summaryrefslogtreecommitdiffstats
path: root/sys/i386/ibcs2/ibcs2_fcntl.c
Commit message (Collapse)AuthorAgeFilesLines
* Merge r263233 from HEAD to stable/10:rwatson2015-03-191-1/+1
| | | | | | | | | Update kernel inclusions of capability.h to use capsicum.h instead; some further refinement is required as some device drivers intended to be portable over FreeBSD versions rely on __FreeBSD_version to decide whether to include capability.h. Sponsored by: Google, Inc.
* Change the cap_rights_t type from uint64_t to a structure that we can extendpjd2013-09-051-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the future in a backward compatible (API and ABI) way. The cap_rights_t represents capability rights. We used to use one bit to represent one right, but we are running out of spare bits. Currently the new structure provides place for 114 rights (so 50 more than the previous cap_rights_t), but it is possible to grow the structure to hold at least 285 rights, although we can make it even larger if 285 rights won't be enough. The structure definition looks like this: struct cap_rights { uint64_t cr_rights[CAP_RIGHTS_VERSION + 2]; }; The initial CAP_RIGHTS_VERSION is 0. The top two bits in the first element of the cr_rights[] array contain total number of elements in the array - 2. This means if those two bits are equal to 0, we have 2 array elements. The top two bits in all remaining array elements should be 0. The next five bits in all array elements contain array index. Only one bit is used and bit position in this five-bits range defines array index. This means there can be at most five array elements in the future. To define new right the CAPRIGHT() macro must be used. The macro takes two arguments - an array index and a bit to set, eg. #define CAP_PDKILL CAPRIGHT(1, 0x0000000000000800ULL) We still support aliases that combine few rights, but the rights have to belong to the same array element, eg: #define CAP_LOOKUP CAPRIGHT(0, 0x0000000000000400ULL) #define CAP_FCHMOD CAPRIGHT(0, 0x0000000000002000ULL) #define CAP_FCHMODAT (CAP_FCHMOD | CAP_LOOKUP) There is new API to manage the new cap_rights_t structure: cap_rights_t *cap_rights_init(cap_rights_t *rights, ...); void cap_rights_set(cap_rights_t *rights, ...); void cap_rights_clear(cap_rights_t *rights, ...); bool cap_rights_is_set(const cap_rights_t *rights, ...); bool cap_rights_is_valid(const cap_rights_t *rights); void cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src); void cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src); bool cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little); Capability rights to the cap_rights_init(), cap_rights_set(), cap_rights_clear() and cap_rights_is_set() functions are provided by separating them with commas, eg: cap_rights_t rights; cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_FSTAT); There is no need to terminate the list of rights, as those functions are actually macros that take care of the termination, eg: #define cap_rights_set(rights, ...) \ __cap_rights_set((rights), __VA_ARGS__, 0ULL) void __cap_rights_set(cap_rights_t *rights, ...); Thanks to using one bit as an array index we can assert in those functions that there are no two rights belonging to different array elements provided together. For example this is illegal and will be detected, because CAP_LOOKUP belongs to element 0 and CAP_PDKILL to element 1: cap_rights_init(&rights, CAP_LOOKUP | CAP_PDKILL); Providing several rights that belongs to the same array's element this way is correct, but is not advised. It should only be used for aliases definition. This commit also breaks compatibility with some existing Capsicum system calls, but I see no other way to do that. This should be fine as Capsicum is still experimental and this change is not going to 9.x. Sponsored by: The FreeBSD Foundation
* Improve *access*() parameter name consistency.ed2011-11-191-1/+1
| | | | | | | | | The current code mixes the use of `flags' and `mode'. This is a bit confusing, since the faccessat() function as a `flag' parameter to store the AT_ flag. Make this less confusing by using the same name as used in the POSIX specification -- `amode'.
* Second-to-last commit implementing Capsicum capabilities in the FreeBSDrwatson2011-08-111-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | kernel for FreeBSD 9.0: Add a new capability mask argument to fget(9) and friends, allowing system call code to declare what capabilities are required when an integer file descriptor is converted into an in-kernel struct file *. With options CAPABILITIES compiled into the kernel, this enforces capability protection; without, this change is effectively a no-op. Some cases require special handling, such as mmap(2), which must preserve information about the maximum rights at the time of mapping in the memory map so that they can later be enforced in mprotect(2) -- this is done by narrowing the rights in the existing max_protection field used for similar purposes with file permissions. In namei(9), we assert that the code is not reached from within capability mode, as we're not yet ready to enforce namespace capabilities there. This will follow in a later commit. Update two capability names: CAP_EVENT and CAP_KEVENT become CAP_POST_KEVENT and CAP_POLL_KEVENT to more accurately indicate what they represent. Approved by: re (bz) Submitted by: jonathan Sponsored by: Google Inc
* Add the new kernel-mode NFS Lock Manager. To use it instead of thedfr2008-03-261-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | user-mode lock manager, build a kernel with the NFSLOCKD option and add '-k' to 'rpc_lockd_flags' in rc.conf. Highlights include: * Thread-safe kernel RPC client - many threads can use the same RPC client handle safely with replies being de-multiplexed at the socket upcall (typically driven directly by the NIC interrupt) and handed off to whichever thread matches the reply. For UDP sockets, many RPC clients can share the same socket. This allows the use of a single privileged UDP port number to talk to an arbitrary number of remote hosts. * Single-threaded kernel RPC server. Adding support for multi-threaded server would be relatively straightforward and would follow approximately the Solaris KPI. A single thread should be sufficient for the NLM since it should rarely block in normal operation. * Kernel mode NLM server supporting cancel requests and granted callbacks. I've tested the NLM server reasonably extensively - it passes both my own tests and the NFS Connectathon locking tests running on Solaris, Mac OS X and Ubuntu Linux. * Userland NLM client supported. While the NLM server doesn't have support for the local NFS client's locking needs, it does have to field async replies and granted callbacks from remote NLMs that the local client has contacted. We relay these replies to the userland rpc.lockd over a local domain RPC socket. * Robust deadlock detection for the local lock manager. In particular it will detect deadlocks caused by a lock request that covers more than one blocking request. As required by the NLM protocol, all deadlock detection happens synchronously - a user is guaranteed that if a lock request isn't rejected immediately, the lock will eventually be granted. The old system allowed for a 'deferred deadlock' condition where a blocked lock request could wake up and find that some other deadlock-causing lock owner had beaten them to the lock. * Since both local and remote locks are managed by the same kernel locking code, local and remote processes can safely use file locks for mutual exclusion. Local processes have no fairness advantage compared to remote processes when contending to lock a region that has just been unlocked - the local lock manager enforces a strict first-come first-served model for both local and remote lockers. Sponsored by: Isilon Systems PR: 95247 107555 115524 116679 MFC after: 2 weeks
* - Implement ibcs2_emul_find() using kern_alternate_path(). This changesjhb2005-02-071-24/+28
| | | | | | | | | | | | | | | | | the semantics in that the returned filename to use is now a kernel pointer rather than a user space pointer. This required changing the arguments to the CHECKALT*() macros some and changing the various system calls that used pathnames to use the kern_foo() functions that can accept kernel space filename pointers instead of calling the system call directly. - Use kern_open(), kern_access(), kern_execve(), kern_mkfifo(), kern_mknod(), kern_setitimer(), kern_getrusage(), kern_utimes(), kern_unlink(), kern_chdir(), kern_chmod(), kern_chown(), kern_symlink(), kern_readlink(), kern_select(), kern_statfs(), kern_fstatfs(), kern_stat(), kern_lstat(), kern_fstat(). - Drop the unused 'uap' argument from spx_open(). - Replace a stale duplication of vn_access() in xenix_access() lacking recent additions such as MAC checks, etc. with a call to kern_access().
* /* -> /*- for license, add FreeBSD tagimp2005-01-061-1/+1
|
* Fix the ABI wrappers to use kern_fcntl() rather than calling fcntl()jhb2004-08-241-47/+18
| | | | | | | | directly. This removes a few more users of the stackgap and also marks the syscalls using these wrappers MP safe where appropriate. Tested on: i386 with linux acroread5 Compiled on: i386, alpha LINT
* Use __FBSDID().obrien2003-06-021-2/+3
|
* SCARGS removal take II.alfred2002-12-141-43/+43
|
* Backout removal SCARGS, the code freeze is only "selectively" over.alfred2002-12-131-43/+43
|
* Remove SCARGS.alfred2002-12-131-43/+43
| | | | Reviewed by: md5
* In continuation of early fileop credential changes, modify fo_ioctl() torwatson2002-08-171-1/+2
| | | | | | | | | | | | | | | | | | | | | | accept an 'active_cred' argument reflecting the credential of the thread initiating the ioctl operation. - Change fo_ioctl() to accept active_cred; change consumers of the fo_ioctl() interface to generally pass active_cred from td->td_ucred. - In fifofs, initialize filetmp.f_cred to ap->a_cred so that the invocations of soo_ioctl() are provided access to the calling f_cred. Pass ap->a_td->td_ucred as the active_cred, but note that this is required because we don't yet distinguish file_cred and active_cred in invoking VOP's. - Update kqueue_ioctl() for its new argument. - Update pipe_ioctl() for its new argument, pass active_cred rather than td_ucred to MAC for authorization. - Update soo_ioctl() for its new argument. - Update vn_ioctl() for its new argument, use active_cred rather than td->td_ucred to authorize VOP_IOCTL() and the associated VOP_GETATTR(). Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Remove __P.alfred2002-03-201-5/+5
|
* Replace ffind_* with fget calls.alfred2002-01-141-2/+3
| | | | | | | | Make fget MPsafe. Make fgetvp and fgetsock use the fget subsystem to reduce code bloat. Push giant down in fpathconf().
* SMP Lock struct file, filedesc and the global file list.alfred2002-01-131-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Seigo Tanimura (tanimura) posted the initial delta. I've polished it quite a bit reducing the need for locking and adapting it for KSE. Locks: 1 mutex in each filedesc protects all the fields. protects "struct file" initialization, while a struct file is being changed from &badfileops -> &pipeops or something the filedesc should be locked. 1 mutex in each struct file protects the refcount fields. doesn't protect anything else. the flags used for garbage collection have been moved to f_gcflag which was the FILLER short, this doesn't need locking because the garbage collection is a single threaded container. could likely be made to use a pool mutex. 1 sx lock for the global filelist. struct file * fhold(struct file *fp); /* increments reference count on a file */ struct file * fhold_locked(struct file *fp); /* like fhold but expects file to locked */ struct file * ffind_hold(struct thread *, int fd); /* finds the struct file in thread, adds one reference and returns it unlocked */ struct file * ffind_lock(struct thread *, int fd); /* ffind_hold, but returns file locked */ I still have to smp-safe the fget cruft, I'll get to that asap.
* KSE Milestone 2julian2001-09-121-27/+28
| | | | | | | | | | | | | | Note ALL MODULES MUST BE RECOMPILED make the kernel aware that there are smaller units of scheduling than the process. (but only allow one thread per process at this time). This is functionally equivalent to teh previousl -current except that there is a thread associated with each process. Sorry john! (your next MFC will be a doosie!) Reviewed by: peter@freebsd.org, dillon@freebsd.org X-MFC after: ha ha ha ha
* Undo part of the tangle of having sys/lock.h and sys/mutex.h included inmarkm2001-05-011-1/+3
| | | | | | | | | | | other "system" header files. Also help the deprecation of lockmgr.h by making it a sub-include of sys/lock.h and removing sys/lockmgr.h form kernel .c files. Sort sys/*.h includes where possible in affected files. OK'ed by: bde (with reservations)
* Proc locking.jhb2001-01-231-1/+4
|
* This is what was "fdfix2.patch," a fix for fd sharing. It's prettygreen1999-09-191-1/+1
| | | | | | | | | | | | | | | | | far-reaching in fd-land, so you'll want to consult the code for changes. The biggest change is that now, you don't use fp->f_ops->fo_foo(fp, bar) but instead fo_foo(fp, bar), which increments and decrements the fp refcount upon entry and exit. Two new calls, fhold() and fdrop(), are provided. Each does what it seems like it should, and if fdrop() brings the refcount to zero, the fd is freed as well. Thanks to peter ("to hell with it, it looks ok to me.") for his review. Thanks to msmith for keeping me from putting locks everywhere :) Reviewed by: peter
* $Id$ -> $FreeBSD$peter1999-08-281-1/+1
|
* Add sufficient braces to keep egcs happy about potentially ambiguouspeter1999-05-061-4/+4
| | | | if/else nesting.
* Make SPX_HACK a new-style option.eivind1998-02-041-1/+3
|
* Move the "retval" (3rd) parameter from all syscall functions and putphk1997-11-061-23/+19
| | | | | | | | | | | | it in struct proc instead. This fixes a boatload of compiler warning, and removes a lot of cruft from the sources. I have not removed the /*ARGSUSED*/, they will require some looking at. libkvm, ps and other userland struct proc frobbing programs will need recompiled.
* Removed unused #includes.bde1997-07-201-8/+1
|
* Don't include <sys/ioctl.h> in the kernel. Stage 4: includebde1997-03-241-2/+2
| | | | | | | | <sys/ttycom.h> and sometimes <sys/filio.h> instead of <sys/ioctl.h> in miscellaneous files. Most of these files have nothing to do with ttys but need to include <sys/ttycom.h> to get the definitions of TIOC[SG]PGRP which are (ab)used to convert F[SG]ETOWN fcntls into ioctls.
* Don't #include <sys/fcntl.h> in <sys/file.h> if KERNEL is defined.bde1997-03-231-1/+2
| | | | | Fixed everything that depended on getting fcntl.h stuff from the wrong place. Most things don't depend on file.h stuff at all.
* Back out part 1 of the MCFH that changed $Id$ to $FreeBSD$. We are notpeter1997-02-221-1/+1
| | | | ready for it yet.
* Make the long-awaited change from $Id$ to $FreeBSD$jkh1997-01-141-1/+1
| | | | | | | | This will make a number of things easier in the future, as well as (finally!) avoiding the Id-smashing problem which has plagued developers for so long. Boy, I'm glad we're not using sup anymore. This update would have been insane otherwise.
* Added (null for the i386) conversions from ibcs2's bogus fcntl argsbde1995-11-121-9/+10
| | | | struct to the standard bogus fcntl args struct.
* Add a hack to emulator to emulat spx device for local X connections.swallace1995-10-161-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This is truly a hack. The idea is taken from the Linux ibcs2 emulator. To use this feature, you must use the option, options SPX_HACK in your config. Also, in /compat/ibcs2/dev, you must do: lrwxr-xr-x 1 root wheel 9 Oct 15 22:20 X0R@ -> /dev/null lrwxr-xr-x 1 root wheel 7 Oct 15 22:20 nfsd@ -> socksys lrwxr-xr-x 1 root wheel 9 Oct 15 22:20 socksys@ -> /dev/null crw-rw-rw- 1 root wheel 41, 1 Oct 15 22:14 spx Do NOT use old socksys driver as that has been removed. This hack needs /compat/ibcs2/dev/spx to be any device that does NOT exist/configured (so the now non-existant spx major/minor works fine). When an open() is called, the error ENXIO is checked and then the path is checked. If spx open detected, then a unix socket is opened to the hardcoded path "/tmp/.X11-unix/X0". As the Linux hacker author mentioned, the real way would be to detect the getmsg/putmsg through /dev/X0R and /dev/spx. Until this true solution is implemented (if ever), I think this hack is important enough to be put into the tree, even though I don't like it dirtying up my clean code (which is what #ifdef SPX_HACK is for).
* Remove old files no longer needed.swallace1995-10-101-13/+32
| | | | | | | | | | | | | | | | | | | | | Add new files created for emulator. Modify NetBSD import to work with FreeBSD and add new features and code. The complete emulator is essentially a combination of work/code implemented by Sean Eric Fagan, Soren Schmidt, Scott Bartram, and myself, Steven Wallace. Features of this new emulator system include: o "clean" code, including strict prototyping. o Auto-generation of ibcs2 system calls, xenix system calls, isc system calls. Generation includes system tables, structure definitions, and prototyping of function calls. o ibcs2 emulator does not rely on any COMPAT_43 system calls. o embedded socksys support o ibcs2 msgsys, semsys, shmsys calls supported if supported in kernel o alternate /emul/ibcs2 namespace searched first for files in ibcs2 system. Usefull to keep sysv libraries, binaries in /emul/ibcs2. o many other finer details and functions fixed or implemented.
* Import of original NetBSD's ibcs2 emulator sources by Scott Bartram,swallace1995-10-101-0/+305
which is used as a basis for a more complete and cleaner ibcs2 emulator. (snapshot about May 1995 with a few files from September 1995) Some files and code from old emulator still remains. New files, features, and changes have been implemented by myself, which will be shown in following commits.
OpenPOWER on IntegriCloud