1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2017-2018 John H. Baldwin <jhb@FreeBSD.org>
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 */
27
28 #include <sys/cdefs.h>
29 #include <sys/param.h>
30 #ifndef WITHOUT_CAPSICUM
31 #include <sys/capsicum.h>
32 #endif
33 #include <sys/endian.h>
34 #include <sys/ioctl.h>
35 #include <sys/mman.h>
36 #include <sys/queue.h>
37 #include <sys/socket.h>
38 #include <machine/atomic.h>
39 #include <machine/specialreg.h>
40 #include <machine/vmm.h>
41 #include <netinet/in.h>
42 #include <assert.h>
43 #ifndef WITHOUT_CAPSICUM
44 #include <capsicum_helpers.h>
45 #endif
46 #include <err.h>
47 #include <errno.h>
48 #include <fcntl.h>
49 #include <netdb.h>
50 #include <pthread.h>
51 #include <pthread_np.h>
52 #include <stdbool.h>
53 #include <stdio.h>
54 #include <stdlib.h>
55 #include <string.h>
56 #include <sysexits.h>
57 #include <unistd.h>
58 #include <vmmapi.h>
59
60 #include "bhyverun.h"
61 #include "config.h"
62 #include "debug.h"
63 #include "gdb.h"
64 #include "mem.h"
65 #include "mevent.h"
66
67 /*
68 * GDB_SIGNAL_* numbers are part of the GDB remote protocol. Most stops
69 * use SIGTRAP.
70 */
71 #define GDB_SIGNAL_TRAP 5
72
73 static void gdb_resume_vcpus(void);
74 static void check_command(int fd);
75
76 static struct mevent *read_event, *write_event;
77
78 static cpuset_t vcpus_active, vcpus_suspended, vcpus_waiting;
79 static pthread_mutex_t gdb_lock;
80 static pthread_cond_t idle_vcpus;
81 static bool first_stop, report_next_stop, swbreak_enabled;
82
83 /*
84 * An I/O buffer contains 'capacity' bytes of room at 'data'. For a
85 * read buffer, 'start' is unused and 'len' contains the number of
86 * valid bytes in the buffer. For a write buffer, 'start' is set to
87 * the index of the next byte in 'data' to send, and 'len' contains
88 * the remaining number of valid bytes to send.
89 */
90 struct io_buffer {
91 uint8_t *data;
92 size_t capacity;
93 size_t start;
94 size_t len;
95 };
96
97 struct breakpoint {
98 uint64_t gpa;
99 uint8_t shadow_inst;
100 TAILQ_ENTRY(breakpoint) link;
101 };
102
103 /*
104 * When a vCPU stops to due to an event that should be reported to the
105 * debugger, information about the event is stored in this structure.
106 * The vCPU thread then sets 'stopped_vcpu' if it is not already set
107 * and stops other vCPUs so the event can be reported. The
108 * report_stop() function reports the event for the 'stopped_vcpu'
109 * vCPU. When the debugger resumes execution via continue or step,
110 * the event for 'stopped_vcpu' is cleared. vCPUs will loop in their
111 * event handlers until the associated event is reported or disabled.
112 *
113 * An idle vCPU will have all of the boolean fields set to false.
114 *
115 * When a vCPU is stepped, 'stepping' is set to true when the vCPU is
116 * released to execute the stepped instruction. When the vCPU reports
117 * the stepping trap, 'stepped' is set.
118 *
119 * When a vCPU hits a breakpoint set by the debug server,
120 * 'hit_swbreak' is set to true.
121 */
122 struct vcpu_state {
123 bool stepping;
124 bool stepped;
125 bool hit_swbreak;
126 };
127
128 static struct io_buffer cur_comm, cur_resp;
129 static uint8_t cur_csum;
130 static struct vmctx *ctx;
131 static int cur_fd = -1;
132 static TAILQ_HEAD(, breakpoint) breakpoints;
133 static struct vcpu_state *vcpu_state;
134 static int cur_vcpu, stopped_vcpu;
135 static bool gdb_active = false;
136
137 static const int gdb_regset[] = {
138 VM_REG_GUEST_RAX,
139 VM_REG_GUEST_RBX,
140 VM_REG_GUEST_RCX,
141 VM_REG_GUEST_RDX,
142 VM_REG_GUEST_RSI,
143 VM_REG_GUEST_RDI,
144 VM_REG_GUEST_RBP,
145 VM_REG_GUEST_RSP,
146 VM_REG_GUEST_R8,
147 VM_REG_GUEST_R9,
148 VM_REG_GUEST_R10,
149 VM_REG_GUEST_R11,
150 VM_REG_GUEST_R12,
151 VM_REG_GUEST_R13,
152 VM_REG_GUEST_R14,
153 VM_REG_GUEST_R15,
154 VM_REG_GUEST_RIP,
155 VM_REG_GUEST_RFLAGS,
156 VM_REG_GUEST_CS,
157 VM_REG_GUEST_SS,
158 VM_REG_GUEST_DS,
159 VM_REG_GUEST_ES,
160 VM_REG_GUEST_FS,
161 VM_REG_GUEST_GS
162 };
163
164 static const int gdb_regsize[] = {
165 8,
166 8,
167 8,
168 8,
169 8,
170 8,
171 8,
172 8,
173 8,
174 8,
175 8,
176 8,
177 8,
178 8,
179 8,
180 8,
181 8,
182 4,
183 4,
184 4,
185 4,
186 4,
187 4,
188 4
189 };
190
191 #ifdef GDB_LOG
192 #include <stdarg.h>
193 #include <stdio.h>
194
195 static void __printflike(1, 2)
debug(const char * fmt,...)196 debug(const char *fmt, ...)
197 {
198 static FILE *logfile;
199 va_list ap;
200
201 if (logfile == NULL) {
202 logfile = fopen("/tmp/bhyve_gdb.log", "w");
203 if (logfile == NULL)
204 return;
205 #ifndef WITHOUT_CAPSICUM
206 if (caph_limit_stream(fileno(logfile), CAPH_WRITE) == -1) {
207 fclose(logfile);
208 logfile = NULL;
209 return;
210 }
211 #endif
212 setlinebuf(logfile);
213 }
214 va_start(ap, fmt);
215 vfprintf(logfile, fmt, ap);
216 va_end(ap);
217 }
218 #else
219 #define debug(...)
220 #endif
221
222 static void remove_all_sw_breakpoints(void);
223
224 static int
guest_paging_info(int vcpu,struct vm_guest_paging * paging)225 guest_paging_info(int vcpu, struct vm_guest_paging *paging)
226 {
227 uint64_t regs[4];
228 const int regset[4] = {
229 VM_REG_GUEST_CR0,
230 VM_REG_GUEST_CR3,
231 VM_REG_GUEST_CR4,
232 VM_REG_GUEST_EFER
233 };
234
235 if (vm_get_register_set(ctx, vcpu, nitems(regset), regset, regs) == -1)
236 return (-1);
237
238 /*
239 * For the debugger, always pretend to be the kernel (CPL 0),
240 * and if long-mode is enabled, always parse addresses as if
241 * in 64-bit mode.
242 */
243 paging->cr3 = regs[1];
244 paging->cpl = 0;
245 if (regs[3] & EFER_LMA)
246 paging->cpu_mode = CPU_MODE_64BIT;
247 else if (regs[0] & CR0_PE)
248 paging->cpu_mode = CPU_MODE_PROTECTED;
249 else
250 paging->cpu_mode = CPU_MODE_REAL;
251 if (!(regs[0] & CR0_PG))
252 paging->paging_mode = PAGING_MODE_FLAT;
253 else if (!(regs[2] & CR4_PAE))
254 paging->paging_mode = PAGING_MODE_32;
255 else if (regs[3] & EFER_LME)
256 paging->paging_mode = (regs[2] & CR4_LA57) ?
257 PAGING_MODE_64_LA57 : PAGING_MODE_64;
258 else
259 paging->paging_mode = PAGING_MODE_PAE;
260 return (0);
261 }
262
263 /*
264 * Map a guest virtual address to a physical address (for a given vcpu).
265 * If a guest virtual address is valid, return 1. If the address is
266 * not valid, return 0. If an error occurs obtaining the mapping,
267 * return -1.
268 */
269 static int
guest_vaddr2paddr(int vcpu,uint64_t vaddr,uint64_t * paddr)270 guest_vaddr2paddr(int vcpu, uint64_t vaddr, uint64_t *paddr)
271 {
272 struct vm_guest_paging paging;
273 int fault;
274
275 if (guest_paging_info(vcpu, &paging) == -1)
276 return (-1);
277
278 /*
279 * Always use PROT_READ. We really care if the VA is
280 * accessible, not if the current vCPU can write.
281 */
282 if (vm_gla2gpa_nofault(ctx, vcpu, &paging, vaddr, PROT_READ, paddr,
283 &fault) == -1)
284 return (-1);
285 if (fault)
286 return (0);
287 return (1);
288 }
289
290 static void
io_buffer_reset(struct io_buffer * io)291 io_buffer_reset(struct io_buffer *io)
292 {
293
294 io->start = 0;
295 io->len = 0;
296 }
297
298 /* Available room for adding data. */
299 static size_t
io_buffer_avail(struct io_buffer * io)300 io_buffer_avail(struct io_buffer *io)
301 {
302
303 return (io->capacity - (io->start + io->len));
304 }
305
306 static uint8_t *
io_buffer_head(struct io_buffer * io)307 io_buffer_head(struct io_buffer *io)
308 {
309
310 return (io->data + io->start);
311 }
312
313 static uint8_t *
io_buffer_tail(struct io_buffer * io)314 io_buffer_tail(struct io_buffer *io)
315 {
316
317 return (io->data + io->start + io->len);
318 }
319
320 static void
io_buffer_advance(struct io_buffer * io,size_t amount)321 io_buffer_advance(struct io_buffer *io, size_t amount)
322 {
323
324 assert(amount <= io->len);
325 io->start += amount;
326 io->len -= amount;
327 }
328
329 static void
io_buffer_consume(struct io_buffer * io,size_t amount)330 io_buffer_consume(struct io_buffer *io, size_t amount)
331 {
332
333 io_buffer_advance(io, amount);
334 if (io->len == 0) {
335 io->start = 0;
336 return;
337 }
338
339 /*
340 * XXX: Consider making this move optional and compacting on a
341 * future read() before realloc().
342 */
343 memmove(io->data, io_buffer_head(io), io->len);
344 io->start = 0;
345 }
346
347 static void
io_buffer_grow(struct io_buffer * io,size_t newsize)348 io_buffer_grow(struct io_buffer *io, size_t newsize)
349 {
350 uint8_t *new_data;
351 size_t avail, new_cap;
352
353 avail = io_buffer_avail(io);
354 if (newsize <= avail)
355 return;
356
357 new_cap = io->capacity + (newsize - avail);
358 new_data = realloc(io->data, new_cap);
359 if (new_data == NULL)
360 err(1, "Failed to grow GDB I/O buffer");
361 io->data = new_data;
362 io->capacity = new_cap;
363 }
364
365 static bool
response_pending(void)366 response_pending(void)
367 {
368
369 if (cur_resp.start == 0 && cur_resp.len == 0)
370 return (false);
371 if (cur_resp.start + cur_resp.len == 1 && cur_resp.data[0] == '+')
372 return (false);
373 return (true);
374 }
375
376 static void
close_connection(void)377 close_connection(void)
378 {
379
380 /*
381 * XXX: This triggers a warning because mevent does the close
382 * before the EV_DELETE.
383 */
384 pthread_mutex_lock(&gdb_lock);
385 mevent_delete(write_event);
386 mevent_delete_close(read_event);
387 write_event = NULL;
388 read_event = NULL;
389 io_buffer_reset(&cur_comm);
390 io_buffer_reset(&cur_resp);
391 cur_fd = -1;
392
393 remove_all_sw_breakpoints();
394
395 /* Clear any pending events. */
396 memset(vcpu_state, 0, guest_ncpus * sizeof(*vcpu_state));
397
398 /* Resume any stopped vCPUs. */
399 gdb_resume_vcpus();
400 pthread_mutex_unlock(&gdb_lock);
401 }
402
403 static uint8_t
hex_digit(uint8_t nibble)404 hex_digit(uint8_t nibble)
405 {
406
407 if (nibble <= 9)
408 return (nibble + '0');
409 else
410 return (nibble + 'a' - 10);
411 }
412
413 static uint8_t
parse_digit(uint8_t v)414 parse_digit(uint8_t v)
415 {
416
417 if (v >= '0' && v <= '9')
418 return (v - '0');
419 if (v >= 'a' && v <= 'f')
420 return (v - 'a' + 10);
421 if (v >= 'A' && v <= 'F')
422 return (v - 'A' + 10);
423 return (0xF);
424 }
425
426 /* Parses big-endian hexadecimal. */
427 static uintmax_t
parse_integer(const uint8_t * p,size_t len)428 parse_integer(const uint8_t *p, size_t len)
429 {
430 uintmax_t v;
431
432 v = 0;
433 while (len > 0) {
434 v <<= 4;
435 v |= parse_digit(*p);
436 p++;
437 len--;
438 }
439 return (v);
440 }
441
442 static uint8_t
parse_byte(const uint8_t * p)443 parse_byte(const uint8_t *p)
444 {
445
446 return (parse_digit(p[0]) << 4 | parse_digit(p[1]));
447 }
448
449 static void
send_pending_data(int fd)450 send_pending_data(int fd)
451 {
452 ssize_t nwritten;
453
454 if (cur_resp.len == 0) {
455 mevent_disable(write_event);
456 return;
457 }
458 nwritten = write(fd, io_buffer_head(&cur_resp), cur_resp.len);
459 if (nwritten == -1) {
460 warn("Write to GDB socket failed");
461 close_connection();
462 } else {
463 io_buffer_advance(&cur_resp, nwritten);
464 if (cur_resp.len == 0)
465 mevent_disable(write_event);
466 else
467 mevent_enable(write_event);
468 }
469 }
470
471 /* Append a single character to the output buffer. */
472 static void
send_char(uint8_t data)473 send_char(uint8_t data)
474 {
475 io_buffer_grow(&cur_resp, 1);
476 *io_buffer_tail(&cur_resp) = data;
477 cur_resp.len++;
478 }
479
480 /* Append an array of bytes to the output buffer. */
481 static void
send_data(const uint8_t * data,size_t len)482 send_data(const uint8_t *data, size_t len)
483 {
484
485 io_buffer_grow(&cur_resp, len);
486 memcpy(io_buffer_tail(&cur_resp), data, len);
487 cur_resp.len += len;
488 }
489
490 static void
format_byte(uint8_t v,uint8_t * buf)491 format_byte(uint8_t v, uint8_t *buf)
492 {
493
494 buf[0] = hex_digit(v >> 4);
495 buf[1] = hex_digit(v & 0xf);
496 }
497
498 /*
499 * Append a single byte (formatted as two hex characters) to the
500 * output buffer.
501 */
502 static void
send_byte(uint8_t v)503 send_byte(uint8_t v)
504 {
505 uint8_t buf[2];
506
507 format_byte(v, buf);
508 send_data(buf, sizeof(buf));
509 }
510
511 static void
start_packet(void)512 start_packet(void)
513 {
514
515 send_char('$');
516 cur_csum = 0;
517 }
518
519 static void
finish_packet(void)520 finish_packet(void)
521 {
522
523 send_char('#');
524 send_byte(cur_csum);
525 debug("-> %.*s\n", (int)cur_resp.len, io_buffer_head(&cur_resp));
526 }
527
528 /*
529 * Append a single character (for the packet payload) and update the
530 * checksum.
531 */
532 static void
append_char(uint8_t v)533 append_char(uint8_t v)
534 {
535
536 send_char(v);
537 cur_csum += v;
538 }
539
540 /*
541 * Append an array of bytes (for the packet payload) and update the
542 * checksum.
543 */
544 static void
append_packet_data(const uint8_t * data,size_t len)545 append_packet_data(const uint8_t *data, size_t len)
546 {
547
548 send_data(data, len);
549 while (len > 0) {
550 cur_csum += *data;
551 data++;
552 len--;
553 }
554 }
555
556 static void
append_string(const char * str)557 append_string(const char *str)
558 {
559
560 append_packet_data(str, strlen(str));
561 }
562
563 static void
append_byte(uint8_t v)564 append_byte(uint8_t v)
565 {
566 uint8_t buf[2];
567
568 format_byte(v, buf);
569 append_packet_data(buf, sizeof(buf));
570 }
571
572 static void
append_unsigned_native(uintmax_t value,size_t len)573 append_unsigned_native(uintmax_t value, size_t len)
574 {
575 size_t i;
576
577 for (i = 0; i < len; i++) {
578 append_byte(value);
579 value >>= 8;
580 }
581 }
582
583 static void
append_unsigned_be(uintmax_t value,size_t len)584 append_unsigned_be(uintmax_t value, size_t len)
585 {
586 char buf[len * 2];
587 size_t i;
588
589 for (i = 0; i < len; i++) {
590 format_byte(value, buf + (len - i - 1) * 2);
591 value >>= 8;
592 }
593 append_packet_data(buf, sizeof(buf));
594 }
595
596 static void
append_integer(unsigned int value)597 append_integer(unsigned int value)
598 {
599
600 if (value == 0)
601 append_char('0');
602 else
603 append_unsigned_be(value, (fls(value) + 7) / 8);
604 }
605
606 static void
append_asciihex(const char * str)607 append_asciihex(const char *str)
608 {
609
610 while (*str != '\0') {
611 append_byte(*str);
612 str++;
613 }
614 }
615
616 static void
send_empty_response(void)617 send_empty_response(void)
618 {
619
620 start_packet();
621 finish_packet();
622 }
623
624 static void
send_error(int error)625 send_error(int error)
626 {
627
628 start_packet();
629 append_char('E');
630 append_byte(error);
631 finish_packet();
632 }
633
634 static void
send_ok(void)635 send_ok(void)
636 {
637
638 start_packet();
639 append_string("OK");
640 finish_packet();
641 }
642
643 static int
parse_threadid(const uint8_t * data,size_t len)644 parse_threadid(const uint8_t *data, size_t len)
645 {
646
647 if (len == 1 && *data == '0')
648 return (0);
649 if (len == 2 && memcmp(data, "-1", 2) == 0)
650 return (-1);
651 if (len == 0)
652 return (-2);
653 return (parse_integer(data, len));
654 }
655
656 /*
657 * Report the current stop event to the debugger. If the stop is due
658 * to an event triggered on a specific vCPU such as a breakpoint or
659 * stepping trap, stopped_vcpu will be set to the vCPU triggering the
660 * stop. If 'set_cur_vcpu' is true, then cur_vcpu will be updated to
661 * the reporting vCPU for vCPU events.
662 */
663 static void
report_stop(bool set_cur_vcpu)664 report_stop(bool set_cur_vcpu)
665 {
666 struct vcpu_state *vs;
667
668 start_packet();
669 if (stopped_vcpu == -1) {
670 append_char('S');
671 append_byte(GDB_SIGNAL_TRAP);
672 } else {
673 vs = &vcpu_state[stopped_vcpu];
674 if (set_cur_vcpu)
675 cur_vcpu = stopped_vcpu;
676 append_char('T');
677 append_byte(GDB_SIGNAL_TRAP);
678 append_string("thread:");
679 append_integer(stopped_vcpu + 1);
680 append_char(';');
681 if (vs->hit_swbreak) {
682 debug("$vCPU %d reporting swbreak\n", stopped_vcpu);
683 if (swbreak_enabled)
684 append_string("swbreak:;");
685 } else if (vs->stepped)
686 debug("$vCPU %d reporting step\n", stopped_vcpu);
687 else
688 debug("$vCPU %d reporting ???\n", stopped_vcpu);
689 }
690 finish_packet();
691 report_next_stop = false;
692 }
693
694 /*
695 * If this stop is due to a vCPU event, clear that event to mark it as
696 * acknowledged.
697 */
698 static void
discard_stop(void)699 discard_stop(void)
700 {
701 struct vcpu_state *vs;
702
703 if (stopped_vcpu != -1) {
704 vs = &vcpu_state[stopped_vcpu];
705 vs->hit_swbreak = false;
706 vs->stepped = false;
707 stopped_vcpu = -1;
708 }
709 report_next_stop = true;
710 }
711
712 static void
gdb_finish_suspend_vcpus(void)713 gdb_finish_suspend_vcpus(void)
714 {
715
716 if (first_stop) {
717 first_stop = false;
718 stopped_vcpu = -1;
719 } else if (report_next_stop) {
720 assert(!response_pending());
721 report_stop(true);
722 send_pending_data(cur_fd);
723 }
724 }
725
726 /*
727 * vCPU threads invoke this function whenever the vCPU enters the
728 * debug server to pause or report an event. vCPU threads wait here
729 * as long as the debug server keeps them suspended.
730 */
731 static void
_gdb_cpu_suspend(int vcpu,bool report_stop)732 _gdb_cpu_suspend(int vcpu, bool report_stop)
733 {
734
735 debug("$vCPU %d suspending\n", vcpu);
736 CPU_SET(vcpu, &vcpus_waiting);
737 if (report_stop && CPU_CMP(&vcpus_waiting, &vcpus_suspended) == 0)
738 gdb_finish_suspend_vcpus();
739 while (CPU_ISSET(vcpu, &vcpus_suspended))
740 pthread_cond_wait(&idle_vcpus, &gdb_lock);
741 CPU_CLR(vcpu, &vcpus_waiting);
742 debug("$vCPU %d resuming\n", vcpu);
743 }
744
745 /*
746 * Invoked at the start of a vCPU thread's execution to inform the
747 * debug server about the new thread.
748 */
749 void
gdb_cpu_add(int vcpu)750 gdb_cpu_add(int vcpu)
751 {
752
753 if (!gdb_active)
754 return;
755 debug("$vCPU %d starting\n", vcpu);
756 pthread_mutex_lock(&gdb_lock);
757 assert(vcpu < guest_ncpus);
758 CPU_SET(vcpu, &vcpus_active);
759 if (!TAILQ_EMPTY(&breakpoints)) {
760 vm_set_capability(ctx, vcpu, VM_CAP_BPT_EXIT, 1);
761 debug("$vCPU %d enabled breakpoint exits\n", vcpu);
762 }
763
764 /*
765 * If a vcpu is added while vcpus are stopped, suspend the new
766 * vcpu so that it will pop back out with a debug exit before
767 * executing the first instruction.
768 */
769 if (!CPU_EMPTY(&vcpus_suspended)) {
770 CPU_SET(vcpu, &vcpus_suspended);
771 _gdb_cpu_suspend(vcpu, false);
772 }
773 pthread_mutex_unlock(&gdb_lock);
774 }
775
776 /*
777 * Invoked by vCPU before resuming execution. This enables stepping
778 * if the vCPU is marked as stepping.
779 */
780 static void
gdb_cpu_resume(int vcpu)781 gdb_cpu_resume(int vcpu)
782 {
783 struct vcpu_state *vs;
784 int error;
785
786 vs = &vcpu_state[vcpu];
787
788 /*
789 * Any pending event should already be reported before
790 * resuming.
791 */
792 assert(vs->hit_swbreak == false);
793 assert(vs->stepped == false);
794 if (vs->stepping) {
795 error = vm_set_capability(ctx, vcpu, VM_CAP_MTRAP_EXIT, 1);
796 assert(error == 0);
797
798 error = vm_set_capability(ctx, vcpu, VM_CAP_MASK_HWINTR, 1);
799 assert(error == 0);
800 }
801 }
802
803 /*
804 * Handler for VM_EXITCODE_DEBUG used to suspend a vCPU when the guest
805 * has been suspended due to an event on different vCPU or in response
806 * to a guest-wide suspend such as Ctrl-C or the stop on attach.
807 */
808 void
gdb_cpu_suspend(int vcpu)809 gdb_cpu_suspend(int vcpu)
810 {
811
812 if (!gdb_active)
813 return;
814 pthread_mutex_lock(&gdb_lock);
815 _gdb_cpu_suspend(vcpu, true);
816 gdb_cpu_resume(vcpu);
817 pthread_mutex_unlock(&gdb_lock);
818 }
819
820 static void
gdb_suspend_vcpus(void)821 gdb_suspend_vcpus(void)
822 {
823
824 assert(pthread_mutex_isowned_np(&gdb_lock));
825 debug("suspending all CPUs\n");
826 vcpus_suspended = vcpus_active;
827 vm_suspend_cpu(ctx, -1);
828 if (CPU_CMP(&vcpus_waiting, &vcpus_suspended) == 0)
829 gdb_finish_suspend_vcpus();
830 }
831
832 /*
833 * Handler for VM_EXITCODE_MTRAP reported when a vCPU single-steps via
834 * the VT-x-specific MTRAP exit.
835 */
836 void
gdb_cpu_mtrap(int vcpu)837 gdb_cpu_mtrap(int vcpu)
838 {
839 struct vcpu_state *vs;
840
841 if (!gdb_active)
842 return;
843 debug("$vCPU %d MTRAP\n", vcpu);
844 pthread_mutex_lock(&gdb_lock);
845 vs = &vcpu_state[vcpu];
846 if (vs->stepping) {
847 vs->stepping = false;
848 vs->stepped = true;
849 vm_set_capability(ctx, vcpu, VM_CAP_MTRAP_EXIT, 0);
850 vm_set_capability(ctx, vcpu, VM_CAP_MASK_HWINTR, 0);
851
852 while (vs->stepped) {
853 if (stopped_vcpu == -1) {
854 debug("$vCPU %d reporting step\n", vcpu);
855 stopped_vcpu = vcpu;
856 gdb_suspend_vcpus();
857 }
858 _gdb_cpu_suspend(vcpu, true);
859 }
860 gdb_cpu_resume(vcpu);
861 }
862 pthread_mutex_unlock(&gdb_lock);
863 }
864
865 static struct breakpoint *
find_breakpoint(uint64_t gpa)866 find_breakpoint(uint64_t gpa)
867 {
868 struct breakpoint *bp;
869
870 TAILQ_FOREACH(bp, &breakpoints, link) {
871 if (bp->gpa == gpa)
872 return (bp);
873 }
874 return (NULL);
875 }
876
877 void
gdb_cpu_breakpoint(int vcpu,struct vm_exit * vmexit)878 gdb_cpu_breakpoint(int vcpu, struct vm_exit *vmexit)
879 {
880 struct breakpoint *bp;
881 struct vcpu_state *vs;
882 uint64_t gpa;
883 int error;
884
885 if (!gdb_active) {
886 EPRINTLN("vm_loop: unexpected VMEXIT_DEBUG");
887 exit(4);
888 }
889 pthread_mutex_lock(&gdb_lock);
890 error = guest_vaddr2paddr(vcpu, vmexit->rip, &gpa);
891 assert(error == 1);
892 bp = find_breakpoint(gpa);
893 if (bp != NULL) {
894 vs = &vcpu_state[vcpu];
895 assert(vs->stepping == false);
896 assert(vs->stepped == false);
897 assert(vs->hit_swbreak == false);
898 vs->hit_swbreak = true;
899 vm_set_register(ctx, vcpu, VM_REG_GUEST_RIP, vmexit->rip);
900 for (;;) {
901 if (stopped_vcpu == -1) {
902 debug("$vCPU %d reporting breakpoint at rip %#lx\n", vcpu,
903 vmexit->rip);
904 stopped_vcpu = vcpu;
905 gdb_suspend_vcpus();
906 }
907 _gdb_cpu_suspend(vcpu, true);
908 if (!vs->hit_swbreak) {
909 /* Breakpoint reported. */
910 break;
911 }
912 bp = find_breakpoint(gpa);
913 if (bp == NULL) {
914 /* Breakpoint was removed. */
915 vs->hit_swbreak = false;
916 break;
917 }
918 }
919 gdb_cpu_resume(vcpu);
920 } else {
921 debug("$vCPU %d injecting breakpoint at rip %#lx\n", vcpu,
922 vmexit->rip);
923 error = vm_set_register(ctx, vcpu,
924 VM_REG_GUEST_ENTRY_INST_LENGTH, vmexit->u.bpt.inst_length);
925 assert(error == 0);
926 error = vm_inject_exception(ctx, vcpu, IDT_BP, 0, 0, 0);
927 assert(error == 0);
928 }
929 pthread_mutex_unlock(&gdb_lock);
930 }
931
932 static bool
gdb_step_vcpu(int vcpu)933 gdb_step_vcpu(int vcpu)
934 {
935 int error, val;
936
937 debug("$vCPU %d step\n", vcpu);
938 error = vm_get_capability(ctx, vcpu, VM_CAP_MTRAP_EXIT, &val);
939 if (error < 0)
940 return (false);
941
942 discard_stop();
943 vcpu_state[vcpu].stepping = true;
944 vm_resume_cpu(ctx, vcpu);
945 CPU_CLR(vcpu, &vcpus_suspended);
946 pthread_cond_broadcast(&idle_vcpus);
947 return (true);
948 }
949
950 static void
gdb_resume_vcpus(void)951 gdb_resume_vcpus(void)
952 {
953
954 assert(pthread_mutex_isowned_np(&gdb_lock));
955 vm_resume_cpu(ctx, -1);
956 debug("resuming all CPUs\n");
957 CPU_ZERO(&vcpus_suspended);
958 pthread_cond_broadcast(&idle_vcpus);
959 }
960
961 static void
gdb_read_regs(void)962 gdb_read_regs(void)
963 {
964 uint64_t regvals[nitems(gdb_regset)];
965
966 if (vm_get_register_set(ctx, cur_vcpu, nitems(gdb_regset),
967 gdb_regset, regvals) == -1) {
968 send_error(errno);
969 return;
970 }
971 start_packet();
972 for (size_t i = 0; i < nitems(regvals); i++)
973 append_unsigned_native(regvals[i], gdb_regsize[i]);
974 finish_packet();
975 }
976
977 static void
gdb_read_mem(const uint8_t * data,size_t len)978 gdb_read_mem(const uint8_t *data, size_t len)
979 {
980 uint64_t gpa, gva, val;
981 uint8_t *cp;
982 size_t resid, todo, bytes;
983 bool started;
984 int error;
985
986 assert(len >= 1);
987
988 /* Skip 'm' */
989 data += 1;
990 len -= 1;
991
992 /* Parse and consume address. */
993 cp = memchr(data, ',', len);
994 if (cp == NULL || cp == data) {
995 send_error(EINVAL);
996 return;
997 }
998 gva = parse_integer(data, cp - data);
999 len -= (cp - data) + 1;
1000 data += (cp - data) + 1;
1001
1002 /* Parse length. */
1003 resid = parse_integer(data, len);
1004
1005 started = false;
1006 while (resid > 0) {
1007 error = guest_vaddr2paddr(cur_vcpu, gva, &gpa);
1008 if (error == -1) {
1009 if (started)
1010 finish_packet();
1011 else
1012 send_error(errno);
1013 return;
1014 }
1015 if (error == 0) {
1016 if (started)
1017 finish_packet();
1018 else
1019 send_error(EFAULT);
1020 return;
1021 }
1022
1023 /* Read bytes from current page. */
1024 todo = getpagesize() - gpa % getpagesize();
1025 if (todo > resid)
1026 todo = resid;
1027
1028 cp = paddr_guest2host(ctx, gpa, todo);
1029 if (cp != NULL) {
1030 /*
1031 * If this page is guest RAM, read it a byte
1032 * at a time.
1033 */
1034 if (!started) {
1035 start_packet();
1036 started = true;
1037 }
1038 while (todo > 0) {
1039 append_byte(*cp);
1040 cp++;
1041 gpa++;
1042 gva++;
1043 resid--;
1044 todo--;
1045 }
1046 } else {
1047 /*
1048 * If this page isn't guest RAM, try to handle
1049 * it via MMIO. For MMIO requests, use
1050 * aligned reads of words when possible.
1051 */
1052 while (todo > 0) {
1053 if (gpa & 1 || todo == 1)
1054 bytes = 1;
1055 else if (gpa & 2 || todo == 2)
1056 bytes = 2;
1057 else
1058 bytes = 4;
1059 error = read_mem(ctx, cur_vcpu, gpa, &val,
1060 bytes);
1061 if (error == 0) {
1062 if (!started) {
1063 start_packet();
1064 started = true;
1065 }
1066 gpa += bytes;
1067 gva += bytes;
1068 resid -= bytes;
1069 todo -= bytes;
1070 while (bytes > 0) {
1071 append_byte(val);
1072 val >>= 8;
1073 bytes--;
1074 }
1075 } else {
1076 if (started)
1077 finish_packet();
1078 else
1079 send_error(EFAULT);
1080 return;
1081 }
1082 }
1083 }
1084 assert(resid == 0 || gpa % getpagesize() == 0);
1085 }
1086 if (!started)
1087 start_packet();
1088 finish_packet();
1089 }
1090
1091 static void
gdb_write_mem(const uint8_t * data,size_t len)1092 gdb_write_mem(const uint8_t *data, size_t len)
1093 {
1094 uint64_t gpa, gva, val;
1095 uint8_t *cp;
1096 size_t resid, todo, bytes;
1097 int error;
1098
1099 assert(len >= 1);
1100
1101 /* Skip 'M' */
1102 data += 1;
1103 len -= 1;
1104
1105 /* Parse and consume address. */
1106 cp = memchr(data, ',', len);
1107 if (cp == NULL || cp == data) {
1108 send_error(EINVAL);
1109 return;
1110 }
1111 gva = parse_integer(data, cp - data);
1112 len -= (cp - data) + 1;
1113 data += (cp - data) + 1;
1114
1115 /* Parse and consume length. */
1116 cp = memchr(data, ':', len);
1117 if (cp == NULL || cp == data) {
1118 send_error(EINVAL);
1119 return;
1120 }
1121 resid = parse_integer(data, cp - data);
1122 len -= (cp - data) + 1;
1123 data += (cp - data) + 1;
1124
1125 /* Verify the available bytes match the length. */
1126 if (len != resid * 2) {
1127 send_error(EINVAL);
1128 return;
1129 }
1130
1131 while (resid > 0) {
1132 error = guest_vaddr2paddr(cur_vcpu, gva, &gpa);
1133 if (error == -1) {
1134 send_error(errno);
1135 return;
1136 }
1137 if (error == 0) {
1138 send_error(EFAULT);
1139 return;
1140 }
1141
1142 /* Write bytes to current page. */
1143 todo = getpagesize() - gpa % getpagesize();
1144 if (todo > resid)
1145 todo = resid;
1146
1147 cp = paddr_guest2host(ctx, gpa, todo);
1148 if (cp != NULL) {
1149 /*
1150 * If this page is guest RAM, write it a byte
1151 * at a time.
1152 */
1153 while (todo > 0) {
1154 assert(len >= 2);
1155 *cp = parse_byte(data);
1156 data += 2;
1157 len -= 2;
1158 cp++;
1159 gpa++;
1160 gva++;
1161 resid--;
1162 todo--;
1163 }
1164 } else {
1165 /*
1166 * If this page isn't guest RAM, try to handle
1167 * it via MMIO. For MMIO requests, use
1168 * aligned writes of words when possible.
1169 */
1170 while (todo > 0) {
1171 if (gpa & 1 || todo == 1) {
1172 bytes = 1;
1173 val = parse_byte(data);
1174 } else if (gpa & 2 || todo == 2) {
1175 bytes = 2;
1176 val = be16toh(parse_integer(data, 4));
1177 } else {
1178 bytes = 4;
1179 val = be32toh(parse_integer(data, 8));
1180 }
1181 error = write_mem(ctx, cur_vcpu, gpa, val,
1182 bytes);
1183 if (error == 0) {
1184 gpa += bytes;
1185 gva += bytes;
1186 resid -= bytes;
1187 todo -= bytes;
1188 data += 2 * bytes;
1189 len -= 2 * bytes;
1190 } else {
1191 send_error(EFAULT);
1192 return;
1193 }
1194 }
1195 }
1196 assert(resid == 0 || gpa % getpagesize() == 0);
1197 }
1198 assert(len == 0);
1199 send_ok();
1200 }
1201
1202 static bool
set_breakpoint_caps(bool enable)1203 set_breakpoint_caps(bool enable)
1204 {
1205 cpuset_t mask;
1206 int vcpu;
1207
1208 mask = vcpus_active;
1209 while (!CPU_EMPTY(&mask)) {
1210 vcpu = CPU_FFS(&mask) - 1;
1211 CPU_CLR(vcpu, &mask);
1212 if (vm_set_capability(ctx, vcpu, VM_CAP_BPT_EXIT,
1213 enable ? 1 : 0) < 0)
1214 return (false);
1215 debug("$vCPU %d %sabled breakpoint exits\n", vcpu,
1216 enable ? "en" : "dis");
1217 }
1218 return (true);
1219 }
1220
1221 static void
remove_all_sw_breakpoints(void)1222 remove_all_sw_breakpoints(void)
1223 {
1224 struct breakpoint *bp, *nbp;
1225 uint8_t *cp;
1226
1227 if (TAILQ_EMPTY(&breakpoints))
1228 return;
1229
1230 TAILQ_FOREACH_SAFE(bp, &breakpoints, link, nbp) {
1231 debug("remove breakpoint at %#lx\n", bp->gpa);
1232 cp = paddr_guest2host(ctx, bp->gpa, 1);
1233 *cp = bp->shadow_inst;
1234 TAILQ_REMOVE(&breakpoints, bp, link);
1235 free(bp);
1236 }
1237 TAILQ_INIT(&breakpoints);
1238 set_breakpoint_caps(false);
1239 }
1240
1241 static void
update_sw_breakpoint(uint64_t gva,int kind,bool insert)1242 update_sw_breakpoint(uint64_t gva, int kind, bool insert)
1243 {
1244 struct breakpoint *bp;
1245 uint64_t gpa;
1246 uint8_t *cp;
1247 int error;
1248
1249 if (kind != 1) {
1250 send_error(EINVAL);
1251 return;
1252 }
1253
1254 error = guest_vaddr2paddr(cur_vcpu, gva, &gpa);
1255 if (error == -1) {
1256 send_error(errno);
1257 return;
1258 }
1259 if (error == 0) {
1260 send_error(EFAULT);
1261 return;
1262 }
1263
1264 cp = paddr_guest2host(ctx, gpa, 1);
1265
1266 /* Only permit breakpoints in guest RAM. */
1267 if (cp == NULL) {
1268 send_error(EFAULT);
1269 return;
1270 }
1271
1272 /* Find any existing breakpoint. */
1273 bp = find_breakpoint(gpa);
1274
1275 /*
1276 * Silently ignore duplicate commands since the protocol
1277 * requires these packets to be idempotent.
1278 */
1279 if (insert) {
1280 if (bp == NULL) {
1281 if (TAILQ_EMPTY(&breakpoints) &&
1282 !set_breakpoint_caps(true)) {
1283 send_empty_response();
1284 return;
1285 }
1286 bp = malloc(sizeof(*bp));
1287 bp->gpa = gpa;
1288 bp->shadow_inst = *cp;
1289 *cp = 0xcc; /* INT 3 */
1290 TAILQ_INSERT_TAIL(&breakpoints, bp, link);
1291 debug("new breakpoint at %#lx\n", gpa);
1292 }
1293 } else {
1294 if (bp != NULL) {
1295 debug("remove breakpoint at %#lx\n", gpa);
1296 *cp = bp->shadow_inst;
1297 TAILQ_REMOVE(&breakpoints, bp, link);
1298 free(bp);
1299 if (TAILQ_EMPTY(&breakpoints))
1300 set_breakpoint_caps(false);
1301 }
1302 }
1303 send_ok();
1304 }
1305
1306 static void
parse_breakpoint(const uint8_t * data,size_t len)1307 parse_breakpoint(const uint8_t *data, size_t len)
1308 {
1309 uint64_t gva;
1310 uint8_t *cp;
1311 bool insert;
1312 int kind, type;
1313
1314 insert = data[0] == 'Z';
1315
1316 /* Skip 'Z/z' */
1317 data += 1;
1318 len -= 1;
1319
1320 /* Parse and consume type. */
1321 cp = memchr(data, ',', len);
1322 if (cp == NULL || cp == data) {
1323 send_error(EINVAL);
1324 return;
1325 }
1326 type = parse_integer(data, cp - data);
1327 len -= (cp - data) + 1;
1328 data += (cp - data) + 1;
1329
1330 /* Parse and consume address. */
1331 cp = memchr(data, ',', len);
1332 if (cp == NULL || cp == data) {
1333 send_error(EINVAL);
1334 return;
1335 }
1336 gva = parse_integer(data, cp - data);
1337 len -= (cp - data) + 1;
1338 data += (cp - data) + 1;
1339
1340 /* Parse and consume kind. */
1341 cp = memchr(data, ';', len);
1342 if (cp == data) {
1343 send_error(EINVAL);
1344 return;
1345 }
1346 if (cp != NULL) {
1347 /*
1348 * We do not advertise support for either the
1349 * ConditionalBreakpoints or BreakpointCommands
1350 * features, so we should not be getting conditions or
1351 * commands from the remote end.
1352 */
1353 send_empty_response();
1354 return;
1355 }
1356 kind = parse_integer(data, len);
1357 data += len;
1358 len = 0;
1359
1360 switch (type) {
1361 case 0:
1362 update_sw_breakpoint(gva, kind, insert);
1363 break;
1364 default:
1365 send_empty_response();
1366 break;
1367 }
1368 }
1369
1370 static bool
command_equals(const uint8_t * data,size_t len,const char * cmd)1371 command_equals(const uint8_t *data, size_t len, const char *cmd)
1372 {
1373
1374 if (strlen(cmd) > len)
1375 return (false);
1376 return (memcmp(data, cmd, strlen(cmd)) == 0);
1377 }
1378
1379 static void
check_features(const uint8_t * data,size_t len)1380 check_features(const uint8_t *data, size_t len)
1381 {
1382 char *feature, *next_feature, *str, *value;
1383 bool supported;
1384
1385 str = malloc(len + 1);
1386 memcpy(str, data, len);
1387 str[len] = '\0';
1388 next_feature = str;
1389
1390 while ((feature = strsep(&next_feature, ";")) != NULL) {
1391 /*
1392 * Null features shouldn't exist, but skip if they
1393 * do.
1394 */
1395 if (strcmp(feature, "") == 0)
1396 continue;
1397
1398 /*
1399 * Look for the value or supported / not supported
1400 * flag.
1401 */
1402 value = strchr(feature, '=');
1403 if (value != NULL) {
1404 *value = '\0';
1405 value++;
1406 supported = true;
1407 } else {
1408 value = feature + strlen(feature) - 1;
1409 switch (*value) {
1410 case '+':
1411 supported = true;
1412 break;
1413 case '-':
1414 supported = false;
1415 break;
1416 default:
1417 /*
1418 * This is really a protocol error,
1419 * but we just ignore malformed
1420 * features for ease of
1421 * implementation.
1422 */
1423 continue;
1424 }
1425 value = NULL;
1426 }
1427
1428 if (strcmp(feature, "swbreak") == 0)
1429 swbreak_enabled = supported;
1430 }
1431 free(str);
1432
1433 start_packet();
1434
1435 /* This is an arbitrary limit. */
1436 append_string("PacketSize=4096");
1437 append_string(";swbreak+");
1438 finish_packet();
1439 }
1440
1441 static void
gdb_query(const uint8_t * data,size_t len)1442 gdb_query(const uint8_t *data, size_t len)
1443 {
1444
1445 /*
1446 * TODO:
1447 * - qSearch
1448 */
1449 if (command_equals(data, len, "qAttached")) {
1450 start_packet();
1451 append_char('1');
1452 finish_packet();
1453 } else if (command_equals(data, len, "qC")) {
1454 start_packet();
1455 append_string("QC");
1456 append_integer(cur_vcpu + 1);
1457 finish_packet();
1458 } else if (command_equals(data, len, "qfThreadInfo")) {
1459 cpuset_t mask;
1460 bool first;
1461 int vcpu;
1462
1463 if (CPU_EMPTY(&vcpus_active)) {
1464 send_error(EINVAL);
1465 return;
1466 }
1467 mask = vcpus_active;
1468 start_packet();
1469 append_char('m');
1470 first = true;
1471 while (!CPU_EMPTY(&mask)) {
1472 vcpu = CPU_FFS(&mask) - 1;
1473 CPU_CLR(vcpu, &mask);
1474 if (first)
1475 first = false;
1476 else
1477 append_char(',');
1478 append_integer(vcpu + 1);
1479 }
1480 finish_packet();
1481 } else if (command_equals(data, len, "qsThreadInfo")) {
1482 start_packet();
1483 append_char('l');
1484 finish_packet();
1485 } else if (command_equals(data, len, "qSupported")) {
1486 data += strlen("qSupported");
1487 len -= strlen("qSupported");
1488 check_features(data, len);
1489 } else if (command_equals(data, len, "qThreadExtraInfo")) {
1490 char buf[16];
1491 int tid;
1492
1493 data += strlen("qThreadExtraInfo");
1494 len -= strlen("qThreadExtraInfo");
1495 if (len == 0 || *data != ',') {
1496 send_error(EINVAL);
1497 return;
1498 }
1499 tid = parse_threadid(data + 1, len - 1);
1500 if (tid <= 0 || !CPU_ISSET(tid - 1, &vcpus_active)) {
1501 send_error(EINVAL);
1502 return;
1503 }
1504
1505 snprintf(buf, sizeof(buf), "vCPU %d", tid - 1);
1506 start_packet();
1507 append_asciihex(buf);
1508 finish_packet();
1509 } else
1510 send_empty_response();
1511 }
1512
1513 static void
handle_command(const uint8_t * data,size_t len)1514 handle_command(const uint8_t *data, size_t len)
1515 {
1516
1517 /* Reject packets with a sequence-id. */
1518 if (len >= 3 && data[0] >= '0' && data[0] <= '9' &&
1519 data[0] >= '0' && data[0] <= '9' && data[2] == ':') {
1520 send_empty_response();
1521 return;
1522 }
1523
1524 switch (*data) {
1525 case 'c':
1526 if (len != 1) {
1527 send_error(EINVAL);
1528 break;
1529 }
1530
1531 discard_stop();
1532 gdb_resume_vcpus();
1533 break;
1534 case 'D':
1535 send_ok();
1536
1537 /* TODO: Resume any stopped CPUs. */
1538 break;
1539 case 'g': {
1540 gdb_read_regs();
1541 break;
1542 }
1543 case 'H': {
1544 int tid;
1545
1546 if (len < 2 || (data[1] != 'g' && data[1] != 'c')) {
1547 send_error(EINVAL);
1548 break;
1549 }
1550 tid = parse_threadid(data + 2, len - 2);
1551 if (tid == -2) {
1552 send_error(EINVAL);
1553 break;
1554 }
1555
1556 if (CPU_EMPTY(&vcpus_active)) {
1557 send_error(EINVAL);
1558 break;
1559 }
1560 if (tid == -1 || tid == 0)
1561 cur_vcpu = CPU_FFS(&vcpus_active) - 1;
1562 else if (CPU_ISSET(tid - 1, &vcpus_active))
1563 cur_vcpu = tid - 1;
1564 else {
1565 send_error(EINVAL);
1566 break;
1567 }
1568 send_ok();
1569 break;
1570 }
1571 case 'm':
1572 gdb_read_mem(data, len);
1573 break;
1574 case 'M':
1575 gdb_write_mem(data, len);
1576 break;
1577 case 'T': {
1578 int tid;
1579
1580 tid = parse_threadid(data + 1, len - 1);
1581 if (tid <= 0 || !CPU_ISSET(tid - 1, &vcpus_active)) {
1582 send_error(EINVAL);
1583 return;
1584 }
1585 send_ok();
1586 break;
1587 }
1588 case 'q':
1589 gdb_query(data, len);
1590 break;
1591 case 's':
1592 if (len != 1) {
1593 send_error(EINVAL);
1594 break;
1595 }
1596
1597 /* Don't send a reply until a stop occurs. */
1598 if (!gdb_step_vcpu(cur_vcpu)) {
1599 send_error(EOPNOTSUPP);
1600 break;
1601 }
1602 break;
1603 case 'z':
1604 case 'Z':
1605 parse_breakpoint(data, len);
1606 break;
1607 case '?':
1608 report_stop(false);
1609 break;
1610 case 'G': /* TODO */
1611 case 'v':
1612 /* Handle 'vCont' */
1613 /* 'vCtrlC' */
1614 case 'p': /* TODO */
1615 case 'P': /* TODO */
1616 case 'Q': /* TODO */
1617 case 't': /* TODO */
1618 case 'X': /* TODO */
1619 default:
1620 send_empty_response();
1621 }
1622 }
1623
1624 /* Check for a valid packet in the command buffer. */
1625 static void
check_command(int fd)1626 check_command(int fd)
1627 {
1628 uint8_t *head, *hash, *p, sum;
1629 size_t avail, plen;
1630
1631 for (;;) {
1632 avail = cur_comm.len;
1633 if (avail == 0)
1634 return;
1635 head = io_buffer_head(&cur_comm);
1636 switch (*head) {
1637 case 0x03:
1638 debug("<- Ctrl-C\n");
1639 io_buffer_consume(&cur_comm, 1);
1640
1641 gdb_suspend_vcpus();
1642 break;
1643 case '+':
1644 /* ACK of previous response. */
1645 debug("<- +\n");
1646 if (response_pending())
1647 io_buffer_reset(&cur_resp);
1648 io_buffer_consume(&cur_comm, 1);
1649 if (stopped_vcpu != -1 && report_next_stop) {
1650 report_stop(true);
1651 send_pending_data(fd);
1652 }
1653 break;
1654 case '-':
1655 /* NACK of previous response. */
1656 debug("<- -\n");
1657 if (response_pending()) {
1658 cur_resp.len += cur_resp.start;
1659 cur_resp.start = 0;
1660 if (cur_resp.data[0] == '+')
1661 io_buffer_advance(&cur_resp, 1);
1662 debug("-> %.*s\n", (int)cur_resp.len,
1663 io_buffer_head(&cur_resp));
1664 }
1665 io_buffer_consume(&cur_comm, 1);
1666 send_pending_data(fd);
1667 break;
1668 case '$':
1669 /* Packet. */
1670
1671 if (response_pending()) {
1672 warnx("New GDB command while response in "
1673 "progress");
1674 io_buffer_reset(&cur_resp);
1675 }
1676
1677 /* Is packet complete? */
1678 hash = memchr(head, '#', avail);
1679 if (hash == NULL)
1680 return;
1681 plen = (hash - head + 1) + 2;
1682 if (avail < plen)
1683 return;
1684 debug("<- %.*s\n", (int)plen, head);
1685
1686 /* Verify checksum. */
1687 for (sum = 0, p = head + 1; p < hash; p++)
1688 sum += *p;
1689 if (sum != parse_byte(hash + 1)) {
1690 io_buffer_consume(&cur_comm, plen);
1691 debug("-> -\n");
1692 send_char('-');
1693 send_pending_data(fd);
1694 break;
1695 }
1696 send_char('+');
1697
1698 handle_command(head + 1, hash - (head + 1));
1699 io_buffer_consume(&cur_comm, plen);
1700 if (!response_pending())
1701 debug("-> +\n");
1702 send_pending_data(fd);
1703 break;
1704 default:
1705 /* XXX: Possibly drop connection instead. */
1706 debug("-> %02x\n", *head);
1707 io_buffer_consume(&cur_comm, 1);
1708 break;
1709 }
1710 }
1711 }
1712
1713 static void
gdb_readable(int fd,enum ev_type event __unused,void * arg __unused)1714 gdb_readable(int fd, enum ev_type event __unused, void *arg __unused)
1715 {
1716 size_t pending;
1717 ssize_t nread;
1718 int n;
1719
1720 if (ioctl(fd, FIONREAD, &n) == -1) {
1721 warn("FIONREAD on GDB socket");
1722 return;
1723 }
1724 assert(n >= 0);
1725 pending = n;
1726
1727 /*
1728 * 'pending' might be zero due to EOF. We need to call read
1729 * with a non-zero length to detect EOF.
1730 */
1731 if (pending == 0)
1732 pending = 1;
1733
1734 /* Ensure there is room in the command buffer. */
1735 io_buffer_grow(&cur_comm, pending);
1736 assert(io_buffer_avail(&cur_comm) >= pending);
1737
1738 nread = read(fd, io_buffer_tail(&cur_comm), io_buffer_avail(&cur_comm));
1739 if (nread == 0) {
1740 close_connection();
1741 } else if (nread == -1) {
1742 if (errno == EAGAIN)
1743 return;
1744
1745 warn("Read from GDB socket");
1746 close_connection();
1747 } else {
1748 cur_comm.len += nread;
1749 pthread_mutex_lock(&gdb_lock);
1750 check_command(fd);
1751 pthread_mutex_unlock(&gdb_lock);
1752 }
1753 }
1754
1755 static void
gdb_writable(int fd,enum ev_type event __unused,void * arg __unused)1756 gdb_writable(int fd, enum ev_type event __unused, void *arg __unused)
1757 {
1758
1759 send_pending_data(fd);
1760 }
1761
1762 static void
new_connection(int fd,enum ev_type event __unused,void * arg)1763 new_connection(int fd, enum ev_type event __unused, void *arg)
1764 {
1765 int optval, s;
1766
1767 s = accept4(fd, NULL, NULL, SOCK_NONBLOCK);
1768 if (s == -1) {
1769 if (arg != NULL)
1770 err(1, "Failed accepting initial GDB connection");
1771
1772 /* Silently ignore errors post-startup. */
1773 return;
1774 }
1775
1776 optval = 1;
1777 if (setsockopt(s, SOL_SOCKET, SO_NOSIGPIPE, &optval, sizeof(optval)) ==
1778 -1) {
1779 warn("Failed to disable SIGPIPE for GDB connection");
1780 close(s);
1781 return;
1782 }
1783
1784 pthread_mutex_lock(&gdb_lock);
1785 if (cur_fd != -1) {
1786 close(s);
1787 warnx("Ignoring additional GDB connection.");
1788 }
1789
1790 read_event = mevent_add(s, EVF_READ, gdb_readable, NULL);
1791 if (read_event == NULL) {
1792 if (arg != NULL)
1793 err(1, "Failed to setup initial GDB connection");
1794 pthread_mutex_unlock(&gdb_lock);
1795 return;
1796 }
1797 write_event = mevent_add(s, EVF_WRITE, gdb_writable, NULL);
1798 if (write_event == NULL) {
1799 if (arg != NULL)
1800 err(1, "Failed to setup initial GDB connection");
1801 mevent_delete_close(read_event);
1802 read_event = NULL;
1803 }
1804
1805 cur_fd = s;
1806 cur_vcpu = 0;
1807 stopped_vcpu = -1;
1808
1809 /* Break on attach. */
1810 first_stop = true;
1811 report_next_stop = false;
1812 gdb_suspend_vcpus();
1813 pthread_mutex_unlock(&gdb_lock);
1814 }
1815
1816 #ifndef WITHOUT_CAPSICUM
1817 static void
limit_gdb_socket(int s)1818 limit_gdb_socket(int s)
1819 {
1820 cap_rights_t rights;
1821 unsigned long ioctls[] = { FIONREAD };
1822
1823 cap_rights_init(&rights, CAP_ACCEPT, CAP_EVENT, CAP_READ, CAP_WRITE,
1824 CAP_SETSOCKOPT, CAP_IOCTL);
1825 if (caph_rights_limit(s, &rights) == -1)
1826 errx(EX_OSERR, "Unable to apply rights for sandbox");
1827 if (caph_ioctls_limit(s, ioctls, nitems(ioctls)) == -1)
1828 errx(EX_OSERR, "Unable to apply rights for sandbox");
1829 }
1830 #endif
1831
1832 void
init_gdb(struct vmctx * _ctx)1833 init_gdb(struct vmctx *_ctx)
1834 {
1835 int error, flags, optval, s;
1836 struct addrinfo hints;
1837 struct addrinfo *gdbaddr;
1838 const char *saddr, *value;
1839 char *sport;
1840 bool wait;
1841
1842 value = get_config_value("gdb.port");
1843 if (value == NULL)
1844 return;
1845 sport = strdup(value);
1846 if (sport == NULL)
1847 errx(4, "Failed to allocate memory");
1848
1849 wait = get_config_bool_default("gdb.wait", false);
1850
1851 saddr = get_config_value("gdb.address");
1852 if (saddr == NULL) {
1853 saddr = "localhost";
1854 }
1855
1856 debug("==> starting on %s:%s, %swaiting\n",
1857 saddr, sport, wait ? "" : "not ");
1858
1859 error = pthread_mutex_init(&gdb_lock, NULL);
1860 if (error != 0)
1861 errc(1, error, "gdb mutex init");
1862 error = pthread_cond_init(&idle_vcpus, NULL);
1863 if (error != 0)
1864 errc(1, error, "gdb cv init");
1865
1866 memset(&hints, 0, sizeof(hints));
1867 hints.ai_family = AF_UNSPEC;
1868 hints.ai_socktype = SOCK_STREAM;
1869 hints.ai_flags = AI_NUMERICSERV | AI_PASSIVE;
1870
1871 error = getaddrinfo(saddr, sport, &hints, &gdbaddr);
1872 if (error != 0)
1873 errx(1, "gdb address resolution: %s", gai_strerror(error));
1874
1875 ctx = _ctx;
1876 s = socket(gdbaddr->ai_family, gdbaddr->ai_socktype, 0);
1877 if (s < 0)
1878 err(1, "gdb socket create");
1879
1880 optval = 1;
1881 (void)setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof(optval));
1882
1883 if (bind(s, gdbaddr->ai_addr, gdbaddr->ai_addrlen) < 0)
1884 err(1, "gdb socket bind");
1885
1886 if (listen(s, 1) < 0)
1887 err(1, "gdb socket listen");
1888
1889 stopped_vcpu = -1;
1890 TAILQ_INIT(&breakpoints);
1891 vcpu_state = calloc(guest_ncpus, sizeof(*vcpu_state));
1892 if (wait) {
1893 /*
1894 * Set vcpu 0 in vcpus_suspended. This will trigger the
1895 * logic in gdb_cpu_add() to suspend the first vcpu before
1896 * it starts execution. The vcpu will remain suspended
1897 * until a debugger connects.
1898 */
1899 CPU_SET(0, &vcpus_suspended);
1900 stopped_vcpu = 0;
1901 }
1902
1903 flags = fcntl(s, F_GETFL);
1904 if (fcntl(s, F_SETFL, flags | O_NONBLOCK) == -1)
1905 err(1, "Failed to mark gdb socket non-blocking");
1906
1907 #ifndef WITHOUT_CAPSICUM
1908 limit_gdb_socket(s);
1909 #endif
1910 mevent_add(s, EVF_READ, new_connection, NULL);
1911 gdb_active = true;
1912 freeaddrinfo(gdbaddr);
1913 free(sport);
1914 }
1915