1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * HW_breakpoint: a unified kernel/user-space hardware breakpoint facility,
4  * using the CPU's debug registers. Derived from
5  * "arch/x86/kernel/hw_breakpoint.c"
6  *
7  * Copyright 2010 IBM Corporation
8  * Author: K.Prasad <prasad@linux.vnet.ibm.com>
9  */
10 
11 #include <linux/hw_breakpoint.h>
12 #include <linux/notifier.h>
13 #include <linux/kprobes.h>
14 #include <linux/percpu.h>
15 #include <linux/kernel.h>
16 #include <linux/sched.h>
17 #include <linux/smp.h>
18 #include <linux/debugfs.h>
19 #include <linux/init.h>
20 
21 #include <asm/hw_breakpoint.h>
22 #include <asm/processor.h>
23 #include <asm/sstep.h>
24 #include <asm/debug.h>
25 #include <asm/debugfs.h>
26 #include <asm/hvcall.h>
27 #include <linux/uaccess.h>
28 
29 /*
30  * Stores the breakpoints currently in use on each breakpoint address
31  * register for every cpu
32  */
33 static DEFINE_PER_CPU(struct perf_event *, bp_per_reg);
34 
35 /*
36  * Returns total number of data or instruction breakpoints available.
37  */
38 int hw_breakpoint_slots(int type)
39 {
40 	if (type == TYPE_DATA)
41 		return HBP_NUM;
42 	return 0;		/* no instruction breakpoints available */
43 }
44 
45 /*
46  * Install a perf counter breakpoint.
47  *
48  * We seek a free debug address register and use it for this
49  * breakpoint.
50  *
51  * Atomic: we hold the counter->ctx->lock and we only handle variables
52  * and registers local to this cpu.
53  */
54 int arch_install_hw_breakpoint(struct perf_event *bp)
55 {
56 	struct arch_hw_breakpoint *info = counter_arch_bp(bp);
57 	struct perf_event **slot = this_cpu_ptr(&bp_per_reg);
58 
59 	*slot = bp;
60 
61 	/*
62 	 * Do not install DABR values if the instruction must be single-stepped.
63 	 * If so, DABR will be populated in single_step_dabr_instruction().
64 	 */
65 	if (current->thread.last_hit_ubp != bp)
66 		__set_breakpoint(info);
67 
68 	return 0;
69 }
70 
71 /*
72  * Uninstall the breakpoint contained in the given counter.
73  *
74  * First we search the debug address register it uses and then we disable
75  * it.
76  *
77  * Atomic: we hold the counter->ctx->lock and we only handle variables
78  * and registers local to this cpu.
79  */
80 void arch_uninstall_hw_breakpoint(struct perf_event *bp)
81 {
82 	struct perf_event **slot = this_cpu_ptr(&bp_per_reg);
83 
84 	if (*slot != bp) {
85 		WARN_ONCE(1, "Can't find the breakpoint");
86 		return;
87 	}
88 
89 	*slot = NULL;
90 	hw_breakpoint_disable();
91 }
92 
93 /*
94  * Perform cleanup of arch-specific counters during unregistration
95  * of the perf-event
96  */
97 void arch_unregister_hw_breakpoint(struct perf_event *bp)
98 {
99 	/*
100 	 * If the breakpoint is unregistered between a hw_breakpoint_handler()
101 	 * and the single_step_dabr_instruction(), then cleanup the breakpoint
102 	 * restoration variables to prevent dangling pointers.
103 	 * FIXME, this should not be using bp->ctx at all! Sayeth peterz.
104 	 */
105 	if (bp->ctx && bp->ctx->task && bp->ctx->task != ((void *)-1L))
106 		bp->ctx->task->thread.last_hit_ubp = NULL;
107 }
108 
109 /*
110  * Check for virtual address in kernel space.
111  */
112 int arch_check_bp_in_kernelspace(struct arch_hw_breakpoint *hw)
113 {
114 	return is_kernel_addr(hw->address);
115 }
116 
117 int arch_bp_generic_fields(int type, int *gen_bp_type)
118 {
119 	*gen_bp_type = 0;
120 	if (type & HW_BRK_TYPE_READ)
121 		*gen_bp_type |= HW_BREAKPOINT_R;
122 	if (type & HW_BRK_TYPE_WRITE)
123 		*gen_bp_type |= HW_BREAKPOINT_W;
124 	if (*gen_bp_type == 0)
125 		return -EINVAL;
126 	return 0;
127 }
128 
129 /*
130  * Watchpoint match range is always doubleword(8 bytes) aligned on
131  * powerpc. If the given range is crossing doubleword boundary, we
132  * need to increase the length such that next doubleword also get
133  * covered. Ex,
134  *
135  *          address   len = 6 bytes
136  *                |=========.
137  *   |------------v--|------v--------|
138  *   | | | | | | | | | | | | | | | | |
139  *   |---------------|---------------|
140  *    <---8 bytes--->
141  *
142  * In this case, we should configure hw as:
143  *   start_addr = address & ~HW_BREAKPOINT_ALIGN
144  *   len = 16 bytes
145  *
146  * @start_addr and @end_addr are inclusive.
147  */
148 static int hw_breakpoint_validate_len(struct arch_hw_breakpoint *hw)
149 {
150 	u16 max_len = DABR_MAX_LEN;
151 	u16 hw_len;
152 	unsigned long start_addr, end_addr;
153 
154 	start_addr = hw->address & ~HW_BREAKPOINT_ALIGN;
155 	end_addr = (hw->address + hw->len - 1) | HW_BREAKPOINT_ALIGN;
156 	hw_len = end_addr - start_addr + 1;
157 
158 	if (dawr_enabled()) {
159 		max_len = DAWR_MAX_LEN;
160 		/* DAWR region can't cross 512 bytes boundary */
161 		if ((start_addr >> 9) != (end_addr >> 9))
162 			return -EINVAL;
163 	}
164 
165 	if (hw_len > max_len)
166 		return -EINVAL;
167 
168 	hw->hw_len = hw_len;
169 	return 0;
170 }
171 
172 /*
173  * Validate the arch-specific HW Breakpoint register settings
174  */
175 int hw_breakpoint_arch_parse(struct perf_event *bp,
176 			     const struct perf_event_attr *attr,
177 			     struct arch_hw_breakpoint *hw)
178 {
179 	int ret = -EINVAL;
180 
181 	if (!bp || !attr->bp_len)
182 		return ret;
183 
184 	hw->type = HW_BRK_TYPE_TRANSLATE;
185 	if (attr->bp_type & HW_BREAKPOINT_R)
186 		hw->type |= HW_BRK_TYPE_READ;
187 	if (attr->bp_type & HW_BREAKPOINT_W)
188 		hw->type |= HW_BRK_TYPE_WRITE;
189 	if (hw->type == HW_BRK_TYPE_TRANSLATE)
190 		/* must set alteast read or write */
191 		return ret;
192 	if (!attr->exclude_user)
193 		hw->type |= HW_BRK_TYPE_USER;
194 	if (!attr->exclude_kernel)
195 		hw->type |= HW_BRK_TYPE_KERNEL;
196 	if (!attr->exclude_hv)
197 		hw->type |= HW_BRK_TYPE_HYP;
198 	hw->address = attr->bp_addr;
199 	hw->len = attr->bp_len;
200 
201 	if (!ppc_breakpoint_available())
202 		return -ENODEV;
203 
204 	return hw_breakpoint_validate_len(hw);
205 }
206 
207 /*
208  * Restores the breakpoint on the debug registers.
209  * Invoke this function if it is known that the execution context is
210  * about to change to cause loss of MSR_SE settings.
211  */
212 void thread_change_pc(struct task_struct *tsk, struct pt_regs *regs)
213 {
214 	struct arch_hw_breakpoint *info;
215 
216 	if (likely(!tsk->thread.last_hit_ubp))
217 		return;
218 
219 	info = counter_arch_bp(tsk->thread.last_hit_ubp);
220 	regs->msr &= ~MSR_SE;
221 	__set_breakpoint(info);
222 	tsk->thread.last_hit_ubp = NULL;
223 }
224 
225 static bool dar_within_range(unsigned long dar, struct arch_hw_breakpoint *info)
226 {
227 	return ((info->address <= dar) && (dar - info->address < info->len));
228 }
229 
230 static bool
231 dar_range_overlaps(unsigned long dar, int size, struct arch_hw_breakpoint *info)
232 {
233 	return ((dar <= info->address + info->len - 1) &&
234 		(dar + size - 1 >= info->address));
235 }
236 
237 /*
238  * Handle debug exception notifications.
239  */
240 static bool stepping_handler(struct pt_regs *regs, struct perf_event *bp,
241 			     struct arch_hw_breakpoint *info)
242 {
243 	unsigned int instr = 0;
244 	int ret, type, size;
245 	struct instruction_op op;
246 	unsigned long addr = info->address;
247 
248 	if (__get_user_inatomic(instr, (unsigned int *)regs->nip))
249 		goto fail;
250 
251 	ret = analyse_instr(&op, regs, instr);
252 	type = GETTYPE(op.type);
253 	size = GETSIZE(op.type);
254 
255 	if (!ret && (type == LARX || type == STCX)) {
256 		printk_ratelimited("Breakpoint hit on instruction that can't be emulated."
257 				   " Breakpoint at 0x%lx will be disabled.\n", addr);
258 		goto disable;
259 	}
260 
261 	/*
262 	 * If it's extraneous event, we still need to emulate/single-
263 	 * step the instruction, but we don't generate an event.
264 	 */
265 	if (size && !dar_range_overlaps(regs->dar, size, info))
266 		info->type |= HW_BRK_TYPE_EXTRANEOUS_IRQ;
267 
268 	/* Do not emulate user-space instructions, instead single-step them */
269 	if (user_mode(regs)) {
270 		current->thread.last_hit_ubp = bp;
271 		regs->msr |= MSR_SE;
272 		return false;
273 	}
274 
275 	if (!emulate_step(regs, instr))
276 		goto fail;
277 
278 	return true;
279 
280 fail:
281 	/*
282 	 * We've failed in reliably handling the hw-breakpoint. Unregister
283 	 * it and throw a warning message to let the user know about it.
284 	 */
285 	WARN(1, "Unable to handle hardware breakpoint. Breakpoint at "
286 		"0x%lx will be disabled.", addr);
287 
288 disable:
289 	perf_event_disable_inatomic(bp);
290 	return false;
291 }
292 
293 int hw_breakpoint_handler(struct die_args *args)
294 {
295 	int rc = NOTIFY_STOP;
296 	struct perf_event *bp;
297 	struct pt_regs *regs = args->regs;
298 	struct arch_hw_breakpoint *info;
299 
300 	/* Disable breakpoints during exception handling */
301 	hw_breakpoint_disable();
302 
303 	/*
304 	 * The counter may be concurrently released but that can only
305 	 * occur from a call_rcu() path. We can then safely fetch
306 	 * the breakpoint, use its callback, touch its counter
307 	 * while we are in an rcu_read_lock() path.
308 	 */
309 	rcu_read_lock();
310 
311 	bp = __this_cpu_read(bp_per_reg);
312 	if (!bp) {
313 		rc = NOTIFY_DONE;
314 		goto out;
315 	}
316 	info = counter_arch_bp(bp);
317 
318 	/*
319 	 * Return early after invoking user-callback function without restoring
320 	 * DABR if the breakpoint is from ptrace which always operates in
321 	 * one-shot mode. The ptrace-ed process will receive the SIGTRAP signal
322 	 * generated in do_dabr().
323 	 */
324 	if (bp->overflow_handler == ptrace_triggered) {
325 		perf_bp_event(bp, regs);
326 		rc = NOTIFY_DONE;
327 		goto out;
328 	}
329 
330 	info->type &= ~HW_BRK_TYPE_EXTRANEOUS_IRQ;
331 	if (IS_ENABLED(CONFIG_PPC_8xx)) {
332 		if (!dar_within_range(regs->dar, info))
333 			info->type |= HW_BRK_TYPE_EXTRANEOUS_IRQ;
334 	} else {
335 		if (!stepping_handler(regs, bp, info))
336 			goto out;
337 	}
338 
339 	/*
340 	 * As a policy, the callback is invoked in a 'trigger-after-execute'
341 	 * fashion
342 	 */
343 	if (!(info->type & HW_BRK_TYPE_EXTRANEOUS_IRQ))
344 		perf_bp_event(bp, regs);
345 
346 	__set_breakpoint(info);
347 out:
348 	rcu_read_unlock();
349 	return rc;
350 }
351 NOKPROBE_SYMBOL(hw_breakpoint_handler);
352 
353 /*
354  * Handle single-step exceptions following a DABR hit.
355  */
356 static int single_step_dabr_instruction(struct die_args *args)
357 {
358 	struct pt_regs *regs = args->regs;
359 	struct perf_event *bp = NULL;
360 	struct arch_hw_breakpoint *info;
361 
362 	bp = current->thread.last_hit_ubp;
363 	/*
364 	 * Check if we are single-stepping as a result of a
365 	 * previous HW Breakpoint exception
366 	 */
367 	if (!bp)
368 		return NOTIFY_DONE;
369 
370 	info = counter_arch_bp(bp);
371 
372 	/*
373 	 * We shall invoke the user-defined callback function in the single
374 	 * stepping handler to confirm to 'trigger-after-execute' semantics
375 	 */
376 	if (!(info->type & HW_BRK_TYPE_EXTRANEOUS_IRQ))
377 		perf_bp_event(bp, regs);
378 
379 	__set_breakpoint(info);
380 	current->thread.last_hit_ubp = NULL;
381 
382 	/*
383 	 * If the process was being single-stepped by ptrace, let the
384 	 * other single-step actions occur (e.g. generate SIGTRAP).
385 	 */
386 	if (test_thread_flag(TIF_SINGLESTEP))
387 		return NOTIFY_DONE;
388 
389 	return NOTIFY_STOP;
390 }
391 NOKPROBE_SYMBOL(single_step_dabr_instruction);
392 
393 /*
394  * Handle debug exception notifications.
395  */
396 int hw_breakpoint_exceptions_notify(
397 		struct notifier_block *unused, unsigned long val, void *data)
398 {
399 	int ret = NOTIFY_DONE;
400 
401 	switch (val) {
402 	case DIE_DABR_MATCH:
403 		ret = hw_breakpoint_handler(data);
404 		break;
405 	case DIE_SSTEP:
406 		ret = single_step_dabr_instruction(data);
407 		break;
408 	}
409 
410 	return ret;
411 }
412 NOKPROBE_SYMBOL(hw_breakpoint_exceptions_notify);
413 
414 /*
415  * Release the user breakpoints used by ptrace
416  */
417 void flush_ptrace_hw_breakpoint(struct task_struct *tsk)
418 {
419 	struct thread_struct *t = &tsk->thread;
420 
421 	unregister_hw_breakpoint(t->ptrace_bps[0]);
422 	t->ptrace_bps[0] = NULL;
423 }
424 
425 void hw_breakpoint_pmu_read(struct perf_event *bp)
426 {
427 	/* TODO */
428 }
429