vm86_32.c

  1// SPDX-License-Identifier: GPL-2.0
  2/*
  3 *  Copyright (C) 1994  Linus Torvalds
  4 *
  5 *  29 dec 2001 - Fixed oopses caused by unchecked access to the vm86
  6 *                stack - Manfred Spraul <manfred@colorfullife.com>
  7 *
  8 *  22 mar 2002 - Manfred detected the stackfaults, but didn't handle
  9 *                them correctly. Now the emulation will be in a
 10 *                consistent state after stackfaults - Kasper Dupont
 11 *                <kasperd@daimi.au.dk>
 12 *
 13 *  22 mar 2002 - Added missing clear_IF in set_vflags_* Kasper Dupont
 14 *                <kasperd@daimi.au.dk>
 15 *
 16 *  ?? ??? 2002 - Fixed premature returns from handle_vm86_fault
 17 *                caused by Kasper Dupont's changes - Stas Sergeev
 18 *
 19 *   4 apr 2002 - Fixed CHECK_IF_IN_TRAP broken by Stas' changes.
 20 *                Kasper Dupont <kasperd@daimi.au.dk>
 21 *
 22 *   9 apr 2002 - Changed syntax of macros in handle_vm86_fault.
 23 *                Kasper Dupont <kasperd@daimi.au.dk>
 24 *
 25 *   9 apr 2002 - Changed stack access macros to jump to a label
 26 *                instead of returning to userspace. This simplifies
 27 *                do_int, and is needed by handle_vm6_fault. Kasper
 28 *                Dupont <kasperd@daimi.au.dk>
 29 *
 30 */
 31
 32#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 33
 34#include <linux/capability.h>
 35#include <linux/errno.h>
 36#include <linux/interrupt.h>
 37#include <linux/syscalls.h>
 38#include <linux/sched.h>
 39#include <linux/sched/task_stack.h>
 40#include <linux/kernel.h>
 41#include <linux/signal.h>
 42#include <linux/string.h>
 43#include <linux/mm.h>
 44#include <linux/smp.h>
 45#include <linux/highmem.h>
 46#include <linux/ptrace.h>
 47#include <linux/audit.h>
 48#include <linux/stddef.h>
 49#include <linux/slab.h>
 50#include <linux/security.h>
 51
 52#include <linux/uaccess.h>
 53#include <asm/io.h>
 54#include <asm/tlbflush.h>
 55#include <asm/irq.h>
 56#include <asm/traps.h>
 57#include <asm/vm86.h>
 58#include <asm/switch_to.h>
 59
 60/*
 61 * Known problems:
 62 *
 63 * Interrupt handling is not guaranteed:
 64 * - a real x86 will disable all interrupts for one instruction
 65 *   after a "mov ss,xx" to make stack handling atomic even without
 66 *   the 'lss' instruction. We can't guarantee this in v86 mode,
 67 *   as the next instruction might result in a page fault or similar.
 68 * - a real x86 will have interrupts disabled for one instruction
 69 *   past the 'sti' that enables them. We don't bother with all the
 70 *   details yet.
 71 *
 72 * Let's hope these problems do not actually matter for anything.
 73 */
 74
 75
 76/*
 77 * 8- and 16-bit register defines..
 78 */
 79#define AL(regs)	(((unsigned char *)&((regs)->pt.ax))[0])
 80#define AH(regs)	(((unsigned char *)&((regs)->pt.ax))[1])
 81#define IP(regs)	(*(unsigned short *)&((regs)->pt.ip))
 82#define SP(regs)	(*(unsigned short *)&((regs)->pt.sp))
 83
 84/*
 85 * virtual flags (16 and 32-bit versions)
 86 */
 87#define VFLAGS	(*(unsigned short *)&(current->thread.vm86->veflags))
 88#define VEFLAGS	(current->thread.vm86->veflags)
 89
 90#define set_flags(X, new, mask) \
 91((X) = ((X) & ~(mask)) | ((new) & (mask)))
 92
 93#define SAFE_MASK	(0xDD5)
 94#define RETURN_MASK	(0xDFF)
 95
 96void save_v86_state(struct kernel_vm86_regs *regs, int retval)
 97{
 98	struct task_struct *tsk = current;
 99	struct vm86plus_struct __user *user;
100	struct vm86 *vm86 = current->thread.vm86;
101
102	/*
103	 * This gets called from entry.S with interrupts disabled, but
104	 * from process context. Enable interrupts here, before trying
105	 * to access user space.
106	 */
107	local_irq_enable();
108
109	BUG_ON(!vm86);
110
111	set_flags(regs->pt.flags, VEFLAGS, X86_EFLAGS_VIF | vm86->veflags_mask);
112	user = vm86->user_vm86;
113
114	if (!user_access_begin(user, vm86->vm86plus.is_vm86pus ?
115		       sizeof(struct vm86plus_struct) :
116		       sizeof(struct vm86_struct)))
117		goto Efault;
118
119	unsafe_put_user(regs->pt.bx, &user->regs.ebx, Efault_end);
120	unsafe_put_user(regs->pt.cx, &user->regs.ecx, Efault_end);
121	unsafe_put_user(regs->pt.dx, &user->regs.edx, Efault_end);
122	unsafe_put_user(regs->pt.si, &user->regs.esi, Efault_end);
123	unsafe_put_user(regs->pt.di, &user->regs.edi, Efault_end);
124	unsafe_put_user(regs->pt.bp, &user->regs.ebp, Efault_end);
125	unsafe_put_user(regs->pt.ax, &user->regs.eax, Efault_end);
126	unsafe_put_user(regs->pt.ip, &user->regs.eip, Efault_end);
127	unsafe_put_user(regs->pt.cs, &user->regs.cs, Efault_end);
128	unsafe_put_user(regs->pt.flags, &user->regs.eflags, Efault_end);
129	unsafe_put_user(regs->pt.sp, &user->regs.esp, Efault_end);
130	unsafe_put_user(regs->pt.ss, &user->regs.ss, Efault_end);
131	unsafe_put_user(regs->es, &user->regs.es, Efault_end);
132	unsafe_put_user(regs->ds, &user->regs.ds, Efault_end);
133	unsafe_put_user(regs->fs, &user->regs.fs, Efault_end);
134	unsafe_put_user(regs->gs, &user->regs.gs, Efault_end);
135
136	/*
137	 * Don't write screen_bitmap in case some user had a value there
138	 * and expected it to remain unchanged.
139	 */
140
141	user_access_end();
142
143exit_vm86:
144	preempt_disable();
145	tsk->thread.sp0 = vm86->saved_sp0;
146	tsk->thread.sysenter_cs = __KERNEL_CS;
147	update_task_stack(tsk);
148	refresh_sysenter_cs(&tsk->thread);
149	vm86->saved_sp0 = 0;
150	preempt_enable();
151
152	memcpy(&regs->pt, &vm86->regs32, sizeof(struct pt_regs));
153
154	loadsegment(gs, vm86->regs32.gs);
155
156	regs->pt.ax = retval;
157	return;
158
159Efault_end:
160	user_access_end();
161Efault:
162	pr_alert("could not access userspace vm86 info\n");
163	force_exit_sig(SIGSEGV);
164	goto exit_vm86;
165}
166
167static int do_vm86_irq_handling(int subfunction, int irqnumber);
168static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus);
169
170SYSCALL_DEFINE1(vm86old, struct vm86_struct __user *, user_vm86)
171{
172	return do_sys_vm86((struct vm86plus_struct __user *) user_vm86, false);
173}
174
175
176SYSCALL_DEFINE2(vm86, unsigned long, cmd, unsigned long, arg)
177{
178	switch (cmd) {
179	case VM86_REQUEST_IRQ:
180	case VM86_FREE_IRQ:
181	case VM86_GET_IRQ_BITS:
182	case VM86_GET_AND_RESET_IRQ:
183		return do_vm86_irq_handling(cmd, (int)arg);
184	case VM86_PLUS_INSTALL_CHECK:
185		/*
186		 * NOTE: on old vm86 stuff this will return the error
187		 *  from access_ok(), because the subfunction is
188		 *  interpreted as (invalid) address to vm86_struct.
189		 *  So the installation check works.
190		 */
191		return 0;
192	}
193
194	/* we come here only for functions VM86_ENTER, VM86_ENTER_NO_BYPASS */
195	return do_sys_vm86((struct vm86plus_struct __user *) arg, true);
196}
197
198
199static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus)
200{
201	struct task_struct *tsk = current;
202	struct vm86 *vm86 = tsk->thread.vm86;
203	struct kernel_vm86_regs vm86regs;
204	struct pt_regs *regs = current_pt_regs();
205	unsigned long err = 0;
206	struct vm86_struct v;
207
208	err = security_mmap_addr(0);
209	if (err) {
210		/*
211		 * vm86 cannot virtualize the address space, so vm86 users
212		 * need to manage the low 1MB themselves using mmap.  Given
213		 * that BIOS places important data in the first page, vm86
214		 * is essentially useless if mmap_min_addr != 0.  DOSEMU,
215		 * for example, won't even bother trying to use vm86 if it
216		 * can't map a page at virtual address 0.
217		 *
218		 * To reduce the available kernel attack surface, simply
219		 * disallow vm86(old) for users who cannot mmap at va 0.
220		 *
221		 * The implementation of security_mmap_addr will allow
222		 * suitably privileged users to map va 0 even if
223		 * vm.mmap_min_addr is set above 0, and we want this
224		 * behavior for vm86 as well, as it ensures that legacy
225		 * tools like vbetool will not fail just because of
226		 * vm.mmap_min_addr.
227		 */
228		pr_info_once("Denied a call to vm86(old) from %s[%d] (uid: %d).  Set the vm.mmap_min_addr sysctl to 0 and/or adjust LSM mmap_min_addr policy to enable vm86 if you are using a vm86-based DOS emulator.\n",
229			     current->comm, task_pid_nr(current),
230			     from_kuid_munged(&init_user_ns, current_uid()));
231		return -EPERM;
232	}
233
234	if (!vm86) {
235		if (!(vm86 = kzalloc(sizeof(*vm86), GFP_KERNEL)))
236			return -ENOMEM;
237		tsk->thread.vm86 = vm86;
238	}
239	if (vm86->saved_sp0)
240		return -EPERM;
241
242	if (copy_from_user(&v, user_vm86,
243			offsetof(struct vm86_struct, int_revectored)))
244		return -EFAULT;
245
246
247	/* VM86_SCREEN_BITMAP had numerous bugs and appears to have no users. */
248	if (v.flags & VM86_SCREEN_BITMAP) {
249		pr_info_once("vm86: '%s' uses VM86_SCREEN_BITMAP, which is no longer supported\n",
250			     current->comm);
251		return -EINVAL;
252	}
253
254	memset(&vm86regs, 0, sizeof(vm86regs));
255
256	vm86regs.pt.bx = v.regs.ebx;
257	vm86regs.pt.cx = v.regs.ecx;
258	vm86regs.pt.dx = v.regs.edx;
259	vm86regs.pt.si = v.regs.esi;
260	vm86regs.pt.di = v.regs.edi;
261	vm86regs.pt.bp = v.regs.ebp;
262	vm86regs.pt.ax = v.regs.eax;
263	vm86regs.pt.ip = v.regs.eip;
264	vm86regs.pt.cs = v.regs.cs;
265	vm86regs.pt.flags = v.regs.eflags;
266	vm86regs.pt.sp = v.regs.esp;
267	vm86regs.pt.ss = v.regs.ss;
268	vm86regs.es = v.regs.es;
269	vm86regs.ds = v.regs.ds;
270	vm86regs.fs = v.regs.fs;
271	vm86regs.gs = v.regs.gs;
272
273	vm86->flags = v.flags;
274	vm86->cpu_type = v.cpu_type;
275
276	if (copy_from_user(&vm86->int_revectored,
277			   &user_vm86->int_revectored,
278			   sizeof(struct revectored_struct)))
279		return -EFAULT;
280	if (copy_from_user(&vm86->int21_revectored,
281			   &user_vm86->int21_revectored,
282			   sizeof(struct revectored_struct)))
283		return -EFAULT;
284	if (plus) {
285		if (copy_from_user(&vm86->vm86plus, &user_vm86->vm86plus,
286				   sizeof(struct vm86plus_info_struct)))
287			return -EFAULT;
288		vm86->vm86plus.is_vm86pus = 1;
289	} else
290		memset(&vm86->vm86plus, 0,
291		       sizeof(struct vm86plus_info_struct));
292
293	memcpy(&vm86->regs32, regs, sizeof(struct pt_regs));
294	vm86->user_vm86 = user_vm86;
295
296/*
297 * The flags register is also special: we cannot trust that the user
298 * has set it up safely, so this makes sure interrupt etc flags are
299 * inherited from protected mode.
300 */
301	VEFLAGS = vm86regs.pt.flags;
302	vm86regs.pt.flags &= SAFE_MASK;
303	vm86regs.pt.flags |= regs->flags & ~SAFE_MASK;
304	vm86regs.pt.flags |= X86_VM_MASK;
305
306	vm86regs.pt.orig_ax = regs->orig_ax;
307
308	switch (vm86->cpu_type) {
309	case CPU_286:
310		vm86->veflags_mask = 0;
311		break;
312	case CPU_386:
313		vm86->veflags_mask = X86_EFLAGS_NT | X86_EFLAGS_IOPL;
314		break;
315	case CPU_486:
316		vm86->veflags_mask = X86_EFLAGS_AC | X86_EFLAGS_NT | X86_EFLAGS_IOPL;
317		break;
318	default:
319		vm86->veflags_mask = X86_EFLAGS_ID | X86_EFLAGS_AC | X86_EFLAGS_NT | X86_EFLAGS_IOPL;
320		break;
321	}
322
323/*
324 * Save old state
325 */
326	vm86->saved_sp0 = tsk->thread.sp0;
327	savesegment(gs, vm86->regs32.gs);
328
329	/* make room for real-mode segments */
330	preempt_disable();
331	tsk->thread.sp0 += 16;
332
333	if (boot_cpu_has(X86_FEATURE_SEP)) {
334		tsk->thread.sysenter_cs = 0;
335		refresh_sysenter_cs(&tsk->thread);
336	}
337
338	update_task_stack(tsk);
339	preempt_enable();
340
341	memcpy((struct kernel_vm86_regs *)regs, &vm86regs, sizeof(vm86regs));
342	return regs->ax;
343}
344
345static inline void set_IF(struct kernel_vm86_regs *regs)
346{
347	VEFLAGS |= X86_EFLAGS_VIF;
348}
349
350static inline void clear_IF(struct kernel_vm86_regs *regs)
351{
352	VEFLAGS &= ~X86_EFLAGS_VIF;
353}
354
355static inline void clear_TF(struct kernel_vm86_regs *regs)
356{
357	regs->pt.flags &= ~X86_EFLAGS_TF;
358}
359
360static inline void clear_AC(struct kernel_vm86_regs *regs)
361{
362	regs->pt.flags &= ~X86_EFLAGS_AC;
363}
364
365/*
366 * It is correct to call set_IF(regs) from the set_vflags_*
367 * functions. However someone forgot to call clear_IF(regs)
368 * in the opposite case.
369 * After the command sequence CLI PUSHF STI POPF you should
370 * end up with interrupts disabled, but you ended up with
371 * interrupts enabled.
372 *  ( I was testing my own changes, but the only bug I
373 *    could find was in a function I had not changed. )
374 * [KD]
375 */
376
377static inline void set_vflags_long(unsigned long flags, struct kernel_vm86_regs *regs)
378{
379	set_flags(VEFLAGS, flags, current->thread.vm86->veflags_mask);
380	set_flags(regs->pt.flags, flags, SAFE_MASK);
381	if (flags & X86_EFLAGS_IF)
382		set_IF(regs);
383	else
384		clear_IF(regs);
385}
386
387static inline void set_vflags_short(unsigned short flags, struct kernel_vm86_regs *regs)
388{
389	set_flags(VFLAGS, flags, current->thread.vm86->veflags_mask);
390	set_flags(regs->pt.flags, flags, SAFE_MASK);
391	if (flags & X86_EFLAGS_IF)
392		set_IF(regs);
393	else
394		clear_IF(regs);
395}
396
397static inline unsigned long get_vflags(struct kernel_vm86_regs *regs)
398{
399	unsigned long flags = regs->pt.flags & RETURN_MASK;
400
401	if (VEFLAGS & X86_EFLAGS_VIF)
402		flags |= X86_EFLAGS_IF;
403	flags |= X86_EFLAGS_IOPL;
404	return flags | (VEFLAGS & current->thread.vm86->veflags_mask);
405}
406
407static inline int is_revectored(int nr, struct revectored_struct *bitmap)
408{
409	return test_bit(nr, bitmap->__map);
410}
411
412#define val_byte(val, n) (((__u8 *)&val)[n])
413
414#define pushb(base, ptr, val, err_label) \
415	do { \
416		__u8 __val = val; \
417		ptr--; \
418		if (put_user(__val, base + ptr) < 0) \
419			goto err_label; \
420	} while (0)
421
422#define pushw(base, ptr, val, err_label) \
423	do { \
424		__u16 __val = val; \
425		ptr--; \
426		if (put_user(val_byte(__val, 1), base + ptr) < 0) \
427			goto err_label; \
428		ptr--; \
429		if (put_user(val_byte(__val, 0), base + ptr) < 0) \
430			goto err_label; \
431	} while (0)
432
433#define pushl(base, ptr, val, err_label) \
434	do { \
435		__u32 __val = val; \
436		ptr--; \
437		if (put_user(val_byte(__val, 3), base + ptr) < 0) \
438			goto err_label; \
439		ptr--; \
440		if (put_user(val_byte(__val, 2), base + ptr) < 0) \
441			goto err_label; \
442		ptr--; \
443		if (put_user(val_byte(__val, 1), base + ptr) < 0) \
444			goto err_label; \
445		ptr--; \
446		if (put_user(val_byte(__val, 0), base + ptr) < 0) \
447			goto err_label; \
448	} while (0)
449
450#define popb(base, ptr, err_label) \
451	({ \
452		__u8 __res; \
453		if (get_user(__res, base + ptr) < 0) \
454			goto err_label; \
455		ptr++; \
456		__res; \
457	})
458
459#define popw(base, ptr, err_label) \
460	({ \
461		__u16 __res; \
462		if (get_user(val_byte(__res, 0), base + ptr) < 0) \
463			goto err_label; \
464		ptr++; \
465		if (get_user(val_byte(__res, 1), base + ptr) < 0) \
466			goto err_label; \
467		ptr++; \
468		__res; \
469	})
470
471#define popl(base, ptr, err_label) \
472	({ \
473		__u32 __res; \
474		if (get_user(val_byte(__res, 0), base + ptr) < 0) \
475			goto err_label; \
476		ptr++; \
477		if (get_user(val_byte(__res, 1), base + ptr) < 0) \
478			goto err_label; \
479		ptr++; \
480		if (get_user(val_byte(__res, 2), base + ptr) < 0) \
481			goto err_label; \
482		ptr++; \
483		if (get_user(val_byte(__res, 3), base + ptr) < 0) \
484			goto err_label; \
485		ptr++; \
486		__res; \
487	})
488
489/* There are so many possible reasons for this function to return
490 * VM86_INTx, so adding another doesn't bother me. We can expect
491 * userspace programs to be able to handle it. (Getting a problem
492 * in userspace is always better than an Oops anyway.) [KD]
493 */
494static void do_int(struct kernel_vm86_regs *regs, int i,
495    unsigned char __user *ssp, unsigned short sp)
496{
497	unsigned long __user *intr_ptr;
498	unsigned long segoffs;
499	struct vm86 *vm86 = current->thread.vm86;
500
501	if (regs->pt.cs == BIOSSEG)
502		goto cannot_handle;
503	if (is_revectored(i, &vm86->int_revectored))
504		goto cannot_handle;
505	if (i == 0x21 && is_revectored(AH(regs), &vm86->int21_revectored))
506		goto cannot_handle;
507	intr_ptr = (unsigned long __user *) (i << 2);
508	if (get_user(segoffs, intr_ptr))
509		goto cannot_handle;
510	if ((segoffs >> 16) == BIOSSEG)
511		goto cannot_handle;
512	pushw(ssp, sp, get_vflags(regs), cannot_handle);
513	pushw(ssp, sp, regs->pt.cs, cannot_handle);
514	pushw(ssp, sp, IP(regs), cannot_handle);
515	regs->pt.cs = segoffs >> 16;
516	SP(regs) -= 6;
517	IP(regs) = segoffs & 0xffff;
518	clear_TF(regs);
519	clear_IF(regs);
520	clear_AC(regs);
521	return;
522
523cannot_handle:
524	save_v86_state(regs, VM86_INTx + (i << 8));
525}
526
527int handle_vm86_trap(struct kernel_vm86_regs *regs, long error_code, int trapno)
528{
529	struct vm86 *vm86 = current->thread.vm86;
530
531	if (vm86->vm86plus.is_vm86pus) {
532		if ((trapno == 3) || (trapno == 1)) {
533			save_v86_state(regs, VM86_TRAP + (trapno << 8));
534			return 0;
535		}
536		do_int(regs, trapno, (unsigned char __user *) (regs->pt.ss << 4), SP(regs));
537		return 0;
538	}
539	if (trapno != 1)
540		return 1; /* we let this handle by the calling routine */
541	current->thread.trap_nr = trapno;
542	current->thread.error_code = error_code;
543	force_sig(SIGTRAP);
544	return 0;
545}
546
547void handle_vm86_fault(struct kernel_vm86_regs *regs, long error_code)
548{
549	unsigned char opcode;
550	unsigned char __user *csp;
551	unsigned char __user *ssp;
552	unsigned short ip, sp, orig_flags;
553	int data32, pref_done;
554	struct vm86plus_info_struct *vmpi = &current->thread.vm86->vm86plus;
555
556#define CHECK_IF_IN_TRAP \
557	if (vmpi->vm86dbg_active && vmpi->vm86dbg_TFpendig) \
558		newflags |= X86_EFLAGS_TF
559
560	orig_flags = *(unsigned short *)&regs->pt.flags;
561
562	csp = (unsigned char __user *) (regs->pt.cs << 4);
563	ssp = (unsigned char __user *) (regs->pt.ss << 4);
564	sp = SP(regs);
565	ip = IP(regs);
566
567	data32 = 0;
568	pref_done = 0;
569	do {
570		switch (opcode = popb(csp, ip, simulate_sigsegv)) {
571		case 0x66:      /* 32-bit data */     data32 = 1; break;
572		case 0x67:      /* 32-bit address */  break;
573		case 0x2e:      /* CS */              break;
574		case 0x3e:      /* DS */              break;
575		case 0x26:      /* ES */              break;
576		case 0x36:      /* SS */              break;
577		case 0x65:      /* GS */              break;
578		case 0x64:      /* FS */              break;
579		case 0xf2:      /* repnz */       break;
580		case 0xf3:      /* rep */             break;
581		default: pref_done = 1;
582		}
583	} while (!pref_done);
584
585	switch (opcode) {
586
587	/* pushf */
588	case 0x9c:
589		if (data32) {
590			pushl(ssp, sp, get_vflags(regs), simulate_sigsegv);
591			SP(regs) -= 4;
592		} else {
593			pushw(ssp, sp, get_vflags(regs), simulate_sigsegv);
594			SP(regs) -= 2;
595		}
596		IP(regs) = ip;
597		goto vm86_fault_return;
598
599	/* popf */
600	case 0x9d:
601		{
602		unsigned long newflags;
603		if (data32) {
604			newflags = popl(ssp, sp, simulate_sigsegv);
605			SP(regs) += 4;
606		} else {
607			newflags = popw(ssp, sp, simulate_sigsegv);
608			SP(regs) += 2;
609		}
610		IP(regs) = ip;
611		CHECK_IF_IN_TRAP;
612		if (data32)
613			set_vflags_long(newflags, regs);
614		else
615			set_vflags_short(newflags, regs);
616
617		goto check_vip;
618		}
619
620	/* int xx */
621	case 0xcd: {
622		int intno = popb(csp, ip, simulate_sigsegv);
623		IP(regs) = ip;
624		if (vmpi->vm86dbg_active) {
625			if ((1 << (intno & 7)) & vmpi->vm86dbg_intxxtab[intno >> 3]) {
626				save_v86_state(regs, VM86_INTx + (intno << 8));
627				return;
628			}
629		}
630		do_int(regs, intno, ssp, sp);
631		return;
632	}
633
634	/* iret */
635	case 0xcf:
636		{
637		unsigned long newip;
638		unsigned long newcs;
639		unsigned long newflags;
640		if (data32) {
641			newip = popl(ssp, sp, simulate_sigsegv);
642			newcs = popl(ssp, sp, simulate_sigsegv);
643			newflags = popl(ssp, sp, simulate_sigsegv);
644			SP(regs) += 12;
645		} else {
646			newip = popw(ssp, sp, simulate_sigsegv);
647			newcs = popw(ssp, sp, simulate_sigsegv);
648			newflags = popw(ssp, sp, simulate_sigsegv);
649			SP(regs) += 6;
650		}
651		IP(regs) = newip;
652		regs->pt.cs = newcs;
653		CHECK_IF_IN_TRAP;
654		if (data32) {
655			set_vflags_long(newflags, regs);
656		} else {
657			set_vflags_short(newflags, regs);
658		}
659		goto check_vip;
660		}
661
662	/* cli */
663	case 0xfa:
664		IP(regs) = ip;
665		clear_IF(regs);
666		goto vm86_fault_return;
667
668	/* sti */
669	/*
670	 * Damn. This is incorrect: the 'sti' instruction should actually
671	 * enable interrupts after the /next/ instruction. Not good.
672	 *
673	 * Probably needs some horsing around with the TF flag. Aiee..
674	 */
675	case 0xfb:
676		IP(regs) = ip;
677		set_IF(regs);
678		goto check_vip;
679
680	default:
681		save_v86_state(regs, VM86_UNKNOWN);
682	}
683
684	return;
685
686check_vip:
687	if ((VEFLAGS & (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) ==
688	    (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) {
689		save_v86_state(regs, VM86_STI);
690		return;
691	}
692
693vm86_fault_return:
694	if (vmpi->force_return_for_pic  && (VEFLAGS & (X86_EFLAGS_IF | X86_EFLAGS_VIF))) {
695		save_v86_state(regs, VM86_PICRETURN);
696		return;
697	}
698	if (orig_flags & X86_EFLAGS_TF)
699		handle_vm86_trap(regs, 0, X86_TRAP_DB);
700	return;
701
702simulate_sigsegv:
703	/* FIXME: After a long discussion with Stas we finally
704	 *        agreed, that this is wrong. Here we should
705	 *        really send a SIGSEGV to the user program.
706	 *        But how do we create the correct context? We
707	 *        are inside a general protection fault handler
708	 *        and has just returned from a page fault handler.
709	 *        The correct context for the signal handler
710	 *        should be a mixture of the two, but how do we
711	 *        get the information? [KD]
712	 */
713	save_v86_state(regs, VM86_UNKNOWN);
714}
715
716/* ---------------- vm86 special IRQ passing stuff ----------------- */
717
718#define VM86_IRQNAME		"vm86irq"
719
720static struct vm86_irqs {
721	struct task_struct *tsk;
722	int sig;
723} vm86_irqs[16];
724
725static DEFINE_SPINLOCK(irqbits_lock);
726static int irqbits;
727
728#define ALLOWED_SIGS (1 /* 0 = don't send a signal */ \
729	| (1 << SIGUSR1) | (1 << SIGUSR2) | (1 << SIGIO)  | (1 << SIGURG) \
730	| (1 << SIGUNUSED))
731
732static irqreturn_t irq_handler(int intno, void *dev_id)
733{
734	int irq_bit;
735	unsigned long flags;
736
737	spin_lock_irqsave(&irqbits_lock, flags);
738	irq_bit = 1 << intno;
739	if ((irqbits & irq_bit) || !vm86_irqs[intno].tsk)
740		goto out;
741	irqbits |= irq_bit;
742	if (vm86_irqs[intno].sig)
743		send_sig(vm86_irqs[intno].sig, vm86_irqs[intno].tsk, 1);
744	/*
745	 * IRQ will be re-enabled when user asks for the irq (whether
746	 * polling or as a result of the signal)
747	 */
748	disable_irq_nosync(intno);
749	spin_unlock_irqrestore(&irqbits_lock, flags);
750	return IRQ_HANDLED;
751
752out:
753	spin_unlock_irqrestore(&irqbits_lock, flags);
754	return IRQ_NONE;
755}
756
757static inline void free_vm86_irq(int irqnumber)
758{
759	unsigned long flags;
760
761	free_irq(irqnumber, NULL);
762	vm86_irqs[irqnumber].tsk = NULL;
763
764	spin_lock_irqsave(&irqbits_lock, flags);
765	irqbits &= ~(1 << irqnumber);
766	spin_unlock_irqrestore(&irqbits_lock, flags);
767}
768
769void release_vm86_irqs(struct task_struct *task)
770{
771	int i;
772	for (i = FIRST_VM86_IRQ ; i <= LAST_VM86_IRQ; i++)
773	    if (vm86_irqs[i].tsk == task)
774		free_vm86_irq(i);
775}
776
777static inline int get_and_reset_irq(int irqnumber)
778{
779	int bit;
780	unsigned long flags;
781	int ret = 0;
782
783	if (invalid_vm86_irq(irqnumber)) return 0;
784	if (vm86_irqs[irqnumber].tsk != current) return 0;
785	spin_lock_irqsave(&irqbits_lock, flags);
786	bit = irqbits & (1 << irqnumber);
787	irqbits &= ~bit;
788	if (bit) {
789		enable_irq(irqnumber);
790		ret = 1;
791	}
792
793	spin_unlock_irqrestore(&irqbits_lock, flags);
794	return ret;
795}
796
797
798static int do_vm86_irq_handling(int subfunction, int irqnumber)
799{
800	int ret;
801	switch (subfunction) {
802		case VM86_GET_AND_RESET_IRQ: {
803			return get_and_reset_irq(irqnumber);
804		}
805		case VM86_GET_IRQ_BITS: {
806			return irqbits;
807		}
808		case VM86_REQUEST_IRQ: {
809			int sig = irqnumber >> 8;
810			int irq = irqnumber & 255;
811			if (!capable(CAP_SYS_ADMIN)) return -EPERM;
812			if (!((1 << sig) & ALLOWED_SIGS)) return -EPERM;
813			if (invalid_vm86_irq(irq)) return -EPERM;
814			if (vm86_irqs[irq].tsk) return -EPERM;
815			ret = request_irq(irq, &irq_handler, 0, VM86_IRQNAME, NULL);
816			if (ret) return ret;
817			vm86_irqs[irq].sig = sig;
818			vm86_irqs[irq].tsk = current;
819			return irq;
820		}
821		case  VM86_FREE_IRQ: {
822			if (invalid_vm86_irq(irqnumber)) return -EPERM;
823			if (!vm86_irqs[irqnumber].tsk) return 0;
824			if (vm86_irqs[irqnumber].tsk != current) return -EPERM;
825			free_vm86_irq(irqnumber);
826			return 0;
827		}
828	}
829	return -EINVAL;
830}
831