libpayload: Add remote GDB support
This patch adds the ability to attach a GDB host through the UART to a
running payload. Libpayload implements a small stub that can parse and
respond to the GDB remote protocol and provide the required primitives
(reading/writing registers/memory, etc.) to allow GDB to control
execution.
The goal of this implementation is to be as small and uninvasive as
possible. It implements only the minimum amount of primitives required,
and relies on GDB's impressive workaround capabilities (such as
emulating breakpoints by temporarily replacing instructions) for the
more complicated features. This way, a relatively tiny amount of code on
the firmware side opens a vast range of capabilities to the user, not
just in debugging but also in remote-controlling the firmware to change
its behavior (e.g. through GDBs ability to modify variables and call
functions).
By default, a system with the REMOTEGDB Kconfig will only trap into GDB
when executing halt() (including the calls from die_if(), assert(), and
exception handlers). In addition, payloads can manually call gdb_enter()
if desired. It will print a final "Ready for GDB connection." on the
serial, detach the normal serial output driver and wait for the commands
that GDB starts sending on attach.
Based on original implementation by Gabe Black <gabeblack@chromium.org>.
BUG=chrome-os-partner:18390
TEST=Boot a GDB enabled image in recovery mode (or get it to hit a
halt()), close your terminal, execute '<toolchain>-gdb --symbols
/build/<board>/firmware/depthcharge_gdb/depthcharge.elf --directory
~/trunk/src/third_party/coreboot/payloads/libpayload --directory
~/trunk/src/platform/depthcharge --directory
~/trunk/src/platform/vboot_reference --ex "target remote
<cpu_uart_pty>"' and behold the magic.
(You can also SIGSTOP your terminal's parent shell and the terminal
itself, and SIGCONT them in reverse order after GDB exits. More
convenient wrapper tools to do all this automatically coming soon.)
Original-Change-Id: Ib440d1804126cdfdac4a8801f5015b4487e25269
Original-Signed-off-by: Julius Werner <jwerner@chromium.org>
Original-Reviewed-on: https://chromium-review.googlesource.com/202563
Original-Reviewed-by: Stefan Reinauer <reinauer@chromium.org>
(cherry picked from commit 9c4a642c7be2faf122fef39bdfaddd64aec68b77)
Signed-off-by: Marc Jones <marc.jones@se-eng.com>
Change-Id: I9238b4eb19d3ab2c98e4e1c5946cd7d252ca3c3b
Reviewed-on: http://review.coreboot.org/8119
Tested-by: build bot (Jenkins)
Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
2014-05-15 20:57:38 +02:00
|
|
|
/*
|
|
|
|
* Copyright 2014 Google Inc.
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License as
|
|
|
|
* published by the Free Software Foundation; either version 2 of
|
|
|
|
* the License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but without any warranty; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <gdb.h>
|
|
|
|
#include <libpayload.h>
|
|
|
|
|
|
|
|
struct gdb_state gdb_state;
|
|
|
|
|
|
|
|
static u8 reply_buf[2048];
|
|
|
|
static u8 command_buf[2048];
|
|
|
|
|
|
|
|
static struct gdb_message command = {
|
|
|
|
.buf = command_buf,
|
|
|
|
.used = 0,
|
|
|
|
.size = sizeof(command_buf),
|
|
|
|
};
|
|
|
|
static struct gdb_message reply = {
|
|
|
|
.buf = reply_buf,
|
|
|
|
.used = 0,
|
|
|
|
.size = sizeof(reply_buf),
|
|
|
|
};
|
|
|
|
|
|
|
|
void gdb_command_loop(u8 signal)
|
|
|
|
{
|
|
|
|
if (gdb_state.resumed) {
|
|
|
|
/* We were just running. Send a stop reply. */
|
|
|
|
reply.used = 0;
|
|
|
|
gdb_message_add_string(&reply, "S");
|
|
|
|
gdb_message_encode_bytes(&reply, &signal, 1);
|
|
|
|
gdb_send_reply(&reply);
|
|
|
|
|
|
|
|
}
|
|
|
|
gdb_state.signal = signal;
|
|
|
|
gdb_state.resumed = 0;
|
|
|
|
gdb_state.connected = 1;
|
|
|
|
|
|
|
|
while (1) {
|
|
|
|
int i;
|
|
|
|
|
|
|
|
gdb_get_command(&command);
|
|
|
|
|
|
|
|
reply.used = 0;
|
|
|
|
for (i = 0; i < gdb_command_count; i++) {
|
|
|
|
int clen = strlen(gdb_commands[i].str);
|
|
|
|
if (!strncmp(gdb_commands[i].str, (char *)command.buf,
|
|
|
|
MIN(clen, command.used))) {
|
|
|
|
gdb_commands[i].handler(&command, clen, &reply);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* If we're resuming, we won't send a reply until we stop. */
|
|
|
|
if (gdb_state.resumed)
|
|
|
|
return;
|
|
|
|
|
|
|
|
gdb_send_reply(&reply);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static void gdb_output_write(const void *buffer, size_t count)
|
|
|
|
{
|
|
|
|
if (!gdb_state.resumed) {
|
|
|
|
/* Must be a die_if() in GDB (or a bug), so bail out and die. */
|
|
|
|
gdb_exit(-1);
|
2020-06-18 09:55:30 +02:00
|
|
|
if (CONFIG(LP_VIDEO_CONSOLE))
|
|
|
|
video_console_init();
|
libpayload: Add remote GDB support
This patch adds the ability to attach a GDB host through the UART to a
running payload. Libpayload implements a small stub that can parse and
respond to the GDB remote protocol and provide the required primitives
(reading/writing registers/memory, etc.) to allow GDB to control
execution.
The goal of this implementation is to be as small and uninvasive as
possible. It implements only the minimum amount of primitives required,
and relies on GDB's impressive workaround capabilities (such as
emulating breakpoints by temporarily replacing instructions) for the
more complicated features. This way, a relatively tiny amount of code on
the firmware side opens a vast range of capabilities to the user, not
just in debugging but also in remote-controlling the firmware to change
its behavior (e.g. through GDBs ability to modify variables and call
functions).
By default, a system with the REMOTEGDB Kconfig will only trap into GDB
when executing halt() (including the calls from die_if(), assert(), and
exception handlers). In addition, payloads can manually call gdb_enter()
if desired. It will print a final "Ready for GDB connection." on the
serial, detach the normal serial output driver and wait for the commands
that GDB starts sending on attach.
Based on original implementation by Gabe Black <gabeblack@chromium.org>.
BUG=chrome-os-partner:18390
TEST=Boot a GDB enabled image in recovery mode (or get it to hit a
halt()), close your terminal, execute '<toolchain>-gdb --symbols
/build/<board>/firmware/depthcharge_gdb/depthcharge.elf --directory
~/trunk/src/third_party/coreboot/payloads/libpayload --directory
~/trunk/src/platform/depthcharge --directory
~/trunk/src/platform/vboot_reference --ex "target remote
<cpu_uart_pty>"' and behold the magic.
(You can also SIGSTOP your terminal's parent shell and the terminal
itself, and SIGCONT them in reverse order after GDB exits. More
convenient wrapper tools to do all this automatically coming soon.)
Original-Change-Id: Ib440d1804126cdfdac4a8801f5015b4487e25269
Original-Signed-off-by: Julius Werner <jwerner@chromium.org>
Original-Reviewed-on: https://chromium-review.googlesource.com/202563
Original-Reviewed-by: Stefan Reinauer <reinauer@chromium.org>
(cherry picked from commit 9c4a642c7be2faf122fef39bdfaddd64aec68b77)
Signed-off-by: Marc Jones <marc.jones@se-eng.com>
Change-Id: I9238b4eb19d3ab2c98e4e1c5946cd7d252ca3c3b
Reviewed-on: http://review.coreboot.org/8119
Tested-by: build bot (Jenkins)
Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
2014-05-15 20:57:38 +02:00
|
|
|
puts("GDB died, redirecting its last words to the screen:\n");
|
|
|
|
console_write(buffer, count);
|
|
|
|
} else {
|
|
|
|
reply.used = 0;
|
|
|
|
reply.buf[reply.used++] = 'O';
|
|
|
|
gdb_message_encode_bytes(&reply, buffer, count);
|
|
|
|
gdb_send_reply(&reply);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static struct console_output_driver gdb_output_driver = {
|
|
|
|
.write = &gdb_output_write
|
|
|
|
};
|
|
|
|
|
|
|
|
static void gdb_init(void)
|
|
|
|
{
|
|
|
|
printf("Ready for GDB connection.\n");
|
|
|
|
gdb_transport_init();
|
|
|
|
gdb_arch_init();
|
|
|
|
console_add_output_driver(&gdb_output_driver);
|
|
|
|
}
|
|
|
|
|
|
|
|
void gdb_enter(void)
|
|
|
|
{
|
|
|
|
if (!gdb_state.connected)
|
|
|
|
gdb_init();
|
|
|
|
gdb_arch_enter();
|
|
|
|
}
|
|
|
|
|
|
|
|
void gdb_exit(s8 exit_status)
|
|
|
|
{
|
|
|
|
if (!gdb_state.connected)
|
|
|
|
return;
|
|
|
|
|
|
|
|
reply.used = 0;
|
|
|
|
gdb_message_add_string(&reply, "W");
|
|
|
|
gdb_message_encode_bytes(&reply, &exit_status, 1);
|
|
|
|
gdb_send_reply(&reply);
|
|
|
|
|
|
|
|
console_remove_output_driver(&gdb_output_write);
|
|
|
|
gdb_transport_teardown();
|
|
|
|
gdb_state.connected = 0;
|
|
|
|
printf("Detached from GDB connection.\n");
|
|
|
|
}
|
2018-10-11 00:54:10 +02:00
|
|
|
|
|
|
|
/*
|
|
|
|
* This is a check architecture backends can run before entering the GDB command
|
|
|
|
* loop during exception handling. If it returns true, GDB was already running
|
|
|
|
* and must have caused an exception itself, which may happen if the GDB server
|
|
|
|
* tells us to do something stupid (e.g. write to an unmapped address). In that
|
|
|
|
* case, all we can do is blindly send a generic error code (since we're not
|
|
|
|
* sure which command caused the exception) and continue serving commands. When
|
|
|
|
* GDB eventually tells us to resume, we'll return from this function to the
|
|
|
|
* architecture backend which will have to do a "super exception return" that
|
|
|
|
* returns right back from the original (outermost) exception, "jumping over"
|
|
|
|
* all the intermediate exception frames we may have accumulated since. (This is
|
|
|
|
* the best we can do because our architecture backends generally don't support
|
|
|
|
* "full", unlimited exception reentrancy.)
|
|
|
|
*/
|
|
|
|
int gdb_handle_reentrant_exception(void)
|
|
|
|
{
|
|
|
|
if (!gdb_state.connected || gdb_state.resumed)
|
|
|
|
return 0; /* This is not a reentrant exception. */
|
|
|
|
|
|
|
|
static const char error_code[] = "E22"; /* EINVAL? */
|
|
|
|
static const struct gdb_message tmp_reply = {
|
|
|
|
.buf = (u8 *)error_code,
|
|
|
|
.used = sizeof(error_code),
|
|
|
|
.size = sizeof(error_code),
|
|
|
|
};
|
|
|
|
gdb_send_reply(&tmp_reply);
|
|
|
|
gdb_command_loop(gdb_state.signal); /* preserve old signal */
|
|
|
|
return 1;
|
|
|
|
}
|