• Masami Hiramatsu's avatar
    arm64: kprobes: Recover pstate.D in single-step exception handler · b3980e48
    Masami Hiramatsu authored
    kprobes manipulates the interrupted PSTATE for single step, and
    doesn't restore it. Thus, if we put a kprobe where the pstate.D
    (debug) masked, the mask will be cleared after the kprobe hits.
    
    Moreover, in the most complicated case, this can lead a kernel
    crash with below message when a nested kprobe hits.
    
    [  152.118921] Unexpected kernel single-step exception at EL1
    
    When the 1st kprobe hits, do_debug_exception() will be called.
    At this point, debug exception (= pstate.D) must be masked (=1).
    But if another kprobes hits before single-step of the first kprobe
    (e.g. inside user pre_handler), it unmask the debug exception
    (pstate.D = 0) and return.
    Then, when the 1st kprobe setting up single-step, it saves current
    DAIF, mask DAIF, enable single-step, and restore DAIF.
    However, since "D" flag in DAIF is cleared by the 2nd kprobe, the
    single-step exception happens soon after restoring DAIF.
    
    This has been introduced by commit 7419333f ("arm64: kprobe:
    Always clear pstate.D in breakpoint exception handler")
    
    To solve this issue, this stores all DAIF bits and restore it
    after single stepping.
    Reported-by: default avatarNaresh Kamboju <naresh.kamboju@linaro.org>
    Fixes: 7419333f ("arm64: kprobe: Always clear pstate.D in breakpoint exception handler")
    Reviewed-by: default avatarJames Morse <james.morse@arm.com>
    Tested-by: default avatarJames Morse <james.morse@arm.com>
    Signed-off-by: default avatarMasami Hiramatsu <mhiramat@kernel.org>
    Signed-off-by: default avatarWill Deacon <will@kernel.org>
    b3980e48
daifflags.h 2.64 KB