1 /*
2 *
3 * Copyright (c) 2000-2024 Apple Inc. All rights reserved.
4 *
5 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
6 *
7 * This file contains Original Code and/or Modifications of Original Code
8 * as defined in and that are subject to the Apple Public Source License
9 * Version 2.0 (the 'License'). You may not use this file except in
10 * compliance with the License. The rights granted to you under the License
11 * may not be used to create, or enable the creation or redistribution of,
12 * unlawful or unlicensed copies of an Apple operating system, or to
13 * circumvent, violate, or enable the circumvention or violation of, any
14 * terms of an Apple operating system software license agreement.
15 *
16 * Please obtain a copy of the License at
17 * http://www.opensource.apple.com/apsl/ and read it before using this file.
18 *
19 * The Original Code and all software distributed under the License are
20 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
21 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
22 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
23 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
24 * Please see the License for the specific language governing rights and
25 * limitations under the License.
26 *
27 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
28 */
29 /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */
30 /*
31 * Copyright (c) 1989, 1993
32 * The Regents of the University of California. All rights reserved.
33 * (c) UNIX System Laboratories, Inc.
34 * All or some portions of this file are derived from material licensed
35 * to the University of California by American Telephone and Telegraph
36 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
37 * the permission of UNIX System Laboratories, Inc.
38 *
39 * Redistribution and use in source and binary forms, with or without
40 * modification, are permitted provided that the following conditions
41 * are met:
42 * 1. Redistributions of source code must retain the above copyright
43 * notice, this list of conditions and the following disclaimer.
44 * 2. Redistributions in binary form must reproduce the above copyright
45 * notice, this list of conditions and the following disclaimer in the
46 * documentation and/or other materials provided with the distribution.
47 * 3. All advertising materials mentioning features or use of this software
48 * must display the following acknowledgement:
49 * This product includes software developed by the University of
50 * California, Berkeley and its contributors.
51 * 4. Neither the name of the University nor the names of its contributors
52 * may be used to endorse or promote products derived from this software
53 * without specific prior written permission.
54 *
55 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
56 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
57 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
58 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
59 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
60 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
61 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
62 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
63 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
64 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
65 * SUCH DAMAGE.
66 *
67 * @(#)vfs_subr.c 8.31 (Berkeley) 5/26/95
68 */
69 /*
70 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
71 * support for mandatory and extensible security protections. This notice
72 * is included in support of clause 2.2 (b) of the Apple Public License,
73 * Version 2.0.
74 */
75
76 /*
77 * External virtual filesystem routines
78 */
79
80 #include <sys/param.h>
81 #include <sys/systm.h>
82 #include <sys/proc_internal.h>
83 #include <sys/kauth.h>
84 #include <sys/mount_internal.h>
85 #include <sys/time.h>
86 #include <sys/lock.h>
87 #include <sys/vnode.h>
88 #include <sys/vnode_internal.h>
89 #include <sys/stat.h>
90 #include <sys/namei.h>
91 #include <sys/ucred.h>
92 #include <sys/buf_internal.h>
93 #include <sys/errno.h>
94 #include <kern/kalloc.h>
95 #include <sys/uio_internal.h>
96 #include <sys/uio.h>
97 #include <sys/domain.h>
98 #include <sys/mbuf.h>
99 #include <sys/syslog.h>
100 #include <sys/ubc_internal.h>
101 #include <sys/vm.h>
102 #include <sys/sysctl.h>
103 #include <sys/filedesc.h>
104 #include <sys/fcntl.h>
105 #include <sys/event.h>
106 #include <sys/kdebug.h>
107 #include <sys/kauth.h>
108 #include <sys/user.h>
109 #include <sys/systm.h>
110 #include <sys/kern_memorystatus_xnu.h>
111 #include <sys/lockf.h>
112 #include <sys/reboot.h>
113 #include <miscfs/fifofs/fifo.h>
114
115 #include <nfs/nfs.h>
116
117 #include <string.h>
118 #include <machine/machine_routines.h>
119
120 #include <kern/assert.h>
121 #include <mach/kern_return.h>
122 #include <kern/thread.h>
123 #include <kern/sched_prim.h>
124 #include <kern/smr.h>
125
126 #include <miscfs/specfs/specdev.h>
127
128 #include <mach/mach_types.h>
129 #include <mach/memory_object_types.h>
130 #include <mach/memory_object_control.h>
131
132 #include <kern/kalloc.h> /* kalloc()/kfree() */
133 #include <kern/clock.h> /* delay_for_interval() */
134 #include <libkern/coreanalytics/coreanalytics.h>
135 #include <libkern/OSAtomic.h> /* OSAddAtomic() */
136 #include <os/atomic_private.h>
137 #if defined(XNU_TARGET_OS_OSX)
138 #include <console/video_console.h>
139 #endif
140
141 #ifdef CONFIG_IOCOUNT_TRACE
142 #include <libkern/OSDebug.h>
143 #endif
144
145 #include <vm/vm_protos.h> /* vnode_pager_vrele() */
146 #include <vm/vm_ubc.h>
147 #include <vm/memory_object_xnu.h>
148
149 #if CONFIG_MACF
150 #include <security/mac_framework.h>
151 #endif
152
153 #include <vfs/vfs_disk_conditioner.h>
154 #include <libkern/section_keywords.h>
155
156 static LCK_GRP_DECLARE(vnode_lck_grp, "vnode");
157 static LCK_ATTR_DECLARE(vnode_lck_attr, 0, 0);
158
159 #if CONFIG_TRIGGERS
160 static LCK_GRP_DECLARE(trigger_vnode_lck_grp, "trigger_vnode");
161 static LCK_ATTR_DECLARE(trigger_vnode_lck_attr, 0, 0);
162 #endif
163
164 extern lck_mtx_t mnt_list_mtx_lock;
165
166 static KALLOC_TYPE_DEFINE(specinfo_zone, struct specinfo, KT_DEFAULT);
167
168 ZONE_DEFINE(vnode_zone, "vnodes",
169 sizeof(struct vnode), ZC_NOGC | ZC_ZFREE_CLEARMEM);
170
171 enum vtype iftovt_tab[16] = {
172 VNON, VFIFO, VCHR, VNON, VDIR, VNON, VBLK, VNON,
173 VREG, VNON, VLNK, VNON, VSOCK, VNON, VNON, VBAD,
174 };
175 int vttoif_tab[9] = {
176 0, S_IFREG, S_IFDIR, S_IFBLK, S_IFCHR, S_IFLNK,
177 S_IFSOCK, S_IFIFO, S_IFMT,
178 };
179
180 extern int paniclog_append_noflush(const char *format, ...);
181
182 /* XXX next prototytype should be from libsa/stdlib.h> but conflicts libkern */
183 __private_extern__ void qsort(
184 void * array,
185 size_t nmembers,
186 size_t member_size,
187 int (*)(const void *, const void *));
188
189 __private_extern__ void vntblinit(void);
190 __private_extern__ int unlink1(vfs_context_t, vnode_t, user_addr_t,
191 enum uio_seg, int);
192
193 static void vnode_list_add(vnode_t);
194 static void vnode_async_list_add(vnode_t);
195 static void vnode_list_remove(vnode_t);
196 static void vnode_list_remove_locked(vnode_t);
197
198 static void vnode_abort_advlocks(vnode_t);
199 static errno_t vnode_drain(vnode_t);
200 static void vgone(vnode_t, int flags);
201 static void vclean(vnode_t vp, int flag);
202 static void vnode_reclaim_internal(vnode_t, int, int, int);
203
204 static void vnode_dropiocount(vnode_t);
205
206 static vnode_t checkalias(vnode_t vp, dev_t nvp_rdev);
207 static int vnode_reload(vnode_t);
208
209 static int unmount_callback(mount_t, __unused void *);
210
211 static void insmntque(vnode_t vp, mount_t mp);
212 static int mount_getvfscnt(void);
213 static int mount_fillfsids(fsid_t *, int );
214 static void vnode_iterate_setup(mount_t);
215 int vnode_umount_preflight(mount_t, vnode_t, int);
216 static int vnode_iterate_prepare(mount_t);
217 static int vnode_iterate_reloadq(mount_t);
218 static void vnode_iterate_clear(mount_t);
219 static mount_t vfs_getvfs_locked(fsid_t *);
220 static int vn_create_reg(vnode_t dvp, vnode_t *vpp, struct nameidata *ndp,
221 struct vnode_attr *vap, uint32_t flags, int fmode, uint32_t *statusp, vfs_context_t ctx);
222 static int vnode_authattr_new_internal(vnode_t dvp, struct vnode_attr *vap, int noauth, uint32_t *defaulted_fieldsp, vfs_context_t ctx);
223
224 errno_t rmdir_remove_orphaned_appleDouble(vnode_t, vfs_context_t, int *);
225
226 #ifdef CONFIG_IOCOUNT_TRACE
227 static void record_vp(vnode_t vp, int count);
228 static TUNABLE(int, bootarg_vnode_iocount_trace, "vnode_iocount_trace", 0);
229 static TUNABLE(int, bootarg_uthread_iocount_trace, "uthread_iocount_trace", 0);
230 #endif /* CONFIG_IOCOUNT_TRACE */
231
232 #if CONFIG_JETSAM && (DEVELOPMENT || DEBUG)
233 static TUNABLE(bool, bootarg_no_vnode_jetsam, "-no_vnode_jetsam", false);
234 #endif /* CONFIG_JETSAM && (DEVELOPMENT || DEBUG) */
235
236 static TUNABLE(bool, bootarg_no_vnode_drain, "-no_vnode_drain", false);
237
238 __options_decl(freeable_vnode_level_t, uint32_t, {
239 DEALLOC_VNODE_NONE = 0,
240 DEALLOC_VNODE_ONLY_OVERFLOW = 1,
241 DEALLOC_VNODE_ALL = 2
242 });
243
244 #if XNU_TARGET_OS_OSX
245 static TUNABLE(freeable_vnode_level_t, bootarg_vn_dealloc_level, "vn_dealloc_level", DEALLOC_VNODE_NONE);
246 #else
247 static TUNABLE(freeable_vnode_level_t, bootarg_vn_dealloc_level, "vn_dealloc_level", DEALLOC_VNODE_ONLY_OVERFLOW);
248 #endif /* CONFIG_VNDEALLOC */
249
250 static freeable_vnode_level_t vn_dealloc_level = DEALLOC_VNODE_NONE;
251
252 boolean_t root_is_CF_drive = FALSE;
253
254 #if CONFIG_TRIGGERS
255 static int vnode_resolver_create(mount_t, vnode_t, struct vnode_trigger_param *, boolean_t external);
256 static void vnode_resolver_detach(vnode_t);
257 #endif
258
259 TAILQ_HEAD(freelst, vnode) vnode_free_list; /* vnode free list */
260 TAILQ_HEAD(deadlst, vnode) vnode_dead_list; /* vnode dead list */
261 TAILQ_HEAD(async_work_lst, vnode) vnode_async_work_list;
262
263
264 TAILQ_HEAD(ragelst, vnode) vnode_rage_list; /* vnode rapid age list */
265 struct timeval rage_tv;
266 int rage_limit = 0;
267 int ragevnodes = 0;
268
269 long reusablevnodes_max = LONG_MAX;
270 long reusablevnodes = 0;
271 int deadvnodes_low = 0;
272 int deadvnodes_high = 0;
273 int numvnodes_min = 0;
274 int numvnodes_max = 0;
275
276 uint64_t newvnode = 0;
277 unsigned long newvnode_nodead = 0;
278
279 static int vfs_unmountall_started = 0;
280 static int vfs_unmountall_finished = 0;
281 static uint64_t vfs_shutdown_last_completion_time;
282
283 #define RAGE_LIMIT_MIN 100
284 #define RAGE_TIME_LIMIT 5
285
286 VFS_SMR_DECLARE;
287 extern uint32_t nc_smr_enabled;
288
289 /*
290 * ROSV definitions
291 * NOTE: These are shadowed from PlatformSupport definitions, but XNU
292 * builds standalone.
293 */
294 #define PLATFORM_DATA_VOLUME_MOUNT_POINT "/System/Volumes/Data"
295
296 /*
297 * These could be in PlatformSupport but aren't yet
298 */
299 #define PLATFORM_PREBOOT_VOLUME_MOUNT_POINT "/System/Volumes/Preboot"
300 #define PLATFORM_RECOVERY_VOLUME_MOUNT_POINT "/System/Volumes/Recovery"
301
302 #if CONFIG_MOUNT_VM
303 #define PLATFORM_VM_VOLUME_MOUNT_POINT "/System/Volumes/VM"
304 #endif
305
306 struct mntlist mountlist; /* mounted filesystem list */
307 static int nummounts = 0;
308
309 static int print_busy_vnodes = 0; /* print out busy vnodes */
310
311 #if DIAGNOSTIC
312 #define VLISTCHECK(fun, vp, list) \
313 if ((vp)->v_freelist.tqe_prev == (struct vnode **)0xdeadb) \
314 panic("%s: %s vnode not on %slist", (fun), (list), (list));
315 #else
316 #define VLISTCHECK(fun, vp, list)
317 #endif /* DIAGNOSTIC */
318
319 #define VLISTNONE(vp) \
320 do { \
321 (vp)->v_freelist.tqe_next = (struct vnode *)0; \
322 (vp)->v_freelist.tqe_prev = (struct vnode **)0xdeadb; \
323 } while(0)
324
325 #define VONLIST(vp) \
326 ((vp)->v_freelist.tqe_prev != (struct vnode **)0xdeadb)
327
328 /* remove a vnode from free vnode list */
329 #define VREMFREE(fun, vp) \
330 do { \
331 VLISTCHECK((fun), (vp), "free"); \
332 TAILQ_REMOVE(&vnode_free_list, (vp), v_freelist); \
333 VLISTNONE((vp)); \
334 freevnodes--; \
335 reusablevnodes--; \
336 } while(0)
337
338
339 /* remove a vnode from dead vnode list */
340 #define VREMDEAD(fun, vp) \
341 do { \
342 VLISTCHECK((fun), (vp), "dead"); \
343 TAILQ_REMOVE(&vnode_dead_list, (vp), v_freelist); \
344 VLISTNONE((vp)); \
345 vp->v_listflag &= ~VLIST_DEAD; \
346 deadvnodes--; \
347 if (vp->v_listflag & VLIST_NO_REUSE) { \
348 deadvnodes_noreuse--; \
349 } \
350 } while(0)
351
352
353 /* remove a vnode from async work vnode list */
354 #define VREMASYNC_WORK(fun, vp) \
355 do { \
356 VLISTCHECK((fun), (vp), "async_work"); \
357 TAILQ_REMOVE(&vnode_async_work_list, (vp), v_freelist); \
358 VLISTNONE((vp)); \
359 vp->v_listflag &= ~VLIST_ASYNC_WORK; \
360 async_work_vnodes--; \
361 if (!(vp->v_listflag & VLIST_NO_REUSE)) { \
362 reusablevnodes--; \
363 } \
364 } while(0)
365
366
367 /* remove a vnode from rage vnode list */
368 #define VREMRAGE(fun, vp) \
369 do { \
370 if ( !(vp->v_listflag & VLIST_RAGE)) \
371 panic("VREMRAGE: vp not on rage list"); \
372 VLISTCHECK((fun), (vp), "rage"); \
373 TAILQ_REMOVE(&vnode_rage_list, (vp), v_freelist); \
374 VLISTNONE((vp)); \
375 vp->v_listflag &= ~VLIST_RAGE; \
376 ragevnodes--; \
377 reusablevnodes--; \
378 } while(0)
379
380 static void async_work_continue(void);
381 static void vn_laundry_continue(void);
382 static void wakeup_laundry_thread(void);
383 static void vnode_smr_free(void *, size_t);
384
385 CA_EVENT(freeable_vnodes,
386 CA_INT, numvnodes_min,
387 CA_INT, numvnodes_max,
388 CA_INT, desiredvnodes,
389 CA_INT, numvnodes,
390 CA_INT, freevnodes,
391 CA_INT, deadvnodes,
392 CA_INT, freeablevnodes,
393 CA_INT, busyvnodes,
394 CA_BOOL, threshold_crossed);
395 static CA_EVENT_TYPE(freeable_vnodes) freeable_vnodes_telemetry;
396
397 static bool freeablevnodes_threshold_crossed = false;
398
399 /*
400 * Initialize the vnode management data structures.
401 */
402 __private_extern__ void
vntblinit(void)403 vntblinit(void)
404 {
405 thread_t thread = THREAD_NULL;
406 int desiredvnodes_one_percent = desiredvnodes / 100;
407
408 TAILQ_INIT(&vnode_free_list);
409 TAILQ_INIT(&vnode_rage_list);
410 TAILQ_INIT(&vnode_dead_list);
411 TAILQ_INIT(&vnode_async_work_list);
412 TAILQ_INIT(&mountlist);
413
414 microuptime(&rage_tv);
415 rage_limit = desiredvnodes_one_percent;
416 if (rage_limit < RAGE_LIMIT_MIN) {
417 rage_limit = RAGE_LIMIT_MIN;
418 }
419
420 deadvnodes_low = desiredvnodes_one_percent;
421 if (deadvnodes_low > 300) {
422 deadvnodes_low = 300;
423 }
424 deadvnodes_high = deadvnodes_low * 2;
425
426 numvnodes_min = numvnodes_max = desiredvnodes;
427 if (bootarg_vn_dealloc_level == DEALLOC_VNODE_ONLY_OVERFLOW) {
428 numvnodes_max = desiredvnodes * 2;
429 vn_dealloc_level = bootarg_vn_dealloc_level;
430 } else if (bootarg_vn_dealloc_level == DEALLOC_VNODE_ALL) {
431 numvnodes_min = desiredvnodes_one_percent * 40;
432 numvnodes_max = desiredvnodes * 2;
433 reusablevnodes_max = (desiredvnodes_one_percent * 20) - deadvnodes_low;
434 vn_dealloc_level = bootarg_vn_dealloc_level;
435 }
436
437 bzero(&freeable_vnodes_telemetry, sizeof(CA_EVENT_TYPE(freeable_vnodes)));
438 freeable_vnodes_telemetry.numvnodes_min = numvnodes_min;
439 freeable_vnodes_telemetry.numvnodes_max = numvnodes_max;
440 freeable_vnodes_telemetry.desiredvnodes = desiredvnodes;
441
442 if (nc_smr_enabled) {
443 zone_enable_smr(vnode_zone, VFS_SMR(), &vnode_smr_free);
444 }
445
446 /*
447 * create worker threads
448 */
449 kernel_thread_start((thread_continue_t)async_work_continue, NULL, &thread);
450 thread_deallocate(thread);
451 kernel_thread_start((thread_continue_t)vn_laundry_continue, NULL, &thread);
452 thread_deallocate(thread);
453 }
454
455 /* the timeout is in 10 msecs */
456 int
vnode_waitforwrites(vnode_t vp,int output_target,int slpflag,int slptimeout,const char * msg)457 vnode_waitforwrites(vnode_t vp, int output_target, int slpflag, int slptimeout, const char *msg)
458 {
459 int error = 0;
460 struct timespec ts;
461
462 if (output_target < 0) {
463 return EINVAL;
464 }
465
466 KERNEL_DEBUG(0x3010280 | DBG_FUNC_START, (int)vp, output_target, vp->v_numoutput, 0, 0);
467
468 if (vp->v_numoutput > output_target) {
469 slpflag |= PDROP;
470
471 vnode_lock_spin(vp);
472
473 while ((vp->v_numoutput > output_target) && error == 0) {
474 if (output_target) {
475 vp->v_flag |= VTHROTTLED;
476 } else {
477 vp->v_flag |= VBWAIT;
478 }
479
480 ts.tv_sec = (slptimeout / 100);
481 ts.tv_nsec = (slptimeout % 1000) * 10 * NSEC_PER_USEC * 1000;
482 error = msleep((caddr_t)&vp->v_numoutput, &vp->v_lock, (slpflag | (PRIBIO + 1)), msg, &ts);
483
484 vnode_lock_spin(vp);
485 }
486 vnode_unlock(vp);
487 }
488 KERNEL_DEBUG(0x3010280 | DBG_FUNC_END, (int)vp, output_target, vp->v_numoutput, error, 0);
489
490 return error;
491 }
492
493
494 void
vnode_startwrite(vnode_t vp)495 vnode_startwrite(vnode_t vp)
496 {
497 OSAddAtomic(1, &vp->v_numoutput);
498 }
499
500
501 void
vnode_writedone(vnode_t vp)502 vnode_writedone(vnode_t vp)
503 {
504 if (vp) {
505 int need_wakeup = 0;
506
507 OSAddAtomic(-1, &vp->v_numoutput);
508
509 vnode_lock_spin(vp);
510
511 if (vp->v_numoutput < 0) {
512 panic("vnode_writedone: numoutput < 0");
513 }
514
515 if ((vp->v_flag & VTHROTTLED)) {
516 vp->v_flag &= ~VTHROTTLED;
517 need_wakeup = 1;
518 }
519 if ((vp->v_flag & VBWAIT) && (vp->v_numoutput == 0)) {
520 vp->v_flag &= ~VBWAIT;
521 need_wakeup = 1;
522 }
523 vnode_unlock(vp);
524
525 if (need_wakeup) {
526 wakeup((caddr_t)&vp->v_numoutput);
527 }
528 }
529 }
530
531
532
533 int
vnode_hasdirtyblks(vnode_t vp)534 vnode_hasdirtyblks(vnode_t vp)
535 {
536 struct cl_writebehind *wbp;
537
538 /*
539 * Not taking the buf_mtx as there is little
540 * point doing it. Even if the lock is taken the
541 * state can change right after that. If their
542 * needs to be a synchronization, it must be driven
543 * by the caller
544 */
545 if (vp->v_dirtyblkhd.lh_first) {
546 return 1;
547 }
548
549 if (!UBCINFOEXISTS(vp)) {
550 return 0;
551 }
552
553 wbp = vp->v_ubcinfo->cl_wbehind;
554
555 if (wbp && (wbp->cl_number || wbp->cl_scmap)) {
556 return 1;
557 }
558
559 return 0;
560 }
561
562 int
vnode_hascleanblks(vnode_t vp)563 vnode_hascleanblks(vnode_t vp)
564 {
565 /*
566 * Not taking the buf_mtx as there is little
567 * point doing it. Even if the lock is taken the
568 * state can change right after that. If their
569 * needs to be a synchronization, it must be driven
570 * by the caller
571 */
572 if (vp->v_cleanblkhd.lh_first) {
573 return 1;
574 }
575 return 0;
576 }
577
578 void
vnode_iterate_setup(mount_t mp)579 vnode_iterate_setup(mount_t mp)
580 {
581 mp->mnt_lflag |= MNT_LITER;
582 }
583
584 int
vnode_umount_preflight(mount_t mp,vnode_t skipvp,int flags)585 vnode_umount_preflight(mount_t mp, vnode_t skipvp, int flags)
586 {
587 vnode_t vp;
588 int ret = 0;
589
590 TAILQ_FOREACH(vp, &mp->mnt_vnodelist, v_mntvnodes) {
591 if (vp->v_type == VDIR) {
592 continue;
593 }
594 if (vp == skipvp) {
595 continue;
596 }
597 if ((flags & SKIPSYSTEM) && ((vp->v_flag & VSYSTEM) || (vp->v_flag & VNOFLUSH))) {
598 continue;
599 }
600 if ((flags & SKIPSWAP) && (vp->v_flag & VSWAP)) {
601 continue;
602 }
603 if ((flags & WRITECLOSE) && (vp->v_writecount == 0 || vp->v_type != VREG)) {
604 continue;
605 }
606
607 /* Look for busy vnode */
608 if ((vp->v_usecount != 0) && ((vp->v_usecount - vp->v_kusecount) != 0)) {
609 ret = 1;
610 if (print_busy_vnodes && ((flags & FORCECLOSE) == 0)) {
611 vprint("vnode_umount_preflight - busy vnode", vp);
612 } else {
613 return ret;
614 }
615 } else if (vp->v_iocount > 0) {
616 /* Busy if iocount is > 0 for more than 3 seconds */
617 tsleep(&vp->v_iocount, PVFS, "vnode_drain_network", 3 * hz);
618 if (vp->v_iocount > 0) {
619 ret = 1;
620 if (print_busy_vnodes && ((flags & FORCECLOSE) == 0)) {
621 vprint("vnode_umount_preflight - busy vnode", vp);
622 } else {
623 return ret;
624 }
625 }
626 continue;
627 }
628 }
629
630 return ret;
631 }
632
633 /*
634 * This routine prepares iteration by moving all the vnodes to worker queue
635 * called with mount lock held
636 */
637 int
vnode_iterate_prepare(mount_t mp)638 vnode_iterate_prepare(mount_t mp)
639 {
640 vnode_t vp;
641
642 if (TAILQ_EMPTY(&mp->mnt_vnodelist)) {
643 /* nothing to do */
644 return 0;
645 }
646
647 vp = TAILQ_FIRST(&mp->mnt_vnodelist);
648 vp->v_mntvnodes.tqe_prev = &(mp->mnt_workerqueue.tqh_first);
649 mp->mnt_workerqueue.tqh_first = mp->mnt_vnodelist.tqh_first;
650 mp->mnt_workerqueue.tqh_last = mp->mnt_vnodelist.tqh_last;
651
652 TAILQ_INIT(&mp->mnt_vnodelist);
653 if (mp->mnt_newvnodes.tqh_first != NULL) {
654 panic("vnode_iterate_prepare: newvnode when entering vnode");
655 }
656 TAILQ_INIT(&mp->mnt_newvnodes);
657
658 return 1;
659 }
660
661
662 /* called with mount lock held */
663 int
vnode_iterate_reloadq(mount_t mp)664 vnode_iterate_reloadq(mount_t mp)
665 {
666 int moved = 0;
667
668 /* add the remaining entries in workerq to the end of mount vnode list */
669 if (!TAILQ_EMPTY(&mp->mnt_workerqueue)) {
670 struct vnode * mvp;
671 mvp = TAILQ_LAST(&mp->mnt_vnodelist, vnodelst);
672
673 /* Joining the workerque entities to mount vnode list */
674 if (mvp) {
675 mvp->v_mntvnodes.tqe_next = mp->mnt_workerqueue.tqh_first;
676 } else {
677 mp->mnt_vnodelist.tqh_first = mp->mnt_workerqueue.tqh_first;
678 }
679 mp->mnt_workerqueue.tqh_first->v_mntvnodes.tqe_prev = mp->mnt_vnodelist.tqh_last;
680 mp->mnt_vnodelist.tqh_last = mp->mnt_workerqueue.tqh_last;
681 TAILQ_INIT(&mp->mnt_workerqueue);
682 }
683
684 /* add the newvnodes to the head of mount vnode list */
685 if (!TAILQ_EMPTY(&mp->mnt_newvnodes)) {
686 struct vnode * nlvp;
687 nlvp = TAILQ_LAST(&mp->mnt_newvnodes, vnodelst);
688
689 mp->mnt_newvnodes.tqh_first->v_mntvnodes.tqe_prev = &mp->mnt_vnodelist.tqh_first;
690 nlvp->v_mntvnodes.tqe_next = mp->mnt_vnodelist.tqh_first;
691 if (mp->mnt_vnodelist.tqh_first) {
692 mp->mnt_vnodelist.tqh_first->v_mntvnodes.tqe_prev = &nlvp->v_mntvnodes.tqe_next;
693 } else {
694 mp->mnt_vnodelist.tqh_last = mp->mnt_newvnodes.tqh_last;
695 }
696 mp->mnt_vnodelist.tqh_first = mp->mnt_newvnodes.tqh_first;
697 TAILQ_INIT(&mp->mnt_newvnodes);
698 moved = 1;
699 }
700
701 return moved;
702 }
703
704
705 void
vnode_iterate_clear(mount_t mp)706 vnode_iterate_clear(mount_t mp)
707 {
708 mp->mnt_lflag &= ~MNT_LITER;
709 }
710
711 #if defined(__x86_64__)
712
713 #include <i386/panic_hooks.h>
714
715 struct vnode_iterate_panic_hook {
716 panic_hook_t hook;
717 mount_t mp;
718 struct vnode *vp;
719 };
720
721 static void
vnode_iterate_panic_hook(panic_hook_t * hook_)722 vnode_iterate_panic_hook(panic_hook_t *hook_)
723 {
724 struct vnode_iterate_panic_hook *hook = (struct vnode_iterate_panic_hook *)hook_;
725 panic_phys_range_t range;
726 uint64_t phys;
727
728 if (panic_phys_range_before(hook->mp, &phys, &range)) {
729 paniclog_append_noflush("mp = %p, phys = %p, prev (%p: %p-%p)\n",
730 hook->mp, phys, range.type, range.phys_start,
731 range.phys_start + range.len);
732 } else {
733 paniclog_append_noflush("mp = %p, phys = %p, prev (!)\n", hook->mp, phys);
734 }
735
736 if (panic_phys_range_before(hook->vp, &phys, &range)) {
737 paniclog_append_noflush("vp = %p, phys = %p, prev (%p: %p-%p)\n",
738 hook->vp, phys, range.type, range.phys_start,
739 range.phys_start + range.len);
740 } else {
741 paniclog_append_noflush("vp = %p, phys = %p, prev (!)\n", hook->vp, phys);
742 }
743 panic_dump_mem((void *)(((vm_offset_t)hook->mp - 4096) & ~4095), 12288);
744 }
745 #endif /* defined(__x86_64__) */
746
747 int
vnode_iterate(mount_t mp,int flags,int (* callout)(struct vnode *,void *),void * arg)748 vnode_iterate(mount_t mp, int flags, int (*callout)(struct vnode *, void *),
749 void *arg)
750 {
751 struct vnode *vp;
752 int vid, retval;
753 int ret = 0;
754
755 /*
756 * The mount iterate mutex is held for the duration of the iteration.
757 * This can be done by a state flag on the mount structure but we can
758 * run into priority inversion issues sometimes.
759 * Using a mutex allows us to benefit from the priority donation
760 * mechanisms in the kernel for locks. This mutex should never be
761 * acquired in spin mode and it should be acquired before attempting to
762 * acquire the mount lock.
763 */
764 mount_iterate_lock(mp);
765
766 mount_lock(mp);
767
768 vnode_iterate_setup(mp);
769
770 /* If it returns 0 then there is nothing to do */
771 retval = vnode_iterate_prepare(mp);
772
773 if (retval == 0) {
774 vnode_iterate_clear(mp);
775 mount_unlock(mp);
776 mount_iterate_unlock(mp);
777 return ret;
778 }
779
780 #if defined(__x86_64__)
781 struct vnode_iterate_panic_hook hook;
782 hook.mp = mp;
783 hook.vp = NULL;
784 panic_hook(&hook.hook, vnode_iterate_panic_hook);
785 #endif
786 /* iterate over all the vnodes */
787 while (!TAILQ_EMPTY(&mp->mnt_workerqueue)) {
788 vp = TAILQ_FIRST(&mp->mnt_workerqueue);
789 #if defined(__x86_64__)
790 hook.vp = vp;
791 #endif
792 TAILQ_REMOVE(&mp->mnt_workerqueue, vp, v_mntvnodes);
793 TAILQ_INSERT_TAIL(&mp->mnt_vnodelist, vp, v_mntvnodes);
794 vid = vp->v_id;
795 if ((vp->v_data == NULL) || (vp->v_type == VNON) || (vp->v_mount != mp)) {
796 continue;
797 }
798 vnode_hold(vp);
799 mount_unlock(mp);
800
801 if (vget_internal(vp, vid, (flags | VNODE_NODEAD | VNODE_WITHID | VNODE_NOSUSPEND))) {
802 mount_lock(mp);
803 vnode_drop(vp);
804 continue;
805 }
806 vnode_drop(vp);
807 if (flags & VNODE_RELOAD) {
808 /*
809 * we're reloading the filesystem
810 * cast out any inactive vnodes...
811 */
812 if (vnode_reload(vp)) {
813 /* vnode will be recycled on the refcount drop */
814 vnode_put(vp);
815 mount_lock(mp);
816 continue;
817 }
818 }
819
820 retval = callout(vp, arg);
821
822 switch (retval) {
823 case VNODE_RETURNED:
824 case VNODE_RETURNED_DONE:
825 vnode_put(vp);
826 if (retval == VNODE_RETURNED_DONE) {
827 mount_lock(mp);
828 ret = 0;
829 goto out;
830 }
831 break;
832
833 case VNODE_CLAIMED_DONE:
834 mount_lock(mp);
835 ret = 0;
836 goto out;
837 case VNODE_CLAIMED:
838 default:
839 break;
840 }
841 mount_lock(mp);
842 }
843
844 out:
845 #if defined(__x86_64__)
846 panic_unhook(&hook.hook);
847 #endif
848 (void)vnode_iterate_reloadq(mp);
849 vnode_iterate_clear(mp);
850 mount_unlock(mp);
851 mount_iterate_unlock(mp);
852 return ret;
853 }
854
855 void
mount_lock_renames(mount_t mp)856 mount_lock_renames(mount_t mp)
857 {
858 lck_mtx_lock(&mp->mnt_renamelock);
859 }
860
861 void
mount_unlock_renames(mount_t mp)862 mount_unlock_renames(mount_t mp)
863 {
864 lck_mtx_unlock(&mp->mnt_renamelock);
865 }
866
867 void
mount_iterate_lock(mount_t mp)868 mount_iterate_lock(mount_t mp)
869 {
870 lck_mtx_lock(&mp->mnt_iter_lock);
871 }
872
873 void
mount_iterate_unlock(mount_t mp)874 mount_iterate_unlock(mount_t mp)
875 {
876 lck_mtx_unlock(&mp->mnt_iter_lock);
877 }
878
879 void
mount_lock(mount_t mp)880 mount_lock(mount_t mp)
881 {
882 lck_mtx_lock(&mp->mnt_mlock);
883 }
884
885 void
mount_lock_spin(mount_t mp)886 mount_lock_spin(mount_t mp)
887 {
888 lck_mtx_lock_spin(&mp->mnt_mlock);
889 }
890
891 void
mount_unlock(mount_t mp)892 mount_unlock(mount_t mp)
893 {
894 lck_mtx_unlock(&mp->mnt_mlock);
895 }
896
897
898 void
mount_ref(mount_t mp,int locked)899 mount_ref(mount_t mp, int locked)
900 {
901 if (!locked) {
902 mount_lock_spin(mp);
903 }
904
905 mp->mnt_count++;
906
907 if (!locked) {
908 mount_unlock(mp);
909 }
910 }
911
912
913 void
mount_drop(mount_t mp,int locked)914 mount_drop(mount_t mp, int locked)
915 {
916 if (!locked) {
917 mount_lock_spin(mp);
918 }
919
920 mp->mnt_count--;
921
922 if (mp->mnt_count == 0 && (mp->mnt_lflag & MNT_LDRAIN)) {
923 wakeup(&mp->mnt_lflag);
924 }
925
926 if (!locked) {
927 mount_unlock(mp);
928 }
929 }
930
931
932 int
mount_iterref(mount_t mp,int locked)933 mount_iterref(mount_t mp, int locked)
934 {
935 int retval = 0;
936
937 if (!locked) {
938 mount_list_lock();
939 }
940 if (mp->mnt_iterref < 0) {
941 retval = 1;
942 } else {
943 mp->mnt_iterref++;
944 }
945 if (!locked) {
946 mount_list_unlock();
947 }
948 return retval;
949 }
950
951 int
mount_isdrained(mount_t mp,int locked)952 mount_isdrained(mount_t mp, int locked)
953 {
954 int retval;
955
956 if (!locked) {
957 mount_list_lock();
958 }
959 if (mp->mnt_iterref < 0) {
960 retval = 1;
961 } else {
962 retval = 0;
963 }
964 if (!locked) {
965 mount_list_unlock();
966 }
967 return retval;
968 }
969
970 void
mount_iterdrop(mount_t mp)971 mount_iterdrop(mount_t mp)
972 {
973 mount_list_lock();
974 mp->mnt_iterref--;
975 wakeup(&mp->mnt_iterref);
976 mount_list_unlock();
977 }
978
979 void
mount_iterdrain(mount_t mp)980 mount_iterdrain(mount_t mp)
981 {
982 mount_list_lock();
983 while (mp->mnt_iterref) {
984 msleep((caddr_t)&mp->mnt_iterref, &mnt_list_mtx_lock, PVFS, "mount_iterdrain", NULL);
985 }
986 /* mount iterations drained */
987 mp->mnt_iterref = -1;
988 mount_list_unlock();
989 }
990 void
mount_iterreset(mount_t mp)991 mount_iterreset(mount_t mp)
992 {
993 mount_list_lock();
994 if (mp->mnt_iterref == -1) {
995 mp->mnt_iterref = 0;
996 }
997 mount_list_unlock();
998 }
999
1000 /* always called with mount lock held */
1001 int
mount_refdrain(mount_t mp)1002 mount_refdrain(mount_t mp)
1003 {
1004 if (mp->mnt_lflag & MNT_LDRAIN) {
1005 panic("already in drain");
1006 }
1007 mp->mnt_lflag |= MNT_LDRAIN;
1008
1009 while (mp->mnt_count) {
1010 msleep((caddr_t)&mp->mnt_lflag, &mp->mnt_mlock, PVFS, "mount_drain", NULL);
1011 }
1012
1013 if (mp->mnt_vnodelist.tqh_first != NULL) {
1014 panic("mount_refdrain: dangling vnode");
1015 }
1016
1017 mp->mnt_lflag &= ~MNT_LDRAIN;
1018
1019 return 0;
1020 }
1021
1022 /* Tags the mount point as not supportine extended readdir for NFS exports */
1023 void
mount_set_noreaddirext(mount_t mp)1024 mount_set_noreaddirext(mount_t mp)
1025 {
1026 mount_lock(mp);
1027 mp->mnt_kern_flag |= MNTK_DENY_READDIREXT;
1028 mount_unlock(mp);
1029 }
1030
1031 /*
1032 * Mark a mount point as busy. Used to synchronize access and to delay
1033 * unmounting.
1034 */
1035 int
vfs_busy(mount_t mp,int flags)1036 vfs_busy(mount_t mp, int flags)
1037 {
1038 restart:
1039 if (mp->mnt_lflag & MNT_LDEAD) {
1040 return ENOENT;
1041 }
1042
1043 mount_lock(mp);
1044
1045 if (mp->mnt_lflag & MNT_LUNMOUNT) {
1046 if (flags & LK_NOWAIT || mp->mnt_lflag & MNT_LDEAD) {
1047 mount_unlock(mp);
1048 return ENOENT;
1049 }
1050
1051 /*
1052 * Since all busy locks are shared except the exclusive
1053 * lock granted when unmounting, the only place that a
1054 * wakeup needs to be done is at the release of the
1055 * exclusive lock at the end of dounmount.
1056 */
1057 mp->mnt_lflag |= MNT_LWAIT;
1058 msleep((caddr_t)mp, &mp->mnt_mlock, (PVFS | PDROP), "vfsbusy", NULL);
1059 return ENOENT;
1060 }
1061
1062 mount_unlock(mp);
1063
1064 lck_rw_lock_shared(&mp->mnt_rwlock);
1065
1066 /*
1067 * Until we are granted the rwlock, it's possible for the mount point to
1068 * change state, so re-evaluate before granting the vfs_busy.
1069 */
1070 if (mp->mnt_lflag & (MNT_LDEAD | MNT_LUNMOUNT)) {
1071 lck_rw_done(&mp->mnt_rwlock);
1072 goto restart;
1073 }
1074 return 0;
1075 }
1076
1077 /*
1078 * Free a busy filesystem.
1079 */
1080 void
vfs_unbusy(mount_t mp)1081 vfs_unbusy(mount_t mp)
1082 {
1083 lck_rw_done(&mp->mnt_rwlock);
1084 }
1085
1086
1087
1088 static void
vfs_rootmountfailed(mount_t mp)1089 vfs_rootmountfailed(mount_t mp)
1090 {
1091 mount_list_lock();
1092 mp->mnt_vtable->vfc_refcount--;
1093 mount_list_unlock();
1094
1095 vfs_unbusy(mp);
1096
1097 if (nc_smr_enabled) {
1098 vfs_smr_synchronize();
1099 }
1100
1101 mount_lock_destroy(mp);
1102
1103 #if CONFIG_MACF
1104 mac_mount_label_destroy(mp);
1105 #endif
1106
1107 zfree(mount_zone, mp);
1108 }
1109
1110 /*
1111 * Lookup a filesystem type, and if found allocate and initialize
1112 * a mount structure for it.
1113 *
1114 * Devname is usually updated by mount(8) after booting.
1115 */
1116 static mount_t
vfs_rootmountalloc_internal(struct vfstable * vfsp,const char * devname)1117 vfs_rootmountalloc_internal(struct vfstable *vfsp, const char *devname)
1118 {
1119 mount_t mp;
1120
1121 mp = zalloc_flags(mount_zone, Z_WAITOK | Z_ZERO);
1122 /* Initialize the default IO constraints */
1123 mp->mnt_maxreadcnt = mp->mnt_maxwritecnt = MAXPHYS;
1124 mp->mnt_segreadcnt = mp->mnt_segwritecnt = 32;
1125 mp->mnt_maxsegreadsize = mp->mnt_maxreadcnt;
1126 mp->mnt_maxsegwritesize = mp->mnt_maxwritecnt;
1127 mp->mnt_devblocksize = DEV_BSIZE;
1128 mp->mnt_alignmentmask = PAGE_MASK;
1129 mp->mnt_ioqueue_depth = MNT_DEFAULT_IOQUEUE_DEPTH;
1130 mp->mnt_ioscale = 1;
1131 mp->mnt_ioflags = 0;
1132 mp->mnt_realrootvp = NULLVP;
1133 mp->mnt_authcache_ttl = CACHED_LOOKUP_RIGHT_TTL;
1134 mp->mnt_throttle_mask = LOWPRI_MAX_NUM_DEV - 1;
1135 mp->mnt_devbsdunit = 0;
1136
1137 mount_lock_init(mp);
1138 (void)vfs_busy(mp, LK_NOWAIT);
1139
1140 TAILQ_INIT(&mp->mnt_vnodelist);
1141 TAILQ_INIT(&mp->mnt_workerqueue);
1142 TAILQ_INIT(&mp->mnt_newvnodes);
1143
1144 mp->mnt_vtable = vfsp;
1145 mp->mnt_op = vfsp->vfc_vfsops;
1146 mp->mnt_flag = MNT_RDONLY | MNT_ROOTFS;
1147 mp->mnt_vnodecovered = NULLVP;
1148 //mp->mnt_stat.f_type = vfsp->vfc_typenum;
1149 mp->mnt_flag |= vfsp->vfc_flags & MNT_VISFLAGMASK;
1150
1151 mount_list_lock();
1152 vfsp->vfc_refcount++;
1153 mount_list_unlock();
1154
1155 strlcpy(mp->mnt_vfsstat.f_fstypename, vfsp->vfc_name, MFSTYPENAMELEN);
1156 mp->mnt_vfsstat.f_mntonname[0] = '/';
1157 /* XXX const poisoning layering violation */
1158 (void) copystr((const void *)devname, mp->mnt_vfsstat.f_mntfromname, MAXPATHLEN - 1, NULL);
1159
1160 #if CONFIG_MACF
1161 mac_mount_label_init(mp);
1162 mac_mount_label_associate(vfs_context_kernel(), mp);
1163 #endif
1164 return mp;
1165 }
1166
1167 errno_t
vfs_rootmountalloc(const char * fstypename,const char * devname,mount_t * mpp)1168 vfs_rootmountalloc(const char *fstypename, const char *devname, mount_t *mpp)
1169 {
1170 struct vfstable *vfsp;
1171
1172 for (vfsp = vfsconf; vfsp; vfsp = vfsp->vfc_next) {
1173 if (!strncmp(vfsp->vfc_name, fstypename,
1174 sizeof(vfsp->vfc_name))) {
1175 break;
1176 }
1177 }
1178 if (vfsp == NULL) {
1179 return ENODEV;
1180 }
1181
1182 *mpp = vfs_rootmountalloc_internal(vfsp, devname);
1183
1184 if (*mpp) {
1185 return 0;
1186 }
1187
1188 return ENOMEM;
1189 }
1190
1191 #define DBG_MOUNTROOT (FSDBG_CODE(DBG_MOUNT, 0))
1192
1193 /*
1194 * Find an appropriate filesystem to use for the root. If a filesystem
1195 * has not been preselected, walk through the list of known filesystems
1196 * trying those that have mountroot routines, and try them until one
1197 * works or we have tried them all.
1198 */
1199 extern int (*mountroot)(void);
1200
1201 int
vfs_mountroot(void)1202 vfs_mountroot(void)
1203 {
1204 #if CONFIG_MACF
1205 struct vnode *vp;
1206 #endif
1207 struct vfstable *vfsp;
1208 vfs_context_t ctx = vfs_context_kernel();
1209 struct vfs_attr vfsattr;
1210 int error;
1211 mount_t mp;
1212 vnode_t bdevvp_rootvp;
1213
1214 /*
1215 * Reset any prior "unmounting everything" state. This handles the
1216 * situation where mount root and then unmountall and re-mountroot
1217 * a new image (see bsd/kern/imageboot.c).
1218 */
1219 vfs_unmountall_started = vfs_unmountall_finished = 0;
1220 OSMemoryBarrier();
1221
1222 KDBG_RELEASE(DBG_MOUNTROOT | DBG_FUNC_START);
1223 if (mountroot != NULL) {
1224 /*
1225 * used for netboot which follows a different set of rules
1226 */
1227 error = (*mountroot)();
1228
1229 KDBG_RELEASE(DBG_MOUNTROOT | DBG_FUNC_END, error, 0);
1230 return error;
1231 }
1232 if ((error = bdevvp(rootdev, &rootvp))) {
1233 printf("vfs_mountroot: can't setup bdevvp\n");
1234
1235 KDBG_RELEASE(DBG_MOUNTROOT | DBG_FUNC_END, error, 1);
1236 return error;
1237 }
1238 /*
1239 * 4951998 - code we call in vfc_mountroot may replace rootvp
1240 * so keep a local copy for some house keeping.
1241 */
1242 bdevvp_rootvp = rootvp;
1243
1244 for (vfsp = vfsconf; vfsp; vfsp = vfsp->vfc_next) {
1245 if (vfsp->vfc_mountroot == NULL
1246 && !ISSET(vfsp->vfc_vfsflags, VFC_VFSCANMOUNTROOT)) {
1247 continue;
1248 }
1249
1250 mp = vfs_rootmountalloc_internal(vfsp, "root_device");
1251 mp->mnt_devvp = rootvp;
1252
1253 if (vfsp->vfc_mountroot) {
1254 error = (*vfsp->vfc_mountroot)(mp, rootvp, ctx);
1255 } else {
1256 error = VFS_MOUNT(mp, rootvp, 0, ctx);
1257 }
1258
1259 if (!error) {
1260 if (bdevvp_rootvp != rootvp) {
1261 /*
1262 * rootvp changed...
1263 * bump the iocount and fix up mnt_devvp for the
1264 * new rootvp (it will already have a usecount taken)...
1265 * drop the iocount and the usecount on the orignal
1266 * since we are no longer going to use it...
1267 */
1268 vnode_getwithref(rootvp);
1269 mp->mnt_devvp = rootvp;
1270
1271 vnode_rele(bdevvp_rootvp);
1272 vnode_put(bdevvp_rootvp);
1273 }
1274 mp->mnt_devvp->v_specflags |= SI_MOUNTEDON;
1275
1276 vfs_unbusy(mp);
1277
1278 mount_list_add(mp);
1279
1280 /*
1281 * cache the IO attributes for the underlying physical media...
1282 * an error return indicates the underlying driver doesn't
1283 * support all the queries necessary... however, reasonable
1284 * defaults will have been set, so no reason to bail or care
1285 */
1286 vfs_init_io_attributes(rootvp, mp);
1287
1288 if (mp->mnt_ioflags & MNT_IOFLAGS_FUSION_DRIVE) {
1289 root_is_CF_drive = TRUE;
1290 }
1291
1292 /*
1293 * Shadow the VFC_VFSNATIVEXATTR flag to MNTK_EXTENDED_ATTRS.
1294 */
1295 if (mp->mnt_vtable->vfc_vfsflags & VFC_VFSNATIVEXATTR) {
1296 mp->mnt_kern_flag |= MNTK_EXTENDED_ATTRS;
1297 }
1298 if (mp->mnt_vtable->vfc_vfsflags & VFC_VFSPREFLIGHT) {
1299 mp->mnt_kern_flag |= MNTK_UNMOUNT_PREFLIGHT;
1300 }
1301
1302 #if defined(XNU_TARGET_OS_OSX)
1303 uint32_t speed;
1304
1305 if (MNTK_VIRTUALDEV & mp->mnt_kern_flag) {
1306 speed = 128;
1307 } else if (disk_conditioner_mount_is_ssd(mp)) {
1308 speed = 7 * 256;
1309 } else {
1310 speed = 256;
1311 }
1312 vc_progress_setdiskspeed(speed);
1313 #endif /* XNU_TARGET_OS_OSX */
1314 /*
1315 * Probe root file system for additional features.
1316 */
1317 (void)VFS_START(mp, 0, ctx);
1318
1319 VFSATTR_INIT(&vfsattr);
1320 VFSATTR_WANTED(&vfsattr, f_capabilities);
1321 if (vfs_getattr(mp, &vfsattr, ctx) == 0 &&
1322 VFSATTR_IS_SUPPORTED(&vfsattr, f_capabilities)) {
1323 if ((vfsattr.f_capabilities.capabilities[VOL_CAPABILITIES_INTERFACES] & VOL_CAP_INT_EXTENDED_ATTR) &&
1324 (vfsattr.f_capabilities.valid[VOL_CAPABILITIES_INTERFACES] & VOL_CAP_INT_EXTENDED_ATTR)) {
1325 mp->mnt_kern_flag |= MNTK_EXTENDED_ATTRS;
1326 }
1327 #if NAMEDSTREAMS
1328 if ((vfsattr.f_capabilities.capabilities[VOL_CAPABILITIES_INTERFACES] & VOL_CAP_INT_NAMEDSTREAMS) &&
1329 (vfsattr.f_capabilities.valid[VOL_CAPABILITIES_INTERFACES] & VOL_CAP_INT_NAMEDSTREAMS)) {
1330 mp->mnt_kern_flag |= MNTK_NAMED_STREAMS;
1331 }
1332 #endif
1333 if ((vfsattr.f_capabilities.capabilities[VOL_CAPABILITIES_FORMAT] & VOL_CAP_FMT_PATH_FROM_ID) &&
1334 (vfsattr.f_capabilities.valid[VOL_CAPABILITIES_FORMAT] & VOL_CAP_FMT_PATH_FROM_ID)) {
1335 mp->mnt_kern_flag |= MNTK_PATH_FROM_ID;
1336 }
1337
1338 if ((vfsattr.f_capabilities.capabilities[VOL_CAPABILITIES_FORMAT] & VOL_CAP_FMT_DIR_HARDLINKS) &&
1339 (vfsattr.f_capabilities.valid[VOL_CAPABILITIES_FORMAT] & VOL_CAP_FMT_DIR_HARDLINKS)) {
1340 mp->mnt_kern_flag |= MNTK_DIR_HARDLINKS;
1341 }
1342 }
1343
1344 /*
1345 * get rid of iocount reference returned
1346 * by bdevvp (or picked up by us on the substitued
1347 * rootvp)... it (or we) will have also taken
1348 * a usecount reference which we want to keep
1349 */
1350 vnode_put(rootvp);
1351
1352 #if CONFIG_MACF
1353 if ((vfs_flags(mp) & MNT_MULTILABEL) == 0) {
1354 KDBG_RELEASE(DBG_MOUNTROOT | DBG_FUNC_END, 0, 2);
1355 return 0;
1356 }
1357
1358 error = VFS_ROOT(mp, &vp, ctx);
1359 if (error) {
1360 printf("%s() VFS_ROOT() returned %d\n",
1361 __func__, error);
1362 dounmount(mp, MNT_FORCE, 0, ctx);
1363 goto fail;
1364 }
1365 error = vnode_label(mp, NULL, vp, NULL, 0, ctx);
1366 /*
1367 * get rid of reference provided by VFS_ROOT
1368 */
1369 vnode_put(vp);
1370
1371 if (error) {
1372 printf("%s() vnode_label() returned %d\n",
1373 __func__, error);
1374 dounmount(mp, MNT_FORCE, 0, ctx);
1375 goto fail;
1376 }
1377 #endif
1378 KDBG_RELEASE(DBG_MOUNTROOT | DBG_FUNC_END, 0, 3);
1379 return 0;
1380 }
1381 vfs_rootmountfailed(mp);
1382 #if CONFIG_MACF
1383 fail:
1384 #endif
1385 if (error != EINVAL) {
1386 printf("%s_mountroot failed: %d\n", vfsp->vfc_name, error);
1387 }
1388 }
1389 KDBG_RELEASE(DBG_MOUNTROOT | DBG_FUNC_END, error ? error : ENODEV, 4);
1390 return ENODEV;
1391 }
1392
1393 static int
cache_purge_callback(mount_t mp,__unused void * arg)1394 cache_purge_callback(mount_t mp, __unused void * arg)
1395 {
1396 cache_purgevfs(mp);
1397 return VFS_RETURNED;
1398 }
1399
1400 extern lck_rw_t rootvnode_rw_lock;
1401 extern void set_rootvnode(vnode_t);
1402
1403
1404 static int
mntonname_fixup_callback(mount_t mp,__unused void * arg)1405 mntonname_fixup_callback(mount_t mp, __unused void *arg)
1406 {
1407 int error = 0;
1408
1409 if ((strncmp(&mp->mnt_vfsstat.f_mntonname[0], "/", sizeof("/")) == 0) ||
1410 (strncmp(&mp->mnt_vfsstat.f_mntonname[0], "/dev", sizeof("/dev")) == 0)) {
1411 return 0;
1412 }
1413
1414 if ((error = vfs_busy(mp, LK_NOWAIT))) {
1415 printf("vfs_busy failed with %d for %s\n", error, mp->mnt_vfsstat.f_mntonname);
1416 return -1;
1417 }
1418
1419 size_t pathlen = MAXPATHLEN;
1420 if ((error = vn_getpath_ext(mp->mnt_vnodecovered, NULL, mp->mnt_vfsstat.f_mntonname, &pathlen, VN_GETPATH_FSENTER))) {
1421 printf("vn_getpath_ext failed with %d for mnt_vnodecovered of %s\n", error, mp->mnt_vfsstat.f_mntonname);
1422 }
1423
1424 vfs_unbusy(mp);
1425
1426 return error;
1427 }
1428
1429 static int
clear_mntk_backs_root_callback(mount_t mp,__unused void * arg)1430 clear_mntk_backs_root_callback(mount_t mp, __unused void *arg)
1431 {
1432 lck_rw_lock_exclusive(&mp->mnt_rwlock);
1433 mp->mnt_kern_flag &= ~MNTK_BACKS_ROOT;
1434 lck_rw_done(&mp->mnt_rwlock);
1435 return VFS_RETURNED;
1436 }
1437
1438 static int
verify_incoming_rootfs(vnode_t * incoming_rootvnodep,vfs_context_t ctx,vfs_switch_root_flags_t flags)1439 verify_incoming_rootfs(vnode_t *incoming_rootvnodep, vfs_context_t ctx,
1440 vfs_switch_root_flags_t flags)
1441 {
1442 mount_t mp;
1443 vnode_t tdp;
1444 vnode_t incoming_rootvnode_with_iocount = *incoming_rootvnodep;
1445 vnode_t incoming_rootvnode_with_usecount = NULLVP;
1446 int error = 0;
1447
1448 if (vnode_vtype(incoming_rootvnode_with_iocount) != VDIR) {
1449 printf("Incoming rootfs path not a directory\n");
1450 error = ENOTDIR;
1451 goto done;
1452 }
1453
1454 /*
1455 * Before we call VFS_ROOT, we have to let go of the iocount already
1456 * acquired, but before doing that get a usecount.
1457 */
1458 vnode_ref_ext(incoming_rootvnode_with_iocount, 0, VNODE_REF_FORCE);
1459 incoming_rootvnode_with_usecount = incoming_rootvnode_with_iocount;
1460 vnode_lock_spin(incoming_rootvnode_with_usecount);
1461 if ((mp = incoming_rootvnode_with_usecount->v_mount)) {
1462 mp->mnt_crossref++;
1463 vnode_unlock(incoming_rootvnode_with_usecount);
1464 } else {
1465 vnode_unlock(incoming_rootvnode_with_usecount);
1466 printf("Incoming rootfs root vnode does not have associated mount\n");
1467 error = ENOTDIR;
1468 goto done;
1469 }
1470
1471 if (vfs_busy(mp, LK_NOWAIT)) {
1472 printf("Incoming rootfs root vnode mount is busy\n");
1473 error = ENOENT;
1474 goto out;
1475 }
1476
1477 vnode_put(incoming_rootvnode_with_iocount);
1478 incoming_rootvnode_with_iocount = NULLVP;
1479
1480 error = VFS_ROOT(mp, &tdp, ctx);
1481
1482 if (error) {
1483 printf("Could not get rootvnode of incoming rootfs\n");
1484 } else if (tdp != incoming_rootvnode_with_usecount) {
1485 vnode_put(tdp);
1486 tdp = NULLVP;
1487 printf("Incoming rootfs root vnode mount is is not a mountpoint\n");
1488 error = EINVAL;
1489 goto out_busy;
1490 } else {
1491 incoming_rootvnode_with_iocount = tdp;
1492 tdp = NULLVP;
1493 }
1494
1495 if ((flags & VFSSR_VIRTUALDEV_PROHIBITED) != 0) {
1496 if (mp->mnt_kern_flag & MNTK_VIRTUALDEV) {
1497 error = ENODEV;
1498 }
1499 if (error) {
1500 printf("Incoming rootfs is backed by a virtual device; cannot switch to it");
1501 goto out_busy;
1502 }
1503 }
1504
1505 out_busy:
1506 vfs_unbusy(mp);
1507
1508 out:
1509 vnode_lock(incoming_rootvnode_with_usecount);
1510 mp->mnt_crossref--;
1511 if (mp->mnt_crossref < 0) {
1512 panic("mount cross refs -ve");
1513 }
1514 vnode_unlock(incoming_rootvnode_with_usecount);
1515
1516 done:
1517 if (incoming_rootvnode_with_usecount) {
1518 vnode_rele(incoming_rootvnode_with_usecount);
1519 incoming_rootvnode_with_usecount = NULLVP;
1520 }
1521
1522 if (error && incoming_rootvnode_with_iocount) {
1523 vnode_put(incoming_rootvnode_with_iocount);
1524 incoming_rootvnode_with_iocount = NULLVP;
1525 }
1526
1527 *incoming_rootvnodep = incoming_rootvnode_with_iocount;
1528 return error;
1529 }
1530
1531 /*
1532 * vfs_switch_root()
1533 *
1534 * Move the current root volume, and put a different volume at the root.
1535 *
1536 * incoming_vol_old_path: This is the path where the incoming root volume
1537 * is mounted when this function begins.
1538 * outgoing_vol_new_path: This is the path where the outgoing root volume
1539 * will be mounted when this function (successfully) ends.
1540 * Note: Do not use a leading slash.
1541 *
1542 * Volumes mounted at several fixed points (including /dev) will be preserved
1543 * at the same absolute path. That means they will move within the folder
1544 * hierarchy during the pivot operation. For example, /dev before the pivot
1545 * will be at /dev after the pivot.
1546 *
1547 * If any filesystem has MNTK_BACKS_ROOT set, it will be cleared. If the
1548 * incoming root volume is actually a disk image backed by some other
1549 * filesystem, it is the caller's responsibility to re-set MNTK_BACKS_ROOT
1550 * as appropriate.
1551 */
1552 int
vfs_switch_root(const char * incoming_vol_old_path,const char * outgoing_vol_new_path,vfs_switch_root_flags_t flags)1553 vfs_switch_root(const char *incoming_vol_old_path,
1554 const char *outgoing_vol_new_path,
1555 vfs_switch_root_flags_t flags)
1556 {
1557 // grumble grumble
1558 #define countof(x) (sizeof(x) / sizeof(x[0]))
1559
1560 struct preserved_mount {
1561 vnode_t pm_rootvnode;
1562 mount_t pm_mount;
1563 vnode_t pm_new_covered_vp;
1564 vnode_t pm_old_covered_vp;
1565 const char *pm_path;
1566 };
1567
1568 vfs_context_t ctx = vfs_context_kernel();
1569 vnode_t incoming_rootvnode = NULLVP;
1570 vnode_t outgoing_vol_new_covered_vp = NULLVP;
1571 vnode_t incoming_vol_old_covered_vp = NULLVP;
1572 mount_t outgoing = NULL;
1573 mount_t incoming = NULL;
1574
1575 struct preserved_mount devfs = { NULLVP, NULL, NULLVP, NULLVP, "dev" };
1576 struct preserved_mount preboot = { NULLVP, NULL, NULLVP, NULLVP, "System/Volumes/Preboot" };
1577 struct preserved_mount recovery = { NULLVP, NULL, NULLVP, NULLVP, "System/Volumes/Recovery" };
1578 struct preserved_mount vm = { NULLVP, NULL, NULLVP, NULLVP, "System/Volumes/VM" };
1579 struct preserved_mount update = { NULLVP, NULL, NULLVP, NULLVP, "System/Volumes/Update" };
1580 struct preserved_mount iscPreboot = { NULLVP, NULL, NULLVP, NULLVP, "System/Volumes/iSCPreboot" };
1581 struct preserved_mount hardware = { NULLVP, NULL, NULLVP, NULLVP, "System/Volumes/Hardware" };
1582 struct preserved_mount xarts = { NULLVP, NULL, NULLVP, NULLVP, "System/Volumes/xarts" };
1583 struct preserved_mount factorylogs = { NULLVP, NULL, NULLVP, NULLVP, "FactoryLogs" };
1584 struct preserved_mount idiags = { NULLVP, NULL, NULLVP, NULLVP, "System/Volumes/Diags" };
1585
1586 struct preserved_mount *preserved[10];
1587 preserved[0] = &devfs;
1588 preserved[1] = &preboot;
1589 preserved[2] = &recovery;
1590 preserved[3] = &vm;
1591 preserved[4] = &update;
1592 preserved[5] = &iscPreboot;
1593 preserved[6] = &hardware;
1594 preserved[7] = &xarts;
1595 preserved[8] = &factorylogs;
1596 preserved[9] = &idiags;
1597
1598 int error;
1599
1600 printf("%s : shuffling mount points : %s <-> / <-> %s\n", __FUNCTION__, incoming_vol_old_path, outgoing_vol_new_path);
1601
1602 if (outgoing_vol_new_path[0] == '/') {
1603 // I should have written this to be more helpful and just advance the pointer forward past the slash
1604 printf("Do not use a leading slash in outgoing_vol_new_path\n");
1605 return EINVAL;
1606 }
1607
1608 // Set incoming_rootvnode.
1609 // Find the vnode representing the mountpoint of the new root
1610 // filesystem. That will be the new root directory.
1611 error = vnode_lookup(incoming_vol_old_path, 0, &incoming_rootvnode, ctx);
1612 if (error) {
1613 printf("Incoming rootfs root vnode not found\n");
1614 error = ENOENT;
1615 goto done;
1616 }
1617
1618 /*
1619 * This function drops the icoount and sets the vnode to NULL on error.
1620 */
1621 error = verify_incoming_rootfs(&incoming_rootvnode, ctx, flags);
1622 if (error) {
1623 goto done;
1624 }
1625
1626 /*
1627 * Set outgoing_vol_new_covered_vp.
1628 * Find the vnode representing the future mountpoint of the old
1629 * root filesystem, inside the directory incoming_rootvnode.
1630 * Right now it's at "/incoming_vol_old_path/outgoing_vol_new_path".
1631 * soon it will become "/oldrootfs_path_after", which will be covered.
1632 */
1633 error = vnode_lookupat(outgoing_vol_new_path, 0, &outgoing_vol_new_covered_vp, ctx, incoming_rootvnode);
1634 if (error) {
1635 printf("Outgoing rootfs path not found, abandoning / switch, error = %d\n", error);
1636 error = ENOENT;
1637 goto done;
1638 }
1639 if (vnode_vtype(outgoing_vol_new_covered_vp) != VDIR) {
1640 printf("Outgoing rootfs path is not a directory, abandoning / switch\n");
1641 error = ENOTDIR;
1642 goto done;
1643 }
1644
1645 /*
1646 * Find the preserved mounts - see if they are mounted. Get their root
1647 * vnode if they are. If they aren't, leave rootvnode NULL which will
1648 * be the signal to ignore this mount later on.
1649 *
1650 * Also get preserved mounts' new_covered_vp.
1651 * Find the node representing the folder "dev" inside the directory newrootvnode.
1652 * Right now it's at "/incoming_vol_old_path/dev".
1653 * Soon it will become /dev, which will be covered by the devfs mountpoint.
1654 */
1655 for (size_t i = 0; i < countof(preserved); i++) {
1656 struct preserved_mount *pmi = preserved[i];
1657
1658 error = vnode_lookupat(pmi->pm_path, 0, &pmi->pm_rootvnode, ctx, rootvnode);
1659 if (error) {
1660 printf("skipping preserved mountpoint because not found or error: %d: %s\n", error, pmi->pm_path);
1661 // not fatal. try the next one in the list.
1662 continue;
1663 }
1664 bool is_mountpoint = false;
1665 vnode_lock_spin(pmi->pm_rootvnode);
1666 if ((pmi->pm_rootvnode->v_flag & VROOT) != 0) {
1667 is_mountpoint = true;
1668 }
1669 vnode_unlock(pmi->pm_rootvnode);
1670 if (!is_mountpoint) {
1671 printf("skipping preserved mountpoint because not a mountpoint: %s\n", pmi->pm_path);
1672 vnode_put(pmi->pm_rootvnode);
1673 pmi->pm_rootvnode = NULLVP;
1674 // not fatal. try the next one in the list.
1675 continue;
1676 }
1677
1678 error = vnode_lookupat(pmi->pm_path, 0, &pmi->pm_new_covered_vp, ctx, incoming_rootvnode);
1679 if (error) {
1680 printf("preserved new mount directory not found or error: %d: %s\n", error, pmi->pm_path);
1681 error = ENOENT;
1682 goto done;
1683 }
1684 if (vnode_vtype(pmi->pm_new_covered_vp) != VDIR) {
1685 printf("preserved new mount directory not directory: %s\n", pmi->pm_path);
1686 error = ENOTDIR;
1687 goto done;
1688 }
1689
1690 printf("will preserve mountpoint across pivot: /%s\n", pmi->pm_path);
1691 }
1692
1693 /*
1694 * --
1695 * At this point, everything has been prepared and all error conditions
1696 * have been checked. We check everything we can before this point;
1697 * from now on we start making destructive changes, and we can't stop
1698 * until we reach the end.
1699 * ----
1700 */
1701
1702 /* this usecount is transferred to the mnt_vnodecovered */
1703 vnode_ref_ext(outgoing_vol_new_covered_vp, 0, VNODE_REF_FORCE);
1704 /* this usecount is transferred to set_rootvnode */
1705 vnode_ref_ext(incoming_rootvnode, 0, VNODE_REF_FORCE);
1706
1707
1708 for (size_t i = 0; i < countof(preserved); i++) {
1709 struct preserved_mount *pmi = preserved[i];
1710 if (pmi->pm_rootvnode == NULLVP) {
1711 continue;
1712 }
1713
1714 /* this usecount is transferred to the mnt_vnodecovered */
1715 vnode_ref_ext(pmi->pm_new_covered_vp, 0, VNODE_REF_FORCE);
1716
1717 /* The new_covered_vp is a mountpoint from now on. */
1718 vnode_lock_spin(pmi->pm_new_covered_vp);
1719 pmi->pm_new_covered_vp->v_flag |= VMOUNTEDHERE;
1720 vnode_unlock(pmi->pm_new_covered_vp);
1721 }
1722
1723 /* The outgoing_vol_new_covered_vp is a mountpoint from now on. */
1724 vnode_lock_spin(outgoing_vol_new_covered_vp);
1725 outgoing_vol_new_covered_vp->v_flag |= VMOUNTEDHERE;
1726 vnode_unlock(outgoing_vol_new_covered_vp);
1727
1728
1729 /*
1730 * Identify the mount_ts of the mounted filesystems that are being
1731 * manipulated: outgoing rootfs, incoming rootfs, and the preserved
1732 * mounts.
1733 */
1734 outgoing = rootvnode->v_mount;
1735 incoming = incoming_rootvnode->v_mount;
1736 for (size_t i = 0; i < countof(preserved); i++) {
1737 struct preserved_mount *pmi = preserved[i];
1738 if (pmi->pm_rootvnode == NULLVP) {
1739 continue;
1740 }
1741
1742 pmi->pm_mount = pmi->pm_rootvnode->v_mount;
1743 }
1744
1745 lck_rw_lock_exclusive(&rootvnode_rw_lock);
1746
1747 /* Setup incoming as the new rootfs */
1748 lck_rw_lock_exclusive(&incoming->mnt_rwlock);
1749 incoming_vol_old_covered_vp = incoming->mnt_vnodecovered;
1750 incoming->mnt_vnodecovered = NULLVP;
1751 strlcpy(incoming->mnt_vfsstat.f_mntonname, "/", MAXPATHLEN);
1752 incoming->mnt_flag |= MNT_ROOTFS;
1753 lck_rw_done(&incoming->mnt_rwlock);
1754
1755 /*
1756 * The preserved mountpoints will now be moved to
1757 * incoming_rootnode/pm_path, and then by the end of the function,
1758 * since incoming_rootnode is going to /, the preserved mounts
1759 * will be end up back at /pm_path
1760 */
1761 for (size_t i = 0; i < countof(preserved); i++) {
1762 struct preserved_mount *pmi = preserved[i];
1763 if (pmi->pm_rootvnode == NULLVP) {
1764 continue;
1765 }
1766
1767 lck_rw_lock_exclusive(&pmi->pm_mount->mnt_rwlock);
1768 pmi->pm_old_covered_vp = pmi->pm_mount->mnt_vnodecovered;
1769 pmi->pm_mount->mnt_vnodecovered = pmi->pm_new_covered_vp;
1770 vnode_lock_spin(pmi->pm_new_covered_vp);
1771 pmi->pm_new_covered_vp->v_mountedhere = pmi->pm_mount;
1772 SET(pmi->pm_new_covered_vp->v_flag, VMOUNTEDHERE);
1773 vnode_unlock(pmi->pm_new_covered_vp);
1774 lck_rw_done(&pmi->pm_mount->mnt_rwlock);
1775 }
1776
1777 /*
1778 * The old root volume now covers outgoing_vol_new_covered_vp
1779 * on the new root volume. Remove the ROOTFS marker.
1780 * Now it is to be found at outgoing_vol_new_path
1781 */
1782 lck_rw_lock_exclusive(&outgoing->mnt_rwlock);
1783 outgoing->mnt_vnodecovered = outgoing_vol_new_covered_vp;
1784 strlcpy(outgoing->mnt_vfsstat.f_mntonname, "/", MAXPATHLEN);
1785 strlcat(outgoing->mnt_vfsstat.f_mntonname, outgoing_vol_new_path, MAXPATHLEN);
1786 outgoing->mnt_flag &= ~MNT_ROOTFS;
1787 vnode_lock_spin(outgoing_vol_new_covered_vp);
1788 outgoing_vol_new_covered_vp->v_mountedhere = outgoing;
1789 vnode_unlock(outgoing_vol_new_covered_vp);
1790 lck_rw_done(&outgoing->mnt_rwlock);
1791
1792 if (!(outgoing->mnt_kern_flag & MNTK_VIRTUALDEV) &&
1793 (TAILQ_FIRST(&mountlist) == outgoing)) {
1794 vfs_setmntsystem(outgoing);
1795 }
1796
1797 /*
1798 * Finally, remove the mount_t linkage from the previously covered
1799 * vnodes on the old root volume. These were incoming_vol_old_path,
1800 * and each preserved mounts's "/pm_path". The filesystems previously
1801 * mounted there have already been moved away.
1802 */
1803 vnode_lock_spin(incoming_vol_old_covered_vp);
1804 incoming_vol_old_covered_vp->v_flag &= ~VMOUNT;
1805 incoming_vol_old_covered_vp->v_mountedhere = NULL;
1806 vnode_unlock(incoming_vol_old_covered_vp);
1807
1808 for (size_t i = 0; i < countof(preserved); i++) {
1809 struct preserved_mount *pmi = preserved[i];
1810 if (pmi->pm_rootvnode == NULLVP) {
1811 continue;
1812 }
1813
1814 vnode_lock_spin(pmi->pm_old_covered_vp);
1815 CLR(pmi->pm_old_covered_vp->v_flag, VMOUNTEDHERE);
1816 pmi->pm_old_covered_vp->v_mountedhere = NULL;
1817 vnode_unlock(pmi->pm_old_covered_vp);
1818 }
1819
1820 /*
1821 * Clear the name cache since many cached names are now invalid.
1822 */
1823 vfs_iterate(0 /* flags */, cache_purge_callback, NULL);
1824
1825 /*
1826 * Actually change the rootvnode! And finally drop the lock that
1827 * prevents concurrent vnode_lookups.
1828 */
1829 set_rootvnode(incoming_rootvnode);
1830 lck_rw_unlock_exclusive(&rootvnode_rw_lock);
1831
1832 if (!(incoming->mnt_kern_flag & MNTK_VIRTUALDEV) &&
1833 !(outgoing->mnt_kern_flag & MNTK_VIRTUALDEV)) {
1834 /*
1835 * Switch the order of mount structures in the mountlist, new root
1836 * mount moves to the head of the list followed by /dev and the other
1837 * preserved mounts then all the preexisting mounts (old rootfs + any
1838 * others)
1839 */
1840 mount_list_lock();
1841 for (size_t i = 0; i < countof(preserved); i++) {
1842 struct preserved_mount *pmi = preserved[i];
1843 if (pmi->pm_rootvnode == NULLVP) {
1844 continue;
1845 }
1846
1847 TAILQ_REMOVE(&mountlist, pmi->pm_mount, mnt_list);
1848 TAILQ_INSERT_HEAD(&mountlist, pmi->pm_mount, mnt_list);
1849 }
1850 TAILQ_REMOVE(&mountlist, incoming, mnt_list);
1851 TAILQ_INSERT_HEAD(&mountlist, incoming, mnt_list);
1852 mount_list_unlock();
1853 }
1854
1855 /*
1856 * Fixups across all volumes
1857 */
1858 vfs_iterate(0 /* flags */, mntonname_fixup_callback, NULL);
1859 vfs_iterate(0 /* flags */, clear_mntk_backs_root_callback, NULL);
1860
1861 error = 0;
1862
1863 done:
1864 for (size_t i = 0; i < countof(preserved); i++) {
1865 struct preserved_mount *pmi = preserved[i];
1866
1867 if (pmi->pm_rootvnode) {
1868 vnode_put(pmi->pm_rootvnode);
1869 }
1870 if (pmi->pm_new_covered_vp) {
1871 vnode_put(pmi->pm_new_covered_vp);
1872 }
1873 if (pmi->pm_old_covered_vp) {
1874 vnode_rele(pmi->pm_old_covered_vp);
1875 }
1876 }
1877
1878 if (outgoing_vol_new_covered_vp) {
1879 vnode_put(outgoing_vol_new_covered_vp);
1880 }
1881
1882 if (incoming_vol_old_covered_vp) {
1883 vnode_rele(incoming_vol_old_covered_vp);
1884 }
1885
1886 if (incoming_rootvnode) {
1887 vnode_put(incoming_rootvnode);
1888 }
1889
1890 printf("%s : done shuffling mount points with error: %d\n", __FUNCTION__, error);
1891 return error;
1892 }
1893
1894 /*
1895 * Mount the Recovery volume of a container
1896 */
1897 int
vfs_mount_recovery(void)1898 vfs_mount_recovery(void)
1899 {
1900 #if CONFIG_MOUNT_PREBOOTRECOVERY
1901 int error = 0;
1902
1903 error = vnode_get(rootvnode);
1904 if (error) {
1905 /* root must be mounted first */
1906 printf("vnode_get(rootvnode) failed with error %d\n", error);
1907 return error;
1908 }
1909
1910 char recoverypath[] = PLATFORM_RECOVERY_VOLUME_MOUNT_POINT; /* !const because of internal casting */
1911
1912 /* Mount the recovery volume */
1913 printf("attempting kernel mount for recovery volume... \n");
1914 error = kernel_mount(rootvnode->v_mount->mnt_vfsstat.f_fstypename, NULLVP, NULLVP,
1915 recoverypath, (rootvnode->v_mount), 0, 0, (KERNEL_MOUNT_RECOVERYVOL), vfs_context_kernel());
1916
1917 if (error) {
1918 printf("Failed to mount recovery volume (%d)\n", error);
1919 } else {
1920 printf("mounted recovery volume\n");
1921 }
1922
1923 vnode_put(rootvnode);
1924 return error;
1925 #else
1926 return 0;
1927 #endif
1928 }
1929
1930 /*
1931 * Lookup a mount point by filesystem identifier.
1932 */
1933
1934 struct mount *
vfs_getvfs(fsid_t * fsid)1935 vfs_getvfs(fsid_t *fsid)
1936 {
1937 return mount_list_lookupby_fsid(fsid, 0, 0);
1938 }
1939
1940 static struct mount *
vfs_getvfs_locked(fsid_t * fsid)1941 vfs_getvfs_locked(fsid_t *fsid)
1942 {
1943 return mount_list_lookupby_fsid(fsid, 1, 0);
1944 }
1945
1946 struct mount *
vfs_getvfs_with_vfsops(fsid_t * fsid,const struct vfsops * const ops)1947 vfs_getvfs_with_vfsops(fsid_t *fsid, const struct vfsops * const ops)
1948 {
1949 mount_t mp = mount_list_lookupby_fsid(fsid, 0, 0);
1950
1951 if (mp != NULL && mp->mnt_op != ops) {
1952 mp = NULL;
1953 }
1954 return mp;
1955 }
1956
1957 struct mount *
vfs_getvfs_by_mntonname(char * path)1958 vfs_getvfs_by_mntonname(char *path)
1959 {
1960 mount_t retmp = (mount_t)0;
1961 mount_t mp;
1962
1963 mount_list_lock();
1964 TAILQ_FOREACH(mp, &mountlist, mnt_list) {
1965 if (!strncmp(mp->mnt_vfsstat.f_mntonname, path,
1966 sizeof(mp->mnt_vfsstat.f_mntonname))) {
1967 retmp = mp;
1968 if (mount_iterref(retmp, 1)) {
1969 retmp = NULL;
1970 }
1971 goto out;
1972 }
1973 }
1974 out:
1975 mount_list_unlock();
1976 return retmp;
1977 }
1978
1979 /* generation number for creation of new fsids */
1980 u_short mntid_gen = 0;
1981 /*
1982 * Get a new unique fsid
1983 */
1984 void
vfs_getnewfsid(struct mount * mp)1985 vfs_getnewfsid(struct mount *mp)
1986 {
1987 fsid_t tfsid;
1988 int mtype;
1989
1990 mount_list_lock();
1991
1992 /* generate a new fsid */
1993 mtype = mp->mnt_vtable->vfc_typenum;
1994 if (++mntid_gen == 0) {
1995 mntid_gen++;
1996 }
1997 tfsid.val[0] = makedev(nblkdev + mtype, mntid_gen);
1998 tfsid.val[1] = mtype;
1999
2000 while (vfs_getvfs_locked(&tfsid)) {
2001 if (++mntid_gen == 0) {
2002 mntid_gen++;
2003 }
2004 tfsid.val[0] = makedev(nblkdev + mtype, mntid_gen);
2005 }
2006
2007 mp->mnt_vfsstat.f_fsid.val[0] = tfsid.val[0];
2008 mp->mnt_vfsstat.f_fsid.val[1] = tfsid.val[1];
2009 mount_list_unlock();
2010 }
2011
2012 /*
2013 * Routines having to do with the management of the vnode table.
2014 */
2015 extern int(**dead_vnodeop_p)(void *);
2016 long numvnodes, freevnodes, deadvnodes, async_work_vnodes;
2017 long busyvnodes = 0;
2018 long deadvnodes_noreuse = 0;
2019 int32_t freeablevnodes = 0;
2020 uint64_t allocedvnodes = 0;
2021 uint64_t deallocedvnodes = 0;
2022
2023
2024 int async_work_timed_out = 0;
2025 int async_work_handled = 0;
2026 int dead_vnode_wanted = 0;
2027 int dead_vnode_waited = 0;
2028
2029 /*
2030 * Move a vnode from one mount queue to another.
2031 */
2032 static void
insmntque(vnode_t vp,mount_t mp)2033 insmntque(vnode_t vp, mount_t mp)
2034 {
2035 mount_t lmp;
2036 /*
2037 * Delete from old mount point vnode list, if on one.
2038 */
2039 if ((lmp = vp->v_mount) != NULL && lmp != dead_mountp) {
2040 if ((vp->v_lflag & VNAMED_MOUNT) == 0) {
2041 panic("insmntque: vp not in mount vnode list");
2042 }
2043 vp->v_lflag &= ~VNAMED_MOUNT;
2044
2045 mount_lock_spin(lmp);
2046
2047 mount_drop(lmp, 1);
2048
2049 if (vp->v_mntvnodes.tqe_next == NULL) {
2050 if (TAILQ_LAST(&lmp->mnt_vnodelist, vnodelst) == vp) {
2051 TAILQ_REMOVE(&lmp->mnt_vnodelist, vp, v_mntvnodes);
2052 } else if (TAILQ_LAST(&lmp->mnt_newvnodes, vnodelst) == vp) {
2053 TAILQ_REMOVE(&lmp->mnt_newvnodes, vp, v_mntvnodes);
2054 } else if (TAILQ_LAST(&lmp->mnt_workerqueue, vnodelst) == vp) {
2055 TAILQ_REMOVE(&lmp->mnt_workerqueue, vp, v_mntvnodes);
2056 }
2057 } else {
2058 vp->v_mntvnodes.tqe_next->v_mntvnodes.tqe_prev = vp->v_mntvnodes.tqe_prev;
2059 *vp->v_mntvnodes.tqe_prev = vp->v_mntvnodes.tqe_next;
2060 }
2061 vp->v_mntvnodes.tqe_next = NULL;
2062 vp->v_mntvnodes.tqe_prev = NULL;
2063 mount_unlock(lmp);
2064 vnode_drop(vp);
2065 return;
2066 }
2067
2068 /*
2069 * Insert into list of vnodes for the new mount point, if available.
2070 */
2071 if ((vp->v_mount = mp) != NULL) {
2072 mount_lock_spin(mp);
2073 if ((vp->v_mntvnodes.tqe_next != 0) && (vp->v_mntvnodes.tqe_prev != 0)) {
2074 panic("vp already in mount list");
2075 }
2076 if (mp->mnt_lflag & MNT_LITER) {
2077 TAILQ_INSERT_HEAD(&mp->mnt_newvnodes, vp, v_mntvnodes);
2078 } else {
2079 TAILQ_INSERT_HEAD(&mp->mnt_vnodelist, vp, v_mntvnodes);
2080 }
2081 if (vp->v_lflag & VNAMED_MOUNT) {
2082 panic("insmntque: vp already in mount vnode list");
2083 }
2084 vnode_hold(vp);
2085 vp->v_lflag |= VNAMED_MOUNT;
2086 mount_ref(mp, 1);
2087 mount_unlock(mp);
2088 }
2089 }
2090
2091
2092 /*
2093 * Create a vnode for a block device.
2094 * Used for root filesystem, argdev, and swap areas.
2095 * Also used for memory file system special devices.
2096 */
2097 int
bdevvp(dev_t dev,vnode_t * vpp)2098 bdevvp(dev_t dev, vnode_t *vpp)
2099 {
2100 vnode_t nvp;
2101 int error;
2102 struct vnode_fsparam vfsp;
2103 struct vfs_context context;
2104
2105 if (dev == NODEV) {
2106 *vpp = NULLVP;
2107 return ENODEV;
2108 }
2109
2110 context.vc_thread = current_thread();
2111 context.vc_ucred = FSCRED;
2112
2113 vfsp.vnfs_mp = (struct mount *)0;
2114 vfsp.vnfs_vtype = VBLK;
2115 vfsp.vnfs_str = "bdevvp";
2116 vfsp.vnfs_dvp = NULL;
2117 vfsp.vnfs_fsnode = NULL;
2118 vfsp.vnfs_cnp = NULL;
2119 vfsp.vnfs_vops = spec_vnodeop_p;
2120 vfsp.vnfs_rdev = dev;
2121 vfsp.vnfs_filesize = 0;
2122
2123 vfsp.vnfs_flags = VNFS_NOCACHE | VNFS_CANTCACHE;
2124
2125 vfsp.vnfs_marksystem = 0;
2126 vfsp.vnfs_markroot = 0;
2127
2128 if ((error = vnode_create(VNCREATE_FLAVOR, VCREATESIZE, &vfsp, &nvp))) {
2129 *vpp = NULLVP;
2130 return error;
2131 }
2132 vnode_lock_spin(nvp);
2133 nvp->v_flag |= VBDEVVP;
2134 nvp->v_tag = VT_NON; /* set this to VT_NON so during aliasing it can be replaced */
2135 vnode_unlock(nvp);
2136 if ((error = vnode_ref(nvp))) {
2137 panic("bdevvp failed: vnode_ref");
2138 return error;
2139 }
2140 if ((error = VNOP_FSYNC(nvp, MNT_WAIT, &context))) {
2141 panic("bdevvp failed: fsync");
2142 return error;
2143 }
2144 if ((error = buf_invalidateblks(nvp, BUF_WRITE_DATA, 0, 0))) {
2145 panic("bdevvp failed: invalidateblks");
2146 return error;
2147 }
2148
2149 #if CONFIG_MACF
2150 /*
2151 * XXXMAC: We can't put a MAC check here, the system will
2152 * panic without this vnode.
2153 */
2154 #endif /* MAC */
2155
2156 if ((error = VNOP_OPEN(nvp, FREAD, &context))) {
2157 panic("bdevvp failed: open");
2158 return error;
2159 }
2160 *vpp = nvp;
2161
2162 return 0;
2163 }
2164
2165 /*
2166 * Check to see if the new vnode represents a special device
2167 * for which we already have a vnode (either because of
2168 * bdevvp() or because of a different vnode representing
2169 * the same block device). If such an alias exists, deallocate
2170 * the existing contents and return the aliased vnode. The
2171 * caller is responsible for filling it with its new contents.
2172 */
2173 static vnode_t
checkalias(struct vnode * nvp,dev_t nvp_rdev)2174 checkalias(struct vnode *nvp, dev_t nvp_rdev)
2175 {
2176 struct vnode *vp;
2177 struct vnode **vpp;
2178 struct specinfo *sin = NULL;
2179 int vid = 0;
2180
2181 vpp = &speclisth[SPECHASH(nvp_rdev)];
2182 loop:
2183 SPECHASH_LOCK();
2184
2185 for (vp = *vpp; vp; vp = vp->v_specnext) {
2186 if (nvp_rdev == vp->v_rdev && nvp->v_type == vp->v_type) {
2187 vid = vp->v_id;
2188 vnode_hold(vp);
2189 break;
2190 }
2191 }
2192 SPECHASH_UNLOCK();
2193
2194 if (vp) {
2195 found_alias:
2196 if (vnode_getwithvid(vp, vid)) {
2197 vnode_drop(vp);
2198 goto loop;
2199 }
2200 vnode_drop(vp);
2201 /*
2202 * Termination state is checked in vnode_getwithvid
2203 */
2204 vnode_lock(vp);
2205
2206 /*
2207 * Alias, but not in use, so flush it out.
2208 */
2209 if ((vp->v_iocount == 1) && (vp->v_usecount == 0)) {
2210 vnode_hold(vp);
2211 vnode_reclaim_internal(vp, 1, 1, 0);
2212 vnode_put_locked(vp);
2213 vnode_drop_and_unlock(vp);
2214 goto loop;
2215 }
2216 }
2217 if (vp == NULL || vp->v_tag != VT_NON) {
2218 if (sin == NULL) {
2219 sin = zalloc_flags(specinfo_zone, Z_WAITOK | Z_ZERO);
2220 } else {
2221 bzero(sin, sizeof(struct specinfo));
2222 }
2223
2224 nvp->v_specinfo = sin;
2225 nvp->v_rdev = nvp_rdev;
2226 nvp->v_specflags = 0;
2227 nvp->v_speclastr = -1;
2228 nvp->v_specinfo->si_opencount = 0;
2229 nvp->v_specinfo->si_initted = 0;
2230 nvp->v_specinfo->si_throttleable = 0;
2231 nvp->v_specinfo->si_devbsdunit = LOWPRI_MAX_NUM_DEV;
2232
2233 SPECHASH_LOCK();
2234
2235 /* We dropped the lock, someone could have added */
2236 if (vp == NULLVP) {
2237 for (vp = *vpp; vp; vp = vp->v_specnext) {
2238 if (nvp_rdev == vp->v_rdev && nvp->v_type == vp->v_type) {
2239 vid = vp->v_id;
2240 vnode_hold(vp);
2241 SPECHASH_UNLOCK();
2242 goto found_alias;
2243 }
2244 }
2245 }
2246
2247 nvp->v_hashchain = vpp;
2248 nvp->v_specnext = *vpp;
2249 *vpp = nvp;
2250
2251 if (vp != NULLVP) {
2252 nvp->v_specflags |= SI_ALIASED;
2253 vp->v_specflags |= SI_ALIASED;
2254 SPECHASH_UNLOCK();
2255 vnode_put_locked(vp);
2256 vnode_unlock(vp);
2257 } else {
2258 SPECHASH_UNLOCK();
2259 }
2260
2261 return NULLVP;
2262 }
2263
2264 if (sin) {
2265 zfree(specinfo_zone, sin);
2266 }
2267
2268 if ((vp->v_flag & (VBDEVVP | VDEVFLUSH)) != 0) {
2269 return vp;
2270 }
2271
2272 panic("checkalias with VT_NON vp that shouldn't: %p", vp);
2273
2274 return vp;
2275 }
2276
2277
2278 /*
2279 * Get a reference on a particular vnode and lock it if requested.
2280 * If the vnode was on the inactive list, remove it from the list.
2281 * If the vnode was on the free list, remove it from the list and
2282 * move it to inactive list as needed.
2283 * The vnode lock bit is set if the vnode is being eliminated in
2284 * vgone. The process is awakened when the transition is completed,
2285 * and an error returned to indicate that the vnode is no longer
2286 * usable (possibly having been changed to a new file system type).
2287 */
2288 int
vget_internal(vnode_t vp,int vid,int vflags)2289 vget_internal(vnode_t vp, int vid, int vflags)
2290 {
2291 int error = 0;
2292
2293 vnode_lock_spin(vp);
2294
2295 if ((vflags & VNODE_WITHREF) && (vp->v_usecount == 0) && (vp->v_iocount == 0)) {
2296 panic("Expected to have usecount or iocount on vnode");
2297 }
2298
2299 if ((vflags & VNODE_WRITEABLE) && (vp->v_writecount == 0)) {
2300 /*
2301 * vnode to be returned only if it has writers opened
2302 */
2303 error = EINVAL;
2304 } else {
2305 error = vnode_getiocount(vp, vid, vflags);
2306 }
2307
2308 vnode_unlock(vp);
2309
2310 return error;
2311 }
2312
2313 /*
2314 * Returns: 0 Success
2315 * ENOENT No such file or directory [terminating]
2316 */
2317 int
vnode_ref(vnode_t vp)2318 vnode_ref(vnode_t vp)
2319 {
2320 return vnode_ref_ext(vp, 0, 0);
2321 }
2322
2323 /*
2324 * Returns: 0 Success
2325 * ENOENT No such file or directory [terminating]
2326 */
2327 int
vnode_ref_ext(vnode_t vp,int fmode,int flags)2328 vnode_ref_ext(vnode_t vp, int fmode, int flags)
2329 {
2330 int error = 0;
2331
2332 vnode_lock_spin(vp);
2333
2334 /*
2335 * once all the current call sites have been fixed to insure they have
2336 * taken an iocount, we can toughen this assert up and insist that the
2337 * iocount is non-zero... a non-zero usecount doesn't insure correctness
2338 */
2339 if (vp->v_iocount <= 0 && vp->v_usecount <= 0) {
2340 panic("vnode_ref_ext: vp %p has no valid reference %d, %d", vp, vp->v_iocount, vp->v_usecount);
2341 }
2342
2343 /*
2344 * if you are the owner of drain/termination, can acquire usecount
2345 */
2346 if ((flags & VNODE_REF_FORCE) == 0) {
2347 if ((vp->v_lflag & (VL_DRAIN | VL_TERMINATE | VL_DEAD))) {
2348 if (vp->v_owner != current_thread()) {
2349 error = ENOENT;
2350 goto out;
2351 }
2352 }
2353 }
2354
2355 /* Enable atomic ops on v_usecount without the vnode lock */
2356 os_atomic_inc(&vp->v_usecount, relaxed);
2357
2358 if (fmode & FWRITE) {
2359 if (++vp->v_writecount <= 0) {
2360 panic("vnode_ref_ext: v_writecount");
2361 }
2362 }
2363 if (fmode & O_EVTONLY) {
2364 if (++vp->v_kusecount <= 0) {
2365 panic("vnode_ref_ext: v_kusecount");
2366 }
2367 }
2368 if (vp->v_flag & VRAGE) {
2369 struct uthread *ut;
2370
2371 ut = current_uthread();
2372
2373 if (!(current_proc()->p_lflag & P_LRAGE_VNODES) &&
2374 !(ut->uu_flag & UT_RAGE_VNODES)) {
2375 /*
2376 * a 'normal' process accessed this vnode
2377 * so make sure its no longer marked
2378 * for rapid aging... also, make sure
2379 * it gets removed from the rage list...
2380 * when v_usecount drops back to 0, it
2381 * will be put back on the real free list
2382 */
2383 vp->v_flag &= ~VRAGE;
2384 vp->v_references = 0;
2385 vnode_list_remove(vp);
2386 }
2387 }
2388 if (vp->v_usecount == 1 && vp->v_type == VREG && !(vp->v_flag & VSYSTEM)) {
2389 if (vp->v_ubcinfo) {
2390 vnode_lock_convert(vp);
2391 memory_object_mark_used(vp->v_ubcinfo->ui_control);
2392 }
2393 }
2394 out:
2395 vnode_unlock(vp);
2396
2397 return error;
2398 }
2399
2400
2401 boolean_t
vnode_on_reliable_media(vnode_t vp)2402 vnode_on_reliable_media(vnode_t vp)
2403 {
2404 mount_t mp = vp->v_mount;
2405
2406 /*
2407 * A NULL mountpoint would imply it's not attached to a any filesystem.
2408 * This can only happen with a vnode created by bdevvp(). We'll consider
2409 * those as not unreliable as the primary use of this function is determine
2410 * which vnodes are to be handed off to the async cleaner thread for
2411 * reclaim.
2412 */
2413 if (!mp || (!(mp->mnt_kern_flag & MNTK_VIRTUALDEV) && (mp->mnt_flag & MNT_LOCAL))) {
2414 return TRUE;
2415 }
2416
2417 return FALSE;
2418 }
2419
2420 static void
vnode_async_list_add_locked(vnode_t vp)2421 vnode_async_list_add_locked(vnode_t vp)
2422 {
2423 if (VONLIST(vp) || (vp->v_lflag & (VL_TERMINATE | VL_DEAD))) {
2424 panic("vnode_async_list_add: %p is in wrong state", vp);
2425 }
2426
2427 TAILQ_INSERT_HEAD(&vnode_async_work_list, vp, v_freelist);
2428 vp->v_listflag |= VLIST_ASYNC_WORK;
2429
2430 async_work_vnodes++;
2431 if (!(vp->v_listflag & VLIST_NO_REUSE)) {
2432 reusablevnodes++;
2433 }
2434 if (vp->v_flag & VCANDEALLOC) {
2435 os_atomic_dec(&busyvnodes, relaxed);
2436 }
2437 }
2438
2439 static void
vnode_async_list_add(vnode_t vp)2440 vnode_async_list_add(vnode_t vp)
2441 {
2442 vnode_list_lock();
2443
2444 if (VONLIST(vp)) {
2445 if (!(vp->v_listflag & VLIST_ASYNC_WORK)) {
2446 vnode_list_remove_locked(vp);
2447 vnode_async_list_add_locked(vp);
2448 }
2449 } else {
2450 vnode_async_list_add_locked(vp);
2451 }
2452
2453 vnode_list_unlock();
2454
2455 wakeup(&vnode_async_work_list);
2456 }
2457
2458
2459 /*
2460 * put the vnode on appropriate free list.
2461 * called with vnode LOCKED
2462 */
2463 static void
vnode_list_add(vnode_t vp)2464 vnode_list_add(vnode_t vp)
2465 {
2466 boolean_t need_dead_wakeup = FALSE;
2467 bool no_busy_decrement = false;
2468
2469 #if DIAGNOSTIC
2470 lck_mtx_assert(&vp->v_lock, LCK_MTX_ASSERT_OWNED);
2471 #endif
2472
2473 again:
2474
2475 /*
2476 * if it is already on a list or non zero references return
2477 */
2478 if (VONLIST(vp) || (vp->v_usecount != 0) || (vp->v_iocount != 0) || (vp->v_lflag & VL_TERMINATE)) {
2479 return;
2480 }
2481
2482 /*
2483 * In vclean, we might have deferred ditching locked buffers
2484 * because something was still referencing them (indicated by
2485 * usecount). We can ditch them now.
2486 */
2487 if (ISSET(vp->v_lflag, VL_DEAD)
2488 && (!LIST_EMPTY(&vp->v_cleanblkhd) || !LIST_EMPTY(&vp->v_dirtyblkhd))) {
2489 ++vp->v_iocount; // Probably not necessary, but harmless
2490 #ifdef CONFIG_IOCOUNT_TRACE
2491 record_vp(vp, 1);
2492 #endif
2493 vnode_unlock(vp);
2494 buf_invalidateblks(vp, BUF_INVALIDATE_LOCKED, 0, 0);
2495 vnode_lock(vp);
2496 vnode_dropiocount(vp);
2497 goto again;
2498 }
2499
2500 vnode_list_lock();
2501
2502 if (!(vp->v_lflag & VL_DEAD) && (vp->v_listflag & VLIST_NO_REUSE)) {
2503 if (!(vp->v_listflag & VLIST_ASYNC_WORK)) {
2504 vnode_async_list_add_locked(vp);
2505 }
2506 no_busy_decrement = true;
2507 } else if ((vp->v_flag & VRAGE) && !(vp->v_lflag & VL_DEAD)) {
2508 /*
2509 * add the new guy to the appropriate end of the RAGE list
2510 */
2511 if ((vp->v_flag & VAGE)) {
2512 TAILQ_INSERT_HEAD(&vnode_rage_list, vp, v_freelist);
2513 } else {
2514 TAILQ_INSERT_TAIL(&vnode_rage_list, vp, v_freelist);
2515 }
2516
2517 vp->v_listflag |= VLIST_RAGE;
2518 ragevnodes++;
2519 reusablevnodes++;
2520 wakeup_laundry_thread();
2521
2522 /*
2523 * reset the timestamp for the last inserted vp on the RAGE
2524 * queue to let new_vnode know that its not ok to start stealing
2525 * from this list... as long as we're actively adding to this list
2526 * we'll push out the vnodes we want to donate to the real free list
2527 * once we stop pushing, we'll let some time elapse before we start
2528 * stealing them in the new_vnode routine
2529 */
2530 microuptime(&rage_tv);
2531 } else {
2532 /*
2533 * if VL_DEAD, insert it at head of the dead list
2534 * else insert at tail of LRU list or at head if VAGE is set
2535 */
2536 if ((vp->v_lflag & VL_DEAD)) {
2537 if (vp->v_flag & VCANDEALLOC) {
2538 TAILQ_INSERT_TAIL(&vnode_dead_list, vp, v_freelist);
2539 if (vp->v_listflag & VLIST_NO_REUSE) {
2540 deadvnodes_noreuse++;
2541 }
2542 } else {
2543 TAILQ_INSERT_HEAD(&vnode_dead_list, vp, v_freelist);
2544 }
2545 vp->v_listflag |= VLIST_DEAD;
2546 deadvnodes++;
2547
2548 if (dead_vnode_wanted) {
2549 dead_vnode_wanted--;
2550 need_dead_wakeup = TRUE;
2551 }
2552 } else if ((vp->v_flag & VAGE)) {
2553 TAILQ_INSERT_HEAD(&vnode_free_list, vp, v_freelist);
2554 vp->v_flag &= ~VAGE;
2555 freevnodes++;
2556 reusablevnodes++;
2557 wakeup_laundry_thread();
2558 } else {
2559 TAILQ_INSERT_TAIL(&vnode_free_list, vp, v_freelist);
2560 freevnodes++;
2561 reusablevnodes++;
2562 wakeup_laundry_thread();
2563 }
2564 }
2565 if ((vp->v_flag & VCANDEALLOC) && !no_busy_decrement) {
2566 os_atomic_dec(&busyvnodes, relaxed);
2567 }
2568 vnode_list_unlock();
2569
2570 if (need_dead_wakeup == TRUE) {
2571 wakeup_one((caddr_t)&dead_vnode_wanted);
2572 }
2573 }
2574
2575
2576 /*
2577 * remove the vnode from appropriate free list.
2578 * called with vnode LOCKED and
2579 * the list lock held
2580 */
2581 static void
vnode_list_remove_locked(vnode_t vp)2582 vnode_list_remove_locked(vnode_t vp)
2583 {
2584 if (VONLIST(vp)) {
2585 /*
2586 * the v_listflag field is
2587 * protected by the vnode_list_lock
2588 */
2589 if (vp->v_listflag & VLIST_RAGE) {
2590 VREMRAGE("vnode_list_remove", vp);
2591 } else if (vp->v_listflag & VLIST_DEAD) {
2592 VREMDEAD("vnode_list_remove", vp);
2593 wakeup_laundry_thread();
2594 } else if (vp->v_listflag & VLIST_ASYNC_WORK) {
2595 VREMASYNC_WORK("vnode_list_remove", vp);
2596 } else {
2597 VREMFREE("vnode_list_remove", vp);
2598 }
2599 if (vp->v_flag & VCANDEALLOC) {
2600 os_atomic_inc(&busyvnodes, relaxed);
2601 }
2602 }
2603 }
2604
2605
2606 /*
2607 * remove the vnode from appropriate free list.
2608 * called with vnode LOCKED
2609 */
2610 static void
vnode_list_remove(vnode_t vp)2611 vnode_list_remove(vnode_t vp)
2612 {
2613 #if DIAGNOSTIC
2614 lck_mtx_assert(&vp->v_lock, LCK_MTX_ASSERT_OWNED);
2615 #endif
2616 /*
2617 * we want to avoid taking the list lock
2618 * in the case where we're not on the free
2619 * list... this will be true for most
2620 * directories and any currently in use files
2621 *
2622 * we're guaranteed that we can't go from
2623 * the not-on-list state to the on-list
2624 * state since we hold the vnode lock...
2625 * all calls to vnode_list_add are done
2626 * under the vnode lock... so we can
2627 * check for that condition (the prevelant one)
2628 * without taking the list lock
2629 */
2630 if (VONLIST(vp)) {
2631 vnode_list_lock();
2632 /*
2633 * however, we're not guaranteed that
2634 * we won't go from the on-list state
2635 * to the not-on-list state until we
2636 * hold the vnode_list_lock... this
2637 * is due to "new_vnode" removing vnodes
2638 * from the free list uder the list_lock
2639 * w/o the vnode lock... so we need to
2640 * check again whether we're currently
2641 * on the free list
2642 */
2643 vnode_list_remove_locked(vp);
2644
2645 vnode_list_unlock();
2646 }
2647 }
2648
2649
2650 void
vnode_rele(vnode_t vp)2651 vnode_rele(vnode_t vp)
2652 {
2653 vnode_rele_internal(vp, 0, 0, 0);
2654 }
2655
2656
2657 void
vnode_rele_ext(vnode_t vp,int fmode,int dont_reenter)2658 vnode_rele_ext(vnode_t vp, int fmode, int dont_reenter)
2659 {
2660 vnode_rele_internal(vp, fmode, dont_reenter, 0);
2661 }
2662
2663
2664 void
vnode_rele_internal(vnode_t vp,int fmode,int dont_reenter,int locked)2665 vnode_rele_internal(vnode_t vp, int fmode, int dont_reenter, int locked)
2666 {
2667 int32_t old_usecount;
2668
2669 if (!locked) {
2670 vnode_hold(vp);
2671 vnode_lock_spin(vp);
2672 }
2673 #if DIAGNOSTIC
2674 else {
2675 lck_mtx_assert(&vp->v_lock, LCK_MTX_ASSERT_OWNED);
2676 }
2677 #endif
2678 /* Enable atomic ops on v_usecount without the vnode lock */
2679 old_usecount = os_atomic_dec_orig(&vp->v_usecount, relaxed);
2680 if (old_usecount < 1) {
2681 /*
2682 * Because we allow atomic ops on usecount (in lookup only, under
2683 * specific conditions of already having a usecount) it is
2684 * possible that when the vnode is examined, its usecount is
2685 * different than what will be printed in this panic message.
2686 */
2687 panic("vnode_rele_ext: vp %p usecount -ve : %d. v_tag = %d, v_type = %d, v_flag = %x.",
2688 vp, old_usecount - 1, vp->v_tag, vp->v_type, vp->v_flag);
2689 }
2690
2691 if (fmode & FWRITE) {
2692 if (--vp->v_writecount < 0) {
2693 panic("vnode_rele_ext: vp %p writecount -ve : %d. v_tag = %d, v_type = %d, v_flag = %x.", vp, vp->v_writecount, vp->v_tag, vp->v_type, vp->v_flag);
2694 }
2695 }
2696 if (fmode & O_EVTONLY) {
2697 if (--vp->v_kusecount < 0) {
2698 panic("vnode_rele_ext: vp %p kusecount -ve : %d. v_tag = %d, v_type = %d, v_flag = %x.", vp, vp->v_kusecount, vp->v_tag, vp->v_type, vp->v_flag);
2699 }
2700 }
2701 if (vp->v_kusecount > vp->v_usecount) {
2702 panic("vnode_rele_ext: vp %p kusecount(%d) out of balance with usecount(%d). v_tag = %d, v_type = %d, v_flag = %x.", vp, vp->v_kusecount, vp->v_usecount, vp->v_tag, vp->v_type, vp->v_flag);
2703 }
2704
2705 if ((vp->v_iocount > 0) || (vp->v_usecount > 0)) {
2706 /*
2707 * vnode is still busy... if we're the last
2708 * usecount, mark for a future call to VNOP_INACTIVE
2709 * when the iocount finally drops to 0
2710 */
2711 if (vp->v_usecount == 0) {
2712 vp->v_lflag |= VL_NEEDINACTIVE;
2713 vp->v_flag &= ~(VNOCACHE_DATA | VRAOFF | VOPENEVT);
2714 }
2715 goto done;
2716 }
2717 vp->v_flag &= ~(VNOCACHE_DATA | VRAOFF | VOPENEVT);
2718
2719 if (ISSET(vp->v_lflag, VL_TERMINATE | VL_DEAD) || dont_reenter) {
2720 /*
2721 * vnode is being cleaned, or
2722 * we've requested that we don't reenter
2723 * the filesystem on this release...in
2724 * the latter case, we'll mark the vnode aged
2725 */
2726 if (dont_reenter) {
2727 if (!(vp->v_lflag & (VL_TERMINATE | VL_DEAD | VL_MARKTERM))) {
2728 vp->v_lflag |= VL_NEEDINACTIVE;
2729
2730 if (vnode_on_reliable_media(vp) == FALSE || vp->v_flag & VISDIRTY) {
2731 vnode_async_list_add(vp);
2732 goto done;
2733 }
2734 }
2735 vp->v_flag |= VAGE;
2736 }
2737 vnode_list_add(vp);
2738
2739 goto done;
2740 }
2741 /*
2742 * at this point both the iocount and usecount
2743 * are zero
2744 * pick up an iocount so that we can call
2745 * VNOP_INACTIVE with the vnode lock unheld
2746 */
2747 vp->v_iocount++;
2748 #ifdef CONFIG_IOCOUNT_TRACE
2749 record_vp(vp, 1);
2750 #endif
2751 vp->v_lflag &= ~VL_NEEDINACTIVE;
2752
2753 if (UBCINFOEXISTS(vp)) {
2754 ubc_cs_free_and_vnode_unlock(vp);
2755 } else {
2756 vnode_unlock(vp);
2757 }
2758
2759 VNOP_INACTIVE(vp, vfs_context_current());
2760
2761 vnode_lock_spin(vp);
2762
2763 /*
2764 * because we dropped the vnode lock to call VNOP_INACTIVE
2765 * the state of the vnode may have changed... we may have
2766 * picked up an iocount, usecount or the MARKTERM may have
2767 * been set... we need to reevaluate the reference counts
2768 * to determine if we can call vnode_reclaim_internal at
2769 * this point... if the reference counts are up, we'll pick
2770 * up the MARKTERM state when they get subsequently dropped
2771 */
2772 if ((vp->v_iocount == 1) && (vp->v_usecount == 0) &&
2773 ((vp->v_lflag & (VL_MARKTERM | VL_TERMINATE | VL_DEAD)) == VL_MARKTERM)) {
2774 struct uthread *ut;
2775
2776 ut = current_uthread();
2777
2778 if (ut->uu_defer_reclaims) {
2779 vp->v_defer_reclaimlist = ut->uu_vreclaims;
2780 ut->uu_vreclaims = vp;
2781 goto done;
2782 }
2783 vnode_lock_convert(vp);
2784 vnode_reclaim_internal(vp, 1, 1, 0);
2785 }
2786 vnode_dropiocount(vp);
2787 vnode_list_add(vp);
2788 done:
2789 if (vp->v_usecount == 0 && vp->v_type == VREG && !(vp->v_flag & VSYSTEM)) {
2790 if (vp->v_ubcinfo) {
2791 vnode_lock_convert(vp);
2792 memory_object_mark_unused(vp->v_ubcinfo->ui_control, (vp->v_flag & VRAGE) == VRAGE);
2793 }
2794 }
2795 if (!locked) {
2796 vnode_drop_and_unlock(vp);
2797 }
2798 return;
2799 }
2800
2801 /*
2802 * Remove any vnodes in the vnode table belonging to mount point mp.
2803 *
2804 * If MNT_NOFORCE is specified, there should not be any active ones,
2805 * return error if any are found (nb: this is a user error, not a
2806 * system error). If MNT_FORCE is specified, detach any active vnodes
2807 * that are found.
2808 */
2809
2810 int
vflush(struct mount * mp,struct vnode * skipvp,int flags)2811 vflush(struct mount *mp, struct vnode *skipvp, int flags)
2812 {
2813 struct vnode *vp;
2814 int busy = 0;
2815 int reclaimed = 0;
2816 int retval;
2817 unsigned int vid;
2818 bool first_try = true;
2819
2820 /*
2821 * See comments in vnode_iterate() for the rationale for this lock
2822 */
2823 mount_iterate_lock(mp);
2824
2825 mount_lock(mp);
2826 vnode_iterate_setup(mp);
2827 /*
2828 * On regular unmounts(not forced) do a
2829 * quick check for vnodes to be in use. This
2830 * preserves the caching of vnodes. automounter
2831 * tries unmounting every so often to see whether
2832 * it is still busy or not.
2833 */
2834 if (((flags & FORCECLOSE) == 0) && ((mp->mnt_kern_flag & MNTK_UNMOUNT_PREFLIGHT) != 0)) {
2835 if (vnode_umount_preflight(mp, skipvp, flags)) {
2836 vnode_iterate_clear(mp);
2837 mount_unlock(mp);
2838 mount_iterate_unlock(mp);
2839 return EBUSY;
2840 }
2841 }
2842 loop:
2843 /* If it returns 0 then there is nothing to do */
2844 retval = vnode_iterate_prepare(mp);
2845
2846 if (retval == 0) {
2847 vnode_iterate_clear(mp);
2848 mount_unlock(mp);
2849 mount_iterate_unlock(mp);
2850 return retval;
2851 }
2852
2853 /* iterate over all the vnodes */
2854 while (!TAILQ_EMPTY(&mp->mnt_workerqueue)) {
2855 vp = TAILQ_FIRST(&mp->mnt_workerqueue);
2856 TAILQ_REMOVE(&mp->mnt_workerqueue, vp, v_mntvnodes);
2857 TAILQ_INSERT_TAIL(&mp->mnt_vnodelist, vp, v_mntvnodes);
2858
2859 if ((vp->v_mount != mp) || (vp == skipvp)) {
2860 continue;
2861 }
2862 vid = vp->v_id;
2863 mount_unlock(mp);
2864
2865 vnode_lock_spin(vp);
2866
2867 // If vnode is already terminating, wait for it...
2868 while (vp->v_id == vid && ISSET(vp->v_lflag, VL_TERMINATE)) {
2869 vp->v_lflag |= VL_TERMWANT;
2870 msleep(&vp->v_lflag, &vp->v_lock, PVFS, "vflush", NULL);
2871 }
2872
2873 if ((vp->v_id != vid) || ISSET(vp->v_lflag, VL_DEAD)) {
2874 vnode_unlock(vp);
2875 mount_lock(mp);
2876 continue;
2877 }
2878
2879 /*
2880 * If requested, skip over vnodes marked VSYSTEM.
2881 * Skip over all vnodes marked VNOFLUSH.
2882 */
2883 if ((flags & SKIPSYSTEM) && ((vp->v_flag & VSYSTEM) ||
2884 (vp->v_flag & VNOFLUSH))) {
2885 vnode_unlock(vp);
2886 mount_lock(mp);
2887 continue;
2888 }
2889 /*
2890 * If requested, skip over vnodes marked VSWAP.
2891 */
2892 if ((flags & SKIPSWAP) && (vp->v_flag & VSWAP)) {
2893 vnode_unlock(vp);
2894 mount_lock(mp);
2895 continue;
2896 }
2897 /*
2898 * If requested, skip over vnodes marked VROOT.
2899 */
2900 if ((flags & SKIPROOT) && (vp->v_flag & VROOT)) {
2901 vnode_unlock(vp);
2902 mount_lock(mp);
2903 continue;
2904 }
2905 /*
2906 * If WRITECLOSE is set, only flush out regular file
2907 * vnodes open for writing.
2908 */
2909 if ((flags & WRITECLOSE) &&
2910 (vp->v_writecount == 0 || vp->v_type != VREG)) {
2911 vnode_unlock(vp);
2912 mount_lock(mp);
2913 continue;
2914 }
2915 /*
2916 * If the real usecount is 0, all we need to do is clear
2917 * out the vnode data structures and we are done.
2918 */
2919 if (((vp->v_usecount == 0) ||
2920 ((vp->v_usecount - vp->v_kusecount) == 0))) {
2921 vnode_lock_convert(vp);
2922 vnode_hold(vp);
2923 vp->v_iocount++; /* so that drain waits for * other iocounts */
2924 #ifdef CONFIG_IOCOUNT_TRACE
2925 record_vp(vp, 1);
2926 #endif
2927 vnode_reclaim_internal(vp, 1, 1, 0);
2928 vnode_dropiocount(vp);
2929 vnode_list_add(vp);
2930 vnode_drop_and_unlock(vp);
2931
2932 reclaimed++;
2933 mount_lock(mp);
2934 continue;
2935 }
2936 /*
2937 * If FORCECLOSE is set, forcibly close the vnode.
2938 * For block or character devices, revert to an
2939 * anonymous device. For all other files, just kill them.
2940 */
2941 if (flags & FORCECLOSE) {
2942 vnode_lock_convert(vp);
2943
2944 if (vp->v_type != VBLK && vp->v_type != VCHR) {
2945 vp->v_iocount++; /* so that drain waits * for other iocounts */
2946 vnode_hold(vp);
2947 #ifdef CONFIG_IOCOUNT_TRACE
2948 record_vp(vp, 1);
2949 #endif
2950 vnode_abort_advlocks(vp);
2951 vnode_reclaim_internal(vp, 1, 1, 0);
2952 vnode_dropiocount(vp);
2953 vnode_list_add(vp);
2954 vnode_drop_and_unlock(vp);
2955 } else {
2956 vnode_hold(vp);
2957 vp->v_lflag |= VL_OPSCHANGE;
2958 vclean(vp, 0);
2959 vp->v_lflag &= ~VL_DEAD;
2960 vp->v_op = spec_vnodeop_p;
2961 vp->v_flag |= VDEVFLUSH;
2962 vnode_drop_and_unlock(vp);
2963 wakeup(&vp->v_lflag); /* chkvnlock is waitng for VL_DEAD to get unset */
2964 }
2965 mount_lock(mp);
2966 continue;
2967 }
2968
2969 /* log vnodes blocking unforced unmounts */
2970 if (print_busy_vnodes && first_try && ((flags & FORCECLOSE) == 0)) {
2971 vprint("vflush - busy vnode", vp);
2972 }
2973
2974 vnode_unlock(vp);
2975 mount_lock(mp);
2976 busy++;
2977 }
2978
2979 /* At this point the worker queue is completed */
2980 if (busy && ((flags & FORCECLOSE) == 0) && reclaimed) {
2981 busy = 0;
2982 reclaimed = 0;
2983 (void)vnode_iterate_reloadq(mp);
2984 first_try = false;
2985 /* returned with mount lock held */
2986 goto loop;
2987 }
2988
2989 /* if new vnodes were created in between retry the reclaim */
2990 if (vnode_iterate_reloadq(mp) != 0) {
2991 if (!(busy && ((flags & FORCECLOSE) == 0))) {
2992 first_try = false;
2993 goto loop;
2994 }
2995 }
2996 vnode_iterate_clear(mp);
2997 mount_unlock(mp);
2998 mount_iterate_unlock(mp);
2999
3000 if (busy && ((flags & FORCECLOSE) == 0)) {
3001 return EBUSY;
3002 }
3003 return 0;
3004 }
3005
3006 long num_recycledvnodes = 0;
3007 /*
3008 * Disassociate the underlying file system from a vnode.
3009 * The vnode lock is held on entry.
3010 */
3011 static void
vclean(vnode_t vp,int flags)3012 vclean(vnode_t vp, int flags)
3013 {
3014 vfs_context_t ctx = vfs_context_current();
3015 int active;
3016 int need_inactive;
3017 int already_terminating;
3018 int clflags = 0;
3019 #if NAMEDSTREAMS
3020 int is_namedstream;
3021 #endif
3022
3023 /*
3024 * Check to see if the vnode is in use.
3025 * If so we have to reference it before we clean it out
3026 * so that its count cannot fall to zero and generate a
3027 * race against ourselves to recycle it.
3028 */
3029 active = vp->v_usecount;
3030
3031 /*
3032 * just in case we missed sending a needed
3033 * VNOP_INACTIVE, we'll do it now
3034 */
3035 need_inactive = (vp->v_lflag & VL_NEEDINACTIVE);
3036
3037 vp->v_lflag &= ~VL_NEEDINACTIVE;
3038
3039 /*
3040 * Prevent the vnode from being recycled or
3041 * brought into use while we clean it out.
3042 */
3043 already_terminating = (vp->v_lflag & VL_TERMINATE);
3044
3045 vp->v_lflag |= VL_TERMINATE;
3046
3047 #if NAMEDSTREAMS
3048 is_namedstream = vnode_isnamedstream(vp);
3049 #endif
3050
3051 vnode_unlock(vp);
3052
3053 OSAddAtomicLong(1, &num_recycledvnodes);
3054
3055 if (flags & DOCLOSE) {
3056 clflags |= IO_NDELAY;
3057 }
3058 if (flags & REVOKEALL) {
3059 clflags |= IO_REVOKE;
3060 }
3061
3062 #if CONFIG_MACF
3063 if (vp->v_mount) {
3064 /*
3065 * It is possible for bdevvp vnodes to not have a mount
3066 * pointer. It's fine to let it get reclaimed without
3067 * notifying.
3068 */
3069 mac_vnode_notify_reclaim(vp);
3070 }
3071 #endif
3072
3073 if (active && (flags & DOCLOSE)) {
3074 VNOP_CLOSE(vp, clflags, ctx);
3075 }
3076
3077 /*
3078 * Clean out any buffers associated with the vnode.
3079 */
3080 if (flags & DOCLOSE) {
3081 if (vp->v_tag == VT_NFS) {
3082 nfs_vinvalbuf(vp, V_SAVE, ctx, 0);
3083 } else {
3084 VNOP_FSYNC(vp, MNT_WAIT, ctx);
3085
3086 /*
3087 * If the vnode is still in use (by the journal for
3088 * example) we don't want to invalidate locked buffers
3089 * here. In that case, either the journal will tidy them
3090 * up, or we will deal with it when the usecount is
3091 * finally released in vnode_rele_internal.
3092 */
3093 buf_invalidateblks(vp, BUF_WRITE_DATA | (active ? 0 : BUF_INVALIDATE_LOCKED), 0, 0);
3094 }
3095 if (UBCINFOEXISTS(vp)) {
3096 /*
3097 * Clean the pages in VM.
3098 */
3099 (void)ubc_msync(vp, (off_t)0, ubc_getsize(vp), NULL, UBC_PUSHALL | UBC_INVALIDATE | UBC_SYNC);
3100 }
3101 }
3102 if (active || need_inactive) {
3103 VNOP_INACTIVE(vp, ctx);
3104 }
3105
3106 #if NAMEDSTREAMS
3107 if ((is_namedstream != 0) && (vp->v_parent != NULLVP)) {
3108 vnode_t pvp = vp->v_parent;
3109
3110 /* Delete the shadow stream file before we reclaim its vnode */
3111 if (vnode_isshadow(vp)) {
3112 vnode_relenamedstream(pvp, vp);
3113 }
3114
3115 /*
3116 * No more streams associated with the parent. We
3117 * have a ref on it, so its identity is stable.
3118 * If the parent is on an opaque volume, then we need to know
3119 * whether it has associated named streams.
3120 */
3121 if (vfs_authopaque(pvp->v_mount)) {
3122 vnode_lock_spin(pvp);
3123 pvp->v_lflag &= ~VL_HASSTREAMS;
3124 vnode_unlock(pvp);
3125 }
3126 }
3127 #endif
3128
3129 vm_object_destroy_reason_t reason = VM_OBJECT_DESTROY_RECLAIM;
3130 bool forced_unmount = vnode_mount(vp) != NULL && (vnode_mount(vp)->mnt_lflag & MNT_LFORCE) != 0;
3131 bool ungraft_heuristic = flags & REVOKEALL;
3132 bool unmount = vnode_mount(vp) != NULL && (vnode_mount(vp)->mnt_lflag & MNT_LUNMOUNT) != 0;
3133 if (forced_unmount) {
3134 reason = VM_OBJECT_DESTROY_FORCED_UNMOUNT;
3135 } else if (ungraft_heuristic) {
3136 reason = VM_OBJECT_DESTROY_UNGRAFT;
3137 } else if (unmount) {
3138 reason = VM_OBJECT_DESTROY_UNMOUNT;
3139 }
3140
3141 /*
3142 * Destroy ubc named reference
3143 * cluster_release is done on this path
3144 * along with dropping the reference on the ucred
3145 * (and in the case of forced unmount of an mmap-ed file,
3146 * the ubc reference on the vnode is dropped here too).
3147 */
3148 ubc_destroy_named(vp, reason);
3149
3150 #if CONFIG_TRIGGERS
3151 /*
3152 * cleanup trigger info from vnode (if any)
3153 */
3154 if (vp->v_resolve) {
3155 vnode_resolver_detach(vp);
3156 }
3157 #endif
3158
3159 #if CONFIG_IO_COMPRESSION_STATS
3160 if ((vp->io_compression_stats)) {
3161 vnode_iocs_record_and_free(vp);
3162 }
3163 #endif /* CONFIG_IO_COMPRESSION_STATS */
3164
3165 /*
3166 * Reclaim the vnode.
3167 */
3168 if (VNOP_RECLAIM(vp, ctx)) {
3169 panic("vclean: cannot reclaim");
3170 }
3171
3172 // make sure the name & parent ptrs get cleaned out!
3173 vnode_update_identity(vp, NULLVP, NULL, 0, 0, VNODE_UPDATE_PARENT | VNODE_UPDATE_NAME | VNODE_UPDATE_PURGE | VNODE_UPDATE_PURGEFIRMLINK);
3174
3175 vnode_lock(vp);
3176
3177 /*
3178 * Remove the vnode from any mount list it might be on. It is not
3179 * safe to do this any earlier because unmount needs to wait for
3180 * any vnodes to terminate and it cannot do that if it cannot find
3181 * them.
3182 */
3183 insmntque(vp, (struct mount *)0);
3184
3185 vp->v_lflag |= VL_DEAD;
3186 vp->v_mount = dead_mountp;
3187 vp->v_op = dead_vnodeop_p;
3188 vp->v_tag = VT_NON;
3189 vp->v_data = NULL;
3190
3191 vp->v_flag &= ~VISDIRTY;
3192
3193 if (already_terminating == 0) {
3194 vp->v_lflag &= ~VL_TERMINATE;
3195 /*
3196 * Done with purge, notify sleepers of the grim news.
3197 */
3198 if (vp->v_lflag & VL_TERMWANT) {
3199 vp->v_lflag &= ~VL_TERMWANT;
3200 wakeup(&vp->v_lflag);
3201 }
3202 }
3203 }
3204
3205 /*
3206 * Eliminate all activity associated with the requested vnode
3207 * and with all vnodes aliased to the requested vnode.
3208 */
3209 int
3210 #if DIAGNOSTIC
vn_revoke(vnode_t vp,int flags,__unused vfs_context_t a_context)3211 vn_revoke(vnode_t vp, int flags, __unused vfs_context_t a_context)
3212 #else
3213 vn_revoke(vnode_t vp, __unused int flags, __unused vfs_context_t a_context)
3214 #endif
3215 {
3216 struct vnode *vq;
3217 int vid;
3218
3219 #if DIAGNOSTIC
3220 if ((flags & REVOKEALL) == 0) {
3221 panic("vnop_revoke");
3222 }
3223 #endif
3224
3225 if (vnode_isaliased(vp)) {
3226 /*
3227 * If a vgone (or vclean) is already in progress,
3228 * return an immediate error
3229 */
3230 if (vp->v_lflag & VL_TERMINATE) {
3231 return ENOENT;
3232 }
3233
3234 /*
3235 * Ensure that vp will not be vgone'd while we
3236 * are eliminating its aliases.
3237 */
3238 SPECHASH_LOCK();
3239 while ((vp->v_specflags & SI_ALIASED)) {
3240 for (vq = *vp->v_hashchain; vq; vq = vq->v_specnext) {
3241 if (vq->v_rdev != vp->v_rdev ||
3242 vq->v_type != vp->v_type || vp == vq) {
3243 continue;
3244 }
3245 vid = vq->v_id;
3246 vnode_hold(vq);
3247 SPECHASH_UNLOCK();
3248 if (vnode_getwithvid(vq, vid)) {
3249 vq = vnode_drop(vq);
3250 SPECHASH_LOCK();
3251 break;
3252 }
3253 vnode_lock(vq);
3254 if (!(vq->v_lflag & VL_TERMINATE)) {
3255 vnode_reclaim_internal(vq, 1, 1, 0);
3256 }
3257 vnode_put_locked(vq);
3258 vq = vnode_drop_and_unlock(vq);
3259 SPECHASH_LOCK();
3260 break;
3261 }
3262 }
3263 SPECHASH_UNLOCK();
3264 }
3265 vnode_lock(vp);
3266 if (vp->v_lflag & VL_TERMINATE) {
3267 vnode_unlock(vp);
3268 return ENOENT;
3269 }
3270 vnode_reclaim_internal(vp, 1, 0, REVOKEALL);
3271 vnode_unlock(vp);
3272
3273 return 0;
3274 }
3275
3276 /*
3277 * Recycle an unused vnode to the front of the free list.
3278 * Release the passed interlock if the vnode will be recycled.
3279 */
3280 int
vnode_recycle(struct vnode * vp)3281 vnode_recycle(struct vnode *vp)
3282 {
3283 vnode_lock_spin(vp);
3284
3285 if (vp->v_iocount || vp->v_usecount) {
3286 vp->v_lflag |= VL_MARKTERM;
3287 vnode_unlock(vp);
3288 return 0;
3289 }
3290 vnode_lock_convert(vp);
3291 vnode_hold(vp);
3292 vnode_reclaim_internal(vp, 1, 0, 0);
3293
3294 vnode_drop_and_unlock(vp);
3295
3296 return 1;
3297 }
3298
3299 static int
vnode_reload(vnode_t vp)3300 vnode_reload(vnode_t vp)
3301 {
3302 vnode_lock_spin(vp);
3303
3304 if ((vp->v_iocount > 1) || vp->v_usecount) {
3305 vnode_unlock(vp);
3306 return 0;
3307 }
3308 if (vp->v_iocount <= 0) {
3309 panic("vnode_reload with no iocount %d", vp->v_iocount);
3310 }
3311
3312 /* mark for release when iocount is dopped */
3313 vp->v_lflag |= VL_MARKTERM;
3314 vnode_unlock(vp);
3315
3316 return 1;
3317 }
3318
3319
3320 static void
vgone(vnode_t vp,int flags)3321 vgone(vnode_t vp, int flags)
3322 {
3323 struct vnode *vq;
3324 struct vnode *vx;
3325
3326 /*
3327 * Clean out the filesystem specific data.
3328 * vclean also takes care of removing the
3329 * vnode from any mount list it might be on
3330 */
3331 vclean(vp, flags | DOCLOSE);
3332
3333 /*
3334 * If special device, remove it from special device alias list
3335 * if it is on one.
3336 */
3337 if ((vp->v_type == VBLK || vp->v_type == VCHR) && vp->v_specinfo != 0) {
3338 SPECHASH_LOCK();
3339 if (*vp->v_hashchain == vp) {
3340 *vp->v_hashchain = vp->v_specnext;
3341 } else {
3342 for (vq = *vp->v_hashchain; vq; vq = vq->v_specnext) {
3343 if (vq->v_specnext != vp) {
3344 continue;
3345 }
3346 vq->v_specnext = vp->v_specnext;
3347 break;
3348 }
3349 if (vq == NULL) {
3350 panic("missing bdev");
3351 }
3352 }
3353 if (vp->v_specflags & SI_ALIASED) {
3354 vx = NULL;
3355 for (vq = *vp->v_hashchain; vq; vq = vq->v_specnext) {
3356 if (vq->v_rdev != vp->v_rdev ||
3357 vq->v_type != vp->v_type) {
3358 continue;
3359 }
3360 if (vx) {
3361 break;
3362 }
3363 vx = vq;
3364 }
3365 if (vx == NULL) {
3366 panic("missing alias");
3367 }
3368 if (vq == NULL) {
3369 vx->v_specflags &= ~SI_ALIASED;
3370 }
3371 vp->v_specflags &= ~SI_ALIASED;
3372 }
3373 SPECHASH_UNLOCK();
3374 {
3375 struct specinfo *tmp = vp->v_specinfo;
3376 vp->v_specinfo = NULL;
3377 zfree(specinfo_zone, tmp);
3378 }
3379 }
3380 }
3381
3382 /*
3383 * internal helper function only!
3384 * vend an _iocounted_ vnode via output argument, or return an error if unable.
3385 */
3386 static int
get_vp_from_dev(dev_t dev,enum vtype type,vnode_t * outvp)3387 get_vp_from_dev(dev_t dev, enum vtype type, vnode_t *outvp)
3388 {
3389 vnode_t vp;
3390 int vid;
3391
3392 loop:
3393 SPECHASH_LOCK();
3394 for (vp = speclisth[SPECHASH(dev)]; vp; vp = vp->v_specnext) {
3395 if (dev != vp->v_rdev || type != vp->v_type) {
3396 continue;
3397 }
3398 vid = vp->v_id;
3399 vnode_hold(vp);
3400 SPECHASH_UNLOCK();
3401
3402 /* acquire iocount */
3403 if (vnode_getwithvid(vp, vid)) {
3404 vnode_drop(vp);
3405 goto loop;
3406 }
3407 vnode_drop(vp);
3408
3409 /* Vend iocounted vnode */
3410 *outvp = vp;
3411 return 0;
3412 }
3413
3414 /* vnode not found, error out */
3415 SPECHASH_UNLOCK();
3416 return ENOENT;
3417 }
3418
3419
3420
3421 /*
3422 * Lookup a vnode by device number.
3423 */
3424 int
check_mountedon(dev_t dev,enum vtype type,int * errorp)3425 check_mountedon(dev_t dev, enum vtype type, int *errorp)
3426 {
3427 vnode_t vp = NULLVP;
3428 int rc = 0;
3429
3430 rc = get_vp_from_dev(dev, type, &vp);
3431 if (rc) {
3432 /* if no vnode found, it cannot be mounted on */
3433 return 0;
3434 }
3435
3436 /* otherwise, examine it */
3437 vnode_lock_spin(vp);
3438 /* note: exclude the iocount we JUST got (e.g. >1, not >0) */
3439 if ((vp->v_usecount > 0) || (vp->v_iocount > 1)) {
3440 vnode_unlock(vp);
3441 if ((*errorp = vfs_mountedon(vp)) != 0) {
3442 rc = 1;
3443 }
3444 } else {
3445 vnode_unlock(vp);
3446 }
3447 /* release iocount! */
3448 vnode_put(vp);
3449
3450 return rc;
3451 }
3452
3453 extern dev_t chrtoblk(dev_t d);
3454
3455 /*
3456 * Examine the supplied vnode's dev_t and find its counterpart
3457 * (e.g. VCHR => VDEV) to compare against.
3458 */
3459 static int
vnode_cmp_paired_dev(vnode_t vp,vnode_t bdev_vp,enum vtype in_type,enum vtype out_type)3460 vnode_cmp_paired_dev(vnode_t vp, vnode_t bdev_vp, enum vtype in_type,
3461 enum vtype out_type)
3462 {
3463 if (!vp || !bdev_vp) {
3464 return EINVAL;
3465 }
3466 /* Verify iocounts */
3467 if (vnode_iocount(vp) <= 0 ||
3468 vnode_iocount(bdev_vp) <= 0) {
3469 return EINVAL;
3470 }
3471
3472 /* check for basic matches */
3473 if (vnode_vtype(vp) != in_type) {
3474 return EINVAL;
3475 }
3476 if (vnode_vtype(bdev_vp) != out_type) {
3477 return EINVAL;
3478 }
3479
3480 dev_t dev = vnode_specrdev(vp);
3481 dev_t blk_devt = vnode_specrdev(bdev_vp);
3482
3483 if (in_type == VCHR) {
3484 if (out_type != VBLK) {
3485 return EINVAL;
3486 }
3487 dev_t bdev = chrtoblk(dev);
3488 if (bdev == NODEV) {
3489 return EINVAL;
3490 } else if (bdev == blk_devt) {
3491 return 0;
3492 }
3493 //fall through
3494 }
3495 /*
3496 * else case:
3497 *
3498 * in_type == VBLK? => VCHR?
3499 * not implemented...
3500 * exercise to the reader: this can be built by
3501 * taking the device's major, and iterating the `chrtoblktab`
3502 * array to look for a value that matches.
3503 */
3504 return EINVAL;
3505 }
3506 /*
3507 * Vnode compare: does the supplied vnode's CHR device, match the dev_t
3508 * of the accompanying `blk_vp` ?
3509 * NOTE: vnodes MUST be iocounted BEFORE calling this!
3510 */
3511
3512 int
vnode_cmp_chrtoblk(vnode_t vp,vnode_t blk_vp)3513 vnode_cmp_chrtoblk(vnode_t vp, vnode_t blk_vp)
3514 {
3515 return vnode_cmp_paired_dev(vp, blk_vp, VCHR, VBLK);
3516 }
3517
3518
3519
3520 /*
3521 * Calculate the total number of references to a special device.
3522 */
3523 int
vcount(vnode_t vp)3524 vcount(vnode_t vp)
3525 {
3526 vnode_t vq, vnext;
3527 int count;
3528 int vid;
3529
3530 if (!vnode_isspec(vp)) {
3531 return vp->v_usecount - vp->v_kusecount;
3532 }
3533
3534 loop:
3535 if (!vnode_isaliased(vp)) {
3536 return vp->v_specinfo->si_opencount;
3537 }
3538 count = 0;
3539
3540 SPECHASH_LOCK();
3541 /*
3542 * Grab first vnode and its vid.
3543 */
3544 vq = *vp->v_hashchain;
3545 if (vq) {
3546 vid = vq->v_id;
3547 vnode_hold(vq);
3548 } else {
3549 vid = 0;
3550 }
3551 SPECHASH_UNLOCK();
3552
3553 while (vq) {
3554 /*
3555 * Attempt to get the vnode outside the SPECHASH lock.
3556 * Don't take iocount on 'vp' as iocount is already held by the caller.
3557 */
3558 if ((vq != vp) && vnode_getwithvid(vq, vid)) {
3559 vnode_drop(vq);
3560 goto loop;
3561 }
3562 vnode_drop(vq);
3563 vnode_lock(vq);
3564
3565 if (vq->v_rdev == vp->v_rdev && vq->v_type == vp->v_type) {
3566 if ((vq->v_usecount == 0) && (vq->v_iocount == 1) && vq != vp) {
3567 /*
3568 * Alias, but not in use, so flush it out.
3569 */
3570 vnode_hold(vq);
3571 vnode_reclaim_internal(vq, 1, 1, 0);
3572 vnode_put_locked(vq);
3573 vnode_drop_and_unlock(vq);
3574 goto loop;
3575 }
3576 count += vq->v_specinfo->si_opencount;
3577 }
3578 vnode_unlock(vq);
3579
3580 SPECHASH_LOCK();
3581 /*
3582 * must do this with the reference still held on 'vq'
3583 * so that it can't be destroyed while we're poking
3584 * through v_specnext
3585 */
3586 vnext = vq->v_specnext;
3587 if (vnext) {
3588 vid = vnext->v_id;
3589 vnode_hold(vnext);
3590 } else {
3591 vid = 0;
3592 }
3593 SPECHASH_UNLOCK();
3594
3595 if (vq != vp) {
3596 vnode_put(vq);
3597 }
3598
3599 vq = vnext;
3600 }
3601
3602 return count;
3603 }
3604
3605 int prtactive = 0; /* 1 => print out reclaim of active vnodes */
3606
3607 /*
3608 * Print out a description of a vnode.
3609 */
3610 static const char *typename[] =
3611 { "VNON", "VREG", "VDIR", "VBLK", "VCHR", "VLNK", "VSOCK", "VFIFO", "VBAD" };
3612
3613 void
vprint(const char * label,struct vnode * vp)3614 vprint(const char *label, struct vnode *vp)
3615 {
3616 char sbuf[64];
3617
3618 if (label != NULL) {
3619 printf("%s: ", label);
3620 }
3621 printf("name %s type %s, usecount %d, writecount %d\n",
3622 vp->v_name, typename[vp->v_type],
3623 vp->v_usecount, vp->v_writecount);
3624 sbuf[0] = '\0';
3625 if (vp->v_flag & VROOT) {
3626 strlcat(sbuf, "|VROOT", sizeof(sbuf));
3627 }
3628 if (vp->v_flag & VTEXT) {
3629 strlcat(sbuf, "|VTEXT", sizeof(sbuf));
3630 }
3631 if (vp->v_flag & VSYSTEM) {
3632 strlcat(sbuf, "|VSYSTEM", sizeof(sbuf));
3633 }
3634 if (vp->v_flag & VNOFLUSH) {
3635 strlcat(sbuf, "|VNOFLUSH", sizeof(sbuf));
3636 }
3637 if (vp->v_flag & VBWAIT) {
3638 strlcat(sbuf, "|VBWAIT", sizeof(sbuf));
3639 }
3640 if (vnode_isaliased(vp)) {
3641 strlcat(sbuf, "|VALIASED", sizeof(sbuf));
3642 }
3643 if (sbuf[0] != '\0') {
3644 printf("vnode flags (%s\n", &sbuf[1]);
3645 }
3646 }
3647
3648 static int
vn_getpath_flags_to_buildpath_flags(int flags)3649 vn_getpath_flags_to_buildpath_flags(int flags)
3650 {
3651 int bpflags = (flags & VN_GETPATH_FSENTER) ? 0 : BUILDPATH_NO_FS_ENTER;
3652
3653 if (flags && (flags != VN_GETPATH_FSENTER)) {
3654 if (flags & VN_GETPATH_NO_FIRMLINK) {
3655 bpflags |= BUILDPATH_NO_FIRMLINK;
3656 }
3657 if (flags & VN_GETPATH_VOLUME_RELATIVE) {
3658 bpflags |= (BUILDPATH_VOLUME_RELATIVE |
3659 BUILDPATH_NO_FIRMLINK);
3660 }
3661 if (flags & VN_GETPATH_NO_PROCROOT) {
3662 bpflags |= BUILDPATH_NO_PROCROOT;
3663 }
3664 if (flags & VN_GETPATH_CHECK_MOVED) {
3665 bpflags |= BUILDPATH_CHECK_MOVED;
3666 }
3667 }
3668
3669 return bpflags;
3670 }
3671
3672 int
vn_getpath_ext_with_mntlen(struct vnode * vp,struct vnode * dvp,char * pathbuf,size_t * len,size_t * mntlen,int flags)3673 vn_getpath_ext_with_mntlen(struct vnode *vp, struct vnode *dvp, char *pathbuf,
3674 size_t *len, size_t *mntlen, int flags)
3675 {
3676 int bpflags = vn_getpath_flags_to_buildpath_flags(flags);
3677 int local_len;
3678 int error;
3679
3680 if (*len > INT_MAX) {
3681 return EINVAL;
3682 }
3683
3684 local_len = *len;
3685
3686 error = build_path_with_parent(vp, dvp, pathbuf, local_len, &local_len,
3687 mntlen, bpflags, vfs_context_current());
3688
3689 if (local_len >= 0 && local_len <= (int)*len) {
3690 *len = (size_t)local_len;
3691 }
3692
3693 return error;
3694 }
3695
3696 int
vn_getpath_ext(struct vnode * vp,struct vnode * dvp,char * pathbuf,size_t * len,int flags)3697 vn_getpath_ext(struct vnode *vp, struct vnode *dvp, char *pathbuf, size_t *len,
3698 int flags)
3699 {
3700 return vn_getpath_ext_with_mntlen(vp, dvp, pathbuf, len, NULL, flags);
3701 }
3702
3703 /*
3704 * Wrapper around vn_getpath_ext() that takes care of the int * <-> size_t *
3705 * conversion for the legacy KPIs.
3706 */
3707 static int
vn_getpath_ext_int(struct vnode * vp,struct vnode * dvp,char * pathbuf,int * len,int flags)3708 vn_getpath_ext_int(struct vnode *vp, struct vnode *dvp, char *pathbuf,
3709 int *len, int flags)
3710 {
3711 size_t slen = *len;
3712 int error;
3713
3714 if (*len < 0) {
3715 return EINVAL;
3716 }
3717
3718 error = vn_getpath_ext(vp, dvp, pathbuf, &slen, flags);
3719
3720 if (slen <= INT_MAX) {
3721 *len = (int)slen;
3722 }
3723
3724 return error;
3725 }
3726
3727 int
vn_getpath(struct vnode * vp,char * pathbuf,int * len)3728 vn_getpath(struct vnode *vp, char *pathbuf, int *len)
3729 {
3730 return vn_getpath_ext_int(vp, NULL, pathbuf, len, 0);
3731 }
3732
3733 int
vn_getpath_fsenter(struct vnode * vp,char * pathbuf,int * len)3734 vn_getpath_fsenter(struct vnode *vp, char *pathbuf, int *len)
3735 {
3736 return vn_getpath_ext_int(vp, NULL, pathbuf, len, VN_GETPATH_FSENTER);
3737 }
3738
3739 /*
3740 * vn_getpath_fsenter_with_parent will reenter the file system to fine the path of the
3741 * vnode. It requires that there are IO counts on both the vnode and the directory vnode.
3742 *
3743 * vn_getpath_fsenter is called by MAC hooks to authorize operations for every thing, but
3744 * unlink, rmdir and rename. For these operation the MAC hook calls vn_getpath. This presents
3745 * problems where if the path can not be found from the name cache, those operations can
3746 * erroneously fail with EPERM even though the call should succeed. When removing or moving
3747 * file system objects with operations such as unlink or rename, those operations need to
3748 * take IO counts on the target and containing directory. Calling vn_getpath_fsenter from a
3749 * MAC hook from these operations during forced unmount operations can lead to dead
3750 * lock. This happens when the operation starts, IO counts are taken on the containing
3751 * directories and targets. Before the MAC hook is called a forced unmount from another
3752 * thread takes place and blocks on the on going operation's directory vnode in vdrain.
3753 * After which, the MAC hook gets called and calls vn_getpath_fsenter. vn_getpath_fsenter
3754 * is called with the understanding that there is an IO count on the target. If in
3755 * build_path the directory vnode is no longer in the cache, then the parent object id via
3756 * vnode_getattr from the target is obtain and used to call VFS_VGET to get the parent
3757 * vnode. The file system's VFS_VGET then looks up by inode in its hash and tries to get
3758 * an IO count. But VFS_VGET "sees" the directory vnode is in vdrain and can block
3759 * depending on which version and how it calls the vnode_get family of interfaces.
3760 *
3761 * N.B. A reasonable interface to use is vnode_getwithvid. This interface was modified to
3762 * call vnode_getiocount with VNODE_DRAINO, so it will happily get an IO count and not
3763 * cause issues, but there is no guarantee that all or any file systems are doing that.
3764 *
3765 * vn_getpath_fsenter_with_parent can enter the file system safely since there is a known
3766 * IO count on the directory vnode by calling build_path_with_parent.
3767 */
3768
3769 int
vn_getpath_fsenter_with_parent(struct vnode * dvp,struct vnode * vp,char * pathbuf,int * len)3770 vn_getpath_fsenter_with_parent(struct vnode *dvp, struct vnode *vp, char *pathbuf, int *len)
3771 {
3772 return build_path_with_parent(vp, dvp, pathbuf, *len, len, NULL, 0, vfs_context_current());
3773 }
3774
3775 int
vn_getpath_no_firmlink(struct vnode * vp,char * pathbuf,int * len)3776 vn_getpath_no_firmlink(struct vnode *vp, char *pathbuf, int *len)
3777 {
3778 return vn_getpath_ext_int(vp, NULLVP, pathbuf, len,
3779 VN_GETPATH_NO_FIRMLINK);
3780 }
3781
3782 int
vn_getcdhash(struct vnode * vp,off_t offset,unsigned char * cdhash,uint8_t * type)3783 vn_getcdhash(struct vnode *vp, off_t offset, unsigned char *cdhash, uint8_t *type)
3784 {
3785 return ubc_cs_getcdhash(vp, offset, cdhash, type);
3786 }
3787
3788
3789 static char *extension_table = NULL;
3790 static int nexts;
3791 static int max_ext_width;
3792
3793 static int
extension_cmp(const void * a,const void * b)3794 extension_cmp(const void *a, const void *b)
3795 {
3796 return (int)(strlen((const char *)a) - strlen((const char *)b));
3797 }
3798
3799
3800 //
3801 // This is the api LaunchServices uses to inform the kernel
3802 // the list of package extensions to ignore.
3803 //
3804 // Internally we keep the list sorted by the length of the
3805 // the extension (from longest to shortest). We sort the
3806 // list of extensions so that we can speed up our searches
3807 // when comparing file names -- we only compare extensions
3808 // that could possibly fit into the file name, not all of
3809 // them (i.e. a short 8 character name can't have an 8
3810 // character extension).
3811 //
3812 extern lck_mtx_t pkg_extensions_lck;
3813
3814 __private_extern__ int
set_package_extensions_table(user_addr_t data,int nentries,int maxwidth)3815 set_package_extensions_table(user_addr_t data, int nentries, int maxwidth)
3816 {
3817 char *new_exts, *old_exts;
3818 int old_nentries = 0, old_maxwidth = 0;
3819 int error;
3820
3821 if (nentries <= 0 || nentries > 1024 || maxwidth <= 0 || maxwidth > 255) {
3822 return EINVAL;
3823 }
3824
3825
3826 // allocate one byte extra so we can guarantee null termination
3827 new_exts = kalloc_data((nentries * maxwidth) + 1, Z_WAITOK);
3828 if (new_exts == NULL) {
3829 return ENOMEM;
3830 }
3831
3832 error = copyin(data, new_exts, nentries * maxwidth);
3833 if (error) {
3834 kfree_data(new_exts, (nentries * maxwidth) + 1);
3835 return error;
3836 }
3837
3838 new_exts[(nentries * maxwidth)] = '\0'; // guarantee null termination of the block
3839
3840 qsort(new_exts, nentries, maxwidth, extension_cmp);
3841
3842 lck_mtx_lock(&pkg_extensions_lck);
3843
3844 old_exts = extension_table;
3845 old_nentries = nexts;
3846 old_maxwidth = max_ext_width;
3847 extension_table = new_exts;
3848 nexts = nentries;
3849 max_ext_width = maxwidth;
3850
3851 lck_mtx_unlock(&pkg_extensions_lck);
3852
3853 kfree_data(old_exts, (old_nentries * old_maxwidth) + 1);
3854
3855 return 0;
3856 }
3857
3858
3859 int
is_package_name(const char * name,int len)3860 is_package_name(const char *name, int len)
3861 {
3862 int i;
3863 size_t extlen;
3864 const char *ptr, *name_ext;
3865
3866 // if the name is less than 3 bytes it can't be of the
3867 // form A.B and if it begins with a "." then it is also
3868 // not a package.
3869 if (len <= 3 || name[0] == '.') {
3870 return 0;
3871 }
3872
3873 name_ext = NULL;
3874 for (ptr = name; *ptr != '\0'; ptr++) {
3875 if (*ptr == '.') {
3876 name_ext = ptr;
3877 }
3878 }
3879
3880 // if there is no "." extension, it can't match
3881 if (name_ext == NULL) {
3882 return 0;
3883 }
3884
3885 // advance over the "."
3886 name_ext++;
3887
3888 lck_mtx_lock(&pkg_extensions_lck);
3889
3890 // now iterate over all the extensions to see if any match
3891 ptr = &extension_table[0];
3892 for (i = 0; i < nexts; i++, ptr += max_ext_width) {
3893 extlen = strlen(ptr);
3894 if (strncasecmp(name_ext, ptr, extlen) == 0 && name_ext[extlen] == '\0') {
3895 // aha, a match!
3896 lck_mtx_unlock(&pkg_extensions_lck);
3897 return 1;
3898 }
3899 }
3900
3901 lck_mtx_unlock(&pkg_extensions_lck);
3902
3903 // if we get here, no extension matched
3904 return 0;
3905 }
3906
3907 int
vn_path_package_check(__unused vnode_t vp,char * path,int pathlen,int * component)3908 vn_path_package_check(__unused vnode_t vp, char *path, int pathlen, int *component)
3909 {
3910 char *ptr, *end;
3911 int comp = 0;
3912
3913 if (pathlen < 0) {
3914 return EINVAL;
3915 }
3916
3917 *component = -1;
3918 if (*path != '/') {
3919 return EINVAL;
3920 }
3921
3922 end = path + 1;
3923 while (end < path + pathlen && *end != '\0') {
3924 while (end < path + pathlen && *end == '/' && *end != '\0') {
3925 end++;
3926 }
3927
3928 ptr = end;
3929
3930 while (end < path + pathlen && *end != '/' && *end != '\0') {
3931 end++;
3932 }
3933
3934 if (end > path + pathlen) {
3935 // hmm, string wasn't null terminated
3936 return EINVAL;
3937 }
3938
3939 *end = '\0';
3940 if (is_package_name(ptr, (int)(end - ptr))) {
3941 *component = comp;
3942 break;
3943 }
3944
3945 end++;
3946 comp++;
3947 }
3948
3949 return 0;
3950 }
3951
3952 /*
3953 * Determine if a name is inappropriate for a searchfs query.
3954 * This list consists of /System currently.
3955 */
3956
3957 int
vn_searchfs_inappropriate_name(const char * name,int len)3958 vn_searchfs_inappropriate_name(const char *name, int len)
3959 {
3960 const char *bad_names[] = { "System" };
3961 int bad_len[] = { 6 };
3962 int i;
3963
3964 if (len < 0) {
3965 return EINVAL;
3966 }
3967
3968 for (i = 0; i < (int) (sizeof(bad_names) / sizeof(bad_names[0])); i++) {
3969 if (len == bad_len[i] && strncmp(name, bad_names[i], strlen(bad_names[i]) + 1) == 0) {
3970 return 1;
3971 }
3972 }
3973
3974 // if we get here, no name matched
3975 return 0;
3976 }
3977
3978 /*
3979 * Top level filesystem related information gathering.
3980 */
3981 extern unsigned int vfs_nummntops;
3982
3983 /*
3984 * The VFS_NUMMNTOPS shouldn't be at name[1] since
3985 * is a VFS generic variable. Since we no longer support
3986 * VT_UFS, we reserve its value to support this sysctl node.
3987 *
3988 * It should have been:
3989 * name[0]: VFS_GENERIC
3990 * name[1]: VFS_NUMMNTOPS
3991 */
3992 SYSCTL_INT(_vfs, VFS_NUMMNTOPS, nummntops,
3993 CTLFLAG_RD | CTLFLAG_KERN | CTLFLAG_LOCKED,
3994 &vfs_nummntops, 0, "");
3995
3996 int
3997 vfs_sysctl(int *name __unused, u_int namelen __unused,
3998 user_addr_t oldp __unused, size_t *oldlenp __unused,
3999 user_addr_t newp __unused, size_t newlen __unused, proc_t p __unused);
4000
4001 int
vfs_sysctl(int * name __unused,u_int namelen __unused,user_addr_t oldp __unused,size_t * oldlenp __unused,user_addr_t newp __unused,size_t newlen __unused,proc_t p __unused)4002 vfs_sysctl(int *name __unused, u_int namelen __unused,
4003 user_addr_t oldp __unused, size_t *oldlenp __unused,
4004 user_addr_t newp __unused, size_t newlen __unused, proc_t p __unused)
4005 {
4006 return EINVAL;
4007 }
4008
4009
4010 //
4011 // The following code disallows specific sysctl's that came through
4012 // the direct sysctl interface (vfs_sysctl_node) instead of the newer
4013 // sysctl_vfs_ctlbyfsid() interface. We can not allow these selectors
4014 // through vfs_sysctl_node() because it passes the user's oldp pointer
4015 // directly to the file system which (for these selectors) casts it
4016 // back to a struct sysctl_req and then proceed to use SYSCTL_IN()
4017 // which jumps through an arbitrary function pointer. When called
4018 // through the sysctl_vfs_ctlbyfsid() interface this does not happen
4019 // and so it's safe.
4020 //
4021 // Unfortunately we have to pull in definitions from AFP and SMB and
4022 // perform explicit name checks on the file system to determine if
4023 // these selectors are being used.
4024 //
4025
4026 #define AFPFS_VFS_CTL_GETID 0x00020001
4027 #define AFPFS_VFS_CTL_NETCHANGE 0x00020002
4028 #define AFPFS_VFS_CTL_VOLCHANGE 0x00020003
4029
4030 #define SMBFS_SYSCTL_REMOUNT 1
4031 #define SMBFS_SYSCTL_REMOUNT_INFO 2
4032 #define SMBFS_SYSCTL_GET_SERVER_SHARE 3
4033
4034
4035 static int
is_bad_sysctl_name(struct vfstable * vfsp,int selector_name)4036 is_bad_sysctl_name(struct vfstable *vfsp, int selector_name)
4037 {
4038 switch (selector_name) {
4039 case VFS_CTL_QUERY:
4040 case VFS_CTL_TIMEO:
4041 case VFS_CTL_NOLOCKS:
4042 case VFS_CTL_NSTATUS:
4043 case VFS_CTL_SADDR:
4044 case VFS_CTL_DISC:
4045 case VFS_CTL_SERVERINFO:
4046 return 1;
4047
4048 default:
4049 break;
4050 }
4051
4052 // the more complicated check for some of SMB's special values
4053 if (strcmp(vfsp->vfc_name, "smbfs") == 0) {
4054 switch (selector_name) {
4055 case SMBFS_SYSCTL_REMOUNT:
4056 case SMBFS_SYSCTL_REMOUNT_INFO:
4057 case SMBFS_SYSCTL_GET_SERVER_SHARE:
4058 return 1;
4059 }
4060 } else if (strcmp(vfsp->vfc_name, "afpfs") == 0) {
4061 switch (selector_name) {
4062 case AFPFS_VFS_CTL_GETID:
4063 case AFPFS_VFS_CTL_NETCHANGE:
4064 case AFPFS_VFS_CTL_VOLCHANGE:
4065 return 1;
4066 }
4067 }
4068
4069 //
4070 // If we get here we passed all the checks so the selector is ok
4071 //
4072 return 0;
4073 }
4074
4075
4076 int vfs_sysctl_node SYSCTL_HANDLER_ARGS
4077 {
4078 int *name, namelen;
4079 struct vfstable *vfsp;
4080 int error;
4081 int fstypenum;
4082
4083 fstypenum = oidp->oid_number;
4084 name = arg1;
4085 namelen = arg2;
4086
4087 /* all sysctl names at this level should have at least one name slot for the FS */
4088 if (namelen < 1) {
4089 return EISDIR; /* overloaded */
4090 }
4091 mount_list_lock();
4092 for (vfsp = vfsconf; vfsp; vfsp = vfsp->vfc_next) {
4093 if (vfsp->vfc_typenum == fstypenum) {
4094 vfsp->vfc_refcount++;
4095 break;
4096 }
4097 }
4098 mount_list_unlock();
4099
4100 if (vfsp == NULL) {
4101 return ENOTSUP;
4102 }
4103
4104 if (is_bad_sysctl_name(vfsp, name[0])) {
4105 printf("vfs: bad selector 0x%.8x for old-style sysctl(). use the sysctl-by-fsid interface instead\n", name[0]);
4106 error = EPERM;
4107 } else {
4108 error = (vfsp->vfc_vfsops->vfs_sysctl)(name, namelen,
4109 req->oldptr, &req->oldlen, req->newptr, req->newlen,
4110 vfs_context_current());
4111 }
4112
4113 mount_list_lock();
4114 vfsp->vfc_refcount--;
4115 mount_list_unlock();
4116
4117 return error;
4118 }
4119
4120 /*
4121 * Check to see if a filesystem is mounted on a block device.
4122 */
4123 int
vfs_mountedon(struct vnode * vp)4124 vfs_mountedon(struct vnode *vp)
4125 {
4126 struct vnode *vq;
4127 int error = 0;
4128
4129 restart:
4130 SPECHASH_LOCK();
4131 if (vp->v_specflags & SI_MOUNTING && (vp->v_specinfo->si_mountingowner != current_thread())) {
4132 msleep((caddr_t)&vp->v_specflags, SPECHASH_LOCK_ADDR(), PVFS | PDROP, "vnode_waitformounting", NULL);
4133 goto restart;
4134 }
4135 if (vp->v_specflags & SI_MOUNTEDON) {
4136 error = EBUSY;
4137 goto out;
4138 }
4139 if (vp->v_specflags & SI_ALIASED) {
4140 for (vq = *vp->v_hashchain; vq; vq = vq->v_specnext) {
4141 if (vq->v_rdev != vp->v_rdev ||
4142 vq->v_type != vp->v_type || vq == vp) {
4143 continue;
4144 }
4145 if (vq->v_specflags & SI_MOUNTING) {
4146 msleep((caddr_t)&vq->v_specflags, SPECHASH_LOCK_ADDR(), PVFS | PDROP, "vnode_waitformounting", NULL);
4147 goto restart;
4148 }
4149 if (vq->v_specflags & SI_MOUNTEDON) {
4150 error = EBUSY;
4151 break;
4152 }
4153 }
4154 }
4155 out:
4156 SPECHASH_UNLOCK();
4157 return error;
4158 }
4159
4160 void
vfs_setmountedon(vnode_t vp)4161 vfs_setmountedon(vnode_t vp)
4162 {
4163 vnode_lock(vp);
4164 SPECHASH_LOCK();
4165 vp->v_specflags |= SI_MOUNTEDON;
4166 vp->v_specflags &= ~SI_MOUNTING;
4167 vp->v_specinfo->si_mountingowner = NULL;
4168 SPECHASH_UNLOCK();
4169 vnode_unlock(vp);
4170 wakeup(&vp->v_specflags);
4171 }
4172
4173 void
vfs_clearmounting(vnode_t vp)4174 vfs_clearmounting(vnode_t vp)
4175 {
4176 vnode_lock(vp);
4177 SPECHASH_LOCK();
4178 vp->v_specflags &= ~SI_MOUNTING;
4179 vp->v_specinfo->si_mountingowner = NULL;
4180 SPECHASH_UNLOCK();
4181 vnode_unlock(vp);
4182 wakeup(&vp->v_specflags);
4183 }
4184
4185 /*
4186 * Check to see if a filesystem is mounted on a block device.
4187 */
4188 int
vfs_setmounting(vnode_t vp)4189 vfs_setmounting(vnode_t vp)
4190 {
4191 struct vnode *vq;
4192 int error = 0;
4193
4194 vnode_lock(vp);
4195 while (vp->v_specflags & SI_MOUNTING) {
4196 msleep((caddr_t)&vp->v_specflags, &vp->v_lock, PVFS, "vnode_waitformounting", NULL);
4197 }
4198 if (vp->v_specflags & SI_MOUNTEDON) {
4199 vnode_unlock(vp);
4200 return EBUSY;
4201 }
4202 SPECHASH_LOCK();
4203 vp->v_specflags |= SI_MOUNTING;
4204 vp->v_specinfo->si_mountingowner = current_thread();
4205 vnode_unlock(vp);
4206 restart:
4207 if (vp->v_specflags & SI_ALIASED) {
4208 for (vq = *vp->v_hashchain; vq; vq = vq->v_specnext) {
4209 if (vq->v_rdev != vp->v_rdev ||
4210 vq->v_type != vp->v_type || vq == vp) {
4211 continue;
4212 }
4213 if (vq->v_specflags & SI_MOUNTING) {
4214 msleep((caddr_t)&vq->v_specflags, SPECHASH_LOCK_ADDR(), PVFS | PDROP, "vnode_waitformounting", NULL);
4215 SPECHASH_LOCK();
4216 goto restart;
4217 }
4218 if (vq->v_specflags & SI_MOUNTEDON) {
4219 error = EBUSY;
4220 break;
4221 }
4222 }
4223 }
4224 SPECHASH_UNLOCK();
4225 if (error) {
4226 vnode_lock(vp);
4227 SPECHASH_LOCK();
4228 vp->v_specflags &= ~SI_MOUNTING;
4229 SPECHASH_UNLOCK();
4230 vnode_unlock(vp);
4231 wakeup(&vp->v_specflags);
4232 }
4233 return error;
4234 }
4235
4236 struct unmount_info {
4237 int u_errs; // Total failed unmounts
4238 int u_busy; // EBUSY failed unmounts
4239 int u_count; // Total volumes iterated
4240 int u_only_non_system;
4241 };
4242
4243 static int
unmount_callback(mount_t mp,void * arg)4244 unmount_callback(mount_t mp, void *arg)
4245 {
4246 int error;
4247 char *mntname;
4248 struct unmount_info *uip = arg;
4249
4250 uip->u_count++;
4251
4252 mntname = zalloc_flags(ZV_NAMEI, Z_WAITOK | Z_NOFAIL);
4253 strlcpy(mntname, mp->mnt_vfsstat.f_mntonname, MAXPATHLEN);
4254
4255 if (uip->u_only_non_system
4256 && ((mp->mnt_flag & MNT_ROOTFS) || (mp->mnt_kern_flag & MNTK_SYSTEM))) { //MNTK_BACKS_ROOT
4257 printf("unmount(%d) %s skipped\n", uip->u_only_non_system, mntname);
4258 mount_iterdrop(mp); // VFS_ITERATE_CB_DROPREF
4259 } else {
4260 printf("unmount(%d) %s\n", uip->u_only_non_system, mntname);
4261
4262 mount_ref(mp, 0);
4263 mount_iterdrop(mp); // VFS_ITERATE_CB_DROPREF
4264 error = dounmount(mp, MNT_FORCE, 1, vfs_context_current());
4265 if (error) {
4266 uip->u_errs++;
4267 printf("Unmount of %s failed (%d)\n", mntname ? mntname:"?", error);
4268 if (error == EBUSY) {
4269 uip->u_busy++;
4270 }
4271 }
4272 }
4273 zfree(ZV_NAMEI, mntname);
4274
4275 return VFS_RETURNED;
4276 }
4277
4278 /*
4279 * Unmount all filesystems. The list is traversed in reverse order
4280 * of mounting to avoid dependencies.
4281 * Busy mounts are retried.
4282 */
4283 __private_extern__ void
vfs_unmountall(int only_non_system)4284 vfs_unmountall(int only_non_system)
4285 {
4286 int mounts, sec = 1;
4287 struct unmount_info ui;
4288
4289 /*
4290 * Ensure last-completion-time is valid before anyone can see that
4291 * VFS shutdown has started.
4292 */
4293 vfs_shutdown_last_completion_time = mach_absolute_time();
4294 OSMemoryBarrier();
4295 vfs_unmountall_started = 1;
4296 printf("vfs_unmountall(%ssystem) start\n", only_non_system ? "non" : "");
4297
4298 retry:
4299 ui.u_errs = ui.u_busy = ui.u_count = 0;
4300 ui.u_only_non_system = only_non_system;
4301 // avoid vfs_iterate deadlock in dounmount(), use VFS_ITERATE_CB_DROPREF
4302 vfs_iterate(VFS_ITERATE_CB_DROPREF | VFS_ITERATE_TAIL_FIRST, unmount_callback, &ui);
4303 mounts = mount_getvfscnt();
4304 if (mounts == 0) {
4305 goto out;
4306 }
4307 if (ui.u_busy > 0) { // Busy mounts - wait & retry
4308 tsleep(&nummounts, PVFS, "busy mount", sec * hz);
4309 sec *= 2;
4310 if (sec <= 32) {
4311 goto retry;
4312 }
4313 printf("Unmounting timed out\n");
4314 } else if (ui.u_count < mounts) {
4315 // If the vfs_iterate missed mounts in progress - wait a bit
4316 tsleep(&nummounts, PVFS, "missed mount", 2 * hz);
4317 }
4318
4319 out:
4320 printf("vfs_unmountall(%ssystem) end\n", only_non_system ? "non" : "");
4321
4322 /*
4323 * reboot_kernel() calls us twice; once to deal with non-system
4324 * mounts, and again to sweep up anything left after terminating
4325 * DEXTs. We're only finished once we've completed the second pass.
4326 */
4327 if (!only_non_system) {
4328 vfs_unmountall_finished = 1;
4329 }
4330 }
4331
4332 /*
4333 * vfs_shutdown_in_progress --
4334 *
4335 * Returns whether or not the VFS is shutting down the file systems.
4336 */
4337 boolean_t
vfs_shutdown_in_progress(void)4338 vfs_shutdown_in_progress(void)
4339 {
4340 return vfs_unmountall_started && !vfs_unmountall_finished;
4341 }
4342
4343 /*
4344 * vfs_shutdown_finished --
4345 *
4346 * Returns whether or not the VFS shutdown has completed.
4347 */
4348 boolean_t
vfs_shutdown_finished(void)4349 vfs_shutdown_finished(void)
4350 {
4351 return !!vfs_unmountall_finished;
4352 }
4353
4354 /*
4355 * vfs_update_last_completion_time --
4356 *
4357 * Updates the "last I/O completion time" timestamp used by the watchdog
4358 * to monitor VFS shutdown progress. Called by various I/O stack layers
4359 * as operations complete and progress moves forward.
4360 */
4361 void
vfs_update_last_completion_time(void)4362 vfs_update_last_completion_time(void)
4363 {
4364 if (vfs_unmountall_started) {
4365 vfs_shutdown_last_completion_time = mach_absolute_time();
4366 }
4367 }
4368
4369 /*
4370 * vfs_last_completion_time --
4371 *
4372 * Returns the "last I/O completion time" timestamp. Return
4373 * value is a mach_absolute_time() value, and is not meaningful
4374 * unless vfs_is_shutting_down() also returns true.
4375 */
4376 uint64_t
vfs_last_completion_time(void)4377 vfs_last_completion_time(void)
4378 {
4379 return vfs_unmountall_started ? vfs_shutdown_last_completion_time : 0;
4380 }
4381
4382 /*
4383 * This routine is called from vnode_pager_deallocate out of the VM
4384 * The path to vnode_pager_deallocate can only be initiated by ubc_destroy_named
4385 * on a vnode that has a UBCINFO
4386 */
4387 __private_extern__ void
vnode_pager_vrele(vnode_t vp)4388 vnode_pager_vrele(vnode_t vp)
4389 {
4390 struct ubc_info *uip;
4391
4392 vnode_lock_spin(vp);
4393
4394 vp->v_lflag &= ~VNAMED_UBC;
4395 if (vp->v_usecount != 0) {
4396 /*
4397 * At the eleventh hour, just before the ubcinfo is
4398 * destroyed, ensure the ubc-specific v_usecount
4399 * reference has gone. We use v_usecount != 0 as a hint;
4400 * ubc_unmap() does nothing if there's no mapping.
4401 *
4402 * This case is caused by coming here via forced unmount,
4403 * versus the usual vm_object_deallocate() path.
4404 * In the forced unmount case, ubc_destroy_named()
4405 * releases the pager before memory_object_last_unmap()
4406 * can be called.
4407 */
4408 vnode_unlock(vp);
4409 ubc_unmap(vp);
4410 vnode_lock_spin(vp);
4411 }
4412
4413 uip = vp->v_ubcinfo;
4414 vp->v_ubcinfo = UBC_INFO_NULL;
4415
4416 vnode_unlock(vp);
4417
4418 ubc_info_deallocate(uip);
4419 }
4420
4421
4422 #include <sys/disk.h>
4423
4424 u_int32_t rootunit = (u_int32_t)-1;
4425
4426 #if CONFIG_IOSCHED
4427 extern int lowpri_throttle_enabled;
4428 extern int iosched_enabled;
4429 #endif
4430
4431 errno_t
vfs_init_io_attributes(vnode_t devvp,mount_t mp)4432 vfs_init_io_attributes(vnode_t devvp, mount_t mp)
4433 {
4434 int error;
4435 off_t readblockcnt = 0;
4436 off_t writeblockcnt = 0;
4437 off_t readmaxcnt = 0;
4438 off_t writemaxcnt = 0;
4439 off_t readsegcnt = 0;
4440 off_t writesegcnt = 0;
4441 off_t readsegsize = 0;
4442 off_t writesegsize = 0;
4443 off_t alignment = 0;
4444 u_int32_t minsaturationbytecount = 0;
4445 u_int32_t ioqueue_depth = 0;
4446 u_int32_t blksize;
4447 u_int64_t temp;
4448 u_int32_t features;
4449 u_int64_t location = 0;
4450 vfs_context_t ctx = vfs_context_current();
4451 dk_corestorage_info_t cs_info;
4452 boolean_t cs_present = FALSE;
4453 int isssd = 0;
4454 int isvirtual = 0;
4455
4456
4457 VNOP_IOCTL(devvp, DKIOCGETTHROTTLEMASK, (caddr_t)&mp->mnt_throttle_mask, 0, NULL);
4458 /*
4459 * as a reasonable approximation, only use the lowest bit of the mask
4460 * to generate a disk unit number
4461 */
4462 mp->mnt_devbsdunit = mp->mnt_throttle_mask ?
4463 num_trailing_0(mp->mnt_throttle_mask) : (LOWPRI_MAX_NUM_DEV - 1);
4464
4465 if (devvp == rootvp) {
4466 rootunit = mp->mnt_devbsdunit;
4467 }
4468
4469 if (mp->mnt_devbsdunit == rootunit) {
4470 /*
4471 * this mount point exists on the same device as the root
4472 * partition, so it comes under the hard throttle control...
4473 * this is true even for the root mount point itself
4474 */
4475 mp->mnt_kern_flag |= MNTK_ROOTDEV;
4476 }
4477 /*
4478 * force the spec device to re-cache
4479 * the underlying block size in case
4480 * the filesystem overrode the initial value
4481 */
4482 set_fsblocksize(devvp);
4483
4484
4485 if ((error = VNOP_IOCTL(devvp, DKIOCGETBLOCKSIZE,
4486 (caddr_t)&blksize, 0, ctx))) {
4487 return error;
4488 }
4489
4490 mp->mnt_devblocksize = blksize;
4491
4492 /*
4493 * set the maximum possible I/O size
4494 * this may get clipped to a smaller value
4495 * based on which constraints are being advertised
4496 * and if those advertised constraints result in a smaller
4497 * limit for a given I/O
4498 */
4499 mp->mnt_maxreadcnt = MAX_UPL_SIZE_BYTES;
4500 mp->mnt_maxwritecnt = MAX_UPL_SIZE_BYTES;
4501
4502 if (VNOP_IOCTL(devvp, DKIOCISVIRTUAL, (caddr_t)&isvirtual, 0, ctx) == 0) {
4503 if (isvirtual) {
4504 mp->mnt_kern_flag |= MNTK_VIRTUALDEV;
4505 mp->mnt_flag |= MNT_REMOVABLE;
4506 }
4507 }
4508 if (VNOP_IOCTL(devvp, DKIOCISSOLIDSTATE, (caddr_t)&isssd, 0, ctx) == 0) {
4509 if (isssd) {
4510 mp->mnt_kern_flag |= MNTK_SSD;
4511 }
4512 }
4513 if ((error = VNOP_IOCTL(devvp, DKIOCGETFEATURES,
4514 (caddr_t)&features, 0, ctx))) {
4515 return error;
4516 }
4517
4518 if ((error = VNOP_IOCTL(devvp, DKIOCGETMAXBLOCKCOUNTREAD,
4519 (caddr_t)&readblockcnt, 0, ctx))) {
4520 return error;
4521 }
4522
4523 if ((error = VNOP_IOCTL(devvp, DKIOCGETMAXBLOCKCOUNTWRITE,
4524 (caddr_t)&writeblockcnt, 0, ctx))) {
4525 return error;
4526 }
4527
4528 if ((error = VNOP_IOCTL(devvp, DKIOCGETMAXBYTECOUNTREAD,
4529 (caddr_t)&readmaxcnt, 0, ctx))) {
4530 return error;
4531 }
4532
4533 if ((error = VNOP_IOCTL(devvp, DKIOCGETMAXBYTECOUNTWRITE,
4534 (caddr_t)&writemaxcnt, 0, ctx))) {
4535 return error;
4536 }
4537
4538 if ((error = VNOP_IOCTL(devvp, DKIOCGETMAXSEGMENTCOUNTREAD,
4539 (caddr_t)&readsegcnt, 0, ctx))) {
4540 return error;
4541 }
4542
4543 if ((error = VNOP_IOCTL(devvp, DKIOCGETMAXSEGMENTCOUNTWRITE,
4544 (caddr_t)&writesegcnt, 0, ctx))) {
4545 return error;
4546 }
4547
4548 if ((error = VNOP_IOCTL(devvp, DKIOCGETMAXSEGMENTBYTECOUNTREAD,
4549 (caddr_t)&readsegsize, 0, ctx))) {
4550 return error;
4551 }
4552
4553 if ((error = VNOP_IOCTL(devvp, DKIOCGETMAXSEGMENTBYTECOUNTWRITE,
4554 (caddr_t)&writesegsize, 0, ctx))) {
4555 return error;
4556 }
4557
4558 if ((error = VNOP_IOCTL(devvp, DKIOCGETMINSEGMENTALIGNMENTBYTECOUNT,
4559 (caddr_t)&alignment, 0, ctx))) {
4560 return error;
4561 }
4562
4563 if ((error = VNOP_IOCTL(devvp, DKIOCGETCOMMANDPOOLSIZE,
4564 (caddr_t)&ioqueue_depth, 0, ctx))) {
4565 return error;
4566 }
4567
4568 if (readmaxcnt) {
4569 mp->mnt_maxreadcnt = (readmaxcnt > UINT32_MAX) ? UINT32_MAX :(uint32_t) readmaxcnt;
4570 }
4571
4572 if (readblockcnt) {
4573 temp = readblockcnt * blksize;
4574 temp = (temp > UINT32_MAX) ? UINT32_MAX : temp;
4575
4576 if (temp < mp->mnt_maxreadcnt) {
4577 mp->mnt_maxreadcnt = (u_int32_t)temp;
4578 }
4579 }
4580
4581 if (writemaxcnt) {
4582 mp->mnt_maxwritecnt = (writemaxcnt > UINT32_MAX) ? UINT32_MAX : (uint32_t)writemaxcnt;
4583 }
4584
4585 if (writeblockcnt) {
4586 temp = writeblockcnt * blksize;
4587 temp = (temp > UINT32_MAX) ? UINT32_MAX : temp;
4588
4589 if (temp < mp->mnt_maxwritecnt) {
4590 mp->mnt_maxwritecnt = (u_int32_t)temp;
4591 }
4592 }
4593
4594 if (readsegcnt) {
4595 temp = (readsegcnt > UINT16_MAX) ? UINT16_MAX : readsegcnt;
4596 } else {
4597 temp = mp->mnt_maxreadcnt / PAGE_SIZE;
4598
4599 if (temp > UINT16_MAX) {
4600 temp = UINT16_MAX;
4601 }
4602 }
4603 mp->mnt_segreadcnt = (u_int16_t)temp;
4604
4605 if (writesegcnt) {
4606 temp = (writesegcnt > UINT16_MAX) ? UINT16_MAX : writesegcnt;
4607 } else {
4608 temp = mp->mnt_maxwritecnt / PAGE_SIZE;
4609
4610 if (temp > UINT16_MAX) {
4611 temp = UINT16_MAX;
4612 }
4613 }
4614 mp->mnt_segwritecnt = (u_int16_t)temp;
4615
4616 if (readsegsize) {
4617 temp = (readsegsize > UINT32_MAX) ? UINT32_MAX : readsegsize;
4618 } else {
4619 temp = mp->mnt_maxreadcnt;
4620 }
4621 mp->mnt_maxsegreadsize = (u_int32_t)temp;
4622
4623 if (writesegsize) {
4624 temp = (writesegsize > UINT32_MAX) ? UINT32_MAX : writesegsize;
4625 } else {
4626 temp = mp->mnt_maxwritecnt;
4627 }
4628 mp->mnt_maxsegwritesize = (u_int32_t)temp;
4629
4630 if (alignment) {
4631 temp = (alignment > PAGE_SIZE) ? PAGE_MASK : alignment - 1;
4632 } else {
4633 temp = 0;
4634 }
4635 mp->mnt_alignmentmask = (uint32_t)temp;
4636
4637
4638 if (ioqueue_depth > MNT_DEFAULT_IOQUEUE_DEPTH) {
4639 temp = ioqueue_depth;
4640 } else {
4641 temp = MNT_DEFAULT_IOQUEUE_DEPTH;
4642 }
4643
4644 mp->mnt_ioqueue_depth = (uint32_t)temp;
4645 mp->mnt_ioscale = MNT_IOSCALE(mp->mnt_ioqueue_depth);
4646
4647 if (mp->mnt_ioscale > 1) {
4648 printf("ioqueue_depth = %d, ioscale = %d\n", (int)mp->mnt_ioqueue_depth, (int)mp->mnt_ioscale);
4649 }
4650
4651 if (features & DK_FEATURE_FORCE_UNIT_ACCESS) {
4652 mp->mnt_ioflags |= MNT_IOFLAGS_FUA_SUPPORTED;
4653 }
4654
4655 if (VNOP_IOCTL(devvp, DKIOCGETIOMINSATURATIONBYTECOUNT, (caddr_t)&minsaturationbytecount, 0, ctx) == 0) {
4656 mp->mnt_minsaturationbytecount = minsaturationbytecount;
4657 } else {
4658 mp->mnt_minsaturationbytecount = 0;
4659 }
4660
4661 if (VNOP_IOCTL(devvp, DKIOCCORESTORAGE, (caddr_t)&cs_info, 0, ctx) == 0) {
4662 cs_present = TRUE;
4663 }
4664
4665 if (features & DK_FEATURE_UNMAP) {
4666 mp->mnt_ioflags |= MNT_IOFLAGS_UNMAP_SUPPORTED;
4667
4668 if (cs_present == TRUE) {
4669 mp->mnt_ioflags |= MNT_IOFLAGS_CSUNMAP_SUPPORTED;
4670 }
4671 }
4672 if (cs_present == TRUE) {
4673 /*
4674 * for now we'll use the following test as a proxy for
4675 * the underlying drive being FUSION in nature
4676 */
4677 if ((cs_info.flags & DK_CORESTORAGE_PIN_YOUR_METADATA)) {
4678 mp->mnt_ioflags |= MNT_IOFLAGS_FUSION_DRIVE;
4679 }
4680 } else {
4681 /* Check for APFS Fusion */
4682 dk_apfs_flavour_t flavour;
4683 if ((VNOP_IOCTL(devvp, DKIOCGETAPFSFLAVOUR, (caddr_t)&flavour, 0, ctx) == 0) &&
4684 (flavour == DK_APFS_FUSION)) {
4685 mp->mnt_ioflags |= MNT_IOFLAGS_FUSION_DRIVE;
4686 }
4687 }
4688
4689 if (VNOP_IOCTL(devvp, DKIOCGETLOCATION, (caddr_t)&location, 0, ctx) == 0) {
4690 if (location & DK_LOCATION_EXTERNAL) {
4691 mp->mnt_ioflags |= MNT_IOFLAGS_PERIPHERAL_DRIVE;
4692 mp->mnt_flag |= MNT_REMOVABLE;
4693 }
4694 }
4695
4696 #if CONFIG_IOSCHED
4697 if (iosched_enabled && (features & DK_FEATURE_PRIORITY)) {
4698 mp->mnt_ioflags |= MNT_IOFLAGS_IOSCHED_SUPPORTED;
4699 throttle_info_disable_throttle(mp->mnt_devbsdunit, (mp->mnt_ioflags & MNT_IOFLAGS_FUSION_DRIVE) != 0);
4700 }
4701 #endif /* CONFIG_IOSCHED */
4702 return error;
4703 }
4704
4705 static struct klist fs_klist;
4706 static LCK_GRP_DECLARE(fs_klist_lck_grp, "fs_klist");
4707 static LCK_MTX_DECLARE(fs_klist_lock, &fs_klist_lck_grp);
4708
4709 void
vfs_event_init(void)4710 vfs_event_init(void)
4711 {
4712 klist_init(&fs_klist);
4713 }
4714
4715 void
vfs_event_signal(fsid_t * fsid,u_int32_t event,intptr_t data)4716 vfs_event_signal(fsid_t *fsid, u_int32_t event, intptr_t data)
4717 {
4718 if (event == VQ_DEAD || event == VQ_NOTRESP) {
4719 struct mount *mp = vfs_getvfs(fsid);
4720 if (mp) {
4721 mount_lock_spin(mp);
4722 if (data) {
4723 mp->mnt_lflag &= ~MNT_LNOTRESP; // Now responding
4724 } else {
4725 mp->mnt_lflag |= MNT_LNOTRESP; // Not responding
4726 }
4727 mount_unlock(mp);
4728 }
4729 }
4730
4731 lck_mtx_lock(&fs_klist_lock);
4732 KNOTE(&fs_klist, event);
4733 lck_mtx_unlock(&fs_klist_lock);
4734 }
4735
4736 /*
4737 * return the number of mounted filesystems.
4738 */
4739 static int
sysctl_vfs_getvfscnt(void)4740 sysctl_vfs_getvfscnt(void)
4741 {
4742 return mount_getvfscnt();
4743 }
4744
4745
4746 static int
mount_getvfscnt(void)4747 mount_getvfscnt(void)
4748 {
4749 int ret;
4750
4751 mount_list_lock();
4752 ret = nummounts;
4753 mount_list_unlock();
4754 return ret;
4755 }
4756
4757
4758
4759 static int
mount_fillfsids(fsid_t * fsidlst,int count)4760 mount_fillfsids(fsid_t *fsidlst, int count)
4761 {
4762 struct mount *mp;
4763 int actual = 0;
4764
4765 actual = 0;
4766 mount_list_lock();
4767 TAILQ_FOREACH(mp, &mountlist, mnt_list) {
4768 if (actual < count) {
4769 fsidlst[actual] = mp->mnt_vfsstat.f_fsid;
4770 actual++;
4771 }
4772 }
4773 mount_list_unlock();
4774 return actual;
4775 }
4776
4777 /*
4778 * fill in the array of fsid_t's up to a max of 'count', the actual
4779 * number filled in will be set in '*actual'. If there are more fsid_t's
4780 * than room in fsidlst then ENOMEM will be returned and '*actual' will
4781 * have the actual count.
4782 * having *actual filled out even in the error case is depended upon.
4783 */
4784 static int
sysctl_vfs_getvfslist(fsid_t * fsidlst,unsigned long count,unsigned long * actual)4785 sysctl_vfs_getvfslist(fsid_t *fsidlst, unsigned long count, unsigned long *actual)
4786 {
4787 struct mount *mp;
4788
4789 *actual = 0;
4790 mount_list_lock();
4791 TAILQ_FOREACH(mp, &mountlist, mnt_list) {
4792 (*actual)++;
4793 if (*actual <= count) {
4794 fsidlst[(*actual) - 1] = mp->mnt_vfsstat.f_fsid;
4795 }
4796 }
4797 mount_list_unlock();
4798 return *actual <= count ? 0 : ENOMEM;
4799 }
4800
4801 static int
sysctl_vfs_vfslist(__unused struct sysctl_oid * oidp,__unused void * arg1,__unused int arg2,struct sysctl_req * req)4802 sysctl_vfs_vfslist(__unused struct sysctl_oid *oidp, __unused void *arg1,
4803 __unused int arg2, struct sysctl_req *req)
4804 {
4805 unsigned long actual;
4806 int error;
4807 size_t space;
4808 fsid_t *fsidlst;
4809
4810 /* This is a readonly node. */
4811 if (req->newptr != USER_ADDR_NULL) {
4812 return EPERM;
4813 }
4814
4815 /* they are querying us so just return the space required. */
4816 if (req->oldptr == USER_ADDR_NULL) {
4817 req->oldidx = sysctl_vfs_getvfscnt() * sizeof(fsid_t);
4818 return 0;
4819 }
4820 again:
4821 /*
4822 * Retrieve an accurate count of the amount of space required to copy
4823 * out all the fsids in the system.
4824 */
4825 space = req->oldlen;
4826 req->oldlen = sysctl_vfs_getvfscnt() * sizeof(fsid_t);
4827
4828 /* they didn't give us enough space. */
4829 if (space < req->oldlen) {
4830 return ENOMEM;
4831 }
4832
4833 fsidlst = kalloc_data(req->oldlen, Z_WAITOK | Z_ZERO);
4834 if (fsidlst == NULL) {
4835 return ENOMEM;
4836 }
4837
4838 error = sysctl_vfs_getvfslist(fsidlst, req->oldlen / sizeof(fsid_t),
4839 &actual);
4840 /*
4841 * If we get back ENOMEM, then another mount has been added while we
4842 * slept in malloc above. If this is the case then try again.
4843 */
4844 if (error == ENOMEM) {
4845 kfree_data(fsidlst, req->oldlen);
4846 req->oldlen = space;
4847 goto again;
4848 }
4849 if (error == 0) {
4850 error = SYSCTL_OUT(req, fsidlst, actual * sizeof(fsid_t));
4851 }
4852 kfree_data(fsidlst, req->oldlen);
4853 return error;
4854 }
4855
4856 /*
4857 * Do a sysctl by fsid.
4858 */
4859 static int
sysctl_vfs_ctlbyfsid(__unused struct sysctl_oid * oidp,void * arg1,int arg2,struct sysctl_req * req)4860 sysctl_vfs_ctlbyfsid(__unused struct sysctl_oid *oidp, void *arg1, int arg2,
4861 struct sysctl_req *req)
4862 {
4863 union union_vfsidctl vc;
4864 struct mount *mp = NULL;
4865 struct vfsstatfs *sp;
4866 int *name, namelen;
4867 int flags = 0;
4868 int error = 0, gotref = 0;
4869 vfs_context_t ctx = vfs_context_current();
4870 proc_t p = req->p; /* XXX req->p != current_proc()? */
4871 boolean_t is_64_bit;
4872 union {
4873 struct statfs64 sfs64;
4874 struct user64_statfs osfs64;
4875 struct user32_statfs osfs32;
4876 } *sfsbuf;
4877
4878 if (req->newptr == USER_ADDR_NULL) {
4879 error = EINVAL;
4880 goto out;
4881 }
4882
4883 name = arg1;
4884 namelen = arg2;
4885 is_64_bit = proc_is64bit(p);
4886
4887 error = SYSCTL_IN(req, &vc, is_64_bit? sizeof(vc.vc64):sizeof(vc.vc32));
4888 if (error) {
4889 goto out;
4890 }
4891 if (vc.vc32.vc_vers != VFS_CTL_VERS1) { /* works for 32 and 64 */
4892 error = EINVAL;
4893 goto out;
4894 }
4895 mp = mount_list_lookupby_fsid(&vc.vc32.vc_fsid, 0, 1); /* works for 32 and 64 */
4896 if (mp == NULL) {
4897 error = ENOENT;
4898 goto out;
4899 }
4900 gotref = 1;
4901 /* reset so that the fs specific code can fetch it. */
4902 req->newidx = 0;
4903 /*
4904 * Note if this is a VFS_CTL then we pass the actual sysctl req
4905 * in for "oldp" so that the lower layer can DTRT and use the
4906 * SYSCTL_IN/OUT routines.
4907 */
4908 if (mp->mnt_op->vfs_sysctl != NULL) {
4909 if (is_64_bit) {
4910 if (vfs_64bitready(mp)) {
4911 error = mp->mnt_op->vfs_sysctl(name, namelen,
4912 CAST_USER_ADDR_T(req),
4913 NULL, USER_ADDR_NULL, 0,
4914 ctx);
4915 } else {
4916 error = ENOTSUP;
4917 }
4918 } else {
4919 error = mp->mnt_op->vfs_sysctl(name, namelen,
4920 CAST_USER_ADDR_T(req),
4921 NULL, USER_ADDR_NULL, 0,
4922 ctx);
4923 }
4924 if (error != ENOTSUP) {
4925 goto out;
4926 }
4927 }
4928 switch (name[0]) {
4929 case VFS_CTL_UMOUNT:
4930 #if CONFIG_MACF
4931 error = mac_mount_check_umount(ctx, mp);
4932 if (error != 0) {
4933 goto out;
4934 }
4935 #endif
4936 req->newidx = 0;
4937 if (is_64_bit) {
4938 req->newptr = vc.vc64.vc_ptr;
4939 req->newlen = (size_t)vc.vc64.vc_len;
4940 } else {
4941 req->newptr = CAST_USER_ADDR_T(vc.vc32.vc_ptr);
4942 req->newlen = vc.vc32.vc_len;
4943 }
4944 error = SYSCTL_IN(req, &flags, sizeof(flags));
4945 if (error) {
4946 break;
4947 }
4948
4949 mount_ref(mp, 0);
4950 mount_iterdrop(mp);
4951 gotref = 0;
4952 /* safedounmount consumes a ref */
4953 error = safedounmount(mp, flags, ctx);
4954 break;
4955 case VFS_CTL_OSTATFS:
4956 case VFS_CTL_STATFS64:
4957 #if CONFIG_MACF
4958 error = mac_mount_check_stat(ctx, mp);
4959 if (error != 0) {
4960 break;
4961 }
4962 #endif
4963 req->newidx = 0;
4964 if (is_64_bit) {
4965 req->newptr = vc.vc64.vc_ptr;
4966 req->newlen = (size_t)vc.vc64.vc_len;
4967 } else {
4968 req->newptr = CAST_USER_ADDR_T(vc.vc32.vc_ptr);
4969 req->newlen = vc.vc32.vc_len;
4970 }
4971 error = SYSCTL_IN(req, &flags, sizeof(flags));
4972 if (error) {
4973 break;
4974 }
4975 sp = &mp->mnt_vfsstat;
4976 if (((flags & MNT_NOWAIT) == 0 || (flags & (MNT_WAIT | MNT_DWAIT))) &&
4977 (error = vfs_update_vfsstat(mp, ctx, VFS_USER_EVENT))) {
4978 goto out;
4979 }
4980
4981 sfsbuf = kalloc_type(typeof(*sfsbuf), Z_WAITOK);
4982
4983 if (name[0] == VFS_CTL_STATFS64) {
4984 struct statfs64 *sfs = &sfsbuf->sfs64;
4985
4986 vfs_get_statfs64(mp, sfs);
4987 error = SYSCTL_OUT(req, sfs, sizeof(*sfs));
4988 } else if (is_64_bit) {
4989 struct user64_statfs *sfs = &sfsbuf->osfs64;
4990
4991 bzero(sfs, sizeof(*sfs));
4992 sfs->f_flags = mp->mnt_flag & MNT_VISFLAGMASK;
4993 sfs->f_type = (short)mp->mnt_vtable->vfc_typenum;
4994 sfs->f_bsize = (user64_long_t)sp->f_bsize;
4995 sfs->f_iosize = (user64_long_t)sp->f_iosize;
4996 sfs->f_blocks = (user64_long_t)sp->f_blocks;
4997 sfs->f_bfree = (user64_long_t)sp->f_bfree;
4998 sfs->f_bavail = (user64_long_t)sp->f_bavail;
4999 sfs->f_files = (user64_long_t)sp->f_files;
5000 sfs->f_ffree = (user64_long_t)sp->f_ffree;
5001 sfs->f_fsid = sp->f_fsid;
5002 sfs->f_owner = sp->f_owner;
5003 vfs_getfstypename(mp, sfs->f_fstypename, MFSNAMELEN);
5004 strlcpy(sfs->f_mntonname, sp->f_mntonname, MNAMELEN);
5005 strlcpy(sfs->f_mntfromname, sp->f_mntfromname, MNAMELEN);
5006
5007 error = SYSCTL_OUT(req, sfs, sizeof(*sfs));
5008 } else {
5009 struct user32_statfs *sfs = &sfsbuf->osfs32;
5010 long temp;
5011
5012 bzero(sfs, sizeof(*sfs));
5013 sfs->f_flags = mp->mnt_flag & MNT_VISFLAGMASK;
5014 sfs->f_type = (short)mp->mnt_vtable->vfc_typenum;
5015
5016 /*
5017 * It's possible for there to be more than 2^^31 blocks in the filesystem, so we
5018 * have to fudge the numbers here in that case. We inflate the blocksize in order
5019 * to reflect the filesystem size as best we can.
5020 */
5021 if (sp->f_blocks > INT_MAX) {
5022 int shift;
5023
5024 /*
5025 * Work out how far we have to shift the block count down to make it fit.
5026 * Note that it's possible to have to shift so far that the resulting
5027 * blocksize would be unreportably large. At that point, we will clip
5028 * any values that don't fit.
5029 *
5030 * For safety's sake, we also ensure that f_iosize is never reported as
5031 * being smaller than f_bsize.
5032 */
5033 for (shift = 0; shift < 32; shift++) {
5034 if ((sp->f_blocks >> shift) <= INT_MAX) {
5035 break;
5036 }
5037 if ((((long long)sp->f_bsize) << (shift + 1)) > INT_MAX) {
5038 break;
5039 }
5040 }
5041 #define __SHIFT_OR_CLIP(x, s) ((((x) >> (s)) > INT_MAX) ? INT_MAX : ((x) >> (s)))
5042 sfs->f_blocks = (user32_long_t)__SHIFT_OR_CLIP(sp->f_blocks, shift);
5043 sfs->f_bfree = (user32_long_t)__SHIFT_OR_CLIP(sp->f_bfree, shift);
5044 sfs->f_bavail = (user32_long_t)__SHIFT_OR_CLIP(sp->f_bavail, shift);
5045 #undef __SHIFT_OR_CLIP
5046 sfs->f_bsize = (user32_long_t)(sp->f_bsize << shift);
5047 temp = lmax(sp->f_iosize, sp->f_bsize);
5048 if (temp > INT32_MAX) {
5049 error = EINVAL;
5050 kfree_type(typeof(*sfsbuf), sfsbuf);
5051 goto out;
5052 }
5053 sfs->f_iosize = (user32_long_t)temp;
5054 } else {
5055 sfs->f_bsize = (user32_long_t)sp->f_bsize;
5056 sfs->f_iosize = (user32_long_t)sp->f_iosize;
5057 sfs->f_blocks = (user32_long_t)sp->f_blocks;
5058 sfs->f_bfree = (user32_long_t)sp->f_bfree;
5059 sfs->f_bavail = (user32_long_t)sp->f_bavail;
5060 }
5061 sfs->f_files = (user32_long_t)sp->f_files;
5062 sfs->f_ffree = (user32_long_t)sp->f_ffree;
5063 sfs->f_fsid = sp->f_fsid;
5064 sfs->f_owner = sp->f_owner;
5065
5066 vfs_getfstypename(mp, sfs->f_fstypename, MFSNAMELEN);
5067 strlcpy(sfs->f_mntonname, sp->f_mntonname, MNAMELEN);
5068 strlcpy(sfs->f_mntfromname, sp->f_mntfromname, MNAMELEN);
5069
5070 error = SYSCTL_OUT(req, sfs, sizeof(*sfs));
5071 }
5072 kfree_type(typeof(*sfsbuf), sfsbuf);
5073 break;
5074 default:
5075 error = ENOTSUP;
5076 goto out;
5077 }
5078 out:
5079 if (gotref != 0) {
5080 mount_iterdrop(mp);
5081 }
5082 return error;
5083 }
5084
5085 static int filt_fsattach(struct knote *kn, struct kevent_qos_s *kev);
5086 static void filt_fsdetach(struct knote *kn);
5087 static int filt_fsevent(struct knote *kn, long hint);
5088 static int filt_fstouch(struct knote *kn, struct kevent_qos_s *kev);
5089 static int filt_fsprocess(struct knote *kn, struct kevent_qos_s *kev);
5090 SECURITY_READ_ONLY_EARLY(struct filterops) fs_filtops = {
5091 .f_attach = filt_fsattach,
5092 .f_detach = filt_fsdetach,
5093 .f_event = filt_fsevent,
5094 .f_touch = filt_fstouch,
5095 .f_process = filt_fsprocess,
5096 };
5097
5098 static int
filt_fsattach(struct knote * kn,__unused struct kevent_qos_s * kev)5099 filt_fsattach(struct knote *kn, __unused struct kevent_qos_s *kev)
5100 {
5101 kn->kn_flags |= EV_CLEAR; /* automatic */
5102 kn->kn_sdata = 0; /* incoming data is ignored */
5103
5104 lck_mtx_lock(&fs_klist_lock);
5105 KNOTE_ATTACH(&fs_klist, kn);
5106 lck_mtx_unlock(&fs_klist_lock);
5107
5108 /*
5109 * filter only sees future events,
5110 * so it can't be fired already.
5111 */
5112 return 0;
5113 }
5114
5115 static void
filt_fsdetach(struct knote * kn)5116 filt_fsdetach(struct knote *kn)
5117 {
5118 lck_mtx_lock(&fs_klist_lock);
5119 KNOTE_DETACH(&fs_klist, kn);
5120 lck_mtx_unlock(&fs_klist_lock);
5121 }
5122
5123 static int
filt_fsevent(struct knote * kn,long hint)5124 filt_fsevent(struct knote *kn, long hint)
5125 {
5126 /*
5127 * Backwards compatibility:
5128 * Other filters would do nothing if kn->kn_sfflags == 0
5129 */
5130
5131 if ((kn->kn_sfflags == 0) || (kn->kn_sfflags & hint)) {
5132 kn->kn_fflags |= hint;
5133 }
5134
5135 return kn->kn_fflags != 0;
5136 }
5137
5138 static int
filt_fstouch(struct knote * kn,struct kevent_qos_s * kev)5139 filt_fstouch(struct knote *kn, struct kevent_qos_s *kev)
5140 {
5141 int res;
5142
5143 lck_mtx_lock(&fs_klist_lock);
5144
5145 kn->kn_sfflags = kev->fflags;
5146
5147 /*
5148 * the above filter function sets bits even if nobody is looking for them.
5149 * Just preserve those bits even in the new mask is more selective
5150 * than before.
5151 *
5152 * For compatibility with previous implementations, we leave kn_fflags
5153 * as they were before.
5154 */
5155 //if (kn->kn_sfflags)
5156 // kn->kn_fflags &= kn->kn_sfflags;
5157 res = (kn->kn_fflags != 0);
5158
5159 lck_mtx_unlock(&fs_klist_lock);
5160
5161 return res;
5162 }
5163
5164 static int
filt_fsprocess(struct knote * kn,struct kevent_qos_s * kev)5165 filt_fsprocess(struct knote *kn, struct kevent_qos_s *kev)
5166 {
5167 int res = 0;
5168
5169 lck_mtx_lock(&fs_klist_lock);
5170 if (kn->kn_fflags) {
5171 knote_fill_kevent(kn, kev, 0);
5172 res = 1;
5173 }
5174 lck_mtx_unlock(&fs_klist_lock);
5175 return res;
5176 }
5177
5178 static int
sysctl_vfs_noremotehang(__unused struct sysctl_oid * oidp,__unused void * arg1,__unused int arg2,struct sysctl_req * req)5179 sysctl_vfs_noremotehang(__unused struct sysctl_oid *oidp,
5180 __unused void *arg1, __unused int arg2, struct sysctl_req *req)
5181 {
5182 int out, error;
5183 pid_t pid;
5184 proc_t p;
5185
5186 /* We need a pid. */
5187 if (req->newptr == USER_ADDR_NULL) {
5188 return EINVAL;
5189 }
5190
5191 error = SYSCTL_IN(req, &pid, sizeof(pid));
5192 if (error) {
5193 return error;
5194 }
5195
5196 p = proc_find(pid < 0 ? -pid : pid);
5197 if (p == NULL) {
5198 return ESRCH;
5199 }
5200
5201 /*
5202 * Fetching the value is ok, but we only fetch if the old
5203 * pointer is given.
5204 */
5205 if (req->oldptr != USER_ADDR_NULL) {
5206 out = !((p->p_flag & P_NOREMOTEHANG) == 0);
5207 proc_rele(p);
5208 error = SYSCTL_OUT(req, &out, sizeof(out));
5209 return error;
5210 }
5211
5212 /* cansignal offers us enough security. */
5213 if (p != req->p && proc_suser(req->p) != 0) {
5214 proc_rele(p);
5215 return EPERM;
5216 }
5217
5218 if (pid < 0) {
5219 OSBitAndAtomic(~((uint32_t)P_NOREMOTEHANG), &p->p_flag);
5220 } else {
5221 OSBitOrAtomic(P_NOREMOTEHANG, &p->p_flag);
5222 }
5223 proc_rele(p);
5224
5225 return 0;
5226 }
5227
5228 static int
5229 sysctl_vfs_generic_conf SYSCTL_HANDLER_ARGS
5230 {
5231 int *name, namelen;
5232 struct vfstable *vfsp;
5233 struct vfsconf vfsc = {};
5234
5235 (void)oidp;
5236 name = arg1;
5237 namelen = arg2;
5238
5239 if (namelen < 1) {
5240 return EISDIR;
5241 } else if (namelen > 1) {
5242 return ENOTDIR;
5243 }
5244
5245 mount_list_lock();
5246 for (vfsp = vfsconf; vfsp; vfsp = vfsp->vfc_next) {
5247 if (vfsp->vfc_typenum == name[0]) {
5248 break;
5249 }
5250 }
5251
5252 if (vfsp == NULL) {
5253 mount_list_unlock();
5254 return ENOTSUP;
5255 }
5256
5257 vfsc.vfc_reserved1 = 0;
5258 bcopy(vfsp->vfc_name, vfsc.vfc_name, sizeof(vfsc.vfc_name));
5259 vfsc.vfc_typenum = vfsp->vfc_typenum;
5260 vfsc.vfc_refcount = vfsp->vfc_refcount;
5261 vfsc.vfc_flags = vfsp->vfc_flags;
5262 vfsc.vfc_reserved2 = 0;
5263 vfsc.vfc_reserved3 = 0;
5264
5265 mount_list_unlock();
5266 return SYSCTL_OUT(req, &vfsc, sizeof(struct vfsconf));
5267 }
5268
5269 /* the vfs.generic. branch. */
5270 SYSCTL_EXTENSIBLE_NODE(_vfs, VFS_GENERIC, generic,
5271 CTLFLAG_RW | CTLFLAG_LOCKED, NULL, "vfs generic hinge");
5272 /* retreive a list of mounted filesystem fsid_t */
5273 SYSCTL_PROC(_vfs_generic, OID_AUTO, vfsidlist,
5274 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
5275 NULL, 0, sysctl_vfs_vfslist, "S,fsid", "List of mounted filesystem ids");
5276 /* perform operations on filesystem via fsid_t */
5277 SYSCTL_NODE(_vfs_generic, OID_AUTO, ctlbyfsid, CTLFLAG_RW | CTLFLAG_LOCKED,
5278 sysctl_vfs_ctlbyfsid, "ctlbyfsid");
5279 SYSCTL_PROC(_vfs_generic, OID_AUTO, noremotehang, CTLFLAG_RW | CTLFLAG_ANYBODY,
5280 NULL, 0, sysctl_vfs_noremotehang, "I", "noremotehang");
5281 SYSCTL_INT(_vfs_generic, VFS_MAXTYPENUM, maxtypenum,
5282 CTLFLAG_RD | CTLFLAG_KERN | CTLFLAG_LOCKED,
5283 &maxvfstypenum, 0, "");
5284 SYSCTL_INT(_vfs_generic, OID_AUTO, sync_timeout, CTLFLAG_RW | CTLFLAG_LOCKED, &sync_timeout_seconds, 0, "");
5285 SYSCTL_NODE(_vfs_generic, VFS_CONF, conf,
5286 CTLFLAG_RD | CTLFLAG_LOCKED,
5287 sysctl_vfs_generic_conf, "");
5288 #if DEVELOPMENT || DEBUG
5289 SYSCTL_INT(_vfs_generic, OID_AUTO, print_busy_vnodes,
5290 CTLTYPE_INT | CTLFLAG_RW,
5291 &print_busy_vnodes, 0,
5292 "VFS log busy vnodes blocking unmount");
5293 #endif
5294
5295 /* Indicate that the root file system unmounted cleanly */
5296 static int vfs_root_unmounted_cleanly = 0;
5297 SYSCTL_INT(_vfs_generic, OID_AUTO, root_unmounted_cleanly, CTLFLAG_RD, &vfs_root_unmounted_cleanly, 0, "Root filesystem was unmounted cleanly");
5298
5299 void
vfs_set_root_unmounted_cleanly(void)5300 vfs_set_root_unmounted_cleanly(void)
5301 {
5302 vfs_root_unmounted_cleanly = 1;
5303 }
5304
5305 /*
5306 * Print vnode state.
5307 */
5308 void
vn_print_state(struct vnode * vp,const char * fmt,...)5309 vn_print_state(struct vnode *vp, const char *fmt, ...)
5310 {
5311 va_list ap;
5312 char perm_str[] = "(VM_KERNEL_ADDRPERM pointer)";
5313 char fs_name[MFSNAMELEN];
5314
5315 va_start(ap, fmt);
5316 vprintf(fmt, ap);
5317 va_end(ap);
5318 printf("vp 0x%0llx %s: ", (uint64_t)VM_KERNEL_ADDRPERM(vp), perm_str);
5319 printf("tag %d, type %d\n", vp->v_tag, vp->v_type);
5320 /* Counts .. */
5321 printf(" iocount %d, usecount %d, kusecount %d references %d\n",
5322 vp->v_iocount, vp->v_usecount, vp->v_kusecount, vp->v_references);
5323 printf(" writecount %d, numoutput %d\n", vp->v_writecount,
5324 vp->v_numoutput);
5325 /* Flags */
5326 printf(" flag 0x%x, lflag 0x%x, listflag 0x%x\n", vp->v_flag,
5327 vp->v_lflag, vp->v_listflag);
5328
5329 if (vp->v_mount == NULL || vp->v_mount == dead_mountp) {
5330 strlcpy(fs_name, "deadfs", MFSNAMELEN);
5331 } else {
5332 vfs_name(vp->v_mount, fs_name);
5333 }
5334
5335 printf(" v_data 0x%0llx %s\n",
5336 (vp->v_data ? (uint64_t)VM_KERNEL_ADDRPERM(vp->v_data) : 0),
5337 perm_str);
5338 printf(" v_mount 0x%0llx %s vfs_name %s\n",
5339 (vp->v_mount ? (uint64_t)VM_KERNEL_ADDRPERM(vp->v_mount) : 0),
5340 perm_str, fs_name);
5341 }
5342
5343 long num_reusedvnodes = 0;
5344
5345
5346 static vnode_t
process_vp(vnode_t vp,int want_vp,bool can_defer,int * deferred)5347 process_vp(vnode_t vp, int want_vp, bool can_defer, int *deferred)
5348 {
5349 unsigned int vpid;
5350
5351 *deferred = 0;
5352
5353 vpid = vp->v_id;
5354
5355 vnode_list_remove_locked(vp);
5356
5357 vnode_hold(vp);
5358 vnode_list_unlock();
5359
5360 vnode_lock_spin(vp);
5361
5362 /*
5363 * We could wait for the vnode_lock after removing the vp from the freelist
5364 * and the vid is bumped only at the very end of reclaim. So it is possible
5365 * that we are looking at a vnode that is being terminated. If so skip it.
5366 */
5367 if ((vpid != vp->v_id) || (vp->v_usecount != 0) || (vp->v_iocount != 0) ||
5368 VONLIST(vp) || (vp->v_lflag & VL_TERMINATE)) {
5369 /*
5370 * we lost the race between dropping the list lock
5371 * and picking up the vnode_lock... someone else
5372 * used this vnode and it is now in a new state
5373 */
5374 vnode_drop_and_unlock(vp);
5375
5376 return NULLVP;
5377 }
5378 if ((vp->v_lflag & (VL_NEEDINACTIVE | VL_MARKTERM)) == VL_NEEDINACTIVE) {
5379 /*
5380 * we did a vnode_rele_ext that asked for
5381 * us not to reenter the filesystem during
5382 * the release even though VL_NEEDINACTIVE was
5383 * set... we'll do it here by doing a
5384 * vnode_get/vnode_put
5385 *
5386 * pick up an iocount so that we can call
5387 * vnode_put and drive the VNOP_INACTIVE...
5388 * vnode_put will either leave us off
5389 * the freelist if a new ref comes in,
5390 * or put us back on the end of the freelist
5391 * or recycle us if we were marked for termination...
5392 * so we'll just go grab a new candidate
5393 */
5394 vp->v_iocount++;
5395 #ifdef CONFIG_IOCOUNT_TRACE
5396 record_vp(vp, 1);
5397 #endif
5398 vnode_put_locked(vp);
5399 vnode_drop_and_unlock(vp);
5400
5401 return NULLVP;
5402 }
5403 /*
5404 * Checks for anyone racing us for recycle
5405 */
5406 if (vp->v_type != VBAD) {
5407 if ((want_vp || can_defer) && (vnode_on_reliable_media(vp) == FALSE || (vp->v_flag & VISDIRTY))) {
5408 vnode_async_list_add(vp);
5409 vnode_drop_and_unlock(vp);
5410
5411 *deferred = 1;
5412
5413 return NULLVP;
5414 }
5415 if (vp->v_lflag & VL_DEAD) {
5416 panic("new_vnode(%p): the vnode is VL_DEAD but not VBAD", vp);
5417 }
5418
5419 vnode_lock_convert(vp);
5420 (void)vnode_reclaim_internal(vp, 1, want_vp, 0);
5421
5422 if (want_vp) {
5423 if ((VONLIST(vp))) {
5424 panic("new_vnode(%p): vp on list", vp);
5425 }
5426 if (vp->v_usecount || vp->v_iocount || vp->v_kusecount ||
5427 (vp->v_lflag & (VNAMED_UBC | VNAMED_MOUNT | VNAMED_FSHASH))) {
5428 panic("new_vnode(%p): free vnode still referenced", vp);
5429 }
5430 if ((vp->v_mntvnodes.tqe_prev != 0) && (vp->v_mntvnodes.tqe_next != 0)) {
5431 panic("new_vnode(%p): vnode seems to be on mount list", vp);
5432 }
5433 if (!LIST_EMPTY(&vp->v_nclinks) || !TAILQ_EMPTY(&vp->v_ncchildren)) {
5434 panic("new_vnode(%p): vnode still hooked into the name cache", vp);
5435 }
5436 } else {
5437 vnode_drop_and_unlock(vp);
5438 vp = NULLVP;
5439 }
5440 }
5441 return vp;
5442 }
5443
5444 __attribute__((noreturn))
5445 static void
async_work_continue(void)5446 async_work_continue(void)
5447 {
5448 struct async_work_lst *q;
5449 int deferred;
5450 vnode_t vp;
5451
5452 q = &vnode_async_work_list;
5453
5454 for (;;) {
5455 vnode_list_lock();
5456
5457 if (TAILQ_EMPTY(q)) {
5458 assert_wait(q, (THREAD_UNINT));
5459
5460 vnode_list_unlock();
5461
5462 thread_block((thread_continue_t)async_work_continue);
5463
5464 continue;
5465 }
5466 async_work_handled++;
5467
5468 vp = TAILQ_FIRST(q);
5469
5470 vp = process_vp(vp, 0, false, &deferred);
5471
5472 if (vp != NULLVP) {
5473 panic("found VBAD vp (%p) on async queue", vp);
5474 }
5475 }
5476 }
5477
5478 #if CONFIG_JETSAM
5479 bool do_async_jetsam = false;
5480 #endif
5481
5482 __attribute__((noreturn))
5483 static void
vn_laundry_continue(void)5484 vn_laundry_continue(void)
5485 {
5486 struct freelst *free_q;
5487 struct ragelst *rage_q;
5488 vnode_t vp;
5489 int deferred;
5490 bool rage_q_empty;
5491 bool free_q_empty;
5492
5493
5494 free_q = &vnode_free_list;
5495 rage_q = &vnode_rage_list;
5496
5497 for (;;) {
5498 vnode_list_lock();
5499
5500 #if CONFIG_JETSAM
5501 if (do_async_jetsam) {
5502 do_async_jetsam = false;
5503 if (deadvnodes <= deadvnodes_low) {
5504 vnode_list_unlock();
5505
5506 log(LOG_EMERG, "Initiating vnode jetsam : %d desired, %ld numvnodes, "
5507 "%ld free, %ld dead, %ld async, %d rage\n",
5508 desiredvnodes, numvnodes, freevnodes, deadvnodes, async_work_vnodes, ragevnodes);
5509
5510 memorystatus_kill_on_vnode_exhaustion();
5511
5512 continue;
5513 }
5514 }
5515 #endif
5516
5517 if (!TAILQ_EMPTY(&vnode_async_work_list)) {
5518 vp = TAILQ_FIRST(&vnode_async_work_list);
5519 async_work_handled++;
5520
5521 vp = process_vp(vp, 0, false, &deferred);
5522
5523 if (vp != NULLVP) {
5524 panic("found VBAD vp (%p) on async queue", vp);
5525 }
5526 continue;
5527 }
5528
5529 free_q_empty = TAILQ_EMPTY(free_q);
5530 rage_q_empty = TAILQ_EMPTY(rage_q);
5531
5532 if (!rage_q_empty && !free_q_empty) {
5533 struct timeval current_tv;
5534
5535 microuptime(¤t_tv);
5536 if (ragevnodes < rage_limit &&
5537 ((current_tv.tv_sec - rage_tv.tv_sec) < RAGE_TIME_LIMIT)) {
5538 rage_q_empty = true;
5539 }
5540 }
5541
5542 if (numvnodes < numvnodes_min || (rage_q_empty && free_q_empty) ||
5543 (reusablevnodes <= reusablevnodes_max && deadvnodes >= deadvnodes_high)) {
5544 assert_wait(free_q, (THREAD_UNINT));
5545
5546 vnode_list_unlock();
5547
5548 thread_block((thread_continue_t)vn_laundry_continue);
5549
5550 continue;
5551 }
5552
5553 if (!rage_q_empty) {
5554 vp = TAILQ_FIRST(rage_q);
5555 } else {
5556 vp = TAILQ_FIRST(free_q);
5557 }
5558
5559 vp = process_vp(vp, 0, false, &deferred);
5560
5561 if (vp != NULLVP) {
5562 /* If process_vp returns a vnode, it is locked and has a holdcount */
5563 vnode_drop_and_unlock(vp);
5564 vp = NULLVP;
5565 }
5566 }
5567 }
5568
5569 static inline void
wakeup_laundry_thread()5570 wakeup_laundry_thread()
5571 {
5572 if (deadvnodes_noreuse || (numvnodes >= numvnodes_min && deadvnodes < deadvnodes_low &&
5573 (reusablevnodes > reusablevnodes_max || numvnodes >= desiredvnodes))) {
5574 wakeup(&vnode_free_list);
5575 }
5576 }
5577
5578 /*
5579 * This must be called under vnode_list_lock() to prevent race when accessing
5580 * various vnode stats.
5581 */
5582 static void
send_freeable_vnodes_telemetry(void)5583 send_freeable_vnodes_telemetry(void)
5584 {
5585 bool send_event = false;
5586
5587 /*
5588 * Log an event when the 'numvnodes' is above the freeable vnodes threshold
5589 * or when it falls back within the threshold.
5590 * When the 'numvnodes' is above the threshold, log an event when it has
5591 * been incrementally growing by 25%.
5592 */
5593 if ((numvnodes > desiredvnodes) && (freevnodes + deadvnodes) == 0) {
5594 long last_numvnodes = freeable_vnodes_telemetry.numvnodes;
5595
5596 if (numvnodes > (last_numvnodes + ((last_numvnodes * 25) / 100)) ||
5597 numvnodes >= numvnodes_max) {
5598 send_event = true;
5599 }
5600 freeablevnodes_threshold_crossed = true;
5601 } else if (freeablevnodes_threshold_crossed &&
5602 (freevnodes + deadvnodes) > busyvnodes) {
5603 freeablevnodes_threshold_crossed = false;
5604 send_event = true;
5605 }
5606
5607 if (__improbable(send_event)) {
5608 ca_event_t event = CA_EVENT_ALLOCATE_FLAGS(freeable_vnodes, Z_NOWAIT);
5609
5610 if (event) {
5611 /*
5612 * Update the stats except the 'numvnodes_max' and 'desiredvnodes'
5613 * as they are immutable after init.
5614 */
5615 freeable_vnodes_telemetry.numvnodes_min = numvnodes_min;
5616 freeable_vnodes_telemetry.numvnodes = numvnodes;
5617 freeable_vnodes_telemetry.freevnodes = freevnodes;
5618 freeable_vnodes_telemetry.deadvnodes = deadvnodes;
5619 freeable_vnodes_telemetry.freeablevnodes = freeablevnodes;
5620 freeable_vnodes_telemetry.busyvnodes = busyvnodes;
5621 freeable_vnodes_telemetry.threshold_crossed =
5622 freeablevnodes_threshold_crossed;
5623
5624 memcpy(event->data, &freeable_vnodes_telemetry,
5625 sizeof(CA_EVENT_TYPE(freeable_vnodes)));
5626
5627 if (!freeablevnodes_threshold_crossed) {
5628 freeable_vnodes_telemetry.numvnodes = 0;
5629 }
5630 CA_EVENT_SEND(event);
5631 }
5632 }
5633 }
5634
5635 static int
new_vnode(vnode_t * vpp,bool can_free)5636 new_vnode(vnode_t *vpp, bool can_free)
5637 {
5638 long force_alloc_min;
5639 vnode_t vp;
5640 #if CONFIG_JETSAM
5641 uint32_t retries = 0, max_retries = 2; /* retry incase of tablefull */
5642 #else
5643 uint32_t retries = 0, max_retries = 100; /* retry incase of tablefull */
5644 #endif
5645 int force_alloc = 0, walk_count = 0;
5646 boolean_t need_reliable_vp = FALSE;
5647 int deferred;
5648 struct timeval initial_tv;
5649 struct timeval current_tv;
5650 proc_t curproc = current_proc();
5651 bool force_alloc_freeable = false;
5652
5653 if (vn_dealloc_level == DEALLOC_VNODE_NONE) {
5654 can_free = false;
5655 }
5656
5657 initial_tv.tv_sec = 0;
5658 retry:
5659 vp = NULLVP;
5660
5661 vnode_list_lock();
5662 newvnode++;
5663
5664 if (need_reliable_vp == TRUE) {
5665 async_work_timed_out++;
5666 }
5667
5668 /*
5669 * The vnode list lock was dropped after force_alloc_freeable was set,
5670 * reevaluate.
5671 */
5672 force_alloc_min = MAX(desiredvnodes, numvnodes_min);
5673 if (force_alloc_freeable &&
5674 (numvnodes < force_alloc_min || numvnodes >= numvnodes_max)) {
5675 force_alloc_freeable = false;
5676 }
5677
5678 #if CONFIG_JETSAM
5679 if ((numvnodes_max > desiredvnodes) && numvnodes > (numvnodes_max - 100)
5680 #if (DEVELOPMENT || DEBUG)
5681 && !bootarg_no_vnode_jetsam
5682 #endif
5683 ) {
5684 do_async_jetsam = true;
5685 wakeup(&vnode_free_list);
5686 }
5687 #endif /* CONFIG_JETSAM */
5688
5689 if (((numvnodes - deadvnodes + deadvnodes_noreuse) < desiredvnodes) ||
5690 force_alloc || force_alloc_freeable) {
5691 struct timespec ts;
5692 uint32_t vflag = 0;
5693
5694 /*
5695 * Can always reuse a dead one except if it is in the process of
5696 * being freed or the FS cannot handle freeable vnodes.
5697 */
5698 if (!TAILQ_EMPTY(&vnode_dead_list)) {
5699 /* Select an appropriate deadvnode */
5700 if (numvnodes <= numvnodes_min || !can_free) {
5701 /* all vnodes upto numvnodes_min are not freeable */
5702 vp = TAILQ_FIRST(&vnode_dead_list);
5703 if (numvnodes > numvnodes_min &&
5704 (vp->v_flag & VCANDEALLOC)) {
5705 /*
5706 * Freeable vnodes are added to the
5707 * back of the queue, so if the first
5708 * from the front is freeable, then
5709 * there are none on the dead list.
5710 */
5711 vp = NULLVP;
5712 }
5713 } else {
5714 /*
5715 * Filesystems which opt in to freeable vnodes
5716 * can get either one.
5717 */
5718 TAILQ_FOREACH_REVERSE(vp, &vnode_dead_list,
5719 deadlst, v_freelist) {
5720 if (!(vp->v_listflag & VLIST_NO_REUSE)) {
5721 break;
5722 }
5723 }
5724 }
5725
5726 if (vp) {
5727 force_alloc_freeable = false;
5728 goto steal_this_vp;
5729 }
5730 }
5731
5732 /*
5733 * no dead vnodes available... if we're under
5734 * the limit, we'll create a new vnode
5735 */
5736 numvnodes++;
5737 if (force_alloc) {
5738 numvnodes_min++;
5739 } else if (can_free && (numvnodes > numvnodes_min)) {
5740 allocedvnodes++;
5741 freeablevnodes++;
5742 vflag = VCANDEALLOC;
5743
5744 send_freeable_vnodes_telemetry();
5745 }
5746 vnode_list_unlock();
5747
5748 if (nc_smr_enabled) {
5749 vp = zalloc_smr(vnode_zone, Z_WAITOK_ZERO_NOFAIL);
5750 } else {
5751 vp = zalloc_flags(vnode_zone, Z_WAITOK_ZERO_NOFAIL);
5752 }
5753
5754 VLISTNONE(vp); /* avoid double queue removal */
5755 lck_mtx_init(&vp->v_lock, &vnode_lck_grp, &vnode_lck_attr);
5756
5757 TAILQ_INIT(&vp->v_ncchildren);
5758
5759 klist_init(&vp->v_knotes);
5760 nanouptime(&ts);
5761 vp->v_id = (uint32_t)ts.tv_nsec;
5762 vp->v_flag = VSTANDARD | vflag;
5763 if (force_alloc_freeable) {
5764 /* This vnode should be recycled and freed immediately */
5765 vp->v_lflag = VL_MARKTERM;
5766 vp->v_listflag = VLIST_NO_REUSE;
5767 }
5768
5769 if (vflag & VCANDEALLOC) {
5770 os_atomic_inc(&busyvnodes, relaxed);
5771 }
5772
5773 #if CONFIG_MACF
5774 if (mac_vnode_label_init_needed(vp)) {
5775 mac_vnode_label_init(vp);
5776 }
5777 #endif /* MAC */
5778
5779 #if CONFIG_IOCOUNT_TRACE
5780 if (__improbable(bootarg_vnode_iocount_trace)) {
5781 vp->v_iocount_trace = (vnode_iocount_trace_t)zalloc_permanent(
5782 IOCOUNT_TRACE_MAX_TYPES * sizeof(struct vnode_iocount_trace),
5783 ZALIGN(struct vnode_iocount_trace));
5784 }
5785 #endif /* CONFIG_IOCOUNT_TRACE */
5786
5787 #if CONFIG_FILE_LEASES
5788 LIST_INIT(&vp->v_leases);
5789 #endif
5790
5791 vp->v_iocount = 1;
5792
5793 goto done;
5794 }
5795
5796 microuptime(¤t_tv);
5797
5798 #define MAX_WALK_COUNT 1000
5799
5800 if (!TAILQ_EMPTY(&vnode_rage_list) &&
5801 (ragevnodes >= rage_limit ||
5802 (current_tv.tv_sec - rage_tv.tv_sec) >= RAGE_TIME_LIMIT)) {
5803 TAILQ_FOREACH(vp, &vnode_rage_list, v_freelist) {
5804 if (!(vp->v_listflag & VLIST_RAGE)) {
5805 panic("new_vnode: vp (%p) on RAGE list not marked VLIST_RAGE", vp);
5806 }
5807
5808 // if we're a dependency-capable process, skip vnodes that can
5809 // cause recycling deadlocks. (i.e. this process is diskimages
5810 // helper and the vnode is in a disk image). Querying the
5811 // mnt_kern_flag for the mount's virtual device status
5812 // is safer than checking the mnt_dependent_process, which
5813 // may not be updated if there are multiple devnode layers
5814 // in between the disk image and the final consumer.
5815
5816 if (((curproc->p_flag & P_DEPENDENCY_CAPABLE) == 0 || vp->v_mount == NULL ||
5817 (vp->v_mount->mnt_kern_flag & MNTK_VIRTUALDEV) == 0) &&
5818 !(vp->v_listflag & VLIST_NO_REUSE) &&
5819 (can_free || !(vp->v_flag & VCANDEALLOC))) {
5820 /*
5821 * if need_reliable_vp == TRUE, then we've already sent one or more
5822 * non-reliable vnodes to the async thread for processing and timed
5823 * out waiting for a dead vnode to show up. Use the MAX_WALK_COUNT
5824 * mechanism to first scan for a reliable vnode before forcing
5825 * a new vnode to be created
5826 */
5827 if (need_reliable_vp == FALSE || vnode_on_reliable_media(vp) == TRUE) {
5828 break;
5829 }
5830 }
5831
5832 // don't iterate more than MAX_WALK_COUNT vnodes to
5833 // avoid keeping the vnode list lock held for too long.
5834
5835 if (walk_count++ > MAX_WALK_COUNT) {
5836 vp = NULL;
5837 break;
5838 }
5839 }
5840 }
5841
5842 if (vp == NULL && !TAILQ_EMPTY(&vnode_free_list)) {
5843 /*
5844 * Pick the first vp for possible reuse
5845 */
5846 walk_count = 0;
5847 TAILQ_FOREACH(vp, &vnode_free_list, v_freelist) {
5848 // if we're a dependency-capable process, skip vnodes that can
5849 // cause recycling deadlocks. (i.e. this process is diskimages
5850 // helper and the vnode is in a disk image). Querying the
5851 // mnt_kern_flag for the mount's virtual device status
5852 // is safer than checking the mnt_dependent_process, which
5853 // may not be updated if there are multiple devnode layers
5854 // in between the disk image and the final consumer.
5855
5856 if (((curproc->p_flag & P_DEPENDENCY_CAPABLE) == 0 || vp->v_mount == NULL ||
5857 (vp->v_mount->mnt_kern_flag & MNTK_VIRTUALDEV) == 0) &&
5858 !(vp->v_listflag & VLIST_NO_REUSE) &&
5859 (can_free || !(vp->v_flag & VCANDEALLOC))) {
5860 /*
5861 * if need_reliable_vp == TRUE, then we've already sent one or more
5862 * non-reliable vnodes to the async thread for processing and timed
5863 * out waiting for a dead vnode to show up. Use the MAX_WALK_COUNT
5864 * mechanism to first scan for a reliable vnode before forcing
5865 * a new vnode to be created
5866 */
5867 if (need_reliable_vp == FALSE || vnode_on_reliable_media(vp) == TRUE) {
5868 break;
5869 }
5870 }
5871
5872 // don't iterate more than MAX_WALK_COUNT vnodes to
5873 // avoid keeping the vnode list lock held for too long.
5874
5875 if (walk_count++ > MAX_WALK_COUNT) {
5876 vp = NULL;
5877 break;
5878 }
5879 }
5880 }
5881
5882 //
5883 // if we don't have a vnode and the walk_count is >= MAX_WALK_COUNT
5884 // then we're trying to create a vnode on behalf of a
5885 // process like diskimages-helper that has file systems
5886 // mounted on top of itself (and thus we can't reclaim
5887 // vnodes in the file systems on top of us). if we can't
5888 // find a vnode to reclaim then we'll just have to force
5889 // the allocation.
5890 //
5891 if (vp == NULL && walk_count >= MAX_WALK_COUNT) {
5892 force_alloc = 1;
5893 vnode_list_unlock();
5894 goto retry;
5895 }
5896
5897 if (vp == NULL) {
5898 if (can_free && (vn_dealloc_level > DEALLOC_VNODE_NONE) &&
5899 (numvnodes >= force_alloc_min) && (numvnodes < numvnodes_max)) {
5900 force_alloc_freeable = true;
5901 vnode_list_unlock();
5902 goto retry;
5903 }
5904 vnode_list_unlock();
5905
5906 /*
5907 * we've reached the system imposed maximum number of vnodes
5908 * but there isn't a single one available
5909 * wait a bit and then retry... if we can't get a vnode
5910 * after our target number of retries, than log a complaint
5911 */
5912 if (++retries <= max_retries) {
5913 delay_for_interval(1, 1000 * 1000);
5914 goto retry;
5915 }
5916
5917 tablefull("vnode");
5918 log(LOG_EMERG, "%d desired, %ld numvnodes, "
5919 "%ld free, %ld dead, %ld async, %d rage\n",
5920 desiredvnodes, numvnodes, freevnodes, deadvnodes, async_work_vnodes, ragevnodes);
5921
5922 #if CONFIG_JETSAM
5923 /*
5924 * Running out of vnodes tends to make a system unusable. Start killing
5925 * processes that jetsam knows are killable.
5926 */
5927 if (!memorystatus_kill_on_vnode_exhaustion()
5928 #if DEVELOPMENT || DEBUG
5929 || bootarg_no_vnode_jetsam
5930 #endif
5931 ) {
5932 /*
5933 * If jetsam can't find any more processes to kill and there
5934 * still aren't any free vnodes, panic. Hopefully we'll get a
5935 * panic log to tell us why we ran out.
5936 */
5937 panic("vnode table is full");
5938 }
5939
5940 /*
5941 * Now that we've killed someone, wait a bit and continue looking
5942 */
5943 delay_for_interval(3, 1000 * 1000);
5944 retries = 0;
5945 goto retry;
5946 #endif
5947
5948 *vpp = NULL;
5949 return ENFILE;
5950 }
5951 newvnode_nodead++;
5952 steal_this_vp:
5953 if ((vp = process_vp(vp, 1, true, &deferred)) == NULLVP) {
5954 if (deferred) {
5955 int elapsed_msecs;
5956 struct timeval elapsed_tv;
5957
5958 if (initial_tv.tv_sec == 0) {
5959 microuptime(&initial_tv);
5960 }
5961
5962 vnode_list_lock();
5963
5964 dead_vnode_waited++;
5965 dead_vnode_wanted++;
5966
5967 /*
5968 * note that we're only going to explicitly wait 10ms
5969 * for a dead vnode to become available, since even if one
5970 * isn't available, a reliable vnode might now be available
5971 * at the head of the VRAGE or free lists... if so, we
5972 * can satisfy the new_vnode request with less latency then waiting
5973 * for the full 100ms duration we're ultimately willing to tolerate
5974 */
5975 assert_wait_timeout((caddr_t)&dead_vnode_wanted, (THREAD_INTERRUPTIBLE), 10000, NSEC_PER_USEC);
5976
5977 vnode_list_unlock();
5978
5979 thread_block(THREAD_CONTINUE_NULL);
5980
5981 microuptime(&elapsed_tv);
5982
5983 timevalsub(&elapsed_tv, &initial_tv);
5984 elapsed_msecs = (int)(elapsed_tv.tv_sec * 1000 + elapsed_tv.tv_usec / 1000);
5985
5986 if (elapsed_msecs >= 100) {
5987 /*
5988 * we've waited long enough... 100ms is
5989 * somewhat arbitrary for this case, but the
5990 * normal worst case latency used for UI
5991 * interaction is 100ms, so I've chosen to
5992 * go with that.
5993 *
5994 * setting need_reliable_vp to TRUE
5995 * forces us to find a reliable vnode
5996 * that we can process synchronously, or
5997 * to create a new one if the scan for
5998 * a reliable one hits the scan limit
5999 */
6000 need_reliable_vp = TRUE;
6001 }
6002 }
6003 goto retry;
6004 }
6005 OSAddAtomicLong(1, &num_reusedvnodes);
6006
6007
6008 #if CONFIG_MACF
6009 /*
6010 * We should never see VL_LABELWAIT or VL_LABEL here.
6011 * as those operations hold a reference.
6012 */
6013 assert((vp->v_lflag & VL_LABELWAIT) != VL_LABELWAIT);
6014 assert((vp->v_lflag & VL_LABEL) != VL_LABEL);
6015 if (vp->v_lflag & VL_LABELED || mac_vnode_label(vp) != NULL) {
6016 vnode_lock_convert(vp);
6017 mac_vnode_label_recycle(vp);
6018 } else if (mac_vnode_label_init_needed(vp)) {
6019 vnode_lock_convert(vp);
6020 mac_vnode_label_init(vp);
6021 }
6022
6023 #endif /* MAC */
6024
6025 vp->v_iocount = 1;
6026 vp->v_lflag = 0;
6027 vp->v_writecount = 0;
6028 vp->v_references = 0;
6029 vp->v_iterblkflags = 0;
6030 if (can_free && (vp->v_flag & VCANDEALLOC)) {
6031 vp->v_flag = VSTANDARD | VCANDEALLOC;
6032 } else {
6033 vp->v_flag = VSTANDARD;
6034 }
6035
6036 /* vbad vnodes can point to dead_mountp */
6037 vp->v_mount = NULL;
6038 vp->v_defer_reclaimlist = (vnode_t)0;
6039
6040 /* process_vp returns a locked vnode with a holdcount */
6041 vnode_drop_and_unlock(vp);
6042
6043 done:
6044 *vpp = vp;
6045
6046 return 0;
6047 }
6048
6049 void
vnode_lock(vnode_t vp)6050 vnode_lock(vnode_t vp)
6051 {
6052 lck_mtx_lock(&vp->v_lock);
6053 }
6054
6055 void
vnode_lock_spin(vnode_t vp)6056 vnode_lock_spin(vnode_t vp)
6057 {
6058 lck_mtx_lock_spin(&vp->v_lock);
6059 }
6060
6061 void
vnode_unlock(vnode_t vp)6062 vnode_unlock(vnode_t vp)
6063 {
6064 lck_mtx_unlock(&vp->v_lock);
6065 }
6066
6067 void
vnode_hold(vnode_t vp)6068 vnode_hold(vnode_t vp)
6069 {
6070 int32_t old_holdcount = os_atomic_inc_orig(&vp->v_holdcount, relaxed);
6071
6072 if (old_holdcount == INT32_MAX) {
6073 /*
6074 * Because we allow atomic ops on the holdcount it is
6075 * possible that when the vnode is examined, its holdcount
6076 * is different than what will be printed in this
6077 * panic message.
6078 */
6079 panic("%s: vp %p holdcount overflow from : %d v_tag = %d, v_type = %d, v_flag = %x.",
6080 __FUNCTION__, vp, old_holdcount, vp->v_tag, vp->v_type, vp->v_flag);
6081 }
6082 }
6083
6084 #define VNODE_HOLD_NO_SMR (1<<29) /* Disable vnode_hold_smr */
6085
6086 /*
6087 * To be used when smr is the only protection (cache_lookup and cache_lookup_path)
6088 */
6089 bool
vnode_hold_smr(vnode_t vp)6090 vnode_hold_smr(vnode_t vp)
6091 {
6092 int32_t holdcount;
6093
6094 /*
6095 * For "high traffic" vnodes like rootvnode, the atomic
6096 * cmpexcg loop below can turn into a infinite loop, no need
6097 * to do it for vnodes that won't be dealloc'ed
6098 */
6099 if (!(os_atomic_load(&vp->v_flag, relaxed) & VCANDEALLOC)) {
6100 vnode_hold(vp);
6101 return true;
6102 }
6103
6104 for (;;) {
6105 holdcount = os_atomic_load(&vp->v_holdcount, relaxed);
6106
6107 if (holdcount & VNODE_HOLD_NO_SMR) {
6108 return false;
6109 }
6110
6111 if ((os_atomic_cmpxchg(&vp->v_holdcount, holdcount, holdcount + 1, relaxed) != 0)) {
6112 return true;
6113 }
6114 }
6115 }
6116
6117 /*
6118 * free callback from smr enabled zones
6119 */
6120 static void
vnode_smr_free(void * _vp,__unused size_t _size)6121 vnode_smr_free(void *_vp, __unused size_t _size)
6122 {
6123 vnode_t vp = _vp;
6124
6125 bzero(vp, sizeof(*vp));
6126 }
6127
6128 static vnode_t
vnode_drop_internal(vnode_t vp,bool locked)6129 vnode_drop_internal(vnode_t vp, bool locked)
6130 {
6131 int32_t old_holdcount = os_atomic_dec_orig(&vp->v_holdcount, relaxed);
6132
6133 if (old_holdcount < 1) {
6134 if (locked) {
6135 vnode_unlock(vp);
6136 }
6137
6138 /*
6139 * Because we allow atomic ops on the holdcount it is possible
6140 * that when the vnode is examined, its holdcount is different
6141 * than what will be printed in this panic message.
6142 */
6143 panic("%s : vp %p holdcount -ve: %d. v_tag = %d, v_type = %d, v_flag = %x.",
6144 __FUNCTION__, vp, old_holdcount - 1, vp->v_tag, vp->v_type, vp->v_flag);
6145 }
6146
6147 if (vn_dealloc_level == DEALLOC_VNODE_NONE || old_holdcount > 1 ||
6148 !(vp->v_flag & VCANDEALLOC) || !(vp->v_lflag & VL_DEAD)) {
6149 if (locked) {
6150 vnode_unlock(vp);
6151 }
6152 return vp;
6153 }
6154
6155 if (!locked) {
6156 vnode_lock(vp);
6157 }
6158
6159 if ((os_atomic_load(&vp->v_holdcount, relaxed) != 0) || vp->v_iocount ||
6160 vp->v_usecount || !(vp->v_flag & VCANDEALLOC) || !(vp->v_lflag & VL_DEAD)) {
6161 vnode_unlock(vp);
6162 return vp;
6163 }
6164
6165 vnode_list_lock();
6166
6167 /*
6168 * the v_listflag field is protected by the vnode_list_lock
6169 */
6170 if (VONLIST(vp) && (vp->v_listflag & VLIST_DEAD) &&
6171 (numvnodes > desiredvnodes || (vp->v_listflag & VLIST_NO_REUSE) ||
6172 vn_dealloc_level != DEALLOC_VNODE_ALL || deadvnodes >= deadvnodes_high) &&
6173 (os_atomic_cmpxchg(&vp->v_holdcount, 0, VNODE_HOLD_NO_SMR, relaxed) != 0)) {
6174 VREMDEAD("vnode_list_remove", vp);
6175 numvnodes--;
6176 freeablevnodes--;
6177 deallocedvnodes++;
6178 vp->v_listflag = 0;
6179
6180 send_freeable_vnodes_telemetry();
6181 vnode_list_unlock();
6182
6183 #if CONFIG_MACF
6184 struct label *tmpl = mac_vnode_label(vp);
6185 vp->v_label = NULL;
6186 #endif /* CONFIG_MACF */
6187
6188 vnode_unlock(vp);
6189
6190 #if CONFIG_MACF
6191 if (tmpl) {
6192 mac_vnode_label_free(tmpl);
6193 }
6194 #endif /* CONFIG_MACF */
6195
6196 if (nc_smr_enabled) {
6197 zfree_smr(vnode_zone, vp);
6198 } else {
6199 zfree(vnode_zone, vp);
6200 }
6201
6202 vp = NULLVP;
6203 } else {
6204 vnode_list_unlock();
6205 vnode_unlock(vp);
6206 }
6207
6208 return vp;
6209 }
6210
6211 vnode_t
vnode_drop_and_unlock(vnode_t vp)6212 vnode_drop_and_unlock(vnode_t vp)
6213 {
6214 return vnode_drop_internal(vp, true);
6215 }
6216
6217 vnode_t
vnode_drop(vnode_t vp)6218 vnode_drop(vnode_t vp)
6219 {
6220 return vnode_drop_internal(vp, false);
6221 }
6222
6223 SYSCTL_NODE(_vfs, OID_AUTO, vnstats, CTLFLAG_RD | CTLFLAG_LOCKED, NULL, "vfs vnode stats");
6224
6225 SYSCTL_COMPAT_INT(_vfs_vnstats, OID_AUTO, vn_dealloc_level,
6226 CTLFLAG_RD | CTLFLAG_LOCKED,
6227 &vn_dealloc_level, 0, "");
6228 SYSCTL_COMPAT_INT(_vfs_vnstats, OID_AUTO, desired_vnodes,
6229 CTLFLAG_RD | CTLFLAG_LOCKED,
6230 &desiredvnodes, 0, "");
6231 SYSCTL_LONG(_vfs_vnstats, OID_AUTO, num_vnodes,
6232 CTLFLAG_RD | CTLFLAG_LOCKED,
6233 &numvnodes, "");
6234 SYSCTL_COMPAT_INT(_vfs_vnstats, OID_AUTO, num_vnodes_min,
6235 CTLFLAG_RD | CTLFLAG_LOCKED,
6236 &numvnodes_min, 0, "");
6237 SYSCTL_COMPAT_INT(_vfs_vnstats, OID_AUTO, num_vnodes_max,
6238 CTLFLAG_RD | CTLFLAG_LOCKED,
6239 &numvnodes_max, 0, "");
6240 SYSCTL_COMPAT_INT(_vfs_vnstats, OID_AUTO, num_deallocable_vnodes,
6241 CTLFLAG_RD | CTLFLAG_LOCKED,
6242 &freeablevnodes, 0, "");
6243 SYSCTL_LONG(_vfs_vnstats, OID_AUTO, num_deallocable_busy_vnodes,
6244 CTLFLAG_RD | CTLFLAG_LOCKED,
6245 &busyvnodes, "");
6246 SYSCTL_LONG(_vfs_vnstats, OID_AUTO, num_dead_vnodes,
6247 CTLFLAG_RD | CTLFLAG_LOCKED,
6248 &deadvnodes, "");
6249 SYSCTL_LONG(_vfs_vnstats, OID_AUTO, num_dead_vnodes_to_dealloc,
6250 CTLFLAG_RD | CTLFLAG_LOCKED,
6251 &deadvnodes_noreuse, "");
6252 SYSCTL_LONG(_vfs_vnstats, OID_AUTO, num_async_work_vnodes,
6253 CTLFLAG_RD | CTLFLAG_LOCKED,
6254 &async_work_vnodes, "");
6255 SYSCTL_COMPAT_INT(_vfs_vnstats, OID_AUTO, num_rapid_aging_vnodes,
6256 CTLFLAG_RD | CTLFLAG_LOCKED,
6257 &ragevnodes, 0, "");
6258 SYSCTL_LONG(_vfs_vnstats, OID_AUTO, num_free_vnodes,
6259 CTLFLAG_RD | CTLFLAG_LOCKED,
6260 &freevnodes, "");
6261 SYSCTL_LONG(_vfs_vnstats, OID_AUTO, num_recycledvnodes,
6262 CTLFLAG_RD | CTLFLAG_LOCKED,
6263 &num_recycledvnodes, "");
6264 SYSCTL_QUAD(_vfs_vnstats, OID_AUTO, num_allocedvnodes,
6265 CTLFLAG_RD | CTLFLAG_LOCKED,
6266 &allocedvnodes, "");
6267 SYSCTL_QUAD(_vfs_vnstats, OID_AUTO, num_deallocedvnodes,
6268 CTLFLAG_RD | CTLFLAG_LOCKED,
6269 &deallocedvnodes, "");
6270 SYSCTL_QUAD(_vfs_vnstats, OID_AUTO, num_newvnode_calls,
6271 CTLFLAG_RD | CTLFLAG_LOCKED,
6272 &newvnode, "");
6273 SYSCTL_QUAD(_vfs_vnstats, OID_AUTO, num_newvnode_calls_nodead,
6274 CTLFLAG_RD | CTLFLAG_LOCKED,
6275 &newvnode_nodead, "");
6276
6277 int
vnode_get(struct vnode * vp)6278 vnode_get(struct vnode *vp)
6279 {
6280 int retval;
6281
6282 vnode_lock_spin(vp);
6283 retval = vnode_get_locked(vp);
6284 vnode_unlock(vp);
6285
6286 return retval;
6287 }
6288
6289 int
vnode_get_locked(struct vnode * vp)6290 vnode_get_locked(struct vnode *vp)
6291 {
6292 #if DIAGNOSTIC
6293 lck_mtx_assert(&vp->v_lock, LCK_MTX_ASSERT_OWNED);
6294 #endif
6295 if ((vp->v_iocount == 0) && (vp->v_lflag & (VL_TERMINATE | VL_DEAD))) {
6296 return ENOENT;
6297 }
6298
6299 if (os_add_overflow(vp->v_iocount, 1, &vp->v_iocount)) {
6300 panic("v_iocount overflow");
6301 }
6302
6303 #ifdef CONFIG_IOCOUNT_TRACE
6304 record_vp(vp, 1);
6305 #endif
6306 return 0;
6307 }
6308
6309 /*
6310 * vnode_getwithvid() cuts in line in front of a vnode drain (that is,
6311 * while the vnode is draining, but at no point after that) to prevent
6312 * deadlocks when getting vnodes from filesystem hashes while holding
6313 * resources that may prevent other iocounts from being released.
6314 */
6315 int
vnode_getwithvid(vnode_t vp,uint32_t vid)6316 vnode_getwithvid(vnode_t vp, uint32_t vid)
6317 {
6318 return vget_internal(vp, vid, (VNODE_NODEAD | VNODE_WITHID | VNODE_DRAINO));
6319 }
6320
6321 /*
6322 * vnode_getwithvid_drainok() is like vnode_getwithvid(), but *does* block behind a vnode
6323 * drain; it exists for use in the VFS name cache, where we really do want to block behind
6324 * vnode drain to prevent holding off an unmount.
6325 */
6326 int
vnode_getwithvid_drainok(vnode_t vp,uint32_t vid)6327 vnode_getwithvid_drainok(vnode_t vp, uint32_t vid)
6328 {
6329 return vget_internal(vp, vid, (VNODE_NODEAD | VNODE_WITHID));
6330 }
6331
6332 int
vnode_getwithref(vnode_t vp)6333 vnode_getwithref(vnode_t vp)
6334 {
6335 return vget_internal(vp, 0, 0);
6336 }
6337
6338 /*
6339 * This is not a noblock variant of vnode_getwithref, this also returns an error
6340 * if the vnode is dead. It should only be called if the calling context already
6341 * has a usecount or iocount.
6342 */
6343 int
vnode_getwithref_noblock(vnode_t vp)6344 vnode_getwithref_noblock(vnode_t vp)
6345 {
6346 return vget_internal(vp, 0, (VNODE_NOBLOCK | VNODE_NODEAD | VNODE_WITHREF));
6347 }
6348
6349 __private_extern__ int
vnode_getalways(vnode_t vp)6350 vnode_getalways(vnode_t vp)
6351 {
6352 return vget_internal(vp, 0, VNODE_ALWAYS);
6353 }
6354
6355 __private_extern__ int
vnode_getalways_from_pager(vnode_t vp)6356 vnode_getalways_from_pager(vnode_t vp)
6357 {
6358 return vget_internal(vp, 0, VNODE_ALWAYS | VNODE_PAGER);
6359 }
6360
6361 static inline void
vn_set_dead(vnode_t vp)6362 vn_set_dead(vnode_t vp)
6363 {
6364 vp->v_mount = NULL;
6365 vp->v_op = dead_vnodeop_p;
6366 vp->v_tag = VT_NON;
6367 vp->v_data = NULL;
6368 vp->v_type = VBAD;
6369 vp->v_lflag |= VL_DEAD;
6370 }
6371
6372 static int
vnode_put_internal_locked(vnode_t vp,bool from_pager)6373 vnode_put_internal_locked(vnode_t vp, bool from_pager)
6374 {
6375 vfs_context_t ctx = vfs_context_current(); /* hoist outside loop */
6376
6377 #if DIAGNOSTIC
6378 lck_mtx_assert(&vp->v_lock, LCK_MTX_ASSERT_OWNED);
6379 #endif
6380 retry:
6381 if (vp->v_iocount < 1) {
6382 panic("vnode_put(%p): iocount < 1", vp);
6383 }
6384
6385 if ((vp->v_usecount > 0) || (vp->v_iocount > 1)) {
6386 vnode_dropiocount(vp);
6387 return 0;
6388 }
6389
6390 if (((vp->v_lflag & (VL_DEAD | VL_NEEDINACTIVE)) == VL_NEEDINACTIVE)) {
6391 vp->v_lflag &= ~VL_NEEDINACTIVE;
6392
6393 if (UBCINFOEXISTS(vp)) {
6394 ubc_cs_free_and_vnode_unlock(vp);
6395 } else {
6396 vnode_unlock(vp);
6397 }
6398
6399 VNOP_INACTIVE(vp, ctx);
6400
6401 vnode_lock_spin(vp);
6402 /*
6403 * because we had to drop the vnode lock before calling
6404 * VNOP_INACTIVE, the state of this vnode may have changed...
6405 * we may pick up both VL_MARTERM and either
6406 * an iocount or a usecount while in the VNOP_INACTIVE call
6407 * we don't want to call vnode_reclaim_internal on a vnode
6408 * that has active references on it... so loop back around
6409 * and reevaluate the state
6410 */
6411 goto retry;
6412 }
6413 vp->v_lflag &= ~VL_NEEDINACTIVE;
6414
6415 vnode_lock_convert(vp);
6416 if ((vp->v_lflag & (VL_MARKTERM | VL_TERMINATE | VL_DEAD)) == VL_MARKTERM) {
6417 if (from_pager) {
6418 /*
6419 * We can't initiate reclaim when called from the pager
6420 * because it will deadlock with itself so we hand it
6421 * off to the async cleaner thread.
6422 */
6423 vnode_async_list_add(vp);
6424 } else {
6425 vnode_reclaim_internal(vp, 1, 1, 0);
6426 }
6427 }
6428 vnode_dropiocount(vp);
6429 vnode_list_add(vp);
6430
6431 return 0;
6432 }
6433
6434 int
vnode_put_locked(vnode_t vp)6435 vnode_put_locked(vnode_t vp)
6436 {
6437 return vnode_put_internal_locked(vp, false);
6438 }
6439
6440 int
vnode_put(vnode_t vp)6441 vnode_put(vnode_t vp)
6442 {
6443 int retval;
6444
6445 vnode_lock_spin(vp);
6446 vnode_hold(vp);
6447 retval = vnode_put_internal_locked(vp, false);
6448 vnode_drop_and_unlock(vp);
6449
6450 return retval;
6451 }
6452
6453 int
vnode_put_from_pager(vnode_t vp)6454 vnode_put_from_pager(vnode_t vp)
6455 {
6456 int retval;
6457
6458 vnode_lock_spin(vp);
6459 vnode_hold(vp);
6460 /* Cannot initiate reclaim while paging */
6461 retval = vnode_put_internal_locked(vp, true);
6462 vnode_drop_and_unlock(vp);
6463
6464 return retval;
6465 }
6466
6467 int
vnode_writecount(vnode_t vp)6468 vnode_writecount(vnode_t vp)
6469 {
6470 return vp->v_writecount;
6471 }
6472
6473 /* is vnode_t in use by others? */
6474 int
vnode_isinuse(vnode_t vp,int refcnt)6475 vnode_isinuse(vnode_t vp, int refcnt)
6476 {
6477 return vnode_isinuse_locked(vp, refcnt, 0);
6478 }
6479
6480 int
vnode_usecount(vnode_t vp)6481 vnode_usecount(vnode_t vp)
6482 {
6483 return vp->v_usecount;
6484 }
6485
6486 int
vnode_iocount(vnode_t vp)6487 vnode_iocount(vnode_t vp)
6488 {
6489 if (!(vp->v_ext_flag & VE_LINKCHANGE)) {
6490 return vp->v_iocount;
6491 } else {
6492 int iocount = 0;
6493 vnode_lock_spin(vp);
6494 if (!(vp->v_ext_flag & VE_LINKCHANGE)) {
6495 iocount = vp->v_iocount;
6496 } else {
6497 /* the "link lock" takes its own iocount */
6498 iocount = vp->v_iocount - 1;
6499 }
6500 vnode_unlock(vp);
6501 return iocount;
6502 }
6503 }
6504
6505 int
vnode_isinuse_locked(vnode_t vp,int refcnt,int locked)6506 vnode_isinuse_locked(vnode_t vp, int refcnt, int locked)
6507 {
6508 int retval = 0;
6509
6510 if (!locked) {
6511 vnode_lock_spin(vp);
6512 }
6513 if ((vp->v_type != VREG) && ((vp->v_usecount - vp->v_kusecount) > refcnt)) {
6514 retval = 1;
6515 goto out;
6516 }
6517 if (vp->v_type == VREG) {
6518 retval = ubc_isinuse_locked(vp, refcnt, 1);
6519 }
6520
6521 out:
6522 if (!locked) {
6523 vnode_unlock(vp);
6524 }
6525 return retval;
6526 }
6527
6528 kauth_cred_t
vnode_cred(vnode_t vp)6529 vnode_cred(vnode_t vp)
6530 {
6531 if (vp->v_cred) {
6532 return kauth_cred_require(vp->v_cred);
6533 }
6534
6535 return NULL;
6536 }
6537
6538
6539 /* resume vnode_t */
6540 errno_t
vnode_resume(vnode_t vp)6541 vnode_resume(vnode_t vp)
6542 {
6543 if ((vp->v_lflag & VL_SUSPENDED) && vp->v_owner == current_thread()) {
6544 vnode_lock_spin(vp);
6545 vp->v_lflag &= ~VL_SUSPENDED;
6546 vp->v_owner = NULL;
6547 vnode_unlock(vp);
6548
6549 wakeup(&vp->v_iocount);
6550 }
6551 return 0;
6552 }
6553
6554 /* suspend vnode_t
6555 * Please do not use on more than one vnode at a time as it may
6556 * cause deadlocks.
6557 * xxx should we explicity prevent this from happening?
6558 */
6559
6560 errno_t
vnode_suspend(vnode_t vp)6561 vnode_suspend(vnode_t vp)
6562 {
6563 if (vp->v_lflag & VL_SUSPENDED) {
6564 return EBUSY;
6565 }
6566
6567 vnode_lock_spin(vp);
6568
6569 /*
6570 * xxx is this sufficient to check if a vnode_drain is
6571 * progress?
6572 */
6573
6574 if (vp->v_owner == NULL) {
6575 vp->v_lflag |= VL_SUSPENDED;
6576 vp->v_owner = current_thread();
6577 }
6578 vnode_unlock(vp);
6579
6580 return 0;
6581 }
6582
6583 /*
6584 * Release any blocked locking requests on the vnode.
6585 * Used for forced-unmounts.
6586 *
6587 * XXX What about network filesystems?
6588 */
6589 static void
vnode_abort_advlocks(vnode_t vp)6590 vnode_abort_advlocks(vnode_t vp)
6591 {
6592 if (vp->v_flag & VLOCKLOCAL) {
6593 lf_abort_advlocks(vp);
6594 }
6595 }
6596
6597
6598 static errno_t
vnode_drain(vnode_t vp)6599 vnode_drain(vnode_t vp)
6600 {
6601 if (vp->v_lflag & VL_DRAIN) {
6602 panic("vnode_drain: recursive drain");
6603 return ENOENT;
6604 }
6605 vp->v_lflag |= VL_DRAIN;
6606 vp->v_owner = current_thread();
6607
6608 while (vp->v_iocount > 1) {
6609 if (bootarg_no_vnode_drain) {
6610 struct timespec ts = {.tv_sec = 10, .tv_nsec = 0};
6611 int error;
6612
6613 if (vfs_unmountall_started) {
6614 ts.tv_sec = 1;
6615 }
6616
6617 error = msleep(&vp->v_iocount, &vp->v_lock, PVFS, "vnode_drain_with_timeout", &ts);
6618
6619 /* Try to deal with leaked iocounts under bootarg and shutting down */
6620 if (vp->v_iocount > 1 && error == EWOULDBLOCK &&
6621 ts.tv_sec == 1 && vp->v_numoutput == 0) {
6622 vp->v_iocount = 1;
6623 break;
6624 }
6625 } else {
6626 msleep(&vp->v_iocount, &vp->v_lock, PVFS, "vnode_drain", NULL);
6627 }
6628 }
6629
6630 vp->v_lflag &= ~VL_DRAIN;
6631
6632 return 0;
6633 }
6634
6635
6636 /*
6637 * if the number of recent references via vnode_getwithvid or vnode_getwithref
6638 * exceeds this threshold, than 'UN-AGE' the vnode by removing it from
6639 * the LRU list if it's currently on it... once the iocount and usecount both drop
6640 * to 0, it will get put back on the end of the list, effectively making it younger
6641 * this allows us to keep actively referenced vnodes in the list without having
6642 * to constantly remove and add to the list each time a vnode w/o a usecount is
6643 * referenced which costs us taking and dropping a global lock twice.
6644 * However, if the vnode is marked DIRTY, we want to pull it out much earlier
6645 */
6646 #define UNAGE_THRESHHOLD 25
6647 #define UNAGE_DIRTYTHRESHHOLD 6
6648
6649 errno_t
vnode_getiocount(vnode_t vp,unsigned int vid,int vflags)6650 vnode_getiocount(vnode_t vp, unsigned int vid, int vflags)
6651 {
6652 int nodead = vflags & VNODE_NODEAD;
6653 int nosusp = vflags & VNODE_NOSUSPEND;
6654 int always = vflags & VNODE_ALWAYS;
6655 int beatdrain = vflags & VNODE_DRAINO;
6656 int withvid = vflags & VNODE_WITHID;
6657 int forpager = vflags & VNODE_PAGER;
6658 int noblock = vflags & VNODE_NOBLOCK;
6659
6660 for (;;) {
6661 int sleepflg = 0;
6662
6663 /*
6664 * if it is a dead vnode with deadfs
6665 */
6666 if (nodead && (vp->v_lflag & VL_DEAD) && ((vp->v_type == VBAD) || (vp->v_data == 0))) {
6667 return ENOENT;
6668 }
6669 /*
6670 * will return VL_DEAD ones
6671 */
6672 if ((vp->v_lflag & (VL_SUSPENDED | VL_DRAIN | VL_TERMINATE)) == 0) {
6673 break;
6674 }
6675 /*
6676 * if suspended vnodes are to be failed
6677 */
6678 if (nosusp && (vp->v_lflag & VL_SUSPENDED)) {
6679 return ENOENT;
6680 }
6681 /*
6682 * if you are the owner of drain/suspend/termination , can acquire iocount
6683 * check for VL_TERMINATE; it does not set owner
6684 */
6685 if ((vp->v_lflag & (VL_DRAIN | VL_SUSPENDED | VL_TERMINATE)) &&
6686 (vp->v_owner == current_thread())) {
6687 break;
6688 }
6689
6690 if (always != 0) {
6691 break;
6692 }
6693
6694 if (noblock && (vp->v_lflag & (VL_DRAIN | VL_SUSPENDED | VL_TERMINATE))) {
6695 return ENOENT;
6696 }
6697
6698 /*
6699 * If this vnode is getting drained, there are some cases where
6700 * we can't block or, in case of tty vnodes, want to be
6701 * interruptible.
6702 */
6703 if (vp->v_lflag & VL_DRAIN) {
6704 /*
6705 * In some situations, we want to get an iocount
6706 * even if the vnode is draining to prevent deadlock,
6707 * e.g. if we're in the filesystem, potentially holding
6708 * resources that could prevent other iocounts from
6709 * being released.
6710 */
6711 if (beatdrain) {
6712 break;
6713 }
6714 /*
6715 * Don't block if the vnode's mount point is unmounting as
6716 * we may be the thread the unmount is itself waiting on
6717 * Only callers who pass in vids (at this point, we've already
6718 * handled nosusp and nodead) are expecting error returns
6719 * from this function, so only we can only return errors for
6720 * those. ENODEV is intended to inform callers that the call
6721 * failed because an unmount is in progress.
6722 */
6723 if (withvid && (vp->v_mount) && vfs_isunmount(vp->v_mount)) {
6724 return ENODEV;
6725 }
6726
6727 if (vnode_istty(vp)) {
6728 sleepflg = PCATCH;
6729 }
6730 }
6731
6732 vnode_lock_convert(vp);
6733
6734 if (vp->v_lflag & VL_TERMINATE) {
6735 int error;
6736
6737 vp->v_lflag |= VL_TERMWANT;
6738
6739 error = msleep(&vp->v_lflag, &vp->v_lock,
6740 (PVFS | sleepflg), "vnode getiocount", NULL);
6741 if (error) {
6742 return error;
6743 }
6744 } else {
6745 msleep(&vp->v_iocount, &vp->v_lock, PVFS, "vnode_getiocount", NULL);
6746 }
6747 }
6748 if (withvid && vid != vp->v_id) {
6749 return ENOENT;
6750 }
6751 if (!forpager && (++vp->v_references >= UNAGE_THRESHHOLD ||
6752 (vp->v_flag & VISDIRTY && vp->v_references >= UNAGE_DIRTYTHRESHHOLD))) {
6753 vp->v_references = 0;
6754 vnode_list_remove(vp);
6755 }
6756 vp->v_iocount++;
6757 #ifdef CONFIG_IOCOUNT_TRACE
6758 record_vp(vp, 1);
6759 #endif
6760 return 0;
6761 }
6762
6763 static void
vnode_dropiocount(vnode_t vp)6764 vnode_dropiocount(vnode_t vp)
6765 {
6766 if (vp->v_iocount < 1) {
6767 panic("vnode_dropiocount(%p): v_iocount < 1", vp);
6768 }
6769
6770 vp->v_iocount--;
6771 #ifdef CONFIG_IOCOUNT_TRACE
6772 record_vp(vp, -1);
6773 #endif
6774 if ((vp->v_lflag & (VL_DRAIN | VL_SUSPENDED)) && (vp->v_iocount <= 1)) {
6775 wakeup(&vp->v_iocount);
6776 }
6777 }
6778
6779
6780 void
vnode_reclaim(struct vnode * vp)6781 vnode_reclaim(struct vnode * vp)
6782 {
6783 vnode_reclaim_internal(vp, 0, 0, 0);
6784 }
6785
6786 __private_extern__
6787 void
vnode_reclaim_internal(struct vnode * vp,int locked,int reuse,int flags)6788 vnode_reclaim_internal(struct vnode * vp, int locked, int reuse, int flags)
6789 {
6790 int isfifo = 0;
6791 bool clear_tty_revoke = false;
6792
6793 if (!locked) {
6794 vnode_lock(vp);
6795 }
6796
6797 if (vp->v_lflag & VL_TERMINATE) {
6798 panic("vnode reclaim in progress");
6799 }
6800 vp->v_lflag |= VL_TERMINATE;
6801
6802 vn_clearunionwait(vp, 1);
6803
6804 /*
6805 * We have to force any terminals in reads to return and give up
6806 * their iocounts. It's important to do this after VL_TERMINATE
6807 * has been set to ensure new reads are blocked while the
6808 * revoke is in progress.
6809 */
6810 if (vnode_istty(vp) && (flags & REVOKEALL) && (vp->v_iocount > 1)) {
6811 vnode_unlock(vp);
6812 VNOP_IOCTL(vp, TIOCREVOKE, (caddr_t)NULL, 0, vfs_context_kernel());
6813 clear_tty_revoke = true;
6814 vnode_lock(vp);
6815 }
6816
6817 vnode_drain(vp);
6818
6819 if (clear_tty_revoke) {
6820 vnode_unlock(vp);
6821 VNOP_IOCTL(vp, TIOCREVOKECLEAR, (caddr_t)NULL, 0, vfs_context_kernel());
6822 vnode_lock(vp);
6823 }
6824
6825 #if CONFIG_FILE_LEASES
6826 /*
6827 * Revoke all leases in place for this vnode as it is about to be reclaimed.
6828 * In normal case, there shouldn't be any leases in place by the time we
6829 * get here as there shouldn't be any opens on the vnode (usecount == 0).
6830 * However, in the case of force unmount or unmount of a volume that
6831 * contains file that was opened with O_EVTONLY then the vnode can be
6832 * reclaimed while the file is still opened.
6833 */
6834 vnode_revokelease(vp, true);
6835 #endif
6836
6837 isfifo = (vp->v_type == VFIFO);
6838
6839 if (vp->v_type != VBAD) {
6840 vgone(vp, flags); /* clean and reclaim the vnode */
6841 }
6842 /*
6843 * give the vnode a new identity so that vnode_getwithvid will fail
6844 * on any stale cache accesses...
6845 * grab the list_lock so that if we're in "new_vnode"
6846 * behind the list_lock trying to steal this vnode, the v_id is stable...
6847 * once new_vnode drops the list_lock, it will block trying to take
6848 * the vnode lock until we release it... at that point it will evaluate
6849 * whether the v_vid has changed
6850 * also need to make sure that the vnode isn't on a list where "new_vnode"
6851 * can find it after the v_id has been bumped until we are completely done
6852 * with the vnode (i.e. putting it back on a list has to be the very last
6853 * thing we do to this vnode... many of the callers of vnode_reclaim_internal
6854 * are holding an io_count on the vnode... they need to drop the io_count
6855 * BEFORE doing a vnode_list_add or make sure to hold the vnode lock until
6856 * they are completely done with the vnode
6857 */
6858 vnode_list_lock();
6859
6860 vnode_list_remove_locked(vp);
6861 vp->v_id++;
6862
6863 vnode_list_unlock();
6864
6865 if (isfifo) {
6866 struct fifoinfo * fip;
6867
6868 fip = vp->v_fifoinfo;
6869 vp->v_fifoinfo = NULL;
6870 kfree_type(struct fifoinfo, fip);
6871 }
6872 vp->v_type = VBAD;
6873
6874 if (vp->v_data) {
6875 panic("vnode_reclaim_internal: cleaned vnode isn't");
6876 }
6877 if (vp->v_numoutput) {
6878 panic("vnode_reclaim_internal: clean vnode has pending I/O's");
6879 }
6880 if (UBCINFOEXISTS(vp)) {
6881 panic("vnode_reclaim_internal: ubcinfo not cleaned");
6882 }
6883 if (vp->v_parent) {
6884 panic("vnode_reclaim_internal: vparent not removed");
6885 }
6886 if (vp->v_name) {
6887 panic("vnode_reclaim_internal: vname not removed");
6888 }
6889
6890 #if CONFIG_FILE_LEASES
6891 if (__improbable(!LIST_EMPTY(&vp->v_leases))) {
6892 panic("vnode_reclaim_internal: vleases NOT empty");
6893 }
6894 #endif
6895
6896 vp->v_socket = NULL;
6897
6898 vp->v_lflag &= ~VL_TERMINATE;
6899 vp->v_owner = NULL;
6900
6901 #if CONFIG_IOCOUNT_TRACE
6902 if (__improbable(bootarg_vnode_iocount_trace)) {
6903 bzero(vp->v_iocount_trace,
6904 IOCOUNT_TRACE_MAX_TYPES * sizeof(struct vnode_iocount_trace));
6905 }
6906 #endif /* CONFIG_IOCOUNT_TRACE */
6907
6908 KNOTE(&vp->v_knotes, NOTE_REVOKE);
6909
6910 /* Make sure that when we reuse the vnode, no knotes left over */
6911 klist_init(&vp->v_knotes);
6912
6913 if (vp->v_lflag & VL_TERMWANT) {
6914 vp->v_lflag &= ~VL_TERMWANT;
6915 wakeup(&vp->v_lflag);
6916 }
6917 if (!reuse) {
6918 /*
6919 * make sure we get on the
6920 * dead list if appropriate
6921 */
6922 vnode_list_add(vp);
6923 }
6924 if (!locked) {
6925 vnode_unlock(vp);
6926 }
6927 }
6928
6929 static int
vnode_create_internal(uint32_t flavor,uint32_t size,void * data,vnode_t * vpp,vnode_create_options_t vc_options)6930 vnode_create_internal(uint32_t flavor, uint32_t size, void *data, vnode_t *vpp,
6931 vnode_create_options_t vc_options)
6932 {
6933 int error;
6934 int insert = 1;
6935 vnode_t vp = NULLVP;
6936 vnode_t nvp;
6937 vnode_t dvp;
6938 struct uthread *ut;
6939 struct componentname *cnp;
6940 struct vnode_fsparam *param = (struct vnode_fsparam *)data;
6941 #if CONFIG_TRIGGERS
6942 struct vnode_trigger_param *tinfo = NULL;
6943 #endif
6944 bool existing_vnode;
6945 bool init_vnode = !(vc_options & VNODE_CREATE_EMPTY);
6946 bool is_bdevvp = false;
6947
6948 if (*vpp) {
6949 vp = *vpp;
6950 *vpp = NULLVP;
6951 existing_vnode = true;
6952 } else {
6953 existing_vnode = false;
6954 }
6955
6956 if (init_vnode) {
6957 /* Do quick sanity check on the parameters. */
6958 if ((param == NULL) || (param->vnfs_vtype == VBAD)) {
6959 error = EINVAL;
6960 goto error_out;
6961 }
6962
6963 #if CONFIG_TRIGGERS
6964 if ((flavor == VNCREATE_TRIGGER) && (size == VNCREATE_TRIGGER_SIZE)) {
6965 tinfo = (struct vnode_trigger_param *)data;
6966
6967 /* Validate trigger vnode input */
6968 if ((param->vnfs_vtype != VDIR) ||
6969 (tinfo->vnt_resolve_func == NULL) ||
6970 (tinfo->vnt_flags & ~VNT_VALID_MASK)) {
6971 error = EINVAL;
6972 goto error_out;
6973 }
6974 /* Fall through a normal create (params will be the same) */
6975 flavor = VNCREATE_FLAVOR;
6976 size = VCREATESIZE;
6977 }
6978 #endif
6979 if ((flavor != VNCREATE_FLAVOR) || (size != VCREATESIZE)) {
6980 error = EINVAL;
6981 goto error_out;
6982 }
6983 }
6984
6985 if (!existing_vnode) {
6986 if ((error = new_vnode(&vp, !(vc_options & VNODE_CREATE_NODEALLOC)))) {
6987 return error;
6988 }
6989 if (!init_vnode) {
6990 /* Make it so that it can be released by a vnode_put) */
6991 vnode_lock(vp);
6992 vn_set_dead(vp);
6993 vnode_unlock(vp);
6994 *vpp = vp;
6995 return 0;
6996 }
6997 } else {
6998 /*
6999 * A vnode obtained by vnode_create_empty has been passed to
7000 * vnode_initialize - Unset VL_DEAD set by vn_set_dead. After
7001 * this point, it is set back on any error.
7002 */
7003 vnode_lock(vp);
7004 vp->v_lflag &= ~VL_DEAD;
7005 vnode_unlock(vp);
7006 }
7007
7008 dvp = param->vnfs_dvp;
7009 cnp = param->vnfs_cnp;
7010
7011 vp->v_op = param->vnfs_vops;
7012 vp->v_type = (uint8_t)param->vnfs_vtype;
7013 vp->v_data = param->vnfs_fsnode;
7014
7015 if (param->vnfs_markroot) {
7016 vp->v_flag |= VROOT;
7017 }
7018 if (param->vnfs_marksystem) {
7019 vp->v_flag |= VSYSTEM;
7020 }
7021 if (vp->v_type == VREG) {
7022 error = ubc_info_init_withsize(vp, param->vnfs_filesize);
7023 if (error) {
7024 #ifdef CONFIG_IOCOUNT_TRACE
7025 record_vp(vp, 1);
7026 #endif
7027 vnode_hold(vp);
7028 vnode_lock(vp);
7029 vn_set_dead(vp);
7030
7031 vnode_put_locked(vp);
7032 vnode_drop_and_unlock(vp);
7033 return error;
7034 }
7035 if (param->vnfs_mp->mnt_ioflags & MNT_IOFLAGS_IOSCHED_SUPPORTED) {
7036 memory_object_mark_io_tracking(vp->v_ubcinfo->ui_control);
7037 }
7038 }
7039 #ifdef CONFIG_IOCOUNT_TRACE
7040 record_vp(vp, 1);
7041 #endif
7042
7043 #if CONFIG_FIRMLINKS
7044 vp->v_fmlink = NULLVP;
7045 #endif
7046 vp->v_flag &= ~VFMLINKTARGET;
7047
7048 #if CONFIG_TRIGGERS
7049 /*
7050 * For trigger vnodes, attach trigger info to vnode
7051 */
7052 if ((vp->v_type == VDIR) && (tinfo != NULL)) {
7053 /*
7054 * Note: has a side effect of incrementing trigger count on the
7055 * mount if successful, which we would need to undo on a
7056 * subsequent failure.
7057 */
7058 #ifdef CONFIG_IOCOUNT_TRACE
7059 record_vp(vp, -1);
7060 #endif
7061 error = vnode_resolver_create(param->vnfs_mp, vp, tinfo, FALSE);
7062 if (error) {
7063 printf("vnode_create: vnode_resolver_create() err %d\n", error);
7064 vnode_hold(vp);
7065 vnode_lock(vp);
7066 vn_set_dead(vp);
7067 #ifdef CONFIG_IOCOUNT_TRACE
7068 record_vp(vp, 1);
7069 #endif
7070 vnode_put_locked(vp);
7071 vnode_drop_and_unlock(vp);
7072 return error;
7073 }
7074 }
7075 #endif
7076 if (vp->v_type == VCHR || vp->v_type == VBLK) {
7077 vp->v_tag = VT_DEVFS; /* callers will reset if needed (bdevvp) */
7078
7079 if ((nvp = checkalias(vp, param->vnfs_rdev))) {
7080 /*
7081 * if checkalias returns a vnode, it will be locked
7082 *
7083 * first get rid of the unneeded vnode we acquired
7084 */
7085 vp->v_data = NULL;
7086 vp->v_op = spec_vnodeop_p;
7087 vp->v_type = VBAD;
7088 vp->v_lflag = VL_DEAD;
7089 vp->v_data = NULL;
7090 vp->v_tag = VT_NON;
7091 vnode_put(vp);
7092
7093 /*
7094 * switch to aliased vnode and finish
7095 * preparing it
7096 */
7097 vp = nvp;
7098
7099 is_bdevvp = (vp->v_flag & VBDEVVP);
7100
7101 if (is_bdevvp) {
7102 printf("%s: alias vnode (vid = %u) is in state of change (start) v_flags = 0x%x v_numoutput = %d\n",
7103 __func__, vp->v_id, vp->v_flag, vp->v_numoutput);
7104 }
7105
7106 vnode_hold(vp);
7107 vp->v_lflag |= VL_OPSCHANGE;
7108 vclean(vp, 0);
7109 vp->v_op = param->vnfs_vops;
7110 vp->v_type = (uint8_t)param->vnfs_vtype;
7111 vp->v_data = param->vnfs_fsnode;
7112 vp->v_lflag = VL_OPSCHANGE;
7113 vp->v_mount = NULL;
7114 insmntque(vp, param->vnfs_mp);
7115 insert = 0;
7116
7117 if (is_bdevvp) {
7118 printf("%s: alias vnode (vid = %u), is in state of change (end) v_flags = 0x%x v_numoutput = %d\n",
7119 __func__, vp->v_id, vp->v_flag, vp->v_numoutput);
7120 }
7121
7122 vnode_drop_and_unlock(vp);
7123 wakeup(&vp->v_lflag); /* chkvnlock is waitng for VL_DEAD to get unset */
7124 }
7125
7126 if (VCHR == vp->v_type) {
7127 u_int maj = major(vp->v_rdev);
7128
7129 if (maj < (u_int)nchrdev && cdevsw[maj].d_type == D_TTY) {
7130 vp->v_flag |= VISTTY;
7131 }
7132 }
7133 }
7134
7135 if (vp->v_type == VFIFO) {
7136 struct fifoinfo *fip;
7137
7138 fip = kalloc_type(struct fifoinfo, Z_WAITOK | Z_ZERO);
7139 vp->v_fifoinfo = fip;
7140 }
7141 /* The file systems must pass the address of the location where
7142 * they store the vnode pointer. When we add the vnode into the mount
7143 * list and name cache they become discoverable. So the file system node
7144 * must have the connection to vnode setup by then
7145 */
7146 *vpp = vp;
7147
7148 /* Add fs named reference. */
7149 if (param->vnfs_flags & VNFS_ADDFSREF) {
7150 vp->v_lflag |= VNAMED_FSHASH;
7151 }
7152 if (param->vnfs_mp) {
7153 if (param->vnfs_mp->mnt_kern_flag & MNTK_LOCK_LOCAL) {
7154 vp->v_flag |= VLOCKLOCAL;
7155 }
7156 if (insert) {
7157 if ((vp->v_freelist.tqe_prev != (struct vnode **)0xdeadb)) {
7158 panic("insmntque: vp on the free list");
7159 }
7160
7161 /*
7162 * enter in mount vnode list
7163 */
7164 insmntque(vp, param->vnfs_mp);
7165 }
7166 }
7167 if (dvp && vnode_ref(dvp) == 0) {
7168 vp->v_parent = dvp;
7169 }
7170 if (cnp) {
7171 if (dvp && ((param->vnfs_flags & (VNFS_NOCACHE | VNFS_CANTCACHE)) == 0)) {
7172 /*
7173 * enter into name cache
7174 * we've got the info to enter it into the name cache now
7175 * cache_enter_create will pick up an extra reference on
7176 * the name entered into the string cache
7177 */
7178 vp->v_name = cache_enter_create(dvp, vp, cnp);
7179 } else {
7180 vp->v_name = vfs_addname(cnp->cn_nameptr, cnp->cn_namelen, cnp->cn_hash, 0);
7181 }
7182
7183 if ((cnp->cn_flags & UNIONCREATED) == UNIONCREATED) {
7184 vp->v_flag |= VISUNION;
7185 }
7186 }
7187 if ((param->vnfs_flags & VNFS_CANTCACHE) == 0) {
7188 /*
7189 * this vnode is being created as cacheable in the name cache
7190 * this allows us to re-enter it in the cache
7191 */
7192 vp->v_flag |= VNCACHEABLE;
7193 }
7194 ut = current_uthread();
7195
7196 if ((current_proc()->p_lflag & P_LRAGE_VNODES) ||
7197 (ut->uu_flag & (UT_RAGE_VNODES | UT_KERN_RAGE_VNODES))) {
7198 /*
7199 * process has indicated that it wants any
7200 * vnodes created on its behalf to be rapidly
7201 * aged to reduce the impact on the cached set
7202 * of vnodes
7203 *
7204 * if UT_KERN_RAGE_VNODES is set, then the
7205 * kernel internally wants vnodes to be rapidly
7206 * aged, even if the process hasn't requested
7207 * this
7208 */
7209 vp->v_flag |= VRAGE;
7210 }
7211
7212 #if CONFIG_SECLUDED_MEMORY
7213 switch (secluded_for_filecache) {
7214 case SECLUDED_FILECACHE_NONE:
7215 /*
7216 * secluded_for_filecache == 0:
7217 * + no file contents in secluded pool
7218 */
7219 break;
7220 case SECLUDED_FILECACHE_APPS:
7221 /*
7222 * secluded_for_filecache == 1:
7223 * + no files from /
7224 * + files from /Applications/ are OK
7225 * + files from /Applications/Camera are not OK
7226 * + no files that are open for write
7227 */
7228 if (vnode_vtype(vp) == VREG &&
7229 vnode_mount(vp) != NULL &&
7230 (!(vfs_flags(vnode_mount(vp)) & MNT_ROOTFS))) {
7231 /* not from root filesystem: eligible for secluded pages */
7232 memory_object_mark_eligible_for_secluded(
7233 ubc_getobject(vp, UBC_FLAGS_NONE),
7234 TRUE);
7235 }
7236 break;
7237 case SECLUDED_FILECACHE_RDONLY:
7238 /*
7239 * secluded_for_filecache == 2:
7240 * + all read-only files OK, except:
7241 * + dyld_shared_cache_arm64*
7242 * + Camera
7243 * + mediaserverd
7244 * + cameracaptured
7245 */
7246 if (vnode_vtype(vp) == VREG) {
7247 memory_object_mark_eligible_for_secluded(
7248 ubc_getobject(vp, UBC_FLAGS_NONE),
7249 TRUE);
7250 }
7251 break;
7252 default:
7253 break;
7254 }
7255 #endif /* CONFIG_SECLUDED_MEMORY */
7256
7257 if (is_bdevvp) {
7258 /*
7259 * The v_flags and v_lflags felds for the vndoe above are
7260 * manipulated without the vnode lock. This is fine for
7261 * everything because no other use of this vnode is occurring.
7262 * However the case of the bdevvp alias vnode reuse is different
7263 * and the flags end up being modified while a thread may be in
7264 * vnode_waitforwrites which sets VTHROTTLED and any one of the
7265 * non atomic modifications of v_flag in this function can race
7266 * with the setting of that flag and cause VTHROTTLED on vflag
7267 * to get "lost".
7268 *
7269 * This should ideally be fixed by making sure all modifications
7270 * in this function to the vnode flags are done under the
7271 * vnode lock but at this time, a much smaller workaround is
7272 * being employed and a the more correct (and potentially
7273 * much bigger) change will follow later.
7274 *
7275 * The effect of "losing" the VTHROTTLED flags would be a lost
7276 * wakeup so we just issue that wakeup here since this happens
7277 * only once per bdevvp vnode which are only one or two for a
7278 * given boot.
7279 */
7280 wakeup(&vp->v_numoutput);
7281
7282 /*
7283 * now make sure the flags that we were suppossed to put aren't
7284 * lost.
7285 */
7286 vnode_lock_spin(vp);
7287 if (param->vnfs_flags & VNFS_ADDFSREF) {
7288 vp->v_lflag |= VNAMED_FSHASH;
7289 }
7290 if (param->vnfs_mp && (param->vnfs_mp->mnt_kern_flag & MNTK_LOCK_LOCAL)) {
7291 vp->v_flag |= VLOCKLOCAL;
7292 }
7293 if ((param->vnfs_flags & VNFS_CANTCACHE) == 0) {
7294 vp->v_flag |= VNCACHEABLE;
7295 }
7296 vnode_unlock(vp);
7297 }
7298
7299 return 0;
7300
7301 error_out:
7302 if (existing_vnode) {
7303 vnode_put(vp);
7304 }
7305 return error;
7306 }
7307
7308 int
vnode_create_ext(uint32_t flavor,uint32_t size,void * data,vnode_t * vpp,vnode_create_options_t vc_options)7309 vnode_create_ext(uint32_t flavor, uint32_t size, void *data, vnode_t *vpp, vnode_create_options_t vc_options)
7310 {
7311 if (vc_options & ~(VNODE_CREATE_EMPTY | VNODE_CREATE_NODEALLOC)) {
7312 return EINVAL;
7313 }
7314 *vpp = NULLVP;
7315 return vnode_create_internal(flavor, size, data, vpp, vc_options);
7316 }
7317
7318 /* USAGE:
7319 * The following api creates a vnode and associates all the parameter specified in vnode_fsparam
7320 * structure and returns a vnode handle with a reference. device aliasing is handled here so checkalias
7321 * is obsoleted by this.
7322 */
7323 int
vnode_create(uint32_t flavor,uint32_t size,void * data,vnode_t * vpp)7324 vnode_create(uint32_t flavor, uint32_t size, void *data, vnode_t *vpp)
7325 {
7326 return vnode_create_ext(flavor, size, data, vpp, VNODE_CREATE_NODEALLOC);
7327 }
7328
7329 int
vnode_create_empty(vnode_t * vpp)7330 vnode_create_empty(vnode_t *vpp)
7331 {
7332 return vnode_create_ext(VNCREATE_FLAVOR, VCREATESIZE, NULL,
7333 vpp, VNODE_CREATE_EMPTY);
7334 }
7335
7336 int
vnode_initialize(uint32_t __unused flavor,uint32_t size,void * data,vnode_t * vpp)7337 vnode_initialize(uint32_t __unused flavor, uint32_t size, void *data, vnode_t *vpp)
7338 {
7339 if (*vpp == NULLVP) {
7340 panic("NULL vnode passed to vnode_initialize");
7341 }
7342 #if DEVELOPMENT || DEBUG
7343 /*
7344 * We lock to check that vnode is fit for unlocked use in
7345 * vnode_create_internal.
7346 */
7347 vnode_lock_spin(*vpp);
7348 VNASSERT(((*vpp)->v_iocount == 1), *vpp,
7349 ("vnode_initialize : iocount not 1, is %d", (*vpp)->v_iocount));
7350 VNASSERT(((*vpp)->v_usecount == 0), *vpp,
7351 ("vnode_initialize : usecount not 0, is %d", (*vpp)->v_usecount));
7352 VNASSERT(((*vpp)->v_lflag & VL_DEAD), *vpp,
7353 ("vnode_initialize : v_lflag does not have VL_DEAD, is 0x%x",
7354 (*vpp)->v_lflag));
7355 VNASSERT(((*vpp)->v_data == NULL), *vpp,
7356 ("vnode_initialize : v_data not NULL"));
7357 vnode_unlock(*vpp);
7358 #endif
7359 return vnode_create_internal(flavor, size, data, vpp, VNODE_CREATE_DEFAULT);
7360 }
7361
7362 int
vnode_addfsref(vnode_t vp)7363 vnode_addfsref(vnode_t vp)
7364 {
7365 vnode_lock_spin(vp);
7366 if (vp->v_lflag & VNAMED_FSHASH) {
7367 panic("add_fsref: vp already has named reference");
7368 }
7369 if ((vp->v_freelist.tqe_prev != (struct vnode **)0xdeadb)) {
7370 panic("addfsref: vp on the free list");
7371 }
7372 vp->v_lflag |= VNAMED_FSHASH;
7373 vnode_unlock(vp);
7374 return 0;
7375 }
7376 int
vnode_removefsref(vnode_t vp)7377 vnode_removefsref(vnode_t vp)
7378 {
7379 vnode_lock_spin(vp);
7380 if ((vp->v_lflag & VNAMED_FSHASH) == 0) {
7381 panic("remove_fsref: no named reference");
7382 }
7383 vp->v_lflag &= ~VNAMED_FSHASH;
7384 vnode_unlock(vp);
7385 return 0;
7386 }
7387
7388 void
vnode_link_lock(vnode_t vp)7389 vnode_link_lock(vnode_t vp)
7390 {
7391 vnode_lock_spin(vp);
7392 while (vp->v_ext_flag & VE_LINKCHANGE) {
7393 vp->v_ext_flag |= VE_LINKCHANGEWAIT;
7394 msleep(&vp->v_ext_flag, &vp->v_lock, PVFS | PSPIN,
7395 "vnode_link_lock_wait", 0);
7396 }
7397 if (vp->v_iocount == 0) {
7398 panic("%s called without an iocount on the vnode", __FUNCTION__);
7399 }
7400 vnode_get_locked(vp);
7401 vp->v_ext_flag |= VE_LINKCHANGE;
7402 vnode_unlock(vp);
7403 }
7404
7405 void
vnode_link_unlock(vnode_t vp)7406 vnode_link_unlock(vnode_t vp)
7407 {
7408 bool do_wakeup = false;
7409 bool do_vnode_put = false;
7410
7411 vnode_lock_spin(vp);
7412 if (vp->v_ext_flag & VE_LINKCHANGEWAIT) {
7413 do_wakeup = true;
7414 }
7415 vp->v_ext_flag &= ~(VE_LINKCHANGE | VE_LINKCHANGEWAIT);
7416 if ((vp->v_usecount > 0) || (vp->v_iocount > 1)) {
7417 vnode_put_locked(vp);
7418 } else {
7419 do_vnode_put = true;
7420 }
7421 vnode_unlock(vp);
7422 if (do_wakeup) {
7423 wakeup(&vp->v_ext_flag);
7424 }
7425 if (do_vnode_put) {
7426 vnode_put(vp);
7427 }
7428 }
7429
7430 int
vfs_iterate(int flags,int (* callout)(mount_t,void *),void * arg)7431 vfs_iterate(int flags, int (*callout)(mount_t, void *), void *arg)
7432 {
7433 mount_t mp;
7434 int ret = 0;
7435 fsid_t * fsid_list;
7436 int count, actualcount, i;
7437 void * allocmem;
7438 int indx_start, indx_stop, indx_incr;
7439 int cb_dropref = (flags & VFS_ITERATE_CB_DROPREF);
7440 int noskip_unmount = (flags & VFS_ITERATE_NOSKIP_UNMOUNT);
7441
7442 count = mount_getvfscnt();
7443 count += 10;
7444
7445 fsid_list = kalloc_data(count * sizeof(fsid_t), Z_WAITOK);
7446 allocmem = (void *)fsid_list;
7447
7448 actualcount = mount_fillfsids(fsid_list, count);
7449
7450 /*
7451 * Establish the iteration direction
7452 * VFS_ITERATE_TAIL_FIRST overrides default head first order (oldest first)
7453 */
7454 if (flags & VFS_ITERATE_TAIL_FIRST) {
7455 indx_start = actualcount - 1;
7456 indx_stop = -1;
7457 indx_incr = -1;
7458 } else { /* Head first by default */
7459 indx_start = 0;
7460 indx_stop = actualcount;
7461 indx_incr = 1;
7462 }
7463
7464 for (i = indx_start; i != indx_stop; i += indx_incr) {
7465 /* obtain the mount point with iteration reference */
7466 mp = mount_list_lookupby_fsid(&fsid_list[i], 0, 1);
7467
7468 if (mp == (struct mount *)0) {
7469 continue;
7470 }
7471 mount_lock(mp);
7472 if ((mp->mnt_lflag & MNT_LDEAD) ||
7473 (!noskip_unmount && (mp->mnt_lflag & MNT_LUNMOUNT))) {
7474 mount_unlock(mp);
7475 mount_iterdrop(mp);
7476 continue;
7477 }
7478 mount_unlock(mp);
7479
7480 /* iterate over all the vnodes */
7481 ret = callout(mp, arg);
7482
7483 /*
7484 * Drop the iterref here if the callback didn't do it.
7485 * Note: If cb_dropref is set the mp may no longer exist.
7486 */
7487 if (!cb_dropref) {
7488 mount_iterdrop(mp);
7489 }
7490
7491 switch (ret) {
7492 case VFS_RETURNED:
7493 case VFS_RETURNED_DONE:
7494 if (ret == VFS_RETURNED_DONE) {
7495 ret = 0;
7496 goto out;
7497 }
7498 break;
7499
7500 case VFS_CLAIMED_DONE:
7501 ret = 0;
7502 goto out;
7503 case VFS_CLAIMED:
7504 default:
7505 break;
7506 }
7507 ret = 0;
7508 }
7509
7510 out:
7511 kfree_data(allocmem, count * sizeof(fsid_t));
7512 return ret;
7513 }
7514
7515 /*
7516 * Update the vfsstatfs structure in the mountpoint.
7517 * MAC: Parameter eventtype added, indicating whether the event that
7518 * triggered this update came from user space, via a system call
7519 * (VFS_USER_EVENT) or an internal kernel call (VFS_KERNEL_EVENT).
7520 */
7521 int
vfs_update_vfsstat(mount_t mp,vfs_context_t ctx,__unused int eventtype)7522 vfs_update_vfsstat(mount_t mp, vfs_context_t ctx, __unused int eventtype)
7523 {
7524 struct vfs_attr va;
7525 int error;
7526
7527 /*
7528 * Request the attributes we want to propagate into
7529 * the per-mount vfsstat structure.
7530 */
7531 VFSATTR_INIT(&va);
7532 VFSATTR_WANTED(&va, f_iosize);
7533 VFSATTR_WANTED(&va, f_blocks);
7534 VFSATTR_WANTED(&va, f_bfree);
7535 VFSATTR_WANTED(&va, f_bavail);
7536 VFSATTR_WANTED(&va, f_bused);
7537 VFSATTR_WANTED(&va, f_files);
7538 VFSATTR_WANTED(&va, f_ffree);
7539 VFSATTR_WANTED(&va, f_bsize);
7540 VFSATTR_WANTED(&va, f_fssubtype);
7541
7542 if ((error = vfs_getattr(mp, &va, ctx)) != 0) {
7543 KAUTH_DEBUG("STAT - filesystem returned error %d", error);
7544 return error;
7545 }
7546 #if CONFIG_MACF
7547 if (eventtype == VFS_USER_EVENT) {
7548 error = mac_mount_check_getattr(ctx, mp, &va);
7549 if (error != 0) {
7550 return error;
7551 }
7552 }
7553 #endif
7554 /*
7555 * Unpack into the per-mount structure.
7556 *
7557 * We only overwrite these fields, which are likely to change:
7558 * f_blocks
7559 * f_bfree
7560 * f_bavail
7561 * f_bused
7562 * f_files
7563 * f_ffree
7564 *
7565 * And these which are not, but which the FS has no other way
7566 * of providing to us:
7567 * f_bsize
7568 * f_iosize
7569 * f_fssubtype
7570 *
7571 */
7572 if (VFSATTR_IS_SUPPORTED(&va, f_bsize)) {
7573 /* 4822056 - protect against malformed server mount */
7574 mp->mnt_vfsstat.f_bsize = (va.f_bsize > 0 ? va.f_bsize : 512);
7575 } else {
7576 mp->mnt_vfsstat.f_bsize = mp->mnt_devblocksize; /* default from the device block size */
7577 }
7578 if (VFSATTR_IS_SUPPORTED(&va, f_iosize)) {
7579 mp->mnt_vfsstat.f_iosize = va.f_iosize;
7580 } else {
7581 mp->mnt_vfsstat.f_iosize = 1024 * 1024; /* 1MB sensible I/O size */
7582 }
7583 if (VFSATTR_IS_SUPPORTED(&va, f_blocks)) {
7584 mp->mnt_vfsstat.f_blocks = va.f_blocks;
7585 }
7586 if (VFSATTR_IS_SUPPORTED(&va, f_bfree)) {
7587 mp->mnt_vfsstat.f_bfree = va.f_bfree;
7588 }
7589 if (VFSATTR_IS_SUPPORTED(&va, f_bavail)) {
7590 mp->mnt_vfsstat.f_bavail = va.f_bavail;
7591 }
7592 if (VFSATTR_IS_SUPPORTED(&va, f_bused)) {
7593 mp->mnt_vfsstat.f_bused = va.f_bused;
7594 }
7595 if (VFSATTR_IS_SUPPORTED(&va, f_files)) {
7596 mp->mnt_vfsstat.f_files = va.f_files;
7597 }
7598 if (VFSATTR_IS_SUPPORTED(&va, f_ffree)) {
7599 mp->mnt_vfsstat.f_ffree = va.f_ffree;
7600 }
7601
7602 /* this is unlikely to change, but has to be queried for */
7603 if (VFSATTR_IS_SUPPORTED(&va, f_fssubtype)) {
7604 mp->mnt_vfsstat.f_fssubtype = va.f_fssubtype;
7605 }
7606
7607 return 0;
7608 }
7609
7610 int
mount_list_add(mount_t mp)7611 mount_list_add(mount_t mp)
7612 {
7613 int res;
7614
7615 mount_list_lock();
7616 if (get_system_inshutdown() != 0) {
7617 res = -1;
7618 } else {
7619 TAILQ_INSERT_TAIL(&mountlist, mp, mnt_list);
7620 nummounts++;
7621 res = 0;
7622 }
7623 mount_list_unlock();
7624
7625 return res;
7626 }
7627
7628 void
mount_list_remove(mount_t mp)7629 mount_list_remove(mount_t mp)
7630 {
7631 mount_list_lock();
7632 TAILQ_REMOVE(&mountlist, mp, mnt_list);
7633 nummounts--;
7634 mp->mnt_list.tqe_next = NULL;
7635 mp->mnt_list.tqe_prev = NULL;
7636 mount_list_unlock();
7637 }
7638
7639 mount_t
mount_lookupby_volfsid(int volfs_id,int withref)7640 mount_lookupby_volfsid(int volfs_id, int withref)
7641 {
7642 mount_t cur_mount = (mount_t)0;
7643 mount_t mp;
7644
7645 mount_list_lock();
7646 TAILQ_FOREACH(mp, &mountlist, mnt_list) {
7647 if (!(mp->mnt_kern_flag & MNTK_UNMOUNT) &&
7648 (mp->mnt_kern_flag & MNTK_PATH_FROM_ID) &&
7649 (mp->mnt_vfsstat.f_fsid.val[0] == volfs_id)) {
7650 cur_mount = mp;
7651 if (withref) {
7652 if (mount_iterref(cur_mount, 1)) {
7653 cur_mount = (mount_t)0;
7654 mount_list_unlock();
7655 goto out;
7656 }
7657 }
7658 break;
7659 }
7660 }
7661 mount_list_unlock();
7662 if (withref && (cur_mount != (mount_t)0)) {
7663 mp = cur_mount;
7664 if (vfs_busy(mp, LK_NOWAIT) != 0) {
7665 cur_mount = (mount_t)0;
7666 }
7667 mount_iterdrop(mp);
7668 }
7669 out:
7670 return cur_mount;
7671 }
7672
7673 mount_t
mount_list_lookupby_fsid(fsid_t * fsid,int locked,int withref)7674 mount_list_lookupby_fsid(fsid_t *fsid, int locked, int withref)
7675 {
7676 mount_t retmp = (mount_t)0;
7677 mount_t mp;
7678
7679 if (!locked) {
7680 mount_list_lock();
7681 }
7682 TAILQ_FOREACH(mp, &mountlist, mnt_list)
7683 if (mp->mnt_vfsstat.f_fsid.val[0] == fsid->val[0] &&
7684 mp->mnt_vfsstat.f_fsid.val[1] == fsid->val[1]) {
7685 retmp = mp;
7686 if (withref) {
7687 if (mount_iterref(retmp, 1)) {
7688 retmp = (mount_t)0;
7689 }
7690 }
7691 goto out;
7692 }
7693 out:
7694 if (!locked) {
7695 mount_list_unlock();
7696 }
7697 return retmp;
7698 }
7699
7700 errno_t
vnode_lookupat(const char * path,int flags,vnode_t * vpp,vfs_context_t ctx,vnode_t start_dvp)7701 vnode_lookupat(const char *path, int flags, vnode_t *vpp, vfs_context_t ctx,
7702 vnode_t start_dvp)
7703 {
7704 struct nameidata *ndp;
7705 int error = 0;
7706 u_int32_t ndflags = 0;
7707
7708 if (ctx == NULL) {
7709 return EINVAL;
7710 }
7711
7712 ndp = kalloc_type(struct nameidata, Z_WAITOK | Z_NOFAIL);
7713
7714 if (flags & VNODE_LOOKUP_NOFOLLOW) {
7715 ndflags = NOFOLLOW;
7716 } else {
7717 ndflags = FOLLOW;
7718 }
7719
7720 if (flags & VNODE_LOOKUP_NOCROSSMOUNT) {
7721 ndflags |= NOCROSSMOUNT;
7722 }
7723
7724 if (flags & VNODE_LOOKUP_CROSSMOUNTNOWAIT) {
7725 ndflags |= CN_NBMOUNTLOOK;
7726 }
7727
7728 /* XXX AUDITVNPATH1 needed ? */
7729 NDINIT(ndp, LOOKUP, OP_LOOKUP, ndflags, UIO_SYSSPACE,
7730 CAST_USER_ADDR_T(path), ctx);
7731
7732 if (flags & VNODE_LOOKUP_NOFOLLOW_ANY) {
7733 ndp->ni_flag |= NAMEI_NOFOLLOW_ANY;
7734 }
7735
7736 if (start_dvp && (path[0] != '/')) {
7737 ndp->ni_dvp = start_dvp;
7738 ndp->ni_cnd.cn_flags |= USEDVP;
7739 }
7740
7741 if ((error = namei(ndp))) {
7742 goto out_free;
7743 }
7744
7745 ndp->ni_cnd.cn_flags &= ~USEDVP;
7746
7747 *vpp = ndp->ni_vp;
7748 nameidone(ndp);
7749
7750 out_free:
7751 kfree_type(struct nameidata, ndp);
7752 return error;
7753 }
7754
7755 errno_t
vnode_lookup(const char * path,int flags,vnode_t * vpp,vfs_context_t ctx)7756 vnode_lookup(const char *path, int flags, vnode_t *vpp, vfs_context_t ctx)
7757 {
7758 return vnode_lookupat(path, flags, vpp, ctx, NULLVP);
7759 }
7760
7761 errno_t
vnode_open(const char * path,int fmode,int cmode,int flags,vnode_t * vpp,vfs_context_t ctx)7762 vnode_open(const char *path, int fmode, int cmode, int flags, vnode_t *vpp, vfs_context_t ctx)
7763 {
7764 struct nameidata *ndp = NULL;
7765 int error;
7766 u_int32_t ndflags = 0;
7767 int lflags = flags;
7768
7769 if (ctx == NULL) { /* XXX technically an error */
7770 ctx = vfs_context_current();
7771 }
7772
7773 ndp = kalloc_type(struct nameidata, Z_WAITOK | Z_NOFAIL);
7774
7775 if (fmode & O_NOFOLLOW) {
7776 lflags |= VNODE_LOOKUP_NOFOLLOW;
7777 }
7778
7779 if (lflags & VNODE_LOOKUP_NOFOLLOW) {
7780 ndflags = NOFOLLOW;
7781 } else {
7782 ndflags = FOLLOW;
7783 }
7784
7785 if (lflags & VNODE_LOOKUP_NOFOLLOW_ANY) {
7786 fmode |= O_NOFOLLOW_ANY;
7787 }
7788
7789 if (lflags & VNODE_LOOKUP_NOCROSSMOUNT) {
7790 ndflags |= NOCROSSMOUNT;
7791 }
7792
7793 if (lflags & VNODE_LOOKUP_CROSSMOUNTNOWAIT) {
7794 ndflags |= CN_NBMOUNTLOOK;
7795 }
7796
7797 /* XXX AUDITVNPATH1 needed ? */
7798 NDINIT(ndp, LOOKUP, OP_OPEN, ndflags, UIO_SYSSPACE,
7799 CAST_USER_ADDR_T(path), ctx);
7800
7801 if ((error = vn_open(ndp, fmode, cmode))) {
7802 *vpp = NULL;
7803 } else {
7804 *vpp = ndp->ni_vp;
7805 }
7806
7807 kfree_type(struct nameidata, ndp);
7808 return error;
7809 }
7810
7811 errno_t
vnode_close(vnode_t vp,int flags,vfs_context_t ctx)7812 vnode_close(vnode_t vp, int flags, vfs_context_t ctx)
7813 {
7814 int error;
7815
7816 if (ctx == NULL) {
7817 ctx = vfs_context_current();
7818 }
7819
7820 error = vn_close(vp, flags, ctx);
7821 vnode_put(vp);
7822 return error;
7823 }
7824
7825 errno_t
vnode_mtime(vnode_t vp,struct timespec * mtime,vfs_context_t ctx)7826 vnode_mtime(vnode_t vp, struct timespec *mtime, vfs_context_t ctx)
7827 {
7828 struct vnode_attr va;
7829 int error;
7830
7831 VATTR_INIT(&va);
7832 VATTR_WANTED(&va, va_modify_time);
7833 error = vnode_getattr(vp, &va, ctx);
7834 if (!error) {
7835 *mtime = va.va_modify_time;
7836 }
7837 return error;
7838 }
7839
7840 errno_t
vnode_flags(vnode_t vp,uint32_t * flags,vfs_context_t ctx)7841 vnode_flags(vnode_t vp, uint32_t *flags, vfs_context_t ctx)
7842 {
7843 struct vnode_attr va;
7844 int error;
7845
7846 VATTR_INIT(&va);
7847 VATTR_WANTED(&va, va_flags);
7848 error = vnode_getattr(vp, &va, ctx);
7849 if (!error) {
7850 *flags = va.va_flags;
7851 }
7852 return error;
7853 }
7854
7855 /*
7856 * Returns: 0 Success
7857 * vnode_getattr:???
7858 */
7859 errno_t
vnode_size(vnode_t vp,off_t * sizep,vfs_context_t ctx)7860 vnode_size(vnode_t vp, off_t *sizep, vfs_context_t ctx)
7861 {
7862 struct vnode_attr va;
7863 int error;
7864
7865 VATTR_INIT(&va);
7866 VATTR_WANTED(&va, va_data_size);
7867 error = vnode_getattr(vp, &va, ctx);
7868 if (!error) {
7869 *sizep = va.va_data_size;
7870 }
7871 return error;
7872 }
7873
7874 errno_t
vnode_setsize(vnode_t vp,off_t size,int ioflag,vfs_context_t ctx)7875 vnode_setsize(vnode_t vp, off_t size, int ioflag, vfs_context_t ctx)
7876 {
7877 struct vnode_attr va;
7878
7879 VATTR_INIT(&va);
7880 VATTR_SET(&va, va_data_size, size);
7881 va.va_vaflags = ioflag & 0xffff;
7882 return vnode_setattr(vp, &va, ctx);
7883 }
7884
7885 int
vnode_setdirty(vnode_t vp)7886 vnode_setdirty(vnode_t vp)
7887 {
7888 vnode_lock_spin(vp);
7889 vp->v_flag |= VISDIRTY;
7890 vnode_unlock(vp);
7891 return 0;
7892 }
7893
7894 int
vnode_cleardirty(vnode_t vp)7895 vnode_cleardirty(vnode_t vp)
7896 {
7897 vnode_lock_spin(vp);
7898 vp->v_flag &= ~VISDIRTY;
7899 vnode_unlock(vp);
7900 return 0;
7901 }
7902
7903 int
vnode_isdirty(vnode_t vp)7904 vnode_isdirty(vnode_t vp)
7905 {
7906 int dirty;
7907
7908 vnode_lock_spin(vp);
7909 dirty = (vp->v_flag & VISDIRTY) ? 1 : 0;
7910 vnode_unlock(vp);
7911
7912 return dirty;
7913 }
7914
7915 static int
vn_create_reg(vnode_t dvp,vnode_t * vpp,struct nameidata * ndp,struct vnode_attr * vap,uint32_t flags,int fmode,uint32_t * statusp,vfs_context_t ctx)7916 vn_create_reg(vnode_t dvp, vnode_t *vpp, struct nameidata *ndp, struct vnode_attr *vap, uint32_t flags, int fmode, uint32_t *statusp, vfs_context_t ctx)
7917 {
7918 /* Only use compound VNOP for compound operation */
7919 if (vnode_compound_open_available(dvp) && ((flags & VN_CREATE_DOOPEN) != 0)) {
7920 *vpp = NULLVP;
7921 return VNOP_COMPOUND_OPEN(dvp, vpp, ndp, O_CREAT, fmode, statusp, vap, ctx);
7922 } else {
7923 return VNOP_CREATE(dvp, vpp, &ndp->ni_cnd, vap, ctx);
7924 }
7925 }
7926
7927 /*
7928 * Create a filesystem object of arbitrary type with arbitrary attributes in
7929 * the spevied directory with the specified name.
7930 *
7931 * Parameters: dvp Pointer to the vnode of the directory
7932 * in which to create the object.
7933 * vpp Pointer to the area into which to
7934 * return the vnode of the created object.
7935 * cnp Component name pointer from the namei
7936 * data structure, containing the name to
7937 * use for the create object.
7938 * vap Pointer to the vnode_attr structure
7939 * describing the object to be created,
7940 * including the type of object.
7941 * flags VN_* flags controlling ACL inheritance
7942 * and whether or not authorization is to
7943 * be required for the operation.
7944 *
7945 * Returns: 0 Success
7946 * !0 errno value
7947 *
7948 * Implicit: *vpp Contains the vnode of the object that
7949 * was created, if successful.
7950 * *cnp May be modified by the underlying VFS.
7951 * *vap May be modified by the underlying VFS.
7952 * modified by either ACL inheritance or
7953 *
7954 *
7955 * be modified, even if the operation is
7956 *
7957 *
7958 * Notes: The kauth_filesec_t in 'vap', if any, is in host byte order.
7959 *
7960 * Modification of '*cnp' and '*vap' by the underlying VFS is
7961 * strongly discouraged.
7962 *
7963 * XXX: This function is a 'vn_*' function; it belongs in vfs_vnops.c
7964 *
7965 * XXX: We should enummerate the possible errno values here, and where
7966 * in the code they originated.
7967 */
7968 errno_t
vn_create(vnode_t dvp,vnode_t * vpp,struct nameidata * ndp,struct vnode_attr * vap,uint32_t flags,int fmode,uint32_t * statusp,vfs_context_t ctx)7969 vn_create(vnode_t dvp, vnode_t *vpp, struct nameidata *ndp, struct vnode_attr *vap, uint32_t flags, int fmode, uint32_t *statusp, vfs_context_t ctx)
7970 {
7971 errno_t error, old_error;
7972 vnode_t vp = (vnode_t)0;
7973 boolean_t batched;
7974 struct componentname *cnp;
7975 uint32_t defaulted;
7976
7977 cnp = &ndp->ni_cnd;
7978 error = 0;
7979 batched = namei_compound_available(dvp, ndp) ? TRUE : FALSE;
7980
7981 KAUTH_DEBUG("%p CREATE - '%s'", dvp, cnp->cn_nameptr);
7982
7983 if (flags & VN_CREATE_NOINHERIT) {
7984 vap->va_vaflags |= VA_NOINHERIT;
7985 }
7986 if (flags & VN_CREATE_NOAUTH) {
7987 vap->va_vaflags |= VA_NOAUTH;
7988 }
7989 /*
7990 * Handle ACL inheritance, initialize vap.
7991 */
7992 error = vn_attribute_prepare(dvp, vap, &defaulted, ctx);
7993 if (error) {
7994 return error;
7995 }
7996
7997 if (vap->va_type != VREG && (fmode != 0 || (flags & VN_CREATE_DOOPEN) || statusp)) {
7998 panic("Open parameters, but not a regular file.");
7999 }
8000 if ((fmode != 0) && ((flags & VN_CREATE_DOOPEN) == 0)) {
8001 panic("Mode for open, but not trying to open...");
8002 }
8003
8004
8005 /*
8006 * Create the requested node.
8007 */
8008 switch (vap->va_type) {
8009 case VREG:
8010 error = vn_create_reg(dvp, vpp, ndp, vap, flags, fmode, statusp, ctx);
8011 break;
8012 case VDIR:
8013 error = vn_mkdir(dvp, vpp, ndp, vap, ctx);
8014 break;
8015 case VSOCK:
8016 case VFIFO:
8017 case VBLK:
8018 case VCHR:
8019 error = VNOP_MKNOD(dvp, vpp, cnp, vap, ctx);
8020 break;
8021 default:
8022 panic("vnode_create: unknown vtype %d", vap->va_type);
8023 }
8024 if (error != 0) {
8025 KAUTH_DEBUG("%p CREATE - error %d returned by filesystem", dvp, error);
8026 goto out;
8027 }
8028
8029 vp = *vpp;
8030 old_error = error;
8031
8032 /*
8033 * If some of the requested attributes weren't handled by the VNOP,
8034 * use our fallback code.
8035 */
8036 if ((error == 0) && !VATTR_ALL_SUPPORTED(vap) && *vpp) {
8037 KAUTH_DEBUG(" CREATE - doing fallback with ACL %p", vap->va_acl);
8038 error = vnode_setattr_fallback(*vpp, vap, ctx);
8039 }
8040
8041 #if CONFIG_MACF
8042 if ((error == 0) && !(flags & VN_CREATE_NOLABEL)) {
8043 error = vnode_label(vnode_mount(vp), dvp, vp, cnp, VNODE_LABEL_CREATE, ctx);
8044 }
8045 #endif
8046
8047 if ((error != 0) && (vp != (vnode_t)0)) {
8048 /* If we've done a compound open, close */
8049 if (batched && (old_error == 0) && (vap->va_type == VREG)) {
8050 VNOP_CLOSE(vp, fmode, ctx);
8051 }
8052
8053 /* Need to provide notifications if a create succeeded */
8054 if (!batched) {
8055 *vpp = (vnode_t) 0;
8056 vnode_put(vp);
8057 vp = NULLVP;
8058 }
8059 }
8060
8061 /*
8062 * For creation VNOPs, this is the equivalent of
8063 * lookup_handle_found_vnode.
8064 */
8065 if (kdebug_enable && *vpp) {
8066 kdebug_lookup(*vpp, cnp);
8067 }
8068
8069 out:
8070 vn_attribute_cleanup(vap, defaulted);
8071
8072 return error;
8073 }
8074
8075 static kauth_scope_t vnode_scope;
8076 static int vnode_authorize_callback(kauth_cred_t credential, void *idata, kauth_action_t action,
8077 uintptr_t arg0, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3);
8078 static int vnode_authorize_callback_int(kauth_action_t action, vfs_context_t ctx,
8079 vnode_t vp, vnode_t dvp, int *errorp);
8080
8081 typedef struct _vnode_authorize_context {
8082 vnode_t vp;
8083 struct vnode_attr *vap;
8084 vnode_t dvp;
8085 struct vnode_attr *dvap;
8086 vfs_context_t ctx;
8087 int flags;
8088 int flags_valid;
8089 #define _VAC_IS_OWNER (1<<0)
8090 #define _VAC_IN_GROUP (1<<1)
8091 #define _VAC_IS_DIR_OWNER (1<<2)
8092 #define _VAC_IN_DIR_GROUP (1<<3)
8093 #define _VAC_NO_VNODE_POINTERS (1<<4)
8094 } *vauth_ctx;
8095
8096 void
vnode_authorize_init(void)8097 vnode_authorize_init(void)
8098 {
8099 vnode_scope = kauth_register_scope(KAUTH_SCOPE_VNODE, vnode_authorize_callback, NULL);
8100 }
8101
8102 #define VATTR_PREPARE_DEFAULTED_UID 0x1
8103 #define VATTR_PREPARE_DEFAULTED_GID 0x2
8104 #define VATTR_PREPARE_DEFAULTED_MODE 0x4
8105
8106 int
vn_attribute_prepare(vnode_t dvp,struct vnode_attr * vap,uint32_t * defaulted_fieldsp,vfs_context_t ctx)8107 vn_attribute_prepare(vnode_t dvp, struct vnode_attr *vap, uint32_t *defaulted_fieldsp, vfs_context_t ctx)
8108 {
8109 kauth_acl_t nacl = NULL, oacl = NULL;
8110 int error;
8111
8112 /*
8113 * Handle ACL inheritance.
8114 */
8115 if (!(vap->va_vaflags & VA_NOINHERIT) && vfs_extendedsecurity(dvp->v_mount)) {
8116 /* save the original filesec */
8117 if (VATTR_IS_ACTIVE(vap, va_acl)) {
8118 oacl = vap->va_acl;
8119 }
8120
8121 vap->va_acl = NULL;
8122 if ((error = kauth_acl_inherit(dvp,
8123 oacl,
8124 &nacl,
8125 vap->va_type == VDIR,
8126 ctx)) != 0) {
8127 KAUTH_DEBUG("%p CREATE - error %d processing inheritance", dvp, error);
8128 return error;
8129 }
8130
8131 /*
8132 * If the generated ACL is NULL, then we can save ourselves some effort
8133 * by clearing the active bit.
8134 */
8135 if (nacl == NULL) {
8136 VATTR_CLEAR_ACTIVE(vap, va_acl);
8137 } else {
8138 vap->va_base_acl = oacl;
8139 VATTR_SET(vap, va_acl, nacl);
8140 }
8141 }
8142
8143 error = vnode_authattr_new_internal(dvp, vap, (vap->va_vaflags & VA_NOAUTH), defaulted_fieldsp, ctx);
8144 if (error) {
8145 vn_attribute_cleanup(vap, *defaulted_fieldsp);
8146 }
8147
8148 return error;
8149 }
8150
8151 void
vn_attribute_cleanup(struct vnode_attr * vap,uint32_t defaulted_fields)8152 vn_attribute_cleanup(struct vnode_attr *vap, uint32_t defaulted_fields)
8153 {
8154 /*
8155 * If the caller supplied a filesec in vap, it has been replaced
8156 * now by the post-inheritance copy. We need to put the original back
8157 * and free the inherited product.
8158 */
8159 kauth_acl_t nacl, oacl;
8160
8161 if (VATTR_IS_ACTIVE(vap, va_acl)) {
8162 nacl = vap->va_acl;
8163 oacl = vap->va_base_acl;
8164
8165 if (oacl) {
8166 VATTR_SET(vap, va_acl, oacl);
8167 vap->va_base_acl = NULL;
8168 } else {
8169 VATTR_CLEAR_ACTIVE(vap, va_acl);
8170 }
8171
8172 if (nacl != NULL) {
8173 /*
8174 * Only free the ACL buffer if 'VA_FILESEC_ACL' is not set as it
8175 * should be freed by the caller or it is a post-inheritance copy.
8176 */
8177 if (!(vap->va_vaflags & VA_FILESEC_ACL) ||
8178 (oacl != NULL && nacl != oacl)) {
8179 kauth_acl_free(nacl);
8180 }
8181 }
8182 }
8183
8184 if ((defaulted_fields & VATTR_PREPARE_DEFAULTED_MODE) != 0) {
8185 VATTR_CLEAR_ACTIVE(vap, va_mode);
8186 }
8187 if ((defaulted_fields & VATTR_PREPARE_DEFAULTED_GID) != 0) {
8188 VATTR_CLEAR_ACTIVE(vap, va_gid);
8189 }
8190 if ((defaulted_fields & VATTR_PREPARE_DEFAULTED_UID) != 0) {
8191 VATTR_CLEAR_ACTIVE(vap, va_uid);
8192 }
8193
8194 return;
8195 }
8196
8197 #if CONFIG_APPLEDOUBLE
8198
8199 #define NATIVE_XATTR(VP) \
8200 ((VP)->v_mount ? (VP)->v_mount->mnt_kern_flag & MNTK_EXTENDED_ATTRS : 0)
8201
8202 static int
dot_underbar_check_paired_vnode(struct componentname * cnp,vnode_t vp,vnode_t dvp,vfs_context_t ctx)8203 dot_underbar_check_paired_vnode(struct componentname *cnp, vnode_t vp,
8204 vnode_t dvp, vfs_context_t ctx)
8205 {
8206 int error = 0;
8207 bool dvp_needs_put = false;
8208
8209 if (!dvp) {
8210 if ((dvp = vnode_getparent(vp)) == NULLVP) {
8211 return 0;
8212 }
8213 dvp_needs_put = true;
8214 }
8215
8216 vnode_t dupairedvp = NULLVP;
8217 char lastchar = cnp->cn_nameptr[cnp->cn_namelen];
8218
8219 cnp->cn_nameptr[cnp->cn_namelen] = '\0';
8220 error = vnode_lookupat(cnp->cn_nameptr + (sizeof("._") - 1), 0,
8221 &dupairedvp, ctx, dvp);
8222 cnp->cn_nameptr[cnp->cn_namelen] = lastchar;
8223 if (dvp_needs_put) {
8224 vnode_put(dvp);
8225 dvp = NULLVP;
8226 }
8227 if (!error && dupairedvp) {
8228 error = mac_vnode_check_deleteextattr(ctx, dupairedvp,
8229 "com.apple.quarantine");
8230 vnode_put(dupairedvp);
8231 dupairedvp = NULLVP;
8232 } else {
8233 error = 0;
8234 }
8235
8236 return error;
8237 }
8238 #endif /* CONFIG_APPLEDOUBLE */
8239
8240 int
vn_authorize_unlink(vnode_t dvp,vnode_t vp,struct componentname * cnp,vfs_context_t ctx,__unused void * reserved)8241 vn_authorize_unlink(vnode_t dvp, vnode_t vp, struct componentname *cnp, vfs_context_t ctx, __unused void *reserved)
8242 {
8243 #if !CONFIG_MACF
8244 #pragma unused(cnp)
8245 #endif
8246 int error = 0;
8247
8248 /*
8249 * Normally, unlinking of directories is not supported.
8250 * However, some file systems may have limited support.
8251 */
8252 if ((vp->v_type == VDIR) &&
8253 !(vp->v_mount->mnt_kern_flag & MNTK_DIR_HARDLINKS)) {
8254 return EPERM; /* POSIX */
8255 }
8256
8257 /* authorize the delete operation */
8258 #if CONFIG_MACF
8259 if (!error) {
8260 error = mac_vnode_check_unlink(ctx, dvp, vp, cnp);
8261 #if CONFIG_APPLEDOUBLE
8262 if (!error && !(NATIVE_XATTR(dvp)) &&
8263 (cnp->cn_namelen > (sizeof("._a") - 1)) &&
8264 cnp->cn_nameptr[0] == '.' && cnp->cn_nameptr[1] == '_') {
8265 error = dot_underbar_check_paired_vnode(cnp, vp, dvp, ctx);
8266 }
8267 #endif /* CONFIG_APPLEDOUBLE */
8268 }
8269 #endif /* MAC */
8270 if (!error) {
8271 error = vnode_authorize(vp, dvp, KAUTH_VNODE_DELETE, ctx);
8272 }
8273
8274 return error;
8275 }
8276
8277 int
vn_authorize_open_existing(vnode_t vp,struct componentname * cnp,int fmode,vfs_context_t ctx,void * reserved)8278 vn_authorize_open_existing(vnode_t vp, struct componentname *cnp, int fmode, vfs_context_t ctx, void *reserved)
8279 {
8280 /* Open of existing case */
8281 kauth_action_t action;
8282 int error = 0;
8283 if (cnp->cn_ndp == NULL) {
8284 panic("NULL ndp");
8285 }
8286 if (reserved != NULL) {
8287 panic("reserved not NULL.");
8288 }
8289
8290 #if CONFIG_MACF
8291 /* XXX may do duplicate work here, but ignore that for now (idempotent) */
8292 if (vfs_flags(vnode_mount(vp)) & MNT_MULTILABEL) {
8293 error = vnode_label(vnode_mount(vp), NULL, vp, NULL, 0, ctx);
8294 if (error) {
8295 return error;
8296 }
8297 }
8298 #endif
8299
8300 if (vnode_isdir(vp)) {
8301 if ((fmode & (FWRITE | O_TRUNC)) || /* disallow write operations on directories */
8302 ((fmode & FSEARCH) && !(fmode & O_DIRECTORY))) {
8303 return EISDIR;
8304 }
8305 } else {
8306 if (fmode & O_DIRECTORY) {
8307 return ENOTDIR;
8308 }
8309
8310 if (vp->v_type == VSOCK && vp->v_tag != VT_FDESC) {
8311 return EOPNOTSUPP; /* Operation not supported on socket */
8312 }
8313
8314 if (vp->v_type == VLNK && (fmode & O_NOFOLLOW) != 0) {
8315 return ELOOP; /* O_NOFOLLOW was specified and the target is a symbolic link */
8316 }
8317
8318 if (cnp->cn_ndp->ni_flag & NAMEI_TRAILINGSLASH) {
8319 return ENOTDIR;
8320 }
8321
8322 if (!vnode_isreg(vp) && (fmode & FEXEC)) {
8323 return EACCES;
8324 }
8325 }
8326
8327 #if CONFIG_MACF
8328 /* If a file being opened is a shadow file containing
8329 * namedstream data, ignore the macf checks because it
8330 * is a kernel internal file and access should always
8331 * be allowed.
8332 */
8333 if (!(vnode_isshadow(vp) && vnode_isnamedstream(vp))) {
8334 error = mac_vnode_check_open(ctx, vp, fmode);
8335 if (error) {
8336 return error;
8337 }
8338 }
8339 #if CONFIG_APPLEDOUBLE
8340 if (fmode & (FWRITE | O_TRUNC) && !(NATIVE_XATTR(vp)) &&
8341 (cnp->cn_namelen > (sizeof("._a") - 1)) &&
8342 cnp->cn_nameptr[0] == '.' && cnp->cn_nameptr[1] == '_') {
8343 error = dot_underbar_check_paired_vnode(cnp, vp, NULLVP, ctx);
8344 if (error) {
8345 return error;
8346 }
8347 }
8348 #endif /* CONFIG_APPLEDOUBLE */
8349 #endif
8350
8351 /* compute action to be authorized */
8352 action = 0;
8353 if (fmode & FREAD) {
8354 action |= KAUTH_VNODE_READ_DATA;
8355 }
8356 if (fmode & (FWRITE | O_TRUNC)) {
8357 /*
8358 * If we are writing, appending, and not truncating,
8359 * indicate that we are appending so that if the
8360 * UF_APPEND or SF_APPEND bits are set, we do not deny
8361 * the open.
8362 */
8363 if ((fmode & O_APPEND) && !(fmode & O_TRUNC)) {
8364 action |= KAUTH_VNODE_APPEND_DATA;
8365 } else {
8366 action |= KAUTH_VNODE_WRITE_DATA;
8367 }
8368 }
8369 if (fmode & (FSEARCH | FEXEC)) {
8370 if (vnode_isdir(vp)) {
8371 action |= KAUTH_VNODE_SEARCH;
8372 } else {
8373 action |= KAUTH_VNODE_EXECUTE;
8374 }
8375 }
8376 error = vnode_authorize(vp, NULL, action, ctx);
8377 #if NAMEDSTREAMS
8378 if (error == EACCES) {
8379 /*
8380 * Shadow files may exist on-disk with a different UID/GID
8381 * than that of the current context. Verify that this file
8382 * is really a shadow file. If it was created successfully
8383 * then it should be authorized.
8384 */
8385 if (vnode_isshadow(vp) && vnode_isnamedstream(vp)) {
8386 error = vnode_verifynamedstream(vp);
8387 }
8388 }
8389 #endif
8390
8391 return error;
8392 }
8393
8394 int
vn_authorize_create(vnode_t dvp,struct componentname * cnp,struct vnode_attr * vap,vfs_context_t ctx,void * reserved)8395 vn_authorize_create(vnode_t dvp, struct componentname *cnp, struct vnode_attr *vap, vfs_context_t ctx, void *reserved)
8396 {
8397 #if !CONFIG_MACF
8398 #pragma unused(vap)
8399 #endif
8400 /* Creation case */
8401 int error;
8402
8403 if (cnp->cn_ndp == NULL) {
8404 panic("NULL cn_ndp");
8405 }
8406 if (reserved != NULL) {
8407 panic("reserved not NULL.");
8408 }
8409
8410 /* Only validate path for creation if we didn't do a complete lookup */
8411 if (cnp->cn_ndp->ni_flag & NAMEI_UNFINISHED) {
8412 error = lookup_validate_creation_path(cnp->cn_ndp);
8413 if (error) {
8414 return error;
8415 }
8416 }
8417
8418 #if CONFIG_MACF
8419 error = mac_vnode_check_create(ctx, dvp, cnp, vap);
8420 if (error) {
8421 return error;
8422 }
8423 #endif /* CONFIG_MACF */
8424
8425 return vnode_authorize(dvp, NULL, KAUTH_VNODE_ADD_FILE, ctx);
8426 }
8427
8428 int
vn_authorize_rename(struct vnode * fdvp,struct vnode * fvp,struct componentname * fcnp,struct vnode * tdvp,struct vnode * tvp,struct componentname * tcnp,vfs_context_t ctx,void * reserved)8429 vn_authorize_rename(struct vnode *fdvp, struct vnode *fvp, struct componentname *fcnp,
8430 struct vnode *tdvp, struct vnode *tvp, struct componentname *tcnp,
8431 vfs_context_t ctx, void *reserved)
8432 {
8433 return vn_authorize_renamex(fdvp, fvp, fcnp, tdvp, tvp, tcnp, ctx, 0, reserved);
8434 }
8435
8436 int
vn_authorize_renamex(struct vnode * fdvp,struct vnode * fvp,struct componentname * fcnp,struct vnode * tdvp,struct vnode * tvp,struct componentname * tcnp,vfs_context_t ctx,vfs_rename_flags_t flags,void * reserved)8437 vn_authorize_renamex(struct vnode *fdvp, struct vnode *fvp, struct componentname *fcnp,
8438 struct vnode *tdvp, struct vnode *tvp, struct componentname *tcnp,
8439 vfs_context_t ctx, vfs_rename_flags_t flags, void *reserved)
8440 {
8441 return vn_authorize_renamex_with_paths(fdvp, fvp, fcnp, NULL, tdvp, tvp, tcnp, NULL, ctx, flags, reserved);
8442 }
8443
8444 int
vn_authorize_renamex_with_paths(struct vnode * fdvp,struct vnode * fvp,struct componentname * fcnp,const char * from_path,struct vnode * tdvp,struct vnode * tvp,struct componentname * tcnp,const char * to_path,vfs_context_t ctx,vfs_rename_flags_t flags,void * reserved)8445 vn_authorize_renamex_with_paths(struct vnode *fdvp, struct vnode *fvp, struct componentname *fcnp, const char *from_path,
8446 struct vnode *tdvp, struct vnode *tvp, struct componentname *tcnp, const char *to_path,
8447 vfs_context_t ctx, vfs_rename_flags_t flags, void *reserved)
8448 {
8449 int error = 0;
8450 int moving = 0;
8451 bool swap = flags & VFS_RENAME_SWAP;
8452
8453 if (reserved != NULL) {
8454 panic("Passed something other than NULL as reserved field!");
8455 }
8456
8457 /*
8458 * Avoid renaming "." and "..".
8459 *
8460 * XXX No need to check for this in the FS. We should always have the leaves
8461 * in VFS in this case.
8462 */
8463 if (fvp->v_type == VDIR &&
8464 ((fdvp == fvp) ||
8465 (fcnp->cn_namelen == 1 && fcnp->cn_nameptr[0] == '.') ||
8466 ((fcnp->cn_flags | tcnp->cn_flags) & ISDOTDOT))) {
8467 error = EINVAL;
8468 goto out;
8469 }
8470
8471 if (tvp == NULLVP && vnode_compound_rename_available(tdvp)) {
8472 error = lookup_validate_creation_path(tcnp->cn_ndp);
8473 if (error) {
8474 goto out;
8475 }
8476 }
8477
8478 /***** <MACF> *****/
8479 #if CONFIG_MACF
8480 if (swap) {
8481 error = mac_vnode_check_rename_swap(ctx, fdvp, fvp, fcnp, tdvp, tvp, tcnp);
8482 } else {
8483 error = mac_vnode_check_rename(ctx, fdvp, fvp, fcnp, tdvp, tvp, tcnp);
8484 }
8485 #if CONFIG_APPLEDOUBLE
8486 if (!error && !(NATIVE_XATTR(fdvp)) &&
8487 fcnp->cn_namelen > (sizeof("._a") - 1) &&
8488 fcnp->cn_nameptr[0] == '.' && fcnp->cn_nameptr[1] == '_') {
8489 error = dot_underbar_check_paired_vnode(fcnp, fvp, fdvp, ctx);
8490 }
8491 /* Currently no Filesystem that does not support native xattrs supports rename swap */
8492 if (!error && swap && !(NATIVE_XATTR(tdvp)) &&
8493 (tcnp->cn_namelen > (sizeof("._a") - 1)) &&
8494 (tcnp->cn_nameptr[0] == '.') && (tcnp->cn_nameptr[1] == '_')) {
8495 error = dot_underbar_check_paired_vnode(tcnp, tvp, tdvp, ctx);
8496 }
8497 #endif /* CONFIG_APPLEDOUBLE */
8498 if (error) {
8499 goto out;
8500 }
8501 #endif
8502 /***** </MACF> *****/
8503
8504 /***** <MiscChecks> *****/
8505 if (tvp != NULL) {
8506 if (!swap) {
8507 if (fvp->v_type == VDIR && tvp->v_type != VDIR) {
8508 error = ENOTDIR;
8509 goto out;
8510 } else if (fvp->v_type != VDIR && tvp->v_type == VDIR) {
8511 error = EISDIR;
8512 goto out;
8513 }
8514 }
8515 } else if (swap) {
8516 /*
8517 * Caller should have already checked this and returned
8518 * ENOENT. If we send back ENOENT here, caller will retry
8519 * which isn't what we want so we send back EINVAL here
8520 * instead.
8521 */
8522 error = EINVAL;
8523 goto out;
8524 }
8525
8526 if (fvp == tdvp) {
8527 error = EINVAL;
8528 goto out;
8529 }
8530
8531 /*
8532 * The following edge case is caught here:
8533 * (to cannot be a descendent of from)
8534 *
8535 * o fdvp
8536 * /
8537 * /
8538 * o fvp
8539 * \
8540 * \
8541 * o tdvp
8542 * /
8543 * /
8544 * o tvp
8545 */
8546 if (tdvp->v_parent == fvp) {
8547 error = EINVAL;
8548 goto out;
8549 }
8550
8551 if (swap && fdvp->v_parent == tvp) {
8552 error = EINVAL;
8553 goto out;
8554 }
8555 /***** </MiscChecks> *****/
8556
8557 /***** <Kauth> *****/
8558
8559 /*
8560 * As part of the Kauth step, we call out to allow 3rd-party
8561 * fileop notification of "about to rename". This is needed
8562 * in the event that 3rd-parties need to know that the DELETE
8563 * authorization is actually part of a rename. It's important
8564 * that we guarantee that the DELETE call-out will always be
8565 * made if the WILL_RENAME call-out is made. Another fileop
8566 * call-out will be performed once the operation is completed.
8567 * We can ignore the result of kauth_authorize_fileop().
8568 *
8569 * N.B. We are passing the vnode and *both* paths to each
8570 * call; kauth_authorize_fileop() extracts the "from" path
8571 * when posting a KAUTH_FILEOP_WILL_RENAME notification.
8572 * As such, we only post these notifications if all of the
8573 * information we need is provided.
8574 */
8575
8576 if (swap) {
8577 kauth_action_t f = 0, t = 0;
8578
8579 /*
8580 * Directories changing parents need ...ADD_SUBDIR... to
8581 * permit changing ".."
8582 */
8583 if (fdvp != tdvp) {
8584 if (vnode_isdir(fvp)) {
8585 f = KAUTH_VNODE_ADD_SUBDIRECTORY;
8586 }
8587 if (vnode_isdir(tvp)) {
8588 t = KAUTH_VNODE_ADD_SUBDIRECTORY;
8589 }
8590 }
8591 if (to_path != NULL) {
8592 kauth_authorize_fileop(vfs_context_ucred(ctx),
8593 KAUTH_FILEOP_WILL_RENAME,
8594 (uintptr_t)fvp,
8595 (uintptr_t)to_path);
8596 }
8597 error = vnode_authorize(fvp, fdvp, KAUTH_VNODE_DELETE | f, ctx);
8598 if (error) {
8599 goto out;
8600 }
8601 if (from_path != NULL) {
8602 kauth_authorize_fileop(vfs_context_ucred(ctx),
8603 KAUTH_FILEOP_WILL_RENAME,
8604 (uintptr_t)tvp,
8605 (uintptr_t)from_path);
8606 }
8607 error = vnode_authorize(tvp, tdvp, KAUTH_VNODE_DELETE | t, ctx);
8608 if (error) {
8609 goto out;
8610 }
8611 f = vnode_isdir(fvp) ? KAUTH_VNODE_ADD_SUBDIRECTORY : KAUTH_VNODE_ADD_FILE;
8612 t = vnode_isdir(tvp) ? KAUTH_VNODE_ADD_SUBDIRECTORY : KAUTH_VNODE_ADD_FILE;
8613 if (fdvp == tdvp) {
8614 error = vnode_authorize(fdvp, NULL, f | t, ctx);
8615 } else {
8616 error = vnode_authorize(fdvp, NULL, t, ctx);
8617 if (error) {
8618 goto out;
8619 }
8620 error = vnode_authorize(tdvp, NULL, f, ctx);
8621 }
8622 if (error) {
8623 goto out;
8624 }
8625 } else {
8626 error = 0;
8627 if ((tvp != NULL) && vnode_isdir(tvp)) {
8628 if (tvp != fdvp) {
8629 moving = 1;
8630 }
8631 } else if (tdvp != fdvp) {
8632 moving = 1;
8633 }
8634
8635 /*
8636 * must have delete rights to remove the old name even in
8637 * the simple case of fdvp == tdvp.
8638 *
8639 * If fvp is a directory, and we are changing it's parent,
8640 * then we also need rights to rewrite its ".." entry as well.
8641 */
8642 if (to_path != NULL) {
8643 kauth_authorize_fileop(vfs_context_ucred(ctx),
8644 KAUTH_FILEOP_WILL_RENAME,
8645 (uintptr_t)fvp,
8646 (uintptr_t)to_path);
8647 }
8648 if (vnode_isdir(fvp)) {
8649 if ((error = vnode_authorize(fvp, fdvp, KAUTH_VNODE_DELETE | KAUTH_VNODE_ADD_SUBDIRECTORY, ctx)) != 0) {
8650 goto out;
8651 }
8652 } else {
8653 if ((error = vnode_authorize(fvp, fdvp, KAUTH_VNODE_DELETE, ctx)) != 0) {
8654 goto out;
8655 }
8656 }
8657 if (moving) {
8658 /* moving into tdvp or tvp, must have rights to add */
8659 if ((error = vnode_authorize(((tvp != NULL) && vnode_isdir(tvp)) ? tvp : tdvp,
8660 NULL,
8661 vnode_isdir(fvp) ? KAUTH_VNODE_ADD_SUBDIRECTORY : KAUTH_VNODE_ADD_FILE,
8662 ctx)) != 0) {
8663 goto out;
8664 }
8665 } else {
8666 /* node staying in same directory, must be allowed to add new name */
8667 if ((error = vnode_authorize(fdvp, NULL,
8668 vnode_isdir(fvp) ? KAUTH_VNODE_ADD_SUBDIRECTORY : KAUTH_VNODE_ADD_FILE, ctx)) != 0) {
8669 goto out;
8670 }
8671 }
8672 /* overwriting tvp */
8673 if ((tvp != NULL) && !vnode_isdir(tvp) &&
8674 ((error = vnode_authorize(tvp, tdvp, KAUTH_VNODE_DELETE, ctx)) != 0)) {
8675 goto out;
8676 }
8677 }
8678
8679 /***** </Kauth> *****/
8680
8681 /* XXX more checks? */
8682 out:
8683 return error;
8684 }
8685
8686 int
vn_authorize_mkdir(vnode_t dvp,struct componentname * cnp,struct vnode_attr * vap,vfs_context_t ctx,void * reserved)8687 vn_authorize_mkdir(vnode_t dvp, struct componentname *cnp, struct vnode_attr *vap, vfs_context_t ctx, void *reserved)
8688 {
8689 #if !CONFIG_MACF
8690 #pragma unused(vap)
8691 #endif
8692 int error;
8693
8694 if (reserved != NULL) {
8695 panic("reserved not NULL in vn_authorize_mkdir()");
8696 }
8697
8698 /* XXX A hack for now, to make shadow files work */
8699 if (cnp->cn_ndp == NULL) {
8700 return 0;
8701 }
8702
8703 if (vnode_compound_mkdir_available(dvp)) {
8704 error = lookup_validate_creation_path(cnp->cn_ndp);
8705 if (error) {
8706 goto out;
8707 }
8708 }
8709
8710 #if CONFIG_MACF
8711 error = mac_vnode_check_create(ctx,
8712 dvp, cnp, vap);
8713 if (error) {
8714 goto out;
8715 }
8716 #endif
8717
8718 /* authorize addition of a directory to the parent */
8719 if ((error = vnode_authorize(dvp, NULL, KAUTH_VNODE_ADD_SUBDIRECTORY, ctx)) != 0) {
8720 goto out;
8721 }
8722
8723 out:
8724 return error;
8725 }
8726
8727 int
vn_authorize_rmdir(vnode_t dvp,vnode_t vp,struct componentname * cnp,vfs_context_t ctx,void * reserved)8728 vn_authorize_rmdir(vnode_t dvp, vnode_t vp, struct componentname *cnp, vfs_context_t ctx, void *reserved)
8729 {
8730 #if CONFIG_MACF
8731 int error;
8732 #else
8733 #pragma unused(cnp)
8734 #endif
8735 if (reserved != NULL) {
8736 panic("Non-NULL reserved argument to vn_authorize_rmdir()");
8737 }
8738
8739 if (vp->v_type != VDIR) {
8740 /*
8741 * rmdir only deals with directories
8742 */
8743 return ENOTDIR;
8744 }
8745
8746 if (dvp == vp) {
8747 /*
8748 * No rmdir "." please.
8749 */
8750 return EINVAL;
8751 }
8752
8753 #if CONFIG_MACF
8754 error = mac_vnode_check_unlink(ctx, dvp,
8755 vp, cnp);
8756 if (error) {
8757 return error;
8758 }
8759 #endif
8760
8761 return vnode_authorize(vp, dvp, KAUTH_VNODE_DELETE, ctx);
8762 }
8763
8764 /*
8765 * Authorizer for directory cloning. This does not use vnodes but instead
8766 * uses prefilled vnode attributes from the filesystem.
8767 *
8768 * The same function is called to set up the attributes required, perform the
8769 * authorization and cleanup (if required)
8770 */
8771 int
vnode_attr_authorize_dir_clone(struct vnode_attr * vap,kauth_action_t action,struct vnode_attr * dvap,__unused vnode_t sdvp,mount_t mp,dir_clone_authorizer_op_t vattr_op,uint32_t flags,vfs_context_t ctx,__unused void * reserved)8772 vnode_attr_authorize_dir_clone(struct vnode_attr *vap, kauth_action_t action,
8773 struct vnode_attr *dvap, __unused vnode_t sdvp, mount_t mp,
8774 dir_clone_authorizer_op_t vattr_op, uint32_t flags, vfs_context_t ctx,
8775 __unused void *reserved)
8776 {
8777 int error;
8778 int is_suser = vfs_context_issuser(ctx);
8779
8780 if (vattr_op == OP_VATTR_SETUP) {
8781 VATTR_INIT(vap);
8782
8783 /*
8784 * When ACL inheritence is implemented, both vap->va_acl and
8785 * dvap->va_acl will be required (even as superuser).
8786 */
8787 VATTR_WANTED(vap, va_type);
8788 VATTR_WANTED(vap, va_mode);
8789 VATTR_WANTED(vap, va_flags);
8790 VATTR_WANTED(vap, va_uid);
8791 VATTR_WANTED(vap, va_gid);
8792 if (dvap) {
8793 VATTR_INIT(dvap);
8794 VATTR_WANTED(dvap, va_flags);
8795 }
8796
8797 if (!is_suser) {
8798 /*
8799 * If not superuser, we have to evaluate ACLs and
8800 * need the target directory gid to set the initial
8801 * gid of the new object.
8802 */
8803 VATTR_WANTED(vap, va_acl);
8804 if (dvap) {
8805 VATTR_WANTED(dvap, va_gid);
8806 }
8807 } else if (dvap && (flags & VNODE_CLONEFILE_NOOWNERCOPY)) {
8808 VATTR_WANTED(dvap, va_gid);
8809 }
8810 return 0;
8811 } else if (vattr_op == OP_VATTR_CLEANUP) {
8812 return 0; /* Nothing to do for now */
8813 }
8814
8815 /* dvap isn't used for authorization */
8816 error = vnode_attr_authorize(vap, NULL, mp, action, ctx);
8817
8818 if (error) {
8819 return error;
8820 }
8821
8822 /*
8823 * vn_attribute_prepare should be able to accept attributes as well as
8824 * vnodes but for now we do this inline.
8825 */
8826 if (!is_suser || (flags & VNODE_CLONEFILE_NOOWNERCOPY)) {
8827 /*
8828 * If the filesystem is mounted IGNORE_OWNERSHIP and an explicit
8829 * owner is set, that owner takes ownership of all new files.
8830 */
8831 if ((mp->mnt_flag & MNT_IGNORE_OWNERSHIP) &&
8832 (mp->mnt_fsowner != KAUTH_UID_NONE)) {
8833 VATTR_SET(vap, va_uid, mp->mnt_fsowner);
8834 } else {
8835 /* default owner is current user */
8836 VATTR_SET(vap, va_uid,
8837 kauth_cred_getuid(vfs_context_ucred(ctx)));
8838 }
8839
8840 if ((mp->mnt_flag & MNT_IGNORE_OWNERSHIP) &&
8841 (mp->mnt_fsgroup != KAUTH_GID_NONE)) {
8842 VATTR_SET(vap, va_gid, mp->mnt_fsgroup);
8843 } else {
8844 /*
8845 * default group comes from parent object,
8846 * fallback to current user
8847 */
8848 if (VATTR_IS_SUPPORTED(dvap, va_gid)) {
8849 VATTR_SET(vap, va_gid, dvap->va_gid);
8850 } else {
8851 VATTR_SET(vap, va_gid,
8852 kauth_cred_getgid(vfs_context_ucred(ctx)));
8853 }
8854 }
8855 }
8856
8857 /* Inherit SF_RESTRICTED bit from destination directory only */
8858 if (VATTR_IS_ACTIVE(vap, va_flags)) {
8859 VATTR_SET(vap, va_flags,
8860 ((vap->va_flags & ~(UF_DATAVAULT | SF_RESTRICTED)))); /* Turn off from source */
8861 if (VATTR_IS_ACTIVE(dvap, va_flags)) {
8862 VATTR_SET(vap, va_flags,
8863 vap->va_flags | (dvap->va_flags & (UF_DATAVAULT | SF_RESTRICTED)));
8864 }
8865 } else if (VATTR_IS_ACTIVE(dvap, va_flags)) {
8866 VATTR_SET(vap, va_flags, (dvap->va_flags & (UF_DATAVAULT | SF_RESTRICTED)));
8867 }
8868
8869 return 0;
8870 }
8871
8872
8873 /*
8874 * Authorize an operation on a vnode.
8875 *
8876 * This is KPI, but here because it needs vnode_scope.
8877 *
8878 * Returns: 0 Success
8879 * kauth_authorize_action:EPERM ...
8880 * xlate => EACCES Permission denied
8881 * kauth_authorize_action:0 Success
8882 * kauth_authorize_action: Depends on callback return; this is
8883 * usually only vnode_authorize_callback(),
8884 * but may include other listerners, if any
8885 * exist.
8886 * EROFS
8887 * EACCES
8888 * EPERM
8889 * ???
8890 */
8891 int
vnode_authorize(vnode_t vp,vnode_t dvp,kauth_action_t action,vfs_context_t ctx)8892 vnode_authorize(vnode_t vp, vnode_t dvp, kauth_action_t action, vfs_context_t ctx)
8893 {
8894 int error, result;
8895
8896 /*
8897 * We can't authorize against a dead vnode; allow all operations through so that
8898 * the correct error can be returned.
8899 */
8900 if (vp->v_type == VBAD) {
8901 return 0;
8902 }
8903
8904 error = 0;
8905 result = kauth_authorize_action(vnode_scope, vfs_context_ucred(ctx), action,
8906 (uintptr_t)ctx, (uintptr_t)vp, (uintptr_t)dvp, (uintptr_t)&error);
8907 if (result == EPERM) { /* traditional behaviour */
8908 result = EACCES;
8909 }
8910 /* did the lower layers give a better error return? */
8911 if ((result != 0) && (error != 0)) {
8912 return error;
8913 }
8914 return result;
8915 }
8916
8917 /*
8918 * Test for vnode immutability.
8919 *
8920 * The 'append' flag is set when the authorization request is constrained
8921 * to operations which only request the right to append to a file.
8922 *
8923 * The 'ignore' flag is set when an operation modifying the immutability flags
8924 * is being authorized. We check the system securelevel to determine which
8925 * immutability flags we can ignore.
8926 */
8927 static int
vnode_immutable(struct vnode_attr * vap,int append,int ignore)8928 vnode_immutable(struct vnode_attr *vap, int append, int ignore)
8929 {
8930 int mask;
8931
8932 /* start with all bits precluding the operation */
8933 mask = IMMUTABLE | APPEND;
8934
8935 /* if appending only, remove the append-only bits */
8936 if (append) {
8937 mask &= ~APPEND;
8938 }
8939
8940 /* ignore only set when authorizing flags changes */
8941 if (ignore) {
8942 if (securelevel <= 0) {
8943 /* in insecure state, flags do not inhibit changes */
8944 mask = 0;
8945 } else {
8946 /* in secure state, user flags don't inhibit */
8947 mask &= ~(UF_IMMUTABLE | UF_APPEND);
8948 }
8949 }
8950 KAUTH_DEBUG("IMMUTABLE - file flags 0x%x mask 0x%x append = %d ignore = %d", vap->va_flags, mask, append, ignore);
8951 if ((vap->va_flags & mask) != 0) {
8952 return EPERM;
8953 }
8954 return 0;
8955 }
8956
8957 static int
vauth_node_owner(struct vnode_attr * vap,kauth_cred_t cred)8958 vauth_node_owner(struct vnode_attr *vap, kauth_cred_t cred)
8959 {
8960 int result;
8961
8962 /* default assumption is not-owner */
8963 result = 0;
8964
8965 /*
8966 * If the filesystem has given us a UID, we treat this as authoritative.
8967 */
8968 if (vap && VATTR_IS_SUPPORTED(vap, va_uid)) {
8969 result = (vap->va_uid == kauth_cred_getuid(cred)) ? 1 : 0;
8970 }
8971 /* we could test the owner UUID here if we had a policy for it */
8972
8973 return result;
8974 }
8975
8976 /*
8977 * vauth_node_group
8978 *
8979 * Description: Ask if a cred is a member of the group owning the vnode object
8980 *
8981 * Parameters: vap vnode attribute
8982 * vap->va_gid group owner of vnode object
8983 * cred credential to check
8984 * ismember pointer to where to put the answer
8985 * idontknow Return this if we can't get an answer
8986 *
8987 * Returns: 0 Success
8988 * idontknow Can't get information
8989 * kauth_cred_ismember_gid:? Error from kauth subsystem
8990 * kauth_cred_ismember_gid:? Error from kauth subsystem
8991 */
8992 static int
vauth_node_group(struct vnode_attr * vap,kauth_cred_t cred,int * ismember,int idontknow)8993 vauth_node_group(struct vnode_attr *vap, kauth_cred_t cred, int *ismember, int idontknow)
8994 {
8995 int error;
8996 int result;
8997
8998 error = 0;
8999 result = 0;
9000
9001 /*
9002 * The caller is expected to have asked the filesystem for a group
9003 * at some point prior to calling this function. The answer may
9004 * have been that there is no group ownership supported for the
9005 * vnode object, in which case we return
9006 */
9007 if (vap && VATTR_IS_SUPPORTED(vap, va_gid)) {
9008 error = kauth_cred_ismember_gid(cred, vap->va_gid, &result);
9009 /*
9010 * Credentials which are opted into external group membership
9011 * resolution which are not known to the external resolver
9012 * will result in an ENOENT error. We translate this into
9013 * the appropriate 'idontknow' response for our caller.
9014 *
9015 * XXX We do not make a distinction here between an ENOENT
9016 * XXX arising from a response from the external resolver,
9017 * XXX and an ENOENT which is internally generated. This is
9018 * XXX a deficiency of the published kauth_cred_ismember_gid()
9019 * XXX KPI which can not be overcome without new KPI. For
9020 * XXX all currently known cases, however, this wil result
9021 * XXX in correct behaviour.
9022 */
9023 if (error == ENOENT) {
9024 error = idontknow;
9025 }
9026 }
9027 /*
9028 * XXX We could test the group UUID here if we had a policy for it,
9029 * XXX but this is problematic from the perspective of synchronizing
9030 * XXX group UUID and POSIX GID ownership of a file and keeping the
9031 * XXX values coherent over time. The problem is that the local
9032 * XXX system will vend transient group UUIDs for unknown POSIX GID
9033 * XXX values, and these are not persistent, whereas storage of values
9034 * XXX is persistent. One potential solution to this is a local
9035 * XXX (persistent) replica of remote directory entries and vended
9036 * XXX local ids in a local directory server (think in terms of a
9037 * XXX caching DNS server).
9038 */
9039
9040 if (!error) {
9041 *ismember = result;
9042 }
9043 return error;
9044 }
9045
9046 static int
vauth_file_owner(vauth_ctx vcp)9047 vauth_file_owner(vauth_ctx vcp)
9048 {
9049 int result;
9050
9051 if (vcp->flags_valid & _VAC_IS_OWNER) {
9052 result = (vcp->flags & _VAC_IS_OWNER) ? 1 : 0;
9053 } else {
9054 result = vauth_node_owner(vcp->vap, vcp->ctx->vc_ucred);
9055
9056 /* cache our result */
9057 vcp->flags_valid |= _VAC_IS_OWNER;
9058 if (result) {
9059 vcp->flags |= _VAC_IS_OWNER;
9060 } else {
9061 vcp->flags &= ~_VAC_IS_OWNER;
9062 }
9063 }
9064 return result;
9065 }
9066
9067
9068 /*
9069 * vauth_file_ingroup
9070 *
9071 * Description: Ask if a user is a member of the group owning the directory
9072 *
9073 * Parameters: vcp The vnode authorization context that
9074 * contains the user and directory info
9075 * vcp->flags_valid Valid flags
9076 * vcp->flags Flags values
9077 * vcp->vap File vnode attributes
9078 * vcp->ctx VFS Context (for user)
9079 * ismember pointer to where to put the answer
9080 * idontknow Return this if we can't get an answer
9081 *
9082 * Returns: 0 Success
9083 * vauth_node_group:? Error from vauth_node_group()
9084 *
9085 * Implicit returns: *ismember 0 The user is not a group member
9086 * 1 The user is a group member
9087 */
9088 static int
vauth_file_ingroup(vauth_ctx vcp,int * ismember,int idontknow)9089 vauth_file_ingroup(vauth_ctx vcp, int *ismember, int idontknow)
9090 {
9091 int error;
9092
9093 /* Check for a cached answer first, to avoid the check if possible */
9094 if (vcp->flags_valid & _VAC_IN_GROUP) {
9095 *ismember = (vcp->flags & _VAC_IN_GROUP) ? 1 : 0;
9096 error = 0;
9097 } else {
9098 /* Otherwise, go look for it */
9099 error = vauth_node_group(vcp->vap, vcp->ctx->vc_ucred, ismember, idontknow);
9100
9101 if (!error) {
9102 /* cache our result */
9103 vcp->flags_valid |= _VAC_IN_GROUP;
9104 if (*ismember) {
9105 vcp->flags |= _VAC_IN_GROUP;
9106 } else {
9107 vcp->flags &= ~_VAC_IN_GROUP;
9108 }
9109 }
9110 }
9111 return error;
9112 }
9113
9114 static int
vauth_dir_owner(vauth_ctx vcp)9115 vauth_dir_owner(vauth_ctx vcp)
9116 {
9117 int result;
9118
9119 if (vcp->flags_valid & _VAC_IS_DIR_OWNER) {
9120 result = (vcp->flags & _VAC_IS_DIR_OWNER) ? 1 : 0;
9121 } else {
9122 result = vauth_node_owner(vcp->dvap, vcp->ctx->vc_ucred);
9123
9124 /* cache our result */
9125 vcp->flags_valid |= _VAC_IS_DIR_OWNER;
9126 if (result) {
9127 vcp->flags |= _VAC_IS_DIR_OWNER;
9128 } else {
9129 vcp->flags &= ~_VAC_IS_DIR_OWNER;
9130 }
9131 }
9132 return result;
9133 }
9134
9135 /*
9136 * vauth_dir_ingroup
9137 *
9138 * Description: Ask if a user is a member of the group owning the directory
9139 *
9140 * Parameters: vcp The vnode authorization context that
9141 * contains the user and directory info
9142 * vcp->flags_valid Valid flags
9143 * vcp->flags Flags values
9144 * vcp->dvap Dir vnode attributes
9145 * vcp->ctx VFS Context (for user)
9146 * ismember pointer to where to put the answer
9147 * idontknow Return this if we can't get an answer
9148 *
9149 * Returns: 0 Success
9150 * vauth_node_group:? Error from vauth_node_group()
9151 *
9152 * Implicit returns: *ismember 0 The user is not a group member
9153 * 1 The user is a group member
9154 */
9155 static int
vauth_dir_ingroup(vauth_ctx vcp,int * ismember,int idontknow)9156 vauth_dir_ingroup(vauth_ctx vcp, int *ismember, int idontknow)
9157 {
9158 int error;
9159
9160 /* Check for a cached answer first, to avoid the check if possible */
9161 if (vcp->flags_valid & _VAC_IN_DIR_GROUP) {
9162 *ismember = (vcp->flags & _VAC_IN_DIR_GROUP) ? 1 : 0;
9163 error = 0;
9164 } else {
9165 /* Otherwise, go look for it */
9166 error = vauth_node_group(vcp->dvap, vcp->ctx->vc_ucred, ismember, idontknow);
9167
9168 if (!error) {
9169 /* cache our result */
9170 vcp->flags_valid |= _VAC_IN_DIR_GROUP;
9171 if (*ismember) {
9172 vcp->flags |= _VAC_IN_DIR_GROUP;
9173 } else {
9174 vcp->flags &= ~_VAC_IN_DIR_GROUP;
9175 }
9176 }
9177 }
9178 return error;
9179 }
9180
9181 /*
9182 * Test the posix permissions in (vap) to determine whether (credential)
9183 * may perform (action)
9184 */
9185 static int
vnode_authorize_posix(vauth_ctx vcp,int action,int on_dir)9186 vnode_authorize_posix(vauth_ctx vcp, int action, int on_dir)
9187 {
9188 struct vnode_attr *vap;
9189 int needed, error, owner_ok, group_ok, world_ok, ismember;
9190 #ifdef KAUTH_DEBUG_ENABLE
9191 const char *where = "uninitialized";
9192 # define _SETWHERE(c) where = c;
9193 #else
9194 # define _SETWHERE(c)
9195 #endif
9196
9197 /* checking file or directory? */
9198 if (on_dir) {
9199 vap = vcp->dvap;
9200 } else {
9201 vap = vcp->vap;
9202 }
9203
9204 error = 0;
9205
9206 /*
9207 * We want to do as little work here as possible. So first we check
9208 * which sets of permissions grant us the access we need, and avoid checking
9209 * whether specific permissions grant access when more generic ones would.
9210 */
9211
9212 /* owner permissions */
9213 needed = 0;
9214 if (action & VREAD) {
9215 needed |= S_IRUSR;
9216 }
9217 if (action & VWRITE) {
9218 needed |= S_IWUSR;
9219 }
9220 if (action & VEXEC) {
9221 needed |= S_IXUSR;
9222 }
9223 owner_ok = (needed & vap->va_mode) == needed;
9224
9225 /*
9226 * Processes with the appropriate entitlement can marked themselves as
9227 * ignoring file/directory permissions if they own it.
9228 */
9229 if (!owner_ok && proc_ignores_node_permissions(vfs_context_proc(vcp->ctx))) {
9230 owner_ok = 1;
9231 }
9232
9233 /* group permissions */
9234 needed = 0;
9235 if (action & VREAD) {
9236 needed |= S_IRGRP;
9237 }
9238 if (action & VWRITE) {
9239 needed |= S_IWGRP;
9240 }
9241 if (action & VEXEC) {
9242 needed |= S_IXGRP;
9243 }
9244 group_ok = (needed & vap->va_mode) == needed;
9245
9246 /* world permissions */
9247 needed = 0;
9248 if (action & VREAD) {
9249 needed |= S_IROTH;
9250 }
9251 if (action & VWRITE) {
9252 needed |= S_IWOTH;
9253 }
9254 if (action & VEXEC) {
9255 needed |= S_IXOTH;
9256 }
9257 world_ok = (needed & vap->va_mode) == needed;
9258
9259 /* If granted/denied by all three, we're done */
9260 if (owner_ok && group_ok && world_ok) {
9261 _SETWHERE("all");
9262 goto out;
9263 }
9264
9265 if (!owner_ok && !group_ok && !world_ok) {
9266 _SETWHERE("all");
9267 error = EACCES;
9268 goto out;
9269 }
9270
9271 /* Check ownership (relatively cheap) */
9272 if ((on_dir && vauth_dir_owner(vcp)) ||
9273 (!on_dir && vauth_file_owner(vcp))) {
9274 _SETWHERE("user");
9275 if (!owner_ok) {
9276 error = EACCES;
9277 }
9278 goto out;
9279 }
9280
9281 /* Not owner; if group and world both grant it we're done */
9282 if (group_ok && world_ok) {
9283 _SETWHERE("group/world");
9284 goto out;
9285 }
9286 if (!group_ok && !world_ok) {
9287 _SETWHERE("group/world");
9288 error = EACCES;
9289 goto out;
9290 }
9291
9292 /* Check group membership (most expensive) */
9293 ismember = 0; /* Default to allow, if the target has no group owner */
9294
9295 /*
9296 * In the case we can't get an answer about the user from the call to
9297 * vauth_dir_ingroup() or vauth_file_ingroup(), we want to fail on
9298 * the side of caution, rather than simply granting access, or we will
9299 * fail to correctly implement exclusion groups, so we set the third
9300 * parameter on the basis of the state of 'group_ok'.
9301 */
9302 if (on_dir) {
9303 error = vauth_dir_ingroup(vcp, &ismember, (!group_ok ? EACCES : 0));
9304 } else {
9305 error = vauth_file_ingroup(vcp, &ismember, (!group_ok ? EACCES : 0));
9306 }
9307 if (error) {
9308 if (!group_ok) {
9309 ismember = 1;
9310 }
9311 error = 0;
9312 }
9313 if (ismember) {
9314 _SETWHERE("group");
9315 if (!group_ok) {
9316 error = EACCES;
9317 }
9318 goto out;
9319 }
9320
9321 /* Not owner, not in group, use world result */
9322 _SETWHERE("world");
9323 if (!world_ok) {
9324 error = EACCES;
9325 }
9326
9327 /* FALLTHROUGH */
9328
9329 out:
9330 KAUTH_DEBUG("%p %s - posix %s permissions : need %s%s%s %x have %s%s%s%s%s%s%s%s%s UID = %d file = %d,%d",
9331 vcp->vp, (error == 0) ? "ALLOWED" : "DENIED", where,
9332 (action & VREAD) ? "r" : "-",
9333 (action & VWRITE) ? "w" : "-",
9334 (action & VEXEC) ? "x" : "-",
9335 needed,
9336 (vap->va_mode & S_IRUSR) ? "r" : "-",
9337 (vap->va_mode & S_IWUSR) ? "w" : "-",
9338 (vap->va_mode & S_IXUSR) ? "x" : "-",
9339 (vap->va_mode & S_IRGRP) ? "r" : "-",
9340 (vap->va_mode & S_IWGRP) ? "w" : "-",
9341 (vap->va_mode & S_IXGRP) ? "x" : "-",
9342 (vap->va_mode & S_IROTH) ? "r" : "-",
9343 (vap->va_mode & S_IWOTH) ? "w" : "-",
9344 (vap->va_mode & S_IXOTH) ? "x" : "-",
9345 kauth_cred_getuid(vcp->ctx->vc_ucred),
9346 on_dir ? vcp->dvap->va_uid : vcp->vap->va_uid,
9347 on_dir ? vcp->dvap->va_gid : vcp->vap->va_gid);
9348 return error;
9349 }
9350
9351 /*
9352 * Authorize the deletion of the node vp from the directory dvp.
9353 *
9354 * We assume that:
9355 * - Neither the node nor the directory are immutable.
9356 * - The user is not the superuser.
9357 *
9358 * The precedence of factors for authorizing or denying delete for a credential
9359 *
9360 * 1) Explicit ACE on the node. (allow or deny DELETE)
9361 * 2) Explicit ACE on the directory (allow or deny DELETE_CHILD).
9362 *
9363 * If there are conflicting ACEs on the node and the directory, the node
9364 * ACE wins.
9365 *
9366 * 3) Sticky bit on the directory.
9367 * Deletion is not permitted if the directory is sticky and the caller is
9368 * not owner of the node or directory. The sticky bit rules are like a deny
9369 * delete ACE except lower in priority than ACL's either allowing or denying
9370 * delete.
9371 *
9372 * 4) POSIX permisions on the directory.
9373 *
9374 * As an optimization, we cache whether or not delete child is permitted
9375 * on directories. This enables us to skip directory ACL and POSIX checks
9376 * as we already have the result from those checks. However, we always check the
9377 * node ACL and, if the directory has the sticky bit set, we always check its
9378 * ACL (even for a directory with an authorized delete child). Furthermore,
9379 * caching the delete child authorization is independent of the sticky bit
9380 * being set as it is only applicable in determining whether the node can be
9381 * deleted or not.
9382 */
9383 static int
vnode_authorize_delete(vauth_ctx vcp,boolean_t cached_delete_child)9384 vnode_authorize_delete(vauth_ctx vcp, boolean_t cached_delete_child)
9385 {
9386 struct vnode_attr *vap = vcp->vap;
9387 struct vnode_attr *dvap = vcp->dvap;
9388 kauth_cred_t cred = vcp->ctx->vc_ucred;
9389 struct kauth_acl_eval eval;
9390 int error, ismember;
9391
9392 /* Check the ACL on the node first */
9393 if (VATTR_IS_NOT(vap, va_acl, NULL)) {
9394 eval.ae_requested = KAUTH_VNODE_DELETE;
9395 eval.ae_acl = &vap->va_acl->acl_ace[0];
9396 eval.ae_count = vap->va_acl->acl_entrycount;
9397 eval.ae_options = 0;
9398 if (vauth_file_owner(vcp)) {
9399 eval.ae_options |= KAUTH_AEVAL_IS_OWNER;
9400 }
9401 /*
9402 * We use ENOENT as a marker to indicate we could not get
9403 * information in order to delay evaluation until after we
9404 * have the ACL evaluation answer. Previously, we would
9405 * always deny the operation at this point.
9406 */
9407 if ((error = vauth_file_ingroup(vcp, &ismember, ENOENT)) != 0 && error != ENOENT) {
9408 return error;
9409 }
9410 if (error == ENOENT) {
9411 eval.ae_options |= KAUTH_AEVAL_IN_GROUP_UNKNOWN;
9412 } else if (ismember) {
9413 eval.ae_options |= KAUTH_AEVAL_IN_GROUP;
9414 }
9415 eval.ae_exp_gall = KAUTH_VNODE_GENERIC_ALL_BITS;
9416 eval.ae_exp_gread = KAUTH_VNODE_GENERIC_READ_BITS;
9417 eval.ae_exp_gwrite = KAUTH_VNODE_GENERIC_WRITE_BITS;
9418 eval.ae_exp_gexec = KAUTH_VNODE_GENERIC_EXECUTE_BITS;
9419
9420 if ((error = kauth_acl_evaluate(cred, &eval)) != 0) {
9421 KAUTH_DEBUG("%p ERROR during ACL processing - %d", vcp->vp, error);
9422 return error;
9423 }
9424
9425 switch (eval.ae_result) {
9426 case KAUTH_RESULT_DENY:
9427 if (vauth_file_owner(vcp) && proc_ignores_node_permissions(vfs_context_proc(vcp->ctx))) {
9428 KAUTH_DEBUG("%p Override DENY due to entitlement", vcp->vp);
9429 return 0;
9430 }
9431 KAUTH_DEBUG("%p DENIED - denied by ACL", vcp->vp);
9432 return EACCES;
9433 case KAUTH_RESULT_ALLOW:
9434 KAUTH_DEBUG("%p ALLOWED - granted by ACL", vcp->vp);
9435 return 0;
9436 case KAUTH_RESULT_DEFER:
9437 default:
9438 /* Defer to directory */
9439 KAUTH_DEBUG("%p DEFERRED - by file ACL", vcp->vp);
9440 break;
9441 }
9442 }
9443
9444 /*
9445 * Without a sticky bit, a previously authorized delete child is
9446 * sufficient to authorize this delete.
9447 *
9448 * If the sticky bit is set, a directory ACL which allows delete child
9449 * overrides a (potential) sticky bit deny. The authorized delete child
9450 * cannot tell us if it was authorized because of an explicit delete
9451 * child allow ACE or because of POSIX permisions so we have to check
9452 * the directory ACL everytime if the directory has a sticky bit.
9453 */
9454 if (!(dvap->va_mode & S_ISTXT) && cached_delete_child) {
9455 KAUTH_DEBUG("%p ALLOWED - granted by directory ACL or POSIX permissions and no sticky bit on directory", vcp->vp);
9456 return 0;
9457 }
9458
9459 /* check the ACL on the directory */
9460 if (VATTR_IS_NOT(dvap, va_acl, NULL)) {
9461 eval.ae_requested = KAUTH_VNODE_DELETE_CHILD;
9462 eval.ae_acl = &dvap->va_acl->acl_ace[0];
9463 eval.ae_count = dvap->va_acl->acl_entrycount;
9464 eval.ae_options = 0;
9465 if (vauth_dir_owner(vcp)) {
9466 eval.ae_options |= KAUTH_AEVAL_IS_OWNER;
9467 }
9468 /*
9469 * We use ENOENT as a marker to indicate we could not get
9470 * information in order to delay evaluation until after we
9471 * have the ACL evaluation answer. Previously, we would
9472 * always deny the operation at this point.
9473 */
9474 if ((error = vauth_dir_ingroup(vcp, &ismember, ENOENT)) != 0 && error != ENOENT) {
9475 return error;
9476 }
9477 if (error == ENOENT) {
9478 eval.ae_options |= KAUTH_AEVAL_IN_GROUP_UNKNOWN;
9479 } else if (ismember) {
9480 eval.ae_options |= KAUTH_AEVAL_IN_GROUP;
9481 }
9482 eval.ae_exp_gall = KAUTH_VNODE_GENERIC_ALL_BITS;
9483 eval.ae_exp_gread = KAUTH_VNODE_GENERIC_READ_BITS;
9484 eval.ae_exp_gwrite = KAUTH_VNODE_GENERIC_WRITE_BITS;
9485 eval.ae_exp_gexec = KAUTH_VNODE_GENERIC_EXECUTE_BITS;
9486
9487 /*
9488 * If there is no entry, we are going to defer to other
9489 * authorization mechanisms.
9490 */
9491 error = kauth_acl_evaluate(cred, &eval);
9492
9493 if (error != 0) {
9494 KAUTH_DEBUG("%p ERROR during ACL processing - %d", vcp->vp, error);
9495 return error;
9496 }
9497 switch (eval.ae_result) {
9498 case KAUTH_RESULT_DENY:
9499 if (vauth_dir_owner(vcp) && proc_ignores_node_permissions(vfs_context_proc(vcp->ctx))) {
9500 KAUTH_DEBUG("%p Override DENY due to entitlement", vcp->vp);
9501 return 0;
9502 }
9503 KAUTH_DEBUG("%p DENIED - denied by directory ACL", vcp->vp);
9504 return EACCES;
9505 case KAUTH_RESULT_ALLOW:
9506 KAUTH_DEBUG("%p ALLOWED - granted by directory ACL", vcp->vp);
9507 if (!cached_delete_child && vcp->dvp) {
9508 vnode_cache_authorized_action(vcp->dvp,
9509 vcp->ctx, KAUTH_VNODE_DELETE_CHILD);
9510 }
9511 return 0;
9512 case KAUTH_RESULT_DEFER:
9513 default:
9514 /* Deferred by directory ACL */
9515 KAUTH_DEBUG("%p DEFERRED - directory ACL", vcp->vp);
9516 break;
9517 }
9518 }
9519
9520 /*
9521 * From this point, we can't explicitly allow and if we reach the end
9522 * of the function without a denial, then the delete is authorized.
9523 */
9524 if (!cached_delete_child) {
9525 if (vnode_authorize_posix(vcp, VWRITE, 1 /* on_dir */) != 0) {
9526 KAUTH_DEBUG("%p DENIED - denied by posix permisssions", vcp->vp);
9527 return EACCES;
9528 }
9529 /*
9530 * Cache the authorized action on the vnode if allowed by the
9531 * directory ACL or POSIX permissions. It is correct to cache
9532 * this action even if sticky bit would deny deleting the node.
9533 */
9534 if (vcp->dvp) {
9535 vnode_cache_authorized_action(vcp->dvp, vcp->ctx,
9536 KAUTH_VNODE_DELETE_CHILD);
9537 }
9538 }
9539
9540 /* enforce sticky bit behaviour */
9541 if ((dvap->va_mode & S_ISTXT) && !vauth_file_owner(vcp) && !vauth_dir_owner(vcp)) {
9542 KAUTH_DEBUG("%p DENIED - sticky bit rules (user %d file %d dir %d)",
9543 vcp->vp, cred->cr_posix.cr_uid, vap->va_uid, dvap->va_uid);
9544 return EACCES;
9545 }
9546
9547 /* not denied, must be OK */
9548 return 0;
9549 }
9550
9551
9552 /*
9553 * Authorize an operation based on the node's attributes.
9554 */
9555 static int
vnode_authorize_simple(vauth_ctx vcp,kauth_ace_rights_t acl_rights,kauth_ace_rights_t preauth_rights,boolean_t * found_deny)9556 vnode_authorize_simple(vauth_ctx vcp, kauth_ace_rights_t acl_rights, kauth_ace_rights_t preauth_rights, boolean_t *found_deny)
9557 {
9558 struct vnode_attr *vap = vcp->vap;
9559 kauth_cred_t cred = vcp->ctx->vc_ucred;
9560 struct kauth_acl_eval eval;
9561 int error, ismember;
9562 mode_t posix_action;
9563
9564 /*
9565 * If we are the file owner, we automatically have some rights.
9566 *
9567 * Do we need to expand this to support group ownership?
9568 */
9569 if (vauth_file_owner(vcp)) {
9570 acl_rights &= ~(KAUTH_VNODE_WRITE_SECURITY);
9571 }
9572
9573 /*
9574 * If we are checking both TAKE_OWNERSHIP and WRITE_SECURITY, we can
9575 * mask the latter. If TAKE_OWNERSHIP is requested the caller is about to
9576 * change ownership to themselves, and WRITE_SECURITY is implicitly
9577 * granted to the owner. We need to do this because at this point
9578 * WRITE_SECURITY may not be granted as the caller is not currently
9579 * the owner.
9580 */
9581 if ((acl_rights & KAUTH_VNODE_TAKE_OWNERSHIP) &&
9582 (acl_rights & KAUTH_VNODE_WRITE_SECURITY)) {
9583 acl_rights &= ~KAUTH_VNODE_WRITE_SECURITY;
9584 }
9585
9586 if (acl_rights == 0) {
9587 KAUTH_DEBUG("%p ALLOWED - implicit or no rights required", vcp->vp);
9588 return 0;
9589 }
9590
9591 /* if we have an ACL, evaluate it */
9592 if (VATTR_IS_NOT(vap, va_acl, NULL)) {
9593 eval.ae_requested = acl_rights;
9594 eval.ae_acl = &vap->va_acl->acl_ace[0];
9595 eval.ae_count = vap->va_acl->acl_entrycount;
9596 eval.ae_options = 0;
9597 if (vauth_file_owner(vcp)) {
9598 eval.ae_options |= KAUTH_AEVAL_IS_OWNER;
9599 }
9600 /*
9601 * We use ENOENT as a marker to indicate we could not get
9602 * information in order to delay evaluation until after we
9603 * have the ACL evaluation answer. Previously, we would
9604 * always deny the operation at this point.
9605 */
9606 if ((error = vauth_file_ingroup(vcp, &ismember, ENOENT)) != 0 && error != ENOENT) {
9607 return error;
9608 }
9609 if (error == ENOENT) {
9610 eval.ae_options |= KAUTH_AEVAL_IN_GROUP_UNKNOWN;
9611 } else if (ismember) {
9612 eval.ae_options |= KAUTH_AEVAL_IN_GROUP;
9613 }
9614 eval.ae_exp_gall = KAUTH_VNODE_GENERIC_ALL_BITS;
9615 eval.ae_exp_gread = KAUTH_VNODE_GENERIC_READ_BITS;
9616 eval.ae_exp_gwrite = KAUTH_VNODE_GENERIC_WRITE_BITS;
9617 eval.ae_exp_gexec = KAUTH_VNODE_GENERIC_EXECUTE_BITS;
9618
9619 if ((error = kauth_acl_evaluate(cred, &eval)) != 0) {
9620 KAUTH_DEBUG("%p ERROR during ACL processing - %d", vcp->vp, error);
9621 return error;
9622 }
9623
9624 switch (eval.ae_result) {
9625 case KAUTH_RESULT_DENY:
9626 if (vauth_file_owner(vcp) && proc_ignores_node_permissions(vfs_context_proc(vcp->ctx))) {
9627 KAUTH_DEBUG("%p Override DENY due to entitlement", vcp->vp);
9628 return 0;
9629 }
9630 KAUTH_DEBUG("%p DENIED - by ACL", vcp->vp);
9631 return EACCES; /* deny, deny, counter-allege */
9632 case KAUTH_RESULT_ALLOW:
9633 KAUTH_DEBUG("%p ALLOWED - all rights granted by ACL", vcp->vp);
9634 return 0;
9635 case KAUTH_RESULT_DEFER:
9636 default:
9637 /* Effectively the same as !delete_child_denied */
9638 KAUTH_DEBUG("%p DEFERRED - directory ACL", vcp->vp);
9639 break;
9640 }
9641
9642 *found_deny = eval.ae_found_deny;
9643
9644 /* fall through and evaluate residual rights */
9645 } else {
9646 /* no ACL, everything is residual */
9647 eval.ae_residual = acl_rights;
9648 }
9649
9650 /*
9651 * Grant residual rights that have been pre-authorized.
9652 */
9653 eval.ae_residual &= ~preauth_rights;
9654
9655 /*
9656 * We grant WRITE_ATTRIBUTES to the owner if it hasn't been denied.
9657 */
9658 if (vauth_file_owner(vcp)) {
9659 eval.ae_residual &= ~KAUTH_VNODE_WRITE_ATTRIBUTES;
9660 }
9661
9662 if (eval.ae_residual == 0) {
9663 KAUTH_DEBUG("%p ALLOWED - rights already authorized", vcp->vp);
9664 return 0;
9665 }
9666
9667 /*
9668 * Bail if we have residual rights that can't be granted by posix permissions,
9669 * or aren't presumed granted at this point.
9670 *
9671 * XXX these can be collapsed for performance
9672 */
9673 if (eval.ae_residual & KAUTH_VNODE_CHANGE_OWNER) {
9674 KAUTH_DEBUG("%p DENIED - CHANGE_OWNER not permitted", vcp->vp);
9675 return EACCES;
9676 }
9677 if (eval.ae_residual & KAUTH_VNODE_WRITE_SECURITY) {
9678 KAUTH_DEBUG("%p DENIED - WRITE_SECURITY not permitted", vcp->vp);
9679 return EACCES;
9680 }
9681
9682 #if DIAGNOSTIC
9683 if (eval.ae_residual & KAUTH_VNODE_DELETE) {
9684 panic("vnode_authorize: can't be checking delete permission here");
9685 }
9686 #endif
9687
9688 /*
9689 * Compute the fallback posix permissions that will satisfy the remaining
9690 * rights.
9691 */
9692 posix_action = 0;
9693 if (eval.ae_residual & (KAUTH_VNODE_READ_DATA |
9694 KAUTH_VNODE_LIST_DIRECTORY |
9695 KAUTH_VNODE_READ_EXTATTRIBUTES)) {
9696 posix_action |= VREAD;
9697 }
9698 if (eval.ae_residual & (KAUTH_VNODE_WRITE_DATA |
9699 KAUTH_VNODE_ADD_FILE |
9700 KAUTH_VNODE_ADD_SUBDIRECTORY |
9701 KAUTH_VNODE_DELETE_CHILD |
9702 KAUTH_VNODE_WRITE_ATTRIBUTES |
9703 KAUTH_VNODE_WRITE_EXTATTRIBUTES)) {
9704 posix_action |= VWRITE;
9705 }
9706 if (eval.ae_residual & (KAUTH_VNODE_EXECUTE |
9707 KAUTH_VNODE_SEARCH)) {
9708 posix_action |= VEXEC;
9709 }
9710
9711 if (posix_action != 0) {
9712 return vnode_authorize_posix(vcp, posix_action, 0 /* !on_dir */);
9713 } else {
9714 KAUTH_DEBUG("%p ALLOWED - residual rights %s%s%s%s%s%s%s%s%s%s%s%s%s%s granted due to no posix mapping",
9715 vcp->vp,
9716 (eval.ae_residual & KAUTH_VNODE_READ_DATA)
9717 ? vnode_isdir(vcp->vp) ? " LIST_DIRECTORY" : " READ_DATA" : "",
9718 (eval.ae_residual & KAUTH_VNODE_WRITE_DATA)
9719 ? vnode_isdir(vcp->vp) ? " ADD_FILE" : " WRITE_DATA" : "",
9720 (eval.ae_residual & KAUTH_VNODE_EXECUTE)
9721 ? vnode_isdir(vcp->vp) ? " SEARCH" : " EXECUTE" : "",
9722 (eval.ae_residual & KAUTH_VNODE_DELETE)
9723 ? " DELETE" : "",
9724 (eval.ae_residual & KAUTH_VNODE_APPEND_DATA)
9725 ? vnode_isdir(vcp->vp) ? " ADD_SUBDIRECTORY" : " APPEND_DATA" : "",
9726 (eval.ae_residual & KAUTH_VNODE_DELETE_CHILD)
9727 ? " DELETE_CHILD" : "",
9728 (eval.ae_residual & KAUTH_VNODE_READ_ATTRIBUTES)
9729 ? " READ_ATTRIBUTES" : "",
9730 (eval.ae_residual & KAUTH_VNODE_WRITE_ATTRIBUTES)
9731 ? " WRITE_ATTRIBUTES" : "",
9732 (eval.ae_residual & KAUTH_VNODE_READ_EXTATTRIBUTES)
9733 ? " READ_EXTATTRIBUTES" : "",
9734 (eval.ae_residual & KAUTH_VNODE_WRITE_EXTATTRIBUTES)
9735 ? " WRITE_EXTATTRIBUTES" : "",
9736 (eval.ae_residual & KAUTH_VNODE_READ_SECURITY)
9737 ? " READ_SECURITY" : "",
9738 (eval.ae_residual & KAUTH_VNODE_WRITE_SECURITY)
9739 ? " WRITE_SECURITY" : "",
9740 (eval.ae_residual & KAUTH_VNODE_CHECKIMMUTABLE)
9741 ? " CHECKIMMUTABLE" : "",
9742 (eval.ae_residual & KAUTH_VNODE_CHANGE_OWNER)
9743 ? " CHANGE_OWNER" : "");
9744 }
9745
9746 /*
9747 * Lack of required Posix permissions implies no reason to deny access.
9748 */
9749 return 0;
9750 }
9751
9752 /*
9753 * Check for file immutability.
9754 */
9755 static int
vnode_authorize_checkimmutable(mount_t mp,vauth_ctx vcp,struct vnode_attr * vap,int rights,int ignore)9756 vnode_authorize_checkimmutable(mount_t mp, vauth_ctx vcp,
9757 struct vnode_attr *vap, int rights, int ignore)
9758 {
9759 int error;
9760 int append;
9761
9762 /*
9763 * Perform immutability checks for operations that change data.
9764 *
9765 * Sockets, fifos and devices require special handling.
9766 */
9767 switch (vap->va_type) {
9768 case VSOCK:
9769 case VFIFO:
9770 case VBLK:
9771 case VCHR:
9772 /*
9773 * Writing to these nodes does not change the filesystem data,
9774 * so forget that it's being tried.
9775 */
9776 rights &= ~KAUTH_VNODE_WRITE_DATA;
9777 break;
9778 default:
9779 break;
9780 }
9781
9782 error = 0;
9783 if (rights & KAUTH_VNODE_WRITE_RIGHTS) {
9784 /* check per-filesystem options if possible */
9785 if (mp != NULL) {
9786 /* check for no-EA filesystems */
9787 if ((rights & KAUTH_VNODE_WRITE_EXTATTRIBUTES) &&
9788 (vfs_flags(mp) & MNT_NOUSERXATTR)) {
9789 KAUTH_DEBUG("%p DENIED - filesystem disallowed extended attributes", vap);
9790 error = EACCES; /* User attributes disabled */
9791 goto out;
9792 }
9793 }
9794
9795 /*
9796 * check for file immutability. first, check if the requested rights are
9797 * allowable for a UF_APPEND file.
9798 */
9799 append = 0;
9800 if (vap->va_type == VDIR) {
9801 if ((rights & (KAUTH_VNODE_ADD_FILE | KAUTH_VNODE_ADD_SUBDIRECTORY | KAUTH_VNODE_WRITE_EXTATTRIBUTES | ~KAUTH_VNODE_WRITE_RIGHTS)) == rights) {
9802 append = 1;
9803 }
9804 } else {
9805 if ((rights & (KAUTH_VNODE_APPEND_DATA | KAUTH_VNODE_WRITE_EXTATTRIBUTES | ~KAUTH_VNODE_WRITE_RIGHTS)) == rights) {
9806 append = 1;
9807 }
9808 }
9809 if ((error = vnode_immutable(vap, append, ignore)) != 0) {
9810 if (error && !ignore) {
9811 /*
9812 * In case of a rename, we want to check ownership for dvp as well.
9813 */
9814 int owner = 0;
9815 if (rights & KAUTH_VNODE_DELETE_CHILD && vcp->dvp != NULL) {
9816 owner = vauth_file_owner(vcp) && vauth_dir_owner(vcp);
9817 } else {
9818 owner = vauth_file_owner(vcp);
9819 }
9820 if (owner && proc_ignores_node_permissions(vfs_context_proc(vcp->ctx))) {
9821 error = vnode_immutable(vap, append, 1);
9822 }
9823 }
9824 }
9825 if (error) {
9826 KAUTH_DEBUG("%p DENIED - file is immutable", vap);
9827 goto out;
9828 }
9829 }
9830 out:
9831 return error;
9832 }
9833
9834 /*
9835 * Handle authorization actions for filesystems that advertise that the
9836 * server will be enforcing.
9837 *
9838 * Returns: 0 Authorization should be handled locally
9839 * 1 Authorization was handled by the FS
9840 *
9841 * Note: Imputed returns will only occur if the authorization request
9842 * was handled by the FS.
9843 *
9844 * Imputed: *resultp, modified Return code from FS when the request is
9845 * handled by the FS.
9846 * VNOP_ACCESS:???
9847 * VNOP_OPEN:???
9848 */
9849 static int
vnode_authorize_opaque(vnode_t vp,int * resultp,kauth_action_t action,vfs_context_t ctx)9850 vnode_authorize_opaque(vnode_t vp, int *resultp, kauth_action_t action, vfs_context_t ctx)
9851 {
9852 int error;
9853
9854 /*
9855 * If the vp is a device node, socket or FIFO it actually represents a local
9856 * endpoint, so we need to handle it locally.
9857 */
9858 switch (vp->v_type) {
9859 case VBLK:
9860 case VCHR:
9861 case VSOCK:
9862 case VFIFO:
9863 return 0;
9864 default:
9865 break;
9866 }
9867
9868 /*
9869 * In the advisory request case, if the filesystem doesn't think it's reliable
9870 * we will attempt to formulate a result ourselves based on VNOP_GETATTR data.
9871 */
9872 if ((action & KAUTH_VNODE_ACCESS) && !vfs_authopaqueaccess(vp->v_mount)) {
9873 return 0;
9874 }
9875
9876 /*
9877 * Let the filesystem have a say in the matter. It's OK for it to not implemnent
9878 * VNOP_ACCESS, as most will authorise inline with the actual request.
9879 */
9880 if ((error = VNOP_ACCESS(vp, action, ctx)) != ENOTSUP) {
9881 *resultp = error;
9882 KAUTH_DEBUG("%p DENIED - opaque filesystem VNOP_ACCESS denied access", vp);
9883 return 1;
9884 }
9885
9886 /*
9887 * Typically opaque filesystems do authorisation in-line, but exec is a special case. In
9888 * order to be reasonably sure that exec will be permitted, we try a bit harder here.
9889 */
9890 if ((action & KAUTH_VNODE_EXECUTE) && (vp->v_type == VREG)) {
9891 /* try a VNOP_OPEN for readonly access */
9892 if ((error = VNOP_OPEN(vp, FREAD, ctx)) != 0) {
9893 *resultp = error;
9894 KAUTH_DEBUG("%p DENIED - EXECUTE denied because file could not be opened readonly", vp);
9895 return 1;
9896 }
9897 VNOP_CLOSE(vp, FREAD, ctx);
9898 }
9899
9900 /*
9901 * We don't have any reason to believe that the request has to be denied at this point,
9902 * so go ahead and allow it.
9903 */
9904 *resultp = 0;
9905 KAUTH_DEBUG("%p ALLOWED - bypassing access check for non-local filesystem", vp);
9906 return 1;
9907 }
9908
9909
9910
9911
9912 /*
9913 * Returns: KAUTH_RESULT_ALLOW
9914 * KAUTH_RESULT_DENY
9915 *
9916 * Imputed: *arg3, modified Error code in the deny case
9917 * EROFS Read-only file system
9918 * EACCES Permission denied
9919 * EPERM Operation not permitted [no execute]
9920 * vnode_getattr:ENOMEM Not enough space [only if has filesec]
9921 * vnode_getattr:???
9922 * vnode_authorize_opaque:*arg2 ???
9923 * vnode_authorize_checkimmutable:???
9924 * vnode_authorize_delete:???
9925 * vnode_authorize_simple:???
9926 */
9927
9928
9929 static int
vnode_authorize_callback(__unused kauth_cred_t cred,__unused void * idata,kauth_action_t action,uintptr_t arg0,uintptr_t arg1,uintptr_t arg2,uintptr_t arg3)9930 vnode_authorize_callback(__unused kauth_cred_t cred, __unused void *idata,
9931 kauth_action_t action, uintptr_t arg0, uintptr_t arg1, uintptr_t arg2,
9932 uintptr_t arg3)
9933 {
9934 vfs_context_t ctx;
9935 vnode_t cvp = NULLVP;
9936 vnode_t vp, dvp;
9937 int result = KAUTH_RESULT_DENY;
9938 int parent_iocount = 0;
9939 int parent_action = 0; /* In case we need to use namedstream's data fork for cached rights*/
9940
9941 ctx = (vfs_context_t)arg0;
9942 vp = (vnode_t)arg1;
9943 dvp = (vnode_t)arg2;
9944
9945 /*
9946 * if there are 2 vnodes passed in, we don't know at
9947 * this point which rights to look at based on the
9948 * combined action being passed in... defer until later...
9949 * otherwise check the kauth 'rights' cache hung
9950 * off of the vnode we're interested in... if we've already
9951 * been granted the right we're currently interested in,
9952 * we can just return success... otherwise we'll go through
9953 * the process of authorizing the requested right(s)... if that
9954 * succeeds, we'll add the right(s) to the cache.
9955 * VNOP_SETATTR and VNOP_SETXATTR will invalidate this cache
9956 */
9957 if (dvp && vp) {
9958 goto defer;
9959 }
9960 if (dvp) {
9961 cvp = dvp;
9962 } else {
9963 /*
9964 * For named streams on local-authorization volumes, rights are cached on the parent;
9965 * authorization is determined by looking at the parent's properties anyway, so storing
9966 * on the parent means that we don't recompute for the named stream and that if
9967 * we need to flush rights (e.g. on VNOP_SETATTR()) we don't need to track down the
9968 * stream to flush its cache separately. If we miss in the cache, then we authorize
9969 * as if there were no cached rights (passing the named stream vnode and desired rights to
9970 * vnode_authorize_callback_int()).
9971 *
9972 * On an opaquely authorized volume, we don't know the relationship between the
9973 * data fork's properties and the rights granted on a stream. Thus, named stream vnodes
9974 * on such a volume are authorized directly (rather than using the parent) and have their
9975 * own caches. When a named stream vnode is created, we mark the parent as having a named
9976 * stream. On a VNOP_SETATTR() for the parent that may invalidate cached authorization, we
9977 * find the stream and flush its cache.
9978 */
9979 if (vnode_isnamedstream(vp) && (!vfs_authopaque(vp->v_mount))) {
9980 cvp = vnode_getparent(vp);
9981 if (cvp != NULLVP) {
9982 parent_iocount = 1;
9983 } else {
9984 cvp = NULL;
9985 goto defer; /* If we can't use the parent, take the slow path */
9986 }
9987
9988 /* Have to translate some actions */
9989 parent_action = action;
9990 if (parent_action & KAUTH_VNODE_READ_DATA) {
9991 parent_action &= ~KAUTH_VNODE_READ_DATA;
9992 parent_action |= KAUTH_VNODE_READ_EXTATTRIBUTES;
9993 }
9994 if (parent_action & KAUTH_VNODE_WRITE_DATA) {
9995 parent_action &= ~KAUTH_VNODE_WRITE_DATA;
9996 parent_action |= KAUTH_VNODE_WRITE_EXTATTRIBUTES;
9997 }
9998 } else {
9999 cvp = vp;
10000 }
10001 }
10002
10003 if (vnode_cache_is_authorized(cvp, ctx, parent_iocount ? parent_action : action) == TRUE) {
10004 result = KAUTH_RESULT_ALLOW;
10005 goto out;
10006 }
10007 defer:
10008 result = vnode_authorize_callback_int(action, ctx, vp, dvp, (int *)arg3);
10009
10010 if (result == KAUTH_RESULT_ALLOW && cvp != NULLVP) {
10011 KAUTH_DEBUG("%p - caching action = %x", cvp, action);
10012 vnode_cache_authorized_action(cvp, ctx, action);
10013 }
10014
10015 out:
10016 if (parent_iocount) {
10017 vnode_put(cvp);
10018 }
10019
10020 return result;
10021 }
10022
10023 static int
vnode_attr_authorize_internal(vauth_ctx vcp,mount_t mp,kauth_ace_rights_t rights,int is_suser,boolean_t * found_deny,int noimmutable,int parent_authorized_for_delete_child)10024 vnode_attr_authorize_internal(vauth_ctx vcp, mount_t mp,
10025 kauth_ace_rights_t rights, int is_suser, boolean_t *found_deny,
10026 int noimmutable, int parent_authorized_for_delete_child)
10027 {
10028 int result;
10029
10030 /*
10031 * Check for immutability.
10032 *
10033 * In the deletion case, parent directory immutability vetoes specific
10034 * file rights.
10035 */
10036 if ((result = vnode_authorize_checkimmutable(mp, vcp, vcp->vap, rights,
10037 noimmutable)) != 0) {
10038 goto out;
10039 }
10040
10041 if ((rights & KAUTH_VNODE_DELETE) &&
10042 !parent_authorized_for_delete_child) {
10043 result = vnode_authorize_checkimmutable(mp, vcp, vcp->dvap,
10044 KAUTH_VNODE_DELETE_CHILD, 0);
10045 if (result) {
10046 goto out;
10047 }
10048 }
10049
10050 /*
10051 * Clear rights that have been authorized by reaching this point, bail if nothing left to
10052 * check.
10053 */
10054 rights &= ~(KAUTH_VNODE_LINKTARGET | KAUTH_VNODE_CHECKIMMUTABLE);
10055 if (rights == 0) {
10056 goto out;
10057 }
10058
10059 /*
10060 * If we're not the superuser, authorize based on file properties;
10061 * note that even if parent_authorized_for_delete_child is TRUE, we
10062 * need to check on the node itself.
10063 */
10064 if (!is_suser) {
10065 /* process delete rights */
10066 if ((rights & KAUTH_VNODE_DELETE) &&
10067 ((result = vnode_authorize_delete(vcp, parent_authorized_for_delete_child)) != 0)) {
10068 goto out;
10069 }
10070
10071 /* process remaining rights */
10072 if ((rights & ~KAUTH_VNODE_DELETE) &&
10073 (result = vnode_authorize_simple(vcp, rights, rights & KAUTH_VNODE_DELETE, found_deny)) != 0) {
10074 goto out;
10075 }
10076 } else {
10077 /*
10078 * Execute is only granted to root if one of the x bits is set. This check only
10079 * makes sense if the posix mode bits are actually supported.
10080 */
10081 if ((rights & KAUTH_VNODE_EXECUTE) &&
10082 (vcp->vap->va_type == VREG) &&
10083 VATTR_IS_SUPPORTED(vcp->vap, va_mode) &&
10084 !(vcp->vap->va_mode & (S_IXUSR | S_IXGRP | S_IXOTH))) {
10085 result = EPERM;
10086 KAUTH_DEBUG("%p DENIED - root execute requires at least one x bit in 0x%x", vcp, vcp->vap->va_mode);
10087 goto out;
10088 }
10089
10090 /* Assume that there were DENYs so we don't wrongly cache KAUTH_VNODE_SEARCHBYANYONE */
10091 *found_deny = TRUE;
10092
10093 KAUTH_DEBUG("%p ALLOWED - caller is superuser", vcp);
10094 }
10095 out:
10096 return result;
10097 }
10098
10099 static int
vnode_authorize_callback_int(kauth_action_t action,vfs_context_t ctx,vnode_t vp,vnode_t dvp,int * errorp)10100 vnode_authorize_callback_int(kauth_action_t action, vfs_context_t ctx,
10101 vnode_t vp, vnode_t dvp, int *errorp)
10102 {
10103 struct _vnode_authorize_context auth_context;
10104 vauth_ctx vcp;
10105 kauth_cred_t cred;
10106 kauth_ace_rights_t rights;
10107 struct vnode_attr va, dva;
10108 int result;
10109 int noimmutable;
10110 boolean_t parent_authorized_for_delete_child = FALSE;
10111 boolean_t found_deny = FALSE;
10112 boolean_t parent_ref = FALSE;
10113 boolean_t is_suser = FALSE;
10114
10115 vcp = &auth_context;
10116 vcp->ctx = ctx;
10117 vcp->vp = vp;
10118 vcp->dvp = dvp;
10119 /*
10120 * Note that we authorize against the context, not the passed cred
10121 * (the same thing anyway)
10122 */
10123 cred = ctx->vc_ucred;
10124
10125 VATTR_INIT(&va);
10126 vcp->vap = &va;
10127 VATTR_INIT(&dva);
10128 vcp->dvap = &dva;
10129
10130 vcp->flags = vcp->flags_valid = 0;
10131
10132 #if DIAGNOSTIC
10133 if ((ctx == NULL) || (vp == NULL) || (cred == NULL)) {
10134 panic("vnode_authorize: bad arguments (context %p vp %p cred %p)", ctx, vp, cred);
10135 }
10136 #endif
10137
10138 KAUTH_DEBUG("%p AUTH - %s %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s on %s '%s' (0x%x:%p/%p)",
10139 vp, vfs_context_proc(ctx)->p_comm,
10140 (action & KAUTH_VNODE_ACCESS) ? "access" : "auth",
10141 (action & KAUTH_VNODE_READ_DATA) ? vnode_isdir(vp) ? " LIST_DIRECTORY" : " READ_DATA" : "",
10142 (action & KAUTH_VNODE_WRITE_DATA) ? vnode_isdir(vp) ? " ADD_FILE" : " WRITE_DATA" : "",
10143 (action & KAUTH_VNODE_EXECUTE) ? vnode_isdir(vp) ? " SEARCH" : " EXECUTE" : "",
10144 (action & KAUTH_VNODE_DELETE) ? " DELETE" : "",
10145 (action & KAUTH_VNODE_APPEND_DATA) ? vnode_isdir(vp) ? " ADD_SUBDIRECTORY" : " APPEND_DATA" : "",
10146 (action & KAUTH_VNODE_DELETE_CHILD) ? " DELETE_CHILD" : "",
10147 (action & KAUTH_VNODE_READ_ATTRIBUTES) ? " READ_ATTRIBUTES" : "",
10148 (action & KAUTH_VNODE_WRITE_ATTRIBUTES) ? " WRITE_ATTRIBUTES" : "",
10149 (action & KAUTH_VNODE_READ_EXTATTRIBUTES) ? " READ_EXTATTRIBUTES" : "",
10150 (action & KAUTH_VNODE_WRITE_EXTATTRIBUTES) ? " WRITE_EXTATTRIBUTES" : "",
10151 (action & KAUTH_VNODE_READ_SECURITY) ? " READ_SECURITY" : "",
10152 (action & KAUTH_VNODE_WRITE_SECURITY) ? " WRITE_SECURITY" : "",
10153 (action & KAUTH_VNODE_CHANGE_OWNER) ? " CHANGE_OWNER" : "",
10154 (action & KAUTH_VNODE_NOIMMUTABLE) ? " (noimmutable)" : "",
10155 vnode_isdir(vp) ? "directory" : "file",
10156 vp->v_name ? vp->v_name : "<NULL>", action, vp, dvp);
10157
10158 /*
10159 * Extract the control bits from the action, everything else is
10160 * requested rights.
10161 */
10162 noimmutable = (action & KAUTH_VNODE_NOIMMUTABLE) ? 1 : 0;
10163 rights = action & ~(KAUTH_VNODE_ACCESS | KAUTH_VNODE_NOIMMUTABLE);
10164
10165 if (rights & KAUTH_VNODE_DELETE) {
10166 #if DIAGNOSTIC
10167 if (dvp == NULL) {
10168 panic("vnode_authorize: KAUTH_VNODE_DELETE test requires a directory");
10169 }
10170 #endif
10171 /*
10172 * check to see if we've already authorized the parent
10173 * directory for deletion of its children... if so, we
10174 * can skip a whole bunch of work... we will still have to
10175 * authorize that this specific child can be removed
10176 */
10177 if (vnode_cache_is_authorized(dvp, ctx, KAUTH_VNODE_DELETE_CHILD) == TRUE) {
10178 parent_authorized_for_delete_child = TRUE;
10179 }
10180 } else {
10181 vcp->dvp = NULLVP;
10182 vcp->dvap = NULL;
10183 }
10184
10185 /*
10186 * Check for read-only filesystems.
10187 */
10188 if ((rights & KAUTH_VNODE_WRITE_RIGHTS) &&
10189 (vp->v_mount->mnt_flag & MNT_RDONLY) &&
10190 ((vp->v_type == VREG) || (vp->v_type == VDIR) ||
10191 (vp->v_type == VLNK) || (vp->v_type == VCPLX) ||
10192 (rights & KAUTH_VNODE_DELETE) || (rights & KAUTH_VNODE_DELETE_CHILD))) {
10193 result = EROFS;
10194 goto out;
10195 }
10196
10197 /*
10198 * Check for noexec filesystems.
10199 */
10200 if ((rights & KAUTH_VNODE_EXECUTE) && (vp->v_type == VREG) && (vp->v_mount->mnt_flag & MNT_NOEXEC)) {
10201 result = EACCES;
10202 goto out;
10203 }
10204
10205 /*
10206 * Handle cases related to filesystems with non-local enforcement.
10207 * This call can return 0, in which case we will fall through to perform a
10208 * check based on VNOP_GETATTR data. Otherwise it returns 1 and sets
10209 * an appropriate result, at which point we can return immediately.
10210 */
10211 if ((vp->v_mount->mnt_kern_flag & MNTK_AUTH_OPAQUE) && vnode_authorize_opaque(vp, &result, action, ctx)) {
10212 goto out;
10213 }
10214
10215 /*
10216 * If the vnode is a namedstream (extended attribute) data vnode (eg.
10217 * a resource fork), *_DATA becomes *_EXTATTRIBUTES.
10218 */
10219 if (vnode_isnamedstream(vp)) {
10220 if (rights & KAUTH_VNODE_READ_DATA) {
10221 rights &= ~KAUTH_VNODE_READ_DATA;
10222 rights |= KAUTH_VNODE_READ_EXTATTRIBUTES;
10223 }
10224 if (rights & KAUTH_VNODE_WRITE_DATA) {
10225 rights &= ~KAUTH_VNODE_WRITE_DATA;
10226 rights |= KAUTH_VNODE_WRITE_EXTATTRIBUTES;
10227 }
10228
10229 /*
10230 * Point 'vp' to the namedstream's parent for ACL checking
10231 */
10232 if ((vp->v_parent != NULL) &&
10233 (vget_internal(vp->v_parent, 0, VNODE_NODEAD | VNODE_DRAINO) == 0)) {
10234 parent_ref = TRUE;
10235 vcp->vp = vp = vp->v_parent;
10236 }
10237 }
10238
10239 if (vfs_context_issuser(ctx)) {
10240 /*
10241 * if we're not asking for execute permissions or modifications,
10242 * then we're done, this action is authorized.
10243 */
10244 if (!(rights & (KAUTH_VNODE_EXECUTE | KAUTH_VNODE_WRITE_RIGHTS))) {
10245 goto success;
10246 }
10247
10248 is_suser = TRUE;
10249 }
10250
10251 /*
10252 * Get vnode attributes and extended security information for the vnode
10253 * and directory if required.
10254 *
10255 * If we're root we only want mode bits and flags for checking
10256 * execute and immutability.
10257 */
10258 VATTR_WANTED(&va, va_mode);
10259 VATTR_WANTED(&va, va_flags);
10260 if (!is_suser) {
10261 VATTR_WANTED(&va, va_uid);
10262 VATTR_WANTED(&va, va_gid);
10263 VATTR_WANTED(&va, va_acl);
10264 }
10265 if ((result = vnode_getattr(vp, &va, ctx)) != 0) {
10266 KAUTH_DEBUG("%p ERROR - failed to get vnode attributes - %d", vp, result);
10267 goto out;
10268 }
10269 VATTR_WANTED(&va, va_type);
10270 VATTR_RETURN(&va, va_type, vnode_vtype(vp));
10271
10272 if (vcp->dvp) {
10273 VATTR_WANTED(&dva, va_mode);
10274 VATTR_WANTED(&dva, va_flags);
10275 if (!is_suser) {
10276 VATTR_WANTED(&dva, va_uid);
10277 VATTR_WANTED(&dva, va_gid);
10278 VATTR_WANTED(&dva, va_acl);
10279 }
10280 if ((result = vnode_getattr(vcp->dvp, &dva, ctx)) != 0) {
10281 KAUTH_DEBUG("%p ERROR - failed to get directory vnode attributes - %d", vp, result);
10282 goto out;
10283 }
10284 VATTR_WANTED(&dva, va_type);
10285 VATTR_RETURN(&dva, va_type, vnode_vtype(vcp->dvp));
10286 }
10287
10288 result = vnode_attr_authorize_internal(vcp, vp->v_mount, rights, is_suser,
10289 &found_deny, noimmutable, parent_authorized_for_delete_child);
10290 out:
10291 if (VATTR_IS_SUPPORTED(&va, va_acl) && (va.va_acl != NULL)) {
10292 kauth_acl_free(va.va_acl);
10293 }
10294 if (VATTR_IS_SUPPORTED(&dva, va_acl) && (dva.va_acl != NULL)) {
10295 kauth_acl_free(dva.va_acl);
10296 }
10297
10298 if (result) {
10299 if (parent_ref) {
10300 vnode_put(vp);
10301 }
10302 *errorp = result;
10303 KAUTH_DEBUG("%p DENIED - auth denied", vp);
10304 return KAUTH_RESULT_DENY;
10305 }
10306 if ((rights & KAUTH_VNODE_SEARCH) && found_deny == FALSE && vp->v_type == VDIR) {
10307 /*
10308 * if we were successfully granted the right to search this directory
10309 * and there were NO ACL DENYs for search and the posix permissions also don't
10310 * deny execute, we can synthesize a global right that allows anyone to
10311 * traverse this directory during a pathname lookup without having to
10312 * match the credential associated with this cache of rights.
10313 *
10314 * Note that we can correctly cache KAUTH_VNODE_SEARCHBYANYONE
10315 * only if we actually check ACLs which we don't for root. As
10316 * a workaround, the lookup fast path checks for root.
10317 */
10318 if (!VATTR_IS_SUPPORTED(&va, va_mode) ||
10319 ((va.va_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) ==
10320 (S_IXUSR | S_IXGRP | S_IXOTH))) {
10321 vnode_cache_authorized_action(vp, ctx, KAUTH_VNODE_SEARCHBYANYONE);
10322 }
10323 }
10324 success:
10325 if (parent_ref) {
10326 vnode_put(vp);
10327 }
10328
10329 /*
10330 * Note that this implies that we will allow requests for no rights, as well as
10331 * for rights that we do not recognise. There should be none of these.
10332 */
10333 KAUTH_DEBUG("%p ALLOWED - auth granted", vp);
10334 return KAUTH_RESULT_ALLOW;
10335 }
10336
10337 int
vnode_attr_authorize_init(struct vnode_attr * vap,struct vnode_attr * dvap,kauth_action_t action,vfs_context_t ctx)10338 vnode_attr_authorize_init(struct vnode_attr *vap, struct vnode_attr *dvap,
10339 kauth_action_t action, vfs_context_t ctx)
10340 {
10341 VATTR_INIT(vap);
10342 VATTR_WANTED(vap, va_type);
10343 VATTR_WANTED(vap, va_mode);
10344 VATTR_WANTED(vap, va_flags);
10345 if (dvap) {
10346 VATTR_INIT(dvap);
10347 if (action & KAUTH_VNODE_DELETE) {
10348 VATTR_WANTED(dvap, va_type);
10349 VATTR_WANTED(dvap, va_mode);
10350 VATTR_WANTED(dvap, va_flags);
10351 }
10352 } else if (action & KAUTH_VNODE_DELETE) {
10353 return EINVAL;
10354 }
10355
10356 if (!vfs_context_issuser(ctx)) {
10357 VATTR_WANTED(vap, va_uid);
10358 VATTR_WANTED(vap, va_gid);
10359 VATTR_WANTED(vap, va_acl);
10360 if (dvap && (action & KAUTH_VNODE_DELETE)) {
10361 VATTR_WANTED(dvap, va_uid);
10362 VATTR_WANTED(dvap, va_gid);
10363 VATTR_WANTED(dvap, va_acl);
10364 }
10365 }
10366
10367 return 0;
10368 }
10369
10370 #define VNODE_SEC_ATTRS_NO_ACL (VNODE_ATTR_va_uid | VNODE_ATTR_va_gid | VNODE_ATTR_va_mode | VNODE_ATTR_va_flags | VNODE_ATTR_va_type)
10371
10372 int
vnode_attr_authorize(struct vnode_attr * vap,struct vnode_attr * dvap,mount_t mp,kauth_action_t action,vfs_context_t ctx)10373 vnode_attr_authorize(struct vnode_attr *vap, struct vnode_attr *dvap, mount_t mp,
10374 kauth_action_t action, vfs_context_t ctx)
10375 {
10376 struct _vnode_authorize_context auth_context;
10377 vauth_ctx vcp;
10378 kauth_ace_rights_t rights;
10379 int noimmutable;
10380 boolean_t found_deny;
10381 boolean_t is_suser = FALSE;
10382 int result = 0;
10383 uid_t ouid = vap->va_uid;
10384 gid_t ogid = vap->va_gid;
10385
10386 vcp = &auth_context;
10387 vcp->ctx = ctx;
10388 vcp->vp = NULLVP;
10389 vcp->vap = vap;
10390 vcp->dvp = NULLVP;
10391 vcp->dvap = dvap;
10392 vcp->flags = vcp->flags_valid = 0;
10393
10394 noimmutable = (action & KAUTH_VNODE_NOIMMUTABLE) ? 1 : 0;
10395 rights = action & ~(KAUTH_VNODE_ACCESS | KAUTH_VNODE_NOIMMUTABLE);
10396
10397 /*
10398 * Check for read-only filesystems.
10399 */
10400 if ((rights & KAUTH_VNODE_WRITE_RIGHTS) &&
10401 mp && (mp->mnt_flag & MNT_RDONLY) &&
10402 ((vap->va_type == VREG) || (vap->va_type == VDIR) ||
10403 (vap->va_type == VLNK) || (rights & KAUTH_VNODE_DELETE) ||
10404 (rights & KAUTH_VNODE_DELETE_CHILD))) {
10405 result = EROFS;
10406 goto out;
10407 }
10408
10409 /*
10410 * Check for noexec filesystems.
10411 */
10412 if ((rights & KAUTH_VNODE_EXECUTE) &&
10413 (vap->va_type == VREG) && mp && (mp->mnt_flag & MNT_NOEXEC)) {
10414 result = EACCES;
10415 goto out;
10416 }
10417
10418 if (vfs_context_issuser(ctx)) {
10419 /*
10420 * if we're not asking for execute permissions or modifications,
10421 * then we're done, this action is authorized.
10422 */
10423 if (!(rights & (KAUTH_VNODE_EXECUTE | KAUTH_VNODE_WRITE_RIGHTS))) {
10424 goto out;
10425 }
10426 is_suser = TRUE;
10427 }
10428
10429 if (mp) {
10430 if (vfs_extendedsecurity(mp) && VATTR_IS_ACTIVE(vap, va_acl) && !VATTR_IS_SUPPORTED(vap, va_acl)) {
10431 panic("(1) vnode attrs not complete for vnode_attr_authorize");
10432 }
10433 vnode_attr_handle_uid_and_gid(vap, mp, ctx);
10434 }
10435
10436 if ((vap->va_active & VNODE_SEC_ATTRS_NO_ACL) != (vap->va_supported & VNODE_SEC_ATTRS_NO_ACL)) {
10437 panic("(2) vnode attrs not complete for vnode_attr_authorize (2) vap->va_active = 0x%llx , vap->va_supported = 0x%llx",
10438 vap->va_active, vap->va_supported);
10439 }
10440
10441 result = vnode_attr_authorize_internal(vcp, mp, rights, is_suser,
10442 &found_deny, noimmutable, FALSE);
10443
10444 if (mp) {
10445 vap->va_uid = ouid;
10446 vap->va_gid = ogid;
10447 }
10448
10449 if (result == EPERM) {
10450 result = EACCES;
10451 }
10452 out:
10453 return result;
10454 }
10455
10456
10457 int
vnode_authattr_new(vnode_t dvp,struct vnode_attr * vap,int noauth,vfs_context_t ctx)10458 vnode_authattr_new(vnode_t dvp, struct vnode_attr *vap, int noauth, vfs_context_t ctx)
10459 {
10460 return vnode_authattr_new_internal(dvp, vap, noauth, NULL, ctx);
10461 }
10462
10463 /*
10464 * Check that the attribute information in vattr can be legally applied to
10465 * a new file by the context.
10466 */
10467 static int
vnode_authattr_new_internal(vnode_t dvp,struct vnode_attr * vap,int noauth,uint32_t * defaulted_fieldsp,vfs_context_t ctx)10468 vnode_authattr_new_internal(vnode_t dvp, struct vnode_attr *vap, int noauth, uint32_t *defaulted_fieldsp, vfs_context_t ctx)
10469 {
10470 int error;
10471 int has_priv_suser, ismember, defaulted_owner, defaulted_group, defaulted_mode;
10472 uint32_t inherit_flags;
10473 kauth_cred_t cred;
10474 guid_t changer;
10475 mount_t dmp;
10476 struct vnode_attr dva;
10477
10478 error = 0;
10479
10480 if (defaulted_fieldsp) {
10481 *defaulted_fieldsp = 0;
10482 }
10483
10484 defaulted_owner = defaulted_group = defaulted_mode = 0;
10485
10486 inherit_flags = 0;
10487
10488 /*
10489 * Require that the filesystem support extended security to apply any.
10490 */
10491 if (!vfs_extendedsecurity(dvp->v_mount) &&
10492 (VATTR_IS_ACTIVE(vap, va_acl) || VATTR_IS_ACTIVE(vap, va_uuuid) || VATTR_IS_ACTIVE(vap, va_guuid))) {
10493 error = EINVAL;
10494 goto out;
10495 }
10496
10497 /*
10498 * Default some fields.
10499 */
10500 dmp = dvp->v_mount;
10501
10502 /*
10503 * If the filesystem is mounted IGNORE_OWNERSHIP and an explicit owner is set, that
10504 * owner takes ownership of all new files.
10505 */
10506 if ((dmp->mnt_flag & MNT_IGNORE_OWNERSHIP) && (dmp->mnt_fsowner != KAUTH_UID_NONE)) {
10507 VATTR_SET(vap, va_uid, dmp->mnt_fsowner);
10508 defaulted_owner = 1;
10509 } else {
10510 if (!VATTR_IS_ACTIVE(vap, va_uid)) {
10511 /* default owner is current user */
10512 VATTR_SET(vap, va_uid, kauth_cred_getuid(vfs_context_ucred(ctx)));
10513 defaulted_owner = 1;
10514 }
10515 }
10516
10517 /*
10518 * We need the dvp's va_flags and *may* need the gid of the directory,
10519 * we ask for both here.
10520 */
10521 VATTR_INIT(&dva);
10522 VATTR_WANTED(&dva, va_gid);
10523 VATTR_WANTED(&dva, va_flags);
10524 if ((error = vnode_getattr(dvp, &dva, ctx)) != 0) {
10525 goto out;
10526 }
10527
10528 /*
10529 * If the filesystem is mounted IGNORE_OWNERSHIP and an explicit grouo is set, that
10530 * group takes ownership of all new files.
10531 */
10532 if ((dmp->mnt_flag & MNT_IGNORE_OWNERSHIP) && (dmp->mnt_fsgroup != KAUTH_GID_NONE)) {
10533 VATTR_SET(vap, va_gid, dmp->mnt_fsgroup);
10534 defaulted_group = 1;
10535 } else {
10536 if (!VATTR_IS_ACTIVE(vap, va_gid)) {
10537 /* default group comes from parent object, fallback to current user */
10538 if (VATTR_IS_SUPPORTED(&dva, va_gid)) {
10539 VATTR_SET(vap, va_gid, dva.va_gid);
10540 } else {
10541 VATTR_SET(vap, va_gid, kauth_cred_getgid(vfs_context_ucred(ctx)));
10542 }
10543 defaulted_group = 1;
10544 }
10545 }
10546
10547 if (!VATTR_IS_ACTIVE(vap, va_flags)) {
10548 VATTR_SET(vap, va_flags, 0);
10549 }
10550
10551 /* Determine if SF_RESTRICTED should be inherited from the parent
10552 * directory. */
10553 if (VATTR_IS_SUPPORTED(&dva, va_flags)) {
10554 inherit_flags = dva.va_flags & (UF_DATAVAULT | SF_RESTRICTED);
10555 }
10556
10557 /* default mode is everything, masked with current umask */
10558 if (!VATTR_IS_ACTIVE(vap, va_mode)) {
10559 VATTR_SET(vap, va_mode, ACCESSPERMS & ~vfs_context_proc(ctx)->p_fd.fd_cmask);
10560 KAUTH_DEBUG("ATTR - defaulting new file mode to %o from umask %o",
10561 vap->va_mode, vfs_context_proc(ctx)->p_fd.fd_cmask);
10562 defaulted_mode = 1;
10563 }
10564 /* set timestamps to now */
10565 if (!VATTR_IS_ACTIVE(vap, va_create_time)) {
10566 nanotime(&vap->va_create_time);
10567 VATTR_SET_ACTIVE(vap, va_create_time);
10568 }
10569
10570 /*
10571 * Check for attempts to set nonsensical fields.
10572 */
10573 if (vap->va_active & ~VNODE_ATTR_NEWOBJ) {
10574 error = EINVAL;
10575 KAUTH_DEBUG("ATTR - ERROR - attempt to set unsupported new-file attributes %llx",
10576 vap->va_active & ~VNODE_ATTR_NEWOBJ);
10577 goto out;
10578 }
10579
10580 /*
10581 * Quickly check for the applicability of any enforcement here.
10582 * Tests below maintain the integrity of the local security model.
10583 */
10584 if (vfs_authopaque(dvp->v_mount)) {
10585 goto out;
10586 }
10587
10588 /*
10589 * We need to know if the caller is the superuser, or if the work is
10590 * otherwise already authorised.
10591 */
10592 cred = vfs_context_ucred(ctx);
10593 if (noauth) {
10594 /* doing work for the kernel */
10595 has_priv_suser = 1;
10596 } else {
10597 has_priv_suser = vfs_context_issuser(ctx);
10598 }
10599
10600
10601 if (VATTR_IS_ACTIVE(vap, va_flags)) {
10602 vap->va_flags &= ~SF_SYNTHETIC;
10603 if (has_priv_suser) {
10604 if ((vap->va_flags & (UF_SETTABLE | SF_SETTABLE)) != vap->va_flags) {
10605 error = EPERM;
10606 KAUTH_DEBUG(" DENIED - superuser attempt to set illegal flag(s)");
10607 goto out;
10608 }
10609 } else {
10610 if ((vap->va_flags & UF_SETTABLE) != vap->va_flags) {
10611 error = EPERM;
10612 KAUTH_DEBUG(" DENIED - user attempt to set illegal flag(s)");
10613 goto out;
10614 }
10615 }
10616 }
10617
10618 /* if not superuser, validate legality of new-item attributes */
10619 if (!has_priv_suser) {
10620 if (!defaulted_mode && VATTR_IS_ACTIVE(vap, va_mode)) {
10621 /* setgid? */
10622 if (vap->va_mode & S_ISGID) {
10623 if ((error = kauth_cred_ismember_gid(cred, vap->va_gid, &ismember)) != 0) {
10624 KAUTH_DEBUG("ATTR - ERROR: got %d checking for membership in %d", error, vap->va_gid);
10625 goto out;
10626 }
10627 if (!ismember) {
10628 KAUTH_DEBUG(" DENIED - can't set SGID bit, not a member of %d", vap->va_gid);
10629 error = EPERM;
10630 goto out;
10631 }
10632 }
10633
10634 /* setuid? */
10635 if ((vap->va_mode & S_ISUID) && (vap->va_uid != kauth_cred_getuid(cred))) {
10636 KAUTH_DEBUG("ATTR - ERROR: illegal attempt to set the setuid bit");
10637 error = EPERM;
10638 goto out;
10639 }
10640 }
10641 if (!defaulted_owner && (vap->va_uid != kauth_cred_getuid(cred))) {
10642 KAUTH_DEBUG(" DENIED - cannot create new item owned by %d", vap->va_uid);
10643 error = EPERM;
10644 goto out;
10645 }
10646 if (!defaulted_group) {
10647 if ((error = kauth_cred_ismember_gid(cred, vap->va_gid, &ismember)) != 0) {
10648 KAUTH_DEBUG(" ERROR - got %d checking for membership in %d", error, vap->va_gid);
10649 goto out;
10650 }
10651 if (!ismember) {
10652 KAUTH_DEBUG(" DENIED - cannot create new item with group %d - not a member", vap->va_gid);
10653 error = EPERM;
10654 goto out;
10655 }
10656 }
10657
10658 /* initialising owner/group UUID */
10659 if (VATTR_IS_ACTIVE(vap, va_uuuid)) {
10660 if ((error = kauth_cred_getguid(cred, &changer)) != 0) {
10661 KAUTH_DEBUG(" ERROR - got %d trying to get caller UUID", error);
10662 /* XXX ENOENT here - no GUID - should perhaps become EPERM */
10663 goto out;
10664 }
10665 if (!kauth_guid_equal(&vap->va_uuuid, &changer)) {
10666 KAUTH_DEBUG(" ERROR - cannot create item with supplied owner UUID - not us");
10667 error = EPERM;
10668 goto out;
10669 }
10670 }
10671 if (VATTR_IS_ACTIVE(vap, va_guuid)) {
10672 if ((error = kauth_cred_ismember_guid(cred, &vap->va_guuid, &ismember)) != 0) {
10673 KAUTH_DEBUG(" ERROR - got %d trying to check group membership", error);
10674 goto out;
10675 }
10676 if (!ismember) {
10677 KAUTH_DEBUG(" ERROR - cannot create item with supplied group UUID - not a member");
10678 error = EPERM;
10679 goto out;
10680 }
10681 }
10682 }
10683 out:
10684 if (inherit_flags) {
10685 /* Apply SF_RESTRICTED to the file if its parent directory was
10686 * restricted. This is done at the end so that root is not
10687 * required if this flag is only set due to inheritance. */
10688 VATTR_SET(vap, va_flags, (vap->va_flags | inherit_flags));
10689 }
10690 if (defaulted_fieldsp) {
10691 if (defaulted_mode) {
10692 *defaulted_fieldsp |= VATTR_PREPARE_DEFAULTED_MODE;
10693 }
10694 if (defaulted_group) {
10695 *defaulted_fieldsp |= VATTR_PREPARE_DEFAULTED_GID;
10696 }
10697 if (defaulted_owner) {
10698 *defaulted_fieldsp |= VATTR_PREPARE_DEFAULTED_UID;
10699 }
10700 }
10701 return error;
10702 }
10703
10704 /*
10705 * Check that the attribute information in vap can be legally written by the
10706 * context.
10707 *
10708 * Call this when you're not sure about the vnode_attr; either its contents
10709 * have come from an unknown source, or when they are variable.
10710 *
10711 * Returns errno, or zero and sets *actionp to the KAUTH_VNODE_* actions that
10712 * must be authorized to be permitted to write the vattr.
10713 */
10714 int
vnode_authattr(vnode_t vp,struct vnode_attr * vap,kauth_action_t * actionp,vfs_context_t ctx)10715 vnode_authattr(vnode_t vp, struct vnode_attr *vap, kauth_action_t *actionp, vfs_context_t ctx)
10716 {
10717 struct vnode_attr ova;
10718 kauth_action_t required_action;
10719 int error, has_priv_suser, ismember, chowner, chgroup, clear_suid, clear_sgid;
10720 guid_t changer;
10721 gid_t group;
10722 uid_t owner;
10723 mode_t newmode;
10724 kauth_cred_t cred;
10725 uint32_t fdelta;
10726
10727 VATTR_INIT(&ova);
10728 required_action = 0;
10729 error = 0;
10730
10731 /*
10732 * Quickly check for enforcement applicability.
10733 */
10734 if (vfs_authopaque(vp->v_mount)) {
10735 goto out;
10736 }
10737
10738 /*
10739 * Check for attempts to set nonsensical fields.
10740 */
10741 if (vap->va_active & VNODE_ATTR_RDONLY) {
10742 KAUTH_DEBUG("ATTR - ERROR: attempt to set readonly attribute(s)");
10743 error = EINVAL;
10744 goto out;
10745 }
10746
10747 /*
10748 * We need to know if the caller is the superuser.
10749 */
10750 cred = vfs_context_ucred(ctx);
10751 has_priv_suser = kauth_cred_issuser(cred);
10752
10753 /*
10754 * If any of the following are changing, we need information from the old file:
10755 * va_uid
10756 * va_gid
10757 * va_mode
10758 * va_uuuid
10759 * va_guuid
10760 */
10761 if (VATTR_IS_ACTIVE(vap, va_uid) ||
10762 VATTR_IS_ACTIVE(vap, va_gid) ||
10763 VATTR_IS_ACTIVE(vap, va_mode) ||
10764 VATTR_IS_ACTIVE(vap, va_uuuid) ||
10765 VATTR_IS_ACTIVE(vap, va_guuid)) {
10766 VATTR_WANTED(&ova, va_mode);
10767 VATTR_WANTED(&ova, va_uid);
10768 VATTR_WANTED(&ova, va_gid);
10769 VATTR_WANTED(&ova, va_uuuid);
10770 VATTR_WANTED(&ova, va_guuid);
10771 KAUTH_DEBUG("ATTR - security information changing, fetching existing attributes");
10772 }
10773
10774 /*
10775 * If timestamps are being changed, we need to know who the file is owned
10776 * by.
10777 */
10778 if (VATTR_IS_ACTIVE(vap, va_create_time) ||
10779 VATTR_IS_ACTIVE(vap, va_change_time) ||
10780 VATTR_IS_ACTIVE(vap, va_modify_time) ||
10781 VATTR_IS_ACTIVE(vap, va_access_time) ||
10782 VATTR_IS_ACTIVE(vap, va_backup_time) ||
10783 VATTR_IS_ACTIVE(vap, va_addedtime)) {
10784 VATTR_WANTED(&ova, va_uid);
10785 #if 0 /* enable this when we support UUIDs as official owners */
10786 VATTR_WANTED(&ova, va_uuuid);
10787 #endif
10788 KAUTH_DEBUG("ATTR - timestamps changing, fetching uid and GUID");
10789 }
10790
10791 /*
10792 * If flags are being changed, we need the old flags.
10793 */
10794 if (VATTR_IS_ACTIVE(vap, va_flags)) {
10795 KAUTH_DEBUG("ATTR - flags changing, fetching old flags");
10796 VATTR_WANTED(&ova, va_flags);
10797 }
10798
10799 /*
10800 * If ACLs are being changed, we need the old ACLs.
10801 */
10802 if (VATTR_IS_ACTIVE(vap, va_acl)) {
10803 KAUTH_DEBUG("ATTR - acl changing, fetching old flags");
10804 VATTR_WANTED(&ova, va_acl);
10805 }
10806
10807 /*
10808 * If the size is being set, make sure it's not a directory.
10809 */
10810 if (VATTR_IS_ACTIVE(vap, va_data_size)) {
10811 /* size is only meaningful on regular files, don't permit otherwise */
10812 if (!vnode_isreg(vp)) {
10813 KAUTH_DEBUG("ATTR - ERROR: size change requested on non-file");
10814 error = vnode_isdir(vp) ? EISDIR : EINVAL;
10815 goto out;
10816 }
10817 }
10818
10819 /*
10820 * Get old data.
10821 */
10822 KAUTH_DEBUG("ATTR - fetching old attributes %016llx", ova.va_active);
10823 if ((error = vnode_getattr(vp, &ova, ctx)) != 0) {
10824 KAUTH_DEBUG(" ERROR - got %d trying to get attributes", error);
10825 goto out;
10826 }
10827
10828 /*
10829 * Size changes require write access to the file data.
10830 */
10831 if (VATTR_IS_ACTIVE(vap, va_data_size)) {
10832 /* if we can't get the size, or it's different, we need write access */
10833 KAUTH_DEBUG("ATTR - size change, requiring WRITE_DATA");
10834 required_action |= KAUTH_VNODE_WRITE_DATA;
10835 }
10836
10837 /*
10838 * Changing timestamps?
10839 *
10840 * Note that we are only called to authorize user-requested time changes;
10841 * side-effect time changes are not authorized. Authorisation is only
10842 * required for existing files.
10843 *
10844 * Non-owners are not permitted to change the time on an existing
10845 * file to anything other than the current time.
10846 */
10847 if (VATTR_IS_ACTIVE(vap, va_create_time) ||
10848 VATTR_IS_ACTIVE(vap, va_change_time) ||
10849 VATTR_IS_ACTIVE(vap, va_modify_time) ||
10850 VATTR_IS_ACTIVE(vap, va_access_time) ||
10851 VATTR_IS_ACTIVE(vap, va_backup_time) ||
10852 VATTR_IS_ACTIVE(vap, va_addedtime)) {
10853 /*
10854 * The owner and root may set any timestamps they like,
10855 * provided that the file is not immutable. The owner still needs
10856 * WRITE_ATTRIBUTES (implied by ownership but still deniable).
10857 */
10858 if (has_priv_suser || vauth_node_owner(&ova, cred)) {
10859 KAUTH_DEBUG("ATTR - root or owner changing timestamps");
10860 required_action |= KAUTH_VNODE_CHECKIMMUTABLE | KAUTH_VNODE_WRITE_ATTRIBUTES;
10861 } else {
10862 /* just setting the current time? */
10863 if (vap->va_vaflags & VA_UTIMES_NULL) {
10864 KAUTH_DEBUG("ATTR - non-root/owner changing timestamps, requiring WRITE_ATTRIBUTES");
10865 required_action |= KAUTH_VNODE_WRITE_ATTRIBUTES;
10866 } else {
10867 KAUTH_DEBUG("ATTR - ERROR: illegal timestamp modification attempted");
10868 error = EACCES;
10869 goto out;
10870 }
10871 }
10872 }
10873
10874 /*
10875 * Changing file mode?
10876 */
10877 if (VATTR_IS_ACTIVE(vap, va_mode) && VATTR_IS_SUPPORTED(&ova, va_mode) && (ova.va_mode != vap->va_mode)) {
10878 KAUTH_DEBUG("ATTR - mode change from %06o to %06o", ova.va_mode, vap->va_mode);
10879
10880 /*
10881 * Mode changes always have the same basic auth requirements.
10882 */
10883 if (has_priv_suser) {
10884 KAUTH_DEBUG("ATTR - superuser mode change, requiring immutability check");
10885 required_action |= KAUTH_VNODE_CHECKIMMUTABLE;
10886 } else {
10887 /* need WRITE_SECURITY */
10888 KAUTH_DEBUG("ATTR - non-superuser mode change, requiring WRITE_SECURITY");
10889 required_action |= KAUTH_VNODE_WRITE_SECURITY;
10890 }
10891
10892 /*
10893 * Can't set the setgid bit if you're not in the group and not root. Have to have
10894 * existing group information in the case we're not setting it right now.
10895 */
10896 if (vap->va_mode & S_ISGID) {
10897 required_action |= KAUTH_VNODE_CHECKIMMUTABLE; /* always required */
10898 if (!has_priv_suser) {
10899 if (VATTR_IS_ACTIVE(vap, va_gid)) {
10900 group = vap->va_gid;
10901 } else if (VATTR_IS_SUPPORTED(&ova, va_gid)) {
10902 group = ova.va_gid;
10903 } else {
10904 KAUTH_DEBUG("ATTR - ERROR: setgid but no gid available");
10905 error = EINVAL;
10906 goto out;
10907 }
10908 /*
10909 * This might be too restrictive; WRITE_SECURITY might be implied by
10910 * membership in this case, rather than being an additional requirement.
10911 */
10912 if ((error = kauth_cred_ismember_gid(cred, group, &ismember)) != 0) {
10913 KAUTH_DEBUG("ATTR - ERROR: got %d checking for membership in %d", error, vap->va_gid);
10914 goto out;
10915 }
10916 if (!ismember) {
10917 KAUTH_DEBUG(" DENIED - can't set SGID bit, not a member of %d", group);
10918 error = EPERM;
10919 goto out;
10920 }
10921 }
10922 }
10923
10924 /*
10925 * Can't set the setuid bit unless you're root or the file's owner.
10926 */
10927 if (vap->va_mode & S_ISUID) {
10928 required_action |= KAUTH_VNODE_CHECKIMMUTABLE; /* always required */
10929 if (!has_priv_suser) {
10930 if (VATTR_IS_ACTIVE(vap, va_uid)) {
10931 owner = vap->va_uid;
10932 } else if (VATTR_IS_SUPPORTED(&ova, va_uid)) {
10933 owner = ova.va_uid;
10934 } else {
10935 KAUTH_DEBUG("ATTR - ERROR: setuid but no uid available");
10936 error = EINVAL;
10937 goto out;
10938 }
10939 if (owner != kauth_cred_getuid(cred)) {
10940 /*
10941 * We could allow this if WRITE_SECURITY is permitted, perhaps.
10942 */
10943 KAUTH_DEBUG("ATTR - ERROR: illegal attempt to set the setuid bit");
10944 error = EPERM;
10945 goto out;
10946 }
10947 }
10948 }
10949 }
10950
10951 /*
10952 * Validate/mask flags changes. This checks that only the flags in
10953 * the UF_SETTABLE mask are being set, and preserves the flags in
10954 * the SF_SETTABLE case.
10955 *
10956 * Since flags changes may be made in conjunction with other changes,
10957 * we will ask the auth code to ignore immutability in the case that
10958 * the SF_* flags are not set and we are only manipulating the file flags.
10959 *
10960 */
10961 if (VATTR_IS_ACTIVE(vap, va_flags)) {
10962 /* compute changing flags bits */
10963 vap->va_flags &= ~SF_SYNTHETIC;
10964 ova.va_flags &= ~SF_SYNTHETIC;
10965 if (VATTR_IS_SUPPORTED(&ova, va_flags)) {
10966 fdelta = vap->va_flags ^ ova.va_flags;
10967 } else {
10968 fdelta = vap->va_flags;
10969 }
10970
10971 if (fdelta != 0) {
10972 KAUTH_DEBUG("ATTR - flags changing, requiring WRITE_SECURITY");
10973 required_action |= KAUTH_VNODE_WRITE_SECURITY;
10974
10975 /* check that changing bits are legal */
10976 if (has_priv_suser) {
10977 /*
10978 * The immutability check will prevent us from clearing the SF_*
10979 * flags unless the system securelevel permits it, so just check
10980 * for legal flags here.
10981 */
10982 if (fdelta & ~(UF_SETTABLE | SF_SETTABLE)) {
10983 error = EPERM;
10984 KAUTH_DEBUG(" DENIED - superuser attempt to set illegal flag(s)");
10985 goto out;
10986 }
10987 } else {
10988 if (fdelta & ~UF_SETTABLE) {
10989 error = EPERM;
10990 KAUTH_DEBUG(" DENIED - user attempt to set illegal flag(s)");
10991 goto out;
10992 }
10993 }
10994 /*
10995 * If the caller has the ability to manipulate file flags,
10996 * security is not reduced by ignoring them for this operation.
10997 *
10998 * A more complete test here would consider the 'after' states of the flags
10999 * to determine whether it would permit the operation, but this becomes
11000 * very complex.
11001 *
11002 * Ignoring immutability is conditional on securelevel; this does not bypass
11003 * the SF_* flags if securelevel > 0.
11004 */
11005 required_action |= KAUTH_VNODE_NOIMMUTABLE;
11006 }
11007 }
11008
11009 /*
11010 * Validate ownership information.
11011 */
11012 chowner = 0;
11013 chgroup = 0;
11014 clear_suid = 0;
11015 clear_sgid = 0;
11016
11017 /*
11018 * uid changing
11019 * Note that if the filesystem didn't give us a UID, we expect that it doesn't
11020 * support them in general, and will ignore it if/when we try to set it.
11021 * We might want to clear the uid out of vap completely here.
11022 */
11023 if (VATTR_IS_ACTIVE(vap, va_uid)) {
11024 if (VATTR_IS_SUPPORTED(&ova, va_uid) && (vap->va_uid != ova.va_uid)) {
11025 if (!has_priv_suser && (kauth_cred_getuid(cred) != vap->va_uid)) {
11026 KAUTH_DEBUG(" DENIED - non-superuser cannot change ownershipt to a third party");
11027 error = EPERM;
11028 goto out;
11029 }
11030 chowner = 1;
11031 }
11032 clear_suid = 1;
11033 }
11034
11035 /*
11036 * gid changing
11037 * Note that if the filesystem didn't give us a GID, we expect that it doesn't
11038 * support them in general, and will ignore it if/when we try to set it.
11039 * We might want to clear the gid out of vap completely here.
11040 */
11041 if (VATTR_IS_ACTIVE(vap, va_gid)) {
11042 if (VATTR_IS_SUPPORTED(&ova, va_gid) && (vap->va_gid != ova.va_gid)) {
11043 if (!has_priv_suser) {
11044 if ((error = kauth_cred_ismember_gid(cred, vap->va_gid, &ismember)) != 0) {
11045 KAUTH_DEBUG(" ERROR - got %d checking for membership in %d", error, vap->va_gid);
11046 goto out;
11047 }
11048 if (!ismember) {
11049 KAUTH_DEBUG(" DENIED - group change from %d to %d but not a member of target group",
11050 ova.va_gid, vap->va_gid);
11051 error = EPERM;
11052 goto out;
11053 }
11054 }
11055 chgroup = 1;
11056 }
11057 clear_sgid = 1;
11058 }
11059
11060 /*
11061 * Owner UUID being set or changed.
11062 */
11063 if (VATTR_IS_ACTIVE(vap, va_uuuid)) {
11064 /* if the owner UUID is not actually changing ... */
11065 if (VATTR_IS_SUPPORTED(&ova, va_uuuid)) {
11066 if (kauth_guid_equal(&vap->va_uuuid, &ova.va_uuuid)) {
11067 goto no_uuuid_change;
11068 }
11069
11070 /*
11071 * If the current owner UUID is a null GUID, check
11072 * it against the UUID corresponding to the owner UID.
11073 */
11074 if (kauth_guid_equal(&ova.va_uuuid, &kauth_null_guid) &&
11075 VATTR_IS_SUPPORTED(&ova, va_uid)) {
11076 guid_t uid_guid;
11077
11078 if (kauth_cred_uid2guid(ova.va_uid, &uid_guid) == 0 &&
11079 kauth_guid_equal(&vap->va_uuuid, &uid_guid)) {
11080 goto no_uuuid_change;
11081 }
11082 }
11083 }
11084
11085 /*
11086 * The owner UUID cannot be set by a non-superuser to anything other than
11087 * their own or a null GUID (to "unset" the owner UUID).
11088 * Note that file systems must be prepared to handle the
11089 * null UUID case in a manner appropriate for that file
11090 * system.
11091 */
11092 if (!has_priv_suser) {
11093 if ((error = kauth_cred_getguid(cred, &changer)) != 0) {
11094 KAUTH_DEBUG(" ERROR - got %d trying to get caller UUID", error);
11095 /* XXX ENOENT here - no UUID - should perhaps become EPERM */
11096 goto out;
11097 }
11098 if (!kauth_guid_equal(&vap->va_uuuid, &changer) &&
11099 !kauth_guid_equal(&vap->va_uuuid, &kauth_null_guid)) {
11100 KAUTH_DEBUG(" ERROR - cannot set supplied owner UUID - not us / null");
11101 error = EPERM;
11102 goto out;
11103 }
11104 }
11105 chowner = 1;
11106 clear_suid = 1;
11107 }
11108 no_uuuid_change:
11109 /*
11110 * Group UUID being set or changed.
11111 */
11112 if (VATTR_IS_ACTIVE(vap, va_guuid)) {
11113 /* if the group UUID is not actually changing ... */
11114 if (VATTR_IS_SUPPORTED(&ova, va_guuid)) {
11115 if (kauth_guid_equal(&vap->va_guuid, &ova.va_guuid)) {
11116 goto no_guuid_change;
11117 }
11118
11119 /*
11120 * If the current group UUID is a null UUID, check
11121 * it against the UUID corresponding to the group GID.
11122 */
11123 if (kauth_guid_equal(&ova.va_guuid, &kauth_null_guid) &&
11124 VATTR_IS_SUPPORTED(&ova, va_gid)) {
11125 guid_t gid_guid;
11126
11127 if (kauth_cred_gid2guid(ova.va_gid, &gid_guid) == 0 &&
11128 kauth_guid_equal(&vap->va_guuid, &gid_guid)) {
11129 goto no_guuid_change;
11130 }
11131 }
11132 }
11133
11134 /*
11135 * The group UUID cannot be set by a non-superuser to anything other than
11136 * one of which they are a member or a null GUID (to "unset"
11137 * the group UUID).
11138 * Note that file systems must be prepared to handle the
11139 * null UUID case in a manner appropriate for that file
11140 * system.
11141 */
11142 if (!has_priv_suser) {
11143 if (kauth_guid_equal(&vap->va_guuid, &kauth_null_guid)) {
11144 ismember = 1;
11145 } else if ((error = kauth_cred_ismember_guid(cred, &vap->va_guuid, &ismember)) != 0) {
11146 KAUTH_DEBUG(" ERROR - got %d trying to check group membership", error);
11147 goto out;
11148 }
11149 if (!ismember) {
11150 KAUTH_DEBUG(" ERROR - cannot set supplied group UUID - not a member / null");
11151 error = EPERM;
11152 goto out;
11153 }
11154 }
11155 chgroup = 1;
11156 }
11157 no_guuid_change:
11158
11159 /*
11160 * Compute authorisation for group/ownership changes.
11161 */
11162 if (chowner || chgroup || clear_suid || clear_sgid) {
11163 if (has_priv_suser) {
11164 KAUTH_DEBUG("ATTR - superuser changing file owner/group, requiring immutability check");
11165 required_action |= KAUTH_VNODE_CHECKIMMUTABLE;
11166 } else {
11167 if (chowner) {
11168 KAUTH_DEBUG("ATTR - ownership change, requiring TAKE_OWNERSHIP");
11169 required_action |= KAUTH_VNODE_TAKE_OWNERSHIP;
11170 }
11171 if (chgroup && !chowner) {
11172 KAUTH_DEBUG("ATTR - group change, requiring WRITE_SECURITY");
11173 required_action |= KAUTH_VNODE_WRITE_SECURITY;
11174 }
11175 }
11176
11177 /*
11178 * clear set-uid and set-gid bits. POSIX only requires this for
11179 * non-privileged processes but we do it even for root.
11180 */
11181 if (VATTR_IS_ACTIVE(vap, va_mode)) {
11182 newmode = vap->va_mode;
11183 } else if (VATTR_IS_SUPPORTED(&ova, va_mode)) {
11184 newmode = ova.va_mode;
11185 } else {
11186 KAUTH_DEBUG("CHOWN - trying to change owner but cannot get mode from filesystem to mask setugid bits");
11187 newmode = 0;
11188 }
11189
11190 /* chown always clears setuid/gid bits. An exception is made for
11191 * setattrlist which can set both at the same time: <uid, gid, mode> on a file:
11192 * setattrlist is allowed to set the new mode on the file and change (chown)
11193 * uid/gid.
11194 */
11195 if (newmode & (S_ISUID | S_ISGID)) {
11196 if (!VATTR_IS_ACTIVE(vap, va_mode)) {
11197 KAUTH_DEBUG("CHOWN - masking setugid bits from mode %o to %o",
11198 newmode, newmode & ~(S_ISUID | S_ISGID));
11199 newmode &= ~(S_ISUID | S_ISGID);
11200 }
11201 VATTR_SET(vap, va_mode, newmode);
11202 }
11203 }
11204
11205 /*
11206 * Authorise changes in the ACL.
11207 */
11208 if (VATTR_IS_ACTIVE(vap, va_acl)) {
11209 /* no existing ACL */
11210 if (!VATTR_IS_ACTIVE(&ova, va_acl) || (ova.va_acl == NULL)) {
11211 /* adding an ACL */
11212 if (vap->va_acl != NULL) {
11213 required_action |= KAUTH_VNODE_WRITE_SECURITY;
11214 KAUTH_DEBUG("CHMOD - adding ACL");
11215 }
11216
11217 /* removing an existing ACL */
11218 } else if (vap->va_acl == NULL) {
11219 required_action |= KAUTH_VNODE_WRITE_SECURITY;
11220 KAUTH_DEBUG("CHMOD - removing ACL");
11221
11222 /* updating an existing ACL */
11223 } else {
11224 if (vap->va_acl->acl_entrycount != ova.va_acl->acl_entrycount) {
11225 /* entry count changed, must be different */
11226 required_action |= KAUTH_VNODE_WRITE_SECURITY;
11227 KAUTH_DEBUG("CHMOD - adding/removing ACL entries");
11228 } else if (vap->va_acl->acl_entrycount > 0) {
11229 /* both ACLs have the same ACE count, said count is 1 or more, bitwise compare ACLs */
11230 if (memcmp(&vap->va_acl->acl_ace[0], &ova.va_acl->acl_ace[0],
11231 sizeof(struct kauth_ace) * vap->va_acl->acl_entrycount)) {
11232 required_action |= KAUTH_VNODE_WRITE_SECURITY;
11233 KAUTH_DEBUG("CHMOD - changing ACL entries");
11234 }
11235 }
11236 }
11237 }
11238
11239 /*
11240 * Other attributes that require authorisation.
11241 */
11242 if (VATTR_IS_ACTIVE(vap, va_encoding)) {
11243 required_action |= KAUTH_VNODE_WRITE_ATTRIBUTES;
11244 }
11245
11246 out:
11247 if (VATTR_IS_SUPPORTED(&ova, va_acl) && (ova.va_acl != NULL)) {
11248 kauth_acl_free(ova.va_acl);
11249 }
11250 if (error == 0) {
11251 *actionp = required_action;
11252 }
11253 return error;
11254 }
11255
11256 static int
setlocklocal_callback(struct vnode * vp,__unused void * cargs)11257 setlocklocal_callback(struct vnode *vp, __unused void *cargs)
11258 {
11259 vnode_lock_spin(vp);
11260 vp->v_flag |= VLOCKLOCAL;
11261 vnode_unlock(vp);
11262
11263 return VNODE_RETURNED;
11264 }
11265
11266 void
vfs_setlocklocal(mount_t mp)11267 vfs_setlocklocal(mount_t mp)
11268 {
11269 mount_lock_spin(mp);
11270 mp->mnt_kern_flag |= MNTK_LOCK_LOCAL;
11271 mount_unlock(mp);
11272
11273 /*
11274 * The number of active vnodes is expected to be
11275 * very small when vfs_setlocklocal is invoked.
11276 */
11277 vnode_iterate(mp, 0, setlocklocal_callback, NULL);
11278 }
11279
11280 void
vfs_setcompoundopen(mount_t mp)11281 vfs_setcompoundopen(mount_t mp)
11282 {
11283 mount_lock_spin(mp);
11284 mp->mnt_compound_ops |= COMPOUND_VNOP_OPEN;
11285 mount_unlock(mp);
11286 }
11287
11288 void
vnode_setswapmount(vnode_t vp)11289 vnode_setswapmount(vnode_t vp)
11290 {
11291 mount_lock(vp->v_mount);
11292 vp->v_mount->mnt_kern_flag |= MNTK_SWAP_MOUNT;
11293 mount_unlock(vp->v_mount);
11294 }
11295
11296 void
vfs_setfskit(mount_t mp)11297 vfs_setfskit(mount_t mp)
11298 {
11299 mount_lock_spin(mp);
11300 mp->mnt_kern_flag |= MNTK_FSKIT;
11301 mount_unlock(mp);
11302 }
11303
11304 uint32_t
vfs_getextflags(mount_t mp)11305 vfs_getextflags(mount_t mp)
11306 {
11307 uint32_t flags_ext = 0;
11308
11309 if (mp->mnt_kern_flag & MNTK_SYSTEMDATA) {
11310 flags_ext |= MNT_EXT_ROOT_DATA_VOL;
11311 }
11312 if (mp->mnt_kern_flag & MNTK_FSKIT) {
11313 flags_ext |= MNT_EXT_FSKIT;
11314 }
11315 return flags_ext;
11316 }
11317
11318 char *
vfs_getfstypenameref_locked(mount_t mp,size_t * lenp)11319 vfs_getfstypenameref_locked(mount_t mp, size_t *lenp)
11320 {
11321 char *name;
11322
11323 if (mp->mnt_kern_flag & MNTK_TYPENAME_OVERRIDE) {
11324 name = mp->fstypename_override;
11325 } else {
11326 name = mp->mnt_vfsstat.f_fstypename;
11327 }
11328 if (lenp != NULL) {
11329 *lenp = strlen(name);
11330 }
11331 return name;
11332 }
11333
11334 void
vfs_getfstypename(mount_t mp,char * buf,size_t buflen)11335 vfs_getfstypename(mount_t mp, char *buf, size_t buflen)
11336 {
11337 mount_lock_spin(mp);
11338 strlcpy(buf, vfs_getfstypenameref_locked(mp, NULL), buflen);
11339 mount_unlock(mp);
11340 }
11341
11342 void
vfs_setfstypename_locked(mount_t mp,const char * name)11343 vfs_setfstypename_locked(mount_t mp, const char *name)
11344 {
11345 if (name == NULL || name[0] == '\0') {
11346 mp->mnt_kern_flag &= ~MNTK_TYPENAME_OVERRIDE;
11347 mp->fstypename_override[0] = '\0';
11348 } else {
11349 strlcpy(mp->fstypename_override, name,
11350 sizeof(mp->fstypename_override));
11351 mp->mnt_kern_flag |= MNTK_TYPENAME_OVERRIDE;
11352 }
11353 }
11354
11355 void
vfs_setfstypename(mount_t mp,const char * name)11356 vfs_setfstypename(mount_t mp, const char *name)
11357 {
11358 mount_lock_spin(mp);
11359 vfs_setfstypename_locked(mp, name);
11360 mount_unlock(mp);
11361 }
11362
11363 int64_t
vnode_getswappin_avail(vnode_t vp)11364 vnode_getswappin_avail(vnode_t vp)
11365 {
11366 int64_t max_swappin_avail = 0;
11367
11368 mount_lock(vp->v_mount);
11369 if (vp->v_mount->mnt_ioflags & MNT_IOFLAGS_SWAPPIN_SUPPORTED) {
11370 max_swappin_avail = vp->v_mount->mnt_max_swappin_available;
11371 }
11372 mount_unlock(vp->v_mount);
11373
11374 return max_swappin_avail;
11375 }
11376
11377
11378 void
vn_setunionwait(vnode_t vp)11379 vn_setunionwait(vnode_t vp)
11380 {
11381 vnode_lock_spin(vp);
11382 vp->v_flag |= VISUNION;
11383 vnode_unlock(vp);
11384 }
11385
11386
11387 void
vn_checkunionwait(vnode_t vp)11388 vn_checkunionwait(vnode_t vp)
11389 {
11390 vnode_lock_spin(vp);
11391 while ((vp->v_flag & VISUNION) == VISUNION) {
11392 msleep((caddr_t)&vp->v_flag, &vp->v_lock, 0, 0, 0);
11393 }
11394 vnode_unlock(vp);
11395 }
11396
11397 void
vn_clearunionwait(vnode_t vp,int locked)11398 vn_clearunionwait(vnode_t vp, int locked)
11399 {
11400 if (!locked) {
11401 vnode_lock_spin(vp);
11402 }
11403 if ((vp->v_flag & VISUNION) == VISUNION) {
11404 vp->v_flag &= ~VISUNION;
11405 wakeup((caddr_t)&vp->v_flag);
11406 }
11407 if (!locked) {
11408 vnode_unlock(vp);
11409 }
11410 }
11411
11412 /*
11413 * Removes orphaned apple double files during a rmdir
11414 * Works by:
11415 * 1. vnode_suspend().
11416 * 2. Call VNOP_READDIR() till the end of directory is reached.
11417 * 3. Check if the directory entries returned are regular files with name starting with "._". If not, return ENOTEMPTY.
11418 * 4. Continue (2) and (3) till end of directory is reached.
11419 * 5. If all the entries in the directory were files with "._" name, delete all the files.
11420 * 6. vnode_resume()
11421 * 7. If deletion of all files succeeded, call VNOP_RMDIR() again.
11422 */
11423
11424 errno_t
rmdir_remove_orphaned_appleDouble(vnode_t vp,vfs_context_t ctx,int * restart_flag)11425 rmdir_remove_orphaned_appleDouble(vnode_t vp, vfs_context_t ctx, int * restart_flag)
11426 {
11427 #define UIO_BUFF_SIZE 2048
11428 uio_t auio = NULL;
11429 int eofflag, siz = UIO_BUFF_SIZE, alloc_size = 0, nentries = 0;
11430 int open_flag = 0, full_erase_flag = 0;
11431 UIO_STACKBUF(uio_buf, 1);
11432 char *rbuf = NULL;
11433 void *dir_pos;
11434 void *dir_end;
11435 struct dirent *dp;
11436 errno_t error;
11437
11438 error = vnode_suspend(vp);
11439
11440 /*
11441 * restart_flag is set so that the calling rmdir sleeps and resets
11442 */
11443 if (error == EBUSY) {
11444 *restart_flag = 1;
11445 }
11446 if (error != 0) {
11447 return error;
11448 }
11449
11450 /*
11451 * Prevent dataless fault materialization while we have
11452 * a suspended vnode.
11453 */
11454 uthread_t ut = current_uthread();
11455 bool saved_nodatalessfaults =
11456 (ut->uu_flag & UT_NSPACE_NODATALESSFAULTS) ? true : false;
11457 ut->uu_flag |= UT_NSPACE_NODATALESSFAULTS;
11458
11459 /*
11460 * set up UIO
11461 */
11462 rbuf = kalloc_data(siz, Z_WAITOK);
11463 alloc_size = siz;
11464 if (rbuf) {
11465 auio = uio_createwithbuffer(1, 0, UIO_SYSSPACE, UIO_READ,
11466 &uio_buf[0], sizeof(uio_buf));
11467 }
11468 if (!rbuf || !auio) {
11469 error = ENOMEM;
11470 goto outsc;
11471 }
11472
11473 uio_setoffset(auio, 0);
11474
11475 eofflag = 0;
11476
11477 if ((error = VNOP_OPEN(vp, FREAD, ctx))) {
11478 goto outsc;
11479 } else {
11480 open_flag = 1;
11481 }
11482
11483 /*
11484 * First pass checks if all files are appleDouble files.
11485 */
11486
11487 do {
11488 siz = UIO_BUFF_SIZE;
11489 uio_reset(auio, uio_offset(auio), UIO_SYSSPACE, UIO_READ);
11490 uio_addiov(auio, CAST_USER_ADDR_T(rbuf), UIO_BUFF_SIZE);
11491
11492 if ((error = VNOP_READDIR(vp, auio, 0, &eofflag, &nentries, ctx))) {
11493 goto outsc;
11494 }
11495
11496 if (uio_resid(auio) != 0) {
11497 siz -= uio_resid(auio);
11498 }
11499
11500 /*
11501 * Iterate through directory
11502 */
11503 dir_pos = (void*) rbuf;
11504 dir_end = (void*) (rbuf + siz);
11505 dp = (struct dirent*) (dir_pos);
11506
11507 if (dir_pos == dir_end) {
11508 eofflag = 1;
11509 }
11510
11511 while (dir_pos < dir_end) {
11512 /*
11513 * Check for . and .. as well as directories
11514 */
11515 if (dp->d_ino != 0 &&
11516 !((dp->d_namlen == 1 && dp->d_name[0] == '.') ||
11517 (dp->d_namlen == 2 && dp->d_name[0] == '.' && dp->d_name[1] == '.'))) {
11518 /*
11519 * Check for irregular files and ._ files
11520 * If there is a ._._ file abort the op
11521 */
11522 if (dp->d_namlen < 2 ||
11523 strncmp(dp->d_name, "._", 2) ||
11524 (dp->d_namlen >= 4 && !strncmp(&(dp->d_name[2]), "._", 2))) {
11525 error = ENOTEMPTY;
11526 goto outsc;
11527 }
11528 }
11529 dir_pos = (void*) ((uint8_t*)dir_pos + dp->d_reclen);
11530 dp = (struct dirent*)dir_pos;
11531 }
11532
11533 /*
11534 * workaround for HFS/NFS setting eofflag before end of file
11535 */
11536 if (vp->v_tag == VT_HFS && nentries > 2) {
11537 eofflag = 0;
11538 }
11539
11540 if (vp->v_tag == VT_NFS) {
11541 if (eofflag && !full_erase_flag) {
11542 full_erase_flag = 1;
11543 eofflag = 0;
11544 uio_reset(auio, 0, UIO_SYSSPACE, UIO_READ);
11545 } else if (!eofflag && full_erase_flag) {
11546 full_erase_flag = 0;
11547 }
11548 }
11549 } while (!eofflag);
11550 /*
11551 * If we've made it here all the files in the dir are ._ files.
11552 * We can delete the files even though the node is suspended
11553 * because we are the owner of the file.
11554 */
11555
11556 uio_reset(auio, 0, UIO_SYSSPACE, UIO_READ);
11557 eofflag = 0;
11558 full_erase_flag = 0;
11559
11560 do {
11561 siz = UIO_BUFF_SIZE;
11562 uio_reset(auio, uio_offset(auio), UIO_SYSSPACE, UIO_READ);
11563 uio_addiov(auio, CAST_USER_ADDR_T(rbuf), UIO_BUFF_SIZE);
11564
11565 error = VNOP_READDIR(vp, auio, 0, &eofflag, &nentries, ctx);
11566
11567 if (error != 0) {
11568 goto outsc;
11569 }
11570
11571 if (uio_resid(auio) != 0) {
11572 siz -= uio_resid(auio);
11573 }
11574
11575 /*
11576 * Iterate through directory
11577 */
11578 dir_pos = (void*) rbuf;
11579 dir_end = (void*) (rbuf + siz);
11580 dp = (struct dirent*) dir_pos;
11581
11582 if (dir_pos == dir_end) {
11583 eofflag = 1;
11584 }
11585
11586 while (dir_pos < dir_end) {
11587 /*
11588 * Check for . and .. as well as directories
11589 */
11590 if (dp->d_ino != 0 &&
11591 !((dp->d_namlen == 1 && dp->d_name[0] == '.') ||
11592 (dp->d_namlen == 2 && dp->d_name[0] == '.' && dp->d_name[1] == '.'))
11593 ) {
11594 error = unlink1(ctx, vp,
11595 CAST_USER_ADDR_T(dp->d_name), UIO_SYSSPACE,
11596 VNODE_REMOVE_SKIP_NAMESPACE_EVENT |
11597 VNODE_REMOVE_NO_AUDIT_PATH);
11598
11599 if (error && error != ENOENT) {
11600 goto outsc;
11601 }
11602 }
11603 dir_pos = (void*) ((uint8_t*)dir_pos + dp->d_reclen);
11604 dp = (struct dirent*)dir_pos;
11605 }
11606
11607 /*
11608 * workaround for HFS/NFS setting eofflag before end of file
11609 */
11610 if (vp->v_tag == VT_HFS && nentries > 2) {
11611 eofflag = 0;
11612 }
11613
11614 if (vp->v_tag == VT_NFS) {
11615 if (eofflag && !full_erase_flag) {
11616 full_erase_flag = 1;
11617 eofflag = 0;
11618 uio_reset(auio, 0, UIO_SYSSPACE, UIO_READ);
11619 } else if (!eofflag && full_erase_flag) {
11620 full_erase_flag = 0;
11621 }
11622 }
11623 } while (!eofflag);
11624
11625
11626 error = 0;
11627
11628 outsc:
11629 if (open_flag) {
11630 VNOP_CLOSE(vp, FREAD, ctx);
11631 }
11632
11633 if (auio) {
11634 uio_free(auio);
11635 }
11636 kfree_data(rbuf, alloc_size);
11637
11638 if (saved_nodatalessfaults == false) {
11639 ut->uu_flag &= ~UT_NSPACE_NODATALESSFAULTS;
11640 }
11641
11642 vnode_resume(vp);
11643
11644 return error;
11645 }
11646
11647
11648 void
lock_vnode_and_post(vnode_t vp,int kevent_num)11649 lock_vnode_and_post(vnode_t vp, int kevent_num)
11650 {
11651 /* Only take the lock if there's something there! */
11652 if (vp->v_knotes.slh_first != NULL) {
11653 vnode_lock(vp);
11654 KNOTE(&vp->v_knotes, kevent_num);
11655 vnode_unlock(vp);
11656 }
11657 }
11658
11659 void panic_print_vnodes(void);
11660
11661 /* define PANIC_PRINTS_VNODES only if investigation is required. */
11662 #ifdef PANIC_PRINTS_VNODES
11663
11664 static const char *
__vtype(uint16_t vtype)11665 __vtype(uint16_t vtype)
11666 {
11667 switch (vtype) {
11668 case VREG:
11669 return "R";
11670 case VDIR:
11671 return "D";
11672 case VBLK:
11673 return "B";
11674 case VCHR:
11675 return "C";
11676 case VLNK:
11677 return "L";
11678 case VSOCK:
11679 return "S";
11680 case VFIFO:
11681 return "F";
11682 case VBAD:
11683 return "x";
11684 case VSTR:
11685 return "T";
11686 case VCPLX:
11687 return "X";
11688 default:
11689 return "?";
11690 }
11691 }
11692
11693 /*
11694 * build a path from the bottom up
11695 * NOTE: called from the panic path - no alloc'ing of memory and no locks!
11696 */
11697 static char *
__vpath(vnode_t vp,char * str,int len,int depth)11698 __vpath(vnode_t vp, char *str, int len, int depth)
11699 {
11700 int vnm_len;
11701 const char *src;
11702 char *dst;
11703
11704 if (len <= 0) {
11705 return str;
11706 }
11707 /* str + len is the start of the string we created */
11708 if (!vp->v_name) {
11709 return str + len;
11710 }
11711
11712 /* follow mount vnodes to get the full path */
11713 if ((vp->v_flag & VROOT)) {
11714 if (vp->v_mount != NULL && vp->v_mount->mnt_vnodecovered) {
11715 return __vpath(vp->v_mount->mnt_vnodecovered,
11716 str, len, depth + 1);
11717 }
11718 return str + len;
11719 }
11720
11721 src = vp->v_name;
11722 vnm_len = strlen(src);
11723 if (vnm_len > len) {
11724 /* truncate the name to fit in the string */
11725 src += (vnm_len - len);
11726 vnm_len = len;
11727 }
11728
11729 /* start from the back and copy just characters (no NULLs) */
11730
11731 /* this will chop off leaf path (file) names */
11732 if (depth > 0) {
11733 dst = str + len - vnm_len;
11734 memcpy(dst, src, vnm_len);
11735 len -= vnm_len;
11736 } else {
11737 dst = str + len;
11738 }
11739
11740 if (vp->v_parent && len > 1) {
11741 /* follow parents up the chain */
11742 len--;
11743 *(dst - 1) = '/';
11744 return __vpath(vp->v_parent, str, len, depth + 1);
11745 }
11746
11747 return dst;
11748 }
11749
11750 #define SANE_VNODE_PRINT_LIMIT 5000
11751 void
panic_print_vnodes(void)11752 panic_print_vnodes(void)
11753 {
11754 mount_t mnt;
11755 vnode_t vp;
11756 int nvnodes = 0;
11757 const char *type;
11758 char *nm;
11759 char vname[257];
11760
11761 paniclog_append_noflush("\n***** VNODES *****\n"
11762 "TYPE UREF ICNT PATH\n");
11763
11764 /* NULL-terminate the path name */
11765 vname[sizeof(vname) - 1] = '\0';
11766
11767 /*
11768 * iterate all vnodelist items in all mounts (mntlist) -> mnt_vnodelist
11769 */
11770 TAILQ_FOREACH(mnt, &mountlist, mnt_list) {
11771 if (!ml_validate_nofault((vm_offset_t)mnt, sizeof(mount_t))) {
11772 paniclog_append_noflush("Unable to iterate the mount list %p - encountered an invalid mount pointer %p \n",
11773 &mountlist, mnt);
11774 break;
11775 }
11776
11777 TAILQ_FOREACH(vp, &mnt->mnt_vnodelist, v_mntvnodes) {
11778 if (!ml_validate_nofault((vm_offset_t)vp, sizeof(vnode_t))) {
11779 paniclog_append_noflush("Unable to iterate the vnode list %p - encountered an invalid vnode pointer %p \n",
11780 &mnt->mnt_vnodelist, vp);
11781 break;
11782 }
11783
11784 if (++nvnodes > SANE_VNODE_PRINT_LIMIT) {
11785 return;
11786 }
11787 type = __vtype(vp->v_type);
11788 nm = __vpath(vp, vname, sizeof(vname) - 1, 0);
11789 paniclog_append_noflush("%s %0d %0d %s\n",
11790 type, vp->v_usecount, vp->v_iocount, nm);
11791 }
11792 }
11793 }
11794
11795 #else /* !PANIC_PRINTS_VNODES */
11796 void
panic_print_vnodes(void)11797 panic_print_vnodes(void)
11798 {
11799 return;
11800 }
11801 #endif
11802
11803
11804 #ifdef CONFIG_IOCOUNT_TRACE
11805 static void
record_iocount_trace_vnode(vnode_t vp,int type)11806 record_iocount_trace_vnode(vnode_t vp, int type)
11807 {
11808 void *stacks[IOCOUNT_TRACE_MAX_FRAMES] = {0};
11809 int idx = vp->v_iocount_trace[type].idx;
11810
11811 if (idx >= IOCOUNT_TRACE_MAX_IDX) {
11812 return;
11813 }
11814
11815 OSBacktrace((void **)&stacks[0], IOCOUNT_TRACE_MAX_FRAMES);
11816
11817 /*
11818 * To save index space, only store the unique backtraces. If dup is found,
11819 * just bump the count and return.
11820 */
11821 for (int i = 0; i < idx; i++) {
11822 if (memcmp(&stacks[0], &vp->v_iocount_trace[type].stacks[i][0],
11823 sizeof(stacks)) == 0) {
11824 vp->v_iocount_trace[type].counts[i]++;
11825 return;
11826 }
11827 }
11828
11829 memcpy(&vp->v_iocount_trace[type].stacks[idx][0], &stacks[0],
11830 sizeof(stacks));
11831 vp->v_iocount_trace[type].counts[idx] = 1;
11832 vp->v_iocount_trace[type].idx++;
11833 }
11834
11835 static void
record_iocount_trace_uthread(vnode_t vp,int count)11836 record_iocount_trace_uthread(vnode_t vp, int count)
11837 {
11838 struct uthread *ut;
11839
11840 ut = current_uthread();
11841 ut->uu_iocount += count;
11842
11843 if (count == 1) {
11844 if (ut->uu_vpindex < 32) {
11845 OSBacktrace((void **)&ut->uu_pcs[ut->uu_vpindex][0], 10);
11846
11847 ut->uu_vps[ut->uu_vpindex] = vp;
11848 ut->uu_vpindex++;
11849 }
11850 }
11851 }
11852
11853 static void
record_vp(vnode_t vp,int count)11854 record_vp(vnode_t vp, int count)
11855 {
11856 if (__probable(bootarg_vnode_iocount_trace == 0 &&
11857 bootarg_uthread_iocount_trace == 0)) {
11858 return;
11859 }
11860
11861 #if CONFIG_TRIGGERS
11862 if (vp->v_resolve) {
11863 return;
11864 }
11865 #endif
11866 if ((vp->v_flag & VSYSTEM)) {
11867 return;
11868 }
11869
11870 if (bootarg_vnode_iocount_trace) {
11871 record_iocount_trace_vnode(vp,
11872 (count > 0) ? IOCOUNT_TRACE_VGET : IOCOUNT_TRACE_VPUT);
11873 }
11874 if (bootarg_uthread_iocount_trace) {
11875 record_iocount_trace_uthread(vp, count);
11876 }
11877 }
11878 #endif /* CONFIG_IOCOUNT_TRACE */
11879
11880 #if CONFIG_TRIGGERS
11881 #define __triggers_unused
11882 #else
11883 #define __triggers_unused __unused
11884 #endif
11885
11886 resolver_result_t
vfs_resolver_result(__triggers_unused uint32_t seq,__triggers_unused enum resolver_status stat,__triggers_unused int aux)11887 vfs_resolver_result(__triggers_unused uint32_t seq, __triggers_unused enum resolver_status stat, __triggers_unused int aux)
11888 {
11889 #if CONFIG_TRIGGERS
11890 /*
11891 * |<--- 32 --->|<--- 28 --->|<- 4 ->|
11892 * sequence auxiliary status
11893 */
11894 return (((uint64_t)seq) << 32) |
11895 (((uint64_t)(aux & 0x0fffffff)) << 4) |
11896 (uint64_t)(stat & 0x0000000F);
11897 #else
11898 return (0x0ULL) | (((uint64_t)ENOTSUP) << 4) | (((uint64_t)RESOLVER_ERROR) & 0xF);
11899 #endif
11900 }
11901
11902 #if CONFIG_TRIGGERS
11903
11904 #define TRIG_DEBUG 0
11905
11906 #if TRIG_DEBUG
11907 #define TRIG_LOG(...) do { printf("%s: ", __FUNCTION__); printf(__VA_ARGS__); } while (0)
11908 #else
11909 #define TRIG_LOG(...)
11910 #endif
11911
11912 /*
11913 * Resolver result functions
11914 */
11915
11916
11917 enum resolver_status
vfs_resolver_status(resolver_result_t result)11918 vfs_resolver_status(resolver_result_t result)
11919 {
11920 /* lower 4 bits is status */
11921 return result & 0x0000000F;
11922 }
11923
11924 uint32_t
vfs_resolver_sequence(resolver_result_t result)11925 vfs_resolver_sequence(resolver_result_t result)
11926 {
11927 /* upper 32 bits is sequence */
11928 return (uint32_t)(result >> 32);
11929 }
11930
11931 int
vfs_resolver_auxiliary(resolver_result_t result)11932 vfs_resolver_auxiliary(resolver_result_t result)
11933 {
11934 /* 28 bits of auxiliary */
11935 return (int)(((uint32_t)(result & 0xFFFFFFF0)) >> 4);
11936 }
11937
11938 /*
11939 * SPI
11940 * Call in for resolvers to update vnode trigger state
11941 */
11942 int
vnode_trigger_update(vnode_t vp,resolver_result_t result)11943 vnode_trigger_update(vnode_t vp, resolver_result_t result)
11944 {
11945 vnode_resolve_t rp;
11946 uint32_t seq;
11947 enum resolver_status stat;
11948
11949 if (vp->v_resolve == NULL) {
11950 return EINVAL;
11951 }
11952
11953 stat = vfs_resolver_status(result);
11954 seq = vfs_resolver_sequence(result);
11955
11956 if ((stat != RESOLVER_RESOLVED) && (stat != RESOLVER_UNRESOLVED)) {
11957 return EINVAL;
11958 }
11959
11960 rp = vp->v_resolve;
11961 lck_mtx_lock(&rp->vr_lock);
11962
11963 if (seq > rp->vr_lastseq) {
11964 if (stat == RESOLVER_RESOLVED) {
11965 rp->vr_flags |= VNT_RESOLVED;
11966 } else {
11967 rp->vr_flags &= ~VNT_RESOLVED;
11968 }
11969
11970 rp->vr_lastseq = seq;
11971 }
11972
11973 lck_mtx_unlock(&rp->vr_lock);
11974
11975 return 0;
11976 }
11977
11978 static int
vnode_resolver_attach(vnode_t vp,vnode_resolve_t rp,boolean_t ref)11979 vnode_resolver_attach(vnode_t vp, vnode_resolve_t rp, boolean_t ref)
11980 {
11981 int error;
11982
11983 vnode_lock_spin(vp);
11984 if (vp->v_resolve != NULL) {
11985 vnode_unlock(vp);
11986 return EINVAL;
11987 } else {
11988 vp->v_resolve = rp;
11989 }
11990 vnode_unlock(vp);
11991
11992 if (ref) {
11993 error = vnode_ref_ext(vp, O_EVTONLY, VNODE_REF_FORCE);
11994 if (error != 0) {
11995 panic("VNODE_REF_FORCE didn't help...");
11996 }
11997 }
11998
11999 return 0;
12000 }
12001
12002 /*
12003 * VFS internal interfaces for vnode triggers
12004 *
12005 * vnode must already have an io count on entry
12006 * v_resolve is stable when io count is non-zero
12007 */
12008 static int
vnode_resolver_create(mount_t mp,vnode_t vp,struct vnode_trigger_param * tinfo,boolean_t external)12009 vnode_resolver_create(mount_t mp, vnode_t vp, struct vnode_trigger_param *tinfo, boolean_t external)
12010 {
12011 vnode_resolve_t rp;
12012 int result;
12013 char byte;
12014
12015 #if 1
12016 /* minimum pointer test (debugging) */
12017 if (tinfo->vnt_data) {
12018 byte = *((char *)tinfo->vnt_data);
12019 }
12020 #endif
12021 rp = kalloc_type(struct vnode_resolve, Z_WAITOK | Z_NOFAIL);
12022
12023 lck_mtx_init(&rp->vr_lock, &trigger_vnode_lck_grp, &trigger_vnode_lck_attr);
12024
12025 rp->vr_resolve_func = tinfo->vnt_resolve_func;
12026 rp->vr_unresolve_func = tinfo->vnt_unresolve_func;
12027 rp->vr_rearm_func = tinfo->vnt_rearm_func;
12028 rp->vr_reclaim_func = tinfo->vnt_reclaim_func;
12029 rp->vr_data = tinfo->vnt_data;
12030 rp->vr_lastseq = 0;
12031 rp->vr_flags = tinfo->vnt_flags & VNT_VALID_MASK;
12032 if (external) {
12033 rp->vr_flags |= VNT_EXTERNAL;
12034 }
12035
12036 result = vnode_resolver_attach(vp, rp, external);
12037 if (result != 0) {
12038 goto out;
12039 }
12040
12041 if (mp) {
12042 OSAddAtomic(1, &mp->mnt_numtriggers);
12043 }
12044
12045 return result;
12046
12047 out:
12048 kfree_type(struct vnode_resolve, rp);
12049 return result;
12050 }
12051
12052 static void
vnode_resolver_release(vnode_resolve_t rp)12053 vnode_resolver_release(vnode_resolve_t rp)
12054 {
12055 /*
12056 * Give them a chance to free any private data
12057 */
12058 if (rp->vr_data && rp->vr_reclaim_func) {
12059 rp->vr_reclaim_func(NULLVP, rp->vr_data);
12060 }
12061
12062 lck_mtx_destroy(&rp->vr_lock, &trigger_vnode_lck_grp);
12063 kfree_type(struct vnode_resolve, rp);
12064 }
12065
12066 /* Called after the vnode has been drained */
12067 static void
vnode_resolver_detach(vnode_t vp)12068 vnode_resolver_detach(vnode_t vp)
12069 {
12070 vnode_resolve_t rp;
12071 mount_t mp;
12072
12073 mp = vnode_mount(vp);
12074
12075 vnode_lock(vp);
12076 rp = vp->v_resolve;
12077 vp->v_resolve = NULL;
12078 vnode_unlock(vp);
12079
12080 if ((rp->vr_flags & VNT_EXTERNAL) != 0) {
12081 vnode_rele_ext(vp, O_EVTONLY, 1);
12082 }
12083
12084 vnode_resolver_release(rp);
12085
12086 /* Keep count of active trigger vnodes per mount */
12087 OSAddAtomic(-1, &mp->mnt_numtriggers);
12088 }
12089
12090 __private_extern__
12091 void
vnode_trigger_rearm(vnode_t vp,vfs_context_t ctx)12092 vnode_trigger_rearm(vnode_t vp, vfs_context_t ctx)
12093 {
12094 vnode_resolve_t rp;
12095 resolver_result_t result;
12096 enum resolver_status status;
12097 uint32_t seq;
12098
12099 if ((vp->v_resolve == NULL) ||
12100 (vp->v_resolve->vr_rearm_func == NULL) ||
12101 (vp->v_resolve->vr_flags & VNT_AUTO_REARM) == 0) {
12102 return;
12103 }
12104
12105 rp = vp->v_resolve;
12106 lck_mtx_lock(&rp->vr_lock);
12107
12108 /*
12109 * Check if VFS initiated this unmount. If so, we'll catch it after the unresolve completes.
12110 */
12111 if (rp->vr_flags & VNT_VFS_UNMOUNTED) {
12112 lck_mtx_unlock(&rp->vr_lock);
12113 return;
12114 }
12115
12116 /* Check if this vnode is already armed */
12117 if ((rp->vr_flags & VNT_RESOLVED) == 0) {
12118 lck_mtx_unlock(&rp->vr_lock);
12119 return;
12120 }
12121
12122 lck_mtx_unlock(&rp->vr_lock);
12123
12124 result = rp->vr_rearm_func(vp, 0, rp->vr_data, ctx);
12125 status = vfs_resolver_status(result);
12126 seq = vfs_resolver_sequence(result);
12127
12128 lck_mtx_lock(&rp->vr_lock);
12129 if (seq > rp->vr_lastseq) {
12130 if (status == RESOLVER_UNRESOLVED) {
12131 rp->vr_flags &= ~VNT_RESOLVED;
12132 }
12133 rp->vr_lastseq = seq;
12134 }
12135 lck_mtx_unlock(&rp->vr_lock);
12136 }
12137
12138 __private_extern__
12139 int
vnode_trigger_resolve(vnode_t vp,struct nameidata * ndp,vfs_context_t ctx)12140 vnode_trigger_resolve(vnode_t vp, struct nameidata *ndp, vfs_context_t ctx)
12141 {
12142 vnode_resolve_t rp;
12143 enum path_operation op;
12144 resolver_result_t result;
12145 enum resolver_status status;
12146 uint32_t seq;
12147
12148 /*
12149 * N.B. we cannot call vfs_context_can_resolve_triggers()
12150 * here because we really only want to suppress that in
12151 * the event the trigger will be resolved by something in
12152 * user-space. Any triggers that are resolved by the kernel
12153 * do not pose a threat of deadlock.
12154 */
12155
12156 /* Only trigger on topmost vnodes */
12157 if ((vp->v_resolve == NULL) ||
12158 (vp->v_resolve->vr_resolve_func == NULL) ||
12159 (vp->v_mountedhere != NULL)) {
12160 return 0;
12161 }
12162
12163 rp = vp->v_resolve;
12164 lck_mtx_lock(&rp->vr_lock);
12165
12166 /* Check if this vnode is already resolved */
12167 if (rp->vr_flags & VNT_RESOLVED) {
12168 lck_mtx_unlock(&rp->vr_lock);
12169 return 0;
12170 }
12171
12172 lck_mtx_unlock(&rp->vr_lock);
12173
12174 #if CONFIG_MACF
12175 if ((rp->vr_flags & VNT_KERN_RESOLVE) == 0) {
12176 /*
12177 * VNT_KERN_RESOLVE indicates this trigger has no parameters
12178 * at the discression of the accessing process other than
12179 * the act of access. All other triggers must be checked
12180 */
12181 int rv = mac_vnode_check_trigger_resolve(ctx, vp, &ndp->ni_cnd);
12182 if (rv != 0) {
12183 return rv;
12184 }
12185 }
12186 #endif
12187
12188 /*
12189 * XXX
12190 * assumes that resolver will not access this trigger vnode (otherwise the kernel will deadlock)
12191 * is there anyway to know this???
12192 * there can also be other legitimate lookups in parallel
12193 *
12194 * XXX - should we call this on a separate thread with a timeout?
12195 *
12196 * XXX - should we use ISLASTCN to pick the op value??? Perhaps only leafs should
12197 * get the richer set and non-leafs should get generic OP_LOOKUP? TBD
12198 */
12199 op = (ndp->ni_op < OP_MAXOP) ? ndp->ni_op: OP_LOOKUP;
12200
12201 result = rp->vr_resolve_func(vp, &ndp->ni_cnd, op, 0, rp->vr_data, ctx);
12202 status = vfs_resolver_status(result);
12203 seq = vfs_resolver_sequence(result);
12204
12205 lck_mtx_lock(&rp->vr_lock);
12206 if (seq > rp->vr_lastseq) {
12207 if (status == RESOLVER_RESOLVED) {
12208 rp->vr_flags |= VNT_RESOLVED;
12209 }
12210 rp->vr_lastseq = seq;
12211 }
12212 lck_mtx_unlock(&rp->vr_lock);
12213
12214 /* On resolver errors, propagate the error back up */
12215 return status == RESOLVER_ERROR ? vfs_resolver_auxiliary(result) : 0;
12216 }
12217
12218 static int
vnode_trigger_unresolve(vnode_t vp,int flags,vfs_context_t ctx)12219 vnode_trigger_unresolve(vnode_t vp, int flags, vfs_context_t ctx)
12220 {
12221 vnode_resolve_t rp;
12222 resolver_result_t result;
12223 enum resolver_status status;
12224 uint32_t seq;
12225
12226 if ((vp->v_resolve == NULL) || (vp->v_resolve->vr_unresolve_func == NULL)) {
12227 return 0;
12228 }
12229
12230 rp = vp->v_resolve;
12231 lck_mtx_lock(&rp->vr_lock);
12232
12233 /* Check if this vnode is already resolved */
12234 if ((rp->vr_flags & VNT_RESOLVED) == 0) {
12235 printf("vnode_trigger_unresolve: not currently resolved\n");
12236 lck_mtx_unlock(&rp->vr_lock);
12237 return 0;
12238 }
12239
12240 rp->vr_flags |= VNT_VFS_UNMOUNTED;
12241
12242 lck_mtx_unlock(&rp->vr_lock);
12243
12244 /*
12245 * XXX
12246 * assumes that resolver will not access this trigger vnode (otherwise the kernel will deadlock)
12247 * there can also be other legitimate lookups in parallel
12248 *
12249 * XXX - should we call this on a separate thread with a timeout?
12250 */
12251
12252 result = rp->vr_unresolve_func(vp, flags, rp->vr_data, ctx);
12253 status = vfs_resolver_status(result);
12254 seq = vfs_resolver_sequence(result);
12255
12256 lck_mtx_lock(&rp->vr_lock);
12257 if (seq > rp->vr_lastseq) {
12258 if (status == RESOLVER_UNRESOLVED) {
12259 rp->vr_flags &= ~VNT_RESOLVED;
12260 }
12261 rp->vr_lastseq = seq;
12262 }
12263 rp->vr_flags &= ~VNT_VFS_UNMOUNTED;
12264 lck_mtx_unlock(&rp->vr_lock);
12265
12266 /* On resolver errors, propagate the error back up */
12267 return status == RESOLVER_ERROR ? vfs_resolver_auxiliary(result) : 0;
12268 }
12269
12270 static int
triggerisdescendant(mount_t mp,mount_t rmp)12271 triggerisdescendant(mount_t mp, mount_t rmp)
12272 {
12273 int match = FALSE;
12274
12275 /*
12276 * walk up vnode covered chain looking for a match
12277 */
12278 name_cache_lock_shared();
12279
12280 while (1) {
12281 vnode_t vp;
12282
12283 /* did we encounter "/" ? */
12284 if (mp->mnt_flag & MNT_ROOTFS) {
12285 break;
12286 }
12287
12288 vp = mp->mnt_vnodecovered;
12289 if (vp == NULLVP) {
12290 break;
12291 }
12292
12293 mp = vp->v_mount;
12294 if (mp == rmp) {
12295 match = TRUE;
12296 break;
12297 }
12298 }
12299
12300 name_cache_unlock();
12301
12302 return match;
12303 }
12304
12305 struct trigger_unmount_info {
12306 vfs_context_t ctx;
12307 mount_t top_mp;
12308 vnode_t trigger_vp;
12309 mount_t trigger_mp;
12310 uint32_t trigger_vid;
12311 int flags;
12312 };
12313
12314 static int
trigger_unmount_callback(mount_t mp,void * arg)12315 trigger_unmount_callback(mount_t mp, void * arg)
12316 {
12317 struct trigger_unmount_info * infop = (struct trigger_unmount_info *)arg;
12318 boolean_t mountedtrigger = FALSE;
12319
12320 /*
12321 * When we encounter the top level mount we're done
12322 */
12323 if (mp == infop->top_mp) {
12324 return VFS_RETURNED_DONE;
12325 }
12326
12327 if ((mp->mnt_vnodecovered == NULL) ||
12328 (vnode_getwithref(mp->mnt_vnodecovered) != 0)) {
12329 return VFS_RETURNED;
12330 }
12331
12332 if ((mp->mnt_vnodecovered->v_mountedhere == mp) &&
12333 (mp->mnt_vnodecovered->v_resolve != NULL) &&
12334 (mp->mnt_vnodecovered->v_resolve->vr_flags & VNT_RESOLVED)) {
12335 mountedtrigger = TRUE;
12336 }
12337 vnode_put(mp->mnt_vnodecovered);
12338
12339 /*
12340 * When we encounter a mounted trigger, check if its under the top level mount
12341 */
12342 if (!mountedtrigger || !triggerisdescendant(mp, infop->top_mp)) {
12343 return VFS_RETURNED;
12344 }
12345
12346 /*
12347 * Process any pending nested mount (now that its not referenced)
12348 */
12349 if ((infop->trigger_vp != NULLVP) &&
12350 (vnode_getwithvid(infop->trigger_vp, infop->trigger_vid) == 0)) {
12351 vnode_t vp = infop->trigger_vp;
12352 int error;
12353
12354 vnode_drop(infop->trigger_vp);
12355 infop->trigger_vp = NULLVP;
12356
12357 if (mp == vp->v_mountedhere) {
12358 vnode_put(vp);
12359 printf("trigger_unmount_callback: unexpected match '%s'\n",
12360 mp->mnt_vfsstat.f_mntonname);
12361 return VFS_RETURNED;
12362 }
12363 if (infop->trigger_mp != vp->v_mountedhere) {
12364 vnode_put(vp);
12365 printf("trigger_unmount_callback: trigger mnt changed! (%p != %p)\n",
12366 infop->trigger_mp, vp->v_mountedhere);
12367 goto savenext;
12368 }
12369
12370 error = vnode_trigger_unresolve(vp, infop->flags, infop->ctx);
12371 vnode_put(vp);
12372 if (error) {
12373 printf("unresolving: '%s', err %d\n",
12374 vp->v_mountedhere ? vp->v_mountedhere->mnt_vfsstat.f_mntonname :
12375 "???", error);
12376 return VFS_RETURNED_DONE; /* stop iteration on errors */
12377 }
12378 } else if (infop->trigger_vp != NULLVP) {
12379 vnode_drop(infop->trigger_vp);
12380 }
12381
12382 savenext:
12383 /*
12384 * We can't call resolver here since we hold a mount iter
12385 * ref on mp so save its covered vp for later processing
12386 */
12387 infop->trigger_vp = mp->mnt_vnodecovered;
12388 if ((infop->trigger_vp != NULLVP) &&
12389 (vnode_getwithref(infop->trigger_vp) == 0)) {
12390 if (infop->trigger_vp->v_mountedhere == mp) {
12391 infop->trigger_vid = infop->trigger_vp->v_id;
12392 vnode_hold(infop->trigger_vp);
12393 infop->trigger_mp = mp;
12394 }
12395 vnode_put(infop->trigger_vp);
12396 }
12397
12398 return VFS_RETURNED;
12399 }
12400
12401 /*
12402 * Attempt to unmount any trigger mounts nested underneath a mount.
12403 * This is a best effort attempt and no retries are performed here.
12404 *
12405 * Note: mp->mnt_rwlock is held exclusively on entry (so be carefull)
12406 */
12407 __private_extern__
12408 void
vfs_nested_trigger_unmounts(mount_t mp,int flags,vfs_context_t ctx)12409 vfs_nested_trigger_unmounts(mount_t mp, int flags, vfs_context_t ctx)
12410 {
12411 struct trigger_unmount_info info;
12412
12413 /* Must have trigger vnodes */
12414 if (mp->mnt_numtriggers == 0) {
12415 return;
12416 }
12417 /* Avoid recursive requests (by checking covered vnode) */
12418 if ((mp->mnt_vnodecovered != NULL) &&
12419 (vnode_getwithref(mp->mnt_vnodecovered) == 0)) {
12420 boolean_t recursive = FALSE;
12421
12422 if ((mp->mnt_vnodecovered->v_mountedhere == mp) &&
12423 (mp->mnt_vnodecovered->v_resolve != NULL) &&
12424 (mp->mnt_vnodecovered->v_resolve->vr_flags & VNT_VFS_UNMOUNTED)) {
12425 recursive = TRUE;
12426 }
12427 vnode_put(mp->mnt_vnodecovered);
12428 if (recursive) {
12429 return;
12430 }
12431 }
12432
12433 /*
12434 * Attempt to unmount any nested trigger mounts (best effort)
12435 */
12436 info.ctx = ctx;
12437 info.top_mp = mp;
12438 info.trigger_vp = NULLVP;
12439 info.trigger_vid = 0;
12440 info.trigger_mp = NULL;
12441 info.flags = flags;
12442
12443 (void) vfs_iterate(VFS_ITERATE_TAIL_FIRST, trigger_unmount_callback, &info);
12444
12445 /*
12446 * Process remaining nested mount (now that its not referenced)
12447 */
12448 if ((info.trigger_vp != NULLVP) &&
12449 (vnode_getwithvid(info.trigger_vp, info.trigger_vid) == 0)) {
12450 vnode_t vp = info.trigger_vp;
12451
12452 if (info.trigger_mp == vp->v_mountedhere) {
12453 (void) vnode_trigger_unresolve(vp, flags, ctx);
12454 }
12455 vnode_put(vp);
12456 vnode_drop(vp);
12457 } else if (info.trigger_vp != NULLVP) {
12458 vnode_drop(info.trigger_vp);
12459 }
12460 }
12461
12462 int
vfs_addtrigger(mount_t mp,const char * relpath,struct vnode_trigger_info * vtip,vfs_context_t ctx)12463 vfs_addtrigger(mount_t mp, const char *relpath, struct vnode_trigger_info *vtip, vfs_context_t ctx)
12464 {
12465 struct nameidata *ndp;
12466 int res;
12467 vnode_t rvp, vp;
12468 struct vnode_trigger_param vtp;
12469
12470 /*
12471 * Must be called for trigger callback, wherein rwlock is held
12472 */
12473 lck_rw_assert(&mp->mnt_rwlock, LCK_RW_ASSERT_HELD);
12474
12475 TRIG_LOG("Adding trigger at %s\n", relpath);
12476 TRIG_LOG("Trying VFS_ROOT\n");
12477
12478 ndp = kalloc_type(struct nameidata, Z_WAITOK | Z_NOFAIL);
12479
12480 /*
12481 * We do a lookup starting at the root of the mountpoint, unwilling
12482 * to cross into other mountpoints.
12483 */
12484 res = VFS_ROOT(mp, &rvp, ctx);
12485 if (res != 0) {
12486 goto out;
12487 }
12488
12489 TRIG_LOG("Trying namei\n");
12490
12491 NDINIT(ndp, LOOKUP, OP_LOOKUP, USEDVP | NOCROSSMOUNT | FOLLOW, UIO_SYSSPACE,
12492 CAST_USER_ADDR_T(relpath), ctx);
12493 ndp->ni_dvp = rvp;
12494 res = namei(ndp);
12495 if (res != 0) {
12496 vnode_put(rvp);
12497 goto out;
12498 }
12499
12500 vp = ndp->ni_vp;
12501 nameidone(ndp);
12502 vnode_put(rvp);
12503
12504 TRIG_LOG("Trying vnode_resolver_create()\n");
12505
12506 /*
12507 * Set up blob. vnode_create() takes a larger structure
12508 * with creation info, and we needed something different
12509 * for this case. One needs to win, or we need to munge both;
12510 * vnode_create() wins.
12511 */
12512 bzero(&vtp, sizeof(vtp));
12513 vtp.vnt_resolve_func = vtip->vti_resolve_func;
12514 vtp.vnt_unresolve_func = vtip->vti_unresolve_func;
12515 vtp.vnt_rearm_func = vtip->vti_rearm_func;
12516 vtp.vnt_reclaim_func = vtip->vti_reclaim_func;
12517 vtp.vnt_reclaim_func = vtip->vti_reclaim_func;
12518 vtp.vnt_data = vtip->vti_data;
12519 vtp.vnt_flags = vtip->vti_flags;
12520
12521 res = vnode_resolver_create(mp, vp, &vtp, TRUE);
12522 vnode_put(vp);
12523 out:
12524 kfree_type(struct nameidata, ndp);
12525 TRIG_LOG("Returning %d\n", res);
12526 return res;
12527 }
12528
12529 #endif /* CONFIG_TRIGGERS */
12530
12531 vm_offset_t
kdebug_vnode(vnode_t vp)12532 kdebug_vnode(vnode_t vp)
12533 {
12534 return VM_KERNEL_ADDRPERM(vp);
12535 }
12536
12537 static int flush_cache_on_write = 0;
12538 SYSCTL_INT(_kern, OID_AUTO, flush_cache_on_write,
12539 CTLFLAG_RW | CTLFLAG_LOCKED, &flush_cache_on_write, 0,
12540 "always flush the drive cache on writes to uncached files");
12541
12542 int
vnode_should_flush_after_write(vnode_t vp,int ioflag)12543 vnode_should_flush_after_write(vnode_t vp, int ioflag)
12544 {
12545 return flush_cache_on_write
12546 && (ISSET(ioflag, IO_NOCACHE) || vnode_isnocache(vp));
12547 }
12548
12549 /*
12550 * sysctl for use by disk I/O tracing tools to get the list of existing
12551 * vnodes' paths
12552 */
12553
12554 #define NPATH_WORDS (MAXPATHLEN / sizeof(unsigned long))
12555 struct vnode_trace_paths_context {
12556 uint64_t count;
12557 /*
12558 * Must be a multiple of 4, then -1, for tracing!
12559 */
12560 unsigned long path[NPATH_WORDS + (4 - (NPATH_WORDS % 4)) - 1];
12561 };
12562
12563 static int
vnode_trace_path_callback(struct vnode * vp,void * vctx)12564 vnode_trace_path_callback(struct vnode *vp, void *vctx)
12565 {
12566 struct vnode_trace_paths_context *ctx = vctx;
12567 size_t path_len = sizeof(ctx->path);
12568
12569 int getpath_len = (int)path_len;
12570 if (vn_getpath(vp, (char *)ctx->path, &getpath_len) == 0) {
12571 /* vn_getpath() NUL-terminates, and len includes the NUL. */
12572 assert(getpath_len >= 0);
12573 path_len = (size_t)getpath_len;
12574
12575 assert(path_len <= sizeof(ctx->path));
12576 kdebug_vfs_lookup((const char *)ctx->path, path_len, vp,
12577 KDBG_VFSLKUP_LOOKUP | KDBG_VFS_LOOKUP_FLAG_NOPROCFILT);
12578
12579 if (++(ctx->count) == 1000) {
12580 thread_yield_to_preemption();
12581 ctx->count = 0;
12582 }
12583 }
12584
12585 return VNODE_RETURNED;
12586 }
12587
12588 static int
vfs_trace_paths_callback(mount_t mp,void * arg)12589 vfs_trace_paths_callback(mount_t mp, void *arg)
12590 {
12591 if (mp->mnt_flag & MNT_LOCAL) {
12592 vnode_iterate(mp, VNODE_ITERATE_ALL, vnode_trace_path_callback, arg);
12593 }
12594
12595 return VFS_RETURNED;
12596 }
12597
12598 static int sysctl_vfs_trace_paths SYSCTL_HANDLER_ARGS {
12599 struct vnode_trace_paths_context ctx;
12600
12601 (void)oidp;
12602 (void)arg1;
12603 (void)arg2;
12604 (void)req;
12605
12606 if (!kauth_cred_issuser(kauth_cred_get())) {
12607 return EPERM;
12608 }
12609
12610 if (!kdebug_enable || !kdebug_debugid_enabled(VFS_LOOKUP)) {
12611 return EINVAL;
12612 }
12613
12614 bzero(&ctx, sizeof(struct vnode_trace_paths_context));
12615
12616 vfs_iterate(0, vfs_trace_paths_callback, &ctx);
12617
12618 return 0;
12619 }
12620
12621 SYSCTL_PROC(_vfs_generic, OID_AUTO, trace_paths, CTLFLAG_RD | CTLFLAG_LOCKED | CTLFLAG_MASKED, NULL, 0, &sysctl_vfs_trace_paths, "-", "trace_paths");
12622
12623 #if CONFIG_FILE_LEASES
12624 #include <IOKit/IOBSD.h>
12625 #include <sys/file_internal.h>
12626
12627 #define FILE_LEASES_ENTITLEMENT "com.apple.private.vfs.file-leases"
12628
12629 static uint32_t lease_break_timeout = 60; /* secs */
12630
12631 #if (DEVELOPMENT || DEBUG)
12632 static int lease_debug = 0;
12633 static int lease_entitlement_override = 0;
12634
12635 SYSCTL_NODE(_vfs, OID_AUTO, lease, CTLFLAG_RW | CTLFLAG_LOCKED, NULL, "vfs lease");
12636 SYSCTL_UINT(_vfs_lease, OID_AUTO, break_timeout, CTLFLAG_RW | CTLFLAG_LOCKED, &lease_break_timeout, 0, "");
12637 SYSCTL_INT(_vfs_lease, OID_AUTO, debug, CTLFLAG_RW | CTLFLAG_LOCKED, &lease_debug, 0, "");
12638 SYSCTL_INT(_vfs_lease, OID_AUTO, entitlement_override, CTLFLAG_RW | CTLFLAG_LOCKED, &lease_entitlement_override, 0, "");
12639
12640 #define LEASEDBG(fmt, args...) \
12641 do { \
12642 if (__improbable(lease_debug)) { \
12643 pid_t cur_pid = proc_getpid(current_proc()); \
12644 printf("%s(%d): " fmt "\n", __func__, cur_pid, ##args); \
12645 } \
12646 } while(0)
12647 #else
12648 #define LEASEDBG(fmt, args...) /**/
12649 #endif /* (DEVELOPMENT || DEBUG) */
12650
12651 static bool
allow_setlease(vfs_context_t ctx)12652 allow_setlease(vfs_context_t ctx)
12653 {
12654 bool entitled;
12655
12656 entitled = IOTaskHasEntitlement(vfs_context_task(ctx),
12657 FILE_LEASES_ENTITLEMENT);
12658
12659 #if (DEVELOPMENT || DEBUG)
12660 if (!entitled) {
12661 entitled = (lease_entitlement_override == 1);
12662 }
12663 #endif
12664
12665 return entitled;
12666 }
12667
12668 static file_lease_t
file_lease_alloc(struct fileglob * fg,int fl_type,pid_t pid)12669 file_lease_alloc(struct fileglob *fg, int fl_type, pid_t pid)
12670 {
12671 file_lease_t fl;
12672
12673 fl = kalloc_type(struct file_lease, Z_WAITOK);
12674 /*
12675 * Duplicated file descriptors created by dup() or fork() would have the
12676 * same 'fileglob' so the lease can be released or modified with the
12677 * duplicated fds. Opening the same file (by either same or different
12678 * process) would have different 'fileglob' so a lease always follows a
12679 * 'fileglob'.
12680 */
12681 fl->fl_fg = fg;
12682 fl->fl_type = fl_type;
12683 fl->fl_pid = pid;
12684 fl->fl_downgrade_start = fl->fl_release_start = 0;
12685
12686 return fl;
12687 }
12688
12689 static void
file_lease_free(file_lease_t fl)12690 file_lease_free(file_lease_t fl)
12691 {
12692 kfree_type(struct file_lease, fl);
12693 }
12694
12695 /*
12696 * A read lease can be placed only on a file/directory that is opened for
12697 * read-only which means no other processes have the file/directory opened in
12698 * read-write/write-only mode or mmap'ed writable.
12699 * A write lease can be placed on a file only if there are no other opens
12700 * for the file.
12701 *
12702 * Needs to be called with vnode's lock held.
12703 */
12704 static int
check_for_open_conflict(vnode_t vp,struct fileglob * fg,int fl_type,int expcounts)12705 check_for_open_conflict(vnode_t vp, struct fileglob *fg, int fl_type,
12706 int expcounts)
12707 {
12708 int error = 0;
12709
12710 if (fl_type == F_RDLCK) {
12711 if (vp->v_writecount > expcounts &&
12712 !(vp->v_writecount == 1 && (fg->fg_flag & FWRITE))) {
12713 error = EAGAIN;
12714 } else if (ubc_is_mapped_writable(vp)) {
12715 error = EAGAIN;
12716 }
12717 } else if (fl_type == F_WRLCK && vp->v_usecount > expcounts) {
12718 error = EAGAIN;
12719 }
12720
12721 return error;
12722 }
12723
12724 /* Needs to be called with vnode's lock held. */
12725 static void
modify_file_lease(vnode_t vp,file_lease_t fl,int new_fl_type,struct fileglob * new_fg)12726 modify_file_lease(vnode_t vp, file_lease_t fl, int new_fl_type,
12727 struct fileglob *new_fg)
12728 {
12729 LEASEDBG("fl %p changing fl_type from %d to %d (flags 0x%x)",
12730 fl, fl->fl_type, new_fl_type, fl->fl_flags);
12731
12732 fl->fl_type = new_fl_type;
12733
12734 /*
12735 * The lease being modified may be using a different file
12736 * descriptor, so usurp the fileglob pointer here. In this
12737 * case the old descriptor no longer holds the lease.
12738 */
12739 if (new_fg != NULL) {
12740 fl->fl_fg = new_fg;
12741 }
12742
12743 if (fl->fl_flags & FL_FLAG_RELEASE_PENDING ||
12744 fl->fl_flags & FL_FLAG_DOWNGRADE_PENDING) {
12745 wakeup(&vp->v_leases);
12746 }
12747 }
12748
12749 static int
acquire_file_lease(vnode_t vp,struct fileglob * fg,int fl_type,int expcounts,vfs_context_t ctx)12750 acquire_file_lease(vnode_t vp, struct fileglob *fg, int fl_type, int expcounts,
12751 vfs_context_t ctx)
12752 {
12753 file_lease_t fl, new_fl, our_fl;
12754 int error;
12755
12756 /* Make sure "expected count" looks sane. */
12757 if (expcounts < 0 || expcounts > OPEN_MAX) {
12758 return EINVAL;
12759 }
12760
12761 new_fl = file_lease_alloc(fg, fl_type, vfs_context_pid(ctx));
12762
12763 vnode_lock(vp);
12764
12765 error = check_for_open_conflict(vp, fg, fl_type, expcounts);
12766 if (error) {
12767 LEASEDBG("open conflict on vp %p type %d writecnt %d usecnt %d "
12768 "fl_type %d expcounts %d",
12769 vp, vp->v_type, vp->v_writecount, vp->v_usecount, fl_type,
12770 expcounts);
12771 goto out;
12772 }
12773
12774 our_fl = NULL;
12775 LIST_FOREACH(fl, &vp->v_leases, fl_link) {
12776 /* Does the existing lease belong to us? */
12777 if (fl->fl_fg == new_fl->fl_fg ||
12778 fl->fl_pid == new_fl->fl_pid) {
12779 our_fl = fl;
12780 continue;
12781 }
12782
12783 /*
12784 * We don't allow placing a new write lease when there is an existing
12785 * read lease that doesn't belong to us. We also don't allow putting
12786 * a new read lease if there is a pending release on the lease.
12787 * Putting a new read lease when there is a pending downgrade on the
12788 * lease is fine as it won't cause lease conflict.
12789 */
12790 if (fl_type == F_WRLCK || fl->fl_flags & FL_FLAG_RELEASE_PENDING) {
12791 break;
12792 }
12793 }
12794
12795 /*
12796 * Found an existing lease that we don't own and it conflicts with the
12797 * new lease.
12798 */
12799 if (fl) {
12800 LEASEDBG("lease conflict on vp %p fl %p fl_type %d cur_fl_type %d",
12801 vp, fl, fl_type, fl->fl_type);
12802 goto out;
12803 }
12804
12805 /* Found an existing lease that we own so just change the type. */
12806 if (our_fl) {
12807 LEASEDBG("replace lease on vp %p fl %p old_fl_type %d new_fl_type %d",
12808 vp, our_fl, our_fl->fl_type, fl_type);
12809
12810 modify_file_lease(vp, our_fl, new_fl->fl_type, new_fl->fl_fg);
12811 goto out;
12812 }
12813
12814 LEASEDBG("acquired lease on vp %p type %d fl %p fl_type %d fg %p",
12815 vp, vp->v_type, new_fl, new_fl->fl_type, new_fl->fl_fg);
12816
12817 LIST_INSERT_HEAD(&vp->v_leases, new_fl, fl_link);
12818 new_fl = NULL;
12819
12820 out:
12821 vnode_unlock(vp);
12822
12823 if (new_fl) {
12824 file_lease_free(new_fl);
12825 }
12826
12827 return error;
12828 }
12829
12830 static int
release_file_lease(vnode_t vp,struct fileglob * fg)12831 release_file_lease(vnode_t vp, struct fileglob *fg)
12832 {
12833 file_lease_t fl, fl_tmp;
12834 int error = 0;
12835
12836 LEASEDBG("request to release lease on vp %p type %d fg %p",
12837 vp, vp->v_type, fg);
12838
12839 vnode_lock(vp);
12840
12841 LIST_FOREACH_SAFE(fl, &vp->v_leases, fl_link, fl_tmp) {
12842 if (fl->fl_fg == fg) {
12843 LEASEDBG("released lease on vp %p fl %p type %d",
12844 vp, fl, fl->fl_type);
12845
12846 LIST_REMOVE(fl, fl_link);
12847 modify_file_lease(vp, fl, F_UNLCK, NULL);
12848 break;
12849 }
12850 }
12851
12852 vnode_unlock(vp);
12853
12854 if (fl) {
12855 file_lease_free(fl);
12856 } else {
12857 error = ENOLCK;
12858 }
12859
12860 return error;
12861 }
12862
12863 /*
12864 * Acquire or release a file lease according to the given type (F_RDLCK,
12865 * F_WRLCK or F_UNLCK).
12866 *
12867 * Returns: 0 Success
12868 * EAGAIN Failed to acquire a file lease due to conflicting opens
12869 * ENOLCK Failed to release a file lease due to lease not found
12870 * EPERM Current task doesn't have the entitlement
12871 */
12872 int
vnode_setlease(vnode_t vp,struct fileglob * fg,int fl_type,int expcounts,vfs_context_t ctx)12873 vnode_setlease(vnode_t vp, struct fileglob *fg, int fl_type, int expcounts,
12874 vfs_context_t ctx)
12875 {
12876 int error;
12877
12878 if (!allow_setlease(ctx)) {
12879 return EPERM;
12880 }
12881
12882 error = (fl_type == F_UNLCK) ? release_file_lease(vp, fg) :
12883 acquire_file_lease(vp, fg, fl_type, expcounts, ctx);
12884
12885 return error;
12886 }
12887
12888 /*
12889 * Retrieve the currently in place lease for the file.
12890 *
12891 * Returns:
12892 * F_RDLCK Read lease
12893 * F_WRLCK Write lease
12894 * F_UNLCK No lease
12895 */
12896 int
vnode_getlease(vnode_t vp)12897 vnode_getlease(vnode_t vp)
12898 {
12899 file_lease_t fl;
12900 int fl_type = F_UNLCK;
12901
12902 vnode_lock(vp);
12903
12904 /*
12905 * There should be only one type of lease in the list as read and write
12906 * leases can't co-exist for the same file.
12907 */
12908 fl = LIST_FIRST(&vp->v_leases);
12909 if (fl) {
12910 fl_type = fl->fl_type;
12911 }
12912
12913 vnode_unlock(vp);
12914
12915 LEASEDBG("vp %p fl %p fl_type %d", vp, fl, fl_type);
12916
12917 return fl_type;
12918 }
12919
12920 /* Must be called with vnode's lock held. */
12921 static bool
check_for_lease_conflict(vnode_t vp,int breaker_fl_type,vfs_context_t ctx)12922 check_for_lease_conflict(vnode_t vp, int breaker_fl_type, vfs_context_t ctx)
12923 {
12924 file_lease_t fl;
12925 pid_t pid = vfs_context_pid(ctx);
12926 bool is_conflict = false;
12927
12928 LIST_FOREACH(fl, &vp->v_leases, fl_link) {
12929 if ((fl->fl_type == F_WRLCK && fl->fl_pid != pid) ||
12930 (breaker_fl_type == F_WRLCK && fl->fl_pid != pid)) {
12931 LEASEDBG("conflict detected on vp %p type %d fl_type %d "
12932 "breaker_fl_type %d",
12933 vp, vp->v_type, fl->fl_type, breaker_fl_type);
12934
12935 is_conflict = true;
12936 break;
12937 }
12938 }
12939
12940 return is_conflict;
12941 }
12942
12943 static uint64_t
absolutetime_elapsed_in_secs(uint64_t start)12944 absolutetime_elapsed_in_secs(uint64_t start)
12945 {
12946 uint64_t elapsed, elapsed_sec;
12947 uint64_t now = mach_absolute_time();
12948
12949 elapsed = now - start;
12950 absolutetime_to_nanoseconds(elapsed, &elapsed_sec);
12951 elapsed_sec /= NSEC_PER_SEC;
12952
12953 return elapsed_sec;
12954 }
12955
12956 /* Must be called with vnode's lock held. */
12957 static void
handle_lease_break_timedout(vnode_t vp)12958 handle_lease_break_timedout(vnode_t vp)
12959 {
12960 file_lease_t fl, fl_tmp;
12961 uint64_t elapsed_sec;
12962
12963 LIST_FOREACH_SAFE(fl, &vp->v_leases, fl_link, fl_tmp) {
12964 if (fl->fl_flags & FL_FLAG_DOWNGRADE_PENDING) {
12965 elapsed_sec = absolutetime_elapsed_in_secs(fl->fl_downgrade_start);
12966
12967 if (elapsed_sec >= lease_break_timeout) {
12968 LEASEDBG("force downgrade on vp %p for fl %p elapsed %llu "
12969 "timeout %u", vp, fl, elapsed_sec, lease_break_timeout);
12970
12971 fl->fl_flags &= ~FL_FLAG_DOWNGRADE_PENDING;
12972 fl->fl_downgrade_start = 0;
12973 modify_file_lease(vp, fl, F_RDLCK, NULL);
12974 continue;
12975 }
12976 }
12977 if (fl->fl_flags & FL_FLAG_RELEASE_PENDING) {
12978 elapsed_sec = absolutetime_elapsed_in_secs(fl->fl_release_start);
12979
12980 if (elapsed_sec >= lease_break_timeout) {
12981 LEASEDBG("force release on vp %p for fl %p elapsed %llu "
12982 "timeout %u", vp, fl, elapsed_sec, lease_break_timeout);
12983
12984 LIST_REMOVE(fl, fl_link);
12985 file_lease_free(fl);
12986 continue;
12987 }
12988 }
12989 }
12990
12991 /* Wakeup the lease breaker(s). */
12992 wakeup(&vp->v_leases);
12993 }
12994
12995 /* Must be called with vnode's lock held. */
12996 static void
wait_for_lease_break(vnode_t vp,int breaker_fl_type,vfs_context_t ctx)12997 wait_for_lease_break(vnode_t vp, int breaker_fl_type, vfs_context_t ctx)
12998 {
12999 file_lease_t fl;
13000 struct timespec ts;
13001 uint64_t elapsed_sec, start_time;
13002 int error;
13003
13004 restart:
13005 fl = LIST_FIRST(&vp->v_leases);
13006 assert(fl);
13007
13008 /*
13009 * In a rare case it is possible that the lease that we are blocked on has
13010 * been released and a new lease has been put in place after we are
13011 * signalled to wake up. In this particular, we would treat it as no
13012 * conflict and proceed. This could only happen for directory leasing.
13013 */
13014 if ((fl->fl_flags & (FL_FLAG_DOWNGRADE_PENDING | FL_FLAG_RELEASE_PENDING)) == 0) {
13015 LEASEDBG("new lease in place on vp %p fl %p fl_type %d "
13016 "breaker_fl_type %d",
13017 vp, fl, fl->fl_type, breaker_fl_type);
13018
13019 return;
13020 }
13021 /*
13022 * Figure out which timer to use for lease break timedout as we could have
13023 * both timers active. If both timers active, pick the one with earliest
13024 * start time.
13025 */
13026 if (fl->fl_release_start) {
13027 if (fl->fl_downgrade_start == 0 ||
13028 fl->fl_downgrade_start < fl->fl_release_start) {
13029 start_time = fl->fl_release_start;
13030 } else {
13031 start_time = fl->fl_downgrade_start;
13032 }
13033 } else {
13034 start_time = fl->fl_downgrade_start;
13035 }
13036 assert(start_time > 0);
13037
13038 elapsed_sec = absolutetime_elapsed_in_secs(start_time);
13039
13040 LEASEDBG("elapsed_sec %llu release_start %llu downgrade_start %llu",
13041 elapsed_sec, fl->fl_release_start, fl->fl_downgrade_start);
13042
13043 ts.tv_sec = (lease_break_timeout > elapsed_sec ?
13044 (lease_break_timeout - elapsed_sec) : 0);
13045 ts.tv_nsec = (ts.tv_sec == 0 ? 1 : 0);
13046 error = msleep(&vp->v_leases, &vp->v_lock, PVFS, __func__, &ts);
13047
13048 if (error == 0 || error != EWOULDBLOCK) {
13049 /*
13050 * Woken up due to lease is released/downgraded by lease holder.
13051 * We don't expect any other error from msleep() beside EWOULDBLOCK.
13052 * Check if there is any further conflicts. If so, then continue to
13053 * wait for the next conflict to resolve.
13054 */
13055 if (check_for_lease_conflict(vp, breaker_fl_type, ctx)) {
13056 goto restart;
13057 }
13058 } else {
13059 /*
13060 * Woken due to lease break timeout expired (EWOULDBLOCK returned).
13061 * Break/downgrade all conflicting leases.
13062 */
13063 handle_lease_break_timedout(vp);
13064
13065 if (check_for_lease_conflict(vp, breaker_fl_type, ctx)) {
13066 goto restart;
13067 }
13068 }
13069 }
13070
13071 /* Must be called with vnode's lock held. */
13072 static void
send_lease_break_event(vnode_t vp,uint32_t event)13073 send_lease_break_event(vnode_t vp, uint32_t event)
13074 {
13075 if (vp->v_knotes.slh_first != NULL) {
13076 KNOTE(&vp->v_knotes, event);
13077 }
13078 }
13079
13080 static bool
is_dataless_file(vnode_t vp,vfs_context_t ctx)13081 is_dataless_file(vnode_t vp, vfs_context_t ctx)
13082 {
13083 struct vnode_attr va;
13084 bool is_dataless = false;
13085 int error;
13086
13087 VATTR_INIT(&va);
13088 VATTR_WANTED(&va, va_flags);
13089
13090 error = vnode_getattr(vp, &va, ctx);
13091 if (!error && (va.va_flags & SF_DATALESS)) {
13092 is_dataless = true;
13093 }
13094
13095 return is_dataless;
13096 }
13097
13098 /*
13099 * Break lease(s) in place for the file when there is conflict.
13100 * This function would return 0 for almost all call sites. The only exception
13101 * is when it is called from open1() with O_NONBLOCK flag and it needs to block
13102 * waiting for the lease conflict(s) to resolve. In this case EWOULDBLOCK is
13103 * returned.
13104 */
13105 int
vnode_breaklease(vnode_t vp,uint32_t oflags,vfs_context_t ctx)13106 vnode_breaklease(vnode_t vp, uint32_t oflags, vfs_context_t ctx)
13107 {
13108 file_lease_t fl;
13109 uint64_t now;
13110 int fl_type;
13111 int error = 0;
13112
13113 vnode_lock(vp);
13114
13115 if (__probable(LIST_EMPTY(&vp->v_leases))) {
13116 goto out_unlock;
13117 }
13118
13119 /* Determine the access mode requested by the lease breaker. */
13120 fl_type = (oflags & (O_WRONLY | O_RDWR | O_CREAT | O_TRUNC)) ? F_WRLCK : F_RDLCK;
13121
13122 /*
13123 * If the lease-breaker is just reading, check that it can break
13124 * leases first. If the lease-breaker is writing, or if the
13125 * context was not specified, we always break.
13126 * We skip lease break if the lease-breaker is dataless manipulator and
13127 * the file is dataless.
13128 */
13129 if ((fl_type == F_RDLCK && !vfs_context_can_break_leases(ctx)) ||
13130 (vfs_context_is_dataless_manipulator(ctx) && (vp->v_type == VREG) &&
13131 is_dataless_file(vp, ctx))) {
13132 goto out_unlock;
13133 }
13134
13135 if (!check_for_lease_conflict(vp, fl_type, ctx)) {
13136 goto out_unlock;
13137 }
13138
13139 now = mach_absolute_time();
13140
13141 LEASEDBG("break lease on vp %p type %d oflags 0x%x cur_time %llu",
13142 vp, vp->v_type, oflags, now);
13143
13144 /*
13145 * We get to this point then this means all lease(s) are conflict and
13146 * we need to send the lease break event to the lease holder(s).
13147 * It is possible that a lease could have both downgrade and release events
13148 * pending triggered by multiple breakers trying to open the file in
13149 * different modes. Both events would have different lease break timers.
13150 * Consider the following case:
13151 * 1. Process A holds the write lease on file X.
13152 * 2. Provess B opens the file X in read-only mode.
13153 * This triggers downgrade lease event to Process A.
13154 * 3. While downgrade is pending, Process C opens the file X in read-write
13155 * mode. This triggers release lease event to Process A.
13156 */
13157 LIST_FOREACH(fl, &vp->v_leases, fl_link) {
13158 if (fl_type == F_WRLCK) {
13159 /* File is opened for writing or truncate. */
13160 if (fl->fl_flags & FL_FLAG_RELEASE_PENDING) {
13161 continue;
13162 }
13163 fl->fl_release_start = now;
13164 fl->fl_flags |= FL_FLAG_RELEASE_PENDING;
13165 send_lease_break_event(vp, NOTE_LEASE_RELEASE);
13166 } else {
13167 /* File is opened for reading. */
13168 if (fl->fl_flags & FL_FLAG_DOWNGRADE_PENDING ||
13169 fl->fl_flags & FL_FLAG_RELEASE_PENDING) {
13170 continue;
13171 }
13172 fl->fl_downgrade_start = now;
13173 fl->fl_flags |= FL_FLAG_DOWNGRADE_PENDING;
13174 send_lease_break_event(vp, NOTE_LEASE_DOWNGRADE);
13175 }
13176 }
13177
13178 /*
13179 * If open is requested with O_NONBLOCK, then we can't block and wait for
13180 * the lease to be released/downgraded. Just bail out with EWOULDBLOCK.
13181 */
13182 if (oflags & O_NONBLOCK) {
13183 error = EWOULDBLOCK;
13184 goto out;
13185 }
13186
13187 wait_for_lease_break(vp, fl_type, ctx);
13188
13189 out:
13190 LEASEDBG("break lease on vp %p oflags 0x%x, error %d", vp, oflags, error);
13191
13192 out_unlock:
13193 vnode_unlock(vp);
13194
13195 return error;
13196 }
13197
13198 /*
13199 * Get parent vnode by parent ID (only for file system that supports
13200 * MNTK_PATH_FROM_ID).
13201 * On success, the parent's vnode is returned with iocount held.
13202 */
13203 static vnode_t
vnode_getparent_byid(vnode_t vp)13204 vnode_getparent_byid(vnode_t vp)
13205 {
13206 struct vnode_attr va;
13207 vnode_t dvp = NULLVP;
13208 vfs_context_t ctx = vfs_context_current();
13209 int error;
13210
13211 if (!(vp->v_mount->mnt_kern_flag & MNTK_PATH_FROM_ID)) {
13212 goto out;
13213 }
13214
13215 VATTR_INIT(&va);
13216 VATTR_WANTED(&va, va_parentid);
13217
13218 /* Get the vnode's parent id from the file system. */
13219 error = vnode_getattr(vp, &va, ctx);
13220 if (error || !VATTR_IS_SUPPORTED(&va, va_parentid)) {
13221 goto out;
13222 }
13223
13224 /*
13225 * Ask the file system for the parent vnode.
13226 * We are ignoring the error here as we don't expect the parent vnode to be
13227 * populated on error.
13228 */
13229 (void)VFS_VGET(vp->v_mount, (ino64_t)va.va_parentid, &dvp, ctx);
13230
13231 out:
13232 return dvp;
13233 }
13234
13235 /*
13236 * Break directory's lease.
13237 * If 'need_parent' is true, then parent is obtained via vnode_getparent() (or
13238 * vnode_getparent_byid()) on the provided 'vp'.
13239 */
13240 void
vnode_breakdirlease(vnode_t vp,bool need_parent,uint32_t oflags)13241 vnode_breakdirlease(vnode_t vp, bool need_parent, uint32_t oflags)
13242 {
13243 vnode_t dvp;
13244
13245 if ((vnode_vtype(vp) != VREG && vnode_vtype(vp) != VDIR) ||
13246 (vp == rootvnode)) {
13247 return;
13248 }
13249
13250 /*
13251 * If parent is not provided, first try to get it from the name cache.
13252 * If failed, then we will attempt to ask the file system for parent vnode.
13253 * This is just a best effort as both attempts could still fail.
13254 */
13255 if (need_parent) {
13256 dvp = vnode_getparent(vp);
13257 if (__improbable(dvp == NULLVP)) {
13258 dvp = vnode_getparent_byid(vp);
13259 }
13260 } else {
13261 dvp = vp;
13262 }
13263
13264 if (__probable(dvp != NULLVP)) {
13265 /* Always break dir leases. */
13266 (void)vnode_breaklease(dvp, oflags, vfs_context_current());
13267 }
13268
13269 if (need_parent && (dvp != NULLVP)) {
13270 vnode_put(dvp);
13271 }
13272 }
13273
13274 /*
13275 * Revoke all lease(s) in place for the file.
13276 * This is called when the vnode is reclaimed.
13277 */
13278 void
vnode_revokelease(vnode_t vp,bool locked)13279 vnode_revokelease(vnode_t vp, bool locked)
13280 {
13281 file_lease_t fl, fl_tmp;
13282 bool need_wakeup = false;
13283
13284 if ((vnode_vtype(vp) != VREG && vnode_vtype(vp) != VDIR)) {
13285 return;
13286 }
13287
13288 if (!locked) {
13289 vnode_lock(vp);
13290 }
13291
13292 LIST_FOREACH_SAFE(fl, &vp->v_leases, fl_link, fl_tmp) {
13293 LIST_REMOVE(fl, fl_link);
13294 file_lease_free(fl);
13295 need_wakeup = true;
13296 }
13297
13298 /* Wakeup any lease breaker(s) that might be currently blocked. */
13299 if (__improbable(need_wakeup)) {
13300 wakeup(&vp->v_leases);
13301 }
13302
13303 if (!locked) {
13304 vnode_unlock(vp);
13305 }
13306 }
13307
13308 #endif /* CONFIG_FILE_LEASES */
13309
13310 errno_t
vnode_rdadvise(vnode_t vp,off_t offset,int len,vfs_context_t ctx)13311 vnode_rdadvise(vnode_t vp, off_t offset, int len, vfs_context_t ctx)
13312 {
13313 struct radvisory ra_struct;
13314
13315 assert(vp);
13316
13317 if (offset < 0 || len < 0) {
13318 return EINVAL;
13319 }
13320
13321 ra_struct.ra_offset = offset;
13322 ra_struct.ra_count = len;
13323
13324 return VNOP_IOCTL(vp, F_RDADVISE, (caddr_t)&ra_struct, 0, ctx);
13325 }
13326