+#include <kern/policy_internal.h>
+#include <kern/exc_guard.h>
+
+#include <vm/vm_protos.h>
+
+#include <pexpert/pexpert.h>
+
+#if SYSV_SHM
+#include <sys/shm_internal.h> /* shmexit */
+#endif /* SYSV_SHM */
+#if CONFIG_PERSONAS
+#include <sys/persona.h>
+#endif /* CONFIG_PERSONAS */
+#if CONFIG_MEMORYSTATUS
+#include <sys/kern_memorystatus.h>
+#endif /* CONFIG_MEMORYSTATUS */
+#if CONFIG_DTRACE
+/* Do not include dtrace.h, it redefines kmem_[alloc/free] */
+void dtrace_proc_exit(proc_t p);
+#include <sys/dtrace_ptss.h>
+#endif /* CONFIG_DTRACE */
+#if CONFIG_MACF
+#include <security/mac_framework.h>
+#include <security/mac_mach_internal.h>
+#include <sys/syscall.h>
+#endif /* CONFIG_MACF */
+
+void proc_prepareexit(proc_t p, int rv, boolean_t perf_notify);
+void gather_populate_corpse_crashinfo(proc_t p, task_t corpse_task,
+ mach_exception_data_type_t code, mach_exception_data_type_t subcode,
+ uint64_t *udata_buffer, int num_udata, void *reason);
+mach_exception_data_type_t proc_encode_exit_exception_code(proc_t p);
+void vfork_exit(proc_t p, int rv);
+__private_extern__ void munge_user64_rusage(struct rusage *a_rusage_p, struct user64_rusage *a_user_rusage_p);
+__private_extern__ void munge_user32_rusage(struct rusage *a_rusage_p, struct user32_rusage *a_user_rusage_p);
+static int reap_child_locked(proc_t parent, proc_t child, int deadparent, int reparentedtoinit, int locked, int droplock);
+static void populate_corpse_crashinfo(proc_t p, task_t corpse_task,
+ struct rusage_superset *rup, mach_exception_data_type_t code,
+ mach_exception_data_type_t subcode, uint64_t *udata_buffer,
+ int num_udata, os_reason_t reason);
+static void proc_update_corpse_exception_codes(proc_t p, mach_exception_data_type_t *code, mach_exception_data_type_t *subcode);
+extern int proc_pidpathinfo_internal(proc_t p, uint64_t arg, char *buffer, uint32_t buffersize, int32_t *retval);
+static __attribute__((noinline)) void launchd_crashed_panic(proc_t p, int rv);
+extern void proc_piduniqidentifierinfo(proc_t p, struct proc_uniqidentifierinfo *p_uniqidinfo);
+extern void task_coalition_ids(task_t task, uint64_t ids[COALITION_NUM_TYPES]);
+extern uint64_t get_task_phys_footprint_limit(task_t);
+int proc_list_uptrs(void *p, uint64_t *udata_buffer, int size);
+extern uint64_t task_corpse_get_crashed_thread_id(task_t corpse_task);
+
+
+/*
+ * Things which should have prototypes in headers, but don't
+ */
+void proc_exit(proc_t p);
+int wait1continue(int result);
+int waitidcontinue(int result);
+kern_return_t sys_perf_notify(thread_t thread, int pid);
+kern_return_t task_exception_notify(exception_type_t exception,
+ mach_exception_data_type_t code, mach_exception_data_type_t subcode);
+kern_return_t task_violated_guard(mach_exception_code_t, mach_exception_subcode_t, void *);
+void delay(int);
+void gather_rusage_info(proc_t p, rusage_info_current *ru, int flavor);
+
+/*
+ * NOTE: Source and target may *NOT* overlap!
+ * XXX Should share code with bsd/dev/ppc/unix_signal.c
+ */
+void
+siginfo_user_to_user32(user_siginfo_t *in, user32_siginfo_t *out)
+{
+ out->si_signo = in->si_signo;
+ out->si_errno = in->si_errno;
+ out->si_code = in->si_code;
+ out->si_pid = in->si_pid;
+ out->si_uid = in->si_uid;
+ out->si_status = in->si_status;
+ out->si_addr = CAST_DOWN_EXPLICIT(user32_addr_t,in->si_addr);
+ /* following cast works for sival_int because of padding */
+ out->si_value.sival_ptr = CAST_DOWN_EXPLICIT(user32_addr_t,in->si_value.sival_ptr);
+ out->si_band = in->si_band; /* range reduction */
+}
+
+void
+siginfo_user_to_user64(user_siginfo_t *in, user64_siginfo_t *out)
+{
+ out->si_signo = in->si_signo;
+ out->si_errno = in->si_errno;
+ out->si_code = in->si_code;
+ out->si_pid = in->si_pid;
+ out->si_uid = in->si_uid;
+ out->si_status = in->si_status;
+ out->si_addr = in->si_addr;
+ /* following cast works for sival_int because of padding */
+ out->si_value.sival_ptr = in->si_value.sival_ptr;
+ out->si_band = in->si_band; /* range reduction */
+}
+
+static int
+copyoutsiginfo(user_siginfo_t *native, boolean_t is64, user_addr_t uaddr)
+{
+ if (is64) {
+ user64_siginfo_t sinfo64;
+
+ bzero(&sinfo64, sizeof (sinfo64));
+ siginfo_user_to_user64(native, &sinfo64);
+ return (copyout(&sinfo64, uaddr, sizeof (sinfo64)));
+ } else {
+ user32_siginfo_t sinfo32;
+
+ bzero(&sinfo32, sizeof (sinfo32));
+ siginfo_user_to_user32(native, &sinfo32);
+ return (copyout(&sinfo32, uaddr, sizeof (sinfo32)));
+ }
+}
+
+void gather_populate_corpse_crashinfo(proc_t p, task_t corpse_task,
+ mach_exception_data_type_t code, mach_exception_data_type_t subcode,
+ uint64_t *udata_buffer, int num_udata, void *reason)
+{
+ struct rusage_superset rup;
+
+ gather_rusage_info(p, &rup.ri, RUSAGE_INFO_CURRENT);
+ rup.ri.ri_phys_footprint = 0;
+ populate_corpse_crashinfo(p, corpse_task, &rup, code, subcode,
+ udata_buffer, num_udata, reason);
+}
+
+static void proc_update_corpse_exception_codes(proc_t p, mach_exception_data_type_t *code, mach_exception_data_type_t *subcode)
+{
+ mach_exception_data_type_t code_update = *code;
+ mach_exception_data_type_t subcode_update = *subcode;
+ if (p->p_exit_reason == OS_REASON_NULL) {
+ return;
+ }
+
+ switch (p->p_exit_reason->osr_namespace) {
+ case OS_REASON_JETSAM:
+ if (p->p_exit_reason->osr_code == JETSAM_REASON_MEMORY_PERPROCESSLIMIT) {
+ /* Update the code with EXC_RESOURCE code for high memory watermark */
+ EXC_RESOURCE_ENCODE_TYPE(code_update, RESOURCE_TYPE_MEMORY);
+ EXC_RESOURCE_ENCODE_FLAVOR(code_update, FLAVOR_HIGH_WATERMARK);
+ EXC_RESOURCE_HWM_ENCODE_LIMIT(code_update, ((get_task_phys_footprint_limit(p->task)) >> 20));
+ subcode_update = 0;
+ break;
+ }
+
+ break;
+ default:
+ break;
+ }
+
+ *code = code_update;
+ *subcode = subcode_update;
+ return;
+}
+
+mach_exception_data_type_t proc_encode_exit_exception_code(proc_t p)
+{
+ uint64_t subcode = 0;
+
+ if (p->p_exit_reason == OS_REASON_NULL) {
+ return 0;
+ }
+
+ /* Embed first 32 bits of osr_namespace and osr_code in exception code */
+ ENCODE_OSR_NAMESPACE_TO_MACH_EXCEPTION_CODE(subcode, p->p_exit_reason->osr_namespace);
+ ENCODE_OSR_CODE_TO_MACH_EXCEPTION_CODE(subcode, p->p_exit_reason->osr_code);
+ return (mach_exception_data_type_t)subcode;
+}
+
+static void
+populate_corpse_crashinfo(proc_t p, task_t corpse_task, struct rusage_superset *rup,
+ mach_exception_data_type_t code, mach_exception_data_type_t subcode,
+ uint64_t *udata_buffer, int num_udata, os_reason_t reason)
+{
+ mach_vm_address_t uaddr = 0;
+ mach_exception_data_type_t exc_codes[EXCEPTION_CODE_MAX];
+ exc_codes[0] = code;
+ exc_codes[1] = subcode;
+ cpu_type_t cputype;
+ struct proc_uniqidentifierinfo p_uniqidinfo;
+ struct proc_workqueueinfo pwqinfo;
+ int retval = 0;
+ uint64_t crashed_threadid = task_corpse_get_crashed_thread_id(corpse_task);
+ unsigned int pflags = 0;
+ uint64_t max_footprint_mb;
+ uint64_t max_footprint;
+ void *crash_info_ptr = task_get_corpseinfo(corpse_task);
+
+#if CONFIG_MEMORYSTATUS
+ int memstat_dirty_flags = 0;
+#endif
+
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_EXCEPTION_CODES, sizeof(exc_codes), &uaddr)) {
+ kcdata_memcpy(crash_info_ptr, uaddr, exc_codes, sizeof(exc_codes));
+ }
+
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_PID, sizeof(p->p_pid), &uaddr)) {
+ kcdata_memcpy(crash_info_ptr, uaddr, &p->p_pid, sizeof(p->p_pid));
+ }
+
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_PPID, sizeof(p->p_ppid), &uaddr)) {
+ kcdata_memcpy(crash_info_ptr, uaddr, &p->p_ppid, sizeof(p->p_ppid));
+ }
+
+ /* Don't include the crashed thread ID if there's an exit reason that indicates it's irrelevant */
+ if ((p->p_exit_reason == OS_REASON_NULL) || !(p->p_exit_reason->osr_flags & OS_REASON_FLAG_NO_CRASHED_TID)) {
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_CRASHED_THREADID, sizeof(uint64_t), &uaddr)) {
+ kcdata_memcpy(crash_info_ptr, uaddr, &crashed_threadid, sizeof(uint64_t));
+ }
+ }
+
+ if (KERN_SUCCESS ==
+ kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_BSDINFOWITHUNIQID, sizeof(struct proc_uniqidentifierinfo), &uaddr)) {
+ proc_piduniqidentifierinfo(p, &p_uniqidinfo);
+ kcdata_memcpy(crash_info_ptr, uaddr, &p_uniqidinfo, sizeof(struct proc_uniqidentifierinfo));
+ }
+
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_RUSAGE_INFO, sizeof(rusage_info_current), &uaddr)) {
+ kcdata_memcpy(crash_info_ptr, uaddr, &rup->ri, sizeof(rusage_info_current));
+ }
+
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_PROC_CSFLAGS, sizeof(p->p_csflags), &uaddr)) {
+ kcdata_memcpy(crash_info_ptr, uaddr, &p->p_csflags, sizeof(p->p_csflags));
+ }
+
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_PROC_NAME, sizeof(p->p_comm), &uaddr)) {
+ kcdata_memcpy(crash_info_ptr, uaddr, &p->p_comm, sizeof(p->p_comm));
+ }
+
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_PROC_STARTTIME, sizeof(p->p_start), &uaddr)) {
+ struct timeval64 t64;
+ t64.tv_sec = (int64_t)p->p_start.tv_sec;
+ t64.tv_usec = (int64_t)p->p_start.tv_usec;
+ kcdata_memcpy(crash_info_ptr, uaddr, &t64, sizeof(t64));
+ }
+
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_USERSTACK, sizeof(p->user_stack), &uaddr)) {
+ kcdata_memcpy(crash_info_ptr, uaddr, &p->user_stack, sizeof(p->user_stack));
+ }
+
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_ARGSLEN, sizeof(p->p_argslen), &uaddr)) {
+ kcdata_memcpy(crash_info_ptr, uaddr, &p->p_argslen, sizeof(p->p_argslen));
+ }
+
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_PROC_ARGC, sizeof(p->p_argc), &uaddr)) {
+ kcdata_memcpy(crash_info_ptr, uaddr, &p->p_argc, sizeof(p->p_argc));
+ }
+
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_PROC_PATH, MAXPATHLEN, &uaddr)) {
+ char *buf = (char *) kalloc(MAXPATHLEN);
+ if (buf != NULL) {
+ bzero(buf, MAXPATHLEN);
+ proc_pidpathinfo_internal(p, 0, buf, MAXPATHLEN, &retval);
+ kcdata_memcpy(crash_info_ptr, uaddr, buf, MAXPATHLEN);
+ kfree(buf, MAXPATHLEN);
+ }
+ }
+
+ pflags = p->p_flag & (P_LP64 | P_SUGID);
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_PROC_FLAGS, sizeof(pflags), &uaddr)) {
+ kcdata_memcpy(crash_info_ptr, uaddr, &pflags, sizeof(pflags));
+ }
+
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_UID, sizeof(p->p_uid), &uaddr)) {
+ kcdata_memcpy(crash_info_ptr, uaddr, &p->p_uid, sizeof(p->p_uid));
+ }
+
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_GID, sizeof(p->p_gid), &uaddr)) {
+ kcdata_memcpy(crash_info_ptr, uaddr, &p->p_gid, sizeof(p->p_gid));
+ }
+
+ cputype = cpu_type() & ~CPU_ARCH_MASK;
+ if (IS_64BIT_PROCESS(p))
+ cputype |= CPU_ARCH_ABI64;
+
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_CPUTYPE, sizeof(cpu_type_t), &uaddr)) {
+ kcdata_memcpy(crash_info_ptr, uaddr, &cputype, sizeof(cpu_type_t));
+ }
+
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_MEMORY_LIMIT, sizeof(max_footprint_mb), &uaddr)) {
+ max_footprint = get_task_phys_footprint_limit(p->task);
+ max_footprint_mb = max_footprint >> 20;
+ kcdata_memcpy(crash_info_ptr, uaddr, &max_footprint_mb, sizeof(max_footprint_mb));
+ }
+
+ bzero(&pwqinfo, sizeof(struct proc_workqueueinfo));
+ retval = fill_procworkqueue(p, &pwqinfo);
+ if (retval == 0) {
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_WORKQUEUEINFO, sizeof(struct proc_workqueueinfo), &uaddr)) {
+ kcdata_memcpy(crash_info_ptr, uaddr, &pwqinfo, sizeof(struct proc_workqueueinfo));
+ }
+ }
+
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_RESPONSIBLE_PID, sizeof(p->p_responsible_pid), &uaddr)) {
+ kcdata_memcpy(crash_info_ptr, uaddr, &p->p_responsible_pid, sizeof(p->p_responsible_pid));
+ }
+
+#if CONFIG_COALITIONS
+ if (KERN_SUCCESS == kcdata_get_memory_addr_for_array(crash_info_ptr, TASK_CRASHINFO_COALITION_ID, sizeof(uint64_t), COALITION_NUM_TYPES, &uaddr)) {
+ uint64_t coalition_ids[COALITION_NUM_TYPES];
+ task_coalition_ids(p->task, coalition_ids);
+ kcdata_memcpy(crash_info_ptr, uaddr, coalition_ids, sizeof(coalition_ids));
+ }
+#endif /* CONFIG_COALITIONS */
+
+#if CONFIG_MEMORYSTATUS
+ memstat_dirty_flags = memorystatus_dirty_get(p);
+ if (KERN_SUCCESS == kcdata_get_memory_addr(crash_info_ptr, TASK_CRASHINFO_DIRTY_FLAGS, sizeof(memstat_dirty_flags), &uaddr)) {
+ kcdata_memcpy(crash_info_ptr, uaddr, &memstat_dirty_flags, sizeof(memstat_dirty_flags));
+ }