summaryrefslogtreecommitdiffstats
path: root/sys/kern
Commit message (Collapse)AuthorAgeFilesLines
* FreeBSD/tahoe is not likely for a while.peter2001-11-031-3/+0
|
* We have a _SIG_VALID() macro, so use it instead of duplicating the test alldes2001-11-021-7/+5
| | | | | | over the place. Also replace a printf() + panic() with a KASSERT(). Reviewed by: jhb
* o Remove (struct proc *p = td->td_proc) indirection in ipcperm(),rwatson2001-11-021-5/+3
| | | | | | | | | as suser_td(td) works as well as suser_xxx(NULL, p->p_ucred, 0); This simplifies upcoming changes to suser(), and causes this code to use the right credential (well, largely) once the td->td_ucred changes are complete. There remains some redundancy and oddness in this code, which should be rethought after the next batch of suser and credential changes.
* Back out the -w, option strict and our($...). They don't work for me andimp2001-11-021-3/+3
| | | | have broken the kernel build.
* o Remove the local temporary variable "struct proc *p" from vfs_mount()rwatson2001-11-022-14/+14
| | | | | | | | | in vfs_syscalls.c. Although it did save some indirection, many of those savings will be obscured with the impending commit of suser() changes, and the result is increased code complexity. Also, once p->p_ucred and td->td_ucred are distinguished, this will make vfs_mount() use the correct thread credential, rather than the process credential.
* Argh!phk2001-11-022-42/+0
| | | | | | patch added the nmount at the bottom first time around. Take 3!
* o Introduce group subset test, which limits the ability of a process torwatson2001-11-021-8/+36
| | | | | | | | | | | | | | | | | | | debug another process based on their respective {effective,additional, saved,real} gid's. p1 is only permitted to debug p2 if its effective gids (egid + additional groups) are a strict superset of the gids of p2. This implements properly the security test previously incorrectly implemented in kern_ktrace.c, and is consistent with the kernel security policy (although might be slightly confusing for those more familiar with the userland policy). o Restructure p_candebug() logic so that various results are generated comparing uids, gids, credential changes, and then composed in a single check before testing for privilege. These tests encapsulate the "BSD" inter-process debugging policy. Other non-BSD checks remain seperate. Additional comments are added. Submitted by: tmm, rwatson Obtained from: TrustedBSD Project Reviewed by: petef, tmm, rwatson
* Add empty shell for nmount syscall (take 2!)phk2001-11-022-0/+42
|
* Add nmount() stub function and regenerate the syscall-glue which shouldphk2001-11-024-2/+46
| | | | not need to check in generated files.
* Reserve 378 for the new mount syscall Maxime Henrion <mux@qualys.com>phk2001-11-021-0/+3
| | | | is working on. (This is to get us more than 32 mountoptions).
* Don't hide the failure to allocate device behind boot verbose. It isimp2001-11-021-3/+2
| | | | | | | still telling us of real problems so should remain until it stops doing that. Submitted by: OGAWA Takaya <t-ogawa@triaez.kaisei.org>
* + Fix another possible vn_close race, in the same fashion as r1.95.jlemon2001-11-021-5/+6
| | | | | + Check that the cached vnode type != VBAD before calling devsw(), this can happen if the vnode has been revoked.
* o Add a comment to p_candebug() noting that the P_INEXEC check shouldrwatson2001-11-021-1/+6
| | | | | | | | | | | | really be moved elsewhere: p_candebug() encapsulates the security policy decision, whereas the P_INEXEC check has to do with "correctness" regarding race conditions, rather than security policy. Example: even if no security protections were enforced (the "uids are advisory" model), removing P_INEXEC could result in incorrect operation due to races on credential evaluation and modification during execve(). Obtained from: TrustedBSD Project
* Merge from POSIX.1e Capabilities development tree:rwatson2001-11-021-2/+17
| | | | | | | | | | | o Reorder and synchronize #include's, including moving "opt_cap.h" to above system includes. o Introduce #ifdef'd kern.security.capabilities sysctl tree, including kern.security.capabilities.enabled, which defaults to 0. The rest of the file remains stubs for the time being. Obtained from: TrustedBSD Project
* Merge from POSIX.1e Capabilities development tree:rwatson2001-11-021-6/+17
| | | | | | | | | o POSIX.1e capabilities authorize overriding of VEXEC for VDIR based on CAP_DAC_READ_SEARCH, but of !VDIR based on CAP_DAC_EXECUTE. Add appropriate conditionals to vaccess() to take that into account. o Synchronization cap_check_xxx() -> cap_check() change. Obtained from: TrustedBSD Project
* o Capabilities cap_check() interface revised to remove _xxx, so renamerwatson2001-11-021-1/+1
| | | | | | in p_cansched(). Also, replace '0' with 'NULL' for the ucred * pointer. Obtained from: TrustedBSD Project
* o Since kern_acl.c uses #ifdef CAPABILITIES to controlrwatson2001-11-023-0/+6
| | | | | | capability-specific semantics, #include "opt_cap.h". Obtained from: TrustedBSD Project
* #ifdef KTRACE a variable to silence a warning.phk2001-11-021-0/+2
| | | | Submitted by: Maxime "mux" Henrion <mux@qualys.com>
* Turn the symlinks around, instead of ad0s1 -> ad0s1c, make it ad0s1c -> ad0s1.phk2001-11-021-13/+23
| | | | Requested by: peter
* o Update copyright dates.rwatson2001-11-014-0/+9
| | | | | | | o Add reference to TrustedBSD Project in license header. o Update dated comments, including comment in extattr.h claiming that no file systems support extended attributes. o Improve comment consistency.
* o Move suser() calls in kern/ to using suser_xxx() with an explicitrwatson2001-11-017-13/+16
| | | | | | | | | credential selection, rather than reference via a thread or process pointer. This is part of a gradual migration to suser() accepting a struct ucred instead of a struct proc, simplifying the reference and locking semantics of suser(). Obtained from: TrustedBSD Project
* Some fix for the recent apm module changes.iwasaki2001-11-011-0/+76
| | | | | | | | | | | | | | - Now that apm loadable module can inform its existence to other kernel components (e.g. i386/isa/clock.c:startrtclock()'s TCS hack). - Exchange priority of SI_SUB_CPU and SI_SUB_KLD for above purpose. - Add simple arbitration mechanism for APM vs. ACPI. This prevents the kernel enables both of them. - Remove obsolete `#ifdef DEV_APM' related code. - Add abstracted interface for Powermanagement operations. Public apm(4) functions, such as apm_suspend(), should be replaced new interfaces. Currently only power_pm_suspend (successor of apm_suspend) is implemented. Reviewed by: peter, arch@ and audit@
* Tidy up the variable declarations and switch on warnings and strict.joe2001-11-011-35/+48
| | | | Reviewed by: diffing the generated files from before and after the change.
* Add new interface functionache2001-11-011-0/+10
| | | | | int devclass_find_free_unit(devclass_t dc, int unit); which return first free unit in given class starting from 'unit'.
* Don't remove the tentative declaration. It's the only one...marcel2001-10-311-0/+1
| | | | Pointy hat: marcel (self-sponsoring)
* Make smp_started volatile in sys/smp.h and remove the volatilemarcel2001-10-311-1/+0
| | | | | | | declaration in subr_smp.c. This solves a compile problem with gcc 3.0.1 (ia64 cross-build). Reviewed: jhb
* Add the sysctl "kern.function_list", which currently exports allgreen2001-10-304-0/+87
| | | | | | | | | | | | | | | | | function symbols in the kernel in a list of C strings, with an extra nul-termination at the end. This sysctl requires addition of a new linker operation. Now, linker_file_t's need to respond to "each_function_name" to export their function symbols. Note that the sysctl doesn't currently allow distinguishing multiple symbols with the same name from different modules, but could quite easily without a change to the linker operation. This will be a nicety to have when it can be used. Obtained from: NAI Labs CBOSS project Funded by: DARPA
* Also, machine/profile.h should be necessary for the function prototypegreen2001-10-302-0/+6
| | | | of kmupetext().
* Use kmupetext() for ELF KLDs to allow for increased text segment size.green2001-10-302-0/+12
| | | | | Obtained from: NAI Labs CBOSS project Funded by: DARPA
* Add kmupetext(), a function that expands the range of memory coveredgreen2001-10-301-5/+64
| | | | | | | | | by the profiler on a running system. This is not done sparsely, as memory is cheaper than processor speed and each gprof mcount() and mexitcount() operation is already very expensive. Obtained from: NAI Labs CBOSS project Funded by: DARPA
* Use the thread we have instead of finding anotherjulian2001-10-301-1/+1
| | | | that may be the wrong one.
* When scanning for control messages, don't process the data mbufs.dwmalone2001-10-291-1/+1
| | | | | | | This could cause hangs if a unix domain socket was closed with data still to be read from it. Tested by: Andrea Campi <andrea@webcom.it>
* Make ttyprintf() of tv_sec value type agnostic.dillon2001-10-291-4/+4
|
* 1) In devclass_alloc_unit(), skip duplicated wired devices (i.e. with fixedache2001-10-281-8/+8
| | | | | | | | | | | | | | number) instead of allocating next free unit for them. If someone needs fixed place, he must specify it correctly. "Allocating next" is especially bad because leads to double device detection and to "repeat make_dev panic" as result. This can happens if the same devices present somewhere on PCI bus, hints and ACPI. Making them present in one place only not always possible, "sc" f.e. can't be removed from hints, it results to no console at all. 2) In make_device(), detect when devclass_add_device() fails, free dev and return. I.e. add missing error checking. This part needed to finish fix in 1), but must be done this way in anycase, with old variant too.
* Adjust printfs to be time_t agnostic.dillon2001-10-281-3/+3
|
* Fix a problem in the disk related hack where device nodes for a physicallyphk2001-10-282-1/+3
| | | | | | | | non-existent disk in a legacy /dev on a DEVFS system would panic the system if stat(2)'ed. Do not whine about anonymous device nodes not having a si_devsw, they're not supposed to.
* Introduce [IPC|SHM]_[INFO|STAT] to shmctl to makemr2001-10-281-1/+44
| | | | `/compat/linux/usr/bin/ipcs -m` happy.
* syncdelay, filedelay, dirdelay, metadelay are ints, not time_t's,dillon2001-10-271-4/+4
| | | | and can also be made static.
* Nudge the axe a bit closer to cdevsw[]:phk2001-10-272-2/+66
| | | | | | | | | | | | Make it a panic to repeat make_dev() or destroy_dev(), this check should maybe be neutered when -current goes -stable. Whine if devsw() is called on anon dev_t's in a devfs system. Make a hack to avoid our lazy-eval disk code triggering the above whine. Fix the multiple make_dev() in disk code by making ${disk}${unit}s${slice} an alias/symlink to ${disk}${unit}s${slice}c
* Add a P_INEXEC flag that indicates that the process has called execve() anddes2001-10-272-15/+29
| | | | | | | | it has not yet returned. Use this flag to deny debugging requests while the process is execve()ing, and close once and for all any race conditions that might occur between execve() and various debugging interfaces. Reviewed by: jhb, rwatson
* o Update copyright dates.rwatson2001-10-274-4/+4
| | | | Obtained from: TrustedBSD Project
* o Improve style(9) compliance following KSE modifications. In particular,rwatson2001-10-273-54/+57
| | | | | | | | | strip the space from '( struct thread *...', wrap long lines. o Remove an unneeded comment on the topic of no lock being required as part of the NDINIT() in __acl_get_file(), as it's really not required there. Obtained from: TrustedBSD Project
* Add mtx_lock_giant() and mtx_unlock_giant() wrappers for sysctl managementdillon2001-10-263-6/+93
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | of Giant during the Giant unwinding phase, and start work on instrumenting Giant for the file and proc mutexes. These wrappers allow developers to turn on and off Giant around various subsystems. DEVELOPERS SHOULD NEVER TURN OFF GIANT AROUND A SUBSYSTEM JUST BECAUSE THE SYSCTL EXISTS! General developers should only considering turning on Giant for a subsystem whos default is off (to help track down bugs). Only developers working on particular subsystems who know what they are doing should consider turning off Giant. These wrappers will greatly improve our ability to unwind Giant and test the kernel on a (mostly) subsystem by subsystem basis. They allow Giant unwinding developers (GUDs) to emplace appropriate subsystem and structural mutexes in the main tree and then request that the larger community test the work by turning off Giant around the subsystem(s), without the larger community having to mess around with patches. These wrappers also allow GUDs to boot into a (more likely to be) working system in the midst of their unwinding work and to test that work under more controlled circumstances. There is a master sysctl, kern.giant.all, which defaults to 0 (off). If turned on it overrides *ALL* other kern.giant sysctls and forces Giant to be turned on for all wrapped subsystems. If turned off then Giant around individual subsystems are controlled by various other kern.giant.XXX sysctls. Code which overlaps multiple subsystems must have all related subsystem Giant sysctls turned off in order to run without Giant.
* - Change the taskqueue locking to protect the necessary parts of a taskjhb2001-10-261-36/+7
| | | | | | | | while it is on a queue with the queue lock and remove the per-task locks. - Remove TASK_DESTROY now that it is no longer needed. - Go back to inlining TASK_INIT now that it is short again. Inspired by: dfr
* Make cdevsw[] static.phk2001-10-261-1/+1
|
* Add a per-thread ucred reference for syscalls and synchronous traps fromjhb2001-10-264-3/+27
| | | | | | | | | userland. The per thread ucred reference is immutable and thus needs no locks to be read. However, until all the proc locking associated with writes to p_ucred are completed, it is still not safe to use the per-thread reference. Tested on: x86 (SMP), alpha, sparc64
* Add locking to taskqueues. There is one mutex per task, one mutex perjhb2001-10-261-34/+80
| | | | | | | | queue, and a mutex to protect the global list of taskqueues. The only visible change is that a TASK_DESTROY() macro has been added to mirror the TASK_INIT() macro to destroy a task before it is free'd. Submitted by: Andrew Reiter <awr@watson.org>
* Use msleep() to avoid lost wakeup's instead of doing an ineffectivejhb2001-10-261-15/+5
| | | | | | | | splhigh() before the mtx_unlock and tsleep(). The splhigh() was probably correct in the original code using simplelocks but is not correct in 5.0-current. Noticed by: Andrew Reiter <awr@FreeBSD.org>
* Implement kern.maxvnodes. adjusting kern.maxvnodes now actually has adillon2001-10-261-36/+76
| | | | | | | | | | | | | | | | real effect. Optimize vfs_msync(). Avoid having to continually drop and re-obtain mutexes when scanning the vnode list. Improves looping case by 500%. Optimize ffs_sync(). Avoid having to continually drop and re-obtain mutexes when scanning the vnode list. This makes a couple of assumptions, which I believe are ok, in regards to vnode stability when the mount list mutex is held. Improves looping case by 500%. (more optimization work is needed on top of these fixes) MFC after: 1 week
* Add missing TAILQ_INSERT_TAIL's which somehow didn't get comitted withdillon2001-10-251-0/+2
| | | | the recent vnode cleanup.
OpenPOWER on IntegriCloud