Commit | Line | Data |
---|---|---|
1da177e4 | 1 | /* |
ba180fd4 | 2 | * Copyright (C) 2001 - 2007 Jeff Dike (jdike@{addtoit,linux.intel}.com) |
1da177e4 LT |
3 | * Licensed under the GPL |
4 | */ | |
5 | ||
8192ab42 JD |
6 | #include <linux/mm.h> |
7 | #include <linux/sched.h> | |
5a0e3ad6 | 8 | #include <linux/slab.h> |
8192ab42 | 9 | #include <asm/unistd.h> |
12919aa6 | 10 | #include "os.h" |
ba180fd4 | 11 | #include "proc_mm.h" |
858259cf BS |
12 | #include "skas.h" |
13 | #include "skas_ptrace.h" | |
ba180fd4 JD |
14 | #include "sysdep/tls.h" |
15 | ||
16 | extern int modify_ldt(int func, void *ptr, unsigned long bytecount); | |
858259cf | 17 | |
99764fa4 WC |
18 | static long write_ldt_entry(struct mm_id *mm_idp, int func, |
19 | struct user_desc *desc, void **addr, int done) | |
858259cf BS |
20 | { |
21 | long res; | |
22 | ||
ba180fd4 JD |
23 | if (proc_mm) { |
24 | /* | |
25 | * This is a special handling for the case, that the mm to | |
858259cf BS |
26 | * modify isn't current->active_mm. |
27 | * If this is called directly by modify_ldt, | |
28 | * (current->active_mm->context.skas.u == mm_idp) | |
77bf4400 | 29 | * will be true. So no call to __switch_mm(mm_idp) is done. |
858259cf BS |
30 | * If this is called in case of init_new_ldt or PTRACE_LDT, |
31 | * mm_idp won't belong to current->active_mm, but child->mm. | |
32 | * So we need to switch child's mm into our userspace, then | |
33 | * later switch back. | |
34 | * | |
07f4e2c6 | 35 | * Note: I'm unsure: should interrupts be disabled here? |
858259cf | 36 | */ |
ba180fd4 | 37 | if (!current->active_mm || current->active_mm == &init_mm || |
6c738ffa | 38 | mm_idp != ¤t->active_mm->context.id) |
77bf4400 | 39 | __switch_mm(mm_idp); |
858259cf BS |
40 | } |
41 | ||
ba180fd4 | 42 | if (ptrace_ldt) { |
858259cf BS |
43 | struct ptrace_ldt ldt_op = (struct ptrace_ldt) { |
44 | .func = func, | |
45 | .ptr = desc, | |
46 | .bytecount = sizeof(*desc)}; | |
47 | u32 cpu; | |
48 | int pid; | |
49 | ||
ba180fd4 | 50 | if (!proc_mm) |
858259cf BS |
51 | pid = mm_idp->u.pid; |
52 | else { | |
53 | cpu = get_cpu(); | |
54 | pid = userspace_pid[cpu]; | |
55 | } | |
56 | ||
07f4e2c6 | 57 | res = os_ptrace_ldt(pid, 0, (unsigned long) &ldt_op); |
858259cf | 58 | |
ba180fd4 | 59 | if (proc_mm) |
858259cf BS |
60 | put_cpu(); |
61 | } | |
62 | else { | |
63 | void *stub_addr; | |
64 | res = syscall_stub_data(mm_idp, (unsigned long *)desc, | |
65 | (sizeof(*desc) + sizeof(long) - 1) & | |
66 | ~(sizeof(long) - 1), | |
67 | addr, &stub_addr); | |
ba180fd4 | 68 | if (!res) { |
858259cf BS |
69 | unsigned long args[] = { func, |
70 | (unsigned long)stub_addr, | |
71 | sizeof(*desc), | |
72 | 0, 0, 0 }; | |
73 | res = run_syscall_stub(mm_idp, __NR_modify_ldt, args, | |
74 | 0, addr, done); | |
75 | } | |
76 | } | |
77 | ||
ba180fd4 JD |
78 | if (proc_mm) { |
79 | /* | |
80 | * This is the second part of special handling, that makes | |
858259cf BS |
81 | * PTRACE_LDT possible to implement. |
82 | */ | |
ba180fd4 | 83 | if (current->active_mm && current->active_mm != &init_mm && |
6c738ffa JD |
84 | mm_idp != ¤t->active_mm->context.id) |
85 | __switch_mm(¤t->active_mm->context.id); | |
858259cf BS |
86 | } |
87 | ||
88 | return res; | |
89 | } | |
90 | ||
91 | static long read_ldt_from_host(void __user * ptr, unsigned long bytecount) | |
92 | { | |
93 | int res, n; | |
94 | struct ptrace_ldt ptrace_ldt = (struct ptrace_ldt) { | |
95 | .func = 0, | |
96 | .bytecount = bytecount, | |
5cbded58 | 97 | .ptr = kmalloc(bytecount, GFP_KERNEL)}; |
858259cf BS |
98 | u32 cpu; |
99 | ||
ba180fd4 | 100 | if (ptrace_ldt.ptr == NULL) |
858259cf BS |
101 | return -ENOMEM; |
102 | ||
ba180fd4 JD |
103 | /* |
104 | * This is called from sys_modify_ldt only, so userspace_pid gives | |
858259cf BS |
105 | * us the right number |
106 | */ | |
107 | ||
108 | cpu = get_cpu(); | |
07f4e2c6 | 109 | res = os_ptrace_ldt(userspace_pid[cpu], 0, (unsigned long) &ptrace_ldt); |
858259cf | 110 | put_cpu(); |
ba180fd4 | 111 | if (res < 0) |
858259cf BS |
112 | goto out; |
113 | ||
114 | n = copy_to_user(ptr, ptrace_ldt.ptr, res); | |
ba180fd4 | 115 | if (n != 0) |
858259cf BS |
116 | res = -EFAULT; |
117 | ||
118 | out: | |
119 | kfree(ptrace_ldt.ptr); | |
120 | ||
121 | return res; | |
122 | } | |
123 | ||
124 | /* | |
125 | * In skas mode, we hold our own ldt data in UML. | |
126 | * Thus, the code implementing sys_modify_ldt_skas | |
127 | * is very similar to (and mostly stolen from) sys_modify_ldt | |
128 | * for arch/i386/kernel/ldt.c | |
129 | * The routines copied and modified in part are: | |
130 | * - read_ldt | |
131 | * - read_default_ldt | |
132 | * - write_ldt | |
133 | * - sys_modify_ldt_skas | |
134 | */ | |
135 | ||
136 | static int read_ldt(void __user * ptr, unsigned long bytecount) | |
137 | { | |
138 | int i, err = 0; | |
139 | unsigned long size; | |
b3ee571e | 140 | uml_ldt_t *ldt = ¤t->mm->context.arch.ldt; |
858259cf | 141 | |
ba180fd4 | 142 | if (!ldt->entry_count) |
858259cf | 143 | goto out; |
ba180fd4 | 144 | if (bytecount > LDT_ENTRY_SIZE*LDT_ENTRIES) |
858259cf BS |
145 | bytecount = LDT_ENTRY_SIZE*LDT_ENTRIES; |
146 | err = bytecount; | |
147 | ||
ba180fd4 | 148 | if (ptrace_ldt) |
858259cf | 149 | return read_ldt_from_host(ptr, bytecount); |
858259cf | 150 | |
01ac835f | 151 | mutex_lock(&ldt->lock); |
ba180fd4 | 152 | if (ldt->entry_count <= LDT_DIRECT_ENTRIES) { |
858259cf | 153 | size = LDT_ENTRY_SIZE*LDT_DIRECT_ENTRIES; |
ba180fd4 | 154 | if (size > bytecount) |
858259cf | 155 | size = bytecount; |
ba180fd4 | 156 | if (copy_to_user(ptr, ldt->u.entries, size)) |
858259cf BS |
157 | err = -EFAULT; |
158 | bytecount -= size; | |
159 | ptr += size; | |
160 | } | |
161 | else { | |
ba180fd4 JD |
162 | for (i=0; i<ldt->entry_count/LDT_ENTRIES_PER_PAGE && bytecount; |
163 | i++) { | |
858259cf | 164 | size = PAGE_SIZE; |
ba180fd4 | 165 | if (size > bytecount) |
858259cf | 166 | size = bytecount; |
ba180fd4 | 167 | if (copy_to_user(ptr, ldt->u.pages[i], size)) { |
858259cf BS |
168 | err = -EFAULT; |
169 | break; | |
170 | } | |
171 | bytecount -= size; | |
172 | ptr += size; | |
173 | } | |
174 | } | |
01ac835f | 175 | mutex_unlock(&ldt->lock); |
858259cf | 176 | |
ba180fd4 | 177 | if (bytecount == 0 || err == -EFAULT) |
858259cf BS |
178 | goto out; |
179 | ||
ba180fd4 | 180 | if (clear_user(ptr, bytecount)) |
858259cf BS |
181 | err = -EFAULT; |
182 | ||
183 | out: | |
184 | return err; | |
185 | } | |
186 | ||
187 | static int read_default_ldt(void __user * ptr, unsigned long bytecount) | |
188 | { | |
189 | int err; | |
190 | ||
ba180fd4 | 191 | if (bytecount > 5*LDT_ENTRY_SIZE) |
858259cf BS |
192 | bytecount = 5*LDT_ENTRY_SIZE; |
193 | ||
194 | err = bytecount; | |
ba180fd4 JD |
195 | /* |
196 | * UML doesn't support lcall7 and lcall27. | |
858259cf BS |
197 | * So, we don't really have a default ldt, but emulate |
198 | * an empty ldt of common host default ldt size. | |
199 | */ | |
ba180fd4 | 200 | if (clear_user(ptr, bytecount)) |
858259cf BS |
201 | err = -EFAULT; |
202 | ||
203 | return err; | |
204 | } | |
205 | ||
206 | static int write_ldt(void __user * ptr, unsigned long bytecount, int func) | |
207 | { | |
b3ee571e | 208 | uml_ldt_t *ldt = ¤t->mm->context.arch.ldt; |
6c738ffa | 209 | struct mm_id * mm_idp = ¤t->mm->context.id; |
858259cf BS |
210 | int i, err; |
211 | struct user_desc ldt_info; | |
212 | struct ldt_entry entry0, *ldt_p; | |
213 | void *addr = NULL; | |
214 | ||
215 | err = -EINVAL; | |
ba180fd4 | 216 | if (bytecount != sizeof(ldt_info)) |
858259cf BS |
217 | goto out; |
218 | err = -EFAULT; | |
ba180fd4 | 219 | if (copy_from_user(&ldt_info, ptr, sizeof(ldt_info))) |
858259cf BS |
220 | goto out; |
221 | ||
222 | err = -EINVAL; | |
ba180fd4 | 223 | if (ldt_info.entry_number >= LDT_ENTRIES) |
858259cf | 224 | goto out; |
ba180fd4 | 225 | if (ldt_info.contents == 3) { |
858259cf BS |
226 | if (func == 1) |
227 | goto out; | |
228 | if (ldt_info.seg_not_present == 0) | |
229 | goto out; | |
230 | } | |
231 | ||
ba180fd4 | 232 | if (!ptrace_ldt) |
01ac835f | 233 | mutex_lock(&ldt->lock); |
858259cf BS |
234 | |
235 | err = write_ldt_entry(mm_idp, func, &ldt_info, &addr, 1); | |
ba180fd4 | 236 | if (err) |
858259cf | 237 | goto out_unlock; |
ba180fd4 JD |
238 | else if (ptrace_ldt) { |
239 | /* With PTRACE_LDT available, this is used as a flag only */ | |
240 | ldt->entry_count = 1; | |
241 | goto out; | |
242 | } | |
243 | ||
244 | if (ldt_info.entry_number >= ldt->entry_count && | |
245 | ldt_info.entry_number >= LDT_DIRECT_ENTRIES) { | |
246 | for (i=ldt->entry_count/LDT_ENTRIES_PER_PAGE; | |
247 | i*LDT_ENTRIES_PER_PAGE <= ldt_info.entry_number; | |
248 | i++) { | |
249 | if (i == 0) | |
e23181de JD |
250 | memcpy(&entry0, ldt->u.entries, |
251 | sizeof(entry0)); | |
252 | ldt->u.pages[i] = (struct ldt_entry *) | |
253 | __get_free_page(GFP_KERNEL|__GFP_ZERO); | |
ba180fd4 | 254 | if (!ldt->u.pages[i]) { |
858259cf BS |
255 | err = -ENOMEM; |
256 | /* Undo the change in host */ | |
257 | memset(&ldt_info, 0, sizeof(ldt_info)); | |
258 | write_ldt_entry(mm_idp, 1, &ldt_info, &addr, 1); | |
259 | goto out_unlock; | |
260 | } | |
ba180fd4 | 261 | if (i == 0) { |
e23181de JD |
262 | memcpy(ldt->u.pages[0], &entry0, |
263 | sizeof(entry0)); | |
264 | memcpy(ldt->u.pages[0]+1, ldt->u.entries+1, | |
858259cf BS |
265 | sizeof(entry0)*(LDT_DIRECT_ENTRIES-1)); |
266 | } | |
267 | ldt->entry_count = (i + 1) * LDT_ENTRIES_PER_PAGE; | |
268 | } | |
269 | } | |
ba180fd4 | 270 | if (ldt->entry_count <= ldt_info.entry_number) |
858259cf BS |
271 | ldt->entry_count = ldt_info.entry_number + 1; |
272 | ||
ba180fd4 | 273 | if (ldt->entry_count <= LDT_DIRECT_ENTRIES) |
e23181de | 274 | ldt_p = ldt->u.entries + ldt_info.entry_number; |
858259cf | 275 | else |
e23181de | 276 | ldt_p = ldt->u.pages[ldt_info.entry_number/LDT_ENTRIES_PER_PAGE] + |
858259cf BS |
277 | ldt_info.entry_number%LDT_ENTRIES_PER_PAGE; |
278 | ||
ba180fd4 JD |
279 | if (ldt_info.base_addr == 0 && ldt_info.limit == 0 && |
280 | (func == 1 || LDT_empty(&ldt_info))) { | |
858259cf BS |
281 | ldt_p->a = 0; |
282 | ldt_p->b = 0; | |
283 | } | |
284 | else{ | |
285 | if (func == 1) | |
286 | ldt_info.useable = 0; | |
287 | ldt_p->a = LDT_entry_a(&ldt_info); | |
288 | ldt_p->b = LDT_entry_b(&ldt_info); | |
289 | } | |
290 | err = 0; | |
291 | ||
292 | out_unlock: | |
01ac835f | 293 | mutex_unlock(&ldt->lock); |
858259cf BS |
294 | out: |
295 | return err; | |
296 | } | |
297 | ||
298 | static long do_modify_ldt_skas(int func, void __user *ptr, | |
299 | unsigned long bytecount) | |
300 | { | |
301 | int ret = -ENOSYS; | |
302 | ||
303 | switch (func) { | |
304 | case 0: | |
305 | ret = read_ldt(ptr, bytecount); | |
306 | break; | |
307 | case 1: | |
308 | case 0x11: | |
309 | ret = write_ldt(ptr, bytecount, func); | |
310 | break; | |
311 | case 2: | |
312 | ret = read_default_ldt(ptr, bytecount); | |
313 | break; | |
314 | } | |
315 | return ret; | |
316 | } | |
317 | ||
af727902 JD |
318 | static DEFINE_SPINLOCK(host_ldt_lock); |
319 | static short dummy_list[9] = {0, -1}; | |
320 | static short * host_ldt_entries = NULL; | |
858259cf | 321 | |
af727902 | 322 | static void ldt_get_host_info(void) |
858259cf BS |
323 | { |
324 | long ret; | |
622e6969 JD |
325 | struct ldt_entry * ldt; |
326 | short *tmp; | |
858259cf BS |
327 | int i, size, k, order; |
328 | ||
af727902 JD |
329 | spin_lock(&host_ldt_lock); |
330 | ||
ba180fd4 | 331 | if (host_ldt_entries != NULL) { |
af727902 JD |
332 | spin_unlock(&host_ldt_lock); |
333 | return; | |
334 | } | |
858259cf BS |
335 | host_ldt_entries = dummy_list+1; |
336 | ||
af727902 JD |
337 | spin_unlock(&host_ldt_lock); |
338 | ||
ba180fd4 JD |
339 | for (i = LDT_PAGES_MAX-1, order=0; i; i>>=1, order++) |
340 | ; | |
858259cf BS |
341 | |
342 | ldt = (struct ldt_entry *) | |
343 | __get_free_pages(GFP_KERNEL|__GFP_ZERO, order); | |
ba180fd4 JD |
344 | if (ldt == NULL) { |
345 | printk(KERN_ERR "ldt_get_host_info: couldn't allocate buffer " | |
346 | "for host ldt\n"); | |
858259cf BS |
347 | return; |
348 | } | |
349 | ||
350 | ret = modify_ldt(0, ldt, (1<<order)*PAGE_SIZE); | |
ba180fd4 JD |
351 | if (ret < 0) { |
352 | printk(KERN_ERR "ldt_get_host_info: couldn't read host ldt\n"); | |
858259cf BS |
353 | goto out_free; |
354 | } | |
ba180fd4 | 355 | if (ret == 0) { |
858259cf BS |
356 | /* default_ldt is active, simply write an empty entry 0 */ |
357 | host_ldt_entries = dummy_list; | |
358 | goto out_free; | |
359 | } | |
360 | ||
ba180fd4 JD |
361 | for (i=0, size=0; i<ret/LDT_ENTRY_SIZE; i++) { |
362 | if (ldt[i].a != 0 || ldt[i].b != 0) | |
858259cf BS |
363 | size++; |
364 | } | |
365 | ||
ba180fd4 | 366 | if (size < ARRAY_SIZE(dummy_list)) |
858259cf | 367 | host_ldt_entries = dummy_list; |
858259cf BS |
368 | else { |
369 | size = (size + 1) * sizeof(dummy_list[0]); | |
af727902 | 370 | tmp = kmalloc(size, GFP_KERNEL); |
ba180fd4 JD |
371 | if (tmp == NULL) { |
372 | printk(KERN_ERR "ldt_get_host_info: couldn't allocate " | |
373 | "host ldt list\n"); | |
858259cf BS |
374 | goto out_free; |
375 | } | |
af727902 | 376 | host_ldt_entries = tmp; |
858259cf BS |
377 | } |
378 | ||
ba180fd4 JD |
379 | for (i=0, k=0; i<ret/LDT_ENTRY_SIZE; i++) { |
380 | if (ldt[i].a != 0 || ldt[i].b != 0) | |
858259cf | 381 | host_ldt_entries[k++] = i; |
858259cf BS |
382 | } |
383 | host_ldt_entries[k] = -1; | |
384 | ||
385 | out_free: | |
386 | free_pages((unsigned long)ldt, order); | |
387 | } | |
388 | ||
6c738ffa | 389 | long init_new_ldt(struct mm_context *new_mm, struct mm_context *from_mm) |
858259cf BS |
390 | { |
391 | struct user_desc desc; | |
392 | short * num_p; | |
393 | int i; | |
394 | long page, err=0; | |
395 | void *addr = NULL; | |
12919aa6 | 396 | struct proc_mm_op copy; |
858259cf | 397 | |
858259cf | 398 | |
ba180fd4 | 399 | if (!ptrace_ldt) |
b3ee571e | 400 | mutex_init(&new_mm->arch.ldt.lock); |
858259cf | 401 | |
ba180fd4 | 402 | if (!from_mm) { |
12919aa6 | 403 | memset(&desc, 0, sizeof(desc)); |
858259cf BS |
404 | /* |
405 | * We have to initialize a clean ldt. | |
406 | */ | |
ba180fd4 | 407 | if (proc_mm) { |
858259cf BS |
408 | /* |
409 | * If the new mm was created using proc_mm, host's | |
410 | * default-ldt currently is assigned, which normally | |
411 | * contains the call-gates for lcall7 and lcall27. | |
412 | * To remove these gates, we simply write an empty | |
413 | * entry as number 0 to the host. | |
414 | */ | |
ba180fd4 | 415 | err = write_ldt_entry(&new_mm->id, 1, &desc, &addr, 1); |
858259cf BS |
416 | } |
417 | else{ | |
418 | /* | |
419 | * Now we try to retrieve info about the ldt, we | |
420 | * inherited from the host. All ldt-entries found | |
421 | * will be reset in the following loop | |
422 | */ | |
af727902 | 423 | ldt_get_host_info(); |
ba180fd4 | 424 | for (num_p=host_ldt_entries; *num_p != -1; num_p++) { |
858259cf BS |
425 | desc.entry_number = *num_p; |
426 | err = write_ldt_entry(&new_mm->id, 1, &desc, | |
427 | &addr, *(num_p + 1) == -1); | |
ba180fd4 | 428 | if (err) |
858259cf BS |
429 | break; |
430 | } | |
431 | } | |
b3ee571e | 432 | new_mm->arch.ldt.entry_count = 0; |
12919aa6 BS |
433 | |
434 | goto out; | |
858259cf | 435 | } |
12919aa6 | 436 | |
ba180fd4 JD |
437 | if (proc_mm) { |
438 | /* | |
439 | * We have a valid from_mm, so we now have to copy the LDT of | |
12919aa6 BS |
440 | * from_mm to new_mm, because using proc_mm an new mm with |
441 | * an empty/default LDT was created in new_mm() | |
442 | */ | |
443 | copy = ((struct proc_mm_op) { .op = MM_COPY_SEGMENTS, | |
444 | .u = | |
445 | { .copy_segments = | |
446 | from_mm->id.u.mm_fd } } ); | |
a6ea4cce | 447 | i = os_write_file(new_mm->id.u.mm_fd, ©, sizeof(copy)); |
ba180fd4 JD |
448 | if (i != sizeof(copy)) |
449 | printk(KERN_ERR "new_mm : /proc/mm copy_segments " | |
450 | "failed, err = %d\n", -i); | |
12919aa6 BS |
451 | } |
452 | ||
ba180fd4 JD |
453 | if (!ptrace_ldt) { |
454 | /* | |
455 | * Our local LDT is used to supply the data for | |
858259cf BS |
456 | * modify_ldt(READLDT), if PTRACE_LDT isn't available, |
457 | * i.e., we have to use the stub for modify_ldt, which | |
458 | * can't handle the big read buffer of up to 64kB. | |
459 | */ | |
b3ee571e AV |
460 | mutex_lock(&from_mm->arch.ldt.lock); |
461 | if (from_mm->arch.ldt.entry_count <= LDT_DIRECT_ENTRIES) | |
462 | memcpy(new_mm->arch.ldt.u.entries, from_mm->arch.ldt.u.entries, | |
463 | sizeof(new_mm->arch.ldt.u.entries)); | |
ba180fd4 | 464 | else { |
b3ee571e | 465 | i = from_mm->arch.ldt.entry_count / LDT_ENTRIES_PER_PAGE; |
ba180fd4 | 466 | while (i-->0) { |
858259cf | 467 | page = __get_free_page(GFP_KERNEL|__GFP_ZERO); |
ba180fd4 | 468 | if (!page) { |
858259cf BS |
469 | err = -ENOMEM; |
470 | break; | |
471 | } | |
b3ee571e | 472 | new_mm->arch.ldt.u.pages[i] = |
e23181de | 473 | (struct ldt_entry *) page; |
b3ee571e AV |
474 | memcpy(new_mm->arch.ldt.u.pages[i], |
475 | from_mm->arch.ldt.u.pages[i], PAGE_SIZE); | |
858259cf BS |
476 | } |
477 | } | |
b3ee571e AV |
478 | new_mm->arch.ldt.entry_count = from_mm->arch.ldt.entry_count; |
479 | mutex_unlock(&from_mm->arch.ldt.lock); | |
858259cf BS |
480 | } |
481 | ||
12919aa6 | 482 | out: |
858259cf BS |
483 | return err; |
484 | } | |
485 | ||
486 | ||
6c738ffa | 487 | void free_ldt(struct mm_context *mm) |
858259cf BS |
488 | { |
489 | int i; | |
490 | ||
b3ee571e AV |
491 | if (!ptrace_ldt && mm->arch.ldt.entry_count > LDT_DIRECT_ENTRIES) { |
492 | i = mm->arch.ldt.entry_count / LDT_ENTRIES_PER_PAGE; | |
ba180fd4 | 493 | while (i-- > 0) |
b3ee571e | 494 | free_page((long) mm->arch.ldt.u.pages[i]); |
858259cf | 495 | } |
b3ee571e | 496 | mm->arch.ldt.entry_count = 0; |
858259cf | 497 | } |
858259cf BS |
498 | |
499 | int sys_modify_ldt(int func, void __user *ptr, unsigned long bytecount) | |
500 | { | |
6aa802ce | 501 | return do_modify_ldt_skas(func, ptr, bytecount); |
858259cf | 502 | } |