2 * gdb server stub - softmmu specific bits
4 * Debug integration depends on support from the individual
5 * accelerators so most of this involves calling the ops helpers.
7 * Copyright (c) 2003-2005 Fabrice Bellard
8 * Copyright (c) 2022 Linaro Ltd
10 * SPDX-License-Identifier: LGPL-2.0+
13 #include "qemu/osdep.h"
14 #include "qapi/error.h"
15 #include "qemu/error-report.h"
16 #include "qemu/cutils.h"
17 #include "exec/gdbstub.h"
18 #include "gdbstub/syscalls.h"
19 #include "exec/hwaddr.h"
20 #include "exec/tb-flush.h"
21 #include "sysemu/cpus.h"
22 #include "sysemu/runstate.h"
23 #include "sysemu/replay.h"
24 #include "hw/core/cpu.h"
25 #include "hw/cpu/cluster.h"
26 #include "hw/boards.h"
27 #include "chardev/char.h"
28 #include "chardev/char-fe.h"
29 #include "monitor/monitor.h"
31 #include "internals.h"
33 /* System emulation specific state */
39 GDBSystemState gdbserver_system_state;
41 static void reset_gdbserver_state(void)
43 g_free(gdbserver_state.processes);
44 gdbserver_state.processes = NULL;
45 gdbserver_state.process_num = 0;
46 gdbserver_state.allow_stop_reply = false;
50 * Return the GDB index for a given vCPU state.
52 * In system mode GDB numbers CPUs from 1 as 0 is reserved as an "any
55 int gdb_get_cpu_index(CPUState *cpu)
57 return cpu->cpu_index + 1;
61 * We check the status of the last message in the chardev receive code
63 bool gdb_got_immediate_ack(void)
69 * GDB Connection management. For system emulation we do all of this
70 * via our existing Chardev infrastructure which allows us to support
71 * network and unix sockets.
74 void gdb_put_buffer(const uint8_t *buf, int len)
77 * XXX this blocks entire thread. Rewrite to use
78 * qemu_chr_fe_write and background I/O callbacks
80 qemu_chr_fe_write_all(&gdbserver_system_state.chr, buf, len);
83 static void gdb_chr_event(void *opaque, QEMUChrEvent event)
86 GDBState *s = (GDBState *) opaque;
89 case CHR_EVENT_OPENED:
90 /* Start with first process attached, others detached */
91 for (i = 0; i < s->process_num; i++) {
92 s->processes[i].attached = !i;
95 s->c_cpu = gdb_first_attached_cpu();
98 vm_stop(RUN_STATE_PAUSED);
99 replay_gdb_attached();
107 * In system-mode we stop the VM and wait to send the syscall packet
108 * until notification that the CPU has stopped. This must be done
109 * because if the packet is sent now the reply from the syscall
110 * request could be received while the CPU is still in the running
111 * state, which can cause packets to be dropped and state transition
112 * 'T' packets to be sent while the syscall is still being processed.
114 void gdb_syscall_handling(const char *syscall_packet)
116 vm_stop(RUN_STATE_DEBUG);
117 qemu_cpu_kick(gdbserver_state.c_cpu);
120 static void gdb_vm_state_change(void *opaque, bool running, RunState state)
122 CPUState *cpu = gdbserver_state.c_cpu;
123 g_autoptr(GString) buf = g_string_new(NULL);
124 g_autoptr(GString) tid = g_string_new(NULL);
128 if (running || gdbserver_state.state == RS_INACTIVE) {
132 /* Is there a GDB syscall waiting to be sent? */
133 if (gdb_handled_syscall()) {
138 /* No process attached */
142 if (!gdbserver_state.allow_stop_reply) {
146 gdb_append_thread_id(cpu, tid);
149 case RUN_STATE_DEBUG:
150 if (cpu->watchpoint_hit) {
151 switch (cpu->watchpoint_hit->flags & BP_MEM_ACCESS) {
162 trace_gdbstub_hit_watchpoint(type,
163 gdb_get_cpu_index(cpu),
164 cpu->watchpoint_hit->vaddr);
165 g_string_printf(buf, "T%02xthread:%s;%swatch:%" VADDR_PRIx ";",
166 GDB_SIGNAL_TRAP, tid->str, type,
167 cpu->watchpoint_hit->vaddr);
168 cpu->watchpoint_hit = NULL;
171 trace_gdbstub_hit_break();
174 ret = GDB_SIGNAL_TRAP;
176 case RUN_STATE_PAUSED:
177 trace_gdbstub_hit_paused();
178 ret = GDB_SIGNAL_INT;
180 case RUN_STATE_SHUTDOWN:
181 trace_gdbstub_hit_shutdown();
182 ret = GDB_SIGNAL_QUIT;
184 case RUN_STATE_IO_ERROR:
185 trace_gdbstub_hit_io_error();
188 case RUN_STATE_WATCHDOG:
189 trace_gdbstub_hit_watchdog();
190 ret = GDB_SIGNAL_ALRM;
192 case RUN_STATE_INTERNAL_ERROR:
193 trace_gdbstub_hit_internal_error();
194 ret = GDB_SIGNAL_ABRT;
196 case RUN_STATE_SAVE_VM:
197 case RUN_STATE_RESTORE_VM:
199 case RUN_STATE_FINISH_MIGRATE:
200 ret = GDB_SIGNAL_XCPU;
203 trace_gdbstub_hit_unknown(state);
204 ret = GDB_SIGNAL_UNKNOWN;
207 gdb_set_stop_cpu(cpu);
208 g_string_printf(buf, "T%02xthread:%s;", ret, tid->str);
211 gdb_put_packet(buf->str);
212 gdbserver_state.allow_stop_reply = false;
214 /* disable single step if it was enabled */
215 cpu_single_step(cpu, 0);
219 static void gdb_sigterm_handler(int signal)
221 if (runstate_is_running()) {
222 vm_stop(RUN_STATE_PAUSED);
227 static int gdb_monitor_write(Chardev *chr, const uint8_t *buf, int len)
229 g_autoptr(GString) hex_buf = g_string_new("O");
230 gdb_memtohex(hex_buf, buf, len);
231 gdb_put_packet(hex_buf->str);
235 static void gdb_monitor_open(Chardev *chr, ChardevBackend *backend,
236 bool *be_opened, Error **errp)
241 static void char_gdb_class_init(ObjectClass *oc, void *data)
243 ChardevClass *cc = CHARDEV_CLASS(oc);
246 cc->open = gdb_monitor_open;
247 cc->chr_write = gdb_monitor_write;
250 #define TYPE_CHARDEV_GDB "chardev-gdb"
252 static const TypeInfo char_gdb_type_info = {
253 .name = TYPE_CHARDEV_GDB,
254 .parent = TYPE_CHARDEV,
255 .class_init = char_gdb_class_init,
258 static int gdb_chr_can_receive(void *opaque)
261 * We can handle an arbitrarily large amount of data.
262 * Pick the maximum packet size, which is as good as anything.
264 return MAX_PACKET_LENGTH;
267 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
271 for (i = 0; i < size; i++) {
272 gdb_read_byte(buf[i]);
276 static int find_cpu_clusters(Object *child, void *opaque)
278 if (object_dynamic_cast(child, TYPE_CPU_CLUSTER)) {
279 GDBState *s = (GDBState *) opaque;
280 CPUClusterState *cluster = CPU_CLUSTER(child);
283 s->processes = g_renew(GDBProcess, s->processes, ++s->process_num);
285 process = &s->processes[s->process_num - 1];
288 * GDB process IDs -1 and 0 are reserved. To avoid subtle errors at
289 * runtime, we enforce here that the machine does not use a cluster ID
290 * that would lead to PID 0.
292 assert(cluster->cluster_id != UINT32_MAX);
293 process->pid = cluster->cluster_id + 1;
294 process->attached = false;
295 process->target_xml = NULL;
300 return object_child_foreach(child, find_cpu_clusters, opaque);
303 static int pid_order(const void *a, const void *b)
305 GDBProcess *pa = (GDBProcess *) a;
306 GDBProcess *pb = (GDBProcess *) b;
308 if (pa->pid < pb->pid) {
310 } else if (pa->pid > pb->pid) {
317 static void create_processes(GDBState *s)
319 object_child_foreach(object_get_root(), find_cpu_clusters, s);
321 if (gdbserver_state.processes) {
323 qsort(gdbserver_state.processes,
324 gdbserver_state.process_num,
325 sizeof(gdbserver_state.processes[0]),
329 gdb_create_default_process(s);
332 int gdbserver_start(const char *device)
336 g_autoptr(GString) cs = g_string_new(device);
339 error_report("gdbstub: meaningless to attach gdb to a "
340 "machine without any CPU.");
344 if (!gdb_supports_guest_debug()) {
345 error_report("gdbstub: current accelerator doesn't "
346 "support guest debugging");
354 trace_gdbstub_op_start(cs->str);
356 if (g_strcmp0(cs->str, "none") != 0) {
357 if (g_str_has_prefix(cs->str, "tcp:")) {
358 /* enforce required TCP attributes */
359 g_string_append_printf(cs, ",wait=off,nodelay=on,server=on");
362 else if (strcmp(device, "stdio") == 0) {
363 struct sigaction act;
365 memset(&act, 0, sizeof(act));
366 act.sa_handler = gdb_sigterm_handler;
367 sigaction(SIGINT, &act, NULL);
371 * FIXME: it's a bit weird to allow using a mux chardev here
372 * and implicitly setup a monitor. We may want to break this.
374 chr = qemu_chr_new_noreplay("gdb", cs->str, true, NULL);
380 if (!gdbserver_state.init) {
381 gdb_init_gdbserver_state();
383 qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
385 /* Initialize a monitor terminal for gdb */
386 mon_chr = qemu_chardev_new(NULL, TYPE_CHARDEV_GDB,
387 NULL, NULL, &error_abort);
388 monitor_init_hmp(mon_chr, false, &error_abort);
390 qemu_chr_fe_deinit(&gdbserver_system_state.chr, true);
391 mon_chr = gdbserver_system_state.mon_chr;
392 reset_gdbserver_state();
395 create_processes(&gdbserver_state);
398 qemu_chr_fe_init(&gdbserver_system_state.chr, chr, &error_abort);
399 qemu_chr_fe_set_handlers(&gdbserver_system_state.chr,
401 gdb_chr_receive, gdb_chr_event,
402 NULL, &gdbserver_state, NULL, true);
404 gdbserver_state.state = chr ? RS_IDLE : RS_INACTIVE;
405 gdbserver_system_state.mon_chr = mon_chr;
411 static void register_types(void)
413 type_register_static(&char_gdb_type_info);
416 type_init(register_types);
418 /* Tell the remote gdb that the process has exited. */
419 void gdb_exit(int code)
423 if (!gdbserver_state.init) {
427 trace_gdbstub_op_exiting((uint8_t)code);
429 if (gdbserver_state.allow_stop_reply) {
430 snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
432 gdbserver_state.allow_stop_reply = false;
435 qemu_chr_fe_deinit(&gdbserver_system_state.chr, true);
438 void gdb_qemu_exit(int code)
440 qemu_system_shutdown_request_with_code(SHUTDOWN_CAUSE_GUEST_SHUTDOWN,
447 static int phy_memory_mode;
449 int gdb_target_memory_rw_debug(CPUState *cpu, hwaddr addr,
450 uint8_t *buf, int len, bool is_write)
454 if (phy_memory_mode) {
456 cpu_physical_memory_write(addr, buf, len);
458 cpu_physical_memory_read(addr, buf, len);
463 cc = CPU_GET_CLASS(cpu);
464 if (cc->memory_rw_debug) {
465 return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
468 return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
475 unsigned int gdb_get_max_cpus(void)
477 MachineState *ms = MACHINE(qdev_get_machine());
478 return ms->smp.max_cpus;
481 bool gdb_can_reverse(void)
483 return replay_mode == REPLAY_MODE_PLAY;
487 * Softmmu specific command helpers
490 void gdb_handle_query_qemu_phy_mem_mode(GArray *params,
493 g_string_printf(gdbserver_state.str_buf, "%d", phy_memory_mode);
497 void gdb_handle_set_qemu_phy_mem_mode(GArray *params, void *user_ctx)
500 gdb_put_packet("E22");
504 if (!get_param(params, 0)->val_ul) {
509 gdb_put_packet("OK");
512 void gdb_handle_query_rcmd(GArray *params, void *user_ctx)
514 const guint8 zero = 0;
518 gdb_put_packet("E22");
522 len = strlen(get_param(params, 0)->data);
524 gdb_put_packet("E01");
528 g_assert(gdbserver_state.mem_buf->len == 0);
530 gdb_hextomem(gdbserver_state.mem_buf, get_param(params, 0)->data, len);
531 g_byte_array_append(gdbserver_state.mem_buf, &zero, 1);
532 qemu_chr_be_write(gdbserver_system_state.mon_chr,
533 gdbserver_state.mem_buf->data,
534 gdbserver_state.mem_buf->len);
535 gdb_put_packet("OK");
539 * Execution state helpers
542 void gdb_handle_query_attached(GArray *params, void *user_ctx)
547 void gdb_continue(void)
549 if (!runstate_needs_reset()) {
550 trace_gdbstub_op_continue();
556 * Resume execution, per CPU actions.
558 int gdb_continue_partial(char *newstates)
564 if (!runstate_needs_reset()) {
565 bool step_requested = false;
567 if (newstates[cpu->cpu_index] == 's') {
568 step_requested = true;
573 if (vm_prepare_start(step_requested)) {
578 switch (newstates[cpu->cpu_index]) {
581 break; /* nothing to do here */
583 trace_gdbstub_op_stepping(cpu->cpu_index);
584 cpu_single_step(cpu, gdbserver_state.sstep_flags);
589 trace_gdbstub_op_continue_cpu(cpu->cpu_index);
600 qemu_clock_enable(QEMU_CLOCK_VIRTUAL, true);
606 * Signal Handling - in system mode we only need SIGINT and SIGTRAP; other
607 * signals are not yet supported.
615 int gdb_signal_to_target(int sig)
619 return TARGET_SIGINT;
621 return TARGET_SIGTRAP;
628 * Break/Watch point helpers
631 bool gdb_supports_guest_debug(void)
633 const AccelOpsClass *ops = cpus_get_accel();
634 if (ops->supports_guest_debug) {
635 return ops->supports_guest_debug();
640 int gdb_breakpoint_insert(CPUState *cs, int type, vaddr addr, vaddr len)
642 const AccelOpsClass *ops = cpus_get_accel();
643 if (ops->insert_breakpoint) {
644 return ops->insert_breakpoint(cs, type, addr, len);
649 int gdb_breakpoint_remove(CPUState *cs, int type, vaddr addr, vaddr len)
651 const AccelOpsClass *ops = cpus_get_accel();
652 if (ops->remove_breakpoint) {
653 return ops->remove_breakpoint(cs, type, addr, len);
658 void gdb_breakpoint_remove_all(CPUState *cs)
660 const AccelOpsClass *ops = cpus_get_accel();
661 if (ops->remove_all_breakpoints) {
662 ops->remove_all_breakpoints(cs);