1 /*
2 * Copyright (C) 1994 Linus Torvalds
3 *
4 * 29 dec 2001 - Fixed oopses caused by unchecked access to the vm86
5 * stack - Manfred Spraul <manfred@colorfullife.com>
6 *
7 * 22 mar 2002 - Manfred detected the stackfaults, but didn't handle
8 * them correctly. Now the emulation will be in a
9 * consistent state after stackfaults - Kasper Dupont
10 * <kasperd@daimi.au.dk>
11 *
12 * 22 mar 2002 - Added missing clear_IF in set_vflags_* Kasper Dupont
13 * <kasperd@daimi.au.dk>
14 *
15 * ?? ??? 2002 - Fixed premature returns from handle_vm86_fault
16 * caused by Kasper Dupont's changes - Stas Sergeev
17 *
18 * 4 apr 2002 - Fixed CHECK_IF_IN_TRAP broken by Stas' changes.
19 * Kasper Dupont <kasperd@daimi.au.dk>
20 *
21 * 9 apr 2002 - Changed syntax of macros in handle_vm86_fault.
22 * Kasper Dupont <kasperd@daimi.au.dk>
23 *
24 * 9 apr 2002 - Changed stack access macros to jump to a label
25 * instead of returning to userspace. This simplifies
26 * do_int, and is needed by handle_vm6_fault. Kasper
27 * Dupont <kasperd@daimi.au.dk>
28 *
29 */
30
31 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
32
33 #include <linux/capability.h>
34 #include <linux/errno.h>
35 #include <linux/interrupt.h>
36 #include <linux/syscalls.h>
37 #include <linux/sched.h>
38 #include <linux/kernel.h>
39 #include <linux/signal.h>
40 #include <linux/string.h>
41 #include <linux/mm.h>
42 #include <linux/smp.h>
43 #include <linux/highmem.h>
44 #include <linux/ptrace.h>
45 #include <linux/audit.h>
46 #include <linux/stddef.h>
47 #include <linux/slab.h>
48 #include <linux/security.h>
49
50 #include <asm/uaccess.h>
51 #include <asm/io.h>
52 #include <asm/tlbflush.h>
53 #include <asm/irq.h>
54 #include <asm/traps.h>
55 #include <asm/vm86.h>
56
57 /*
58 * Known problems:
59 *
60 * Interrupt handling is not guaranteed:
61 * - a real x86 will disable all interrupts for one instruction
62 * after a "mov ss,xx" to make stack handling atomic even without
63 * the 'lss' instruction. We can't guarantee this in v86 mode,
64 * as the next instruction might result in a page fault or similar.
65 * - a real x86 will have interrupts disabled for one instruction
66 * past the 'sti' that enables them. We don't bother with all the
67 * details yet.
68 *
69 * Let's hope these problems do not actually matter for anything.
70 */
71
72
73 /*
74 * 8- and 16-bit register defines..
75 */
76 #define AL(regs) (((unsigned char *)&((regs)->pt.ax))[0])
77 #define AH(regs) (((unsigned char *)&((regs)->pt.ax))[1])
78 #define IP(regs) (*(unsigned short *)&((regs)->pt.ip))
79 #define SP(regs) (*(unsigned short *)&((regs)->pt.sp))
80
81 /*
82 * virtual flags (16 and 32-bit versions)
83 */
84 #define VFLAGS (*(unsigned short *)&(current->thread.vm86->veflags))
85 #define VEFLAGS (current->thread.vm86->veflags)
86
87 #define set_flags(X, new, mask) \
88 ((X) = ((X) & ~(mask)) | ((new) & (mask)))
89
90 #define SAFE_MASK (0xDD5)
91 #define RETURN_MASK (0xDFF)
92
save_v86_state(struct kernel_vm86_regs * regs,int retval)93 void save_v86_state(struct kernel_vm86_regs *regs, int retval)
94 {
95 struct tss_struct *tss;
96 struct task_struct *tsk = current;
97 struct vm86plus_struct __user *user;
98 struct vm86 *vm86 = current->thread.vm86;
99 long err = 0;
100
101 /*
102 * This gets called from entry.S with interrupts disabled, but
103 * from process context. Enable interrupts here, before trying
104 * to access user space.
105 */
106 local_irq_enable();
107
108 if (!vm86 || !vm86->user_vm86) {
109 pr_alert("no user_vm86: BAD\n");
110 do_exit(SIGSEGV);
111 }
112 set_flags(regs->pt.flags, VEFLAGS, X86_EFLAGS_VIF | vm86->veflags_mask);
113 user = vm86->user_vm86;
114
115 if (!access_ok(VERIFY_WRITE, user, vm86->vm86plus.is_vm86pus ?
116 sizeof(struct vm86plus_struct) :
117 sizeof(struct vm86_struct))) {
118 pr_alert("could not access userspace vm86 info\n");
119 do_exit(SIGSEGV);
120 }
121
122 put_user_try {
123 put_user_ex(regs->pt.bx, &user->regs.ebx);
124 put_user_ex(regs->pt.cx, &user->regs.ecx);
125 put_user_ex(regs->pt.dx, &user->regs.edx);
126 put_user_ex(regs->pt.si, &user->regs.esi);
127 put_user_ex(regs->pt.di, &user->regs.edi);
128 put_user_ex(regs->pt.bp, &user->regs.ebp);
129 put_user_ex(regs->pt.ax, &user->regs.eax);
130 put_user_ex(regs->pt.ip, &user->regs.eip);
131 put_user_ex(regs->pt.cs, &user->regs.cs);
132 put_user_ex(regs->pt.flags, &user->regs.eflags);
133 put_user_ex(regs->pt.sp, &user->regs.esp);
134 put_user_ex(regs->pt.ss, &user->regs.ss);
135 put_user_ex(regs->es, &user->regs.es);
136 put_user_ex(regs->ds, &user->regs.ds);
137 put_user_ex(regs->fs, &user->regs.fs);
138 put_user_ex(regs->gs, &user->regs.gs);
139
140 put_user_ex(vm86->screen_bitmap, &user->screen_bitmap);
141 } put_user_catch(err);
142 if (err) {
143 pr_alert("could not access userspace vm86 info\n");
144 do_exit(SIGSEGV);
145 }
146
147 tss = &per_cpu(cpu_tss, get_cpu());
148 tsk->thread.sp0 = vm86->saved_sp0;
149 tsk->thread.sysenter_cs = __KERNEL_CS;
150 load_sp0(tss, &tsk->thread);
151 vm86->saved_sp0 = 0;
152 put_cpu();
153
154 memcpy(®s->pt, &vm86->regs32, sizeof(struct pt_regs));
155
156 lazy_load_gs(vm86->regs32.gs);
157
158 regs->pt.ax = retval;
159 }
160
mark_screen_rdonly(struct mm_struct * mm)161 static void mark_screen_rdonly(struct mm_struct *mm)
162 {
163 pgd_t *pgd;
164 pud_t *pud;
165 pmd_t *pmd;
166 pte_t *pte;
167 spinlock_t *ptl;
168 int i;
169
170 down_write(&mm->mmap_sem);
171 pgd = pgd_offset(mm, 0xA0000);
172 if (pgd_none_or_clear_bad(pgd))
173 goto out;
174 pud = pud_offset(pgd, 0xA0000);
175 if (pud_none_or_clear_bad(pud))
176 goto out;
177 pmd = pmd_offset(pud, 0xA0000);
178 split_huge_page_pmd_mm(mm, 0xA0000, pmd);
179 if (pmd_none_or_clear_bad(pmd))
180 goto out;
181 pte = pte_offset_map_lock(mm, pmd, 0xA0000, &ptl);
182 for (i = 0; i < 32; i++) {
183 if (pte_present(*pte))
184 set_pte(pte, pte_wrprotect(*pte));
185 pte++;
186 }
187 pte_unmap_unlock(pte, ptl);
188 out:
189 up_write(&mm->mmap_sem);
190 flush_tlb_mm_range(mm, 0xA0000, 0xA0000 + 32*PAGE_SIZE, 0UL);
191 }
192
193
194
195 static int do_vm86_irq_handling(int subfunction, int irqnumber);
196 static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus);
197
SYSCALL_DEFINE1(vm86old,struct vm86_struct __user *,user_vm86)198 SYSCALL_DEFINE1(vm86old, struct vm86_struct __user *, user_vm86)
199 {
200 return do_sys_vm86((struct vm86plus_struct __user *) user_vm86, false);
201 }
202
203
SYSCALL_DEFINE2(vm86,unsigned long,cmd,unsigned long,arg)204 SYSCALL_DEFINE2(vm86, unsigned long, cmd, unsigned long, arg)
205 {
206 switch (cmd) {
207 case VM86_REQUEST_IRQ:
208 case VM86_FREE_IRQ:
209 case VM86_GET_IRQ_BITS:
210 case VM86_GET_AND_RESET_IRQ:
211 return do_vm86_irq_handling(cmd, (int)arg);
212 case VM86_PLUS_INSTALL_CHECK:
213 /*
214 * NOTE: on old vm86 stuff this will return the error
215 * from access_ok(), because the subfunction is
216 * interpreted as (invalid) address to vm86_struct.
217 * So the installation check works.
218 */
219 return 0;
220 }
221
222 /* we come here only for functions VM86_ENTER, VM86_ENTER_NO_BYPASS */
223 return do_sys_vm86((struct vm86plus_struct __user *) arg, true);
224 }
225
226
do_sys_vm86(struct vm86plus_struct __user * user_vm86,bool plus)227 static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus)
228 {
229 struct tss_struct *tss;
230 struct task_struct *tsk = current;
231 struct vm86 *vm86 = tsk->thread.vm86;
232 struct kernel_vm86_regs vm86regs;
233 struct pt_regs *regs = current_pt_regs();
234 unsigned long err = 0;
235
236 err = security_mmap_addr(0);
237 if (err) {
238 /*
239 * vm86 cannot virtualize the address space, so vm86 users
240 * need to manage the low 1MB themselves using mmap. Given
241 * that BIOS places important data in the first page, vm86
242 * is essentially useless if mmap_min_addr != 0. DOSEMU,
243 * for example, won't even bother trying to use vm86 if it
244 * can't map a page at virtual address 0.
245 *
246 * To reduce the available kernel attack surface, simply
247 * disallow vm86(old) for users who cannot mmap at va 0.
248 *
249 * The implementation of security_mmap_addr will allow
250 * suitably privileged users to map va 0 even if
251 * vm.mmap_min_addr is set above 0, and we want this
252 * behavior for vm86 as well, as it ensures that legacy
253 * tools like vbetool will not fail just because of
254 * vm.mmap_min_addr.
255 */
256 pr_info_once("Denied a call to vm86(old) from %s[%d] (uid: %d). Set the vm.mmap_min_addr sysctl to 0 and/or adjust LSM mmap_min_addr policy to enable vm86 if you are using a vm86-based DOS emulator.\n",
257 current->comm, task_pid_nr(current),
258 from_kuid_munged(&init_user_ns, current_uid()));
259 return -EPERM;
260 }
261
262 if (!vm86) {
263 if (!(vm86 = kzalloc(sizeof(*vm86), GFP_KERNEL)))
264 return -ENOMEM;
265 tsk->thread.vm86 = vm86;
266 }
267 if (vm86->saved_sp0)
268 return -EPERM;
269
270 if (!access_ok(VERIFY_READ, user_vm86, plus ?
271 sizeof(struct vm86_struct) :
272 sizeof(struct vm86plus_struct)))
273 return -EFAULT;
274
275 memset(&vm86regs, 0, sizeof(vm86regs));
276 get_user_try {
277 unsigned short seg;
278 get_user_ex(vm86regs.pt.bx, &user_vm86->regs.ebx);
279 get_user_ex(vm86regs.pt.cx, &user_vm86->regs.ecx);
280 get_user_ex(vm86regs.pt.dx, &user_vm86->regs.edx);
281 get_user_ex(vm86regs.pt.si, &user_vm86->regs.esi);
282 get_user_ex(vm86regs.pt.di, &user_vm86->regs.edi);
283 get_user_ex(vm86regs.pt.bp, &user_vm86->regs.ebp);
284 get_user_ex(vm86regs.pt.ax, &user_vm86->regs.eax);
285 get_user_ex(vm86regs.pt.ip, &user_vm86->regs.eip);
286 get_user_ex(seg, &user_vm86->regs.cs);
287 vm86regs.pt.cs = seg;
288 get_user_ex(vm86regs.pt.flags, &user_vm86->regs.eflags);
289 get_user_ex(vm86regs.pt.sp, &user_vm86->regs.esp);
290 get_user_ex(seg, &user_vm86->regs.ss);
291 vm86regs.pt.ss = seg;
292 get_user_ex(vm86regs.es, &user_vm86->regs.es);
293 get_user_ex(vm86regs.ds, &user_vm86->regs.ds);
294 get_user_ex(vm86regs.fs, &user_vm86->regs.fs);
295 get_user_ex(vm86regs.gs, &user_vm86->regs.gs);
296
297 get_user_ex(vm86->flags, &user_vm86->flags);
298 get_user_ex(vm86->screen_bitmap, &user_vm86->screen_bitmap);
299 get_user_ex(vm86->cpu_type, &user_vm86->cpu_type);
300 } get_user_catch(err);
301 if (err)
302 return err;
303
304 if (copy_from_user(&vm86->int_revectored,
305 &user_vm86->int_revectored,
306 sizeof(struct revectored_struct)))
307 return -EFAULT;
308 if (copy_from_user(&vm86->int21_revectored,
309 &user_vm86->int21_revectored,
310 sizeof(struct revectored_struct)))
311 return -EFAULT;
312 if (plus) {
313 if (copy_from_user(&vm86->vm86plus, &user_vm86->vm86plus,
314 sizeof(struct vm86plus_info_struct)))
315 return -EFAULT;
316 vm86->vm86plus.is_vm86pus = 1;
317 } else
318 memset(&vm86->vm86plus, 0,
319 sizeof(struct vm86plus_info_struct));
320
321 memcpy(&vm86->regs32, regs, sizeof(struct pt_regs));
322 vm86->user_vm86 = user_vm86;
323
324 /*
325 * The flags register is also special: we cannot trust that the user
326 * has set it up safely, so this makes sure interrupt etc flags are
327 * inherited from protected mode.
328 */
329 VEFLAGS = vm86regs.pt.flags;
330 vm86regs.pt.flags &= SAFE_MASK;
331 vm86regs.pt.flags |= regs->flags & ~SAFE_MASK;
332 vm86regs.pt.flags |= X86_VM_MASK;
333
334 vm86regs.pt.orig_ax = regs->orig_ax;
335
336 switch (vm86->cpu_type) {
337 case CPU_286:
338 vm86->veflags_mask = 0;
339 break;
340 case CPU_386:
341 vm86->veflags_mask = X86_EFLAGS_NT | X86_EFLAGS_IOPL;
342 break;
343 case CPU_486:
344 vm86->veflags_mask = X86_EFLAGS_AC | X86_EFLAGS_NT | X86_EFLAGS_IOPL;
345 break;
346 default:
347 vm86->veflags_mask = X86_EFLAGS_ID | X86_EFLAGS_AC | X86_EFLAGS_NT | X86_EFLAGS_IOPL;
348 break;
349 }
350
351 /*
352 * Save old state
353 */
354 vm86->saved_sp0 = tsk->thread.sp0;
355 lazy_save_gs(vm86->regs32.gs);
356
357 tss = &per_cpu(cpu_tss, get_cpu());
358 /* make room for real-mode segments */
359 tsk->thread.sp0 += 16;
360
361 if (static_cpu_has(X86_FEATURE_SEP))
362 tsk->thread.sysenter_cs = 0;
363
364 load_sp0(tss, &tsk->thread);
365 put_cpu();
366
367 if (vm86->flags & VM86_SCREEN_BITMAP)
368 mark_screen_rdonly(tsk->mm);
369
370 memcpy((struct kernel_vm86_regs *)regs, &vm86regs, sizeof(vm86regs));
371 force_iret();
372 return regs->ax;
373 }
374
set_IF(struct kernel_vm86_regs * regs)375 static inline void set_IF(struct kernel_vm86_regs *regs)
376 {
377 VEFLAGS |= X86_EFLAGS_VIF;
378 }
379
clear_IF(struct kernel_vm86_regs * regs)380 static inline void clear_IF(struct kernel_vm86_regs *regs)
381 {
382 VEFLAGS &= ~X86_EFLAGS_VIF;
383 }
384
clear_TF(struct kernel_vm86_regs * regs)385 static inline void clear_TF(struct kernel_vm86_regs *regs)
386 {
387 regs->pt.flags &= ~X86_EFLAGS_TF;
388 }
389
clear_AC(struct kernel_vm86_regs * regs)390 static inline void clear_AC(struct kernel_vm86_regs *regs)
391 {
392 regs->pt.flags &= ~X86_EFLAGS_AC;
393 }
394
395 /*
396 * It is correct to call set_IF(regs) from the set_vflags_*
397 * functions. However someone forgot to call clear_IF(regs)
398 * in the opposite case.
399 * After the command sequence CLI PUSHF STI POPF you should
400 * end up with interrupts disabled, but you ended up with
401 * interrupts enabled.
402 * ( I was testing my own changes, but the only bug I
403 * could find was in a function I had not changed. )
404 * [KD]
405 */
406
set_vflags_long(unsigned long flags,struct kernel_vm86_regs * regs)407 static inline void set_vflags_long(unsigned long flags, struct kernel_vm86_regs *regs)
408 {
409 set_flags(VEFLAGS, flags, current->thread.vm86->veflags_mask);
410 set_flags(regs->pt.flags, flags, SAFE_MASK);
411 if (flags & X86_EFLAGS_IF)
412 set_IF(regs);
413 else
414 clear_IF(regs);
415 }
416
set_vflags_short(unsigned short flags,struct kernel_vm86_regs * regs)417 static inline void set_vflags_short(unsigned short flags, struct kernel_vm86_regs *regs)
418 {
419 set_flags(VFLAGS, flags, current->thread.vm86->veflags_mask);
420 set_flags(regs->pt.flags, flags, SAFE_MASK);
421 if (flags & X86_EFLAGS_IF)
422 set_IF(regs);
423 else
424 clear_IF(regs);
425 }
426
get_vflags(struct kernel_vm86_regs * regs)427 static inline unsigned long get_vflags(struct kernel_vm86_regs *regs)
428 {
429 unsigned long flags = regs->pt.flags & RETURN_MASK;
430
431 if (VEFLAGS & X86_EFLAGS_VIF)
432 flags |= X86_EFLAGS_IF;
433 flags |= X86_EFLAGS_IOPL;
434 return flags | (VEFLAGS & current->thread.vm86->veflags_mask);
435 }
436
is_revectored(int nr,struct revectored_struct * bitmap)437 static inline int is_revectored(int nr, struct revectored_struct *bitmap)
438 {
439 __asm__ __volatile__("btl %2,%1\n\tsbbl %0,%0"
440 :"=r" (nr)
441 :"m" (*bitmap), "r" (nr));
442 return nr;
443 }
444
445 #define val_byte(val, n) (((__u8 *)&val)[n])
446
447 #define pushb(base, ptr, val, err_label) \
448 do { \
449 __u8 __val = val; \
450 ptr--; \
451 if (put_user(__val, base + ptr) < 0) \
452 goto err_label; \
453 } while (0)
454
455 #define pushw(base, ptr, val, err_label) \
456 do { \
457 __u16 __val = val; \
458 ptr--; \
459 if (put_user(val_byte(__val, 1), base + ptr) < 0) \
460 goto err_label; \
461 ptr--; \
462 if (put_user(val_byte(__val, 0), base + ptr) < 0) \
463 goto err_label; \
464 } while (0)
465
466 #define pushl(base, ptr, val, err_label) \
467 do { \
468 __u32 __val = val; \
469 ptr--; \
470 if (put_user(val_byte(__val, 3), base + ptr) < 0) \
471 goto err_label; \
472 ptr--; \
473 if (put_user(val_byte(__val, 2), base + ptr) < 0) \
474 goto err_label; \
475 ptr--; \
476 if (put_user(val_byte(__val, 1), base + ptr) < 0) \
477 goto err_label; \
478 ptr--; \
479 if (put_user(val_byte(__val, 0), base + ptr) < 0) \
480 goto err_label; \
481 } while (0)
482
483 #define popb(base, ptr, err_label) \
484 ({ \
485 __u8 __res; \
486 if (get_user(__res, base + ptr) < 0) \
487 goto err_label; \
488 ptr++; \
489 __res; \
490 })
491
492 #define popw(base, ptr, err_label) \
493 ({ \
494 __u16 __res; \
495 if (get_user(val_byte(__res, 0), base + ptr) < 0) \
496 goto err_label; \
497 ptr++; \
498 if (get_user(val_byte(__res, 1), base + ptr) < 0) \
499 goto err_label; \
500 ptr++; \
501 __res; \
502 })
503
504 #define popl(base, ptr, err_label) \
505 ({ \
506 __u32 __res; \
507 if (get_user(val_byte(__res, 0), base + ptr) < 0) \
508 goto err_label; \
509 ptr++; \
510 if (get_user(val_byte(__res, 1), base + ptr) < 0) \
511 goto err_label; \
512 ptr++; \
513 if (get_user(val_byte(__res, 2), base + ptr) < 0) \
514 goto err_label; \
515 ptr++; \
516 if (get_user(val_byte(__res, 3), base + ptr) < 0) \
517 goto err_label; \
518 ptr++; \
519 __res; \
520 })
521
522 /* There are so many possible reasons for this function to return
523 * VM86_INTx, so adding another doesn't bother me. We can expect
524 * userspace programs to be able to handle it. (Getting a problem
525 * in userspace is always better than an Oops anyway.) [KD]
526 */
do_int(struct kernel_vm86_regs * regs,int i,unsigned char __user * ssp,unsigned short sp)527 static void do_int(struct kernel_vm86_regs *regs, int i,
528 unsigned char __user *ssp, unsigned short sp)
529 {
530 unsigned long __user *intr_ptr;
531 unsigned long segoffs;
532 struct vm86 *vm86 = current->thread.vm86;
533
534 if (regs->pt.cs == BIOSSEG)
535 goto cannot_handle;
536 if (is_revectored(i, &vm86->int_revectored))
537 goto cannot_handle;
538 if (i == 0x21 && is_revectored(AH(regs), &vm86->int21_revectored))
539 goto cannot_handle;
540 intr_ptr = (unsigned long __user *) (i << 2);
541 if (get_user(segoffs, intr_ptr))
542 goto cannot_handle;
543 if ((segoffs >> 16) == BIOSSEG)
544 goto cannot_handle;
545 pushw(ssp, sp, get_vflags(regs), cannot_handle);
546 pushw(ssp, sp, regs->pt.cs, cannot_handle);
547 pushw(ssp, sp, IP(regs), cannot_handle);
548 regs->pt.cs = segoffs >> 16;
549 SP(regs) -= 6;
550 IP(regs) = segoffs & 0xffff;
551 clear_TF(regs);
552 clear_IF(regs);
553 clear_AC(regs);
554 return;
555
556 cannot_handle:
557 save_v86_state(regs, VM86_INTx + (i << 8));
558 }
559
handle_vm86_trap(struct kernel_vm86_regs * regs,long error_code,int trapno)560 int handle_vm86_trap(struct kernel_vm86_regs *regs, long error_code, int trapno)
561 {
562 struct vm86 *vm86 = current->thread.vm86;
563
564 if (vm86->vm86plus.is_vm86pus) {
565 if ((trapno == 3) || (trapno == 1)) {
566 save_v86_state(regs, VM86_TRAP + (trapno << 8));
567 return 0;
568 }
569 do_int(regs, trapno, (unsigned char __user *) (regs->pt.ss << 4), SP(regs));
570 return 0;
571 }
572 if (trapno != 1)
573 return 1; /* we let this handle by the calling routine */
574 current->thread.trap_nr = trapno;
575 current->thread.error_code = error_code;
576 force_sig(SIGTRAP, current);
577 return 0;
578 }
579
handle_vm86_fault(struct kernel_vm86_regs * regs,long error_code)580 void handle_vm86_fault(struct kernel_vm86_regs *regs, long error_code)
581 {
582 unsigned char opcode;
583 unsigned char __user *csp;
584 unsigned char __user *ssp;
585 unsigned short ip, sp, orig_flags;
586 int data32, pref_done;
587 struct vm86plus_info_struct *vmpi = ¤t->thread.vm86->vm86plus;
588
589 #define CHECK_IF_IN_TRAP \
590 if (vmpi->vm86dbg_active && vmpi->vm86dbg_TFpendig) \
591 newflags |= X86_EFLAGS_TF
592
593 orig_flags = *(unsigned short *)®s->pt.flags;
594
595 csp = (unsigned char __user *) (regs->pt.cs << 4);
596 ssp = (unsigned char __user *) (regs->pt.ss << 4);
597 sp = SP(regs);
598 ip = IP(regs);
599
600 data32 = 0;
601 pref_done = 0;
602 do {
603 switch (opcode = popb(csp, ip, simulate_sigsegv)) {
604 case 0x66: /* 32-bit data */ data32 = 1; break;
605 case 0x67: /* 32-bit address */ break;
606 case 0x2e: /* CS */ break;
607 case 0x3e: /* DS */ break;
608 case 0x26: /* ES */ break;
609 case 0x36: /* SS */ break;
610 case 0x65: /* GS */ break;
611 case 0x64: /* FS */ break;
612 case 0xf2: /* repnz */ break;
613 case 0xf3: /* rep */ break;
614 default: pref_done = 1;
615 }
616 } while (!pref_done);
617
618 switch (opcode) {
619
620 /* pushf */
621 case 0x9c:
622 if (data32) {
623 pushl(ssp, sp, get_vflags(regs), simulate_sigsegv);
624 SP(regs) -= 4;
625 } else {
626 pushw(ssp, sp, get_vflags(regs), simulate_sigsegv);
627 SP(regs) -= 2;
628 }
629 IP(regs) = ip;
630 goto vm86_fault_return;
631
632 /* popf */
633 case 0x9d:
634 {
635 unsigned long newflags;
636 if (data32) {
637 newflags = popl(ssp, sp, simulate_sigsegv);
638 SP(regs) += 4;
639 } else {
640 newflags = popw(ssp, sp, simulate_sigsegv);
641 SP(regs) += 2;
642 }
643 IP(regs) = ip;
644 CHECK_IF_IN_TRAP;
645 if (data32)
646 set_vflags_long(newflags, regs);
647 else
648 set_vflags_short(newflags, regs);
649
650 goto check_vip;
651 }
652
653 /* int xx */
654 case 0xcd: {
655 int intno = popb(csp, ip, simulate_sigsegv);
656 IP(regs) = ip;
657 if (vmpi->vm86dbg_active) {
658 if ((1 << (intno & 7)) & vmpi->vm86dbg_intxxtab[intno >> 3]) {
659 save_v86_state(regs, VM86_INTx + (intno << 8));
660 return;
661 }
662 }
663 do_int(regs, intno, ssp, sp);
664 return;
665 }
666
667 /* iret */
668 case 0xcf:
669 {
670 unsigned long newip;
671 unsigned long newcs;
672 unsigned long newflags;
673 if (data32) {
674 newip = popl(ssp, sp, simulate_sigsegv);
675 newcs = popl(ssp, sp, simulate_sigsegv);
676 newflags = popl(ssp, sp, simulate_sigsegv);
677 SP(regs) += 12;
678 } else {
679 newip = popw(ssp, sp, simulate_sigsegv);
680 newcs = popw(ssp, sp, simulate_sigsegv);
681 newflags = popw(ssp, sp, simulate_sigsegv);
682 SP(regs) += 6;
683 }
684 IP(regs) = newip;
685 regs->pt.cs = newcs;
686 CHECK_IF_IN_TRAP;
687 if (data32) {
688 set_vflags_long(newflags, regs);
689 } else {
690 set_vflags_short(newflags, regs);
691 }
692 goto check_vip;
693 }
694
695 /* cli */
696 case 0xfa:
697 IP(regs) = ip;
698 clear_IF(regs);
699 goto vm86_fault_return;
700
701 /* sti */
702 /*
703 * Damn. This is incorrect: the 'sti' instruction should actually
704 * enable interrupts after the /next/ instruction. Not good.
705 *
706 * Probably needs some horsing around with the TF flag. Aiee..
707 */
708 case 0xfb:
709 IP(regs) = ip;
710 set_IF(regs);
711 goto check_vip;
712
713 default:
714 save_v86_state(regs, VM86_UNKNOWN);
715 }
716
717 return;
718
719 check_vip:
720 if ((VEFLAGS & (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) ==
721 (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) {
722 save_v86_state(regs, VM86_STI);
723 return;
724 }
725
726 vm86_fault_return:
727 if (vmpi->force_return_for_pic && (VEFLAGS & (X86_EFLAGS_IF | X86_EFLAGS_VIF))) {
728 save_v86_state(regs, VM86_PICRETURN);
729 return;
730 }
731 if (orig_flags & X86_EFLAGS_TF)
732 handle_vm86_trap(regs, 0, X86_TRAP_DB);
733 return;
734
735 simulate_sigsegv:
736 /* FIXME: After a long discussion with Stas we finally
737 * agreed, that this is wrong. Here we should
738 * really send a SIGSEGV to the user program.
739 * But how do we create the correct context? We
740 * are inside a general protection fault handler
741 * and has just returned from a page fault handler.
742 * The correct context for the signal handler
743 * should be a mixture of the two, but how do we
744 * get the information? [KD]
745 */
746 save_v86_state(regs, VM86_UNKNOWN);
747 }
748
749 /* ---------------- vm86 special IRQ passing stuff ----------------- */
750
751 #define VM86_IRQNAME "vm86irq"
752
753 static struct vm86_irqs {
754 struct task_struct *tsk;
755 int sig;
756 } vm86_irqs[16];
757
758 static DEFINE_SPINLOCK(irqbits_lock);
759 static int irqbits;
760
761 #define ALLOWED_SIGS (1 /* 0 = don't send a signal */ \
762 | (1 << SIGUSR1) | (1 << SIGUSR2) | (1 << SIGIO) | (1 << SIGURG) \
763 | (1 << SIGUNUSED))
764
irq_handler(int intno,void * dev_id)765 static irqreturn_t irq_handler(int intno, void *dev_id)
766 {
767 int irq_bit;
768 unsigned long flags;
769
770 spin_lock_irqsave(&irqbits_lock, flags);
771 irq_bit = 1 << intno;
772 if ((irqbits & irq_bit) || !vm86_irqs[intno].tsk)
773 goto out;
774 irqbits |= irq_bit;
775 if (vm86_irqs[intno].sig)
776 send_sig(vm86_irqs[intno].sig, vm86_irqs[intno].tsk, 1);
777 /*
778 * IRQ will be re-enabled when user asks for the irq (whether
779 * polling or as a result of the signal)
780 */
781 disable_irq_nosync(intno);
782 spin_unlock_irqrestore(&irqbits_lock, flags);
783 return IRQ_HANDLED;
784
785 out:
786 spin_unlock_irqrestore(&irqbits_lock, flags);
787 return IRQ_NONE;
788 }
789
free_vm86_irq(int irqnumber)790 static inline void free_vm86_irq(int irqnumber)
791 {
792 unsigned long flags;
793
794 free_irq(irqnumber, NULL);
795 vm86_irqs[irqnumber].tsk = NULL;
796
797 spin_lock_irqsave(&irqbits_lock, flags);
798 irqbits &= ~(1 << irqnumber);
799 spin_unlock_irqrestore(&irqbits_lock, flags);
800 }
801
release_vm86_irqs(struct task_struct * task)802 void release_vm86_irqs(struct task_struct *task)
803 {
804 int i;
805 for (i = FIRST_VM86_IRQ ; i <= LAST_VM86_IRQ; i++)
806 if (vm86_irqs[i].tsk == task)
807 free_vm86_irq(i);
808 }
809
get_and_reset_irq(int irqnumber)810 static inline int get_and_reset_irq(int irqnumber)
811 {
812 int bit;
813 unsigned long flags;
814 int ret = 0;
815
816 if (invalid_vm86_irq(irqnumber)) return 0;
817 if (vm86_irqs[irqnumber].tsk != current) return 0;
818 spin_lock_irqsave(&irqbits_lock, flags);
819 bit = irqbits & (1 << irqnumber);
820 irqbits &= ~bit;
821 if (bit) {
822 enable_irq(irqnumber);
823 ret = 1;
824 }
825
826 spin_unlock_irqrestore(&irqbits_lock, flags);
827 return ret;
828 }
829
830
do_vm86_irq_handling(int subfunction,int irqnumber)831 static int do_vm86_irq_handling(int subfunction, int irqnumber)
832 {
833 int ret;
834 switch (subfunction) {
835 case VM86_GET_AND_RESET_IRQ: {
836 return get_and_reset_irq(irqnumber);
837 }
838 case VM86_GET_IRQ_BITS: {
839 return irqbits;
840 }
841 case VM86_REQUEST_IRQ: {
842 int sig = irqnumber >> 8;
843 int irq = irqnumber & 255;
844 if (!capable(CAP_SYS_ADMIN)) return -EPERM;
845 if (!((1 << sig) & ALLOWED_SIGS)) return -EPERM;
846 if (invalid_vm86_irq(irq)) return -EPERM;
847 if (vm86_irqs[irq].tsk) return -EPERM;
848 ret = request_irq(irq, &irq_handler, 0, VM86_IRQNAME, NULL);
849 if (ret) return ret;
850 vm86_irqs[irq].sig = sig;
851 vm86_irqs[irq].tsk = current;
852 return irq;
853 }
854 case VM86_FREE_IRQ: {
855 if (invalid_vm86_irq(irqnumber)) return -EPERM;
856 if (!vm86_irqs[irqnumber].tsk) return 0;
857 if (vm86_irqs[irqnumber].tsk != current) return -EPERM;
858 free_vm86_irq(irqnumber);
859 return 0;
860 }
861 }
862 return -EINVAL;
863 }
864
865