1 PROC(4) File Formats and Configurations PROC(4) 2 3 4 5 NAME 6 proc - /proc, the process file system 7 8 DESCRIPTION 9 /proc is a file system that provides access to the state of each 10 process and light-weight process (lwp) in the system. The name of each 11 entry in the /proc directory is a decimal number corresponding to a 12 process-ID. These entries are themselves subdirectories. Access to 13 process state is provided by additional files contained within each 14 subdirectory; the hierarchy is described more completely below. In this 15 document, ``/proc file'' refers to a non-directory file within the 16 hierarchy rooted at /proc. The owner of each /proc file and 17 subdirectory is determined by the user-ID of the process. 18 19 20 /proc can be mounted on any mount point, in addition to the standard 21 /proc mount point, and can be mounted several places at once. Such 22 additional mounts are allowed in order to facilitate the confinement of 23 processes to subtrees of the file system via chroot(1M) and yet allow 24 such processes access to commands like ps(1). 25 26 27 Standard system calls are used to access /proc files: open(2), 28 close(2), read(2), and write(2) (including readv(2), writev(2), 29 pread(2), and pwrite(2)). Most files describe process state and can 30 only be opened for reading. ctl and lwpctl (control) files permit 31 manipulation of process state and can only be opened for writing. as 32 (address space) files contain the image of the running process and can 33 be opened for both reading and writing. An open for writing allows 34 process control; a read-only open allows inspection but not control. In 35 this document, we refer to the process as open for reading or writing 36 if any of its associated /proc files is open for reading or writing. 37 38 39 In general, more than one process can open the same /proc file at the 40 same time. Exclusive open is an advisory mechanism provided to allow 41 controlling processes to avoid collisions with each other. A process 42 can obtain exclusive control of a target process, with respect to other 43 cooperating processes, if it successfully opens any /proc file in the 44 target process for writing (the as or ctl files, or the lwpctl file of 45 any lwp) while specifying O_EXCL in the open(2). Such an open will fail 46 if the target process is already open for writing (that is, if an as, 47 ctl, or lwpctl file is already open for writing). There can be any 48 number of concurrent read-only opens; O_EXCL is ignored on opens for 49 reading. It is recommended that the first open for writing by a 50 controlling process use the O_EXCL flag; multiple controlling processes 51 usually result in chaos. 52 53 54 If a process opens one of its own /proc files for writing, the open 55 succeeds regardless of O_EXCL and regardless of whether some other 56 process has the process open for writing. Self-opens do not count when 57 another process attempts an exclusive open. (A process cannot exclude a 58 debugger by opening itself for writing and the application of a 59 debugger cannot prevent a process from opening itself.) All self-opens 60 for writing are forced to be close-on-exec (see the F_SETFD operation 61 of fcntl(2)). 62 63 64 Data may be transferred from or to any locations in the address space 65 of the traced process by applying lseek(2) to position the as file at 66 the virtual address of interest followed by read(2) or write(2) (or by 67 using pread(2) or pwrite(2) for the combined operation). The address- 68 map files /proc/pid/map and /proc/pid/xmap can be read to determine the 69 accessible areas (mappings) of the address space. I/O transfers may 70 span contiguous mappings. An I/O request extending into an unmapped 71 area is truncated at the boundary. A write request beginning at an 72 unmapped virtual address fails with EIO; a read request beginning at an 73 unmapped virtual address returns zero (an end-of-file indication). 74 75 76 Information and control operations are provided through additional 77 files. <procfs.h> contains definitions of data structures and message 78 formats used with these files. Some of these definitions involve the 79 use of sets of flags. The set types sigset_t, fltset_t, and sysset_t 80 correspond, respectively, to signal, fault, and system call 81 enumerations defined in <sys/signal.h>, <sys/fault.h>, and 82 <sys/syscall.h>. Each set type is large enough to hold flags for its 83 own enumeration. Although they are of different sizes, they have a 84 common structure and can be manipulated by these macros: 85 86 prfillset(&set); /* turn on all flags in set */ 87 premptyset(&set); /* turn off all flags in set */ 88 praddset(&set, flag); /* turn on the specified flag */ 89 prdelset(&set, flag); /* turn off the specified flag */ 90 r = prismember(&set, flag); /* != 0 iff flag is turned on */ 91 92 93 94 One of prfillset() or premptyset() must be used to initialize set 95 before it is used in any other operation. flag must be a member of the 96 enumeration corresponding to set. 97 98 99 Every process contains at least one light-weight process, or lwp. Each 100 lwp represents a flow of execution that is independently scheduled by 101 the operating system. All lwps in a process share its address space as 102 well as many other attributes. Through the use of lwpctl and ctl files 103 as described below, it is possible to affect individual lwps in a 104 process or to affect all of them at once, depending on the operation. 105 106 107 When the process has more than one lwp, a representative lwp is chosen 108 by the system for certain process status files and control operations. 109 The representative lwp is a stopped lwp only if all of the process's 110 lwps are stopped; is stopped on an event of interest only if all of the 111 lwps are so stopped (excluding PR_SUSPENDED lwps); is in a PR_REQUESTED 112 stop only if there are no other events of interest to be found; or, 113 failing everything else, is in a PR_SUSPENDED stop (implying that the 114 process is deadlocked). See the description of the status file for 115 definitions of stopped states. See the PCSTOP control operation for the 116 definition of ``event of interest''. 117 118 119 The representative lwp remains fixed (it will be chosen again on the 120 next operation) as long as all of the lwps are stopped on events of 121 interest or are in a PR_SUSPENDED stop and the PCRUN control operation 122 is not applied to any of them. 123 124 125 When applied to the process control file, every /proc control operation 126 that must act on an lwp uses the same algorithm to choose which lwp to 127 act upon. Together with synchronous stopping (see PCSET), this enables 128 a debugger to control a multiple-lwp process using only the process- 129 level status and control files if it so chooses. More fine-grained 130 control can be achieved using the lwp-specific files. 131 132 133 The system supports two process data models, the traditional 32-bit 134 data model in which ints, longs and pointers are all 32 bits wide (the 135 ILP32 data model), and on some platforms the 64-bit data model in which 136 longs and pointers, but not ints, are 64 bits in width (the LP64 data 137 model). In the LP64 data model some system data types, notably size_t, 138 off_t, time_t and dev_t, grow from 32 bits to 64 bits as well. 139 140 141 The /proc interfaces described here are available to both 32-bit and 142 64-bit controlling processes. However, many operations attempted by a 143 32-bit controlling process on a 64-bit target process will fail with 144 EOVERFLOW because the address space range of a 32-bit process cannot 145 encompass a 64-bit process or because the data in some 64-bit system 146 data type cannot be compressed to fit into the corresponding 32-bit 147 type without loss of information. Operations that fail in this 148 circumstance include reading and writing the address space, reading the 149 address-map files, and setting the target process's registers. There is 150 no restriction on operations applied by a 64-bit process to either a 151 32-bit or a 64-bit target processes. 152 153 154 The format of the contents of any /proc file depends on the data model 155 of the observer (the controlling process), not on the data model of the 156 target process. A 64-bit debugger does not have to translate the 157 information it reads from a /proc file for a 32-bit process from 32-bit 158 format to 64-bit format. However, it usually has to be aware of the 159 data model of the target process. The pr_dmodel field of the status 160 files indicates the target process's data model. 161 162 163 To help deal with system data structures that are read from 32-bit 164 processes, a 64-bit controlling program can be compiled with the C 165 preprocessor symbol _SYSCALL32 defined before system header files are 166 included. This makes explicit 32-bit fixed-width data structures (like 167 cstruct stat32) visible to the 64-bit program. See types32.h(3HEAD). 168 169 DIRECTORY STRUCTURE 170 At the top level, the directory /proc contains entries each of which 171 names an existing process in the system. These entries are themselves 172 directories. Except where otherwise noted, the files described below 173 can be opened for reading only. In addition, if a process becomes a 174 zombie (one that has exited but whose parent has not yet performed a 175 wait(3C) upon it), most of its associated /proc files disappear from 176 the hierarchy; subsequent attempts to open them, or to read or write 177 files opened before the process exited, will elicit the error ENOENT. 178 179 180 Although process state and consequently the contents of /proc files can 181 change from instant to instant, a single read(2) of a /proc file is 182 guaranteed to return a sane representation of state; that is, the read 183 will be atomic with respect to the state of the process. No such 184 guarantee applies to successive reads applied to a /proc file for a 185 running process. In addition, atomicity is not guaranteed for I/O 186 applied to the as (address-space) file for a running process or for a 187 process whose address space contains memory shared by another running 188 process. 189 190 191 A number of structure definitions are used to describe the files. These 192 structures may grow by the addition of elements at the end in future 193 releases of the system and it is not legitimate for a program to assume 194 that they will not. 195 196 STRUCTURE OF /proc/pid 197 A given directory /proc/pid contains the following entries. A process 198 can use the invisible alias /proc/self if it wishes to open one of its 199 own /proc files (invisible in the sense that the name ``self'' does not 200 appear in a directory listing of /proc obtained from ls(1), 201 getdents(2), or readdir(3C)). 202 203 contracts 204 A directory containing references to the contracts held by the process. 205 Each entry is a symlink to the contract's directory under 206 /system/contract. See contract(4). 207 208 as 209 Contains the address-space image of the process; it can be opened for 210 both reading and writing. lseek(2) is used to position the file at the 211 virtual address of interest and then the address space can be examined 212 or changed through read(2) or write(2) (or by using pread(2) or 213 pwrite(2) for the combined operation). 214 215 ctl 216 A write-only file to which structured messages are written directing 217 the system to change some aspect of the process's state or control its 218 behavior in some way. The seek offset is not relevant when writing to 219 this file. Individual lwps also have associated lwpctl files in the lwp 220 subdirectories. A control message may be written either to the 221 process's ctl file or to a specific lwpctl file with operation-specific 222 effects. The effect of a control message is immediately reflected in 223 the state of the process visible through appropriate status and 224 information files. The types of control messages are described in 225 detail later. See CONTROL MESSAGES. 226 227 status 228 Contains state information about the process and the representative 229 lwp. The file contains a pstatus structure which contains an embedded 230 lwpstatus structure for the representative lwp, as follows: 231 232 typedef struct pstatus { 233 int pr_flags; /* flags (see below) */ 234 int pr_nlwp; /* number of active lwps in the process */ 235 int pr_nzomb; /* number of zombie lwps in the process */ 236 pid_tpr_pid; /* process id */ 237 pid_tpr_ppid; /* parent process id */ 238 pid_tpr_pgid; /* process group id */ 239 pid_tpr_sid; /* session id */ 240 id_t pr_aslwpid; /* obsolete */ 241 id_t pr_agentid; /* lwp-id of the agent lwp, if any */ 242 sigset_t pr_sigpend; /* set of process pending signals */ 243 uintptr_t pr_brkbase; /* virtual address of the process heap */ 244 size_t pr_brksize; /* size of the process heap, in bytes */ 245 uintptr_t pr_stkbase; /* virtual address of the process stack */ 246 size_tpr_stksize; /* size of the process stack, in bytes */ 247 timestruc_t pr_utime; /* process user cpu time */ 248 timestruc_t pr_stime; /* process system cpu time */ 249 timestruc_t pr_cutime; /* sum of children's user times */ 250 timestruc_t pr_cstime; /* sum of children's system times */ 251 sigset_t pr_sigtrace; /* set of traced signals */ 252 fltset_t pr_flttrace; /* set of traced faults */ 253 sysset_t pr_sysentry; /* set of system calls traced on entry */ 254 sysset_t pr_sysexit; /* set of system calls traced on exit */ 255 char pr_dmodel; /* data model of the process */ 256 taskid_t pr_taskid; /* task id */ 257 projid_t pr_projid; /* project id */ 258 zoneid_t pr_zoneid; /* zone id */ 259 lwpstatus_t pr_lwp; /* status of the representative lwp */ 260 } pstatus_t; 261 262 263 264 pr_flags is a bit-mask holding the following process flags. For 265 convenience, it also contains the lwp flags for the representative lwp, 266 described later. 267 268 PR_ISSYS 269 process is a system process (see PCSTOP). 270 271 272 PR_VFORKP 273 process is the parent of a vforked child (see PCWATCH). 274 275 276 PR_FORK 277 process has its inherit-on-fork mode set (see PCSET). 278 279 280 PR_RLC 281 process has its run-on-last-close mode set (see PCSET). 282 283 284 PR_KLC 285 process has its kill-on-last-close mode set (see PCSET). 286 287 288 PR_ASYNC 289 process has its asynchronous-stop mode set (see PCSET). 290 291 292 PR_MSACCT 293 Set by default in all processes to indicate that 294 microstate accounting is enabled. However, this flag has 295 been deprecated and no longer has any effect. Microstate 296 accounting may not be disabled; however, it is still 297 possible to toggle the flag. 298 299 300 PR_MSFORK 301 Set by default in all processes to indicate that 302 microstate accounting will be enabled for processes that 303 this parent forks(). However, this flag has been 304 deprecated and no longer has any effect. It is possible to 305 toggle this flag; however, it is not possible to disable 306 microstate accounting. 307 308 309 PR_BPTADJ 310 process has its breakpoint adjustment mode set (see 311 PCSET). 312 313 314 PR_PTRACE 315 process has its ptrace-compatibility mode set (see PCSET). 316 317 318 319 pr_nlwp is the total number of active lwps in the process. pr_nzomb is 320 the total number of zombie lwps in the process. A zombie lwp is a non- 321 detached lwp that has terminated but has not been reaped with 322 thr_join(3C) or pthread_join(3C). 323 324 325 pr_pid, pr_ppid, pr_pgid, and pr_sid are, respectively, the process ID, 326 the ID of the process's parent, the process's process group ID, and the 327 process's session ID. 328 329 330 pr_aslwpid is obsolete and is always zero. 331 332 333 pr_agentid is the lwp-ID for the /proc agent lwp (see the PCAGENT 334 control operation). It is zero if there is no agent lwp in the process. 335 336 337 pr_sigpend identifies asynchronous signals pending for the process. 338 339 340 pr_brkbase is the virtual address of the process heap and pr_brksize is 341 its size in bytes. The address formed by the sum of these values is the 342 process break (see brk(2)). pr_stkbase and pr_stksize are, 343 respectively, the virtual address of the process stack and its size in 344 bytes. (Each lwp runs on a separate stack; the distinguishing 345 characteristic of the process stack is that the operating system will 346 grow it when necessary.) 347 348 349 pr_utime, pr_stime, pr_cutime, and pr_cstime are, respectively, the 350 user CPU and system CPU time consumed by the process, and the 351 cumulative user CPU and system CPU time consumed by the process's 352 children, in seconds and nanoseconds. 353 354 355 pr_sigtrace and pr_flttrace contain, respectively, the set of signals 356 and the set of hardware faults that are being traced (see PCSTRACE and 357 PCSFAULT). 358 359 360 pr_sysentry and pr_sysexit contain, respectively, the sets of system 361 calls being traced on entry and exit (see PCSENTRY and PCSEXIT). 362 363 364 pr_dmodel indicates the data model of the process. Possible values are: 365 366 PR_MODEL_ILP32 367 process data model is ILP32. 368 369 370 PR_MODEL_LP64 371 process data model is LP64. 372 373 374 PR_MODEL_NATIVE 375 process data model is native. 376 377 378 379 The pr_taskid, pr_projid, and pr_zoneid fields contain respectively, 380 the numeric IDs of the task, project, and zone in which the process was 381 running. 382 383 384 The constant PR_MODEL_NATIVE reflects the data model of the controlling 385 process, that is, its value is PR_MODEL_ILP32 or PR_MODEL_LP64 386 according to whether the controlling process has been compiled as a 387 32-bit program or a 64-bit program, respectively. 388 389 390 pr_lwp contains the status information for the representative lwp: 391 392 typedef struct lwpstatus { 393 int pr_flags; /* flags (see below) */ 394 id_t pr_lwpid; /* specific lwp identifier */ 395 short pr_why; /* reason for lwp stop, if stopped */ 396 short pr_what; /* more detailed reason */ 397 short pr_cursig; /* current signal, if any */ 398 siginfo_t pr_info; /* info associated with signal or fault */ 399 sigset_t pr_lwppend; /* set of signals pending to the lwp */ 400 sigset_t pr_lwphold; /* set of signals blocked by the lwp */ 401 struct sigaction pr_action;/* signal action for current signal */ 402 stack_t pr_altstack; /* alternate signal stack info */ 403 uintptr_t pr_oldcontext; /* address of previous ucontext */ 404 short pr_syscall; /* system call number (if in syscall) */ 405 short pr_nsysarg; /* number of arguments to this syscall */ 406 int pr_errno; /* errno for failed syscall */ 407 long pr_sysarg[PRSYSARGS]; /* arguments to this syscall */ 408 long pr_rval1; /* primary syscall return value */ 409 long pr_rval2; /* second syscall return value, if any */ 410 char pr_clname[PRCLSZ]; /* scheduling class name */ 411 timestruc_t pr_tstamp; /* real-time time stamp of stop */ 412 timestruc_t pr_utime; /* lwp user cpu time */ 413 timestruc_t pr_stime; /* lwp system cpu time */ 414 uintptr_t pr_ustack; /* stack boundary data (stack_t) address */ 415 ulong_t pr_instr; /* current instruction */ 416 prgregset_t pr_reg; /* general registers */ 417 prfpregset_t pr_fpreg; /* floating-point registers */ 418 } lwpstatus_t; 419 420 421 422 pr_flags is a bit-mask holding the following lwp flags. For 423 convenience, it also contains the process flags, described previously. 424 425 PR_STOPPED 426 The lwp is stopped. 427 428 429 PR_ISTOP 430 The lwp is stopped on an event of interest (see PCSTOP). 431 432 433 PR_DSTOP 434 The lwp has a stop directive in effect (see PCSTOP). 435 436 437 PR_STEP 438 The lwp has a single-step directive in effect (see 439 PCRUN). 440 441 442 PR_ASLEEP 443 The lwp is in an interruptible sleep within a system 444 call. 445 446 447 PR_PCINVAL 448 The lwp's current instruction (pr_instr) is undefined. 449 450 451 PR_DETACH 452 This is a detached lwp (see pthread_create(3C) and 453 pthread_join(3C)). 454 455 456 PR_DAEMON 457 This is a daemon lwp (see pthread_create(3C)). 458 459 460 PR_ASLWP 461 This flag is obsolete and is never set. 462 463 464 PR_AGENT 465 This is the /proc agent lwp for the process. 466 467 468 469 pr_lwpid names the specific lwp. 470 471 472 pr_why and pr_what together describe, for a stopped lwp, the reason for 473 the stop. Possible values of pr_why and the associated pr_what are: 474 475 PR_REQUESTED 476 indicates that the stop occurred in response to a stop 477 directive, normally because PCSTOP was applied or 478 because another lwp stopped on an event of interest 479 and the asynchronous-stop flag (see PCSET) was not set 480 for the process. pr_what is unused in this case. 481 482 483 PR_SIGNALLED 484 indicates that the lwp stopped on receipt of a signal 485 (see PCSTRACE); pr_what holds the signal number that 486 caused the stop (for a newly-stopped lwp, the same 487 value is in pr_cursig). 488 489 490 PR_FAULTED 491 indicates that the lwp stopped on incurring a hardware 492 fault (see PCSFAULT); pr_what holds the fault number 493 that caused the stop. 494 495 496 PR_SYSENTRY 497 PR_SYSEXIT 498 indicate a stop on entry to or exit from a system call 499 (see PCSENTRY and PCSEXIT); pr_what holds the system 500 call number. 501 502 503 PR_JOBCONTROL 504 indicates that the lwp stopped due to the default 505 action of a job control stop signal (see 506 sigaction(2)); pr_what holds the stopping signal 507 number. 508 509 510 PR_SUSPENDED 511 indicates that the lwp stopped due to internal 512 synchronization of lwps within the process. pr_what is 513 unused in this case. 514 515 516 517 pr_cursig names the current signal, that is, the next signal to be 518 delivered to the lwp, if any. pr_info, when the lwp is in a 519 PR_SIGNALLED or PR_FAULTED stop, contains additional information 520 pertinent to the particular signal or fault (see <sys/siginfo.h>). 521 522 523 pr_lwppend identifies any synchronous or directed signals pending for 524 the lwp. pr_lwphold identifies those signals whose delivery is being 525 blocked by the lwp (the signal mask). 526 527 528 pr_action contains the signal action information pertaining to the 529 current signal (see sigaction(2)); it is undefined if pr_cursig is 530 zero. pr_altstack contains the alternate signal stack information for 531 the lwp (see sigaltstack(2)). 532 533 534 pr_oldcontext, if not zero, contains the address on the lwp stack of a 535 ucontext structure describing the previous user-level context (see 536 ucontext.h(3HEAD)). It is non-zero only if the lwp is executing in the 537 context of a signal handler. 538 539 540 pr_syscall is the number of the system call, if any, being executed by 541 the lwp; it is non-zero if and only if the lwp is stopped on 542 PR_SYSENTRY or PR_SYSEXIT, or is asleep within a system call ( 543 PR_ASLEEP is set). If pr_syscall is non-zero, pr_nsysarg is the number 544 of arguments to the system call and pr_sysarg contains the actual 545 arguments. 546 547 548 pr_rval1, pr_rval2, and pr_errno are defined only if the lwp is stopped 549 on PR_SYSEXIT or if the PR_VFORKP flag is set. If pr_errno is zero, 550 pr_rval1 and pr_rval2 contain the return values from the system call. 551 Otherwise, pr_errno contains the error number for the failing system 552 call (see <sys/errno.h>). 553 554 555 pr_clname contains the name of the lwp's scheduling class. 556 557 558 pr_tstamp, if the lwp is stopped, contains a time stamp marking when 559 the lwp stopped, in real time seconds and nanoseconds since an 560 arbitrary time in the past. 561 562 563 pr_utime is the amount of user level CPU time used by this LWP. 564 565 566 pr_stime is the amount of system level CPU time used by this LWP. 567 568 569 pr_ustack is the virtual address of the stack_t that contains the stack 570 boundaries for this LWP. See getustack(2) and _stack_grow(3C). 571 572 573 pr_instr contains the machine instruction to which the lwp's program 574 counter refers. The amount of data retrieved from the process is 575 machine-dependent. On SPARC based machines, it is a 32-bit word. On 576 x86-based machines, it is a single byte. In general, the size is that 577 of the machine's smallest instruction. If PR_PCINVAL is set, pr_instr 578 is undefined; this occurs whenever the lwp is not stopped or when the 579 program counter refers to an invalid virtual address. 580 581 582 pr_reg is an array holding the contents of a stopped lwp's general 583 registers. 584 585 SPARC 586 On SPARC-based machines, the predefined constants 587 R_G0 ... R_G7, R_O0 ... R_O7, R_L0 ... R_L7, R_I0 588 ... R_I7, R_PC, R_nPC, and R_Y can be used as 589 indices to refer to the corresponding registers; 590 previous register windows can be read from their 591 overflow locations on the stack (however, see the 592 gwindows file in the /proc/pid/lwp/lwpid 593 subdirectory). 594 595 596 SPARC V8 (32-bit) 597 For SPARC V8 (32-bit) controlling processes, the 598 predefined constants R_PSR, R_WIM, and R_TBR can 599 be used as indices to refer to the corresponding 600 special registers. For SPARC V9 (64-bit) 601 controlling processes, the predefined constants 602 R_CCR, R_ASI, and R_FPRS can be used as indices to 603 refer to the corresponding special registers. 604 605 606 x86 (32-bit) 607 For 32-bit x86 processes, the predefined constants 608 listed belowcan be used as indices to refer to the 609 corresponding registers. 610 611 SS 612 UESP 613 EFL 614 CS 615 EIP 616 ERR 617 TRAPNO 618 EAX 619 ECX 620 EDX 621 EBX 622 ESP 623 EBP 624 ESI 625 EDI 626 DS 627 ES 628 GS 629 630 The preceding constants are listed in 631 <sys/regset.h>. 632 633 Note that a 32-bit process can run on an x86 634 64-bit system, using the constants listed above. 635 636 637 x86 (64-bit) 638 To read the registers of a 32- or a 64-bit 639 process, a 64-bit x86 process should use the 640 predefined constants listed below. 641 642 REG_GSBASE 643 REG_FSBASE 644 REG_DS 645 REG_ES 646 REG_GS 647 REG_FS 648 REG_SS 649 REG_RSP 650 REG_RFL 651 REG_CS 652 REG_RIP 653 REG_ERR 654 REG_TRAPNO 655 REG_RAX 656 REG_RCX 657 REG_RDX 658 REG_RBX 659 REG_RBP 660 REG_RSI 661 REG_RDI 662 REG_R8 663 REG_R9 664 REG_R10 665 REG_R11 666 REG_R12 667 REG_R13 668 REG_R14 669 REG_R15 670 671 The preceding constants are listed in 672 <sys/regset.h>. 673 674 675 676 pr_fpreg is a structure holding the contents of the floating-point 677 registers. 678 679 680 SPARC registers, both general and floating-point, as seen by a 64-bit 681 controlling process are the V9 versions of the registers, even if the 682 target process is a 32-bit (V8) process. V8 registers are a subset of 683 the V9 registers. 684 685 686 If the lwp is not stopped, all register values are undefined. 687 688 psinfo 689 Contains miscellaneous information about the process and the 690 representative lwp needed by the ps(1) command. psinfo remains 691 accessible after a process becomes a zombie. The file contains a psinfo 692 structure which contains an embedded lwpsinfo structure for the 693 representative lwp, as follows: 694 695 typedef struct psinfo { 696 int pr_flag; /* process flags (DEPRECATED: see below) */ 697 int pr_nlwp; /* number of active lwps in the process */ 698 int pr_nzomb; /* number of zombie lwps in the process */ 699 pid_t pr_pid; /* process id */ 700 pid_t pr_ppid; /* process id of parent */ 701 pid_t pr_pgid; /* process id of process group leader */ 702 pid_t pr_sid; /* session id */ 703 uid_t pr_uid; /* real user id */ 704 uid_t pr_euid; /* effective user id */ 705 gid_t pr_gid; /* real group id */ 706 gid_t pr_egid; /* effective group id */ 707 uintptr_t pr_addr; /* address of process */ 708 size_t pr_size; /* size of process image in Kbytes */ 709 size_t pr_rssize; /* resident set size in Kbytes */ 710 dev_t pr_ttydev; /* controlling tty device (or PRNODEV) */ 711 ushort_t pr_pctcpu; /* % of recent cpu time used by all lwps */ 712 ushort_t pr_pctmem; /* % of system memory used by process */ 713 timestruc_t pr_start; /* process start time, from the epoch */ 714 timestruc_t pr_time; /* cpu time for this process */ 715 timestruc_t pr_ctime; /* cpu time for reaped children */ 716 char pr_fname[PRFNSZ]; /* name of exec'ed file */ 717 char pr_psargs[PRARGSZ]; /* initial characters of arg list */ 718 int pr_wstat; /* if zombie, the wait() status */ 719 int pr_argc; /* initial argument count */ 720 uintptr_t pr_argv; /* address of initial argument vector */ 721 uintptr_t pr_envp; /* address of initial environment vector */ 722 char pr_dmodel; /* data model of the process */ 723 taskid_t pr_taskid; /* task id */ 724 projid_t pr_projid; /* project id */ 725 poolid_t pr_poolid; /* pool id */ 726 zoneid_t pr_zoneid; /* zone id */ 727 ctid_t pr_contract; /* process contract id */ 728 lwpsinfo_t pr_lwp; /* information for representative lwp */ 729 } psinfo_t; 730 731 732 733 Some of the entries in psinfo, such as pr_addr, refer to internal 734 kernel data structures and should not be expected to retain their 735 meanings across different versions of the operating system. 736 737 738 psinfo_t.pr_flag is a deprecated interface that should no longer be 739 used. Applications currently relying on the SSYS bit in pr_flag should 740 migrate to checking PR_ISSYS in the pstatus structure's pr_flags field. 741 742 743 pr_pctcpu and pr_pctmem are 16-bit binary fractions in the range 0.0 to 744 1.0 with the binary point to the right of the high-order bit (1.0 == 745 0x8000). pr_pctcpu is the summation over all lwps in the process. 746 747 748 pr_lwp contains the ps(1) information for the representative lwp. If 749 the process is a zombie, pr_nlwp, pr_nzomb, and pr_lwp.pr_lwpid are 750 zero and the other fields of pr_lwp are undefined: 751 752 typedef struct lwpsinfo { 753 int pr_flag; /* lwp flags (DEPRECATED: see below) */ 754 id_t pr_lwpid; /* lwp id */ 755 uintptr_t pr_addr; /* internal address of lwp */ 756 uintptr_t pr_wchan; /* wait addr for sleeping lwp */ 757 char pr_stype; /* synchronization event type */ 758 char pr_state; /* numeric lwp state */ 759 char pr_sname; /* printable character for pr_state */ 760 char pr_nice; /* nice for cpu usage */ 761 short pr_syscall; /* system call number (if in syscall) */ 762 char pr_oldpri; /* pre-SVR4, low value is high priority */ 763 char pr_cpu; /* pre-SVR4, cpu usage for scheduling */ 764 int pr_pri; /* priority, high value = high priority */ 765 ushort_t pr_pctcpu; /* % of recent cpu time used by this lwp */ 766 timestruc_t pr_start; /* lwp start time, from the epoch */ 767 timestruc_t pr_time; /* cpu time for this lwp */ 768 char pr_clname[PRCLSZ]; /* scheduling class name */ 769 char pr_name[PRFNSZ]; /* name of system lwp */ 770 processorid_t pr_onpro; /* processor which last ran this lwp */ 771 processorid_t pr_bindpro;/* processor to which lwp is bound */ 772 psetid_t pr_bindpset; /* processor set to which lwp is bound */ 773 lgrp_id_t pr_lgrp /* home lgroup */ 774 } lwpsinfo_t; 775 776 777 778 Some of the entries in lwpsinfo, such as pr_addr, pr_wchan, pr_stype, 779 pr_state, and pr_name, refer to internal kernel data structures and 780 should not be expected to retain their meanings across different 781 versions of the operating system. 782 783 784 lwpsinfo_t.pr_flag is a deprecated interface that should no longer be 785 used. 786 787 788 pr_pctcpu is a 16-bit binary fraction, as described above. It 789 represents the CPU time used by the specific lwp. On a multi-processor 790 machine, the maximum value is 1/N, where N is the number of CPUs. 791 792 793 pr_contract is the id of the process contract of which the process is a 794 member. See contract(4) and process(4). 795 796 cred 797 Contains a description of the credentials associated with the process: 798 799 typedef struct prcred { 800 uid_t pr_euid; /* effective user id */ 801 uid_t pr_ruid; /* real user id */ 802 uid_t pr_suid; /* saved user id (from exec) */ 803 gid_t pr_egid; /* effective group id */ 804 gid_t pr_rgid; /* real group id */ 805 gid_t pr_sgid; /* saved group id (from exec) */ 806 int pr_ngroups; /* number of supplementary groups */ 807 gid_t pr_groups[1]; /* array of supplementary groups */ 808 } prcred_t; 809 810 811 812 813 The array of associated supplementary groups in pr_groups is of 814 variable length; the cred file contains all of the supplementary 815 groups. pr_ngroups indicates the number of supplementary groups. (See 816 also the PCSCRED and PCSCREDX control operations.) 817 818 priv 819 Contains a description of the privileges associated with the process: 820 821 typedef struct prpriv { 822 uint32_t pr_nsets; /* number of privilege set */ 823 uint32_t pr_setsize; /* size of privilege set */ 824 uint32_t pr_infosize; /* size of supplementary data */ 825 priv_chunk_t pr_sets[1]; /* array of sets */ 826 } prpriv_t; 827 828 829 830 The actual dimension of the pr_sets[] field is 831 832 pr_sets[pr_nsets][pr_setsize] 833 834 835 836 which is followed by additional information about the process state 837 pr_infosize bytes in size. 838 839 840 The full size of the structure can be computed using 841 PRIV_PRPRIV_SIZE(prpriv_t *). 842 843 secflags 844 This file contains the security-flags of the process. It contains a 845 description of the security flags associated with the process. 846 847 typedef struct prsecflags { 848 uint32_t pr_version; /* ABI Versioning of this structure */ 849 secflagset_t pr_effective; /* Effective flags */ 850 secflagset_t pr_inherit; /* Inheritable flags */ 851 secflagset_t pr_lower; /* Lower flags */ 852 secflagset_t pr_upper; /* Upper flags */ 853 } prsecflags_t; 854 855 856 857 The pr_version field is a version number for the structure, currently 858 PRSECFLAGS_VERSION_1. 859 860 sigact 861 Contains an array of sigaction structures describing the current 862 dispositions of all signals associated with the traced process (see 863 sigaction(2)). Signal numbers are displaced by 1 from array indices, so 864 that the action for signal number n appears in position n-1 of the 865 array. 866 867 auxv 868 Contains the initial values of the process's aux vector in an array of 869 auxv_t structures (see <sys/auxv.h>). The values are those that were 870 passed by the operating system as startup information to the dynamic 871 linker. 872 873 ldt 874 This file exists only on x86-based machines. It is non-empty only if 875 the process has established a local descriptor table (LDT). If non- 876 empty, the file contains the array of currently active LDT entries in 877 an array of elements of type struct ssd, defined in <sys/sysi86.h>, one 878 element for each active LDT entry. 879 880 map, xmap 881 Contain information about the virtual address map of the process. The 882 map file contains an array of prmap structures while the xmap file 883 contains an array of prxmap structures. Each structure describes a 884 contiguous virtual address region in the address space of the traced 885 process: 886 887 typedef struct prmap { 888 uintptr_tpr_vaddr; /* virtual address of mapping */ 889 size_t pr_size; /* size of mapping in bytes */ 890 char pr_mapname[PRMAPSZ]; /* name in /proc/pid/object */ 891 offset_t pr_offset; /* offset into mapped object, if any */ 892 int pr_mflags; /* protection and attribute flags */ 893 int pr_pagesize; /* pagesize for this mapping in bytes */ 894 int pr_shmid; /* SysV shared memory identifier */ 895 } prmap_t; 896 897 898 899 typedef struct prxmap { 900 uintptr_t pr_vaddr; /* virtual address of mapping */ 901 size_t pr_size; /* size of mapping in bytes */ 902 char pr_mapname[PRMAPSZ]; /* name in /proc/pid/object */ 903 offset_t pr_offset; /* offset into mapped object, if any */ 904 int pr_mflags; /* protection and attribute flags */ 905 int pr_pagesize; /* pagesize for this mapping in bytes */ 906 int pr_shmid; /* SysV shared memory identifier */ 907 dev_t pr_dev; /* device of mapped object, if any */ 908 uint64_t pr_ino; /* inode of mapped object, if any */ 909 size_t pr_rss; /* pages of resident memory */ 910 size_t pr_anon; /* pages of resident anonymous memory */ 911 size_t pr_locked; /* pages of locked memory */ 912 uint64_t pr_hatpagesize; /* pagesize of mapping */ 913 } prxmap_t; 914 915 916 917 918 pr_vaddr is the virtual address of the mapping within the traced 919 process and pr_size is its size in bytes. pr_mapname, if it does not 920 contain a null string, contains the name of a file in the object 921 directory (see below) that can be opened read-only to obtain a file 922 descriptor for the mapped file associated with the mapping. This 923 enables a debugger to find object file symbol tables without having to 924 know the real path names of the executable file and shared libraries of 925 the process. pr_offset is the 64-bit offset within the mapped file (if 926 any) to which the virtual address is mapped. 927 928 929 pr_mflags is a bit-mask of protection and attribute flags: 930 931 MA_READ 932 mapping is readable by the traced process. 933 934 935 MA_WRITE 936 mapping is writable by the traced process. 937 938 939 MA_EXEC 940 mapping is executable by the traced process. 941 942 943 MA_SHARED 944 mapping changes are shared by the mapped object. 945 946 947 MA_ISM 948 mapping is intimate shared memory (shared MMU 949 resources) 950 951 952 MAP_NORESERVE 953 mapping does not have swap space reserved (mapped with 954 MAP_NORESERVE) 955 956 957 MA_SHM 958 mapping System V shared memory 959 960 961 962 A contiguous area of the address space having the same underlying 963 mapped object may appear as multiple mappings due to varying read, 964 write, and execute attributes. The underlying mapped object does not 965 change over the range of a single mapping. An I/O operation to a 966 mapping marked MA_SHARED fails if applied at a virtual address not 967 corresponding to a valid page in the underlying mapped object. A write 968 to a MA_SHARED mapping that is not marked MA_WRITE fails. Reads and 969 writes to private mappings always succeed. Reads and writes to unmapped 970 addresses fail. 971 972 973 pr_pagesize is the page size for the mapping, currently always the 974 system pagesize. 975 976 977 pr_shmid is the shared memory identifier, if any, for the mapping. Its 978 value is -1 if the mapping is not System V shared memory. See 979 shmget(2). 980 981 982 pr_dev is the device of the mapped object, if any, for the mapping. Its 983 value is PRNODEV (-1) if the mapping does not have a device. 984 985 986 pr_ino is the inode of the mapped object, if any, for the mapping. Its 987 contents are only valid if pr_dev is not PRNODEV. 988 989 990 pr_rss is the number of resident pages of memory for the mapping. The 991 number of resident bytes for the mapping may be determined by 992 multiplying pr_rss by the page size given by pr_pagesize. 993 994 995 pr_anon is the number of resident anonymous memory pages (pages which 996 are private to this process) for the mapping. 997 998 999 pr_locked is the number of locked pages for the mapping. Pages which 1000 are locked are always resident in memory. 1001 1002 1003 pr_hatpagesize is the size, in bytes, of the HAT (MMU) translation for 1004 the mapping. pr_hatpagesize may be different than pr_pagesize. The 1005 possible values are hardware architecture specific, and may change over 1006 a mapping's lifetime. 1007 1008 rmap 1009 Contains information about the reserved address ranges of the process. 1010 The file contains an array of prmap structures, as defined above for 1011 the map file. Each structure describes a contiguous virtual address 1012 region in the address space of the traced process that is reserved by 1013 the system in the sense that an mmap(2) system call that does not 1014 specify MAP_FIXED will not use any part of it for the new mapping. 1015 Examples of such reservations include the address ranges reserved for 1016 the process stack and the individual thread stacks of a multi-threaded 1017 process. 1018 1019 cwd 1020 A symbolic link to the process's current working directory. See 1021 chdir(2). A readlink(2) of /proc/pid/cwd yields a null string. 1022 However, it can be opened, listed, and searched as a directory, and can 1023 be the target of chdir(2). 1024 1025 root 1026 A symbolic link to the process's root directory. /proc/pid/root can 1027 differ from the system root directory if the process or one of its 1028 ancestors executed chroot(2) as super user. It has the same semantics 1029 as /proc/pid/cwd. 1030 1031 fd 1032 A directory containing references to the open files of the process. 1033 Each entry is a decimal number corresponding to an open file descriptor 1034 in the process. 1035 1036 1037 If an entry refers to a regular file, it can be opened with normal file 1038 system semantics but, to ensure that the controlling process cannot 1039 gain greater access than the controlled process, with no file access 1040 modes other than its read/write open modes in the controlled process. 1041 If an entry refers to a directory, it can be accessed with the same 1042 semantics as /proc/pid/cwd. An attempt to open any other type of entry 1043 fails with EACCES. 1044 1045 object 1046 A directory containing read-only files with names corresponding to the 1047 pr_mapname entries in the map and pagedata files. Opening such a file 1048 yields a file descriptor for the underlying mapped file associated with 1049 an address-space mapping in the process. The file name a.out appears in 1050 the directory as an alias for the process's executable file. 1051 1052 1053 The object directory makes it possible for a controlling process to 1054 gain access to the object file and any shared libraries (and 1055 consequently the symbol tables) without having to know the actual path 1056 names of the executable files. 1057 1058 path 1059 A directory containing symbolic links to files opened by the process. 1060 The directory includes one entry for cwd and root. The directory also 1061 contains a numerical entry for each file descriptor in the fd 1062 directory, and entries matching those in the object directory. If this 1063 information is not available, any attempt to read the contents of the 1064 symbolic link will fail. This is most common for files that do not 1065 exist in the filesystem namespace (such as FIFOs and sockets), but can 1066 also happen for regular files. For the file descriptor entries, the 1067 path may be different from the one used by the process to open the 1068 file. 1069 1070 pagedata 1071 Opening the page data file enables tracking of address space references 1072 and modifications on a per-page basis. 1073 1074 1075 A read(2) of the page data file descriptor returns structured page data 1076 and atomically clears the page data maintained for the file by the 1077 system. That is to say, each read returns data collected since the last 1078 read; the first read returns data collected since the file was opened. 1079 When the call completes, the read buffer contains the following 1080 structure as its header and thereafter contains a number of section 1081 header structures and associated byte arrays that must be accessed by 1082 walking linearly through the buffer. 1083 1084 typedef struct prpageheader { 1085 timestruc_t pr_tstamp; /* real time stamp, time of read() */ 1086 ulong_t pr_nmap; /* number of address space mappings */ 1087 ulong_t pr_npage; /* total number of pages */ 1088 } prpageheader_t; 1089 1090 1091 1092 The header is followed by pr_nmap prasmap structures and associated 1093 data arrays. The prasmap structure contains the following elements: 1094 1095 typedef struct prasmap { 1096 uintptr_t pr_vaddr; /* virtual address of mapping */ 1097 ulong_t pr_npage; /* number of pages in mapping */ 1098 char pr_mapname[PRMAPSZ]; /* name in /proc/pid/object */ 1099 offset_t pr_offset; /* offset into mapped object, if any */ 1100 int pr_mflags; /* protection and attribute flags */ 1101 int pr_pagesize; /* pagesize for this mapping in bytes */ 1102 int pr_shmid; /* SysV shared memory identifier */ 1103 } prasmap_t; 1104 1105 1106 1107 Each section header is followed by pr_npage bytes, one byte for each 1108 page in the mapping, plus 0-7 null bytes at the end so that the next 1109 prasmap structure begins on an eight-byte aligned boundary. Each data 1110 byte may contain these flags: 1111 1112 PG_REFERENCED 1113 page has been referenced. 1114 1115 1116 PG_MODIFIED 1117 page has been modified. 1118 1119 1120 1121 If the read buffer is not large enough to contain all of the page data, 1122 the read fails with E2BIG and the page data is not cleared. The 1123 required size of the read buffer can be determined through fstat(2). 1124 Application of lseek(2) to the page data file descriptor is 1125 ineffective; every read starts from the beginning of the file. Closing 1126 the page data file descriptor terminates the system overhead associated 1127 with collecting the data. 1128 1129 1130 More than one page data file descriptor for the same process can be 1131 opened, up to a system-imposed limit per traced process. A read of one 1132 does not affect the data being collected by the system for the others. 1133 An open of the page data file will fail with ENOMEM if the system- 1134 imposed limit would be exceeded. 1135 1136 watch 1137 Contains an array of prwatch structures, one for each watched area 1138 established by the PCWATCH control operation. See PCWATCH for details. 1139 1140 usage 1141 Contains process usage information described by a prusage structure 1142 which contains at least the following fields: 1143 1144 typedef struct prusage { 1145 id_t pr_lwpid; /* lwp id. 0: process or defunct */ 1146 int pr_count; /* number of contributing lwps */ 1147 timestruc_t pr_tstamp; /* real time stamp, time of read() */ 1148 timestruc_t pr_create; /* process/lwp creation time stamp */ 1149 timestruc_t pr_term; /* process/lwp termination time stamp */ 1150 timestruc_t pr_rtime; /* total lwp real (elapsed) time */ 1151 timestruc_t pr_utime; /* user level CPU time */ 1152 timestruc_t pr_stime; /* system call CPU time */ 1153 timestruc_t pr_ttime; /* other system trap CPU time */ 1154 timestruc_t pr_tftime; /* text page fault sleep time */ 1155 timestruc_t pr_dftime; /* data page fault sleep time */ 1156 timestruc_t pr_kftime; /* kernel page fault sleep time */ 1157 timestruc_t pr_ltime; /* user lock wait sleep time */ 1158 timestruc_t pr_slptime; /* all other sleep time */ 1159 timestruc_t pr_wtime; /* wait-cpu (latency) time */ 1160 timestruc_t pr_stoptime; /* stopped time */ 1161 ulong_t pr_minf; /* minor page faults */ 1162 ulong_t pr_majf; /* major page faults */ 1163 ulong_t pr_nswap; /* swaps */ 1164 ulong_t pr_inblk; /* input blocks */ 1165 ulong_t pr_oublk; /* output blocks */ 1166 ulong_t pr_msnd; /* messages sent */ 1167 ulong_t pr_mrcv; /* messages received */ 1168 ulong_t pr_sigs; /* signals received */ 1169 ulong_t pr_vctx; /* voluntary context switches */ 1170 ulong_t pr_ictx; /* involuntary context switches */ 1171 ulong_t pr_sysc; /* system calls */ 1172 ulong_t pr_ioch; /* chars read and written */ 1173 } prusage_t; 1174 1175 1176 1177 Microstate accounting is now continuously enabled. While this 1178 information was previously an estimate, if microstate accounting were 1179 not enabled, the current information is now never an estimate 1180 represents time the process has spent in various states. 1181 1182 lstatus 1183 Contains a prheader structure followed by an array of lwpstatus 1184 structures, one for each active lwp in the process (see also 1185 /proc/pid/lwp/lwpid/lwpstatus, below). The prheader structure describes 1186 the number and size of the array entries that follow. 1187 1188 typedef struct prheader { 1189 long pr_nent; /* number of entries */ 1190 size_t pr_entsize; /* size of each entry, in bytes */ 1191 } prheader_t; 1192 1193 1194 1195 The lwpstatus structure may grow by the addition of elements at the end 1196 in future releases of the system. Programs must use pr_entsize in the 1197 file header to index through the array. These comments apply to all 1198 /proc files that include a prheader structure (lpsinfo and lusage, 1199 below). 1200 1201 lpsinfo 1202 Contains a prheader structure followed by an array of lwpsinfo 1203 structures, one for eachactive and zombie lwp in the process. See also 1204 /proc/pid/lwp/lwpid/lwpsinfo, below. 1205 1206 lusage 1207 Contains a prheader structure followed by an array of prusage 1208 structures, one for each active lwp in the process, plus an additional 1209 element at the beginning that contains the summation over all defunct 1210 lwps (lwps that once existed but no longer exist in the process). 1211 Excluding the pr_lwpid, pr_tstamp, pr_create, and pr_term entries, the 1212 entry-by-entry summation over all these structures is the definition of 1213 the process usage information obtained from the usage file. (See also 1214 /proc/pid/lwp/lwpid/lwpusage, below.) 1215 1216 lwp 1217 A directory containing entries each of which names an active or zombie 1218 lwp within the process. These entries are themselves directories 1219 containing additional files as described below. Only the lwpsinfo file 1220 exists in the directory of a zombie lwp. 1221 1222 STRUCTURE OF /proc/pid/lwp/lwpid 1223 A given directory /proc/pid/lwp/lwpid contains the following entries: 1224 1225 lwpctl 1226 Write-only control file. The messages written to this file affect the 1227 specific lwp rather than the representative lwp, as is the case for the 1228 process's ctl file. 1229 1230 lwpname 1231 A buffer of THREAD_NAME_MAX bytes representing the LWP name; the buffer 1232 is zero-filled if the thread name is shorter than the buffer. If no 1233 thread name is set, the buffer contains the empty string. A read with a 1234 buffer shorter than THREAD_NAME_MAX bytes is not guaranteed to be NUL- 1235 terminated. Writing to this file will set the LWP name for the 1236 specific lwp. This file may not be present in older operating system 1237 versions. THREAD_NAME_MAX may increase in the future; clients should be 1238 prepared for this. 1239 1240 lwpstatus 1241 lwp-specific state information. This file contains the lwpstatus 1242 structure for the specific lwp as described above for the 1243 representative lwp in the process's status file. 1244 1245 lwpsinfo 1246 lwp-specific ps(1) information. This file contains the lwpsinfo 1247 structure for the specific lwp as described above for the 1248 representative lwp in the process's psinfo file. The lwpsinfo file 1249 remains accessible after an lwp becomes a zombie. 1250 1251 lwpusage 1252 This file contains the prusage structure for the specific lwp as 1253 described above for the process's usage file. 1254 1255 gwindows 1256 This file exists only on SPARC based machines. If it is non-empty, it 1257 contains a gwindows_t structure, defined in <sys/regset.h>, with the 1258 values of those SPARC register windows that could not be stored on the 1259 stack when the lwp stopped. Conditions under which register windows are 1260 not stored on the stack are: the stack pointer refers to nonexistent 1261 process memory or the stack pointer is improperly aligned. If the lwp 1262 is not stopped or if there are no register windows that could not be 1263 stored on the stack, the file is empty (the usual case). 1264 1265 xregs 1266 Extra state registers. The extra state register set is architecture 1267 dependent; this file is empty if the system does not support extra 1268 state registers. If the file is non-empty, it contains an architecture 1269 dependent structure of type prxregset_t, defined in <procfs.h>, with 1270 the values of the lwp's extra state registers. If the lwp is not 1271 stopped, all register values are undefined. See also the PCSXREG 1272 control operation, below. 1273 1274 asrs 1275 This file exists only for 64-bit SPARC V9 processes. It contains an 1276 asrset_t structure, defined in <sys/regset.h>, containing the values of 1277 the lwp's platform-dependent ancillary state registers. If the lwp is 1278 not stopped, all register values are undefined. See also the PCSASRS 1279 control operation, below. 1280 1281 spymaster 1282 For an agent lwp (see PCAGENT), this file contains a psinfo_t structure 1283 that corresponds to the process that created the agent lwp at the time 1284 the agent was created. This structure is identical to that retrieved 1285 via the psinfo file, with one modification: the pr_time field does not 1286 correspond to the CPU time for the process, but rather to the creation 1287 time of the agent lwp. 1288 1289 templates 1290 A directory which contains references to the active templates for the 1291 lwp, named by the contract type. Changes made to an active template 1292 descriptor do not affect the original template which was activated, 1293 though they do affect the active template. It is not possible to 1294 activate an active template descriptor. See contract(4). 1295 1296 CONTROL MESSAGES 1297 Process state changes are effected through messages written to a 1298 process's ctl file or to an individual lwp's lwpctl file. All control 1299 messages consist of a long that names the specific operation followed 1300 by additional data containing the operand, if any. 1301 1302 1303 Multiple control messages may be combined in a single write(2) (or 1304 writev(2)) to a control file, but no partial writes are permitted. That 1305 is, each control message, operation code plus operand, if any, must be 1306 presented in its entirety to the write(2) and not in pieces over 1307 several system calls. If a control operation fails, no subsequent 1308 operations contained in the same write(2) are attempted. 1309 1310 1311 Descriptions of the allowable control messages follow. In all cases, 1312 writing a message to a control file for a process or lwp that has 1313 terminated elicits the error ENOENT. 1314 1315 PCSTOP PCDSTOP PCWSTOP PCTWSTOP 1316 When applied to the process control file, PCSTOP directs all lwps to 1317 stop and waits for them to stop, PCDSTOP directs all lwps to stop 1318 without waiting for them to stop, and PCWSTOP simply waits for all lwps 1319 to stop. When applied to an lwp control file, PCSTOP directs the 1320 specific lwp to stop and waits until it has stopped, PCDSTOP directs 1321 the specific lwp to stop without waiting for it to stop, and PCWSTOP 1322 simply waits for the specific lwp to stop. When applied to an lwp 1323 control file, PCSTOP and PCWSTOP complete when the lwp stops on an 1324 event of interest, immediately if already so stopped; when applied to 1325 the process control file, they complete when every lwp has stopped 1326 either on an event of interest or on a PR_SUSPENDED stop. 1327 1328 1329 PCTWSTOP is identical to PCWSTOP except that it enables the operation 1330 to time out, to avoid waiting forever for a process or lwp that may 1331 never stop on an event of interest. PCTWSTOP takes a long operand 1332 specifying a number of milliseconds; the wait will terminate 1333 successfully after the specified number of milliseconds even if the 1334 process or lwp has not stopped; a timeout value of zero makes the 1335 operation identical to PCWSTOP. 1336 1337 1338 An ``event of interest'' is either a PR_REQUESTED stop or a stop that 1339 has been specified in the process's tracing flags (set by PCSTRACE, 1340 PCSFAULT, PCSENTRY, and PCSEXIT). PR_JOBCONTROL and PR_SUSPENDED stops 1341 are specifically not events of interest. (An lwp may stop twice due to 1342 a stop signal, first showing PR_SIGNALLED if the signal is traced and 1343 again showing PR_JOBCONTROL if the lwp is set running without clearing 1344 the signal.) If PCSTOP or PCDSTOP is applied to an lwp that is stopped, 1345 but not on an event of interest, the stop directive takes effect when 1346 the lwp is restarted by the competing mechanism. At that time, the lwp 1347 enters a PR_REQUESTED stop before executing any user-level code. 1348 1349 1350 A write of a control message that blocks is interruptible by a signal 1351 so that, for example, an alarm(2) can be set to avoid waiting forever 1352 for a process or lwp that may never stop on an event of interest. If 1353 PCSTOP is interrupted, the lwp stop directives remain in effect even 1354 though the write(2) returns an error. (Use of PCTWSTOP with a non-zero 1355 timeout is recommended over PCWSTOP with an alarm(2).) 1356 1357 1358 A system process (indicated by the PR_ISSYS flag) never executes at 1359 user level, has no user-level address space visible through /proc, and 1360 cannot be stopped. Applying one of these operations to a system process 1361 or any of its lwps elicits the error EBUSY. 1362 1363 PCRUN 1364 Make an lwp runnable again after a stop. This operation takes a long 1365 operand containing zero or more of the following flags: 1366 1367 PRCSIG 1368 clears the current signal, if any (see PCCSIG). 1369 1370 1371 PRCFAULT 1372 clears the current fault, if any (see PCCFAULT). 1373 1374 1375 PRSTEP 1376 directs the lwp to execute a single machine instruction. On 1377 completion of the instruction, a trace trap occurs. If 1378 FLTTRACE is being traced, the lwp stops; otherwise, it is 1379 sent SIGTRAP. If SIGTRAP is being traced and is not 1380 blocked, the lwp stops. When the lwp stops on an event of 1381 interest, the single-step directive is cancelled, even if 1382 the stop occurs before the instruction is executed. This 1383 operation requires hardware and operating system support 1384 and may not be implemented on all processors. It is 1385 implemented on SPARC and x86-based machines. 1386 1387 1388 PRSABORT 1389 is meaningful only if the lwp is in a PR_SYSENTRY stop or 1390 is marked PR_ASLEEP; it instructs the lwp to abort 1391 execution of the system call (see PCSENTRY and PCSEXIT). 1392 1393 1394 PRSTOP 1395 directs the lwp to stop again as soon as possible after 1396 resuming execution (see PCDSTOP). In particular, if the lwp 1397 is stopped on PR_SIGNALLED or PR_FAULTED, the next stop 1398 will show PR_REQUESTED, no other stop will have intervened, 1399 and the lwp will not have executed any user-level code. 1400 1401 1402 1403 When applied to an lwp control file, PCRUN clears any outstanding 1404 directed-stop request and makes the specific lwp runnable. The 1405 operation fails with EBUSY if the specific lwp is not stopped on an 1406 event of interest or has not been directed to stop or if the agent lwp 1407 exists and this is not the agent lwp (see PCAGENT). 1408 1409 1410 When applied to the process control file, a representative lwp is 1411 chosen for the operation as described for /proc/pid/status. The 1412 operation fails with EBUSY if the representative lwp is not stopped on 1413 an event of interest or has not been directed to stop or if the agent 1414 lwp exists. If PRSTEP or PRSTOP was requested, the representative lwp 1415 is made runnable and its outstanding directed-stop request is cleared; 1416 otherwise all outstanding directed-stop requests are cleared and, if it 1417 was stopped on an event of interest, the representative lwp is marked 1418 PR_REQUESTED. If, as a consequence, all lwps are in the PR_REQUESTED or 1419 PR_SUSPENDED stop state, all lwps showing PR_REQUESTED are made 1420 runnable. 1421 1422 PCSTRACE 1423 Define a set of signals to be traced in the process. The receipt of one 1424 of these signals by an lwp causes the lwp to stop. The set of signals 1425 is defined using an operand sigset_t contained in the control message. 1426 Receipt of SIGKILL cannot be traced; if specified, it is silently 1427 ignored. 1428 1429 1430 If a signal that is included in an lwp's held signal set (the signal 1431 mask) is sent to the lwp, the signal is not received and does not cause 1432 a stop until it is removed from the held signal set, either by the lwp 1433 itself or by setting the held signal set with PCSHOLD. 1434 1435 PCCSIG 1436 The current signal, if any, is cleared from the specific or 1437 representative lwp. 1438 1439 PCSSIG 1440 The current signal and its associated signal information for the 1441 specific or representative lwp are set according to the contents of the 1442 operand siginfo structure (see <sys/siginfo.h>). If the specified 1443 signal number is zero, the current signal is cleared. The semantics of 1444 this operation are different from those of kill(2) in that the signal 1445 is delivered to the lwp immediately after execution is resumed (even if 1446 it is being blocked) and an additional PR_SIGNALLED stop does not 1447 intervene even if the signal is traced. Setting the current signal to 1448 SIGKILL terminates the process immediately. 1449 1450 PCKILL 1451 If applied to the process control file, a signal is sent to the process 1452 with semantics identical to those of kill(2). If applied to an lwp 1453 control file, a directed signal is sent to the specific lwp. The signal 1454 is named in a long operand contained in the message. Sending SIGKILL 1455 terminates the process immediately. 1456 1457 PCUNKILL 1458 A signal is deleted, that is, it is removed from the set of pending 1459 signals. If applied to the process control file, the signal is deleted 1460 from the process's pending signals. If applied to an lwp control file, 1461 the signal is deleted from the lwp's pending signals. The current 1462 signal (if any) is unaffected. The signal is named in a long operand in 1463 the control message. It is an error (EINVAL) to attempt to delete 1464 SIGKILL. 1465 1466 PCSHOLD 1467 Set the set of held signals for the specific or representative lwp 1468 (signals whose delivery will be blocked if sent to the lwp). The set of 1469 signals is specified with a sigset_t operand. SIGKILL and SIGSTOP 1470 cannot be held; if specified, they are silently ignored. 1471 1472 PCSFAULT 1473 Define a set of hardware faults to be traced in the process. On 1474 incurring one of these faults, an lwp stops. The set is defined via the 1475 operand fltset_t structure. Fault names are defined in <sys/fault.h> 1476 and include the following. Some of these may not occur on all 1477 processors; there may be processor-specific faults in addition to 1478 these. 1479 1480 FLTILL 1481 illegal instruction 1482 1483 1484 FLTPRIV 1485 privileged instruction 1486 1487 1488 FLTBPT 1489 breakpoint trap 1490 1491 1492 FLTTRACE 1493 trace trap (single-step) 1494 1495 1496 FLTWATCH 1497 watchpoint trap 1498 1499 1500 FLTACCESS 1501 memory access fault (bus error) 1502 1503 1504 FLTBOUNDS 1505 memory bounds violation 1506 1507 1508 FLTIOVF 1509 integer overflow 1510 1511 1512 FLTIZDIV 1513 integer zero divide 1514 1515 1516 FLTFPE 1517 floating-point exception 1518 1519 1520 FLTSTACK 1521 unrecoverable stack fault 1522 1523 1524 FLTPAGE 1525 recoverable page fault 1526 1527 1528 1529 When not traced, a fault normally results in the posting of a signal to 1530 the lwp that incurred the fault. If an lwp stops on a fault, the signal 1531 is posted to the lwp when execution is resumed unless the fault is 1532 cleared by PCCFAULT or by the PRCFAULT option of PCRUN. FLTPAGE is an 1533 exception; no signal is posted. The pr_info field in the lwpstatus 1534 structure identifies the signal to be sent and contains machine- 1535 specific information about the fault. 1536 1537 PCCFAULT 1538 The current fault, if any, is cleared; the associated signal will not 1539 be sent to the specific or representative lwp. 1540 1541 PCSENTRY PCSEXIT 1542 These control operations instruct the process's lwps to stop on entry 1543 to or exit from specified system calls. The set of system calls to be 1544 traced is defined via an operand sysset_t structure. 1545 1546 1547 When entry to a system call is being traced, an lwp stops after having 1548 begun the call to the system but before the system call arguments have 1549 been fetched from the lwp. When exit from a system call is being 1550 traced, an lwp stops on completion of the system call just prior to 1551 checking for signals and returning to user level. At this point, all 1552 return values have been stored into the lwp's registers. 1553 1554 1555 If an lwp is stopped on entry to a system call (PR_SYSENTRY) or when 1556 sleeping in an interruptible system call (PR_ASLEEP is set), it may be 1557 instructed to go directly to system call exit by specifying the 1558 PRSABORT flag in a PCRUN control message. Unless exit from the system 1559 call is being traced, the lwp returns to user level showing EINTR. 1560 1561 PCWATCH 1562 Set or clear a watched area in the controlled process from a prwatch 1563 structure operand: 1564 1565 typedef struct prwatch { 1566 uintptr_t pr_vaddr; /* virtual address of watched area */ 1567 size_t pr_size; /* size of watched area in bytes */ 1568 int pr_wflags; /* watch type flags */ 1569 } prwatch_t; 1570 1571 1572 1573 pr_vaddr specifies the virtual address of an area of memory to be 1574 watched in the controlled process. pr_size specifies the size of the 1575 area, in bytes. pr_wflags specifies the type of memory access to be 1576 monitored as a bit-mask of the following flags: 1577 1578 WA_READ 1579 read access 1580 1581 1582 WA_WRITE 1583 write access 1584 1585 1586 WA_EXEC 1587 execution access 1588 1589 1590 WA_TRAPAFTER 1591 trap after the instruction completes 1592 1593 1594 1595 If pr_wflags is non-empty, a watched area is established for the 1596 virtual address range specified by pr_vaddr and pr_size. If pr_wflags 1597 is empty, any previously-established watched area starting at the 1598 specified virtual address is cleared; pr_size is ignored. 1599 1600 1601 A watchpoint is triggered when an lwp in the traced process makes a 1602 memory reference that covers at least one byte of a watched area and 1603 the memory reference is as specified in pr_wflags. When an lwp triggers 1604 a watchpoint, it incurs a watchpoint trap. If FLTWATCH is being traced, 1605 the lwp stops; otherwise, it is sent a SIGTRAP signal; if SIGTRAP is 1606 being traced and is not blocked, the lwp stops. 1607 1608 1609 The watchpoint trap occurs before the instruction completes unless 1610 WA_TRAPAFTER was specified, in which case it occurs after the 1611 instruction completes. If it occurs before completion, the memory is 1612 not modified. If it occurs after completion, the memory is modified (if 1613 the access is a write access). 1614 1615 1616 Physical i/o is an exception for watchpoint traps. In this instance, 1617 there is no guarantee that memory before the watched area has already 1618 been modified (or in the case of WA_TRAPAFTER, that the memory 1619 following the watched area has not been modified) when the watchpoint 1620 trap occurs and the lwp stops. 1621 1622 1623 pr_info in the lwpstatus structure contains information pertinent to 1624 the watchpoint trap. In particular, the si_addr field contains the 1625 virtual address of the memory reference that triggered the watchpoint, 1626 and the si_code field contains one of TRAP_RWATCH, TRAP_WWATCH, or 1627 TRAP_XWATCH, indicating read, write, or execute access, respectively. 1628 The si_trapafter field is zero unless WA_TRAPAFTER is in effect for 1629 this watched area; non-zero indicates that the current instruction is 1630 not the instruction that incurred the watchpoint trap. The si_pc field 1631 contains the virtual address of the instruction that incurred the trap. 1632 1633 1634 A watchpoint trap may be triggered while executing a system call that 1635 makes reference to the traced process's memory. The lwp that is 1636 executing the system call incurs the watchpoint trap while still in the 1637 system call. If it stops as a result, the lwpstatus structure contains 1638 the system call number and its arguments. If the lwp does not stop, or 1639 if it is set running again without clearing the signal or fault, the 1640 system call fails with EFAULT. If WA_TRAPAFTER was specified, the 1641 memory reference will have completed and the memory will have been 1642 modified (if the access was a write access) when the watchpoint trap 1643 occurs. 1644 1645 1646 If more than one of WA_READ, WA_WRITE, and WA_EXEC is specified for a 1647 watched area, and a single instruction incurs more than one of the 1648 specified types, only one is reported when the watchpoint trap occurs. 1649 The precedence is WA_EXEC, WA_READ, WA_WRITE (WA_EXEC and WA_READ take 1650 precedence over WA_WRITE), unless WA_TRAPAFTER was specified, in which 1651 case it is WA_WRITE, WA_READ, WA_EXEC (WA_WRITE takes precedence). 1652 1653 1654 PCWATCH fails with EINVAL if an attempt is made to specify overlapping 1655 watched areas or if pr_wflags contains flags other than those specified 1656 above. It fails with ENOMEM if an attempt is made to establish more 1657 watched areas than the system can support (the system can support 1658 thousands). 1659 1660 1661 The child of a vfork(2) borrows the parent's address space. When a 1662 vfork(2) is executed by a traced process, all watched areas established 1663 for the parent are suspended until the child terminates or performs an 1664 exec(2). Any watched areas established independently in the child are 1665 cancelled when the parent resumes after the child's termination or 1666 exec(2). PCWATCH fails with EBUSY if applied to the parent of a 1667 vfork(2) before the child has terminated or performed an exec(2). The 1668 PR_VFORKP flag is set in the pstatus structure for such a parent 1669 process. 1670 1671 1672 Certain accesses of the traced process's address space by the operating 1673 system are immune to watchpoints. The initial construction of a signal 1674 stack frame when a signal is delivered to an lwp will not trigger a 1675 watchpoint trap even if the new frame covers watched areas of the 1676 stack. Once the signal handler is entered, watchpoint traps occur 1677 normally. On SPARC based machines, register window overflow and 1678 underflow will not trigger watchpoint traps, even if the register 1679 window save areas cover watched areas of the stack. 1680 1681 1682 Watched areas are not inherited by child processes, even if the traced 1683 process's inherit-on-fork mode, PR_FORK, is set (see PCSET, below). 1684 All watched areas are cancelled when the traced process performs a 1685 successful exec(2). 1686 1687 PCSET PCUNSET 1688 PCSET sets one or more modes of operation for the traced process. 1689 PCUNSET unsets these modes. The modes to be set or unset are specified 1690 by flags in an operand long in the control message: 1691 1692 PR_FORK 1693 (inherit-on-fork): When set, the process's tracing flags 1694 and its inherit-on-fork mode are inherited by the child of 1695 a fork(2), fork1(2), or vfork(2). When unset, child 1696 processes start with all tracing flags cleared. 1697 1698 1699 PR_RLC 1700 (run-on-last-close): When set and the last writable /proc 1701 file descriptor referring to the traced process or any of 1702 its lwps is closed, all of the process's tracing flags and 1703 watched areas are cleared, any outstanding stop directives 1704 are canceled, and if any lwps are stopped on events of 1705 interest, they are set running as though PCRUN had been 1706 applied to them. When unset, the process's tracing flags 1707 and watched areas are retained and lwps are not set 1708 running on last close. 1709 1710 1711 PR_KLC 1712 (kill-on-last-close): When set and the last writable /proc 1713 file descriptor referring to the traced process or any of 1714 its lwps is closed, the process is terminated with 1715 SIGKILL. 1716 1717 1718 PR_ASYNC 1719 (asynchronous-stop): When set, a stop on an event of 1720 interest by one lwp does not directly affect any other lwp 1721 in the process. When unset and an lwp stops on an event of 1722 interest other than PR_REQUESTED, all other lwps in the 1723 process are directed to stop. 1724 1725 1726 PR_MSACCT 1727 (microstate accounting): Microstate accounting is now 1728 continuously enabled. This flag is deprecated and no 1729 longer has any effect upon microstate accounting. 1730 Applications may toggle this flag; however, microstate 1731 accounting will remain enabled regardless. 1732 1733 1734 PR_MSFORK 1735 (inherit microstate accounting): All processes now inherit 1736 microstate accounting, as it is continuously enabled. This 1737 flag has been deprecated and its use no longer has any 1738 effect upon the behavior of microstate accounting. 1739 1740 1741 PR_BPTADJ 1742 (breakpoint trap pc adjustment): On x86-based machines, a 1743 breakpoint trap leaves the program counter (the EIP) 1744 referring to the breakpointed instruction plus one byte. 1745 When PR_BPTADJ is set, the system will adjust the program 1746 counter back to the location of the breakpointed 1747 instruction when the lwp stops on a breakpoint. This flag 1748 has no effect on SPARC based machines, where breakpoint 1749 traps leave the program counter referring to the 1750 breakpointed instruction. 1751 1752 1753 PR_PTRACE 1754 (ptrace-compatibility): When set, a stop on an event of 1755 interest by the traced process is reported to the parent 1756 of the traced process by wait(3C), SIGTRAP is sent to the 1757 traced process when it executes a successful exec(2), 1758 setuid/setgid flags are not honored for execs performed by 1759 the traced process, any exec of an object file that the 1760 traced process cannot read fails, and the process dies 1761 when its parent dies. This mode is deprecated; it is 1762 provided only to allow ptrace(3C) to be implemented as a 1763 library function using /proc. 1764 1765 1766 1767 It is an error (EINVAL) to specify flags other than those described 1768 above or to apply these operations to a system process. The current 1769 modes are reported in the pr_flags field of /proc/pid/status and 1770 /proc/pid/lwp/lwp/lwpstatus. 1771 1772 PCSREG 1773 Set the general registers for the specific or representative lwp 1774 according to the operand prgregset_t structure. 1775 1776 1777 On SPARC based systems, only the condition-code bits of the processor- 1778 status register (R_PSR) of SPARC V8 (32-bit) processes can be modified 1779 by PCSREG. Other privileged registers cannot be modified at all. 1780 1781 1782 On x86-based systems, only certain bits of the flags register (EFL) can 1783 be modified by PCSREG: these include the condition codes, direction- 1784 bit, and overflow-bit. 1785 1786 1787 PCSREG fails with EBUSY if the lwp is not stopped on an event of 1788 interest. 1789 1790 PCSVADDR 1791 Set the address at which execution will resume for the specific or 1792 representative lwp from the operand long. On SPARC based systems, both 1793 %pc and %npc are set, with %npc set to the instruction following the 1794 virtual address. On x86-based systems, only %eip is set. PCSVADDR fails 1795 with EBUSY if the lwp is not stopped on an event of interest. 1796 1797 PCSFPREG 1798 Set the floating-point registers for the specific or representative lwp 1799 according to the operand prfpregset_t structure. An error (EINVAL) is 1800 returned if the system does not support floating-point operations (no 1801 floating-point hardware and the system does not emulate floating-point 1802 machine instructions). PCSFPREG fails with EBUSY if the lwp is not 1803 stopped on an event of interest. 1804 1805 PCSXREG 1806 Set the extra state registers for the specific or representative lwp 1807 according to the architecture-dependent operand prxregset_t structure. 1808 An error (EINVAL) is returned if the system does not support extra 1809 state registers. PCSXREG fails with EBUSY if the lwp is not stopped on 1810 an event of interest. 1811 1812 PCSASRS 1813 Set the ancillary state registers for the specific or representative 1814 lwp according to the SPARC V9 platform-dependent operand asrset_t 1815 structure. An error (EINVAL) is returned if either the target process 1816 or the controlling process is not a 64-bit SPARC V9 process. Most of 1817 the ancillary state registers are privileged registers that cannot be 1818 modified. Only those that can be modified are set; all others are 1819 silently ignored. PCSASRS fails with EBUSY if the lwp is not stopped on 1820 an event of interest. 1821 1822 PCAGENT 1823 Create an agent lwp in the controlled process with register values from 1824 the operand prgregset_t structure (see PCSREG, above). The agent lwp is 1825 created in the stopped state showing PR_REQUESTED and with its held 1826 signal set (the signal mask) having all signals except SIGKILL and 1827 SIGSTOP blocked. 1828 1829 1830 The PCAGENT operation fails with EBUSY unless the process is fully 1831 stopped via /proc, that is, unless all of the lwps in the process are 1832 stopped either on events of interest or on PR_SUSPENDED, or are stopped 1833 on PR_JOBCONTROL and have been directed to stop via PCDSTOP. It fails 1834 with EBUSY if an agent lwp already exists. It fails with ENOMEM if 1835 system resources for creating new lwps have been exhausted. 1836 1837 1838 Any PCRUN operation applied to the process control file or to the 1839 control file of an lwp other than the agent lwp fails with EBUSY as 1840 long as the agent lwp exists. The agent lwp must be caused to terminate 1841 by executing the SYS_lwp_exit system call trap before the process can 1842 be restarted. 1843 1844 1845 Once the agent lwp is created, its lwp-ID can be found by reading the 1846 process status file. To facilitate opening the agent lwp's control and 1847 status files, the directory name /propc/pid/lwp/agent is accepted for 1848 lookup operations as an invisible alias for /proc/pid/lwp/lwpid, lwpid 1849 being the lwp-ID of the agent lwp (invisible in the sense that the name 1850 ``agent'' does not appear in a directory listing of /proc/pid/lwp 1851 obtained from ls(1), getdents(2), or readdir(3C)). 1852 1853 1854 The purpose of the agent lwp is to perform operations in the controlled 1855 process on behalf of the controlling process: to gather information not 1856 directly available via /proc files, or in general to make the process 1857 change state in ways not directly available via /proc control 1858 operations. To make use of an agent lwp, the controlling process must 1859 be capable of making it execute system calls (specifically, the 1860 SYS_lwp_exit system call trap). The register values given to the agent 1861 lwp on creation are typically the registers of the representative lwp, 1862 so that the agent lwp can use its stack. 1863 1864 1865 If the controlling process neglects to force the agent lwp to execute 1866 the SYS_lwp_exit system call (due to either logic error or fatal 1867 failure on the part of the controlling process), the agent lwp will 1868 remain in the target process. For purposes of being able to debug 1869 these otherwise rogue agents, information as to the creator of the 1870 agent lwp is reflected in that lwp's spymaster file in /proc. Should 1871 the target process generate a core dump with the agent lwp in place, 1872 this information will be available via the NT_SPYMASTER note in the 1873 core file (see core(4)). 1874 1875 1876 The agent lwp is not allowed to execute any variation of the SYS_fork 1877 or SYS_exec system call traps. Attempts to do so yield ENOTSUP to the 1878 agent lwp. 1879 1880 1881 Symbolic constants for system call trap numbers like SYS_lwp_exit and 1882 SYS_lwp_create can be found in the header file <sys/syscall.h>. 1883 1884 PCREAD PCWRITE 1885 Read or write the target process's address space via a priovec 1886 structure operand: 1887 1888 typedef struct priovec { 1889 void *pio_base; /* buffer in controlling process */ 1890 size_t pio_len; /* size of read/write request in bytes */ 1891 off_t pio_offset; /* virtual address in target process */ 1892 } priovec_t; 1893 1894 1895 1896 These operations have the same effect as pread(2) and pwrite(2), 1897 respectively, of the target process's address space file. The 1898 difference is that more than one PCREAD or PCWRITE control operation 1899 can be written to the control file at once, and they can be 1900 interspersed with other control operations in a single write to the 1901 control file. This is useful, for example, when planting many 1902 breakpoint instructions in the process's address space, or when 1903 stepping over a breakpointed instruction. Unlike pread(2) and 1904 pwrite(2), no provision is made for partial reads or writes; if the 1905 operation cannot be performed completely, it fails with EIO. 1906 1907 PCNICE 1908 The traced process's nice(2) value is incremented by the amount in the 1909 operand long. Only a process with the {PRIV_PROC_PRIOCNTL} privilege 1910 asserted in its effective set can better a process's priority in this 1911 way, but any user may lower the priority. This operation is not 1912 meaningful for all scheduling classes. 1913 1914 PCSCRED 1915 Set the target process credentials to the values contained in the 1916 prcred_t structure operand (see /proc/pid/cred). The effective, real, 1917 and saved user-IDs and group-IDs of the target process are set. The 1918 target process's supplementary groups are not changed; the pr_ngroups 1919 and pr_groups members of the structure operand are ignored. Only the 1920 privileged processes can perform this operation; for all others it 1921 fails with EPERM. 1922 1923 PCSCREDX 1924 Operates like PCSCRED but also sets the supplementary groups; the 1925 length of the data written with this control operation should be 1926 "sizeof (prcred_t) + sizeof (gid_t) * (#groups - 1)". 1927 1928 PCSPRIV 1929 Set the target process privilege to the values contained in the 1930 prpriv_t operand (see /proc/pid/priv). The effective, permitted, 1931 inheritable, and limit sets are all changed. Privilege flags can also 1932 be set. The process is made privilege aware unless it can relinquish 1933 privilege awareness. See privileges(5). 1934 1935 1936 The limit set of the target process cannot be grown. The other 1937 privilege sets must be subsets of the intersection of the effective set 1938 of the calling process with the new limit set of the target process or 1939 subsets of the original values of the sets in the target process. 1940 1941 1942 If any of the above restrictions are not met, EPERM is returned. If the 1943 structure written is improperly formatted, EINVAL is returned. 1944 1945 PROGRAMMING NOTES 1946 For security reasons, except for the psinfo, usage, lpsinfo, lusage, 1947 lwpsinfo, and lwpusage files, which are world-readable, and except for 1948 privileged processes, an open of a /proc file fails unless both the 1949 user-ID and group-ID of the caller match those of the traced process 1950 and the process's object file is readable by the caller. The effective 1951 set of the caller is a superset of both the inheritable and the 1952 permitted set of the target process. The limit set of the caller is a 1953 superset of the limit set of the target process. Except for the world- 1954 readable files just mentioned, files corresponding to setuid and setgid 1955 processes can be opened only by the appropriately privileged process. 1956 1957 1958 A process that is missing the basic privilege {PRIV_PROC_INFO} cannot 1959 see any processes under /proc that it cannot send a signal to. 1960 1961 1962 A process that has {PRIV_PROC_OWNER} asserted in its effective set can 1963 open any file for reading. To manipulate or control a process, the 1964 controlling process must have at least as many privileges in its 1965 effective set as the target process has in its effective, inheritable, 1966 and permitted sets. The limit set of the controlling process must be a 1967 superset of the limit set of the target process. Additional 1968 restrictions apply if any of the uids of the target process are 0. See 1969 privileges(5). 1970 1971 1972 Even if held by a privileged process, an open process or lwp file 1973 descriptor (other than file descriptors for the world-readable files) 1974 becomes invalid if the traced process performs an exec(2) of a 1975 setuid/setgid object file or an object file that the traced process 1976 cannot read. Any operation performed on an invalid file descriptor, 1977 except close(2), fails with EAGAIN. In this situation, if any tracing 1978 flags are set and the process or any lwp file descriptor is open for 1979 writing, the process will have been directed to stop and its run-on- 1980 last-close flag will have been set (see PCSET). This enables a 1981 controlling process (if it has permission) to reopen the /proc files to 1982 get new valid file descriptors, close the invalid file descriptors, 1983 unset the run-on-last-close flag (if desired), and proceed. Just 1984 closing the invalid file descriptors causes the traced process to 1985 resume execution with all tracing flags cleared. Any process not 1986 currently open for writing via /proc, but that has left-over tracing 1987 flags from a previous open, and that executes a setuid/setgid or 1988 unreadable object file, will not be stopped but will have all its 1989 tracing flags cleared. 1990 1991 1992 To wait for one or more of a set of processes or lwps to stop or 1993 terminate, /proc file descriptors (other than those obtained by opening 1994 the cwd or root directories or by opening files in the fd or object 1995 directories) can be used in a poll(2) system call. When requested and 1996 returned, either of the polling events POLLPRI or POLLWRNORM indicates 1997 that the process or lwp stopped on an event of interest. Although they 1998 cannot be requested, the polling events POLLHUP, POLLERR, and POLLNVAL 1999 may be returned. POLLHUP indicates that the process or lwp has 2000 terminated. POLLERR indicates that the file descriptor has become 2001 invalid. POLLNVAL is returned immediately if POLLPRI or POLLWRNORM is 2002 requested on a file descriptor referring to a system process (see 2003 PCSTOP). The requested events may be empty to wait simply for 2004 termination. 2005 2006 FILES 2007 /proc 2008 2009 directory (list of processes) 2010 2011 2012 /proc/pid 2013 2014 specific process directory 2015 2016 2017 /proc/self 2018 2019 alias for a process's own directory 2020 2021 2022 /proc/pid/as 2023 2024 address space file 2025 2026 2027 /proc/pid/ctl 2028 2029 process control file 2030 2031 2032 /proc/pid/status 2033 2034 process status 2035 2036 2037 /proc/pid/lstatus 2038 2039 array of lwp status structs 2040 2041 2042 /proc/pid/psinfo 2043 2044 process ps(1) info 2045 2046 2047 /proc/pid/lpsinfo 2048 2049 array of lwp ps(1) info structs 2050 2051 2052 /proc/pid/map 2053 2054 address space map 2055 2056 2057 /proc/pid/xmap 2058 2059 extended address space map 2060 2061 2062 /proc/pid/rmap 2063 2064 reserved address map 2065 2066 2067 /proc/pid/cred 2068 2069 process credentials 2070 2071 2072 /proc/pid/priv 2073 2074 process privileges 2075 2076 2077 /proc/pid/sigact 2078 2079 process signal actions 2080 2081 2082 /proc/pid/auxv 2083 2084 process aux vector 2085 2086 2087 /proc/pid/ldt 2088 2089 process LDT (x86 only) 2090 2091 2092 /proc/pid/usage 2093 2094 process usage 2095 2096 2097 /proc/pid/lusage 2098 2099 array of lwp usage structs 2100 2101 2102 /proc/pid/path 2103 2104 symbolic links to process open files 2105 2106 2107 /proc/pid/pagedata 2108 2109 process page data 2110 2111 2112 /proc/pid/watch 2113 2114 active watchpoints 2115 2116 2117 /proc/pid/cwd 2118 2119 alias for the current working directory 2120 2121 2122 /proc/pid/root 2123 2124 alias for the root directory 2125 2126 2127 /proc/pid/fd 2128 2129 directory (list of open files) 2130 2131 2132 /proc/pid/fd/* 2133 2134 aliases for process's open files 2135 2136 2137 /proc/pid/object 2138 2139 directory (list of mapped files) 2140 2141 2142 /proc/pid/object/a.out 2143 2144 alias for process's executable file 2145 2146 2147 /proc/pid/object/* 2148 2149 aliases for other mapped files 2150 2151 2152 /proc/pid/lwp 2153 2154 directory (list of lwps) 2155 2156 2157 /proc/pid/lwp/lwpid 2158 2159 specific lwp directory 2160 2161 2162 /proc/pid/lwp/agent 2163 2164 alias for the agent lwp directory 2165 2166 2167 /proc/pid/lwp/lwpid/lwpctl 2168 2169 lwp control file 2170 2171 2172 /proc/pid/lwp/lwpid/lwpstatus 2173 2174 lwp status 2175 2176 2177 /proc/pid/lwp/lwpid/lwpsinfo 2178 2179 lwp ps(1) info 2180 2181 2182 /proc/pid/lwp/lwpid/lwpusage 2183 2184 lwp usage 2185 2186 2187 /proc/pid/lwp/lwpid/gwindows 2188 2189 register windows (SPARC only) 2190 2191 2192 /proc/pid/lwp/lwpid/xregs 2193 2194 extra state registers 2195 2196 2197 /proc/pid/lwp/lwpid/asrs 2198 2199 ancillary state registers (SPARC V9 only) 2200 2201 2202 /proc/pid/lwp/lwpid/spymaster 2203 2204 For an agent LWP, the controlling process 2205 2206 2207 SEE ALSO 2208 ls(1), ps(1), chroot(1M), alarm(2), brk(2), chdir(2), chroot(2), 2209 close(2), creat(2), dup(2), exec(2), fcntl(2), fork(2), fork1(2), 2210 fstat(2), getdents(2), getustack(2), kill(2), lseek(2), mmap(2), 2211 nice(2), open(2), poll(2), pread(2), ptrace(3C), pwrite(2), read(2), 2212 readlink(2), readv(2), shmget(2), sigaction(2), sigaltstack(2), 2213 vfork(2), write(2), writev(2), _stack_grow(3C), readdir(3C), 2214 pthread_create(3C), pthread_join(3C), siginfo.h(3HEAD), 2215 signal.h(3HEAD), thr_create(3C), thr_join(3C), types32.h(3HEAD), 2216 ucontext.h(3HEAD), wait(3C), contract(4), core(4), process(4), 2217 lfcompile(5), privileges(5), security-flags(5) 2218 2219 DIAGNOSTICS 2220 Errors that can occur in addition to the errors normally associated 2221 with file system access: 2222 2223 E2BIG 2224 Data to be returned in a read(2) of the page data file 2225 exceeds the size of the read buffer provided by the 2226 caller. 2227 2228 2229 EACCES 2230 An attempt was made to examine a process that ran under a 2231 different uid than the controlling process and 2232 {PRIV_PROC_OWNER} was not asserted in the effective set. 2233 2234 2235 EAGAIN 2236 The traced process has performed an exec(2) of a 2237 setuid/setgid object file or of an object file that it 2238 cannot read; all further operations on the process or lwp 2239 file descriptor (except close(2)) elicit this error. 2240 2241 2242 EBUSY 2243 PCSTOP, PCDSTOP, PCWSTOP, or PCTWSTOP was applied to a 2244 system process; an exclusive open(2) was attempted on a 2245 /proc file for a process already open for writing; PCRUN, 2246 PCSREG, PCSVADDR, PCSFPREG, or PCSXREG was applied to a 2247 process or lwp not stopped on an event of interest; an 2248 attempt was made to mount /proc when it was already 2249 mounted; PCAGENT was applied to a process that was not 2250 fully stopped or that already had an agent lwp. 2251 2252 2253 EINVAL 2254 In general, this means that some invalid argument was 2255 supplied to a system call. A non-exhaustive list of 2256 conditions eliciting this error includes: a control 2257 message operation code is undefined; an out-of-range 2258 signal number was specified with PCSSIG, PCKILL, or 2259 PCUNKILL; SIGKILL was specified with PCUNKILL; PCSFPREG 2260 was applied on a system that does not support floating- 2261 point operations; PCSXREG was applied on a system that 2262 does not support extra state registers. 2263 2264 2265 EINTR 2266 A signal was received by the controlling process while 2267 waiting for the traced process or lwp to stop via PCSTOP, 2268 PCWSTOP, or PCTWSTOP. 2269 2270 2271 EIO 2272 A write(2) was attempted at an illegal address in the 2273 traced process. 2274 2275 2276 ENOENT 2277 The traced process or lwp has terminated after being 2278 opened. The basic privilege {PRIV_PROC_INFO} is not 2279 asserted in the effective set of the calling process and 2280 the calling process cannot send a signal to the target 2281 process. 2282 2283 2284 ENOMEM 2285 The system-imposed limit on the number of page data file 2286 descriptors was reached on an open of /proc/pid/pagedata; 2287 an attempt was made with PCWATCH to establish more watched 2288 areas than the system can support; the PCAGENT operation 2289 was issued when the system was out of resources for 2290 creating lwps. 2291 2292 2293 ENOSYS 2294 An attempt was made to perform an unsupported operation 2295 (such as creat(2), link(2), or unlink(2)) on an entry in 2296 /proc. 2297 2298 2299 EOVERFLOW 2300 A 32-bit controlling process attempted to read or write 2301 the as file or attempted to read the map, rmap, or 2302 pagedata file of a 64-bit target process. A 32-bit 2303 controlling process attempted to apply one of the control 2304 operations PCSREG, PCSXREG, PCSVADDR, PCWATCH, PCAGENT, 2305 PCREAD, PCWRITE to a 64-bit target process. 2306 2307 2308 EPERM 2309 The process that issued the PCSCRED or PCSCREDX operation 2310 did not have the {PRIV_PROC_SETID} privilege asserted in 2311 its effective set, or the process that issued the PCNICE 2312 operation did not have the {PRIV_PROC_PRIOCNTL} in its 2313 effective set. 2314 2315 An attempt was made to control a process of which the E, 2316 P, and I privilege sets were not a subset of the effective 2317 set of the controlling process or the limit set of the 2318 controlling process is not a superset of limit set of the 2319 controlled process. 2320 2321 Any of the uids of the target process are 0 or an attempt 2322 was made to change any of the uids to 0 using PCSCRED and 2323 the security policy imposed additional restrictions. See 2324 privileges(5). 2325 2326 2327 NOTES 2328 Descriptions of structures in this document include only interesting 2329 structure elements, not filler and padding fields, and may show 2330 elements out of order for descriptive clarity. The actual structure 2331 definitions are contained in <procfs.h>. 2332 2333 BUGS 2334 Because the old ioctl(2)-based version of /proc is currently supported 2335 for binary compatibility with old applications, the top-level directory 2336 for a process, /proc/pid, is not world-readable, but it is world- 2337 searchable. Thus, anyone can open /proc/pid/psinfo even though ls(1) 2338 applied to /proc/pid will fail for anyone but the owner or an 2339 appropriately privileged process. Support for the old ioctl(2)-based 2340 version of /proc will be dropped in a future release, at which time the 2341 top-level directory for a process will be made world-readable. 2342 2343 2344 On SPARC based machines, the types gregset_t and fpregset_t defined in 2345 <sys/regset.h> are similar to but not the same as the types prgregset_t 2346 and prfpregset_t defined in <procfs.h>. 2347 2348 2349 2350 August 22, 2018 PROC(4)