Skip to contentSkip to conversation

arm64/hw_breakpoint: trigger breakpoint exception infinitely

BUG Li Bin 2 participants 3 messages Apr 26, 2016 – Apr 27, 2016

lore
Share & tools
lore

Li Bin

author
#0 lore raw

This bug can be reproduced by compiling the hw_breakpoint sample module that is in the kernel tree, when loading it with parameter ksym=nfsdstats, and running nfsstat:

$ insmod data_breakpoint.ko ksym=nfsdstats
$ nfsstat

It will trigger breakpoint exception infinitely:

nfsdstats value is changed
...

Call trace:

...
Dump stack from sample_hbp_handler
nfsdstats value is changed
...

Call trace:

...
Dump stack from sample_hbp_handler
......
......

This is because that the overflow_handler is set to the callback in the module, and in watchpoint_handler, it will not disable the breakpoint (and set single step that reenable it), so when exception return, it will trigger the breakpoint exception again immediately...

Li Bin

#1 lore raw
Quoted 22 lines · Li Bin

This bug can be reproduced by compiling the hw_breakpoint sample module that is in the kernel tree, when loading it with parameter ksym=nfsdstats, and running nfsstat:

$ insmod data_breakpoint.ko ksym=nfsdstats
$ nfsstat

It will trigger breakpoint exception infinitely:

nfsdstats value is changed
...

Call trace:

...
Dump stack from sample_hbp_handler
nfsdstats value is changed
...

Call trace:

...
Dump stack from sample_hbp_handler
......
......

Quoted 4 lines

This is because that the overflow_handler is set to the callback in the module, and in watchpoint_handler, it will not disable the breakpoint (and set single step that reenable it), so when exception return, it will trigger the breakpoint exception again immediately...

As I explained before, GDB/ptrace *relies* on this behaviour. If you register an breakpoint overflow handler on arm64, then you need to handle the step.

Will

author
#2 lore raw
Quoted 23 lines · Will Deacon
Quoted 22 lines · Li Bin

This bug can be reproduced by compiling the hw_breakpoint sample module that is in the kernel tree, when loading it with parameter ksym=nfsdstats, and running nfsstat:

$ insmod data_breakpoint.ko ksym=nfsdstats
$ nfsstat

It will trigger breakpoint exception infinitely:

nfsdstats value is changed
...

Call trace:

...
Dump stack from sample_hbp_handler
nfsdstats value is changed
...

Call trace:

...
Dump stack from sample_hbp_handler
......
......

Quoted 8 lines
Quoted 4 lines

This is because that the overflow_handler is set to the callback in the module, and in watchpoint_handler, it will not disable the breakpoint (and set single step that reenable it), so when exception return, it will trigger the breakpoint exception again immediately...

As I explained before, GDB/ptrace *relies* on this behaviour. If you register an breakpoint overflow handler on arm64, then you need to handle the step.

So it is a bug of samples/hw_breakpoint/data_breakpoint.c for arm64. Should we fix it (may need to change the kernel code), or disable it for arm64?

Thanks,
Li Bin

Quoted 5 lines

Will

.