1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * arch/sh/kernel/hw_breakpoint.c 4 * 5 * Unified kernel/user-space hardware breakpoint facility for the on-chip UBC. 6 * 7 * Copyright (C) 2009 - 2010 Paul Mundt 8 */ 9 #include <linux/init.h> 10 #include <linux/perf_event.h> 11 #include <linux/sched/signal.h> 12 #include <linux/hw_breakpoint.h> 13 #include <linux/percpu.h> 14 #include <linux/kallsyms.h> 15 #include <linux/notifier.h> 16 #include <linux/kprobes.h> 17 #include <linux/kdebug.h> 18 #include <linux/io.h> 19 #include <linux/clk.h> 20 #include <asm/hw_breakpoint.h> 21 #include <asm/mmu_context.h> 22 #include <asm/ptrace.h> 23 #include <asm/traps.h> 24 25 /* 26 * Stores the breakpoints currently in use on each breakpoint address 27 * register for each cpus 28 */ 29 static DEFINE_PER_CPU(struct perf_event *, bp_per_reg[HBP_NUM]); 30 31 /* 32 * A dummy placeholder for early accesses until the CPUs get a chance to 33 * register their UBCs later in the boot process. 34 */ 35 static struct sh_ubc ubc_dummy = { .num_events = 0 }; 36 37 static struct sh_ubc *sh_ubc __read_mostly = &ubc_dummy; 38 39 /* 40 * Install a perf counter breakpoint. 41 * 42 * We seek a free UBC channel and use it for this breakpoint. 43 * 44 * Atomic: we hold the counter->ctx->lock and we only handle variables 45 * and registers local to this cpu. 46 */ 47 int arch_install_hw_breakpoint(struct perf_event *bp) 48 { 49 struct arch_hw_breakpoint *info = counter_arch_bp(bp); 50 int i; 51 52 for (i = 0; i < sh_ubc->num_events; i++) { 53 struct perf_event **slot = this_cpu_ptr(&bp_per_reg[i]); 54 55 if (!*slot) { 56 *slot = bp; 57 break; 58 } 59 } 60 61 if (WARN_ONCE(i == sh_ubc->num_events, "Can't find any breakpoint slot")) 62 return -EBUSY; 63 64 clk_enable(sh_ubc->clk); 65 sh_ubc->enable(info, i); 66 67 return 0; 68 } 69 70 /* 71 * Uninstall the breakpoint contained in the given counter. 72 * 73 * First we search the debug address register it uses and then we disable 74 * it. 75 * 76 * Atomic: we hold the counter->ctx->lock and we only handle variables 77 * and registers local to this cpu. 78 */ 79 void arch_uninstall_hw_breakpoint(struct perf_event *bp) 80 { 81 struct arch_hw_breakpoint *info = counter_arch_bp(bp); 82 int i; 83 84 for (i = 0; i < sh_ubc->num_events; i++) { 85 struct perf_event **slot = this_cpu_ptr(&bp_per_reg[i]); 86 87 if (*slot == bp) { 88 *slot = NULL; 89 break; 90 } 91 } 92 93 if (WARN_ONCE(i == sh_ubc->num_events, "Can't find any breakpoint slot")) 94 return; 95 96 sh_ubc->disable(info, i); 97 clk_disable(sh_ubc->clk); 98 } 99 100 static int get_hbp_len(u16 hbp_len) 101 { 102 unsigned int len_in_bytes = 0; 103 104 switch (hbp_len) { 105 case SH_BREAKPOINT_LEN_1: 106 len_in_bytes = 1; 107 break; 108 case SH_BREAKPOINT_LEN_2: 109 len_in_bytes = 2; 110 break; 111 case SH_BREAKPOINT_LEN_4: 112 len_in_bytes = 4; 113 break; 114 case SH_BREAKPOINT_LEN_8: 115 len_in_bytes = 8; 116 break; 117 } 118 return len_in_bytes; 119 } 120 121 /* 122 * Check for virtual address in kernel space. 123 */ 124 int arch_check_bp_in_kernelspace(struct arch_hw_breakpoint *hw) 125 { 126 unsigned int len; 127 unsigned long va; 128 129 va = hw->address; 130 len = get_hbp_len(hw->len); 131 132 return (va >= TASK_SIZE) && ((va + len - 1) >= TASK_SIZE); 133 } 134 135 int arch_bp_generic_fields(int sh_len, int sh_type, 136 int *gen_len, int *gen_type) 137 { 138 /* Len */ 139 switch (sh_len) { 140 case SH_BREAKPOINT_LEN_1: 141 *gen_len = HW_BREAKPOINT_LEN_1; 142 break; 143 case SH_BREAKPOINT_LEN_2: 144 *gen_len = HW_BREAKPOINT_LEN_2; 145 break; 146 case SH_BREAKPOINT_LEN_4: 147 *gen_len = HW_BREAKPOINT_LEN_4; 148 break; 149 case SH_BREAKPOINT_LEN_8: 150 *gen_len = HW_BREAKPOINT_LEN_8; 151 break; 152 default: 153 return -EINVAL; 154 } 155 156 /* Type */ 157 switch (sh_type) { 158 case SH_BREAKPOINT_READ: 159 *gen_type = HW_BREAKPOINT_R; 160 break; 161 case SH_BREAKPOINT_WRITE: 162 *gen_type = HW_BREAKPOINT_W; 163 break; 164 case SH_BREAKPOINT_RW: 165 *gen_type = HW_BREAKPOINT_W | HW_BREAKPOINT_R; 166 break; 167 default: 168 return -EINVAL; 169 } 170 171 return 0; 172 } 173 174 static int arch_build_bp_info(struct perf_event *bp, 175 const struct perf_event_attr *attr, 176 struct arch_hw_breakpoint *hw) 177 { 178 hw->address = attr->bp_addr; 179 180 /* Len */ 181 switch (attr->bp_len) { 182 case HW_BREAKPOINT_LEN_1: 183 hw->len = SH_BREAKPOINT_LEN_1; 184 break; 185 case HW_BREAKPOINT_LEN_2: 186 hw->len = SH_BREAKPOINT_LEN_2; 187 break; 188 case HW_BREAKPOINT_LEN_4: 189 hw->len = SH_BREAKPOINT_LEN_4; 190 break; 191 case HW_BREAKPOINT_LEN_8: 192 hw->len = SH_BREAKPOINT_LEN_8; 193 break; 194 default: 195 return -EINVAL; 196 } 197 198 /* Type */ 199 switch (attr->bp_type) { 200 case HW_BREAKPOINT_R: 201 hw->type = SH_BREAKPOINT_READ; 202 break; 203 case HW_BREAKPOINT_W: 204 hw->type = SH_BREAKPOINT_WRITE; 205 break; 206 case HW_BREAKPOINT_W | HW_BREAKPOINT_R: 207 hw->type = SH_BREAKPOINT_RW; 208 break; 209 default: 210 return -EINVAL; 211 } 212 213 return 0; 214 } 215 216 /* 217 * Validate the arch-specific HW Breakpoint register settings 218 */ 219 int hw_breakpoint_arch_parse(struct perf_event *bp, 220 const struct perf_event_attr *attr, 221 struct arch_hw_breakpoint *hw) 222 { 223 unsigned int align; 224 int ret; 225 226 ret = arch_build_bp_info(bp, attr, hw); 227 if (ret) 228 return ret; 229 230 ret = -EINVAL; 231 232 switch (hw->len) { 233 case SH_BREAKPOINT_LEN_1: 234 align = 0; 235 break; 236 case SH_BREAKPOINT_LEN_2: 237 align = 1; 238 break; 239 case SH_BREAKPOINT_LEN_4: 240 align = 3; 241 break; 242 case SH_BREAKPOINT_LEN_8: 243 align = 7; 244 break; 245 default: 246 return ret; 247 } 248 249 /* 250 * Check that the low-order bits of the address are appropriate 251 * for the alignment implied by len. 252 */ 253 if (hw->address & align) 254 return -EINVAL; 255 256 return 0; 257 } 258 259 /* 260 * Release the user breakpoints used by ptrace 261 */ 262 void flush_ptrace_hw_breakpoint(struct task_struct *tsk) 263 { 264 int i; 265 struct thread_struct *t = &tsk->thread; 266 267 for (i = 0; i < sh_ubc->num_events; i++) { 268 unregister_hw_breakpoint(t->ptrace_bps[i]); 269 t->ptrace_bps[i] = NULL; 270 } 271 } 272 273 static int __kprobes hw_breakpoint_handler(struct die_args *args) 274 { 275 int cpu, i, rc = NOTIFY_STOP; 276 struct perf_event *bp; 277 unsigned int cmf, resume_mask; 278 279 /* 280 * Do an early return if none of the channels triggered. 281 */ 282 cmf = sh_ubc->triggered_mask(); 283 if (unlikely(!cmf)) 284 return NOTIFY_DONE; 285 286 /* 287 * By default, resume all of the active channels. 288 */ 289 resume_mask = sh_ubc->active_mask(); 290 291 /* 292 * Disable breakpoints during exception handling. 293 */ 294 sh_ubc->disable_all(); 295 296 cpu = get_cpu(); 297 for (i = 0; i < sh_ubc->num_events; i++) { 298 unsigned long event_mask = (1 << i); 299 300 if (likely(!(cmf & event_mask))) 301 continue; 302 303 /* 304 * The counter may be concurrently released but that can only 305 * occur from a call_rcu() path. We can then safely fetch 306 * the breakpoint, use its callback, touch its counter 307 * while we are in an rcu_read_lock() path. 308 */ 309 rcu_read_lock(); 310 311 bp = per_cpu(bp_per_reg[i], cpu); 312 if (bp) 313 rc = NOTIFY_DONE; 314 315 /* 316 * Reset the condition match flag to denote completion of 317 * exception handling. 318 */ 319 sh_ubc->clear_triggered_mask(event_mask); 320 321 /* 322 * bp can be NULL due to concurrent perf counter 323 * removing. 324 */ 325 if (!bp) { 326 rcu_read_unlock(); 327 break; 328 } 329 330 /* 331 * Don't restore the channel if the breakpoint is from 332 * ptrace, as it always operates in one-shot mode. 333 */ 334 if (bp->overflow_handler == ptrace_triggered) 335 resume_mask &= ~(1 << i); 336 337 perf_bp_event(bp, args->regs); 338 339 /* Deliver the signal to userspace */ 340 if (!arch_check_bp_in_kernelspace(&bp->hw.info)) { 341 force_sig_fault(SIGTRAP, TRAP_HWBKPT, 342 (void __user *)NULL); 343 } 344 345 rcu_read_unlock(); 346 } 347 348 if (cmf == 0) 349 rc = NOTIFY_DONE; 350 351 sh_ubc->enable_all(resume_mask); 352 353 put_cpu(); 354 355 return rc; 356 } 357 358 BUILD_TRAP_HANDLER(breakpoint) 359 { 360 unsigned long ex = lookup_exception_vector(); 361 TRAP_HANDLER_DECL; 362 363 notify_die(DIE_BREAKPOINT, "breakpoint", regs, 0, ex, SIGTRAP); 364 } 365 366 /* 367 * Handle debug exception notifications. 368 */ 369 int __kprobes hw_breakpoint_exceptions_notify(struct notifier_block *unused, 370 unsigned long val, void *data) 371 { 372 struct die_args *args = data; 373 374 if (val != DIE_BREAKPOINT) 375 return NOTIFY_DONE; 376 377 /* 378 * If the breakpoint hasn't been triggered by the UBC, it's 379 * probably from a debugger, so don't do anything more here. 380 * 381 * This also permits the UBC interface clock to remain off for 382 * non-UBC breakpoints, as we don't need to check the triggered 383 * or active channel masks. 384 */ 385 if (args->trapnr != sh_ubc->trap_nr) 386 return NOTIFY_DONE; 387 388 return hw_breakpoint_handler(data); 389 } 390 391 void hw_breakpoint_pmu_read(struct perf_event *bp) 392 { 393 /* TODO */ 394 } 395 396 int register_sh_ubc(struct sh_ubc *ubc) 397 { 398 /* Bail if it's already assigned */ 399 if (sh_ubc != &ubc_dummy) 400 return -EBUSY; 401 sh_ubc = ubc; 402 403 pr_info("HW Breakpoints: %s UBC support registered\n", ubc->name); 404 405 WARN_ON(ubc->num_events > HBP_NUM); 406 407 return 0; 408 } 409