1 /* 2 * HW_breakpoint: a unified kernel/user-space hardware breakpoint facility, 3 * using the CPU's debug registers. Derived from 4 * "arch/x86/kernel/hw_breakpoint.c" 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation; either version 2 of the License, or 9 * (at your option) any later version. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License 17 * along with this program; if not, write to the Free Software 18 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. 19 * 20 * Copyright 2010 IBM Corporation 21 * Author: K.Prasad <prasad@linux.vnet.ibm.com> 22 * 23 */ 24 25 #include <linux/hw_breakpoint.h> 26 #include <linux/notifier.h> 27 #include <linux/kprobes.h> 28 #include <linux/percpu.h> 29 #include <linux/kernel.h> 30 #include <linux/sched.h> 31 #include <linux/smp.h> 32 33 #include <asm/hw_breakpoint.h> 34 #include <asm/processor.h> 35 #include <asm/sstep.h> 36 #include <asm/debug.h> 37 #include <linux/uaccess.h> 38 39 /* 40 * Stores the breakpoints currently in use on each breakpoint address 41 * register for every cpu 42 */ 43 static DEFINE_PER_CPU(struct perf_event *, bp_per_reg); 44 45 /* 46 * Returns total number of data or instruction breakpoints available. 47 */ 48 int hw_breakpoint_slots(int type) 49 { 50 if (type == TYPE_DATA) 51 return HBP_NUM; 52 return 0; /* no instruction breakpoints available */ 53 } 54 55 /* 56 * Install a perf counter breakpoint. 57 * 58 * We seek a free debug address register and use it for this 59 * breakpoint. 60 * 61 * Atomic: we hold the counter->ctx->lock and we only handle variables 62 * and registers local to this cpu. 63 */ 64 int arch_install_hw_breakpoint(struct perf_event *bp) 65 { 66 struct arch_hw_breakpoint *info = counter_arch_bp(bp); 67 struct perf_event **slot = this_cpu_ptr(&bp_per_reg); 68 69 *slot = bp; 70 71 /* 72 * Do not install DABR values if the instruction must be single-stepped. 73 * If so, DABR will be populated in single_step_dabr_instruction(). 74 */ 75 if (current->thread.last_hit_ubp != bp) 76 __set_breakpoint(info); 77 78 return 0; 79 } 80 81 /* 82 * Uninstall the breakpoint contained in the given counter. 83 * 84 * First we search the debug address register it uses and then we disable 85 * it. 86 * 87 * Atomic: we hold the counter->ctx->lock and we only handle variables 88 * and registers local to this cpu. 89 */ 90 void arch_uninstall_hw_breakpoint(struct perf_event *bp) 91 { 92 struct perf_event **slot = this_cpu_ptr(&bp_per_reg); 93 94 if (*slot != bp) { 95 WARN_ONCE(1, "Can't find the breakpoint"); 96 return; 97 } 98 99 *slot = NULL; 100 hw_breakpoint_disable(); 101 } 102 103 /* 104 * Perform cleanup of arch-specific counters during unregistration 105 * of the perf-event 106 */ 107 void arch_unregister_hw_breakpoint(struct perf_event *bp) 108 { 109 /* 110 * If the breakpoint is unregistered between a hw_breakpoint_handler() 111 * and the single_step_dabr_instruction(), then cleanup the breakpoint 112 * restoration variables to prevent dangling pointers. 113 * FIXME, this should not be using bp->ctx at all! Sayeth peterz. 114 */ 115 if (bp->ctx && bp->ctx->task && bp->ctx->task != ((void *)-1L)) 116 bp->ctx->task->thread.last_hit_ubp = NULL; 117 } 118 119 /* 120 * Check for virtual address in kernel space. 121 */ 122 int arch_check_bp_in_kernelspace(struct perf_event *bp) 123 { 124 struct arch_hw_breakpoint *info = counter_arch_bp(bp); 125 126 return is_kernel_addr(info->address); 127 } 128 129 int arch_bp_generic_fields(int type, int *gen_bp_type) 130 { 131 *gen_bp_type = 0; 132 if (type & HW_BRK_TYPE_READ) 133 *gen_bp_type |= HW_BREAKPOINT_R; 134 if (type & HW_BRK_TYPE_WRITE) 135 *gen_bp_type |= HW_BREAKPOINT_W; 136 if (*gen_bp_type == 0) 137 return -EINVAL; 138 return 0; 139 } 140 141 /* 142 * Validate the arch-specific HW Breakpoint register settings 143 */ 144 int arch_validate_hwbkpt_settings(struct perf_event *bp) 145 { 146 int ret = -EINVAL, length_max; 147 struct arch_hw_breakpoint *info = counter_arch_bp(bp); 148 149 if (!bp) 150 return ret; 151 152 info->type = HW_BRK_TYPE_TRANSLATE; 153 if (bp->attr.bp_type & HW_BREAKPOINT_R) 154 info->type |= HW_BRK_TYPE_READ; 155 if (bp->attr.bp_type & HW_BREAKPOINT_W) 156 info->type |= HW_BRK_TYPE_WRITE; 157 if (info->type == HW_BRK_TYPE_TRANSLATE) 158 /* must set alteast read or write */ 159 return ret; 160 if (!(bp->attr.exclude_user)) 161 info->type |= HW_BRK_TYPE_USER; 162 if (!(bp->attr.exclude_kernel)) 163 info->type |= HW_BRK_TYPE_KERNEL; 164 if (!(bp->attr.exclude_hv)) 165 info->type |= HW_BRK_TYPE_HYP; 166 info->address = bp->attr.bp_addr; 167 info->len = bp->attr.bp_len; 168 169 /* 170 * Since breakpoint length can be a maximum of HW_BREAKPOINT_LEN(8) 171 * and breakpoint addresses are aligned to nearest double-word 172 * HW_BREAKPOINT_ALIGN by rounding off to the lower address, the 173 * 'symbolsize' should satisfy the check below. 174 */ 175 if (!ppc_breakpoint_available()) 176 return -ENODEV; 177 length_max = 8; /* DABR */ 178 if (cpu_has_feature(CPU_FTR_DAWR)) { 179 length_max = 512 ; /* 64 doublewords */ 180 /* DAWR region can't cross 512 boundary */ 181 if ((bp->attr.bp_addr >> 10) != 182 ((bp->attr.bp_addr + bp->attr.bp_len - 1) >> 10)) 183 return -EINVAL; 184 } 185 if (info->len > 186 (length_max - (info->address & HW_BREAKPOINT_ALIGN))) 187 return -EINVAL; 188 return 0; 189 } 190 191 /* 192 * Restores the breakpoint on the debug registers. 193 * Invoke this function if it is known that the execution context is 194 * about to change to cause loss of MSR_SE settings. 195 */ 196 void thread_change_pc(struct task_struct *tsk, struct pt_regs *regs) 197 { 198 struct arch_hw_breakpoint *info; 199 200 if (likely(!tsk->thread.last_hit_ubp)) 201 return; 202 203 info = counter_arch_bp(tsk->thread.last_hit_ubp); 204 regs->msr &= ~MSR_SE; 205 __set_breakpoint(info); 206 tsk->thread.last_hit_ubp = NULL; 207 } 208 209 /* 210 * Handle debug exception notifications. 211 */ 212 int hw_breakpoint_handler(struct die_args *args) 213 { 214 int rc = NOTIFY_STOP; 215 struct perf_event *bp; 216 struct pt_regs *regs = args->regs; 217 #ifndef CONFIG_PPC_8xx 218 int stepped = 1; 219 unsigned int instr; 220 #endif 221 struct arch_hw_breakpoint *info; 222 unsigned long dar = regs->dar; 223 224 /* Disable breakpoints during exception handling */ 225 hw_breakpoint_disable(); 226 227 /* 228 * The counter may be concurrently released but that can only 229 * occur from a call_rcu() path. We can then safely fetch 230 * the breakpoint, use its callback, touch its counter 231 * while we are in an rcu_read_lock() path. 232 */ 233 rcu_read_lock(); 234 235 bp = __this_cpu_read(bp_per_reg); 236 if (!bp) { 237 rc = NOTIFY_DONE; 238 goto out; 239 } 240 info = counter_arch_bp(bp); 241 242 /* 243 * Return early after invoking user-callback function without restoring 244 * DABR if the breakpoint is from ptrace which always operates in 245 * one-shot mode. The ptrace-ed process will receive the SIGTRAP signal 246 * generated in do_dabr(). 247 */ 248 if (bp->overflow_handler == ptrace_triggered) { 249 perf_bp_event(bp, regs); 250 rc = NOTIFY_DONE; 251 goto out; 252 } 253 254 /* 255 * Verify if dar lies within the address range occupied by the symbol 256 * being watched to filter extraneous exceptions. If it doesn't, 257 * we still need to single-step the instruction, but we don't 258 * generate an event. 259 */ 260 info->type &= ~HW_BRK_TYPE_EXTRANEOUS_IRQ; 261 if (!((bp->attr.bp_addr <= dar) && 262 (dar - bp->attr.bp_addr < bp->attr.bp_len))) 263 info->type |= HW_BRK_TYPE_EXTRANEOUS_IRQ; 264 265 #ifndef CONFIG_PPC_8xx 266 /* Do not emulate user-space instructions, instead single-step them */ 267 if (user_mode(regs)) { 268 current->thread.last_hit_ubp = bp; 269 regs->msr |= MSR_SE; 270 goto out; 271 } 272 273 stepped = 0; 274 instr = 0; 275 if (!__get_user_inatomic(instr, (unsigned int *) regs->nip)) 276 stepped = emulate_step(regs, instr); 277 278 /* 279 * emulate_step() could not execute it. We've failed in reliably 280 * handling the hw-breakpoint. Unregister it and throw a warning 281 * message to let the user know about it. 282 */ 283 if (!stepped) { 284 WARN(1, "Unable to handle hardware breakpoint. Breakpoint at " 285 "0x%lx will be disabled.", info->address); 286 perf_event_disable_inatomic(bp); 287 goto out; 288 } 289 #endif 290 /* 291 * As a policy, the callback is invoked in a 'trigger-after-execute' 292 * fashion 293 */ 294 if (!(info->type & HW_BRK_TYPE_EXTRANEOUS_IRQ)) 295 perf_bp_event(bp, regs); 296 297 __set_breakpoint(info); 298 out: 299 rcu_read_unlock(); 300 return rc; 301 } 302 NOKPROBE_SYMBOL(hw_breakpoint_handler); 303 304 /* 305 * Handle single-step exceptions following a DABR hit. 306 */ 307 static int single_step_dabr_instruction(struct die_args *args) 308 { 309 struct pt_regs *regs = args->regs; 310 struct perf_event *bp = NULL; 311 struct arch_hw_breakpoint *info; 312 313 bp = current->thread.last_hit_ubp; 314 /* 315 * Check if we are single-stepping as a result of a 316 * previous HW Breakpoint exception 317 */ 318 if (!bp) 319 return NOTIFY_DONE; 320 321 info = counter_arch_bp(bp); 322 323 /* 324 * We shall invoke the user-defined callback function in the single 325 * stepping handler to confirm to 'trigger-after-execute' semantics 326 */ 327 if (!(info->type & HW_BRK_TYPE_EXTRANEOUS_IRQ)) 328 perf_bp_event(bp, regs); 329 330 __set_breakpoint(info); 331 current->thread.last_hit_ubp = NULL; 332 333 /* 334 * If the process was being single-stepped by ptrace, let the 335 * other single-step actions occur (e.g. generate SIGTRAP). 336 */ 337 if (test_thread_flag(TIF_SINGLESTEP)) 338 return NOTIFY_DONE; 339 340 return NOTIFY_STOP; 341 } 342 NOKPROBE_SYMBOL(single_step_dabr_instruction); 343 344 /* 345 * Handle debug exception notifications. 346 */ 347 int hw_breakpoint_exceptions_notify( 348 struct notifier_block *unused, unsigned long val, void *data) 349 { 350 int ret = NOTIFY_DONE; 351 352 switch (val) { 353 case DIE_DABR_MATCH: 354 ret = hw_breakpoint_handler(data); 355 break; 356 case DIE_SSTEP: 357 ret = single_step_dabr_instruction(data); 358 break; 359 } 360 361 return ret; 362 } 363 NOKPROBE_SYMBOL(hw_breakpoint_exceptions_notify); 364 365 /* 366 * Release the user breakpoints used by ptrace 367 */ 368 void flush_ptrace_hw_breakpoint(struct task_struct *tsk) 369 { 370 struct thread_struct *t = &tsk->thread; 371 372 unregister_hw_breakpoint(t->ptrace_bps[0]); 373 t->ptrace_bps[0] = NULL; 374 } 375 376 void hw_breakpoint_pmu_read(struct perf_event *bp) 377 { 378 /* TODO */ 379 } 380