step.c 6.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * x86 single-step support code, common to 32-bit and 64-bit.
  4. */
  5. #include <linux/sched.h>
  6. #include <linux/sched/task_stack.h>
  7. #include <linux/mm.h>
  8. #include <linux/ptrace.h>
  9. #include <asm/desc.h>
  10. #include <asm/mmu_context.h>
  11. unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *regs)
  12. {
  13. unsigned long addr, seg;
  14. addr = regs->ip;
  15. seg = regs->cs;
  16. if (v8086_mode(regs)) {
  17. addr = (addr & 0xffff) + (seg << 4);
  18. return addr;
  19. }
  20. #ifdef CONFIG_MODIFY_LDT_SYSCALL
  21. /*
  22. * We'll assume that the code segments in the GDT
  23. * are all zero-based. That is largely true: the
  24. * TLS segments are used for data, and the PNPBIOS
  25. * and APM bios ones we just ignore here.
  26. */
  27. if ((seg & SEGMENT_TI_MASK) == SEGMENT_LDT) {
  28. struct desc_struct *desc;
  29. unsigned long base;
  30. seg >>= 3;
  31. mutex_lock(&child->mm->context.lock);
  32. if (unlikely(!child->mm->context.ldt ||
  33. seg >= child->mm->context.ldt->nr_entries))
  34. addr = -1L; /* bogus selector, access would fault */
  35. else {
  36. desc = &child->mm->context.ldt->entries[seg];
  37. base = get_desc_base(desc);
  38. /* 16-bit code segment? */
  39. if (!desc->d)
  40. addr &= 0xffff;
  41. addr += base;
  42. }
  43. mutex_unlock(&child->mm->context.lock);
  44. }
  45. #endif
  46. return addr;
  47. }
  48. static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
  49. {
  50. int i, copied;
  51. unsigned char opcode[15];
  52. unsigned long addr = convert_ip_to_linear(child, regs);
  53. copied = access_process_vm(child, addr, opcode, sizeof(opcode),
  54. FOLL_FORCE);
  55. for (i = 0; i < copied; i++) {
  56. switch (opcode[i]) {
  57. /* popf and iret */
  58. case 0x9d: case 0xcf:
  59. return 1;
  60. /* CHECKME: 64 65 */
  61. /* opcode and address size prefixes */
  62. case 0x66: case 0x67:
  63. continue;
  64. /* irrelevant prefixes (segment overrides and repeats) */
  65. case 0x26: case 0x2e:
  66. case 0x36: case 0x3e:
  67. case 0x64: case 0x65:
  68. case 0xf0: case 0xf2: case 0xf3:
  69. continue;
  70. #ifdef CONFIG_X86_64
  71. case 0x40 ... 0x4f:
  72. if (!user_64bit_mode(regs))
  73. /* 32-bit mode: register increment */
  74. return 0;
  75. /* 64-bit mode: REX prefix */
  76. continue;
  77. #endif
  78. /* CHECKME: f2, f3 */
  79. /*
  80. * pushf: NOTE! We should probably not let
  81. * the user see the TF bit being set. But
  82. * it's more pain than it's worth to avoid
  83. * it, and a debugger could emulate this
  84. * all in user space if it _really_ cares.
  85. */
  86. case 0x9c:
  87. default:
  88. return 0;
  89. }
  90. }
  91. return 0;
  92. }
  93. /*
  94. * Enable single-stepping. Return nonzero if user mode is not using TF itself.
  95. */
  96. static int enable_single_step(struct task_struct *child)
  97. {
  98. struct pt_regs *regs = task_pt_regs(child);
  99. unsigned long oflags;
  100. /*
  101. * If we stepped into a sysenter/syscall insn, it trapped in
  102. * kernel mode; do_debug() cleared TF and set TIF_SINGLESTEP.
  103. * If user-mode had set TF itself, then it's still clear from
  104. * do_debug() and we need to set it again to restore the user
  105. * state so we don't wrongly set TIF_FORCED_TF below.
  106. * If enable_single_step() was used last and that is what
  107. * set TIF_SINGLESTEP, then both TF and TIF_FORCED_TF are
  108. * already set and our bookkeeping is fine.
  109. */
  110. if (unlikely(test_tsk_thread_flag(child, TIF_SINGLESTEP)))
  111. regs->flags |= X86_EFLAGS_TF;
  112. /*
  113. * Always set TIF_SINGLESTEP - this guarantees that
  114. * we single-step system calls etc.. This will also
  115. * cause us to set TF when returning to user mode.
  116. */
  117. set_tsk_thread_flag(child, TIF_SINGLESTEP);
  118. oflags = regs->flags;
  119. /* Set TF on the kernel stack.. */
  120. regs->flags |= X86_EFLAGS_TF;
  121. /*
  122. * ..but if TF is changed by the instruction we will trace,
  123. * don't mark it as being "us" that set it, so that we
  124. * won't clear it by hand later.
  125. *
  126. * Note that if we don't actually execute the popf because
  127. * of a signal arriving right now or suchlike, we will lose
  128. * track of the fact that it really was "us" that set it.
  129. */
  130. if (is_setting_trap_flag(child, regs)) {
  131. clear_tsk_thread_flag(child, TIF_FORCED_TF);
  132. return 0;
  133. }
  134. /*
  135. * If TF was already set, check whether it was us who set it.
  136. * If not, we should never attempt a block step.
  137. */
  138. if (oflags & X86_EFLAGS_TF)
  139. return test_tsk_thread_flag(child, TIF_FORCED_TF);
  140. set_tsk_thread_flag(child, TIF_FORCED_TF);
  141. return 1;
  142. }
  143. void set_task_blockstep(struct task_struct *task, bool on)
  144. {
  145. unsigned long debugctl;
  146. /*
  147. * Ensure irq/preemption can't change debugctl in between.
  148. * Note also that both TIF_BLOCKSTEP and debugctl should
  149. * be changed atomically wrt preemption.
  150. *
  151. * NOTE: this means that set/clear TIF_BLOCKSTEP is only safe if
  152. * task is current or it can't be running, otherwise we can race
  153. * with __switch_to_xtra(). We rely on ptrace_freeze_traced() but
  154. * PTRACE_KILL is not safe.
  155. */
  156. local_irq_disable();
  157. debugctl = get_debugctlmsr();
  158. if (on) {
  159. debugctl |= DEBUGCTLMSR_BTF;
  160. set_tsk_thread_flag(task, TIF_BLOCKSTEP);
  161. } else {
  162. debugctl &= ~DEBUGCTLMSR_BTF;
  163. clear_tsk_thread_flag(task, TIF_BLOCKSTEP);
  164. }
  165. if (task == current)
  166. update_debugctlmsr(debugctl);
  167. local_irq_enable();
  168. }
  169. /*
  170. * Enable single or block step.
  171. */
  172. static void enable_step(struct task_struct *child, bool block)
  173. {
  174. /*
  175. * Make sure block stepping (BTF) is not enabled unless it should be.
  176. * Note that we don't try to worry about any is_setting_trap_flag()
  177. * instructions after the first when using block stepping.
  178. * So no one should try to use debugger block stepping in a program
  179. * that uses user-mode single stepping itself.
  180. */
  181. if (enable_single_step(child) && block)
  182. set_task_blockstep(child, true);
  183. else if (test_tsk_thread_flag(child, TIF_BLOCKSTEP))
  184. set_task_blockstep(child, false);
  185. }
  186. void user_enable_single_step(struct task_struct *child)
  187. {
  188. enable_step(child, 0);
  189. }
  190. void user_enable_block_step(struct task_struct *child)
  191. {
  192. enable_step(child, 1);
  193. }
  194. void user_disable_single_step(struct task_struct *child)
  195. {
  196. /*
  197. * Make sure block stepping (BTF) is disabled.
  198. */
  199. if (test_tsk_thread_flag(child, TIF_BLOCKSTEP))
  200. set_task_blockstep(child, false);
  201. /* Always clear TIF_SINGLESTEP... */
  202. clear_tsk_thread_flag(child, TIF_SINGLESTEP);
  203. /* But touch TF only if it was set by us.. */
  204. if (test_and_clear_tsk_thread_flag(child, TIF_FORCED_TF))
  205. task_pt_regs(child)->flags &= ~X86_EFLAGS_TF;
  206. }