ARM: 7735/2: Preserve the user r/w register TPIDRURW on context switch and fork

Since commit 6a1c53124aa1 the user writeable TLS register was zeroed to
prevent it from being used as a covert channel between two tasks.

There are more and more applications coming to Windows RT,
Wine could support them, but mostly they expect to have
the thread environment block (TEB) in TPIDRURW.

This patch preserves that register per thread instead of clearing it.
Unlike the TPIDRURO, which is already switched, the TPIDRURW
can be updated from userspace so needs careful treatment in the case that we
modify TPIDRURW and call fork(). To avoid this we must always read
TPIDRURW in copy_thread.

Signed-off-by: André Hentschel <nerv@dawncrow.de>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Jonathan Austin <jonathan.austin@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

4 files changed, 9 insertions, 6 deletions

diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index 582b405befc5..a39cfc2a1f90 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -685,15 +685,16 @@ ENTRY(__switch_to)
  UNWIND(.fnstart        )
  UNWIND(.cantunwind     )
         add     ip, r1, #TI_CPU_SAVE
-        ldr     r3, [r2, #TI_TP_VALUE]
  ARM(   stmia   ip!, {r4 - sl, fp, sp, lr} )    @ Store most regs on stack
  THUMB( stmia   ip!, {r4 - sl, fp}         )    @ Store most regs on stack
  THUMB( str     sp, [ip], #4               )
  THUMB( str     lr, [ip], #4               )
+        ldr     r4, [r2, #TI_TP_VALUE]
+        ldr     r5, [r2, #TI_TP_VALUE + 4]
 #ifdef CONFIG_CPU_USE_DOMAINS
         ldr     r6, [r2, #TI_CPU_DOMAIN]
 #endif
-        set_tls r3, r4, r5
+        switch_tls r1, r4, r5, r3, r7
 #if defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_SMP)
         ldr     r7, [r2, #TI_TASK]
         ldr     r8, =__stack_chk_guard
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index f21970316836..087064148ebf 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -39,6 +39,7 @@
 #include <asm/thread_notify.h>
 #include <asm/stacktrace.h>
 #include <asm/mach/time.h>
+#include <asm/tls.h>
 
 #ifdef CONFIG_CC_STACKPROTECTOR
 #include <linux/stackprotector.h>
@@ -343,7 +344,8 @@ copy_thread(unsigned long clone_flags, unsigned long stack_start,
         clear_ptrace_hw_breakpoint(p);
 
         if (clone_flags & CLONE_SETTLS)
-                thread->tp_value = childregs->ARM_r3;
+                thread->tp_value[0] = childregs->ARM_r3;
+        thread->tp_value[1] = get_tpuser();
 
         thread_notify(THREAD_NOTIFY_COPY, thread);
 
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 03deeffd9f6d..2bc1514d6dbe 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -849,7 +849,7 @@ long arch_ptrace(struct task_struct *child, long request,
 #endif
 
                 case PTRACE_GET_THREAD_AREA:
-                        ret = put_user(task_thread_info(child)->tp_value,
+                        ret = put_user(task_thread_info(child)->tp_value[0],
                                        datap);
                         break;
 
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 18b32e8e4497..517bfd4da1c9 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -581,7 +581,7 @@ asmlinkage int arm_syscall(int no, struct pt_regs *regs)
                 return regs->ARM_r0;
 
         case NR(set_tls):
-                thread->tp_value = regs->ARM_r0;
+                thread->tp_value[0] = regs->ARM_r0;
                 if (tls_emu)
                         return 0;
                 if (has_tls_reg) {
@@ -699,7 +699,7 @@ static int get_tp_trap(struct pt_regs *regs, unsigned int instr)
         int reg = (instr >> 12) & 15;
         if (reg == 15)
                 return 1;
-        regs->uregs[reg] = current_thread_info()->tp_value;
+        regs->uregs[reg] = current_thread_info()->tp_value[0];
         regs->ARM_pc += 4;
         return 0;
 }