Linux Operating System 許 富 皓

1. Linux Operating System 許 富 皓

2. Processes Switch

3. switch_to Macro • Assumptions: • local variableprev refers to the process descriptor of the process being switched out. • next refers to the one being switched in to replace it. • switch_to(prev,next,last) macro: • First of all, the macro has three parameters called prev,next, and last. • The actual invocation of the macro in context_switch()is: switch_to(prev, next, prev). • In any process switch, three processes are involved, not just two.

4. Why 3 Processes Are Involved in a Context Switch? Here old process is suspended. New process resumes. Where is C ? ………. ……….. code of switch_to front rear : prev = A next=B : prev = next= : prev = next= : prev = C next= A Kernel Mode Stack of Process A Kernel Mode Stack of Process D Kernel Mode Stack of Process C Kernel Mode Stack of Process B

5. Why Reference to C Is Needed? • To complete the process switching. • P.S.: See Chapter 7, Process Scheduling, for more details.

6. The last Parameter • (F) Before the process switching, the macro saves in the eax CPU register the content of the variable identified by the first input parameter prev -- that is, the prev local variable allocated on the Kernel Mode stack of C. • (R) After the process switching, when A has resumed its execution, the macro writes the content of the eax CPU register in the memory location of A identified by the third output parameter last(=prev). • (R) The last parameter of the switch_to macro is an output parameter that specifies a memory location in which the macro writes the descriptor address of process C (of course, this is done after A resumes its execution). • (R) In the current implementation of schedule( ), the last parameter identifies the prev local variable of A, so prev is overwritten with the address of C. • (R) Because the CPU register doesn't change across the process switch, this memory location receives the address of C's descriptor. • P.S.: (F) means the front part of switch_to (R) means the rear part of switch_to

7. : prev = C next= Code Execution Sequence & Get the Correct Previous Process Descriptor code of switch_to code of switch_to current execution ………. movl 484(%edx),%esp movl $1f, 480(%eax) previous execution movl $1f, 480(%eax) : front rear %eax=prev prev= %eax : prev = A next=B : prev = next= : prev = next= : prev = D next= prev = C prev = C Kernel Mode Stack of Process A Kernel Mode Stack of Process D Kernel Mode Stack of Process C Kernel Mode Stack of Process B

8. From schedule to switch_to schedule() __schedule() context_switch() switch_to

9. Simplification for Explanation • The switch_to macro is coded in extended inline assembly language that makes for rather complex reading. • In fact, the code refers to registers by means of a special positional notation that allows the compiler to freely choose the general-purpose registers to be used. • Rather than follow the extended inline assembly language, we'll describe what the switch_to macro typically does on an 80x86 microprocessor by using standard assembly language.

10. switch_to (1) • Saves the values of prev and next in the eax and edx registers, respectively: movl prev,%eax    movl next,%edx The eax and edx registers correspond to the prev and next parameters of the macro.

11. switch_to (2) • Saves the contents of the eflags and ebp registers in the prev Kernel Mode stack. • They must be saved because the compiler assumes that they will stay unchanged until the end of switch_to : pushfl pushl %ebp

12. switch_to (3) • Saves the content of esp in prev->thread.sp so that the field points to the top of the prev Kernel Mode stack: movl %esp,484(%eax) • The 484(%eax) operand identifies the memory cell whose address is the contents of eax plus 484.

13. switch_to (4) • Loads next->thread.sp in esp. From now on, the kernel operates on the Kernel Mode stack of next, so this instruction performs the actual process switch from prev to next. movl 484(%edx), %esp

14. switch_to (5) • Saves the address labeled 1 (shown later in this section) in prev->thread.ip. • When the process being replaced resumes its execution, the process executes the instruction labeled as 1: movl $1f, 480(%eax)

15. switch_to (6) • On the Kernel Mode stack of next, the macro pushes the next->thread.ip value, which, in most cases, is the address labeled as 1: pushl 480(%edx)

16. switch_to (7) • Jumps to the __switch_to( ) C function: • P.S.: see next. jmp __switch_to

17. Graphic Explanation of the Front Part of switch_to kernel mode stack kernel mode stack 0xzzzzzzzz : : eflag ebp lable 1 : : eflag ebp esp 0xyyyyyyyy process descriptor process descriptor : : : sp= 0xzzzzzzzz ip=label 1 : : sp=oxyyyyyyyy ip=label 1 struct thread_struct prev next

18. __switch_to

19. The __switch_to( )function • The __switch_to( ) function does the bulk of the process switch started by the switch_to( ) macro. • It acts on the prev_p and next_p parameters that denote the former process (e.g. process C of slide 7) and the new process (e.g. process A of slide 7). • This function call is different from the average function call, though, because __switch_to( ) takes the prev_p and next_p parameters from the eax and edx registers (where we saw they were stored), not from the stack like most functions.

20. Before and Including Linux 2.6.24

21. Get Function Parameters from Registers • To force the function to go to the registers for its parameters, the kernel uses the __attribute__ and regparm keywords, which are nonstandard extensions of the C language implemented by the gcc compiler.

22. regparm • regparm (number) • On the Intel 386, the regparm attribute causes the compiler to pass up to number integer arguments in registers EAX, EDX, and ECX instead of on the stack. • Functions that take a variable number of arguments will continue to be passed all of their arguments on the stack.

23. Macro fastcall [1][2] #define fastcall \ __attribute__((regparm(3))) Get parameters from related registers.

24. Macro asmlinkage [1][2][3] #define asmlinkage __attribute__((regparm(0))) Get parameters from the stack.

25. Function Prototype of __switch_to( ) • The __switch_to( ) function is declared as follows: struct task_struct fastcall * __switch_to(struct task_struct *prev_p, struct task_struct * next_p)

26. After and Including Linux 2.6.25

27. Function Prototype of __switch_to( )[何春晖] __notrace_funcgraph struct task_struct * __switch_to(struct task_struct *prev_p, struct task_struct *next_p) Makefile, /arch/x86/Makefile, instructs complier to utilize registers to pass parameters.

28. __switch_to( ) (1) • Executes the smp_processor_id( )[1][2]macro to get the index of the localCPU, namely the CPU that executes the code. • stores the result into the cpu local variable.

29. Definition of cpu_number DEFINE_PER_CPU_READ_MOSTLY(int, cpu_number); EXPORT_PER_CPU_SYMBOL(cpu_number);

30. Initialization of cpu_number void __init setup_per_cpu_areas(void) { unsigned int cpu; unsigned long delta; int rc; : for_each_possible_cpu(cpu) { per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu]; per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu); per_cpu(cpu_number, cpu) = cpu; : } : }

31. __switch_to( ) (2) • Loads next_p->thread.sp0 into the sp0[1][2] field of the TSS relative to the local CPU; as we'll see in the section "Issuing a System Call via the sysenter Instruction", any future privilege level change from User Mode to Kernel Mode raised by a sysenter assembly instruction will copy this address into the esp register: tss->x86_tss.sp0 = thread->sp0; P.S.When a process is created, functioncopy_thread()set the sp0field to point the next byte of the last byte of the kernel mode stack of the new born process.

32. __switch_to( ) (3) • Loads in the Global Descriptor Table of the local CPU the Thread-Local Storage (TLS) segments used by the next_p process. • The above three Segment Selectors are stored in the tls_array array inside the process descriptor. • P.S.: See the section "Segmentation in Linux" in Chapter 2. #define GDT_ENTRY_TLS_MIN 6 per_cpu(gdt_page, cpu).gdt[GDT_ENTRY_TLS_MIN + 0] = next->tls_array[0]; per_cpu(gdt_page, cpu).gdt[GDT_ENTRY_TLS_MIN + 1] = next->tls_array[1]; per_cpu(gdt_page, cpu).gdt[GDT_ENTRY_TLS_MIN + 2] = next->tls_array[2];

33. __switch_to( ) (4)- 1 • Stores the contents of the gs segmentation registers in prev_p->thread.gs; [1] #define savesegment(seg, value) \ asm("mov %%" #seg ",%0":"=r" (value) : : "memory") #define lazy_save_gs(v) savesegment(gs, (v)) __switch_to(…){ … struct thread_struct *prev = &prev_p->thread; … lazy_save_gs(prev->gs); … }

34. __switch_to( ) (4)– 2 gs points to the sixth entry of GDT[1]. Linux初始化gs,就是跟TLS相關的register[2]。 The sixth entry of GDT is the first TLS segment descriptor of a process. No need to save fs, because it was saved on the stack on entryto the kernel address space[3].

35. __switch_to( ) (4)– 3 per-CPU init_tss Linux’s GDT Linux’s GDT n-1 ESPFIX small SS per-cpu stack_canary-20

36. __switch_to( ) (5) • If the the gs segmentation register have been used either by the prev_p or by the next_p process (having nonzero values), loads into gs the value stored in the thread_struct descriptor of the next_p process. __switch_to(…){ … struct thread_struct *next = &next_p->thread; … if (prev->gs | next->gs) lazy_load_gs(next->gs); … }

37. __switch_to( ) (6) • Updates the I/Obitmap in the TSS, if necessary. : void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p, struct tss_struct *tss) { struct thread_struct *prev, *next; prev = &prev_p->thread; next = &next_p->thread; ... if (test_tsk_thread_flag(next_p, TIF_IO_BITMAP)) { memcpy(tss->io_bitmap, next->io_bitmap_ptr, max(prev->io_bitmap_max, next-> io_bitmap_max)); } else ... }

38. Make current to Point to the next_p Process (7) Function __switch_to()invokesthis_cpu_write(current_task, next_p)to make macro current to point to the next_p process.

39. __switch_to( ) (8)-1 • Terminates. • The __switch_to( ) C function ends by means of the statement: return prev_p; • The corresponding assembly language instructions generated by the compiler are: movl %edi,%eax ret • The prev_p parameter (now in edi) is copied into eax, because by default the return value of any C function is passed in the eax register. • Notice that the value of eax is thus preserved across the invocation of __switch_to( ); this is quite important, because the invoking switch_to( ) macro assumes that eax always stores the address of the process descriptor being replaced.

40. __switch_to( ) (8)-2 • The ret assembly language instruction loads the eip program counter with the return address stored on top of the stack. • However, the __switch_to( ) function has been invoked simply by jumping into it. Therefore, the ret instruction finds on the stack the address of the instruction labeled as 1, which was pushed by the switch_to macro. • If next_p was never suspended before because it is being executed for the first time, the function finds the starting address of the ret_from_fork( ) function [1]. • P.S.: see the section "The clone( ),fork( ), and vfork( ) System Calls" later in this chapter.

41. Resume the Execution of a Process

42. switch_to (8) • Here process A that was replaced by B gets the CPU again: it executes a few instructions that restore the contents of the eflags and ebp registers. The first of these two instructions is labeled as 1: 1: popl %ebp popfl

43. switch_to (9) • Copies the content of the eax register (loaded in step 1 above) into the memory location identified by the third parameter last of the switch_to macro: movl %eax, last • As discussed earlier, the eax register points to the descriptor of the process that has just been replaced.

44. Supplementary Material

45. Linux Buffer Overflow Protection [1][2][3] __switch_canary