1 /* 2 * Copyright (C) 1995 Linus Torvalds 3 * 4 * Pentium III FXSR, SSE support 5 * Gareth Hughes <gareth@valinux.com>, May 2000 6 * 7 * X86-64 port 8 * Andi Kleen. 9 * 10 * CPU hotplug support - ashok.raj@intel.com 11 */ 12 13 /* 14 * This file handles the architecture-dependent parts of process handling.. 15 */ 16 17 #include <linux/cpu.h> 18 #include <linux/errno.h> 19 #include <linux/sched.h> 20 #include <linux/fs.h> 21 #include <linux/kernel.h> 22 #include <linux/mm.h> 23 #include <linux/elfcore.h> 24 #include <linux/smp.h> 25 #include <linux/slab.h> 26 #include <linux/user.h> 27 #include <linux/interrupt.h> 28 #include <linux/delay.h> 29 #include <linux/module.h> 30 #include <linux/ptrace.h> 31 #include <linux/notifier.h> 32 #include <linux/kprobes.h> 33 #include <linux/kdebug.h> 34 #include <linux/prctl.h> 35 #include <linux/uaccess.h> 36 #include <linux/io.h> 37 #include <linux/ftrace.h> 38 39 #include <asm/pgtable.h> 40 #include <asm/processor.h> 41 #include <asm/i387.h> 42 #include <asm/fpu-internal.h> 43 #include <asm/mmu_context.h> 44 #include <asm/prctl.h> 45 #include <asm/desc.h> 46 #include <asm/proto.h> 47 #include <asm/ia32.h> 48 #include <asm/idle.h> 49 #include <asm/syscalls.h> 50 #include <asm/debugreg.h> 51 #include <asm/switch_to.h> 52 53 asmlinkage extern void ret_from_fork(void); 54 55 __visible DEFINE_PER_CPU(unsigned long, rsp_scratch); 56 57 /* Prints also some state that isn't saved in the pt_regs */ 58 void __show_regs(struct pt_regs *regs, int all) 59 { 60 unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L, fs, gs, shadowgs; 61 unsigned long d0, d1, d2, d3, d6, d7; 62 unsigned int fsindex, gsindex; 63 unsigned int ds, cs, es; 64 65 printk(KERN_DEFAULT "RIP: %04lx:[<%016lx>] ", regs->cs & 0xffff, regs->ip); 66 printk_address(regs->ip); 67 printk(KERN_DEFAULT "RSP: %04lx:%016lx EFLAGS: %08lx\n", regs->ss, 68 regs->sp, regs->flags); 69 printk(KERN_DEFAULT "RAX: %016lx RBX: %016lx RCX: %016lx\n", 70 regs->ax, regs->bx, regs->cx); 71 printk(KERN_DEFAULT "RDX: %016lx RSI: %016lx RDI: %016lx\n", 72 regs->dx, regs->si, regs->di); 73 printk(KERN_DEFAULT "RBP: %016lx R08: %016lx R09: %016lx\n", 74 regs->bp, regs->r8, regs->r9); 75 printk(KERN_DEFAULT "R10: %016lx R11: %016lx R12: %016lx\n", 76 regs->r10, regs->r11, regs->r12); 77 printk(KERN_DEFAULT "R13: %016lx R14: %016lx R15: %016lx\n", 78 regs->r13, regs->r14, regs->r15); 79 80 asm("movl %%ds,%0" : "=r" (ds)); 81 asm("movl %%cs,%0" : "=r" (cs)); 82 asm("movl %%es,%0" : "=r" (es)); 83 asm("movl %%fs,%0" : "=r" (fsindex)); 84 asm("movl %%gs,%0" : "=r" (gsindex)); 85 86 rdmsrl(MSR_FS_BASE, fs); 87 rdmsrl(MSR_GS_BASE, gs); 88 rdmsrl(MSR_KERNEL_GS_BASE, shadowgs); 89 90 if (!all) 91 return; 92 93 cr0 = read_cr0(); 94 cr2 = read_cr2(); 95 cr3 = read_cr3(); 96 cr4 = __read_cr4(); 97 98 printk(KERN_DEFAULT "FS: %016lx(%04x) GS:%016lx(%04x) knlGS:%016lx\n", 99 fs, fsindex, gs, gsindex, shadowgs); 100 printk(KERN_DEFAULT "CS: %04x DS: %04x ES: %04x CR0: %016lx\n", cs, ds, 101 es, cr0); 102 printk(KERN_DEFAULT "CR2: %016lx CR3: %016lx CR4: %016lx\n", cr2, cr3, 103 cr4); 104 105 get_debugreg(d0, 0); 106 get_debugreg(d1, 1); 107 get_debugreg(d2, 2); 108 get_debugreg(d3, 3); 109 get_debugreg(d6, 6); 110 get_debugreg(d7, 7); 111 112 /* Only print out debug registers if they are in their non-default state. */ 113 if ((d0 == 0) && (d1 == 0) && (d2 == 0) && (d3 == 0) && 114 (d6 == DR6_RESERVED) && (d7 == 0x400)) 115 return; 116 117 printk(KERN_DEFAULT "DR0: %016lx DR1: %016lx DR2: %016lx\n", d0, d1, d2); 118 printk(KERN_DEFAULT "DR3: %016lx DR6: %016lx DR7: %016lx\n", d3, d6, d7); 119 120 } 121 122 void release_thread(struct task_struct *dead_task) 123 { 124 if (dead_task->mm) { 125 if (dead_task->mm->context.size) { 126 pr_warn("WARNING: dead process %s still has LDT? <%p/%d>\n", 127 dead_task->comm, 128 dead_task->mm->context.ldt, 129 dead_task->mm->context.size); 130 BUG(); 131 } 132 } 133 } 134 135 static inline void set_32bit_tls(struct task_struct *t, int tls, u32 addr) 136 { 137 struct user_desc ud = { 138 .base_addr = addr, 139 .limit = 0xfffff, 140 .seg_32bit = 1, 141 .limit_in_pages = 1, 142 .useable = 1, 143 }; 144 struct desc_struct *desc = t->thread.tls_array; 145 desc += tls; 146 fill_ldt(desc, &ud); 147 } 148 149 static inline u32 read_32bit_tls(struct task_struct *t, int tls) 150 { 151 return get_desc_base(&t->thread.tls_array[tls]); 152 } 153 154 int copy_thread(unsigned long clone_flags, unsigned long sp, 155 unsigned long arg, struct task_struct *p) 156 { 157 int err; 158 struct pt_regs *childregs; 159 struct task_struct *me = current; 160 161 p->thread.sp0 = (unsigned long)task_stack_page(p) + THREAD_SIZE; 162 childregs = task_pt_regs(p); 163 p->thread.sp = (unsigned long) childregs; 164 set_tsk_thread_flag(p, TIF_FORK); 165 p->thread.io_bitmap_ptr = NULL; 166 167 savesegment(gs, p->thread.gsindex); 168 p->thread.gs = p->thread.gsindex ? 0 : me->thread.gs; 169 savesegment(fs, p->thread.fsindex); 170 p->thread.fs = p->thread.fsindex ? 0 : me->thread.fs; 171 savesegment(es, p->thread.es); 172 savesegment(ds, p->thread.ds); 173 memset(p->thread.ptrace_bps, 0, sizeof(p->thread.ptrace_bps)); 174 175 if (unlikely(p->flags & PF_KTHREAD)) { 176 /* kernel thread */ 177 memset(childregs, 0, sizeof(struct pt_regs)); 178 childregs->sp = (unsigned long)childregs; 179 childregs->ss = __KERNEL_DS; 180 childregs->bx = sp; /* function */ 181 childregs->bp = arg; 182 childregs->orig_ax = -1; 183 childregs->cs = __KERNEL_CS | get_kernel_rpl(); 184 childregs->flags = X86_EFLAGS_IF | X86_EFLAGS_FIXED; 185 return 0; 186 } 187 *childregs = *current_pt_regs(); 188 189 childregs->ax = 0; 190 if (sp) 191 childregs->sp = sp; 192 193 err = -ENOMEM; 194 if (unlikely(test_tsk_thread_flag(me, TIF_IO_BITMAP))) { 195 p->thread.io_bitmap_ptr = kmemdup(me->thread.io_bitmap_ptr, 196 IO_BITMAP_BYTES, GFP_KERNEL); 197 if (!p->thread.io_bitmap_ptr) { 198 p->thread.io_bitmap_max = 0; 199 return -ENOMEM; 200 } 201 set_tsk_thread_flag(p, TIF_IO_BITMAP); 202 } 203 204 /* 205 * Set a new TLS for the child thread? 206 */ 207 if (clone_flags & CLONE_SETTLS) { 208 #ifdef CONFIG_IA32_EMULATION 209 if (is_ia32_task()) 210 err = do_set_thread_area(p, -1, 211 (struct user_desc __user *)childregs->si, 0); 212 else 213 #endif 214 err = do_arch_prctl(p, ARCH_SET_FS, childregs->r8); 215 if (err) 216 goto out; 217 } 218 err = 0; 219 out: 220 if (err && p->thread.io_bitmap_ptr) { 221 kfree(p->thread.io_bitmap_ptr); 222 p->thread.io_bitmap_max = 0; 223 } 224 225 return err; 226 } 227 228 static void 229 start_thread_common(struct pt_regs *regs, unsigned long new_ip, 230 unsigned long new_sp, 231 unsigned int _cs, unsigned int _ss, unsigned int _ds) 232 { 233 loadsegment(fs, 0); 234 loadsegment(es, _ds); 235 loadsegment(ds, _ds); 236 load_gs_index(0); 237 regs->ip = new_ip; 238 regs->sp = new_sp; 239 regs->cs = _cs; 240 regs->ss = _ss; 241 regs->flags = X86_EFLAGS_IF; 242 force_iret(); 243 } 244 245 void 246 start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_sp) 247 { 248 start_thread_common(regs, new_ip, new_sp, 249 __USER_CS, __USER_DS, 0); 250 } 251 252 #ifdef CONFIG_IA32_EMULATION 253 void start_thread_ia32(struct pt_regs *regs, u32 new_ip, u32 new_sp) 254 { 255 start_thread_common(regs, new_ip, new_sp, 256 test_thread_flag(TIF_X32) 257 ? __USER_CS : __USER32_CS, 258 __USER_DS, __USER_DS); 259 } 260 #endif 261 262 /* 263 * switch_to(x,y) should switch tasks from x to y. 264 * 265 * This could still be optimized: 266 * - fold all the options into a flag word and test it with a single test. 267 * - could test fs/gs bitsliced 268 * 269 * Kprobes not supported here. Set the probe on schedule instead. 270 * Function graph tracer not supported too. 271 */ 272 __visible __notrace_funcgraph struct task_struct * 273 __switch_to(struct task_struct *prev_p, struct task_struct *next_p) 274 { 275 struct thread_struct *prev = &prev_p->thread; 276 struct thread_struct *next = &next_p->thread; 277 int cpu = smp_processor_id(); 278 struct tss_struct *tss = &per_cpu(cpu_tss, cpu); 279 unsigned fsindex, gsindex; 280 fpu_switch_t fpu; 281 282 fpu = switch_fpu_prepare(prev_p, next_p, cpu); 283 284 /* We must save %fs and %gs before load_TLS() because 285 * %fs and %gs may be cleared by load_TLS(). 286 * 287 * (e.g. xen_load_tls()) 288 */ 289 savesegment(fs, fsindex); 290 savesegment(gs, gsindex); 291 292 /* 293 * Load TLS before restoring any segments so that segment loads 294 * reference the correct GDT entries. 295 */ 296 load_TLS(next, cpu); 297 298 /* 299 * Leave lazy mode, flushing any hypercalls made here. This 300 * must be done after loading TLS entries in the GDT but before 301 * loading segments that might reference them, and and it must 302 * be done before math_state_restore, so the TS bit is up to 303 * date. 304 */ 305 arch_end_context_switch(next_p); 306 307 /* Switch DS and ES. 308 * 309 * Reading them only returns the selectors, but writing them (if 310 * nonzero) loads the full descriptor from the GDT or LDT. The 311 * LDT for next is loaded in switch_mm, and the GDT is loaded 312 * above. 313 * 314 * We therefore need to write new values to the segment 315 * registers on every context switch unless both the new and old 316 * values are zero. 317 * 318 * Note that we don't need to do anything for CS and SS, as 319 * those are saved and restored as part of pt_regs. 320 */ 321 savesegment(es, prev->es); 322 if (unlikely(next->es | prev->es)) 323 loadsegment(es, next->es); 324 325 savesegment(ds, prev->ds); 326 if (unlikely(next->ds | prev->ds)) 327 loadsegment(ds, next->ds); 328 329 /* 330 * Switch FS and GS. 331 * 332 * These are even more complicated than FS and GS: they have 333 * 64-bit bases are that controlled by arch_prctl. Those bases 334 * only differ from the values in the GDT or LDT if the selector 335 * is 0. 336 * 337 * Loading the segment register resets the hidden base part of 338 * the register to 0 or the value from the GDT / LDT. If the 339 * next base address zero, writing 0 to the segment register is 340 * much faster than using wrmsr to explicitly zero the base. 341 * 342 * The thread_struct.fs and thread_struct.gs values are 0 343 * if the fs and gs bases respectively are not overridden 344 * from the values implied by fsindex and gsindex. They 345 * are nonzero, and store the nonzero base addresses, if 346 * the bases are overridden. 347 * 348 * (fs != 0 && fsindex != 0) || (gs != 0 && gsindex != 0) should 349 * be impossible. 350 * 351 * Therefore we need to reload the segment registers if either 352 * the old or new selector is nonzero, and we need to override 353 * the base address if next thread expects it to be overridden. 354 * 355 * This code is unnecessarily slow in the case where the old and 356 * new indexes are zero and the new base is nonzero -- it will 357 * unnecessarily write 0 to the selector before writing the new 358 * base address. 359 * 360 * Note: This all depends on arch_prctl being the only way that 361 * user code can override the segment base. Once wrfsbase and 362 * wrgsbase are enabled, most of this code will need to change. 363 */ 364 if (unlikely(fsindex | next->fsindex | prev->fs)) { 365 loadsegment(fs, next->fsindex); 366 367 /* 368 * If user code wrote a nonzero value to FS, then it also 369 * cleared the overridden base address. 370 * 371 * XXX: if user code wrote 0 to FS and cleared the base 372 * address itself, we won't notice and we'll incorrectly 373 * restore the prior base address next time we reschdule 374 * the process. 375 */ 376 if (fsindex) 377 prev->fs = 0; 378 } 379 if (next->fs) 380 wrmsrl(MSR_FS_BASE, next->fs); 381 prev->fsindex = fsindex; 382 383 if (unlikely(gsindex | next->gsindex | prev->gs)) { 384 load_gs_index(next->gsindex); 385 386 /* This works (and fails) the same way as fsindex above. */ 387 if (gsindex) 388 prev->gs = 0; 389 } 390 if (next->gs) 391 wrmsrl(MSR_KERNEL_GS_BASE, next->gs); 392 prev->gsindex = gsindex; 393 394 switch_fpu_finish(next_p, fpu); 395 396 /* 397 * Switch the PDA and FPU contexts. 398 */ 399 this_cpu_write(current_task, next_p); 400 401 /* 402 * If it were not for PREEMPT_ACTIVE we could guarantee that the 403 * preempt_count of all tasks was equal here and this would not be 404 * needed. 405 */ 406 task_thread_info(prev_p)->saved_preempt_count = this_cpu_read(__preempt_count); 407 this_cpu_write(__preempt_count, task_thread_info(next_p)->saved_preempt_count); 408 409 /* Reload esp0 and ss1. This changes current_thread_info(). */ 410 load_sp0(tss, next); 411 412 this_cpu_write(kernel_stack, 413 (unsigned long)task_stack_page(next_p) + THREAD_SIZE); 414 415 /* 416 * Now maybe reload the debug registers and handle I/O bitmaps 417 */ 418 if (unlikely(task_thread_info(next_p)->flags & _TIF_WORK_CTXSW_NEXT || 419 task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV)) 420 __switch_to_xtra(prev_p, next_p, tss); 421 422 if (static_cpu_has_bug(X86_BUG_SYSRET_SS_ATTRS)) { 423 /* 424 * AMD CPUs have a misfeature: SYSRET sets the SS selector but 425 * does not update the cached descriptor. As a result, if we 426 * do SYSRET while SS is NULL, we'll end up in user mode with 427 * SS apparently equal to __USER_DS but actually unusable. 428 * 429 * The straightforward workaround would be to fix it up just 430 * before SYSRET, but that would slow down the system call 431 * fast paths. Instead, we ensure that SS is never NULL in 432 * system call context. We do this by replacing NULL SS 433 * selectors at every context switch. SYSCALL sets up a valid 434 * SS, so the only way to get NULL is to re-enter the kernel 435 * from CPL 3 through an interrupt. Since that can't happen 436 * in the same task as a running syscall, we are guaranteed to 437 * context switch between every interrupt vector entry and a 438 * subsequent SYSRET. 439 * 440 * We read SS first because SS reads are much faster than 441 * writes. Out of caution, we force SS to __KERNEL_DS even if 442 * it previously had a different non-NULL value. 443 */ 444 unsigned short ss_sel; 445 savesegment(ss, ss_sel); 446 if (ss_sel != __KERNEL_DS) 447 loadsegment(ss, __KERNEL_DS); 448 } 449 450 return prev_p; 451 } 452 453 void set_personality_64bit(void) 454 { 455 /* inherit personality from parent */ 456 457 /* Make sure to be in 64bit mode */ 458 clear_thread_flag(TIF_IA32); 459 clear_thread_flag(TIF_ADDR32); 460 clear_thread_flag(TIF_X32); 461 462 /* Ensure the corresponding mm is not marked. */ 463 if (current->mm) 464 current->mm->context.ia32_compat = 0; 465 466 /* TBD: overwrites user setup. Should have two bits. 467 But 64bit processes have always behaved this way, 468 so it's not too bad. The main problem is just that 469 32bit childs are affected again. */ 470 current->personality &= ~READ_IMPLIES_EXEC; 471 } 472 473 void set_personality_ia32(bool x32) 474 { 475 /* inherit personality from parent */ 476 477 /* Make sure to be in 32bit mode */ 478 set_thread_flag(TIF_ADDR32); 479 480 /* Mark the associated mm as containing 32-bit tasks. */ 481 if (x32) { 482 clear_thread_flag(TIF_IA32); 483 set_thread_flag(TIF_X32); 484 if (current->mm) 485 current->mm->context.ia32_compat = TIF_X32; 486 current->personality &= ~READ_IMPLIES_EXEC; 487 /* is_compat_task() uses the presence of the x32 488 syscall bit flag to determine compat status */ 489 current_thread_info()->status &= ~TS_COMPAT; 490 } else { 491 set_thread_flag(TIF_IA32); 492 clear_thread_flag(TIF_X32); 493 if (current->mm) 494 current->mm->context.ia32_compat = TIF_IA32; 495 current->personality |= force_personality32; 496 /* Prepare the first "return" to user space */ 497 current_thread_info()->status |= TS_COMPAT; 498 } 499 } 500 EXPORT_SYMBOL_GPL(set_personality_ia32); 501 502 unsigned long get_wchan(struct task_struct *p) 503 { 504 unsigned long stack; 505 u64 fp, ip; 506 int count = 0; 507 508 if (!p || p == current || p->state == TASK_RUNNING) 509 return 0; 510 stack = (unsigned long)task_stack_page(p); 511 if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE) 512 return 0; 513 fp = *(u64 *)(p->thread.sp); 514 do { 515 if (fp < (unsigned long)stack || 516 fp >= (unsigned long)stack+THREAD_SIZE) 517 return 0; 518 ip = *(u64 *)(fp+8); 519 if (!in_sched_functions(ip)) 520 return ip; 521 fp = *(u64 *)fp; 522 } while (count++ < 16); 523 return 0; 524 } 525 526 long do_arch_prctl(struct task_struct *task, int code, unsigned long addr) 527 { 528 int ret = 0; 529 int doit = task == current; 530 int cpu; 531 532 switch (code) { 533 case ARCH_SET_GS: 534 if (addr >= TASK_SIZE_OF(task)) 535 return -EPERM; 536 cpu = get_cpu(); 537 /* handle small bases via the GDT because that's faster to 538 switch. */ 539 if (addr <= 0xffffffff) { 540 set_32bit_tls(task, GS_TLS, addr); 541 if (doit) { 542 load_TLS(&task->thread, cpu); 543 load_gs_index(GS_TLS_SEL); 544 } 545 task->thread.gsindex = GS_TLS_SEL; 546 task->thread.gs = 0; 547 } else { 548 task->thread.gsindex = 0; 549 task->thread.gs = addr; 550 if (doit) { 551 load_gs_index(0); 552 ret = wrmsrl_safe(MSR_KERNEL_GS_BASE, addr); 553 } 554 } 555 put_cpu(); 556 break; 557 case ARCH_SET_FS: 558 /* Not strictly needed for fs, but do it for symmetry 559 with gs */ 560 if (addr >= TASK_SIZE_OF(task)) 561 return -EPERM; 562 cpu = get_cpu(); 563 /* handle small bases via the GDT because that's faster to 564 switch. */ 565 if (addr <= 0xffffffff) { 566 set_32bit_tls(task, FS_TLS, addr); 567 if (doit) { 568 load_TLS(&task->thread, cpu); 569 loadsegment(fs, FS_TLS_SEL); 570 } 571 task->thread.fsindex = FS_TLS_SEL; 572 task->thread.fs = 0; 573 } else { 574 task->thread.fsindex = 0; 575 task->thread.fs = addr; 576 if (doit) { 577 /* set the selector to 0 to not confuse 578 __switch_to */ 579 loadsegment(fs, 0); 580 ret = wrmsrl_safe(MSR_FS_BASE, addr); 581 } 582 } 583 put_cpu(); 584 break; 585 case ARCH_GET_FS: { 586 unsigned long base; 587 if (task->thread.fsindex == FS_TLS_SEL) 588 base = read_32bit_tls(task, FS_TLS); 589 else if (doit) 590 rdmsrl(MSR_FS_BASE, base); 591 else 592 base = task->thread.fs; 593 ret = put_user(base, (unsigned long __user *)addr); 594 break; 595 } 596 case ARCH_GET_GS: { 597 unsigned long base; 598 unsigned gsindex; 599 if (task->thread.gsindex == GS_TLS_SEL) 600 base = read_32bit_tls(task, GS_TLS); 601 else if (doit) { 602 savesegment(gs, gsindex); 603 if (gsindex) 604 rdmsrl(MSR_KERNEL_GS_BASE, base); 605 else 606 base = task->thread.gs; 607 } else 608 base = task->thread.gs; 609 ret = put_user(base, (unsigned long __user *)addr); 610 break; 611 } 612 613 default: 614 ret = -EINVAL; 615 break; 616 } 617 618 return ret; 619 } 620 621 long sys_arch_prctl(int code, unsigned long addr) 622 { 623 return do_arch_prctl(current, code, addr); 624 } 625 626 unsigned long KSTK_ESP(struct task_struct *task) 627 { 628 return task_pt_regs(task)->sp; 629 } 630