summaryrefslogtreecommitdiffstats
path: root/sys/kern/sys_pipe.c
Commit message (Collapse)AuthorAgeFilesLines
...
* Break out mac_check_pipe_op() into component check entry points:rwatson2002-08-191-4/+4
| | | | | | | | | | | mac_check_pipe_poll(), mac_check_pipe_read(), mac_check_pipe_stat(), and mac_check_pipe_write(). This is improves consistency with other access control entry points and permits security modules to only control the object methods that they are interested in, avoiding switch statements. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* In continuation of early fileop credential changes, modify fo_ioctl() torwatson2002-08-171-3/+4
| | | | | | | | | | | | | | | | | | | | | | accept an 'active_cred' argument reflecting the credential of the thread initiating the ioctl operation. - Change fo_ioctl() to accept active_cred; change consumers of the fo_ioctl() interface to generally pass active_cred from td->td_ucred. - In fifofs, initialize filetmp.f_cred to ap->a_cred so that the invocations of soo_ioctl() are provided access to the calling f_cred. Pass ap->a_td->td_ucred as the active_cred, but note that this is required because we don't yet distinguish file_cred and active_cred in invoking VOP's. - Update kqueue_ioctl() for its new argument. - Update pipe_ioctl() for its new argument, pass active_cred rather than td_ucred to MAC for authorization. - Update soo_ioctl() for its new argument. - Update vn_ioctl() for its new argument, use active_cred rather than td->td_ucred to authorize VOP_IOCTL() and the associated VOP_GETATTR(). Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Correct white space nits that crept in during my recent merges ofrwatson2002-08-161-1/+1
| | | | trustedbsd_mac material.
* Make similar changes to fo_stat() and fo_poll() as made earlier torwatson2002-08-161-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | fo_read() and fo_write(): explicitly use the cred argument to fo_poll() as "active_cred" using the passed file descriptor's f_cred reference to provide access to the file credential. Add an active_cred argument to fo_stat() so that implementers have access to the active credential as well as the file credential. Generally modify callers of fo_stat() to pass in td->td_ucred rather than fp->f_cred, which was redundantly provided via the fp argument. This set of modifications also permits threads to perform these operations on behalf of another thread without modifying their credential. Trickle this change down into fo_stat/poll() implementations: - badfo_poll(), badfo_stat(): modify/add arguments. - kqueue_poll(), kqueue_stat(): modify arguments. - pipe_poll(), pipe_stat(): modify/add arguments, pass active_cred to MAC checks rather than td->td_ucred. - soo_poll(), soo_stat(): modify/add arguments, pass fp->f_cred rather than cred to pru_sopoll() to maintain current semantics. - sopoll(): moidfy arguments. - vn_poll(), vn_statfile(): modify/add arguments, pass new arguments to vn_stat(). Pass active_cred to MAC and fp->f_cred to VOP_POLL() to maintian current semantics. - vn_close(): rename cred to file_cred to reflect reality while I'm here. - vn_stat(): Add active_cred and file_cred arguments to vn_stat() and consumers so that this distinction is maintained at the VFS as well as 'struct file' layer. Pass active_cred instead of td->td_ucred to MAC and to VOP_GETATTR() to maintain current semantics. - fifofs: modify the creation of a "filetemp" so that the file credential is properly initialized and can be used in the socket code if desired. Pass ap->a_td->td_ucred as the active credential to soo_poll(). If we teach the vnop interface about the distinction between file and active credentials, we would use the active credential here. Note that current inconsistent passing of active_cred vs. file_cred to VOP's is maintained. It's not clear why GETATTR would be authorized using active_cred while POLL would be authorized using file_cred at the file system level. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* In order to better support flexible and extensible access control,rwatson2002-08-151-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | make a series of modifications to the credential arguments relating to file read and write operations to cliarfy which credential is used for what: - Change fo_read() and fo_write() to accept "active_cred" instead of "cred", and change the semantics of consumers of fo_read() and fo_write() to pass the active credential of the thread requesting an operation rather than the cached file cred. The cached file cred is still available in fo_read() and fo_write() consumers via fp->f_cred. These changes largely in sys_generic.c. For each implementation of fo_read() and fo_write(), update cred usage to reflect this change and maintain current semantics: - badfo_readwrite() unchanged - kqueue_read/write() unchanged pipe_read/write() now authorize MAC using active_cred rather than td->td_ucred - soo_read/write() unchanged - vn_read/write() now authorize MAC using active_cred but VOP_READ/WRITE() with fp->f_cred Modify vn_rdwr() to accept two credential arguments instead of a single credential: active_cred and file_cred. Use active_cred for MAC authorization, and select a credential for use in VOP_READ/WRITE() based on whether file_cred is NULL or not. If file_cred is provided, authorize the VOP using that cred, otherwise the active credential, matching current semantics. Modify current vn_rdwr() consumers to pass a file_cred if used in the context of a struct file, and to always pass active_cred. When vn_rdwr() is used without a file_cred, pass NOCRED. These changes should maintain current semantics for read/write, but avoid a redundant passing of fp->f_cred, as well as making it more clear what the origin of each credential is in file descriptor read/write operations. Follow-up commits will make similar changes to other file descriptor operations, and modify the MAC framework to pass both credentials to MAC policy modules so they can implement either semantic for revocation. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for labeling and access control of pipe objectsrwatson2002-08-131-0/+60
| | | | | | | | | | as part of the TrustedBSD MAC framework. Instrument the creation and destruction of pipes, as well as relevant operations, with necessary calls to the MAC framework. Note that the locking here is probably not quite right yet, but fixes will be forthcoming. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Check the far end before registering an EVFILT_WRITE filter on a pipe.des2002-08-051-0/+3
|
* Remove unneeded caddr_t casts.alfred2002-07-221-5/+5
|
* o Lock accesses to the page queues.alc2002-07-131-0/+11
| | | | | o Add a comment explaining why hoisting the page queue lock outside of a particular loop is not possible.
* More caddr_t removal, make fo_ioctl take a void * instead of a caddr_t.alfred2002-06-291-2/+3
|
* document that the pipe fo_stat routine doesn't need locks because it'salfred2002-06-281-0/+4
| | | | | | a read operation. Requested by: rwatson
* Make funsetown() take a 'struct sigio **' so that the locking canalfred2002-05-061-1/+1
| | | | | | | | | | | | | | | | be done internally. Ensure that no one can fsetown() to a dying process/pgrp. We need to check the process for P_WEXIT to see if it's exiting. Process groups are already safe because there is no such thing as a pgrp zombie, therefore the proctree lock completely protects the pgrp from having sigio structures associated with it after it runs funsetownlst. Add sigio lock to witness list under proctree and allproc, but over proc and pgrp. Seigo Tanimura helped with this.
* Redo the sigio locking.alfred2002-05-011-1/+1
| | | | | | | | | | | Turn the sigio sx into a mutex. Sigio lock is really only needed to protect interrupts from dereferencing the sigio pointer in an object when the sigio itself is being destroyed. In order to do this in the most unintrusive manner change pgsigio's sigio * argument into a **, that way we can lock internally to the function.
* Use pmap_extract() instead of pmap_kextract() to retrieve the physicaltmm2002-04-131-1/+2
| | | | | | | address associated with a user virtual address in pipe_build_write_buffer(). Reviewed by: alc
* Back out the last revision - it does not work correctly when one oftmm2002-04-131-17/+6
| | | | | | | | the pages in question is not in the top-level vm object, but in one of the shadow ones. Pointed out by: alc Pointy hat to: tmm
* Do not use pmap_kextract() to find out the physical address of a usertmm2002-04-121-6/+17
| | | | | | | | | | | belong to a user virtual address; while this happens to work on some architectures, it can't on sparc64, since user and kernel virtual address spaces overlap there (the distinction between them is done via separate address space identifiers). Instead, look up the page in the vm_map of the process in question. Reviewed by: jake
* Change callers of mtx_init() to pass in an appropriate lock type name. Injhb2002-04-041-1/+1
| | | | | | | most cases NULL is passed, but in some cases such as network driver locks (which use the MTX_NETWORK_LOCK macro) and UMA zone locks, a name is used. Tested on: i386, alpha, sparc64
* Allow resursion on the pipe mutex because filt_piperead() and filt_pipewrite()alc2002-03-271-1/+1
| | | | | | | | can be called both with and without the pipe mutex held. (For example, if called by pipeselwakeup(), it is held. Whereas, if called by kqueue_scan(), it is not.) Reviewed by: alfred
* When "cloning" a pipe's buffer bcopy the data after dropping the pipe'salfred2002-03-221-2/+2
| | | | lock as the data may be paged out and cause a fault.
* Remove references to vm_zone.h and switch over to the new uma API.jeff2002-03-201-4/+4
| | | | | Also, remove maxsockets. If you look carefully you'll notice that the old zone allocator never honored this anyway.
* This is the first part of the new kernel memory allocator. This replacesjeff2002-03-191-2/+2
| | | | | | malloc(9) and vm_zone with a slab like allocator. Reviewed by: arch@
* Bug fixes:alfred2002-03-151-5/+10
| | | | | | | | | | | Missed a place where the pipe sleep lock was needed in order to safely grab Giant, fix it and add an assertion to make sure this doesn't happen again. Fix typos in the PIPE_GET_GIANT/PIPE_DROP_GIANT that could cause the wrong mutex to get passed to PIPE_LOCK/PIPE_UNLOCK. Fix a location where the wrong pipe was being passed to PIPE_GET_GIANT/PIPE_DROP_GIANT.
* Don't deref NULL mutex pointer when pipeclose()'ing a pipe that is notalfred2002-03-091-30/+51
| | | | | | | | | | | | | | | | | | fully instaniated. Revert the logic in pipeclose so that we don't have the entire function pretty much under a single if() statement, instead invert the test and just return if it fails. Submitted (in different form) by: bde Don't use pool mutexes for pipes. We can not use pool mutexes because we will need to grab the select lock while holding a pipe lock which is not allowed because you may not aquire additional mutexes when holding a pool mutex. Instead malloc(9) space for the mutex that is shared between the pipes.
* Track the number of wired pages to avoid unwiring unwired pages.tanimura2002-03-051-0/+1
| | | | Reviewed by: alfred
* kill __P.alfred2002-02-271-22/+22
|
* add assertions in the places where giant is required to catch whenalfred2002-02-271-0/+12
| | | | | | | | | | | the pipe is locked and shouldn't be. initialize pipe->pipe_mtxp to NULL when creating pipes in order not to trip the above assertions. swap pipe lock with giant around calls to pipe_destroy_write_buffer() pipe_destroy_write_buffer issue noticed by: jhb
* Fix a NULL deref panic in pipe_write, we can't blindly lockalfred2002-02-271-12/+12
| | | | | pipe->pipe_peer->pipe_mtxp because it may be NULL, so lock the passed in pipe's mutex instead.
* MPsafe fixes:alfred2002-02-271-4/+23
| | | | | use SYSINIT to initialize pipe_zone. use PIPE_LOCK to protect kevent ops.
* First rev at making pipe(2) pipe's MPsafe.alfred2002-02-271-22/+68
| | | | | | | | | | | Both ends of the pipe share a pool_mutex, this makes allocation and deadlock avoidance easy. Remove some un-needed FILE_LOCK ops while I'm here. There are some issues wrt to select and the f{s,g}etown code that we'll have to deal with, I think we may also need to move the calls to vfs_timestamp outside of the sections covered by PIPE_LOCK.
* SMP Lock struct file, filedesc and the global file list.alfred2002-01-131-4/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Seigo Tanimura (tanimura) posted the initial delta. I've polished it quite a bit reducing the need for locking and adapting it for KSE. Locks: 1 mutex in each filedesc protects all the fields. protects "struct file" initialization, while a struct file is being changed from &badfileops -> &pipeops or something the filedesc should be locked. 1 mutex in each struct file protects the refcount fields. doesn't protect anything else. the flags used for garbage collection have been moved to f_gcflag which was the FILLER short, this doesn't need locking because the garbage collection is a single threaded container. could likely be made to use a pool mutex. 1 sx lock for the global filelist. struct file * fhold(struct file *fp); /* increments reference count on a file */ struct file * fhold_locked(struct file *fp); /* like fhold but expects file to locked */ struct file * ffind_hold(struct thread *, int fd); /* finds the struct file in thread, adds one reference and returns it unlocked */ struct file * ffind_lock(struct thread *, int fd); /* ffind_hold, but returns file locked */ I still have to smp-safe the fget cruft, I'll get to that asap.
* Make kevents on pipes work as described in the manpage - when the lastsobomax2001-11-191-0/+1
| | | | | | | reader/writer disconnects, ensure that anybody who is waiting for the kevent on the other end of the pipe gets EV_EOF. MFC after: 2 weeks
* Use the passed in thread to selrecord() instead of curthread.jhb2001-09-211-2/+2
|
* KSE Milestone 2julian2001-09-121-32/+32
| | | | | | | | | | | | | | Note ALL MODULES MUST BE RECOMPILED make the kernel aware that there are smaller units of scheduling than the process. (but only allow one thread per process at this time). This is functionally equivalent to teh previousl -current except that there is a thread associated with each process. Sorry john! (your next MFC will be a doosie!) Reviewed by: peter@freebsd.org, dillon@freebsd.org X-MFC after: ha ha ha ha
* cleanup: GIANT macros, rename DEPRECIATE to DEPRECATEdillon2001-07-041-3/+0
| | | | | Move p_giant_optional to proc zero'd section Remove (old) XXX zfree comment in pipe code
* With Alfred's permission, remove vm_mtx in favor of a fine-grained approachdillon2001-07-041-11/+7
| | | | | | | | | (this commit is just the first stage). Also add various GIANT_ macros to formalize the removal of Giant, making it easy to test in a more piecemeal fashion. These macros will allow us to test fine-grained locks to a degree before removing Giant, and also after, and to remove Giant in a piecemeal fashion via sysctl's on those subsystems which the authors believe can operate without Giant.
* Correctly hook up the write kqfilter to pipes.jlemon2001-06-151-5/+7
| | | | Submitted by: Niels Provos <provos@citi.umich.edu>
* The pipe_write() code was locking the pipe without busying it first indillon2001-06-041-5/+20
| | | | | | | certain cases, and a close() by another process could potentially rip the pipe out from under the (blocked) locking operation. Reported-by: Alexander Viro <viro@math.psu.edu>
* whitespace/stylealfred2001-05-241-1/+2
|
* aquire vm_mutex a little bit earlier to protect a pmap call.alfred2001-05-231-1/+1
|
* - Assert that the vm mutex is held in pipe_free_kmem().jhb2001-05-211-1/+6
| | | | | | | | - Don't release the vm mutex early in pipespace() but instead hold it across vm_object_deallocate() if vm_map_find() returns an error and across pipe_free_kmem() if vm_map_find() succeeds. - Add a XXX above a zfree() since zalloc already has its own locking, one would hope that zfree() wouldn't need the vm lock.
* Introduce a global lock for the vm subsystem (vm_mtx).alfred2001-05-191-1/+10
| | | | | | | | | | | | | | | | | | | vm_mtx does not recurse and is required for most low level vm operations. faults can not be taken without holding Giant. Memory subsystems can now call the base page allocators safely. Almost all atomic ops were removed as they are covered under the vm mutex. Alpha and ia64 now need to catch up to i386's trap handlers. FFS and NFS have been tested, other filesystems will need minor changes (grabbing the vm lock when twiddling page properties). Reviewed (partially) by: jake, jhb
* Cleanupalfred2001-05-171-54/+50
| | | | | | | | | | | | | | | | | | | | | Remove comment about setting error for reads on EOF, read returns 0 on EOF so the code should be ok. Remove non-effective priority boost, PRIO+1 doesn't do anything (according to McKusick), if a real priority boost is needed it should have been +4. Style fixes: .) return foo -> return (foo) .) FLAG1|FlAG2 -> FLAG1 | FlAG2 .) wrap long lines .) unwrap short lines .) for(i=0;i=foo;i++) -> for (i = 0; i=foo; i++) .) remove braces for some conditionals with a single statement .) fix continuation lines. md5 couldn't verify the binary because some code had to be shuffled around to address the style issues.
* initialize pipe pointersalfred2001-05-171-0/+1
|
* pipe_create has to zero out the select record earlier to avoidalfred2001-05-171-1/+1
| | | | | | | returning a half-initialized pipe and causing pipeclose() to follow a junk pointer. Discovered by: "Nick S" <snicko@noid.org>
* Remove an 'optimization' I hope to never see again.alfred2001-05-081-89/+111
| | | | | | | | | | | | | | | | | | The pipe code could not handle running out of kva, it would panic if that happened. Instead return ENFILE to the application which is an acceptable error return from pipe(2). There was some slightly tricky things that needed to be worked on, namely that the pipe code can 'realloc' the size of the buffer if it detects that the pipe could use a bit more room. However if it failed the reallocation it could not cope and would panic. Fix this by attempting to grow the pipe while holding onto our old resources. If all goes well free the old resources and use the new ones, otherwise continue to use the smaller buffer already allocated. While I'm here add a few blank lines for style(9) and remove 'register'.
* Undo part of the tangle of having sys/lock.h and sys/mutex.h included inmarkm2001-05-011-2/+2
| | | | | | | | | | | other "system" header files. Also help the deprecation of lockmgr.h by making it a sub-include of sys/lock.h and removing sys/lockmgr.h form kernel .c files. Sort sys/*.h includes where possible in affected files. OK'ed by: bde (with reservations)
* Extend kqueue down to the device layer.jlemon2001-02-151-8/+23
| | | | Backwards compatible approach suggested by: peter
* Style improvements for last fix. Should be functionally the same.dwmalone2001-01-111-19/+19
| | | | Submitted by: bde
* select() DKI is now in <sys/selinfo.h>.wollman2001-01-091-1/+1
|
* If we failed to allocate the file discriptor for the write end ofdwmalone2001-01-081-0/+8
| | | | | | | | the pipe, then we were corrupting the pipe_zone free list by calling pipeclose on rpipe twice. NULL out rpipe to avoid this. Reviewed by: dillon Reviewed by: iedowse
OpenPOWER on IntegriCloud