]> git.saurik.com Git - apple/xnu.git/blobdiff - bsd/kern/kern_resource.c
xnu-1228.0.2.tar.gz
[apple/xnu.git] / bsd / kern / kern_resource.c
index 21da076bacaacfe12ed45b6277ca0031477ac921..5e2f8c17158a37f4d4619451fdb8a5a662bd9363 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 2000-2004 Apple Computer, Inc. All rights reserved.
+ * Copyright (c) 2000-2007 Apple Inc. All rights reserved.
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  * 
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  * 
  *
  *     @(#)kern_resource.c     8.5 (Berkeley) 1/21/94
  */
  *
  *     @(#)kern_resource.c     8.5 (Berkeley) 1/21/94
  */
+/*
+ * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
+ * support for mandatory and extensible security protections.  This notice
+ * is included in support of clause 2.2 (b) of the Apple Public License,
+ * Version 2.0.
+ */
 
 #include <sys/param.h>
 #include <sys/systm.h>
 
 #include <sys/param.h>
 #include <sys/systm.h>
 
 #include <mach/mach_types.h>
 #include <mach/time_value.h>
 
 #include <mach/mach_types.h>
 #include <mach/time_value.h>
+#include <mach/task.h>
 #include <mach/task_info.h>
 #include <mach/vm_map.h>
 #include <mach/task_info.h>
 #include <mach/vm_map.h>
+#include <mach/mach_vm.h>
+#include <mach/thread_act.h>  /* for thread_policy_set( ) */
+#include <kern/lock.h>
+#include <kern/thread.h>
+
+#include <kern/task.h>
+#include <kern/clock.h>                /* for absolutetime_to_microtime() */
+#include <netinet/in.h>                /* for TRAFFIC_MGT_SO_BACKGROUND */
+#include <sys/socketvar.h>     /* for struct socket */
 
 #include <vm/vm_map.h>
 
 int    donice(struct proc *curp, struct proc *chgp, int n);
 int    dosetrlimit(struct proc *p, u_int which, struct rlimit *limp);
 
 #include <vm/vm_map.h>
 
 int    donice(struct proc *curp, struct proc *chgp, int n);
 int    dosetrlimit(struct proc *p, u_int which, struct rlimit *limp);
+static int do_background_thread(struct proc *curp, int priority);
 
 rlim_t maxdmap = MAXDSIZ;      /* XXX */ 
 
 rlim_t maxdmap = MAXDSIZ;      /* XXX */ 
-rlim_t maxsmap = MAXSSIZ;      /* XXX */ 
+rlim_t maxsmap = MAXSSIZ - PAGE_SIZE;  /* XXX */ 
 
 /*
  * Limits on the number of open files per process, and the number
 
 /*
  * Limits on the number of open files per process, and the number
@@ -103,7 +120,6 @@ rlim_t maxsmap = MAXSSIZ;   /* XXX */
  *
  * Note: would be in kern/subr_param.c in FreeBSD.
  */
  *
  * Note: would be in kern/subr_param.c in FreeBSD.
  */
-int maxprocperuid = CHILD_MAX;         /* max # of procs per user */
 int maxfilesperproc = OPEN_MAX;                /* per-proc open files limit */
 
 SYSCTL_INT( _kern, KERN_MAXPROCPERUID, maxprocperuid, CTLFLAG_RW,
 int maxfilesperproc = OPEN_MAX;                /* per-proc open files limit */
 
 SYSCTL_INT( _kern, KERN_MAXPROCPERUID, maxprocperuid, CTLFLAG_RW,
@@ -112,6 +128,25 @@ SYSCTL_INT( _kern, KERN_MAXPROCPERUID, maxprocperuid, CTLFLAG_RW,
 SYSCTL_INT( _kern, KERN_MAXFILESPERPROC, maxfilesperproc, CTLFLAG_RW,       
                &maxfilesperproc, 0, "Maximum files allowed open per process" );
 
 SYSCTL_INT( _kern, KERN_MAXFILESPERPROC, maxfilesperproc, CTLFLAG_RW,       
                &maxfilesperproc, 0, "Maximum files allowed open per process" );
 
+/* Args and fn for proc_iteration callback used in setpriority */
+struct puser_nice_args {
+       proc_t curp;
+       int     prio;
+       id_t    who;
+       int *   foundp;
+       int *   errorp;
+};
+static int puser_donice_callback(proc_t p, void * arg);
+
+
+/* Args and fn for proc_iteration callback used in setpriority */
+struct ppgrp_nice_args {
+       proc_t curp;
+       int     prio;
+       int *   foundp;
+       int *   errorp;
+};
+static int ppgrp_donice_callback(proc_t p, void * arg);
 
 /*
  * Resource controls and accounting.
 
 /*
  * Resource controls and accounting.
@@ -119,46 +154,86 @@ SYSCTL_INT( _kern, KERN_MAXFILESPERPROC, maxfilesperproc, CTLFLAG_RW,
 int
 getpriority(struct proc *curp, struct getpriority_args *uap, register_t *retval)
 {
 int
 getpriority(struct proc *curp, struct getpriority_args *uap, register_t *retval)
 {
-       register struct proc *p;
-       register int low = PRIO_MAX + 1;
+       struct proc *p;
+       int low = PRIO_MAX + 1;
+       kauth_cred_t my_cred;
 
 
-       if (uap->who < 0)
+       /* would also test (uap->who < 0), but id_t is unsigned */
+       if (uap->who > 0x7fffffff)
                return (EINVAL);
 
        switch (uap->which) {
 
        case PRIO_PROCESS:
                return (EINVAL);
 
        switch (uap->which) {
 
        case PRIO_PROCESS:
-               if (uap->who == 0)
+               if (uap->who == 0) {
                        p = curp;
                        p = curp;
-               else
-                       p = pfind(uap->who);
-               if (p == 0)
-                       break;
-               low = p->p_nice;
+                       low = p->p_nice;
+               } else {
+                       p = proc_find(uap->who);
+                       if (p == 0)
+                               break;
+                       low = p->p_nice;
+                       proc_rele(p);
+
+               }
                break;
 
        case PRIO_PGRP: {
                break;
 
        case PRIO_PGRP: {
-               register struct pgrp *pg;
+               struct pgrp *pg = PGRP_NULL;
 
 
-               if (uap->who == 0)
-                       pg = curp->p_pgrp;
-               else if ((pg = pgfind(uap->who)) == NULL)
+               if (uap->who == 0) {
+                       /* returns the pgrp to ref */
+                       pg = proc_pgrp(curp);
+                } else if ((pg = pgfind(uap->who)) == PGRP_NULL) {
                        break;
                        break;
+               }
+               /* No need for iteration as it is a simple scan */
+               pgrp_lock(pg);
                for (p = pg->pg_members.lh_first; p != 0; p = p->p_pglist.le_next) {
                        if (p->p_nice < low)
                                low = p->p_nice;
                }
                for (p = pg->pg_members.lh_first; p != 0; p = p->p_pglist.le_next) {
                        if (p->p_nice < low)
                                low = p->p_nice;
                }
+               pgrp_unlock(pg);
+               pg_rele(pg);
                break;
        }
 
        case PRIO_USER:
                if (uap->who == 0)
                        uap->who = kauth_cred_getuid(kauth_cred_get());
                break;
        }
 
        case PRIO_USER:
                if (uap->who == 0)
                        uap->who = kauth_cred_getuid(kauth_cred_get());
-               for (p = allproc.lh_first; p != 0; p = p->p_list.le_next)
-                       if (kauth_cred_getuid(p->p_ucred) == uap->who &&
+
+               proc_list_lock();
+
+               for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) {
+                       my_cred = kauth_cred_proc_ref(p);
+                       if (kauth_cred_getuid(my_cred) == uap->who &&
                            p->p_nice < low)
                                low = p->p_nice;
                            p->p_nice < low)
                                low = p->p_nice;
+                       kauth_cred_unref(&my_cred);
+               }
+
+               proc_list_unlock();
+
+               break;
+
+       case PRIO_DARWIN_THREAD: {
+               thread_t                        thread;
+               struct uthread          *ut;
+
+               /* we currently only support the current thread */
+               if (uap->who != 0) {
+                       return (EINVAL);
+               }
+       
+               thread = current_thread();
+               ut = get_bsdthread_info(thread);
+
+               low = 0;
+               if ( (ut->uu_flag & UT_BACKGROUND) != 0 ) {
+                       low = 1;
+               }
                break;
                break;
+       }
 
        default:
                return (EINVAL);
 
        default:
                return (EINVAL);
@@ -169,18 +244,69 @@ getpriority(struct proc *curp, struct getpriority_args *uap, register_t *retval)
        return (0);
 }
 
        return (0);
 }
 
+/* call back function used for proc iteration in PRIO_USER */
+static int
+puser_donice_callback(proc_t p, void * arg)
+{
+       int error, n;
+       struct puser_nice_args * pun = (struct puser_nice_args *)arg;
+       kauth_cred_t my_cred;
+
+       my_cred = kauth_cred_proc_ref(p);
+       if (kauth_cred_getuid(my_cred) == pun->who) {
+               error = donice(pun->curp, p, pun->prio);
+               if (pun->errorp != NULL)
+                       *pun->errorp = error;
+               if (pun->foundp != NULL) {
+                       n = *pun->foundp;
+                       *pun->foundp = n+1;
+               }
+       }
+       kauth_cred_unref(&my_cred);
+
+       return(PROC_RETURNED);
+}
+
+/* call back function used for proc iteration in PRIO_PGRP */
+static int
+ppgrp_donice_callback(proc_t p, void * arg)
+{
+       int error;
+       struct ppgrp_nice_args * pun = (struct ppgrp_nice_args *)arg;
+       int n;
+
+       error = donice(pun->curp, p, pun->prio);
+       if (pun->errorp != NULL)
+               *pun->errorp = error;
+       if (pun->foundp!= NULL) {
+               n = *pun->foundp;
+               *pun->foundp = n+1;
+       }
+
+       return(PROC_RETURNED);
+}
+
+/*
+ * Returns:    0                       Success
+ *             EINVAL
+ *             ESRCH
+ *     donice:EPERM
+ *     donice:EACCES
+ */
 /* ARGSUSED */
 int
 setpriority(struct proc *curp, struct setpriority_args *uap, __unused register_t *retval)
 {
 /* ARGSUSED */
 int
 setpriority(struct proc *curp, struct setpriority_args *uap, __unused register_t *retval)
 {
-       register struct proc *p;
+       struct proc *p;
        int found = 0, error = 0;
        int found = 0, error = 0;
+       int refheld = 0;
 
        AUDIT_ARG(cmd, uap->which);
        AUDIT_ARG(owner, uap->who, 0);
        AUDIT_ARG(value, uap->prio);
 
 
        AUDIT_ARG(cmd, uap->which);
        AUDIT_ARG(owner, uap->who, 0);
        AUDIT_ARG(value, uap->prio);
 
-       if (uap->who < 0)
+       /* would also test (uap->who < 0), but id_t is unsigned */
+       if (uap->who > 0x7fffffff)
                return (EINVAL);
 
        switch (uap->which) {
                return (EINVAL);
 
        switch (uap->which) {
@@ -188,38 +314,64 @@ setpriority(struct proc *curp, struct setpriority_args *uap, __unused register_t
        case PRIO_PROCESS:
                if (uap->who == 0)
                        p = curp;
        case PRIO_PROCESS:
                if (uap->who == 0)
                        p = curp;
-               else
-                       p = pfind(uap->who);
-               if (p == 0)
-                       break;
+               else {
+                       p = proc_find(uap->who);
+                       if (p == 0)
+                               break;
+                       refheld = 1;
+               }
                error = donice(curp, p, uap->prio);
                found++;
                error = donice(curp, p, uap->prio);
                found++;
+               if (refheld != 0)
+                       proc_rele(p);
                break;
 
        case PRIO_PGRP: {
                break;
 
        case PRIO_PGRP: {
-               register struct pgrp *pg;
+               struct pgrp *pg = PGRP_NULL;
+               struct ppgrp_nice_args ppgrp;
                 
                 
-               if (uap->who == 0)
-                       pg = curp->p_pgrp;
-               else if ((pg = pgfind(uap->who)) == NULL)
+               if (uap->who == 0) {
+                       pg = proc_pgrp(curp);
+                } else if ((pg = pgfind(uap->who)) == PGRP_NULL)
                        break;
                        break;
-               for (p = pg->pg_members.lh_first; p != 0;
-                   p = p->p_pglist.le_next) {
-                       error = donice(curp, p, uap->prio);
-                       found++;
-               }
+
+               ppgrp.curp = curp;
+               ppgrp.prio = uap->prio;
+               ppgrp.foundp = &found;
+               ppgrp.errorp = &error;
+               
+               /* PGRP_DROPREF drops the reference on process group */
+               pgrp_iterate(pg, PGRP_DROPREF, ppgrp_donice_callback, (void *)&ppgrp, NULL, NULL);
+
                break;
        }
 
                break;
        }
 
-       case PRIO_USER:
+       case PRIO_USER: {
+               struct puser_nice_args punice;
+
                if (uap->who == 0)
                        uap->who = kauth_cred_getuid(kauth_cred_get());
                if (uap->who == 0)
                        uap->who = kauth_cred_getuid(kauth_cred_get());
-               for (p = allproc.lh_first; p != 0; p = p->p_list.le_next)
-                       if (kauth_cred_getuid(p->p_ucred) == uap->who) {
-                               error = donice(curp, p, uap->prio);
-                               found++;
-                       }
+
+               punice.curp = curp;
+               punice.prio = uap->prio;
+               punice.who = uap->who;
+               punice.foundp = &found;
+               error = 0;
+               punice.errorp = &error;
+               proc_iterate(PROC_ALLPROCLIST, puser_donice_callback, (void *)&punice, NULL, NULL);
+
                break;
                break;
+       }
+
+       case PRIO_DARWIN_THREAD: {
+               /* we currently only support the current thread */
+               if (uap->who != 0) {
+                       return (EINVAL);
+               }
+               error = do_background_thread(curp, uap->prio);
+               found++;
+               break;
+       }
 
        default:
                return (EINVAL);
 
        default:
                return (EINVAL);
@@ -229,32 +381,145 @@ setpriority(struct proc *curp, struct setpriority_args *uap, __unused register_t
        return (error);
 }
 
        return (error);
 }
 
+
+/*
+ * Returns:    0                       Success
+ *             EPERM
+ *             EACCES
+ *     mac_check_proc_sched:???
+ */
 int
 int
-donice(curp, chgp, n)
-       register struct proc *curp, *chgp;
-       register int n;
+donice(struct proc *curp, struct proc *chgp, int n)
 {
 {
-       kauth_cred_t ucred = curp->p_ucred;
+       int error = 0;
+       kauth_cred_t ucred;
+       kauth_cred_t my_cred;
+
+       ucred = kauth_cred_proc_ref(curp);
+       my_cred = kauth_cred_proc_ref(chgp);
 
        if (suser(ucred, NULL) && ucred->cr_ruid &&
 
        if (suser(ucred, NULL) && ucred->cr_ruid &&
-           kauth_cred_getuid(ucred) != kauth_cred_getuid(chgp->p_ucred) &&
-           ucred->cr_ruid != kauth_cred_getuid(chgp->p_ucred))
-               return (EPERM);
+           kauth_cred_getuid(ucred) != kauth_cred_getuid(my_cred) &&
+           ucred->cr_ruid != kauth_cred_getuid(my_cred)) {
+               error = EPERM;
+               goto out;
+       }
        if (n > PRIO_MAX)
                n = PRIO_MAX;
        if (n < PRIO_MIN)
                n = PRIO_MIN;
        if (n > PRIO_MAX)
                n = PRIO_MAX;
        if (n < PRIO_MIN)
                n = PRIO_MIN;
-       if (n < chgp->p_nice && suser(ucred, &curp->p_acflag))
-               return (EACCES);
+       if (n < chgp->p_nice && suser(ucred, &curp->p_acflag)) {
+               error = EACCES;
+               goto out;
+       }
+#if CONFIG_MACF
+       error = mac_proc_check_sched(curp, chgp);
+       if (error) 
+               goto out;
+#endif
+       proc_lock(chgp);
        chgp->p_nice = n;
        chgp->p_nice = n;
+       proc_unlock(chgp);
        (void)resetpriority(chgp);
        (void)resetpriority(chgp);
-       return (0);
+out:
+       kauth_cred_unref(&ucred);
+       kauth_cred_unref(&my_cred);
+       return (error);
+}
+
+/*
+ * do_background_thread
+ * Returns:    0                       Success
+ * XXX - todo - does this need a MACF hook?
+ */
+static int
+do_background_thread(struct proc *curp, int priority)
+{
+       int                                                                     i;
+       thread_t                                                        thread;
+       struct uthread                                          *ut;
+       thread_precedence_policy_data_t         policy;
+       struct filedesc                                         *fdp;
+       struct fileproc                                         *fp;
+       
+       thread = current_thread();
+       ut = get_bsdthread_info(thread);
+
+       if ( (priority & PRIO_DARWIN_BG) == 0 ) {
+               /* turn off backgrounding of thread */
+               if ( (ut->uu_flag & UT_BACKGROUND) == 0 ) {
+                       /* already off */
+                       return(0);
+               }
+
+               /* clear background bit in thread and disable disk IO throttle */
+               ut->uu_flag &= ~UT_BACKGROUND;
+               ut->uu_iopol_disk = IOPOL_NORMAL;
+
+               /* reset thread priority (we did not save previous value) */
+               policy.importance = 0;
+               thread_policy_set( thread, THREAD_PRECEDENCE_POLICY,
+                                                  (thread_policy_t)&policy,
+                                                  THREAD_PRECEDENCE_POLICY_COUNT );
+
+               /* disable networking IO throttle.
+                * NOTE - It is a known limitation of the current design that we 
+                * could potentially clear TRAFFIC_MGT_SO_BACKGROUND bit for 
+                * sockets created by other threads within this process.  
+                */
+               proc_fdlock(curp);
+               fdp = curp->p_fd;
+               for ( i = 0; i < fdp->fd_nfiles; i++ ) {
+                       struct socket           *sockp;
+                       
+                       fp = fdp->fd_ofiles[ i ];
+                       if ( fp == NULL || (fdp->fd_ofileflags[ i ] & UF_RESERVED) != 0 || 
+                                fp->f_fglob->fg_type != DTYPE_SOCKET ) {
+                               continue;
+                       }
+                       sockp = (struct socket *)fp->f_fglob->fg_data;
+                       if ( sockp->so_background_thread != thread ) {
+                               continue;
+                       }
+                       sockp->so_traffic_mgt_flags &= ~TRAFFIC_MGT_SO_BACKGROUND;
+                       sockp->so_background_thread = NULL;
+               }
+               proc_fdunlock(curp);
+
+               return(0);
+       }
+       
+       /* background this thread */
+       if ( (ut->uu_flag & UT_BACKGROUND) != 0 ) {
+               /* already backgrounded */
+               return(0);
+       }
+
+       /* tag thread as background and throttle disk IO */
+       ut->uu_flag |= UT_BACKGROUND;
+       ut->uu_iopol_disk = IOPOL_THROTTLE;
+
+       policy.importance = INT_MIN;
+       thread_policy_set( thread, THREAD_PRECEDENCE_POLICY,
+                                          (thread_policy_t)&policy,
+                                          THREAD_PRECEDENCE_POLICY_COUNT );
+       
+       /* throttle networking IO happens in socket( ) syscall.
+        * If UT_BACKGROUND is set in the current thread then
+        * TRAFFIC_MGT_SO_BACKGROUND socket option is set.
+        */
+       return(0);
 }
 
 
 }
 
 
+/*
+ * Returns:    0                       Success
+ *     copyin:EFAULT
+ *     dosetrlimit:
+ */
 /* ARGSUSED */
 int
 /* ARGSUSED */
 int
-setrlimit(struct proc *p, register struct setrlimit_args *uap, __unused register_t *retval)
+setrlimit(struct proc *p, struct setrlimit_args *uap, __unused register_t *retval)
 {
        struct rlimit alim;
        int error;
 {
        struct rlimit alim;
        int error;
@@ -262,36 +527,88 @@ setrlimit(struct proc *p, register struct setrlimit_args *uap, __unused register
        if ((error = copyin(uap->rlp, (caddr_t)&alim,
            sizeof (struct rlimit))))
                return (error);
        if ((error = copyin(uap->rlp, (caddr_t)&alim,
            sizeof (struct rlimit))))
                return (error);
+
        return (dosetrlimit(p, uap->which, &alim));
 }
 
        return (dosetrlimit(p, uap->which, &alim));
 }
 
+/*
+ * Returns:    0                       Success
+ *             EINVAL
+ *             ENOMEM                  Cannot copy limit structure
+ *     suser:EPERM
+ *
+ * Notes:      EINVAL is returned both for invalid arguments, and in the
+ *             case that the current usage (e.g. RLIMIT_STACK) is already
+ *             in excess of the requested limit.
+ */
 int
 int
-dosetrlimit(p, which, limp)
-       struct proc *p;
-       u_int which;
-       struct rlimit *limp;
+dosetrlimit(struct proc *p, u_int which, struct rlimit *limp)
 {
 {
-       register struct rlimit *alimp;
+       struct rlimit *alimp;
        int error;
        int error;
+       kern_return_t   kr;
+       int posix = (which & _RLIMIT_POSIX_FLAG) ? 1 : 0;
+
+       /* Mask out POSIX flag, saved above */
+       which &= ~_RLIMIT_POSIX_FLAG;
 
        if (which >= RLIM_NLIMITS)
                return (EINVAL);
 
        if (which >= RLIM_NLIMITS)
                return (EINVAL);
+
        alimp = &p->p_rlimit[which];
        alimp = &p->p_rlimit[which];
+       if (limp->rlim_cur > limp->rlim_max)
+               return EINVAL;
+
        if (limp->rlim_cur > alimp->rlim_max || 
            limp->rlim_max > alimp->rlim_max)
        if (limp->rlim_cur > alimp->rlim_max || 
            limp->rlim_max > alimp->rlim_max)
-               if ((error = suser(kauth_cred_get(), &p->p_acflag)))
+               if ((error = suser(kauth_cred_get(), &p->p_acflag))) {
                        return (error);
                        return (error);
-       if (limp->rlim_cur > limp->rlim_max)
-               limp->rlim_cur = limp->rlim_max;
-       if (p->p_limit->p_refcnt > 1 &&
-           (p->p_limit->p_lflags & PL_SHAREMOD) == 0) {
-               p->p_limit->p_refcnt--;
-               p->p_limit = limcopy(p->p_limit);
-               alimp = &p->p_rlimit[which];
        }
 
        }
 
+       proc_limitblock(p);
+
+       if ((error = proc_limitreplace(p)) != 0) {
+               proc_limitunblock(p);
+               return(error);
+       }
+
+       alimp = &p->p_rlimit[which];
+       
        switch (which) {
 
        switch (which) {
 
+       case RLIMIT_CPU:
+               if (limp->rlim_cur == RLIM_INFINITY) {
+                       task_vtimer_clear(p->task, TASK_VTIMER_RLIM);
+                       timerclear(&p->p_rlim_cpu);
+               }
+               else {
+                       task_absolutetime_info_data_t   tinfo;
+                       mach_msg_type_number_t                  count;
+                       struct timeval                                  ttv, tv;
+
+                       count = TASK_ABSOLUTETIME_INFO_COUNT;
+                       task_info(p->task, TASK_ABSOLUTETIME_INFO,
+                                                               (task_info_t)&tinfo, &count);
+                       absolutetime_to_microtime(tinfo.total_user + tinfo.total_system,
+                                                               (uint32_t *) &ttv.tv_sec, (uint32_t *) &ttv.tv_usec);
+
+                       tv.tv_sec = (limp->rlim_cur > __INT_MAX__ ? __INT_MAX__ : limp->rlim_cur);
+                       tv.tv_usec = 0;
+                       timersub(&tv, &ttv, &p->p_rlim_cpu);
+
+                       timerclear(&tv);
+                       if (timercmp(&p->p_rlim_cpu, &tv, >))
+                               task_vtimer_set(p->task, TASK_VTIMER_RLIM);
+                       else {
+                               task_vtimer_clear(p->task, TASK_VTIMER_RLIM);
+
+                               timerclear(&p->p_rlim_cpu);
+
+                               psignal(p, SIGXCPU);
+                       }
+               }
+               break;
+
        case RLIMIT_DATA:
                if (limp->rlim_cur > maxdmap)
                        limp->rlim_cur = maxdmap;
        case RLIMIT_DATA:
                if (limp->rlim_cur > maxdmap)
                        limp->rlim_cur = maxdmap;
@@ -300,55 +617,162 @@ dosetrlimit(p, which, limp)
                break;
 
        case RLIMIT_STACK:
                break;
 
        case RLIMIT_STACK:
-               if (limp->rlim_cur > maxsmap)
-                       limp->rlim_cur = maxsmap;
-               if (limp->rlim_max > maxsmap)
-                       limp->rlim_max = maxsmap;
+               /* Disallow illegal stack size instead of clipping */
+               if (limp->rlim_cur > maxsmap ||
+                   limp->rlim_max > maxsmap) {
+                       if (posix) {
+                               error = EINVAL;
+                               goto out;
+                       }
+                       else {
+                               /* 
+                                * 4797860 - workaround poorly written installers by 
+                                * doing previous implementation (< 10.5) when caller 
+                                * is non-POSIX conforming.
+                                */
+                               if (limp->rlim_cur > maxsmap) 
+                                       limp->rlim_cur = maxsmap;
+                               if (limp->rlim_max > maxsmap) 
+                                       limp->rlim_max = maxsmap;
+                       }
+               }
+
                /*
                 * Stack is allocated to the max at exec time with only
                 * "rlim_cur" bytes accessible.  If stack limit is going
                 * up make more accessible, if going down make inaccessible.
                 */
                /*
                 * Stack is allocated to the max at exec time with only
                 * "rlim_cur" bytes accessible.  If stack limit is going
                 * up make more accessible, if going down make inaccessible.
                 */
-               if (limp->rlim_cur != alimp->rlim_cur) {
+               if (limp->rlim_cur > alimp->rlim_cur) {
                        user_addr_t addr;
                        user_size_t size;
                        
                        user_addr_t addr;
                        user_size_t size;
                        
-                       if (limp->rlim_cur > alimp->rlim_cur) {
                                /* grow stack */
                                size = round_page_64(limp->rlim_cur);
                                size -= round_page_64(alimp->rlim_cur);
 
 #if STACK_GROWTH_UP
                                /* go to top of current stack */
                                /* grow stack */
                                size = round_page_64(limp->rlim_cur);
                                size -= round_page_64(alimp->rlim_cur);
 
 #if STACK_GROWTH_UP
                                /* go to top of current stack */
-                               addr = p->user_stack + alimp->rlim_cur;
-#else STACK_GROWTH_UP
-                               addr = p->user_stack - alimp->rlim_cur;
-                               addr -= size;
+                       addr = p->user_stack + round_page_64(alimp->rlim_cur);
+#else  /* STACK_GROWTH_UP */
+                       addr = p->user_stack - round_page_64(limp->rlim_cur);
 #endif /* STACK_GROWTH_UP */
 #endif /* STACK_GROWTH_UP */
-                               if (mach_vm_allocate(current_map(), 
-                                                    &addr, size,
-                                                    VM_FLAGS_FIXED) != KERN_SUCCESS)
-                                       return(EINVAL);
-                       } else {
+                       kr = mach_vm_protect(current_map(), 
+                                            addr, size,
+                                            FALSE, VM_PROT_DEFAULT);
+                       if (kr != KERN_SUCCESS) {
+                               error =  EINVAL;
+                               goto out;
+                       }
+               } else if (limp->rlim_cur < alimp->rlim_cur) {
+                       user_addr_t addr;
+                       user_size_t size;
+                       user_addr_t cur_sp;
+
                                /* shrink stack */
                                /* shrink stack */
+
+                       /*
+                        * First check if new stack limit would agree
+                        * with current stack usage.
+                        * Get the current thread's stack pointer...
+                        */
+                       cur_sp = thread_adjuserstack(current_thread(),
+                                                    0);
+#if STACK_GROWTH_UP
+                       if (cur_sp >= p->user_stack &&
+                           cur_sp < (p->user_stack +
+                                     round_page_64(alimp->rlim_cur))) {
+                               /* current stack pointer is in main stack */
+                               if (cur_sp >= (p->user_stack +
+                                              round_page_64(limp->rlim_cur))) {
+                                       /*
+                                        * New limit would cause
+                                        * current usage to be invalid:
+                                        * reject new limit.
+                                        */
+                                       error =  EINVAL;
+                                       goto out;
+                       }
+                       } else {
+                               /* not on the main stack: reject */
+                               error =  EINVAL;
+                               goto out;
+               }
+                                
+#else  /* STACK_GROWTH_UP */
+                       if (cur_sp <= p->user_stack &&
+                           cur_sp > (p->user_stack -
+                                     round_page_64(alimp->rlim_cur))) {
+                               /* stack pointer is in main stack */
+                               if (cur_sp <= (p->user_stack -
+                                              round_page_64(limp->rlim_cur))) {
+                                       /*
+                                        * New limit would cause
+                                        * current usage to be invalid:
+                                        * reject new limit.
+                                        */
+                                       error =  EINVAL;
+                                       goto out;
+                               }
+                       } else {
+                               /* not on the main stack: reject */
+                               error =  EINVAL;
+                               goto out;
+                       }
+#endif /* STACK_GROWTH_UP */
+                               
+                       size = round_page_64(alimp->rlim_cur);
+                       size -= round_page_64(limp->rlim_cur);
+
+#if STACK_GROWTH_UP
+                       addr = p->user_stack + round_page_64(limp->rlim_cur);
+#else  /* STACK_GROWTH_UP */
+                       addr = p->user_stack - round_page_64(alimp->rlim_cur);
+#endif /* STACK_GROWTH_UP */
+
+                       kr = mach_vm_protect(current_map(),
+                                            addr, size,
+                                            FALSE, VM_PROT_NONE);
+                       if (kr != KERN_SUCCESS) {
+                               error =  EINVAL;
+                               goto out;
                        }
                        }
+               } else {
+                       /* no change ... */
                }
                break;
 
        case RLIMIT_NOFILE:
                /* 
                }
                break;
 
        case RLIMIT_NOFILE:
                /* 
-               * Only root can set the maxfiles limits, as it is systemwide resource
+                * Only root can set the maxfiles limits, as it is
+                * systemwide resource.  If we are expecting POSIX behavior,
+                * instead of clamping the value, return EINVAL.  We do this
+                * because historically, people have been able to attempt to
+                * set RLIM_INFINITY to get "whatever the maximum is".
                */
                if ( is_suser() ) {
                */
                if ( is_suser() ) {
-                       if (limp->rlim_cur > maxfiles)
+                       if (limp->rlim_cur != alimp->rlim_cur &&
+                           limp->rlim_cur > (rlim_t)maxfiles) {
+                               if (posix) {
+                                       error =  EINVAL;
+                                       goto out;
+                               }
                                limp->rlim_cur = maxfiles;
                                limp->rlim_cur = maxfiles;
-                       if (limp->rlim_max > maxfiles)
+                       }
+                       if (limp->rlim_max != alimp->rlim_max &&
+                           limp->rlim_max > (rlim_t)maxfiles)
                                limp->rlim_max = maxfiles;
                }
                else {
                                limp->rlim_max = maxfiles;
                }
                else {
-                       if (limp->rlim_cur > maxfilesperproc)
+                       if (limp->rlim_cur != alimp->rlim_cur &&
+                           limp->rlim_cur > (rlim_t)maxfilesperproc) {
+                               if (posix) {
+                                       error =  EINVAL;
+                                       goto out;
+                               }
                                limp->rlim_cur = maxfilesperproc;
                                limp->rlim_cur = maxfilesperproc;
-                       if (limp->rlim_max > maxfilesperproc)
+                       }
+                       if (limp->rlim_max != alimp->rlim_max &&
+                           limp->rlim_max > (rlim_t)maxfilesperproc)
                                limp->rlim_max = maxfilesperproc;
                }
                break;
                                limp->rlim_max = maxfilesperproc;
                }
                break;
@@ -360,31 +784,53 @@ dosetrlimit(p, which, limp)
                 * maxprocperuid (presumably less than maxproc).
                 */
                if ( is_suser() ) {
                 * maxprocperuid (presumably less than maxproc).
                 */
                if ( is_suser() ) {
-                       if (limp->rlim_cur > maxproc)
+                       if (limp->rlim_cur > (rlim_t)maxproc)
                                limp->rlim_cur = maxproc;
                                limp->rlim_cur = maxproc;
-                       if (limp->rlim_max > maxproc)
+                       if (limp->rlim_max > (rlim_t)maxproc)
                                limp->rlim_max = maxproc;
                } 
                else {
                                limp->rlim_max = maxproc;
                } 
                else {
-                       if (limp->rlim_cur > maxprocperuid)
+                       if (limp->rlim_cur > (rlim_t)maxprocperuid)
                                limp->rlim_cur = maxprocperuid;
                                limp->rlim_cur = maxprocperuid;
-                       if (limp->rlim_max > maxprocperuid)
+                       if (limp->rlim_max > (rlim_t)maxprocperuid)
                                limp->rlim_max = maxprocperuid;
                }
                break;
                                limp->rlim_max = maxprocperuid;
                }
                break;
+
+       case RLIMIT_MEMLOCK:
+               /*
+                * Tell the Mach VM layer about the new limit value.
+                */
+
+               vm_map_set_user_wire_limit(current_map(), limp->rlim_cur);
+               break;
                
        } /* switch... */
                
        } /* switch... */
+       proc_lock(p);
        *alimp = *limp;
        *alimp = *limp;
-       return (0);
+       proc_unlock(p);
+       error = 0;
+out:
+       proc_limitunblock(p);
+       return (error);
 }
 
 /* ARGSUSED */
 int
 }
 
 /* ARGSUSED */
 int
-getrlimit(struct proc *p, register struct getrlimit_args *uap, __unused register_t *retval)
+getrlimit(struct proc *p, struct getrlimit_args *uap, __unused register_t *retval)
 {
 {
+       struct rlimit lim;
+
+       /*
+        * Take out flag now in case we need to use it to trigger variant
+        * behaviour later.
+        */
+       uap->which &= ~_RLIMIT_POSIX_FLAG;
+
        if (uap->which >= RLIM_NLIMITS)
                return (EINVAL);
        if (uap->which >= RLIM_NLIMITS)
                return (EINVAL);
-       return (copyout((caddr_t)&p->p_rlimit[uap->which],
+       proc_limitget(p, uap->which, &lim);
+       return (copyout((caddr_t)&lim,
                        uap->rlp, sizeof (struct rlimit)));
 }
 
                        uap->rlp, sizeof (struct rlimit)));
 }
 
@@ -392,12 +838,9 @@ getrlimit(struct proc *p, register struct getrlimit_args *uap, __unused register
  * Transform the running time and tick information in proc p into user,
  * system, and interrupt time usage.
  */
  * Transform the running time and tick information in proc p into user,
  * system, and interrupt time usage.
  */
+/* No lock on proc is held for this.. */
 void
 void
-calcru(p, up, sp, ip)
-       register struct proc *p;
-       register struct timeval *up;
-       register struct timeval *sp;
-       register struct timeval *ip;
+calcru(struct proc *p, struct timeval *up, struct timeval *sp, struct timeval *ip)
 {
        task_t                  task;
 
 {
        task_t                  task;
 
@@ -410,12 +853,12 @@ calcru(p, up, sp, ip)
        if (task) {
                task_basic_info_data_t tinfo;
                task_thread_times_info_data_t ttimesinfo;
        if (task) {
                task_basic_info_data_t tinfo;
                task_thread_times_info_data_t ttimesinfo;
-               int task_info_stuff, task_ttimes_stuff;
+               mach_msg_type_number_t task_info_stuff, task_ttimes_stuff;
                struct timeval ut,st;
 
                task_info_stuff = TASK_BASIC_INFO_COUNT;
                task_info(task, TASK_BASIC_INFO,
                struct timeval ut,st;
 
                task_info_stuff = TASK_BASIC_INFO_COUNT;
                task_info(task, TASK_BASIC_INFO,
-                         &tinfo, &task_info_stuff);
+                         (task_info_t)&tinfo, &task_info_stuff);
                ut.tv_sec = tinfo.user_time.seconds;
                ut.tv_usec = tinfo.user_time.microseconds;
                st.tv_sec = tinfo.system_time.seconds;
                ut.tv_sec = tinfo.user_time.seconds;
                ut.tv_usec = tinfo.user_time.microseconds;
                st.tv_sec = tinfo.system_time.seconds;
@@ -425,7 +868,7 @@ calcru(p, up, sp, ip)
 
                task_ttimes_stuff = TASK_THREAD_TIMES_INFO_COUNT;
                task_info(task, TASK_THREAD_TIMES_INFO,
 
                task_ttimes_stuff = TASK_THREAD_TIMES_INFO_COUNT;
                task_info(task, TASK_THREAD_TIMES_INFO,
-                         &ttimesinfo, &task_ttimes_stuff);
+                         (task_info_t)&ttimesinfo, &task_ttimes_stuff);
 
                ut.tv_sec = ttimesinfo.user_time.seconds;
                ut.tv_usec = ttimesinfo.user_time.microseconds;
 
                ut.tv_sec = ttimesinfo.user_time.seconds;
                ut.tv_usec = ttimesinfo.user_time.microseconds;
@@ -440,24 +883,35 @@ __private_extern__ void munge_rusage(struct rusage *a_rusage_p, struct user_rusa
 
 /* ARGSUSED */
 int
 
 /* ARGSUSED */
 int
-getrusage(register struct proc *p, register struct getrusage_args *uap, __unused register_t *retval)
+getrusage(struct proc *p, struct getrusage_args *uap, __unused register_t *retval)
 {
        struct rusage *rup, rubuf;
        struct user_rusage rubuf64;
        size_t retsize = sizeof(rubuf);                 /* default: 32 bits */
        caddr_t retbuf = (caddr_t)&rubuf;               /* default: 32 bits */
 {
        struct rusage *rup, rubuf;
        struct user_rusage rubuf64;
        size_t retsize = sizeof(rubuf);                 /* default: 32 bits */
        caddr_t retbuf = (caddr_t)&rubuf;               /* default: 32 bits */
+       struct timeval utime;
+       struct timeval stime;
+
 
        switch (uap->who) {
        case RUSAGE_SELF:
 
        switch (uap->who) {
        case RUSAGE_SELF:
-               rup = &p->p_stats->p_ru;
-               calcru(p, &rup->ru_utime, &rup->ru_stime, NULL);
+               calcru(p, &utime, &stime, NULL);
                // LP64todo: proc struct should have 64 bit version of struct
                // LP64todo: proc struct should have 64 bit version of struct
+               proc_lock(p);
+               rup = &p->p_stats->p_ru;
+               rup->ru_utime = utime;
+               rup->ru_stime = stime;
+
                rubuf = *rup;
                rubuf = *rup;
+               proc_unlock(p);
+
                break;
 
        case RUSAGE_CHILDREN:
                break;
 
        case RUSAGE_CHILDREN:
+               proc_lock(p);
                rup = &p->p_stats->p_cru;
                rubuf = *rup;
                rup = &p->p_stats->p_cru;
                rubuf = *rup;
+               proc_unlock(p);
                break;
 
        default:
                break;
 
        default:
@@ -472,11 +926,10 @@ getrusage(register struct proc *p, register struct getrusage_args *uap, __unused
 }
 
 void
 }
 
 void
-ruadd(ru, ru2)
-       register struct rusage *ru, *ru2;
+ruadd(struct rusage *ru, struct rusage *ru2)
 {
 {
-       register long *ip, *ip2;
-       register int i;
+       long *ip, *ip2;
+       int i;
 
        timeradd(&ru->ru_utime, &ru2->ru_utime, &ru->ru_utime);
        timeradd(&ru->ru_stime, &ru2->ru_stime, &ru->ru_stime);
 
        timeradd(&ru->ru_utime, &ru2->ru_utime, &ru->ru_utime);
        timeradd(&ru->ru_stime, &ru2->ru_stime, &ru->ru_stime);
@@ -487,24 +940,195 @@ ruadd(ru, ru2)
                *ip++ += *ip2++;
 }
 
                *ip++ += *ip2++;
 }
 
-/*
- * Make a copy of the plimit structure.
- * We share these structures copy-on-write after fork,
- * and copy when a limit is changed.
- */
-struct plimit *
-limcopy(lim)
-       struct plimit *lim;
+void
+proc_limitget(proc_t p, int which, struct rlimit * limp)
+{
+       proc_list_lock();
+       limp->rlim_cur = p->p_rlimit[which].rlim_cur;
+       limp->rlim_max = p->p_rlimit[which].rlim_max;
+       proc_list_unlock();
+}
+
+
+void
+proc_limitdrop(proc_t p, int exiting)
+{
+       struct  plimit * freelim = NULL;
+       struct  plimit * freeoldlim = NULL;
+
+       proc_list_lock();
+
+       if (--p->p_limit->pl_refcnt == 0) { 
+               freelim = p->p_limit;
+               p->p_limit = NULL;
+       }
+       if ((exiting != 0) && (p->p_olimit != NULL) && (--p->p_olimit->pl_refcnt == 0)) {
+               freeoldlim =  p->p_olimit;
+               p->p_olimit = NULL;
+       }
+
+       proc_list_unlock();
+       if (freelim != NULL)
+               FREE_ZONE(freelim, sizeof *p->p_limit, M_PLIMIT);
+       if (freeoldlim != NULL)
+               FREE_ZONE(freeoldlim, sizeof *p->p_olimit, M_PLIMIT);
+}
+
+
+void
+proc_limitfork(proc_t parent, proc_t child)
 {
 {
-       register struct plimit *copy;
+       proc_list_lock();
+       child->p_limit = parent->p_limit;
+       child->p_limit->pl_refcnt++;
+       child->p_olimit = NULL;
+       proc_list_unlock();
+}
+
+void
+proc_limitblock(proc_t p)
+{
+       proc_lock(p);
+       while (p->p_lflag & P_LLIMCHANGE) {
+               p->p_lflag |= P_LLIMWAIT;
+               msleep(&p->p_olimit, &p->p_mlock, 0, "proc_limitblock", NULL);
+       }
+       p->p_lflag |= P_LLIMCHANGE;
+       proc_unlock(p);
+
+}
+
+
+void
+proc_limitunblock(proc_t p)
+{
+       proc_lock(p);
+       p->p_lflag &= ~P_LLIMCHANGE;
+       if (p->p_lflag & P_LLIMWAIT) {
+               p->p_lflag &= ~P_LLIMWAIT;
+               wakeup(&p->p_olimit);
+       }
+       proc_unlock(p);
+}
+
+/* This is called behind serialization provided by proc_limitblock/unlbock */
+int
+proc_limitreplace(proc_t p)
+{
+       struct plimit *copy;
+
+
+       proc_list_lock();
+
+       if (p->p_limit->pl_refcnt == 1) {
+               proc_list_unlock();
+               return(0);
+       }
+               
+       proc_list_unlock();
 
        MALLOC_ZONE(copy, struct plimit *,
 
        MALLOC_ZONE(copy, struct plimit *,
-                       sizeof(struct plimit), M_SUBPROC, M_WAITOK);
-       if (copy == NULL)
-               panic("limcopy");
-       bcopy(lim->pl_rlimit, copy->pl_rlimit,
+                       sizeof(struct plimit), M_PLIMIT, M_WAITOK);
+       if (copy == NULL) {
+               return(ENOMEM);
+       }
+
+       proc_list_lock();
+       bcopy(p->p_limit->pl_rlimit, copy->pl_rlimit,
            sizeof(struct rlimit) * RLIM_NLIMITS);
            sizeof(struct rlimit) * RLIM_NLIMITS);
-       copy->p_lflags = 0;
-       copy->p_refcnt = 1;
-       return (copy);
+       copy->pl_refcnt = 1;
+       /* hang on to reference to old till process exits */
+       p->p_olimit = p->p_limit;
+       p->p_limit = copy;
+       proc_list_unlock();
+
+       return(0);
+}
+
+
+/*
+ * iopolicysys
+ *
+ * Description:        System call MUX for use in manipulating I/O policy attributes of the current process or thread
+ *
+ * Parameters: cmd                             Policy command
+ *             arg                             Pointer to policy arguments
+ *
+ * Returns:    0                               Success
+ *             EINVAL                          Invalid command or invalid policy arguments
+ *
+ */
+int
+iopolicysys(__unused struct proc *p, __unused struct iopolicysys_args *uap, __unused register_t *retval)
+{
+       int     error = 0;
+       thread_t thread = THREAD_NULL;
+       int *policy;
+       struct uthread  *ut = NULL;
+       struct _iopol_param_t iop_param;
+
+       if ((error = copyin(uap->arg, &iop_param, sizeof(iop_param))) != 0)
+               goto exit;
+
+       if (iop_param.iop_iotype != IOPOL_TYPE_DISK) {
+               error = EINVAL;
+               goto exit;
+       }
+
+       switch (iop_param.iop_scope) {
+       case IOPOL_SCOPE_PROCESS:
+               policy = &p->p_iopol_disk;
+               break;
+       case IOPOL_SCOPE_THREAD:
+               thread = current_thread();
+               ut = get_bsdthread_info(thread);
+               policy = &ut->uu_iopol_disk;
+               break;
+       default:
+               error = EINVAL;
+               goto exit;
+       }
+               
+       switch(uap->cmd) {
+       case IOPOL_CMD_SET:
+               switch (iop_param.iop_policy) {
+               case IOPOL_DEFAULT:
+               case IOPOL_NORMAL:
+               case IOPOL_THROTTLE:
+               case IOPOL_PASSIVE:
+                       proc_lock(p);
+                       *policy = iop_param.iop_policy;
+                       proc_unlock(p);
+                       break;
+               default:
+                       error = EINVAL;
+                       goto exit;
+               }
+               break;
+       case IOPOL_CMD_GET:
+               switch (*policy) {
+               case IOPOL_DEFAULT:
+               case IOPOL_NORMAL:
+               case IOPOL_THROTTLE:
+               case IOPOL_PASSIVE:
+                       iop_param.iop_policy = *policy;
+                       break;
+               default: // in-kernel 
+                       // this should never happen
+                       printf("%s: unknown I/O policy %d\n", __func__, *policy);
+                       // restore to default value
+                       *policy = IOPOL_DEFAULT;
+                       iop_param.iop_policy = *policy;
+               }
+               
+               error = copyout((caddr_t)&iop_param, uap->arg, sizeof(iop_param));
+               break;
+       default:
+               error = EINVAL; // unknown command
+               break;
+       }
+
+  exit:
+       *retval = error;
+       return (error);
 }
 }