linux-user: calling SYS_get_thread_area and SYS_get_thread_area has incorrent result on multithread environment Description of problem: Steps to reproduce: 1. Compile test.out by Command and source code: ``` gcc -m32 -g test.c -lpthread -o test.out ``` ``` #include #include #include #include #include static inline int set_thread_area( struct user_desc *ptr ) { return syscall( SYS_set_thread_area, ptr ); } static inline int get_thread_area( struct user_desc *ptr ) { return syscall( SYS_get_thread_area, ptr ); } static unsigned int entry_number; static void* start_routine(void* ptr) { struct user_desc user_desc0 = { entry_number }; struct user_desc user_desc1 = { entry_number }; struct user_desc user_desc2 = { entry_number }; get_thread_area(&user_desc0); printf("child thread: %u\n", user_desc0.base_addr); user_desc1.base_addr = 2; user_desc1.limit = 0xFFF; user_desc1.seg_32bit = 1; set_thread_area( &user_desc1 ); get_thread_area(&user_desc2); printf("child thread: %u\n", user_desc2.base_addr); return NULL; } int main(void) { struct user_desc user_desc0 = { -1 }, user_desc1 = { 0 }, user_desc2 = { 0 }; user_desc0.seg_32bit = 1; user_desc0.useable = 1; set_thread_area( &user_desc0 ); entry_number = user_desc0.entry_number; user_desc1.entry_number = entry_number; user_desc1.base_addr = 1; user_desc1.limit = 0xFFF; user_desc1.seg_32bit = 1; set_thread_area( &user_desc1 ); pthread_t thread_id; pthread_create(&thread_id, NULL, &start_routine, NULL); pthread_join(thread_id, NULL); user_desc2.entry_number = entry_number; get_thread_area(&user_desc2); printf("main thread: %u\n", user_desc2.base_addr); // main thread: 1 return 0; } ``` 2. Correct Result: ``` child thread: 1 child thread: 2 main thread: 1 ``` qemu-i386 Print Result: ``` child thread: 1 child thread: 2 main thread: 2 ``` Additional information: patch for fix the bug: https://lists.nongnu.org/archive/html/qemu-devel/2023-02/msg02203.html CPUX86State::gdt::base on differect threads must have different vaules, but it points to same memory. value of CPUX86State::gdt::base must be copied when clone thread. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/kernel/tls.c SYS_set_thread_area call do_set_thread_area in kernel, it set user_desc to different memroy area on differernt threads. tls_array is in thread local memory. ``` static void set_tls_desc(struct task_struct *p, int idx, const struct user_desc *info, int n) { struct thread_struct *t = &p->thread; struct desc_struct *desc = &t->tls_array[idx - GDT_ENTRY_TLS_MIN]; int cpu; /* * We must not get preempted while modifying the TLS. */ cpu = get_cpu(); while (n-- > 0) { if (LDT_empty(info) || LDT_zero(info)) memset(desc, 0, sizeof(*desc)); else fill_ldt(desc, info); ++info; ++desc; } if (t == ¤t->thread) load_TLS(t, cpu); put_cpu(); } ```