drivers/char/mem.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  *  linux/drivers/char/mem.c
   4  *
   5  *  Copyright (C) 1991, 1992  Linus Torvalds
   6  *
   7  *  Added devfs support.
   8  *    Jan-11-1998, C. Scott Ananian <[email protected]>
   9  *  Shared /dev/zero mmapping support, Feb 2000, Kanoj Sarcar <[email protected]>
  10  */
  11
  12 #include <linux/mm.h>
  13 #include <linux/miscdevice.h>
  14 #include <linux/slab.h>
  15 #include <linux/vmalloc.h>
  16 #include <linux/mman.h>
  17 #include <linux/random.h>
  18 #include <linux/init.h>
  19 #include <linux/raw.h>
  20 #include <linux/tty.h>
  21 #include <linux/capability.h>
  22 #include <linux/ptrace.h>
  23 #include <linux/device.h>
  24 #include <linux/highmem.h>
  25 #include <linux/backing-dev.h>
  26 #include <linux/shmem_fs.h>
  27 #include <linux/splice.h>
  28 #include <linux/pfn.h>
  29 #include <linux/export.h>
  30 #include <linux/io.h>
  31 #include <linux/uio.h>
  32 #include <linux/uaccess.h>
  33 #include <linux/security.h>
  34 #include <linux/pseudo_fs.h>
  35 #include <uapi/linux/magic.h>
  36 #include <linux/mount.h>
  37
  38 #ifdef CONFIG_IA64
  39 # include <linux/efi.h>
  40 #endif
  41
  42 #define DEVMEM_MINOR    1
  43 #define DEVPORT_MINOR   4
  44
  45 static inline unsigned long size_inside_page(unsigned long start,
  46                                              unsigned long size)
  47 {
  48         unsigned long sz;
  49
  50         sz = PAGE_SIZE - (start & (PAGE_SIZE - 1));
  51
  52         return min(sz, size);
  53 }
  54
  55 #ifndef ARCH_HAS_VALID_PHYS_ADDR_RANGE
  56 static inline int valid_phys_addr_range(phys_addr_t addr, size_t count)
  57 {
  58         return addr + count <= __pa(high_memory);
  59 }
  60
  61 static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t size)
  62 {
  63         return 1;
  64 }
  65 #endif
  66
  67 #ifdef CONFIG_STRICT_DEVMEM
  68 static inline int page_is_allowed(unsigned long pfn)
  69 {
  70         return devmem_is_allowed(pfn);
  71 }
  72 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
  73 {
  74         u64 from = ((u64)pfn) << PAGE_SHIFT;
  75         u64 to = from + size;
  76         u64 cursor = from;
  77
  78         while (cursor < to) {
  79                 if (!devmem_is_allowed(pfn))
  80                         return 0;
  81                 cursor += PAGE_SIZE;
  82                 pfn++;
  83         }
  84         return 1;
  85 }
  86 #else
  87 static inline int page_is_allowed(unsigned long pfn)
  88 {
  89         return 1;
  90 }
  91 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
  92 {
  93         return 1;
  94 }
  95 #endif
  96
  97 #ifndef unxlate_dev_mem_ptr
  98 #define unxlate_dev_mem_ptr unxlate_dev_mem_ptr
  99 void __weak unxlate_dev_mem_ptr(phys_addr_t phys, void *addr)
 100 {
 101 }
 102 #endif
 103
 104 static inline bool should_stop_iteration(void)
 105 {
 106         if (need_resched())
 107                 cond_resched();
 108         return fatal_signal_pending(current);
 109 }
 110
 111 /*
 112  * This funcion reads the *physical* memory. The f_pos points directly to the
 113  * memory location.
 114  */
 115 static ssize_t read_mem(struct file *file, char __user *buf,
 116                         size_t count, loff_t *ppos)
 117 {
 118         phys_addr_t p = *ppos;
 119         ssize_t read, sz;
 120         void *ptr;
 121         char *bounce;
 122         int err;
 123
 124         if (p != *ppos)
 125                 return 0;
 126
 127         if (!valid_phys_addr_range(p, count))
 128                 return -EFAULT;
 129         read = 0;
 130 #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
 131         /* we don't have page 0 mapped on sparc and m68k.. */
 132         if (p < PAGE_SIZE) {
 133                 sz = size_inside_page(p, count);
 134                 if (sz > 0) {
 135                         if (clear_user(buf, sz))
 136                                 return -EFAULT;
 137                         buf += sz;
 138                         p += sz;
 139                         count -= sz;
 140                         read += sz;
 141                 }
 142         }
 143 #endif
 144
 145         bounce = kmalloc(PAGE_SIZE, GFP_KERNEL);
 146         if (!bounce)
 147                 return -ENOMEM;
 148
 149         while (count > 0) {
 150                 unsigned long remaining;
 151                 int allowed, probe;
 152
 153                 sz = size_inside_page(p, count);
 154
 155                 err = -EPERM;
 156                 allowed = page_is_allowed(p >> PAGE_SHIFT);
 157                 if (!allowed)
 158                         goto failed;
 159
 160                 err = -EFAULT;
 161                 if (allowed == 2) {
 162                         /* Show zeros for restricted memory. */
 163                         remaining = clear_user(buf, sz);
 164                 } else {
 165                         /*
 166                          * On ia64 if a page has been mapped somewhere as
 167                          * uncached, then it must also be accessed uncached
 168                          * by the kernel or data corruption may occur.
 169                          */
 170                         ptr = xlate_dev_mem_ptr(p);
 171                         if (!ptr)
 172                                 goto failed;
 173
 174                         probe = copy_from_kernel_nofault(bounce, ptr, sz);
 175                         unxlate_dev_mem_ptr(p, ptr);
 176                         if (probe)
 177                                 goto failed;
 178
 179                         remaining = copy_to_user(buf, bounce, sz);
 180                 }
 181
 182                 if (remaining)
 183                         goto failed;
 184
 185                 buf += sz;
 186                 p += sz;
 187                 count -= sz;
 188                 read += sz;
 189                 if (should_stop_iteration())
 190                         break;
 191         }
 192         kfree(bounce);
 193
 194         *ppos += read;
 195         return read;
 196
 197 failed:
 198         kfree(bounce);
 199         return err;
 200 }
 201
 202 static ssize_t write_mem(struct file *file, const char __user *buf,
 203                          size_t count, loff_t *ppos)
 204 {
 205         phys_addr_t p = *ppos;
 206         ssize_t written, sz;
 207         unsigned long copied;
 208         void *ptr;
 209
 210         if (p != *ppos)
 211                 return -EFBIG;
 212
 213         if (!valid_phys_addr_range(p, count))
 214                 return -EFAULT;
 215
 216         written = 0;
 217
 218 #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
 219         /* we don't have page 0 mapped on sparc and m68k.. */
 220         if (p < PAGE_SIZE) {
 221                 sz = size_inside_page(p, count);
 222                 /* Hmm. Do something? */
 223                 buf += sz;
 224                 p += sz;
 225                 count -= sz;
 226                 written += sz;
 227         }
 228 #endif
 229
 230         while (count > 0) {
 231                 int allowed;
 232
 233                 sz = size_inside_page(p, count);
 234
 235                 allowed = page_is_allowed(p >> PAGE_SHIFT);
 236                 if (!allowed)
 237                         return -EPERM;
 238
 239                 /* Skip actual writing when a page is marked as restricted. */
 240                 if (allowed == 1) {
 241                         /*
 242                          * On ia64 if a page has been mapped somewhere as
 243                          * uncached, then it must also be accessed uncached
 244                          * by the kernel or data corruption may occur.
 245                          */
 246                         ptr = xlate_dev_mem_ptr(p);
 247                         if (!ptr) {
 248                                 if (written)
 249                                         break;
 250                                 return -EFAULT;
 251                         }
 252
 253                         copied = copy_from_user(ptr, buf, sz);
 254                         unxlate_dev_mem_ptr(p, ptr);
 255                         if (copied) {
 256                                 written += sz - copied;
 257                                 if (written)
 258                                         break;
 259                                 return -EFAULT;
 260                         }
 261                 }
 262
 263                 buf += sz;
 264                 p += sz;
 265                 count -= sz;
 266                 written += sz;
 267                 if (should_stop_iteration())
 268                         break;
 269         }
 270
 271         *ppos += written;
 272         return written;
 273 }
 274
 275 int __weak phys_mem_access_prot_allowed(struct file *file,
 276         unsigned long pfn, unsigned long size, pgprot_t *vma_prot)
 277 {
 278         return 1;
 279 }
 280
 281 #ifndef __HAVE_PHYS_MEM_ACCESS_PROT
 282
 283 /*
 284  * Architectures vary in how they handle caching for addresses
 285  * outside of main memory.
 286  *
 287  */
 288 #ifdef pgprot_noncached
 289 static int uncached_access(struct file *file, phys_addr_t addr)
 290 {
 291 #if defined(CONFIG_IA64)
 292         /*
 293          * On ia64, we ignore O_DSYNC because we cannot tolerate memory
 294          * attribute aliases.
 295          */
 296         return !(efi_mem_attributes(addr) & EFI_MEMORY_WB);
 297 #elif defined(CONFIG_MIPS)
 298         {
 299                 extern int __uncached_access(struct file *file,
 300                                              unsigned long addr);
 301
 302                 return __uncached_access(file, addr);
 303         }
 304 #else
 305         /*
 306          * Accessing memory above the top the kernel knows about or through a
 307          * file pointer
 308          * that was marked O_DSYNC will be done non-cached.
 309          */
 310         if (file->f_flags & O_DSYNC)
 311                 return 1;
 312         return addr >= __pa(high_memory);
 313 #endif
 314 }
 315 #endif
 316
 317 static pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
 318                                      unsigned long size, pgprot_t vma_prot)
 319 {
 320 #ifdef pgprot_noncached
 321         phys_addr_t offset = pfn << PAGE_SHIFT;
 322
 323         if (uncached_access(file, offset))
 324                 return pgprot_noncached(vma_prot);
 325 #endif
 326         return vma_prot;
 327 }
 328 #endif
 329
 330 #ifndef CONFIG_MMU
 331 static unsigned long get_unmapped_area_mem(struct file *file,
 332                                            unsigned long addr,
 333                                            unsigned long len,
 334                                            unsigned long pgoff,
 335                                            unsigned long flags)
 336 {
 337         if (!valid_mmap_phys_addr_range(pgoff, len))
 338                 return (unsigned long) -EINVAL;
 339         return pgoff << PAGE_SHIFT;
 340 }
 341
 342 /* permit direct mmap, for read, write or exec */
 343 static unsigned memory_mmap_capabilities(struct file *file)
 344 {
 345         return NOMMU_MAP_DIRECT |
 346                 NOMMU_MAP_READ | NOMMU_MAP_WRITE | NOMMU_MAP_EXEC;
 347 }
 348
 349 static unsigned zero_mmap_capabilities(struct file *file)
 350 {
 351         return NOMMU_MAP_COPY;
 352 }
 353
 354 /* can't do an in-place private mapping if there's no MMU */
 355 static inline int private_mapping_ok(struct vm_area_struct *vma)
 356 {
 357         return vma->vm_flags & VM_MAYSHARE;
 358 }
 359 #else
 360
 361 static inline int private_mapping_ok(struct vm_area_struct *vma)
 362 {
 363         return 1;
 364 }
 365 #endif
 366
 367 static const struct vm_operations_struct mmap_mem_ops = {
 368 #ifdef CONFIG_HAVE_IOREMAP_PROT
 369         .access = generic_access_phys
 370 #endif
 371 };
 372
 373 static int mmap_mem(struct file *file, struct vm_area_struct *vma)
 374 {
 375         size_t size = vma->vm_end - vma->vm_start;
 376         phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
 377
 378         /* Does it even fit in phys_addr_t? */
 379         if (offset >> PAGE_SHIFT != vma->vm_pgoff)
 380                 return -EINVAL;
 381
 382         /* It's illegal to wrap around the end of the physical address space. */
 383         if (offset + (phys_addr_t)size - 1 < offset)
 384                 return -EINVAL;
 385
 386         if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size))
 387                 return -EINVAL;
 388
 389         if (!private_mapping_ok(vma))
 390                 return -ENOSYS;
 391
 392         if (!range_is_allowed(vma->vm_pgoff, size))
 393                 return -EPERM;
 394
 395         if (!phys_mem_access_prot_allowed(file, vma->vm_pgoff, size,
 396                                                 &vma->vm_page_prot))
 397                 return -EINVAL;
 398
 399         vma->vm_page_prot = phys_mem_access_prot(file, vma->vm_pgoff,
 400                                                  size,
 401                                                  vma->vm_page_prot);
 402
 403         vma->vm_ops = &mmap_mem_ops;
 404
 405         /* Remap-pfn-range will mark the range VM_IO */
 406         if (remap_pfn_range(vma,
 407                             vma->vm_start,
 408                             vma->vm_pgoff,
 409                             size,
 410                             vma->vm_page_prot)) {
 411                 return -EAGAIN;
 412         }
 413         return 0;
 414 }
 415
 416 static int mmap_kmem(struct file *file, struct vm_area_struct *vma)
 417 {
 418         unsigned long pfn;
 419
 420         /* Turn a kernel-virtual address into a physical page frame */
 421         pfn = __pa((u64)vma->vm_pgoff << PAGE_SHIFT) >> PAGE_SHIFT;
 422
 423         /*
 424          * RED-PEN: on some architectures there is more mapped memory than
 425          * available in mem_map which pfn_valid checks for. Perhaps should add a
 426          * new macro here.
 427          *
 428          * RED-PEN: vmalloc is not supported right now.
 429          */
 430         if (!pfn_valid(pfn))
 431                 return -EIO;
 432
 433         vma->vm_pgoff = pfn;
 434         return mmap_mem(file, vma);
 435 }
 436
 437 /*
 438  * This function reads the *virtual* memory as seen by the kernel.
 439  */
 440 static ssize_t read_kmem(struct file *file, char __user *buf,
 441                          size_t count, loff_t *ppos)
 442 {
 443         unsigned long p = *ppos;
 444         ssize_t low_count, read, sz;
 445         char *kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
 446         int err = 0;
 447
 448         read = 0;
 449         if (p < (unsigned long) high_memory) {
 450                 low_count = count;
 451                 if (count > (unsigned long)high_memory - p)
 452                         low_count = (unsigned long)high_memory - p;
 453
 454 #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
 455                 /* we don't have page 0 mapped on sparc and m68k.. */
 456                 if (p < PAGE_SIZE && low_count > 0) {
 457                         sz = size_inside_page(p, low_count);
 458                         if (clear_user(buf, sz))
 459                                 return -EFAULT;
 460                         buf += sz;
 461                         p += sz;
 462                         read += sz;
 463                         low_count -= sz;
 464                         count -= sz;
 465                 }
 466 #endif
 467                 while (low_count > 0) {
 468                         sz = size_inside_page(p, low_count);
 469
 470                         /*
 471                          * On ia64 if a page has been mapped somewhere as
 472                          * uncached, then it must also be accessed uncached
 473                          * by the kernel or data corruption may occur
 474                          */
 475                         kbuf = xlate_dev_kmem_ptr((void *)p);
 476                         if (!virt_addr_valid(kbuf))
 477                                 return -ENXIO;
 478
 479                         if (copy_to_user(buf, kbuf, sz))
 480                                 return -EFAULT;
 481                         buf += sz;
 482                         p += sz;
 483                         read += sz;
 484                         low_count -= sz;
 485                         count -= sz;
 486                         if (should_stop_iteration()) {
 487                                 count = 0;
 488                                 break;
 489                         }
 490                 }
 491         }
 492
 493         if (count > 0) {
 494                 kbuf = (char *)__get_free_page(GFP_KERNEL);
 495                 if (!kbuf)
 496                         return -ENOMEM;
 497                 while (count > 0) {
 498                         sz = size_inside_page(p, count);
 499                         if (!is_vmalloc_or_module_addr((void *)p)) {
 500                                 err = -ENXIO;
 501                                 break;
 502                         }
 503                         sz = vread(kbuf, (char *)p, sz);
 504                         if (!sz)
 505                                 break;
 506                         if (copy_to_user(buf, kbuf, sz)) {
 507                                 err = -EFAULT;
 508                                 break;
 509                         }
 510                         count -= sz;
 511                         buf += sz;
 512                         read += sz;
 513                         p += sz;
 514                         if (should_stop_iteration())
 515                                 break;
 516                 }
 517                 free_page((unsigned long)kbuf);
 518         }
 519         *ppos = p;
 520         return read ? read : err;
 521 }
 522
 523
 524 static ssize_t do_write_kmem(unsigned long p, const char __user *buf,
 525                                 size_t count, loff_t *ppos)
 526 {
 527         ssize_t written, sz;
 528         unsigned long copied;
 529
 530         written = 0;
 531 #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
 532         /* we don't have page 0 mapped on sparc and m68k.. */
 533         if (p < PAGE_SIZE) {
 534                 sz = size_inside_page(p, count);
 535                 /* Hmm. Do something? */
 536                 buf += sz;
 537                 p += sz;
 538                 count -= sz;
 539                 written += sz;
 540         }
 541 #endif
 542
 543         while (count > 0) {
 544                 void *ptr;
 545
 546                 sz = size_inside_page(p, count);
 547
 548                 /*
 549                  * On ia64 if a page has been mapped somewhere as uncached, then
 550                  * it must also be accessed uncached by the kernel or data
 551                  * corruption may occur.
 552                  */
 553                 ptr = xlate_dev_kmem_ptr((void *)p);
 554                 if (!virt_addr_valid(ptr))
 555                         return -ENXIO;
 556
 557                 copied = copy_from_user(ptr, buf, sz);
 558                 if (copied) {
 559                         written += sz - copied;
 560                         if (written)
 561                                 break;
 562                         return -EFAULT;
 563                 }
 564                 buf += sz;
 565                 p += sz;
 566                 count -= sz;
 567                 written += sz;
 568                 if (should_stop_iteration())
 569                         break;
 570         }
 571
 572         *ppos += written;
 573         return written;
 574 }
 575
 576 /*
 577  * This function writes to the *virtual* memory as seen by the kernel.
 578  */
 579 static ssize_t write_kmem(struct file *file, const char __user *buf,
 580                           size_t count, loff_t *ppos)
 581 {
 582         unsigned long p = *ppos;
 583         ssize_t wrote = 0;
 584         ssize_t virtr = 0;
 585         char *kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
 586         int err = 0;
 587
 588         if (p < (unsigned long) high_memory) {
 589                 unsigned long to_write = min_t(unsigned long, count,
 590                                                (unsigned long)high_memory - p);
 591                 wrote = do_write_kmem(p, buf, to_write, ppos);
 592                 if (wrote != to_write)
 593                         return wrote;
 594                 p += wrote;
 595                 buf += wrote;
 596                 count -= wrote;
 597         }
 598
 599         if (count > 0) {
 600                 kbuf = (char *)__get_free_page(GFP_KERNEL);
 601                 if (!kbuf)
 602                         return wrote ? wrote : -ENOMEM;
 603                 while (count > 0) {
 604                         unsigned long sz = size_inside_page(p, count);
 605                         unsigned long n;
 606
 607                         if (!is_vmalloc_or_module_addr((void *)p)) {
 608                                 err = -ENXIO;
 609                                 break;
 610                         }
 611                         n = copy_from_user(kbuf, buf, sz);
 612                         if (n) {
 613                                 err = -EFAULT;
 614                                 break;
 615                         }
 616                         vwrite(kbuf, (char *)p, sz);
 617                         count -= sz;
 618                         buf += sz;
 619                         virtr += sz;
 620                         p += sz;
 621                         if (should_stop_iteration())
 622                                 break;
 623                 }
 624                 free_page((unsigned long)kbuf);
 625         }
 626
 627         *ppos = p;
 628         return virtr + wrote ? : err;
 629 }
 630
 631 static ssize_t read_port(struct file *file, char __user *buf,
 632                          size_t count, loff_t *ppos)
 633 {
 634         unsigned long i = *ppos;
 635         char __user *tmp = buf;
 636
 637         if (!access_ok(buf, count))
 638                 return -EFAULT;
 639         while (count-- > 0 && i < 65536) {
 640                 if (__put_user(inb(i), tmp) < 0)
 641                         return -EFAULT;
 642                 i++;
 643                 tmp++;
 644         }
 645         *ppos = i;
 646         return tmp-buf;
 647 }
 648
 649 static ssize_t write_port(struct file *file, const char __user *buf,
 650                           size_t count, loff_t *ppos)
 651 {
 652         unsigned long i = *ppos;
 653         const char __user *tmp = buf;
 654
 655         if (!access_ok(buf, count))
 656                 return -EFAULT;
 657         while (count-- > 0 && i < 65536) {
 658                 char c;
 659
 660                 if (__get_user(c, tmp)) {
 661                         if (tmp > buf)
 662                                 break;
 663                         return -EFAULT;
 664                 }
 665                 outb(c, i);
 666                 i++;
 667                 tmp++;
 668         }
 669         *ppos = i;
 670         return tmp-buf;
 671 }
 672
 673 static ssize_t read_null(struct file *file, char __user *buf,
 674                          size_t count, loff_t *ppos)
 675 {
 676         return 0;
 677 }
 678
 679 static ssize_t write_null(struct file *file, const char __user *buf,
 680                           size_t count, loff_t *ppos)
 681 {
 682         return count;
 683 }
 684
 685 static ssize_t read_iter_null(struct kiocb *iocb, struct iov_iter *to)
 686 {
 687         return 0;
 688 }
 689
 690 static ssize_t write_iter_null(struct kiocb *iocb, struct iov_iter *from)
 691 {
 692         size_t count = iov_iter_count(from);
 693         iov_iter_advance(from, count);
 694         return count;
 695 }
 696
 697 static int pipe_to_null(struct pipe_inode_info *info, struct pipe_buffer *buf,
 698                         struct splice_desc *sd)
 699 {
 700         return sd->len;
 701 }
 702
 703 static ssize_t splice_write_null(struct pipe_inode_info *pipe, struct file *out,
 704                                  loff_t *ppos, size_t len, unsigned int flags)
 705 {
 706         return splice_from_pipe(pipe, out, ppos, len, flags, pipe_to_null);
 707 }
 708
 709 static ssize_t read_iter_zero(struct kiocb *iocb, struct iov_iter *iter)
 710 {
 711         size_t written = 0;
 712
 713         while (iov_iter_count(iter)) {
 714                 size_t chunk = iov_iter_count(iter), n;
 715
 716                 if (chunk > PAGE_SIZE)
 717                         chunk = PAGE_SIZE;      /* Just for latency reasons */
 718                 n = iov_iter_zero(chunk, iter);
 719                 if (!n && iov_iter_count(iter))
 720                         return written ? written : -EFAULT;
 721                 written += n;
 722                 if (signal_pending(current))
 723                         return written ? written : -ERESTARTSYS;
 724                 cond_resched();
 725         }
 726         return written;
 727 }
 728
 729 static ssize_t read_zero(struct file *file, char __user *buf,
 730                          size_t count, loff_t *ppos)
 731 {
 732         size_t cleared = 0;
 733
 734         while (count) {
 735                 size_t chunk = min_t(size_t, count, PAGE_SIZE);
 736                 size_t left;
 737
 738                 left = clear_user(buf + cleared, chunk);
 739                 if (unlikely(left)) {
 740                         cleared += (chunk - left);
 741                         if (!cleared)
 742                                 return -EFAULT;
 743                         break;
 744                 }
 745                 cleared += chunk;
 746                 count -= chunk;
 747
 748                 if (signal_pending(current))
 749                         break;
 750                 cond_resched();
 751         }
 752
 753         return cleared;
 754 }
 755
 756 static int mmap_zero(struct file *file, struct vm_area_struct *vma)
 757 {
 758 #ifndef CONFIG_MMU
 759         return -ENOSYS;
 760 #endif
 761         if (vma->vm_flags & VM_SHARED)
 762                 return shmem_zero_setup(vma);
 763         vma_set_anonymous(vma);
 764         return 0;
 765 }
 766
 767 static unsigned long get_unmapped_area_zero(struct file *file,
 768                                 unsigned long addr, unsigned long len,
 769                                 unsigned long pgoff, unsigned long flags)
 770 {
 771 #ifdef CONFIG_MMU
 772         if (flags & MAP_SHARED) {
 773                 /*
 774                  * mmap_zero() will call shmem_zero_setup() to create a file,
 775                  * so use shmem's get_unmapped_area in case it can be huge;
 776                  * and pass NULL for file as in mmap.c's get_unmapped_area(),
 777                  * so as not to confuse shmem with our handle on "/dev/zero".
 778                  */
 779                 return shmem_get_unmapped_area(NULL, addr, len, pgoff, flags);
 780         }
 781
 782         /* Otherwise flags & MAP_PRIVATE: with no shmem object beneath it */
 783         return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
 784 #else
 785         return -ENOSYS;
 786 #endif
 787 }
 788
 789 static ssize_t write_full(struct file *file, const char __user *buf,
 790                           size_t count, loff_t *ppos)
 791 {
 792         return -ENOSPC;
 793 }
 794
 795 /*
 796  * Special lseek() function for /dev/null and /dev/zero.  Most notably, you
 797  * can fopen() both devices with "a" now.  This was previously impossible.
 798  * -- SRB.
 799  */
 800 static loff_t null_lseek(struct file *file, loff_t offset, int orig)
 801 {
 802         return file->f_pos = 0;
 803 }
 804
 805 /*
 806  * The memory devices use the full 32/64 bits of the offset, and so we cannot
 807  * check against negative addresses: they are ok. The return value is weird,
 808  * though, in that case (0).
 809  *
 810  * also note that seeking relative to the "end of file" isn't supported:
 811  * it has no meaning, so it returns -EINVAL.
 812  */
 813 static loff_t memory_lseek(struct file *file, loff_t offset, int orig)
 814 {
 815         loff_t ret;
 816
 817         inode_lock(file_inode(file));
 818         switch (orig) {
 819         case SEEK_CUR:
 820                 offset += file->f_pos;
 821                 fallthrough;
 822         case SEEK_SET:
 823                 /* to avoid userland mistaking f_pos=-9 as -EBADF=-9 */
 824                 if ((unsigned long long)offset >= -MAX_ERRNO) {
 825                         ret = -EOVERFLOW;
 826                         break;
 827                 }
 828                 file->f_pos = offset;
 829                 ret = file->f_pos;
 830                 force_successful_syscall_return();
 831                 break;
 832         default:
 833                 ret = -EINVAL;
 834         }
 835         inode_unlock(file_inode(file));
 836         return ret;
 837 }
 838
 839 static struct inode *devmem_inode;
 840
 841 #ifdef CONFIG_IO_STRICT_DEVMEM
 842 void revoke_devmem(struct resource *res)
 843 {
 844         /* pairs with smp_store_release() in devmem_init_inode() */
 845         struct inode *inode = smp_load_acquire(&devmem_inode);
 846
 847         /*
 848          * Check that the initialization has completed. Losing the race
 849          * is ok because it means drivers are claiming resources before
 850          * the fs_initcall level of init and prevent /dev/mem from
 851          * establishing mappings.
 852          */
 853         if (!inode)
 854                 return;
 855
 856         /*
 857          * The expectation is that the driver has successfully marked
 858          * the resource busy by this point, so devmem_is_allowed()
 859          * should start returning false, however for performance this
 860          * does not iterate the entire resource range.
 861          */
 862         if (devmem_is_allowed(PHYS_PFN(res->start)) &&
 863             devmem_is_allowed(PHYS_PFN(res->end))) {
 864                 /*
 865                  * *cringe* iomem=relaxed says "go ahead, what's the
 866                  * worst that can happen?"
 867                  */
 868                 return;
 869         }
 870
 871         unmap_mapping_range(inode->i_mapping, res->start, resource_size(res), 1);
 872 }
 873 #endif
 874
 875 static int open_port(struct inode *inode, struct file *filp)
 876 {
 877         int rc;
 878
 879         if (!capable(CAP_SYS_RAWIO))
 880                 return -EPERM;
 881
 882         rc = security_locked_down(LOCKDOWN_DEV_MEM);
 883         if (rc)
 884                 return rc;
 885
 886         if (iminor(inode) != DEVMEM_MINOR)
 887                 return 0;
 888
 889         /*
 890          * Use a unified address space to have a single point to manage
 891          * revocations when drivers want to take over a /dev/mem mapped
 892          * range.
 893          */
 894         inode->i_mapping = devmem_inode->i_mapping;
 895         filp->f_mapping = inode->i_mapping;
 896
 897         return 0;
 898 }
 899
 900 #define zero_lseek      null_lseek
 901 #define full_lseek      null_lseek
 902 #define write_zero      write_null
 903 #define write_iter_zero write_iter_null
 904 #define open_mem        open_port
 905 #define open_kmem       open_mem
 906
 907 static const struct file_operations __maybe_unused mem_fops = {
 908         .llseek         = memory_lseek,
 909         .read           = read_mem,
 910         .write          = write_mem,
 911         .mmap           = mmap_mem,
 912         .open           = open_mem,
 913 #ifndef CONFIG_MMU
 914         .get_unmapped_area = get_unmapped_area_mem,
 915         .mmap_capabilities = memory_mmap_capabilities,
 916 #endif
 917 };
 918
 919 static const struct file_operations __maybe_unused kmem_fops = {
 920         .llseek         = memory_lseek,
 921         .read           = read_kmem,
 922         .write          = write_kmem,
 923         .mmap           = mmap_kmem,
 924         .open           = open_kmem,
 925 #ifndef CONFIG_MMU
 926         .get_unmapped_area = get_unmapped_area_mem,
 927         .mmap_capabilities = memory_mmap_capabilities,
 928 #endif
 929 };
 930
 931 static const struct file_operations null_fops = {
 932         .llseek         = null_lseek,
 933         .read           = read_null,
 934         .write          = write_null,
 935         .read_iter      = read_iter_null,
 936         .write_iter     = write_iter_null,
 937         .splice_write   = splice_write_null,
 938 };
 939
 940 static const struct file_operations __maybe_unused port_fops = {
 941         .llseek         = memory_lseek,
 942         .read           = read_port,
 943         .write          = write_port,
 944         .open           = open_port,
 945 };
 946
 947 static const struct file_operations zero_fops = {
 948         .llseek         = zero_lseek,
 949         .write          = write_zero,
 950         .read_iter      = read_iter_zero,
 951         .read           = read_zero,
 952         .write_iter     = write_iter_zero,
 953         .mmap           = mmap_zero,
 954         .get_unmapped_area = get_unmapped_area_zero,
 955 #ifndef CONFIG_MMU
 956         .mmap_capabilities = zero_mmap_capabilities,
 957 #endif
 958 };
 959
 960 static const struct file_operations full_fops = {
 961         .llseek         = full_lseek,
 962         .read_iter      = read_iter_zero,
 963         .write          = write_full,
 964 };
 965
 966 static const struct memdev {
 967         const char *name;
 968         umode_t mode;
 969         const struct file_operations *fops;
 970         fmode_t fmode;
 971 } devlist[] = {
 972 #ifdef CONFIG_DEVMEM
 973          [DEVMEM_MINOR] = { "mem", 0, &mem_fops, FMODE_UNSIGNED_OFFSET },
 974 #endif
 975 #ifdef CONFIG_DEVKMEM
 976          [2] = { "kmem", 0, &kmem_fops, FMODE_UNSIGNED_OFFSET },
 977 #endif
 978          [3] = { "null", 0666, &null_fops, 0 },
 979 #ifdef CONFIG_DEVPORT
 980          [4] = { "port", 0, &port_fops, 0 },
 981 #endif
 982          [5] = { "zero", 0666, &zero_fops, 0 },
 983          [7] = { "full", 0666, &full_fops, 0 },
 984          [8] = { "random", 0666, &random_fops, 0 },
 985          [9] = { "urandom", 0666, &urandom_fops, 0 },
 986 #ifdef CONFIG_PRINTK
 987         [11] = { "kmsg", 0644, &kmsg_fops, 0 },
 988 #endif
 989 };
 990
 991 static int memory_open(struct inode *inode, struct file *filp)
 992 {
 993         int minor;
 994         const struct memdev *dev;
 995
 996         minor = iminor(inode);
 997         if (minor >= ARRAY_SIZE(devlist))
 998                 return -ENXIO;
 999
1000         dev = &devlist[minor];
1001         if (!dev->fops)
1002                 return -ENXIO;
1003
1004         filp->f_op = dev->fops;
1005         filp->f_mode |= dev->fmode;
1006
1007         if (dev->fops->open)
1008                 return dev->fops->open(inode, filp);
1009
1010         return 0;
1011 }
1012
1013 static const struct file_operations memory_fops = {
1014         .open = memory_open,
1015         .llseek = noop_llseek,
1016 };
1017
1018 static char *mem_devnode(struct device *dev, umode_t *mode)
1019 {
1020         if (mode && devlist[MINOR(dev->devt)].mode)
1021                 *mode = devlist[MINOR(dev->devt)].mode;
1022         return NULL;
1023 }
1024
1025 static struct class *mem_class;
1026
1027 static int devmem_fs_init_fs_context(struct fs_context *fc)
1028 {
1029         return init_pseudo(fc, DEVMEM_MAGIC) ? 0 : -ENOMEM;
1030 }
1031
1032 static struct file_system_type devmem_fs_type = {
1033         .name           = "devmem",
1034         .owner          = THIS_MODULE,
1035         .init_fs_context = devmem_fs_init_fs_context,
1036         .kill_sb        = kill_anon_super,
1037 };
1038
1039 static int devmem_init_inode(void)
1040 {
1041         static struct vfsmount *devmem_vfs_mount;
1042         static int devmem_fs_cnt;
1043         struct inode *inode;
1044         int rc;
1045
1046         rc = simple_pin_fs(&devmem_fs_type, &devmem_vfs_mount, &devmem_fs_cnt);
1047         if (rc < 0) {
1048                 pr_err("Cannot mount /dev/mem pseudo filesystem: %d\n", rc);
1049                 return rc;
1050         }
1051
1052         inode = alloc_anon_inode(devmem_vfs_mount->mnt_sb);
1053         if (IS_ERR(inode)) {
1054                 rc = PTR_ERR(inode);
1055                 pr_err("Cannot allocate inode for /dev/mem: %d\n", rc);
1056                 simple_release_fs(&devmem_vfs_mount, &devmem_fs_cnt);
1057                 return rc;
1058         }
1059
1060         /*
1061          * Publish /dev/mem initialized.
1062          * Pairs with smp_load_acquire() in revoke_devmem().
1063          */
1064         smp_store_release(&devmem_inode, inode);
1065
1066         return 0;
1067 }
1068
1069 static int __init chr_dev_init(void)
1070 {
1071         int minor;
1072
1073         if (register_chrdev(MEM_MAJOR, "mem", &memory_fops))
1074                 printk("unable to get major %d for memory devs\n", MEM_MAJOR);
1075
1076         mem_class = class_create(THIS_MODULE, "mem");
1077         if (IS_ERR(mem_class))
1078                 return PTR_ERR(mem_class);
1079
1080         mem_class->devnode = mem_devnode;
1081         for (minor = 1; minor < ARRAY_SIZE(devlist); minor++) {
1082                 if (!devlist[minor].name)
1083                         continue;
1084
1085                 /*
1086                  * Create /dev/port?
1087                  */
1088                 if ((minor == DEVPORT_MINOR) && !arch_has_dev_port())
1089                         continue;
1090                 if ((minor == DEVMEM_MINOR) && devmem_init_inode() != 0)
1091                         continue;
1092
1093                 device_create(mem_class, NULL, MKDEV(MEM_MAJOR, minor),
1094                               NULL, devlist[minor].name);
1095         }
1096
1097         return tty_init();
1098 }
1099
1100 fs_initcall(chr_dev_init);