arch/um/sys-i386/ldt.c

   1 /*
   2  * Copyright (C) 2001, 2002 Jeff Dike (jdike@karaya.com)
   3  * Licensed under the GPL
   4  */
   5
   6 #include "linux/sched.h"
   7 #include "linux/slab.h"
   8 #include "linux/types.h"
   9 #include "linux/errno.h"
  10 #include "linux/spinlock.h"
  11 #include "asm/uaccess.h"
  12 #include "asm/smp.h"
  13 #include "asm/ldt.h"
  14 #include "asm/unistd.h"
  15 #include "kern.h"
  16 #include "os.h"
  17
  18 extern int modify_ldt(int func, void *ptr, unsigned long bytecount);
  19
  20 #include "skas.h"
  21 #include "skas_ptrace.h"
  22 #include "asm/mmu_context.h"
  23 #include "proc_mm.h"
  24
  25 long write_ldt_entry(struct mm_id * mm_idp, int func, struct user_desc * desc,
  26                      void **addr, int done)
  27 {
  28         long res;
  29
  30         if(proc_mm){
  31                 /* This is a special handling for the case, that the mm to
  32                  * modify isn't current->active_mm.
  33                  * If this is called directly by modify_ldt,
  34                  *     (current->active_mm->context.skas.u == mm_idp)
  35                  * will be true. So no call to __switch_mm(mm_idp) is done.
  36                  * If this is called in case of init_new_ldt or PTRACE_LDT,
  37                  * mm_idp won't belong to current->active_mm, but child->mm.
  38                  * So we need to switch child's mm into our userspace, then
  39                  * later switch back.
  40                  *
  41                  * Note: I'm unsure: should interrupts be disabled here?
  42                  */
  43                 if(!current->active_mm || current->active_mm == &init_mm ||
  44                    mm_idp != &current->active_mm->context.skas.id)
  45                         __switch_mm(mm_idp);
  46         }
  47
  48         if(ptrace_ldt) {
  49                 struct ptrace_ldt ldt_op = (struct ptrace_ldt) {
  50                         .func = func,
  51                         .ptr = desc,
  52                         .bytecount = sizeof(*desc)};
  53                 u32 cpu;
  54                 int pid;
  55
  56                 if(!proc_mm)
  57                         pid = mm_idp->u.pid;
  58                 else {
  59                         cpu = get_cpu();
  60                         pid = userspace_pid[cpu];
  61                 }
  62
  63                 res = os_ptrace_ldt(pid, 0, (unsigned long) &ldt_op);
  64
  65                 if(proc_mm)
  66                         put_cpu();
  67         }
  68         else {
  69                 void *stub_addr;
  70                 res = syscall_stub_data(mm_idp, (unsigned long *)desc,
  71                                         (sizeof(*desc) + sizeof(long) - 1) &
  72                                             ~(sizeof(long) - 1),
  73                                         addr, &stub_addr);
  74                 if(!res){
  75                         unsigned long args[] = { func,
  76                                                  (unsigned long)stub_addr,
  77                                                  sizeof(*desc),
  78                                                  0, 0, 0 };
  79                         res = run_syscall_stub(mm_idp, __NR_modify_ldt, args,
  80                                                0, addr, done);
  81                 }
  82         }
  83
  84         if(proc_mm){
  85                 /* This is the second part of special handling, that makes
  86                  * PTRACE_LDT possible to implement.
  87                  */
  88                 if(current->active_mm && current->active_mm != &init_mm &&
  89                    mm_idp != &current->active_mm->context.skas.id)
  90                         __switch_mm(&current->active_mm->context.skas.id);
  91         }
  92
  93         return res;
  94 }
  95
  96 static long read_ldt_from_host(void __user * ptr, unsigned long bytecount)
  97 {
  98         int res, n;
  99         struct ptrace_ldt ptrace_ldt = (struct ptrace_ldt) {
 100                         .func = 0,
 101                         .bytecount = bytecount,
 102                         .ptr = kmalloc(bytecount, GFP_KERNEL)};
 103         u32 cpu;
 104
 105         if(ptrace_ldt.ptr == NULL)
 106                 return -ENOMEM;
 107
 108         /* This is called from sys_modify_ldt only, so userspace_pid gives
 109          * us the right number
 110          */
 111
 112         cpu = get_cpu();
 113         res = os_ptrace_ldt(userspace_pid[cpu], 0, (unsigned long) &ptrace_ldt);
 114         put_cpu();
 115         if(res < 0)
 116                 goto out;
 117
 118         n = copy_to_user(ptr, ptrace_ldt.ptr, res);
 119         if(n != 0)
 120                 res = -EFAULT;
 121
 122   out:
 123         kfree(ptrace_ldt.ptr);
 124
 125         return res;
 126 }
 127
 128 /*
 129  * In skas mode, we hold our own ldt data in UML.
 130  * Thus, the code implementing sys_modify_ldt_skas
 131  * is very similar to (and mostly stolen from) sys_modify_ldt
 132  * for arch/i386/kernel/ldt.c
 133  * The routines copied and modified in part are:
 134  * - read_ldt
 135  * - read_default_ldt
 136  * - write_ldt
 137  * - sys_modify_ldt_skas
 138  */
 139
 140 static int read_ldt(void __user * ptr, unsigned long bytecount)
 141 {
 142         int i, err = 0;
 143         unsigned long size;
 144         uml_ldt_t * ldt = &current->mm->context.skas.ldt;
 145
 146         if(!ldt->entry_count)
 147                 goto out;
 148         if(bytecount > LDT_ENTRY_SIZE*LDT_ENTRIES)
 149                 bytecount = LDT_ENTRY_SIZE*LDT_ENTRIES;
 150         err = bytecount;
 151
 152         if(ptrace_ldt){
 153                 return read_ldt_from_host(ptr, bytecount);
 154         }
 155
 156         down(&ldt->semaphore);
 157         if(ldt->entry_count <= LDT_DIRECT_ENTRIES){
 158                 size = LDT_ENTRY_SIZE*LDT_DIRECT_ENTRIES;
 159                 if(size > bytecount)
 160                         size = bytecount;
 161                 if(copy_to_user(ptr, ldt->u.entries, size))
 162                         err = -EFAULT;
 163                 bytecount -= size;
 164                 ptr += size;
 165         }
 166         else {
 167                 for(i=0; i<ldt->entry_count/LDT_ENTRIES_PER_PAGE && bytecount;
 168                          i++){
 169                         size = PAGE_SIZE;
 170                         if(size > bytecount)
 171                                 size = bytecount;
 172                         if(copy_to_user(ptr, ldt->u.pages[i], size)){
 173                                 err = -EFAULT;
 174                                 break;
 175                         }
 176                         bytecount -= size;
 177                         ptr += size;
 178                 }
 179         }
 180         up(&ldt->semaphore);
 181
 182         if(bytecount == 0 || err == -EFAULT)
 183                 goto out;
 184
 185         if(clear_user(ptr, bytecount))
 186                 err = -EFAULT;
 187
 188 out:
 189         return err;
 190 }
 191
 192 static int read_default_ldt(void __user * ptr, unsigned long bytecount)
 193 {
 194         int err;
 195
 196         if(bytecount > 5*LDT_ENTRY_SIZE)
 197                 bytecount = 5*LDT_ENTRY_SIZE;
 198
 199         err = bytecount;
 200         /* UML doesn't support lcall7 and lcall27.
 201          * So, we don't really have a default ldt, but emulate
 202          * an empty ldt of common host default ldt size.
 203          */
 204         if(clear_user(ptr, bytecount))
 205                 err = -EFAULT;
 206
 207         return err;
 208 }
 209
 210 static int write_ldt(void __user * ptr, unsigned long bytecount, int func)
 211 {
 212         uml_ldt_t * ldt = &current->mm->context.skas.ldt;
 213         struct mm_id * mm_idp = &current->mm->context.skas.id;
 214         int i, err;
 215         struct user_desc ldt_info;
 216         struct ldt_entry entry0, *ldt_p;
 217         void *addr = NULL;
 218
 219         err = -EINVAL;
 220         if(bytecount != sizeof(ldt_info))
 221                 goto out;
 222         err = -EFAULT;
 223         if(copy_from_user(&ldt_info, ptr, sizeof(ldt_info)))
 224                 goto out;
 225
 226         err = -EINVAL;
 227         if(ldt_info.entry_number >= LDT_ENTRIES)
 228                 goto out;
 229         if(ldt_info.contents == 3){
 230                 if (func == 1)
 231                         goto out;
 232                 if (ldt_info.seg_not_present == 0)
 233                         goto out;
 234         }
 235
 236         if(!ptrace_ldt)
 237                 down(&ldt->semaphore);
 238
 239         err = write_ldt_entry(mm_idp, func, &ldt_info, &addr, 1);
 240         if(err)
 241                 goto out_unlock;
 242         else if(ptrace_ldt) {
 243         /* With PTRACE_LDT available, this is used as a flag only */
 244                 ldt->entry_count = 1;
 245                 goto out;
 246         }
 247
 248         if(ldt_info.entry_number >= ldt->entry_count &&
 249            ldt_info.entry_number >= LDT_DIRECT_ENTRIES){
 250                 for(i=ldt->entry_count/LDT_ENTRIES_PER_PAGE;
 251                     i*LDT_ENTRIES_PER_PAGE <= ldt_info.entry_number;
 252                     i++){
 253                         if(i == 0)
 254                                 memcpy(&entry0, ldt->u.entries,
 255                                        sizeof(entry0));
 256                         ldt->u.pages[i] = (struct ldt_entry *)
 257                                 __get_free_page(GFP_KERNEL|__GFP_ZERO);
 258                         if(!ldt->u.pages[i]){
 259                                 err = -ENOMEM;
 260                                 /* Undo the change in host */
 261                                 memset(&ldt_info, 0, sizeof(ldt_info));
 262                                 write_ldt_entry(mm_idp, 1, &ldt_info, &addr, 1);
 263                                 goto out_unlock;
 264                         }
 265                         if(i == 0) {
 266                                 memcpy(ldt->u.pages[0], &entry0,
 267                                        sizeof(entry0));
 268                                 memcpy(ldt->u.pages[0]+1, ldt->u.entries+1,
 269                                        sizeof(entry0)*(LDT_DIRECT_ENTRIES-1));
 270                         }
 271                         ldt->entry_count = (i + 1) * LDT_ENTRIES_PER_PAGE;
 272                 }
 273         }
 274         if(ldt->entry_count <= ldt_info.entry_number)
 275                 ldt->entry_count = ldt_info.entry_number + 1;
 276
 277         if(ldt->entry_count <= LDT_DIRECT_ENTRIES)
 278                 ldt_p = ldt->u.entries + ldt_info.entry_number;
 279         else
 280                 ldt_p = ldt->u.pages[ldt_info.entry_number/LDT_ENTRIES_PER_PAGE] +
 281                         ldt_info.entry_number%LDT_ENTRIES_PER_PAGE;
 282
 283         if(ldt_info.base_addr == 0 && ldt_info.limit == 0 &&
 284            (func == 1 || LDT_empty(&ldt_info))){
 285                 ldt_p->a = 0;
 286                 ldt_p->b = 0;
 287         }
 288         else{
 289                 if (func == 1)
 290                         ldt_info.useable = 0;
 291                 ldt_p->a = LDT_entry_a(&ldt_info);
 292                 ldt_p->b = LDT_entry_b(&ldt_info);
 293         }
 294         err = 0;
 295
 296 out_unlock:
 297         up(&ldt->semaphore);
 298 out:
 299         return err;
 300 }
 301
 302 static long do_modify_ldt_skas(int func, void __user *ptr,
 303                                unsigned long bytecount)
 304 {
 305         int ret = -ENOSYS;
 306
 307         switch (func) {
 308                 case 0:
 309                         ret = read_ldt(ptr, bytecount);
 310                         break;
 311                 case 1:
 312                 case 0x11:
 313                         ret = write_ldt(ptr, bytecount, func);
 314                         break;
 315                 case 2:
 316                         ret = read_default_ldt(ptr, bytecount);
 317                         break;
 318         }
 319         return ret;
 320 }
 321
 322 static DEFINE_SPINLOCK(host_ldt_lock);
 323 static short dummy_list[9] = {0, -1};
 324 static short * host_ldt_entries = NULL;
 325
 326 static void ldt_get_host_info(void)
 327 {
 328         long ret;
 329         struct ldt_entry * ldt;
 330         short *tmp;
 331         int i, size, k, order;
 332
 333         spin_lock(&host_ldt_lock);
 334
 335         if(host_ldt_entries != NULL){
 336                 spin_unlock(&host_ldt_lock);
 337                 return;
 338         }
 339         host_ldt_entries = dummy_list+1;
 340
 341         spin_unlock(&host_ldt_lock);
 342
 343         for(i = LDT_PAGES_MAX-1, order=0; i; i>>=1, order++);
 344
 345         ldt = (struct ldt_entry *)
 346               __get_free_pages(GFP_KERNEL|__GFP_ZERO, order);
 347         if(ldt == NULL) {
 348                 printk("ldt_get_host_info: couldn't allocate buffer for host "
 349                        "ldt\n");
 350                 return;
 351         }
 352
 353         ret = modify_ldt(0, ldt, (1<<order)*PAGE_SIZE);
 354         if(ret < 0) {
 355                 printk("ldt_get_host_info: couldn't read host ldt\n");
 356                 goto out_free;
 357         }
 358         if(ret == 0) {
 359                 /* default_ldt is active, simply write an empty entry 0 */
 360                 host_ldt_entries = dummy_list;
 361                 goto out_free;
 362         }
 363
 364         for(i=0, size=0; i<ret/LDT_ENTRY_SIZE; i++){
 365                 if(ldt[i].a != 0 || ldt[i].b != 0)
 366                         size++;
 367         }
 368
 369         if(size < ARRAY_SIZE(dummy_list))
 370                 host_ldt_entries = dummy_list;
 371         else {
 372                 size = (size + 1) * sizeof(dummy_list[0]);
 373                 tmp = kmalloc(size, GFP_KERNEL);
 374                 if(tmp == NULL) {
 375                         printk("ldt_get_host_info: couldn't allocate host ldt "
 376                                "list\n");
 377                         goto out_free;
 378                 }
 379                 host_ldt_entries = tmp;
 380         }
 381
 382         for(i=0, k=0; i<ret/LDT_ENTRY_SIZE; i++){
 383                 if(ldt[i].a != 0 || ldt[i].b != 0) {
 384                         host_ldt_entries[k++] = i;
 385                 }
 386         }
 387         host_ldt_entries[k] = -1;
 388
 389 out_free:
 390         free_pages((unsigned long)ldt, order);
 391 }
 392
 393 long init_new_ldt(struct mmu_context_skas * new_mm,
 394                   struct mmu_context_skas * from_mm)
 395 {
 396         struct user_desc desc;
 397         short * num_p;
 398         int i;
 399         long page, err=0;
 400         void *addr = NULL;
 401         struct proc_mm_op copy;
 402
 403
 404         if(!ptrace_ldt)
 405                 init_MUTEX(&new_mm->ldt.semaphore);
 406
 407         if(!from_mm){
 408                 memset(&desc, 0, sizeof(desc));
 409                 /*
 410                  * We have to initialize a clean ldt.
 411                  */
 412                 if(proc_mm) {
 413                         /*
 414                          * If the new mm was created using proc_mm, host's
 415                          * default-ldt currently is assigned, which normally
 416                          * contains the call-gates for lcall7 and lcall27.
 417                          * To remove these gates, we simply write an empty
 418                          * entry as number 0 to the host.
 419                          */
 420                         err = write_ldt_entry(&new_mm->id, 1, &desc,
 421                                               &addr, 1);
 422                 }
 423                 else{
 424                         /*
 425                          * Now we try to retrieve info about the ldt, we
 426                          * inherited from the host. All ldt-entries found
 427                          * will be reset in the following loop
 428                          */
 429                         ldt_get_host_info();
 430                         for(num_p=host_ldt_entries; *num_p != -1; num_p++){
 431                                 desc.entry_number = *num_p;
 432                                 err = write_ldt_entry(&new_mm->id, 1, &desc,
 433                                                       &addr, *(num_p + 1) == -1);
 434                                 if(err)
 435                                         break;
 436                         }
 437                 }
 438                 new_mm->ldt.entry_count = 0;
 439
 440                 goto out;
 441         }
 442
 443         if(proc_mm){
 444                 /* We have a valid from_mm, so we now have to copy the LDT of
 445                  * from_mm to new_mm, because using proc_mm an new mm with
 446                  * an empty/default LDT was created in new_mm()
 447                  */
 448                 copy = ((struct proc_mm_op) { .op       = MM_COPY_SEGMENTS,
 449                                               .u        =
 450                                               { .copy_segments =
 451                                                         from_mm->id.u.mm_fd } } );
 452                 i = os_write_file(new_mm->id.u.mm_fd, &copy, sizeof(copy));
 453                 if(i != sizeof(copy))
 454                         printk("new_mm : /proc/mm copy_segments failed, "
 455                                "err = %d\n", -i);
 456         }
 457
 458         if(!ptrace_ldt) {
 459                 /* Our local LDT is used to supply the data for
 460                  * modify_ldt(READLDT), if PTRACE_LDT isn't available,
 461                  * i.e., we have to use the stub for modify_ldt, which
 462                  * can't handle the big read buffer of up to 64kB.
 463                  */
 464                 down(&from_mm->ldt.semaphore);
 465                 if(from_mm->ldt.entry_count <= LDT_DIRECT_ENTRIES){
 466                         memcpy(new_mm->ldt.u.entries, from_mm->ldt.u.entries,
 467                                sizeof(new_mm->ldt.u.entries));
 468                 }
 469                 else{
 470                         i = from_mm->ldt.entry_count / LDT_ENTRIES_PER_PAGE;
 471                         while(i-->0){
 472                                 page = __get_free_page(GFP_KERNEL|__GFP_ZERO);
 473                                 if (!page){
 474                                         err = -ENOMEM;
 475                                         break;
 476                                 }
 477                                 new_mm->ldt.u.pages[i] =
 478                                         (struct ldt_entry *) page;
 479                                 memcpy(new_mm->ldt.u.pages[i],
 480                                        from_mm->ldt.u.pages[i], PAGE_SIZE);
 481                         }
 482                 }
 483                 new_mm->ldt.entry_count = from_mm->ldt.entry_count;
 484                 up(&from_mm->ldt.semaphore);
 485         }
 486
 487     out:
 488         return err;
 489 }
 490
 491
 492 void free_ldt(struct mmu_context_skas * mm)
 493 {
 494         int i;
 495
 496         if(!ptrace_ldt && mm->ldt.entry_count > LDT_DIRECT_ENTRIES){
 497                 i = mm->ldt.entry_count / LDT_ENTRIES_PER_PAGE;
 498                 while(i-- > 0){
 499                         free_page((long )mm->ldt.u.pages[i]);
 500                 }
 501         }
 502         mm->ldt.entry_count = 0;
 503 }
 504
 505 int sys_modify_ldt(int func, void __user *ptr, unsigned long bytecount)
 506 {
 507         return do_modify_ldt_skas(func, ptr, bytecount);
 508 }