1 /* 2 * This program is free software; you can redistribute it and/or modify 3 * it under the terms of the GNU General Public License as published by 4 * the Free Software Foundation; either version 2 of the License, or 5 * (at your option) any later version. 6 * 7 * This program is distributed in the hope that it will be useful, 8 * but WITHOUT ANY WARRANTY; without even the implied warranty of 9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 10 * GNU General Public License for more details. 11 * 12 * You should have received a copy of the GNU General Public License 13 * along with this program; if not, write to the Free Software 14 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. 15 * 16 * Copyright (C) 2007 Alan Stern 17 * Copyright (C) 2009 IBM Corporation 18 */ 19 20 /* 21 * HW_breakpoint: a unified kernel/user-space hardware breakpoint facility, 22 * using the CPU's debug registers. 23 */ 24 25 #include <linux/irqflags.h> 26 #include <linux/notifier.h> 27 #include <linux/kallsyms.h> 28 #include <linux/kprobes.h> 29 #include <linux/percpu.h> 30 #include <linux/kdebug.h> 31 #include <linux/kernel.h> 32 #include <linux/module.h> 33 #include <linux/sched.h> 34 #include <linux/init.h> 35 #include <linux/smp.h> 36 37 #include <asm/hw_breakpoint.h> 38 #include <asm/processor.h> 39 #include <asm/debugreg.h> 40 41 /* Unmasked kernel DR7 value */ 42 static unsigned long kdr7; 43 44 /* 45 * Masks for the bits corresponding to registers DR0 - DR3 in DR7 register. 46 * Used to clear and verify the status of bits corresponding to DR0 - DR3 47 */ 48 static const unsigned long dr7_masks[HBP_NUM] = { 49 0x000f0003, /* LEN0, R/W0, G0, L0 */ 50 0x00f0000c, /* LEN1, R/W1, G1, L1 */ 51 0x0f000030, /* LEN2, R/W2, G2, L2 */ 52 0xf00000c0 /* LEN3, R/W3, G3, L3 */ 53 }; 54 55 56 /* 57 * Encode the length, type, Exact, and Enable bits for a particular breakpoint 58 * as stored in debug register 7. 59 */ 60 static unsigned long encode_dr7(int drnum, unsigned int len, unsigned int type) 61 { 62 unsigned long bp_info; 63 64 bp_info = (len | type) & 0xf; 65 bp_info <<= (DR_CONTROL_SHIFT + drnum * DR_CONTROL_SIZE); 66 bp_info |= (DR_GLOBAL_ENABLE << (drnum * DR_ENABLE_SIZE)) | 67 DR_GLOBAL_SLOWDOWN; 68 return bp_info; 69 } 70 71 void arch_update_kernel_hw_breakpoint(void *unused) 72 { 73 struct hw_breakpoint *bp; 74 int i, cpu = get_cpu(); 75 unsigned long temp_kdr7 = 0; 76 77 /* Don't allow debug exceptions while we update the registers */ 78 set_debugreg(0UL, 7); 79 80 for (i = hbp_kernel_pos; i < HBP_NUM; i++) { 81 per_cpu(this_hbp_kernel[i], cpu) = bp = hbp_kernel[i]; 82 if (bp) { 83 temp_kdr7 |= encode_dr7(i, bp->info.len, bp->info.type); 84 set_debugreg(bp->info.address, i); 85 } 86 } 87 88 /* No need to set DR6. Update the debug registers with kernel-space 89 * breakpoint values from kdr7 and user-space requests from the 90 * current process 91 */ 92 kdr7 = temp_kdr7; 93 set_debugreg(kdr7 | current->thread.debugreg7, 7); 94 put_cpu(); 95 } 96 97 /* 98 * Install the thread breakpoints in their debug registers. 99 */ 100 void arch_install_thread_hw_breakpoint(struct task_struct *tsk) 101 { 102 struct thread_struct *thread = &(tsk->thread); 103 104 switch (hbp_kernel_pos) { 105 case 4: 106 set_debugreg(thread->debugreg[3], 3); 107 case 3: 108 set_debugreg(thread->debugreg[2], 2); 109 case 2: 110 set_debugreg(thread->debugreg[1], 1); 111 case 1: 112 set_debugreg(thread->debugreg[0], 0); 113 default: 114 break; 115 } 116 117 /* No need to set DR6 */ 118 set_debugreg((kdr7 | thread->debugreg7), 7); 119 } 120 121 /* 122 * Install the debug register values for just the kernel, no thread. 123 */ 124 void arch_uninstall_thread_hw_breakpoint(void) 125 { 126 /* Clear the user-space portion of debugreg7 by setting only kdr7 */ 127 set_debugreg(kdr7, 7); 128 129 } 130 131 static int get_hbp_len(u8 hbp_len) 132 { 133 unsigned int len_in_bytes = 0; 134 135 switch (hbp_len) { 136 case HW_BREAKPOINT_LEN_1: 137 len_in_bytes = 1; 138 break; 139 case HW_BREAKPOINT_LEN_2: 140 len_in_bytes = 2; 141 break; 142 case HW_BREAKPOINT_LEN_4: 143 len_in_bytes = 4; 144 break; 145 #ifdef CONFIG_X86_64 146 case HW_BREAKPOINT_LEN_8: 147 len_in_bytes = 8; 148 break; 149 #endif 150 } 151 return len_in_bytes; 152 } 153 154 /* 155 * Check for virtual address in user space. 156 */ 157 int arch_check_va_in_userspace(unsigned long va, u8 hbp_len) 158 { 159 unsigned int len; 160 161 len = get_hbp_len(hbp_len); 162 163 return (va <= TASK_SIZE - len); 164 } 165 166 /* 167 * Check for virtual address in kernel space. 168 */ 169 static int arch_check_va_in_kernelspace(unsigned long va, u8 hbp_len) 170 { 171 unsigned int len; 172 173 len = get_hbp_len(hbp_len); 174 175 return (va >= TASK_SIZE) && ((va + len - 1) >= TASK_SIZE); 176 } 177 178 /* 179 * Store a breakpoint's encoded address, length, and type. 180 */ 181 static int arch_store_info(struct hw_breakpoint *bp, struct task_struct *tsk) 182 { 183 /* 184 * User-space requests will always have the address field populated 185 * Symbol names from user-space are rejected 186 */ 187 if (tsk && bp->info.name) 188 return -EINVAL; 189 /* 190 * For kernel-addresses, either the address or symbol name can be 191 * specified. 192 */ 193 if (bp->info.name) 194 bp->info.address = (unsigned long) 195 kallsyms_lookup_name(bp->info.name); 196 if (bp->info.address) 197 return 0; 198 return -EINVAL; 199 } 200 201 /* 202 * Validate the arch-specific HW Breakpoint register settings 203 */ 204 int arch_validate_hwbkpt_settings(struct hw_breakpoint *bp, 205 struct task_struct *tsk) 206 { 207 unsigned int align; 208 int ret = -EINVAL; 209 210 switch (bp->info.type) { 211 /* 212 * Ptrace-refactoring code 213 * For now, we'll allow instruction breakpoint only for user-space 214 * addresses 215 */ 216 case HW_BREAKPOINT_EXECUTE: 217 if ((!arch_check_va_in_userspace(bp->info.address, 218 bp->info.len)) && 219 bp->info.len != HW_BREAKPOINT_LEN_EXECUTE) 220 return ret; 221 break; 222 case HW_BREAKPOINT_WRITE: 223 break; 224 case HW_BREAKPOINT_RW: 225 break; 226 default: 227 return ret; 228 } 229 230 switch (bp->info.len) { 231 case HW_BREAKPOINT_LEN_1: 232 align = 0; 233 break; 234 case HW_BREAKPOINT_LEN_2: 235 align = 1; 236 break; 237 case HW_BREAKPOINT_LEN_4: 238 align = 3; 239 break; 240 #ifdef CONFIG_X86_64 241 case HW_BREAKPOINT_LEN_8: 242 align = 7; 243 break; 244 #endif 245 default: 246 return ret; 247 } 248 249 if (bp->triggered) 250 ret = arch_store_info(bp, tsk); 251 252 if (ret < 0) 253 return ret; 254 /* 255 * Check that the low-order bits of the address are appropriate 256 * for the alignment implied by len. 257 */ 258 if (bp->info.address & align) 259 return -EINVAL; 260 261 /* Check that the virtual address is in the proper range */ 262 if (tsk) { 263 if (!arch_check_va_in_userspace(bp->info.address, bp->info.len)) 264 return -EFAULT; 265 } else { 266 if (!arch_check_va_in_kernelspace(bp->info.address, 267 bp->info.len)) 268 return -EFAULT; 269 } 270 return 0; 271 } 272 273 void arch_update_user_hw_breakpoint(int pos, struct task_struct *tsk) 274 { 275 struct thread_struct *thread = &(tsk->thread); 276 struct hw_breakpoint *bp = thread->hbp[pos]; 277 278 thread->debugreg7 &= ~dr7_masks[pos]; 279 if (bp) { 280 thread->debugreg[pos] = bp->info.address; 281 thread->debugreg7 |= encode_dr7(pos, bp->info.len, 282 bp->info.type); 283 } else 284 thread->debugreg[pos] = 0; 285 } 286 287 void arch_flush_thread_hw_breakpoint(struct task_struct *tsk) 288 { 289 int i; 290 struct thread_struct *thread = &(tsk->thread); 291 292 thread->debugreg7 = 0; 293 for (i = 0; i < HBP_NUM; i++) 294 thread->debugreg[i] = 0; 295 } 296 297 /* 298 * Handle debug exception notifications. 299 * 300 * Return value is either NOTIFY_STOP or NOTIFY_DONE as explained below. 301 * 302 * NOTIFY_DONE returned if one of the following conditions is true. 303 * i) When the causative address is from user-space and the exception 304 * is a valid one, i.e. not triggered as a result of lazy debug register 305 * switching 306 * ii) When there are more bits than trap<n> set in DR6 register (such 307 * as BD, BS or BT) indicating that more than one debug condition is 308 * met and requires some more action in do_debug(). 309 * 310 * NOTIFY_STOP returned for all other cases 311 * 312 */ 313 static int __kprobes hw_breakpoint_handler(struct die_args *args) 314 { 315 int i, cpu, rc = NOTIFY_STOP; 316 struct hw_breakpoint *bp; 317 unsigned long dr7, dr6; 318 unsigned long *dr6_p; 319 320 /* The DR6 value is pointed by args->err */ 321 dr6_p = (unsigned long *)ERR_PTR(args->err); 322 dr6 = *dr6_p; 323 324 /* Do an early return if no trap bits are set in DR6 */ 325 if ((dr6 & DR_TRAP_BITS) == 0) 326 return NOTIFY_DONE; 327 328 /* Lazy debug register switching */ 329 if (!test_tsk_thread_flag(current, TIF_DEBUG)) 330 arch_uninstall_thread_hw_breakpoint(); 331 332 get_debugreg(dr7, 7); 333 /* Disable breakpoints during exception handling */ 334 set_debugreg(0UL, 7); 335 /* 336 * Assert that local interrupts are disabled 337 * Reset the DRn bits in the virtualized register value. 338 * The ptrace trigger routine will add in whatever is needed. 339 */ 340 current->thread.debugreg6 &= ~DR_TRAP_BITS; 341 cpu = get_cpu(); 342 343 /* Handle all the breakpoints that were triggered */ 344 for (i = 0; i < HBP_NUM; ++i) { 345 if (likely(!(dr6 & (DR_TRAP0 << i)))) 346 continue; 347 /* 348 * Find the corresponding hw_breakpoint structure and 349 * invoke its triggered callback. 350 */ 351 if (i >= hbp_kernel_pos) 352 bp = per_cpu(this_hbp_kernel[i], cpu); 353 else { 354 bp = current->thread.hbp[i]; 355 if (bp) 356 rc = NOTIFY_DONE; 357 } 358 /* 359 * Reset the 'i'th TRAP bit in dr6 to denote completion of 360 * exception handling 361 */ 362 (*dr6_p) &= ~(DR_TRAP0 << i); 363 /* 364 * bp can be NULL due to lazy debug register switching 365 * or due to the delay between updates of hbp_kernel_pos 366 * and this_hbp_kernel. 367 */ 368 if (!bp) 369 continue; 370 371 (bp->triggered)(bp, args->regs); 372 } 373 if (dr6 & (~DR_TRAP_BITS)) 374 rc = NOTIFY_DONE; 375 376 set_debugreg(dr7, 7); 377 put_cpu(); 378 return rc; 379 } 380 381 /* 382 * Handle debug exception notifications. 383 */ 384 int __kprobes hw_breakpoint_exceptions_notify( 385 struct notifier_block *unused, unsigned long val, void *data) 386 { 387 if (val != DIE_DEBUG) 388 return NOTIFY_DONE; 389 390 return hw_breakpoint_handler(data); 391 } 392