xref: /linux/kernel/debug/gdbstub.c (revision c4ee0af3fa0dc65f690fc908f02b8355f9576ea0)
1 /*
2  * Kernel Debug Core
3  *
4  * Maintainer: Jason Wessel <jason.wessel@windriver.com>
5  *
6  * Copyright (C) 2000-2001 VERITAS Software Corporation.
7  * Copyright (C) 2002-2004 Timesys Corporation
8  * Copyright (C) 2003-2004 Amit S. Kale <amitkale@linsyssoft.com>
9  * Copyright (C) 2004 Pavel Machek <pavel@ucw.cz>
10  * Copyright (C) 2004-2006 Tom Rini <trini@kernel.crashing.org>
11  * Copyright (C) 2004-2006 LinSysSoft Technologies Pvt. Ltd.
12  * Copyright (C) 2005-2009 Wind River Systems, Inc.
13  * Copyright (C) 2007 MontaVista Software, Inc.
14  * Copyright (C) 2008 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
15  *
16  * Contributors at various stages not listed above:
17  *  Jason Wessel ( jason.wessel@windriver.com )
18  *  George Anzinger <george@mvista.com>
19  *  Anurekh Saxena (anurekh.saxena@timesys.com)
20  *  Lake Stevens Instrument Division (Glenn Engel)
21  *  Jim Kingdon, Cygnus Support.
22  *
23  * Original KGDB stub: David Grothe <dave@gcom.com>,
24  * Tigran Aivazian <tigran@sco.com>
25  *
26  * This file is licensed under the terms of the GNU General Public License
27  * version 2. This program is licensed "as is" without any warranty of any
28  * kind, whether express or implied.
29  */
30 
31 #include <linux/kernel.h>
32 #include <linux/kgdb.h>
33 #include <linux/kdb.h>
34 #include <linux/serial_core.h>
35 #include <linux/reboot.h>
36 #include <linux/uaccess.h>
37 #include <asm/cacheflush.h>
38 #include <asm/unaligned.h>
39 #include "debug_core.h"
40 
41 #define KGDB_MAX_THREAD_QUERY 17
42 
43 /* Our I/O buffers. */
44 static char			remcom_in_buffer[BUFMAX];
45 static char			remcom_out_buffer[BUFMAX];
46 static int			gdbstub_use_prev_in_buf;
47 static int			gdbstub_prev_in_buf_pos;
48 
49 /* Storage for the registers, in GDB format. */
50 static unsigned long		gdb_regs[(NUMREGBYTES +
51 					sizeof(unsigned long) - 1) /
52 					sizeof(unsigned long)];
53 
54 /*
55  * GDB remote protocol parser:
56  */
57 
58 #ifdef CONFIG_KGDB_KDB
59 static int gdbstub_read_wait(void)
60 {
61 	int ret = -1;
62 	int i;
63 
64 	if (unlikely(gdbstub_use_prev_in_buf)) {
65 		if (gdbstub_prev_in_buf_pos < gdbstub_use_prev_in_buf)
66 			return remcom_in_buffer[gdbstub_prev_in_buf_pos++];
67 		else
68 			gdbstub_use_prev_in_buf = 0;
69 	}
70 
71 	/* poll any additional I/O interfaces that are defined */
72 	while (ret < 0)
73 		for (i = 0; kdb_poll_funcs[i] != NULL; i++) {
74 			ret = kdb_poll_funcs[i]();
75 			if (ret > 0)
76 				break;
77 		}
78 	return ret;
79 }
80 #else
81 static int gdbstub_read_wait(void)
82 {
83 	int ret = dbg_io_ops->read_char();
84 	while (ret == NO_POLL_CHAR)
85 		ret = dbg_io_ops->read_char();
86 	return ret;
87 }
88 #endif
89 /* scan for the sequence $<data>#<checksum> */
90 static void get_packet(char *buffer)
91 {
92 	unsigned char checksum;
93 	unsigned char xmitcsum;
94 	int count;
95 	char ch;
96 
97 	do {
98 		/*
99 		 * Spin and wait around for the start character, ignore all
100 		 * other characters:
101 		 */
102 		while ((ch = (gdbstub_read_wait())) != '$')
103 			/* nothing */;
104 
105 		kgdb_connected = 1;
106 		checksum = 0;
107 		xmitcsum = -1;
108 
109 		count = 0;
110 
111 		/*
112 		 * now, read until a # or end of buffer is found:
113 		 */
114 		while (count < (BUFMAX - 1)) {
115 			ch = gdbstub_read_wait();
116 			if (ch == '#')
117 				break;
118 			checksum = checksum + ch;
119 			buffer[count] = ch;
120 			count = count + 1;
121 		}
122 
123 		if (ch == '#') {
124 			xmitcsum = hex_to_bin(gdbstub_read_wait()) << 4;
125 			xmitcsum += hex_to_bin(gdbstub_read_wait());
126 
127 			if (checksum != xmitcsum)
128 				/* failed checksum */
129 				dbg_io_ops->write_char('-');
130 			else
131 				/* successful transfer */
132 				dbg_io_ops->write_char('+');
133 			if (dbg_io_ops->flush)
134 				dbg_io_ops->flush();
135 		}
136 		buffer[count] = 0;
137 	} while (checksum != xmitcsum);
138 }
139 
140 /*
141  * Send the packet in buffer.
142  * Check for gdb connection if asked for.
143  */
144 static void put_packet(char *buffer)
145 {
146 	unsigned char checksum;
147 	int count;
148 	char ch;
149 
150 	/*
151 	 * $<packet info>#<checksum>.
152 	 */
153 	while (1) {
154 		dbg_io_ops->write_char('$');
155 		checksum = 0;
156 		count = 0;
157 
158 		while ((ch = buffer[count])) {
159 			dbg_io_ops->write_char(ch);
160 			checksum += ch;
161 			count++;
162 		}
163 
164 		dbg_io_ops->write_char('#');
165 		dbg_io_ops->write_char(hex_asc_hi(checksum));
166 		dbg_io_ops->write_char(hex_asc_lo(checksum));
167 		if (dbg_io_ops->flush)
168 			dbg_io_ops->flush();
169 
170 		/* Now see what we get in reply. */
171 		ch = gdbstub_read_wait();
172 
173 		if (ch == 3)
174 			ch = gdbstub_read_wait();
175 
176 		/* If we get an ACK, we are done. */
177 		if (ch == '+')
178 			return;
179 
180 		/*
181 		 * If we get the start of another packet, this means
182 		 * that GDB is attempting to reconnect.  We will NAK
183 		 * the packet being sent, and stop trying to send this
184 		 * packet.
185 		 */
186 		if (ch == '$') {
187 			dbg_io_ops->write_char('-');
188 			if (dbg_io_ops->flush)
189 				dbg_io_ops->flush();
190 			return;
191 		}
192 	}
193 }
194 
195 static char gdbmsgbuf[BUFMAX + 1];
196 
197 void gdbstub_msg_write(const char *s, int len)
198 {
199 	char *bufptr;
200 	int wcount;
201 	int i;
202 
203 	if (len == 0)
204 		len = strlen(s);
205 
206 	/* 'O'utput */
207 	gdbmsgbuf[0] = 'O';
208 
209 	/* Fill and send buffers... */
210 	while (len > 0) {
211 		bufptr = gdbmsgbuf + 1;
212 
213 		/* Calculate how many this time */
214 		if ((len << 1) > (BUFMAX - 2))
215 			wcount = (BUFMAX - 2) >> 1;
216 		else
217 			wcount = len;
218 
219 		/* Pack in hex chars */
220 		for (i = 0; i < wcount; i++)
221 			bufptr = hex_byte_pack(bufptr, s[i]);
222 		*bufptr = '\0';
223 
224 		/* Move up */
225 		s += wcount;
226 		len -= wcount;
227 
228 		/* Write packet */
229 		put_packet(gdbmsgbuf);
230 	}
231 }
232 
233 /*
234  * Convert the memory pointed to by mem into hex, placing result in
235  * buf.  Return a pointer to the last char put in buf (null). May
236  * return an error.
237  */
238 char *kgdb_mem2hex(char *mem, char *buf, int count)
239 {
240 	char *tmp;
241 	int err;
242 
243 	/*
244 	 * We use the upper half of buf as an intermediate buffer for the
245 	 * raw memory copy.  Hex conversion will work against this one.
246 	 */
247 	tmp = buf + count;
248 
249 	err = probe_kernel_read(tmp, mem, count);
250 	if (err)
251 		return NULL;
252 	while (count > 0) {
253 		buf = hex_byte_pack(buf, *tmp);
254 		tmp++;
255 		count--;
256 	}
257 	*buf = 0;
258 
259 	return buf;
260 }
261 
262 /*
263  * Convert the hex array pointed to by buf into binary to be placed in
264  * mem.  Return a pointer to the character AFTER the last byte
265  * written.  May return an error.
266  */
267 int kgdb_hex2mem(char *buf, char *mem, int count)
268 {
269 	char *tmp_raw;
270 	char *tmp_hex;
271 
272 	/*
273 	 * We use the upper half of buf as an intermediate buffer for the
274 	 * raw memory that is converted from hex.
275 	 */
276 	tmp_raw = buf + count * 2;
277 
278 	tmp_hex = tmp_raw - 1;
279 	while (tmp_hex >= buf) {
280 		tmp_raw--;
281 		*tmp_raw = hex_to_bin(*tmp_hex--);
282 		*tmp_raw |= hex_to_bin(*tmp_hex--) << 4;
283 	}
284 
285 	return probe_kernel_write(mem, tmp_raw, count);
286 }
287 
288 /*
289  * While we find nice hex chars, build a long_val.
290  * Return number of chars processed.
291  */
292 int kgdb_hex2long(char **ptr, unsigned long *long_val)
293 {
294 	int hex_val;
295 	int num = 0;
296 	int negate = 0;
297 
298 	*long_val = 0;
299 
300 	if (**ptr == '-') {
301 		negate = 1;
302 		(*ptr)++;
303 	}
304 	while (**ptr) {
305 		hex_val = hex_to_bin(**ptr);
306 		if (hex_val < 0)
307 			break;
308 
309 		*long_val = (*long_val << 4) | hex_val;
310 		num++;
311 		(*ptr)++;
312 	}
313 
314 	if (negate)
315 		*long_val = -*long_val;
316 
317 	return num;
318 }
319 
320 /*
321  * Copy the binary array pointed to by buf into mem.  Fix $, #, and
322  * 0x7d escaped with 0x7d. Return -EFAULT on failure or 0 on success.
323  * The input buf is overwitten with the result to write to mem.
324  */
325 static int kgdb_ebin2mem(char *buf, char *mem, int count)
326 {
327 	int size = 0;
328 	char *c = buf;
329 
330 	while (count-- > 0) {
331 		c[size] = *buf++;
332 		if (c[size] == 0x7d)
333 			c[size] = *buf++ ^ 0x20;
334 		size++;
335 	}
336 
337 	return probe_kernel_write(mem, c, size);
338 }
339 
340 #if DBG_MAX_REG_NUM > 0
341 void pt_regs_to_gdb_regs(unsigned long *gdb_regs, struct pt_regs *regs)
342 {
343 	int i;
344 	int idx = 0;
345 	char *ptr = (char *)gdb_regs;
346 
347 	for (i = 0; i < DBG_MAX_REG_NUM; i++) {
348 		dbg_get_reg(i, ptr + idx, regs);
349 		idx += dbg_reg_def[i].size;
350 	}
351 }
352 
353 void gdb_regs_to_pt_regs(unsigned long *gdb_regs, struct pt_regs *regs)
354 {
355 	int i;
356 	int idx = 0;
357 	char *ptr = (char *)gdb_regs;
358 
359 	for (i = 0; i < DBG_MAX_REG_NUM; i++) {
360 		dbg_set_reg(i, ptr + idx, regs);
361 		idx += dbg_reg_def[i].size;
362 	}
363 }
364 #endif /* DBG_MAX_REG_NUM > 0 */
365 
366 /* Write memory due to an 'M' or 'X' packet. */
367 static int write_mem_msg(int binary)
368 {
369 	char *ptr = &remcom_in_buffer[1];
370 	unsigned long addr;
371 	unsigned long length;
372 	int err;
373 
374 	if (kgdb_hex2long(&ptr, &addr) > 0 && *(ptr++) == ',' &&
375 	    kgdb_hex2long(&ptr, &length) > 0 && *(ptr++) == ':') {
376 		if (binary)
377 			err = kgdb_ebin2mem(ptr, (char *)addr, length);
378 		else
379 			err = kgdb_hex2mem(ptr, (char *)addr, length);
380 		if (err)
381 			return err;
382 		if (CACHE_FLUSH_IS_SAFE)
383 			flush_icache_range(addr, addr + length);
384 		return 0;
385 	}
386 
387 	return -EINVAL;
388 }
389 
390 static void error_packet(char *pkt, int error)
391 {
392 	error = -error;
393 	pkt[0] = 'E';
394 	pkt[1] = hex_asc[(error / 10)];
395 	pkt[2] = hex_asc[(error % 10)];
396 	pkt[3] = '\0';
397 }
398 
399 /*
400  * Thread ID accessors. We represent a flat TID space to GDB, where
401  * the per CPU idle threads (which under Linux all have PID 0) are
402  * remapped to negative TIDs.
403  */
404 
405 #define BUF_THREAD_ID_SIZE	8
406 
407 static char *pack_threadid(char *pkt, unsigned char *id)
408 {
409 	unsigned char *limit;
410 	int lzero = 1;
411 
412 	limit = id + (BUF_THREAD_ID_SIZE / 2);
413 	while (id < limit) {
414 		if (!lzero || *id != 0) {
415 			pkt = hex_byte_pack(pkt, *id);
416 			lzero = 0;
417 		}
418 		id++;
419 	}
420 
421 	if (lzero)
422 		pkt = hex_byte_pack(pkt, 0);
423 
424 	return pkt;
425 }
426 
427 static void int_to_threadref(unsigned char *id, int value)
428 {
429 	put_unaligned_be32(value, id);
430 }
431 
432 static struct task_struct *getthread(struct pt_regs *regs, int tid)
433 {
434 	/*
435 	 * Non-positive TIDs are remapped to the cpu shadow information
436 	 */
437 	if (tid == 0 || tid == -1)
438 		tid = -atomic_read(&kgdb_active) - 2;
439 	if (tid < -1 && tid > -NR_CPUS - 2) {
440 		if (kgdb_info[-tid - 2].task)
441 			return kgdb_info[-tid - 2].task;
442 		else
443 			return idle_task(-tid - 2);
444 	}
445 	if (tid <= 0) {
446 		printk(KERN_ERR "KGDB: Internal thread select error\n");
447 		dump_stack();
448 		return NULL;
449 	}
450 
451 	/*
452 	 * find_task_by_pid_ns() does not take the tasklist lock anymore
453 	 * but is nicely RCU locked - hence is a pretty resilient
454 	 * thing to use:
455 	 */
456 	return find_task_by_pid_ns(tid, &init_pid_ns);
457 }
458 
459 
460 /*
461  * Remap normal tasks to their real PID,
462  * CPU shadow threads are mapped to -CPU - 2
463  */
464 static inline int shadow_pid(int realpid)
465 {
466 	if (realpid)
467 		return realpid;
468 
469 	return -raw_smp_processor_id() - 2;
470 }
471 
472 /*
473  * All the functions that start with gdb_cmd are the various
474  * operations to implement the handlers for the gdbserial protocol
475  * where KGDB is communicating with an external debugger
476  */
477 
478 /* Handle the '?' status packets */
479 static void gdb_cmd_status(struct kgdb_state *ks)
480 {
481 	/*
482 	 * We know that this packet is only sent
483 	 * during initial connect.  So to be safe,
484 	 * we clear out our breakpoints now in case
485 	 * GDB is reconnecting.
486 	 */
487 	dbg_remove_all_break();
488 
489 	remcom_out_buffer[0] = 'S';
490 	hex_byte_pack(&remcom_out_buffer[1], ks->signo);
491 }
492 
493 static void gdb_get_regs_helper(struct kgdb_state *ks)
494 {
495 	struct task_struct *thread;
496 	void *local_debuggerinfo;
497 	int i;
498 
499 	thread = kgdb_usethread;
500 	if (!thread) {
501 		thread = kgdb_info[ks->cpu].task;
502 		local_debuggerinfo = kgdb_info[ks->cpu].debuggerinfo;
503 	} else {
504 		local_debuggerinfo = NULL;
505 		for_each_online_cpu(i) {
506 			/*
507 			 * Try to find the task on some other
508 			 * or possibly this node if we do not
509 			 * find the matching task then we try
510 			 * to approximate the results.
511 			 */
512 			if (thread == kgdb_info[i].task)
513 				local_debuggerinfo = kgdb_info[i].debuggerinfo;
514 		}
515 	}
516 
517 	/*
518 	 * All threads that don't have debuggerinfo should be
519 	 * in schedule() sleeping, since all other CPUs
520 	 * are in kgdb_wait, and thus have debuggerinfo.
521 	 */
522 	if (local_debuggerinfo) {
523 		pt_regs_to_gdb_regs(gdb_regs, local_debuggerinfo);
524 	} else {
525 		/*
526 		 * Pull stuff saved during switch_to; nothing
527 		 * else is accessible (or even particularly
528 		 * relevant).
529 		 *
530 		 * This should be enough for a stack trace.
531 		 */
532 		sleeping_thread_to_gdb_regs(gdb_regs, thread);
533 	}
534 }
535 
536 /* Handle the 'g' get registers request */
537 static void gdb_cmd_getregs(struct kgdb_state *ks)
538 {
539 	gdb_get_regs_helper(ks);
540 	kgdb_mem2hex((char *)gdb_regs, remcom_out_buffer, NUMREGBYTES);
541 }
542 
543 /* Handle the 'G' set registers request */
544 static void gdb_cmd_setregs(struct kgdb_state *ks)
545 {
546 	kgdb_hex2mem(&remcom_in_buffer[1], (char *)gdb_regs, NUMREGBYTES);
547 
548 	if (kgdb_usethread && kgdb_usethread != current) {
549 		error_packet(remcom_out_buffer, -EINVAL);
550 	} else {
551 		gdb_regs_to_pt_regs(gdb_regs, ks->linux_regs);
552 		strcpy(remcom_out_buffer, "OK");
553 	}
554 }
555 
556 /* Handle the 'm' memory read bytes */
557 static void gdb_cmd_memread(struct kgdb_state *ks)
558 {
559 	char *ptr = &remcom_in_buffer[1];
560 	unsigned long length;
561 	unsigned long addr;
562 	char *err;
563 
564 	if (kgdb_hex2long(&ptr, &addr) > 0 && *ptr++ == ',' &&
565 					kgdb_hex2long(&ptr, &length) > 0) {
566 		err = kgdb_mem2hex((char *)addr, remcom_out_buffer, length);
567 		if (!err)
568 			error_packet(remcom_out_buffer, -EINVAL);
569 	} else {
570 		error_packet(remcom_out_buffer, -EINVAL);
571 	}
572 }
573 
574 /* Handle the 'M' memory write bytes */
575 static void gdb_cmd_memwrite(struct kgdb_state *ks)
576 {
577 	int err = write_mem_msg(0);
578 
579 	if (err)
580 		error_packet(remcom_out_buffer, err);
581 	else
582 		strcpy(remcom_out_buffer, "OK");
583 }
584 
585 #if DBG_MAX_REG_NUM > 0
586 static char *gdb_hex_reg_helper(int regnum, char *out)
587 {
588 	int i;
589 	int offset = 0;
590 
591 	for (i = 0; i < regnum; i++)
592 		offset += dbg_reg_def[i].size;
593 	return kgdb_mem2hex((char *)gdb_regs + offset, out,
594 			    dbg_reg_def[i].size);
595 }
596 
597 /* Handle the 'p' individual regster get */
598 static void gdb_cmd_reg_get(struct kgdb_state *ks)
599 {
600 	unsigned long regnum;
601 	char *ptr = &remcom_in_buffer[1];
602 
603 	kgdb_hex2long(&ptr, &regnum);
604 	if (regnum >= DBG_MAX_REG_NUM) {
605 		error_packet(remcom_out_buffer, -EINVAL);
606 		return;
607 	}
608 	gdb_get_regs_helper(ks);
609 	gdb_hex_reg_helper(regnum, remcom_out_buffer);
610 }
611 
612 /* Handle the 'P' individual regster set */
613 static void gdb_cmd_reg_set(struct kgdb_state *ks)
614 {
615 	unsigned long regnum;
616 	char *ptr = &remcom_in_buffer[1];
617 	int i = 0;
618 
619 	kgdb_hex2long(&ptr, &regnum);
620 	if (*ptr++ != '=' ||
621 	    !(!kgdb_usethread || kgdb_usethread == current) ||
622 	    !dbg_get_reg(regnum, gdb_regs, ks->linux_regs)) {
623 		error_packet(remcom_out_buffer, -EINVAL);
624 		return;
625 	}
626 	memset(gdb_regs, 0, sizeof(gdb_regs));
627 	while (i < sizeof(gdb_regs) * 2)
628 		if (hex_to_bin(ptr[i]) >= 0)
629 			i++;
630 		else
631 			break;
632 	i = i / 2;
633 	kgdb_hex2mem(ptr, (char *)gdb_regs, i);
634 	dbg_set_reg(regnum, gdb_regs, ks->linux_regs);
635 	strcpy(remcom_out_buffer, "OK");
636 }
637 #endif /* DBG_MAX_REG_NUM > 0 */
638 
639 /* Handle the 'X' memory binary write bytes */
640 static void gdb_cmd_binwrite(struct kgdb_state *ks)
641 {
642 	int err = write_mem_msg(1);
643 
644 	if (err)
645 		error_packet(remcom_out_buffer, err);
646 	else
647 		strcpy(remcom_out_buffer, "OK");
648 }
649 
650 /* Handle the 'D' or 'k', detach or kill packets */
651 static void gdb_cmd_detachkill(struct kgdb_state *ks)
652 {
653 	int error;
654 
655 	/* The detach case */
656 	if (remcom_in_buffer[0] == 'D') {
657 		error = dbg_remove_all_break();
658 		if (error < 0) {
659 			error_packet(remcom_out_buffer, error);
660 		} else {
661 			strcpy(remcom_out_buffer, "OK");
662 			kgdb_connected = 0;
663 		}
664 		put_packet(remcom_out_buffer);
665 	} else {
666 		/*
667 		 * Assume the kill case, with no exit code checking,
668 		 * trying to force detach the debugger:
669 		 */
670 		dbg_remove_all_break();
671 		kgdb_connected = 0;
672 	}
673 }
674 
675 /* Handle the 'R' reboot packets */
676 static int gdb_cmd_reboot(struct kgdb_state *ks)
677 {
678 	/* For now, only honor R0 */
679 	if (strcmp(remcom_in_buffer, "R0") == 0) {
680 		printk(KERN_CRIT "Executing emergency reboot\n");
681 		strcpy(remcom_out_buffer, "OK");
682 		put_packet(remcom_out_buffer);
683 
684 		/*
685 		 * Execution should not return from
686 		 * machine_emergency_restart()
687 		 */
688 		machine_emergency_restart();
689 		kgdb_connected = 0;
690 
691 		return 1;
692 	}
693 	return 0;
694 }
695 
696 /* Handle the 'q' query packets */
697 static void gdb_cmd_query(struct kgdb_state *ks)
698 {
699 	struct task_struct *g;
700 	struct task_struct *p;
701 	unsigned char thref[BUF_THREAD_ID_SIZE];
702 	char *ptr;
703 	int i;
704 	int cpu;
705 	int finished = 0;
706 
707 	switch (remcom_in_buffer[1]) {
708 	case 's':
709 	case 'f':
710 		if (memcmp(remcom_in_buffer + 2, "ThreadInfo", 10))
711 			break;
712 
713 		i = 0;
714 		remcom_out_buffer[0] = 'm';
715 		ptr = remcom_out_buffer + 1;
716 		if (remcom_in_buffer[1] == 'f') {
717 			/* Each cpu is a shadow thread */
718 			for_each_online_cpu(cpu) {
719 				ks->thr_query = 0;
720 				int_to_threadref(thref, -cpu - 2);
721 				ptr = pack_threadid(ptr, thref);
722 				*(ptr++) = ',';
723 				i++;
724 			}
725 		}
726 
727 		do_each_thread(g, p) {
728 			if (i >= ks->thr_query && !finished) {
729 				int_to_threadref(thref, p->pid);
730 				ptr = pack_threadid(ptr, thref);
731 				*(ptr++) = ',';
732 				ks->thr_query++;
733 				if (ks->thr_query % KGDB_MAX_THREAD_QUERY == 0)
734 					finished = 1;
735 			}
736 			i++;
737 		} while_each_thread(g, p);
738 
739 		*(--ptr) = '\0';
740 		break;
741 
742 	case 'C':
743 		/* Current thread id */
744 		strcpy(remcom_out_buffer, "QC");
745 		ks->threadid = shadow_pid(current->pid);
746 		int_to_threadref(thref, ks->threadid);
747 		pack_threadid(remcom_out_buffer + 2, thref);
748 		break;
749 	case 'T':
750 		if (memcmp(remcom_in_buffer + 1, "ThreadExtraInfo,", 16))
751 			break;
752 
753 		ks->threadid = 0;
754 		ptr = remcom_in_buffer + 17;
755 		kgdb_hex2long(&ptr, &ks->threadid);
756 		if (!getthread(ks->linux_regs, ks->threadid)) {
757 			error_packet(remcom_out_buffer, -EINVAL);
758 			break;
759 		}
760 		if ((int)ks->threadid > 0) {
761 			kgdb_mem2hex(getthread(ks->linux_regs,
762 					ks->threadid)->comm,
763 					remcom_out_buffer, 16);
764 		} else {
765 			static char tmpstr[23 + BUF_THREAD_ID_SIZE];
766 
767 			sprintf(tmpstr, "shadowCPU%d",
768 					(int)(-ks->threadid - 2));
769 			kgdb_mem2hex(tmpstr, remcom_out_buffer, strlen(tmpstr));
770 		}
771 		break;
772 #ifdef CONFIG_KGDB_KDB
773 	case 'R':
774 		if (strncmp(remcom_in_buffer, "qRcmd,", 6) == 0) {
775 			int len = strlen(remcom_in_buffer + 6);
776 
777 			if ((len % 2) != 0) {
778 				strcpy(remcom_out_buffer, "E01");
779 				break;
780 			}
781 			kgdb_hex2mem(remcom_in_buffer + 6,
782 				     remcom_out_buffer, len);
783 			len = len / 2;
784 			remcom_out_buffer[len++] = 0;
785 
786 			kdb_common_init_state(ks);
787 			kdb_parse(remcom_out_buffer);
788 			kdb_common_deinit_state();
789 
790 			strcpy(remcom_out_buffer, "OK");
791 		}
792 		break;
793 #endif
794 	}
795 }
796 
797 /* Handle the 'H' task query packets */
798 static void gdb_cmd_task(struct kgdb_state *ks)
799 {
800 	struct task_struct *thread;
801 	char *ptr;
802 
803 	switch (remcom_in_buffer[1]) {
804 	case 'g':
805 		ptr = &remcom_in_buffer[2];
806 		kgdb_hex2long(&ptr, &ks->threadid);
807 		thread = getthread(ks->linux_regs, ks->threadid);
808 		if (!thread && ks->threadid > 0) {
809 			error_packet(remcom_out_buffer, -EINVAL);
810 			break;
811 		}
812 		kgdb_usethread = thread;
813 		ks->kgdb_usethreadid = ks->threadid;
814 		strcpy(remcom_out_buffer, "OK");
815 		break;
816 	case 'c':
817 		ptr = &remcom_in_buffer[2];
818 		kgdb_hex2long(&ptr, &ks->threadid);
819 		if (!ks->threadid) {
820 			kgdb_contthread = NULL;
821 		} else {
822 			thread = getthread(ks->linux_regs, ks->threadid);
823 			if (!thread && ks->threadid > 0) {
824 				error_packet(remcom_out_buffer, -EINVAL);
825 				break;
826 			}
827 			kgdb_contthread = thread;
828 		}
829 		strcpy(remcom_out_buffer, "OK");
830 		break;
831 	}
832 }
833 
834 /* Handle the 'T' thread query packets */
835 static void gdb_cmd_thread(struct kgdb_state *ks)
836 {
837 	char *ptr = &remcom_in_buffer[1];
838 	struct task_struct *thread;
839 
840 	kgdb_hex2long(&ptr, &ks->threadid);
841 	thread = getthread(ks->linux_regs, ks->threadid);
842 	if (thread)
843 		strcpy(remcom_out_buffer, "OK");
844 	else
845 		error_packet(remcom_out_buffer, -EINVAL);
846 }
847 
848 /* Handle the 'z' or 'Z' breakpoint remove or set packets */
849 static void gdb_cmd_break(struct kgdb_state *ks)
850 {
851 	/*
852 	 * Since GDB-5.3, it's been drafted that '0' is a software
853 	 * breakpoint, '1' is a hardware breakpoint, so let's do that.
854 	 */
855 	char *bpt_type = &remcom_in_buffer[1];
856 	char *ptr = &remcom_in_buffer[2];
857 	unsigned long addr;
858 	unsigned long length;
859 	int error = 0;
860 
861 	if (arch_kgdb_ops.set_hw_breakpoint && *bpt_type >= '1') {
862 		/* Unsupported */
863 		if (*bpt_type > '4')
864 			return;
865 	} else {
866 		if (*bpt_type != '0' && *bpt_type != '1')
867 			/* Unsupported. */
868 			return;
869 	}
870 
871 	/*
872 	 * Test if this is a hardware breakpoint, and
873 	 * if we support it:
874 	 */
875 	if (*bpt_type == '1' && !(arch_kgdb_ops.flags & KGDB_HW_BREAKPOINT))
876 		/* Unsupported. */
877 		return;
878 
879 	if (*(ptr++) != ',') {
880 		error_packet(remcom_out_buffer, -EINVAL);
881 		return;
882 	}
883 	if (!kgdb_hex2long(&ptr, &addr)) {
884 		error_packet(remcom_out_buffer, -EINVAL);
885 		return;
886 	}
887 	if (*(ptr++) != ',' ||
888 		!kgdb_hex2long(&ptr, &length)) {
889 		error_packet(remcom_out_buffer, -EINVAL);
890 		return;
891 	}
892 
893 	if (remcom_in_buffer[0] == 'Z' && *bpt_type == '0')
894 		error = dbg_set_sw_break(addr);
895 	else if (remcom_in_buffer[0] == 'z' && *bpt_type == '0')
896 		error = dbg_remove_sw_break(addr);
897 	else if (remcom_in_buffer[0] == 'Z')
898 		error = arch_kgdb_ops.set_hw_breakpoint(addr,
899 			(int)length, *bpt_type - '0');
900 	else if (remcom_in_buffer[0] == 'z')
901 		error = arch_kgdb_ops.remove_hw_breakpoint(addr,
902 			(int) length, *bpt_type - '0');
903 
904 	if (error == 0)
905 		strcpy(remcom_out_buffer, "OK");
906 	else
907 		error_packet(remcom_out_buffer, error);
908 }
909 
910 /* Handle the 'C' signal / exception passing packets */
911 static int gdb_cmd_exception_pass(struct kgdb_state *ks)
912 {
913 	/* C09 == pass exception
914 	 * C15 == detach kgdb, pass exception
915 	 */
916 	if (remcom_in_buffer[1] == '0' && remcom_in_buffer[2] == '9') {
917 
918 		ks->pass_exception = 1;
919 		remcom_in_buffer[0] = 'c';
920 
921 	} else if (remcom_in_buffer[1] == '1' && remcom_in_buffer[2] == '5') {
922 
923 		ks->pass_exception = 1;
924 		remcom_in_buffer[0] = 'D';
925 		dbg_remove_all_break();
926 		kgdb_connected = 0;
927 		return 1;
928 
929 	} else {
930 		gdbstub_msg_write("KGDB only knows signal 9 (pass)"
931 			" and 15 (pass and disconnect)\n"
932 			"Executing a continue without signal passing\n", 0);
933 		remcom_in_buffer[0] = 'c';
934 	}
935 
936 	/* Indicate fall through */
937 	return -1;
938 }
939 
940 /*
941  * This function performs all gdbserial command procesing
942  */
943 int gdb_serial_stub(struct kgdb_state *ks)
944 {
945 	int error = 0;
946 	int tmp;
947 
948 	/* Initialize comm buffer and globals. */
949 	memset(remcom_out_buffer, 0, sizeof(remcom_out_buffer));
950 	kgdb_usethread = kgdb_info[ks->cpu].task;
951 	ks->kgdb_usethreadid = shadow_pid(kgdb_info[ks->cpu].task->pid);
952 	ks->pass_exception = 0;
953 
954 	if (kgdb_connected) {
955 		unsigned char thref[BUF_THREAD_ID_SIZE];
956 		char *ptr;
957 
958 		/* Reply to host that an exception has occurred */
959 		ptr = remcom_out_buffer;
960 		*ptr++ = 'T';
961 		ptr = hex_byte_pack(ptr, ks->signo);
962 		ptr += strlen(strcpy(ptr, "thread:"));
963 		int_to_threadref(thref, shadow_pid(current->pid));
964 		ptr = pack_threadid(ptr, thref);
965 		*ptr++ = ';';
966 		put_packet(remcom_out_buffer);
967 	}
968 
969 	while (1) {
970 		error = 0;
971 
972 		/* Clear the out buffer. */
973 		memset(remcom_out_buffer, 0, sizeof(remcom_out_buffer));
974 
975 		get_packet(remcom_in_buffer);
976 
977 		switch (remcom_in_buffer[0]) {
978 		case '?': /* gdbserial status */
979 			gdb_cmd_status(ks);
980 			break;
981 		case 'g': /* return the value of the CPU registers */
982 			gdb_cmd_getregs(ks);
983 			break;
984 		case 'G': /* set the value of the CPU registers - return OK */
985 			gdb_cmd_setregs(ks);
986 			break;
987 		case 'm': /* mAA..AA,LLLL  Read LLLL bytes at address AA..AA */
988 			gdb_cmd_memread(ks);
989 			break;
990 		case 'M': /* MAA..AA,LLLL: Write LLLL bytes at address AA..AA */
991 			gdb_cmd_memwrite(ks);
992 			break;
993 #if DBG_MAX_REG_NUM > 0
994 		case 'p': /* pXX Return gdb register XX (in hex) */
995 			gdb_cmd_reg_get(ks);
996 			break;
997 		case 'P': /* PXX=aaaa Set gdb register XX to aaaa (in hex) */
998 			gdb_cmd_reg_set(ks);
999 			break;
1000 #endif /* DBG_MAX_REG_NUM > 0 */
1001 		case 'X': /* XAA..AA,LLLL: Write LLLL bytes at address AA..AA */
1002 			gdb_cmd_binwrite(ks);
1003 			break;
1004 			/* kill or detach. KGDB should treat this like a
1005 			 * continue.
1006 			 */
1007 		case 'D': /* Debugger detach */
1008 		case 'k': /* Debugger detach via kill */
1009 			gdb_cmd_detachkill(ks);
1010 			goto default_handle;
1011 		case 'R': /* Reboot */
1012 			if (gdb_cmd_reboot(ks))
1013 				goto default_handle;
1014 			break;
1015 		case 'q': /* query command */
1016 			gdb_cmd_query(ks);
1017 			break;
1018 		case 'H': /* task related */
1019 			gdb_cmd_task(ks);
1020 			break;
1021 		case 'T': /* Query thread status */
1022 			gdb_cmd_thread(ks);
1023 			break;
1024 		case 'z': /* Break point remove */
1025 		case 'Z': /* Break point set */
1026 			gdb_cmd_break(ks);
1027 			break;
1028 #ifdef CONFIG_KGDB_KDB
1029 		case '3': /* Escape into back into kdb */
1030 			if (remcom_in_buffer[1] == '\0') {
1031 				gdb_cmd_detachkill(ks);
1032 				return DBG_PASS_EVENT;
1033 			}
1034 #endif
1035 		case 'C': /* Exception passing */
1036 			tmp = gdb_cmd_exception_pass(ks);
1037 			if (tmp > 0)
1038 				goto default_handle;
1039 			if (tmp == 0)
1040 				break;
1041 			/* Fall through on tmp < 0 */
1042 		case 'c': /* Continue packet */
1043 		case 's': /* Single step packet */
1044 			if (kgdb_contthread && kgdb_contthread != current) {
1045 				/* Can't switch threads in kgdb */
1046 				error_packet(remcom_out_buffer, -EINVAL);
1047 				break;
1048 			}
1049 			dbg_activate_sw_breakpoints();
1050 			/* Fall through to default processing */
1051 		default:
1052 default_handle:
1053 			error = kgdb_arch_handle_exception(ks->ex_vector,
1054 						ks->signo,
1055 						ks->err_code,
1056 						remcom_in_buffer,
1057 						remcom_out_buffer,
1058 						ks->linux_regs);
1059 			/*
1060 			 * Leave cmd processing on error, detach,
1061 			 * kill, continue, or single step.
1062 			 */
1063 			if (error >= 0 || remcom_in_buffer[0] == 'D' ||
1064 			    remcom_in_buffer[0] == 'k') {
1065 				error = 0;
1066 				goto kgdb_exit;
1067 			}
1068 
1069 		}
1070 
1071 		/* reply to the request */
1072 		put_packet(remcom_out_buffer);
1073 	}
1074 
1075 kgdb_exit:
1076 	if (ks->pass_exception)
1077 		error = 1;
1078 	return error;
1079 }
1080 
1081 int gdbstub_state(struct kgdb_state *ks, char *cmd)
1082 {
1083 	int error;
1084 
1085 	switch (cmd[0]) {
1086 	case 'e':
1087 		error = kgdb_arch_handle_exception(ks->ex_vector,
1088 						   ks->signo,
1089 						   ks->err_code,
1090 						   remcom_in_buffer,
1091 						   remcom_out_buffer,
1092 						   ks->linux_regs);
1093 		return error;
1094 	case 's':
1095 	case 'c':
1096 		strcpy(remcom_in_buffer, cmd);
1097 		return 0;
1098 	case '$':
1099 		strcpy(remcom_in_buffer, cmd);
1100 		gdbstub_use_prev_in_buf = strlen(remcom_in_buffer);
1101 		gdbstub_prev_in_buf_pos = 0;
1102 		return 0;
1103 	}
1104 	dbg_io_ops->write_char('+');
1105 	put_packet(remcom_out_buffer);
1106 	return 0;
1107 }
1108 
1109 /**
1110  * gdbstub_exit - Send an exit message to GDB
1111  * @status: The exit code to report.
1112  */
1113 void gdbstub_exit(int status)
1114 {
1115 	unsigned char checksum, ch, buffer[3];
1116 	int loop;
1117 
1118 	if (!kgdb_connected)
1119 		return;
1120 	kgdb_connected = 0;
1121 
1122 	if (!dbg_io_ops || dbg_kdb_mode)
1123 		return;
1124 
1125 	buffer[0] = 'W';
1126 	buffer[1] = hex_asc_hi(status);
1127 	buffer[2] = hex_asc_lo(status);
1128 
1129 	dbg_io_ops->write_char('$');
1130 	checksum = 0;
1131 
1132 	for (loop = 0; loop < 3; loop++) {
1133 		ch = buffer[loop];
1134 		checksum += ch;
1135 		dbg_io_ops->write_char(ch);
1136 	}
1137 
1138 	dbg_io_ops->write_char('#');
1139 	dbg_io_ops->write_char(hex_asc_hi(checksum));
1140 	dbg_io_ops->write_char(hex_asc_lo(checksum));
1141 
1142 	/* make sure the output is flushed, lest the bootloader clobber it */
1143 	if (dbg_io_ops->flush)
1144 		dbg_io_ops->flush();
1145 }
1146