2 * Copyright (c) 1988 University of Utah.
3 * Copyright (c) 1982, 1986, 1990 The Regents of the University of California.
6 * This code is derived from software contributed to Berkeley by
7 * the Systems Programming Group of the University of Utah Computer
8 * Science Department, and code derived from software contributed to
9 * Berkeley by William Jolitz.
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of the University nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * from: Utah $Hdr: mem.c 1.13 89/10/08$
36 * from: @(#)mem.c 7.2 (Berkeley) 5/9/91
37 * $FreeBSD: src/sys/i386/i386/mem.c,v 1.79.2.9 2003/01/04 22:58:01 njl Exp $
44 #include <sys/param.h>
45 #include <sys/systm.h>
48 #include <sys/fcntl.h>
49 #include <sys/filio.h>
50 #include <sys/kernel.h>
51 #include <sys/malloc.h>
52 #include <sys/memrange.h>
55 #include <sys/random.h>
56 #include <sys/signalvar.h>
58 #include <sys/vnode.h>
59 #include <sys/sysctl.h>
61 #include <sys/signal2.h>
62 #include <sys/mplock2.h>
66 #include <vm/vm_extern.h>
69 static d_open_t mmopen
;
70 static d_close_t mmclose
;
71 static d_read_t mmread
;
72 static d_write_t mmwrite
;
73 static d_ioctl_t mmioctl
;
75 static d_mmap_t memmmap
;
77 static d_kqfilter_t mmkqfilter
;
78 static int memuksmap(cdev_t dev
, vm_page_t fake
);
81 static struct dev_ops mem_ops
= {
82 { "mem", 0, D_MPSAFE
},
88 .d_kqfilter
= mmkqfilter
,
97 static cdev_t zerodev
= NULL
;
99 MALLOC_DEFINE(M_MEMDESC
, "memdesc", "memory range descriptors");
100 static int mem_ioctl (cdev_t
, u_long
, caddr_t
, int, struct ucred
*);
101 static int random_ioctl (cdev_t
, u_long
, caddr_t
, int, struct ucred
*);
103 struct mem_range_softc mem_range_softc
;
105 static int seedenable
;
106 SYSCTL_INT(_kern
, OID_AUTO
, seedenable
, CTLFLAG_RW
, &seedenable
, 0, "");
109 mmopen(struct dev_open_args
*ap
)
111 cdev_t dev
= ap
->a_head
.a_dev
;
114 switch (minor(dev
)) {
118 * /dev/mem and /dev/kmem
120 if (ap
->a_oflags
& FWRITE
) {
121 if (securelevel
> 0 || kernel_mem_readonly
)
128 * /dev/kpmap can only be opened for reading.
130 if (ap
->a_oflags
& FWRITE
)
135 error
= priv_check_cred(ap
->a_cred
, PRIV_ROOT
, 0);
138 if (securelevel
> 0 || kernel_mem_readonly
) {
142 error
= cpu_set_iopl();
152 mmclose(struct dev_close_args
*ap
)
154 cdev_t dev
= ap
->a_head
.a_dev
;
157 switch (minor(dev
)) {
159 error
= cpu_clr_iopl();
170 mmrw(cdev_t dev
, struct uio
*uio
, int flags
)
180 while (uio
->uio_resid
> 0 && error
== 0) {
182 if (iov
->iov_len
== 0) {
185 if (uio
->uio_iovcnt
< 0)
189 switch (minor(dev
)) {
192 * minor device 0 is physical memory, /dev/mem
195 v
&= ~(long)PAGE_MASK
;
196 pmap_kenter((vm_offset_t
)ptvmmap
, v
);
197 o
= (int)uio
->uio_offset
& PAGE_MASK
;
198 c
= (u_int
)(PAGE_SIZE
- ((uintptr_t)iov
->iov_base
& PAGE_MASK
));
199 c
= min(c
, (u_int
)(PAGE_SIZE
- o
));
200 c
= min(c
, (u_int
)iov
->iov_len
);
201 error
= uiomove((caddr_t
)&ptvmmap
[o
], (int)c
, uio
);
202 pmap_kremove((vm_offset_t
)ptvmmap
);
207 * minor device 1 is kernel memory, /dev/kmem
209 vm_offset_t saddr
, eaddr
;
215 * Make sure that all of the pages are currently
216 * resident so that we don't create any zero-fill
219 saddr
= trunc_page(uio
->uio_offset
);
220 eaddr
= round_page(uio
->uio_offset
+ c
);
225 * Make sure the kernel addresses are mapped.
226 * platform_direct_mapped() can be used to bypass
227 * default mapping via the page table (virtual kernels
228 * contain a lot of out-of-band data).
231 if (uio
->uio_rw
!= UIO_READ
)
232 prot
|= VM_PROT_WRITE
;
233 error
= kvm_access_check(saddr
, eaddr
, prot
);
236 error
= uiomove((caddr_t
)(vm_offset_t
)uio
->uio_offset
,
242 * minor device 2 (/dev/null) is EOF/RATHOLE
244 if (uio
->uio_rw
== UIO_READ
)
250 * minor device 3 (/dev/random) is source of filth
251 * on read, seeder on write
254 buf
= kmalloc(PAGE_SIZE
, M_TEMP
, M_WAITOK
);
255 c
= min(iov
->iov_len
, PAGE_SIZE
);
256 if (uio
->uio_rw
== UIO_WRITE
) {
257 error
= uiomove(buf
, (int)c
, uio
);
261 error
= add_buffer_randomness_src(buf
, c
, RAND_SRC_SEEDING
);
262 } else if (error
== 0) {
266 poolsize
= read_random(buf
, c
);
270 if ((flags
& IO_NDELAY
) != 0)
271 return (EWOULDBLOCK
);
274 c
= min(c
, poolsize
);
275 error
= uiomove(buf
, (int)c
, uio
);
280 * minor device 4 (/dev/urandom) is source of muck
281 * on read, writes are disallowed.
283 c
= min(iov
->iov_len
, PAGE_SIZE
);
284 if (uio
->uio_rw
== UIO_WRITE
) {
288 if (CURSIG(curthread
->td_lwp
) != 0) {
290 * Use tsleep() to get the error code right.
291 * It should return immediately.
293 error
= tsleep(&rand_bolt
, PCATCH
, "urand", 1);
294 if (error
!= 0 && error
!= EWOULDBLOCK
)
298 buf
= kmalloc(PAGE_SIZE
, M_TEMP
, M_WAITOK
);
299 poolsize
= read_random_unlimited(buf
, c
);
300 c
= min(c
, poolsize
);
301 error
= uiomove(buf
, (int)c
, uio
);
303 /* case 5: read/write not supported, mmap only */
304 /* case 6: read/write not supported, mmap only */
307 * minor device 12 (/dev/zero) is source of nulls
308 * on read, write are disallowed.
310 if (uio
->uio_rw
== UIO_WRITE
) {
315 zbuf
= (caddr_t
)kmalloc(PAGE_SIZE
, M_TEMP
,
318 c
= min(iov
->iov_len
, PAGE_SIZE
);
319 error
= uiomove(zbuf
, (int)c
, uio
);
326 iov
->iov_base
= (char *)iov
->iov_base
+ c
;
328 uio
->uio_offset
+= c
;
337 mmread(struct dev_read_args
*ap
)
339 return(mmrw(ap
->a_head
.a_dev
, ap
->a_uio
, ap
->a_ioflag
));
343 mmwrite(struct dev_write_args
*ap
)
345 return(mmrw(ap
->a_head
.a_dev
, ap
->a_uio
, ap
->a_ioflag
));
348 /*******************************************************\
349 * allow user processes to MMAP some memory sections *
350 * instead of going through read/write *
351 \*******************************************************/
353 static int user_kernel_mapping(int num
, vm_ooffset_t offset
,
354 vm_ooffset_t
*resultp
);
359 memmmap(struct dev_mmap_args
*ap
)
361 cdev_t dev
= ap
->a_head
.a_dev
;
365 switch (minor(dev
)) {
368 * minor device 0 is physical memory
370 ap
->a_result
= atop(ap
->a_offset
);
375 * minor device 1 is kernel memory
377 ap
->a_result
= atop(vtophys(ap
->a_offset
));
383 * minor device 5 is /dev/upmap (see sys/upmap.h)
384 * minor device 6 is /dev/kpmap (see sys/upmap.h)
387 error
= user_kernel_mapping(minor(dev
), ap
->a_offset
, &result
);
388 ap
->a_result
= atop(result
);
400 memuksmap(cdev_t dev
, vm_page_t fake
)
405 switch (minor(dev
)) {
408 * minor device 0 is physical memory
410 fake
->phys_addr
= ptoa(fake
->pindex
);
415 * minor device 1 is kernel memory
417 fake
->phys_addr
= vtophys(ptoa(fake
->pindex
));
423 * minor device 5 is /dev/upmap (see sys/upmap.h)
424 * minor device 6 is /dev/kpmap (see sys/upmap.h)
427 error
= user_kernel_mapping(minor(dev
),
428 ptoa(fake
->pindex
), &result
);
429 fake
->phys_addr
= result
;
439 mmioctl(struct dev_ioctl_args
*ap
)
441 cdev_t dev
= ap
->a_head
.a_dev
;
446 switch (minor(dev
)) {
448 error
= mem_ioctl(dev
, ap
->a_cmd
, ap
->a_data
,
449 ap
->a_fflag
, ap
->a_cred
);
453 error
= random_ioctl(dev
, ap
->a_cmd
, ap
->a_data
,
454 ap
->a_fflag
, ap
->a_cred
);
466 * Operations for changing memory attributes.
468 * This is basically just an ioctl shim for mem_range_attr_get
469 * and mem_range_attr_set.
472 mem_ioctl(cdev_t dev
, u_long cmd
, caddr_t data
, int flags
, struct ucred
*cred
)
475 struct mem_range_op
*mo
= (struct mem_range_op
*)data
;
476 struct mem_range_desc
*md
;
478 /* is this for us? */
479 if ((cmd
!= MEMRANGE_GET
) &&
480 (cmd
!= MEMRANGE_SET
))
483 /* any chance we can handle this? */
484 if (mem_range_softc
.mr_op
== NULL
)
487 /* do we have any descriptors? */
488 if (mem_range_softc
.mr_ndesc
== 0)
493 nd
= imin(mo
->mo_arg
[0], mem_range_softc
.mr_ndesc
);
495 md
= (struct mem_range_desc
*)
496 kmalloc(nd
* sizeof(struct mem_range_desc
),
497 M_MEMDESC
, M_WAITOK
);
498 error
= mem_range_attr_get(md
, &nd
);
500 error
= copyout(md
, mo
->mo_desc
,
501 nd
* sizeof(struct mem_range_desc
));
502 kfree(md
, M_MEMDESC
);
504 nd
= mem_range_softc
.mr_ndesc
;
510 md
= (struct mem_range_desc
*)kmalloc(sizeof(struct mem_range_desc
),
511 M_MEMDESC
, M_WAITOK
);
512 error
= copyin(mo
->mo_desc
, md
, sizeof(struct mem_range_desc
));
513 /* clamp description string */
514 md
->mr_owner
[sizeof(md
->mr_owner
) - 1] = 0;
516 error
= mem_range_attr_set(md
, &mo
->mo_arg
[0]);
517 kfree(md
, M_MEMDESC
);
524 * Implementation-neutral, kernel-callable functions for manipulating
525 * memory range attributes.
528 mem_range_attr_get(struct mem_range_desc
*mrd
, int *arg
)
530 /* can we handle this? */
531 if (mem_range_softc
.mr_op
== NULL
)
535 *arg
= mem_range_softc
.mr_ndesc
;
537 bcopy(mem_range_softc
.mr_desc
, mrd
, (*arg
) * sizeof(struct mem_range_desc
));
543 mem_range_attr_set(struct mem_range_desc
*mrd
, int *arg
)
545 /* can we handle this? */
546 if (mem_range_softc
.mr_op
== NULL
)
549 return (mem_range_softc
.mr_op
->set(&mem_range_softc
, mrd
, arg
));
553 mem_range_AP_init(void)
555 if (mem_range_softc
.mr_op
&& mem_range_softc
.mr_op
->initAP
)
556 mem_range_softc
.mr_op
->initAP(&mem_range_softc
);
560 random_ioctl(cdev_t dev
, u_long cmd
, caddr_t data
, int flags
, struct ucred
*cred
)
566 * Even inspecting the state is privileged, since it gives a hint
567 * about how easily the randomness might be guessed.
572 /* Really handled in upper layer */
576 intr
= *(int16_t *)data
;
577 if ((error
= priv_check_cred(cred
, PRIV_ROOT
, 0)) != 0)
579 if (intr
< 0 || intr
>= MAX_INTS
)
581 register_randintr(intr
);
584 intr
= *(int16_t *)data
;
585 if ((error
= priv_check_cred(cred
, PRIV_ROOT
, 0)) != 0)
587 if (intr
< 0 || intr
>= MAX_INTS
)
589 unregister_randintr(intr
);
595 intr
= *(int16_t *)data
;
596 if ((error
= priv_check_cred(cred
, PRIV_ROOT
, 0)) != 0)
598 if (intr
< 0 || intr
>= MAX_INTS
)
600 intr
= next_registered_randintr(intr
);
601 if (intr
== MAX_INTS
)
603 *(u_int16_t
*)data
= intr
;
613 mm_filter_read(struct knote
*kn
, long hint
)
619 mm_filter_write(struct knote
*kn
, long hint
)
625 dummy_filter_detach(struct knote
*kn
) {}
627 /* Implemented in kern_nrandom.c */
628 static struct filterops random_read_filtops
=
629 { FILTEROP_ISFD
|FILTEROP_MPSAFE
, NULL
, dummy_filter_detach
, random_filter_read
};
631 static struct filterops mm_read_filtops
=
632 { FILTEROP_ISFD
|FILTEROP_MPSAFE
, NULL
, dummy_filter_detach
, mm_filter_read
};
634 static struct filterops mm_write_filtops
=
635 { FILTEROP_ISFD
|FILTEROP_MPSAFE
, NULL
, dummy_filter_detach
, mm_filter_write
};
638 mmkqfilter(struct dev_kqfilter_args
*ap
)
640 struct knote
*kn
= ap
->a_kn
;
641 cdev_t dev
= ap
->a_head
.a_dev
;
644 switch (kn
->kn_filter
) {
646 switch (minor(dev
)) {
648 kn
->kn_fop
= &random_read_filtops
;
651 kn
->kn_fop
= &mm_read_filtops
;
656 kn
->kn_fop
= &mm_write_filtops
;
659 ap
->a_result
= EOPNOTSUPP
;
667 iszerodev(cdev_t dev
)
669 return (zerodev
== dev
);
673 * /dev/upmap and /dev/kpmap.
676 user_kernel_mapping(int num
, vm_ooffset_t offset
, vm_ooffset_t
*resultp
)
682 if ((p
= curproc
) == NULL
)
686 * If this is a child currently in vfork the pmap is shared with
687 * the parent! We need to actually set-up the parent's p_upmap,
688 * not the child's, and we need to set the invfork flag. Userland
689 * will probably adjust its static state so it must be consistent
690 * with the parent or userland will be really badly confused.
692 * (this situation can happen when user code in vfork() calls
693 * libc's getpid() or some other function which then decides
694 * it wants the upmap).
696 if (p
->p_flags
& P_PPWAIT
) {
710 * /dev/upmap - maps RW per-process shared user-kernel area.
712 if (p
->p_upmap
== NULL
)
713 proc_usermap(p
, invfork
);
715 p
->p_upmap
->invfork
= invfork
;
718 offset
< roundup2(sizeof(*p
->p_upmap
), PAGE_SIZE
)) {
719 /* only good for current process */
720 *resultp
= pmap_kextract((vm_offset_t
)p
->p_upmap
+
727 * /dev/kpmap - maps RO shared kernel global page
730 offset
< roundup2(sizeof(*kpmap
), PAGE_SIZE
)) {
731 *resultp
= pmap_kextract((vm_offset_t
)kpmap
+
743 mem_drvinit(void *unused
)
746 /* Initialise memory range handling */
747 if (mem_range_softc
.mr_op
!= NULL
)
748 mem_range_softc
.mr_op
->init(&mem_range_softc
);
750 make_dev(&mem_ops
, 0, UID_ROOT
, GID_KMEM
, 0640, "mem");
751 make_dev(&mem_ops
, 1, UID_ROOT
, GID_KMEM
, 0640, "kmem");
752 make_dev(&mem_ops
, 2, UID_ROOT
, GID_WHEEL
, 0666, "null");
753 make_dev(&mem_ops
, 3, UID_ROOT
, GID_WHEEL
, 0644, "random");
754 make_dev(&mem_ops
, 4, UID_ROOT
, GID_WHEEL
, 0644, "urandom");
755 make_dev(&mem_ops
, 5, UID_ROOT
, GID_WHEEL
, 0666, "upmap");
756 make_dev(&mem_ops
, 6, UID_ROOT
, GID_WHEEL
, 0444, "kpmap");
757 zerodev
= make_dev(&mem_ops
, 12, UID_ROOT
, GID_WHEEL
, 0666, "zero");
758 make_dev(&mem_ops
, 14, UID_ROOT
, GID_WHEEL
, 0600, "io");
761 SYSINIT(memdev
, SI_SUB_DRIVERS
, SI_ORDER_MIDDLE
+ CDEV_MAJOR
, mem_drvinit
,