arch/sh/kernel/hw_breakpoint.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * arch/sh/kernel/hw_breakpoint.c
   4  *
   5  * Unified kernel/user-space hardware breakpoint facility for the on-chip UBC.
   6  *
   7  * Copyright (C) 2009 - 2010  Paul Mundt
   8  */
   9 #include <linux/init.h>
  10 #include <linux/perf_event.h>
  11 #include <linux/sched/signal.h>
  12 #include <linux/hw_breakpoint.h>
  13 #include <linux/percpu.h>
  14 #include <linux/kallsyms.h>
  15 #include <linux/notifier.h>
  16 #include <linux/kprobes.h>
  17 #include <linux/kdebug.h>
  18 #include <linux/io.h>
  19 #include <linux/clk.h>
  20 #include <asm/hw_breakpoint.h>
  21 #include <asm/mmu_context.h>
  22 #include <asm/ptrace.h>
  23 #include <asm/traps.h>
  24
  25 /*
  26  * Stores the breakpoints currently in use on each breakpoint address
  27  * register for each cpus
  28  */
  29 static DEFINE_PER_CPU(struct perf_event *, bp_per_reg[HBP_NUM]);
  30
  31 /*
  32  * A dummy placeholder for early accesses until the CPUs get a chance to
  33  * register their UBCs later in the boot process.
  34  */
  35 static struct sh_ubc ubc_dummy = { .num_events = 0 };
  36
  37 static struct sh_ubc *sh_ubc __read_mostly = &ubc_dummy;
  38
  39 /*
  40  * Install a perf counter breakpoint.
  41  *
  42  * We seek a free UBC channel and use it for this breakpoint.
  43  *
  44  * Atomic: we hold the counter->ctx->lock and we only handle variables
  45  * and registers local to this cpu.
  46  */
  47 int arch_install_hw_breakpoint(struct perf_event *bp)
  48 {
  49         struct arch_hw_breakpoint *info = counter_arch_bp(bp);
  50         int i;
  51
  52         for (i = 0; i < sh_ubc->num_events; i++) {
  53                 struct perf_event **slot = this_cpu_ptr(&bp_per_reg[i]);
  54
  55                 if (!*slot) {
  56                         *slot = bp;
  57                         break;
  58                 }
  59         }
  60
  61         if (WARN_ONCE(i == sh_ubc->num_events, "Can't find any breakpoint slot"))
  62                 return -EBUSY;
  63
  64         clk_enable(sh_ubc->clk);
  65         sh_ubc->enable(info, i);
  66
  67         return 0;
  68 }
  69
  70 /*
  71  * Uninstall the breakpoint contained in the given counter.
  72  *
  73  * First we search the debug address register it uses and then we disable
  74  * it.
  75  *
  76  * Atomic: we hold the counter->ctx->lock and we only handle variables
  77  * and registers local to this cpu.
  78  */
  79 void arch_uninstall_hw_breakpoint(struct perf_event *bp)
  80 {
  81         struct arch_hw_breakpoint *info = counter_arch_bp(bp);
  82         int i;
  83
  84         for (i = 0; i < sh_ubc->num_events; i++) {
  85                 struct perf_event **slot = this_cpu_ptr(&bp_per_reg[i]);
  86
  87                 if (*slot == bp) {
  88                         *slot = NULL;
  89                         break;
  90                 }
  91         }
  92
  93         if (WARN_ONCE(i == sh_ubc->num_events, "Can't find any breakpoint slot"))
  94                 return;
  95
  96         sh_ubc->disable(info, i);
  97         clk_disable(sh_ubc->clk);
  98 }
  99
 100 static int get_hbp_len(u16 hbp_len)
 101 {
 102         unsigned int len_in_bytes = 0;
 103
 104         switch (hbp_len) {
 105         case SH_BREAKPOINT_LEN_1:
 106                 len_in_bytes = 1;
 107                 break;
 108         case SH_BREAKPOINT_LEN_2:
 109                 len_in_bytes = 2;
 110                 break;
 111         case SH_BREAKPOINT_LEN_4:
 112                 len_in_bytes = 4;
 113                 break;
 114         case SH_BREAKPOINT_LEN_8:
 115                 len_in_bytes = 8;
 116                 break;
 117         }
 118         return len_in_bytes;
 119 }
 120
 121 /*
 122  * Check for virtual address in kernel space.
 123  */
 124 int arch_check_bp_in_kernelspace(struct arch_hw_breakpoint *hw)
 125 {
 126         unsigned int len;
 127         unsigned long va;
 128
 129         va = hw->address;
 130         len = get_hbp_len(hw->len);
 131
 132         return (va >= TASK_SIZE) && ((va + len - 1) >= TASK_SIZE);
 133 }
 134
 135 int arch_bp_generic_fields(int sh_len, int sh_type,
 136                            int *gen_len, int *gen_type)
 137 {
 138         /* Len */
 139         switch (sh_len) {
 140         case SH_BREAKPOINT_LEN_1:
 141                 *gen_len = HW_BREAKPOINT_LEN_1;
 142                 break;
 143         case SH_BREAKPOINT_LEN_2:
 144                 *gen_len = HW_BREAKPOINT_LEN_2;
 145                 break;
 146         case SH_BREAKPOINT_LEN_4:
 147                 *gen_len = HW_BREAKPOINT_LEN_4;
 148                 break;
 149         case SH_BREAKPOINT_LEN_8:
 150                 *gen_len = HW_BREAKPOINT_LEN_8;
 151                 break;
 152         default:
 153                 return -EINVAL;
 154         }
 155
 156         /* Type */
 157         switch (sh_type) {
 158         case SH_BREAKPOINT_READ:
 159                 *gen_type = HW_BREAKPOINT_R;
 160                 break;
 161         case SH_BREAKPOINT_WRITE:
 162                 *gen_type = HW_BREAKPOINT_W;
 163                 break;
 164         case SH_BREAKPOINT_RW:
 165                 *gen_type = HW_BREAKPOINT_W | HW_BREAKPOINT_R;
 166                 break;
 167         default:
 168                 return -EINVAL;
 169         }
 170
 171         return 0;
 172 }
 173
 174 static int arch_build_bp_info(struct perf_event *bp,
 175                               const struct perf_event_attr *attr,
 176                               struct arch_hw_breakpoint *hw)
 177 {
 178         hw->address = attr->bp_addr;
 179
 180         /* Len */
 181         switch (attr->bp_len) {
 182         case HW_BREAKPOINT_LEN_1:
 183                 hw->len = SH_BREAKPOINT_LEN_1;
 184                 break;
 185         case HW_BREAKPOINT_LEN_2:
 186                 hw->len = SH_BREAKPOINT_LEN_2;
 187                 break;
 188         case HW_BREAKPOINT_LEN_4:
 189                 hw->len = SH_BREAKPOINT_LEN_4;
 190                 break;
 191         case HW_BREAKPOINT_LEN_8:
 192                 hw->len = SH_BREAKPOINT_LEN_8;
 193                 break;
 194         default:
 195                 return -EINVAL;
 196         }
 197
 198         /* Type */
 199         switch (attr->bp_type) {
 200         case HW_BREAKPOINT_R:
 201                 hw->type = SH_BREAKPOINT_READ;
 202                 break;
 203         case HW_BREAKPOINT_W:
 204                 hw->type = SH_BREAKPOINT_WRITE;
 205                 break;
 206         case HW_BREAKPOINT_W | HW_BREAKPOINT_R:
 207                 hw->type = SH_BREAKPOINT_RW;
 208                 break;
 209         default:
 210                 return -EINVAL;
 211         }
 212
 213         return 0;
 214 }
 215
 216 /*
 217  * Validate the arch-specific HW Breakpoint register settings
 218  */
 219 int hw_breakpoint_arch_parse(struct perf_event *bp,
 220                              const struct perf_event_attr *attr,
 221                              struct arch_hw_breakpoint *hw)
 222 {
 223         unsigned int align;
 224         int ret;
 225
 226         ret = arch_build_bp_info(bp, attr, hw);
 227         if (ret)
 228                 return ret;
 229
 230         ret = -EINVAL;
 231
 232         switch (hw->len) {
 233         case SH_BREAKPOINT_LEN_1:
 234                 align = 0;
 235                 break;
 236         case SH_BREAKPOINT_LEN_2:
 237                 align = 1;
 238                 break;
 239         case SH_BREAKPOINT_LEN_4:
 240                 align = 3;
 241                 break;
 242         case SH_BREAKPOINT_LEN_8:
 243                 align = 7;
 244                 break;
 245         default:
 246                 return ret;
 247         }
 248
 249         /*
 250          * Check that the low-order bits of the address are appropriate
 251          * for the alignment implied by len.
 252          */
 253         if (hw->address & align)
 254                 return -EINVAL;
 255
 256         return 0;
 257 }
 258
 259 /*
 260  * Release the user breakpoints used by ptrace
 261  */
 262 void flush_ptrace_hw_breakpoint(struct task_struct *tsk)
 263 {
 264         int i;
 265         struct thread_struct *t = &tsk->thread;
 266
 267         for (i = 0; i < sh_ubc->num_events; i++) {
 268                 unregister_hw_breakpoint(t->ptrace_bps[i]);
 269                 t->ptrace_bps[i] = NULL;
 270         }
 271 }
 272
 273 static int __kprobes hw_breakpoint_handler(struct die_args *args)
 274 {
 275         int cpu, i, rc = NOTIFY_STOP;
 276         struct perf_event *bp;
 277         unsigned int cmf, resume_mask;
 278
 279         /*
 280          * Do an early return if none of the channels triggered.
 281          */
 282         cmf = sh_ubc->triggered_mask();
 283         if (unlikely(!cmf))
 284                 return NOTIFY_DONE;
 285
 286         /*
 287          * By default, resume all of the active channels.
 288          */
 289         resume_mask = sh_ubc->active_mask();
 290
 291         /*
 292          * Disable breakpoints during exception handling.
 293          */
 294         sh_ubc->disable_all();
 295
 296         cpu = get_cpu();
 297         for (i = 0; i < sh_ubc->num_events; i++) {
 298                 unsigned long event_mask = (1 << i);
 299
 300                 if (likely(!(cmf & event_mask)))
 301                         continue;
 302
 303                 /*
 304                  * The counter may be concurrently released but that can only
 305                  * occur from a call_rcu() path. We can then safely fetch
 306                  * the breakpoint, use its callback, touch its counter
 307                  * while we are in an rcu_read_lock() path.
 308                  */
 309                 rcu_read_lock();
 310
 311                 bp = per_cpu(bp_per_reg[i], cpu);
 312                 if (bp)
 313                         rc = NOTIFY_DONE;
 314
 315                 /*
 316                  * Reset the condition match flag to denote completion of
 317                  * exception handling.
 318                  */
 319                 sh_ubc->clear_triggered_mask(event_mask);
 320
 321                 /*
 322                  * bp can be NULL due to concurrent perf counter
 323                  * removing.
 324                  */
 325                 if (!bp) {
 326                         rcu_read_unlock();
 327                         break;
 328                 }
 329
 330                 /*
 331                  * Don't restore the channel if the breakpoint is from
 332                  * ptrace, as it always operates in one-shot mode.
 333                  */
 334                 if (bp->overflow_handler == ptrace_triggered)
 335                         resume_mask &= ~(1 << i);
 336
 337                 perf_bp_event(bp, args->regs);
 338
 339                 /* Deliver the signal to userspace */
 340                 if (!arch_check_bp_in_kernelspace(&bp->hw.info)) {
 341                         force_sig_fault(SIGTRAP, TRAP_HWBKPT,
 342                                         (void __user *)NULL);
 343                 }
 344
 345                 rcu_read_unlock();
 346         }
 347
 348         if (cmf == 0)
 349                 rc = NOTIFY_DONE;
 350
 351         sh_ubc->enable_all(resume_mask);
 352
 353         put_cpu();
 354
 355         return rc;
 356 }
 357
 358 BUILD_TRAP_HANDLER(breakpoint)
 359 {
 360         unsigned long ex = lookup_exception_vector();
 361         TRAP_HANDLER_DECL;
 362
 363         notify_die(DIE_BREAKPOINT, "breakpoint", regs, 0, ex, SIGTRAP);
 364 }
 365
 366 /*
 367  * Handle debug exception notifications.
 368  */
 369 int __kprobes hw_breakpoint_exceptions_notify(struct notifier_block *unused,
 370                                     unsigned long val, void *data)
 371 {
 372         struct die_args *args = data;
 373
 374         if (val != DIE_BREAKPOINT)
 375                 return NOTIFY_DONE;
 376
 377         /*
 378          * If the breakpoint hasn't been triggered by the UBC, it's
 379          * probably from a debugger, so don't do anything more here.
 380          *
 381          * This also permits the UBC interface clock to remain off for
 382          * non-UBC breakpoints, as we don't need to check the triggered
 383          * or active channel masks.
 384          */
 385         if (args->trapnr != sh_ubc->trap_nr)
 386                 return NOTIFY_DONE;
 387
 388         return hw_breakpoint_handler(data);
 389 }
 390
 391 void hw_breakpoint_pmu_read(struct perf_event *bp)
 392 {
 393         /* TODO */
 394 }
 395
 396 int register_sh_ubc(struct sh_ubc *ubc)
 397 {
 398         /* Bail if it's already assigned */
 399         if (sh_ubc != &ubc_dummy)
 400                 return -EBUSY;
 401         sh_ubc = ubc;
 402
 403         pr_info("HW Breakpoints: %s UBC support registered\n", ubc->name);
 404
 405         WARN_ON(ubc->num_events > HBP_NUM);
 406
 407         return 0;
 408 }