vm86_32.c 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * Copyright (C) 1994 Linus Torvalds
  4. *
  5. * 29 dec 2001 - Fixed oopses caused by unchecked access to the vm86
  6. * stack - Manfred Spraul <[email protected]>
  7. *
  8. * 22 mar 2002 - Manfred detected the stackfaults, but didn't handle
  9. * them correctly. Now the emulation will be in a
  10. * consistent state after stackfaults - Kasper Dupont
  11. * <[email protected]>
  12. *
  13. * 22 mar 2002 - Added missing clear_IF in set_vflags_* Kasper Dupont
  14. * <[email protected]>
  15. *
  16. * ?? ??? 2002 - Fixed premature returns from handle_vm86_fault
  17. * caused by Kasper Dupont's changes - Stas Sergeev
  18. *
  19. * 4 apr 2002 - Fixed CHECK_IF_IN_TRAP broken by Stas' changes.
  20. * Kasper Dupont <[email protected]>
  21. *
  22. * 9 apr 2002 - Changed syntax of macros in handle_vm86_fault.
  23. * Kasper Dupont <[email protected]>
  24. *
  25. * 9 apr 2002 - Changed stack access macros to jump to a label
  26. * instead of returning to userspace. This simplifies
  27. * do_int, and is needed by handle_vm6_fault. Kasper
  28. * Dupont <[email protected]>
  29. *
  30. */
  31. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  32. #include <linux/capability.h>
  33. #include <linux/errno.h>
  34. #include <linux/interrupt.h>
  35. #include <linux/syscalls.h>
  36. #include <linux/sched.h>
  37. #include <linux/sched/task_stack.h>
  38. #include <linux/kernel.h>
  39. #include <linux/signal.h>
  40. #include <linux/string.h>
  41. #include <linux/mm.h>
  42. #include <linux/smp.h>
  43. #include <linux/highmem.h>
  44. #include <linux/ptrace.h>
  45. #include <linux/audit.h>
  46. #include <linux/stddef.h>
  47. #include <linux/slab.h>
  48. #include <linux/security.h>
  49. #include <linux/uaccess.h>
  50. #include <asm/io.h>
  51. #include <asm/tlbflush.h>
  52. #include <asm/irq.h>
  53. #include <asm/traps.h>
  54. #include <asm/vm86.h>
  55. #include <asm/switch_to.h>
  56. /*
  57. * Known problems:
  58. *
  59. * Interrupt handling is not guaranteed:
  60. * - a real x86 will disable all interrupts for one instruction
  61. * after a "mov ss,xx" to make stack handling atomic even without
  62. * the 'lss' instruction. We can't guarantee this in v86 mode,
  63. * as the next instruction might result in a page fault or similar.
  64. * - a real x86 will have interrupts disabled for one instruction
  65. * past the 'sti' that enables them. We don't bother with all the
  66. * details yet.
  67. *
  68. * Let's hope these problems do not actually matter for anything.
  69. */
  70. /*
  71. * 8- and 16-bit register defines..
  72. */
  73. #define AL(regs) (((unsigned char *)&((regs)->pt.ax))[0])
  74. #define AH(regs) (((unsigned char *)&((regs)->pt.ax))[1])
  75. #define IP(regs) (*(unsigned short *)&((regs)->pt.ip))
  76. #define SP(regs) (*(unsigned short *)&((regs)->pt.sp))
  77. /*
  78. * virtual flags (16 and 32-bit versions)
  79. */
  80. #define VFLAGS (*(unsigned short *)&(current->thread.vm86->veflags))
  81. #define VEFLAGS (current->thread.vm86->veflags)
  82. #define set_flags(X, new, mask) \
  83. ((X) = ((X) & ~(mask)) | ((new) & (mask)))
  84. #define SAFE_MASK (0xDD5)
  85. #define RETURN_MASK (0xDFF)
  86. void save_v86_state(struct kernel_vm86_regs *regs, int retval)
  87. {
  88. struct task_struct *tsk = current;
  89. struct vm86plus_struct __user *user;
  90. struct vm86 *vm86 = current->thread.vm86;
  91. /*
  92. * This gets called from entry.S with interrupts disabled, but
  93. * from process context. Enable interrupts here, before trying
  94. * to access user space.
  95. */
  96. local_irq_enable();
  97. BUG_ON(!vm86);
  98. set_flags(regs->pt.flags, VEFLAGS, X86_EFLAGS_VIF | vm86->veflags_mask);
  99. user = vm86->user_vm86;
  100. if (!user_access_begin(user, vm86->vm86plus.is_vm86pus ?
  101. sizeof(struct vm86plus_struct) :
  102. sizeof(struct vm86_struct)))
  103. goto Efault;
  104. unsafe_put_user(regs->pt.bx, &user->regs.ebx, Efault_end);
  105. unsafe_put_user(regs->pt.cx, &user->regs.ecx, Efault_end);
  106. unsafe_put_user(regs->pt.dx, &user->regs.edx, Efault_end);
  107. unsafe_put_user(regs->pt.si, &user->regs.esi, Efault_end);
  108. unsafe_put_user(regs->pt.di, &user->regs.edi, Efault_end);
  109. unsafe_put_user(regs->pt.bp, &user->regs.ebp, Efault_end);
  110. unsafe_put_user(regs->pt.ax, &user->regs.eax, Efault_end);
  111. unsafe_put_user(regs->pt.ip, &user->regs.eip, Efault_end);
  112. unsafe_put_user(regs->pt.cs, &user->regs.cs, Efault_end);
  113. unsafe_put_user(regs->pt.flags, &user->regs.eflags, Efault_end);
  114. unsafe_put_user(regs->pt.sp, &user->regs.esp, Efault_end);
  115. unsafe_put_user(regs->pt.ss, &user->regs.ss, Efault_end);
  116. unsafe_put_user(regs->es, &user->regs.es, Efault_end);
  117. unsafe_put_user(regs->ds, &user->regs.ds, Efault_end);
  118. unsafe_put_user(regs->fs, &user->regs.fs, Efault_end);
  119. unsafe_put_user(regs->gs, &user->regs.gs, Efault_end);
  120. /*
  121. * Don't write screen_bitmap in case some user had a value there
  122. * and expected it to remain unchanged.
  123. */
  124. user_access_end();
  125. exit_vm86:
  126. preempt_disable();
  127. tsk->thread.sp0 = vm86->saved_sp0;
  128. tsk->thread.sysenter_cs = __KERNEL_CS;
  129. update_task_stack(tsk);
  130. refresh_sysenter_cs(&tsk->thread);
  131. vm86->saved_sp0 = 0;
  132. preempt_enable();
  133. memcpy(&regs->pt, &vm86->regs32, sizeof(struct pt_regs));
  134. loadsegment(gs, vm86->regs32.gs);
  135. regs->pt.ax = retval;
  136. return;
  137. Efault_end:
  138. user_access_end();
  139. Efault:
  140. pr_alert("could not access userspace vm86 info\n");
  141. force_exit_sig(SIGSEGV);
  142. goto exit_vm86;
  143. }
  144. static int do_vm86_irq_handling(int subfunction, int irqnumber);
  145. static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus);
  146. SYSCALL_DEFINE1(vm86old, struct vm86_struct __user *, user_vm86)
  147. {
  148. return do_sys_vm86((struct vm86plus_struct __user *) user_vm86, false);
  149. }
  150. SYSCALL_DEFINE2(vm86, unsigned long, cmd, unsigned long, arg)
  151. {
  152. switch (cmd) {
  153. case VM86_REQUEST_IRQ:
  154. case VM86_FREE_IRQ:
  155. case VM86_GET_IRQ_BITS:
  156. case VM86_GET_AND_RESET_IRQ:
  157. return do_vm86_irq_handling(cmd, (int)arg);
  158. case VM86_PLUS_INSTALL_CHECK:
  159. /*
  160. * NOTE: on old vm86 stuff this will return the error
  161. * from access_ok(), because the subfunction is
  162. * interpreted as (invalid) address to vm86_struct.
  163. * So the installation check works.
  164. */
  165. return 0;
  166. }
  167. /* we come here only for functions VM86_ENTER, VM86_ENTER_NO_BYPASS */
  168. return do_sys_vm86((struct vm86plus_struct __user *) arg, true);
  169. }
  170. static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus)
  171. {
  172. struct task_struct *tsk = current;
  173. struct vm86 *vm86 = tsk->thread.vm86;
  174. struct kernel_vm86_regs vm86regs;
  175. struct pt_regs *regs = current_pt_regs();
  176. unsigned long err = 0;
  177. struct vm86_struct v;
  178. err = security_mmap_addr(0);
  179. if (err) {
  180. /*
  181. * vm86 cannot virtualize the address space, so vm86 users
  182. * need to manage the low 1MB themselves using mmap. Given
  183. * that BIOS places important data in the first page, vm86
  184. * is essentially useless if mmap_min_addr != 0. DOSEMU,
  185. * for example, won't even bother trying to use vm86 if it
  186. * can't map a page at virtual address 0.
  187. *
  188. * To reduce the available kernel attack surface, simply
  189. * disallow vm86(old) for users who cannot mmap at va 0.
  190. *
  191. * The implementation of security_mmap_addr will allow
  192. * suitably privileged users to map va 0 even if
  193. * vm.mmap_min_addr is set above 0, and we want this
  194. * behavior for vm86 as well, as it ensures that legacy
  195. * tools like vbetool will not fail just because of
  196. * vm.mmap_min_addr.
  197. */
  198. pr_info_once("Denied a call to vm86(old) from %s[%d] (uid: %d). Set the vm.mmap_min_addr sysctl to 0 and/or adjust LSM mmap_min_addr policy to enable vm86 if you are using a vm86-based DOS emulator.\n",
  199. current->comm, task_pid_nr(current),
  200. from_kuid_munged(&init_user_ns, current_uid()));
  201. return -EPERM;
  202. }
  203. if (!vm86) {
  204. if (!(vm86 = kzalloc(sizeof(*vm86), GFP_KERNEL)))
  205. return -ENOMEM;
  206. tsk->thread.vm86 = vm86;
  207. }
  208. if (vm86->saved_sp0)
  209. return -EPERM;
  210. if (copy_from_user(&v, user_vm86,
  211. offsetof(struct vm86_struct, int_revectored)))
  212. return -EFAULT;
  213. /* VM86_SCREEN_BITMAP had numerous bugs and appears to have no users. */
  214. if (v.flags & VM86_SCREEN_BITMAP) {
  215. char comm[TASK_COMM_LEN];
  216. pr_info_once("vm86: '%s' uses VM86_SCREEN_BITMAP, which is no longer supported\n", get_task_comm(comm, current));
  217. return -EINVAL;
  218. }
  219. memset(&vm86regs, 0, sizeof(vm86regs));
  220. vm86regs.pt.bx = v.regs.ebx;
  221. vm86regs.pt.cx = v.regs.ecx;
  222. vm86regs.pt.dx = v.regs.edx;
  223. vm86regs.pt.si = v.regs.esi;
  224. vm86regs.pt.di = v.regs.edi;
  225. vm86regs.pt.bp = v.regs.ebp;
  226. vm86regs.pt.ax = v.regs.eax;
  227. vm86regs.pt.ip = v.regs.eip;
  228. vm86regs.pt.cs = v.regs.cs;
  229. vm86regs.pt.flags = v.regs.eflags;
  230. vm86regs.pt.sp = v.regs.esp;
  231. vm86regs.pt.ss = v.regs.ss;
  232. vm86regs.es = v.regs.es;
  233. vm86regs.ds = v.regs.ds;
  234. vm86regs.fs = v.regs.fs;
  235. vm86regs.gs = v.regs.gs;
  236. vm86->flags = v.flags;
  237. vm86->cpu_type = v.cpu_type;
  238. if (copy_from_user(&vm86->int_revectored,
  239. &user_vm86->int_revectored,
  240. sizeof(struct revectored_struct)))
  241. return -EFAULT;
  242. if (copy_from_user(&vm86->int21_revectored,
  243. &user_vm86->int21_revectored,
  244. sizeof(struct revectored_struct)))
  245. return -EFAULT;
  246. if (plus) {
  247. if (copy_from_user(&vm86->vm86plus, &user_vm86->vm86plus,
  248. sizeof(struct vm86plus_info_struct)))
  249. return -EFAULT;
  250. vm86->vm86plus.is_vm86pus = 1;
  251. } else
  252. memset(&vm86->vm86plus, 0,
  253. sizeof(struct vm86plus_info_struct));
  254. memcpy(&vm86->regs32, regs, sizeof(struct pt_regs));
  255. vm86->user_vm86 = user_vm86;
  256. /*
  257. * The flags register is also special: we cannot trust that the user
  258. * has set it up safely, so this makes sure interrupt etc flags are
  259. * inherited from protected mode.
  260. */
  261. VEFLAGS = vm86regs.pt.flags;
  262. vm86regs.pt.flags &= SAFE_MASK;
  263. vm86regs.pt.flags |= regs->flags & ~SAFE_MASK;
  264. vm86regs.pt.flags |= X86_VM_MASK;
  265. vm86regs.pt.orig_ax = regs->orig_ax;
  266. switch (vm86->cpu_type) {
  267. case CPU_286:
  268. vm86->veflags_mask = 0;
  269. break;
  270. case CPU_386:
  271. vm86->veflags_mask = X86_EFLAGS_NT | X86_EFLAGS_IOPL;
  272. break;
  273. case CPU_486:
  274. vm86->veflags_mask = X86_EFLAGS_AC | X86_EFLAGS_NT | X86_EFLAGS_IOPL;
  275. break;
  276. default:
  277. vm86->veflags_mask = X86_EFLAGS_ID | X86_EFLAGS_AC | X86_EFLAGS_NT | X86_EFLAGS_IOPL;
  278. break;
  279. }
  280. /*
  281. * Save old state
  282. */
  283. vm86->saved_sp0 = tsk->thread.sp0;
  284. savesegment(gs, vm86->regs32.gs);
  285. /* make room for real-mode segments */
  286. preempt_disable();
  287. tsk->thread.sp0 += 16;
  288. if (boot_cpu_has(X86_FEATURE_SEP)) {
  289. tsk->thread.sysenter_cs = 0;
  290. refresh_sysenter_cs(&tsk->thread);
  291. }
  292. update_task_stack(tsk);
  293. preempt_enable();
  294. memcpy((struct kernel_vm86_regs *)regs, &vm86regs, sizeof(vm86regs));
  295. return regs->ax;
  296. }
  297. static inline void set_IF(struct kernel_vm86_regs *regs)
  298. {
  299. VEFLAGS |= X86_EFLAGS_VIF;
  300. }
  301. static inline void clear_IF(struct kernel_vm86_regs *regs)
  302. {
  303. VEFLAGS &= ~X86_EFLAGS_VIF;
  304. }
  305. static inline void clear_TF(struct kernel_vm86_regs *regs)
  306. {
  307. regs->pt.flags &= ~X86_EFLAGS_TF;
  308. }
  309. static inline void clear_AC(struct kernel_vm86_regs *regs)
  310. {
  311. regs->pt.flags &= ~X86_EFLAGS_AC;
  312. }
  313. /*
  314. * It is correct to call set_IF(regs) from the set_vflags_*
  315. * functions. However someone forgot to call clear_IF(regs)
  316. * in the opposite case.
  317. * After the command sequence CLI PUSHF STI POPF you should
  318. * end up with interrupts disabled, but you ended up with
  319. * interrupts enabled.
  320. * ( I was testing my own changes, but the only bug I
  321. * could find was in a function I had not changed. )
  322. * [KD]
  323. */
  324. static inline void set_vflags_long(unsigned long flags, struct kernel_vm86_regs *regs)
  325. {
  326. set_flags(VEFLAGS, flags, current->thread.vm86->veflags_mask);
  327. set_flags(regs->pt.flags, flags, SAFE_MASK);
  328. if (flags & X86_EFLAGS_IF)
  329. set_IF(regs);
  330. else
  331. clear_IF(regs);
  332. }
  333. static inline void set_vflags_short(unsigned short flags, struct kernel_vm86_regs *regs)
  334. {
  335. set_flags(VFLAGS, flags, current->thread.vm86->veflags_mask);
  336. set_flags(regs->pt.flags, flags, SAFE_MASK);
  337. if (flags & X86_EFLAGS_IF)
  338. set_IF(regs);
  339. else
  340. clear_IF(regs);
  341. }
  342. static inline unsigned long get_vflags(struct kernel_vm86_regs *regs)
  343. {
  344. unsigned long flags = regs->pt.flags & RETURN_MASK;
  345. if (VEFLAGS & X86_EFLAGS_VIF)
  346. flags |= X86_EFLAGS_IF;
  347. flags |= X86_EFLAGS_IOPL;
  348. return flags | (VEFLAGS & current->thread.vm86->veflags_mask);
  349. }
  350. static inline int is_revectored(int nr, struct revectored_struct *bitmap)
  351. {
  352. return test_bit(nr, bitmap->__map);
  353. }
  354. #define val_byte(val, n) (((__u8 *)&val)[n])
  355. #define pushb(base, ptr, val, err_label) \
  356. do { \
  357. __u8 __val = val; \
  358. ptr--; \
  359. if (put_user(__val, base + ptr) < 0) \
  360. goto err_label; \
  361. } while (0)
  362. #define pushw(base, ptr, val, err_label) \
  363. do { \
  364. __u16 __val = val; \
  365. ptr--; \
  366. if (put_user(val_byte(__val, 1), base + ptr) < 0) \
  367. goto err_label; \
  368. ptr--; \
  369. if (put_user(val_byte(__val, 0), base + ptr) < 0) \
  370. goto err_label; \
  371. } while (0)
  372. #define pushl(base, ptr, val, err_label) \
  373. do { \
  374. __u32 __val = val; \
  375. ptr--; \
  376. if (put_user(val_byte(__val, 3), base + ptr) < 0) \
  377. goto err_label; \
  378. ptr--; \
  379. if (put_user(val_byte(__val, 2), base + ptr) < 0) \
  380. goto err_label; \
  381. ptr--; \
  382. if (put_user(val_byte(__val, 1), base + ptr) < 0) \
  383. goto err_label; \
  384. ptr--; \
  385. if (put_user(val_byte(__val, 0), base + ptr) < 0) \
  386. goto err_label; \
  387. } while (0)
  388. #define popb(base, ptr, err_label) \
  389. ({ \
  390. __u8 __res; \
  391. if (get_user(__res, base + ptr) < 0) \
  392. goto err_label; \
  393. ptr++; \
  394. __res; \
  395. })
  396. #define popw(base, ptr, err_label) \
  397. ({ \
  398. __u16 __res; \
  399. if (get_user(val_byte(__res, 0), base + ptr) < 0) \
  400. goto err_label; \
  401. ptr++; \
  402. if (get_user(val_byte(__res, 1), base + ptr) < 0) \
  403. goto err_label; \
  404. ptr++; \
  405. __res; \
  406. })
  407. #define popl(base, ptr, err_label) \
  408. ({ \
  409. __u32 __res; \
  410. if (get_user(val_byte(__res, 0), base + ptr) < 0) \
  411. goto err_label; \
  412. ptr++; \
  413. if (get_user(val_byte(__res, 1), base + ptr) < 0) \
  414. goto err_label; \
  415. ptr++; \
  416. if (get_user(val_byte(__res, 2), base + ptr) < 0) \
  417. goto err_label; \
  418. ptr++; \
  419. if (get_user(val_byte(__res, 3), base + ptr) < 0) \
  420. goto err_label; \
  421. ptr++; \
  422. __res; \
  423. })
  424. /* There are so many possible reasons for this function to return
  425. * VM86_INTx, so adding another doesn't bother me. We can expect
  426. * userspace programs to be able to handle it. (Getting a problem
  427. * in userspace is always better than an Oops anyway.) [KD]
  428. */
  429. static void do_int(struct kernel_vm86_regs *regs, int i,
  430. unsigned char __user *ssp, unsigned short sp)
  431. {
  432. unsigned long __user *intr_ptr;
  433. unsigned long segoffs;
  434. struct vm86 *vm86 = current->thread.vm86;
  435. if (regs->pt.cs == BIOSSEG)
  436. goto cannot_handle;
  437. if (is_revectored(i, &vm86->int_revectored))
  438. goto cannot_handle;
  439. if (i == 0x21 && is_revectored(AH(regs), &vm86->int21_revectored))
  440. goto cannot_handle;
  441. intr_ptr = (unsigned long __user *) (i << 2);
  442. if (get_user(segoffs, intr_ptr))
  443. goto cannot_handle;
  444. if ((segoffs >> 16) == BIOSSEG)
  445. goto cannot_handle;
  446. pushw(ssp, sp, get_vflags(regs), cannot_handle);
  447. pushw(ssp, sp, regs->pt.cs, cannot_handle);
  448. pushw(ssp, sp, IP(regs), cannot_handle);
  449. regs->pt.cs = segoffs >> 16;
  450. SP(regs) -= 6;
  451. IP(regs) = segoffs & 0xffff;
  452. clear_TF(regs);
  453. clear_IF(regs);
  454. clear_AC(regs);
  455. return;
  456. cannot_handle:
  457. save_v86_state(regs, VM86_INTx + (i << 8));
  458. }
  459. int handle_vm86_trap(struct kernel_vm86_regs *regs, long error_code, int trapno)
  460. {
  461. struct vm86 *vm86 = current->thread.vm86;
  462. if (vm86->vm86plus.is_vm86pus) {
  463. if ((trapno == 3) || (trapno == 1)) {
  464. save_v86_state(regs, VM86_TRAP + (trapno << 8));
  465. return 0;
  466. }
  467. do_int(regs, trapno, (unsigned char __user *) (regs->pt.ss << 4), SP(regs));
  468. return 0;
  469. }
  470. if (trapno != 1)
  471. return 1; /* we let this handle by the calling routine */
  472. current->thread.trap_nr = trapno;
  473. current->thread.error_code = error_code;
  474. force_sig(SIGTRAP);
  475. return 0;
  476. }
  477. void handle_vm86_fault(struct kernel_vm86_regs *regs, long error_code)
  478. {
  479. unsigned char opcode;
  480. unsigned char __user *csp;
  481. unsigned char __user *ssp;
  482. unsigned short ip, sp, orig_flags;
  483. int data32, pref_done;
  484. struct vm86plus_info_struct *vmpi = &current->thread.vm86->vm86plus;
  485. #define CHECK_IF_IN_TRAP \
  486. if (vmpi->vm86dbg_active && vmpi->vm86dbg_TFpendig) \
  487. newflags |= X86_EFLAGS_TF
  488. orig_flags = *(unsigned short *)&regs->pt.flags;
  489. csp = (unsigned char __user *) (regs->pt.cs << 4);
  490. ssp = (unsigned char __user *) (regs->pt.ss << 4);
  491. sp = SP(regs);
  492. ip = IP(regs);
  493. data32 = 0;
  494. pref_done = 0;
  495. do {
  496. switch (opcode = popb(csp, ip, simulate_sigsegv)) {
  497. case 0x66: /* 32-bit data */ data32 = 1; break;
  498. case 0x67: /* 32-bit address */ break;
  499. case 0x2e: /* CS */ break;
  500. case 0x3e: /* DS */ break;
  501. case 0x26: /* ES */ break;
  502. case 0x36: /* SS */ break;
  503. case 0x65: /* GS */ break;
  504. case 0x64: /* FS */ break;
  505. case 0xf2: /* repnz */ break;
  506. case 0xf3: /* rep */ break;
  507. default: pref_done = 1;
  508. }
  509. } while (!pref_done);
  510. switch (opcode) {
  511. /* pushf */
  512. case 0x9c:
  513. if (data32) {
  514. pushl(ssp, sp, get_vflags(regs), simulate_sigsegv);
  515. SP(regs) -= 4;
  516. } else {
  517. pushw(ssp, sp, get_vflags(regs), simulate_sigsegv);
  518. SP(regs) -= 2;
  519. }
  520. IP(regs) = ip;
  521. goto vm86_fault_return;
  522. /* popf */
  523. case 0x9d:
  524. {
  525. unsigned long newflags;
  526. if (data32) {
  527. newflags = popl(ssp, sp, simulate_sigsegv);
  528. SP(regs) += 4;
  529. } else {
  530. newflags = popw(ssp, sp, simulate_sigsegv);
  531. SP(regs) += 2;
  532. }
  533. IP(regs) = ip;
  534. CHECK_IF_IN_TRAP;
  535. if (data32)
  536. set_vflags_long(newflags, regs);
  537. else
  538. set_vflags_short(newflags, regs);
  539. goto check_vip;
  540. }
  541. /* int xx */
  542. case 0xcd: {
  543. int intno = popb(csp, ip, simulate_sigsegv);
  544. IP(regs) = ip;
  545. if (vmpi->vm86dbg_active) {
  546. if ((1 << (intno & 7)) & vmpi->vm86dbg_intxxtab[intno >> 3]) {
  547. save_v86_state(regs, VM86_INTx + (intno << 8));
  548. return;
  549. }
  550. }
  551. do_int(regs, intno, ssp, sp);
  552. return;
  553. }
  554. /* iret */
  555. case 0xcf:
  556. {
  557. unsigned long newip;
  558. unsigned long newcs;
  559. unsigned long newflags;
  560. if (data32) {
  561. newip = popl(ssp, sp, simulate_sigsegv);
  562. newcs = popl(ssp, sp, simulate_sigsegv);
  563. newflags = popl(ssp, sp, simulate_sigsegv);
  564. SP(regs) += 12;
  565. } else {
  566. newip = popw(ssp, sp, simulate_sigsegv);
  567. newcs = popw(ssp, sp, simulate_sigsegv);
  568. newflags = popw(ssp, sp, simulate_sigsegv);
  569. SP(regs) += 6;
  570. }
  571. IP(regs) = newip;
  572. regs->pt.cs = newcs;
  573. CHECK_IF_IN_TRAP;
  574. if (data32) {
  575. set_vflags_long(newflags, regs);
  576. } else {
  577. set_vflags_short(newflags, regs);
  578. }
  579. goto check_vip;
  580. }
  581. /* cli */
  582. case 0xfa:
  583. IP(regs) = ip;
  584. clear_IF(regs);
  585. goto vm86_fault_return;
  586. /* sti */
  587. /*
  588. * Damn. This is incorrect: the 'sti' instruction should actually
  589. * enable interrupts after the /next/ instruction. Not good.
  590. *
  591. * Probably needs some horsing around with the TF flag. Aiee..
  592. */
  593. case 0xfb:
  594. IP(regs) = ip;
  595. set_IF(regs);
  596. goto check_vip;
  597. default:
  598. save_v86_state(regs, VM86_UNKNOWN);
  599. }
  600. return;
  601. check_vip:
  602. if ((VEFLAGS & (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) ==
  603. (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) {
  604. save_v86_state(regs, VM86_STI);
  605. return;
  606. }
  607. vm86_fault_return:
  608. if (vmpi->force_return_for_pic && (VEFLAGS & (X86_EFLAGS_IF | X86_EFLAGS_VIF))) {
  609. save_v86_state(regs, VM86_PICRETURN);
  610. return;
  611. }
  612. if (orig_flags & X86_EFLAGS_TF)
  613. handle_vm86_trap(regs, 0, X86_TRAP_DB);
  614. return;
  615. simulate_sigsegv:
  616. /* FIXME: After a long discussion with Stas we finally
  617. * agreed, that this is wrong. Here we should
  618. * really send a SIGSEGV to the user program.
  619. * But how do we create the correct context? We
  620. * are inside a general protection fault handler
  621. * and has just returned from a page fault handler.
  622. * The correct context for the signal handler
  623. * should be a mixture of the two, but how do we
  624. * get the information? [KD]
  625. */
  626. save_v86_state(regs, VM86_UNKNOWN);
  627. }
  628. /* ---------------- vm86 special IRQ passing stuff ----------------- */
  629. #define VM86_IRQNAME "vm86irq"
  630. static struct vm86_irqs {
  631. struct task_struct *tsk;
  632. int sig;
  633. } vm86_irqs[16];
  634. static DEFINE_SPINLOCK(irqbits_lock);
  635. static int irqbits;
  636. #define ALLOWED_SIGS (1 /* 0 = don't send a signal */ \
  637. | (1 << SIGUSR1) | (1 << SIGUSR2) | (1 << SIGIO) | (1 << SIGURG) \
  638. | (1 << SIGUNUSED))
  639. static irqreturn_t irq_handler(int intno, void *dev_id)
  640. {
  641. int irq_bit;
  642. unsigned long flags;
  643. spin_lock_irqsave(&irqbits_lock, flags);
  644. irq_bit = 1 << intno;
  645. if ((irqbits & irq_bit) || !vm86_irqs[intno].tsk)
  646. goto out;
  647. irqbits |= irq_bit;
  648. if (vm86_irqs[intno].sig)
  649. send_sig(vm86_irqs[intno].sig, vm86_irqs[intno].tsk, 1);
  650. /*
  651. * IRQ will be re-enabled when user asks for the irq (whether
  652. * polling or as a result of the signal)
  653. */
  654. disable_irq_nosync(intno);
  655. spin_unlock_irqrestore(&irqbits_lock, flags);
  656. return IRQ_HANDLED;
  657. out:
  658. spin_unlock_irqrestore(&irqbits_lock, flags);
  659. return IRQ_NONE;
  660. }
  661. static inline void free_vm86_irq(int irqnumber)
  662. {
  663. unsigned long flags;
  664. free_irq(irqnumber, NULL);
  665. vm86_irqs[irqnumber].tsk = NULL;
  666. spin_lock_irqsave(&irqbits_lock, flags);
  667. irqbits &= ~(1 << irqnumber);
  668. spin_unlock_irqrestore(&irqbits_lock, flags);
  669. }
  670. void release_vm86_irqs(struct task_struct *task)
  671. {
  672. int i;
  673. for (i = FIRST_VM86_IRQ ; i <= LAST_VM86_IRQ; i++)
  674. if (vm86_irqs[i].tsk == task)
  675. free_vm86_irq(i);
  676. }
  677. static inline int get_and_reset_irq(int irqnumber)
  678. {
  679. int bit;
  680. unsigned long flags;
  681. int ret = 0;
  682. if (invalid_vm86_irq(irqnumber)) return 0;
  683. if (vm86_irqs[irqnumber].tsk != current) return 0;
  684. spin_lock_irqsave(&irqbits_lock, flags);
  685. bit = irqbits & (1 << irqnumber);
  686. irqbits &= ~bit;
  687. if (bit) {
  688. enable_irq(irqnumber);
  689. ret = 1;
  690. }
  691. spin_unlock_irqrestore(&irqbits_lock, flags);
  692. return ret;
  693. }
  694. static int do_vm86_irq_handling(int subfunction, int irqnumber)
  695. {
  696. int ret;
  697. switch (subfunction) {
  698. case VM86_GET_AND_RESET_IRQ: {
  699. return get_and_reset_irq(irqnumber);
  700. }
  701. case VM86_GET_IRQ_BITS: {
  702. return irqbits;
  703. }
  704. case VM86_REQUEST_IRQ: {
  705. int sig = irqnumber >> 8;
  706. int irq = irqnumber & 255;
  707. if (!capable(CAP_SYS_ADMIN)) return -EPERM;
  708. if (!((1 << sig) & ALLOWED_SIGS)) return -EPERM;
  709. if (invalid_vm86_irq(irq)) return -EPERM;
  710. if (vm86_irqs[irq].tsk) return -EPERM;
  711. ret = request_irq(irq, &irq_handler, 0, VM86_IRQNAME, NULL);
  712. if (ret) return ret;
  713. vm86_irqs[irq].sig = sig;
  714. vm86_irqs[irq].tsk = current;
  715. return irq;
  716. }
  717. case VM86_FREE_IRQ: {
  718. if (invalid_vm86_irq(irqnumber)) return -EPERM;
  719. if (!vm86_irqs[irqnumber].tsk) return 0;
  720. if (vm86_irqs[irqnumber].tsk != current) return -EPERM;
  721. free_vm86_irq(irqnumber);
  722. return 0;
  723. }
  724. }
  725. return -EINVAL;
  726. }