arch/i386/kernel/vm86.c

   1 /*
   2  *  linux/kernel/vm86.c
   3  *
   4  *  Copyright (C) 1994  Linus Torvalds
   5  */
   6 #include <linux/errno.h>
   7 #include <linux/sched.h>
   8 #include <linux/kernel.h>
   9 #include <linux/signal.h>
  10 #include <linux/string.h>
  11 #include <linux/ptrace.h>
  12 #include <linux/mm.h>
  13 #include <linux/smp.h>
  14 #include <linux/smp_lock.h>
  15
  16 #include <asm/uaccess.h>
  17 #include <asm/pgalloc.h>
  18 #include <asm/io.h>
  19
  20 /*
  21  * Known problems:
  22  *
  23  * Interrupt handling is not guaranteed:
  24  * - a real x86 will disable all interrupts for one instruction
  25  *   after a "mov ss,xx" to make stack handling atomic even without
  26  *   the 'lss' instruction. We can't guarantee this in v86 mode,
  27  *   as the next instruction might result in a page fault or similar.
  28  * - a real x86 will have interrupts disabled for one instruction
  29  *   past the 'sti' that enables them. We don't bother with all the
  30  *   details yet.
  31  *
  32  * Let's hope these problems do not actually matter for anything.
  33  */
  34
  35
  36 #define KVM86   ((struct kernel_vm86_struct *)regs)
  37 #define VMPI    KVM86->vm86plus
  38
  39
  40 /*
  41  * 8- and 16-bit register defines..
  42  */
  43 #define AL(regs)        (((unsigned char *)&((regs)->eax))[0])
  44 #define AH(regs)        (((unsigned char *)&((regs)->eax))[1])
  45 #define IP(regs)        (*(unsigned short *)&((regs)->eip))
  46 #define SP(regs)        (*(unsigned short *)&((regs)->esp))
  47
  48 /*
  49  * virtual flags (16 and 32-bit versions)
  50  */
  51 #define VFLAGS  (*(unsigned short *)&(current->thread.v86flags))
  52 #define VEFLAGS (current->thread.v86flags)
  53
  54 #define set_flags(X,new,mask) \
  55 ((X) = ((X) & ~(mask)) | ((new) & (mask)))
  56
  57 #define SAFE_MASK       (0xDD5)
  58 #define RETURN_MASK     (0xDFF)
  59
  60 #define VM86_REGS_PART2 orig_eax
  61 #define VM86_REGS_SIZE1 \
  62         ( (unsigned)( & (((struct kernel_vm86_regs *)0)->VM86_REGS_PART2) ) )
  63 #define VM86_REGS_SIZE2 (sizeof(struct kernel_vm86_regs) - VM86_REGS_SIZE1)
  64
  65 asmlinkage struct pt_regs * FASTCALL(save_v86_state(struct kernel_vm86_regs * regs));
  66 struct pt_regs * save_v86_state(struct kernel_vm86_regs * regs)
  67 {
  68         struct tss_struct *tss;
  69         struct pt_regs *ret;
  70         unsigned long tmp;
  71
  72         if (!current->thread.vm86_info) {
  73                 printk("no vm86_info: BAD\n");
  74                 do_exit(SIGSEGV);
  75         }
  76         set_flags(regs->eflags, VEFLAGS, VIF_MASK | current->thread.v86mask);
  77         tmp = copy_to_user(&current->thread.vm86_info->regs,regs, VM86_REGS_SIZE1);
  78         tmp += copy_to_user(&current->thread.vm86_info->regs.VM86_REGS_PART2,
  79                 &regs->VM86_REGS_PART2, VM86_REGS_SIZE2);
  80         tmp += put_user(current->thread.screen_bitmap,&current->thread.vm86_info->screen_bitmap);
  81         if (tmp) {
  82                 printk("vm86: could not access userspace vm86_info\n");
  83                 do_exit(SIGSEGV);
  84         }
  85         tss = init_tss + smp_processor_id();
  86         tss->esp0 = current->thread.esp0 = current->thread.saved_esp0;
  87         current->thread.saved_esp0 = 0;
  88         ret = KVM86->regs32;
  89         return ret;
  90 }
  91
  92 static void mark_screen_rdonly(struct task_struct * tsk)
  93 {
  94         pgd_t *pgd;
  95         pmd_t *pmd;
  96         pte_t *pte;
  97         int i;
  98
  99         pgd = pgd_offset(tsk->mm, 0xA0000);
 100         if (pgd_none(*pgd))
 101                 return;
 102         if (pgd_bad(*pgd)) {
 103                 pgd_ERROR(*pgd);
 104                 pgd_clear(pgd);
 105                 return;
 106         }
 107         pmd = pmd_offset(pgd, 0xA0000);
 108         if (pmd_none(*pmd))
 109                 return;
 110         if (pmd_bad(*pmd)) {
 111                 pmd_ERROR(*pmd);
 112                 pmd_clear(pmd);
 113                 return;
 114         }
 115         pte = pte_offset(pmd, 0xA0000);
 116         for (i = 0; i < 32; i++) {
 117                 if (pte_present(*pte))
 118                         set_pte(pte, pte_wrprotect(*pte));
 119                 pte++;
 120         }
 121         flush_tlb();
 122 }
 123
 124
 125
 126 static int do_vm86_irq_handling(int subfunction, int irqnumber);
 127 static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk);
 128
 129 asmlinkage int sys_vm86old(struct vm86_struct * v86)
 130 {
 131         struct kernel_vm86_struct info; /* declare this _on top_,
 132                                          * this avoids wasting of stack space.
 133                                          * This remains on the stack until we
 134                                          * return to 32 bit user space.
 135                                          */
 136         struct task_struct *tsk;
 137         int tmp, ret = -EPERM;
 138
 139         tsk = current;
 140         if (tsk->thread.saved_esp0)
 141                 goto out;
 142         tmp  = copy_from_user(&info, v86, VM86_REGS_SIZE1);
 143         tmp += copy_from_user(&info.regs.VM86_REGS_PART2, &v86->regs.VM86_REGS_PART2,
 144                 (long)&info.vm86plus - (long)&info.regs.VM86_REGS_PART2);
 145         ret = -EFAULT;
 146         if (tmp)
 147                 goto out;
 148         memset(&info.vm86plus, 0, (int)&info.regs32 - (int)&info.vm86plus);
 149         info.regs32 = (struct pt_regs *) &v86;
 150         tsk->thread.vm86_info = v86;
 151         do_sys_vm86(&info, tsk);
 152         ret = 0;        /* we never return here */
 153 out:
 154         return ret;
 155 }
 156
 157
 158 asmlinkage int sys_vm86(unsigned long subfunction, struct vm86plus_struct * v86)
 159 {
 160         struct kernel_vm86_struct info; /* declare this _on top_,
 161                                          * this avoids wasting of stack space.
 162                                          * This remains on the stack until we
 163                                          * return to 32 bit user space.
 164                                          */
 165         struct task_struct *tsk;
 166         int tmp, ret;
 167
 168         tsk = current;
 169         switch (subfunction) {
 170                 case VM86_REQUEST_IRQ:
 171                 case VM86_FREE_IRQ:
 172                 case VM86_GET_IRQ_BITS:
 173                 case VM86_GET_AND_RESET_IRQ:
 174                         ret = do_vm86_irq_handling(subfunction,(int)v86);
 175                         goto out;
 176                 case VM86_PLUS_INSTALL_CHECK:
 177                         /* NOTE: on old vm86 stuff this will return the error
 178                            from verify_area(), because the subfunction is
 179                            interpreted as (invalid) address to vm86_struct.
 180                            So the installation check works.
 181                          */
 182                         ret = 0;
 183                         goto out;
 184         }
 185
 186         /* we come here only for functions VM86_ENTER, VM86_ENTER_NO_BYPASS */
 187         ret = -EPERM;
 188         if (tsk->thread.saved_esp0)
 189                 goto out;
 190         tmp  = copy_from_user(&info, v86, VM86_REGS_SIZE1);
 191         tmp += copy_from_user(&info.regs.VM86_REGS_PART2, &v86->regs.VM86_REGS_PART2,
 192                 (long)&info.regs32 - (long)&info.regs.VM86_REGS_PART2);
 193         ret = -EFAULT;
 194         if (tmp)
 195                 goto out;
 196         info.regs32 = (struct pt_regs *) &subfunction;
 197         info.vm86plus.is_vm86pus = 1;
 198         tsk->thread.vm86_info = (struct vm86_struct *)v86;
 199         do_sys_vm86(&info, tsk);
 200         ret = 0;        /* we never return here */
 201 out:
 202         return ret;
 203 }
 204
 205
 206 static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk)
 207 {
 208         struct tss_struct *tss;
 209 /*
 210  * make sure the vm86() system call doesn't try to do anything silly
 211  */
 212         info->regs.__null_ds = 0;
 213         info->regs.__null_es = 0;
 214
 215 /* we are clearing fs,gs later just before "jmp ret_from_sys_call",
 216  * because starting with Linux 2.1.x they aren't no longer saved/restored
 217  */
 218
 219 /*
 220  * The eflags register is also special: we cannot trust that the user
 221  * has set it up safely, so this makes sure interrupt etc flags are
 222  * inherited from protected mode.
 223  */
 224         VEFLAGS = info->regs.eflags;
 225         info->regs.eflags &= SAFE_MASK;
 226         info->regs.eflags |= info->regs32->eflags & ~SAFE_MASK;
 227         info->regs.eflags |= VM_MASK;
 228
 229         switch (info->cpu_type) {
 230                 case CPU_286:
 231                         tsk->thread.v86mask = 0;
 232                         break;
 233                 case CPU_386:
 234                         tsk->thread.v86mask = NT_MASK | IOPL_MASK;
 235                         break;
 236                 case CPU_486:
 237                         tsk->thread.v86mask = AC_MASK | NT_MASK | IOPL_MASK;
 238                         break;
 239                 default:
 240                         tsk->thread.v86mask = ID_MASK | AC_MASK | NT_MASK | IOPL_MASK;
 241                         break;
 242         }
 243
 244 /*
 245  * Save old state, set default return value (%eax) to 0
 246  */
 247         info->regs32->eax = 0;
 248         tsk->thread.saved_esp0 = tsk->thread.esp0;
 249         tss = init_tss + smp_processor_id();
 250         tss->esp0 = tsk->thread.esp0 = (unsigned long) &info->VM86_TSS_ESP0;
 251
 252         tsk->thread.screen_bitmap = info->screen_bitmap;
 253         if (info->flags & VM86_SCREEN_BITMAP)
 254                 mark_screen_rdonly(tsk);
 255         __asm__ __volatile__(
 256                 "xorl %%eax,%%eax; movl %%eax,%%fs; movl %%eax,%%gs\n\t"
 257                 "movl %0,%%esp\n\t"
 258                 "jmp ret_from_sys_call"
 259                 : /* no outputs */
 260                 :"r" (&info->regs), "b" (tsk) : "ax");
 261         /* we never return here */
 262 }
 263
 264 static inline void return_to_32bit(struct kernel_vm86_regs * regs16, int retval)
 265 {
 266         struct pt_regs * regs32;
 267
 268         regs32 = save_v86_state(regs16);
 269         regs32->eax = retval;
 270         __asm__ __volatile__("movl %0,%%esp\n\t"
 271                 "jmp ret_from_sys_call"
 272                 : : "r" (regs32), "b" (current));
 273 }
 274
 275 static inline void set_IF(struct kernel_vm86_regs * regs)
 276 {
 277         VEFLAGS |= VIF_MASK;
 278         if (VEFLAGS & VIP_MASK)
 279                 return_to_32bit(regs, VM86_STI);
 280 }
 281
 282 static inline void clear_IF(struct kernel_vm86_regs * regs)
 283 {
 284         VEFLAGS &= ~VIF_MASK;
 285 }
 286
 287 static inline void clear_TF(struct kernel_vm86_regs * regs)
 288 {
 289         regs->eflags &= ~TF_MASK;
 290 }
 291
 292 static inline void set_vflags_long(unsigned long eflags, struct kernel_vm86_regs * regs)
 293 {
 294         set_flags(VEFLAGS, eflags, current->thread.v86mask);
 295         set_flags(regs->eflags, eflags, SAFE_MASK);
 296         if (eflags & IF_MASK)
 297                 set_IF(regs);
 298 }
 299
 300 static inline void set_vflags_short(unsigned short flags, struct kernel_vm86_regs * regs)
 301 {
 302         set_flags(VFLAGS, flags, current->thread.v86mask);
 303         set_flags(regs->eflags, flags, SAFE_MASK);
 304         if (flags & IF_MASK)
 305                 set_IF(regs);
 306 }
 307
 308 static inline unsigned long get_vflags(struct kernel_vm86_regs * regs)
 309 {
 310         unsigned long flags = regs->eflags & RETURN_MASK;
 311
 312         if (VEFLAGS & VIF_MASK)
 313                 flags |= IF_MASK;
 314         return flags | (VEFLAGS & current->thread.v86mask);
 315 }
 316
 317 static inline int is_revectored(int nr, struct revectored_struct * bitmap)
 318 {
 319         __asm__ __volatile__("btl %2,%1\n\tsbbl %0,%0"
 320                 :"=r" (nr)
 321                 :"m" (*bitmap),"r" (nr));
 322         return nr;
 323 }
 324
 325 /*
 326  * Boy are these ugly, but we need to do the correct 16-bit arithmetic.
 327  * Gcc makes a mess of it, so we do it inline and use non-obvious calling
 328  * conventions..
 329  */
 330 #define pushb(base, ptr, val) \
 331 __asm__ __volatile__( \
 332         "decw %w0\n\t" \
 333         "movb %2,0(%1,%0)" \
 334         : "=r" (ptr) \
 335         : "r" (base), "q" (val), "0" (ptr))
 336
 337 #define pushw(base, ptr, val) \
 338 __asm__ __volatile__( \
 339         "decw %w0\n\t" \
 340         "movb %h2,0(%1,%0)\n\t" \
 341         "decw %w0\n\t" \
 342         "movb %b2,0(%1,%0)" \
 343         : "=r" (ptr) \
 344         : "r" (base), "q" (val), "0" (ptr))
 345
 346 #define pushl(base, ptr, val) \
 347 __asm__ __volatile__( \
 348         "decw %w0\n\t" \
 349         "rorl $16,%2\n\t" \
 350         "movb %h2,0(%1,%0)\n\t" \
 351         "decw %w0\n\t" \
 352         "movb %b2,0(%1,%0)\n\t" \
 353         "decw %w0\n\t" \
 354         "rorl $16,%2\n\t" \
 355         "movb %h2,0(%1,%0)\n\t" \
 356         "decw %w0\n\t" \
 357         "movb %b2,0(%1,%0)" \
 358         : "=r" (ptr) \
 359         : "r" (base), "q" (val), "0" (ptr))
 360
 361 #define popb(base, ptr) \
 362 ({ unsigned long __res; \
 363 __asm__ __volatile__( \
 364         "movb 0(%1,%0),%b2\n\t" \
 365         "incw %w0" \
 366         : "=r" (ptr), "=r" (base), "=q" (__res) \
 367         : "0" (ptr), "1" (base), "2" (0)); \
 368 __res; })
 369
 370 #define popw(base, ptr) \
 371 ({ unsigned long __res; \
 372 __asm__ __volatile__( \
 373         "movb 0(%1,%0),%b2\n\t" \
 374         "incw %w0\n\t" \
 375         "movb 0(%1,%0),%h2\n\t" \
 376         "incw %w0" \
 377         : "=r" (ptr), "=r" (base), "=q" (__res) \
 378         : "0" (ptr), "1" (base), "2" (0)); \
 379 __res; })
 380
 381 #define popl(base, ptr) \
 382 ({ unsigned long __res; \
 383 __asm__ __volatile__( \
 384         "movb 0(%1,%0),%b2\n\t" \
 385         "incw %w0\n\t" \
 386         "movb 0(%1,%0),%h2\n\t" \
 387         "incw %w0\n\t" \
 388         "rorl $16,%2\n\t" \
 389         "movb 0(%1,%0),%b2\n\t" \
 390         "incw %w0\n\t" \
 391         "movb 0(%1,%0),%h2\n\t" \
 392         "incw %w0\n\t" \
 393         "rorl $16,%2" \
 394         : "=r" (ptr), "=r" (base), "=q" (__res) \
 395         : "0" (ptr), "1" (base)); \
 396 __res; })
 397
 398 static void do_int(struct kernel_vm86_regs *regs, int i, unsigned char * ssp, unsigned long sp)
 399 {
 400         unsigned long *intr_ptr, segoffs;
 401
 402         if (regs->cs == BIOSSEG)
 403                 goto cannot_handle;
 404         if (is_revectored(i, &KVM86->int_revectored))
 405                 goto cannot_handle;
 406         if (i==0x21 && is_revectored(AH(regs),&KVM86->int21_revectored))
 407                 goto cannot_handle;
 408         intr_ptr = (unsigned long *) (i << 2);
 409         if (get_user(segoffs, intr_ptr))
 410                 goto cannot_handle;
 411         if ((segoffs >> 16) == BIOSSEG)
 412                 goto cannot_handle;
 413         pushw(ssp, sp, get_vflags(regs));
 414         pushw(ssp, sp, regs->cs);
 415         pushw(ssp, sp, IP(regs));
 416         regs->cs = segoffs >> 16;
 417         SP(regs) -= 6;
 418         IP(regs) = segoffs & 0xffff;
 419         clear_TF(regs);
 420         clear_IF(regs);
 421         return;
 422
 423 cannot_handle:
 424         return_to_32bit(regs, VM86_INTx + (i << 8));
 425 }
 426
 427 int handle_vm86_trap(struct kernel_vm86_regs * regs, long error_code, int trapno)
 428 {
 429         if (VMPI.is_vm86pus) {
 430                 if ( (trapno==3) || (trapno==1) )
 431                         return_to_32bit(regs, VM86_TRAP + (trapno << 8));
 432                 do_int(regs, trapno, (unsigned char *) (regs->ss << 4), SP(regs));
 433                 return 0;
 434         }
 435         if (trapno !=1)
 436                 return 1; /* we let this handle by the calling routine */
 437         if (current->ptrace & PT_PTRACED) {
 438                 unsigned long flags;
 439                 spin_lock_irqsave(&current->sigmask_lock, flags);
 440                 sigdelset(&current->blocked, SIGTRAP);
 441                 recalc_sigpending(current);
 442                 spin_unlock_irqrestore(&current->sigmask_lock, flags);
 443         }
 444         send_sig(SIGTRAP, current, 1);
 445         current->thread.trap_no = trapno;
 446         current->thread.error_code = error_code;
 447         return 0;
 448 }
 449
 450 void handle_vm86_fault(struct kernel_vm86_regs * regs, long error_code)
 451 {
 452         unsigned char *csp, *ssp;
 453         unsigned long ip, sp;
 454
 455 #define CHECK_IF_IN_TRAP \
 456         if (VMPI.vm86dbg_active && VMPI.vm86dbg_TFpendig) \
 457                 pushw(ssp,sp,popw(ssp,sp) | TF_MASK);
 458 #define VM86_FAULT_RETURN \
 459         if (VMPI.force_return_for_pic  && (VEFLAGS & IF_MASK)) \
 460                 return_to_32bit(regs, VM86_PICRETURN); \
 461         return;
 462
 463         csp = (unsigned char *) (regs->cs << 4);
 464         ssp = (unsigned char *) (regs->ss << 4);
 465         sp = SP(regs);
 466         ip = IP(regs);
 467
 468         switch (popb(csp, ip)) {
 469
 470         /* operand size override */
 471         case 0x66:
 472                 switch (popb(csp, ip)) {
 473
 474                 /* pushfd */
 475                 case 0x9c:
 476                         SP(regs) -= 4;
 477                         IP(regs) += 2;
 478                         pushl(ssp, sp, get_vflags(regs));
 479                         VM86_FAULT_RETURN;
 480
 481                 /* popfd */
 482                 case 0x9d:
 483                         SP(regs) += 4;
 484                         IP(regs) += 2;
 485                         CHECK_IF_IN_TRAP
 486                         set_vflags_long(popl(ssp, sp), regs);
 487                         VM86_FAULT_RETURN;
 488
 489                 /* iretd */
 490                 case 0xcf:
 491                         SP(regs) += 12;
 492                         IP(regs) = (unsigned short)popl(ssp, sp);
 493                         regs->cs = (unsigned short)popl(ssp, sp);
 494                         CHECK_IF_IN_TRAP
 495                         set_vflags_long(popl(ssp, sp), regs);
 496                         VM86_FAULT_RETURN;
 497                 /* need this to avoid a fallthrough */
 498                 default:
 499                         return_to_32bit(regs, VM86_UNKNOWN);
 500                 }
 501
 502         /* pushf */
 503         case 0x9c:
 504                 SP(regs) -= 2;
 505                 IP(regs)++;
 506                 pushw(ssp, sp, get_vflags(regs));
 507                 VM86_FAULT_RETURN;
 508
 509         /* popf */
 510         case 0x9d:
 511                 SP(regs) += 2;
 512                 IP(regs)++;
 513                 CHECK_IF_IN_TRAP
 514                 set_vflags_short(popw(ssp, sp), regs);
 515                 VM86_FAULT_RETURN;
 516
 517         /* int xx */
 518         case 0xcd: {
 519                 int intno=popb(csp, ip);
 520                 IP(regs) += 2;
 521                 if (VMPI.vm86dbg_active) {
 522                         if ( (1 << (intno &7)) & VMPI.vm86dbg_intxxtab[intno >> 3] )
 523                                 return_to_32bit(regs, VM86_INTx + (intno << 8));
 524                 }
 525                 do_int(regs, intno, ssp, sp);
 526                 return;
 527         }
 528
 529         /* iret */
 530         case 0xcf:
 531                 SP(regs) += 6;
 532                 IP(regs) = popw(ssp, sp);
 533                 regs->cs = popw(ssp, sp);
 534                 CHECK_IF_IN_TRAP
 535                 set_vflags_short(popw(ssp, sp), regs);
 536                 VM86_FAULT_RETURN;
 537
 538         /* cli */
 539         case 0xfa:
 540                 IP(regs)++;
 541                 clear_IF(regs);
 542                 VM86_FAULT_RETURN;
 543
 544         /* sti */
 545         /*
 546          * Damn. This is incorrect: the 'sti' instruction should actually
 547          * enable interrupts after the /next/ instruction. Not good.
 548          *
 549          * Probably needs some horsing around with the TF flag. Aiee..
 550          */
 551         case 0xfb:
 552                 IP(regs)++;
 553                 set_IF(regs);
 554                 VM86_FAULT_RETURN;
 555
 556         default:
 557                 return_to_32bit(regs, VM86_UNKNOWN);
 558         }
 559 }
 560
 561 /* ---------------- vm86 special IRQ passing stuff ----------------- */
 562
 563 #define VM86_IRQNAME            "vm86irq"
 564
 565 static struct vm86_irqs {
 566         struct task_struct *tsk;
 567         int sig;
 568 } vm86_irqs[16];
 569 static int irqbits;
 570
 571 #define ALLOWED_SIGS ( 1 /* 0 = don't send a signal */ \
 572         | (1 << SIGUSR1) | (1 << SIGUSR2) | (1 << SIGIO)  | (1 << SIGURG) \
 573         | (1 << SIGUNUSED) )
 574
 575 static void irq_handler(int intno, void *dev_id, struct pt_regs * regs) {
 576         int irq_bit;
 577         unsigned long flags;
 578
 579         save_flags(flags);
 580         cli();
 581         irq_bit = 1 << intno;
 582         if ((irqbits & irq_bit) || ! vm86_irqs[intno].tsk)
 583                 goto out;
 584         irqbits |= irq_bit;
 585         if (vm86_irqs[intno].sig)
 586                 send_sig(vm86_irqs[intno].sig, vm86_irqs[intno].tsk, 1);
 587         /* else user will poll for IRQs */
 588 out:
 589         restore_flags(flags);
 590 }
 591
 592 static inline void free_vm86_irq(int irqnumber)
 593 {
 594         free_irq(irqnumber,0);
 595         vm86_irqs[irqnumber].tsk = 0;
 596         irqbits &= ~(1 << irqnumber);
 597 }
 598
 599 static inline int task_valid(struct task_struct *tsk)
 600 {
 601         struct task_struct *p;
 602         int ret = 0;
 603
 604         read_lock(&tasklist_lock);
 605         for_each_task(p) {
 606                 if ((p == tsk) && (p->sig)) {
 607                         ret = 1;
 608                         break;
 609                 }
 610         }
 611         read_unlock(&tasklist_lock);
 612         return ret;
 613 }
 614
 615 static inline void handle_irq_zombies(void)
 616 {
 617         int i;
 618         for (i=3; i<16; i++) {
 619                 if (vm86_irqs[i].tsk) {
 620                         if (task_valid(vm86_irqs[i].tsk)) continue;
 621                         free_vm86_irq(i);
 622                 }
 623         }
 624 }
 625
 626 static inline int get_and_reset_irq(int irqnumber)
 627 {
 628         int bit;
 629         unsigned long flags;
 630
 631         if ( (irqnumber<3) || (irqnumber>15) ) return 0;
 632         if (vm86_irqs[irqnumber].tsk != current) return 0;
 633         save_flags(flags);
 634         cli();
 635         bit = irqbits & (1 << irqnumber);
 636         irqbits &= ~bit;
 637         restore_flags(flags);
 638         return bit;
 639 }
 640
 641
 642 static int do_vm86_irq_handling(int subfunction, int irqnumber)
 643 {
 644         int ret;
 645         switch (subfunction) {
 646                 case VM86_GET_AND_RESET_IRQ: {
 647                         return get_and_reset_irq(irqnumber);
 648                 }
 649                 case VM86_GET_IRQ_BITS: {
 650                         return irqbits;
 651                 }
 652                 case VM86_REQUEST_IRQ: {
 653                         int sig = irqnumber >> 8;
 654                         int irq = irqnumber & 255;
 655                         handle_irq_zombies();
 656                         if (!capable(CAP_SYS_ADMIN)) return -EPERM;
 657                         if (!((1 << sig) & ALLOWED_SIGS)) return -EPERM;
 658                         if ( (irq<3) || (irq>15) ) return -EPERM;
 659                         if (vm86_irqs[irq].tsk) return -EPERM;
 660                         ret = request_irq(irq, &irq_handler, 0, VM86_IRQNAME, 0);
 661                         if (ret) return ret;
 662                         vm86_irqs[irq].sig = sig;
 663                         vm86_irqs[irq].tsk = current;
 664                         return irq;
 665                 }
 666                 case  VM86_FREE_IRQ: {
 667                         handle_irq_zombies();
 668                         if ( (irqnumber<3) || (irqnumber>15) ) return -EPERM;
 669                         if (!vm86_irqs[irqnumber].tsk) return 0;
 670                         if (vm86_irqs[irqnumber].tsk != current) return -EPERM;
 671                         free_vm86_irq(irqnumber);
 672                         return 0;
 673                 }
 674         }
 675         return -EINVAL;
 676 }
 677