1 /*
2  * ARMv8 single-step debug support and mdscr context switching.
3  *
4  * Copyright (C) 2012 ARM Limited
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License version 2 as
8  * published by the Free Software Foundation.
9  *
10  * This program is distributed in the hope that it will be useful,
11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13  * GNU General Public License for more details.
14  *
15  * You should have received a copy of the GNU General Public License
16  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
17  *
18  * Author: Will Deacon <will.deacon@arm.com>
19  */
20 
21 #include <linux/cpu.h>
22 #include <linux/debugfs.h>
23 #include <linux/hardirq.h>
24 #include <linux/init.h>
25 #include <linux/ptrace.h>
26 #include <linux/kprobes.h>
27 #include <linux/stat.h>
28 #include <linux/uaccess.h>
29 #include <linux/sched/task_stack.h>
30 
31 #include <asm/cpufeature.h>
32 #include <asm/cputype.h>
33 #include <asm/debug-monitors.h>
34 #include <asm/system_misc.h>
35 
36 /* Determine debug architecture. */
37 u8 debug_monitors_arch(void)
38 {
39 	return cpuid_feature_extract_unsigned_field(read_sanitised_ftr_reg(SYS_ID_AA64DFR0_EL1),
40 						ID_AA64DFR0_DEBUGVER_SHIFT);
41 }
42 
43 /*
44  * MDSCR access routines.
45  */
46 static void mdscr_write(u32 mdscr)
47 {
48 	unsigned long flags;
49 	local_dbg_save(flags);
50 	write_sysreg(mdscr, mdscr_el1);
51 	local_dbg_restore(flags);
52 }
53 NOKPROBE_SYMBOL(mdscr_write);
54 
55 static u32 mdscr_read(void)
56 {
57 	return read_sysreg(mdscr_el1);
58 }
59 NOKPROBE_SYMBOL(mdscr_read);
60 
61 /*
62  * Allow root to disable self-hosted debug from userspace.
63  * This is useful if you want to connect an external JTAG debugger.
64  */
65 static bool debug_enabled = true;
66 
67 static int create_debug_debugfs_entry(void)
68 {
69 	debugfs_create_bool("debug_enabled", 0644, NULL, &debug_enabled);
70 	return 0;
71 }
72 fs_initcall(create_debug_debugfs_entry);
73 
74 static int __init early_debug_disable(char *buf)
75 {
76 	debug_enabled = false;
77 	return 0;
78 }
79 
80 early_param("nodebugmon", early_debug_disable);
81 
82 /*
83  * Keep track of debug users on each core.
84  * The ref counts are per-cpu so we use a local_t type.
85  */
86 static DEFINE_PER_CPU(int, mde_ref_count);
87 static DEFINE_PER_CPU(int, kde_ref_count);
88 
89 void enable_debug_monitors(enum dbg_active_el el)
90 {
91 	u32 mdscr, enable = 0;
92 
93 	WARN_ON(preemptible());
94 
95 	if (this_cpu_inc_return(mde_ref_count) == 1)
96 		enable = DBG_MDSCR_MDE;
97 
98 	if (el == DBG_ACTIVE_EL1 &&
99 	    this_cpu_inc_return(kde_ref_count) == 1)
100 		enable |= DBG_MDSCR_KDE;
101 
102 	if (enable && debug_enabled) {
103 		mdscr = mdscr_read();
104 		mdscr |= enable;
105 		mdscr_write(mdscr);
106 	}
107 }
108 NOKPROBE_SYMBOL(enable_debug_monitors);
109 
110 void disable_debug_monitors(enum dbg_active_el el)
111 {
112 	u32 mdscr, disable = 0;
113 
114 	WARN_ON(preemptible());
115 
116 	if (this_cpu_dec_return(mde_ref_count) == 0)
117 		disable = ~DBG_MDSCR_MDE;
118 
119 	if (el == DBG_ACTIVE_EL1 &&
120 	    this_cpu_dec_return(kde_ref_count) == 0)
121 		disable &= ~DBG_MDSCR_KDE;
122 
123 	if (disable) {
124 		mdscr = mdscr_read();
125 		mdscr &= disable;
126 		mdscr_write(mdscr);
127 	}
128 }
129 NOKPROBE_SYMBOL(disable_debug_monitors);
130 
131 /*
132  * OS lock clearing.
133  */
134 static int clear_os_lock(unsigned int cpu)
135 {
136 	write_sysreg(0, oslar_el1);
137 	isb();
138 	return 0;
139 }
140 
141 static int debug_monitors_init(void)
142 {
143 	return cpuhp_setup_state(CPUHP_AP_ARM64_DEBUG_MONITORS_STARTING,
144 				 "arm64/debug_monitors:starting",
145 				 clear_os_lock, NULL);
146 }
147 postcore_initcall(debug_monitors_init);
148 
149 /*
150  * Single step API and exception handling.
151  */
152 static void set_regs_spsr_ss(struct pt_regs *regs)
153 {
154 	regs->pstate |= DBG_SPSR_SS;
155 }
156 NOKPROBE_SYMBOL(set_regs_spsr_ss);
157 
158 static void clear_regs_spsr_ss(struct pt_regs *regs)
159 {
160 	regs->pstate &= ~DBG_SPSR_SS;
161 }
162 NOKPROBE_SYMBOL(clear_regs_spsr_ss);
163 
164 /* EL1 Single Step Handler hooks */
165 static LIST_HEAD(step_hook);
166 static DEFINE_SPINLOCK(step_hook_lock);
167 
168 void register_step_hook(struct step_hook *hook)
169 {
170 	spin_lock(&step_hook_lock);
171 	list_add_rcu(&hook->node, &step_hook);
172 	spin_unlock(&step_hook_lock);
173 }
174 
175 void unregister_step_hook(struct step_hook *hook)
176 {
177 	spin_lock(&step_hook_lock);
178 	list_del_rcu(&hook->node);
179 	spin_unlock(&step_hook_lock);
180 	synchronize_rcu();
181 }
182 
183 /*
184  * Call registered single step handlers
185  * There is no Syndrome info to check for determining the handler.
186  * So we call all the registered handlers, until the right handler is
187  * found which returns zero.
188  */
189 static int call_step_hook(struct pt_regs *regs, unsigned int esr)
190 {
191 	struct step_hook *hook;
192 	int retval = DBG_HOOK_ERROR;
193 
194 	rcu_read_lock();
195 
196 	list_for_each_entry_rcu(hook, &step_hook, node)	{
197 		retval = hook->fn(regs, esr);
198 		if (retval == DBG_HOOK_HANDLED)
199 			break;
200 	}
201 
202 	rcu_read_unlock();
203 
204 	return retval;
205 }
206 NOKPROBE_SYMBOL(call_step_hook);
207 
208 static void send_user_sigtrap(int si_code)
209 {
210 	struct pt_regs *regs = current_pt_regs();
211 	siginfo_t info = {
212 		.si_signo	= SIGTRAP,
213 		.si_errno	= 0,
214 		.si_code	= si_code,
215 		.si_addr	= (void __user *)instruction_pointer(regs),
216 	};
217 
218 	if (WARN_ON(!user_mode(regs)))
219 		return;
220 
221 	if (interrupts_enabled(regs))
222 		local_irq_enable();
223 
224 	force_sig_info(SIGTRAP, &info, current);
225 }
226 
227 static int single_step_handler(unsigned long addr, unsigned int esr,
228 			       struct pt_regs *regs)
229 {
230 	bool handler_found = false;
231 
232 	/*
233 	 * If we are stepping a pending breakpoint, call the hw_breakpoint
234 	 * handler first.
235 	 */
236 	if (!reinstall_suspended_bps(regs))
237 		return 0;
238 
239 #ifdef	CONFIG_KPROBES
240 	if (kprobe_single_step_handler(regs, esr) == DBG_HOOK_HANDLED)
241 		handler_found = true;
242 #endif
243 	if (!handler_found && call_step_hook(regs, esr) == DBG_HOOK_HANDLED)
244 		handler_found = true;
245 
246 	if (!handler_found && user_mode(regs)) {
247 		send_user_sigtrap(TRAP_TRACE);
248 
249 		/*
250 		 * ptrace will disable single step unless explicitly
251 		 * asked to re-enable it. For other clients, it makes
252 		 * sense to leave it enabled (i.e. rewind the controls
253 		 * to the active-not-pending state).
254 		 */
255 		user_rewind_single_step(current);
256 	} else if (!handler_found) {
257 		pr_warn("Unexpected kernel single-step exception at EL1\n");
258 		/*
259 		 * Re-enable stepping since we know that we will be
260 		 * returning to regs.
261 		 */
262 		set_regs_spsr_ss(regs);
263 	}
264 
265 	return 0;
266 }
267 NOKPROBE_SYMBOL(single_step_handler);
268 
269 /*
270  * Breakpoint handler is re-entrant as another breakpoint can
271  * hit within breakpoint handler, especically in kprobes.
272  * Use reader/writer locks instead of plain spinlock.
273  */
274 static LIST_HEAD(break_hook);
275 static DEFINE_SPINLOCK(break_hook_lock);
276 
277 void register_break_hook(struct break_hook *hook)
278 {
279 	spin_lock(&break_hook_lock);
280 	list_add_rcu(&hook->node, &break_hook);
281 	spin_unlock(&break_hook_lock);
282 }
283 
284 void unregister_break_hook(struct break_hook *hook)
285 {
286 	spin_lock(&break_hook_lock);
287 	list_del_rcu(&hook->node);
288 	spin_unlock(&break_hook_lock);
289 	synchronize_rcu();
290 }
291 
292 static int call_break_hook(struct pt_regs *regs, unsigned int esr)
293 {
294 	struct break_hook *hook;
295 	int (*fn)(struct pt_regs *regs, unsigned int esr) = NULL;
296 
297 	rcu_read_lock();
298 	list_for_each_entry_rcu(hook, &break_hook, node)
299 		if ((esr & hook->esr_mask) == hook->esr_val)
300 			fn = hook->fn;
301 	rcu_read_unlock();
302 
303 	return fn ? fn(regs, esr) : DBG_HOOK_ERROR;
304 }
305 NOKPROBE_SYMBOL(call_break_hook);
306 
307 static int brk_handler(unsigned long addr, unsigned int esr,
308 		       struct pt_regs *regs)
309 {
310 	bool handler_found = false;
311 
312 #ifdef	CONFIG_KPROBES
313 	if ((esr & BRK64_ESR_MASK) == BRK64_ESR_KPROBES) {
314 		if (kprobe_breakpoint_handler(regs, esr) == DBG_HOOK_HANDLED)
315 			handler_found = true;
316 	}
317 #endif
318 	if (!handler_found && call_break_hook(regs, esr) == DBG_HOOK_HANDLED)
319 		handler_found = true;
320 
321 	if (!handler_found && user_mode(regs)) {
322 		send_user_sigtrap(TRAP_BRKPT);
323 	} else if (!handler_found) {
324 		pr_warn("Unexpected kernel BRK exception at EL1\n");
325 		return -EFAULT;
326 	}
327 
328 	return 0;
329 }
330 NOKPROBE_SYMBOL(brk_handler);
331 
332 int aarch32_break_handler(struct pt_regs *regs)
333 {
334 	u32 arm_instr;
335 	u16 thumb_instr;
336 	bool bp = false;
337 	void __user *pc = (void __user *)instruction_pointer(regs);
338 
339 	if (!compat_user_mode(regs))
340 		return -EFAULT;
341 
342 	if (compat_thumb_mode(regs)) {
343 		/* get 16-bit Thumb instruction */
344 		__le16 instr;
345 		get_user(instr, (__le16 __user *)pc);
346 		thumb_instr = le16_to_cpu(instr);
347 		if (thumb_instr == AARCH32_BREAK_THUMB2_LO) {
348 			/* get second half of 32-bit Thumb-2 instruction */
349 			get_user(instr, (__le16 __user *)(pc + 2));
350 			thumb_instr = le16_to_cpu(instr);
351 			bp = thumb_instr == AARCH32_BREAK_THUMB2_HI;
352 		} else {
353 			bp = thumb_instr == AARCH32_BREAK_THUMB;
354 		}
355 	} else {
356 		/* 32-bit ARM instruction */
357 		__le32 instr;
358 		get_user(instr, (__le32 __user *)pc);
359 		arm_instr = le32_to_cpu(instr);
360 		bp = (arm_instr & ~0xf0000000) == AARCH32_BREAK_ARM;
361 	}
362 
363 	if (!bp)
364 		return -EFAULT;
365 
366 	send_user_sigtrap(TRAP_BRKPT);
367 	return 0;
368 }
369 NOKPROBE_SYMBOL(aarch32_break_handler);
370 
371 static int __init debug_traps_init(void)
372 {
373 	hook_debug_fault_code(DBG_ESR_EVT_HWSS, single_step_handler, SIGTRAP,
374 			      TRAP_TRACE, "single-step handler");
375 	hook_debug_fault_code(DBG_ESR_EVT_BRK, brk_handler, SIGTRAP,
376 			      TRAP_BRKPT, "ptrace BRK handler");
377 	return 0;
378 }
379 arch_initcall(debug_traps_init);
380 
381 /* Re-enable single step for syscall restarting. */
382 void user_rewind_single_step(struct task_struct *task)
383 {
384 	/*
385 	 * If single step is active for this thread, then set SPSR.SS
386 	 * to 1 to avoid returning to the active-pending state.
387 	 */
388 	if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP))
389 		set_regs_spsr_ss(task_pt_regs(task));
390 }
391 NOKPROBE_SYMBOL(user_rewind_single_step);
392 
393 void user_fastforward_single_step(struct task_struct *task)
394 {
395 	if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP))
396 		clear_regs_spsr_ss(task_pt_regs(task));
397 }
398 
399 /* Kernel API */
400 void kernel_enable_single_step(struct pt_regs *regs)
401 {
402 	WARN_ON(!irqs_disabled());
403 	set_regs_spsr_ss(regs);
404 	mdscr_write(mdscr_read() | DBG_MDSCR_SS);
405 	enable_debug_monitors(DBG_ACTIVE_EL1);
406 }
407 NOKPROBE_SYMBOL(kernel_enable_single_step);
408 
409 void kernel_disable_single_step(void)
410 {
411 	WARN_ON(!irqs_disabled());
412 	mdscr_write(mdscr_read() & ~DBG_MDSCR_SS);
413 	disable_debug_monitors(DBG_ACTIVE_EL1);
414 }
415 NOKPROBE_SYMBOL(kernel_disable_single_step);
416 
417 int kernel_active_single_step(void)
418 {
419 	WARN_ON(!irqs_disabled());
420 	return mdscr_read() & DBG_MDSCR_SS;
421 }
422 NOKPROBE_SYMBOL(kernel_active_single_step);
423 
424 /* ptrace API */
425 void user_enable_single_step(struct task_struct *task)
426 {
427 	struct thread_info *ti = task_thread_info(task);
428 
429 	if (!test_and_set_ti_thread_flag(ti, TIF_SINGLESTEP))
430 		set_regs_spsr_ss(task_pt_regs(task));
431 }
432 NOKPROBE_SYMBOL(user_enable_single_step);
433 
434 void user_disable_single_step(struct task_struct *task)
435 {
436 	clear_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP);
437 }
438 NOKPROBE_SYMBOL(user_disable_single_step);
439