Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'x86-urgent-2020-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Thomas Gleixner:
"Three fixes all related to #DB:
- Handle the BTF bit correctly so it doesn't get lost due to a kernel
#DB
- Only clear and set the virtual DR6 value used by ptrace on user
space triggered #DB. A kernel #DB must leave it alone to ensure
data consistency for ptrace.
- Make the bitmasking of the virtual DR6 storage correct so it does
not lose DR_STEP"
* tag 'x86-urgent-2020-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/debug: Fix DR_STEP vs ptrace_get_debugreg(6)
x86/debug: Only clear/set ->virtual_dr6 for userspace #DB
x86/debug: Fix BTF handling
+30
-13
+30
-13
arch/x86/kernel/traps.c
+30
-13
arch/x86/kernel/traps.c
···
793
793
set_debugreg(DR6_RESERVED, 6);
794
794
dr6 ^= DR6_RESERVED; /* Flip to positive polarity */
795
795
796
-
/*
797
-
* Clear the virtual DR6 value, ptrace routines will set bits here for
798
-
* things we want signals for.
799
-
*/
800
-
current->thread.virtual_dr6 = 0;
801
-
802
-
/*
803
-
* The SDM says "The processor clears the BTF flag when it
804
-
* generates a debug exception." Clear TIF_BLOCKSTEP to keep
805
-
* TIF_BLOCKSTEP in sync with the hardware BTF flag.
806
-
*/
807
-
clear_thread_flag(TIF_BLOCKSTEP);
808
-
809
796
return dr6;
810
797
}
811
798
···
860
873
*/
861
874
WARN_ON_ONCE(user_mode(regs));
862
875
876
+
if (test_thread_flag(TIF_BLOCKSTEP)) {
877
+
/*
878
+
* The SDM says "The processor clears the BTF flag when it
879
+
* generates a debug exception." but PTRACE_BLOCKSTEP requested
880
+
* it for userspace, but we just took a kernel #DB, so re-set
881
+
* BTF.
882
+
*/
883
+
unsigned long debugctl;
884
+
885
+
rdmsrl(MSR_IA32_DEBUGCTLMSR, debugctl);
886
+
debugctl |= DEBUGCTLMSR_BTF;
887
+
wrmsrl(MSR_IA32_DEBUGCTLMSR, debugctl);
888
+
}
889
+
863
890
/*
864
891
* Catch SYSENTER with TF set and clear DR_STEP. If this hit a
865
892
* watchpoint at the same time then that will still be handled.
···
935
934
936
935
irqentry_enter_from_user_mode(regs);
937
936
instrumentation_begin();
937
+
938
+
/*
939
+
* Start the virtual/ptrace DR6 value with just the DR_STEP mask
940
+
* of the real DR6. ptrace_triggered() will set the DR_TRAPn bits.
941
+
*
942
+
* Userspace expects DR_STEP to be visible in ptrace_get_debugreg(6)
943
+
* even if it is not the result of PTRACE_SINGLESTEP.
944
+
*/
945
+
current->thread.virtual_dr6 = (dr6 & DR_STEP);
946
+
947
+
/*
948
+
* The SDM says "The processor clears the BTF flag when it
949
+
* generates a debug exception." Clear TIF_BLOCKSTEP to keep
950
+
* TIF_BLOCKSTEP in sync with the hardware BTF flag.
951
+
*/
952
+
clear_thread_flag(TIF_BLOCKSTEP);
938
953
939
954
/*
940
955
* If dr6 has no reason to give us about the origin of this trap,