2 * Copyright 2010 Tilera Corporation. All Rights Reserved.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation, version 2.
8 * This program is distributed in the hope that it will be useful, but
9 * WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
11 * NON INFRINGEMENT. See the GNU General Public License for
14 * A code-rewriter that enables instruction single-stepping.
17 #include <linux/smp.h>
18 #include <linux/ptrace.h>
19 #include <linux/slab.h>
20 #include <linux/thread_info.h>
21 #include <linux/uaccess.h>
22 #include <linux/mman.h>
23 #include <linux/types.h>
24 #include <linux/err.h>
25 #include <linux/prctl.h>
26 #include <asm/cacheflush.h>
27 #include <asm/traps.h>
28 #include <linux/uaccess.h>
29 #include <asm/unaligned.h>
31 #include <arch/spr_def.h>
32 #include <arch/opcode.h>
35 #ifndef __tilegx__ /* Hardware support for single step unavailable. */
37 #define signExtend17(val) sign_extend((val), 17)
38 #define TILE_X1_MASK (0xffffffffULL << 31)
48 static inline tilepro_bundle_bits
set_BrOff_X1(tilepro_bundle_bits n
,
51 tilepro_bundle_bits result
;
53 /* mask out the old offset */
54 tilepro_bundle_bits mask
= create_BrOff_X1(-1);
57 /* or in the new offset */
58 result
|= create_BrOff_X1(offset
);
63 static inline tilepro_bundle_bits
move_X1(tilepro_bundle_bits n
, int dest
,
66 tilepro_bundle_bits result
;
67 tilepro_bundle_bits op
;
69 result
= n
& (~TILE_X1_MASK
);
71 op
= create_Opcode_X1(SPECIAL_0_OPCODE_X1
) |
72 create_RRROpcodeExtension_X1(OR_SPECIAL_0_OPCODE_X1
) |
73 create_Dest_X1(dest
) |
74 create_SrcB_X1(TREG_ZERO
) |
81 static inline tilepro_bundle_bits
nop_X1(tilepro_bundle_bits n
)
83 return move_X1(n
, TREG_ZERO
, TREG_ZERO
);
86 static inline tilepro_bundle_bits
addi_X1(
87 tilepro_bundle_bits n
, int dest
, int src
, int imm
)
91 n
|= (create_SrcA_X1(src
) |
92 create_Dest_X1(dest
) |
95 create_Opcode_X1(IMM_0_OPCODE_X1
) |
96 create_ImmOpcodeExtension_X1(ADDI_IMM_0_OPCODE_X1
));
101 static tilepro_bundle_bits
rewrite_load_store_unaligned(
102 struct single_step_state
*state
,
103 tilepro_bundle_bits bundle
,
104 struct pt_regs
*regs
,
106 int size
, int sign_ext
)
108 unsigned char __user
*addr
;
109 int val_reg
, addr_reg
, err
, val
;
112 align_ctl
= unaligned_fixup
;
113 switch (task_thread_info(current
)->align_ctl
) {
114 case PR_UNALIGN_NOPRINT
:
117 case PR_UNALIGN_SIGBUS
:
122 /* Get address and value registers */
123 if (bundle
& TILEPRO_BUNDLE_Y_ENCODING_MASK
) {
124 addr_reg
= get_SrcA_Y2(bundle
);
125 val_reg
= get_SrcBDest_Y2(bundle
);
126 } else if (mem_op
== MEMOP_LOAD
|| mem_op
== MEMOP_LOAD_POSTINCR
) {
127 addr_reg
= get_SrcA_X1(bundle
);
128 val_reg
= get_Dest_X1(bundle
);
130 addr_reg
= get_SrcA_X1(bundle
);
131 val_reg
= get_SrcB_X1(bundle
);
135 * If registers are not GPRs, don't try to handle it.
137 * FIXME: we could handle non-GPR loads by getting the real value
138 * from memory, writing it to the single step buffer, using a
139 * temp_reg to hold a pointer to that memory, then executing that
140 * instruction and resetting temp_reg. For non-GPR stores, it's a
141 * little trickier; we could use the single step buffer for that
142 * too, but we'd have to add some more state bits so that we could
143 * call back in here to copy that value to the real target. For
144 * now, we just handle the simple case.
146 if ((val_reg
>= PTREGS_NR_GPRS
&&
147 (val_reg
!= TREG_ZERO
||
148 mem_op
== MEMOP_LOAD
||
149 mem_op
== MEMOP_LOAD_POSTINCR
)) ||
150 addr_reg
>= PTREGS_NR_GPRS
)
153 /* If it's aligned, don't handle it specially */
154 addr
= (void __user
*)regs
->regs
[addr_reg
];
155 if (((unsigned long)addr
% size
) == 0)
159 * Return SIGBUS with the unaligned address, if requested.
160 * Note that we return SIGBUS even for completely invalid addresses
161 * as long as they are in fact unaligned; this matches what the
162 * tilepro hardware would be doing, if it could provide us with the
163 * actual bad address in an SPR, which it doesn't.
165 if (align_ctl
== 0) {
168 clear_siginfo(&info
);
169 info
.si_signo
= SIGBUS
;
170 info
.si_code
= BUS_ADRALN
;
173 trace_unhandled_signal("unaligned trap", regs
,
174 (unsigned long)addr
, SIGBUS
);
175 force_sig_info(info
.si_signo
, &info
, current
);
176 return (tilepro_bundle_bits
) 0;
179 /* Handle unaligned load/store */
180 if (mem_op
== MEMOP_LOAD
|| mem_op
== MEMOP_LOAD_POSTINCR
) {
181 unsigned short val_16
;
184 err
= copy_from_user(&val_16
, addr
, sizeof(val_16
));
185 val
= sign_ext
? ((short)val_16
) : val_16
;
188 err
= copy_from_user(&val
, addr
, sizeof(val
));
194 state
->update_reg
= val_reg
;
195 state
->update_value
= val
;
199 unsigned short val_16
;
200 val
= (val_reg
== TREG_ZERO
) ? 0 : regs
->regs
[val_reg
];
204 err
= copy_to_user(addr
, &val_16
, sizeof(val_16
));
207 err
= copy_to_user(addr
, &val
, sizeof(val
));
217 clear_siginfo(&info
);
218 info
.si_signo
= SIGBUS
;
219 info
.si_code
= BUS_ADRALN
;
222 trace_unhandled_signal("bad address for unaligned fixup", regs
,
223 (unsigned long)addr
, SIGBUS
);
224 force_sig_info(info
.si_signo
, &info
, current
);
225 return (tilepro_bundle_bits
) 0;
228 if (unaligned_printk
|| unaligned_fixup_count
== 0) {
229 pr_info("Process %d/%s: PC %#lx: Fixup of unaligned %s at %#lx\n",
230 current
->pid
, current
->comm
, regs
->pc
,
231 mem_op
== MEMOP_LOAD
|| mem_op
== MEMOP_LOAD_POSTINCR
?
233 (unsigned long)addr
);
234 if (!unaligned_printk
) {
237 P("Unaligned fixups in the kernel will slow your application considerably.\n");
238 P("To find them, write a \"1\" to /proc/sys/tile/unaligned_fixup/printk,\n");
239 P("which requests the kernel show all unaligned fixups, or write a \"0\"\n");
240 P("to /proc/sys/tile/unaligned_fixup/enabled, in which case each unaligned\n");
241 P("access will become a SIGBUS you can debug. No further warnings will be\n");
242 P("shown so as to avoid additional slowdown, but you can track the number\n");
243 P("of fixups performed via /proc/sys/tile/unaligned_fixup/count.\n");
244 P("Use the tile-addr2line command (see \"info addr2line\") to decode PCs.\n");
249 ++unaligned_fixup_count
;
251 if (bundle
& TILEPRO_BUNDLE_Y_ENCODING_MASK
) {
252 /* Convert the Y2 instruction to a prefetch. */
253 bundle
&= ~(create_SrcBDest_Y2(-1) |
254 create_Opcode_Y2(-1));
255 bundle
|= (create_SrcBDest_Y2(TREG_ZERO
) |
256 create_Opcode_Y2(LW_OPCODE_Y2
));
257 /* Replace the load postincr with an addi */
258 } else if (mem_op
== MEMOP_LOAD_POSTINCR
) {
259 bundle
= addi_X1(bundle
, addr_reg
, addr_reg
,
260 get_Imm8_X1(bundle
));
261 /* Replace the store postincr with an addi */
262 } else if (mem_op
== MEMOP_STORE_POSTINCR
) {
263 bundle
= addi_X1(bundle
, addr_reg
, addr_reg
,
264 get_Dest_Imm8_X1(bundle
));
266 /* Convert the X1 instruction to a nop. */
267 bundle
&= ~(create_Opcode_X1(-1) |
268 create_UnShOpcodeExtension_X1(-1) |
269 create_UnOpcodeExtension_X1(-1));
270 bundle
|= (create_Opcode_X1(SHUN_0_OPCODE_X1
) |
271 create_UnShOpcodeExtension_X1(
272 UN_0_SHUN_0_OPCODE_X1
) |
273 create_UnOpcodeExtension_X1(
274 NOP_UN_0_SHUN_0_OPCODE_X1
));
281 * Called after execve() has started the new image. This allows us
282 * to reset the info state. Note that the the mmap'ed memory, if there
283 * was any, has already been unmapped by the exec.
285 void single_step_execve(void)
287 struct thread_info
*ti
= current_thread_info();
288 kfree(ti
->step_state
);
289 ti
->step_state
= NULL
;
293 * single_step_once() - entry point when single stepping has been triggered.
294 * @regs: The machine register state
296 * When we arrive at this routine via a trampoline, the single step
297 * engine copies the executing bundle to the single step buffer.
298 * If the instruction is a condition branch, then the target is
299 * reset to one past the next instruction. If the instruction
300 * sets the lr, then that is noted. If the instruction is a jump
301 * or call, then the new target pc is preserved and the current
302 * bundle instruction set to null.
304 * The necessary post-single-step rewriting information is stored in
305 * single_step_state-> We use data segment values because the
306 * stack will be rewound when we run the rewritten single-stepped
309 void single_step_once(struct pt_regs
*regs
)
311 extern tilepro_bundle_bits __single_step_ill_insn
;
312 extern tilepro_bundle_bits __single_step_j_insn
;
313 extern tilepro_bundle_bits __single_step_addli_insn
;
314 extern tilepro_bundle_bits __single_step_auli_insn
;
315 struct thread_info
*info
= (void *)current_thread_info();
316 struct single_step_state
*state
= info
->step_state
;
317 int is_single_step
= test_ti_thread_flag(info
, TIF_SINGLESTEP
);
318 tilepro_bundle_bits __user
*buffer
, *pc
;
319 tilepro_bundle_bits bundle
;
321 int target_reg
= TREG_LR
;
323 enum mem_op mem_op
= MEMOP_NONE
;
324 int size
= 0, sign_ext
= 0; /* happy compiler */
327 align_ctl
= unaligned_fixup
;
328 switch (task_thread_info(current
)->align_ctl
) {
329 case PR_UNALIGN_NOPRINT
:
332 case PR_UNALIGN_SIGBUS
:
338 " .pushsection .rodata.single_step\n"
340 " .globl __single_step_ill_insn\n"
341 "__single_step_ill_insn:\n"
343 " .globl __single_step_addli_insn\n"
344 "__single_step_addli_insn:\n"
345 " { nop; addli r0, zero, 0 }\n"
346 " .globl __single_step_auli_insn\n"
347 "__single_step_auli_insn:\n"
348 " { nop; auli r0, r0, 0 }\n"
349 " .globl __single_step_j_insn\n"
350 "__single_step_j_insn:\n"
356 * Enable interrupts here to allow touching userspace and the like.
357 * The callers expect this: do_trap() already has interrupts
358 * enabled, and do_work_pending() handles functions that enable
359 * interrupts internally.
364 /* allocate a page of writable, executable memory */
365 state
= kmalloc(sizeof(struct single_step_state
), GFP_KERNEL
);
367 pr_err("Out of kernel memory trying to single-step\n");
371 /* allocate a cache line of writable, executable memory */
372 buffer
= (void __user
*) vm_mmap(NULL
, 0, 64,
373 PROT_EXEC
| PROT_READ
| PROT_WRITE
,
374 MAP_PRIVATE
| MAP_ANONYMOUS
,
377 if (IS_ERR((void __force
*)buffer
)) {
379 pr_err("Out of kernel pages trying to single-step\n");
383 state
->buffer
= buffer
;
384 state
->is_enabled
= 0;
386 info
->step_state
= state
;
388 /* Validate our stored instruction patterns */
389 BUG_ON(get_Opcode_X1(__single_step_addli_insn
) !=
391 BUG_ON(get_Opcode_X1(__single_step_auli_insn
) !=
393 BUG_ON(get_SrcA_X1(__single_step_addli_insn
) != TREG_ZERO
);
394 BUG_ON(get_Dest_X1(__single_step_addli_insn
) != 0);
395 BUG_ON(get_JOffLong_X1(__single_step_j_insn
) != 0);
399 * If we are returning from a syscall, we still haven't hit the
400 * "ill" for the swint1 instruction. So back the PC up to be
401 * pointing at the swint1, but we'll actually return directly
402 * back to the "ill" so we come back in via SIGILL as if we
403 * had "executed" the swint1 without ever being in kernel space.
405 if (regs
->faultnum
== INT_SWINT_1
)
408 pc
= (tilepro_bundle_bits __user
*)(regs
->pc
);
409 if (get_user(bundle
, pc
) != 0) {
410 pr_err("Couldn't read instruction at %p trying to step\n", pc
);
414 /* We'll follow the instruction with 2 ill op bundles */
415 state
->orig_pc
= (unsigned long)pc
;
416 state
->next_pc
= (unsigned long)(pc
+ 1);
417 state
->branch_next_pc
= 0;
420 if (!(bundle
& TILEPRO_BUNDLE_Y_ENCODING_MASK
)) {
421 /* two wide, check for control flow */
422 int opcode
= get_Opcode_X1(bundle
);
426 case BRANCH_OPCODE_X1
:
428 s32 offset
= signExtend17(get_BrOff_X1(bundle
));
431 * For branches, we use a rewriting trick to let the
432 * hardware evaluate whether the branch is taken or
433 * untaken. We record the target offset and then
434 * rewrite the branch instruction to target 1 insn
435 * ahead if the branch is taken. We then follow the
436 * rewritten branch with two bundles, each containing
437 * an "ill" instruction. The supervisor examines the
438 * pc after the single step code is executed, and if
439 * the pc is the first ill instruction, then the
440 * branch (if any) was not taken. If the pc is the
441 * second ill instruction, then the branch was
442 * taken. The new pc is computed for these cases, and
443 * inserted into the registers for the thread. If
444 * the pc is the start of the single step code, then
445 * an exception or interrupt was taken before the
446 * code started processing, and the same "original"
447 * pc is restored. This change, different from the
448 * original implementation, has the advantage of
449 * executing a single user instruction.
451 state
->branch_next_pc
= (unsigned long)(pc
+ offset
);
453 /* rewrite branch offset to go forward one bundle */
454 bundle
= set_BrOff_X1(bundle
, 2);
463 (unsigned long) (pc
+ get_JOffLong_X1(bundle
));
469 (unsigned long) (pc
+ get_JOffLong_X1(bundle
));
470 bundle
= nop_X1(bundle
);
473 case SPECIAL_0_OPCODE_X1
:
474 switch (get_RRROpcodeExtension_X1(bundle
)) {
476 case JALRP_SPECIAL_0_OPCODE_X1
:
477 case JALR_SPECIAL_0_OPCODE_X1
:
480 regs
->regs
[get_SrcA_X1(bundle
)];
483 case JRP_SPECIAL_0_OPCODE_X1
:
484 case JR_SPECIAL_0_OPCODE_X1
:
486 regs
->regs
[get_SrcA_X1(bundle
)];
487 bundle
= nop_X1(bundle
);
490 case LNK_SPECIAL_0_OPCODE_X1
:
492 target_reg
= get_Dest_X1(bundle
);
496 case SH_SPECIAL_0_OPCODE_X1
:
497 mem_op
= MEMOP_STORE
;
501 case SW_SPECIAL_0_OPCODE_X1
:
502 mem_op
= MEMOP_STORE
;
509 case SHUN_0_OPCODE_X1
:
510 if (get_UnShOpcodeExtension_X1(bundle
) ==
511 UN_0_SHUN_0_OPCODE_X1
) {
512 switch (get_UnOpcodeExtension_X1(bundle
)) {
513 case LH_UN_0_SHUN_0_OPCODE_X1
:
519 case LH_U_UN_0_SHUN_0_OPCODE_X1
:
525 case LW_UN_0_SHUN_0_OPCODE_X1
:
530 case IRET_UN_0_SHUN_0_OPCODE_X1
:
532 unsigned long ex0_0
= __insn_mfspr(
534 unsigned long ex0_1
= __insn_mfspr(
537 * Special-case it if we're iret'ing
538 * to PL0 again. Otherwise just let
539 * it run and it will generate SIGILL.
541 if (EX1_PL(ex0_1
) == USER_PL
) {
542 state
->next_pc
= ex0_0
;
544 bundle
= nop_X1(bundle
);
551 /* postincrement operations */
552 case IMM_0_OPCODE_X1
:
553 switch (get_ImmOpcodeExtension_X1(bundle
)) {
554 case LWADD_IMM_0_OPCODE_X1
:
555 mem_op
= MEMOP_LOAD_POSTINCR
;
559 case LHADD_IMM_0_OPCODE_X1
:
560 mem_op
= MEMOP_LOAD_POSTINCR
;
565 case LHADD_U_IMM_0_OPCODE_X1
:
566 mem_op
= MEMOP_LOAD_POSTINCR
;
571 case SWADD_IMM_0_OPCODE_X1
:
572 mem_op
= MEMOP_STORE_POSTINCR
;
576 case SHADD_IMM_0_OPCODE_X1
:
577 mem_op
= MEMOP_STORE_POSTINCR
;
589 * Get an available register. We start with a
590 * bitmask with 1's for available registers.
591 * We truncate to the low 32 registers since
592 * we are guaranteed to have set bits in the
593 * low 32 bits, then use ctz to pick the first.
595 u32 mask
= (u32
) ~((1ULL << get_Dest_X0(bundle
)) |
596 (1ULL << get_SrcA_X0(bundle
)) |
597 (1ULL << get_SrcB_X0(bundle
)) |
598 (1ULL << target_reg
));
599 temp_reg
= __builtin_ctz(mask
);
600 state
->update_reg
= temp_reg
;
601 state
->update_value
= regs
->regs
[temp_reg
];
602 regs
->regs
[temp_reg
] = (unsigned long) (pc
+1);
603 regs
->flags
|= PT_FLAGS_RESTORE_REGS
;
604 bundle
= move_X1(bundle
, target_reg
, temp_reg
);
607 int opcode
= get_Opcode_Y2(bundle
);
630 mem_op
= MEMOP_STORE
;
635 mem_op
= MEMOP_STORE
;
642 * Check if we need to rewrite an unaligned load/store.
643 * Returning zero is a special value meaning we generated a signal.
645 if (mem_op
!= MEMOP_NONE
&& align_ctl
>= 0) {
646 bundle
= rewrite_load_store_unaligned(state
, bundle
, regs
,
647 mem_op
, size
, sign_ext
);
652 /* write the bundle to our execution area */
653 buffer
= state
->buffer
;
654 err
= __put_user(bundle
, buffer
++);
657 * If we're really single-stepping, we take an INT_ILL after.
658 * If we're just handling an unaligned access, we can just
659 * jump directly back to where we were in user code.
661 if (is_single_step
) {
662 err
|= __put_user(__single_step_ill_insn
, buffer
++);
663 err
|= __put_user(__single_step_ill_insn
, buffer
++);
668 /* We have some state to update; do it inline */
670 bundle
= __single_step_addli_insn
;
671 bundle
|= create_Dest_X1(state
->update_reg
);
672 bundle
|= create_Imm16_X1(state
->update_value
);
673 err
|= __put_user(bundle
, buffer
++);
674 bundle
= __single_step_auli_insn
;
675 bundle
|= create_Dest_X1(state
->update_reg
);
676 bundle
|= create_SrcA_X1(state
->update_reg
);
677 ha16
= (state
->update_value
+ 0x8000) >> 16;
678 bundle
|= create_Imm16_X1(ha16
);
679 err
|= __put_user(bundle
, buffer
++);
683 /* End with a jump back to the next instruction */
684 delta
= ((regs
->pc
+ TILEPRO_BUNDLE_SIZE_IN_BYTES
) -
685 (unsigned long)buffer
) >>
686 TILEPRO_LOG2_BUNDLE_ALIGNMENT_IN_BYTES
;
687 bundle
= __single_step_j_insn
;
688 bundle
|= create_JOffLong_X1(delta
);
689 err
|= __put_user(bundle
, buffer
++);
693 pr_err("Fault when writing to single-step buffer\n");
699 * We do a local flush only, since this is a thread-specific buffer.
701 __flush_icache_range((unsigned long)state
->buffer
,
702 (unsigned long)buffer
);
704 /* Indicate enabled */
705 state
->is_enabled
= is_single_step
;
706 regs
->pc
= (unsigned long)state
->buffer
;
708 /* Fault immediately if we are coming back from a syscall. */
709 if (regs
->faultnum
== INT_SWINT_1
)
715 static DEFINE_PER_CPU(unsigned long, ss_saved_pc
);
719 * Called directly on the occasion of an interrupt.
721 * If the process doesn't have single step set, then we use this as an
722 * opportunity to turn single step off.
724 * It has been mentioned that we could conditionally turn off single stepping
725 * on each entry into the kernel and rely on single_step_once to turn it
726 * on for the processes that matter (as we already do), but this
727 * implementation is somewhat more efficient in that we muck with registers
728 * once on a bum interrupt rather than on every entry into the kernel.
730 * If SINGLE_STEP_CONTROL_K has CANCELED set, then an interrupt occurred,
731 * so we have to run through this process again before we can say that an
732 * instruction has executed.
734 * swint will set CANCELED, but it's a legitimate instruction. Fortunately
735 * it changes the PC. If it hasn't changed, then we know that the interrupt
736 * wasn't generated by swint and we'll need to run this process again before
737 * we can say an instruction has executed.
739 * If either CANCELED == 0 or the PC's changed, we send out SIGTRAPs and get
743 void gx_singlestep_handle(struct pt_regs
*regs
, int fault_num
)
745 unsigned long *ss_pc
= this_cpu_ptr(&ss_saved_pc
);
746 struct thread_info
*info
= (void *)current_thread_info();
747 int is_single_step
= test_ti_thread_flag(info
, TIF_SINGLESTEP
);
748 unsigned long control
= __insn_mfspr(SPR_SINGLE_STEP_CONTROL_K
);
750 if (is_single_step
== 0) {
751 __insn_mtspr(SPR_SINGLE_STEP_EN_K_K
, 0);
753 } else if ((*ss_pc
!= regs
->pc
) ||
754 (!(control
& SPR_SINGLE_STEP_CONTROL_1__CANCELED_MASK
))) {
756 control
|= SPR_SINGLE_STEP_CONTROL_1__CANCELED_MASK
;
757 control
|= SPR_SINGLE_STEP_CONTROL_1__INHIBIT_MASK
;
758 __insn_mtspr(SPR_SINGLE_STEP_CONTROL_K
, control
);
759 send_sigtrap(current
, regs
);
765 * Called from need_singlestep. Set up the control registers and the enable
766 * register, then return back.
769 void single_step_once(struct pt_regs
*regs
)
771 unsigned long *ss_pc
= this_cpu_ptr(&ss_saved_pc
);
772 unsigned long control
= __insn_mfspr(SPR_SINGLE_STEP_CONTROL_K
);
775 control
|= SPR_SINGLE_STEP_CONTROL_1__CANCELED_MASK
;
776 control
|= SPR_SINGLE_STEP_CONTROL_1__INHIBIT_MASK
;
777 __insn_mtspr(SPR_SINGLE_STEP_CONTROL_K
, control
);
778 __insn_mtspr(SPR_SINGLE_STEP_EN_K_K
, 1 << USER_PL
);
781 void single_step_execve(void)
786 #endif /* !__tilegx__ */