How is /proc able to list process IDs?

# Create a directory somewhere
mkdir /tmp/ciro

# Run `strace` with the option of 
# tracing child processes as they are
# created.
strace -f ls /tmp/ciro
execve("/bin/ls", ["ls", "/tmp/ciro/"], 0x7ffd091bfe30 /* 20 vars */) = 0
...
        # Open the file, passing some flags to it.
        openat(AT_FDCWD,     
                "/tmp/ciro/",
                O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3

        # Read the directory entries.
        getdents(3,             
                /* 2 entries */, 32768)     = 48

//                     .--> flag set if 
error = -ENOTDIR; //   |    `O_DIRECTORY` is passed
//                     |    to open(2)
//                     |
if ((nd->flags & LOOKUP_DIRECTORY) && 
        !d_can_lookup(nd->path.dentry)) {

        goto out;       // ends up returning ENOTDIR
}

#include <fcntl.h>
#include <linux/types.h>
#include <stdio.h>
#include <sys/syscall.h>
#include <unistd.h>

// Total size that the buffer that we'll allocate
// in the stack can have.
#define BUF_SIZE 1024

// The directory we'll end up reading.
const char* proc_directory_path = "/proc";

/**
 * Provide the structure that fits our current kernel structure
 * for directory entries (see linux#include/linux/dirent.h).
 */
struct linux_dirent64 {
	long           d_ino;    /* 64-bit inode number */
	off_t          d_off;    /* 64-bit offset to next structure */
	unsigned short d_reclen; /* Size of this dirent */
	unsigned char  d_type;   /* File type */
	char           d_name[]; /* Filename (null-terminated) */
};

/**
 * Reads the directory entries from `/proc`.
 *
 * It does so using by using the non-wrapped syscall
 * getdents64 until it returns 0 entries.
 */
int
main(int argc, char** argv)
{
	// `buf` that holds a piece of allocated memory to
	// be given to the Kernel to retrieve data.
	//
	// Given that we're initializing it with `BUF_SIZE`,
	// this is allocating `BUFSIZE * 1` bytes in the stack.
	char buf[BUF_SIZE];

	// file descriptor to hold the open file (directory)
	int fd;

	// number of directory entries that were read and put
	// in the buffer that we allocated in the stack.
	int directory_entries_read;

	// error code to exit.
	int err = 0;


        // Open the directory so that we're able to let the
        // kernel deal with the underlying file description.
	fd = open(proc_directory_path, O_RDONLY | O_DIRECTORY);
	if (fd == -1) {
		perror("open");
		return 1;
	}

	for (;;) {
		// Call the `getdents64` syscall passing the buffer
		// to the kernel so that it can fill with directory
		// entries.
		directory_entries_read =
		  syscall(SYS_getdents64, fd, buf, BUF_SIZE);
		if (directory_entries_read == -1) {
			perror("SYS_getdents64");
			err = 1;
			break;
		}

		if (directory_entries_read == 0) {
			err = 0;
			break;
		}

		struct linux_dirent64* entry;

		// Given that the Kernel filled our array of memory with
		// `N` entries (directory_entries_read), iterate over those
		// structs using the right offset.
		for (int off = 0; off < directory_entries_read;) {
			entry = (struct linux_dirent64*)(buf + off);

			printf("entry: %s\n", entry->d_name);
			off += entry->d_reclen;
		}
	}

	// Given that we're done with reading
	// from the file, close it to free the
	// underlying structures allocated for
	// it (and make further reads fail).
	close(fd);
	return err;
}

/**
 * file_operations describe an interface that
 * filesystems must implement in order to handle
 * calls from syscalls that interact with filesystems.
 */
struct file_operations {
	loff_t (*llseek) (struct file *, loff_t, int);
	ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
	ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
	// ...

        // The method for iterating over the directory
        // entries under a given directory.
	int (*iterate) (struct file *, struct dir_context *);

        // A method that is similar to `iterate` but allows
        // multiple calls to be performed simultaneously.
	int (*iterate_shared) (struct file *, struct dir_context *);
	// ...
} __randomize_layout;

int iterate_dir(struct file *file, struct dir_context *ctx)
{
	struct inode *inode = file_inode(file);
	bool shared = false;
	int res = -ENOTDIR;

        // making sure that either the iterate_shared or
        // iterate methods of the file_operations interface
        // are implemented
	if (file->f_op->iterate_shared)
		shared = true;
	else if (!file->f_op->iterate)
		goto out;

	// ...

        // is the directory really there?
        // if so, hand the file to the underlying
        // filesystem implementation and let it 
        // iterate over the directory entries.
	res = -ENOENT;
	if (!IS_DEADDIR(inode)) {
		ctx->pos = file->f_pos;

                // In either case, let the filesystem
                // implementation do it.
		if (shared)
			res = file->f_op->iterate_shared(file, ctx);
		else
			res = file->f_op->iterate(file, ctx);

                // update the reading offset
                // ("file pointer")
		file->f_pos = ctx->pos;

                // notify that we accessed the file
		fsnotify_access(file);
		file_accessed(file);
	}
	
        // ...
}

ubuntu@bionic:~/linux/fs/proc$ ag iterate_shared
fd.c
269:	.iterate_shared	= proc_readfd,
353:	.iterate_shared	= proc_readfdinfo,

generic.c
306:	.iterate_shared	= proc_readdir,

root.c
190:	.iterate_shared	= proc_root_readdir,

proc_net.c
184:	.iterate_shared	= proc_tgid_net_readdir,

base.c
2215:	.iterate_shared	= proc_map_files_readdir,
2587:	.iterate_shared	= proc_attr_dir_readdir,
3009:	.iterate_shared	= proc_tgid_base_readdir,
3402:	.iterate_shared	= proc_tid_base_readdir,
3612:	.iterate_shared	= proc_task_readdir,

namespaces.c
143:	.iterate_shared	= proc_ns_dir_readdir,

proc_sysctl.c
847:	.iterate_shared	= proc_sys_readdir,

root@bionic:~# funccount 'proc_*readdir'
FUNC                                    COUNT
proc_readdir                                1
proc_root_readdir                           2
proc_pid_readdir                            2

/*
 * This is the root "inode" in the /proc tree..
 */
struct proc_dir_entry proc_root = {
	.low_ino	= PROC_ROOT_INO, 
	.namelen	= 5, 
	.mode		= S_IFDIR | S_IRUGO | S_IXUGO, 
	.nlink		= 2, 
	.count		= ATOMIC_INIT(1),
	.proc_iops	= &proc_root_inode_operations, 

        // Sets the implementation of the `file_operations`
        // interface to use.
	.proc_fops	= &proc_root_operations,
	.parent		= &proc_root,
	.subdir		= RB_ROOT_CACHED,
	.name		= "/proc",
};


/*
 * The root /proc directory is special, as it has the
 * <pid> directories. Thus we don't use the generic
 * directory handling functions for that..
 */
static const struct file_operations proc_root_operations = {
	.read		 = generic_read_dir,

        // Sets the method for iterating over directory entries.
	.iterate_shared	 = proc_root_readdir,
	.llseek		= generic_file_llseek,
};

/**
 * Starts the process of listing the entries from
 * `/proc`.
 */
static int proc_root_readdir(struct file *file, struct dir_context *ctx)
{
        // Check if we're still in the context of
        // listing non-PID entries.
	if (ctx->pos < FIRST_PROCESS_ENTRY) {
		int error = proc_readdir(file, ctx);
		if (unlikely(error <= 0))
			return error;
		ctx->pos = FIRST_PROCESS_ENTRY;
	}

        // Having already read the non-pid directory
        // entries (like `/proc/meminfo`), now go 
        // list the PIDs.
	return proc_pid_readdir(file, ctx);
}

/**
 * For the /proc/ directory itself, 
 * after non-process stuff has been done.
 */
int proc_pid_readdir(struct file *file, struct dir_context *ctx)
{
	// ...

        // Given that calls to `/proc`
        // are namespaced (check out `ls /proc`
        // from within a docker container),
        // we start by grabbing the PID namespace
        // of the current task executing the 
        // getdents call.
	struct pid_namespace *ns = file_inode(file)->i_sb->s_fs_info;

	// ... do some checks ...

        // Iterate over all thread group ids 
        // (`tgid`s), capturing the task struct
        // associated with them.
	for (iter = next_tgid(ns, iter);
	     iter.task;
	     iter.tgid += 1, iter = next_tgid(ns, iter)) {
		char name[PROC_NUMBUF];
		int len;

		cond_resched();
		if (!has_pid_permissions(ns, iter.task, HIDEPID_INVISIBLE))
			continue;

                // convert the tgid to a string that we can
                // return in the dir entries
		len = snprintf(name, sizeof(name), "%d", iter.tgid);
		ctx->pos = iter.tgid + TGID_OFFSET;
		if (!proc_fill_cache(file, ctx, name, len,
				     proc_pid_instantiate, iter.task, NULL)) {
			put_task_struct(iter.task);
			return 0;
		}
	}
	ctx->pos = PID_MAX_LIMIT + TGID_OFFSET;
	return 0;
}