As Alan indicted, mechanisms for emulating single step
behavior have long existed for MIPS and Linux. Newer
MIPS parts which implement the EJTAG debug system
do have a single-step mode, but they trap to Debug mode,
rather than to the kernel - this allows kernel code to be
single-stepped using an EJTAG probe. If the system
allows for it - one needs to have ROM at the right location
which transfers Debug mode control back to the kernel - it
is possible to exploit EJTAG debug features from an OS
kernel. We''ve prototyped this to prove that it works, but
never went so far as to wire up EJTAG signle-step mode
to a ptrace or other debug API. If for some strange reason
the standard emulation mechanism isn't adequate for you
(e.g. if your applicaiton is executing out of ROM), you
do have this as a potential alternative. But it would not
be a trivial hack.
Well this is ok ..but I am trying to implement kenel debugger..
something like system tap.
And I have started with kprobe..
where the kernel code execution will be stopped at user specified
address using break, how do i single step that instruction to decode
the instruction and print the registers value..?
~Nida
On Mon, Sep 04, 2006 at 10:27:12AM +0530, Nida M wrote:
Well this is ok ..but I am trying to implement kenel debugger..
something like system tap.
And I have started with kprobe..
where the kernel code execution will be stopped at user specified
address using break, how do i single step that instruction to decode
the instruction and print the registers value..?
Insert a breakpoint instruction after the instruction you want to single
step. Anything that triggers an exception but typicall a "break 0" would
be used for debuggers. Branches need special care. Either they need to
be executed in software or breakpoints at both the branch-taken and the
not-taken address need to be inserted.
Just to make this more entertaining, the kernel is a multithreaed piece
of software, even if you only have a single processor and you do not
necessarily want the singlestepping break point to be taken by each
thread / process, so you want to implement some filtering in the
exception handler.
Executing the instruction that has been replaced with a breakpoint takes
an interesting hack as well. Copy that instruction to the stackframe,
perform the necessary cacheflushes so the CPU will actually fetch the
right instruction. Then jump to that instruction. Obviously that needs
to be followed by a jump to the logical next instruction.
And with all those hints I leave the special case of instructions in
branch delay slots to the you, I'm sure you'll find it trivial ;-)
The FPU emulator in the kernel implements this btw. Not for single
stepping but for entirely different reasons but you may want to look
at it.
Ralf
Insert a breakpoint instruction after the instruction you want to single
step. Anything that triggers an exception but typicall a "break 0" would
be used for debuggers. Branches need special care. Either they need to
be executed in software or breakpoints at both the branch-taken and the
not-taken address need to be inserted.
Instead of break 0, can I use Trap Exception 'Tr' with the special
case for single step BRK_SSTEPBP (break 5)
E.g : teq rs,rt,code
which is nothing but :
bne rs,rt,1f
nop
break code
....... ???
And with all those hints I leave the special case of instructions in
branch delay slots to the you, I'm sure you'll find it trivial ;-)
Insert a breakpoint instruction after the instruction you want to single
step. Anything that triggers an exception but typicall a "break 0" would
be used for debuggers. Branches need special care. Either they need to
be executed in software or breakpoints at both the branch-taken and the
not-taken address need to be inserted.
Instead of break 0, can I use Trap Exception 'Tr' with the special
case for single step BRK_SSTEPBP (break 5)
E.g : teq rs,rt,code
which is nothing but :
bne rs,rt,1f
nop
break code
....... ???
quoted
And with all those hints I leave the special case of instructions in
branch delay slots to the you, I'm sure you'll find it trivial ;-)
Hi,
I am facing problem in case of branch delay instruction.
When single stepping is done on a copied page,for an uncondition jump
instruction to the given target address ( e.g j, jal ),
epc jumps to the target address with respect to current address,
And if I tried to put break point over there....it gives error as
"CPU 0 Unable to handle kernel paging request at virtual
address c005eeb8, epc == c005eeb8"
Can anybody knows...how to solve this problem..?
~Nida
On 9/7/06, Nida M [off-list ref] wrote:
quoted
Insert a breakpoint instruction after the instruction you want to single
step. Anything that triggers an exception but typicall a "break 0" would
be used for debuggers. Branches need special care. Either they need to
be executed in software or breakpoints at both the branch-taken and the
not-taken address need to be inserted.
Instead of break 0, can I use Trap Exception 'Tr' with the special
case for single step BRK_SSTEPBP (break 5)
E.g : teq rs,rt,code
which is nothing but :
bne rs,rt,1f
nop
break code
....... ???
quoted
And with all those hints I leave the special case of instructions in
branch delay slots to the you, I'm sure you'll find it trivial ;-)