2 * This program is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License as published by
4 * the Free Software Foundation; either version 2 of the License, or
5 * (at your option) any later version.
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
12 * You should have received a copy of the GNU General Public License
13 * along with this program; if not, write to the Free Software
14 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
16 * Copyright (C) 2007 Alan Stern
17 * Copyright (C) 2009 IBM Corporation
21 * HW_breakpoint: a unified kernel/user-space hardware breakpoint facility,
22 * using the CPU's debug registers.
25 #include <linux/irqflags.h>
26 #include <linux/notifier.h>
27 #include <linux/kallsyms.h>
28 #include <linux/kprobes.h>
29 #include <linux/percpu.h>
30 #include <linux/kdebug.h>
31 #include <linux/kernel.h>
32 #include <linux/module.h>
33 #include <linux/sched.h>
34 #include <linux/init.h>
35 #include <linux/smp.h>
37 #include <asm/hw_breakpoint.h>
38 #include <asm/processor.h>
39 #include <asm/debugreg.h>
41 /* Unmasked kernel DR7 value */
42 static unsigned long kdr7
;
45 * Masks for the bits corresponding to registers DR0 - DR3 in DR7 register.
46 * Used to clear and verify the status of bits corresponding to DR0 - DR3
48 static const unsigned long dr7_masks
[HBP_NUM
] = {
49 0x000f0003, /* LEN0, R/W0, G0, L0 */
50 0x00f0000c, /* LEN1, R/W1, G1, L1 */
51 0x0f000030, /* LEN2, R/W2, G2, L2 */
52 0xf00000c0 /* LEN3, R/W3, G3, L3 */
57 * Encode the length, type, Exact, and Enable bits for a particular breakpoint
58 * as stored in debug register 7.
60 static unsigned long encode_dr7(int drnum
, unsigned int len
, unsigned int type
)
62 unsigned long bp_info
;
64 bp_info
= (len
| type
) & 0xf;
65 bp_info
<<= (DR_CONTROL_SHIFT
+ drnum
* DR_CONTROL_SIZE
);
66 bp_info
|= (DR_GLOBAL_ENABLE
<< (drnum
* DR_ENABLE_SIZE
)) |
71 void arch_update_kernel_hw_breakpoint(void *unused
)
73 struct hw_breakpoint
*bp
;
74 int i
, cpu
= get_cpu();
75 unsigned long temp_kdr7
= 0;
77 /* Don't allow debug exceptions while we update the registers */
80 for (i
= hbp_kernel_pos
; i
< HBP_NUM
; i
++) {
81 per_cpu(this_hbp_kernel
[i
], cpu
) = bp
= hbp_kernel
[i
];
83 temp_kdr7
|= encode_dr7(i
, bp
->info
.len
, bp
->info
.type
);
84 set_debugreg(bp
->info
.address
, i
);
88 /* No need to set DR6. Update the debug registers with kernel-space
89 * breakpoint values from kdr7 and user-space requests from the
93 set_debugreg(kdr7
| current
->thread
.debugreg7
, 7);
98 * Install the thread breakpoints in their debug registers.
100 void arch_install_thread_hw_breakpoint(struct task_struct
*tsk
)
102 struct thread_struct
*thread
= &(tsk
->thread
);
104 switch (hbp_kernel_pos
) {
106 set_debugreg(thread
->debugreg
[3], 3);
108 set_debugreg(thread
->debugreg
[2], 2);
110 set_debugreg(thread
->debugreg
[1], 1);
112 set_debugreg(thread
->debugreg
[0], 0);
117 /* No need to set DR6 */
118 set_debugreg((kdr7
| thread
->debugreg7
), 7);
122 * Install the debug register values for just the kernel, no thread.
124 void arch_uninstall_thread_hw_breakpoint()
126 /* Clear the user-space portion of debugreg7 by setting only kdr7 */
127 set_debugreg(kdr7
, 7);
131 static int get_hbp_len(u8 hbp_len
)
133 unsigned int len_in_bytes
= 0;
136 case HW_BREAKPOINT_LEN_1
:
139 case HW_BREAKPOINT_LEN_2
:
142 case HW_BREAKPOINT_LEN_4
:
146 case HW_BREAKPOINT_LEN_8
:
155 * Check for virtual address in user space.
157 int arch_check_va_in_userspace(unsigned long va
, u8 hbp_len
)
161 len
= get_hbp_len(hbp_len
);
163 return (va
<= TASK_SIZE
- len
);
167 * Check for virtual address in kernel space.
169 int arch_check_va_in_kernelspace(unsigned long va
, u8 hbp_len
)
173 len
= get_hbp_len(hbp_len
);
175 return (va
>= TASK_SIZE
) && ((va
+ len
- 1) >= TASK_SIZE
);
179 * Store a breakpoint's encoded address, length, and type.
181 static int arch_store_info(struct hw_breakpoint
*bp
, struct task_struct
*tsk
)
184 * User-space requests will always have the address field populated
185 * Symbol names from user-space are rejected
187 if (tsk
&& bp
->info
.name
)
190 * For kernel-addresses, either the address or symbol name can be
194 bp
->info
.address
= (unsigned long)
195 kallsyms_lookup_name(bp
->info
.name
);
196 if (bp
->info
.address
)
202 * Validate the arch-specific HW Breakpoint register settings
204 int arch_validate_hwbkpt_settings(struct hw_breakpoint
*bp
,
205 struct task_struct
*tsk
)
210 switch (bp
->info
.type
) {
212 * Ptrace-refactoring code
213 * For now, we'll allow instruction breakpoint only for user-space
216 case HW_BREAKPOINT_EXECUTE
:
217 if ((!arch_check_va_in_userspace(bp
->info
.address
,
219 bp
->info
.len
!= HW_BREAKPOINT_LEN_EXECUTE
)
222 case HW_BREAKPOINT_WRITE
:
224 case HW_BREAKPOINT_RW
:
230 switch (bp
->info
.len
) {
231 case HW_BREAKPOINT_LEN_1
:
234 case HW_BREAKPOINT_LEN_2
:
237 case HW_BREAKPOINT_LEN_4
:
241 case HW_BREAKPOINT_LEN_8
:
250 ret
= arch_store_info(bp
, tsk
);
255 * Check that the low-order bits of the address are appropriate
256 * for the alignment implied by len.
258 if (bp
->info
.address
& align
)
261 /* Check that the virtual address is in the proper range */
263 if (!arch_check_va_in_userspace(bp
->info
.address
, bp
->info
.len
))
266 if (!arch_check_va_in_kernelspace(bp
->info
.address
,
273 void arch_update_user_hw_breakpoint(int pos
, struct task_struct
*tsk
)
275 struct thread_struct
*thread
= &(tsk
->thread
);
276 struct hw_breakpoint
*bp
= thread
->hbp
[pos
];
278 thread
->debugreg7
&= ~dr7_masks
[pos
];
280 thread
->debugreg
[pos
] = bp
->info
.address
;
281 thread
->debugreg7
|= encode_dr7(pos
, bp
->info
.len
,
284 thread
->debugreg
[pos
] = 0;
287 void arch_flush_thread_hw_breakpoint(struct task_struct
*tsk
)
290 struct thread_struct
*thread
= &(tsk
->thread
);
292 thread
->debugreg7
= 0;
293 for (i
= 0; i
< HBP_NUM
; i
++)
294 thread
->debugreg
[i
] = 0;
298 * Handle debug exception notifications.
300 * Return value is either NOTIFY_STOP or NOTIFY_DONE as explained below.
302 * NOTIFY_DONE returned if one of the following conditions is true.
303 * i) When the causative address is from user-space and the exception
304 * is a valid one, i.e. not triggered as a result of lazy debug register
306 * ii) When there are more bits than trap<n> set in DR6 register (such
307 * as BD, BS or BT) indicating that more than one debug condition is
308 * met and requires some more action in do_debug().
310 * NOTIFY_STOP returned for all other cases
313 int __kprobes
hw_breakpoint_handler(struct die_args
*args
)
315 int i
, cpu
, rc
= NOTIFY_STOP
;
316 struct hw_breakpoint
*bp
;
317 unsigned long dr7
, dr6
;
318 unsigned long *dr6_p
;
320 /* The DR6 value is pointed by args->err */
321 dr6_p
= (unsigned long *)ERR_PTR(args
->err
);
324 /* Do an early return if no trap bits are set in DR6 */
325 if ((dr6
& DR_TRAP_BITS
) == 0)
328 /* Lazy debug register switching */
329 if (!test_tsk_thread_flag(current
, TIF_DEBUG
))
330 arch_uninstall_thread_hw_breakpoint();
332 get_debugreg(dr7
, 7);
333 /* Disable breakpoints during exception handling */
334 set_debugreg(0UL, 7);
336 * Assert that local interrupts are disabled
337 * Reset the DRn bits in the virtualized register value.
338 * The ptrace trigger routine will add in whatever is needed.
340 current
->thread
.debugreg6
&= ~DR_TRAP_BITS
;
343 /* Handle all the breakpoints that were triggered */
344 for (i
= 0; i
< HBP_NUM
; ++i
) {
345 if (likely(!(dr6
& (DR_TRAP0
<< i
))))
348 * Find the corresponding hw_breakpoint structure and
349 * invoke its triggered callback.
351 if (i
>= hbp_kernel_pos
)
352 bp
= per_cpu(this_hbp_kernel
[i
], cpu
);
354 bp
= current
->thread
.hbp
[i
];
359 * Reset the 'i'th TRAP bit in dr6 to denote completion of
362 (*dr6_p
) &= ~(DR_TRAP0
<< i
);
364 * bp can be NULL due to lazy debug register switching
365 * or due to the delay between updates of hbp_kernel_pos
366 * and this_hbp_kernel.
371 (bp
->triggered
)(bp
, args
->regs
);
373 if (dr6
& (~DR_TRAP_BITS
))
376 set_debugreg(dr7
, 7);
377 put_cpu_no_resched();
382 * Handle debug exception notifications.
384 int __kprobes
hw_breakpoint_exceptions_notify(
385 struct notifier_block
*unused
, unsigned long val
, void *data
)
387 if (val
!= DIE_DEBUG
)
390 return hw_breakpoint_handler(data
);