Subversion Repositories c0or1k

/*

 * Functions to validate, map and unmap user buffers.

 *

 * Copyright (C) 2008 Bahadir Balban

 */

#include L4LIB_INC_ARCH(syslib.h)

#include <vm_area.h>

#include <task.h>

#include <user.h>

#include <l4/api/errno.h>

#include <malloc/malloc.h>

/*

 * Checks if the given user virtual address range is

 * validly owned by that user with given flags.

 *

 * FIXME: This scans the vmas page by page, we can do it faster

 * by leaping from one vma to next.

 */

int pager_validate_user_range(struct tcb *user, void *userptr, unsigned long size,

                              unsigned int vmflags)

{

        struct vm_area *vma;

        unsigned long start = page_align(userptr);

        unsigned long end = page_align_up(userptr + size);

        /* Find the vma that maps that virtual address */

        for (unsigned long vaddr = start; vaddr < end; vaddr += PAGE_SIZE) {

                if (!(vma = find_vma(vaddr, &user->vm_area_head->list))) {

                        //printf("%s: No VMA found for 0x%x on task: %d\n",

                        //       __FUNCTION__, vaddr, user->tid);

                        return -1;

                }

                if ((vma->flags & vmflags) != vmflags)

                        return -1;

        }

        return 0;

}

/*

 * Validates and maps the user virtual address range to the pager.

 * Every virtual page needs to be mapped individually because it's

 * not guaranteed pages are physically contiguous.

 *

 * FIXME: There's no logic here to make non-contiguous physical pages

 * to get mapped virtually contiguous.

 */

void *pager_get_user_page(struct tcb *user, void *userptr,

                          unsigned long size, unsigned int vm_flags)

{

        unsigned long start = page_align(userptr);

        unsigned long end = page_align_up(userptr + size);

        void *mapped = 0;

        /* Validate that user task owns this address range */

        if (pager_validate_user_range(user, userptr, size, vm_flags) < 0)

                return 0;

        /* Map first page and calculate the mapped address of pointer */

        mapped = page_to_virt(task_prefault_page(user, start, vm_flags));

        mapped = (void *)(((unsigned long)mapped) |

                          ((unsigned long)(PAGE_MASK & (unsigned long)userptr)));

        /* Map the rest of the pages, if any */

        for (unsigned long i = start + PAGE_SIZE; i < end; i += PAGE_SIZE)

                BUG();

        return mapped;

}

/*

 * Copy from one buffer to another. Stop if maxlength or

 * a page boundary is hit.

 */

int strncpy_page(void *to_ptr, void *from_ptr, int maxlength)

{

        int count = 0;

        char *to = to_ptr, *from = from_ptr;

        do {

                if ((to[count] = from[count]) == '\0') {

                        count++;

                        break;

                } else

                        count++;

        } while (count < maxlength && !page_boundary(&from[count]));

        if (page_boundary(&from[count]))

                return -EFAULT;

        if (count == maxlength)

                return -E2BIG;

        return count;

}

/*

 * Copy from one buffer to another. Stop if maxlength or

 * a page boundary is hit. Breaks if unsigned long sized copy value is 0,

 * as opposed to a 0 byte as in string copy. If byte size 0 was used

 * a valid pointer with a 0 byte in it would give a false termination.

 */

int bufncpy_page(void *to_ptr, void *from_ptr, int maxlength)

{

        int count = 0;

        unsigned long *to = to_ptr, *from = from_ptr;

        do {

                if ((to[count] = from[count]) == 0) {

                        count++;

                        break;

                } else

                        count++;

        } while (count < maxlength && !page_boundary(&from[count]));

        if (page_boundary(&from[count]))

                return -EFAULT;

        if (count == maxlength)

                return -E2BIG;

        return count;

}

/*

 * Copies src to dest for given size, return -EFAULT on page boundaries.

 */

int memcpy_page(void *dst, void *src, int size, int fault_on_dest)

{

        int count = 0;

        char *to = dst, *from = src;

        if (!fault_on_dest) {

                do {

                        to[count] = from[count];

                        count++;

                } while (count < size &&

                         !page_boundary(&from[count]));

        } else {

                do {

                        to[count] = from[count];

                        count++;

                } while (count < size &&

                         !page_boundary(&to[count]));

        }

        if (page_boundary(&from[count]))

                return -EFAULT;

        return count;

}

int copy_from_user(struct tcb *task, void *buf, char *user, int size)

{

        int copied = 0, ret = 0, total = 0;

        int count = size;

        void *mapped = 0;

        if (!(mapped = pager_get_user_page(task, user, TILL_PAGE_ENDS(user),

                                           VM_READ)))

                return -EINVAL;

        while ((ret = memcpy_page(buf + copied, mapped, count, 0)) < 0) {

                copied += TILL_PAGE_ENDS(mapped);

                count -= TILL_PAGE_ENDS(mapped);

                if (!(mapped =

                      pager_get_user_page(task, user + copied,

                                          TILL_PAGE_ENDS(user + copied),

                                          VM_READ)))

                        return -EINVAL;

        }

        /* Note copied is always in bytes */

        total = copied + ret;

        return total;

}

int copy_to_user(struct tcb *task, char *user, void *buf, int size)

{

        int copied = 0, ret = 0, total = 0;

        int count = size;

        void *mapped = 0;

        /* Map the user page */

        if (!(mapped = pager_get_user_page(task, user,

                                           TILL_PAGE_ENDS(user),

                                           VM_READ | VM_WRITE)))

                return -EINVAL;

        while ((ret = memcpy_page(mapped, buf + copied, count, 1)) < 0) {

                copied += TILL_PAGE_ENDS(mapped);

                count -= TILL_PAGE_ENDS(mapped);

                if (!(mapped = pager_get_user_page(task, user + copied,

                                                   TILL_PAGE_ENDS(user + copied),

                                                   VM_READ | VM_WRITE)))

                        return -EINVAL;

        }

        /* Note copied is always in bytes */

        total = copied + ret;

        return total;

}

/*

 * Copies a variable sized userspace string or array of pointers

 * (think &argv[0]), into buffer. If a page boundary is hit,

 * unmaps the previous page, validates and maps the new page.

 */

int copy_user_buf(struct tcb *task, void *buf, char *user, int maxlength,

                  int elem_size)

{

        int count = maxlength;

        int copied = 0, ret = 0, total = 0;

        void *mapped = 0;

        int (*copy_func)(void *, void *, int count);

        /* This bit determines what size copier function to use. */

        if (elem_size == sizeof(char))

                copy_func = strncpy_page;

        else if (elem_size == sizeof(unsigned long))

                copy_func = bufncpy_page;

        else

                return -EINVAL;

        /* Map the first page the user buffer is in */

        if (!(mapped = pager_get_user_page(task, user, TILL_PAGE_ENDS(user),

                                           VM_READ)))

                return -EINVAL;

        while ((ret = copy_func(buf + copied, mapped, count)) < 0) {

                if (ret == -E2BIG)

                        return ret;

                else if (ret == -EFAULT) {

                        /*

                         * Copied is always in bytes no matter what elem_size is

                         * because we know we hit a page boundary and we increase

                         * by the page boundary bytes

                         */

                        copied += TILL_PAGE_ENDS(mapped);

                        count -= TILL_PAGE_ENDS(mapped);

                        if (!(mapped =

                              pager_get_user_page(task, user + copied,

                                                  TILL_PAGE_ENDS(user + copied),

                                                  VM_READ)))

                                return -EINVAL;

                }

        }

        /* Note copied is always in bytes */

        total = (copied / elem_size) + ret;

        return total;

}

/*

 * Calls copy_user_buf with char-sized copying. This matters because

 * buffer is variable and the terminator must be in char size

 */

int copy_user_string(struct tcb *task, void *buf, char *user, int maxlength)

{

        return copy_user_buf(task, buf, user, maxlength, sizeof(char));

}

/*

 * Calls copy_user_buf with unsigned long sized copying. This matters

 * because buffer is variable and the terminator must be in ulong size

 */

static inline int

copy_user_ptrs(struct tcb *task, void *buf, char *user,

                 int maxlength)

{

        return copy_user_buf(task, buf, user, maxlength, sizeof(unsigned long));

}

int copy_user_args(struct tcb *task, struct args_struct *args,

                   void *argv_user, int args_max)

{

        char **argv = 0;

        void *argsbuf;

        char *curbuf;

        int argc = 0;

        int used;

        int count;

        if (!(argsbuf = kzalloc(args_max)))

                return -ENOMEM;

        /*

         * First, copy the null-terminated array of

         * pointers to argument strings.

         */

        if ((count = copy_user_ptrs(task, argsbuf, argv_user, args_max)) < 0)

                goto out;

        /* On success, we get the number of arg strings + the terminator */

        argc = count - 1;

        used = count * sizeof(char *);

        argv = argsbuf;

        curbuf = argsbuf + used;

        /* Now we copy each argument string into buffer */

        for (int i = 0; i < argc; i++) {

                /* Copy string into empty space in buffer */

                if ((count = copy_user_string(task, curbuf, argv[i],

                                              args_max - used)) < 0)

                        goto out;

                /* Replace pointer to string with copied location */

                argv[i] = curbuf;

                /* Update current empty buffer location */

                curbuf += count;

                /* Increase used buffer count */

                used += count;

        }

        /* Set up the args struct */

        args->argc = argc;

        args->argv = argv;

        args->size = used;

        return 0;

out:

        kfree(argsbuf);

        return count;

}