1*4882a593Smuzhiyun /*
2*4882a593Smuzhiyun * Copyright (C) 2005 Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
3*4882a593Smuzhiyun * Licensed under the GPL
4*4882a593Smuzhiyun */
5*4882a593Smuzhiyun
6*4882a593Smuzhiyun #include <linux/percpu.h>
7*4882a593Smuzhiyun #include <linux/sched.h>
8*4882a593Smuzhiyun #include <linux/syscalls.h>
9*4882a593Smuzhiyun #include <linux/uaccess.h>
10*4882a593Smuzhiyun #include <asm/ptrace-abi.h>
11*4882a593Smuzhiyun #include <os.h>
12*4882a593Smuzhiyun #include <skas.h>
13*4882a593Smuzhiyun #include <sysdep/tls.h>
14*4882a593Smuzhiyun
15*4882a593Smuzhiyun /*
16*4882a593Smuzhiyun * If needed we can detect when it's uninitialized.
17*4882a593Smuzhiyun *
18*4882a593Smuzhiyun * These are initialized in an initcall and unchanged thereafter.
19*4882a593Smuzhiyun */
20*4882a593Smuzhiyun static int host_supports_tls = -1;
21*4882a593Smuzhiyun int host_gdt_entry_tls_min;
22*4882a593Smuzhiyun
do_set_thread_area(struct user_desc * info)23*4882a593Smuzhiyun int do_set_thread_area(struct user_desc *info)
24*4882a593Smuzhiyun {
25*4882a593Smuzhiyun int ret;
26*4882a593Smuzhiyun u32 cpu;
27*4882a593Smuzhiyun
28*4882a593Smuzhiyun cpu = get_cpu();
29*4882a593Smuzhiyun ret = os_set_thread_area(info, userspace_pid[cpu]);
30*4882a593Smuzhiyun put_cpu();
31*4882a593Smuzhiyun
32*4882a593Smuzhiyun if (ret)
33*4882a593Smuzhiyun printk(KERN_ERR "PTRACE_SET_THREAD_AREA failed, err = %d, "
34*4882a593Smuzhiyun "index = %d\n", ret, info->entry_number);
35*4882a593Smuzhiyun
36*4882a593Smuzhiyun return ret;
37*4882a593Smuzhiyun }
38*4882a593Smuzhiyun
do_get_thread_area(struct user_desc * info)39*4882a593Smuzhiyun int do_get_thread_area(struct user_desc *info)
40*4882a593Smuzhiyun {
41*4882a593Smuzhiyun int ret;
42*4882a593Smuzhiyun u32 cpu;
43*4882a593Smuzhiyun
44*4882a593Smuzhiyun cpu = get_cpu();
45*4882a593Smuzhiyun ret = os_get_thread_area(info, userspace_pid[cpu]);
46*4882a593Smuzhiyun put_cpu();
47*4882a593Smuzhiyun
48*4882a593Smuzhiyun if (ret)
49*4882a593Smuzhiyun printk(KERN_ERR "PTRACE_GET_THREAD_AREA failed, err = %d, "
50*4882a593Smuzhiyun "index = %d\n", ret, info->entry_number);
51*4882a593Smuzhiyun
52*4882a593Smuzhiyun return ret;
53*4882a593Smuzhiyun }
54*4882a593Smuzhiyun
55*4882a593Smuzhiyun /*
56*4882a593Smuzhiyun * sys_get_thread_area: get a yet unused TLS descriptor index.
57*4882a593Smuzhiyun * XXX: Consider leaving one free slot for glibc usage at first place. This must
58*4882a593Smuzhiyun * be done here (and by changing GDT_ENTRY_TLS_* macros) and nowhere else.
59*4882a593Smuzhiyun *
60*4882a593Smuzhiyun * Also, this must be tested when compiling in SKAS mode with dynamic linking
61*4882a593Smuzhiyun * and running against NPTL.
62*4882a593Smuzhiyun */
get_free_idx(struct task_struct * task)63*4882a593Smuzhiyun static int get_free_idx(struct task_struct* task)
64*4882a593Smuzhiyun {
65*4882a593Smuzhiyun struct thread_struct *t = &task->thread;
66*4882a593Smuzhiyun int idx;
67*4882a593Smuzhiyun
68*4882a593Smuzhiyun for (idx = 0; idx < GDT_ENTRY_TLS_ENTRIES; idx++)
69*4882a593Smuzhiyun if (!t->arch.tls_array[idx].present)
70*4882a593Smuzhiyun return idx + GDT_ENTRY_TLS_MIN;
71*4882a593Smuzhiyun return -ESRCH;
72*4882a593Smuzhiyun }
73*4882a593Smuzhiyun
clear_user_desc(struct user_desc * info)74*4882a593Smuzhiyun static inline void clear_user_desc(struct user_desc* info)
75*4882a593Smuzhiyun {
76*4882a593Smuzhiyun /* Postcondition: LDT_empty(info) returns true. */
77*4882a593Smuzhiyun memset(info, 0, sizeof(*info));
78*4882a593Smuzhiyun
79*4882a593Smuzhiyun /*
80*4882a593Smuzhiyun * Check the LDT_empty or the i386 sys_get_thread_area code - we obtain
81*4882a593Smuzhiyun * indeed an empty user_desc.
82*4882a593Smuzhiyun */
83*4882a593Smuzhiyun info->read_exec_only = 1;
84*4882a593Smuzhiyun info->seg_not_present = 1;
85*4882a593Smuzhiyun }
86*4882a593Smuzhiyun
87*4882a593Smuzhiyun #define O_FORCE 1
88*4882a593Smuzhiyun
load_TLS(int flags,struct task_struct * to)89*4882a593Smuzhiyun static int load_TLS(int flags, struct task_struct *to)
90*4882a593Smuzhiyun {
91*4882a593Smuzhiyun int ret = 0;
92*4882a593Smuzhiyun int idx;
93*4882a593Smuzhiyun
94*4882a593Smuzhiyun for (idx = GDT_ENTRY_TLS_MIN; idx < GDT_ENTRY_TLS_MAX; idx++) {
95*4882a593Smuzhiyun struct uml_tls_struct* curr =
96*4882a593Smuzhiyun &to->thread.arch.tls_array[idx - GDT_ENTRY_TLS_MIN];
97*4882a593Smuzhiyun
98*4882a593Smuzhiyun /*
99*4882a593Smuzhiyun * Actually, now if it wasn't flushed it gets cleared and
100*4882a593Smuzhiyun * flushed to the host, which will clear it.
101*4882a593Smuzhiyun */
102*4882a593Smuzhiyun if (!curr->present) {
103*4882a593Smuzhiyun if (!curr->flushed) {
104*4882a593Smuzhiyun clear_user_desc(&curr->tls);
105*4882a593Smuzhiyun curr->tls.entry_number = idx;
106*4882a593Smuzhiyun } else {
107*4882a593Smuzhiyun WARN_ON(!LDT_empty(&curr->tls));
108*4882a593Smuzhiyun continue;
109*4882a593Smuzhiyun }
110*4882a593Smuzhiyun }
111*4882a593Smuzhiyun
112*4882a593Smuzhiyun if (!(flags & O_FORCE) && curr->flushed)
113*4882a593Smuzhiyun continue;
114*4882a593Smuzhiyun
115*4882a593Smuzhiyun ret = do_set_thread_area(&curr->tls);
116*4882a593Smuzhiyun if (ret)
117*4882a593Smuzhiyun goto out;
118*4882a593Smuzhiyun
119*4882a593Smuzhiyun curr->flushed = 1;
120*4882a593Smuzhiyun }
121*4882a593Smuzhiyun out:
122*4882a593Smuzhiyun return ret;
123*4882a593Smuzhiyun }
124*4882a593Smuzhiyun
125*4882a593Smuzhiyun /*
126*4882a593Smuzhiyun * Verify if we need to do a flush for the new process, i.e. if there are any
127*4882a593Smuzhiyun * present desc's, only if they haven't been flushed.
128*4882a593Smuzhiyun */
needs_TLS_update(struct task_struct * task)129*4882a593Smuzhiyun static inline int needs_TLS_update(struct task_struct *task)
130*4882a593Smuzhiyun {
131*4882a593Smuzhiyun int i;
132*4882a593Smuzhiyun int ret = 0;
133*4882a593Smuzhiyun
134*4882a593Smuzhiyun for (i = GDT_ENTRY_TLS_MIN; i < GDT_ENTRY_TLS_MAX; i++) {
135*4882a593Smuzhiyun struct uml_tls_struct* curr =
136*4882a593Smuzhiyun &task->thread.arch.tls_array[i - GDT_ENTRY_TLS_MIN];
137*4882a593Smuzhiyun
138*4882a593Smuzhiyun /*
139*4882a593Smuzhiyun * Can't test curr->present, we may need to clear a descriptor
140*4882a593Smuzhiyun * which had a value.
141*4882a593Smuzhiyun */
142*4882a593Smuzhiyun if (curr->flushed)
143*4882a593Smuzhiyun continue;
144*4882a593Smuzhiyun ret = 1;
145*4882a593Smuzhiyun break;
146*4882a593Smuzhiyun }
147*4882a593Smuzhiyun return ret;
148*4882a593Smuzhiyun }
149*4882a593Smuzhiyun
150*4882a593Smuzhiyun /*
151*4882a593Smuzhiyun * On a newly forked process, the TLS descriptors haven't yet been flushed. So
152*4882a593Smuzhiyun * we mark them as such and the first switch_to will do the job.
153*4882a593Smuzhiyun */
clear_flushed_tls(struct task_struct * task)154*4882a593Smuzhiyun void clear_flushed_tls(struct task_struct *task)
155*4882a593Smuzhiyun {
156*4882a593Smuzhiyun int i;
157*4882a593Smuzhiyun
158*4882a593Smuzhiyun for (i = GDT_ENTRY_TLS_MIN; i < GDT_ENTRY_TLS_MAX; i++) {
159*4882a593Smuzhiyun struct uml_tls_struct* curr =
160*4882a593Smuzhiyun &task->thread.arch.tls_array[i - GDT_ENTRY_TLS_MIN];
161*4882a593Smuzhiyun
162*4882a593Smuzhiyun /*
163*4882a593Smuzhiyun * Still correct to do this, if it wasn't present on the host it
164*4882a593Smuzhiyun * will remain as flushed as it was.
165*4882a593Smuzhiyun */
166*4882a593Smuzhiyun if (!curr->present)
167*4882a593Smuzhiyun continue;
168*4882a593Smuzhiyun
169*4882a593Smuzhiyun curr->flushed = 0;
170*4882a593Smuzhiyun }
171*4882a593Smuzhiyun }
172*4882a593Smuzhiyun
173*4882a593Smuzhiyun /*
174*4882a593Smuzhiyun * In SKAS0 mode, currently, multiple guest threads sharing the same ->mm have a
175*4882a593Smuzhiyun * common host process. So this is needed in SKAS0 too.
176*4882a593Smuzhiyun *
177*4882a593Smuzhiyun * However, if each thread had a different host process (and this was discussed
178*4882a593Smuzhiyun * for SMP support) this won't be needed.
179*4882a593Smuzhiyun *
180*4882a593Smuzhiyun * And this will not need be used when (and if) we'll add support to the host
181*4882a593Smuzhiyun * SKAS patch.
182*4882a593Smuzhiyun */
183*4882a593Smuzhiyun
arch_switch_tls(struct task_struct * to)184*4882a593Smuzhiyun int arch_switch_tls(struct task_struct *to)
185*4882a593Smuzhiyun {
186*4882a593Smuzhiyun if (!host_supports_tls)
187*4882a593Smuzhiyun return 0;
188*4882a593Smuzhiyun
189*4882a593Smuzhiyun /*
190*4882a593Smuzhiyun * We have no need whatsoever to switch TLS for kernel threads; beyond
191*4882a593Smuzhiyun * that, that would also result in us calling os_set_thread_area with
192*4882a593Smuzhiyun * userspace_pid[cpu] == 0, which gives an error.
193*4882a593Smuzhiyun */
194*4882a593Smuzhiyun if (likely(to->mm))
195*4882a593Smuzhiyun return load_TLS(O_FORCE, to);
196*4882a593Smuzhiyun
197*4882a593Smuzhiyun return 0;
198*4882a593Smuzhiyun }
199*4882a593Smuzhiyun
set_tls_entry(struct task_struct * task,struct user_desc * info,int idx,int flushed)200*4882a593Smuzhiyun static int set_tls_entry(struct task_struct* task, struct user_desc *info,
201*4882a593Smuzhiyun int idx, int flushed)
202*4882a593Smuzhiyun {
203*4882a593Smuzhiyun struct thread_struct *t = &task->thread;
204*4882a593Smuzhiyun
205*4882a593Smuzhiyun if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
206*4882a593Smuzhiyun return -EINVAL;
207*4882a593Smuzhiyun
208*4882a593Smuzhiyun t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].tls = *info;
209*4882a593Smuzhiyun t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].present = 1;
210*4882a593Smuzhiyun t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].flushed = flushed;
211*4882a593Smuzhiyun
212*4882a593Smuzhiyun return 0;
213*4882a593Smuzhiyun }
214*4882a593Smuzhiyun
arch_set_tls(struct task_struct * new,unsigned long tls)215*4882a593Smuzhiyun int arch_set_tls(struct task_struct *new, unsigned long tls)
216*4882a593Smuzhiyun {
217*4882a593Smuzhiyun struct user_desc info;
218*4882a593Smuzhiyun int idx, ret = -EFAULT;
219*4882a593Smuzhiyun
220*4882a593Smuzhiyun if (copy_from_user(&info, (void __user *) tls, sizeof(info)))
221*4882a593Smuzhiyun goto out;
222*4882a593Smuzhiyun
223*4882a593Smuzhiyun ret = -EINVAL;
224*4882a593Smuzhiyun if (LDT_empty(&info))
225*4882a593Smuzhiyun goto out;
226*4882a593Smuzhiyun
227*4882a593Smuzhiyun idx = info.entry_number;
228*4882a593Smuzhiyun
229*4882a593Smuzhiyun ret = set_tls_entry(new, &info, idx, 0);
230*4882a593Smuzhiyun out:
231*4882a593Smuzhiyun return ret;
232*4882a593Smuzhiyun }
233*4882a593Smuzhiyun
234*4882a593Smuzhiyun /* XXX: use do_get_thread_area to read the host value? I'm not at all sure! */
get_tls_entry(struct task_struct * task,struct user_desc * info,int idx)235*4882a593Smuzhiyun static int get_tls_entry(struct task_struct *task, struct user_desc *info,
236*4882a593Smuzhiyun int idx)
237*4882a593Smuzhiyun {
238*4882a593Smuzhiyun struct thread_struct *t = &task->thread;
239*4882a593Smuzhiyun
240*4882a593Smuzhiyun if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
241*4882a593Smuzhiyun return -EINVAL;
242*4882a593Smuzhiyun
243*4882a593Smuzhiyun if (!t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].present)
244*4882a593Smuzhiyun goto clear;
245*4882a593Smuzhiyun
246*4882a593Smuzhiyun *info = t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].tls;
247*4882a593Smuzhiyun
248*4882a593Smuzhiyun out:
249*4882a593Smuzhiyun /*
250*4882a593Smuzhiyun * Temporary debugging check, to make sure that things have been
251*4882a593Smuzhiyun * flushed. This could be triggered if load_TLS() failed.
252*4882a593Smuzhiyun */
253*4882a593Smuzhiyun if (unlikely(task == current &&
254*4882a593Smuzhiyun !t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].flushed)) {
255*4882a593Smuzhiyun printk(KERN_ERR "get_tls_entry: task with pid %d got here "
256*4882a593Smuzhiyun "without flushed TLS.", current->pid);
257*4882a593Smuzhiyun }
258*4882a593Smuzhiyun
259*4882a593Smuzhiyun return 0;
260*4882a593Smuzhiyun clear:
261*4882a593Smuzhiyun /*
262*4882a593Smuzhiyun * When the TLS entry has not been set, the values read to user in the
263*4882a593Smuzhiyun * tls_array are 0 (because it's cleared at boot, see
264*4882a593Smuzhiyun * arch/i386/kernel/head.S:cpu_gdt_table). Emulate that.
265*4882a593Smuzhiyun */
266*4882a593Smuzhiyun clear_user_desc(info);
267*4882a593Smuzhiyun info->entry_number = idx;
268*4882a593Smuzhiyun goto out;
269*4882a593Smuzhiyun }
270*4882a593Smuzhiyun
SYSCALL_DEFINE1(set_thread_area,struct user_desc __user *,user_desc)271*4882a593Smuzhiyun SYSCALL_DEFINE1(set_thread_area, struct user_desc __user *, user_desc)
272*4882a593Smuzhiyun {
273*4882a593Smuzhiyun struct user_desc info;
274*4882a593Smuzhiyun int idx, ret;
275*4882a593Smuzhiyun
276*4882a593Smuzhiyun if (!host_supports_tls)
277*4882a593Smuzhiyun return -ENOSYS;
278*4882a593Smuzhiyun
279*4882a593Smuzhiyun if (copy_from_user(&info, user_desc, sizeof(info)))
280*4882a593Smuzhiyun return -EFAULT;
281*4882a593Smuzhiyun
282*4882a593Smuzhiyun idx = info.entry_number;
283*4882a593Smuzhiyun
284*4882a593Smuzhiyun if (idx == -1) {
285*4882a593Smuzhiyun idx = get_free_idx(current);
286*4882a593Smuzhiyun if (idx < 0)
287*4882a593Smuzhiyun return idx;
288*4882a593Smuzhiyun info.entry_number = idx;
289*4882a593Smuzhiyun /* Tell the user which slot we chose for him.*/
290*4882a593Smuzhiyun if (put_user(idx, &user_desc->entry_number))
291*4882a593Smuzhiyun return -EFAULT;
292*4882a593Smuzhiyun }
293*4882a593Smuzhiyun
294*4882a593Smuzhiyun ret = do_set_thread_area(&info);
295*4882a593Smuzhiyun if (ret)
296*4882a593Smuzhiyun return ret;
297*4882a593Smuzhiyun return set_tls_entry(current, &info, idx, 1);
298*4882a593Smuzhiyun }
299*4882a593Smuzhiyun
300*4882a593Smuzhiyun /*
301*4882a593Smuzhiyun * Perform set_thread_area on behalf of the traced child.
302*4882a593Smuzhiyun * Note: error handling is not done on the deferred load, and this differ from
303*4882a593Smuzhiyun * i386. However the only possible error are caused by bugs.
304*4882a593Smuzhiyun */
ptrace_set_thread_area(struct task_struct * child,int idx,struct user_desc __user * user_desc)305*4882a593Smuzhiyun int ptrace_set_thread_area(struct task_struct *child, int idx,
306*4882a593Smuzhiyun struct user_desc __user *user_desc)
307*4882a593Smuzhiyun {
308*4882a593Smuzhiyun struct user_desc info;
309*4882a593Smuzhiyun
310*4882a593Smuzhiyun if (!host_supports_tls)
311*4882a593Smuzhiyun return -EIO;
312*4882a593Smuzhiyun
313*4882a593Smuzhiyun if (copy_from_user(&info, user_desc, sizeof(info)))
314*4882a593Smuzhiyun return -EFAULT;
315*4882a593Smuzhiyun
316*4882a593Smuzhiyun return set_tls_entry(child, &info, idx, 0);
317*4882a593Smuzhiyun }
318*4882a593Smuzhiyun
SYSCALL_DEFINE1(get_thread_area,struct user_desc __user *,user_desc)319*4882a593Smuzhiyun SYSCALL_DEFINE1(get_thread_area, struct user_desc __user *, user_desc)
320*4882a593Smuzhiyun {
321*4882a593Smuzhiyun struct user_desc info;
322*4882a593Smuzhiyun int idx, ret;
323*4882a593Smuzhiyun
324*4882a593Smuzhiyun if (!host_supports_tls)
325*4882a593Smuzhiyun return -ENOSYS;
326*4882a593Smuzhiyun
327*4882a593Smuzhiyun if (get_user(idx, &user_desc->entry_number))
328*4882a593Smuzhiyun return -EFAULT;
329*4882a593Smuzhiyun
330*4882a593Smuzhiyun ret = get_tls_entry(current, &info, idx);
331*4882a593Smuzhiyun if (ret < 0)
332*4882a593Smuzhiyun goto out;
333*4882a593Smuzhiyun
334*4882a593Smuzhiyun if (copy_to_user(user_desc, &info, sizeof(info)))
335*4882a593Smuzhiyun ret = -EFAULT;
336*4882a593Smuzhiyun
337*4882a593Smuzhiyun out:
338*4882a593Smuzhiyun return ret;
339*4882a593Smuzhiyun }
340*4882a593Smuzhiyun
341*4882a593Smuzhiyun /*
342*4882a593Smuzhiyun * Perform get_thread_area on behalf of the traced child.
343*4882a593Smuzhiyun */
ptrace_get_thread_area(struct task_struct * child,int idx,struct user_desc __user * user_desc)344*4882a593Smuzhiyun int ptrace_get_thread_area(struct task_struct *child, int idx,
345*4882a593Smuzhiyun struct user_desc __user *user_desc)
346*4882a593Smuzhiyun {
347*4882a593Smuzhiyun struct user_desc info;
348*4882a593Smuzhiyun int ret;
349*4882a593Smuzhiyun
350*4882a593Smuzhiyun if (!host_supports_tls)
351*4882a593Smuzhiyun return -EIO;
352*4882a593Smuzhiyun
353*4882a593Smuzhiyun ret = get_tls_entry(child, &info, idx);
354*4882a593Smuzhiyun if (ret < 0)
355*4882a593Smuzhiyun goto out;
356*4882a593Smuzhiyun
357*4882a593Smuzhiyun if (copy_to_user(user_desc, &info, sizeof(info)))
358*4882a593Smuzhiyun ret = -EFAULT;
359*4882a593Smuzhiyun out:
360*4882a593Smuzhiyun return ret;
361*4882a593Smuzhiyun }
362*4882a593Smuzhiyun
363*4882a593Smuzhiyun /*
364*4882a593Smuzhiyun * This code is really i386-only, but it detects and logs x86_64 GDT indexes
365*4882a593Smuzhiyun * if a 32-bit UML is running on a 64-bit host.
366*4882a593Smuzhiyun */
__setup_host_supports_tls(void)367*4882a593Smuzhiyun static int __init __setup_host_supports_tls(void)
368*4882a593Smuzhiyun {
369*4882a593Smuzhiyun check_host_supports_tls(&host_supports_tls, &host_gdt_entry_tls_min);
370*4882a593Smuzhiyun if (host_supports_tls) {
371*4882a593Smuzhiyun printk(KERN_INFO "Host TLS support detected\n");
372*4882a593Smuzhiyun printk(KERN_INFO "Detected host type: ");
373*4882a593Smuzhiyun switch (host_gdt_entry_tls_min) {
374*4882a593Smuzhiyun case GDT_ENTRY_TLS_MIN_I386:
375*4882a593Smuzhiyun printk(KERN_CONT "i386");
376*4882a593Smuzhiyun break;
377*4882a593Smuzhiyun case GDT_ENTRY_TLS_MIN_X86_64:
378*4882a593Smuzhiyun printk(KERN_CONT "x86_64");
379*4882a593Smuzhiyun break;
380*4882a593Smuzhiyun }
381*4882a593Smuzhiyun printk(KERN_CONT " (GDT indexes %d to %d)\n",
382*4882a593Smuzhiyun host_gdt_entry_tls_min,
383*4882a593Smuzhiyun host_gdt_entry_tls_min + GDT_ENTRY_TLS_ENTRIES);
384*4882a593Smuzhiyun } else
385*4882a593Smuzhiyun printk(KERN_ERR " Host TLS support NOT detected! "
386*4882a593Smuzhiyun "TLS support inside UML will not work\n");
387*4882a593Smuzhiyun return 0;
388*4882a593Smuzhiyun }
389*4882a593Smuzhiyun
390*4882a593Smuzhiyun __initcall(__setup_host_supports_tls);
391