summaryrefslogtreecommitdiffstats
path: root/sys/kern/kern_cpuset.c
diff options
context:
space:
mode:
authorjamie <jamie@FreeBSD.org>2009-05-27 14:11:23 +0000
committerjamie <jamie@FreeBSD.org>2009-05-27 14:11:23 +0000
commita013e0afcbb44052a86a7977277d669d8883b7e7 (patch)
treeb7f782d79e61a1bd80655a068684cb0fd9f39922 /sys/kern/kern_cpuset.c
parent6e53147404a7f4fb4173694bc812d9d23efd9fef (diff)
downloadFreeBSD-src-a013e0afcbb44052a86a7977277d669d8883b7e7.zip
FreeBSD-src-a013e0afcbb44052a86a7977277d669d8883b7e7.tar.gz
Add hierarchical jails. A jail may further virtualize its environment
by creating a child jail, which is visible to that jail and to any parent jails. Child jails may be restricted more than their parents, but never less. Jail names reflect this hierarchy, being MIB-style dot-separated strings. Every thread now points to a jail, the default being prison0, which contains information about the physical system. Prison0's root directory is the same as rootvnode; its hostname is the same as the global hostname, and its securelevel replaces the global securelevel. Note that the variable "securelevel" has actually gone away, which should not cause any problems for code that properly uses securelevel_gt() and securelevel_ge(). Some jail-related permissions that were kept in global variables and set via sysctls are now per-jail settings. The sysctls still exist for backward compatibility, used only by the now-deprecated jail(2) system call. Approved by: bz (mentor)
Diffstat (limited to 'sys/kern/kern_cpuset.c')
-rw-r--r--sys/kern/kern_cpuset.c52
1 files changed, 14 insertions, 38 deletions
diff --git a/sys/kern/kern_cpuset.c b/sys/kern/kern_cpuset.c
index fc2e51b..ed8c311 100644
--- a/sys/kern/kern_cpuset.c
+++ b/sys/kern/kern_cpuset.c
@@ -36,6 +36,7 @@ __FBSDID("$FreeBSD$");
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/sysproto.h>
+#include <sys/jail.h>
#include <sys/kernel.h>
#include <sys/lock.h>
#include <sys/malloc.h>
@@ -53,7 +54,6 @@ __FBSDID("$FreeBSD$");
#include <sys/limits.h>
#include <sys/bus.h>
#include <sys/interrupt.h>
-#include <sys/jail.h> /* Must come after sys/proc.h */
#include <vm/uma.h>
@@ -225,23 +225,16 @@ cpuset_lookup(cpusetid_t setid, struct thread *td)
KASSERT(td != NULL, ("[%s:%d] td is NULL", __func__, __LINE__));
if (set != NULL && jailed(td->td_ucred)) {
- struct cpuset *rset, *jset;
- struct prison *pr;
-
- rset = cpuset_refroot(set);
-
- pr = td->td_ucred->cr_prison;
- mtx_lock(&pr->pr_mtx);
- cpuset_ref(pr->pr_cpuset);
- jset = pr->pr_cpuset;
- mtx_unlock(&pr->pr_mtx);
+ struct cpuset *jset, *tset;
- if (jset->cs_id != rset->cs_id) {
+ jset = td->td_ucred->cr_prison->pr_cpuset;
+ for (tset = set; tset != NULL; tset = tset->cs_parent)
+ if (tset == jset)
+ break;
+ if (tset == NULL) {
cpuset_rel(set);
set = NULL;
}
- cpuset_rel(jset);
- cpuset_rel(rset);
}
return (set);
@@ -456,25 +449,14 @@ cpuset_which(cpuwhich_t which, id_t id, struct proc **pp, struct thread **tdp,
struct prison *pr;
sx_slock(&allprison_lock);
- pr = prison_find(id);
+ pr = prison_find_child(curthread->td_ucred->cr_prison, id);
sx_sunlock(&allprison_lock);
if (pr == NULL)
return (ESRCH);
- if (jailed(curthread->td_ucred)) {
- if (curthread->td_ucred->cr_prison == pr) {
- cpuset_ref(pr->pr_cpuset);
- set = pr->pr_cpuset;
- }
- } else {
- cpuset_ref(pr->pr_cpuset);
- set = pr->pr_cpuset;
- }
+ cpuset_ref(pr->pr_cpuset);
+ *setp = pr->pr_cpuset;
mtx_unlock(&pr->pr_mtx);
- if (set) {
- *setp = set;
- return (0);
- }
- return (ESRCH);
+ return (0);
}
case CPU_WHICH_IRQ:
return (0);
@@ -731,21 +713,15 @@ cpuset_thread0(void)
* In case of no error, returns the set in *setp locked with a reference.
*/
int
-cpuset_create_root(struct thread *td, struct cpuset **setp)
+cpuset_create_root(struct prison *pr, struct cpuset **setp)
{
- struct cpuset *root;
struct cpuset *set;
int error;
- KASSERT(td != NULL, ("[%s:%d] invalid td", __func__, __LINE__));
+ KASSERT(pr != NULL, ("[%s:%d] invalid pr", __func__, __LINE__));
KASSERT(setp != NULL, ("[%s:%d] invalid setp", __func__, __LINE__));
- thread_lock(td);
- root = cpuset_refroot(td->td_cpuset);
- thread_unlock(td);
-
- error = cpuset_create(setp, td->td_cpuset, &root->cs_mask);
- cpuset_rel(root);
+ error = cpuset_create(setp, pr->pr_cpuset, &pr->pr_cpuset->cs_mask);
if (error)
return (error);
OpenPOWER on IntegriCloud