xref: /dflybsd-src/sys/kern/kern_proc.c (revision b370aff7747b2e03ce9b829fbf2877dffdadfb64)
1 /*
2  * (MPSAFE)
3  *
4  * Copyright (c) 1982, 1986, 1989, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed by the University of
18  *	California, Berkeley and its contributors.
19  * 4. Neither the name of the University nor the names of its contributors
20  *    may be used to endorse or promote products derived from this software
21  *    without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33  * SUCH DAMAGE.
34  *
35  *	@(#)kern_proc.c	8.7 (Berkeley) 2/14/95
36  * $FreeBSD: src/sys/kern/kern_proc.c,v 1.63.2.9 2003/05/08 07:47:16 kbyanc Exp $
37  * $DragonFly: src/sys/kern/kern_proc.c,v 1.45 2008/06/12 23:25:02 dillon Exp $
38  */
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/kernel.h>
43 #include <sys/sysctl.h>
44 #include <sys/malloc.h>
45 #include <sys/proc.h>
46 #include <sys/jail.h>
47 #include <sys/filedesc.h>
48 #include <sys/tty.h>
49 #include <sys/dsched.h>
50 #include <sys/signalvar.h>
51 #include <sys/spinlock.h>
52 #include <vm/vm.h>
53 #include <sys/lock.h>
54 #include <vm/pmap.h>
55 #include <vm/vm_map.h>
56 #include <sys/user.h>
57 #include <machine/smp.h>
58 
59 #include <sys/refcount.h>
60 #include <sys/spinlock2.h>
61 #include <sys/mplock2.h>
62 
63 static MALLOC_DEFINE(M_PGRP, "pgrp", "process group header");
64 MALLOC_DEFINE(M_SESSION, "session", "session header");
65 MALLOC_DEFINE(M_PROC, "proc", "Proc structures");
66 MALLOC_DEFINE(M_LWP, "lwp", "lwp structures");
67 MALLOC_DEFINE(M_SUBPROC, "subproc", "Proc sub-structures");
68 
69 int ps_showallprocs = 1;
70 static int ps_showallthreads = 1;
71 SYSCTL_INT(_security, OID_AUTO, ps_showallprocs, CTLFLAG_RW,
72     &ps_showallprocs, 0,
73     "Unprivileged processes can see proccesses with different UID/GID");
74 SYSCTL_INT(_security, OID_AUTO, ps_showallthreads, CTLFLAG_RW,
75     &ps_showallthreads, 0,
76     "Unprivileged processes can see kernel threads");
77 
78 static void pgdelete(struct pgrp *);
79 static void orphanpg(struct pgrp *pg);
80 static pid_t proc_getnewpid_locked(int random_offset);
81 
82 /*
83  * Other process lists
84  */
85 struct pidhashhead *pidhashtbl;
86 u_long pidhash;
87 struct pgrphashhead *pgrphashtbl;
88 u_long pgrphash;
89 struct proclist allproc;
90 struct proclist zombproc;
91 
92 /*
93  * Random component to nextpid generation.  We mix in a random factor to make
94  * it a little harder to predict.  We sanity check the modulus value to avoid
95  * doing it in critical paths.  Don't let it be too small or we pointlessly
96  * waste randomness entropy, and don't let it be impossibly large.  Using a
97  * modulus that is too big causes a LOT more process table scans and slows
98  * down fork processing as the pidchecked caching is defeated.
99  */
100 static int randompid = 0;
101 
102 /*
103  * No requirements.
104  */
105 static int
106 sysctl_kern_randompid(SYSCTL_HANDLER_ARGS)
107 {
108 	int error, pid;
109 
110 	pid = randompid;
111 	error = sysctl_handle_int(oidp, &pid, 0, req);
112 	if (error || !req->newptr)
113 		return (error);
114 	if (pid < 0 || pid > PID_MAX - 100)     /* out of range */
115 		pid = PID_MAX - 100;
116 	else if (pid < 2)                       /* NOP */
117 		pid = 0;
118 	else if (pid < 100)                     /* Make it reasonable */
119 		pid = 100;
120 	randompid = pid;
121 	return (error);
122 }
123 
124 SYSCTL_PROC(_kern, OID_AUTO, randompid, CTLTYPE_INT|CTLFLAG_RW,
125 	    0, 0, sysctl_kern_randompid, "I", "Random PID modulus");
126 
127 /*
128  * Initialize global process hashing structures.
129  *
130  * Called from the low level boot code only.
131  */
132 void
133 procinit(void)
134 {
135 	LIST_INIT(&allproc);
136 	LIST_INIT(&zombproc);
137 	lwkt_init();
138 	pidhashtbl = hashinit(maxproc / 4, M_PROC, &pidhash);
139 	pgrphashtbl = hashinit(maxproc / 4, M_PROC, &pgrphash);
140 	uihashinit();
141 }
142 
143 /*
144  * Process hold/release support functions.  These functions must be MPSAFE.
145  * Called via the PHOLD(), PRELE(), and PSTALL() macros.
146  *
147  * p->p_lock is a simple hold count with a waiting interlock.  No wakeup()
148  * is issued unless someone is actually waiting for the process.
149  *
150  * Most holds are short-term, allowing a process scan or other similar
151  * operation to access a proc structure without it getting ripped out from
152  * under us.  procfs and process-list sysctl ops also use the hold function
153  * interlocked with various p_flags to keep the vmspace intact when reading
154  * or writing a user process's address space.
155  *
156  * There are two situations where a hold count can be longer.  Exiting lwps
157  * hold the process until the lwp is reaped, and the parent will hold the
158  * child during vfork()/exec() sequences while the child is marked P_PPWAIT.
159  *
160  * The kernel waits for the hold count to drop to 0 (or 1 in some cases) at
161  * various critical points in the fork/exec and exit paths before proceeding.
162  */
163 #define PLOCK_WAITING	0x40000000
164 #define PLOCK_MASK	0x3FFFFFFF
165 
166 void
167 pstall(struct proc *p, const char *wmesg, int count)
168 {
169 	int o;
170 	int n;
171 
172 	for (;;) {
173 		o = p->p_lock;
174 		cpu_ccfence();
175 		if ((o & PLOCK_MASK) <= count)
176 			break;
177 		n = o | PLOCK_WAITING;
178 		tsleep_interlock(&p->p_lock, 0);
179 		if (atomic_cmpset_int(&p->p_lock, o, n)) {
180 			tsleep(&p->p_lock, PINTERLOCKED, wmesg, 0);
181 		}
182 	}
183 }
184 
185 void
186 phold(struct proc *p)
187 {
188 	int o;
189 	int n;
190 
191 	for (;;) {
192 		o = p->p_lock;
193 		cpu_ccfence();
194 		n = o + 1;
195 		if (atomic_cmpset_int(&p->p_lock, o, n))
196 			break;
197 	}
198 }
199 
200 void
201 prele(struct proc *p)
202 {
203 	int o;
204 	int n;
205 
206 	/*
207 	 * Fast path
208 	 */
209 	if (atomic_cmpset_int(&p->p_lock, 1, 0))
210 		return;
211 
212 	/*
213 	 * Slow path
214 	 */
215 	for (;;) {
216 		o = p->p_lock;
217 		KKASSERT((o & PLOCK_MASK) > 0);
218 		cpu_ccfence();
219 		n = (o - 1) & ~PLOCK_WAITING;
220 		if (atomic_cmpset_int(&p->p_lock, o, n)) {
221 			if (o & PLOCK_WAITING)
222 				wakeup(&p->p_lock);
223 			break;
224 		}
225 	}
226 }
227 
228 /*
229  * Is p an inferior of the current process?
230  *
231  * No requirements.
232  * The caller must hold proc_token if the caller wishes a stable result.
233  */
234 int
235 inferior(struct proc *p)
236 {
237 	lwkt_gettoken(&proc_token);
238 	while (p != curproc) {
239 		if (p->p_pid == 0) {
240 			lwkt_reltoken(&proc_token);
241 			return (0);
242 		}
243 		p = p->p_pptr;
244 	}
245 	lwkt_reltoken(&proc_token);
246 	return (1);
247 }
248 
249 /*
250  * Locate a process by number.  The returned process will be referenced and
251  * must be released with PRELE().
252  *
253  * No requirements.
254  */
255 struct proc *
256 pfind(pid_t pid)
257 {
258 	struct proc *p;
259 
260 	lwkt_gettoken(&proc_token);
261 	LIST_FOREACH(p, PIDHASH(pid), p_hash) {
262 		if (p->p_pid == pid) {
263 			PHOLD(p);
264 			lwkt_reltoken(&proc_token);
265 			return (p);
266 		}
267 	}
268 	lwkt_reltoken(&proc_token);
269 	return (NULL);
270 }
271 
272 /*
273  * Locate a process by number.  The returned process is NOT referenced.
274  * The caller should hold proc_token if the caller wishes a stable result.
275  *
276  * No requirements.
277  */
278 struct proc *
279 pfindn(pid_t pid)
280 {
281 	struct proc *p;
282 
283 	lwkt_gettoken(&proc_token);
284 	LIST_FOREACH(p, PIDHASH(pid), p_hash) {
285 		if (p->p_pid == pid) {
286 			lwkt_reltoken(&proc_token);
287 			return (p);
288 		}
289 	}
290 	lwkt_reltoken(&proc_token);
291 	return (NULL);
292 }
293 
294 void
295 pgref(struct pgrp *pgrp)
296 {
297 	refcount_acquire(&pgrp->pg_refs);
298 }
299 
300 void
301 pgrel(struct pgrp *pgrp)
302 {
303 	if (refcount_release(&pgrp->pg_refs))
304 		pgdelete(pgrp);
305 }
306 
307 /*
308  * Locate a process group by number.  The returned process group will be
309  * referenced w/pgref() and must be released with pgrel() (or assigned
310  * somewhere if you wish to keep the reference).
311  *
312  * No requirements.
313  */
314 struct pgrp *
315 pgfind(pid_t pgid)
316 {
317 	struct pgrp *pgrp;
318 
319 	lwkt_gettoken(&proc_token);
320 	LIST_FOREACH(pgrp, PGRPHASH(pgid), pg_hash) {
321 		if (pgrp->pg_id == pgid) {
322 			refcount_acquire(&pgrp->pg_refs);
323 			lwkt_reltoken(&proc_token);
324 			return (pgrp);
325 		}
326 	}
327 	lwkt_reltoken(&proc_token);
328 	return (NULL);
329 }
330 
331 /*
332  * Move p to a new or existing process group (and session)
333  *
334  * No requirements.
335  */
336 int
337 enterpgrp(struct proc *p, pid_t pgid, int mksess)
338 {
339 	struct pgrp *pgrp;
340 	struct pgrp *opgrp;
341 	int error;
342 
343 	pgrp = pgfind(pgid);
344 
345 	KASSERT(pgrp == NULL || !mksess,
346 		("enterpgrp: setsid into non-empty pgrp"));
347 	KASSERT(!SESS_LEADER(p),
348 		("enterpgrp: session leader attempted setpgrp"));
349 
350 	if (pgrp == NULL) {
351 		pid_t savepid = p->p_pid;
352 		struct proc *np;
353 		/*
354 		 * new process group
355 		 */
356 		KASSERT(p->p_pid == pgid,
357 			("enterpgrp: new pgrp and pid != pgid"));
358 		if ((np = pfindn(savepid)) == NULL || np != p) {
359 			error = ESRCH;
360 			goto fatal;
361 		}
362 		MALLOC(pgrp, struct pgrp *, sizeof(struct pgrp),
363 		       M_PGRP, M_WAITOK);
364 		if (mksess) {
365 			struct session *sess;
366 
367 			/*
368 			 * new session
369 			 */
370 			MALLOC(sess, struct session *, sizeof(struct session),
371 			       M_SESSION, M_WAITOK);
372 			sess->s_leader = p;
373 			sess->s_sid = p->p_pid;
374 			sess->s_count = 1;
375 			sess->s_ttyvp = NULL;
376 			sess->s_ttyp = NULL;
377 			bcopy(p->p_session->s_login, sess->s_login,
378 			      sizeof(sess->s_login));
379 			pgrp->pg_session = sess;
380 			KASSERT(p == curproc,
381 				("enterpgrp: mksession and p != curproc"));
382 			lwkt_gettoken(&p->p_token);
383 			p->p_flags &= ~P_CONTROLT;
384 			lwkt_reltoken(&p->p_token);
385 		} else {
386 			pgrp->pg_session = p->p_session;
387 			sess_hold(pgrp->pg_session);
388 		}
389 		pgrp->pg_id = pgid;
390 		LIST_INIT(&pgrp->pg_members);
391 		LIST_INSERT_HEAD(PGRPHASH(pgid), pgrp, pg_hash);
392 		pgrp->pg_jobc = 0;
393 		SLIST_INIT(&pgrp->pg_sigiolst);
394 		lwkt_token_init(&pgrp->pg_token, "pgrp_token");
395 		refcount_init(&pgrp->pg_refs, 1);
396 		lockinit(&pgrp->pg_lock, "pgwt", 0, 0);
397 	} else if (pgrp == p->p_pgrp) {
398 		pgrel(pgrp);
399 		goto done;
400 	} /* else pgfind() referenced the pgrp */
401 
402 	/*
403 	 * Adjust eligibility of affected pgrps to participate in job control.
404 	 * Increment eligibility counts before decrementing, otherwise we
405 	 * could reach 0 spuriously during the first call.
406 	 */
407 	lwkt_gettoken(&pgrp->pg_token);
408 	lwkt_gettoken(&p->p_token);
409 	fixjobc(p, pgrp, 1);
410 	fixjobc(p, p->p_pgrp, 0);
411 	while ((opgrp = p->p_pgrp) != NULL) {
412 		opgrp = p->p_pgrp;
413 		lwkt_gettoken(&opgrp->pg_token);
414 		LIST_REMOVE(p, p_pglist);
415 		p->p_pgrp = NULL;
416 		lwkt_reltoken(&opgrp->pg_token);
417 		pgrel(opgrp);
418 	}
419 	p->p_pgrp = pgrp;
420 	LIST_INSERT_HEAD(&pgrp->pg_members, p, p_pglist);
421 	lwkt_reltoken(&p->p_token);
422 	lwkt_reltoken(&pgrp->pg_token);
423 done:
424 	error = 0;
425 fatal:
426 	return (error);
427 }
428 
429 /*
430  * Remove process from process group
431  *
432  * No requirements.
433  */
434 int
435 leavepgrp(struct proc *p)
436 {
437 	struct pgrp *pg = p->p_pgrp;
438 
439 	lwkt_gettoken(&p->p_token);
440 	pg = p->p_pgrp;
441 	if (pg) {
442 		pgref(pg);
443 		lwkt_gettoken(&pg->pg_token);
444 		if (p->p_pgrp == pg) {
445 			p->p_pgrp = NULL;
446 			LIST_REMOVE(p, p_pglist);
447 			pgrel(pg);
448 		}
449 		lwkt_reltoken(&pg->pg_token);
450 		lwkt_reltoken(&p->p_token);	/* avoid chaining on rel */
451 		pgrel(pg);
452 	} else {
453 		lwkt_reltoken(&p->p_token);
454 	}
455 	return (0);
456 }
457 
458 /*
459  * Delete a process group.  Must be called only after the last ref has been
460  * released.
461  */
462 static void
463 pgdelete(struct pgrp *pgrp)
464 {
465 	/*
466 	 * Reset any sigio structures pointing to us as a result of
467 	 * F_SETOWN with our pgid.
468 	 */
469 	funsetownlst(&pgrp->pg_sigiolst);
470 
471 	if (pgrp->pg_session->s_ttyp != NULL &&
472 	    pgrp->pg_session->s_ttyp->t_pgrp == pgrp)
473 		pgrp->pg_session->s_ttyp->t_pgrp = NULL;
474 	LIST_REMOVE(pgrp, pg_hash);
475 	sess_rele(pgrp->pg_session);
476 	kfree(pgrp, M_PGRP);
477 }
478 
479 /*
480  * Adjust the ref count on a session structure.  When the ref count falls to
481  * zero the tty is disassociated from the session and the session structure
482  * is freed.  Note that tty assocation is not itself ref-counted.
483  *
484  * No requirements.
485  */
486 void
487 sess_hold(struct session *sp)
488 {
489 	lwkt_gettoken(&tty_token);
490 	++sp->s_count;
491 	lwkt_reltoken(&tty_token);
492 }
493 
494 /*
495  * No requirements.
496  */
497 void
498 sess_rele(struct session *sp)
499 {
500 	struct tty *tp;
501 
502 	KKASSERT(sp->s_count > 0);
503 	lwkt_gettoken(&tty_token);
504 	if (--sp->s_count == 0) {
505 		if (sp->s_ttyp && sp->s_ttyp->t_session) {
506 #ifdef TTY_DO_FULL_CLOSE
507 			/* FULL CLOSE, see ttyclearsession() */
508 			KKASSERT(sp->s_ttyp->t_session == sp);
509 			sp->s_ttyp->t_session = NULL;
510 #else
511 			/* HALF CLOSE, see ttyclearsession() */
512 			if (sp->s_ttyp->t_session == sp)
513 				sp->s_ttyp->t_session = NULL;
514 #endif
515 		}
516 		if ((tp = sp->s_ttyp) != NULL) {
517 			sp->s_ttyp = NULL;
518 			ttyunhold(tp);
519 		}
520 		kfree(sp, M_SESSION);
521 	}
522 	lwkt_reltoken(&tty_token);
523 }
524 
525 /*
526  * Adjust pgrp jobc counters when specified process changes process group.
527  * We count the number of processes in each process group that "qualify"
528  * the group for terminal job control (those with a parent in a different
529  * process group of the same session).  If that count reaches zero, the
530  * process group becomes orphaned.  Check both the specified process'
531  * process group and that of its children.
532  * entering == 0 => p is leaving specified group.
533  * entering == 1 => p is entering specified group.
534  *
535  * No requirements.
536  */
537 void
538 fixjobc(struct proc *p, struct pgrp *pgrp, int entering)
539 {
540 	struct pgrp *hispgrp;
541 	struct session *mysession;
542 	struct proc *np;
543 
544 	/*
545 	 * Check p's parent to see whether p qualifies its own process
546 	 * group; if so, adjust count for p's process group.
547 	 */
548 	lwkt_gettoken(&p->p_token);	/* p_children scan */
549 	lwkt_gettoken(&pgrp->pg_token);
550 
551 	mysession = pgrp->pg_session;
552 	if ((hispgrp = p->p_pptr->p_pgrp) != pgrp &&
553 	    hispgrp->pg_session == mysession) {
554 		if (entering)
555 			pgrp->pg_jobc++;
556 		else if (--pgrp->pg_jobc == 0)
557 			orphanpg(pgrp);
558 	}
559 
560 	/*
561 	 * Check this process' children to see whether they qualify
562 	 * their process groups; if so, adjust counts for children's
563 	 * process groups.
564 	 */
565 	LIST_FOREACH(np, &p->p_children, p_sibling) {
566 		PHOLD(np);
567 		lwkt_gettoken(&np->p_token);
568 		if ((hispgrp = np->p_pgrp) != pgrp &&
569 		    hispgrp->pg_session == mysession &&
570 		    np->p_stat != SZOMB) {
571 			pgref(hispgrp);
572 			lwkt_gettoken(&hispgrp->pg_token);
573 			if (entering)
574 				hispgrp->pg_jobc++;
575 			else if (--hispgrp->pg_jobc == 0)
576 				orphanpg(hispgrp);
577 			lwkt_reltoken(&hispgrp->pg_token);
578 			pgrel(hispgrp);
579 		}
580 		lwkt_reltoken(&np->p_token);
581 		PRELE(np);
582 	}
583 	KKASSERT(pgrp->pg_refs > 0);
584 	lwkt_reltoken(&pgrp->pg_token);
585 	lwkt_reltoken(&p->p_token);
586 }
587 
588 /*
589  * A process group has become orphaned;
590  * if there are any stopped processes in the group,
591  * hang-up all process in that group.
592  *
593  * The caller must hold pg_token.
594  */
595 static void
596 orphanpg(struct pgrp *pg)
597 {
598 	struct proc *p;
599 
600 	LIST_FOREACH(p, &pg->pg_members, p_pglist) {
601 		if (p->p_stat == SSTOP) {
602 			LIST_FOREACH(p, &pg->pg_members, p_pglist) {
603 				ksignal(p, SIGHUP);
604 				ksignal(p, SIGCONT);
605 			}
606 			return;
607 		}
608 	}
609 }
610 
611 /*
612  * Add a new process to the allproc list and the PID hash.  This
613  * also assigns a pid to the new process.
614  *
615  * No requirements.
616  */
617 void
618 proc_add_allproc(struct proc *p)
619 {
620 	int random_offset;
621 
622 	if ((random_offset = randompid) != 0) {
623 		get_mplock();
624 		random_offset = karc4random() % random_offset;
625 		rel_mplock();
626 	}
627 
628 	lwkt_gettoken(&proc_token);
629 	p->p_pid = proc_getnewpid_locked(random_offset);
630 	LIST_INSERT_HEAD(&allproc, p, p_list);
631 	LIST_INSERT_HEAD(PIDHASH(p->p_pid), p, p_hash);
632 	lwkt_reltoken(&proc_token);
633 }
634 
635 /*
636  * Calculate a new process pid.  This function is integrated into
637  * proc_add_allproc() to guarentee that the new pid is not reused before
638  * the new process can be added to the allproc list.
639  *
640  * The caller must hold proc_token.
641  */
642 static
643 pid_t
644 proc_getnewpid_locked(int random_offset)
645 {
646 	static pid_t nextpid;
647 	static pid_t pidchecked;
648 	struct proc *p;
649 
650 	/*
651 	 * Find an unused process ID.  We remember a range of unused IDs
652 	 * ready to use (from nextpid+1 through pidchecked-1).
653 	 */
654 	nextpid = nextpid + 1 + random_offset;
655 retry:
656 	/*
657 	 * If the process ID prototype has wrapped around,
658 	 * restart somewhat above 0, as the low-numbered procs
659 	 * tend to include daemons that don't exit.
660 	 */
661 	if (nextpid >= PID_MAX) {
662 		nextpid = nextpid % PID_MAX;
663 		if (nextpid < 100)
664 			nextpid += 100;
665 		pidchecked = 0;
666 	}
667 	if (nextpid >= pidchecked) {
668 		int doingzomb = 0;
669 
670 		pidchecked = PID_MAX;
671 
672 		/*
673 		 * Scan the active and zombie procs to check whether this pid
674 		 * is in use.  Remember the lowest pid that's greater
675 		 * than nextpid, so we can avoid checking for a while.
676 		 *
677 		 * NOTE: Processes in the midst of being forked may not
678 		 *	 yet have p_pgrp and p_pgrp->pg_session set up
679 		 *	 yet, so we have to check for NULL.
680 		 *
681 		 *	 Processes being torn down should be interlocked
682 		 *	 with proc_token prior to the clearing of their
683 		 *	 p_pgrp.
684 		 */
685 		p = LIST_FIRST(&allproc);
686 again:
687 		for (; p != NULL; p = LIST_NEXT(p, p_list)) {
688 			while (p->p_pid == nextpid ||
689 			    (p->p_pgrp && p->p_pgrp->pg_id == nextpid) ||
690 			    (p->p_pgrp && p->p_session &&
691 			     p->p_session->s_sid == nextpid)) {
692 				nextpid++;
693 				if (nextpid >= pidchecked)
694 					goto retry;
695 			}
696 			if (p->p_pid > nextpid && pidchecked > p->p_pid)
697 				pidchecked = p->p_pid;
698 			if (p->p_pgrp &&
699 			    p->p_pgrp->pg_id > nextpid &&
700 			    pidchecked > p->p_pgrp->pg_id) {
701 				pidchecked = p->p_pgrp->pg_id;
702 			}
703 			if (p->p_pgrp && p->p_session &&
704 			    p->p_session->s_sid > nextpid &&
705 			    pidchecked > p->p_session->s_sid) {
706 				pidchecked = p->p_session->s_sid;
707 			}
708 		}
709 		if (!doingzomb) {
710 			doingzomb = 1;
711 			p = LIST_FIRST(&zombproc);
712 			goto again;
713 		}
714 	}
715 	return(nextpid);
716 }
717 
718 /*
719  * Called from exit1 to remove a process from the allproc
720  * list and move it to the zombie list.
721  *
722  * Caller must hold p->p_token.  We are required to wait until p_lock
723  * becomes zero before we can manipulate the list, allowing allproc
724  * scans to guarantee consistency during a list scan.
725  */
726 void
727 proc_move_allproc_zombie(struct proc *p)
728 {
729 	lwkt_gettoken(&proc_token);
730 	PSTALL(p, "reap1", 0);
731 	LIST_REMOVE(p, p_list);
732 	LIST_INSERT_HEAD(&zombproc, p, p_list);
733 	LIST_REMOVE(p, p_hash);
734 	p->p_stat = SZOMB;
735 	lwkt_reltoken(&proc_token);
736 	dsched_exit_proc(p);
737 }
738 
739 /*
740  * This routine is called from kern_wait() and will remove the process
741  * from the zombie list and the sibling list.  This routine will block
742  * if someone has a lock on the proces (p_lock).
743  *
744  * Caller must hold p->p_token.  We are required to wait until p_lock
745  * becomes zero before we can manipulate the list, allowing allproc
746  * scans to guarantee consistency during a list scan.
747  */
748 void
749 proc_remove_zombie(struct proc *p)
750 {
751 	lwkt_gettoken(&proc_token);
752 	PSTALL(p, "reap2", 0);
753 	LIST_REMOVE(p, p_list); /* off zombproc */
754 	LIST_REMOVE(p, p_sibling);
755 	lwkt_reltoken(&proc_token);
756 }
757 
758 /*
759  * Scan all processes on the allproc list.  The process is automatically
760  * held for the callback.  A return value of -1 terminates the loop.
761  *
762  * The callback is made with the process held and proc_token held.
763  *
764  * We limit the scan to the number of processes as-of the start of
765  * the scan so as not to get caught up in an endless loop if new processes
766  * are created more quickly than we can scan the old ones.  Add a little
767  * slop to try to catch edge cases since nprocs can race.
768  *
769  * No requirements.
770  */
771 void
772 allproc_scan(int (*callback)(struct proc *, void *), void *data)
773 {
774 	struct proc *p;
775 	int r;
776 	int limit = nprocs + ncpus;
777 
778 	/*
779 	 * proc_token protects the allproc list and PHOLD() prevents the
780 	 * process from being removed from the allproc list or the zombproc
781 	 * list.
782 	 */
783 	lwkt_gettoken(&proc_token);
784 	LIST_FOREACH(p, &allproc, p_list) {
785 		PHOLD(p);
786 		r = callback(p, data);
787 		PRELE(p);
788 		if (r < 0)
789 			break;
790 		if (--limit < 0)
791 			break;
792 	}
793 	lwkt_reltoken(&proc_token);
794 }
795 
796 /*
797  * Scan all lwps of processes on the allproc list.  The lwp is automatically
798  * held for the callback.  A return value of -1 terminates the loop.
799  *
800  * The callback is made with the proces and lwp both held, and proc_token held.
801  *
802  * No requirements.
803  */
804 void
805 alllwp_scan(int (*callback)(struct lwp *, void *), void *data)
806 {
807 	struct proc *p;
808 	struct lwp *lp;
809 	int r = 0;
810 
811 	/*
812 	 * proc_token protects the allproc list and PHOLD() prevents the
813 	 * process from being removed from the allproc list or the zombproc
814 	 * list.
815 	 */
816 	lwkt_gettoken(&proc_token);
817 	LIST_FOREACH(p, &allproc, p_list) {
818 		PHOLD(p);
819 		FOREACH_LWP_IN_PROC(lp, p) {
820 			LWPHOLD(lp);
821 			r = callback(lp, data);
822 			LWPRELE(lp);
823 		}
824 		PRELE(p);
825 		if (r < 0)
826 			break;
827 	}
828 	lwkt_reltoken(&proc_token);
829 }
830 
831 /*
832  * Scan all processes on the zombproc list.  The process is automatically
833  * held for the callback.  A return value of -1 terminates the loop.
834  *
835  * No requirements.
836  * The callback is made with the proces held and proc_token held.
837  */
838 void
839 zombproc_scan(int (*callback)(struct proc *, void *), void *data)
840 {
841 	struct proc *p;
842 	int r;
843 
844 	lwkt_gettoken(&proc_token);
845 	LIST_FOREACH(p, &zombproc, p_list) {
846 		PHOLD(p);
847 		r = callback(p, data);
848 		PRELE(p);
849 		if (r < 0)
850 			break;
851 	}
852 	lwkt_reltoken(&proc_token);
853 }
854 
855 #include "opt_ddb.h"
856 #ifdef DDB
857 #include <ddb/ddb.h>
858 
859 /*
860  * Debugging only
861  */
862 DB_SHOW_COMMAND(pgrpdump, pgrpdump)
863 {
864 	struct pgrp *pgrp;
865 	struct proc *p;
866 	int i;
867 
868 	for (i = 0; i <= pgrphash; i++) {
869 		if (!LIST_EMPTY(&pgrphashtbl[i])) {
870 			kprintf("\tindx %d\n", i);
871 			LIST_FOREACH(pgrp, &pgrphashtbl[i], pg_hash) {
872 				kprintf(
873 			"\tpgrp %p, pgid %ld, sess %p, sesscnt %d, mem %p\n",
874 				    (void *)pgrp, (long)pgrp->pg_id,
875 				    (void *)pgrp->pg_session,
876 				    pgrp->pg_session->s_count,
877 				    (void *)LIST_FIRST(&pgrp->pg_members));
878 				LIST_FOREACH(p, &pgrp->pg_members, p_pglist) {
879 					kprintf("\t\tpid %ld addr %p pgrp %p\n",
880 					    (long)p->p_pid, (void *)p,
881 					    (void *)p->p_pgrp);
882 				}
883 			}
884 		}
885 	}
886 }
887 #endif /* DDB */
888 
889 /*
890  * Locate a process on the zombie list.  Return a process or NULL.
891  * The returned process will be referenced and the caller must release
892  * it with PRELE().
893  *
894  * No other requirements.
895  */
896 struct proc *
897 zpfind(pid_t pid)
898 {
899 	struct proc *p;
900 
901 	lwkt_gettoken(&proc_token);
902 	LIST_FOREACH(p, &zombproc, p_list) {
903 		if (p->p_pid == pid) {
904 			PHOLD(p);
905 			lwkt_reltoken(&proc_token);
906 			return (p);
907 		}
908 	}
909 	lwkt_reltoken(&proc_token);
910 	return (NULL);
911 }
912 
913 /*
914  * The caller must hold proc_token.
915  */
916 static int
917 sysctl_out_proc(struct proc *p, struct sysctl_req *req, int flags)
918 {
919 	struct kinfo_proc ki;
920 	struct lwp *lp;
921 	int skp = 0, had_output = 0;
922 	int error;
923 
924 	bzero(&ki, sizeof(ki));
925 	lwkt_gettoken(&p->p_token);
926 	fill_kinfo_proc(p, &ki);
927 	if ((flags & KERN_PROC_FLAG_LWP) == 0)
928 		skp = 1;
929 	error = 0;
930 	FOREACH_LWP_IN_PROC(lp, p) {
931 		LWPHOLD(lp);
932 		fill_kinfo_lwp(lp, &ki.kp_lwp);
933 		had_output = 1;
934 		error = SYSCTL_OUT(req, &ki, sizeof(ki));
935 		LWPRELE(lp);
936 		if (error)
937 			break;
938 		if (skp)
939 			break;
940 	}
941 	lwkt_reltoken(&p->p_token);
942 	/* We need to output at least the proc, even if there is no lwp. */
943 	if (had_output == 0) {
944 		error = SYSCTL_OUT(req, &ki, sizeof(ki));
945 	}
946 	return (error);
947 }
948 
949 /*
950  * The caller must hold proc_token.
951  */
952 static int
953 sysctl_out_proc_kthread(struct thread *td, struct sysctl_req *req, int flags)
954 {
955 	struct kinfo_proc ki;
956 	int error;
957 
958 	fill_kinfo_proc_kthread(td, &ki);
959 	error = SYSCTL_OUT(req, &ki, sizeof(ki));
960 	if (error)
961 		return error;
962 	return(0);
963 }
964 
965 /*
966  * No requirements.
967  */
968 static int
969 sysctl_kern_proc(SYSCTL_HANDLER_ARGS)
970 {
971 	int *name = (int*) arg1;
972 	int oid = oidp->oid_number;
973 	u_int namelen = arg2;
974 	struct proc *p;
975 	struct proclist *plist;
976 	struct thread *td;
977 	struct thread *marker;
978 	int doingzomb, flags = 0;
979 	int error = 0;
980 	int n;
981 	int origcpu;
982 	struct ucred *cr1 = curproc->p_ucred;
983 
984 	flags = oid & KERN_PROC_FLAGMASK;
985 	oid &= ~KERN_PROC_FLAGMASK;
986 
987 	if ((oid == KERN_PROC_ALL && namelen != 0) ||
988 	    (oid != KERN_PROC_ALL && namelen != 1)) {
989 		return (EINVAL);
990 	}
991 
992 	/*
993 	 * proc_token protects the allproc list and PHOLD() prevents the
994 	 * process from being removed from the allproc list or the zombproc
995 	 * list.
996 	 */
997 	lwkt_gettoken(&proc_token);
998 	if (oid == KERN_PROC_PID) {
999 		p = pfindn((pid_t)name[0]);
1000 		if (p == NULL)
1001 			goto post_threads;
1002 		if (!PRISON_CHECK(cr1, p->p_ucred))
1003 			goto post_threads;
1004 		PHOLD(p);
1005 		error = sysctl_out_proc(p, req, flags);
1006 		PRELE(p);
1007 		goto post_threads;
1008 	}
1009 
1010 	if (!req->oldptr) {
1011 		/* overestimate by 5 procs */
1012 		error = SYSCTL_OUT(req, 0, sizeof (struct kinfo_proc) * 5);
1013 		if (error)
1014 			goto post_threads;
1015 	}
1016 	for (doingzomb = 0; doingzomb <= 1; doingzomb++) {
1017 		if (doingzomb)
1018 			plist = &zombproc;
1019 		else
1020 			plist = &allproc;
1021 		LIST_FOREACH(p, plist, p_list) {
1022 			/*
1023 			 * Show a user only their processes.
1024 			 */
1025 			if ((!ps_showallprocs) && p_trespass(cr1, p->p_ucred))
1026 				continue;
1027 			/*
1028 			 * Skip embryonic processes.
1029 			 */
1030 			if (p->p_stat == SIDL)
1031 				continue;
1032 			/*
1033 			 * TODO - make more efficient (see notes below).
1034 			 * do by session.
1035 			 */
1036 			switch (oid) {
1037 			case KERN_PROC_PGRP:
1038 				/* could do this by traversing pgrp */
1039 				if (p->p_pgrp == NULL ||
1040 				    p->p_pgrp->pg_id != (pid_t)name[0])
1041 					continue;
1042 				break;
1043 
1044 			case KERN_PROC_TTY:
1045 				if ((p->p_flags & P_CONTROLT) == 0 ||
1046 				    p->p_session == NULL ||
1047 				    p->p_session->s_ttyp == NULL ||
1048 				    dev2udev(p->p_session->s_ttyp->t_dev) !=
1049 					(udev_t)name[0])
1050 					continue;
1051 				break;
1052 
1053 			case KERN_PROC_UID:
1054 				if (p->p_ucred == NULL ||
1055 				    p->p_ucred->cr_uid != (uid_t)name[0])
1056 					continue;
1057 				break;
1058 
1059 			case KERN_PROC_RUID:
1060 				if (p->p_ucred == NULL ||
1061 				    p->p_ucred->cr_ruid != (uid_t)name[0])
1062 					continue;
1063 				break;
1064 			}
1065 
1066 			if (!PRISON_CHECK(cr1, p->p_ucred))
1067 				continue;
1068 			PHOLD(p);
1069 			error = sysctl_out_proc(p, req, flags);
1070 			PRELE(p);
1071 			if (error)
1072 				goto post_threads;
1073 		}
1074 	}
1075 
1076 	/*
1077 	 * Iterate over all active cpus and scan their thread list.  Start
1078 	 * with the next logical cpu and end with our original cpu.  We
1079 	 * migrate our own thread to each target cpu in order to safely scan
1080 	 * its thread list.  In the last loop we migrate back to our original
1081 	 * cpu.
1082 	 */
1083 	origcpu = mycpu->gd_cpuid;
1084 	if (!ps_showallthreads || jailed(cr1))
1085 		goto post_threads;
1086 
1087 	marker = kmalloc(sizeof(struct thread), M_TEMP, M_WAITOK|M_ZERO);
1088 	marker->td_flags = TDF_MARKER;
1089 	error = 0;
1090 
1091 	for (n = 1; n <= ncpus; ++n) {
1092 		globaldata_t rgd;
1093 		int nid;
1094 
1095 		nid = (origcpu + n) % ncpus;
1096 		if ((smp_active_mask & CPUMASK(nid)) == 0)
1097 			continue;
1098 		rgd = globaldata_find(nid);
1099 		lwkt_setcpu_self(rgd);
1100 
1101 		crit_enter();
1102 		TAILQ_INSERT_TAIL(&rgd->gd_tdallq, marker, td_allq);
1103 
1104 		while ((td = TAILQ_PREV(marker, lwkt_queue, td_allq)) != NULL) {
1105 			TAILQ_REMOVE(&rgd->gd_tdallq, marker, td_allq);
1106 			TAILQ_INSERT_BEFORE(td, marker, td_allq);
1107 			if (td->td_flags & TDF_MARKER)
1108 				continue;
1109 			if (td->td_proc)
1110 				continue;
1111 
1112 			lwkt_hold(td);
1113 			crit_exit();
1114 
1115 			switch (oid) {
1116 			case KERN_PROC_PGRP:
1117 			case KERN_PROC_TTY:
1118 			case KERN_PROC_UID:
1119 			case KERN_PROC_RUID:
1120 				break;
1121 			default:
1122 				error = sysctl_out_proc_kthread(td, req,
1123 								doingzomb);
1124 				break;
1125 			}
1126 			lwkt_rele(td);
1127 			crit_enter();
1128 			if (error)
1129 				break;
1130 		}
1131 		TAILQ_REMOVE(&rgd->gd_tdallq, marker, td_allq);
1132 		crit_exit();
1133 
1134 		if (error)
1135 			break;
1136 	}
1137 	kfree(marker, M_TEMP);
1138 
1139 post_threads:
1140 	lwkt_reltoken(&proc_token);
1141 	return (error);
1142 }
1143 
1144 /*
1145  * This sysctl allows a process to retrieve the argument list or process
1146  * title for another process without groping around in the address space
1147  * of the other process.  It also allow a process to set its own "process
1148  * title to a string of its own choice.
1149  *
1150  * No requirements.
1151  */
1152 static int
1153 sysctl_kern_proc_args(SYSCTL_HANDLER_ARGS)
1154 {
1155 	int *name = (int*) arg1;
1156 	u_int namelen = arg2;
1157 	struct proc *p;
1158 	struct pargs *opa;
1159 	struct pargs *pa;
1160 	int error = 0;
1161 	struct ucred *cr1 = curproc->p_ucred;
1162 
1163 	if (namelen != 1)
1164 		return (EINVAL);
1165 
1166 	p = pfind((pid_t)name[0]);
1167 	if (p == NULL)
1168 		goto done;
1169 	lwkt_gettoken(&p->p_token);
1170 
1171 	if ((!ps_argsopen) && p_trespass(cr1, p->p_ucred))
1172 		goto done;
1173 
1174 	if (req->newptr && curproc != p) {
1175 		error = EPERM;
1176 		goto done;
1177 	}
1178 	if (req->oldptr && (pa = p->p_args) != NULL) {
1179 		refcount_acquire(&pa->ar_ref);
1180 		error = SYSCTL_OUT(req, pa->ar_args, pa->ar_length);
1181 		if (refcount_release(&pa->ar_ref))
1182 			kfree(pa, M_PARGS);
1183 	}
1184 	if (req->newptr == NULL)
1185 		goto done;
1186 
1187 	if (req->newlen + sizeof(struct pargs) > ps_arg_cache_limit) {
1188 		goto done;
1189 	}
1190 
1191 	pa = kmalloc(sizeof(struct pargs) + req->newlen, M_PARGS, M_WAITOK);
1192 	refcount_init(&pa->ar_ref, 1);
1193 	pa->ar_length = req->newlen;
1194 	error = SYSCTL_IN(req, pa->ar_args, req->newlen);
1195 	if (error) {
1196 		kfree(pa, M_PARGS);
1197 		goto done;
1198 	}
1199 
1200 
1201 	/*
1202 	 * Replace p_args with the new pa.  p_args may have previously
1203 	 * been NULL.
1204 	 */
1205 	opa = p->p_args;
1206 	p->p_args = pa;
1207 
1208 	if (opa) {
1209 		KKASSERT(opa->ar_ref > 0);
1210 		if (refcount_release(&opa->ar_ref)) {
1211 			kfree(opa, M_PARGS);
1212 			/* opa = NULL; */
1213 		}
1214 	}
1215 done:
1216 	if (p) {
1217 		lwkt_reltoken(&p->p_token);
1218 		PRELE(p);
1219 	}
1220 	return (error);
1221 }
1222 
1223 static int
1224 sysctl_kern_proc_cwd(SYSCTL_HANDLER_ARGS)
1225 {
1226 	int *name = (int*) arg1;
1227 	u_int namelen = arg2;
1228 	struct proc *p;
1229 	int error = 0;
1230 	char *fullpath, *freepath;
1231 	struct ucred *cr1 = curproc->p_ucred;
1232 
1233 	if (namelen != 1)
1234 		return (EINVAL);
1235 
1236 	p = pfind((pid_t)name[0]);
1237 	if (p == NULL)
1238 		goto done;
1239 	lwkt_gettoken(&p->p_token);
1240 
1241 	/*
1242 	 * If we are not allowed to see other args, we certainly shouldn't
1243 	 * get the cwd either. Also check the usual trespassing.
1244 	 */
1245 	if ((!ps_argsopen) && p_trespass(cr1, p->p_ucred))
1246 		goto done;
1247 
1248 	if (req->oldptr && p->p_fd != NULL && p->p_fd->fd_ncdir.ncp) {
1249 		struct nchandle nch;
1250 
1251 		cache_copy(&p->p_fd->fd_ncdir, &nch);
1252 		error = cache_fullpath(p, &nch, &fullpath, &freepath, 0);
1253 		cache_drop(&nch);
1254 		if (error)
1255 			goto done;
1256 		error = SYSCTL_OUT(req, fullpath, strlen(fullpath) + 1);
1257 		kfree(freepath, M_TEMP);
1258 	}
1259 
1260 done:
1261 	if (p) {
1262 		lwkt_reltoken(&p->p_token);
1263 		PRELE(p);
1264 	}
1265 	return (error);
1266 }
1267 
1268 SYSCTL_NODE(_kern, KERN_PROC, proc, CTLFLAG_RD,  0, "Process table");
1269 
1270 SYSCTL_PROC(_kern_proc, KERN_PROC_ALL, all, CTLFLAG_RD|CTLTYPE_STRUCT,
1271 	0, 0, sysctl_kern_proc, "S,proc", "Return entire process table");
1272 
1273 SYSCTL_NODE(_kern_proc, KERN_PROC_PGRP, pgrp, CTLFLAG_RD,
1274 	sysctl_kern_proc, "Process table");
1275 
1276 SYSCTL_NODE(_kern_proc, KERN_PROC_TTY, tty, CTLFLAG_RD,
1277 	sysctl_kern_proc, "Process table");
1278 
1279 SYSCTL_NODE(_kern_proc, KERN_PROC_UID, uid, CTLFLAG_RD,
1280 	sysctl_kern_proc, "Process table");
1281 
1282 SYSCTL_NODE(_kern_proc, KERN_PROC_RUID, ruid, CTLFLAG_RD,
1283 	sysctl_kern_proc, "Process table");
1284 
1285 SYSCTL_NODE(_kern_proc, KERN_PROC_PID, pid, CTLFLAG_RD,
1286 	sysctl_kern_proc, "Process table");
1287 
1288 SYSCTL_NODE(_kern_proc, (KERN_PROC_ALL | KERN_PROC_FLAG_LWP), all_lwp, CTLFLAG_RD,
1289 	sysctl_kern_proc, "Process table");
1290 
1291 SYSCTL_NODE(_kern_proc, (KERN_PROC_PGRP | KERN_PROC_FLAG_LWP), pgrp_lwp, CTLFLAG_RD,
1292 	sysctl_kern_proc, "Process table");
1293 
1294 SYSCTL_NODE(_kern_proc, (KERN_PROC_TTY | KERN_PROC_FLAG_LWP), tty_lwp, CTLFLAG_RD,
1295 	sysctl_kern_proc, "Process table");
1296 
1297 SYSCTL_NODE(_kern_proc, (KERN_PROC_UID | KERN_PROC_FLAG_LWP), uid_lwp, CTLFLAG_RD,
1298 	sysctl_kern_proc, "Process table");
1299 
1300 SYSCTL_NODE(_kern_proc, (KERN_PROC_RUID | KERN_PROC_FLAG_LWP), ruid_lwp, CTLFLAG_RD,
1301 	sysctl_kern_proc, "Process table");
1302 
1303 SYSCTL_NODE(_kern_proc, (KERN_PROC_PID | KERN_PROC_FLAG_LWP), pid_lwp, CTLFLAG_RD,
1304 	sysctl_kern_proc, "Process table");
1305 
1306 SYSCTL_NODE(_kern_proc, KERN_PROC_ARGS, args, CTLFLAG_RW | CTLFLAG_ANYBODY,
1307 	sysctl_kern_proc_args, "Process argument list");
1308 
1309 SYSCTL_NODE(_kern_proc, KERN_PROC_CWD, cwd, CTLFLAG_RD | CTLFLAG_ANYBODY,
1310 	sysctl_kern_proc_cwd, "Process argument list");
1311