1 /* 2 * HW_breakpoint: a unified kernel/user-space hardware breakpoint facility, 3 * using the CPU's debug registers. Derived from 4 * "arch/x86/kernel/hw_breakpoint.c" 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation; either version 2 of the License, or 9 * (at your option) any later version. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License 17 * along with this program; if not, write to the Free Software 18 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. 19 * 20 * Copyright 2010 IBM Corporation 21 * Author: K.Prasad <prasad@linux.vnet.ibm.com> 22 * 23 */ 24 25 #include <linux/hw_breakpoint.h> 26 #include <linux/notifier.h> 27 #include <linux/kprobes.h> 28 #include <linux/percpu.h> 29 #include <linux/kernel.h> 30 #include <linux/sched.h> 31 #include <linux/smp.h> 32 #include <linux/debugfs.h> 33 #include <linux/init.h> 34 35 #include <asm/hw_breakpoint.h> 36 #include <asm/processor.h> 37 #include <asm/sstep.h> 38 #include <asm/debug.h> 39 #include <asm/debugfs.h> 40 #include <asm/hvcall.h> 41 #include <linux/uaccess.h> 42 43 /* 44 * Stores the breakpoints currently in use on each breakpoint address 45 * register for every cpu 46 */ 47 static DEFINE_PER_CPU(struct perf_event *, bp_per_reg); 48 49 /* 50 * Returns total number of data or instruction breakpoints available. 51 */ 52 int hw_breakpoint_slots(int type) 53 { 54 if (type == TYPE_DATA) 55 return HBP_NUM; 56 return 0; /* no instruction breakpoints available */ 57 } 58 59 /* 60 * Install a perf counter breakpoint. 61 * 62 * We seek a free debug address register and use it for this 63 * breakpoint. 64 * 65 * Atomic: we hold the counter->ctx->lock and we only handle variables 66 * and registers local to this cpu. 67 */ 68 int arch_install_hw_breakpoint(struct perf_event *bp) 69 { 70 struct arch_hw_breakpoint *info = counter_arch_bp(bp); 71 struct perf_event **slot = this_cpu_ptr(&bp_per_reg); 72 73 *slot = bp; 74 75 /* 76 * Do not install DABR values if the instruction must be single-stepped. 77 * If so, DABR will be populated in single_step_dabr_instruction(). 78 */ 79 if (current->thread.last_hit_ubp != bp) 80 __set_breakpoint(info); 81 82 return 0; 83 } 84 85 /* 86 * Uninstall the breakpoint contained in the given counter. 87 * 88 * First we search the debug address register it uses and then we disable 89 * it. 90 * 91 * Atomic: we hold the counter->ctx->lock and we only handle variables 92 * and registers local to this cpu. 93 */ 94 void arch_uninstall_hw_breakpoint(struct perf_event *bp) 95 { 96 struct perf_event **slot = this_cpu_ptr(&bp_per_reg); 97 98 if (*slot != bp) { 99 WARN_ONCE(1, "Can't find the breakpoint"); 100 return; 101 } 102 103 *slot = NULL; 104 hw_breakpoint_disable(); 105 } 106 107 /* 108 * Perform cleanup of arch-specific counters during unregistration 109 * of the perf-event 110 */ 111 void arch_unregister_hw_breakpoint(struct perf_event *bp) 112 { 113 /* 114 * If the breakpoint is unregistered between a hw_breakpoint_handler() 115 * and the single_step_dabr_instruction(), then cleanup the breakpoint 116 * restoration variables to prevent dangling pointers. 117 * FIXME, this should not be using bp->ctx at all! Sayeth peterz. 118 */ 119 if (bp->ctx && bp->ctx->task && bp->ctx->task != ((void *)-1L)) 120 bp->ctx->task->thread.last_hit_ubp = NULL; 121 } 122 123 /* 124 * Check for virtual address in kernel space. 125 */ 126 int arch_check_bp_in_kernelspace(struct arch_hw_breakpoint *hw) 127 { 128 return is_kernel_addr(hw->address); 129 } 130 131 int arch_bp_generic_fields(int type, int *gen_bp_type) 132 { 133 *gen_bp_type = 0; 134 if (type & HW_BRK_TYPE_READ) 135 *gen_bp_type |= HW_BREAKPOINT_R; 136 if (type & HW_BRK_TYPE_WRITE) 137 *gen_bp_type |= HW_BREAKPOINT_W; 138 if (*gen_bp_type == 0) 139 return -EINVAL; 140 return 0; 141 } 142 143 /* 144 * Validate the arch-specific HW Breakpoint register settings 145 */ 146 int hw_breakpoint_arch_parse(struct perf_event *bp, 147 const struct perf_event_attr *attr, 148 struct arch_hw_breakpoint *hw) 149 { 150 int ret = -EINVAL, length_max; 151 152 if (!bp) 153 return ret; 154 155 hw->type = HW_BRK_TYPE_TRANSLATE; 156 if (attr->bp_type & HW_BREAKPOINT_R) 157 hw->type |= HW_BRK_TYPE_READ; 158 if (attr->bp_type & HW_BREAKPOINT_W) 159 hw->type |= HW_BRK_TYPE_WRITE; 160 if (hw->type == HW_BRK_TYPE_TRANSLATE) 161 /* must set alteast read or write */ 162 return ret; 163 if (!attr->exclude_user) 164 hw->type |= HW_BRK_TYPE_USER; 165 if (!attr->exclude_kernel) 166 hw->type |= HW_BRK_TYPE_KERNEL; 167 if (!attr->exclude_hv) 168 hw->type |= HW_BRK_TYPE_HYP; 169 hw->address = attr->bp_addr; 170 hw->len = attr->bp_len; 171 172 /* 173 * Since breakpoint length can be a maximum of HW_BREAKPOINT_LEN(8) 174 * and breakpoint addresses are aligned to nearest double-word 175 * HW_BREAKPOINT_ALIGN by rounding off to the lower address, the 176 * 'symbolsize' should satisfy the check below. 177 */ 178 if (!ppc_breakpoint_available()) 179 return -ENODEV; 180 length_max = 8; /* DABR */ 181 if (dawr_enabled()) { 182 length_max = 512 ; /* 64 doublewords */ 183 /* DAWR region can't cross 512 boundary */ 184 if ((attr->bp_addr >> 9) != 185 ((attr->bp_addr + attr->bp_len - 1) >> 9)) 186 return -EINVAL; 187 } 188 if (hw->len > 189 (length_max - (hw->address & HW_BREAKPOINT_ALIGN))) 190 return -EINVAL; 191 return 0; 192 } 193 194 /* 195 * Restores the breakpoint on the debug registers. 196 * Invoke this function if it is known that the execution context is 197 * about to change to cause loss of MSR_SE settings. 198 */ 199 void thread_change_pc(struct task_struct *tsk, struct pt_regs *regs) 200 { 201 struct arch_hw_breakpoint *info; 202 203 if (likely(!tsk->thread.last_hit_ubp)) 204 return; 205 206 info = counter_arch_bp(tsk->thread.last_hit_ubp); 207 regs->msr &= ~MSR_SE; 208 __set_breakpoint(info); 209 tsk->thread.last_hit_ubp = NULL; 210 } 211 212 /* 213 * Handle debug exception notifications. 214 */ 215 int hw_breakpoint_handler(struct die_args *args) 216 { 217 int rc = NOTIFY_STOP; 218 struct perf_event *bp; 219 struct pt_regs *regs = args->regs; 220 #ifndef CONFIG_PPC_8xx 221 int stepped = 1; 222 unsigned int instr; 223 #endif 224 struct arch_hw_breakpoint *info; 225 unsigned long dar = regs->dar; 226 227 /* Disable breakpoints during exception handling */ 228 hw_breakpoint_disable(); 229 230 /* 231 * The counter may be concurrently released but that can only 232 * occur from a call_rcu() path. We can then safely fetch 233 * the breakpoint, use its callback, touch its counter 234 * while we are in an rcu_read_lock() path. 235 */ 236 rcu_read_lock(); 237 238 bp = __this_cpu_read(bp_per_reg); 239 if (!bp) { 240 rc = NOTIFY_DONE; 241 goto out; 242 } 243 info = counter_arch_bp(bp); 244 245 /* 246 * Return early after invoking user-callback function without restoring 247 * DABR if the breakpoint is from ptrace which always operates in 248 * one-shot mode. The ptrace-ed process will receive the SIGTRAP signal 249 * generated in do_dabr(). 250 */ 251 if (bp->overflow_handler == ptrace_triggered) { 252 perf_bp_event(bp, regs); 253 rc = NOTIFY_DONE; 254 goto out; 255 } 256 257 /* 258 * Verify if dar lies within the address range occupied by the symbol 259 * being watched to filter extraneous exceptions. If it doesn't, 260 * we still need to single-step the instruction, but we don't 261 * generate an event. 262 */ 263 info->type &= ~HW_BRK_TYPE_EXTRANEOUS_IRQ; 264 if (!((bp->attr.bp_addr <= dar) && 265 (dar - bp->attr.bp_addr < bp->attr.bp_len))) 266 info->type |= HW_BRK_TYPE_EXTRANEOUS_IRQ; 267 268 #ifndef CONFIG_PPC_8xx 269 /* Do not emulate user-space instructions, instead single-step them */ 270 if (user_mode(regs)) { 271 current->thread.last_hit_ubp = bp; 272 regs->msr |= MSR_SE; 273 goto out; 274 } 275 276 stepped = 0; 277 instr = 0; 278 if (!__get_user_inatomic(instr, (unsigned int *) regs->nip)) 279 stepped = emulate_step(regs, instr); 280 281 /* 282 * emulate_step() could not execute it. We've failed in reliably 283 * handling the hw-breakpoint. Unregister it and throw a warning 284 * message to let the user know about it. 285 */ 286 if (!stepped) { 287 WARN(1, "Unable to handle hardware breakpoint. Breakpoint at " 288 "0x%lx will be disabled.", info->address); 289 perf_event_disable_inatomic(bp); 290 goto out; 291 } 292 #endif 293 /* 294 * As a policy, the callback is invoked in a 'trigger-after-execute' 295 * fashion 296 */ 297 if (!(info->type & HW_BRK_TYPE_EXTRANEOUS_IRQ)) 298 perf_bp_event(bp, regs); 299 300 __set_breakpoint(info); 301 out: 302 rcu_read_unlock(); 303 return rc; 304 } 305 NOKPROBE_SYMBOL(hw_breakpoint_handler); 306 307 /* 308 * Handle single-step exceptions following a DABR hit. 309 */ 310 static int single_step_dabr_instruction(struct die_args *args) 311 { 312 struct pt_regs *regs = args->regs; 313 struct perf_event *bp = NULL; 314 struct arch_hw_breakpoint *info; 315 316 bp = current->thread.last_hit_ubp; 317 /* 318 * Check if we are single-stepping as a result of a 319 * previous HW Breakpoint exception 320 */ 321 if (!bp) 322 return NOTIFY_DONE; 323 324 info = counter_arch_bp(bp); 325 326 /* 327 * We shall invoke the user-defined callback function in the single 328 * stepping handler to confirm to 'trigger-after-execute' semantics 329 */ 330 if (!(info->type & HW_BRK_TYPE_EXTRANEOUS_IRQ)) 331 perf_bp_event(bp, regs); 332 333 __set_breakpoint(info); 334 current->thread.last_hit_ubp = NULL; 335 336 /* 337 * If the process was being single-stepped by ptrace, let the 338 * other single-step actions occur (e.g. generate SIGTRAP). 339 */ 340 if (test_thread_flag(TIF_SINGLESTEP)) 341 return NOTIFY_DONE; 342 343 return NOTIFY_STOP; 344 } 345 NOKPROBE_SYMBOL(single_step_dabr_instruction); 346 347 /* 348 * Handle debug exception notifications. 349 */ 350 int hw_breakpoint_exceptions_notify( 351 struct notifier_block *unused, unsigned long val, void *data) 352 { 353 int ret = NOTIFY_DONE; 354 355 switch (val) { 356 case DIE_DABR_MATCH: 357 ret = hw_breakpoint_handler(data); 358 break; 359 case DIE_SSTEP: 360 ret = single_step_dabr_instruction(data); 361 break; 362 } 363 364 return ret; 365 } 366 NOKPROBE_SYMBOL(hw_breakpoint_exceptions_notify); 367 368 /* 369 * Release the user breakpoints used by ptrace 370 */ 371 void flush_ptrace_hw_breakpoint(struct task_struct *tsk) 372 { 373 struct thread_struct *t = &tsk->thread; 374 375 unregister_hw_breakpoint(t->ptrace_bps[0]); 376 t->ptrace_bps[0] = NULL; 377 } 378 379 void hw_breakpoint_pmu_read(struct perf_event *bp) 380 { 381 /* TODO */ 382 } 383 384 bool dawr_force_enable; 385 EXPORT_SYMBOL_GPL(dawr_force_enable); 386 387 static ssize_t dawr_write_file_bool(struct file *file, 388 const char __user *user_buf, 389 size_t count, loff_t *ppos) 390 { 391 struct arch_hw_breakpoint null_brk = {0, 0, 0}; 392 size_t rc; 393 394 /* Send error to user if they hypervisor won't allow us to write DAWR */ 395 if ((!dawr_force_enable) && 396 (firmware_has_feature(FW_FEATURE_LPAR)) && 397 (set_dawr(&null_brk) != H_SUCCESS)) 398 return -1; 399 400 rc = debugfs_write_file_bool(file, user_buf, count, ppos); 401 if (rc) 402 return rc; 403 404 /* If we are clearing, make sure all CPUs have the DAWR cleared */ 405 if (!dawr_force_enable) 406 smp_call_function((smp_call_func_t)set_dawr, &null_brk, 0); 407 408 return rc; 409 } 410 411 static const struct file_operations dawr_enable_fops = { 412 .read = debugfs_read_file_bool, 413 .write = dawr_write_file_bool, 414 .open = simple_open, 415 .llseek = default_llseek, 416 }; 417 418 static int __init dawr_force_setup(void) 419 { 420 dawr_force_enable = false; 421 422 if (cpu_has_feature(CPU_FTR_DAWR)) { 423 /* Don't setup sysfs file for user control on P8 */ 424 dawr_force_enable = true; 425 return 0; 426 } 427 428 if (PVR_VER(mfspr(SPRN_PVR)) == PVR_POWER9) { 429 /* Turn DAWR off by default, but allow admin to turn it on */ 430 dawr_force_enable = false; 431 debugfs_create_file_unsafe("dawr_enable_dangerous", 0600, 432 powerpc_debugfs_root, 433 &dawr_force_enable, 434 &dawr_enable_fops); 435 } 436 return 0; 437 } 438 arch_initcall(dawr_force_setup); 439