1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * HW_breakpoint: a unified kernel/user-space hardware breakpoint facility,
4 * using the CPU's debug registers. Derived from
5 * "arch/x86/kernel/hw_breakpoint.c"
7 * Copyright 2010 IBM Corporation
8 * Author: K.Prasad <prasad@linux.vnet.ibm.com>
11 #include <linux/hw_breakpoint.h>
12 #include <linux/notifier.h>
13 #include <linux/kprobes.h>
14 #include <linux/percpu.h>
15 #include <linux/kernel.h>
16 #include <linux/sched.h>
17 #include <linux/smp.h>
18 #include <linux/debugfs.h>
19 #include <linux/init.h>
21 #include <asm/hw_breakpoint.h>
22 #include <asm/processor.h>
23 #include <asm/sstep.h>
24 #include <asm/debug.h>
25 #include <asm/debugfs.h>
26 #include <asm/hvcall.h>
27 #include <linux/uaccess.h>
30 * Stores the breakpoints currently in use on each breakpoint address
31 * register for every cpu
33 static DEFINE_PER_CPU(struct perf_event
*, bp_per_reg
);
36 * Returns total number of data or instruction breakpoints available.
38 int hw_breakpoint_slots(int type
)
40 if (type
== TYPE_DATA
)
42 return 0; /* no instruction breakpoints available */
46 * Install a perf counter breakpoint.
48 * We seek a free debug address register and use it for this
51 * Atomic: we hold the counter->ctx->lock and we only handle variables
52 * and registers local to this cpu.
54 int arch_install_hw_breakpoint(struct perf_event
*bp
)
56 struct arch_hw_breakpoint
*info
= counter_arch_bp(bp
);
57 struct perf_event
**slot
= this_cpu_ptr(&bp_per_reg
);
62 * Do not install DABR values if the instruction must be single-stepped.
63 * If so, DABR will be populated in single_step_dabr_instruction().
65 if (current
->thread
.last_hit_ubp
!= bp
)
66 __set_breakpoint(info
);
72 * Uninstall the breakpoint contained in the given counter.
74 * First we search the debug address register it uses and then we disable
77 * Atomic: we hold the counter->ctx->lock and we only handle variables
78 * and registers local to this cpu.
80 void arch_uninstall_hw_breakpoint(struct perf_event
*bp
)
82 struct perf_event
**slot
= this_cpu_ptr(&bp_per_reg
);
85 WARN_ONCE(1, "Can't find the breakpoint");
90 hw_breakpoint_disable();
94 * Perform cleanup of arch-specific counters during unregistration
97 void arch_unregister_hw_breakpoint(struct perf_event
*bp
)
100 * If the breakpoint is unregistered between a hw_breakpoint_handler()
101 * and the single_step_dabr_instruction(), then cleanup the breakpoint
102 * restoration variables to prevent dangling pointers.
103 * FIXME, this should not be using bp->ctx at all! Sayeth peterz.
105 if (bp
->ctx
&& bp
->ctx
->task
&& bp
->ctx
->task
!= ((void *)-1L))
106 bp
->ctx
->task
->thread
.last_hit_ubp
= NULL
;
110 * Check for virtual address in kernel space.
112 int arch_check_bp_in_kernelspace(struct arch_hw_breakpoint
*hw
)
114 return is_kernel_addr(hw
->address
);
117 int arch_bp_generic_fields(int type
, int *gen_bp_type
)
120 if (type
& HW_BRK_TYPE_READ
)
121 *gen_bp_type
|= HW_BREAKPOINT_R
;
122 if (type
& HW_BRK_TYPE_WRITE
)
123 *gen_bp_type
|= HW_BREAKPOINT_W
;
124 if (*gen_bp_type
== 0)
130 * Validate the arch-specific HW Breakpoint register settings
132 int hw_breakpoint_arch_parse(struct perf_event
*bp
,
133 const struct perf_event_attr
*attr
,
134 struct arch_hw_breakpoint
*hw
)
136 int ret
= -EINVAL
, length_max
;
141 hw
->type
= HW_BRK_TYPE_TRANSLATE
;
142 if (attr
->bp_type
& HW_BREAKPOINT_R
)
143 hw
->type
|= HW_BRK_TYPE_READ
;
144 if (attr
->bp_type
& HW_BREAKPOINT_W
)
145 hw
->type
|= HW_BRK_TYPE_WRITE
;
146 if (hw
->type
== HW_BRK_TYPE_TRANSLATE
)
147 /* must set alteast read or write */
149 if (!attr
->exclude_user
)
150 hw
->type
|= HW_BRK_TYPE_USER
;
151 if (!attr
->exclude_kernel
)
152 hw
->type
|= HW_BRK_TYPE_KERNEL
;
153 if (!attr
->exclude_hv
)
154 hw
->type
|= HW_BRK_TYPE_HYP
;
155 hw
->address
= attr
->bp_addr
;
156 hw
->len
= attr
->bp_len
;
159 * Since breakpoint length can be a maximum of HW_BREAKPOINT_LEN(8)
160 * and breakpoint addresses are aligned to nearest double-word
161 * HW_BREAKPOINT_ALIGN by rounding off to the lower address, the
162 * 'symbolsize' should satisfy the check below.
164 if (!ppc_breakpoint_available())
166 length_max
= 8; /* DABR */
167 if (dawr_enabled()) {
168 length_max
= 512 ; /* 64 doublewords */
169 /* DAWR region can't cross 512 boundary */
170 if ((attr
->bp_addr
>> 9) !=
171 ((attr
->bp_addr
+ attr
->bp_len
- 1) >> 9))
175 (length_max
- (hw
->address
& HW_BREAKPOINT_ALIGN
)))
181 * Restores the breakpoint on the debug registers.
182 * Invoke this function if it is known that the execution context is
183 * about to change to cause loss of MSR_SE settings.
185 void thread_change_pc(struct task_struct
*tsk
, struct pt_regs
*regs
)
187 struct arch_hw_breakpoint
*info
;
189 if (likely(!tsk
->thread
.last_hit_ubp
))
192 info
= counter_arch_bp(tsk
->thread
.last_hit_ubp
);
193 regs
->msr
&= ~MSR_SE
;
194 __set_breakpoint(info
);
195 tsk
->thread
.last_hit_ubp
= NULL
;
199 * Handle debug exception notifications.
201 int hw_breakpoint_handler(struct die_args
*args
)
203 int rc
= NOTIFY_STOP
;
204 struct perf_event
*bp
;
205 struct pt_regs
*regs
= args
->regs
;
206 #ifndef CONFIG_PPC_8xx
210 struct arch_hw_breakpoint
*info
;
211 unsigned long dar
= regs
->dar
;
213 /* Disable breakpoints during exception handling */
214 hw_breakpoint_disable();
217 * The counter may be concurrently released but that can only
218 * occur from a call_rcu() path. We can then safely fetch
219 * the breakpoint, use its callback, touch its counter
220 * while we are in an rcu_read_lock() path.
224 bp
= __this_cpu_read(bp_per_reg
);
229 info
= counter_arch_bp(bp
);
232 * Return early after invoking user-callback function without restoring
233 * DABR if the breakpoint is from ptrace which always operates in
234 * one-shot mode. The ptrace-ed process will receive the SIGTRAP signal
235 * generated in do_dabr().
237 if (bp
->overflow_handler
== ptrace_triggered
) {
238 perf_bp_event(bp
, regs
);
244 * Verify if dar lies within the address range occupied by the symbol
245 * being watched to filter extraneous exceptions. If it doesn't,
246 * we still need to single-step the instruction, but we don't
249 info
->type
&= ~HW_BRK_TYPE_EXTRANEOUS_IRQ
;
250 if (!((bp
->attr
.bp_addr
<= dar
) &&
251 (dar
- bp
->attr
.bp_addr
< bp
->attr
.bp_len
)))
252 info
->type
|= HW_BRK_TYPE_EXTRANEOUS_IRQ
;
254 #ifndef CONFIG_PPC_8xx
255 /* Do not emulate user-space instructions, instead single-step them */
256 if (user_mode(regs
)) {
257 current
->thread
.last_hit_ubp
= bp
;
264 if (!__get_user_inatomic(instr
, (unsigned int *) regs
->nip
))
265 stepped
= emulate_step(regs
, instr
);
268 * emulate_step() could not execute it. We've failed in reliably
269 * handling the hw-breakpoint. Unregister it and throw a warning
270 * message to let the user know about it.
273 WARN(1, "Unable to handle hardware breakpoint. Breakpoint at "
274 "0x%lx will be disabled.", info
->address
);
275 perf_event_disable_inatomic(bp
);
280 * As a policy, the callback is invoked in a 'trigger-after-execute'
283 if (!(info
->type
& HW_BRK_TYPE_EXTRANEOUS_IRQ
))
284 perf_bp_event(bp
, regs
);
286 __set_breakpoint(info
);
291 NOKPROBE_SYMBOL(hw_breakpoint_handler
);
294 * Handle single-step exceptions following a DABR hit.
296 static int single_step_dabr_instruction(struct die_args
*args
)
298 struct pt_regs
*regs
= args
->regs
;
299 struct perf_event
*bp
= NULL
;
300 struct arch_hw_breakpoint
*info
;
302 bp
= current
->thread
.last_hit_ubp
;
304 * Check if we are single-stepping as a result of a
305 * previous HW Breakpoint exception
310 info
= counter_arch_bp(bp
);
313 * We shall invoke the user-defined callback function in the single
314 * stepping handler to confirm to 'trigger-after-execute' semantics
316 if (!(info
->type
& HW_BRK_TYPE_EXTRANEOUS_IRQ
))
317 perf_bp_event(bp
, regs
);
319 __set_breakpoint(info
);
320 current
->thread
.last_hit_ubp
= NULL
;
323 * If the process was being single-stepped by ptrace, let the
324 * other single-step actions occur (e.g. generate SIGTRAP).
326 if (test_thread_flag(TIF_SINGLESTEP
))
331 NOKPROBE_SYMBOL(single_step_dabr_instruction
);
334 * Handle debug exception notifications.
336 int hw_breakpoint_exceptions_notify(
337 struct notifier_block
*unused
, unsigned long val
, void *data
)
339 int ret
= NOTIFY_DONE
;
343 ret
= hw_breakpoint_handler(data
);
346 ret
= single_step_dabr_instruction(data
);
352 NOKPROBE_SYMBOL(hw_breakpoint_exceptions_notify
);
355 * Release the user breakpoints used by ptrace
357 void flush_ptrace_hw_breakpoint(struct task_struct
*tsk
)
359 struct thread_struct
*t
= &tsk
->thread
;
361 unregister_hw_breakpoint(t
->ptrace_bps
[0]);
362 t
->ptrace_bps
[0] = NULL
;
365 void hw_breakpoint_pmu_read(struct perf_event
*bp
)
370 bool dawr_force_enable
;
371 EXPORT_SYMBOL_GPL(dawr_force_enable
);
373 static ssize_t
dawr_write_file_bool(struct file
*file
,
374 const char __user
*user_buf
,
375 size_t count
, loff_t
*ppos
)
377 struct arch_hw_breakpoint null_brk
= {0, 0, 0};
380 /* Send error to user if they hypervisor won't allow us to write DAWR */
381 if ((!dawr_force_enable
) &&
382 (firmware_has_feature(FW_FEATURE_LPAR
)) &&
383 (set_dawr(&null_brk
) != H_SUCCESS
))
386 rc
= debugfs_write_file_bool(file
, user_buf
, count
, ppos
);
390 /* If we are clearing, make sure all CPUs have the DAWR cleared */
391 if (!dawr_force_enable
)
392 smp_call_function((smp_call_func_t
)set_dawr
, &null_brk
, 0);
397 static const struct file_operations dawr_enable_fops
= {
398 .read
= debugfs_read_file_bool
,
399 .write
= dawr_write_file_bool
,
401 .llseek
= default_llseek
,
404 static int __init
dawr_force_setup(void)
406 dawr_force_enable
= false;
408 if (cpu_has_feature(CPU_FTR_DAWR
)) {
409 /* Don't setup sysfs file for user control on P8 */
410 dawr_force_enable
= true;
414 if (PVR_VER(mfspr(SPRN_PVR
)) == PVR_POWER9
) {
415 /* Turn DAWR off by default, but allow admin to turn it on */
416 dawr_force_enable
= false;
417 debugfs_create_file_unsafe("dawr_enable_dangerous", 0600,
418 powerpc_debugfs_root
,
424 arch_initcall(dawr_force_setup
);