xref: /netbsd-src/sys/kern/kern_resource.c (revision 7c3f385475147b6e1c4753f2bee961630e2dfc40)
1 /*	$NetBSD: kern_resource.c,v 1.137 2008/03/27 19:06:52 ad Exp $	*/
2 
3 /*-
4  * Copyright (c) 1982, 1986, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * (c) UNIX System Laboratories, Inc.
7  * All or some portions of this file are derived from material licensed
8  * to the University of California by American Telephone and Telegraph
9  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10  * the permission of UNIX System Laboratories, Inc.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  *	@(#)kern_resource.c	8.8 (Berkeley) 2/14/95
37  */
38 
39 #include <sys/cdefs.h>
40 __KERNEL_RCSID(0, "$NetBSD: kern_resource.c,v 1.137 2008/03/27 19:06:52 ad Exp $");
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/kernel.h>
45 #include <sys/file.h>
46 #include <sys/resourcevar.h>
47 #include <sys/malloc.h>
48 #include <sys/kmem.h>
49 #include <sys/namei.h>
50 #include <sys/pool.h>
51 #include <sys/proc.h>
52 #include <sys/sysctl.h>
53 #include <sys/timevar.h>
54 #include <sys/kauth.h>
55 #include <sys/atomic.h>
56 #include <sys/mount.h>
57 #include <sys/syscallargs.h>
58 #include <sys/atomic.h>
59 
60 #include <uvm/uvm_extern.h>
61 
62 /*
63  * Maximum process data and stack limits.
64  * They are variables so they are patchable.
65  */
66 rlim_t maxdmap = MAXDSIZ;
67 rlim_t maxsmap = MAXSSIZ;
68 
69 static SLIST_HEAD(uihashhead, uidinfo) *uihashtbl;
70 static u_long 		uihash;
71 
72 #define	UIHASH(uid)	(&uihashtbl[(uid) & uihash])
73 
74 static pool_cache_t	plimit_cache;
75 static pool_cache_t	pstats_cache;
76 
77 void
78 resource_init(void)
79 {
80 	/*
81 	 * In case of MP system, SLIST_FOREACH would force a cache line
82 	 * write-back for every modified 'uidinfo', thus we try to keep the
83 	 * lists short.
84 	 */
85 	const u_int uihash_sz = (maxproc > 1 ? 1024 : 64);
86 
87 	plimit_cache = pool_cache_init(sizeof(struct plimit), 0, 0, 0,
88 	    "plimitpl", NULL, IPL_NONE, NULL, NULL, NULL);
89 	pstats_cache = pool_cache_init(sizeof(struct pstats), 0, 0, 0,
90 	    "pstatspl", NULL, IPL_NONE, NULL, NULL, NULL);
91 	uihashtbl = hashinit(uihash_sz, HASH_SLIST, M_PROC, M_WAITOK, &uihash);
92 }
93 
94 /*
95  * Resource controls and accounting.
96  */
97 
98 int
99 sys_getpriority(struct lwp *l, const struct sys_getpriority_args *uap,
100     register_t *retval)
101 {
102 	/* {
103 		syscallarg(int) which;
104 		syscallarg(id_t) who;
105 	} */
106 	struct proc *curp = l->l_proc, *p;
107 	int low = NZERO + PRIO_MAX + 1;
108 	int who = SCARG(uap, who);
109 
110 	mutex_enter(&proclist_lock);
111 	switch (SCARG(uap, which)) {
112 	case PRIO_PROCESS:
113 		if (who == 0)
114 			p = curp;
115 		else
116 			p = p_find(who, PFIND_LOCKED);
117 		if (p != NULL)
118 			low = p->p_nice;
119 		break;
120 
121 	case PRIO_PGRP: {
122 		struct pgrp *pg;
123 
124 		if (who == 0)
125 			pg = curp->p_pgrp;
126 		else if ((pg = pg_find(who, PFIND_LOCKED)) == NULL)
127 			break;
128 		LIST_FOREACH(p, &pg->pg_members, p_pglist) {
129 			if (p->p_nice < low)
130 				low = p->p_nice;
131 		}
132 		break;
133 	}
134 
135 	case PRIO_USER:
136 		if (who == 0)
137 			who = (int)kauth_cred_geteuid(l->l_cred);
138 		PROCLIST_FOREACH(p, &allproc) {
139 			mutex_enter(&p->p_mutex);
140 			if (kauth_cred_geteuid(p->p_cred) ==
141 			    (uid_t)who && p->p_nice < low)
142 				low = p->p_nice;
143 			mutex_exit(&p->p_mutex);
144 		}
145 		break;
146 
147 	default:
148 		mutex_exit(&proclist_lock);
149 		return (EINVAL);
150 	}
151 	mutex_exit(&proclist_lock);
152 
153 	if (low == NZERO + PRIO_MAX + 1)
154 		return (ESRCH);
155 	*retval = low - NZERO;
156 	return (0);
157 }
158 
159 /* ARGSUSED */
160 int
161 sys_setpriority(struct lwp *l, const struct sys_setpriority_args *uap,
162     register_t *retval)
163 {
164 	/* {
165 		syscallarg(int) which;
166 		syscallarg(id_t) who;
167 		syscallarg(int) prio;
168 	} */
169 	struct proc *curp = l->l_proc, *p;
170 	int found = 0, error = 0;
171 	int who = SCARG(uap, who);
172 
173 	mutex_enter(&proclist_lock);
174 	switch (SCARG(uap, which)) {
175 	case PRIO_PROCESS:
176 		if (who == 0)
177 			p = curp;
178 		else
179 			p = p_find(who, PFIND_LOCKED);
180 		if (p != 0) {
181 			mutex_enter(&p->p_mutex);
182 			error = donice(l, p, SCARG(uap, prio));
183 			mutex_exit(&p->p_mutex);
184 		}
185 		found++;
186 		break;
187 
188 	case PRIO_PGRP: {
189 		struct pgrp *pg;
190 
191 		if (who == 0)
192 			pg = curp->p_pgrp;
193 		else if ((pg = pg_find(who, PFIND_LOCKED)) == NULL)
194 			break;
195 		LIST_FOREACH(p, &pg->pg_members, p_pglist) {
196 			mutex_enter(&p->p_mutex);
197 			error = donice(l, p, SCARG(uap, prio));
198 			mutex_exit(&p->p_mutex);
199 			found++;
200 		}
201 		break;
202 	}
203 
204 	case PRIO_USER:
205 		if (who == 0)
206 			who = (int)kauth_cred_geteuid(l->l_cred);
207 		PROCLIST_FOREACH(p, &allproc) {
208 			mutex_enter(&p->p_mutex);
209 			if (kauth_cred_geteuid(p->p_cred) ==
210 			    (uid_t)SCARG(uap, who)) {
211 				error = donice(l, p, SCARG(uap, prio));
212 				found++;
213 			}
214 			mutex_exit(&p->p_mutex);
215 		}
216 		break;
217 
218 	default:
219 		error = EINVAL;
220 		break;
221 	}
222 	mutex_exit(&proclist_lock);
223 	if (found == 0)
224 		return (ESRCH);
225 	return (error);
226 }
227 
228 /*
229  * Renice a process.
230  *
231  * Call with the target process' credentials locked.
232  */
233 int
234 donice(struct lwp *l, struct proc *chgp, int n)
235 {
236 	kauth_cred_t cred = l->l_cred;
237 	int onice;
238 
239 	KASSERT(mutex_owned(&chgp->p_mutex));
240 
241 	if (n > PRIO_MAX)
242 		n = PRIO_MAX;
243 	if (n < PRIO_MIN)
244 		n = PRIO_MIN;
245 	n += NZERO;
246 	onice = chgp->p_nice;
247 	onice = chgp->p_nice;
248 
249   again:
250 	if (kauth_authorize_process(cred, KAUTH_PROCESS_NICE, chgp,
251 	    KAUTH_ARG(n), NULL, NULL))
252 		return (EACCES);
253 	mutex_spin_enter(&chgp->p_smutex);
254 	if (onice != chgp->p_nice) {
255 		mutex_spin_exit(&chgp->p_smutex);
256 		goto again;
257 	}
258 	sched_nice(chgp, n);
259 	mutex_spin_exit(&chgp->p_smutex);
260 	return (0);
261 }
262 
263 /* ARGSUSED */
264 int
265 sys_setrlimit(struct lwp *l, const struct sys_setrlimit_args *uap,
266     register_t *retval)
267 {
268 	/* {
269 		syscallarg(int) which;
270 		syscallarg(const struct rlimit *) rlp;
271 	} */
272 	int which = SCARG(uap, which);
273 	struct rlimit alim;
274 	int error;
275 
276 	error = copyin(SCARG(uap, rlp), &alim, sizeof(struct rlimit));
277 	if (error)
278 		return (error);
279 	return (dosetrlimit(l, l->l_proc, which, &alim));
280 }
281 
282 int
283 dosetrlimit(struct lwp *l, struct proc *p, int which, struct rlimit *limp)
284 {
285 	struct rlimit *alimp;
286 	int error;
287 
288 	if ((u_int)which >= RLIM_NLIMITS)
289 		return (EINVAL);
290 
291 	if (limp->rlim_cur < 0 || limp->rlim_max < 0)
292 		return (EINVAL);
293 
294 	if (limp->rlim_cur > limp->rlim_max) {
295 		/*
296 		 * This is programming error. According to SUSv2, we should
297 		 * return error in this case.
298 		 */
299 		return (EINVAL);
300 	}
301 
302 	alimp = &p->p_rlimit[which];
303 	/* if we don't change the value, no need to limcopy() */
304 	if (limp->rlim_cur == alimp->rlim_cur &&
305 	    limp->rlim_max == alimp->rlim_max)
306 		return 0;
307 
308 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_RLIMIT,
309 	    p, KAUTH_ARG(KAUTH_REQ_PROCESS_RLIMIT_SET), limp, KAUTH_ARG(which));
310 	if (error)
311 		return (error);
312 
313 	lim_privatise(p, false);
314 	/* p->p_limit is now unchangeable */
315 	alimp = &p->p_rlimit[which];
316 
317 	switch (which) {
318 
319 	case RLIMIT_DATA:
320 		if (limp->rlim_cur > maxdmap)
321 			limp->rlim_cur = maxdmap;
322 		if (limp->rlim_max > maxdmap)
323 			limp->rlim_max = maxdmap;
324 		break;
325 
326 	case RLIMIT_STACK:
327 		if (limp->rlim_cur > maxsmap)
328 			limp->rlim_cur = maxsmap;
329 		if (limp->rlim_max > maxsmap)
330 			limp->rlim_max = maxsmap;
331 
332 		/*
333 		 * Return EINVAL if the new stack size limit is lower than
334 		 * current usage. Otherwise, the process would get SIGSEGV the
335 		 * moment it would try to access anything on it's current stack.
336 		 * This conforms to SUSv2.
337 		 */
338 		if (limp->rlim_cur < p->p_vmspace->vm_ssize * PAGE_SIZE
339 		    || limp->rlim_max < p->p_vmspace->vm_ssize * PAGE_SIZE) {
340 			return (EINVAL);
341 		}
342 
343 		/*
344 		 * Stack is allocated to the max at exec time with
345 		 * only "rlim_cur" bytes accessible (In other words,
346 		 * allocates stack dividing two contiguous regions at
347 		 * "rlim_cur" bytes boundary).
348 		 *
349 		 * Since allocation is done in terms of page, roundup
350 		 * "rlim_cur" (otherwise, contiguous regions
351 		 * overlap).  If stack limit is going up make more
352 		 * accessible, if going down make inaccessible.
353 		 */
354 		limp->rlim_cur = round_page(limp->rlim_cur);
355 		if (limp->rlim_cur != alimp->rlim_cur) {
356 			vaddr_t addr;
357 			vsize_t size;
358 			vm_prot_t prot;
359 
360 			if (limp->rlim_cur > alimp->rlim_cur) {
361 				prot = VM_PROT_READ | VM_PROT_WRITE;
362 				size = limp->rlim_cur - alimp->rlim_cur;
363 				addr = (vaddr_t)p->p_vmspace->vm_minsaddr -
364 				    limp->rlim_cur;
365 			} else {
366 				prot = VM_PROT_NONE;
367 				size = alimp->rlim_cur - limp->rlim_cur;
368 				addr = (vaddr_t)p->p_vmspace->vm_minsaddr -
369 				     alimp->rlim_cur;
370 			}
371 			(void) uvm_map_protect(&p->p_vmspace->vm_map,
372 			    addr, addr+size, prot, false);
373 		}
374 		break;
375 
376 	case RLIMIT_NOFILE:
377 		if (limp->rlim_cur > maxfiles)
378 			limp->rlim_cur = maxfiles;
379 		if (limp->rlim_max > maxfiles)
380 			limp->rlim_max = maxfiles;
381 		break;
382 
383 	case RLIMIT_NPROC:
384 		if (limp->rlim_cur > maxproc)
385 			limp->rlim_cur = maxproc;
386 		if (limp->rlim_max > maxproc)
387 			limp->rlim_max = maxproc;
388 		break;
389 	}
390 
391 	mutex_enter(&p->p_limit->pl_lock);
392 	*alimp = *limp;
393 	mutex_exit(&p->p_limit->pl_lock);
394 	return (0);
395 }
396 
397 /* ARGSUSED */
398 int
399 sys_getrlimit(struct lwp *l, const struct sys_getrlimit_args *uap,
400     register_t *retval)
401 {
402 	/* {
403 		syscallarg(int) which;
404 		syscallarg(struct rlimit *) rlp;
405 	} */
406 	struct proc *p = l->l_proc;
407 	int which = SCARG(uap, which);
408 	struct rlimit rl;
409 
410 	if ((u_int)which >= RLIM_NLIMITS)
411 		return (EINVAL);
412 
413 	mutex_enter(&p->p_mutex);
414 	memcpy(&rl, &p->p_rlimit[which], sizeof(rl));
415 	mutex_exit(&p->p_mutex);
416 
417 	return copyout(&rl, SCARG(uap, rlp), sizeof(rl));
418 }
419 
420 /*
421  * Transform the running time and tick information in proc p into user,
422  * system, and interrupt time usage.
423  *
424  * Should be called with p->p_smutex held unless called from exit1().
425  */
426 void
427 calcru(struct proc *p, struct timeval *up, struct timeval *sp,
428     struct timeval *ip, struct timeval *rp)
429 {
430 	uint64_t u, st, ut, it, tot;
431 	struct lwp *l;
432 	struct bintime tm;
433 	struct timeval tv;
434 
435 	mutex_spin_enter(&p->p_stmutex);
436 	st = p->p_sticks;
437 	ut = p->p_uticks;
438 	it = p->p_iticks;
439 	mutex_spin_exit(&p->p_stmutex);
440 
441 	tm = p->p_rtime;
442 
443 	LIST_FOREACH(l, &p->p_lwps, l_sibling) {
444 		lwp_lock(l);
445 		bintime_add(&tm, &l->l_rtime);
446 		if ((l->l_flag & LW_RUNNING) != 0) {
447 			struct bintime diff;
448 			/*
449 			 * Adjust for the current time slice.  This is
450 			 * actually fairly important since the error
451 			 * here is on the order of a time quantum,
452 			 * which is much greater than the sampling
453 			 * error.
454 			 */
455 			binuptime(&diff);
456 			bintime_sub(&diff, &l->l_stime);
457 			bintime_add(&tm, &diff);
458 		}
459 		lwp_unlock(l);
460 	}
461 
462 	tot = st + ut + it;
463 	bintime2timeval(&tm, &tv);
464 	u = (uint64_t)tv.tv_sec * 1000000ul + tv.tv_usec;
465 
466 	if (tot == 0) {
467 		/* No ticks, so can't use to share time out, split 50-50 */
468 		st = ut = u / 2;
469 	} else {
470 		st = (u * st) / tot;
471 		ut = (u * ut) / tot;
472 	}
473 	if (sp != NULL) {
474 		sp->tv_sec = st / 1000000;
475 		sp->tv_usec = st % 1000000;
476 	}
477 	if (up != NULL) {
478 		up->tv_sec = ut / 1000000;
479 		up->tv_usec = ut % 1000000;
480 	}
481 	if (ip != NULL) {
482 		if (it != 0)
483 			it = (u * it) / tot;
484 		ip->tv_sec = it / 1000000;
485 		ip->tv_usec = it % 1000000;
486 	}
487 	if (rp != NULL) {
488 		*rp = tv;
489 	}
490 }
491 
492 /* ARGSUSED */
493 int
494 sys_getrusage(struct lwp *l, const struct sys_getrusage_args *uap,
495     register_t *retval)
496 {
497 	/* {
498 		syscallarg(int) who;
499 		syscallarg(struct rusage *) rusage;
500 	} */
501 	struct rusage ru;
502 	struct proc *p = l->l_proc;
503 
504 	switch (SCARG(uap, who)) {
505 	case RUSAGE_SELF:
506 		mutex_enter(&p->p_smutex);
507 		memcpy(&ru, &p->p_stats->p_ru, sizeof(ru));
508 		calcru(p, &ru.ru_utime, &ru.ru_stime, NULL, NULL);
509 		rulwps(p, &ru);
510 		mutex_exit(&p->p_smutex);
511 		break;
512 
513 	case RUSAGE_CHILDREN:
514 		mutex_enter(&p->p_smutex);
515 		memcpy(&ru, &p->p_stats->p_cru, sizeof(ru));
516 		mutex_exit(&p->p_smutex);
517 		break;
518 
519 	default:
520 		return EINVAL;
521 	}
522 
523 	return copyout(&ru, SCARG(uap, rusage), sizeof(ru));
524 }
525 
526 void
527 ruadd(struct rusage *ru, struct rusage *ru2)
528 {
529 	long *ip, *ip2;
530 	int i;
531 
532 	timeradd(&ru->ru_utime, &ru2->ru_utime, &ru->ru_utime);
533 	timeradd(&ru->ru_stime, &ru2->ru_stime, &ru->ru_stime);
534 	if (ru->ru_maxrss < ru2->ru_maxrss)
535 		ru->ru_maxrss = ru2->ru_maxrss;
536 	ip = &ru->ru_first; ip2 = &ru2->ru_first;
537 	for (i = &ru->ru_last - &ru->ru_first; i >= 0; i--)
538 		*ip++ += *ip2++;
539 }
540 
541 void
542 rulwps(proc_t *p, struct rusage *ru)
543 {
544 	lwp_t *l;
545 
546 	KASSERT(mutex_owned(&p->p_smutex));
547 
548 	LIST_FOREACH(l, &p->p_lwps, l_sibling) {
549 		ruadd(ru, &l->l_ru);
550 		ru->ru_nvcsw += (l->l_ncsw - l->l_nivcsw);
551 		ru->ru_nivcsw += l->l_nivcsw;
552 	}
553 }
554 
555 /*
556  * Make a copy of the plimit structure.
557  * We share these structures copy-on-write after fork,
558  * and copy when a limit is changed.
559  *
560  * Unfortunately (due to PL_SHAREMOD) it is possibly for the structure
561  * we are copying to change beneath our feet!
562  */
563 struct plimit *
564 lim_copy(struct plimit *lim)
565 {
566 	struct plimit *newlim;
567 	char *corename;
568 	size_t alen, len;
569 
570 	newlim = pool_cache_get(plimit_cache, PR_WAITOK);
571 	mutex_init(&newlim->pl_lock, MUTEX_DEFAULT, IPL_NONE);
572 	newlim->pl_flags = 0;
573 	newlim->pl_refcnt = 1;
574 	newlim->pl_sv_limit = NULL;
575 
576 	mutex_enter(&lim->pl_lock);
577 	memcpy(newlim->pl_rlimit, lim->pl_rlimit,
578 	    sizeof(struct rlimit) * RLIM_NLIMITS);
579 
580 	alen = 0;
581 	corename = NULL;
582 	for (;;) {
583 		if (lim->pl_corename == defcorename) {
584 			newlim->pl_corename = defcorename;
585 			break;
586 		}
587 		len = strlen(lim->pl_corename) + 1;
588 		if (len <= alen) {
589 			newlim->pl_corename = corename;
590 			memcpy(corename, lim->pl_corename, len);
591 			corename = NULL;
592 			break;
593 		}
594 		mutex_exit(&lim->pl_lock);
595 		if (corename != NULL)
596 			free(corename, M_TEMP);
597 		alen = len;
598 		corename = malloc(alen, M_TEMP, M_WAITOK);
599 		mutex_enter(&lim->pl_lock);
600 	}
601 	mutex_exit(&lim->pl_lock);
602 	if (corename != NULL)
603 		free(corename, M_TEMP);
604 	return newlim;
605 }
606 
607 void
608 lim_addref(struct plimit *lim)
609 {
610 	atomic_inc_uint(&lim->pl_refcnt);
611 }
612 
613 /*
614  * Give a process it's own private plimit structure.
615  * This will only be shared (in fork) if modifications are to be shared.
616  */
617 void
618 lim_privatise(struct proc *p, bool set_shared)
619 {
620 	struct plimit *lim, *newlim;
621 
622 	lim = p->p_limit;
623 	if (lim->pl_flags & PL_WRITEABLE) {
624 		if (set_shared)
625 			lim->pl_flags |= PL_SHAREMOD;
626 		return;
627 	}
628 
629 	if (set_shared && lim->pl_flags & PL_SHAREMOD)
630 		return;
631 
632 	newlim = lim_copy(lim);
633 
634 	mutex_enter(&p->p_mutex);
635 	if (p->p_limit->pl_flags & PL_WRITEABLE) {
636 		/* Someone crept in while we were busy */
637 		mutex_exit(&p->p_mutex);
638 		limfree(newlim);
639 		if (set_shared)
640 			p->p_limit->pl_flags |= PL_SHAREMOD;
641 		return;
642 	}
643 
644 	/*
645 	 * Since most accesses to p->p_limit aren't locked, we must not
646 	 * delete the old limit structure yet.
647 	 */
648 	newlim->pl_sv_limit = p->p_limit;
649 	newlim->pl_flags |= PL_WRITEABLE;
650 	if (set_shared)
651 		newlim->pl_flags |= PL_SHAREMOD;
652 	p->p_limit = newlim;
653 	mutex_exit(&p->p_mutex);
654 }
655 
656 void
657 limfree(struct plimit *lim)
658 {
659 	struct plimit *sv_lim;
660 
661 	do {
662 		if (atomic_dec_uint_nv(&lim->pl_refcnt) > 0)
663 			return;
664 		if (lim->pl_corename != defcorename)
665 			free(lim->pl_corename, M_TEMP);
666 		sv_lim = lim->pl_sv_limit;
667 		mutex_destroy(&lim->pl_lock);
668 		pool_cache_put(plimit_cache, lim);
669 	} while ((lim = sv_lim) != NULL);
670 }
671 
672 struct pstats *
673 pstatscopy(struct pstats *ps)
674 {
675 
676 	struct pstats *newps;
677 
678 	newps = pool_cache_get(pstats_cache, PR_WAITOK);
679 
680 	memset(&newps->pstat_startzero, 0,
681 	(unsigned) ((char *)&newps->pstat_endzero -
682 		    (char *)&newps->pstat_startzero));
683 	memcpy(&newps->pstat_startcopy, &ps->pstat_startcopy,
684 	((char *)&newps->pstat_endcopy -
685 	 (char *)&newps->pstat_startcopy));
686 
687 	return (newps);
688 
689 }
690 
691 void
692 pstatsfree(struct pstats *ps)
693 {
694 
695 	pool_cache_put(pstats_cache, ps);
696 }
697 
698 /*
699  * sysctl interface in five parts
700  */
701 
702 /*
703  * a routine for sysctl proc subtree helpers that need to pick a valid
704  * process by pid.
705  */
706 static int
707 sysctl_proc_findproc(struct lwp *l, struct proc **p2, pid_t pid)
708 {
709 	struct proc *ptmp;
710 	int error = 0;
711 
712 	if (pid == PROC_CURPROC)
713 		ptmp = l->l_proc;
714 	else if ((ptmp = pfind(pid)) == NULL)
715 		error = ESRCH;
716 
717 	*p2 = ptmp;
718 	return (error);
719 }
720 
721 /*
722  * sysctl helper routine for setting a process's specific corefile
723  * name.  picks the process based on the given pid and checks the
724  * correctness of the new value.
725  */
726 static int
727 sysctl_proc_corename(SYSCTLFN_ARGS)
728 {
729 	struct proc *ptmp;
730 	struct plimit *lim;
731 	int error = 0, len;
732 	char *cname;
733 	char *ocore;
734 	char *tmp;
735 	struct sysctlnode node;
736 
737 	/*
738 	 * is this all correct?
739 	 */
740 	if (namelen != 0)
741 		return (EINVAL);
742 	if (name[-1] != PROC_PID_CORENAME)
743 		return (EINVAL);
744 
745 	/*
746 	 * whom are we tweaking?
747 	 */
748 	error = sysctl_proc_findproc(l, &ptmp, (pid_t)name[-2]);
749 	if (error)
750 		return (error);
751 
752 	/* XXX-elad */
753 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE, ptmp,
754 	    KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
755 	if (error)
756 		return (error);
757 
758 	if (newp == NULL) {
759 		error = kauth_authorize_process(l->l_cred,
760 		    KAUTH_PROCESS_CORENAME, ptmp,
761 		    KAUTH_ARG(KAUTH_REQ_PROCESS_CORENAME_GET), NULL, NULL);
762 		if (error)
763 			return (error);
764 	}
765 
766 	/*
767 	 * let them modify a temporary copy of the core name
768 	 */
769 	cname = PNBUF_GET();
770 	lim = ptmp->p_limit;
771 	mutex_enter(&lim->pl_lock);
772 	strlcpy(cname, lim->pl_corename, MAXPATHLEN);
773 	mutex_exit(&lim->pl_lock);
774 
775 	node = *rnode;
776 	node.sysctl_data = cname;
777 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
778 
779 	/*
780 	 * if that failed, or they have nothing new to say, or we've
781 	 * heard it before...
782 	 */
783 	if (error || newp == NULL)
784 		goto done;
785 	lim = ptmp->p_limit;
786 	mutex_enter(&lim->pl_lock);
787 	error = strcmp(cname, lim->pl_corename);
788 	mutex_exit(&lim->pl_lock);
789 	if (error == 0)
790 		/* Unchanged */
791 		goto done;
792 
793 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CORENAME,
794 	    ptmp, KAUTH_ARG(KAUTH_REQ_PROCESS_CORENAME_SET), cname, NULL);
795 	if (error)
796 		return (error);
797 
798 	/*
799 	 * no error yet and cname now has the new core name in it.
800 	 * let's see if it looks acceptable.  it must be either "core"
801 	 * or end in ".core" or "/core".
802 	 */
803 	len = strlen(cname);
804 	if (len < 4) {
805 		error = EINVAL;
806 	} else if (strcmp(cname + len - 4, "core") != 0) {
807 		error = EINVAL;
808 	} else if (len > 4 && cname[len - 5] != '/' && cname[len - 5] != '.') {
809 		error = EINVAL;
810 	}
811 	if (error != 0) {
812 		goto done;
813 	}
814 
815 	/*
816 	 * hmm...looks good.  now...where do we put it?
817 	 */
818 	tmp = malloc(len + 1, M_TEMP, M_WAITOK|M_CANFAIL);
819 	if (tmp == NULL) {
820 		error = ENOMEM;
821 		goto done;
822 	}
823 	memcpy(tmp, cname, len + 1);
824 
825 	lim_privatise(ptmp, false);
826 	lim = ptmp->p_limit;
827 	mutex_enter(&lim->pl_lock);
828 	ocore = lim->pl_corename;
829 	lim->pl_corename = tmp;
830 	mutex_exit(&lim->pl_lock);
831 	if (ocore != defcorename)
832 		free(ocore, M_TEMP);
833 
834 done:
835 	PNBUF_PUT(cname);
836 	return error;
837 }
838 
839 /*
840  * sysctl helper routine for checking/setting a process's stop flags,
841  * one for fork and one for exec.
842  */
843 static int
844 sysctl_proc_stop(SYSCTLFN_ARGS)
845 {
846 	struct proc *ptmp;
847 	int i, f, error = 0;
848 	struct sysctlnode node;
849 
850 	if (namelen != 0)
851 		return (EINVAL);
852 
853 	error = sysctl_proc_findproc(l, &ptmp, (pid_t)name[-2]);
854 	if (error)
855 		return (error);
856 
857 	/* XXX-elad */
858 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE, ptmp,
859 	    KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
860 	if (error)
861 		return (error);
862 
863 	switch (rnode->sysctl_num) {
864 	case PROC_PID_STOPFORK:
865 		f = PS_STOPFORK;
866 		break;
867 	case PROC_PID_STOPEXEC:
868 		f = PS_STOPEXEC;
869 		break;
870 	case PROC_PID_STOPEXIT:
871 		f = PS_STOPEXIT;
872 		break;
873 	default:
874 		return (EINVAL);
875 	}
876 
877 	i = (ptmp->p_flag & f) ? 1 : 0;
878 	node = *rnode;
879 	node.sysctl_data = &i;
880 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
881 	if (error || newp == NULL)
882 		return (error);
883 
884 	mutex_enter(&ptmp->p_smutex);
885 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_STOPFLAG,
886 	    ptmp, KAUTH_ARG(f), NULL, NULL);
887 	if (error)
888 		return (error);
889 	if (i)
890 		ptmp->p_sflag |= f;
891 	else
892 		ptmp->p_sflag &= ~f;
893 	mutex_exit(&ptmp->p_smutex);
894 
895 	return (0);
896 }
897 
898 /*
899  * sysctl helper routine for a process's rlimits as exposed by sysctl.
900  */
901 static int
902 sysctl_proc_plimit(SYSCTLFN_ARGS)
903 {
904 	struct proc *ptmp;
905 	u_int limitno;
906 	int which, error = 0;
907         struct rlimit alim;
908 	struct sysctlnode node;
909 
910 	if (namelen != 0)
911 		return (EINVAL);
912 
913 	which = name[-1];
914 	if (which != PROC_PID_LIMIT_TYPE_SOFT &&
915 	    which != PROC_PID_LIMIT_TYPE_HARD)
916 		return (EINVAL);
917 
918 	limitno = name[-2] - 1;
919 	if (limitno >= RLIM_NLIMITS)
920 		return (EINVAL);
921 
922 	if (name[-3] != PROC_PID_LIMIT)
923 		return (EINVAL);
924 
925 	error = sysctl_proc_findproc(l, &ptmp, (pid_t)name[-4]);
926 	if (error)
927 		return (error);
928 
929 	/* XXX-elad */
930 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE, ptmp,
931 	    KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
932 	if (error)
933 		return (error);
934 
935 	/* Check if we can view limits. */
936 	if (newp == NULL) {
937 		error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_RLIMIT,
938 		    ptmp, KAUTH_ARG(KAUTH_REQ_PROCESS_RLIMIT_GET), &alim,
939 		    KAUTH_ARG(which));
940 		if (error)
941 			return (error);
942 	}
943 
944 	node = *rnode;
945 	memcpy(&alim, &ptmp->p_rlimit[limitno], sizeof(alim));
946 	if (which == PROC_PID_LIMIT_TYPE_HARD)
947 		node.sysctl_data = &alim.rlim_max;
948 	else
949 		node.sysctl_data = &alim.rlim_cur;
950 
951 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
952 	if (error || newp == NULL)
953 		return (error);
954 
955 	return (dosetrlimit(l, ptmp, limitno, &alim));
956 }
957 
958 /*
959  * and finally, the actually glue that sticks it to the tree
960  */
961 SYSCTL_SETUP(sysctl_proc_setup, "sysctl proc subtree setup")
962 {
963 
964 	sysctl_createv(clog, 0, NULL, NULL,
965 		       CTLFLAG_PERMANENT,
966 		       CTLTYPE_NODE, "proc", NULL,
967 		       NULL, 0, NULL, 0,
968 		       CTL_PROC, CTL_EOL);
969 	sysctl_createv(clog, 0, NULL, NULL,
970 		       CTLFLAG_PERMANENT|CTLFLAG_ANYNUMBER,
971 		       CTLTYPE_NODE, "curproc",
972 		       SYSCTL_DESCR("Per-process settings"),
973 		       NULL, 0, NULL, 0,
974 		       CTL_PROC, PROC_CURPROC, CTL_EOL);
975 
976 	sysctl_createv(clog, 0, NULL, NULL,
977 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
978 		       CTLTYPE_STRING, "corename",
979 		       SYSCTL_DESCR("Core file name"),
980 		       sysctl_proc_corename, 0, NULL, MAXPATHLEN,
981 		       CTL_PROC, PROC_CURPROC, PROC_PID_CORENAME, CTL_EOL);
982 	sysctl_createv(clog, 0, NULL, NULL,
983 		       CTLFLAG_PERMANENT,
984 		       CTLTYPE_NODE, "rlimit",
985 		       SYSCTL_DESCR("Process limits"),
986 		       NULL, 0, NULL, 0,
987 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, CTL_EOL);
988 
989 #define create_proc_plimit(s, n) do {					\
990 	sysctl_createv(clog, 0, NULL, NULL,				\
991 		       CTLFLAG_PERMANENT,				\
992 		       CTLTYPE_NODE, s,					\
993 		       SYSCTL_DESCR("Process " s " limits"),		\
994 		       NULL, 0, NULL, 0,				\
995 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, n,	\
996 		       CTL_EOL);					\
997 	sysctl_createv(clog, 0, NULL, NULL,				\
998 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE, \
999 		       CTLTYPE_QUAD, "soft",				\
1000 		       SYSCTL_DESCR("Process soft " s " limit"),	\
1001 		       sysctl_proc_plimit, 0, NULL, 0,			\
1002 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, n,	\
1003 		       PROC_PID_LIMIT_TYPE_SOFT, CTL_EOL);		\
1004 	sysctl_createv(clog, 0, NULL, NULL,				\
1005 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE, \
1006 		       CTLTYPE_QUAD, "hard",				\
1007 		       SYSCTL_DESCR("Process hard " s " limit"),	\
1008 		       sysctl_proc_plimit, 0, NULL, 0,			\
1009 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, n,	\
1010 		       PROC_PID_LIMIT_TYPE_HARD, CTL_EOL);		\
1011 	} while (0/*CONSTCOND*/)
1012 
1013 	create_proc_plimit("cputime",		PROC_PID_LIMIT_CPU);
1014 	create_proc_plimit("filesize",		PROC_PID_LIMIT_FSIZE);
1015 	create_proc_plimit("datasize",		PROC_PID_LIMIT_DATA);
1016 	create_proc_plimit("stacksize",		PROC_PID_LIMIT_STACK);
1017 	create_proc_plimit("coredumpsize",	PROC_PID_LIMIT_CORE);
1018 	create_proc_plimit("memoryuse",		PROC_PID_LIMIT_RSS);
1019 	create_proc_plimit("memorylocked",	PROC_PID_LIMIT_MEMLOCK);
1020 	create_proc_plimit("maxproc",		PROC_PID_LIMIT_NPROC);
1021 	create_proc_plimit("descriptors",	PROC_PID_LIMIT_NOFILE);
1022 	create_proc_plimit("sbsize",		PROC_PID_LIMIT_SBSIZE);
1023 
1024 #undef create_proc_plimit
1025 
1026 	sysctl_createv(clog, 0, NULL, NULL,
1027 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1028 		       CTLTYPE_INT, "stopfork",
1029 		       SYSCTL_DESCR("Stop process at fork(2)"),
1030 		       sysctl_proc_stop, 0, NULL, 0,
1031 		       CTL_PROC, PROC_CURPROC, PROC_PID_STOPFORK, CTL_EOL);
1032 	sysctl_createv(clog, 0, NULL, NULL,
1033 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1034 		       CTLTYPE_INT, "stopexec",
1035 		       SYSCTL_DESCR("Stop process at execve(2)"),
1036 		       sysctl_proc_stop, 0, NULL, 0,
1037 		       CTL_PROC, PROC_CURPROC, PROC_PID_STOPEXEC, CTL_EOL);
1038 	sysctl_createv(clog, 0, NULL, NULL,
1039 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1040 		       CTLTYPE_INT, "stopexit",
1041 		       SYSCTL_DESCR("Stop process before completing exit"),
1042 		       sysctl_proc_stop, 0, NULL, 0,
1043 		       CTL_PROC, PROC_CURPROC, PROC_PID_STOPEXIT, CTL_EOL);
1044 }
1045 
1046 void
1047 uid_init(void)
1048 {
1049 
1050 	/*
1051 	 * Ensure that uid 0 is always in the user hash table, as
1052 	 * sbreserve() expects it available from interrupt context.
1053 	 */
1054 	(void)uid_find(0);
1055 }
1056 
1057 struct uidinfo *
1058 uid_find(uid_t uid)
1059 {
1060 	struct uidinfo *uip, *uip_first, *newuip;
1061 	struct uihashhead *uipp;
1062 
1063 	uipp = UIHASH(uid);
1064 	newuip = NULL;
1065 
1066 	/*
1067 	 * To make insertion atomic, abstraction of SLIST will be violated.
1068 	 */
1069 	uip_first = uipp->slh_first;
1070  again:
1071 	SLIST_FOREACH(uip, uipp, ui_hash) {
1072 		if (uip->ui_uid != uid)
1073 			continue;
1074 		if (newuip != NULL)
1075 			kmem_free(newuip, sizeof(*newuip));
1076 		return uip;
1077 	}
1078 	if (newuip == NULL)
1079 		newuip = kmem_zalloc(sizeof(*newuip), KM_SLEEP);
1080 	newuip->ui_uid = uid;
1081 
1082 	/*
1083 	 * If atomic insert is unsuccessful, another thread might be
1084 	 * allocated this 'uid', thus full re-check is needed.
1085 	 */
1086 	newuip->ui_hash.sle_next = uip_first;
1087 	membar_producer();
1088 	uip = atomic_cas_ptr(&uipp->slh_first, uip_first, newuip);
1089 	if (uip != uip_first) {
1090 		uip_first = uip;
1091 		goto again;
1092 	}
1093 
1094 	return newuip;
1095 }
1096 
1097 /*
1098  * Change the count associated with number of processes
1099  * a given user is using.
1100  */
1101 int
1102 chgproccnt(uid_t uid, int diff)
1103 {
1104 	struct uidinfo *uip;
1105 	long proccnt;
1106 
1107 	uip = uid_find(uid);
1108 	proccnt = atomic_add_long_nv(&uip->ui_proccnt, diff);
1109 	KASSERT(proccnt >= 0);
1110 	return proccnt;
1111 }
1112 
1113 int
1114 chgsbsize(struct uidinfo *uip, u_long *hiwat, u_long to, rlim_t xmax)
1115 {
1116 	rlim_t nsb;
1117 	const long diff = to - *hiwat;
1118 
1119 	nsb = atomic_add_long_nv((long *)&uip->ui_sbsize, diff);
1120 	if (diff > 0 && nsb > xmax) {
1121 		atomic_add_long((long *)&uip->ui_sbsize, -diff);
1122 		return 0;
1123 	}
1124 	*hiwat = to;
1125 	KASSERT(nsb >= 0);
1126 	return 1;
1127 }
1128