]>
Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* |
2 | * Copyright (C) 2001, 2002 Jeff Dike (jdike@karaya.com) | |
3 | * Licensed under the GPL | |
4 | */ | |
5 | ||
2e5e5592 | 6 | #include "linux/sched.h" |
1da177e4 | 7 | #include "linux/slab.h" |
2e5e5592 | 8 | #include "linux/types.h" |
858259cf | 9 | #include "linux/errno.h" |
1da177e4 | 10 | #include "asm/uaccess.h" |
2e5e5592 PBG |
11 | #include "asm/smp.h" |
12 | #include "asm/ldt.h" | |
858259cf | 13 | #include "asm/unistd.h" |
1da177e4 LT |
14 | #include "choose-mode.h" |
15 | #include "kern.h" | |
2e5e5592 | 16 | #include "mode_kern.h" |
12919aa6 | 17 | #include "os.h" |
1da177e4 | 18 | |
2e5e5592 | 19 | extern int modify_ldt(int func, void *ptr, unsigned long bytecount); |
1da177e4 | 20 | |
858259cf | 21 | #ifdef CONFIG_MODE_TT |
2e5e5592 | 22 | |
858259cf BS |
23 | static long do_modify_ldt_tt(int func, void __user *ptr, |
24 | unsigned long bytecount) | |
2e5e5592 PBG |
25 | { |
26 | struct user_desc info; | |
27 | int res = 0; | |
28 | void *buf = NULL; | |
29 | void *p = NULL; /* What we pass to host. */ | |
1da177e4 LT |
30 | |
31 | switch(func){ | |
32 | case 1: | |
2e5e5592 PBG |
33 | case 0x11: /* write_ldt */ |
34 | /* Do this check now to avoid overflows. */ | |
35 | if (bytecount != sizeof(struct user_desc)) { | |
36 | res = -EINVAL; | |
37 | goto out; | |
38 | } | |
39 | ||
40 | if(copy_from_user(&info, ptr, sizeof(info))) { | |
41 | res = -EFAULT; | |
42 | goto out; | |
43 | } | |
1da177e4 | 44 | |
2e5e5592 PBG |
45 | p = &info; |
46 | break; | |
47 | case 0: | |
48 | case 2: /* read_ldt */ | |
49 | ||
50 | /* The use of info avoids kmalloc on the write case, not on the | |
51 | * read one. */ | |
52 | buf = kmalloc(bytecount, GFP_KERNEL); | |
53 | if (!buf) { | |
54 | res = -ENOMEM; | |
55 | goto out; | |
56 | } | |
57 | p = buf; | |
36decba9 | 58 | break; |
2e5e5592 PBG |
59 | default: |
60 | res = -ENOSYS; | |
1da177e4 LT |
61 | goto out; |
62 | } | |
63 | ||
858259cf | 64 | res = modify_ldt(func, p, bytecount); |
1da177e4 LT |
65 | if(res < 0) |
66 | goto out; | |
67 | ||
68 | switch(func){ | |
69 | case 0: | |
70 | case 2: | |
2e5e5592 PBG |
71 | /* Modify_ldt was for reading and returned the number of read |
72 | * bytes.*/ | |
73 | if(copy_to_user(ptr, p, res)) | |
1da177e4 | 74 | res = -EFAULT; |
1da177e4 LT |
75 | break; |
76 | } | |
77 | ||
2e5e5592 | 78 | out: |
1da177e4 | 79 | kfree(buf); |
2e5e5592 | 80 | return res; |
1da177e4 | 81 | } |
858259cf BS |
82 | |
83 | #endif | |
84 | ||
85 | #ifdef CONFIG_MODE_SKAS | |
86 | ||
87 | #include "skas.h" | |
88 | #include "skas_ptrace.h" | |
89 | #include "asm/mmu_context.h" | |
e8730eab | 90 | #include "proc_mm.h" |
858259cf BS |
91 | |
92 | long write_ldt_entry(struct mm_id * mm_idp, int func, struct user_desc * desc, | |
93 | void **addr, int done) | |
94 | { | |
95 | long res; | |
96 | ||
97 | if(proc_mm){ | |
98 | /* This is a special handling for the case, that the mm to | |
99 | * modify isn't current->active_mm. | |
100 | * If this is called directly by modify_ldt, | |
101 | * (current->active_mm->context.skas.u == mm_idp) | |
102 | * will be true. So no call to switch_mm_skas(mm_idp) is done. | |
103 | * If this is called in case of init_new_ldt or PTRACE_LDT, | |
104 | * mm_idp won't belong to current->active_mm, but child->mm. | |
105 | * So we need to switch child's mm into our userspace, then | |
106 | * later switch back. | |
107 | * | |
07f4e2c6 | 108 | * Note: I'm unsure: should interrupts be disabled here? |
858259cf BS |
109 | */ |
110 | if(!current->active_mm || current->active_mm == &init_mm || | |
111 | mm_idp != ¤t->active_mm->context.skas.id) | |
112 | switch_mm_skas(mm_idp); | |
113 | } | |
114 | ||
115 | if(ptrace_ldt) { | |
116 | struct ptrace_ldt ldt_op = (struct ptrace_ldt) { | |
117 | .func = func, | |
118 | .ptr = desc, | |
119 | .bytecount = sizeof(*desc)}; | |
120 | u32 cpu; | |
121 | int pid; | |
122 | ||
123 | if(!proc_mm) | |
124 | pid = mm_idp->u.pid; | |
125 | else { | |
126 | cpu = get_cpu(); | |
127 | pid = userspace_pid[cpu]; | |
128 | } | |
129 | ||
07f4e2c6 | 130 | res = os_ptrace_ldt(pid, 0, (unsigned long) &ldt_op); |
858259cf BS |
131 | |
132 | if(proc_mm) | |
133 | put_cpu(); | |
134 | } | |
135 | else { | |
136 | void *stub_addr; | |
137 | res = syscall_stub_data(mm_idp, (unsigned long *)desc, | |
138 | (sizeof(*desc) + sizeof(long) - 1) & | |
139 | ~(sizeof(long) - 1), | |
140 | addr, &stub_addr); | |
141 | if(!res){ | |
142 | unsigned long args[] = { func, | |
143 | (unsigned long)stub_addr, | |
144 | sizeof(*desc), | |
145 | 0, 0, 0 }; | |
146 | res = run_syscall_stub(mm_idp, __NR_modify_ldt, args, | |
147 | 0, addr, done); | |
148 | } | |
149 | } | |
150 | ||
151 | if(proc_mm){ | |
152 | /* This is the second part of special handling, that makes | |
153 | * PTRACE_LDT possible to implement. | |
154 | */ | |
155 | if(current->active_mm && current->active_mm != &init_mm && | |
156 | mm_idp != ¤t->active_mm->context.skas.id) | |
157 | switch_mm_skas(¤t->active_mm->context.skas.id); | |
158 | } | |
159 | ||
160 | return res; | |
161 | } | |
162 | ||
163 | static long read_ldt_from_host(void __user * ptr, unsigned long bytecount) | |
164 | { | |
165 | int res, n; | |
166 | struct ptrace_ldt ptrace_ldt = (struct ptrace_ldt) { | |
167 | .func = 0, | |
168 | .bytecount = bytecount, | |
5cbded58 | 169 | .ptr = kmalloc(bytecount, GFP_KERNEL)}; |
858259cf BS |
170 | u32 cpu; |
171 | ||
172 | if(ptrace_ldt.ptr == NULL) | |
173 | return -ENOMEM; | |
174 | ||
175 | /* This is called from sys_modify_ldt only, so userspace_pid gives | |
176 | * us the right number | |
177 | */ | |
178 | ||
179 | cpu = get_cpu(); | |
07f4e2c6 | 180 | res = os_ptrace_ldt(userspace_pid[cpu], 0, (unsigned long) &ptrace_ldt); |
858259cf BS |
181 | put_cpu(); |
182 | if(res < 0) | |
183 | goto out; | |
184 | ||
185 | n = copy_to_user(ptr, ptrace_ldt.ptr, res); | |
186 | if(n != 0) | |
187 | res = -EFAULT; | |
188 | ||
189 | out: | |
190 | kfree(ptrace_ldt.ptr); | |
191 | ||
192 | return res; | |
193 | } | |
194 | ||
195 | /* | |
196 | * In skas mode, we hold our own ldt data in UML. | |
197 | * Thus, the code implementing sys_modify_ldt_skas | |
198 | * is very similar to (and mostly stolen from) sys_modify_ldt | |
199 | * for arch/i386/kernel/ldt.c | |
200 | * The routines copied and modified in part are: | |
201 | * - read_ldt | |
202 | * - read_default_ldt | |
203 | * - write_ldt | |
204 | * - sys_modify_ldt_skas | |
205 | */ | |
206 | ||
207 | static int read_ldt(void __user * ptr, unsigned long bytecount) | |
208 | { | |
209 | int i, err = 0; | |
210 | unsigned long size; | |
211 | uml_ldt_t * ldt = ¤t->mm->context.skas.ldt; | |
212 | ||
213 | if(!ldt->entry_count) | |
214 | goto out; | |
215 | if(bytecount > LDT_ENTRY_SIZE*LDT_ENTRIES) | |
216 | bytecount = LDT_ENTRY_SIZE*LDT_ENTRIES; | |
217 | err = bytecount; | |
218 | ||
219 | if(ptrace_ldt){ | |
220 | return read_ldt_from_host(ptr, bytecount); | |
221 | } | |
222 | ||
223 | down(&ldt->semaphore); | |
224 | if(ldt->entry_count <= LDT_DIRECT_ENTRIES){ | |
225 | size = LDT_ENTRY_SIZE*LDT_DIRECT_ENTRIES; | |
226 | if(size > bytecount) | |
227 | size = bytecount; | |
e23181de | 228 | if(copy_to_user(ptr, ldt->u.entries, size)) |
858259cf BS |
229 | err = -EFAULT; |
230 | bytecount -= size; | |
231 | ptr += size; | |
232 | } | |
233 | else { | |
234 | for(i=0; i<ldt->entry_count/LDT_ENTRIES_PER_PAGE && bytecount; | |
235 | i++){ | |
236 | size = PAGE_SIZE; | |
237 | if(size > bytecount) | |
238 | size = bytecount; | |
e23181de | 239 | if(copy_to_user(ptr, ldt->u.pages[i], size)){ |
858259cf BS |
240 | err = -EFAULT; |
241 | break; | |
242 | } | |
243 | bytecount -= size; | |
244 | ptr += size; | |
245 | } | |
246 | } | |
247 | up(&ldt->semaphore); | |
248 | ||
249 | if(bytecount == 0 || err == -EFAULT) | |
250 | goto out; | |
251 | ||
252 | if(clear_user(ptr, bytecount)) | |
253 | err = -EFAULT; | |
254 | ||
255 | out: | |
256 | return err; | |
257 | } | |
258 | ||
259 | static int read_default_ldt(void __user * ptr, unsigned long bytecount) | |
260 | { | |
261 | int err; | |
262 | ||
263 | if(bytecount > 5*LDT_ENTRY_SIZE) | |
264 | bytecount = 5*LDT_ENTRY_SIZE; | |
265 | ||
266 | err = bytecount; | |
267 | /* UML doesn't support lcall7 and lcall27. | |
268 | * So, we don't really have a default ldt, but emulate | |
269 | * an empty ldt of common host default ldt size. | |
270 | */ | |
271 | if(clear_user(ptr, bytecount)) | |
272 | err = -EFAULT; | |
273 | ||
274 | return err; | |
275 | } | |
276 | ||
277 | static int write_ldt(void __user * ptr, unsigned long bytecount, int func) | |
278 | { | |
279 | uml_ldt_t * ldt = ¤t->mm->context.skas.ldt; | |
280 | struct mm_id * mm_idp = ¤t->mm->context.skas.id; | |
281 | int i, err; | |
282 | struct user_desc ldt_info; | |
283 | struct ldt_entry entry0, *ldt_p; | |
284 | void *addr = NULL; | |
285 | ||
286 | err = -EINVAL; | |
287 | if(bytecount != sizeof(ldt_info)) | |
288 | goto out; | |
289 | err = -EFAULT; | |
290 | if(copy_from_user(&ldt_info, ptr, sizeof(ldt_info))) | |
291 | goto out; | |
292 | ||
293 | err = -EINVAL; | |
294 | if(ldt_info.entry_number >= LDT_ENTRIES) | |
295 | goto out; | |
296 | if(ldt_info.contents == 3){ | |
297 | if (func == 1) | |
298 | goto out; | |
299 | if (ldt_info.seg_not_present == 0) | |
300 | goto out; | |
301 | } | |
302 | ||
303 | if(!ptrace_ldt) | |
304 | down(&ldt->semaphore); | |
305 | ||
306 | err = write_ldt_entry(mm_idp, func, &ldt_info, &addr, 1); | |
307 | if(err) | |
308 | goto out_unlock; | |
309 | else if(ptrace_ldt) { | |
310 | /* With PTRACE_LDT available, this is used as a flag only */ | |
311 | ldt->entry_count = 1; | |
312 | goto out; | |
313 | } | |
314 | ||
315 | if(ldt_info.entry_number >= ldt->entry_count && | |
316 | ldt_info.entry_number >= LDT_DIRECT_ENTRIES){ | |
317 | for(i=ldt->entry_count/LDT_ENTRIES_PER_PAGE; | |
318 | i*LDT_ENTRIES_PER_PAGE <= ldt_info.entry_number; | |
319 | i++){ | |
320 | if(i == 0) | |
e23181de JD |
321 | memcpy(&entry0, ldt->u.entries, |
322 | sizeof(entry0)); | |
323 | ldt->u.pages[i] = (struct ldt_entry *) | |
324 | __get_free_page(GFP_KERNEL|__GFP_ZERO); | |
325 | if(!ldt->u.pages[i]){ | |
858259cf BS |
326 | err = -ENOMEM; |
327 | /* Undo the change in host */ | |
328 | memset(&ldt_info, 0, sizeof(ldt_info)); | |
329 | write_ldt_entry(mm_idp, 1, &ldt_info, &addr, 1); | |
330 | goto out_unlock; | |
331 | } | |
332 | if(i == 0) { | |
e23181de JD |
333 | memcpy(ldt->u.pages[0], &entry0, |
334 | sizeof(entry0)); | |
335 | memcpy(ldt->u.pages[0]+1, ldt->u.entries+1, | |
858259cf BS |
336 | sizeof(entry0)*(LDT_DIRECT_ENTRIES-1)); |
337 | } | |
338 | ldt->entry_count = (i + 1) * LDT_ENTRIES_PER_PAGE; | |
339 | } | |
340 | } | |
341 | if(ldt->entry_count <= ldt_info.entry_number) | |
342 | ldt->entry_count = ldt_info.entry_number + 1; | |
343 | ||
344 | if(ldt->entry_count <= LDT_DIRECT_ENTRIES) | |
e23181de | 345 | ldt_p = ldt->u.entries + ldt_info.entry_number; |
858259cf | 346 | else |
e23181de | 347 | ldt_p = ldt->u.pages[ldt_info.entry_number/LDT_ENTRIES_PER_PAGE] + |
858259cf BS |
348 | ldt_info.entry_number%LDT_ENTRIES_PER_PAGE; |
349 | ||
350 | if(ldt_info.base_addr == 0 && ldt_info.limit == 0 && | |
351 | (func == 1 || LDT_empty(&ldt_info))){ | |
352 | ldt_p->a = 0; | |
353 | ldt_p->b = 0; | |
354 | } | |
355 | else{ | |
356 | if (func == 1) | |
357 | ldt_info.useable = 0; | |
358 | ldt_p->a = LDT_entry_a(&ldt_info); | |
359 | ldt_p->b = LDT_entry_b(&ldt_info); | |
360 | } | |
361 | err = 0; | |
362 | ||
363 | out_unlock: | |
364 | up(&ldt->semaphore); | |
365 | out: | |
366 | return err; | |
367 | } | |
368 | ||
369 | static long do_modify_ldt_skas(int func, void __user *ptr, | |
370 | unsigned long bytecount) | |
371 | { | |
372 | int ret = -ENOSYS; | |
373 | ||
374 | switch (func) { | |
375 | case 0: | |
376 | ret = read_ldt(ptr, bytecount); | |
377 | break; | |
378 | case 1: | |
379 | case 0x11: | |
380 | ret = write_ldt(ptr, bytecount, func); | |
381 | break; | |
382 | case 2: | |
383 | ret = read_default_ldt(ptr, bytecount); | |
384 | break; | |
385 | } | |
386 | return ret; | |
387 | } | |
388 | ||
389 | short dummy_list[9] = {0, -1}; | |
390 | short * host_ldt_entries = NULL; | |
391 | ||
392 | void ldt_get_host_info(void) | |
393 | { | |
394 | long ret; | |
395 | struct ldt_entry * ldt; | |
396 | int i, size, k, order; | |
397 | ||
398 | host_ldt_entries = dummy_list+1; | |
399 | ||
400 | for(i = LDT_PAGES_MAX-1, order=0; i; i>>=1, order++); | |
401 | ||
402 | ldt = (struct ldt_entry *) | |
403 | __get_free_pages(GFP_KERNEL|__GFP_ZERO, order); | |
404 | if(ldt == NULL) { | |
405 | printk("ldt_get_host_info: couldn't allocate buffer for host ldt\n"); | |
406 | return; | |
407 | } | |
408 | ||
409 | ret = modify_ldt(0, ldt, (1<<order)*PAGE_SIZE); | |
410 | if(ret < 0) { | |
411 | printk("ldt_get_host_info: couldn't read host ldt\n"); | |
412 | goto out_free; | |
413 | } | |
414 | if(ret == 0) { | |
415 | /* default_ldt is active, simply write an empty entry 0 */ | |
416 | host_ldt_entries = dummy_list; | |
417 | goto out_free; | |
418 | } | |
419 | ||
420 | for(i=0, size=0; i<ret/LDT_ENTRY_SIZE; i++){ | |
421 | if(ldt[i].a != 0 || ldt[i].b != 0) | |
422 | size++; | |
423 | } | |
424 | ||
91b165c0 | 425 | if(size < ARRAY_SIZE(dummy_list)) |
858259cf | 426 | host_ldt_entries = dummy_list; |
858259cf BS |
427 | else { |
428 | size = (size + 1) * sizeof(dummy_list[0]); | |
5cbded58 | 429 | host_ldt_entries = kmalloc(size, GFP_KERNEL); |
858259cf BS |
430 | if(host_ldt_entries == NULL) { |
431 | printk("ldt_get_host_info: couldn't allocate host ldt list\n"); | |
432 | goto out_free; | |
433 | } | |
434 | } | |
435 | ||
436 | for(i=0, k=0; i<ret/LDT_ENTRY_SIZE; i++){ | |
437 | if(ldt[i].a != 0 || ldt[i].b != 0) { | |
438 | host_ldt_entries[k++] = i; | |
439 | } | |
440 | } | |
441 | host_ldt_entries[k] = -1; | |
442 | ||
443 | out_free: | |
444 | free_pages((unsigned long)ldt, order); | |
445 | } | |
446 | ||
447 | long init_new_ldt(struct mmu_context_skas * new_mm, | |
448 | struct mmu_context_skas * from_mm) | |
449 | { | |
450 | struct user_desc desc; | |
451 | short * num_p; | |
452 | int i; | |
453 | long page, err=0; | |
454 | void *addr = NULL; | |
12919aa6 | 455 | struct proc_mm_op copy; |
858259cf | 456 | |
858259cf BS |
457 | |
458 | if(!ptrace_ldt) | |
459 | init_MUTEX(&new_mm->ldt.semaphore); | |
460 | ||
461 | if(!from_mm){ | |
12919aa6 | 462 | memset(&desc, 0, sizeof(desc)); |
858259cf BS |
463 | /* |
464 | * We have to initialize a clean ldt. | |
465 | */ | |
466 | if(proc_mm) { | |
467 | /* | |
468 | * If the new mm was created using proc_mm, host's | |
469 | * default-ldt currently is assigned, which normally | |
470 | * contains the call-gates for lcall7 and lcall27. | |
471 | * To remove these gates, we simply write an empty | |
472 | * entry as number 0 to the host. | |
473 | */ | |
474 | err = write_ldt_entry(&new_mm->id, 1, &desc, | |
475 | &addr, 1); | |
476 | } | |
477 | else{ | |
478 | /* | |
479 | * Now we try to retrieve info about the ldt, we | |
480 | * inherited from the host. All ldt-entries found | |
481 | * will be reset in the following loop | |
482 | */ | |
483 | if(host_ldt_entries == NULL) | |
484 | ldt_get_host_info(); | |
485 | for(num_p=host_ldt_entries; *num_p != -1; num_p++){ | |
486 | desc.entry_number = *num_p; | |
487 | err = write_ldt_entry(&new_mm->id, 1, &desc, | |
488 | &addr, *(num_p + 1) == -1); | |
489 | if(err) | |
490 | break; | |
491 | } | |
492 | } | |
493 | new_mm->ldt.entry_count = 0; | |
12919aa6 BS |
494 | |
495 | goto out; | |
858259cf | 496 | } |
12919aa6 BS |
497 | |
498 | if(proc_mm){ | |
499 | /* We have a valid from_mm, so we now have to copy the LDT of | |
500 | * from_mm to new_mm, because using proc_mm an new mm with | |
501 | * an empty/default LDT was created in new_mm() | |
502 | */ | |
503 | copy = ((struct proc_mm_op) { .op = MM_COPY_SEGMENTS, | |
504 | .u = | |
505 | { .copy_segments = | |
506 | from_mm->id.u.mm_fd } } ); | |
507 | i = os_write_file(new_mm->id.u.mm_fd, ©, sizeof(copy)); | |
508 | if(i != sizeof(copy)) | |
509 | printk("new_mm : /proc/mm copy_segments failed, " | |
510 | "err = %d\n", -i); | |
511 | } | |
512 | ||
513 | if(!ptrace_ldt) { | |
858259cf BS |
514 | /* Our local LDT is used to supply the data for |
515 | * modify_ldt(READLDT), if PTRACE_LDT isn't available, | |
516 | * i.e., we have to use the stub for modify_ldt, which | |
517 | * can't handle the big read buffer of up to 64kB. | |
518 | */ | |
519 | down(&from_mm->ldt.semaphore); | |
520 | if(from_mm->ldt.entry_count <= LDT_DIRECT_ENTRIES){ | |
e23181de JD |
521 | memcpy(new_mm->ldt.u.entries, from_mm->ldt.u.entries, |
522 | sizeof(new_mm->ldt.u.entries)); | |
858259cf BS |
523 | } |
524 | else{ | |
525 | i = from_mm->ldt.entry_count / LDT_ENTRIES_PER_PAGE; | |
526 | while(i-->0){ | |
527 | page = __get_free_page(GFP_KERNEL|__GFP_ZERO); | |
528 | if (!page){ | |
529 | err = -ENOMEM; | |
530 | break; | |
531 | } | |
e23181de JD |
532 | new_mm->ldt.u.pages[i] = |
533 | (struct ldt_entry *) page; | |
534 | memcpy(new_mm->ldt.u.pages[i], | |
535 | from_mm->ldt.u.pages[i], PAGE_SIZE); | |
858259cf BS |
536 | } |
537 | } | |
538 | new_mm->ldt.entry_count = from_mm->ldt.entry_count; | |
539 | up(&from_mm->ldt.semaphore); | |
540 | } | |
541 | ||
12919aa6 | 542 | out: |
858259cf BS |
543 | return err; |
544 | } | |
545 | ||
546 | ||
547 | void free_ldt(struct mmu_context_skas * mm) | |
548 | { | |
549 | int i; | |
550 | ||
551 | if(!ptrace_ldt && mm->ldt.entry_count > LDT_DIRECT_ENTRIES){ | |
552 | i = mm->ldt.entry_count / LDT_ENTRIES_PER_PAGE; | |
553 | while(i-- > 0){ | |
e23181de | 554 | free_page((long )mm->ldt.u.pages[i]); |
858259cf BS |
555 | } |
556 | } | |
557 | mm->ldt.entry_count = 0; | |
558 | } | |
559 | #endif | |
560 | ||
561 | int sys_modify_ldt(int func, void __user *ptr, unsigned long bytecount) | |
562 | { | |
563 | return(CHOOSE_MODE_PROC(do_modify_ldt_tt, do_modify_ldt_skas, func, | |
564 | ptr, bytecount)); | |
565 | } |