]>
Commit | Line | Data |
---|---|---|
1da177e4 | 1 | /* |
1da177e4 LT |
2 | * Copyright (C) 1992 Krishna Balasubramanian and Linus Torvalds |
3 | * Copyright (C) 1999 Ingo Molnar <mingo@redhat.com> | |
4 | * Copyright (C) 2002 Andi Kleen | |
78aa1f66 | 5 | * |
1da177e4 | 6 | * This handles calls from both 32bit and 64bit mode. |
bf7ee649 PZ |
7 | * |
8 | * Lock order: | |
9 | * contex.ldt_usr_sem | |
10 | * mmap_sem | |
11 | * context.lock | |
1da177e4 LT |
12 | */ |
13 | ||
14 | #include <linux/errno.h> | |
5a0e3ad6 | 15 | #include <linux/gfp.h> |
1da177e4 LT |
16 | #include <linux/sched.h> |
17 | #include <linux/string.h> | |
18 | #include <linux/mm.h> | |
19 | #include <linux/smp.h> | |
d865f635 | 20 | #include <linux/syscalls.h> |
37868fe1 | 21 | #include <linux/slab.h> |
1da177e4 | 22 | #include <linux/vmalloc.h> |
423a5405 | 23 | #include <linux/uaccess.h> |
1da177e4 | 24 | |
1da177e4 LT |
25 | #include <asm/ldt.h> |
26 | #include <asm/desc.h> | |
70f5088d | 27 | #include <asm/mmu_context.h> |
bbc1f698 | 28 | #include <asm/syscalls.h> |
1da177e4 | 29 | |
295cb0b0 AL |
30 | static void refresh_ldt_segments(void) |
31 | { | |
32 | #ifdef CONFIG_X86_64 | |
33 | unsigned short sel; | |
34 | ||
35 | /* | |
36 | * Make sure that the cached DS and ES descriptors match the updated | |
37 | * LDT. | |
38 | */ | |
39 | savesegment(ds, sel); | |
40 | if ((sel & SEGMENT_TI_MASK) == SEGMENT_LDT) | |
41 | loadsegment(ds, sel); | |
42 | ||
43 | savesegment(es, sel); | |
44 | if ((sel & SEGMENT_TI_MASK) == SEGMENT_LDT) | |
45 | loadsegment(es, sel); | |
46 | #endif | |
47 | } | |
48 | ||
bf7ee649 | 49 | /* context.lock is held by the task which issued the smp function call */ |
3d28ebce | 50 | static void flush_ldt(void *__mm) |
1da177e4 | 51 | { |
3d28ebce | 52 | struct mm_struct *mm = __mm; |
37868fe1 AL |
53 | mm_context_t *pc; |
54 | ||
3d28ebce | 55 | if (this_cpu_read(cpu_tlbstate.loaded_mm) != mm) |
37868fe1 AL |
56 | return; |
57 | ||
3d28ebce | 58 | pc = &mm->context; |
bbf79d21 | 59 | set_ldt(pc->ldt->entries, pc->ldt->nr_entries); |
295cb0b0 AL |
60 | |
61 | refresh_ldt_segments(); | |
1da177e4 | 62 | } |
1da177e4 | 63 | |
37868fe1 | 64 | /* The caller must call finalize_ldt_struct on the result. LDT starts zeroed. */ |
bbf79d21 | 65 | static struct ldt_struct *alloc_ldt_struct(unsigned int num_entries) |
1da177e4 | 66 | { |
37868fe1 | 67 | struct ldt_struct *new_ldt; |
990e9dc3 | 68 | unsigned int alloc_size; |
37868fe1 | 69 | |
bbf79d21 | 70 | if (num_entries > LDT_ENTRIES) |
37868fe1 AL |
71 | return NULL; |
72 | ||
73 | new_ldt = kmalloc(sizeof(struct ldt_struct), GFP_KERNEL); | |
74 | if (!new_ldt) | |
75 | return NULL; | |
76 | ||
77 | BUILD_BUG_ON(LDT_ENTRY_SIZE != sizeof(struct desc_struct)); | |
bbf79d21 | 78 | alloc_size = num_entries * LDT_ENTRY_SIZE; |
37868fe1 AL |
79 | |
80 | /* | |
81 | * Xen is very picky: it requires a page-aligned LDT that has no | |
82 | * trailing nonzero bytes in any page that contains LDT descriptors. | |
83 | * Keep it simple: zero the whole allocation and never allocate less | |
84 | * than PAGE_SIZE. | |
85 | */ | |
86 | if (alloc_size > PAGE_SIZE) | |
87 | new_ldt->entries = vzalloc(alloc_size); | |
1da177e4 | 88 | else |
f454b478 | 89 | new_ldt->entries = (void *)get_zeroed_page(GFP_KERNEL); |
1da177e4 | 90 | |
37868fe1 AL |
91 | if (!new_ldt->entries) { |
92 | kfree(new_ldt); | |
93 | return NULL; | |
94 | } | |
77e463d1 | 95 | |
bbf79d21 | 96 | new_ldt->nr_entries = num_entries; |
37868fe1 AL |
97 | return new_ldt; |
98 | } | |
38ffbe66 | 99 | |
37868fe1 AL |
100 | /* After calling this, the LDT is immutable. */ |
101 | static void finalize_ldt_struct(struct ldt_struct *ldt) | |
102 | { | |
bbf79d21 | 103 | paravirt_alloc_ldt(ldt->entries, ldt->nr_entries); |
1da177e4 LT |
104 | } |
105 | ||
bf7ee649 | 106 | static void install_ldt(struct mm_struct *mm, struct ldt_struct *ldt) |
1da177e4 | 107 | { |
bf7ee649 PZ |
108 | mutex_lock(&mm->context.lock); |
109 | ||
7252704b | 110 | /* Synchronizes with READ_ONCE in load_mm_ldt. */ |
bf7ee649 | 111 | smp_store_release(&mm->context.ldt, ldt); |
37868fe1 | 112 | |
bf7ee649 PZ |
113 | /* Activate the LDT for all CPUs using currents mm. */ |
114 | on_each_cpu_mask(mm_cpumask(mm), flush_ldt, mm, true); | |
115 | ||
116 | mutex_unlock(&mm->context.lock); | |
37868fe1 | 117 | } |
78aa1f66 | 118 | |
37868fe1 AL |
119 | static void free_ldt_struct(struct ldt_struct *ldt) |
120 | { | |
121 | if (likely(!ldt)) | |
122 | return; | |
38ffbe66 | 123 | |
bbf79d21 BP |
124 | paravirt_free_ldt(ldt->entries, ldt->nr_entries); |
125 | if (ldt->nr_entries * LDT_ENTRY_SIZE > PAGE_SIZE) | |
8d5341a6 | 126 | vfree_atomic(ldt->entries); |
37868fe1 | 127 | else |
f454b478 | 128 | free_page((unsigned long)ldt->entries); |
37868fe1 | 129 | kfree(ldt); |
1da177e4 LT |
130 | } |
131 | ||
132 | /* | |
f90d2542 TG |
133 | * Called on fork from arch_dup_mmap(). Just copy the current LDT state, |
134 | * the new task is not running, so nothing can be installed. | |
1da177e4 | 135 | */ |
f90d2542 | 136 | int ldt_dup_context(struct mm_struct *old_mm, struct mm_struct *mm) |
1da177e4 | 137 | { |
37868fe1 | 138 | struct ldt_struct *new_ldt; |
1da177e4 LT |
139 | int retval = 0; |
140 | ||
f90d2542 | 141 | if (!old_mm) |
37868fe1 | 142 | return 0; |
37868fe1 AL |
143 | |
144 | mutex_lock(&old_mm->context.lock); | |
f90d2542 | 145 | if (!old_mm->context.ldt) |
37868fe1 | 146 | goto out_unlock; |
37868fe1 | 147 | |
bbf79d21 | 148 | new_ldt = alloc_ldt_struct(old_mm->context.ldt->nr_entries); |
37868fe1 AL |
149 | if (!new_ldt) { |
150 | retval = -ENOMEM; | |
151 | goto out_unlock; | |
152 | } | |
153 | ||
154 | memcpy(new_ldt->entries, old_mm->context.ldt->entries, | |
bbf79d21 | 155 | new_ldt->nr_entries * LDT_ENTRY_SIZE); |
37868fe1 AL |
156 | finalize_ldt_struct(new_ldt); |
157 | ||
158 | mm->context.ldt = new_ldt; | |
159 | ||
160 | out_unlock: | |
161 | mutex_unlock(&old_mm->context.lock); | |
1da177e4 LT |
162 | return retval; |
163 | } | |
164 | ||
165 | /* | |
77e463d1 TG |
166 | * No need to lock the MM as we are the last user |
167 | * | |
168 | * 64bit: Don't touch the LDT register - we're already in the next thread. | |
1da177e4 | 169 | */ |
39a0526f | 170 | void destroy_context_ldt(struct mm_struct *mm) |
1da177e4 | 171 | { |
37868fe1 AL |
172 | free_ldt_struct(mm->context.ldt); |
173 | mm->context.ldt = NULL; | |
1da177e4 LT |
174 | } |
175 | ||
78aa1f66 | 176 | static int read_ldt(void __user *ptr, unsigned long bytecount) |
1da177e4 | 177 | { |
78aa1f66 | 178 | struct mm_struct *mm = current->mm; |
bbf79d21 BP |
179 | unsigned long entries_size; |
180 | int retval; | |
1da177e4 | 181 | |
bf7ee649 | 182 | down_read(&mm->context.ldt_usr_sem); |
37868fe1 AL |
183 | |
184 | if (!mm->context.ldt) { | |
185 | retval = 0; | |
186 | goto out_unlock; | |
187 | } | |
188 | ||
78aa1f66 TG |
189 | if (bytecount > LDT_ENTRY_SIZE * LDT_ENTRIES) |
190 | bytecount = LDT_ENTRY_SIZE * LDT_ENTRIES; | |
1da177e4 | 191 | |
bbf79d21 BP |
192 | entries_size = mm->context.ldt->nr_entries * LDT_ENTRY_SIZE; |
193 | if (entries_size > bytecount) | |
194 | entries_size = bytecount; | |
1da177e4 | 195 | |
bbf79d21 | 196 | if (copy_to_user(ptr, mm->context.ldt->entries, entries_size)) { |
37868fe1 AL |
197 | retval = -EFAULT; |
198 | goto out_unlock; | |
199 | } | |
200 | ||
bbf79d21 | 201 | if (entries_size != bytecount) { |
37868fe1 | 202 | /* Zero-fill the rest and pretend we read bytecount bytes. */ |
bbf79d21 | 203 | if (clear_user(ptr + entries_size, bytecount - entries_size)) { |
37868fe1 AL |
204 | retval = -EFAULT; |
205 | goto out_unlock; | |
1da177e4 LT |
206 | } |
207 | } | |
37868fe1 AL |
208 | retval = bytecount; |
209 | ||
210 | out_unlock: | |
bf7ee649 | 211 | up_read(&mm->context.ldt_usr_sem); |
37868fe1 | 212 | return retval; |
1da177e4 LT |
213 | } |
214 | ||
78aa1f66 | 215 | static int read_default_ldt(void __user *ptr, unsigned long bytecount) |
1da177e4 | 216 | { |
77e463d1 TG |
217 | /* CHECKME: Can we use _one_ random number ? */ |
218 | #ifdef CONFIG_X86_32 | |
219 | unsigned long size = 5 * sizeof(struct desc_struct); | |
220 | #else | |
221 | unsigned long size = 128; | |
222 | #endif | |
223 | if (bytecount > size) | |
224 | bytecount = size; | |
1da177e4 LT |
225 | if (clear_user(ptr, bytecount)) |
226 | return -EFAULT; | |
78aa1f66 | 227 | return bytecount; |
1da177e4 LT |
228 | } |
229 | ||
78aa1f66 | 230 | static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode) |
1da177e4 | 231 | { |
70f5088d | 232 | struct mm_struct *mm = current->mm; |
990e9dc3 | 233 | struct ldt_struct *new_ldt, *old_ldt; |
bbf79d21 | 234 | unsigned int old_nr_entries, new_nr_entries; |
990e9dc3 | 235 | struct user_desc ldt_info; |
5af72502 | 236 | struct desc_struct ldt; |
1da177e4 | 237 | int error; |
1da177e4 LT |
238 | |
239 | error = -EINVAL; | |
1da177e4 LT |
240 | if (bytecount != sizeof(ldt_info)) |
241 | goto out; | |
78aa1f66 | 242 | error = -EFAULT; |
70f5088d | 243 | if (copy_from_user(&ldt_info, ptr, sizeof(ldt_info))) |
1da177e4 LT |
244 | goto out; |
245 | ||
246 | error = -EINVAL; | |
247 | if (ldt_info.entry_number >= LDT_ENTRIES) | |
248 | goto out; | |
249 | if (ldt_info.contents == 3) { | |
250 | if (oldmode) | |
251 | goto out; | |
252 | if (ldt_info.seg_not_present == 0) | |
253 | goto out; | |
254 | } | |
255 | ||
37868fe1 AL |
256 | if ((oldmode && !ldt_info.base_addr && !ldt_info.limit) || |
257 | LDT_empty(&ldt_info)) { | |
258 | /* The user wants to clear the entry. */ | |
259 | memset(&ldt, 0, sizeof(ldt)); | |
260 | } else { | |
261 | if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) { | |
262 | error = -EINVAL; | |
263 | goto out; | |
1da177e4 | 264 | } |
37868fe1 AL |
265 | |
266 | fill_ldt(&ldt, &ldt_info); | |
267 | if (oldmode) | |
268 | ldt.avl = 0; | |
1da177e4 LT |
269 | } |
270 | ||
bf7ee649 PZ |
271 | if (down_write_killable(&mm->context.ldt_usr_sem)) |
272 | return -EINTR; | |
37868fe1 | 273 | |
bbf79d21 BP |
274 | old_ldt = mm->context.ldt; |
275 | old_nr_entries = old_ldt ? old_ldt->nr_entries : 0; | |
276 | new_nr_entries = max(ldt_info.entry_number + 1, old_nr_entries); | |
37868fe1 AL |
277 | |
278 | error = -ENOMEM; | |
bbf79d21 | 279 | new_ldt = alloc_ldt_struct(new_nr_entries); |
37868fe1 | 280 | if (!new_ldt) |
34273f41 | 281 | goto out_unlock; |
34273f41 | 282 | |
37868fe1 | 283 | if (old_ldt) |
bbf79d21 BP |
284 | memcpy(new_ldt->entries, old_ldt->entries, old_nr_entries * LDT_ENTRY_SIZE); |
285 | ||
37868fe1 AL |
286 | new_ldt->entries[ldt_info.entry_number] = ldt; |
287 | finalize_ldt_struct(new_ldt); | |
1da177e4 | 288 | |
37868fe1 AL |
289 | install_ldt(mm, new_ldt); |
290 | free_ldt_struct(old_ldt); | |
1da177e4 LT |
291 | error = 0; |
292 | ||
293 | out_unlock: | |
bf7ee649 | 294 | up_write(&mm->context.ldt_usr_sem); |
1da177e4 LT |
295 | out: |
296 | return error; | |
297 | } | |
298 | ||
d865f635 DH |
299 | SYSCALL_DEFINE3(modify_ldt, int , func , void __user * , ptr , |
300 | unsigned long , bytecount) | |
1da177e4 LT |
301 | { |
302 | int ret = -ENOSYS; | |
303 | ||
304 | switch (func) { | |
305 | case 0: | |
306 | ret = read_ldt(ptr, bytecount); | |
307 | break; | |
308 | case 1: | |
309 | ret = write_ldt(ptr, bytecount, 1); | |
310 | break; | |
311 | case 2: | |
312 | ret = read_default_ldt(ptr, bytecount); | |
313 | break; | |
314 | case 0x11: | |
315 | ret = write_ldt(ptr, bytecount, 0); | |
316 | break; | |
317 | } | |
d865f635 DH |
318 | /* |
319 | * The SYSCALL_DEFINE() macros give us an 'unsigned long' | |
320 | * return type, but tht ABI for sys_modify_ldt() expects | |
321 | * 'int'. This cast gives us an int-sized value in %rax | |
322 | * for the return code. The 'unsigned' is necessary so | |
323 | * the compiler does not try to sign-extend the negative | |
324 | * return codes into the high half of the register when | |
325 | * taking the value from int->long. | |
326 | */ | |
327 | return (unsigned int)ret; | |
1da177e4 | 328 | } |