Commit | Line | Data |
---|---|---|
b2441318 | 1 | // SPDX-License-Identifier: GPL-2.0 |
57319d80 QR |
2 | /* |
3 | * mpx.c - Memory Protection eXtensions | |
4 | * | |
5 | * Copyright (c) 2014, Intel Corporation. | |
6 | * Qiaowei Ren <qiaowei.ren@intel.com> | |
7 | * Dave Hansen <dave.hansen@intel.com> | |
8 | */ | |
9 | #include <linux/kernel.h> | |
fcc7ffd6 | 10 | #include <linux/slab.h> |
589ee628 | 11 | #include <linux/mm_types.h> |
57319d80 QR |
12 | #include <linux/syscalls.h> |
13 | #include <linux/sched/sysctl.h> | |
14 | ||
fe3d197f | 15 | #include <asm/insn.h> |
57319d80 | 16 | #include <asm/mman.h> |
1de4fa14 | 17 | #include <asm/mmu_context.h> |
57319d80 | 18 | #include <asm/mpx.h> |
fe3d197f | 19 | #include <asm/processor.h> |
78f7f1e5 | 20 | #include <asm/fpu/internal.h> |
57319d80 | 21 | |
e7126cf5 DH |
22 | #define CREATE_TRACE_POINTS |
23 | #include <asm/trace/mpx.h> | |
24 | ||
613fcb7d DH |
25 | static inline unsigned long mpx_bd_size_bytes(struct mm_struct *mm) |
26 | { | |
27 | if (is_64bit_mm(mm)) | |
28 | return MPX_BD_SIZE_BYTES_64; | |
29 | else | |
30 | return MPX_BD_SIZE_BYTES_32; | |
31 | } | |
32 | ||
33 | static inline unsigned long mpx_bt_size_bytes(struct mm_struct *mm) | |
34 | { | |
35 | if (is_64bit_mm(mm)) | |
36 | return MPX_BT_SIZE_BYTES_64; | |
37 | else | |
38 | return MPX_BT_SIZE_BYTES_32; | |
39 | } | |
40 | ||
57319d80 QR |
41 | /* |
42 | * This is really a simplified "vm_mmap". it only handles MPX | |
43 | * bounds tables (the bounds directory is user-allocated). | |
57319d80 QR |
44 | */ |
45 | static unsigned long mpx_mmap(unsigned long len) | |
46 | { | |
57319d80 | 47 | struct mm_struct *mm = current->mm; |
1fcfd8db | 48 | unsigned long addr, populate; |
57319d80 | 49 | |
eb099e5b | 50 | /* Only bounds table can be allocated here */ |
613fcb7d | 51 | if (len != mpx_bt_size_bytes(mm)) |
57319d80 QR |
52 | return -EINVAL; |
53 | ||
54 | down_write(&mm->mmap_sem); | |
1fcfd8db | 55 | addr = do_mmap(NULL, 0, len, PROT_READ | PROT_WRITE, |
897ab3e0 | 56 | MAP_ANONYMOUS | MAP_PRIVATE, VM_MPX, 0, &populate, NULL); |
57319d80 | 57 | up_write(&mm->mmap_sem); |
1fcfd8db ON |
58 | if (populate) |
59 | mm_populate(addr, populate); | |
60 | ||
61 | return addr; | |
57319d80 | 62 | } |
fcc7ffd6 DH |
63 | |
64 | enum reg_type { | |
65 | REG_TYPE_RM = 0, | |
66 | REG_TYPE_INDEX, | |
67 | REG_TYPE_BASE, | |
68 | }; | |
69 | ||
68c009c4 DH |
70 | static int get_reg_offset(struct insn *insn, struct pt_regs *regs, |
71 | enum reg_type type) | |
fcc7ffd6 DH |
72 | { |
73 | int regno = 0; | |
74 | ||
75 | static const int regoff[] = { | |
76 | offsetof(struct pt_regs, ax), | |
77 | offsetof(struct pt_regs, cx), | |
78 | offsetof(struct pt_regs, dx), | |
79 | offsetof(struct pt_regs, bx), | |
80 | offsetof(struct pt_regs, sp), | |
81 | offsetof(struct pt_regs, bp), | |
82 | offsetof(struct pt_regs, si), | |
83 | offsetof(struct pt_regs, di), | |
84 | #ifdef CONFIG_X86_64 | |
85 | offsetof(struct pt_regs, r8), | |
86 | offsetof(struct pt_regs, r9), | |
87 | offsetof(struct pt_regs, r10), | |
88 | offsetof(struct pt_regs, r11), | |
89 | offsetof(struct pt_regs, r12), | |
90 | offsetof(struct pt_regs, r13), | |
91 | offsetof(struct pt_regs, r14), | |
92 | offsetof(struct pt_regs, r15), | |
93 | #endif | |
94 | }; | |
95 | int nr_registers = ARRAY_SIZE(regoff); | |
96 | /* | |
97 | * Don't possibly decode a 32-bit instructions as | |
98 | * reading a 64-bit-only register. | |
99 | */ | |
100 | if (IS_ENABLED(CONFIG_X86_64) && !insn->x86_64) | |
101 | nr_registers -= 8; | |
102 | ||
103 | switch (type) { | |
104 | case REG_TYPE_RM: | |
105 | regno = X86_MODRM_RM(insn->modrm.value); | |
8e8efe03 | 106 | if (X86_REX_B(insn->rex_prefix.value)) |
fcc7ffd6 DH |
107 | regno += 8; |
108 | break; | |
109 | ||
110 | case REG_TYPE_INDEX: | |
111 | regno = X86_SIB_INDEX(insn->sib.value); | |
8e8efe03 | 112 | if (X86_REX_X(insn->rex_prefix.value)) |
fcc7ffd6 DH |
113 | regno += 8; |
114 | break; | |
115 | ||
116 | case REG_TYPE_BASE: | |
117 | regno = X86_SIB_BASE(insn->sib.value); | |
8e8efe03 | 118 | if (X86_REX_B(insn->rex_prefix.value)) |
fcc7ffd6 DH |
119 | regno += 8; |
120 | break; | |
121 | ||
122 | default: | |
123 | pr_err("invalid register type"); | |
124 | BUG(); | |
125 | break; | |
126 | } | |
127 | ||
9bf148cb | 128 | if (regno >= nr_registers) { |
fcc7ffd6 DH |
129 | WARN_ONCE(1, "decoded an instruction with an invalid register"); |
130 | return -EINVAL; | |
131 | } | |
132 | return regoff[regno]; | |
133 | } | |
134 | ||
135 | /* | |
136 | * return the address being referenced be instruction | |
137 | * for rm=3 returning the content of the rm reg | |
138 | * for rm!=3 calculates the address using SIB and Disp | |
139 | */ | |
140 | static void __user *mpx_get_addr_ref(struct insn *insn, struct pt_regs *regs) | |
141 | { | |
68c009c4 DH |
142 | unsigned long addr, base, indx; |
143 | int addr_offset, base_offset, indx_offset; | |
fcc7ffd6 DH |
144 | insn_byte_t sib; |
145 | ||
146 | insn_get_modrm(insn); | |
147 | insn_get_sib(insn); | |
148 | sib = insn->sib.value; | |
149 | ||
150 | if (X86_MODRM_MOD(insn->modrm.value) == 3) { | |
151 | addr_offset = get_reg_offset(insn, regs, REG_TYPE_RM); | |
152 | if (addr_offset < 0) | |
153 | goto out_err; | |
154 | addr = regs_get_register(regs, addr_offset); | |
155 | } else { | |
156 | if (insn->sib.nbytes) { | |
157 | base_offset = get_reg_offset(insn, regs, REG_TYPE_BASE); | |
158 | if (base_offset < 0) | |
159 | goto out_err; | |
160 | ||
161 | indx_offset = get_reg_offset(insn, regs, REG_TYPE_INDEX); | |
162 | if (indx_offset < 0) | |
163 | goto out_err; | |
164 | ||
165 | base = regs_get_register(regs, base_offset); | |
166 | indx = regs_get_register(regs, indx_offset); | |
167 | addr = base + indx * (1 << X86_SIB_SCALE(sib)); | |
168 | } else { | |
169 | addr_offset = get_reg_offset(insn, regs, REG_TYPE_RM); | |
170 | if (addr_offset < 0) | |
171 | goto out_err; | |
172 | addr = regs_get_register(regs, addr_offset); | |
173 | } | |
174 | addr += insn->displacement.value; | |
175 | } | |
176 | return (void __user *)addr; | |
177 | out_err: | |
178 | return (void __user *)-1; | |
179 | } | |
180 | ||
181 | static int mpx_insn_decode(struct insn *insn, | |
182 | struct pt_regs *regs) | |
183 | { | |
184 | unsigned char buf[MAX_INSN_SIZE]; | |
185 | int x86_64 = !test_thread_flag(TIF_IA32); | |
186 | int not_copied; | |
187 | int nr_copied; | |
188 | ||
189 | not_copied = copy_from_user(buf, (void __user *)regs->ip, sizeof(buf)); | |
190 | nr_copied = sizeof(buf) - not_copied; | |
191 | /* | |
192 | * The decoder _should_ fail nicely if we pass it a short buffer. | |
193 | * But, let's not depend on that implementation detail. If we | |
194 | * did not get anything, just error out now. | |
195 | */ | |
196 | if (!nr_copied) | |
197 | return -EFAULT; | |
198 | insn_init(insn, buf, nr_copied, x86_64); | |
199 | insn_get_length(insn); | |
200 | /* | |
201 | * copy_from_user() tries to get as many bytes as we could see in | |
202 | * the largest possible instruction. If the instruction we are | |
203 | * after is shorter than that _and_ we attempt to copy from | |
204 | * something unreadable, we might get a short read. This is OK | |
205 | * as long as the read did not stop in the middle of the | |
206 | * instruction. Check to see if we got a partial instruction. | |
207 | */ | |
208 | if (nr_copied < insn->length) | |
209 | return -EFAULT; | |
210 | ||
211 | insn_get_opcode(insn); | |
212 | /* | |
213 | * We only _really_ need to decode bndcl/bndcn/bndcu | |
214 | * Error out on anything else. | |
215 | */ | |
216 | if (insn->opcode.bytes[0] != 0x0f) | |
217 | goto bad_opcode; | |
218 | if ((insn->opcode.bytes[1] != 0x1a) && | |
219 | (insn->opcode.bytes[1] != 0x1b)) | |
220 | goto bad_opcode; | |
221 | ||
222 | return 0; | |
223 | bad_opcode: | |
224 | return -EINVAL; | |
225 | } | |
226 | ||
227 | /* | |
228 | * If a bounds overflow occurs then a #BR is generated. This | |
229 | * function decodes MPX instructions to get violation address | |
230 | * and set this address into extended struct siginfo. | |
231 | * | |
232 | * Note that this is not a super precise way of doing this. | |
233 | * Userspace could have, by the time we get here, written | |
234 | * anything it wants in to the instructions. We can not | |
235 | * trust anything about it. They might not be valid | |
236 | * instructions or might encode invalid registers, etc... | |
237 | * | |
238 | * The caller is expected to kfree() the returned siginfo_t. | |
239 | */ | |
46a6e0cf | 240 | siginfo_t *mpx_generate_siginfo(struct pt_regs *regs) |
fcc7ffd6 | 241 | { |
1126cb45 DH |
242 | const struct mpx_bndreg_state *bndregs; |
243 | const struct mpx_bndreg *bndreg; | |
fe3d197f | 244 | siginfo_t *info = NULL; |
fcc7ffd6 DH |
245 | struct insn insn; |
246 | uint8_t bndregno; | |
247 | int err; | |
fcc7ffd6 DH |
248 | |
249 | err = mpx_insn_decode(&insn, regs); | |
250 | if (err) | |
251 | goto err_out; | |
252 | ||
253 | /* | |
254 | * We know at this point that we are only dealing with | |
255 | * MPX instructions. | |
256 | */ | |
257 | insn_get_modrm(&insn); | |
258 | bndregno = X86_MODRM_REG(insn.modrm.value); | |
259 | if (bndregno > 3) { | |
260 | err = -EINVAL; | |
261 | goto err_out; | |
262 | } | |
a84eeaa9 | 263 | /* get bndregs field from current task's xsave area */ |
d91cab78 | 264 | bndregs = get_xsave_field_ptr(XFEATURE_MASK_BNDREGS); |
fe3d197f DH |
265 | if (!bndregs) { |
266 | err = -EINVAL; | |
267 | goto err_out; | |
268 | } | |
269 | /* now go select the individual register in the set of 4 */ | |
1126cb45 | 270 | bndreg = &bndregs->bndreg[bndregno]; |
fe3d197f | 271 | |
fcc7ffd6 DH |
272 | info = kzalloc(sizeof(*info), GFP_KERNEL); |
273 | if (!info) { | |
274 | err = -ENOMEM; | |
275 | goto err_out; | |
276 | } | |
277 | /* | |
278 | * The registers are always 64-bit, but the upper 32 | |
279 | * bits are ignored in 32-bit mode. Also, note that the | |
280 | * upper bounds are architecturally represented in 1's | |
281 | * complement form. | |
282 | * | |
283 | * The 'unsigned long' cast is because the compiler | |
284 | * complains when casting from integers to different-size | |
285 | * pointers. | |
286 | */ | |
fe3d197f DH |
287 | info->si_lower = (void __user *)(unsigned long)bndreg->lower_bound; |
288 | info->si_upper = (void __user *)(unsigned long)~bndreg->upper_bound; | |
fcc7ffd6 DH |
289 | info->si_addr_lsb = 0; |
290 | info->si_signo = SIGSEGV; | |
291 | info->si_errno = 0; | |
292 | info->si_code = SEGV_BNDERR; | |
293 | info->si_addr = mpx_get_addr_ref(&insn, regs); | |
294 | /* | |
295 | * We were not able to extract an address from the instruction, | |
296 | * probably because there was something invalid in it. | |
297 | */ | |
45382862 | 298 | if (info->si_addr == (void __user *)-1) { |
fcc7ffd6 DH |
299 | err = -EINVAL; |
300 | goto err_out; | |
301 | } | |
97efebf1 | 302 | trace_mpx_bounds_register_exception(info->si_addr, bndreg); |
fcc7ffd6 DH |
303 | return info; |
304 | err_out: | |
fe3d197f DH |
305 | /* info might be NULL, but kfree() handles that */ |
306 | kfree(info); | |
fcc7ffd6 DH |
307 | return ERR_PTR(err); |
308 | } | |
fe3d197f | 309 | |
46a6e0cf | 310 | static __user void *mpx_get_bounds_dir(void) |
fe3d197f | 311 | { |
1126cb45 | 312 | const struct mpx_bndcsr *bndcsr; |
fe3d197f DH |
313 | |
314 | if (!cpu_feature_enabled(X86_FEATURE_MPX)) | |
315 | return MPX_INVALID_BOUNDS_DIR; | |
316 | ||
317 | /* | |
318 | * The bounds directory pointer is stored in a register | |
319 | * only accessible if we first do an xsave. | |
320 | */ | |
d91cab78 | 321 | bndcsr = get_xsave_field_ptr(XFEATURE_MASK_BNDCSR); |
fe3d197f DH |
322 | if (!bndcsr) |
323 | return MPX_INVALID_BOUNDS_DIR; | |
324 | ||
325 | /* | |
326 | * Make sure the register looks valid by checking the | |
327 | * enable bit. | |
328 | */ | |
329 | if (!(bndcsr->bndcfgu & MPX_BNDCFG_ENABLE_FLAG)) | |
330 | return MPX_INVALID_BOUNDS_DIR; | |
331 | ||
332 | /* | |
333 | * Lastly, mask off the low bits used for configuration | |
334 | * flags, and return the address of the bounds table. | |
335 | */ | |
336 | return (void __user *)(unsigned long) | |
337 | (bndcsr->bndcfgu & MPX_BNDCFG_ADDR_MASK); | |
338 | } | |
339 | ||
46a6e0cf | 340 | int mpx_enable_management(void) |
fe3d197f DH |
341 | { |
342 | void __user *bd_base = MPX_INVALID_BOUNDS_DIR; | |
46a6e0cf | 343 | struct mm_struct *mm = current->mm; |
fe3d197f DH |
344 | int ret = 0; |
345 | ||
346 | /* | |
347 | * runtime in the userspace will be responsible for allocation of | |
348 | * the bounds directory. Then, it will save the base of the bounds | |
349 | * directory into XSAVE/XRSTOR Save Area and enable MPX through | |
350 | * XRSTOR instruction. | |
351 | * | |
a84eeaa9 DH |
352 | * The copy_xregs_to_kernel() beneath get_xsave_field_ptr() is |
353 | * expected to be relatively expensive. Storing the bounds | |
354 | * directory here means that we do not have to do xsave in the | |
cb02de96 | 355 | * unmap path; we can just use mm->context.bd_addr instead. |
fe3d197f | 356 | */ |
46a6e0cf | 357 | bd_base = mpx_get_bounds_dir(); |
fe3d197f | 358 | down_write(&mm->mmap_sem); |
44b04912 KS |
359 | |
360 | /* MPX doesn't support addresses above 47 bits yet. */ | |
361 | if (find_vma(mm, DEFAULT_MAP_WINDOW)) { | |
362 | pr_warn_once("%s (%d): MPX cannot handle addresses " | |
363 | "above 47-bits. Disabling.", | |
364 | current->comm, current->pid); | |
365 | ret = -ENXIO; | |
366 | goto out; | |
367 | } | |
cb02de96 MR |
368 | mm->context.bd_addr = bd_base; |
369 | if (mm->context.bd_addr == MPX_INVALID_BOUNDS_DIR) | |
fe3d197f | 370 | ret = -ENXIO; |
44b04912 | 371 | out: |
fe3d197f DH |
372 | up_write(&mm->mmap_sem); |
373 | return ret; | |
374 | } | |
375 | ||
46a6e0cf | 376 | int mpx_disable_management(void) |
fe3d197f DH |
377 | { |
378 | struct mm_struct *mm = current->mm; | |
379 | ||
380 | if (!cpu_feature_enabled(X86_FEATURE_MPX)) | |
381 | return -ENXIO; | |
382 | ||
383 | down_write(&mm->mmap_sem); | |
cb02de96 | 384 | mm->context.bd_addr = MPX_INVALID_BOUNDS_DIR; |
fe3d197f DH |
385 | up_write(&mm->mmap_sem); |
386 | return 0; | |
387 | } | |
388 | ||
6ac52bb4 DH |
389 | static int mpx_cmpxchg_bd_entry(struct mm_struct *mm, |
390 | unsigned long *curval, | |
391 | unsigned long __user *addr, | |
392 | unsigned long old_val, unsigned long new_val) | |
393 | { | |
394 | int ret; | |
395 | /* | |
396 | * user_atomic_cmpxchg_inatomic() actually uses sizeof() | |
397 | * the pointer that we pass to it to figure out how much | |
398 | * data to cmpxchg. We have to be careful here not to | |
399 | * pass a pointer to a 64-bit data type when we only want | |
400 | * a 32-bit copy. | |
401 | */ | |
402 | if (is_64bit_mm(mm)) { | |
403 | ret = user_atomic_cmpxchg_inatomic(curval, | |
404 | addr, old_val, new_val); | |
405 | } else { | |
406 | u32 uninitialized_var(curval_32); | |
407 | u32 old_val_32 = old_val; | |
408 | u32 new_val_32 = new_val; | |
409 | u32 __user *addr_32 = (u32 __user *)addr; | |
410 | ||
411 | ret = user_atomic_cmpxchg_inatomic(&curval_32, | |
412 | addr_32, old_val_32, new_val_32); | |
413 | *curval = curval_32; | |
414 | } | |
415 | return ret; | |
416 | } | |
417 | ||
fe3d197f | 418 | /* |
613fcb7d DH |
419 | * With 32-bit mode, a bounds directory is 4MB, and the size of each |
420 | * bounds table is 16KB. With 64-bit mode, a bounds directory is 2GB, | |
fe3d197f DH |
421 | * and the size of each bounds table is 4MB. |
422 | */ | |
613fcb7d | 423 | static int allocate_bt(struct mm_struct *mm, long __user *bd_entry) |
fe3d197f DH |
424 | { |
425 | unsigned long expected_old_val = 0; | |
426 | unsigned long actual_old_val = 0; | |
427 | unsigned long bt_addr; | |
a1149fc8 | 428 | unsigned long bd_new_entry; |
fe3d197f DH |
429 | int ret = 0; |
430 | ||
431 | /* | |
432 | * Carve the virtual space out of userspace for the new | |
433 | * bounds table: | |
434 | */ | |
613fcb7d | 435 | bt_addr = mpx_mmap(mpx_bt_size_bytes(mm)); |
fe3d197f DH |
436 | if (IS_ERR((void *)bt_addr)) |
437 | return PTR_ERR((void *)bt_addr); | |
438 | /* | |
439 | * Set the valid flag (kinda like _PAGE_PRESENT in a pte) | |
440 | */ | |
a1149fc8 | 441 | bd_new_entry = bt_addr | MPX_BD_ENTRY_VALID_FLAG; |
fe3d197f DH |
442 | |
443 | /* | |
444 | * Go poke the address of the new bounds table in to the | |
445 | * bounds directory entry out in userspace memory. Note: | |
446 | * we may race with another CPU instantiating the same table. | |
447 | * In that case the cmpxchg will see an unexpected | |
448 | * 'actual_old_val'. | |
449 | * | |
450 | * This can fault, but that's OK because we do not hold | |
451 | * mmap_sem at this point, unlike some of the other part | |
452 | * of the MPX code that have to pagefault_disable(). | |
453 | */ | |
6ac52bb4 DH |
454 | ret = mpx_cmpxchg_bd_entry(mm, &actual_old_val, bd_entry, |
455 | expected_old_val, bd_new_entry); | |
fe3d197f DH |
456 | if (ret) |
457 | goto out_unmap; | |
458 | ||
459 | /* | |
460 | * The user_atomic_cmpxchg_inatomic() will only return nonzero | |
461 | * for faults, *not* if the cmpxchg itself fails. Now we must | |
462 | * verify that the cmpxchg itself completed successfully. | |
463 | */ | |
464 | /* | |
465 | * We expected an empty 'expected_old_val', but instead found | |
466 | * an apparently valid entry. Assume we raced with another | |
467 | * thread to instantiate this table and desclare succecss. | |
468 | */ | |
469 | if (actual_old_val & MPX_BD_ENTRY_VALID_FLAG) { | |
470 | ret = 0; | |
471 | goto out_unmap; | |
472 | } | |
473 | /* | |
474 | * We found a non-empty bd_entry but it did not have the | |
475 | * VALID_FLAG set. Return an error which will result in | |
476 | * a SEGV since this probably means that somebody scribbled | |
477 | * some invalid data in to a bounds table. | |
478 | */ | |
479 | if (expected_old_val != actual_old_val) { | |
480 | ret = -EINVAL; | |
481 | goto out_unmap; | |
482 | } | |
cd4996dc | 483 | trace_mpx_new_bounds_table(bt_addr); |
fe3d197f DH |
484 | return 0; |
485 | out_unmap: | |
613fcb7d | 486 | vm_munmap(bt_addr, mpx_bt_size_bytes(mm)); |
fe3d197f DH |
487 | return ret; |
488 | } | |
489 | ||
490 | /* | |
491 | * When a BNDSTX instruction attempts to save bounds to a bounds | |
492 | * table, it will first attempt to look up the table in the | |
493 | * first-level bounds directory. If it does not find a table in | |
494 | * the directory, a #BR is generated and we get here in order to | |
495 | * allocate a new table. | |
496 | * | |
497 | * With 32-bit mode, the size of BD is 4MB, and the size of each | |
498 | * bound table is 16KB. With 64-bit mode, the size of BD is 2GB, | |
499 | * and the size of each bound table is 4MB. | |
500 | */ | |
46a6e0cf | 501 | static int do_mpx_bt_fault(void) |
fe3d197f DH |
502 | { |
503 | unsigned long bd_entry, bd_base; | |
1126cb45 | 504 | const struct mpx_bndcsr *bndcsr; |
613fcb7d | 505 | struct mm_struct *mm = current->mm; |
fe3d197f | 506 | |
d91cab78 | 507 | bndcsr = get_xsave_field_ptr(XFEATURE_MASK_BNDCSR); |
fe3d197f DH |
508 | if (!bndcsr) |
509 | return -EINVAL; | |
510 | /* | |
511 | * Mask off the preserve and enable bits | |
512 | */ | |
513 | bd_base = bndcsr->bndcfgu & MPX_BNDCFG_ADDR_MASK; | |
514 | /* | |
515 | * The hardware provides the address of the missing or invalid | |
516 | * entry via BNDSTATUS, so we don't have to go look it up. | |
517 | */ | |
518 | bd_entry = bndcsr->bndstatus & MPX_BNDSTA_ADDR_MASK; | |
519 | /* | |
520 | * Make sure the directory entry is within where we think | |
521 | * the directory is. | |
522 | */ | |
523 | if ((bd_entry < bd_base) || | |
613fcb7d | 524 | (bd_entry >= bd_base + mpx_bd_size_bytes(mm))) |
fe3d197f DH |
525 | return -EINVAL; |
526 | ||
613fcb7d | 527 | return allocate_bt(mm, (long __user *)bd_entry); |
fe3d197f DH |
528 | } |
529 | ||
46a6e0cf | 530 | int mpx_handle_bd_fault(void) |
fe3d197f DH |
531 | { |
532 | /* | |
533 | * Userspace never asked us to manage the bounds tables, | |
534 | * so refuse to help. | |
535 | */ | |
536 | if (!kernel_managing_mpx_tables(current->mm)) | |
537 | return -EINVAL; | |
538 | ||
5ed386ec | 539 | return do_mpx_bt_fault(); |
fe3d197f | 540 | } |
1de4fa14 DH |
541 | |
542 | /* | |
543 | * A thin wrapper around get_user_pages(). Returns 0 if the | |
544 | * fault was resolved or -errno if not. | |
545 | */ | |
546 | static int mpx_resolve_fault(long __user *addr, int write) | |
547 | { | |
548 | long gup_ret; | |
549 | int nr_pages = 1; | |
1de4fa14 | 550 | |
768ae309 LS |
551 | gup_ret = get_user_pages((unsigned long)addr, nr_pages, |
552 | write ? FOLL_WRITE : 0, NULL, NULL); | |
1de4fa14 DH |
553 | /* |
554 | * get_user_pages() returns number of pages gotten. | |
555 | * 0 means we failed to fault in and get anything, | |
556 | * probably because 'addr' is bad. | |
557 | */ | |
558 | if (!gup_ret) | |
559 | return -EFAULT; | |
560 | /* Other error, return it */ | |
561 | if (gup_ret < 0) | |
562 | return gup_ret; | |
563 | /* must have gup'd a page and gup_ret>0, success */ | |
564 | return 0; | |
565 | } | |
566 | ||
54587653 DH |
567 | static unsigned long mpx_bd_entry_to_bt_addr(struct mm_struct *mm, |
568 | unsigned long bd_entry) | |
569 | { | |
570 | unsigned long bt_addr = bd_entry; | |
571 | int align_to_bytes; | |
572 | /* | |
573 | * Bit 0 in a bt_entry is always the valid bit. | |
574 | */ | |
575 | bt_addr &= ~MPX_BD_ENTRY_VALID_FLAG; | |
576 | /* | |
577 | * Tables are naturally aligned at 8-byte boundaries | |
578 | * on 64-bit and 4-byte boundaries on 32-bit. The | |
579 | * documentation makes it appear that the low bits | |
580 | * are ignored by the hardware, so we do the same. | |
581 | */ | |
582 | if (is_64bit_mm(mm)) | |
583 | align_to_bytes = 8; | |
584 | else | |
585 | align_to_bytes = 4; | |
586 | bt_addr &= ~(align_to_bytes-1); | |
587 | return bt_addr; | |
588 | } | |
589 | ||
46561c39 DH |
590 | /* |
591 | * We only want to do a 4-byte get_user() on 32-bit. Otherwise, | |
592 | * we might run off the end of the bounds table if we are on | |
593 | * a 64-bit kernel and try to get 8 bytes. | |
594 | */ | |
6bce725a | 595 | static int get_user_bd_entry(struct mm_struct *mm, unsigned long *bd_entry_ret, |
46561c39 DH |
596 | long __user *bd_entry_ptr) |
597 | { | |
598 | u32 bd_entry_32; | |
599 | int ret; | |
600 | ||
601 | if (is_64bit_mm(mm)) | |
602 | return get_user(*bd_entry_ret, bd_entry_ptr); | |
603 | ||
604 | /* | |
605 | * Note that get_user() uses the type of the *pointer* to | |
606 | * establish the size of the get, not the destination. | |
607 | */ | |
608 | ret = get_user(bd_entry_32, (u32 __user *)bd_entry_ptr); | |
609 | *bd_entry_ret = bd_entry_32; | |
610 | return ret; | |
611 | } | |
612 | ||
1de4fa14 DH |
613 | /* |
614 | * Get the base of bounds tables pointed by specific bounds | |
615 | * directory entry. | |
616 | */ | |
617 | static int get_bt_addr(struct mm_struct *mm, | |
54587653 DH |
618 | long __user *bd_entry_ptr, |
619 | unsigned long *bt_addr_result) | |
1de4fa14 DH |
620 | { |
621 | int ret; | |
622 | int valid_bit; | |
54587653 DH |
623 | unsigned long bd_entry; |
624 | unsigned long bt_addr; | |
1de4fa14 | 625 | |
54587653 | 626 | if (!access_ok(VERIFY_READ, (bd_entry_ptr), sizeof(*bd_entry_ptr))) |
1de4fa14 DH |
627 | return -EFAULT; |
628 | ||
629 | while (1) { | |
630 | int need_write = 0; | |
631 | ||
632 | pagefault_disable(); | |
46561c39 | 633 | ret = get_user_bd_entry(mm, &bd_entry, bd_entry_ptr); |
1de4fa14 DH |
634 | pagefault_enable(); |
635 | if (!ret) | |
636 | break; | |
637 | if (ret == -EFAULT) | |
54587653 | 638 | ret = mpx_resolve_fault(bd_entry_ptr, need_write); |
1de4fa14 DH |
639 | /* |
640 | * If we could not resolve the fault, consider it | |
641 | * userspace's fault and error out. | |
642 | */ | |
643 | if (ret) | |
644 | return ret; | |
645 | } | |
646 | ||
54587653 DH |
647 | valid_bit = bd_entry & MPX_BD_ENTRY_VALID_FLAG; |
648 | bt_addr = mpx_bd_entry_to_bt_addr(mm, bd_entry); | |
1de4fa14 DH |
649 | |
650 | /* | |
651 | * When the kernel is managing bounds tables, a bounds directory | |
652 | * entry will either have a valid address (plus the valid bit) | |
653 | * *OR* be completely empty. If we see a !valid entry *and* some | |
654 | * data in the address field, we know something is wrong. This | |
655 | * -EINVAL return will cause a SIGSEGV. | |
656 | */ | |
54587653 | 657 | if (!valid_bit && bt_addr) |
1de4fa14 DH |
658 | return -EINVAL; |
659 | /* | |
660 | * Do we have an completely zeroed bt entry? That is OK. It | |
661 | * just means there was no bounds table for this memory. Make | |
662 | * sure to distinguish this from -EINVAL, which will cause | |
663 | * a SEGV. | |
664 | */ | |
665 | if (!valid_bit) | |
666 | return -ENOENT; | |
667 | ||
54587653 | 668 | *bt_addr_result = bt_addr; |
1de4fa14 DH |
669 | return 0; |
670 | } | |
671 | ||
613fcb7d DH |
672 | static inline int bt_entry_size_bytes(struct mm_struct *mm) |
673 | { | |
674 | if (is_64bit_mm(mm)) | |
675 | return MPX_BT_ENTRY_BYTES_64; | |
676 | else | |
677 | return MPX_BT_ENTRY_BYTES_32; | |
678 | } | |
679 | ||
680 | /* | |
681 | * Take a virtual address and turns it in to the offset in bytes | |
682 | * inside of the bounds table where the bounds table entry | |
683 | * controlling 'addr' can be found. | |
684 | */ | |
685 | static unsigned long mpx_get_bt_entry_offset_bytes(struct mm_struct *mm, | |
686 | unsigned long addr) | |
687 | { | |
688 | unsigned long bt_table_nr_entries; | |
689 | unsigned long offset = addr; | |
690 | ||
691 | if (is_64bit_mm(mm)) { | |
692 | /* Bottom 3 bits are ignored on 64-bit */ | |
693 | offset >>= 3; | |
694 | bt_table_nr_entries = MPX_BT_NR_ENTRIES_64; | |
695 | } else { | |
696 | /* Bottom 2 bits are ignored on 32-bit */ | |
697 | offset >>= 2; | |
698 | bt_table_nr_entries = MPX_BT_NR_ENTRIES_32; | |
699 | } | |
700 | /* | |
701 | * We know the size of the table in to which we are | |
702 | * indexing, and we have eliminated all the low bits | |
703 | * which are ignored for indexing. | |
704 | * | |
705 | * Mask out all the high bits which we do not need | |
706 | * to index in to the table. Note that the tables | |
707 | * are always powers of two so this gives us a proper | |
708 | * mask. | |
709 | */ | |
710 | offset &= (bt_table_nr_entries-1); | |
711 | /* | |
712 | * We now have an entry offset in terms of *entries* in | |
713 | * the table. We need to scale it back up to bytes. | |
714 | */ | |
715 | offset *= bt_entry_size_bytes(mm); | |
716 | return offset; | |
717 | } | |
718 | ||
719 | /* | |
720 | * How much virtual address space does a single bounds | |
721 | * directory entry cover? | |
722 | * | |
723 | * Note, we need a long long because 4GB doesn't fit in | |
724 | * to a long on 32-bit. | |
725 | */ | |
726 | static inline unsigned long bd_entry_virt_space(struct mm_struct *mm) | |
727 | { | |
f3119b83 DH |
728 | unsigned long long virt_space; |
729 | unsigned long long GB = (1ULL << 30); | |
730 | ||
731 | /* | |
732 | * This covers 32-bit emulation as well as 32-bit kernels | |
6a6256f9 | 733 | * running on 64-bit hardware. |
f3119b83 DH |
734 | */ |
735 | if (!is_64bit_mm(mm)) | |
736 | return (4ULL * GB) / MPX_BD_NR_ENTRIES_32; | |
737 | ||
738 | /* | |
739 | * 'x86_virt_bits' returns what the hardware is capable | |
6a6256f9 | 740 | * of, and returns the full >32-bit address space when |
f3119b83 DH |
741 | * running 32-bit kernels on 64-bit hardware. |
742 | */ | |
743 | virt_space = (1ULL << boot_cpu_data.x86_virt_bits); | |
744 | return virt_space / MPX_BD_NR_ENTRIES_64; | |
613fcb7d DH |
745 | } |
746 | ||
747 | /* | |
3ceaccdf DH |
748 | * Free the backing physical pages of bounds table 'bt_addr'. |
749 | * Assume start...end is within that bounds table. | |
613fcb7d | 750 | */ |
3ceaccdf DH |
751 | static noinline int zap_bt_entries_mapping(struct mm_struct *mm, |
752 | unsigned long bt_addr, | |
753 | unsigned long start_mapping, unsigned long end_mapping) | |
754 | { | |
755 | struct vm_area_struct *vma; | |
756 | unsigned long addr, len; | |
757 | unsigned long start; | |
758 | unsigned long end; | |
759 | ||
760 | /* | |
761 | * if we 'end' on a boundary, the offset will be 0 which | |
762 | * is not what we want. Back it up a byte to get the | |
763 | * last bt entry. Then once we have the entry itself, | |
764 | * move 'end' back up by the table entry size. | |
765 | */ | |
766 | start = bt_addr + mpx_get_bt_entry_offset_bytes(mm, start_mapping); | |
767 | end = bt_addr + mpx_get_bt_entry_offset_bytes(mm, end_mapping - 1); | |
768 | /* | |
769 | * Move end back up by one entry. Among other things | |
770 | * this ensures that it remains page-aligned and does | |
771 | * not screw up zap_page_range() | |
772 | */ | |
773 | end += bt_entry_size_bytes(mm); | |
774 | ||
775 | /* | |
776 | * Find the first overlapping vma. If vma->vm_start > start, there | |
777 | * will be a hole in the bounds table. This -EINVAL return will | |
778 | * cause a SIGSEGV. | |
779 | */ | |
780 | vma = find_vma(mm, start); | |
781 | if (!vma || vma->vm_start > start) | |
782 | return -EINVAL; | |
783 | ||
784 | /* | |
785 | * A NUMA policy on a VM_MPX VMA could cause this bounds table to | |
786 | * be split. So we need to look across the entire 'start -> end' | |
787 | * range of this bounds table, find all of the VM_MPX VMAs, and | |
788 | * zap only those. | |
789 | */ | |
790 | addr = start; | |
791 | while (vma && vma->vm_start < end) { | |
792 | /* | |
793 | * We followed a bounds directory entry down | |
794 | * here. If we find a non-MPX VMA, that's bad, | |
795 | * so stop immediately and return an error. This | |
796 | * probably results in a SIGSEGV. | |
797 | */ | |
a8965276 | 798 | if (!(vma->vm_flags & VM_MPX)) |
3ceaccdf DH |
799 | return -EINVAL; |
800 | ||
801 | len = min(vma->vm_end, end) - addr; | |
ecf1385d | 802 | zap_page_range(vma, addr, len); |
3ceaccdf DH |
803 | trace_mpx_unmap_zap(addr, addr+len); |
804 | ||
805 | vma = vma->vm_next; | |
806 | addr = vma->vm_start; | |
807 | } | |
808 | return 0; | |
809 | } | |
810 | ||
613fcb7d DH |
811 | static unsigned long mpx_get_bd_entry_offset(struct mm_struct *mm, |
812 | unsigned long addr) | |
813 | { | |
814 | /* | |
815 | * There are several ways to derive the bd offsets. We | |
816 | * use the following approach here: | |
817 | * 1. We know the size of the virtual address space | |
818 | * 2. We know the number of entries in a bounds table | |
819 | * 3. We know that each entry covers a fixed amount of | |
820 | * virtual address space. | |
821 | * So, we can just divide the virtual address by the | |
822 | * virtual space used by one entry to determine which | |
823 | * entry "controls" the given virtual address. | |
824 | */ | |
825 | if (is_64bit_mm(mm)) { | |
826 | int bd_entry_size = 8; /* 64-bit pointer */ | |
827 | /* | |
828 | * Take the 64-bit addressing hole in to account. | |
829 | */ | |
830 | addr &= ((1UL << boot_cpu_data.x86_virt_bits) - 1); | |
831 | return (addr / bd_entry_virt_space(mm)) * bd_entry_size; | |
832 | } else { | |
833 | int bd_entry_size = 4; /* 32-bit pointer */ | |
834 | /* | |
835 | * 32-bit has no hole so this case needs no mask | |
836 | */ | |
837 | return (addr / bd_entry_virt_space(mm)) * bd_entry_size; | |
838 | } | |
839 | /* | |
840 | * The two return calls above are exact copies. If we | |
841 | * pull out a single copy and put it in here, gcc won't | |
842 | * realize that we're doing a power-of-2 divide and use | |
843 | * shifts. It uses a real divide. If we put them up | |
844 | * there, it manages to figure it out (gcc 4.8.3). | |
845 | */ | |
1de4fa14 DH |
846 | } |
847 | ||
3ceaccdf DH |
848 | static int unmap_entire_bt(struct mm_struct *mm, |
849 | long __user *bd_entry, unsigned long bt_addr) | |
1de4fa14 | 850 | { |
3ceaccdf DH |
851 | unsigned long expected_old_val = bt_addr | MPX_BD_ENTRY_VALID_FLAG; |
852 | unsigned long uninitialized_var(actual_old_val); | |
1de4fa14 DH |
853 | int ret; |
854 | ||
3ceaccdf DH |
855 | while (1) { |
856 | int need_write = 1; | |
857 | unsigned long cleared_bd_entry = 0; | |
858 | ||
859 | pagefault_disable(); | |
860 | ret = mpx_cmpxchg_bd_entry(mm, &actual_old_val, | |
861 | bd_entry, expected_old_val, cleared_bd_entry); | |
862 | pagefault_enable(); | |
863 | if (!ret) | |
864 | break; | |
865 | if (ret == -EFAULT) | |
866 | ret = mpx_resolve_fault(bd_entry, need_write); | |
867 | /* | |
868 | * If we could not resolve the fault, consider it | |
869 | * userspace's fault and error out. | |
870 | */ | |
871 | if (ret) | |
872 | return ret; | |
873 | } | |
1de4fa14 | 874 | /* |
3ceaccdf | 875 | * The cmpxchg was performed, check the results. |
1de4fa14 | 876 | */ |
3ceaccdf DH |
877 | if (actual_old_val != expected_old_val) { |
878 | /* | |
879 | * Someone else raced with us to unmap the table. | |
880 | * That is OK, since we were both trying to do | |
881 | * the same thing. Declare success. | |
882 | */ | |
883 | if (!actual_old_val) | |
884 | return 0; | |
885 | /* | |
886 | * Something messed with the bounds directory | |
887 | * entry. We hold mmap_sem for read or write | |
888 | * here, so it could not be a _new_ bounds table | |
889 | * that someone just allocated. Something is | |
890 | * wrong, so pass up the error and SIGSEGV. | |
891 | */ | |
892 | return -EINVAL; | |
893 | } | |
894 | /* | |
895 | * Note, we are likely being called under do_munmap() already. To | |
896 | * avoid recursion, do_munmap() will check whether it comes | |
897 | * from one bounds table through VM_MPX flag. | |
898 | */ | |
897ab3e0 | 899 | return do_munmap(mm, bt_addr, mpx_bt_size_bytes(mm), NULL); |
1de4fa14 DH |
900 | } |
901 | ||
3ceaccdf DH |
902 | static int try_unmap_single_bt(struct mm_struct *mm, |
903 | unsigned long start, unsigned long end) | |
1de4fa14 | 904 | { |
3ceaccdf DH |
905 | struct vm_area_struct *next; |
906 | struct vm_area_struct *prev; | |
907 | /* | |
908 | * "bta" == Bounds Table Area: the area controlled by the | |
909 | * bounds table that we are unmapping. | |
910 | */ | |
911 | unsigned long bta_start_vaddr = start & ~(bd_entry_virt_space(mm)-1); | |
912 | unsigned long bta_end_vaddr = bta_start_vaddr + bd_entry_virt_space(mm); | |
913 | unsigned long uninitialized_var(bt_addr); | |
914 | void __user *bde_vaddr; | |
1de4fa14 | 915 | int ret; |
bea03c50 DH |
916 | /* |
917 | * We already unlinked the VMAs from the mm's rbtree so 'start' | |
918 | * is guaranteed to be in a hole. This gets us the first VMA | |
919 | * before the hole in to 'prev' and the next VMA after the hole | |
920 | * in to 'next'. | |
921 | */ | |
922 | next = find_vma_prev(mm, start, &prev); | |
923 | /* | |
924 | * Do not count other MPX bounds table VMAs as neighbors. | |
925 | * Although theoretically possible, we do not allow bounds | |
926 | * tables for bounds tables so our heads do not explode. | |
927 | * If we count them as neighbors here, we may end up with | |
928 | * lots of tables even though we have no actual table | |
929 | * entries in use. | |
930 | */ | |
a8965276 | 931 | while (next && (next->vm_flags & VM_MPX)) |
bea03c50 | 932 | next = next->vm_next; |
a8965276 | 933 | while (prev && (prev->vm_flags & VM_MPX)) |
bea03c50 | 934 | prev = prev->vm_prev; |
1de4fa14 | 935 | /* |
3ceaccdf DH |
936 | * We know 'start' and 'end' lie within an area controlled |
937 | * by a single bounds table. See if there are any other | |
938 | * VMAs controlled by that bounds table. If there are not | |
939 | * then we can "expand" the are we are unmapping to possibly | |
940 | * cover the entire table. | |
1de4fa14 DH |
941 | */ |
942 | next = find_vma_prev(mm, start, &prev); | |
3ceaccdf DH |
943 | if ((!prev || prev->vm_end <= bta_start_vaddr) && |
944 | (!next || next->vm_start >= bta_end_vaddr)) { | |
945 | /* | |
946 | * No neighbor VMAs controlled by same bounds | |
947 | * table. Try to unmap the whole thing | |
948 | */ | |
949 | start = bta_start_vaddr; | |
950 | end = bta_end_vaddr; | |
1de4fa14 DH |
951 | } |
952 | ||
cb02de96 | 953 | bde_vaddr = mm->context.bd_addr + mpx_get_bd_entry_offset(mm, start); |
3ceaccdf | 954 | ret = get_bt_addr(mm, bde_vaddr, &bt_addr); |
1de4fa14 | 955 | /* |
3ceaccdf | 956 | * No bounds table there, so nothing to unmap. |
1de4fa14 | 957 | */ |
3ceaccdf DH |
958 | if (ret == -ENOENT) { |
959 | ret = 0; | |
960 | return 0; | |
961 | } | |
1de4fa14 DH |
962 | if (ret) |
963 | return ret; | |
3ceaccdf DH |
964 | /* |
965 | * We are unmapping an entire table. Either because the | |
966 | * unmap that started this whole process was large enough | |
967 | * to cover an entire table, or that the unmap was small | |
968 | * but was the area covered by a bounds table. | |
969 | */ | |
970 | if ((start == bta_start_vaddr) && | |
971 | (end == bta_end_vaddr)) | |
972 | return unmap_entire_bt(mm, bde_vaddr, bt_addr); | |
973 | return zap_bt_entries_mapping(mm, bt_addr, start, end); | |
1de4fa14 DH |
974 | } |
975 | ||
976 | static int mpx_unmap_tables(struct mm_struct *mm, | |
977 | unsigned long start, unsigned long end) | |
978 | { | |
3ceaccdf | 979 | unsigned long one_unmap_start; |
2a1dcb1f | 980 | trace_mpx_unmap_search(start, end); |
1de4fa14 | 981 | |
3ceaccdf DH |
982 | one_unmap_start = start; |
983 | while (one_unmap_start < end) { | |
984 | int ret; | |
985 | unsigned long next_unmap_start = ALIGN(one_unmap_start+1, | |
986 | bd_entry_virt_space(mm)); | |
987 | unsigned long one_unmap_end = end; | |
988 | /* | |
989 | * if the end is beyond the current bounds table, | |
990 | * move it back so we only deal with a single one | |
991 | * at a time | |
992 | */ | |
993 | if (one_unmap_end > next_unmap_start) | |
994 | one_unmap_end = next_unmap_start; | |
995 | ret = try_unmap_single_bt(mm, one_unmap_start, one_unmap_end); | |
1de4fa14 DH |
996 | if (ret) |
997 | return ret; | |
1de4fa14 | 998 | |
3ceaccdf DH |
999 | one_unmap_start = next_unmap_start; |
1000 | } | |
1de4fa14 DH |
1001 | return 0; |
1002 | } | |
1003 | ||
1004 | /* | |
1005 | * Free unused bounds tables covered in a virtual address region being | |
1006 | * munmap()ed. Assume end > start. | |
1007 | * | |
1008 | * This function will be called by do_munmap(), and the VMAs covering | |
1009 | * the virtual address region start...end have already been split if | |
1010 | * necessary, and the 'vma' is the first vma in this range (start -> end). | |
1011 | */ | |
1012 | void mpx_notify_unmap(struct mm_struct *mm, struct vm_area_struct *vma, | |
1013 | unsigned long start, unsigned long end) | |
1014 | { | |
1015 | int ret; | |
1016 | ||
1017 | /* | |
1018 | * Refuse to do anything unless userspace has asked | |
1019 | * the kernel to help manage the bounds tables, | |
1020 | */ | |
1021 | if (!kernel_managing_mpx_tables(current->mm)) | |
1022 | return; | |
1023 | /* | |
1024 | * This will look across the entire 'start -> end' range, | |
1025 | * and find all of the non-VM_MPX VMAs. | |
1026 | * | |
1027 | * To avoid recursion, if a VM_MPX vma is found in the range | |
1028 | * (start->end), we will not continue follow-up work. This | |
1029 | * recursion represents having bounds tables for bounds tables, | |
1030 | * which should not occur normally. Being strict about it here | |
1031 | * helps ensure that we do not have an exploitable stack overflow. | |
1032 | */ | |
1033 | do { | |
1034 | if (vma->vm_flags & VM_MPX) | |
1035 | return; | |
1036 | vma = vma->vm_next; | |
1037 | } while (vma && vma->vm_start < end); | |
1038 | ||
1039 | ret = mpx_unmap_tables(mm, start, end); | |
1040 | if (ret) | |
1041 | force_sig(SIGSEGV, current); | |
1042 | } | |
44b04912 KS |
1043 | |
1044 | /* MPX cannot handle addresses above 47 bits yet. */ | |
1045 | unsigned long mpx_unmapped_area_check(unsigned long addr, unsigned long len, | |
1046 | unsigned long flags) | |
1047 | { | |
1048 | if (!kernel_managing_mpx_tables(current->mm)) | |
1049 | return addr; | |
1050 | if (addr + len <= DEFAULT_MAP_WINDOW) | |
1051 | return addr; | |
1052 | if (flags & MAP_FIXED) | |
1053 | return -ENOMEM; | |
1054 | ||
1055 | /* | |
1056 | * Requested len is larger than the whole area we're allowed to map in. | |
1057 | * Resetting hinting address wouldn't do much good -- fail early. | |
1058 | */ | |
1059 | if (len > DEFAULT_MAP_WINDOW) | |
1060 | return -ENOMEM; | |
1061 | ||
1062 | /* Look for unmap area within DEFAULT_MAP_WINDOW */ | |
1063 | return 0; | |
1064 | } |