 @@ -26,26 +26,27 @@
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
 #include <sys/systm.h>
 #include <sys/device.h>
 #include <sys/file.h>
 #include <sys/filedesc.h>
 #include <sys/kmem.h>
 #include "vchiq_core.h"
 #include "vchiq_ioctl.h"
 #include "vchiq_arm.h"
 #define DEVICE_NAME "vchiq"
 /* Override the default prefix, which would be vchiq_arm (from the filename) */
 #undef MODULE_PARAM_PREFIX
 #define MODULE_PARAM_PREFIX DEVICE_NAME "."
 #define VCHIQ_MINOR 0
 @@ -186,29 +187,30 @@ struct cdevsw vchiq_cdevsw = {
 	.d_stop = nostop,
 	.d_tty = notty,
 	.d_poll = nopoll,
 	.d_mmap = nommap,
 	.d_kqfilter = nokqfilter,
 	.d_discard = nodiscard,
 	.d_flag = D_OTHER | D_MPSAFE
 };
 extern struct cfdriver vchiq_cd;
 static int	vchiq_ioctl(struct file *, u_long, void *);
 static int	vchiq_close(struct file *);
 static int	vchiq_read(struct file *, off_t *, struct uio *, kauth_cred_t, int);
 static const struct fileops vchiq_fileops = {
-	.fo_read = fbadop_read,
+	.fo_read = vchiq_read,
 	.fo_write = fbadop_write,
 	.fo_ioctl = vchiq_ioctl,
 	.fo_fcntl = fnullop_fcntl,
 	.fo_poll = fnullop_poll,
 	.fo_stat = fbadop_stat,
 	.fo_close = vchiq_close,
 	.fo_kqfilter = fnullop_kqfilter,
 };
 #if 0
 static void
 dump_phys_mem(void *virt_addr, uint32_t num_bytes);
 #endif
 @@ -1235,40 +1237,36 @@ vchiq_dump(void *dump_context, const cha
 	if (context->actual < context->space) {
 		int copy_bytes;
 		if (context->offset > 0) {
 			int skip_bytes = min(len, (int)context->offset);
 			str += skip_bytes;
 			len -= skip_bytes;
 			context->offset -= skip_bytes;
 			if (context->offset > 0)
 				return;
+		}
 		copy_bytes = min(len, (int)(context->space - context->actual));
 		if (copy_bytes == 0)
 			return;
-		if (copy_to_user(context->buf + context->actual, str,
+		memcpy(context->buf + context->actual, str, copy_bytes);
 			copy_bytes))
 			context->actual = -EFAULT;
 		context->actual += copy_bytes;
 		len -= copy_bytes;
 		/* If tne terminating NUL is included in the length, then it
 		** marks the end of a line and should be replaced with a
 		** carriage return. */
 		if ((len == 0) && (str[copy_bytes - 1] == '\0')) {
 			char cr = '\n';
-			if (copy_to_user(context->buf + context->actual - 1,
+			memcpy(context->buf + context->actual - 1, &cr, 1);
 				&cr, 1))
 				context->actual = -EFAULT;
+		}
+	}
+}
 /****************************************************************************
+*
 *   vchiq_dump_platform_instance_state
+*
 ***************************************************************************/
 void
 vchiq_dump_platform_instances(void *dump_context)
+{
 @@ -1422,50 +1420,57 @@ dump_phys_mem(void *virt_addr, uint32_t
 					page_offset],
 				&kmapped_virt_ptr[page_offset], 16);
 		offset += 16;
+	}
 	if (page != NULL)
 		kunmap(page);
 	for (page_idx = 0; page_idx < num_pages; page_idx++)
 		page_cache_release(pages[page_idx]);
 	kfree(pages);
+}
 #endif
 /****************************************************************************
+*
 *   vchiq_read
+*
 ***************************************************************************/
-static ssize_t
+static int
-vchiq_read(struct file *file, char __user *buf,
+vchiq_read(struct file *file, off_t *ppos, struct uio *uio, kauth_cred_t cred,
-	size_t count, loff_t *ppos)
+    int flags)
+{
 	int result;
 	char *buf = kmem_zalloc(PAGE_SIZE, KM_SLEEP);
 	DUMP_CONTEXT_T context;
 	context.buf = buf;
 	context.actual = 0;
-	context.space = count;
+	context.space = PAGE_SIZE;
 	context.offset = *ppos;
 	vchiq_dump_state(&context, &g_state);
 	*ppos += context.actual;
-	return context.actual;
+	result = uiomove(buf, context.actual, uio);
 	kmem_free(buf, PAGE_SIZE);
 	return result;
+}
 #endif
 VCHIQ_STATE_T *
 vchiq_get_state(void)
+{
 	if (g_state.remote == NULL)
 		printk(KERN_ERR "%s: g_state.remote == NULL\n", __func__);
 	else if (g_state.remote->initialised != 1)
 		printk(KERN_NOTICE "%s: g_state.remote->initialised != 1 (%d)\n",
 			__func__, g_state.remote->initialised);
 	return ((g_state.remote != NULL) &&
 		(g_state.remote->initialised == 1)) ? &g_state : NULL;