1 /*
2 * Copyright (c) 1982, 1986, 1991, 1993
3 * The Regents of the University of California. All rights reserved.
4 * (c) UNIX System Laboratories, Inc.
5 * All or some portions of this file are derived from material licensed
6 * to the University of California by American Telephone and Telegraph
7 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8 * the permission of UNIX System Laboratories, Inc.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. Neither the name of the University nor the names of its contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
34 * @(#)kern_subr.c 8.3 (Berkeley) 1/21/94
35 * $FreeBSD: src/sys/kern/kern_subr.c,v 1.31.2.2 2002/04/21 08:09:37 bde Exp $
36 */
37
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/kernel.h>
41 #include <sys/proc.h>
42 #include <sys/malloc.h>
43 #include <sys/lock.h>
44 #include <sys/resourcevar.h>
45 #include <sys/sysctl.h>
46 #include <sys/uio.h>
47 #include <sys/vnode.h>
48 #include <sys/thread2.h>
49 #include <machine/limits.h>
50
51 #include <cpu/lwbuf.h>
52
53 #include <vm/vm.h>
54 #include <vm/vm_page.h>
55 #include <vm/vm_map.h>
56
57 SYSCTL_INT(_kern, KERN_IOV_MAX, iov_max, CTLFLAG_RD, NULL, UIO_MAXIOV,
58 "Maximum number of elements in an I/O vector; sysconf(_SC_IOV_MAX)");
59
60 int
copyin_nofault(const void * udaddr,void * kaddr,size_t len)61 copyin_nofault(const void *udaddr, void *kaddr, size_t len)
62 {
63 thread_t td = curthread;
64 int error;
65
66 atomic_set_int(&td->td_flags, TDF_NOFAULT);
67 error = copyin(udaddr, kaddr, len);
68 atomic_clear_int(&td->td_flags, TDF_NOFAULT);
69 return error;
70 }
71
72 int
copyout_nofault(const void * kaddr,void * udaddr,size_t len)73 copyout_nofault(const void *kaddr, void *udaddr, size_t len)
74 {
75 thread_t td = curthread;
76 int error;
77
78 atomic_set_int(&td->td_flags, TDF_NOFAULT);
79 error = copyout(kaddr, udaddr, len);
80 atomic_clear_int(&td->td_flags, TDF_NOFAULT);
81 return error;
82 }
83
84 /*
85 * UIO_READ: copy the kernelspace cp to the user or kernelspace UIO
86 * UIO_WRITE: copy the user or kernelspace UIO to the kernelspace cp
87 *
88 * For userspace UIO's, uio_td must be the current thread.
89 *
90 * The syscall interface is responsible for limiting the length to
91 * ssize_t for things like read() or write() which return the bytes
92 * read or written as ssize_t. These functions work with unsigned
93 * lengths.
94 */
95 int
uiomove(caddr_t cp,size_t n,struct uio * uio)96 uiomove(caddr_t cp, size_t n, struct uio *uio)
97 {
98 thread_t td = curthread;
99 struct iovec *iov;
100 size_t cnt;
101 size_t tot;
102 int error = 0;
103 int save = 0;
104
105 KASSERT(uio->uio_rw == UIO_READ || uio->uio_rw == UIO_WRITE,
106 ("uiomove: mode"));
107 KASSERT(uio->uio_segflg != UIO_USERSPACE || uio->uio_td == td,
108 ("uiomove proc"));
109
110 crit_enter();
111 save = td->td_flags & TDF_DEADLKTREAT;
112 td->td_flags |= TDF_DEADLKTREAT;
113 crit_exit();
114
115 tot = 0;
116
117 while (n > 0 && uio->uio_resid) {
118 iov = uio->uio_iov;
119 cnt = iov->iov_len;
120 if (cnt == 0) {
121 uio->uio_iov++;
122 uio->uio_iovcnt--;
123 continue;
124 }
125 if (cnt > n)
126 cnt = n;
127 tot += cnt;
128
129 switch (uio->uio_segflg) {
130 case UIO_USERSPACE:
131 if (tot > 1024*1024)
132 lwkt_user_yield();
133 if (uio->uio_rw == UIO_READ)
134 error = copyout(cp, iov->iov_base, cnt);
135 else
136 error = copyin(iov->iov_base, cp, cnt);
137 break;
138 case UIO_SYSSPACE:
139 if (uio->uio_rw == UIO_READ)
140 bcopy(cp, iov->iov_base, cnt);
141 else
142 bcopy(iov->iov_base, cp, cnt);
143 break;
144 case UIO_NOCOPY:
145 break;
146 }
147
148 if (error)
149 break;
150 iov->iov_base = (char *)iov->iov_base + cnt;
151 iov->iov_len -= cnt;
152 uio->uio_resid -= cnt;
153 uio->uio_offset += cnt;
154 cp += cnt;
155 n -= cnt;
156 }
157 crit_enter();
158 td->td_flags = (td->td_flags & ~TDF_DEADLKTREAT) | save;
159 crit_exit();
160
161 return (error);
162 }
163
164 /*
165 * This is the same as uiomove() except (cp, n) is within the bounds of
166 * the passed, locked buffer. Under certain circumstances a VM fault
167 * occuring with a locked buffer held can result in a deadlock or an
168 * attempt to recursively lock the buffer.
169 *
170 * This procedure deals with these cases.
171 *
172 * If the buffer represents a regular file, is B_CACHE, but the last VM page
173 * is not fully valid we fix-up the last VM page. This should handle the
174 * recursive lock issue.
175 *
176 * Deadlocks are another issue. We are holding the vp and the bp locked
177 * and could deadlock against a different vp and/or bp if another thread is
178 * trying to access us while we accessing it. The only solution here is
179 * to release the bp and vnode lock and do the uio to/from a system buffer,
180 * then regain the locks and copyback (if applicable). XXX TODO.
181 */
182 int
uiomovebp(struct buf * bp,caddr_t cp,size_t n,struct uio * uio)183 uiomovebp(struct buf *bp, caddr_t cp, size_t n, struct uio *uio)
184 {
185 int count;
186 vm_page_t m;
187
188 if (bp->b_vp && bp->b_vp->v_type == VREG &&
189 (bp->b_flags & B_CACHE) &&
190 (count = bp->b_xio.xio_npages) != 0 &&
191 (m = bp->b_xio.xio_pages[count-1])->valid != VM_PAGE_BITS_ALL) {
192 vm_page_zero_invalid(m, TRUE);
193 }
194 return (uiomove(cp, n, uio));
195 }
196
197 /*
198 * uiomove() but fail for non-trivial VM faults, even if the VM fault is
199 * valid. Returns EFAULT if a VM fault occurred via the copyin/copyout
200 * onfault code.
201 *
202 * This allows callers to hold e.g. a busy VM page, or a busy VM object,
203 * or a locked vnode through the call and then fall-back to safer code
204 * if we fail.
205 */
206 int
uiomove_nofault(caddr_t cp,size_t n,struct uio * uio)207 uiomove_nofault(caddr_t cp, size_t n, struct uio *uio)
208 {
209 thread_t td = curthread;
210 int error;
211
212 atomic_set_int(&td->td_flags, TDF_NOFAULT);
213 error = uiomove(cp, n, uio);
214 atomic_clear_int(&td->td_flags, TDF_NOFAULT);
215 return error;
216 }
217
218 /*
219 * Like uiomove() but copies zero-fill. Only allowed for UIO_READ,
220 * for obvious reasons.
221 */
222 int
uiomovez(size_t n,struct uio * uio)223 uiomovez(size_t n, struct uio *uio)
224 {
225 struct iovec *iov;
226 size_t cnt;
227 int error = 0;
228
229 KASSERT(uio->uio_rw == UIO_READ, ("uiomovez: mode"));
230 KASSERT(uio->uio_segflg != UIO_USERSPACE || uio->uio_td == curthread,
231 ("uiomove proc"));
232
233 while (n > 0 && uio->uio_resid) {
234 iov = uio->uio_iov;
235 cnt = iov->iov_len;
236 if (cnt == 0) {
237 uio->uio_iov++;
238 uio->uio_iovcnt--;
239 continue;
240 }
241 if (cnt > n)
242 cnt = n;
243
244 switch (uio->uio_segflg) {
245 case UIO_USERSPACE:
246 error = copyout(ZeroPage, iov->iov_base, cnt);
247 break;
248 case UIO_SYSSPACE:
249 bzero(iov->iov_base, cnt);
250 break;
251 case UIO_NOCOPY:
252 break;
253 }
254
255 if (error)
256 break;
257 iov->iov_base = (char *)iov->iov_base + cnt;
258 iov->iov_len -= cnt;
259 uio->uio_resid -= cnt;
260 uio->uio_offset += cnt;
261 n -= cnt;
262 }
263 return (error);
264 }
265
266 /*
267 * Wrapper for uiomove() that validates the arguments against a known-good
268 * kernel buffer. This function automatically indexes the buffer by
269 * uio_offset and handles all range checking.
270 */
271 int
uiomove_frombuf(void * buf,size_t buflen,struct uio * uio)272 uiomove_frombuf(void *buf, size_t buflen, struct uio *uio)
273 {
274 size_t offset;
275
276 offset = (size_t)uio->uio_offset;
277 if ((off_t)offset != uio->uio_offset)
278 return (EINVAL);
279 if (buflen == 0 || offset >= buflen)
280 return (0);
281 return (uiomove((char *)buf + offset, buflen - offset, uio));
282 }
283
284 /*
285 * Give next character to user as result of read.
286 */
287 int
ureadc(int c,struct uio * uio)288 ureadc(int c, struct uio *uio)
289 {
290 struct iovec *iov;
291 char *iov_base;
292
293 again:
294 if (uio->uio_iovcnt == 0 || uio->uio_resid == 0)
295 panic("ureadc");
296 iov = uio->uio_iov;
297 if (iov->iov_len == 0) {
298 uio->uio_iovcnt--;
299 uio->uio_iov++;
300 goto again;
301 }
302
303 switch (uio->uio_segflg) {
304 case UIO_USERSPACE:
305 if (subyte(iov->iov_base, c) < 0)
306 return (EFAULT);
307 break;
308 case UIO_SYSSPACE:
309 iov_base = iov->iov_base;
310 *iov_base = c;
311 iov->iov_base = iov_base;
312 break;
313 case UIO_NOCOPY:
314 break;
315 }
316
317 iov->iov_base = (char *)iov->iov_base + 1;
318 iov->iov_len--;
319 uio->uio_resid--;
320 uio->uio_offset++;
321 return (0);
322 }
323
324 /*
325 * General routine to allocate a hash table. Make the hash table size a
326 * power of 2 greater or equal to the number of elements requested, and
327 * store the masking value in *hashmask.
328 */
329 void *
hashinit(int elements,struct malloc_type * type,u_long * hashmask)330 hashinit(int elements, struct malloc_type *type, u_long *hashmask)
331 {
332 long hashsize;
333 LIST_HEAD(generic, generic) *hashtbl;
334 int i;
335
336 if (elements <= 0)
337 panic("hashinit: bad elements");
338 for (hashsize = 2; hashsize < elements; hashsize <<= 1)
339 continue;
340 hashtbl = kmalloc((u_long)hashsize * sizeof(*hashtbl), type, M_WAITOK);
341 for (i = 0; i < hashsize; i++)
342 LIST_INIT(&hashtbl[i]);
343 *hashmask = hashsize - 1;
344 return (hashtbl);
345 }
346
347 void
hashdestroy(void * vhashtbl,struct malloc_type * type,u_long hashmask)348 hashdestroy(void *vhashtbl, struct malloc_type *type, u_long hashmask)
349 {
350 LIST_HEAD(generic, generic) *hashtbl, *hp;
351
352 hashtbl = vhashtbl;
353 for (hp = hashtbl; hp <= &hashtbl[hashmask]; hp++)
354 KASSERT(LIST_EMPTY(hp), ("%s: hash not empty", __func__));
355 kfree(hashtbl, type);
356 }
357
358 /*
359 * This is a newer version which allocates a hash table of structures.
360 *
361 * The returned array will be zero'd. The caller is responsible for
362 * initializing the structures.
363 */
364 void *
hashinit_ext(int elements,size_t size,struct malloc_type * type,u_long * hashmask)365 hashinit_ext(int elements, size_t size, struct malloc_type *type,
366 u_long *hashmask)
367 {
368 long hashsize;
369 void *hashtbl;
370
371 if (elements <= 0)
372 panic("hashinit: bad elements");
373 for (hashsize = 2; hashsize < elements; hashsize <<= 1)
374 continue;
375 hashtbl = kmalloc((size_t)hashsize * size, type, M_WAITOK | M_ZERO);
376 *hashmask = hashsize - 1;
377 return (hashtbl);
378 }
379
380 static int primes[] = { 1, 13, 31, 61, 127, 251, 509, 761, 1021, 1531, 2039,
381 2557, 3067, 3583, 4093, 4603, 5119, 5623, 6143, 6653,
382 7159, 7673, 8191, 12281, 16381, 24571, 32749 };
383 #define NPRIMES NELEM(primes)
384
385 /*
386 * General routine to allocate a prime number sized hash table.
387 */
388 void *
phashinit(int elements,struct malloc_type * type,u_long * nentries)389 phashinit(int elements, struct malloc_type *type, u_long *nentries)
390 {
391 long hashsize;
392 LIST_HEAD(generic, generic) *hashtbl;
393 int i;
394
395 if (elements <= 0)
396 panic("phashinit: bad elements");
397 for (i = 1, hashsize = primes[1]; hashsize <= elements;) {
398 i++;
399 if (i == NPRIMES)
400 break;
401 hashsize = primes[i];
402 }
403 hashsize = primes[i - 1];
404 hashtbl = kmalloc((u_long)hashsize * sizeof(*hashtbl), type, M_WAITOK);
405 for (i = 0; i < hashsize; i++)
406 LIST_INIT(&hashtbl[i]);
407 *nentries = hashsize;
408 return (hashtbl);
409 }
410
411 /*
412 * This is a newer version which allocates a hash table of structures
413 * in a prime-number size.
414 *
415 * The returned array will be zero'd. The caller is responsible for
416 * initializing the structures.
417 */
418 void *
phashinit_ext(int elements,size_t size,struct malloc_type * type,u_long * nentries)419 phashinit_ext(int elements, size_t size, struct malloc_type *type,
420 u_long *nentries)
421 {
422 long hashsize;
423 void *hashtbl;
424 int i;
425
426 if (elements <= 0)
427 panic("phashinit: bad elements");
428 for (i = 1, hashsize = primes[1]; hashsize <= elements;) {
429 i++;
430 if (i == NPRIMES)
431 break;
432 hashsize = primes[i];
433 }
434 hashsize = primes[i - 1];
435 hashtbl = kmalloc((size_t)hashsize * size, type, M_WAITOK | M_ZERO);
436 *nentries = hashsize;
437 return (hashtbl);
438 }
439
440 /*
441 * Copyin an iovec. If the iovec array fits, use the preallocated small
442 * iovec structure. If it is too big, dynamically allocate an iovec array
443 * of sufficient size.
444 *
445 * MPSAFE
446 */
447 int
iovec_copyin(const struct iovec * uiov,struct iovec ** kiov,struct iovec * siov,int iov_cnt,size_t * iov_len)448 iovec_copyin(const struct iovec *uiov, struct iovec **kiov, struct iovec *siov,
449 int iov_cnt, size_t *iov_len)
450 {
451 struct iovec *iovp;
452 int error, i;
453 size_t len;
454
455 if ((u_int)iov_cnt > UIO_MAXIOV)
456 return EMSGSIZE;
457 if (iov_cnt > UIO_SMALLIOV) {
458 *kiov = kmalloc(sizeof(struct iovec) * iov_cnt, M_IOV,
459 M_WAITOK);
460 } else {
461 *kiov = siov;
462 }
463 error = copyin(uiov, *kiov, iov_cnt * sizeof(struct iovec));
464 if (error == 0) {
465 *iov_len = 0;
466 for (i = 0, iovp = *kiov; i < iov_cnt; i++, iovp++) {
467 /*
468 * Check for both *iov_len overflows and out of
469 * range iovp->iov_len's. We limit to the
470 * capabilities of signed integers.
471 *
472 * GCC4 - overflow check opt requires assign/test.
473 */
474 len = *iov_len + iovp->iov_len;
475 if (len < *iov_len)
476 error = EINVAL;
477 *iov_len = len;
478 }
479 }
480
481 /*
482 * From userland disallow iovec's which exceed the sized size
483 * limit as the system calls return ssize_t.
484 *
485 * NOTE: Internal kernel interfaces can handle the unsigned
486 * limit.
487 */
488 if (error == 0 && (ssize_t)*iov_len < 0)
489 error = EINVAL;
490
491 if (error)
492 iovec_free(kiov, siov);
493 return (error);
494 }
495
496
497 /*
498 * Copyright (c) 2004 Alan L. Cox <alc@cs.rice.edu>
499 * Copyright (c) 1982, 1986, 1991, 1993
500 * The Regents of the University of California. All rights reserved.
501 * (c) UNIX System Laboratories, Inc.
502 * All or some portions of this file are derived from material licensed
503 * to the University of California by American Telephone and Telegraph
504 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
505 * the permission of UNIX System Laboratories, Inc.
506 *
507 * Redistribution and use in source and binary forms, with or without
508 * modification, are permitted provided that the following conditions
509 * are met:
510 * 1. Redistributions of source code must retain the above copyright
511 * notice, this list of conditions and the following disclaimer.
512 * 2. Redistributions in binary form must reproduce the above copyright
513 * notice, this list of conditions and the following disclaimer in the
514 * documentation and/or other materials provided with the distribution.
515 * 3. Neither the name of the University nor the names of its contributors
516 * may be used to endorse or promote products derived from this software
517 * without specific prior written permission.
518 *
519 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
520 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
521 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
522 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
523 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
524 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
525 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
526 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
527 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
528 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
529 * SUCH DAMAGE.
530 *
531 * @(#)kern_subr.c 8.3 (Berkeley) 1/21/94
532 * $FreeBSD: src/sys/i386/i386/uio_machdep.c,v 1.1 2004/03/21 20:28:36 alc Exp $
533 */
534
535 /*
536 * Implement uiomove(9) from physical memory using lwbuf's to reduce
537 * the creation and destruction of ephemeral mappings.
538 */
539 int
uiomove_fromphys(vm_page_t * ma,vm_offset_t offset,size_t n,struct uio * uio)540 uiomove_fromphys(vm_page_t *ma, vm_offset_t offset, size_t n, struct uio *uio)
541 {
542 struct lwbuf lwb_cache;
543 struct lwbuf *lwb;
544 struct thread *td = curthread;
545 struct iovec *iov;
546 void *cp;
547 vm_offset_t page_offset;
548 vm_page_t m;
549 size_t cnt;
550 int error = 0;
551 int save = 0;
552
553 KASSERT(uio->uio_rw == UIO_READ || uio->uio_rw == UIO_WRITE,
554 ("uiomove_fromphys: mode"));
555 KASSERT(uio->uio_segflg != UIO_USERSPACE || uio->uio_td == curthread,
556 ("uiomove_fromphys proc"));
557
558 crit_enter();
559 save = td->td_flags & TDF_DEADLKTREAT;
560 td->td_flags |= TDF_DEADLKTREAT;
561 crit_exit();
562
563 while (n > 0 && uio->uio_resid) {
564 iov = uio->uio_iov;
565 cnt = iov->iov_len;
566 if (cnt == 0) {
567 uio->uio_iov++;
568 uio->uio_iovcnt--;
569 continue;
570 }
571 if (cnt > n)
572 cnt = n;
573 page_offset = offset & PAGE_MASK;
574 cnt = min(cnt, PAGE_SIZE - page_offset);
575 m = ma[offset >> PAGE_SHIFT];
576 lwb = lwbuf_alloc(m, &lwb_cache);
577 cp = (char *)lwbuf_kva(lwb) + page_offset;
578
579 switch (uio->uio_segflg) {
580 case UIO_USERSPACE:
581 /*
582 * note: removed uioyield (it was the wrong place to
583 * put it).
584 */
585 if (uio->uio_rw == UIO_READ)
586 error = copyout(cp, iov->iov_base, cnt);
587 else
588 error = copyin(iov->iov_base, cp, cnt);
589 if (error) {
590 lwbuf_free(lwb);
591 goto out;
592 }
593 break;
594 case UIO_SYSSPACE:
595 if (uio->uio_rw == UIO_READ)
596 bcopy(cp, iov->iov_base, cnt);
597 else
598 bcopy(iov->iov_base, cp, cnt);
599 break;
600 case UIO_NOCOPY:
601 break;
602 }
603 lwbuf_free(lwb);
604 iov->iov_base = (char *)iov->iov_base + cnt;
605 iov->iov_len -= cnt;
606 uio->uio_resid -= cnt;
607 uio->uio_offset += cnt;
608 offset += cnt;
609 n -= cnt;
610 }
611 out:
612 if (save == 0) {
613 crit_enter();
614 td->td_flags &= ~TDF_DEADLKTREAT;
615 crit_exit();
616 }
617 return (error);
618 }
619
620