1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * HW_breakpoint: a unified kernel/user-space hardware breakpoint facility, 4 * using the CPU's debug registers. Derived from 5 * "arch/x86/kernel/hw_breakpoint.c" 6 * 7 * Copyright 2010 IBM Corporation 8 * Author: K.Prasad <prasad@linux.vnet.ibm.com> 9 */ 10 11 #include <linux/hw_breakpoint.h> 12 #include <linux/notifier.h> 13 #include <linux/kprobes.h> 14 #include <linux/percpu.h> 15 #include <linux/kernel.h> 16 #include <linux/sched.h> 17 #include <linux/smp.h> 18 #include <linux/debugfs.h> 19 #include <linux/init.h> 20 21 #include <asm/hw_breakpoint.h> 22 #include <asm/processor.h> 23 #include <asm/sstep.h> 24 #include <asm/debug.h> 25 #include <asm/debugfs.h> 26 #include <asm/hvcall.h> 27 #include <linux/uaccess.h> 28 29 /* 30 * Stores the breakpoints currently in use on each breakpoint address 31 * register for every cpu 32 */ 33 static DEFINE_PER_CPU(struct perf_event *, bp_per_reg); 34 35 /* 36 * Returns total number of data or instruction breakpoints available. 37 */ 38 int hw_breakpoint_slots(int type) 39 { 40 if (type == TYPE_DATA) 41 return HBP_NUM; 42 return 0; /* no instruction breakpoints available */ 43 } 44 45 /* 46 * Install a perf counter breakpoint. 47 * 48 * We seek a free debug address register and use it for this 49 * breakpoint. 50 * 51 * Atomic: we hold the counter->ctx->lock and we only handle variables 52 * and registers local to this cpu. 53 */ 54 int arch_install_hw_breakpoint(struct perf_event *bp) 55 { 56 struct arch_hw_breakpoint *info = counter_arch_bp(bp); 57 struct perf_event **slot = this_cpu_ptr(&bp_per_reg); 58 59 *slot = bp; 60 61 /* 62 * Do not install DABR values if the instruction must be single-stepped. 63 * If so, DABR will be populated in single_step_dabr_instruction(). 64 */ 65 if (current->thread.last_hit_ubp != bp) 66 __set_breakpoint(info); 67 68 return 0; 69 } 70 71 /* 72 * Uninstall the breakpoint contained in the given counter. 73 * 74 * First we search the debug address register it uses and then we disable 75 * it. 76 * 77 * Atomic: we hold the counter->ctx->lock and we only handle variables 78 * and registers local to this cpu. 79 */ 80 void arch_uninstall_hw_breakpoint(struct perf_event *bp) 81 { 82 struct perf_event **slot = this_cpu_ptr(&bp_per_reg); 83 84 if (*slot != bp) { 85 WARN_ONCE(1, "Can't find the breakpoint"); 86 return; 87 } 88 89 *slot = NULL; 90 hw_breakpoint_disable(); 91 } 92 93 /* 94 * Perform cleanup of arch-specific counters during unregistration 95 * of the perf-event 96 */ 97 void arch_unregister_hw_breakpoint(struct perf_event *bp) 98 { 99 /* 100 * If the breakpoint is unregistered between a hw_breakpoint_handler() 101 * and the single_step_dabr_instruction(), then cleanup the breakpoint 102 * restoration variables to prevent dangling pointers. 103 * FIXME, this should not be using bp->ctx at all! Sayeth peterz. 104 */ 105 if (bp->ctx && bp->ctx->task && bp->ctx->task != ((void *)-1L)) 106 bp->ctx->task->thread.last_hit_ubp = NULL; 107 } 108 109 /* 110 * Check for virtual address in kernel space. 111 */ 112 int arch_check_bp_in_kernelspace(struct arch_hw_breakpoint *hw) 113 { 114 return is_kernel_addr(hw->address); 115 } 116 117 int arch_bp_generic_fields(int type, int *gen_bp_type) 118 { 119 *gen_bp_type = 0; 120 if (type & HW_BRK_TYPE_READ) 121 *gen_bp_type |= HW_BREAKPOINT_R; 122 if (type & HW_BRK_TYPE_WRITE) 123 *gen_bp_type |= HW_BREAKPOINT_W; 124 if (*gen_bp_type == 0) 125 return -EINVAL; 126 return 0; 127 } 128 129 /* 130 * Watchpoint match range is always doubleword(8 bytes) aligned on 131 * powerpc. If the given range is crossing doubleword boundary, we 132 * need to increase the length such that next doubleword also get 133 * covered. Ex, 134 * 135 * address len = 6 bytes 136 * |=========. 137 * |------------v--|------v--------| 138 * | | | | | | | | | | | | | | | | | 139 * |---------------|---------------| 140 * <---8 bytes---> 141 * 142 * In this case, we should configure hw as: 143 * start_addr = address & ~HW_BREAKPOINT_ALIGN 144 * len = 16 bytes 145 * 146 * @start_addr and @end_addr are inclusive. 147 */ 148 static int hw_breakpoint_validate_len(struct arch_hw_breakpoint *hw) 149 { 150 u16 max_len = DABR_MAX_LEN; 151 u16 hw_len; 152 unsigned long start_addr, end_addr; 153 154 start_addr = hw->address & ~HW_BREAKPOINT_ALIGN; 155 end_addr = (hw->address + hw->len - 1) | HW_BREAKPOINT_ALIGN; 156 hw_len = end_addr - start_addr + 1; 157 158 if (dawr_enabled()) { 159 max_len = DAWR_MAX_LEN; 160 /* DAWR region can't cross 512 bytes boundary */ 161 if ((start_addr >> 9) != (end_addr >> 9)) 162 return -EINVAL; 163 } 164 165 if (hw_len > max_len) 166 return -EINVAL; 167 168 hw->hw_len = hw_len; 169 return 0; 170 } 171 172 /* 173 * Validate the arch-specific HW Breakpoint register settings 174 */ 175 int hw_breakpoint_arch_parse(struct perf_event *bp, 176 const struct perf_event_attr *attr, 177 struct arch_hw_breakpoint *hw) 178 { 179 int ret = -EINVAL; 180 181 if (!bp || !attr->bp_len) 182 return ret; 183 184 hw->type = HW_BRK_TYPE_TRANSLATE; 185 if (attr->bp_type & HW_BREAKPOINT_R) 186 hw->type |= HW_BRK_TYPE_READ; 187 if (attr->bp_type & HW_BREAKPOINT_W) 188 hw->type |= HW_BRK_TYPE_WRITE; 189 if (hw->type == HW_BRK_TYPE_TRANSLATE) 190 /* must set alteast read or write */ 191 return ret; 192 if (!attr->exclude_user) 193 hw->type |= HW_BRK_TYPE_USER; 194 if (!attr->exclude_kernel) 195 hw->type |= HW_BRK_TYPE_KERNEL; 196 if (!attr->exclude_hv) 197 hw->type |= HW_BRK_TYPE_HYP; 198 hw->address = attr->bp_addr; 199 hw->len = attr->bp_len; 200 201 if (!ppc_breakpoint_available()) 202 return -ENODEV; 203 204 return hw_breakpoint_validate_len(hw); 205 } 206 207 /* 208 * Restores the breakpoint on the debug registers. 209 * Invoke this function if it is known that the execution context is 210 * about to change to cause loss of MSR_SE settings. 211 */ 212 void thread_change_pc(struct task_struct *tsk, struct pt_regs *regs) 213 { 214 struct arch_hw_breakpoint *info; 215 216 if (likely(!tsk->thread.last_hit_ubp)) 217 return; 218 219 info = counter_arch_bp(tsk->thread.last_hit_ubp); 220 regs->msr &= ~MSR_SE; 221 __set_breakpoint(info); 222 tsk->thread.last_hit_ubp = NULL; 223 } 224 225 static bool dar_within_range(unsigned long dar, struct arch_hw_breakpoint *info) 226 { 227 return ((info->address <= dar) && (dar - info->address < info->len)); 228 } 229 230 static bool 231 dar_range_overlaps(unsigned long dar, int size, struct arch_hw_breakpoint *info) 232 { 233 return ((dar <= info->address + info->len - 1) && 234 (dar + size - 1 >= info->address)); 235 } 236 237 /* 238 * Handle debug exception notifications. 239 */ 240 static bool stepping_handler(struct pt_regs *regs, struct perf_event *bp, 241 struct arch_hw_breakpoint *info) 242 { 243 unsigned int instr = 0; 244 int ret, type, size; 245 struct instruction_op op; 246 unsigned long addr = info->address; 247 248 if (__get_user_inatomic(instr, (unsigned int *)regs->nip)) 249 goto fail; 250 251 ret = analyse_instr(&op, regs, instr); 252 type = GETTYPE(op.type); 253 size = GETSIZE(op.type); 254 255 if (!ret && (type == LARX || type == STCX)) { 256 printk_ratelimited("Breakpoint hit on instruction that can't be emulated." 257 " Breakpoint at 0x%lx will be disabled.\n", addr); 258 goto disable; 259 } 260 261 /* 262 * If it's extraneous event, we still need to emulate/single- 263 * step the instruction, but we don't generate an event. 264 */ 265 if (size && !dar_range_overlaps(regs->dar, size, info)) 266 info->type |= HW_BRK_TYPE_EXTRANEOUS_IRQ; 267 268 /* Do not emulate user-space instructions, instead single-step them */ 269 if (user_mode(regs)) { 270 current->thread.last_hit_ubp = bp; 271 regs->msr |= MSR_SE; 272 return false; 273 } 274 275 if (!emulate_step(regs, instr)) 276 goto fail; 277 278 return true; 279 280 fail: 281 /* 282 * We've failed in reliably handling the hw-breakpoint. Unregister 283 * it and throw a warning message to let the user know about it. 284 */ 285 WARN(1, "Unable to handle hardware breakpoint. Breakpoint at " 286 "0x%lx will be disabled.", addr); 287 288 disable: 289 perf_event_disable_inatomic(bp); 290 return false; 291 } 292 293 int hw_breakpoint_handler(struct die_args *args) 294 { 295 int rc = NOTIFY_STOP; 296 struct perf_event *bp; 297 struct pt_regs *regs = args->regs; 298 struct arch_hw_breakpoint *info; 299 300 /* Disable breakpoints during exception handling */ 301 hw_breakpoint_disable(); 302 303 /* 304 * The counter may be concurrently released but that can only 305 * occur from a call_rcu() path. We can then safely fetch 306 * the breakpoint, use its callback, touch its counter 307 * while we are in an rcu_read_lock() path. 308 */ 309 rcu_read_lock(); 310 311 bp = __this_cpu_read(bp_per_reg); 312 if (!bp) { 313 rc = NOTIFY_DONE; 314 goto out; 315 } 316 info = counter_arch_bp(bp); 317 318 /* 319 * Return early after invoking user-callback function without restoring 320 * DABR if the breakpoint is from ptrace which always operates in 321 * one-shot mode. The ptrace-ed process will receive the SIGTRAP signal 322 * generated in do_dabr(). 323 */ 324 if (bp->overflow_handler == ptrace_triggered) { 325 perf_bp_event(bp, regs); 326 rc = NOTIFY_DONE; 327 goto out; 328 } 329 330 info->type &= ~HW_BRK_TYPE_EXTRANEOUS_IRQ; 331 if (IS_ENABLED(CONFIG_PPC_8xx)) { 332 if (!dar_within_range(regs->dar, info)) 333 info->type |= HW_BRK_TYPE_EXTRANEOUS_IRQ; 334 } else { 335 if (!stepping_handler(regs, bp, info)) 336 goto out; 337 } 338 339 /* 340 * As a policy, the callback is invoked in a 'trigger-after-execute' 341 * fashion 342 */ 343 if (!(info->type & HW_BRK_TYPE_EXTRANEOUS_IRQ)) 344 perf_bp_event(bp, regs); 345 346 __set_breakpoint(info); 347 out: 348 rcu_read_unlock(); 349 return rc; 350 } 351 NOKPROBE_SYMBOL(hw_breakpoint_handler); 352 353 /* 354 * Handle single-step exceptions following a DABR hit. 355 */ 356 static int single_step_dabr_instruction(struct die_args *args) 357 { 358 struct pt_regs *regs = args->regs; 359 struct perf_event *bp = NULL; 360 struct arch_hw_breakpoint *info; 361 362 bp = current->thread.last_hit_ubp; 363 /* 364 * Check if we are single-stepping as a result of a 365 * previous HW Breakpoint exception 366 */ 367 if (!bp) 368 return NOTIFY_DONE; 369 370 info = counter_arch_bp(bp); 371 372 /* 373 * We shall invoke the user-defined callback function in the single 374 * stepping handler to confirm to 'trigger-after-execute' semantics 375 */ 376 if (!(info->type & HW_BRK_TYPE_EXTRANEOUS_IRQ)) 377 perf_bp_event(bp, regs); 378 379 __set_breakpoint(info); 380 current->thread.last_hit_ubp = NULL; 381 382 /* 383 * If the process was being single-stepped by ptrace, let the 384 * other single-step actions occur (e.g. generate SIGTRAP). 385 */ 386 if (test_thread_flag(TIF_SINGLESTEP)) 387 return NOTIFY_DONE; 388 389 return NOTIFY_STOP; 390 } 391 NOKPROBE_SYMBOL(single_step_dabr_instruction); 392 393 /* 394 * Handle debug exception notifications. 395 */ 396 int hw_breakpoint_exceptions_notify( 397 struct notifier_block *unused, unsigned long val, void *data) 398 { 399 int ret = NOTIFY_DONE; 400 401 switch (val) { 402 case DIE_DABR_MATCH: 403 ret = hw_breakpoint_handler(data); 404 break; 405 case DIE_SSTEP: 406 ret = single_step_dabr_instruction(data); 407 break; 408 } 409 410 return ret; 411 } 412 NOKPROBE_SYMBOL(hw_breakpoint_exceptions_notify); 413 414 /* 415 * Release the user breakpoints used by ptrace 416 */ 417 void flush_ptrace_hw_breakpoint(struct task_struct *tsk) 418 { 419 struct thread_struct *t = &tsk->thread; 420 421 unregister_hw_breakpoint(t->ptrace_bps[0]); 422 t->ptrace_bps[0] = NULL; 423 } 424 425 void hw_breakpoint_pmu_read(struct perf_event *bp) 426 { 427 /* TODO */ 428 } 429