4 * Maintainer: Jason Wessel <jason.wessel@windriver.com>
6 * Copyright (C) 2000-2001 VERITAS Software Corporation.
7 * Copyright (C) 2002-2004 Timesys Corporation
8 * Copyright (C) 2003-2004 Amit S. Kale <amitkale@linsyssoft.com>
9 * Copyright (C) 2004 Pavel Machek <pavel@suse.cz>
10 * Copyright (C) 2004-2006 Tom Rini <trini@kernel.crashing.org>
11 * Copyright (C) 2004-2006 LinSysSoft Technologies Pvt. Ltd.
12 * Copyright (C) 2005-2009 Wind River Systems, Inc.
13 * Copyright (C) 2007 MontaVista Software, Inc.
14 * Copyright (C) 2008 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
16 * Contributors at various stages not listed above:
17 * Jason Wessel ( jason.wessel@windriver.com )
18 * George Anzinger <george@mvista.com>
19 * Anurekh Saxena (anurekh.saxena@timesys.com)
20 * Lake Stevens Instrument Division (Glenn Engel)
21 * Jim Kingdon, Cygnus Support.
23 * Original KGDB stub: David Grothe <dave@gcom.com>,
24 * Tigran Aivazian <tigran@sco.com>
26 * This file is licensed under the terms of the GNU General Public License
27 * version 2. This program is licensed "as is" without any warranty of any
28 * kind, whether express or implied.
31 #include <linux/kernel.h>
32 #include <linux/kgdb.h>
33 #include <linux/reboot.h>
34 #include <linux/uaccess.h>
35 #include <asm/cacheflush.h>
36 #include <asm/unaligned.h>
37 #include "debug_core.h"
39 #define KGDB_MAX_THREAD_QUERY 17
41 /* Our I/O buffers. */
42 static char remcom_in_buffer[BUFMAX];
43 static char remcom_out_buffer[BUFMAX];
45 /* Storage for the registers, in GDB format. */
46 static unsigned long gdb_regs[(NUMREGBYTES +
47 sizeof(unsigned long) - 1) /
48 sizeof(unsigned long)];
51 * GDB remote protocol parser:
54 static int hex(char ch)
56 if ((ch >= 'a') && (ch <= 'f'))
58 if ((ch >= '0') && (ch <= '9'))
60 if ((ch >= 'A') && (ch <= 'F'))
65 /* scan for the sequence $<data>#<checksum> */
66 static void get_packet(char *buffer)
68 unsigned char checksum;
69 unsigned char xmitcsum;
75 * Spin and wait around for the start character, ignore all
78 while ((ch = (dbg_io_ops->read_char())) != '$')
88 * now, read until a # or end of buffer is found:
90 while (count < (BUFMAX - 1)) {
91 ch = dbg_io_ops->read_char();
94 checksum = checksum + ch;
101 xmitcsum = hex(dbg_io_ops->read_char()) << 4;
102 xmitcsum += hex(dbg_io_ops->read_char());
104 if (checksum != xmitcsum)
105 /* failed checksum */
106 dbg_io_ops->write_char('-');
108 /* successful transfer */
109 dbg_io_ops->write_char('+');
110 if (dbg_io_ops->flush)
113 } while (checksum != xmitcsum);
117 * Send the packet in buffer.
118 * Check for gdb connection if asked for.
120 static void put_packet(char *buffer)
122 unsigned char checksum;
127 * $<packet info>#<checksum>.
130 dbg_io_ops->write_char('$');
134 while ((ch = buffer[count])) {
135 dbg_io_ops->write_char(ch);
140 dbg_io_ops->write_char('#');
141 dbg_io_ops->write_char(hex_asc_hi(checksum));
142 dbg_io_ops->write_char(hex_asc_lo(checksum));
143 if (dbg_io_ops->flush)
146 /* Now see what we get in reply. */
147 ch = dbg_io_ops->read_char();
150 ch = dbg_io_ops->read_char();
152 /* If we get an ACK, we are done. */
157 * If we get the start of another packet, this means
158 * that GDB is attempting to reconnect. We will NAK
159 * the packet being sent, and stop trying to send this
163 dbg_io_ops->write_char('-');
164 if (dbg_io_ops->flush)
171 static char gdbmsgbuf[BUFMAX + 1];
173 void gdbstub_msg_write(const char *s, int len)
182 /* Fill and send buffers... */
184 bufptr = gdbmsgbuf + 1;
186 /* Calculate how many this time */
187 if ((len << 1) > (BUFMAX - 2))
188 wcount = (BUFMAX - 2) >> 1;
192 /* Pack in hex chars */
193 for (i = 0; i < wcount; i++)
194 bufptr = pack_hex_byte(bufptr, s[i]);
202 put_packet(gdbmsgbuf);
207 * Convert the memory pointed to by mem into hex, placing result in
208 * buf. Return a pointer to the last char put in buf (null). May
211 int kgdb_mem2hex(char *mem, char *buf, int count)
217 * We use the upper half of buf as an intermediate buffer for the
218 * raw memory copy. Hex conversion will work against this one.
222 err = probe_kernel_read(tmp, mem, count);
225 buf = pack_hex_byte(buf, *tmp);
237 * Convert the hex array pointed to by buf into binary to be placed in
238 * mem. Return a pointer to the character AFTER the last byte
239 * written. May return an error.
241 int kgdb_hex2mem(char *buf, char *mem, int count)
247 * We use the upper half of buf as an intermediate buffer for the
248 * raw memory that is converted from hex.
250 tmp_raw = buf + count * 2;
252 tmp_hex = tmp_raw - 1;
253 while (tmp_hex >= buf) {
255 *tmp_raw = hex(*tmp_hex--);
256 *tmp_raw |= hex(*tmp_hex--) << 4;
259 return probe_kernel_write(mem, tmp_raw, count);
263 * While we find nice hex chars, build a long_val.
264 * Return number of chars processed.
266 int kgdb_hex2long(char **ptr, unsigned long *long_val)
279 hex_val = hex(**ptr);
283 *long_val = (*long_val << 4) | hex_val;
289 *long_val = -*long_val;
295 * Copy the binary array pointed to by buf into mem. Fix $, #, and
296 * 0x7d escaped with 0x7d. Return -EFAULT on failure or 0 on success.
297 * The input buf is overwitten with the result to write to mem.
299 static int kgdb_ebin2mem(char *buf, char *mem, int count)
304 while (count-- > 0) {
307 c[size] = *buf++ ^ 0x20;
311 return probe_kernel_write(mem, c, size);
314 /* Write memory due to an 'M' or 'X' packet. */
315 static int write_mem_msg(int binary)
317 char *ptr = &remcom_in_buffer[1];
319 unsigned long length;
322 if (kgdb_hex2long(&ptr, &addr) > 0 && *(ptr++) == ',' &&
323 kgdb_hex2long(&ptr, &length) > 0 && *(ptr++) == ':') {
325 err = kgdb_ebin2mem(ptr, (char *)addr, length);
327 err = kgdb_hex2mem(ptr, (char *)addr, length);
330 if (CACHE_FLUSH_IS_SAFE)
331 flush_icache_range(addr, addr + length);
338 static void error_packet(char *pkt, int error)
342 pkt[1] = hex_asc[(error / 10)];
343 pkt[2] = hex_asc[(error % 10)];
348 * Thread ID accessors. We represent a flat TID space to GDB, where
349 * the per CPU idle threads (which under Linux all have PID 0) are
350 * remapped to negative TIDs.
353 #define BUF_THREAD_ID_SIZE 16
355 static char *pack_threadid(char *pkt, unsigned char *id)
359 limit = pkt + BUF_THREAD_ID_SIZE;
361 pkt = pack_hex_byte(pkt, *id++);
366 static void int_to_threadref(unsigned char *id, int value)
371 scan = (unsigned char *)id;
374 put_unaligned_be32(value, scan);
377 static struct task_struct *getthread(struct pt_regs *regs, int tid)
380 * Non-positive TIDs are remapped to the cpu shadow information
382 if (tid == 0 || tid == -1)
383 tid = -atomic_read(&kgdb_active) - 2;
384 if (tid < -1 && tid > -NR_CPUS - 2) {
385 if (kgdb_info[-tid - 2].task)
386 return kgdb_info[-tid - 2].task;
388 return idle_task(-tid - 2);
391 printk(KERN_ERR "KGDB: Internal thread select error\n");
397 * find_task_by_pid_ns() does not take the tasklist lock anymore
398 * but is nicely RCU locked - hence is a pretty resilient
401 return find_task_by_pid_ns(tid, &init_pid_ns);
406 * Remap normal tasks to their real PID,
407 * CPU shadow threads are mapped to -CPU - 2
409 static inline int shadow_pid(int realpid)
414 return -raw_smp_processor_id() - 2;
418 * All the functions that start with gdb_cmd are the various
419 * operations to implement the handlers for the gdbserial protocol
420 * where KGDB is communicating with an external debugger
423 /* Handle the '?' status packets */
424 static void gdb_cmd_status(struct kgdb_state *ks)
427 * We know that this packet is only sent
428 * during initial connect. So to be safe,
429 * we clear out our breakpoints now in case
430 * GDB is reconnecting.
432 dbg_remove_all_break();
434 remcom_out_buffer[0] = 'S';
435 pack_hex_byte(&remcom_out_buffer[1], ks->signo);
438 /* Handle the 'g' get registers request */
439 static void gdb_cmd_getregs(struct kgdb_state *ks)
441 struct task_struct *thread;
442 void *local_debuggerinfo;
445 thread = kgdb_usethread;
447 thread = kgdb_info[ks->cpu].task;
448 local_debuggerinfo = kgdb_info[ks->cpu].debuggerinfo;
450 local_debuggerinfo = NULL;
451 for_each_online_cpu(i) {
453 * Try to find the task on some other
454 * or possibly this node if we do not
455 * find the matching task then we try
456 * to approximate the results.
458 if (thread == kgdb_info[i].task)
459 local_debuggerinfo = kgdb_info[i].debuggerinfo;
464 * All threads that don't have debuggerinfo should be
465 * in schedule() sleeping, since all other CPUs
466 * are in kgdb_wait, and thus have debuggerinfo.
468 if (local_debuggerinfo) {
469 pt_regs_to_gdb_regs(gdb_regs, local_debuggerinfo);
472 * Pull stuff saved during switch_to; nothing
473 * else is accessible (or even particularly
476 * This should be enough for a stack trace.
478 sleeping_thread_to_gdb_regs(gdb_regs, thread);
480 kgdb_mem2hex((char *)gdb_regs, remcom_out_buffer, NUMREGBYTES);
483 /* Handle the 'G' set registers request */
484 static void gdb_cmd_setregs(struct kgdb_state *ks)
486 kgdb_hex2mem(&remcom_in_buffer[1], (char *)gdb_regs, NUMREGBYTES);
488 if (kgdb_usethread && kgdb_usethread != current) {
489 error_packet(remcom_out_buffer, -EINVAL);
491 gdb_regs_to_pt_regs(gdb_regs, ks->linux_regs);
492 strcpy(remcom_out_buffer, "OK");
496 /* Handle the 'm' memory read bytes */
497 static void gdb_cmd_memread(struct kgdb_state *ks)
499 char *ptr = &remcom_in_buffer[1];
500 unsigned long length;
504 if (kgdb_hex2long(&ptr, &addr) > 0 && *ptr++ == ',' &&
505 kgdb_hex2long(&ptr, &length) > 0) {
506 err = kgdb_mem2hex((char *)addr, remcom_out_buffer, length);
508 error_packet(remcom_out_buffer, err);
510 error_packet(remcom_out_buffer, -EINVAL);
514 /* Handle the 'M' memory write bytes */
515 static void gdb_cmd_memwrite(struct kgdb_state *ks)
517 int err = write_mem_msg(0);
520 error_packet(remcom_out_buffer, err);
522 strcpy(remcom_out_buffer, "OK");
525 /* Handle the 'X' memory binary write bytes */
526 static void gdb_cmd_binwrite(struct kgdb_state *ks)
528 int err = write_mem_msg(1);
531 error_packet(remcom_out_buffer, err);
533 strcpy(remcom_out_buffer, "OK");
536 /* Handle the 'D' or 'k', detach or kill packets */
537 static void gdb_cmd_detachkill(struct kgdb_state *ks)
541 /* The detach case */
542 if (remcom_in_buffer[0] == 'D') {
543 error = dbg_remove_all_break();
545 error_packet(remcom_out_buffer, error);
547 strcpy(remcom_out_buffer, "OK");
550 put_packet(remcom_out_buffer);
553 * Assume the kill case, with no exit code checking,
554 * trying to force detach the debugger:
556 dbg_remove_all_break();
561 /* Handle the 'R' reboot packets */
562 static int gdb_cmd_reboot(struct kgdb_state *ks)
564 /* For now, only honor R0 */
565 if (strcmp(remcom_in_buffer, "R0") == 0) {
566 printk(KERN_CRIT "Executing emergency reboot\n");
567 strcpy(remcom_out_buffer, "OK");
568 put_packet(remcom_out_buffer);
571 * Execution should not return from
572 * machine_emergency_restart()
574 machine_emergency_restart();
582 /* Handle the 'q' query packets */
583 static void gdb_cmd_query(struct kgdb_state *ks)
585 struct task_struct *g;
586 struct task_struct *p;
587 unsigned char thref[8];
593 switch (remcom_in_buffer[1]) {
596 if (memcmp(remcom_in_buffer + 2, "ThreadInfo", 10)) {
597 error_packet(remcom_out_buffer, -EINVAL);
602 remcom_out_buffer[0] = 'm';
603 ptr = remcom_out_buffer + 1;
604 if (remcom_in_buffer[1] == 'f') {
605 /* Each cpu is a shadow thread */
606 for_each_online_cpu(cpu) {
608 int_to_threadref(thref, -cpu - 2);
609 pack_threadid(ptr, thref);
610 ptr += BUF_THREAD_ID_SIZE;
616 do_each_thread(g, p) {
617 if (i >= ks->thr_query && !finished) {
618 int_to_threadref(thref, p->pid);
619 pack_threadid(ptr, thref);
620 ptr += BUF_THREAD_ID_SIZE;
623 if (ks->thr_query % KGDB_MAX_THREAD_QUERY == 0)
627 } while_each_thread(g, p);
633 /* Current thread id */
634 strcpy(remcom_out_buffer, "QC");
635 ks->threadid = shadow_pid(current->pid);
636 int_to_threadref(thref, ks->threadid);
637 pack_threadid(remcom_out_buffer + 2, thref);
640 if (memcmp(remcom_in_buffer + 1, "ThreadExtraInfo,", 16)) {
641 error_packet(remcom_out_buffer, -EINVAL);
645 ptr = remcom_in_buffer + 17;
646 kgdb_hex2long(&ptr, &ks->threadid);
647 if (!getthread(ks->linux_regs, ks->threadid)) {
648 error_packet(remcom_out_buffer, -EINVAL);
651 if ((int)ks->threadid > 0) {
652 kgdb_mem2hex(getthread(ks->linux_regs,
654 remcom_out_buffer, 16);
656 static char tmpstr[23 + BUF_THREAD_ID_SIZE];
658 sprintf(tmpstr, "shadowCPU%d",
659 (int)(-ks->threadid - 2));
660 kgdb_mem2hex(tmpstr, remcom_out_buffer, strlen(tmpstr));
666 /* Handle the 'H' task query packets */
667 static void gdb_cmd_task(struct kgdb_state *ks)
669 struct task_struct *thread;
672 switch (remcom_in_buffer[1]) {
674 ptr = &remcom_in_buffer[2];
675 kgdb_hex2long(&ptr, &ks->threadid);
676 thread = getthread(ks->linux_regs, ks->threadid);
677 if (!thread && ks->threadid > 0) {
678 error_packet(remcom_out_buffer, -EINVAL);
681 kgdb_usethread = thread;
682 ks->kgdb_usethreadid = ks->threadid;
683 strcpy(remcom_out_buffer, "OK");
686 ptr = &remcom_in_buffer[2];
687 kgdb_hex2long(&ptr, &ks->threadid);
689 kgdb_contthread = NULL;
691 thread = getthread(ks->linux_regs, ks->threadid);
692 if (!thread && ks->threadid > 0) {
693 error_packet(remcom_out_buffer, -EINVAL);
696 kgdb_contthread = thread;
698 strcpy(remcom_out_buffer, "OK");
703 /* Handle the 'T' thread query packets */
704 static void gdb_cmd_thread(struct kgdb_state *ks)
706 char *ptr = &remcom_in_buffer[1];
707 struct task_struct *thread;
709 kgdb_hex2long(&ptr, &ks->threadid);
710 thread = getthread(ks->linux_regs, ks->threadid);
712 strcpy(remcom_out_buffer, "OK");
714 error_packet(remcom_out_buffer, -EINVAL);
717 /* Handle the 'z' or 'Z' breakpoint remove or set packets */
718 static void gdb_cmd_break(struct kgdb_state *ks)
721 * Since GDB-5.3, it's been drafted that '0' is a software
722 * breakpoint, '1' is a hardware breakpoint, so let's do that.
724 char *bpt_type = &remcom_in_buffer[1];
725 char *ptr = &remcom_in_buffer[2];
727 unsigned long length;
730 if (arch_kgdb_ops.set_hw_breakpoint && *bpt_type >= '1') {
735 if (*bpt_type != '0' && *bpt_type != '1')
741 * Test if this is a hardware breakpoint, and
744 if (*bpt_type == '1' && !(arch_kgdb_ops.flags & KGDB_HW_BREAKPOINT))
748 if (*(ptr++) != ',') {
749 error_packet(remcom_out_buffer, -EINVAL);
752 if (!kgdb_hex2long(&ptr, &addr)) {
753 error_packet(remcom_out_buffer, -EINVAL);
756 if (*(ptr++) != ',' ||
757 !kgdb_hex2long(&ptr, &length)) {
758 error_packet(remcom_out_buffer, -EINVAL);
762 if (remcom_in_buffer[0] == 'Z' && *bpt_type == '0')
763 error = dbg_set_sw_break(addr);
764 else if (remcom_in_buffer[0] == 'z' && *bpt_type == '0')
765 error = dbg_remove_sw_break(addr);
766 else if (remcom_in_buffer[0] == 'Z')
767 error = arch_kgdb_ops.set_hw_breakpoint(addr,
768 (int)length, *bpt_type - '0');
769 else if (remcom_in_buffer[0] == 'z')
770 error = arch_kgdb_ops.remove_hw_breakpoint(addr,
771 (int) length, *bpt_type - '0');
774 strcpy(remcom_out_buffer, "OK");
776 error_packet(remcom_out_buffer, error);
779 /* Handle the 'C' signal / exception passing packets */
780 static int gdb_cmd_exception_pass(struct kgdb_state *ks)
782 /* C09 == pass exception
783 * C15 == detach kgdb, pass exception
785 if (remcom_in_buffer[1] == '0' && remcom_in_buffer[2] == '9') {
787 ks->pass_exception = 1;
788 remcom_in_buffer[0] = 'c';
790 } else if (remcom_in_buffer[1] == '1' && remcom_in_buffer[2] == '5') {
792 ks->pass_exception = 1;
793 remcom_in_buffer[0] = 'D';
794 dbg_remove_all_break();
799 gdbstub_msg_write("KGDB only knows signal 9 (pass)"
800 " and 15 (pass and disconnect)\n"
801 "Executing a continue without signal passing\n", 0);
802 remcom_in_buffer[0] = 'c';
805 /* Indicate fall through */
810 * This function performs all gdbserial command procesing
812 int gdb_serial_stub(struct kgdb_state *ks)
817 /* Clear the out buffer. */
818 memset(remcom_out_buffer, 0, sizeof(remcom_out_buffer));
820 if (kgdb_connected) {
821 unsigned char thref[8];
824 /* Reply to host that an exception has occurred */
825 ptr = remcom_out_buffer;
827 ptr = pack_hex_byte(ptr, ks->signo);
828 ptr += strlen(strcpy(ptr, "thread:"));
829 int_to_threadref(thref, shadow_pid(current->pid));
830 ptr = pack_threadid(ptr, thref);
832 put_packet(remcom_out_buffer);
835 kgdb_usethread = kgdb_info[ks->cpu].task;
836 ks->kgdb_usethreadid = shadow_pid(kgdb_info[ks->cpu].task->pid);
837 ks->pass_exception = 0;
842 /* Clear the out buffer. */
843 memset(remcom_out_buffer, 0, sizeof(remcom_out_buffer));
845 get_packet(remcom_in_buffer);
847 switch (remcom_in_buffer[0]) {
848 case '?': /* gdbserial status */
851 case 'g': /* return the value of the CPU registers */
854 case 'G': /* set the value of the CPU registers - return OK */
857 case 'm': /* mAA..AA,LLLL Read LLLL bytes at address AA..AA */
860 case 'M': /* MAA..AA,LLLL: Write LLLL bytes at address AA..AA */
861 gdb_cmd_memwrite(ks);
863 case 'X': /* XAA..AA,LLLL: Write LLLL bytes at address AA..AA */
864 gdb_cmd_binwrite(ks);
866 /* kill or detach. KGDB should treat this like a
869 case 'D': /* Debugger detach */
870 case 'k': /* Debugger detach via kill */
871 gdb_cmd_detachkill(ks);
873 case 'R': /* Reboot */
874 if (gdb_cmd_reboot(ks))
877 case 'q': /* query command */
880 case 'H': /* task related */
883 case 'T': /* Query thread status */
886 case 'z': /* Break point remove */
887 case 'Z': /* Break point set */
890 #ifdef CONFIG_KGDB_KDB
891 case '3': /* Escape into back into kdb */
892 if (remcom_in_buffer[1] == '\0') {
893 gdb_cmd_detachkill(ks);
894 return DBG_PASS_EVENT;
897 case 'C': /* Exception passing */
898 tmp = gdb_cmd_exception_pass(ks);
903 /* Fall through on tmp < 0 */
904 case 'c': /* Continue packet */
905 case 's': /* Single step packet */
906 if (kgdb_contthread && kgdb_contthread != current) {
907 /* Can't switch threads in kgdb */
908 error_packet(remcom_out_buffer, -EINVAL);
911 dbg_activate_sw_breakpoints();
912 /* Fall through to default processing */
915 error = kgdb_arch_handle_exception(ks->ex_vector,
922 * Leave cmd processing on error, detach,
923 * kill, continue, or single step.
925 if (error >= 0 || remcom_in_buffer[0] == 'D' ||
926 remcom_in_buffer[0] == 'k') {
933 /* reply to the request */
934 put_packet(remcom_out_buffer);
938 if (ks->pass_exception)
943 int gdbstub_state(struct kgdb_state *ks, char *cmd)
949 error = kgdb_arch_handle_exception(ks->ex_vector,
958 strcpy(remcom_in_buffer, cmd);
964 strcpy(remcom_out_buffer, "");
967 dbg_io_ops->write_char('+');
968 put_packet(remcom_out_buffer);