1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * HW_breakpoint: a unified kernel/user-space hardware breakpoint facility, 4 * using the CPU's debug registers. Derived from 5 * "arch/x86/kernel/hw_breakpoint.c" 6 * 7 * Copyright 2010 IBM Corporation 8 * Author: K.Prasad <prasad@linux.vnet.ibm.com> 9 */ 10 11 #include <linux/hw_breakpoint.h> 12 #include <linux/notifier.h> 13 #include <linux/kprobes.h> 14 #include <linux/percpu.h> 15 #include <linux/kernel.h> 16 #include <linux/sched.h> 17 #include <linux/smp.h> 18 #include <linux/debugfs.h> 19 #include <linux/init.h> 20 21 #include <asm/hw_breakpoint.h> 22 #include <asm/processor.h> 23 #include <asm/sstep.h> 24 #include <asm/debug.h> 25 #include <asm/debugfs.h> 26 #include <asm/hvcall.h> 27 #include <linux/uaccess.h> 28 29 /* 30 * Stores the breakpoints currently in use on each breakpoint address 31 * register for every cpu 32 */ 33 static DEFINE_PER_CPU(struct perf_event *, bp_per_reg); 34 35 /* 36 * Returns total number of data or instruction breakpoints available. 37 */ 38 int hw_breakpoint_slots(int type) 39 { 40 if (type == TYPE_DATA) 41 return HBP_NUM; 42 return 0; /* no instruction breakpoints available */ 43 } 44 45 /* 46 * Install a perf counter breakpoint. 47 * 48 * We seek a free debug address register and use it for this 49 * breakpoint. 50 * 51 * Atomic: we hold the counter->ctx->lock and we only handle variables 52 * and registers local to this cpu. 53 */ 54 int arch_install_hw_breakpoint(struct perf_event *bp) 55 { 56 struct arch_hw_breakpoint *info = counter_arch_bp(bp); 57 struct perf_event **slot = this_cpu_ptr(&bp_per_reg); 58 59 *slot = bp; 60 61 /* 62 * Do not install DABR values if the instruction must be single-stepped. 63 * If so, DABR will be populated in single_step_dabr_instruction(). 64 */ 65 if (current->thread.last_hit_ubp != bp) 66 __set_breakpoint(info); 67 68 return 0; 69 } 70 71 /* 72 * Uninstall the breakpoint contained in the given counter. 73 * 74 * First we search the debug address register it uses and then we disable 75 * it. 76 * 77 * Atomic: we hold the counter->ctx->lock and we only handle variables 78 * and registers local to this cpu. 79 */ 80 void arch_uninstall_hw_breakpoint(struct perf_event *bp) 81 { 82 struct perf_event **slot = this_cpu_ptr(&bp_per_reg); 83 84 if (*slot != bp) { 85 WARN_ONCE(1, "Can't find the breakpoint"); 86 return; 87 } 88 89 *slot = NULL; 90 hw_breakpoint_disable(); 91 } 92 93 /* 94 * Perform cleanup of arch-specific counters during unregistration 95 * of the perf-event 96 */ 97 void arch_unregister_hw_breakpoint(struct perf_event *bp) 98 { 99 /* 100 * If the breakpoint is unregistered between a hw_breakpoint_handler() 101 * and the single_step_dabr_instruction(), then cleanup the breakpoint 102 * restoration variables to prevent dangling pointers. 103 * FIXME, this should not be using bp->ctx at all! Sayeth peterz. 104 */ 105 if (bp->ctx && bp->ctx->task && bp->ctx->task != ((void *)-1L)) 106 bp->ctx->task->thread.last_hit_ubp = NULL; 107 } 108 109 /* 110 * Check for virtual address in kernel space. 111 */ 112 int arch_check_bp_in_kernelspace(struct arch_hw_breakpoint *hw) 113 { 114 return is_kernel_addr(hw->address); 115 } 116 117 int arch_bp_generic_fields(int type, int *gen_bp_type) 118 { 119 *gen_bp_type = 0; 120 if (type & HW_BRK_TYPE_READ) 121 *gen_bp_type |= HW_BREAKPOINT_R; 122 if (type & HW_BRK_TYPE_WRITE) 123 *gen_bp_type |= HW_BREAKPOINT_W; 124 if (*gen_bp_type == 0) 125 return -EINVAL; 126 return 0; 127 } 128 129 /* 130 * Watchpoint match range is always doubleword(8 bytes) aligned on 131 * powerpc. If the given range is crossing doubleword boundary, we 132 * need to increase the length such that next doubleword also get 133 * covered. Ex, 134 * 135 * address len = 6 bytes 136 * |=========. 137 * |------------v--|------v--------| 138 * | | | | | | | | | | | | | | | | | 139 * |---------------|---------------| 140 * <---8 bytes---> 141 * 142 * In this case, we should configure hw as: 143 * start_addr = address & ~HW_BREAKPOINT_ALIGN 144 * len = 16 bytes 145 * 146 * @start_addr and @end_addr are inclusive. 147 */ 148 static int hw_breakpoint_validate_len(struct arch_hw_breakpoint *hw) 149 { 150 u16 max_len = DABR_MAX_LEN; 151 u16 hw_len; 152 unsigned long start_addr, end_addr; 153 154 start_addr = hw->address & ~HW_BREAKPOINT_ALIGN; 155 end_addr = (hw->address + hw->len - 1) | HW_BREAKPOINT_ALIGN; 156 hw_len = end_addr - start_addr + 1; 157 158 if (dawr_enabled()) { 159 max_len = DAWR_MAX_LEN; 160 /* DAWR region can't cross 512 bytes boundary */ 161 if ((start_addr >> 9) != (end_addr >> 9)) 162 return -EINVAL; 163 } else if (IS_ENABLED(CONFIG_PPC_8xx)) { 164 /* 8xx can setup a range without limitation */ 165 max_len = U16_MAX; 166 } 167 168 if (hw_len > max_len) 169 return -EINVAL; 170 171 hw->hw_len = hw_len; 172 return 0; 173 } 174 175 /* 176 * Validate the arch-specific HW Breakpoint register settings 177 */ 178 int hw_breakpoint_arch_parse(struct perf_event *bp, 179 const struct perf_event_attr *attr, 180 struct arch_hw_breakpoint *hw) 181 { 182 int ret = -EINVAL; 183 184 if (!bp || !attr->bp_len) 185 return ret; 186 187 hw->type = HW_BRK_TYPE_TRANSLATE; 188 if (attr->bp_type & HW_BREAKPOINT_R) 189 hw->type |= HW_BRK_TYPE_READ; 190 if (attr->bp_type & HW_BREAKPOINT_W) 191 hw->type |= HW_BRK_TYPE_WRITE; 192 if (hw->type == HW_BRK_TYPE_TRANSLATE) 193 /* must set alteast read or write */ 194 return ret; 195 if (!attr->exclude_user) 196 hw->type |= HW_BRK_TYPE_USER; 197 if (!attr->exclude_kernel) 198 hw->type |= HW_BRK_TYPE_KERNEL; 199 if (!attr->exclude_hv) 200 hw->type |= HW_BRK_TYPE_HYP; 201 hw->address = attr->bp_addr; 202 hw->len = attr->bp_len; 203 204 if (!ppc_breakpoint_available()) 205 return -ENODEV; 206 207 return hw_breakpoint_validate_len(hw); 208 } 209 210 /* 211 * Restores the breakpoint on the debug registers. 212 * Invoke this function if it is known that the execution context is 213 * about to change to cause loss of MSR_SE settings. 214 */ 215 void thread_change_pc(struct task_struct *tsk, struct pt_regs *regs) 216 { 217 struct arch_hw_breakpoint *info; 218 219 if (likely(!tsk->thread.last_hit_ubp)) 220 return; 221 222 info = counter_arch_bp(tsk->thread.last_hit_ubp); 223 regs->msr &= ~MSR_SE; 224 __set_breakpoint(info); 225 tsk->thread.last_hit_ubp = NULL; 226 } 227 228 static bool dar_within_range(unsigned long dar, struct arch_hw_breakpoint *info) 229 { 230 return ((info->address <= dar) && (dar - info->address < info->len)); 231 } 232 233 static bool 234 dar_range_overlaps(unsigned long dar, int size, struct arch_hw_breakpoint *info) 235 { 236 return ((dar <= info->address + info->len - 1) && 237 (dar + size - 1 >= info->address)); 238 } 239 240 /* 241 * Handle debug exception notifications. 242 */ 243 static bool stepping_handler(struct pt_regs *regs, struct perf_event *bp, 244 struct arch_hw_breakpoint *info) 245 { 246 unsigned int instr = 0; 247 int ret, type, size; 248 struct instruction_op op; 249 unsigned long addr = info->address; 250 251 if (__get_user_inatomic(instr, (unsigned int *)regs->nip)) 252 goto fail; 253 254 ret = analyse_instr(&op, regs, instr); 255 type = GETTYPE(op.type); 256 size = GETSIZE(op.type); 257 258 if (!ret && (type == LARX || type == STCX)) { 259 printk_ratelimited("Breakpoint hit on instruction that can't be emulated." 260 " Breakpoint at 0x%lx will be disabled.\n", addr); 261 goto disable; 262 } 263 264 /* 265 * If it's extraneous event, we still need to emulate/single- 266 * step the instruction, but we don't generate an event. 267 */ 268 if (size && !dar_range_overlaps(regs->dar, size, info)) 269 info->type |= HW_BRK_TYPE_EXTRANEOUS_IRQ; 270 271 /* Do not emulate user-space instructions, instead single-step them */ 272 if (user_mode(regs)) { 273 current->thread.last_hit_ubp = bp; 274 regs->msr |= MSR_SE; 275 return false; 276 } 277 278 if (!emulate_step(regs, instr)) 279 goto fail; 280 281 return true; 282 283 fail: 284 /* 285 * We've failed in reliably handling the hw-breakpoint. Unregister 286 * it and throw a warning message to let the user know about it. 287 */ 288 WARN(1, "Unable to handle hardware breakpoint. Breakpoint at " 289 "0x%lx will be disabled.", addr); 290 291 disable: 292 perf_event_disable_inatomic(bp); 293 return false; 294 } 295 296 int hw_breakpoint_handler(struct die_args *args) 297 { 298 int rc = NOTIFY_STOP; 299 struct perf_event *bp; 300 struct pt_regs *regs = args->regs; 301 struct arch_hw_breakpoint *info; 302 303 /* Disable breakpoints during exception handling */ 304 hw_breakpoint_disable(); 305 306 /* 307 * The counter may be concurrently released but that can only 308 * occur from a call_rcu() path. We can then safely fetch 309 * the breakpoint, use its callback, touch its counter 310 * while we are in an rcu_read_lock() path. 311 */ 312 rcu_read_lock(); 313 314 bp = __this_cpu_read(bp_per_reg); 315 if (!bp) { 316 rc = NOTIFY_DONE; 317 goto out; 318 } 319 info = counter_arch_bp(bp); 320 321 /* 322 * Return early after invoking user-callback function without restoring 323 * DABR if the breakpoint is from ptrace which always operates in 324 * one-shot mode. The ptrace-ed process will receive the SIGTRAP signal 325 * generated in do_dabr(). 326 */ 327 if (bp->overflow_handler == ptrace_triggered) { 328 perf_bp_event(bp, regs); 329 rc = NOTIFY_DONE; 330 goto out; 331 } 332 333 info->type &= ~HW_BRK_TYPE_EXTRANEOUS_IRQ; 334 if (!dar_within_range(regs->dar, info)) 335 info->type |= HW_BRK_TYPE_EXTRANEOUS_IRQ; 336 337 if (!IS_ENABLED(CONFIG_PPC_8xx) && !stepping_handler(regs, bp, info)) 338 goto out; 339 340 /* 341 * As a policy, the callback is invoked in a 'trigger-after-execute' 342 * fashion 343 */ 344 if (!(info->type & HW_BRK_TYPE_EXTRANEOUS_IRQ)) 345 perf_bp_event(bp, regs); 346 347 __set_breakpoint(info); 348 out: 349 rcu_read_unlock(); 350 return rc; 351 } 352 NOKPROBE_SYMBOL(hw_breakpoint_handler); 353 354 /* 355 * Handle single-step exceptions following a DABR hit. 356 */ 357 static int single_step_dabr_instruction(struct die_args *args) 358 { 359 struct pt_regs *regs = args->regs; 360 struct perf_event *bp = NULL; 361 struct arch_hw_breakpoint *info; 362 363 bp = current->thread.last_hit_ubp; 364 /* 365 * Check if we are single-stepping as a result of a 366 * previous HW Breakpoint exception 367 */ 368 if (!bp) 369 return NOTIFY_DONE; 370 371 info = counter_arch_bp(bp); 372 373 /* 374 * We shall invoke the user-defined callback function in the single 375 * stepping handler to confirm to 'trigger-after-execute' semantics 376 */ 377 if (!(info->type & HW_BRK_TYPE_EXTRANEOUS_IRQ)) 378 perf_bp_event(bp, regs); 379 380 __set_breakpoint(info); 381 current->thread.last_hit_ubp = NULL; 382 383 /* 384 * If the process was being single-stepped by ptrace, let the 385 * other single-step actions occur (e.g. generate SIGTRAP). 386 */ 387 if (test_thread_flag(TIF_SINGLESTEP)) 388 return NOTIFY_DONE; 389 390 return NOTIFY_STOP; 391 } 392 NOKPROBE_SYMBOL(single_step_dabr_instruction); 393 394 /* 395 * Handle debug exception notifications. 396 */ 397 int hw_breakpoint_exceptions_notify( 398 struct notifier_block *unused, unsigned long val, void *data) 399 { 400 int ret = NOTIFY_DONE; 401 402 switch (val) { 403 case DIE_DABR_MATCH: 404 ret = hw_breakpoint_handler(data); 405 break; 406 case DIE_SSTEP: 407 ret = single_step_dabr_instruction(data); 408 break; 409 } 410 411 return ret; 412 } 413 NOKPROBE_SYMBOL(hw_breakpoint_exceptions_notify); 414 415 /* 416 * Release the user breakpoints used by ptrace 417 */ 418 void flush_ptrace_hw_breakpoint(struct task_struct *tsk) 419 { 420 struct thread_struct *t = &tsk->thread; 421 422 unregister_hw_breakpoint(t->ptrace_bps[0]); 423 t->ptrace_bps[0] = NULL; 424 } 425 426 void hw_breakpoint_pmu_read(struct perf_event *bp) 427 { 428 /* TODO */ 429 } 430