mirror of
https://github.com/torvalds/linux.git
synced 2024-12-24 11:51:27 +00:00
b3980e4852
kprobes manipulates the interrupted PSTATE for single step, and doesn't restore it. Thus, if we put a kprobe where the pstate.D (debug) masked, the mask will be cleared after the kprobe hits. Moreover, in the most complicated case, this can lead a kernel crash with below message when a nested kprobe hits. [ 152.118921] Unexpected kernel single-step exception at EL1 When the 1st kprobe hits, do_debug_exception() will be called. At this point, debug exception (= pstate.D) must be masked (=1). But if another kprobes hits before single-step of the first kprobe (e.g. inside user pre_handler), it unmask the debug exception (pstate.D = 0) and return. Then, when the 1st kprobe setting up single-step, it saves current DAIF, mask DAIF, enable single-step, and restore DAIF. However, since "D" flag in DAIF is cleared by the 2nd kprobe, the single-step exception happens soon after restoring DAIF. This has been introduced by commit7419333fa1("arm64: kprobe: Always clear pstate.D in breakpoint exception handler") To solve this issue, this stores all DAIF bits and restore it after single stepping. Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org> Fixes:7419333fa1("arm64: kprobe: Always clear pstate.D in breakpoint exception handler") Reviewed-by: James Morse <james.morse@arm.com> Tested-by: James Morse <james.morse@arm.com> Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> Signed-off-by: Will Deacon <will@kernel.org>
113 lines
2.6 KiB
C
113 lines
2.6 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/*
|
|
* Copyright (C) 2017 ARM Ltd.
|
|
*/
|
|
#ifndef __ASM_DAIFFLAGS_H
|
|
#define __ASM_DAIFFLAGS_H
|
|
|
|
#include <linux/irqflags.h>
|
|
|
|
#include <asm/arch_gicv3.h>
|
|
#include <asm/cpufeature.h>
|
|
|
|
#define DAIF_PROCCTX 0
|
|
#define DAIF_PROCCTX_NOIRQ PSR_I_BIT
|
|
#define DAIF_ERRCTX (PSR_I_BIT | PSR_A_BIT)
|
|
#define DAIF_MASK (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT)
|
|
|
|
|
|
/* mask/save/unmask/restore all exceptions, including interrupts. */
|
|
static inline void local_daif_mask(void)
|
|
{
|
|
WARN_ON(system_has_prio_mask_debugging() &&
|
|
(read_sysreg_s(SYS_ICC_PMR_EL1) == (GIC_PRIO_IRQOFF |
|
|
GIC_PRIO_PSR_I_SET)));
|
|
|
|
asm volatile(
|
|
"msr daifset, #0xf // local_daif_mask\n"
|
|
:
|
|
:
|
|
: "memory");
|
|
|
|
/* Don't really care for a dsb here, we don't intend to enable IRQs */
|
|
if (system_uses_irq_prio_masking())
|
|
gic_write_pmr(GIC_PRIO_IRQON | GIC_PRIO_PSR_I_SET);
|
|
|
|
trace_hardirqs_off();
|
|
}
|
|
|
|
static inline unsigned long local_daif_save(void)
|
|
{
|
|
unsigned long flags;
|
|
|
|
flags = read_sysreg(daif);
|
|
|
|
if (system_uses_irq_prio_masking()) {
|
|
/* If IRQs are masked with PMR, reflect it in the flags */
|
|
if (read_sysreg_s(SYS_ICC_PMR_EL1) != GIC_PRIO_IRQON)
|
|
flags |= PSR_I_BIT;
|
|
}
|
|
|
|
local_daif_mask();
|
|
|
|
return flags;
|
|
}
|
|
|
|
static inline void local_daif_restore(unsigned long flags)
|
|
{
|
|
bool irq_disabled = flags & PSR_I_BIT;
|
|
|
|
WARN_ON(system_has_prio_mask_debugging() &&
|
|
!(read_sysreg(daif) & PSR_I_BIT));
|
|
|
|
if (!irq_disabled) {
|
|
trace_hardirqs_on();
|
|
|
|
if (system_uses_irq_prio_masking()) {
|
|
gic_write_pmr(GIC_PRIO_IRQON);
|
|
dsb(sy);
|
|
}
|
|
} else if (system_uses_irq_prio_masking()) {
|
|
u64 pmr;
|
|
|
|
if (!(flags & PSR_A_BIT)) {
|
|
/*
|
|
* If interrupts are disabled but we can take
|
|
* asynchronous errors, we can take NMIs
|
|
*/
|
|
flags &= ~PSR_I_BIT;
|
|
pmr = GIC_PRIO_IRQOFF;
|
|
} else {
|
|
pmr = GIC_PRIO_IRQON | GIC_PRIO_PSR_I_SET;
|
|
}
|
|
|
|
/*
|
|
* There has been concern that the write to daif
|
|
* might be reordered before this write to PMR.
|
|
* From the ARM ARM DDI 0487D.a, section D1.7.1
|
|
* "Accessing PSTATE fields":
|
|
* Writes to the PSTATE fields have side-effects on
|
|
* various aspects of the PE operation. All of these
|
|
* side-effects are guaranteed:
|
|
* - Not to be visible to earlier instructions in
|
|
* the execution stream.
|
|
* - To be visible to later instructions in the
|
|
* execution stream
|
|
*
|
|
* Also, writes to PMR are self-synchronizing, so no
|
|
* interrupts with a lower priority than PMR is signaled
|
|
* to the PE after the write.
|
|
*
|
|
* So we don't need additional synchronization here.
|
|
*/
|
|
gic_write_pmr(pmr);
|
|
}
|
|
|
|
write_sysreg(flags, daif);
|
|
|
|
if (irq_disabled)
|
|
trace_hardirqs_off();
|
|
}
|
|
|
|
#endif
|