Loading...
1/*
2 * HW_breakpoint: a unified kernel/user-space hardware breakpoint facility,
3 * using the CPU's debug registers. Derived from
4 * "arch/x86/kernel/hw_breakpoint.c"
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
19 *
20 * Copyright 2010 IBM Corporation
21 * Author: K.Prasad <prasad@linux.vnet.ibm.com>
22 *
23 */
24
25#include <linux/hw_breakpoint.h>
26#include <linux/notifier.h>
27#include <linux/kprobes.h>
28#include <linux/percpu.h>
29#include <linux/kernel.h>
30#include <linux/sched.h>
31#include <linux/smp.h>
32
33#include <asm/hw_breakpoint.h>
34#include <asm/processor.h>
35#include <asm/sstep.h>
36#include <asm/debug.h>
37#include <linux/uaccess.h>
38
39/*
40 * Stores the breakpoints currently in use on each breakpoint address
41 * register for every cpu
42 */
43static DEFINE_PER_CPU(struct perf_event *, bp_per_reg);
44
45/*
46 * Returns total number of data or instruction breakpoints available.
47 */
48int hw_breakpoint_slots(int type)
49{
50 if (type == TYPE_DATA)
51 return HBP_NUM;
52 return 0; /* no instruction breakpoints available */
53}
54
55/*
56 * Install a perf counter breakpoint.
57 *
58 * We seek a free debug address register and use it for this
59 * breakpoint.
60 *
61 * Atomic: we hold the counter->ctx->lock and we only handle variables
62 * and registers local to this cpu.
63 */
64int arch_install_hw_breakpoint(struct perf_event *bp)
65{
66 struct arch_hw_breakpoint *info = counter_arch_bp(bp);
67 struct perf_event **slot = this_cpu_ptr(&bp_per_reg);
68
69 *slot = bp;
70
71 /*
72 * Do not install DABR values if the instruction must be single-stepped.
73 * If so, DABR will be populated in single_step_dabr_instruction().
74 */
75 if (current->thread.last_hit_ubp != bp)
76 __set_breakpoint(info);
77
78 return 0;
79}
80
81/*
82 * Uninstall the breakpoint contained in the given counter.
83 *
84 * First we search the debug address register it uses and then we disable
85 * it.
86 *
87 * Atomic: we hold the counter->ctx->lock and we only handle variables
88 * and registers local to this cpu.
89 */
90void arch_uninstall_hw_breakpoint(struct perf_event *bp)
91{
92 struct perf_event **slot = this_cpu_ptr(&bp_per_reg);
93
94 if (*slot != bp) {
95 WARN_ONCE(1, "Can't find the breakpoint");
96 return;
97 }
98
99 *slot = NULL;
100 hw_breakpoint_disable();
101}
102
103/*
104 * Perform cleanup of arch-specific counters during unregistration
105 * of the perf-event
106 */
107void arch_unregister_hw_breakpoint(struct perf_event *bp)
108{
109 /*
110 * If the breakpoint is unregistered between a hw_breakpoint_handler()
111 * and the single_step_dabr_instruction(), then cleanup the breakpoint
112 * restoration variables to prevent dangling pointers.
113 * FIXME, this should not be using bp->ctx at all! Sayeth peterz.
114 */
115 if (bp->ctx && bp->ctx->task && bp->ctx->task != ((void *)-1L))
116 bp->ctx->task->thread.last_hit_ubp = NULL;
117}
118
119/*
120 * Check for virtual address in kernel space.
121 */
122int arch_check_bp_in_kernelspace(struct perf_event *bp)
123{
124 struct arch_hw_breakpoint *info = counter_arch_bp(bp);
125
126 return is_kernel_addr(info->address);
127}
128
129int arch_bp_generic_fields(int type, int *gen_bp_type)
130{
131 *gen_bp_type = 0;
132 if (type & HW_BRK_TYPE_READ)
133 *gen_bp_type |= HW_BREAKPOINT_R;
134 if (type & HW_BRK_TYPE_WRITE)
135 *gen_bp_type |= HW_BREAKPOINT_W;
136 if (*gen_bp_type == 0)
137 return -EINVAL;
138 return 0;
139}
140
141/*
142 * Validate the arch-specific HW Breakpoint register settings
143 */
144int arch_validate_hwbkpt_settings(struct perf_event *bp)
145{
146 int ret = -EINVAL, length_max;
147 struct arch_hw_breakpoint *info = counter_arch_bp(bp);
148
149 if (!bp)
150 return ret;
151
152 info->type = HW_BRK_TYPE_TRANSLATE;
153 if (bp->attr.bp_type & HW_BREAKPOINT_R)
154 info->type |= HW_BRK_TYPE_READ;
155 if (bp->attr.bp_type & HW_BREAKPOINT_W)
156 info->type |= HW_BRK_TYPE_WRITE;
157 if (info->type == HW_BRK_TYPE_TRANSLATE)
158 /* must set alteast read or write */
159 return ret;
160 if (!(bp->attr.exclude_user))
161 info->type |= HW_BRK_TYPE_USER;
162 if (!(bp->attr.exclude_kernel))
163 info->type |= HW_BRK_TYPE_KERNEL;
164 if (!(bp->attr.exclude_hv))
165 info->type |= HW_BRK_TYPE_HYP;
166 info->address = bp->attr.bp_addr;
167 info->len = bp->attr.bp_len;
168
169 /*
170 * Since breakpoint length can be a maximum of HW_BREAKPOINT_LEN(8)
171 * and breakpoint addresses are aligned to nearest double-word
172 * HW_BREAKPOINT_ALIGN by rounding off to the lower address, the
173 * 'symbolsize' should satisfy the check below.
174 */
175 if (!ppc_breakpoint_available())
176 return -ENODEV;
177 length_max = 8; /* DABR */
178 if (cpu_has_feature(CPU_FTR_DAWR)) {
179 length_max = 512 ; /* 64 doublewords */
180 /* DAWR region can't cross 512 boundary */
181 if ((bp->attr.bp_addr >> 10) !=
182 ((bp->attr.bp_addr + bp->attr.bp_len - 1) >> 10))
183 return -EINVAL;
184 }
185 if (info->len >
186 (length_max - (info->address & HW_BREAKPOINT_ALIGN)))
187 return -EINVAL;
188 return 0;
189}
190
191/*
192 * Restores the breakpoint on the debug registers.
193 * Invoke this function if it is known that the execution context is
194 * about to change to cause loss of MSR_SE settings.
195 */
196void thread_change_pc(struct task_struct *tsk, struct pt_regs *regs)
197{
198 struct arch_hw_breakpoint *info;
199
200 if (likely(!tsk->thread.last_hit_ubp))
201 return;
202
203 info = counter_arch_bp(tsk->thread.last_hit_ubp);
204 regs->msr &= ~MSR_SE;
205 __set_breakpoint(info);
206 tsk->thread.last_hit_ubp = NULL;
207}
208
209/*
210 * Handle debug exception notifications.
211 */
212int hw_breakpoint_handler(struct die_args *args)
213{
214 int rc = NOTIFY_STOP;
215 struct perf_event *bp;
216 struct pt_regs *regs = args->regs;
217#ifndef CONFIG_PPC_8xx
218 int stepped = 1;
219 unsigned int instr;
220#endif
221 struct arch_hw_breakpoint *info;
222 unsigned long dar = regs->dar;
223
224 /* Disable breakpoints during exception handling */
225 hw_breakpoint_disable();
226
227 /*
228 * The counter may be concurrently released but that can only
229 * occur from a call_rcu() path. We can then safely fetch
230 * the breakpoint, use its callback, touch its counter
231 * while we are in an rcu_read_lock() path.
232 */
233 rcu_read_lock();
234
235 bp = __this_cpu_read(bp_per_reg);
236 if (!bp) {
237 rc = NOTIFY_DONE;
238 goto out;
239 }
240 info = counter_arch_bp(bp);
241
242 /*
243 * Return early after invoking user-callback function without restoring
244 * DABR if the breakpoint is from ptrace which always operates in
245 * one-shot mode. The ptrace-ed process will receive the SIGTRAP signal
246 * generated in do_dabr().
247 */
248 if (bp->overflow_handler == ptrace_triggered) {
249 perf_bp_event(bp, regs);
250 rc = NOTIFY_DONE;
251 goto out;
252 }
253
254 /*
255 * Verify if dar lies within the address range occupied by the symbol
256 * being watched to filter extraneous exceptions. If it doesn't,
257 * we still need to single-step the instruction, but we don't
258 * generate an event.
259 */
260 info->type &= ~HW_BRK_TYPE_EXTRANEOUS_IRQ;
261 if (!((bp->attr.bp_addr <= dar) &&
262 (dar - bp->attr.bp_addr < bp->attr.bp_len)))
263 info->type |= HW_BRK_TYPE_EXTRANEOUS_IRQ;
264
265#ifndef CONFIG_PPC_8xx
266 /* Do not emulate user-space instructions, instead single-step them */
267 if (user_mode(regs)) {
268 current->thread.last_hit_ubp = bp;
269 regs->msr |= MSR_SE;
270 goto out;
271 }
272
273 stepped = 0;
274 instr = 0;
275 if (!__get_user_inatomic(instr, (unsigned int *) regs->nip))
276 stepped = emulate_step(regs, instr);
277
278 /*
279 * emulate_step() could not execute it. We've failed in reliably
280 * handling the hw-breakpoint. Unregister it and throw a warning
281 * message to let the user know about it.
282 */
283 if (!stepped) {
284 WARN(1, "Unable to handle hardware breakpoint. Breakpoint at "
285 "0x%lx will be disabled.", info->address);
286 perf_event_disable_inatomic(bp);
287 goto out;
288 }
289#endif
290 /*
291 * As a policy, the callback is invoked in a 'trigger-after-execute'
292 * fashion
293 */
294 if (!(info->type & HW_BRK_TYPE_EXTRANEOUS_IRQ))
295 perf_bp_event(bp, regs);
296
297 __set_breakpoint(info);
298out:
299 rcu_read_unlock();
300 return rc;
301}
302NOKPROBE_SYMBOL(hw_breakpoint_handler);
303
304/*
305 * Handle single-step exceptions following a DABR hit.
306 */
307static int single_step_dabr_instruction(struct die_args *args)
308{
309 struct pt_regs *regs = args->regs;
310 struct perf_event *bp = NULL;
311 struct arch_hw_breakpoint *info;
312
313 bp = current->thread.last_hit_ubp;
314 /*
315 * Check if we are single-stepping as a result of a
316 * previous HW Breakpoint exception
317 */
318 if (!bp)
319 return NOTIFY_DONE;
320
321 info = counter_arch_bp(bp);
322
323 /*
324 * We shall invoke the user-defined callback function in the single
325 * stepping handler to confirm to 'trigger-after-execute' semantics
326 */
327 if (!(info->type & HW_BRK_TYPE_EXTRANEOUS_IRQ))
328 perf_bp_event(bp, regs);
329
330 __set_breakpoint(info);
331 current->thread.last_hit_ubp = NULL;
332
333 /*
334 * If the process was being single-stepped by ptrace, let the
335 * other single-step actions occur (e.g. generate SIGTRAP).
336 */
337 if (test_thread_flag(TIF_SINGLESTEP))
338 return NOTIFY_DONE;
339
340 return NOTIFY_STOP;
341}
342NOKPROBE_SYMBOL(single_step_dabr_instruction);
343
344/*
345 * Handle debug exception notifications.
346 */
347int hw_breakpoint_exceptions_notify(
348 struct notifier_block *unused, unsigned long val, void *data)
349{
350 int ret = NOTIFY_DONE;
351
352 switch (val) {
353 case DIE_DABR_MATCH:
354 ret = hw_breakpoint_handler(data);
355 break;
356 case DIE_SSTEP:
357 ret = single_step_dabr_instruction(data);
358 break;
359 }
360
361 return ret;
362}
363NOKPROBE_SYMBOL(hw_breakpoint_exceptions_notify);
364
365/*
366 * Release the user breakpoints used by ptrace
367 */
368void flush_ptrace_hw_breakpoint(struct task_struct *tsk)
369{
370 struct thread_struct *t = &tsk->thread;
371
372 unregister_hw_breakpoint(t->ptrace_bps[0]);
373 t->ptrace_bps[0] = NULL;
374}
375
376void hw_breakpoint_pmu_read(struct perf_event *bp)
377{
378 /* TODO */
379}
1/*
2 * HW_breakpoint: a unified kernel/user-space hardware breakpoint facility,
3 * using the CPU's debug registers. Derived from
4 * "arch/x86/kernel/hw_breakpoint.c"
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
19 *
20 * Copyright 2010 IBM Corporation
21 * Author: K.Prasad <prasad@linux.vnet.ibm.com>
22 *
23 */
24
25#include <linux/hw_breakpoint.h>
26#include <linux/notifier.h>
27#include <linux/kprobes.h>
28#include <linux/percpu.h>
29#include <linux/kernel.h>
30#include <linux/sched.h>
31#include <linux/init.h>
32#include <linux/smp.h>
33
34#include <asm/hw_breakpoint.h>
35#include <asm/processor.h>
36#include <asm/sstep.h>
37#include <asm/uaccess.h>
38
39/*
40 * Stores the breakpoints currently in use on each breakpoint address
41 * register for every cpu
42 */
43static DEFINE_PER_CPU(struct perf_event *, bp_per_reg);
44
45/*
46 * Returns total number of data or instruction breakpoints available.
47 */
48int hw_breakpoint_slots(int type)
49{
50 if (type == TYPE_DATA)
51 return HBP_NUM;
52 return 0; /* no instruction breakpoints available */
53}
54
55/*
56 * Install a perf counter breakpoint.
57 *
58 * We seek a free debug address register and use it for this
59 * breakpoint.
60 *
61 * Atomic: we hold the counter->ctx->lock and we only handle variables
62 * and registers local to this cpu.
63 */
64int arch_install_hw_breakpoint(struct perf_event *bp)
65{
66 struct arch_hw_breakpoint *info = counter_arch_bp(bp);
67 struct perf_event **slot = &__get_cpu_var(bp_per_reg);
68
69 *slot = bp;
70
71 /*
72 * Do not install DABR values if the instruction must be single-stepped.
73 * If so, DABR will be populated in single_step_dabr_instruction().
74 */
75 if (current->thread.last_hit_ubp != bp)
76 set_dabr(info->address | info->type | DABR_TRANSLATION);
77
78 return 0;
79}
80
81/*
82 * Uninstall the breakpoint contained in the given counter.
83 *
84 * First we search the debug address register it uses and then we disable
85 * it.
86 *
87 * Atomic: we hold the counter->ctx->lock and we only handle variables
88 * and registers local to this cpu.
89 */
90void arch_uninstall_hw_breakpoint(struct perf_event *bp)
91{
92 struct perf_event **slot = &__get_cpu_var(bp_per_reg);
93
94 if (*slot != bp) {
95 WARN_ONCE(1, "Can't find the breakpoint");
96 return;
97 }
98
99 *slot = NULL;
100 set_dabr(0);
101}
102
103/*
104 * Perform cleanup of arch-specific counters during unregistration
105 * of the perf-event
106 */
107void arch_unregister_hw_breakpoint(struct perf_event *bp)
108{
109 /*
110 * If the breakpoint is unregistered between a hw_breakpoint_handler()
111 * and the single_step_dabr_instruction(), then cleanup the breakpoint
112 * restoration variables to prevent dangling pointers.
113 */
114 if (bp->ctx->task)
115 bp->ctx->task->thread.last_hit_ubp = NULL;
116}
117
118/*
119 * Check for virtual address in kernel space.
120 */
121int arch_check_bp_in_kernelspace(struct perf_event *bp)
122{
123 struct arch_hw_breakpoint *info = counter_arch_bp(bp);
124
125 return is_kernel_addr(info->address);
126}
127
128int arch_bp_generic_fields(int type, int *gen_bp_type)
129{
130 switch (type) {
131 case DABR_DATA_READ:
132 *gen_bp_type = HW_BREAKPOINT_R;
133 break;
134 case DABR_DATA_WRITE:
135 *gen_bp_type = HW_BREAKPOINT_W;
136 break;
137 case (DABR_DATA_WRITE | DABR_DATA_READ):
138 *gen_bp_type = (HW_BREAKPOINT_W | HW_BREAKPOINT_R);
139 break;
140 default:
141 return -EINVAL;
142 }
143 return 0;
144}
145
146/*
147 * Validate the arch-specific HW Breakpoint register settings
148 */
149int arch_validate_hwbkpt_settings(struct perf_event *bp)
150{
151 int ret = -EINVAL;
152 struct arch_hw_breakpoint *info = counter_arch_bp(bp);
153
154 if (!bp)
155 return ret;
156
157 switch (bp->attr.bp_type) {
158 case HW_BREAKPOINT_R:
159 info->type = DABR_DATA_READ;
160 break;
161 case HW_BREAKPOINT_W:
162 info->type = DABR_DATA_WRITE;
163 break;
164 case HW_BREAKPOINT_R | HW_BREAKPOINT_W:
165 info->type = (DABR_DATA_READ | DABR_DATA_WRITE);
166 break;
167 default:
168 return ret;
169 }
170
171 info->address = bp->attr.bp_addr;
172 info->len = bp->attr.bp_len;
173
174 /*
175 * Since breakpoint length can be a maximum of HW_BREAKPOINT_LEN(8)
176 * and breakpoint addresses are aligned to nearest double-word
177 * HW_BREAKPOINT_ALIGN by rounding off to the lower address, the
178 * 'symbolsize' should satisfy the check below.
179 */
180 if (info->len >
181 (HW_BREAKPOINT_LEN - (info->address & HW_BREAKPOINT_ALIGN)))
182 return -EINVAL;
183 return 0;
184}
185
186/*
187 * Restores the breakpoint on the debug registers.
188 * Invoke this function if it is known that the execution context is
189 * about to change to cause loss of MSR_SE settings.
190 */
191void thread_change_pc(struct task_struct *tsk, struct pt_regs *regs)
192{
193 struct arch_hw_breakpoint *info;
194
195 if (likely(!tsk->thread.last_hit_ubp))
196 return;
197
198 info = counter_arch_bp(tsk->thread.last_hit_ubp);
199 regs->msr &= ~MSR_SE;
200 set_dabr(info->address | info->type | DABR_TRANSLATION);
201 tsk->thread.last_hit_ubp = NULL;
202}
203
204/*
205 * Handle debug exception notifications.
206 */
207int __kprobes hw_breakpoint_handler(struct die_args *args)
208{
209 int rc = NOTIFY_STOP;
210 struct perf_event *bp;
211 struct pt_regs *regs = args->regs;
212 int stepped = 1;
213 struct arch_hw_breakpoint *info;
214 unsigned int instr;
215 unsigned long dar = regs->dar;
216
217 /* Disable breakpoints during exception handling */
218 set_dabr(0);
219
220 /*
221 * The counter may be concurrently released but that can only
222 * occur from a call_rcu() path. We can then safely fetch
223 * the breakpoint, use its callback, touch its counter
224 * while we are in an rcu_read_lock() path.
225 */
226 rcu_read_lock();
227
228 bp = __get_cpu_var(bp_per_reg);
229 if (!bp)
230 goto out;
231 info = counter_arch_bp(bp);
232
233 /*
234 * Return early after invoking user-callback function without restoring
235 * DABR if the breakpoint is from ptrace which always operates in
236 * one-shot mode. The ptrace-ed process will receive the SIGTRAP signal
237 * generated in do_dabr().
238 */
239 if (bp->overflow_handler == ptrace_triggered) {
240 perf_bp_event(bp, regs);
241 rc = NOTIFY_DONE;
242 goto out;
243 }
244
245 /*
246 * Verify if dar lies within the address range occupied by the symbol
247 * being watched to filter extraneous exceptions. If it doesn't,
248 * we still need to single-step the instruction, but we don't
249 * generate an event.
250 */
251 info->extraneous_interrupt = !((bp->attr.bp_addr <= dar) &&
252 (dar - bp->attr.bp_addr < bp->attr.bp_len));
253
254 /* Do not emulate user-space instructions, instead single-step them */
255 if (user_mode(regs)) {
256 bp->ctx->task->thread.last_hit_ubp = bp;
257 regs->msr |= MSR_SE;
258 goto out;
259 }
260
261 stepped = 0;
262 instr = 0;
263 if (!__get_user_inatomic(instr, (unsigned int *) regs->nip))
264 stepped = emulate_step(regs, instr);
265
266 /*
267 * emulate_step() could not execute it. We've failed in reliably
268 * handling the hw-breakpoint. Unregister it and throw a warning
269 * message to let the user know about it.
270 */
271 if (!stepped) {
272 WARN(1, "Unable to handle hardware breakpoint. Breakpoint at "
273 "0x%lx will be disabled.", info->address);
274 perf_event_disable(bp);
275 goto out;
276 }
277 /*
278 * As a policy, the callback is invoked in a 'trigger-after-execute'
279 * fashion
280 */
281 if (!info->extraneous_interrupt)
282 perf_bp_event(bp, regs);
283
284 set_dabr(info->address | info->type | DABR_TRANSLATION);
285out:
286 rcu_read_unlock();
287 return rc;
288}
289
290/*
291 * Handle single-step exceptions following a DABR hit.
292 */
293int __kprobes single_step_dabr_instruction(struct die_args *args)
294{
295 struct pt_regs *regs = args->regs;
296 struct perf_event *bp = NULL;
297 struct arch_hw_breakpoint *bp_info;
298
299 bp = current->thread.last_hit_ubp;
300 /*
301 * Check if we are single-stepping as a result of a
302 * previous HW Breakpoint exception
303 */
304 if (!bp)
305 return NOTIFY_DONE;
306
307 bp_info = counter_arch_bp(bp);
308
309 /*
310 * We shall invoke the user-defined callback function in the single
311 * stepping handler to confirm to 'trigger-after-execute' semantics
312 */
313 if (!bp_info->extraneous_interrupt)
314 perf_bp_event(bp, regs);
315
316 set_dabr(bp_info->address | bp_info->type | DABR_TRANSLATION);
317 current->thread.last_hit_ubp = NULL;
318
319 /*
320 * If the process was being single-stepped by ptrace, let the
321 * other single-step actions occur (e.g. generate SIGTRAP).
322 */
323 if (test_thread_flag(TIF_SINGLESTEP))
324 return NOTIFY_DONE;
325
326 return NOTIFY_STOP;
327}
328
329/*
330 * Handle debug exception notifications.
331 */
332int __kprobes hw_breakpoint_exceptions_notify(
333 struct notifier_block *unused, unsigned long val, void *data)
334{
335 int ret = NOTIFY_DONE;
336
337 switch (val) {
338 case DIE_DABR_MATCH:
339 ret = hw_breakpoint_handler(data);
340 break;
341 case DIE_SSTEP:
342 ret = single_step_dabr_instruction(data);
343 break;
344 }
345
346 return ret;
347}
348
349/*
350 * Release the user breakpoints used by ptrace
351 */
352void flush_ptrace_hw_breakpoint(struct task_struct *tsk)
353{
354 struct thread_struct *t = &tsk->thread;
355
356 unregister_hw_breakpoint(t->ptrace_bps[0]);
357 t->ptrace_bps[0] = NULL;
358}
359
360void hw_breakpoint_pmu_read(struct perf_event *bp)
361{
362 /* TODO */
363}