linux-kernel - Re: [PATCH 3/4] arm64: kgdb: Fix single-stepping into the irq handler wrongly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAD=FV=Xkhs6eivpp7+r0qyfgbBgpSiHpwNY8o=JDBwYSBWadJA@mail.gmail.com>
Date:   Wed, 13 May 2020 17:21:58 -0700
From:   Doug Anderson <dianders@...omium.org>
To:     Wei Li <liwei391@...wei.com>
Cc:     Daniel Thompson <daniel.thompson@...aro.org>,
        Jason Wessel <jason.wessel@...driver.com>,
        Marc Zyngier <maz@...nel.org>,
        Mark Rutland <mark.rutland@....com>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        David Miller <davem@...emloft.net>,
        Will Deacon <will@...nel.org>,
        Catalin Marinas <catalin.marinas@....com>,
        Linux ARM <linux-arm-kernel@...ts.infradead.org>,
        LKML <linux-kernel@...r.kernel.org>, liwei1412@....com
Subject: Re: [PATCH 3/4] arm64: kgdb: Fix single-stepping into the irq handler wrongly

Hi,

On Sat, May 9, 2020 at 6:49 AM Wei Li <liwei391@...wei.com> wrote:
>
> After the single-step exception handling oops is fixed, when we execute
> single-step in kdb/kgdb, we may see it jumps to the irq_handler (where
> PSTATE.D is cleared) instead of the next instruction.
>
> Add the prepare and cleanup work for single-step when enabling and
> disabling to maintain the PSTATE.I and PSTATE.D carefully.
>
> Before this patch:
> * kdb:
> Entering kdb (current=0xffff8000119e2dc0, pid 0) on processor 0 due to Keyboard Entry
> [0]kdb> bp printk
> Instruction(i) BP #0 at 0xffff8000101486cc (printk)
>     is enabled   addr at ffff8000101486cc, hardtype=0 installed=0
>
> [0]kdb> g
>
> / # echo h > /proc/sysrq-trigger
>
> Entering kdb (current=0xffff0000fada65c0, pid 267) on processor 0 due to Breakpoint @ 0xffff8000101486cc
> [0]kdb> ss
>
> Entering kdb (current=0xffff0000fada65c0, pid 267) on processor 0 due to SS trap @ 0xffff800010082ab8
> [0]kdb> 0xffff800010082ab8
> 0xffff800010082ab8 = 0xffff800010082ab8 (el1_irq+0x78)
> [0]kdb>
>
>    0xffff800010082ab0 <+112>:   nop
>    0xffff800010082ab4 <+116>:   msr     daifclr, #0xd
>    0xffff800010082ab8 <+120>:   adrp    x1, 0xffff8000113a7000 <cpu_ops+1288>
>    0xffff800010082abc <+124>:   ldr     x1, [x1, #1408]
>
> * kgdb:
> (gdb) target remote 127.1:23002
> Remote debugging using 127.1:23002
> arch_kgdb_breakpoint () at /home/liwei/main_code/linux/arch/arm64/include/asm/kgdb.h:21
> 21              asm ("brk %0" : : "I" (KGDB_COMPILED_DBG_BRK_IMM));
> (gdb) b printk
> Breakpoint 1 at 0xffff8000101486cc: file /home/liwei/main_code/linux/kernel/printk/printk.c, line 2076.
> (gdb) c
> Continuing.
> [New Thread 287]
> [Switching to Thread 283]
>
> Thread 177 hit Breakpoint 1, printk (fmt=0xffff80001130c9d8 "\001\066sysrq: HELP : ")
>     at /home/liwei/main_code/linux/kernel/printk/printk.c:2076
> 2076    {
> (gdb) stepi
> el1_irq () at /home/liwei/main_code/linux/arch/arm64/kernel/entry.S:608
> 608             irq_handler
> (gdb)
>
> After this patch:
> * kdb:
> Entering kdb (current=0xffff8000119d2dc0, pid 0) on processor 0 due to Keyboard Entry
> [0]kdb> bp printk
> Instruction(i) BP #0 at 0xffff80001014874c (printk)
>     is enabled   addr at ffff80001014874c, hardtype=0 installed=0
>
> [0]kdb> g
>
> / # echo h > /proc/sysrq-trigger
>
> Entering kdb (current=0xffff0000fa6948c0, pid 265) on processor 0 due to Breakpoint @ 0xffff80001014874c
> [0]kdb> ss
>
> Entering kdb (current=0xffff0000fa6948c0, pid 265) on processor 0 due to SS trap @ 0xffff800010148750
> [0]kdb>
>
> * kgdb:
> (gdb) target remote 127.1:23002
> Remote debugging using 127.1:23002
> arch_kgdb_breakpoint () at /home/liwei/main_code/linux/arch/arm64/include/asm/kgdb.h:21
> 21              asm ("brk %0" : : "I" (KGDB_COMPILED_DBG_BRK_IMM));
> (gdb) b printk
> Breakpoint 1 at 0xffff80001014874c: file /home/liwei/main_code/linux/kernel/printk/printk.c, line 2076.
> (gdb) c
> Continuing.
> [New Thread 277]
> [Switching to Thread 276]
>
> Thread 171 hit Breakpoint 1, printk (fmt=0xffff8000112fc130 "\001\066sysrq: HELP : ")
>     at /home/liwei/main_code/linux/kernel/printk/printk.c:2076
> 2076    {
> (gdb) stepi
> 0xffff800010148750      2076    {
> (gdb)
>
> Fixes: 44679a4f142b ("arm64: KGDB: Add step debugging support")
> Signed-off-by: Wei Li <liwei391@...wei.com>
> ---
>  arch/arm64/kernel/kgdb.c | 13 +++++++++++--
>  1 file changed, 11 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c
> index 1a157ca33262..3910ac06c261 100644
> --- a/arch/arm64/kernel/kgdb.c
> +++ b/arch/arm64/kernel/kgdb.c
> @@ -100,6 +100,8 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
>         { "fpcr", 4, -1 },
>  };
>
> +static DEFINE_PER_CPU(unsigned long, kgdb_ss_flags);
> +
>  char *dbg_get_reg(int regno, void *mem, struct pt_regs *regs)
>  {
>         if (regno >= DBG_MAX_REG_NUM || regno < 0)
> @@ -200,8 +202,11 @@ int kgdb_arch_handle_exception(int exception_vector, int signo,
>                 /*
>                  * Received continue command, disable single step
>                  */
> -               if (kernel_active_single_step())
> +               if (kernel_active_single_step()) {
> +                       kernel_cleanup_single_step(per_cpu(kgdb_ss_flags,
> +                                       raw_smp_processor_id()), linux_regs);

I don't think you need the raw_ version of smp_processor_id(), do you?


-Doug