summaryrefslogtreecommitdiffstats
path: root/sys/kern/kern_exit.c
Commit message (Collapse)AuthorAgeFilesLines
* Properly lock accesses to p_tracep and p_traceflag. Also make a fewjhb2002-06-071-0/+5
| | | | ktrace-only things #ifdef KTRACE that were not before.
* Add POSIX.1-2001 WCONTINUED option for waitpid(2). A proc flagmike2002-06-011-1/+17
| | | | | | | | | | (P_CONTINUED) is set when a stopped process receives a SIGCONT and cleared after it has notified a parent process that has requested notification via waitpid(2) with WCONTINUED specified in its options operand. The status value can be checked with the new WIFCONTINUED() macro. Reviewed by: jake
* Whitespace: trim a trailing tab.jhb2002-05-231-1/+1
|
* Make funsetown() take a 'struct sigio **' so that the locking canalfred2002-05-061-4/+0
| | | | | | | | | | | | | | | | be done internally. Ensure that no one can fsetown() to a dying process/pgrp. We need to check the process for P_WEXIT to see if it's exiting. Process groups are already safe because there is no such thing as a pgrp zombie, therefore the proctree lock completely protects the pgrp from having sigio structures associated with it after it runs funsetownlst. Add sigio lock to witness list under proctree and allproc, but over proc and pgrp. Seigo Tanimura helped with this.
* When checking to see if the init process calls exit1(), compare p to thejhb2002-05-061-1/+1
| | | | | | initproc proc pointer instead of checking to see if the pid is 1. Submitted by: bde
* Style fixes in local variable declarations.jhb2002-05-061-9/+10
| | | | Submitted by: bde
* - Style fixes in some comments.jhb2002-05-061-9/+10
| | | | | | | - Whitespace nit. - Sort some includes. Submitted by: bde (mostly)
* style(9): 'if' and 'while' need a space after them.alfred2002-05-041-3/+3
|
* Fix the lock order reversal between the sigio lock and a process/pgrp lock intanimura2002-05-031-0/+2
| | | | funsetownlst() by locking the sigio lock across funsetownlst().
* - Reorder a few things so that when we lock the process at the end ofjhb2002-05-021-107/+118
| | | | | | | | | | | | | | | | | | | | | | | exit1() we don't have to release it until we acquire schd_lock to call cpu_throw(). - Since we can switch at any time due to preemption or a lock release prior to acquiring sched_lock, don't update switchtime and switchticks until the very end of exit1() after we have acquired sched_lock. - Interlock the proctree_lock and proc lock in wait1() and exit1() to avoid lost wakeups when a parent blocks waiting for a child to exit at the bottom of wait1(). In exit1() the proc lock interlocked with proctree_lock (and released after acquiring sched_lock) is that of the parent process. - In wait1() use an exclusive lock of proctree lock while we are looking for a process to harvest. This allows us to completely remove all references to the process once we've found one (i.e., disconnect it from pgrp's, session's, zombproc list, and it's parent's children list) "atomically" without needing to worry about a lock upgrade. - We don't need sched_lock to test if p_stat is SZOMB or SSTOP when holding the proc lock since the proc lock is always held with p_stat is set to SZOMB or SSTOP. - Protect nprocs with an xlock of the allproc_lock.
* Avoid the user-visible effect of setting SA_NOCLDWAIT when theiedowse2002-04-271-3/+3
| | | | | | | SIGCHLD handler is SIG_IGN. This is a reimplementation of the problematic revision 1.131 of kern_exit.c. To avoid accessing process UPAGES, we set a new procsig flag when the SIGCHLD handler is SIG_IGN and use that instead.
* - Lock proctree_lock instead of pgrpsess_lock.jhb2002-04-161-7/+7
| | | | - Exclusively lock proctree_lock while calling leavepgrp().
* We don't need Giant to read the pgrp ID since the proc lock has protectedjhb2002-04-091-5/+3
| | | | | | p_pgrp since the pgrp locking went in. We also don't need it to check for invalid values in the options argument to wait1(), so push Giant down slightly.
* Close some holes with p->p_args by NULL'ing out the p->p_args pointeralfred2002-03-311-1/+4
| | | | | | | while holding the proc lock, and by holding the pargs structure when accessing it from outside of the owner. Submitted by: Jonathan Mini <mini@haikugeek.com>
* Make the reference counting of 'struct pargs' SMP safe.alfred2002-03-271-2/+1
| | | | | | | | | There is still some locations where the PROC lock should be held in order to prevent inconsistent views from outside (like the proc->p_fd fix for kern/vfs_syscalls.c:checkdirs()) that can be fixed later. Submitted by: Jonathan Mini <mini@haikugeek.com>
* Remove references to vm_zone.h and switch over to the new uma API.jeff2002-03-201-2/+2
| | | | | Also, remove maxsockets. If you look carefully you'll notice that the old zone allocator never honored this anyway.
* Remove __P.alfred2002-03-191-1/+1
|
* Do not lock the pgrpsess_lock exclusively across ttywait().tanimura2002-03-111-0/+2
| | | | | Spotted by: David Wolfskill <david@catwhisker.org> Investigated by: rwatson
* Lock struct pgrp, session and sigio.tanimura2002-02-231-17/+47
| | | | | | | | | | | | | | | | | | | | | | | | | New locks are: - pgrpsess_lock which locks the whole pgrps and sessions, - pg_mtx which protects the pgrp members, and - s_mtx which protects the session members. Please refer to sys/proc.h for the coverage of these locks. Changes on the pgrp/session interface: - pgfind() needs the pgrpsess_lock held. - The caller of enterpgrp() is responsible to allocate a new pgrp and session. - Call enterthispgrp() in order to enter an existing pgrp. - pgsignal() requires a pgrp lock held. Reviewed by: jhb, alfred Tested on: cvsup.jp.FreeBSD.org (which is a quad-CPU machine running -current)
* Convert p->p_runtime and PCPU(switchtime) to bintime format.phk2002-02-221-1/+1
|
* Fix a race with free'ing vmspaces at process exit when vmspaces arealfred2002-02-051-3/+4
| | | | | | | | | | | | | | | | | | | shared. Also introduce vm_endcopy instead of using pointer tricks when initializing new vmspaces. The race occured because of how the reference was utilized: test vmspace reference, possibly block, decrement reference When sharing a vmspace between multiple processes it was possible for two processes exiting at the same time to test the reference count, possibly block and neither one free because they wouldn't see the other's update. Submitted by: green
* Release text vnode in exit() rather than wait(). Occasionallydwmalone2002-01-051-8/+8
| | | | | | | | | fifesystem problems could prevent the release from completing and this could result in init being blocked indefinitely. This was looked over by Matt ages ago. Approved by: dillon
* Change the preemption code for software interrupt thread schedules andjhb2002-01-051-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | mutex releases to not require flags for the cases when preemption is not allowed: The purpose of the MTX_NOSWITCH and SWI_NOSWITCH flags is to prevent switching to a higher priority thread on mutex releease and swi schedule, respectively when that switch is not safe. Now that the critical section API maintains a per-thread nesting count, the kernel can easily check whether or not it should switch without relying on flags from the programmer. This fixes a few bugs in that all current callers of swi_sched() used SWI_NOSWITCH, when in fact, only the ones called from fast interrupt handlers and the swi_sched of softclock needed this flag. Note that to ensure that swi_sched()'s in clock and fast interrupt handlers do not switch, these handlers have to be explicitly wrapped in critical_enter/exit pairs. Presently, just wrapping the handlers is sufficient, but in the future with the fully preemptive kernel, the interrupt must be EOI'd before critical_exit() is called. (critical_exit() can switch due to a deferred preemption in a fully preemptive kernel.) I've tested the changes to the interrupt code on i386 and alpha. I have not tested ia64, but the interrupt code is almost identical to the alpha code, so I expect it will work fine. PowerPC and ARM do not yet have interrupt code in the tree so they shouldn't be broken. Sparc64 is broken, but that's been ok'd by jake and tmm who will be fixing the interrupt code for sparc64 shortly. Reviewed by: peter Tested on: i386, alpha
* Eliminate semexit_hook using at_exit(9) and rm_at_exit(9).alc2001-12-301-5/+0
| | | | Reviewed by: alfred
* Make AIO a loadable module.alfred2001-12-291-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | Remove the explicit call to aio_proc_rundown() from exit1(), instead AIO will use at_exit(9). Add functions at_exec(9), rm_at_exec(9) which function nearly the same as at_exec(9) and rm_at_exec(9), these functions are called on behalf of modules at the time of execve(2) after the image activator has run. Use a modified version of tegge's suggestion via at_exec(9) to close an exploitable race in AIO. Fix SYSCALL_MODULE_HELPER such that it's archetecuterally neutral, the problem was that one had to pass it a paramater indicating the number of arguments which were actually the number of "int". Fix it by using an inline version of the AS macro against the syscall arguments. (AS should be available globally but we'll get to that later.) Add a primative system for dynamically adding kqueue ops, it's really not as sophisticated as it should be, but I'll discuss with jlemon when he's around.
* #ifdef KTRACE a variable to silence a warning.phk2001-11-021-0/+2
| | | | Submitted by: Maxime "mux" Henrion <mux@qualys.com>
* Use the thread we have instead of finding anotherjulian2001-10-301-1/+1
| | | | that may be the wrong one.
* Add a per-thread ucred reference for syscalls and synchronous traps fromjhb2001-10-261-0/+10
| | | | | | | | | userland. The per thread ucred reference is immutable and thus needs no locks to be read. However, until all the proc locking associated with writes to p_ucred are completed, it is still not safe to use the per-thread reference. Tested on: x86 (SMP), alpha, sparc64
* Fix ktrace enablement/disablement races that can result in a vnodedillon2001-10-241-2/+5
| | | | | | | | ref count panic. Bug noticed by: ps Reviewed by: ps MFC after: 1 day
* Change the sx(9) assertion API to use a sx_assert() function similar tojhb2001-10-231-1/+1
| | | | mtx_assert(9) rather than several SX_ASSERT_* macros.
* KSE Milestone 2julian2001-09-121-28/+46
| | | | | | | | | | | | | | Note ALL MODULES MUST BE RECOMPILED make the kernel aware that there are smaller units of scheduling than the process. (but only allow one thread per process at this time). This is functionally equivalent to teh previousl -current except that there is a thread associated with each process. Sorry john! (your next MFC will be a doosie!) Reviewed by: peter@freebsd.org, dillon@freebsd.org X-MFC after: ha ha ha ha
* Rip some well duplicated code out of cpu_wait() and cpu_exit() and movepeter2001-09-101-7/+26
| | | | | | | | | | | | it to the MI area. KSE touched cpu_wait() which had the same change replicated five ways for each platform. Now it can just do it once. The only MD parts seemed to be dealing with fpu state cleanup and things like vm86 cleanup on x86. The rest was identical. XXX: ia64 and powerpc did not have cpu_throw(), so I've put a functional stub in place. Reviewed by: jake, tmm, dillon
* Giant pushdown sys_exit(), [o]wait(), wait4()dillon2001-09-011-16/+39
|
* *** empty log message ***peter2001-08-091-20/+0
|
* Temporarily back out kern_sig.c rev 1.125 and kern_exit.c rev 1.131.peter2001-08-011-4/+3
| | | | | | | | | This paniced my one of my machines one time too many :-( and there is no sign of a solution in the pipeline. The deltas are still easily available in cvs. The problem is that if the parent has been swapped out, the child process cannot grope around in the parent's UPAGES to see the sigact[] array or it will fault. This probably is a showstopper for this implementation anyway.
* As per further discussions on hackers redo the SIGCHLD patch to not generatedillon2001-07-221-3/+4
| | | | | | | | | an unexpected user-visible side effect with the sigaction flags. Also cleanup a minor union issue. Submitted by: Rudolf Cejka <cejkar@dcse.fee.vutbr.cz> MFC addendum: MFC will be combined w/ original commit MFC after: 3 days
* With Alfred's permission, remove vm_mtx in favor of a fine-grained approachdillon2001-07-041-2/+2
| | | | | | | | | (this commit is just the first stage). Also add various GIANT_ macros to formalize the removal of Giant, making it easy to test in a more piecemeal fashion. These macros will allow us to test fine-grained locks to a degree before removing Giant, and also after, and to remove Giant in a piecemeal fashion via sysctl's on those subsystems which the authors believe can operate without Giant.
* - Always use the proc lock of the task leader to protect the peers list ofjhb2001-06-271-15/+12
| | | | | | | | | | | | | | processes. - Don't construct fake call args and then call kill(). psignal is not anymore complicated and is quicker and not prone to locking problems. Calling psignal() avoids having to do a pfind() since we already have a proc pointer and also allows us to keep the task leader locked while we kill all the peer processes so the list is kept coherent. - When a kthread exits, do a wakeup() on its proc pointers. This can be used by kernel modules that have kthreads and want to ensure they have safely exited before completely the MOD_UNLOAD event. Connectivity provided by: Usenix wireless
* o Merge contents of struct pcred into struct ucred. Specifically, add therwatson2001-05-251-7/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | real uid, saved uid, real gid, and saved gid to ucred, as well as the pcred->pc_uidinfo, which was associated with the real uid, only rename it to cr_ruidinfo so as not to conflict with cr_uidinfo, which corresponds to the effective uid. o Remove p_cred from struct proc; add p_ucred to struct proc, replacing original macro that pointed. p->p_ucred to p->p_cred->pc_ucred. o Universally update code so that it makes use of ucred instead of pcred, p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo, cr_{r,sv}{u,g}id instead of p_*, etc. o Remove pcred0 and its initialization from init_main.c; initialize cr_ruidinfo there. o Restruction many credential modification chunks to always crdup while we figure out locking and optimizations; generally speaking, this means moving to a structure like this: newcred = crdup(oldcred); ... p->p_ucred = newcred; crfree(oldcred); It's not race-free, but better than nothing. There are also races in sys_process.c, all inter-process authorization, fork, exec, and exit. o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid; remove comments indicating that the old arrangement was a problem. o Restructure exec1() a little to use newcred/oldcred arrangement, and use improved uid management primitives. o Clean up exit1() so as to do less work in credential cleanup due to pcred removal. o Clean up fork1() so as to do less work in credential cleanup and allocation. o Clean up ktrcanset() to take into account changes, and move to using suser_xxx() instead of performing a direct uid==0 comparision. o Improve commenting in various kern_prot.c credential modification calls to better document current behavior. In a couple of places, current behavior is a little questionable and we need to check POSIX.1 to make sure it's "right". More commenting work still remains to be done. o Update credential management calls, such as crfree(), to take into account new ruidinfo reference. o Modify or add the following uid and gid helper routines: change_euid() change_egid() change_ruid() change_rgid() change_svuid() change_svgid() In each case, the call now acts on a credential not a process, and as such no longer requires more complicated process locking/etc. They now assume the caller will do any necessary allocation of an exclusive credential reference. Each is commented to document its reference requirements. o CANSIGIO() is simplified to require only credentials, not processes and pcreds. o Remove lots of (p_pcred==NULL) checks. o Add an XXX to authorization code in nfs_lock.c, since it's questionable, and needs to be considered carefully. o Simplify posix4 authorization code to require only credentials, not processes and pcreds. Note that this authorization, as well as CANSIGIO(), needs to be updated to use the p_cansignal() and p_cansched() centralized authorization routines, as they currently do not take into account some desirable restrictions that are handled by the centralized routines, as well as being inconsistent with other similar authorization instances. o Update libkvm to take these changes into account. Obtained from: TrustedBSD Project Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
* Introduce a global lock for the vm subsystem (vm_mtx).alfred2001-05-191-0/+2
| | | | | | | | | | | | | | | | | | | vm_mtx does not recurse and is required for most low level vm operations. faults can not be taken without holding Giant. Memory subsystems can now call the base page allocators safely. Almost all atomic ops were removed as they are covered under the vm mutex. Alpha and ia64 now need to catch up to i386's trap handlers. FFS and NFS have been tested, other filesystems will need minor changes (grabbing the vm lock when twiddling page properties). Reviewed (partially) by: jake, jhb
* Don't hold the process mutex across calls to FREE() since the vm systemjhb2001-05-041-1/+0
| | | | | | | uses lockmgr locks and this leads to a lock order reversal. At this point in wait1() the process is not on any process lists or in the process tree, so no other process should be able to find it or have a reference to it anyways, so the locking is not needed.
* Do not leave a process with no credential in zombproc.tanimura2001-04-251-17/+14
| | | | Reviewed by: jhb
* Change the pfind() and zpfind() functions to lock the process that theyjhb2001-04-241-2/+1
| | | | | | find before releasing the allproc lock and returning. Reviewed by: -smp, dfr, jake
* Convert the allproc and proctree locks from lockmgr locks to sx locks.jhb2001-03-281-16/+17
|
* Catch up to header include changes:jhb2001-03-281-1/+1
| | | | | - <sys/mutex.h> now requires <sys/systm.h> - <sys/mutex.h> and <sys/sx.h> now require <sys/lock.h>
* - Call proc_reparent() when handing a process off to init in exit ratherjhb2001-03-071-18/+23
| | | | | | | | | | than dinking around in the process lists explicitly. - Hold both the proctree lock and proc lock of the child process when reparenting a process via proc_reparent. - Lock processes while sending them signals. - Miscellaenous proc locking. - proc_reparent() now asserts that the child is locked in addition to an exclusive proctree lock.
* Streamline updating of switchtime (don't copy code from kern_sync.c).tegge2001-02-221-4/+2
| | | | Submitted by: jhb
* Protect update of the per processor switchtime variable againsttegge2001-02-221-1/+5
| | | | | | | | | interrupts. Protect usage of the per processor switchtime variable against interrupts in calcru(). This seem to eliminate the "microuptime() went backwards" warnings.
* o Move per-process jail pointer (p->pr_prison) to inside of the subjectrwatson2001-02-211-9/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | credential structure, ucred (cr->cr_prison). o Allow jail inheritence to be a function of credential inheritence. o Abstract prison structure reference counting behind pr_hold() and pr_free(), invoked by the similarly named credential reference management functions, removing this code from per-ABI fork/exit code. o Modify various jail() functions to use struct ucred arguments instead of struct proc arguments. o Introduce jailed() function to determine if a credential is jailed, rather than directly checking pointers all over the place. o Convert PRISON_CHECK() macro to prison_check() function. o Move jail() function prototypes to jail.h. o Emulate the P_JAILED flag in fill_kinfo_proc() and no longer set the flag in the process flags field itself. o Eliminate that "const" qualifier from suser/p_can/etc to reflect mutex use. Notes: o Some further cleanup of the linux/jail code is still required. o It's now possible to consider resolving some of the process vs credential based permission checking confusion in the socket code. o Mutex protection of struct prison is still not present, and is required to protect the reference count plus some fields in the structure. Reviewed by: freebsd-arch Obtained from: TrustedBSD Project
* Revert the previous revision for two reasons:jhb2001-02-091-2/+0
| | | | | | | - I can't seem to reproduce the warning I got from WITNESS anymore. - The fix was wrong. Since a uidinfo struct is a member of proc, it makes sense for the locking order to be such that you are allowed to hold proc and then grab the uidinfo lock.
OpenPOWER on IntegriCloud