summaryrefslogtreecommitdiffstats
path: root/sys/kern/sys_pipe.c
Commit message (Collapse)AuthorAgeFilesLines
...
* The introduction of vm object locking has caused witness to revealalc2003-07-301-1/+1
| | | | | | | | | | | a long-standing mistake in the way a portion of a pipe's KVA is allocated. Specifically, kmem_alloc_pageable() is inappropriate for use in the "direct" case because it allows a preceding vm map entry and vm object to be extended to support the new KVA allocation. However, the direct case KVA allocation should not have a backing vm object. This is corrected by using kmem_alloc_nofault(). Submitted by: tegge (with the above explanation by me)
* A few minor changes:silby2003-07-091-6/+7
| | | | | | | - Use atomic ops to update the bigpipe count - Make the bigpipe count sysctl readable - Remove a duplicate comparison in an if statement - Comment two SYSCTLs.
* Put some concrete limits on pipe memory consumption:silby2003-07-081-17/+68
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Limit the total number of pipes so that we do not exhaust all vm objects in the kernel map. When this limit is reached, a ratelimited message will be printed to the console. - Put a soft limit on the amount of memory consumable by pipes. Once the limit has been reached, all new pipes will be limited to 4K in size, rather than the default of 16K. - Put a limit on the number of pages that may be used for high speed page flipping in order to reduce the amount of wired memory. Pipe writes that occur while this limit is exceeded will fall back to non-page flipping mode. The above values are auto-tuned in subr_param.c and are scaled to take into account both the size of physical memory and the size of the kernel map. These limits help to reduce the "kernel resources exhausted" panics that could be caused by opening a large number of pipes. (Pipes alone are no longer able to exhaust all resources, but other kernel memory hogs in league with pipes may still be able to do so.) PR: 53627 Ideas / comments from: hsu, tjr, dillon@apollo.backplane.com MFC after: 1 week
* Initialize struct fileops with C99 sparse initialization.phk2003-06-181-2/+8
|
* Use __FBSDID().obrien2003-06-111-2/+3
|
* style(9).mux2003-06-091-12/+20
|
* Need to hold the same SMP lock for (knote) list traversal as forhsu2003-04-021-1/+1
| | | | | list manipulation. This lock also protects read-modify-write operations on the pipe_state field.
* - Add vm_paddr_t, a physical address type. This is required for systemsjake2003-03-251-1/+2
| | | | | | | | | | | | | | | where physical addresses larger than virtual addresses, such as i386s with PAE. - Use this to represent physical addresses in the MI vm system and in the i386 pmap code. This also changes the paddr parameter to d_mmap_t. - Fix printf formats to handle physical addresses >4G in the i386 memory detection code, and due to kvtop returning vm_paddr_t instead of u_long. Note that this is a name change only; vm_paddr_t is still the same as vm_offset_t on all currently supported platforms. Sponsored by: DARPA, Network Associates Laboratories Discussed with: re, phk (cdevsw change)
* Back out M_* changes, per decision of the TRB.imp2003-02-191-2/+2
| | | | Approved by: trb
* Do not allow kqueues to be passed via unix domain sockets.alfred2003-02-151-1/+1
|
* Use atomic ops to update amountpipekva. Amountpipekva represents thealc2003-02-131-5/+8
| | | | | total kernel virtual address space used by all pipes. It is, thus, outside the scope of any individual pipe lock.
* Remove M_TRYWAIT/M_WAITOK/M_WAIT. Callers should use 0.alfred2003-01-211-2/+2
| | | | Merge M_NOWAIT/M_DONTWAIT into a single flag M_NOWAIT.
* Bow to the whining masses and change a union back into void *. Retaindillon2003-01-131-12/+12
| | | | | removal of unnecessary casts and throw in some minor cleanups to see if anyone complains, just for the hell of it.
* Change struct file f_data to un_data, a union of the correct structdillon2003-01-121-12/+12
| | | | | | | | | | pointer types, and remove a huge number of casts from code using it. Change struct xfile xf_data to xun_data (ABI is still compatible). If we need to add a #define for f_data and xf_data we can, but I don't think it will be necessary. There are no operational changes in this commit.
* White-space changes.phk2002-12-241-7/+7
|
* Detediousficate declaration of fileops array members by introducingphk2002-12-231-12/+7
| | | | typedefs for them.
* Remove a KASSERT I added in 1.73 to catch uninitialized pipes.alfred2002-10-141-2/+0
| | | | | | | | | | | | It must be removed because it is done without the pipe being locked via pipelock() and therefore is vulnerable to races with pipespace() erroneously triggering it by temporarily zero'ing out the structure backing the pipe. It looks as if this assertion is not needed because all manipulation of the data changed by pipespace() _is_ protected by pipelock(). Reported by: kris, mckusick
* whitespace fixes.alfred2002-10-121-2/+2
|
* Change iov_base's type from `char *' to the standard `void *'. Allmike2002-10-111-1/+1
| | | | | uses of iov_base which assume its type is `char *' (in order to do pointer arithmetic) have been updated to cast iov_base to `char *'.
* In an SMP environment post-Giant it is no longer safe to blindlytruckman2002-10-031-2/+2
| | | | | | | | | dereference the struct sigio pointer without any locking. Change fgetown() to take a reference to the pointer instead of a copy of the pointer and call SIGIO_LOCK() before copying the pointer and dereferencing it. Reviewed by: rwatson
* Improve locking of pipe mutexes in the context of MAC:rwatson2002-10-011-4/+12
| | | | | | | | | | | | | | | | | | | | | | | | | (1) Where previously the pipe mutex was selectively grabbed during pipe_ioctl(), now always grab it and then release if if not needed. This protects the call to mac_check_pipe_ioctl() to make sure the label remains consistent. (Note: it looks like sigio locking may be incorrect for fgetown() since we call it not-by-reference and sigio locking assumes call by reference). (2) In pipe_stat(), lock the pipe if MAC is compiled in so that the call to mac_check_pipe_stat() gets a locked pipe to protect label consistency. We still release the lock before returning actual stat() data, risking inconsistency, but apparently our pipe locking model accepts that risk. (3) In various pipe MAC authorization checks, assert that the pipe lock is held. (4) Grab the lock when performing a pipe relabel operation, and assert it a little deeper in the stack. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Be consistent about "static" functions: if the function is markedphk2002-09-281-2/+2
| | | | | | static in its prototype, mark it static at the definition too. Inspired by: FlexeLint warning #512
* Don't use "NULL" when "0" is really meant.archie2002-08-211-2/+2
|
* Break out mac_check_pipe_op() into component check entry points:rwatson2002-08-191-4/+4
| | | | | | | | | | | mac_check_pipe_poll(), mac_check_pipe_read(), mac_check_pipe_stat(), and mac_check_pipe_write(). This is improves consistency with other access control entry points and permits security modules to only control the object methods that they are interested in, avoiding switch statements. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* In continuation of early fileop credential changes, modify fo_ioctl() torwatson2002-08-171-3/+4
| | | | | | | | | | | | | | | | | | | | | | accept an 'active_cred' argument reflecting the credential of the thread initiating the ioctl operation. - Change fo_ioctl() to accept active_cred; change consumers of the fo_ioctl() interface to generally pass active_cred from td->td_ucred. - In fifofs, initialize filetmp.f_cred to ap->a_cred so that the invocations of soo_ioctl() are provided access to the calling f_cred. Pass ap->a_td->td_ucred as the active_cred, but note that this is required because we don't yet distinguish file_cred and active_cred in invoking VOP's. - Update kqueue_ioctl() for its new argument. - Update pipe_ioctl() for its new argument, pass active_cred rather than td_ucred to MAC for authorization. - Update soo_ioctl() for its new argument. - Update vn_ioctl() for its new argument, use active_cred rather than td->td_ucred to authorize VOP_IOCTL() and the associated VOP_GETATTR(). Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Correct white space nits that crept in during my recent merges ofrwatson2002-08-161-1/+1
| | | | trustedbsd_mac material.
* Make similar changes to fo_stat() and fo_poll() as made earlier torwatson2002-08-161-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | fo_read() and fo_write(): explicitly use the cred argument to fo_poll() as "active_cred" using the passed file descriptor's f_cred reference to provide access to the file credential. Add an active_cred argument to fo_stat() so that implementers have access to the active credential as well as the file credential. Generally modify callers of fo_stat() to pass in td->td_ucred rather than fp->f_cred, which was redundantly provided via the fp argument. This set of modifications also permits threads to perform these operations on behalf of another thread without modifying their credential. Trickle this change down into fo_stat/poll() implementations: - badfo_poll(), badfo_stat(): modify/add arguments. - kqueue_poll(), kqueue_stat(): modify arguments. - pipe_poll(), pipe_stat(): modify/add arguments, pass active_cred to MAC checks rather than td->td_ucred. - soo_poll(), soo_stat(): modify/add arguments, pass fp->f_cred rather than cred to pru_sopoll() to maintain current semantics. - sopoll(): moidfy arguments. - vn_poll(), vn_statfile(): modify/add arguments, pass new arguments to vn_stat(). Pass active_cred to MAC and fp->f_cred to VOP_POLL() to maintian current semantics. - vn_close(): rename cred to file_cred to reflect reality while I'm here. - vn_stat(): Add active_cred and file_cred arguments to vn_stat() and consumers so that this distinction is maintained at the VFS as well as 'struct file' layer. Pass active_cred instead of td->td_ucred to MAC and to VOP_GETATTR() to maintain current semantics. - fifofs: modify the creation of a "filetemp" so that the file credential is properly initialized and can be used in the socket code if desired. Pass ap->a_td->td_ucred as the active credential to soo_poll(). If we teach the vnop interface about the distinction between file and active credentials, we would use the active credential here. Note that current inconsistent passing of active_cred vs. file_cred to VOP's is maintained. It's not clear why GETATTR would be authorized using active_cred while POLL would be authorized using file_cred at the file system level. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* In order to better support flexible and extensible access control,rwatson2002-08-151-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | make a series of modifications to the credential arguments relating to file read and write operations to cliarfy which credential is used for what: - Change fo_read() and fo_write() to accept "active_cred" instead of "cred", and change the semantics of consumers of fo_read() and fo_write() to pass the active credential of the thread requesting an operation rather than the cached file cred. The cached file cred is still available in fo_read() and fo_write() consumers via fp->f_cred. These changes largely in sys_generic.c. For each implementation of fo_read() and fo_write(), update cred usage to reflect this change and maintain current semantics: - badfo_readwrite() unchanged - kqueue_read/write() unchanged pipe_read/write() now authorize MAC using active_cred rather than td->td_ucred - soo_read/write() unchanged - vn_read/write() now authorize MAC using active_cred but VOP_READ/WRITE() with fp->f_cred Modify vn_rdwr() to accept two credential arguments instead of a single credential: active_cred and file_cred. Use active_cred for MAC authorization, and select a credential for use in VOP_READ/WRITE() based on whether file_cred is NULL or not. If file_cred is provided, authorize the VOP using that cred, otherwise the active credential, matching current semantics. Modify current vn_rdwr() consumers to pass a file_cred if used in the context of a struct file, and to always pass active_cred. When vn_rdwr() is used without a file_cred, pass NOCRED. These changes should maintain current semantics for read/write, but avoid a redundant passing of fp->f_cred, as well as making it more clear what the origin of each credential is in file descriptor read/write operations. Follow-up commits will make similar changes to other file descriptor operations, and modify the MAC framework to pass both credentials to MAC policy modules so they can implement either semantic for revocation. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for labeling and access control of pipe objectsrwatson2002-08-131-0/+60
| | | | | | | | | | as part of the TrustedBSD MAC framework. Instrument the creation and destruction of pipes, as well as relevant operations, with necessary calls to the MAC framework. Note that the locking here is probably not quite right yet, but fixes will be forthcoming. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Check the far end before registering an EVFILT_WRITE filter on a pipe.des2002-08-051-0/+3
|
* Remove unneeded caddr_t casts.alfred2002-07-221-5/+5
|
* o Lock accesses to the page queues.alc2002-07-131-0/+11
| | | | | o Add a comment explaining why hoisting the page queue lock outside of a particular loop is not possible.
* More caddr_t removal, make fo_ioctl take a void * instead of a caddr_t.alfred2002-06-291-2/+3
|
* document that the pipe fo_stat routine doesn't need locks because it'salfred2002-06-281-0/+4
| | | | | | a read operation. Requested by: rwatson
* Make funsetown() take a 'struct sigio **' so that the locking canalfred2002-05-061-1/+1
| | | | | | | | | | | | | | | | be done internally. Ensure that no one can fsetown() to a dying process/pgrp. We need to check the process for P_WEXIT to see if it's exiting. Process groups are already safe because there is no such thing as a pgrp zombie, therefore the proctree lock completely protects the pgrp from having sigio structures associated with it after it runs funsetownlst. Add sigio lock to witness list under proctree and allproc, but over proc and pgrp. Seigo Tanimura helped with this.
* Redo the sigio locking.alfred2002-05-011-1/+1
| | | | | | | | | | | Turn the sigio sx into a mutex. Sigio lock is really only needed to protect interrupts from dereferencing the sigio pointer in an object when the sigio itself is being destroyed. In order to do this in the most unintrusive manner change pgsigio's sigio * argument into a **, that way we can lock internally to the function.
* Use pmap_extract() instead of pmap_kextract() to retrieve the physicaltmm2002-04-131-1/+2
| | | | | | | address associated with a user virtual address in pipe_build_write_buffer(). Reviewed by: alc
* Back out the last revision - it does not work correctly when one oftmm2002-04-131-17/+6
| | | | | | | | the pages in question is not in the top-level vm object, but in one of the shadow ones. Pointed out by: alc Pointy hat to: tmm
* Do not use pmap_kextract() to find out the physical address of a usertmm2002-04-121-6/+17
| | | | | | | | | | | belong to a user virtual address; while this happens to work on some architectures, it can't on sparc64, since user and kernel virtual address spaces overlap there (the distinction between them is done via separate address space identifiers). Instead, look up the page in the vm_map of the process in question. Reviewed by: jake
* Change callers of mtx_init() to pass in an appropriate lock type name. Injhb2002-04-041-1/+1
| | | | | | | most cases NULL is passed, but in some cases such as network driver locks (which use the MTX_NETWORK_LOCK macro) and UMA zone locks, a name is used. Tested on: i386, alpha, sparc64
* Allow resursion on the pipe mutex because filt_piperead() and filt_pipewrite()alc2002-03-271-1/+1
| | | | | | | | can be called both with and without the pipe mutex held. (For example, if called by pipeselwakeup(), it is held. Whereas, if called by kqueue_scan(), it is not.) Reviewed by: alfred
* When "cloning" a pipe's buffer bcopy the data after dropping the pipe'salfred2002-03-221-2/+2
| | | | lock as the data may be paged out and cause a fault.
* Remove references to vm_zone.h and switch over to the new uma API.jeff2002-03-201-4/+4
| | | | | Also, remove maxsockets. If you look carefully you'll notice that the old zone allocator never honored this anyway.
* This is the first part of the new kernel memory allocator. This replacesjeff2002-03-191-2/+2
| | | | | | malloc(9) and vm_zone with a slab like allocator. Reviewed by: arch@
* Bug fixes:alfred2002-03-151-5/+10
| | | | | | | | | | | Missed a place where the pipe sleep lock was needed in order to safely grab Giant, fix it and add an assertion to make sure this doesn't happen again. Fix typos in the PIPE_GET_GIANT/PIPE_DROP_GIANT that could cause the wrong mutex to get passed to PIPE_LOCK/PIPE_UNLOCK. Fix a location where the wrong pipe was being passed to PIPE_GET_GIANT/PIPE_DROP_GIANT.
* Don't deref NULL mutex pointer when pipeclose()'ing a pipe that is notalfred2002-03-091-30/+51
| | | | | | | | | | | | | | | | | | fully instaniated. Revert the logic in pipeclose so that we don't have the entire function pretty much under a single if() statement, instead invert the test and just return if it fails. Submitted (in different form) by: bde Don't use pool mutexes for pipes. We can not use pool mutexes because we will need to grab the select lock while holding a pipe lock which is not allowed because you may not aquire additional mutexes when holding a pool mutex. Instead malloc(9) space for the mutex that is shared between the pipes.
* Track the number of wired pages to avoid unwiring unwired pages.tanimura2002-03-051-0/+1
| | | | Reviewed by: alfred
* kill __P.alfred2002-02-271-22/+22
|
* add assertions in the places where giant is required to catch whenalfred2002-02-271-0/+12
| | | | | | | | | | | the pipe is locked and shouldn't be. initialize pipe->pipe_mtxp to NULL when creating pipes in order not to trip the above assertions. swap pipe lock with giant around calls to pipe_destroy_write_buffer() pipe_destroy_write_buffer issue noticed by: jhb
* Fix a NULL deref panic in pipe_write, we can't blindly lockalfred2002-02-271-12/+12
| | | | | pipe->pipe_peer->pipe_mtxp because it may be NULL, so lock the passed in pipe's mutex instead.
OpenPOWER on IntegriCloud