1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Copyright (C) 2002 - 2007 Jeff Dike (jdike@{addtoit,linux.intel}.com)
4 */
5
6 #include <linux/err.h>
7 #include <linux/highmem.h>
8 #include <linux/mm.h>
9 #include <linux/module.h>
10 #include <linux/sched.h>
11 #include <asm/current.h>
12 #include <asm/page.h>
13 #include <kern_util.h>
14 #include <asm/futex.h>
15 #include <os.h>
16
virt_to_pte(struct mm_struct * mm,unsigned long addr)17 pte_t *virt_to_pte(struct mm_struct *mm, unsigned long addr)
18 {
19 pgd_t *pgd;
20 p4d_t *p4d;
21 pud_t *pud;
22 pmd_t *pmd;
23
24 if (mm == NULL)
25 return NULL;
26
27 pgd = pgd_offset(mm, addr);
28 if (!pgd_present(*pgd))
29 return NULL;
30
31 p4d = p4d_offset(pgd, addr);
32 if (!p4d_present(*p4d))
33 return NULL;
34
35 pud = pud_offset(p4d, addr);
36 if (!pud_present(*pud))
37 return NULL;
38
39 pmd = pmd_offset(pud, addr);
40 if (!pmd_present(*pmd))
41 return NULL;
42
43 return pte_offset_kernel(pmd, addr);
44 }
45
maybe_map(unsigned long virt,int is_write)46 static pte_t *maybe_map(unsigned long virt, int is_write)
47 {
48 pte_t *pte = virt_to_pte(current->mm, virt);
49 int err, dummy_code;
50
51 if ((pte == NULL) || !pte_present(*pte) ||
52 (is_write && !pte_write(*pte))) {
53 err = handle_page_fault(virt, 0, is_write, 1, &dummy_code);
54 if (err)
55 return NULL;
56 pte = virt_to_pte(current->mm, virt);
57 }
58 if (!pte_present(*pte))
59 pte = NULL;
60
61 return pte;
62 }
63
do_op_one_page(unsigned long addr,int len,int is_write,int (* op)(unsigned long addr,int len,void * arg),void * arg)64 static int do_op_one_page(unsigned long addr, int len, int is_write,
65 int (*op)(unsigned long addr, int len, void *arg), void *arg)
66 {
67 struct page *page;
68 pte_t *pte;
69 int n;
70
71 pte = maybe_map(addr, is_write);
72 if (pte == NULL)
73 return -1;
74
75 page = pte_page(*pte);
76 #ifdef CONFIG_64BIT
77 pagefault_disable();
78 addr = (unsigned long) page_address(page) +
79 (addr & ~PAGE_MASK);
80 #else
81 addr = (unsigned long) kmap_atomic(page) +
82 (addr & ~PAGE_MASK);
83 #endif
84 n = (*op)(addr, len, arg);
85
86 #ifdef CONFIG_64BIT
87 pagefault_enable();
88 #else
89 kunmap_atomic((void *)addr);
90 #endif
91
92 return n;
93 }
94
buffer_op(unsigned long addr,int len,int is_write,int (* op)(unsigned long,int,void *),void * arg)95 static long buffer_op(unsigned long addr, int len, int is_write,
96 int (*op)(unsigned long, int, void *), void *arg)
97 {
98 long size, remain, n;
99
100 size = min(PAGE_ALIGN(addr) - addr, (unsigned long) len);
101 remain = len;
102
103 n = do_op_one_page(addr, size, is_write, op, arg);
104 if (n != 0) {
105 remain = (n < 0 ? remain : 0);
106 goto out;
107 }
108
109 addr += size;
110 remain -= size;
111 if (remain == 0)
112 goto out;
113
114 while (addr < ((addr + remain) & PAGE_MASK)) {
115 n = do_op_one_page(addr, PAGE_SIZE, is_write, op, arg);
116 if (n != 0) {
117 remain = (n < 0 ? remain : 0);
118 goto out;
119 }
120
121 addr += PAGE_SIZE;
122 remain -= PAGE_SIZE;
123 }
124 if (remain == 0)
125 goto out;
126
127 n = do_op_one_page(addr, remain, is_write, op, arg);
128 if (n != 0) {
129 remain = (n < 0 ? remain : 0);
130 goto out;
131 }
132
133 return 0;
134 out:
135 return remain;
136 }
137
copy_chunk_from_user(unsigned long from,int len,void * arg)138 static int copy_chunk_from_user(unsigned long from, int len, void *arg)
139 {
140 unsigned long *to_ptr = arg, to = *to_ptr;
141
142 memcpy((void *) to, (void *) from, len);
143 *to_ptr += len;
144 return 0;
145 }
146
raw_copy_from_user(void * to,const void __user * from,unsigned long n)147 unsigned long raw_copy_from_user(void *to, const void __user *from, unsigned long n)
148 {
149 if (uaccess_kernel()) {
150 memcpy(to, (__force void*)from, n);
151 return 0;
152 }
153
154 return buffer_op((unsigned long) from, n, 0, copy_chunk_from_user, &to);
155 }
156 EXPORT_SYMBOL(raw_copy_from_user);
157
copy_chunk_to_user(unsigned long to,int len,void * arg)158 static int copy_chunk_to_user(unsigned long to, int len, void *arg)
159 {
160 unsigned long *from_ptr = arg, from = *from_ptr;
161
162 memcpy((void *) to, (void *) from, len);
163 *from_ptr += len;
164 return 0;
165 }
166
raw_copy_to_user(void __user * to,const void * from,unsigned long n)167 unsigned long raw_copy_to_user(void __user *to, const void *from, unsigned long n)
168 {
169 if (uaccess_kernel()) {
170 memcpy((__force void *) to, from, n);
171 return 0;
172 }
173
174 return buffer_op((unsigned long) to, n, 1, copy_chunk_to_user, &from);
175 }
176 EXPORT_SYMBOL(raw_copy_to_user);
177
strncpy_chunk_from_user(unsigned long from,int len,void * arg)178 static int strncpy_chunk_from_user(unsigned long from, int len, void *arg)
179 {
180 char **to_ptr = arg, *to = *to_ptr;
181 int n;
182
183 strncpy(to, (void *) from, len);
184 n = strnlen(to, len);
185 *to_ptr += n;
186
187 if (n < len)
188 return 1;
189 return 0;
190 }
191
strncpy_from_user(char * dst,const char __user * src,long count)192 long strncpy_from_user(char *dst, const char __user *src, long count)
193 {
194 long n;
195 char *ptr = dst;
196
197 if (!access_ok(src, 1))
198 return -EFAULT;
199
200 if (uaccess_kernel()) {
201 strncpy(dst, (__force void *) src, count);
202 return strnlen(dst, count);
203 }
204
205 n = buffer_op((unsigned long) src, count, 0, strncpy_chunk_from_user,
206 &ptr);
207 if (n != 0)
208 return -EFAULT;
209 return strnlen(dst, count);
210 }
211 EXPORT_SYMBOL(strncpy_from_user);
212
clear_chunk(unsigned long addr,int len,void * unused)213 static int clear_chunk(unsigned long addr, int len, void *unused)
214 {
215 memset((void *) addr, 0, len);
216 return 0;
217 }
218
__clear_user(void __user * mem,unsigned long len)219 unsigned long __clear_user(void __user *mem, unsigned long len)
220 {
221 if (uaccess_kernel()) {
222 memset((__force void*)mem, 0, len);
223 return 0;
224 }
225
226 return buffer_op((unsigned long) mem, len, 1, clear_chunk, NULL);
227 }
228 EXPORT_SYMBOL(__clear_user);
229
strnlen_chunk(unsigned long str,int len,void * arg)230 static int strnlen_chunk(unsigned long str, int len, void *arg)
231 {
232 int *len_ptr = arg, n;
233
234 n = strnlen((void *) str, len);
235 *len_ptr += n;
236
237 if (n < len)
238 return 1;
239 return 0;
240 }
241
strnlen_user(const char __user * str,long len)242 long strnlen_user(const char __user *str, long len)
243 {
244 int count = 0, n;
245
246 if (!access_ok(str, 1))
247 return -EFAULT;
248
249 if (uaccess_kernel())
250 return strnlen((__force char*)str, len) + 1;
251
252 n = buffer_op((unsigned long) str, len, 0, strnlen_chunk, &count);
253 if (n == 0)
254 return count + 1;
255 return 0;
256 }
257 EXPORT_SYMBOL(strnlen_user);
258
259 /**
260 * arch_futex_atomic_op_inuser() - Atomic arithmetic operation with constant
261 * argument and comparison of the previous
262 * futex value with another constant.
263 *
264 * @encoded_op: encoded operation to execute
265 * @uaddr: pointer to user space address
266 *
267 * Return:
268 * 0 - On success
269 * -EFAULT - User access resulted in a page fault
270 * -EAGAIN - Atomic operation was unable to complete due to contention
271 * -ENOSYS - Operation not supported
272 */
273
arch_futex_atomic_op_inuser(int op,u32 oparg,int * oval,u32 __user * uaddr)274 int arch_futex_atomic_op_inuser(int op, u32 oparg, int *oval, u32 __user *uaddr)
275 {
276 int oldval, ret;
277 struct page *page;
278 unsigned long addr = (unsigned long) uaddr;
279 pte_t *pte;
280
281 ret = -EFAULT;
282 if (!access_ok(uaddr, sizeof(*uaddr)))
283 return -EFAULT;
284 preempt_disable();
285 pte = maybe_map(addr, 1);
286 if (pte == NULL)
287 goto out_inuser;
288
289 page = pte_page(*pte);
290 #ifdef CONFIG_64BIT
291 pagefault_disable();
292 addr = (unsigned long) page_address(page) +
293 (((unsigned long) addr) & ~PAGE_MASK);
294 #else
295 addr = (unsigned long) kmap_atomic(page) +
296 ((unsigned long) addr & ~PAGE_MASK);
297 #endif
298 uaddr = (u32 *) addr;
299 oldval = *uaddr;
300
301 ret = 0;
302
303 switch (op) {
304 case FUTEX_OP_SET:
305 *uaddr = oparg;
306 break;
307 case FUTEX_OP_ADD:
308 *uaddr += oparg;
309 break;
310 case FUTEX_OP_OR:
311 *uaddr |= oparg;
312 break;
313 case FUTEX_OP_ANDN:
314 *uaddr &= ~oparg;
315 break;
316 case FUTEX_OP_XOR:
317 *uaddr ^= oparg;
318 break;
319 default:
320 ret = -ENOSYS;
321 }
322 #ifdef CONFIG_64BIT
323 pagefault_enable();
324 #else
325 kunmap_atomic((void *)addr);
326 #endif
327
328 out_inuser:
329 preempt_enable();
330
331 if (ret == 0)
332 *oval = oldval;
333
334 return ret;
335 }
336 EXPORT_SYMBOL(arch_futex_atomic_op_inuser);
337
338 /**
339 * futex_atomic_cmpxchg_inatomic() - Compare and exchange the content of the
340 * uaddr with newval if the current value is
341 * oldval.
342 * @uval: pointer to store content of @uaddr
343 * @uaddr: pointer to user space address
344 * @oldval: old value
345 * @newval: new value to store to @uaddr
346 *
347 * Return:
348 * 0 - On success
349 * -EFAULT - User access resulted in a page fault
350 * -EAGAIN - Atomic operation was unable to complete due to contention
351 * -ENOSYS - Function not implemented (only if !HAVE_FUTEX_CMPXCHG)
352 */
353
futex_atomic_cmpxchg_inatomic(u32 * uval,u32 __user * uaddr,u32 oldval,u32 newval)354 int futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
355 u32 oldval, u32 newval)
356 {
357 struct page *page;
358 pte_t *pte;
359 int ret = -EFAULT;
360
361 if (!access_ok(uaddr, sizeof(*uaddr)))
362 return -EFAULT;
363
364 preempt_disable();
365 pte = maybe_map((unsigned long) uaddr, 1);
366 if (pte == NULL)
367 goto out_inatomic;
368
369 page = pte_page(*pte);
370 #ifdef CONFIG_64BIT
371 pagefault_disable();
372 uaddr = page_address(page) + (((unsigned long) uaddr) & ~PAGE_MASK);
373 #else
374 uaddr = kmap_atomic(page) + ((unsigned long) uaddr & ~PAGE_MASK);
375 #endif
376
377 *uval = *uaddr;
378
379 ret = cmpxchg(uaddr, oldval, newval);
380
381 #ifdef CONFIG_64BIT
382 pagefault_enable();
383 #else
384 kunmap_atomic(uaddr);
385 #endif
386 ret = 0;
387
388 out_inatomic:
389 preempt_enable();
390 return ret;
391 }
392 EXPORT_SYMBOL(futex_atomic_cmpxchg_inatomic);
393