4 * Maintainer: Jason Wessel <jason.wessel@windriver.com>
6 * Copyright (C) 2000-2001 VERITAS Software Corporation.
7 * Copyright (C) 2002-2004 Timesys Corporation
8 * Copyright (C) 2003-2004 Amit S. Kale <amitkale@linsyssoft.com>
9 * Copyright (C) 2004 Pavel Machek <pavel@suse.cz>
10 * Copyright (C) 2004-2006 Tom Rini <trini@kernel.crashing.org>
11 * Copyright (C) 2004-2006 LinSysSoft Technologies Pvt. Ltd.
12 * Copyright (C) 2005-2009 Wind River Systems, Inc.
13 * Copyright (C) 2007 MontaVista Software, Inc.
14 * Copyright (C) 2008 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
16 * Contributors at various stages not listed above:
17 * Jason Wessel ( jason.wessel@windriver.com )
18 * George Anzinger <george@mvista.com>
19 * Anurekh Saxena (anurekh.saxena@timesys.com)
20 * Lake Stevens Instrument Division (Glenn Engel)
21 * Jim Kingdon, Cygnus Support.
23 * Original KGDB stub: David Grothe <dave@gcom.com>,
24 * Tigran Aivazian <tigran@sco.com>
26 * This file is licensed under the terms of the GNU General Public License
27 * version 2. This program is licensed "as is" without any warranty of any
28 * kind, whether express or implied.
31 #include <linux/kernel.h>
32 #include <linux/kgdb.h>
33 #include <linux/kdb.h>
34 #include <linux/reboot.h>
35 #include <linux/uaccess.h>
36 #include <asm/cacheflush.h>
37 #include <asm/unaligned.h>
38 #include "debug_core.h"
40 #define KGDB_MAX_THREAD_QUERY 17
42 /* Our I/O buffers. */
43 static char remcom_in_buffer[BUFMAX];
44 static char remcom_out_buffer[BUFMAX];
46 /* Storage for the registers, in GDB format. */
47 static unsigned long gdb_regs[(NUMREGBYTES +
48 sizeof(unsigned long) - 1) /
49 sizeof(unsigned long)];
52 * GDB remote protocol parser:
55 static int hex(char ch)
57 if ((ch >= 'a') && (ch <= 'f'))
59 if ((ch >= '0') && (ch <= '9'))
61 if ((ch >= 'A') && (ch <= 'F'))
66 #ifdef CONFIG_KGDB_KDB
67 static int gdbstub_read_wait(void)
72 /* poll any additional I/O interfaces that are defined */
74 for (i = 0; kdb_poll_funcs[i] != NULL; i++) {
75 ret = kdb_poll_funcs[i]();
82 static int gdbstub_read_wait(void)
84 int ret = dbg_io_ops->read_char();
85 while (ret == NO_POLL_CHAR)
86 ret = dbg_io_ops->read_char();
90 /* scan for the sequence $<data>#<checksum> */
91 static void get_packet(char *buffer)
93 unsigned char checksum;
94 unsigned char xmitcsum;
100 * Spin and wait around for the start character, ignore all
103 while ((ch = (gdbstub_read_wait())) != '$')
113 * now, read until a # or end of buffer is found:
115 while (count < (BUFMAX - 1)) {
116 ch = gdbstub_read_wait();
119 checksum = checksum + ch;
126 xmitcsum = hex(gdbstub_read_wait()) << 4;
127 xmitcsum += hex(gdbstub_read_wait());
129 if (checksum != xmitcsum)
130 /* failed checksum */
131 dbg_io_ops->write_char('-');
133 /* successful transfer */
134 dbg_io_ops->write_char('+');
135 if (dbg_io_ops->flush)
138 } while (checksum != xmitcsum);
142 * Send the packet in buffer.
143 * Check for gdb connection if asked for.
145 static void put_packet(char *buffer)
147 unsigned char checksum;
152 * $<packet info>#<checksum>.
155 dbg_io_ops->write_char('$');
159 while ((ch = buffer[count])) {
160 dbg_io_ops->write_char(ch);
165 dbg_io_ops->write_char('#');
166 dbg_io_ops->write_char(hex_asc_hi(checksum));
167 dbg_io_ops->write_char(hex_asc_lo(checksum));
168 if (dbg_io_ops->flush)
171 /* Now see what we get in reply. */
172 ch = gdbstub_read_wait();
175 ch = gdbstub_read_wait();
177 /* If we get an ACK, we are done. */
182 * If we get the start of another packet, this means
183 * that GDB is attempting to reconnect. We will NAK
184 * the packet being sent, and stop trying to send this
188 dbg_io_ops->write_char('-');
189 if (dbg_io_ops->flush)
196 static char gdbmsgbuf[BUFMAX + 1];
198 void gdbstub_msg_write(const char *s, int len)
207 /* Fill and send buffers... */
209 bufptr = gdbmsgbuf + 1;
211 /* Calculate how many this time */
212 if ((len << 1) > (BUFMAX - 2))
213 wcount = (BUFMAX - 2) >> 1;
217 /* Pack in hex chars */
218 for (i = 0; i < wcount; i++)
219 bufptr = pack_hex_byte(bufptr, s[i]);
227 put_packet(gdbmsgbuf);
232 * Convert the memory pointed to by mem into hex, placing result in
233 * buf. Return a pointer to the last char put in buf (null). May
236 int kgdb_mem2hex(char *mem, char *buf, int count)
242 * We use the upper half of buf as an intermediate buffer for the
243 * raw memory copy. Hex conversion will work against this one.
247 err = probe_kernel_read(tmp, mem, count);
250 buf = pack_hex_byte(buf, *tmp);
262 * Convert the hex array pointed to by buf into binary to be placed in
263 * mem. Return a pointer to the character AFTER the last byte
264 * written. May return an error.
266 int kgdb_hex2mem(char *buf, char *mem, int count)
272 * We use the upper half of buf as an intermediate buffer for the
273 * raw memory that is converted from hex.
275 tmp_raw = buf + count * 2;
277 tmp_hex = tmp_raw - 1;
278 while (tmp_hex >= buf) {
280 *tmp_raw = hex(*tmp_hex--);
281 *tmp_raw |= hex(*tmp_hex--) << 4;
284 return probe_kernel_write(mem, tmp_raw, count);
288 * While we find nice hex chars, build a long_val.
289 * Return number of chars processed.
291 int kgdb_hex2long(char **ptr, unsigned long *long_val)
304 hex_val = hex(**ptr);
308 *long_val = (*long_val << 4) | hex_val;
314 *long_val = -*long_val;
320 * Copy the binary array pointed to by buf into mem. Fix $, #, and
321 * 0x7d escaped with 0x7d. Return -EFAULT on failure or 0 on success.
322 * The input buf is overwitten with the result to write to mem.
324 static int kgdb_ebin2mem(char *buf, char *mem, int count)
329 while (count-- > 0) {
332 c[size] = *buf++ ^ 0x20;
336 return probe_kernel_write(mem, c, size);
339 /* Write memory due to an 'M' or 'X' packet. */
340 static int write_mem_msg(int binary)
342 char *ptr = &remcom_in_buffer[1];
344 unsigned long length;
347 if (kgdb_hex2long(&ptr, &addr) > 0 && *(ptr++) == ',' &&
348 kgdb_hex2long(&ptr, &length) > 0 && *(ptr++) == ':') {
350 err = kgdb_ebin2mem(ptr, (char *)addr, length);
352 err = kgdb_hex2mem(ptr, (char *)addr, length);
355 if (CACHE_FLUSH_IS_SAFE)
356 flush_icache_range(addr, addr + length);
363 static void error_packet(char *pkt, int error)
367 pkt[1] = hex_asc[(error / 10)];
368 pkt[2] = hex_asc[(error % 10)];
373 * Thread ID accessors. We represent a flat TID space to GDB, where
374 * the per CPU idle threads (which under Linux all have PID 0) are
375 * remapped to negative TIDs.
378 #define BUF_THREAD_ID_SIZE 16
380 static char *pack_threadid(char *pkt, unsigned char *id)
384 limit = pkt + BUF_THREAD_ID_SIZE;
386 pkt = pack_hex_byte(pkt, *id++);
391 static void int_to_threadref(unsigned char *id, int value)
396 scan = (unsigned char *)id;
399 put_unaligned_be32(value, scan);
402 static struct task_struct *getthread(struct pt_regs *regs, int tid)
405 * Non-positive TIDs are remapped to the cpu shadow information
407 if (tid == 0 || tid == -1)
408 tid = -atomic_read(&kgdb_active) - 2;
409 if (tid < -1 && tid > -NR_CPUS - 2) {
410 if (kgdb_info[-tid - 2].task)
411 return kgdb_info[-tid - 2].task;
413 return idle_task(-tid - 2);
416 printk(KERN_ERR "KGDB: Internal thread select error\n");
422 * find_task_by_pid_ns() does not take the tasklist lock anymore
423 * but is nicely RCU locked - hence is a pretty resilient
426 return find_task_by_pid_ns(tid, &init_pid_ns);
431 * Remap normal tasks to their real PID,
432 * CPU shadow threads are mapped to -CPU - 2
434 static inline int shadow_pid(int realpid)
439 return -raw_smp_processor_id() - 2;
443 * All the functions that start with gdb_cmd are the various
444 * operations to implement the handlers for the gdbserial protocol
445 * where KGDB is communicating with an external debugger
448 /* Handle the '?' status packets */
449 static void gdb_cmd_status(struct kgdb_state *ks)
452 * We know that this packet is only sent
453 * during initial connect. So to be safe,
454 * we clear out our breakpoints now in case
455 * GDB is reconnecting.
457 dbg_remove_all_break();
459 remcom_out_buffer[0] = 'S';
460 pack_hex_byte(&remcom_out_buffer[1], ks->signo);
463 /* Handle the 'g' get registers request */
464 static void gdb_cmd_getregs(struct kgdb_state *ks)
466 struct task_struct *thread;
467 void *local_debuggerinfo;
470 thread = kgdb_usethread;
472 thread = kgdb_info[ks->cpu].task;
473 local_debuggerinfo = kgdb_info[ks->cpu].debuggerinfo;
475 local_debuggerinfo = NULL;
476 for_each_online_cpu(i) {
478 * Try to find the task on some other
479 * or possibly this node if we do not
480 * find the matching task then we try
481 * to approximate the results.
483 if (thread == kgdb_info[i].task)
484 local_debuggerinfo = kgdb_info[i].debuggerinfo;
489 * All threads that don't have debuggerinfo should be
490 * in schedule() sleeping, since all other CPUs
491 * are in kgdb_wait, and thus have debuggerinfo.
493 if (local_debuggerinfo) {
494 pt_regs_to_gdb_regs(gdb_regs, local_debuggerinfo);
497 * Pull stuff saved during switch_to; nothing
498 * else is accessible (or even particularly
501 * This should be enough for a stack trace.
503 sleeping_thread_to_gdb_regs(gdb_regs, thread);
505 kgdb_mem2hex((char *)gdb_regs, remcom_out_buffer, NUMREGBYTES);
508 /* Handle the 'G' set registers request */
509 static void gdb_cmd_setregs(struct kgdb_state *ks)
511 kgdb_hex2mem(&remcom_in_buffer[1], (char *)gdb_regs, NUMREGBYTES);
513 if (kgdb_usethread && kgdb_usethread != current) {
514 error_packet(remcom_out_buffer, -EINVAL);
516 gdb_regs_to_pt_regs(gdb_regs, ks->linux_regs);
517 strcpy(remcom_out_buffer, "OK");
521 /* Handle the 'm' memory read bytes */
522 static void gdb_cmd_memread(struct kgdb_state *ks)
524 char *ptr = &remcom_in_buffer[1];
525 unsigned long length;
529 if (kgdb_hex2long(&ptr, &addr) > 0 && *ptr++ == ',' &&
530 kgdb_hex2long(&ptr, &length) > 0) {
531 err = kgdb_mem2hex((char *)addr, remcom_out_buffer, length);
533 error_packet(remcom_out_buffer, err);
535 error_packet(remcom_out_buffer, -EINVAL);
539 /* Handle the 'M' memory write bytes */
540 static void gdb_cmd_memwrite(struct kgdb_state *ks)
542 int err = write_mem_msg(0);
545 error_packet(remcom_out_buffer, err);
547 strcpy(remcom_out_buffer, "OK");
550 /* Handle the 'X' memory binary write bytes */
551 static void gdb_cmd_binwrite(struct kgdb_state *ks)
553 int err = write_mem_msg(1);
556 error_packet(remcom_out_buffer, err);
558 strcpy(remcom_out_buffer, "OK");
561 /* Handle the 'D' or 'k', detach or kill packets */
562 static void gdb_cmd_detachkill(struct kgdb_state *ks)
566 /* The detach case */
567 if (remcom_in_buffer[0] == 'D') {
568 error = dbg_remove_all_break();
570 error_packet(remcom_out_buffer, error);
572 strcpy(remcom_out_buffer, "OK");
575 put_packet(remcom_out_buffer);
578 * Assume the kill case, with no exit code checking,
579 * trying to force detach the debugger:
581 dbg_remove_all_break();
586 /* Handle the 'R' reboot packets */
587 static int gdb_cmd_reboot(struct kgdb_state *ks)
589 /* For now, only honor R0 */
590 if (strcmp(remcom_in_buffer, "R0") == 0) {
591 printk(KERN_CRIT "Executing emergency reboot\n");
592 strcpy(remcom_out_buffer, "OK");
593 put_packet(remcom_out_buffer);
596 * Execution should not return from
597 * machine_emergency_restart()
599 machine_emergency_restart();
607 /* Handle the 'q' query packets */
608 static void gdb_cmd_query(struct kgdb_state *ks)
610 struct task_struct *g;
611 struct task_struct *p;
612 unsigned char thref[8];
618 switch (remcom_in_buffer[1]) {
621 if (memcmp(remcom_in_buffer + 2, "ThreadInfo", 10)) {
622 error_packet(remcom_out_buffer, -EINVAL);
627 remcom_out_buffer[0] = 'm';
628 ptr = remcom_out_buffer + 1;
629 if (remcom_in_buffer[1] == 'f') {
630 /* Each cpu is a shadow thread */
631 for_each_online_cpu(cpu) {
633 int_to_threadref(thref, -cpu - 2);
634 pack_threadid(ptr, thref);
635 ptr += BUF_THREAD_ID_SIZE;
641 do_each_thread(g, p) {
642 if (i >= ks->thr_query && !finished) {
643 int_to_threadref(thref, p->pid);
644 pack_threadid(ptr, thref);
645 ptr += BUF_THREAD_ID_SIZE;
648 if (ks->thr_query % KGDB_MAX_THREAD_QUERY == 0)
652 } while_each_thread(g, p);
658 /* Current thread id */
659 strcpy(remcom_out_buffer, "QC");
660 ks->threadid = shadow_pid(current->pid);
661 int_to_threadref(thref, ks->threadid);
662 pack_threadid(remcom_out_buffer + 2, thref);
665 if (memcmp(remcom_in_buffer + 1, "ThreadExtraInfo,", 16)) {
666 error_packet(remcom_out_buffer, -EINVAL);
670 ptr = remcom_in_buffer + 17;
671 kgdb_hex2long(&ptr, &ks->threadid);
672 if (!getthread(ks->linux_regs, ks->threadid)) {
673 error_packet(remcom_out_buffer, -EINVAL);
676 if ((int)ks->threadid > 0) {
677 kgdb_mem2hex(getthread(ks->linux_regs,
679 remcom_out_buffer, 16);
681 static char tmpstr[23 + BUF_THREAD_ID_SIZE];
683 sprintf(tmpstr, "shadowCPU%d",
684 (int)(-ks->threadid - 2));
685 kgdb_mem2hex(tmpstr, remcom_out_buffer, strlen(tmpstr));
691 /* Handle the 'H' task query packets */
692 static void gdb_cmd_task(struct kgdb_state *ks)
694 struct task_struct *thread;
697 switch (remcom_in_buffer[1]) {
699 ptr = &remcom_in_buffer[2];
700 kgdb_hex2long(&ptr, &ks->threadid);
701 thread = getthread(ks->linux_regs, ks->threadid);
702 if (!thread && ks->threadid > 0) {
703 error_packet(remcom_out_buffer, -EINVAL);
706 kgdb_usethread = thread;
707 ks->kgdb_usethreadid = ks->threadid;
708 strcpy(remcom_out_buffer, "OK");
711 ptr = &remcom_in_buffer[2];
712 kgdb_hex2long(&ptr, &ks->threadid);
714 kgdb_contthread = NULL;
716 thread = getthread(ks->linux_regs, ks->threadid);
717 if (!thread && ks->threadid > 0) {
718 error_packet(remcom_out_buffer, -EINVAL);
721 kgdb_contthread = thread;
723 strcpy(remcom_out_buffer, "OK");
728 /* Handle the 'T' thread query packets */
729 static void gdb_cmd_thread(struct kgdb_state *ks)
731 char *ptr = &remcom_in_buffer[1];
732 struct task_struct *thread;
734 kgdb_hex2long(&ptr, &ks->threadid);
735 thread = getthread(ks->linux_regs, ks->threadid);
737 strcpy(remcom_out_buffer, "OK");
739 error_packet(remcom_out_buffer, -EINVAL);
742 /* Handle the 'z' or 'Z' breakpoint remove or set packets */
743 static void gdb_cmd_break(struct kgdb_state *ks)
746 * Since GDB-5.3, it's been drafted that '0' is a software
747 * breakpoint, '1' is a hardware breakpoint, so let's do that.
749 char *bpt_type = &remcom_in_buffer[1];
750 char *ptr = &remcom_in_buffer[2];
752 unsigned long length;
755 if (arch_kgdb_ops.set_hw_breakpoint && *bpt_type >= '1') {
760 if (*bpt_type != '0' && *bpt_type != '1')
766 * Test if this is a hardware breakpoint, and
769 if (*bpt_type == '1' && !(arch_kgdb_ops.flags & KGDB_HW_BREAKPOINT))
773 if (*(ptr++) != ',') {
774 error_packet(remcom_out_buffer, -EINVAL);
777 if (!kgdb_hex2long(&ptr, &addr)) {
778 error_packet(remcom_out_buffer, -EINVAL);
781 if (*(ptr++) != ',' ||
782 !kgdb_hex2long(&ptr, &length)) {
783 error_packet(remcom_out_buffer, -EINVAL);
787 if (remcom_in_buffer[0] == 'Z' && *bpt_type == '0')
788 error = dbg_set_sw_break(addr);
789 else if (remcom_in_buffer[0] == 'z' && *bpt_type == '0')
790 error = dbg_remove_sw_break(addr);
791 else if (remcom_in_buffer[0] == 'Z')
792 error = arch_kgdb_ops.set_hw_breakpoint(addr,
793 (int)length, *bpt_type - '0');
794 else if (remcom_in_buffer[0] == 'z')
795 error = arch_kgdb_ops.remove_hw_breakpoint(addr,
796 (int) length, *bpt_type - '0');
799 strcpy(remcom_out_buffer, "OK");
801 error_packet(remcom_out_buffer, error);
804 /* Handle the 'C' signal / exception passing packets */
805 static int gdb_cmd_exception_pass(struct kgdb_state *ks)
807 /* C09 == pass exception
808 * C15 == detach kgdb, pass exception
810 if (remcom_in_buffer[1] == '0' && remcom_in_buffer[2] == '9') {
812 ks->pass_exception = 1;
813 remcom_in_buffer[0] = 'c';
815 } else if (remcom_in_buffer[1] == '1' && remcom_in_buffer[2] == '5') {
817 ks->pass_exception = 1;
818 remcom_in_buffer[0] = 'D';
819 dbg_remove_all_break();
824 gdbstub_msg_write("KGDB only knows signal 9 (pass)"
825 " and 15 (pass and disconnect)\n"
826 "Executing a continue without signal passing\n", 0);
827 remcom_in_buffer[0] = 'c';
830 /* Indicate fall through */
835 * This function performs all gdbserial command procesing
837 int gdb_serial_stub(struct kgdb_state *ks)
842 /* Clear the out buffer. */
843 memset(remcom_out_buffer, 0, sizeof(remcom_out_buffer));
845 if (kgdb_connected) {
846 unsigned char thref[8];
849 /* Reply to host that an exception has occurred */
850 ptr = remcom_out_buffer;
852 ptr = pack_hex_byte(ptr, ks->signo);
853 ptr += strlen(strcpy(ptr, "thread:"));
854 int_to_threadref(thref, shadow_pid(current->pid));
855 ptr = pack_threadid(ptr, thref);
857 put_packet(remcom_out_buffer);
860 kgdb_usethread = kgdb_info[ks->cpu].task;
861 ks->kgdb_usethreadid = shadow_pid(kgdb_info[ks->cpu].task->pid);
862 ks->pass_exception = 0;
867 /* Clear the out buffer. */
868 memset(remcom_out_buffer, 0, sizeof(remcom_out_buffer));
870 get_packet(remcom_in_buffer);
872 switch (remcom_in_buffer[0]) {
873 case '?': /* gdbserial status */
876 case 'g': /* return the value of the CPU registers */
879 case 'G': /* set the value of the CPU registers - return OK */
882 case 'm': /* mAA..AA,LLLL Read LLLL bytes at address AA..AA */
885 case 'M': /* MAA..AA,LLLL: Write LLLL bytes at address AA..AA */
886 gdb_cmd_memwrite(ks);
888 case 'X': /* XAA..AA,LLLL: Write LLLL bytes at address AA..AA */
889 gdb_cmd_binwrite(ks);
891 /* kill or detach. KGDB should treat this like a
894 case 'D': /* Debugger detach */
895 case 'k': /* Debugger detach via kill */
896 gdb_cmd_detachkill(ks);
898 case 'R': /* Reboot */
899 if (gdb_cmd_reboot(ks))
902 case 'q': /* query command */
905 case 'H': /* task related */
908 case 'T': /* Query thread status */
911 case 'z': /* Break point remove */
912 case 'Z': /* Break point set */
915 #ifdef CONFIG_KGDB_KDB
916 case '3': /* Escape into back into kdb */
917 if (remcom_in_buffer[1] == '\0') {
918 gdb_cmd_detachkill(ks);
919 return DBG_PASS_EVENT;
922 case 'C': /* Exception passing */
923 tmp = gdb_cmd_exception_pass(ks);
928 /* Fall through on tmp < 0 */
929 case 'c': /* Continue packet */
930 case 's': /* Single step packet */
931 if (kgdb_contthread && kgdb_contthread != current) {
932 /* Can't switch threads in kgdb */
933 error_packet(remcom_out_buffer, -EINVAL);
936 dbg_activate_sw_breakpoints();
937 /* Fall through to default processing */
940 error = kgdb_arch_handle_exception(ks->ex_vector,
947 * Leave cmd processing on error, detach,
948 * kill, continue, or single step.
950 if (error >= 0 || remcom_in_buffer[0] == 'D' ||
951 remcom_in_buffer[0] == 'k') {
958 /* reply to the request */
959 put_packet(remcom_out_buffer);
963 if (ks->pass_exception)
968 int gdbstub_state(struct kgdb_state *ks, char *cmd)
974 error = kgdb_arch_handle_exception(ks->ex_vector,
983 strcpy(remcom_in_buffer, cmd);
989 strcpy(remcom_out_buffer, "");
992 dbg_io_ops->write_char('+');
993 put_packet(remcom_out_buffer);