Understanding proc_rwmem

[Fernando Apesteguía]

Hi all,

I'm trying to read process memory other than the current process in
kernel. I was told to use the proc_rwmem function, however I can't get
it working properly. At first, I'm trying to read how many elements
the environment variables vector has. To do this I tried this from a
linprocfs filler function:


        struct iovec iov;
	struct uio tmp_uio;
	struct ps_strings *pss;
	int ret_code;

	buff = malloc(sizeof(struct ps_strings), M_TEMP, M_WAITOK);
	memset(buff, 0, sizeof(struct ps_strings));

	PROC_LOCK_ASSERT(td->td_proc, MA_NOTOWNED);
	iov.iov_base = (caddr_t) buff;
	iov.iov_len = sizeof(struct ps_strings);
	tmp_uio.uio_iov = &iov;
	tmp_uio.uio_iovcnt = 1;
	tmp_uio.uio_offset = (off_t)(p->p_sysent->sv_psstrings);
	tmp_uio.uio_resid = sizeof(struct ps_strings);
	tmp_uio.uio_segflg = UIO_USERSPACE;
	tmp_uio.uio_rw = UIO_READ;
	tmp_uio.uio_td = td;
	ret_code = proc_rwmem(td->td_proc, &tmp_uio);

	if (ret_code == 0) {
		sbuf_printf(sb, "proc_rwmem successfully executed: %d\n", ret_code);
	} else {
		sbuf_printf(sb, "Error in proc_rwmem: %d\n", ret_code);
	}

	pss = (struct ps_strings *)(iov.iov_base);
	sbuf_printf(sb, "ps_nargvstr = %d\nps_nenvstr = %d\n",
			pss->ps_nargvstr, pss->ps_nenvstr);

	free(buff, M_TEMP);

Considering I left security and error handling aside, what is wrong
with the code above?
proc_rwmem returns 0 indicating no failure, but when I try to print
the result, I get random stuff. I thought maybe the problem is in the
uio_offset field, but p->p_sysent->sv_psstrings is a vm_offset_t. Is
the offset properly specified? If not, what else could be the problem?

Thanks in advance.

PS: I posted a similar question at forums.freebsd.org but got no
answer, that is why I ask here.