Fix a MP lock race. The MP locking state can change when lwkt_chktokens()
[dragonfly.git] / sys / i386 / i386 / vm86.c
1 /*-
2  * Copyright (c) 1997 Jonathan Lemon
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  * modification, are permitted provided that the following conditions
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  *
27  * $FreeBSD: src/sys/i386/i386/vm86.c,v 1.31.2.2 2001/10/05 06:18:55 peter Exp $
28  * $DragonFly: src/sys/i386/i386/Attic/vm86.c,v 1.14 2005/07/19 19:08:03 dillon Exp $
29  */
30
31 #include <sys/param.h>
32 #include <sys/systm.h>
33 #include <sys/kernel.h>
34 #include <sys/proc.h>
35 #include <sys/lock.h>
36 #include <sys/malloc.h>
37 #include <sys/sysctl.h>
38
39 #include <vm/vm.h>
40 #include <vm/pmap.h>
41 #include <vm/vm_map.h>
42 #include <vm/vm_page.h>
43
44 #include <sys/user.h>
45 #include <sys/thread2.h>
46
47 #include <machine/md_var.h>
48 #include <machine/pcb_ext.h>    /* pcb.h included via sys/user.h */
49 #include <machine/psl.h>
50 #include <machine/specialreg.h>
51 #include <machine/sysarch.h>
52 #include <machine/clock.h>
53 #include <bus/isa/i386/isa.h>
54 #include <bus/isa/rtc.h>
55 #include <i386/isa/timerreg.h>
56
57 extern int i386_extend_pcb      (struct proc *);
58 extern int vm86pa;
59 extern struct pcb *vm86pcb;
60
61 extern int vm86_bioscall(struct vm86frame *);
62 extern void vm86_biosret(struct vm86frame *);
63
64 #define PGTABLE_SIZE    ((1024 + 64) * 1024 / PAGE_SIZE)
65 #define INTMAP_SIZE     32
66 #define IOMAP_SIZE      ctob(IOPAGES)
67 #define TSS_SIZE \
68         (sizeof(struct pcb_ext) - sizeof(struct segment_descriptor) + \
69          INTMAP_SIZE + IOMAP_SIZE + 1)
70
71 struct vm86_layout {
72         pt_entry_t      vml_pgtbl[PGTABLE_SIZE];
73         struct  pcb vml_pcb;
74         struct  pcb_ext vml_ext;
75         char    vml_intmap[INTMAP_SIZE];
76         char    vml_iomap[IOMAP_SIZE];
77         char    vml_iomap_trailer;
78 };
79
80 void vm86_prepcall(struct vm86frame);
81
82 struct system_map {
83         int             type;
84         vm_offset_t     start;
85         vm_offset_t     end;
86 };
87
88 #define HLT     0xf4
89 #define CLI     0xfa
90 #define STI     0xfb
91 #define PUSHF   0x9c
92 #define POPF    0x9d
93 #define INTn    0xcd
94 #define IRET    0xcf
95 #define INB     0xe4
96 #define INW     0xe5
97 #define INBDX   0xec
98 #define INWDX   0xed
99 #define OUTB    0xe6
100 #define OUTW    0xe7
101 #define OUTBDX  0xee
102 #define OUTWDX  0xef
103 #define CALLm   0xff
104 #define OPERAND_SIZE_PREFIX     0x66
105 #define ADDRESS_SIZE_PREFIX     0x67
106 #define PUSH_MASK       ~(PSL_VM | PSL_RF | PSL_I)
107 #define POP_MASK        ~(PSL_VIP | PSL_VIF | PSL_VM | PSL_RF | PSL_IOPL)
108
109 static void vm86_setup_timer_fault(void);
110 static void vm86_clear_timer_fault(void);
111
112 static int vm86_blew_up_timer;
113
114 static int timer_warn = 1;
115 SYSCTL_INT(_debug, OID_AUTO, timer_warn, CTLFLAG_RW, &timer_warn, 0, "");
116
117 static __inline caddr_t
118 MAKE_ADDR(u_short sel, u_short off)
119 {
120         return ((caddr_t)((sel << 4) + off));
121 }
122
123 static __inline void
124 GET_VEC(u_int vec, u_short *sel, u_short *off)
125 {
126         *sel = vec >> 16;
127         *off = vec & 0xffff;
128 }
129
130 static __inline u_int
131 MAKE_VEC(u_short sel, u_short off)
132 {
133         return ((sel << 16) | off);
134 }
135
136 static __inline void
137 PUSH(u_short x, struct vm86frame *vmf)
138 {
139         vmf->vmf_sp -= 2;
140         susword(MAKE_ADDR(vmf->vmf_ss, vmf->vmf_sp), x);
141 }
142
143 static __inline void
144 PUSHL(u_int x, struct vm86frame *vmf)
145 {
146         vmf->vmf_sp -= 4;
147         suword(MAKE_ADDR(vmf->vmf_ss, vmf->vmf_sp), x);
148 }
149
150 static __inline u_short
151 POP(struct vm86frame *vmf)
152 {
153         u_short x = fusword(MAKE_ADDR(vmf->vmf_ss, vmf->vmf_sp));
154
155         vmf->vmf_sp += 2;
156         return (x);
157 }
158
159 static __inline u_int
160 POPL(struct vm86frame *vmf)
161 {
162         u_int x = fuword(MAKE_ADDR(vmf->vmf_ss, vmf->vmf_sp));
163
164         vmf->vmf_sp += 4;
165         return (x);
166 }
167
168 int
169 vm86_emulate(vmf)
170         struct vm86frame *vmf;
171 {
172         struct vm86_kernel *vm86;
173         caddr_t addr;
174         u_char i_byte;
175         u_int temp_flags;
176         int inc_ip = 1;
177         int retcode = 0;
178
179         /*
180          * pcb_ext contains the address of the extension area, or zero if
181          * the extension is not present.  (This check should not be needed,
182          * as we can't enter vm86 mode until we set up an extension area)
183          */
184         if (curthread->td_pcb->pcb_ext == 0)
185                 return (SIGBUS);
186         vm86 = &curthread->td_pcb->pcb_ext->ext_vm86;
187
188         if (vmf->vmf_eflags & PSL_T)
189                 retcode = SIGTRAP;
190
191         /*
192          * Instruction emulation
193          */
194         addr = MAKE_ADDR(vmf->vmf_cs, vmf->vmf_ip);
195         i_byte = fubyte(addr);
196         if (i_byte == ADDRESS_SIZE_PREFIX) {
197                 i_byte = fubyte(++addr);
198                 inc_ip++;
199         }
200
201         /*
202          * I/O emulation (TIMER only, a big hack).  Just reenable the
203          * IO bits involved, flag it, and retry the instruction.
204          */
205         switch(i_byte) {
206         case OUTB:
207         case OUTW:
208         case OUTBDX:
209         case OUTWDX:
210                 vm86_blew_up_timer = 1;
211                 /* fall through */
212         case INB:
213         case INW:
214         case INBDX:
215         case INWDX:
216                 vm86_clear_timer_fault();
217                 /* retry insn */
218                 return(0);
219         }
220
221         if (vm86->vm86_has_vme) {
222                 switch (i_byte) {
223                 case OPERAND_SIZE_PREFIX:
224                         i_byte = fubyte(++addr);
225                         inc_ip++;
226                         switch (i_byte) {
227                         case PUSHF:
228                                 if (vmf->vmf_eflags & PSL_VIF)
229                                         PUSHL((vmf->vmf_eflags & PUSH_MASK)
230                                             | PSL_IOPL | PSL_I, vmf);
231                                 else
232                                         PUSHL((vmf->vmf_eflags & PUSH_MASK)
233                                             | PSL_IOPL, vmf);
234                                 vmf->vmf_ip += inc_ip;
235                                 return (0);
236
237                         case POPF:
238                                 temp_flags = POPL(vmf) & POP_MASK;
239                                 vmf->vmf_eflags = (vmf->vmf_eflags & ~POP_MASK)
240                                     | temp_flags | PSL_VM | PSL_I;
241                                 vmf->vmf_ip += inc_ip;
242                                 if (temp_flags & PSL_I) {
243                                         vmf->vmf_eflags |= PSL_VIF;
244                                         if (vmf->vmf_eflags & PSL_VIP)
245                                                 break;
246                                 } else {
247                                         vmf->vmf_eflags &= ~PSL_VIF;
248                                 }
249                                 return (0);
250                         }
251                         break;
252
253                 /* VME faults here if VIP is set, but does not set VIF. */
254                 case STI:
255                         vmf->vmf_eflags |= PSL_VIF;
256                         vmf->vmf_ip += inc_ip;
257                         if ((vmf->vmf_eflags & PSL_VIP) == 0) {
258                                 uprintf("fatal sti\n");
259                                 return (SIGKILL);
260                         }
261                         break;
262
263                 /* VME if no redirection support */
264                 case INTn:
265                         break;
266
267                 /* VME if trying to set PSL_TF, or PSL_I when VIP is set */
268                 case POPF:
269                         temp_flags = POP(vmf) & POP_MASK;
270                         vmf->vmf_flags = (vmf->vmf_flags & ~POP_MASK)
271                             | temp_flags | PSL_VM | PSL_I;
272                         vmf->vmf_ip += inc_ip;
273                         if (temp_flags & PSL_I) {
274                                 vmf->vmf_eflags |= PSL_VIF;
275                                 if (vmf->vmf_eflags & PSL_VIP)
276                                         break;
277                         } else {
278                                 vmf->vmf_eflags &= ~PSL_VIF;
279                         }
280                         return (retcode);
281
282                 /* VME if trying to set PSL_TF, or PSL_I when VIP is set */
283                 case IRET:
284                         vmf->vmf_ip = POP(vmf);
285                         vmf->vmf_cs = POP(vmf);
286                         temp_flags = POP(vmf) & POP_MASK;
287                         vmf->vmf_flags = (vmf->vmf_flags & ~POP_MASK)
288                             | temp_flags | PSL_VM | PSL_I;
289                         if (temp_flags & PSL_I) {
290                                 vmf->vmf_eflags |= PSL_VIF;
291                                 if (vmf->vmf_eflags & PSL_VIP)
292                                         break;
293                         } else {
294                                 vmf->vmf_eflags &= ~PSL_VIF;
295                         }
296                         return (retcode);
297
298                 }
299                 return (SIGBUS);
300         }
301
302         switch (i_byte) {
303         case OPERAND_SIZE_PREFIX:
304                 i_byte = fubyte(++addr);
305                 inc_ip++;
306                 switch (i_byte) {
307                 case PUSHF:
308                         if (vm86->vm86_eflags & PSL_VIF)
309                                 PUSHL((vmf->vmf_flags & PUSH_MASK)
310                                     | PSL_IOPL | PSL_I, vmf);
311                         else
312                                 PUSHL((vmf->vmf_flags & PUSH_MASK)
313                                     | PSL_IOPL, vmf);
314                         vmf->vmf_ip += inc_ip;
315                         return (retcode);
316
317                 case POPF:
318                         temp_flags = POPL(vmf) & POP_MASK;
319                         vmf->vmf_eflags = (vmf->vmf_eflags & ~POP_MASK)
320                             | temp_flags | PSL_VM | PSL_I;
321                         vmf->vmf_ip += inc_ip;
322                         if (temp_flags & PSL_I) {
323                                 vm86->vm86_eflags |= PSL_VIF;
324                                 if (vm86->vm86_eflags & PSL_VIP)
325                                         break;
326                         } else {
327                                 vm86->vm86_eflags &= ~PSL_VIF;
328                         }
329                         return (retcode);
330                 }
331                 return (SIGBUS);
332
333         case CLI:
334                 vm86->vm86_eflags &= ~PSL_VIF;
335                 vmf->vmf_ip += inc_ip;
336                 return (retcode);
337
338         case STI:
339                 /* if there is a pending interrupt, go to the emulator */
340                 vm86->vm86_eflags |= PSL_VIF;
341                 vmf->vmf_ip += inc_ip;
342                 if (vm86->vm86_eflags & PSL_VIP)
343                         break;
344                 return (retcode);
345
346         case PUSHF:
347                 if (vm86->vm86_eflags & PSL_VIF)
348                         PUSH((vmf->vmf_flags & PUSH_MASK)
349                             | PSL_IOPL | PSL_I, vmf);
350                 else
351                         PUSH((vmf->vmf_flags & PUSH_MASK) | PSL_IOPL, vmf);
352                 vmf->vmf_ip += inc_ip;
353                 return (retcode);
354
355         case INTn:
356                 i_byte = fubyte(addr + 1);
357                 if ((vm86->vm86_intmap[i_byte >> 3] & (1 << (i_byte & 7))) != 0)
358                         break;
359                 if (vm86->vm86_eflags & PSL_VIF)
360                         PUSH((vmf->vmf_flags & PUSH_MASK)
361                             | PSL_IOPL | PSL_I, vmf);
362                 else
363                         PUSH((vmf->vmf_flags & PUSH_MASK) | PSL_IOPL, vmf);
364                 PUSH(vmf->vmf_cs, vmf);
365                 PUSH(vmf->vmf_ip + inc_ip + 1, vmf);    /* increment IP */
366                 GET_VEC(fuword((caddr_t)(i_byte * 4)),
367                      &vmf->vmf_cs, &vmf->vmf_ip);
368                 vmf->vmf_flags &= ~PSL_T;
369                 vm86->vm86_eflags &= ~PSL_VIF;
370                 return (retcode);
371
372         case IRET:
373                 vmf->vmf_ip = POP(vmf);
374                 vmf->vmf_cs = POP(vmf);
375                 temp_flags = POP(vmf) & POP_MASK;
376                 vmf->vmf_flags = (vmf->vmf_flags & ~POP_MASK)
377                     | temp_flags | PSL_VM | PSL_I;
378                 if (temp_flags & PSL_I) {
379                         vm86->vm86_eflags |= PSL_VIF;
380                         if (vm86->vm86_eflags & PSL_VIP)
381                                 break;
382                 } else {
383                         vm86->vm86_eflags &= ~PSL_VIF;
384                 }
385                 return (retcode);
386
387         case POPF:
388                 temp_flags = POP(vmf) & POP_MASK;
389                 vmf->vmf_flags = (vmf->vmf_flags & ~POP_MASK)
390                     | temp_flags | PSL_VM | PSL_I;
391                 vmf->vmf_ip += inc_ip;
392                 if (temp_flags & PSL_I) {
393                         vm86->vm86_eflags |= PSL_VIF;
394                         if (vm86->vm86_eflags & PSL_VIP)
395                                 break;
396                 } else {
397                         vm86->vm86_eflags &= ~PSL_VIF;
398                 }
399                 return (retcode);
400         }
401         return (SIGBUS);
402 }
403
404 void
405 vm86_initialize(void)
406 {
407         int i;
408         u_int *addr;
409         struct vm86_layout *vml = (struct vm86_layout *)vm86paddr;
410         struct pcb *pcb;
411         struct pcb_ext *ext;
412         struct soft_segment_descriptor ssd = {
413                 0,                      /* segment base address (overwritten) */
414                 0,                      /* length (overwritten) */
415                 SDT_SYS386TSS,          /* segment type */
416                 0,                      /* priority level */
417                 1,                      /* descriptor present */
418                 0, 0,
419                 0,                      /* default 16 size */
420                 0                       /* granularity */
421         };
422
423         /*
424          * this should be a compile time error, but cpp doesn't grok sizeof().
425          */
426         if (sizeof(struct vm86_layout) > ctob(3))
427                 panic("struct vm86_layout exceeds space allocated in locore.s");
428
429         /*
430          * Below is the memory layout that we use for the vm86 region.
431          *
432          * +--------+
433          * |        | 
434          * |        |
435          * | page 0 |       
436          * |        | +--------+
437          * |        | | stack  |
438          * +--------+ +--------+ <--------- vm86paddr
439          * |        | |Page Tbl| 1M + 64K = 272 entries = 1088 bytes
440          * |        | +--------+
441          * |        | |  PCB   | size: ~240 bytes
442          * | page 1 | |PCB Ext | size: ~140 bytes (includes TSS)
443          * |        | +--------+
444          * |        | |int map |
445          * |        | +--------+
446          * +--------+ |        |
447          * | page 2 | |  I/O   |
448          * +--------+ | bitmap |
449          * | page 3 | |        |
450          * |        | +--------+
451          * +--------+ 
452          */
453
454         /*
455          * A rudimentary PCB must be installed, in order to get to the
456          * PCB extension area.  We use the PCB area as a scratchpad for
457          * data storage, the layout of which is shown below.
458          *
459          * pcb_esi      = new PTD entry 0
460          * pcb_ebp      = pointer to frame on vm86 stack
461          * pcb_esp      =    stack frame pointer at time of switch
462          * pcb_ebx      = va of vm86 page table
463          * pcb_eip      =    argument pointer to initial call
464          * pcb_spare[0] =    saved TSS descriptor, word 0
465          * pcb_space[1] =    saved TSS descriptor, word 1
466          */
467 #define new_ptd         pcb_esi
468 #define vm86_frame      pcb_ebp
469 #define pgtable_va      pcb_ebx
470
471         pcb = &vml->vml_pcb;
472         ext = &vml->vml_ext;
473
474         bzero(pcb, sizeof(struct pcb));
475         pcb->new_ptd = vm86pa | PG_V | PG_RW | PG_U;
476         pcb->vm86_frame = (pt_entry_t)vm86paddr - sizeof(struct vm86frame);
477         pcb->pgtable_va = (vm_offset_t)vm86paddr;
478         pcb->pcb_ext = ext;
479
480         bzero(ext, sizeof(struct pcb_ext)); 
481         ext->ext_tss.tss_esp0 = (vm_offset_t)vm86paddr;
482         ext->ext_tss.tss_ss0 = GSEL(GDATA_SEL, SEL_KPL);
483         ext->ext_tss.tss_ioopt = 
484                 ((u_int)vml->vml_iomap - (u_int)&ext->ext_tss) << 16;
485         ext->ext_iomap = vml->vml_iomap;
486         ext->ext_vm86.vm86_intmap = vml->vml_intmap;
487
488         if (cpu_feature & CPUID_VME)
489                 ext->ext_vm86.vm86_has_vme = (rcr4() & CR4_VME ? 1 : 0);
490
491         addr = (u_int *)ext->ext_vm86.vm86_intmap;
492         for (i = 0; i < (INTMAP_SIZE + IOMAP_SIZE) / sizeof(u_int); i++)
493                 *addr++ = 0;
494         vml->vml_iomap_trailer = 0xff;
495
496         ssd.ssd_base = (u_int)&ext->ext_tss;
497         ssd.ssd_limit = TSS_SIZE - 1; 
498         ssdtosd(&ssd, &ext->ext_tssd);
499
500         vm86pcb = pcb;
501
502 #if 0
503         /*
504          * use whatever is leftover of the vm86 page layout as a
505          * message buffer so we can capture early output.
506          */
507         msgbufinit((vm_offset_t)vm86paddr + sizeof(struct vm86_layout),
508             ctob(3) - sizeof(struct vm86_layout));
509 #endif
510 }
511
512 vm_offset_t
513 vm86_getpage(struct vm86context *vmc, int pagenum)
514 {
515         int i;
516
517         for (i = 0; i < vmc->npages; i++)
518                 if (vmc->pmap[i].pte_num == pagenum)
519                         return (vmc->pmap[i].kva);
520         return (0);
521 }
522
523 vm_offset_t
524 vm86_addpage(struct vm86context *vmc, int pagenum, vm_offset_t kva)
525 {
526         int i, flags = 0;
527
528         for (i = 0; i < vmc->npages; i++)
529                 if (vmc->pmap[i].pte_num == pagenum)
530                         goto bad;
531
532         if (vmc->npages == VM86_PMAPSIZE)
533                 goto bad;                       /* XXX grow map? */
534
535         if (kva == 0) {
536                 kva = (vm_offset_t)malloc(PAGE_SIZE, M_TEMP, M_WAITOK);
537                 flags = VMAP_MALLOC;
538         }
539
540         i = vmc->npages++;
541         vmc->pmap[i].flags = flags;
542         vmc->pmap[i].kva = kva;
543         vmc->pmap[i].pte_num = pagenum;
544         return (kva);
545 bad:
546         panic("vm86_addpage: not enough room, or overlap");
547 }
548
549 static void
550 vm86_initflags(struct vm86frame *vmf)
551 {
552         int eflags = vmf->vmf_eflags;
553         struct vm86_kernel *vm86 = &curthread->td_pcb->pcb_ext->ext_vm86;
554
555         if (vm86->vm86_has_vme) {
556                 eflags = (vmf->vmf_eflags & ~VME_USERCHANGE) |
557                     (eflags & VME_USERCHANGE) | PSL_VM;
558         } else {
559                 vm86->vm86_eflags = eflags;     /* save VIF, VIP */
560                 eflags = (vmf->vmf_eflags & ~VM_USERCHANGE) |             
561                     (eflags & VM_USERCHANGE) | PSL_VM;
562         }
563         vmf->vmf_eflags = eflags | PSL_VM;
564 }
565
566 /*
567  * called from vm86_bioscall, while in vm86 address space, to finalize setup.
568  */
569 void
570 vm86_prepcall(struct vm86frame vmf)
571 {
572         uintptr_t addr[] = { 0xA00, 0x1000 };   /* code, stack */
573         u_char intcall[] = {
574                 CLI, INTn, 0x00, STI, HLT
575         };
576
577         if ((vmf.vmf_trapno & PAGE_MASK) <= 0xff) {
578                 /* interrupt call requested */
579                 intcall[2] = (u_char)(vmf.vmf_trapno & 0xff);
580                 memcpy((void *)addr[0], (void *)intcall, sizeof(intcall));
581                 vmf.vmf_ip = addr[0];
582                 vmf.vmf_cs = 0;
583         }
584         vmf.vmf_sp = addr[1] - 2;              /* keep aligned */
585         vmf.kernel_fs = vmf.kernel_es = vmf.kernel_ds = 0;
586         vmf.vmf_ss = 0;
587         vmf.vmf_eflags = PSL_VIF | PSL_VM | PSL_USER;
588         vm86_initflags(&vmf);
589 }
590
591 /*
592  * vm86 trap handler; determines whether routine succeeded or not.
593  * Called while in vm86 space, returns to calling process.
594  *
595  * A MP lock ref is held on entry from trap() and must be released prior
596  * to returning to the VM86 call.
597  */
598 void
599 vm86_trap(struct vm86frame *vmf)
600 {
601         caddr_t addr;
602
603         /* "should not happen" */
604         if ((vmf->vmf_eflags & PSL_VM) == 0)
605                 panic("vm86_trap called, but not in vm86 mode");
606
607         addr = MAKE_ADDR(vmf->vmf_cs, vmf->vmf_ip);
608         if (*(u_char *)addr == HLT)
609                 vmf->vmf_trapno = vmf->vmf_eflags & PSL_C;
610         else
611                 vmf->vmf_trapno = vmf->vmf_trapno << 16;
612
613         rel_mplock();
614         vm86_biosret(vmf);
615 }
616
617 int
618 vm86_intcall(int intnum, struct vm86frame *vmf)
619 {
620         int error;
621
622         if (intnum < 0 || intnum > 0xff)
623                 return (EINVAL);
624
625         crit_enter();
626         ASSERT_MP_LOCK_HELD(curthread);
627
628         vm86_setup_timer_fault();
629         vmf->vmf_trapno = intnum;
630         error = vm86_bioscall(vmf);
631
632         /*
633          * Yes, this happens, especially with video BIOS calls.  The BIOS
634          * will sometimes eat timer 2 for lunch, and we need timer 2.
635          */
636         if (vm86_blew_up_timer) {
637                 vm86_blew_up_timer = 0;
638                 timer_restore();
639                 if (timer_warn) {
640                         printf("Warning: BIOS played with the 8254, "
641                                 "resetting it\n");
642                 }
643         }
644         crit_exit();
645         return(error);
646 }
647
648 /*
649  * struct vm86context contains the page table to use when making
650  * vm86 calls.  If intnum is a valid interrupt number (0-255), then
651  * the "interrupt trampoline" will be used, otherwise we use the
652  * caller's cs:ip routine.  
653  */
654 int
655 vm86_datacall(intnum, vmf, vmc)
656         int intnum;
657         struct vm86frame *vmf;
658         struct vm86context *vmc;
659 {
660         pt_entry_t *pte = vm86paddr;
661         u_int page;
662         int i, entry, retval;
663
664         crit_enter();
665         ASSERT_MP_LOCK_HELD(curthread);
666
667         for (i = 0; i < vmc->npages; i++) {
668                 page = vtophys(vmc->pmap[i].kva & PG_FRAME);
669                 entry = vmc->pmap[i].pte_num; 
670                 vmc->pmap[i].old_pte = pte[entry];
671                 pte[entry] = page | PG_V | PG_RW | PG_U;
672         }
673
674         vmf->vmf_trapno = intnum;
675         retval = vm86_bioscall(vmf);
676
677         for (i = 0; i < vmc->npages; i++) {
678                 entry = vmc->pmap[i].pte_num;
679                 pte[entry] = vmc->pmap[i].old_pte;
680         }
681         crit_exit();
682         return (retval);
683 }
684
685 vm_offset_t
686 vm86_getaddr(vmc, sel, off)
687         struct vm86context *vmc;
688         u_short sel;
689         u_short off;
690 {
691         int i, page;
692         vm_offset_t addr;
693
694         addr = (vm_offset_t)MAKE_ADDR(sel, off);
695         page = addr >> PAGE_SHIFT;
696         for (i = 0; i < vmc->npages; i++)
697                 if (page == vmc->pmap[i].pte_num)
698                         return (vmc->pmap[i].kva + (addr & PAGE_MASK));
699         return (0);
700 }
701
702 int
703 vm86_getptr(vmc, kva, sel, off)
704         struct vm86context *vmc;
705         vm_offset_t kva;
706         u_short *sel;
707         u_short *off;
708 {
709         int i;
710
711         for (i = 0; i < vmc->npages; i++)
712                 if (kva >= vmc->pmap[i].kva &&
713                     kva < vmc->pmap[i].kva + PAGE_SIZE) {
714                         *off = kva - vmc->pmap[i].kva;
715                         *sel = vmc->pmap[i].pte_num << 8;
716                         return (1);
717                 }
718         return (0);
719         panic("vm86_getptr: address not found");
720 }
721         
722 int
723 vm86_sysarch(struct proc *p, char *args)
724 {
725         int error = 0;
726         struct i386_vm86_args ua;
727         struct vm86_kernel *vm86;
728
729         if ((error = copyin(args, &ua, sizeof(struct i386_vm86_args))) != 0)
730                 return (error);
731
732         if (p->p_thread->td_pcb->pcb_ext == 0)
733                 if ((error = i386_extend_pcb(p)) != 0)
734                         return (error);
735         vm86 = &p->p_thread->td_pcb->pcb_ext->ext_vm86;
736
737         switch (ua.sub_op) {
738         case VM86_INIT: {
739                 struct vm86_init_args sa;
740
741                 if ((error = copyin(ua.sub_args, &sa, sizeof(sa))) != 0)
742                         return (error);
743                 if (cpu_feature & CPUID_VME)
744                         vm86->vm86_has_vme = (rcr4() & CR4_VME ? 1 : 0);
745                 else
746                         vm86->vm86_has_vme = 0;
747                 vm86->vm86_inited = 1;
748                 vm86->vm86_debug = sa.debug;
749                 bcopy(&sa.int_map, vm86->vm86_intmap, 32);
750                 }
751                 break;
752
753 #if 0
754         case VM86_SET_VME: {
755                 struct vm86_vme_args sa;
756         
757                 if ((cpu_feature & CPUID_VME) == 0)
758                         return (ENODEV);
759
760                 if (error = copyin(ua.sub_args, &sa, sizeof(sa)))
761                         return (error);
762                 if (sa.state)
763                         load_cr4(rcr4() | CR4_VME);
764                 else
765                         load_cr4(rcr4() & ~CR4_VME);
766                 }
767                 break;
768 #endif
769
770         case VM86_GET_VME: {
771                 struct vm86_vme_args sa;
772
773                 sa.state = (rcr4() & CR4_VME ? 1 : 0);
774                 error = copyout(&sa, ua.sub_args, sizeof(sa));
775                 }
776                 break;
777
778         case VM86_INTCALL: {
779                 struct vm86_intcall_args sa;
780
781                 if ((error = suser_cred(p->p_ucred, 0)))
782                         return (error);
783                 if ((error = copyin(ua.sub_args, &sa, sizeof(sa))))
784                         return (error);
785                 if ((error = vm86_intcall(sa.intnum, &sa.vmf)))
786                         return (error);
787                 error = copyout(&sa, ua.sub_args, sizeof(sa));
788                 }
789                 break;
790
791         default:
792                 error = EINVAL;
793         }
794         return (error);
795 }
796
797 /*
798  * Setup the VM86 I/O map to take faults on the timer
799  */
800 static void
801 vm86_setup_timer_fault(void)
802 {
803         struct vm86_layout *vml = (struct vm86_layout *)vm86paddr;
804
805         vml->vml_iomap[TIMER_MODE >> 3] |= 1 << (TIMER_MODE & 7);
806         vml->vml_iomap[TIMER_CNTR0 >> 3] |= 1 << (TIMER_CNTR0 & 7);
807         vml->vml_iomap[TIMER_CNTR1 >> 3] |= 1 << (TIMER_CNTR1 & 7);
808         vml->vml_iomap[TIMER_CNTR2 >> 3] |= 1 << (TIMER_CNTR2 & 7);
809 }
810
811 /*
812  * Setup the VM86 I/O map to not fault on the timer
813  */
814 static void
815 vm86_clear_timer_fault(void)
816 {
817         struct vm86_layout *vml = (struct vm86_layout *)vm86paddr;
818
819         vml->vml_iomap[TIMER_MODE >> 3] &= ~(1 << (TIMER_MODE & 7));
820         vml->vml_iomap[TIMER_CNTR0 >> 3] &= ~(1 << (TIMER_CNTR0 & 7));
821         vml->vml_iomap[TIMER_CNTR1 >> 3] &= ~(1 << (TIMER_CNTR1 & 7));
822         vml->vml_iomap[TIMER_CNTR2 >> 3] &= ~(1 << (TIMER_CNTR2 & 7));
823 }
824