~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/arch/x86/kernel/vm86_32.c

Version: ~ [ linux-5.16 ] ~ [ linux-5.15.13 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.90 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.170 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.224 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.261 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.296 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.298 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 // SPDX-License-Identifier: GPL-2.0
  2 /*
  3  *  Copyright (C) 1994  Linus Torvalds
  4  *
  5  *  29 dec 2001 - Fixed oopses caused by unchecked access to the vm86
  6  *                stack - Manfred Spraul <manfred@colorfullife.com>
  7  *
  8  *  22 mar 2002 - Manfred detected the stackfaults, but didn't handle
  9  *                them correctly. Now the emulation will be in a
 10  *                consistent state after stackfaults - Kasper Dupont
 11  *                <kasperd@daimi.au.dk>
 12  *
 13  *  22 mar 2002 - Added missing clear_IF in set_vflags_* Kasper Dupont
 14  *                <kasperd@daimi.au.dk>
 15  *
 16  *  ?? ??? 2002 - Fixed premature returns from handle_vm86_fault
 17  *                caused by Kasper Dupont's changes - Stas Sergeev
 18  *
 19  *   4 apr 2002 - Fixed CHECK_IF_IN_TRAP broken by Stas' changes.
 20  *                Kasper Dupont <kasperd@daimi.au.dk>
 21  *
 22  *   9 apr 2002 - Changed syntax of macros in handle_vm86_fault.
 23  *                Kasper Dupont <kasperd@daimi.au.dk>
 24  *
 25  *   9 apr 2002 - Changed stack access macros to jump to a label
 26  *                instead of returning to userspace. This simplifies
 27  *                do_int, and is needed by handle_vm6_fault. Kasper
 28  *                Dupont <kasperd@daimi.au.dk>
 29  *
 30  */
 31 
 32 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 33 
 34 #include <linux/capability.h>
 35 #include <linux/errno.h>
 36 #include <linux/interrupt.h>
 37 #include <linux/syscalls.h>
 38 #include <linux/sched.h>
 39 #include <linux/sched/task_stack.h>
 40 #include <linux/kernel.h>
 41 #include <linux/signal.h>
 42 #include <linux/string.h>
 43 #include <linux/mm.h>
 44 #include <linux/smp.h>
 45 #include <linux/highmem.h>
 46 #include <linux/ptrace.h>
 47 #include <linux/audit.h>
 48 #include <linux/stddef.h>
 49 #include <linux/slab.h>
 50 #include <linux/security.h>
 51 
 52 #include <linux/uaccess.h>
 53 #include <asm/io.h>
 54 #include <asm/tlbflush.h>
 55 #include <asm/irq.h>
 56 #include <asm/traps.h>
 57 #include <asm/vm86.h>
 58 #include <asm/switch_to.h>
 59 
 60 /*
 61  * Known problems:
 62  *
 63  * Interrupt handling is not guaranteed:
 64  * - a real x86 will disable all interrupts for one instruction
 65  *   after a "mov ss,xx" to make stack handling atomic even without
 66  *   the 'lss' instruction. We can't guarantee this in v86 mode,
 67  *   as the next instruction might result in a page fault or similar.
 68  * - a real x86 will have interrupts disabled for one instruction
 69  *   past the 'sti' that enables them. We don't bother with all the
 70  *   details yet.
 71  *
 72  * Let's hope these problems do not actually matter for anything.
 73  */
 74 
 75 
 76 /*
 77  * 8- and 16-bit register defines..
 78  */
 79 #define AL(regs)        (((unsigned char *)&((regs)->pt.ax))[0])
 80 #define AH(regs)        (((unsigned char *)&((regs)->pt.ax))[1])
 81 #define IP(regs)        (*(unsigned short *)&((regs)->pt.ip))
 82 #define SP(regs)        (*(unsigned short *)&((regs)->pt.sp))
 83 
 84 /*
 85  * virtual flags (16 and 32-bit versions)
 86  */
 87 #define VFLAGS  (*(unsigned short *)&(current->thread.vm86->veflags))
 88 #define VEFLAGS (current->thread.vm86->veflags)
 89 
 90 #define set_flags(X, new, mask) \
 91 ((X) = ((X) & ~(mask)) | ((new) & (mask)))
 92 
 93 #define SAFE_MASK       (0xDD5)
 94 #define RETURN_MASK     (0xDFF)
 95 
 96 void save_v86_state(struct kernel_vm86_regs *regs, int retval)
 97 {
 98         struct task_struct *tsk = current;
 99         struct vm86plus_struct __user *user;
100         struct vm86 *vm86 = current->thread.vm86;
101 
102         /*
103          * This gets called from entry.S with interrupts disabled, but
104          * from process context. Enable interrupts here, before trying
105          * to access user space.
106          */
107         local_irq_enable();
108 
109         if (!vm86 || !vm86->user_vm86) {
110                 pr_alert("no user_vm86: BAD\n");
111                 do_exit(SIGSEGV);
112         }
113         set_flags(regs->pt.flags, VEFLAGS, X86_EFLAGS_VIF | vm86->veflags_mask);
114         user = vm86->user_vm86;
115 
116         if (!user_access_begin(user, vm86->vm86plus.is_vm86pus ?
117                        sizeof(struct vm86plus_struct) :
118                        sizeof(struct vm86_struct)))
119                 goto Efault;
120 
121         unsafe_put_user(regs->pt.bx, &user->regs.ebx, Efault_end);
122         unsafe_put_user(regs->pt.cx, &user->regs.ecx, Efault_end);
123         unsafe_put_user(regs->pt.dx, &user->regs.edx, Efault_end);
124         unsafe_put_user(regs->pt.si, &user->regs.esi, Efault_end);
125         unsafe_put_user(regs->pt.di, &user->regs.edi, Efault_end);
126         unsafe_put_user(regs->pt.bp, &user->regs.ebp, Efault_end);
127         unsafe_put_user(regs->pt.ax, &user->regs.eax, Efault_end);
128         unsafe_put_user(regs->pt.ip, &user->regs.eip, Efault_end);
129         unsafe_put_user(regs->pt.cs, &user->regs.cs, Efault_end);
130         unsafe_put_user(regs->pt.flags, &user->regs.eflags, Efault_end);
131         unsafe_put_user(regs->pt.sp, &user->regs.esp, Efault_end);
132         unsafe_put_user(regs->pt.ss, &user->regs.ss, Efault_end);
133         unsafe_put_user(regs->es, &user->regs.es, Efault_end);
134         unsafe_put_user(regs->ds, &user->regs.ds, Efault_end);
135         unsafe_put_user(regs->fs, &user->regs.fs, Efault_end);
136         unsafe_put_user(regs->gs, &user->regs.gs, Efault_end);
137         unsafe_put_user(vm86->screen_bitmap, &user->screen_bitmap, Efault_end);
138 
139         user_access_end();
140 
141         preempt_disable();
142         tsk->thread.sp0 = vm86->saved_sp0;
143         tsk->thread.sysenter_cs = __KERNEL_CS;
144         update_task_stack(tsk);
145         refresh_sysenter_cs(&tsk->thread);
146         vm86->saved_sp0 = 0;
147         preempt_enable();
148 
149         memcpy(&regs->pt, &vm86->regs32, sizeof(struct pt_regs));
150 
151         lazy_load_gs(vm86->regs32.gs);
152 
153         regs->pt.ax = retval;
154         return;
155 
156 Efault_end:
157         user_access_end();
158 Efault:
159         pr_alert("could not access userspace vm86 info\n");
160         do_exit(SIGSEGV);
161 }
162 
163 static void mark_screen_rdonly(struct mm_struct *mm)
164 {
165         struct vm_area_struct *vma;
166         spinlock_t *ptl;
167         pgd_t *pgd;
168         p4d_t *p4d;
169         pud_t *pud;
170         pmd_t *pmd;
171         pte_t *pte;
172         int i;
173 
174         down_write(&mm->mmap_sem);
175         pgd = pgd_offset(mm, 0xA0000);
176         if (pgd_none_or_clear_bad(pgd))
177                 goto out;
178         p4d = p4d_offset(pgd, 0xA0000);
179         if (p4d_none_or_clear_bad(p4d))
180                 goto out;
181         pud = pud_offset(p4d, 0xA0000);
182         if (pud_none_or_clear_bad(pud))
183                 goto out;
184         pmd = pmd_offset(pud, 0xA0000);
185 
186         if (pmd_trans_huge(*pmd)) {
187                 vma = find_vma(mm, 0xA0000);
188                 split_huge_pmd(vma, pmd, 0xA0000);
189         }
190         if (pmd_none_or_clear_bad(pmd))
191                 goto out;
192         pte = pte_offset_map_lock(mm, pmd, 0xA0000, &ptl);
193         for (i = 0; i < 32; i++) {
194                 if (pte_present(*pte))
195                         set_pte(pte, pte_wrprotect(*pte));
196                 pte++;
197         }
198         pte_unmap_unlock(pte, ptl);
199 out:
200         up_write(&mm->mmap_sem);
201         flush_tlb_mm_range(mm, 0xA0000, 0xA0000 + 32*PAGE_SIZE, PAGE_SHIFT, false);
202 }
203 
204 
205 
206 static int do_vm86_irq_handling(int subfunction, int irqnumber);
207 static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus);
208 
209 SYSCALL_DEFINE1(vm86old, struct vm86_struct __user *, user_vm86)
210 {
211         return do_sys_vm86((struct vm86plus_struct __user *) user_vm86, false);
212 }
213 
214 
215 SYSCALL_DEFINE2(vm86, unsigned long, cmd, unsigned long, arg)
216 {
217         switch (cmd) {
218         case VM86_REQUEST_IRQ:
219         case VM86_FREE_IRQ:
220         case VM86_GET_IRQ_BITS:
221         case VM86_GET_AND_RESET_IRQ:
222                 return do_vm86_irq_handling(cmd, (int)arg);
223         case VM86_PLUS_INSTALL_CHECK:
224                 /*
225                  * NOTE: on old vm86 stuff this will return the error
226                  *  from access_ok(), because the subfunction is
227                  *  interpreted as (invalid) address to vm86_struct.
228                  *  So the installation check works.
229                  */
230                 return 0;
231         }
232 
233         /* we come here only for functions VM86_ENTER, VM86_ENTER_NO_BYPASS */
234         return do_sys_vm86((struct vm86plus_struct __user *) arg, true);
235 }
236 
237 
238 static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus)
239 {
240         struct task_struct *tsk = current;
241         struct vm86 *vm86 = tsk->thread.vm86;
242         struct kernel_vm86_regs vm86regs;
243         struct pt_regs *regs = current_pt_regs();
244         unsigned long err = 0;
245         struct vm86_struct v;
246 
247         err = security_mmap_addr(0);
248         if (err) {
249                 /*
250                  * vm86 cannot virtualize the address space, so vm86 users
251                  * need to manage the low 1MB themselves using mmap.  Given
252                  * that BIOS places important data in the first page, vm86
253                  * is essentially useless if mmap_min_addr != 0.  DOSEMU,
254                  * for example, won't even bother trying to use vm86 if it
255                  * can't map a page at virtual address 0.
256                  *
257                  * To reduce the available kernel attack surface, simply
258                  * disallow vm86(old) for users who cannot mmap at va 0.
259                  *
260                  * The implementation of security_mmap_addr will allow
261                  * suitably privileged users to map va 0 even if
262                  * vm.mmap_min_addr is set above 0, and we want this
263                  * behavior for vm86 as well, as it ensures that legacy
264                  * tools like vbetool will not fail just because of
265                  * vm.mmap_min_addr.
266                  */
267                 pr_info_once("Denied a call to vm86(old) from %s[%d] (uid: %d).  Set the vm.mmap_min_addr sysctl to 0 and/or adjust LSM mmap_min_addr policy to enable vm86 if you are using a vm86-based DOS emulator.\n",
268                              current->comm, task_pid_nr(current),
269                              from_kuid_munged(&init_user_ns, current_uid()));
270                 return -EPERM;
271         }
272 
273         if (!vm86) {
274                 if (!(vm86 = kzalloc(sizeof(*vm86), GFP_KERNEL)))
275                         return -ENOMEM;
276                 tsk->thread.vm86 = vm86;
277         }
278         if (vm86->saved_sp0)
279                 return -EPERM;
280 
281         if (copy_from_user(&v, user_vm86,
282                         offsetof(struct vm86_struct, int_revectored)))
283                 return -EFAULT;
284 
285         memset(&vm86regs, 0, sizeof(vm86regs));
286 
287         vm86regs.pt.bx = v.regs.ebx;
288         vm86regs.pt.cx = v.regs.ecx;
289         vm86regs.pt.dx = v.regs.edx;
290         vm86regs.pt.si = v.regs.esi;
291         vm86regs.pt.di = v.regs.edi;
292         vm86regs.pt.bp = v.regs.ebp;
293         vm86regs.pt.ax = v.regs.eax;
294         vm86regs.pt.ip = v.regs.eip;
295         vm86regs.pt.cs = v.regs.cs;
296         vm86regs.pt.flags = v.regs.eflags;
297         vm86regs.pt.sp = v.regs.esp;
298         vm86regs.pt.ss = v.regs.ss;
299         vm86regs.es = v.regs.es;
300         vm86regs.ds = v.regs.ds;
301         vm86regs.fs = v.regs.fs;
302         vm86regs.gs = v.regs.gs;
303 
304         vm86->flags = v.flags;
305         vm86->screen_bitmap = v.screen_bitmap;
306         vm86->cpu_type = v.cpu_type;
307 
308         if (copy_from_user(&vm86->int_revectored,
309                            &user_vm86->int_revectored,
310                            sizeof(struct revectored_struct)))
311                 return -EFAULT;
312         if (copy_from_user(&vm86->int21_revectored,
313                            &user_vm86->int21_revectored,
314                            sizeof(struct revectored_struct)))
315                 return -EFAULT;
316         if (plus) {
317                 if (copy_from_user(&vm86->vm86plus, &user_vm86->vm86plus,
318                                    sizeof(struct vm86plus_info_struct)))
319                         return -EFAULT;
320                 vm86->vm86plus.is_vm86pus = 1;
321         } else
322                 memset(&vm86->vm86plus, 0,
323                        sizeof(struct vm86plus_info_struct));
324 
325         memcpy(&vm86->regs32, regs, sizeof(struct pt_regs));
326         vm86->user_vm86 = user_vm86;
327 
328 /*
329  * The flags register is also special: we cannot trust that the user
330  * has set it up safely, so this makes sure interrupt etc flags are
331  * inherited from protected mode.
332  */
333         VEFLAGS = vm86regs.pt.flags;
334         vm86regs.pt.flags &= SAFE_MASK;
335         vm86regs.pt.flags |= regs->flags & ~SAFE_MASK;
336         vm86regs.pt.flags |= X86_VM_MASK;
337 
338         vm86regs.pt.orig_ax = regs->orig_ax;
339 
340         switch (vm86->cpu_type) {
341         case CPU_286:
342                 vm86->veflags_mask = 0;
343                 break;
344         case CPU_386:
345                 vm86->veflags_mask = X86_EFLAGS_NT | X86_EFLAGS_IOPL;
346                 break;
347         case CPU_486:
348                 vm86->veflags_mask = X86_EFLAGS_AC | X86_EFLAGS_NT | X86_EFLAGS_IOPL;
349                 break;
350         default:
351                 vm86->veflags_mask = X86_EFLAGS_ID | X86_EFLAGS_AC | X86_EFLAGS_NT | X86_EFLAGS_IOPL;
352                 break;
353         }
354 
355 /*
356  * Save old state
357  */
358         vm86->saved_sp0 = tsk->thread.sp0;
359         lazy_save_gs(vm86->regs32.gs);
360 
361         /* make room for real-mode segments */
362         preempt_disable();
363         tsk->thread.sp0 += 16;
364 
365         if (boot_cpu_has(X86_FEATURE_SEP)) {
366                 tsk->thread.sysenter_cs = 0;
367                 refresh_sysenter_cs(&tsk->thread);
368         }
369 
370         update_task_stack(tsk);
371         preempt_enable();
372 
373         if (vm86->flags & VM86_SCREEN_BITMAP)
374                 mark_screen_rdonly(tsk->mm);
375 
376         memcpy((struct kernel_vm86_regs *)regs, &vm86regs, sizeof(vm86regs));
377         return regs->ax;
378 }
379 
380 static inline void set_IF(struct kernel_vm86_regs *regs)
381 {
382         VEFLAGS |= X86_EFLAGS_VIF;
383 }
384 
385 static inline void clear_IF(struct kernel_vm86_regs *regs)
386 {
387         VEFLAGS &= ~X86_EFLAGS_VIF;
388 }
389 
390 static inline void clear_TF(struct kernel_vm86_regs *regs)
391 {
392         regs->pt.flags &= ~X86_EFLAGS_TF;
393 }
394 
395 static inline void clear_AC(struct kernel_vm86_regs *regs)
396 {
397         regs->pt.flags &= ~X86_EFLAGS_AC;
398 }
399 
400 /*
401  * It is correct to call set_IF(regs) from the set_vflags_*
402  * functions. However someone forgot to call clear_IF(regs)
403  * in the opposite case.
404  * After the command sequence CLI PUSHF STI POPF you should
405  * end up with interrupts disabled, but you ended up with
406  * interrupts enabled.
407  *  ( I was testing my own changes, but the only bug I
408  *    could find was in a function I had not changed. )
409  * [KD]
410  */
411 
412 static inline void set_vflags_long(unsigned long flags, struct kernel_vm86_regs *regs)
413 {
414         set_flags(VEFLAGS, flags, current->thread.vm86->veflags_mask);
415         set_flags(regs->pt.flags, flags, SAFE_MASK);
416         if (flags & X86_EFLAGS_IF)
417                 set_IF(regs);
418         else
419                 clear_IF(regs);
420 }
421 
422 static inline void set_vflags_short(unsigned short flags, struct kernel_vm86_regs *regs)
423 {
424         set_flags(VFLAGS, flags, current->thread.vm86->veflags_mask);
425         set_flags(regs->pt.flags, flags, SAFE_MASK);
426         if (flags & X86_EFLAGS_IF)
427                 set_IF(regs);
428         else
429                 clear_IF(regs);
430 }
431 
432 static inline unsigned long get_vflags(struct kernel_vm86_regs *regs)
433 {
434         unsigned long flags = regs->pt.flags & RETURN_MASK;
435 
436         if (VEFLAGS & X86_EFLAGS_VIF)
437                 flags |= X86_EFLAGS_IF;
438         flags |= X86_EFLAGS_IOPL;
439         return flags | (VEFLAGS & current->thread.vm86->veflags_mask);
440 }
441 
442 static inline int is_revectored(int nr, struct revectored_struct *bitmap)
443 {
444         return test_bit(nr, bitmap->__map);
445 }
446 
447 #define val_byte(val, n) (((__u8 *)&val)[n])
448 
449 #define pushb(base, ptr, val, err_label) \
450         do { \
451                 __u8 __val = val; \
452                 ptr--; \
453                 if (put_user(__val, base + ptr) < 0) \
454                         goto err_label; \
455         } while (0)
456 
457 #define pushw(base, ptr, val, err_label) \
458         do { \
459                 __u16 __val = val; \
460                 ptr--; \
461                 if (put_user(val_byte(__val, 1), base + ptr) < 0) \
462                         goto err_label; \
463                 ptr--; \
464                 if (put_user(val_byte(__val, 0), base + ptr) < 0) \
465                         goto err_label; \
466         } while (0)
467 
468 #define pushl(base, ptr, val, err_label) \
469         do { \
470                 __u32 __val = val; \
471                 ptr--; \
472                 if (put_user(val_byte(__val, 3), base + ptr) < 0) \
473                         goto err_label; \
474                 ptr--; \
475                 if (put_user(val_byte(__val, 2), base + ptr) < 0) \
476                         goto err_label; \
477                 ptr--; \
478                 if (put_user(val_byte(__val, 1), base + ptr) < 0) \
479                         goto err_label; \
480                 ptr--; \
481                 if (put_user(val_byte(__val, 0), base + ptr) < 0) \
482                         goto err_label; \
483         } while (0)
484 
485 #define popb(base, ptr, err_label) \
486         ({ \
487                 __u8 __res; \
488                 if (get_user(__res, base + ptr) < 0) \
489                         goto err_label; \
490                 ptr++; \
491                 __res; \
492         })
493 
494 #define popw(base, ptr, err_label) \
495         ({ \
496                 __u16 __res; \
497                 if (get_user(val_byte(__res, 0), base + ptr) < 0) \
498                         goto err_label; \
499                 ptr++; \
500                 if (get_user(val_byte(__res, 1), base + ptr) < 0) \
501                         goto err_label; \
502                 ptr++; \
503                 __res; \
504         })
505 
506 #define popl(base, ptr, err_label) \
507         ({ \
508                 __u32 __res; \
509                 if (get_user(val_byte(__res, 0), base + ptr) < 0) \
510                         goto err_label; \
511                 ptr++; \
512                 if (get_user(val_byte(__res, 1), base + ptr) < 0) \
513                         goto err_label; \
514                 ptr++; \
515                 if (get_user(val_byte(__res, 2), base + ptr) < 0) \
516                         goto err_label; \
517                 ptr++; \
518                 if (get_user(val_byte(__res, 3), base + ptr) < 0) \
519                         goto err_label; \
520                 ptr++; \
521                 __res; \
522         })
523 
524 /* There are so many possible reasons for this function to return
525  * VM86_INTx, so adding another doesn't bother me. We can expect
526  * userspace programs to be able to handle it. (Getting a problem
527  * in userspace is always better than an Oops anyway.) [KD]
528  */
529 static void do_int(struct kernel_vm86_regs *regs, int i,
530     unsigned char __user *ssp, unsigned short sp)
531 {
532         unsigned long __user *intr_ptr;
533         unsigned long segoffs;
534         struct vm86 *vm86 = current->thread.vm86;
535 
536         if (regs->pt.cs == BIOSSEG)
537                 goto cannot_handle;
538         if (is_revectored(i, &vm86->int_revectored))
539                 goto cannot_handle;
540         if (i == 0x21 && is_revectored(AH(regs), &vm86->int21_revectored))
541                 goto cannot_handle;
542         intr_ptr = (unsigned long __user *) (i << 2);
543         if (get_user(segoffs, intr_ptr))
544                 goto cannot_handle;
545         if ((segoffs >> 16) == BIOSSEG)
546                 goto cannot_handle;
547         pushw(ssp, sp, get_vflags(regs), cannot_handle);
548         pushw(ssp, sp, regs->pt.cs, cannot_handle);
549         pushw(ssp, sp, IP(regs), cannot_handle);
550         regs->pt.cs = segoffs >> 16;
551         SP(regs) -= 6;
552         IP(regs) = segoffs & 0xffff;
553         clear_TF(regs);
554         clear_IF(regs);
555         clear_AC(regs);
556         return;
557 
558 cannot_handle:
559         save_v86_state(regs, VM86_INTx + (i << 8));
560 }
561 
562 int handle_vm86_trap(struct kernel_vm86_regs *regs, long error_code, int trapno)
563 {
564         struct vm86 *vm86 = current->thread.vm86;
565 
566         if (vm86->vm86plus.is_vm86pus) {
567                 if ((trapno == 3) || (trapno == 1)) {
568                         save_v86_state(regs, VM86_TRAP + (trapno << 8));
569                         return 0;
570                 }
571                 do_int(regs, trapno, (unsigned char __user *) (regs->pt.ss << 4), SP(regs));
572                 return 0;
573         }
574         if (trapno != 1)
575                 return 1; /* we let this handle by the calling routine */
576         current->thread.trap_nr = trapno;
577         current->thread.error_code = error_code;
578         force_sig(SIGTRAP);
579         return 0;
580 }
581 
582 void handle_vm86_fault(struct kernel_vm86_regs *regs, long error_code)
583 {
584         unsigned char opcode;
585         unsigned char __user *csp;
586         unsigned char __user *ssp;
587         unsigned short ip, sp, orig_flags;
588         int data32, pref_done;
589         struct vm86plus_info_struct *vmpi = &current->thread.vm86->vm86plus;
590 
591 #define CHECK_IF_IN_TRAP \
592         if (vmpi->vm86dbg_active && vmpi->vm86dbg_TFpendig) \
593                 newflags |= X86_EFLAGS_TF
594 
595         orig_flags = *(unsigned short *)&regs->pt.flags;
596 
597         csp = (unsigned char __user *) (regs->pt.cs << 4);
598         ssp = (unsigned char __user *) (regs->pt.ss << 4);
599         sp = SP(regs);
600         ip = IP(regs);
601 
602         data32 = 0;
603         pref_done = 0;
604         do {
605                 switch (opcode = popb(csp, ip, simulate_sigsegv)) {
606                 case 0x66:      /* 32-bit data */     data32 = 1; break;
607                 case 0x67:      /* 32-bit address */  break;
608                 case 0x2e:      /* CS */              break;
609                 case 0x3e:      /* DS */              break;
610                 case 0x26:      /* ES */              break;
611                 case 0x36:      /* SS */              break;
612                 case 0x65:      /* GS */              break;
613                 case 0x64:      /* FS */              break;
614                 case 0xf2:      /* repnz */       break;
615                 case 0xf3:      /* rep */             break;
616                 default: pref_done = 1;
617                 }
618         } while (!pref_done);
619 
620         switch (opcode) {
621 
622         /* pushf */
623         case 0x9c:
624                 if (data32) {
625                         pushl(ssp, sp, get_vflags(regs), simulate_sigsegv);
626                         SP(regs) -= 4;
627                 } else {
628                         pushw(ssp, sp, get_vflags(regs), simulate_sigsegv);
629                         SP(regs) -= 2;
630                 }
631                 IP(regs) = ip;
632                 goto vm86_fault_return;
633 
634         /* popf */
635         case 0x9d:
636                 {
637                 unsigned long newflags;
638                 if (data32) {
639                         newflags = popl(ssp, sp, simulate_sigsegv);
640                         SP(regs) += 4;
641                 } else {
642                         newflags = popw(ssp, sp, simulate_sigsegv);
643                         SP(regs) += 2;
644                 }
645                 IP(regs) = ip;
646                 CHECK_IF_IN_TRAP;
647                 if (data32)
648                         set_vflags_long(newflags, regs);
649                 else
650                         set_vflags_short(newflags, regs);
651 
652                 goto check_vip;
653                 }
654 
655         /* int xx */
656         case 0xcd: {
657                 int intno = popb(csp, ip, simulate_sigsegv);
658                 IP(regs) = ip;
659                 if (vmpi->vm86dbg_active) {
660                         if ((1 << (intno & 7)) & vmpi->vm86dbg_intxxtab[intno >> 3]) {
661                                 save_v86_state(regs, VM86_INTx + (intno << 8));
662                                 return;
663                         }
664                 }
665                 do_int(regs, intno, ssp, sp);
666                 return;
667         }
668 
669         /* iret */
670         case 0xcf:
671                 {
672                 unsigned long newip;
673                 unsigned long newcs;
674                 unsigned long newflags;
675                 if (data32) {
676                         newip = popl(ssp, sp, simulate_sigsegv);
677                         newcs = popl(ssp, sp, simulate_sigsegv);
678                         newflags = popl(ssp, sp, simulate_sigsegv);
679                         SP(regs) += 12;
680                 } else {
681                         newip = popw(ssp, sp, simulate_sigsegv);
682                         newcs = popw(ssp, sp, simulate_sigsegv);
683                         newflags = popw(ssp, sp, simulate_sigsegv);
684                         SP(regs) += 6;
685                 }
686                 IP(regs) = newip;
687                 regs->pt.cs = newcs;
688                 CHECK_IF_IN_TRAP;
689                 if (data32) {
690                         set_vflags_long(newflags, regs);
691                 } else {
692                         set_vflags_short(newflags, regs);
693                 }
694                 goto check_vip;
695                 }
696 
697         /* cli */
698         case 0xfa:
699                 IP(regs) = ip;
700                 clear_IF(regs);
701                 goto vm86_fault_return;
702 
703         /* sti */
704         /*
705          * Damn. This is incorrect: the 'sti' instruction should actually
706          * enable interrupts after the /next/ instruction. Not good.
707          *
708          * Probably needs some horsing around with the TF flag. Aiee..
709          */
710         case 0xfb:
711                 IP(regs) = ip;
712                 set_IF(regs);
713                 goto check_vip;
714 
715         default:
716                 save_v86_state(regs, VM86_UNKNOWN);
717         }
718 
719         return;
720 
721 check_vip:
722         if ((VEFLAGS & (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) ==
723             (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) {
724                 save_v86_state(regs, VM86_STI);
725                 return;
726         }
727 
728 vm86_fault_return:
729         if (vmpi->force_return_for_pic  && (VEFLAGS & (X86_EFLAGS_IF | X86_EFLAGS_VIF))) {
730                 save_v86_state(regs, VM86_PICRETURN);
731                 return;
732         }
733         if (orig_flags & X86_EFLAGS_TF)
734                 handle_vm86_trap(regs, 0, X86_TRAP_DB);
735         return;
736 
737 simulate_sigsegv:
738         /* FIXME: After a long discussion with Stas we finally
739          *        agreed, that this is wrong. Here we should
740          *        really send a SIGSEGV to the user program.
741          *        But how do we create the correct context? We
742          *        are inside a general protection fault handler
743          *        and has just returned from a page fault handler.
744          *        The correct context for the signal handler
745          *        should be a mixture of the two, but how do we
746          *        get the information? [KD]
747          */
748         save_v86_state(regs, VM86_UNKNOWN);
749 }
750 
751 /* ---------------- vm86 special IRQ passing stuff ----------------- */
752 
753 #define VM86_IRQNAME            "vm86irq"
754 
755 static struct vm86_irqs {
756         struct task_struct *tsk;
757         int sig;
758 } vm86_irqs[16];
759 
760 static DEFINE_SPINLOCK(irqbits_lock);
761 static int irqbits;
762 
763 #define ALLOWED_SIGS (1 /* 0 = don't send a signal */ \
764         | (1 << SIGUSR1) | (1 << SIGUSR2) | (1 << SIGIO)  | (1 << SIGURG) \
765         | (1 << SIGUNUSED))
766 
767 static irqreturn_t irq_handler(int intno, void *dev_id)
768 {
769         int irq_bit;
770         unsigned long flags;
771 
772         spin_lock_irqsave(&irqbits_lock, flags);
773         irq_bit = 1 << intno;
774         if ((irqbits & irq_bit) || !vm86_irqs[intno].tsk)
775                 goto out;
776         irqbits |= irq_bit;
777         if (vm86_irqs[intno].sig)
778                 send_sig(vm86_irqs[intno].sig, vm86_irqs[intno].tsk, 1);
779         /*
780          * IRQ will be re-enabled when user asks for the irq (whether
781          * polling or as a result of the signal)
782          */
783         disable_irq_nosync(intno);
784         spin_unlock_irqrestore(&irqbits_lock, flags);
785         return IRQ_HANDLED;
786 
787 out:
788         spin_unlock_irqrestore(&irqbits_lock, flags);
789         return IRQ_NONE;
790 }
791 
792 static inline void free_vm86_irq(int irqnumber)
793 {
794         unsigned long flags;
795 
796         free_irq(irqnumber, NULL);
797         vm86_irqs[irqnumber].tsk = NULL;
798 
799         spin_lock_irqsave(&irqbits_lock, flags);
800         irqbits &= ~(1 << irqnumber);
801         spin_unlock_irqrestore(&irqbits_lock, flags);
802 }
803 
804 void release_vm86_irqs(struct task_struct *task)
805 {
806         int i;
807         for (i = FIRST_VM86_IRQ ; i <= LAST_VM86_IRQ; i++)
808             if (vm86_irqs[i].tsk == task)
809                 free_vm86_irq(i);
810 }
811 
812 static inline int get_and_reset_irq(int irqnumber)
813 {
814         int bit;
815         unsigned long flags;
816         int ret = 0;
817 
818         if (invalid_vm86_irq(irqnumber)) return 0;
819         if (vm86_irqs[irqnumber].tsk != current) return 0;
820         spin_lock_irqsave(&irqbits_lock, flags);
821         bit = irqbits & (1 << irqnumber);
822         irqbits &= ~bit;
823         if (bit) {
824                 enable_irq(irqnumber);
825                 ret = 1;
826         }
827 
828         spin_unlock_irqrestore(&irqbits_lock, flags);
829         return ret;
830 }
831 
832 
833 static int do_vm86_irq_handling(int subfunction, int irqnumber)
834 {
835         int ret;
836         switch (subfunction) {
837                 case VM86_GET_AND_RESET_IRQ: {
838                         return get_and_reset_irq(irqnumber);
839                 }
840                 case VM86_GET_IRQ_BITS: {
841                         return irqbits;
842                 }
843                 case VM86_REQUEST_IRQ: {
844                         int sig = irqnumber >> 8;
845                         int irq = irqnumber & 255;
846                         if (!capable(CAP_SYS_ADMIN)) return -EPERM;
847                         if (!((1 << sig) & ALLOWED_SIGS)) return -EPERM;
848                         if (invalid_vm86_irq(irq)) return -EPERM;
849                         if (vm86_irqs[irq].tsk) return -EPERM;
850                         ret = request_irq(irq, &irq_handler, 0, VM86_IRQNAME, NULL);
851                         if (ret) return ret;
852                         vm86_irqs[irq].sig = sig;
853                         vm86_irqs[irq].tsk = current;
854                         return irq;
855                 }
856                 case  VM86_FREE_IRQ: {
857                         if (invalid_vm86_irq(irqnumber)) return -EPERM;
858                         if (!vm86_irqs[irqnumber].tsk) return 0;
859                         if (vm86_irqs[irqnumber].tsk != current) return -EPERM;
860                         free_vm86_irq(irqnumber);
861                         return 0;
862                 }
863         }
864         return -EINVAL;
865 }
866 
867 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp