[dragonfly.git] / sys / kern / kern_memio.c

/*-
 * Copyright (c) 1988 University of Utah.
 * Copyright (c) 1982, 1986, 1990 The Regents of the University of California.
 * All rights reserved.
 *
 * This code is derived from software contributed to Berkeley by
 * the Systems Programming Group of the University of Utah Computer
 * Science Department, and code derived from software contributed to
 * Berkeley by William Jolitz.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *	This product includes software developed by the University of
 *	California, Berkeley and its contributors.
 * 4. Neither the name of the University nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 *	from: Utah $Hdr: mem.c 1.13 89/10/08$
 *	from: @(#)mem.c	7.2 (Berkeley) 5/9/91
 * $FreeBSD: src/sys/i386/i386/mem.c,v 1.79.2.9 2003/01/04 22:58:01 njl Exp $
 * $DragonFly: src/sys/kern/kern_memio.c,v 1.32 2008/07/23 16:39:28 dillon Exp $
 */

/*
 * Memory special file
 */

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/buf.h>
#include <sys/conf.h>
#include <sys/fcntl.h>
#include <sys/filio.h>
#include <sys/kernel.h>
#include <sys/malloc.h>
#include <sys/memrange.h>
#include <sys/proc.h>
#include <sys/priv.h>
#include <sys/random.h>
#include <sys/signalvar.h>
#include <sys/signal2.h>
#include <sys/uio.h>
#include <sys/vnode.h>

#include <vm/vm.h>
#include <vm/pmap.h>
#include <vm/vm_extern.h>


static	d_open_t	mmopen;
static	d_close_t	mmclose;
static	d_read_t	mmread;
static	d_write_t	mmwrite;
static	d_ioctl_t	mmioctl;
static	d_mmap_t	memmmap;
static	d_poll_t	mmpoll;

#define CDEV_MAJOR 2
static struct dev_ops mem_ops = {
	{ "mem", CDEV_MAJOR, D_MEM },
	.d_open =	mmopen,
	.d_close =	mmclose,
	.d_read =	mmread,
	.d_write =	mmwrite,
	.d_ioctl =	mmioctl,
	.d_poll =	mmpoll,
	.d_mmap =	memmmap,
};

static int rand_bolt;
static caddr_t	zbuf;
static cdev_t	zerodev = NULL;

MALLOC_DEFINE(M_MEMDESC, "memdesc", "memory range descriptors");
static int mem_ioctl (cdev_t, u_long, caddr_t, int, struct ucred *);
static int random_ioctl (cdev_t, u_long, caddr_t, int, struct ucred *);

struct mem_range_softc mem_range_softc;


static int
mmopen(struct dev_open_args *ap)
{
	cdev_t dev = ap->a_head.a_dev;
	int error;

	switch (minor(dev)) {
	case 0:
	case 1:
		if (ap->a_oflags & FWRITE) {
			if (securelevel > 0 || kernel_mem_readonly)
				return (EPERM);
		}
		error = 0;
		break;
	case 14:
		error = priv_check_cred(ap->a_cred, PRIV_ROOT, 0);
		if (error != 0)
			break;
		if (securelevel > 0 || kernel_mem_readonly) {
			error = EPERM;
			break;
		}
		error = cpu_set_iopl();
		break;
	default:
		error = 0;
		break;
	}
	return (error);
}

static int
mmclose(struct dev_close_args *ap)
{
	cdev_t dev = ap->a_head.a_dev;
	int error;

	switch (minor(dev)) {
	case 14:
		error = cpu_clr_iopl();
		break;
	default:
		error = 0;
		break;
	}
	return (error);
}


static int
mmrw(cdev_t dev, struct uio *uio, int flags)
{
	int o;
	u_int c, v;
	u_int poolsize;
	struct iovec *iov;
	int error = 0;
	caddr_t buf = NULL;

	while (uio->uio_resid > 0 && error == 0) {
		iov = uio->uio_iov;
		if (iov->iov_len == 0) {
			uio->uio_iov++;
			uio->uio_iovcnt--;
			if (uio->uio_iovcnt < 0)
				panic("mmrw");
			continue;
		}
		switch (minor(dev)) {
		case 0:
			/*
			 * minor device 0 is physical memory, /dev/mem 
			 */
			v = uio->uio_offset;
			v &= ~PAGE_MASK;
			pmap_kenter((vm_offset_t)ptvmmap, v);
			o = (int)uio->uio_offset & PAGE_MASK;
			c = (u_int)(PAGE_SIZE - ((uintptr_t)iov->iov_base & PAGE_MASK));
			c = min(c, (u_int)(PAGE_SIZE - o));
			c = min(c, (u_int)iov->iov_len);
			error = uiomove((caddr_t)&ptvmmap[o], (int)c, uio);
			pmap_kremove((vm_offset_t)ptvmmap);
			continue;

		case 1: {
			/*
			 * minor device 1 is kernel memory, /dev/kmem 
			 */
			vm_offset_t saddr, eaddr;
			int prot;

			c = iov->iov_len;

			/*
			 * Make sure that all of the pages are currently 
			 * resident so that we don't create any zero-fill
			 * pages.
			 */
			saddr = trunc_page(uio->uio_offset);
			eaddr = round_page(uio->uio_offset + c);
			if (saddr > eaddr)
				return EFAULT;

			/*
			 * Make sure the kernel addresses are mapped.
			 * platform_direct_mapped() can be used to bypass
			 * default mapping via the page table (virtual kernels
			 * contain a lot of out-of-band data).
			 */
			prot = VM_PROT_READ;
			if (uio->uio_rw != UIO_READ)
				prot |= VM_PROT_WRITE;
			error = kvm_access_check(saddr, eaddr, prot);
			if (error)
				return (error);
			error = uiomove((caddr_t)(vm_offset_t)uio->uio_offset,
					(int)c, uio);
			continue;
		}
		case 2:
			/*
			 * minor device 2 is EOF/RATHOLE 
			 */
			if (uio->uio_rw == UIO_READ)
				return (0);
			c = iov->iov_len;
			break;
		case 3:
			/*
			 * minor device 3 (/dev/random) is source of filth
			 * on read, seeder on write
			 */
			if (buf == NULL)
				buf = kmalloc(PAGE_SIZE, M_TEMP, M_WAITOK);
			c = min(iov->iov_len, PAGE_SIZE);
			if (uio->uio_rw == UIO_WRITE) {
				error = uiomove(buf, (int)c, uio);
				if (error == 0)
					error = add_buffer_randomness(buf, c);
			} else {
				poolsize = read_random(buf, c);
				if (poolsize == 0) {
					if (buf)
						kfree(buf, M_TEMP);
					if ((flags & IO_NDELAY) != 0)
						return (EWOULDBLOCK);
					return (0);
				}
				c = min(c, poolsize);
				error = uiomove(buf, (int)c, uio);
			}
			continue;
		case 4:
			/*
			 * minor device 4 (/dev/urandom) is source of muck
			 * on read, writes are disallowed.
			 */
			c = min(iov->iov_len, PAGE_SIZE);
			if (uio->uio_rw == UIO_WRITE) {
				error = EPERM;
				break;
			}
			if (CURSIG(curthread->td_lwp) != 0) {
				/*
				 * Use tsleep() to get the error code right.
				 * It should return immediately.
				 */
				error = tsleep(&rand_bolt, PCATCH, "urand", 1);
				if (error != 0 && error != EWOULDBLOCK)
					continue;
			}
			if (buf == NULL)
				buf = kmalloc(PAGE_SIZE, M_TEMP, M_WAITOK);
			poolsize = read_random_unlimited(buf, c);
			c = min(c, poolsize);
			error = uiomove(buf, (int)c, uio);
			continue;
		case 12:
			/*
			 * minor device 12 (/dev/zero) is source of nulls 
			 * on read, write are disallowed.
			 */
			if (uio->uio_rw == UIO_WRITE) {
				c = iov->iov_len;
				break;
			}
			if (zbuf == NULL) {
				zbuf = (caddr_t)kmalloc(PAGE_SIZE, M_TEMP,
				    M_WAITOK | M_ZERO);
			}
			c = min(iov->iov_len, PAGE_SIZE);
			error = uiomove(zbuf, (int)c, uio);
			continue;
		default:
			return (ENODEV);
		}
		if (error)
			break;
		iov->iov_base = (char *)iov->iov_base + c;
		iov->iov_len -= c;
		uio->uio_offset += c;
		uio->uio_resid -= c;
	}
	if (buf)
		kfree(buf, M_TEMP);
	return (error);
}

static int
mmread(struct dev_read_args *ap)
{
	return(mmrw(ap->a_head.a_dev, ap->a_uio, ap->a_ioflag));
}

static int
mmwrite(struct dev_write_args *ap)
{
	return(mmrw(ap->a_head.a_dev, ap->a_uio, ap->a_ioflag));
}


/*******************************************************\
* allow user processes to MMAP some memory sections	*
* instead of going through read/write			*
\*******************************************************/

static int
memmmap(struct dev_mmap_args *ap)
{
	cdev_t dev = ap->a_head.a_dev;

	switch (minor(dev)) {
	case 0:
		/* 
		 * minor device 0 is physical memory 
		 */
#if defined(__i386__)
        	ap->a_result = i386_btop(ap->a_offset);
#elif defined(__x86_64__)
		ap->a_result = x86_64_btop(ap->a_offset);
#endif
		return 0;
	case 1:
		/*
		 * minor device 1 is kernel memory 
		 */
#if defined(__i386__)
        	ap->a_result = i386_btop(vtophys(ap->a_offset));
#elif defined(__x86_64__)
        	ap->a_result = x86_64_btop(vtophys(ap->a_offset));
#endif
		return 0;

	default:
		return EINVAL;
	}
}

static int
mmioctl(struct dev_ioctl_args *ap)
{
	cdev_t dev = ap->a_head.a_dev;

	switch (minor(dev)) {
	case 0:
		return mem_ioctl(dev, ap->a_cmd, ap->a_data,
				 ap->a_fflag, ap->a_cred);
	case 3:
	case 4:
		return random_ioctl(dev, ap->a_cmd, ap->a_data,
				    ap->a_fflag, ap->a_cred);
	}
	return (ENODEV);
}

/*
 * Operations for changing memory attributes.
 *
 * This is basically just an ioctl shim for mem_range_attr_get
 * and mem_range_attr_set.
 */
static int 
mem_ioctl(cdev_t dev, u_long cmd, caddr_t data, int flags, struct ucred *cred)
{
	int nd, error = 0;
	struct mem_range_op *mo = (struct mem_range_op *)data;
	struct mem_range_desc *md;
	
	/* is this for us? */
	if ((cmd != MEMRANGE_GET) &&
	    (cmd != MEMRANGE_SET))
		return (ENOTTY);

	/* any chance we can handle this? */
	if (mem_range_softc.mr_op == NULL)
		return (EOPNOTSUPP);

	/* do we have any descriptors? */
	if (mem_range_softc.mr_ndesc == 0)
		return (ENXIO);

	switch (cmd) {
	case MEMRANGE_GET:
		nd = imin(mo->mo_arg[0], mem_range_softc.mr_ndesc);
		if (nd > 0) {
			md = (struct mem_range_desc *)
				kmalloc(nd * sizeof(struct mem_range_desc),
				       M_MEMDESC, M_WAITOK);
			error = mem_range_attr_get(md, &nd);
			if (!error)
				error = copyout(md, mo->mo_desc, 
					nd * sizeof(struct mem_range_desc));
			kfree(md, M_MEMDESC);
		} else {
			nd = mem_range_softc.mr_ndesc;
		}
		mo->mo_arg[0] = nd;
		break;
		
	case MEMRANGE_SET:
		md = (struct mem_range_desc *)kmalloc(sizeof(struct mem_range_desc),
						    M_MEMDESC, M_WAITOK);
		error = copyin(mo->mo_desc, md, sizeof(struct mem_range_desc));
		/* clamp description string */
		md->mr_owner[sizeof(md->mr_owner) - 1] = 0;
		if (error == 0)
			error = mem_range_attr_set(md, &mo->mo_arg[0]);
		kfree(md, M_MEMDESC);
		break;
	}
	return (error);
}

/*
 * Implementation-neutral, kernel-callable functions for manipulating
 * memory range attributes.
 */
int
mem_range_attr_get(struct mem_range_desc *mrd, int *arg)
{
	/* can we handle this? */
	if (mem_range_softc.mr_op == NULL)
		return (EOPNOTSUPP);

	if (*arg == 0) {
		*arg = mem_range_softc.mr_ndesc;
	} else {
		bcopy(mem_range_softc.mr_desc, mrd, (*arg) * sizeof(struct mem_range_desc));
	}
	return (0);
}

int
mem_range_attr_set(struct mem_range_desc *mrd, int *arg)
{
	/* can we handle this? */
	if (mem_range_softc.mr_op == NULL)
		return (EOPNOTSUPP);

	return (mem_range_softc.mr_op->set(&mem_range_softc, mrd, arg));
}

#ifdef SMP
void
mem_range_AP_init(void)
{
	if (mem_range_softc.mr_op && mem_range_softc.mr_op->initAP)
		return (mem_range_softc.mr_op->initAP(&mem_range_softc));
}
#endif

static int 
random_ioctl(cdev_t dev, u_long cmd, caddr_t data, int flags, struct ucred *cred)
{
	int error;
	int intr;
	
	/*
	 * Even inspecting the state is privileged, since it gives a hint
	 * about how easily the randomness might be guessed.
	 */
	error = 0;

	switch (cmd) {
	/* Really handled in upper layer */
	case FIOASYNC:
		break;
	case MEM_SETIRQ:
		intr = *(int16_t *)data;
		if ((error = priv_check_cred(cred, PRIV_ROOT, 0)) != 0)
			break;
		if (intr < 0 || intr >= MAX_INTS)
			return (EINVAL);
		register_randintr(intr);
		break;
	case MEM_CLEARIRQ:
		intr = *(int16_t *)data;
		if ((error = priv_check_cred(cred, PRIV_ROOT, 0)) != 0)
			break;
		if (intr < 0 || intr >= MAX_INTS)
			return (EINVAL);
		unregister_randintr(intr);
		break;
	case MEM_RETURNIRQ:
		error = ENOTSUP;
		break;
	case MEM_FINDIRQ:
		intr = *(int16_t *)data;
		if ((error = priv_check_cred(cred, PRIV_ROOT, 0)) != 0)
			break;
		if (intr < 0 || intr >= MAX_INTS)
			return (EINVAL);
		intr = next_registered_randintr(intr);
		if (intr == MAX_INTS)
			return (ENOENT);
		*(u_int16_t *)data = intr;
		break;
	default:
		error = ENOTSUP;
		break;
	}
	return (error);
}

int
mmpoll(struct dev_poll_args *ap)
{
	cdev_t dev = ap->a_head.a_dev;
	int revents;

	switch (minor(dev)) {
	case 3:		/* /dev/random */
		revents = random_poll(dev, ap->a_events);
		break;
	case 4:		/* /dev/urandom */
	default:
		revents = seltrue(dev, ap->a_events);
		break;
	}
	ap->a_events = revents;
	return (0);
}

int
iszerodev(cdev_t dev)
{
	return (zerodev == dev);
}

static void
mem_drvinit(void *unused)
{

	/* Initialise memory range handling */
	if (mem_range_softc.mr_op != NULL)
		mem_range_softc.mr_op->init(&mem_range_softc);

	make_dev(&mem_ops, 0, UID_ROOT, GID_KMEM, 0640, "mem");
	make_dev(&mem_ops, 1, UID_ROOT, GID_KMEM, 0640, "kmem");
	make_dev(&mem_ops, 2, UID_ROOT, GID_WHEEL, 0666, "null");
	make_dev(&mem_ops, 3, UID_ROOT, GID_WHEEL, 0644, "random");
	make_dev(&mem_ops, 4, UID_ROOT, GID_WHEEL, 0644, "urandom");
	zerodev = make_dev(&mem_ops, 12, UID_ROOT, GID_WHEEL, 0666, "zero");
	make_dev(&mem_ops, 14, UID_ROOT, GID_WHEEL, 0600, "io");
}

SYSINIT(memdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE+CDEV_MAJOR,mem_drvinit,NULL)
Commit	Line	Data
984263bc MD	1	/*-
	2	* Copyright (c) 1988 University of Utah.
	3	* Copyright (c) 1982, 1986, 1990 The Regents of the University of California.
	4	* All rights reserved.
	5	*
	6	* This code is derived from software contributed to Berkeley by
	7	* the Systems Programming Group of the University of Utah Computer
	8	* Science Department, and code derived from software contributed to
	9	* Berkeley by William Jolitz.
	10	*
	11	* Redistribution and use in source and binary forms, with or without
	12	* modification, are permitted provided that the following conditions
	13	* are met:
	14	* 1. Redistributions of source code must retain the above copyright
	15	* notice, this list of conditions and the following disclaimer.
	16	* 2. Redistributions in binary form must reproduce the above copyright
	17	* notice, this list of conditions and the following disclaimer in the
	18	* documentation and/or other materials provided with the distribution.
	19	* 3. All advertising materials mentioning features or use of this software
	20	* must display the following acknowledgement:
	21	* This product includes software developed by the University of
	22	* California, Berkeley and its contributors.
	23	* 4. Neither the name of the University nor the names of its contributors
	24	* may be used to endorse or promote products derived from this software
	25	* without specific prior written permission.
	26	*
	27	* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
	28	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	29	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	30	* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
	31	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	32	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	33	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	34	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	35	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	36	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	37	* SUCH DAMAGE.
	38	*
	39	* from: Utah $Hdr: mem.c 1.13 89/10/08$
	40	* from: @(#)mem.c 7.2 (Berkeley) 5/9/91
	41	* $FreeBSD: src/sys/i386/i386/mem.c,v 1.79.2.9 2003/01/04 22:58:01 njl Exp $
8d565796	42	* $DragonFly: src/sys/kern/kern_memio.c,v 1.32 2008/07/23 16:39:28 dillon Exp $
984263bc MD	43	*/
	44
	45	/*
	46	* Memory special file
	47	*/
	48
	49	#include <sys/param.h>
	50	#include <sys/systm.h>
	51	#include <sys/buf.h>
	52	#include <sys/conf.h>
	53	#include <sys/fcntl.h>
	54	#include <sys/filio.h>
984263bc MD	55	#include <sys/kernel.h>
	56	#include <sys/malloc.h>
	57	#include <sys/memrange.h>
	58	#include <sys/proc.h>
895c1f85	59	#include <sys/priv.h>
984263bc MD	60	#include <sys/random.h>
984263bc MD	61	#include <sys/signalvar.h>
b1b4e5a6	62	#include <sys/signal2.h>
984263bc MD	63	#include <sys/uio.h>
	64	#include <sys/vnode.h>
	65
984263bc MD	66	#include <vm/vm.h>
	67	#include <vm/pmap.h>
	68	#include <vm/vm_extern.h>
	69
	70
	71	static d_open_t mmopen;
	72	static d_close_t mmclose;
fef8985e MD	73	static d_read_t mmread;
fef8985e MD	74	static d_write_t mmwrite;
984263bc MD	75	static d_ioctl_t mmioctl;
	76	static d_mmap_t memmmap;
	77	static d_poll_t mmpoll;
	78
	79	#define CDEV_MAJOR 2
fef8985e MD	80	static struct dev_ops mem_ops = {
	81	{ "mem", CDEV_MAJOR, D_MEM },
	82	.d_open = mmopen,
	83	.d_close = mmclose,
	84	.d_read = mmread,
	85	.d_write = mmwrite,
	86	.d_ioctl = mmioctl,
	87	.d_poll = mmpoll,
	88	.d_mmap = memmmap,
984263bc MD	89	};
984263bc MD	90
7e071e7a	91	static int rand_bolt;
984263bc	92	static caddr_t zbuf;
b9a1f8e1	93	static cdev_t zerodev = NULL;
984263bc MD	94
984263bc MD	95	MALLOC_DEFINE(M_MEMDESC, "memdesc", "memory range descriptors");
b13267a5 MD	96	static int mem_ioctl (cdev_t, u_long, caddr_t, int, struct ucred *);
b13267a5 MD	97	static int random_ioctl (cdev_t, u_long, caddr_t, int, struct ucred *);
984263bc MD	98
	99	struct mem_range_softc mem_range_softc;
	100
	101
	102	static int
fef8985e	103	mmopen(struct dev_open_args *ap)
984263bc	104	{
b13267a5	105	cdev_t dev = ap->a_head.a_dev;
fef8985e	106	int error;
41c20dac	107
984263bc	108	switch (minor(dev)) {
fef8985e MD	109	case 0:
fef8985e MD	110	case 1:
7e42c007 MD	111	if (ap->a_oflags & FWRITE) {
	112	if (securelevel > 0 \|\| kernel_mem_readonly)
	113	return (EPERM);
	114	}
fc26c9f1	115	error = 0;
fef8985e	116	break;
984263bc	117	case 14:
895c1f85	118	error = priv_check_cred(ap->a_cred, PRIV_ROOT, 0);
fef8985e	119	if (error != 0)
fc26c9f1	120	break;
7e42c007	121	if (securelevel > 0 \|\| kernel_mem_readonly) {
fc26c9f1 MD	122	error = EPERM;
	123	break;
	124	}
	125	error = cpu_set_iopl();
984263bc MD	126	break;
984263bc MD	127	default:
fc26c9f1	128	error = 0;
984263bc MD	129	break;
984263bc MD	130	}
fc26c9f1	131	return (error);
984263bc MD	132	}
	133
	134	static int
fef8985e	135	mmclose(struct dev_close_args *ap)
984263bc	136	{
b13267a5	137	cdev_t dev = ap->a_head.a_dev;
fc26c9f1	138	int error;
984263bc MD	139
984263bc MD	140	switch (minor(dev)) {
984263bc	141	case 14:
fc26c9f1	142	error = cpu_clr_iopl();
984263bc MD	143	break;
984263bc MD	144	default:
fc26c9f1	145	error = 0;
984263bc MD	146	break;
984263bc MD	147	}
fc26c9f1	148	return (error);
984263bc MD	149	}
984263bc MD	150
fef8985e	151
984263bc	152	static int
b13267a5	153	mmrw(cdev_t dev, struct uio *uio, int flags)
984263bc	154	{
c9faf524 RG	155	int o;
c9faf524 RG	156	u_int c, v;
984263bc	157	u_int poolsize;
c9faf524	158	struct iovec *iov;
984263bc MD	159	int error = 0;
	160	caddr_t buf = NULL;
	161
	162	while (uio->uio_resid > 0 && error == 0) {
	163	iov = uio->uio_iov;
	164	if (iov->iov_len == 0) {
	165	uio->uio_iov++;
	166	uio->uio_iovcnt--;
	167	if (uio->uio_iovcnt < 0)
	168	panic("mmrw");
	169	continue;
	170	}
	171	switch (minor(dev)) {
984263bc	172	case 0:
207bedb9 MD	173	/*
	174	* minor device 0 is physical memory, /dev/mem
	175	*/
984263bc MD	176	v = uio->uio_offset;
	177	v &= ~PAGE_MASK;
	178	pmap_kenter((vm_offset_t)ptvmmap, v);
	179	o = (int)uio->uio_offset & PAGE_MASK;
973c11b9	180	c = (u_int)(PAGE_SIZE - ((uintptr_t)iov->iov_base & PAGE_MASK));
984263bc MD	181	c = min(c, (u_int)(PAGE_SIZE - o));
	182	c = min(c, (u_int)iov->iov_len);
	183	error = uiomove((caddr_t)&ptvmmap[o], (int)c, uio);
	184	pmap_kremove((vm_offset_t)ptvmmap);
	185	continue;
	186
984263bc	187	case 1: {
207bedb9 MD	188	/*
	189	* minor device 1 is kernel memory, /dev/kmem
	190	*/
c439ad8f	191	vm_offset_t saddr, eaddr;
460426e6 MD	192	int prot;
460426e6 MD	193
984263bc MD	194	c = iov->iov_len;
	195
	196	/*
03debc4a MD	197	* Make sure that all of the pages are currently
	198	* resident so that we don't create any zero-fill
	199	* pages.
984263bc	200	*/
c439ad8f	201	saddr = trunc_page(uio->uio_offset);
984263bc	202	eaddr = round_page(uio->uio_offset + c);
460426e6	203	if (saddr > eaddr)
984263bc	204	return EFAULT;
460426e6 MD	205
	206	/*
	207	* Make sure the kernel addresses are mapped.
	208	* platform_direct_mapped() can be used to bypass
	209	* default mapping via the page table (virtual kernels
	210	* contain a lot of out-of-band data).
	211	*/
	212	prot = VM_PROT_READ;
	213	if (uio->uio_rw != UIO_READ)
	214	prot \|= VM_PROT_WRITE;
	215	error = kvm_access_check(saddr, eaddr, prot);
	216	if (error)
	217	return (error);
	218	error = uiomove((caddr_t)(vm_offset_t)uio->uio_offset,
	219	(int)c, uio);
984263bc MD	220	continue;
984263bc MD	221	}
984263bc	222	case 2:
207bedb9 MD	223	/*
	224	* minor device 2 is EOF/RATHOLE
	225	*/
984263bc MD	226	if (uio->uio_rw == UIO_READ)
	227	return (0);
	228	c = iov->iov_len;
	229	break;
984263bc	230	case 3:
207bedb9 MD	231	/*
207bedb9 MD	232	* minor device 3 (/dev/random) is source of filth
c26b3d4d	233	* on read, seeder on write
207bedb9	234	*/
984263bc	235	if (buf == NULL)
efda3bd0	236	buf = kmalloc(PAGE_SIZE, M_TEMP, M_WAITOK);
984263bc	237	c = min(iov->iov_len, PAGE_SIZE);
c26b3d4d MD	238	if (uio->uio_rw == UIO_WRITE) {
	239	error = uiomove(buf, (int)c, uio);
	240	if (error == 0)
	241	error = add_buffer_randomness(buf, c);
	242	} else {
	243	poolsize = read_random(buf, c);
	244	if (poolsize == 0) {
	245	if (buf)
efda3bd0	246	kfree(buf, M_TEMP);
c26b3d4d MD	247	if ((flags & IO_NDELAY) != 0)
	248	return (EWOULDBLOCK);
	249	return (0);
	250	}
	251	c = min(c, poolsize);
	252	error = uiomove(buf, (int)c, uio);
984263bc	253	}
984263bc	254	continue;
984263bc	255	case 4:
207bedb9 MD	256	/*
207bedb9 MD	257	* minor device 4 (/dev/urandom) is source of muck
c26b3d4d	258	* on read, writes are disallowed.
207bedb9	259	*/
c26b3d4d	260	c = min(iov->iov_len, PAGE_SIZE);
984263bc	261	if (uio->uio_rw == UIO_WRITE) {
c26b3d4d	262	error = EPERM;
984263bc MD	263	break;
984263bc MD	264	}
08f2f1bb	265	if (CURSIG(curthread->td_lwp) != 0) {
984263bc MD	266	/*
	267	* Use tsleep() to get the error code right.
	268	* It should return immediately.
	269	*/
377d4740	270	error = tsleep(&rand_bolt, PCATCH, "urand", 1);
984263bc MD	271	if (error != 0 && error != EWOULDBLOCK)
	272	continue;
	273	}
	274	if (buf == NULL)
efda3bd0	275	buf = kmalloc(PAGE_SIZE, M_TEMP, M_WAITOK);
984263bc MD	276	poolsize = read_random_unlimited(buf, c);
	277	c = min(c, poolsize);
	278	error = uiomove(buf, (int)c, uio);
	279	continue;
984263bc	280	case 12:
207bedb9 MD	281	/*
207bedb9 MD	282	* minor device 12 (/dev/zero) is source of nulls
c26b3d4d	283	* on read, write are disallowed.
207bedb9	284	*/
984263bc MD	285	if (uio->uio_rw == UIO_WRITE) {
	286	c = iov->iov_len;
	287	break;
	288	}
	289	if (zbuf == NULL) {
e7b4468c SW	290	zbuf = (caddr_t)kmalloc(PAGE_SIZE, M_TEMP,
e7b4468c SW	291	M_WAITOK \| M_ZERO);
984263bc MD	292	}
	293	c = min(iov->iov_len, PAGE_SIZE);
	294	error = uiomove(zbuf, (int)c, uio);
	295	continue;
984263bc MD	296	default:
	297	return (ENODEV);
	298	}
	299	if (error)
	300	break;
656849c6	301	iov->iov_base = (char *)iov->iov_base + c;
984263bc MD	302	iov->iov_len -= c;
	303	uio->uio_offset += c;
	304	uio->uio_resid -= c;
	305	}
	306	if (buf)
efda3bd0	307	kfree(buf, M_TEMP);
984263bc MD	308	return (error);
	309	}
	310
fef8985e MD	311	static int
	312	mmread(struct dev_read_args *ap)
	313	{
	314	return(mmrw(ap->a_head.a_dev, ap->a_uio, ap->a_ioflag));
	315	}
	316
	317	static int
	318	mmwrite(struct dev_write_args *ap)
	319	{
	320	return(mmrw(ap->a_head.a_dev, ap->a_uio, ap->a_ioflag));
	321	}
	322
	323
984263bc MD	324
	325
	326
	327	/*******************************************************\
	328	* allow user processes to MMAP some memory sections *
	329	* instead of going through read/write *
	330	\*******************************************************/
fef8985e	331
984263bc	332	static int
fef8985e	333	memmmap(struct dev_mmap_args *ap)
984263bc	334	{
b13267a5	335	cdev_t dev = ap->a_head.a_dev;
984263bc	336
fef8985e	337	switch (minor(dev)) {
984263bc	338	case 0:
fef8985e MD	339	/*
	340	* minor device 0 is physical memory
	341	*/
8d565796	342	#if defined(__i386__)
fef8985e	343	ap->a_result = i386_btop(ap->a_offset);
c1543a89 SS	344	#elif defined(__x86_64__)
c1543a89 SS	345	ap->a_result = x86_64_btop(ap->a_offset);
8d565796	346	#endif
fef8985e	347	return 0;
984263bc	348	case 1:
fef8985e MD	349	/*
	350	* minor device 1 is kernel memory
	351	*/
8d565796	352	#if defined(__i386__)
fef8985e	353	ap->a_result = i386_btop(vtophys(ap->a_offset));
c1543a89 SS	354	#elif defined(__x86_64__)
c1543a89 SS	355	ap->a_result = x86_64_btop(vtophys(ap->a_offset));
8d565796	356	#endif
fef8985e	357	return 0;
984263bc MD	358
984263bc MD	359	default:
fef8985e	360	return EINVAL;
984263bc MD	361	}
	362	}
	363
	364	static int
fef8985e	365	mmioctl(struct dev_ioctl_args *ap)
984263bc	366	{
b13267a5	367	cdev_t dev = ap->a_head.a_dev;
984263bc MD	368
	369	switch (minor(dev)) {
	370	case 0:
fef8985e MD	371	return mem_ioctl(dev, ap->a_cmd, ap->a_data,
fef8985e MD	372	ap->a_fflag, ap->a_cred);
984263bc MD	373	case 3:
984263bc MD	374	case 4:
fef8985e MD	375	return random_ioctl(dev, ap->a_cmd, ap->a_data,
fef8985e MD	376	ap->a_fflag, ap->a_cred);
984263bc MD	377	}
	378	return (ENODEV);
	379	}
	380
	381	/*
	382	* Operations for changing memory attributes.
	383	*
	384	* This is basically just an ioctl shim for mem_range_attr_get
	385	* and mem_range_attr_set.
	386	*/
	387	static int
b13267a5	388	mem_ioctl(cdev_t dev, u_long cmd, caddr_t data, int flags, struct ucred *cred)
984263bc MD	389	{
	390	int nd, error = 0;
	391	struct mem_range_op mo = (struct mem_range_op )data;
	392	struct mem_range_desc *md;
	393
	394	/* is this for us? */
	395	if ((cmd != MEMRANGE_GET) &&
	396	(cmd != MEMRANGE_SET))
	397	return (ENOTTY);
	398
	399	/* any chance we can handle this? */
	400	if (mem_range_softc.mr_op == NULL)
	401	return (EOPNOTSUPP);
	402
	403	/* do we have any descriptors? */
	404	if (mem_range_softc.mr_ndesc == 0)
	405	return (ENXIO);
	406
	407	switch (cmd) {
	408	case MEMRANGE_GET:
	409	nd = imin(mo->mo_arg[0], mem_range_softc.mr_ndesc);
	410	if (nd > 0) {
	411	md = (struct mem_range_desc *)
77652cad	412	kmalloc(nd * sizeof(struct mem_range_desc),
984263bc MD	413	M_MEMDESC, M_WAITOK);
	414	error = mem_range_attr_get(md, &nd);
	415	if (!error)
	416	error = copyout(md, mo->mo_desc,
	417	nd * sizeof(struct mem_range_desc));
efda3bd0	418	kfree(md, M_MEMDESC);
984263bc MD	419	} else {
	420	nd = mem_range_softc.mr_ndesc;
	421	}
	422	mo->mo_arg[0] = nd;
	423	break;
	424
	425	case MEMRANGE_SET:
77652cad	426	md = (struct mem_range_desc *)kmalloc(sizeof(struct mem_range_desc),
984263bc MD	427	M_MEMDESC, M_WAITOK);
	428	error = copyin(mo->mo_desc, md, sizeof(struct mem_range_desc));
	429	/* clamp description string */
	430	md->mr_owner[sizeof(md->mr_owner) - 1] = 0;
	431	if (error == 0)
	432	error = mem_range_attr_set(md, &mo->mo_arg[0]);
efda3bd0	433	kfree(md, M_MEMDESC);
984263bc MD	434	break;
	435	}
	436	return (error);
	437	}
	438
	439	/*
	440	* Implementation-neutral, kernel-callable functions for manipulating
	441	* memory range attributes.
	442	*/
	443	int
f123d5a1	444	mem_range_attr_get(struct mem_range_desc mrd, int arg)
984263bc MD	445	{
	446	/* can we handle this? */
	447	if (mem_range_softc.mr_op == NULL)
	448	return (EOPNOTSUPP);
	449
	450	if (*arg == 0) {
	451	*arg = mem_range_softc.mr_ndesc;
	452	} else {
	453	bcopy(mem_range_softc.mr_desc, mrd, (arg) sizeof(struct mem_range_desc));
	454	}
	455	return (0);
	456	}
	457
	458	int
f123d5a1	459	mem_range_attr_set(struct mem_range_desc mrd, int arg)
984263bc MD	460	{
	461	/* can we handle this? */
	462	if (mem_range_softc.mr_op == NULL)
	463	return (EOPNOTSUPP);
	464
	465	return (mem_range_softc.mr_op->set(&mem_range_softc, mrd, arg));
	466	}
	467
	468	#ifdef SMP
	469	void
	470	mem_range_AP_init(void)
	471	{
	472	if (mem_range_softc.mr_op && mem_range_softc.mr_op->initAP)
	473	return (mem_range_softc.mr_op->initAP(&mem_range_softc));
	474	}
	475	#endif
	476
	477	static int
b13267a5	478	random_ioctl(cdev_t dev, u_long cmd, caddr_t data, int flags, struct ucred *cred)
984263bc	479	{
5f456c40 MD	480	int error;
5f456c40 MD	481	int intr;
984263bc MD	482
984263bc MD	483	/*
984263bc MD	484	* Even inspecting the state is privileged, since it gives a hint
	485	* about how easily the randomness might be guessed.
	486	*/
5f456c40 MD	487	error = 0;
5f456c40 MD	488
984263bc MD	489	switch (cmd) {
	490	/* Really handled in upper layer */
	491	case FIOASYNC:
984263bc MD	492	break;
984263bc MD	493	case MEM_SETIRQ:
5f456c40	494	intr = (int16_t )data;
895c1f85	495	if ((error = priv_check_cred(cred, PRIV_ROOT, 0)) != 0)
984263bc	496	break;
5f456c40 MD	497	if (intr < 0 \|\| intr >= MAX_INTS)
5f456c40 MD	498	return (EINVAL);
7e071e7a	499	register_randintr(intr);
984263bc MD	500	break;
984263bc MD	501	case MEM_CLEARIRQ:
5f456c40	502	intr = (int16_t )data;
895c1f85	503	if ((error = priv_check_cred(cred, PRIV_ROOT, 0)) != 0)
984263bc	504	break;
5f456c40 MD	505	if (intr < 0 \|\| intr >= MAX_INTS)
5f456c40 MD	506	return (EINVAL);
7e071e7a	507	unregister_randintr(intr);
984263bc MD	508	break;
984263bc MD	509	case MEM_RETURNIRQ:
5f456c40 MD	510	error = ENOTSUP;
	511	break;
	512	case MEM_FINDIRQ:
	513	intr = (int16_t )data;
895c1f85	514	if ((error = priv_check_cred(cred, PRIV_ROOT, 0)) != 0)
5f456c40 MD	515	break;
	516	if (intr < 0 \|\| intr >= MAX_INTS)
	517	return (EINVAL);
	518	intr = next_registered_randintr(intr);
	519	if (intr == MAX_INTS)
	520	return (ENOENT);
	521	(u_int16_t )data = intr;
	522	break;
	523	default:
	524	error = ENOTSUP;
984263bc MD	525	break;
984263bc MD	526	}
5f456c40	527	return (error);
984263bc MD	528	}
	529
	530	int
fef8985e	531	mmpoll(struct dev_poll_args *ap)
984263bc	532	{
b13267a5	533	cdev_t dev = ap->a_head.a_dev;
fef8985e MD	534	int revents;
fef8985e MD	535
984263bc MD	536	switch (minor(dev)) {
984263bc MD	537	case 3: /* /dev/random */
fef8985e MD	538	revents = random_poll(dev, ap->a_events);
fef8985e MD	539	break;
984263bc MD	540	case 4: /* /dev/urandom */
984263bc MD	541	default:
fef8985e MD	542	revents = seltrue(dev, ap->a_events);
fef8985e MD	543	break;
984263bc	544	}
fef8985e MD	545	ap->a_events = revents;
fef8985e MD	546	return (0);
984263bc MD	547	}
	548
	549	int
f123d5a1	550	iszerodev(cdev_t dev)
984263bc	551	{
964d9977	552	return (zerodev == dev);
984263bc MD	553	}
	554
	555	static void
	556	mem_drvinit(void *unused)
	557	{
	558
	559	/* Initialise memory range handling */
	560	if (mem_range_softc.mr_op != NULL)
	561	mem_range_softc.mr_op->init(&mem_range_softc);
	562
fef8985e MD	563	make_dev(&mem_ops, 0, UID_ROOT, GID_KMEM, 0640, "mem");
	564	make_dev(&mem_ops, 1, UID_ROOT, GID_KMEM, 0640, "kmem");
	565	make_dev(&mem_ops, 2, UID_ROOT, GID_WHEEL, 0666, "null");
	566	make_dev(&mem_ops, 3, UID_ROOT, GID_WHEEL, 0644, "random");
	567	make_dev(&mem_ops, 4, UID_ROOT, GID_WHEEL, 0644, "urandom");
b9a1f8e1	568	zerodev = make_dev(&mem_ops, 12, UID_ROOT, GID_WHEEL, 0666, "zero");
fef8985e	569	make_dev(&mem_ops, 14, UID_ROOT, GID_WHEEL, 0600, "io");
984263bc MD	570	}
	571
	572	SYSINIT(memdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE+CDEV_MAJOR,mem_drvinit,NULL)
	573