2 * gdbstub user-mode helper routines.
4 * We know for user-mode we are using TCG so we can call stuff directly.
6 * Copyright (c) 2003-2005 Fabrice Bellard
7 * Copyright (c) 2022 Linaro Ltd
9 * SPDX-License-Identifier: LGPL-2.0+
12 #include "qemu/osdep.h"
13 #include "qemu/bitops.h"
14 #include "qemu/cutils.h"
15 #include "qemu/sockets.h"
16 #include "exec/hwaddr.h"
17 #include "exec/tb-flush.h"
18 #include "exec/gdbstub.h"
19 #include "gdbstub/syscalls.h"
20 #include "gdbstub/user.h"
21 #include "hw/core/cpu.h"
23 #include "internals.h"
25 #define GDB_NR_SYSCALLS 1024
26 typedef unsigned long GDBSyscallsMask
[BITS_TO_LONGS(GDB_NR_SYSCALLS
)];
29 * Forked child talks to its parent in order to let GDB enforce the
30 * follow-fork-mode. This happens inside a start_exclusive() section, so that
31 * the other threads, which may be forking too, do not interfere. The
32 * implementation relies on GDB not sending $vCont until it has detached
33 * either from the parent (follow-fork-mode child) or from the child
34 * (follow-fork-mode parent).
36 * The parent and the child share the GDB socket; at any given time only one
37 * of them is allowed to use it, as is reflected in the respective fork_state.
38 * This is negotiated via the fork_sockets pair as a reaction to $Hg.
40 * Below is a short summary of the possible state transitions:
42 * ENABLED : Terminal state.
43 * DISABLED : Terminal state.
44 * ACTIVE : Parent initial state.
45 * INACTIVE : Child initial state.
46 * ACTIVE -> DEACTIVATING: On $Hg.
47 * ACTIVE -> ENABLING : On $D.
48 * ACTIVE -> DISABLING : On $D.
49 * ACTIVE -> DISABLED : On communication error.
50 * DEACTIVATING -> INACTIVE : On gdb_read_byte() return.
51 * DEACTIVATING -> DISABLED : On communication error.
52 * INACTIVE -> ACTIVE : On $Hg in the peer.
53 * INACTIVE -> ENABLE : On $D in the peer.
54 * INACTIVE -> DISABLE : On $D in the peer.
55 * INACTIVE -> DISABLED : On communication error.
56 * ENABLING -> ENABLED : On gdb_read_byte() return.
57 * ENABLING -> DISABLED : On communication error.
58 * DISABLING -> DISABLED : On gdb_read_byte() return.
61 /* Fully owning the GDB socket. */
63 /* Working with the GDB socket; the peer is inactive. */
65 /* Handing off the GDB socket to the peer. */
66 GDB_FORK_DEACTIVATING
,
67 /* The peer is working with the GDB socket. */
69 /* Asking the peer to close its GDB socket fd. */
71 /* Asking the peer to take over, closing our GDB socket fd. */
73 /* The peer has taken over, our GDB socket fd is closed. */
78 GDB_FORK_ACTIVATE
= 'a',
79 GDB_FORK_ENABLE
= 'e',
80 GDB_FORK_DISABLE
= 'd',
83 /* User-mode specific state */
89 * Store syscalls mask without memory allocation in order to avoid
90 * implementing synchronization.
92 bool catch_all_syscalls
;
93 GDBSyscallsMask catch_syscalls_mask
;
95 enum GDBForkState fork_state
;
97 pid_t fork_peer_pid
, fork_peer_tid
;
100 static GDBUserState gdbserver_user_state
;
102 int gdb_get_char(void)
108 ret
= recv(gdbserver_user_state
.fd
, &ch
, 1, 0);
110 if (errno
== ECONNRESET
) {
111 gdbserver_user_state
.fd
= -1;
113 if (errno
!= EINTR
) {
116 } else if (ret
== 0) {
117 close(gdbserver_user_state
.fd
);
118 gdbserver_user_state
.fd
= -1;
127 bool gdb_got_immediate_ack(void)
133 /* no response, continue anyway */
138 /* received correctly, continue */
142 /* anything else, including '-' then try again */
146 void gdb_put_buffer(const uint8_t *buf
, int len
)
151 ret
= send(gdbserver_user_state
.fd
, buf
, len
, 0);
153 if (errno
!= EINTR
) {
163 /* Tell the remote gdb that the process has exited. */
164 void gdb_exit(int code
)
168 if (!gdbserver_state
.init
) {
171 if (gdbserver_user_state
.socket_path
) {
172 unlink(gdbserver_user_state
.socket_path
);
174 if (gdbserver_user_state
.fd
< 0) {
178 trace_gdbstub_op_exiting((uint8_t)code
);
180 if (gdbserver_state
.allow_stop_reply
) {
181 snprintf(buf
, sizeof(buf
), "W%02x", (uint8_t)code
);
183 gdbserver_state
.allow_stop_reply
= false;
188 void gdb_qemu_exit(int code
)
193 int gdb_handlesig_reason(CPUState
*cpu
, int sig
, const char *reason
)
198 if (!gdbserver_state
.init
|| gdbserver_user_state
.fd
< 0) {
202 /* disable single step if it was enabled */
203 cpu_single_step(cpu
, 0);
207 gdb_set_stop_cpu(cpu
);
208 if (gdbserver_state
.allow_stop_reply
) {
209 g_string_printf(gdbserver_state
.str_buf
,
210 "T%02xthread:", gdb_target_signal_to_gdb(sig
));
211 gdb_append_thread_id(cpu
, gdbserver_state
.str_buf
);
212 g_string_append_c(gdbserver_state
.str_buf
, ';');
214 g_string_append(gdbserver_state
.str_buf
, reason
);
217 gdbserver_state
.allow_stop_reply
= false;
221 * gdb_put_packet() might have detected that the peer terminated the
224 if (gdbserver_user_state
.fd
< 0) {
229 gdbserver_state
.state
= RS_IDLE
;
230 gdbserver_user_state
.running_state
= 0;
231 while (gdbserver_user_state
.running_state
== 0) {
232 n
= read(gdbserver_user_state
.fd
, buf
, 256);
236 for (i
= 0; i
< n
; i
++) {
237 gdb_read_byte(buf
[i
]);
241 * XXX: Connection closed. Should probably wait for another
242 * connection before continuing.
245 close(gdbserver_user_state
.fd
);
247 gdbserver_user_state
.fd
= -1;
251 sig
= gdbserver_state
.signal
;
252 gdbserver_state
.signal
= 0;
256 /* Tell the remote gdb that the process has exited due to SIG. */
257 void gdb_signalled(CPUArchState
*env
, int sig
)
261 if (!gdbserver_state
.init
|| gdbserver_user_state
.fd
< 0 ||
262 !gdbserver_state
.allow_stop_reply
) {
266 snprintf(buf
, sizeof(buf
), "X%02x", gdb_target_signal_to_gdb(sig
));
268 gdbserver_state
.allow_stop_reply
= false;
271 static void gdb_accept_init(int fd
)
273 gdb_init_gdbserver_state();
274 gdb_create_default_process(&gdbserver_state
);
275 gdbserver_state
.processes
[0].attached
= true;
276 gdbserver_state
.c_cpu
= gdb_first_attached_cpu();
277 gdbserver_state
.g_cpu
= gdbserver_state
.c_cpu
;
278 gdbserver_user_state
.fd
= fd
;
281 static bool gdb_accept_socket(int gdb_fd
)
286 fd
= accept(gdb_fd
, NULL
, NULL
);
287 if (fd
< 0 && errno
!= EINTR
) {
288 perror("accept socket");
290 } else if (fd
>= 0) {
291 qemu_set_cloexec(fd
);
300 static int gdbserver_open_socket(const char *path
)
302 struct sockaddr_un sockaddr
= {};
305 fd
= socket(AF_UNIX
, SOCK_STREAM
, 0);
307 perror("create socket");
311 sockaddr
.sun_family
= AF_UNIX
;
312 pstrcpy(sockaddr
.sun_path
, sizeof(sockaddr
.sun_path
) - 1, path
);
313 ret
= bind(fd
, (struct sockaddr
*)&sockaddr
, sizeof(sockaddr
));
315 perror("bind socket");
321 perror("listen socket");
329 static bool gdb_accept_tcp(int gdb_fd
)
331 struct sockaddr_in sockaddr
= {};
336 len
= sizeof(sockaddr
);
337 fd
= accept(gdb_fd
, (struct sockaddr
*)&sockaddr
, &len
);
338 if (fd
< 0 && errno
!= EINTR
) {
341 } else if (fd
>= 0) {
342 qemu_set_cloexec(fd
);
347 /* set short latency */
348 if (socket_set_nodelay(fd
)) {
349 perror("setsockopt");
358 static int gdbserver_open_port(int port
)
360 struct sockaddr_in sockaddr
;
363 fd
= socket(PF_INET
, SOCK_STREAM
, 0);
368 qemu_set_cloexec(fd
);
370 socket_set_fast_reuse(fd
);
372 sockaddr
.sin_family
= AF_INET
;
373 sockaddr
.sin_port
= htons(port
);
374 sockaddr
.sin_addr
.s_addr
= 0;
375 ret
= bind(fd
, (struct sockaddr
*)&sockaddr
, sizeof(sockaddr
));
391 int gdbserver_start(const char *port_or_path
)
393 int port
= g_ascii_strtoull(port_or_path
, NULL
, 10);
397 gdb_fd
= gdbserver_open_port(port
);
399 gdb_fd
= gdbserver_open_socket(port_or_path
);
406 if (port
> 0 && gdb_accept_tcp(gdb_fd
)) {
408 } else if (gdb_accept_socket(gdb_fd
)) {
409 gdbserver_user_state
.socket_path
= g_strdup(port_or_path
);
418 void gdbserver_fork_start(void)
420 if (!gdbserver_state
.init
|| gdbserver_user_state
.fd
< 0) {
423 if (!gdbserver_user_state
.fork_events
||
424 qemu_socketpair(AF_UNIX
, SOCK_STREAM
, 0,
425 gdbserver_user_state
.fork_sockets
) < 0) {
426 gdbserver_user_state
.fork_state
= GDB_FORK_DISABLED
;
429 gdbserver_user_state
.fork_state
= GDB_FORK_INACTIVE
;
430 gdbserver_user_state
.fork_peer_pid
= getpid();
431 gdbserver_user_state
.fork_peer_tid
= qemu_get_thread_id();
434 static void disable_gdbstub(CPUState
*thread_cpu
)
438 close(gdbserver_user_state
.fd
);
439 gdbserver_user_state
.fd
= -1;
441 cpu_breakpoint_remove_all(cpu
, BP_GDB
);
442 /* no cpu_watchpoint_remove_all for user-mode */
443 cpu_single_step(cpu
, 0);
445 tb_flush(thread_cpu
);
448 void gdbserver_fork_end(CPUState
*cpu
, pid_t pid
)
453 if (!gdbserver_state
.init
|| gdbserver_user_state
.fd
< 0) {
458 if (gdbserver_user_state
.fork_state
!= GDB_FORK_DISABLED
) {
459 g_assert(gdbserver_user_state
.fork_state
== GDB_FORK_INACTIVE
);
460 close(gdbserver_user_state
.fork_sockets
[0]);
461 close(gdbserver_user_state
.fork_sockets
[1]);
466 if (gdbserver_user_state
.fork_state
== GDB_FORK_DISABLED
) {
468 disable_gdbstub(cpu
);
474 close(gdbserver_user_state
.fork_sockets
[0]);
475 fd
= gdbserver_user_state
.fork_sockets
[1];
476 g_assert(gdbserver_state
.process_num
== 1);
477 g_assert(gdbserver_state
.processes
[0].pid
==
478 gdbserver_user_state
.fork_peer_pid
);
479 g_assert(gdbserver_state
.processes
[0].attached
);
480 gdbserver_state
.processes
[0].pid
= getpid();
482 close(gdbserver_user_state
.fork_sockets
[1]);
483 fd
= gdbserver_user_state
.fork_sockets
[0];
484 gdbserver_user_state
.fork_state
= GDB_FORK_ACTIVE
;
485 gdbserver_user_state
.fork_peer_pid
= pid
;
486 gdbserver_user_state
.fork_peer_tid
= pid
;
488 if (!gdbserver_state
.allow_stop_reply
) {
491 g_string_printf(gdbserver_state
.str_buf
,
492 "T%02xfork:p%02x.%02x;thread:p%02x.%02x;",
493 gdb_target_signal_to_gdb(gdb_target_sigtrap()),
494 pid
, pid
, (int)getpid(), qemu_get_thread_id());
498 gdbserver_state
.state
= RS_IDLE
;
499 gdbserver_state
.allow_stop_reply
= false;
500 gdbserver_user_state
.running_state
= 0;
502 switch (gdbserver_user_state
.fork_state
) {
503 case GDB_FORK_ENABLED
:
504 if (gdbserver_user_state
.running_state
) {
508 case GDB_FORK_ACTIVE
:
509 if (read(gdbserver_user_state
.fd
, &b
, 1) != 1) {
514 case GDB_FORK_DEACTIVATING
:
515 b
= GDB_FORK_ACTIVATE
;
516 if (write(fd
, &b
, 1) != 1) {
519 gdbserver_user_state
.fork_state
= GDB_FORK_INACTIVE
;
521 case GDB_FORK_INACTIVE
:
522 if (read(fd
, &b
, 1) != 1) {
526 case GDB_FORK_ACTIVATE
:
527 gdbserver_user_state
.fork_state
= GDB_FORK_ACTIVE
;
529 case GDB_FORK_ENABLE
:
531 gdbserver_user_state
.fork_state
= GDB_FORK_ENABLED
;
533 case GDB_FORK_DISABLE
:
534 gdbserver_user_state
.fork_state
= GDB_FORK_DISABLED
;
537 g_assert_not_reached();
540 case GDB_FORK_ENABLING
:
541 b
= GDB_FORK_DISABLE
;
542 if (write(fd
, &b
, 1) != 1) {
546 gdbserver_user_state
.fork_state
= GDB_FORK_ENABLED
;
548 case GDB_FORK_DISABLING
:
550 if (write(fd
, &b
, 1) != 1) {
553 gdbserver_user_state
.fork_state
= GDB_FORK_DISABLED
;
555 case GDB_FORK_DISABLED
:
557 disable_gdbstub(cpu
);
560 g_assert_not_reached();
567 disable_gdbstub(cpu
);
571 void gdb_handle_query_supported_user(const char *gdb_supported
)
573 if (strstr(gdb_supported
, "fork-events+")) {
574 gdbserver_user_state
.fork_events
= true;
576 g_string_append(gdbserver_state
.str_buf
, ";fork-events+");
579 bool gdb_handle_set_thread_user(uint32_t pid
, uint32_t tid
)
581 if (gdbserver_user_state
.fork_state
== GDB_FORK_ACTIVE
&&
582 pid
== gdbserver_user_state
.fork_peer_pid
&&
583 tid
== gdbserver_user_state
.fork_peer_tid
) {
584 gdbserver_user_state
.fork_state
= GDB_FORK_DEACTIVATING
;
585 gdb_put_packet("OK");
591 bool gdb_handle_detach_user(uint32_t pid
)
595 if (gdbserver_user_state
.fork_state
== GDB_FORK_ACTIVE
) {
596 enable
= pid
== gdbserver_user_state
.fork_peer_pid
;
597 if (enable
|| pid
== getpid()) {
598 gdbserver_user_state
.fork_state
= enable
? GDB_FORK_ENABLING
:
600 gdb_put_packet("OK");
608 * Execution state helpers
611 void gdb_handle_query_attached(GArray
*params
, void *user_ctx
)
616 void gdb_continue(void)
618 gdbserver_user_state
.running_state
= 1;
619 trace_gdbstub_op_continue();
623 * Resume execution, for user-mode emulation it's equivalent to
626 int gdb_continue_partial(char *newstates
)
631 * This is not exactly accurate, but it's an improvement compared to the
632 * previous situation, where only one CPU would be single-stepped.
635 if (newstates
[cpu
->cpu_index
] == 's') {
636 trace_gdbstub_op_stepping(cpu
->cpu_index
);
637 cpu_single_step(cpu
, gdbserver_state
.sstep_flags
);
640 gdbserver_user_state
.running_state
= 1;
645 * Memory access helpers
647 int gdb_target_memory_rw_debug(CPUState
*cpu
, hwaddr addr
,
648 uint8_t *buf
, int len
, bool is_write
)
652 cc
= CPU_GET_CLASS(cpu
);
653 if (cc
->memory_rw_debug
) {
654 return cc
->memory_rw_debug(cpu
, addr
, buf
, len
, is_write
);
656 return cpu_memory_rw_debug(cpu
, addr
, buf
, len
, is_write
);
663 unsigned int gdb_get_max_cpus(void)
666 unsigned int max_cpus
= 1;
669 max_cpus
= max_cpus
<= cpu
->cpu_index
? cpu
->cpu_index
+ 1 : max_cpus
;
675 /* replay not supported for user-mode */
676 bool gdb_can_reverse(void)
682 * Break/Watch point helpers
685 bool gdb_supports_guest_debug(void)
687 /* user-mode == TCG == supported */
691 int gdb_breakpoint_insert(CPUState
*cs
, int type
, vaddr addr
, vaddr len
)
697 case GDB_BREAKPOINT_SW
:
698 case GDB_BREAKPOINT_HW
:
700 err
= cpu_breakpoint_insert(cpu
, addr
, BP_GDB
, NULL
);
707 /* user-mode doesn't support watchpoints */
712 int gdb_breakpoint_remove(CPUState
*cs
, int type
, vaddr addr
, vaddr len
)
718 case GDB_BREAKPOINT_SW
:
719 case GDB_BREAKPOINT_HW
:
721 err
= cpu_breakpoint_remove(cpu
, addr
, BP_GDB
);
728 /* user-mode doesn't support watchpoints */
733 void gdb_breakpoint_remove_all(CPUState
*cs
)
735 cpu_breakpoint_remove_all(cs
, BP_GDB
);
739 * For user-mode syscall support we send the system call immediately
740 * and then return control to gdb for it to process the syscall request.
741 * Since the protocol requires that gdb hands control back to us
742 * using a "here are the results" F packet, we don't need to check
743 * gdb_handlesig's return value (which is the signal to deliver if
744 * execution was resumed via a continue packet).
746 void gdb_syscall_handling(const char *syscall_packet
)
748 gdb_put_packet(syscall_packet
);
749 gdb_handlesig(gdbserver_state
.c_cpu
, 0);
752 static bool should_catch_syscall(int num
)
754 if (gdbserver_user_state
.catch_all_syscalls
) {
757 if (num
< 0 || num
>= GDB_NR_SYSCALLS
) {
760 return test_bit(num
, gdbserver_user_state
.catch_syscalls_mask
);
763 void gdb_syscall_entry(CPUState
*cs
, int num
)
765 if (should_catch_syscall(num
)) {
766 g_autofree
char *reason
= g_strdup_printf("syscall_entry:%x;", num
);
767 gdb_handlesig_reason(cs
, gdb_target_sigtrap(), reason
);
771 void gdb_syscall_return(CPUState
*cs
, int num
)
773 if (should_catch_syscall(num
)) {
774 g_autofree
char *reason
= g_strdup_printf("syscall_return:%x;", num
);
775 gdb_handlesig_reason(cs
, gdb_target_sigtrap(), reason
);
779 void gdb_handle_set_catch_syscalls(GArray
*params
, void *user_ctx
)
781 const char *param
= get_param(params
, 0)->data
;
782 GDBSyscallsMask catch_syscalls_mask
;
783 bool catch_all_syscalls
;
787 /* "0" means not catching any syscalls. */
788 if (strcmp(param
, "0") == 0) {
789 gdbserver_user_state
.catch_all_syscalls
= false;
790 memset(gdbserver_user_state
.catch_syscalls_mask
, 0,
791 sizeof(gdbserver_user_state
.catch_syscalls_mask
));
792 gdb_put_packet("OK");
796 /* "1" means catching all syscalls. */
797 if (strcmp(param
, "1") == 0) {
798 gdbserver_user_state
.catch_all_syscalls
= true;
799 gdb_put_packet("OK");
804 * "1;..." means catching only the specified syscalls.
805 * The syscall list must not be empty.
807 if (param
[0] == '1' && param
[1] == ';') {
808 catch_all_syscalls
= false;
809 memset(catch_syscalls_mask
, 0, sizeof(catch_syscalls_mask
));
810 for (p
= ¶m
[2];; p
++) {
811 if (qemu_strtoui(p
, &p
, 16, &num
) || (*p
&& *p
!= ';')) {
814 if (num
>= GDB_NR_SYSCALLS
) {
816 * Fall back to reporting all syscalls. Reporting extra
817 * syscalls is inefficient, but the spec explicitly allows it.
818 * Keep parsing in case there is a syntax error ahead.
820 catch_all_syscalls
= true;
822 set_bit(num
, catch_syscalls_mask
);
828 gdbserver_user_state
.catch_all_syscalls
= catch_all_syscalls
;
829 if (!catch_all_syscalls
) {
830 memcpy(gdbserver_user_state
.catch_syscalls_mask
,
831 catch_syscalls_mask
, sizeof(catch_syscalls_mask
));
833 gdb_put_packet("OK");
838 gdb_put_packet("E00");