1 /*
2 * gdb server stub - system specific bits
3 *
4 * Debug integration depends on support from the individual
5 * accelerators so most of this involves calling the ops helpers.
6 *
7 * Copyright (c) 2003-2005 Fabrice Bellard
8 * Copyright (c) 2022 Linaro Ltd
9 *
10 * SPDX-License-Identifier: LGPL-2.0-or-later
11 */
12
13 #include "qemu/osdep.h"
14 #include "qapi/error.h"
15 #include "qemu/error-report.h"
16 #include "qemu/cutils.h"
17 #include "exec/gdbstub.h"
18 #include "gdbstub/syscalls.h"
19 #include "gdbstub/commands.h"
20 #include "exec/hwaddr.h"
21 #include "exec/tb-flush.h"
22 #include "accel/accel-ops.h"
23 #include "accel/accel-cpu-ops.h"
24 #include "system/cpus.h"
25 #include "system/runstate.h"
26 #include "system/replay.h"
27 #include "system/tcg.h"
28 #include "hw/core/cpu.h"
29 #include "hw/cpu/cluster.h"
30 #include "hw/boards.h"
31 #include "chardev/char.h"
32 #include "chardev/char-fe.h"
33 #include "monitor/monitor.h"
34 #include "trace.h"
35 #include "internals.h"
36
37 /* System emulation specific state */
38 typedef struct {
39 CharBackend chr;
40 Chardev *mon_chr;
41 } GDBSystemState;
42
43 GDBSystemState gdbserver_system_state;
44
reset_gdbserver_state(void)45 static void reset_gdbserver_state(void)
46 {
47 g_free(gdbserver_state.processes);
48 gdbserver_state.processes = NULL;
49 gdbserver_state.process_num = 0;
50 gdbserver_state.allow_stop_reply = false;
51 }
52
53 /*
54 * Return the GDB index for a given vCPU state.
55 *
56 * In system mode GDB numbers CPUs from 1 as 0 is reserved as an "any
57 * cpu" index.
58 */
gdb_get_cpu_index(CPUState * cpu)59 int gdb_get_cpu_index(CPUState *cpu)
60 {
61 return cpu->cpu_index + 1;
62 }
63
64 /*
65 * We check the status of the last message in the chardev receive code
66 */
gdb_got_immediate_ack(void)67 bool gdb_got_immediate_ack(void)
68 {
69 return true;
70 }
71
72 /*
73 * GDB Connection management. For system emulation we do all of this
74 * via our existing Chardev infrastructure which allows us to support
75 * network and unix sockets.
76 */
77
gdb_put_buffer(const uint8_t * buf,int len)78 void gdb_put_buffer(const uint8_t *buf, int len)
79 {
80 /*
81 * XXX this blocks entire thread. Rewrite to use
82 * qemu_chr_fe_write and background I/O callbacks
83 */
84 qemu_chr_fe_write_all(&gdbserver_system_state.chr, buf, len);
85 }
86
gdb_chr_event(void * opaque,QEMUChrEvent event)87 static void gdb_chr_event(void *opaque, QEMUChrEvent event)
88 {
89 int i;
90 GDBState *s = (GDBState *) opaque;
91
92 switch (event) {
93 case CHR_EVENT_OPENED:
94 /* Start with first process attached, others detached */
95 for (i = 0; i < s->process_num; i++) {
96 s->processes[i].attached = !i;
97 }
98
99 s->c_cpu = gdb_first_attached_cpu();
100 s->g_cpu = s->c_cpu;
101
102 vm_stop(RUN_STATE_PAUSED);
103 replay_gdb_attached();
104 break;
105 default:
106 break;
107 }
108 }
109
110 /*
111 * In system-mode we stop the VM and wait to send the syscall packet
112 * until notification that the CPU has stopped. This must be done
113 * because if the packet is sent now the reply from the syscall
114 * request could be received while the CPU is still in the running
115 * state, which can cause packets to be dropped and state transition
116 * 'T' packets to be sent while the syscall is still being processed.
117 */
gdb_syscall_handling(const char * syscall_packet)118 void gdb_syscall_handling(const char *syscall_packet)
119 {
120 vm_stop(RUN_STATE_DEBUG);
121 qemu_cpu_kick(gdbserver_state.c_cpu);
122 }
123
gdb_vm_state_change(void * opaque,bool running,RunState state)124 static void gdb_vm_state_change(void *opaque, bool running, RunState state)
125 {
126 CPUState *cpu = gdbserver_state.c_cpu;
127 g_autoptr(GString) buf = g_string_new(NULL);
128 g_autoptr(GString) tid = g_string_new(NULL);
129 const char *type;
130 int ret;
131
132 if (running || gdbserver_state.state == RS_INACTIVE) {
133 return;
134 }
135
136 /* Is there a GDB syscall waiting to be sent? */
137 if (gdb_handled_syscall()) {
138 return;
139 }
140
141 if (cpu == NULL) {
142 /* No process attached */
143 return;
144 }
145
146 if (!gdbserver_state.allow_stop_reply) {
147 return;
148 }
149
150 gdb_append_thread_id(cpu, tid);
151
152 switch (state) {
153 case RUN_STATE_DEBUG:
154 if (cpu->watchpoint_hit) {
155 switch (cpu->watchpoint_hit->flags & BP_MEM_ACCESS) {
156 case BP_MEM_READ:
157 type = "r";
158 break;
159 case BP_MEM_ACCESS:
160 type = "a";
161 break;
162 default:
163 type = "";
164 break;
165 }
166 trace_gdbstub_hit_watchpoint(type,
167 gdb_get_cpu_index(cpu),
168 cpu->watchpoint_hit->vaddr);
169 g_string_printf(buf, "T%02xthread:%s;%swatch:%" VADDR_PRIx ";",
170 GDB_SIGNAL_TRAP, tid->str, type,
171 cpu->watchpoint_hit->vaddr);
172 cpu->watchpoint_hit = NULL;
173 goto send_packet;
174 } else {
175 trace_gdbstub_hit_break();
176 }
177 if (tcg_enabled()) {
178 tb_flush(cpu);
179 }
180 ret = GDB_SIGNAL_TRAP;
181 break;
182 case RUN_STATE_PAUSED:
183 trace_gdbstub_hit_paused();
184 ret = GDB_SIGNAL_INT;
185 break;
186 case RUN_STATE_SHUTDOWN:
187 trace_gdbstub_hit_shutdown();
188 ret = GDB_SIGNAL_QUIT;
189 break;
190 case RUN_STATE_IO_ERROR:
191 trace_gdbstub_hit_io_error();
192 ret = GDB_SIGNAL_STOP;
193 break;
194 case RUN_STATE_WATCHDOG:
195 trace_gdbstub_hit_watchdog();
196 ret = GDB_SIGNAL_ALRM;
197 break;
198 case RUN_STATE_INTERNAL_ERROR:
199 trace_gdbstub_hit_internal_error();
200 ret = GDB_SIGNAL_ABRT;
201 break;
202 case RUN_STATE_SAVE_VM:
203 case RUN_STATE_RESTORE_VM:
204 return;
205 case RUN_STATE_FINISH_MIGRATE:
206 ret = GDB_SIGNAL_XCPU;
207 break;
208 default:
209 trace_gdbstub_hit_unknown(state);
210 ret = GDB_SIGNAL_UNKNOWN;
211 break;
212 }
213 gdb_set_stop_cpu(cpu);
214 g_string_printf(buf, "T%02xthread:%s;", ret, tid->str);
215
216 send_packet:
217 gdb_put_packet(buf->str);
218 gdbserver_state.allow_stop_reply = false;
219
220 /* disable single step if it was enabled */
221 cpu_single_step(cpu, 0);
222 }
223
224 #ifndef _WIN32
gdb_sigterm_handler(int signal)225 static void gdb_sigterm_handler(int signal)
226 {
227 if (runstate_is_running()) {
228 vm_stop(RUN_STATE_PAUSED);
229 }
230 }
231 #endif
232
gdb_monitor_write(Chardev * chr,const uint8_t * buf,int len)233 static int gdb_monitor_write(Chardev *chr, const uint8_t *buf, int len)
234 {
235 g_autoptr(GString) hex_buf = g_string_new("O");
236 gdb_memtohex(hex_buf, buf, len);
237 gdb_put_packet(hex_buf->str);
238 return len;
239 }
240
gdb_monitor_open(Chardev * chr,ChardevBackend * backend,bool * be_opened,Error ** errp)241 static void gdb_monitor_open(Chardev *chr, ChardevBackend *backend,
242 bool *be_opened, Error **errp)
243 {
244 *be_opened = false;
245 }
246
char_gdb_class_init(ObjectClass * oc,const void * data)247 static void char_gdb_class_init(ObjectClass *oc, const void *data)
248 {
249 ChardevClass *cc = CHARDEV_CLASS(oc);
250
251 cc->internal = true;
252 cc->open = gdb_monitor_open;
253 cc->chr_write = gdb_monitor_write;
254 }
255
256 #define TYPE_CHARDEV_GDB "chardev-gdb"
257
258 static const TypeInfo char_gdb_type_info = {
259 .name = TYPE_CHARDEV_GDB,
260 .parent = TYPE_CHARDEV,
261 .class_init = char_gdb_class_init,
262 };
263
gdb_chr_can_receive(void * opaque)264 static int gdb_chr_can_receive(void *opaque)
265 {
266 /*
267 * We can handle an arbitrarily large amount of data.
268 * Pick the maximum packet size, which is as good as anything.
269 */
270 return MAX_PACKET_LENGTH;
271 }
272
gdb_chr_receive(void * opaque,const uint8_t * buf,int size)273 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
274 {
275 int i;
276
277 for (i = 0; i < size; i++) {
278 gdb_read_byte(buf[i]);
279 }
280 }
281
find_cpu_clusters(Object * child,void * opaque)282 static int find_cpu_clusters(Object *child, void *opaque)
283 {
284 if (object_dynamic_cast(child, TYPE_CPU_CLUSTER)) {
285 GDBState *s = (GDBState *) opaque;
286 CPUClusterState *cluster = CPU_CLUSTER(child);
287 GDBProcess *process;
288
289 s->processes = g_renew(GDBProcess, s->processes, ++s->process_num);
290
291 process = &s->processes[s->process_num - 1];
292
293 /*
294 * GDB process IDs -1 and 0 are reserved. To avoid subtle errors at
295 * runtime, we enforce here that the machine does not use a cluster ID
296 * that would lead to PID 0.
297 */
298 assert(cluster->cluster_id != UINT32_MAX);
299 process->pid = cluster->cluster_id + 1;
300 process->attached = false;
301 process->target_xml = NULL;
302
303 return 0;
304 }
305
306 return object_child_foreach(child, find_cpu_clusters, opaque);
307 }
308
pid_order(const void * a,const void * b)309 static int pid_order(const void *a, const void *b)
310 {
311 GDBProcess *pa = (GDBProcess *) a;
312 GDBProcess *pb = (GDBProcess *) b;
313
314 if (pa->pid < pb->pid) {
315 return -1;
316 } else if (pa->pid > pb->pid) {
317 return 1;
318 } else {
319 return 0;
320 }
321 }
322
create_processes(GDBState * s)323 static void create_processes(GDBState *s)
324 {
325 object_child_foreach(object_get_root(), find_cpu_clusters, s);
326
327 if (gdbserver_state.processes) {
328 /* Sort by PID */
329 qsort(gdbserver_state.processes,
330 gdbserver_state.process_num,
331 sizeof(gdbserver_state.processes[0]),
332 pid_order);
333 }
334
335 gdb_create_default_process(s);
336 }
337
gdbserver_start(const char * device,Error ** errp)338 bool gdbserver_start(const char *device, Error **errp)
339 {
340 Chardev *chr = NULL;
341 Chardev *mon_chr;
342 g_autoptr(GString) cs = g_string_new(device);
343
344 if (!first_cpu) {
345 error_setg(errp, "gdbstub: meaningless to attach gdb to a "
346 "machine without any CPU.");
347 return false;
348 }
349
350 if (!gdb_supports_guest_debug()) {
351 error_setg(errp, "gdbstub: current accelerator doesn't "
352 "support guest debugging");
353 return false;
354 }
355
356 if (cs->len == 0) {
357 error_setg(errp, "gdbstub: missing connection string");
358 return false;
359 }
360
361 trace_gdbstub_op_start(cs->str);
362
363 if (g_strcmp0(cs->str, "none") != 0) {
364 if (g_str_has_prefix(cs->str, "tcp:")) {
365 /* enforce required TCP attributes */
366 g_string_append_printf(cs, ",wait=off,nodelay=on,server=on");
367 }
368 #ifndef _WIN32
369 else if (strcmp(device, "stdio") == 0) {
370 struct sigaction act;
371
372 memset(&act, 0, sizeof(act));
373 act.sa_handler = gdb_sigterm_handler;
374 sigaction(SIGINT, &act, NULL);
375 }
376 #endif
377 /*
378 * FIXME: it's a bit weird to allow using a mux chardev here
379 * and implicitly setup a monitor. We may want to break this.
380 */
381 chr = qemu_chr_new_noreplay("gdb", cs->str, true, NULL);
382 if (!chr) {
383 error_setg(errp, "gdbstub: couldn't create chardev");
384 return false;
385 }
386 }
387
388 if (!gdbserver_state.init) {
389 gdb_init_gdbserver_state();
390
391 qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
392
393 /* Initialize a monitor terminal for gdb */
394 mon_chr = qemu_chardev_new(NULL, TYPE_CHARDEV_GDB,
395 NULL, NULL, &error_abort);
396 monitor_init_hmp(mon_chr, false, &error_abort);
397 } else {
398 qemu_chr_fe_deinit(&gdbserver_system_state.chr, true);
399 mon_chr = gdbserver_system_state.mon_chr;
400 reset_gdbserver_state();
401 }
402
403 create_processes(&gdbserver_state);
404
405 if (chr) {
406 qemu_chr_fe_init(&gdbserver_system_state.chr, chr, &error_abort);
407 qemu_chr_fe_set_handlers(&gdbserver_system_state.chr,
408 gdb_chr_can_receive,
409 gdb_chr_receive, gdb_chr_event,
410 NULL, &gdbserver_state, NULL, true);
411 }
412 gdbserver_state.state = chr ? RS_IDLE : RS_INACTIVE;
413 gdbserver_system_state.mon_chr = mon_chr;
414 gdb_syscall_reset();
415
416 return true;
417 }
418
register_types(void)419 static void register_types(void)
420 {
421 type_register_static(&char_gdb_type_info);
422 }
423
424 type_init(register_types);
425
426 /* Tell the remote gdb that the process has exited. */
gdb_exit(int code)427 void gdb_exit(int code)
428 {
429 char buf[4];
430
431 if (!gdbserver_state.init) {
432 return;
433 }
434
435 trace_gdbstub_op_exiting((uint8_t)code);
436
437 if (gdbserver_state.allow_stop_reply) {
438 snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
439 gdb_put_packet(buf);
440 gdbserver_state.allow_stop_reply = false;
441 }
442
443 qemu_chr_fe_deinit(&gdbserver_system_state.chr, true);
444 }
445
gdb_qemu_exit(int code)446 void gdb_qemu_exit(int code)
447 {
448 qemu_system_shutdown_request_with_code(SHUTDOWN_CAUSE_GUEST_SHUTDOWN,
449 code);
450 }
451
452 /*
453 * Memory access
454 */
455 static int phy_memory_mode;
456
gdb_target_memory_rw_debug(CPUState * cpu,hwaddr addr,uint8_t * buf,int len,bool is_write)457 int gdb_target_memory_rw_debug(CPUState *cpu, hwaddr addr,
458 uint8_t *buf, int len, bool is_write)
459 {
460 if (phy_memory_mode) {
461 if (is_write) {
462 cpu_physical_memory_write(addr, buf, len);
463 } else {
464 cpu_physical_memory_read(addr, buf, len);
465 }
466 return 0;
467 }
468
469 if (cpu->cc->memory_rw_debug) {
470 return cpu->cc->memory_rw_debug(cpu, addr, buf, len, is_write);
471 }
472
473 return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
474 }
475
476 /*
477 * cpu helpers
478 */
479
gdb_get_max_cpus(void)480 unsigned int gdb_get_max_cpus(void)
481 {
482 MachineState *ms = MACHINE(qdev_get_machine());
483 return ms->smp.max_cpus;
484 }
485
gdb_can_reverse(void)486 bool gdb_can_reverse(void)
487 {
488 return replay_mode == REPLAY_MODE_PLAY;
489 }
490
491 /*
492 * Softmmu specific command helpers
493 */
494
gdb_handle_query_qemu_phy_mem_mode(GArray * params,void * ctx)495 void gdb_handle_query_qemu_phy_mem_mode(GArray *params,
496 void *ctx)
497 {
498 g_string_printf(gdbserver_state.str_buf, "%d", phy_memory_mode);
499 gdb_put_strbuf();
500 }
501
gdb_handle_set_qemu_phy_mem_mode(GArray * params,void * ctx)502 void gdb_handle_set_qemu_phy_mem_mode(GArray *params, void *ctx)
503 {
504 if (!params->len) {
505 gdb_put_packet("E22");
506 return;
507 }
508
509 if (!gdb_get_cmd_param(params, 0)->val_ul) {
510 phy_memory_mode = 0;
511 } else {
512 phy_memory_mode = 1;
513 }
514 gdb_put_packet("OK");
515 }
516
gdb_handle_query_rcmd(GArray * params,void * ctx)517 void gdb_handle_query_rcmd(GArray *params, void *ctx)
518 {
519 const guint8 zero = 0;
520 int len;
521
522 if (!params->len) {
523 gdb_put_packet("E22");
524 return;
525 }
526
527 len = strlen(gdb_get_cmd_param(params, 0)->data);
528 if (len % 2) {
529 gdb_put_packet("E01");
530 return;
531 }
532
533 g_assert(gdbserver_state.mem_buf->len == 0);
534 len = len / 2;
535 gdb_hextomem(gdbserver_state.mem_buf, gdb_get_cmd_param(params, 0)->data, len);
536 g_byte_array_append(gdbserver_state.mem_buf, &zero, 1);
537 qemu_chr_be_write(gdbserver_system_state.mon_chr,
538 gdbserver_state.mem_buf->data,
539 gdbserver_state.mem_buf->len);
540 gdb_put_packet("OK");
541 }
542
543 /*
544 * Execution state helpers
545 */
546
gdb_handle_query_attached(GArray * params,void * ctx)547 void gdb_handle_query_attached(GArray *params, void *ctx)
548 {
549 gdb_put_packet("1");
550 }
551
gdb_continue(void)552 void gdb_continue(void)
553 {
554 if (!runstate_needs_reset()) {
555 trace_gdbstub_op_continue();
556 vm_start();
557 }
558 }
559
560 /*
561 * Resume execution, per CPU actions.
562 */
gdb_continue_partial(char * newstates)563 int gdb_continue_partial(char *newstates)
564 {
565 CPUState *cpu;
566 int res = 0;
567 int flag = 0;
568
569 if (!runstate_needs_reset()) {
570 bool step_requested = false;
571 CPU_FOREACH(cpu) {
572 if (newstates[cpu->cpu_index] == 's') {
573 step_requested = true;
574 break;
575 }
576 }
577
578 if (vm_prepare_start(step_requested)) {
579 return 0;
580 }
581
582 CPU_FOREACH(cpu) {
583 switch (newstates[cpu->cpu_index]) {
584 case 0:
585 case 1:
586 break; /* nothing to do here */
587 case 's':
588 trace_gdbstub_op_stepping(cpu->cpu_index);
589 cpu_single_step(cpu, gdbserver_state.sstep_flags);
590 cpu_resume(cpu);
591 flag = 1;
592 break;
593 case 'c':
594 trace_gdbstub_op_continue_cpu(cpu->cpu_index);
595 cpu_resume(cpu);
596 flag = 1;
597 break;
598 default:
599 res = -1;
600 break;
601 }
602 }
603 }
604 if (flag) {
605 qemu_clock_enable(QEMU_CLOCK_VIRTUAL, true);
606 }
607 return res;
608 }
609
610 /*
611 * Signal Handling - in system mode we only need SIGINT and SIGTRAP; other
612 * signals are not yet supported.
613 */
614
615 enum {
616 TARGET_SIGINT = 2,
617 TARGET_SIGTRAP = 5
618 };
619
gdb_signal_to_target(int sig)620 int gdb_signal_to_target(int sig)
621 {
622 switch (sig) {
623 case 2:
624 return TARGET_SIGINT;
625 case 5:
626 return TARGET_SIGTRAP;
627 default:
628 return -1;
629 }
630 }
631
632 /*
633 * Break/Watch point helpers
634 */
635
gdb_supports_guest_debug(void)636 bool gdb_supports_guest_debug(void)
637 {
638 const AccelOpsClass *ops = cpus_get_accel();
639 if (ops->supports_guest_debug) {
640 return ops->supports_guest_debug();
641 }
642 return false;
643 }
644
gdb_breakpoint_insert(CPUState * cs,int type,vaddr addr,vaddr len)645 int gdb_breakpoint_insert(CPUState *cs, int type, vaddr addr, vaddr len)
646 {
647 const AccelOpsClass *ops = cpus_get_accel();
648 if (ops->insert_breakpoint) {
649 return ops->insert_breakpoint(cs, type, addr, len);
650 }
651 return -ENOSYS;
652 }
653
gdb_breakpoint_remove(CPUState * cs,int type,vaddr addr,vaddr len)654 int gdb_breakpoint_remove(CPUState *cs, int type, vaddr addr, vaddr len)
655 {
656 const AccelOpsClass *ops = cpus_get_accel();
657 if (ops->remove_breakpoint) {
658 return ops->remove_breakpoint(cs, type, addr, len);
659 }
660 return -ENOSYS;
661 }
662
gdb_breakpoint_remove_all(CPUState * cs)663 void gdb_breakpoint_remove_all(CPUState *cs)
664 {
665 const AccelOpsClass *ops = cpus_get_accel();
666 if (ops->remove_all_breakpoints) {
667 ops->remove_all_breakpoints(cs);
668 }
669 }
670