1*4882a593Smuzhiyun // SPDX-License-Identifier: GPL-2.0
2*4882a593Smuzhiyun /*
3*4882a593Smuzhiyun * Inspired by breakpoint overflow test done by
4*4882a593Smuzhiyun * Vince Weaver <vincent.weaver@maine.edu> for perf_event_tests
5*4882a593Smuzhiyun * (git://github.com/deater/perf_event_tests)
6*4882a593Smuzhiyun */
7*4882a593Smuzhiyun
8*4882a593Smuzhiyun /*
9*4882a593Smuzhiyun * Powerpc needs __SANE_USERSPACE_TYPES__ before <linux/types.h> to select
10*4882a593Smuzhiyun * 'int-ll64.h' and avoid compile warnings when printing __u64 with %llu.
11*4882a593Smuzhiyun */
12*4882a593Smuzhiyun #define __SANE_USERSPACE_TYPES__
13*4882a593Smuzhiyun
14*4882a593Smuzhiyun #include <stdlib.h>
15*4882a593Smuzhiyun #include <stdio.h>
16*4882a593Smuzhiyun #include <unistd.h>
17*4882a593Smuzhiyun #include <string.h>
18*4882a593Smuzhiyun #include <sys/ioctl.h>
19*4882a593Smuzhiyun #include <time.h>
20*4882a593Smuzhiyun #include <fcntl.h>
21*4882a593Smuzhiyun #include <signal.h>
22*4882a593Smuzhiyun #include <sys/mman.h>
23*4882a593Smuzhiyun #include <linux/compiler.h>
24*4882a593Smuzhiyun #include <linux/hw_breakpoint.h>
25*4882a593Smuzhiyun
26*4882a593Smuzhiyun #include "tests.h"
27*4882a593Smuzhiyun #include "debug.h"
28*4882a593Smuzhiyun #include "event.h"
29*4882a593Smuzhiyun #include "perf-sys.h"
30*4882a593Smuzhiyun #include "cloexec.h"
31*4882a593Smuzhiyun
32*4882a593Smuzhiyun static int fd1;
33*4882a593Smuzhiyun static int fd2;
34*4882a593Smuzhiyun static int fd3;
35*4882a593Smuzhiyun static int overflows;
36*4882a593Smuzhiyun static int overflows_2;
37*4882a593Smuzhiyun
38*4882a593Smuzhiyun volatile long the_var;
39*4882a593Smuzhiyun
40*4882a593Smuzhiyun
41*4882a593Smuzhiyun /*
42*4882a593Smuzhiyun * Use ASM to ensure watchpoint and breakpoint can be triggered
43*4882a593Smuzhiyun * at one instruction.
44*4882a593Smuzhiyun */
45*4882a593Smuzhiyun #if defined (__x86_64__)
46*4882a593Smuzhiyun extern void __test_function(volatile long *ptr);
47*4882a593Smuzhiyun asm (
48*4882a593Smuzhiyun ".pushsection .text;"
49*4882a593Smuzhiyun ".globl __test_function\n"
50*4882a593Smuzhiyun ".type __test_function, @function;"
51*4882a593Smuzhiyun "__test_function:\n"
52*4882a593Smuzhiyun "incq (%rdi)\n"
53*4882a593Smuzhiyun "ret\n"
54*4882a593Smuzhiyun ".popsection\n");
55*4882a593Smuzhiyun #else
__test_function(volatile long * ptr)56*4882a593Smuzhiyun static void __test_function(volatile long *ptr)
57*4882a593Smuzhiyun {
58*4882a593Smuzhiyun *ptr = 0x1234;
59*4882a593Smuzhiyun }
60*4882a593Smuzhiyun #endif
61*4882a593Smuzhiyun
test_function(void)62*4882a593Smuzhiyun static noinline int test_function(void)
63*4882a593Smuzhiyun {
64*4882a593Smuzhiyun __test_function(&the_var);
65*4882a593Smuzhiyun the_var++;
66*4882a593Smuzhiyun return time(NULL);
67*4882a593Smuzhiyun }
68*4882a593Smuzhiyun
sig_handler_2(int signum __maybe_unused,siginfo_t * oh __maybe_unused,void * uc __maybe_unused)69*4882a593Smuzhiyun static void sig_handler_2(int signum __maybe_unused,
70*4882a593Smuzhiyun siginfo_t *oh __maybe_unused,
71*4882a593Smuzhiyun void *uc __maybe_unused)
72*4882a593Smuzhiyun {
73*4882a593Smuzhiyun overflows_2++;
74*4882a593Smuzhiyun if (overflows_2 > 10) {
75*4882a593Smuzhiyun ioctl(fd1, PERF_EVENT_IOC_DISABLE, 0);
76*4882a593Smuzhiyun ioctl(fd2, PERF_EVENT_IOC_DISABLE, 0);
77*4882a593Smuzhiyun ioctl(fd3, PERF_EVENT_IOC_DISABLE, 0);
78*4882a593Smuzhiyun }
79*4882a593Smuzhiyun }
80*4882a593Smuzhiyun
sig_handler(int signum __maybe_unused,siginfo_t * oh __maybe_unused,void * uc __maybe_unused)81*4882a593Smuzhiyun static void sig_handler(int signum __maybe_unused,
82*4882a593Smuzhiyun siginfo_t *oh __maybe_unused,
83*4882a593Smuzhiyun void *uc __maybe_unused)
84*4882a593Smuzhiyun {
85*4882a593Smuzhiyun overflows++;
86*4882a593Smuzhiyun
87*4882a593Smuzhiyun if (overflows > 10) {
88*4882a593Smuzhiyun /*
89*4882a593Smuzhiyun * This should be executed only once during
90*4882a593Smuzhiyun * this test, if we are here for the 10th
91*4882a593Smuzhiyun * time, consider this the recursive issue.
92*4882a593Smuzhiyun *
93*4882a593Smuzhiyun * We can get out of here by disable events,
94*4882a593Smuzhiyun * so no new SIGIO is delivered.
95*4882a593Smuzhiyun */
96*4882a593Smuzhiyun ioctl(fd1, PERF_EVENT_IOC_DISABLE, 0);
97*4882a593Smuzhiyun ioctl(fd2, PERF_EVENT_IOC_DISABLE, 0);
98*4882a593Smuzhiyun ioctl(fd3, PERF_EVENT_IOC_DISABLE, 0);
99*4882a593Smuzhiyun }
100*4882a593Smuzhiyun }
101*4882a593Smuzhiyun
__event(bool is_x,void * addr,int sig)102*4882a593Smuzhiyun static int __event(bool is_x, void *addr, int sig)
103*4882a593Smuzhiyun {
104*4882a593Smuzhiyun struct perf_event_attr pe;
105*4882a593Smuzhiyun int fd;
106*4882a593Smuzhiyun
107*4882a593Smuzhiyun memset(&pe, 0, sizeof(struct perf_event_attr));
108*4882a593Smuzhiyun pe.type = PERF_TYPE_BREAKPOINT;
109*4882a593Smuzhiyun pe.size = sizeof(struct perf_event_attr);
110*4882a593Smuzhiyun
111*4882a593Smuzhiyun pe.config = 0;
112*4882a593Smuzhiyun pe.bp_type = is_x ? HW_BREAKPOINT_X : HW_BREAKPOINT_W;
113*4882a593Smuzhiyun pe.bp_addr = (unsigned long) addr;
114*4882a593Smuzhiyun pe.bp_len = sizeof(long);
115*4882a593Smuzhiyun
116*4882a593Smuzhiyun pe.sample_period = 1;
117*4882a593Smuzhiyun pe.sample_type = PERF_SAMPLE_IP;
118*4882a593Smuzhiyun pe.wakeup_events = 1;
119*4882a593Smuzhiyun
120*4882a593Smuzhiyun pe.disabled = 1;
121*4882a593Smuzhiyun pe.exclude_kernel = 1;
122*4882a593Smuzhiyun pe.exclude_hv = 1;
123*4882a593Smuzhiyun
124*4882a593Smuzhiyun fd = sys_perf_event_open(&pe, 0, -1, -1,
125*4882a593Smuzhiyun perf_event_open_cloexec_flag());
126*4882a593Smuzhiyun if (fd < 0) {
127*4882a593Smuzhiyun pr_debug("failed opening event %llx\n", pe.config);
128*4882a593Smuzhiyun return TEST_FAIL;
129*4882a593Smuzhiyun }
130*4882a593Smuzhiyun
131*4882a593Smuzhiyun fcntl(fd, F_SETFL, O_RDWR|O_NONBLOCK|O_ASYNC);
132*4882a593Smuzhiyun fcntl(fd, F_SETSIG, sig);
133*4882a593Smuzhiyun fcntl(fd, F_SETOWN, getpid());
134*4882a593Smuzhiyun
135*4882a593Smuzhiyun ioctl(fd, PERF_EVENT_IOC_RESET, 0);
136*4882a593Smuzhiyun
137*4882a593Smuzhiyun return fd;
138*4882a593Smuzhiyun }
139*4882a593Smuzhiyun
bp_event(void * addr,int sig)140*4882a593Smuzhiyun static int bp_event(void *addr, int sig)
141*4882a593Smuzhiyun {
142*4882a593Smuzhiyun return __event(true, addr, sig);
143*4882a593Smuzhiyun }
144*4882a593Smuzhiyun
wp_event(void * addr,int sig)145*4882a593Smuzhiyun static int wp_event(void *addr, int sig)
146*4882a593Smuzhiyun {
147*4882a593Smuzhiyun return __event(false, addr, sig);
148*4882a593Smuzhiyun }
149*4882a593Smuzhiyun
bp_count(int fd)150*4882a593Smuzhiyun static long long bp_count(int fd)
151*4882a593Smuzhiyun {
152*4882a593Smuzhiyun long long count;
153*4882a593Smuzhiyun int ret;
154*4882a593Smuzhiyun
155*4882a593Smuzhiyun ret = read(fd, &count, sizeof(long long));
156*4882a593Smuzhiyun if (ret != sizeof(long long)) {
157*4882a593Smuzhiyun pr_debug("failed to read: %d\n", ret);
158*4882a593Smuzhiyun return TEST_FAIL;
159*4882a593Smuzhiyun }
160*4882a593Smuzhiyun
161*4882a593Smuzhiyun return count;
162*4882a593Smuzhiyun }
163*4882a593Smuzhiyun
test__bp_signal(struct test * test __maybe_unused,int subtest __maybe_unused)164*4882a593Smuzhiyun int test__bp_signal(struct test *test __maybe_unused, int subtest __maybe_unused)
165*4882a593Smuzhiyun {
166*4882a593Smuzhiyun struct sigaction sa;
167*4882a593Smuzhiyun long long count1, count2, count3;
168*4882a593Smuzhiyun
169*4882a593Smuzhiyun /* setup SIGIO signal handler */
170*4882a593Smuzhiyun memset(&sa, 0, sizeof(struct sigaction));
171*4882a593Smuzhiyun sa.sa_sigaction = (void *) sig_handler;
172*4882a593Smuzhiyun sa.sa_flags = SA_SIGINFO;
173*4882a593Smuzhiyun
174*4882a593Smuzhiyun if (sigaction(SIGIO, &sa, NULL) < 0) {
175*4882a593Smuzhiyun pr_debug("failed setting up signal handler\n");
176*4882a593Smuzhiyun return TEST_FAIL;
177*4882a593Smuzhiyun }
178*4882a593Smuzhiyun
179*4882a593Smuzhiyun sa.sa_sigaction = (void *) sig_handler_2;
180*4882a593Smuzhiyun if (sigaction(SIGUSR1, &sa, NULL) < 0) {
181*4882a593Smuzhiyun pr_debug("failed setting up signal handler 2\n");
182*4882a593Smuzhiyun return TEST_FAIL;
183*4882a593Smuzhiyun }
184*4882a593Smuzhiyun
185*4882a593Smuzhiyun /*
186*4882a593Smuzhiyun * We create following events:
187*4882a593Smuzhiyun *
188*4882a593Smuzhiyun * fd1 - breakpoint event on __test_function with SIGIO
189*4882a593Smuzhiyun * signal configured. We should get signal
190*4882a593Smuzhiyun * notification each time the breakpoint is hit
191*4882a593Smuzhiyun *
192*4882a593Smuzhiyun * fd2 - breakpoint event on sig_handler with SIGUSR1
193*4882a593Smuzhiyun * configured. We should get SIGUSR1 each time when
194*4882a593Smuzhiyun * breakpoint is hit
195*4882a593Smuzhiyun *
196*4882a593Smuzhiyun * fd3 - watchpoint event on __test_function with SIGIO
197*4882a593Smuzhiyun * configured.
198*4882a593Smuzhiyun *
199*4882a593Smuzhiyun * Following processing should happen:
200*4882a593Smuzhiyun * Exec: Action: Result:
201*4882a593Smuzhiyun * incq (%rdi) - fd1 event breakpoint hit -> count1 == 1
202*4882a593Smuzhiyun * - SIGIO is delivered
203*4882a593Smuzhiyun * sig_handler - fd2 event breakpoint hit -> count2 == 1
204*4882a593Smuzhiyun * - SIGUSR1 is delivered
205*4882a593Smuzhiyun * sig_handler_2 -> overflows_2 == 1 (nested signal)
206*4882a593Smuzhiyun * sys_rt_sigreturn - return from sig_handler_2
207*4882a593Smuzhiyun * overflows++ -> overflows = 1
208*4882a593Smuzhiyun * sys_rt_sigreturn - return from sig_handler
209*4882a593Smuzhiyun * incq (%rdi) - fd3 event watchpoint hit -> count3 == 1 (wp and bp in one insn)
210*4882a593Smuzhiyun * - SIGIO is delivered
211*4882a593Smuzhiyun * sig_handler - fd2 event breakpoint hit -> count2 == 2
212*4882a593Smuzhiyun * - SIGUSR1 is delivered
213*4882a593Smuzhiyun * sig_handler_2 -> overflows_2 == 2 (nested signal)
214*4882a593Smuzhiyun * sys_rt_sigreturn - return from sig_handler_2
215*4882a593Smuzhiyun * overflows++ -> overflows = 2
216*4882a593Smuzhiyun * sys_rt_sigreturn - return from sig_handler
217*4882a593Smuzhiyun * the_var++ - fd3 event watchpoint hit -> count3 == 2 (standalone watchpoint)
218*4882a593Smuzhiyun * - SIGIO is delivered
219*4882a593Smuzhiyun * sig_handler - fd2 event breakpoint hit -> count2 == 3
220*4882a593Smuzhiyun * - SIGUSR1 is delivered
221*4882a593Smuzhiyun * sig_handler_2 -> overflows_2 == 3 (nested signal)
222*4882a593Smuzhiyun * sys_rt_sigreturn - return from sig_handler_2
223*4882a593Smuzhiyun * overflows++ -> overflows == 3
224*4882a593Smuzhiyun * sys_rt_sigreturn - return from sig_handler
225*4882a593Smuzhiyun *
226*4882a593Smuzhiyun * The test case check following error conditions:
227*4882a593Smuzhiyun * - we get stuck in signal handler because of debug
228*4882a593Smuzhiyun * exception being triggered receursively due to
229*4882a593Smuzhiyun * the wrong RF EFLAG management
230*4882a593Smuzhiyun *
231*4882a593Smuzhiyun * - we never trigger the sig_handler breakpoint due
232*4882a593Smuzhiyun * to the rong RF EFLAG management
233*4882a593Smuzhiyun *
234*4882a593Smuzhiyun */
235*4882a593Smuzhiyun
236*4882a593Smuzhiyun fd1 = bp_event(__test_function, SIGIO);
237*4882a593Smuzhiyun fd2 = bp_event(sig_handler, SIGUSR1);
238*4882a593Smuzhiyun fd3 = wp_event((void *)&the_var, SIGIO);
239*4882a593Smuzhiyun
240*4882a593Smuzhiyun ioctl(fd1, PERF_EVENT_IOC_ENABLE, 0);
241*4882a593Smuzhiyun ioctl(fd2, PERF_EVENT_IOC_ENABLE, 0);
242*4882a593Smuzhiyun ioctl(fd3, PERF_EVENT_IOC_ENABLE, 0);
243*4882a593Smuzhiyun
244*4882a593Smuzhiyun /*
245*4882a593Smuzhiyun * Kick off the test by trigering 'fd1'
246*4882a593Smuzhiyun * breakpoint.
247*4882a593Smuzhiyun */
248*4882a593Smuzhiyun test_function();
249*4882a593Smuzhiyun
250*4882a593Smuzhiyun ioctl(fd1, PERF_EVENT_IOC_DISABLE, 0);
251*4882a593Smuzhiyun ioctl(fd2, PERF_EVENT_IOC_DISABLE, 0);
252*4882a593Smuzhiyun ioctl(fd3, PERF_EVENT_IOC_DISABLE, 0);
253*4882a593Smuzhiyun
254*4882a593Smuzhiyun count1 = bp_count(fd1);
255*4882a593Smuzhiyun count2 = bp_count(fd2);
256*4882a593Smuzhiyun count3 = bp_count(fd3);
257*4882a593Smuzhiyun
258*4882a593Smuzhiyun close(fd1);
259*4882a593Smuzhiyun close(fd2);
260*4882a593Smuzhiyun close(fd3);
261*4882a593Smuzhiyun
262*4882a593Smuzhiyun pr_debug("count1 %lld, count2 %lld, count3 %lld, overflow %d, overflows_2 %d\n",
263*4882a593Smuzhiyun count1, count2, count3, overflows, overflows_2);
264*4882a593Smuzhiyun
265*4882a593Smuzhiyun if (count1 != 1) {
266*4882a593Smuzhiyun if (count1 == 11)
267*4882a593Smuzhiyun pr_debug("failed: RF EFLAG recursion issue detected\n");
268*4882a593Smuzhiyun else
269*4882a593Smuzhiyun pr_debug("failed: wrong count for bp1: %lld, expected 1\n", count1);
270*4882a593Smuzhiyun }
271*4882a593Smuzhiyun
272*4882a593Smuzhiyun if (overflows != 3)
273*4882a593Smuzhiyun pr_debug("failed: wrong overflow (%d) hit, expected 3\n", overflows);
274*4882a593Smuzhiyun
275*4882a593Smuzhiyun if (overflows_2 != 3)
276*4882a593Smuzhiyun pr_debug("failed: wrong overflow_2 (%d) hit, expected 3\n", overflows_2);
277*4882a593Smuzhiyun
278*4882a593Smuzhiyun if (count2 != 3)
279*4882a593Smuzhiyun pr_debug("failed: wrong count for bp2 (%lld), expected 3\n", count2);
280*4882a593Smuzhiyun
281*4882a593Smuzhiyun if (count3 != 2)
282*4882a593Smuzhiyun pr_debug("failed: wrong count for bp3 (%lld), expected 2\n", count3);
283*4882a593Smuzhiyun
284*4882a593Smuzhiyun return count1 == 1 && overflows == 3 && count2 == 3 && overflows_2 == 3 && count3 == 2 ?
285*4882a593Smuzhiyun TEST_OK : TEST_FAIL;
286*4882a593Smuzhiyun }
287*4882a593Smuzhiyun
test__bp_signal_is_supported(void)288*4882a593Smuzhiyun bool test__bp_signal_is_supported(void)
289*4882a593Smuzhiyun {
290*4882a593Smuzhiyun /*
291*4882a593Smuzhiyun * PowerPC and S390 do not support creation of instruction
292*4882a593Smuzhiyun * breakpoints using the perf_event interface.
293*4882a593Smuzhiyun *
294*4882a593Smuzhiyun * ARM requires explicit rounding down of the instruction
295*4882a593Smuzhiyun * pointer in Thumb mode, and then requires the single-step
296*4882a593Smuzhiyun * to be handled explicitly in the overflow handler to avoid
297*4882a593Smuzhiyun * stepping into the SIGIO handler and getting stuck on the
298*4882a593Smuzhiyun * breakpointed instruction.
299*4882a593Smuzhiyun *
300*4882a593Smuzhiyun * Since arm64 has the same issue with arm for the single-step
301*4882a593Smuzhiyun * handling, this case also gets stuck on the breakpointed
302*4882a593Smuzhiyun * instruction.
303*4882a593Smuzhiyun *
304*4882a593Smuzhiyun * Just disable the test for these architectures until these
305*4882a593Smuzhiyun * issues are resolved.
306*4882a593Smuzhiyun */
307*4882a593Smuzhiyun #if defined(__powerpc__) || defined(__s390x__) || defined(__arm__) || \
308*4882a593Smuzhiyun defined(__aarch64__)
309*4882a593Smuzhiyun return false;
310*4882a593Smuzhiyun #else
311*4882a593Smuzhiyun return true;
312*4882a593Smuzhiyun #endif
313*4882a593Smuzhiyun }
314