]> git.karo-electronics.de Git - karo-tx-linux.git/blob - arch/x86/kernel/vm86_32.c
ipc/msg.c: use freezable blocking call
[karo-tx-linux.git] / arch / x86 / kernel / vm86_32.c
1 /*
2  *  Copyright (C) 1994  Linus Torvalds
3  *
4  *  29 dec 2001 - Fixed oopses caused by unchecked access to the vm86
5  *                stack - Manfred Spraul <manfred@colorfullife.com>
6  *
7  *  22 mar 2002 - Manfred detected the stackfaults, but didn't handle
8  *                them correctly. Now the emulation will be in a
9  *                consistent state after stackfaults - Kasper Dupont
10  *                <kasperd@daimi.au.dk>
11  *
12  *  22 mar 2002 - Added missing clear_IF in set_vflags_* Kasper Dupont
13  *                <kasperd@daimi.au.dk>
14  *
15  *  ?? ??? 2002 - Fixed premature returns from handle_vm86_fault
16  *                caused by Kasper Dupont's changes - Stas Sergeev
17  *
18  *   4 apr 2002 - Fixed CHECK_IF_IN_TRAP broken by Stas' changes.
19  *                Kasper Dupont <kasperd@daimi.au.dk>
20  *
21  *   9 apr 2002 - Changed syntax of macros in handle_vm86_fault.
22  *                Kasper Dupont <kasperd@daimi.au.dk>
23  *
24  *   9 apr 2002 - Changed stack access macros to jump to a label
25  *                instead of returning to userspace. This simplifies
26  *                do_int, and is needed by handle_vm6_fault. Kasper
27  *                Dupont <kasperd@daimi.au.dk>
28  *
29  */
30
31 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
32
33 #include <linux/capability.h>
34 #include <linux/errno.h>
35 #include <linux/interrupt.h>
36 #include <linux/syscalls.h>
37 #include <linux/sched.h>
38 #include <linux/kernel.h>
39 #include <linux/signal.h>
40 #include <linux/string.h>
41 #include <linux/mm.h>
42 #include <linux/smp.h>
43 #include <linux/highmem.h>
44 #include <linux/ptrace.h>
45 #include <linux/audit.h>
46 #include <linux/stddef.h>
47 #include <linux/slab.h>
48 #include <linux/security.h>
49
50 #include <asm/uaccess.h>
51 #include <asm/io.h>
52 #include <asm/tlbflush.h>
53 #include <asm/irq.h>
54 #include <asm/traps.h>
55 #include <asm/vm86.h>
56
57 /*
58  * Known problems:
59  *
60  * Interrupt handling is not guaranteed:
61  * - a real x86 will disable all interrupts for one instruction
62  *   after a "mov ss,xx" to make stack handling atomic even without
63  *   the 'lss' instruction. We can't guarantee this in v86 mode,
64  *   as the next instruction might result in a page fault or similar.
65  * - a real x86 will have interrupts disabled for one instruction
66  *   past the 'sti' that enables them. We don't bother with all the
67  *   details yet.
68  *
69  * Let's hope these problems do not actually matter for anything.
70  */
71
72
73 /*
74  * 8- and 16-bit register defines..
75  */
76 #define AL(regs)        (((unsigned char *)&((regs)->pt.ax))[0])
77 #define AH(regs)        (((unsigned char *)&((regs)->pt.ax))[1])
78 #define IP(regs)        (*(unsigned short *)&((regs)->pt.ip))
79 #define SP(regs)        (*(unsigned short *)&((regs)->pt.sp))
80
81 /*
82  * virtual flags (16 and 32-bit versions)
83  */
84 #define VFLAGS  (*(unsigned short *)&(current->thread.vm86->veflags))
85 #define VEFLAGS (current->thread.vm86->veflags)
86
87 #define set_flags(X, new, mask) \
88 ((X) = ((X) & ~(mask)) | ((new) & (mask)))
89
90 #define SAFE_MASK       (0xDD5)
91 #define RETURN_MASK     (0xDFF)
92
93 void save_v86_state(struct kernel_vm86_regs *regs, int retval)
94 {
95         struct tss_struct *tss;
96         struct task_struct *tsk = current;
97         struct vm86plus_struct __user *user;
98         struct vm86 *vm86 = current->thread.vm86;
99         long err = 0;
100
101         /*
102          * This gets called from entry.S with interrupts disabled, but
103          * from process context. Enable interrupts here, before trying
104          * to access user space.
105          */
106         local_irq_enable();
107
108         if (!vm86 || !vm86->user_vm86) {
109                 pr_alert("no user_vm86: BAD\n");
110                 do_exit(SIGSEGV);
111         }
112         set_flags(regs->pt.flags, VEFLAGS, X86_EFLAGS_VIF | vm86->veflags_mask);
113         user = vm86->user_vm86;
114
115         if (!access_ok(VERIFY_WRITE, user, vm86->vm86plus.is_vm86pus ?
116                        sizeof(struct vm86plus_struct) :
117                        sizeof(struct vm86_struct))) {
118                 pr_alert("could not access userspace vm86 info\n");
119                 do_exit(SIGSEGV);
120         }
121
122         put_user_try {
123                 put_user_ex(regs->pt.bx, &user->regs.ebx);
124                 put_user_ex(regs->pt.cx, &user->regs.ecx);
125                 put_user_ex(regs->pt.dx, &user->regs.edx);
126                 put_user_ex(regs->pt.si, &user->regs.esi);
127                 put_user_ex(regs->pt.di, &user->regs.edi);
128                 put_user_ex(regs->pt.bp, &user->regs.ebp);
129                 put_user_ex(regs->pt.ax, &user->regs.eax);
130                 put_user_ex(regs->pt.ip, &user->regs.eip);
131                 put_user_ex(regs->pt.cs, &user->regs.cs);
132                 put_user_ex(regs->pt.flags, &user->regs.eflags);
133                 put_user_ex(regs->pt.sp, &user->regs.esp);
134                 put_user_ex(regs->pt.ss, &user->regs.ss);
135                 put_user_ex(regs->es, &user->regs.es);
136                 put_user_ex(regs->ds, &user->regs.ds);
137                 put_user_ex(regs->fs, &user->regs.fs);
138                 put_user_ex(regs->gs, &user->regs.gs);
139
140                 put_user_ex(vm86->screen_bitmap, &user->screen_bitmap);
141         } put_user_catch(err);
142         if (err) {
143                 pr_alert("could not access userspace vm86 info\n");
144                 do_exit(SIGSEGV);
145         }
146
147         tss = &per_cpu(cpu_tss, get_cpu());
148         tsk->thread.sp0 = vm86->saved_sp0;
149         tsk->thread.sysenter_cs = __KERNEL_CS;
150         load_sp0(tss, &tsk->thread);
151         vm86->saved_sp0 = 0;
152         put_cpu();
153
154         memcpy(&regs->pt, &vm86->regs32, sizeof(struct pt_regs));
155
156         lazy_load_gs(vm86->regs32.gs);
157
158         regs->pt.ax = retval;
159 }
160
161 static void mark_screen_rdonly(struct mm_struct *mm)
162 {
163         pgd_t *pgd;
164         pud_t *pud;
165         pmd_t *pmd;
166         pte_t *pte;
167         spinlock_t *ptl;
168         int i;
169
170         down_write(&mm->mmap_sem);
171         pgd = pgd_offset(mm, 0xA0000);
172         if (pgd_none_or_clear_bad(pgd))
173                 goto out;
174         pud = pud_offset(pgd, 0xA0000);
175         if (pud_none_or_clear_bad(pud))
176                 goto out;
177         pmd = pmd_offset(pud, 0xA0000);
178
179         if (pmd_trans_huge(*pmd)) {
180                 struct vm_area_struct *vma = find_vma(mm, 0xA0000);
181                 split_huge_pmd(vma, pmd, 0xA0000);
182         }
183         if (pmd_none_or_clear_bad(pmd))
184                 goto out;
185         pte = pte_offset_map_lock(mm, pmd, 0xA0000, &ptl);
186         for (i = 0; i < 32; i++) {
187                 if (pte_present(*pte))
188                         set_pte(pte, pte_wrprotect(*pte));
189                 pte++;
190         }
191         pte_unmap_unlock(pte, ptl);
192 out:
193         up_write(&mm->mmap_sem);
194         flush_tlb();
195 }
196
197
198
199 static int do_vm86_irq_handling(int subfunction, int irqnumber);
200 static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus);
201
202 SYSCALL_DEFINE1(vm86old, struct vm86_struct __user *, user_vm86)
203 {
204         return do_sys_vm86((struct vm86plus_struct __user *) user_vm86, false);
205 }
206
207
208 SYSCALL_DEFINE2(vm86, unsigned long, cmd, unsigned long, arg)
209 {
210         switch (cmd) {
211         case VM86_REQUEST_IRQ:
212         case VM86_FREE_IRQ:
213         case VM86_GET_IRQ_BITS:
214         case VM86_GET_AND_RESET_IRQ:
215                 return do_vm86_irq_handling(cmd, (int)arg);
216         case VM86_PLUS_INSTALL_CHECK:
217                 /*
218                  * NOTE: on old vm86 stuff this will return the error
219                  *  from access_ok(), because the subfunction is
220                  *  interpreted as (invalid) address to vm86_struct.
221                  *  So the installation check works.
222                  */
223                 return 0;
224         }
225
226         /* we come here only for functions VM86_ENTER, VM86_ENTER_NO_BYPASS */
227         return do_sys_vm86((struct vm86plus_struct __user *) arg, true);
228 }
229
230
231 static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus)
232 {
233         struct tss_struct *tss;
234         struct task_struct *tsk = current;
235         struct vm86 *vm86 = tsk->thread.vm86;
236         struct kernel_vm86_regs vm86regs;
237         struct pt_regs *regs = current_pt_regs();
238         unsigned long err = 0;
239
240         err = security_mmap_addr(0);
241         if (err) {
242                 /*
243                  * vm86 cannot virtualize the address space, so vm86 users
244                  * need to manage the low 1MB themselves using mmap.  Given
245                  * that BIOS places important data in the first page, vm86
246                  * is essentially useless if mmap_min_addr != 0.  DOSEMU,
247                  * for example, won't even bother trying to use vm86 if it
248                  * can't map a page at virtual address 0.
249                  *
250                  * To reduce the available kernel attack surface, simply
251                  * disallow vm86(old) for users who cannot mmap at va 0.
252                  *
253                  * The implementation of security_mmap_addr will allow
254                  * suitably privileged users to map va 0 even if
255                  * vm.mmap_min_addr is set above 0, and we want this
256                  * behavior for vm86 as well, as it ensures that legacy
257                  * tools like vbetool will not fail just because of
258                  * vm.mmap_min_addr.
259                  */
260                 pr_info_once("Denied a call to vm86(old) from %s[%d] (uid: %d).  Set the vm.mmap_min_addr sysctl to 0 and/or adjust LSM mmap_min_addr policy to enable vm86 if you are using a vm86-based DOS emulator.\n",
261                              current->comm, task_pid_nr(current),
262                              from_kuid_munged(&init_user_ns, current_uid()));
263                 return -EPERM;
264         }
265
266         if (!vm86) {
267                 if (!(vm86 = kzalloc(sizeof(*vm86), GFP_KERNEL)))
268                         return -ENOMEM;
269                 tsk->thread.vm86 = vm86;
270         }
271         if (vm86->saved_sp0)
272                 return -EPERM;
273
274         if (!access_ok(VERIFY_READ, user_vm86, plus ?
275                        sizeof(struct vm86_struct) :
276                        sizeof(struct vm86plus_struct)))
277                 return -EFAULT;
278
279         memset(&vm86regs, 0, sizeof(vm86regs));
280         get_user_try {
281                 unsigned short seg;
282                 get_user_ex(vm86regs.pt.bx, &user_vm86->regs.ebx);
283                 get_user_ex(vm86regs.pt.cx, &user_vm86->regs.ecx);
284                 get_user_ex(vm86regs.pt.dx, &user_vm86->regs.edx);
285                 get_user_ex(vm86regs.pt.si, &user_vm86->regs.esi);
286                 get_user_ex(vm86regs.pt.di, &user_vm86->regs.edi);
287                 get_user_ex(vm86regs.pt.bp, &user_vm86->regs.ebp);
288                 get_user_ex(vm86regs.pt.ax, &user_vm86->regs.eax);
289                 get_user_ex(vm86regs.pt.ip, &user_vm86->regs.eip);
290                 get_user_ex(seg, &user_vm86->regs.cs);
291                 vm86regs.pt.cs = seg;
292                 get_user_ex(vm86regs.pt.flags, &user_vm86->regs.eflags);
293                 get_user_ex(vm86regs.pt.sp, &user_vm86->regs.esp);
294                 get_user_ex(seg, &user_vm86->regs.ss);
295                 vm86regs.pt.ss = seg;
296                 get_user_ex(vm86regs.es, &user_vm86->regs.es);
297                 get_user_ex(vm86regs.ds, &user_vm86->regs.ds);
298                 get_user_ex(vm86regs.fs, &user_vm86->regs.fs);
299                 get_user_ex(vm86regs.gs, &user_vm86->regs.gs);
300
301                 get_user_ex(vm86->flags, &user_vm86->flags);
302                 get_user_ex(vm86->screen_bitmap, &user_vm86->screen_bitmap);
303                 get_user_ex(vm86->cpu_type, &user_vm86->cpu_type);
304         } get_user_catch(err);
305         if (err)
306                 return err;
307
308         if (copy_from_user(&vm86->int_revectored,
309                            &user_vm86->int_revectored,
310                            sizeof(struct revectored_struct)))
311                 return -EFAULT;
312         if (copy_from_user(&vm86->int21_revectored,
313                            &user_vm86->int21_revectored,
314                            sizeof(struct revectored_struct)))
315                 return -EFAULT;
316         if (plus) {
317                 if (copy_from_user(&vm86->vm86plus, &user_vm86->vm86plus,
318                                    sizeof(struct vm86plus_info_struct)))
319                         return -EFAULT;
320                 vm86->vm86plus.is_vm86pus = 1;
321         } else
322                 memset(&vm86->vm86plus, 0,
323                        sizeof(struct vm86plus_info_struct));
324
325         memcpy(&vm86->regs32, regs, sizeof(struct pt_regs));
326         vm86->user_vm86 = user_vm86;
327
328 /*
329  * The flags register is also special: we cannot trust that the user
330  * has set it up safely, so this makes sure interrupt etc flags are
331  * inherited from protected mode.
332  */
333         VEFLAGS = vm86regs.pt.flags;
334         vm86regs.pt.flags &= SAFE_MASK;
335         vm86regs.pt.flags |= regs->flags & ~SAFE_MASK;
336         vm86regs.pt.flags |= X86_VM_MASK;
337
338         vm86regs.pt.orig_ax = regs->orig_ax;
339
340         switch (vm86->cpu_type) {
341         case CPU_286:
342                 vm86->veflags_mask = 0;
343                 break;
344         case CPU_386:
345                 vm86->veflags_mask = X86_EFLAGS_NT | X86_EFLAGS_IOPL;
346                 break;
347         case CPU_486:
348                 vm86->veflags_mask = X86_EFLAGS_AC | X86_EFLAGS_NT | X86_EFLAGS_IOPL;
349                 break;
350         default:
351                 vm86->veflags_mask = X86_EFLAGS_ID | X86_EFLAGS_AC | X86_EFLAGS_NT | X86_EFLAGS_IOPL;
352                 break;
353         }
354
355 /*
356  * Save old state
357  */
358         vm86->saved_sp0 = tsk->thread.sp0;
359         lazy_save_gs(vm86->regs32.gs);
360
361         tss = &per_cpu(cpu_tss, get_cpu());
362         /* make room for real-mode segments */
363         tsk->thread.sp0 += 16;
364
365         if (static_cpu_has_safe(X86_FEATURE_SEP))
366                 tsk->thread.sysenter_cs = 0;
367
368         load_sp0(tss, &tsk->thread);
369         put_cpu();
370
371         if (vm86->flags & VM86_SCREEN_BITMAP)
372                 mark_screen_rdonly(tsk->mm);
373
374         memcpy((struct kernel_vm86_regs *)regs, &vm86regs, sizeof(vm86regs));
375         force_iret();
376         return regs->ax;
377 }
378
379 static inline void set_IF(struct kernel_vm86_regs *regs)
380 {
381         VEFLAGS |= X86_EFLAGS_VIF;
382 }
383
384 static inline void clear_IF(struct kernel_vm86_regs *regs)
385 {
386         VEFLAGS &= ~X86_EFLAGS_VIF;
387 }
388
389 static inline void clear_TF(struct kernel_vm86_regs *regs)
390 {
391         regs->pt.flags &= ~X86_EFLAGS_TF;
392 }
393
394 static inline void clear_AC(struct kernel_vm86_regs *regs)
395 {
396         regs->pt.flags &= ~X86_EFLAGS_AC;
397 }
398
399 /*
400  * It is correct to call set_IF(regs) from the set_vflags_*
401  * functions. However someone forgot to call clear_IF(regs)
402  * in the opposite case.
403  * After the command sequence CLI PUSHF STI POPF you should
404  * end up with interrupts disabled, but you ended up with
405  * interrupts enabled.
406  *  ( I was testing my own changes, but the only bug I
407  *    could find was in a function I had not changed. )
408  * [KD]
409  */
410
411 static inline void set_vflags_long(unsigned long flags, struct kernel_vm86_regs *regs)
412 {
413         set_flags(VEFLAGS, flags, current->thread.vm86->veflags_mask);
414         set_flags(regs->pt.flags, flags, SAFE_MASK);
415         if (flags & X86_EFLAGS_IF)
416                 set_IF(regs);
417         else
418                 clear_IF(regs);
419 }
420
421 static inline void set_vflags_short(unsigned short flags, struct kernel_vm86_regs *regs)
422 {
423         set_flags(VFLAGS, flags, current->thread.vm86->veflags_mask);
424         set_flags(regs->pt.flags, flags, SAFE_MASK);
425         if (flags & X86_EFLAGS_IF)
426                 set_IF(regs);
427         else
428                 clear_IF(regs);
429 }
430
431 static inline unsigned long get_vflags(struct kernel_vm86_regs *regs)
432 {
433         unsigned long flags = regs->pt.flags & RETURN_MASK;
434
435         if (VEFLAGS & X86_EFLAGS_VIF)
436                 flags |= X86_EFLAGS_IF;
437         flags |= X86_EFLAGS_IOPL;
438         return flags | (VEFLAGS & current->thread.vm86->veflags_mask);
439 }
440
441 static inline int is_revectored(int nr, struct revectored_struct *bitmap)
442 {
443         __asm__ __volatile__("btl %2,%1\n\tsbbl %0,%0"
444                 :"=r" (nr)
445                 :"m" (*bitmap), "r" (nr));
446         return nr;
447 }
448
449 #define val_byte(val, n) (((__u8 *)&val)[n])
450
451 #define pushb(base, ptr, val, err_label) \
452         do { \
453                 __u8 __val = val; \
454                 ptr--; \
455                 if (put_user(__val, base + ptr) < 0) \
456                         goto err_label; \
457         } while (0)
458
459 #define pushw(base, ptr, val, err_label) \
460         do { \
461                 __u16 __val = val; \
462                 ptr--; \
463                 if (put_user(val_byte(__val, 1), base + ptr) < 0) \
464                         goto err_label; \
465                 ptr--; \
466                 if (put_user(val_byte(__val, 0), base + ptr) < 0) \
467                         goto err_label; \
468         } while (0)
469
470 #define pushl(base, ptr, val, err_label) \
471         do { \
472                 __u32 __val = val; \
473                 ptr--; \
474                 if (put_user(val_byte(__val, 3), base + ptr) < 0) \
475                         goto err_label; \
476                 ptr--; \
477                 if (put_user(val_byte(__val, 2), base + ptr) < 0) \
478                         goto err_label; \
479                 ptr--; \
480                 if (put_user(val_byte(__val, 1), base + ptr) < 0) \
481                         goto err_label; \
482                 ptr--; \
483                 if (put_user(val_byte(__val, 0), base + ptr) < 0) \
484                         goto err_label; \
485         } while (0)
486
487 #define popb(base, ptr, err_label) \
488         ({ \
489                 __u8 __res; \
490                 if (get_user(__res, base + ptr) < 0) \
491                         goto err_label; \
492                 ptr++; \
493                 __res; \
494         })
495
496 #define popw(base, ptr, err_label) \
497         ({ \
498                 __u16 __res; \
499                 if (get_user(val_byte(__res, 0), base + ptr) < 0) \
500                         goto err_label; \
501                 ptr++; \
502                 if (get_user(val_byte(__res, 1), base + ptr) < 0) \
503                         goto err_label; \
504                 ptr++; \
505                 __res; \
506         })
507
508 #define popl(base, ptr, err_label) \
509         ({ \
510                 __u32 __res; \
511                 if (get_user(val_byte(__res, 0), base + ptr) < 0) \
512                         goto err_label; \
513                 ptr++; \
514                 if (get_user(val_byte(__res, 1), base + ptr) < 0) \
515                         goto err_label; \
516                 ptr++; \
517                 if (get_user(val_byte(__res, 2), base + ptr) < 0) \
518                         goto err_label; \
519                 ptr++; \
520                 if (get_user(val_byte(__res, 3), base + ptr) < 0) \
521                         goto err_label; \
522                 ptr++; \
523                 __res; \
524         })
525
526 /* There are so many possible reasons for this function to return
527  * VM86_INTx, so adding another doesn't bother me. We can expect
528  * userspace programs to be able to handle it. (Getting a problem
529  * in userspace is always better than an Oops anyway.) [KD]
530  */
531 static void do_int(struct kernel_vm86_regs *regs, int i,
532     unsigned char __user *ssp, unsigned short sp)
533 {
534         unsigned long __user *intr_ptr;
535         unsigned long segoffs;
536         struct vm86 *vm86 = current->thread.vm86;
537
538         if (regs->pt.cs == BIOSSEG)
539                 goto cannot_handle;
540         if (is_revectored(i, &vm86->int_revectored))
541                 goto cannot_handle;
542         if (i == 0x21 && is_revectored(AH(regs), &vm86->int21_revectored))
543                 goto cannot_handle;
544         intr_ptr = (unsigned long __user *) (i << 2);
545         if (get_user(segoffs, intr_ptr))
546                 goto cannot_handle;
547         if ((segoffs >> 16) == BIOSSEG)
548                 goto cannot_handle;
549         pushw(ssp, sp, get_vflags(regs), cannot_handle);
550         pushw(ssp, sp, regs->pt.cs, cannot_handle);
551         pushw(ssp, sp, IP(regs), cannot_handle);
552         regs->pt.cs = segoffs >> 16;
553         SP(regs) -= 6;
554         IP(regs) = segoffs & 0xffff;
555         clear_TF(regs);
556         clear_IF(regs);
557         clear_AC(regs);
558         return;
559
560 cannot_handle:
561         save_v86_state(regs, VM86_INTx + (i << 8));
562 }
563
564 int handle_vm86_trap(struct kernel_vm86_regs *regs, long error_code, int trapno)
565 {
566         struct vm86 *vm86 = current->thread.vm86;
567
568         if (vm86->vm86plus.is_vm86pus) {
569                 if ((trapno == 3) || (trapno == 1)) {
570                         save_v86_state(regs, VM86_TRAP + (trapno << 8));
571                         return 0;
572                 }
573                 do_int(regs, trapno, (unsigned char __user *) (regs->pt.ss << 4), SP(regs));
574                 return 0;
575         }
576         if (trapno != 1)
577                 return 1; /* we let this handle by the calling routine */
578         current->thread.trap_nr = trapno;
579         current->thread.error_code = error_code;
580         force_sig(SIGTRAP, current);
581         return 0;
582 }
583
584 void handle_vm86_fault(struct kernel_vm86_regs *regs, long error_code)
585 {
586         unsigned char opcode;
587         unsigned char __user *csp;
588         unsigned char __user *ssp;
589         unsigned short ip, sp, orig_flags;
590         int data32, pref_done;
591         struct vm86plus_info_struct *vmpi = &current->thread.vm86->vm86plus;
592
593 #define CHECK_IF_IN_TRAP \
594         if (vmpi->vm86dbg_active && vmpi->vm86dbg_TFpendig) \
595                 newflags |= X86_EFLAGS_TF
596
597         orig_flags = *(unsigned short *)&regs->pt.flags;
598
599         csp = (unsigned char __user *) (regs->pt.cs << 4);
600         ssp = (unsigned char __user *) (regs->pt.ss << 4);
601         sp = SP(regs);
602         ip = IP(regs);
603
604         data32 = 0;
605         pref_done = 0;
606         do {
607                 switch (opcode = popb(csp, ip, simulate_sigsegv)) {
608                 case 0x66:      /* 32-bit data */     data32 = 1; break;
609                 case 0x67:      /* 32-bit address */  break;
610                 case 0x2e:      /* CS */              break;
611                 case 0x3e:      /* DS */              break;
612                 case 0x26:      /* ES */              break;
613                 case 0x36:      /* SS */              break;
614                 case 0x65:      /* GS */              break;
615                 case 0x64:      /* FS */              break;
616                 case 0xf2:      /* repnz */       break;
617                 case 0xf3:      /* rep */             break;
618                 default: pref_done = 1;
619                 }
620         } while (!pref_done);
621
622         switch (opcode) {
623
624         /* pushf */
625         case 0x9c:
626                 if (data32) {
627                         pushl(ssp, sp, get_vflags(regs), simulate_sigsegv);
628                         SP(regs) -= 4;
629                 } else {
630                         pushw(ssp, sp, get_vflags(regs), simulate_sigsegv);
631                         SP(regs) -= 2;
632                 }
633                 IP(regs) = ip;
634                 goto vm86_fault_return;
635
636         /* popf */
637         case 0x9d:
638                 {
639                 unsigned long newflags;
640                 if (data32) {
641                         newflags = popl(ssp, sp, simulate_sigsegv);
642                         SP(regs) += 4;
643                 } else {
644                         newflags = popw(ssp, sp, simulate_sigsegv);
645                         SP(regs) += 2;
646                 }
647                 IP(regs) = ip;
648                 CHECK_IF_IN_TRAP;
649                 if (data32)
650                         set_vflags_long(newflags, regs);
651                 else
652                         set_vflags_short(newflags, regs);
653
654                 goto check_vip;
655                 }
656
657         /* int xx */
658         case 0xcd: {
659                 int intno = popb(csp, ip, simulate_sigsegv);
660                 IP(regs) = ip;
661                 if (vmpi->vm86dbg_active) {
662                         if ((1 << (intno & 7)) & vmpi->vm86dbg_intxxtab[intno >> 3]) {
663                                 save_v86_state(regs, VM86_INTx + (intno << 8));
664                                 return;
665                         }
666                 }
667                 do_int(regs, intno, ssp, sp);
668                 return;
669         }
670
671         /* iret */
672         case 0xcf:
673                 {
674                 unsigned long newip;
675                 unsigned long newcs;
676                 unsigned long newflags;
677                 if (data32) {
678                         newip = popl(ssp, sp, simulate_sigsegv);
679                         newcs = popl(ssp, sp, simulate_sigsegv);
680                         newflags = popl(ssp, sp, simulate_sigsegv);
681                         SP(regs) += 12;
682                 } else {
683                         newip = popw(ssp, sp, simulate_sigsegv);
684                         newcs = popw(ssp, sp, simulate_sigsegv);
685                         newflags = popw(ssp, sp, simulate_sigsegv);
686                         SP(regs) += 6;
687                 }
688                 IP(regs) = newip;
689                 regs->pt.cs = newcs;
690                 CHECK_IF_IN_TRAP;
691                 if (data32) {
692                         set_vflags_long(newflags, regs);
693                 } else {
694                         set_vflags_short(newflags, regs);
695                 }
696                 goto check_vip;
697                 }
698
699         /* cli */
700         case 0xfa:
701                 IP(regs) = ip;
702                 clear_IF(regs);
703                 goto vm86_fault_return;
704
705         /* sti */
706         /*
707          * Damn. This is incorrect: the 'sti' instruction should actually
708          * enable interrupts after the /next/ instruction. Not good.
709          *
710          * Probably needs some horsing around with the TF flag. Aiee..
711          */
712         case 0xfb:
713                 IP(regs) = ip;
714                 set_IF(regs);
715                 goto check_vip;
716
717         default:
718                 save_v86_state(regs, VM86_UNKNOWN);
719         }
720
721         return;
722
723 check_vip:
724         if (VEFLAGS & X86_EFLAGS_VIP) {
725                 save_v86_state(regs, VM86_STI);
726                 return;
727         }
728
729 vm86_fault_return:
730         if (vmpi->force_return_for_pic  && (VEFLAGS & (X86_EFLAGS_IF | X86_EFLAGS_VIF))) {
731                 save_v86_state(regs, VM86_PICRETURN);
732                 return;
733         }
734         if (orig_flags & X86_EFLAGS_TF)
735                 handle_vm86_trap(regs, 0, X86_TRAP_DB);
736         return;
737
738 simulate_sigsegv:
739         /* FIXME: After a long discussion with Stas we finally
740          *        agreed, that this is wrong. Here we should
741          *        really send a SIGSEGV to the user program.
742          *        But how do we create the correct context? We
743          *        are inside a general protection fault handler
744          *        and has just returned from a page fault handler.
745          *        The correct context for the signal handler
746          *        should be a mixture of the two, but how do we
747          *        get the information? [KD]
748          */
749         save_v86_state(regs, VM86_UNKNOWN);
750 }
751
752 /* ---------------- vm86 special IRQ passing stuff ----------------- */
753
754 #define VM86_IRQNAME            "vm86irq"
755
756 static struct vm86_irqs {
757         struct task_struct *tsk;
758         int sig;
759 } vm86_irqs[16];
760
761 static DEFINE_SPINLOCK(irqbits_lock);
762 static int irqbits;
763
764 #define ALLOWED_SIGS (1 /* 0 = don't send a signal */ \
765         | (1 << SIGUSR1) | (1 << SIGUSR2) | (1 << SIGIO)  | (1 << SIGURG) \
766         | (1 << SIGUNUSED))
767
768 static irqreturn_t irq_handler(int intno, void *dev_id)
769 {
770         int irq_bit;
771         unsigned long flags;
772
773         spin_lock_irqsave(&irqbits_lock, flags);
774         irq_bit = 1 << intno;
775         if ((irqbits & irq_bit) || !vm86_irqs[intno].tsk)
776                 goto out;
777         irqbits |= irq_bit;
778         if (vm86_irqs[intno].sig)
779                 send_sig(vm86_irqs[intno].sig, vm86_irqs[intno].tsk, 1);
780         /*
781          * IRQ will be re-enabled when user asks for the irq (whether
782          * polling or as a result of the signal)
783          */
784         disable_irq_nosync(intno);
785         spin_unlock_irqrestore(&irqbits_lock, flags);
786         return IRQ_HANDLED;
787
788 out:
789         spin_unlock_irqrestore(&irqbits_lock, flags);
790         return IRQ_NONE;
791 }
792
793 static inline void free_vm86_irq(int irqnumber)
794 {
795         unsigned long flags;
796
797         free_irq(irqnumber, NULL);
798         vm86_irqs[irqnumber].tsk = NULL;
799
800         spin_lock_irqsave(&irqbits_lock, flags);
801         irqbits &= ~(1 << irqnumber);
802         spin_unlock_irqrestore(&irqbits_lock, flags);
803 }
804
805 void release_vm86_irqs(struct task_struct *task)
806 {
807         int i;
808         for (i = FIRST_VM86_IRQ ; i <= LAST_VM86_IRQ; i++)
809             if (vm86_irqs[i].tsk == task)
810                 free_vm86_irq(i);
811 }
812
813 static inline int get_and_reset_irq(int irqnumber)
814 {
815         int bit;
816         unsigned long flags;
817         int ret = 0;
818
819         if (invalid_vm86_irq(irqnumber)) return 0;
820         if (vm86_irqs[irqnumber].tsk != current) return 0;
821         spin_lock_irqsave(&irqbits_lock, flags);
822         bit = irqbits & (1 << irqnumber);
823         irqbits &= ~bit;
824         if (bit) {
825                 enable_irq(irqnumber);
826                 ret = 1;
827         }
828
829         spin_unlock_irqrestore(&irqbits_lock, flags);
830         return ret;
831 }
832
833
834 static int do_vm86_irq_handling(int subfunction, int irqnumber)
835 {
836         int ret;
837         switch (subfunction) {
838                 case VM86_GET_AND_RESET_IRQ: {
839                         return get_and_reset_irq(irqnumber);
840                 }
841                 case VM86_GET_IRQ_BITS: {
842                         return irqbits;
843                 }
844                 case VM86_REQUEST_IRQ: {
845                         int sig = irqnumber >> 8;
846                         int irq = irqnumber & 255;
847                         if (!capable(CAP_SYS_ADMIN)) return -EPERM;
848                         if (!((1 << sig) & ALLOWED_SIGS)) return -EPERM;
849                         if (invalid_vm86_irq(irq)) return -EPERM;
850                         if (vm86_irqs[irq].tsk) return -EPERM;
851                         ret = request_irq(irq, &irq_handler, 0, VM86_IRQNAME, NULL);
852                         if (ret) return ret;
853                         vm86_irqs[irq].sig = sig;
854                         vm86_irqs[irq].tsk = current;
855                         return irq;
856                 }
857                 case  VM86_FREE_IRQ: {
858                         if (invalid_vm86_irq(irqnumber)) return -EPERM;
859                         if (!vm86_irqs[irqnumber].tsk) return 0;
860                         if (vm86_irqs[irqnumber].tsk != current) return -EPERM;
861                         free_vm86_irq(irqnumber);
862                         return 0;
863                 }
864         }
865         return -EINVAL;
866 }
867