2 * Kernel Debugger Architecture Dependent Breakpoint Handling
4 * This file is subject to the terms and conditions of the GNU General Public
5 * License. See the file "COPYING" in the main directory of this archive
8 * Copyright (c) 1999-2004 Silicon Graphics, Inc. All Rights Reserved.
11 #include <linux/string.h>
12 #include <linux/kernel.h>
13 #include <linux/sched.h>
14 #include <linux/smp.h>
15 #include <linux/ptrace.h>
16 #include <linux/kdb.h>
17 #include <linux/kdbprivate.h>
20 static char *kdba_rwtypes[] = { "Instruction(Register)", "Data Write",
21 "I/O", "Data Access"};
24 * Table describing processor architecture hardware
25 * breakpoint registers.
28 static kdbhard_bp_t kdb_hardbreaks[KDB_MAXHARDBPT];
33 * Perform breakpoint processing upon entry to the
34 * processor debugger fault. Determine and print
35 * the active breakpoint.
38 * regs Exception frame containing machine register state
39 * error Error number passed to kdb.
43 * KDB_DB_BPT Standard instruction or data breakpoint encountered
44 * KDB_DB_SS Single Step fault ('ss' command or end of 'ssb' command)
45 * KDB_DB_SSB Single Step fault, caller should continue ('ssb' command)
46 * KDB_DB_SSBPT Single step over breakpoint
47 * KDB_DB_NOBPT No existing kdb breakpoint matches this debug exception
51 * Yup, there be goto's here.
53 * If multiple processors receive debug exceptions simultaneously,
54 * one may be waiting at the kdb fence in kdb() while the user
55 * issues a 'bc' command to clear the breakpoint the processor
56 * which is waiting has already encountered. If this is the case,
57 * the debug registers will no longer match any entry in the
58 * breakpoint table, and we'll return the value KDB_DB_NOBPT.
59 * This can cause a panic in die_if_kernel(). It is safer to
60 * disable the breakpoint (bd), go until all processors are past
61 * the breakpoint then clear the breakpoint (bc). This code
62 * recognises a breakpoint even when disabled but not when it has
65 * WARNING: This routine clears the debug state. It should be called
66 * once per debug and the result cached.
70 kdba_db_trap(struct pt_regs *regs, int error_unused)
76 kdb_dbtrap_t rv = KDB_DB_BPT;
79 if (KDB_NULL_REGS(regs))
86 kdb_printf("kdb: dr6 0x%lx dr7 0x%lx\n", dr6, dr7);
88 if (KDB_STATE(SSBPT)) {
90 kdb_printf("ssbpt\n");
91 KDB_STATE_CLEAR(SSBPT);
92 for(i=0,bp=kdb_breakpoints;
96 kdb_printf("bp 0x%p enabled %d delayed %d global %d cpu %d\n",
97 bp, bp->bp_enabled, bp->bp_delayed, bp->bp_global, bp->bp_cpu);
100 if (!bp->bp_global && bp->bp_cpu != smp_processor_id())
103 kdb_printf("bp for this cpu\n");
104 if (bp->bp_delayed) {
107 kdb_printf("kdba_installbp\n");
108 kdba_installbp(regs, bp);
109 if (!KDB_STATE(DOING_SS)) {
110 regs->flags &= ~EF_TF;
111 return(KDB_DB_SSBPT);
116 if (i == KDB_MAXBPT) {
117 kdb_printf("kdb: Unable to find delayed breakpoint\n");
119 if (!KDB_STATE(DOING_SS)) {
120 regs->flags &= ~EF_TF;
121 return(KDB_DB_NOBPT);
127 * KDB_STATE_DOING_SS is set when the kernel debugger is using
128 * the processor trap flag to single-step a processor. If a
129 * single step trap occurs and this flag is clear, the SS trap
130 * will be ignored by KDB and the kernel will be allowed to deal
131 * with it as necessary (e.g. for ptrace).
133 if (!KDB_STATE(DOING_SS))
137 rv = KDB_DB_SS; /* Indicate single step */
138 if (KDB_STATE(DOING_SSB)) {
139 unsigned char instruction[2];
142 if (kdb_getarea(instruction, regs->ip) ||
143 (instruction[0]&0xf0) == 0xe0 || /* short disp jumps */
144 (instruction[0]&0xf0) == 0x70 || /* Misc. jumps */
145 instruction[0] == 0xc2 || /* ret */
146 instruction[0] == 0x9a || /* call */
147 (instruction[0]&0xf8) == 0xc8 || /* enter, leave, iret, int, */
148 ((instruction[0] == 0x0f) &&
149 ((instruction[1]&0xf0)== 0x80))
152 * End the ssb command here.
154 KDB_STATE_CLEAR(DOING_SSB);
155 KDB_STATE_CLEAR(DOING_SS);
157 rv = KDB_DB_SSB; /* Indicate ssb - dismiss immediately */
163 kdb_printf("SS trap at ");
164 kdb_symbol_print(regs->ip, NULL, KDB_SP_DEFAULT|KDB_SP_NEWLINE);
166 KDB_STATE_CLEAR(DOING_SS);
169 if (rv != KDB_DB_SSB)
170 regs->flags &= ~EF_TF;
200 goto unknown; /* dismiss */
206 regs->flags |= EF_RF;
209 * Determine which breakpoint was encountered.
211 for(i=0, bp=kdb_breakpoints; i<KDB_MAXBPT; i++, bp++) {
213 && (bp->bp_global || bp->bp_cpu == smp_processor_id())
215 && (bp->bp_hard->bph_reg == reg)) {
217 * Hit this breakpoint.
219 kdb_printf("%s breakpoint #%d at " kdb_bfd_vma_fmt "\n",
224 * For an instruction breakpoint, disassemble
225 * the current instruction.
236 regs->flags |= EF_RF; /* Supress further faults */
237 rv = KDB_DB_NOBPT; /* Cause kdb() to return */
242 * Clear the pending exceptions.
252 * Perform breakpoint processing upon entry to the
253 * processor breakpoint instruction fault. Determine and print
254 * the active breakpoint.
257 * regs Exception frame containing machine register state
258 * error Error number passed to kdb.
262 * 0 Standard instruction or data breakpoint encountered
263 * 1 Single Step fault ('ss' command)
264 * 2 Single Step fault, caller should continue ('ssb' command)
265 * 3 No existing kdb breakpoint matches this debug exception
270 * If multiple processors receive debug exceptions simultaneously,
271 * one may be waiting at the kdb fence in kdb() while the user
272 * issues a 'bc' command to clear the breakpoint the processor which
273 * is waiting has already encountered. If this is the case, the
274 * debug registers will no longer match any entry in the breakpoint
275 * table, and we'll return the value '3'. This can cause a panic
276 * in die_if_kernel(). It is safer to disable the breakpoint (bd),
277 * 'go' until all processors are past the breakpoint then clear the
278 * breakpoint (bc). This code recognises a breakpoint even when
279 * disabled but not when it has been cleared.
281 * WARNING: This routine resets the eip. It should be called
282 * once per breakpoint and the result cached.
286 kdba_bp_trap(struct pt_regs *regs, int error_unused)
292 if (KDB_NULL_REGS(regs))
296 * Determine which breakpoint was encountered.
299 kdb_printf("kdba_bp_trap: eip=0x%lx (not adjusted) "
300 "eflags=0x%lx regs=0x%p esp=0x%lx\n",
301 regs->ip, regs->flags, regs, regs->sp);
303 rv = KDB_DB_NOBPT; /* Cause kdb() to return */
305 for(i=0, bp=kdb_breakpoints; i<KDB_MAXBPT; i++, bp++) {
308 if (!bp->bp_global && bp->bp_cpu != smp_processor_id())
310 if ((void *)bp->bp_addr == (void *)(regs->ip - bp->bp_adjust)) {
311 /* Hit this breakpoint. */
312 regs->ip -= bp->bp_adjust;
313 kdb_printf("Instruction(i) breakpoint #%d at 0x%lx (adjusted)\n",
318 /* SSBPT is set when the kernel debugger must single
319 * step a task in order to re-establish an instruction
320 * breakpoint which uses the instruction replacement
321 * mechanism. It is cleared by any action that removes
322 * the need to single-step the breakpoint.
324 KDB_STATE_SET(SSBPT);
335 * Handle an instruction-breakpoint trap. Called when re-installing
336 * an enabled breakpoint which has has the bp_delay bit set.
343 * Ok, we really need to:
344 * 1) Restore the original instruction byte
346 * 3) Restore breakpoint instruction
353 kdba_handle_bp(struct pt_regs *regs, kdb_bp_t *bp)
355 if (KDB_NULL_REGS(regs))
359 kdb_printf("regs->ip = 0x%lx\n", regs->ip);
364 kdba_setsinglestep(regs);
367 * Reset delay attribute
377 * Return a string describing type of breakpoint.
380 * bph Pointer to hardware breakpoint description
391 kdba_bptype(kdbhard_bp_t *bph)
395 mode = kdba_rwtypes[bph->bph_mode];
403 * Print register name assigned to breakpoint
406 * bph Pointer hardware breakpoint structure
417 kdba_printbpreg(kdbhard_bp_t *bph)
419 kdb_printf(" in dr%ld", bph->bph_reg);
425 * Print string describing hardware breakpoint.
428 * bph Pointer to hardware breakpoint description
439 kdba_printbp(kdb_bp_t *bp)
441 kdb_printf("\n is enabled");
442 if (bp->bp_hardtype) {
443 kdba_printbpreg(bp->bp_hard);
444 if (bp->bp_hard->bph_mode != 0) {
445 kdb_printf(" for %d bytes",
446 bp->bp_hard->bph_length+1);
454 * Parse architecture dependent portion of the
455 * breakpoint command.
462 * Zero for success, a kdb diagnostic for failure
466 * for Ia32 architure, data access, data write and
467 * I/O breakpoints are supported in addition to instruction
470 * {datar|dataw|io|inst} [length]
474 kdba_parsebp(int argc, const char **argv, int *nextargp, kdb_bp_t *bp)
476 int nextarg = *nextargp;
478 kdbhard_bp_t *bph = &bp->bp_template;
480 bph->bph_mode = 0; /* Default to instruction breakpoint */
481 bph->bph_length = 0; /* Length must be zero for insn bp */
482 if ((argc + 1) != nextarg) {
483 if (strnicmp(argv[nextarg], "datar", sizeof("datar")) == 0) {
485 } else if (strnicmp(argv[nextarg], "dataw", sizeof("dataw")) == 0) {
487 } else if (strnicmp(argv[nextarg], "io", sizeof("io")) == 0) {
489 } else if (strnicmp(argv[nextarg], "inst", sizeof("inst")) == 0) {
495 bph->bph_length = 3; /* Default to 4 byte */
499 if ((argc + 1) != nextarg) {
502 diag = kdbgetularg((char *)argv[nextarg],
508 if ((len > 4) || (len == 3))
509 return KDB_BADLENGTH;
511 bph->bph_length = len;
512 bph->bph_length--; /* Normalize for debug register */
516 if ((argc + 1) != nextarg)
520 * Indicate to architecture independent level that
521 * a hardware register assignment is required to enable
528 kdb_printf("kdba_bp: no args, forcehw is %d\n", bp->bp_forcehw);
529 if (bp->bp_forcehw) {
531 * We are forced to use a hardware register for this
532 * breakpoint because either the bph or bpha
533 * commands were used to establish this breakpoint.
538 * Indicate to architecture dependent level that
539 * the instruction replacement breakpoint technique
540 * should be used for this breakpoint.
543 bp->bp_adjust = 1; /* software, int 3 is one byte */
547 if (bph->bph_mode != 2 && kdba_verify_rw(bp->bp_addr, bph->bph_length+1)) {
548 kdb_printf("Invalid address for breakpoint, ignoring bp command\n");
559 * Associate a hardware register with a breakpoint.
566 * A pointer to the allocated register kdbhard_bp_t structure for
567 * success, Null and a non-zero diagnostic for failure.
574 kdba_allocbp(kdbhard_bp_t *bph, int *diagp)
577 kdbhard_bp_t *newbph;
579 for(i=0,newbph=kdb_hardbreaks; i < KDB_MAXHARDBPT; i++, newbph++) {
580 if (newbph->bph_free) {
585 if (i == KDB_MAXHARDBPT) {
586 *diagp = KDB_TOOMANYDBREGS;
593 * Copy data from template. Can't just copy the entire template
594 * here because the register number in kdb_hardbreaks must be
597 newbph->bph_data = bph->bph_data;
598 newbph->bph_write = bph->bph_write;
599 newbph->bph_mode = bph->bph_mode;
600 newbph->bph_length = bph->bph_length;
603 * Mark entry allocated.
605 newbph->bph_free = 0;
613 * Deallocate a hardware breakpoint
620 * Zero for success, a kdb diagnostic for failure
627 kdba_freebp(kdbhard_bp_t *bph)
635 * Initialize the breakpoint table for the hardware breakpoint
643 * Zero for success, a kdb diagnostic for failure
648 * There is one entry per register. On the ia32 architecture
649 * all the registers are interchangeable, so no special allocation
650 * criteria are required.
660 * Clear the hardware breakpoint table
663 memset(kdb_hardbreaks, '\0', sizeof(kdb_hardbreaks));
665 for(i=0,bph=kdb_hardbreaks; i<KDB_MAXHARDBPT; i++, bph++) {
674 * Install a breakpoint
677 * regs Exception frame
678 * bp Breakpoint structure for the breakpoint to be installed
682 * 0 if breakpoint installed.
686 * For hardware breakpoints, a debug register is allocated
687 * and assigned to the breakpoint. If no debug register is
688 * available, a warning message is printed and the breakpoint
691 * For instruction replacement breakpoints, we must single-step
692 * over the replaced instruction at this point so we can re-install
693 * the breakpoint instruction after the single-step. SSBPT is set
694 * when the breakpoint is initially hit and is cleared by any action
695 * that removes the need for single-step over the breakpoint.
699 kdba_installbp(struct pt_regs *regs, kdb_bp_t *bp)
702 * Install the breakpoint, if it is not already installed.
706 kdb_printf("kdba_installbp bp_installed %d\n", bp->bp_installed);
708 if (!KDB_STATE(SSBPT))
710 if (!bp->bp_installed) {
711 if (bp->bp_hardtype) {
712 kdba_installdbreg(bp);
713 bp->bp_installed = 1;
715 kdb_printf("kdba_installbp hardware reg %ld at " kdb_bfd_vma_fmt "\n",
716 bp->bp_hard->bph_reg, bp->bp_addr);
718 } else if (bp->bp_delay) {
720 kdb_printf("kdba_installbp delayed bp\n");
721 kdba_handle_bp(regs, bp);
723 if (kdb_getarea_size(&(bp->bp_inst), bp->bp_addr, 1) ||
724 kdb_putword(bp->bp_addr, IA32_BREAKPOINT_INSTRUCTION, 1)) {
725 kdb_printf("kdba_installbp failed to set software breakpoint at 0x%lx\n", bp->bp_addr);
728 bp->bp_installed = 1;
730 kdb_printf("kdba_installbp instruction 0x%x at " kdb_bfd_vma_fmt "\n",
731 IA32_BREAKPOINT_INSTRUCTION, bp->bp_addr);
740 * Make a breakpoint ineffective.
754 kdba_removebp(kdb_bp_t *bp)
757 * For hardware breakpoints, remove it from the active register,
758 * for software breakpoints, restore the instruction stream.
761 kdb_printf("kdba_removebp bp_installed %d\n", bp->bp_installed);
763 if (bp->bp_installed) {
764 if (bp->bp_hardtype) {
766 kdb_printf("kdb: removing hardware reg %ld at " kdb_bfd_vma_fmt "\n",
767 bp->bp_hard->bph_reg, bp->bp_addr);
769 kdba_removedbreg(bp);
772 kdb_printf("kdb: restoring instruction 0x%x at " kdb_bfd_vma_fmt "\n",
773 bp->bp_inst, bp->bp_addr);
774 if (kdb_putword(bp->bp_addr, bp->bp_inst, 1))
777 bp->bp_installed = 0;