bp: ARM64 breakpoint driver (HWBP/PTEBP/STEPBP) with stable ioctl ABI

[MoonBypass]

Summary

Adds �p/, an ARM64 breakpoint driver (module �p, device /dev/bp) derived from this repository's lsdriver breakpoint subsystems (HWBP / PTEBP / STEPBP), rebuilt around a stable char-device ioctl ABI, lifecycle-safe sessions, full unload support and mapping-invalidation fail-closed.

• PTEBP: PTE UXN execute breakpoints with in-kernel batch instruction emulation and S0 (low 32 bits of Q0) write-back on every precise hit; high 96 bits of Q0 and all other registers preserved. Exception entry hooked per kernel series: 5.15+ el0t_64_sync_handler, 5.10 el0_ia (with a PAN-window adapter).
• HWBP: hardware breakpoints/watchpoints (X/R/W/RW, 1-8 bytes) with 2-bit per-register masks (NONE/READ/WRITE), x0 seed write-back and per-PC hit records.
• STEPBP: single-step PC breakpoints with generation tracking.
• Session model: single active configuration, mm_cookie issued at ARM and required by STATUS/STOP, tgid + start-time identity (PID-reuse guard), auto-clean on target exit/exec, full drain on unload. No module hiding, no CFI bypass.
• Mapping invalidation: an mmu-notifier (invalidate_range_start) fails the PTE monitor closed on 5.15+/6.2+ targets (5.10/6.1 keep hit-time PTE-match fallback).
• Builds against kernel defaults, __cfi_check stub for GKI, static KMI gates pass on all seven GKI targets. Includes Kconfig and a top-level README.md.

ABI

include/bp_uapi.h (kernel mirror kernel/abi/bp_uapi.h), BP_ABI_VERSION 1.0, 11 ioctls (INFO, PTE/HWBP/STEP arm/status/stop, HWBP record). See �p/docs/BREAKPOINT_ABI.md.

Test results (7 QEMU, serial and parallel)

Target	Static gate	QEMU suite
android12-5.10	PASS	PASS (full PTE hits via el0_ia)
android13-5.10	PASS	PASS (full PTE hits)
android13-5.15	PASS	PASS (incl. mapping invalidation)
android14-5.15	PASS	PASS
android14-6.1	PASS	PASS
android15-6.6	PASS	PASS
android16-6.12	PASS	PASS

QEMU suite covers: ABI/error paths (500-iteration ioctl fuzz), PTE S0 write-back + persistence + cookie + stop restore, mapping-invalidation fail-closed, HWBP x0 write-back + watchpoint + record, exec auto-clean, 4x500 concurrent arm/status/stop, hit storm (300k+ hits), 50x fork/arm/exit, unload/reload, dmesg cleanliness (0 panic/Oops/CFI/RCU/warning signatures).

Known limitations

• QEMU virt: STEP single-step hit delivery may surface a user-visible SIGTRAP (ptrace pseudo-step semantics); the kernel-side counters are authoritative and the hit path is intended for real-hardware validation.
• Real device 5.15.180: the first validation round passed load/INFO/err/rmmod; a PTE-hit stall observed on that build is under investigation (later on-device re-tests were blocked by the device-side module-load policy).

Rollback

Remove the �p/ directory and rebuild; the driver is fully unloadable (
mmod bp) and keeps no residual state.