hw_breakpoint.c 9.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364
  1. /*
  2. * HW_breakpoint: a unified kernel/user-space hardware breakpoint facility,
  3. * using the CPU's debug registers. Derived from
  4. * "arch/x86/kernel/hw_breakpoint.c"
  5. *
  6. * This program is free software; you can redistribute it and/or modify
  7. * it under the terms of the GNU General Public License as published by
  8. * the Free Software Foundation; either version 2 of the License, or
  9. * (at your option) any later version.
  10. *
  11. * This program is distributed in the hope that it will be useful,
  12. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  14. * GNU General Public License for more details.
  15. *
  16. * You should have received a copy of the GNU General Public License
  17. * along with this program; if not, write to the Free Software
  18. * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  19. *
  20. * Copyright 2010 IBM Corporation
  21. * Author: K.Prasad <prasad@linux.vnet.ibm.com>
  22. *
  23. */
  24. #include <linux/hw_breakpoint.h>
  25. #include <linux/notifier.h>
  26. #include <linux/kprobes.h>
  27. #include <linux/percpu.h>
  28. #include <linux/kernel.h>
  29. #include <linux/module.h>
  30. #include <linux/sched.h>
  31. #include <linux/init.h>
  32. #include <linux/smp.h>
  33. #include <asm/hw_breakpoint.h>
  34. #include <asm/processor.h>
  35. #include <asm/sstep.h>
  36. #include <asm/uaccess.h>
  37. /*
  38. * Stores the breakpoints currently in use on each breakpoint address
  39. * register for every cpu
  40. */
  41. static DEFINE_PER_CPU(struct perf_event *, bp_per_reg);
  42. /*
  43. * Returns total number of data or instruction breakpoints available.
  44. */
  45. int hw_breakpoint_slots(int type)
  46. {
  47. if (type == TYPE_DATA)
  48. return HBP_NUM;
  49. return 0; /* no instruction breakpoints available */
  50. }
  51. /*
  52. * Install a perf counter breakpoint.
  53. *
  54. * We seek a free debug address register and use it for this
  55. * breakpoint.
  56. *
  57. * Atomic: we hold the counter->ctx->lock and we only handle variables
  58. * and registers local to this cpu.
  59. */
  60. int arch_install_hw_breakpoint(struct perf_event *bp)
  61. {
  62. struct arch_hw_breakpoint *info = counter_arch_bp(bp);
  63. struct perf_event **slot = &__get_cpu_var(bp_per_reg);
  64. *slot = bp;
  65. /*
  66. * Do not install DABR values if the instruction must be single-stepped.
  67. * If so, DABR will be populated in single_step_dabr_instruction().
  68. */
  69. if (current->thread.last_hit_ubp != bp)
  70. set_dabr(info->address | info->type | DABR_TRANSLATION);
  71. return 0;
  72. }
  73. /*
  74. * Uninstall the breakpoint contained in the given counter.
  75. *
  76. * First we search the debug address register it uses and then we disable
  77. * it.
  78. *
  79. * Atomic: we hold the counter->ctx->lock and we only handle variables
  80. * and registers local to this cpu.
  81. */
  82. void arch_uninstall_hw_breakpoint(struct perf_event *bp)
  83. {
  84. struct perf_event **slot = &__get_cpu_var(bp_per_reg);
  85. if (*slot != bp) {
  86. WARN_ONCE(1, "Can't find the breakpoint");
  87. return;
  88. }
  89. *slot = NULL;
  90. set_dabr(0);
  91. }
  92. /*
  93. * Perform cleanup of arch-specific counters during unregistration
  94. * of the perf-event
  95. */
  96. void arch_unregister_hw_breakpoint(struct perf_event *bp)
  97. {
  98. /*
  99. * If the breakpoint is unregistered between a hw_breakpoint_handler()
  100. * and the single_step_dabr_instruction(), then cleanup the breakpoint
  101. * restoration variables to prevent dangling pointers.
  102. */
  103. if (bp->ctx->task)
  104. bp->ctx->task->thread.last_hit_ubp = NULL;
  105. }
  106. /*
  107. * Check for virtual address in kernel space.
  108. */
  109. int arch_check_bp_in_kernelspace(struct perf_event *bp)
  110. {
  111. struct arch_hw_breakpoint *info = counter_arch_bp(bp);
  112. return is_kernel_addr(info->address);
  113. }
  114. int arch_bp_generic_fields(int type, int *gen_bp_type)
  115. {
  116. switch (type) {
  117. case DABR_DATA_READ:
  118. *gen_bp_type = HW_BREAKPOINT_R;
  119. break;
  120. case DABR_DATA_WRITE:
  121. *gen_bp_type = HW_BREAKPOINT_W;
  122. break;
  123. case (DABR_DATA_WRITE | DABR_DATA_READ):
  124. *gen_bp_type = (HW_BREAKPOINT_W | HW_BREAKPOINT_R);
  125. break;
  126. default:
  127. return -EINVAL;
  128. }
  129. return 0;
  130. }
  131. /*
  132. * Validate the arch-specific HW Breakpoint register settings
  133. */
  134. int arch_validate_hwbkpt_settings(struct perf_event *bp)
  135. {
  136. int ret = -EINVAL;
  137. struct arch_hw_breakpoint *info = counter_arch_bp(bp);
  138. if (!bp)
  139. return ret;
  140. switch (bp->attr.bp_type) {
  141. case HW_BREAKPOINT_R:
  142. info->type = DABR_DATA_READ;
  143. break;
  144. case HW_BREAKPOINT_W:
  145. info->type = DABR_DATA_WRITE;
  146. break;
  147. case HW_BREAKPOINT_R | HW_BREAKPOINT_W:
  148. info->type = (DABR_DATA_READ | DABR_DATA_WRITE);
  149. break;
  150. default:
  151. return ret;
  152. }
  153. info->address = bp->attr.bp_addr;
  154. info->len = bp->attr.bp_len;
  155. /*
  156. * Since breakpoint length can be a maximum of HW_BREAKPOINT_LEN(8)
  157. * and breakpoint addresses are aligned to nearest double-word
  158. * HW_BREAKPOINT_ALIGN by rounding off to the lower address, the
  159. * 'symbolsize' should satisfy the check below.
  160. */
  161. if (info->len >
  162. (HW_BREAKPOINT_LEN - (info->address & HW_BREAKPOINT_ALIGN)))
  163. return -EINVAL;
  164. return 0;
  165. }
  166. /*
  167. * Restores the breakpoint on the debug registers.
  168. * Invoke this function if it is known that the execution context is
  169. * about to change to cause loss of MSR_SE settings.
  170. */
  171. void thread_change_pc(struct task_struct *tsk, struct pt_regs *regs)
  172. {
  173. struct arch_hw_breakpoint *info;
  174. if (likely(!tsk->thread.last_hit_ubp))
  175. return;
  176. info = counter_arch_bp(tsk->thread.last_hit_ubp);
  177. regs->msr &= ~MSR_SE;
  178. set_dabr(info->address | info->type | DABR_TRANSLATION);
  179. tsk->thread.last_hit_ubp = NULL;
  180. }
  181. /*
  182. * Handle debug exception notifications.
  183. */
  184. int __kprobes hw_breakpoint_handler(struct die_args *args)
  185. {
  186. int rc = NOTIFY_STOP;
  187. struct perf_event *bp;
  188. struct pt_regs *regs = args->regs;
  189. int stepped = 1;
  190. struct arch_hw_breakpoint *info;
  191. unsigned int instr;
  192. unsigned long dar = regs->dar;
  193. /* Disable breakpoints during exception handling */
  194. set_dabr(0);
  195. /*
  196. * The counter may be concurrently released but that can only
  197. * occur from a call_rcu() path. We can then safely fetch
  198. * the breakpoint, use its callback, touch its counter
  199. * while we are in an rcu_read_lock() path.
  200. */
  201. rcu_read_lock();
  202. bp = __get_cpu_var(bp_per_reg);
  203. if (!bp)
  204. goto out;
  205. info = counter_arch_bp(bp);
  206. /*
  207. * Return early after invoking user-callback function without restoring
  208. * DABR if the breakpoint is from ptrace which always operates in
  209. * one-shot mode. The ptrace-ed process will receive the SIGTRAP signal
  210. * generated in do_dabr().
  211. */
  212. if (bp->overflow_handler == ptrace_triggered) {
  213. perf_bp_event(bp, regs);
  214. rc = NOTIFY_DONE;
  215. goto out;
  216. }
  217. /*
  218. * Verify if dar lies within the address range occupied by the symbol
  219. * being watched to filter extraneous exceptions. If it doesn't,
  220. * we still need to single-step the instruction, but we don't
  221. * generate an event.
  222. */
  223. info->extraneous_interrupt = !((bp->attr.bp_addr <= dar) &&
  224. (dar - bp->attr.bp_addr < bp->attr.bp_len));
  225. /* Do not emulate user-space instructions, instead single-step them */
  226. if (user_mode(regs)) {
  227. bp->ctx->task->thread.last_hit_ubp = bp;
  228. regs->msr |= MSR_SE;
  229. goto out;
  230. }
  231. stepped = 0;
  232. instr = 0;
  233. if (!__get_user_inatomic(instr, (unsigned int *) regs->nip))
  234. stepped = emulate_step(regs, instr);
  235. /*
  236. * emulate_step() could not execute it. We've failed in reliably
  237. * handling the hw-breakpoint. Unregister it and throw a warning
  238. * message to let the user know about it.
  239. */
  240. if (!stepped) {
  241. WARN(1, "Unable to handle hardware breakpoint. Breakpoint at "
  242. "0x%lx will be disabled.", info->address);
  243. perf_event_disable(bp);
  244. goto out;
  245. }
  246. /*
  247. * As a policy, the callback is invoked in a 'trigger-after-execute'
  248. * fashion
  249. */
  250. if (!info->extraneous_interrupt)
  251. perf_bp_event(bp, regs);
  252. set_dabr(info->address | info->type | DABR_TRANSLATION);
  253. out:
  254. rcu_read_unlock();
  255. return rc;
  256. }
  257. /*
  258. * Handle single-step exceptions following a DABR hit.
  259. */
  260. int __kprobes single_step_dabr_instruction(struct die_args *args)
  261. {
  262. struct pt_regs *regs = args->regs;
  263. struct perf_event *bp = NULL;
  264. struct arch_hw_breakpoint *bp_info;
  265. bp = current->thread.last_hit_ubp;
  266. /*
  267. * Check if we are single-stepping as a result of a
  268. * previous HW Breakpoint exception
  269. */
  270. if (!bp)
  271. return NOTIFY_DONE;
  272. bp_info = counter_arch_bp(bp);
  273. /*
  274. * We shall invoke the user-defined callback function in the single
  275. * stepping handler to confirm to 'trigger-after-execute' semantics
  276. */
  277. if (!bp_info->extraneous_interrupt)
  278. perf_bp_event(bp, regs);
  279. set_dabr(bp_info->address | bp_info->type | DABR_TRANSLATION);
  280. current->thread.last_hit_ubp = NULL;
  281. /*
  282. * If the process was being single-stepped by ptrace, let the
  283. * other single-step actions occur (e.g. generate SIGTRAP).
  284. */
  285. if (test_thread_flag(TIF_SINGLESTEP))
  286. return NOTIFY_DONE;
  287. return NOTIFY_STOP;
  288. }
  289. /*
  290. * Handle debug exception notifications.
  291. */
  292. int __kprobes hw_breakpoint_exceptions_notify(
  293. struct notifier_block *unused, unsigned long val, void *data)
  294. {
  295. int ret = NOTIFY_DONE;
  296. switch (val) {
  297. case DIE_DABR_MATCH:
  298. ret = hw_breakpoint_handler(data);
  299. break;
  300. case DIE_SSTEP:
  301. ret = single_step_dabr_instruction(data);
  302. break;
  303. }
  304. return ret;
  305. }
  306. /*
  307. * Release the user breakpoints used by ptrace
  308. */
  309. void flush_ptrace_hw_breakpoint(struct task_struct *tsk)
  310. {
  311. struct thread_struct *t = &tsk->thread;
  312. unregister_hw_breakpoint(t->ptrace_bps[0]);
  313. t->ptrace_bps[0] = NULL;
  314. }
  315. void hw_breakpoint_pmu_read(struct perf_event *bp)
  316. {
  317. /* TODO */
  318. }