1 /* 2 * Copyright (c) 2006 The DragonFly Project. All rights reserved. 3 * 4 * This code is derived from software contributed to The DragonFly Project 5 * by Matthew Dillon <dillon@backplane.com> 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in 15 * the documentation and/or other materials provided with the 16 * distribution. 17 * 3. Neither the name of The DragonFly Project nor the names of its 18 * contributors may be used to endorse or promote products derived 19 * from this software without specific, prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 22 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 23 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 24 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 25 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 26 * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING, 27 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 28 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 29 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 30 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 31 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 */ 34 /* 35 * Copyright (c) 1982, 1986, 1991, 1993 36 * The Regents of the University of California. All rights reserved. 37 * (c) UNIX System Laboratories, Inc. 38 * All or some portions of this file are derived from material licensed 39 * to the University of California by American Telephone and Telegraph 40 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 41 * the permission of UNIX System Laboratories, Inc. 42 * 43 * Redistribution and use in source and binary forms, with or without 44 * modification, are permitted provided that the following conditions 45 * are met: 46 * 1. Redistributions of source code must retain the above copyright 47 * notice, this list of conditions and the following disclaimer. 48 * 2. Redistributions in binary form must reproduce the above copyright 49 * notice, this list of conditions and the following disclaimer in the 50 * documentation and/or other materials provided with the distribution. 51 * 3. Neither the name of the University nor the names of its contributors 52 * may be used to endorse or promote products derived from this software 53 * without specific prior written permission. 54 * 55 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 56 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 57 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 58 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 59 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 60 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 61 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 62 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 63 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 64 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 65 * SUCH DAMAGE. 66 * 67 * @(#)kern_resource.c 8.5 (Berkeley) 1/21/94 68 * $FreeBSD: src/sys/kern/kern_resource.c,v 1.55.2.5 2001/11/03 01:41:08 ps Exp $ 69 * $DragonFly: src/sys/kern/kern_plimit.c,v 1.2 2006/09/05 00:55:45 dillon Exp $ 70 */ 71 72 #include <sys/resource.h> 73 #include <sys/spinlock.h> 74 #include <sys/proc.h> 75 #include <sys/file.h> 76 #include <sys/lockf.h> 77 #include <sys/kern_syscall.h> 78 79 #include <vm/vm_param.h> 80 #include <vm/vm.h> 81 #include <vm/vm_map.h> 82 83 #include <machine/pmap.h> 84 85 #include <sys/spinlock2.h> 86 87 static struct plimit *plimit_copy(struct plimit *olimit); 88 static void plimit_exclusive(struct plimit **limitp); 89 90 /* 91 * Initialize proc0's plimit structure. All later plimit structures 92 * are inherited through fork. 93 */ 94 void 95 plimit_init0(struct plimit *limit) 96 { 97 int i; 98 rlim_t lim; 99 100 for (i = 0; i < RLIM_NLIMITS; ++i) { 101 limit->pl_rlimit[i].rlim_cur = RLIM_INFINITY; 102 limit->pl_rlimit[i].rlim_max = RLIM_INFINITY; 103 } 104 limit->pl_rlimit[RLIMIT_NOFILE].rlim_cur = maxfiles; 105 limit->pl_rlimit[RLIMIT_NOFILE].rlim_max = maxfiles; 106 limit->pl_rlimit[RLIMIT_NPROC].rlim_cur = maxproc; 107 limit->pl_rlimit[RLIMIT_NPROC].rlim_max = maxproc; 108 lim = ptoa((rlim_t)vmstats.v_free_count); 109 limit->pl_rlimit[RLIMIT_RSS].rlim_max = lim; 110 limit->pl_rlimit[RLIMIT_MEMLOCK].rlim_max = lim; 111 limit->pl_rlimit[RLIMIT_MEMLOCK].rlim_cur = lim / 3; 112 limit->p_cpulimit = RLIM_INFINITY; 113 limit->p_refcnt = 1; 114 spin_init(&limit->p_spin); 115 } 116 117 /* 118 * Return a plimit for use by a new forked process given the one 119 * contained in the parent process. p_exclusive will be set if 120 * the parent process has more then one thread, requiring a copy. 121 * Otherwise we can just inherit a reference. 122 * 123 * MPSAFE 124 */ 125 struct plimit * 126 plimit_fork(struct plimit *limit) 127 { 128 if (limit->p_exclusive) { 129 limit = plimit_copy(limit); 130 } else { 131 spin_lock_wr(&limit->p_spin); 132 ++limit->p_refcnt; 133 spin_unlock_wr(&limit->p_spin); 134 } 135 return(limit); 136 } 137 138 /* 139 * This routine is called when the second LWP is created for a process. 140 * The process's limit structure must be made exclusive and a copy is 141 * made if necessary. 142 * 143 * If the refcnt is 1 only the LWPs associated with the caller's process 144 * have access to the structure, and since all we do is set the exclusive 145 * but we don't need a spinlock. 146 * 147 * MPSAFE 148 */ 149 static 150 void 151 plimit_exclusive(struct plimit **limitp) 152 { 153 struct plimit *olimit = *limitp; 154 struct plimit *nlimit; 155 156 if (olimit->p_refcnt == 1) { 157 olimit->p_exclusive = 1; 158 } else { 159 nlimit = plimit_copy(olimit); 160 nlimit->p_exclusive = 1; 161 *limitp = nlimit; 162 spin_lock_wr(&olimit->p_spin); 163 if (--olimit->p_refcnt == 0) { 164 spin_unlock_wr(&olimit->p_spin); 165 kfree(olimit, M_SUBPROC); 166 } else { 167 spin_unlock_wr(&olimit->p_spin); 168 } 169 } 170 } 171 172 /* 173 * Return a copy of the passed plimit. The returned copy will have a refcnt 174 * of 1 and p_exclusive will be cleared. 175 * 176 * MPSAFE 177 */ 178 static 179 struct plimit * 180 plimit_copy(struct plimit *olimit) 181 { 182 struct plimit *nlimit; 183 184 nlimit = kmalloc(sizeof(struct plimit), M_SUBPROC, M_WAITOK); 185 186 spin_lock_rd(&olimit->p_spin); 187 *nlimit = *olimit; 188 spin_unlock_rd(&olimit->p_spin); 189 190 spin_init(&nlimit->p_spin); 191 nlimit->p_refcnt = 1; 192 nlimit->p_exclusive = 0; 193 return (nlimit); 194 } 195 196 /* 197 * This routine is called to fixup a proces's p_limit structure prior 198 * to it being modified. If index >= 0 the specified modified is also 199 * made. 200 * 201 * A limit structure is potentially shared only if the process has exactly 202 * one LWP, otherwise it is guarenteed to be exclusive and no copy needs 203 * to be made. This means that we can safely replace *limitp in the copy 204 * case. 205 * 206 * We call plimit_exclusive() to do all the hard work, but the result does 207 * not actually have to be exclusive since the original was not, so just 208 * clear p_exclusive afterwords. 209 * 210 * MPSAFE 211 */ 212 void 213 plimit_modify(struct plimit **limitp, int index, struct rlimit *rlim) 214 { 215 struct plimit *limit = *limitp; 216 217 if (limit->p_exclusive == 0 && limit->p_refcnt > 1) { 218 plimit_exclusive(limitp); 219 limit = *limitp; 220 limit->p_exclusive = 0; 221 } 222 if (index >= 0) { 223 spin_lock_wr(&limit->p_spin); 224 limit->pl_rlimit[index] = *rlim; 225 spin_unlock_wr(&limit->p_spin); 226 } 227 } 228 229 /* 230 * Destroy a process's plimit structure. 231 * 232 * MPSAFE 233 */ 234 void 235 plimit_free(struct plimit **limitp) 236 { 237 struct plimit *limit; 238 239 if ((limit = *limitp) != NULL) { 240 *limitp = NULL; 241 242 spin_lock_wr(&limit->p_spin); 243 if (--limit->p_refcnt == 0) { 244 spin_unlock_wr(&limit->p_spin); 245 kfree(limit, M_SUBPROC); 246 } else { 247 spin_unlock_wr(&limit->p_spin); 248 } 249 } 250 } 251 252 /* 253 * Modify a resource limit (from system call) 254 * 255 * MPSAFE 256 */ 257 int 258 kern_setrlimit(u_int which, struct rlimit *limp) 259 { 260 struct proc *p = curproc; 261 struct plimit *limit; 262 struct rlimit *alimp; 263 int error; 264 265 if (which >= RLIM_NLIMITS) 266 return (EINVAL); 267 268 /* 269 * We will be modifying a resource, make a copy if necessary. 270 */ 271 plimit_modify(&p->p_limit, -1, NULL); 272 limit = p->p_limit; 273 alimp = &limit->pl_rlimit[which]; 274 275 /* 276 * Preserve historical bugs by treating negative limits as unsigned. 277 */ 278 if (limp->rlim_cur < 0) 279 limp->rlim_cur = RLIM_INFINITY; 280 if (limp->rlim_max < 0) 281 limp->rlim_max = RLIM_INFINITY; 282 283 spin_lock_rd(&limit->p_spin); 284 if (limp->rlim_cur > alimp->rlim_max || 285 limp->rlim_max > alimp->rlim_max) { 286 spin_unlock_rd(&limit->p_spin); 287 if ((error = suser_cred(p->p_ucred, PRISON_ROOT))) 288 return (error); 289 } else { 290 spin_unlock_rd(&limit->p_spin); 291 } 292 if (limp->rlim_cur > limp->rlim_max) 293 limp->rlim_cur = limp->rlim_max; 294 295 switch (which) { 296 case RLIMIT_CPU: 297 spin_lock_wr(&limit->p_spin); 298 if (limp->rlim_cur > RLIM_INFINITY / (rlim_t)1000000) 299 limit->p_cpulimit = RLIM_INFINITY; 300 else 301 limit->p_cpulimit = (rlim_t)1000000 * limp->rlim_cur; 302 spin_unlock_wr(&limit->p_spin); 303 break; 304 case RLIMIT_DATA: 305 if (limp->rlim_cur > maxdsiz) 306 limp->rlim_cur = maxdsiz; 307 if (limp->rlim_max > maxdsiz) 308 limp->rlim_max = maxdsiz; 309 break; 310 311 case RLIMIT_STACK: 312 if (limp->rlim_cur > maxssiz) 313 limp->rlim_cur = maxssiz; 314 if (limp->rlim_max > maxssiz) 315 limp->rlim_max = maxssiz; 316 /* 317 * Stack is allocated to the max at exec time with only 318 * "rlim_cur" bytes accessible. If stack limit is going 319 * up make more accessible, if going down make inaccessible. 320 */ 321 spin_lock_rd(&limit->p_spin); 322 if (limp->rlim_cur != alimp->rlim_cur) { 323 vm_offset_t addr; 324 vm_size_t size; 325 vm_prot_t prot; 326 327 if (limp->rlim_cur > alimp->rlim_cur) { 328 prot = VM_PROT_ALL; 329 size = limp->rlim_cur - alimp->rlim_cur; 330 addr = USRSTACK - limp->rlim_cur; 331 } else { 332 prot = VM_PROT_NONE; 333 size = alimp->rlim_cur - limp->rlim_cur; 334 addr = USRSTACK - alimp->rlim_cur; 335 } 336 spin_unlock_rd(&limit->p_spin); 337 addr = trunc_page(addr); 338 size = round_page(size); 339 (void) vm_map_protect(&p->p_vmspace->vm_map, 340 addr, addr+size, prot, FALSE); 341 } else { 342 spin_unlock_rd(&limit->p_spin); 343 } 344 break; 345 346 case RLIMIT_NOFILE: 347 if (limp->rlim_cur > maxfilesperproc) 348 limp->rlim_cur = maxfilesperproc; 349 if (limp->rlim_max > maxfilesperproc) 350 limp->rlim_max = maxfilesperproc; 351 break; 352 353 case RLIMIT_NPROC: 354 if (limp->rlim_cur > maxprocperuid) 355 limp->rlim_cur = maxprocperuid; 356 if (limp->rlim_max > maxprocperuid) 357 limp->rlim_max = maxprocperuid; 358 if (limp->rlim_cur < 1) 359 limp->rlim_cur = 1; 360 if (limp->rlim_max < 1) 361 limp->rlim_max = 1; 362 break; 363 case RLIMIT_POSIXLOCKS: 364 if (limp->rlim_cur > maxposixlocksperuid) 365 limp->rlim_cur = maxposixlocksperuid; 366 if (limp->rlim_max > maxposixlocksperuid) 367 limp->rlim_max = maxposixlocksperuid; 368 break; 369 } 370 spin_lock_wr(&limit->p_spin); 371 *alimp = *limp; 372 spin_unlock_wr(&limit->p_spin); 373 return (0); 374 } 375 376 /* 377 * The rlimit indexed by which is returned in the second argument. 378 * 379 * MPSAFE 380 */ 381 int 382 kern_getrlimit(u_int which, struct rlimit *limp) 383 { 384 struct proc *p = curproc; 385 struct plimit *limit; 386 387 if (which >= RLIM_NLIMITS) 388 return (EINVAL); 389 390 limit = p->p_limit; 391 spin_lock_rd(&limit->p_spin); 392 *limp = p->p_rlimit[which]; 393 spin_unlock_rd(&limit->p_spin); 394 return (0); 395 } 396 397 /* 398 * Determine if the cpu limit has been reached and return an operations 399 * code for the caller to perform. 400 * 401 * MPSAFE 402 */ 403 int 404 plimit_testcpulimit(struct plimit *limit, u_int64_t ttime) 405 { 406 struct rlimit *rlim; 407 int mode; 408 409 mode = PLIMIT_TESTCPU_OK; 410 if (limit->p_cpulimit != RLIM_INFINITY) { 411 spin_lock_rd(&limit->p_spin); 412 if (ttime > limit->p_cpulimit) { 413 rlim = &limit->pl_rlimit[RLIMIT_CPU]; 414 if (ttime / (rlim_t)1000000 >= rlim->rlim_max + 5) { 415 mode = PLIMIT_TESTCPU_KILL; 416 } else { 417 mode = PLIMIT_TESTCPU_XCPU; 418 } 419 } 420 spin_unlock_rd(&limit->p_spin); 421 } 422 return(mode); 423 } 424 425