ldt.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578
  1. /*
  2. * Copyright (C) 2001, 2002 Jeff Dike (jdike@karaya.com)
  3. * Licensed under the GPL
  4. */
  5. #include "linux/sched.h"
  6. #include "linux/slab.h"
  7. #include "linux/types.h"
  8. #include "linux/errno.h"
  9. #include "linux/spinlock.h"
  10. #include "asm/uaccess.h"
  11. #include "asm/smp.h"
  12. #include "asm/ldt.h"
  13. #include "asm/unistd.h"
  14. #include "choose-mode.h"
  15. #include "kern.h"
  16. #include "mode_kern.h"
  17. #include "os.h"
  18. extern int modify_ldt(int func, void *ptr, unsigned long bytecount);
  19. #ifdef CONFIG_MODE_TT
  20. static long do_modify_ldt_tt(int func, void __user *ptr,
  21. unsigned long bytecount)
  22. {
  23. struct user_desc info;
  24. int res = 0;
  25. void *buf = NULL;
  26. void *p = NULL; /* What we pass to host. */
  27. switch(func){
  28. case 1:
  29. case 0x11: /* write_ldt */
  30. /* Do this check now to avoid overflows. */
  31. if (bytecount != sizeof(struct user_desc)) {
  32. res = -EINVAL;
  33. goto out;
  34. }
  35. if(copy_from_user(&info, ptr, sizeof(info))) {
  36. res = -EFAULT;
  37. goto out;
  38. }
  39. p = &info;
  40. break;
  41. case 0:
  42. case 2: /* read_ldt */
  43. /* The use of info avoids kmalloc on the write case, not on the
  44. * read one. */
  45. buf = kmalloc(bytecount, GFP_KERNEL);
  46. if (!buf) {
  47. res = -ENOMEM;
  48. goto out;
  49. }
  50. p = buf;
  51. break;
  52. default:
  53. res = -ENOSYS;
  54. goto out;
  55. }
  56. res = modify_ldt(func, p, bytecount);
  57. if(res < 0)
  58. goto out;
  59. switch(func){
  60. case 0:
  61. case 2:
  62. /* Modify_ldt was for reading and returned the number of read
  63. * bytes.*/
  64. if(copy_to_user(ptr, p, res))
  65. res = -EFAULT;
  66. break;
  67. }
  68. out:
  69. kfree(buf);
  70. return res;
  71. }
  72. #endif
  73. #ifdef CONFIG_MODE_SKAS
  74. #include "skas.h"
  75. #include "skas_ptrace.h"
  76. #include "asm/mmu_context.h"
  77. #include "proc_mm.h"
  78. long write_ldt_entry(struct mm_id * mm_idp, int func, struct user_desc * desc,
  79. void **addr, int done)
  80. {
  81. long res;
  82. if(proc_mm){
  83. /* This is a special handling for the case, that the mm to
  84. * modify isn't current->active_mm.
  85. * If this is called directly by modify_ldt,
  86. * (current->active_mm->context.skas.u == mm_idp)
  87. * will be true. So no call to switch_mm_skas(mm_idp) is done.
  88. * If this is called in case of init_new_ldt or PTRACE_LDT,
  89. * mm_idp won't belong to current->active_mm, but child->mm.
  90. * So we need to switch child's mm into our userspace, then
  91. * later switch back.
  92. *
  93. * Note: I'm unsure: should interrupts be disabled here?
  94. */
  95. if(!current->active_mm || current->active_mm == &init_mm ||
  96. mm_idp != &current->active_mm->context.skas.id)
  97. switch_mm_skas(mm_idp);
  98. }
  99. if(ptrace_ldt) {
  100. struct ptrace_ldt ldt_op = (struct ptrace_ldt) {
  101. .func = func,
  102. .ptr = desc,
  103. .bytecount = sizeof(*desc)};
  104. u32 cpu;
  105. int pid;
  106. if(!proc_mm)
  107. pid = mm_idp->u.pid;
  108. else {
  109. cpu = get_cpu();
  110. pid = userspace_pid[cpu];
  111. }
  112. res = os_ptrace_ldt(pid, 0, (unsigned long) &ldt_op);
  113. if(proc_mm)
  114. put_cpu();
  115. }
  116. else {
  117. void *stub_addr;
  118. res = syscall_stub_data(mm_idp, (unsigned long *)desc,
  119. (sizeof(*desc) + sizeof(long) - 1) &
  120. ~(sizeof(long) - 1),
  121. addr, &stub_addr);
  122. if(!res){
  123. unsigned long args[] = { func,
  124. (unsigned long)stub_addr,
  125. sizeof(*desc),
  126. 0, 0, 0 };
  127. res = run_syscall_stub(mm_idp, __NR_modify_ldt, args,
  128. 0, addr, done);
  129. }
  130. }
  131. if(proc_mm){
  132. /* This is the second part of special handling, that makes
  133. * PTRACE_LDT possible to implement.
  134. */
  135. if(current->active_mm && current->active_mm != &init_mm &&
  136. mm_idp != &current->active_mm->context.skas.id)
  137. switch_mm_skas(&current->active_mm->context.skas.id);
  138. }
  139. return res;
  140. }
  141. static long read_ldt_from_host(void __user * ptr, unsigned long bytecount)
  142. {
  143. int res, n;
  144. struct ptrace_ldt ptrace_ldt = (struct ptrace_ldt) {
  145. .func = 0,
  146. .bytecount = bytecount,
  147. .ptr = kmalloc(bytecount, GFP_KERNEL)};
  148. u32 cpu;
  149. if(ptrace_ldt.ptr == NULL)
  150. return -ENOMEM;
  151. /* This is called from sys_modify_ldt only, so userspace_pid gives
  152. * us the right number
  153. */
  154. cpu = get_cpu();
  155. res = os_ptrace_ldt(userspace_pid[cpu], 0, (unsigned long) &ptrace_ldt);
  156. put_cpu();
  157. if(res < 0)
  158. goto out;
  159. n = copy_to_user(ptr, ptrace_ldt.ptr, res);
  160. if(n != 0)
  161. res = -EFAULT;
  162. out:
  163. kfree(ptrace_ldt.ptr);
  164. return res;
  165. }
  166. /*
  167. * In skas mode, we hold our own ldt data in UML.
  168. * Thus, the code implementing sys_modify_ldt_skas
  169. * is very similar to (and mostly stolen from) sys_modify_ldt
  170. * for arch/i386/kernel/ldt.c
  171. * The routines copied and modified in part are:
  172. * - read_ldt
  173. * - read_default_ldt
  174. * - write_ldt
  175. * - sys_modify_ldt_skas
  176. */
  177. static int read_ldt(void __user * ptr, unsigned long bytecount)
  178. {
  179. int i, err = 0;
  180. unsigned long size;
  181. uml_ldt_t * ldt = &current->mm->context.skas.ldt;
  182. if(!ldt->entry_count)
  183. goto out;
  184. if(bytecount > LDT_ENTRY_SIZE*LDT_ENTRIES)
  185. bytecount = LDT_ENTRY_SIZE*LDT_ENTRIES;
  186. err = bytecount;
  187. if(ptrace_ldt){
  188. return read_ldt_from_host(ptr, bytecount);
  189. }
  190. down(&ldt->semaphore);
  191. if(ldt->entry_count <= LDT_DIRECT_ENTRIES){
  192. size = LDT_ENTRY_SIZE*LDT_DIRECT_ENTRIES;
  193. if(size > bytecount)
  194. size = bytecount;
  195. if(copy_to_user(ptr, ldt->u.entries, size))
  196. err = -EFAULT;
  197. bytecount -= size;
  198. ptr += size;
  199. }
  200. else {
  201. for(i=0; i<ldt->entry_count/LDT_ENTRIES_PER_PAGE && bytecount;
  202. i++){
  203. size = PAGE_SIZE;
  204. if(size > bytecount)
  205. size = bytecount;
  206. if(copy_to_user(ptr, ldt->u.pages[i], size)){
  207. err = -EFAULT;
  208. break;
  209. }
  210. bytecount -= size;
  211. ptr += size;
  212. }
  213. }
  214. up(&ldt->semaphore);
  215. if(bytecount == 0 || err == -EFAULT)
  216. goto out;
  217. if(clear_user(ptr, bytecount))
  218. err = -EFAULT;
  219. out:
  220. return err;
  221. }
  222. static int read_default_ldt(void __user * ptr, unsigned long bytecount)
  223. {
  224. int err;
  225. if(bytecount > 5*LDT_ENTRY_SIZE)
  226. bytecount = 5*LDT_ENTRY_SIZE;
  227. err = bytecount;
  228. /* UML doesn't support lcall7 and lcall27.
  229. * So, we don't really have a default ldt, but emulate
  230. * an empty ldt of common host default ldt size.
  231. */
  232. if(clear_user(ptr, bytecount))
  233. err = -EFAULT;
  234. return err;
  235. }
  236. static int write_ldt(void __user * ptr, unsigned long bytecount, int func)
  237. {
  238. uml_ldt_t * ldt = &current->mm->context.skas.ldt;
  239. struct mm_id * mm_idp = &current->mm->context.skas.id;
  240. int i, err;
  241. struct user_desc ldt_info;
  242. struct ldt_entry entry0, *ldt_p;
  243. void *addr = NULL;
  244. err = -EINVAL;
  245. if(bytecount != sizeof(ldt_info))
  246. goto out;
  247. err = -EFAULT;
  248. if(copy_from_user(&ldt_info, ptr, sizeof(ldt_info)))
  249. goto out;
  250. err = -EINVAL;
  251. if(ldt_info.entry_number >= LDT_ENTRIES)
  252. goto out;
  253. if(ldt_info.contents == 3){
  254. if (func == 1)
  255. goto out;
  256. if (ldt_info.seg_not_present == 0)
  257. goto out;
  258. }
  259. if(!ptrace_ldt)
  260. down(&ldt->semaphore);
  261. err = write_ldt_entry(mm_idp, func, &ldt_info, &addr, 1);
  262. if(err)
  263. goto out_unlock;
  264. else if(ptrace_ldt) {
  265. /* With PTRACE_LDT available, this is used as a flag only */
  266. ldt->entry_count = 1;
  267. goto out;
  268. }
  269. if(ldt_info.entry_number >= ldt->entry_count &&
  270. ldt_info.entry_number >= LDT_DIRECT_ENTRIES){
  271. for(i=ldt->entry_count/LDT_ENTRIES_PER_PAGE;
  272. i*LDT_ENTRIES_PER_PAGE <= ldt_info.entry_number;
  273. i++){
  274. if(i == 0)
  275. memcpy(&entry0, ldt->u.entries,
  276. sizeof(entry0));
  277. ldt->u.pages[i] = (struct ldt_entry *)
  278. __get_free_page(GFP_KERNEL|__GFP_ZERO);
  279. if(!ldt->u.pages[i]){
  280. err = -ENOMEM;
  281. /* Undo the change in host */
  282. memset(&ldt_info, 0, sizeof(ldt_info));
  283. write_ldt_entry(mm_idp, 1, &ldt_info, &addr, 1);
  284. goto out_unlock;
  285. }
  286. if(i == 0) {
  287. memcpy(ldt->u.pages[0], &entry0,
  288. sizeof(entry0));
  289. memcpy(ldt->u.pages[0]+1, ldt->u.entries+1,
  290. sizeof(entry0)*(LDT_DIRECT_ENTRIES-1));
  291. }
  292. ldt->entry_count = (i + 1) * LDT_ENTRIES_PER_PAGE;
  293. }
  294. }
  295. if(ldt->entry_count <= ldt_info.entry_number)
  296. ldt->entry_count = ldt_info.entry_number + 1;
  297. if(ldt->entry_count <= LDT_DIRECT_ENTRIES)
  298. ldt_p = ldt->u.entries + ldt_info.entry_number;
  299. else
  300. ldt_p = ldt->u.pages[ldt_info.entry_number/LDT_ENTRIES_PER_PAGE] +
  301. ldt_info.entry_number%LDT_ENTRIES_PER_PAGE;
  302. if(ldt_info.base_addr == 0 && ldt_info.limit == 0 &&
  303. (func == 1 || LDT_empty(&ldt_info))){
  304. ldt_p->a = 0;
  305. ldt_p->b = 0;
  306. }
  307. else{
  308. if (func == 1)
  309. ldt_info.useable = 0;
  310. ldt_p->a = LDT_entry_a(&ldt_info);
  311. ldt_p->b = LDT_entry_b(&ldt_info);
  312. }
  313. err = 0;
  314. out_unlock:
  315. up(&ldt->semaphore);
  316. out:
  317. return err;
  318. }
  319. static long do_modify_ldt_skas(int func, void __user *ptr,
  320. unsigned long bytecount)
  321. {
  322. int ret = -ENOSYS;
  323. switch (func) {
  324. case 0:
  325. ret = read_ldt(ptr, bytecount);
  326. break;
  327. case 1:
  328. case 0x11:
  329. ret = write_ldt(ptr, bytecount, func);
  330. break;
  331. case 2:
  332. ret = read_default_ldt(ptr, bytecount);
  333. break;
  334. }
  335. return ret;
  336. }
  337. static DEFINE_SPINLOCK(host_ldt_lock);
  338. static short dummy_list[9] = {0, -1};
  339. static short * host_ldt_entries = NULL;
  340. static void ldt_get_host_info(void)
  341. {
  342. long ret;
  343. struct ldt_entry * ldt;
  344. short *tmp;
  345. int i, size, k, order;
  346. spin_lock(&host_ldt_lock);
  347. if(host_ldt_entries != NULL){
  348. spin_unlock(&host_ldt_lock);
  349. return;
  350. }
  351. host_ldt_entries = dummy_list+1;
  352. spin_unlock(&host_ldt_lock);
  353. for(i = LDT_PAGES_MAX-1, order=0; i; i>>=1, order++);
  354. ldt = (struct ldt_entry *)
  355. __get_free_pages(GFP_KERNEL|__GFP_ZERO, order);
  356. if(ldt == NULL) {
  357. printk("ldt_get_host_info: couldn't allocate buffer for host "
  358. "ldt\n");
  359. return;
  360. }
  361. ret = modify_ldt(0, ldt, (1<<order)*PAGE_SIZE);
  362. if(ret < 0) {
  363. printk("ldt_get_host_info: couldn't read host ldt\n");
  364. goto out_free;
  365. }
  366. if(ret == 0) {
  367. /* default_ldt is active, simply write an empty entry 0 */
  368. host_ldt_entries = dummy_list;
  369. goto out_free;
  370. }
  371. for(i=0, size=0; i<ret/LDT_ENTRY_SIZE; i++){
  372. if(ldt[i].a != 0 || ldt[i].b != 0)
  373. size++;
  374. }
  375. if(size < ARRAY_SIZE(dummy_list))
  376. host_ldt_entries = dummy_list;
  377. else {
  378. size = (size + 1) * sizeof(dummy_list[0]);
  379. tmp = kmalloc(size, GFP_KERNEL);
  380. if(tmp == NULL) {
  381. printk("ldt_get_host_info: couldn't allocate host ldt "
  382. "list\n");
  383. goto out_free;
  384. }
  385. host_ldt_entries = tmp;
  386. }
  387. for(i=0, k=0; i<ret/LDT_ENTRY_SIZE; i++){
  388. if(ldt[i].a != 0 || ldt[i].b != 0) {
  389. host_ldt_entries[k++] = i;
  390. }
  391. }
  392. host_ldt_entries[k] = -1;
  393. out_free:
  394. free_pages((unsigned long)ldt, order);
  395. }
  396. long init_new_ldt(struct mmu_context_skas * new_mm,
  397. struct mmu_context_skas * from_mm)
  398. {
  399. struct user_desc desc;
  400. short * num_p;
  401. int i;
  402. long page, err=0;
  403. void *addr = NULL;
  404. struct proc_mm_op copy;
  405. if(!ptrace_ldt)
  406. init_MUTEX(&new_mm->ldt.semaphore);
  407. if(!from_mm){
  408. memset(&desc, 0, sizeof(desc));
  409. /*
  410. * We have to initialize a clean ldt.
  411. */
  412. if(proc_mm) {
  413. /*
  414. * If the new mm was created using proc_mm, host's
  415. * default-ldt currently is assigned, which normally
  416. * contains the call-gates for lcall7 and lcall27.
  417. * To remove these gates, we simply write an empty
  418. * entry as number 0 to the host.
  419. */
  420. err = write_ldt_entry(&new_mm->id, 1, &desc,
  421. &addr, 1);
  422. }
  423. else{
  424. /*
  425. * Now we try to retrieve info about the ldt, we
  426. * inherited from the host. All ldt-entries found
  427. * will be reset in the following loop
  428. */
  429. ldt_get_host_info();
  430. for(num_p=host_ldt_entries; *num_p != -1; num_p++){
  431. desc.entry_number = *num_p;
  432. err = write_ldt_entry(&new_mm->id, 1, &desc,
  433. &addr, *(num_p + 1) == -1);
  434. if(err)
  435. break;
  436. }
  437. }
  438. new_mm->ldt.entry_count = 0;
  439. goto out;
  440. }
  441. if(proc_mm){
  442. /* We have a valid from_mm, so we now have to copy the LDT of
  443. * from_mm to new_mm, because using proc_mm an new mm with
  444. * an empty/default LDT was created in new_mm()
  445. */
  446. copy = ((struct proc_mm_op) { .op = MM_COPY_SEGMENTS,
  447. .u =
  448. { .copy_segments =
  449. from_mm->id.u.mm_fd } } );
  450. i = os_write_file(new_mm->id.u.mm_fd, &copy, sizeof(copy));
  451. if(i != sizeof(copy))
  452. printk("new_mm : /proc/mm copy_segments failed, "
  453. "err = %d\n", -i);
  454. }
  455. if(!ptrace_ldt) {
  456. /* Our local LDT is used to supply the data for
  457. * modify_ldt(READLDT), if PTRACE_LDT isn't available,
  458. * i.e., we have to use the stub for modify_ldt, which
  459. * can't handle the big read buffer of up to 64kB.
  460. */
  461. down(&from_mm->ldt.semaphore);
  462. if(from_mm->ldt.entry_count <= LDT_DIRECT_ENTRIES){
  463. memcpy(new_mm->ldt.u.entries, from_mm->ldt.u.entries,
  464. sizeof(new_mm->ldt.u.entries));
  465. }
  466. else{
  467. i = from_mm->ldt.entry_count / LDT_ENTRIES_PER_PAGE;
  468. while(i-->0){
  469. page = __get_free_page(GFP_KERNEL|__GFP_ZERO);
  470. if (!page){
  471. err = -ENOMEM;
  472. break;
  473. }
  474. new_mm->ldt.u.pages[i] =
  475. (struct ldt_entry *) page;
  476. memcpy(new_mm->ldt.u.pages[i],
  477. from_mm->ldt.u.pages[i], PAGE_SIZE);
  478. }
  479. }
  480. new_mm->ldt.entry_count = from_mm->ldt.entry_count;
  481. up(&from_mm->ldt.semaphore);
  482. }
  483. out:
  484. return err;
  485. }
  486. void free_ldt(struct mmu_context_skas * mm)
  487. {
  488. int i;
  489. if(!ptrace_ldt && mm->ldt.entry_count > LDT_DIRECT_ENTRIES){
  490. i = mm->ldt.entry_count / LDT_ENTRIES_PER_PAGE;
  491. while(i-- > 0){
  492. free_page((long )mm->ldt.u.pages[i]);
  493. }
  494. }
  495. mm->ldt.entry_count = 0;
  496. }
  497. #endif
  498. int sys_modify_ldt(int func, void __user *ptr, unsigned long bytecount)
  499. {
  500. return CHOOSE_MODE_PROC(do_modify_ldt_tt, do_modify_ldt_skas, func,
  501. ptr, bytecount);
  502. }