xref: /netbsd-src/sys/kern/kern_resource.c (revision fff57c5525bbe431aee7bdb3983954f0627a42cb)
1 /*	$NetBSD: kern_resource.c,v 1.142 2008/05/31 21:26:01 ad Exp $	*/
2 
3 /*-
4  * Copyright (c) 1982, 1986, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * (c) UNIX System Laboratories, Inc.
7  * All or some portions of this file are derived from material licensed
8  * to the University of California by American Telephone and Telegraph
9  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10  * the permission of UNIX System Laboratories, Inc.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  *	@(#)kern_resource.c	8.8 (Berkeley) 2/14/95
37  */
38 
39 #include <sys/cdefs.h>
40 __KERNEL_RCSID(0, "$NetBSD: kern_resource.c,v 1.142 2008/05/31 21:26:01 ad Exp $");
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/kernel.h>
45 #include <sys/file.h>
46 #include <sys/resourcevar.h>
47 #include <sys/malloc.h>
48 #include <sys/kmem.h>
49 #include <sys/namei.h>
50 #include <sys/pool.h>
51 #include <sys/proc.h>
52 #include <sys/sysctl.h>
53 #include <sys/timevar.h>
54 #include <sys/kauth.h>
55 #include <sys/atomic.h>
56 #include <sys/mount.h>
57 #include <sys/syscallargs.h>
58 #include <sys/atomic.h>
59 
60 #include <uvm/uvm_extern.h>
61 
62 /*
63  * Maximum process data and stack limits.
64  * They are variables so they are patchable.
65  */
66 rlim_t maxdmap = MAXDSIZ;
67 rlim_t maxsmap = MAXSSIZ;
68 
69 static SLIST_HEAD(uihashhead, uidinfo) *uihashtbl;
70 static u_long 		uihash;
71 
72 #define	UIHASH(uid)	(&uihashtbl[(uid) & uihash])
73 
74 static pool_cache_t	plimit_cache;
75 static pool_cache_t	pstats_cache;
76 
77 void
78 resource_init(void)
79 {
80 	/*
81 	 * In case of MP system, SLIST_FOREACH would force a cache line
82 	 * write-back for every modified 'uidinfo', thus we try to keep the
83 	 * lists short.
84 	 */
85 	const u_int uihash_sz = (maxproc > 1 ? 1024 : 64);
86 
87 	plimit_cache = pool_cache_init(sizeof(struct plimit), 0, 0, 0,
88 	    "plimitpl", NULL, IPL_NONE, NULL, NULL, NULL);
89 	pstats_cache = pool_cache_init(sizeof(struct pstats), 0, 0, 0,
90 	    "pstatspl", NULL, IPL_NONE, NULL, NULL, NULL);
91 	uihashtbl = hashinit(uihash_sz, HASH_SLIST, true, &uihash);
92 }
93 
94 /*
95  * Resource controls and accounting.
96  */
97 
98 int
99 sys_getpriority(struct lwp *l, const struct sys_getpriority_args *uap,
100     register_t *retval)
101 {
102 	/* {
103 		syscallarg(int) which;
104 		syscallarg(id_t) who;
105 	} */
106 	struct proc *curp = l->l_proc, *p;
107 	int low = NZERO + PRIO_MAX + 1;
108 	int who = SCARG(uap, who);
109 
110 	mutex_enter(proc_lock);
111 	switch (SCARG(uap, which)) {
112 	case PRIO_PROCESS:
113 		if (who == 0)
114 			p = curp;
115 		else
116 			p = p_find(who, PFIND_LOCKED);
117 		if (p != NULL)
118 			low = p->p_nice;
119 		break;
120 
121 	case PRIO_PGRP: {
122 		struct pgrp *pg;
123 
124 		if (who == 0)
125 			pg = curp->p_pgrp;
126 		else if ((pg = pg_find(who, PFIND_LOCKED)) == NULL)
127 			break;
128 		LIST_FOREACH(p, &pg->pg_members, p_pglist) {
129 			if (p->p_nice < low)
130 				low = p->p_nice;
131 		}
132 		break;
133 	}
134 
135 	case PRIO_USER:
136 		if (who == 0)
137 			who = (int)kauth_cred_geteuid(l->l_cred);
138 		PROCLIST_FOREACH(p, &allproc) {
139 			if ((p->p_flag & PK_MARKER) != 0)
140 				continue;
141 			mutex_enter(p->p_lock);
142 			if (kauth_cred_geteuid(p->p_cred) ==
143 			    (uid_t)who && p->p_nice < low)
144 				low = p->p_nice;
145 			mutex_exit(p->p_lock);
146 		}
147 		break;
148 
149 	default:
150 		mutex_exit(proc_lock);
151 		return (EINVAL);
152 	}
153 	mutex_exit(proc_lock);
154 
155 	if (low == NZERO + PRIO_MAX + 1)
156 		return (ESRCH);
157 	*retval = low - NZERO;
158 	return (0);
159 }
160 
161 /* ARGSUSED */
162 int
163 sys_setpriority(struct lwp *l, const struct sys_setpriority_args *uap,
164     register_t *retval)
165 {
166 	/* {
167 		syscallarg(int) which;
168 		syscallarg(id_t) who;
169 		syscallarg(int) prio;
170 	} */
171 	struct proc *curp = l->l_proc, *p;
172 	int found = 0, error = 0;
173 	int who = SCARG(uap, who);
174 
175 	mutex_enter(proc_lock);
176 	switch (SCARG(uap, which)) {
177 	case PRIO_PROCESS:
178 		if (who == 0)
179 			p = curp;
180 		else
181 			p = p_find(who, PFIND_LOCKED);
182 		if (p != 0) {
183 			mutex_enter(p->p_lock);
184 			error = donice(l, p, SCARG(uap, prio));
185 			mutex_exit(p->p_lock);
186 		}
187 		found++;
188 		break;
189 
190 	case PRIO_PGRP: {
191 		struct pgrp *pg;
192 
193 		if (who == 0)
194 			pg = curp->p_pgrp;
195 		else if ((pg = pg_find(who, PFIND_LOCKED)) == NULL)
196 			break;
197 		LIST_FOREACH(p, &pg->pg_members, p_pglist) {
198 			mutex_enter(p->p_lock);
199 			error = donice(l, p, SCARG(uap, prio));
200 			mutex_exit(p->p_lock);
201 			found++;
202 		}
203 		break;
204 	}
205 
206 	case PRIO_USER:
207 		if (who == 0)
208 			who = (int)kauth_cred_geteuid(l->l_cred);
209 		PROCLIST_FOREACH(p, &allproc) {
210 			if ((p->p_flag & PK_MARKER) != 0)
211 				continue;
212 			mutex_enter(p->p_lock);
213 			if (kauth_cred_geteuid(p->p_cred) ==
214 			    (uid_t)SCARG(uap, who)) {
215 				error = donice(l, p, SCARG(uap, prio));
216 				found++;
217 			}
218 			mutex_exit(p->p_lock);
219 		}
220 		break;
221 
222 	default:
223 		error = EINVAL;
224 		break;
225 	}
226 	mutex_exit(proc_lock);
227 	if (found == 0)
228 		return (ESRCH);
229 	return (error);
230 }
231 
232 /*
233  * Renice a process.
234  *
235  * Call with the target process' credentials locked.
236  */
237 int
238 donice(struct lwp *l, struct proc *chgp, int n)
239 {
240 	kauth_cred_t cred = l->l_cred;
241 
242 	KASSERT(mutex_owned(chgp->p_lock));
243 
244 	if (n > PRIO_MAX)
245 		n = PRIO_MAX;
246 	if (n < PRIO_MIN)
247 		n = PRIO_MIN;
248 	n += NZERO;
249 	if (kauth_authorize_process(cred, KAUTH_PROCESS_NICE, chgp,
250 	    KAUTH_ARG(n), NULL, NULL))
251 		return (EACCES);
252 	sched_nice(chgp, n);
253 	return (0);
254 }
255 
256 /* ARGSUSED */
257 int
258 sys_setrlimit(struct lwp *l, const struct sys_setrlimit_args *uap,
259     register_t *retval)
260 {
261 	/* {
262 		syscallarg(int) which;
263 		syscallarg(const struct rlimit *) rlp;
264 	} */
265 	int which = SCARG(uap, which);
266 	struct rlimit alim;
267 	int error;
268 
269 	error = copyin(SCARG(uap, rlp), &alim, sizeof(struct rlimit));
270 	if (error)
271 		return (error);
272 	return (dosetrlimit(l, l->l_proc, which, &alim));
273 }
274 
275 int
276 dosetrlimit(struct lwp *l, struct proc *p, int which, struct rlimit *limp)
277 {
278 	struct rlimit *alimp;
279 	int error;
280 
281 	if ((u_int)which >= RLIM_NLIMITS)
282 		return (EINVAL);
283 
284 	if (limp->rlim_cur < 0 || limp->rlim_max < 0)
285 		return (EINVAL);
286 
287 	if (limp->rlim_cur > limp->rlim_max) {
288 		/*
289 		 * This is programming error. According to SUSv2, we should
290 		 * return error in this case.
291 		 */
292 		return (EINVAL);
293 	}
294 
295 	alimp = &p->p_rlimit[which];
296 	/* if we don't change the value, no need to limcopy() */
297 	if (limp->rlim_cur == alimp->rlim_cur &&
298 	    limp->rlim_max == alimp->rlim_max)
299 		return 0;
300 
301 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_RLIMIT,
302 	    p, KAUTH_ARG(KAUTH_REQ_PROCESS_RLIMIT_SET), limp, KAUTH_ARG(which));
303 	if (error)
304 		return (error);
305 
306 	lim_privatise(p, false);
307 	/* p->p_limit is now unchangeable */
308 	alimp = &p->p_rlimit[which];
309 
310 	switch (which) {
311 
312 	case RLIMIT_DATA:
313 		if (limp->rlim_cur > maxdmap)
314 			limp->rlim_cur = maxdmap;
315 		if (limp->rlim_max > maxdmap)
316 			limp->rlim_max = maxdmap;
317 		break;
318 
319 	case RLIMIT_STACK:
320 		if (limp->rlim_cur > maxsmap)
321 			limp->rlim_cur = maxsmap;
322 		if (limp->rlim_max > maxsmap)
323 			limp->rlim_max = maxsmap;
324 
325 		/*
326 		 * Return EINVAL if the new stack size limit is lower than
327 		 * current usage. Otherwise, the process would get SIGSEGV the
328 		 * moment it would try to access anything on it's current stack.
329 		 * This conforms to SUSv2.
330 		 */
331 		if (limp->rlim_cur < p->p_vmspace->vm_ssize * PAGE_SIZE
332 		    || limp->rlim_max < p->p_vmspace->vm_ssize * PAGE_SIZE) {
333 			return (EINVAL);
334 		}
335 
336 		/*
337 		 * Stack is allocated to the max at exec time with
338 		 * only "rlim_cur" bytes accessible (In other words,
339 		 * allocates stack dividing two contiguous regions at
340 		 * "rlim_cur" bytes boundary).
341 		 *
342 		 * Since allocation is done in terms of page, roundup
343 		 * "rlim_cur" (otherwise, contiguous regions
344 		 * overlap).  If stack limit is going up make more
345 		 * accessible, if going down make inaccessible.
346 		 */
347 		limp->rlim_cur = round_page(limp->rlim_cur);
348 		if (limp->rlim_cur != alimp->rlim_cur) {
349 			vaddr_t addr;
350 			vsize_t size;
351 			vm_prot_t prot;
352 
353 			if (limp->rlim_cur > alimp->rlim_cur) {
354 				prot = VM_PROT_READ | VM_PROT_WRITE;
355 				size = limp->rlim_cur - alimp->rlim_cur;
356 				addr = (vaddr_t)p->p_vmspace->vm_minsaddr -
357 				    limp->rlim_cur;
358 			} else {
359 				prot = VM_PROT_NONE;
360 				size = alimp->rlim_cur - limp->rlim_cur;
361 				addr = (vaddr_t)p->p_vmspace->vm_minsaddr -
362 				     alimp->rlim_cur;
363 			}
364 			(void) uvm_map_protect(&p->p_vmspace->vm_map,
365 			    addr, addr+size, prot, false);
366 		}
367 		break;
368 
369 	case RLIMIT_NOFILE:
370 		if (limp->rlim_cur > maxfiles)
371 			limp->rlim_cur = maxfiles;
372 		if (limp->rlim_max > maxfiles)
373 			limp->rlim_max = maxfiles;
374 		break;
375 
376 	case RLIMIT_NPROC:
377 		if (limp->rlim_cur > maxproc)
378 			limp->rlim_cur = maxproc;
379 		if (limp->rlim_max > maxproc)
380 			limp->rlim_max = maxproc;
381 		break;
382 	}
383 
384 	mutex_enter(&p->p_limit->pl_lock);
385 	*alimp = *limp;
386 	mutex_exit(&p->p_limit->pl_lock);
387 	return (0);
388 }
389 
390 /* ARGSUSED */
391 int
392 sys_getrlimit(struct lwp *l, const struct sys_getrlimit_args *uap,
393     register_t *retval)
394 {
395 	/* {
396 		syscallarg(int) which;
397 		syscallarg(struct rlimit *) rlp;
398 	} */
399 	struct proc *p = l->l_proc;
400 	int which = SCARG(uap, which);
401 	struct rlimit rl;
402 
403 	if ((u_int)which >= RLIM_NLIMITS)
404 		return (EINVAL);
405 
406 	mutex_enter(p->p_lock);
407 	memcpy(&rl, &p->p_rlimit[which], sizeof(rl));
408 	mutex_exit(p->p_lock);
409 
410 	return copyout(&rl, SCARG(uap, rlp), sizeof(rl));
411 }
412 
413 /*
414  * Transform the running time and tick information in proc p into user,
415  * system, and interrupt time usage.
416  *
417  * Should be called with p->p_lock held unless called from exit1().
418  */
419 void
420 calcru(struct proc *p, struct timeval *up, struct timeval *sp,
421     struct timeval *ip, struct timeval *rp)
422 {
423 	uint64_t u, st, ut, it, tot;
424 	struct lwp *l;
425 	struct bintime tm;
426 	struct timeval tv;
427 
428 	mutex_spin_enter(&p->p_stmutex);
429 	st = p->p_sticks;
430 	ut = p->p_uticks;
431 	it = p->p_iticks;
432 	mutex_spin_exit(&p->p_stmutex);
433 
434 	tm = p->p_rtime;
435 
436 	LIST_FOREACH(l, &p->p_lwps, l_sibling) {
437 		lwp_lock(l);
438 		bintime_add(&tm, &l->l_rtime);
439 		if ((l->l_pflag & LP_RUNNING) != 0) {
440 			struct bintime diff;
441 			/*
442 			 * Adjust for the current time slice.  This is
443 			 * actually fairly important since the error
444 			 * here is on the order of a time quantum,
445 			 * which is much greater than the sampling
446 			 * error.
447 			 */
448 			binuptime(&diff);
449 			bintime_sub(&diff, &l->l_stime);
450 			bintime_add(&tm, &diff);
451 		}
452 		lwp_unlock(l);
453 	}
454 
455 	tot = st + ut + it;
456 	bintime2timeval(&tm, &tv);
457 	u = (uint64_t)tv.tv_sec * 1000000ul + tv.tv_usec;
458 
459 	if (tot == 0) {
460 		/* No ticks, so can't use to share time out, split 50-50 */
461 		st = ut = u / 2;
462 	} else {
463 		st = (u * st) / tot;
464 		ut = (u * ut) / tot;
465 	}
466 	if (sp != NULL) {
467 		sp->tv_sec = st / 1000000;
468 		sp->tv_usec = st % 1000000;
469 	}
470 	if (up != NULL) {
471 		up->tv_sec = ut / 1000000;
472 		up->tv_usec = ut % 1000000;
473 	}
474 	if (ip != NULL) {
475 		if (it != 0)
476 			it = (u * it) / tot;
477 		ip->tv_sec = it / 1000000;
478 		ip->tv_usec = it % 1000000;
479 	}
480 	if (rp != NULL) {
481 		*rp = tv;
482 	}
483 }
484 
485 /* ARGSUSED */
486 int
487 sys_getrusage(struct lwp *l, const struct sys_getrusage_args *uap,
488     register_t *retval)
489 {
490 	/* {
491 		syscallarg(int) who;
492 		syscallarg(struct rusage *) rusage;
493 	} */
494 	struct rusage ru;
495 	struct proc *p = l->l_proc;
496 
497 	switch (SCARG(uap, who)) {
498 	case RUSAGE_SELF:
499 		mutex_enter(p->p_lock);
500 		memcpy(&ru, &p->p_stats->p_ru, sizeof(ru));
501 		calcru(p, &ru.ru_utime, &ru.ru_stime, NULL, NULL);
502 		rulwps(p, &ru);
503 		mutex_exit(p->p_lock);
504 		break;
505 
506 	case RUSAGE_CHILDREN:
507 		mutex_enter(p->p_lock);
508 		memcpy(&ru, &p->p_stats->p_cru, sizeof(ru));
509 		mutex_exit(p->p_lock);
510 		break;
511 
512 	default:
513 		return EINVAL;
514 	}
515 
516 	return copyout(&ru, SCARG(uap, rusage), sizeof(ru));
517 }
518 
519 void
520 ruadd(struct rusage *ru, struct rusage *ru2)
521 {
522 	long *ip, *ip2;
523 	int i;
524 
525 	timeradd(&ru->ru_utime, &ru2->ru_utime, &ru->ru_utime);
526 	timeradd(&ru->ru_stime, &ru2->ru_stime, &ru->ru_stime);
527 	if (ru->ru_maxrss < ru2->ru_maxrss)
528 		ru->ru_maxrss = ru2->ru_maxrss;
529 	ip = &ru->ru_first; ip2 = &ru2->ru_first;
530 	for (i = &ru->ru_last - &ru->ru_first; i >= 0; i--)
531 		*ip++ += *ip2++;
532 }
533 
534 void
535 rulwps(proc_t *p, struct rusage *ru)
536 {
537 	lwp_t *l;
538 
539 	KASSERT(mutex_owned(p->p_lock));
540 
541 	LIST_FOREACH(l, &p->p_lwps, l_sibling) {
542 		ruadd(ru, &l->l_ru);
543 		ru->ru_nvcsw += (l->l_ncsw - l->l_nivcsw);
544 		ru->ru_nivcsw += l->l_nivcsw;
545 	}
546 }
547 
548 /*
549  * Make a copy of the plimit structure.
550  * We share these structures copy-on-write after fork,
551  * and copy when a limit is changed.
552  *
553  * Unfortunately (due to PL_SHAREMOD) it is possibly for the structure
554  * we are copying to change beneath our feet!
555  */
556 struct plimit *
557 lim_copy(struct plimit *lim)
558 {
559 	struct plimit *newlim;
560 	char *corename;
561 	size_t alen, len;
562 
563 	newlim = pool_cache_get(plimit_cache, PR_WAITOK);
564 	mutex_init(&newlim->pl_lock, MUTEX_DEFAULT, IPL_NONE);
565 	newlim->pl_flags = 0;
566 	newlim->pl_refcnt = 1;
567 	newlim->pl_sv_limit = NULL;
568 
569 	mutex_enter(&lim->pl_lock);
570 	memcpy(newlim->pl_rlimit, lim->pl_rlimit,
571 	    sizeof(struct rlimit) * RLIM_NLIMITS);
572 
573 	alen = 0;
574 	corename = NULL;
575 	for (;;) {
576 		if (lim->pl_corename == defcorename) {
577 			newlim->pl_corename = defcorename;
578 			break;
579 		}
580 		len = strlen(lim->pl_corename) + 1;
581 		if (len <= alen) {
582 			newlim->pl_corename = corename;
583 			memcpy(corename, lim->pl_corename, len);
584 			corename = NULL;
585 			break;
586 		}
587 		mutex_exit(&lim->pl_lock);
588 		if (corename != NULL)
589 			free(corename, M_TEMP);
590 		alen = len;
591 		corename = malloc(alen, M_TEMP, M_WAITOK);
592 		mutex_enter(&lim->pl_lock);
593 	}
594 	mutex_exit(&lim->pl_lock);
595 	if (corename != NULL)
596 		free(corename, M_TEMP);
597 	return newlim;
598 }
599 
600 void
601 lim_addref(struct plimit *lim)
602 {
603 	atomic_inc_uint(&lim->pl_refcnt);
604 }
605 
606 /*
607  * Give a process it's own private plimit structure.
608  * This will only be shared (in fork) if modifications are to be shared.
609  */
610 void
611 lim_privatise(struct proc *p, bool set_shared)
612 {
613 	struct plimit *lim, *newlim;
614 
615 	lim = p->p_limit;
616 	if (lim->pl_flags & PL_WRITEABLE) {
617 		if (set_shared)
618 			lim->pl_flags |= PL_SHAREMOD;
619 		return;
620 	}
621 
622 	if (set_shared && lim->pl_flags & PL_SHAREMOD)
623 		return;
624 
625 	newlim = lim_copy(lim);
626 
627 	mutex_enter(p->p_lock);
628 	if (p->p_limit->pl_flags & PL_WRITEABLE) {
629 		/* Someone crept in while we were busy */
630 		mutex_exit(p->p_lock);
631 		limfree(newlim);
632 		if (set_shared)
633 			p->p_limit->pl_flags |= PL_SHAREMOD;
634 		return;
635 	}
636 
637 	/*
638 	 * Since most accesses to p->p_limit aren't locked, we must not
639 	 * delete the old limit structure yet.
640 	 */
641 	newlim->pl_sv_limit = p->p_limit;
642 	newlim->pl_flags |= PL_WRITEABLE;
643 	if (set_shared)
644 		newlim->pl_flags |= PL_SHAREMOD;
645 	p->p_limit = newlim;
646 	mutex_exit(p->p_lock);
647 }
648 
649 void
650 limfree(struct plimit *lim)
651 {
652 	struct plimit *sv_lim;
653 
654 	do {
655 		if (atomic_dec_uint_nv(&lim->pl_refcnt) > 0)
656 			return;
657 		if (lim->pl_corename != defcorename)
658 			free(lim->pl_corename, M_TEMP);
659 		sv_lim = lim->pl_sv_limit;
660 		mutex_destroy(&lim->pl_lock);
661 		pool_cache_put(plimit_cache, lim);
662 	} while ((lim = sv_lim) != NULL);
663 }
664 
665 struct pstats *
666 pstatscopy(struct pstats *ps)
667 {
668 
669 	struct pstats *newps;
670 
671 	newps = pool_cache_get(pstats_cache, PR_WAITOK);
672 
673 	memset(&newps->pstat_startzero, 0,
674 	(unsigned) ((char *)&newps->pstat_endzero -
675 		    (char *)&newps->pstat_startzero));
676 	memcpy(&newps->pstat_startcopy, &ps->pstat_startcopy,
677 	((char *)&newps->pstat_endcopy -
678 	 (char *)&newps->pstat_startcopy));
679 
680 	return (newps);
681 
682 }
683 
684 void
685 pstatsfree(struct pstats *ps)
686 {
687 
688 	pool_cache_put(pstats_cache, ps);
689 }
690 
691 /*
692  * sysctl interface in five parts
693  */
694 
695 /*
696  * a routine for sysctl proc subtree helpers that need to pick a valid
697  * process by pid.
698  */
699 static int
700 sysctl_proc_findproc(struct lwp *l, struct proc **p2, pid_t pid)
701 {
702 	struct proc *ptmp;
703 	int error = 0;
704 
705 	if (pid == PROC_CURPROC)
706 		ptmp = l->l_proc;
707 	else if ((ptmp = pfind(pid)) == NULL)
708 		error = ESRCH;
709 
710 	*p2 = ptmp;
711 	return (error);
712 }
713 
714 /*
715  * sysctl helper routine for setting a process's specific corefile
716  * name.  picks the process based on the given pid and checks the
717  * correctness of the new value.
718  */
719 static int
720 sysctl_proc_corename(SYSCTLFN_ARGS)
721 {
722 	struct proc *ptmp;
723 	struct plimit *lim;
724 	int error = 0, len;
725 	char *cname;
726 	char *ocore;
727 	char *tmp;
728 	struct sysctlnode node;
729 
730 	/*
731 	 * is this all correct?
732 	 */
733 	if (namelen != 0)
734 		return (EINVAL);
735 	if (name[-1] != PROC_PID_CORENAME)
736 		return (EINVAL);
737 
738 	/*
739 	 * whom are we tweaking?
740 	 */
741 	error = sysctl_proc_findproc(l, &ptmp, (pid_t)name[-2]);
742 	if (error)
743 		return (error);
744 
745 	/* XXX-elad */
746 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE, ptmp,
747 	    KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
748 	if (error)
749 		return (error);
750 
751 	if (newp == NULL) {
752 		error = kauth_authorize_process(l->l_cred,
753 		    KAUTH_PROCESS_CORENAME, ptmp,
754 		    KAUTH_ARG(KAUTH_REQ_PROCESS_CORENAME_GET), NULL, NULL);
755 		if (error)
756 			return (error);
757 	}
758 
759 	/*
760 	 * let them modify a temporary copy of the core name
761 	 */
762 	cname = PNBUF_GET();
763 	lim = ptmp->p_limit;
764 	mutex_enter(&lim->pl_lock);
765 	strlcpy(cname, lim->pl_corename, MAXPATHLEN);
766 	mutex_exit(&lim->pl_lock);
767 
768 	node = *rnode;
769 	node.sysctl_data = cname;
770 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
771 
772 	/*
773 	 * if that failed, or they have nothing new to say, or we've
774 	 * heard it before...
775 	 */
776 	if (error || newp == NULL)
777 		goto done;
778 	lim = ptmp->p_limit;
779 	mutex_enter(&lim->pl_lock);
780 	error = strcmp(cname, lim->pl_corename);
781 	mutex_exit(&lim->pl_lock);
782 	if (error == 0)
783 		/* Unchanged */
784 		goto done;
785 
786 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CORENAME,
787 	    ptmp, KAUTH_ARG(KAUTH_REQ_PROCESS_CORENAME_SET), cname, NULL);
788 	if (error)
789 		return (error);
790 
791 	/*
792 	 * no error yet and cname now has the new core name in it.
793 	 * let's see if it looks acceptable.  it must be either "core"
794 	 * or end in ".core" or "/core".
795 	 */
796 	len = strlen(cname);
797 	if (len < 4) {
798 		error = EINVAL;
799 	} else if (strcmp(cname + len - 4, "core") != 0) {
800 		error = EINVAL;
801 	} else if (len > 4 && cname[len - 5] != '/' && cname[len - 5] != '.') {
802 		error = EINVAL;
803 	}
804 	if (error != 0) {
805 		goto done;
806 	}
807 
808 	/*
809 	 * hmm...looks good.  now...where do we put it?
810 	 */
811 	tmp = malloc(len + 1, M_TEMP, M_WAITOK|M_CANFAIL);
812 	if (tmp == NULL) {
813 		error = ENOMEM;
814 		goto done;
815 	}
816 	memcpy(tmp, cname, len + 1);
817 
818 	lim_privatise(ptmp, false);
819 	lim = ptmp->p_limit;
820 	mutex_enter(&lim->pl_lock);
821 	ocore = lim->pl_corename;
822 	lim->pl_corename = tmp;
823 	mutex_exit(&lim->pl_lock);
824 	if (ocore != defcorename)
825 		free(ocore, M_TEMP);
826 
827 done:
828 	PNBUF_PUT(cname);
829 	return error;
830 }
831 
832 /*
833  * sysctl helper routine for checking/setting a process's stop flags,
834  * one for fork and one for exec.
835  */
836 static int
837 sysctl_proc_stop(SYSCTLFN_ARGS)
838 {
839 	struct proc *ptmp;
840 	int i, f, error = 0;
841 	struct sysctlnode node;
842 
843 	if (namelen != 0)
844 		return (EINVAL);
845 
846 	error = sysctl_proc_findproc(l, &ptmp, (pid_t)name[-2]);
847 	if (error)
848 		return (error);
849 
850 	/* XXX-elad */
851 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE, ptmp,
852 	    KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
853 	if (error)
854 		return (error);
855 
856 	switch (rnode->sysctl_num) {
857 	case PROC_PID_STOPFORK:
858 		f = PS_STOPFORK;
859 		break;
860 	case PROC_PID_STOPEXEC:
861 		f = PS_STOPEXEC;
862 		break;
863 	case PROC_PID_STOPEXIT:
864 		f = PS_STOPEXIT;
865 		break;
866 	default:
867 		return (EINVAL);
868 	}
869 
870 	i = (ptmp->p_flag & f) ? 1 : 0;
871 	node = *rnode;
872 	node.sysctl_data = &i;
873 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
874 	if (error || newp == NULL)
875 		return (error);
876 
877 	mutex_enter(ptmp->p_lock);
878 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_STOPFLAG,
879 	    ptmp, KAUTH_ARG(f), NULL, NULL);
880 	if (error)
881 		return (error);
882 	if (i)
883 		ptmp->p_sflag |= f;
884 	else
885 		ptmp->p_sflag &= ~f;
886 	mutex_exit(ptmp->p_lock);
887 
888 	return (0);
889 }
890 
891 /*
892  * sysctl helper routine for a process's rlimits as exposed by sysctl.
893  */
894 static int
895 sysctl_proc_plimit(SYSCTLFN_ARGS)
896 {
897 	struct proc *ptmp;
898 	u_int limitno;
899 	int which, error = 0;
900         struct rlimit alim;
901 	struct sysctlnode node;
902 
903 	if (namelen != 0)
904 		return (EINVAL);
905 
906 	which = name[-1];
907 	if (which != PROC_PID_LIMIT_TYPE_SOFT &&
908 	    which != PROC_PID_LIMIT_TYPE_HARD)
909 		return (EINVAL);
910 
911 	limitno = name[-2] - 1;
912 	if (limitno >= RLIM_NLIMITS)
913 		return (EINVAL);
914 
915 	if (name[-3] != PROC_PID_LIMIT)
916 		return (EINVAL);
917 
918 	error = sysctl_proc_findproc(l, &ptmp, (pid_t)name[-4]);
919 	if (error)
920 		return (error);
921 
922 	/* XXX-elad */
923 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE, ptmp,
924 	    KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
925 	if (error)
926 		return (error);
927 
928 	/* Check if we can view limits. */
929 	if (newp == NULL) {
930 		error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_RLIMIT,
931 		    ptmp, KAUTH_ARG(KAUTH_REQ_PROCESS_RLIMIT_GET), &alim,
932 		    KAUTH_ARG(which));
933 		if (error)
934 			return (error);
935 	}
936 
937 	node = *rnode;
938 	memcpy(&alim, &ptmp->p_rlimit[limitno], sizeof(alim));
939 	if (which == PROC_PID_LIMIT_TYPE_HARD)
940 		node.sysctl_data = &alim.rlim_max;
941 	else
942 		node.sysctl_data = &alim.rlim_cur;
943 
944 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
945 	if (error || newp == NULL)
946 		return (error);
947 
948 	return (dosetrlimit(l, ptmp, limitno, &alim));
949 }
950 
951 /*
952  * and finally, the actually glue that sticks it to the tree
953  */
954 SYSCTL_SETUP(sysctl_proc_setup, "sysctl proc subtree setup")
955 {
956 
957 	sysctl_createv(clog, 0, NULL, NULL,
958 		       CTLFLAG_PERMANENT,
959 		       CTLTYPE_NODE, "proc", NULL,
960 		       NULL, 0, NULL, 0,
961 		       CTL_PROC, CTL_EOL);
962 	sysctl_createv(clog, 0, NULL, NULL,
963 		       CTLFLAG_PERMANENT|CTLFLAG_ANYNUMBER,
964 		       CTLTYPE_NODE, "curproc",
965 		       SYSCTL_DESCR("Per-process settings"),
966 		       NULL, 0, NULL, 0,
967 		       CTL_PROC, PROC_CURPROC, CTL_EOL);
968 
969 	sysctl_createv(clog, 0, NULL, NULL,
970 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
971 		       CTLTYPE_STRING, "corename",
972 		       SYSCTL_DESCR("Core file name"),
973 		       sysctl_proc_corename, 0, NULL, MAXPATHLEN,
974 		       CTL_PROC, PROC_CURPROC, PROC_PID_CORENAME, CTL_EOL);
975 	sysctl_createv(clog, 0, NULL, NULL,
976 		       CTLFLAG_PERMANENT,
977 		       CTLTYPE_NODE, "rlimit",
978 		       SYSCTL_DESCR("Process limits"),
979 		       NULL, 0, NULL, 0,
980 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, CTL_EOL);
981 
982 #define create_proc_plimit(s, n) do {					\
983 	sysctl_createv(clog, 0, NULL, NULL,				\
984 		       CTLFLAG_PERMANENT,				\
985 		       CTLTYPE_NODE, s,					\
986 		       SYSCTL_DESCR("Process " s " limits"),		\
987 		       NULL, 0, NULL, 0,				\
988 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, n,	\
989 		       CTL_EOL);					\
990 	sysctl_createv(clog, 0, NULL, NULL,				\
991 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE, \
992 		       CTLTYPE_QUAD, "soft",				\
993 		       SYSCTL_DESCR("Process soft " s " limit"),	\
994 		       sysctl_proc_plimit, 0, NULL, 0,			\
995 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, n,	\
996 		       PROC_PID_LIMIT_TYPE_SOFT, CTL_EOL);		\
997 	sysctl_createv(clog, 0, NULL, NULL,				\
998 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE, \
999 		       CTLTYPE_QUAD, "hard",				\
1000 		       SYSCTL_DESCR("Process hard " s " limit"),	\
1001 		       sysctl_proc_plimit, 0, NULL, 0,			\
1002 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, n,	\
1003 		       PROC_PID_LIMIT_TYPE_HARD, CTL_EOL);		\
1004 	} while (0/*CONSTCOND*/)
1005 
1006 	create_proc_plimit("cputime",		PROC_PID_LIMIT_CPU);
1007 	create_proc_plimit("filesize",		PROC_PID_LIMIT_FSIZE);
1008 	create_proc_plimit("datasize",		PROC_PID_LIMIT_DATA);
1009 	create_proc_plimit("stacksize",		PROC_PID_LIMIT_STACK);
1010 	create_proc_plimit("coredumpsize",	PROC_PID_LIMIT_CORE);
1011 	create_proc_plimit("memoryuse",		PROC_PID_LIMIT_RSS);
1012 	create_proc_plimit("memorylocked",	PROC_PID_LIMIT_MEMLOCK);
1013 	create_proc_plimit("maxproc",		PROC_PID_LIMIT_NPROC);
1014 	create_proc_plimit("descriptors",	PROC_PID_LIMIT_NOFILE);
1015 	create_proc_plimit("sbsize",		PROC_PID_LIMIT_SBSIZE);
1016 
1017 #undef create_proc_plimit
1018 
1019 	sysctl_createv(clog, 0, NULL, NULL,
1020 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1021 		       CTLTYPE_INT, "stopfork",
1022 		       SYSCTL_DESCR("Stop process at fork(2)"),
1023 		       sysctl_proc_stop, 0, NULL, 0,
1024 		       CTL_PROC, PROC_CURPROC, PROC_PID_STOPFORK, CTL_EOL);
1025 	sysctl_createv(clog, 0, NULL, NULL,
1026 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1027 		       CTLTYPE_INT, "stopexec",
1028 		       SYSCTL_DESCR("Stop process at execve(2)"),
1029 		       sysctl_proc_stop, 0, NULL, 0,
1030 		       CTL_PROC, PROC_CURPROC, PROC_PID_STOPEXEC, CTL_EOL);
1031 	sysctl_createv(clog, 0, NULL, NULL,
1032 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1033 		       CTLTYPE_INT, "stopexit",
1034 		       SYSCTL_DESCR("Stop process before completing exit"),
1035 		       sysctl_proc_stop, 0, NULL, 0,
1036 		       CTL_PROC, PROC_CURPROC, PROC_PID_STOPEXIT, CTL_EOL);
1037 }
1038 
1039 void
1040 uid_init(void)
1041 {
1042 
1043 	/*
1044 	 * Ensure that uid 0 is always in the user hash table, as
1045 	 * sbreserve() expects it available from interrupt context.
1046 	 */
1047 	(void)uid_find(0);
1048 }
1049 
1050 struct uidinfo *
1051 uid_find(uid_t uid)
1052 {
1053 	struct uidinfo *uip, *uip_first, *newuip;
1054 	struct uihashhead *uipp;
1055 
1056 	uipp = UIHASH(uid);
1057 	newuip = NULL;
1058 
1059 	/*
1060 	 * To make insertion atomic, abstraction of SLIST will be violated.
1061 	 */
1062 	uip_first = uipp->slh_first;
1063  again:
1064 	SLIST_FOREACH(uip, uipp, ui_hash) {
1065 		if (uip->ui_uid != uid)
1066 			continue;
1067 		if (newuip != NULL)
1068 			kmem_free(newuip, sizeof(*newuip));
1069 		return uip;
1070 	}
1071 	if (newuip == NULL)
1072 		newuip = kmem_zalloc(sizeof(*newuip), KM_SLEEP);
1073 	newuip->ui_uid = uid;
1074 
1075 	/*
1076 	 * If atomic insert is unsuccessful, another thread might be
1077 	 * allocated this 'uid', thus full re-check is needed.
1078 	 */
1079 	newuip->ui_hash.sle_next = uip_first;
1080 	membar_producer();
1081 	uip = atomic_cas_ptr(&uipp->slh_first, uip_first, newuip);
1082 	if (uip != uip_first) {
1083 		uip_first = uip;
1084 		goto again;
1085 	}
1086 
1087 	return newuip;
1088 }
1089 
1090 /*
1091  * Change the count associated with number of processes
1092  * a given user is using.
1093  */
1094 int
1095 chgproccnt(uid_t uid, int diff)
1096 {
1097 	struct uidinfo *uip;
1098 	long proccnt;
1099 
1100 	uip = uid_find(uid);
1101 	proccnt = atomic_add_long_nv(&uip->ui_proccnt, diff);
1102 	KASSERT(proccnt >= 0);
1103 	return proccnt;
1104 }
1105 
1106 int
1107 chgsbsize(struct uidinfo *uip, u_long *hiwat, u_long to, rlim_t xmax)
1108 {
1109 	rlim_t nsb;
1110 	const long diff = to - *hiwat;
1111 
1112 	nsb = atomic_add_long_nv((long *)&uip->ui_sbsize, diff);
1113 	if (diff > 0 && nsb > xmax) {
1114 		atomic_add_long((long *)&uip->ui_sbsize, -diff);
1115 		return 0;
1116 	}
1117 	*hiwat = to;
1118 	KASSERT(nsb >= 0);
1119 	return 1;
1120 }
1121