arch/um/sys-i386/ldt.c

   1 /*
   2  * Copyright (C) 2001, 2002 Jeff Dike (jdike@karaya.com)
   3  * Licensed under the GPL
   4  */
   5
   6 #include "linux/sched.h"
   7 #include "linux/slab.h"
   8 #include "linux/types.h"
   9 #include "linux/errno.h"
  10 #include "asm/uaccess.h"
  11 #include "asm/smp.h"
  12 #include "asm/ldt.h"
  13 #include "asm/unistd.h"
  14 #include "choose-mode.h"
  15 #include "kern.h"
  16 #include "mode_kern.h"
  17 #include "os.h"
  18
  19 extern int modify_ldt(int func, void *ptr, unsigned long bytecount);
  20
  21 #ifdef CONFIG_MODE_TT
  22
  23 static long do_modify_ldt_tt(int func, void __user *ptr,
  24                               unsigned long bytecount)
  25 {
  26         struct user_desc info;
  27         int res = 0;
  28         void *buf = NULL;
  29         void *p = NULL; /* What we pass to host. */
  30
  31         switch(func){
  32         case 1:
  33         case 0x11: /* write_ldt */
  34                 /* Do this check now to avoid overflows. */
  35                 if (bytecount != sizeof(struct user_desc)) {
  36                         res = -EINVAL;
  37                         goto out;
  38                 }
  39
  40                 if(copy_from_user(&info, ptr, sizeof(info))) {
  41                         res = -EFAULT;
  42                         goto out;
  43                 }
  44
  45                 p = &info;
  46                 break;
  47         case 0:
  48         case 2: /* read_ldt */
  49
  50                 /* The use of info avoids kmalloc on the write case, not on the
  51                  * read one. */
  52                 buf = kmalloc(bytecount, GFP_KERNEL);
  53                 if (!buf) {
  54                         res = -ENOMEM;
  55                         goto out;
  56                 }
  57                 p = buf;
  58                 break;
  59         default:
  60                 res = -ENOSYS;
  61                 goto out;
  62         }
  63
  64         res = modify_ldt(func, p, bytecount);
  65         if(res < 0)
  66                 goto out;
  67
  68         switch(func){
  69         case 0:
  70         case 2:
  71                 /* Modify_ldt was for reading and returned the number of read
  72                  * bytes.*/
  73                 if(copy_to_user(ptr, p, res))
  74                         res = -EFAULT;
  75                 break;
  76         }
  77
  78 out:
  79         kfree(buf);
  80         return res;
  81 }
  82
  83 #endif
  84
  85 #ifdef CONFIG_MODE_SKAS
  86
  87 #include "skas.h"
  88 #include "skas_ptrace.h"
  89 #include "asm/mmu_context.h"
  90 #include "proc_mm.h"
  91
  92 long write_ldt_entry(struct mm_id * mm_idp, int func, struct user_desc * desc,
  93                      void **addr, int done)
  94 {
  95         long res;
  96
  97         if(proc_mm){
  98                 /* This is a special handling for the case, that the mm to
  99                  * modify isn't current->active_mm.
 100                  * If this is called directly by modify_ldt,
 101                  *     (current->active_mm->context.skas.u == mm_idp)
 102                  * will be true. So no call to switch_mm_skas(mm_idp) is done.
 103                  * If this is called in case of init_new_ldt or PTRACE_LDT,
 104                  * mm_idp won't belong to current->active_mm, but child->mm.
 105                  * So we need to switch child's mm into our userspace, then
 106                  * later switch back.
 107                  *
 108                  * Note: I'm unsure: should interrupts be disabled here?
 109                  */
 110                 if(!current->active_mm || current->active_mm == &init_mm ||
 111                    mm_idp != &current->active_mm->context.skas.id)
 112                         switch_mm_skas(mm_idp);
 113         }
 114
 115         if(ptrace_ldt) {
 116                 struct ptrace_ldt ldt_op = (struct ptrace_ldt) {
 117                         .func = func,
 118                         .ptr = desc,
 119                         .bytecount = sizeof(*desc)};
 120                 u32 cpu;
 121                 int pid;
 122
 123                 if(!proc_mm)
 124                         pid = mm_idp->u.pid;
 125                 else {
 126                         cpu = get_cpu();
 127                         pid = userspace_pid[cpu];
 128                 }
 129
 130                 res = os_ptrace_ldt(pid, 0, (unsigned long) &ldt_op);
 131
 132                 if(proc_mm)
 133                         put_cpu();
 134         }
 135         else {
 136                 void *stub_addr;
 137                 res = syscall_stub_data(mm_idp, (unsigned long *)desc,
 138                                         (sizeof(*desc) + sizeof(long) - 1) &
 139                                             ~(sizeof(long) - 1),
 140                                         addr, &stub_addr);
 141                 if(!res){
 142                         unsigned long args[] = { func,
 143                                                  (unsigned long)stub_addr,
 144                                                  sizeof(*desc),
 145                                                  0, 0, 0 };
 146                         res = run_syscall_stub(mm_idp, __NR_modify_ldt, args,
 147                                                0, addr, done);
 148                 }
 149         }
 150
 151         if(proc_mm){
 152                 /* This is the second part of special handling, that makes
 153                  * PTRACE_LDT possible to implement.
 154                  */
 155                 if(current->active_mm && current->active_mm != &init_mm &&
 156                    mm_idp != &current->active_mm->context.skas.id)
 157                         switch_mm_skas(&current->active_mm->context.skas.id);
 158         }
 159
 160         return res;
 161 }
 162
 163 static long read_ldt_from_host(void __user * ptr, unsigned long bytecount)
 164 {
 165         int res, n;
 166         struct ptrace_ldt ptrace_ldt = (struct ptrace_ldt) {
 167                         .func = 0,
 168                         .bytecount = bytecount,
 169                         .ptr = kmalloc(bytecount, GFP_KERNEL)};
 170         u32 cpu;
 171
 172         if(ptrace_ldt.ptr == NULL)
 173                 return -ENOMEM;
 174
 175         /* This is called from sys_modify_ldt only, so userspace_pid gives
 176          * us the right number
 177          */
 178
 179         cpu = get_cpu();
 180         res = os_ptrace_ldt(userspace_pid[cpu], 0, (unsigned long) &ptrace_ldt);
 181         put_cpu();
 182         if(res < 0)
 183                 goto out;
 184
 185         n = copy_to_user(ptr, ptrace_ldt.ptr, res);
 186         if(n != 0)
 187                 res = -EFAULT;
 188
 189   out:
 190         kfree(ptrace_ldt.ptr);
 191
 192         return res;
 193 }
 194
 195 /*
 196  * In skas mode, we hold our own ldt data in UML.
 197  * Thus, the code implementing sys_modify_ldt_skas
 198  * is very similar to (and mostly stolen from) sys_modify_ldt
 199  * for arch/i386/kernel/ldt.c
 200  * The routines copied and modified in part are:
 201  * - read_ldt
 202  * - read_default_ldt
 203  * - write_ldt
 204  * - sys_modify_ldt_skas
 205  */
 206
 207 static int read_ldt(void __user * ptr, unsigned long bytecount)
 208 {
 209         int i, err = 0;
 210         unsigned long size;
 211         uml_ldt_t * ldt = &current->mm->context.skas.ldt;
 212
 213         if(!ldt->entry_count)
 214                 goto out;
 215         if(bytecount > LDT_ENTRY_SIZE*LDT_ENTRIES)
 216                 bytecount = LDT_ENTRY_SIZE*LDT_ENTRIES;
 217         err = bytecount;
 218
 219         if(ptrace_ldt){
 220                 return read_ldt_from_host(ptr, bytecount);
 221         }
 222
 223         down(&ldt->semaphore);
 224         if(ldt->entry_count <= LDT_DIRECT_ENTRIES){
 225                 size = LDT_ENTRY_SIZE*LDT_DIRECT_ENTRIES;
 226                 if(size > bytecount)
 227                         size = bytecount;
 228                 if(copy_to_user(ptr, ldt->u.entries, size))
 229                         err = -EFAULT;
 230                 bytecount -= size;
 231                 ptr += size;
 232         }
 233         else {
 234                 for(i=0; i<ldt->entry_count/LDT_ENTRIES_PER_PAGE && bytecount;
 235                          i++){
 236                         size = PAGE_SIZE;
 237                         if(size > bytecount)
 238                                 size = bytecount;
 239                         if(copy_to_user(ptr, ldt->u.pages[i], size)){
 240                                 err = -EFAULT;
 241                                 break;
 242                         }
 243                         bytecount -= size;
 244                         ptr += size;
 245                 }
 246         }
 247         up(&ldt->semaphore);
 248
 249         if(bytecount == 0 || err == -EFAULT)
 250                 goto out;
 251
 252         if(clear_user(ptr, bytecount))
 253                 err = -EFAULT;
 254
 255 out:
 256         return err;
 257 }
 258
 259 static int read_default_ldt(void __user * ptr, unsigned long bytecount)
 260 {
 261         int err;
 262
 263         if(bytecount > 5*LDT_ENTRY_SIZE)
 264                 bytecount = 5*LDT_ENTRY_SIZE;
 265
 266         err = bytecount;
 267         /* UML doesn't support lcall7 and lcall27.
 268          * So, we don't really have a default ldt, but emulate
 269          * an empty ldt of common host default ldt size.
 270          */
 271         if(clear_user(ptr, bytecount))
 272                 err = -EFAULT;
 273
 274         return err;
 275 }
 276
 277 static int write_ldt(void __user * ptr, unsigned long bytecount, int func)
 278 {
 279         uml_ldt_t * ldt = &current->mm->context.skas.ldt;
 280         struct mm_id * mm_idp = &current->mm->context.skas.id;
 281         int i, err;
 282         struct user_desc ldt_info;
 283         struct ldt_entry entry0, *ldt_p;
 284         void *addr = NULL;
 285
 286         err = -EINVAL;
 287         if(bytecount != sizeof(ldt_info))
 288                 goto out;
 289         err = -EFAULT;
 290         if(copy_from_user(&ldt_info, ptr, sizeof(ldt_info)))
 291                 goto out;
 292
 293         err = -EINVAL;
 294         if(ldt_info.entry_number >= LDT_ENTRIES)
 295                 goto out;
 296         if(ldt_info.contents == 3){
 297                 if (func == 1)
 298                         goto out;
 299                 if (ldt_info.seg_not_present == 0)
 300                         goto out;
 301         }
 302
 303         if(!ptrace_ldt)
 304                 down(&ldt->semaphore);
 305
 306         err = write_ldt_entry(mm_idp, func, &ldt_info, &addr, 1);
 307         if(err)
 308                 goto out_unlock;
 309         else if(ptrace_ldt) {
 310         /* With PTRACE_LDT available, this is used as a flag only */
 311                 ldt->entry_count = 1;
 312                 goto out;
 313         }
 314
 315         if(ldt_info.entry_number >= ldt->entry_count &&
 316            ldt_info.entry_number >= LDT_DIRECT_ENTRIES){
 317                 for(i=ldt->entry_count/LDT_ENTRIES_PER_PAGE;
 318                     i*LDT_ENTRIES_PER_PAGE <= ldt_info.entry_number;
 319                     i++){
 320                         if(i == 0)
 321                                 memcpy(&entry0, ldt->u.entries,
 322                                        sizeof(entry0));
 323                         ldt->u.pages[i] = (struct ldt_entry *)
 324                                 __get_free_page(GFP_KERNEL|__GFP_ZERO);
 325                         if(!ldt->u.pages[i]){
 326                                 err = -ENOMEM;
 327                                 /* Undo the change in host */
 328                                 memset(&ldt_info, 0, sizeof(ldt_info));
 329                                 write_ldt_entry(mm_idp, 1, &ldt_info, &addr, 1);
 330                                 goto out_unlock;
 331                         }
 332                         if(i == 0) {
 333                                 memcpy(ldt->u.pages[0], &entry0,
 334                                        sizeof(entry0));
 335                                 memcpy(ldt->u.pages[0]+1, ldt->u.entries+1,
 336                                        sizeof(entry0)*(LDT_DIRECT_ENTRIES-1));
 337                         }
 338                         ldt->entry_count = (i + 1) * LDT_ENTRIES_PER_PAGE;
 339                 }
 340         }
 341         if(ldt->entry_count <= ldt_info.entry_number)
 342                 ldt->entry_count = ldt_info.entry_number + 1;
 343
 344         if(ldt->entry_count <= LDT_DIRECT_ENTRIES)
 345                 ldt_p = ldt->u.entries + ldt_info.entry_number;
 346         else
 347                 ldt_p = ldt->u.pages[ldt_info.entry_number/LDT_ENTRIES_PER_PAGE] +
 348                         ldt_info.entry_number%LDT_ENTRIES_PER_PAGE;
 349
 350         if(ldt_info.base_addr == 0 && ldt_info.limit == 0 &&
 351            (func == 1 || LDT_empty(&ldt_info))){
 352                 ldt_p->a = 0;
 353                 ldt_p->b = 0;
 354         }
 355         else{
 356                 if (func == 1)
 357                         ldt_info.useable = 0;
 358                 ldt_p->a = LDT_entry_a(&ldt_info);
 359                 ldt_p->b = LDT_entry_b(&ldt_info);
 360         }
 361         err = 0;
 362
 363 out_unlock:
 364         up(&ldt->semaphore);
 365 out:
 366         return err;
 367 }
 368
 369 static long do_modify_ldt_skas(int func, void __user *ptr,
 370                                unsigned long bytecount)
 371 {
 372         int ret = -ENOSYS;
 373
 374         switch (func) {
 375                 case 0:
 376                         ret = read_ldt(ptr, bytecount);
 377                         break;
 378                 case 1:
 379                 case 0x11:
 380                         ret = write_ldt(ptr, bytecount, func);
 381                         break;
 382                 case 2:
 383                         ret = read_default_ldt(ptr, bytecount);
 384                         break;
 385         }
 386         return ret;
 387 }
 388
 389 short dummy_list[9] = {0, -1};
 390 short * host_ldt_entries = NULL;
 391
 392 void ldt_get_host_info(void)
 393 {
 394         long ret;
 395         struct ldt_entry * ldt;
 396         int i, size, k, order;
 397
 398         host_ldt_entries = dummy_list+1;
 399
 400         for(i = LDT_PAGES_MAX-1, order=0; i; i>>=1, order++);
 401
 402         ldt = (struct ldt_entry *)
 403               __get_free_pages(GFP_KERNEL|__GFP_ZERO, order);
 404         if(ldt == NULL) {
 405                 printk("ldt_get_host_info: couldn't allocate buffer for host ldt\n");
 406                 return;
 407         }
 408
 409         ret = modify_ldt(0, ldt, (1<<order)*PAGE_SIZE);
 410         if(ret < 0) {
 411                 printk("ldt_get_host_info: couldn't read host ldt\n");
 412                 goto out_free;
 413         }
 414         if(ret == 0) {
 415                 /* default_ldt is active, simply write an empty entry 0 */
 416                 host_ldt_entries = dummy_list;
 417                 goto out_free;
 418         }
 419
 420         for(i=0, size=0; i<ret/LDT_ENTRY_SIZE; i++){
 421                 if(ldt[i].a != 0 || ldt[i].b != 0)
 422                         size++;
 423         }
 424
 425         if(size < ARRAY_SIZE(dummy_list))
 426                 host_ldt_entries = dummy_list;
 427         else {
 428                 size = (size + 1) * sizeof(dummy_list[0]);
 429                 host_ldt_entries = kmalloc(size, GFP_KERNEL);
 430                 if(host_ldt_entries == NULL) {
 431                         printk("ldt_get_host_info: couldn't allocate host ldt list\n");
 432                         goto out_free;
 433                 }
 434         }
 435
 436         for(i=0, k=0; i<ret/LDT_ENTRY_SIZE; i++){
 437                 if(ldt[i].a != 0 || ldt[i].b != 0) {
 438                         host_ldt_entries[k++] = i;
 439                 }
 440         }
 441         host_ldt_entries[k] = -1;
 442
 443 out_free:
 444         free_pages((unsigned long)ldt, order);
 445 }
 446
 447 long init_new_ldt(struct mmu_context_skas * new_mm,
 448                   struct mmu_context_skas * from_mm)
 449 {
 450         struct user_desc desc;
 451         short * num_p;
 452         int i;
 453         long page, err=0;
 454         void *addr = NULL;
 455         struct proc_mm_op copy;
 456
 457
 458         if(!ptrace_ldt)
 459                 init_MUTEX(&new_mm->ldt.semaphore);
 460
 461         if(!from_mm){
 462                 memset(&desc, 0, sizeof(desc));
 463                 /*
 464                  * We have to initialize a clean ldt.
 465                  */
 466                 if(proc_mm) {
 467                         /*
 468                          * If the new mm was created using proc_mm, host's
 469                          * default-ldt currently is assigned, which normally
 470                          * contains the call-gates for lcall7 and lcall27.
 471                          * To remove these gates, we simply write an empty
 472                          * entry as number 0 to the host.
 473                          */
 474                         err = write_ldt_entry(&new_mm->id, 1, &desc,
 475                                               &addr, 1);
 476                 }
 477                 else{
 478                         /*
 479                          * Now we try to retrieve info about the ldt, we
 480                          * inherited from the host. All ldt-entries found
 481                          * will be reset in the following loop
 482                          */
 483                         if(host_ldt_entries == NULL)
 484                                 ldt_get_host_info();
 485                         for(num_p=host_ldt_entries; *num_p != -1; num_p++){
 486                                 desc.entry_number = *num_p;
 487                                 err = write_ldt_entry(&new_mm->id, 1, &desc,
 488                                                       &addr, *(num_p + 1) == -1);
 489                                 if(err)
 490                                         break;
 491                         }
 492                 }
 493                 new_mm->ldt.entry_count = 0;
 494
 495                 goto out;
 496         }
 497
 498         if(proc_mm){
 499                 /* We have a valid from_mm, so we now have to copy the LDT of
 500                  * from_mm to new_mm, because using proc_mm an new mm with
 501                  * an empty/default LDT was created in new_mm()
 502                  */
 503                 copy = ((struct proc_mm_op) { .op       = MM_COPY_SEGMENTS,
 504                                               .u        =
 505                                               { .copy_segments =
 506                                                         from_mm->id.u.mm_fd } } );
 507                 i = os_write_file(new_mm->id.u.mm_fd, &copy, sizeof(copy));
 508                 if(i != sizeof(copy))
 509                         printk("new_mm : /proc/mm copy_segments failed, "
 510                                "err = %d\n", -i);
 511         }
 512
 513         if(!ptrace_ldt) {
 514                 /* Our local LDT is used to supply the data for
 515                  * modify_ldt(READLDT), if PTRACE_LDT isn't available,
 516                  * i.e., we have to use the stub for modify_ldt, which
 517                  * can't handle the big read buffer of up to 64kB.
 518                  */
 519                 down(&from_mm->ldt.semaphore);
 520                 if(from_mm->ldt.entry_count <= LDT_DIRECT_ENTRIES){
 521                         memcpy(new_mm->ldt.u.entries, from_mm->ldt.u.entries,
 522                                sizeof(new_mm->ldt.u.entries));
 523                 }
 524                 else{
 525                         i = from_mm->ldt.entry_count / LDT_ENTRIES_PER_PAGE;
 526                         while(i-->0){
 527                                 page = __get_free_page(GFP_KERNEL|__GFP_ZERO);
 528                                 if (!page){
 529                                         err = -ENOMEM;
 530                                         break;
 531                                 }
 532                                 new_mm->ldt.u.pages[i] =
 533                                         (struct ldt_entry *) page;
 534                                 memcpy(new_mm->ldt.u.pages[i],
 535                                        from_mm->ldt.u.pages[i], PAGE_SIZE);
 536                         }
 537                 }
 538                 new_mm->ldt.entry_count = from_mm->ldt.entry_count;
 539                 up(&from_mm->ldt.semaphore);
 540         }
 541
 542     out:
 543         return err;
 544 }
 545
 546
 547 void free_ldt(struct mmu_context_skas * mm)
 548 {
 549         int i;
 550
 551         if(!ptrace_ldt && mm->ldt.entry_count > LDT_DIRECT_ENTRIES){
 552                 i = mm->ldt.entry_count / LDT_ENTRIES_PER_PAGE;
 553                 while(i-- > 0){
 554                         free_page((long )mm->ldt.u.pages[i]);
 555                 }
 556         }
 557         mm->ldt.entry_count = 0;
 558 }
 559 #endif
 560
 561 int sys_modify_ldt(int func, void __user *ptr, unsigned long bytecount)
 562 {
 563         return(CHOOSE_MODE_PROC(do_modify_ldt_tt, do_modify_ldt_skas, func,
 564                                 ptr, bytecount));
 565 }