1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * HW_breakpoint: a unified kernel/user-space hardware breakpoint facility, 4 * using the CPU's debug registers. Derived from 5 * "arch/x86/kernel/hw_breakpoint.c" 6 * 7 * Copyright 2010 IBM Corporation 8 * Author: K.Prasad <prasad@linux.vnet.ibm.com> 9 */ 10 11 #include <linux/hw_breakpoint.h> 12 #include <linux/notifier.h> 13 #include <linux/kprobes.h> 14 #include <linux/percpu.h> 15 #include <linux/kernel.h> 16 #include <linux/sched.h> 17 #include <linux/smp.h> 18 #include <linux/debugfs.h> 19 #include <linux/init.h> 20 21 #include <asm/hw_breakpoint.h> 22 #include <asm/processor.h> 23 #include <asm/sstep.h> 24 #include <asm/debug.h> 25 #include <asm/debugfs.h> 26 #include <asm/hvcall.h> 27 #include <linux/uaccess.h> 28 29 /* 30 * Stores the breakpoints currently in use on each breakpoint address 31 * register for every cpu 32 */ 33 static DEFINE_PER_CPU(struct perf_event *, bp_per_reg); 34 35 /* 36 * Returns total number of data or instruction breakpoints available. 37 */ 38 int hw_breakpoint_slots(int type) 39 { 40 if (type == TYPE_DATA) 41 return HBP_NUM; 42 return 0; /* no instruction breakpoints available */ 43 } 44 45 /* 46 * Install a perf counter breakpoint. 47 * 48 * We seek a free debug address register and use it for this 49 * breakpoint. 50 * 51 * Atomic: we hold the counter->ctx->lock and we only handle variables 52 * and registers local to this cpu. 53 */ 54 int arch_install_hw_breakpoint(struct perf_event *bp) 55 { 56 struct arch_hw_breakpoint *info = counter_arch_bp(bp); 57 struct perf_event **slot = this_cpu_ptr(&bp_per_reg); 58 59 *slot = bp; 60 61 /* 62 * Do not install DABR values if the instruction must be single-stepped. 63 * If so, DABR will be populated in single_step_dabr_instruction(). 64 */ 65 if (current->thread.last_hit_ubp != bp) 66 __set_breakpoint(info); 67 68 return 0; 69 } 70 71 /* 72 * Uninstall the breakpoint contained in the given counter. 73 * 74 * First we search the debug address register it uses and then we disable 75 * it. 76 * 77 * Atomic: we hold the counter->ctx->lock and we only handle variables 78 * and registers local to this cpu. 79 */ 80 void arch_uninstall_hw_breakpoint(struct perf_event *bp) 81 { 82 struct perf_event **slot = this_cpu_ptr(&bp_per_reg); 83 84 if (*slot != bp) { 85 WARN_ONCE(1, "Can't find the breakpoint"); 86 return; 87 } 88 89 *slot = NULL; 90 hw_breakpoint_disable(); 91 } 92 93 /* 94 * Perform cleanup of arch-specific counters during unregistration 95 * of the perf-event 96 */ 97 void arch_unregister_hw_breakpoint(struct perf_event *bp) 98 { 99 /* 100 * If the breakpoint is unregistered between a hw_breakpoint_handler() 101 * and the single_step_dabr_instruction(), then cleanup the breakpoint 102 * restoration variables to prevent dangling pointers. 103 * FIXME, this should not be using bp->ctx at all! Sayeth peterz. 104 */ 105 if (bp->ctx && bp->ctx->task && bp->ctx->task != ((void *)-1L)) 106 bp->ctx->task->thread.last_hit_ubp = NULL; 107 } 108 109 /* 110 * Check for virtual address in kernel space. 111 */ 112 int arch_check_bp_in_kernelspace(struct arch_hw_breakpoint *hw) 113 { 114 return is_kernel_addr(hw->address); 115 } 116 117 int arch_bp_generic_fields(int type, int *gen_bp_type) 118 { 119 *gen_bp_type = 0; 120 if (type & HW_BRK_TYPE_READ) 121 *gen_bp_type |= HW_BREAKPOINT_R; 122 if (type & HW_BRK_TYPE_WRITE) 123 *gen_bp_type |= HW_BREAKPOINT_W; 124 if (*gen_bp_type == 0) 125 return -EINVAL; 126 return 0; 127 } 128 129 /* 130 * Validate the arch-specific HW Breakpoint register settings 131 */ 132 int hw_breakpoint_arch_parse(struct perf_event *bp, 133 const struct perf_event_attr *attr, 134 struct arch_hw_breakpoint *hw) 135 { 136 int ret = -EINVAL, length_max; 137 138 if (!bp) 139 return ret; 140 141 hw->type = HW_BRK_TYPE_TRANSLATE; 142 if (attr->bp_type & HW_BREAKPOINT_R) 143 hw->type |= HW_BRK_TYPE_READ; 144 if (attr->bp_type & HW_BREAKPOINT_W) 145 hw->type |= HW_BRK_TYPE_WRITE; 146 if (hw->type == HW_BRK_TYPE_TRANSLATE) 147 /* must set alteast read or write */ 148 return ret; 149 if (!attr->exclude_user) 150 hw->type |= HW_BRK_TYPE_USER; 151 if (!attr->exclude_kernel) 152 hw->type |= HW_BRK_TYPE_KERNEL; 153 if (!attr->exclude_hv) 154 hw->type |= HW_BRK_TYPE_HYP; 155 hw->address = attr->bp_addr; 156 hw->len = attr->bp_len; 157 158 /* 159 * Since breakpoint length can be a maximum of HW_BREAKPOINT_LEN(8) 160 * and breakpoint addresses are aligned to nearest double-word 161 * HW_BREAKPOINT_ALIGN by rounding off to the lower address, the 162 * 'symbolsize' should satisfy the check below. 163 */ 164 if (!ppc_breakpoint_available()) 165 return -ENODEV; 166 length_max = 8; /* DABR */ 167 if (dawr_enabled()) { 168 length_max = 512 ; /* 64 doublewords */ 169 /* DAWR region can't cross 512 boundary */ 170 if ((attr->bp_addr >> 9) != 171 ((attr->bp_addr + attr->bp_len - 1) >> 9)) 172 return -EINVAL; 173 } 174 if (hw->len > 175 (length_max - (hw->address & HW_BREAKPOINT_ALIGN))) 176 return -EINVAL; 177 return 0; 178 } 179 180 /* 181 * Restores the breakpoint on the debug registers. 182 * Invoke this function if it is known that the execution context is 183 * about to change to cause loss of MSR_SE settings. 184 */ 185 void thread_change_pc(struct task_struct *tsk, struct pt_regs *regs) 186 { 187 struct arch_hw_breakpoint *info; 188 189 if (likely(!tsk->thread.last_hit_ubp)) 190 return; 191 192 info = counter_arch_bp(tsk->thread.last_hit_ubp); 193 regs->msr &= ~MSR_SE; 194 __set_breakpoint(info); 195 tsk->thread.last_hit_ubp = NULL; 196 } 197 198 /* 199 * Handle debug exception notifications. 200 */ 201 int hw_breakpoint_handler(struct die_args *args) 202 { 203 int rc = NOTIFY_STOP; 204 struct perf_event *bp; 205 struct pt_regs *regs = args->regs; 206 #ifndef CONFIG_PPC_8xx 207 int stepped = 1; 208 unsigned int instr; 209 #endif 210 struct arch_hw_breakpoint *info; 211 unsigned long dar = regs->dar; 212 213 /* Disable breakpoints during exception handling */ 214 hw_breakpoint_disable(); 215 216 /* 217 * The counter may be concurrently released but that can only 218 * occur from a call_rcu() path. We can then safely fetch 219 * the breakpoint, use its callback, touch its counter 220 * while we are in an rcu_read_lock() path. 221 */ 222 rcu_read_lock(); 223 224 bp = __this_cpu_read(bp_per_reg); 225 if (!bp) { 226 rc = NOTIFY_DONE; 227 goto out; 228 } 229 info = counter_arch_bp(bp); 230 231 /* 232 * Return early after invoking user-callback function without restoring 233 * DABR if the breakpoint is from ptrace which always operates in 234 * one-shot mode. The ptrace-ed process will receive the SIGTRAP signal 235 * generated in do_dabr(). 236 */ 237 if (bp->overflow_handler == ptrace_triggered) { 238 perf_bp_event(bp, regs); 239 rc = NOTIFY_DONE; 240 goto out; 241 } 242 243 /* 244 * Verify if dar lies within the address range occupied by the symbol 245 * being watched to filter extraneous exceptions. If it doesn't, 246 * we still need to single-step the instruction, but we don't 247 * generate an event. 248 */ 249 info->type &= ~HW_BRK_TYPE_EXTRANEOUS_IRQ; 250 if (!((bp->attr.bp_addr <= dar) && 251 (dar - bp->attr.bp_addr < bp->attr.bp_len))) 252 info->type |= HW_BRK_TYPE_EXTRANEOUS_IRQ; 253 254 #ifndef CONFIG_PPC_8xx 255 /* Do not emulate user-space instructions, instead single-step them */ 256 if (user_mode(regs)) { 257 current->thread.last_hit_ubp = bp; 258 regs->msr |= MSR_SE; 259 goto out; 260 } 261 262 stepped = 0; 263 instr = 0; 264 if (!__get_user_inatomic(instr, (unsigned int *) regs->nip)) 265 stepped = emulate_step(regs, instr); 266 267 /* 268 * emulate_step() could not execute it. We've failed in reliably 269 * handling the hw-breakpoint. Unregister it and throw a warning 270 * message to let the user know about it. 271 */ 272 if (!stepped) { 273 WARN(1, "Unable to handle hardware breakpoint. Breakpoint at " 274 "0x%lx will be disabled.", info->address); 275 perf_event_disable_inatomic(bp); 276 goto out; 277 } 278 #endif 279 /* 280 * As a policy, the callback is invoked in a 'trigger-after-execute' 281 * fashion 282 */ 283 if (!(info->type & HW_BRK_TYPE_EXTRANEOUS_IRQ)) 284 perf_bp_event(bp, regs); 285 286 __set_breakpoint(info); 287 out: 288 rcu_read_unlock(); 289 return rc; 290 } 291 NOKPROBE_SYMBOL(hw_breakpoint_handler); 292 293 /* 294 * Handle single-step exceptions following a DABR hit. 295 */ 296 static int single_step_dabr_instruction(struct die_args *args) 297 { 298 struct pt_regs *regs = args->regs; 299 struct perf_event *bp = NULL; 300 struct arch_hw_breakpoint *info; 301 302 bp = current->thread.last_hit_ubp; 303 /* 304 * Check if we are single-stepping as a result of a 305 * previous HW Breakpoint exception 306 */ 307 if (!bp) 308 return NOTIFY_DONE; 309 310 info = counter_arch_bp(bp); 311 312 /* 313 * We shall invoke the user-defined callback function in the single 314 * stepping handler to confirm to 'trigger-after-execute' semantics 315 */ 316 if (!(info->type & HW_BRK_TYPE_EXTRANEOUS_IRQ)) 317 perf_bp_event(bp, regs); 318 319 __set_breakpoint(info); 320 current->thread.last_hit_ubp = NULL; 321 322 /* 323 * If the process was being single-stepped by ptrace, let the 324 * other single-step actions occur (e.g. generate SIGTRAP). 325 */ 326 if (test_thread_flag(TIF_SINGLESTEP)) 327 return NOTIFY_DONE; 328 329 return NOTIFY_STOP; 330 } 331 NOKPROBE_SYMBOL(single_step_dabr_instruction); 332 333 /* 334 * Handle debug exception notifications. 335 */ 336 int hw_breakpoint_exceptions_notify( 337 struct notifier_block *unused, unsigned long val, void *data) 338 { 339 int ret = NOTIFY_DONE; 340 341 switch (val) { 342 case DIE_DABR_MATCH: 343 ret = hw_breakpoint_handler(data); 344 break; 345 case DIE_SSTEP: 346 ret = single_step_dabr_instruction(data); 347 break; 348 } 349 350 return ret; 351 } 352 NOKPROBE_SYMBOL(hw_breakpoint_exceptions_notify); 353 354 /* 355 * Release the user breakpoints used by ptrace 356 */ 357 void flush_ptrace_hw_breakpoint(struct task_struct *tsk) 358 { 359 struct thread_struct *t = &tsk->thread; 360 361 unregister_hw_breakpoint(t->ptrace_bps[0]); 362 t->ptrace_bps[0] = NULL; 363 } 364 365 void hw_breakpoint_pmu_read(struct perf_event *bp) 366 { 367 /* TODO */ 368 } 369 370 bool dawr_force_enable; 371 EXPORT_SYMBOL_GPL(dawr_force_enable); 372 373 static ssize_t dawr_write_file_bool(struct file *file, 374 const char __user *user_buf, 375 size_t count, loff_t *ppos) 376 { 377 struct arch_hw_breakpoint null_brk = {0, 0, 0}; 378 size_t rc; 379 380 /* Send error to user if they hypervisor won't allow us to write DAWR */ 381 if ((!dawr_force_enable) && 382 (firmware_has_feature(FW_FEATURE_LPAR)) && 383 (set_dawr(&null_brk) != H_SUCCESS)) 384 return -1; 385 386 rc = debugfs_write_file_bool(file, user_buf, count, ppos); 387 if (rc) 388 return rc; 389 390 /* If we are clearing, make sure all CPUs have the DAWR cleared */ 391 if (!dawr_force_enable) 392 smp_call_function((smp_call_func_t)set_dawr, &null_brk, 0); 393 394 return rc; 395 } 396 397 static const struct file_operations dawr_enable_fops = { 398 .read = debugfs_read_file_bool, 399 .write = dawr_write_file_bool, 400 .open = simple_open, 401 .llseek = default_llseek, 402 }; 403 404 static int __init dawr_force_setup(void) 405 { 406 dawr_force_enable = false; 407 408 if (cpu_has_feature(CPU_FTR_DAWR)) { 409 /* Don't setup sysfs file for user control on P8 */ 410 dawr_force_enable = true; 411 return 0; 412 } 413 414 if (PVR_VER(mfspr(SPRN_PVR)) == PVR_POWER9) { 415 /* Turn DAWR off by default, but allow admin to turn it on */ 416 dawr_force_enable = false; 417 debugfs_create_file_unsafe("dawr_enable_dangerous", 0600, 418 powerpc_debugfs_root, 419 &dawr_force_enable, 420 &dawr_enable_fops); 421 } 422 return 0; 423 } 424 arch_initcall(dawr_force_setup); 425