4 * Maintainer: Jason Wessel <jason.wessel@windriver.com>
6 * Copyright (C) 2000-2001 VERITAS Software Corporation.
7 * Copyright (C) 2002-2004 Timesys Corporation
8 * Copyright (C) 2003-2004 Amit S. Kale <amitkale@linsyssoft.com>
9 * Copyright (C) 2004 Pavel Machek <pavel@suse.cz>
10 * Copyright (C) 2004-2006 Tom Rini <trini@kernel.crashing.org>
11 * Copyright (C) 2004-2006 LinSysSoft Technologies Pvt. Ltd.
12 * Copyright (C) 2005-2009 Wind River Systems, Inc.
13 * Copyright (C) 2007 MontaVista Software, Inc.
14 * Copyright (C) 2008 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
16 * Contributors at various stages not listed above:
17 * Jason Wessel ( jason.wessel@windriver.com )
18 * George Anzinger <george@mvista.com>
19 * Anurekh Saxena (anurekh.saxena@timesys.com)
20 * Lake Stevens Instrument Division (Glenn Engel)
21 * Jim Kingdon, Cygnus Support.
23 * Original KGDB stub: David Grothe <dave@gcom.com>,
24 * Tigran Aivazian <tigran@sco.com>
26 * This file is licensed under the terms of the GNU General Public License
27 * version 2. This program is licensed "as is" without any warranty of any
28 * kind, whether express or implied.
31 #include <linux/kernel.h>
32 #include <linux/kgdb.h>
33 #include <linux/kdb.h>
34 #include <linux/reboot.h>
35 #include <linux/uaccess.h>
36 #include <asm/cacheflush.h>
37 #include <asm/unaligned.h>
38 #include "debug_core.h"
40 #define KGDB_MAX_THREAD_QUERY 17
42 /* Our I/O buffers. */
43 static char remcom_in_buffer[BUFMAX];
44 static char remcom_out_buffer[BUFMAX];
46 /* Storage for the registers, in GDB format. */
47 static unsigned long gdb_regs[(NUMREGBYTES +
48 sizeof(unsigned long) - 1) /
49 sizeof(unsigned long)];
52 * GDB remote protocol parser:
55 static int hex(char ch)
57 if ((ch >= 'a') && (ch <= 'f'))
59 if ((ch >= '0') && (ch <= '9'))
61 if ((ch >= 'A') && (ch <= 'F'))
66 #ifdef CONFIG_KGDB_KDB
67 static int gdbstub_read_wait(void)
72 /* poll any additional I/O interfaces that are defined */
74 for (i = 0; kdb_poll_funcs[i] != NULL; i++) {
75 ret = kdb_poll_funcs[i]();
82 static int gdbstub_read_wait(void)
84 int ret = dbg_io_ops->read_char();
85 while (ret == NO_POLL_CHAR)
86 ret = dbg_io_ops->read_char();
90 /* scan for the sequence $<data>#<checksum> */
91 static void get_packet(char *buffer)
93 unsigned char checksum;
94 unsigned char xmitcsum;
100 * Spin and wait around for the start character, ignore all
103 while ((ch = (gdbstub_read_wait())) != '$')
113 * now, read until a # or end of buffer is found:
115 while (count < (BUFMAX - 1)) {
116 ch = gdbstub_read_wait();
119 checksum = checksum + ch;
126 xmitcsum = hex(gdbstub_read_wait()) << 4;
127 xmitcsum += hex(gdbstub_read_wait());
129 if (checksum != xmitcsum)
130 /* failed checksum */
131 dbg_io_ops->write_char('-');
133 /* successful transfer */
134 dbg_io_ops->write_char('+');
135 if (dbg_io_ops->flush)
138 } while (checksum != xmitcsum);
142 * Send the packet in buffer.
143 * Check for gdb connection if asked for.
145 static void put_packet(char *buffer)
147 unsigned char checksum;
152 * $<packet info>#<checksum>.
155 dbg_io_ops->write_char('$');
159 while ((ch = buffer[count])) {
160 dbg_io_ops->write_char(ch);
165 dbg_io_ops->write_char('#');
166 dbg_io_ops->write_char(hex_asc_hi(checksum));
167 dbg_io_ops->write_char(hex_asc_lo(checksum));
168 if (dbg_io_ops->flush)
171 /* Now see what we get in reply. */
172 ch = gdbstub_read_wait();
175 ch = gdbstub_read_wait();
177 /* If we get an ACK, we are done. */
182 * If we get the start of another packet, this means
183 * that GDB is attempting to reconnect. We will NAK
184 * the packet being sent, and stop trying to send this
188 dbg_io_ops->write_char('-');
189 if (dbg_io_ops->flush)
196 static char gdbmsgbuf[BUFMAX + 1];
198 void gdbstub_msg_write(const char *s, int len)
210 /* Fill and send buffers... */
212 bufptr = gdbmsgbuf + 1;
214 /* Calculate how many this time */
215 if ((len << 1) > (BUFMAX - 2))
216 wcount = (BUFMAX - 2) >> 1;
220 /* Pack in hex chars */
221 for (i = 0; i < wcount; i++)
222 bufptr = pack_hex_byte(bufptr, s[i]);
230 put_packet(gdbmsgbuf);
235 * Convert the memory pointed to by mem into hex, placing result in
236 * buf. Return a pointer to the last char put in buf (null). May
239 int kgdb_mem2hex(char *mem, char *buf, int count)
245 * We use the upper half of buf as an intermediate buffer for the
246 * raw memory copy. Hex conversion will work against this one.
250 err = probe_kernel_read(tmp, mem, count);
253 buf = pack_hex_byte(buf, *tmp);
265 * Convert the hex array pointed to by buf into binary to be placed in
266 * mem. Return a pointer to the character AFTER the last byte
267 * written. May return an error.
269 int kgdb_hex2mem(char *buf, char *mem, int count)
275 * We use the upper half of buf as an intermediate buffer for the
276 * raw memory that is converted from hex.
278 tmp_raw = buf + count * 2;
280 tmp_hex = tmp_raw - 1;
281 while (tmp_hex >= buf) {
283 *tmp_raw = hex(*tmp_hex--);
284 *tmp_raw |= hex(*tmp_hex--) << 4;
287 return probe_kernel_write(mem, tmp_raw, count);
291 * While we find nice hex chars, build a long_val.
292 * Return number of chars processed.
294 int kgdb_hex2long(char **ptr, unsigned long *long_val)
307 hex_val = hex(**ptr);
311 *long_val = (*long_val << 4) | hex_val;
317 *long_val = -*long_val;
323 * Copy the binary array pointed to by buf into mem. Fix $, #, and
324 * 0x7d escaped with 0x7d. Return -EFAULT on failure or 0 on success.
325 * The input buf is overwitten with the result to write to mem.
327 static int kgdb_ebin2mem(char *buf, char *mem, int count)
332 while (count-- > 0) {
335 c[size] = *buf++ ^ 0x20;
339 return probe_kernel_write(mem, c, size);
342 /* Write memory due to an 'M' or 'X' packet. */
343 static int write_mem_msg(int binary)
345 char *ptr = &remcom_in_buffer[1];
347 unsigned long length;
350 if (kgdb_hex2long(&ptr, &addr) > 0 && *(ptr++) == ',' &&
351 kgdb_hex2long(&ptr, &length) > 0 && *(ptr++) == ':') {
353 err = kgdb_ebin2mem(ptr, (char *)addr, length);
355 err = kgdb_hex2mem(ptr, (char *)addr, length);
358 if (CACHE_FLUSH_IS_SAFE)
359 flush_icache_range(addr, addr + length);
366 static void error_packet(char *pkt, int error)
370 pkt[1] = hex_asc[(error / 10)];
371 pkt[2] = hex_asc[(error % 10)];
376 * Thread ID accessors. We represent a flat TID space to GDB, where
377 * the per CPU idle threads (which under Linux all have PID 0) are
378 * remapped to negative TIDs.
381 #define BUF_THREAD_ID_SIZE 16
383 static char *pack_threadid(char *pkt, unsigned char *id)
387 limit = pkt + BUF_THREAD_ID_SIZE;
389 pkt = pack_hex_byte(pkt, *id++);
394 static void int_to_threadref(unsigned char *id, int value)
399 scan = (unsigned char *)id;
402 put_unaligned_be32(value, scan);
405 static struct task_struct *getthread(struct pt_regs *regs, int tid)
408 * Non-positive TIDs are remapped to the cpu shadow information
410 if (tid == 0 || tid == -1)
411 tid = -atomic_read(&kgdb_active) - 2;
412 if (tid < -1 && tid > -NR_CPUS - 2) {
413 if (kgdb_info[-tid - 2].task)
414 return kgdb_info[-tid - 2].task;
416 return idle_task(-tid - 2);
419 printk(KERN_ERR "KGDB: Internal thread select error\n");
425 * find_task_by_pid_ns() does not take the tasklist lock anymore
426 * but is nicely RCU locked - hence is a pretty resilient
429 return find_task_by_pid_ns(tid, &init_pid_ns);
434 * Remap normal tasks to their real PID,
435 * CPU shadow threads are mapped to -CPU - 2
437 static inline int shadow_pid(int realpid)
442 return -raw_smp_processor_id() - 2;
446 * All the functions that start with gdb_cmd are the various
447 * operations to implement the handlers for the gdbserial protocol
448 * where KGDB is communicating with an external debugger
451 /* Handle the '?' status packets */
452 static void gdb_cmd_status(struct kgdb_state *ks)
455 * We know that this packet is only sent
456 * during initial connect. So to be safe,
457 * we clear out our breakpoints now in case
458 * GDB is reconnecting.
460 dbg_remove_all_break();
462 remcom_out_buffer[0] = 'S';
463 pack_hex_byte(&remcom_out_buffer[1], ks->signo);
466 /* Handle the 'g' get registers request */
467 static void gdb_cmd_getregs(struct kgdb_state *ks)
469 struct task_struct *thread;
470 void *local_debuggerinfo;
473 thread = kgdb_usethread;
475 thread = kgdb_info[ks->cpu].task;
476 local_debuggerinfo = kgdb_info[ks->cpu].debuggerinfo;
478 local_debuggerinfo = NULL;
479 for_each_online_cpu(i) {
481 * Try to find the task on some other
482 * or possibly this node if we do not
483 * find the matching task then we try
484 * to approximate the results.
486 if (thread == kgdb_info[i].task)
487 local_debuggerinfo = kgdb_info[i].debuggerinfo;
492 * All threads that don't have debuggerinfo should be
493 * in schedule() sleeping, since all other CPUs
494 * are in kgdb_wait, and thus have debuggerinfo.
496 if (local_debuggerinfo) {
497 pt_regs_to_gdb_regs(gdb_regs, local_debuggerinfo);
500 * Pull stuff saved during switch_to; nothing
501 * else is accessible (or even particularly
504 * This should be enough for a stack trace.
506 sleeping_thread_to_gdb_regs(gdb_regs, thread);
508 kgdb_mem2hex((char *)gdb_regs, remcom_out_buffer, NUMREGBYTES);
511 /* Handle the 'G' set registers request */
512 static void gdb_cmd_setregs(struct kgdb_state *ks)
514 kgdb_hex2mem(&remcom_in_buffer[1], (char *)gdb_regs, NUMREGBYTES);
516 if (kgdb_usethread && kgdb_usethread != current) {
517 error_packet(remcom_out_buffer, -EINVAL);
519 gdb_regs_to_pt_regs(gdb_regs, ks->linux_regs);
520 strcpy(remcom_out_buffer, "OK");
524 /* Handle the 'm' memory read bytes */
525 static void gdb_cmd_memread(struct kgdb_state *ks)
527 char *ptr = &remcom_in_buffer[1];
528 unsigned long length;
532 if (kgdb_hex2long(&ptr, &addr) > 0 && *ptr++ == ',' &&
533 kgdb_hex2long(&ptr, &length) > 0) {
534 err = kgdb_mem2hex((char *)addr, remcom_out_buffer, length);
536 error_packet(remcom_out_buffer, err);
538 error_packet(remcom_out_buffer, -EINVAL);
542 /* Handle the 'M' memory write bytes */
543 static void gdb_cmd_memwrite(struct kgdb_state *ks)
545 int err = write_mem_msg(0);
548 error_packet(remcom_out_buffer, err);
550 strcpy(remcom_out_buffer, "OK");
553 /* Handle the 'X' memory binary write bytes */
554 static void gdb_cmd_binwrite(struct kgdb_state *ks)
556 int err = write_mem_msg(1);
559 error_packet(remcom_out_buffer, err);
561 strcpy(remcom_out_buffer, "OK");
564 /* Handle the 'D' or 'k', detach or kill packets */
565 static void gdb_cmd_detachkill(struct kgdb_state *ks)
569 /* The detach case */
570 if (remcom_in_buffer[0] == 'D') {
571 error = dbg_remove_all_break();
573 error_packet(remcom_out_buffer, error);
575 strcpy(remcom_out_buffer, "OK");
578 put_packet(remcom_out_buffer);
581 * Assume the kill case, with no exit code checking,
582 * trying to force detach the debugger:
584 dbg_remove_all_break();
589 /* Handle the 'R' reboot packets */
590 static int gdb_cmd_reboot(struct kgdb_state *ks)
592 /* For now, only honor R0 */
593 if (strcmp(remcom_in_buffer, "R0") == 0) {
594 printk(KERN_CRIT "Executing emergency reboot\n");
595 strcpy(remcom_out_buffer, "OK");
596 put_packet(remcom_out_buffer);
599 * Execution should not return from
600 * machine_emergency_restart()
602 machine_emergency_restart();
610 /* Handle the 'q' query packets */
611 static void gdb_cmd_query(struct kgdb_state *ks)
613 struct task_struct *g;
614 struct task_struct *p;
615 unsigned char thref[8];
621 switch (remcom_in_buffer[1]) {
624 if (memcmp(remcom_in_buffer + 2, "ThreadInfo", 10))
628 remcom_out_buffer[0] = 'm';
629 ptr = remcom_out_buffer + 1;
630 if (remcom_in_buffer[1] == 'f') {
631 /* Each cpu is a shadow thread */
632 for_each_online_cpu(cpu) {
634 int_to_threadref(thref, -cpu - 2);
635 pack_threadid(ptr, thref);
636 ptr += BUF_THREAD_ID_SIZE;
642 do_each_thread(g, p) {
643 if (i >= ks->thr_query && !finished) {
644 int_to_threadref(thref, p->pid);
645 pack_threadid(ptr, thref);
646 ptr += BUF_THREAD_ID_SIZE;
649 if (ks->thr_query % KGDB_MAX_THREAD_QUERY == 0)
653 } while_each_thread(g, p);
659 /* Current thread id */
660 strcpy(remcom_out_buffer, "QC");
661 ks->threadid = shadow_pid(current->pid);
662 int_to_threadref(thref, ks->threadid);
663 pack_threadid(remcom_out_buffer + 2, thref);
666 if (memcmp(remcom_in_buffer + 1, "ThreadExtraInfo,", 16))
670 ptr = remcom_in_buffer + 17;
671 kgdb_hex2long(&ptr, &ks->threadid);
672 if (!getthread(ks->linux_regs, ks->threadid)) {
673 error_packet(remcom_out_buffer, -EINVAL);
676 if ((int)ks->threadid > 0) {
677 kgdb_mem2hex(getthread(ks->linux_regs,
679 remcom_out_buffer, 16);
681 static char tmpstr[23 + BUF_THREAD_ID_SIZE];
683 sprintf(tmpstr, "shadowCPU%d",
684 (int)(-ks->threadid - 2));
685 kgdb_mem2hex(tmpstr, remcom_out_buffer, strlen(tmpstr));
688 #ifdef CONFIG_KGDB_KDB
690 if (strncmp(remcom_in_buffer, "qRcmd,", 6) == 0) {
691 int len = strlen(remcom_in_buffer + 6);
693 if ((len % 2) != 0) {
694 strcpy(remcom_out_buffer, "E01");
697 kgdb_hex2mem(remcom_in_buffer + 6,
698 remcom_out_buffer, len);
700 remcom_out_buffer[len++] = 0;
702 kdb_parse(remcom_out_buffer);
703 strcpy(remcom_out_buffer, "OK");
710 /* Handle the 'H' task query packets */
711 static void gdb_cmd_task(struct kgdb_state *ks)
713 struct task_struct *thread;
716 switch (remcom_in_buffer[1]) {
718 ptr = &remcom_in_buffer[2];
719 kgdb_hex2long(&ptr, &ks->threadid);
720 thread = getthread(ks->linux_regs, ks->threadid);
721 if (!thread && ks->threadid > 0) {
722 error_packet(remcom_out_buffer, -EINVAL);
725 kgdb_usethread = thread;
726 ks->kgdb_usethreadid = ks->threadid;
727 strcpy(remcom_out_buffer, "OK");
730 ptr = &remcom_in_buffer[2];
731 kgdb_hex2long(&ptr, &ks->threadid);
733 kgdb_contthread = NULL;
735 thread = getthread(ks->linux_regs, ks->threadid);
736 if (!thread && ks->threadid > 0) {
737 error_packet(remcom_out_buffer, -EINVAL);
740 kgdb_contthread = thread;
742 strcpy(remcom_out_buffer, "OK");
747 /* Handle the 'T' thread query packets */
748 static void gdb_cmd_thread(struct kgdb_state *ks)
750 char *ptr = &remcom_in_buffer[1];
751 struct task_struct *thread;
753 kgdb_hex2long(&ptr, &ks->threadid);
754 thread = getthread(ks->linux_regs, ks->threadid);
756 strcpy(remcom_out_buffer, "OK");
758 error_packet(remcom_out_buffer, -EINVAL);
761 /* Handle the 'z' or 'Z' breakpoint remove or set packets */
762 static void gdb_cmd_break(struct kgdb_state *ks)
765 * Since GDB-5.3, it's been drafted that '0' is a software
766 * breakpoint, '1' is a hardware breakpoint, so let's do that.
768 char *bpt_type = &remcom_in_buffer[1];
769 char *ptr = &remcom_in_buffer[2];
771 unsigned long length;
774 if (arch_kgdb_ops.set_hw_breakpoint && *bpt_type >= '1') {
779 if (*bpt_type != '0' && *bpt_type != '1')
785 * Test if this is a hardware breakpoint, and
788 if (*bpt_type == '1' && !(arch_kgdb_ops.flags & KGDB_HW_BREAKPOINT))
792 if (*(ptr++) != ',') {
793 error_packet(remcom_out_buffer, -EINVAL);
796 if (!kgdb_hex2long(&ptr, &addr)) {
797 error_packet(remcom_out_buffer, -EINVAL);
800 if (*(ptr++) != ',' ||
801 !kgdb_hex2long(&ptr, &length)) {
802 error_packet(remcom_out_buffer, -EINVAL);
806 if (remcom_in_buffer[0] == 'Z' && *bpt_type == '0')
807 error = dbg_set_sw_break(addr);
808 else if (remcom_in_buffer[0] == 'z' && *bpt_type == '0')
809 error = dbg_remove_sw_break(addr);
810 else if (remcom_in_buffer[0] == 'Z')
811 error = arch_kgdb_ops.set_hw_breakpoint(addr,
812 (int)length, *bpt_type - '0');
813 else if (remcom_in_buffer[0] == 'z')
814 error = arch_kgdb_ops.remove_hw_breakpoint(addr,
815 (int) length, *bpt_type - '0');
818 strcpy(remcom_out_buffer, "OK");
820 error_packet(remcom_out_buffer, error);
823 /* Handle the 'C' signal / exception passing packets */
824 static int gdb_cmd_exception_pass(struct kgdb_state *ks)
826 /* C09 == pass exception
827 * C15 == detach kgdb, pass exception
829 if (remcom_in_buffer[1] == '0' && remcom_in_buffer[2] == '9') {
831 ks->pass_exception = 1;
832 remcom_in_buffer[0] = 'c';
834 } else if (remcom_in_buffer[1] == '1' && remcom_in_buffer[2] == '5') {
836 ks->pass_exception = 1;
837 remcom_in_buffer[0] = 'D';
838 dbg_remove_all_break();
843 gdbstub_msg_write("KGDB only knows signal 9 (pass)"
844 " and 15 (pass and disconnect)\n"
845 "Executing a continue without signal passing\n", 0);
846 remcom_in_buffer[0] = 'c';
849 /* Indicate fall through */
854 * This function performs all gdbserial command procesing
856 int gdb_serial_stub(struct kgdb_state *ks)
861 /* Clear the out buffer. */
862 memset(remcom_out_buffer, 0, sizeof(remcom_out_buffer));
864 if (kgdb_connected) {
865 unsigned char thref[8];
868 /* Reply to host that an exception has occurred */
869 ptr = remcom_out_buffer;
871 ptr = pack_hex_byte(ptr, ks->signo);
872 ptr += strlen(strcpy(ptr, "thread:"));
873 int_to_threadref(thref, shadow_pid(current->pid));
874 ptr = pack_threadid(ptr, thref);
876 put_packet(remcom_out_buffer);
879 kgdb_usethread = kgdb_info[ks->cpu].task;
880 ks->kgdb_usethreadid = shadow_pid(kgdb_info[ks->cpu].task->pid);
881 ks->pass_exception = 0;
886 /* Clear the out buffer. */
887 memset(remcom_out_buffer, 0, sizeof(remcom_out_buffer));
889 get_packet(remcom_in_buffer);
891 switch (remcom_in_buffer[0]) {
892 case '?': /* gdbserial status */
895 case 'g': /* return the value of the CPU registers */
898 case 'G': /* set the value of the CPU registers - return OK */
901 case 'm': /* mAA..AA,LLLL Read LLLL bytes at address AA..AA */
904 case 'M': /* MAA..AA,LLLL: Write LLLL bytes at address AA..AA */
905 gdb_cmd_memwrite(ks);
907 case 'X': /* XAA..AA,LLLL: Write LLLL bytes at address AA..AA */
908 gdb_cmd_binwrite(ks);
910 /* kill or detach. KGDB should treat this like a
913 case 'D': /* Debugger detach */
914 case 'k': /* Debugger detach via kill */
915 gdb_cmd_detachkill(ks);
917 case 'R': /* Reboot */
918 if (gdb_cmd_reboot(ks))
921 case 'q': /* query command */
924 case 'H': /* task related */
927 case 'T': /* Query thread status */
930 case 'z': /* Break point remove */
931 case 'Z': /* Break point set */
934 #ifdef CONFIG_KGDB_KDB
935 case '3': /* Escape into back into kdb */
936 if (remcom_in_buffer[1] == '\0') {
937 gdb_cmd_detachkill(ks);
938 return DBG_PASS_EVENT;
941 case 'C': /* Exception passing */
942 tmp = gdb_cmd_exception_pass(ks);
947 /* Fall through on tmp < 0 */
948 case 'c': /* Continue packet */
949 case 's': /* Single step packet */
950 if (kgdb_contthread && kgdb_contthread != current) {
951 /* Can't switch threads in kgdb */
952 error_packet(remcom_out_buffer, -EINVAL);
955 dbg_activate_sw_breakpoints();
956 /* Fall through to default processing */
959 error = kgdb_arch_handle_exception(ks->ex_vector,
966 * Leave cmd processing on error, detach,
967 * kill, continue, or single step.
969 if (error >= 0 || remcom_in_buffer[0] == 'D' ||
970 remcom_in_buffer[0] == 'k') {
977 /* reply to the request */
978 put_packet(remcom_out_buffer);
982 if (ks->pass_exception)
987 int gdbstub_state(struct kgdb_state *ks, char *cmd)
993 error = kgdb_arch_handle_exception(ks->ex_vector,
1002 strcpy(remcom_in_buffer, cmd);
1008 strcpy(remcom_out_buffer, "");
1011 dbg_io_ops->write_char('+');
1012 put_packet(remcom_out_buffer);