xref: /openbmc/linux/arch/x86/kernel/vm86_32.c (revision b6dcefde)
1 /*
2  *  Copyright (C) 1994  Linus Torvalds
3  *
4  *  29 dec 2001 - Fixed oopses caused by unchecked access to the vm86
5  *                stack - Manfred Spraul <manfred@colorfullife.com>
6  *
7  *  22 mar 2002 - Manfred detected the stackfaults, but didn't handle
8  *                them correctly. Now the emulation will be in a
9  *                consistent state after stackfaults - Kasper Dupont
10  *                <kasperd@daimi.au.dk>
11  *
12  *  22 mar 2002 - Added missing clear_IF in set_vflags_* Kasper Dupont
13  *                <kasperd@daimi.au.dk>
14  *
15  *  ?? ??? 2002 - Fixed premature returns from handle_vm86_fault
16  *                caused by Kasper Dupont's changes - Stas Sergeev
17  *
18  *   4 apr 2002 - Fixed CHECK_IF_IN_TRAP broken by Stas' changes.
19  *                Kasper Dupont <kasperd@daimi.au.dk>
20  *
21  *   9 apr 2002 - Changed syntax of macros in handle_vm86_fault.
22  *                Kasper Dupont <kasperd@daimi.au.dk>
23  *
24  *   9 apr 2002 - Changed stack access macros to jump to a label
25  *                instead of returning to userspace. This simplifies
26  *                do_int, and is needed by handle_vm6_fault. Kasper
27  *                Dupont <kasperd@daimi.au.dk>
28  *
29  */
30 
31 #include <linux/capability.h>
32 #include <linux/errno.h>
33 #include <linux/interrupt.h>
34 #include <linux/sched.h>
35 #include <linux/kernel.h>
36 #include <linux/signal.h>
37 #include <linux/string.h>
38 #include <linux/mm.h>
39 #include <linux/smp.h>
40 #include <linux/highmem.h>
41 #include <linux/ptrace.h>
42 #include <linux/audit.h>
43 #include <linux/stddef.h>
44 
45 #include <asm/uaccess.h>
46 #include <asm/io.h>
47 #include <asm/tlbflush.h>
48 #include <asm/irq.h>
49 #include <asm/syscalls.h>
50 
51 /*
52  * Known problems:
53  *
54  * Interrupt handling is not guaranteed:
55  * - a real x86 will disable all interrupts for one instruction
56  *   after a "mov ss,xx" to make stack handling atomic even without
57  *   the 'lss' instruction. We can't guarantee this in v86 mode,
58  *   as the next instruction might result in a page fault or similar.
59  * - a real x86 will have interrupts disabled for one instruction
60  *   past the 'sti' that enables them. We don't bother with all the
61  *   details yet.
62  *
63  * Let's hope these problems do not actually matter for anything.
64  */
65 
66 
67 #define KVM86	((struct kernel_vm86_struct *)regs)
68 #define VMPI	KVM86->vm86plus
69 
70 
71 /*
72  * 8- and 16-bit register defines..
73  */
74 #define AL(regs)	(((unsigned char *)&((regs)->pt.ax))[0])
75 #define AH(regs)	(((unsigned char *)&((regs)->pt.ax))[1])
76 #define IP(regs)	(*(unsigned short *)&((regs)->pt.ip))
77 #define SP(regs)	(*(unsigned short *)&((regs)->pt.sp))
78 
79 /*
80  * virtual flags (16 and 32-bit versions)
81  */
82 #define VFLAGS	(*(unsigned short *)&(current->thread.v86flags))
83 #define VEFLAGS	(current->thread.v86flags)
84 
85 #define set_flags(X, new, mask) \
86 ((X) = ((X) & ~(mask)) | ((new) & (mask)))
87 
88 #define SAFE_MASK	(0xDD5)
89 #define RETURN_MASK	(0xDFF)
90 
91 /* convert kernel_vm86_regs to vm86_regs */
92 static int copy_vm86_regs_to_user(struct vm86_regs __user *user,
93 				  const struct kernel_vm86_regs *regs)
94 {
95 	int ret = 0;
96 
97 	/*
98 	 * kernel_vm86_regs is missing gs, so copy everything up to
99 	 * (but not including) orig_eax, and then rest including orig_eax.
100 	 */
101 	ret += copy_to_user(user, regs, offsetof(struct kernel_vm86_regs, pt.orig_ax));
102 	ret += copy_to_user(&user->orig_eax, &regs->pt.orig_ax,
103 			    sizeof(struct kernel_vm86_regs) -
104 			    offsetof(struct kernel_vm86_regs, pt.orig_ax));
105 
106 	return ret;
107 }
108 
109 /* convert vm86_regs to kernel_vm86_regs */
110 static int copy_vm86_regs_from_user(struct kernel_vm86_regs *regs,
111 				    const struct vm86_regs __user *user,
112 				    unsigned extra)
113 {
114 	int ret = 0;
115 
116 	/* copy ax-fs inclusive */
117 	ret += copy_from_user(regs, user, offsetof(struct kernel_vm86_regs, pt.orig_ax));
118 	/* copy orig_ax-__gsh+extra */
119 	ret += copy_from_user(&regs->pt.orig_ax, &user->orig_eax,
120 			      sizeof(struct kernel_vm86_regs) -
121 			      offsetof(struct kernel_vm86_regs, pt.orig_ax) +
122 			      extra);
123 	return ret;
124 }
125 
126 struct pt_regs *save_v86_state(struct kernel_vm86_regs *regs)
127 {
128 	struct tss_struct *tss;
129 	struct pt_regs *ret;
130 	unsigned long tmp;
131 
132 	/*
133 	 * This gets called from entry.S with interrupts disabled, but
134 	 * from process context. Enable interrupts here, before trying
135 	 * to access user space.
136 	 */
137 	local_irq_enable();
138 
139 	if (!current->thread.vm86_info) {
140 		printk("no vm86_info: BAD\n");
141 		do_exit(SIGSEGV);
142 	}
143 	set_flags(regs->pt.flags, VEFLAGS, X86_EFLAGS_VIF | current->thread.v86mask);
144 	tmp = copy_vm86_regs_to_user(&current->thread.vm86_info->regs, regs);
145 	tmp += put_user(current->thread.screen_bitmap, &current->thread.vm86_info->screen_bitmap);
146 	if (tmp) {
147 		printk("vm86: could not access userspace vm86_info\n");
148 		do_exit(SIGSEGV);
149 	}
150 
151 	tss = &per_cpu(init_tss, get_cpu());
152 	current->thread.sp0 = current->thread.saved_sp0;
153 	current->thread.sysenter_cs = __KERNEL_CS;
154 	load_sp0(tss, &current->thread);
155 	current->thread.saved_sp0 = 0;
156 	put_cpu();
157 
158 	ret = KVM86->regs32;
159 
160 	ret->fs = current->thread.saved_fs;
161 	set_user_gs(ret, current->thread.saved_gs);
162 
163 	return ret;
164 }
165 
166 static void mark_screen_rdonly(struct mm_struct *mm)
167 {
168 	pgd_t *pgd;
169 	pud_t *pud;
170 	pmd_t *pmd;
171 	pte_t *pte;
172 	spinlock_t *ptl;
173 	int i;
174 
175 	pgd = pgd_offset(mm, 0xA0000);
176 	if (pgd_none_or_clear_bad(pgd))
177 		goto out;
178 	pud = pud_offset(pgd, 0xA0000);
179 	if (pud_none_or_clear_bad(pud))
180 		goto out;
181 	pmd = pmd_offset(pud, 0xA0000);
182 	if (pmd_none_or_clear_bad(pmd))
183 		goto out;
184 	pte = pte_offset_map_lock(mm, pmd, 0xA0000, &ptl);
185 	for (i = 0; i < 32; i++) {
186 		if (pte_present(*pte))
187 			set_pte(pte, pte_wrprotect(*pte));
188 		pte++;
189 	}
190 	pte_unmap_unlock(pte, ptl);
191 out:
192 	flush_tlb();
193 }
194 
195 
196 
197 static int do_vm86_irq_handling(int subfunction, int irqnumber);
198 static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk);
199 
200 int sys_vm86old(struct vm86_struct __user *v86, struct pt_regs *regs)
201 {
202 	struct kernel_vm86_struct info; /* declare this _on top_,
203 					 * this avoids wasting of stack space.
204 					 * This remains on the stack until we
205 					 * return to 32 bit user space.
206 					 */
207 	struct task_struct *tsk;
208 	int tmp, ret = -EPERM;
209 
210 	tsk = current;
211 	if (tsk->thread.saved_sp0)
212 		goto out;
213 	tmp = copy_vm86_regs_from_user(&info.regs, &v86->regs,
214 				       offsetof(struct kernel_vm86_struct, vm86plus) -
215 				       sizeof(info.regs));
216 	ret = -EFAULT;
217 	if (tmp)
218 		goto out;
219 	memset(&info.vm86plus, 0, (int)&info.regs32 - (int)&info.vm86plus);
220 	info.regs32 = regs;
221 	tsk->thread.vm86_info = v86;
222 	do_sys_vm86(&info, tsk);
223 	ret = 0;	/* we never return here */
224 out:
225 	return ret;
226 }
227 
228 
229 int sys_vm86(unsigned long cmd, unsigned long arg, struct pt_regs *regs)
230 {
231 	struct kernel_vm86_struct info; /* declare this _on top_,
232 					 * this avoids wasting of stack space.
233 					 * This remains on the stack until we
234 					 * return to 32 bit user space.
235 					 */
236 	struct task_struct *tsk;
237 	int tmp, ret;
238 	struct vm86plus_struct __user *v86;
239 
240 	tsk = current;
241 	switch (cmd) {
242 	case VM86_REQUEST_IRQ:
243 	case VM86_FREE_IRQ:
244 	case VM86_GET_IRQ_BITS:
245 	case VM86_GET_AND_RESET_IRQ:
246 		ret = do_vm86_irq_handling(cmd, (int)arg);
247 		goto out;
248 	case VM86_PLUS_INSTALL_CHECK:
249 		/*
250 		 * NOTE: on old vm86 stuff this will return the error
251 		 *  from access_ok(), because the subfunction is
252 		 *  interpreted as (invalid) address to vm86_struct.
253 		 *  So the installation check works.
254 		 */
255 		ret = 0;
256 		goto out;
257 	}
258 
259 	/* we come here only for functions VM86_ENTER, VM86_ENTER_NO_BYPASS */
260 	ret = -EPERM;
261 	if (tsk->thread.saved_sp0)
262 		goto out;
263 	v86 = (struct vm86plus_struct __user *)arg;
264 	tmp = copy_vm86_regs_from_user(&info.regs, &v86->regs,
265 				       offsetof(struct kernel_vm86_struct, regs32) -
266 				       sizeof(info.regs));
267 	ret = -EFAULT;
268 	if (tmp)
269 		goto out;
270 	info.regs32 = regs;
271 	info.vm86plus.is_vm86pus = 1;
272 	tsk->thread.vm86_info = (struct vm86_struct __user *)v86;
273 	do_sys_vm86(&info, tsk);
274 	ret = 0;	/* we never return here */
275 out:
276 	return ret;
277 }
278 
279 
280 static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk)
281 {
282 	struct tss_struct *tss;
283 /*
284  * make sure the vm86() system call doesn't try to do anything silly
285  */
286 	info->regs.pt.ds = 0;
287 	info->regs.pt.es = 0;
288 	info->regs.pt.fs = 0;
289 #ifndef CONFIG_X86_32_LAZY_GS
290 	info->regs.pt.gs = 0;
291 #endif
292 
293 /*
294  * The flags register is also special: we cannot trust that the user
295  * has set it up safely, so this makes sure interrupt etc flags are
296  * inherited from protected mode.
297  */
298 	VEFLAGS = info->regs.pt.flags;
299 	info->regs.pt.flags &= SAFE_MASK;
300 	info->regs.pt.flags |= info->regs32->flags & ~SAFE_MASK;
301 	info->regs.pt.flags |= X86_VM_MASK;
302 
303 	switch (info->cpu_type) {
304 	case CPU_286:
305 		tsk->thread.v86mask = 0;
306 		break;
307 	case CPU_386:
308 		tsk->thread.v86mask = X86_EFLAGS_NT | X86_EFLAGS_IOPL;
309 		break;
310 	case CPU_486:
311 		tsk->thread.v86mask = X86_EFLAGS_AC | X86_EFLAGS_NT | X86_EFLAGS_IOPL;
312 		break;
313 	default:
314 		tsk->thread.v86mask = X86_EFLAGS_ID | X86_EFLAGS_AC | X86_EFLAGS_NT | X86_EFLAGS_IOPL;
315 		break;
316 	}
317 
318 /*
319  * Save old state, set default return value (%ax) to 0 (VM86_SIGNAL)
320  */
321 	info->regs32->ax = VM86_SIGNAL;
322 	tsk->thread.saved_sp0 = tsk->thread.sp0;
323 	tsk->thread.saved_fs = info->regs32->fs;
324 	tsk->thread.saved_gs = get_user_gs(info->regs32);
325 
326 	tss = &per_cpu(init_tss, get_cpu());
327 	tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
328 	if (cpu_has_sep)
329 		tsk->thread.sysenter_cs = 0;
330 	load_sp0(tss, &tsk->thread);
331 	put_cpu();
332 
333 	tsk->thread.screen_bitmap = info->screen_bitmap;
334 	if (info->flags & VM86_SCREEN_BITMAP)
335 		mark_screen_rdonly(tsk->mm);
336 
337 	/*call audit_syscall_exit since we do not exit via the normal paths */
338 	if (unlikely(current->audit_context))
339 		audit_syscall_exit(AUDITSC_RESULT(0), 0);
340 
341 	__asm__ __volatile__(
342 		"movl %0,%%esp\n\t"
343 		"movl %1,%%ebp\n\t"
344 #ifdef CONFIG_X86_32_LAZY_GS
345 		"mov  %2, %%gs\n\t"
346 #endif
347 		"jmp resume_userspace"
348 		: /* no outputs */
349 		:"r" (&info->regs), "r" (task_thread_info(tsk)), "r" (0));
350 	/* we never return here */
351 }
352 
353 static inline void return_to_32bit(struct kernel_vm86_regs *regs16, int retval)
354 {
355 	struct pt_regs *regs32;
356 
357 	regs32 = save_v86_state(regs16);
358 	regs32->ax = retval;
359 	__asm__ __volatile__("movl %0,%%esp\n\t"
360 		"movl %1,%%ebp\n\t"
361 		"jmp resume_userspace"
362 		: : "r" (regs32), "r" (current_thread_info()));
363 }
364 
365 static inline void set_IF(struct kernel_vm86_regs *regs)
366 {
367 	VEFLAGS |= X86_EFLAGS_VIF;
368 	if (VEFLAGS & X86_EFLAGS_VIP)
369 		return_to_32bit(regs, VM86_STI);
370 }
371 
372 static inline void clear_IF(struct kernel_vm86_regs *regs)
373 {
374 	VEFLAGS &= ~X86_EFLAGS_VIF;
375 }
376 
377 static inline void clear_TF(struct kernel_vm86_regs *regs)
378 {
379 	regs->pt.flags &= ~X86_EFLAGS_TF;
380 }
381 
382 static inline void clear_AC(struct kernel_vm86_regs *regs)
383 {
384 	regs->pt.flags &= ~X86_EFLAGS_AC;
385 }
386 
387 /*
388  * It is correct to call set_IF(regs) from the set_vflags_*
389  * functions. However someone forgot to call clear_IF(regs)
390  * in the opposite case.
391  * After the command sequence CLI PUSHF STI POPF you should
392  * end up with interrupts disabled, but you ended up with
393  * interrupts enabled.
394  *  ( I was testing my own changes, but the only bug I
395  *    could find was in a function I had not changed. )
396  * [KD]
397  */
398 
399 static inline void set_vflags_long(unsigned long flags, struct kernel_vm86_regs *regs)
400 {
401 	set_flags(VEFLAGS, flags, current->thread.v86mask);
402 	set_flags(regs->pt.flags, flags, SAFE_MASK);
403 	if (flags & X86_EFLAGS_IF)
404 		set_IF(regs);
405 	else
406 		clear_IF(regs);
407 }
408 
409 static inline void set_vflags_short(unsigned short flags, struct kernel_vm86_regs *regs)
410 {
411 	set_flags(VFLAGS, flags, current->thread.v86mask);
412 	set_flags(regs->pt.flags, flags, SAFE_MASK);
413 	if (flags & X86_EFLAGS_IF)
414 		set_IF(regs);
415 	else
416 		clear_IF(regs);
417 }
418 
419 static inline unsigned long get_vflags(struct kernel_vm86_regs *regs)
420 {
421 	unsigned long flags = regs->pt.flags & RETURN_MASK;
422 
423 	if (VEFLAGS & X86_EFLAGS_VIF)
424 		flags |= X86_EFLAGS_IF;
425 	flags |= X86_EFLAGS_IOPL;
426 	return flags | (VEFLAGS & current->thread.v86mask);
427 }
428 
429 static inline int is_revectored(int nr, struct revectored_struct *bitmap)
430 {
431 	__asm__ __volatile__("btl %2,%1\n\tsbbl %0,%0"
432 		:"=r" (nr)
433 		:"m" (*bitmap), "r" (nr));
434 	return nr;
435 }
436 
437 #define val_byte(val, n) (((__u8 *)&val)[n])
438 
439 #define pushb(base, ptr, val, err_label) \
440 	do { \
441 		__u8 __val = val; \
442 		ptr--; \
443 		if (put_user(__val, base + ptr) < 0) \
444 			goto err_label; \
445 	} while (0)
446 
447 #define pushw(base, ptr, val, err_label) \
448 	do { \
449 		__u16 __val = val; \
450 		ptr--; \
451 		if (put_user(val_byte(__val, 1), base + ptr) < 0) \
452 			goto err_label; \
453 		ptr--; \
454 		if (put_user(val_byte(__val, 0), base + ptr) < 0) \
455 			goto err_label; \
456 	} while (0)
457 
458 #define pushl(base, ptr, val, err_label) \
459 	do { \
460 		__u32 __val = val; \
461 		ptr--; \
462 		if (put_user(val_byte(__val, 3), base + ptr) < 0) \
463 			goto err_label; \
464 		ptr--; \
465 		if (put_user(val_byte(__val, 2), base + ptr) < 0) \
466 			goto err_label; \
467 		ptr--; \
468 		if (put_user(val_byte(__val, 1), base + ptr) < 0) \
469 			goto err_label; \
470 		ptr--; \
471 		if (put_user(val_byte(__val, 0), base + ptr) < 0) \
472 			goto err_label; \
473 	} while (0)
474 
475 #define popb(base, ptr, err_label) \
476 	({ \
477 		__u8 __res; \
478 		if (get_user(__res, base + ptr) < 0) \
479 			goto err_label; \
480 		ptr++; \
481 		__res; \
482 	})
483 
484 #define popw(base, ptr, err_label) \
485 	({ \
486 		__u16 __res; \
487 		if (get_user(val_byte(__res, 0), base + ptr) < 0) \
488 			goto err_label; \
489 		ptr++; \
490 		if (get_user(val_byte(__res, 1), base + ptr) < 0) \
491 			goto err_label; \
492 		ptr++; \
493 		__res; \
494 	})
495 
496 #define popl(base, ptr, err_label) \
497 	({ \
498 		__u32 __res; \
499 		if (get_user(val_byte(__res, 0), base + ptr) < 0) \
500 			goto err_label; \
501 		ptr++; \
502 		if (get_user(val_byte(__res, 1), base + ptr) < 0) \
503 			goto err_label; \
504 		ptr++; \
505 		if (get_user(val_byte(__res, 2), base + ptr) < 0) \
506 			goto err_label; \
507 		ptr++; \
508 		if (get_user(val_byte(__res, 3), base + ptr) < 0) \
509 			goto err_label; \
510 		ptr++; \
511 		__res; \
512 	})
513 
514 /* There are so many possible reasons for this function to return
515  * VM86_INTx, so adding another doesn't bother me. We can expect
516  * userspace programs to be able to handle it. (Getting a problem
517  * in userspace is always better than an Oops anyway.) [KD]
518  */
519 static void do_int(struct kernel_vm86_regs *regs, int i,
520     unsigned char __user *ssp, unsigned short sp)
521 {
522 	unsigned long __user *intr_ptr;
523 	unsigned long segoffs;
524 
525 	if (regs->pt.cs == BIOSSEG)
526 		goto cannot_handle;
527 	if (is_revectored(i, &KVM86->int_revectored))
528 		goto cannot_handle;
529 	if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
530 		goto cannot_handle;
531 	intr_ptr = (unsigned long __user *) (i << 2);
532 	if (get_user(segoffs, intr_ptr))
533 		goto cannot_handle;
534 	if ((segoffs >> 16) == BIOSSEG)
535 		goto cannot_handle;
536 	pushw(ssp, sp, get_vflags(regs), cannot_handle);
537 	pushw(ssp, sp, regs->pt.cs, cannot_handle);
538 	pushw(ssp, sp, IP(regs), cannot_handle);
539 	regs->pt.cs = segoffs >> 16;
540 	SP(regs) -= 6;
541 	IP(regs) = segoffs & 0xffff;
542 	clear_TF(regs);
543 	clear_IF(regs);
544 	clear_AC(regs);
545 	return;
546 
547 cannot_handle:
548 	return_to_32bit(regs, VM86_INTx + (i << 8));
549 }
550 
551 int handle_vm86_trap(struct kernel_vm86_regs *regs, long error_code, int trapno)
552 {
553 	if (VMPI.is_vm86pus) {
554 		if ((trapno == 3) || (trapno == 1))
555 			return_to_32bit(regs, VM86_TRAP + (trapno << 8));
556 		do_int(regs, trapno, (unsigned char __user *) (regs->pt.ss << 4), SP(regs));
557 		return 0;
558 	}
559 	if (trapno != 1)
560 		return 1; /* we let this handle by the calling routine */
561 	current->thread.trap_no = trapno;
562 	current->thread.error_code = error_code;
563 	force_sig(SIGTRAP, current);
564 	return 0;
565 }
566 
567 void handle_vm86_fault(struct kernel_vm86_regs *regs, long error_code)
568 {
569 	unsigned char opcode;
570 	unsigned char __user *csp;
571 	unsigned char __user *ssp;
572 	unsigned short ip, sp, orig_flags;
573 	int data32, pref_done;
574 
575 #define CHECK_IF_IN_TRAP \
576 	if (VMPI.vm86dbg_active && VMPI.vm86dbg_TFpendig) \
577 		newflags |= X86_EFLAGS_TF
578 #define VM86_FAULT_RETURN do { \
579 	if (VMPI.force_return_for_pic  && (VEFLAGS & (X86_EFLAGS_IF | X86_EFLAGS_VIF))) \
580 		return_to_32bit(regs, VM86_PICRETURN); \
581 	if (orig_flags & X86_EFLAGS_TF) \
582 		handle_vm86_trap(regs, 0, 1); \
583 	return; } while (0)
584 
585 	orig_flags = *(unsigned short *)&regs->pt.flags;
586 
587 	csp = (unsigned char __user *) (regs->pt.cs << 4);
588 	ssp = (unsigned char __user *) (regs->pt.ss << 4);
589 	sp = SP(regs);
590 	ip = IP(regs);
591 
592 	data32 = 0;
593 	pref_done = 0;
594 	do {
595 		switch (opcode = popb(csp, ip, simulate_sigsegv)) {
596 		case 0x66:      /* 32-bit data */     data32 = 1; break;
597 		case 0x67:      /* 32-bit address */  break;
598 		case 0x2e:      /* CS */              break;
599 		case 0x3e:      /* DS */              break;
600 		case 0x26:      /* ES */              break;
601 		case 0x36:      /* SS */              break;
602 		case 0x65:      /* GS */              break;
603 		case 0x64:      /* FS */              break;
604 		case 0xf2:      /* repnz */       break;
605 		case 0xf3:      /* rep */             break;
606 		default: pref_done = 1;
607 		}
608 	} while (!pref_done);
609 
610 	switch (opcode) {
611 
612 	/* pushf */
613 	case 0x9c:
614 		if (data32) {
615 			pushl(ssp, sp, get_vflags(regs), simulate_sigsegv);
616 			SP(regs) -= 4;
617 		} else {
618 			pushw(ssp, sp, get_vflags(regs), simulate_sigsegv);
619 			SP(regs) -= 2;
620 		}
621 		IP(regs) = ip;
622 		VM86_FAULT_RETURN;
623 
624 	/* popf */
625 	case 0x9d:
626 		{
627 		unsigned long newflags;
628 		if (data32) {
629 			newflags = popl(ssp, sp, simulate_sigsegv);
630 			SP(regs) += 4;
631 		} else {
632 			newflags = popw(ssp, sp, simulate_sigsegv);
633 			SP(regs) += 2;
634 		}
635 		IP(regs) = ip;
636 		CHECK_IF_IN_TRAP;
637 		if (data32)
638 			set_vflags_long(newflags, regs);
639 		else
640 			set_vflags_short(newflags, regs);
641 
642 		VM86_FAULT_RETURN;
643 		}
644 
645 	/* int xx */
646 	case 0xcd: {
647 		int intno = popb(csp, ip, simulate_sigsegv);
648 		IP(regs) = ip;
649 		if (VMPI.vm86dbg_active) {
650 			if ((1 << (intno & 7)) & VMPI.vm86dbg_intxxtab[intno >> 3])
651 				return_to_32bit(regs, VM86_INTx + (intno << 8));
652 		}
653 		do_int(regs, intno, ssp, sp);
654 		return;
655 	}
656 
657 	/* iret */
658 	case 0xcf:
659 		{
660 		unsigned long newip;
661 		unsigned long newcs;
662 		unsigned long newflags;
663 		if (data32) {
664 			newip = popl(ssp, sp, simulate_sigsegv);
665 			newcs = popl(ssp, sp, simulate_sigsegv);
666 			newflags = popl(ssp, sp, simulate_sigsegv);
667 			SP(regs) += 12;
668 		} else {
669 			newip = popw(ssp, sp, simulate_sigsegv);
670 			newcs = popw(ssp, sp, simulate_sigsegv);
671 			newflags = popw(ssp, sp, simulate_sigsegv);
672 			SP(regs) += 6;
673 		}
674 		IP(regs) = newip;
675 		regs->pt.cs = newcs;
676 		CHECK_IF_IN_TRAP;
677 		if (data32) {
678 			set_vflags_long(newflags, regs);
679 		} else {
680 			set_vflags_short(newflags, regs);
681 		}
682 		VM86_FAULT_RETURN;
683 		}
684 
685 	/* cli */
686 	case 0xfa:
687 		IP(regs) = ip;
688 		clear_IF(regs);
689 		VM86_FAULT_RETURN;
690 
691 	/* sti */
692 	/*
693 	 * Damn. This is incorrect: the 'sti' instruction should actually
694 	 * enable interrupts after the /next/ instruction. Not good.
695 	 *
696 	 * Probably needs some horsing around with the TF flag. Aiee..
697 	 */
698 	case 0xfb:
699 		IP(regs) = ip;
700 		set_IF(regs);
701 		VM86_FAULT_RETURN;
702 
703 	default:
704 		return_to_32bit(regs, VM86_UNKNOWN);
705 	}
706 
707 	return;
708 
709 simulate_sigsegv:
710 	/* FIXME: After a long discussion with Stas we finally
711 	 *        agreed, that this is wrong. Here we should
712 	 *        really send a SIGSEGV to the user program.
713 	 *        But how do we create the correct context? We
714 	 *        are inside a general protection fault handler
715 	 *        and has just returned from a page fault handler.
716 	 *        The correct context for the signal handler
717 	 *        should be a mixture of the two, but how do we
718 	 *        get the information? [KD]
719 	 */
720 	return_to_32bit(regs, VM86_UNKNOWN);
721 }
722 
723 /* ---------------- vm86 special IRQ passing stuff ----------------- */
724 
725 #define VM86_IRQNAME		"vm86irq"
726 
727 static struct vm86_irqs {
728 	struct task_struct *tsk;
729 	int sig;
730 } vm86_irqs[16];
731 
732 static DEFINE_SPINLOCK(irqbits_lock);
733 static int irqbits;
734 
735 #define ALLOWED_SIGS (1 /* 0 = don't send a signal */ \
736 	| (1 << SIGUSR1) | (1 << SIGUSR2) | (1 << SIGIO)  | (1 << SIGURG) \
737 	| (1 << SIGUNUSED))
738 
739 static irqreturn_t irq_handler(int intno, void *dev_id)
740 {
741 	int irq_bit;
742 	unsigned long flags;
743 
744 	spin_lock_irqsave(&irqbits_lock, flags);
745 	irq_bit = 1 << intno;
746 	if ((irqbits & irq_bit) || !vm86_irqs[intno].tsk)
747 		goto out;
748 	irqbits |= irq_bit;
749 	if (vm86_irqs[intno].sig)
750 		send_sig(vm86_irqs[intno].sig, vm86_irqs[intno].tsk, 1);
751 	/*
752 	 * IRQ will be re-enabled when user asks for the irq (whether
753 	 * polling or as a result of the signal)
754 	 */
755 	disable_irq_nosync(intno);
756 	spin_unlock_irqrestore(&irqbits_lock, flags);
757 	return IRQ_HANDLED;
758 
759 out:
760 	spin_unlock_irqrestore(&irqbits_lock, flags);
761 	return IRQ_NONE;
762 }
763 
764 static inline void free_vm86_irq(int irqnumber)
765 {
766 	unsigned long flags;
767 
768 	free_irq(irqnumber, NULL);
769 	vm86_irqs[irqnumber].tsk = NULL;
770 
771 	spin_lock_irqsave(&irqbits_lock, flags);
772 	irqbits &= ~(1 << irqnumber);
773 	spin_unlock_irqrestore(&irqbits_lock, flags);
774 }
775 
776 void release_vm86_irqs(struct task_struct *task)
777 {
778 	int i;
779 	for (i = FIRST_VM86_IRQ ; i <= LAST_VM86_IRQ; i++)
780 	    if (vm86_irqs[i].tsk == task)
781 		free_vm86_irq(i);
782 }
783 
784 static inline int get_and_reset_irq(int irqnumber)
785 {
786 	int bit;
787 	unsigned long flags;
788 	int ret = 0;
789 
790 	if (invalid_vm86_irq(irqnumber)) return 0;
791 	if (vm86_irqs[irqnumber].tsk != current) return 0;
792 	spin_lock_irqsave(&irqbits_lock, flags);
793 	bit = irqbits & (1 << irqnumber);
794 	irqbits &= ~bit;
795 	if (bit) {
796 		enable_irq(irqnumber);
797 		ret = 1;
798 	}
799 
800 	spin_unlock_irqrestore(&irqbits_lock, flags);
801 	return ret;
802 }
803 
804 
805 static int do_vm86_irq_handling(int subfunction, int irqnumber)
806 {
807 	int ret;
808 	switch (subfunction) {
809 		case VM86_GET_AND_RESET_IRQ: {
810 			return get_and_reset_irq(irqnumber);
811 		}
812 		case VM86_GET_IRQ_BITS: {
813 			return irqbits;
814 		}
815 		case VM86_REQUEST_IRQ: {
816 			int sig = irqnumber >> 8;
817 			int irq = irqnumber & 255;
818 			if (!capable(CAP_SYS_ADMIN)) return -EPERM;
819 			if (!((1 << sig) & ALLOWED_SIGS)) return -EPERM;
820 			if (invalid_vm86_irq(irq)) return -EPERM;
821 			if (vm86_irqs[irq].tsk) return -EPERM;
822 			ret = request_irq(irq, &irq_handler, 0, VM86_IRQNAME, NULL);
823 			if (ret) return ret;
824 			vm86_irqs[irq].sig = sig;
825 			vm86_irqs[irq].tsk = current;
826 			return irq;
827 		}
828 		case  VM86_FREE_IRQ: {
829 			if (invalid_vm86_irq(irqnumber)) return -EPERM;
830 			if (!vm86_irqs[irqnumber].tsk) return 0;
831 			if (vm86_irqs[irqnumber].tsk != current) return -EPERM;
832 			free_vm86_irq(irqnumber);
833 			return 0;
834 		}
835 	}
836 	return -EINVAL;
837 }
838 
839