1 /* 2 * This program is free software; you can redistribute it and/or modify 3 * it under the terms of the GNU General Public License as published by 4 * the Free Software Foundation; either version 2 of the License, or 5 * (at your option) any later version. 6 * 7 * This program is distributed in the hope that it will be useful, 8 * but WITHOUT ANY WARRANTY; without even the implied warranty of 9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 10 * GNU General Public License for more details. 11 * 12 * You should have received a copy of the GNU General Public License 13 * along with this program; if not, write to the Free Software 14 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. 15 * 16 * Copyright (C) 2007 Alan Stern 17 * Copyright (C) 2009 IBM Corporation 18 * Copyright (C) 2009 Frederic Weisbecker <fweisbec@gmail.com> 19 * 20 * Authors: Alan Stern <stern@rowland.harvard.edu> 21 * K.Prasad <prasad@linux.vnet.ibm.com> 22 * Frederic Weisbecker <fweisbec@gmail.com> 23 */ 24 25 /* 26 * HW_breakpoint: a unified kernel/user-space hardware breakpoint facility, 27 * using the CPU's debug registers. 28 */ 29 30 #include <linux/perf_event.h> 31 #include <linux/hw_breakpoint.h> 32 #include <linux/irqflags.h> 33 #include <linux/notifier.h> 34 #include <linux/kallsyms.h> 35 #include <linux/percpu.h> 36 #include <linux/kdebug.h> 37 #include <linux/kernel.h> 38 #include <linux/module.h> 39 #include <linux/sched.h> 40 #include <linux/smp.h> 41 42 #include <asm/hw_breakpoint.h> 43 #include <asm/processor.h> 44 #include <asm/debugreg.h> 45 46 /* Per cpu debug control register value */ 47 DEFINE_PER_CPU(unsigned long, cpu_dr7); 48 EXPORT_PER_CPU_SYMBOL(cpu_dr7); 49 50 /* Per cpu debug address registers values */ 51 static DEFINE_PER_CPU(unsigned long, cpu_debugreg[HBP_NUM]); 52 53 /* 54 * Stores the breakpoints currently in use on each breakpoint address 55 * register for each cpus 56 */ 57 static DEFINE_PER_CPU(struct perf_event *, bp_per_reg[HBP_NUM]); 58 59 60 static inline unsigned long 61 __encode_dr7(int drnum, unsigned int len, unsigned int type) 62 { 63 unsigned long bp_info; 64 65 bp_info = (len | type) & 0xf; 66 bp_info <<= (DR_CONTROL_SHIFT + drnum * DR_CONTROL_SIZE); 67 bp_info |= (DR_GLOBAL_ENABLE << (drnum * DR_ENABLE_SIZE)); 68 69 return bp_info; 70 } 71 72 /* 73 * Encode the length, type, Exact, and Enable bits for a particular breakpoint 74 * as stored in debug register 7. 75 */ 76 unsigned long encode_dr7(int drnum, unsigned int len, unsigned int type) 77 { 78 return __encode_dr7(drnum, len, type) | DR_GLOBAL_SLOWDOWN; 79 } 80 81 /* 82 * Decode the length and type bits for a particular breakpoint as 83 * stored in debug register 7. Return the "enabled" status. 84 */ 85 int decode_dr7(unsigned long dr7, int bpnum, unsigned *len, unsigned *type) 86 { 87 int bp_info = dr7 >> (DR_CONTROL_SHIFT + bpnum * DR_CONTROL_SIZE); 88 89 *len = (bp_info & 0xc) | 0x40; 90 *type = (bp_info & 0x3) | 0x80; 91 92 return (dr7 >> (bpnum * DR_ENABLE_SIZE)) & 0x3; 93 } 94 95 /* 96 * Install a perf counter breakpoint. 97 * 98 * We seek a free debug address register and use it for this 99 * breakpoint. Eventually we enable it in the debug control register. 100 * 101 * Atomic: we hold the counter->ctx->lock and we only handle variables 102 * and registers local to this cpu. 103 */ 104 int arch_install_hw_breakpoint(struct perf_event *bp) 105 { 106 struct arch_hw_breakpoint *info = counter_arch_bp(bp); 107 unsigned long *dr7; 108 int i; 109 110 for (i = 0; i < HBP_NUM; i++) { 111 struct perf_event **slot = this_cpu_ptr(&bp_per_reg[i]); 112 113 if (!*slot) { 114 *slot = bp; 115 break; 116 } 117 } 118 119 if (WARN_ONCE(i == HBP_NUM, "Can't find any breakpoint slot")) 120 return -EBUSY; 121 122 set_debugreg(info->address, i); 123 __this_cpu_write(cpu_debugreg[i], info->address); 124 125 dr7 = this_cpu_ptr(&cpu_dr7); 126 *dr7 |= encode_dr7(i, info->len, info->type); 127 128 set_debugreg(*dr7, 7); 129 if (info->mask) 130 set_dr_addr_mask(info->mask, i); 131 132 return 0; 133 } 134 135 /* 136 * Uninstall the breakpoint contained in the given counter. 137 * 138 * First we search the debug address register it uses and then we disable 139 * it. 140 * 141 * Atomic: we hold the counter->ctx->lock and we only handle variables 142 * and registers local to this cpu. 143 */ 144 void arch_uninstall_hw_breakpoint(struct perf_event *bp) 145 { 146 struct arch_hw_breakpoint *info = counter_arch_bp(bp); 147 unsigned long *dr7; 148 int i; 149 150 for (i = 0; i < HBP_NUM; i++) { 151 struct perf_event **slot = this_cpu_ptr(&bp_per_reg[i]); 152 153 if (*slot == bp) { 154 *slot = NULL; 155 break; 156 } 157 } 158 159 if (WARN_ONCE(i == HBP_NUM, "Can't find any breakpoint slot")) 160 return; 161 162 dr7 = this_cpu_ptr(&cpu_dr7); 163 *dr7 &= ~__encode_dr7(i, info->len, info->type); 164 165 set_debugreg(*dr7, 7); 166 if (info->mask) 167 set_dr_addr_mask(0, i); 168 } 169 170 static int get_hbp_len(u8 hbp_len) 171 { 172 unsigned int len_in_bytes = 0; 173 174 switch (hbp_len) { 175 case X86_BREAKPOINT_LEN_1: 176 len_in_bytes = 1; 177 break; 178 case X86_BREAKPOINT_LEN_2: 179 len_in_bytes = 2; 180 break; 181 case X86_BREAKPOINT_LEN_4: 182 len_in_bytes = 4; 183 break; 184 #ifdef CONFIG_X86_64 185 case X86_BREAKPOINT_LEN_8: 186 len_in_bytes = 8; 187 break; 188 #endif 189 } 190 return len_in_bytes; 191 } 192 193 /* 194 * Check for virtual address in kernel space. 195 */ 196 int arch_check_bp_in_kernelspace(struct perf_event *bp) 197 { 198 unsigned int len; 199 unsigned long va; 200 struct arch_hw_breakpoint *info = counter_arch_bp(bp); 201 202 va = info->address; 203 len = get_hbp_len(info->len); 204 205 return (va >= TASK_SIZE) && ((va + len - 1) >= TASK_SIZE); 206 } 207 208 int arch_bp_generic_fields(int x86_len, int x86_type, 209 int *gen_len, int *gen_type) 210 { 211 /* Type */ 212 switch (x86_type) { 213 case X86_BREAKPOINT_EXECUTE: 214 if (x86_len != X86_BREAKPOINT_LEN_X) 215 return -EINVAL; 216 217 *gen_type = HW_BREAKPOINT_X; 218 *gen_len = sizeof(long); 219 return 0; 220 case X86_BREAKPOINT_WRITE: 221 *gen_type = HW_BREAKPOINT_W; 222 break; 223 case X86_BREAKPOINT_RW: 224 *gen_type = HW_BREAKPOINT_W | HW_BREAKPOINT_R; 225 break; 226 default: 227 return -EINVAL; 228 } 229 230 /* Len */ 231 switch (x86_len) { 232 case X86_BREAKPOINT_LEN_1: 233 *gen_len = HW_BREAKPOINT_LEN_1; 234 break; 235 case X86_BREAKPOINT_LEN_2: 236 *gen_len = HW_BREAKPOINT_LEN_2; 237 break; 238 case X86_BREAKPOINT_LEN_4: 239 *gen_len = HW_BREAKPOINT_LEN_4; 240 break; 241 #ifdef CONFIG_X86_64 242 case X86_BREAKPOINT_LEN_8: 243 *gen_len = HW_BREAKPOINT_LEN_8; 244 break; 245 #endif 246 default: 247 return -EINVAL; 248 } 249 250 return 0; 251 } 252 253 254 static int arch_build_bp_info(struct perf_event *bp) 255 { 256 struct arch_hw_breakpoint *info = counter_arch_bp(bp); 257 258 info->address = bp->attr.bp_addr; 259 260 /* Type */ 261 switch (bp->attr.bp_type) { 262 case HW_BREAKPOINT_W: 263 info->type = X86_BREAKPOINT_WRITE; 264 break; 265 case HW_BREAKPOINT_W | HW_BREAKPOINT_R: 266 info->type = X86_BREAKPOINT_RW; 267 break; 268 case HW_BREAKPOINT_X: 269 info->type = X86_BREAKPOINT_EXECUTE; 270 /* 271 * x86 inst breakpoints need to have a specific undefined len. 272 * But we still need to check userspace is not trying to setup 273 * an unsupported length, to get a range breakpoint for example. 274 */ 275 if (bp->attr.bp_len == sizeof(long)) { 276 info->len = X86_BREAKPOINT_LEN_X; 277 return 0; 278 } 279 default: 280 return -EINVAL; 281 } 282 283 /* Len */ 284 info->mask = 0; 285 286 switch (bp->attr.bp_len) { 287 case HW_BREAKPOINT_LEN_1: 288 info->len = X86_BREAKPOINT_LEN_1; 289 break; 290 case HW_BREAKPOINT_LEN_2: 291 info->len = X86_BREAKPOINT_LEN_2; 292 break; 293 case HW_BREAKPOINT_LEN_4: 294 info->len = X86_BREAKPOINT_LEN_4; 295 break; 296 #ifdef CONFIG_X86_64 297 case HW_BREAKPOINT_LEN_8: 298 info->len = X86_BREAKPOINT_LEN_8; 299 break; 300 #endif 301 default: 302 if (!is_power_of_2(bp->attr.bp_len)) 303 return -EINVAL; 304 if (!cpu_has_bpext) 305 return -EOPNOTSUPP; 306 info->mask = bp->attr.bp_len - 1; 307 info->len = X86_BREAKPOINT_LEN_1; 308 } 309 310 return 0; 311 } 312 313 /* 314 * Validate the arch-specific HW Breakpoint register settings 315 */ 316 int arch_validate_hwbkpt_settings(struct perf_event *bp) 317 { 318 struct arch_hw_breakpoint *info = counter_arch_bp(bp); 319 unsigned int align; 320 int ret; 321 322 323 ret = arch_build_bp_info(bp); 324 if (ret) 325 return ret; 326 327 switch (info->len) { 328 case X86_BREAKPOINT_LEN_1: 329 align = 0; 330 if (info->mask) 331 align = info->mask; 332 break; 333 case X86_BREAKPOINT_LEN_2: 334 align = 1; 335 break; 336 case X86_BREAKPOINT_LEN_4: 337 align = 3; 338 break; 339 #ifdef CONFIG_X86_64 340 case X86_BREAKPOINT_LEN_8: 341 align = 7; 342 break; 343 #endif 344 default: 345 WARN_ON_ONCE(1); 346 } 347 348 /* 349 * Check that the low-order bits of the address are appropriate 350 * for the alignment implied by len. 351 */ 352 if (info->address & align) 353 return -EINVAL; 354 355 return 0; 356 } 357 358 /* 359 * Dump the debug register contents to the user. 360 * We can't dump our per cpu values because it 361 * may contain cpu wide breakpoint, something that 362 * doesn't belong to the current task. 363 * 364 * TODO: include non-ptrace user breakpoints (perf) 365 */ 366 void aout_dump_debugregs(struct user *dump) 367 { 368 int i; 369 int dr7 = 0; 370 struct perf_event *bp; 371 struct arch_hw_breakpoint *info; 372 struct thread_struct *thread = ¤t->thread; 373 374 for (i = 0; i < HBP_NUM; i++) { 375 bp = thread->ptrace_bps[i]; 376 377 if (bp && !bp->attr.disabled) { 378 dump->u_debugreg[i] = bp->attr.bp_addr; 379 info = counter_arch_bp(bp); 380 dr7 |= encode_dr7(i, info->len, info->type); 381 } else { 382 dump->u_debugreg[i] = 0; 383 } 384 } 385 386 dump->u_debugreg[4] = 0; 387 dump->u_debugreg[5] = 0; 388 dump->u_debugreg[6] = current->thread.debugreg6; 389 390 dump->u_debugreg[7] = dr7; 391 } 392 EXPORT_SYMBOL_GPL(aout_dump_debugregs); 393 394 /* 395 * Release the user breakpoints used by ptrace 396 */ 397 void flush_ptrace_hw_breakpoint(struct task_struct *tsk) 398 { 399 int i; 400 struct thread_struct *t = &tsk->thread; 401 402 for (i = 0; i < HBP_NUM; i++) { 403 unregister_hw_breakpoint(t->ptrace_bps[i]); 404 t->ptrace_bps[i] = NULL; 405 } 406 407 t->debugreg6 = 0; 408 t->ptrace_dr7 = 0; 409 } 410 411 void hw_breakpoint_restore(void) 412 { 413 set_debugreg(__this_cpu_read(cpu_debugreg[0]), 0); 414 set_debugreg(__this_cpu_read(cpu_debugreg[1]), 1); 415 set_debugreg(__this_cpu_read(cpu_debugreg[2]), 2); 416 set_debugreg(__this_cpu_read(cpu_debugreg[3]), 3); 417 set_debugreg(current->thread.debugreg6, 6); 418 set_debugreg(__this_cpu_read(cpu_dr7), 7); 419 } 420 EXPORT_SYMBOL_GPL(hw_breakpoint_restore); 421 422 /* 423 * Handle debug exception notifications. 424 * 425 * Return value is either NOTIFY_STOP or NOTIFY_DONE as explained below. 426 * 427 * NOTIFY_DONE returned if one of the following conditions is true. 428 * i) When the causative address is from user-space and the exception 429 * is a valid one, i.e. not triggered as a result of lazy debug register 430 * switching 431 * ii) When there are more bits than trap<n> set in DR6 register (such 432 * as BD, BS or BT) indicating that more than one debug condition is 433 * met and requires some more action in do_debug(). 434 * 435 * NOTIFY_STOP returned for all other cases 436 * 437 */ 438 static int hw_breakpoint_handler(struct die_args *args) 439 { 440 int i, cpu, rc = NOTIFY_STOP; 441 struct perf_event *bp; 442 unsigned long dr7, dr6; 443 unsigned long *dr6_p; 444 445 /* The DR6 value is pointed by args->err */ 446 dr6_p = (unsigned long *)ERR_PTR(args->err); 447 dr6 = *dr6_p; 448 449 /* If it's a single step, TRAP bits are random */ 450 if (dr6 & DR_STEP) 451 return NOTIFY_DONE; 452 453 /* Do an early return if no trap bits are set in DR6 */ 454 if ((dr6 & DR_TRAP_BITS) == 0) 455 return NOTIFY_DONE; 456 457 get_debugreg(dr7, 7); 458 /* Disable breakpoints during exception handling */ 459 set_debugreg(0UL, 7); 460 /* 461 * Assert that local interrupts are disabled 462 * Reset the DRn bits in the virtualized register value. 463 * The ptrace trigger routine will add in whatever is needed. 464 */ 465 current->thread.debugreg6 &= ~DR_TRAP_BITS; 466 cpu = get_cpu(); 467 468 /* Handle all the breakpoints that were triggered */ 469 for (i = 0; i < HBP_NUM; ++i) { 470 if (likely(!(dr6 & (DR_TRAP0 << i)))) 471 continue; 472 473 /* 474 * The counter may be concurrently released but that can only 475 * occur from a call_rcu() path. We can then safely fetch 476 * the breakpoint, use its callback, touch its counter 477 * while we are in an rcu_read_lock() path. 478 */ 479 rcu_read_lock(); 480 481 bp = per_cpu(bp_per_reg[i], cpu); 482 /* 483 * Reset the 'i'th TRAP bit in dr6 to denote completion of 484 * exception handling 485 */ 486 (*dr6_p) &= ~(DR_TRAP0 << i); 487 /* 488 * bp can be NULL due to lazy debug register switching 489 * or due to concurrent perf counter removing. 490 */ 491 if (!bp) { 492 rcu_read_unlock(); 493 break; 494 } 495 496 perf_bp_event(bp, args->regs); 497 498 /* 499 * Set up resume flag to avoid breakpoint recursion when 500 * returning back to origin. 501 */ 502 if (bp->hw.info.type == X86_BREAKPOINT_EXECUTE) 503 args->regs->flags |= X86_EFLAGS_RF; 504 505 rcu_read_unlock(); 506 } 507 /* 508 * Further processing in do_debug() is needed for a) user-space 509 * breakpoints (to generate signals) and b) when the system has 510 * taken exception due to multiple causes 511 */ 512 if ((current->thread.debugreg6 & DR_TRAP_BITS) || 513 (dr6 & (~DR_TRAP_BITS))) 514 rc = NOTIFY_DONE; 515 516 set_debugreg(dr7, 7); 517 put_cpu(); 518 519 return rc; 520 } 521 522 /* 523 * Handle debug exception notifications. 524 */ 525 int hw_breakpoint_exceptions_notify( 526 struct notifier_block *unused, unsigned long val, void *data) 527 { 528 if (val != DIE_DEBUG) 529 return NOTIFY_DONE; 530 531 return hw_breakpoint_handler(data); 532 } 533 534 void hw_breakpoint_pmu_read(struct perf_event *bp) 535 { 536 /* TODO */ 537 } 538