summaryrefslogtreecommitdiffstats
path: root/sys/kern/kern_exec.c
Commit message (Collapse)AuthorAgeFilesLines
...
* More caddr_t removal, make fo_ioctl take a void * instead of a caddr_t.alfred2002-06-291-1/+1
|
* o Eliminate vmspace::vm_minsaddr. It's initialized but never used.alc2002-06-251-1/+0
| | | | | o Replace stale comments in vmspace by "const until freed" annotations on some fields.
* Don't leak resources if fdcheckstd() fails during exec.alfred2002-06-201-5/+10
| | | | Submitted by: Mike Makonnen <makonnen@pacbell.net>
* Squish the "could sleep with process lock" messages caused by callingalfred2002-06-191-1/+4
| | | | | | | | | | | | | | | | | | | | uifind() with a proc lock held. change_ruid() and change_euid() have been modified to take a uidinfo structure which will be pre-allocated by callers, they will then call uihold() on the uidinfo structure so that the caller's logic is simplified. This allows one to call uifind() before locking the proc struct and thereby avoid a potential blocking allocation with the proc lock held. This may need revisiting, perhaps keeping a spare uidinfo allocated per process to handle this situation or re-examining if the proc lock needs to be held over the entire operation of changing real or effective user id. Submitted by: Don Lewis <dl-freebsd@catspoiler.org>
* Properly lock accesses to p_tracep and p_traceflag. Also make a fewjhb2002-06-071-1/+10
| | | | ktrace-only things #ifdef KTRACE that were not before.
* - Reorder execve() so that it performs blocking operations before itjhb2002-05-021-61/+73
| | | | | | | | locks the process. - Defer other blocking operations such as vrele()'s until after we release locks. - execsigs() now requires the proc lock to be held when it is called rather than locking the process internally.
* When exec'ing a set[ug]id program, make sure that the stdio file descriptorsnectar2002-04-191-0/+4
| | | | | | | | (0, 1, 2) are allocated by opening /dev/null for any which are not already open. Reviewed by: alfred, phk MFC after: 2 days
* Increase the size of the register stack storage on ia64 from 32K to 2MB sopeter2002-04-051-1/+7
| | | | | | | | | that we can compile gcc. This is a hack because it adds a fixed 2MB to each process's VSIZE regardless of how much is really being used since there is no grow-up stack support. At least it isn't physical memory. Sigh. Add a sysctl to enable tweaking it for new processes.
* Change the suser() API to take advantage of td_ucred as well as do ajhb2002-04-011-1/+1
| | | | | | | | | | | | general cleanup of the API. The entire API now consists of two functions similar to the pre-KSE API. The suser() function takes a thread pointer as its only argument. The td_ucred member of this thread must be valid so the only valid thread pointers are curthread and a few kernel threads such as thread0. The suser_cred() function takes a pointer to a struct ucred as its first argument and an integer flag as its second argument. The flag is currently only used for the PRISON_ROOT flag. Discussed on: smp@
* Add a local proc *p in exec_new_vmspace() to avoid repeated dereferencingalc2002-03-311-6/+7
| | | | to obtain it.
* Make the reference counting of 'struct pargs' SMP safe.alfred2002-03-271-6/+2
| | | | | | | | | There is still some locations where the PROC lock should be held in order to prevent inconsistent views from outside (like the proc->p_fd fix for kern/vfs_syscalls.c:checkdirs()) that can be fixed later. Submitted by: Jonathan Mini <mini@haikugeek.com>
* Remove an unnecessary and inconsistently used variable from exec_new_vmspace().alc2002-03-261-3/+1
|
* Remove __P.alfred2002-03-191-2/+2
|
* Convert all pmap_kenter/pmap_kremove pairs in MI code to use pmap_qenter/jake2002-03-171-2/+2
| | | | | | | | | | | | | | | pmap_qremove. pmap_kenter is not safe to use in MI code because it is not guaranteed to flush the mapping from the tlb on all cpus. If the process in question is preempted and migrates cpus between the call to pmap_kenter and pmap_kremove, the original cpu will be left with stale mappings in its tlb. This is currently not a problem for i386 because we do not use PG_G on SMP, and thus all mappings are flushed from the tlb on context switches, not just user mappings. This is not the case on all architectures, and if PG_G is to be used with SMP on i386 it will be a problem. This was committed by peter earlier as part of his fine grained tlb shootdown work for i386, which was backed out for other reasons. Reviewed by: peter
* Remove now unused struct proc *p.imp2002-02-271-1/+0
| | | | Approved by: jhb
* Simple p_ucred -> td_ucred changes to start using the per-thread ucredjhb2002-02-271-9/+7
| | | | reference.
* Back out all the pmap related stuff I've touched over the last few days.peter2002-02-271-2/+2
| | | | | | There is some unresolved badness that has been eluding me, particularly affecting uniprocessor kernels. Turning off PG_G helped (which is a bad sign) but didn't solve it entirely. Userland programs still crashed.
* Jake further reduced IPI shootdowns on sparc64 in loops by using rangedpeter2002-02-271-2/+2
| | | | | | | | shootdowns in a couple of key places. Do the same for i386. This also hides some physical addresses from higher levels and has it use the generic vm_page_t's instead. This will help for PAE down the road. Obtained from: jake (MI code, suggestions for MD part)
* Pre-KSE/M3 commit.julian2002-02-071-1/+1
| | | | | | | | | | this is a low-functionality change that changes the kernel to access the main thread of a process via the linked list of threads rather than assuming that it is embedded in the process. It IS still embeded there but remove all teh code that assumes that in preparation for the next commit which will actually move it out. Reviewed by: peter@freebsd.org, gallatin@cs.duke.edu, benno rice,
* o Call the functions registered with at_exec() from exec_new_vmspace()alc2002-01-131-4/+7
| | | | | | | instead of execve(). Otherwise, the possibility still exists for a pending AIO to modify the new address space. Reviewed by: alfred
* SMP Lock struct file, filedesc and the global file list.alfred2002-01-131-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Seigo Tanimura (tanimura) posted the initial delta. I've polished it quite a bit reducing the need for locking and adapting it for KSE. Locks: 1 mutex in each filedesc protects all the fields. protects "struct file" initialization, while a struct file is being changed from &badfileops -> &pipeops or something the filedesc should be locked. 1 mutex in each struct file protects the refcount fields. doesn't protect anything else. the flags used for garbage collection have been moved to f_gcflag which was the FILLER short, this doesn't need locking because the garbage collection is a single threaded container. could likely be made to use a pool mutex. 1 sx lock for the global filelist. struct file * fhold(struct file *fp); /* increments reference count on a file */ struct file * fhold_locked(struct file *fp); /* like fhold but expects file to locked */ struct file * ffind_hold(struct thread *, int fd); /* finds the struct file in thread, adds one reference and returns it unlocked */ struct file * ffind_lock(struct thread *, int fd); /* ffind_hold, but returns file locked */ I still have to smp-safe the fget cruft, I'll get to that asap.
* Make AIO a loadable module.alfred2001-12-291-0/+58
| | | | | | | | | | | | | | | | | | | | | | | | Remove the explicit call to aio_proc_rundown() from exit1(), instead AIO will use at_exit(9). Add functions at_exec(9), rm_at_exec(9) which function nearly the same as at_exec(9) and rm_at_exec(9), these functions are called on behalf of modules at the time of execve(2) after the image activator has run. Use a modified version of tegge's suggestion via at_exec(9) to close an exploitable race in AIO. Fix SYSCALL_MODULE_HELPER such that it's archetecuterally neutral, the problem was that one had to pass it a paramater indicating the number of arguments which were actually the number of "int". Fix it by using an inline version of the AS macro against the syscall arguments. (AS should be available globally but we'll get to that later.) Add a primative system for dynamically adding kqueue ops, it's really not as sophisticated as it should be, but I'll discuss with jlemon when he's around.
* Repeat after me -- "Use of ANSI string concatenation can be bad."obrien2001-12-101-1/+1
| | | | | | | | In this case, C99's __func__ is properly defined as: static const char __func__[] = "function-name"; and GCC 3.1 will not allow it to be used in bogus string concatenation.
* For what its worth, sync up the type of ps_arg_cache_max (unsigned long)peter2001-11-081-1/+1
| | | | with the sysctl type (signed long).
* Add a P_INEXEC flag that indicates that the process has called execve() anddes2001-10-271-15/+25
| | | | | | | | it has not yet returned. Use this flag to deny debugging requests while the process is execve()ing, and close once and for all any race conditions that might occur between execve() and various debugging interfaces. Reviewed by: jhb, rwatson
* Use vm_offset_t instead of caddr_t to fix a warning and removerobert2001-10-241-3/+3
| | | | two casts.
* Fix ktrace enablement/disablement races that can result in a vnodedillon2001-10-241-3/+7
| | | | | | | | ref count panic. Bug noticed by: ps Reviewed by: ps MFC after: 1 day
* Make MAXTSIZ, DFLDSIZ, MAXDSIZ, DFLSSIZ, MAXSSIZ, SGROWSIZ loaderps2001-10-101-5/+5
| | | | | | | tunable. Reviewed by: peter MFC after: 2 weeks
* Move setregs() out from under the PROC_LOCK so that it can use functionsdfr2001-10-101-4/+4
| | | | list suword() which may trap.
* proces -> process in a comment.jhb2001-10-091-1/+1
|
* KSE Milestone 2julian2001-09-121-19/+24
| | | | | | | | | | | | | | Note ALL MODULES MUST BE RECOMPILED make the kernel aware that there are smaller units of scheduling than the process. (but only allow one thread per process at this time). This is functionally equivalent to teh previousl -current except that there is a thread associated with each process. Sorry john! (your next MFC will be a doosie!) Reviewed by: peter@freebsd.org, dillon@freebsd.org X-MFC after: ha ha ha ha
* Pushdown Giant for acct(), kqueue(), kevent(), execve(), fork(),dillon2001-09-011-5/+10
| | | | vfork(), rfork(), jail().
* Fix a simple typo I just happened to find.alex2001-08-221-1/+1
|
* Correct spelling in a comment and remove trailing newline from add2001-07-111-2/+2
| | | | panic() call (panic() adds it itself).
* Don't share sig handlers after an execguido2001-07-091-1/+23
| | | | Reviewed by: Alfred Perlstein
* With Alfred's permission, remove vm_mtx in favor of a fine-grained approachdillon2001-07-041-6/+4
| | | | | | | | | (this commit is just the first stage). Also add various GIANT_ macros to formalize the removal of Giant, making it easy to test in a more piecemeal fashion. These macros will allow us to test fine-grained locks to a degree before removing Giant, and also after, and to remove Giant in a piecemeal fashion via sysctl's on those subsystems which the authors believe can operate without Giant.
* Fix some lock order reversals where we called free() while holding a procjhb2001-06-201-9/+11
| | | | | | lock. We now use temporary variables to save the process argument pointer and just update the pointer while holding the lock. We then perform the free on the cached pointer after releasing the lock.
* Move setugid() a little sooner to before we release tracing in casepeter2001-06-161-2/+3
| | | | crdup() or change_e*id() block on malloc() or mutex.
* o pcred-removal changes included modifications to optimize the setting ofrwatson2001-05-261-7/+8
| | | | | | | | | | | | the saved uid and gid during execve(). Unfortunately, the optimizations were incorrect in the case where the credential was updated, skipping the setting of the saved uid and gid when new credentials were generated. This change corrects that problem by handling the newcred!=NULL case correctly. Reported/tested by: David Malone <dwmalone@maths.tcd.ie> Obtained from: TrustedBSD Project
* o Merge contents of struct pcred into struct ucred. Specifically, add therwatson2001-05-251-11/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | real uid, saved uid, real gid, and saved gid to ucred, as well as the pcred->pc_uidinfo, which was associated with the real uid, only rename it to cr_ruidinfo so as not to conflict with cr_uidinfo, which corresponds to the effective uid. o Remove p_cred from struct proc; add p_ucred to struct proc, replacing original macro that pointed. p->p_ucred to p->p_cred->pc_ucred. o Universally update code so that it makes use of ucred instead of pcred, p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo, cr_{r,sv}{u,g}id instead of p_*, etc. o Remove pcred0 and its initialization from init_main.c; initialize cr_ruidinfo there. o Restruction many credential modification chunks to always crdup while we figure out locking and optimizations; generally speaking, this means moving to a structure like this: newcred = crdup(oldcred); ... p->p_ucred = newcred; crfree(oldcred); It's not race-free, but better than nothing. There are also races in sys_process.c, all inter-process authorization, fork, exec, and exit. o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid; remove comments indicating that the old arrangement was a problem. o Restructure exec1() a little to use newcred/oldcred arrangement, and use improved uid management primitives. o Clean up exit1() so as to do less work in credential cleanup due to pcred removal. o Clean up fork1() so as to do less work in credential cleanup and allocation. o Clean up ktrcanset() to take into account changes, and move to using suser_xxx() instead of performing a direct uid==0 comparision. o Improve commenting in various kern_prot.c credential modification calls to better document current behavior. In a couple of places, current behavior is a little questionable and we need to check POSIX.1 to make sure it's "right". More commenting work still remains to be done. o Update credential management calls, such as crfree(), to take into account new ruidinfo reference. o Modify or add the following uid and gid helper routines: change_euid() change_egid() change_ruid() change_rgid() change_svuid() change_svgid() In each case, the call now acts on a credential not a process, and as such no longer requires more complicated process locking/etc. They now assume the caller will do any necessary allocation of an exclusive credential reference. Each is commented to document its reference requirements. o CANSIGIO() is simplified to require only credentials, not processes and pcreds. o Remove lots of (p_pcred==NULL) checks. o Add an XXX to authorization code in nfs_lock.c, since it's questionable, and needs to be considered carefully. o Simplify posix4 authorization code to require only credentials, not processes and pcreds. Note that this authorization, as well as CANSIGIO(), needs to be updated to use the p_cansignal() and p_cansched() centralized authorization routines, as they currently do not take into account some desirable restrictions that are handled by the centralized routines, as well as being inconsistent with other similar authorization instances. o Update libkvm to take these changes into account. Obtained from: TrustedBSD Project Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
* Axe unneeded spl()'s.jhb2001-05-211-4/+1
|
* Introduce a global lock for the vm subsystem (vm_mtx).alfred2001-05-191-0/+7
| | | | | | | | | | | | | | | | | | | vm_mtx does not recurse and is required for most low level vm operations. faults can not be taken without holding Giant. Memory subsystems can now call the base page allocators safely. Almost all atomic ops were removed as they are covered under the vm mutex. Alpha and ia64 now need to catch up to i386's trap handlers. FFS and NFS have been tested, other filesystems will need minor changes (grabbing the vm lock when twiddling page properties). Reviewed (partially) by: jake, jhb
* Undo part of the tangle of having sys/lock.h and sys/mutex.h included inmarkm2001-05-011-2/+2
| | | | | | | | | | | other "system" header files. Also help the deprecation of lockmgr.h by making it a sub-include of sys/lock.h and removing sys/lockmgr.h form kernel .c files. Sort sys/*.h includes where possible in affected files. OK'ed by: bde (with reservations)
* Revert consequences of changes to mount.h, part 2.grog2001-04-291-2/+0
| | | | Requested by: bde
* Correct #includes to work with fixed sys/mount.h.grog2001-04-231-0/+2
|
* Proc locking.jhb2001-03-071-3/+9
|
* Fix typo: seperate -> separate.asmodai2001-02-061-1/+1
| | | | Seperate does not exist in the english language.
* Protect proc.p_pptr and proc.p_children/p_sibling with thejake2000-12-231-0/+2
| | | | | | | | proctree_lock. linprocfs not locked pending response from informal maintainer. Reviewed by: jhb, -smp@
* o Add a comment to exec_check_permissions() to indicate that therwatson2000-11-301-0/+1
| | | | | | | | | | passed vnode must be locked; this is the case because of calls to VOP_GETATTR(), VOP_ACCESS(), and VOP_OPEN(). This becomes more of an issue when VOP_ACCESS() gets a bit more complicated, which it does when you introduce ACL, Capability, and MAC support. Obtained from: TrustedBSD Project
* Catch up to moving headers:jhb2000-10-201-1/+1
| | | | | - machine/ipl.h -> sys/ipl.h - machine/mutex.h -> sys/mutex.h
OpenPOWER on IntegriCloud