arch/i386/kernel/vm86.c

   1 /*
   2  *  linux/kernel/vm86.c
   3  *
   4  *  Copyright (C) 1994  Linus Torvalds
   5  */
   6 #include <linux/errno.h>
   7 #include <linux/sched.h>
   8 #include <linux/kernel.h>
   9 #include <linux/signal.h>
  10 #include <linux/string.h>
  11 #include <linux/ptrace.h>
  12 #include <linux/mm.h>
  13 #include <linux/smp.h>
  14 #include <linux/smp_lock.h>
  15
  16 #include <asm/uaccess.h>
  17 #include <asm/pgtable.h>
  18 #include <asm/io.h>
  19
  20 /*
  21  * Known problems:
  22  *
  23  * Interrupt handling is not guaranteed:
  24  * - a real x86 will disable all interrupts for one instruction
  25  *   after a "mov ss,xx" to make stack handling atomic even without
  26  *   the 'lss' instruction. We can't guarantee this in v86 mode,
  27  *   as the next instruction might result in a page fault or similar.
  28  * - a real x86 will have interrupts disabled for one instruction
  29  *   past the 'sti' that enables them. We don't bother with all the
  30  *   details yet.
  31  *
  32  * Let's hope these problems do not actually matter for anything.
  33  */
  34
  35
  36 #define KVM86   ((struct kernel_vm86_struct *)regs)
  37 #define VMPI    KVM86->vm86plus
  38
  39
  40 /*
  41  * 8- and 16-bit register defines..
  42  */
  43 #define AL(regs)        (((unsigned char *)&((regs)->eax))[0])
  44 #define AH(regs)        (((unsigned char *)&((regs)->eax))[1])
  45 #define IP(regs)        (*(unsigned short *)&((regs)->eip))
  46 #define SP(regs)        (*(unsigned short *)&((regs)->esp))
  47
  48 /*
  49  * virtual flags (16 and 32-bit versions)
  50  */
  51 #define VFLAGS  (*(unsigned short *)&(current->thread.v86flags))
  52 #define VEFLAGS (current->thread.v86flags)
  53
  54 #define set_flags(X,new,mask) \
  55 ((X) = ((X) & ~(mask)) | ((new) & (mask)))
  56
  57 #define SAFE_MASK       (0xDD5)
  58 #define RETURN_MASK     (0xDFF)
  59
  60 #define VM86_REGS_PART2 orig_eax
  61 #define VM86_REGS_SIZE1 \
  62         ( (unsigned)( & (((struct kernel_vm86_regs *)0)->VM86_REGS_PART2) ) )
  63 #define VM86_REGS_SIZE2 (sizeof(struct kernel_vm86_regs) - VM86_REGS_SIZE1)
  64
  65 asmlinkage struct pt_regs * FASTCALL(save_v86_state(struct kernel_vm86_regs * regs));
  66 struct pt_regs * save_v86_state(struct kernel_vm86_regs * regs)
  67 {
  68         struct tss_struct *tss;
  69         struct pt_regs *ret;
  70         unsigned long tmp;
  71
  72         lock_kernel();
  73         if (!current->thread.vm86_info) {
  74                 printk("no vm86_info: BAD\n");
  75                 do_exit(SIGSEGV);
  76         }
  77         set_flags(regs->eflags, VEFLAGS, VIF_MASK | current->thread.v86mask);
  78         tmp = copy_to_user(&current->thread.vm86_info->regs,regs, VM86_REGS_SIZE1);
  79         tmp += copy_to_user(&current->thread.vm86_info->regs.VM86_REGS_PART2,
  80                 &regs->VM86_REGS_PART2, VM86_REGS_SIZE2);
  81         tmp += put_user(current->thread.screen_bitmap,&current->thread.vm86_info->screen_bitmap);
  82         if (tmp) {
  83                 printk("vm86: could not access userspace vm86_info\n");
  84                 do_exit(SIGSEGV);
  85         }
  86         tss = init_tss + smp_processor_id();
  87         tss->esp0 = current->thread.esp0 = current->thread.saved_esp0;
  88         current->thread.saved_esp0 = 0;
  89         ret = KVM86->regs32;
  90         unlock_kernel();
  91         return ret;
  92 }
  93
  94 static void mark_screen_rdonly(struct task_struct * tsk)
  95 {
  96         pgd_t *pgd;
  97         pmd_t *pmd;
  98         pte_t *pte;
  99         int i;
 100
 101         pgd = pgd_offset(tsk->mm, 0xA0000);
 102         if (pgd_none(*pgd))
 103                 return;
 104         if (pgd_bad(*pgd)) {
 105                 printk("vm86: bad pgd entry [%p]:%08lx\n", pgd, pgd_val(*pgd));
 106                 pgd_clear(pgd);
 107                 return;
 108         }
 109         pmd = pmd_offset(pgd, 0xA0000);
 110         if (pmd_none(*pmd))
 111                 return;
 112         if (pmd_bad(*pmd)) {
 113                 printk("vm86: bad pmd entry [%p]:%08lx\n", pmd, pmd_val(*pmd));
 114                 pmd_clear(pmd);
 115                 return;
 116         }
 117         pte = pte_offset(pmd, 0xA0000);
 118         for (i = 0; i < 32; i++) {
 119                 if (pte_present(*pte))
 120                         set_pte(pte, pte_wrprotect(*pte));
 121                 pte++;
 122         }
 123         flush_tlb();
 124 }
 125
 126
 127
 128 static int do_vm86_irq_handling(int subfunction, int irqnumber);
 129 static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk);
 130
 131 asmlinkage int sys_vm86old(struct vm86_struct * v86)
 132 {
 133         struct kernel_vm86_struct info; /* declare this _on top_,
 134                                          * this avoids wasting of stack space.
 135                                          * This remains on the stack until we
 136                                          * return to 32 bit user space.
 137                                          */
 138         struct task_struct *tsk;
 139         int tmp, ret = -EPERM;
 140
 141         lock_kernel();
 142         tsk = current;
 143         if (tsk->thread.saved_esp0)
 144                 goto out;
 145         tmp  = copy_from_user(&info, v86, VM86_REGS_SIZE1);
 146         tmp += copy_from_user(&info.regs.VM86_REGS_PART2, &v86->regs.VM86_REGS_PART2,
 147                 (long)&info.vm86plus - (long)&info.regs.VM86_REGS_PART2);
 148         ret = -EFAULT;
 149         if (tmp)
 150                 goto out;
 151         memset(&info.vm86plus, 0, (int)&info.regs32 - (int)&info.vm86plus);
 152         info.regs32 = (struct pt_regs *) &v86;
 153         tsk->thread.vm86_info = v86;
 154         do_sys_vm86(&info, tsk);
 155         ret = 0;        /* we never return here */
 156 out:
 157         unlock_kernel();
 158         return ret;
 159 }
 160
 161
 162 asmlinkage int sys_vm86(unsigned long subfunction, struct vm86plus_struct * v86)
 163 {
 164         struct kernel_vm86_struct info; /* declare this _on top_,
 165                                          * this avoids wasting of stack space.
 166                                          * This remains on the stack until we
 167                                          * return to 32 bit user space.
 168                                          */
 169         struct task_struct *tsk;
 170         int tmp, ret;
 171
 172         lock_kernel();
 173         tsk = current;
 174         switch (subfunction) {
 175                 case VM86_REQUEST_IRQ:
 176                 case VM86_FREE_IRQ:
 177                 case VM86_GET_IRQ_BITS:
 178                 case VM86_GET_AND_RESET_IRQ:
 179                         ret = do_vm86_irq_handling(subfunction,(int)v86);
 180                         goto out;
 181                 case VM86_PLUS_INSTALL_CHECK:
 182                         /* NOTE: on old vm86 stuff this will return the error
 183                            from verify_area(), because the subfunction is
 184                            interpreted as (invalid) address to vm86_struct.
 185                            So the installation check works.
 186                          */
 187                         ret = 0;
 188                         goto out;
 189         }
 190
 191         /* we come here only for functions VM86_ENTER, VM86_ENTER_NO_BYPASS */
 192         ret = -EPERM;
 193         if (tsk->thread.saved_esp0)
 194                 goto out;
 195         tmp  = copy_from_user(&info, v86, VM86_REGS_SIZE1);
 196         tmp += copy_from_user(&info.regs.VM86_REGS_PART2, &v86->regs.VM86_REGS_PART2,
 197                 (long)&info.regs32 - (long)&info.regs.VM86_REGS_PART2);
 198         ret = -EFAULT;
 199         if (tmp)
 200                 goto out;
 201         info.regs32 = (struct pt_regs *) &subfunction;
 202         info.vm86plus.is_vm86pus = 1;
 203         tsk->thread.vm86_info = (struct vm86_struct *)v86;
 204         do_sys_vm86(&info, tsk);
 205         ret = 0;        /* we never return here */
 206 out:
 207         unlock_kernel();
 208         return ret;
 209 }
 210
 211
 212 static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk)
 213 {
 214         struct tss_struct *tss;
 215 /*
 216  * make sure the vm86() system call doesn't try to do anything silly
 217  */
 218         info->regs.__null_ds = 0;
 219         info->regs.__null_es = 0;
 220
 221 /* we are clearing fs,gs later just before "jmp ret_from_sys_call",
 222  * because starting with Linux 2.1.x they aren't no longer saved/restored
 223  */
 224
 225 /*
 226  * The eflags register is also special: we cannot trust that the user
 227  * has set it up safely, so this makes sure interrupt etc flags are
 228  * inherited from protected mode.
 229  */
 230         VEFLAGS = info->regs.eflags;
 231         info->regs.eflags &= SAFE_MASK;
 232         info->regs.eflags |= info->regs32->eflags & ~SAFE_MASK;
 233         info->regs.eflags |= VM_MASK;
 234
 235         switch (info->cpu_type) {
 236                 case CPU_286:
 237                         tsk->thread.v86mask = 0;
 238                         break;
 239                 case CPU_386:
 240                         tsk->thread.v86mask = NT_MASK | IOPL_MASK;
 241                         break;
 242                 case CPU_486:
 243                         tsk->thread.v86mask = AC_MASK | NT_MASK | IOPL_MASK;
 244                         break;
 245                 default:
 246                         tsk->thread.v86mask = ID_MASK | AC_MASK | NT_MASK | IOPL_MASK;
 247                         break;
 248         }
 249
 250 /*
 251  * Save old state, set default return value (%eax) to 0
 252  */
 253         info->regs32->eax = 0;
 254         tsk->thread.saved_esp0 = tsk->thread.esp0;
 255         tss = init_tss + smp_processor_id();
 256         tss->esp0 = tsk->thread.esp0 = (unsigned long) &info->VM86_TSS_ESP0;
 257
 258         tsk->thread.screen_bitmap = info->screen_bitmap;
 259         if (info->flags & VM86_SCREEN_BITMAP)
 260                 mark_screen_rdonly(tsk);
 261         unlock_kernel();
 262         __asm__ __volatile__(
 263                 "xorl %%eax,%%eax; movl %%ax,%%fs; movl %%ax,%%gs\n\t"
 264                 "movl %0,%%esp\n\t"
 265                 "jmp ret_from_sys_call"
 266                 : /* no outputs */
 267                 :"r" (&info->regs), "b" (tsk) : "ax");
 268         /* we never return here */
 269 }
 270
 271 static inline void return_to_32bit(struct kernel_vm86_regs * regs16, int retval)
 272 {
 273         struct pt_regs * regs32;
 274
 275         regs32 = save_v86_state(regs16);
 276         regs32->eax = retval;
 277         unlock_kernel();
 278         __asm__ __volatile__("movl %0,%%esp\n\t"
 279                 "jmp ret_from_sys_call"
 280                 : : "r" (regs32), "b" (current));
 281 }
 282
 283 static inline void set_IF(struct kernel_vm86_regs * regs)
 284 {
 285         VEFLAGS |= VIF_MASK;
 286         if (VEFLAGS & VIP_MASK)
 287                 return_to_32bit(regs, VM86_STI);
 288 }
 289
 290 static inline void clear_IF(struct kernel_vm86_regs * regs)
 291 {
 292         VEFLAGS &= ~VIF_MASK;
 293 }
 294
 295 static inline void clear_TF(struct kernel_vm86_regs * regs)
 296 {
 297         regs->eflags &= ~TF_MASK;
 298 }
 299
 300 static inline void set_vflags_long(unsigned long eflags, struct kernel_vm86_regs * regs)
 301 {
 302         set_flags(VEFLAGS, eflags, current->thread.v86mask);
 303         set_flags(regs->eflags, eflags, SAFE_MASK);
 304         if (eflags & IF_MASK)
 305                 set_IF(regs);
 306 }
 307
 308 static inline void set_vflags_short(unsigned short flags, struct kernel_vm86_regs * regs)
 309 {
 310         set_flags(VFLAGS, flags, current->thread.v86mask);
 311         set_flags(regs->eflags, flags, SAFE_MASK);
 312         if (flags & IF_MASK)
 313                 set_IF(regs);
 314 }
 315
 316 static inline unsigned long get_vflags(struct kernel_vm86_regs * regs)
 317 {
 318         unsigned long flags = regs->eflags & RETURN_MASK;
 319
 320         if (VEFLAGS & VIF_MASK)
 321                 flags |= IF_MASK;
 322         return flags | (VEFLAGS & current->thread.v86mask);
 323 }
 324
 325 static inline int is_revectored(int nr, struct revectored_struct * bitmap)
 326 {
 327         __asm__ __volatile__("btl %2,%1\n\tsbbl %0,%0"
 328                 :"=r" (nr)
 329                 :"m" (*bitmap),"r" (nr));
 330         return nr;
 331 }
 332
 333 /*
 334  * Boy are these ugly, but we need to do the correct 16-bit arithmetic.
 335  * Gcc makes a mess of it, so we do it inline and use non-obvious calling
 336  * conventions..
 337  */
 338 #define pushb(base, ptr, val) \
 339 __asm__ __volatile__( \
 340         "decw %w0\n\t" \
 341         "movb %2,0(%1,%0)" \
 342         : "=r" (ptr) \
 343         : "r" (base), "q" (val), "0" (ptr))
 344
 345 #define pushw(base, ptr, val) \
 346 __asm__ __volatile__( \
 347         "decw %w0\n\t" \
 348         "movb %h2,0(%1,%0)\n\t" \
 349         "decw %w0\n\t" \
 350         "movb %b2,0(%1,%0)" \
 351         : "=r" (ptr) \
 352         : "r" (base), "q" (val), "0" (ptr))
 353
 354 #define pushl(base, ptr, val) \
 355 __asm__ __volatile__( \
 356         "decw %w0\n\t" \
 357         "rorl $16,%2\n\t" \
 358         "movb %h2,0(%1,%0)\n\t" \
 359         "decw %w0\n\t" \
 360         "movb %b2,0(%1,%0)\n\t" \
 361         "decw %w0\n\t" \
 362         "rorl $16,%2\n\t" \
 363         "movb %h2,0(%1,%0)\n\t" \
 364         "decw %w0\n\t" \
 365         "movb %b2,0(%1,%0)" \
 366         : "=r" (ptr) \
 367         : "r" (base), "q" (val), "0" (ptr))
 368
 369 #define popb(base, ptr) \
 370 ({ unsigned long __res; \
 371 __asm__ __volatile__( \
 372         "movb 0(%1,%0),%b2\n\t" \
 373         "incw %w0" \
 374         : "=r" (ptr), "=r" (base), "=q" (__res) \
 375         : "0" (ptr), "1" (base), "2" (0)); \
 376 __res; })
 377
 378 #define popw(base, ptr) \
 379 ({ unsigned long __res; \
 380 __asm__ __volatile__( \
 381         "movb 0(%1,%0),%b2\n\t" \
 382         "incw %w0\n\t" \
 383         "movb 0(%1,%0),%h2\n\t" \
 384         "incw %w0" \
 385         : "=r" (ptr), "=r" (base), "=q" (__res) \
 386         : "0" (ptr), "1" (base), "2" (0)); \
 387 __res; })
 388
 389 #define popl(base, ptr) \
 390 ({ unsigned long __res; \
 391 __asm__ __volatile__( \
 392         "movb 0(%1,%0),%b2\n\t" \
 393         "incw %w0\n\t" \
 394         "movb 0(%1,%0),%h2\n\t" \
 395         "incw %w0\n\t" \
 396         "rorl $16,%2\n\t" \
 397         "movb 0(%1,%0),%b2\n\t" \
 398         "incw %w0\n\t" \
 399         "movb 0(%1,%0),%h2\n\t" \
 400         "incw %w0\n\t" \
 401         "rorl $16,%2" \
 402         : "=r" (ptr), "=r" (base), "=q" (__res) \
 403         : "0" (ptr), "1" (base)); \
 404 __res; })
 405
 406 static void do_int(struct kernel_vm86_regs *regs, int i, unsigned char * ssp, unsigned long sp)
 407 {
 408         unsigned long *intr_ptr, segoffs;
 409
 410         if (regs->cs == BIOSSEG)
 411                 goto cannot_handle;
 412         if (is_revectored(i, &KVM86->int_revectored))
 413                 goto cannot_handle;
 414         if (i==0x21 && is_revectored(AH(regs),&KVM86->int21_revectored))
 415                 goto cannot_handle;
 416         intr_ptr = (unsigned long *) (i << 2);
 417         if (get_user(segoffs, intr_ptr))
 418                 goto cannot_handle;
 419         if ((segoffs >> 16) == BIOSSEG)
 420                 goto cannot_handle;
 421         pushw(ssp, sp, get_vflags(regs));
 422         pushw(ssp, sp, regs->cs);
 423         pushw(ssp, sp, IP(regs));
 424         regs->cs = segoffs >> 16;
 425         SP(regs) -= 6;
 426         IP(regs) = segoffs & 0xffff;
 427         clear_TF(regs);
 428         clear_IF(regs);
 429         return;
 430
 431 cannot_handle:
 432         return_to_32bit(regs, VM86_INTx + (i << 8));
 433 }
 434
 435 /* This must be called with the kernel lock held. */
 436 int handle_vm86_trap(struct kernel_vm86_regs * regs, long error_code, int trapno)
 437 {
 438         if (VMPI.is_vm86pus) {
 439                 if ( (trapno==3) || (trapno==1) )
 440                         return_to_32bit(regs, VM86_TRAP + (trapno << 8));
 441                 do_int(regs, trapno, (unsigned char *) (regs->ss << 4), SP(regs));
 442                 return 0;
 443         }
 444         if (trapno !=1)
 445                 return 1; /* we let this handle by the calling routine */
 446         if (current->flags & PF_PTRACED) {
 447                 unsigned long flags;
 448                 spin_lock_irqsave(&current->sigmask_lock, flags);
 449                 sigdelset(&current->blocked, SIGTRAP);
 450                 recalc_sigpending(current);
 451                 spin_unlock_irqrestore(&current->sigmask_lock, flags);
 452         }
 453         send_sig(SIGTRAP, current, 1);
 454         current->thread.trap_no = trapno;
 455         current->thread.error_code = error_code;
 456         return 0;
 457 }
 458
 459 /* This must be called with the kernel lock held. */
 460 void handle_vm86_fault(struct kernel_vm86_regs * regs, long error_code)
 461 {
 462         unsigned char *csp, *ssp;
 463         unsigned long ip, sp;
 464
 465 #define CHECK_IF_IN_TRAP \
 466         if (VMPI.vm86dbg_active && VMPI.vm86dbg_TFpendig) \
 467                 pushw(ssp,sp,popw(ssp,sp) | TF_MASK);
 468 #define VM86_FAULT_RETURN \
 469         if (VMPI.force_return_for_pic  && (VEFLAGS & IF_MASK)) \
 470                 return_to_32bit(regs, VM86_PICRETURN); \
 471         return;
 472
 473         csp = (unsigned char *) (regs->cs << 4);
 474         ssp = (unsigned char *) (regs->ss << 4);
 475         sp = SP(regs);
 476         ip = IP(regs);
 477
 478         switch (popb(csp, ip)) {
 479
 480         /* operand size override */
 481         case 0x66:
 482                 switch (popb(csp, ip)) {
 483
 484                 /* pushfd */
 485                 case 0x9c:
 486                         SP(regs) -= 4;
 487                         IP(regs) += 2;
 488                         pushl(ssp, sp, get_vflags(regs));
 489                         VM86_FAULT_RETURN;
 490
 491                 /* popfd */
 492                 case 0x9d:
 493                         SP(regs) += 4;
 494                         IP(regs) += 2;
 495                         CHECK_IF_IN_TRAP
 496                         set_vflags_long(popl(ssp, sp), regs);
 497                         VM86_FAULT_RETURN;
 498
 499                 /* iretd */
 500                 case 0xcf:
 501                         SP(regs) += 12;
 502                         IP(regs) = (unsigned short)popl(ssp, sp);
 503                         regs->cs = (unsigned short)popl(ssp, sp);
 504                         CHECK_IF_IN_TRAP
 505                         set_vflags_long(popl(ssp, sp), regs);
 506                         VM86_FAULT_RETURN;
 507                 /* need this to avoid a fallthrough */
 508                 default:
 509                         return_to_32bit(regs, VM86_UNKNOWN);
 510                 }
 511
 512         /* pushf */
 513         case 0x9c:
 514                 SP(regs) -= 2;
 515                 IP(regs)++;
 516                 pushw(ssp, sp, get_vflags(regs));
 517                 VM86_FAULT_RETURN;
 518
 519         /* popf */
 520         case 0x9d:
 521                 SP(regs) += 2;
 522                 IP(regs)++;
 523                 CHECK_IF_IN_TRAP
 524                 set_vflags_short(popw(ssp, sp), regs);
 525                 VM86_FAULT_RETURN;
 526
 527         /* int xx */
 528         case 0xcd: {
 529                 int intno=popb(csp, ip);
 530                 IP(regs) += 2;
 531                 if (VMPI.vm86dbg_active) {
 532                         if ( (1 << (intno &7)) & VMPI.vm86dbg_intxxtab[intno >> 3] )
 533                                 return_to_32bit(regs, VM86_INTx + (intno << 8));
 534                 }
 535                 do_int(regs, intno, ssp, sp);
 536                 return;
 537         }
 538
 539         /* iret */
 540         case 0xcf:
 541                 SP(regs) += 6;
 542                 IP(regs) = popw(ssp, sp);
 543                 regs->cs = popw(ssp, sp);
 544                 CHECK_IF_IN_TRAP
 545                 set_vflags_short(popw(ssp, sp), regs);
 546                 VM86_FAULT_RETURN;
 547
 548         /* cli */
 549         case 0xfa:
 550                 IP(regs)++;
 551                 clear_IF(regs);
 552                 VM86_FAULT_RETURN;
 553
 554         /* sti */
 555         /*
 556          * Damn. This is incorrect: the 'sti' instruction should actually
 557          * enable interrupts after the /next/ instruction. Not good.
 558          *
 559          * Probably needs some horsing around with the TF flag. Aiee..
 560          */
 561         case 0xfb:
 562                 IP(regs)++;
 563                 set_IF(regs);
 564                 VM86_FAULT_RETURN;
 565
 566         default:
 567                 return_to_32bit(regs, VM86_UNKNOWN);
 568         }
 569 }
 570
 571 /* ---------------- vm86 special IRQ passing stuff ----------------- */
 572
 573 #define VM86_IRQNAME            "vm86irq"
 574
 575 static struct vm86_irqs {
 576         struct task_struct *tsk;
 577         int sig;
 578 } vm86_irqs[16] = {{0},};
 579 static int irqbits=0;
 580
 581 #define ALLOWED_SIGS ( 1 /* 0 = don't send a signal */ \
 582         | (1 << SIGUSR1) | (1 << SIGUSR2) | (1 << SIGIO)  | (1 << SIGURG) \
 583         | (1 << SIGUNUSED) )
 584
 585 static void irq_handler(int intno, void *dev_id, struct pt_regs * regs) {
 586         int irq_bit;
 587         unsigned long flags;
 588
 589         lock_kernel();
 590         save_flags(flags);
 591         cli();
 592         irq_bit = 1 << intno;
 593         if ((irqbits & irq_bit) || ! vm86_irqs[intno].tsk)
 594                 goto out;
 595         irqbits |= irq_bit;
 596         if (vm86_irqs[intno].sig)
 597                 send_sig(vm86_irqs[intno].sig, vm86_irqs[intno].tsk, 1);
 598         /* else user will poll for IRQs */
 599 out:
 600         restore_flags(flags);
 601         unlock_kernel();
 602 }
 603
 604 static inline void free_vm86_irq(int irqnumber)
 605 {
 606         free_irq(irqnumber,0);
 607         vm86_irqs[irqnumber].tsk = 0;
 608         irqbits &= ~(1 << irqnumber);
 609 }
 610
 611 static inline int task_valid(struct task_struct *tsk)
 612 {
 613         struct task_struct *p;
 614         int ret = 0;
 615
 616         read_lock(&tasklist_lock);
 617         for_each_task(p) {
 618                 if ((p == tsk) && (p->sig)) {
 619                         ret = 1;
 620                         break;
 621                 }
 622         }
 623         read_unlock(&tasklist_lock);
 624         return ret;
 625 }
 626
 627 static inline void handle_irq_zombies(void)
 628 {
 629         int i;
 630         for (i=3; i<16; i++) {
 631                 if (vm86_irqs[i].tsk) {
 632                         if (task_valid(vm86_irqs[i].tsk)) continue;
 633                         free_vm86_irq(i);
 634                 }
 635         }
 636 }
 637
 638 static inline int get_and_reset_irq(int irqnumber)
 639 {
 640         int bit;
 641         unsigned long flags;
 642
 643         if ( (irqnumber<3) || (irqnumber>15) ) return 0;
 644         if (vm86_irqs[irqnumber].tsk != current) return 0;
 645         save_flags(flags);
 646         cli();
 647         bit = irqbits & (1 << irqnumber);
 648         irqbits &= ~bit;
 649         restore_flags(flags);
 650         return bit;
 651 }
 652
 653
 654 static int do_vm86_irq_handling(int subfunction, int irqnumber)
 655 {
 656         int ret;
 657         switch (subfunction) {
 658                 case VM86_GET_AND_RESET_IRQ: {
 659                         return get_and_reset_irq(irqnumber);
 660                 }
 661                 case VM86_GET_IRQ_BITS: {
 662                         return irqbits;
 663                 }
 664                 case VM86_REQUEST_IRQ: {
 665                         int sig = irqnumber >> 8;
 666                         int irq = irqnumber & 255;
 667                         handle_irq_zombies();
 668                         if (!capable(CAP_SYS_ADMIN)) return -EPERM;
 669                         if (!((1 << sig) & ALLOWED_SIGS)) return -EPERM;
 670                         if ( (irq<3) || (irq>15) ) return -EPERM;
 671                         if (vm86_irqs[irq].tsk) return -EPERM;
 672                         ret = request_irq(irq, &irq_handler, 0, VM86_IRQNAME, 0);
 673                         if (ret) return ret;
 674                         vm86_irqs[irq].sig = sig;
 675                         vm86_irqs[irq].tsk = current;
 676                         return irq;
 677                 }
 678                 case  VM86_FREE_IRQ: {
 679                         handle_irq_zombies();
 680                         if ( (irqnumber<3) || (irqnumber>15) ) return -EPERM;
 681                         if (!vm86_irqs[irqnumber].tsk) return 0;
 682                         if (vm86_irqs[irqnumber].tsk != current) return -EPERM;
 683                         free_vm86_irq(irqnumber);
 684                         return 0;
 685                 }
 686         }
 687         return -EINVAL;
 688 }
 689