d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
4d6481a4c9
freebsd-skq/sys/fs/pseudofs/pseudofs_vncache.c

329 lines
8.7 KiB
C
Raw Normal View History

Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
/*-
Convert files to UTF-8
2012-01-15 13:23:18 +00:00
* Copyright (c) 2001 Dag-Erling Coïdan Smørgrav
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer
* in this position and unchanged.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
fbsdidize.
2005-03-14 15:54:11 +00:00
#include <sys/cdefs.h>
__FBSDID("$FreeBSD$");
#include "opt_pseudofs.h"
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/systm.h>
Replace the at_fork, at_exec, and at_exit functions with the slightly more flexible process_fork, process_exec, and process_exit eventhandlers. This reduces code duplication and also means that I don't have to go duplicate the eventhandler locking three more times for each of at_fork, at_exec, and at_exit. Reviewed by: phk, jake, almost complete silence on arch@
2003-03-24 21:15:35 +00:00
#include <sys/eventhandler.h>
For some reason, though the module builds just fine without <sys/lock.h>, LINT fails to build without it.
2001-06-11 15:04:48 +00:00
#include <sys/lock.h>
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
#include <sys/malloc.h>
Add missing #include of <sys/mutex.h>.
2001-06-10 10:36:16 +00:00
#include <sys/mutex.h>
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
#include <sys/proc.h>
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
#include <sys/sysctl.h>
#include <sys/vnode.h>
#include <fs/pseudofs/pseudofs.h>
#include <fs/pseudofs/pseudofs_internal.h>
Add support for process-dependent directories. This means that save for the lack of a man page, pseudofs is mostly complete now.
2001-06-10 18:39:21 +00:00
static MALLOC_DEFINE(M_PFSVNCACHE, "pfs_vncache", "pseudofs vnode cache");
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
static struct mtx pfs_vncache_mutex;
Staticise pfs_vncache, it's not used anywhere else. Reviewed by: des
2002-01-08 11:15:57 +00:00
static struct pfs_vdata *pfs_vncache;
Replace the at_fork, at_exec, and at_exit functions with the slightly more flexible process_fork, process_exec, and process_exit eventhandlers. This reduces code duplication and also means that I don't have to go duplicate the eventhandler locking three more times for each of at_fork, at_exec, and at_exit. Reviewed by: phk, jake, almost complete silence on arch@
2003-03-24 21:15:35 +00:00
static eventhandler_tag pfs_exit_tag;
static void pfs_exit(void *arg, struct proc *p);
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
Mark all SYSCTL_NODEs static that have no corresponding SYSCTL_DECLs. The SYSCTL_NODE macro defines a list that stores all child-elements of that node. If there's no SYSCTL_DECL macro anywhere else, there's no reason why it shouldn't be static.
2011-11-07 15:43:11 +00:00
static SYSCTL_NODE(_vfs_pfs, OID_AUTO, vncache, CTLFLAG_RW, 0,
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
"pseudofs vnode cache");
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
static int pfs_vncache_entries;
SYSCTL_INT(_vfs_pfs_vncache, OID_AUTO, entries, CTLFLAG_RD,
&pfs_vncache_entries, 0,
"number of entries in the vnode cache");
static int pfs_vncache_maxentries;
SYSCTL_INT(_vfs_pfs_vncache, OID_AUTO, maxentries, CTLFLAG_RD,
&pfs_vncache_maxentries, 0,
"highest number of entries in the vnode cache");
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
static int pfs_vncache_hits;
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
SYSCTL_INT(_vfs_pfs_vncache, OID_AUTO, hits, CTLFLAG_RD,
&pfs_vncache_hits, 0,
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
"number of cache hits since initialization");
static int pfs_vncache_misses;
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
SYSCTL_INT(_vfs_pfs_vncache, OID_AUTO, misses, CTLFLAG_RD,
&pfs_vncache_misses, 0,
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
"number of cache misses since initialization");
Back when VOP_* was introduced, we did not have new-style struct initializations but we did have lofty goals and big ideals. Adjust to more contemporary circumstances and gain type checking. Replace the entire vop_t frobbing thing with properly typed structures. The only casualty is that we can not add a new VOP_ method with a loadable module. History has not given us reason to belive this would ever be feasible in the the first place. Eliminate in toto VOCALL(), vop_t, VNODEOP_SET() etc. Give coda correct prototypes and function definitions for all vop_()s. Generate a bit more data from the vnode_if.src file: a struct vop_vector and protype typedefs for all vop methods. Add a new vop_bypass() and make vop_default be a pointer to another struct vop_vector. Remove a lot of vfs_init since vop_vector is ready to use from the compiler. Cast various vop_mumble() to void * with uppercase name, for instance VOP_PANIC, VOP_NULL etc. Implement VCALL() by making vdesc_offset the offsetof() the relevant function pointer in vop_vector. This is disgusting but since the code is generated by a script comparatively safe. The alternative for nullfs etc. would be much worse. Fix up all vnode method vectors to remove casts so they become typesafe. (The bulk of this is generated by scripts)
2004-12-01 23:16:38 +00:00
extern struct vop_vector pfs_vnodeops; /* XXX -> .h file */
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
/*
* Initialize vnode cache
*/
void
pfs_vncache_load(void)
{
Further pseudofs improvements: The pfs_info mutex is only needed to lock pi_unrhdr. Everything else in struct pfs_info is modified only while Giant is held (during vfs_init() / vfs_uninit()); add assertions to that effect. Simplify pfs_destroy somewhat. Remove superfluous arguments from pfs_fileno_{alloc,free}(), and the assertions which were added in the previous commit to ensure they were consistent. Assert that Giant is held while the vnode cache is initialized and destroyed. Also assert that the cache is empty when it is destroyed. Rename the vnode cache mutex for consistency. Fix a long-standing bug in pfs_getattr(): it would uncritically return the node's pn_fileno as st_ino. This would result in st_ino being 0 if the node had not previously been visited by readdir(), and also in an incorrect st_ino for process directories and any files contained therein. Correct this by abstracting the fileno manipulations previously done in pfs_readdir() into a new function, pfs_fileno(), which is used by both pfs_getattr() and pfs_readdir().
2007-04-14 14:08:30 +00:00
mtx_assert(&Giant, MA_OWNED);
mtx_init(&pfs_vncache_mutex, "pfs_vncache", NULL, MTX_DEF);
Replace the at_fork, at_exec, and at_exit functions with the slightly more flexible process_fork, process_exec, and process_exit eventhandlers. This reduces code duplication and also means that I don't have to go duplicate the eventhandler locking three more times for each of at_fork, at_exec, and at_exit. Reviewed by: phk, jake, almost complete silence on arch@
2003-03-24 21:15:35 +00:00
pfs_exit_tag = EVENTHANDLER_REGISTER(process_exit, pfs_exit, NULL,
EVENTHANDLER_PRI_ANY);
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
}
/*
* Tear down vnode cache
*/
void
pfs_vncache_unload(void)
{
Further pseudofs improvements: The pfs_info mutex is only needed to lock pi_unrhdr. Everything else in struct pfs_info is modified only while Giant is held (during vfs_init() / vfs_uninit()); add assertions to that effect. Simplify pfs_destroy somewhat. Remove superfluous arguments from pfs_fileno_{alloc,free}(), and the assertions which were added in the previous commit to ensure they were consistent. Assert that Giant is held while the vnode cache is initialized and destroyed. Also assert that the cache is empty when it is destroyed. Rename the vnode cache mutex for consistency. Fix a long-standing bug in pfs_getattr(): it would uncritically return the node's pn_fileno as st_ino. This would result in st_ino being 0 if the node had not previously been visited by readdir(), and also in an incorrect st_ino for process directories and any files contained therein. Correct this by abstracting the fileno manipulations previously done in pfs_readdir() into a new function, pfs_fileno(), which is used by both pfs_getattr() and pfs_readdir().
2007-04-14 14:08:30 +00:00
mtx_assert(&Giant, MA_OWNED);
Replace the at_fork, at_exec, and at_exit functions with the slightly more flexible process_fork, process_exec, and process_exit eventhandlers. This reduces code duplication and also means that I don't have to go duplicate the eventhandler locking three more times for each of at_fork, at_exec, and at_exit. Reviewed by: phk, jake, almost complete silence on arch@
2003-03-24 21:15:35 +00:00
EVENTHANDLER_DEREGISTER(process_exit, pfs_exit_tag);
Further pseudofs improvements: The pfs_info mutex is only needed to lock pi_unrhdr. Everything else in struct pfs_info is modified only while Giant is held (during vfs_init() / vfs_uninit()); add assertions to that effect. Simplify pfs_destroy somewhat. Remove superfluous arguments from pfs_fileno_{alloc,free}(), and the assertions which were added in the previous commit to ensure they were consistent. Assert that Giant is held while the vnode cache is initialized and destroyed. Also assert that the cache is empty when it is destroyed. Rename the vnode cache mutex for consistency. Fix a long-standing bug in pfs_getattr(): it would uncritically return the node's pn_fileno as st_ino. This would result in st_ino being 0 if the node had not previously been visited by readdir(), and also in an incorrect st_ino for process directories and any files contained therein. Correct this by abstracting the fileno manipulations previously done in pfs_readdir() into a new function, pfs_fileno(), which is used by both pfs_getattr() and pfs_readdir().
2007-04-14 14:08:30 +00:00
KASSERT(pfs_vncache_entries == 0,
("%d vncache entries remaining", pfs_vncache_entries));
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
mtx_destroy(&pfs_vncache_mutex);
}
/*
* Allocate a vnode
*/
int
Add support for process-dependent directories. This means that save for the lack of a man page, pseudofs is mostly complete now.
2001-06-10 18:39:21 +00:00
pfs_vncache_alloc(struct mount *mp, struct vnode **vpp,
struct pfs_node *pn, pid_t pid)
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
{
After the pfs_vncache_mutex is dropped, another thread may attempt to do pfs_vncache_alloc() for the same pfs_node and pid. In this case, we could end up with two vnodes for the pair. Recheck the cache under the locked pfs_vncache_mutex after all sleeping operations are done [1]. This case mostly cannot happen now because pseudofs uses exclusive vnode locking for lookup. But it does drop the vnode lock for dotdot lookups, and Marcus' pseudofs_vptocnp implementation is vulnerable too. Do not call free() on the struct pfs_vdata after insmntque() failure, because vp->v_data points to the structure, and pseudofs_reclaim() frees it by the call to pfs_vncache_free(). Tested by: pho [1] Approved by: des MFC after: 2 weeks
2008-12-29 12:07:18 +00:00
struct pfs_vdata *pvd, *pvd2;
Use the vnode interlock to close a race where pfs_vncache_alloc() could attempt to vn_lock() a destroyed vnode resulting in a hang. MFC after: 1 week Submitted by: ups Reviewed by: des
2007-01-02 17:27:52 +00:00
struct vnode *vp;
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
int error;
Pseudofs was leaking VFS cache entries badly due to its cache and use of the wrong VOP descriptor. This misuse caused VFS-cached vnodes to be re-cached, resulting in the leak. This commit is an interim fix until DES has a chance to rework the code involved.
2001-12-19 23:58:09 +00:00
/*
Gratuitous whitespace cleanup.
2002-06-06 16:59:24 +00:00
* See if the vnode is in the cache.
Pseudofs was leaking VFS cache entries badly due to its cache and use of the wrong VOP descriptor. This misuse caused VFS-cached vnodes to be re-cached, resulting in the leak. This commit is an interim fix until DES has a chance to rework the code involved.
2001-12-19 23:58:09 +00:00
* XXX linear search is not very efficient.
*/
Use the vnode interlock to close a race where pfs_vncache_alloc() could attempt to vn_lock() a destroyed vnode resulting in a hang. MFC after: 1 week Submitted by: ups Reviewed by: des
2007-01-02 17:27:52 +00:00
retry:
Add support for process-dependent directories. This means that save for the lack of a man page, pseudofs is mostly complete now.
2001-06-10 18:39:21 +00:00
mtx_lock(&pfs_vncache_mutex);
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
for (pvd = pfs_vncache; pvd; pvd = pvd->pvd_next) {
Do not allow a cached vnode to be shared among multiple mounts of the same kind of pseudofs-based filesystem. Fixes (at least) one problem where when procfs is mounted mupltiple times, trying to unmount one will often cause the wrong one to get unmounted, and other problem where mounting one procfs on top of another caused the kernel to lock up. Reviewed by: des
2003-01-28 09:21:42 +00:00
if (pvd->pvd_pn == pn && pvd->pvd_pid == pid &&
pvd->pvd_vnode->v_mount == mp) {
Use the vnode interlock to close a race where pfs_vncache_alloc() could attempt to vn_lock() a destroyed vnode resulting in a hang. MFC after: 1 week Submitted by: ups Reviewed by: des
2007-01-02 17:27:52 +00:00
vp = pvd->pvd_vnode;
VI_LOCK(vp);
mtx_unlock(&pfs_vncache_mutex);
if (vget(vp, LK_EXCLUSIVE | LK_INTERLOCK, curthread) == 0) {
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
++pfs_vncache_hits;
Use the vnode interlock to close a race where pfs_vncache_alloc() could attempt to vn_lock() a destroyed vnode resulting in a hang. MFC after: 1 week Submitted by: ups Reviewed by: des
2007-01-02 17:27:52 +00:00
*vpp = vp;
Add a flag to struct pfs_vdata to mark the vnode as dead (e.g. process- specific nodes when the process exits) Move the vnode-cache-walking loop which was duplicated in pfs_exit() and pfs_disable() into its own function, pfs_purge(), which looks for vnodes marked as dead and / or belonging to the specified pfs_node and reclaims them. Note that this loop is still extremely inefficient. Add a comment in pfs_vncache_alloc() explaining why we have to purge the vnode from the vnode cache before returning, in case anyone should be tempted to remove the call to cache_purge(). Move the special handling for pfstype_root nodes into pfs_fileno_alloc() and pfs_fileno_free() (the root node's fileno must always be 2). This also fixes a bug where pfs_fileno_free() would reclaim the root node's fileno, triggering a panic in the unr code, as that fileno was never allocated from unr to begin with. When destroying a pfs_node, release its fileno and purge it from the vnode cache. I wish we could put off the call to pfs_purge() until after the entire tree had been destroyed, but then we'd have vnodes referencing freed pfs nodes. This probably doesn't matter while we're still under Giant, but might become an issue later. When destroying a pseudofs instance, destroy the tree before tearing down the fileno allocator. In pfs_mount(), acquire the mountpoint interlock when required. MFC after: 3 weeks
2007-04-11 22:40:57 +00:00
/*
* Some callers cache_enter(vp) later, so
* we have to make sure it's not in the
* VFS cache so it doesn't get entered
* twice. A better solution would be to
* make pfs_vncache_alloc() responsible
* for entering the vnode in the VFS
* cache.
*/
cache_purge(vp);
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
return (0);
}
Use the vnode interlock to close a race where pfs_vncache_alloc() could attempt to vn_lock() a destroyed vnode resulting in a hang. MFC after: 1 week Submitted by: ups Reviewed by: des
2007-01-02 17:27:52 +00:00
goto retry;
Add support for process-dependent directories. This means that save for the lack of a man page, pseudofs is mostly complete now.
2001-06-10 18:39:21 +00:00
}
}
mtx_unlock(&pfs_vncache_mutex);
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
/* nope, get a new one */
Retire the MALLOC and FREE macros. They are an abomination unto style(9). MFC after: 3 months
2008-10-23 15:53:51 +00:00
pvd = malloc(sizeof *pvd, M_PFSVNCACHE, M_WAITOK);
When the insmntque() in the pfs_vncache_alloc() fails, vop_reclaim calls pfs_vncache_free() that removes pvd from the list, while it is not yet put on the list. Prevent the invalid removal from the list by clearing pvd_next and pvd_prev for the newly allocated pvd, and only move pfs_vncache list head when the pvd was at the head. Suggested and approved by: des MFC after: 2 weeks
2008-12-29 13:25:58 +00:00
pvd->pvd_next = pvd->pvd_prev = NULL;
Back when VOP_* was introduced, we did not have new-style struct initializations but we did have lofty goals and big ideals. Adjust to more contemporary circumstances and gain type checking. Replace the entire vop_t frobbing thing with properly typed structures. The only casualty is that we can not add a new VOP_ method with a loadable module. History has not given us reason to belive this would ever be feasible in the the first place. Eliminate in toto VOCALL(), vop_t, VNODEOP_SET() etc. Give coda correct prototypes and function definitions for all vop_()s. Generate a bit more data from the vnode_if.src file: a struct vop_vector and protype typedefs for all vop methods. Add a new vop_bypass() and make vop_default be a pointer to another struct vop_vector. Remove a lot of vfs_init since vop_vector is ready to use from the compiler. Cast various vop_mumble() to void * with uppercase name, for instance VOP_PANIC, VOP_NULL etc. Implement VCALL() by making vdesc_offset the offsetof() the relevant function pointer in vop_vector. This is disgusting but since the code is generated by a script comparatively safe. The alternative for nullfs etc. would be much worse. Fix up all vnode method vectors to remove casts so they become typesafe. (The bulk of this is generated by scripts)
2004-12-01 23:16:38 +00:00
error = getnewvnode("pseudofs", mp, &pfs_vnodeops, vpp);
Plug an infrequent (I think) memory leak. Spotted by: FlexeLint
2002-10-15 18:51:02 +00:00
if (error) {
Retire the MALLOC and FREE macros. They are an abomination unto style(9). MFC after: 3 months
2008-10-23 15:53:51 +00:00
free(pvd, M_PFSVNCACHE);
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
return (error);
Plug an infrequent (I think) memory leak. Spotted by: FlexeLint
2002-10-15 18:51:02 +00:00
}
Add support for process-dependent directories. This means that save for the lack of a man page, pseudofs is mostly complete now.
2001-06-10 18:39:21 +00:00
pvd->pvd_pn = pn;
pvd->pvd_pid = pid;
(*vpp)->v_data = pvd;
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
switch (pn->pn_type) {
case pfstype_root:
- Replace v_flag with v_iflag and v_vflag - v_vflag is protected by the vnode lock and is used when synchronization with VOP calls is needed. - v_iflag is protected by interlock and is used for dealing with vnode management issues. These flags include X/O LOCK, FREE, DOOMED, etc. - All accesses to v_iflag and v_vflag have either been locked or marked with mp_fixme's. - Many ASSERT_VOP_LOCKED calls have been added where the locking was not clear. - Many functions in vfs_subr.c were restructured to provide for stronger locking. Idea stolen from: BSD/OS
2002-08-04 10:29:36 +00:00
(*vpp)->v_vflag = VV_ROOT;
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
#if 0
printf("root vnode allocated\n");
#endif
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
/* fall through */
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
case pfstype_dir:
case pfstype_this:
case pfstype_parent:
Add support for process-dependent directories. This means that save for the lack of a man page, pseudofs is mostly complete now.
2001-06-10 18:39:21 +00:00
case pfstype_procdir:
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
(*vpp)->v_type = VDIR;
break;
case pfstype_file:
(*vpp)->v_type = VREG;
break;
case pfstype_symlink:
(*vpp)->v_type = VLNK;
break;
Add support for process-dependent directories. This means that save for the lack of a man page, pseudofs is mostly complete now.
2001-06-10 18:39:21 +00:00
case pfstype_none:
KASSERT(0, ("pfs_vncache_alloc called for null node\n"));
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
default:
panic("%s has unexpected type: %d", pn->pn_name, pn->pn_type);
}
Remove all use of vnode->v_tag, replacing with appropriate substitutes. v_tag is now const char * and should only be used for debugging. Additionally: 1. All users of VT_NTS now check vfsconf->vf_type VFCF_NETWORK 2. The user of VT_PROCFS now checks for the new flag VV_PROCDEP, which is propagated by pseudofs to all child vnodes if the fs sets PFS_PROCDEP. Suggested by: phk Reviewed by: bde, rwatson (earlier version)
2002-09-14 09:02:28 +00:00
/*
* Propagate flag through to vnode so users know it can change
* if the process changes (i.e. execve)
*/
if ((pn->pn_flags & PFS_PROCDEP) != 0)
(*vpp)->v_vflag |= VV_PROCDEP;
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
pvd->pvd_vnode = *vpp;
vn_lock() is currently only used with the 'curthread' passed as argument. Remove this argument and pass curthread directly to underlying VOP_LOCK1() VFS method. This modify makes the code cleaner and in particular remove an annoying dependence helping next lockmgr() cleanup. KPI results, obviously, changed. Manpage and FreeBSD_version will be updated through further commits. As a side note, would be valuable to say that next commits will address a similar cleanup about VFS methods, in particular vop_lock1 and vop_unlock. Tested by: Diego Sardina <siarodx at gmail dot com>, Andrea Di Pasquale <whyx dot it at gmail dot com>
2008-01-10 01:10:58 +00:00
vn_lock(*vpp, LK_EXCLUSIVE | LK_RETRY);
Add dedicated routines to toggle lockmgr flags such as LK_NOSHARE and LK_CANRECURSE after a lock is created. Use them to implement macros that otherwise manipulated the flags directly. Assert that the associated lockmgr lock is exclusively locked by the current thread when manipulating these flags to ensure the flag updates are safe. This last change required some minor shuffling in a few filesystems to exclusively lock a brand new vnode slightly earlier. Reviewed by: kib MFC after: 3 days
2010-08-20 19:46:50 +00:00
VN_LOCK_AREC(*vpp);
Make insmntque() externally visibile and allow it to fail (e.g. during late stages of unmount). On failure, the vnode is recycled. Add insmntque1(), to allow for file system specific cleanup when recycling vnode on failure. Change getnewvnode() to no longer call insmntque(). Previously, embryonic vnodes were put onto the list of vnode belonging to a file system, which is unsafe for a file system marked MPSAFE. Change vfs_hash_insert() to no longer lock the vnode. The caller now has that responsibility. Change most file systems to lock the vnode and call insmntque() or insmntque1() after a new vnode has been sufficiently setup. Handle failed insmntque*() calls by propagating errors to callers, possibly after some file system specific cleanup. Approved by: re (kensmith) Reviewed by: kib In collaboration with: kib
2007-03-13 01:50:27 +00:00
error = insmntque(*vpp, mp);
if (error != 0) {
insmntque_stddtr() clears vp->v_data and resets vp->v_op to dead_vnodeops before calling vgone(). Revert r189706 and corresponding part of the r186560. Noted and reviewed by: tegge Approved by: des (pseudofs part) MFC after: 3 days
2009-09-07 11:55:34 +00:00
free(pvd, M_PFSVNCACHE);
Make insmntque() externally visibile and allow it to fail (e.g. during late stages of unmount). On failure, the vnode is recycled. Add insmntque1(), to allow for file system specific cleanup when recycling vnode on failure. Change getnewvnode() to no longer call insmntque(). Previously, embryonic vnodes were put onto the list of vnode belonging to a file system, which is unsafe for a file system marked MPSAFE. Change vfs_hash_insert() to no longer lock the vnode. The caller now has that responsibility. Change most file systems to lock the vnode and call insmntque() or insmntque1() after a new vnode has been sufficiently setup. Handle failed insmntque*() calls by propagating errors to callers, possibly after some file system specific cleanup. Approved by: re (kensmith) Reviewed by: kib In collaboration with: kib
2007-03-13 01:50:27 +00:00
*vpp = NULLVP;
return (error);
}
After the pfs_vncache_mutex is dropped, another thread may attempt to do pfs_vncache_alloc() for the same pfs_node and pid. In this case, we could end up with two vnodes for the pair. Recheck the cache under the locked pfs_vncache_mutex after all sleeping operations are done [1]. This case mostly cannot happen now because pseudofs uses exclusive vnode locking for lookup. But it does drop the vnode lock for dotdot lookups, and Marcus' pseudofs_vptocnp implementation is vulnerable too. Do not call free() on the struct pfs_vdata after insmntque() failure, because vp->v_data points to the structure, and pseudofs_reclaim() frees it by the call to pfs_vncache_free(). Tested by: pho [1] Approved by: des MFC after: 2 weeks
2008-12-29 12:07:18 +00:00
retry2:
Add support for process-dependent directories. This means that save for the lack of a man page, pseudofs is mostly complete now.
2001-06-10 18:39:21 +00:00
mtx_lock(&pfs_vncache_mutex);
After the pfs_vncache_mutex is dropped, another thread may attempt to do pfs_vncache_alloc() for the same pfs_node and pid. In this case, we could end up with two vnodes for the pair. Recheck the cache under the locked pfs_vncache_mutex after all sleeping operations are done [1]. This case mostly cannot happen now because pseudofs uses exclusive vnode locking for lookup. But it does drop the vnode lock for dotdot lookups, and Marcus' pseudofs_vptocnp implementation is vulnerable too. Do not call free() on the struct pfs_vdata after insmntque() failure, because vp->v_data points to the structure, and pseudofs_reclaim() frees it by the call to pfs_vncache_free(). Tested by: pho [1] Approved by: des MFC after: 2 weeks
2008-12-29 12:07:18 +00:00
/*
* Other thread may race with us, creating the entry we are
* going to insert into the cache. Recheck after
* pfs_vncache_mutex is reacquired.
*/
for (pvd2 = pfs_vncache; pvd2; pvd2 = pvd2->pvd_next) {
if (pvd2->pvd_pn == pn && pvd2->pvd_pid == pid &&
pvd2->pvd_vnode->v_mount == mp) {
vp = pvd2->pvd_vnode;
VI_LOCK(vp);
mtx_unlock(&pfs_vncache_mutex);
if (vget(vp, LK_EXCLUSIVE | LK_INTERLOCK, curthread) == 0) {
++pfs_vncache_hits;
vgone(*vpp);
Fix a deadlock which can occur due to a pseudofs vnode not getting unlocked. Reported by: Richard Todd <rmtodd@ichotolot.servalan.com> Reviewed by: kib Approved by: kib
2009-01-09 22:06:48 +00:00
vput(*vpp);
After the pfs_vncache_mutex is dropped, another thread may attempt to do pfs_vncache_alloc() for the same pfs_node and pid. In this case, we could end up with two vnodes for the pair. Recheck the cache under the locked pfs_vncache_mutex after all sleeping operations are done [1]. This case mostly cannot happen now because pseudofs uses exclusive vnode locking for lookup. But it does drop the vnode lock for dotdot lookups, and Marcus' pseudofs_vptocnp implementation is vulnerable too. Do not call free() on the struct pfs_vdata after insmntque() failure, because vp->v_data points to the structure, and pseudofs_reclaim() frees it by the call to pfs_vncache_free(). Tested by: pho [1] Approved by: des MFC after: 2 weeks
2008-12-29 12:07:18 +00:00
*vpp = vp;
cache_purge(vp);
return (0);
}
goto retry2;
}
}
++pfs_vncache_misses;
if (++pfs_vncache_entries > pfs_vncache_maxentries)
pfs_vncache_maxentries = pfs_vncache_entries;
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
pvd->pvd_prev = NULL;
pvd->pvd_next = pfs_vncache;
if (pvd->pvd_next)
pvd->pvd_next->pvd_prev = pvd;
pfs_vncache = pvd;
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
mtx_unlock(&pfs_vncache_mutex);
return (0);
}
/*
* Free a vnode
*/
int
pfs_vncache_free(struct vnode *vp)
{
Add support for process-dependent directories. This means that save for the lack of a man page, pseudofs is mostly complete now.
2001-06-10 18:39:21 +00:00
struct pfs_vdata *pvd;
Pseudofs was leaking VFS cache entries badly due to its cache and use of the wrong VOP descriptor. This misuse caused VFS-cached vnodes to be re-cached, resulting in the leak. This commit is an interim fix until DES has a chance to rework the code involved.
2001-12-19 23:58:09 +00:00
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
mtx_lock(&pfs_vncache_mutex);
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
pvd = (struct pfs_vdata *)vp->v_data;
KASSERT(pvd != NULL, ("pfs_vncache_free(): no vnode data\n"));
if (pvd->pvd_next)
pvd->pvd_next->pvd_prev = pvd->pvd_prev;
If a race is detected, pfs_vncache_alloc() may reclaim a vnode that had never been inserted into the pfs_vncache list. Since pfs_vncache_free() does not anticipate this case, it decrements pfs_vncache_entries unconditionally; if the vnode was not in the list, pfs_vncache_entries will no longer reflect the actual number of list entries. This may cause size of the cache to exceed the configured maximum. It may also trigger a panic during module unload or system shutdown. Do not decrement pfs_vncache_entries for the vnode that was not in the list. Submitted by: tegge Reviewed by: des MFC after: 1 week
2009-09-07 12:10:41 +00:00
if (pvd->pvd_prev) {
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
pvd->pvd_prev->pvd_next = pvd->pvd_next;
If a race is detected, pfs_vncache_alloc() may reclaim a vnode that had never been inserted into the pfs_vncache list. Since pfs_vncache_free() does not anticipate this case, it decrements pfs_vncache_entries unconditionally; if the vnode was not in the list, pfs_vncache_entries will no longer reflect the actual number of list entries. This may cause size of the cache to exceed the configured maximum. It may also trigger a panic during module unload or system shutdown. Do not decrement pfs_vncache_entries for the vnode that was not in the list. Submitted by: tegge Reviewed by: des MFC after: 1 week
2009-09-07 12:10:41 +00:00
--pfs_vncache_entries;
} else if (pfs_vncache == pvd) {
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
pfs_vncache = pvd->pvd_next;
If a race is detected, pfs_vncache_alloc() may reclaim a vnode that had never been inserted into the pfs_vncache list. Since pfs_vncache_free() does not anticipate this case, it decrements pfs_vncache_entries unconditionally; if the vnode was not in the list, pfs_vncache_entries will no longer reflect the actual number of list entries. This may cause size of the cache to exceed the configured maximum. It may also trigger a panic during module unload or system shutdown. Do not decrement pfs_vncache_entries for the vnode that was not in the list. Submitted by: tegge Reviewed by: des MFC after: 1 week
2009-09-07 12:10:41 +00:00
--pfs_vncache_entries;
}
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
mtx_unlock(&pfs_vncache_mutex);
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
Retire the MALLOC and FREE macros. They are an abomination unto style(9). MFC after: 3 months
2008-10-23 15:53:51 +00:00
free(pvd, M_PFSVNCACHE);
Add support for process-dependent directories. This means that save for the lack of a man page, pseudofs is mostly complete now.
2001-06-10 18:39:21 +00:00
vp->v_data = NULL;
Let pseudofs into the warmth of the FreeBSD CVS repo. It's not finished yet (I still have to find a way to implement process- dependent nodes without consuming too much memory, and the permission system needs tightening up), but it's becoming hard to work on without a repo (I've accidentally almost nuked it once already), and it works (except for the lack of process-dependent nodes, that is). I was supposed to commit this a week ago, but timed out waiting for jkh to reply to some questions I had. Pass him a spoonful of bad karma :)
2001-04-07 19:51:12 +00:00
return (0);
}
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
/*
Make pseudofs (and consequently procfs, linprocfs and linsysfs) MPSAFE.
2007-04-15 17:10:01 +00:00
* Purge the cache of dead entries
Annotate that pfs_exit() always acquires and releases two mutexes for every process exist, even if procfs isn't mounted. And one of those mutexes is Giant. No immediate thoughts on fixing this.
2005-01-08 04:56:38 +00:00
*
Add a flag to struct pfs_vdata to mark the vnode as dead (e.g. process- specific nodes when the process exits) Move the vnode-cache-walking loop which was duplicated in pfs_exit() and pfs_disable() into its own function, pfs_purge(), which looks for vnodes marked as dead and / or belonging to the specified pfs_node and reclaims them. Note that this loop is still extremely inefficient. Add a comment in pfs_vncache_alloc() explaining why we have to purge the vnode from the vnode cache before returning, in case anyone should be tempted to remove the call to cache_purge(). Move the special handling for pfstype_root nodes into pfs_fileno_alloc() and pfs_fileno_free() (the root node's fileno must always be 2). This also fixes a bug where pfs_fileno_free() would reclaim the root node's fileno, triggering a panic in the unr code, as that fileno was never allocated from unr to begin with. When destroying a pfs_node, release its fileno and purge it from the vnode cache. I wish we could put off the call to pfs_purge() until after the entire tree had been destroyed, but then we'd have vnodes referencing freed pfs nodes. This probably doesn't matter while we're still under Giant, but might become an issue later. When destroying a pseudofs instance, destroy the tree before tearing down the fileno allocator. In pfs_mount(), acquire the mountpoint interlock when required. MFC after: 3 weeks
2007-04-11 22:40:57 +00:00
* This is extremely inefficient due to the fact that vgone() not only
* indirectly modifies the vnode cache, but may also sleep. We can
* neither hold pfs_vncache_mutex across a vgone() call, nor make any
* assumptions about the state of the cache after vgone() returns. In
* consequence, we must start over after every vgone() call, and keep
* trying until we manage to traverse the entire cache.
*
* The only way to improve this situation is to change the data structure
* used to implement the cache.
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
*/
Drop Giant. MFC after: 1 week
2009-06-06 00:44:13 +00:00
static void
pfs_purge_locked(struct pfs_node *pn)
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
{
Release the vnode cache mutex when calling vgone(), since vgone() may sleep. This makes pfs_exit() even less efficient than before, but on the bright side, the vnode cache mutex no longer needs to be recursive.
2004-08-15 21:58:02 +00:00
struct pfs_vdata *pvd;
struct vnode *vnp;
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
Drop Giant. MFC after: 1 week
2009-06-06 00:44:13 +00:00
mtx_assert(&pfs_vncache_mutex, MA_OWNED);
Release the vnode cache mutex when calling vgone(), since vgone() may sleep. This makes pfs_exit() even less efficient than before, but on the bright side, the vnode cache mutex no longer needs to be recursive.
2004-08-15 21:58:02 +00:00
pvd = pfs_vncache;
while (pvd != NULL) {
Add a flag to struct pfs_vdata to mark the vnode as dead (e.g. process- specific nodes when the process exits) Move the vnode-cache-walking loop which was duplicated in pfs_exit() and pfs_disable() into its own function, pfs_purge(), which looks for vnodes marked as dead and / or belonging to the specified pfs_node and reclaims them. Note that this loop is still extremely inefficient. Add a comment in pfs_vncache_alloc() explaining why we have to purge the vnode from the vnode cache before returning, in case anyone should be tempted to remove the call to cache_purge(). Move the special handling for pfstype_root nodes into pfs_fileno_alloc() and pfs_fileno_free() (the root node's fileno must always be 2). This also fixes a bug where pfs_fileno_free() would reclaim the root node's fileno, triggering a panic in the unr code, as that fileno was never allocated from unr to begin with. When destroying a pfs_node, release its fileno and purge it from the vnode cache. I wish we could put off the call to pfs_purge() until after the entire tree had been destroyed, but then we'd have vnodes referencing freed pfs nodes. This probably doesn't matter while we're still under Giant, but might become an issue later. When destroying a pseudofs instance, destroy the tree before tearing down the fileno allocator. In pfs_mount(), acquire the mountpoint interlock when required. MFC after: 3 weeks
2007-04-11 22:40:57 +00:00
if (pvd->pvd_dead || (pn != NULL && pvd->pvd_pn == pn)) {
Release the vnode cache mutex when calling vgone(), since vgone() may sleep. This makes pfs_exit() even less efficient than before, but on the bright side, the vnode cache mutex no longer needs to be recursive.
2004-08-15 21:58:02 +00:00
vnp = pvd->pvd_vnode;
- Since we don't hold a usecount in pfs_exit we have to get a holdcnt prior to calling vgone() to prevent any races. Sponsored by: Isilon Systems, Inc. Approved by: re (vfs blanket)
2005-07-07 07:33:10 +00:00
vhold(vnp);
Release the vnode cache mutex when calling vgone(), since vgone() may sleep. This makes pfs_exit() even less efficient than before, but on the bright side, the vnode cache mutex no longer needs to be recursive.
2004-08-15 21:58:02 +00:00
mtx_unlock(&pfs_vncache_mutex);
VOP_LOCK1() (and so VOP_LOCK()) and VOP_UNLOCK() are only used in conjuction with 'thread' argument passing which is always curthread. Remove the unuseful extra-argument and pass explicitly curthread to lower layer functions, when necessary. KPI results broken by this change, which should affect several ports, so version bumping and manpage update will be further committed. Tested by: kris, pho, Diego Sardina <siarodx at gmail dot com>
2008-01-13 14:44:15 +00:00
VOP_LOCK(vnp, LK_EXCLUSIVE);
Release the vnode cache mutex when calling vgone(), since vgone() may sleep. This makes pfs_exit() even less efficient than before, but on the bright side, the vnode cache mutex no longer needs to be recursive.
2004-08-15 21:58:02 +00:00
vgone(vnp);
VOP_LOCK1() (and so VOP_LOCK()) and VOP_UNLOCK() are only used in conjuction with 'thread' argument passing which is always curthread. Remove the unuseful extra-argument and pass explicitly curthread to lower layer functions, when necessary. KPI results broken by this change, which should affect several ports, so version bumping and manpage update will be further committed. Tested by: kris, pho, Diego Sardina <siarodx at gmail dot com>
2008-01-13 14:44:15 +00:00
VOP_UNLOCK(vnp, 0);
Release the vnode cache mutex when calling vgone(), since vgone() may sleep. This makes pfs_exit() even less efficient than before, but on the bright side, the vnode cache mutex no longer needs to be recursive.
2004-08-15 21:58:02 +00:00
mtx_lock(&pfs_vncache_mutex);
Drop Giant. MFC after: 1 week
2009-06-06 00:44:13 +00:00
vdrop(vnp);
Release the vnode cache mutex when calling vgone(), since vgone() may sleep. This makes pfs_exit() even less efficient than before, but on the bright side, the vnode cache mutex no longer needs to be recursive.
2004-08-15 21:58:02 +00:00
pvd = pfs_vncache;
} else {
pvd = pvd->pvd_next;
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
}
}
Drop Giant. MFC after: 1 week
2009-06-06 00:44:13 +00:00
}
void
pfs_purge(struct pfs_node *pn)
{
mtx_lock(&pfs_vncache_mutex);
pfs_purge_locked(pn);
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
mtx_unlock(&pfs_vncache_mutex);
Add a flag to struct pfs_vdata to mark the vnode as dead (e.g. process- specific nodes when the process exits) Move the vnode-cache-walking loop which was duplicated in pfs_exit() and pfs_disable() into its own function, pfs_purge(), which looks for vnodes marked as dead and / or belonging to the specified pfs_node and reclaims them. Note that this loop is still extremely inefficient. Add a comment in pfs_vncache_alloc() explaining why we have to purge the vnode from the vnode cache before returning, in case anyone should be tempted to remove the call to cache_purge(). Move the special handling for pfstype_root nodes into pfs_fileno_alloc() and pfs_fileno_free() (the root node's fileno must always be 2). This also fixes a bug where pfs_fileno_free() would reclaim the root node's fileno, triggering a panic in the unr code, as that fileno was never allocated from unr to begin with. When destroying a pfs_node, release its fileno and purge it from the vnode cache. I wish we could put off the call to pfs_purge() until after the entire tree had been destroyed, but then we'd have vnodes referencing freed pfs nodes. This probably doesn't matter while we're still under Giant, but might become an issue later. When destroying a pseudofs instance, destroy the tree before tearing down the fileno allocator. In pfs_mount(), acquire the mountpoint interlock when required. MFC after: 3 weeks
2007-04-11 22:40:57 +00:00
}
/*
* Free all vnodes associated with a defunct process
*/
static void
pfs_exit(void *arg, struct proc *p)
{
struct pfs_vdata *pvd;
int dead;
if (pfs_vncache == NULL)
return;
mtx_lock(&pfs_vncache_mutex);
for (pvd = pfs_vncache, dead = 0; pvd != NULL; pvd = pvd->pvd_next)
if (pvd->pvd_pid == p->p_pid)
dead = pvd->pvd_dead = 1;
if (dead)
Drop Giant. MFC after: 1 week
2009-06-06 00:44:13 +00:00
pfs_purge_locked(NULL);
mtx_unlock(&pfs_vncache_mutex);
YA pseudofs megacommit, part 1: - Add a third callback to the pfs_node structure. This one simply returns non-zero if the specified requesting process is allowed to access the specified node for the specified target process. This is used in addition to the usual permission checks, e.g. when certain files don't make sense for certain (system) processes. - Make sure that pfs_lookup() and pfs_readdir() don't yap about files which aren't pfs_visible(). Also check pfs_visible() before performing reads and writes, to prevent the kind of races reported in SA-00:77 and SA-01:55 (fork a child, open /proc/child/ctl, have that child fork a setuid binary, and assume control of it). - Add some more trace points.
2001-10-01 04:22:20 +00:00
}
Reference in New Issue Copy Permalink