[dragonfly.git] / sys / kern / kern_memio.c

/*-
 * Copyright (c) 1988 University of Utah.
 * Copyright (c) 1982, 1986, 1990 The Regents of the University of California.
 * All rights reserved.
 *
 * This code is derived from software contributed to Berkeley by
 * the Systems Programming Group of the University of Utah Computer
 * Science Department, and code derived from software contributed to
 * Berkeley by William Jolitz.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *	This product includes software developed by the University of
 *	California, Berkeley and its contributors.
 * 4. Neither the name of the University nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 *	from: Utah $Hdr: mem.c 1.13 89/10/08$
 *	from: @(#)mem.c	7.2 (Berkeley) 5/9/91
 * $FreeBSD: src/sys/i386/i386/mem.c,v 1.79.2.9 2003/01/04 22:58:01 njl Exp $
 * $DragonFly: src/sys/kern/kern_memio.c,v 1.32 2008/07/23 16:39:28 dillon Exp $
 */

/*
 * Memory special file
 */

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/buf.h>
#include <sys/conf.h>
#include <sys/fcntl.h>
#include <sys/filio.h>
#include <sys/kernel.h>
#include <sys/malloc.h>
#include <sys/memrange.h>
#include <sys/proc.h>
#include <sys/priv.h>
#include <sys/random.h>
#include <sys/signalvar.h>
#include <sys/signal2.h>
#include <sys/uio.h>
#include <sys/vnode.h>

#include <vm/vm.h>
#include <vm/pmap.h>
#include <vm/vm_extern.h>


static	d_open_t	mmopen;
static	d_close_t	mmclose;
static	d_read_t	mmread;
static	d_write_t	mmwrite;
static	d_ioctl_t	mmioctl;
static	d_mmap_t	memmmap;
static	d_poll_t	mmpoll;

#define CDEV_MAJOR 2
static struct dev_ops mem_ops = {
	{ "mem", CDEV_MAJOR, D_MEM },
	.d_open =	mmopen,
	.d_close =	mmclose,
	.d_read =	mmread,
	.d_write =	mmwrite,
	.d_ioctl =	mmioctl,
	.d_poll =	mmpoll,
	.d_mmap =	memmmap,
};

static int rand_bolt;
static caddr_t	zbuf;

MALLOC_DEFINE(M_MEMDESC, "memdesc", "memory range descriptors");
static int mem_ioctl (cdev_t, u_long, caddr_t, int, struct ucred *);
static int random_ioctl (cdev_t, u_long, caddr_t, int, struct ucred *);

struct mem_range_softc mem_range_softc;


static int
mmopen(struct dev_open_args *ap)
{
	cdev_t dev = ap->a_head.a_dev;
	int error;

	switch (minor(dev)) {
	case 0:
	case 1:
		if (ap->a_oflags & FWRITE) {
			if (securelevel > 0 || kernel_mem_readonly)
				return (EPERM);
		}
		error = 0;
		break;
	case 14:
		error = priv_check_cred(ap->a_cred, PRIV_ROOT, 0);
		if (error != 0)
			break;
		if (securelevel > 0 || kernel_mem_readonly) {
			error = EPERM;
			break;
		}
		error = cpu_set_iopl();
		break;
	default:
		error = 0;
		break;
	}
	return (error);
}

static int
mmclose(struct dev_close_args *ap)
{
	cdev_t dev = ap->a_head.a_dev;
	int error;

	switch (minor(dev)) {
	case 14:
		error = cpu_clr_iopl();
		break;
	default:
		error = 0;
		break;
	}
	return (error);
}


static int
mmrw(cdev_t dev, struct uio *uio, int flags)
{
	int o;
	u_int c, v;
	u_int poolsize;
	struct iovec *iov;
	int error = 0;
	caddr_t buf = NULL;

	while (uio->uio_resid > 0 && error == 0) {
		iov = uio->uio_iov;
		if (iov->iov_len == 0) {
			uio->uio_iov++;
			uio->uio_iovcnt--;
			if (uio->uio_iovcnt < 0)
				panic("mmrw");
			continue;
		}
		switch (minor(dev)) {
		case 0:
			/*
			 * minor device 0 is physical memory, /dev/mem 
			 */
			v = uio->uio_offset;
			v &= ~PAGE_MASK;
			pmap_kenter((vm_offset_t)ptvmmap, v);
			o = (int)uio->uio_offset & PAGE_MASK;
			c = (u_int)(PAGE_SIZE - ((uintptr_t)iov->iov_base & PAGE_MASK));
			c = min(c, (u_int)(PAGE_SIZE - o));
			c = min(c, (u_int)iov->iov_len);
			error = uiomove((caddr_t)&ptvmmap[o], (int)c, uio);
			pmap_kremove((vm_offset_t)ptvmmap);
			continue;

		case 1: {
			/*
			 * minor device 1 is kernel memory, /dev/kmem 
			 */
			vm_offset_t saddr, eaddr;
			int prot;

			c = iov->iov_len;

			/*
			 * Make sure that all of the pages are currently 
			 * resident so that we don't create any zero-fill
			 * pages.
			 */
			saddr = trunc_page(uio->uio_offset);
			eaddr = round_page(uio->uio_offset + c);
			if (saddr > eaddr)
				return EFAULT;

			/*
			 * Make sure the kernel addresses are mapped.
			 * platform_direct_mapped() can be used to bypass
			 * default mapping via the page table (virtual kernels
			 * contain a lot of out-of-band data).
			 */
			prot = VM_PROT_READ;
			if (uio->uio_rw != UIO_READ)
				prot |= VM_PROT_WRITE;
			error = kvm_access_check(saddr, eaddr, prot);
			if (error)
				return (error);
			error = uiomove((caddr_t)(vm_offset_t)uio->uio_offset,
					(int)c, uio);
			continue;
		}
		case 2:
			/*
			 * minor device 2 is EOF/RATHOLE 
			 */
			if (uio->uio_rw == UIO_READ)
				return (0);
			c = iov->iov_len;
			break;
		case 3:
			/*
			 * minor device 3 (/dev/random) is source of filth
			 * on read, seeder on write
			 */
			if (buf == NULL)
				buf = kmalloc(PAGE_SIZE, M_TEMP, M_WAITOK);
			c = min(iov->iov_len, PAGE_SIZE);
			if (uio->uio_rw == UIO_WRITE) {
				error = uiomove(buf, (int)c, uio);
				if (error == 0)
					error = add_buffer_randomness(buf, c);
			} else {
				poolsize = read_random(buf, c);
				if (poolsize == 0) {
					if (buf)
						kfree(buf, M_TEMP);
					if ((flags & IO_NDELAY) != 0)
						return (EWOULDBLOCK);
					return (0);
				}
				c = min(c, poolsize);
				error = uiomove(buf, (int)c, uio);
			}
			continue;
		case 4:
			/*
			 * minor device 4 (/dev/urandom) is source of muck
			 * on read, writes are disallowed.
			 */
			c = min(iov->iov_len, PAGE_SIZE);
			if (uio->uio_rw == UIO_WRITE) {
				error = EPERM;
				break;
			}
			if (CURSIG(curthread->td_lwp) != 0) {
				/*
				 * Use tsleep() to get the error code right.
				 * It should return immediately.
				 */
				error = tsleep(&rand_bolt, PCATCH, "urand", 1);
				if (error != 0 && error != EWOULDBLOCK)
					continue;
			}
			if (buf == NULL)
				buf = kmalloc(PAGE_SIZE, M_TEMP, M_WAITOK);
			poolsize = read_random_unlimited(buf, c);
			c = min(c, poolsize);
			error = uiomove(buf, (int)c, uio);
			continue;
		case 12:
			/*
			 * minor device 12 (/dev/zero) is source of nulls 
			 * on read, write are disallowed.
			 */
			if (uio->uio_rw == UIO_WRITE) {
				c = iov->iov_len;
				break;
			}
			if (zbuf == NULL) {
				zbuf = (caddr_t)kmalloc(PAGE_SIZE, M_TEMP,
				    M_WAITOK | M_ZERO);
			}
			c = min(iov->iov_len, PAGE_SIZE);
			error = uiomove(zbuf, (int)c, uio);
			continue;
		default:
			return (ENODEV);
		}
		if (error)
			break;
		iov->iov_base = (char *)iov->iov_base + c;
		iov->iov_len -= c;
		uio->uio_offset += c;
		uio->uio_resid -= c;
	}
	if (buf)
		kfree(buf, M_TEMP);
	return (error);
}

static int
mmread(struct dev_read_args *ap)
{
	return(mmrw(ap->a_head.a_dev, ap->a_uio, ap->a_ioflag));
}

static int
mmwrite(struct dev_write_args *ap)
{
	return(mmrw(ap->a_head.a_dev, ap->a_uio, ap->a_ioflag));
}


/*******************************************************\
* allow user processes to MMAP some memory sections	*
* instead of going through read/write			*
\*******************************************************/

static int
memmmap(struct dev_mmap_args *ap)
{
	cdev_t dev = ap->a_head.a_dev;

	switch (minor(dev)) {
	case 0:
		/* 
		 * minor device 0 is physical memory 
		 */
#if defined(__i386__)
        	ap->a_result = i386_btop(ap->a_offset);
#elif defined(__amd64__)
		ap->a_result = amd64_btop(ap->a_offset);
#endif
		return 0;
	case 1:
		/*
		 * minor device 1 is kernel memory 
		 */
#if defined(__i386__)
        	ap->a_result = i386_btop(vtophys(ap->a_offset));
#elif defined(__amd64__)
        	ap->a_result = amd64_btop(vtophys(ap->a_offset));
#endif
		return 0;

	default:
		return EINVAL;
	}
}

static int
mmioctl(struct dev_ioctl_args *ap)
{
	cdev_t dev = ap->a_head.a_dev;

	switch (minor(dev)) {
	case 0:
		return mem_ioctl(dev, ap->a_cmd, ap->a_data,
				 ap->a_fflag, ap->a_cred);
	case 3:
	case 4:
		return random_ioctl(dev, ap->a_cmd, ap->a_data,
				    ap->a_fflag, ap->a_cred);
	}
	return (ENODEV);
}

/*
 * Operations for changing memory attributes.
 *
 * This is basically just an ioctl shim for mem_range_attr_get
 * and mem_range_attr_set.
 */
static int 
mem_ioctl(cdev_t dev, u_long cmd, caddr_t data, int flags, struct ucred *cred)
{
	int nd, error = 0;
	struct mem_range_op *mo = (struct mem_range_op *)data;
	struct mem_range_desc *md;
	
	/* is this for us? */
	if ((cmd != MEMRANGE_GET) &&
	    (cmd != MEMRANGE_SET))
		return (ENOTTY);

	/* any chance we can handle this? */
	if (mem_range_softc.mr_op == NULL)
		return (EOPNOTSUPP);

	/* do we have any descriptors? */
	if (mem_range_softc.mr_ndesc == 0)
		return (ENXIO);

	switch (cmd) {
	case MEMRANGE_GET:
		nd = imin(mo->mo_arg[0], mem_range_softc.mr_ndesc);
		if (nd > 0) {
			md = (struct mem_range_desc *)
				kmalloc(nd * sizeof(struct mem_range_desc),
				       M_MEMDESC, M_WAITOK);
			error = mem_range_attr_get(md, &nd);
			if (!error)
				error = copyout(md, mo->mo_desc, 
					nd * sizeof(struct mem_range_desc));
			kfree(md, M_MEMDESC);
		} else {
			nd = mem_range_softc.mr_ndesc;
		}
		mo->mo_arg[0] = nd;
		break;
		
	case MEMRANGE_SET:
		md = (struct mem_range_desc *)kmalloc(sizeof(struct mem_range_desc),
						    M_MEMDESC, M_WAITOK);
		error = copyin(mo->mo_desc, md, sizeof(struct mem_range_desc));
		/* clamp description string */
		md->mr_owner[sizeof(md->mr_owner) - 1] = 0;
		if (error == 0)
			error = mem_range_attr_set(md, &mo->mo_arg[0]);
		kfree(md, M_MEMDESC);
		break;
	}
	return (error);
}

/*
 * Implementation-neutral, kernel-callable functions for manipulating
 * memory range attributes.
 */
int
mem_range_attr_get(struct mem_range_desc *mrd, int *arg)
{
	/* can we handle this? */
	if (mem_range_softc.mr_op == NULL)
		return (EOPNOTSUPP);

	if (*arg == 0) {
		*arg = mem_range_softc.mr_ndesc;
	} else {
		bcopy(mem_range_softc.mr_desc, mrd, (*arg) * sizeof(struct mem_range_desc));
	}
	return (0);
}

int
mem_range_attr_set(struct mem_range_desc *mrd, int *arg)
{
	/* can we handle this? */
	if (mem_range_softc.mr_op == NULL)
		return (EOPNOTSUPP);

	return (mem_range_softc.mr_op->set(&mem_range_softc, mrd, arg));
}

#ifdef SMP
void
mem_range_AP_init(void)
{
	if (mem_range_softc.mr_op && mem_range_softc.mr_op->initAP)
		return (mem_range_softc.mr_op->initAP(&mem_range_softc));
}
#endif

static int 
random_ioctl(cdev_t dev, u_long cmd, caddr_t data, int flags, struct ucred *cred)
{
	int error;
	int intr;
	
	/*
	 * Even inspecting the state is privileged, since it gives a hint
	 * about how easily the randomness might be guessed.
	 */
	error = 0;

	switch (cmd) {
	/* Really handled in upper layer */
	case FIOASYNC:
		break;
	case MEM_SETIRQ:
		intr = *(int16_t *)data;
		if ((error = priv_check_cred(cred, PRIV_ROOT, 0)) != 0)
			break;
		if (intr < 0 || intr >= MAX_INTS)
			return (EINVAL);
		register_randintr(intr);
		break;
	case MEM_CLEARIRQ:
		intr = *(int16_t *)data;
		if ((error = priv_check_cred(cred, PRIV_ROOT, 0)) != 0)
			break;
		if (intr < 0 || intr >= MAX_INTS)
			return (EINVAL);
		unregister_randintr(intr);
		break;
	case MEM_RETURNIRQ:
		error = ENOTSUP;
		break;
	case MEM_FINDIRQ:
		intr = *(int16_t *)data;
		if ((error = priv_check_cred(cred, PRIV_ROOT, 0)) != 0)
			break;
		if (intr < 0 || intr >= MAX_INTS)
			return (EINVAL);
		intr = next_registered_randintr(intr);
		if (intr == MAX_INTS)
			return (ENOENT);
		*(u_int16_t *)data = intr;
		break;
	default:
		error = ENOTSUP;
		break;
	}
	return (error);
}

int
mmpoll(struct dev_poll_args *ap)
{
	cdev_t dev = ap->a_head.a_dev;
	int revents;

	switch (minor(dev)) {
	case 3:		/* /dev/random */
		revents = random_poll(dev, ap->a_events);
		break;
	case 4:		/* /dev/urandom */
	default:
		revents = seltrue(dev, ap->a_events);
		break;
	}
	ap->a_events = revents;
	return (0);
}

int
iszerodev(cdev_t dev)
{
	return ((major(dev) == mem_ops.head.maj)
	  && minor(dev) == 12);
}

static void
mem_drvinit(void *unused)
{

	/* Initialise memory range handling */
	if (mem_range_softc.mr_op != NULL)
		mem_range_softc.mr_op->init(&mem_range_softc);

	dev_ops_add(&mem_ops, 0xf0, 0);
	make_dev(&mem_ops, 0, UID_ROOT, GID_KMEM, 0640, "mem");
	make_dev(&mem_ops, 1, UID_ROOT, GID_KMEM, 0640, "kmem");
	make_dev(&mem_ops, 2, UID_ROOT, GID_WHEEL, 0666, "null");
	make_dev(&mem_ops, 3, UID_ROOT, GID_WHEEL, 0644, "random");
	make_dev(&mem_ops, 4, UID_ROOT, GID_WHEEL, 0644, "urandom");
	make_dev(&mem_ops, 12, UID_ROOT, GID_WHEEL, 0666, "zero");
	make_dev(&mem_ops, 14, UID_ROOT, GID_WHEEL, 0600, "io");
}

SYSINIT(memdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE+CDEV_MAJOR,mem_drvinit,NULL)
Commit	Line	Data
984263bc MD	1	/*-
	2	* Copyright (c) 1988 University of Utah.
	3	* Copyright (c) 1982, 1986, 1990 The Regents of the University of California.
	4	* All rights reserved.
	5	*
	6	* This code is derived from software contributed to Berkeley by
	7	* the Systems Programming Group of the University of Utah Computer
	8	* Science Department, and code derived from software contributed to
	9	* Berkeley by William Jolitz.
	10	*
	11	* Redistribution and use in source and binary forms, with or without
	12	* modification, are permitted provided that the following conditions
	13	* are met:
	14	* 1. Redistributions of source code must retain the above copyright
	15	* notice, this list of conditions and the following disclaimer.
	16	* 2. Redistributions in binary form must reproduce the above copyright
	17	* notice, this list of conditions and the following disclaimer in the
	18	* documentation and/or other materials provided with the distribution.
	19	* 3. All advertising materials mentioning features or use of this software
	20	* must display the following acknowledgement:
	21	* This product includes software developed by the University of
	22	* California, Berkeley and its contributors.
	23	* 4. Neither the name of the University nor the names of its contributors
	24	* may be used to endorse or promote products derived from this software
	25	* without specific prior written permission.
	26	*
	27	* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
	28	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	29	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	30	* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
	31	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	32	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	33	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	34	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	35	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	36	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	37	* SUCH DAMAGE.
	38	*
	39	* from: Utah $Hdr: mem.c 1.13 89/10/08$
	40	* from: @(#)mem.c 7.2 (Berkeley) 5/9/91
	41	* $FreeBSD: src/sys/i386/i386/mem.c,v 1.79.2.9 2003/01/04 22:58:01 njl Exp $
8d565796	42	* $DragonFly: src/sys/kern/kern_memio.c,v 1.32 2008/07/23 16:39:28 dillon Exp $
984263bc MD	43	*/
	44
	45	/*
	46	* Memory special file
	47	*/
	48
	49	#include <sys/param.h>
	50	#include <sys/systm.h>
	51	#include <sys/buf.h>
	52	#include <sys/conf.h>
	53	#include <sys/fcntl.h>
	54	#include <sys/filio.h>
984263bc MD	55	#include <sys/kernel.h>
	56	#include <sys/malloc.h>
	57	#include <sys/memrange.h>
	58	#include <sys/proc.h>
895c1f85	59	#include <sys/priv.h>
984263bc MD	60	#include <sys/random.h>
984263bc MD	61	#include <sys/signalvar.h>
b1b4e5a6	62	#include <sys/signal2.h>
984263bc MD	63	#include <sys/uio.h>
	64	#include <sys/vnode.h>
	65
984263bc MD	66	#include <vm/vm.h>
	67	#include <vm/pmap.h>
	68	#include <vm/vm_extern.h>
	69
	70
	71	static d_open_t mmopen;
	72	static d_close_t mmclose;
fef8985e MD	73	static d_read_t mmread;
fef8985e MD	74	static d_write_t mmwrite;
984263bc MD	75	static d_ioctl_t mmioctl;
	76	static d_mmap_t memmmap;
	77	static d_poll_t mmpoll;
	78
	79	#define CDEV_MAJOR 2
fef8985e MD	80	static struct dev_ops mem_ops = {
	81	{ "mem", CDEV_MAJOR, D_MEM },
	82	.d_open = mmopen,
	83	.d_close = mmclose,
	84	.d_read = mmread,
	85	.d_write = mmwrite,
	86	.d_ioctl = mmioctl,
	87	.d_poll = mmpoll,
	88	.d_mmap = memmmap,
984263bc MD	89	};
984263bc MD	90
7e071e7a	91	static int rand_bolt;
984263bc MD	92	static caddr_t zbuf;
	93
	94	MALLOC_DEFINE(M_MEMDESC, "memdesc", "memory range descriptors");
b13267a5 MD	95	static int mem_ioctl (cdev_t, u_long, caddr_t, int, struct ucred *);
b13267a5 MD	96	static int random_ioctl (cdev_t, u_long, caddr_t, int, struct ucred *);
984263bc MD	97
	98	struct mem_range_softc mem_range_softc;
	99
	100
	101	static int
fef8985e	102	mmopen(struct dev_open_args *ap)
984263bc	103	{
b13267a5	104	cdev_t dev = ap->a_head.a_dev;
fef8985e	105	int error;
41c20dac	106
984263bc	107	switch (minor(dev)) {
fef8985e MD	108	case 0:
fef8985e MD	109	case 1:
7e42c007 MD	110	if (ap->a_oflags & FWRITE) {
	111	if (securelevel > 0 \|\| kernel_mem_readonly)
	112	return (EPERM);
	113	}
fc26c9f1	114	error = 0;
fef8985e	115	break;
984263bc	116	case 14:
895c1f85	117	error = priv_check_cred(ap->a_cred, PRIV_ROOT, 0);
fef8985e	118	if (error != 0)
fc26c9f1	119	break;
7e42c007	120	if (securelevel > 0 \|\| kernel_mem_readonly) {
fc26c9f1 MD	121	error = EPERM;
	122	break;
	123	}
	124	error = cpu_set_iopl();
984263bc MD	125	break;
984263bc MD	126	default:
fc26c9f1	127	error = 0;
984263bc MD	128	break;
984263bc MD	129	}
fc26c9f1	130	return (error);
984263bc MD	131	}
	132
	133	static int
fef8985e	134	mmclose(struct dev_close_args *ap)
984263bc	135	{
b13267a5	136	cdev_t dev = ap->a_head.a_dev;
fc26c9f1	137	int error;
984263bc MD	138
984263bc MD	139	switch (minor(dev)) {
984263bc	140	case 14:
fc26c9f1	141	error = cpu_clr_iopl();
984263bc MD	142	break;
984263bc MD	143	default:
fc26c9f1	144	error = 0;
984263bc MD	145	break;
984263bc MD	146	}
fc26c9f1	147	return (error);
984263bc MD	148	}
984263bc MD	149
fef8985e	150
984263bc	151	static int
b13267a5	152	mmrw(cdev_t dev, struct uio *uio, int flags)
984263bc	153	{
c9faf524 RG	154	int o;
c9faf524 RG	155	u_int c, v;
984263bc	156	u_int poolsize;
c9faf524	157	struct iovec *iov;
984263bc MD	158	int error = 0;
	159	caddr_t buf = NULL;
	160
	161	while (uio->uio_resid > 0 && error == 0) {
	162	iov = uio->uio_iov;
	163	if (iov->iov_len == 0) {
	164	uio->uio_iov++;
	165	uio->uio_iovcnt--;
	166	if (uio->uio_iovcnt < 0)
	167	panic("mmrw");
	168	continue;
	169	}
	170	switch (minor(dev)) {
984263bc	171	case 0:
207bedb9 MD	172	/*
	173	* minor device 0 is physical memory, /dev/mem
	174	*/
984263bc MD	175	v = uio->uio_offset;
	176	v &= ~PAGE_MASK;
	177	pmap_kenter((vm_offset_t)ptvmmap, v);
	178	o = (int)uio->uio_offset & PAGE_MASK;
973c11b9	179	c = (u_int)(PAGE_SIZE - ((uintptr_t)iov->iov_base & PAGE_MASK));
984263bc MD	180	c = min(c, (u_int)(PAGE_SIZE - o));
	181	c = min(c, (u_int)iov->iov_len);
	182	error = uiomove((caddr_t)&ptvmmap[o], (int)c, uio);
	183	pmap_kremove((vm_offset_t)ptvmmap);
	184	continue;
	185
984263bc	186	case 1: {
207bedb9 MD	187	/*
	188	* minor device 1 is kernel memory, /dev/kmem
	189	*/
c439ad8f	190	vm_offset_t saddr, eaddr;
460426e6 MD	191	int prot;
460426e6 MD	192
984263bc MD	193	c = iov->iov_len;
	194
	195	/*
03debc4a MD	196	* Make sure that all of the pages are currently
	197	* resident so that we don't create any zero-fill
	198	* pages.
984263bc	199	*/
c439ad8f	200	saddr = trunc_page(uio->uio_offset);
984263bc	201	eaddr = round_page(uio->uio_offset + c);
460426e6	202	if (saddr > eaddr)
984263bc	203	return EFAULT;
460426e6 MD	204
	205	/*
	206	* Make sure the kernel addresses are mapped.
	207	* platform_direct_mapped() can be used to bypass
	208	* default mapping via the page table (virtual kernels
	209	* contain a lot of out-of-band data).
	210	*/
	211	prot = VM_PROT_READ;
	212	if (uio->uio_rw != UIO_READ)
	213	prot \|= VM_PROT_WRITE;
	214	error = kvm_access_check(saddr, eaddr, prot);
	215	if (error)
	216	return (error);
	217	error = uiomove((caddr_t)(vm_offset_t)uio->uio_offset,
	218	(int)c, uio);
984263bc MD	219	continue;
984263bc MD	220	}
984263bc	221	case 2:
207bedb9 MD	222	/*
	223	* minor device 2 is EOF/RATHOLE
	224	*/
984263bc MD	225	if (uio->uio_rw == UIO_READ)
	226	return (0);
	227	c = iov->iov_len;
	228	break;
984263bc	229	case 3:
207bedb9 MD	230	/*
207bedb9 MD	231	* minor device 3 (/dev/random) is source of filth
c26b3d4d	232	* on read, seeder on write
207bedb9	233	*/
984263bc	234	if (buf == NULL)
efda3bd0	235	buf = kmalloc(PAGE_SIZE, M_TEMP, M_WAITOK);
984263bc	236	c = min(iov->iov_len, PAGE_SIZE);
c26b3d4d MD	237	if (uio->uio_rw == UIO_WRITE) {
	238	error = uiomove(buf, (int)c, uio);
	239	if (error == 0)
	240	error = add_buffer_randomness(buf, c);
	241	} else {
	242	poolsize = read_random(buf, c);
	243	if (poolsize == 0) {
	244	if (buf)
efda3bd0	245	kfree(buf, M_TEMP);
c26b3d4d MD	246	if ((flags & IO_NDELAY) != 0)
	247	return (EWOULDBLOCK);
	248	return (0);
	249	}
	250	c = min(c, poolsize);
	251	error = uiomove(buf, (int)c, uio);
984263bc	252	}
984263bc	253	continue;
984263bc	254	case 4:
207bedb9 MD	255	/*
207bedb9 MD	256	* minor device 4 (/dev/urandom) is source of muck
c26b3d4d	257	* on read, writes are disallowed.
207bedb9	258	*/
c26b3d4d	259	c = min(iov->iov_len, PAGE_SIZE);
984263bc	260	if (uio->uio_rw == UIO_WRITE) {
c26b3d4d	261	error = EPERM;
984263bc MD	262	break;
984263bc MD	263	}
08f2f1bb	264	if (CURSIG(curthread->td_lwp) != 0) {
984263bc MD	265	/*
	266	* Use tsleep() to get the error code right.
	267	* It should return immediately.
	268	*/
377d4740	269	error = tsleep(&rand_bolt, PCATCH, "urand", 1);
984263bc MD	270	if (error != 0 && error != EWOULDBLOCK)
	271	continue;
	272	}
	273	if (buf == NULL)
efda3bd0	274	buf = kmalloc(PAGE_SIZE, M_TEMP, M_WAITOK);
984263bc MD	275	poolsize = read_random_unlimited(buf, c);
	276	c = min(c, poolsize);
	277	error = uiomove(buf, (int)c, uio);
	278	continue;
984263bc	279	case 12:
207bedb9 MD	280	/*
207bedb9 MD	281	* minor device 12 (/dev/zero) is source of nulls
c26b3d4d	282	* on read, write are disallowed.
207bedb9	283	*/
984263bc MD	284	if (uio->uio_rw == UIO_WRITE) {
	285	c = iov->iov_len;
	286	break;
	287	}
	288	if (zbuf == NULL) {
e7b4468c SW	289	zbuf = (caddr_t)kmalloc(PAGE_SIZE, M_TEMP,
e7b4468c SW	290	M_WAITOK \| M_ZERO);
984263bc MD	291	}
	292	c = min(iov->iov_len, PAGE_SIZE);
	293	error = uiomove(zbuf, (int)c, uio);
	294	continue;
984263bc MD	295	default:
	296	return (ENODEV);
	297	}
	298	if (error)
	299	break;
656849c6	300	iov->iov_base = (char *)iov->iov_base + c;
984263bc MD	301	iov->iov_len -= c;
	302	uio->uio_offset += c;
	303	uio->uio_resid -= c;
	304	}
	305	if (buf)
efda3bd0	306	kfree(buf, M_TEMP);
984263bc MD	307	return (error);
	308	}
	309
fef8985e MD	310	static int
	311	mmread(struct dev_read_args *ap)
	312	{
	313	return(mmrw(ap->a_head.a_dev, ap->a_uio, ap->a_ioflag));
	314	}
	315
	316	static int
	317	mmwrite(struct dev_write_args *ap)
	318	{
	319	return(mmrw(ap->a_head.a_dev, ap->a_uio, ap->a_ioflag));
	320	}
	321
	322
984263bc MD	323
	324
	325
	326	/*******************************************************\
	327	* allow user processes to MMAP some memory sections *
	328	* instead of going through read/write *
	329	\*******************************************************/
fef8985e	330
984263bc	331	static int
fef8985e	332	memmmap(struct dev_mmap_args *ap)
984263bc	333	{
b13267a5	334	cdev_t dev = ap->a_head.a_dev;
984263bc	335
fef8985e	336	switch (minor(dev)) {
984263bc	337	case 0:
fef8985e MD	338	/*
	339	* minor device 0 is physical memory
	340	*/
8d565796	341	#if defined(__i386__)
fef8985e	342	ap->a_result = i386_btop(ap->a_offset);
8d565796 MD	343	#elif defined(__amd64__)
	344	ap->a_result = amd64_btop(ap->a_offset);
	345	#endif
fef8985e	346	return 0;
984263bc	347	case 1:
fef8985e MD	348	/*
	349	* minor device 1 is kernel memory
	350	*/
8d565796	351	#if defined(__i386__)
fef8985e	352	ap->a_result = i386_btop(vtophys(ap->a_offset));
8d565796 MD	353	#elif defined(__amd64__)
	354	ap->a_result = amd64_btop(vtophys(ap->a_offset));
	355	#endif
fef8985e	356	return 0;
984263bc MD	357
984263bc MD	358	default:
fef8985e	359	return EINVAL;
984263bc MD	360	}
	361	}
	362
	363	static int
fef8985e	364	mmioctl(struct dev_ioctl_args *ap)
984263bc	365	{
b13267a5	366	cdev_t dev = ap->a_head.a_dev;
984263bc MD	367
	368	switch (minor(dev)) {
	369	case 0:
fef8985e MD	370	return mem_ioctl(dev, ap->a_cmd, ap->a_data,
fef8985e MD	371	ap->a_fflag, ap->a_cred);
984263bc MD	372	case 3:
984263bc MD	373	case 4:
fef8985e MD	374	return random_ioctl(dev, ap->a_cmd, ap->a_data,
fef8985e MD	375	ap->a_fflag, ap->a_cred);
984263bc MD	376	}
	377	return (ENODEV);
	378	}
	379
	380	/*
	381	* Operations for changing memory attributes.
	382	*
	383	* This is basically just an ioctl shim for mem_range_attr_get
	384	* and mem_range_attr_set.
	385	*/
	386	static int
b13267a5	387	mem_ioctl(cdev_t dev, u_long cmd, caddr_t data, int flags, struct ucred *cred)
984263bc MD	388	{
	389	int nd, error = 0;
	390	struct mem_range_op mo = (struct mem_range_op )data;
	391	struct mem_range_desc *md;
	392
	393	/* is this for us? */
	394	if ((cmd != MEMRANGE_GET) &&
	395	(cmd != MEMRANGE_SET))
	396	return (ENOTTY);
	397
	398	/* any chance we can handle this? */
	399	if (mem_range_softc.mr_op == NULL)
	400	return (EOPNOTSUPP);
	401
	402	/* do we have any descriptors? */
	403	if (mem_range_softc.mr_ndesc == 0)
	404	return (ENXIO);
	405
	406	switch (cmd) {
	407	case MEMRANGE_GET:
	408	nd = imin(mo->mo_arg[0], mem_range_softc.mr_ndesc);
	409	if (nd > 0) {
	410	md = (struct mem_range_desc *)
77652cad	411	kmalloc(nd * sizeof(struct mem_range_desc),
984263bc MD	412	M_MEMDESC, M_WAITOK);
	413	error = mem_range_attr_get(md, &nd);
	414	if (!error)
	415	error = copyout(md, mo->mo_desc,
	416	nd * sizeof(struct mem_range_desc));
efda3bd0	417	kfree(md, M_MEMDESC);
984263bc MD	418	} else {
	419	nd = mem_range_softc.mr_ndesc;
	420	}
	421	mo->mo_arg[0] = nd;
	422	break;
	423
	424	case MEMRANGE_SET:
77652cad	425	md = (struct mem_range_desc *)kmalloc(sizeof(struct mem_range_desc),
984263bc MD	426	M_MEMDESC, M_WAITOK);
	427	error = copyin(mo->mo_desc, md, sizeof(struct mem_range_desc));
	428	/* clamp description string */
	429	md->mr_owner[sizeof(md->mr_owner) - 1] = 0;
	430	if (error == 0)
	431	error = mem_range_attr_set(md, &mo->mo_arg[0]);
efda3bd0	432	kfree(md, M_MEMDESC);
984263bc MD	433	break;
	434	}
	435	return (error);
	436	}
	437
	438	/*
	439	* Implementation-neutral, kernel-callable functions for manipulating
	440	* memory range attributes.
	441	*/
	442	int
f123d5a1	443	mem_range_attr_get(struct mem_range_desc mrd, int arg)
984263bc MD	444	{
	445	/* can we handle this? */
	446	if (mem_range_softc.mr_op == NULL)
	447	return (EOPNOTSUPP);
	448
	449	if (*arg == 0) {
	450	*arg = mem_range_softc.mr_ndesc;
	451	} else {
	452	bcopy(mem_range_softc.mr_desc, mrd, (arg) sizeof(struct mem_range_desc));
	453	}
	454	return (0);
	455	}
	456
	457	int
f123d5a1	458	mem_range_attr_set(struct mem_range_desc mrd, int arg)
984263bc MD	459	{
	460	/* can we handle this? */
	461	if (mem_range_softc.mr_op == NULL)
	462	return (EOPNOTSUPP);
	463
	464	return (mem_range_softc.mr_op->set(&mem_range_softc, mrd, arg));
	465	}
	466
	467	#ifdef SMP
	468	void
	469	mem_range_AP_init(void)
	470	{
	471	if (mem_range_softc.mr_op && mem_range_softc.mr_op->initAP)
	472	return (mem_range_softc.mr_op->initAP(&mem_range_softc));
	473	}
	474	#endif
	475
	476	static int
b13267a5	477	random_ioctl(cdev_t dev, u_long cmd, caddr_t data, int flags, struct ucred *cred)
984263bc	478	{
5f456c40 MD	479	int error;
5f456c40 MD	480	int intr;
984263bc MD	481
984263bc MD	482	/*
984263bc MD	483	* Even inspecting the state is privileged, since it gives a hint
	484	* about how easily the randomness might be guessed.
	485	*/
5f456c40 MD	486	error = 0;
5f456c40 MD	487
984263bc MD	488	switch (cmd) {
	489	/* Really handled in upper layer */
	490	case FIOASYNC:
984263bc MD	491	break;
984263bc MD	492	case MEM_SETIRQ:
5f456c40	493	intr = (int16_t )data;
895c1f85	494	if ((error = priv_check_cred(cred, PRIV_ROOT, 0)) != 0)
984263bc	495	break;
5f456c40 MD	496	if (intr < 0 \|\| intr >= MAX_INTS)
5f456c40 MD	497	return (EINVAL);
7e071e7a	498	register_randintr(intr);
984263bc MD	499	break;
984263bc MD	500	case MEM_CLEARIRQ:
5f456c40	501	intr = (int16_t )data;
895c1f85	502	if ((error = priv_check_cred(cred, PRIV_ROOT, 0)) != 0)
984263bc	503	break;
5f456c40 MD	504	if (intr < 0 \|\| intr >= MAX_INTS)
5f456c40 MD	505	return (EINVAL);
7e071e7a	506	unregister_randintr(intr);
984263bc MD	507	break;
984263bc MD	508	case MEM_RETURNIRQ:
5f456c40 MD	509	error = ENOTSUP;
	510	break;
	511	case MEM_FINDIRQ:
	512	intr = (int16_t )data;
895c1f85	513	if ((error = priv_check_cred(cred, PRIV_ROOT, 0)) != 0)
5f456c40 MD	514	break;
	515	if (intr < 0 \|\| intr >= MAX_INTS)
	516	return (EINVAL);
	517	intr = next_registered_randintr(intr);
	518	if (intr == MAX_INTS)
	519	return (ENOENT);
	520	(u_int16_t )data = intr;
	521	break;
	522	default:
	523	error = ENOTSUP;
984263bc MD	524	break;
984263bc MD	525	}
5f456c40	526	return (error);
984263bc MD	527	}
	528
	529	int
fef8985e	530	mmpoll(struct dev_poll_args *ap)
984263bc	531	{
b13267a5	532	cdev_t dev = ap->a_head.a_dev;
fef8985e MD	533	int revents;
fef8985e MD	534
984263bc MD	535	switch (minor(dev)) {
984263bc MD	536	case 3: /* /dev/random */
fef8985e MD	537	revents = random_poll(dev, ap->a_events);
fef8985e MD	538	break;
984263bc MD	539	case 4: /* /dev/urandom */
984263bc MD	540	default:
fef8985e MD	541	revents = seltrue(dev, ap->a_events);
fef8985e MD	542	break;
984263bc	543	}
fef8985e MD	544	ap->a_events = revents;
fef8985e MD	545	return (0);
984263bc MD	546	}
	547
	548	int
f123d5a1	549	iszerodev(cdev_t dev)
984263bc	550	{
fef8985e	551	return ((major(dev) == mem_ops.head.maj)
984263bc MD	552	&& minor(dev) == 12);
	553	}
	554
	555	static void
	556	mem_drvinit(void *unused)
	557	{
	558
	559	/* Initialise memory range handling */
	560	if (mem_range_softc.mr_op != NULL)
	561	mem_range_softc.mr_op->init(&mem_range_softc);
	562
fef8985e MD	563	dev_ops_add(&mem_ops, 0xf0, 0);
	564	make_dev(&mem_ops, 0, UID_ROOT, GID_KMEM, 0640, "mem");
	565	make_dev(&mem_ops, 1, UID_ROOT, GID_KMEM, 0640, "kmem");
	566	make_dev(&mem_ops, 2, UID_ROOT, GID_WHEEL, 0666, "null");
	567	make_dev(&mem_ops, 3, UID_ROOT, GID_WHEEL, 0644, "random");
	568	make_dev(&mem_ops, 4, UID_ROOT, GID_WHEEL, 0644, "urandom");
	569	make_dev(&mem_ops, 12, UID_ROOT, GID_WHEEL, 0666, "zero");
	570	make_dev(&mem_ops, 14, UID_ROOT, GID_WHEEL, 0600, "io");
984263bc MD	571	}
	572
	573	SYSINIT(memdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE+CDEV_MAJOR,mem_drvinit,NULL)
	574