1 /*
2  * linux/kernel/ldt.c
3  *
4  * Copyright (C) 1992 Krishna Balasubramanian and Linus Torvalds
5  * Copyright (C) 1999 Ingo Molnar <mingo@redhat.com>
6  */
7 
8 #include <linux/errno.h>
9 #include <linux/sched.h>
10 #include <linux/string.h>
11 #include <linux/mm.h>
12 #include <linux/smp.h>
13 #include <linux/smp_lock.h>
14 #include <linux/vmalloc.h>
15 #include <linux/slab.h>
16 
17 #include <asm/uaccess.h>
18 #include <asm/system.h>
19 #include <asm/ldt.h>
20 #include <asm/desc.h>
21 
22 #ifdef CONFIG_SMP /* avoids "defined but not used" warnig */
flush_ldt(void * mm)23 static void flush_ldt(void *mm)
24 {
25 	if (current->active_mm)
26 		load_LDT(&current->active_mm->context);
27 }
28 #endif
29 
alloc_ldt(mm_context_t * pc,int mincount,int reload)30 static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
31 {
32 	void *oldldt;
33 	void *newldt;
34 	int oldsize;
35 
36 	if (mincount <= pc->size)
37 		return 0;
38 	oldsize = pc->size;
39 	mincount = (mincount+511)&(~511);
40 	if (mincount*LDT_ENTRY_SIZE > PAGE_SIZE)
41 		newldt = vmalloc(mincount*LDT_ENTRY_SIZE);
42 	else
43 		newldt = kmalloc(mincount*LDT_ENTRY_SIZE, GFP_KERNEL);
44 
45 	if (!newldt)
46 		return -ENOMEM;
47 
48 	if (oldsize)
49 		memcpy(newldt, pc->ldt, oldsize*LDT_ENTRY_SIZE);
50 
51 	oldldt = pc->ldt;
52 	memset(newldt+oldsize*LDT_ENTRY_SIZE, 0, (mincount-oldsize)*LDT_ENTRY_SIZE);
53 	wmb();
54 	pc->ldt = newldt;
55 	pc->size = mincount;
56 	if (reload) {
57 		load_LDT(pc);
58 #ifdef CONFIG_SMP
59 		if (current->mm->cpu_vm_mask != (1<<smp_processor_id()))
60 			smp_call_function(flush_ldt, 0, 1, 1);
61 #endif
62 	}
63 	wmb();
64 	if (oldsize) {
65 		if (oldsize*LDT_ENTRY_SIZE > PAGE_SIZE)
66 			vfree(oldldt);
67 		else
68 			kfree(oldldt);
69 	}
70 	return 0;
71 }
72 
copy_ldt(mm_context_t * new,mm_context_t * old)73 static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
74 {
75 	int err = alloc_ldt(new, old->size, 0);
76 	if (err < 0) {
77 		printk(KERN_WARNING "ldt allocation failed\n");
78 		new->size = 0;
79 		return err;
80 	}
81 	memcpy(new->ldt, old->ldt, old->size*LDT_ENTRY_SIZE);
82 	return 0;
83 }
84 
85 /*
86  * we do not have to muck with descriptors here, that is
87  * done in switch_mm() as needed.
88  */
init_new_context(struct task_struct * tsk,struct mm_struct * mm)89 int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
90 {
91 	struct mm_struct * old_mm;
92 	int retval = 0;
93 
94 	init_MUTEX(&mm->context.sem);
95 	mm->context.size = 0;
96 	old_mm = current->mm;
97 	if (old_mm && old_mm->context.size > 0) {
98 		down(&old_mm->context.sem);
99 		retval = copy_ldt(&mm->context, &old_mm->context);
100 		up(&old_mm->context.sem);
101 	}
102 	return retval;
103 }
104 
105 /*
106  * No need to lock the MM as we are the last user
107  * Do not touch the ldt register, we are already
108  * in the next thread.
109  */
destroy_context(struct mm_struct * mm)110 void destroy_context(struct mm_struct *mm)
111 {
112 	if (mm->context.size) {
113 		if (mm->context.size*LDT_ENTRY_SIZE > PAGE_SIZE)
114 			vfree(mm->context.ldt);
115 		else
116 			kfree(mm->context.ldt);
117 		mm->context.size = 0;
118 	}
119 }
120 
read_ldt(void * ptr,unsigned long bytecount)121 static int read_ldt(void * ptr, unsigned long bytecount)
122 {
123 	int err;
124 	unsigned long size;
125 	struct mm_struct * mm = current->mm;
126 
127 	if (!mm->context.size)
128 		return 0;
129 	if (bytecount > LDT_ENTRY_SIZE*LDT_ENTRIES)
130 		bytecount = LDT_ENTRY_SIZE*LDT_ENTRIES;
131 
132 	down(&mm->context.sem);
133 	size = mm->context.size*LDT_ENTRY_SIZE;
134 	if (size > bytecount)
135 		size = bytecount;
136 
137 	err = 0;
138 	if (copy_to_user(ptr, mm->context.ldt, size))
139 		err = -EFAULT;
140 	up(&mm->context.sem);
141 	if (err < 0)
142 		return err;
143 	if (size != bytecount) {
144 		/* zero-fill the rest */
145 		clear_user(ptr+size, bytecount-size);
146 	}
147 	return bytecount;
148 }
149 
read_default_ldt(void * ptr,unsigned long bytecount)150 static int read_default_ldt(void * ptr, unsigned long bytecount)
151 {
152 	int err;
153 	unsigned long size;
154 	void *address;
155 
156 	err = 0;
157 	address = &default_ldt[0];
158 	size = 5*sizeof(struct desc_struct);
159 	if (size > bytecount)
160 		size = bytecount;
161 
162 	err = size;
163 	if (copy_to_user(ptr, address, size))
164 		err = -EFAULT;
165 
166 	return err;
167 }
168 
write_ldt(void * ptr,unsigned long bytecount,int oldmode)169 static int write_ldt(void * ptr, unsigned long bytecount, int oldmode)
170 {
171 	struct mm_struct * mm = current->mm;
172 	__u32 entry_1, entry_2, *lp;
173 	int error;
174 	struct modify_ldt_ldt_s ldt_info;
175 
176 	error = -EINVAL;
177 	if (bytecount != sizeof(ldt_info))
178 		goto out;
179 	error = -EFAULT;
180 	if (copy_from_user(&ldt_info, ptr, sizeof(ldt_info)))
181 		goto out;
182 
183 	error = -EINVAL;
184 	if (ldt_info.entry_number >= LDT_ENTRIES)
185 		goto out;
186 	if (ldt_info.contents == 3) {
187 		if (oldmode)
188 			goto out;
189 		if (ldt_info.seg_not_present == 0)
190 			goto out;
191 	}
192 
193 	down(&mm->context.sem);
194 	if (ldt_info.entry_number >= mm->context.size) {
195 		error = alloc_ldt(&current->mm->context, ldt_info.entry_number+1, 1);
196 		if (error < 0)
197 			goto out_unlock;
198 	}
199 
200 	lp = (__u32 *) ((ldt_info.entry_number << 3) + (char *) mm->context.ldt);
201 
202    	/* Allow LDTs to be cleared by the user. */
203    	if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
204 		if (oldmode ||
205 		    (ldt_info.contents == 0		&&
206 		     ldt_info.read_exec_only == 1	&&
207 		     ldt_info.seg_32bit == 0		&&
208 		     ldt_info.limit_in_pages == 0	&&
209 		     ldt_info.seg_not_present == 1	&&
210 		     ldt_info.useable == 0 )) {
211 			entry_1 = 0;
212 			entry_2 = 0;
213 			goto install;
214 		}
215 	}
216 
217 	entry_1 = ((ldt_info.base_addr & 0x0000ffff) << 16) |
218 		  (ldt_info.limit & 0x0ffff);
219 	entry_2 = (ldt_info.base_addr & 0xff000000) |
220 		  ((ldt_info.base_addr & 0x00ff0000) >> 16) |
221 		  (ldt_info.limit & 0xf0000) |
222 		  ((ldt_info.read_exec_only ^ 1) << 9) |
223 		  (ldt_info.contents << 10) |
224 		  ((ldt_info.seg_not_present ^ 1) << 15) |
225 		  (ldt_info.seg_32bit << 22) |
226 		  (ldt_info.limit_in_pages << 23) |
227 		  0x7000;
228 	if (!oldmode)
229 		entry_2 |= (ldt_info.useable << 20);
230 
231 	/* Install the new entry ...  */
232 install:
233 	*lp	= entry_1;
234 	*(lp+1)	= entry_2;
235 	error = 0;
236 
237 out_unlock:
238 	up(&mm->context.sem);
239 out:
240 	return error;
241 }
242 
sys_modify_ldt(int func,void * ptr,unsigned long bytecount)243 asmlinkage int sys_modify_ldt(int func, void *ptr, unsigned long bytecount)
244 {
245 	int ret = -ENOSYS;
246 
247 	switch (func) {
248 	case 0:
249 		ret = read_ldt(ptr, bytecount);
250 		break;
251 	case 1:
252 		ret = write_ldt(ptr, bytecount, 1);
253 		break;
254 	case 2:
255 		ret = read_default_ldt(ptr, bytecount);
256 		break;
257 	case 0x11:
258 		ret = write_ldt(ptr, bytecount, 0);
259 		break;
260 	}
261 	return ret;
262 }
263