// fdebuggerkernel.cpp

// 

// Copyright (c) 2010 Accenture. All rights reserved.

// This component and the accompanying materials are made available

// under the terms of the "Eclipse Public License v1.0"

// which accompanies this distribution, and is available

// at the URL "http://www.eclipse.org/legal/epl-v10.html".

// 

// Initial Contributors:

// Accenture - Initial contribution

//

#include "fdebuggerkernel.h"

#include "DynamicDfcSupport.h"

#ifdef __MARM__

#	include <arm/arm.h>

#	if defined(FSHELL_ARM11XX_SUPPORT) || defined(FSHELL_ARM_MEM_MAPPED_DEBUG)

//#		ifndef __MEMMODEL_MULTIPLE__

//#			error "FSHELL_ARM11XX_SUPPORT is only supported on platforms using the multiple memory model!"

//#		endif

#	include <multiple/memmodel.h>

#	endif

#endif

#include "memoryaccess.h"

#if !defined(__EABI__) && defined(FSHELL_ARM_MEM_MAPPED_DEBUG)

#undef FSHELL_ARM_MEM_MAPPED_DEBUG

#endif

#ifdef ASSERT

#undef ASSERT

#endif

#ifdef __WINS__

#define ASSERT(x) __ASSERT_ALWAYS((x), Kern::Fault("Assertion failed: " #x, __LINE__))

#else

#define ASSERT(x) if (!(x)) { Kern::Printf("Assertion failed @ %d: " #x, __LINE__); NKern::Sleep(NKern::TimerTicks(5000)); }

#endif

#define ASSERT_LOCKED() ASSERT(Kern::CurrentThread().iNThread.iHeldFastMutex == &iLock)

#define ASSERT_UNLOCKED() ASSERT(Kern::CurrentThread().iNThread.iHeldFastMutex == NULL)

#define ASSERT_BREAKPOINT_LOCKED() ASSERT(iBreakpointMutex->iCleanup.iThread == &Kern::CurrentThread());

#define ASSERT_BREAKPOINT_UNLOCKED() ASSERT(iBreakpointMutex->iCleanup.iThread != &Kern::CurrentThread());

//#define LOG(args...) Kern::Printf(args)

#define LOG(args...)

void MCR_SetContextIdBrp(TInt aRegister, TUint aContextId);

void MCR_SetBreakpointPair(TInt aRegister, TUint aBvrValue, TUint aBcrValue);

TUint MRC_ReadBcr(TInt aRegister);

TUint32 GetDscr();

void MCR_SetDscr(TUint32 aVal);

TUint32 GetDsar();

TUint32 GetDrar();

TUint32 GetContextId();

void Dsb();

void Isb();

void Imb();

enum TMemMappedDebugAddresses

	{

	EDscrOffset = 0x88,

	EBvrOffset = 0x100,

	EBcrOffset = 0x140,

	ELockAccessOffset = 0xFB0,

	EAuthStatusOffset = 0xFB8,

	};

DDebuggerEventHandler* DDebuggerEventHandler::New(TDfcQue* aQue)

	{

	// This is backwards from the usual constructor, 2nd phase construction pattern because I can't do anything that could

	// error after creating a DKernelEventHandler, because we get called from DLogicalDevice::Install(). So the stuff that would normally

	// be done as 2nd-phase construction is done first

	DMutex* breakpointMutex = NULL;

	TInt err = Kern::MutexCreate(breakpointMutex, _L("FDebuggerBreakpointMutex"), KMutexOrdGeneral5); // No special reason for using 5

	if (err) return NULL;

	DDebuggerEventHandler* self = new DDebuggerEventHandler(aQue);

	if (self)

		{

		self->iBreakpointMutex = breakpointMutex;

		self->Add();

		}

	else

		{

		breakpointMutex->Close(NULL);

		}

	return self;

	}

DDebuggerEventHandler::DDebuggerEventHandler(TDfcQue* aQue)

	: DKernelEventHandler(&Event, this), iNextBreakpointId(1), iHandleCodesegRemovedDfc(&HandleCodesegRemoved, this, aQue, 0)

	{

#if defined(FSHELL_ARM11XX_SUPPORT) || defined(FSHELL_ARM_MEM_MAPPED_DEBUG)

	iFreeHwBreakpoints = 0x3F; // BRPs 0,1,2,3,4,5 (at a minimum) are supported on ARM11xx or later

#endif

	}

/*static*/ TUint DDebuggerEventHandler::Event(TKernelEvent aEvent, TAny* a1, TAny* a2, TAny* aPrivateData)

	{

	DDebuggerEventHandler* self = static_cast<DDebuggerEventHandler*>(aPrivateData);

	return self->DoEvent(aEvent, a1, a2);

	}

TUint DDebuggerEventHandler::DoEvent(TKernelEvent aEvent, TAny* a1, TAny* a2)

	{

	//if (aEvent != EEventUserTrace) Kern::Printf("fdbk: Event %d a1=%d a2=%d", aEvent, a1, a2);

	if (aEvent == EEventKillThread)

		{

#ifdef __MARM__

		LOG("Thread %x %O with contextId %x killed", &Kern::CurrentThread().iNThread, &Kern::CurrentThread(), GetContextId());

#endif

		if (iZombieMode == EAllExits || (iZombieMode == EAbnormalExit && Kern::CurrentThread().iExitType != EExitKill))

			{

			// The thread in question is Kern::CurrentThread()

			Zombify();

			}

		RemoveAllHardwareBreakpointsForThread(&Kern::CurrentThread()); // The thread ID could get reused so make sure we clean up

		}

	else if (aEvent == EEventHwExc)

		{

		// Breakpoint?

#ifdef __MARM__

		TArmExcInfo* info = (TArmExcInfo*)a1;

		LOG("fdbk: Exception excCode=%d addr=0x%08x", info->iExcCode, info->iR15);

		SBreakpoint* b = NULL;

		TLinAddr excAddr = info->iR15 & ~1;

		BreakpointLock();

		if (info->iExcCode == 0)

			{

			// EArmExceptionPrefetchAbort - Could be a HW breakpoint

			b = FindHardwareBreakpoint(&Kern::CurrentThread(), excAddr);

			}

		else if (info->iExcCode == 2)

			{

			// EArmExceptionUndefinedOpcode - SW breakpoint?

			b = FindBreakpointByAddress(excAddr);

			}

		LOG("fdbk: Found breakpoint %d", b ? b->iBreakpointId : -1);

		if (b == NULL)

			{

			// Not one of ours, we should allow it to blow up (or be handled by someone else)

			// It could of course be a thread hitting a breakpoint we've just removed, in which case I'm not sure what we can do other than let

			// the thread crash... hopefully this won't happen in practice!

			BreakpointUnlock();

			return ERunNext;

			}

		TBool shouldBreak = b->MatchesThread(&Kern::CurrentThread()); // Check if it's the wrong thread

		if (b->iFlags & SBreakpoint::ETempContinue)

			{

			// It's a temporary break-at-next-instruction used while continuing a thread.

			if (shouldBreak)

				{

				// Excellent, we have sucessfully continued from a breakpoint. Restore the original, clear the temp (and any threads waiting on it), resume this thread and we're done

				SBreakpoint* orig = b->iRealBreakpoint;

				if (orig->IsHardware()) ClearBreakpoint(b, ETrue); // Clear HW first 

				TInt err = KErrNone;

				if ((orig->iFlags & SBreakpoint::EDisabled) == SBreakpoint::EDisabledDuringContinue)

					{

					// Only resume it if it hasn't been disabled for some other reason in the meantime

					err = ApplyBreakpoint(orig);

					}

				if (err)

					{

					Kern::Printf("fdbk: failed to re-enable breakpoint id %d", orig->iBreakpointId);

					// What to do?

					}

				else

					{

					// Clear the disabled flag

					orig->iFlags &= ~SBreakpoint::EDisabledDuringContinue;

					}

				if (!orig->IsHardware()) ClearBreakpoint(b, ETrue);

				BreakpointUnlock();

				return (TUint)EExcHandled;

				}

			else

				{

				// Any other threads unlucky enough to hit our temp breakpoint will just have to wait until we see our target thread - otherwise

				// we'll end up with temp breakpoints for the temp breakpoints and the universe will implode.

				BreakpointUnlock();

				Zombify(excAddr);

				return (TUint)EExcHandled;

				}

			}

		TInt id = b->iBreakpointId;

		BreakpointUnlock();

		if (shouldBreak)

			{

			// TODO should we suspend the thread rather than semaphoring it, to be more efficient?

			if (iBreakpointNotifyClient)

				{

				RMemoryAccess::TBreakpointNotification notif;

				notif.iThreadId = Kern::CurrentThread().iId;

				notif.iBreakpointId = id;

				notif.iAddress = excAddr;

				TPckg<RMemoryAccess::TBreakpointNotification> pkg(notif);

				// We shouldn't really pass blobs of data...

				iBreakpointNotifyClient->BreakpointHit(pkg);

				}

			Zombify(excAddr);

			}

		else

			{

			TInt err = ContinueFromBreakpoint(&Kern::CurrentThread(), excAddr);

			if (err) return ERunNext; // If we failed to continue, we shouldn't pretend we've handled it

			}

		return (TUint)DKernelEventHandler::EExcHandled;

#else

		(void)a1;

#endif

		}

	else if (aEvent == EEventRemoveCodeSeg)

		{

		DCodeSeg* codeseg = (DCodeSeg*)a1;

		DProcess* proc = (DProcess*)a2;

		// We can't scan the breakpoint list at this point, because we'd need to call BreakpointLock() and 

		// we're currently holding the codeseg lock. So queue a DFC.

		SRemovedCodeseg* removed = new SRemovedCodeseg;

		if (removed)

			{

			removed->iCodeseg = codeseg;

			removed->iProcess = proc;

			Lock();

			iRemovedCodesegs.Add(&removed->iLink);

			Unlock();

			NKern::ThreadEnterCS();

			iHandleCodesegRemovedDfc.Enque();

			NKern::ThreadLeaveCS();

			}

		}

	else if (aEvent == EEventRemoveThread)

		{

		DThread* thread = (DThread*)a1;

		TCreatorInfo dummy(thread->iId, 0);

		BreakpointLock(); // It's not actually breakpoint related but never mind

		TInt found = iCreatorInfo.FindInUnsignedKeyOrder(dummy);

		if (found != KErrNotFound)

			{

			iCreatorInfo.Remove(found);

			}

		BreakpointUnlock();

		}

	else if (aEvent == EEventRemoveProcess)

		{

		// In case a thread dies before creating its first thread, try to remove the creator info we stashed

		DProcess* proc = (DProcess*)a1;

		TCreatorInfo dummy(proc->iId, 0);

		BreakpointLock();

		TInt found = iCreatorInfo.FindInUnsignedKeyOrder(dummy);

		if (found != KErrNotFound)

			{

			iCreatorInfo.Remove(found);

			}

		BreakpointUnlock();

		}

	else if (aEvent == EEventAddProcess)

		{

		// We need to use EEventAddProcess as well as EEventAddThread, because EEventAddThread doesn't do the special check for the creator not being the current thread, meaning for process creation the main thread always appears to have been created by the loader and not be the person who created the process

		// Remember the process for when we come to add the thread

		DProcess* process = (DProcess*)a1;

		DThread* creator = (DThread*)a2;

		BreakpointLock();

		TCreatorInfo threadInfo(process->iId, creator->iId);

		TInt err = iCreatorInfo.InsertInUnsignedKeyOrder(threadInfo);

		if (err)

			{

			LOG("Failed to InsertInUnsignedKeyOrder err=%d", err);

			}

		BreakpointUnlock();

		}

	else if (aEvent == EEventAddThread)

		{

		DThread* thread = (DThread*)a1;

		DThread* creator = (DThread*)a2;

		TCreatorInfo threadInfo(thread->iId, creator->iId);

		BreakpointLock(); // It's not actually breakpoint related but never mind

		if (thread->Owner() != creator->Owner())

			{

			// This means we're probably the first thread of a new process, and our 'creator' is the loader thread. Use the info we stashed earlier about the process's creator instead

			TCreatorInfo dummy(((DProcess*)thread->Owner())->iId, 0);

			TInt found = iCreatorInfo.FindInUnsignedKeyOrder(dummy);

			if (found != KErrNotFound)

				{

				threadInfo.iCreatorThreadId = iCreatorInfo[found].iCreatorThreadId;

				// We don't need to track the process creator for anything else

				iCreatorInfo.Remove(found);

				}

			}

		TInt err = iCreatorInfo.InsertInUnsignedKeyOrder(threadInfo);

		if (err)

			{

			LOG("Failed to InsertInUnsignedKeyOrder err=%d", err);

			}

		BreakpointUnlock();

		}

	return ERunNext;

	}

TInt DDebuggerEventHandler::Zombify(TLinAddr aBreakpointAddr)

	{

	// The purpose of this code is to prevent dying threads from taking down their address space, so that we can still poke at their memory

	// Currently, it is also used to pause a thread on a breakpoint

	SZombie zom; // zombies go on the stack of the thread that is being halted. That way avoids having to alloc.

	zom.iThread = &Kern::CurrentThread();

	zom.iBlocker = NULL;

	zom.iBreakpointAddress = aBreakpointAddr;

	TBuf8<32> semName;

	semName.Append(_L8("ThreadZombiefier-"));

	semName.AppendNum((TUint)zom.iThread->iId);

	NKern::ThreadEnterCS();

	TInt err = Kern::SemaphoreCreate(zom.iBlocker, semName, 0);

	if (err)

		{

		NKern::ThreadLeaveCS();

		return err;

		}

	Lock();

	iZombies.Add(&zom.iLink);

	iZombieCount++;

	Unlock();

	zom.iThread->Open(); // So no-one is tempted to destroy it

	NKern::ThreadLeaveCS();

	Kern::SemaphoreWait(*zom.iBlocker);

	// The above blocks until a "fdb detach" or equivalent has happened, at which point we'll get signalled on this semaphore and should clean up

	zom.iBlocker->Close(NULL);

	zom.iThread->Close(NULL);

	return KErrNone;

	}

TInt DDebuggerEventHandler::GetZombieMode()

	{

	Lock();

	TInt res = iZombieMode;

	Unlock();

	return res;

	}

TInt DDebuggerEventHandler::SetZombieMode(TInt aMode)

	{

	Lock();

	iZombieMode = (TZombieMode)aMode;

	Unlock();

	if (aMode == EDisabled)

		{

		ClearAllBreakpoints(); // This is not exactly obvious, but unblocking a zombie that's blocked on a breakpoint necessarily means you have to remove the breakpoint

		CompleteZombies();

		}

	return KErrNone;

	}

void DDebuggerEventHandler::CompleteZombies()

	{

	ASSERT_UNLOCKED();

	// enter and exit with lock not held

	for (;;)

		{

		Lock();

		SDblQueLink* link = iZombies.IsEmpty() ? NULL : iZombies.First();

		if (!link)

			{

			Unlock();

			break;

			}

		SZombie* zom = _LOFF(link, SZombie, iLink);

		ReleaseZombieAndUnlock(zom);

		}

	}

void DDebuggerEventHandler::UnsuspendThread(SZombie* aZombie)

	{

	Kern::ThreadResume(*aZombie->iThread);

	aZombie->iThread->Close(NULL);

	delete aZombie;

	}

TInt DDebuggerEventHandler::SuspendThread(DThread* aThread)

	{

	// This is the only case where an SZombie goes on the heap - usually they are created in the context of their thread so go on that thread's stack

	SZombie* zom = new SZombie;

	if (!zom) return KErrNoMemory;

	zom->iThread = aThread;

	zom->iThread->Open();

	zom->iBlocker = NULL;

	Lock();

	iZombies.Add(&zom->iLink);

	iZombieCount++;

	Unlock();

	Kern::ThreadSuspend(*zom->iThread, 1);

	return KErrNone;

	}

void DDebuggerEventHandler::Lock()

	{

	NKern::FMWait(&iLock);

	}

void DDebuggerEventHandler::Unlock()

	{

	NKern::FMSignal(&iLock);

	}

DDebuggerEventHandler::~DDebuggerEventHandler()

	{

	// The call to SetZombieMode below is actually pretty pointless: the kernel increments our access count while calling

	// our Event function, which means DKernelEventHandler::Close will never get as far as our destructor

	// while we are blocking on zombies.

	SetZombieMode(EDisabled); // This frees up any outstanding zombies via CompleteZombies()

	iHandleCodesegRemovedDfc.Cancel();

	if (iCodeModifierInited)

		{

#ifdef __EPOC32__

		DebugSupport::CloseCodeModifier();

#endif

		}

	if (iBreakpointMutex)

		{

		iBreakpointMutex->Close(NULL);

		}

#ifdef FSHELL_ARM_MEM_MAPPED_DEBUG

	if (iDebugRegistersChunk)

		{

		iDebugRegistersChunk->Close(NULL);

		}

#endif

	iCreatorInfo.Close();

	}

HBuf* DDebuggerEventHandler::GetZombieThreadIds()

	{

	TInt count = iZombieCount;

	TInt size = count*sizeof(RMemoryAccess::TZombieInfo);

	HBuf* result = HBuf::New(size);

	if (!result) return NULL;

	result->SetLength(size);

	RMemoryAccess::TZombieInfo* ptr = (RMemoryAccess::TZombieInfo*)result->Ptr();

	Lock();

	TInt i = 0;

	for (SDblQueLink* link = iZombies.First(); link != NULL && link != &iZombies.iA && i < count; i++, link=link->iNext)

		{

		SZombie& zom = *_LOFF(link, SZombie, iLink);

		ptr[i].iThreadId = zom.iThread->iId;

		ptr[i].iFlags = 0;

		if (zom.iBlocker == NULL) ptr[i].iFlags |= RMemoryAccess::TZombieInfo::ESuspended;

		else if (zom.iBreakpointAddress != 0) ptr[i].iFlags |= RMemoryAccess::TZombieInfo::EBreakpoint;

		}

	Unlock();

	return result;

	}

DDebuggerEventHandler::SZombie* DDebuggerEventHandler::FindZombie(DThread* aThread)

	{

	// Enter and leave locked

	ASSERT_LOCKED();

	for (SDblQueLink* link = iZombies.First(); link != NULL && link != &iZombies.iA; link=link->iNext)

		{

		SZombie* zom = _LOFF(link, SZombie, iLink);

		if (zom->iThread == aThread)

			{

			return zom;

			}

		}

	return NULL;

	}

TInt DDebuggerEventHandler::ReleaseZombie(DThread* aThread)

	{

	ASSERT_UNLOCKED();

	Lock();

	SZombie* found = FindZombie(aThread);

	if (found)

		{

		if (found->iBreakpointAddress)

			{

			// It's actually paused on a breakpoint, so we need to do a continue instead

			Unlock();

			return ContinueFromBreakpoint(aThread, 0);

			}

		else

			{

			ReleaseZombieAndUnlock(found);

			return KErrNone;

			}

		}

	else

		{

		Unlock();

		return KErrNotFound;

		}

	}

void DDebuggerEventHandler::ReleaseZombieAndUnlock(SZombie* aZombie)

	{

	ASSERT_LOCKED();

	ReleaseZombie(aZombie);

	Unlock();

	}

void DDebuggerEventHandler::ReleaseZombie(SZombie* aZombie)

	{

	ASSERT_LOCKED();

	aZombie->iLink.Deque();

	iZombieCount--;

	if (aZombie->iBlocker)

		{

		Kern::SemaphoreSignal(*aZombie->iBlocker);

		}

	else

		{

		UnsuspendThread(aZombie);

		}

	}

TInt DDebuggerEventHandler::RegisterForBreakpointNotification(MDebuggerEventClient* aClient)

	{

	Lock();

	TInt err = KErrAlreadyExists;