xref: /freebsd/sys/kern/kern_resource.c (revision 05b432d2d18bddd0672b3cde6aad1680c174321f)
1 /*-
2  * Copyright (c) 1982, 1986, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 4. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)kern_resource.c	8.5 (Berkeley) 1/21/94
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 #include "opt_compat.h"
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/sysproto.h>
45 #include <sys/file.h>
46 #include <sys/kernel.h>
47 #include <sys/lock.h>
48 #include <sys/malloc.h>
49 #include <sys/mutex.h>
50 #include <sys/priv.h>
51 #include <sys/proc.h>
52 #include <sys/refcount.h>
53 #include <sys/resourcevar.h>
54 #include <sys/sched.h>
55 #include <sys/sx.h>
56 #include <sys/syscallsubr.h>
57 #include <sys/sysent.h>
58 #include <sys/time.h>
59 
60 #include <vm/vm.h>
61 #include <vm/vm_param.h>
62 #include <vm/pmap.h>
63 #include <vm/vm_map.h>
64 
65 
66 static MALLOC_DEFINE(M_PLIMIT, "plimit", "plimit structures");
67 static MALLOC_DEFINE(M_UIDINFO, "uidinfo", "uidinfo structures");
68 #define	UIHASH(uid)	(&uihashtbl[(uid) & uihash])
69 static struct mtx uihashtbl_mtx;
70 static LIST_HEAD(uihashhead, uidinfo) *uihashtbl;
71 static u_long uihash;		/* size of hash table - 1 */
72 
73 static void	calcru1(struct proc *p, struct rusage_ext *ruxp,
74 		    struct timeval *up, struct timeval *sp);
75 static int	donice(struct thread *td, struct proc *chgp, int n);
76 static struct uidinfo *uilookup(uid_t uid);
77 
78 /*
79  * Resource controls and accounting.
80  */
81 
82 #ifndef _SYS_SYSPROTO_H_
83 struct getpriority_args {
84 	int	which;
85 	int	who;
86 };
87 #endif
88 /*
89  * MPSAFE
90  */
91 int
92 getpriority(td, uap)
93 	struct thread *td;
94 	register struct getpriority_args *uap;
95 {
96 	struct proc *p;
97 	struct pgrp *pg;
98 	int error, low;
99 
100 	error = 0;
101 	low = PRIO_MAX + 1;
102 	switch (uap->which) {
103 
104 	case PRIO_PROCESS:
105 		if (uap->who == 0)
106 			low = td->td_proc->p_nice;
107 		else {
108 			p = pfind(uap->who);
109 			if (p == NULL)
110 				break;
111 			if (p_cansee(td, p) == 0)
112 				low = p->p_nice;
113 			PROC_UNLOCK(p);
114 		}
115 		break;
116 
117 	case PRIO_PGRP:
118 		sx_slock(&proctree_lock);
119 		if (uap->who == 0) {
120 			pg = td->td_proc->p_pgrp;
121 			PGRP_LOCK(pg);
122 		} else {
123 			pg = pgfind(uap->who);
124 			if (pg == NULL) {
125 				sx_sunlock(&proctree_lock);
126 				break;
127 			}
128 		}
129 		sx_sunlock(&proctree_lock);
130 		LIST_FOREACH(p, &pg->pg_members, p_pglist) {
131 			PROC_LOCK(p);
132 			if (!p_cansee(td, p)) {
133 				if (p->p_nice < low)
134 					low = p->p_nice;
135 			}
136 			PROC_UNLOCK(p);
137 		}
138 		PGRP_UNLOCK(pg);
139 		break;
140 
141 	case PRIO_USER:
142 		if (uap->who == 0)
143 			uap->who = td->td_ucred->cr_uid;
144 		sx_slock(&allproc_lock);
145 		LIST_FOREACH(p, &allproc, p_list) {
146 			PROC_LOCK(p);
147 			if (!p_cansee(td, p) &&
148 			    p->p_ucred->cr_uid == uap->who) {
149 				if (p->p_nice < low)
150 					low = p->p_nice;
151 			}
152 			PROC_UNLOCK(p);
153 		}
154 		sx_sunlock(&allproc_lock);
155 		break;
156 
157 	default:
158 		error = EINVAL;
159 		break;
160 	}
161 	if (low == PRIO_MAX + 1 && error == 0)
162 		error = ESRCH;
163 	td->td_retval[0] = low;
164 	return (error);
165 }
166 
167 #ifndef _SYS_SYSPROTO_H_
168 struct setpriority_args {
169 	int	which;
170 	int	who;
171 	int	prio;
172 };
173 #endif
174 /*
175  * MPSAFE
176  */
177 int
178 setpriority(td, uap)
179 	struct thread *td;
180 	struct setpriority_args *uap;
181 {
182 	struct proc *curp, *p;
183 	struct pgrp *pg;
184 	int found = 0, error = 0;
185 
186 	curp = td->td_proc;
187 	switch (uap->which) {
188 	case PRIO_PROCESS:
189 		if (uap->who == 0) {
190 			PROC_LOCK(curp);
191 			error = donice(td, curp, uap->prio);
192 			PROC_UNLOCK(curp);
193 		} else {
194 			p = pfind(uap->who);
195 			if (p == 0)
196 				break;
197 			if (p_cansee(td, p) == 0)
198 				error = donice(td, p, uap->prio);
199 			PROC_UNLOCK(p);
200 		}
201 		found++;
202 		break;
203 
204 	case PRIO_PGRP:
205 		sx_slock(&proctree_lock);
206 		if (uap->who == 0) {
207 			pg = curp->p_pgrp;
208 			PGRP_LOCK(pg);
209 		} else {
210 			pg = pgfind(uap->who);
211 			if (pg == NULL) {
212 				sx_sunlock(&proctree_lock);
213 				break;
214 			}
215 		}
216 		sx_sunlock(&proctree_lock);
217 		LIST_FOREACH(p, &pg->pg_members, p_pglist) {
218 			PROC_LOCK(p);
219 			if (!p_cansee(td, p)) {
220 				error = donice(td, p, uap->prio);
221 				found++;
222 			}
223 			PROC_UNLOCK(p);
224 		}
225 		PGRP_UNLOCK(pg);
226 		break;
227 
228 	case PRIO_USER:
229 		if (uap->who == 0)
230 			uap->who = td->td_ucred->cr_uid;
231 		sx_slock(&allproc_lock);
232 		FOREACH_PROC_IN_SYSTEM(p) {
233 			PROC_LOCK(p);
234 			if (p->p_ucred->cr_uid == uap->who &&
235 			    !p_cansee(td, p)) {
236 				error = donice(td, p, uap->prio);
237 				found++;
238 			}
239 			PROC_UNLOCK(p);
240 		}
241 		sx_sunlock(&allproc_lock);
242 		break;
243 
244 	default:
245 		error = EINVAL;
246 		break;
247 	}
248 	if (found == 0 && error == 0)
249 		error = ESRCH;
250 	return (error);
251 }
252 
253 /*
254  * Set "nice" for a (whole) process.
255  */
256 static int
257 donice(struct thread *td, struct proc *p, int n)
258 {
259 	int error;
260 
261 	PROC_LOCK_ASSERT(p, MA_OWNED);
262 	if ((error = p_cansched(td, p)))
263 		return (error);
264 	if (n > PRIO_MAX)
265 		n = PRIO_MAX;
266 	if (n < PRIO_MIN)
267 		n = PRIO_MIN;
268  	if (n < p->p_nice && priv_check(td, PRIV_SCHED_SETPRIORITY) != 0)
269 		return (EACCES);
270 	mtx_lock_spin(&sched_lock);
271 	sched_nice(p, n);
272 	mtx_unlock_spin(&sched_lock);
273 	return (0);
274 }
275 
276 /*
277  * Set realtime priority for LWP.
278  *
279  * MPSAFE
280  */
281 #ifndef _SYS_SYSPROTO_H_
282 struct rtprio_thread_args {
283 	int		function;
284 	lwpid_t		lwpid;
285 	struct rtprio	*rtp;
286 };
287 #endif
288 
289 int
290 rtprio_thread(struct thread *td, struct rtprio_thread_args *uap)
291 {
292 	struct proc *curp;
293 	struct proc *p;
294 	struct rtprio rtp;
295 	struct thread *td1;
296 	int cierror, error;
297 
298 	/* Perform copyin before acquiring locks if needed. */
299 	if (uap->function == RTP_SET)
300 		cierror = copyin(uap->rtp, &rtp, sizeof(struct rtprio));
301 	else
302 		cierror = 0;
303 
304 	curp = td->td_proc;
305 	/*
306 	 * Though lwpid is unique, only current process is supported
307 	 * since there is no efficient way to look up a LWP yet.
308 	 */
309 	p = curp;
310 	PROC_LOCK(p);
311 
312 	switch (uap->function) {
313 	case RTP_LOOKUP:
314 		if ((error = p_cansee(td, p)))
315 			break;
316 		mtx_lock_spin(&sched_lock);
317 		if (uap->lwpid == 0 || uap->lwpid == td->td_tid)
318 			td1 = td;
319 		else
320 			td1 = thread_find(p, uap->lwpid);
321 		if (td1 != NULL)
322 #ifdef KSE
323 			pri_to_rtp(td1->td_ksegrp, &rtp);
324 #else
325 			pri_to_rtp(td1, &rtp);
326 #endif
327 		else
328 			error = ESRCH;
329 		mtx_unlock_spin(&sched_lock);
330 		PROC_UNLOCK(p);
331 		return (copyout(&rtp, uap->rtp, sizeof(struct rtprio)));
332 	case RTP_SET:
333 		if ((error = p_cansched(td, p)) || (error = cierror))
334 			break;
335 
336 		/* Disallow setting rtprio in most cases if not superuser. */
337 		if (suser(td) != 0) {
338 			/* can't set realtime priority */
339 /*
340  * Realtime priority has to be restricted for reasons which should be
341  * obvious.  However, for idle priority, there is a potential for
342  * system deadlock if an idleprio process gains a lock on a resource
343  * that other processes need (and the idleprio process can't run
344  * due to a CPU-bound normal process).  Fix me!  XXX
345  */
346 #if 0
347  			if (RTP_PRIO_IS_REALTIME(rtp.type)) {
348 #else
349 			if (rtp.type != RTP_PRIO_NORMAL) {
350 #endif
351 				error = EPERM;
352 				break;
353 			}
354 		}
355 
356 		mtx_lock_spin(&sched_lock);
357 		if (uap->lwpid == 0 || uap->lwpid == td->td_tid)
358 			td1 = td;
359 		else
360 			td1 = thread_find(p, uap->lwpid);
361 		if (td1 != NULL)
362 #ifdef KSE
363 			error = rtp_to_pri(&rtp, td1->td_ksegrp);
364 #else
365 			error = rtp_to_pri(&rtp, td1);
366 #endif
367 		else
368 			error = ESRCH;
369 		mtx_unlock_spin(&sched_lock);
370 		break;
371 	default:
372 		error = EINVAL;
373 		break;
374 	}
375 	PROC_UNLOCK(p);
376 	return (error);
377 }
378 
379 /*
380  * Set realtime priority.
381  *
382  * MPSAFE
383  */
384 #ifndef _SYS_SYSPROTO_H_
385 struct rtprio_args {
386 	int		function;
387 	pid_t		pid;
388 	struct rtprio	*rtp;
389 };
390 #endif
391 
392 int
393 rtprio(td, uap)
394 	struct thread *td;		/* curthread */
395 	register struct rtprio_args *uap;
396 {
397 	struct proc *curp;
398 	struct proc *p;
399 #ifdef KSE
400 	struct ksegrp *kg;
401 #else
402 	struct thread *tdp;
403 #endif
404 	struct rtprio rtp;
405 	int cierror, error;
406 
407 	/* Perform copyin before acquiring locks if needed. */
408 	if (uap->function == RTP_SET)
409 		cierror = copyin(uap->rtp, &rtp, sizeof(struct rtprio));
410 	else
411 		cierror = 0;
412 
413 	curp = td->td_proc;
414 	if (uap->pid == 0) {
415 		p = curp;
416 		PROC_LOCK(p);
417 	} else {
418 		p = pfind(uap->pid);
419 		if (p == NULL)
420 			return (ESRCH);
421 	}
422 
423 	switch (uap->function) {
424 	case RTP_LOOKUP:
425 		if ((error = p_cansee(td, p)))
426 			break;
427 		mtx_lock_spin(&sched_lock);
428 		/*
429 		 * Return OUR priority if no pid specified,
430 		 * or if one is, report the highest priority
431 		 * in the process.  There isn't much more you can do as
432 		 * there is only room to return a single priority.
433 		 * XXXKSE: maybe need a new interface to report
434 		 * priorities of multiple system scope threads.
435 		 * Note: specifying our own pid is not the same
436 		 * as leaving it zero.
437 		 */
438 		if (uap->pid == 0) {
439 #ifdef KSE
440 			pri_to_rtp(td->td_ksegrp, &rtp);
441 #else
442 			pri_to_rtp(td, &rtp);
443 #endif
444 		} else {
445 			struct rtprio rtp2;
446 
447 			rtp.type = RTP_PRIO_IDLE;
448 			rtp.prio = RTP_PRIO_MAX;
449 #ifdef KSE
450 			FOREACH_KSEGRP_IN_PROC(p, kg) {
451 				pri_to_rtp(kg, &rtp2);
452 #else
453 			FOREACH_THREAD_IN_PROC(p, tdp) {
454 				pri_to_rtp(tdp, &rtp2);
455 #endif
456 				if (rtp2.type <  rtp.type ||
457 				    (rtp2.type == rtp.type &&
458 				    rtp2.prio < rtp.prio)) {
459 					rtp.type = rtp2.type;
460 					rtp.prio = rtp2.prio;
461 				}
462 			}
463 		}
464 		mtx_unlock_spin(&sched_lock);
465 		PROC_UNLOCK(p);
466 		return (copyout(&rtp, uap->rtp, sizeof(struct rtprio)));
467 	case RTP_SET:
468 		if ((error = p_cansched(td, p)) || (error = cierror))
469 			break;
470 
471 		/* Disallow setting rtprio in most cases if not superuser. */
472 		if (priv_check(td, PRIV_SCHED_RTPRIO) != 0) {
473 			/* can't set someone else's */
474 			if (uap->pid) {
475 				error = EPERM;
476 				break;
477 			}
478 			/* can't set realtime priority */
479 /*
480  * Realtime priority has to be restricted for reasons which should be
481  * obvious.  However, for idle priority, there is a potential for
482  * system deadlock if an idleprio process gains a lock on a resource
483  * that other processes need (and the idleprio process can't run
484  * due to a CPU-bound normal process).  Fix me!  XXX
485  */
486 #if 0
487  			if (RTP_PRIO_IS_REALTIME(rtp.type)) {
488 #else
489 			if (rtp.type != RTP_PRIO_NORMAL) {
490 #endif
491 				error = EPERM;
492 				break;
493 			}
494 		}
495 
496 #ifdef KSE
497 		/*
498 		 * If we are setting our own priority, set just our
499 		 * KSEGRP but if we are doing another process,
500 		 * do all the groups on that process. If we
501 		 * specify our own pid we do the latter.
502 		 */
503 #else
504 		/*
505 		 * If we are setting our own priority, set just our
506 		 * thread but if we are doing another process,
507 		 * do all the threads on that process. If we
508 		 * specify our own pid we do the latter.
509 		 */
510 #endif
511 		mtx_lock_spin(&sched_lock);
512 		if (uap->pid == 0) {
513 #ifdef KSE
514 			error = rtp_to_pri(&rtp, td->td_ksegrp);
515 #else
516 			error = rtp_to_pri(&rtp, td);
517 #endif
518 		} else {
519 #ifdef KSE
520 			FOREACH_KSEGRP_IN_PROC(p, kg) {
521 				if ((error = rtp_to_pri(&rtp, kg)) != 0) {
522 					break;
523 				}
524 #else
525 			FOREACH_THREAD_IN_PROC(p, td) {
526 				if ((error = rtp_to_pri(&rtp, td)) != 0)
527 					break;
528 #endif
529 			}
530 		}
531 		mtx_unlock_spin(&sched_lock);
532 		break;
533 	default:
534 		error = EINVAL;
535 		break;
536 	}
537 	PROC_UNLOCK(p);
538 	return (error);
539 }
540 
541 int
542 #ifdef KSE
543 rtp_to_pri(struct rtprio *rtp, struct ksegrp *kg)
544 #else
545 rtp_to_pri(struct rtprio *rtp, struct thread *td)
546 #endif
547 {
548 
549 	mtx_assert(&sched_lock, MA_OWNED);
550 	if (rtp->prio > RTP_PRIO_MAX)
551 		return (EINVAL);
552 	switch (RTP_PRIO_BASE(rtp->type)) {
553 	case RTP_PRIO_REALTIME:
554 #ifdef KSE
555 		kg->kg_user_pri = PRI_MIN_REALTIME + rtp->prio;
556 #else
557 		td->td_user_pri = PRI_MIN_REALTIME + rtp->prio;
558 #endif
559 		break;
560 	case RTP_PRIO_NORMAL:
561 #ifdef KSE
562 		kg->kg_user_pri = PRI_MIN_TIMESHARE + rtp->prio;
563 #else
564 		td->td_user_pri = PRI_MIN_TIMESHARE + rtp->prio;
565 #endif
566 		break;
567 	case RTP_PRIO_IDLE:
568 #ifdef KSE
569 		kg->kg_user_pri = PRI_MIN_IDLE + rtp->prio;
570 #else
571 		td->td_user_pri = PRI_MIN_IDLE + rtp->prio;
572 #endif
573 		break;
574 	default:
575 		return (EINVAL);
576 	}
577 #ifdef KSE
578 	sched_class(kg, rtp->type);
579 	if (curthread->td_ksegrp == kg) {
580 		sched_prio(curthread, kg->kg_user_pri); /* XXX dubious */
581 	}
582 #else
583 	sched_class(td, rtp->type);	/* XXX fix */
584 	if (curthread == td)
585 		sched_prio(curthread, td->td_user_pri); /* XXX dubious */
586 #endif
587 	return (0);
588 }
589 
590 void
591 #ifdef KSE
592 pri_to_rtp(struct ksegrp *kg, struct rtprio *rtp)
593 #else
594 pri_to_rtp(struct thread *td, struct rtprio *rtp)
595 #endif
596 {
597 
598 	mtx_assert(&sched_lock, MA_OWNED);
599 #ifdef KSE
600 	switch (PRI_BASE(kg->kg_pri_class)) {
601 #else
602 	switch (PRI_BASE(td->td_pri_class)) {
603 #endif
604 	case PRI_REALTIME:
605 #ifdef KSE
606 		rtp->prio = kg->kg_user_pri - PRI_MIN_REALTIME;
607 #else
608 		rtp->prio = td->td_user_pri - PRI_MIN_REALTIME;
609 #endif
610 		break;
611 	case PRI_TIMESHARE:
612 #ifdef KSE
613 		rtp->prio = kg->kg_user_pri - PRI_MIN_TIMESHARE;
614 #else
615 		rtp->prio = td->td_user_pri - PRI_MIN_TIMESHARE;
616 #endif
617 		break;
618 	case PRI_IDLE:
619 #ifdef KSE
620 		rtp->prio = kg->kg_user_pri - PRI_MIN_IDLE;
621 #else
622 		rtp->prio = td->td_user_pri - PRI_MIN_IDLE;
623 #endif
624 		break;
625 	default:
626 		break;
627 	}
628 #ifdef KSE
629 	rtp->type = kg->kg_pri_class;
630 #else
631 	rtp->type = td->td_pri_class;
632 #endif
633 }
634 
635 #if defined(COMPAT_43)
636 #ifndef _SYS_SYSPROTO_H_
637 struct osetrlimit_args {
638 	u_int	which;
639 	struct	orlimit *rlp;
640 };
641 #endif
642 /*
643  * MPSAFE
644  */
645 int
646 osetrlimit(td, uap)
647 	struct thread *td;
648 	register struct osetrlimit_args *uap;
649 {
650 	struct orlimit olim;
651 	struct rlimit lim;
652 	int error;
653 
654 	if ((error = copyin(uap->rlp, &olim, sizeof(struct orlimit))))
655 		return (error);
656 	lim.rlim_cur = olim.rlim_cur;
657 	lim.rlim_max = olim.rlim_max;
658 	error = kern_setrlimit(td, uap->which, &lim);
659 	return (error);
660 }
661 
662 #ifndef _SYS_SYSPROTO_H_
663 struct ogetrlimit_args {
664 	u_int	which;
665 	struct	orlimit *rlp;
666 };
667 #endif
668 /*
669  * MPSAFE
670  */
671 int
672 ogetrlimit(td, uap)
673 	struct thread *td;
674 	register struct ogetrlimit_args *uap;
675 {
676 	struct orlimit olim;
677 	struct rlimit rl;
678 	struct proc *p;
679 	int error;
680 
681 	if (uap->which >= RLIM_NLIMITS)
682 		return (EINVAL);
683 	p = td->td_proc;
684 	PROC_LOCK(p);
685 	lim_rlimit(p, uap->which, &rl);
686 	PROC_UNLOCK(p);
687 
688 	/*
689 	 * XXX would be more correct to convert only RLIM_INFINITY to the
690 	 * old RLIM_INFINITY and fail with EOVERFLOW for other larger
691 	 * values.  Most 64->32 and 32->16 conversions, including not
692 	 * unimportant ones of uids are even more broken than what we
693 	 * do here (they blindly truncate).  We don't do this correctly
694 	 * here since we have little experience with EOVERFLOW yet.
695 	 * Elsewhere, getuid() can't fail...
696 	 */
697 	olim.rlim_cur = rl.rlim_cur > 0x7fffffff ? 0x7fffffff : rl.rlim_cur;
698 	olim.rlim_max = rl.rlim_max > 0x7fffffff ? 0x7fffffff : rl.rlim_max;
699 	error = copyout(&olim, uap->rlp, sizeof(olim));
700 	return (error);
701 }
702 #endif /* COMPAT_43 */
703 
704 #ifndef _SYS_SYSPROTO_H_
705 struct __setrlimit_args {
706 	u_int	which;
707 	struct	rlimit *rlp;
708 };
709 #endif
710 /*
711  * MPSAFE
712  */
713 int
714 setrlimit(td, uap)
715 	struct thread *td;
716 	register struct __setrlimit_args *uap;
717 {
718 	struct rlimit alim;
719 	int error;
720 
721 	if ((error = copyin(uap->rlp, &alim, sizeof(struct rlimit))))
722 		return (error);
723 	error = kern_setrlimit(td, uap->which, &alim);
724 	return (error);
725 }
726 
727 int
728 kern_setrlimit(td, which, limp)
729 	struct thread *td;
730 	u_int which;
731 	struct rlimit *limp;
732 {
733 	struct plimit *newlim, *oldlim;
734 	struct proc *p;
735 	register struct rlimit *alimp;
736 	rlim_t oldssiz;
737 	int error;
738 
739 	if (which >= RLIM_NLIMITS)
740 		return (EINVAL);
741 
742 	/*
743 	 * Preserve historical bugs by treating negative limits as unsigned.
744 	 */
745 	if (limp->rlim_cur < 0)
746 		limp->rlim_cur = RLIM_INFINITY;
747 	if (limp->rlim_max < 0)
748 		limp->rlim_max = RLIM_INFINITY;
749 
750 	oldssiz = 0;
751 	p = td->td_proc;
752 	newlim = lim_alloc();
753 	PROC_LOCK(p);
754 	oldlim = p->p_limit;
755 	alimp = &oldlim->pl_rlimit[which];
756 	if (limp->rlim_cur > alimp->rlim_max ||
757 	    limp->rlim_max > alimp->rlim_max)
758 		if ((error = priv_check_cred(td->td_ucred,
759 		    PRIV_PROC_SETRLIMIT, SUSER_ALLOWJAIL))) {
760 			PROC_UNLOCK(p);
761 			lim_free(newlim);
762 			return (error);
763 		}
764 	if (limp->rlim_cur > limp->rlim_max)
765 		limp->rlim_cur = limp->rlim_max;
766 	lim_copy(newlim, oldlim);
767 	alimp = &newlim->pl_rlimit[which];
768 
769 	switch (which) {
770 
771 	case RLIMIT_CPU:
772 		mtx_lock_spin(&sched_lock);
773 		p->p_cpulimit = limp->rlim_cur;
774 		mtx_unlock_spin(&sched_lock);
775 		break;
776 	case RLIMIT_DATA:
777 		if (limp->rlim_cur > maxdsiz)
778 			limp->rlim_cur = maxdsiz;
779 		if (limp->rlim_max > maxdsiz)
780 			limp->rlim_max = maxdsiz;
781 		break;
782 
783 	case RLIMIT_STACK:
784 		if (limp->rlim_cur > maxssiz)
785 			limp->rlim_cur = maxssiz;
786 		if (limp->rlim_max > maxssiz)
787 			limp->rlim_max = maxssiz;
788 		oldssiz = alimp->rlim_cur;
789 		break;
790 
791 	case RLIMIT_NOFILE:
792 		if (limp->rlim_cur > maxfilesperproc)
793 			limp->rlim_cur = maxfilesperproc;
794 		if (limp->rlim_max > maxfilesperproc)
795 			limp->rlim_max = maxfilesperproc;
796 		break;
797 
798 	case RLIMIT_NPROC:
799 		if (limp->rlim_cur > maxprocperuid)
800 			limp->rlim_cur = maxprocperuid;
801 		if (limp->rlim_max > maxprocperuid)
802 			limp->rlim_max = maxprocperuid;
803 		if (limp->rlim_cur < 1)
804 			limp->rlim_cur = 1;
805 		if (limp->rlim_max < 1)
806 			limp->rlim_max = 1;
807 		break;
808 	}
809 	*alimp = *limp;
810 	p->p_limit = newlim;
811 	PROC_UNLOCK(p);
812 	lim_free(oldlim);
813 
814 	if (which == RLIMIT_STACK) {
815 		/*
816 		 * Stack is allocated to the max at exec time with only
817 		 * "rlim_cur" bytes accessible.  If stack limit is going
818 		 * up make more accessible, if going down make inaccessible.
819 		 */
820 		if (limp->rlim_cur != oldssiz) {
821 			vm_offset_t addr;
822 			vm_size_t size;
823 			vm_prot_t prot;
824 
825 			if (limp->rlim_cur > oldssiz) {
826 				prot = p->p_sysent->sv_stackprot;
827 				size = limp->rlim_cur - oldssiz;
828 				addr = p->p_sysent->sv_usrstack -
829 				    limp->rlim_cur;
830 			} else {
831 				prot = VM_PROT_NONE;
832 				size = oldssiz - limp->rlim_cur;
833 				addr = p->p_sysent->sv_usrstack - oldssiz;
834 			}
835 			addr = trunc_page(addr);
836 			size = round_page(size);
837 			(void)vm_map_protect(&p->p_vmspace->vm_map,
838 			    addr, addr + size, prot, FALSE);
839 		}
840 	}
841 
842 	/*
843 	 * The data size limit may need to be changed to a value
844 	 * that makes sense for the 32 bit binary.
845 	 */
846 	if (p->p_sysent->sv_fixlimits != NULL)
847 		p->p_sysent->sv_fixlimits(p);
848 	return (0);
849 }
850 
851 #ifndef _SYS_SYSPROTO_H_
852 struct __getrlimit_args {
853 	u_int	which;
854 	struct	rlimit *rlp;
855 };
856 #endif
857 /*
858  * MPSAFE
859  */
860 /* ARGSUSED */
861 int
862 getrlimit(td, uap)
863 	struct thread *td;
864 	register struct __getrlimit_args *uap;
865 {
866 	struct rlimit rlim;
867 	struct proc *p;
868 	int error;
869 
870 	if (uap->which >= RLIM_NLIMITS)
871 		return (EINVAL);
872 	p = td->td_proc;
873 	PROC_LOCK(p);
874 	lim_rlimit(p, uap->which, &rlim);
875 	PROC_UNLOCK(p);
876 	error = copyout(&rlim, uap->rlp, sizeof(struct rlimit));
877 	return (error);
878 }
879 
880 /*
881  * Transform the running time and tick information for children of proc p
882  * into user and system time usage.
883  */
884 void
885 calccru(p, up, sp)
886 	struct proc *p;
887 	struct timeval *up;
888 	struct timeval *sp;
889 {
890 
891 	PROC_LOCK_ASSERT(p, MA_OWNED);
892 	calcru1(p, &p->p_crux, up, sp);
893 }
894 
895 /*
896  * Transform the running time and tick information in proc p into user
897  * and system time usage.  If appropriate, include the current time slice
898  * on this CPU.
899  */
900 void
901 calcru(struct proc *p, struct timeval *up, struct timeval *sp)
902 {
903 	struct rusage_ext rux;
904 	struct thread *td;
905 	uint64_t u;
906 
907 	PROC_LOCK_ASSERT(p, MA_OWNED);
908 	mtx_assert(&sched_lock, MA_NOTOWNED);
909 	mtx_lock_spin(&sched_lock);
910 
911 	/*
912 	 * If we are getting stats for the current process, then add in the
913 	 * stats that this thread has accumulated in its current time slice.
914 	 * We reset the thread and CPU state as if we had performed a context
915 	 * switch right here.
916 	 */
917 	if (curthread->td_proc == p) {
918 		td = curthread;
919 		u = cpu_ticks();
920 		p->p_rux.rux_runtime += u - PCPU_GET(switchtime);
921 		PCPU_SET(switchtime, u);
922 		p->p_rux.rux_uticks += td->td_uticks;
923 		td->td_uticks = 0;
924 		p->p_rux.rux_iticks += td->td_iticks;
925 		td->td_iticks = 0;
926 		p->p_rux.rux_sticks += td->td_sticks;
927 		td->td_sticks = 0;
928 	}
929 	/* Work on a copy of p_rux so we can let go of sched_lock */
930 	rux = p->p_rux;
931 	mtx_unlock_spin(&sched_lock);
932 	calcru1(p, &rux, up, sp);
933 	/* Update the result from the p_rux copy */
934 	p->p_rux.rux_uu = rux.rux_uu;
935 	p->p_rux.rux_su = rux.rux_su;
936 	p->p_rux.rux_tu = rux.rux_tu;
937 }
938 
939 static void
940 calcru1(struct proc *p, struct rusage_ext *ruxp, struct timeval *up,
941     struct timeval *sp)
942 {
943 	/* {user, system, interrupt, total} {ticks, usec}: */
944 	u_int64_t ut, uu, st, su, it, tt, tu;
945 
946 	ut = ruxp->rux_uticks;
947 	st = ruxp->rux_sticks;
948 	it = ruxp->rux_iticks;
949 	tt = ut + st + it;
950 	if (tt == 0) {
951 		/* Avoid divide by zero */
952 		st = 1;
953 		tt = 1;
954 	}
955 	tu = cputick2usec(ruxp->rux_runtime);
956 	if ((int64_t)tu < 0) {
957 		/* XXX: this should be an assert /phk */
958 		printf("calcru: negative runtime of %jd usec for pid %d (%s)\n",
959 		    (intmax_t)tu, p->p_pid, p->p_comm);
960 		tu = ruxp->rux_tu;
961 	}
962 
963 	if (tu >= ruxp->rux_tu) {
964 		/*
965 		 * The normal case, time increased.
966 		 * Enforce monotonicity of bucketed numbers.
967 		 */
968 		uu = (tu * ut) / tt;
969 		if (uu < ruxp->rux_uu)
970 			uu = ruxp->rux_uu;
971 		su = (tu * st) / tt;
972 		if (su < ruxp->rux_su)
973 			su = ruxp->rux_su;
974 	} else if (tu + 3 > ruxp->rux_tu || 101 * tu > 100 * ruxp->rux_tu) {
975 		/*
976 		 * When we calibrate the cputicker, it is not uncommon to
977 		 * see the presumably fixed frequency increase slightly over
978 		 * time as a result of thermal stabilization and NTP
979 		 * discipline (of the reference clock).  We therefore ignore
980 		 * a bit of backwards slop because we  expect to catch up
981  		 * shortly.  We use a 3 microsecond limit to catch low
982 		 * counts and a 1% limit for high counts.
983 		 */
984 		uu = ruxp->rux_uu;
985 		su = ruxp->rux_su;
986 		tu = ruxp->rux_tu;
987 	} else { /* tu < ruxp->rux_tu */
988 		/*
989 		 * What happene here was likely that a laptop, which ran at
990 		 * a reduced clock frequency at boot, kicked into high gear.
991 		 * The wisdom of spamming this message in that case is
992 		 * dubious, but it might also be indicative of something
993 		 * serious, so lets keep it and hope laptops can be made
994 		 * more truthful about their CPU speed via ACPI.
995 		 */
996 		printf("calcru: runtime went backwards from %ju usec "
997 		    "to %ju usec for pid %d (%s)\n",
998 		    (uintmax_t)ruxp->rux_tu, (uintmax_t)tu,
999 		    p->p_pid, p->p_comm);
1000 		uu = (tu * ut) / tt;
1001 		su = (tu * st) / tt;
1002 	}
1003 
1004 	ruxp->rux_uu = uu;
1005 	ruxp->rux_su = su;
1006 	ruxp->rux_tu = tu;
1007 
1008 	up->tv_sec = uu / 1000000;
1009 	up->tv_usec = uu % 1000000;
1010 	sp->tv_sec = su / 1000000;
1011 	sp->tv_usec = su % 1000000;
1012 }
1013 
1014 #ifndef _SYS_SYSPROTO_H_
1015 struct getrusage_args {
1016 	int	who;
1017 	struct	rusage *rusage;
1018 };
1019 #endif
1020 /*
1021  * MPSAFE
1022  */
1023 int
1024 getrusage(td, uap)
1025 	register struct thread *td;
1026 	register struct getrusage_args *uap;
1027 {
1028 	struct rusage ru;
1029 	int error;
1030 
1031 	error = kern_getrusage(td, uap->who, &ru);
1032 	if (error == 0)
1033 		error = copyout(&ru, uap->rusage, sizeof(struct rusage));
1034 	return (error);
1035 }
1036 
1037 int
1038 kern_getrusage(td, who, rup)
1039 	struct thread *td;
1040 	int who;
1041 	struct rusage *rup;
1042 {
1043 	struct proc *p;
1044 
1045 	p = td->td_proc;
1046 	PROC_LOCK(p);
1047 	switch (who) {
1048 
1049 	case RUSAGE_SELF:
1050 		*rup = p->p_stats->p_ru;
1051 		calcru(p, &rup->ru_utime, &rup->ru_stime);
1052 		break;
1053 
1054 	case RUSAGE_CHILDREN:
1055 		*rup = p->p_stats->p_cru;
1056 		calccru(p, &rup->ru_utime, &rup->ru_stime);
1057 		break;
1058 
1059 	default:
1060 		PROC_UNLOCK(p);
1061 		return (EINVAL);
1062 	}
1063 	PROC_UNLOCK(p);
1064 	return (0);
1065 }
1066 
1067 void
1068 ruadd(ru, rux, ru2, rux2)
1069 	struct rusage *ru;
1070 	struct rusage_ext *rux;
1071 	struct rusage *ru2;
1072 	struct rusage_ext *rux2;
1073 {
1074 	register long *ip, *ip2;
1075 	register int i;
1076 
1077 	rux->rux_runtime += rux2->rux_runtime;
1078 	rux->rux_uticks += rux2->rux_uticks;
1079 	rux->rux_sticks += rux2->rux_sticks;
1080 	rux->rux_iticks += rux2->rux_iticks;
1081 	rux->rux_uu += rux2->rux_uu;
1082 	rux->rux_su += rux2->rux_su;
1083 	rux->rux_tu += rux2->rux_tu;
1084 	if (ru->ru_maxrss < ru2->ru_maxrss)
1085 		ru->ru_maxrss = ru2->ru_maxrss;
1086 	ip = &ru->ru_first;
1087 	ip2 = &ru2->ru_first;
1088 	for (i = &ru->ru_last - &ru->ru_first; i >= 0; i--)
1089 		*ip++ += *ip2++;
1090 }
1091 
1092 /*
1093  * Allocate a new resource limits structure and initialize its
1094  * reference count and mutex pointer.
1095  */
1096 struct plimit *
1097 lim_alloc()
1098 {
1099 	struct plimit *limp;
1100 
1101 	limp = malloc(sizeof(struct plimit), M_PLIMIT, M_WAITOK);
1102 	refcount_init(&limp->pl_refcnt, 1);
1103 	return (limp);
1104 }
1105 
1106 struct plimit *
1107 lim_hold(limp)
1108 	struct plimit *limp;
1109 {
1110 
1111 	refcount_acquire(&limp->pl_refcnt);
1112 	return (limp);
1113 }
1114 
1115 void
1116 lim_free(limp)
1117 	struct plimit *limp;
1118 {
1119 
1120 	KASSERT(limp->pl_refcnt > 0, ("plimit refcnt underflow"));
1121 	if (refcount_release(&limp->pl_refcnt))
1122 		free((void *)limp, M_PLIMIT);
1123 }
1124 
1125 /*
1126  * Make a copy of the plimit structure.
1127  * We share these structures copy-on-write after fork.
1128  */
1129 void
1130 lim_copy(dst, src)
1131 	struct plimit *dst, *src;
1132 {
1133 
1134 	KASSERT(dst->pl_refcnt == 1, ("lim_copy to shared limit"));
1135 	bcopy(src->pl_rlimit, dst->pl_rlimit, sizeof(src->pl_rlimit));
1136 }
1137 
1138 /*
1139  * Return the hard limit for a particular system resource.  The
1140  * which parameter specifies the index into the rlimit array.
1141  */
1142 rlim_t
1143 lim_max(struct proc *p, int which)
1144 {
1145 	struct rlimit rl;
1146 
1147 	lim_rlimit(p, which, &rl);
1148 	return (rl.rlim_max);
1149 }
1150 
1151 /*
1152  * Return the current (soft) limit for a particular system resource.
1153  * The which parameter which specifies the index into the rlimit array
1154  */
1155 rlim_t
1156 lim_cur(struct proc *p, int which)
1157 {
1158 	struct rlimit rl;
1159 
1160 	lim_rlimit(p, which, &rl);
1161 	return (rl.rlim_cur);
1162 }
1163 
1164 /*
1165  * Return a copy of the entire rlimit structure for the system limit
1166  * specified by 'which' in the rlimit structure pointed to by 'rlp'.
1167  */
1168 void
1169 lim_rlimit(struct proc *p, int which, struct rlimit *rlp)
1170 {
1171 
1172 	PROC_LOCK_ASSERT(p, MA_OWNED);
1173 	KASSERT(which >= 0 && which < RLIM_NLIMITS,
1174 	    ("request for invalid resource limit"));
1175 	*rlp = p->p_limit->pl_rlimit[which];
1176 }
1177 
1178 /*
1179  * Find the uidinfo structure for a uid.  This structure is used to
1180  * track the total resource consumption (process count, socket buffer
1181  * size, etc.) for the uid and impose limits.
1182  */
1183 void
1184 uihashinit()
1185 {
1186 
1187 	uihashtbl = hashinit(maxproc / 16, M_UIDINFO, &uihash);
1188 	mtx_init(&uihashtbl_mtx, "uidinfo hash", NULL, MTX_DEF);
1189 }
1190 
1191 /*
1192  * Look up a uidinfo struct for the parameter uid.
1193  * uihashtbl_mtx must be locked.
1194  */
1195 static struct uidinfo *
1196 uilookup(uid)
1197 	uid_t uid;
1198 {
1199 	struct uihashhead *uipp;
1200 	struct uidinfo *uip;
1201 
1202 	mtx_assert(&uihashtbl_mtx, MA_OWNED);
1203 	uipp = UIHASH(uid);
1204 	LIST_FOREACH(uip, uipp, ui_hash)
1205 		if (uip->ui_uid == uid)
1206 			break;
1207 
1208 	return (uip);
1209 }
1210 
1211 /*
1212  * Find or allocate a struct uidinfo for a particular uid.
1213  * Increase refcount on uidinfo struct returned.
1214  * uifree() should be called on a struct uidinfo when released.
1215  */
1216 struct uidinfo *
1217 uifind(uid)
1218 	uid_t uid;
1219 {
1220 	struct uidinfo *old_uip, *uip;
1221 
1222 	mtx_lock(&uihashtbl_mtx);
1223 	uip = uilookup(uid);
1224 	if (uip == NULL) {
1225 		mtx_unlock(&uihashtbl_mtx);
1226 		uip = malloc(sizeof(*uip), M_UIDINFO, M_WAITOK | M_ZERO);
1227 		mtx_lock(&uihashtbl_mtx);
1228 		/*
1229 		 * There's a chance someone created our uidinfo while we
1230 		 * were in malloc and not holding the lock, so we have to
1231 		 * make sure we don't insert a duplicate uidinfo.
1232 		 */
1233 		if ((old_uip = uilookup(uid)) != NULL) {
1234 			/* Someone else beat us to it. */
1235 			free(uip, M_UIDINFO);
1236 			uip = old_uip;
1237 		} else {
1238 			uip->ui_mtxp = mtx_pool_alloc(mtxpool_sleep);
1239 			uip->ui_uid = uid;
1240 			LIST_INSERT_HEAD(UIHASH(uid), uip, ui_hash);
1241 		}
1242 	}
1243 	uihold(uip);
1244 	mtx_unlock(&uihashtbl_mtx);
1245 	return (uip);
1246 }
1247 
1248 /*
1249  * Place another refcount on a uidinfo struct.
1250  */
1251 void
1252 uihold(uip)
1253 	struct uidinfo *uip;
1254 {
1255 
1256 	UIDINFO_LOCK(uip);
1257 	uip->ui_ref++;
1258 	UIDINFO_UNLOCK(uip);
1259 }
1260 
1261 /*-
1262  * Since uidinfo structs have a long lifetime, we use an
1263  * opportunistic refcounting scheme to avoid locking the lookup hash
1264  * for each release.
1265  *
1266  * If the refcount hits 0, we need to free the structure,
1267  * which means we need to lock the hash.
1268  * Optimal case:
1269  *   After locking the struct and lowering the refcount, if we find
1270  *   that we don't need to free, simply unlock and return.
1271  * Suboptimal case:
1272  *   If refcount lowering results in need to free, bump the count
1273  *   back up, lose the lock and aquire the locks in the proper
1274  *   order to try again.
1275  */
1276 void
1277 uifree(uip)
1278 	struct uidinfo *uip;
1279 {
1280 
1281 	/* Prepare for optimal case. */
1282 	UIDINFO_LOCK(uip);
1283 
1284 	if (--uip->ui_ref != 0) {
1285 		UIDINFO_UNLOCK(uip);
1286 		return;
1287 	}
1288 
1289 	/* Prepare for suboptimal case. */
1290 	uip->ui_ref++;
1291 	UIDINFO_UNLOCK(uip);
1292 	mtx_lock(&uihashtbl_mtx);
1293 	UIDINFO_LOCK(uip);
1294 
1295 	/*
1296 	 * We must subtract one from the count again because we backed out
1297 	 * our initial subtraction before dropping the lock.
1298 	 * Since another thread may have added a reference after we dropped the
1299 	 * initial lock we have to test for zero again.
1300 	 */
1301 	if (--uip->ui_ref == 0) {
1302 		LIST_REMOVE(uip, ui_hash);
1303 		mtx_unlock(&uihashtbl_mtx);
1304 		if (uip->ui_sbsize != 0)
1305 			printf("freeing uidinfo: uid = %d, sbsize = %jd\n",
1306 			    uip->ui_uid, (intmax_t)uip->ui_sbsize);
1307 		if (uip->ui_proccnt != 0)
1308 			printf("freeing uidinfo: uid = %d, proccnt = %ld\n",
1309 			    uip->ui_uid, uip->ui_proccnt);
1310 		UIDINFO_UNLOCK(uip);
1311 		FREE(uip, M_UIDINFO);
1312 		return;
1313 	}
1314 
1315 	mtx_unlock(&uihashtbl_mtx);
1316 	UIDINFO_UNLOCK(uip);
1317 }
1318 
1319 /*
1320  * Change the count associated with number of processes
1321  * a given user is using.  When 'max' is 0, don't enforce a limit
1322  */
1323 int
1324 chgproccnt(uip, diff, max)
1325 	struct	uidinfo	*uip;
1326 	int	diff;
1327 	int	max;
1328 {
1329 
1330 	UIDINFO_LOCK(uip);
1331 	/* Don't allow them to exceed max, but allow subtraction. */
1332 	if (diff > 0 && uip->ui_proccnt + diff > max && max != 0) {
1333 		UIDINFO_UNLOCK(uip);
1334 		return (0);
1335 	}
1336 	uip->ui_proccnt += diff;
1337 	if (uip->ui_proccnt < 0)
1338 		printf("negative proccnt for uid = %d\n", uip->ui_uid);
1339 	UIDINFO_UNLOCK(uip);
1340 	return (1);
1341 }
1342 
1343 /*
1344  * Change the total socket buffer size a user has used.
1345  */
1346 int
1347 chgsbsize(uip, hiwat, to, max)
1348 	struct	uidinfo	*uip;
1349 	u_int  *hiwat;
1350 	u_int	to;
1351 	rlim_t	max;
1352 {
1353 	rlim_t new;
1354 
1355 	UIDINFO_LOCK(uip);
1356 	new = uip->ui_sbsize + to - *hiwat;
1357 	/* Don't allow them to exceed max, but allow subtraction. */
1358 	if (to > *hiwat && new > max) {
1359 		UIDINFO_UNLOCK(uip);
1360 		return (0);
1361 	}
1362 	uip->ui_sbsize = new;
1363 	UIDINFO_UNLOCK(uip);
1364 	*hiwat = to;
1365 	if (new < 0)
1366 		printf("negative sbsize for uid = %d\n", uip->ui_uid);
1367 	return (1);
1368 }
1369