1 /*
2  * Kernel Debug Core
3  *
4  * Maintainer: Jason Wessel <jason.wessel@windriver.com>
5  *
6  * Copyright (C) 2000-2001 VERITAS Software Corporation.
7  * Copyright (C) 2002-2004 Timesys Corporation
8  * Copyright (C) 2003-2004 Amit S. Kale <amitkale@linsyssoft.com>
9  * Copyright (C) 2004 Pavel Machek <pavel@ucw.cz>
10  * Copyright (C) 2004-2006 Tom Rini <trini@kernel.crashing.org>
11  * Copyright (C) 2004-2006 LinSysSoft Technologies Pvt. Ltd.
12  * Copyright (C) 2005-2009 Wind River Systems, Inc.
13  * Copyright (C) 2007 MontaVista Software, Inc.
14  * Copyright (C) 2008 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
15  *
16  * Contributors at various stages not listed above:
17  *  Jason Wessel ( jason.wessel@windriver.com )
18  *  George Anzinger <george@mvista.com>
19  *  Anurekh Saxena (anurekh.saxena@timesys.com)
20  *  Lake Stevens Instrument Division (Glenn Engel)
21  *  Jim Kingdon, Cygnus Support.
22  *
23  * Original KGDB stub: David Grothe <dave@gcom.com>,
24  * Tigran Aivazian <tigran@sco.com>
25  *
26  * This file is licensed under the terms of the GNU General Public License
27  * version 2. This program is licensed "as is" without any warranty of any
28  * kind, whether express or implied.
29  */
30 
31 #define pr_fmt(fmt) "KGDB: " fmt
32 
33 #include <linux/pid_namespace.h>
34 #include <linux/clocksource.h>
35 #include <linux/serial_core.h>
36 #include <linux/interrupt.h>
37 #include <linux/spinlock.h>
38 #include <linux/console.h>
39 #include <linux/threads.h>
40 #include <linux/uaccess.h>
41 #include <linux/kernel.h>
42 #include <linux/module.h>
43 #include <linux/ptrace.h>
44 #include <linux/string.h>
45 #include <linux/delay.h>
46 #include <linux/sched.h>
47 #include <linux/sysrq.h>
48 #include <linux/reboot.h>
49 #include <linux/init.h>
50 #include <linux/kgdb.h>
51 #include <linux/kdb.h>
52 #include <linux/nmi.h>
53 #include <linux/pid.h>
54 #include <linux/smp.h>
55 #include <linux/mm.h>
56 #include <linux/vmacache.h>
57 #include <linux/rcupdate.h>
58 #include <linux/irq.h>
59 
60 #include <asm/cacheflush.h>
61 #include <asm/byteorder.h>
62 #include <linux/atomic.h>
63 
64 #include "debug_core.h"
65 
66 static int kgdb_break_asap;
67 
68 struct debuggerinfo_struct kgdb_info[NR_CPUS];
69 
70 /* kgdb_connected - Is a host GDB connected to us? */
71 int				kgdb_connected;
72 EXPORT_SYMBOL_GPL(kgdb_connected);
73 
74 /* All the KGDB handlers are installed */
75 int			kgdb_io_module_registered;
76 
77 /* Guard for recursive entry */
78 static int			exception_level;
79 
80 struct kgdb_io		*dbg_io_ops;
81 static DEFINE_SPINLOCK(kgdb_registration_lock);
82 
83 /* Action for the reboot notifier, a global allow kdb to change it */
84 static int kgdbreboot;
85 /* kgdb console driver is loaded */
86 static int kgdb_con_registered;
87 /* determine if kgdb console output should be used */
88 static int kgdb_use_con;
89 /* Flag for alternate operations for early debugging */
90 bool dbg_is_early = true;
91 /* Next cpu to become the master debug core */
92 int dbg_switch_cpu;
93 
94 /* Use kdb or gdbserver mode */
95 int dbg_kdb_mode = 1;
96 
97 module_param(kgdb_use_con, int, 0644);
98 module_param(kgdbreboot, int, 0644);
99 
100 /*
101  * Holds information about breakpoints in a kernel. These breakpoints are
102  * added and removed by gdb.
103  */
104 static struct kgdb_bkpt		kgdb_break[KGDB_MAX_BREAKPOINTS] = {
105 	[0 ... KGDB_MAX_BREAKPOINTS-1] = { .state = BP_UNDEFINED }
106 };
107 
108 /*
109  * The CPU# of the active CPU, or -1 if none:
110  */
111 atomic_t			kgdb_active = ATOMIC_INIT(-1);
112 EXPORT_SYMBOL_GPL(kgdb_active);
113 static DEFINE_RAW_SPINLOCK(dbg_master_lock);
114 static DEFINE_RAW_SPINLOCK(dbg_slave_lock);
115 
116 /*
117  * We use NR_CPUs not PERCPU, in case kgdb is used to debug early
118  * bootup code (which might not have percpu set up yet):
119  */
120 static atomic_t			masters_in_kgdb;
121 static atomic_t			slaves_in_kgdb;
122 static atomic_t			kgdb_break_tasklet_var;
123 atomic_t			kgdb_setting_breakpoint;
124 
125 struct task_struct		*kgdb_usethread;
126 struct task_struct		*kgdb_contthread;
127 
128 int				kgdb_single_step;
129 static pid_t			kgdb_sstep_pid;
130 
131 /* to keep track of the CPU which is doing the single stepping*/
132 atomic_t			kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
133 
134 /*
135  * If you are debugging a problem where roundup (the collection of
136  * all other CPUs) is a problem [this should be extremely rare],
137  * then use the nokgdbroundup option to avoid roundup. In that case
138  * the other CPUs might interfere with your debugging context, so
139  * use this with care:
140  */
141 static int kgdb_do_roundup = 1;
142 
opt_nokgdbroundup(char * str)143 static int __init opt_nokgdbroundup(char *str)
144 {
145 	kgdb_do_roundup = 0;
146 
147 	return 0;
148 }
149 
150 early_param("nokgdbroundup", opt_nokgdbroundup);
151 
152 /*
153  * Finally, some KGDB code :-)
154  */
155 
156 /*
157  * Weak aliases for breakpoint management,
158  * can be overridden by architectures when needed:
159  */
kgdb_arch_set_breakpoint(struct kgdb_bkpt * bpt)160 int __weak kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
161 {
162 	int err;
163 
164 	err = copy_from_kernel_nofault(bpt->saved_instr, (char *)bpt->bpt_addr,
165 				BREAK_INSTR_SIZE);
166 	if (err)
167 		return err;
168 	err = copy_to_kernel_nofault((char *)bpt->bpt_addr,
169 				 arch_kgdb_ops.gdb_bpt_instr, BREAK_INSTR_SIZE);
170 	return err;
171 }
172 NOKPROBE_SYMBOL(kgdb_arch_set_breakpoint);
173 
kgdb_arch_remove_breakpoint(struct kgdb_bkpt * bpt)174 int __weak kgdb_arch_remove_breakpoint(struct kgdb_bkpt *bpt)
175 {
176 	return copy_to_kernel_nofault((char *)bpt->bpt_addr,
177 				  (char *)bpt->saved_instr, BREAK_INSTR_SIZE);
178 }
179 NOKPROBE_SYMBOL(kgdb_arch_remove_breakpoint);
180 
kgdb_validate_break_address(unsigned long addr)181 int __weak kgdb_validate_break_address(unsigned long addr)
182 {
183 	struct kgdb_bkpt tmp;
184 	int err;
185 
186 	if (kgdb_within_blocklist(addr))
187 		return -EINVAL;
188 
189 	/* Validate setting the breakpoint and then removing it.  If the
190 	 * remove fails, the kernel needs to emit a bad message because we
191 	 * are deep trouble not being able to put things back the way we
192 	 * found them.
193 	 */
194 	tmp.bpt_addr = addr;
195 	err = kgdb_arch_set_breakpoint(&tmp);
196 	if (err)
197 		return err;
198 	err = kgdb_arch_remove_breakpoint(&tmp);
199 	if (err)
200 		pr_err("Critical breakpoint error, kernel memory destroyed at: %lx\n",
201 		       addr);
202 	return err;
203 }
204 
kgdb_arch_pc(int exception,struct pt_regs * regs)205 unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs)
206 {
207 	return instruction_pointer(regs);
208 }
209 NOKPROBE_SYMBOL(kgdb_arch_pc);
210 
kgdb_arch_init(void)211 int __weak kgdb_arch_init(void)
212 {
213 	return 0;
214 }
215 
kgdb_skipexception(int exception,struct pt_regs * regs)216 int __weak kgdb_skipexception(int exception, struct pt_regs *regs)
217 {
218 	return 0;
219 }
220 NOKPROBE_SYMBOL(kgdb_skipexception);
221 
222 #ifdef CONFIG_SMP
223 
224 /*
225  * Default (weak) implementation for kgdb_roundup_cpus
226  */
227 
228 static DEFINE_PER_CPU(call_single_data_t, kgdb_roundup_csd);
229 
kgdb_call_nmi_hook(void * ignored)230 void __weak kgdb_call_nmi_hook(void *ignored)
231 {
232 	/*
233 	 * NOTE: get_irq_regs() is supposed to get the registers from
234 	 * before the IPI interrupt happened and so is supposed to
235 	 * show where the processor was.  In some situations it's
236 	 * possible we might be called without an IPI, so it might be
237 	 * safer to figure out how to make kgdb_breakpoint() work
238 	 * properly here.
239 	 */
240 	kgdb_nmicallback(raw_smp_processor_id(), get_irq_regs());
241 }
242 NOKPROBE_SYMBOL(kgdb_call_nmi_hook);
243 
kgdb_roundup_cpus(void)244 void __weak kgdb_roundup_cpus(void)
245 {
246 	call_single_data_t *csd;
247 	int this_cpu = raw_smp_processor_id();
248 	int cpu;
249 	int ret;
250 
251 	for_each_online_cpu(cpu) {
252 		/* No need to roundup ourselves */
253 		if (cpu == this_cpu)
254 			continue;
255 
256 		csd = &per_cpu(kgdb_roundup_csd, cpu);
257 
258 		/*
259 		 * If it didn't round up last time, don't try again
260 		 * since smp_call_function_single_async() will block.
261 		 *
262 		 * If rounding_up is false then we know that the
263 		 * previous call must have at least started and that
264 		 * means smp_call_function_single_async() won't block.
265 		 */
266 		if (kgdb_info[cpu].rounding_up)
267 			continue;
268 		kgdb_info[cpu].rounding_up = true;
269 
270 		csd->func = kgdb_call_nmi_hook;
271 		ret = smp_call_function_single_async(cpu, csd);
272 		if (ret)
273 			kgdb_info[cpu].rounding_up = false;
274 	}
275 }
276 NOKPROBE_SYMBOL(kgdb_roundup_cpus);
277 
278 #endif
279 
280 /*
281  * Some architectures need cache flushes when we set/clear a
282  * breakpoint:
283  */
kgdb_flush_swbreak_addr(unsigned long addr)284 static void kgdb_flush_swbreak_addr(unsigned long addr)
285 {
286 	if (!CACHE_FLUSH_IS_SAFE)
287 		return;
288 
289 	if (current->mm) {
290 		int i;
291 
292 		for (i = 0; i < VMACACHE_SIZE; i++) {
293 			if (!current->vmacache.vmas[i])
294 				continue;
295 			flush_cache_range(current->vmacache.vmas[i],
296 					  addr, addr + BREAK_INSTR_SIZE);
297 		}
298 	}
299 
300 	/* Force flush instruction cache if it was outside the mm */
301 	flush_icache_range(addr, addr + BREAK_INSTR_SIZE);
302 }
303 NOKPROBE_SYMBOL(kgdb_flush_swbreak_addr);
304 
305 /*
306  * SW breakpoint management:
307  */
dbg_activate_sw_breakpoints(void)308 int dbg_activate_sw_breakpoints(void)
309 {
310 	int error;
311 	int ret = 0;
312 	int i;
313 
314 	for (i = 0; i < KGDB_MAX_BREAKPOINTS; i++) {
315 		if (kgdb_break[i].state != BP_SET)
316 			continue;
317 
318 		error = kgdb_arch_set_breakpoint(&kgdb_break[i]);
319 		if (error) {
320 			ret = error;
321 			pr_info("BP install failed: %lx\n",
322 				kgdb_break[i].bpt_addr);
323 			continue;
324 		}
325 
326 		kgdb_flush_swbreak_addr(kgdb_break[i].bpt_addr);
327 		kgdb_break[i].state = BP_ACTIVE;
328 	}
329 	return ret;
330 }
331 NOKPROBE_SYMBOL(dbg_activate_sw_breakpoints);
332 
dbg_set_sw_break(unsigned long addr)333 int dbg_set_sw_break(unsigned long addr)
334 {
335 	int err = kgdb_validate_break_address(addr);
336 	int breakno = -1;
337 	int i;
338 
339 	if (err)
340 		return err;
341 
342 	for (i = 0; i < KGDB_MAX_BREAKPOINTS; i++) {
343 		if ((kgdb_break[i].state == BP_SET) &&
344 					(kgdb_break[i].bpt_addr == addr))
345 			return -EEXIST;
346 	}
347 	for (i = 0; i < KGDB_MAX_BREAKPOINTS; i++) {
348 		if (kgdb_break[i].state == BP_REMOVED &&
349 					kgdb_break[i].bpt_addr == addr) {
350 			breakno = i;
351 			break;
352 		}
353 	}
354 
355 	if (breakno == -1) {
356 		for (i = 0; i < KGDB_MAX_BREAKPOINTS; i++) {
357 			if (kgdb_break[i].state == BP_UNDEFINED) {
358 				breakno = i;
359 				break;
360 			}
361 		}
362 	}
363 
364 	if (breakno == -1)
365 		return -E2BIG;
366 
367 	kgdb_break[breakno].state = BP_SET;
368 	kgdb_break[breakno].type = BP_BREAKPOINT;
369 	kgdb_break[breakno].bpt_addr = addr;
370 
371 	return 0;
372 }
373 
dbg_deactivate_sw_breakpoints(void)374 int dbg_deactivate_sw_breakpoints(void)
375 {
376 	int error;
377 	int ret = 0;
378 	int i;
379 
380 	for (i = 0; i < KGDB_MAX_BREAKPOINTS; i++) {
381 		if (kgdb_break[i].state != BP_ACTIVE)
382 			continue;
383 		error = kgdb_arch_remove_breakpoint(&kgdb_break[i]);
384 		if (error) {
385 			pr_info("BP remove failed: %lx\n",
386 				kgdb_break[i].bpt_addr);
387 			ret = error;
388 		}
389 
390 		kgdb_flush_swbreak_addr(kgdb_break[i].bpt_addr);
391 		kgdb_break[i].state = BP_SET;
392 	}
393 	return ret;
394 }
395 NOKPROBE_SYMBOL(dbg_deactivate_sw_breakpoints);
396 
dbg_remove_sw_break(unsigned long addr)397 int dbg_remove_sw_break(unsigned long addr)
398 {
399 	int i;
400 
401 	for (i = 0; i < KGDB_MAX_BREAKPOINTS; i++) {
402 		if ((kgdb_break[i].state == BP_SET) &&
403 				(kgdb_break[i].bpt_addr == addr)) {
404 			kgdb_break[i].state = BP_REMOVED;
405 			return 0;
406 		}
407 	}
408 	return -ENOENT;
409 }
410 
kgdb_isremovedbreak(unsigned long addr)411 int kgdb_isremovedbreak(unsigned long addr)
412 {
413 	int i;
414 
415 	for (i = 0; i < KGDB_MAX_BREAKPOINTS; i++) {
416 		if ((kgdb_break[i].state == BP_REMOVED) &&
417 					(kgdb_break[i].bpt_addr == addr))
418 			return 1;
419 	}
420 	return 0;
421 }
422 
kgdb_has_hit_break(unsigned long addr)423 int kgdb_has_hit_break(unsigned long addr)
424 {
425 	int i;
426 
427 	for (i = 0; i < KGDB_MAX_BREAKPOINTS; i++) {
428 		if (kgdb_break[i].state == BP_ACTIVE &&
429 		    kgdb_break[i].bpt_addr == addr)
430 			return 1;
431 	}
432 	return 0;
433 }
434 
dbg_remove_all_break(void)435 int dbg_remove_all_break(void)
436 {
437 	int error;
438 	int i;
439 
440 	/* Clear memory breakpoints. */
441 	for (i = 0; i < KGDB_MAX_BREAKPOINTS; i++) {
442 		if (kgdb_break[i].state != BP_ACTIVE)
443 			goto setundefined;
444 		error = kgdb_arch_remove_breakpoint(&kgdb_break[i]);
445 		if (error)
446 			pr_err("breakpoint remove failed: %lx\n",
447 			       kgdb_break[i].bpt_addr);
448 setundefined:
449 		kgdb_break[i].state = BP_UNDEFINED;
450 	}
451 
452 	/* Clear hardware breakpoints. */
453 	if (arch_kgdb_ops.remove_all_hw_break)
454 		arch_kgdb_ops.remove_all_hw_break();
455 
456 	return 0;
457 }
458 
459 #ifdef CONFIG_KGDB_KDB
kdb_dump_stack_on_cpu(int cpu)460 void kdb_dump_stack_on_cpu(int cpu)
461 {
462 	if (cpu == raw_smp_processor_id() || !IS_ENABLED(CONFIG_SMP)) {
463 		dump_stack();
464 		return;
465 	}
466 
467 	if (!(kgdb_info[cpu].exception_state & DCPU_IS_SLAVE)) {
468 		kdb_printf("ERROR: Task on cpu %d didn't stop in the debugger\n",
469 			   cpu);
470 		return;
471 	}
472 
473 	/*
474 	 * In general, architectures don't support dumping the stack of a
475 	 * "running" process that's not the current one.  From the point of
476 	 * view of the Linux, kernel processes that are looping in the kgdb
477 	 * slave loop are still "running".  There's also no API (that actually
478 	 * works across all architectures) that can do a stack crawl based
479 	 * on registers passed as a parameter.
480 	 *
481 	 * Solve this conundrum by asking slave CPUs to do the backtrace
482 	 * themselves.
483 	 */
484 	kgdb_info[cpu].exception_state |= DCPU_WANT_BT;
485 	while (kgdb_info[cpu].exception_state & DCPU_WANT_BT)
486 		cpu_relax();
487 }
488 #endif
489 
490 /*
491  * Return true if there is a valid kgdb I/O module.  Also if no
492  * debugger is attached a message can be printed to the console about
493  * waiting for the debugger to attach.
494  *
495  * The print_wait argument is only to be true when called from inside
496  * the core kgdb_handle_exception, because it will wait for the
497  * debugger to attach.
498  */
kgdb_io_ready(int print_wait)499 static int kgdb_io_ready(int print_wait)
500 {
501 	if (!dbg_io_ops)
502 		return 0;
503 	if (kgdb_connected)
504 		return 1;
505 	if (atomic_read(&kgdb_setting_breakpoint))
506 		return 1;
507 	if (print_wait) {
508 #ifdef CONFIG_KGDB_KDB
509 		if (!dbg_kdb_mode)
510 			pr_crit("waiting... or $3#33 for KDB\n");
511 #else
512 		pr_crit("Waiting for remote debugger\n");
513 #endif
514 	}
515 	return 1;
516 }
517 NOKPROBE_SYMBOL(kgdb_io_ready);
518 
kgdb_reenter_check(struct kgdb_state * ks)519 static int kgdb_reenter_check(struct kgdb_state *ks)
520 {
521 	unsigned long addr;
522 
523 	if (atomic_read(&kgdb_active) != raw_smp_processor_id())
524 		return 0;
525 
526 	/* Panic on recursive debugger calls: */
527 	exception_level++;
528 	addr = kgdb_arch_pc(ks->ex_vector, ks->linux_regs);
529 	dbg_deactivate_sw_breakpoints();
530 
531 	/*
532 	 * If the break point removed ok at the place exception
533 	 * occurred, try to recover and print a warning to the end
534 	 * user because the user planted a breakpoint in a place that
535 	 * KGDB needs in order to function.
536 	 */
537 	if (dbg_remove_sw_break(addr) == 0) {
538 		exception_level = 0;
539 		kgdb_skipexception(ks->ex_vector, ks->linux_regs);
540 		dbg_activate_sw_breakpoints();
541 		pr_crit("re-enter error: breakpoint removed %lx\n", addr);
542 		WARN_ON_ONCE(1);
543 
544 		return 1;
545 	}
546 	dbg_remove_all_break();
547 	kgdb_skipexception(ks->ex_vector, ks->linux_regs);
548 
549 	if (exception_level > 1) {
550 		dump_stack();
551 		kgdb_io_module_registered = false;
552 		panic("Recursive entry to debugger");
553 	}
554 
555 	pr_crit("re-enter exception: ALL breakpoints killed\n");
556 #ifdef CONFIG_KGDB_KDB
557 	/* Allow kdb to debug itself one level */
558 	return 0;
559 #endif
560 	dump_stack();
561 	panic("Recursive entry to debugger");
562 
563 	return 1;
564 }
565 NOKPROBE_SYMBOL(kgdb_reenter_check);
566 
dbg_touch_watchdogs(void)567 static void dbg_touch_watchdogs(void)
568 {
569 	touch_softlockup_watchdog_sync();
570 	clocksource_touch_watchdog();
571 	rcu_cpu_stall_reset();
572 }
573 NOKPROBE_SYMBOL(dbg_touch_watchdogs);
574 
kgdb_cpu_enter(struct kgdb_state * ks,struct pt_regs * regs,int exception_state)575 static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs,
576 		int exception_state)
577 {
578 	unsigned long flags;
579 	int sstep_tries = 100;
580 	int error;
581 	int cpu;
582 	int trace_on = 0;
583 	int online_cpus = num_online_cpus();
584 	u64 time_left;
585 
586 	kgdb_info[ks->cpu].enter_kgdb++;
587 	kgdb_info[ks->cpu].exception_state |= exception_state;
588 
589 	if (exception_state == DCPU_WANT_MASTER)
590 		atomic_inc(&masters_in_kgdb);
591 	else
592 		atomic_inc(&slaves_in_kgdb);
593 
594 	if (arch_kgdb_ops.disable_hw_break)
595 		arch_kgdb_ops.disable_hw_break(regs);
596 
597 acquirelock:
598 	rcu_read_lock();
599 	/*
600 	 * Interrupts will be restored by the 'trap return' code, except when
601 	 * single stepping.
602 	 */
603 	local_irq_save(flags);
604 
605 	cpu = ks->cpu;
606 	kgdb_info[cpu].debuggerinfo = regs;
607 	kgdb_info[cpu].task = current;
608 	kgdb_info[cpu].ret_state = 0;
609 	kgdb_info[cpu].irq_depth = hardirq_count() >> HARDIRQ_SHIFT;
610 
611 	/* Make sure the above info reaches the primary CPU */
612 	smp_mb();
613 
614 	if (exception_level == 1) {
615 		if (raw_spin_trylock(&dbg_master_lock))
616 			atomic_xchg(&kgdb_active, cpu);
617 		goto cpu_master_loop;
618 	}
619 
620 	/*
621 	 * CPU will loop if it is a slave or request to become a kgdb
622 	 * master cpu and acquire the kgdb_active lock:
623 	 */
624 	while (1) {
625 cpu_loop:
626 		if (kgdb_info[cpu].exception_state & DCPU_NEXT_MASTER) {
627 			kgdb_info[cpu].exception_state &= ~DCPU_NEXT_MASTER;
628 			goto cpu_master_loop;
629 		} else if (kgdb_info[cpu].exception_state & DCPU_WANT_MASTER) {
630 			if (raw_spin_trylock(&dbg_master_lock)) {
631 				atomic_xchg(&kgdb_active, cpu);
632 				break;
633 			}
634 		} else if (kgdb_info[cpu].exception_state & DCPU_WANT_BT) {
635 			dump_stack();
636 			kgdb_info[cpu].exception_state &= ~DCPU_WANT_BT;
637 		} else if (kgdb_info[cpu].exception_state & DCPU_IS_SLAVE) {
638 			if (!raw_spin_is_locked(&dbg_slave_lock))
639 				goto return_normal;
640 		} else {
641 return_normal:
642 			/* Return to normal operation by executing any
643 			 * hw breakpoint fixup.
644 			 */
645 			if (arch_kgdb_ops.correct_hw_break)
646 				arch_kgdb_ops.correct_hw_break();
647 			if (trace_on)
648 				tracing_on();
649 			kgdb_info[cpu].debuggerinfo = NULL;
650 			kgdb_info[cpu].task = NULL;
651 			kgdb_info[cpu].exception_state &=
652 				~(DCPU_WANT_MASTER | DCPU_IS_SLAVE);
653 			kgdb_info[cpu].enter_kgdb--;
654 			smp_mb__before_atomic();
655 			atomic_dec(&slaves_in_kgdb);
656 			dbg_touch_watchdogs();
657 			local_irq_restore(flags);
658 			rcu_read_unlock();
659 			return 0;
660 		}
661 		cpu_relax();
662 	}
663 
664 	/*
665 	 * For single stepping, try to only enter on the processor
666 	 * that was single stepping.  To guard against a deadlock, the
667 	 * kernel will only try for the value of sstep_tries before
668 	 * giving up and continuing on.
669 	 */
670 	if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
671 	    (kgdb_info[cpu].task &&
672 	     kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) {
673 		atomic_set(&kgdb_active, -1);
674 		raw_spin_unlock(&dbg_master_lock);
675 		dbg_touch_watchdogs();
676 		local_irq_restore(flags);
677 		rcu_read_unlock();
678 
679 		goto acquirelock;
680 	}
681 
682 	if (!kgdb_io_ready(1)) {
683 		kgdb_info[cpu].ret_state = 1;
684 		goto kgdb_restore; /* No I/O connection, resume the system */
685 	}
686 
687 	/*
688 	 * Don't enter if we have hit a removed breakpoint.
689 	 */
690 	if (kgdb_skipexception(ks->ex_vector, ks->linux_regs))
691 		goto kgdb_restore;
692 
693 	atomic_inc(&ignore_console_lock_warning);
694 
695 	/* Call the I/O driver's pre_exception routine */
696 	if (dbg_io_ops->pre_exception)
697 		dbg_io_ops->pre_exception();
698 
699 	/*
700 	 * Get the passive CPU lock which will hold all the non-primary
701 	 * CPU in a spin state while the debugger is active
702 	 */
703 	if (!kgdb_single_step)
704 		raw_spin_lock(&dbg_slave_lock);
705 
706 #ifdef CONFIG_SMP
707 	/* If send_ready set, slaves are already waiting */
708 	if (ks->send_ready)
709 		atomic_set(ks->send_ready, 1);
710 
711 	/* Signal the other CPUs to enter kgdb_wait() */
712 	else if ((!kgdb_single_step) && kgdb_do_roundup)
713 		kgdb_roundup_cpus();
714 #endif
715 
716 	/*
717 	 * Wait for the other CPUs to be notified and be waiting for us:
718 	 */
719 	time_left = MSEC_PER_SEC;
720 	while (kgdb_do_roundup && --time_left &&
721 	       (atomic_read(&masters_in_kgdb) + atomic_read(&slaves_in_kgdb)) !=
722 		   online_cpus)
723 		udelay(1000);
724 	if (!time_left)
725 		pr_crit("Timed out waiting for secondary CPUs.\n");
726 
727 	/*
728 	 * At this point the primary processor is completely
729 	 * in the debugger and all secondary CPUs are quiescent
730 	 */
731 	dbg_deactivate_sw_breakpoints();
732 	kgdb_single_step = 0;
733 	kgdb_contthread = current;
734 	exception_level = 0;
735 	trace_on = tracing_is_on();
736 	if (trace_on)
737 		tracing_off();
738 
739 	while (1) {
740 cpu_master_loop:
741 		if (dbg_kdb_mode) {
742 			kgdb_connected = 1;
743 			error = kdb_stub(ks);
744 			if (error == -1)
745 				continue;
746 			kgdb_connected = 0;
747 		} else {
748 			error = gdb_serial_stub(ks);
749 		}
750 
751 		if (error == DBG_PASS_EVENT) {
752 			dbg_kdb_mode = !dbg_kdb_mode;
753 		} else if (error == DBG_SWITCH_CPU_EVENT) {
754 			kgdb_info[dbg_switch_cpu].exception_state |=
755 				DCPU_NEXT_MASTER;
756 			goto cpu_loop;
757 		} else {
758 			kgdb_info[cpu].ret_state = error;
759 			break;
760 		}
761 	}
762 
763 	dbg_activate_sw_breakpoints();
764 
765 	/* Call the I/O driver's post_exception routine */
766 	if (dbg_io_ops->post_exception)
767 		dbg_io_ops->post_exception();
768 
769 	atomic_dec(&ignore_console_lock_warning);
770 
771 	if (!kgdb_single_step) {
772 		raw_spin_unlock(&dbg_slave_lock);
773 		/* Wait till all the CPUs have quit from the debugger. */
774 		while (kgdb_do_roundup && atomic_read(&slaves_in_kgdb))
775 			cpu_relax();
776 	}
777 
778 kgdb_restore:
779 	if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
780 		int sstep_cpu = atomic_read(&kgdb_cpu_doing_single_step);
781 		if (kgdb_info[sstep_cpu].task)
782 			kgdb_sstep_pid = kgdb_info[sstep_cpu].task->pid;
783 		else
784 			kgdb_sstep_pid = 0;
785 	}
786 	if (arch_kgdb_ops.correct_hw_break)
787 		arch_kgdb_ops.correct_hw_break();
788 	if (trace_on)
789 		tracing_on();
790 
791 	kgdb_info[cpu].debuggerinfo = NULL;
792 	kgdb_info[cpu].task = NULL;
793 	kgdb_info[cpu].exception_state &=
794 		~(DCPU_WANT_MASTER | DCPU_IS_SLAVE);
795 	kgdb_info[cpu].enter_kgdb--;
796 	smp_mb__before_atomic();
797 	atomic_dec(&masters_in_kgdb);
798 	/* Free kgdb_active */
799 	atomic_set(&kgdb_active, -1);
800 	raw_spin_unlock(&dbg_master_lock);
801 	dbg_touch_watchdogs();
802 	local_irq_restore(flags);
803 	rcu_read_unlock();
804 
805 	return kgdb_info[cpu].ret_state;
806 }
807 NOKPROBE_SYMBOL(kgdb_cpu_enter);
808 
809 /*
810  * kgdb_handle_exception() - main entry point from a kernel exception
811  *
812  * Locking hierarchy:
813  *	interface locks, if any (begin_session)
814  *	kgdb lock (kgdb_active)
815  */
816 int
kgdb_handle_exception(int evector,int signo,int ecode,struct pt_regs * regs)817 kgdb_handle_exception(int evector, int signo, int ecode, struct pt_regs *regs)
818 {
819 	struct kgdb_state kgdb_var;
820 	struct kgdb_state *ks = &kgdb_var;
821 	int ret = 0;
822 
823 	if (arch_kgdb_ops.enable_nmi)
824 		arch_kgdb_ops.enable_nmi(0);
825 	/*
826 	 * Avoid entering the debugger if we were triggered due to an oops
827 	 * but panic_timeout indicates the system should automatically
828 	 * reboot on panic. We don't want to get stuck waiting for input
829 	 * on such systems, especially if its "just" an oops.
830 	 */
831 	if (signo != SIGTRAP && panic_timeout)
832 		return 1;
833 
834 	memset(ks, 0, sizeof(struct kgdb_state));
835 	ks->cpu			= raw_smp_processor_id();
836 	ks->ex_vector		= evector;
837 	ks->signo		= signo;
838 	ks->err_code		= ecode;
839 	ks->linux_regs		= regs;
840 
841 	if (kgdb_reenter_check(ks))
842 		goto out; /* Ouch, double exception ! */
843 	if (kgdb_info[ks->cpu].enter_kgdb != 0)
844 		goto out;
845 
846 	ret = kgdb_cpu_enter(ks, regs, DCPU_WANT_MASTER);
847 out:
848 	if (arch_kgdb_ops.enable_nmi)
849 		arch_kgdb_ops.enable_nmi(1);
850 	return ret;
851 }
852 NOKPROBE_SYMBOL(kgdb_handle_exception);
853 
854 /*
855  * GDB places a breakpoint at this function to know dynamically loaded objects.
856  */
module_event(struct notifier_block * self,unsigned long val,void * data)857 static int module_event(struct notifier_block *self, unsigned long val,
858 	void *data)
859 {
860 	return 0;
861 }
862 
863 static struct notifier_block dbg_module_load_nb = {
864 	.notifier_call	= module_event,
865 };
866 
kgdb_nmicallback(int cpu,void * regs)867 int kgdb_nmicallback(int cpu, void *regs)
868 {
869 #ifdef CONFIG_SMP
870 	struct kgdb_state kgdb_var;
871 	struct kgdb_state *ks = &kgdb_var;
872 
873 	kgdb_info[cpu].rounding_up = false;
874 
875 	memset(ks, 0, sizeof(struct kgdb_state));
876 	ks->cpu			= cpu;
877 	ks->linux_regs		= regs;
878 
879 	if (kgdb_info[ks->cpu].enter_kgdb == 0 &&
880 			raw_spin_is_locked(&dbg_master_lock)) {
881 		kgdb_cpu_enter(ks, regs, DCPU_IS_SLAVE);
882 		return 0;
883 	}
884 #endif
885 	return 1;
886 }
887 NOKPROBE_SYMBOL(kgdb_nmicallback);
888 
kgdb_nmicallin(int cpu,int trapnr,void * regs,int err_code,atomic_t * send_ready)889 int kgdb_nmicallin(int cpu, int trapnr, void *regs, int err_code,
890 							atomic_t *send_ready)
891 {
892 #ifdef CONFIG_SMP
893 	if (!kgdb_io_ready(0) || !send_ready)
894 		return 1;
895 
896 	if (kgdb_info[cpu].enter_kgdb == 0) {
897 		struct kgdb_state kgdb_var;
898 		struct kgdb_state *ks = &kgdb_var;
899 
900 		memset(ks, 0, sizeof(struct kgdb_state));
901 		ks->cpu			= cpu;
902 		ks->ex_vector		= trapnr;
903 		ks->signo		= SIGTRAP;
904 		ks->err_code		= err_code;
905 		ks->linux_regs		= regs;
906 		ks->send_ready		= send_ready;
907 		kgdb_cpu_enter(ks, regs, DCPU_WANT_MASTER);
908 		return 0;
909 	}
910 #endif
911 	return 1;
912 }
913 NOKPROBE_SYMBOL(kgdb_nmicallin);
914 
kgdb_console_write(struct console * co,const char * s,unsigned count)915 static void kgdb_console_write(struct console *co, const char *s,
916    unsigned count)
917 {
918 	unsigned long flags;
919 
920 	/* If we're debugging, or KGDB has not connected, don't try
921 	 * and print. */
922 	if (!kgdb_connected || atomic_read(&kgdb_active) != -1 || dbg_kdb_mode)
923 		return;
924 
925 	local_irq_save(flags);
926 	gdbstub_msg_write(s, count);
927 	local_irq_restore(flags);
928 }
929 
930 static struct console kgdbcons = {
931 	.name		= "kgdb",
932 	.write		= kgdb_console_write,
933 	.flags		= CON_PRINTBUFFER | CON_ENABLED,
934 	.index		= -1,
935 };
936 
opt_kgdb_con(char * str)937 static int __init opt_kgdb_con(char *str)
938 {
939 	kgdb_use_con = 1;
940 
941 	if (kgdb_io_module_registered && !kgdb_con_registered) {
942 		register_console(&kgdbcons);
943 		kgdb_con_registered = 1;
944 	}
945 
946 	return 0;
947 }
948 
949 early_param("kgdbcon", opt_kgdb_con);
950 
951 #ifdef CONFIG_MAGIC_SYSRQ
sysrq_handle_dbg(int key)952 static void sysrq_handle_dbg(int key)
953 {
954 	if (!dbg_io_ops) {
955 		pr_crit("ERROR: No KGDB I/O module available\n");
956 		return;
957 	}
958 	if (!kgdb_connected) {
959 #ifdef CONFIG_KGDB_KDB
960 		if (!dbg_kdb_mode)
961 			pr_crit("KGDB or $3#33 for KDB\n");
962 #else
963 		pr_crit("Entering KGDB\n");
964 #endif
965 	}
966 
967 	kgdb_breakpoint();
968 }
969 
970 static const struct sysrq_key_op sysrq_dbg_op = {
971 	.handler	= sysrq_handle_dbg,
972 	.help_msg	= "debug(g)",
973 	.action_msg	= "DEBUG",
974 };
975 #endif
976 
kgdb_panic(const char * msg)977 void kgdb_panic(const char *msg)
978 {
979 	if (!kgdb_io_module_registered)
980 		return;
981 
982 	/*
983 	 * We don't want to get stuck waiting for input from user if
984 	 * "panic_timeout" indicates the system should automatically
985 	 * reboot on panic.
986 	 */
987 	if (panic_timeout)
988 		return;
989 
990 	if (dbg_kdb_mode)
991 		kdb_printf("PANIC: %s\n", msg);
992 
993 	kgdb_breakpoint();
994 }
995 
kgdb_initial_breakpoint(void)996 static void kgdb_initial_breakpoint(void)
997 {
998 	kgdb_break_asap = 0;
999 
1000 	pr_crit("Waiting for connection from remote gdb...\n");
1001 	kgdb_breakpoint();
1002 }
1003 
kgdb_arch_late(void)1004 void __weak kgdb_arch_late(void)
1005 {
1006 }
1007 
dbg_late_init(void)1008 void __init dbg_late_init(void)
1009 {
1010 	dbg_is_early = false;
1011 	if (kgdb_io_module_registered)
1012 		kgdb_arch_late();
1013 	kdb_init(KDB_INIT_FULL);
1014 
1015 	if (kgdb_io_module_registered && kgdb_break_asap)
1016 		kgdb_initial_breakpoint();
1017 }
1018 
1019 static int
dbg_notify_reboot(struct notifier_block * this,unsigned long code,void * x)1020 dbg_notify_reboot(struct notifier_block *this, unsigned long code, void *x)
1021 {
1022 	/*
1023 	 * Take the following action on reboot notify depending on value:
1024 	 *    1 == Enter debugger
1025 	 *    0 == [the default] detatch debug client
1026 	 *   -1 == Do nothing... and use this until the board resets
1027 	 */
1028 	switch (kgdbreboot) {
1029 	case 1:
1030 		kgdb_breakpoint();
1031 	case -1:
1032 		goto done;
1033 	}
1034 	if (!dbg_kdb_mode)
1035 		gdbstub_exit(code);
1036 done:
1037 	return NOTIFY_DONE;
1038 }
1039 
1040 static struct notifier_block dbg_reboot_notifier = {
1041 	.notifier_call		= dbg_notify_reboot,
1042 	.next			= NULL,
1043 	.priority		= INT_MAX,
1044 };
1045 
kgdb_register_callbacks(void)1046 static void kgdb_register_callbacks(void)
1047 {
1048 	if (!kgdb_io_module_registered) {
1049 		kgdb_io_module_registered = 1;
1050 		kgdb_arch_init();
1051 		if (!dbg_is_early)
1052 			kgdb_arch_late();
1053 		register_module_notifier(&dbg_module_load_nb);
1054 		register_reboot_notifier(&dbg_reboot_notifier);
1055 #ifdef CONFIG_MAGIC_SYSRQ
1056 		register_sysrq_key('g', &sysrq_dbg_op);
1057 #endif
1058 		if (kgdb_use_con && !kgdb_con_registered) {
1059 			register_console(&kgdbcons);
1060 			kgdb_con_registered = 1;
1061 		}
1062 	}
1063 }
1064 
kgdb_unregister_callbacks(void)1065 static void kgdb_unregister_callbacks(void)
1066 {
1067 	/*
1068 	 * When this routine is called KGDB should unregister from
1069 	 * handlers and clean up, making sure it is not handling any
1070 	 * break exceptions at the time.
1071 	 */
1072 	if (kgdb_io_module_registered) {
1073 		kgdb_io_module_registered = 0;
1074 		unregister_reboot_notifier(&dbg_reboot_notifier);
1075 		unregister_module_notifier(&dbg_module_load_nb);
1076 		kgdb_arch_exit();
1077 #ifdef CONFIG_MAGIC_SYSRQ
1078 		unregister_sysrq_key('g', &sysrq_dbg_op);
1079 #endif
1080 		if (kgdb_con_registered) {
1081 			unregister_console(&kgdbcons);
1082 			kgdb_con_registered = 0;
1083 		}
1084 	}
1085 }
1086 
1087 /*
1088  * There are times a tasklet needs to be used vs a compiled in
1089  * break point so as to cause an exception outside a kgdb I/O module,
1090  * such as is the case with kgdboe, where calling a breakpoint in the
1091  * I/O driver itself would be fatal.
1092  */
kgdb_tasklet_bpt(unsigned long ing)1093 static void kgdb_tasklet_bpt(unsigned long ing)
1094 {
1095 	kgdb_breakpoint();
1096 	atomic_set(&kgdb_break_tasklet_var, 0);
1097 }
1098 
1099 static DECLARE_TASKLET_OLD(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt);
1100 
kgdb_schedule_breakpoint(void)1101 void kgdb_schedule_breakpoint(void)
1102 {
1103 	if (atomic_read(&kgdb_break_tasklet_var) ||
1104 		atomic_read(&kgdb_active) != -1 ||
1105 		atomic_read(&kgdb_setting_breakpoint))
1106 		return;
1107 	atomic_inc(&kgdb_break_tasklet_var);
1108 	tasklet_schedule(&kgdb_tasklet_breakpoint);
1109 }
1110 EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint);
1111 
1112 /**
1113  *	kgdb_register_io_module - register KGDB IO module
1114  *	@new_dbg_io_ops: the io ops vector
1115  *
1116  *	Register it with the KGDB core.
1117  */
kgdb_register_io_module(struct kgdb_io * new_dbg_io_ops)1118 int kgdb_register_io_module(struct kgdb_io *new_dbg_io_ops)
1119 {
1120 	struct kgdb_io *old_dbg_io_ops;
1121 	int err;
1122 
1123 	spin_lock(&kgdb_registration_lock);
1124 
1125 	old_dbg_io_ops = dbg_io_ops;
1126 	if (old_dbg_io_ops) {
1127 		if (!old_dbg_io_ops->deinit) {
1128 			spin_unlock(&kgdb_registration_lock);
1129 
1130 			pr_err("KGDB I/O driver %s can't replace %s.\n",
1131 				new_dbg_io_ops->name, old_dbg_io_ops->name);
1132 			return -EBUSY;
1133 		}
1134 		pr_info("Replacing I/O driver %s with %s\n",
1135 			old_dbg_io_ops->name, new_dbg_io_ops->name);
1136 	}
1137 
1138 	if (new_dbg_io_ops->init) {
1139 		err = new_dbg_io_ops->init();
1140 		if (err) {
1141 			spin_unlock(&kgdb_registration_lock);
1142 			return err;
1143 		}
1144 	}
1145 
1146 	dbg_io_ops = new_dbg_io_ops;
1147 
1148 	spin_unlock(&kgdb_registration_lock);
1149 
1150 	if (old_dbg_io_ops) {
1151 		old_dbg_io_ops->deinit();
1152 		return 0;
1153 	}
1154 
1155 	pr_info("Registered I/O driver %s\n", new_dbg_io_ops->name);
1156 
1157 	/* Arm KGDB now. */
1158 	kgdb_register_callbacks();
1159 
1160 	if (kgdb_break_asap &&
1161 	    (!dbg_is_early || IS_ENABLED(CONFIG_ARCH_HAS_EARLY_DEBUG)))
1162 		kgdb_initial_breakpoint();
1163 
1164 	return 0;
1165 }
1166 EXPORT_SYMBOL_GPL(kgdb_register_io_module);
1167 
1168 /**
1169  *	kkgdb_unregister_io_module - unregister KGDB IO module
1170  *	@old_dbg_io_ops: the io ops vector
1171  *
1172  *	Unregister it with the KGDB core.
1173  */
kgdb_unregister_io_module(struct kgdb_io * old_dbg_io_ops)1174 void kgdb_unregister_io_module(struct kgdb_io *old_dbg_io_ops)
1175 {
1176 	BUG_ON(kgdb_connected);
1177 
1178 	/*
1179 	 * KGDB is no longer able to communicate out, so
1180 	 * unregister our callbacks and reset state.
1181 	 */
1182 	kgdb_unregister_callbacks();
1183 
1184 	spin_lock(&kgdb_registration_lock);
1185 
1186 	WARN_ON_ONCE(dbg_io_ops != old_dbg_io_ops);
1187 	dbg_io_ops = NULL;
1188 
1189 	spin_unlock(&kgdb_registration_lock);
1190 
1191 	if (old_dbg_io_ops->deinit)
1192 		old_dbg_io_ops->deinit();
1193 
1194 	pr_info("Unregistered I/O driver %s, debugger disabled\n",
1195 		old_dbg_io_ops->name);
1196 }
1197 EXPORT_SYMBOL_GPL(kgdb_unregister_io_module);
1198 
dbg_io_get_char(void)1199 int dbg_io_get_char(void)
1200 {
1201 	int ret = dbg_io_ops->read_char();
1202 	if (ret == NO_POLL_CHAR)
1203 		return -1;
1204 	if (!dbg_kdb_mode)
1205 		return ret;
1206 	if (ret == 127)
1207 		return 8;
1208 	return ret;
1209 }
1210 
1211 /**
1212  * kgdb_breakpoint - generate breakpoint exception
1213  *
1214  * This function will generate a breakpoint exception.  It is used at the
1215  * beginning of a program to sync up with a debugger and can be used
1216  * otherwise as a quick means to stop program execution and "break" into
1217  * the debugger.
1218  */
kgdb_breakpoint(void)1219 noinline void kgdb_breakpoint(void)
1220 {
1221 	atomic_inc(&kgdb_setting_breakpoint);
1222 	wmb(); /* Sync point before breakpoint */
1223 	arch_kgdb_breakpoint();
1224 	wmb(); /* Sync point after breakpoint */
1225 	atomic_dec(&kgdb_setting_breakpoint);
1226 }
1227 EXPORT_SYMBOL_GPL(kgdb_breakpoint);
1228 
opt_kgdb_wait(char * str)1229 static int __init opt_kgdb_wait(char *str)
1230 {
1231 	kgdb_break_asap = 1;
1232 
1233 	kdb_init(KDB_INIT_EARLY);
1234 	if (kgdb_io_module_registered &&
1235 	    IS_ENABLED(CONFIG_ARCH_HAS_EARLY_DEBUG))
1236 		kgdb_initial_breakpoint();
1237 
1238 	return 0;
1239 }
1240 
1241 early_param("kgdbwait", opt_kgdb_wait);
1242