1// SPDX-License-Identifier: GPL-2.0
  2/*
  3 * x86 single-step support code, common to 32-bit and 64-bit.
  4 */
  5#include <linux/sched.h>
  6#include <linux/sched/task_stack.h>
  7#include <linux/mm.h>
  8#include <linux/ptrace.h>
  9
 10#include <asm/desc.h>
 11#include <asm/debugreg.h>
 12#include <asm/mmu_context.h>
 13
 14unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *regs)
 15{
 16	unsigned long addr, seg;
 17
 18	addr = regs->ip;
 19	seg = regs->cs;
 20	if (v8086_mode(regs)) {
 21		addr = (addr & 0xffff) + (seg << 4);
 22		return addr;
 23	}
 24
 25#ifdef CONFIG_MODIFY_LDT_SYSCALL
 26	/*
 27	 * We'll assume that the code segments in the GDT
 28	 * are all zero-based. That is largely true: the
 29	 * TLS segments are used for data, and the PNPBIOS
 30	 * and APM bios ones we just ignore here.
 31	 */
 32	if ((seg & SEGMENT_TI_MASK) == SEGMENT_LDT) {
 33		struct desc_struct *desc;
 34		unsigned long base;
 35
 36		seg >>= 3;
 37
 38		mutex_lock(&child->mm->context.lock);
 39		if (unlikely(!child->mm->context.ldt ||
 40			     seg >= child->mm->context.ldt->nr_entries))
 41			addr = -1L; /* bogus selector, access would fault */
 42		else {
 43			desc = &child->mm->context.ldt->entries[seg];
 44			base = get_desc_base(desc);
 45
 46			/* 16-bit code segment? */
 47			if (!desc->d)
 48				addr &= 0xffff;
 49			addr += base;
 50		}
 51		mutex_unlock(&child->mm->context.lock);
 52	}
 53#endif
 54
 55	return addr;
 56}
 57
 58static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
 59{
 60	int i, copied;
 61	unsigned char opcode[15];
 62	unsigned long addr = convert_ip_to_linear(child, regs);
 63
 64	copied = access_process_vm(child, addr, opcode, sizeof(opcode),
 65			FOLL_FORCE);
 66	for (i = 0; i < copied; i++) {
 67		switch (opcode[i]) {
 68		/* popf and iret */
 69		case 0x9d: case 0xcf:
 70			return 1;
 71
 72			/* CHECKME: 64 65 */
 73
 74		/* opcode and address size prefixes */
 75		case 0x66: case 0x67:
 76			continue;
 77		/* irrelevant prefixes (segment overrides and repeats) */
 78		case 0x26: case 0x2e:
 79		case 0x36: case 0x3e:
 80		case 0x64: case 0x65:
 81		case 0xf0: case 0xf2: case 0xf3:
 82			continue;
 83
 84#ifdef CONFIG_X86_64
 85		case 0x40 ... 0x4f:
 86			if (!user_64bit_mode(regs))
 87				/* 32-bit mode: register increment */
 88				return 0;
 89			/* 64-bit mode: REX prefix */
 90			continue;
 91#endif
 92
 93			/* CHECKME: f2, f3 */
 94
 95		/*
 96		 * pushf: NOTE! We should probably not let
 97		 * the user see the TF bit being set. But
 98		 * it's more pain than it's worth to avoid
 99		 * it, and a debugger could emulate this
100		 * all in user space if it _really_ cares.
101		 */
102		case 0x9c:
103		default:
104			return 0;
105		}
106	}
107	return 0;
108}
109
110/*
111 * Enable single-stepping.  Return nonzero if user mode is not using TF itself.
112 */
113static int enable_single_step(struct task_struct *child)
114{
115	struct pt_regs *regs = task_pt_regs(child);
116	unsigned long oflags;
117
118	/*
119	 * If we stepped into a sysenter/syscall insn, it trapped in
120	 * kernel mode; do_debug() cleared TF and set TIF_SINGLESTEP.
121	 * If user-mode had set TF itself, then it's still clear from
122	 * do_debug() and we need to set it again to restore the user
123	 * state so we don't wrongly set TIF_FORCED_TF below.
124	 * If enable_single_step() was used last and that is what
125	 * set TIF_SINGLESTEP, then both TF and TIF_FORCED_TF are
126	 * already set and our bookkeeping is fine.
127	 */
128	if (unlikely(test_tsk_thread_flag(child, TIF_SINGLESTEP)))
129		regs->flags |= X86_EFLAGS_TF;
130
131	/*
132	 * Always set TIF_SINGLESTEP.  This will also
 
133	 * cause us to set TF when returning to user mode.
134	 */
135	set_tsk_thread_flag(child, TIF_SINGLESTEP);
136
137	/*
138	 * Ensure that a trap is triggered once stepping out of a system
139	 * call prior to executing any user instruction.
140	 */
141	set_task_syscall_work(child, SYSCALL_EXIT_TRAP);
142
143	oflags = regs->flags;
144
145	/* Set TF on the kernel stack.. */
146	regs->flags |= X86_EFLAGS_TF;
147
148	/*
149	 * ..but if TF is changed by the instruction we will trace,
150	 * don't mark it as being "us" that set it, so that we
151	 * won't clear it by hand later.
152	 *
153	 * Note that if we don't actually execute the popf because
154	 * of a signal arriving right now or suchlike, we will lose
155	 * track of the fact that it really was "us" that set it.
156	 */
157	if (is_setting_trap_flag(child, regs)) {
158		clear_tsk_thread_flag(child, TIF_FORCED_TF);
159		return 0;
160	}
161
162	/*
163	 * If TF was already set, check whether it was us who set it.
164	 * If not, we should never attempt a block step.
165	 */
166	if (oflags & X86_EFLAGS_TF)
167		return test_tsk_thread_flag(child, TIF_FORCED_TF);
168
169	set_tsk_thread_flag(child, TIF_FORCED_TF);
170
171	return 1;
172}
173
174void set_task_blockstep(struct task_struct *task, bool on)
175{
176	unsigned long debugctl;
177
178	/*
179	 * Ensure irq/preemption can't change debugctl in between.
180	 * Note also that both TIF_BLOCKSTEP and debugctl should
181	 * be changed atomically wrt preemption.
182	 *
183	 * NOTE: this means that set/clear TIF_BLOCKSTEP is only safe if
184	 * task is current or it can't be running, otherwise we can race
185	 * with __switch_to_xtra(). We rely on ptrace_freeze_traced().
186	 */
187	local_irq_disable();
188	debugctl = get_debugctlmsr();
189	if (on) {
190		debugctl |= DEBUGCTLMSR_BTF;
191		set_tsk_thread_flag(task, TIF_BLOCKSTEP);
192	} else {
193		debugctl &= ~DEBUGCTLMSR_BTF;
194		clear_tsk_thread_flag(task, TIF_BLOCKSTEP);
195	}
196	if (task == current)
197		update_debugctlmsr(debugctl);
198	local_irq_enable();
199}
200
201/*
202 * Enable single or block step.
203 */
204static void enable_step(struct task_struct *child, bool block)
205{
206	/*
207	 * Make sure block stepping (BTF) is not enabled unless it should be.
208	 * Note that we don't try to worry about any is_setting_trap_flag()
209	 * instructions after the first when using block stepping.
210	 * So no one should try to use debugger block stepping in a program
211	 * that uses user-mode single stepping itself.
212	 */
213	if (enable_single_step(child) && block)
214		set_task_blockstep(child, true);
215	else if (test_tsk_thread_flag(child, TIF_BLOCKSTEP))
216		set_task_blockstep(child, false);
 
 
 
 
 
 
 
 
 
217}
218
219void user_enable_single_step(struct task_struct *child)
220{
221	enable_step(child, 0);
222}
223
224void user_enable_block_step(struct task_struct *child)
225{
226	enable_step(child, 1);
227}
228
229void user_disable_single_step(struct task_struct *child)
230{
231	/*
232	 * Make sure block stepping (BTF) is disabled.
233	 */
234	if (test_tsk_thread_flag(child, TIF_BLOCKSTEP))
235		set_task_blockstep(child, false);
 
 
 
 
 
236
237	/* Always clear TIF_SINGLESTEP... */
238	clear_tsk_thread_flag(child, TIF_SINGLESTEP);
239	clear_task_syscall_work(child, SYSCALL_EXIT_TRAP);
240
241	/* But touch TF only if it was set by us.. */
242	if (test_and_clear_tsk_thread_flag(child, TIF_FORCED_TF))
243		task_pt_regs(child)->flags &= ~X86_EFLAGS_TF;
244}

 
  1/*
  2 * x86 single-step support code, common to 32-bit and 64-bit.
  3 */
  4#include <linux/sched.h>
 
  5#include <linux/mm.h>
  6#include <linux/ptrace.h>
 
  7#include <asm/desc.h>
 
 
  8
  9unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *regs)
 10{
 11	unsigned long addr, seg;
 12
 13	addr = regs->ip;
 14	seg = regs->cs & 0xffff;
 15	if (v8086_mode(regs)) {
 16		addr = (addr & 0xffff) + (seg << 4);
 17		return addr;
 18	}
 19
 
 20	/*
 21	 * We'll assume that the code segments in the GDT
 22	 * are all zero-based. That is largely true: the
 23	 * TLS segments are used for data, and the PNPBIOS
 24	 * and APM bios ones we just ignore here.
 25	 */
 26	if ((seg & SEGMENT_TI_MASK) == SEGMENT_LDT) {
 27		struct desc_struct *desc;
 28		unsigned long base;
 29
 30		seg &= ~7UL;
 31
 32		mutex_lock(&child->mm->context.lock);
 33		if (unlikely((seg >> 3) >= child->mm->context.size))
 
 34			addr = -1L; /* bogus selector, access would fault */
 35		else {
 36			desc = child->mm->context.ldt + seg;
 37			base = get_desc_base(desc);
 38
 39			/* 16-bit code segment? */
 40			if (!desc->d)
 41				addr &= 0xffff;
 42			addr += base;
 43		}
 44		mutex_unlock(&child->mm->context.lock);
 45	}
 
 46
 47	return addr;
 48}
 49
 50static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
 51{
 52	int i, copied;
 53	unsigned char opcode[15];
 54	unsigned long addr = convert_ip_to_linear(child, regs);
 55
 56	copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
 
 57	for (i = 0; i < copied; i++) {
 58		switch (opcode[i]) {
 59		/* popf and iret */
 60		case 0x9d: case 0xcf:
 61			return 1;
 62
 63			/* CHECKME: 64 65 */
 64
 65		/* opcode and address size prefixes */
 66		case 0x66: case 0x67:
 67			continue;
 68		/* irrelevant prefixes (segment overrides and repeats) */
 69		case 0x26: case 0x2e:
 70		case 0x36: case 0x3e:
 71		case 0x64: case 0x65:
 72		case 0xf0: case 0xf2: case 0xf3:
 73			continue;
 74
 75#ifdef CONFIG_X86_64
 76		case 0x40 ... 0x4f:
 77			if (!user_64bit_mode(regs))
 78				/* 32-bit mode: register increment */
 79				return 0;
 80			/* 64-bit mode: REX prefix */
 81			continue;
 82#endif
 83
 84			/* CHECKME: f2, f3 */
 85
 86		/*
 87		 * pushf: NOTE! We should probably not let
 88		 * the user see the TF bit being set. But
 89		 * it's more pain than it's worth to avoid
 90		 * it, and a debugger could emulate this
 91		 * all in user space if it _really_ cares.
 92		 */
 93		case 0x9c:
 94		default:
 95			return 0;
 96		}
 97	}
 98	return 0;
 99}
100
101/*
102 * Enable single-stepping.  Return nonzero if user mode is not using TF itself.
103 */
104static int enable_single_step(struct task_struct *child)
105{
106	struct pt_regs *regs = task_pt_regs(child);
107	unsigned long oflags;
108
109	/*
110	 * If we stepped into a sysenter/syscall insn, it trapped in
111	 * kernel mode; do_debug() cleared TF and set TIF_SINGLESTEP.
112	 * If user-mode had set TF itself, then it's still clear from
113	 * do_debug() and we need to set it again to restore the user
114	 * state so we don't wrongly set TIF_FORCED_TF below.
115	 * If enable_single_step() was used last and that is what
116	 * set TIF_SINGLESTEP, then both TF and TIF_FORCED_TF are
117	 * already set and our bookkeeping is fine.
118	 */
119	if (unlikely(test_tsk_thread_flag(child, TIF_SINGLESTEP)))
120		regs->flags |= X86_EFLAGS_TF;
121
122	/*
123	 * Always set TIF_SINGLESTEP - this guarantees that
124	 * we single-step system calls etc..  This will also
125	 * cause us to set TF when returning to user mode.
126	 */
127	set_tsk_thread_flag(child, TIF_SINGLESTEP);
128
 
 
 
 
 
 
129	oflags = regs->flags;
130
131	/* Set TF on the kernel stack.. */
132	regs->flags |= X86_EFLAGS_TF;
133
134	/*
135	 * ..but if TF is changed by the instruction we will trace,
136	 * don't mark it as being "us" that set it, so that we
137	 * won't clear it by hand later.
138	 *
139	 * Note that if we don't actually execute the popf because
140	 * of a signal arriving right now or suchlike, we will lose
141	 * track of the fact that it really was "us" that set it.
142	 */
143	if (is_setting_trap_flag(child, regs)) {
144		clear_tsk_thread_flag(child, TIF_FORCED_TF);
145		return 0;
146	}
147
148	/*
149	 * If TF was already set, check whether it was us who set it.
150	 * If not, we should never attempt a block step.
151	 */
152	if (oflags & X86_EFLAGS_TF)
153		return test_tsk_thread_flag(child, TIF_FORCED_TF);
154
155	set_tsk_thread_flag(child, TIF_FORCED_TF);
156
157	return 1;
158}
159
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
160/*
161 * Enable single or block step.
162 */
163static void enable_step(struct task_struct *child, bool block)
164{
165	/*
166	 * Make sure block stepping (BTF) is not enabled unless it should be.
167	 * Note that we don't try to worry about any is_setting_trap_flag()
168	 * instructions after the first when using block stepping.
169	 * So no one should try to use debugger block stepping in a program
170	 * that uses user-mode single stepping itself.
171	 */
172	if (enable_single_step(child) && block) {
173		unsigned long debugctl = get_debugctlmsr();
174
175		debugctl |= DEBUGCTLMSR_BTF;
176		update_debugctlmsr(debugctl);
177		set_tsk_thread_flag(child, TIF_BLOCKSTEP);
178	} else if (test_tsk_thread_flag(child, TIF_BLOCKSTEP)) {
179		unsigned long debugctl = get_debugctlmsr();
180
181		debugctl &= ~DEBUGCTLMSR_BTF;
182		update_debugctlmsr(debugctl);
183		clear_tsk_thread_flag(child, TIF_BLOCKSTEP);
184	}
185}
186
187void user_enable_single_step(struct task_struct *child)
188{
189	enable_step(child, 0);
190}
191
192void user_enable_block_step(struct task_struct *child)
193{
194	enable_step(child, 1);
195}
196
197void user_disable_single_step(struct task_struct *child)
198{
199	/*
200	 * Make sure block stepping (BTF) is disabled.
201	 */
202	if (test_tsk_thread_flag(child, TIF_BLOCKSTEP)) {
203		unsigned long debugctl = get_debugctlmsr();
204
205		debugctl &= ~DEBUGCTLMSR_BTF;
206		update_debugctlmsr(debugctl);
207		clear_tsk_thread_flag(child, TIF_BLOCKSTEP);
208	}
209
210	/* Always clear TIF_SINGLESTEP... */
211	clear_tsk_thread_flag(child, TIF_SINGLESTEP);
 
212
213	/* But touch TF only if it was set by us.. */
214	if (test_and_clear_tsk_thread_flag(child, TIF_FORCED_TF))
215		task_pt_regs(child)->flags &= ~X86_EFLAGS_TF;
216}