]>
Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* |
2 | * Copyright (C) 2001, 2002 Jeff Dike (jdike@karaya.com) | |
3 | * Licensed under the GPL | |
4 | */ | |
5 | ||
858259cf | 6 | #include "linux/stddef.h" |
1da177e4 | 7 | #include "linux/config.h" |
2e5e5592 | 8 | #include "linux/sched.h" |
1da177e4 | 9 | #include "linux/slab.h" |
2e5e5592 | 10 | #include "linux/types.h" |
858259cf | 11 | #include "linux/errno.h" |
1da177e4 | 12 | #include "asm/uaccess.h" |
2e5e5592 PBG |
13 | #include "asm/smp.h" |
14 | #include "asm/ldt.h" | |
858259cf | 15 | #include "asm/unistd.h" |
1da177e4 LT |
16 | #include "choose-mode.h" |
17 | #include "kern.h" | |
2e5e5592 | 18 | #include "mode_kern.h" |
1da177e4 | 19 | |
2e5e5592 | 20 | extern int modify_ldt(int func, void *ptr, unsigned long bytecount); |
1da177e4 | 21 | |
858259cf | 22 | #ifdef CONFIG_MODE_TT |
2e5e5592 | 23 | |
858259cf BS |
24 | static long do_modify_ldt_tt(int func, void __user *ptr, |
25 | unsigned long bytecount) | |
2e5e5592 PBG |
26 | { |
27 | struct user_desc info; | |
28 | int res = 0; | |
29 | void *buf = NULL; | |
30 | void *p = NULL; /* What we pass to host. */ | |
1da177e4 LT |
31 | |
32 | switch(func){ | |
33 | case 1: | |
2e5e5592 PBG |
34 | case 0x11: /* write_ldt */ |
35 | /* Do this check now to avoid overflows. */ | |
36 | if (bytecount != sizeof(struct user_desc)) { | |
37 | res = -EINVAL; | |
38 | goto out; | |
39 | } | |
40 | ||
41 | if(copy_from_user(&info, ptr, sizeof(info))) { | |
42 | res = -EFAULT; | |
43 | goto out; | |
44 | } | |
1da177e4 | 45 | |
2e5e5592 PBG |
46 | p = &info; |
47 | break; | |
48 | case 0: | |
49 | case 2: /* read_ldt */ | |
50 | ||
51 | /* The use of info avoids kmalloc on the write case, not on the | |
52 | * read one. */ | |
53 | buf = kmalloc(bytecount, GFP_KERNEL); | |
54 | if (!buf) { | |
55 | res = -ENOMEM; | |
56 | goto out; | |
57 | } | |
58 | p = buf; | |
36decba9 | 59 | break; |
2e5e5592 PBG |
60 | default: |
61 | res = -ENOSYS; | |
1da177e4 LT |
62 | goto out; |
63 | } | |
64 | ||
858259cf | 65 | res = modify_ldt(func, p, bytecount); |
1da177e4 LT |
66 | if(res < 0) |
67 | goto out; | |
68 | ||
69 | switch(func){ | |
70 | case 0: | |
71 | case 2: | |
2e5e5592 PBG |
72 | /* Modify_ldt was for reading and returned the number of read |
73 | * bytes.*/ | |
74 | if(copy_to_user(ptr, p, res)) | |
1da177e4 | 75 | res = -EFAULT; |
1da177e4 LT |
76 | break; |
77 | } | |
78 | ||
2e5e5592 | 79 | out: |
1da177e4 | 80 | kfree(buf); |
2e5e5592 | 81 | return res; |
1da177e4 | 82 | } |
858259cf BS |
83 | |
84 | #endif | |
85 | ||
86 | #ifdef CONFIG_MODE_SKAS | |
87 | ||
88 | #include "skas.h" | |
89 | #include "skas_ptrace.h" | |
90 | #include "asm/mmu_context.h" | |
91 | ||
92 | long write_ldt_entry(struct mm_id * mm_idp, int func, struct user_desc * desc, | |
93 | void **addr, int done) | |
94 | { | |
95 | long res; | |
96 | ||
97 | if(proc_mm){ | |
98 | /* This is a special handling for the case, that the mm to | |
99 | * modify isn't current->active_mm. | |
100 | * If this is called directly by modify_ldt, | |
101 | * (current->active_mm->context.skas.u == mm_idp) | |
102 | * will be true. So no call to switch_mm_skas(mm_idp) is done. | |
103 | * If this is called in case of init_new_ldt or PTRACE_LDT, | |
104 | * mm_idp won't belong to current->active_mm, but child->mm. | |
105 | * So we need to switch child's mm into our userspace, then | |
106 | * later switch back. | |
107 | * | |
108 | * Note: I'm unshure: should interrupts be disabled here? | |
109 | */ | |
110 | if(!current->active_mm || current->active_mm == &init_mm || | |
111 | mm_idp != ¤t->active_mm->context.skas.id) | |
112 | switch_mm_skas(mm_idp); | |
113 | } | |
114 | ||
115 | if(ptrace_ldt) { | |
116 | struct ptrace_ldt ldt_op = (struct ptrace_ldt) { | |
117 | .func = func, | |
118 | .ptr = desc, | |
119 | .bytecount = sizeof(*desc)}; | |
120 | u32 cpu; | |
121 | int pid; | |
122 | ||
123 | if(!proc_mm) | |
124 | pid = mm_idp->u.pid; | |
125 | else { | |
126 | cpu = get_cpu(); | |
127 | pid = userspace_pid[cpu]; | |
128 | } | |
129 | ||
130 | res = ptrace(PTRACE_LDT, pid, 0, (unsigned long) &ldt_op); | |
131 | if(res) | |
132 | res = errno; | |
133 | ||
134 | if(proc_mm) | |
135 | put_cpu(); | |
136 | } | |
137 | else { | |
138 | void *stub_addr; | |
139 | res = syscall_stub_data(mm_idp, (unsigned long *)desc, | |
140 | (sizeof(*desc) + sizeof(long) - 1) & | |
141 | ~(sizeof(long) - 1), | |
142 | addr, &stub_addr); | |
143 | if(!res){ | |
144 | unsigned long args[] = { func, | |
145 | (unsigned long)stub_addr, | |
146 | sizeof(*desc), | |
147 | 0, 0, 0 }; | |
148 | res = run_syscall_stub(mm_idp, __NR_modify_ldt, args, | |
149 | 0, addr, done); | |
150 | } | |
151 | } | |
152 | ||
153 | if(proc_mm){ | |
154 | /* This is the second part of special handling, that makes | |
155 | * PTRACE_LDT possible to implement. | |
156 | */ | |
157 | if(current->active_mm && current->active_mm != &init_mm && | |
158 | mm_idp != ¤t->active_mm->context.skas.id) | |
159 | switch_mm_skas(¤t->active_mm->context.skas.id); | |
160 | } | |
161 | ||
162 | return res; | |
163 | } | |
164 | ||
165 | static long read_ldt_from_host(void __user * ptr, unsigned long bytecount) | |
166 | { | |
167 | int res, n; | |
168 | struct ptrace_ldt ptrace_ldt = (struct ptrace_ldt) { | |
169 | .func = 0, | |
170 | .bytecount = bytecount, | |
171 | .ptr = (void *)kmalloc(bytecount, GFP_KERNEL)}; | |
172 | u32 cpu; | |
173 | ||
174 | if(ptrace_ldt.ptr == NULL) | |
175 | return -ENOMEM; | |
176 | ||
177 | /* This is called from sys_modify_ldt only, so userspace_pid gives | |
178 | * us the right number | |
179 | */ | |
180 | ||
181 | cpu = get_cpu(); | |
182 | res = ptrace(PTRACE_LDT, userspace_pid[cpu], 0, | |
183 | (unsigned long) &ptrace_ldt); | |
184 | put_cpu(); | |
185 | if(res < 0) | |
186 | goto out; | |
187 | ||
188 | n = copy_to_user(ptr, ptrace_ldt.ptr, res); | |
189 | if(n != 0) | |
190 | res = -EFAULT; | |
191 | ||
192 | out: | |
193 | kfree(ptrace_ldt.ptr); | |
194 | ||
195 | return res; | |
196 | } | |
197 | ||
198 | /* | |
199 | * In skas mode, we hold our own ldt data in UML. | |
200 | * Thus, the code implementing sys_modify_ldt_skas | |
201 | * is very similar to (and mostly stolen from) sys_modify_ldt | |
202 | * for arch/i386/kernel/ldt.c | |
203 | * The routines copied and modified in part are: | |
204 | * - read_ldt | |
205 | * - read_default_ldt | |
206 | * - write_ldt | |
207 | * - sys_modify_ldt_skas | |
208 | */ | |
209 | ||
210 | static int read_ldt(void __user * ptr, unsigned long bytecount) | |
211 | { | |
212 | int i, err = 0; | |
213 | unsigned long size; | |
214 | uml_ldt_t * ldt = ¤t->mm->context.skas.ldt; | |
215 | ||
216 | if(!ldt->entry_count) | |
217 | goto out; | |
218 | if(bytecount > LDT_ENTRY_SIZE*LDT_ENTRIES) | |
219 | bytecount = LDT_ENTRY_SIZE*LDT_ENTRIES; | |
220 | err = bytecount; | |
221 | ||
222 | if(ptrace_ldt){ | |
223 | return read_ldt_from_host(ptr, bytecount); | |
224 | } | |
225 | ||
226 | down(&ldt->semaphore); | |
227 | if(ldt->entry_count <= LDT_DIRECT_ENTRIES){ | |
228 | size = LDT_ENTRY_SIZE*LDT_DIRECT_ENTRIES; | |
229 | if(size > bytecount) | |
230 | size = bytecount; | |
e23181de | 231 | if(copy_to_user(ptr, ldt->u.entries, size)) |
858259cf BS |
232 | err = -EFAULT; |
233 | bytecount -= size; | |
234 | ptr += size; | |
235 | } | |
236 | else { | |
237 | for(i=0; i<ldt->entry_count/LDT_ENTRIES_PER_PAGE && bytecount; | |
238 | i++){ | |
239 | size = PAGE_SIZE; | |
240 | if(size > bytecount) | |
241 | size = bytecount; | |
e23181de | 242 | if(copy_to_user(ptr, ldt->u.pages[i], size)){ |
858259cf BS |
243 | err = -EFAULT; |
244 | break; | |
245 | } | |
246 | bytecount -= size; | |
247 | ptr += size; | |
248 | } | |
249 | } | |
250 | up(&ldt->semaphore); | |
251 | ||
252 | if(bytecount == 0 || err == -EFAULT) | |
253 | goto out; | |
254 | ||
255 | if(clear_user(ptr, bytecount)) | |
256 | err = -EFAULT; | |
257 | ||
258 | out: | |
259 | return err; | |
260 | } | |
261 | ||
262 | static int read_default_ldt(void __user * ptr, unsigned long bytecount) | |
263 | { | |
264 | int err; | |
265 | ||
266 | if(bytecount > 5*LDT_ENTRY_SIZE) | |
267 | bytecount = 5*LDT_ENTRY_SIZE; | |
268 | ||
269 | err = bytecount; | |
270 | /* UML doesn't support lcall7 and lcall27. | |
271 | * So, we don't really have a default ldt, but emulate | |
272 | * an empty ldt of common host default ldt size. | |
273 | */ | |
274 | if(clear_user(ptr, bytecount)) | |
275 | err = -EFAULT; | |
276 | ||
277 | return err; | |
278 | } | |
279 | ||
280 | static int write_ldt(void __user * ptr, unsigned long bytecount, int func) | |
281 | { | |
282 | uml_ldt_t * ldt = ¤t->mm->context.skas.ldt; | |
283 | struct mm_id * mm_idp = ¤t->mm->context.skas.id; | |
284 | int i, err; | |
285 | struct user_desc ldt_info; | |
286 | struct ldt_entry entry0, *ldt_p; | |
287 | void *addr = NULL; | |
288 | ||
289 | err = -EINVAL; | |
290 | if(bytecount != sizeof(ldt_info)) | |
291 | goto out; | |
292 | err = -EFAULT; | |
293 | if(copy_from_user(&ldt_info, ptr, sizeof(ldt_info))) | |
294 | goto out; | |
295 | ||
296 | err = -EINVAL; | |
297 | if(ldt_info.entry_number >= LDT_ENTRIES) | |
298 | goto out; | |
299 | if(ldt_info.contents == 3){ | |
300 | if (func == 1) | |
301 | goto out; | |
302 | if (ldt_info.seg_not_present == 0) | |
303 | goto out; | |
304 | } | |
305 | ||
306 | if(!ptrace_ldt) | |
307 | down(&ldt->semaphore); | |
308 | ||
309 | err = write_ldt_entry(mm_idp, func, &ldt_info, &addr, 1); | |
310 | if(err) | |
311 | goto out_unlock; | |
312 | else if(ptrace_ldt) { | |
313 | /* With PTRACE_LDT available, this is used as a flag only */ | |
314 | ldt->entry_count = 1; | |
315 | goto out; | |
316 | } | |
317 | ||
318 | if(ldt_info.entry_number >= ldt->entry_count && | |
319 | ldt_info.entry_number >= LDT_DIRECT_ENTRIES){ | |
320 | for(i=ldt->entry_count/LDT_ENTRIES_PER_PAGE; | |
321 | i*LDT_ENTRIES_PER_PAGE <= ldt_info.entry_number; | |
322 | i++){ | |
323 | if(i == 0) | |
e23181de JD |
324 | memcpy(&entry0, ldt->u.entries, |
325 | sizeof(entry0)); | |
326 | ldt->u.pages[i] = (struct ldt_entry *) | |
327 | __get_free_page(GFP_KERNEL|__GFP_ZERO); | |
328 | if(!ldt->u.pages[i]){ | |
858259cf BS |
329 | err = -ENOMEM; |
330 | /* Undo the change in host */ | |
331 | memset(&ldt_info, 0, sizeof(ldt_info)); | |
332 | write_ldt_entry(mm_idp, 1, &ldt_info, &addr, 1); | |
333 | goto out_unlock; | |
334 | } | |
335 | if(i == 0) { | |
e23181de JD |
336 | memcpy(ldt->u.pages[0], &entry0, |
337 | sizeof(entry0)); | |
338 | memcpy(ldt->u.pages[0]+1, ldt->u.entries+1, | |
858259cf BS |
339 | sizeof(entry0)*(LDT_DIRECT_ENTRIES-1)); |
340 | } | |
341 | ldt->entry_count = (i + 1) * LDT_ENTRIES_PER_PAGE; | |
342 | } | |
343 | } | |
344 | if(ldt->entry_count <= ldt_info.entry_number) | |
345 | ldt->entry_count = ldt_info.entry_number + 1; | |
346 | ||
347 | if(ldt->entry_count <= LDT_DIRECT_ENTRIES) | |
e23181de | 348 | ldt_p = ldt->u.entries + ldt_info.entry_number; |
858259cf | 349 | else |
e23181de | 350 | ldt_p = ldt->u.pages[ldt_info.entry_number/LDT_ENTRIES_PER_PAGE] + |
858259cf BS |
351 | ldt_info.entry_number%LDT_ENTRIES_PER_PAGE; |
352 | ||
353 | if(ldt_info.base_addr == 0 && ldt_info.limit == 0 && | |
354 | (func == 1 || LDT_empty(&ldt_info))){ | |
355 | ldt_p->a = 0; | |
356 | ldt_p->b = 0; | |
357 | } | |
358 | else{ | |
359 | if (func == 1) | |
360 | ldt_info.useable = 0; | |
361 | ldt_p->a = LDT_entry_a(&ldt_info); | |
362 | ldt_p->b = LDT_entry_b(&ldt_info); | |
363 | } | |
364 | err = 0; | |
365 | ||
366 | out_unlock: | |
367 | up(&ldt->semaphore); | |
368 | out: | |
369 | return err; | |
370 | } | |
371 | ||
372 | static long do_modify_ldt_skas(int func, void __user *ptr, | |
373 | unsigned long bytecount) | |
374 | { | |
375 | int ret = -ENOSYS; | |
376 | ||
377 | switch (func) { | |
378 | case 0: | |
379 | ret = read_ldt(ptr, bytecount); | |
380 | break; | |
381 | case 1: | |
382 | case 0x11: | |
383 | ret = write_ldt(ptr, bytecount, func); | |
384 | break; | |
385 | case 2: | |
386 | ret = read_default_ldt(ptr, bytecount); | |
387 | break; | |
388 | } | |
389 | return ret; | |
390 | } | |
391 | ||
392 | short dummy_list[9] = {0, -1}; | |
393 | short * host_ldt_entries = NULL; | |
394 | ||
395 | void ldt_get_host_info(void) | |
396 | { | |
397 | long ret; | |
398 | struct ldt_entry * ldt; | |
399 | int i, size, k, order; | |
400 | ||
401 | host_ldt_entries = dummy_list+1; | |
402 | ||
403 | for(i = LDT_PAGES_MAX-1, order=0; i; i>>=1, order++); | |
404 | ||
405 | ldt = (struct ldt_entry *) | |
406 | __get_free_pages(GFP_KERNEL|__GFP_ZERO, order); | |
407 | if(ldt == NULL) { | |
408 | printk("ldt_get_host_info: couldn't allocate buffer for host ldt\n"); | |
409 | return; | |
410 | } | |
411 | ||
412 | ret = modify_ldt(0, ldt, (1<<order)*PAGE_SIZE); | |
413 | if(ret < 0) { | |
414 | printk("ldt_get_host_info: couldn't read host ldt\n"); | |
415 | goto out_free; | |
416 | } | |
417 | if(ret == 0) { | |
418 | /* default_ldt is active, simply write an empty entry 0 */ | |
419 | host_ldt_entries = dummy_list; | |
420 | goto out_free; | |
421 | } | |
422 | ||
423 | for(i=0, size=0; i<ret/LDT_ENTRY_SIZE; i++){ | |
424 | if(ldt[i].a != 0 || ldt[i].b != 0) | |
425 | size++; | |
426 | } | |
427 | ||
428 | if(size < sizeof(dummy_list)/sizeof(dummy_list[0])) { | |
429 | host_ldt_entries = dummy_list; | |
430 | } | |
431 | else { | |
432 | size = (size + 1) * sizeof(dummy_list[0]); | |
433 | host_ldt_entries = (short *)kmalloc(size, GFP_KERNEL); | |
434 | if(host_ldt_entries == NULL) { | |
435 | printk("ldt_get_host_info: couldn't allocate host ldt list\n"); | |
436 | goto out_free; | |
437 | } | |
438 | } | |
439 | ||
440 | for(i=0, k=0; i<ret/LDT_ENTRY_SIZE; i++){ | |
441 | if(ldt[i].a != 0 || ldt[i].b != 0) { | |
442 | host_ldt_entries[k++] = i; | |
443 | } | |
444 | } | |
445 | host_ldt_entries[k] = -1; | |
446 | ||
447 | out_free: | |
448 | free_pages((unsigned long)ldt, order); | |
449 | } | |
450 | ||
451 | long init_new_ldt(struct mmu_context_skas * new_mm, | |
452 | struct mmu_context_skas * from_mm) | |
453 | { | |
454 | struct user_desc desc; | |
455 | short * num_p; | |
456 | int i; | |
457 | long page, err=0; | |
458 | void *addr = NULL; | |
459 | ||
460 | memset(&desc, 0, sizeof(desc)); | |
461 | ||
462 | if(!ptrace_ldt) | |
463 | init_MUTEX(&new_mm->ldt.semaphore); | |
464 | ||
465 | if(!from_mm){ | |
466 | /* | |
467 | * We have to initialize a clean ldt. | |
468 | */ | |
469 | if(proc_mm) { | |
470 | /* | |
471 | * If the new mm was created using proc_mm, host's | |
472 | * default-ldt currently is assigned, which normally | |
473 | * contains the call-gates for lcall7 and lcall27. | |
474 | * To remove these gates, we simply write an empty | |
475 | * entry as number 0 to the host. | |
476 | */ | |
477 | err = write_ldt_entry(&new_mm->id, 1, &desc, | |
478 | &addr, 1); | |
479 | } | |
480 | else{ | |
481 | /* | |
482 | * Now we try to retrieve info about the ldt, we | |
483 | * inherited from the host. All ldt-entries found | |
484 | * will be reset in the following loop | |
485 | */ | |
486 | if(host_ldt_entries == NULL) | |
487 | ldt_get_host_info(); | |
488 | for(num_p=host_ldt_entries; *num_p != -1; num_p++){ | |
489 | desc.entry_number = *num_p; | |
490 | err = write_ldt_entry(&new_mm->id, 1, &desc, | |
491 | &addr, *(num_p + 1) == -1); | |
492 | if(err) | |
493 | break; | |
494 | } | |
495 | } | |
496 | new_mm->ldt.entry_count = 0; | |
497 | } | |
498 | else if (!ptrace_ldt) { | |
499 | /* Our local LDT is used to supply the data for | |
500 | * modify_ldt(READLDT), if PTRACE_LDT isn't available, | |
501 | * i.e., we have to use the stub for modify_ldt, which | |
502 | * can't handle the big read buffer of up to 64kB. | |
503 | */ | |
504 | down(&from_mm->ldt.semaphore); | |
505 | if(from_mm->ldt.entry_count <= LDT_DIRECT_ENTRIES){ | |
e23181de JD |
506 | memcpy(new_mm->ldt.u.entries, from_mm->ldt.u.entries, |
507 | sizeof(new_mm->ldt.u.entries)); | |
858259cf BS |
508 | } |
509 | else{ | |
510 | i = from_mm->ldt.entry_count / LDT_ENTRIES_PER_PAGE; | |
511 | while(i-->0){ | |
512 | page = __get_free_page(GFP_KERNEL|__GFP_ZERO); | |
513 | if (!page){ | |
514 | err = -ENOMEM; | |
515 | break; | |
516 | } | |
e23181de JD |
517 | new_mm->ldt.u.pages[i] = |
518 | (struct ldt_entry *) page; | |
519 | memcpy(new_mm->ldt.u.pages[i], | |
520 | from_mm->ldt.u.pages[i], PAGE_SIZE); | |
858259cf BS |
521 | } |
522 | } | |
523 | new_mm->ldt.entry_count = from_mm->ldt.entry_count; | |
524 | up(&from_mm->ldt.semaphore); | |
525 | } | |
526 | ||
527 | return err; | |
528 | } | |
529 | ||
530 | ||
531 | void free_ldt(struct mmu_context_skas * mm) | |
532 | { | |
533 | int i; | |
534 | ||
535 | if(!ptrace_ldt && mm->ldt.entry_count > LDT_DIRECT_ENTRIES){ | |
536 | i = mm->ldt.entry_count / LDT_ENTRIES_PER_PAGE; | |
537 | while(i-- > 0){ | |
e23181de | 538 | free_page((long )mm->ldt.u.pages[i]); |
858259cf BS |
539 | } |
540 | } | |
541 | mm->ldt.entry_count = 0; | |
542 | } | |
543 | #endif | |
544 | ||
545 | int sys_modify_ldt(int func, void __user *ptr, unsigned long bytecount) | |
546 | { | |
547 | return(CHOOSE_MODE_PROC(do_modify_ldt_tt, do_modify_ldt_skas, func, | |
548 | ptr, bytecount)); | |
549 | } |