xref: /freebsd/sys/kern/kern_proc.c (revision d34048812292b714a0bf99967270d18fe3097c62)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1989, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)kern_proc.c	8.7 (Berkeley) 2/14/95
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 #include "opt_ddb.h"
38 #include "opt_ktrace.h"
39 #include "opt_kstack_pages.h"
40 #include "opt_stack.h"
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/elf.h>
45 #include <sys/eventhandler.h>
46 #include <sys/exec.h>
47 #include <sys/jail.h>
48 #include <sys/kernel.h>
49 #include <sys/limits.h>
50 #include <sys/lock.h>
51 #include <sys/loginclass.h>
52 #include <sys/malloc.h>
53 #include <sys/mman.h>
54 #include <sys/mount.h>
55 #include <sys/mutex.h>
56 #include <sys/proc.h>
57 #include <sys/ptrace.h>
58 #include <sys/refcount.h>
59 #include <sys/resourcevar.h>
60 #include <sys/rwlock.h>
61 #include <sys/sbuf.h>
62 #include <sys/sysent.h>
63 #include <sys/sched.h>
64 #include <sys/smp.h>
65 #include <sys/stack.h>
66 #include <sys/stat.h>
67 #include <sys/sysctl.h>
68 #include <sys/filedesc.h>
69 #include <sys/tty.h>
70 #include <sys/signalvar.h>
71 #include <sys/sdt.h>
72 #include <sys/sx.h>
73 #include <sys/user.h>
74 #include <sys/vnode.h>
75 #include <sys/wait.h>
76 
77 #ifdef DDB
78 #include <ddb/ddb.h>
79 #endif
80 
81 #include <vm/vm.h>
82 #include <vm/vm_param.h>
83 #include <vm/vm_extern.h>
84 #include <vm/pmap.h>
85 #include <vm/vm_map.h>
86 #include <vm/vm_object.h>
87 #include <vm/vm_page.h>
88 #include <vm/uma.h>
89 
90 #ifdef COMPAT_FREEBSD32
91 #include <compat/freebsd32/freebsd32.h>
92 #include <compat/freebsd32/freebsd32_util.h>
93 #endif
94 
95 SDT_PROVIDER_DEFINE(proc);
96 
97 MALLOC_DEFINE(M_PGRP, "pgrp", "process group header");
98 MALLOC_DEFINE(M_SESSION, "session", "session header");
99 static MALLOC_DEFINE(M_PROC, "proc", "Proc structures");
100 MALLOC_DEFINE(M_SUBPROC, "subproc", "Proc sub-structures");
101 
102 static void doenterpgrp(struct proc *, struct pgrp *);
103 static void orphanpg(struct pgrp *pg);
104 static void fill_kinfo_aggregate(struct proc *p, struct kinfo_proc *kp);
105 static void fill_kinfo_proc_only(struct proc *p, struct kinfo_proc *kp);
106 static void fill_kinfo_thread(struct thread *td, struct kinfo_proc *kp,
107     int preferthread);
108 static void pgadjustjobc(struct pgrp *pgrp, int entering);
109 static void pgdelete(struct pgrp *);
110 static int proc_ctor(void *mem, int size, void *arg, int flags);
111 static void proc_dtor(void *mem, int size, void *arg);
112 static int proc_init(void *mem, int size, int flags);
113 static void proc_fini(void *mem, int size);
114 static void pargs_free(struct pargs *pa);
115 
116 /*
117  * Other process lists
118  */
119 struct pidhashhead *pidhashtbl;
120 struct sx *pidhashtbl_lock;
121 u_long pidhash;
122 u_long pidhashlock;
123 struct pgrphashhead *pgrphashtbl;
124 u_long pgrphash;
125 struct proclist allproc;
126 struct proclist zombproc;
127 struct sx __exclusive_cache_line allproc_lock;
128 struct sx __exclusive_cache_line proctree_lock;
129 struct mtx __exclusive_cache_line ppeers_lock;
130 uma_zone_t proc_zone;
131 
132 /*
133  * The offset of various fields in struct proc and struct thread.
134  * These are used by kernel debuggers to enumerate kernel threads and
135  * processes.
136  */
137 const int proc_off_p_pid = offsetof(struct proc, p_pid);
138 const int proc_off_p_comm = offsetof(struct proc, p_comm);
139 const int proc_off_p_list = offsetof(struct proc, p_list);
140 const int proc_off_p_threads = offsetof(struct proc, p_threads);
141 const int thread_off_td_tid = offsetof(struct thread, td_tid);
142 const int thread_off_td_name = offsetof(struct thread, td_name);
143 const int thread_off_td_oncpu = offsetof(struct thread, td_oncpu);
144 const int thread_off_td_pcb = offsetof(struct thread, td_pcb);
145 const int thread_off_td_plist = offsetof(struct thread, td_plist);
146 
147 EVENTHANDLER_LIST_DEFINE(process_ctor);
148 EVENTHANDLER_LIST_DEFINE(process_dtor);
149 EVENTHANDLER_LIST_DEFINE(process_init);
150 EVENTHANDLER_LIST_DEFINE(process_fini);
151 EVENTHANDLER_LIST_DEFINE(process_exit);
152 EVENTHANDLER_LIST_DEFINE(process_fork);
153 EVENTHANDLER_LIST_DEFINE(process_exec);
154 
155 EVENTHANDLER_LIST_DECLARE(thread_ctor);
156 EVENTHANDLER_LIST_DECLARE(thread_dtor);
157 
158 int kstack_pages = KSTACK_PAGES;
159 SYSCTL_INT(_kern, OID_AUTO, kstack_pages, CTLFLAG_RD, &kstack_pages, 0,
160     "Kernel stack size in pages");
161 static int vmmap_skip_res_cnt = 0;
162 SYSCTL_INT(_kern, OID_AUTO, proc_vmmap_skip_resident_count, CTLFLAG_RW,
163     &vmmap_skip_res_cnt, 0,
164     "Skip calculation of the pages resident count in kern.proc.vmmap");
165 
166 CTASSERT(sizeof(struct kinfo_proc) == KINFO_PROC_SIZE);
167 #ifdef COMPAT_FREEBSD32
168 CTASSERT(sizeof(struct kinfo_proc32) == KINFO_PROC32_SIZE);
169 #endif
170 
171 /*
172  * Initialize global process hashing structures.
173  */
174 void
175 procinit(void)
176 {
177 	u_long i;
178 
179 	sx_init(&allproc_lock, "allproc");
180 	sx_init(&proctree_lock, "proctree");
181 	mtx_init(&ppeers_lock, "p_peers", NULL, MTX_DEF);
182 	LIST_INIT(&allproc);
183 	LIST_INIT(&zombproc);
184 	pidhashtbl = hashinit(maxproc / 4, M_PROC, &pidhash);
185 	pidhashlock = (pidhash + 1) / 64;
186 	if (pidhashlock > 0)
187 		pidhashlock--;
188 	pidhashtbl_lock = malloc(sizeof(*pidhashtbl_lock) * (pidhashlock + 1),
189 	    M_PROC, M_WAITOK | M_ZERO);
190 	for (i = 0; i < pidhashlock + 1; i++)
191 		sx_init(&pidhashtbl_lock[i], "pidhash");
192 	pgrphashtbl = hashinit(maxproc / 4, M_PROC, &pgrphash);
193 	proc_zone = uma_zcreate("PROC", sched_sizeof_proc(),
194 	    proc_ctor, proc_dtor, proc_init, proc_fini,
195 	    UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
196 	uihashinit();
197 }
198 
199 /*
200  * Prepare a proc for use.
201  */
202 static int
203 proc_ctor(void *mem, int size, void *arg, int flags)
204 {
205 	struct proc *p;
206 	struct thread *td;
207 
208 	p = (struct proc *)mem;
209 	EVENTHANDLER_DIRECT_INVOKE(process_ctor, p);
210 	td = FIRST_THREAD_IN_PROC(p);
211 	if (td != NULL) {
212 		/* Make sure all thread constructors are executed */
213 		EVENTHANDLER_DIRECT_INVOKE(thread_ctor, td);
214 	}
215 	return (0);
216 }
217 
218 /*
219  * Reclaim a proc after use.
220  */
221 static void
222 proc_dtor(void *mem, int size, void *arg)
223 {
224 	struct proc *p;
225 	struct thread *td;
226 
227 	/* INVARIANTS checks go here */
228 	p = (struct proc *)mem;
229 	td = FIRST_THREAD_IN_PROC(p);
230 	if (td != NULL) {
231 #ifdef INVARIANTS
232 		KASSERT((p->p_numthreads == 1),
233 		    ("bad number of threads in exiting process"));
234 		KASSERT(STAILQ_EMPTY(&p->p_ktr), ("proc_dtor: non-empty p_ktr"));
235 #endif
236 		/* Free all OSD associated to this thread. */
237 		osd_thread_exit(td);
238 		td_softdep_cleanup(td);
239 		MPASS(td->td_su == NULL);
240 
241 		/* Make sure all thread destructors are executed */
242 		EVENTHANDLER_DIRECT_INVOKE(thread_dtor, td);
243 	}
244 	EVENTHANDLER_DIRECT_INVOKE(process_dtor, p);
245 	if (p->p_ksi != NULL)
246 		KASSERT(! KSI_ONQ(p->p_ksi), ("SIGCHLD queue"));
247 }
248 
249 /*
250  * Initialize type-stable parts of a proc (when newly created).
251  */
252 static int
253 proc_init(void *mem, int size, int flags)
254 {
255 	struct proc *p;
256 
257 	p = (struct proc *)mem;
258 	mtx_init(&p->p_mtx, "process lock", NULL, MTX_DEF | MTX_DUPOK | MTX_NEW);
259 	mtx_init(&p->p_slock, "process slock", NULL, MTX_SPIN | MTX_NEW);
260 	mtx_init(&p->p_statmtx, "pstatl", NULL, MTX_SPIN | MTX_NEW);
261 	mtx_init(&p->p_itimmtx, "pitiml", NULL, MTX_SPIN | MTX_NEW);
262 	mtx_init(&p->p_profmtx, "pprofl", NULL, MTX_SPIN | MTX_NEW);
263 	cv_init(&p->p_pwait, "ppwait");
264 	TAILQ_INIT(&p->p_threads);	     /* all threads in proc */
265 	EVENTHANDLER_DIRECT_INVOKE(process_init, p);
266 	p->p_stats = pstats_alloc();
267 	p->p_pgrp = NULL;
268 	return (0);
269 }
270 
271 /*
272  * UMA should ensure that this function is never called.
273  * Freeing a proc structure would violate type stability.
274  */
275 static void
276 proc_fini(void *mem, int size)
277 {
278 #ifdef notnow
279 	struct proc *p;
280 
281 	p = (struct proc *)mem;
282 	EVENTHANDLER_DIRECT_INVOKE(process_fini, p);
283 	pstats_free(p->p_stats);
284 	thread_free(FIRST_THREAD_IN_PROC(p));
285 	mtx_destroy(&p->p_mtx);
286 	if (p->p_ksi != NULL)
287 		ksiginfo_free(p->p_ksi);
288 #else
289 	panic("proc reclaimed");
290 #endif
291 }
292 
293 /*
294  * Is p an inferior of the current process?
295  */
296 int
297 inferior(struct proc *p)
298 {
299 
300 	sx_assert(&proctree_lock, SX_LOCKED);
301 	PROC_LOCK_ASSERT(p, MA_OWNED);
302 	for (; p != curproc; p = proc_realparent(p)) {
303 		if (p->p_pid == 0)
304 			return (0);
305 	}
306 	return (1);
307 }
308 
309 /*
310  * Locate a process by number.
311  *
312  * By not returning processes in the PRS_NEW state, we allow callers to avoid
313  * testing for that condition to avoid dereferencing p_ucred, et al.
314  */
315 static __always_inline struct proc *
316 _pfind(pid_t pid, bool zombie)
317 {
318 	struct proc *p;
319 
320 	p = curproc;
321 	if (p->p_pid == pid) {
322 		PROC_LOCK(p);
323 		return (p);
324 	}
325 	sx_slock(PIDHASHLOCK(pid));
326 	LIST_FOREACH(p, PIDHASH(pid), p_hash) {
327 		if (p->p_pid == pid) {
328 			PROC_LOCK(p);
329 			if (p->p_state == PRS_NEW ||
330 			    (zombie && p->p_state == PRS_ZOMBIE)) {
331 				PROC_UNLOCK(p);
332 				p = NULL;
333 			}
334 			break;
335 		}
336 	}
337 	sx_sunlock(PIDHASHLOCK(pid));
338 	return (p);
339 }
340 
341 struct proc *
342 pfind(pid_t pid)
343 {
344 
345 	return (_pfind(pid, false));
346 }
347 
348 /*
349  * Same as pfind but allow zombies.
350  */
351 struct proc *
352 pfind_any(pid_t pid)
353 {
354 
355 	return (_pfind(pid, true));
356 }
357 
358 static struct proc *
359 pfind_tid(pid_t tid)
360 {
361 	struct proc *p;
362 	struct thread *td;
363 
364 	sx_slock(&allproc_lock);
365 	FOREACH_PROC_IN_SYSTEM(p) {
366 		PROC_LOCK(p);
367 		if (p->p_state == PRS_NEW) {
368 			PROC_UNLOCK(p);
369 			continue;
370 		}
371 		FOREACH_THREAD_IN_PROC(p, td) {
372 			if (td->td_tid == tid)
373 				goto found;
374 		}
375 		PROC_UNLOCK(p);
376 	}
377 found:
378 	sx_sunlock(&allproc_lock);
379 	return (p);
380 }
381 
382 /*
383  * Locate a process group by number.
384  * The caller must hold proctree_lock.
385  */
386 struct pgrp *
387 pgfind(pid_t pgid)
388 {
389 	struct pgrp *pgrp;
390 
391 	sx_assert(&proctree_lock, SX_LOCKED);
392 
393 	LIST_FOREACH(pgrp, PGRPHASH(pgid), pg_hash) {
394 		if (pgrp->pg_id == pgid) {
395 			PGRP_LOCK(pgrp);
396 			return (pgrp);
397 		}
398 	}
399 	return (NULL);
400 }
401 
402 /*
403  * Locate process and do additional manipulations, depending on flags.
404  */
405 int
406 pget(pid_t pid, int flags, struct proc **pp)
407 {
408 	struct proc *p;
409 	int error;
410 
411 	p = curproc;
412 	if (p->p_pid == pid) {
413 		PROC_LOCK(p);
414 	} else {
415 		p = NULL;
416 		if (pid <= PID_MAX) {
417 			if ((flags & PGET_NOTWEXIT) == 0)
418 				p = pfind_any(pid);
419 			else
420 				p = pfind(pid);
421 		} else if ((flags & PGET_NOTID) == 0) {
422 			p = pfind_tid(pid);
423 		}
424 		if (p == NULL)
425 			return (ESRCH);
426 		if ((flags & PGET_CANSEE) != 0) {
427 			error = p_cansee(curthread, p);
428 			if (error != 0)
429 				goto errout;
430 		}
431 	}
432 	if ((flags & PGET_CANDEBUG) != 0) {
433 		error = p_candebug(curthread, p);
434 		if (error != 0)
435 			goto errout;
436 	}
437 	if ((flags & PGET_ISCURRENT) != 0 && curproc != p) {
438 		error = EPERM;
439 		goto errout;
440 	}
441 	if ((flags & PGET_NOTWEXIT) != 0 && (p->p_flag & P_WEXIT) != 0) {
442 		error = ESRCH;
443 		goto errout;
444 	}
445 	if ((flags & PGET_NOTINEXEC) != 0 && (p->p_flag & P_INEXEC) != 0) {
446 		/*
447 		 * XXXRW: Not clear ESRCH is the right error during proc
448 		 * execve().
449 		 */
450 		error = ESRCH;
451 		goto errout;
452 	}
453 	if ((flags & PGET_HOLD) != 0) {
454 		_PHOLD(p);
455 		PROC_UNLOCK(p);
456 	}
457 	*pp = p;
458 	return (0);
459 errout:
460 	PROC_UNLOCK(p);
461 	return (error);
462 }
463 
464 /*
465  * Create a new process group.
466  * pgid must be equal to the pid of p.
467  * Begin a new session if required.
468  */
469 int
470 enterpgrp(struct proc *p, pid_t pgid, struct pgrp *pgrp, struct session *sess)
471 {
472 
473 	sx_assert(&proctree_lock, SX_XLOCKED);
474 
475 	KASSERT(pgrp != NULL, ("enterpgrp: pgrp == NULL"));
476 	KASSERT(p->p_pid == pgid,
477 	    ("enterpgrp: new pgrp and pid != pgid"));
478 	KASSERT(pgfind(pgid) == NULL,
479 	    ("enterpgrp: pgrp with pgid exists"));
480 	KASSERT(!SESS_LEADER(p),
481 	    ("enterpgrp: session leader attempted setpgrp"));
482 
483 	mtx_init(&pgrp->pg_mtx, "process group", NULL, MTX_DEF | MTX_DUPOK);
484 
485 	if (sess != NULL) {
486 		/*
487 		 * new session
488 		 */
489 		mtx_init(&sess->s_mtx, "session", NULL, MTX_DEF);
490 		PROC_LOCK(p);
491 		p->p_flag &= ~P_CONTROLT;
492 		PROC_UNLOCK(p);
493 		PGRP_LOCK(pgrp);
494 		sess->s_leader = p;
495 		sess->s_sid = p->p_pid;
496 		refcount_init(&sess->s_count, 1);
497 		sess->s_ttyvp = NULL;
498 		sess->s_ttydp = NULL;
499 		sess->s_ttyp = NULL;
500 		bcopy(p->p_session->s_login, sess->s_login,
501 			    sizeof(sess->s_login));
502 		pgrp->pg_session = sess;
503 		KASSERT(p == curproc,
504 		    ("enterpgrp: mksession and p != curproc"));
505 	} else {
506 		pgrp->pg_session = p->p_session;
507 		sess_hold(pgrp->pg_session);
508 		PGRP_LOCK(pgrp);
509 	}
510 	pgrp->pg_id = pgid;
511 	LIST_INIT(&pgrp->pg_members);
512 
513 	/*
514 	 * As we have an exclusive lock of proctree_lock,
515 	 * this should not deadlock.
516 	 */
517 	LIST_INSERT_HEAD(PGRPHASH(pgid), pgrp, pg_hash);
518 	pgrp->pg_jobc = 0;
519 	SLIST_INIT(&pgrp->pg_sigiolst);
520 	PGRP_UNLOCK(pgrp);
521 
522 	doenterpgrp(p, pgrp);
523 
524 	return (0);
525 }
526 
527 /*
528  * Move p to an existing process group
529  */
530 int
531 enterthispgrp(struct proc *p, struct pgrp *pgrp)
532 {
533 
534 	sx_assert(&proctree_lock, SX_XLOCKED);
535 	PROC_LOCK_ASSERT(p, MA_NOTOWNED);
536 	PGRP_LOCK_ASSERT(pgrp, MA_NOTOWNED);
537 	PGRP_LOCK_ASSERT(p->p_pgrp, MA_NOTOWNED);
538 	SESS_LOCK_ASSERT(p->p_session, MA_NOTOWNED);
539 	KASSERT(pgrp->pg_session == p->p_session,
540 		("%s: pgrp's session %p, p->p_session %p.\n",
541 		__func__,
542 		pgrp->pg_session,
543 		p->p_session));
544 	KASSERT(pgrp != p->p_pgrp,
545 		("%s: p belongs to pgrp.", __func__));
546 
547 	doenterpgrp(p, pgrp);
548 
549 	return (0);
550 }
551 
552 /*
553  * Move p to a process group
554  */
555 static void
556 doenterpgrp(struct proc *p, struct pgrp *pgrp)
557 {
558 	struct pgrp *savepgrp;
559 
560 	sx_assert(&proctree_lock, SX_XLOCKED);
561 	PROC_LOCK_ASSERT(p, MA_NOTOWNED);
562 	PGRP_LOCK_ASSERT(pgrp, MA_NOTOWNED);
563 	PGRP_LOCK_ASSERT(p->p_pgrp, MA_NOTOWNED);
564 	SESS_LOCK_ASSERT(p->p_session, MA_NOTOWNED);
565 
566 	savepgrp = p->p_pgrp;
567 
568 	/*
569 	 * Adjust eligibility of affected pgrps to participate in job control.
570 	 * Increment eligibility counts before decrementing, otherwise we
571 	 * could reach 0 spuriously during the first call.
572 	 */
573 	fixjobc(p, pgrp, 1);
574 	fixjobc(p, p->p_pgrp, 0);
575 
576 	PGRP_LOCK(pgrp);
577 	PGRP_LOCK(savepgrp);
578 	PROC_LOCK(p);
579 	LIST_REMOVE(p, p_pglist);
580 	p->p_pgrp = pgrp;
581 	PROC_UNLOCK(p);
582 	LIST_INSERT_HEAD(&pgrp->pg_members, p, p_pglist);
583 	PGRP_UNLOCK(savepgrp);
584 	PGRP_UNLOCK(pgrp);
585 	if (LIST_EMPTY(&savepgrp->pg_members))
586 		pgdelete(savepgrp);
587 }
588 
589 /*
590  * remove process from process group
591  */
592 int
593 leavepgrp(struct proc *p)
594 {
595 	struct pgrp *savepgrp;
596 
597 	sx_assert(&proctree_lock, SX_XLOCKED);
598 	savepgrp = p->p_pgrp;
599 	PGRP_LOCK(savepgrp);
600 	PROC_LOCK(p);
601 	LIST_REMOVE(p, p_pglist);
602 	p->p_pgrp = NULL;
603 	PROC_UNLOCK(p);
604 	PGRP_UNLOCK(savepgrp);
605 	if (LIST_EMPTY(&savepgrp->pg_members))
606 		pgdelete(savepgrp);
607 	return (0);
608 }
609 
610 /*
611  * delete a process group
612  */
613 static void
614 pgdelete(struct pgrp *pgrp)
615 {
616 	struct session *savesess;
617 	struct tty *tp;
618 
619 	sx_assert(&proctree_lock, SX_XLOCKED);
620 	PGRP_LOCK_ASSERT(pgrp, MA_NOTOWNED);
621 	SESS_LOCK_ASSERT(pgrp->pg_session, MA_NOTOWNED);
622 
623 	/*
624 	 * Reset any sigio structures pointing to us as a result of
625 	 * F_SETOWN with our pgid.
626 	 */
627 	funsetownlst(&pgrp->pg_sigiolst);
628 
629 	PGRP_LOCK(pgrp);
630 	tp = pgrp->pg_session->s_ttyp;
631 	LIST_REMOVE(pgrp, pg_hash);
632 	savesess = pgrp->pg_session;
633 	PGRP_UNLOCK(pgrp);
634 
635 	/* Remove the reference to the pgrp before deallocating it. */
636 	if (tp != NULL) {
637 		tty_lock(tp);
638 		tty_rel_pgrp(tp, pgrp);
639 	}
640 
641 	mtx_destroy(&pgrp->pg_mtx);
642 	free(pgrp, M_PGRP);
643 	sess_release(savesess);
644 }
645 
646 static void
647 pgadjustjobc(struct pgrp *pgrp, int entering)
648 {
649 
650 	PGRP_LOCK(pgrp);
651 	if (entering)
652 		pgrp->pg_jobc++;
653 	else {
654 		--pgrp->pg_jobc;
655 		if (pgrp->pg_jobc == 0)
656 			orphanpg(pgrp);
657 	}
658 	PGRP_UNLOCK(pgrp);
659 }
660 
661 /*
662  * Adjust pgrp jobc counters when specified process changes process group.
663  * We count the number of processes in each process group that "qualify"
664  * the group for terminal job control (those with a parent in a different
665  * process group of the same session).  If that count reaches zero, the
666  * process group becomes orphaned.  Check both the specified process'
667  * process group and that of its children.
668  * entering == 0 => p is leaving specified group.
669  * entering == 1 => p is entering specified group.
670  */
671 void
672 fixjobc(struct proc *p, struct pgrp *pgrp, int entering)
673 {
674 	struct pgrp *hispgrp;
675 	struct session *mysession;
676 	struct proc *q;
677 
678 	sx_assert(&proctree_lock, SX_LOCKED);
679 	PROC_LOCK_ASSERT(p, MA_NOTOWNED);
680 	PGRP_LOCK_ASSERT(pgrp, MA_NOTOWNED);
681 	SESS_LOCK_ASSERT(pgrp->pg_session, MA_NOTOWNED);
682 
683 	/*
684 	 * Check p's parent to see whether p qualifies its own process
685 	 * group; if so, adjust count for p's process group.
686 	 */
687 	mysession = pgrp->pg_session;
688 	if ((hispgrp = p->p_pptr->p_pgrp) != pgrp &&
689 	    hispgrp->pg_session == mysession)
690 		pgadjustjobc(pgrp, entering);
691 
692 	/*
693 	 * Check this process' children to see whether they qualify
694 	 * their process groups; if so, adjust counts for children's
695 	 * process groups.
696 	 */
697 	LIST_FOREACH(q, &p->p_children, p_sibling) {
698 		hispgrp = q->p_pgrp;
699 		if (hispgrp == pgrp ||
700 		    hispgrp->pg_session != mysession)
701 			continue;
702 		if (q->p_state == PRS_ZOMBIE)
703 			continue;
704 		pgadjustjobc(hispgrp, entering);
705 	}
706 }
707 
708 void
709 killjobc(void)
710 {
711 	struct session *sp;
712 	struct tty *tp;
713 	struct proc *p;
714 	struct vnode *ttyvp;
715 
716 	p = curproc;
717 	MPASS(p->p_flag & P_WEXIT);
718 	/*
719 	 * Do a quick check to see if there is anything to do with the
720 	 * proctree_lock held. pgrp and LIST_EMPTY checks are for fixjobc().
721 	 */
722 	PROC_LOCK(p);
723 	if (!SESS_LEADER(p) &&
724 	    (p->p_pgrp == p->p_pptr->p_pgrp) &&
725 	    LIST_EMPTY(&p->p_children)) {
726 		PROC_UNLOCK(p);
727 		return;
728 	}
729 	PROC_UNLOCK(p);
730 
731 	sx_xlock(&proctree_lock);
732 	if (SESS_LEADER(p)) {
733 		sp = p->p_session;
734 
735 		/*
736 		 * s_ttyp is not zero'd; we use this to indicate that
737 		 * the session once had a controlling terminal. (for
738 		 * logging and informational purposes)
739 		 */
740 		SESS_LOCK(sp);
741 		ttyvp = sp->s_ttyvp;
742 		tp = sp->s_ttyp;
743 		sp->s_ttyvp = NULL;
744 		sp->s_ttydp = NULL;
745 		sp->s_leader = NULL;
746 		SESS_UNLOCK(sp);
747 
748 		/*
749 		 * Signal foreground pgrp and revoke access to
750 		 * controlling terminal if it has not been revoked
751 		 * already.
752 		 *
753 		 * Because the TTY may have been revoked in the mean
754 		 * time and could already have a new session associated
755 		 * with it, make sure we don't send a SIGHUP to a
756 		 * foreground process group that does not belong to this
757 		 * session.
758 		 */
759 
760 		if (tp != NULL) {
761 			tty_lock(tp);
762 			if (tp->t_session == sp)
763 				tty_signal_pgrp(tp, SIGHUP);
764 			tty_unlock(tp);
765 		}
766 
767 		if (ttyvp != NULL) {
768 			sx_xunlock(&proctree_lock);
769 			if (vn_lock(ttyvp, LK_EXCLUSIVE) == 0) {
770 				VOP_REVOKE(ttyvp, REVOKEALL);
771 				VOP_UNLOCK(ttyvp, 0);
772 			}
773 			vrele(ttyvp);
774 			sx_xlock(&proctree_lock);
775 		}
776 	}
777 	fixjobc(p, p->p_pgrp, 0);
778 	sx_xunlock(&proctree_lock);
779 }
780 
781 /*
782  * A process group has become orphaned;
783  * if there are any stopped processes in the group,
784  * hang-up all process in that group.
785  */
786 static void
787 orphanpg(struct pgrp *pg)
788 {
789 	struct proc *p;
790 
791 	PGRP_LOCK_ASSERT(pg, MA_OWNED);
792 
793 	LIST_FOREACH(p, &pg->pg_members, p_pglist) {
794 		PROC_LOCK(p);
795 		if (P_SHOULDSTOP(p) == P_STOPPED_SIG) {
796 			PROC_UNLOCK(p);
797 			LIST_FOREACH(p, &pg->pg_members, p_pglist) {
798 				PROC_LOCK(p);
799 				kern_psignal(p, SIGHUP);
800 				kern_psignal(p, SIGCONT);
801 				PROC_UNLOCK(p);
802 			}
803 			return;
804 		}
805 		PROC_UNLOCK(p);
806 	}
807 }
808 
809 void
810 sess_hold(struct session *s)
811 {
812 
813 	refcount_acquire(&s->s_count);
814 }
815 
816 void
817 sess_release(struct session *s)
818 {
819 
820 	if (refcount_release(&s->s_count)) {
821 		if (s->s_ttyp != NULL) {
822 			tty_lock(s->s_ttyp);
823 			tty_rel_sess(s->s_ttyp, s);
824 		}
825 		mtx_destroy(&s->s_mtx);
826 		free(s, M_SESSION);
827 	}
828 }
829 
830 #ifdef DDB
831 
832 DB_SHOW_COMMAND(pgrpdump, pgrpdump)
833 {
834 	struct pgrp *pgrp;
835 	struct proc *p;
836 	int i;
837 
838 	for (i = 0; i <= pgrphash; i++) {
839 		if (!LIST_EMPTY(&pgrphashtbl[i])) {
840 			printf("\tindx %d\n", i);
841 			LIST_FOREACH(pgrp, &pgrphashtbl[i], pg_hash) {
842 				printf(
843 			"\tpgrp %p, pgid %ld, sess %p, sesscnt %d, mem %p\n",
844 				    (void *)pgrp, (long)pgrp->pg_id,
845 				    (void *)pgrp->pg_session,
846 				    pgrp->pg_session->s_count,
847 				    (void *)LIST_FIRST(&pgrp->pg_members));
848 				LIST_FOREACH(p, &pgrp->pg_members, p_pglist) {
849 					printf("\t\tpid %ld addr %p pgrp %p\n",
850 					    (long)p->p_pid, (void *)p,
851 					    (void *)p->p_pgrp);
852 				}
853 			}
854 		}
855 	}
856 }
857 #endif /* DDB */
858 
859 /*
860  * Calculate the kinfo_proc members which contain process-wide
861  * informations.
862  * Must be called with the target process locked.
863  */
864 static void
865 fill_kinfo_aggregate(struct proc *p, struct kinfo_proc *kp)
866 {
867 	struct thread *td;
868 
869 	PROC_LOCK_ASSERT(p, MA_OWNED);
870 
871 	kp->ki_estcpu = 0;
872 	kp->ki_pctcpu = 0;
873 	FOREACH_THREAD_IN_PROC(p, td) {
874 		thread_lock(td);
875 		kp->ki_pctcpu += sched_pctcpu(td);
876 		kp->ki_estcpu += sched_estcpu(td);
877 		thread_unlock(td);
878 	}
879 }
880 
881 /*
882  * Clear kinfo_proc and fill in any information that is common
883  * to all threads in the process.
884  * Must be called with the target process locked.
885  */
886 static void
887 fill_kinfo_proc_only(struct proc *p, struct kinfo_proc *kp)
888 {
889 	struct thread *td0;
890 	struct tty *tp;
891 	struct session *sp;
892 	struct ucred *cred;
893 	struct sigacts *ps;
894 	struct timeval boottime;
895 
896 	PROC_LOCK_ASSERT(p, MA_OWNED);
897 	bzero(kp, sizeof(*kp));
898 
899 	kp->ki_structsize = sizeof(*kp);
900 	kp->ki_paddr = p;
901 	kp->ki_addr =/* p->p_addr; */0; /* XXX */
902 	kp->ki_args = p->p_args;
903 	kp->ki_textvp = p->p_textvp;
904 #ifdef KTRACE
905 	kp->ki_tracep = p->p_tracevp;
906 	kp->ki_traceflag = p->p_traceflag;
907 #endif
908 	kp->ki_fd = p->p_fd;
909 	kp->ki_vmspace = p->p_vmspace;
910 	kp->ki_flag = p->p_flag;
911 	kp->ki_flag2 = p->p_flag2;
912 	cred = p->p_ucred;
913 	if (cred) {
914 		kp->ki_uid = cred->cr_uid;
915 		kp->ki_ruid = cred->cr_ruid;
916 		kp->ki_svuid = cred->cr_svuid;
917 		kp->ki_cr_flags = 0;
918 		if (cred->cr_flags & CRED_FLAG_CAPMODE)
919 			kp->ki_cr_flags |= KI_CRF_CAPABILITY_MODE;
920 		/* XXX bde doesn't like KI_NGROUPS */
921 		if (cred->cr_ngroups > KI_NGROUPS) {
922 			kp->ki_ngroups = KI_NGROUPS;
923 			kp->ki_cr_flags |= KI_CRF_GRP_OVERFLOW;
924 		} else
925 			kp->ki_ngroups = cred->cr_ngroups;
926 		bcopy(cred->cr_groups, kp->ki_groups,
927 		    kp->ki_ngroups * sizeof(gid_t));
928 		kp->ki_rgid = cred->cr_rgid;
929 		kp->ki_svgid = cred->cr_svgid;
930 		/* If jailed(cred), emulate the old P_JAILED flag. */
931 		if (jailed(cred)) {
932 			kp->ki_flag |= P_JAILED;
933 			/* If inside the jail, use 0 as a jail ID. */
934 			if (cred->cr_prison != curthread->td_ucred->cr_prison)
935 				kp->ki_jid = cred->cr_prison->pr_id;
936 		}
937 		strlcpy(kp->ki_loginclass, cred->cr_loginclass->lc_name,
938 		    sizeof(kp->ki_loginclass));
939 	}
940 	ps = p->p_sigacts;
941 	if (ps) {
942 		mtx_lock(&ps->ps_mtx);
943 		kp->ki_sigignore = ps->ps_sigignore;
944 		kp->ki_sigcatch = ps->ps_sigcatch;
945 		mtx_unlock(&ps->ps_mtx);
946 	}
947 	if (p->p_state != PRS_NEW &&
948 	    p->p_state != PRS_ZOMBIE &&
949 	    p->p_vmspace != NULL) {
950 		struct vmspace *vm = p->p_vmspace;
951 
952 		kp->ki_size = vm->vm_map.size;
953 		kp->ki_rssize = vmspace_resident_count(vm); /*XXX*/
954 		FOREACH_THREAD_IN_PROC(p, td0) {
955 			if (!TD_IS_SWAPPED(td0))
956 				kp->ki_rssize += td0->td_kstack_pages;
957 		}
958 		kp->ki_swrss = vm->vm_swrss;
959 		kp->ki_tsize = vm->vm_tsize;
960 		kp->ki_dsize = vm->vm_dsize;
961 		kp->ki_ssize = vm->vm_ssize;
962 	} else if (p->p_state == PRS_ZOMBIE)
963 		kp->ki_stat = SZOMB;
964 	if (kp->ki_flag & P_INMEM)
965 		kp->ki_sflag = PS_INMEM;
966 	else
967 		kp->ki_sflag = 0;
968 	/* Calculate legacy swtime as seconds since 'swtick'. */
969 	kp->ki_swtime = (ticks - p->p_swtick) / hz;
970 	kp->ki_pid = p->p_pid;
971 	kp->ki_nice = p->p_nice;
972 	kp->ki_fibnum = p->p_fibnum;
973 	kp->ki_start = p->p_stats->p_start;
974 	getboottime(&boottime);
975 	timevaladd(&kp->ki_start, &boottime);
976 	PROC_STATLOCK(p);
977 	rufetch(p, &kp->ki_rusage);
978 	kp->ki_runtime = cputick2usec(p->p_rux.rux_runtime);
979 	calcru(p, &kp->ki_rusage.ru_utime, &kp->ki_rusage.ru_stime);
980 	PROC_STATUNLOCK(p);
981 	calccru(p, &kp->ki_childutime, &kp->ki_childstime);
982 	/* Some callers want child times in a single value. */
983 	kp->ki_childtime = kp->ki_childstime;
984 	timevaladd(&kp->ki_childtime, &kp->ki_childutime);
985 
986 	FOREACH_THREAD_IN_PROC(p, td0)
987 		kp->ki_cow += td0->td_cow;
988 
989 	tp = NULL;
990 	if (p->p_pgrp) {
991 		kp->ki_pgid = p->p_pgrp->pg_id;
992 		kp->ki_jobc = p->p_pgrp->pg_jobc;
993 		sp = p->p_pgrp->pg_session;
994 
995 		if (sp != NULL) {
996 			kp->ki_sid = sp->s_sid;
997 			SESS_LOCK(sp);
998 			strlcpy(kp->ki_login, sp->s_login,
999 			    sizeof(kp->ki_login));
1000 			if (sp->s_ttyvp)
1001 				kp->ki_kiflag |= KI_CTTY;
1002 			if (SESS_LEADER(p))
1003 				kp->ki_kiflag |= KI_SLEADER;
1004 			/* XXX proctree_lock */
1005 			tp = sp->s_ttyp;
1006 			SESS_UNLOCK(sp);
1007 		}
1008 	}
1009 	if ((p->p_flag & P_CONTROLT) && tp != NULL) {
1010 		kp->ki_tdev = tty_udev(tp);
1011 		kp->ki_tdev_freebsd11 = kp->ki_tdev; /* truncate */
1012 		kp->ki_tpgid = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
1013 		if (tp->t_session)
1014 			kp->ki_tsid = tp->t_session->s_sid;
1015 	} else {
1016 		kp->ki_tdev = NODEV;
1017 		kp->ki_tdev_freebsd11 = kp->ki_tdev; /* truncate */
1018 	}
1019 	if (p->p_comm[0] != '\0')
1020 		strlcpy(kp->ki_comm, p->p_comm, sizeof(kp->ki_comm));
1021 	if (p->p_sysent && p->p_sysent->sv_name != NULL &&
1022 	    p->p_sysent->sv_name[0] != '\0')
1023 		strlcpy(kp->ki_emul, p->p_sysent->sv_name, sizeof(kp->ki_emul));
1024 	kp->ki_siglist = p->p_siglist;
1025 	kp->ki_xstat = KW_EXITCODE(p->p_xexit, p->p_xsig);
1026 	kp->ki_acflag = p->p_acflag;
1027 	kp->ki_lock = p->p_lock;
1028 	if (p->p_pptr) {
1029 		kp->ki_ppid = p->p_oppid;
1030 		if (p->p_flag & P_TRACED)
1031 			kp->ki_tracer = p->p_pptr->p_pid;
1032 	}
1033 }
1034 
1035 /*
1036  * Fill in information that is thread specific.  Must be called with
1037  * target process locked.  If 'preferthread' is set, overwrite certain
1038  * process-related fields that are maintained for both threads and
1039  * processes.
1040  */
1041 static void
1042 fill_kinfo_thread(struct thread *td, struct kinfo_proc *kp, int preferthread)
1043 {
1044 	struct proc *p;
1045 
1046 	p = td->td_proc;
1047 	kp->ki_tdaddr = td;
1048 	PROC_LOCK_ASSERT(p, MA_OWNED);
1049 
1050 	if (preferthread)
1051 		PROC_STATLOCK(p);
1052 	thread_lock(td);
1053 	if (td->td_wmesg != NULL)
1054 		strlcpy(kp->ki_wmesg, td->td_wmesg, sizeof(kp->ki_wmesg));
1055 	else
1056 		bzero(kp->ki_wmesg, sizeof(kp->ki_wmesg));
1057 	if (strlcpy(kp->ki_tdname, td->td_name, sizeof(kp->ki_tdname)) >=
1058 	    sizeof(kp->ki_tdname)) {
1059 		strlcpy(kp->ki_moretdname,
1060 		    td->td_name + sizeof(kp->ki_tdname) - 1,
1061 		    sizeof(kp->ki_moretdname));
1062 	} else {
1063 		bzero(kp->ki_moretdname, sizeof(kp->ki_moretdname));
1064 	}
1065 	if (TD_ON_LOCK(td)) {
1066 		kp->ki_kiflag |= KI_LOCKBLOCK;
1067 		strlcpy(kp->ki_lockname, td->td_lockname,
1068 		    sizeof(kp->ki_lockname));
1069 	} else {
1070 		kp->ki_kiflag &= ~KI_LOCKBLOCK;
1071 		bzero(kp->ki_lockname, sizeof(kp->ki_lockname));
1072 	}
1073 
1074 	if (p->p_state == PRS_NORMAL) { /* approximate. */
1075 		if (TD_ON_RUNQ(td) ||
1076 		    TD_CAN_RUN(td) ||
1077 		    TD_IS_RUNNING(td)) {
1078 			kp->ki_stat = SRUN;
1079 		} else if (P_SHOULDSTOP(p)) {
1080 			kp->ki_stat = SSTOP;
1081 		} else if (TD_IS_SLEEPING(td)) {
1082 			kp->ki_stat = SSLEEP;
1083 		} else if (TD_ON_LOCK(td)) {
1084 			kp->ki_stat = SLOCK;
1085 		} else {
1086 			kp->ki_stat = SWAIT;
1087 		}
1088 	} else if (p->p_state == PRS_ZOMBIE) {
1089 		kp->ki_stat = SZOMB;
1090 	} else {
1091 		kp->ki_stat = SIDL;
1092 	}
1093 
1094 	/* Things in the thread */
1095 	kp->ki_wchan = td->td_wchan;
1096 	kp->ki_pri.pri_level = td->td_priority;
1097 	kp->ki_pri.pri_native = td->td_base_pri;
1098 
1099 	/*
1100 	 * Note: legacy fields; clamp at the old NOCPU value and/or
1101 	 * the maximum u_char CPU value.
1102 	 */
1103 	if (td->td_lastcpu == NOCPU)
1104 		kp->ki_lastcpu_old = NOCPU_OLD;
1105 	else if (td->td_lastcpu > MAXCPU_OLD)
1106 		kp->ki_lastcpu_old = MAXCPU_OLD;
1107 	else
1108 		kp->ki_lastcpu_old = td->td_lastcpu;
1109 
1110 	if (td->td_oncpu == NOCPU)
1111 		kp->ki_oncpu_old = NOCPU_OLD;
1112 	else if (td->td_oncpu > MAXCPU_OLD)
1113 		kp->ki_oncpu_old = MAXCPU_OLD;
1114 	else
1115 		kp->ki_oncpu_old = td->td_oncpu;
1116 
1117 	kp->ki_lastcpu = td->td_lastcpu;
1118 	kp->ki_oncpu = td->td_oncpu;
1119 	kp->ki_tdflags = td->td_flags;
1120 	kp->ki_tid = td->td_tid;
1121 	kp->ki_numthreads = p->p_numthreads;
1122 	kp->ki_pcb = td->td_pcb;
1123 	kp->ki_kstack = (void *)td->td_kstack;
1124 	kp->ki_slptime = (ticks - td->td_slptick) / hz;
1125 	kp->ki_pri.pri_class = td->td_pri_class;
1126 	kp->ki_pri.pri_user = td->td_user_pri;
1127 
1128 	if (preferthread) {
1129 		rufetchtd(td, &kp->ki_rusage);
1130 		kp->ki_runtime = cputick2usec(td->td_rux.rux_runtime);
1131 		kp->ki_pctcpu = sched_pctcpu(td);
1132 		kp->ki_estcpu = sched_estcpu(td);
1133 		kp->ki_cow = td->td_cow;
1134 	}
1135 
1136 	/* We can't get this anymore but ps etc never used it anyway. */
1137 	kp->ki_rqindex = 0;
1138 
1139 	if (preferthread)
1140 		kp->ki_siglist = td->td_siglist;
1141 	kp->ki_sigmask = td->td_sigmask;
1142 	thread_unlock(td);
1143 	if (preferthread)
1144 		PROC_STATUNLOCK(p);
1145 }
1146 
1147 /*
1148  * Fill in a kinfo_proc structure for the specified process.
1149  * Must be called with the target process locked.
1150  */
1151 void
1152 fill_kinfo_proc(struct proc *p, struct kinfo_proc *kp)
1153 {
1154 
1155 	MPASS(FIRST_THREAD_IN_PROC(p) != NULL);
1156 
1157 	fill_kinfo_proc_only(p, kp);
1158 	fill_kinfo_thread(FIRST_THREAD_IN_PROC(p), kp, 0);
1159 	fill_kinfo_aggregate(p, kp);
1160 }
1161 
1162 struct pstats *
1163 pstats_alloc(void)
1164 {
1165 
1166 	return (malloc(sizeof(struct pstats), M_SUBPROC, M_ZERO|M_WAITOK));
1167 }
1168 
1169 /*
1170  * Copy parts of p_stats; zero the rest of p_stats (statistics).
1171  */
1172 void
1173 pstats_fork(struct pstats *src, struct pstats *dst)
1174 {
1175 
1176 	bzero(&dst->pstat_startzero,
1177 	    __rangeof(struct pstats, pstat_startzero, pstat_endzero));
1178 	bcopy(&src->pstat_startcopy, &dst->pstat_startcopy,
1179 	    __rangeof(struct pstats, pstat_startcopy, pstat_endcopy));
1180 }
1181 
1182 void
1183 pstats_free(struct pstats *ps)
1184 {
1185 
1186 	free(ps, M_SUBPROC);
1187 }
1188 
1189 /*
1190  * Locate a zombie process by number
1191  */
1192 struct proc *
1193 zpfind(pid_t pid)
1194 {
1195 	struct proc *p;
1196 
1197 	sx_slock(&allproc_lock);
1198 	LIST_FOREACH(p, &zombproc, p_list) {
1199 		if (p->p_pid == pid) {
1200 			PROC_LOCK(p);
1201 			break;
1202 		}
1203 	}
1204 	sx_sunlock(&allproc_lock);
1205 	return (p);
1206 }
1207 
1208 #ifdef COMPAT_FREEBSD32
1209 
1210 /*
1211  * This function is typically used to copy out the kernel address, so
1212  * it can be replaced by assignment of zero.
1213  */
1214 static inline uint32_t
1215 ptr32_trim(void *ptr)
1216 {
1217 	uintptr_t uptr;
1218 
1219 	uptr = (uintptr_t)ptr;
1220 	return ((uptr > UINT_MAX) ? 0 : uptr);
1221 }
1222 
1223 #define PTRTRIM_CP(src,dst,fld) \
1224 	do { (dst).fld = ptr32_trim((src).fld); } while (0)
1225 
1226 static void
1227 freebsd32_kinfo_proc_out(const struct kinfo_proc *ki, struct kinfo_proc32 *ki32)
1228 {
1229 	int i;
1230 
1231 	bzero(ki32, sizeof(struct kinfo_proc32));
1232 	ki32->ki_structsize = sizeof(struct kinfo_proc32);
1233 	CP(*ki, *ki32, ki_layout);
1234 	PTRTRIM_CP(*ki, *ki32, ki_args);
1235 	PTRTRIM_CP(*ki, *ki32, ki_paddr);
1236 	PTRTRIM_CP(*ki, *ki32, ki_addr);
1237 	PTRTRIM_CP(*ki, *ki32, ki_tracep);
1238 	PTRTRIM_CP(*ki, *ki32, ki_textvp);
1239 	PTRTRIM_CP(*ki, *ki32, ki_fd);
1240 	PTRTRIM_CP(*ki, *ki32, ki_vmspace);
1241 	PTRTRIM_CP(*ki, *ki32, ki_wchan);
1242 	CP(*ki, *ki32, ki_pid);
1243 	CP(*ki, *ki32, ki_ppid);
1244 	CP(*ki, *ki32, ki_pgid);
1245 	CP(*ki, *ki32, ki_tpgid);
1246 	CP(*ki, *ki32, ki_sid);
1247 	CP(*ki, *ki32, ki_tsid);
1248 	CP(*ki, *ki32, ki_jobc);
1249 	CP(*ki, *ki32, ki_tdev);
1250 	CP(*ki, *ki32, ki_tdev_freebsd11);
1251 	CP(*ki, *ki32, ki_siglist);
1252 	CP(*ki, *ki32, ki_sigmask);
1253 	CP(*ki, *ki32, ki_sigignore);
1254 	CP(*ki, *ki32, ki_sigcatch);
1255 	CP(*ki, *ki32, ki_uid);
1256 	CP(*ki, *ki32, ki_ruid);
1257 	CP(*ki, *ki32, ki_svuid);
1258 	CP(*ki, *ki32, ki_rgid);
1259 	CP(*ki, *ki32, ki_svgid);
1260 	CP(*ki, *ki32, ki_ngroups);
1261 	for (i = 0; i < KI_NGROUPS; i++)
1262 		CP(*ki, *ki32, ki_groups[i]);
1263 	CP(*ki, *ki32, ki_size);
1264 	CP(*ki, *ki32, ki_rssize);
1265 	CP(*ki, *ki32, ki_swrss);
1266 	CP(*ki, *ki32, ki_tsize);
1267 	CP(*ki, *ki32, ki_dsize);
1268 	CP(*ki, *ki32, ki_ssize);
1269 	CP(*ki, *ki32, ki_xstat);
1270 	CP(*ki, *ki32, ki_acflag);
1271 	CP(*ki, *ki32, ki_pctcpu);
1272 	CP(*ki, *ki32, ki_estcpu);
1273 	CP(*ki, *ki32, ki_slptime);
1274 	CP(*ki, *ki32, ki_swtime);
1275 	CP(*ki, *ki32, ki_cow);
1276 	CP(*ki, *ki32, ki_runtime);
1277 	TV_CP(*ki, *ki32, ki_start);
1278 	TV_CP(*ki, *ki32, ki_childtime);
1279 	CP(*ki, *ki32, ki_flag);
1280 	CP(*ki, *ki32, ki_kiflag);
1281 	CP(*ki, *ki32, ki_traceflag);
1282 	CP(*ki, *ki32, ki_stat);
1283 	CP(*ki, *ki32, ki_nice);
1284 	CP(*ki, *ki32, ki_lock);
1285 	CP(*ki, *ki32, ki_rqindex);
1286 	CP(*ki, *ki32, ki_oncpu);
1287 	CP(*ki, *ki32, ki_lastcpu);
1288 
1289 	/* XXX TODO: wrap cpu value as appropriate */
1290 	CP(*ki, *ki32, ki_oncpu_old);
1291 	CP(*ki, *ki32, ki_lastcpu_old);
1292 
1293 	bcopy(ki->ki_tdname, ki32->ki_tdname, TDNAMLEN + 1);
1294 	bcopy(ki->ki_wmesg, ki32->ki_wmesg, WMESGLEN + 1);
1295 	bcopy(ki->ki_login, ki32->ki_login, LOGNAMELEN + 1);
1296 	bcopy(ki->ki_lockname, ki32->ki_lockname, LOCKNAMELEN + 1);
1297 	bcopy(ki->ki_comm, ki32->ki_comm, COMMLEN + 1);
1298 	bcopy(ki->ki_emul, ki32->ki_emul, KI_EMULNAMELEN + 1);
1299 	bcopy(ki->ki_loginclass, ki32->ki_loginclass, LOGINCLASSLEN + 1);
1300 	bcopy(ki->ki_moretdname, ki32->ki_moretdname, MAXCOMLEN - TDNAMLEN + 1);
1301 	CP(*ki, *ki32, ki_tracer);
1302 	CP(*ki, *ki32, ki_flag2);
1303 	CP(*ki, *ki32, ki_fibnum);
1304 	CP(*ki, *ki32, ki_cr_flags);
1305 	CP(*ki, *ki32, ki_jid);
1306 	CP(*ki, *ki32, ki_numthreads);
1307 	CP(*ki, *ki32, ki_tid);
1308 	CP(*ki, *ki32, ki_pri);
1309 	freebsd32_rusage_out(&ki->ki_rusage, &ki32->ki_rusage);
1310 	freebsd32_rusage_out(&ki->ki_rusage_ch, &ki32->ki_rusage_ch);
1311 	PTRTRIM_CP(*ki, *ki32, ki_pcb);
1312 	PTRTRIM_CP(*ki, *ki32, ki_kstack);
1313 	PTRTRIM_CP(*ki, *ki32, ki_udata);
1314 	PTRTRIM_CP(*ki, *ki32, ki_tdaddr);
1315 	CP(*ki, *ki32, ki_sflag);
1316 	CP(*ki, *ki32, ki_tdflags);
1317 }
1318 #endif
1319 
1320 static ssize_t
1321 kern_proc_out_size(struct proc *p, int flags)
1322 {
1323 	ssize_t size = 0;
1324 
1325 	PROC_LOCK_ASSERT(p, MA_OWNED);
1326 
1327 	if ((flags & KERN_PROC_NOTHREADS) != 0) {
1328 #ifdef COMPAT_FREEBSD32
1329 		if ((flags & KERN_PROC_MASK32) != 0) {
1330 			size += sizeof(struct kinfo_proc32);
1331 		} else
1332 #endif
1333 			size += sizeof(struct kinfo_proc);
1334 	} else {
1335 #ifdef COMPAT_FREEBSD32
1336 		if ((flags & KERN_PROC_MASK32) != 0)
1337 			size += sizeof(struct kinfo_proc32) * p->p_numthreads;
1338 		else
1339 #endif
1340 			size += sizeof(struct kinfo_proc) * p->p_numthreads;
1341 	}
1342 	PROC_UNLOCK(p);
1343 	return (size);
1344 }
1345 
1346 int
1347 kern_proc_out(struct proc *p, struct sbuf *sb, int flags)
1348 {
1349 	struct thread *td;
1350 	struct kinfo_proc ki;
1351 #ifdef COMPAT_FREEBSD32
1352 	struct kinfo_proc32 ki32;
1353 #endif
1354 	int error;
1355 
1356 	PROC_LOCK_ASSERT(p, MA_OWNED);
1357 	MPASS(FIRST_THREAD_IN_PROC(p) != NULL);
1358 
1359 	error = 0;
1360 	fill_kinfo_proc(p, &ki);
1361 	if ((flags & KERN_PROC_NOTHREADS) != 0) {
1362 #ifdef COMPAT_FREEBSD32
1363 		if ((flags & KERN_PROC_MASK32) != 0) {
1364 			freebsd32_kinfo_proc_out(&ki, &ki32);
1365 			if (sbuf_bcat(sb, &ki32, sizeof(ki32)) != 0)
1366 				error = ENOMEM;
1367 		} else
1368 #endif
1369 			if (sbuf_bcat(sb, &ki, sizeof(ki)) != 0)
1370 				error = ENOMEM;
1371 	} else {
1372 		FOREACH_THREAD_IN_PROC(p, td) {
1373 			fill_kinfo_thread(td, &ki, 1);
1374 #ifdef COMPAT_FREEBSD32
1375 			if ((flags & KERN_PROC_MASK32) != 0) {
1376 				freebsd32_kinfo_proc_out(&ki, &ki32);
1377 				if (sbuf_bcat(sb, &ki32, sizeof(ki32)) != 0)
1378 					error = ENOMEM;
1379 			} else
1380 #endif
1381 				if (sbuf_bcat(sb, &ki, sizeof(ki)) != 0)
1382 					error = ENOMEM;
1383 			if (error != 0)
1384 				break;
1385 		}
1386 	}
1387 	PROC_UNLOCK(p);
1388 	return (error);
1389 }
1390 
1391 static int
1392 sysctl_out_proc(struct proc *p, struct sysctl_req *req, int flags)
1393 {
1394 	struct sbuf sb;
1395 	struct kinfo_proc ki;
1396 	int error, error2;
1397 
1398 	if (req->oldptr == NULL)
1399 		return (SYSCTL_OUT(req, 0, kern_proc_out_size(p, flags)));
1400 
1401 	sbuf_new_for_sysctl(&sb, (char *)&ki, sizeof(ki), req);
1402 	sbuf_clear_flags(&sb, SBUF_INCLUDENUL);
1403 	error = kern_proc_out(p, &sb, flags);
1404 	error2 = sbuf_finish(&sb);
1405 	sbuf_delete(&sb);
1406 	if (error != 0)
1407 		return (error);
1408 	else if (error2 != 0)
1409 		return (error2);
1410 	return (0);
1411 }
1412 
1413 int
1414 proc_iterate(int (*cb)(struct proc *, void *), void *cbarg)
1415 {
1416 	struct proc *p;
1417 	int error, i, j;
1418 
1419 	for (i = 0; i < pidhashlock + 1; i++) {
1420 		sx_slock(&pidhashtbl_lock[i]);
1421 		for (j = i; j <= pidhash; j += pidhashlock + 1) {
1422 			LIST_FOREACH(p, &pidhashtbl[j], p_hash) {
1423 				if (p->p_state == PRS_NEW)
1424 					continue;
1425 				error = cb(p, cbarg);
1426 				PROC_LOCK_ASSERT(p, MA_NOTOWNED);
1427 				if (error != 0) {
1428 					sx_sunlock(&pidhashtbl_lock[i]);
1429 					return (error);
1430 				}
1431 			}
1432 		}
1433 		sx_sunlock(&pidhashtbl_lock[i]);
1434 	}
1435 	return (0);
1436 }
1437 
1438 struct kern_proc_out_args {
1439 	struct sysctl_req *req;
1440 	int flags;
1441 	int oid_number;
1442 	int *name;
1443 };
1444 
1445 static int
1446 sysctl_kern_proc_iterate(struct proc *p, void *origarg)
1447 {
1448 	struct kern_proc_out_args *arg = origarg;
1449 	int *name = arg->name;
1450 	int oid_number = arg->oid_number;
1451 	int flags = arg->flags;
1452 	struct sysctl_req *req = arg->req;
1453 	int error = 0;
1454 
1455 	PROC_LOCK(p);
1456 
1457 	KASSERT(p->p_ucred != NULL,
1458 	    ("process credential is NULL for non-NEW proc"));
1459 	/*
1460 	 * Show a user only appropriate processes.
1461 	 */
1462 	if (p_cansee(curthread, p))
1463 		goto skip;
1464 	/*
1465 	 * TODO - make more efficient (see notes below).
1466 	 * do by session.
1467 	 */
1468 	switch (oid_number) {
1469 
1470 	case KERN_PROC_GID:
1471 		if (p->p_ucred->cr_gid != (gid_t)name[0])
1472 			goto skip;
1473 		break;
1474 
1475 	case KERN_PROC_PGRP:
1476 		/* could do this by traversing pgrp */
1477 		if (p->p_pgrp == NULL ||
1478 		    p->p_pgrp->pg_id != (pid_t)name[0])
1479 			goto skip;
1480 		break;
1481 
1482 	case KERN_PROC_RGID:
1483 		if (p->p_ucred->cr_rgid != (gid_t)name[0])
1484 			goto skip;
1485 		break;
1486 
1487 	case KERN_PROC_SESSION:
1488 		if (p->p_session == NULL ||
1489 		    p->p_session->s_sid != (pid_t)name[0])
1490 			goto skip;
1491 		break;
1492 
1493 	case KERN_PROC_TTY:
1494 		if ((p->p_flag & P_CONTROLT) == 0 ||
1495 		    p->p_session == NULL)
1496 			goto skip;
1497 		/* XXX proctree_lock */
1498 		SESS_LOCK(p->p_session);
1499 		if (p->p_session->s_ttyp == NULL ||
1500 		    tty_udev(p->p_session->s_ttyp) !=
1501 		    (dev_t)name[0]) {
1502 			SESS_UNLOCK(p->p_session);
1503 			goto skip;
1504 		}
1505 		SESS_UNLOCK(p->p_session);
1506 		break;
1507 
1508 	case KERN_PROC_UID:
1509 		if (p->p_ucred->cr_uid != (uid_t)name[0])
1510 			goto skip;
1511 		break;
1512 
1513 	case KERN_PROC_RUID:
1514 		if (p->p_ucred->cr_ruid != (uid_t)name[0])
1515 			goto skip;
1516 		break;
1517 
1518 	case KERN_PROC_PROC:
1519 		break;
1520 
1521 	default:
1522 		break;
1523 
1524 	}
1525 	error = sysctl_out_proc(p, req, flags);
1526 	PROC_LOCK_ASSERT(p, MA_NOTOWNED);
1527 	return (error);
1528 skip:
1529 	PROC_UNLOCK(p);
1530 	return (0);
1531 }
1532 
1533 static int
1534 sysctl_kern_proc(SYSCTL_HANDLER_ARGS)
1535 {
1536 	struct kern_proc_out_args iterarg;
1537 	int *name = (int *)arg1;
1538 	u_int namelen = arg2;
1539 	struct proc *p;
1540 	int flags, oid_number;
1541 	int error = 0;
1542 
1543 	oid_number = oidp->oid_number;
1544 	if (oid_number != KERN_PROC_ALL &&
1545 	    (oid_number & KERN_PROC_INC_THREAD) == 0)
1546 		flags = KERN_PROC_NOTHREADS;
1547 	else {
1548 		flags = 0;
1549 		oid_number &= ~KERN_PROC_INC_THREAD;
1550 	}
1551 #ifdef COMPAT_FREEBSD32
1552 	if (req->flags & SCTL_MASK32)
1553 		flags |= KERN_PROC_MASK32;
1554 #endif
1555 	if (oid_number == KERN_PROC_PID) {
1556 		if (namelen != 1)
1557 			return (EINVAL);
1558 		error = sysctl_wire_old_buffer(req, 0);
1559 		if (error)
1560 			return (error);
1561 		error = pget((pid_t)name[0], PGET_CANSEE, &p);
1562 		if (error == 0)
1563 			error = sysctl_out_proc(p, req, flags);
1564 		return (error);
1565 	}
1566 
1567 	switch (oid_number) {
1568 	case KERN_PROC_ALL:
1569 		if (namelen != 0)
1570 			return (EINVAL);
1571 		break;
1572 	case KERN_PROC_PROC:
1573 		if (namelen != 0 && namelen != 1)
1574 			return (EINVAL);
1575 		break;
1576 	default:
1577 		if (namelen != 1)
1578 			return (EINVAL);
1579 		break;
1580 	}
1581 
1582 	if (req->oldptr == NULL) {
1583 		/* overestimate by 5 procs */
1584 		error = SYSCTL_OUT(req, 0, sizeof (struct kinfo_proc) * 5);
1585 		if (error)
1586 			return (error);
1587 	} else {
1588 		error = sysctl_wire_old_buffer(req, 0);
1589 		if (error != 0)
1590 			return (error);
1591 	}
1592 	iterarg.flags = flags;
1593 	iterarg.oid_number = oid_number;
1594 	iterarg.req = req;
1595 	iterarg.name = name;
1596 	error = proc_iterate(sysctl_kern_proc_iterate, &iterarg);
1597 	return (error);
1598 }
1599 
1600 struct pargs *
1601 pargs_alloc(int len)
1602 {
1603 	struct pargs *pa;
1604 
1605 	pa = malloc(sizeof(struct pargs) + len, M_PARGS,
1606 		M_WAITOK);
1607 	refcount_init(&pa->ar_ref, 1);
1608 	pa->ar_length = len;
1609 	return (pa);
1610 }
1611 
1612 static void
1613 pargs_free(struct pargs *pa)
1614 {
1615 
1616 	free(pa, M_PARGS);
1617 }
1618 
1619 void
1620 pargs_hold(struct pargs *pa)
1621 {
1622 
1623 	if (pa == NULL)
1624 		return;
1625 	refcount_acquire(&pa->ar_ref);
1626 }
1627 
1628 void
1629 pargs_drop(struct pargs *pa)
1630 {
1631 
1632 	if (pa == NULL)
1633 		return;
1634 	if (refcount_release(&pa->ar_ref))
1635 		pargs_free(pa);
1636 }
1637 
1638 static int
1639 proc_read_string(struct thread *td, struct proc *p, const char *sptr, char *buf,
1640     size_t len)
1641 {
1642 	ssize_t n;
1643 
1644 	/*
1645 	 * This may return a short read if the string is shorter than the chunk
1646 	 * and is aligned at the end of the page, and the following page is not
1647 	 * mapped.
1648 	 */
1649 	n = proc_readmem(td, p, (vm_offset_t)sptr, buf, len);
1650 	if (n <= 0)
1651 		return (ENOMEM);
1652 	return (0);
1653 }
1654 
1655 #define PROC_AUXV_MAX	256	/* Safety limit on auxv size. */
1656 
1657 enum proc_vector_type {
1658 	PROC_ARG,
1659 	PROC_ENV,
1660 	PROC_AUX,
1661 };
1662 
1663 #ifdef COMPAT_FREEBSD32
1664 static int
1665 get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp,
1666     size_t *vsizep, enum proc_vector_type type)
1667 {
1668 	struct freebsd32_ps_strings pss;
1669 	Elf32_Auxinfo aux;
1670 	vm_offset_t vptr, ptr;
1671 	uint32_t *proc_vector32;
1672 	char **proc_vector;
1673 	size_t vsize, size;
1674 	int i, error;
1675 
1676 	error = 0;
1677 	if (proc_readmem(td, p, (vm_offset_t)p->p_sysent->sv_psstrings, &pss,
1678 	    sizeof(pss)) != sizeof(pss))
1679 		return (ENOMEM);
1680 	switch (type) {
1681 	case PROC_ARG:
1682 		vptr = (vm_offset_t)PTRIN(pss.ps_argvstr);
1683 		vsize = pss.ps_nargvstr;
1684 		if (vsize > ARG_MAX)
1685 			return (ENOEXEC);
1686 		size = vsize * sizeof(int32_t);
1687 		break;
1688 	case PROC_ENV:
1689 		vptr = (vm_offset_t)PTRIN(pss.ps_envstr);
1690 		vsize = pss.ps_nenvstr;
1691 		if (vsize > ARG_MAX)
1692 			return (ENOEXEC);
1693 		size = vsize * sizeof(int32_t);
1694 		break;
1695 	case PROC_AUX:
1696 		vptr = (vm_offset_t)PTRIN(pss.ps_envstr) +
1697 		    (pss.ps_nenvstr + 1) * sizeof(int32_t);
1698 		if (vptr % 4 != 0)
1699 			return (ENOEXEC);
1700 		for (ptr = vptr, i = 0; i < PROC_AUXV_MAX; i++) {
1701 			if (proc_readmem(td, p, ptr, &aux, sizeof(aux)) !=
1702 			    sizeof(aux))
1703 				return (ENOMEM);
1704 			if (aux.a_type == AT_NULL)
1705 				break;
1706 			ptr += sizeof(aux);
1707 		}
1708 		if (aux.a_type != AT_NULL)
1709 			return (ENOEXEC);
1710 		vsize = i + 1;
1711 		size = vsize * sizeof(aux);
1712 		break;
1713 	default:
1714 		KASSERT(0, ("Wrong proc vector type: %d", type));
1715 		return (EINVAL);
1716 	}
1717 	proc_vector32 = malloc(size, M_TEMP, M_WAITOK);
1718 	if (proc_readmem(td, p, vptr, proc_vector32, size) != size) {
1719 		error = ENOMEM;
1720 		goto done;
1721 	}
1722 	if (type == PROC_AUX) {
1723 		*proc_vectorp = (char **)proc_vector32;
1724 		*vsizep = vsize;
1725 		return (0);
1726 	}
1727 	proc_vector = malloc(vsize * sizeof(char *), M_TEMP, M_WAITOK);
1728 	for (i = 0; i < (int)vsize; i++)
1729 		proc_vector[i] = PTRIN(proc_vector32[i]);
1730 	*proc_vectorp = proc_vector;
1731 	*vsizep = vsize;
1732 done:
1733 	free(proc_vector32, M_TEMP);
1734 	return (error);
1735 }
1736 #endif
1737 
1738 static int
1739 get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp,
1740     size_t *vsizep, enum proc_vector_type type)
1741 {
1742 	struct ps_strings pss;
1743 	Elf_Auxinfo aux;
1744 	vm_offset_t vptr, ptr;
1745 	char **proc_vector;
1746 	size_t vsize, size;
1747 	int i;
1748 
1749 #ifdef COMPAT_FREEBSD32
1750 	if (SV_PROC_FLAG(p, SV_ILP32) != 0)
1751 		return (get_proc_vector32(td, p, proc_vectorp, vsizep, type));
1752 #endif
1753 	if (proc_readmem(td, p, (vm_offset_t)p->p_sysent->sv_psstrings, &pss,
1754 	    sizeof(pss)) != sizeof(pss))
1755 		return (ENOMEM);
1756 	switch (type) {
1757 	case PROC_ARG:
1758 		vptr = (vm_offset_t)pss.ps_argvstr;
1759 		vsize = pss.ps_nargvstr;
1760 		if (vsize > ARG_MAX)
1761 			return (ENOEXEC);
1762 		size = vsize * sizeof(char *);
1763 		break;
1764 	case PROC_ENV:
1765 		vptr = (vm_offset_t)pss.ps_envstr;
1766 		vsize = pss.ps_nenvstr;
1767 		if (vsize > ARG_MAX)
1768 			return (ENOEXEC);
1769 		size = vsize * sizeof(char *);
1770 		break;
1771 	case PROC_AUX:
1772 		/*
1773 		 * The aux array is just above env array on the stack. Check
1774 		 * that the address is naturally aligned.
1775 		 */
1776 		vptr = (vm_offset_t)pss.ps_envstr + (pss.ps_nenvstr + 1)
1777 		    * sizeof(char *);
1778 #if __ELF_WORD_SIZE == 64
1779 		if (vptr % sizeof(uint64_t) != 0)
1780 #else
1781 		if (vptr % sizeof(uint32_t) != 0)
1782 #endif
1783 			return (ENOEXEC);
1784 		/*
1785 		 * We count the array size reading the aux vectors from the
1786 		 * stack until AT_NULL vector is returned.  So (to keep the code
1787 		 * simple) we read the process stack twice: the first time here
1788 		 * to find the size and the second time when copying the vectors
1789 		 * to the allocated proc_vector.
1790 		 */
1791 		for (ptr = vptr, i = 0; i < PROC_AUXV_MAX; i++) {
1792 			if (proc_readmem(td, p, ptr, &aux, sizeof(aux)) !=
1793 			    sizeof(aux))
1794 				return (ENOMEM);
1795 			if (aux.a_type == AT_NULL)
1796 				break;
1797 			ptr += sizeof(aux);
1798 		}
1799 		/*
1800 		 * If the PROC_AUXV_MAX entries are iterated over, and we have
1801 		 * not reached AT_NULL, it is most likely we are reading wrong
1802 		 * data: either the process doesn't have auxv array or data has
1803 		 * been modified. Return the error in this case.
1804 		 */
1805 		if (aux.a_type != AT_NULL)
1806 			return (ENOEXEC);
1807 		vsize = i + 1;
1808 		size = vsize * sizeof(aux);
1809 		break;
1810 	default:
1811 		KASSERT(0, ("Wrong proc vector type: %d", type));
1812 		return (EINVAL); /* In case we are built without INVARIANTS. */
1813 	}
1814 	proc_vector = malloc(size, M_TEMP, M_WAITOK);
1815 	if (proc_readmem(td, p, vptr, proc_vector, size) != size) {
1816 		free(proc_vector, M_TEMP);
1817 		return (ENOMEM);
1818 	}
1819 	*proc_vectorp = proc_vector;
1820 	*vsizep = vsize;
1821 
1822 	return (0);
1823 }
1824 
1825 #define GET_PS_STRINGS_CHUNK_SZ	256	/* Chunk size (bytes) for ps_strings operations. */
1826 
1827 static int
1828 get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb,
1829     enum proc_vector_type type)
1830 {
1831 	size_t done, len, nchr, vsize;
1832 	int error, i;
1833 	char **proc_vector, *sptr;
1834 	char pss_string[GET_PS_STRINGS_CHUNK_SZ];
1835 
1836 	PROC_ASSERT_HELD(p);
1837 
1838 	/*
1839 	 * We are not going to read more than 2 * (PATH_MAX + ARG_MAX) bytes.
1840 	 */
1841 	nchr = 2 * (PATH_MAX + ARG_MAX);
1842 
1843 	error = get_proc_vector(td, p, &proc_vector, &vsize, type);
1844 	if (error != 0)
1845 		return (error);
1846 	for (done = 0, i = 0; i < (int)vsize && done < nchr; i++) {
1847 		/*
1848 		 * The program may have scribbled into its argv array, e.g. to
1849 		 * remove some arguments.  If that has happened, break out
1850 		 * before trying to read from NULL.
1851 		 */
1852 		if (proc_vector[i] == NULL)
1853 			break;
1854 		for (sptr = proc_vector[i]; ; sptr += GET_PS_STRINGS_CHUNK_SZ) {
1855 			error = proc_read_string(td, p, sptr, pss_string,
1856 			    sizeof(pss_string));
1857 			if (error != 0)
1858 				goto done;
1859 			len = strnlen(pss_string, GET_PS_STRINGS_CHUNK_SZ);
1860 			if (done + len >= nchr)
1861 				len = nchr - done - 1;
1862 			sbuf_bcat(sb, pss_string, len);
1863 			if (len != GET_PS_STRINGS_CHUNK_SZ)
1864 				break;
1865 			done += GET_PS_STRINGS_CHUNK_SZ;
1866 		}
1867 		sbuf_bcat(sb, "", 1);
1868 		done += len + 1;
1869 	}
1870 done:
1871 	free(proc_vector, M_TEMP);
1872 	return (error);
1873 }
1874 
1875 int
1876 proc_getargv(struct thread *td, struct proc *p, struct sbuf *sb)
1877 {
1878 
1879 	return (get_ps_strings(curthread, p, sb, PROC_ARG));
1880 }
1881 
1882 int
1883 proc_getenvv(struct thread *td, struct proc *p, struct sbuf *sb)
1884 {
1885 
1886 	return (get_ps_strings(curthread, p, sb, PROC_ENV));
1887 }
1888 
1889 int
1890 proc_getauxv(struct thread *td, struct proc *p, struct sbuf *sb)
1891 {
1892 	size_t vsize, size;
1893 	char **auxv;
1894 	int error;
1895 
1896 	error = get_proc_vector(td, p, &auxv, &vsize, PROC_AUX);
1897 	if (error == 0) {
1898 #ifdef COMPAT_FREEBSD32
1899 		if (SV_PROC_FLAG(p, SV_ILP32) != 0)
1900 			size = vsize * sizeof(Elf32_Auxinfo);
1901 		else
1902 #endif
1903 			size = vsize * sizeof(Elf_Auxinfo);
1904 		if (sbuf_bcat(sb, auxv, size) != 0)
1905 			error = ENOMEM;
1906 		free(auxv, M_TEMP);
1907 	}
1908 	return (error);
1909 }
1910 
1911 /*
1912  * This sysctl allows a process to retrieve the argument list or process
1913  * title for another process without groping around in the address space
1914  * of the other process.  It also allow a process to set its own "process
1915  * title to a string of its own choice.
1916  */
1917 static int
1918 sysctl_kern_proc_args(SYSCTL_HANDLER_ARGS)
1919 {
1920 	int *name = (int *)arg1;
1921 	u_int namelen = arg2;
1922 	struct pargs *newpa, *pa;
1923 	struct proc *p;
1924 	struct sbuf sb;
1925 	int flags, error = 0, error2;
1926 	pid_t pid;
1927 
1928 	if (namelen != 1)
1929 		return (EINVAL);
1930 
1931 	pid = (pid_t)name[0];
1932 	/*
1933 	 * If the query is for this process and it is single-threaded, there
1934 	 * is nobody to modify pargs, thus we can just read.
1935 	 */
1936 	p = curproc;
1937 	if (pid == p->p_pid && p->p_numthreads == 1 && req->newptr == NULL &&
1938 	    (pa = p->p_args) != NULL)
1939 		return (SYSCTL_OUT(req, pa->ar_args, pa->ar_length));
1940 
1941 	flags = PGET_CANSEE;
1942 	if (req->newptr != NULL)
1943 		flags |= PGET_ISCURRENT;
1944 	error = pget(pid, flags, &p);
1945 	if (error)
1946 		return (error);
1947 
1948 	pa = p->p_args;
1949 	if (pa != NULL) {
1950 		pargs_hold(pa);
1951 		PROC_UNLOCK(p);
1952 		error = SYSCTL_OUT(req, pa->ar_args, pa->ar_length);
1953 		pargs_drop(pa);
1954 	} else if ((p->p_flag & (P_WEXIT | P_SYSTEM)) == 0) {
1955 		_PHOLD(p);
1956 		PROC_UNLOCK(p);
1957 		sbuf_new_for_sysctl(&sb, NULL, GET_PS_STRINGS_CHUNK_SZ, req);
1958 		sbuf_clear_flags(&sb, SBUF_INCLUDENUL);
1959 		error = proc_getargv(curthread, p, &sb);
1960 		error2 = sbuf_finish(&sb);
1961 		PRELE(p);
1962 		sbuf_delete(&sb);
1963 		if (error == 0 && error2 != 0)
1964 			error = error2;
1965 	} else {
1966 		PROC_UNLOCK(p);
1967 	}
1968 	if (error != 0 || req->newptr == NULL)
1969 		return (error);
1970 
1971 	if (req->newlen > ps_arg_cache_limit - sizeof(struct pargs))
1972 		return (ENOMEM);
1973 
1974 	if (req->newlen == 0) {
1975 		/*
1976 		 * Clear the argument pointer, so that we'll fetch arguments
1977 		 * with proc_getargv() until further notice.
1978 		 */
1979 		newpa = NULL;
1980 	} else {
1981 		newpa = pargs_alloc(req->newlen);
1982 		error = SYSCTL_IN(req, newpa->ar_args, req->newlen);
1983 		if (error != 0) {
1984 			pargs_free(newpa);
1985 			return (error);
1986 		}
1987 	}
1988 	PROC_LOCK(p);
1989 	pa = p->p_args;
1990 	p->p_args = newpa;
1991 	PROC_UNLOCK(p);
1992 	pargs_drop(pa);
1993 	return (0);
1994 }
1995 
1996 /*
1997  * This sysctl allows a process to retrieve environment of another process.
1998  */
1999 static int
2000 sysctl_kern_proc_env(SYSCTL_HANDLER_ARGS)
2001 {
2002 	int *name = (int *)arg1;
2003 	u_int namelen = arg2;
2004 	struct proc *p;
2005 	struct sbuf sb;
2006 	int error, error2;
2007 
2008 	if (namelen != 1)
2009 		return (EINVAL);
2010 
2011 	error = pget((pid_t)name[0], PGET_WANTREAD, &p);
2012 	if (error != 0)
2013 		return (error);
2014 	if ((p->p_flag & P_SYSTEM) != 0) {
2015 		PRELE(p);
2016 		return (0);
2017 	}
2018 
2019 	sbuf_new_for_sysctl(&sb, NULL, GET_PS_STRINGS_CHUNK_SZ, req);
2020 	sbuf_clear_flags(&sb, SBUF_INCLUDENUL);
2021 	error = proc_getenvv(curthread, p, &sb);
2022 	error2 = sbuf_finish(&sb);
2023 	PRELE(p);
2024 	sbuf_delete(&sb);
2025 	return (error != 0 ? error : error2);
2026 }
2027 
2028 /*
2029  * This sysctl allows a process to retrieve ELF auxiliary vector of
2030  * another process.
2031  */
2032 static int
2033 sysctl_kern_proc_auxv(SYSCTL_HANDLER_ARGS)
2034 {
2035 	int *name = (int *)arg1;
2036 	u_int namelen = arg2;
2037 	struct proc *p;
2038 	struct sbuf sb;
2039 	int error, error2;
2040 
2041 	if (namelen != 1)
2042 		return (EINVAL);
2043 
2044 	error = pget((pid_t)name[0], PGET_WANTREAD, &p);
2045 	if (error != 0)
2046 		return (error);
2047 	if ((p->p_flag & P_SYSTEM) != 0) {
2048 		PRELE(p);
2049 		return (0);
2050 	}
2051 	sbuf_new_for_sysctl(&sb, NULL, GET_PS_STRINGS_CHUNK_SZ, req);
2052 	sbuf_clear_flags(&sb, SBUF_INCLUDENUL);
2053 	error = proc_getauxv(curthread, p, &sb);
2054 	error2 = sbuf_finish(&sb);
2055 	PRELE(p);
2056 	sbuf_delete(&sb);
2057 	return (error != 0 ? error : error2);
2058 }
2059 
2060 /*
2061  * This sysctl allows a process to retrieve the path of the executable for
2062  * itself or another process.
2063  */
2064 static int
2065 sysctl_kern_proc_pathname(SYSCTL_HANDLER_ARGS)
2066 {
2067 	pid_t *pidp = (pid_t *)arg1;
2068 	unsigned int arglen = arg2;
2069 	struct proc *p;
2070 	struct vnode *vp;
2071 	char *retbuf, *freebuf;
2072 	int error;
2073 
2074 	if (arglen != 1)
2075 		return (EINVAL);
2076 	if (*pidp == -1) {	/* -1 means this process */
2077 		p = req->td->td_proc;
2078 	} else {
2079 		error = pget(*pidp, PGET_CANSEE, &p);
2080 		if (error != 0)
2081 			return (error);
2082 	}
2083 
2084 	vp = p->p_textvp;
2085 	if (vp == NULL) {
2086 		if (*pidp != -1)
2087 			PROC_UNLOCK(p);
2088 		return (0);
2089 	}
2090 	vref(vp);
2091 	if (*pidp != -1)
2092 		PROC_UNLOCK(p);
2093 	error = vn_fullpath(req->td, vp, &retbuf, &freebuf);
2094 	vrele(vp);
2095 	if (error)
2096 		return (error);
2097 	error = SYSCTL_OUT(req, retbuf, strlen(retbuf) + 1);
2098 	free(freebuf, M_TEMP);
2099 	return (error);
2100 }
2101 
2102 static int
2103 sysctl_kern_proc_sv_name(SYSCTL_HANDLER_ARGS)
2104 {
2105 	struct proc *p;
2106 	char *sv_name;
2107 	int *name;
2108 	int namelen;
2109 	int error;
2110 
2111 	namelen = arg2;
2112 	if (namelen != 1)
2113 		return (EINVAL);
2114 
2115 	name = (int *)arg1;
2116 	error = pget((pid_t)name[0], PGET_CANSEE, &p);
2117 	if (error != 0)
2118 		return (error);
2119 	sv_name = p->p_sysent->sv_name;
2120 	PROC_UNLOCK(p);
2121 	return (sysctl_handle_string(oidp, sv_name, 0, req));
2122 }
2123 
2124 #ifdef KINFO_OVMENTRY_SIZE
2125 CTASSERT(sizeof(struct kinfo_ovmentry) == KINFO_OVMENTRY_SIZE);
2126 #endif
2127 
2128 #ifdef COMPAT_FREEBSD7
2129 static int
2130 sysctl_kern_proc_ovmmap(SYSCTL_HANDLER_ARGS)
2131 {
2132 	vm_map_entry_t entry, tmp_entry;
2133 	unsigned int last_timestamp;
2134 	char *fullpath, *freepath;
2135 	struct kinfo_ovmentry *kve;
2136 	struct vattr va;
2137 	struct ucred *cred;
2138 	int error, *name;
2139 	struct vnode *vp;
2140 	struct proc *p;
2141 	vm_map_t map;
2142 	struct vmspace *vm;
2143 
2144 	name = (int *)arg1;
2145 	error = pget((pid_t)name[0], PGET_WANTREAD, &p);
2146 	if (error != 0)
2147 		return (error);
2148 	vm = vmspace_acquire_ref(p);
2149 	if (vm == NULL) {
2150 		PRELE(p);
2151 		return (ESRCH);
2152 	}
2153 	kve = malloc(sizeof(*kve), M_TEMP, M_WAITOK);
2154 
2155 	map = &vm->vm_map;
2156 	vm_map_lock_read(map);
2157 	for (entry = map->header.next; entry != &map->header;
2158 	    entry = entry->next) {
2159 		vm_object_t obj, tobj, lobj;
2160 		vm_offset_t addr;
2161 
2162 		if (entry->eflags & MAP_ENTRY_IS_SUB_MAP)
2163 			continue;
2164 
2165 		bzero(kve, sizeof(*kve));
2166 		kve->kve_structsize = sizeof(*kve);
2167 
2168 		kve->kve_private_resident = 0;
2169 		obj = entry->object.vm_object;
2170 		if (obj != NULL) {
2171 			VM_OBJECT_RLOCK(obj);
2172 			if (obj->shadow_count == 1)
2173 				kve->kve_private_resident =
2174 				    obj->resident_page_count;
2175 		}
2176 		kve->kve_resident = 0;
2177 		addr = entry->start;
2178 		while (addr < entry->end) {
2179 			if (pmap_extract(map->pmap, addr))
2180 				kve->kve_resident++;
2181 			addr += PAGE_SIZE;
2182 		}
2183 
2184 		for (lobj = tobj = obj; tobj; tobj = tobj->backing_object) {
2185 			if (tobj != obj) {
2186 				VM_OBJECT_RLOCK(tobj);
2187 				kve->kve_offset += tobj->backing_object_offset;
2188 			}
2189 			if (lobj != obj)
2190 				VM_OBJECT_RUNLOCK(lobj);
2191 			lobj = tobj;
2192 		}
2193 
2194 		kve->kve_start = (void*)entry->start;
2195 		kve->kve_end = (void*)entry->end;
2196 		kve->kve_offset += (off_t)entry->offset;
2197 
2198 		if (entry->protection & VM_PROT_READ)
2199 			kve->kve_protection |= KVME_PROT_READ;
2200 		if (entry->protection & VM_PROT_WRITE)
2201 			kve->kve_protection |= KVME_PROT_WRITE;
2202 		if (entry->protection & VM_PROT_EXECUTE)
2203 			kve->kve_protection |= KVME_PROT_EXEC;
2204 
2205 		if (entry->eflags & MAP_ENTRY_COW)
2206 			kve->kve_flags |= KVME_FLAG_COW;
2207 		if (entry->eflags & MAP_ENTRY_NEEDS_COPY)
2208 			kve->kve_flags |= KVME_FLAG_NEEDS_COPY;
2209 		if (entry->eflags & MAP_ENTRY_NOCOREDUMP)
2210 			kve->kve_flags |= KVME_FLAG_NOCOREDUMP;
2211 
2212 		last_timestamp = map->timestamp;
2213 		vm_map_unlock_read(map);
2214 
2215 		kve->kve_fileid = 0;
2216 		kve->kve_fsid = 0;
2217 		freepath = NULL;
2218 		fullpath = "";
2219 		if (lobj) {
2220 			vp = NULL;
2221 			switch (lobj->type) {
2222 			case OBJT_DEFAULT:
2223 				kve->kve_type = KVME_TYPE_DEFAULT;
2224 				break;
2225 			case OBJT_VNODE:
2226 				kve->kve_type = KVME_TYPE_VNODE;
2227 				vp = lobj->handle;
2228 				vref(vp);
2229 				break;
2230 			case OBJT_SWAP:
2231 				if ((lobj->flags & OBJ_TMPFS_NODE) != 0) {
2232 					kve->kve_type = KVME_TYPE_VNODE;
2233 					if ((lobj->flags & OBJ_TMPFS) != 0) {
2234 						vp = lobj->un_pager.swp.swp_tmpfs;
2235 						vref(vp);
2236 					}
2237 				} else {
2238 					kve->kve_type = KVME_TYPE_SWAP;
2239 				}
2240 				break;
2241 			case OBJT_DEVICE:
2242 				kve->kve_type = KVME_TYPE_DEVICE;
2243 				break;
2244 			case OBJT_PHYS:
2245 				kve->kve_type = KVME_TYPE_PHYS;
2246 				break;
2247 			case OBJT_DEAD:
2248 				kve->kve_type = KVME_TYPE_DEAD;
2249 				break;
2250 			case OBJT_SG:
2251 				kve->kve_type = KVME_TYPE_SG;
2252 				break;
2253 			default:
2254 				kve->kve_type = KVME_TYPE_UNKNOWN;
2255 				break;
2256 			}
2257 			if (lobj != obj)
2258 				VM_OBJECT_RUNLOCK(lobj);
2259 
2260 			kve->kve_ref_count = obj->ref_count;
2261 			kve->kve_shadow_count = obj->shadow_count;
2262 			VM_OBJECT_RUNLOCK(obj);
2263 			if (vp != NULL) {
2264 				vn_fullpath(curthread, vp, &fullpath,
2265 				    &freepath);
2266 				cred = curthread->td_ucred;
2267 				vn_lock(vp, LK_SHARED | LK_RETRY);
2268 				if (VOP_GETATTR(vp, &va, cred) == 0) {
2269 					kve->kve_fileid = va.va_fileid;
2270 					/* truncate */
2271 					kve->kve_fsid = va.va_fsid;
2272 				}
2273 				vput(vp);
2274 			}
2275 		} else {
2276 			kve->kve_type = KVME_TYPE_NONE;
2277 			kve->kve_ref_count = 0;
2278 			kve->kve_shadow_count = 0;
2279 		}
2280 
2281 		strlcpy(kve->kve_path, fullpath, sizeof(kve->kve_path));
2282 		if (freepath != NULL)
2283 			free(freepath, M_TEMP);
2284 
2285 		error = SYSCTL_OUT(req, kve, sizeof(*kve));
2286 		vm_map_lock_read(map);
2287 		if (error)
2288 			break;
2289 		if (last_timestamp != map->timestamp) {
2290 			vm_map_lookup_entry(map, addr - 1, &tmp_entry);
2291 			entry = tmp_entry;
2292 		}
2293 	}
2294 	vm_map_unlock_read(map);
2295 	vmspace_free(vm);
2296 	PRELE(p);
2297 	free(kve, M_TEMP);
2298 	return (error);
2299 }
2300 #endif	/* COMPAT_FREEBSD7 */
2301 
2302 #ifdef KINFO_VMENTRY_SIZE
2303 CTASSERT(sizeof(struct kinfo_vmentry) == KINFO_VMENTRY_SIZE);
2304 #endif
2305 
2306 void
2307 kern_proc_vmmap_resident(vm_map_t map, vm_map_entry_t entry,
2308     int *resident_count, bool *super)
2309 {
2310 	vm_object_t obj, tobj;
2311 	vm_page_t m, m_adv;
2312 	vm_offset_t addr;
2313 	vm_paddr_t locked_pa;
2314 	vm_pindex_t pi, pi_adv, pindex;
2315 
2316 	*super = false;
2317 	*resident_count = 0;
2318 	if (vmmap_skip_res_cnt)
2319 		return;
2320 
2321 	locked_pa = 0;
2322 	obj = entry->object.vm_object;
2323 	addr = entry->start;
2324 	m_adv = NULL;
2325 	pi = OFF_TO_IDX(entry->offset);
2326 	for (; addr < entry->end; addr += IDX_TO_OFF(pi_adv), pi += pi_adv) {
2327 		if (m_adv != NULL) {
2328 			m = m_adv;
2329 		} else {
2330 			pi_adv = atop(entry->end - addr);
2331 			pindex = pi;
2332 			for (tobj = obj;; tobj = tobj->backing_object) {
2333 				m = vm_page_find_least(tobj, pindex);
2334 				if (m != NULL) {
2335 					if (m->pindex == pindex)
2336 						break;
2337 					if (pi_adv > m->pindex - pindex) {
2338 						pi_adv = m->pindex - pindex;
2339 						m_adv = m;
2340 					}
2341 				}
2342 				if (tobj->backing_object == NULL)
2343 					goto next;
2344 				pindex += OFF_TO_IDX(tobj->
2345 				    backing_object_offset);
2346 			}
2347 		}
2348 		m_adv = NULL;
2349 		if (m->psind != 0 && addr + pagesizes[1] <= entry->end &&
2350 		    (addr & (pagesizes[1] - 1)) == 0 &&
2351 		    (pmap_mincore(map->pmap, addr, &locked_pa) &
2352 		    MINCORE_SUPER) != 0) {
2353 			*super = true;
2354 			pi_adv = atop(pagesizes[1]);
2355 		} else {
2356 			/*
2357 			 * We do not test the found page on validity.
2358 			 * Either the page is busy and being paged in,
2359 			 * or it was invalidated.  The first case
2360 			 * should be counted as resident, the second
2361 			 * is not so clear; we do account both.
2362 			 */
2363 			pi_adv = 1;
2364 		}
2365 		*resident_count += pi_adv;
2366 next:;
2367 	}
2368 	PA_UNLOCK_COND(locked_pa);
2369 }
2370 
2371 /*
2372  * Must be called with the process locked and will return unlocked.
2373  */
2374 int
2375 kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags)
2376 {
2377 	vm_map_entry_t entry, tmp_entry;
2378 	struct vattr va;
2379 	vm_map_t map;
2380 	vm_object_t obj, tobj, lobj;
2381 	char *fullpath, *freepath;
2382 	struct kinfo_vmentry *kve;
2383 	struct ucred *cred;
2384 	struct vnode *vp;
2385 	struct vmspace *vm;
2386 	vm_offset_t addr;
2387 	unsigned int last_timestamp;
2388 	int error;
2389 	bool super;
2390 
2391 	PROC_LOCK_ASSERT(p, MA_OWNED);
2392 
2393 	_PHOLD(p);
2394 	PROC_UNLOCK(p);
2395 	vm = vmspace_acquire_ref(p);
2396 	if (vm == NULL) {
2397 		PRELE(p);
2398 		return (ESRCH);
2399 	}
2400 	kve = malloc(sizeof(*kve), M_TEMP, M_WAITOK | M_ZERO);
2401 
2402 	error = 0;
2403 	map = &vm->vm_map;
2404 	vm_map_lock_read(map);
2405 	for (entry = map->header.next; entry != &map->header;
2406 	    entry = entry->next) {
2407 		if (entry->eflags & MAP_ENTRY_IS_SUB_MAP)
2408 			continue;
2409 
2410 		addr = entry->end;
2411 		bzero(kve, sizeof(*kve));
2412 		obj = entry->object.vm_object;
2413 		if (obj != NULL) {
2414 			for (tobj = obj; tobj != NULL;
2415 			    tobj = tobj->backing_object) {
2416 				VM_OBJECT_RLOCK(tobj);
2417 				kve->kve_offset += tobj->backing_object_offset;
2418 				lobj = tobj;
2419 			}
2420 			if (obj->backing_object == NULL)
2421 				kve->kve_private_resident =
2422 				    obj->resident_page_count;
2423 			kern_proc_vmmap_resident(map, entry,
2424 			    &kve->kve_resident, &super);
2425 			if (super)
2426 				kve->kve_flags |= KVME_FLAG_SUPER;
2427 			for (tobj = obj; tobj != NULL;
2428 			    tobj = tobj->backing_object) {
2429 				if (tobj != obj && tobj != lobj)
2430 					VM_OBJECT_RUNLOCK(tobj);
2431 			}
2432 		} else {
2433 			lobj = NULL;
2434 		}
2435 
2436 		kve->kve_start = entry->start;
2437 		kve->kve_end = entry->end;
2438 		kve->kve_offset += entry->offset;
2439 
2440 		if (entry->protection & VM_PROT_READ)
2441 			kve->kve_protection |= KVME_PROT_READ;
2442 		if (entry->protection & VM_PROT_WRITE)
2443 			kve->kve_protection |= KVME_PROT_WRITE;
2444 		if (entry->protection & VM_PROT_EXECUTE)
2445 			kve->kve_protection |= KVME_PROT_EXEC;
2446 
2447 		if (entry->eflags & MAP_ENTRY_COW)
2448 			kve->kve_flags |= KVME_FLAG_COW;
2449 		if (entry->eflags & MAP_ENTRY_NEEDS_COPY)
2450 			kve->kve_flags |= KVME_FLAG_NEEDS_COPY;
2451 		if (entry->eflags & MAP_ENTRY_NOCOREDUMP)
2452 			kve->kve_flags |= KVME_FLAG_NOCOREDUMP;
2453 		if (entry->eflags & MAP_ENTRY_GROWS_UP)
2454 			kve->kve_flags |= KVME_FLAG_GROWS_UP;
2455 		if (entry->eflags & MAP_ENTRY_GROWS_DOWN)
2456 			kve->kve_flags |= KVME_FLAG_GROWS_DOWN;
2457 
2458 		last_timestamp = map->timestamp;
2459 		vm_map_unlock_read(map);
2460 
2461 		freepath = NULL;
2462 		fullpath = "";
2463 		if (lobj != NULL) {
2464 			vp = NULL;
2465 			switch (lobj->type) {
2466 			case OBJT_DEFAULT:
2467 				kve->kve_type = KVME_TYPE_DEFAULT;
2468 				break;
2469 			case OBJT_VNODE:
2470 				kve->kve_type = KVME_TYPE_VNODE;
2471 				vp = lobj->handle;
2472 				vref(vp);
2473 				break;
2474 			case OBJT_SWAP:
2475 				if ((lobj->flags & OBJ_TMPFS_NODE) != 0) {
2476 					kve->kve_type = KVME_TYPE_VNODE;
2477 					if ((lobj->flags & OBJ_TMPFS) != 0) {
2478 						vp = lobj->un_pager.swp.swp_tmpfs;
2479 						vref(vp);
2480 					}
2481 				} else {
2482 					kve->kve_type = KVME_TYPE_SWAP;
2483 				}
2484 				break;
2485 			case OBJT_DEVICE:
2486 				kve->kve_type = KVME_TYPE_DEVICE;
2487 				break;
2488 			case OBJT_PHYS:
2489 				kve->kve_type = KVME_TYPE_PHYS;
2490 				break;
2491 			case OBJT_DEAD:
2492 				kve->kve_type = KVME_TYPE_DEAD;
2493 				break;
2494 			case OBJT_SG:
2495 				kve->kve_type = KVME_TYPE_SG;
2496 				break;
2497 			case OBJT_MGTDEVICE:
2498 				kve->kve_type = KVME_TYPE_MGTDEVICE;
2499 				break;
2500 			default:
2501 				kve->kve_type = KVME_TYPE_UNKNOWN;
2502 				break;
2503 			}
2504 			if (lobj != obj)
2505 				VM_OBJECT_RUNLOCK(lobj);
2506 
2507 			kve->kve_ref_count = obj->ref_count;
2508 			kve->kve_shadow_count = obj->shadow_count;
2509 			VM_OBJECT_RUNLOCK(obj);
2510 			if (vp != NULL) {
2511 				vn_fullpath(curthread, vp, &fullpath,
2512 				    &freepath);
2513 				kve->kve_vn_type = vntype_to_kinfo(vp->v_type);
2514 				cred = curthread->td_ucred;
2515 				vn_lock(vp, LK_SHARED | LK_RETRY);
2516 				if (VOP_GETATTR(vp, &va, cred) == 0) {
2517 					kve->kve_vn_fileid = va.va_fileid;
2518 					kve->kve_vn_fsid = va.va_fsid;
2519 					kve->kve_vn_fsid_freebsd11 =
2520 					    kve->kve_vn_fsid; /* truncate */
2521 					kve->kve_vn_mode =
2522 					    MAKEIMODE(va.va_type, va.va_mode);
2523 					kve->kve_vn_size = va.va_size;
2524 					kve->kve_vn_rdev = va.va_rdev;
2525 					kve->kve_vn_rdev_freebsd11 =
2526 					    kve->kve_vn_rdev; /* truncate */
2527 					kve->kve_status = KF_ATTR_VALID;
2528 				}
2529 				vput(vp);
2530 			}
2531 		} else {
2532 			kve->kve_type = KVME_TYPE_NONE;
2533 			kve->kve_ref_count = 0;
2534 			kve->kve_shadow_count = 0;
2535 		}
2536 
2537 		strlcpy(kve->kve_path, fullpath, sizeof(kve->kve_path));
2538 		if (freepath != NULL)
2539 			free(freepath, M_TEMP);
2540 
2541 		/* Pack record size down */
2542 		if ((flags & KERN_VMMAP_PACK_KINFO) != 0)
2543 			kve->kve_structsize =
2544 			    offsetof(struct kinfo_vmentry, kve_path) +
2545 			    strlen(kve->kve_path) + 1;
2546 		else
2547 			kve->kve_structsize = sizeof(*kve);
2548 		kve->kve_structsize = roundup(kve->kve_structsize,
2549 		    sizeof(uint64_t));
2550 
2551 		/* Halt filling and truncate rather than exceeding maxlen */
2552 		if (maxlen != -1 && maxlen < kve->kve_structsize) {
2553 			error = 0;
2554 			vm_map_lock_read(map);
2555 			break;
2556 		} else if (maxlen != -1)
2557 			maxlen -= kve->kve_structsize;
2558 
2559 		if (sbuf_bcat(sb, kve, kve->kve_structsize) != 0)
2560 			error = ENOMEM;
2561 		vm_map_lock_read(map);
2562 		if (error != 0)
2563 			break;
2564 		if (last_timestamp != map->timestamp) {
2565 			vm_map_lookup_entry(map, addr - 1, &tmp_entry);
2566 			entry = tmp_entry;
2567 		}
2568 	}
2569 	vm_map_unlock_read(map);
2570 	vmspace_free(vm);
2571 	PRELE(p);
2572 	free(kve, M_TEMP);
2573 	return (error);
2574 }
2575 
2576 static int
2577 sysctl_kern_proc_vmmap(SYSCTL_HANDLER_ARGS)
2578 {
2579 	struct proc *p;
2580 	struct sbuf sb;
2581 	int error, error2, *name;
2582 
2583 	name = (int *)arg1;
2584 	sbuf_new_for_sysctl(&sb, NULL, sizeof(struct kinfo_vmentry), req);
2585 	sbuf_clear_flags(&sb, SBUF_INCLUDENUL);
2586 	error = pget((pid_t)name[0], PGET_CANDEBUG | PGET_NOTWEXIT, &p);
2587 	if (error != 0) {
2588 		sbuf_delete(&sb);
2589 		return (error);
2590 	}
2591 	error = kern_proc_vmmap_out(p, &sb, -1, KERN_VMMAP_PACK_KINFO);
2592 	error2 = sbuf_finish(&sb);
2593 	sbuf_delete(&sb);
2594 	return (error != 0 ? error : error2);
2595 }
2596 
2597 #if defined(STACK) || defined(DDB)
2598 static int
2599 sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS)
2600 {
2601 	struct kinfo_kstack *kkstp;
2602 	int error, i, *name, numthreads;
2603 	lwpid_t *lwpidarray;
2604 	struct thread *td;
2605 	struct stack *st;
2606 	struct sbuf sb;
2607 	struct proc *p;
2608 
2609 	name = (int *)arg1;
2610 	error = pget((pid_t)name[0], PGET_NOTINEXEC | PGET_WANTREAD, &p);
2611 	if (error != 0)
2612 		return (error);
2613 
2614 	kkstp = malloc(sizeof(*kkstp), M_TEMP, M_WAITOK);
2615 	st = stack_create(M_WAITOK);
2616 
2617 	lwpidarray = NULL;
2618 	PROC_LOCK(p);
2619 	do {
2620 		if (lwpidarray != NULL) {
2621 			free(lwpidarray, M_TEMP);
2622 			lwpidarray = NULL;
2623 		}
2624 		numthreads = p->p_numthreads;
2625 		PROC_UNLOCK(p);
2626 		lwpidarray = malloc(sizeof(*lwpidarray) * numthreads, M_TEMP,
2627 		    M_WAITOK | M_ZERO);
2628 		PROC_LOCK(p);
2629 	} while (numthreads < p->p_numthreads);
2630 
2631 	/*
2632 	 * XXXRW: During the below loop, execve(2) and countless other sorts
2633 	 * of changes could have taken place.  Should we check to see if the
2634 	 * vmspace has been replaced, or the like, in order to prevent
2635 	 * giving a snapshot that spans, say, execve(2), with some threads
2636 	 * before and some after?  Among other things, the credentials could
2637 	 * have changed, in which case the right to extract debug info might
2638 	 * no longer be assured.
2639 	 */
2640 	i = 0;
2641 	FOREACH_THREAD_IN_PROC(p, td) {
2642 		KASSERT(i < numthreads,
2643 		    ("sysctl_kern_proc_kstack: numthreads"));
2644 		lwpidarray[i] = td->td_tid;
2645 		i++;
2646 	}
2647 	numthreads = i;
2648 	for (i = 0; i < numthreads; i++) {
2649 		td = thread_find(p, lwpidarray[i]);
2650 		if (td == NULL) {
2651 			continue;
2652 		}
2653 		bzero(kkstp, sizeof(*kkstp));
2654 		(void)sbuf_new(&sb, kkstp->kkst_trace,
2655 		    sizeof(kkstp->kkst_trace), SBUF_FIXEDLEN);
2656 		thread_lock(td);
2657 		kkstp->kkst_tid = td->td_tid;
2658 		if (TD_IS_SWAPPED(td)) {
2659 			kkstp->kkst_state = KKST_STATE_SWAPPED;
2660 		} else if (TD_IS_RUNNING(td)) {
2661 			if (stack_save_td_running(st, td) == 0)
2662 				kkstp->kkst_state = KKST_STATE_STACKOK;
2663 			else
2664 				kkstp->kkst_state = KKST_STATE_RUNNING;
2665 		} else {
2666 			kkstp->kkst_state = KKST_STATE_STACKOK;
2667 			stack_save_td(st, td);
2668 		}
2669 		thread_unlock(td);
2670 		PROC_UNLOCK(p);
2671 		stack_sbuf_print(&sb, st);
2672 		sbuf_finish(&sb);
2673 		sbuf_delete(&sb);
2674 		error = SYSCTL_OUT(req, kkstp, sizeof(*kkstp));
2675 		PROC_LOCK(p);
2676 		if (error)
2677 			break;
2678 	}
2679 	_PRELE(p);
2680 	PROC_UNLOCK(p);
2681 	if (lwpidarray != NULL)
2682 		free(lwpidarray, M_TEMP);
2683 	stack_destroy(st);
2684 	free(kkstp, M_TEMP);
2685 	return (error);
2686 }
2687 #endif
2688 
2689 /*
2690  * This sysctl allows a process to retrieve the full list of groups from
2691  * itself or another process.
2692  */
2693 static int
2694 sysctl_kern_proc_groups(SYSCTL_HANDLER_ARGS)
2695 {
2696 	pid_t *pidp = (pid_t *)arg1;
2697 	unsigned int arglen = arg2;
2698 	struct proc *p;
2699 	struct ucred *cred;
2700 	int error;
2701 
2702 	if (arglen != 1)
2703 		return (EINVAL);
2704 	if (*pidp == -1) {	/* -1 means this process */
2705 		p = req->td->td_proc;
2706 		PROC_LOCK(p);
2707 	} else {
2708 		error = pget(*pidp, PGET_CANSEE, &p);
2709 		if (error != 0)
2710 			return (error);
2711 	}
2712 
2713 	cred = crhold(p->p_ucred);
2714 	PROC_UNLOCK(p);
2715 
2716 	error = SYSCTL_OUT(req, cred->cr_groups,
2717 	    cred->cr_ngroups * sizeof(gid_t));
2718 	crfree(cred);
2719 	return (error);
2720 }
2721 
2722 /*
2723  * This sysctl allows a process to retrieve or/and set the resource limit for
2724  * another process.
2725  */
2726 static int
2727 sysctl_kern_proc_rlimit(SYSCTL_HANDLER_ARGS)
2728 {
2729 	int *name = (int *)arg1;
2730 	u_int namelen = arg2;
2731 	struct rlimit rlim;
2732 	struct proc *p;
2733 	u_int which;
2734 	int flags, error;
2735 
2736 	if (namelen != 2)
2737 		return (EINVAL);
2738 
2739 	which = (u_int)name[1];
2740 	if (which >= RLIM_NLIMITS)
2741 		return (EINVAL);
2742 
2743 	if (req->newptr != NULL && req->newlen != sizeof(rlim))
2744 		return (EINVAL);
2745 
2746 	flags = PGET_HOLD | PGET_NOTWEXIT;
2747 	if (req->newptr != NULL)
2748 		flags |= PGET_CANDEBUG;
2749 	else
2750 		flags |= PGET_CANSEE;
2751 	error = pget((pid_t)name[0], flags, &p);
2752 	if (error != 0)
2753 		return (error);
2754 
2755 	/*
2756 	 * Retrieve limit.
2757 	 */
2758 	if (req->oldptr != NULL) {
2759 		PROC_LOCK(p);
2760 		lim_rlimit_proc(p, which, &rlim);
2761 		PROC_UNLOCK(p);
2762 	}
2763 	error = SYSCTL_OUT(req, &rlim, sizeof(rlim));
2764 	if (error != 0)
2765 		goto errout;
2766 
2767 	/*
2768 	 * Set limit.
2769 	 */
2770 	if (req->newptr != NULL) {
2771 		error = SYSCTL_IN(req, &rlim, sizeof(rlim));
2772 		if (error == 0)
2773 			error = kern_proc_setrlimit(curthread, p, which, &rlim);
2774 	}
2775 
2776 errout:
2777 	PRELE(p);
2778 	return (error);
2779 }
2780 
2781 /*
2782  * This sysctl allows a process to retrieve ps_strings structure location of
2783  * another process.
2784  */
2785 static int
2786 sysctl_kern_proc_ps_strings(SYSCTL_HANDLER_ARGS)
2787 {
2788 	int *name = (int *)arg1;
2789 	u_int namelen = arg2;
2790 	struct proc *p;
2791 	vm_offset_t ps_strings;
2792 	int error;
2793 #ifdef COMPAT_FREEBSD32
2794 	uint32_t ps_strings32;
2795 #endif
2796 
2797 	if (namelen != 1)
2798 		return (EINVAL);
2799 
2800 	error = pget((pid_t)name[0], PGET_CANDEBUG, &p);
2801 	if (error != 0)
2802 		return (error);
2803 #ifdef COMPAT_FREEBSD32
2804 	if ((req->flags & SCTL_MASK32) != 0) {
2805 		/*
2806 		 * We return 0 if the 32 bit emulation request is for a 64 bit
2807 		 * process.
2808 		 */
2809 		ps_strings32 = SV_PROC_FLAG(p, SV_ILP32) != 0 ?
2810 		    PTROUT(p->p_sysent->sv_psstrings) : 0;
2811 		PROC_UNLOCK(p);
2812 		error = SYSCTL_OUT(req, &ps_strings32, sizeof(ps_strings32));
2813 		return (error);
2814 	}
2815 #endif
2816 	ps_strings = p->p_sysent->sv_psstrings;
2817 	PROC_UNLOCK(p);
2818 	error = SYSCTL_OUT(req, &ps_strings, sizeof(ps_strings));
2819 	return (error);
2820 }
2821 
2822 /*
2823  * This sysctl allows a process to retrieve umask of another process.
2824  */
2825 static int
2826 sysctl_kern_proc_umask(SYSCTL_HANDLER_ARGS)
2827 {
2828 	int *name = (int *)arg1;
2829 	u_int namelen = arg2;
2830 	struct proc *p;
2831 	int error;
2832 	u_short fd_cmask;
2833 	pid_t pid;
2834 
2835 	if (namelen != 1)
2836 		return (EINVAL);
2837 
2838 	pid = (pid_t)name[0];
2839 	p = curproc;
2840 	if (pid == p->p_pid || pid == 0) {
2841 		fd_cmask = p->p_fd->fd_cmask;
2842 		goto out;
2843 	}
2844 
2845 	error = pget(pid, PGET_WANTREAD, &p);
2846 	if (error != 0)
2847 		return (error);
2848 
2849 	fd_cmask = p->p_fd->fd_cmask;
2850 	PRELE(p);
2851 out:
2852 	error = SYSCTL_OUT(req, &fd_cmask, sizeof(fd_cmask));
2853 	return (error);
2854 }
2855 
2856 /*
2857  * This sysctl allows a process to set and retrieve binary osreldate of
2858  * another process.
2859  */
2860 static int
2861 sysctl_kern_proc_osrel(SYSCTL_HANDLER_ARGS)
2862 {
2863 	int *name = (int *)arg1;
2864 	u_int namelen = arg2;
2865 	struct proc *p;
2866 	int flags, error, osrel;
2867 
2868 	if (namelen != 1)
2869 		return (EINVAL);
2870 
2871 	if (req->newptr != NULL && req->newlen != sizeof(osrel))
2872 		return (EINVAL);
2873 
2874 	flags = PGET_HOLD | PGET_NOTWEXIT;
2875 	if (req->newptr != NULL)
2876 		flags |= PGET_CANDEBUG;
2877 	else
2878 		flags |= PGET_CANSEE;
2879 	error = pget((pid_t)name[0], flags, &p);
2880 	if (error != 0)
2881 		return (error);
2882 
2883 	error = SYSCTL_OUT(req, &p->p_osrel, sizeof(p->p_osrel));
2884 	if (error != 0)
2885 		goto errout;
2886 
2887 	if (req->newptr != NULL) {
2888 		error = SYSCTL_IN(req, &osrel, sizeof(osrel));
2889 		if (error != 0)
2890 			goto errout;
2891 		if (osrel < 0) {
2892 			error = EINVAL;
2893 			goto errout;
2894 		}
2895 		p->p_osrel = osrel;
2896 	}
2897 errout:
2898 	PRELE(p);
2899 	return (error);
2900 }
2901 
2902 static int
2903 sysctl_kern_proc_sigtramp(SYSCTL_HANDLER_ARGS)
2904 {
2905 	int *name = (int *)arg1;
2906 	u_int namelen = arg2;
2907 	struct proc *p;
2908 	struct kinfo_sigtramp kst;
2909 	const struct sysentvec *sv;
2910 	int error;
2911 #ifdef COMPAT_FREEBSD32
2912 	struct kinfo_sigtramp32 kst32;
2913 #endif
2914 
2915 	if (namelen != 1)
2916 		return (EINVAL);
2917 
2918 	error = pget((pid_t)name[0], PGET_CANDEBUG, &p);
2919 	if (error != 0)
2920 		return (error);
2921 	sv = p->p_sysent;
2922 #ifdef COMPAT_FREEBSD32
2923 	if ((req->flags & SCTL_MASK32) != 0) {
2924 		bzero(&kst32, sizeof(kst32));
2925 		if (SV_PROC_FLAG(p, SV_ILP32)) {
2926 			if (sv->sv_sigcode_base != 0) {
2927 				kst32.ksigtramp_start = sv->sv_sigcode_base;
2928 				kst32.ksigtramp_end = sv->sv_sigcode_base +
2929 				    *sv->sv_szsigcode;
2930 			} else {
2931 				kst32.ksigtramp_start = sv->sv_psstrings -
2932 				    *sv->sv_szsigcode;
2933 				kst32.ksigtramp_end = sv->sv_psstrings;
2934 			}
2935 		}
2936 		PROC_UNLOCK(p);
2937 		error = SYSCTL_OUT(req, &kst32, sizeof(kst32));
2938 		return (error);
2939 	}
2940 #endif
2941 	bzero(&kst, sizeof(kst));
2942 	if (sv->sv_sigcode_base != 0) {
2943 		kst.ksigtramp_start = (char *)sv->sv_sigcode_base;
2944 		kst.ksigtramp_end = (char *)sv->sv_sigcode_base +
2945 		    *sv->sv_szsigcode;
2946 	} else {
2947 		kst.ksigtramp_start = (char *)sv->sv_psstrings -
2948 		    *sv->sv_szsigcode;
2949 		kst.ksigtramp_end = (char *)sv->sv_psstrings;
2950 	}
2951 	PROC_UNLOCK(p);
2952 	error = SYSCTL_OUT(req, &kst, sizeof(kst));
2953 	return (error);
2954 }
2955 
2956 SYSCTL_NODE(_kern, KERN_PROC, proc, CTLFLAG_RD,  0, "Process table");
2957 
2958 SYSCTL_PROC(_kern_proc, KERN_PROC_ALL, all, CTLFLAG_RD|CTLTYPE_STRUCT|
2959 	CTLFLAG_MPSAFE, 0, 0, sysctl_kern_proc, "S,proc",
2960 	"Return entire process table");
2961 
2962 static SYSCTL_NODE(_kern_proc, KERN_PROC_GID, gid, CTLFLAG_RD | CTLFLAG_MPSAFE,
2963 	sysctl_kern_proc, "Process table");
2964 
2965 static SYSCTL_NODE(_kern_proc, KERN_PROC_PGRP, pgrp, CTLFLAG_RD | CTLFLAG_MPSAFE,
2966 	sysctl_kern_proc, "Process table");
2967 
2968 static SYSCTL_NODE(_kern_proc, KERN_PROC_RGID, rgid, CTLFLAG_RD | CTLFLAG_MPSAFE,
2969 	sysctl_kern_proc, "Process table");
2970 
2971 static SYSCTL_NODE(_kern_proc, KERN_PROC_SESSION, sid, CTLFLAG_RD |
2972 	CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2973 
2974 static SYSCTL_NODE(_kern_proc, KERN_PROC_TTY, tty, CTLFLAG_RD | CTLFLAG_MPSAFE,
2975 	sysctl_kern_proc, "Process table");
2976 
2977 static SYSCTL_NODE(_kern_proc, KERN_PROC_UID, uid, CTLFLAG_RD | CTLFLAG_MPSAFE,
2978 	sysctl_kern_proc, "Process table");
2979 
2980 static SYSCTL_NODE(_kern_proc, KERN_PROC_RUID, ruid, CTLFLAG_RD | CTLFLAG_MPSAFE,
2981 	sysctl_kern_proc, "Process table");
2982 
2983 static SYSCTL_NODE(_kern_proc, KERN_PROC_PID, pid, CTLFLAG_RD | CTLFLAG_MPSAFE,
2984 	sysctl_kern_proc, "Process table");
2985 
2986 static SYSCTL_NODE(_kern_proc, KERN_PROC_PROC, proc, CTLFLAG_RD | CTLFLAG_MPSAFE,
2987 	sysctl_kern_proc, "Return process table, no threads");
2988 
2989 static SYSCTL_NODE(_kern_proc, KERN_PROC_ARGS, args,
2990 	CTLFLAG_RW | CTLFLAG_CAPWR | CTLFLAG_ANYBODY | CTLFLAG_MPSAFE,
2991 	sysctl_kern_proc_args, "Process argument list");
2992 
2993 static SYSCTL_NODE(_kern_proc, KERN_PROC_ENV, env, CTLFLAG_RD | CTLFLAG_MPSAFE,
2994 	sysctl_kern_proc_env, "Process environment");
2995 
2996 static SYSCTL_NODE(_kern_proc, KERN_PROC_AUXV, auxv, CTLFLAG_RD |
2997 	CTLFLAG_MPSAFE, sysctl_kern_proc_auxv, "Process ELF auxiliary vector");
2998 
2999 static SYSCTL_NODE(_kern_proc, KERN_PROC_PATHNAME, pathname, CTLFLAG_RD |
3000 	CTLFLAG_MPSAFE, sysctl_kern_proc_pathname, "Process executable path");
3001 
3002 static SYSCTL_NODE(_kern_proc, KERN_PROC_SV_NAME, sv_name, CTLFLAG_RD |
3003 	CTLFLAG_MPSAFE, sysctl_kern_proc_sv_name,
3004 	"Process syscall vector name (ABI type)");
3005 
3006 static SYSCTL_NODE(_kern_proc, (KERN_PROC_GID | KERN_PROC_INC_THREAD), gid_td,
3007 	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
3008 
3009 static SYSCTL_NODE(_kern_proc, (KERN_PROC_PGRP | KERN_PROC_INC_THREAD), pgrp_td,
3010 	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
3011 
3012 static SYSCTL_NODE(_kern_proc, (KERN_PROC_RGID | KERN_PROC_INC_THREAD), rgid_td,
3013 	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
3014 
3015 static SYSCTL_NODE(_kern_proc, (KERN_PROC_SESSION | KERN_PROC_INC_THREAD),
3016 	sid_td, CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
3017 
3018 static SYSCTL_NODE(_kern_proc, (KERN_PROC_TTY | KERN_PROC_INC_THREAD), tty_td,
3019 	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
3020 
3021 static SYSCTL_NODE(_kern_proc, (KERN_PROC_UID | KERN_PROC_INC_THREAD), uid_td,
3022 	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
3023 
3024 static SYSCTL_NODE(_kern_proc, (KERN_PROC_RUID | KERN_PROC_INC_THREAD), ruid_td,
3025 	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
3026 
3027 static SYSCTL_NODE(_kern_proc, (KERN_PROC_PID | KERN_PROC_INC_THREAD), pid_td,
3028 	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
3029 
3030 static SYSCTL_NODE(_kern_proc, (KERN_PROC_PROC | KERN_PROC_INC_THREAD), proc_td,
3031 	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc,
3032 	"Return process table, no threads");
3033 
3034 #ifdef COMPAT_FREEBSD7
3035 static SYSCTL_NODE(_kern_proc, KERN_PROC_OVMMAP, ovmmap, CTLFLAG_RD |
3036 	CTLFLAG_MPSAFE, sysctl_kern_proc_ovmmap, "Old Process vm map entries");
3037 #endif
3038 
3039 static SYSCTL_NODE(_kern_proc, KERN_PROC_VMMAP, vmmap, CTLFLAG_RD |
3040 	CTLFLAG_MPSAFE, sysctl_kern_proc_vmmap, "Process vm map entries");
3041 
3042 #if defined(STACK) || defined(DDB)
3043 static SYSCTL_NODE(_kern_proc, KERN_PROC_KSTACK, kstack, CTLFLAG_RD |
3044 	CTLFLAG_MPSAFE, sysctl_kern_proc_kstack, "Process kernel stacks");
3045 #endif
3046 
3047 static SYSCTL_NODE(_kern_proc, KERN_PROC_GROUPS, groups, CTLFLAG_RD |
3048 	CTLFLAG_MPSAFE, sysctl_kern_proc_groups, "Process groups");
3049 
3050 static SYSCTL_NODE(_kern_proc, KERN_PROC_RLIMIT, rlimit, CTLFLAG_RW |
3051 	CTLFLAG_ANYBODY | CTLFLAG_MPSAFE, sysctl_kern_proc_rlimit,
3052 	"Process resource limits");
3053 
3054 static SYSCTL_NODE(_kern_proc, KERN_PROC_PS_STRINGS, ps_strings, CTLFLAG_RD |
3055 	CTLFLAG_MPSAFE, sysctl_kern_proc_ps_strings,
3056 	"Process ps_strings location");
3057 
3058 static SYSCTL_NODE(_kern_proc, KERN_PROC_UMASK, umask, CTLFLAG_RD |
3059 	CTLFLAG_MPSAFE, sysctl_kern_proc_umask, "Process umask");
3060 
3061 static SYSCTL_NODE(_kern_proc, KERN_PROC_OSREL, osrel, CTLFLAG_RW |
3062 	CTLFLAG_ANYBODY | CTLFLAG_MPSAFE, sysctl_kern_proc_osrel,
3063 	"Process binary osreldate");
3064 
3065 static SYSCTL_NODE(_kern_proc, KERN_PROC_SIGTRAMP, sigtramp, CTLFLAG_RD |
3066 	CTLFLAG_MPSAFE, sysctl_kern_proc_sigtramp,
3067 	"Process signal trampoline location");
3068 
3069 int allproc_gen;
3070 
3071 /*
3072  * stop_all_proc() purpose is to stop all process which have usermode,
3073  * except current process for obvious reasons.  This makes it somewhat
3074  * unreliable when invoked from multithreaded process.  The service
3075  * must not be user-callable anyway.
3076  */
3077 void
3078 stop_all_proc(void)
3079 {
3080 	struct proc *cp, *p;
3081 	int r, gen;
3082 	bool restart, seen_stopped, seen_exiting, stopped_some;
3083 
3084 	cp = curproc;
3085 allproc_loop:
3086 	sx_xlock(&allproc_lock);
3087 	gen = allproc_gen;
3088 	seen_exiting = seen_stopped = stopped_some = restart = false;
3089 	LIST_REMOVE(cp, p_list);
3090 	LIST_INSERT_HEAD(&allproc, cp, p_list);
3091 	for (;;) {
3092 		p = LIST_NEXT(cp, p_list);
3093 		if (p == NULL)
3094 			break;
3095 		LIST_REMOVE(cp, p_list);
3096 		LIST_INSERT_AFTER(p, cp, p_list);
3097 		PROC_LOCK(p);
3098 		if ((p->p_flag & (P_KPROC | P_SYSTEM | P_TOTAL_STOP)) != 0) {
3099 			PROC_UNLOCK(p);
3100 			continue;
3101 		}
3102 		if ((p->p_flag & P_WEXIT) != 0) {
3103 			seen_exiting = true;
3104 			PROC_UNLOCK(p);
3105 			continue;
3106 		}
3107 		if (P_SHOULDSTOP(p) == P_STOPPED_SINGLE) {
3108 			/*
3109 			 * Stopped processes are tolerated when there
3110 			 * are no other processes which might continue
3111 			 * them.  P_STOPPED_SINGLE but not
3112 			 * P_TOTAL_STOP process still has at least one
3113 			 * thread running.
3114 			 */
3115 			seen_stopped = true;
3116 			PROC_UNLOCK(p);
3117 			continue;
3118 		}
3119 		_PHOLD(p);
3120 		sx_xunlock(&allproc_lock);
3121 		r = thread_single(p, SINGLE_ALLPROC);
3122 		if (r != 0)
3123 			restart = true;
3124 		else
3125 			stopped_some = true;
3126 		_PRELE(p);
3127 		PROC_UNLOCK(p);
3128 		sx_xlock(&allproc_lock);
3129 	}
3130 	/* Catch forked children we did not see in iteration. */
3131 	if (gen != allproc_gen)
3132 		restart = true;
3133 	sx_xunlock(&allproc_lock);
3134 	if (restart || stopped_some || seen_exiting || seen_stopped) {
3135 		kern_yield(PRI_USER);
3136 		goto allproc_loop;
3137 	}
3138 }
3139 
3140 void
3141 resume_all_proc(void)
3142 {
3143 	struct proc *cp, *p;
3144 
3145 	cp = curproc;
3146 	sx_xlock(&allproc_lock);
3147 again:
3148 	LIST_REMOVE(cp, p_list);
3149 	LIST_INSERT_HEAD(&allproc, cp, p_list);
3150 	for (;;) {
3151 		p = LIST_NEXT(cp, p_list);
3152 		if (p == NULL)
3153 			break;
3154 		LIST_REMOVE(cp, p_list);
3155 		LIST_INSERT_AFTER(p, cp, p_list);
3156 		PROC_LOCK(p);
3157 		if ((p->p_flag & P_TOTAL_STOP) != 0) {
3158 			sx_xunlock(&allproc_lock);
3159 			_PHOLD(p);
3160 			thread_single_end(p, SINGLE_ALLPROC);
3161 			_PRELE(p);
3162 			PROC_UNLOCK(p);
3163 			sx_xlock(&allproc_lock);
3164 		} else {
3165 			PROC_UNLOCK(p);
3166 		}
3167 	}
3168 	/*  Did the loop above missed any stopped process ? */
3169 	FOREACH_PROC_IN_SYSTEM(p) {
3170 		/* No need for proc lock. */
3171 		if ((p->p_flag & P_TOTAL_STOP) != 0)
3172 			goto again;
3173 	}
3174 	sx_xunlock(&allproc_lock);
3175 }
3176 
3177 /* #define	TOTAL_STOP_DEBUG	1 */
3178 #ifdef TOTAL_STOP_DEBUG
3179 volatile static int ap_resume;
3180 #include <sys/mount.h>
3181 
3182 static int
3183 sysctl_debug_stop_all_proc(SYSCTL_HANDLER_ARGS)
3184 {
3185 	int error, val;
3186 
3187 	val = 0;
3188 	ap_resume = 0;
3189 	error = sysctl_handle_int(oidp, &val, 0, req);
3190 	if (error != 0 || req->newptr == NULL)
3191 		return (error);
3192 	if (val != 0) {
3193 		stop_all_proc();
3194 		syncer_suspend();
3195 		while (ap_resume == 0)
3196 			;
3197 		syncer_resume();
3198 		resume_all_proc();
3199 	}
3200 	return (0);
3201 }
3202 
3203 SYSCTL_PROC(_debug, OID_AUTO, stop_all_proc, CTLTYPE_INT | CTLFLAG_RW |
3204     CTLFLAG_MPSAFE, __DEVOLATILE(int *, &ap_resume), 0,
3205     sysctl_debug_stop_all_proc, "I",
3206     "");
3207 #endif
3208