summaryrefslogtreecommitdiff
path: root/sys/kern/syscalls.master
AgeCommit message (Collapse)Author
2022-10-25mplement waitid(2) which is now part of POSIX and used by mozilla.Mark Kettenis
This includes a change of siginfo_r which is technically an ABI break but this should have no real-world impact since the members involved are never touched by the kernel. ok millert@, deraadt@
2022-10-07Add mimmutable(2) system call which locks the permissions (PROT_*) ofTheo de Raadt
memory mappings so they cannot be changed by a later mmap(), mprotect(), or munmap(), which will error with EPERM instead. ok kettenis
2022-09-03Make recvmmsg and sendmmsg look more alike. change the flag typeMoritz Buhl
to int like other flag parameters, NetBSD uses unsigned int, FreeBSD and Linux do int. OK bluhm@
2022-09-03add the sendmmsg syscall that allows sending multiple msghdrs atMoritz Buhl
once. libc, man page, and regress parts to come. With input from jca@, bluhm@. OK bluhm@
2022-09-02add the recvmmsg syscall that allows receiving multiple msghdrs atMoritz Buhl
once. libc, man page, and regress parts to come. With input from jca@, guenther@, bluhm@. OK bluhm@
2022-08-01some ports bootstraps, and go internals, need a bit more time to adaptTheo de Raadt
to the padded syscalls going away.
2022-07-20the _pad_ system calls from 2021/12/23 can go awayTheo de Raadt
ok guenther
2022-07-15pledge "getpw" would notice access to /var/run/ypbind.lock, and grant "inet"Theo de Raadt
rights, so that libc/yp could access YP services via a fairly complex 'protocol' including file access, sockets, etc. This YP protocol is also used by ypldap -- this is our way of bringing 'NIS' services into libc without monster sub-libraries. I have managed to remove this "inet" right by creating a new ypconnect() system call, which performs parts of the yp_bind.c dance inside the kernel.. It checks if domainname is set, looks for a binding file with advisory lock, reads it to get the IP and udp/tcp port numbers, and then establishes a connnected socket direct to that ypserv. This socket has a SS_YP flag set, and non-required system calls are prohibited. libc maintains lifetime on this socket so a process should never see it, but it seems safer to block udp re-connect and other calls even in non-pledge mode. Userland changes to use this will follow in a few days. Lots of help from claudio and jmatthew, also ok miod
2022-06-29Unlock the pledge(2) system callJeremie Courreges-Anglas
Protect the ps_pledge/ps_execpledge fields with ps_mtx. Shuffle the code to call unveil_destroy() outside the critical section. Only writes to those fields are protected. Since we may only remove bits from those fields, garbage values should do no harm even when a read crosses a write on 32 bits systems. Input claudio@ kettenis@ deraadt@, ok deraadt@
2022-06-27kbind(2): unlock syscall, push kernel lock down to binding loopScott Soule Cheloha
- Rearrange the security check code in sys_kbind() so that we only need to take the kernel lock once if we need to raise SIGILL. - Protect process.ps_kbind_addr and process.ps_kbind_cookie with process.ps_mtx. This is easier to do after the aforementioned rearrangement. Under normal circumstances this isn't necessary: the process is single-threaded when we initialize kbind(2). But in stranger situations this brief mutex ensures that the first thread to reach sys_kbind() initializes both variables. - Wrap the binding loop with the kernel lock. We need to carefully confirm that uvm_unmap_remove(), uvm_map_extract(), and uvm_unmap_detach() are MP-safe in a subsequent patch before completely removing the kernel lock from sys_kbind(). - Remove the kernel lock from kbind(2) in syscalls.master. Prompted by mpi@, dlg@, and deraadt@. Current patch workshopped with deraadt@. Based on a patch from dlg@. With input from dlg@, bluhm@, mpi@, kettenis@, deraadt@, and guenther@. Thread: https://marc.info/?l=openbsd-tech&m=165274831829349&w=2 ok deraadt@ kettenis@ mpi@
2022-05-16Unlock umask(2). sys_umask() only modifies `fd_cmask', whichVitaliy Makkoveev
modification is already protected by `fd_lock' rwlock(9). ok bluhm@
2022-02-24Unlock getsockname(2) syscall. For inet and UNIX sockets it fills passedVitaliy Makkoveev
'sockaddr' structure with socket's address. For key management and route domain sockets it just returns error. ok bluhm@
2022-01-11Unlock getpeername(2). For inet and unix sockets it follows the codeVitaliy Makkoveev
which was unlocked with accept(2) unlocking. For key management and route domain sockets it just copies the read-only data. ok bluhm@
2021-12-23Roll the syscalls that have an off_t argument to remove the explicit padding.Philip Guenther
Switch libc and ld.so to the generic stubs for these calls. WARNING: reboot to updated kernel before installing libc or ld.so! Time for a story... When gcc (back in 1.x days) first implemented long long, it didn't (always) pass 64bit arguments in 'aligned' registers/stack slots, with the result that argument offsets didn't match structure offsets. This affected the nine system calls that pass off_t arguments: ftruncate lseek mmap mquery pread preadv pwrite pwritev truncate To avoid having to do custom ASM wrappers for those, BSD put an explicit pad argument in so that the off_t argument would always start on a even slot and thus be naturally aligned. Thus those odd wrappers in lib/libc/sys/ that use __syscall() and pass an extra '0' argument. The ABIs for different CPUs eventually settled how things should be passed on each and gcc 2.x followed them. The only arch now where it helps is landisk, which needs to skip the last argument register if it would be the first half of a 64bit argument. So: add new syscalls without the pad argument and on landisk do that skipping directly in the syscall handler in the kernel. Keep compat support for the existing syscalls long enough for the transition. ok deraadt@
2021-11-29Unlock accept(2) and accept4(2) syscalls. Unlock them both because theyVitaliy Makkoveev
follow the same code path. ok bluhm@
2021-10-27Unlock the kevent(2) system call.Visa Hankala
Tested by mpi@ and tb@ OK mpi@
2021-06-04Unlock connect(2). Again.mvs
ok mpi@
2021-06-02Unlock setrtable(2). Local copy of `ps_rtableid' used to make checksmvs
consistent. ok mpi@
2021-05-12Revert unlock of connect(2), bind(2), listen(2) and shutdown(2).Martin Pieuchot
At least one of them cause a deadlock involving `unplock' and mbuf allocations ('mbufpl') as reported by millert@.
2021-05-11Unlock shutdown(2).mvs
ok mpi@
2021-05-11Unlock listen(2).mvs
ok mpi@
2021-05-11Unlock connect(2).mvs
ok mpi@
2021-05-11Unlock bind(2).mvs
ok mpi@
2021-05-06Unlock lseek(2).anton
In August 2019 I tried to unlock lseek which failed since the vnode lock could not be acquired without holding the kernel lock back then. claudio@ recently made it possible to acquire a vnode lock without holding the kernel lock. The kernel lock is still required around VOP_GETATTR() as the underlying file system implementations are not MP-safe. ok claudio@
2021-05-04getitimer(2), setitimer(2): unlock syscallscheloha
With the changes in kern_time.c v1.150, neither getitimer(2) nor setitimer(2) need the kernel lock anymore. ok anton@, mpi@
2021-03-18Unlock sendsyslog(2). Console output still requires kernel lock to bemvs
held but this path is only followed while `syslogf' socket is not set. New `syslogf_rwlock' used to protect `syslogf' access. ok bluhm@
2021-01-18Unlock getppid(2).mvs
ok mpi@
2020-03-18Unlock flock(2).anton
ok mpi@ visa@
2020-03-10Unlock fcntl(2).anton
ok visa@
2020-02-22Unlock ioctl(2).anton
ok kettenis@ mpi@ visa@
2020-01-30Unlock close*(2) and dup*(2).Visa Hankala
Tested by krw@, anton@ OK mpi@, anton@
2020-01-26add a new __tmpfd system call that creates a new unnamed file in /tmp.Ted Unangst
intended for shm/fd passing, but for programs that may otherwise like filesystem access. ok beck deraadt kettenis
2020-01-21Make __thrsleep(2) and __thrwakeup(2) MP-safeVisa Hankala
Threads in __thrsleep(2) are tracked using queues, one queue per each process for synchronization between threads of a process, and one system-wide queue for the special ident -1 handling. Each of these queues has an associated rwlock that serializes access. The queue lock is released when calling copyin() and copyout() in thrsleep(). This preserves the existing behaviour where a blocked copy operation does not prevent other threads from making progress. Tested by anton@, claudio@ OK anton@, claudio@, tedu@, mpi@
2020-01-13Unlock a tiny part of the kqueue subsystem: kqueue(2).Visa Hankala
Tested by and OK anton@ OK mpi@, kettenis@
2020-01-02Unlock pipe(2) and pipe2(2). The kernel lock does not provide anyanton
serialization at this point since everything is protected by the pipe_lock. Thanks to tb@ and visa@ for testing; ok mpi@ visa@
2019-12-24Unlock nanosleep(2).Visa Hankala
OK cheloha@, anton@, mpi@
2019-11-27Add dummy msyscall(2) system call which is currently a noop. This willTheo de Raadt
be used by kernel and ld.so in the near future. Adding the system call earlier will reduce the number of people who try to build through and encounter agony. ok kettenis guenther
2019-08-13Revert unlock of lseek(2) since vn_lock() could end up calling tsleep()anton
which is not allowed without holding the kernel lock. Otherwise, wakeups could be lost. Reported-by: syzbot+57588681ca9e3e9ba926@syzkaller.appspotmail.com
2019-08-12Unlock lseek(2) since the file offset is MP-safe by now. Callinganton
VOP_GETATTR() must still be serialized using the kernel lock since the underlying file system implementation is not MP-safe. no objection from deraadt@ and ok mpi@ visa@
2019-07-09backout the unlock of pipe(2) and pipe2(2)Sebastien Marie
assert "cpipe->pipe_buffer.cnt == 0" occured whereas it shouldn't. Reported-by: syzbot+b559fa9d3292c3cb0343@syzkaller.appspotmail.com
2019-07-09unlock pipe(2) and pipe2(2) syscallsSebastien Marie
initial work from mpi@ ok visa@ mpi@
2019-06-24Unlock getrlimit(2) and setrlimit(2).Visa Hankala
OK semarie@ mpi@ deraadt@ anton@
2019-06-22push the KERNEL_LOCK deeper on read(2) and write(2)Sebastien Marie
unlocks read(2) and write(2) syscalls families, and push the KERNEL_LOCK deeper in the code path. KERNEL_LOCK is managed per file type in fileops handlers (fo_read, fo_write, and fo_close). read(2) and write(2) on socket are KERNEL_LOCK-free. initial work from mpi@ and ians@ ok mpi@ kettenis@ visa@ ians@
2019-05-13Add a kernel implementation of realpath() as __realpath().Bob Beck
We want this so that we can stop allowing readlink() on traversed vnodes in unveil(). This includes all the kernel side and the system call. This is not yet used in libc for realpath, so nothing calls this yet. The libc wrapper will be committed later. Testing by many, and ports build by naddy@ ok deraadt@
2019-05-09Unlock adjfreq(2), adjtime(2), clock_settime(2), and settimeofday(2).cheloha
clock_settime(2)/settimeofday(2) still need KERNEL_LOCK for a moment when resetting the RTC, as that's done periodically from a task under KERNEL_LOCK. Not quite sure how to approach that one yet. ok visa@ mpi@, "good stuff" tedu@, "please wait until after [tree] unlock" deraadt@
2019-01-11mincore() is a relic from the past, exposing physical machine informationTheo de Raadt
about shared resources which no program should see. only a few pieces of software use it, generally poorly thought out. they are being fixed, so mincore() can be deleted. ok guenther tedu jca sthen, others
2018-07-30Unlock sendmsg(2), sendto(2), recvfrom(2) and recvmsg(2).Martin Pieuchot
ok kettenis@, sthen@, deraadt@, visa@, krw@
2018-07-30rename 2nd argument of unveil from vague "flags" to "permissions";Theo de Raadt
man page change will follow
2018-07-13Unveiling unveil(2).Bob Beck
This brings unveil into the tree, disabled by default - Currently this will return EPERM on all attempts to use it until we are fully certain it is ready for people to start using, but this now allows for others to do more tweaking and experimentation. Still needs to send the unveil's across forks and execs before fully enabling. Many thanks to robert@ and deraadt@ for extensive testing. ok deraadt@
2018-07-05Put back sendto(2) and sendmsg(2) under KERNEL_LOCK().Martin Pieuchot
malloc(9) is apparently not mpsafe as found the hardway by sthen@.
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-04 15:26:34 +0000