lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <1612782447-3728-1-git-send-email-yangtiezhu@loongson.cn>
Date:   Mon,  8 Feb 2021 19:07:27 +0800
From:   Tiezhu Yang <yangtiezhu@...ngson.cn>
To:     Thomas Bogendoerfer <tsbogend@...ha.franken.de>,
        Oleg Nesterov <oleg@...hat.com>
Cc:     linux-mips@...r.kernel.org, linux-kernel@...r.kernel.org,
        Xuefeng Li <lixuefeng@...ngson.cn>,
        Xingxing Su <suxingxing@...ngson.cn>
Subject: [PATCH] MIPS: Add basic support for ptrace single step

In the current code, arch_has_single_step() is not defined on MIPS,
that means MIPS does not support instruction single-step for user mode.

Delve is a debugger for the Go programming language, the ptrace syscall
PtraceSingleStep() failed [1] on MIPS and then the single step function
can not work well, we can see that PtraceSingleStep() definition returns
ptrace(PTRACE_SINGLESTEP) [2].

So it is necessary to support ptrace single step on MIPS.

At the beginning, we try to use the Debug Single Step exception on the
Loongson 3A4000 platform, but it has no effect when set CP0_DEBUG SSt
bit, this is because CP0_DEBUG NoSSt bit is 1 which indicates no
single-step feature available [3], so this way which is dependent on the
hardware is almost impossible.

With further research, we find out there exists a common way used with
break instruction in arch/alpha/kernel/ptrace.c, it is workable.

For the above analysis, define arch_has_single_step(), add the common
function user_enable_single_step() and user_disable_single_step(), set
flag TIF_SINGLESTEP for child process, use break instruction to set
breakpoint.

We can use the following testcase to test it:
tools/testing/selftests/breakpoints/step_after_suspend_test.c

 $ make -C tools/testing/selftests TARGETS=breakpoints
 $ cd tools/testing/selftests/breakpoints

Without this patch:

 $ ./step_after_suspend_test -n
 TAP version 13
 1..4
 # ptrace(PTRACE_SINGLESTEP) not supported on this architecture: Input/output error
 ok 1 # SKIP CPU 0
 # ptrace(PTRACE_SINGLESTEP) not supported on this architecture: Input/output error
 ok 2 # SKIP CPU 1
 # ptrace(PTRACE_SINGLESTEP) not supported on this architecture: Input/output error
 ok 3 # SKIP CPU 2
 # ptrace(PTRACE_SINGLESTEP) not supported on this architecture: Input/output error
 ok 4 # SKIP CPU 3
 # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:4 error:0

With this patch:

 $ ./step_after_suspend_test -n
 TAP version 13
 1..4
 ok 1 CPU 0
 ok 2 CPU 1
 ok 3 CPU 2
 ok 4 CPU 3
 # Totals: pass:4 fail:0 xfail:0 xpass:0 skip:0 error:0

[1] https://github.com/go-delve/delve/blob/master/pkg/proc/native/threads_linux.go#L50
[2] https://github.com/go-delve/delve/blob/master/vendor/golang.org/x/sys/unix/syscall_linux.go#L1573
[3] http://www.t-es-t.hu/download/mips/md00047f.pdf

Reported-by: Guoqi Chen <chenguoqi@...ngson.cn>
Signed-off-by: Xingxing Su <suxingxing@...ngson.cn>
Signed-off-by: Tiezhu Yang <yangtiezhu@...ngson.cn>
---
 arch/mips/include/asm/ptrace.h      |   2 +
 arch/mips/include/asm/thread_info.h |   5 ++
 arch/mips/kernel/ptrace.c           | 108 ++++++++++++++++++++++++++++++++++++
 arch/mips/kernel/signal.c           |   2 +-
 4 files changed, 116 insertions(+), 1 deletion(-)

diff --git a/arch/mips/include/asm/ptrace.h b/arch/mips/include/asm/ptrace.h
index daf3cf2..c733daef 100644
--- a/arch/mips/include/asm/ptrace.h
+++ b/arch/mips/include/asm/ptrace.h
@@ -186,4 +186,6 @@ static inline void user_stack_pointer_set(struct pt_regs *regs,
 	regs->regs[29] = val;
 }
 
+#define arch_has_single_step()	(1)
+
 #endif /* _ASM_PTRACE_H */
diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
index e2c352d..bd4dbb5 100644
--- a/arch/mips/include/asm/thread_info.h
+++ b/arch/mips/include/asm/thread_info.h
@@ -35,6 +35,10 @@ struct thread_info {
 						 */
 	struct pt_regs		*regs;
 	long			syscall;	/* syscall number */
+
+	int bpt_nsaved;
+	unsigned long bpt_addr[1];		/* breakpoint handling */
+	unsigned int bpt_insn[1];
 };
 
 /*
@@ -117,6 +121,7 @@ static inline struct thread_info *current_thread_info(void)
 #define TIF_UPROBE		6	/* breakpointed or singlestepping */
 #define TIF_NOTIFY_SIGNAL	7	/* signal notifications exist */
 #define TIF_RESTORE_SIGMASK	9	/* restore signal mask in do_signal() */
+#define TIF_SINGLESTEP		10	/* restore singlestep on return to user mode */
 #define TIF_USEDFPU		16	/* FPU was used by this task this quantum (SMP) */
 #define TIF_MEMDIE		18	/* is terminating due to OOM killer */
 #define TIF_NOHZ		19	/* in adaptive nohz mode */
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index db7c5be..1c06523 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -45,10 +45,15 @@
 #include <linux/uaccess.h>
 #include <asm/bootinfo.h>
 #include <asm/reg.h>
+#include <asm/branch.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/syscalls.h>
 
+#include "probes-common.h"
+
+#define BREAKINST	0x0000000d
+
 /*
  * Called by kernel/ptrace.c when detaching..
  *
@@ -58,6 +63,7 @@ void ptrace_disable(struct task_struct *child)
 {
 	/* Don't load the watchpoint registers for the ex-child. */
 	clear_tsk_thread_flag(child, TIF_LOAD_WATCH);
+	user_disable_single_step(child);
 }
 
 /*
@@ -1072,6 +1078,108 @@ const struct user_regset_view *task_user_regset_view(struct task_struct *task)
 #endif
 }
 
+static int read_insn(struct task_struct *task, unsigned long addr, unsigned int *insn)
+{
+	int copied = access_process_vm(task, addr, insn,
+				       sizeof(unsigned int), FOLL_FORCE);
+
+	if (copied != sizeof(unsigned int)) {
+		pr_err("failed to read instruction from 0x%lx\n", addr);
+		return -EIO;
+	}
+
+	return 0;
+}
+
+static int write_insn(struct task_struct *task, unsigned long addr, unsigned int insn)
+{
+	int copied = access_process_vm(task, addr, &insn,
+				       sizeof(unsigned int), FOLL_FORCE | FOLL_WRITE);
+
+	if (copied != sizeof(unsigned int)) {
+		pr_err("failed to write instruction to 0x%lx\n", addr);
+		return -EIO;
+	}
+
+	return 0;
+}
+
+static int insn_has_delayslot(union mips_instruction insn)
+{
+	return __insn_has_delay_slot(insn);
+}
+
+static void ptrace_set_bpt(struct task_struct *child)
+{
+	union mips_instruction mips_insn;
+	struct pt_regs *regs;
+	unsigned long pc;
+	unsigned int insn;
+	int i, ret, nsaved = 0;
+
+	regs = task_pt_regs(child);
+	pc = regs->cp0_epc;
+
+	ret = read_insn(child, pc, &insn);
+	if (ret < 0)
+		return;
+
+	if (insn_has_delayslot(mips_insn)) {
+		pr_info("executing branch insn\n");
+		ret = __compute_return_epc(regs);
+		if (ret < 0)
+			return;
+		task_thread_info(child)->bpt_addr[nsaved++] = regs->cp0_epc;
+	} else {
+		pr_info("executing normal insn\n");
+		task_thread_info(child)->bpt_addr[nsaved++] = pc + 4;
+	}
+
+	/* install breakpoints */
+	for (i = 0; i < nsaved; i++) {
+		ret = read_insn(child, task_thread_info(child)->bpt_addr[i], &insn);
+		if (ret < 0)
+			return;
+
+		task_thread_info(child)->bpt_insn[i] = insn;
+
+		ret = write_insn(child, task_thread_info(child)->bpt_addr[i], BREAKINST);
+		if (ret < 0)
+			return;
+	}
+
+	task_thread_info(child)->bpt_nsaved = nsaved;
+}
+
+static void ptrace_cancel_bpt(struct task_struct *child)
+{
+	int i, nsaved = task_thread_info(child)->bpt_nsaved;
+
+	task_thread_info(child)->bpt_nsaved = 0;
+
+	if (nsaved > 1) {
+		pr_info("%s: bogus nsaved: %d!\n", __func__, nsaved);
+		nsaved = 1;
+	}
+
+	for (i = 0; i < nsaved; i++) {
+		write_insn(child, task_thread_info(child)->bpt_addr[i],
+			  task_thread_info(child)->bpt_insn[i]);
+	}
+}
+
+void user_enable_single_step(struct task_struct *child)
+{
+	set_tsk_thread_flag(child, TIF_SINGLESTEP);
+	ptrace_set_bpt(child);
+}
+
+void user_disable_single_step(struct task_struct *child)
+{
+	clear_tsk_thread_flag(child, TIF_SINGLESTEP);
+	ptrace_cancel_bpt(child);
+}
+
 long arch_ptrace(struct task_struct *child, long request,
 		 unsigned long addr, unsigned long data)
 {
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index f1e9851..82d11d8 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -849,7 +849,7 @@ static void handle_signal(struct ksignal *ksig, struct pt_regs *regs)
 		ret = abi->setup_frame(vdso + abi->vdso->off_sigreturn,
 				       ksig, regs, oldset);
 
-	signal_setup_done(ret, ksig, 0);
+	signal_setup_done(ret, ksig, test_thread_flag(TIF_SINGLESTEP));
 }
 
 static void do_signal(struct pt_regs *regs)
-- 
2.1.0

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ