minix/servers/vfs/misc.c

812 lines
22 KiB
C
Raw Normal View History

2005-04-21 16:53:53 +02:00
/* This file contains a collection of miscellaneous procedures. Some of them
* perform simple system calls. Some others do a little part of system calls
* that are mostly performed by the Memory Manager.
*
* The entry points into this file are
* do_dup: perform the DUP system call
* do_fcntl: perform the FCNTL system call
* do_sync: perform the SYNC system call
* do_fsync: perform the FSYNC system call
2012-02-13 16:28:04 +01:00
* pm_reboot: sync disks and prepare for shutdown
2010-07-15 16:47:08 +02:00
* pm_fork: adjust the tables after PM has performed a FORK system call
* do_exec: handle files with FD_CLOEXEC on after PM has done an EXEC
2005-04-21 16:53:53 +02:00
* do_exit: a process has exited; note that in the tables
* do_set: set uid or gid for some process
* do_revive: revive a process that was waiting for something (e.g. TTY)
2005-04-21 16:53:53 +02:00
* do_svrctl: file system control
* do_getsysinfo: request copy of FS data structure
2006-05-11 16:57:23 +02:00
* pm_dumpcore: create a core dump
2005-04-21 16:53:53 +02:00
*/
#include "fs.h"
#include <fcntl.h>
#include <assert.h>
#include <unistd.h>
#include <string.h>
2005-04-21 16:53:53 +02:00
#include <minix/callnr.h>
#include <minix/safecopies.h>
endpoint-aware conversion of servers. 'who', indicating caller number in pm and fs and some other servers, has been removed in favour of 'who_e' (endpoint) and 'who_p' (proc nr.). In both PM and FS, isokendpt() convert endpoints to process slot numbers, returning OK if it was a valid and consistent endpoint number. okendpt() does the same but panic()s if it doesn't succeed. (In PM, this is pm_isok..) pm and fs keep their own records of process endpoints in their proc tables, which are needed to make kernel calls about those processes. message field names have changed. fs drivers are endpoints. fs now doesn't try to get out of driver deadlock, as the protocol isn't supposed to let that happen any more. (A warning is printed if ELOCKED is detected though.) fproc[].fp_task (indicating which driver the process is suspended on) became an int. PM and FS now get endpoint numbers of initial boot processes from the kernel. These happen to be the same as the old proc numbers, to let user processes reach them with the old numbers, but FS and PM don't know that. All new processes after INIT, even after the generation number wraps around, get endpoint numbers with generation 1 and higher, so the first instances of the boot processes are the only processes ever to have endpoint numbers in the old proc number range. More return code checks of sys_* functions have been added. IS has become endpoint-aware. Ditched the 'text' and 'data' fields in the kernel dump (which show locations, not sizes, so aren't terribly useful) in favour of the endpoint number. Proc number is still visible. Some other dumps (e.g. dmap, rs) show endpoint numbers now too which got the formatting changed. PM reading segments using rw_seg() has changed - it uses other fields in the message now instead of encoding the segment and process number and fd in the fd field. For that it uses _read_pm() and _write_pm() which to _taskcall()s directly in pm/misc.c. PM now sys_exit()s itself on panic(), instead of sys_abort(). RS also talks in endpoints instead of process numbers.
2006-03-03 11:20:58 +01:00
#include <minix/endpoint.h>
2005-04-21 16:53:53 +02:00
#include <minix/com.h>
2010-09-14 23:50:05 +02:00
#include <minix/sysinfo.h>
#include <minix/u64.h>
2006-05-11 16:57:23 +02:00
#include <sys/ptrace.h>
2005-04-21 16:53:53 +02:00
#include <sys/svrctl.h>
#include "file.h"
#include "fproc.h"
2012-02-13 16:28:04 +01:00
#include "scratchpad.h"
#include "dmap.h"
#include <minix/vfsif.h>
#include "vnode.h"
#include "vmnt.h"
2012-02-13 16:28:04 +01:00
#include "param.h"
2005-04-21 16:53:53 +02:00
2006-05-11 16:57:23 +02:00
#define CORE_NAME "core"
#define CORE_MODE 0777 /* mode to use on core image files */
#if ENABLE_SYSCALL_STATS
2012-03-25 20:25:53 +02:00
unsigned long calls_stats[NCALLS];
#endif
2012-03-25 20:25:53 +02:00
static void free_proc(struct fproc *freed, int flags);
/*
2012-03-25 20:25:53 +02:00
static int dumpcore(int proc_e, struct mem_map *seg_ptr);
static int write_bytes(struct inode *rip, off_t off, char *buf, size_t
bytes);
2012-03-25 20:25:53 +02:00
static int write_seg(struct inode *rip, off_t off, int proc_e, int seg,
off_t seg_off, phys_bytes seg_bytes);
*/
2005-04-21 16:53:53 +02:00
/*===========================================================================*
2005-09-11 18:45:46 +02:00
* do_getsysinfo *
2005-04-21 16:53:53 +02:00
*===========================================================================*/
2012-03-25 20:25:53 +02:00
int do_getsysinfo()
2005-04-21 16:53:53 +02:00
{
vir_bytes src_addr, dst_addr;
size_t len, buf_size;
int what;
what = job_m_in.SI_WHAT;
dst_addr = (vir_bytes) job_m_in.SI_WHERE;
buf_size = (size_t) job_m_in.SI_SIZE;
/* Only su may call do_getsysinfo. This call may leak information (and is not
2011-11-07 21:11:30 +01:00
* stable enough to be part of the API/ABI). In the future, requests from
* non-system processes should be denied.
*/
if (!super_user) return(EPERM);
switch(what) {
2012-02-13 16:28:04 +01:00
case SI_PROC_TAB:
src_addr = (vir_bytes) fproc;
len = sizeof(struct fproc) * NR_PROCS;
break;
case SI_DMAP_TAB:
src_addr = (vir_bytes) dmap;
len = sizeof(struct dmap) * NR_DEVICES;
break;
#if ENABLE_SYSCALL_STATS
2012-02-13 16:28:04 +01:00
case SI_CALL_STATS:
src_addr = (vir_bytes) calls_stats;
len = sizeof(calls_stats);
break;
#endif
case SI_VMNT_TAB:
fetch_vmnt_paths();
src_addr = (vir_bytes) vmnt;
len = sizeof(struct vmnt) * NR_MNTS;
break;
2012-02-13 16:28:04 +01:00
default:
return(EINVAL);
}
if (len != buf_size)
return(EINVAL);
return sys_datacopy(SELF, src_addr, who_e, dst_addr, len);
2005-04-21 16:53:53 +02:00
}
/*===========================================================================*
* do_dup *
*===========================================================================*/
2012-03-25 20:25:53 +02:00
int do_dup()
2005-04-21 16:53:53 +02:00
{
/* Perform the dup(fd) or dup2(fd,fd2) system call. These system calls are
* obsolete. In fact, it is not even possible to invoke them using the
* current library because the library routines call fcntl(). They are
* provided to permit old binary programs to continue to run.
*/
int rfd, rfd2;
struct filp *f;
2012-02-13 16:28:04 +01:00
int r = OK;
2005-04-21 16:53:53 +02:00
scratch(fp).file.fd_nr = job_m_in.fd;
rfd2 = job_m_in.fd2;
2005-04-21 16:53:53 +02:00
/* Is the file descriptor valid? */
rfd = scratch(fp).file.fd_nr & ~DUP_MASK; /* kill off dup2 bit, if on */
2012-02-13 16:28:04 +01:00
if ((f = get_filp(rfd, VNODE_READ)) == NULL) return(err_code);
2005-04-21 16:53:53 +02:00
/* Distinguish between dup and dup2. */
if (!(scratch(fp).file.fd_nr & DUP_MASK)) { /* bit not on */
2005-04-21 16:53:53 +02:00
/* dup(fd) */
r = get_fd(0, 0, &rfd2, NULL);
2005-04-21 16:53:53 +02:00
} else {
2012-02-13 16:28:04 +01:00
/* dup2(old_fd, new_fd) */
if (rfd2 < 0 || rfd2 >= OPEN_MAX) {
2012-02-13 16:28:04 +01:00
r = EBADF;
} else if (rfd == rfd2) { /* ignore the call: dup2(x, x) */
r = rfd2;
2012-02-13 16:28:04 +01:00
} else {
/* All is fine, close new_fd if necessary */
unlock_filp(f); /* or it might deadlock on do_close */
(void) close_fd(fp, rfd2); /* cannot fail */
2012-02-13 16:28:04 +01:00
f = get_filp(rfd, VNODE_READ); /* lock old_fd again */
2012-07-13 18:08:06 +02:00
if (f == NULL) return(err_code);
2012-02-13 16:28:04 +01:00
}
2005-04-21 16:53:53 +02:00
}
2012-02-13 16:28:04 +01:00
if (r == OK) {
/* Success. Set up new file descriptors. */
f->filp_count++;
fp->fp_filp[rfd2] = f;
FD_SET(rfd2, &fp->fp_filp_inuse);
r = rfd2;
2012-02-13 16:28:04 +01:00
}
2005-04-21 16:53:53 +02:00
2012-02-13 16:28:04 +01:00
unlock_filp(f);
return(r);
}
2005-04-21 16:53:53 +02:00
/*===========================================================================*
* do_fcntl *
*===========================================================================*/
2012-03-25 20:25:53 +02:00
int do_fcntl()
2005-04-21 16:53:53 +02:00
{
/* Perform the fcntl(fd, request, ...) system call. */
register struct filp *f;
int new_fd, fl, r = OK, fcntl_req, fcntl_argx;
2012-02-13 16:28:04 +01:00
tll_access_t locktype;
scratch(fp).file.fd_nr = job_m_in.fd;
scratch(fp).io.io_buffer = job_m_in.buffer;
scratch(fp).io.io_nbytes = job_m_in.nbytes; /* a.k.a. m_in.request */
fcntl_req = job_m_in.request;
fcntl_argx = job_m_in.addr;
2005-04-21 16:53:53 +02:00
/* Is the file descriptor valid? */
locktype = (fcntl_req == F_FREESP) ? VNODE_WRITE : VNODE_READ;
2012-02-13 16:28:04 +01:00
if ((f = get_filp(scratch(fp).file.fd_nr, locktype)) == NULL)
return(err_code);
switch (fcntl_req) {
2012-02-13 16:28:04 +01:00
case F_DUPFD:
2005-04-21 16:53:53 +02:00
/* This replaces the old dup() system call. */
if (fcntl_argx < 0 || fcntl_argx >= OPEN_MAX) r = EINVAL;
else if ((r = get_fd(fcntl_argx, 0, &new_fd, NULL)) == OK) {
2012-02-13 16:28:04 +01:00
f->filp_count++;
fp->fp_filp[new_fd] = f;
FD_SET(new_fd, &fp->fp_filp_inuse);
r = new_fd;
}
break;
2005-04-21 16:53:53 +02:00
2012-02-13 16:28:04 +01:00
case F_GETFD:
2005-04-21 16:53:53 +02:00
/* Get close-on-exec flag (FD_CLOEXEC in POSIX Table 6-2). */
2012-02-13 16:28:04 +01:00
r = 0;
if (FD_ISSET(scratch(fp).file.fd_nr, &fp->fp_cloexec_set))
r = FD_CLOEXEC;
break;
2005-04-21 16:53:53 +02:00
2012-02-13 16:28:04 +01:00
case F_SETFD:
2005-04-21 16:53:53 +02:00
/* Set close-on-exec flag (FD_CLOEXEC in POSIX Table 6-2). */
if (fcntl_argx & FD_CLOEXEC)
2012-02-13 16:28:04 +01:00
FD_SET(scratch(fp).file.fd_nr, &fp->fp_cloexec_set);
else
2012-02-13 16:28:04 +01:00
FD_CLR(scratch(fp).file.fd_nr, &fp->fp_cloexec_set);
break;
2005-04-21 16:53:53 +02:00
2012-02-13 16:28:04 +01:00
case F_GETFL:
2005-04-21 16:53:53 +02:00
/* Get file status flags (O_NONBLOCK and O_APPEND). */
fl = f->filp_flags & (O_NONBLOCK | O_APPEND | O_ACCMODE);
2012-02-13 16:28:04 +01:00
r = fl;
break;
2005-04-21 16:53:53 +02:00
2012-02-13 16:28:04 +01:00
case F_SETFL:
2005-04-21 16:53:53 +02:00
/* Set file status flags (O_NONBLOCK and O_APPEND). */
fl = O_NONBLOCK | O_APPEND | O_REOPEN;
f->filp_flags = (f->filp_flags & ~fl) | (fcntl_argx & fl);
2012-02-13 16:28:04 +01:00
break;
2005-04-21 16:53:53 +02:00
2012-02-13 16:28:04 +01:00
case F_GETLK:
case F_SETLK:
case F_SETLKW:
2005-04-21 16:53:53 +02:00
/* Set or clear a file lock. */
r = lock_op(f, fcntl_req);
2012-02-13 16:28:04 +01:00
break;
2012-02-13 16:28:04 +01:00
case F_FREESP:
{
2012-02-13 16:28:04 +01:00
/* Free a section of a file */
off_t start, end;
struct flock flock_arg;
signed long offset;
/* Check if it's a regular file. */
2012-04-25 14:44:42 +02:00
if (!S_ISREG(f->filp_vno->v_mode)) r = EINVAL;
2012-02-13 16:28:04 +01:00
else if (!(f->filp_mode & W_BIT)) r = EBADF;
else
/* Copy flock data from userspace. */
r = sys_datacopy(who_e, (vir_bytes) scratch(fp).io.io_buffer,
SELF, (vir_bytes) &flock_arg,
sizeof(flock_arg));
2012-02-13 16:28:04 +01:00
if (r != OK) break;
/* Convert starting offset to signed. */
offset = (signed long) flock_arg.l_start;
/* Figure out starting position base. */
switch(flock_arg.l_whence) {
2012-02-13 16:28:04 +01:00
case SEEK_SET: start = 0; break;
case SEEK_CUR:
if (ex64hi(f->filp_pos) != 0)
panic("do_fcntl: position in file too high");
2012-02-13 16:28:04 +01:00
start = ex64lo(f->filp_pos);
break;
case SEEK_END: start = f->filp_vno->v_size; break;
default: r = EINVAL;
}
2012-02-13 16:28:04 +01:00
if (r != OK) break;
/* Check for overflow or underflow. */
2012-02-13 16:28:04 +01:00
if (offset > 0 && start + offset < start) r = EINVAL;
else if (offset < 0 && start + offset > start) r = EINVAL;
else {
start += offset;
if (start < 0) r = EINVAL;
}
if (r != OK) break;
if (flock_arg.l_len != 0) {
if (start >= f->filp_vno->v_size) r = EINVAL;
else if ((end = start + flock_arg.l_len) <= start) r = EINVAL;
else if (end > f->filp_vno->v_size) end = f->filp_vno->v_size;
} else {
end = 0;
}
2012-02-13 16:28:04 +01:00
if (r != OK) break;
2012-02-13 16:28:04 +01:00
r = req_ftrunc(f->filp_vno->v_fs_e, f->filp_vno->v_inode_nr,start,end);
2012-02-13 16:28:04 +01:00
if (r == OK && flock_arg.l_len == 0)
f->filp_vno->v_size = start;
2012-02-13 16:28:04 +01:00
break;
}
case F_GETNOSIGPIPE:
/* POSIX: return value other than -1 is flag is set, else -1 */
r = -1;
if (f->filp_flags & O_NOSIGPIPE)
r = 0;
break;
case F_SETNOSIGPIPE:
fl = (O_NOSIGPIPE);
f->filp_flags = (f->filp_flags & ~fl) | (fcntl_argx & fl);
break;
2012-02-13 16:28:04 +01:00
default:
r = EINVAL;
2005-04-21 16:53:53 +02:00
}
2012-02-13 16:28:04 +01:00
unlock_filp(f);
return(r);
}
2005-04-21 16:53:53 +02:00
/*===========================================================================*
* do_sync *
*===========================================================================*/
2012-03-25 20:25:53 +02:00
int do_sync()
2005-04-21 16:53:53 +02:00
{
struct vmnt *vmp;
2012-02-13 16:28:04 +01:00
int r = OK;
for (vmp = &vmnt[0]; vmp < &vmnt[NR_MNTS]; ++vmp) {
VFS: fix locking bugs .sync and fsync used unnecessarily restrictive locking type .fsync violated locking order by obtaining a vmnt lock after a filp lock .fsync contained a TOCTOU bug .new_node violated locking rules (didn't upgrade lock upon file creation) .do_pipe used unnecessarily restrictive locking type .always lock pipes exclusively; even a read operation might require to do a write on a vnode object (update pipe size) .when opening a file with O_TRUNC, upgrade vnode lock when truncating .utime used unnecessarily restrictive locking type .path parsing: .always acquire VMNT_WRITE or VMNT_EXCL on vmnt and downgrade to VMNT_READ if that was what was actually requested. This prevents the following deadlock scenario: thread A: lock_vmnt(vmp, TLL_READSER); lock_vnode(vp, TLL_READSER); upgrade_vmnt_lock(vmp, TLL_WRITE); thread B: lock_vmnt(vmp, TLL_READ); lock_vnode(vp, TLL_READSER); thread A will be stuck in upgrade_vmnt_lock and thread B is stuck in lock_vnode. This happens when, for example, thread A tries create a new node (open.c:new_node) and thread B tries to do eat_path to change dir (stadir.c:do_chdir). When the path is being resolved, a vnode is always locked with VNODE_OPCL (TLL_READSER) and then downgraded to VNODE_READ if read-only is actually requested. Thread A locks the vmnt with VMNT_WRITE (TLL_READSER) which still allows VMNT_READ locks. Thread B can't acquire a lock on the vnode because thread A has it; Thread A can't upgrade its vmnt lock to VMNT_WRITE (TLL_WRITE) because thread B has a VMNT_READ lock on it. By serializing vmnt locks during path parsing, thread B can only acquire a lock on vmp when thread A has completely finished its operation.
2012-11-30 13:49:53 +01:00
if ((r = lock_vmnt(vmp, VMNT_READ)) != OK)
2012-11-14 14:24:53 +01:00
break;
2012-02-13 16:28:04 +01:00
if (vmp->m_dev != NO_DEV && vmp->m_fs_e != NONE &&
vmp->m_root_node != NULL) {
req_sync(vmp->m_fs_e);
}
2012-11-14 14:24:53 +01:00
unlock_vmnt(vmp);
2012-02-13 16:28:04 +01:00
}
2012-02-13 16:28:04 +01:00
return(r);
2005-04-21 16:53:53 +02:00
}
/*===========================================================================*
2005-09-11 18:45:46 +02:00
* do_fsync *
*===========================================================================*/
2012-03-25 20:25:53 +02:00
int do_fsync()
{
2012-02-13 16:28:04 +01:00
/* Perform the fsync() system call. */
struct filp *rfilp;
struct vmnt *vmp;
dev_t dev;
int r = OK;
scratch(fp).file.fd_nr = job_m_in.fd;
if ((rfilp = get_filp(scratch(fp).file.fd_nr, VNODE_READ)) == NULL)
return(err_code);
VFS: fix locking bugs .sync and fsync used unnecessarily restrictive locking type .fsync violated locking order by obtaining a vmnt lock after a filp lock .fsync contained a TOCTOU bug .new_node violated locking rules (didn't upgrade lock upon file creation) .do_pipe used unnecessarily restrictive locking type .always lock pipes exclusively; even a read operation might require to do a write on a vnode object (update pipe size) .when opening a file with O_TRUNC, upgrade vnode lock when truncating .utime used unnecessarily restrictive locking type .path parsing: .always acquire VMNT_WRITE or VMNT_EXCL on vmnt and downgrade to VMNT_READ if that was what was actually requested. This prevents the following deadlock scenario: thread A: lock_vmnt(vmp, TLL_READSER); lock_vnode(vp, TLL_READSER); upgrade_vmnt_lock(vmp, TLL_WRITE); thread B: lock_vmnt(vmp, TLL_READ); lock_vnode(vp, TLL_READSER); thread A will be stuck in upgrade_vmnt_lock and thread B is stuck in lock_vnode. This happens when, for example, thread A tries create a new node (open.c:new_node) and thread B tries to do eat_path to change dir (stadir.c:do_chdir). When the path is being resolved, a vnode is always locked with VNODE_OPCL (TLL_READSER) and then downgraded to VNODE_READ if read-only is actually requested. Thread A locks the vmnt with VMNT_WRITE (TLL_READSER) which still allows VMNT_READ locks. Thread B can't acquire a lock on the vnode because thread A has it; Thread A can't upgrade its vmnt lock to VMNT_WRITE (TLL_WRITE) because thread B has a VMNT_READ lock on it. By serializing vmnt locks during path parsing, thread B can only acquire a lock on vmp when thread A has completely finished its operation.
2012-11-30 13:49:53 +01:00
2012-02-13 16:28:04 +01:00
dev = rfilp->filp_vno->v_dev;
VFS: fix locking bugs .sync and fsync used unnecessarily restrictive locking type .fsync violated locking order by obtaining a vmnt lock after a filp lock .fsync contained a TOCTOU bug .new_node violated locking rules (didn't upgrade lock upon file creation) .do_pipe used unnecessarily restrictive locking type .always lock pipes exclusively; even a read operation might require to do a write on a vnode object (update pipe size) .when opening a file with O_TRUNC, upgrade vnode lock when truncating .utime used unnecessarily restrictive locking type .path parsing: .always acquire VMNT_WRITE or VMNT_EXCL on vmnt and downgrade to VMNT_READ if that was what was actually requested. This prevents the following deadlock scenario: thread A: lock_vmnt(vmp, TLL_READSER); lock_vnode(vp, TLL_READSER); upgrade_vmnt_lock(vmp, TLL_WRITE); thread B: lock_vmnt(vmp, TLL_READ); lock_vnode(vp, TLL_READSER); thread A will be stuck in upgrade_vmnt_lock and thread B is stuck in lock_vnode. This happens when, for example, thread A tries create a new node (open.c:new_node) and thread B tries to do eat_path to change dir (stadir.c:do_chdir). When the path is being resolved, a vnode is always locked with VNODE_OPCL (TLL_READSER) and then downgraded to VNODE_READ if read-only is actually requested. Thread A locks the vmnt with VMNT_WRITE (TLL_READSER) which still allows VMNT_READ locks. Thread B can't acquire a lock on the vnode because thread A has it; Thread A can't upgrade its vmnt lock to VMNT_WRITE (TLL_WRITE) because thread B has a VMNT_READ lock on it. By serializing vmnt locks during path parsing, thread B can only acquire a lock on vmp when thread A has completely finished its operation.
2012-11-30 13:49:53 +01:00
unlock_filp(rfilp);
2012-02-13 16:28:04 +01:00
for (vmp = &vmnt[0]; vmp < &vmnt[NR_MNTS]; ++vmp) {
VFS: fix locking bugs .sync and fsync used unnecessarily restrictive locking type .fsync violated locking order by obtaining a vmnt lock after a filp lock .fsync contained a TOCTOU bug .new_node violated locking rules (didn't upgrade lock upon file creation) .do_pipe used unnecessarily restrictive locking type .always lock pipes exclusively; even a read operation might require to do a write on a vnode object (update pipe size) .when opening a file with O_TRUNC, upgrade vnode lock when truncating .utime used unnecessarily restrictive locking type .path parsing: .always acquire VMNT_WRITE or VMNT_EXCL on vmnt and downgrade to VMNT_READ if that was what was actually requested. This prevents the following deadlock scenario: thread A: lock_vmnt(vmp, TLL_READSER); lock_vnode(vp, TLL_READSER); upgrade_vmnt_lock(vmp, TLL_WRITE); thread B: lock_vmnt(vmp, TLL_READ); lock_vnode(vp, TLL_READSER); thread A will be stuck in upgrade_vmnt_lock and thread B is stuck in lock_vnode. This happens when, for example, thread A tries create a new node (open.c:new_node) and thread B tries to do eat_path to change dir (stadir.c:do_chdir). When the path is being resolved, a vnode is always locked with VNODE_OPCL (TLL_READSER) and then downgraded to VNODE_READ if read-only is actually requested. Thread A locks the vmnt with VMNT_WRITE (TLL_READSER) which still allows VMNT_READ locks. Thread B can't acquire a lock on the vnode because thread A has it; Thread A can't upgrade its vmnt lock to VMNT_WRITE (TLL_WRITE) because thread B has a VMNT_READ lock on it. By serializing vmnt locks during path parsing, thread B can only acquire a lock on vmp when thread A has completely finished its operation.
2012-11-30 13:49:53 +01:00
if (vmp->m_dev != dev) continue;
if ((r = lock_vmnt(vmp, VMNT_READ)) != OK)
break;
2012-02-13 16:28:04 +01:00
if (vmp->m_dev != NO_DEV && vmp->m_dev == dev &&
vmp->m_fs_e != NONE && vmp->m_root_node != NULL) {
req_sync(vmp->m_fs_e);
}
VFS: fix locking bugs .sync and fsync used unnecessarily restrictive locking type .fsync violated locking order by obtaining a vmnt lock after a filp lock .fsync contained a TOCTOU bug .new_node violated locking rules (didn't upgrade lock upon file creation) .do_pipe used unnecessarily restrictive locking type .always lock pipes exclusively; even a read operation might require to do a write on a vnode object (update pipe size) .when opening a file with O_TRUNC, upgrade vnode lock when truncating .utime used unnecessarily restrictive locking type .path parsing: .always acquire VMNT_WRITE or VMNT_EXCL on vmnt and downgrade to VMNT_READ if that was what was actually requested. This prevents the following deadlock scenario: thread A: lock_vmnt(vmp, TLL_READSER); lock_vnode(vp, TLL_READSER); upgrade_vmnt_lock(vmp, TLL_WRITE); thread B: lock_vmnt(vmp, TLL_READ); lock_vnode(vp, TLL_READSER); thread A will be stuck in upgrade_vmnt_lock and thread B is stuck in lock_vnode. This happens when, for example, thread A tries create a new node (open.c:new_node) and thread B tries to do eat_path to change dir (stadir.c:do_chdir). When the path is being resolved, a vnode is always locked with VNODE_OPCL (TLL_READSER) and then downgraded to VNODE_READ if read-only is actually requested. Thread A locks the vmnt with VMNT_WRITE (TLL_READSER) which still allows VMNT_READ locks. Thread B can't acquire a lock on the vnode because thread A has it; Thread A can't upgrade its vmnt lock to VMNT_WRITE (TLL_WRITE) because thread B has a VMNT_READ lock on it. By serializing vmnt locks during path parsing, thread B can only acquire a lock on vmp when thread A has completely finished its operation.
2012-11-30 13:49:53 +01:00
unlock_vmnt(vmp);
}
2012-02-13 16:28:04 +01:00
return(r);
}
2005-04-21 16:53:53 +02:00
/*===========================================================================*
2006-05-11 16:57:23 +02:00
* pm_reboot *
2005-04-21 16:53:53 +02:00
*===========================================================================*/
2012-03-25 20:25:53 +02:00
void pm_reboot()
2005-04-21 16:53:53 +02:00
{
/* Perform the VFS side of the reboot call. */
2005-04-21 16:53:53 +02:00
int i;
2012-02-13 16:28:04 +01:00
struct fproc *rfp;
2005-04-21 16:53:53 +02:00
do_sync();
/* Do exit processing for all leftover processes and servers, but don't
* actually exit them (if they were really gone, PM will tell us about it).
* Skip processes that handle parts of the file system; we first need to give
* them the chance to unmount (which should be possible as all normal
* processes have no open files anymore).
*/
2012-02-13 16:28:04 +01:00
for (i = 0; i < NR_PROCS; i++) {
rfp = &fproc[i];
/* Don't just free the proc right away, but let it finish what it was
* doing first */
lock_proc(rfp, 0);
if (rfp->fp_endpoint != NONE && find_vmnt(rfp->fp_endpoint) == NULL)
free_proc(rfp, 0);
unlock_proc(rfp);
}
do_sync();
unmount_all(0 /* Don't force */);
/* Try to exit all processes again including File Servers */
for (i = 0; i < NR_PROCS; i++) {
rfp = &fproc[i];
2012-02-13 16:28:04 +01:00
/* Don't just free the proc right away, but let it finish what it was
* doing first */
lock_proc(rfp, 0);
if (rfp->fp_endpoint != NONE)
free_proc(rfp, 0);
2012-02-13 16:28:04 +01:00
unlock_proc(rfp);
}
2005-04-21 16:53:53 +02:00
2012-02-13 16:28:04 +01:00
do_sync();
unmount_all(1 /* Force */);
2005-04-21 16:53:53 +02:00
}
/*===========================================================================*
2006-05-11 16:57:23 +02:00
* pm_fork *
2005-04-21 16:53:53 +02:00
*===========================================================================*/
void pm_fork(endpoint_t pproc, endpoint_t cproc, pid_t cpid)
2005-04-21 16:53:53 +02:00
{
/* Perform those aspects of the fork() system call that relate to files.
* In particular, let the child inherit its parent's file descriptors.
* The parent and child parameters tell who forked off whom. The file
* system uses the same slot numbers as the kernel. Only PM makes this call.
2005-04-21 16:53:53 +02:00
*/
struct fproc *cp, *pp;
endpoint-aware conversion of servers. 'who', indicating caller number in pm and fs and some other servers, has been removed in favour of 'who_e' (endpoint) and 'who_p' (proc nr.). In both PM and FS, isokendpt() convert endpoints to process slot numbers, returning OK if it was a valid and consistent endpoint number. okendpt() does the same but panic()s if it doesn't succeed. (In PM, this is pm_isok..) pm and fs keep their own records of process endpoints in their proc tables, which are needed to make kernel calls about those processes. message field names have changed. fs drivers are endpoints. fs now doesn't try to get out of driver deadlock, as the protocol isn't supposed to let that happen any more. (A warning is printed if ELOCKED is detected though.) fproc[].fp_task (indicating which driver the process is suspended on) became an int. PM and FS now get endpoint numbers of initial boot processes from the kernel. These happen to be the same as the old proc numbers, to let user processes reach them with the old numbers, but FS and PM don't know that. All new processes after INIT, even after the generation number wraps around, get endpoint numbers with generation 1 and higher, so the first instances of the boot processes are the only processes ever to have endpoint numbers in the old proc number range. More return code checks of sys_* functions have been added. IS has become endpoint-aware. Ditched the 'text' and 'data' fields in the kernel dump (which show locations, not sizes, so aren't terribly useful) in favour of the endpoint number. Proc number is still visible. Some other dumps (e.g. dmap, rs) show endpoint numbers now too which got the formatting changed. PM reading segments using rw_seg() has changed - it uses other fields in the message now instead of encoding the segment and process number and fd in the fd field. For that it uses _read_pm() and _write_pm() which to _taskcall()s directly in pm/misc.c. PM now sys_exit()s itself on panic(), instead of sys_abort(). RS also talks in endpoints instead of process numbers.
2006-03-03 11:20:58 +01:00
int i, parentno, childno;
2012-02-13 16:28:04 +01:00
mutex_t c_fp_lock;
2005-04-21 16:53:53 +02:00
endpoint-aware conversion of servers. 'who', indicating caller number in pm and fs and some other servers, has been removed in favour of 'who_e' (endpoint) and 'who_p' (proc nr.). In both PM and FS, isokendpt() convert endpoints to process slot numbers, returning OK if it was a valid and consistent endpoint number. okendpt() does the same but panic()s if it doesn't succeed. (In PM, this is pm_isok..) pm and fs keep their own records of process endpoints in their proc tables, which are needed to make kernel calls about those processes. message field names have changed. fs drivers are endpoints. fs now doesn't try to get out of driver deadlock, as the protocol isn't supposed to let that happen any more. (A warning is printed if ELOCKED is detected though.) fproc[].fp_task (indicating which driver the process is suspended on) became an int. PM and FS now get endpoint numbers of initial boot processes from the kernel. These happen to be the same as the old proc numbers, to let user processes reach them with the old numbers, but FS and PM don't know that. All new processes after INIT, even after the generation number wraps around, get endpoint numbers with generation 1 and higher, so the first instances of the boot processes are the only processes ever to have endpoint numbers in the old proc number range. More return code checks of sys_* functions have been added. IS has become endpoint-aware. Ditched the 'text' and 'data' fields in the kernel dump (which show locations, not sizes, so aren't terribly useful) in favour of the endpoint number. Proc number is still visible. Some other dumps (e.g. dmap, rs) show endpoint numbers now too which got the formatting changed. PM reading segments using rw_seg() has changed - it uses other fields in the message now instead of encoding the segment and process number and fd in the fd field. For that it uses _read_pm() and _write_pm() which to _taskcall()s directly in pm/misc.c. PM now sys_exit()s itself on panic(), instead of sys_abort(). RS also talks in endpoints instead of process numbers.
2006-03-03 11:20:58 +01:00
/* Check up-to-dateness of fproc. */
2006-05-11 16:57:23 +02:00
okendpt(pproc, &parentno);
endpoint-aware conversion of servers. 'who', indicating caller number in pm and fs and some other servers, has been removed in favour of 'who_e' (endpoint) and 'who_p' (proc nr.). In both PM and FS, isokendpt() convert endpoints to process slot numbers, returning OK if it was a valid and consistent endpoint number. okendpt() does the same but panic()s if it doesn't succeed. (In PM, this is pm_isok..) pm and fs keep their own records of process endpoints in their proc tables, which are needed to make kernel calls about those processes. message field names have changed. fs drivers are endpoints. fs now doesn't try to get out of driver deadlock, as the protocol isn't supposed to let that happen any more. (A warning is printed if ELOCKED is detected though.) fproc[].fp_task (indicating which driver the process is suspended on) became an int. PM and FS now get endpoint numbers of initial boot processes from the kernel. These happen to be the same as the old proc numbers, to let user processes reach them with the old numbers, but FS and PM don't know that. All new processes after INIT, even after the generation number wraps around, get endpoint numbers with generation 1 and higher, so the first instances of the boot processes are the only processes ever to have endpoint numbers in the old proc number range. More return code checks of sys_* functions have been added. IS has become endpoint-aware. Ditched the 'text' and 'data' fields in the kernel dump (which show locations, not sizes, so aren't terribly useful) in favour of the endpoint number. Proc number is still visible. Some other dumps (e.g. dmap, rs) show endpoint numbers now too which got the formatting changed. PM reading segments using rw_seg() has changed - it uses other fields in the message now instead of encoding the segment and process number and fd in the fd field. For that it uses _read_pm() and _write_pm() which to _taskcall()s directly in pm/misc.c. PM now sys_exit()s itself on panic(), instead of sys_abort(). RS also talks in endpoints instead of process numbers.
2006-03-03 11:20:58 +01:00
/* PM gives child endpoint, which implies process slot information.
* Don't call isokendpt, because that will verify if the endpoint
* number is correct in fproc, which it won't be.
*/
2006-05-11 16:57:23 +02:00
childno = _ENDPOINT_P(cproc);
2012-02-13 16:28:04 +01:00
if (childno < 0 || childno >= NR_PROCS)
panic("VFS: bogus child for forking: %d", cproc);
2012-02-13 16:28:04 +01:00
if (fproc[childno].fp_pid != PID_FREE)
panic("VFS: forking on top of in-use child: %d", childno);
2005-04-21 16:53:53 +02:00
/* Copy the parent's fproc struct to the child. */
2012-02-13 16:28:04 +01:00
/* However, the mutex variables belong to a slot and must stay the same. */
c_fp_lock = fproc[childno].fp_lock;
endpoint-aware conversion of servers. 'who', indicating caller number in pm and fs and some other servers, has been removed in favour of 'who_e' (endpoint) and 'who_p' (proc nr.). In both PM and FS, isokendpt() convert endpoints to process slot numbers, returning OK if it was a valid and consistent endpoint number. okendpt() does the same but panic()s if it doesn't succeed. (In PM, this is pm_isok..) pm and fs keep their own records of process endpoints in their proc tables, which are needed to make kernel calls about those processes. message field names have changed. fs drivers are endpoints. fs now doesn't try to get out of driver deadlock, as the protocol isn't supposed to let that happen any more. (A warning is printed if ELOCKED is detected though.) fproc[].fp_task (indicating which driver the process is suspended on) became an int. PM and FS now get endpoint numbers of initial boot processes from the kernel. These happen to be the same as the old proc numbers, to let user processes reach them with the old numbers, but FS and PM don't know that. All new processes after INIT, even after the generation number wraps around, get endpoint numbers with generation 1 and higher, so the first instances of the boot processes are the only processes ever to have endpoint numbers in the old proc number range. More return code checks of sys_* functions have been added. IS has become endpoint-aware. Ditched the 'text' and 'data' fields in the kernel dump (which show locations, not sizes, so aren't terribly useful) in favour of the endpoint number. Proc number is still visible. Some other dumps (e.g. dmap, rs) show endpoint numbers now too which got the formatting changed. PM reading segments using rw_seg() has changed - it uses other fields in the message now instead of encoding the segment and process number and fd in the fd field. For that it uses _read_pm() and _write_pm() which to _taskcall()s directly in pm/misc.c. PM now sys_exit()s itself on panic(), instead of sys_abort(). RS also talks in endpoints instead of process numbers.
2006-03-03 11:20:58 +01:00
fproc[childno] = fproc[parentno];
2012-02-13 16:28:04 +01:00
fproc[childno].fp_lock = c_fp_lock;
2005-04-21 16:53:53 +02:00
/* Increase the counters in the 'filp' table. */
endpoint-aware conversion of servers. 'who', indicating caller number in pm and fs and some other servers, has been removed in favour of 'who_e' (endpoint) and 'who_p' (proc nr.). In both PM and FS, isokendpt() convert endpoints to process slot numbers, returning OK if it was a valid and consistent endpoint number. okendpt() does the same but panic()s if it doesn't succeed. (In PM, this is pm_isok..) pm and fs keep their own records of process endpoints in their proc tables, which are needed to make kernel calls about those processes. message field names have changed. fs drivers are endpoints. fs now doesn't try to get out of driver deadlock, as the protocol isn't supposed to let that happen any more. (A warning is printed if ELOCKED is detected though.) fproc[].fp_task (indicating which driver the process is suspended on) became an int. PM and FS now get endpoint numbers of initial boot processes from the kernel. These happen to be the same as the old proc numbers, to let user processes reach them with the old numbers, but FS and PM don't know that. All new processes after INIT, even after the generation number wraps around, get endpoint numbers with generation 1 and higher, so the first instances of the boot processes are the only processes ever to have endpoint numbers in the old proc number range. More return code checks of sys_* functions have been added. IS has become endpoint-aware. Ditched the 'text' and 'data' fields in the kernel dump (which show locations, not sizes, so aren't terribly useful) in favour of the endpoint number. Proc number is still visible. Some other dumps (e.g. dmap, rs) show endpoint numbers now too which got the formatting changed. PM reading segments using rw_seg() has changed - it uses other fields in the message now instead of encoding the segment and process number and fd in the fd field. For that it uses _read_pm() and _write_pm() which to _taskcall()s directly in pm/misc.c. PM now sys_exit()s itself on panic(), instead of sys_abort(). RS also talks in endpoints instead of process numbers.
2006-03-03 11:20:58 +01:00
cp = &fproc[childno];
2012-02-13 16:28:04 +01:00
pp = &fproc[parentno];
2005-04-21 16:53:53 +02:00
for (i = 0; i < OPEN_MAX; i++)
if (cp->fp_filp[i] != NULL) cp->fp_filp[i]->filp_count++;
2005-04-21 16:53:53 +02:00
endpoint-aware conversion of servers. 'who', indicating caller number in pm and fs and some other servers, has been removed in favour of 'who_e' (endpoint) and 'who_p' (proc nr.). In both PM and FS, isokendpt() convert endpoints to process slot numbers, returning OK if it was a valid and consistent endpoint number. okendpt() does the same but panic()s if it doesn't succeed. (In PM, this is pm_isok..) pm and fs keep their own records of process endpoints in their proc tables, which are needed to make kernel calls about those processes. message field names have changed. fs drivers are endpoints. fs now doesn't try to get out of driver deadlock, as the protocol isn't supposed to let that happen any more. (A warning is printed if ELOCKED is detected though.) fproc[].fp_task (indicating which driver the process is suspended on) became an int. PM and FS now get endpoint numbers of initial boot processes from the kernel. These happen to be the same as the old proc numbers, to let user processes reach them with the old numbers, but FS and PM don't know that. All new processes after INIT, even after the generation number wraps around, get endpoint numbers with generation 1 and higher, so the first instances of the boot processes are the only processes ever to have endpoint numbers in the old proc number range. More return code checks of sys_* functions have been added. IS has become endpoint-aware. Ditched the 'text' and 'data' fields in the kernel dump (which show locations, not sizes, so aren't terribly useful) in favour of the endpoint number. Proc number is still visible. Some other dumps (e.g. dmap, rs) show endpoint numbers now too which got the formatting changed. PM reading segments using rw_seg() has changed - it uses other fields in the message now instead of encoding the segment and process number and fd in the fd field. For that it uses _read_pm() and _write_pm() which to _taskcall()s directly in pm/misc.c. PM now sys_exit()s itself on panic(), instead of sys_abort(). RS also talks in endpoints instead of process numbers.
2006-03-03 11:20:58 +01:00
/* Fill in new process and endpoint id. */
2006-05-11 16:57:23 +02:00
cp->fp_pid = cpid;
cp->fp_endpoint = cproc;
2005-04-21 16:53:53 +02:00
2012-02-13 16:28:04 +01:00
/* A forking process never has an outstanding grant, as it isn't blocking on
* I/O. */
if (GRANT_VALID(pp->fp_grant)) {
2012-02-13 16:28:04 +01:00
panic("VFS: fork: pp (endpoint %d) has grant %d\n", pp->fp_endpoint,
pp->fp_grant);
}
if (GRANT_VALID(cp->fp_grant)) {
2012-02-13 16:28:04 +01:00
panic("VFS: fork: cp (endpoint %d) has grant %d\n", cp->fp_endpoint,
cp->fp_grant);
}
2012-02-13 16:28:04 +01:00
/* A child is not a process leader, not being revived, etc. */
cp->fp_flags = FP_NOFLAGS;
2005-04-21 16:53:53 +02:00
/* Record the fact that both root and working dir have another user. */
2012-02-13 16:28:04 +01:00
if (cp->fp_rd) dup_vnode(cp->fp_rd);
if (cp->fp_wd) dup_vnode(cp->fp_wd);
2005-04-21 16:53:53 +02:00
}
/*===========================================================================*
* free_proc *
2005-04-21 16:53:53 +02:00
*===========================================================================*/
2012-03-25 20:25:53 +02:00
static void free_proc(struct fproc *exiter, int flags)
2005-04-21 16:53:53 +02:00
{
int i;
2005-04-21 16:53:53 +02:00
register struct fproc *rfp;
register struct filp *rfilp;
register struct vnode *vp;
2005-04-21 16:53:53 +02:00
dev_t dev;
2012-02-13 16:28:04 +01:00
if (exiter->fp_endpoint == NONE)
panic("free_proc: already free");
2005-04-21 16:53:53 +02:00
2012-02-13 16:28:04 +01:00
if (fp_is_blocked(exiter))
unpause(exiter->fp_endpoint);
2005-04-21 16:53:53 +02:00
/* Loop on file descriptors, closing any that are open. */
for (i = 0; i < OPEN_MAX; i++) {
2012-02-13 16:28:04 +01:00
(void) close_fd(exiter, i);
2005-04-21 16:53:53 +02:00
}
2012-02-13 16:28:04 +01:00
/* Release root and working directories. */
if (exiter->fp_rd) { put_vnode(exiter->fp_rd); exiter->fp_rd = NULL; }
if (exiter->fp_wd) { put_vnode(exiter->fp_wd); exiter->fp_wd = NULL; }
/* The rest of these actions is only done when processes actually exit. */
if (!(flags & FP_EXITING)) return;
exiter->fp_flags |= FP_EXITING;
/* Check if any process is SUSPENDed on this driver.
* If a driver exits, unmap its entries in the dmap table.
* (unmapping has to be done after the first step, because the
* dmap table is used in the first step.)
*/
2012-02-13 16:28:04 +01:00
unsuspend_by_endpt(exiter->fp_endpoint);
dmap_unmap_by_endpt(exiter->fp_endpoint);
2012-02-13 16:28:04 +01:00
worker_stop_by_endpt(exiter->fp_endpoint); /* Unblock waiting threads */
vmnt_unmap_by_endpt(exiter->fp_endpoint); /* Invalidate open files if this
* was an active FS */
endpoint-aware conversion of servers. 'who', indicating caller number in pm and fs and some other servers, has been removed in favour of 'who_e' (endpoint) and 'who_p' (proc nr.). In both PM and FS, isokendpt() convert endpoints to process slot numbers, returning OK if it was a valid and consistent endpoint number. okendpt() does the same but panic()s if it doesn't succeed. (In PM, this is pm_isok..) pm and fs keep their own records of process endpoints in their proc tables, which are needed to make kernel calls about those processes. message field names have changed. fs drivers are endpoints. fs now doesn't try to get out of driver deadlock, as the protocol isn't supposed to let that happen any more. (A warning is printed if ELOCKED is detected though.) fproc[].fp_task (indicating which driver the process is suspended on) became an int. PM and FS now get endpoint numbers of initial boot processes from the kernel. These happen to be the same as the old proc numbers, to let user processes reach them with the old numbers, but FS and PM don't know that. All new processes after INIT, even after the generation number wraps around, get endpoint numbers with generation 1 and higher, so the first instances of the boot processes are the only processes ever to have endpoint numbers in the old proc number range. More return code checks of sys_* functions have been added. IS has become endpoint-aware. Ditched the 'text' and 'data' fields in the kernel dump (which show locations, not sizes, so aren't terribly useful) in favour of the endpoint number. Proc number is still visible. Some other dumps (e.g. dmap, rs) show endpoint numbers now too which got the formatting changed. PM reading segments using rw_seg() has changed - it uses other fields in the message now instead of encoding the segment and process number and fd in the fd field. For that it uses _read_pm() and _write_pm() which to _taskcall()s directly in pm/misc.c. PM now sys_exit()s itself on panic(), instead of sys_abort(). RS also talks in endpoints instead of process numbers.
2006-03-03 11:20:58 +01:00
/* Invalidate endpoint number for error and sanity checks. */
2012-02-13 16:28:04 +01:00
exiter->fp_endpoint = NONE;
2012-02-13 16:28:04 +01:00
/* If a session leader exits and it has a controlling tty, then revoke
2006-03-10 17:10:05 +01:00
* access to its controlling tty from all other processes using it.
2005-04-21 16:53:53 +02:00
*/
2012-02-13 16:28:04 +01:00
if ((exiter->fp_flags & FP_SESLDR) && exiter->fp_tty != 0) {
dev = exiter->fp_tty;
2006-03-10 17:10:05 +01:00
for (rfp = &fproc[0]; rfp < &fproc[NR_PROCS]; rfp++) {
if(rfp->fp_pid == PID_FREE) continue;
2006-03-10 17:10:05 +01:00
if (rfp->fp_tty == dev) rfp->fp_tty = 0;
2005-04-21 16:53:53 +02:00
2006-03-10 17:10:05 +01:00
for (i = 0; i < OPEN_MAX; i++) {
if ((rfilp = rfp->fp_filp[i]) == NULL) continue;
2005-04-21 16:53:53 +02:00
if (rfilp->filp_mode == FILP_CLOSED) continue;
vp = rfilp->filp_vno;
2012-04-25 14:44:42 +02:00
if (!S_ISCHR(vp->v_mode)) continue;
if ((dev_t) vp->v_sdev != dev) continue;
2012-02-13 16:28:04 +01:00
lock_filp(rfilp, VNODE_READ);
(void) dev_close(dev, rfilp-filp); /* Ignore any errors, even
* SUSPEND. */
2005-04-21 16:53:53 +02:00
rfilp->filp_mode = FILP_CLOSED;
2012-02-13 16:28:04 +01:00
unlock_filp(rfilp);
2006-03-10 17:10:05 +01:00
}
}
2005-04-21 16:53:53 +02:00
}
2006-03-10 17:10:05 +01:00
/* Exit done. Mark slot as free. */
2012-02-13 16:28:04 +01:00
exiter->fp_pid = PID_FREE;
if (exiter->fp_flags & FP_PENDING)
pending--; /* No longer pending job, not going to do it */
exiter->fp_flags = FP_NOFLAGS;
}
/*===========================================================================*
2006-05-11 16:57:23 +02:00
* pm_exit *
*===========================================================================*/
2012-03-25 20:25:53 +02:00
void pm_exit(proc)
2006-05-11 16:57:23 +02:00
int proc;
{
/* Perform the file system portion of the exit(status) system call. */
2012-02-13 16:28:04 +01:00
int exitee_p;
/* Nevertheless, pretend that the call came from the user. */
2006-05-11 16:57:23 +02:00
okendpt(proc, &exitee_p);
2012-02-13 16:28:04 +01:00
fp = &fproc[exitee_p];
free_proc(fp, FP_EXITING);
2005-04-21 16:53:53 +02:00
}
/*===========================================================================*
2006-05-11 16:57:23 +02:00
* pm_setgid *
2005-04-21 16:53:53 +02:00
*===========================================================================*/
2012-03-25 20:25:53 +02:00
void pm_setgid(proc_e, egid, rgid)
2006-05-11 16:57:23 +02:00
int proc_e;
int egid;
int rgid;
2005-04-21 16:53:53 +02:00
{
2006-05-11 16:57:23 +02:00
register struct fproc *tfp;
int slot;
okendpt(proc_e, &slot);
tfp = &fproc[slot];
tfp->fp_effgid = egid;
tfp->fp_realgid = rgid;
}
2005-04-21 16:53:53 +02:00
/*===========================================================================*
* pm_setgroups *
*===========================================================================*/
2012-03-25 20:25:53 +02:00
void pm_setgroups(proc_e, ngroups, groups)
int proc_e;
int ngroups;
gid_t *groups;
{
struct fproc *rfp;
int slot;
okendpt(proc_e, &slot);
rfp = &fproc[slot];
if (ngroups * sizeof(gid_t) > sizeof(rfp->fp_sgroups))
2012-02-13 16:28:04 +01:00
panic("VFS: pm_setgroups: too much data to copy");
if (sys_datacopy(who_e, (vir_bytes) groups, SELF, (vir_bytes) rfp->fp_sgroups,
ngroups * sizeof(gid_t)) == OK) {
rfp->fp_ngroups = ngroups;
} else
2012-02-13 16:28:04 +01:00
panic("VFS: pm_setgroups: datacopy failed");
}
2006-05-11 16:57:23 +02:00
/*===========================================================================*
* pm_setuid *
*===========================================================================*/
2012-03-25 20:25:53 +02:00
void pm_setuid(proc_e, euid, ruid)
2006-05-11 16:57:23 +02:00
int proc_e;
int euid;
int ruid;
{
2012-02-13 16:28:04 +01:00
struct fproc *tfp;
2006-05-11 16:57:23 +02:00
int slot;
2005-04-21 16:53:53 +02:00
2006-05-11 16:57:23 +02:00
okendpt(proc_e, &slot);
tfp = &fproc[slot];
2005-04-21 16:53:53 +02:00
2006-05-11 16:57:23 +02:00
tfp->fp_effuid = euid;
tfp->fp_realuid = ruid;
2005-04-21 16:53:53 +02:00
}
/*===========================================================================*
* do_svrctl *
*===========================================================================*/
2012-03-25 20:25:53 +02:00
int do_svrctl()
2005-04-21 16:53:53 +02:00
{
unsigned int svrctl;
2012-03-30 11:24:44 +02:00
vir_bytes ptr;
2012-03-30 11:24:44 +02:00
svrctl = job_m_in.svrctl_req;
ptr = (vir_bytes) job_m_in.svrctl_argp;
if (((svrctl >> 8) & 0xFF) != 'M') return(EINVAL);
switch (svrctl) {
2012-03-30 11:24:44 +02:00
case VFSSETPARAM:
case VFSGETPARAM:
{
struct sysgetenv sysgetenv;
char search_key[64];
char val[64];
int r, s;
/* Copy sysgetenv structure to VFS */
if (sys_datacopy(who_e, ptr, SELF, (vir_bytes) &sysgetenv,
sizeof(sysgetenv)) != OK)
return(EFAULT);
/* Basic sanity checking */
if (svrctl == VFSSETPARAM) {
if (sysgetenv.keylen <= 0 ||
sysgetenv.keylen > (sizeof(search_key) - 1) ||
sysgetenv.vallen <= 0 ||
sysgetenv.vallen >= sizeof(val)) {
return(EINVAL);
}
}
/* Copy parameter "key" */
if ((s = sys_datacopy(who_e, (vir_bytes) sysgetenv.key,
SELF, (vir_bytes) search_key,
sysgetenv.keylen)) != OK)
return(s);
search_key[sysgetenv.keylen] = '\0'; /* Limit string */
/* Is it a parameter we know? */
if (svrctl == VFSSETPARAM) {
if (!strcmp(search_key, "verbose")) {
int verbose_val;
if ((s = sys_datacopy(who_e,
(vir_bytes) sysgetenv.val, SELF,
(vir_bytes) &val, sysgetenv.vallen)) != OK)
return(s);
val[sysgetenv.vallen] = '\0'; /* Limit string */
verbose_val = atoi(val);
if (verbose_val < 0 || verbose_val > 4) {
return(EINVAL);
}
verbose = verbose_val;
r = OK;
} else {
r = ESRCH;
}
} else { /* VFSGETPARAM */
char small_buf[60];
r = ESRCH;
2012-03-30 11:24:44 +02:00
if (!strcmp(search_key, "print_traces")) {
mthread_stacktraces();
sysgetenv.val = 0;
sysgetenv.vallen = 0;
r = OK;
} else if (!strcmp(search_key, "active_threads")) {
int active = NR_WTHREADS - worker_available();
2012-07-13 18:08:06 +02:00
snprintf(small_buf, sizeof(small_buf) - 1,
"%d", active);
sysgetenv.vallen = strlen(small_buf);
r = OK;
2012-03-30 11:24:44 +02:00
}
if (r == OK) {
if ((s = sys_datacopy(SELF,
(vir_bytes) &sysgetenv, who_e, ptr,
sizeof(sysgetenv))) != OK)
return(s);
if (sysgetenv.val != 0) {
if ((s = sys_datacopy(SELF,
(vir_bytes) small_buf, who_e,
(vir_bytes) sysgetenv.val,
sysgetenv.vallen)) != OK)
return(s);
}
2012-03-30 11:24:44 +02:00
}
}
return(r);
}
2012-02-13 16:28:04 +01:00
default:
2005-04-21 16:53:53 +02:00
return(EINVAL);
}
}
2006-05-11 16:57:23 +02:00
/*===========================================================================*
* pm_dumpcore *
*===========================================================================*/
2012-03-25 20:25:53 +02:00
int pm_dumpcore(endpoint_t proc_e, int csig, vir_bytes exe_name)
2006-05-11 16:57:23 +02:00
{
int slot, r = OK, core_fd;
2012-02-13 16:28:04 +01:00
struct filp *f;
char core_path[PATH_MAX];
char proc_name[PROC_NAME_LEN];
2011-07-30 08:03:23 +02:00
2012-02-13 16:28:04 +01:00
okendpt(proc_e, &slot);
fp = &fproc[slot];
2011-07-30 08:03:23 +02:00
/* if a process is blocked, scratch(fp).file.fd_nr holds the fd it's blocked
* on. free it up for use by common_open().
*/
if (fp_is_blocked(fp))
unpause(fp->fp_endpoint);
2012-02-13 16:28:04 +01:00
/* open core file */
snprintf(core_path, PATH_MAX, "%s.%d", CORE_NAME, fp->fp_pid);
core_fd = common_open(core_path, O_WRONLY | O_CREAT | O_TRUNC, CORE_MODE);
if (core_fd < 0) { r = core_fd; goto core_exit; }
2011-07-30 08:03:23 +02:00
2012-02-13 16:28:04 +01:00
/* get process' name */
r = sys_datacopy(PM_PROC_NR, exe_name, VFS_PROC_NR, (vir_bytes) proc_name,
PROC_NAME_LEN);
if (r != OK) goto core_exit;
2012-02-13 16:28:04 +01:00
proc_name[PROC_NAME_LEN - 1] = '\0';
2011-07-30 08:03:23 +02:00
if ((f = get_filp(core_fd, VNODE_WRITE)) == NULL) { r=EBADF; goto core_exit; }
2012-02-13 16:28:04 +01:00
write_elf_core_file(f, csig, proc_name);
unlock_filp(f);
(void) close_fd(fp, core_fd); /* ignore failure, we're exiting anyway */
2011-07-30 08:03:23 +02:00
core_exit:
if(csig)
free_proc(fp, FP_EXITING);
return(r);
2006-05-11 16:57:23 +02:00
}
Driver refactory for live update and crash recovery. SYSLIB CHANGES: - DS calls to publish / retrieve labels consider endpoints instead of u32_t. VFS CHANGES: - mapdriver() only adds an entry in the dmap table in VFS. - dev_up() is only executed upon reception of a driver up event. INET CHANGES: - INET no longer searches for existing drivers instances at startup. - A newtwork driver is (re)initialized upon reception of a driver up event. - Networking startup is now race-free by design. No need to waste 5 seconds at startup any more. DRIVER CHANGES: - Every driver publishes driver up events when starting for the first time or in case of restart when recovery actions must be taken in the upper layers. - Driver up events are published by drivers through DS. - For regular drivers, VFS is normally the only subscriber, but not necessarily. For instance, when the filter driver is in use, it must subscribe to driver up events to initiate recovery. - For network drivers, inet is the only subscriber for now. - Every VFS driver is statically linked with libdriver, every network driver is statically linked with libnetdriver. DRIVER LIBRARIES CHANGES: - Libdriver is extended to provide generic receive() and ds_publish() interfaces for VFS drivers. - driver_receive() is a wrapper for sef_receive() also used in driver_task() to discard spurious messages that were meant to be delivered to a previous version of the driver. - driver_receive_mq() is the same as driver_receive() but integrates support for queued messages. - driver_announce() publishes a driver up event for VFS drivers and marks the driver as initialized and expecting a DEV_OPEN message. - Libnetdriver is introduced to provide similar receive() and ds_publish() interfaces for network drivers (netdriver_announce() and netdriver_receive()). - Network drivers all support live update with no state transfer now. KERNEL CHANGES: - Added kernel call statectl for state management. Used by driver_announce() to unblock eventual callers sendrecing to the driver.
2010-04-08 15:41:35 +02:00
/*===========================================================================*
* ds_event *
*===========================================================================*/
VFS: make all IPC asynchronous By decoupling synchronous drivers from VFS, we are a big step closer to supporting driver crashes under all circumstances. That is, VFS can't become stuck on IPC with a synchronous driver (e.g., INET) and can recover from crashing block drivers during open/close/ioctl or during communication with an FS. In order to maintain serialized communication with a synchronous driver, the communication is wrapped by a mutex on a per driver basis (not major numbers as there can be multiple majors with identical endpoints). Majors that share a driver endpoint point to a single mutex object. In order to support crashes from block drivers, the file reopen tactic had to be changed; first reopen files associated with the crashed driver, then send the new driver endpoint to FSes. This solves a deadlock between the FS and the block driver; - VFS would send REQ_NEW_DRIVER to an FS, but he FS only receives it after retrying the current request to the newly started driver. - The block driver would refuse the retried request until all files had been reopened. - VFS would reopen files only after getting a reply from the initial REQ_NEW_DRIVER. When a character special driver crashes, all associated files have to be marked invalid and closed (or reopened if flagged as such). However, they can only be closed if a thread holds exclusive access to it. To obtain exclusive access, the worker thread (which handles the new driver endpoint event from DS) schedules a new job to garbage collect invalid files. This way, we can signal the worker thread that was talking to the crashed driver and will release exclusive access to a file associated with the crashed driver and prevent the garbage collecting worker thread from dead locking on that file. Also, when a character special driver crashes, RS will unmap the driver and remap it upon restart. During unmapping, associated files are marked invalid instead of waiting for an endpoint up event from DS, as that event might come later than new read/write/select requests and thus cause confusion in the freshly started driver. When locking a filp, the usage counters are no longer checked. The usage counter can legally go down to zero during filp invalidation while there are locks pending. DS events are handled by a separate worker thread instead of the main thread as reopening files could lead to another crash and a stuck thread. An additional worker thread is then necessary to unlock it. Finally, with everything asynchronous a race condition in do_select surfaced. A select entry was only marked in use after succesfully sending initial select requests to drivers and having to wait. When multiple select() calls were handled there was opportunity that these entries were overwritten. This had as effect that some select results were ignored (and select() remained blocking instead if returning) or do_select tried to access filps that were not present (because thrown away by secondary select()). This bug manifested itself with sendrecs, but was very hard to reproduce. However, it became awfully easy to trigger with asynsends only.
2012-08-28 16:06:51 +02:00
void *
ds_event(void *arg)
Driver refactory for live update and crash recovery. SYSLIB CHANGES: - DS calls to publish / retrieve labels consider endpoints instead of u32_t. VFS CHANGES: - mapdriver() only adds an entry in the dmap table in VFS. - dev_up() is only executed upon reception of a driver up event. INET CHANGES: - INET no longer searches for existing drivers instances at startup. - A newtwork driver is (re)initialized upon reception of a driver up event. - Networking startup is now race-free by design. No need to waste 5 seconds at startup any more. DRIVER CHANGES: - Every driver publishes driver up events when starting for the first time or in case of restart when recovery actions must be taken in the upper layers. - Driver up events are published by drivers through DS. - For regular drivers, VFS is normally the only subscriber, but not necessarily. For instance, when the filter driver is in use, it must subscribe to driver up events to initiate recovery. - For network drivers, inet is the only subscriber for now. - Every VFS driver is statically linked with libdriver, every network driver is statically linked with libnetdriver. DRIVER LIBRARIES CHANGES: - Libdriver is extended to provide generic receive() and ds_publish() interfaces for VFS drivers. - driver_receive() is a wrapper for sef_receive() also used in driver_task() to discard spurious messages that were meant to be delivered to a previous version of the driver. - driver_receive_mq() is the same as driver_receive() but integrates support for queued messages. - driver_announce() publishes a driver up event for VFS drivers and marks the driver as initialized and expecting a DEV_OPEN message. - Libnetdriver is introduced to provide similar receive() and ds_publish() interfaces for network drivers (netdriver_announce() and netdriver_receive()). - Network drivers all support live update with no state transfer now. KERNEL CHANGES: - Added kernel call statectl for state management. Used by driver_announce() to unblock eventual callers sendrecing to the driver.
2010-04-08 15:41:35 +02:00
{
2012-02-13 16:28:04 +01:00
char key[DS_MAX_KEYLEN];
char *blkdrv_prefix = "drv.blk.";
char *chrdrv_prefix = "drv.chr.";
u32_t value;
int type, r, is_blk;
endpoint_t owner_endpoint;
VFS: make all IPC asynchronous By decoupling synchronous drivers from VFS, we are a big step closer to supporting driver crashes under all circumstances. That is, VFS can't become stuck on IPC with a synchronous driver (e.g., INET) and can recover from crashing block drivers during open/close/ioctl or during communication with an FS. In order to maintain serialized communication with a synchronous driver, the communication is wrapped by a mutex on a per driver basis (not major numbers as there can be multiple majors with identical endpoints). Majors that share a driver endpoint point to a single mutex object. In order to support crashes from block drivers, the file reopen tactic had to be changed; first reopen files associated with the crashed driver, then send the new driver endpoint to FSes. This solves a deadlock between the FS and the block driver; - VFS would send REQ_NEW_DRIVER to an FS, but he FS only receives it after retrying the current request to the newly started driver. - The block driver would refuse the retried request until all files had been reopened. - VFS would reopen files only after getting a reply from the initial REQ_NEW_DRIVER. When a character special driver crashes, all associated files have to be marked invalid and closed (or reopened if flagged as such). However, they can only be closed if a thread holds exclusive access to it. To obtain exclusive access, the worker thread (which handles the new driver endpoint event from DS) schedules a new job to garbage collect invalid files. This way, we can signal the worker thread that was talking to the crashed driver and will release exclusive access to a file associated with the crashed driver and prevent the garbage collecting worker thread from dead locking on that file. Also, when a character special driver crashes, RS will unmap the driver and remap it upon restart. During unmapping, associated files are marked invalid instead of waiting for an endpoint up event from DS, as that event might come later than new read/write/select requests and thus cause confusion in the freshly started driver. When locking a filp, the usage counters are no longer checked. The usage counter can legally go down to zero during filp invalidation while there are locks pending. DS events are handled by a separate worker thread instead of the main thread as reopening files could lead to another crash and a stuck thread. An additional worker thread is then necessary to unlock it. Finally, with everything asynchronous a race condition in do_select surfaced. A select entry was only marked in use after succesfully sending initial select requests to drivers and having to wait. When multiple select() calls were handled there was opportunity that these entries were overwritten. This had as effect that some select results were ignored (and select() remained blocking instead if returning) or do_select tried to access filps that were not present (because thrown away by secondary select()). This bug manifested itself with sendrecs, but was very hard to reproduce. However, it became awfully easy to trigger with asynsends only.
2012-08-28 16:06:51 +02:00
struct job my_job;
my_job = *((struct job *) arg);
fp = my_job.j_fp;
2012-02-13 16:28:04 +01:00
/* Get the event and the owner from DS. */
while ((r = ds_check(key, &type, &owner_endpoint)) == OK) {
Split block/character protocols and libdriver This patch separates the character and block driver communication protocols. The old character protocol remains the same, but a new block protocol is introduced. The libdriver library is replaced by two new libraries: libchardriver and libblockdriver. Their exposed API, and drivers that use them, have been updated accordingly. Together, libbdev and libblockdriver now completely abstract away the message format used by the block protocol. As the memory driver is both a character and a block device driver, it now implements its own message loop. The most important semantic change made to the block protocol is that it is no longer possible to return both partial results and an error for a single transfer. This simplifies the interaction between the caller and the driver, as the I/O vector no longer needs to be copied back. Also, drivers are now no longer supposed to decide based on the layout of the I/O vector when a transfer should be cut short. Put simply, transfers are now supposed to either succeed completely, or result in an error. After this patch, the state of the various pieces is as follows: - block protocol: stable - libbdev API: stable for synchronous communication - libblockdriver API: needs slight revision (the drvlib/partition API in particular; the threading API will also change shortly) - character protocol: needs cleanup - libchardriver API: needs cleanup accordingly - driver restarts: largely unsupported until endpoint changes are reintroduced As a side effect, this patch eliminates several bugs, hacks, and gcc -Wall and -W warnings all over the place. It probably introduces a few new ones, too. Update warning: this patch changes the protocol between MFS and disk drivers, so in order to use old/new images, the MFS from the ramdisk must be used to mount all file systems.
2011-11-22 13:27:53 +01:00
/* Only check for block and character driver up events. */
if (!strncmp(key, blkdrv_prefix, strlen(blkdrv_prefix))) {
is_blk = TRUE;
} else if (!strncmp(key, chrdrv_prefix, strlen(chrdrv_prefix))) {
is_blk = FALSE;
} else {
2012-02-13 16:28:04 +01:00
continue;
Split block/character protocols and libdriver This patch separates the character and block driver communication protocols. The old character protocol remains the same, but a new block protocol is introduced. The libdriver library is replaced by two new libraries: libchardriver and libblockdriver. Their exposed API, and drivers that use them, have been updated accordingly. Together, libbdev and libblockdriver now completely abstract away the message format used by the block protocol. As the memory driver is both a character and a block device driver, it now implements its own message loop. The most important semantic change made to the block protocol is that it is no longer possible to return both partial results and an error for a single transfer. This simplifies the interaction between the caller and the driver, as the I/O vector no longer needs to be copied back. Also, drivers are now no longer supposed to decide based on the layout of the I/O vector when a transfer should be cut short. Put simply, transfers are now supposed to either succeed completely, or result in an error. After this patch, the state of the various pieces is as follows: - block protocol: stable - libbdev API: stable for synchronous communication - libblockdriver API: needs slight revision (the drvlib/partition API in particular; the threading API will also change shortly) - character protocol: needs cleanup - libchardriver API: needs cleanup accordingly - driver restarts: largely unsupported until endpoint changes are reintroduced As a side effect, this patch eliminates several bugs, hacks, and gcc -Wall and -W warnings all over the place. It probably introduces a few new ones, too. Update warning: this patch changes the protocol between MFS and disk drivers, so in order to use old/new images, the MFS from the ramdisk must be used to mount all file systems.
2011-11-22 13:27:53 +01:00
}
2012-02-13 16:28:04 +01:00
if ((r = ds_retrieve_u32(key, &value)) != OK) {
printf("VFS: ds_event: ds_retrieve_u32 failed\n");
VFS: make all IPC asynchronous By decoupling synchronous drivers from VFS, we are a big step closer to supporting driver crashes under all circumstances. That is, VFS can't become stuck on IPC with a synchronous driver (e.g., INET) and can recover from crashing block drivers during open/close/ioctl or during communication with an FS. In order to maintain serialized communication with a synchronous driver, the communication is wrapped by a mutex on a per driver basis (not major numbers as there can be multiple majors with identical endpoints). Majors that share a driver endpoint point to a single mutex object. In order to support crashes from block drivers, the file reopen tactic had to be changed; first reopen files associated with the crashed driver, then send the new driver endpoint to FSes. This solves a deadlock between the FS and the block driver; - VFS would send REQ_NEW_DRIVER to an FS, but he FS only receives it after retrying the current request to the newly started driver. - The block driver would refuse the retried request until all files had been reopened. - VFS would reopen files only after getting a reply from the initial REQ_NEW_DRIVER. When a character special driver crashes, all associated files have to be marked invalid and closed (or reopened if flagged as such). However, they can only be closed if a thread holds exclusive access to it. To obtain exclusive access, the worker thread (which handles the new driver endpoint event from DS) schedules a new job to garbage collect invalid files. This way, we can signal the worker thread that was talking to the crashed driver and will release exclusive access to a file associated with the crashed driver and prevent the garbage collecting worker thread from dead locking on that file. Also, when a character special driver crashes, RS will unmap the driver and remap it upon restart. During unmapping, associated files are marked invalid instead of waiting for an endpoint up event from DS, as that event might come later than new read/write/select requests and thus cause confusion in the freshly started driver. When locking a filp, the usage counters are no longer checked. The usage counter can legally go down to zero during filp invalidation while there are locks pending. DS events are handled by a separate worker thread instead of the main thread as reopening files could lead to another crash and a stuck thread. An additional worker thread is then necessary to unlock it. Finally, with everything asynchronous a race condition in do_select surfaced. A select entry was only marked in use after succesfully sending initial select requests to drivers and having to wait. When multiple select() calls were handled there was opportunity that these entries were overwritten. This had as effect that some select results were ignored (and select() remained blocking instead if returning) or do_select tried to access filps that were not present (because thrown away by secondary select()). This bug manifested itself with sendrecs, but was very hard to reproduce. However, it became awfully easy to trigger with asynsends only.
2012-08-28 16:06:51 +02:00
break;
Driver refactory for live update and crash recovery. SYSLIB CHANGES: - DS calls to publish / retrieve labels consider endpoints instead of u32_t. VFS CHANGES: - mapdriver() only adds an entry in the dmap table in VFS. - dev_up() is only executed upon reception of a driver up event. INET CHANGES: - INET no longer searches for existing drivers instances at startup. - A newtwork driver is (re)initialized upon reception of a driver up event. - Networking startup is now race-free by design. No need to waste 5 seconds at startup any more. DRIVER CHANGES: - Every driver publishes driver up events when starting for the first time or in case of restart when recovery actions must be taken in the upper layers. - Driver up events are published by drivers through DS. - For regular drivers, VFS is normally the only subscriber, but not necessarily. For instance, when the filter driver is in use, it must subscribe to driver up events to initiate recovery. - For network drivers, inet is the only subscriber for now. - Every VFS driver is statically linked with libdriver, every network driver is statically linked with libnetdriver. DRIVER LIBRARIES CHANGES: - Libdriver is extended to provide generic receive() and ds_publish() interfaces for VFS drivers. - driver_receive() is a wrapper for sef_receive() also used in driver_task() to discard spurious messages that were meant to be delivered to a previous version of the driver. - driver_receive_mq() is the same as driver_receive() but integrates support for queued messages. - driver_announce() publishes a driver up event for VFS drivers and marks the driver as initialized and expecting a DEV_OPEN message. - Libnetdriver is introduced to provide similar receive() and ds_publish() interfaces for network drivers (netdriver_announce() and netdriver_receive()). - Network drivers all support live update with no state transfer now. KERNEL CHANGES: - Added kernel call statectl for state management. Used by driver_announce() to unblock eventual callers sendrecing to the driver.
2010-04-08 15:41:35 +02:00
}
2012-02-13 16:28:04 +01:00
if (value != DS_DRIVER_UP) continue;
2006-05-11 16:57:23 +02:00
Driver refactory for live update and crash recovery. SYSLIB CHANGES: - DS calls to publish / retrieve labels consider endpoints instead of u32_t. VFS CHANGES: - mapdriver() only adds an entry in the dmap table in VFS. - dev_up() is only executed upon reception of a driver up event. INET CHANGES: - INET no longer searches for existing drivers instances at startup. - A newtwork driver is (re)initialized upon reception of a driver up event. - Networking startup is now race-free by design. No need to waste 5 seconds at startup any more. DRIVER CHANGES: - Every driver publishes driver up events when starting for the first time or in case of restart when recovery actions must be taken in the upper layers. - Driver up events are published by drivers through DS. - For regular drivers, VFS is normally the only subscriber, but not necessarily. For instance, when the filter driver is in use, it must subscribe to driver up events to initiate recovery. - For network drivers, inet is the only subscriber for now. - Every VFS driver is statically linked with libdriver, every network driver is statically linked with libnetdriver. DRIVER LIBRARIES CHANGES: - Libdriver is extended to provide generic receive() and ds_publish() interfaces for VFS drivers. - driver_receive() is a wrapper for sef_receive() also used in driver_task() to discard spurious messages that were meant to be delivered to a previous version of the driver. - driver_receive_mq() is the same as driver_receive() but integrates support for queued messages. - driver_announce() publishes a driver up event for VFS drivers and marks the driver as initialized and expecting a DEV_OPEN message. - Libnetdriver is introduced to provide similar receive() and ds_publish() interfaces for network drivers (netdriver_announce() and netdriver_receive()). - Network drivers all support live update with no state transfer now. KERNEL CHANGES: - Added kernel call statectl for state management. Used by driver_announce() to unblock eventual callers sendrecing to the driver.
2010-04-08 15:41:35 +02:00
/* Perform up. */
Split block/character protocols and libdriver This patch separates the character and block driver communication protocols. The old character protocol remains the same, but a new block protocol is introduced. The libdriver library is replaced by two new libraries: libchardriver and libblockdriver. Their exposed API, and drivers that use them, have been updated accordingly. Together, libbdev and libblockdriver now completely abstract away the message format used by the block protocol. As the memory driver is both a character and a block device driver, it now implements its own message loop. The most important semantic change made to the block protocol is that it is no longer possible to return both partial results and an error for a single transfer. This simplifies the interaction between the caller and the driver, as the I/O vector no longer needs to be copied back. Also, drivers are now no longer supposed to decide based on the layout of the I/O vector when a transfer should be cut short. Put simply, transfers are now supposed to either succeed completely, or result in an error. After this patch, the state of the various pieces is as follows: - block protocol: stable - libbdev API: stable for synchronous communication - libblockdriver API: needs slight revision (the drvlib/partition API in particular; the threading API will also change shortly) - character protocol: needs cleanup - libchardriver API: needs cleanup accordingly - driver restarts: largely unsupported until endpoint changes are reintroduced As a side effect, this patch eliminates several bugs, hacks, and gcc -Wall and -W warnings all over the place. It probably introduces a few new ones, too. Update warning: this patch changes the protocol between MFS and disk drivers, so in order to use old/new images, the MFS from the ramdisk must be used to mount all file systems.
2011-11-22 13:27:53 +01:00
dmap_endpt_up(owner_endpoint, is_blk);
2012-02-13 16:28:04 +01:00
}
2006-05-11 16:57:23 +02:00
2012-02-13 16:28:04 +01:00
if (r != ENOENT) printf("VFS: ds_event: ds_check failed: %d\n", r);
VFS: make all IPC asynchronous By decoupling synchronous drivers from VFS, we are a big step closer to supporting driver crashes under all circumstances. That is, VFS can't become stuck on IPC with a synchronous driver (e.g., INET) and can recover from crashing block drivers during open/close/ioctl or during communication with an FS. In order to maintain serialized communication with a synchronous driver, the communication is wrapped by a mutex on a per driver basis (not major numbers as there can be multiple majors with identical endpoints). Majors that share a driver endpoint point to a single mutex object. In order to support crashes from block drivers, the file reopen tactic had to be changed; first reopen files associated with the crashed driver, then send the new driver endpoint to FSes. This solves a deadlock between the FS and the block driver; - VFS would send REQ_NEW_DRIVER to an FS, but he FS only receives it after retrying the current request to the newly started driver. - The block driver would refuse the retried request until all files had been reopened. - VFS would reopen files only after getting a reply from the initial REQ_NEW_DRIVER. When a character special driver crashes, all associated files have to be marked invalid and closed (or reopened if flagged as such). However, they can only be closed if a thread holds exclusive access to it. To obtain exclusive access, the worker thread (which handles the new driver endpoint event from DS) schedules a new job to garbage collect invalid files. This way, we can signal the worker thread that was talking to the crashed driver and will release exclusive access to a file associated with the crashed driver and prevent the garbage collecting worker thread from dead locking on that file. Also, when a character special driver crashes, RS will unmap the driver and remap it upon restart. During unmapping, associated files are marked invalid instead of waiting for an endpoint up event from DS, as that event might come later than new read/write/select requests and thus cause confusion in the freshly started driver. When locking a filp, the usage counters are no longer checked. The usage counter can legally go down to zero during filp invalidation while there are locks pending. DS events are handled by a separate worker thread instead of the main thread as reopening files could lead to another crash and a stuck thread. An additional worker thread is then necessary to unlock it. Finally, with everything asynchronous a race condition in do_select surfaced. A select entry was only marked in use after succesfully sending initial select requests to drivers and having to wait. When multiple select() calls were handled there was opportunity that these entries were overwritten. This had as effect that some select results were ignored (and select() remained blocking instead if returning) or do_select tried to access filps that were not present (because thrown away by secondary select()). This bug manifested itself with sendrecs, but was very hard to reproduce. However, it became awfully easy to trigger with asynsends only.
2012-08-28 16:06:51 +02:00
thread_cleanup(NULL);
return(NULL);
2012-02-13 16:28:04 +01:00
}