1 // SPDX-License-Identifier: GPL-2.0-or-later
6 * Copyright (C) 2004 Amit S. Kale <amitkale@linsyssoft.com>
7 * Copyright (C) 2000-2001 VERITAS Software Corporation.
8 * Copyright (C) 2002 Andi Kleen, SuSE Labs
9 * Copyright (C) 2004 LinSysSoft Technologies Pvt. Ltd.
10 * Copyright (C) 2007 MontaVista Software, Inc.
11 * Copyright (C) 2007-2008 Jason Wessel, Wind River Systems, Inc.
13 /****************************************************************************
14 * Contributor: Lake Stevens Instrument Division$
15 * Written by: Glenn Engel $
16 * Updated by: Amit Kale<akale@veritas.com>
17 * Updated by: Tom Rini <trini@kernel.crashing.org>
18 * Updated by: Jason Wessel <jason.wessel@windriver.com>
19 * Modified for 386 by Jim Kingdon, Cygnus Support.
20 * Origianl kgdb, compatibility with 2.1.xx kernel by
21 * David Grothe <dave@gcom.com>
22 * Integrated into 2.2.5 kernel by Tigran Aivazian <tigran@sco.com>
23 * X86_64 changes from Andi Kleen's patch merged by Jim Houston
25 #include <linux/spinlock.h>
26 #include <linux/kdebug.h>
27 #include <linux/string.h>
28 #include <linux/kernel.h>
29 #include <linux/ptrace.h>
30 #include <linux/sched.h>
31 #include <linux/delay.h>
32 #include <linux/kgdb.h>
33 #include <linux/smp.h>
34 #include <linux/nmi.h>
35 #include <linux/hw_breakpoint.h>
36 #include <linux/uaccess.h>
37 #include <linux/memory.h>
39 #include <asm/text-patching.h>
40 #include <asm/debugreg.h>
41 #include <asm/apicdef.h>
44 #include <asm/switch_to.h>
46 struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] =
49 { "ax", 4, offsetof(struct pt_regs, ax) },
50 { "cx", 4, offsetof(struct pt_regs, cx) },
51 { "dx", 4, offsetof(struct pt_regs, dx) },
52 { "bx", 4, offsetof(struct pt_regs, bx) },
53 { "sp", 4, offsetof(struct pt_regs, sp) },
54 { "bp", 4, offsetof(struct pt_regs, bp) },
55 { "si", 4, offsetof(struct pt_regs, si) },
56 { "di", 4, offsetof(struct pt_regs, di) },
57 { "ip", 4, offsetof(struct pt_regs, ip) },
58 { "flags", 4, offsetof(struct pt_regs, flags) },
59 { "cs", 4, offsetof(struct pt_regs, cs) },
60 { "ss", 4, offsetof(struct pt_regs, ss) },
61 { "ds", 4, offsetof(struct pt_regs, ds) },
62 { "es", 4, offsetof(struct pt_regs, es) },
64 { "ax", 8, offsetof(struct pt_regs, ax) },
65 { "bx", 8, offsetof(struct pt_regs, bx) },
66 { "cx", 8, offsetof(struct pt_regs, cx) },
67 { "dx", 8, offsetof(struct pt_regs, dx) },
68 { "si", 8, offsetof(struct pt_regs, si) },
69 { "di", 8, offsetof(struct pt_regs, di) },
70 { "bp", 8, offsetof(struct pt_regs, bp) },
71 { "sp", 8, offsetof(struct pt_regs, sp) },
72 { "r8", 8, offsetof(struct pt_regs, r8) },
73 { "r9", 8, offsetof(struct pt_regs, r9) },
74 { "r10", 8, offsetof(struct pt_regs, r10) },
75 { "r11", 8, offsetof(struct pt_regs, r11) },
76 { "r12", 8, offsetof(struct pt_regs, r12) },
77 { "r13", 8, offsetof(struct pt_regs, r13) },
78 { "r14", 8, offsetof(struct pt_regs, r14) },
79 { "r15", 8, offsetof(struct pt_regs, r15) },
80 { "ip", 8, offsetof(struct pt_regs, ip) },
81 { "flags", 4, offsetof(struct pt_regs, flags) },
82 { "cs", 4, offsetof(struct pt_regs, cs) },
83 { "ss", 4, offsetof(struct pt_regs, ss) },
91 int dbg_set_reg(int regno, void *mem, struct pt_regs *regs)
95 regno == GDB_SS || regno == GDB_FS || regno == GDB_GS ||
97 regno == GDB_SP || regno == GDB_ORIG_AX)
100 if (dbg_reg_def[regno].offset != -1)
101 memcpy((void *)regs + dbg_reg_def[regno].offset, mem,
102 dbg_reg_def[regno].size);
106 char *dbg_get_reg(int regno, void *mem, struct pt_regs *regs)
108 if (regno == GDB_ORIG_AX) {
109 memcpy(mem, ®s->orig_ax, sizeof(regs->orig_ax));
112 if (regno >= DBG_MAX_REG_NUM || regno < 0)
115 if (dbg_reg_def[regno].offset != -1)
116 memcpy(mem, (void *)regs + dbg_reg_def[regno].offset,
117 dbg_reg_def[regno].size);
122 if (!user_mode(regs))
123 *(unsigned long *)mem = __KERNEL_DS;
126 if (!user_mode(regs))
127 *(unsigned long *)mem = kernel_stack_pointer(regs);
131 *(unsigned long *)mem = 0xFFFF;
135 return dbg_reg_def[regno].name;
139 * sleeping_thread_to_gdb_regs - Convert ptrace regs to GDB regs
140 * @gdb_regs: A pointer to hold the registers in the order GDB wants.
141 * @p: The &struct task_struct of the desired process.
143 * Convert the register values of the sleeping process in @p to
144 * the format that GDB expects.
145 * This function is called when kgdb does not have access to the
146 * &struct pt_regs and therefore it should fill the gdb registers
147 * @gdb_regs with what has been saved in &struct thread_struct
148 * thread field during switch_to.
150 void sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *p)
152 #ifndef CONFIG_X86_32
153 u32 *gdb_regs32 = (u32 *)gdb_regs;
155 gdb_regs[GDB_AX] = 0;
156 gdb_regs[GDB_BX] = 0;
157 gdb_regs[GDB_CX] = 0;
158 gdb_regs[GDB_DX] = 0;
159 gdb_regs[GDB_SI] = 0;
160 gdb_regs[GDB_DI] = 0;
161 gdb_regs[GDB_BP] = ((struct inactive_task_frame *)p->thread.sp)->bp;
163 gdb_regs[GDB_DS] = __KERNEL_DS;
164 gdb_regs[GDB_ES] = __KERNEL_DS;
165 gdb_regs[GDB_PS] = 0;
166 gdb_regs[GDB_CS] = __KERNEL_CS;
167 gdb_regs[GDB_SS] = __KERNEL_DS;
168 gdb_regs[GDB_FS] = 0xFFFF;
169 gdb_regs[GDB_GS] = 0xFFFF;
171 gdb_regs32[GDB_PS] = 0;
172 gdb_regs32[GDB_CS] = __KERNEL_CS;
173 gdb_regs32[GDB_SS] = __KERNEL_DS;
174 gdb_regs[GDB_R8] = 0;
175 gdb_regs[GDB_R9] = 0;
176 gdb_regs[GDB_R10] = 0;
177 gdb_regs[GDB_R11] = 0;
178 gdb_regs[GDB_R12] = 0;
179 gdb_regs[GDB_R13] = 0;
180 gdb_regs[GDB_R14] = 0;
181 gdb_regs[GDB_R15] = 0;
183 gdb_regs[GDB_PC] = 0;
184 gdb_regs[GDB_SP] = p->thread.sp;
187 static struct hw_breakpoint {
192 struct perf_event * __percpu *pev;
193 } breakinfo[HBP_NUM];
195 static unsigned long early_dr7;
197 static void kgdb_correct_hw_break(void)
201 for (breakno = 0; breakno < HBP_NUM; breakno++) {
202 struct perf_event *bp;
203 struct arch_hw_breakpoint *info;
205 int cpu = raw_smp_processor_id();
206 if (!breakinfo[breakno].enabled)
209 set_debugreg(breakinfo[breakno].addr, breakno);
210 early_dr7 |= encode_dr7(breakno,
211 breakinfo[breakno].len,
212 breakinfo[breakno].type);
213 set_debugreg(early_dr7, 7);
216 bp = *per_cpu_ptr(breakinfo[breakno].pev, cpu);
217 info = counter_arch_bp(bp);
218 if (bp->attr.disabled != 1)
220 bp->attr.bp_addr = breakinfo[breakno].addr;
221 bp->attr.bp_len = breakinfo[breakno].len;
222 bp->attr.bp_type = breakinfo[breakno].type;
223 info->address = breakinfo[breakno].addr;
224 info->len = breakinfo[breakno].len;
225 info->type = breakinfo[breakno].type;
226 val = arch_install_hw_breakpoint(bp);
228 bp->attr.disabled = 0;
231 hw_breakpoint_restore();
234 static int hw_break_reserve_slot(int breakno)
238 struct perf_event **pevent;
243 for_each_online_cpu(cpu) {
245 pevent = per_cpu_ptr(breakinfo[breakno].pev, cpu);
246 if (dbg_reserve_bp_slot(*pevent))
253 for_each_online_cpu(cpu) {
257 pevent = per_cpu_ptr(breakinfo[breakno].pev, cpu);
258 dbg_release_bp_slot(*pevent);
263 static int hw_break_release_slot(int breakno)
265 struct perf_event **pevent;
271 for_each_online_cpu(cpu) {
272 pevent = per_cpu_ptr(breakinfo[breakno].pev, cpu);
273 if (dbg_release_bp_slot(*pevent))
275 * The debugger is responsible for handing the retry on
284 kgdb_remove_hw_break(unsigned long addr, int len, enum kgdb_bptype bptype)
288 for (i = 0; i < HBP_NUM; i++)
289 if (breakinfo[i].addr == addr && breakinfo[i].enabled)
294 if (hw_break_release_slot(i)) {
295 printk(KERN_ERR "Cannot remove hw breakpoint at %lx\n", addr);
298 breakinfo[i].enabled = 0;
303 static void kgdb_remove_all_hw_break(void)
306 int cpu = raw_smp_processor_id();
307 struct perf_event *bp;
309 for (i = 0; i < HBP_NUM; i++) {
310 if (!breakinfo[i].enabled)
312 bp = *per_cpu_ptr(breakinfo[i].pev, cpu);
313 if (!bp->attr.disabled) {
314 arch_uninstall_hw_breakpoint(bp);
315 bp->attr.disabled = 1;
319 early_dr7 &= ~encode_dr7(i, breakinfo[i].len,
321 else if (hw_break_release_slot(i))
322 printk(KERN_ERR "KGDB: hw bpt remove failed %lx\n",
324 breakinfo[i].enabled = 0;
329 kgdb_set_hw_break(unsigned long addr, int len, enum kgdb_bptype bptype)
333 for (i = 0; i < HBP_NUM; i++)
334 if (!breakinfo[i].enabled)
340 case BP_HARDWARE_BREAKPOINT:
342 breakinfo[i].type = X86_BREAKPOINT_EXECUTE;
344 case BP_WRITE_WATCHPOINT:
345 breakinfo[i].type = X86_BREAKPOINT_WRITE;
347 case BP_ACCESS_WATCHPOINT:
348 breakinfo[i].type = X86_BREAKPOINT_RW;
355 breakinfo[i].len = X86_BREAKPOINT_LEN_1;
358 breakinfo[i].len = X86_BREAKPOINT_LEN_2;
361 breakinfo[i].len = X86_BREAKPOINT_LEN_4;
365 breakinfo[i].len = X86_BREAKPOINT_LEN_8;
371 breakinfo[i].addr = addr;
372 if (hw_break_reserve_slot(i)) {
373 breakinfo[i].addr = 0;
376 breakinfo[i].enabled = 1;
382 * kgdb_disable_hw_debug - Disable hardware debugging while we in kgdb.
383 * @regs: Current &struct pt_regs.
385 * This function will be called if the particular architecture must
386 * disable hardware debugging while it is processing gdb packets or
387 * handling exception.
389 static void kgdb_disable_hw_debug(struct pt_regs *regs)
392 int cpu = raw_smp_processor_id();
393 struct perf_event *bp;
395 /* Disable hardware debugging while we are in kgdb: */
396 set_debugreg(0UL, 7);
397 for (i = 0; i < HBP_NUM; i++) {
398 if (!breakinfo[i].enabled)
401 early_dr7 &= ~encode_dr7(i, breakinfo[i].len,
405 bp = *per_cpu_ptr(breakinfo[i].pev, cpu);
406 if (bp->attr.disabled == 1)
408 arch_uninstall_hw_breakpoint(bp);
409 bp->attr.disabled = 1;
415 * kgdb_roundup_cpus - Get other CPUs into a holding pattern
417 * On SMP systems, we need to get the attention of the other CPUs
418 * and get them be in a known state. This should do what is needed
419 * to get the other CPUs to call kgdb_wait(). Note that on some arches,
420 * the NMI approach is not used for rounding up all the CPUs. For example,
421 * in case of MIPS, smp_call_function() is used to roundup CPUs.
423 * On non-SMP systems, this is not called.
425 void kgdb_roundup_cpus(void)
427 apic->send_IPI_allbutself(APIC_DM_NMI);
432 * kgdb_arch_handle_exception - Handle architecture specific GDB packets.
433 * @e_vector: The error vector of the exception that happened.
434 * @signo: The signal number of the exception that happened.
435 * @err_code: The error code of the exception that happened.
436 * @remcomInBuffer: The buffer of the packet we have read.
437 * @remcomOutBuffer: The buffer of %BUFMAX bytes to write a packet into.
438 * @linux_regs: The &struct pt_regs of the current process.
440 * This function MUST handle the 'c' and 's' command packets,
441 * as well packets to set / remove a hardware breakpoint, if used.
442 * If there are additional packets which the hardware needs to handle,
443 * they are handled here. The code should return -1 if it wants to
444 * process more packets, and a %0 or %1 if it wants to exit from the
447 int kgdb_arch_handle_exception(int e_vector, int signo, int err_code,
448 char *remcomInBuffer, char *remcomOutBuffer,
449 struct pt_regs *linux_regs)
454 switch (remcomInBuffer[0]) {
457 /* try to read optional parameter, pc unchanged if no parm */
458 ptr = &remcomInBuffer[1];
459 if (kgdb_hex2long(&ptr, &addr))
460 linux_regs->ip = addr;
464 /* clear the trace bit */
465 linux_regs->flags &= ~X86_EFLAGS_TF;
466 atomic_set(&kgdb_cpu_doing_single_step, -1);
468 /* set the trace bit if we're stepping */
469 if (remcomInBuffer[0] == 's') {
470 linux_regs->flags |= X86_EFLAGS_TF;
471 atomic_set(&kgdb_cpu_doing_single_step,
472 raw_smp_processor_id());
478 /* this means that we do not want to exit from the handler: */
483 single_step_cont(struct pt_regs *regs, struct die_args *args)
486 * Single step exception from kernel space to user space so
487 * eat the exception and continue the process:
489 printk(KERN_ERR "KGDB: trap/step from kernel to user space, "
491 kgdb_arch_handle_exception(args->trapnr, args->signr,
492 args->err, "c", "", regs);
494 * Reset the BS bit in dr6 (pointed by args->err) to
495 * denote completion of processing
497 (*(unsigned long *)ERR_PTR(args->err)) &= ~DR_STEP;
502 static DECLARE_BITMAP(was_in_debug_nmi, NR_CPUS);
504 static int kgdb_nmi_handler(unsigned int cmd, struct pt_regs *regs)
510 if (atomic_read(&kgdb_active) != -1) {
511 /* KGDB CPU roundup */
512 cpu = raw_smp_processor_id();
513 kgdb_nmicallback(cpu, regs);
514 set_bit(cpu, was_in_debug_nmi);
515 touch_nmi_watchdog();
522 cpu = raw_smp_processor_id();
524 if (__test_and_clear_bit(cpu, was_in_debug_nmi))
535 static int __kgdb_notify(struct die_args *args, unsigned long cmd)
537 struct pt_regs *regs = args->regs;
541 if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
543 return single_step_cont(regs, args);
545 } else if (test_thread_flag(TIF_SINGLESTEP))
546 /* This means a user thread is single stepping
547 * a system call which should be ignored
556 if (kgdb_handle_exception(args->trapnr, args->signr, cmd, regs))
559 /* Must touch watchdog before return to normal operation */
560 touch_nmi_watchdog();
564 int kgdb_ll_trap(int cmd, const char *str,
565 struct pt_regs *regs, long err, int trap, int sig)
567 struct die_args args = {
576 if (!kgdb_io_module_registered)
579 return __kgdb_notify(&args, cmd);
583 kgdb_notify(struct notifier_block *self, unsigned long cmd, void *ptr)
588 local_irq_save(flags);
589 ret = __kgdb_notify(ptr, cmd);
590 local_irq_restore(flags);
595 static struct notifier_block kgdb_notifier = {
596 .notifier_call = kgdb_notify,
600 * kgdb_arch_init - Perform any architecture specific initialization.
602 * This function will handle the initialization of any architecture
603 * specific callbacks.
605 int kgdb_arch_init(void)
609 retval = register_die_notifier(&kgdb_notifier);
613 retval = register_nmi_handler(NMI_LOCAL, kgdb_nmi_handler,
618 retval = register_nmi_handler(NMI_UNKNOWN, kgdb_nmi_handler,
627 unregister_nmi_handler(NMI_LOCAL, "kgdb");
629 unregister_die_notifier(&kgdb_notifier);
634 static void kgdb_hw_overflow_handler(struct perf_event *event,
635 struct perf_sample_data *data, struct pt_regs *regs)
637 struct task_struct *tsk = current;
640 for (i = 0; i < 4; i++)
641 if (breakinfo[i].enabled)
642 tsk->thread.debugreg6 |= (DR_TRAP0 << i);
645 void kgdb_arch_late(void)
648 struct perf_event_attr attr;
649 struct perf_event **pevent;
652 * Pre-allocate the hw breakpoint structions in the non-atomic
653 * portion of kgdb because this operation requires mutexs to
656 hw_breakpoint_init(&attr);
657 attr.bp_addr = (unsigned long)kgdb_arch_init;
658 attr.bp_len = HW_BREAKPOINT_LEN_1;
659 attr.bp_type = HW_BREAKPOINT_W;
661 for (i = 0; i < HBP_NUM; i++) {
662 if (breakinfo[i].pev)
664 breakinfo[i].pev = register_wide_hw_breakpoint(&attr, NULL, NULL);
665 if (IS_ERR((void * __force)breakinfo[i].pev)) {
666 printk(KERN_ERR "kgdb: Could not allocate hw"
667 "breakpoints\nDisabling the kernel debugger\n");
668 breakinfo[i].pev = NULL;
672 for_each_online_cpu(cpu) {
673 pevent = per_cpu_ptr(breakinfo[i].pev, cpu);
674 pevent[0]->hw.sample_period = 1;
675 pevent[0]->overflow_handler = kgdb_hw_overflow_handler;
676 if (pevent[0]->destroy != NULL) {
677 pevent[0]->destroy = NULL;
678 release_bp_slot(*pevent);
685 * kgdb_arch_exit - Perform any architecture specific uninitalization.
687 * This function will handle the uninitalization of any architecture
688 * specific callbacks, for dynamic registration and unregistration.
690 void kgdb_arch_exit(void)
693 for (i = 0; i < 4; i++) {
694 if (breakinfo[i].pev) {
695 unregister_wide_hw_breakpoint(breakinfo[i].pev);
696 breakinfo[i].pev = NULL;
699 unregister_nmi_handler(NMI_UNKNOWN, "kgdb");
700 unregister_nmi_handler(NMI_LOCAL, "kgdb");
701 unregister_die_notifier(&kgdb_notifier);
706 * kgdb_skipexception - Bail out of KGDB when we've been triggered.
707 * @exception: Exception vector number
708 * @regs: Current &struct pt_regs.
710 * On some architectures we need to skip a breakpoint exception when
711 * it occurs after a breakpoint has been removed.
713 * Skip an int3 exception when it occurs after a breakpoint has been
714 * removed. Backtrack eip by 1 since the int3 would have caused it to
717 int kgdb_skipexception(int exception, struct pt_regs *regs)
719 if (exception == 3 && kgdb_isremovedbreak(regs->ip - 1)) {
726 unsigned long kgdb_arch_pc(int exception, struct pt_regs *regs)
729 return instruction_pointer(regs) - 1;
730 return instruction_pointer(regs);
733 void kgdb_arch_set_pc(struct pt_regs *regs, unsigned long ip)
738 int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
742 bpt->type = BP_BREAKPOINT;
743 err = probe_kernel_read(bpt->saved_instr, (char *)bpt->bpt_addr,
747 err = probe_kernel_write((char *)bpt->bpt_addr,
748 arch_kgdb_ops.gdb_bpt_instr, BREAK_INSTR_SIZE);
752 * It is safe to call text_poke_kgdb() because normal kernel execution
753 * is stopped on all cores, so long as the text_mutex is not locked.
755 if (mutex_is_locked(&text_mutex))
757 text_poke_kgdb((void *)bpt->bpt_addr, arch_kgdb_ops.gdb_bpt_instr,
759 bpt->type = BP_POKE_BREAKPOINT;
764 int kgdb_arch_remove_breakpoint(struct kgdb_bkpt *bpt)
766 if (bpt->type != BP_POKE_BREAKPOINT)
769 * It is safe to call text_poke_kgdb() because normal kernel execution
770 * is stopped on all cores, so long as the text_mutex is not locked.
772 if (mutex_is_locked(&text_mutex))
774 text_poke_kgdb((void *)bpt->bpt_addr, bpt->saved_instr,
779 return probe_kernel_write((char *)bpt->bpt_addr,
780 (char *)bpt->saved_instr, BREAK_INSTR_SIZE);
783 const struct kgdb_arch arch_kgdb_ops = {
784 /* Breakpoint instruction: */
785 .gdb_bpt_instr = { 0xcc },
786 .flags = KGDB_HW_BREAKPOINT,
787 .set_hw_breakpoint = kgdb_set_hw_break,
788 .remove_hw_breakpoint = kgdb_remove_hw_break,
789 .disable_hw_break = kgdb_disable_hw_debug,
790 .remove_all_hw_break = kgdb_remove_all_hw_break,
791 .correct_hw_break = kgdb_correct_hw_break,