2 * arch/mips/kernel/gdb-stub.c
4 * Originally written by Glenn Engel, Lake Stevens Instrument Division
6 * Contributed by HP Systems
8 * Modified for SPARC by Stu Grossman, Cygnus Support.
10 * Modified for Linux/MIPS (and MIPS in general) by Andreas Busse
11 * Send complaints, suggestions etc. to <andy@waldorf-gmbh.de>
13 * Copyright (C) 1995 Andreas Busse
15 * Copyright (C) 2003 MontaVista Software Inc.
16 * Author: Jun Sun, jsun@mvista.com or jsun@junsun.net
20 * To enable debugger support, two things need to happen. One, a
21 * call to set_debug_traps() is necessary in order to allow any breakpoints
22 * or error conditions to be properly intercepted and reported to gdb.
23 * Two, a breakpoint needs to be generated to begin communication. This
24 * is most easily accomplished by a call to breakpoint(). Breakpoint()
25 * simulates a breakpoint by executing a BREAK instruction.
28 * The following gdb commands are supported:
30 * command function Return value
32 * g return the value of the CPU registers hex data or ENN
33 * G set the value of the CPU registers OK or ENN
35 * mAA..AA,LLLL Read LLLL bytes at address AA..AA hex data or ENN
36 * MAA..AA,LLLL: Write LLLL bytes at address AA.AA OK or ENN
38 * c Resume at current address SNN ( signal NN)
39 * cAA..AA Continue at address AA..AA SNN
41 * s Step one instruction SNN
42 * sAA..AA Step one instruction from AA..AA SNN
46 * ? What was the last sigval ? SNN (signal NN)
48 * bBB..BB Set baud rate to BB..BB OK or BNN, then sets
51 * All commands and responses are sent with a packet which includes a
52 * checksum. A packet consists of
54 * $<packet info>#<checksum>.
57 * <packet info> :: <characters representing the command or response>
58 * <checksum> :: < two hex digits computed as modulo 256 sum of <packetinfo>>
60 * When a packet is received, it is first acknowledged with either '+' or '-'.
61 * '+' indicates a successful transfer. '-' indicates a failed transfer.
66 * $m0,10#2a +$00010203040506070809101112131415#42
73 * For reference -- the following are the steps that one
74 * company took (RidgeRun Inc) to get remote gdb debugging
75 * going. In this scenario the host machine was a PC and the
76 * target platform was a Galileo EVB64120A MIPS evaluation
80 * First download gdb-5.0.tar.gz from the internet.
81 * and then build/install the package.
84 * $ tar zxf gdb-5.0.tar.gz
86 * $ ./configure --target=mips-linux-elf
89 * $ which mips-linux-elf-gdb
90 * /usr/local/bin/mips-linux-elf-gdb
93 * Configure linux for remote debugging and build it.
97 * $ make menuconfig <go to "Kernel Hacking" and turn on remote debugging>
101 * Download the kernel to the remote target and start
102 * the kernel running. It will promptly halt and wait
103 * for the host gdb session to connect. It does this
104 * since the "Kernel Hacking" option has defined
105 * CONFIG_KGDB which in turn enables your calls
111 * Start the gdb session on the host.
114 * $ mips-linux-elf-gdb vmlinux
115 * (gdb) set remotebaud 115200
116 * (gdb) target remote /dev/ttyS1
117 * ...at this point you are connected to
118 * the remote target and can use gdb
119 * in the normal fasion. Setting
120 * breakpoints, single stepping,
121 * printing variables, etc.
123 #include <linux/config.h>
124 #include <linux/string.h>
125 #include <linux/kernel.h>
126 #include <linux/signal.h>
127 #include <linux/sched.h>
128 #include <linux/mm.h>
129 #include <linux/console.h>
130 #include <linux/init.h>
131 #include <linux/smp.h>
132 #include <linux/spinlock.h>
133 #include <linux/slab.h>
134 #include <linux/reboot.h>
137 #include <asm/cacheflush.h>
138 #include <asm/mipsregs.h>
139 #include <asm/pgtable.h>
140 #include <asm/system.h>
141 #include <asm/gdb-stub.h>
142 #include <asm/inst.h>
145 * external low-level support routines
148 extern int putDebugChar(char c); /* write a single character */
149 extern char getDebugChar(void); /* read and return a single char */
150 extern void trap_low(void);
153 * breakpoint and test functions
155 extern void breakpoint(void);
156 extern void breakinst(void);
157 extern void async_breakpoint(void);
158 extern void async_breakinst(void);
159 extern void adel(void);
165 static void getpacket(char *buffer);
166 static void putpacket(char *buffer);
167 static int computeSignal(int tt);
168 static int hex(unsigned char ch);
169 static int hexToInt(char **ptr, int *intValue);
170 static int hexToLong(char **ptr, long *longValue);
171 static unsigned char *mem2hex(char *mem, char *buf, int count, int may_fault);
172 void handle_exception(struct gdb_regs *regs);
177 * spin locks for smp case
179 static DEFINE_SPINLOCK(kgdb_lock);
180 static raw_spinlock_t kgdb_cpulock[NR_CPUS] = {
181 [0 ... NR_CPUS-1] = __RAW_SPIN_LOCK_UNLOCKED;
185 * BUFMAX defines the maximum number of characters in inbound/outbound buffers
186 * at least NUMREGBYTES*2 are needed for register packets
190 static char input_buffer[BUFMAX];
191 static char output_buffer[BUFMAX];
192 static int initialized; /* !0 means we've been initialized */
193 static int kgdb_started;
194 static const char hexchars[]="0123456789abcdef";
196 /* Used to prevent crashes in memory access. Note that they'll crash anyway if
197 we haven't set up fault handlers yet... */
198 int kgdb_read_byte(unsigned char *address, unsigned char *dest);
199 int kgdb_write_byte(unsigned char val, unsigned char *dest);
202 * Convert ch from a hex digit to an int
204 static int hex(unsigned char ch)
206 if (ch >= 'a' && ch <= 'f')
208 if (ch >= '0' && ch <= '9')
210 if (ch >= 'A' && ch <= 'F')
216 * scan for the sequence $<data>#<checksum>
218 static void getpacket(char *buffer)
220 unsigned char checksum;
221 unsigned char xmitcsum;
228 * wait around for the start character,
229 * ignore all other characters
231 while ((ch = (getDebugChar() & 0x7f)) != '$') ;
238 * now, read until a # or end of buffer is found
240 while (count < BUFMAX) {
244 checksum = checksum + ch;
255 xmitcsum = hex(getDebugChar() & 0x7f) << 4;
256 xmitcsum |= hex(getDebugChar() & 0x7f);
258 if (checksum != xmitcsum)
259 putDebugChar('-'); /* failed checksum */
261 putDebugChar('+'); /* successful transfer */
264 * if a sequence char is present,
265 * reply the sequence ID
267 if (buffer[2] == ':') {
268 putDebugChar(buffer[0]);
269 putDebugChar(buffer[1]);
272 * remove sequence chars from buffer
274 count = strlen(buffer);
275 for (i=3; i <= count; i++)
276 buffer[i-3] = buffer[i];
281 while (checksum != xmitcsum);
285 * send the packet in buffer.
287 static void putpacket(char *buffer)
289 unsigned char checksum;
294 * $<packet info>#<checksum>.
302 while ((ch = buffer[count]) != 0) {
303 if (!(putDebugChar(ch)))
310 putDebugChar(hexchars[checksum >> 4]);
311 putDebugChar(hexchars[checksum & 0xf]);
314 while ((getDebugChar() & 0x7f) != '+');
319 * Convert the memory pointed to by mem into hex, placing result in buf.
320 * Return a pointer to the last char put in buf (null), in case of mem fault,
322 * may_fault is non-zero if we are reading from arbitrary memory, but is currently
325 static unsigned char *mem2hex(char *mem, char *buf, int count, int may_fault)
329 while (count-- > 0) {
330 if (kgdb_read_byte(mem++, &ch) != 0)
332 *buf++ = hexchars[ch >> 4];
333 *buf++ = hexchars[ch & 0xf];
342 * convert the hex array pointed to by buf into binary to be placed in mem
343 * return a pointer to the character AFTER the last byte written
344 * may_fault is non-zero if we are reading from arbitrary memory, but is currently
347 static char *hex2mem(char *buf, char *mem, int count, int binary, int may_fault)
352 for (i=0; i<count; i++)
360 ch = hex(*buf++) << 4;
363 if (kgdb_write_byte(ch, mem++) != 0)
371 * This table contains the mapping between SPARC hardware trap types, and
372 * signals, which are primarily what GDB understands. It also indicates
373 * which hardware traps we need to commandeer when initializing the stub.
375 static struct hard_trap_info {
376 unsigned char tt; /* Trap type code for MIPS R3xxx and R4xxx */
377 unsigned char signo; /* Signal that we map this trap into */
378 } hard_trap_info[] = {
379 { 6, SIGBUS }, /* instruction bus error */
380 { 7, SIGBUS }, /* data bus error */
381 { 9, SIGTRAP }, /* break */
382 { 10, SIGILL }, /* reserved instruction */
383 /* { 11, SIGILL }, */ /* CPU unusable */
384 { 12, SIGFPE }, /* overflow */
385 { 13, SIGTRAP }, /* trap */
386 { 14, SIGSEGV }, /* virtual instruction cache coherency */
387 { 15, SIGFPE }, /* floating point exception */
388 { 23, SIGSEGV }, /* watch */
389 { 31, SIGSEGV }, /* virtual data cache coherency */
390 { 0, 0} /* Must be last */
393 /* Save the normal trap handlers for user-mode traps. */
394 void *saved_vectors[32];
397 * Set up exception handlers for tracing and breakpoints
399 void set_debug_traps(void)
401 struct hard_trap_info *ht;
405 local_irq_save(flags);
406 for (ht = hard_trap_info; ht->tt && ht->signo; ht++)
407 saved_vectors[ht->tt] = set_except_vector(ht->tt, trap_low);
409 putDebugChar('+'); /* 'hello world' */
411 * In case GDB is started before us, ack any packets
412 * (presumably "$?#xx") sitting there.
414 while((c = getDebugChar()) != '$');
415 while((c = getDebugChar()) != '#');
416 c = getDebugChar(); /* eat first csum byte */
417 c = getDebugChar(); /* eat second csum byte */
418 putDebugChar('+'); /* ack it */
421 local_irq_restore(flags);
424 void restore_debug_traps(void)
426 struct hard_trap_info *ht;
429 local_irq_save(flags);
430 for (ht = hard_trap_info; ht->tt && ht->signo; ht++)
431 set_except_vector(ht->tt, saved_vectors[ht->tt]);
432 local_irq_restore(flags);
436 * Convert the MIPS hardware trap type code to a Unix signal number.
438 static int computeSignal(int tt)
440 struct hard_trap_info *ht;
442 for (ht = hard_trap_info; ht->tt && ht->signo; ht++)
446 return SIGHUP; /* default for things we don't know about */
450 * While we find nice hex chars, build an int.
451 * Return number of chars processed.
453 static int hexToInt(char **ptr, int *intValue)
461 hexValue = hex(**ptr);
465 *intValue = (*intValue << 4) | hexValue;
474 static int hexToLong(char **ptr, long *longValue)
482 hexValue = hex(**ptr);
486 *longValue = (*longValue << 4) | hexValue;
498 * Print registers (on target console)
499 * Used only to debug the stub...
501 void show_gdbregs(struct gdb_regs * regs)
504 * Saved main processor registers
506 printk("$0 : %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
507 regs->reg0, regs->reg1, regs->reg2, regs->reg3,
508 regs->reg4, regs->reg5, regs->reg6, regs->reg7);
509 printk("$8 : %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
510 regs->reg8, regs->reg9, regs->reg10, regs->reg11,
511 regs->reg12, regs->reg13, regs->reg14, regs->reg15);
512 printk("$16: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
513 regs->reg16, regs->reg17, regs->reg18, regs->reg19,
514 regs->reg20, regs->reg21, regs->reg22, regs->reg23);
515 printk("$24: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
516 regs->reg24, regs->reg25, regs->reg26, regs->reg27,
517 regs->reg28, regs->reg29, regs->reg30, regs->reg31);
520 * Saved cp0 registers
522 printk("epc : %08lx\nStatus: %08lx\nCause : %08lx\n",
523 regs->cp0_epc, regs->cp0_status, regs->cp0_cause);
525 #endif /* dead code */
528 * We single-step by setting breakpoints. When an exception
529 * is handled, we need to restore the instructions hoisted
530 * when the breakpoints were set.
532 * This is where we save the original instructions.
534 static struct gdb_bp_save {
539 #define BP 0x0000000d /* break opcode */
542 * Set breakpoint instructions for single stepping.
544 static void single_step(struct gdb_regs *regs)
546 union mips_instruction insn;
548 int is_branch, is_cond, i;
550 targ = regs->cp0_epc;
551 insn.word = *(unsigned int *)targ;
552 is_branch = is_cond = 0;
554 switch (insn.i_format.opcode) {
556 * jr and jalr are in r_format format.
559 switch (insn.r_format.func) {
562 targ = *(®s->reg0 + insn.r_format.rs);
569 * This group contains:
570 * bltz_op, bgez_op, bltzl_op, bgezl_op,
571 * bltzal_op, bgezal_op, bltzall_op, bgezall_op.
574 is_branch = is_cond = 1;
575 targ += 4 + (insn.i_format.simmediate << 2);
579 * These are unconditional and in j_format.
587 targ |= (insn.j_format.target << 2);
591 * These are conditional.
605 is_branch = is_cond = 1;
606 targ += 4 + (insn.i_format.simmediate << 2);
612 if (is_cond && targ != (regs->cp0_epc + 8)) {
613 step_bp[i].addr = regs->cp0_epc + 8;
614 step_bp[i++].val = *(unsigned *)(regs->cp0_epc + 8);
615 *(unsigned *)(regs->cp0_epc + 8) = BP;
617 step_bp[i].addr = targ;
618 step_bp[i].val = *(unsigned *)targ;
619 *(unsigned *)targ = BP;
621 step_bp[0].addr = regs->cp0_epc + 4;
622 step_bp[0].val = *(unsigned *)(regs->cp0_epc + 4);
623 *(unsigned *)(regs->cp0_epc + 4) = BP;
628 * If asynchronously interrupted by gdb, then we need to set a breakpoint
629 * at the interrupted instruction so that we wind up stopped with a
630 * reasonable stack frame.
632 static struct gdb_bp_save async_bp;
635 * Swap the interrupted EPC with our asynchronous breakpoint routine.
636 * This is safer than stuffing the breakpoint in-place, since no cache
637 * flushes (or resulting smp_call_functions) are required. The
638 * assumption is that only one CPU will be handling asynchronous bp's,
639 * and only one can be active at a time.
641 extern spinlock_t smp_call_lock;
643 void set_async_breakpoint(unsigned long *epc)
645 /* skip breaking into userland */
646 if ((*epc & 0x80000000) == 0)
650 /* avoid deadlock if someone is make IPC */
651 if (spin_is_locked(&smp_call_lock))
655 async_bp.addr = *epc;
656 *epc = (unsigned long)async_breakpoint;
659 static void kgdb_wait(void *arg)
662 int cpu = smp_processor_id();
664 local_irq_save(flags);
666 __raw_spin_lock(&kgdb_cpulock[cpu]);
667 __raw_spin_unlock(&kgdb_cpulock[cpu]);
669 local_irq_restore(flags);
674 * This function does all command processing for interfacing to gdb. It
675 * returns 1 if you should skip the instruction at the trap address, 0
678 void handle_exception (struct gdb_regs *regs)
680 int trap; /* Trap type */
685 unsigned long *stack;
692 * acquire the big kgdb spinlock
694 if (!spin_trylock(&kgdb_lock)) {
696 * some other CPU has the lock, we should go back to
697 * receive the gdb_wait IPC
703 * If we're in async_breakpoint(), restore the real EPC from
706 if (regs->cp0_epc == (unsigned long)async_breakinst) {
707 regs->cp0_epc = async_bp.addr;
712 * acquire the CPU spinlocks
714 for (i = num_online_cpus()-1; i >= 0; i--)
715 if (__raw_spin_trylock(&kgdb_cpulock[i]) == 0)
716 panic("kgdb: couldn't get cpulock %d\n", i);
719 * force other cpus to enter kgdb
721 smp_call_function(kgdb_wait, NULL, 0, 0);
724 * If we're in breakpoint() increment the PC
726 trap = (regs->cp0_cause & 0x7c) >> 2;
727 if (trap == 9 && regs->cp0_epc == (unsigned long)breakinst)
731 * If we were single_stepping, restore the opcodes hoisted
732 * for the breakpoint[s].
734 if (step_bp[0].addr) {
735 *(unsigned *)step_bp[0].addr = step_bp[0].val;
738 if (step_bp[1].addr) {
739 *(unsigned *)step_bp[1].addr = step_bp[1].val;
744 stack = (long *)regs->reg29; /* stack ptr */
745 sigval = computeSignal(trap);
748 * reply to host that an exception has occurred
753 * Send trap type (converted to signal)
756 *ptr++ = hexchars[sigval >> 4];
757 *ptr++ = hexchars[sigval & 0xf];
762 *ptr++ = hexchars[REG_EPC >> 4];
763 *ptr++ = hexchars[REG_EPC & 0xf];
765 ptr = mem2hex((char *)®s->cp0_epc, ptr, sizeof(long), 0);
771 *ptr++ = hexchars[REG_FP >> 4];
772 *ptr++ = hexchars[REG_FP & 0xf];
774 ptr = mem2hex((char *)®s->reg30, ptr, sizeof(long), 0);
780 *ptr++ = hexchars[REG_SP >> 4];
781 *ptr++ = hexchars[REG_SP & 0xf];
783 ptr = mem2hex((char *)®s->reg29, ptr, sizeof(long), 0);
787 putpacket(output_buffer); /* send it off... */
790 * Wait for input from remote GDB
793 output_buffer[0] = 0;
794 getpacket(input_buffer);
796 switch (input_buffer[0])
799 output_buffer[0] = 'S';
800 output_buffer[1] = hexchars[sigval >> 4];
801 output_buffer[2] = hexchars[sigval & 0xf];
802 output_buffer[3] = 0;
806 * Detach debugger; let CPU run
809 putpacket(output_buffer);
814 /* toggle debug flag */
818 * Return the value of the CPU registers
822 ptr = mem2hex((char *)®s->reg0, ptr, 32*sizeof(long), 0); /* r0...r31 */
823 ptr = mem2hex((char *)®s->cp0_status, ptr, 6*sizeof(long), 0); /* cp0 */
824 ptr = mem2hex((char *)®s->fpr0, ptr, 32*sizeof(long), 0); /* f0...31 */
825 ptr = mem2hex((char *)®s->cp1_fsr, ptr, 2*sizeof(long), 0); /* cp1 */
826 ptr = mem2hex((char *)®s->frame_ptr, ptr, 2*sizeof(long), 0); /* frp */
827 ptr = mem2hex((char *)®s->cp0_index, ptr, 16*sizeof(long), 0); /* cp0 */
831 * set the value of the CPU registers - return OK
835 ptr = &input_buffer[1];
836 hex2mem(ptr, (char *)®s->reg0, 32*sizeof(long), 0, 0);
837 ptr += 32*(2*sizeof(long));
838 hex2mem(ptr, (char *)®s->cp0_status, 6*sizeof(long), 0, 0);
839 ptr += 6*(2*sizeof(long));
840 hex2mem(ptr, (char *)®s->fpr0, 32*sizeof(long), 0, 0);
841 ptr += 32*(2*sizeof(long));
842 hex2mem(ptr, (char *)®s->cp1_fsr, 2*sizeof(long), 0, 0);
843 ptr += 2*(2*sizeof(long));
844 hex2mem(ptr, (char *)®s->frame_ptr, 2*sizeof(long), 0, 0);
845 ptr += 2*(2*sizeof(long));
846 hex2mem(ptr, (char *)®s->cp0_index, 16*sizeof(long), 0, 0);
847 strcpy(output_buffer,"OK");
852 * mAA..AA,LLLL Read LLLL bytes at address AA..AA
855 ptr = &input_buffer[1];
857 if (hexToLong(&ptr, &addr)
859 && hexToInt(&ptr, &length)) {
860 if (mem2hex((char *)addr, output_buffer, length, 1))
862 strcpy (output_buffer, "E03");
864 strcpy(output_buffer,"E01");
868 * XAA..AA,LLLL: Write LLLL escaped binary bytes at address AA.AA
875 * MAA..AA,LLLL: Write LLLL bytes at address AA.AA return OK
878 ptr = &input_buffer[1];
880 if (hexToLong(&ptr, &addr)
882 && hexToInt(&ptr, &length)
884 if (hex2mem(ptr, (char *)addr, length, bflag, 1))
885 strcpy(output_buffer, "OK");
887 strcpy(output_buffer, "E03");
890 strcpy(output_buffer, "E02");
894 * cAA..AA Continue at address AA..AA(optional)
897 /* try to read optional parameter, pc unchanged if no parm */
899 ptr = &input_buffer[1];
900 if (hexToLong(&ptr, &addr))
901 regs->cp0_epc = addr;
903 goto exit_kgdb_exception;
907 * kill the program; let us try to restart the machine
908 * Reset the whole machine.
912 machine_restart("kgdb restarts machine");
916 * Step to next instruction
920 * There is no single step insn in the MIPS ISA, so we
921 * use breakpoints and continue, instead.
924 goto exit_kgdb_exception;
929 * Set baud rate (bBB)
930 * FIXME: Needs to be written
936 extern void set_timer_3();
938 ptr = &input_buffer[1];
939 if (!hexToInt(&ptr, &baudrate))
941 strcpy(output_buffer,"B01");
945 /* Convert baud rate to uart clock divider */
960 strcpy(output_buffer,"B02");
965 putpacket("OK"); /* Ack before changing speed */
966 set_timer_3(baudrate); /* Set it */
975 * reply to the request
978 putpacket(output_buffer);
985 restore_debug_traps();
988 /* release locks so other CPUs can go */
989 for (i = num_online_cpus()-1; i >= 0; i--)
990 __raw_spin_unlock(&kgdb_cpulock[i]);
991 spin_unlock(&kgdb_lock);
998 * This function will generate a breakpoint exception. It is used at the
999 * beginning of a program to sync up with a debugger and can be used
1000 * otherwise as a quick means to stop program execution and "break" into
1003 void breakpoint(void)
1008 __asm__ __volatile__(
1009 ".globl breakinst\n\t"
1010 ".set\tnoreorder\n\t"
1012 "breakinst:\tbreak\n\t"
1018 /* Nothing but the break; don't pollute any registers */
1019 void async_breakpoint(void)
1021 __asm__ __volatile__(
1022 ".globl async_breakinst\n\t"
1023 ".set\tnoreorder\n\t"
1025 "async_breakinst:\tbreak\n\t"
1033 __asm__ __volatile__(
1035 "lui\t$8,0x8000\n\t"
1041 * malloc is needed by gdb client in "call func()", even a private one
1042 * will make gdb happy
1044 static void * __attribute_used__ malloc(size_t size)
1046 return kmalloc(size, GFP_ATOMIC);
1049 static void __attribute_used__ free (void *where)
1054 #ifdef CONFIG_GDB_CONSOLE
1056 void gdb_putsn(const char *str, int l)
1067 mem2hex((char *)str, &outbuf[1], i, 0);
1075 static void gdb_console_write(struct console *con, const char *s, unsigned n)
1080 static struct console gdb_console = {
1082 .write = gdb_console_write,
1083 .flags = CON_PRINTBUFFER,
1087 static int __init register_gdb_console(void)
1089 register_console(&gdb_console);
1094 console_initcall(register_gdb_console);