1 /*
2 * This program is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License version 2 as
4 * published by the Free Software Foundation.
5 *
6 * This program is distributed in the hope that it will be useful,
7 * but WITHOUT ANY WARRANTY; without even the implied warranty of
8 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
9 * GNU General Public License for more details.
10 *
11 * You should have received a copy of the GNU General Public License
12 * along with this program; if not, write to the Free Software
13 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
14 *
15 * Copyright (C) 2009, 2010 ARM Limited
16 *
17 * Author: Will Deacon <will.deacon@arm.com>
18 */
19
20 /*
21 * HW_breakpoint: a unified kernel/user-space hardware breakpoint facility,
22 * using the CPU's debug registers.
23 */
24 #define pr_fmt(fmt) "hw-breakpoint: " fmt
25
26 #include <linux/errno.h>
27 #include <linux/hardirq.h>
28 #include <linux/perf_event.h>
29 #include <linux/hw_breakpoint.h>
30 #include <linux/smp.h>
31
32 #include <asm/cacheflush.h>
33 #include <asm/cputype.h>
34 #include <asm/current.h>
35 #include <asm/hw_breakpoint.h>
36 #include <asm/kdebug.h>
37 #include <asm/system.h>
38 #include <asm/traps.h>
39
40 /* Breakpoint currently in use for each BRP. */
41 static DEFINE_PER_CPU(struct perf_event *, bp_on_reg[ARM_MAX_BRP]);
42
43 /* Watchpoint currently in use for each WRP. */
44 static DEFINE_PER_CPU(struct perf_event *, wp_on_reg[ARM_MAX_WRP]);
45
46 /* Number of BRP/WRP registers on this CPU. */
47 static int core_num_brps;
48 static int core_num_wrps;
49
50 /* Debug architecture version. */
51 static u8 debug_arch;
52
53 /* Maximum supported watchpoint length. */
54 static u8 max_watchpoint_len;
55
56 #define READ_WB_REG_CASE(OP2, M, VAL) \
57 case ((OP2 << 4) + M): \
58 ARM_DBG_READ(c ## M, OP2, VAL); \
59 break
60
61 #define WRITE_WB_REG_CASE(OP2, M, VAL) \
62 case ((OP2 << 4) + M): \
63 ARM_DBG_WRITE(c ## M, OP2, VAL);\
64 break
65
66 #define GEN_READ_WB_REG_CASES(OP2, VAL) \
67 READ_WB_REG_CASE(OP2, 0, VAL); \
68 READ_WB_REG_CASE(OP2, 1, VAL); \
69 READ_WB_REG_CASE(OP2, 2, VAL); \
70 READ_WB_REG_CASE(OP2, 3, VAL); \
71 READ_WB_REG_CASE(OP2, 4, VAL); \
72 READ_WB_REG_CASE(OP2, 5, VAL); \
73 READ_WB_REG_CASE(OP2, 6, VAL); \
74 READ_WB_REG_CASE(OP2, 7, VAL); \
75 READ_WB_REG_CASE(OP2, 8, VAL); \
76 READ_WB_REG_CASE(OP2, 9, VAL); \
77 READ_WB_REG_CASE(OP2, 10, VAL); \
78 READ_WB_REG_CASE(OP2, 11, VAL); \
79 READ_WB_REG_CASE(OP2, 12, VAL); \
80 READ_WB_REG_CASE(OP2, 13, VAL); \
81 READ_WB_REG_CASE(OP2, 14, VAL); \
82 READ_WB_REG_CASE(OP2, 15, VAL)
83
84 #define GEN_WRITE_WB_REG_CASES(OP2, VAL) \
85 WRITE_WB_REG_CASE(OP2, 0, VAL); \
86 WRITE_WB_REG_CASE(OP2, 1, VAL); \
87 WRITE_WB_REG_CASE(OP2, 2, VAL); \
88 WRITE_WB_REG_CASE(OP2, 3, VAL); \
89 WRITE_WB_REG_CASE(OP2, 4, VAL); \
90 WRITE_WB_REG_CASE(OP2, 5, VAL); \
91 WRITE_WB_REG_CASE(OP2, 6, VAL); \
92 WRITE_WB_REG_CASE(OP2, 7, VAL); \
93 WRITE_WB_REG_CASE(OP2, 8, VAL); \
94 WRITE_WB_REG_CASE(OP2, 9, VAL); \
95 WRITE_WB_REG_CASE(OP2, 10, VAL); \
96 WRITE_WB_REG_CASE(OP2, 11, VAL); \
97 WRITE_WB_REG_CASE(OP2, 12, VAL); \
98 WRITE_WB_REG_CASE(OP2, 13, VAL); \
99 WRITE_WB_REG_CASE(OP2, 14, VAL); \
100 WRITE_WB_REG_CASE(OP2, 15, VAL)
101
read_wb_reg(int n)102 static u32 read_wb_reg(int n)
103 {
104 u32 val = 0;
105
106 switch (n) {
107 GEN_READ_WB_REG_CASES(ARM_OP2_BVR, val);
108 GEN_READ_WB_REG_CASES(ARM_OP2_BCR, val);
109 GEN_READ_WB_REG_CASES(ARM_OP2_WVR, val);
110 GEN_READ_WB_REG_CASES(ARM_OP2_WCR, val);
111 default:
112 pr_warning("attempt to read from unknown breakpoint "
113 "register %d\n", n);
114 }
115
116 return val;
117 }
118
write_wb_reg(int n,u32 val)119 static void write_wb_reg(int n, u32 val)
120 {
121 switch (n) {
122 GEN_WRITE_WB_REG_CASES(ARM_OP2_BVR, val);
123 GEN_WRITE_WB_REG_CASES(ARM_OP2_BCR, val);
124 GEN_WRITE_WB_REG_CASES(ARM_OP2_WVR, val);
125 GEN_WRITE_WB_REG_CASES(ARM_OP2_WCR, val);
126 default:
127 pr_warning("attempt to write to unknown breakpoint "
128 "register %d\n", n);
129 }
130 isb();
131 }
132
133 /* Determine debug architecture. */
get_debug_arch(void)134 static u8 get_debug_arch(void)
135 {
136 u32 didr;
137
138 /* Do we implement the extended CPUID interface? */
139 if (((read_cpuid_id() >> 16) & 0xf) != 0xf) {
140 pr_warning("CPUID feature registers not supported. "
141 "Assuming v6 debug is present.\n");
142 return ARM_DEBUG_ARCH_V6;
143 }
144
145 ARM_DBG_READ(c0, 0, didr);
146 return (didr >> 16) & 0xf;
147 }
148
arch_get_debug_arch(void)149 u8 arch_get_debug_arch(void)
150 {
151 return debug_arch;
152 }
153
debug_arch_supported(void)154 static int debug_arch_supported(void)
155 {
156 u8 arch = get_debug_arch();
157
158 /* We don't support the memory-mapped interface. */
159 return (arch >= ARM_DEBUG_ARCH_V6 && arch <= ARM_DEBUG_ARCH_V7_ECP14) ||
160 arch >= ARM_DEBUG_ARCH_V7_1;
161 }
162
163 /* Determine number of WRP registers available. */
get_num_wrp_resources(void)164 static int get_num_wrp_resources(void)
165 {
166 u32 didr;
167 ARM_DBG_READ(c0, 0, didr);
168 return ((didr >> 28) & 0xf) + 1;
169 }
170
171 /* Determine number of BRP registers available. */
get_num_brp_resources(void)172 static int get_num_brp_resources(void)
173 {
174 u32 didr;
175 ARM_DBG_READ(c0, 0, didr);
176 return ((didr >> 24) & 0xf) + 1;
177 }
178
179 /* Does this core support mismatch breakpoints? */
core_has_mismatch_brps(void)180 static int core_has_mismatch_brps(void)
181 {
182 return (get_debug_arch() >= ARM_DEBUG_ARCH_V7_ECP14 &&
183 get_num_brp_resources() > 1);
184 }
185
186 /* Determine number of usable WRPs available. */
get_num_wrps(void)187 static int get_num_wrps(void)
188 {
189 /*
190 * On debug architectures prior to 7.1, when a watchpoint fires, the
191 * only way to work out which watchpoint it was is by disassembling
192 * the faulting instruction and working out the address of the memory
193 * access.
194 *
195 * Furthermore, we can only do this if the watchpoint was precise
196 * since imprecise watchpoints prevent us from calculating register
197 * based addresses.
198 *
199 * Providing we have more than 1 breakpoint register, we only report
200 * a single watchpoint register for the time being. This way, we always
201 * know which watchpoint fired. In the future we can either add a
202 * disassembler and address generation emulator, or we can insert a
203 * check to see if the DFAR is set on watchpoint exception entry
204 * [the ARM ARM states that the DFAR is UNKNOWN, but experience shows
205 * that it is set on some implementations].
206 */
207 if (get_debug_arch() < ARM_DEBUG_ARCH_V7_1)
208 return 1;
209
210 return get_num_wrp_resources();
211 }
212
213 /* Determine number of usable BRPs available. */
get_num_brps(void)214 static int get_num_brps(void)
215 {
216 int brps = get_num_brp_resources();
217 return core_has_mismatch_brps() ? brps - 1 : brps;
218 }
219
220 /*
221 * In order to access the breakpoint/watchpoint control registers,
222 * we must be running in debug monitor mode. Unfortunately, we can
223 * be put into halting debug mode at any time by an external debugger
224 * but there is nothing we can do to prevent that.
225 */
enable_monitor_mode(void)226 static int enable_monitor_mode(void)
227 {
228 u32 dscr;
229 int ret = 0;
230
231 ARM_DBG_READ(c1, 0, dscr);
232
233 /* Ensure that halting mode is disabled. */
234 if (WARN_ONCE(dscr & ARM_DSCR_HDBGEN,
235 "halting debug mode enabled. Unable to access hardware resources.\n")) {
236 ret = -EPERM;
237 goto out;
238 }
239
240 /* If monitor mode is already enabled, just return. */
241 if (dscr & ARM_DSCR_MDBGEN)
242 goto out;
243
244 /* Write to the corresponding DSCR. */
245 switch (get_debug_arch()) {
246 case ARM_DEBUG_ARCH_V6:
247 case ARM_DEBUG_ARCH_V6_1:
248 ARM_DBG_WRITE(c1, 0, (dscr | ARM_DSCR_MDBGEN));
249 break;
250 case ARM_DEBUG_ARCH_V7_ECP14:
251 case ARM_DEBUG_ARCH_V7_1:
252 ARM_DBG_WRITE(c2, 2, (dscr | ARM_DSCR_MDBGEN));
253 break;
254 default:
255 ret = -ENODEV;
256 goto out;
257 }
258
259 /* Check that the write made it through. */
260 ARM_DBG_READ(c1, 0, dscr);
261 if (!(dscr & ARM_DSCR_MDBGEN))
262 ret = -EPERM;
263
264 out:
265 return ret;
266 }
267
hw_breakpoint_slots(int type)268 int hw_breakpoint_slots(int type)
269 {
270 if (!debug_arch_supported())
271 return 0;
272
273 /*
274 * We can be called early, so don't rely on
275 * our static variables being initialised.
276 */
277 switch (type) {
278 case TYPE_INST:
279 return get_num_brps();
280 case TYPE_DATA:
281 return get_num_wrps();
282 default:
283 pr_warning("unknown slot type: %d\n", type);
284 return 0;
285 }
286 }
287
288 /*
289 * Check if 8-bit byte-address select is available.
290 * This clobbers WRP 0.
291 */
get_max_wp_len(void)292 static u8 get_max_wp_len(void)
293 {
294 u32 ctrl_reg;
295 struct arch_hw_breakpoint_ctrl ctrl;
296 u8 size = 4;
297
298 if (debug_arch < ARM_DEBUG_ARCH_V7_ECP14)
299 goto out;
300
301 memset(&ctrl, 0, sizeof(ctrl));
302 ctrl.len = ARM_BREAKPOINT_LEN_8;
303 ctrl_reg = encode_ctrl_reg(ctrl);
304
305 write_wb_reg(ARM_BASE_WVR, 0);
306 write_wb_reg(ARM_BASE_WCR, ctrl_reg);
307 if ((read_wb_reg(ARM_BASE_WCR) & ctrl_reg) == ctrl_reg)
308 size = 8;
309
310 out:
311 return size;
312 }
313
arch_get_max_wp_len(void)314 u8 arch_get_max_wp_len(void)
315 {
316 return max_watchpoint_len;
317 }
318
319 /*
320 * Install a perf counter breakpoint.
321 */
arch_install_hw_breakpoint(struct perf_event * bp)322 int arch_install_hw_breakpoint(struct perf_event *bp)
323 {
324 struct arch_hw_breakpoint *info = counter_arch_bp(bp);
325 struct perf_event **slot, **slots;
326 int i, max_slots, ctrl_base, val_base, ret = 0;
327 u32 addr, ctrl;
328
329 /* Ensure that we are in monitor mode and halting mode is disabled. */
330 ret = enable_monitor_mode();
331 if (ret)
332 goto out;
333
334 addr = info->address;
335 ctrl = encode_ctrl_reg(info->ctrl) | 0x1;
336
337 if (info->ctrl.type == ARM_BREAKPOINT_EXECUTE) {
338 /* Breakpoint */
339 ctrl_base = ARM_BASE_BCR;
340 val_base = ARM_BASE_BVR;
341 slots = (struct perf_event **)__get_cpu_var(bp_on_reg);
342 max_slots = core_num_brps;
343 } else {
344 /* Watchpoint */
345 ctrl_base = ARM_BASE_WCR;
346 val_base = ARM_BASE_WVR;
347 slots = (struct perf_event **)__get_cpu_var(wp_on_reg);
348 max_slots = core_num_wrps;
349 }
350
351 for (i = 0; i < max_slots; ++i) {
352 slot = &slots[i];
353
354 if (!*slot) {
355 *slot = bp;
356 break;
357 }
358 }
359
360 if (WARN_ONCE(i == max_slots, "Can't find any breakpoint slot\n")) {
361 ret = -EBUSY;
362 goto out;
363 }
364
365 /* Override the breakpoint data with the step data. */
366 if (info->step_ctrl.enabled) {
367 addr = info->trigger & ~0x3;
368 ctrl = encode_ctrl_reg(info->step_ctrl);
369 if (info->ctrl.type != ARM_BREAKPOINT_EXECUTE) {
370 i = 0;
371 ctrl_base = ARM_BASE_BCR + core_num_brps;
372 val_base = ARM_BASE_BVR + core_num_brps;
373 }
374 }
375
376 /* Setup the address register. */
377 write_wb_reg(val_base + i, addr);
378
379 /* Setup the control register. */
380 write_wb_reg(ctrl_base + i, ctrl);
381
382 out:
383 return ret;
384 }
385
arch_uninstall_hw_breakpoint(struct perf_event * bp)386 void arch_uninstall_hw_breakpoint(struct perf_event *bp)
387 {
388 struct arch_hw_breakpoint *info = counter_arch_bp(bp);
389 struct perf_event **slot, **slots;
390 int i, max_slots, base;
391
392 if (info->ctrl.type == ARM_BREAKPOINT_EXECUTE) {
393 /* Breakpoint */
394 base = ARM_BASE_BCR;
395 slots = (struct perf_event **)__get_cpu_var(bp_on_reg);
396 max_slots = core_num_brps;
397 } else {
398 /* Watchpoint */
399 base = ARM_BASE_WCR;
400 slots = (struct perf_event **)__get_cpu_var(wp_on_reg);
401 max_slots = core_num_wrps;
402 }
403
404 /* Remove the breakpoint. */
405 for (i = 0; i < max_slots; ++i) {
406 slot = &slots[i];
407
408 if (*slot == bp) {
409 *slot = NULL;
410 break;
411 }
412 }
413
414 if (WARN_ONCE(i == max_slots, "Can't find any breakpoint slot\n"))
415 return;
416
417 /* Ensure that we disable the mismatch breakpoint. */
418 if (info->ctrl.type != ARM_BREAKPOINT_EXECUTE &&
419 info->step_ctrl.enabled) {
420 i = 0;
421 base = ARM_BASE_BCR + core_num_brps;
422 }
423
424 /* Reset the control register. */
425 write_wb_reg(base + i, 0);
426 }
427
get_hbp_len(u8 hbp_len)428 static int get_hbp_len(u8 hbp_len)
429 {
430 unsigned int len_in_bytes = 0;
431
432 switch (hbp_len) {
433 case ARM_BREAKPOINT_LEN_1:
434 len_in_bytes = 1;
435 break;
436 case ARM_BREAKPOINT_LEN_2:
437 len_in_bytes = 2;
438 break;
439 case ARM_BREAKPOINT_LEN_4:
440 len_in_bytes = 4;
441 break;
442 case ARM_BREAKPOINT_LEN_8:
443 len_in_bytes = 8;
444 break;
445 }
446
447 return len_in_bytes;
448 }
449
450 /*
451 * Check whether bp virtual address is in kernel space.
452 */
arch_check_bp_in_kernelspace(struct perf_event * bp)453 int arch_check_bp_in_kernelspace(struct perf_event *bp)
454 {
455 unsigned int len;
456 unsigned long va;
457 struct arch_hw_breakpoint *info = counter_arch_bp(bp);
458
459 va = info->address;
460 len = get_hbp_len(info->ctrl.len);
461
462 return (va >= TASK_SIZE) && ((va + len - 1) >= TASK_SIZE);
463 }
464
465 /*
466 * Extract generic type and length encodings from an arch_hw_breakpoint_ctrl.
467 * Hopefully this will disappear when ptrace can bypass the conversion
468 * to generic breakpoint descriptions.
469 */
arch_bp_generic_fields(struct arch_hw_breakpoint_ctrl ctrl,int * gen_len,int * gen_type)470 int arch_bp_generic_fields(struct arch_hw_breakpoint_ctrl ctrl,
471 int *gen_len, int *gen_type)
472 {
473 /* Type */
474 switch (ctrl.type) {
475 case ARM_BREAKPOINT_EXECUTE:
476 *gen_type = HW_BREAKPOINT_X;
477 break;
478 case ARM_BREAKPOINT_LOAD:
479 *gen_type = HW_BREAKPOINT_R;
480 break;
481 case ARM_BREAKPOINT_STORE:
482 *gen_type = HW_BREAKPOINT_W;
483 break;
484 case ARM_BREAKPOINT_LOAD | ARM_BREAKPOINT_STORE:
485 *gen_type = HW_BREAKPOINT_RW;
486 break;
487 default:
488 return -EINVAL;
489 }
490
491 /* Len */
492 switch (ctrl.len) {
493 case ARM_BREAKPOINT_LEN_1:
494 *gen_len = HW_BREAKPOINT_LEN_1;
495 break;
496 case ARM_BREAKPOINT_LEN_2:
497 *gen_len = HW_BREAKPOINT_LEN_2;
498 break;
499 case ARM_BREAKPOINT_LEN_4:
500 *gen_len = HW_BREAKPOINT_LEN_4;
501 break;
502 case ARM_BREAKPOINT_LEN_8:
503 *gen_len = HW_BREAKPOINT_LEN_8;
504 break;
505 default:
506 return -EINVAL;
507 }
508
509 return 0;
510 }
511
512 /*
513 * Construct an arch_hw_breakpoint from a perf_event.
514 */
arch_build_bp_info(struct perf_event * bp)515 static int arch_build_bp_info(struct perf_event *bp)
516 {
517 struct arch_hw_breakpoint *info = counter_arch_bp(bp);
518
519 /* Type */
520 switch (bp->attr.bp_type) {
521 case HW_BREAKPOINT_X:
522 info->ctrl.type = ARM_BREAKPOINT_EXECUTE;
523 break;
524 case HW_BREAKPOINT_R:
525 info->ctrl.type = ARM_BREAKPOINT_LOAD;
526 break;
527 case HW_BREAKPOINT_W:
528 info->ctrl.type = ARM_BREAKPOINT_STORE;
529 break;
530 case HW_BREAKPOINT_RW:
531 info->ctrl.type = ARM_BREAKPOINT_LOAD | ARM_BREAKPOINT_STORE;
532 break;
533 default:
534 return -EINVAL;
535 }
536
537 /* Len */
538 switch (bp->attr.bp_len) {
539 case HW_BREAKPOINT_LEN_1:
540 info->ctrl.len = ARM_BREAKPOINT_LEN_1;
541 break;
542 case HW_BREAKPOINT_LEN_2:
543 info->ctrl.len = ARM_BREAKPOINT_LEN_2;
544 break;
545 case HW_BREAKPOINT_LEN_4:
546 info->ctrl.len = ARM_BREAKPOINT_LEN_4;
547 break;
548 case HW_BREAKPOINT_LEN_8:
549 info->ctrl.len = ARM_BREAKPOINT_LEN_8;
550 if ((info->ctrl.type != ARM_BREAKPOINT_EXECUTE)
551 && max_watchpoint_len >= 8)
552 break;
553 default:
554 return -EINVAL;
555 }
556
557 /*
558 * Breakpoints must be of length 2 (thumb) or 4 (ARM) bytes.
559 * Watchpoints can be of length 1, 2, 4 or 8 bytes if supported
560 * by the hardware and must be aligned to the appropriate number of
561 * bytes.
562 */
563 if (info->ctrl.type == ARM_BREAKPOINT_EXECUTE &&
564 info->ctrl.len != ARM_BREAKPOINT_LEN_2 &&
565 info->ctrl.len != ARM_BREAKPOINT_LEN_4)
566 return -EINVAL;
567
568 /* Address */
569 info->address = bp->attr.bp_addr;
570
571 /* Privilege */
572 info->ctrl.privilege = ARM_BREAKPOINT_USER;
573 if (arch_check_bp_in_kernelspace(bp))
574 info->ctrl.privilege |= ARM_BREAKPOINT_PRIV;
575
576 /* Enabled? */
577 info->ctrl.enabled = !bp->attr.disabled;
578
579 /* Mismatch */
580 info->ctrl.mismatch = 0;
581
582 return 0;
583 }
584
585 /*
586 * Validate the arch-specific HW Breakpoint register settings.
587 */
arch_validate_hwbkpt_settings(struct perf_event * bp)588 int arch_validate_hwbkpt_settings(struct perf_event *bp)
589 {
590 struct arch_hw_breakpoint *info = counter_arch_bp(bp);
591 int ret = 0;
592 u32 offset, alignment_mask = 0x3;
593
594 /* Build the arch_hw_breakpoint. */
595 ret = arch_build_bp_info(bp);
596 if (ret)
597 goto out;
598
599 /* Check address alignment. */
600 if (info->ctrl.len == ARM_BREAKPOINT_LEN_8)
601 alignment_mask = 0x7;
602 offset = info->address & alignment_mask;
603 switch (offset) {
604 case 0:
605 /* Aligned */
606 break;
607 case 1:
608 /* Allow single byte watchpoint. */
609 if (info->ctrl.len == ARM_BREAKPOINT_LEN_1)
610 break;
611 case 2:
612 /* Allow halfword watchpoints and breakpoints. */
613 if (info->ctrl.len == ARM_BREAKPOINT_LEN_2)
614 break;
615 default:
616 ret = -EINVAL;
617 goto out;
618 }
619
620 info->address &= ~alignment_mask;
621 info->ctrl.len <<= offset;
622
623 /*
624 * Currently we rely on an overflow handler to take
625 * care of single-stepping the breakpoint when it fires.
626 * In the case of userspace breakpoints on a core with V7 debug,
627 * we can use the mismatch feature as a poor-man's hardware
628 * single-step, but this only works for per-task breakpoints.
629 */
630 if (!bp->overflow_handler && (arch_check_bp_in_kernelspace(bp) ||
631 !core_has_mismatch_brps() || !bp->hw.bp_target)) {
632 pr_warning("overflow handler required but none found\n");
633 ret = -EINVAL;
634 }
635 out:
636 return ret;
637 }
638
639 /*
640 * Enable/disable single-stepping over the breakpoint bp at address addr.
641 */
enable_single_step(struct perf_event * bp,u32 addr)642 static void enable_single_step(struct perf_event *bp, u32 addr)
643 {
644 struct arch_hw_breakpoint *info = counter_arch_bp(bp);
645
646 arch_uninstall_hw_breakpoint(bp);
647 info->step_ctrl.mismatch = 1;
648 info->step_ctrl.len = ARM_BREAKPOINT_LEN_4;
649 info->step_ctrl.type = ARM_BREAKPOINT_EXECUTE;
650 info->step_ctrl.privilege = info->ctrl.privilege;
651 info->step_ctrl.enabled = 1;
652 info->trigger = addr;
653 arch_install_hw_breakpoint(bp);
654 }
655
disable_single_step(struct perf_event * bp)656 static void disable_single_step(struct perf_event *bp)
657 {
658 arch_uninstall_hw_breakpoint(bp);
659 counter_arch_bp(bp)->step_ctrl.enabled = 0;
660 arch_install_hw_breakpoint(bp);
661 }
662
watchpoint_handler(unsigned long addr,unsigned int fsr,struct pt_regs * regs)663 static void watchpoint_handler(unsigned long addr, unsigned int fsr,
664 struct pt_regs *regs)
665 {
666 int i, access;
667 u32 val, ctrl_reg, alignment_mask;
668 struct perf_event *wp, **slots;
669 struct arch_hw_breakpoint *info;
670 struct arch_hw_breakpoint_ctrl ctrl;
671
672 slots = (struct perf_event **)__get_cpu_var(wp_on_reg);
673
674 for (i = 0; i < core_num_wrps; ++i) {
675 rcu_read_lock();
676
677 wp = slots[i];
678
679 if (wp == NULL)
680 goto unlock;
681
682 info = counter_arch_bp(wp);
683 /*
684 * The DFAR is an unknown value on debug architectures prior
685 * to 7.1. Since we only allow a single watchpoint on these
686 * older CPUs, we can set the trigger to the lowest possible
687 * faulting address.
688 */
689 if (debug_arch < ARM_DEBUG_ARCH_V7_1) {
690 BUG_ON(i > 0);
691 info->trigger = wp->attr.bp_addr;
692 } else {
693 if (info->ctrl.len == ARM_BREAKPOINT_LEN_8)
694 alignment_mask = 0x7;
695 else
696 alignment_mask = 0x3;
697
698 /* Check if the watchpoint value matches. */
699 val = read_wb_reg(ARM_BASE_WVR + i);
700 if (val != (addr & ~alignment_mask))
701 goto unlock;
702
703 /* Possible match, check the byte address select. */
704 ctrl_reg = read_wb_reg(ARM_BASE_WCR + i);
705 decode_ctrl_reg(ctrl_reg, &ctrl);
706 if (!((1 << (addr & alignment_mask)) & ctrl.len))
707 goto unlock;
708
709 /* Check that the access type matches. */
710 access = (fsr & ARM_FSR_ACCESS_MASK) ? HW_BREAKPOINT_W :
711 HW_BREAKPOINT_R;
712 if (!(access & hw_breakpoint_type(wp)))
713 goto unlock;
714
715 /* We have a winner. */
716 info->trigger = addr;
717 }
718
719 pr_debug("watchpoint fired: address = 0x%x\n", info->trigger);
720 perf_bp_event(wp, regs);
721
722 /*
723 * If no overflow handler is present, insert a temporary
724 * mismatch breakpoint so we can single-step over the
725 * watchpoint trigger.
726 */
727 if (!wp->overflow_handler)
728 enable_single_step(wp, instruction_pointer(regs));
729
730 unlock:
731 rcu_read_unlock();
732 }
733 }
734
watchpoint_single_step_handler(unsigned long pc)735 static void watchpoint_single_step_handler(unsigned long pc)
736 {
737 int i;
738 struct perf_event *wp, **slots;
739 struct arch_hw_breakpoint *info;
740
741 slots = (struct perf_event **)__get_cpu_var(wp_on_reg);
742
743 for (i = 0; i < core_num_wrps; ++i) {
744 rcu_read_lock();
745
746 wp = slots[i];
747
748 if (wp == NULL)
749 goto unlock;
750
751 info = counter_arch_bp(wp);
752 if (!info->step_ctrl.enabled)
753 goto unlock;
754
755 /*
756 * Restore the original watchpoint if we've completed the
757 * single-step.
758 */
759 if (info->trigger != pc)
760 disable_single_step(wp);
761
762 unlock:
763 rcu_read_unlock();
764 }
765 }
766
breakpoint_handler(unsigned long unknown,struct pt_regs * regs)767 static void breakpoint_handler(unsigned long unknown, struct pt_regs *regs)
768 {
769 int i;
770 u32 ctrl_reg, val, addr;
771 struct perf_event *bp, **slots;
772 struct arch_hw_breakpoint *info;
773 struct arch_hw_breakpoint_ctrl ctrl;
774
775 slots = (struct perf_event **)__get_cpu_var(bp_on_reg);
776
777 /* The exception entry code places the amended lr in the PC. */
778 addr = regs->ARM_pc;
779
780 /* Check the currently installed breakpoints first. */
781 for (i = 0; i < core_num_brps; ++i) {
782 rcu_read_lock();
783
784 bp = slots[i];
785
786 if (bp == NULL)
787 goto unlock;
788
789 info = counter_arch_bp(bp);
790
791 /* Check if the breakpoint value matches. */
792 val = read_wb_reg(ARM_BASE_BVR + i);
793 if (val != (addr & ~0x3))
794 goto mismatch;
795
796 /* Possible match, check the byte address select to confirm. */
797 ctrl_reg = read_wb_reg(ARM_BASE_BCR + i);
798 decode_ctrl_reg(ctrl_reg, &ctrl);
799 if ((1 << (addr & 0x3)) & ctrl.len) {
800 info->trigger = addr;
801 pr_debug("breakpoint fired: address = 0x%x\n", addr);
802 perf_bp_event(bp, regs);
803 if (!bp->overflow_handler)
804 enable_single_step(bp, addr);
805 goto unlock;
806 }
807
808 mismatch:
809 /* If we're stepping a breakpoint, it can now be restored. */
810 if (info->step_ctrl.enabled)
811 disable_single_step(bp);
812 unlock:
813 rcu_read_unlock();
814 }
815
816 /* Handle any pending watchpoint single-step breakpoints. */
817 watchpoint_single_step_handler(addr);
818 }
819
820 /*
821 * Called from either the Data Abort Handler [watchpoint] or the
822 * Prefetch Abort Handler [breakpoint] with interrupts disabled.
823 */
hw_breakpoint_pending(unsigned long addr,unsigned int fsr,struct pt_regs * regs)824 static int hw_breakpoint_pending(unsigned long addr, unsigned int fsr,
825 struct pt_regs *regs)
826 {
827 int ret = 0;
828 u32 dscr;
829
830 preempt_disable();
831
832 if (interrupts_enabled(regs))
833 local_irq_enable();
834
835 /* We only handle watchpoints and hardware breakpoints. */
836 ARM_DBG_READ(c1, 0, dscr);
837
838 /* Perform perf callbacks. */
839 switch (ARM_DSCR_MOE(dscr)) {
840 case ARM_ENTRY_BREAKPOINT:
841 breakpoint_handler(addr, regs);
842 break;
843 case ARM_ENTRY_ASYNC_WATCHPOINT:
844 WARN(1, "Asynchronous watchpoint exception taken. Debugging results may be unreliable\n");
845 case ARM_ENTRY_SYNC_WATCHPOINT:
846 watchpoint_handler(addr, fsr, regs);
847 break;
848 default:
849 ret = 1; /* Unhandled fault. */
850 }
851
852 preempt_enable();
853
854 return ret;
855 }
856
857 /*
858 * One-time initialisation.
859 */
860 static cpumask_t debug_err_mask;
861
debug_reg_trap(struct pt_regs * regs,unsigned int instr)862 static int debug_reg_trap(struct pt_regs *regs, unsigned int instr)
863 {
864 int cpu = smp_processor_id();
865
866 pr_warning("Debug register access (0x%x) caused undefined instruction on CPU %d\n",
867 instr, cpu);
868
869 /* Set the error flag for this CPU and skip the faulting instruction. */
870 cpumask_set_cpu(cpu, &debug_err_mask);
871 instruction_pointer(regs) += 4;
872 return 0;
873 }
874
875 static struct undef_hook debug_reg_hook = {
876 .instr_mask = 0x0fe80f10,
877 .instr_val = 0x0e000e10,
878 .fn = debug_reg_trap,
879 };
880
reset_ctrl_regs(void * unused)881 static void reset_ctrl_regs(void *unused)
882 {
883 int i, raw_num_brps, err = 0, cpu = smp_processor_id();
884 u32 dbg_power;
885
886 /*
887 * v7 debug contains save and restore registers so that debug state
888 * can be maintained across low-power modes without leaving the debug
889 * logic powered up. It is IMPLEMENTATION DEFINED whether we can access
890 * the debug registers out of reset, so we must unlock the OS Lock
891 * Access Register to avoid taking undefined instruction exceptions
892 * later on.
893 */
894 switch (debug_arch) {
895 case ARM_DEBUG_ARCH_V6:
896 case ARM_DEBUG_ARCH_V6_1:
897 /* ARMv6 cores just need to reset the registers. */
898 goto reset_regs;
899 case ARM_DEBUG_ARCH_V7_ECP14:
900 /*
901 * Ensure sticky power-down is clear (i.e. debug logic is
902 * powered up).
903 */
904 asm volatile("mrc p14, 0, %0, c1, c5, 4" : "=r" (dbg_power));
905 if ((dbg_power & 0x1) == 0)
906 err = -EPERM;
907 break;
908 case ARM_DEBUG_ARCH_V7_1:
909 /*
910 * Ensure the OS double lock is clear.
911 */
912 asm volatile("mrc p14, 0, %0, c1, c3, 4" : "=r" (dbg_power));
913 if ((dbg_power & 0x1) == 1)
914 err = -EPERM;
915 break;
916 }
917
918 if (err) {
919 pr_warning("CPU %d debug is powered down!\n", cpu);
920 cpumask_or(&debug_err_mask, &debug_err_mask, cpumask_of(cpu));
921 return;
922 }
923
924 /*
925 * Unconditionally clear the lock by writing a value
926 * other than 0xC5ACCE55 to the access register.
927 */
928 asm volatile("mcr p14, 0, %0, c1, c0, 4" : : "r" (0));
929 isb();
930
931 /*
932 * Clear any configured vector-catch events before
933 * enabling monitor mode.
934 */
935 asm volatile("mcr p14, 0, %0, c0, c7, 0" : : "r" (0));
936 isb();
937
938 reset_regs:
939 if (enable_monitor_mode())
940 return;
941
942 /* We must also reset any reserved registers. */
943 raw_num_brps = get_num_brp_resources();
944 for (i = 0; i < raw_num_brps; ++i) {
945 write_wb_reg(ARM_BASE_BCR + i, 0UL);
946 write_wb_reg(ARM_BASE_BVR + i, 0UL);
947 }
948
949 for (i = 0; i < core_num_wrps; ++i) {
950 write_wb_reg(ARM_BASE_WCR + i, 0UL);
951 write_wb_reg(ARM_BASE_WVR + i, 0UL);
952 }
953 }
954
dbg_reset_notify(struct notifier_block * self,unsigned long action,void * cpu)955 static int __cpuinit dbg_reset_notify(struct notifier_block *self,
956 unsigned long action, void *cpu)
957 {
958 if (action == CPU_ONLINE)
959 smp_call_function_single((int)cpu, reset_ctrl_regs, NULL, 1);
960
961 return NOTIFY_OK;
962 }
963
964 static struct notifier_block __cpuinitdata dbg_reset_nb = {
965 .notifier_call = dbg_reset_notify,
966 };
967
arch_hw_breakpoint_init(void)968 static int __init arch_hw_breakpoint_init(void)
969 {
970 u32 dscr;
971
972 debug_arch = get_debug_arch();
973
974 if (!debug_arch_supported()) {
975 pr_info("debug architecture 0x%x unsupported.\n", debug_arch);
976 return 0;
977 }
978
979 /* Determine how many BRPs/WRPs are available. */
980 core_num_brps = get_num_brps();
981 core_num_wrps = get_num_wrps();
982
983 /*
984 * We need to tread carefully here because DBGSWENABLE may be
985 * driven low on this core and there isn't an architected way to
986 * determine that.
987 */
988 register_undef_hook(&debug_reg_hook);
989
990 /*
991 * Reset the breakpoint resources. We assume that a halting
992 * debugger will leave the world in a nice state for us.
993 */
994 on_each_cpu(reset_ctrl_regs, NULL, 1);
995 unregister_undef_hook(&debug_reg_hook);
996 if (!cpumask_empty(&debug_err_mask)) {
997 core_num_brps = 0;
998 core_num_wrps = 0;
999 return 0;
1000 }
1001
1002 pr_info("found %d " "%s" "breakpoint and %d watchpoint registers.\n",
1003 core_num_brps, core_has_mismatch_brps() ? "(+1 reserved) " :
1004 "", core_num_wrps);
1005
1006 ARM_DBG_READ(c1, 0, dscr);
1007 if (dscr & ARM_DSCR_HDBGEN) {
1008 max_watchpoint_len = 4;
1009 pr_warning("halting debug mode enabled. Assuming maximum watchpoint size of %u bytes.\n",
1010 max_watchpoint_len);
1011 } else {
1012 /* Work out the maximum supported watchpoint length. */
1013 max_watchpoint_len = get_max_wp_len();
1014 pr_info("maximum watchpoint size is %u bytes.\n",
1015 max_watchpoint_len);
1016 }
1017
1018 /* Register debug fault handler. */
1019 hook_fault_code(FAULT_CODE_DEBUG, hw_breakpoint_pending, SIGTRAP,
1020 TRAP_HWBKPT, "watchpoint debug exception");
1021 hook_ifault_code(FAULT_CODE_DEBUG, hw_breakpoint_pending, SIGTRAP,
1022 TRAP_HWBKPT, "breakpoint debug exception");
1023
1024 /* Register hotplug notifier. */
1025 register_cpu_notifier(&dbg_reset_nb);
1026 return 0;
1027 }
1028 arch_initcall(arch_hw_breakpoint_init);
1029
hw_breakpoint_pmu_read(struct perf_event * bp)1030 void hw_breakpoint_pmu_read(struct perf_event *bp)
1031 {
1032 }
1033
1034 /*
1035 * Dummy function to register with die_notifier.
1036 */
hw_breakpoint_exceptions_notify(struct notifier_block * unused,unsigned long val,void * data)1037 int hw_breakpoint_exceptions_notify(struct notifier_block *unused,
1038 unsigned long val, void *data)
1039 {
1040 return NOTIFY_DONE;
1041 }
1042