summaryrefslogtreecommitdiffstats
path: root/sys/kern/uipc_sem.c
Commit message (Collapse)AuthorAgeFilesLines
* In order to maximize the re-usability of kernel code in user space thiskmacy2011-09-161-17/+17
| | | | | | | | | | | | | patch modifies makesyscalls.sh to prefix all of the non-compatibility calls (e.g. not linux_, freebsd32_) with sys_ and updates the kernel entry points and all places in the code that use them. It also fixes an additional name space collision between the kernel function psignal and the libc function of the same name by renaming the kernel psignal kern_psignal(). By introducing this change now we will ease future MFCs that change syscalls. Reviewed by: rwatson Approved by: re (bz)
* Fix build breakage. Initialize error variables explicitely for !MAC case.kib2011-08-171-0/+1
| | | | | Pointy hat to: kib Approved by: re (bz)
* Add the fo_chown and fo_chmod methods to struct fileops and use themkib2011-08-161-2/+62
| | | | | | | | | | to implement fchown(2) and fchmod(2) support for several file types that previously lacked it. Add MAC entries for chown/chmod done on posix shared memory and (old) in-kernel posix semaphores. Based on the submission by: glebius Reviewed by: rwatson Approved by: re (bz)
* Second-to-last commit implementing Capsicum capabilities in the FreeBSDrwatson2011-08-111-8/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | kernel for FreeBSD 9.0: Add a new capability mask argument to fget(9) and friends, allowing system call code to declare what capabilities are required when an integer file descriptor is converted into an in-kernel struct file *. With options CAPABILITIES compiled into the kernel, this enforces capability protection; without, this change is effectively a no-op. Some cases require special handling, such as mmap(2), which must preserve information about the maximum rights at the time of mapping in the memory map so that they can later be enforced in mprotect(2) -- this is done by narrowing the rights in the existing max_protection field used for similar purposes with file permissions. In namei(9), we assert that the code is not reached from within capability mode, as we're not yet ready to enforce namespace capabilities there. This will follow in a later commit. Update two capability names: CAP_EVENT and CAP_KEVENT become CAP_POST_KEVENT and CAP_POLL_KEVENT to more accurately indicate what they represent. Approved by: re (bz) Submitted by: jonathan Sponsored by: Google Inc
* After the r219999 is merged to stable/8, rename fallocf(9) to falloc(9)kib2011-04-011-1/+1
| | | | | | | | and remove the falloc() version that lacks flag argument. This is done to reduce the KPI bloat. Requested by: jhb X-MFC-note: do not
* Make the description of the feature consistent with another similarnetchild2011-02-251-1/+1
| | | | | | description for another feature. Noticed by: trasz
* Add some FEATURE macros for various features (AUDIT/CAM/IPC/KTR/MAC/NFS/NTP/netchild2011-02-251-0/+1
| | | | | | | | | | | | | PMC/SYSV/...). No FreeBSD version bump, the userland application to query the features will be committed last and can serve as an indication of the availablility if needed. Sponsored by: Google Summer of Code 2010 Submitted by: kibab Reviewed by: arch@ (parts by rwatson, trasz, jhb) X-MFC after: to be determined in last commit with code from this project
* Set the POSIX semaphore capability when the semaphore module is enabled.jhb2010-11-191-0/+2
| | | | | | | This is ignored in HEAD where semaphores are marked as always enabled in <unistd.h>. MFC after: 1 week
* Add a facility to dynamically adjust or unconfigure p1003_1b mib.kib2010-06-021-0/+2
| | | | | | | | | Use it to allow to tune sem_nsem_max at runtime, only when sem.ko module is present in kernel. Requested and tested by: amdmi3 Reviewed by: jhb MFC after: 3 days
* Rename st_*timespec fields to st_*tim for POSIX 2008 compliance.ed2010-03-281-4/+4
| | | | | | | | | | | | | | | A nice thing about POSIX 2008 is that it finally standardizes a way to obtain file access/modification/change times in sub-second precision, namely using struct timespec, which we already have for a very long time. Unfortunately POSIX uses different names. This commit adds compatibility macros, so existing code should still build properly. Also change all source code in the kernel to work without any of the compatibility macros. This makes it all a less ambiguous. I am also renaming st_birthtime to st_birthtim, even though it was a local extension anyway. It seems Cygwin also has a st_birthtim.
* Implement compat32 shims for ksem syscalls.kib2010-03-191-59/+126
| | | | | Reviewed by: jhb MFC after: 2 weeks
* Use umtx to implement process sharable semaphore, to make this work,davidxu2010-01-051-1/+0
| | | | | | | | | | | | | | | | | | | | | | now type sema_t is a structure which can be put in a shared memory area, and multiple processes can operate it concurrently. User can either use mmap(MAP_SHARED) + sem_init(pshared=1) or use sem_open() to initialize a shared semaphore. Named semaphore uses file system and is located in /tmp directory, and its file name is prefixed with 'SEMD', so now it is chroot or jail friendly. In simplist cases, both for named and un-named semaphore, userland code does not have to enter kernel to reduce/increase semaphore's count. The semaphore is designed to be crash-safe, it means even if an application is crashed in the middle of operating semaphore, the semaphore state is still safely recovered by later use, there is no waiter counter maintained by userland code. The main semaphore code is in libc and libthr only has some necessary stubs, this makes it possible that a non-threaded application can use semaphore without linking to thread library. Old semaphore implementation is kept libc to maintain binary compatibility. The kernel ksem API is no longer used in the new implemenation. Discussed on: threads@
* Move "options MAC" from opt_mac.h to opt_global.h, as it's now in GENERICrwatson2009-06-051-1/+0
| | | | | | | | and used in a large number of files, but also because an increasing number of incorrect uses of MAC calls were sneaking in due to copy-and-paste of MAC-aware code without the associated opt_mac.h include. Discussed with: pjd
* Ensure that the semaphore value is re-checked after sem_lockbms2009-03-121-1/+1
| | | | | | | | is re-acquired, after the condition variable is signalled. PR: http://www.freebsd.org/cgi/query-pr.cgi?pr=kern/127545 MFC after: 5 days Reviewed by: attilio
* Make semaphore debugging output more useful.bms2009-03-121-2/+8
| | | | | | PR: http://www.freebsd.org/cgi/query-pr.cgi?pr=kern/127545 MFC after: 5 days Submitted by: Philip Semanchuk
* Rework the lifetime management of the kernel implementation of POSIXjhb2008-06-271-624/+562
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | semaphores. Specifically, semaphores are now represented as new file descriptor type that is set to close on exec. This removes the need for all of the manual process reference counting (and fork, exec, and exit event handlers) as the normal file descriptor operations handle all of that for us nicely. It is also suggested as one possible implementation in the spec and at least one other OS (OS X) uses this approach. Some bugs that were fixed as a result include: - References to a named semaphore whose name is removed still work after the sem_unlink() operation. Prior to this patch, if a semaphore's name was removed, valid handles from sem_open() would get EINVAL errors from sem_getvalue(), sem_post(), etc. This fixes that. - Unnamed semaphores created with sem_init() were not cleaned up when a process exited or exec'd. They were only cleaned up if the process did an explicit sem_destroy(). This could result in a leak of semaphore objects that could never be cleaned up. - On the other hand, if another process guessed the id (kernel pointer to 'struct ksem' of an unnamed semaphore (created via sem_init)) and had write access to the semaphore based on UID/GID checks, then that other process could manipulate the semaphore via sem_destroy(), sem_post(), sem_wait(), etc. - As part of the permission check (UID/GID), the umask of the proces creating the semaphore was not honored. Thus if your umask denied group read/write access but the explicit mode in the sem_init() call allowed it, the semaphore would be readable/writable by other users in the same group, for example. This includes access via the previous bug. - If the module refused to unload because there were active semaphores, then it might have deregistered one or more of the semaphore system calls before it noticed that there was a problem. I'm not sure if this actually happened as the order that modules are discovered by the kernel linker depends on how the actual .ko file is linked. One can make the order deterministic by using a single module with a mod_event handler that explicitly registers syscalls (and deregisters during unload after any checks). This also fixes a race where even if the sem_module unloaded first it would have destroyed locks that the syscalls might be trying to access if they are still executing when they are unloaded. XXX: By the way, deregistering system calls doesn't do any blocking to drain any threads from the calls. - Some minor fixes to errno values on error. For example, sem_init() isn't documented to return ENFILE or EMFILE if we run out of semaphores the way that sem_open() can. Instead, it should return ENOSPC in that case. Other changes: - Kernel semaphores now use a hash table to manage the namespace of named semaphores nearly in a similar fashion to the POSIX shared memory object file descriptors. Kernel semaphores can now also have names longer than 14 chars (up to MAXPATHLEN) and can include subdirectories in their pathname. - The UID/GID permission checks for access to a named semaphore are now done via vaccess() rather than a home-rolled set of checks. - Now that kernel semaphores have an associated file object, the various MAC checks for POSIX semaphores accept both a file credential and an active credential. There is also a new posixsem_check_stat() since it is possible to fstat() a semaphore file descriptor. - A small set of regression tests (using the ksem API directly) is present in src/tools/regression/posixsem. Reported by: kris (1) Tested by: kris Reviewed by: rwatson (lightly) MFC after: 1 month
* Remove the posixsem_check_destroy() MAC check. It is semantically identicaljhb2008-06-231-5/+0
| | | | | | | to doing a MAC check for close(), but no other types of close() (including close(2) and ksem_close(2)) have MAC checks. Discussed with: rwatson
* Keep proper track of nsegs counter: sem_free is called for allgonzo2008-06-101-4/+3
| | | | | | | | | allocated semaphores, so it's wrong to increase it conditionally, in this case for every over-the-limit semaphore nsegs is decreased without being previously increased. PR: kern/123685 Approved by: cognet (mentor)
* Attempt to improve convergence of POSIX semaphore code with style(9).rwatson2008-05-161-31/+38
| | | | MFC after: 3 days
* Free MAC label on a POSIX semaphore when the semaphore is freed.rwatson2008-01-071-0/+3
| | | | | MFC after: 3 days Submitted by: jhb
* Merge first in a series of TrustedBSD MAC Framework KPI changesrwatson2007-10-241-8/+8
| | | | | | | | | | | | | | | | | | | | | | | from Mac OS X Leopard--rationalize naming for entry points to the following general forms: mac_<object>_<method/action> mac_<object>_check_<method/action> The previous naming scheme was inconsistent and mostly reversed from the new scheme. Also, make object types more consistent and remove spaces from object types that contain multiple parts ("posix_sem" -> "posixsem") to make mechanical parsing easier. Introduce a new "netinet" object type for certain IPv4/IPv6-related methods. Also simplify, slightly, some entry point names. All MAC policy modules will need to be recompiled, and modules not updates as part of this commit will need to be modified to conform to the new KPI. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer
* Further system call comment cleanup:rwatson2007-03-051-3/+0
| | | | | | | | | | - Remove also "MP SAFE" after prior "MPSAFE" pass. (suggested by bde) - Remove extra blank lines in some cases. - Add extra blank lines in some cases. - Remove no-op comments consisting solely of the function name, the word "syscall", or the system call name. - Add punctuation. - Re-wrap some comments.
* Merge posix4/* into normal kernel hierarchy.trhodes2006-11-111-5/+4
| | | | | Reviewed by: glanced at by jhb Approved by: silence on -arch@ and -standards@
* Sweep kernel replacing suser(9) calls with priv(9) calls, assigningrwatson2006-11-061-4/+13
| | | | | | | | | | | | | specific privilege names to a broad range of privileges. These may require some future tweaking. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
* Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.hrwatson2006-10-221-1/+2
| | | | | | | | | | | | | begun with a repo-copy of mac.h to mac_framework.h. sys/mac.h now contains the userspace and user<->kernel API and definitions, with all in-kernel interfaces moved to mac_framework.h, which is now included across most of the kernel instead. This change is the first step in a larger cleanup and sweep of MAC Framework interfaces in the kernel, and will not be MFC'd. Obtained from: TrustedBSD Project Sponsored by: SPARTA
* Swap the names "sem_exithook" and "sem_exechook" in the previous commit tocperciva2006-08-161-4/+4
| | | | | | | | | | match up with reality and the prototype definitions. Register the sem_exechook as the "process_exec" event handler, not sem_exithook. Submitted by: rdivacky Sponsored by: SoC 2006
* - Change process_exec function handlers prototype to include structnetchild2006-08-151-1/+8
| | | | | | | | | | | | | image_params arg. - Change struct image_params to include struct sysentvec pointer and initialize it. - Change all consumers of process_exit/process_exec eventhandlers to new prototypes (includes splitting up into distinct exec/exit functions). - Add eventhandler to userret. Sponsored by: Google SoC 2006 Submitted by: rdivacky Parts suggested by: jhb (on hackers@)
* Convert remaining functions to ANSI C function declarations.rwatson2006-01-221-86/+28
| | | | MFC after: 1 week
* Const-qualify ksem_timedwait's parameter abstime as it's only passed in.stefanf2005-10-181-1/+1
|
* In sem_forkhook(), don't attempt to generate a copy of the process semaphorerwatson2005-06-081-0/+4
| | | | | | | | | list on fork() if the process doesn't actually have references to any semaphores. This avoids extra work, as well as potentially asking to allocate storage for 0 references. Found by: avatar MFC after: 1 week
* Introduce MAC Framework and MAC Policy entry points to label and controlrwatson2005-05-041-9/+56
| | | | | | | | | | | | | | | | | | | | | | access to POSIX Semaphores: mac_init_posix_sem() Initialize label for POSIX semaphore mac_create_posix_sem() Create POSIX semaphore mac_destroy_posix_sem() Destroy POSIX semaphore mac_check_posix_sem_destroy() Check whether semaphore may be destroyed mac_check_posix_sem_getvalue() Check whether semaphore may be queried mac_check_possix_sem_open() Check whether semaphore may be opened mac_check_posix_sem_post() Check whether semaphore may be posted to mac_check_posix_sem_unlink() Check whether semaphore may be unlinked mac_check_posix_sem_wait() Check whether may wait on semaphore Update Biba, MLS, Stub, and Test policies to implement these entry points. For information flow policies, most semaphore operations are effectively read/write. Submitted by: Dandekar Hrishikesh <rishi_dandekar at sbcglobal dot net> Sponsored by: DARPA, McAfee, SPARTA Obtained from: TrustedBSD Project
* Move definitions of 'struct kuser' and 'struct ksem' from uipc_sem.crwatson2005-05-031-19/+1
| | | | | | | | | | | to ksem.h so that they are accessible from the MAC Framework for the purposes of labeling and enforcing additional protections. #error if these are included without _KERNEL, since they are not intended (nor installed) for user application use. Submitted by: Dandekar Hrishikesh <rishi_dandekar at sbcglobal dot net> Sponsored by: DARPA, SPARTA Obtained from: TrustedBSD Project
* Insert missing increment of (i) when walking the temporary semaphorerwatson2005-02-251-2/+3
| | | | | | | | vector during fork. Fix assertion which contained an off-by-one error. Submitted by: Antoine Brodin < antoine dot brodin at laposte dot net >
* Add an exit hook, sem_forkhook(), which walks the list of POSIX semaphoresrwatson2005-02-251-1/+113
| | | | | | | | | | | | | owned by a process when it forks, and creates a matching set of references for the child process, as prescribed by POSIX. In order to avoid races with other threads in the parent process during fork(), it is necessary to allocate a temporary reference list while holding the sem_lock, then transfer those references to the new process once the sem_lock is released. The implementation is inefficient but appears functional; in order to improve the efficiency, it will be necessary to modify the existing structures and logic, which generally rely on O(n) operations over the global set of semaphores.
* Assert sem_lock in id_to_sem() and sem_lookup_byname(), since theserwatson2005-02-251-0/+2
| | | | | | functions iterate over the global POSIX semaphore lists. MFC after: 3 days
* /* -> /*- for copyright notices, minor format tweaks as necessaryimp2005-01-061-1/+1
|
* Assert the sem lock in sem_ref() and sem_rel(), as it is required torwatson2004-12-231-0/+2
| | | | safely manipulate the reference count.
* Add missing #include <sys/module.h>phk2004-05-301-0/+1
|
* Add ksem_timedwait() to complement ksem_wait().deischen2004-02-031-6/+61
| | | | Glanced at by: alfred
* Reduce gratuitous includes: don't include jail.h if it's not needed.rwatson2004-01-211-1/+0
| | | | | | | Presumably, at some point, you had to include jail.h if you included proc.h, but that is no longer required. Result of: self injury involving adding something to struct prison
* Use __FBSDID().obrien2003-06-111-2/+3
|
* Replace the at_fork, at_exec, and at_exit functions with the slightly morejhb2003-03-241-6/+12
| | | | | | | | | flexible process_fork, process_exec, and process_exit eventhandlers. This reduces code duplication and also means that I don't have to go duplicate the eventhandler locking three more times for each of at_fork, at_exec, and at_exit. Reviewed by: phk, jake, almost complete silence on arch@
* Use td_ucred of curthread instead of p_ucred of curproc. This requiredjhb2003-03-201-17/+17
| | | | | changing sem_perm() and sem_hasopen() to take a thread instead of a proc for the first argument.
* Back out M_* changes, per decision of the TRB.imp2003-02-191-3/+3
| | | | Approved by: trb
* Remove M_TRYWAIT/M_WAITOK/M_WAIT. Callers should use 0.alfred2003-01-211-3/+3
| | | | Merge M_NOWAIT/M_DONTWAIT into a single flag M_NOWAIT.
* make sem_leave return a usable errno instead of -1.alfred2003-01-101-3/+3
| | | | | | make ksem_close return that usable errno instead of -1 (ERESTART). PR: 46957
* Be consistent about funtions being static.phk2002-10-161-11/+11
| | | | Spotted by: FlexeLint
* disable debug output by default.alfred2002-10-071-24/+30
|
* Bring in my implementation of kernel support for posix realtime semaphoresalfred2002-09-181-0/+835
that are shareable between processes. There will be a cleanup shortly along with the necessary changes made to libc, libc_r, libpthread as well as the hooks into sys/conf and sys/modules.
OpenPOWER on IntegriCloud