xref: /freebsd/sys/kern/kern_rctl.c (revision 4d846d260e2b9a3d4d0a701462568268cbfe7a5b)
1ec125fbbSEdward Tomasz Napierala /*-
2*4d846d26SWarner Losh  * SPDX-License-Identifier: BSD-2-Clause
38a36da99SPedro F. Giffuni  *
4ec125fbbSEdward Tomasz Napierala  * Copyright (c) 2010 The FreeBSD Foundation
5ec125fbbSEdward Tomasz Napierala  *
6ec125fbbSEdward Tomasz Napierala  * This software was developed by Edward Tomasz Napierala under sponsorship
7ec125fbbSEdward Tomasz Napierala  * from the FreeBSD Foundation.
8ec125fbbSEdward Tomasz Napierala  *
9ec125fbbSEdward Tomasz Napierala  * Redistribution and use in source and binary forms, with or without
10ec125fbbSEdward Tomasz Napierala  * modification, are permitted provided that the following conditions
11ec125fbbSEdward Tomasz Napierala  * are met:
12ec125fbbSEdward Tomasz Napierala  * 1. Redistributions of source code must retain the above copyright
13ec125fbbSEdward Tomasz Napierala  *    notice, this list of conditions and the following disclaimer.
14ec125fbbSEdward Tomasz Napierala  * 2. Redistributions in binary form must reproduce the above copyright
15ec125fbbSEdward Tomasz Napierala  *    notice, this list of conditions and the following disclaimer in the
16ec125fbbSEdward Tomasz Napierala  *    documentation and/or other materials provided with the distribution.
17ec125fbbSEdward Tomasz Napierala  *
18ec125fbbSEdward Tomasz Napierala  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19ec125fbbSEdward Tomasz Napierala  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20ec125fbbSEdward Tomasz Napierala  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21ec125fbbSEdward Tomasz Napierala  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22ec125fbbSEdward Tomasz Napierala  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23ec125fbbSEdward Tomasz Napierala  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24ec125fbbSEdward Tomasz Napierala  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25ec125fbbSEdward Tomasz Napierala  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26ec125fbbSEdward Tomasz Napierala  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27ec125fbbSEdward Tomasz Napierala  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28ec125fbbSEdward Tomasz Napierala  * SUCH DAMAGE.
29ec125fbbSEdward Tomasz Napierala  *
30ec125fbbSEdward Tomasz Napierala  * $FreeBSD$
31ec125fbbSEdward Tomasz Napierala  */
32ec125fbbSEdward Tomasz Napierala 
33ec125fbbSEdward Tomasz Napierala #include <sys/cdefs.h>
34ec125fbbSEdward Tomasz Napierala __FBSDID("$FreeBSD$");
35ec125fbbSEdward Tomasz Napierala 
36ec125fbbSEdward Tomasz Napierala #include <sys/param.h>
37773e541eSWarner Losh #include <sys/devctl.h>
38ec125fbbSEdward Tomasz Napierala #include <sys/malloc.h>
39ec125fbbSEdward Tomasz Napierala #include <sys/queue.h>
40ec125fbbSEdward Tomasz Napierala #include <sys/refcount.h>
41ec125fbbSEdward Tomasz Napierala #include <sys/jail.h>
42ec125fbbSEdward Tomasz Napierala #include <sys/kernel.h>
43ec125fbbSEdward Tomasz Napierala #include <sys/limits.h>
44ec125fbbSEdward Tomasz Napierala #include <sys/loginclass.h>
45ec125fbbSEdward Tomasz Napierala #include <sys/priv.h>
46ec125fbbSEdward Tomasz Napierala #include <sys/proc.h>
47ec125fbbSEdward Tomasz Napierala #include <sys/racct.h>
48ec125fbbSEdward Tomasz Napierala #include <sys/rctl.h>
49ec125fbbSEdward Tomasz Napierala #include <sys/resourcevar.h>
50ec125fbbSEdward Tomasz Napierala #include <sys/sx.h>
51ec125fbbSEdward Tomasz Napierala #include <sys/sysproto.h>
52ec125fbbSEdward Tomasz Napierala #include <sys/systm.h>
53ec125fbbSEdward Tomasz Napierala #include <sys/types.h>
54ec125fbbSEdward Tomasz Napierala #include <sys/eventhandler.h>
55ec125fbbSEdward Tomasz Napierala #include <sys/lock.h>
56ec125fbbSEdward Tomasz Napierala #include <sys/mutex.h>
57ec125fbbSEdward Tomasz Napierala #include <sys/rwlock.h>
58ec125fbbSEdward Tomasz Napierala #include <sys/sbuf.h>
59ec125fbbSEdward Tomasz Napierala #include <sys/taskqueue.h>
60ec125fbbSEdward Tomasz Napierala #include <sys/tree.h>
61ec125fbbSEdward Tomasz Napierala #include <vm/uma.h>
62ec125fbbSEdward Tomasz Napierala 
63ec125fbbSEdward Tomasz Napierala #ifdef RCTL
64ec125fbbSEdward Tomasz Napierala #ifndef RACCT
65ec125fbbSEdward Tomasz Napierala #error "The RCTL option requires the RACCT option"
66ec125fbbSEdward Tomasz Napierala #endif
67ec125fbbSEdward Tomasz Napierala 
68ec125fbbSEdward Tomasz Napierala FEATURE(rctl, "Resource Limits");
69ec125fbbSEdward Tomasz Napierala 
70ec125fbbSEdward Tomasz Napierala #define	HRF_DEFAULT		0
71ec125fbbSEdward Tomasz Napierala #define	HRF_DONT_INHERIT	1
72ec125fbbSEdward Tomasz Napierala #define	HRF_DONT_ACCUMULATE	2
73ec125fbbSEdward Tomasz Napierala 
74ea228b48SEdward Tomasz Napierala #define	RCTL_MAX_INBUFSIZE	4 * 1024
75ea228b48SEdward Tomasz Napierala #define	RCTL_MAX_OUTBUFSIZE	16 * 1024 * 1024
76ec125fbbSEdward Tomasz Napierala #define	RCTL_LOG_BUFSIZE	128
77ec125fbbSEdward Tomasz Napierala 
7836af9869SEdward Tomasz Napierala #define	RCTL_PCPU_SHIFT		(10 * 1000000)
7936af9869SEdward Tomasz Napierala 
80ae34b6ffSEdward Tomasz Napierala static unsigned int rctl_maxbufsize = RCTL_MAX_OUTBUFSIZE;
81f70c075eSEdward Tomasz Napierala static int rctl_log_rate_limit = 10;
82f70c075eSEdward Tomasz Napierala static int rctl_devctl_rate_limit = 10;
838bd8c8f1SEdward Tomasz Napierala 
848bd8c8f1SEdward Tomasz Napierala /*
858bd8c8f1SEdward Tomasz Napierala  * Values below are initialized in rctl_init().
868bd8c8f1SEdward Tomasz Napierala  */
878bd8c8f1SEdward Tomasz Napierala static int rctl_throttle_min = -1;
888bd8c8f1SEdward Tomasz Napierala static int rctl_throttle_max = -1;
898bd8c8f1SEdward Tomasz Napierala static int rctl_throttle_pct = -1;
908bd8c8f1SEdward Tomasz Napierala static int rctl_throttle_pct2 = -1;
918bd8c8f1SEdward Tomasz Napierala 
928bd8c8f1SEdward Tomasz Napierala static int rctl_throttle_min_sysctl(SYSCTL_HANDLER_ARGS);
938bd8c8f1SEdward Tomasz Napierala static int rctl_throttle_max_sysctl(SYSCTL_HANDLER_ARGS);
948bd8c8f1SEdward Tomasz Napierala static int rctl_throttle_pct_sysctl(SYSCTL_HANDLER_ARGS);
958bd8c8f1SEdward Tomasz Napierala static int rctl_throttle_pct2_sysctl(SYSCTL_HANDLER_ARGS);
962b4035eeSEdward Tomasz Napierala 
97e0d69c5aSPawel Biernacki SYSCTL_NODE(_kern_racct, OID_AUTO, rctl, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
98e0d69c5aSPawel Biernacki     "Resource Limits");
992b4035eeSEdward Tomasz Napierala SYSCTL_UINT(_kern_racct_rctl, OID_AUTO, maxbufsize, CTLFLAG_RWTUN,
1002b4035eeSEdward Tomasz Napierala     &rctl_maxbufsize, 0, "Maximum output buffer size");
101f70c075eSEdward Tomasz Napierala SYSCTL_UINT(_kern_racct_rctl, OID_AUTO, log_rate_limit, CTLFLAG_RW,
102f70c075eSEdward Tomasz Napierala     &rctl_log_rate_limit, 0, "Maximum number of log messages per second");
1038bd8c8f1SEdward Tomasz Napierala SYSCTL_UINT(_kern_racct_rctl, OID_AUTO, devctl_rate_limit, CTLFLAG_RWTUN,
104f70c075eSEdward Tomasz Napierala     &rctl_devctl_rate_limit, 0, "Maximum number of devctl messages per second");
1058bd8c8f1SEdward Tomasz Napierala SYSCTL_PROC(_kern_racct_rctl, OID_AUTO, throttle_min,
106e0d69c5aSPawel Biernacki     CTLTYPE_UINT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE, 0, 0,
107e0d69c5aSPawel Biernacki     &rctl_throttle_min_sysctl, "IU",
1088bd8c8f1SEdward Tomasz Napierala     "Shortest throttling duration, in hz");
1098bd8c8f1SEdward Tomasz Napierala TUNABLE_INT("kern.racct.rctl.throttle_min", &rctl_throttle_min);
1108bd8c8f1SEdward Tomasz Napierala SYSCTL_PROC(_kern_racct_rctl, OID_AUTO, throttle_max,
111e0d69c5aSPawel Biernacki     CTLTYPE_UINT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE, 0, 0,
112e0d69c5aSPawel Biernacki     &rctl_throttle_max_sysctl, "IU",
1138bd8c8f1SEdward Tomasz Napierala     "Longest throttling duration, in hz");
1148bd8c8f1SEdward Tomasz Napierala TUNABLE_INT("kern.racct.rctl.throttle_max", &rctl_throttle_max);
1158bd8c8f1SEdward Tomasz Napierala SYSCTL_PROC(_kern_racct_rctl, OID_AUTO, throttle_pct,
116e0d69c5aSPawel Biernacki     CTLTYPE_UINT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE, 0, 0,
117e0d69c5aSPawel Biernacki     &rctl_throttle_pct_sysctl, "IU",
118ae34b6ffSEdward Tomasz Napierala     "Throttling penalty for process consumption, in percent");
1198bd8c8f1SEdward Tomasz Napierala TUNABLE_INT("kern.racct.rctl.throttle_pct", &rctl_throttle_pct);
1208bd8c8f1SEdward Tomasz Napierala SYSCTL_PROC(_kern_racct_rctl, OID_AUTO, throttle_pct2,
121e0d69c5aSPawel Biernacki     CTLTYPE_UINT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE, 0, 0,
122e0d69c5aSPawel Biernacki     &rctl_throttle_pct2_sysctl, "IU",
123ae34b6ffSEdward Tomasz Napierala     "Throttling penalty for container consumption, in percent");
1248bd8c8f1SEdward Tomasz Napierala TUNABLE_INT("kern.racct.rctl.throttle_pct2", &rctl_throttle_pct2);
1252b4035eeSEdward Tomasz Napierala 
126ec125fbbSEdward Tomasz Napierala /*
127ec125fbbSEdward Tomasz Napierala  * 'rctl_rule_link' connects a rule with every racct it's related to.
128ec125fbbSEdward Tomasz Napierala  * For example, rule 'user:X:openfiles:deny=N/process' is linked
129ec125fbbSEdward Tomasz Napierala  * with uidinfo for user X, and to each process of that user.
130ec125fbbSEdward Tomasz Napierala  */
131ec125fbbSEdward Tomasz Napierala struct rctl_rule_link {
132ec125fbbSEdward Tomasz Napierala 	LIST_ENTRY(rctl_rule_link)	rrl_next;
133ec125fbbSEdward Tomasz Napierala 	struct rctl_rule		*rrl_rule;
134ec125fbbSEdward Tomasz Napierala 	int				rrl_exceeded;
135ec125fbbSEdward Tomasz Napierala };
136ec125fbbSEdward Tomasz Napierala 
137ec125fbbSEdward Tomasz Napierala struct dict {
138ec125fbbSEdward Tomasz Napierala 	const char	*d_name;
139ec125fbbSEdward Tomasz Napierala 	int		d_value;
140ec125fbbSEdward Tomasz Napierala };
141ec125fbbSEdward Tomasz Napierala 
142ec125fbbSEdward Tomasz Napierala static struct dict subjectnames[] = {
143ec125fbbSEdward Tomasz Napierala 	{ "process", RCTL_SUBJECT_TYPE_PROCESS },
144ec125fbbSEdward Tomasz Napierala 	{ "user", RCTL_SUBJECT_TYPE_USER },
145ec125fbbSEdward Tomasz Napierala 	{ "loginclass", RCTL_SUBJECT_TYPE_LOGINCLASS },
146ec125fbbSEdward Tomasz Napierala 	{ "jail", RCTL_SUBJECT_TYPE_JAIL },
147ec125fbbSEdward Tomasz Napierala 	{ NULL, -1 }};
148ec125fbbSEdward Tomasz Napierala 
149ec125fbbSEdward Tomasz Napierala static struct dict resourcenames[] = {
15085a2f1b4SEdward Tomasz Napierala 	{ "cputime", RACCT_CPU },
15185a2f1b4SEdward Tomasz Napierala 	{ "datasize", RACCT_DATA },
15285a2f1b4SEdward Tomasz Napierala 	{ "stacksize", RACCT_STACK },
15385a2f1b4SEdward Tomasz Napierala 	{ "coredumpsize", RACCT_CORE },
15485a2f1b4SEdward Tomasz Napierala 	{ "memoryuse", RACCT_RSS },
15585a2f1b4SEdward Tomasz Napierala 	{ "memorylocked", RACCT_MEMLOCK },
15685a2f1b4SEdward Tomasz Napierala 	{ "maxproc", RACCT_NPROC },
15785a2f1b4SEdward Tomasz Napierala 	{ "openfiles", RACCT_NOFILE },
15885a2f1b4SEdward Tomasz Napierala 	{ "vmemoryuse", RACCT_VMEM },
15985a2f1b4SEdward Tomasz Napierala 	{ "pseudoterminals", RACCT_NPTS },
16085a2f1b4SEdward Tomasz Napierala 	{ "swapuse", RACCT_SWAP },
161ec125fbbSEdward Tomasz Napierala 	{ "nthr", RACCT_NTHR },
162ec125fbbSEdward Tomasz Napierala 	{ "msgqqueued", RACCT_MSGQQUEUED },
163ec125fbbSEdward Tomasz Napierala 	{ "msgqsize", RACCT_MSGQSIZE },
164ec125fbbSEdward Tomasz Napierala 	{ "nmsgq", RACCT_NMSGQ },
165ec125fbbSEdward Tomasz Napierala 	{ "nsem", RACCT_NSEM },
166ec125fbbSEdward Tomasz Napierala 	{ "nsemop", RACCT_NSEMOP },
167ec125fbbSEdward Tomasz Napierala 	{ "nshm", RACCT_NSHM },
168ec125fbbSEdward Tomasz Napierala 	{ "shmsize", RACCT_SHMSIZE },
169ec125fbbSEdward Tomasz Napierala 	{ "wallclock", RACCT_WALLCLOCK },
17036af9869SEdward Tomasz Napierala 	{ "pcpu", RACCT_PCTCPU },
171ae34b6ffSEdward Tomasz Napierala 	{ "readbps", RACCT_READBPS },
172ae34b6ffSEdward Tomasz Napierala 	{ "writebps", RACCT_WRITEBPS },
173ae34b6ffSEdward Tomasz Napierala 	{ "readiops", RACCT_READIOPS },
174ae34b6ffSEdward Tomasz Napierala 	{ "writeiops", RACCT_WRITEIOPS },
175ec125fbbSEdward Tomasz Napierala 	{ NULL, -1 }};
176ec125fbbSEdward Tomasz Napierala 
177ec125fbbSEdward Tomasz Napierala static struct dict actionnames[] = {
178ec125fbbSEdward Tomasz Napierala 	{ "sighup", RCTL_ACTION_SIGHUP },
179ec125fbbSEdward Tomasz Napierala 	{ "sigint", RCTL_ACTION_SIGINT },
180ec125fbbSEdward Tomasz Napierala 	{ "sigquit", RCTL_ACTION_SIGQUIT },
181ec125fbbSEdward Tomasz Napierala 	{ "sigill", RCTL_ACTION_SIGILL },
182ec125fbbSEdward Tomasz Napierala 	{ "sigtrap", RCTL_ACTION_SIGTRAP },
183ec125fbbSEdward Tomasz Napierala 	{ "sigabrt", RCTL_ACTION_SIGABRT },
184ec125fbbSEdward Tomasz Napierala 	{ "sigemt", RCTL_ACTION_SIGEMT },
185ec125fbbSEdward Tomasz Napierala 	{ "sigfpe", RCTL_ACTION_SIGFPE },
186ec125fbbSEdward Tomasz Napierala 	{ "sigkill", RCTL_ACTION_SIGKILL },
187ec125fbbSEdward Tomasz Napierala 	{ "sigbus", RCTL_ACTION_SIGBUS },
188ec125fbbSEdward Tomasz Napierala 	{ "sigsegv", RCTL_ACTION_SIGSEGV },
189ec125fbbSEdward Tomasz Napierala 	{ "sigsys", RCTL_ACTION_SIGSYS },
190ec125fbbSEdward Tomasz Napierala 	{ "sigpipe", RCTL_ACTION_SIGPIPE },
191ec125fbbSEdward Tomasz Napierala 	{ "sigalrm", RCTL_ACTION_SIGALRM },
192ec125fbbSEdward Tomasz Napierala 	{ "sigterm", RCTL_ACTION_SIGTERM },
193ec125fbbSEdward Tomasz Napierala 	{ "sigurg", RCTL_ACTION_SIGURG },
194ec125fbbSEdward Tomasz Napierala 	{ "sigstop", RCTL_ACTION_SIGSTOP },
195ec125fbbSEdward Tomasz Napierala 	{ "sigtstp", RCTL_ACTION_SIGTSTP },
196ec125fbbSEdward Tomasz Napierala 	{ "sigchld", RCTL_ACTION_SIGCHLD },
197ec125fbbSEdward Tomasz Napierala 	{ "sigttin", RCTL_ACTION_SIGTTIN },
198ec125fbbSEdward Tomasz Napierala 	{ "sigttou", RCTL_ACTION_SIGTTOU },
199ec125fbbSEdward Tomasz Napierala 	{ "sigio", RCTL_ACTION_SIGIO },
200ec125fbbSEdward Tomasz Napierala 	{ "sigxcpu", RCTL_ACTION_SIGXCPU },
201ec125fbbSEdward Tomasz Napierala 	{ "sigxfsz", RCTL_ACTION_SIGXFSZ },
202ec125fbbSEdward Tomasz Napierala 	{ "sigvtalrm", RCTL_ACTION_SIGVTALRM },
203ec125fbbSEdward Tomasz Napierala 	{ "sigprof", RCTL_ACTION_SIGPROF },
204ec125fbbSEdward Tomasz Napierala 	{ "sigwinch", RCTL_ACTION_SIGWINCH },
205ec125fbbSEdward Tomasz Napierala 	{ "siginfo", RCTL_ACTION_SIGINFO },
206ec125fbbSEdward Tomasz Napierala 	{ "sigusr1", RCTL_ACTION_SIGUSR1 },
207ec125fbbSEdward Tomasz Napierala 	{ "sigusr2", RCTL_ACTION_SIGUSR2 },
208ec125fbbSEdward Tomasz Napierala 	{ "sigthr", RCTL_ACTION_SIGTHR },
209ec125fbbSEdward Tomasz Napierala 	{ "deny", RCTL_ACTION_DENY },
210ec125fbbSEdward Tomasz Napierala 	{ "log", RCTL_ACTION_LOG },
211ec125fbbSEdward Tomasz Napierala 	{ "devctl", RCTL_ACTION_DEVCTL },
212ae34b6ffSEdward Tomasz Napierala 	{ "throttle", RCTL_ACTION_THROTTLE },
213ec125fbbSEdward Tomasz Napierala 	{ NULL, -1 }};
214ec125fbbSEdward Tomasz Napierala 
215ec125fbbSEdward Tomasz Napierala static void rctl_init(void);
216ec125fbbSEdward Tomasz Napierala SYSINIT(rctl, SI_SUB_RACCT, SI_ORDER_FIRST, rctl_init, NULL);
217ec125fbbSEdward Tomasz Napierala 
218ec125fbbSEdward Tomasz Napierala static uma_zone_t rctl_rule_zone;
219c1a43e73SEdward Tomasz Napierala static uma_zone_t rctl_rule_link_zone;
2204c230cdaSEdward Tomasz Napierala 
221ec125fbbSEdward Tomasz Napierala static int rctl_rule_fully_specified(const struct rctl_rule *rule);
222ec125fbbSEdward Tomasz Napierala static void rctl_rule_to_sbuf(struct sbuf *sb, const struct rctl_rule *rule);
223ec125fbbSEdward Tomasz Napierala 
224d745c852SEd Schouten static MALLOC_DEFINE(M_RCTL, "rctl", "Resource Limits");
225ec125fbbSEdward Tomasz Napierala 
2268bd8c8f1SEdward Tomasz Napierala static int rctl_throttle_min_sysctl(SYSCTL_HANDLER_ARGS)
2278bd8c8f1SEdward Tomasz Napierala {
228c1a43e73SEdward Tomasz Napierala 	int error, val = rctl_throttle_min;
2298bd8c8f1SEdward Tomasz Napierala 
2308bd8c8f1SEdward Tomasz Napierala 	error = sysctl_handle_int(oidp, &val, 0, req);
2318bd8c8f1SEdward Tomasz Napierala 	if (error || !req->newptr)
2328bd8c8f1SEdward Tomasz Napierala 		return (error);
2338bd8c8f1SEdward Tomasz Napierala 	if (val < 1 || val > rctl_throttle_max)
2348bd8c8f1SEdward Tomasz Napierala 		return (EINVAL);
2358bd8c8f1SEdward Tomasz Napierala 
236bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK();
2378bd8c8f1SEdward Tomasz Napierala 	rctl_throttle_min = val;
238bbe4eb6dSEdward Tomasz Napierala 	RACCT_UNLOCK();
2398bd8c8f1SEdward Tomasz Napierala 
2408bd8c8f1SEdward Tomasz Napierala 	return (0);
2418bd8c8f1SEdward Tomasz Napierala }
2428bd8c8f1SEdward Tomasz Napierala 
2438bd8c8f1SEdward Tomasz Napierala static int rctl_throttle_max_sysctl(SYSCTL_HANDLER_ARGS)
2448bd8c8f1SEdward Tomasz Napierala {
245c1a43e73SEdward Tomasz Napierala 	int error, val = rctl_throttle_max;
2468bd8c8f1SEdward Tomasz Napierala 
2478bd8c8f1SEdward Tomasz Napierala 	error = sysctl_handle_int(oidp, &val, 0, req);
2488bd8c8f1SEdward Tomasz Napierala 	if (error || !req->newptr)
2498bd8c8f1SEdward Tomasz Napierala 		return (error);
2508bd8c8f1SEdward Tomasz Napierala 	if (val < rctl_throttle_min)
2518bd8c8f1SEdward Tomasz Napierala 		return (EINVAL);
2528bd8c8f1SEdward Tomasz Napierala 
253bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK();
2548bd8c8f1SEdward Tomasz Napierala 	rctl_throttle_max = val;
255bbe4eb6dSEdward Tomasz Napierala 	RACCT_UNLOCK();
2568bd8c8f1SEdward Tomasz Napierala 
2578bd8c8f1SEdward Tomasz Napierala 	return (0);
2588bd8c8f1SEdward Tomasz Napierala }
2598bd8c8f1SEdward Tomasz Napierala 
2608bd8c8f1SEdward Tomasz Napierala static int rctl_throttle_pct_sysctl(SYSCTL_HANDLER_ARGS)
2618bd8c8f1SEdward Tomasz Napierala {
262c1a43e73SEdward Tomasz Napierala 	int error, val = rctl_throttle_pct;
2638bd8c8f1SEdward Tomasz Napierala 
2648bd8c8f1SEdward Tomasz Napierala 	error = sysctl_handle_int(oidp, &val, 0, req);
2658bd8c8f1SEdward Tomasz Napierala 	if (error || !req->newptr)
2668bd8c8f1SEdward Tomasz Napierala 		return (error);
2678bd8c8f1SEdward Tomasz Napierala 	if (val < 0)
2688bd8c8f1SEdward Tomasz Napierala 		return (EINVAL);
2698bd8c8f1SEdward Tomasz Napierala 
270bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK();
2718bd8c8f1SEdward Tomasz Napierala 	rctl_throttle_pct = val;
272bbe4eb6dSEdward Tomasz Napierala 	RACCT_UNLOCK();
2738bd8c8f1SEdward Tomasz Napierala 
2748bd8c8f1SEdward Tomasz Napierala 	return (0);
2758bd8c8f1SEdward Tomasz Napierala }
2768bd8c8f1SEdward Tomasz Napierala 
2778bd8c8f1SEdward Tomasz Napierala static int rctl_throttle_pct2_sysctl(SYSCTL_HANDLER_ARGS)
2788bd8c8f1SEdward Tomasz Napierala {
279c1a43e73SEdward Tomasz Napierala 	int error, val = rctl_throttle_pct2;
2808bd8c8f1SEdward Tomasz Napierala 
2818bd8c8f1SEdward Tomasz Napierala 	error = sysctl_handle_int(oidp, &val, 0, req);
2828bd8c8f1SEdward Tomasz Napierala 	if (error || !req->newptr)
2838bd8c8f1SEdward Tomasz Napierala 		return (error);
2848bd8c8f1SEdward Tomasz Napierala 	if (val < 0)
2858bd8c8f1SEdward Tomasz Napierala 		return (EINVAL);
2868bd8c8f1SEdward Tomasz Napierala 
287bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK();
2888bd8c8f1SEdward Tomasz Napierala 	rctl_throttle_pct2 = val;
289bbe4eb6dSEdward Tomasz Napierala 	RACCT_UNLOCK();
2908bd8c8f1SEdward Tomasz Napierala 
2918bd8c8f1SEdward Tomasz Napierala 	return (0);
2928bd8c8f1SEdward Tomasz Napierala }
2938bd8c8f1SEdward Tomasz Napierala 
294ec125fbbSEdward Tomasz Napierala static const char *
295ec125fbbSEdward Tomasz Napierala rctl_subject_type_name(int subject)
296ec125fbbSEdward Tomasz Napierala {
297ec125fbbSEdward Tomasz Napierala 	int i;
298ec125fbbSEdward Tomasz Napierala 
299ec125fbbSEdward Tomasz Napierala 	for (i = 0; subjectnames[i].d_name != NULL; i++) {
300ec125fbbSEdward Tomasz Napierala 		if (subjectnames[i].d_value == subject)
301ec125fbbSEdward Tomasz Napierala 			return (subjectnames[i].d_name);
302ec125fbbSEdward Tomasz Napierala 	}
303ec125fbbSEdward Tomasz Napierala 
304ec125fbbSEdward Tomasz Napierala 	panic("rctl_subject_type_name: unknown subject type %d", subject);
305ec125fbbSEdward Tomasz Napierala }
306ec125fbbSEdward Tomasz Napierala 
307ec125fbbSEdward Tomasz Napierala static const char *
308ec125fbbSEdward Tomasz Napierala rctl_action_name(int action)
309ec125fbbSEdward Tomasz Napierala {
310ec125fbbSEdward Tomasz Napierala 	int i;
311ec125fbbSEdward Tomasz Napierala 
312ec125fbbSEdward Tomasz Napierala 	for (i = 0; actionnames[i].d_name != NULL; i++) {
313ec125fbbSEdward Tomasz Napierala 		if (actionnames[i].d_value == action)
314ec125fbbSEdward Tomasz Napierala 			return (actionnames[i].d_name);
315ec125fbbSEdward Tomasz Napierala 	}
316ec125fbbSEdward Tomasz Napierala 
317ec125fbbSEdward Tomasz Napierala 	panic("rctl_action_name: unknown action %d", action);
318ec125fbbSEdward Tomasz Napierala }
319ec125fbbSEdward Tomasz Napierala 
320ec125fbbSEdward Tomasz Napierala const char *
321ec125fbbSEdward Tomasz Napierala rctl_resource_name(int resource)
322ec125fbbSEdward Tomasz Napierala {
323ec125fbbSEdward Tomasz Napierala 	int i;
324ec125fbbSEdward Tomasz Napierala 
325ec125fbbSEdward Tomasz Napierala 	for (i = 0; resourcenames[i].d_name != NULL; i++) {
326ec125fbbSEdward Tomasz Napierala 		if (resourcenames[i].d_value == resource)
327ec125fbbSEdward Tomasz Napierala 			return (resourcenames[i].d_name);
328ec125fbbSEdward Tomasz Napierala 	}
329ec125fbbSEdward Tomasz Napierala 
330ec125fbbSEdward Tomasz Napierala 	panic("rctl_resource_name: unknown resource %d", resource);
331ec125fbbSEdward Tomasz Napierala }
332ec125fbbSEdward Tomasz Napierala 
333ac3c9819SEdward Tomasz Napierala static struct racct *
334ac3c9819SEdward Tomasz Napierala rctl_proc_rule_to_racct(const struct proc *p, const struct rctl_rule *rule)
335ac3c9819SEdward Tomasz Napierala {
336ac3c9819SEdward Tomasz Napierala 	struct ucred *cred = p->p_ucred;
337ac3c9819SEdward Tomasz Napierala 
338ac3c9819SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
339bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK_ASSERT();
340ac3c9819SEdward Tomasz Napierala 
341ac3c9819SEdward Tomasz Napierala 	switch (rule->rr_per) {
342ac3c9819SEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_PROCESS:
343ac3c9819SEdward Tomasz Napierala 		return (p->p_racct);
344ac3c9819SEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_USER:
345ac3c9819SEdward Tomasz Napierala 		return (cred->cr_ruidinfo->ui_racct);
346ac3c9819SEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_LOGINCLASS:
347ac3c9819SEdward Tomasz Napierala 		return (cred->cr_loginclass->lc_racct);
348ac3c9819SEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_JAIL:
349ac3c9819SEdward Tomasz Napierala 		return (cred->cr_prison->pr_prison_racct->prr_racct);
350ac3c9819SEdward Tomasz Napierala 	default:
351ac3c9819SEdward Tomasz Napierala 		panic("%s: unknown per %d", __func__, rule->rr_per);
352ac3c9819SEdward Tomasz Napierala 	}
353ac3c9819SEdward Tomasz Napierala }
354ac3c9819SEdward Tomasz Napierala 
355ec125fbbSEdward Tomasz Napierala /*
356ec125fbbSEdward Tomasz Napierala  * Return the amount of resource that can be allocated by 'p' before
357ec125fbbSEdward Tomasz Napierala  * hitting 'rule'.
358ec125fbbSEdward Tomasz Napierala  */
359ec125fbbSEdward Tomasz Napierala static int64_t
360ec125fbbSEdward Tomasz Napierala rctl_available_resource(const struct proc *p, const struct rctl_rule *rule)
361ec125fbbSEdward Tomasz Napierala {
362ac3c9819SEdward Tomasz Napierala 	const struct racct *racct;
363c1a43e73SEdward Tomasz Napierala 	int64_t available;
364ec125fbbSEdward Tomasz Napierala 
3654b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
366bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK_ASSERT();
367ec125fbbSEdward Tomasz Napierala 
368ac3c9819SEdward Tomasz Napierala 	racct = rctl_proc_rule_to_racct(p, rule);
369ac3c9819SEdward Tomasz Napierala 	available = rule->rr_amount - racct->r_resources[rule->rr_resource];
370ec125fbbSEdward Tomasz Napierala 
371ec125fbbSEdward Tomasz Napierala 	return (available);
372ec125fbbSEdward Tomasz Napierala }
373ec125fbbSEdward Tomasz Napierala 
374ec125fbbSEdward Tomasz Napierala /*
375ae34b6ffSEdward Tomasz Napierala  * Called every second for proc, uidinfo, loginclass, and jail containers.
376ae34b6ffSEdward Tomasz Napierala  * If the limit isn't exceeded, it decreases the usage amount to zero.
377ae34b6ffSEdward Tomasz Napierala  * Otherwise, it decreases it by the value of the limit.  This way
378ae34b6ffSEdward Tomasz Napierala  * resource consumption exceeding the limit "carries over" to the next
379ae34b6ffSEdward Tomasz Napierala  * period.
380ec125fbbSEdward Tomasz Napierala  */
381ae34b6ffSEdward Tomasz Napierala void
382ae34b6ffSEdward Tomasz Napierala rctl_throttle_decay(struct racct *racct, int resource)
383ec125fbbSEdward Tomasz Napierala {
384ae34b6ffSEdward Tomasz Napierala 	struct rctl_rule *rule;
385ae34b6ffSEdward Tomasz Napierala 	struct rctl_rule_link *link;
386ae34b6ffSEdward Tomasz Napierala 	int64_t minavailable;
387ec125fbbSEdward Tomasz Napierala 
3884b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
389bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK_ASSERT();
390ec125fbbSEdward Tomasz Napierala 
391ae34b6ffSEdward Tomasz Napierala 	minavailable = INT64_MAX;
392ec125fbbSEdward Tomasz Napierala 
393ae34b6ffSEdward Tomasz Napierala 	LIST_FOREACH(link, &racct->r_rule_links, rrl_next) {
394ae34b6ffSEdward Tomasz Napierala 		rule = link->rrl_rule;
395ae34b6ffSEdward Tomasz Napierala 
396ae34b6ffSEdward Tomasz Napierala 		if (rule->rr_resource != resource)
397ae34b6ffSEdward Tomasz Napierala 			continue;
398ae34b6ffSEdward Tomasz Napierala 		if (rule->rr_action != RCTL_ACTION_THROTTLE)
399ae34b6ffSEdward Tomasz Napierala 			continue;
400ae34b6ffSEdward Tomasz Napierala 
401ae34b6ffSEdward Tomasz Napierala 		if (rule->rr_amount < minavailable)
402ae34b6ffSEdward Tomasz Napierala 			minavailable = rule->rr_amount;
403ae34b6ffSEdward Tomasz Napierala 	}
404ae34b6ffSEdward Tomasz Napierala 
405ae34b6ffSEdward Tomasz Napierala 	if (racct->r_resources[resource] < minavailable) {
406ae34b6ffSEdward Tomasz Napierala 		racct->r_resources[resource] = 0;
407ae34b6ffSEdward Tomasz Napierala 	} else {
408ae34b6ffSEdward Tomasz Napierala 		/*
409ae34b6ffSEdward Tomasz Napierala 		 * Cap utilization counter at ten times the limit.  Otherwise,
410ae34b6ffSEdward Tomasz Napierala 		 * if we changed the rule lowering the allowed amount, it could
411ae34b6ffSEdward Tomasz Napierala 		 * take unreasonably long time for the accumulated resource
412ae34b6ffSEdward Tomasz Napierala 		 * usage to drop.
413ae34b6ffSEdward Tomasz Napierala 		 */
414ae34b6ffSEdward Tomasz Napierala 		if (racct->r_resources[resource] > minavailable * 10)
415ae34b6ffSEdward Tomasz Napierala 			racct->r_resources[resource] = minavailable * 10;
416ae34b6ffSEdward Tomasz Napierala 
417ae34b6ffSEdward Tomasz Napierala 		racct->r_resources[resource] -= minavailable;
418ae34b6ffSEdward Tomasz Napierala 	}
419ec125fbbSEdward Tomasz Napierala }
420ec125fbbSEdward Tomasz Napierala 
421ec125fbbSEdward Tomasz Napierala /*
422af1a7b25SEdward Tomasz Napierala  * Special version of rctl_get_available() for the %CPU resource.
42336af9869SEdward Tomasz Napierala  * We slightly cheat here and return less than we normally would.
42436af9869SEdward Tomasz Napierala  */
42536af9869SEdward Tomasz Napierala int64_t
42636af9869SEdward Tomasz Napierala rctl_pcpu_available(const struct proc *p) {
42736af9869SEdward Tomasz Napierala 	struct rctl_rule *rule;
42836af9869SEdward Tomasz Napierala 	struct rctl_rule_link *link;
42936af9869SEdward Tomasz Napierala 	int64_t available, minavailable, limit;
43036af9869SEdward Tomasz Napierala 
4314b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
432bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK_ASSERT();
4334b5c9cf6SEdward Tomasz Napierala 
43436af9869SEdward Tomasz Napierala 	minavailable = INT64_MAX;
43536af9869SEdward Tomasz Napierala 	limit = 0;
43636af9869SEdward Tomasz Napierala 
43736af9869SEdward Tomasz Napierala 	LIST_FOREACH(link, &p->p_racct->r_rule_links, rrl_next) {
43836af9869SEdward Tomasz Napierala 		rule = link->rrl_rule;
43936af9869SEdward Tomasz Napierala 		if (rule->rr_resource != RACCT_PCTCPU)
44036af9869SEdward Tomasz Napierala 			continue;
44136af9869SEdward Tomasz Napierala 		if (rule->rr_action != RCTL_ACTION_DENY)
44236af9869SEdward Tomasz Napierala 			continue;
44336af9869SEdward Tomasz Napierala 		available = rctl_available_resource(p, rule);
44436af9869SEdward Tomasz Napierala 		if (available < minavailable) {
44536af9869SEdward Tomasz Napierala 			minavailable = available;
44636af9869SEdward Tomasz Napierala 			limit = rule->rr_amount;
44736af9869SEdward Tomasz Napierala 		}
44836af9869SEdward Tomasz Napierala 	}
44936af9869SEdward Tomasz Napierala 
45036af9869SEdward Tomasz Napierala 	/*
45136af9869SEdward Tomasz Napierala 	 * Return slightly less than actual value of the available
452e3043798SPedro F. Giffuni 	 * %cpu resource.  This makes %cpu throttling more aggressive
45336af9869SEdward Tomasz Napierala 	 * and lets us act sooner than the limits are already exceeded.
45436af9869SEdward Tomasz Napierala 	 */
45536af9869SEdward Tomasz Napierala 	if (limit != 0) {
45636af9869SEdward Tomasz Napierala 		if (limit > 2 * RCTL_PCPU_SHIFT)
45736af9869SEdward Tomasz Napierala 			minavailable -= RCTL_PCPU_SHIFT;
45836af9869SEdward Tomasz Napierala 		else
45936af9869SEdward Tomasz Napierala 			minavailable -= (limit / 2);
46036af9869SEdward Tomasz Napierala 	}
46136af9869SEdward Tomasz Napierala 
46236af9869SEdward Tomasz Napierala 	return (minavailable);
46336af9869SEdward Tomasz Napierala }
46436af9869SEdward Tomasz Napierala 
465ae34b6ffSEdward Tomasz Napierala static uint64_t
466ae34b6ffSEdward Tomasz Napierala xadd(uint64_t a, uint64_t b)
467ae34b6ffSEdward Tomasz Napierala {
468ae34b6ffSEdward Tomasz Napierala 	uint64_t c;
469ae34b6ffSEdward Tomasz Napierala 
470ae34b6ffSEdward Tomasz Napierala 	c = a + b;
471ae34b6ffSEdward Tomasz Napierala 
472ae34b6ffSEdward Tomasz Napierala 	/*
473ae34b6ffSEdward Tomasz Napierala 	 * Detect overflow.
474ae34b6ffSEdward Tomasz Napierala 	 */
475ae34b6ffSEdward Tomasz Napierala 	if (c < a || c < b)
476ae34b6ffSEdward Tomasz Napierala 		return (UINT64_MAX);
477ae34b6ffSEdward Tomasz Napierala 
478ae34b6ffSEdward Tomasz Napierala 	return (c);
479ae34b6ffSEdward Tomasz Napierala }
480ae34b6ffSEdward Tomasz Napierala 
481ae34b6ffSEdward Tomasz Napierala static uint64_t
482ae34b6ffSEdward Tomasz Napierala xmul(uint64_t a, uint64_t b)
483ae34b6ffSEdward Tomasz Napierala {
484ae34b6ffSEdward Tomasz Napierala 
485f459a818SEdward Tomasz Napierala 	if (b != 0 && a > UINT64_MAX / b)
486ae34b6ffSEdward Tomasz Napierala 		return (UINT64_MAX);
487ae34b6ffSEdward Tomasz Napierala 
488f459a818SEdward Tomasz Napierala 	return (a * b);
489ae34b6ffSEdward Tomasz Napierala }
490ae34b6ffSEdward Tomasz Napierala 
49136af9869SEdward Tomasz Napierala /*
492ec125fbbSEdward Tomasz Napierala  * Check whether the proc 'p' can allocate 'amount' of 'resource' in addition
493ec125fbbSEdward Tomasz Napierala  * to what it keeps allocated now.  Returns non-zero if the allocation should
494ec125fbbSEdward Tomasz Napierala  * be denied, 0 otherwise.
495ec125fbbSEdward Tomasz Napierala  */
496ec125fbbSEdward Tomasz Napierala int
497ec125fbbSEdward Tomasz Napierala rctl_enforce(struct proc *p, int resource, uint64_t amount)
498ec125fbbSEdward Tomasz Napierala {
499f70c075eSEdward Tomasz Napierala 	static struct timeval log_lasttime, devctl_lasttime;
500f70c075eSEdward Tomasz Napierala 	static int log_curtime = 0, devctl_curtime = 0;
501ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *rule;
502ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
503ec125fbbSEdward Tomasz Napierala 	struct sbuf sb;
504c1a43e73SEdward Tomasz Napierala 	char *buf;
505ae34b6ffSEdward Tomasz Napierala 	int64_t available;
506ae34b6ffSEdward Tomasz Napierala 	uint64_t sleep_ms, sleep_ratio;
507ec125fbbSEdward Tomasz Napierala 	int should_deny = 0;
508ec125fbbSEdward Tomasz Napierala 
5094b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
510bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK_ASSERT();
511ec125fbbSEdward Tomasz Napierala 
512ec125fbbSEdward Tomasz Napierala 	/*
513ec125fbbSEdward Tomasz Napierala 	 * There may be more than one matching rule; go through all of them.
514ec125fbbSEdward Tomasz Napierala 	 * Denial should be done last, after logging and sending signals.
515ec125fbbSEdward Tomasz Napierala 	 */
516ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &p->p_racct->r_rule_links, rrl_next) {
517ec125fbbSEdward Tomasz Napierala 		rule = link->rrl_rule;
518ec125fbbSEdward Tomasz Napierala 		if (rule->rr_resource != resource)
519ec125fbbSEdward Tomasz Napierala 			continue;
520ae34b6ffSEdward Tomasz Napierala 
521ae34b6ffSEdward Tomasz Napierala 		available = rctl_available_resource(p, rule);
522ae34b6ffSEdward Tomasz Napierala 		if (available >= (int64_t)amount) {
523ec125fbbSEdward Tomasz Napierala 			link->rrl_exceeded = 0;
524ec125fbbSEdward Tomasz Napierala 			continue;
525ec125fbbSEdward Tomasz Napierala 		}
526ec125fbbSEdward Tomasz Napierala 
527ec125fbbSEdward Tomasz Napierala 		switch (rule->rr_action) {
528ec125fbbSEdward Tomasz Napierala 		case RCTL_ACTION_DENY:
529ec125fbbSEdward Tomasz Napierala 			should_deny = 1;
530ec125fbbSEdward Tomasz Napierala 			continue;
531ec125fbbSEdward Tomasz Napierala 		case RCTL_ACTION_LOG:
532ec125fbbSEdward Tomasz Napierala 			/*
533ec125fbbSEdward Tomasz Napierala 			 * If rrl_exceeded != 0, it means we've already
534ec125fbbSEdward Tomasz Napierala 			 * logged a warning for this process.
535ec125fbbSEdward Tomasz Napierala 			 */
536ec125fbbSEdward Tomasz Napierala 			if (link->rrl_exceeded != 0)
537ec125fbbSEdward Tomasz Napierala 				continue;
538ec125fbbSEdward Tomasz Napierala 
53972a401d9SEdward Tomasz Napierala 			/*
54072a401d9SEdward Tomasz Napierala 			 * If the process state is not fully initialized yet,
54172a401d9SEdward Tomasz Napierala 			 * we can't access most of the required fields, e.g.
54272a401d9SEdward Tomasz Napierala 			 * p->p_comm.  This happens when called from fork1().
54372a401d9SEdward Tomasz Napierala 			 * Ignore this rule for now; it will be processed just
54472a401d9SEdward Tomasz Napierala 			 * after fork, when called from racct_proc_fork_done().
54572a401d9SEdward Tomasz Napierala 			 */
54672a401d9SEdward Tomasz Napierala 			if (p->p_state != PRS_NORMAL)
54772a401d9SEdward Tomasz Napierala 				continue;
54872a401d9SEdward Tomasz Napierala 
549f70c075eSEdward Tomasz Napierala 			if (!ppsratecheck(&log_lasttime, &log_curtime,
550f70c075eSEdward Tomasz Napierala 			    rctl_log_rate_limit))
551ec125fbbSEdward Tomasz Napierala 				continue;
552ec125fbbSEdward Tomasz Napierala 
553ec125fbbSEdward Tomasz Napierala 			buf = malloc(RCTL_LOG_BUFSIZE, M_RCTL, M_NOWAIT);
554ec125fbbSEdward Tomasz Napierala 			if (buf == NULL) {
555ec125fbbSEdward Tomasz Napierala 				printf("rctl_enforce: out of memory\n");
556ec125fbbSEdward Tomasz Napierala 				continue;
557ec125fbbSEdward Tomasz Napierala 			}
558ec125fbbSEdward Tomasz Napierala 			sbuf_new(&sb, buf, RCTL_LOG_BUFSIZE, SBUF_FIXEDLEN);
559ec125fbbSEdward Tomasz Napierala 			rctl_rule_to_sbuf(&sb, rule);
560ec125fbbSEdward Tomasz Napierala 			sbuf_finish(&sb);
561ec125fbbSEdward Tomasz Napierala 			printf("rctl: rule \"%s\" matched by pid %d "
562ec125fbbSEdward Tomasz Napierala 			    "(%s), uid %d, jail %s\n", sbuf_data(&sb),
563ec125fbbSEdward Tomasz Napierala 			    p->p_pid, p->p_comm, p->p_ucred->cr_uid,
564a7ad07bfSEdward Tomasz Napierala 			    p->p_ucred->cr_prison->pr_prison_racct->prr_name);
565ec125fbbSEdward Tomasz Napierala 			sbuf_delete(&sb);
566ec125fbbSEdward Tomasz Napierala 			free(buf, M_RCTL);
567ec125fbbSEdward Tomasz Napierala 			link->rrl_exceeded = 1;
568ec125fbbSEdward Tomasz Napierala 			continue;
569ec125fbbSEdward Tomasz Napierala 		case RCTL_ACTION_DEVCTL:
570ec125fbbSEdward Tomasz Napierala 			if (link->rrl_exceeded != 0)
571ec125fbbSEdward Tomasz Napierala 				continue;
572ec125fbbSEdward Tomasz Napierala 
57372a401d9SEdward Tomasz Napierala 			if (p->p_state != PRS_NORMAL)
57472a401d9SEdward Tomasz Napierala 				continue;
57572a401d9SEdward Tomasz Napierala 
576f70c075eSEdward Tomasz Napierala 			if (!ppsratecheck(&devctl_lasttime, &devctl_curtime,
577f70c075eSEdward Tomasz Napierala 			    rctl_devctl_rate_limit))
578f70c075eSEdward Tomasz Napierala 				continue;
579f70c075eSEdward Tomasz Napierala 
580ec125fbbSEdward Tomasz Napierala 			buf = malloc(RCTL_LOG_BUFSIZE, M_RCTL, M_NOWAIT);
581ec125fbbSEdward Tomasz Napierala 			if (buf == NULL) {
582ec125fbbSEdward Tomasz Napierala 				printf("rctl_enforce: out of memory\n");
583ec125fbbSEdward Tomasz Napierala 				continue;
584ec125fbbSEdward Tomasz Napierala 			}
585ec125fbbSEdward Tomasz Napierala 			sbuf_new(&sb, buf, RCTL_LOG_BUFSIZE, SBUF_FIXEDLEN);
586ec125fbbSEdward Tomasz Napierala 			sbuf_printf(&sb, "rule=");
587ec125fbbSEdward Tomasz Napierala 			rctl_rule_to_sbuf(&sb, rule);
588ec125fbbSEdward Tomasz Napierala 			sbuf_printf(&sb, " pid=%d ruid=%d jail=%s",
589ec125fbbSEdward Tomasz Napierala 			    p->p_pid, p->p_ucred->cr_ruid,
590a7ad07bfSEdward Tomasz Napierala 			    p->p_ucred->cr_prison->pr_prison_racct->prr_name);
591ec125fbbSEdward Tomasz Napierala 			sbuf_finish(&sb);
592887611b1SWarner Losh 			devctl_notify("RCTL", "rule", "matched",
593887611b1SWarner Losh 			    sbuf_data(&sb));
594ec125fbbSEdward Tomasz Napierala 			sbuf_delete(&sb);
595ec125fbbSEdward Tomasz Napierala 			free(buf, M_RCTL);
596ec125fbbSEdward Tomasz Napierala 			link->rrl_exceeded = 1;
597ec125fbbSEdward Tomasz Napierala 			continue;
598ae34b6ffSEdward Tomasz Napierala 		case RCTL_ACTION_THROTTLE:
599ae34b6ffSEdward Tomasz Napierala 			if (p->p_state != PRS_NORMAL)
600ae34b6ffSEdward Tomasz Napierala 				continue;
601ae34b6ffSEdward Tomasz Napierala 
602e8a5a1adSJason A. Harmening 			if (rule->rr_amount == 0) {
603e8a5a1adSJason A. Harmening 				racct_proc_throttle(p, rctl_throttle_max);
604e8a5a1adSJason A. Harmening 				continue;
605e8a5a1adSJason A. Harmening 			}
606e8a5a1adSJason A. Harmening 
607ae34b6ffSEdward Tomasz Napierala 			/*
608ae34b6ffSEdward Tomasz Napierala 			 * Make the process sleep for a fraction of second
609ae34b6ffSEdward Tomasz Napierala 			 * proportional to the ratio of process' resource
610ae34b6ffSEdward Tomasz Napierala 			 * utilization compared to the limit.  The point is
611ae34b6ffSEdward Tomasz Napierala 			 * to penalize resource hogs: processes that consume
612ae34b6ffSEdward Tomasz Napierala 			 * more of the available resources sleep for longer.
613ae34b6ffSEdward Tomasz Napierala 			 *
614ae34b6ffSEdward Tomasz Napierala 			 * We're trying to defer division until the very end,
615ae34b6ffSEdward Tomasz Napierala 			 * to minimize the rounding effects.  The following
616ae34b6ffSEdward Tomasz Napierala 			 * calculation could have been written in a clearer
617ae34b6ffSEdward Tomasz Napierala 			 * way like this:
618ae34b6ffSEdward Tomasz Napierala 			 *
619ae34b6ffSEdward Tomasz Napierala 			 * sleep_ms = hz * p->p_racct->r_resources[resource] /
620ae34b6ffSEdward Tomasz Napierala 			 *     rule->rr_amount;
621ae34b6ffSEdward Tomasz Napierala 			 * sleep_ms *= rctl_throttle_pct / 100;
622ae34b6ffSEdward Tomasz Napierala 			 * if (sleep_ms < rctl_throttle_min)
623ae34b6ffSEdward Tomasz Napierala 			 *         sleep_ms = rctl_throttle_min;
624ae34b6ffSEdward Tomasz Napierala 			 *
625ae34b6ffSEdward Tomasz Napierala 			 */
626ae34b6ffSEdward Tomasz Napierala 			sleep_ms = xmul(hz, p->p_racct->r_resources[resource]);
627ae34b6ffSEdward Tomasz Napierala 			sleep_ms = xmul(sleep_ms,  rctl_throttle_pct) / 100;
628ae34b6ffSEdward Tomasz Napierala 			if (sleep_ms < rctl_throttle_min * rule->rr_amount)
629ae34b6ffSEdward Tomasz Napierala 				sleep_ms = rctl_throttle_min * rule->rr_amount;
630ae34b6ffSEdward Tomasz Napierala 
631ae34b6ffSEdward Tomasz Napierala 			/*
632ae34b6ffSEdward Tomasz Napierala 			 * Multiply that by the ratio of the resource
633ae34b6ffSEdward Tomasz Napierala 			 * consumption for the container compared to the limit,
634ae34b6ffSEdward Tomasz Napierala 			 * squared.  In other words, a process in a container
635ae34b6ffSEdward Tomasz Napierala 			 * that is two times over the limit will be throttled
636ae34b6ffSEdward Tomasz Napierala 			 * four times as much for hitting the same rule.  The
637ae34b6ffSEdward Tomasz Napierala 			 * point is to penalize processes more if the container
638ae34b6ffSEdward Tomasz Napierala 			 * itself (eg certain UID or jail) is above the limit.
639ae34b6ffSEdward Tomasz Napierala 			 */
640ae34b6ffSEdward Tomasz Napierala 			if (available < 0)
641ae34b6ffSEdward Tomasz Napierala 				sleep_ratio = -available / rule->rr_amount;
642ae34b6ffSEdward Tomasz Napierala 			else
643ae34b6ffSEdward Tomasz Napierala 				sleep_ratio = 0;
644ae34b6ffSEdward Tomasz Napierala 			sleep_ratio = xmul(sleep_ratio, sleep_ratio);
645ae34b6ffSEdward Tomasz Napierala 			sleep_ratio = xmul(sleep_ratio, rctl_throttle_pct2) / 100;
646ae34b6ffSEdward Tomasz Napierala 			sleep_ms = xadd(sleep_ms, xmul(sleep_ms, sleep_ratio));
647ae34b6ffSEdward Tomasz Napierala 
648ae34b6ffSEdward Tomasz Napierala 			/*
649ae34b6ffSEdward Tomasz Napierala 			 * Finally the division.
650ae34b6ffSEdward Tomasz Napierala 			 */
651ae34b6ffSEdward Tomasz Napierala 			sleep_ms /= rule->rr_amount;
652ae34b6ffSEdward Tomasz Napierala 
653ae34b6ffSEdward Tomasz Napierala 			if (sleep_ms > rctl_throttle_max)
654ae34b6ffSEdward Tomasz Napierala 				sleep_ms = rctl_throttle_max;
655ae34b6ffSEdward Tomasz Napierala #if 0
65674a7305aSEdward Tomasz Napierala 			printf("%s: pid %d (%s), %jd of %jd, will sleep for %ju ms (ratio %ju, available %jd)\n",
657ae34b6ffSEdward Tomasz Napierala 			   __func__, p->p_pid, p->p_comm,
658ae34b6ffSEdward Tomasz Napierala 			   p->p_racct->r_resources[resource],
65974a7305aSEdward Tomasz Napierala 			   rule->rr_amount, (uintmax_t)sleep_ms,
66074a7305aSEdward Tomasz Napierala 			   (uintmax_t)sleep_ratio, (intmax_t)available);
661ae34b6ffSEdward Tomasz Napierala #endif
662ae34b6ffSEdward Tomasz Napierala 
663ae34b6ffSEdward Tomasz Napierala 			KASSERT(sleep_ms >= rctl_throttle_min, ("%s: %ju < %d\n",
664ae34b6ffSEdward Tomasz Napierala 			    __func__, (uintmax_t)sleep_ms, rctl_throttle_min));
665ae34b6ffSEdward Tomasz Napierala 			racct_proc_throttle(p, sleep_ms);
666ae34b6ffSEdward Tomasz Napierala 			continue;
667ec125fbbSEdward Tomasz Napierala 		default:
668ec125fbbSEdward Tomasz Napierala 			if (link->rrl_exceeded != 0)
669ec125fbbSEdward Tomasz Napierala 				continue;
670ec125fbbSEdward Tomasz Napierala 
67172a401d9SEdward Tomasz Napierala 			if (p->p_state != PRS_NORMAL)
67272a401d9SEdward Tomasz Napierala 				continue;
67372a401d9SEdward Tomasz Napierala 
674ec125fbbSEdward Tomasz Napierala 			KASSERT(rule->rr_action > 0 &&
675ec125fbbSEdward Tomasz Napierala 			    rule->rr_action <= RCTL_ACTION_SIGNAL_MAX,
676ec125fbbSEdward Tomasz Napierala 			    ("rctl_enforce: unknown action %d",
677ec125fbbSEdward Tomasz Napierala 			     rule->rr_action));
678ec125fbbSEdward Tomasz Napierala 
679ec125fbbSEdward Tomasz Napierala 			/*
680ec125fbbSEdward Tomasz Napierala 			 * We're using the fact that RCTL_ACTION_SIG* values
681ec125fbbSEdward Tomasz Napierala 			 * are equal to their counterparts from sys/signal.h.
682ec125fbbSEdward Tomasz Napierala 			 */
6838451d0ddSKip Macy 			kern_psignal(p, rule->rr_action);
684ec125fbbSEdward Tomasz Napierala 			link->rrl_exceeded = 1;
685ec125fbbSEdward Tomasz Napierala 			continue;
686ec125fbbSEdward Tomasz Napierala 		}
687ec125fbbSEdward Tomasz Napierala 	}
688ec125fbbSEdward Tomasz Napierala 
689ec125fbbSEdward Tomasz Napierala 	if (should_deny) {
690ec125fbbSEdward Tomasz Napierala 		/*
691ec125fbbSEdward Tomasz Napierala 		 * Return fake error code; the caller should change it
692ec125fbbSEdward Tomasz Napierala 		 * into one proper for the situation - EFSIZ, ENOMEM etc.
693ec125fbbSEdward Tomasz Napierala 		 */
694ec125fbbSEdward Tomasz Napierala 		return (EDOOFUS);
695ec125fbbSEdward Tomasz Napierala 	}
696ec125fbbSEdward Tomasz Napierala 
697ec125fbbSEdward Tomasz Napierala 	return (0);
698ec125fbbSEdward Tomasz Napierala }
699ec125fbbSEdward Tomasz Napierala 
700ec125fbbSEdward Tomasz Napierala uint64_t
701ec125fbbSEdward Tomasz Napierala rctl_get_limit(struct proc *p, int resource)
702ec125fbbSEdward Tomasz Napierala {
703ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *rule;
704ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
705ec125fbbSEdward Tomasz Napierala 	uint64_t amount = UINT64_MAX;
706ec125fbbSEdward Tomasz Napierala 
7074b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
708bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK_ASSERT();
709ec125fbbSEdward Tomasz Napierala 
710ec125fbbSEdward Tomasz Napierala 	/*
711ec125fbbSEdward Tomasz Napierala 	 * There may be more than one matching rule; go through all of them.
712ec125fbbSEdward Tomasz Napierala 	 * Denial should be done last, after logging and sending signals.
713ec125fbbSEdward Tomasz Napierala 	 */
714ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &p->p_racct->r_rule_links, rrl_next) {
715ec125fbbSEdward Tomasz Napierala 		rule = link->rrl_rule;
716ec125fbbSEdward Tomasz Napierala 		if (rule->rr_resource != resource)
717ec125fbbSEdward Tomasz Napierala 			continue;
718ec125fbbSEdward Tomasz Napierala 		if (rule->rr_action != RCTL_ACTION_DENY)
719ec125fbbSEdward Tomasz Napierala 			continue;
720ec125fbbSEdward Tomasz Napierala 		if (rule->rr_amount < amount)
721ec125fbbSEdward Tomasz Napierala 			amount = rule->rr_amount;
722ec125fbbSEdward Tomasz Napierala 	}
723ec125fbbSEdward Tomasz Napierala 
724ec125fbbSEdward Tomasz Napierala 	return (amount);
725ec125fbbSEdward Tomasz Napierala }
726ec125fbbSEdward Tomasz Napierala 
727ec125fbbSEdward Tomasz Napierala uint64_t
728ec125fbbSEdward Tomasz Napierala rctl_get_available(struct proc *p, int resource)
729ec125fbbSEdward Tomasz Napierala {
730ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *rule;
731ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
732ec125fbbSEdward Tomasz Napierala 	int64_t available, minavailable, allocated;
733ec125fbbSEdward Tomasz Napierala 
734ec125fbbSEdward Tomasz Napierala 	minavailable = INT64_MAX;
735ec125fbbSEdward Tomasz Napierala 
7364b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
737bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK_ASSERT();
738ec125fbbSEdward Tomasz Napierala 
739ec125fbbSEdward Tomasz Napierala 	/*
740ec125fbbSEdward Tomasz Napierala 	 * There may be more than one matching rule; go through all of them.
741ec125fbbSEdward Tomasz Napierala 	 * Denial should be done last, after logging and sending signals.
742ec125fbbSEdward Tomasz Napierala 	 */
743ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &p->p_racct->r_rule_links, rrl_next) {
744ec125fbbSEdward Tomasz Napierala 		rule = link->rrl_rule;
745ec125fbbSEdward Tomasz Napierala 		if (rule->rr_resource != resource)
746ec125fbbSEdward Tomasz Napierala 			continue;
747ec125fbbSEdward Tomasz Napierala 		if (rule->rr_action != RCTL_ACTION_DENY)
748ec125fbbSEdward Tomasz Napierala 			continue;
749ec125fbbSEdward Tomasz Napierala 		available = rctl_available_resource(p, rule);
750ec125fbbSEdward Tomasz Napierala 		if (available < minavailable)
751ec125fbbSEdward Tomasz Napierala 			minavailable = available;
752ec125fbbSEdward Tomasz Napierala 	}
753ec125fbbSEdward Tomasz Napierala 
754ec125fbbSEdward Tomasz Napierala 	/*
755ec125fbbSEdward Tomasz Napierala 	 * XXX: Think about this _hard_.
756ec125fbbSEdward Tomasz Napierala 	 */
757ec125fbbSEdward Tomasz Napierala 	allocated = p->p_racct->r_resources[resource];
758ec125fbbSEdward Tomasz Napierala 	if (minavailable < INT64_MAX - allocated)
759ec125fbbSEdward Tomasz Napierala 		minavailable += allocated;
760ec125fbbSEdward Tomasz Napierala 	if (minavailable < 0)
761ec125fbbSEdward Tomasz Napierala 		minavailable = 0;
762bbe4eb6dSEdward Tomasz Napierala 
763ec125fbbSEdward Tomasz Napierala 	return (minavailable);
764ec125fbbSEdward Tomasz Napierala }
765ec125fbbSEdward Tomasz Napierala 
766ec125fbbSEdward Tomasz Napierala static int
767ec125fbbSEdward Tomasz Napierala rctl_rule_matches(const struct rctl_rule *rule, const struct rctl_rule *filter)
768ec125fbbSEdward Tomasz Napierala {
769ec125fbbSEdward Tomasz Napierala 
7704b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
7714b5c9cf6SEdward Tomasz Napierala 
772ec125fbbSEdward Tomasz Napierala 	if (filter->rr_subject_type != RCTL_SUBJECT_TYPE_UNDEFINED) {
773ec125fbbSEdward Tomasz Napierala 		if (rule->rr_subject_type != filter->rr_subject_type)
774ec125fbbSEdward Tomasz Napierala 			return (0);
775ec125fbbSEdward Tomasz Napierala 
776ec125fbbSEdward Tomasz Napierala 		switch (filter->rr_subject_type) {
777ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_PROCESS:
778ec125fbbSEdward Tomasz Napierala 			if (filter->rr_subject.rs_proc != NULL &&
779ec125fbbSEdward Tomasz Napierala 			    rule->rr_subject.rs_proc !=
780ec125fbbSEdward Tomasz Napierala 			    filter->rr_subject.rs_proc)
781ec125fbbSEdward Tomasz Napierala 				return (0);
782ec125fbbSEdward Tomasz Napierala 			break;
783ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_USER:
784ec125fbbSEdward Tomasz Napierala 			if (filter->rr_subject.rs_uip != NULL &&
785ec125fbbSEdward Tomasz Napierala 			    rule->rr_subject.rs_uip !=
786ec125fbbSEdward Tomasz Napierala 			    filter->rr_subject.rs_uip)
787ec125fbbSEdward Tomasz Napierala 				return (0);
788ec125fbbSEdward Tomasz Napierala 			break;
789ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_LOGINCLASS:
790415896e3SEdward Tomasz Napierala 			if (filter->rr_subject.rs_loginclass != NULL &&
791415896e3SEdward Tomasz Napierala 			    rule->rr_subject.rs_loginclass !=
792415896e3SEdward Tomasz Napierala 			    filter->rr_subject.rs_loginclass)
793ec125fbbSEdward Tomasz Napierala 				return (0);
794ec125fbbSEdward Tomasz Napierala 			break;
795ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_JAIL:
796a7ad07bfSEdward Tomasz Napierala 			if (filter->rr_subject.rs_prison_racct != NULL &&
797a7ad07bfSEdward Tomasz Napierala 			    rule->rr_subject.rs_prison_racct !=
798a7ad07bfSEdward Tomasz Napierala 			    filter->rr_subject.rs_prison_racct)
799ec125fbbSEdward Tomasz Napierala 				return (0);
800ec125fbbSEdward Tomasz Napierala 			break;
801ec125fbbSEdward Tomasz Napierala 		default:
802ec125fbbSEdward Tomasz Napierala 			panic("rctl_rule_matches: unknown subject type %d",
803ec125fbbSEdward Tomasz Napierala 			    filter->rr_subject_type);
804ec125fbbSEdward Tomasz Napierala 		}
805ec125fbbSEdward Tomasz Napierala 	}
806ec125fbbSEdward Tomasz Napierala 
807ec125fbbSEdward Tomasz Napierala 	if (filter->rr_resource != RACCT_UNDEFINED) {
808ec125fbbSEdward Tomasz Napierala 		if (rule->rr_resource != filter->rr_resource)
809ec125fbbSEdward Tomasz Napierala 			return (0);
810ec125fbbSEdward Tomasz Napierala 	}
811ec125fbbSEdward Tomasz Napierala 
812ec125fbbSEdward Tomasz Napierala 	if (filter->rr_action != RCTL_ACTION_UNDEFINED) {
813ec125fbbSEdward Tomasz Napierala 		if (rule->rr_action != filter->rr_action)
814ec125fbbSEdward Tomasz Napierala 			return (0);
815ec125fbbSEdward Tomasz Napierala 	}
816ec125fbbSEdward Tomasz Napierala 
817ec125fbbSEdward Tomasz Napierala 	if (filter->rr_amount != RCTL_AMOUNT_UNDEFINED) {
818ec125fbbSEdward Tomasz Napierala 		if (rule->rr_amount != filter->rr_amount)
819ec125fbbSEdward Tomasz Napierala 			return (0);
820ec125fbbSEdward Tomasz Napierala 	}
821ec125fbbSEdward Tomasz Napierala 
822ec125fbbSEdward Tomasz Napierala 	if (filter->rr_per != RCTL_SUBJECT_TYPE_UNDEFINED) {
823ec125fbbSEdward Tomasz Napierala 		if (rule->rr_per != filter->rr_per)
824ec125fbbSEdward Tomasz Napierala 			return (0);
825ec125fbbSEdward Tomasz Napierala 	}
826ec125fbbSEdward Tomasz Napierala 
827ec125fbbSEdward Tomasz Napierala 	return (1);
828ec125fbbSEdward Tomasz Napierala }
829ec125fbbSEdward Tomasz Napierala 
830ec125fbbSEdward Tomasz Napierala static int
831ec125fbbSEdward Tomasz Napierala str2value(const char *str, int *value, struct dict *table)
832ec125fbbSEdward Tomasz Napierala {
833ec125fbbSEdward Tomasz Napierala 	int i;
834ec125fbbSEdward Tomasz Napierala 
835ec125fbbSEdward Tomasz Napierala 	if (value == NULL)
836ec125fbbSEdward Tomasz Napierala 		return (EINVAL);
837ec125fbbSEdward Tomasz Napierala 
838ec125fbbSEdward Tomasz Napierala 	for (i = 0; table[i].d_name != NULL; i++) {
839ec125fbbSEdward Tomasz Napierala 		if (strcasecmp(table[i].d_name, str) == 0) {
840ec125fbbSEdward Tomasz Napierala 			*value =  table[i].d_value;
841ec125fbbSEdward Tomasz Napierala 			return (0);
842ec125fbbSEdward Tomasz Napierala 		}
843ec125fbbSEdward Tomasz Napierala 	}
844ec125fbbSEdward Tomasz Napierala 
845ec125fbbSEdward Tomasz Napierala 	return (EINVAL);
846ec125fbbSEdward Tomasz Napierala }
847ec125fbbSEdward Tomasz Napierala 
848ec125fbbSEdward Tomasz Napierala static int
849ec125fbbSEdward Tomasz Napierala str2id(const char *str, id_t *value)
850ec125fbbSEdward Tomasz Napierala {
851ec125fbbSEdward Tomasz Napierala 	char *end;
852ec125fbbSEdward Tomasz Napierala 
853ec125fbbSEdward Tomasz Napierala 	if (str == NULL)
854ec125fbbSEdward Tomasz Napierala 		return (EINVAL);
855ec125fbbSEdward Tomasz Napierala 
856ec125fbbSEdward Tomasz Napierala 	*value = strtoul(str, &end, 10);
857ec125fbbSEdward Tomasz Napierala 	if ((size_t)(end - str) != strlen(str))
858ec125fbbSEdward Tomasz Napierala 		return (EINVAL);
859ec125fbbSEdward Tomasz Napierala 
860ec125fbbSEdward Tomasz Napierala 	return (0);
861ec125fbbSEdward Tomasz Napierala }
862ec125fbbSEdward Tomasz Napierala 
863ec125fbbSEdward Tomasz Napierala static int
864ec125fbbSEdward Tomasz Napierala str2int64(const char *str, int64_t *value)
865ec125fbbSEdward Tomasz Napierala {
866ec125fbbSEdward Tomasz Napierala 	char *end;
867ec125fbbSEdward Tomasz Napierala 
868ec125fbbSEdward Tomasz Napierala 	if (str == NULL)
869ec125fbbSEdward Tomasz Napierala 		return (EINVAL);
870ec125fbbSEdward Tomasz Napierala 
871ec125fbbSEdward Tomasz Napierala 	*value = strtoul(str, &end, 10);
872ec125fbbSEdward Tomasz Napierala 	if ((size_t)(end - str) != strlen(str))
873ec125fbbSEdward Tomasz Napierala 		return (EINVAL);
874ec125fbbSEdward Tomasz Napierala 
875b450d447SEdward Tomasz Napierala 	if (*value < 0)
876b450d447SEdward Tomasz Napierala 		return (ERANGE);
877b450d447SEdward Tomasz Napierala 
878ec125fbbSEdward Tomasz Napierala 	return (0);
879ec125fbbSEdward Tomasz Napierala }
880ec125fbbSEdward Tomasz Napierala 
881ec125fbbSEdward Tomasz Napierala /*
882ec125fbbSEdward Tomasz Napierala  * Connect the rule to the racct, increasing refcount for the rule.
883ec125fbbSEdward Tomasz Napierala  */
884ec125fbbSEdward Tomasz Napierala static void
885ec125fbbSEdward Tomasz Napierala rctl_racct_add_rule(struct racct *racct, struct rctl_rule *rule)
886ec125fbbSEdward Tomasz Napierala {
887ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
888ec125fbbSEdward Tomasz Napierala 
8894b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
890ec125fbbSEdward Tomasz Napierala 	KASSERT(rctl_rule_fully_specified(rule), ("rule not fully specified"));
891ec125fbbSEdward Tomasz Napierala 
892ec125fbbSEdward Tomasz Napierala 	rctl_rule_acquire(rule);
893ec125fbbSEdward Tomasz Napierala 	link = uma_zalloc(rctl_rule_link_zone, M_WAITOK);
894ec125fbbSEdward Tomasz Napierala 	link->rrl_rule = rule;
895ec125fbbSEdward Tomasz Napierala 	link->rrl_exceeded = 0;
896ec125fbbSEdward Tomasz Napierala 
897bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK();
898ec125fbbSEdward Tomasz Napierala 	LIST_INSERT_HEAD(&racct->r_rule_links, link, rrl_next);
899bbe4eb6dSEdward Tomasz Napierala 	RACCT_UNLOCK();
900ec125fbbSEdward Tomasz Napierala }
901ec125fbbSEdward Tomasz Napierala 
902ec125fbbSEdward Tomasz Napierala static int
903ec125fbbSEdward Tomasz Napierala rctl_racct_add_rule_locked(struct racct *racct, struct rctl_rule *rule)
904ec125fbbSEdward Tomasz Napierala {
905ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
906ec125fbbSEdward Tomasz Napierala 
9074b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
908ec125fbbSEdward Tomasz Napierala 	KASSERT(rctl_rule_fully_specified(rule), ("rule not fully specified"));
909bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK_ASSERT();
910ec125fbbSEdward Tomasz Napierala 
911ec125fbbSEdward Tomasz Napierala 	link = uma_zalloc(rctl_rule_link_zone, M_NOWAIT);
912ec125fbbSEdward Tomasz Napierala 	if (link == NULL)
913ec125fbbSEdward Tomasz Napierala 		return (ENOMEM);
914ec125fbbSEdward Tomasz Napierala 	rctl_rule_acquire(rule);
915ec125fbbSEdward Tomasz Napierala 	link->rrl_rule = rule;
916ec125fbbSEdward Tomasz Napierala 	link->rrl_exceeded = 0;
917ec125fbbSEdward Tomasz Napierala 
918ec125fbbSEdward Tomasz Napierala 	LIST_INSERT_HEAD(&racct->r_rule_links, link, rrl_next);
919bbe4eb6dSEdward Tomasz Napierala 
920ec125fbbSEdward Tomasz Napierala 	return (0);
921ec125fbbSEdward Tomasz Napierala }
922ec125fbbSEdward Tomasz Napierala 
923ec125fbbSEdward Tomasz Napierala /*
924ec125fbbSEdward Tomasz Napierala  * Remove limits for a rules matching the filter and release
925ec125fbbSEdward Tomasz Napierala  * the refcounts for the rules, possibly freeing them.  Returns
926ec125fbbSEdward Tomasz Napierala  * the number of limit structures removed.
927ec125fbbSEdward Tomasz Napierala  */
928ec125fbbSEdward Tomasz Napierala static int
929ec125fbbSEdward Tomasz Napierala rctl_racct_remove_rules(struct racct *racct,
930ec125fbbSEdward Tomasz Napierala     const struct rctl_rule *filter)
931ec125fbbSEdward Tomasz Napierala {
932ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link, *linktmp;
933c1a43e73SEdward Tomasz Napierala 	int removed = 0;
934ec125fbbSEdward Tomasz Napierala 
9354b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
936bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK_ASSERT();
937ec125fbbSEdward Tomasz Napierala 
938ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH_SAFE(link, &racct->r_rule_links, rrl_next, linktmp) {
939ec125fbbSEdward Tomasz Napierala 		if (!rctl_rule_matches(link->rrl_rule, filter))
940ec125fbbSEdward Tomasz Napierala 			continue;
941ec125fbbSEdward Tomasz Napierala 
942ec125fbbSEdward Tomasz Napierala 		LIST_REMOVE(link, rrl_next);
943ec125fbbSEdward Tomasz Napierala 		rctl_rule_release(link->rrl_rule);
944ec125fbbSEdward Tomasz Napierala 		uma_zfree(rctl_rule_link_zone, link);
945ec125fbbSEdward Tomasz Napierala 		removed++;
946ec125fbbSEdward Tomasz Napierala 	}
947ec125fbbSEdward Tomasz Napierala 	return (removed);
948ec125fbbSEdward Tomasz Napierala }
949ec125fbbSEdward Tomasz Napierala 
950ec125fbbSEdward Tomasz Napierala static void
951ec125fbbSEdward Tomasz Napierala rctl_rule_acquire_subject(struct rctl_rule *rule)
952ec125fbbSEdward Tomasz Napierala {
953ec125fbbSEdward Tomasz Napierala 
9544b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
9554b5c9cf6SEdward Tomasz Napierala 
956ec125fbbSEdward Tomasz Napierala 	switch (rule->rr_subject_type) {
957ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_UNDEFINED:
958ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_PROCESS:
959a7ad07bfSEdward Tomasz Napierala 		break;
960ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_JAIL:
961a7ad07bfSEdward Tomasz Napierala 		if (rule->rr_subject.rs_prison_racct != NULL)
962a7ad07bfSEdward Tomasz Napierala 			prison_racct_hold(rule->rr_subject.rs_prison_racct);
963ec125fbbSEdward Tomasz Napierala 		break;
964ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_USER:
965ec125fbbSEdward Tomasz Napierala 		if (rule->rr_subject.rs_uip != NULL)
966ec125fbbSEdward Tomasz Napierala 			uihold(rule->rr_subject.rs_uip);
967ec125fbbSEdward Tomasz Napierala 		break;
968ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_LOGINCLASS:
969415896e3SEdward Tomasz Napierala 		if (rule->rr_subject.rs_loginclass != NULL)
970415896e3SEdward Tomasz Napierala 			loginclass_hold(rule->rr_subject.rs_loginclass);
971ec125fbbSEdward Tomasz Napierala 		break;
972ec125fbbSEdward Tomasz Napierala 	default:
973ec125fbbSEdward Tomasz Napierala 		panic("rctl_rule_acquire_subject: unknown subject type %d",
974ec125fbbSEdward Tomasz Napierala 		    rule->rr_subject_type);
975ec125fbbSEdward Tomasz Napierala 	}
976ec125fbbSEdward Tomasz Napierala }
977ec125fbbSEdward Tomasz Napierala 
978ec125fbbSEdward Tomasz Napierala static void
979ec125fbbSEdward Tomasz Napierala rctl_rule_release_subject(struct rctl_rule *rule)
980ec125fbbSEdward Tomasz Napierala {
981ec125fbbSEdward Tomasz Napierala 
9824b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
9834b5c9cf6SEdward Tomasz Napierala 
984ec125fbbSEdward Tomasz Napierala 	switch (rule->rr_subject_type) {
985ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_UNDEFINED:
986ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_PROCESS:
987a7ad07bfSEdward Tomasz Napierala 		break;
988ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_JAIL:
989a7ad07bfSEdward Tomasz Napierala 		if (rule->rr_subject.rs_prison_racct != NULL)
990a7ad07bfSEdward Tomasz Napierala 			prison_racct_free(rule->rr_subject.rs_prison_racct);
991ec125fbbSEdward Tomasz Napierala 		break;
992ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_USER:
993ec125fbbSEdward Tomasz Napierala 		if (rule->rr_subject.rs_uip != NULL)
994ec125fbbSEdward Tomasz Napierala 			uifree(rule->rr_subject.rs_uip);
995ec125fbbSEdward Tomasz Napierala 		break;
996ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_LOGINCLASS:
997415896e3SEdward Tomasz Napierala 		if (rule->rr_subject.rs_loginclass != NULL)
998415896e3SEdward Tomasz Napierala 			loginclass_free(rule->rr_subject.rs_loginclass);
999ec125fbbSEdward Tomasz Napierala 		break;
1000ec125fbbSEdward Tomasz Napierala 	default:
1001ec125fbbSEdward Tomasz Napierala 		panic("rctl_rule_release_subject: unknown subject type %d",
1002ec125fbbSEdward Tomasz Napierala 		    rule->rr_subject_type);
1003ec125fbbSEdward Tomasz Napierala 	}
1004ec125fbbSEdward Tomasz Napierala }
1005ec125fbbSEdward Tomasz Napierala 
1006ec125fbbSEdward Tomasz Napierala struct rctl_rule *
1007ec125fbbSEdward Tomasz Napierala rctl_rule_alloc(int flags)
1008ec125fbbSEdward Tomasz Napierala {
1009ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *rule;
1010ec125fbbSEdward Tomasz Napierala 
10114b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
10124b5c9cf6SEdward Tomasz Napierala 
1013ec125fbbSEdward Tomasz Napierala 	rule = uma_zalloc(rctl_rule_zone, flags);
1014ec125fbbSEdward Tomasz Napierala 	if (rule == NULL)
1015ec125fbbSEdward Tomasz Napierala 		return (NULL);
1016ec125fbbSEdward Tomasz Napierala 	rule->rr_subject_type = RCTL_SUBJECT_TYPE_UNDEFINED;
1017ec125fbbSEdward Tomasz Napierala 	rule->rr_subject.rs_proc = NULL;
1018ec125fbbSEdward Tomasz Napierala 	rule->rr_subject.rs_uip = NULL;
1019415896e3SEdward Tomasz Napierala 	rule->rr_subject.rs_loginclass = NULL;
1020a7ad07bfSEdward Tomasz Napierala 	rule->rr_subject.rs_prison_racct = NULL;
1021ec125fbbSEdward Tomasz Napierala 	rule->rr_per = RCTL_SUBJECT_TYPE_UNDEFINED;
1022ec125fbbSEdward Tomasz Napierala 	rule->rr_resource = RACCT_UNDEFINED;
1023ec125fbbSEdward Tomasz Napierala 	rule->rr_action = RCTL_ACTION_UNDEFINED;
1024ec125fbbSEdward Tomasz Napierala 	rule->rr_amount = RCTL_AMOUNT_UNDEFINED;
1025ec125fbbSEdward Tomasz Napierala 	refcount_init(&rule->rr_refcount, 1);
1026ec125fbbSEdward Tomasz Napierala 
1027ec125fbbSEdward Tomasz Napierala 	return (rule);
1028ec125fbbSEdward Tomasz Napierala }
1029ec125fbbSEdward Tomasz Napierala 
1030ec125fbbSEdward Tomasz Napierala struct rctl_rule *
1031ec125fbbSEdward Tomasz Napierala rctl_rule_duplicate(const struct rctl_rule *rule, int flags)
1032ec125fbbSEdward Tomasz Napierala {
1033ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *copy;
1034ec125fbbSEdward Tomasz Napierala 
10354b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
10364b5c9cf6SEdward Tomasz Napierala 
1037ec125fbbSEdward Tomasz Napierala 	copy = uma_zalloc(rctl_rule_zone, flags);
1038ec125fbbSEdward Tomasz Napierala 	if (copy == NULL)
1039ec125fbbSEdward Tomasz Napierala 		return (NULL);
1040ec125fbbSEdward Tomasz Napierala 	copy->rr_subject_type = rule->rr_subject_type;
1041ec125fbbSEdward Tomasz Napierala 	copy->rr_subject.rs_proc = rule->rr_subject.rs_proc;
1042ec125fbbSEdward Tomasz Napierala 	copy->rr_subject.rs_uip = rule->rr_subject.rs_uip;
1043415896e3SEdward Tomasz Napierala 	copy->rr_subject.rs_loginclass = rule->rr_subject.rs_loginclass;
1044a7ad07bfSEdward Tomasz Napierala 	copy->rr_subject.rs_prison_racct = rule->rr_subject.rs_prison_racct;
1045ec125fbbSEdward Tomasz Napierala 	copy->rr_per = rule->rr_per;
1046ec125fbbSEdward Tomasz Napierala 	copy->rr_resource = rule->rr_resource;
1047ec125fbbSEdward Tomasz Napierala 	copy->rr_action = rule->rr_action;
1048ec125fbbSEdward Tomasz Napierala 	copy->rr_amount = rule->rr_amount;
1049ec125fbbSEdward Tomasz Napierala 	refcount_init(&copy->rr_refcount, 1);
1050ec125fbbSEdward Tomasz Napierala 	rctl_rule_acquire_subject(copy);
1051ec125fbbSEdward Tomasz Napierala 
1052ec125fbbSEdward Tomasz Napierala 	return (copy);
1053ec125fbbSEdward Tomasz Napierala }
1054ec125fbbSEdward Tomasz Napierala 
1055ec125fbbSEdward Tomasz Napierala void
1056ec125fbbSEdward Tomasz Napierala rctl_rule_acquire(struct rctl_rule *rule)
1057ec125fbbSEdward Tomasz Napierala {
1058ec125fbbSEdward Tomasz Napierala 
10594b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
1060ec125fbbSEdward Tomasz Napierala 	KASSERT(rule->rr_refcount > 0, ("rule->rr_refcount <= 0"));
1061ec125fbbSEdward Tomasz Napierala 
1062ec125fbbSEdward Tomasz Napierala 	refcount_acquire(&rule->rr_refcount);
1063ec125fbbSEdward Tomasz Napierala }
1064ec125fbbSEdward Tomasz Napierala 
1065ec125fbbSEdward Tomasz Napierala static void
1066ec125fbbSEdward Tomasz Napierala rctl_rule_free(void *context, int pending)
1067ec125fbbSEdward Tomasz Napierala {
1068ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *rule;
1069ec125fbbSEdward Tomasz Napierala 
1070ec125fbbSEdward Tomasz Napierala 	rule = (struct rctl_rule *)context;
1071ec125fbbSEdward Tomasz Napierala 
10724b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
1073ec125fbbSEdward Tomasz Napierala 	KASSERT(rule->rr_refcount == 0, ("rule->rr_refcount != 0"));
1074ec125fbbSEdward Tomasz Napierala 
1075ec125fbbSEdward Tomasz Napierala 	/*
1076ec125fbbSEdward Tomasz Napierala 	 * We don't need locking here; rule is guaranteed to be inaccessible.
1077ec125fbbSEdward Tomasz Napierala 	 */
1078ec125fbbSEdward Tomasz Napierala 
1079ec125fbbSEdward Tomasz Napierala 	rctl_rule_release_subject(rule);
1080ec125fbbSEdward Tomasz Napierala 	uma_zfree(rctl_rule_zone, rule);
1081ec125fbbSEdward Tomasz Napierala }
1082ec125fbbSEdward Tomasz Napierala 
1083ec125fbbSEdward Tomasz Napierala void
1084ec125fbbSEdward Tomasz Napierala rctl_rule_release(struct rctl_rule *rule)
1085ec125fbbSEdward Tomasz Napierala {
1086ec125fbbSEdward Tomasz Napierala 
10874b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
1088ec125fbbSEdward Tomasz Napierala 	KASSERT(rule->rr_refcount > 0, ("rule->rr_refcount <= 0"));
1089ec125fbbSEdward Tomasz Napierala 
1090ec125fbbSEdward Tomasz Napierala 	if (refcount_release(&rule->rr_refcount)) {
1091ec125fbbSEdward Tomasz Napierala 		/*
1092ec125fbbSEdward Tomasz Napierala 		 * rctl_rule_release() is often called when iterating
1093ec125fbbSEdward Tomasz Napierala 		 * over all the uidinfo structures in the system,
1094ec125fbbSEdward Tomasz Napierala 		 * holding uihashtbl_lock.  Since rctl_rule_free()
1095ec125fbbSEdward Tomasz Napierala 		 * might end up calling uifree(), this would lead
1096ec125fbbSEdward Tomasz Napierala 		 * to lock recursion.  Use taskqueue to avoid this.
1097ec125fbbSEdward Tomasz Napierala 		 */
1098ec125fbbSEdward Tomasz Napierala 		TASK_INIT(&rule->rr_task, 0, rctl_rule_free, rule);
1099ec125fbbSEdward Tomasz Napierala 		taskqueue_enqueue(taskqueue_thread, &rule->rr_task);
1100ec125fbbSEdward Tomasz Napierala 	}
1101ec125fbbSEdward Tomasz Napierala }
1102ec125fbbSEdward Tomasz Napierala 
1103ec125fbbSEdward Tomasz Napierala static int
1104ec125fbbSEdward Tomasz Napierala rctl_rule_fully_specified(const struct rctl_rule *rule)
1105ec125fbbSEdward Tomasz Napierala {
1106ec125fbbSEdward Tomasz Napierala 
11074b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
11084b5c9cf6SEdward Tomasz Napierala 
1109ec125fbbSEdward Tomasz Napierala 	switch (rule->rr_subject_type) {
1110ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_UNDEFINED:
1111ec125fbbSEdward Tomasz Napierala 		return (0);
1112ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_PROCESS:
1113ec125fbbSEdward Tomasz Napierala 		if (rule->rr_subject.rs_proc == NULL)
1114ec125fbbSEdward Tomasz Napierala 			return (0);
1115ec125fbbSEdward Tomasz Napierala 		break;
1116ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_USER:
1117ec125fbbSEdward Tomasz Napierala 		if (rule->rr_subject.rs_uip == NULL)
1118ec125fbbSEdward Tomasz Napierala 			return (0);
1119ec125fbbSEdward Tomasz Napierala 		break;
1120ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_LOGINCLASS:
1121415896e3SEdward Tomasz Napierala 		if (rule->rr_subject.rs_loginclass == NULL)
1122ec125fbbSEdward Tomasz Napierala 			return (0);
1123ec125fbbSEdward Tomasz Napierala 		break;
1124ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_JAIL:
1125a7ad07bfSEdward Tomasz Napierala 		if (rule->rr_subject.rs_prison_racct == NULL)
1126ec125fbbSEdward Tomasz Napierala 			return (0);
1127ec125fbbSEdward Tomasz Napierala 		break;
1128ec125fbbSEdward Tomasz Napierala 	default:
1129ec125fbbSEdward Tomasz Napierala 		panic("rctl_rule_fully_specified: unknown subject type %d",
1130ec125fbbSEdward Tomasz Napierala 		    rule->rr_subject_type);
1131ec125fbbSEdward Tomasz Napierala 	}
1132ec125fbbSEdward Tomasz Napierala 	if (rule->rr_resource == RACCT_UNDEFINED)
1133ec125fbbSEdward Tomasz Napierala 		return (0);
1134ec125fbbSEdward Tomasz Napierala 	if (rule->rr_action == RCTL_ACTION_UNDEFINED)
1135ec125fbbSEdward Tomasz Napierala 		return (0);
1136ec125fbbSEdward Tomasz Napierala 	if (rule->rr_amount == RCTL_AMOUNT_UNDEFINED)
1137ec125fbbSEdward Tomasz Napierala 		return (0);
1138ec125fbbSEdward Tomasz Napierala 	if (rule->rr_per == RCTL_SUBJECT_TYPE_UNDEFINED)
1139ec125fbbSEdward Tomasz Napierala 		return (0);
1140ec125fbbSEdward Tomasz Napierala 
1141ec125fbbSEdward Tomasz Napierala 	return (1);
1142ec125fbbSEdward Tomasz Napierala }
1143ec125fbbSEdward Tomasz Napierala 
1144ec125fbbSEdward Tomasz Napierala static int
1145ec125fbbSEdward Tomasz Napierala rctl_string_to_rule(char *rulestr, struct rctl_rule **rulep)
1146ec125fbbSEdward Tomasz Napierala {
1147c1a43e73SEdward Tomasz Napierala 	struct rctl_rule *rule;
1148ec125fbbSEdward Tomasz Napierala 	char *subjectstr, *subject_idstr, *resourcestr, *actionstr,
1149ec125fbbSEdward Tomasz Napierala 	     *amountstr, *perstr;
1150ec125fbbSEdward Tomasz Napierala 	id_t id;
1151c1a43e73SEdward Tomasz Napierala 	int error = 0;
1152ec125fbbSEdward Tomasz Napierala 
11534b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
11544b5c9cf6SEdward Tomasz Napierala 
1155ec125fbbSEdward Tomasz Napierala 	rule = rctl_rule_alloc(M_WAITOK);
1156ec125fbbSEdward Tomasz Napierala 
1157ec125fbbSEdward Tomasz Napierala 	subjectstr = strsep(&rulestr, ":");
1158ec125fbbSEdward Tomasz Napierala 	subject_idstr = strsep(&rulestr, ":");
1159ec125fbbSEdward Tomasz Napierala 	resourcestr = strsep(&rulestr, ":");
1160ec125fbbSEdward Tomasz Napierala 	actionstr = strsep(&rulestr, "=/");
1161ec125fbbSEdward Tomasz Napierala 	amountstr = strsep(&rulestr, "/");
1162ec125fbbSEdward Tomasz Napierala 	perstr = rulestr;
1163ec125fbbSEdward Tomasz Napierala 
1164ec125fbbSEdward Tomasz Napierala 	if (subjectstr == NULL || subjectstr[0] == '\0')
1165ec125fbbSEdward Tomasz Napierala 		rule->rr_subject_type = RCTL_SUBJECT_TYPE_UNDEFINED;
1166ec125fbbSEdward Tomasz Napierala 	else {
1167ec125fbbSEdward Tomasz Napierala 		error = str2value(subjectstr, &rule->rr_subject_type, subjectnames);
1168ec125fbbSEdward Tomasz Napierala 		if (error != 0)
1169ec125fbbSEdward Tomasz Napierala 			goto out;
1170ec125fbbSEdward Tomasz Napierala 	}
1171ec125fbbSEdward Tomasz Napierala 
1172ec125fbbSEdward Tomasz Napierala 	if (subject_idstr == NULL || subject_idstr[0] == '\0') {
1173ec125fbbSEdward Tomasz Napierala 		rule->rr_subject.rs_proc = NULL;
1174ec125fbbSEdward Tomasz Napierala 		rule->rr_subject.rs_uip = NULL;
1175415896e3SEdward Tomasz Napierala 		rule->rr_subject.rs_loginclass = NULL;
1176a7ad07bfSEdward Tomasz Napierala 		rule->rr_subject.rs_prison_racct = NULL;
1177ec125fbbSEdward Tomasz Napierala 	} else {
1178ec125fbbSEdward Tomasz Napierala 		switch (rule->rr_subject_type) {
1179ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_UNDEFINED:
1180ec125fbbSEdward Tomasz Napierala 			error = EINVAL;
1181ec125fbbSEdward Tomasz Napierala 			goto out;
1182ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_PROCESS:
1183ec125fbbSEdward Tomasz Napierala 			error = str2id(subject_idstr, &id);
1184ec125fbbSEdward Tomasz Napierala 			if (error != 0)
1185ec125fbbSEdward Tomasz Napierala 				goto out;
1186ec125fbbSEdward Tomasz Napierala 			sx_assert(&allproc_lock, SA_LOCKED);
1187ec125fbbSEdward Tomasz Napierala 			rule->rr_subject.rs_proc = pfind(id);
1188ec125fbbSEdward Tomasz Napierala 			if (rule->rr_subject.rs_proc == NULL) {
1189ec125fbbSEdward Tomasz Napierala 				error = ESRCH;
1190ec125fbbSEdward Tomasz Napierala 				goto out;
1191ec125fbbSEdward Tomasz Napierala 			}
1192ec125fbbSEdward Tomasz Napierala 			PROC_UNLOCK(rule->rr_subject.rs_proc);
1193ec125fbbSEdward Tomasz Napierala 			break;
1194ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_USER:
1195ec125fbbSEdward Tomasz Napierala 			error = str2id(subject_idstr, &id);
1196ec125fbbSEdward Tomasz Napierala 			if (error != 0)
1197ec125fbbSEdward Tomasz Napierala 				goto out;
1198ec125fbbSEdward Tomasz Napierala 			rule->rr_subject.rs_uip = uifind(id);
1199ec125fbbSEdward Tomasz Napierala 			break;
1200ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_LOGINCLASS:
1201415896e3SEdward Tomasz Napierala 			rule->rr_subject.rs_loginclass =
1202ec125fbbSEdward Tomasz Napierala 			    loginclass_find(subject_idstr);
1203415896e3SEdward Tomasz Napierala 			if (rule->rr_subject.rs_loginclass == NULL) {
1204ec125fbbSEdward Tomasz Napierala 				error = ENAMETOOLONG;
1205ec125fbbSEdward Tomasz Napierala 				goto out;
1206ec125fbbSEdward Tomasz Napierala 			}
1207ec125fbbSEdward Tomasz Napierala 			break;
1208ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_JAIL:
1209a7ad07bfSEdward Tomasz Napierala 			rule->rr_subject.rs_prison_racct =
1210a7ad07bfSEdward Tomasz Napierala 			    prison_racct_find(subject_idstr);
1211a7ad07bfSEdward Tomasz Napierala 			if (rule->rr_subject.rs_prison_racct == NULL) {
1212a7ad07bfSEdward Tomasz Napierala 				error = ENAMETOOLONG;
1213ec125fbbSEdward Tomasz Napierala 				goto out;
1214ec125fbbSEdward Tomasz Napierala 			}
1215ec125fbbSEdward Tomasz Napierala 			break;
1216ec125fbbSEdward Tomasz Napierala                default:
1217ec125fbbSEdward Tomasz Napierala                        panic("rctl_string_to_rule: unknown subject type %d",
1218ec125fbbSEdward Tomasz Napierala                            rule->rr_subject_type);
1219ec125fbbSEdward Tomasz Napierala                }
1220ec125fbbSEdward Tomasz Napierala 	}
1221ec125fbbSEdward Tomasz Napierala 
1222ec125fbbSEdward Tomasz Napierala 	if (resourcestr == NULL || resourcestr[0] == '\0')
1223ec125fbbSEdward Tomasz Napierala 		rule->rr_resource = RACCT_UNDEFINED;
1224ec125fbbSEdward Tomasz Napierala 	else {
1225ec125fbbSEdward Tomasz Napierala 		error = str2value(resourcestr, &rule->rr_resource,
1226ec125fbbSEdward Tomasz Napierala 		    resourcenames);
1227ec125fbbSEdward Tomasz Napierala 		if (error != 0)
1228ec125fbbSEdward Tomasz Napierala 			goto out;
1229ec125fbbSEdward Tomasz Napierala 	}
1230ec125fbbSEdward Tomasz Napierala 
1231ec125fbbSEdward Tomasz Napierala 	if (actionstr == NULL || actionstr[0] == '\0')
1232ec125fbbSEdward Tomasz Napierala 		rule->rr_action = RCTL_ACTION_UNDEFINED;
1233ec125fbbSEdward Tomasz Napierala 	else {
1234ec125fbbSEdward Tomasz Napierala 		error = str2value(actionstr, &rule->rr_action, actionnames);
1235ec125fbbSEdward Tomasz Napierala 		if (error != 0)
1236ec125fbbSEdward Tomasz Napierala 			goto out;
1237ec125fbbSEdward Tomasz Napierala 	}
1238ec125fbbSEdward Tomasz Napierala 
1239ec125fbbSEdward Tomasz Napierala 	if (amountstr == NULL || amountstr[0] == '\0')
1240ec125fbbSEdward Tomasz Napierala 		rule->rr_amount = RCTL_AMOUNT_UNDEFINED;
1241ec125fbbSEdward Tomasz Napierala 	else {
1242ec125fbbSEdward Tomasz Napierala 		error = str2int64(amountstr, &rule->rr_amount);
1243ec125fbbSEdward Tomasz Napierala 		if (error != 0)
1244ec125fbbSEdward Tomasz Napierala 			goto out;
1245b450d447SEdward Tomasz Napierala 		if (RACCT_IS_IN_MILLIONS(rule->rr_resource)) {
1246b450d447SEdward Tomasz Napierala 			if (rule->rr_amount > INT64_MAX / 1000000) {
1247b450d447SEdward Tomasz Napierala 				error = ERANGE;
1248b450d447SEdward Tomasz Napierala 				goto out;
1249b450d447SEdward Tomasz Napierala 			}
1250cff08ec0SEdward Tomasz Napierala 			rule->rr_amount *= 1000000;
1251ec125fbbSEdward Tomasz Napierala 		}
1252b450d447SEdward Tomasz Napierala 	}
1253ec125fbbSEdward Tomasz Napierala 
1254ec125fbbSEdward Tomasz Napierala 	if (perstr == NULL || perstr[0] == '\0')
1255ec125fbbSEdward Tomasz Napierala 		rule->rr_per = RCTL_SUBJECT_TYPE_UNDEFINED;
1256ec125fbbSEdward Tomasz Napierala 	else {
1257ec125fbbSEdward Tomasz Napierala 		error = str2value(perstr, &rule->rr_per, subjectnames);
1258ec125fbbSEdward Tomasz Napierala 		if (error != 0)
1259ec125fbbSEdward Tomasz Napierala 			goto out;
1260ec125fbbSEdward Tomasz Napierala 	}
1261ec125fbbSEdward Tomasz Napierala 
1262ec125fbbSEdward Tomasz Napierala out:
1263ec125fbbSEdward Tomasz Napierala 	if (error == 0)
1264ec125fbbSEdward Tomasz Napierala 		*rulep = rule;
1265ec125fbbSEdward Tomasz Napierala 	else
1266ec125fbbSEdward Tomasz Napierala 		rctl_rule_release(rule);
1267ec125fbbSEdward Tomasz Napierala 
1268ec125fbbSEdward Tomasz Napierala 	return (error);
1269ec125fbbSEdward Tomasz Napierala }
1270ec125fbbSEdward Tomasz Napierala 
1271ec125fbbSEdward Tomasz Napierala /*
1272ec125fbbSEdward Tomasz Napierala  * Link a rule with all the subjects it applies to.
1273ec125fbbSEdward Tomasz Napierala  */
1274ec125fbbSEdward Tomasz Napierala int
1275ec125fbbSEdward Tomasz Napierala rctl_rule_add(struct rctl_rule *rule)
1276ec125fbbSEdward Tomasz Napierala {
1277ec125fbbSEdward Tomasz Napierala 	struct proc *p;
1278ec125fbbSEdward Tomasz Napierala 	struct ucred *cred;
1279ec125fbbSEdward Tomasz Napierala 	struct uidinfo *uip;
1280ec125fbbSEdward Tomasz Napierala 	struct prison *pr;
1281a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
1282ec125fbbSEdward Tomasz Napierala 	struct loginclass *lc;
1283ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *rule2;
1284ec125fbbSEdward Tomasz Napierala 	int match;
1285ec125fbbSEdward Tomasz Napierala 
12864b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
1287ec125fbbSEdward Tomasz Napierala 	KASSERT(rctl_rule_fully_specified(rule), ("rule not fully specified"));
1288ec125fbbSEdward Tomasz Napierala 
1289ec125fbbSEdward Tomasz Napierala 	/*
1290ae34b6ffSEdward Tomasz Napierala 	 * Some rules just don't make sense, like "deny" rule for an undeniable
1291ae34b6ffSEdward Tomasz Napierala 	 * resource.  The exception are the RSS and %CPU resources - they are
1292ae34b6ffSEdward Tomasz Napierala 	 * not deniable in the racct sense, but the limit is enforced in
1293ae34b6ffSEdward Tomasz Napierala 	 * a different way.
1294ec125fbbSEdward Tomasz Napierala 	 */
1295ec125fbbSEdward Tomasz Napierala 	if (rule->rr_action == RCTL_ACTION_DENY &&
1296ae34b6ffSEdward Tomasz Napierala 	    !RACCT_IS_DENIABLE(rule->rr_resource) &&
1297ae34b6ffSEdward Tomasz Napierala 	    rule->rr_resource != RACCT_RSS &&
1298ae34b6ffSEdward Tomasz Napierala 	    rule->rr_resource != RACCT_PCTCPU) {
1299ec125fbbSEdward Tomasz Napierala 		return (EOPNOTSUPP);
1300ae34b6ffSEdward Tomasz Napierala 	}
1301ae34b6ffSEdward Tomasz Napierala 
1302ae34b6ffSEdward Tomasz Napierala 	if (rule->rr_action == RCTL_ACTION_THROTTLE &&
1303ae34b6ffSEdward Tomasz Napierala 	    !RACCT_IS_DECAYING(rule->rr_resource)) {
1304ae34b6ffSEdward Tomasz Napierala 		return (EOPNOTSUPP);
1305ae34b6ffSEdward Tomasz Napierala 	}
1306ae34b6ffSEdward Tomasz Napierala 
1307ae34b6ffSEdward Tomasz Napierala 	if (rule->rr_action == RCTL_ACTION_THROTTLE &&
1308ae34b6ffSEdward Tomasz Napierala 	    rule->rr_resource == RACCT_PCTCPU) {
1309ae34b6ffSEdward Tomasz Napierala 		return (EOPNOTSUPP);
1310ae34b6ffSEdward Tomasz Napierala 	}
1311ec125fbbSEdward Tomasz Napierala 
1312ec125fbbSEdward Tomasz Napierala 	if (rule->rr_per == RCTL_SUBJECT_TYPE_PROCESS &&
1313ae34b6ffSEdward Tomasz Napierala 	    RACCT_IS_SLOPPY(rule->rr_resource)) {
1314ec125fbbSEdward Tomasz Napierala 		return (EOPNOTSUPP);
1315ae34b6ffSEdward Tomasz Napierala 	}
1316ec125fbbSEdward Tomasz Napierala 
1317ec125fbbSEdward Tomasz Napierala 	/*
1318ec125fbbSEdward Tomasz Napierala 	 * Make sure there are no duplicated rules.  Also, for the "deny"
1319ec125fbbSEdward Tomasz Napierala 	 * rules, remove ones differing only by "amount".
1320ec125fbbSEdward Tomasz Napierala 	 */
1321ec125fbbSEdward Tomasz Napierala 	if (rule->rr_action == RCTL_ACTION_DENY) {
1322ec125fbbSEdward Tomasz Napierala 		rule2 = rctl_rule_duplicate(rule, M_WAITOK);
1323ec125fbbSEdward Tomasz Napierala 		rule2->rr_amount = RCTL_AMOUNT_UNDEFINED;
1324ec125fbbSEdward Tomasz Napierala 		rctl_rule_remove(rule2);
1325ec125fbbSEdward Tomasz Napierala 		rctl_rule_release(rule2);
1326ec125fbbSEdward Tomasz Napierala 	} else
1327ec125fbbSEdward Tomasz Napierala 		rctl_rule_remove(rule);
1328ec125fbbSEdward Tomasz Napierala 
1329ec125fbbSEdward Tomasz Napierala 	switch (rule->rr_subject_type) {
1330ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_PROCESS:
1331ec125fbbSEdward Tomasz Napierala 		p = rule->rr_subject.rs_proc;
1332ec125fbbSEdward Tomasz Napierala 		KASSERT(p != NULL, ("rctl_rule_add: NULL proc"));
1333ec125fbbSEdward Tomasz Napierala 
1334ec125fbbSEdward Tomasz Napierala 		rctl_racct_add_rule(p->p_racct, rule);
1335ec125fbbSEdward Tomasz Napierala 		/*
1336ec125fbbSEdward Tomasz Napierala 		 * In case of per-process rule, we don't have anything more
1337ec125fbbSEdward Tomasz Napierala 		 * to do.
1338ec125fbbSEdward Tomasz Napierala 		 */
1339ec125fbbSEdward Tomasz Napierala 		return (0);
1340ec125fbbSEdward Tomasz Napierala 
1341ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_USER:
1342ec125fbbSEdward Tomasz Napierala 		uip = rule->rr_subject.rs_uip;
1343ec125fbbSEdward Tomasz Napierala 		KASSERT(uip != NULL, ("rctl_rule_add: NULL uip"));
1344ec125fbbSEdward Tomasz Napierala 		rctl_racct_add_rule(uip->ui_racct, rule);
1345ec125fbbSEdward Tomasz Napierala 		break;
1346ec125fbbSEdward Tomasz Napierala 
1347ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_LOGINCLASS:
1348415896e3SEdward Tomasz Napierala 		lc = rule->rr_subject.rs_loginclass;
1349ec125fbbSEdward Tomasz Napierala 		KASSERT(lc != NULL, ("rctl_rule_add: NULL loginclass"));
1350ec125fbbSEdward Tomasz Napierala 		rctl_racct_add_rule(lc->lc_racct, rule);
1351ec125fbbSEdward Tomasz Napierala 		break;
1352ec125fbbSEdward Tomasz Napierala 
1353ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_JAIL:
1354a7ad07bfSEdward Tomasz Napierala 		prr = rule->rr_subject.rs_prison_racct;
1355a7ad07bfSEdward Tomasz Napierala 		KASSERT(prr != NULL, ("rctl_rule_add: NULL pr"));
1356a7ad07bfSEdward Tomasz Napierala 		rctl_racct_add_rule(prr->prr_racct, rule);
1357ec125fbbSEdward Tomasz Napierala 		break;
1358ec125fbbSEdward Tomasz Napierala 
1359ec125fbbSEdward Tomasz Napierala 	default:
1360ec125fbbSEdward Tomasz Napierala 		panic("rctl_rule_add: unknown subject type %d",
1361ec125fbbSEdward Tomasz Napierala 		    rule->rr_subject_type);
1362ec125fbbSEdward Tomasz Napierala 	}
1363ec125fbbSEdward Tomasz Napierala 
1364ec125fbbSEdward Tomasz Napierala 	/*
1365ec125fbbSEdward Tomasz Napierala 	 * Now go through all the processes and add the new rule to the ones
1366ec125fbbSEdward Tomasz Napierala 	 * it applies to.
1367ec125fbbSEdward Tomasz Napierala 	 */
1368ec125fbbSEdward Tomasz Napierala 	sx_assert(&allproc_lock, SA_LOCKED);
1369ec125fbbSEdward Tomasz Napierala 	FOREACH_PROC_IN_SYSTEM(p) {
1370ec125fbbSEdward Tomasz Napierala 		cred = p->p_ucred;
1371ec125fbbSEdward Tomasz Napierala 		switch (rule->rr_subject_type) {
1372ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_USER:
1373ec125fbbSEdward Tomasz Napierala 			if (cred->cr_uidinfo == rule->rr_subject.rs_uip ||
1374ec125fbbSEdward Tomasz Napierala 			    cred->cr_ruidinfo == rule->rr_subject.rs_uip)
1375ec125fbbSEdward Tomasz Napierala 				break;
1376ec125fbbSEdward Tomasz Napierala 			continue;
1377ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_LOGINCLASS:
1378415896e3SEdward Tomasz Napierala 			if (cred->cr_loginclass == rule->rr_subject.rs_loginclass)
1379ec125fbbSEdward Tomasz Napierala 				break;
1380ec125fbbSEdward Tomasz Napierala 			continue;
1381ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_JAIL:
1382ec125fbbSEdward Tomasz Napierala 			match = 0;
1383ec125fbbSEdward Tomasz Napierala 			for (pr = cred->cr_prison; pr != NULL; pr = pr->pr_parent) {
1384a7ad07bfSEdward Tomasz Napierala 				if (pr->pr_prison_racct == rule->rr_subject.rs_prison_racct) {
1385ec125fbbSEdward Tomasz Napierala 					match = 1;
1386ec125fbbSEdward Tomasz Napierala 					break;
1387ec125fbbSEdward Tomasz Napierala 				}
1388ec125fbbSEdward Tomasz Napierala 			}
1389ec125fbbSEdward Tomasz Napierala 			if (match)
1390ec125fbbSEdward Tomasz Napierala 				break;
1391ec125fbbSEdward Tomasz Napierala 			continue;
1392ec125fbbSEdward Tomasz Napierala 		default:
1393ec125fbbSEdward Tomasz Napierala 			panic("rctl_rule_add: unknown subject type %d",
1394ec125fbbSEdward Tomasz Napierala 			    rule->rr_subject_type);
1395ec125fbbSEdward Tomasz Napierala 		}
1396ec125fbbSEdward Tomasz Napierala 
1397ec125fbbSEdward Tomasz Napierala 		rctl_racct_add_rule(p->p_racct, rule);
1398ec125fbbSEdward Tomasz Napierala 	}
1399ec125fbbSEdward Tomasz Napierala 
1400ec125fbbSEdward Tomasz Napierala 	return (0);
1401ec125fbbSEdward Tomasz Napierala }
1402ec125fbbSEdward Tomasz Napierala 
1403ec125fbbSEdward Tomasz Napierala static void
140415db3c07SEdward Tomasz Napierala rctl_rule_pre_callback(void)
140515db3c07SEdward Tomasz Napierala {
140615db3c07SEdward Tomasz Napierala 
1407bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK();
140815db3c07SEdward Tomasz Napierala }
140915db3c07SEdward Tomasz Napierala 
141015db3c07SEdward Tomasz Napierala static void
141115db3c07SEdward Tomasz Napierala rctl_rule_post_callback(void)
141215db3c07SEdward Tomasz Napierala {
141315db3c07SEdward Tomasz Napierala 
1414bbe4eb6dSEdward Tomasz Napierala 	RACCT_UNLOCK();
141515db3c07SEdward Tomasz Napierala }
141615db3c07SEdward Tomasz Napierala 
141715db3c07SEdward Tomasz Napierala static void
1418ec125fbbSEdward Tomasz Napierala rctl_rule_remove_callback(struct racct *racct, void *arg2, void *arg3)
1419ec125fbbSEdward Tomasz Napierala {
1420ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *filter = (struct rctl_rule *)arg2;
1421ec125fbbSEdward Tomasz Napierala 	int found = 0;
1422ec125fbbSEdward Tomasz Napierala 
14234b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
1424bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK_ASSERT();
14254b5c9cf6SEdward Tomasz Napierala 
1426ec125fbbSEdward Tomasz Napierala 	found += rctl_racct_remove_rules(racct, filter);
1427ec125fbbSEdward Tomasz Napierala 
1428ec125fbbSEdward Tomasz Napierala 	*((int *)arg3) += found;
1429ec125fbbSEdward Tomasz Napierala }
1430ec125fbbSEdward Tomasz Napierala 
1431ec125fbbSEdward Tomasz Napierala /*
1432ec125fbbSEdward Tomasz Napierala  * Remove all rules that match the filter.
1433ec125fbbSEdward Tomasz Napierala  */
1434ec125fbbSEdward Tomasz Napierala int
1435ec125fbbSEdward Tomasz Napierala rctl_rule_remove(struct rctl_rule *filter)
1436ec125fbbSEdward Tomasz Napierala {
1437ec125fbbSEdward Tomasz Napierala 	struct proc *p;
1438c1a43e73SEdward Tomasz Napierala 	int found = 0;
1439ec125fbbSEdward Tomasz Napierala 
14404b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
14414b5c9cf6SEdward Tomasz Napierala 
1442ec125fbbSEdward Tomasz Napierala 	if (filter->rr_subject_type == RCTL_SUBJECT_TYPE_PROCESS &&
1443ec125fbbSEdward Tomasz Napierala 	    filter->rr_subject.rs_proc != NULL) {
1444ec125fbbSEdward Tomasz Napierala 		p = filter->rr_subject.rs_proc;
1445bbe4eb6dSEdward Tomasz Napierala 		RACCT_LOCK();
1446ec125fbbSEdward Tomasz Napierala 		found = rctl_racct_remove_rules(p->p_racct, filter);
1447bbe4eb6dSEdward Tomasz Napierala 		RACCT_UNLOCK();
1448ec125fbbSEdward Tomasz Napierala 		if (found)
1449ec125fbbSEdward Tomasz Napierala 			return (0);
1450ec125fbbSEdward Tomasz Napierala 		return (ESRCH);
1451ec125fbbSEdward Tomasz Napierala 	}
1452ec125fbbSEdward Tomasz Napierala 
145315db3c07SEdward Tomasz Napierala 	loginclass_racct_foreach(rctl_rule_remove_callback,
145415db3c07SEdward Tomasz Napierala 	    rctl_rule_pre_callback, rctl_rule_post_callback,
145515db3c07SEdward Tomasz Napierala 	    filter, (void *)&found);
145615db3c07SEdward Tomasz Napierala 	ui_racct_foreach(rctl_rule_remove_callback,
145715db3c07SEdward Tomasz Napierala 	    rctl_rule_pre_callback, rctl_rule_post_callback,
145815db3c07SEdward Tomasz Napierala 	    filter, (void *)&found);
145915db3c07SEdward Tomasz Napierala 	prison_racct_foreach(rctl_rule_remove_callback,
146015db3c07SEdward Tomasz Napierala 	    rctl_rule_pre_callback, rctl_rule_post_callback,
146115db3c07SEdward Tomasz Napierala 	    filter, (void *)&found);
1462ec125fbbSEdward Tomasz Napierala 
1463ec125fbbSEdward Tomasz Napierala 	sx_assert(&allproc_lock, SA_LOCKED);
1464bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK();
1465ec125fbbSEdward Tomasz Napierala 	FOREACH_PROC_IN_SYSTEM(p) {
1466ec125fbbSEdward Tomasz Napierala 		found += rctl_racct_remove_rules(p->p_racct, filter);
1467ec125fbbSEdward Tomasz Napierala 	}
1468bbe4eb6dSEdward Tomasz Napierala 	RACCT_UNLOCK();
1469ec125fbbSEdward Tomasz Napierala 
1470ec125fbbSEdward Tomasz Napierala 	if (found)
1471ec125fbbSEdward Tomasz Napierala 		return (0);
1472ec125fbbSEdward Tomasz Napierala 	return (ESRCH);
1473ec125fbbSEdward Tomasz Napierala }
1474ec125fbbSEdward Tomasz Napierala 
1475ec125fbbSEdward Tomasz Napierala /*
1476ec125fbbSEdward Tomasz Napierala  * Appends a rule to the sbuf.
1477ec125fbbSEdward Tomasz Napierala  */
1478ec125fbbSEdward Tomasz Napierala static void
1479ec125fbbSEdward Tomasz Napierala rctl_rule_to_sbuf(struct sbuf *sb, const struct rctl_rule *rule)
1480ec125fbbSEdward Tomasz Napierala {
1481ec125fbbSEdward Tomasz Napierala 	int64_t amount;
1482ec125fbbSEdward Tomasz Napierala 
14834b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
14844b5c9cf6SEdward Tomasz Napierala 
1485ec125fbbSEdward Tomasz Napierala 	sbuf_printf(sb, "%s:", rctl_subject_type_name(rule->rr_subject_type));
1486ec125fbbSEdward Tomasz Napierala 
1487ec125fbbSEdward Tomasz Napierala 	switch (rule->rr_subject_type) {
1488ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_PROCESS:
1489ec125fbbSEdward Tomasz Napierala 		if (rule->rr_subject.rs_proc == NULL)
1490ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, ":");
1491ec125fbbSEdward Tomasz Napierala 		else
1492ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, "%d:",
1493ec125fbbSEdward Tomasz Napierala 			    rule->rr_subject.rs_proc->p_pid);
1494ec125fbbSEdward Tomasz Napierala 		break;
1495ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_USER:
1496ec125fbbSEdward Tomasz Napierala 		if (rule->rr_subject.rs_uip == NULL)
1497ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, ":");
1498ec125fbbSEdward Tomasz Napierala 		else
1499ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, "%d:",
1500ec125fbbSEdward Tomasz Napierala 			    rule->rr_subject.rs_uip->ui_uid);
1501ec125fbbSEdward Tomasz Napierala 		break;
1502ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_LOGINCLASS:
1503415896e3SEdward Tomasz Napierala 		if (rule->rr_subject.rs_loginclass == NULL)
1504ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, ":");
1505ec125fbbSEdward Tomasz Napierala 		else
1506ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, "%s:",
1507415896e3SEdward Tomasz Napierala 			    rule->rr_subject.rs_loginclass->lc_name);
1508ec125fbbSEdward Tomasz Napierala 		break;
1509ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_JAIL:
1510a7ad07bfSEdward Tomasz Napierala 		if (rule->rr_subject.rs_prison_racct == NULL)
1511ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, ":");
1512ec125fbbSEdward Tomasz Napierala 		else
1513ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, "%s:",
1514a7ad07bfSEdward Tomasz Napierala 			    rule->rr_subject.rs_prison_racct->prr_name);
1515ec125fbbSEdward Tomasz Napierala 		break;
1516ec125fbbSEdward Tomasz Napierala 	default:
1517ec125fbbSEdward Tomasz Napierala 		panic("rctl_rule_to_sbuf: unknown subject type %d",
1518ec125fbbSEdward Tomasz Napierala 		    rule->rr_subject_type);
1519ec125fbbSEdward Tomasz Napierala 	}
1520ec125fbbSEdward Tomasz Napierala 
1521ec125fbbSEdward Tomasz Napierala 	amount = rule->rr_amount;
1522ec125fbbSEdward Tomasz Napierala 	if (amount != RCTL_AMOUNT_UNDEFINED &&
152385a2f1b4SEdward Tomasz Napierala 	    RACCT_IS_IN_MILLIONS(rule->rr_resource))
152485a2f1b4SEdward Tomasz Napierala 		amount /= 1000000;
1525ec125fbbSEdward Tomasz Napierala 
1526ec125fbbSEdward Tomasz Napierala 	sbuf_printf(sb, "%s:%s=%jd",
1527ec125fbbSEdward Tomasz Napierala 	    rctl_resource_name(rule->rr_resource),
1528ec125fbbSEdward Tomasz Napierala 	    rctl_action_name(rule->rr_action),
1529ec125fbbSEdward Tomasz Napierala 	    amount);
1530ec125fbbSEdward Tomasz Napierala 
1531ec125fbbSEdward Tomasz Napierala 	if (rule->rr_per != rule->rr_subject_type)
1532ec125fbbSEdward Tomasz Napierala 		sbuf_printf(sb, "/%s", rctl_subject_type_name(rule->rr_per));
1533ec125fbbSEdward Tomasz Napierala }
1534ec125fbbSEdward Tomasz Napierala 
1535ec125fbbSEdward Tomasz Napierala /*
1536ec125fbbSEdward Tomasz Napierala  * Routine used by RCTL syscalls to read in input string.
1537ec125fbbSEdward Tomasz Napierala  */
1538ec125fbbSEdward Tomasz Napierala static int
1539ec125fbbSEdward Tomasz Napierala rctl_read_inbuf(char **inputstr, const char *inbufp, size_t inbuflen)
1540ec125fbbSEdward Tomasz Napierala {
1541ec125fbbSEdward Tomasz Napierala 	char *str;
1542c1a43e73SEdward Tomasz Napierala 	int error;
1543ec125fbbSEdward Tomasz Napierala 
15444b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
15454b5c9cf6SEdward Tomasz Napierala 
1546ec125fbbSEdward Tomasz Napierala 	if (inbuflen <= 0)
1547ec125fbbSEdward Tomasz Napierala 		return (EINVAL);
1548ea228b48SEdward Tomasz Napierala 	if (inbuflen > RCTL_MAX_INBUFSIZE)
1549786813aaSEdward Tomasz Napierala 		return (E2BIG);
1550ec125fbbSEdward Tomasz Napierala 
1551ec125fbbSEdward Tomasz Napierala 	str = malloc(inbuflen + 1, M_RCTL, M_WAITOK);
1552ec125fbbSEdward Tomasz Napierala 	error = copyinstr(inbufp, str, inbuflen, NULL);
1553ec125fbbSEdward Tomasz Napierala 	if (error != 0) {
1554ec125fbbSEdward Tomasz Napierala 		free(str, M_RCTL);
1555ec125fbbSEdward Tomasz Napierala 		return (error);
1556ec125fbbSEdward Tomasz Napierala 	}
1557ec125fbbSEdward Tomasz Napierala 
1558ec125fbbSEdward Tomasz Napierala 	*inputstr = str;
1559ec125fbbSEdward Tomasz Napierala 
1560ec125fbbSEdward Tomasz Napierala 	return (0);
1561ec125fbbSEdward Tomasz Napierala }
1562ec125fbbSEdward Tomasz Napierala 
1563ec125fbbSEdward Tomasz Napierala /*
1564ec125fbbSEdward Tomasz Napierala  * Routine used by RCTL syscalls to write out output string.
1565ec125fbbSEdward Tomasz Napierala  */
1566ec125fbbSEdward Tomasz Napierala static int
1567ec125fbbSEdward Tomasz Napierala rctl_write_outbuf(struct sbuf *outputsbuf, char *outbufp, size_t outbuflen)
1568ec125fbbSEdward Tomasz Napierala {
1569ec125fbbSEdward Tomasz Napierala 	int error;
1570ec125fbbSEdward Tomasz Napierala 
15714b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
15724b5c9cf6SEdward Tomasz Napierala 
1573ec125fbbSEdward Tomasz Napierala 	if (outputsbuf == NULL)
1574ec125fbbSEdward Tomasz Napierala 		return (0);
1575ec125fbbSEdward Tomasz Napierala 
1576ec125fbbSEdward Tomasz Napierala 	sbuf_finish(outputsbuf);
1577ec125fbbSEdward Tomasz Napierala 	if (outbuflen < sbuf_len(outputsbuf) + 1) {
1578ec125fbbSEdward Tomasz Napierala 		sbuf_delete(outputsbuf);
1579ec125fbbSEdward Tomasz Napierala 		return (ERANGE);
1580ec125fbbSEdward Tomasz Napierala 	}
1581ec125fbbSEdward Tomasz Napierala 	error = copyout(sbuf_data(outputsbuf), outbufp,
1582ec125fbbSEdward Tomasz Napierala 	    sbuf_len(outputsbuf) + 1);
1583ec125fbbSEdward Tomasz Napierala 	sbuf_delete(outputsbuf);
1584ec125fbbSEdward Tomasz Napierala 	return (error);
1585ec125fbbSEdward Tomasz Napierala }
1586ec125fbbSEdward Tomasz Napierala 
1587ec125fbbSEdward Tomasz Napierala static struct sbuf *
1588ec125fbbSEdward Tomasz Napierala rctl_racct_to_sbuf(struct racct *racct, int sloppy)
1589ec125fbbSEdward Tomasz Napierala {
1590ec125fbbSEdward Tomasz Napierala 	struct sbuf *sb;
1591c1a43e73SEdward Tomasz Napierala 	int64_t amount;
1592c1a43e73SEdward Tomasz Napierala 	int i;
1593ec125fbbSEdward Tomasz Napierala 
15944b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
15954b5c9cf6SEdward Tomasz Napierala 
1596ec125fbbSEdward Tomasz Napierala 	sb = sbuf_new_auto();
1597ec125fbbSEdward Tomasz Napierala 	for (i = 0; i <= RACCT_MAX; i++) {
15984fe84775SEdward Tomasz Napierala 		if (sloppy == 0 && RACCT_IS_SLOPPY(i))
1599ec125fbbSEdward Tomasz Napierala 			continue;
1600bbe4eb6dSEdward Tomasz Napierala 		RACCT_LOCK();
1601ec125fbbSEdward Tomasz Napierala 		amount = racct->r_resources[i];
1602bbe4eb6dSEdward Tomasz Napierala 		RACCT_UNLOCK();
160385a2f1b4SEdward Tomasz Napierala 		if (RACCT_IS_IN_MILLIONS(i))
1604cff08ec0SEdward Tomasz Napierala 			amount /= 1000000;
1605ec125fbbSEdward Tomasz Napierala 		sbuf_printf(sb, "%s=%jd,", rctl_resource_name(i), amount);
1606ec125fbbSEdward Tomasz Napierala 	}
1607ec125fbbSEdward Tomasz Napierala 	sbuf_setpos(sb, sbuf_len(sb) - 1);
1608ec125fbbSEdward Tomasz Napierala 	return (sb);
1609ec125fbbSEdward Tomasz Napierala }
1610ec125fbbSEdward Tomasz Napierala 
1611ec125fbbSEdward Tomasz Napierala int
16128451d0ddSKip Macy sys_rctl_get_racct(struct thread *td, struct rctl_get_racct_args *uap)
1613ec125fbbSEdward Tomasz Napierala {
1614ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *filter;
1615ec125fbbSEdward Tomasz Napierala 	struct sbuf *outputsbuf = NULL;
1616ec125fbbSEdward Tomasz Napierala 	struct proc *p;
1617ec125fbbSEdward Tomasz Napierala 	struct uidinfo *uip;
1618ec125fbbSEdward Tomasz Napierala 	struct loginclass *lc;
1619a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
1620c1a43e73SEdward Tomasz Napierala 	char *inputstr;
1621c1a43e73SEdward Tomasz Napierala 	int error;
1622ec125fbbSEdward Tomasz Napierala 
16234b5c9cf6SEdward Tomasz Napierala 	if (!racct_enable)
16244b5c9cf6SEdward Tomasz Napierala 		return (ENOSYS);
16254b5c9cf6SEdward Tomasz Napierala 
1626415896e3SEdward Tomasz Napierala 	error = priv_check(td, PRIV_RCTL_GET_RACCT);
1627ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1628ec125fbbSEdward Tomasz Napierala 		return (error);
1629ec125fbbSEdward Tomasz Napierala 
1630ec125fbbSEdward Tomasz Napierala 	error = rctl_read_inbuf(&inputstr, uap->inbufp, uap->inbuflen);
1631ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1632ec125fbbSEdward Tomasz Napierala 		return (error);
1633ec125fbbSEdward Tomasz Napierala 
1634ec125fbbSEdward Tomasz Napierala 	sx_slock(&allproc_lock);
1635ec125fbbSEdward Tomasz Napierala 	error = rctl_string_to_rule(inputstr, &filter);
1636ec125fbbSEdward Tomasz Napierala 	free(inputstr, M_RCTL);
1637ec125fbbSEdward Tomasz Napierala 	if (error != 0) {
1638ec125fbbSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
1639ec125fbbSEdward Tomasz Napierala 		return (error);
1640ec125fbbSEdward Tomasz Napierala 	}
1641ec125fbbSEdward Tomasz Napierala 
1642ec125fbbSEdward Tomasz Napierala 	switch (filter->rr_subject_type) {
1643ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_PROCESS:
1644ec125fbbSEdward Tomasz Napierala 		p = filter->rr_subject.rs_proc;
1645ec125fbbSEdward Tomasz Napierala 		if (p == NULL) {
1646ec125fbbSEdward Tomasz Napierala 			error = EINVAL;
1647ec125fbbSEdward Tomasz Napierala 			goto out;
1648ec125fbbSEdward Tomasz Napierala 		}
1649ec125fbbSEdward Tomasz Napierala 		outputsbuf = rctl_racct_to_sbuf(p->p_racct, 0);
1650ec125fbbSEdward Tomasz Napierala 		break;
1651ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_USER:
1652ec125fbbSEdward Tomasz Napierala 		uip = filter->rr_subject.rs_uip;
1653ec125fbbSEdward Tomasz Napierala 		if (uip == NULL) {
1654ec125fbbSEdward Tomasz Napierala 			error = EINVAL;
1655ec125fbbSEdward Tomasz Napierala 			goto out;
1656ec125fbbSEdward Tomasz Napierala 		}
1657ec125fbbSEdward Tomasz Napierala 		outputsbuf = rctl_racct_to_sbuf(uip->ui_racct, 1);
1658ec125fbbSEdward Tomasz Napierala 		break;
1659ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_LOGINCLASS:
1660415896e3SEdward Tomasz Napierala 		lc = filter->rr_subject.rs_loginclass;
1661ec125fbbSEdward Tomasz Napierala 		if (lc == NULL) {
1662ec125fbbSEdward Tomasz Napierala 			error = EINVAL;
1663ec125fbbSEdward Tomasz Napierala 			goto out;
1664ec125fbbSEdward Tomasz Napierala 		}
1665ec125fbbSEdward Tomasz Napierala 		outputsbuf = rctl_racct_to_sbuf(lc->lc_racct, 1);
1666ec125fbbSEdward Tomasz Napierala 		break;
1667ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_JAIL:
1668a7ad07bfSEdward Tomasz Napierala 		prr = filter->rr_subject.rs_prison_racct;
1669a7ad07bfSEdward Tomasz Napierala 		if (prr == NULL) {
1670ec125fbbSEdward Tomasz Napierala 			error = EINVAL;
1671ec125fbbSEdward Tomasz Napierala 			goto out;
1672ec125fbbSEdward Tomasz Napierala 		}
1673a7ad07bfSEdward Tomasz Napierala 		outputsbuf = rctl_racct_to_sbuf(prr->prr_racct, 1);
1674ec125fbbSEdward Tomasz Napierala 		break;
1675ec125fbbSEdward Tomasz Napierala 	default:
1676ec125fbbSEdward Tomasz Napierala 		error = EINVAL;
1677ec125fbbSEdward Tomasz Napierala 	}
1678ec125fbbSEdward Tomasz Napierala out:
1679ec125fbbSEdward Tomasz Napierala 	rctl_rule_release(filter);
1680ec125fbbSEdward Tomasz Napierala 	sx_sunlock(&allproc_lock);
1681ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1682ec125fbbSEdward Tomasz Napierala 		return (error);
1683ec125fbbSEdward Tomasz Napierala 
1684ec125fbbSEdward Tomasz Napierala 	error = rctl_write_outbuf(outputsbuf, uap->outbufp, uap->outbuflen);
1685ec125fbbSEdward Tomasz Napierala 
1686ec125fbbSEdward Tomasz Napierala 	return (error);
1687ec125fbbSEdward Tomasz Napierala }
1688ec125fbbSEdward Tomasz Napierala 
1689ec125fbbSEdward Tomasz Napierala static void
1690ec125fbbSEdward Tomasz Napierala rctl_get_rules_callback(struct racct *racct, void *arg2, void *arg3)
1691ec125fbbSEdward Tomasz Napierala {
1692ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *filter = (struct rctl_rule *)arg2;
1693ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
1694ec125fbbSEdward Tomasz Napierala 	struct sbuf *sb = (struct sbuf *)arg3;
1695ec125fbbSEdward Tomasz Napierala 
16964b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
1697bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK_ASSERT();
16984b5c9cf6SEdward Tomasz Napierala 
1699ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &racct->r_rule_links, rrl_next) {
1700ec125fbbSEdward Tomasz Napierala 		if (!rctl_rule_matches(link->rrl_rule, filter))
1701ec125fbbSEdward Tomasz Napierala 			continue;
1702ec125fbbSEdward Tomasz Napierala 		rctl_rule_to_sbuf(sb, link->rrl_rule);
1703ec125fbbSEdward Tomasz Napierala 		sbuf_printf(sb, ",");
1704ec125fbbSEdward Tomasz Napierala 	}
1705ec125fbbSEdward Tomasz Napierala }
1706ec125fbbSEdward Tomasz Napierala 
1707ec125fbbSEdward Tomasz Napierala int
17088451d0ddSKip Macy sys_rctl_get_rules(struct thread *td, struct rctl_get_rules_args *uap)
1709ec125fbbSEdward Tomasz Napierala {
1710ec125fbbSEdward Tomasz Napierala 	struct sbuf *sb;
1711ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *filter;
1712ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
1713ec125fbbSEdward Tomasz Napierala 	struct proc *p;
1714c1a43e73SEdward Tomasz Napierala 	char *inputstr, *buf;
1715c1a43e73SEdward Tomasz Napierala 	size_t bufsize;
1716c1a43e73SEdward Tomasz Napierala 	int error;
1717ec125fbbSEdward Tomasz Napierala 
17184b5c9cf6SEdward Tomasz Napierala 	if (!racct_enable)
17194b5c9cf6SEdward Tomasz Napierala 		return (ENOSYS);
17204b5c9cf6SEdward Tomasz Napierala 
1721ec125fbbSEdward Tomasz Napierala 	error = priv_check(td, PRIV_RCTL_GET_RULES);
1722ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1723ec125fbbSEdward Tomasz Napierala 		return (error);
1724ec125fbbSEdward Tomasz Napierala 
1725ec125fbbSEdward Tomasz Napierala 	error = rctl_read_inbuf(&inputstr, uap->inbufp, uap->inbuflen);
1726ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1727ec125fbbSEdward Tomasz Napierala 		return (error);
1728ec125fbbSEdward Tomasz Napierala 
1729ec125fbbSEdward Tomasz Napierala 	sx_slock(&allproc_lock);
1730ec125fbbSEdward Tomasz Napierala 	error = rctl_string_to_rule(inputstr, &filter);
1731ec125fbbSEdward Tomasz Napierala 	free(inputstr, M_RCTL);
1732ec125fbbSEdward Tomasz Napierala 	if (error != 0) {
1733ec125fbbSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
1734ec125fbbSEdward Tomasz Napierala 		return (error);
1735ec125fbbSEdward Tomasz Napierala 	}
1736ec125fbbSEdward Tomasz Napierala 
17372b4035eeSEdward Tomasz Napierala 	bufsize = uap->outbuflen;
17382b4035eeSEdward Tomasz Napierala 	if (bufsize > rctl_maxbufsize) {
17392b4035eeSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
17402b4035eeSEdward Tomasz Napierala 		return (E2BIG);
17412b4035eeSEdward Tomasz Napierala 	}
17422b4035eeSEdward Tomasz Napierala 
1743ec125fbbSEdward Tomasz Napierala 	buf = malloc(bufsize, M_RCTL, M_WAITOK);
1744ec125fbbSEdward Tomasz Napierala 	sb = sbuf_new(NULL, buf, bufsize, SBUF_FIXEDLEN);
1745ec125fbbSEdward Tomasz Napierala 	KASSERT(sb != NULL, ("sbuf_new failed"));
1746ec125fbbSEdward Tomasz Napierala 
1747ec125fbbSEdward Tomasz Napierala 	FOREACH_PROC_IN_SYSTEM(p) {
1748bbe4eb6dSEdward Tomasz Napierala 		RACCT_LOCK();
1749ec125fbbSEdward Tomasz Napierala 		LIST_FOREACH(link, &p->p_racct->r_rule_links, rrl_next) {
1750ec125fbbSEdward Tomasz Napierala 			/*
1751ec125fbbSEdward Tomasz Napierala 			 * Non-process rules will be added to the buffer later.
1752ec125fbbSEdward Tomasz Napierala 			 * Adding them here would result in duplicated output.
1753ec125fbbSEdward Tomasz Napierala 			 */
1754ec125fbbSEdward Tomasz Napierala 			if (link->rrl_rule->rr_subject_type !=
1755ec125fbbSEdward Tomasz Napierala 			    RCTL_SUBJECT_TYPE_PROCESS)
1756ec125fbbSEdward Tomasz Napierala 				continue;
1757ec125fbbSEdward Tomasz Napierala 			if (!rctl_rule_matches(link->rrl_rule, filter))
1758ec125fbbSEdward Tomasz Napierala 				continue;
1759ec125fbbSEdward Tomasz Napierala 			rctl_rule_to_sbuf(sb, link->rrl_rule);
1760ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, ",");
1761ec125fbbSEdward Tomasz Napierala 		}
1762bbe4eb6dSEdward Tomasz Napierala 		RACCT_UNLOCK();
1763ec125fbbSEdward Tomasz Napierala 	}
1764ec125fbbSEdward Tomasz Napierala 
176515db3c07SEdward Tomasz Napierala 	loginclass_racct_foreach(rctl_get_rules_callback,
176615db3c07SEdward Tomasz Napierala 	    rctl_rule_pre_callback, rctl_rule_post_callback,
176715db3c07SEdward Tomasz Napierala 	    filter, sb);
176815db3c07SEdward Tomasz Napierala 	ui_racct_foreach(rctl_get_rules_callback,
176915db3c07SEdward Tomasz Napierala 	    rctl_rule_pre_callback, rctl_rule_post_callback,
177015db3c07SEdward Tomasz Napierala 	    filter, sb);
177115db3c07SEdward Tomasz Napierala 	prison_racct_foreach(rctl_get_rules_callback,
177215db3c07SEdward Tomasz Napierala 	    rctl_rule_pre_callback, rctl_rule_post_callback,
177315db3c07SEdward Tomasz Napierala 	    filter, sb);
1774ec125fbbSEdward Tomasz Napierala 	if (sbuf_error(sb) == ENOMEM) {
17752b4035eeSEdward Tomasz Napierala 		error = ERANGE;
17762b4035eeSEdward Tomasz Napierala 		goto out;
1777ec125fbbSEdward Tomasz Napierala 	}
1778ec125fbbSEdward Tomasz Napierala 
1779ec125fbbSEdward Tomasz Napierala 	/*
1780ec125fbbSEdward Tomasz Napierala 	 * Remove trailing ",".
1781ec125fbbSEdward Tomasz Napierala 	 */
1782ec125fbbSEdward Tomasz Napierala 	if (sbuf_len(sb) > 0)
1783ec125fbbSEdward Tomasz Napierala 		sbuf_setpos(sb, sbuf_len(sb) - 1);
1784ec125fbbSEdward Tomasz Napierala 
1785ec125fbbSEdward Tomasz Napierala 	error = rctl_write_outbuf(sb, uap->outbufp, uap->outbuflen);
17862b4035eeSEdward Tomasz Napierala out:
1787ec125fbbSEdward Tomasz Napierala 	rctl_rule_release(filter);
1788ec125fbbSEdward Tomasz Napierala 	sx_sunlock(&allproc_lock);
1789ec125fbbSEdward Tomasz Napierala 	free(buf, M_RCTL);
1790ec125fbbSEdward Tomasz Napierala 	return (error);
1791ec125fbbSEdward Tomasz Napierala }
1792ec125fbbSEdward Tomasz Napierala 
1793ec125fbbSEdward Tomasz Napierala int
17948451d0ddSKip Macy sys_rctl_get_limits(struct thread *td, struct rctl_get_limits_args *uap)
1795ec125fbbSEdward Tomasz Napierala {
1796ec125fbbSEdward Tomasz Napierala 	struct sbuf *sb;
1797ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *filter;
1798ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
1799c1a43e73SEdward Tomasz Napierala 	char *inputstr, *buf;
1800c1a43e73SEdward Tomasz Napierala 	size_t bufsize;
1801c1a43e73SEdward Tomasz Napierala 	int error;
1802ec125fbbSEdward Tomasz Napierala 
18034b5c9cf6SEdward Tomasz Napierala 	if (!racct_enable)
18044b5c9cf6SEdward Tomasz Napierala 		return (ENOSYS);
18054b5c9cf6SEdward Tomasz Napierala 
1806ec125fbbSEdward Tomasz Napierala 	error = priv_check(td, PRIV_RCTL_GET_LIMITS);
1807ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1808ec125fbbSEdward Tomasz Napierala 		return (error);
1809ec125fbbSEdward Tomasz Napierala 
1810ec125fbbSEdward Tomasz Napierala 	error = rctl_read_inbuf(&inputstr, uap->inbufp, uap->inbuflen);
1811ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1812ec125fbbSEdward Tomasz Napierala 		return (error);
1813ec125fbbSEdward Tomasz Napierala 
1814ec125fbbSEdward Tomasz Napierala 	sx_slock(&allproc_lock);
1815ec125fbbSEdward Tomasz Napierala 	error = rctl_string_to_rule(inputstr, &filter);
1816ec125fbbSEdward Tomasz Napierala 	free(inputstr, M_RCTL);
1817ec125fbbSEdward Tomasz Napierala 	if (error != 0) {
1818ec125fbbSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
1819ec125fbbSEdward Tomasz Napierala 		return (error);
1820ec125fbbSEdward Tomasz Napierala 	}
1821ec125fbbSEdward Tomasz Napierala 
1822ec125fbbSEdward Tomasz Napierala 	if (filter->rr_subject_type == RCTL_SUBJECT_TYPE_UNDEFINED) {
1823ec125fbbSEdward Tomasz Napierala 		rctl_rule_release(filter);
1824ec125fbbSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
1825ec125fbbSEdward Tomasz Napierala 		return (EINVAL);
1826ec125fbbSEdward Tomasz Napierala 	}
1827ec125fbbSEdward Tomasz Napierala 	if (filter->rr_subject_type != RCTL_SUBJECT_TYPE_PROCESS) {
1828ec125fbbSEdward Tomasz Napierala 		rctl_rule_release(filter);
1829ec125fbbSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
1830ec125fbbSEdward Tomasz Napierala 		return (EOPNOTSUPP);
1831ec125fbbSEdward Tomasz Napierala 	}
1832ec125fbbSEdward Tomasz Napierala 	if (filter->rr_subject.rs_proc == NULL) {
1833ec125fbbSEdward Tomasz Napierala 		rctl_rule_release(filter);
1834ec125fbbSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
1835ec125fbbSEdward Tomasz Napierala 		return (EINVAL);
1836ec125fbbSEdward Tomasz Napierala 	}
1837ec125fbbSEdward Tomasz Napierala 
18382b4035eeSEdward Tomasz Napierala 	bufsize = uap->outbuflen;
18392b4035eeSEdward Tomasz Napierala 	if (bufsize > rctl_maxbufsize) {
18402b4035eeSEdward Tomasz Napierala 		rctl_rule_release(filter);
18412b4035eeSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
18422b4035eeSEdward Tomasz Napierala 		return (E2BIG);
18432b4035eeSEdward Tomasz Napierala 	}
18442b4035eeSEdward Tomasz Napierala 
1845ec125fbbSEdward Tomasz Napierala 	buf = malloc(bufsize, M_RCTL, M_WAITOK);
1846ec125fbbSEdward Tomasz Napierala 	sb = sbuf_new(NULL, buf, bufsize, SBUF_FIXEDLEN);
1847ec125fbbSEdward Tomasz Napierala 	KASSERT(sb != NULL, ("sbuf_new failed"));
1848ec125fbbSEdward Tomasz Napierala 
1849bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK();
1850ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &filter->rr_subject.rs_proc->p_racct->r_rule_links,
1851ec125fbbSEdward Tomasz Napierala 	    rrl_next) {
1852ec125fbbSEdward Tomasz Napierala 		rctl_rule_to_sbuf(sb, link->rrl_rule);
1853ec125fbbSEdward Tomasz Napierala 		sbuf_printf(sb, ",");
1854ec125fbbSEdward Tomasz Napierala 	}
1855bbe4eb6dSEdward Tomasz Napierala 	RACCT_UNLOCK();
1856ec125fbbSEdward Tomasz Napierala 	if (sbuf_error(sb) == ENOMEM) {
18572b4035eeSEdward Tomasz Napierala 		error = ERANGE;
1858b483e111SConrad Meyer 		sbuf_delete(sb);
18592b4035eeSEdward Tomasz Napierala 		goto out;
1860ec125fbbSEdward Tomasz Napierala 	}
1861ec125fbbSEdward Tomasz Napierala 
1862ec125fbbSEdward Tomasz Napierala 	/*
1863ec125fbbSEdward Tomasz Napierala 	 * Remove trailing ",".
1864ec125fbbSEdward Tomasz Napierala 	 */
1865ec125fbbSEdward Tomasz Napierala 	if (sbuf_len(sb) > 0)
1866ec125fbbSEdward Tomasz Napierala 		sbuf_setpos(sb, sbuf_len(sb) - 1);
1867ec125fbbSEdward Tomasz Napierala 
1868ec125fbbSEdward Tomasz Napierala 	error = rctl_write_outbuf(sb, uap->outbufp, uap->outbuflen);
18692b4035eeSEdward Tomasz Napierala out:
1870ec125fbbSEdward Tomasz Napierala 	rctl_rule_release(filter);
1871ec125fbbSEdward Tomasz Napierala 	sx_sunlock(&allproc_lock);
1872ec125fbbSEdward Tomasz Napierala 	free(buf, M_RCTL);
1873ec125fbbSEdward Tomasz Napierala 	return (error);
1874ec125fbbSEdward Tomasz Napierala }
1875ec125fbbSEdward Tomasz Napierala 
1876ec125fbbSEdward Tomasz Napierala int
18778451d0ddSKip Macy sys_rctl_add_rule(struct thread *td, struct rctl_add_rule_args *uap)
1878ec125fbbSEdward Tomasz Napierala {
1879ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *rule;
1880ec125fbbSEdward Tomasz Napierala 	char *inputstr;
1881c1a43e73SEdward Tomasz Napierala 	int error;
1882ec125fbbSEdward Tomasz Napierala 
18834b5c9cf6SEdward Tomasz Napierala 	if (!racct_enable)
18844b5c9cf6SEdward Tomasz Napierala 		return (ENOSYS);
18854b5c9cf6SEdward Tomasz Napierala 
1886ec125fbbSEdward Tomasz Napierala 	error = priv_check(td, PRIV_RCTL_ADD_RULE);
1887ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1888ec125fbbSEdward Tomasz Napierala 		return (error);
1889ec125fbbSEdward Tomasz Napierala 
1890ec125fbbSEdward Tomasz Napierala 	error = rctl_read_inbuf(&inputstr, uap->inbufp, uap->inbuflen);
1891ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1892ec125fbbSEdward Tomasz Napierala 		return (error);
1893ec125fbbSEdward Tomasz Napierala 
1894ec125fbbSEdward Tomasz Napierala 	sx_slock(&allproc_lock);
1895ec125fbbSEdward Tomasz Napierala 	error = rctl_string_to_rule(inputstr, &rule);
1896ec125fbbSEdward Tomasz Napierala 	free(inputstr, M_RCTL);
1897ec125fbbSEdward Tomasz Napierala 	if (error != 0) {
1898ec125fbbSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
1899ec125fbbSEdward Tomasz Napierala 		return (error);
1900ec125fbbSEdward Tomasz Napierala 	}
1901ec125fbbSEdward Tomasz Napierala 	/*
1902ec125fbbSEdward Tomasz Napierala 	 * The 'per' part of a rule is optional.
1903ec125fbbSEdward Tomasz Napierala 	 */
1904ec125fbbSEdward Tomasz Napierala 	if (rule->rr_per == RCTL_SUBJECT_TYPE_UNDEFINED &&
1905ec125fbbSEdward Tomasz Napierala 	    rule->rr_subject_type != RCTL_SUBJECT_TYPE_UNDEFINED)
1906ec125fbbSEdward Tomasz Napierala 		rule->rr_per = rule->rr_subject_type;
1907ec125fbbSEdward Tomasz Napierala 
1908ec125fbbSEdward Tomasz Napierala 	if (!rctl_rule_fully_specified(rule)) {
1909ec125fbbSEdward Tomasz Napierala 		error = EINVAL;
1910ec125fbbSEdward Tomasz Napierala 		goto out;
1911ec125fbbSEdward Tomasz Napierala 	}
1912ec125fbbSEdward Tomasz Napierala 
1913ec125fbbSEdward Tomasz Napierala 	error = rctl_rule_add(rule);
1914ec125fbbSEdward Tomasz Napierala 
1915ec125fbbSEdward Tomasz Napierala out:
1916ec125fbbSEdward Tomasz Napierala 	rctl_rule_release(rule);
1917ec125fbbSEdward Tomasz Napierala 	sx_sunlock(&allproc_lock);
1918ec125fbbSEdward Tomasz Napierala 	return (error);
1919ec125fbbSEdward Tomasz Napierala }
1920ec125fbbSEdward Tomasz Napierala 
1921ec125fbbSEdward Tomasz Napierala int
19228451d0ddSKip Macy sys_rctl_remove_rule(struct thread *td, struct rctl_remove_rule_args *uap)
1923ec125fbbSEdward Tomasz Napierala {
1924ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *filter;
1925ec125fbbSEdward Tomasz Napierala 	char *inputstr;
1926c1a43e73SEdward Tomasz Napierala 	int error;
1927ec125fbbSEdward Tomasz Napierala 
19284b5c9cf6SEdward Tomasz Napierala 	if (!racct_enable)
19294b5c9cf6SEdward Tomasz Napierala 		return (ENOSYS);
19304b5c9cf6SEdward Tomasz Napierala 
1931ec125fbbSEdward Tomasz Napierala 	error = priv_check(td, PRIV_RCTL_REMOVE_RULE);
1932ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1933ec125fbbSEdward Tomasz Napierala 		return (error);
1934ec125fbbSEdward Tomasz Napierala 
1935ec125fbbSEdward Tomasz Napierala 	error = rctl_read_inbuf(&inputstr, uap->inbufp, uap->inbuflen);
1936ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1937ec125fbbSEdward Tomasz Napierala 		return (error);
1938ec125fbbSEdward Tomasz Napierala 
1939ec125fbbSEdward Tomasz Napierala 	sx_slock(&allproc_lock);
1940ec125fbbSEdward Tomasz Napierala 	error = rctl_string_to_rule(inputstr, &filter);
1941ec125fbbSEdward Tomasz Napierala 	free(inputstr, M_RCTL);
1942ec125fbbSEdward Tomasz Napierala 	if (error != 0) {
1943ec125fbbSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
1944ec125fbbSEdward Tomasz Napierala 		return (error);
1945ec125fbbSEdward Tomasz Napierala 	}
1946ec125fbbSEdward Tomasz Napierala 
1947ec125fbbSEdward Tomasz Napierala 	error = rctl_rule_remove(filter);
1948ec125fbbSEdward Tomasz Napierala 	rctl_rule_release(filter);
1949ec125fbbSEdward Tomasz Napierala 	sx_sunlock(&allproc_lock);
1950ec125fbbSEdward Tomasz Napierala 
1951ec125fbbSEdward Tomasz Napierala 	return (error);
1952ec125fbbSEdward Tomasz Napierala }
1953ec125fbbSEdward Tomasz Napierala 
1954ec125fbbSEdward Tomasz Napierala /*
1955ec125fbbSEdward Tomasz Napierala  * Update RCTL rule list after credential change.
1956ec125fbbSEdward Tomasz Napierala  */
1957ec125fbbSEdward Tomasz Napierala void
1958ec125fbbSEdward Tomasz Napierala rctl_proc_ucred_changed(struct proc *p, struct ucred *newcred)
1959ec125fbbSEdward Tomasz Napierala {
1960c1a43e73SEdward Tomasz Napierala 	LIST_HEAD(, rctl_rule_link) newrules;
1961ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link, *newlink;
1962ec125fbbSEdward Tomasz Napierala 	struct uidinfo *newuip;
1963ec125fbbSEdward Tomasz Napierala 	struct loginclass *newlc;
1964a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *newprr;
1965c1a43e73SEdward Tomasz Napierala 	int rulecnt, i;
1966ec125fbbSEdward Tomasz Napierala 
1967f87beb93SAndriy Gapon 	if (!racct_enable)
1968f87beb93SAndriy Gapon 		return;
1969f87beb93SAndriy Gapon 
1970f87beb93SAndriy Gapon 	PROC_LOCK_ASSERT(p, MA_NOTOWNED);
19714b5c9cf6SEdward Tomasz Napierala 
1972ec125fbbSEdward Tomasz Napierala 	newuip = newcred->cr_ruidinfo;
1973ec125fbbSEdward Tomasz Napierala 	newlc = newcred->cr_loginclass;
1974a7ad07bfSEdward Tomasz Napierala 	newprr = newcred->cr_prison->pr_prison_racct;
1975ec125fbbSEdward Tomasz Napierala 
1976ec125fbbSEdward Tomasz Napierala 	LIST_INIT(&newrules);
1977ec125fbbSEdward Tomasz Napierala 
1978ec125fbbSEdward Tomasz Napierala again:
1979ec125fbbSEdward Tomasz Napierala 	/*
1980ec125fbbSEdward Tomasz Napierala 	 * First, count the rules that apply to the process with new
1981ec125fbbSEdward Tomasz Napierala 	 * credentials.
1982ec125fbbSEdward Tomasz Napierala 	 */
1983ec125fbbSEdward Tomasz Napierala 	rulecnt = 0;
1984bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK();
1985ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &p->p_racct->r_rule_links, rrl_next) {
1986ec125fbbSEdward Tomasz Napierala 		if (link->rrl_rule->rr_subject_type ==
1987ec125fbbSEdward Tomasz Napierala 		    RCTL_SUBJECT_TYPE_PROCESS)
1988ec125fbbSEdward Tomasz Napierala 			rulecnt++;
1989ec125fbbSEdward Tomasz Napierala 	}
1990ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &newuip->ui_racct->r_rule_links, rrl_next)
1991ec125fbbSEdward Tomasz Napierala 		rulecnt++;
1992ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &newlc->lc_racct->r_rule_links, rrl_next)
1993ec125fbbSEdward Tomasz Napierala 		rulecnt++;
1994a7ad07bfSEdward Tomasz Napierala 	LIST_FOREACH(link, &newprr->prr_racct->r_rule_links, rrl_next)
1995ec125fbbSEdward Tomasz Napierala 		rulecnt++;
1996bbe4eb6dSEdward Tomasz Napierala 	RACCT_UNLOCK();
1997ec125fbbSEdward Tomasz Napierala 
1998ec125fbbSEdward Tomasz Napierala 	/*
1999ec125fbbSEdward Tomasz Napierala 	 * Create temporary list.  We've dropped the rctl_lock in order
2000ec125fbbSEdward Tomasz Napierala 	 * to use M_WAITOK.
2001ec125fbbSEdward Tomasz Napierala 	 */
2002ec125fbbSEdward Tomasz Napierala 	for (i = 0; i < rulecnt; i++) {
2003ec125fbbSEdward Tomasz Napierala 		newlink = uma_zalloc(rctl_rule_link_zone, M_WAITOK);
2004ec125fbbSEdward Tomasz Napierala 		newlink->rrl_rule = NULL;
2005ed810200SEdward Tomasz Napierala 		newlink->rrl_exceeded = 0;
2006ec125fbbSEdward Tomasz Napierala 		LIST_INSERT_HEAD(&newrules, newlink, rrl_next);
2007ec125fbbSEdward Tomasz Napierala 	}
2008ec125fbbSEdward Tomasz Napierala 
2009ec125fbbSEdward Tomasz Napierala 	newlink = LIST_FIRST(&newrules);
2010ec125fbbSEdward Tomasz Napierala 
2011ec125fbbSEdward Tomasz Napierala 	/*
2012ec125fbbSEdward Tomasz Napierala 	 * Assign rules to the newly allocated list entries.
2013ec125fbbSEdward Tomasz Napierala 	 */
2014bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK();
2015ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &p->p_racct->r_rule_links, rrl_next) {
2016ec125fbbSEdward Tomasz Napierala 		if (link->rrl_rule->rr_subject_type ==
2017ec125fbbSEdward Tomasz Napierala 		    RCTL_SUBJECT_TYPE_PROCESS) {
2018ec125fbbSEdward Tomasz Napierala 			if (newlink == NULL)
2019ec125fbbSEdward Tomasz Napierala 				goto goaround;
2020ec125fbbSEdward Tomasz Napierala 			rctl_rule_acquire(link->rrl_rule);
2021ec125fbbSEdward Tomasz Napierala 			newlink->rrl_rule = link->rrl_rule;
2022ed810200SEdward Tomasz Napierala 			newlink->rrl_exceeded = link->rrl_exceeded;
2023ec125fbbSEdward Tomasz Napierala 			newlink = LIST_NEXT(newlink, rrl_next);
2024ec125fbbSEdward Tomasz Napierala 			rulecnt--;
2025ec125fbbSEdward Tomasz Napierala 		}
2026ec125fbbSEdward Tomasz Napierala 	}
2027ec125fbbSEdward Tomasz Napierala 
2028ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &newuip->ui_racct->r_rule_links, rrl_next) {
2029ec125fbbSEdward Tomasz Napierala 		if (newlink == NULL)
2030ec125fbbSEdward Tomasz Napierala 			goto goaround;
2031ec125fbbSEdward Tomasz Napierala 		rctl_rule_acquire(link->rrl_rule);
2032ec125fbbSEdward Tomasz Napierala 		newlink->rrl_rule = link->rrl_rule;
2033ed810200SEdward Tomasz Napierala 		newlink->rrl_exceeded = link->rrl_exceeded;
2034ec125fbbSEdward Tomasz Napierala 		newlink = LIST_NEXT(newlink, rrl_next);
2035ec125fbbSEdward Tomasz Napierala 		rulecnt--;
2036ec125fbbSEdward Tomasz Napierala 	}
2037ec125fbbSEdward Tomasz Napierala 
2038ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &newlc->lc_racct->r_rule_links, rrl_next) {
2039ec125fbbSEdward Tomasz Napierala 		if (newlink == NULL)
2040ec125fbbSEdward Tomasz Napierala 			goto goaround;
2041ec125fbbSEdward Tomasz Napierala 		rctl_rule_acquire(link->rrl_rule);
2042ec125fbbSEdward Tomasz Napierala 		newlink->rrl_rule = link->rrl_rule;
2043ed810200SEdward Tomasz Napierala 		newlink->rrl_exceeded = link->rrl_exceeded;
2044ec125fbbSEdward Tomasz Napierala 		newlink = LIST_NEXT(newlink, rrl_next);
2045ec125fbbSEdward Tomasz Napierala 		rulecnt--;
2046ec125fbbSEdward Tomasz Napierala 	}
2047ec125fbbSEdward Tomasz Napierala 
2048a7ad07bfSEdward Tomasz Napierala 	LIST_FOREACH(link, &newprr->prr_racct->r_rule_links, rrl_next) {
2049ec125fbbSEdward Tomasz Napierala 		if (newlink == NULL)
2050ec125fbbSEdward Tomasz Napierala 			goto goaround;
2051ec125fbbSEdward Tomasz Napierala 		rctl_rule_acquire(link->rrl_rule);
2052ec125fbbSEdward Tomasz Napierala 		newlink->rrl_rule = link->rrl_rule;
2053ed810200SEdward Tomasz Napierala 		newlink->rrl_exceeded = link->rrl_exceeded;
2054ec125fbbSEdward Tomasz Napierala 		newlink = LIST_NEXT(newlink, rrl_next);
2055ec125fbbSEdward Tomasz Napierala 		rulecnt--;
2056ec125fbbSEdward Tomasz Napierala 	}
2057ec125fbbSEdward Tomasz Napierala 
2058ec125fbbSEdward Tomasz Napierala 	if (rulecnt == 0) {
2059ec125fbbSEdward Tomasz Napierala 		/*
2060ec125fbbSEdward Tomasz Napierala 		 * Free the old rule list.
2061ec125fbbSEdward Tomasz Napierala 		 */
2062ec125fbbSEdward Tomasz Napierala 		while (!LIST_EMPTY(&p->p_racct->r_rule_links)) {
2063ec125fbbSEdward Tomasz Napierala 			link = LIST_FIRST(&p->p_racct->r_rule_links);
2064ec125fbbSEdward Tomasz Napierala 			LIST_REMOVE(link, rrl_next);
2065ec125fbbSEdward Tomasz Napierala 			rctl_rule_release(link->rrl_rule);
2066ec125fbbSEdward Tomasz Napierala 			uma_zfree(rctl_rule_link_zone, link);
2067ec125fbbSEdward Tomasz Napierala 		}
2068ec125fbbSEdward Tomasz Napierala 
2069ec125fbbSEdward Tomasz Napierala 		/*
2070ec125fbbSEdward Tomasz Napierala 		 * Replace lists and we're done.
2071ec125fbbSEdward Tomasz Napierala 		 *
2072ec125fbbSEdward Tomasz Napierala 		 * XXX: Is there any way to switch list heads instead
2073ec125fbbSEdward Tomasz Napierala 		 *      of iterating here?
2074ec125fbbSEdward Tomasz Napierala 		 */
2075ec125fbbSEdward Tomasz Napierala 		while (!LIST_EMPTY(&newrules)) {
2076ec125fbbSEdward Tomasz Napierala 			newlink = LIST_FIRST(&newrules);
2077ec125fbbSEdward Tomasz Napierala 			LIST_REMOVE(newlink, rrl_next);
2078ec125fbbSEdward Tomasz Napierala 			LIST_INSERT_HEAD(&p->p_racct->r_rule_links,
2079ec125fbbSEdward Tomasz Napierala 			    newlink, rrl_next);
2080ec125fbbSEdward Tomasz Napierala 		}
2081ec125fbbSEdward Tomasz Napierala 
2082bbe4eb6dSEdward Tomasz Napierala 		RACCT_UNLOCK();
2083ec125fbbSEdward Tomasz Napierala 
2084ec125fbbSEdward Tomasz Napierala 		return;
2085ec125fbbSEdward Tomasz Napierala 	}
2086ec125fbbSEdward Tomasz Napierala 
2087ec125fbbSEdward Tomasz Napierala goaround:
2088bbe4eb6dSEdward Tomasz Napierala 	RACCT_UNLOCK();
2089ec125fbbSEdward Tomasz Napierala 
2090ec125fbbSEdward Tomasz Napierala 	/*
2091ec125fbbSEdward Tomasz Napierala 	 * Rule list changed while we were not holding the rctl_lock.
2092ec125fbbSEdward Tomasz Napierala 	 * Free the new list and try again.
2093ec125fbbSEdward Tomasz Napierala 	 */
2094ec125fbbSEdward Tomasz Napierala 	while (!LIST_EMPTY(&newrules)) {
2095ec125fbbSEdward Tomasz Napierala 		newlink = LIST_FIRST(&newrules);
2096ec125fbbSEdward Tomasz Napierala 		LIST_REMOVE(newlink, rrl_next);
2097ec125fbbSEdward Tomasz Napierala 		if (newlink->rrl_rule != NULL)
2098ec125fbbSEdward Tomasz Napierala 			rctl_rule_release(newlink->rrl_rule);
2099ec125fbbSEdward Tomasz Napierala 		uma_zfree(rctl_rule_link_zone, newlink);
2100ec125fbbSEdward Tomasz Napierala 	}
2101ec125fbbSEdward Tomasz Napierala 
2102ec125fbbSEdward Tomasz Napierala 	goto again;
2103ec125fbbSEdward Tomasz Napierala }
2104ec125fbbSEdward Tomasz Napierala 
2105ec125fbbSEdward Tomasz Napierala /*
2106ec125fbbSEdward Tomasz Napierala  * Assign RCTL rules to the newly created process.
2107ec125fbbSEdward Tomasz Napierala  */
2108ec125fbbSEdward Tomasz Napierala int
2109ec125fbbSEdward Tomasz Napierala rctl_proc_fork(struct proc *parent, struct proc *child)
2110ec125fbbSEdward Tomasz Napierala {
2111ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *rule;
2112c1a43e73SEdward Tomasz Napierala 	struct rctl_rule_link *link;
2113c1a43e73SEdward Tomasz Napierala 	int error;
2114ec125fbbSEdward Tomasz Napierala 
21154b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
2116bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK_ASSERT();
21170b18eb6dSEdward Tomasz Napierala 	KASSERT(parent->p_racct != NULL, ("process without racct; p = %p", parent));
2118ec125fbbSEdward Tomasz Napierala 
2119bbe4eb6dSEdward Tomasz Napierala 	LIST_INIT(&child->p_racct->r_rule_links);
2120ec125fbbSEdward Tomasz Napierala 
2121ec125fbbSEdward Tomasz Napierala 	/*
2122ec125fbbSEdward Tomasz Napierala 	 * Go through limits applicable to the parent and assign them
2123ec125fbbSEdward Tomasz Napierala 	 * to the child.  Rules with 'process' subject have to be duplicated
2124ec125fbbSEdward Tomasz Napierala 	 * in order to make their rr_subject point to the new process.
2125ec125fbbSEdward Tomasz Napierala 	 */
2126ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &parent->p_racct->r_rule_links, rrl_next) {
2127ec125fbbSEdward Tomasz Napierala 		if (link->rrl_rule->rr_subject_type ==
2128ec125fbbSEdward Tomasz Napierala 		    RCTL_SUBJECT_TYPE_PROCESS) {
2129ec125fbbSEdward Tomasz Napierala 			rule = rctl_rule_duplicate(link->rrl_rule, M_NOWAIT);
2130ec125fbbSEdward Tomasz Napierala 			if (rule == NULL)
2131ec125fbbSEdward Tomasz Napierala 				goto fail;
2132ec125fbbSEdward Tomasz Napierala 			KASSERT(rule->rr_subject.rs_proc == parent,
2133ec125fbbSEdward Tomasz Napierala 			    ("rule->rr_subject.rs_proc != parent"));
2134ec125fbbSEdward Tomasz Napierala 			rule->rr_subject.rs_proc = child;
2135ec125fbbSEdward Tomasz Napierala 			error = rctl_racct_add_rule_locked(child->p_racct,
2136ec125fbbSEdward Tomasz Napierala 			    rule);
2137ec125fbbSEdward Tomasz Napierala 			rctl_rule_release(rule);
2138ec125fbbSEdward Tomasz Napierala 			if (error != 0)
2139ec125fbbSEdward Tomasz Napierala 				goto fail;
2140ec125fbbSEdward Tomasz Napierala 		} else {
2141ec125fbbSEdward Tomasz Napierala 			error = rctl_racct_add_rule_locked(child->p_racct,
2142ec125fbbSEdward Tomasz Napierala 			    link->rrl_rule);
2143ec125fbbSEdward Tomasz Napierala 			if (error != 0)
2144ec125fbbSEdward Tomasz Napierala 				goto fail;
2145ec125fbbSEdward Tomasz Napierala 		}
2146ec125fbbSEdward Tomasz Napierala 	}
2147ec125fbbSEdward Tomasz Napierala 
2148ec125fbbSEdward Tomasz Napierala 	return (0);
2149ec125fbbSEdward Tomasz Napierala 
2150ec125fbbSEdward Tomasz Napierala fail:
2151ec125fbbSEdward Tomasz Napierala 	while (!LIST_EMPTY(&child->p_racct->r_rule_links)) {
2152ec125fbbSEdward Tomasz Napierala 		link = LIST_FIRST(&child->p_racct->r_rule_links);
2153ec125fbbSEdward Tomasz Napierala 		LIST_REMOVE(link, rrl_next);
2154ec125fbbSEdward Tomasz Napierala 		rctl_rule_release(link->rrl_rule);
2155ec125fbbSEdward Tomasz Napierala 		uma_zfree(rctl_rule_link_zone, link);
2156ec125fbbSEdward Tomasz Napierala 	}
2157bbe4eb6dSEdward Tomasz Napierala 
2158ec125fbbSEdward Tomasz Napierala 	return (EAGAIN);
2159ec125fbbSEdward Tomasz Napierala }
2160ec125fbbSEdward Tomasz Napierala 
2161ec125fbbSEdward Tomasz Napierala /*
2162ec125fbbSEdward Tomasz Napierala  * Release rules attached to the racct.
2163ec125fbbSEdward Tomasz Napierala  */
2164ec125fbbSEdward Tomasz Napierala void
2165ec125fbbSEdward Tomasz Napierala rctl_racct_release(struct racct *racct)
2166ec125fbbSEdward Tomasz Napierala {
2167ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
2168ec125fbbSEdward Tomasz Napierala 
21694b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
2170bbe4eb6dSEdward Tomasz Napierala 	RACCT_LOCK_ASSERT();
21714b5c9cf6SEdward Tomasz Napierala 
2172ec125fbbSEdward Tomasz Napierala 	while (!LIST_EMPTY(&racct->r_rule_links)) {
2173ec125fbbSEdward Tomasz Napierala 		link = LIST_FIRST(&racct->r_rule_links);
2174ec125fbbSEdward Tomasz Napierala 		LIST_REMOVE(link, rrl_next);
2175ec125fbbSEdward Tomasz Napierala 		rctl_rule_release(link->rrl_rule);
2176ec125fbbSEdward Tomasz Napierala 		uma_zfree(rctl_rule_link_zone, link);
2177ec125fbbSEdward Tomasz Napierala 	}
2178ec125fbbSEdward Tomasz Napierala }
2179ec125fbbSEdward Tomasz Napierala 
2180ec125fbbSEdward Tomasz Napierala static void
2181ec125fbbSEdward Tomasz Napierala rctl_init(void)
2182ec125fbbSEdward Tomasz Napierala {
2183ec125fbbSEdward Tomasz Napierala 
21844b5c9cf6SEdward Tomasz Napierala 	if (!racct_enable)
21854b5c9cf6SEdward Tomasz Napierala 		return;
21864b5c9cf6SEdward Tomasz Napierala 
2187c1a43e73SEdward Tomasz Napierala 	rctl_rule_zone = uma_zcreate("rctl_rule", sizeof(struct rctl_rule),
218823e6fff2SEdward Tomasz Napierala 	    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
2189ec125fbbSEdward Tomasz Napierala 	rctl_rule_link_zone = uma_zcreate("rctl_rule_link",
2190ec125fbbSEdward Tomasz Napierala 	    sizeof(struct rctl_rule_link), NULL, NULL, NULL, NULL,
219123e6fff2SEdward Tomasz Napierala 	    UMA_ALIGN_PTR, 0);
2192ae34b6ffSEdward Tomasz Napierala 
21938bd8c8f1SEdward Tomasz Napierala 	/*
21948bd8c8f1SEdward Tomasz Napierala 	 * Set default values, making sure not to overwrite the ones
21958bd8c8f1SEdward Tomasz Napierala 	 * fetched from tunables.  Most of those could be set at the
21968bd8c8f1SEdward Tomasz Napierala 	 * declaration, except for the rctl_throttle_max - we cannot
21978bd8c8f1SEdward Tomasz Napierala 	 * set it there due to hz not being compile time constant.
21988bd8c8f1SEdward Tomasz Napierala 	 */
21998bd8c8f1SEdward Tomasz Napierala 	if (rctl_throttle_min < 1)
2200ae34b6ffSEdward Tomasz Napierala 		rctl_throttle_min = 1;
22018bd8c8f1SEdward Tomasz Napierala 	if (rctl_throttle_max < rctl_throttle_min)
2202ae34b6ffSEdward Tomasz Napierala 		rctl_throttle_max = 2 * hz;
22038bd8c8f1SEdward Tomasz Napierala 	if (rctl_throttle_pct < 0)
2204ae34b6ffSEdward Tomasz Napierala 		rctl_throttle_pct = 100;
22058bd8c8f1SEdward Tomasz Napierala 	if (rctl_throttle_pct2 < 0)
2206ae34b6ffSEdward Tomasz Napierala 		rctl_throttle_pct2 = 100;
2207ec125fbbSEdward Tomasz Napierala }
2208ec125fbbSEdward Tomasz Napierala 
2209ec125fbbSEdward Tomasz Napierala #else /* !RCTL */
2210ec125fbbSEdward Tomasz Napierala 
2211ec125fbbSEdward Tomasz Napierala int
22128451d0ddSKip Macy sys_rctl_get_racct(struct thread *td, struct rctl_get_racct_args *uap)
2213ec125fbbSEdward Tomasz Napierala {
2214ec125fbbSEdward Tomasz Napierala 
2215ec125fbbSEdward Tomasz Napierala 	return (ENOSYS);
2216ec125fbbSEdward Tomasz Napierala }
2217ec125fbbSEdward Tomasz Napierala 
2218ec125fbbSEdward Tomasz Napierala int
22198451d0ddSKip Macy sys_rctl_get_rules(struct thread *td, struct rctl_get_rules_args *uap)
2220ec125fbbSEdward Tomasz Napierala {
2221ec125fbbSEdward Tomasz Napierala 
2222ec125fbbSEdward Tomasz Napierala 	return (ENOSYS);
2223ec125fbbSEdward Tomasz Napierala }
2224ec125fbbSEdward Tomasz Napierala 
2225ec125fbbSEdward Tomasz Napierala int
22268451d0ddSKip Macy sys_rctl_get_limits(struct thread *td, struct rctl_get_limits_args *uap)
2227ec125fbbSEdward Tomasz Napierala {
2228ec125fbbSEdward Tomasz Napierala 
2229ec125fbbSEdward Tomasz Napierala 	return (ENOSYS);
2230ec125fbbSEdward Tomasz Napierala }
2231ec125fbbSEdward Tomasz Napierala 
2232ec125fbbSEdward Tomasz Napierala int
22338451d0ddSKip Macy sys_rctl_add_rule(struct thread *td, struct rctl_add_rule_args *uap)
2234ec125fbbSEdward Tomasz Napierala {
2235ec125fbbSEdward Tomasz Napierala 
2236ec125fbbSEdward Tomasz Napierala 	return (ENOSYS);
2237ec125fbbSEdward Tomasz Napierala }
2238ec125fbbSEdward Tomasz Napierala 
2239ec125fbbSEdward Tomasz Napierala int
22408451d0ddSKip Macy sys_rctl_remove_rule(struct thread *td, struct rctl_remove_rule_args *uap)
2241ec125fbbSEdward Tomasz Napierala {
2242ec125fbbSEdward Tomasz Napierala 
2243ec125fbbSEdward Tomasz Napierala 	return (ENOSYS);
2244ec125fbbSEdward Tomasz Napierala }
2245ec125fbbSEdward Tomasz Napierala 
2246ec125fbbSEdward Tomasz Napierala #endif /* !RCTL */
2247