Orange Pi5 kernel

^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   1) // SPDX-License-Identifier: GPL-2.0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   2) #include <linux/kernel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   3) #include <linux/errno.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   4) #include <linux/sched.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   5) #include <linux/user.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   6) #include <linux/regset.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   7) #include <linux/syscalls.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   8) #include <linux/nospec.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   9) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  10) #include <linux/uaccess.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  11) #include <asm/desc.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  12) #include <asm/ldt.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  13) #include <asm/processor.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  14) #include <asm/proto.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  15) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  16) #include "tls.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  17) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  18) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  19)  * sys_alloc_thread_area: get a yet unused TLS descriptor index.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  20)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  21) static int get_free_idx(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  22) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  23) 	struct thread_struct *t = &current->thread;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  24) 	int idx;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  25) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  26) 	for (idx = 0; idx < GDT_ENTRY_TLS_ENTRIES; idx++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  27) 		if (desc_empty(&t->tls_array[idx]))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  28) 			return idx + GDT_ENTRY_TLS_MIN;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  29) 	return -ESRCH;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  30) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  31) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  32) static bool tls_desc_okay(const struct user_desc *info)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  33) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  34) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  35) 	 * For historical reasons (i.e. no one ever documented how any
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  36) 	 * of the segmentation APIs work), user programs can and do
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  37) 	 * assume that a struct user_desc that's all zeros except for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  38) 	 * entry_number means "no segment at all".  This never actually
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  39) 	 * worked.  In fact, up to Linux 3.19, a struct user_desc like
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  40) 	 * this would create a 16-bit read-write segment with base and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  41) 	 * limit both equal to zero.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  42) 	 *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  43) 	 * That was close enough to "no segment at all" until we
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  44) 	 * hardened this function to disallow 16-bit TLS segments.  Fix
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  45) 	 * it up by interpreting these zeroed segments the way that they
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  46) 	 * were almost certainly intended to be interpreted.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  47) 	 *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  48) 	 * The correct way to ask for "no segment at all" is to specify
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  49) 	 * a user_desc that satisfies LDT_empty.  To keep everything
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  50) 	 * working, we accept both.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  51) 	 *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  52) 	 * Note that there's a similar kludge in modify_ldt -- look at
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  53) 	 * the distinction between modes 1 and 0x11.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  54) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  55) 	if (LDT_empty(info) || LDT_zero(info))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  56) 		return true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  57) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  58) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  59) 	 * espfix is required for 16-bit data segments, but espfix
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  60) 	 * only works for LDT segments.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  61) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  62) 	if (!info->seg_32bit)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  63) 		return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  64) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  65) 	/* Only allow data segments in the TLS array. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  66) 	if (info->contents > 1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  67) 		return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  68) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  69) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  70) 	 * Non-present segments with DPL 3 present an interesting attack
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  71) 	 * surface.  The kernel should handle such segments correctly,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  72) 	 * but TLS is very difficult to protect in a sandbox, so prevent
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  73) 	 * such segments from being created.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  74) 	 *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  75) 	 * If userspace needs to remove a TLS entry, it can still delete
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  76) 	 * it outright.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  77) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  78) 	if (info->seg_not_present)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  79) 		return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  80) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  81) 	return true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  82) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  83) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  84) static void set_tls_desc(struct task_struct *p, int idx,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  85) 			 const struct user_desc *info, int n)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  86) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  87) 	struct thread_struct *t = &p->thread;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  88) 	struct desc_struct *desc = &t->tls_array[idx - GDT_ENTRY_TLS_MIN];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  89) 	int cpu;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  90) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  91) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  92) 	 * We must not get preempted while modifying the TLS.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  93) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  94) 	cpu = get_cpu();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  95) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  96) 	while (n-- > 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  97) 		if (LDT_empty(info) || LDT_zero(info))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  98) 			memset(desc, 0, sizeof(*desc));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  99) 		else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) 			fill_ldt(desc, info);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) 		++info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) 		++desc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) 	if (t == &current->thread)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) 		load_TLS(t, cpu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) 	put_cpu();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112)  * Set a given TLS descriptor:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) int do_set_thread_area(struct task_struct *p, int idx,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) 		       struct user_desc __user *u_info,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) 		       int can_allocate)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) 	struct user_desc info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) 	unsigned short __maybe_unused sel, modified_sel;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) 	if (copy_from_user(&info, u_info, sizeof(info)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) 		return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) 	if (!tls_desc_okay(&info))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) 		return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) 	if (idx == -1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) 		idx = info.entry_number;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) 	 * index -1 means the kernel should try to find and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) 	 * allocate an empty descriptor:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) 	if (idx == -1 && can_allocate) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) 		idx = get_free_idx();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) 		if (idx < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) 			return idx;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) 		if (put_user(idx, &u_info->entry_number))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) 			return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) 	if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) 		return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) 	set_tls_desc(p, idx, &info, 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) 	 * If DS, ES, FS, or GS points to the modified segment, forcibly
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) 	 * refresh it.  Only needed on x86_64 because x86_32 reloads them
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) 	 * on return to user mode.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) 	modified_sel = (idx << 3) | 3;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) 	if (p == current) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) #ifdef CONFIG_X86_64
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) 		savesegment(ds, sel);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) 		if (sel == modified_sel)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) 			loadsegment(ds, sel);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) 		savesegment(es, sel);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) 		if (sel == modified_sel)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) 			loadsegment(es, sel);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) 		savesegment(fs, sel);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) 		if (sel == modified_sel)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) 			loadsegment(fs, sel);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) 		savesegment(gs, sel);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) 		if (sel == modified_sel)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) 			load_gs_index(sel);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) #ifdef CONFIG_X86_32_LAZY_GS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) 		savesegment(gs, sel);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) 		if (sel == modified_sel)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) 			loadsegment(gs, sel);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) 	} else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) #ifdef CONFIG_X86_64
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) 		if (p->thread.fsindex == modified_sel)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) 			p->thread.fsbase = info.base_addr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) 		if (p->thread.gsindex == modified_sel)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) 			p->thread.gsbase = info.base_addr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) 	return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) SYSCALL_DEFINE1(set_thread_area, struct user_desc __user *, u_info)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) 	return do_set_thread_area(current, -1, u_info, 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198)  * Get the current Thread-Local Storage area:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) static void fill_user_desc(struct user_desc *info, int idx,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) 			   const struct desc_struct *desc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) 	memset(info, 0, sizeof(*info));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) 	info->entry_number = idx;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) 	info->base_addr = get_desc_base(desc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) 	info->limit = get_desc_limit(desc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) 	info->seg_32bit = desc->d;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) 	info->contents = desc->type >> 2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) 	info->read_exec_only = !(desc->type & 2);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) 	info->limit_in_pages = desc->g;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) 	info->seg_not_present = !desc->p;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) 	info->useable = desc->avl;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) #ifdef CONFIG_X86_64
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) 	info->lm = desc->l;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) int do_get_thread_area(struct task_struct *p, int idx,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) 		       struct user_desc __user *u_info)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) 	struct user_desc info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) 	int index;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) 	if (idx == -1 && get_user(idx, &u_info->entry_number))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) 		return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) 	if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) 		return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) 	index = idx - GDT_ENTRY_TLS_MIN;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) 	index = array_index_nospec(index,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) 			GDT_ENTRY_TLS_MAX - GDT_ENTRY_TLS_MIN + 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) 	fill_user_desc(&info, idx, &p->thread.tls_array[index]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238) 	if (copy_to_user(u_info, &info, sizeof(info)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239) 		return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) 	return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) SYSCALL_DEFINE1(get_thread_area, struct user_desc __user *, u_info)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) 	return do_get_thread_area(current, -1, u_info);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) int regset_tls_active(struct task_struct *target,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) 		      const struct user_regset *regset)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) 	struct thread_struct *t = &target->thread;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252) 	int n = GDT_ENTRY_TLS_ENTRIES;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) 	while (n > 0 && desc_empty(&t->tls_array[n - 1]))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) 		--n;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) 	return n;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) int regset_tls_get(struct task_struct *target, const struct user_regset *regset,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259) 		   struct membuf to)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) 	const struct desc_struct *tls;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) 	struct user_desc v;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) 	int pos;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) 	for (pos = 0, tls = target->thread.tls_array; to.left; pos++, tls++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) 		fill_user_desc(&v, GDT_ENTRY_TLS_MIN + pos, tls);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) 		membuf_write(&to, &v, sizeof(v));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) 	return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) int regset_tls_set(struct task_struct *target, const struct user_regset *regset,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) 		   unsigned int pos, unsigned int count,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) 		   const void *kbuf, const void __user *ubuf)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) 	struct user_desc infobuf[GDT_ENTRY_TLS_ENTRIES];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) 	const struct user_desc *info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) 	int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280) 	if (pos >= GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) 	    (pos % sizeof(struct user_desc)) != 0 ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) 	    (count % sizeof(struct user_desc)) != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) 		return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) 	if (kbuf)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) 		info = kbuf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) 	else if (__copy_from_user(infobuf, ubuf, count))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) 		return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) 	else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) 		info = infobuf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) 	for (i = 0; i < count / sizeof(struct user_desc); i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) 		if (!tls_desc_okay(info + i))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) 			return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296) 	set_tls_desc(target,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) 		     GDT_ENTRY_TLS_MIN + (pos / sizeof(struct user_desc)),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) 		     info, count / sizeof(struct user_desc));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) 	return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) }