summaryrefslogtreecommitdiff
path: root/sys/nfsclient/nfs_lock.c
Commit message (Collapse)AuthorAgeFilesLines
* Move sys/nfsclient/nfs_lock.c into sys/nfs and build it as a separateRick Macklem2010-07-241-396/+0
| | | | | | | | | | | | | | module that can be used by both the regular and experimental nfs clients. This fixes the problem reported by jh@ where /dev/nfslock would be registered twice when both nfs clients were used. I also defined the size of the lm_fh field to be the correct value, as it should be the maximum size of an NFSv3 file handle. Reviewed by: jh MFC after: 2 weeks Notes: svn path=/head/; revision=210455
* Remove the old kernel RPC implementation and the NFS_LEGACYRPC option.Doug Rabson2009-06-301-1/+0
| | | | | | | Approved by: re Notes: svn path=/head/; revision=195202
* Remove the unmaintained University of Michigan NFSv4 client from 8.xRobert Watson2009-05-221-2/+0
| | | | | | | | | | prior to 8.0-RELEASE. Rick Macklem's new and more feature-rich NFSv234 client and server are replacing it. Discussed with: rmacklem Notes: svn path=/head/; revision=192578
* Fix a number of style issues in the MALLOC / FREE commit. I've tried toDag-Erling Smørgrav2008-10-231-1/+2
| | | | | | | | be careful not to fix anything that was already broken; the NFSv4 code is particularly bad in this respect. Notes: svn path=/head/; revision=184214
* Retire the MALLOC and FREE macros. They are an abomination unto style(9).Dag-Erling Smørgrav2008-10-231-2/+1
| | | | | | | MFC after: 3 months Notes: svn path=/head/; revision=184205
* Move the head of byte-level advisory lock list from theKonstantin Belousov2008-04-161-8/+18
| | | | | | | | | | | | | | | | | | | | | | | | | filesystem-specific vnode data to the struct vnode. Provide the default implementation for the vop_advlock and vop_advlockasync. Purge the locks on the vnode reclaim by using the lf_purgelocks(). The default implementation is augmented for the nfs and smbfs. In the nfs_advlock, push the Giant inside the nfs_dolock. Before the change, the vop_advlock and vop_advlockasync have taken the unlocked vnode and dereferenced the fs-private inode data, racing with with the vnode reclamation due to forced unmount. Now, the vop_getattr under the shared vnode lock is used to obtain the inode size, and later, in the lf_advlockasync, after locking the vnode interlock, the VI_DOOMED flag is checked to prevent an operation on the doomed vnode. The implementation of the lf_purgelocks() is submitted by dfr. Reported by: kris Tested by: kris, pho Discussed with: jeff, dfr MFC after: 2 weeks Notes: svn path=/head/; revision=178243
* Add the new kernel-mode NFS Lock Manager. To use it instead of theDoug Rabson2008-03-261-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | user-mode lock manager, build a kernel with the NFSLOCKD option and add '-k' to 'rpc_lockd_flags' in rc.conf. Highlights include: * Thread-safe kernel RPC client - many threads can use the same RPC client handle safely with replies being de-multiplexed at the socket upcall (typically driven directly by the NIC interrupt) and handed off to whichever thread matches the reply. For UDP sockets, many RPC clients can share the same socket. This allows the use of a single privileged UDP port number to talk to an arbitrary number of remote hosts. * Single-threaded kernel RPC server. Adding support for multi-threaded server would be relatively straightforward and would follow approximately the Solaris KPI. A single thread should be sufficient for the NLM since it should rarely block in normal operation. * Kernel mode NLM server supporting cancel requests and granted callbacks. I've tested the NLM server reasonably extensively - it passes both my own tests and the NFS Connectathon locking tests running on Solaris, Mac OS X and Ubuntu Linux. * Userland NLM client supported. While the NLM server doesn't have support for the local NFS client's locking needs, it does have to field async replies and granted callbacks from remote NLMs that the local client has contacted. We relay these replies to the userland rpc.lockd over a local domain RPC socket. * Robust deadlock detection for the local lock manager. In particular it will detect deadlocks caused by a lock request that covers more than one blocking request. As required by the NLM protocol, all deadlock detection happens synchronously - a user is guaranteed that if a lock request isn't rejected immediately, the lock will eventually be granted. The old system allowed for a 'deferred deadlock' condition where a blocked lock request could wake up and find that some other deadlock-causing lock owner had beaten them to the lock. * Since both local and remote locks are managed by the same kernel locking code, local and remote processes can safely use file locks for mutual exclusion. Local processes have no fairness advantage compared to remote processes when contending to lock a region that has just been unlocked - the local lock manager enforces a strict first-come first-served model for both local and remote lockers. Sponsored by: Isilon Systems PR: 95247 107555 115524 116679 MFC after: 2 weeks Notes: svn path=/head/; revision=177633
* Attempt to rationalize NFS privileges:Robert Watson2007-04-211-11/+5
| | | | | | | | | | | | | | - Replace PRIV_NFSD with PRIV_NFS_DAEMON, add PRIV_NFS_LOCKD. - Use PRIV_NFS_DAEMON in the NFS server. - In the NFS client, move the privilege check from nfslockdans(), which occurs every time a write is performed on /dev/nfslock, and instead do it in nfslock_open() just once. This allows us to avoid checking the saved uid for root, and just use the effective on open. Use PRIV_NFS_LOCKD. Notes: svn path=/head/; revision=168931
* Fix typos in comment.Thomas Quinot2006-08-161-1/+1
| | | | Notes: svn path=/head/; revision=161371
* In nfs_dolock(), GC now under-used ioflg, rendered obsolete when we movedRobert Watson2006-01-131-4/+1
| | | | | | | | | | from using a fifo to talk to rpc.lockd to using a special device node. Noticed by: Coverity Prevent analysis tool MFC after: 3 days Notes: svn path=/head/; revision=154316
* Normalize a significant number of kernel malloc type names:Robert Watson2005-10-311-2/+2
| | | | | | | | | | | | | | | | | | | | | | - Prefer '_' to ' ', as it results in more easily parsed results in memory monitoring tools such as vmstat. - Remove punctuation that is incompatible with using memory type names as file names, such as '/' characters. - Disambiguate some collisions by adding subsystem prefixes to some memory types. - Generally prefer lower case to upper case. - If the same type is defined in multiple architecture directories, attempt to use the same name in additional cases. Not all instances were caught in this change, so more work is required to finish this conversion. Similar changes are required for UMA zone names. Notes: svn path=/head/; revision=151897
* - Fix leak of struct nlminfo on process exit.Gleb Smirnoff2005-10-261-1/+15
| | | | | | | | | | - Fix malloc type collision, that made the above problem difficult to understand. Reported by: Vladimir Sharun <sharun ukr.net> Notes: svn path=/head/; revision=151695
* For reasons unknown, the nfs locking code used a fifo to send requests toPoul-Henning Kamp2004-12-061-58/+156
| | | | | | | | | | | | | | | | userland and a dedicated system call to get replies. The vnode-bypass of fifos broke this into a panic. Ditch all the magic and create a device /dev/nfslock instead, and use that for both directions apart from the shorter path, this is also faster because the device driver runs Giant free using the vnode bypass. Noticed by: marcel Notes: svn path=/head/; revision=138430
* University of Michigan's Citi NFSv4 kernel client code.Alfred Perlstein2003-11-141-0/+2
| | | | | | | Submitted by: Jim Rees <rees@umich.edu> Notes: svn path=/head/; revision=122698
* Add fdidx argument to vn_open() and vn_open_cred() and pass -1 throughout.Poul-Henning Kamp2003-07-271-1/+1
| | | | Notes: svn path=/head/; revision=118094
* Add the comment I meant to add about not passing in PCATCH to theRobert Watson2003-06-111-0/+8
| | | | | | | tsleep(). Note the XXX. Notes: svn path=/head/; revision=116185
* rpc.lockd stability workaround: remove PCATCH from the tsleep() inRobert Watson2003-05-301-1/+1
| | | | | | | | | | | | | | | | | | | | nfs_lock.c. Right now, if we permit a signal to interrupt the sleep, we will slip the lock and no process on that client, the server, or any other client will be able to acquire the lock. This can happen, for example, if a user hits Ctrl-C or Ctrl-T while a process is waiting for the lock. By removing PCATCH, we prevent that from happening, at the cost of not permitting a user-requested lock abort: also nasty. However, a user interface bug might be preferable to a serious semantic bug, so we go with that for now. We need to teach the rpc.lockd/kernel protocol how to abort lock requests, and rpc.lockd how to handle aborted lock requests; patches for the kernel bit are floating around, but no rpc.lockd bit yet. Approved by: re (scottl) Notes: svn path=/head/; revision=115415
* Instead of recording the Unix time in a process when it starts, record theDag-Erling Smørgrav2003-05-011-0/+1
| | | | | | | | | | uptime. Where necessary, convert it back to Unix time by adding boottime to it. This fixes a potential problem in the accounting code, which would compute the elapsed time incorrectly if the Unix time was stepped during the lifetime of the process. Notes: svn path=/head/; revision=114434
* Deprecate machine/limits.h in favor of new sys/limits.h.Alexander Kabaev2003-04-291-2/+1
| | | | | | | | | | Change all in-tree consumers to include <sys/limits.h> Discussed on: standards@ Partially submitted by: Craig Rodrigues <rodrigc@attbi.com> Notes: svn path=/head/; revision=114216
* Add O_NONBLOCK to the vn_open_cred() flags for NFS client locking whenRobert Watson2003-03-261-3/+13
| | | | | | | | | | | | | | | | | | opening the POSIX fifo; convert ENXIO error returns to EOPNOTSUPP. This improves handling of the case where the /var/run/lock fifo exists but there is no listener: we immediately return EOPNOTSUPP rather than blocking until a listener turns up. This could occur during a diskless boot before rpc.lockd is loaded, or if the lock file persists across a reboot following the disabling of rpc.lockd. This may have suddenly started to occur due to fifo blocking fixes--previously it looks like attempts to read on a fifo with no listener would time out due to insufficient resources. Reviewed by: alfred Notes: svn path=/head/; revision=112685
* Back out M_* changes, per decision of the TRB.Warner Losh2003-02-191-1/+1
| | | | | | | Approved by: trb Notes: svn path=/head/; revision=111119
* Remove M_TRYWAIT/M_WAITOK/M_WAIT. Callers should use 0.Alfred Perlstein2003-01-211-1/+1
| | | | | | | Merge M_NOWAIT/M_DONTWAIT into a single flag M_NOWAIT. Notes: svn path=/head/; revision=109623
* reapply 1.26 through 1.28.Alfred Perlstein2002-11-201-18/+6
| | | | | | | Approved by: re Notes: svn path=/head/; revision=107104
* forgot about 5.x freeze, backout 1.26 through 1.28 pending re@ appoval.Alfred Perlstein2002-11-201-6/+18
| | | | Notes: svn path=/head/; revision=107101
* remove useless casts, unused macros and cleanup a line wrap.Alfred Perlstein2002-11-201-9/+3
| | | | Notes: svn path=/head/; revision=107100
* comment and untwist error return logicAlfred Perlstein2002-11-201-4/+3
| | | | Notes: svn path=/head/; revision=107099
* Remove an outdated comment complaining about exporting struct ucredAlfred Perlstein2002-11-201-5/+0
| | | | | | | to userspace, I fixed it a while ago. Notes: svn path=/head/; revision=107098
* Remove a case of exposing 'struct ucred' to userspace. Use a struct xucredAlfred Perlstein2002-08-151-1/+1
| | | | | | | | | for LOCKD_MSG instead. Requested by: rwatson Notes: svn path=/head/; revision=101947
* In order to better support flexible and extensible access control,Robert Watson2002-08-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | make a series of modifications to the credential arguments relating to file read and write operations to cliarfy which credential is used for what: - Change fo_read() and fo_write() to accept "active_cred" instead of "cred", and change the semantics of consumers of fo_read() and fo_write() to pass the active credential of the thread requesting an operation rather than the cached file cred. The cached file cred is still available in fo_read() and fo_write() consumers via fp->f_cred. These changes largely in sys_generic.c. For each implementation of fo_read() and fo_write(), update cred usage to reflect this change and maintain current semantics: - badfo_readwrite() unchanged - kqueue_read/write() unchanged pipe_read/write() now authorize MAC using active_cred rather than td->td_ucred - soo_read/write() unchanged - vn_read/write() now authorize MAC using active_cred but VOP_READ/WRITE() with fp->f_cred Modify vn_rdwr() to accept two credential arguments instead of a single credential: active_cred and file_cred. Use active_cred for MAC authorization, and select a credential for use in VOP_READ/WRITE() based on whether file_cred is NULL or not. If file_cred is provided, authorize the VOP using that cred, otherwise the active credential, matching current semantics. Modify current vn_rdwr() consumers to pass a file_cred if used in the context of a struct file, and to always pass active_cred. When vn_rdwr() is used without a file_cred, pass NOCRED. These changes should maintain current semantics for read/write, but avoid a redundant passing of fp->f_cred, as well as making it more clear what the origin of each credential is in file descriptor read/write operations. Follow-up commits will make similar changes to other file descriptor operations, and modify the MAC framework to pass both credentials to MAC policy modules so they can implement either semantic for revocation. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=101941
* Pass IO_NOMACCHECK to vn_rdwr() in the following checks to preventRobert Watson2002-08-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | enforcement of MAC policy on the read or write operations: - In ext2fs, don't enforce MAC on loop-back reads and writes supporting directory read operations in lookup(), directory modifications in rename(), directory write operations in mkdir(), symlink write operations in symlink(). - In the NFS client locking code, perform vn_rdwr() on the NFS locking socket without enforcing MAC, since the write is done on behalf of the kernel NFS implementation rather than the user process. - In UFS, don't enforce MAC on loop-back reads and writes supporting directory read operations in lookup(), and symlink write operations in symlink(). Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=101744
* Add IPv6 support.Alfred Perlstein2002-07-151-3/+2
| | | | | | | Submitted by: Jean-Luc Richier <Jean-Luc.Richier@imag.fr> Notes: svn path=/head/; revision=100134
* Change the suser() API to take advantage of td_ucred as well as do aJohn Baldwin2002-04-011-1/+1
| | | | | | | | | | | | | | | general cleanup of the API. The entire API now consists of two functions similar to the pre-KSE API. The suser() function takes a thread pointer as its only argument. The td_ucred member of this thread must be valid so the only valid thread pointers are curthread and a few kernel threads such as thread0. The suser_cred() function takes a pointer to a struct ucred as its first argument and an integer flag as its second argument. The flag is currently only used for the PRISON_ROOT flag. Discussed on: smp@ Notes: svn path=/head/; revision=93593
* Use thread0.td_ucred instead of proc0.p_ucred. This change is cosmeticJohn Baldwin2002-02-271-4/+4
| | | | | | | | | and isn't strictly required. However, it lowers the number of false positives found when grep'ing the kernel sources for p_ucred to ensure proper locking. Notes: svn path=/head/; revision=91420
* Simple p_ucred -> td_ucred changes to start using the per-thread ucredJohn Baldwin2002-02-271-2/+2
| | | | | | | reference. Notes: svn path=/head/; revision=91406
* o Modify nfslockdans() to accept a thread reference instead of a procRobert Watson2001-11-141-12/+14
| | | | | | | | | | | | | | reference: with td->td_ucred, it will be desirable to authorize based on td->td_ucred, rather than p->p_ucred. o Since the same variable 'p' was later used with pfind() on the target process for the wakeup, introduce a new local variable 'targetp' to use instead. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=86363
* turn vn_open() into a wrapper around vn_open_cred() which allowsAlfred Perlstein2001-11-111-15/+1
| | | | | | | | | | | one to perform a vn_open using temporary/other/fake credentials. Modify the nfs client side locking code to use vn_open_cred() passing proc0's ucred instead of the old way which was to temporary raise privs while running vn_open(). This should close the race hopefully. Notes: svn path=/head/; revision=86278
* o Note an additional potential problem here: LOCKD_MSG directly exportsRobert Watson2001-10-241-0/+4
| | | | | | | | | struct ucred to userland. In 5.0-CURRENT, it is desirable to instead export struct xucred, as ucred contains mutexes, pointers, and other kernel evil. I'll add it to my work queue. Notes: svn path=/head/; revision=85398
* o Add two comments identifying problems with the current nfs_lock.cRobert Watson2001-10-231-0/+7
| | | | | | | | | | | | implementation, so that the information doesn't get lost. (1) /var/run/lock is looked up relative to the current thread's root directory, but it's not clear that's desirable. (2) A race condition associated with live credential modification on a shared credential is present when privilege is granted for the purposes of talking to /var/run/lock. Notes: svn path=/head/; revision=85370
* Cleanup and split of nfs client and server code.Peter Wemm2001-09-181-22/+15
| | | | | | | This builds on the top of several repo-copies. Notes: svn path=/head/; revision=83651
* KSE Milestone 2Julian Elischer2001-09-121-7/+10
| | | | | | | | | | | | | | | | | Note ALL MODULES MUST BE RECOMPILED make the kernel aware that there are smaller units of scheduling than the process. (but only allow one thread per process at this time). This is functionally equivalent to teh previousl -current except that there is a thread associated with each process. Sorry john! (your next MFC will be a doosie!) Reviewed by: peter@freebsd.org, dillon@freebsd.org X-MFC after: ha ha ha ha Notes: svn path=/head/; revision=83366
* Stupid error from my side in prev. commit: || -> &&Andrey A. Chernov2001-08-231-1/+1
| | | | Notes: svn path=/head/; revision=82213
* Implement l_len<0 per POSIX check.Andrey A. Chernov2001-08-231-4/+6
| | | | | | | Check for valid l_whence too. Notes: svn path=/head/; revision=82204
* Even better move: suppose that server is able to handle SEEK_END,Andrey A. Chernov2001-08-231-6/+6
| | | | | | | | so check arguments for all but not SEEK_END case, leaving SEEK_END handling for server Notes: svn path=/head/; revision=82194
* Apparently SEEK_END locking not supported by NFS. Previous variantAndrey A. Chernov2001-08-231-1/+5
| | | | | | | returns EINVAL in that case, change it to EOPNOTSUPP. Notes: svn path=/head/; revision=82193
* Move <machine/*> after <sys/*>Andrey A. Chernov2001-08-231-1/+2
| | | | | | | Pointed by: bde Notes: svn path=/head/; revision=82190
* adv. lock:Andrey A. Chernov2001-08-231-5/+5
| | | | | | | | detect off_t overflow _before_ it occurse and return EOVERFLOW instead of EINVAL Notes: svn path=/head/; revision=82174
* Unlock the process returned from pfind() if it does not return NULL.Jake Burkholder2001-06-011-1/+4
| | | | | | | | | | | This fixes a witness lock violation for nfssvc returning with locks held. Submitted by: Jean-Luc Richier <Jean-Luc.Richier@imag.fr> PR: kern/27776 Notes: svn path=/head/; revision=77563
* o Merge contents of struct pcred into struct ucred. Specifically, add theRobert Watson2001-05-251-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | real uid, saved uid, real gid, and saved gid to ucred, as well as the pcred->pc_uidinfo, which was associated with the real uid, only rename it to cr_ruidinfo so as not to conflict with cr_uidinfo, which corresponds to the effective uid. o Remove p_cred from struct proc; add p_ucred to struct proc, replacing original macro that pointed. p->p_ucred to p->p_cred->pc_ucred. o Universally update code so that it makes use of ucred instead of pcred, p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo, cr_{r,sv}{u,g}id instead of p_*, etc. o Remove pcred0 and its initialization from init_main.c; initialize cr_ruidinfo there. o Restruction many credential modification chunks to always crdup while we figure out locking and optimizations; generally speaking, this means moving to a structure like this: newcred = crdup(oldcred); ... p->p_ucred = newcred; crfree(oldcred); It's not race-free, but better than nothing. There are also races in sys_process.c, all inter-process authorization, fork, exec, and exit. o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid; remove comments indicating that the old arrangement was a problem. o Restructure exec1() a little to use newcred/oldcred arrangement, and use improved uid management primitives. o Clean up exit1() so as to do less work in credential cleanup due to pcred removal. o Clean up fork1() so as to do less work in credential cleanup and allocation. o Clean up ktrcanset() to take into account changes, and move to using suser_xxx() instead of performing a direct uid==0 comparision. o Improve commenting in various kern_prot.c credential modification calls to better document current behavior. In a couple of places, current behavior is a little questionable and we need to check POSIX.1 to make sure it's "right". More commenting work still remains to be done. o Update credential management calls, such as crfree(), to take into account new ruidinfo reference. o Modify or add the following uid and gid helper routines: change_euid() change_egid() change_ruid() change_rgid() change_svuid() change_svgid() In each case, the call now acts on a credential not a process, and as such no longer requires more complicated process locking/etc. They now assume the caller will do any necessary allocation of an exclusive credential reference. Each is commented to document its reference requirements. o CANSIGIO() is simplified to require only credentials, not processes and pcreds. o Remove lots of (p_pcred==NULL) checks. o Add an XXX to authorization code in nfs_lock.c, since it's questionable, and needs to be considered carefully. o Simplify posix4 authorization code to require only credentials, not processes and pcreds. Note that this authorization, as well as CANSIGIO(), needs to be updated to use the p_cansignal() and p_cansched() centralized authorization routines, as they currently do not take into account some desirable restrictions that are handled by the centralized routines, as well as being inconsistent with other similar authorization instances. o Update libkvm to take these changes into account. Obtained from: TrustedBSD Project Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit Notes: svn path=/head/; revision=77183
* Undo part of the tangle of having sys/lock.h and sys/mutex.h included inMark Murray2001-05-011-3/+5
| | | | | | | | | | | | | | other "system" header files. Also help the deprecation of lockmgr.h by making it a sub-include of sys/lock.h and removing sys/lockmgr.h form kernel .c files. Sort sys/*.h includes where possible in affected files. OK'ed by: bde (with reservations) Notes: svn path=/head/; revision=76166
* Revert consequences of changes to mount.h, part 2.Greg Lehey2001-04-291-2/+0
| | | | | | | Requested by: bde Notes: svn path=/head/; revision=76117
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-05 13:10:45 +0000