arch/x86/kernel/step.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * x86 single-step support code, common to 32-bit and 64-bit.
   4  */
   5 #include <linux/sched.h>
   6 #include <linux/sched/task_stack.h>
   7 #include <linux/mm.h>
   8 #include <linux/ptrace.h>
   9
  10 #include <asm/desc.h>
  11 #include <asm/debugreg.h>
  12 #include <asm/mmu_context.h>
  13
  14 unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *regs)
  15 {
  16         unsigned long addr, seg;
  17
  18         addr = regs->ip;
  19         seg = regs->cs;
  20         if (v8086_mode(regs)) {
  21                 addr = (addr & 0xffff) + (seg << 4);
  22                 return addr;
  23         }
  24
  25 #ifdef CONFIG_MODIFY_LDT_SYSCALL
  26         /*
  27          * We'll assume that the code segments in the GDT
  28          * are all zero-based. That is largely true: the
  29          * TLS segments are used for data, and the PNPBIOS
  30          * and APM bios ones we just ignore here.
  31          */
  32         if ((seg & SEGMENT_TI_MASK) == SEGMENT_LDT) {
  33                 struct desc_struct *desc;
  34                 unsigned long base;
  35
  36                 seg >>= 3;
  37
  38                 mutex_lock(&child->mm->context.lock);
  39                 if (unlikely(!child->mm->context.ldt ||
  40                              seg >= child->mm->context.ldt->nr_entries))
  41                         addr = -1L; /* bogus selector, access would fault */
  42                 else {
  43                         desc = &child->mm->context.ldt->entries[seg];
  44                         base = get_desc_base(desc);
  45
  46                         /* 16-bit code segment? */
  47                         if (!desc->d)
  48                                 addr &= 0xffff;
  49                         addr += base;
  50                 }
  51                 mutex_unlock(&child->mm->context.lock);
  52         }
  53 #endif
  54
  55         return addr;
  56 }
  57
  58 static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
  59 {
  60         int i, copied;
  61         unsigned char opcode[15];
  62         unsigned long addr = convert_ip_to_linear(child, regs);
  63
  64         copied = access_process_vm(child, addr, opcode, sizeof(opcode),
  65                         FOLL_FORCE);
  66         for (i = 0; i < copied; i++) {
  67                 switch (opcode[i]) {
  68                 /* popf and iret */
  69                 case 0x9d: case 0xcf:
  70                         return 1;
  71
  72                         /* CHECKME: 64 65 */
  73
  74                 /* opcode and address size prefixes */
  75                 case 0x66: case 0x67:
  76                         continue;
  77                 /* irrelevant prefixes (segment overrides and repeats) */
  78                 case 0x26: case 0x2e:
  79                 case 0x36: case 0x3e:
  80                 case 0x64: case 0x65:
  81                 case 0xf0: case 0xf2: case 0xf3:
  82                         continue;
  83
  84 #ifdef CONFIG_X86_64
  85                 case 0x40 ... 0x4f:
  86                         if (!user_64bit_mode(regs))
  87                                 /* 32-bit mode: register increment */
  88                                 return 0;
  89                         /* 64-bit mode: REX prefix */
  90                         continue;
  91 #endif
  92
  93                         /* CHECKME: f2, f3 */
  94
  95                 /*
  96                  * pushf: NOTE! We should probably not let
  97                  * the user see the TF bit being set. But
  98                  * it's more pain than it's worth to avoid
  99                  * it, and a debugger could emulate this
 100                  * all in user space if it _really_ cares.
 101                  */
 102                 case 0x9c:
 103                 default:
 104                         return 0;
 105                 }
 106         }
 107         return 0;
 108 }
 109
 110 /*
 111  * Enable single-stepping.  Return nonzero if user mode is not using TF itself.
 112  */
 113 static int enable_single_step(struct task_struct *child)
 114 {
 115         struct pt_regs *regs = task_pt_regs(child);
 116         unsigned long oflags;
 117
 118         /*
 119          * If we stepped into a sysenter/syscall insn, it trapped in
 120          * kernel mode; do_debug() cleared TF and set TIF_SINGLESTEP.
 121          * If user-mode had set TF itself, then it's still clear from
 122          * do_debug() and we need to set it again to restore the user
 123          * state so we don't wrongly set TIF_FORCED_TF below.
 124          * If enable_single_step() was used last and that is what
 125          * set TIF_SINGLESTEP, then both TF and TIF_FORCED_TF are
 126          * already set and our bookkeeping is fine.
 127          */
 128         if (unlikely(test_tsk_thread_flag(child, TIF_SINGLESTEP)))
 129                 regs->flags |= X86_EFLAGS_TF;
 130
 131         /*
 132          * Always set TIF_SINGLESTEP.  This will also
 133          * cause us to set TF when returning to user mode.
 134          */
 135         set_tsk_thread_flag(child, TIF_SINGLESTEP);
 136
 137         /*
 138          * Ensure that a trap is triggered once stepping out of a system
 139          * call prior to executing any user instruction.
 140          */
 141         set_task_syscall_work(child, SYSCALL_EXIT_TRAP);
 142
 143         oflags = regs->flags;
 144
 145         /* Set TF on the kernel stack.. */
 146         regs->flags |= X86_EFLAGS_TF;
 147
 148         /*
 149          * ..but if TF is changed by the instruction we will trace,
 150          * don't mark it as being "us" that set it, so that we
 151          * won't clear it by hand later.
 152          *
 153          * Note that if we don't actually execute the popf because
 154          * of a signal arriving right now or suchlike, we will lose
 155          * track of the fact that it really was "us" that set it.
 156          */
 157         if (is_setting_trap_flag(child, regs)) {
 158                 clear_tsk_thread_flag(child, TIF_FORCED_TF);
 159                 return 0;
 160         }
 161
 162         /*
 163          * If TF was already set, check whether it was us who set it.
 164          * If not, we should never attempt a block step.
 165          */
 166         if (oflags & X86_EFLAGS_TF)
 167                 return test_tsk_thread_flag(child, TIF_FORCED_TF);
 168
 169         set_tsk_thread_flag(child, TIF_FORCED_TF);
 170
 171         return 1;
 172 }
 173
 174 void set_task_blockstep(struct task_struct *task, bool on)
 175 {
 176         unsigned long debugctl;
 177
 178         /*
 179          * Ensure irq/preemption can't change debugctl in between.
 180          * Note also that both TIF_BLOCKSTEP and debugctl should
 181          * be changed atomically wrt preemption.
 182          *
 183          * NOTE: this means that set/clear TIF_BLOCKSTEP is only safe if
 184          * task is current or it can't be running, otherwise we can race
 185          * with __switch_to_xtra(). We rely on ptrace_freeze_traced().
 186          */
 187         local_irq_disable();
 188         debugctl = get_debugctlmsr();
 189         if (on) {
 190                 debugctl |= DEBUGCTLMSR_BTF;
 191                 set_tsk_thread_flag(task, TIF_BLOCKSTEP);
 192         } else {
 193                 debugctl &= ~DEBUGCTLMSR_BTF;
 194                 clear_tsk_thread_flag(task, TIF_BLOCKSTEP);
 195         }
 196         if (task == current)
 197                 update_debugctlmsr(debugctl);
 198         local_irq_enable();
 199 }
 200
 201 /*
 202  * Enable single or block step.
 203  */
 204 static void enable_step(struct task_struct *child, bool block)
 205 {
 206         /*
 207          * Make sure block stepping (BTF) is not enabled unless it should be.
 208          * Note that we don't try to worry about any is_setting_trap_flag()
 209          * instructions after the first when using block stepping.
 210          * So no one should try to use debugger block stepping in a program
 211          * that uses user-mode single stepping itself.
 212          */
 213         if (enable_single_step(child) && block)
 214                 set_task_blockstep(child, true);
 215         else if (test_tsk_thread_flag(child, TIF_BLOCKSTEP))
 216                 set_task_blockstep(child, false);
 217 }
 218
 219 void user_enable_single_step(struct task_struct *child)
 220 {
 221         enable_step(child, 0);
 222 }
 223
 224 void user_enable_block_step(struct task_struct *child)
 225 {
 226         enable_step(child, 1);
 227 }
 228
 229 void user_disable_single_step(struct task_struct *child)
 230 {
 231         /*
 232          * Make sure block stepping (BTF) is disabled.
 233          */
 234         if (test_tsk_thread_flag(child, TIF_BLOCKSTEP))
 235                 set_task_blockstep(child, false);
 236
 237         /* Always clear TIF_SINGLESTEP... */
 238         clear_tsk_thread_flag(child, TIF_SINGLESTEP);
 239         clear_task_syscall_work(child, SYSCALL_EXIT_TRAP);
 240
 241         /* But touch TF only if it was set by us.. */
 242         if (test_and_clear_tsk_thread_flag(child, TIF_FORCED_TF))
 243                 task_pt_regs(child)->flags &= ~X86_EFLAGS_TF;
 244 }