1
2
3
4
5
6
7
8
9
10
11#include <linux/mm.h>
12#include <linux/miscdevice.h>
13#include <linux/slab.h>
14#include <linux/vmalloc.h>
15#include <linux/mman.h>
16#include <linux/random.h>
17#include <linux/init.h>
18#include <linux/raw.h>
19#include <linux/tty.h>
20#include <linux/capability.h>
21#include <linux/ptrace.h>
22#include <linux/device.h>
23#include <linux/highmem.h>
24#include <linux/crash_dump.h>
25#include <linux/backing-dev.h>
26#include <linux/bootmem.h>
27#include <linux/splice.h>
28#include <linux/pfn.h>
29#include <linux/smp_lock.h>
30
31#include <asm/uaccess.h>
32#include <asm/io.h>
33
34#ifdef CONFIG_IA64
35# include <linux/efi.h>
36#endif
37
38
39
40
41
42
43static inline int uncached_access(struct file *file, unsigned long addr)
44{
45#if defined(CONFIG_IA64)
46
47
48
49 return !(efi_mem_attributes(addr) & EFI_MEMORY_WB);
50#elif defined(CONFIG_MIPS)
51 {
52 extern int __uncached_access(struct file *file,
53 unsigned long addr);
54
55 return __uncached_access(file, addr);
56 }
57#else
58
59
60
61
62 if (file->f_flags & O_SYNC)
63 return 1;
64 return addr >= __pa(high_memory);
65#endif
66}
67
68#ifndef ARCH_HAS_VALID_PHYS_ADDR_RANGE
69static inline int valid_phys_addr_range(unsigned long addr, size_t count)
70{
71 if (addr + count > __pa(high_memory))
72 return 0;
73
74 return 1;
75}
76
77static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t size)
78{
79 return 1;
80}
81#endif
82
83#ifdef CONFIG_STRICT_DEVMEM
84static inline int range_is_allowed(unsigned long pfn, unsigned long size)
85{
86 u64 from = ((u64)pfn) << PAGE_SHIFT;
87 u64 to = from + size;
88 u64 cursor = from;
89
90 while (cursor < to) {
91 if (!devmem_is_allowed(pfn)) {
92 printk(KERN_INFO
93 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
94 current->comm, from, to);
95 return 0;
96 }
97 cursor += PAGE_SIZE;
98 pfn++;
99 }
100 return 1;
101}
102#else
103static inline int range_is_allowed(unsigned long pfn, unsigned long size)
104{
105 return 1;
106}
107#endif
108
109void __attribute__((weak)) unxlate_dev_mem_ptr(unsigned long phys, void *addr)
110{
111}
112
113
114
115
116
117static ssize_t read_mem(struct file * file, char __user * buf,
118 size_t count, loff_t *ppos)
119{
120 unsigned long p = *ppos;
121 ssize_t read, sz;
122 char *ptr;
123
124 if (!valid_phys_addr_range(p, count))
125 return -EFAULT;
126 read = 0;
127#ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
128
129 if (p < PAGE_SIZE) {
130 sz = PAGE_SIZE - p;
131 if (sz > count)
132 sz = count;
133 if (sz > 0) {
134 if (clear_user(buf, sz))
135 return -EFAULT;
136 buf += sz;
137 p += sz;
138 count -= sz;
139 read += sz;
140 }
141 }
142#endif
143
144 while (count > 0) {
145
146
147
148 if (-p & (PAGE_SIZE - 1))
149 sz = -p & (PAGE_SIZE - 1);
150 else
151 sz = PAGE_SIZE;
152
153 sz = min_t(unsigned long, sz, count);
154
155 if (!range_is_allowed(p >> PAGE_SHIFT, count))
156 return -EPERM;
157
158
159
160
161
162
163 ptr = xlate_dev_mem_ptr(p);
164 if (!ptr)
165 return -EFAULT;
166
167 if (copy_to_user(buf, ptr, sz)) {
168 unxlate_dev_mem_ptr(p, ptr);
169 return -EFAULT;
170 }
171
172 unxlate_dev_mem_ptr(p, ptr);
173
174 buf += sz;
175 p += sz;
176 count -= sz;
177 read += sz;
178 }
179
180 *ppos += read;
181 return read;
182}
183
184static ssize_t write_mem(struct file * file, const char __user * buf,
185 size_t count, loff_t *ppos)
186{
187 unsigned long p = *ppos;
188 ssize_t written, sz;
189 unsigned long copied;
190 void *ptr;
191
192 if (!valid_phys_addr_range(p, count))
193 return -EFAULT;
194
195 written = 0;
196
197#ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
198
199 if (p < PAGE_SIZE) {
200 unsigned long sz = PAGE_SIZE - p;
201 if (sz > count)
202 sz = count;
203
204 buf += sz;
205 p += sz;
206 count -= sz;
207 written += sz;
208 }
209#endif
210
211 while (count > 0) {
212
213
214
215 if (-p & (PAGE_SIZE - 1))
216 sz = -p & (PAGE_SIZE - 1);
217 else
218 sz = PAGE_SIZE;
219
220 sz = min_t(unsigned long, sz, count);
221
222 if (!range_is_allowed(p >> PAGE_SHIFT, sz))
223 return -EPERM;
224
225
226
227
228
229
230 ptr = xlate_dev_mem_ptr(p);
231 if (!ptr) {
232 if (written)
233 break;
234 return -EFAULT;
235 }
236
237 copied = copy_from_user(ptr, buf, sz);
238 if (copied) {
239 written += sz - copied;
240 unxlate_dev_mem_ptr(p, ptr);
241 if (written)
242 break;
243 return -EFAULT;
244 }
245
246 unxlate_dev_mem_ptr(p, ptr);
247
248 buf += sz;
249 p += sz;
250 count -= sz;
251 written += sz;
252 }
253
254 *ppos += written;
255 return written;
256}
257
258int __attribute__((weak)) phys_mem_access_prot_allowed(struct file *file,
259 unsigned long pfn, unsigned long size, pgprot_t *vma_prot)
260{
261 return 1;
262}
263
264#ifndef __HAVE_PHYS_MEM_ACCESS_PROT
265static pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
266 unsigned long size, pgprot_t vma_prot)
267{
268#ifdef pgprot_noncached
269 unsigned long offset = pfn << PAGE_SHIFT;
270
271 if (uncached_access(file, offset))
272 return pgprot_noncached(vma_prot);
273#endif
274 return vma_prot;
275}
276#endif
277
278#ifndef CONFIG_MMU
279static unsigned long get_unmapped_area_mem(struct file *file,
280 unsigned long addr,
281 unsigned long len,
282 unsigned long pgoff,
283 unsigned long flags)
284{
285 if (!valid_mmap_phys_addr_range(pgoff, len))
286 return (unsigned long) -EINVAL;
287 return pgoff << PAGE_SHIFT;
288}
289
290
291static inline int private_mapping_ok(struct vm_area_struct *vma)
292{
293 return vma->vm_flags & VM_MAYSHARE;
294}
295#else
296#define get_unmapped_area_mem NULL
297
298static inline int private_mapping_ok(struct vm_area_struct *vma)
299{
300 return 1;
301}
302#endif
303
304static const struct vm_operations_struct mmap_mem_ops = {
305#ifdef CONFIG_HAVE_IOREMAP_PROT
306 .access = generic_access_phys
307#endif
308};
309
310static int mmap_mem(struct file * file, struct vm_area_struct * vma)
311{
312 size_t size = vma->vm_end - vma->vm_start;
313
314 if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size))
315 return -EINVAL;
316
317 if (!private_mapping_ok(vma))
318 return -ENOSYS;
319
320 if (!range_is_allowed(vma->vm_pgoff, size))
321 return -EPERM;
322
323 if (!phys_mem_access_prot_allowed(file, vma->vm_pgoff, size,
324 &vma->vm_page_prot))
325 return -EINVAL;
326
327 vma->vm_page_prot = phys_mem_access_prot(file, vma->vm_pgoff,
328 size,
329 vma->vm_page_prot);
330
331 vma->vm_ops = &mmap_mem_ops;
332
333
334 if (remap_pfn_range(vma,
335 vma->vm_start,
336 vma->vm_pgoff,
337 size,
338 vma->vm_page_prot)) {
339 return -EAGAIN;
340 }
341 return 0;
342}
343
344#ifdef CONFIG_DEVKMEM
345static int mmap_kmem(struct file * file, struct vm_area_struct * vma)
346{
347 unsigned long pfn;
348
349
350 pfn = __pa((u64)vma->vm_pgoff << PAGE_SHIFT) >> PAGE_SHIFT;
351
352
353
354
355
356
357
358
359 if (!pfn_valid(pfn))
360 return -EIO;
361
362 vma->vm_pgoff = pfn;
363 return mmap_mem(file, vma);
364}
365#endif
366
367#ifdef CONFIG_CRASH_DUMP
368
369
370
371static ssize_t read_oldmem(struct file *file, char __user *buf,
372 size_t count, loff_t *ppos)
373{
374 unsigned long pfn, offset;
375 size_t read = 0, csize;
376 int rc = 0;
377
378 while (count) {
379 pfn = *ppos / PAGE_SIZE;
380 if (pfn > saved_max_pfn)
381 return read;
382
383 offset = (unsigned long)(*ppos % PAGE_SIZE);
384 if (count > PAGE_SIZE - offset)
385 csize = PAGE_SIZE - offset;
386 else
387 csize = count;
388
389 rc = copy_oldmem_page(pfn, buf, csize, offset, 1);
390 if (rc < 0)
391 return rc;
392 buf += csize;
393 *ppos += csize;
394 read += csize;
395 count -= csize;
396 }
397 return read;
398}
399#endif
400
401#ifdef CONFIG_DEVKMEM
402
403
404
405static ssize_t read_kmem(struct file *file, char __user *buf,
406 size_t count, loff_t *ppos)
407{
408 unsigned long p = *ppos;
409 ssize_t low_count, read, sz;
410 char * kbuf;
411
412 read = 0;
413 if (p < (unsigned long) high_memory) {
414 low_count = count;
415 if (count > (unsigned long) high_memory - p)
416 low_count = (unsigned long) high_memory - p;
417
418#ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
419
420 if (p < PAGE_SIZE && low_count > 0) {
421 size_t tmp = PAGE_SIZE - p;
422 if (tmp > low_count) tmp = low_count;
423 if (clear_user(buf, tmp))
424 return -EFAULT;
425 buf += tmp;
426 p += tmp;
427 read += tmp;
428 low_count -= tmp;
429 count -= tmp;
430 }
431#endif
432 while (low_count > 0) {
433
434
435
436 if (-p & (PAGE_SIZE - 1))
437 sz = -p & (PAGE_SIZE - 1);
438 else
439 sz = PAGE_SIZE;
440
441 sz = min_t(unsigned long, sz, low_count);
442
443
444
445
446
447
448 kbuf = xlate_dev_kmem_ptr((char *)p);
449
450 if (copy_to_user(buf, kbuf, sz))
451 return -EFAULT;
452 buf += sz;
453 p += sz;
454 read += sz;
455 low_count -= sz;
456 count -= sz;
457 }
458 }
459
460 if (count > 0) {
461 kbuf = (char *)__get_free_page(GFP_KERNEL);
462 if (!kbuf)
463 return -ENOMEM;
464 while (count > 0) {
465 int len = count;
466
467 if (len > PAGE_SIZE)
468 len = PAGE_SIZE;
469 len = vread(kbuf, (char *)p, len);
470 if (!len)
471 break;
472 if (copy_to_user(buf, kbuf, len)) {
473 free_page((unsigned long)kbuf);
474 return -EFAULT;
475 }
476 count -= len;
477 buf += len;
478 read += len;
479 p += len;
480 }
481 free_page((unsigned long)kbuf);
482 }
483 *ppos = p;
484 return read;
485}
486
487
488static inline ssize_t
489do_write_kmem(void *p, unsigned long realp, const char __user * buf,
490 size_t count, loff_t *ppos)
491{
492 ssize_t written, sz;
493 unsigned long copied;
494
495 written = 0;
496#ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
497
498 if (realp < PAGE_SIZE) {
499 unsigned long sz = PAGE_SIZE - realp;
500 if (sz > count)
501 sz = count;
502
503 buf += sz;
504 p += sz;
505 realp += sz;
506 count -= sz;
507 written += sz;
508 }
509#endif
510
511 while (count > 0) {
512 char *ptr;
513
514
515
516 if (-realp & (PAGE_SIZE - 1))
517 sz = -realp & (PAGE_SIZE - 1);
518 else
519 sz = PAGE_SIZE;
520
521 sz = min_t(unsigned long, sz, count);
522
523
524
525
526
527
528 ptr = xlate_dev_kmem_ptr(p);
529
530 copied = copy_from_user(ptr, buf, sz);
531 if (copied) {
532 written += sz - copied;
533 if (written)
534 break;
535 return -EFAULT;
536 }
537 buf += sz;
538 p += sz;
539 realp += sz;
540 count -= sz;
541 written += sz;
542 }
543
544 *ppos += written;
545 return written;
546}
547
548
549
550
551
552static ssize_t write_kmem(struct file * file, const char __user * buf,
553 size_t count, loff_t *ppos)
554{
555 unsigned long p = *ppos;
556 ssize_t wrote = 0;
557 ssize_t virtr = 0;
558 ssize_t written;
559 char * kbuf;
560
561 if (p < (unsigned long) high_memory) {
562
563 wrote = count;
564 if (count > (unsigned long) high_memory - p)
565 wrote = (unsigned long) high_memory - p;
566
567 written = do_write_kmem((void*)p, p, buf, wrote, ppos);
568 if (written != wrote)
569 return written;
570 wrote = written;
571 p += wrote;
572 buf += wrote;
573 count -= wrote;
574 }
575
576 if (count > 0) {
577 kbuf = (char *)__get_free_page(GFP_KERNEL);
578 if (!kbuf)
579 return wrote ? wrote : -ENOMEM;
580 while (count > 0) {
581 int len = count;
582
583 if (len > PAGE_SIZE)
584 len = PAGE_SIZE;
585 if (len) {
586 written = copy_from_user(kbuf, buf, len);
587 if (written) {
588 if (wrote + virtr)
589 break;
590 free_page((unsigned long)kbuf);
591 return -EFAULT;
592 }
593 }
594 len = vwrite(kbuf, (char *)p, len);
595 count -= len;
596 buf += len;
597 virtr += len;
598 p += len;
599 }
600 free_page((unsigned long)kbuf);
601 }
602
603 *ppos = p;
604 return virtr + wrote;
605}
606#endif
607
608#ifdef CONFIG_DEVPORT
609static ssize_t read_port(struct file * file, char __user * buf,
610 size_t count, loff_t *ppos)
611{
612 unsigned long i = *ppos;
613 char __user *tmp = buf;
614
615 if (!access_ok(VERIFY_WRITE, buf, count))
616 return -EFAULT;
617 while (count-- > 0 && i < 65536) {
618 if (__put_user(inb(i),tmp) < 0)
619 return -EFAULT;
620 i++;
621 tmp++;
622 }
623 *ppos = i;
624 return tmp-buf;
625}
626
627static ssize_t write_port(struct file * file, const char __user * buf,
628 size_t count, loff_t *ppos)
629{
630 unsigned long i = *ppos;
631 const char __user * tmp = buf;
632
633 if (!access_ok(VERIFY_READ,buf,count))
634 return -EFAULT;
635 while (count-- > 0 && i < 65536) {
636 char c;
637 if (__get_user(c, tmp)) {
638 if (tmp > buf)
639 break;
640 return -EFAULT;
641 }
642 outb(c,i);
643 i++;
644 tmp++;
645 }
646 *ppos = i;
647 return tmp-buf;
648}
649#endif
650
651static ssize_t read_null(struct file * file, char __user * buf,
652 size_t count, loff_t *ppos)
653{
654 return 0;
655}
656
657static ssize_t write_null(struct file * file, const char __user * buf,
658 size_t count, loff_t *ppos)
659{
660 return count;
661}
662
663static int pipe_to_null(struct pipe_inode_info *info, struct pipe_buffer *buf,
664 struct splice_desc *sd)
665{
666 return sd->len;
667}
668
669static ssize_t splice_write_null(struct pipe_inode_info *pipe,struct file *out,
670 loff_t *ppos, size_t len, unsigned int flags)
671{
672 return splice_from_pipe(pipe, out, ppos, len, flags, pipe_to_null);
673}
674
675static ssize_t read_zero(struct file * file, char __user * buf,
676 size_t count, loff_t *ppos)
677{
678 size_t written;
679
680 if (!count)
681 return 0;
682
683 if (!access_ok(VERIFY_WRITE, buf, count))
684 return -EFAULT;
685
686 written = 0;
687 while (count) {
688 unsigned long unwritten;
689 size_t chunk = count;
690
691 if (chunk > PAGE_SIZE)
692 chunk = PAGE_SIZE;
693 unwritten = __clear_user(buf, chunk);
694 written += chunk - unwritten;
695 if (unwritten)
696 break;
697 if (signal_pending(current))
698 return written ? written : -ERESTARTSYS;
699 buf += chunk;
700 count -= chunk;
701 cond_resched();
702 }
703 return written ? written : -EFAULT;
704}
705
706static int mmap_zero(struct file * file, struct vm_area_struct * vma)
707{
708#ifndef CONFIG_MMU
709 return -ENOSYS;
710#endif
711 if (vma->vm_flags & VM_SHARED)
712 return shmem_zero_setup(vma);
713 return 0;
714}
715
716static ssize_t write_full(struct file * file, const char __user * buf,
717 size_t count, loff_t *ppos)
718{
719 return -ENOSPC;
720}
721
722
723
724
725
726
727
728static loff_t null_lseek(struct file * file, loff_t offset, int orig)
729{
730 return file->f_pos = 0;
731}
732
733
734
735
736
737
738
739
740
741static loff_t memory_lseek(struct file * file, loff_t offset, int orig)
742{
743 loff_t ret;
744
745 mutex_lock(&file->f_path.dentry->d_inode->i_mutex);
746 switch (orig) {
747 case 0:
748 file->f_pos = offset;
749 ret = file->f_pos;
750 force_successful_syscall_return();
751 break;
752 case 1:
753 file->f_pos += offset;
754 ret = file->f_pos;
755 force_successful_syscall_return();
756 break;
757 default:
758 ret = -EINVAL;
759 }
760 mutex_unlock(&file->f_path.dentry->d_inode->i_mutex);
761 return ret;
762}
763
764static int open_port(struct inode * inode, struct file * filp)
765{
766 return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
767}
768
769#define zero_lseek null_lseek
770#define full_lseek null_lseek
771#define write_zero write_null
772#define read_full read_zero
773#define open_mem open_port
774#define open_kmem open_mem
775#define open_oldmem open_mem
776
777static const struct file_operations mem_fops = {
778 .llseek = memory_lseek,
779 .read = read_mem,
780 .write = write_mem,
781 .mmap = mmap_mem,
782 .open = open_mem,
783 .get_unmapped_area = get_unmapped_area_mem,
784};
785
786#ifdef CONFIG_DEVKMEM
787static const struct file_operations kmem_fops = {
788 .llseek = memory_lseek,
789 .read = read_kmem,
790 .write = write_kmem,
791 .mmap = mmap_kmem,
792 .open = open_kmem,
793 .get_unmapped_area = get_unmapped_area_mem,
794};
795#endif
796
797static const struct file_operations null_fops = {
798 .llseek = null_lseek,
799 .read = read_null,
800 .write = write_null,
801 .splice_write = splice_write_null,
802};
803
804#ifdef CONFIG_DEVPORT
805static const struct file_operations port_fops = {
806 .llseek = memory_lseek,
807 .read = read_port,
808 .write = write_port,
809 .open = open_port,
810};
811#endif
812
813static const struct file_operations zero_fops = {
814 .llseek = zero_lseek,
815 .read = read_zero,
816 .write = write_zero,
817 .mmap = mmap_zero,
818};
819
820
821
822
823
824static struct backing_dev_info zero_bdi = {
825 .name = "char/mem",
826 .capabilities = BDI_CAP_MAP_COPY,
827};
828
829static const struct file_operations full_fops = {
830 .llseek = full_lseek,
831 .read = read_full,
832 .write = write_full,
833};
834
835#ifdef CONFIG_CRASH_DUMP
836static const struct file_operations oldmem_fops = {
837 .read = read_oldmem,
838 .open = open_oldmem,
839};
840#endif
841
842static ssize_t kmsg_write(struct file * file, const char __user * buf,
843 size_t count, loff_t *ppos)
844{
845 char *tmp;
846 ssize_t ret;
847
848 tmp = kmalloc(count + 1, GFP_KERNEL);
849 if (tmp == NULL)
850 return -ENOMEM;
851 ret = -EFAULT;
852 if (!copy_from_user(tmp, buf, count)) {
853 tmp[count] = 0;
854 ret = printk("%s", tmp);
855 if (ret > count)
856
857 ret = count;
858 }
859 kfree(tmp);
860 return ret;
861}
862
863static const struct file_operations kmsg_fops = {
864 .write = kmsg_write,
865};
866
867static const struct memdev {
868 const char *name;
869 mode_t mode;
870 const struct file_operations *fops;
871 struct backing_dev_info *dev_info;
872} devlist[] = {
873 [1] = { "mem", 0, &mem_fops, &directly_mappable_cdev_bdi },
874#ifdef CONFIG_DEVKMEM
875 [2] = { "kmem", 0, &kmem_fops, &directly_mappable_cdev_bdi },
876#endif
877 [3] = { "null", 0666, &null_fops, NULL },
878#ifdef CONFIG_DEVPORT
879 [4] = { "port", 0, &port_fops, NULL },
880#endif
881 [5] = { "zero", 0666, &zero_fops, &zero_bdi },
882 [7] = { "full", 0666, &full_fops, NULL },
883 [8] = { "random", 0666, &random_fops, NULL },
884 [9] = { "urandom", 0666, &urandom_fops, NULL },
885 [11] = { "kmsg", 0, &kmsg_fops, NULL },
886#ifdef CONFIG_CRASH_DUMP
887 [12] = { "oldmem", 0, &oldmem_fops, NULL },
888#endif
889};
890
891static int memory_open(struct inode *inode, struct file *filp)
892{
893 int minor;
894 const struct memdev *dev;
895 int ret = -ENXIO;
896
897 lock_kernel();
898
899 minor = iminor(inode);
900 if (minor >= ARRAY_SIZE(devlist))
901 goto out;
902
903 dev = &devlist[minor];
904 if (!dev->fops)
905 goto out;
906
907 filp->f_op = dev->fops;
908 if (dev->dev_info)
909 filp->f_mapping->backing_dev_info = dev->dev_info;
910
911 if (dev->fops->open)
912 ret = dev->fops->open(inode, filp);
913 else
914 ret = 0;
915out:
916 unlock_kernel();
917 return ret;
918}
919
920static const struct file_operations memory_fops = {
921 .open = memory_open,
922};
923
924static char *mem_devnode(struct device *dev, mode_t *mode)
925{
926 if (mode && devlist[MINOR(dev->devt)].mode)
927 *mode = devlist[MINOR(dev->devt)].mode;
928 return NULL;
929}
930
931static struct class *mem_class;
932
933static int __init chr_dev_init(void)
934{
935 int minor;
936 int err;
937
938 err = bdi_init(&zero_bdi);
939 if (err)
940 return err;
941
942 if (register_chrdev(MEM_MAJOR,"mem",&memory_fops))
943 printk("unable to get major %d for memory devs\n", MEM_MAJOR);
944
945 mem_class = class_create(THIS_MODULE, "mem");
946 mem_class->devnode = mem_devnode;
947 for (minor = 1; minor < ARRAY_SIZE(devlist); minor++) {
948 if (!devlist[minor].name)
949 continue;
950 device_create(mem_class, NULL, MKDEV(MEM_MAJOR, minor),
951 NULL, devlist[minor].name);
952 }
953
954 return 0;
955}
956
957fs_initcall(chr_dev_init);
958