1 /*
2  * Copyright (C) 2005 Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
3  * Licensed under the GPL
4  */
5 
6 #include <linux/percpu.h>
7 #include <linux/sched.h>
8 #include <linux/syscalls.h>
9 #include <linux/uaccess.h>
10 #include <asm/ptrace-abi.h>
11 #include <os.h>
12 #include <skas.h>
13 #include <sysdep/tls.h>
14 
15 /*
16  * If needed we can detect when it's uninitialized.
17  *
18  * These are initialized in an initcall and unchanged thereafter.
19  */
20 static int host_supports_tls = -1;
21 int host_gdt_entry_tls_min;
22 
do_set_thread_area(struct user_desc * info)23 int do_set_thread_area(struct user_desc *info)
24 {
25 	int ret;
26 	u32 cpu;
27 
28 	cpu = get_cpu();
29 	ret = os_set_thread_area(info, userspace_pid[cpu]);
30 	put_cpu();
31 
32 	if (ret)
33 		printk(KERN_ERR "PTRACE_SET_THREAD_AREA failed, err = %d, "
34 		       "index = %d\n", ret, info->entry_number);
35 
36 	return ret;
37 }
38 
do_get_thread_area(struct user_desc * info)39 int do_get_thread_area(struct user_desc *info)
40 {
41 	int ret;
42 	u32 cpu;
43 
44 	cpu = get_cpu();
45 	ret = os_get_thread_area(info, userspace_pid[cpu]);
46 	put_cpu();
47 
48 	if (ret)
49 		printk(KERN_ERR "PTRACE_GET_THREAD_AREA failed, err = %d, "
50 		       "index = %d\n", ret, info->entry_number);
51 
52 	return ret;
53 }
54 
55 /*
56  * sys_get_thread_area: get a yet unused TLS descriptor index.
57  * XXX: Consider leaving one free slot for glibc usage at first place. This must
58  * be done here (and by changing GDT_ENTRY_TLS_* macros) and nowhere else.
59  *
60  * Also, this must be tested when compiling in SKAS mode with dynamic linking
61  * and running against NPTL.
62  */
get_free_idx(struct task_struct * task)63 static int get_free_idx(struct task_struct* task)
64 {
65 	struct thread_struct *t = &task->thread;
66 	int idx;
67 
68 	for (idx = 0; idx < GDT_ENTRY_TLS_ENTRIES; idx++)
69 		if (!t->arch.tls_array[idx].present)
70 			return idx + GDT_ENTRY_TLS_MIN;
71 	return -ESRCH;
72 }
73 
clear_user_desc(struct user_desc * info)74 static inline void clear_user_desc(struct user_desc* info)
75 {
76 	/* Postcondition: LDT_empty(info) returns true. */
77 	memset(info, 0, sizeof(*info));
78 
79 	/*
80 	 * Check the LDT_empty or the i386 sys_get_thread_area code - we obtain
81 	 * indeed an empty user_desc.
82 	 */
83 	info->read_exec_only = 1;
84 	info->seg_not_present = 1;
85 }
86 
87 #define O_FORCE 1
88 
load_TLS(int flags,struct task_struct * to)89 static int load_TLS(int flags, struct task_struct *to)
90 {
91 	int ret = 0;
92 	int idx;
93 
94 	for (idx = GDT_ENTRY_TLS_MIN; idx < GDT_ENTRY_TLS_MAX; idx++) {
95 		struct uml_tls_struct* curr =
96 			&to->thread.arch.tls_array[idx - GDT_ENTRY_TLS_MIN];
97 
98 		/*
99 		 * Actually, now if it wasn't flushed it gets cleared and
100 		 * flushed to the host, which will clear it.
101 		 */
102 		if (!curr->present) {
103 			if (!curr->flushed) {
104 				clear_user_desc(&curr->tls);
105 				curr->tls.entry_number = idx;
106 			} else {
107 				WARN_ON(!LDT_empty(&curr->tls));
108 				continue;
109 			}
110 		}
111 
112 		if (!(flags & O_FORCE) && curr->flushed)
113 			continue;
114 
115 		ret = do_set_thread_area(&curr->tls);
116 		if (ret)
117 			goto out;
118 
119 		curr->flushed = 1;
120 	}
121 out:
122 	return ret;
123 }
124 
125 /*
126  * Verify if we need to do a flush for the new process, i.e. if there are any
127  * present desc's, only if they haven't been flushed.
128  */
needs_TLS_update(struct task_struct * task)129 static inline int needs_TLS_update(struct task_struct *task)
130 {
131 	int i;
132 	int ret = 0;
133 
134 	for (i = GDT_ENTRY_TLS_MIN; i < GDT_ENTRY_TLS_MAX; i++) {
135 		struct uml_tls_struct* curr =
136 			&task->thread.arch.tls_array[i - GDT_ENTRY_TLS_MIN];
137 
138 		/*
139 		 * Can't test curr->present, we may need to clear a descriptor
140 		 * which had a value.
141 		 */
142 		if (curr->flushed)
143 			continue;
144 		ret = 1;
145 		break;
146 	}
147 	return ret;
148 }
149 
150 /*
151  * On a newly forked process, the TLS descriptors haven't yet been flushed. So
152  * we mark them as such and the first switch_to will do the job.
153  */
clear_flushed_tls(struct task_struct * task)154 void clear_flushed_tls(struct task_struct *task)
155 {
156 	int i;
157 
158 	for (i = GDT_ENTRY_TLS_MIN; i < GDT_ENTRY_TLS_MAX; i++) {
159 		struct uml_tls_struct* curr =
160 			&task->thread.arch.tls_array[i - GDT_ENTRY_TLS_MIN];
161 
162 		/*
163 		 * Still correct to do this, if it wasn't present on the host it
164 		 * will remain as flushed as it was.
165 		 */
166 		if (!curr->present)
167 			continue;
168 
169 		curr->flushed = 0;
170 	}
171 }
172 
173 /*
174  * In SKAS0 mode, currently, multiple guest threads sharing the same ->mm have a
175  * common host process. So this is needed in SKAS0 too.
176  *
177  * However, if each thread had a different host process (and this was discussed
178  * for SMP support) this won't be needed.
179  *
180  * And this will not need be used when (and if) we'll add support to the host
181  * SKAS patch.
182  */
183 
arch_switch_tls(struct task_struct * to)184 int arch_switch_tls(struct task_struct *to)
185 {
186 	if (!host_supports_tls)
187 		return 0;
188 
189 	/*
190 	 * We have no need whatsoever to switch TLS for kernel threads; beyond
191 	 * that, that would also result in us calling os_set_thread_area with
192 	 * userspace_pid[cpu] == 0, which gives an error.
193 	 */
194 	if (likely(to->mm))
195 		return load_TLS(O_FORCE, to);
196 
197 	return 0;
198 }
199 
set_tls_entry(struct task_struct * task,struct user_desc * info,int idx,int flushed)200 static int set_tls_entry(struct task_struct* task, struct user_desc *info,
201 			 int idx, int flushed)
202 {
203 	struct thread_struct *t = &task->thread;
204 
205 	if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
206 		return -EINVAL;
207 
208 	t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].tls = *info;
209 	t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].present = 1;
210 	t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].flushed = flushed;
211 
212 	return 0;
213 }
214 
arch_set_tls(struct task_struct * new,unsigned long tls)215 int arch_set_tls(struct task_struct *new, unsigned long tls)
216 {
217 	struct user_desc info;
218 	int idx, ret = -EFAULT;
219 
220 	if (copy_from_user(&info, (void __user *) tls, sizeof(info)))
221 		goto out;
222 
223 	ret = -EINVAL;
224 	if (LDT_empty(&info))
225 		goto out;
226 
227 	idx = info.entry_number;
228 
229 	ret = set_tls_entry(new, &info, idx, 0);
230 out:
231 	return ret;
232 }
233 
234 /* XXX: use do_get_thread_area to read the host value? I'm not at all sure! */
get_tls_entry(struct task_struct * task,struct user_desc * info,int idx)235 static int get_tls_entry(struct task_struct *task, struct user_desc *info,
236 			 int idx)
237 {
238 	struct thread_struct *t = &task->thread;
239 
240 	if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
241 		return -EINVAL;
242 
243 	if (!t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].present)
244 		goto clear;
245 
246 	*info = t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].tls;
247 
248 out:
249 	/*
250 	 * Temporary debugging check, to make sure that things have been
251 	 * flushed. This could be triggered if load_TLS() failed.
252 	 */
253 	if (unlikely(task == current &&
254 		     !t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].flushed)) {
255 		printk(KERN_ERR "get_tls_entry: task with pid %d got here "
256 				"without flushed TLS.", current->pid);
257 	}
258 
259 	return 0;
260 clear:
261 	/*
262 	 * When the TLS entry has not been set, the values read to user in the
263 	 * tls_array are 0 (because it's cleared at boot, see
264 	 * arch/i386/kernel/head.S:cpu_gdt_table). Emulate that.
265 	 */
266 	clear_user_desc(info);
267 	info->entry_number = idx;
268 	goto out;
269 }
270 
SYSCALL_DEFINE1(set_thread_area,struct user_desc __user *,user_desc)271 SYSCALL_DEFINE1(set_thread_area, struct user_desc __user *, user_desc)
272 {
273 	struct user_desc info;
274 	int idx, ret;
275 
276 	if (!host_supports_tls)
277 		return -ENOSYS;
278 
279 	if (copy_from_user(&info, user_desc, sizeof(info)))
280 		return -EFAULT;
281 
282 	idx = info.entry_number;
283 
284 	if (idx == -1) {
285 		idx = get_free_idx(current);
286 		if (idx < 0)
287 			return idx;
288 		info.entry_number = idx;
289 		/* Tell the user which slot we chose for him.*/
290 		if (put_user(idx, &user_desc->entry_number))
291 			return -EFAULT;
292 	}
293 
294 	ret = do_set_thread_area(&info);
295 	if (ret)
296 		return ret;
297 	return set_tls_entry(current, &info, idx, 1);
298 }
299 
300 /*
301  * Perform set_thread_area on behalf of the traced child.
302  * Note: error handling is not done on the deferred load, and this differ from
303  * i386. However the only possible error are caused by bugs.
304  */
ptrace_set_thread_area(struct task_struct * child,int idx,struct user_desc __user * user_desc)305 int ptrace_set_thread_area(struct task_struct *child, int idx,
306 			   struct user_desc __user *user_desc)
307 {
308 	struct user_desc info;
309 
310 	if (!host_supports_tls)
311 		return -EIO;
312 
313 	if (copy_from_user(&info, user_desc, sizeof(info)))
314 		return -EFAULT;
315 
316 	return set_tls_entry(child, &info, idx, 0);
317 }
318 
SYSCALL_DEFINE1(get_thread_area,struct user_desc __user *,user_desc)319 SYSCALL_DEFINE1(get_thread_area, struct user_desc __user *, user_desc)
320 {
321 	struct user_desc info;
322 	int idx, ret;
323 
324 	if (!host_supports_tls)
325 		return -ENOSYS;
326 
327 	if (get_user(idx, &user_desc->entry_number))
328 		return -EFAULT;
329 
330 	ret = get_tls_entry(current, &info, idx);
331 	if (ret < 0)
332 		goto out;
333 
334 	if (copy_to_user(user_desc, &info, sizeof(info)))
335 		ret = -EFAULT;
336 
337 out:
338 	return ret;
339 }
340 
341 /*
342  * Perform get_thread_area on behalf of the traced child.
343  */
ptrace_get_thread_area(struct task_struct * child,int idx,struct user_desc __user * user_desc)344 int ptrace_get_thread_area(struct task_struct *child, int idx,
345 		struct user_desc __user *user_desc)
346 {
347 	struct user_desc info;
348 	int ret;
349 
350 	if (!host_supports_tls)
351 		return -EIO;
352 
353 	ret = get_tls_entry(child, &info, idx);
354 	if (ret < 0)
355 		goto out;
356 
357 	if (copy_to_user(user_desc, &info, sizeof(info)))
358 		ret = -EFAULT;
359 out:
360 	return ret;
361 }
362 
363 /*
364  * This code is really i386-only, but it detects and logs x86_64 GDT indexes
365  * if a 32-bit UML is running on a 64-bit host.
366  */
__setup_host_supports_tls(void)367 static int __init __setup_host_supports_tls(void)
368 {
369 	check_host_supports_tls(&host_supports_tls, &host_gdt_entry_tls_min);
370 	if (host_supports_tls) {
371 		printk(KERN_INFO "Host TLS support detected\n");
372 		printk(KERN_INFO "Detected host type: ");
373 		switch (host_gdt_entry_tls_min) {
374 		case GDT_ENTRY_TLS_MIN_I386:
375 			printk(KERN_CONT "i386");
376 			break;
377 		case GDT_ENTRY_TLS_MIN_X86_64:
378 			printk(KERN_CONT "x86_64");
379 			break;
380 		}
381 		printk(KERN_CONT " (GDT indexes %d to %d)\n",
382 		       host_gdt_entry_tls_min,
383 		       host_gdt_entry_tls_min + GDT_ENTRY_TLS_ENTRIES);
384 	} else
385 		printk(KERN_ERR "  Host TLS support NOT detected! "
386 				"TLS support inside UML will not work\n");
387 	return 0;
388 }
389 
390 __initcall(__setup_host_supports_tls);
391