~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/arch/x86/kernel/vm86_32.c

Version: ~ [ linux-6.0-rc6 ] ~ [ linux-5.19.10 ] ~ [ linux-5.18.19 ] ~ [ linux-5.17.15 ] ~ [ linux-5.16.20 ] ~ [ linux-5.15.69 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.144 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.214 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.259 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.294 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.329 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.302 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.9 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  *  Copyright (C) 1994  Linus Torvalds
  3  *
  4  *  29 dec 2001 - Fixed oopses caused by unchecked access to the vm86
  5  *                stack - Manfred Spraul <manfred@colorfullife.com>
  6  *
  7  *  22 mar 2002 - Manfred detected the stackfaults, but didn't handle
  8  *                them correctly. Now the emulation will be in a
  9  *                consistent state after stackfaults - Kasper Dupont
 10  *                <kasperd@daimi.au.dk>
 11  *
 12  *  22 mar 2002 - Added missing clear_IF in set_vflags_* Kasper Dupont
 13  *                <kasperd@daimi.au.dk>
 14  *
 15  *  ?? ??? 2002 - Fixed premature returns from handle_vm86_fault
 16  *                caused by Kasper Dupont's changes - Stas Sergeev
 17  *
 18  *   4 apr 2002 - Fixed CHECK_IF_IN_TRAP broken by Stas' changes.
 19  *                Kasper Dupont <kasperd@daimi.au.dk>
 20  *
 21  *   9 apr 2002 - Changed syntax of macros in handle_vm86_fault.
 22  *                Kasper Dupont <kasperd@daimi.au.dk>
 23  *
 24  *   9 apr 2002 - Changed stack access macros to jump to a label
 25  *                instead of returning to userspace. This simplifies
 26  *                do_int, and is needed by handle_vm6_fault. Kasper
 27  *                Dupont <kasperd@daimi.au.dk>
 28  *
 29  */
 30 
 31 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 32 
 33 #include <linux/capability.h>
 34 #include <linux/errno.h>
 35 #include <linux/interrupt.h>
 36 #include <linux/syscalls.h>
 37 #include <linux/sched.h>
 38 #include <linux/kernel.h>
 39 #include <linux/signal.h>
 40 #include <linux/string.h>
 41 #include <linux/mm.h>
 42 #include <linux/smp.h>
 43 #include <linux/highmem.h>
 44 #include <linux/ptrace.h>
 45 #include <linux/audit.h>
 46 #include <linux/stddef.h>
 47 #include <linux/slab.h>
 48 #include <linux/security.h>
 49 
 50 #include <asm/uaccess.h>
 51 #include <asm/io.h>
 52 #include <asm/tlbflush.h>
 53 #include <asm/irq.h>
 54 #include <asm/traps.h>
 55 #include <asm/vm86.h>
 56 
 57 /*
 58  * Known problems:
 59  *
 60  * Interrupt handling is not guaranteed:
 61  * - a real x86 will disable all interrupts for one instruction
 62  *   after a "mov ss,xx" to make stack handling atomic even without
 63  *   the 'lss' instruction. We can't guarantee this in v86 mode,
 64  *   as the next instruction might result in a page fault or similar.
 65  * - a real x86 will have interrupts disabled for one instruction
 66  *   past the 'sti' that enables them. We don't bother with all the
 67  *   details yet.
 68  *
 69  * Let's hope these problems do not actually matter for anything.
 70  */
 71 
 72 
 73 /*
 74  * 8- and 16-bit register defines..
 75  */
 76 #define AL(regs)        (((unsigned char *)&((regs)->pt.ax))[0])
 77 #define AH(regs)        (((unsigned char *)&((regs)->pt.ax))[1])
 78 #define IP(regs)        (*(unsigned short *)&((regs)->pt.ip))
 79 #define SP(regs)        (*(unsigned short *)&((regs)->pt.sp))
 80 
 81 /*
 82  * virtual flags (16 and 32-bit versions)
 83  */
 84 #define VFLAGS  (*(unsigned short *)&(current->thread.vm86->veflags))
 85 #define VEFLAGS (current->thread.vm86->veflags)
 86 
 87 #define set_flags(X, new, mask) \
 88 ((X) = ((X) & ~(mask)) | ((new) & (mask)))
 89 
 90 #define SAFE_MASK       (0xDD5)
 91 #define RETURN_MASK     (0xDFF)
 92 
 93 void save_v86_state(struct kernel_vm86_regs *regs, int retval)
 94 {
 95         struct tss_struct *tss;
 96         struct task_struct *tsk = current;
 97         struct vm86plus_struct __user *user;
 98         struct vm86 *vm86 = current->thread.vm86;
 99         long err = 0;
100 
101         /*
102          * This gets called from entry.S with interrupts disabled, but
103          * from process context. Enable interrupts here, before trying
104          * to access user space.
105          */
106         local_irq_enable();
107 
108         if (!vm86 || !vm86->user_vm86) {
109                 pr_alert("no user_vm86: BAD\n");
110                 do_exit(SIGSEGV);
111         }
112         set_flags(regs->pt.flags, VEFLAGS, X86_EFLAGS_VIF | vm86->veflags_mask);
113         user = vm86->user_vm86;
114 
115         if (!access_ok(VERIFY_WRITE, user, vm86->vm86plus.is_vm86pus ?
116                        sizeof(struct vm86plus_struct) :
117                        sizeof(struct vm86_struct))) {
118                 pr_alert("could not access userspace vm86 info\n");
119                 do_exit(SIGSEGV);
120         }
121 
122         put_user_try {
123                 put_user_ex(regs->pt.bx, &user->regs.ebx);
124                 put_user_ex(regs->pt.cx, &user->regs.ecx);
125                 put_user_ex(regs->pt.dx, &user->regs.edx);
126                 put_user_ex(regs->pt.si, &user->regs.esi);
127                 put_user_ex(regs->pt.di, &user->regs.edi);
128                 put_user_ex(regs->pt.bp, &user->regs.ebp);
129                 put_user_ex(regs->pt.ax, &user->regs.eax);
130                 put_user_ex(regs->pt.ip, &user->regs.eip);
131                 put_user_ex(regs->pt.cs, &user->regs.cs);
132                 put_user_ex(regs->pt.flags, &user->regs.eflags);
133                 put_user_ex(regs->pt.sp, &user->regs.esp);
134                 put_user_ex(regs->pt.ss, &user->regs.ss);
135                 put_user_ex(regs->es, &user->regs.es);
136                 put_user_ex(regs->ds, &user->regs.ds);
137                 put_user_ex(regs->fs, &user->regs.fs);
138                 put_user_ex(regs->gs, &user->regs.gs);
139 
140                 put_user_ex(vm86->screen_bitmap, &user->screen_bitmap);
141         } put_user_catch(err);
142         if (err) {
143                 pr_alert("could not access userspace vm86 info\n");
144                 do_exit(SIGSEGV);
145         }
146 
147         tss = &per_cpu(cpu_tss, get_cpu());
148         tsk->thread.sp0 = vm86->saved_sp0;
149         tsk->thread.sysenter_cs = __KERNEL_CS;
150         load_sp0(tss, &tsk->thread);
151         vm86->saved_sp0 = 0;
152         put_cpu();
153 
154         memcpy(&regs->pt, &vm86->regs32, sizeof(struct pt_regs));
155 
156         lazy_load_gs(vm86->regs32.gs);
157 
158         regs->pt.ax = retval;
159 }
160 
161 static void mark_screen_rdonly(struct mm_struct *mm)
162 {
163         pgd_t *pgd;
164         pud_t *pud;
165         pmd_t *pmd;
166         pte_t *pte;
167         spinlock_t *ptl;
168         int i;
169 
170         down_write(&mm->mmap_sem);
171         pgd = pgd_offset(mm, 0xA0000);
172         if (pgd_none_or_clear_bad(pgd))
173                 goto out;
174         pud = pud_offset(pgd, 0xA0000);
175         if (pud_none_or_clear_bad(pud))
176                 goto out;
177         pmd = pmd_offset(pud, 0xA0000);
178         split_huge_page_pmd_mm(mm, 0xA0000, pmd);
179         if (pmd_none_or_clear_bad(pmd))
180                 goto out;
181         pte = pte_offset_map_lock(mm, pmd, 0xA0000, &ptl);
182         for (i = 0; i < 32; i++) {
183                 if (pte_present(*pte))
184                         set_pte(pte, pte_wrprotect(*pte));
185                 pte++;
186         }
187         pte_unmap_unlock(pte, ptl);
188 out:
189         up_write(&mm->mmap_sem);
190         flush_tlb_mm_range(mm, 0xA0000, 0xA0000 + 32*PAGE_SIZE, 0UL);
191 }
192 
193 
194 
195 static int do_vm86_irq_handling(int subfunction, int irqnumber);
196 static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus);
197 
198 SYSCALL_DEFINE1(vm86old, struct vm86_struct __user *, user_vm86)
199 {
200         return do_sys_vm86((struct vm86plus_struct __user *) user_vm86, false);
201 }
202 
203 
204 SYSCALL_DEFINE2(vm86, unsigned long, cmd, unsigned long, arg)
205 {
206         switch (cmd) {
207         case VM86_REQUEST_IRQ:
208         case VM86_FREE_IRQ:
209         case VM86_GET_IRQ_BITS:
210         case VM86_GET_AND_RESET_IRQ:
211                 return do_vm86_irq_handling(cmd, (int)arg);
212         case VM86_PLUS_INSTALL_CHECK:
213                 /*
214                  * NOTE: on old vm86 stuff this will return the error
215                  *  from access_ok(), because the subfunction is
216                  *  interpreted as (invalid) address to vm86_struct.
217                  *  So the installation check works.
218                  */
219                 return 0;
220         }
221 
222         /* we come here only for functions VM86_ENTER, VM86_ENTER_NO_BYPASS */
223         return do_sys_vm86((struct vm86plus_struct __user *) arg, true);
224 }
225 
226 
227 static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus)
228 {
229         struct tss_struct *tss;
230         struct task_struct *tsk = current;
231         struct vm86 *vm86 = tsk->thread.vm86;
232         struct kernel_vm86_regs vm86regs;
233         struct pt_regs *regs = current_pt_regs();
234         unsigned long err = 0;
235 
236         err = security_mmap_addr(0);
237         if (err) {
238                 /*
239                  * vm86 cannot virtualize the address space, so vm86 users
240                  * need to manage the low 1MB themselves using mmap.  Given
241                  * that BIOS places important data in the first page, vm86
242                  * is essentially useless if mmap_min_addr != 0.  DOSEMU,
243                  * for example, won't even bother trying to use vm86 if it
244                  * can't map a page at virtual address 0.
245                  *
246                  * To reduce the available kernel attack surface, simply
247                  * disallow vm86(old) for users who cannot mmap at va 0.
248                  *
249                  * The implementation of security_mmap_addr will allow
250                  * suitably privileged users to map va 0 even if
251                  * vm.mmap_min_addr is set above 0, and we want this
252                  * behavior for vm86 as well, as it ensures that legacy
253                  * tools like vbetool will not fail just because of
254                  * vm.mmap_min_addr.
255                  */
256                 pr_info_once("Denied a call to vm86(old) from %s[%d] (uid: %d).  Set the vm.mmap_min_addr sysctl to 0 and/or adjust LSM mmap_min_addr policy to enable vm86 if you are using a vm86-based DOS emulator.\n",
257                              current->comm, task_pid_nr(current),
258                              from_kuid_munged(&init_user_ns, current_uid()));
259                 return -EPERM;
260         }
261 
262         if (!vm86) {
263                 if (!(vm86 = kzalloc(sizeof(*vm86), GFP_KERNEL)))
264                         return -ENOMEM;
265                 tsk->thread.vm86 = vm86;
266         }
267         if (vm86->saved_sp0)
268                 return -EPERM;
269 
270         if (!access_ok(VERIFY_READ, user_vm86, plus ?
271                        sizeof(struct vm86_struct) :
272                        sizeof(struct vm86plus_struct)))
273                 return -EFAULT;
274 
275         memset(&vm86regs, 0, sizeof(vm86regs));
276         get_user_try {
277                 unsigned short seg;
278                 get_user_ex(vm86regs.pt.bx, &user_vm86->regs.ebx);
279                 get_user_ex(vm86regs.pt.cx, &user_vm86->regs.ecx);
280                 get_user_ex(vm86regs.pt.dx, &user_vm86->regs.edx);
281                 get_user_ex(vm86regs.pt.si, &user_vm86->regs.esi);
282                 get_user_ex(vm86regs.pt.di, &user_vm86->regs.edi);
283                 get_user_ex(vm86regs.pt.bp, &user_vm86->regs.ebp);
284                 get_user_ex(vm86regs.pt.ax, &user_vm86->regs.eax);
285                 get_user_ex(vm86regs.pt.ip, &user_vm86->regs.eip);
286                 get_user_ex(seg, &user_vm86->regs.cs);
287                 vm86regs.pt.cs = seg;
288                 get_user_ex(vm86regs.pt.flags, &user_vm86->regs.eflags);
289                 get_user_ex(vm86regs.pt.sp, &user_vm86->regs.esp);
290                 get_user_ex(seg, &user_vm86->regs.ss);
291                 vm86regs.pt.ss = seg;
292                 get_user_ex(vm86regs.es, &user_vm86->regs.es);
293                 get_user_ex(vm86regs.ds, &user_vm86->regs.ds);
294                 get_user_ex(vm86regs.fs, &user_vm86->regs.fs);
295                 get_user_ex(vm86regs.gs, &user_vm86->regs.gs);
296 
297                 get_user_ex(vm86->flags, &user_vm86->flags);
298                 get_user_ex(vm86->screen_bitmap, &user_vm86->screen_bitmap);
299                 get_user_ex(vm86->cpu_type, &user_vm86->cpu_type);
300         } get_user_catch(err);
301         if (err)
302                 return err;
303 
304         if (copy_from_user(&vm86->int_revectored,
305                            &user_vm86->int_revectored,
306                            sizeof(struct revectored_struct)))
307                 return -EFAULT;
308         if (copy_from_user(&vm86->int21_revectored,
309                            &user_vm86->int21_revectored,
310                            sizeof(struct revectored_struct)))
311                 return -EFAULT;
312         if (plus) {
313                 if (copy_from_user(&vm86->vm86plus, &user_vm86->vm86plus,
314                                    sizeof(struct vm86plus_info_struct)))
315                         return -EFAULT;
316                 vm86->vm86plus.is_vm86pus = 1;
317         } else
318                 memset(&vm86->vm86plus, 0,
319                        sizeof(struct vm86plus_info_struct));
320 
321         memcpy(&vm86->regs32, regs, sizeof(struct pt_regs));
322         vm86->user_vm86 = user_vm86;
323 
324 /*
325  * The flags register is also special: we cannot trust that the user
326  * has set it up safely, so this makes sure interrupt etc flags are
327  * inherited from protected mode.
328  */
329         VEFLAGS = vm86regs.pt.flags;
330         vm86regs.pt.flags &= SAFE_MASK;
331         vm86regs.pt.flags |= regs->flags & ~SAFE_MASK;
332         vm86regs.pt.flags |= X86_VM_MASK;
333 
334         vm86regs.pt.orig_ax = regs->orig_ax;
335 
336         switch (vm86->cpu_type) {
337         case CPU_286:
338                 vm86->veflags_mask = 0;
339                 break;
340         case CPU_386:
341                 vm86->veflags_mask = X86_EFLAGS_NT | X86_EFLAGS_IOPL;
342                 break;
343         case CPU_486:
344                 vm86->veflags_mask = X86_EFLAGS_AC | X86_EFLAGS_NT | X86_EFLAGS_IOPL;
345                 break;
346         default:
347                 vm86->veflags_mask = X86_EFLAGS_ID | X86_EFLAGS_AC | X86_EFLAGS_NT | X86_EFLAGS_IOPL;
348                 break;
349         }
350 
351 /*
352  * Save old state
353  */
354         vm86->saved_sp0 = tsk->thread.sp0;
355         lazy_save_gs(vm86->regs32.gs);
356 
357         tss = &per_cpu(cpu_tss, get_cpu());
358         /* make room for real-mode segments */
359         tsk->thread.sp0 += 16;
360 
361         if (static_cpu_has(X86_FEATURE_SEP))
362                 tsk->thread.sysenter_cs = 0;
363 
364         load_sp0(tss, &tsk->thread);
365         put_cpu();
366 
367         if (vm86->flags & VM86_SCREEN_BITMAP)
368                 mark_screen_rdonly(tsk->mm);
369 
370         memcpy((struct kernel_vm86_regs *)regs, &vm86regs, sizeof(vm86regs));
371         force_iret();
372         return regs->ax;
373 }
374 
375 static inline void set_IF(struct kernel_vm86_regs *regs)
376 {
377         VEFLAGS |= X86_EFLAGS_VIF;
378 }
379 
380 static inline void clear_IF(struct kernel_vm86_regs *regs)
381 {
382         VEFLAGS &= ~X86_EFLAGS_VIF;
383 }
384 
385 static inline void clear_TF(struct kernel_vm86_regs *regs)
386 {
387         regs->pt.flags &= ~X86_EFLAGS_TF;
388 }
389 
390 static inline void clear_AC(struct kernel_vm86_regs *regs)
391 {
392         regs->pt.flags &= ~X86_EFLAGS_AC;
393 }
394 
395 /*
396  * It is correct to call set_IF(regs) from the set_vflags_*
397  * functions. However someone forgot to call clear_IF(regs)
398  * in the opposite case.
399  * After the command sequence CLI PUSHF STI POPF you should
400  * end up with interrupts disabled, but you ended up with
401  * interrupts enabled.
402  *  ( I was testing my own changes, but the only bug I
403  *    could find was in a function I had not changed. )
404  * [KD]
405  */
406 
407 static inline void set_vflags_long(unsigned long flags, struct kernel_vm86_regs *regs)
408 {
409         set_flags(VEFLAGS, flags, current->thread.vm86->veflags_mask);
410         set_flags(regs->pt.flags, flags, SAFE_MASK);
411         if (flags & X86_EFLAGS_IF)
412                 set_IF(regs);
413         else
414                 clear_IF(regs);
415 }
416 
417 static inline void set_vflags_short(unsigned short flags, struct kernel_vm86_regs *regs)
418 {
419         set_flags(VFLAGS, flags, current->thread.vm86->veflags_mask);
420         set_flags(regs->pt.flags, flags, SAFE_MASK);
421         if (flags & X86_EFLAGS_IF)
422                 set_IF(regs);
423         else
424                 clear_IF(regs);
425 }
426 
427 static inline unsigned long get_vflags(struct kernel_vm86_regs *regs)
428 {
429         unsigned long flags = regs->pt.flags & RETURN_MASK;
430 
431         if (VEFLAGS & X86_EFLAGS_VIF)
432                 flags |= X86_EFLAGS_IF;
433         flags |= X86_EFLAGS_IOPL;
434         return flags | (VEFLAGS & current->thread.vm86->veflags_mask);
435 }
436 
437 static inline int is_revectored(int nr, struct revectored_struct *bitmap)
438 {
439         __asm__ __volatile__("btl %2,%1\n\tsbbl %0,%0"
440                 :"=r" (nr)
441                 :"m" (*bitmap), "r" (nr));
442         return nr;
443 }
444 
445 #define val_byte(val, n) (((__u8 *)&val)[n])
446 
447 #define pushb(base, ptr, val, err_label) \
448         do { \
449                 __u8 __val = val; \
450                 ptr--; \
451                 if (put_user(__val, base + ptr) < 0) \
452                         goto err_label; \
453         } while (0)
454 
455 #define pushw(base, ptr, val, err_label) \
456         do { \
457                 __u16 __val = val; \
458                 ptr--; \
459                 if (put_user(val_byte(__val, 1), base + ptr) < 0) \
460                         goto err_label; \
461                 ptr--; \
462                 if (put_user(val_byte(__val, 0), base + ptr) < 0) \
463                         goto err_label; \
464         } while (0)
465 
466 #define pushl(base, ptr, val, err_label) \
467         do { \
468                 __u32 __val = val; \
469                 ptr--; \
470                 if (put_user(val_byte(__val, 3), base + ptr) < 0) \
471                         goto err_label; \
472                 ptr--; \
473                 if (put_user(val_byte(__val, 2), base + ptr) < 0) \
474                         goto err_label; \
475                 ptr--; \
476                 if (put_user(val_byte(__val, 1), base + ptr) < 0) \
477                         goto err_label; \
478                 ptr--; \
479                 if (put_user(val_byte(__val, 0), base + ptr) < 0) \
480                         goto err_label; \
481         } while (0)
482 
483 #define popb(base, ptr, err_label) \
484         ({ \
485                 __u8 __res; \
486                 if (get_user(__res, base + ptr) < 0) \
487                         goto err_label; \
488                 ptr++; \
489                 __res; \
490         })
491 
492 #define popw(base, ptr, err_label) \
493         ({ \
494                 __u16 __res; \
495                 if (get_user(val_byte(__res, 0), base + ptr) < 0) \
496                         goto err_label; \
497                 ptr++; \
498                 if (get_user(val_byte(__res, 1), base + ptr) < 0) \
499                         goto err_label; \
500                 ptr++; \
501                 __res; \
502         })
503 
504 #define popl(base, ptr, err_label) \
505         ({ \
506                 __u32 __res; \
507                 if (get_user(val_byte(__res, 0), base + ptr) < 0) \
508                         goto err_label; \
509                 ptr++; \
510                 if (get_user(val_byte(__res, 1), base + ptr) < 0) \
511                         goto err_label; \
512                 ptr++; \
513                 if (get_user(val_byte(__res, 2), base + ptr) < 0) \
514                         goto err_label; \
515                 ptr++; \
516                 if (get_user(val_byte(__res, 3), base + ptr) < 0) \
517                         goto err_label; \
518                 ptr++; \
519                 __res; \
520         })
521 
522 /* There are so many possible reasons for this function to return
523  * VM86_INTx, so adding another doesn't bother me. We can expect
524  * userspace programs to be able to handle it. (Getting a problem
525  * in userspace is always better than an Oops anyway.) [KD]
526  */
527 static void do_int(struct kernel_vm86_regs *regs, int i,
528     unsigned char __user *ssp, unsigned short sp)
529 {
530         unsigned long __user *intr_ptr;
531         unsigned long segoffs;
532         struct vm86 *vm86 = current->thread.vm86;
533 
534         if (regs->pt.cs == BIOSSEG)
535                 goto cannot_handle;
536         if (is_revectored(i, &vm86->int_revectored))
537                 goto cannot_handle;
538         if (i == 0x21 && is_revectored(AH(regs), &vm86->int21_revectored))
539                 goto cannot_handle;
540         intr_ptr = (unsigned long __user *) (i << 2);
541         if (get_user(segoffs, intr_ptr))
542                 goto cannot_handle;
543         if ((segoffs >> 16) == BIOSSEG)
544                 goto cannot_handle;
545         pushw(ssp, sp, get_vflags(regs), cannot_handle);
546         pushw(ssp, sp, regs->pt.cs, cannot_handle);
547         pushw(ssp, sp, IP(regs), cannot_handle);
548         regs->pt.cs = segoffs >> 16;
549         SP(regs) -= 6;
550         IP(regs) = segoffs & 0xffff;
551         clear_TF(regs);
552         clear_IF(regs);
553         clear_AC(regs);
554         return;
555 
556 cannot_handle:
557         save_v86_state(regs, VM86_INTx + (i << 8));
558 }
559 
560 int handle_vm86_trap(struct kernel_vm86_regs *regs, long error_code, int trapno)
561 {
562         struct vm86 *vm86 = current->thread.vm86;
563 
564         if (vm86->vm86plus.is_vm86pus) {
565                 if ((trapno == 3) || (trapno == 1)) {
566                         save_v86_state(regs, VM86_TRAP + (trapno << 8));
567                         return 0;
568                 }
569                 do_int(regs, trapno, (unsigned char __user *) (regs->pt.ss << 4), SP(regs));
570                 return 0;
571         }
572         if (trapno != 1)
573                 return 1; /* we let this handle by the calling routine */
574         current->thread.trap_nr = trapno;
575         current->thread.error_code = error_code;
576         force_sig(SIGTRAP, current);
577         return 0;
578 }
579 
580 void handle_vm86_fault(struct kernel_vm86_regs *regs, long error_code)
581 {
582         unsigned char opcode;
583         unsigned char __user *csp;
584         unsigned char __user *ssp;
585         unsigned short ip, sp, orig_flags;
586         int data32, pref_done;
587         struct vm86plus_info_struct *vmpi = &current->thread.vm86->vm86plus;
588 
589 #define CHECK_IF_IN_TRAP \
590         if (vmpi->vm86dbg_active && vmpi->vm86dbg_TFpendig) \
591                 newflags |= X86_EFLAGS_TF
592 
593         orig_flags = *(unsigned short *)&regs->pt.flags;
594 
595         csp = (unsigned char __user *) (regs->pt.cs << 4);
596         ssp = (unsigned char __user *) (regs->pt.ss << 4);
597         sp = SP(regs);
598         ip = IP(regs);
599 
600         data32 = 0;
601         pref_done = 0;
602         do {
603                 switch (opcode = popb(csp, ip, simulate_sigsegv)) {
604                 case 0x66:      /* 32-bit data */     data32 = 1; break;
605                 case 0x67:      /* 32-bit address */  break;
606                 case 0x2e:      /* CS */              break;
607                 case 0x3e:      /* DS */              break;
608                 case 0x26:      /* ES */              break;
609                 case 0x36:      /* SS */              break;
610                 case 0x65:      /* GS */              break;
611                 case 0x64:      /* FS */              break;
612                 case 0xf2:      /* repnz */       break;
613                 case 0xf3:      /* rep */             break;
614                 default: pref_done = 1;
615                 }
616         } while (!pref_done);
617 
618         switch (opcode) {
619 
620         /* pushf */
621         case 0x9c:
622                 if (data32) {
623                         pushl(ssp, sp, get_vflags(regs), simulate_sigsegv);
624                         SP(regs) -= 4;
625                 } else {
626                         pushw(ssp, sp, get_vflags(regs), simulate_sigsegv);
627                         SP(regs) -= 2;
628                 }
629                 IP(regs) = ip;
630                 goto vm86_fault_return;
631 
632         /* popf */
633         case 0x9d:
634                 {
635                 unsigned long newflags;
636                 if (data32) {
637                         newflags = popl(ssp, sp, simulate_sigsegv);
638                         SP(regs) += 4;
639                 } else {
640                         newflags = popw(ssp, sp, simulate_sigsegv);
641                         SP(regs) += 2;
642                 }
643                 IP(regs) = ip;
644                 CHECK_IF_IN_TRAP;
645                 if (data32)
646                         set_vflags_long(newflags, regs);
647                 else
648                         set_vflags_short(newflags, regs);
649 
650                 goto check_vip;
651                 }
652 
653         /* int xx */
654         case 0xcd: {
655                 int intno = popb(csp, ip, simulate_sigsegv);
656                 IP(regs) = ip;
657                 if (vmpi->vm86dbg_active) {
658                         if ((1 << (intno & 7)) & vmpi->vm86dbg_intxxtab[intno >> 3]) {
659                                 save_v86_state(regs, VM86_INTx + (intno << 8));
660                                 return;
661                         }
662                 }
663                 do_int(regs, intno, ssp, sp);
664                 return;
665         }
666 
667         /* iret */
668         case 0xcf:
669                 {
670                 unsigned long newip;
671                 unsigned long newcs;
672                 unsigned long newflags;
673                 if (data32) {
674                         newip = popl(ssp, sp, simulate_sigsegv);
675                         newcs = popl(ssp, sp, simulate_sigsegv);
676                         newflags = popl(ssp, sp, simulate_sigsegv);
677                         SP(regs) += 12;
678                 } else {
679                         newip = popw(ssp, sp, simulate_sigsegv);
680                         newcs = popw(ssp, sp, simulate_sigsegv);
681                         newflags = popw(ssp, sp, simulate_sigsegv);
682                         SP(regs) += 6;
683                 }
684                 IP(regs) = newip;
685                 regs->pt.cs = newcs;
686                 CHECK_IF_IN_TRAP;
687                 if (data32) {
688                         set_vflags_long(newflags, regs);
689                 } else {
690                         set_vflags_short(newflags, regs);
691                 }
692                 goto check_vip;
693                 }
694 
695         /* cli */
696         case 0xfa:
697                 IP(regs) = ip;
698                 clear_IF(regs);
699                 goto vm86_fault_return;
700 
701         /* sti */
702         /*
703          * Damn. This is incorrect: the 'sti' instruction should actually
704          * enable interrupts after the /next/ instruction. Not good.
705          *
706          * Probably needs some horsing around with the TF flag. Aiee..
707          */
708         case 0xfb:
709                 IP(regs) = ip;
710                 set_IF(regs);
711                 goto check_vip;
712 
713         default:
714                 save_v86_state(regs, VM86_UNKNOWN);
715         }
716 
717         return;
718 
719 check_vip:
720         if ((VEFLAGS & (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) ==
721             (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) {
722                 save_v86_state(regs, VM86_STI);
723                 return;
724         }
725 
726 vm86_fault_return:
727         if (vmpi->force_return_for_pic  && (VEFLAGS & (X86_EFLAGS_IF | X86_EFLAGS_VIF))) {
728                 save_v86_state(regs, VM86_PICRETURN);
729                 return;
730         }
731         if (orig_flags & X86_EFLAGS_TF)
732                 handle_vm86_trap(regs, 0, X86_TRAP_DB);
733         return;
734 
735 simulate_sigsegv:
736         /* FIXME: After a long discussion with Stas we finally
737          *        agreed, that this is wrong. Here we should
738          *        really send a SIGSEGV to the user program.
739          *        But how do we create the correct context? We
740          *        are inside a general protection fault handler
741          *        and has just returned from a page fault handler.
742          *        The correct context for the signal handler
743          *        should be a mixture of the two, but how do we
744          *        get the information? [KD]
745          */
746         save_v86_state(regs, VM86_UNKNOWN);
747 }
748 
749 /* ---------------- vm86 special IRQ passing stuff ----------------- */
750 
751 #define VM86_IRQNAME            "vm86irq"
752 
753 static struct vm86_irqs {
754         struct task_struct *tsk;
755         int sig;
756 } vm86_irqs[16];
757 
758 static DEFINE_SPINLOCK(irqbits_lock);
759 static int irqbits;
760 
761 #define ALLOWED_SIGS (1 /* 0 = don't send a signal */ \
762         | (1 << SIGUSR1) | (1 << SIGUSR2) | (1 << SIGIO)  | (1 << SIGURG) \
763         | (1 << SIGUNUSED))
764 
765 static irqreturn_t irq_handler(int intno, void *dev_id)
766 {
767         int irq_bit;
768         unsigned long flags;
769 
770         spin_lock_irqsave(&irqbits_lock, flags);
771         irq_bit = 1 << intno;
772         if ((irqbits & irq_bit) || !vm86_irqs[intno].tsk)
773                 goto out;
774         irqbits |= irq_bit;
775         if (vm86_irqs[intno].sig)
776                 send_sig(vm86_irqs[intno].sig, vm86_irqs[intno].tsk, 1);
777         /*
778          * IRQ will be re-enabled when user asks for the irq (whether
779          * polling or as a result of the signal)
780          */
781         disable_irq_nosync(intno);
782         spin_unlock_irqrestore(&irqbits_lock, flags);
783         return IRQ_HANDLED;
784 
785 out:
786         spin_unlock_irqrestore(&irqbits_lock, flags);
787         return IRQ_NONE;
788 }
789 
790 static inline void free_vm86_irq(int irqnumber)
791 {
792         unsigned long flags;
793 
794         free_irq(irqnumber, NULL);
795         vm86_irqs[irqnumber].tsk = NULL;
796 
797         spin_lock_irqsave(&irqbits_lock, flags);
798         irqbits &= ~(1 << irqnumber);
799         spin_unlock_irqrestore(&irqbits_lock, flags);
800 }
801 
802 void release_vm86_irqs(struct task_struct *task)
803 {
804         int i;
805         for (i = FIRST_VM86_IRQ ; i <= LAST_VM86_IRQ; i++)
806             if (vm86_irqs[i].tsk == task)
807                 free_vm86_irq(i);
808 }
809 
810 static inline int get_and_reset_irq(int irqnumber)
811 {
812         int bit;
813         unsigned long flags;
814         int ret = 0;
815 
816         if (invalid_vm86_irq(irqnumber)) return 0;
817         if (vm86_irqs[irqnumber].tsk != current) return 0;
818         spin_lock_irqsave(&irqbits_lock, flags);
819         bit = irqbits & (1 << irqnumber);
820         irqbits &= ~bit;
821         if (bit) {
822                 enable_irq(irqnumber);
823                 ret = 1;
824         }
825 
826         spin_unlock_irqrestore(&irqbits_lock, flags);
827         return ret;
828 }
829 
830 
831 static int do_vm86_irq_handling(int subfunction, int irqnumber)
832 {
833         int ret;
834         switch (subfunction) {
835                 case VM86_GET_AND_RESET_IRQ: {
836                         return get_and_reset_irq(irqnumber);
837                 }
838                 case VM86_GET_IRQ_BITS: {
839                         return irqbits;
840                 }
841                 case VM86_REQUEST_IRQ: {
842                         int sig = irqnumber >> 8;
843                         int irq = irqnumber & 255;
844                         if (!capable(CAP_SYS_ADMIN)) return -EPERM;
845                         if (!((1 << sig) & ALLOWED_SIGS)) return -EPERM;
846                         if (invalid_vm86_irq(irq)) return -EPERM;
847                         if (vm86_irqs[irq].tsk) return -EPERM;
848                         ret = request_irq(irq, &irq_handler, 0, VM86_IRQNAME, NULL);
849                         if (ret) return ret;
850                         vm86_irqs[irq].sig = sig;
851                         vm86_irqs[irq].tsk = current;
852                         return irq;
853                 }
854                 case  VM86_FREE_IRQ: {
855                         if (invalid_vm86_irq(irqnumber)) return -EPERM;
856                         if (!vm86_irqs[irqnumber].tsk) return 0;
857                         if (vm86_irqs[irqnumber].tsk != current) return -EPERM;
858                         free_vm86_irq(irqnumber);
859                         return 0;
860                 }
861         }
862         return -EINVAL;
863 }
864 
865 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp