Stackdb
Stackdb is a stackable, multi-target and -level source debugger and memory forensics library.
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Pages
target_gdb_helper_qemu.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2014 The University of Utah
3  *
4  * This program is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU General Public License as
6  * published by the Free Software Foundation; either version 2 of
7  * the License, or (at your option) any later version.
8  *
9  * This program is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12  * GNU General Public License for more details.
13  *
14  * You should have received a copy of the GNU General Public License
15  * along with this program; if not, write to the Free Software
16  * Foundation, 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
17  */
18 
19 #include "config.h"
20 
21 #include <errno.h>
22 #include <ctype.h>
23 #include <unistd.h>
24 #include <sys/types.h>
25 #include <sys/stat.h>
26 #include <fcntl.h>
27 #include <sys/socket.h>
28 #include <netdb.h>
29 #include <netinet/in.h>
30 #include <sys/mman.h>
31 #ifdef ENABLE_LIBVIRT
32 #include <libvirt/libvirt.h>
33 #include <libvirt/libvirt-qemu.h>
34 #endif
35 
36 #include "common.h"
37 #include "arch.h"
38 #include "arch_x86.h"
39 #include "arch_x86_64.h"
40 #include "regcache.h"
41 #include "target_api.h"
42 #include "target.h"
43 
44 #include "target_gdb.h"
45 #include "target_gdb_rsp.h"
46 
47 /*
48  * Ok, if we use the QEMU QMP, we can extract even more info... like
49  * more machine registers -- and if the user starts QEMU with the
50  * -mem-path option and configures our LD_PRELOADable libqemuhacks.so
51  * appropriately, we can read/write phys memory directly by mmap! This
52  * is a huge performance benefit.
53  */
54 
55 /*
56  * Local prototypes.
57  */
58 int gdb_helper_qemu_addr_v2p(struct target *target,tid_t tid,ADDR pgd,
59  ADDR vaddr,ADDR *paddr);
60 unsigned char *gdb_helper_qemu_read_tid(struct target *target,
61  tid_t tid,ADDR pgd,ADDR addr,
62  unsigned long length,
63  unsigned char *buf);
64 
68  void *ram_mmap;
69  unsigned long ram_mmap_size;
70 #ifdef ENABLE_LIBVIRT
71  virConnectPtr qemu_libvirt_conn;
72  virDomainPtr qemu_libvirt_dom;
73 #endif
74 };
75 
77  struct gdb_spec *gspec = (struct gdb_spec *)target->spec->backend_spec;
78  struct gdb_state *gstate = (struct gdb_state *)target->state;
79  struct gdb_helper_qemu_state *qstate;
80  struct stat sbuf;
81 
82  qstate = calloc(1,sizeof(*qstate));
83 
84  /* We use memcache for v2p -- create one. */
85  if (target->memcache) {
86  verror("memcache already in use!\n");
87  errno = EINVAL;
88  return -1;
89  }
90  target->memcache = memcache_create(0,0,NULL);
91 
92  if (gspec->qemu_mem_path) {
93  if (stat(gspec->qemu_mem_path,&sbuf) < 0) {
94  verror("could not stat QEMU mem-path file %s: %s (%d)!\n",
95  gspec->qemu_mem_path,strerror(errno),errno);
96  free(qstate);
97  return -1;
98  }
99  qstate->ram_mmap_size = sbuf.st_size;
100  qstate->ram_mmap_fd = open(gspec->qemu_mem_path,O_RDWR);
101  if (qstate->ram_mmap_fd < 0) {
102  verror("could not open QEMU mem-path file %s: %s (%d)!\n",
103  gspec->qemu_mem_path,strerror(errno),errno);
104  free(qstate);
105  return -1;
106  }
107  qstate->ram_mmap = mmap(NULL,qstate->ram_mmap_size,PROT_READ | PROT_WRITE,
108  MAP_SHARED,qstate->ram_mmap_fd,0);
109  if (qstate->ram_mmap == (void *) -1) {
110  verror("could not mmap QEMU mem-path file %s: %s (%d)!\n",
111  gspec->qemu_mem_path,strerror(errno),errno);
112  free(qstate);
113  return -1;
114  }
115  }
116 
117  qstate->qemu_qmp_fd = -1;
118  gstate->hops_priv = qstate;
119 
120  /*
121  * No version of QEMU hijacks userspace exceptions for us... we must
122  * have them emulated in the OS personality...
123  */
124  g_hash_table_insert(target->config,
125  strdup("OS_EMULATE_USERSPACE_EXCEPTIONS"),
126  strdup("1"));
127 
128 #ifdef ENABLE_LIBVIRT
129  qstate->qemu_libvirt_conn = 0;
130  qstate->qemu_libvirt_dom = 0;
131 #endif
132 
133  return 0;
134 }
135 
136 int __recv_til_block(int fd,char *buf,unsigned int len,int blockfirst) {
137  char sbuf[4096];
138  char *bufp;
139  unsigned int rlen;
140  unsigned int count;
141  int rc;
142  int i;
143 
144  if (buf) {
145  bufp = buf;
146  rlen = len;
147  }
148  else {
149  bufp = sbuf;
150  rlen = sizeof(sbuf);
151  }
152 
153  /*
154  * Recv everything we can until we would block; throw it away.
155  */
156  count = 0;
157  i = 0;
158  while (1) {
159  rc = recv(fd,bufp + count,rlen - count,
160  (i == 0 && blockfirst) ? 0 : MSG_DONTWAIT);
161  ++i;
162  if (rc < 0) {
163  if (errno == EAGAIN || errno == EWOULDBLOCK) {
164  break;
165  }
166  else {
167  verror("recv: %s (%d)\n",strerror(errno),errno);
168  return -1;
169  }
170  }
171  else if (rc == 0) {
172  verror("qmp server disconnected unexpectedly!\n");
173  return -1;
174  }
175  else {
176  count += (unsigned int)rc;
177  if (!buf) {
178  vdebug(9,LA_TARGET,LF_GDB,"(discarding) recv QMP '%s'\n",bufp);
179  count = 0;
180  }
181  else {
182  vdebug(9,LA_TARGET,LF_GDB,"(saving) recv QMP '%s'\n",bufp);
183  }
184 
185  if (count == rlen)
186  break;
187  }
188  }
189 
190  return count;
191 }
192 
194  struct gdb_state *gstate = (struct gdb_state *)target->state;
195  struct gdb_spec *gspec = (struct gdb_spec *)target->spec->backend_spec;
196  struct gdb_helper_qemu_state *qstate = \
197  (struct gdb_helper_qemu_state *)gstate->hops_priv;
198  struct hostent *he;
199  void *dst;
200  int addrtype;
201  int dlen;
202  struct sockaddr_in sin;
203  struct sockaddr_in6 sin6;
204  char *cmd = "{ \"execute\": \"qmp_capabilities\" }";
205 
206  /*
207  * If spec->qemu_qmp_port, connect. Set nonblocking.
208  */
209  if (gspec->qemu_qmp_hostname || gspec->qemu_qmp_port > 0) {
210  if (!gspec->qemu_qmp_hostname)
211  gspec->qemu_qmp_hostname = strdup("localhost");
212  if (gspec->qemu_qmp_port < 0)
213  gspec->qemu_qmp_port = 1235;
214 
215  he = gethostbyname(gspec->qemu_qmp_hostname);
216  if (!he) {
217  verror("gethostbyname(%s): %s (%d)!",gspec->qemu_qmp_hostname,
218  hstrerror(h_errno),h_errno);
219  goto in_err;
220  }
221 
222  addrtype = he->h_addrtype;
223  if (addrtype == AF_INET) {
224  memcpy(&sin.sin_addr,he->h_addr,he->h_length);
225  //sin.sin_addr.s_addr = INADDR_ANY;
226  dlen = sizeof(sin);
227  dst = &sin;
228  sin.sin_port = htons(gspec->qemu_qmp_port);
229  sin.sin_family = addrtype;
230  }
231  else if (addrtype == AF_INET6) {
232  memcpy(&sin6.sin6_addr,he->h_addr,he->h_length);
233  dlen = sizeof(sin6);
234  dst = &sin6;
235  sin6.sin6_port = htons(gspec->qemu_qmp_port);
236  sin6.sin6_family = addrtype;
237  }
238  else {
239  verror("unknown addrtype %d for hostname %s!\n",
240  addrtype,gspec->qemu_qmp_hostname);
241  goto in_err;
242  }
243 
244  /*
245  if (inet_pton(addrtype,he->h_addr,dst) != 1) {
246  verror("could not convert addr %s to network!\n",he->h_addr);
247  goto in_err;
248  }
249  */
250 
251  qstate->qemu_qmp_fd = socket(addrtype,SOCK_STREAM,0);
252  if (qstate->qemu_qmp_fd < 0) {
253  verror("socket(): %s\n",strerror(errno));
254  goto in_err;
255  }
256 
257  if (connect(qstate->qemu_qmp_fd,(struct sockaddr *)dst,dlen) < 0) {
258  verror("connect(%s): %s\n",he->h_name,strerror(errno));
259  goto in_err;
260  }
261 
263  "connected to tcp socket %s:%d (fd %d)\n",
264  he->h_name,gspec->qemu_qmp_port,qstate->qemu_qmp_fd);
265 
266  /*
267  * Make it nonblocking.
268  */
269  /*
270  flags = fcntl(qstate->qemu_qmp_fd,F_GETFL,0);
271  flags |= O_NONBLOCK;
272  fcntl(qstate->qemu_qmp_fd,F_SETFL,flags);
273  */
274 
275  /*
276  * Enter capabilities execution mode.
277  */
278  __recv_til_block(qstate->qemu_qmp_fd,NULL,0,0);
279  write(qstate->qemu_qmp_fd,cmd,strlen(cmd));
280  __recv_til_block(qstate->qemu_qmp_fd,NULL,0,1);
281  }
282 #ifdef ENABLE_LIBVIRT
283  else if (gspec->qemu_libvirt_domain) {
284  qstate->qemu_libvirt_conn = virConnectOpen(NULL);
285  if (!qstate->qemu_libvirt_conn)
286  return -1;
287  qstate->qemu_libvirt_dom =
288  virDomainLookupByName(qstate->qemu_libvirt_conn,
289  gspec->qemu_libvirt_domain);
290  if (!qstate->qemu_libvirt_dom) {
291  verror("could not find libvirt domain '%s'!\n",
292  gspec->qemu_libvirt_domain);
293  if (!errno)
294  errno = ECONNREFUSED;
295  virConnectClose(qstate->qemu_libvirt_conn);
296  qstate->qemu_libvirt_conn = NULL;
297  return -1;
298  }
299  }
300 #endif
301 
302  return 0;
303 
304  in_err:
305  if (qstate->qemu_qmp_fd > -1) {
306  close(qstate->qemu_qmp_fd);
307  qstate->qemu_qmp_fd = -1;
308  }
309  return -1;
310 }
311 
313  return 0;
314 }
315 
317  struct gdb_spec *xspec;
318 
319  xspec = (struct gdb_spec *)target->spec->backend_spec;
320 
321  /* XXX: invalidate caches? */
322  if (xspec->clear_mem_caches_each_exception) {
324  }
325  else
326  memcache_inc_ticks(target->memcache,1);
327 
328  return 0;
329 }
330 
332  struct gdb_spec *xspec;
333 
334  xspec = (struct gdb_spec *)target->spec->backend_spec;
335 
336  /* XXX: invalidate caches? */
337  if (xspec->clear_mem_caches_each_exception) {
339  }
340  else
341  memcache_inc_ticks(target->memcache,1);
342 
343  return 0;
344 }
345 
347  struct regcache *regcache) {
348  struct gdb_state *gstate = (struct gdb_state *)target->state;
349  struct gdb_helper_qemu_state *qstate = \
350  (struct gdb_helper_qemu_state *)gstate->hops_priv;
351  unsigned int i;
352  char *cmd = "{ \"execute\": \"human-monitor-command\","
353  " \"arguments\": { \"command-line\": \"info registers\" } }\n";
354  char *buf;
355  unsigned int bufsiz;
356  char *idx;
357  REGVAL regval;
358 
359  if (qstate->qemu_qmp_fd > 0) {
360  bufsiz = 4096;
361  buf = malloc(bufsiz);
362  __recv_til_block(qstate->qemu_qmp_fd,NULL,0,0);
363 
364  /*
365  * Send the command -- the whole thing.
366  */
367  write(qstate->qemu_qmp_fd,cmd,strlen(cmd));
368 
369  /*
370  * Block until we receive enough crap that has a GS *= *deadbeef.xs
371  */
372  __recv_til_block(qstate->qemu_qmp_fd,buf,bufsiz,1);
373  }
374 #ifdef ENABLE_LIBVIRT
375  else if (qstate->qemu_libvirt_conn) {
376  buf = NULL;
377  virDomainQemuMonitorCommand(qstate->qemu_libvirt_dom,cmd,&buf,0);
378  if (!buf) {
379  if (!errno)
380  errno = ECOMM;
381  return -1;
382  }
383  bufsiz = strlen(buf);
384  }
385 #endif
386  else {
387  errno = EINVAL;
388  return -1;
389  }
390 
391  for (i = 0; i < bufsiz; ++i) {
392  if (buf[i] == '\r' || buf[i] == '\n')
393  buf[i] = ' ';
394  }
395 
396  if (target->arch->type == ARCH_X86_64) {
397  idx = strstr(buf,"GS =0000 ");
398  if (idx) {
399  regval = (REGVAL)strtoull(idx + strlen("GS =0000"),NULL,16);
400 
401  vdebug(9,LA_TARGET,LF_GDB,"gs_base = 0x%"PRIxREGVAL"\n",regval);
402 
403  regcache_init_reg(regcache,REG_X86_64_GS_BASE,regval);
404  }
405  else
406  vwarnopt(9,LA_TARGET,LF_GDB,"no GS for gs_base!\n");
407  }
408 
409  idx = strstr(buf,"CR0=");
410  if (idx) {
411  regval = (REGVAL)strtoull(idx + strlen("CR0="),NULL,16);
412 
413  vdebug(9,LA_TARGET,LF_GDB,"cr0 = 0x%"PRIxREGVAL"\n",regval);
414 
415  if (target->arch->type == ARCH_X86_64)
416  regcache_init_reg(regcache,REG_X86_64_CR0,regval);
417  else
418  regcache_init_reg(regcache,REG_X86_CR0,regval);
419  }
420  else
421  vwarnopt(9,LA_TARGET,LF_GDB,"no cr0!\n");
422 
423  idx = strstr(buf,"CR3=");
424  if (idx) {
425  regval = (REGVAL)strtoull(idx + strlen("CR3="),NULL,16);
426 
427  vdebug(9,LA_TARGET,LF_GDB,"cr3 = 0x%"PRIxREGVAL"\n",regval);
428 
429  if (target->arch->type == ARCH_X86_64)
430  regcache_init_reg(regcache,REG_X86_64_CR3,regval);
431  else
432  regcache_init_reg(regcache,REG_X86_CR3,regval);
433  }
434  else
435  vwarnopt(9,LA_TARGET,LF_GDB,"no cr3!\n");
436 
437  idx = strstr(buf,"CR4=");
438  if (idx) {
439  regval = (REGVAL)strtoull(idx + strlen("CR4="),NULL,16);
440 
441  vdebug(9,LA_TARGET,LF_GDB,"cr4 = 0x%"PRIxREGVAL"\n",regval);
442 
443  if (target->arch->type == ARCH_X86_64)
444  regcache_init_reg(regcache,REG_X86_64_CR4,regval);
445  else
446  regcache_init_reg(regcache,REG_X86_CR4,regval);
447  }
448  else
449  vwarnopt(9,LA_TARGET,LF_GDB,"no cr4!\n");
450 
451  idx = strstr(buf,"DR6=");
452  if (idx) {
453  regval = (REGVAL)strtoull(idx + strlen("DR6="),NULL,16);
454 
455  vdebug(9,LA_TARGET,LF_GDB,"dr6 = 0x%"PRIxREGVAL"\n",regval);
456 
457  if (target->arch->type == ARCH_X86_64)
458  regcache_init_reg(regcache,REG_X86_64_DR6,regval);
459  else
460  regcache_init_reg(regcache,REG_X86_DR6,regval);
461  }
462  else
463  vwarnopt(9,LA_TARGET,LF_GDB,"no dr6!\n");
464 
465  idx = strstr(buf,"EFER=");
466  if (idx) {
467  regval = (REGVAL)strtoull(idx + strlen("EFER="),NULL,16);
468 
469  vdebug(9,LA_TARGET,LF_GDB,"efer = 0x%"PRIxREGVAL"\n",regval);
470 
471  if (target->arch->type == ARCH_X86_64)
472  regcache_init_reg(regcache,REG_X86_64_MSR_EFER,regval);
473  else
474  regcache_init_reg(regcache,REG_X86_MSR_EFER,regval);
475  }
476  else
477  vwarnopt(9,LA_TARGET,LF_GDB,"no efer!\n");
478 
479  if (qstate->qemu_qmp_fd > 0)
480  __recv_til_block(qstate->qemu_qmp_fd,NULL,0,0);
481 
482  free(buf);
483 
484  return 0;
485 }
486 
488  tid_t tid,ADDR pgd,ADDR addr,
489  unsigned long length,
490  unsigned char *buf) {
491  struct gdb_state *xstate;
492  struct gdb_helper_qemu_state *mstate;
493  char *ram_mmap_start,*ram_mmap_end;
494  ADDR lvaddr;
495  OFFSET voffset = 0;
496  char *mmap = NULL;
497  unsigned long mlen;
498  ADDR paddr;
499  unsigned long i,j;
500  int rc;
501  unsigned long plength = 0;
502  char *lbuf;
503  unsigned long alen = 0;
504 
505  xstate = (struct gdb_state *)target->state;
506  mstate = (struct gdb_helper_qemu_state *)xstate->hops_priv;
507 
508  if (!mstate->ram_mmap) {
509  vwarnopt(5,LA_TARGET,LF_GDB,"QEMU -mem-path option not enabled!\n");
510  errno = ENOTSUP;
511  return NULL;
512  }
513 
514  if (buf)
515  lbuf = (char *)buf;
516  else if (length)
517  lbuf = malloc(length + 1);
518  else {
519  lbuf = NULL;
520  }
521 
522  ram_mmap_start = (char *)mstate->ram_mmap;
523  ram_mmap_end = (char *)mstate->ram_mmap + mstate->ram_mmap_size;
524 
525  /*
526  * Ok, translate vaddrs to paddrs page by page and read.
527  */
528 
529  lvaddr = addr & ~(__PAGE_SIZE - 1);
530  voffset = addr & (__PAGE_SIZE - 1);
531 
532  for (i = 0; length == 0 || plength < length; ++i) {
533  rc = gdb_helper_qemu_addr_v2p(target,tid,pgd,lvaddr + i * __PAGE_SIZE,
534  &paddr);
535  if (rc) {
536  verror("could not translate v 0x%"PRIxADDR"; start v 0x%"PRIxADDR"!\n",
537  lvaddr,addr);
538  if (lbuf != (char *)buf)
539  free(lbuf);
540  return NULL;
541  }
542 
543  mlen = __PAGE_SIZE;
544  if (i == 0) {
545  mlen -= voffset;
546  }
547 
548  if (length > 0 && (plength + mlen) > length)
549  mlen = (length - plength);
550 
551  mmap = ram_mmap_start + paddr;
552  if (i == 0)
553  mmap += voffset;
554 
555  if (mmap < ram_mmap_start || mmap >= ram_mmap_end) {
556  verror("Bad physical address 0x%"PRIxADDR"!\n",paddr);
557  errno = EFAULT;
558  if (lbuf != (char *)buf)
559  free(lbuf);
560  return NULL;
561  }
562  else {
563  /* If looking for string, make more room in lbuf! */
564  if (!buf && !length) {
565  alen += mlen;
566  lbuf = realloc(lbuf,alen);
567  }
568 
569  /* Copy the whole chunk to the end of the page. */
570  memcpy(lbuf + plength,mmap,mlen);
571 
572  /* If looking for string, look for '\0'. */
573  if (!buf && !length) {
574  for (j = plength; j < (plength + mlen); ++j) {
575  if (lbuf[j] == '\0')
576  break;
577  }
578  if (j < (plength + mlen)) {
579  lbuf = realloc(lbuf,plength + j + 1);
580  lbuf[j] = '\0';
581  break;
582  }
583  }
584 
585  /* Update our total bytes read. */
586  plength += mlen;
587  }
588  }
589 
590  return (unsigned char *)lbuf;
591 }
592 
594  tid_t tid,ADDR pgd,ADDR addr,
595  unsigned long length,
596  unsigned char *buf) {
597  struct gdb_state *xstate;
598  struct gdb_helper_qemu_state *mstate;
599  char *ram_mmap_start,*ram_mmap_end;
600  ADDR lvaddr;
601  OFFSET voffset = 0;
602  char *mmap = NULL;
603  unsigned long mlen;
604  ADDR paddr;
605  unsigned long i;
606  int rc;
607  unsigned long plength = 0;
608 
609  xstate = (struct gdb_state *)target->state;
610  mstate = (struct gdb_helper_qemu_state *)xstate->hops_priv;
611 
612  if (!mstate->ram_mmap) {
613  vwarnopt(5,LA_TARGET,LF_GDB,"QEMU -mem-path option not enabled!\n");
614  errno = ENOTSUP;
615  return 0;
616  }
617 
618  ram_mmap_start = (char *)mstate->ram_mmap;
619  ram_mmap_end = (char *)mstate->ram_mmap + mstate->ram_mmap_size;
620 
621  /*
622  * Ok, translate vaddrs to paddrs page by page and write.
623  */
624 
625  lvaddr = addr & ~(__PAGE_SIZE - 1);
626  voffset = addr & (__PAGE_SIZE - 1);
627 
628  for (i = 0; plength < length; ++i) {
629  rc = gdb_helper_qemu_addr_v2p(target,tid,pgd,lvaddr + i * __PAGE_SIZE,
630  &paddr);
631  if (rc) {
632  verror("could not translate v 0x%"PRIxADDR"; start v 0x%"PRIxADDR"!\n",
633  lvaddr,addr);
634  return 0;
635  }
636 
637  mlen = __PAGE_SIZE;
638  if (i == 0) {
639  mlen -= voffset;
640  }
641 
642  if ((plength + mlen) > length)
643  mlen = (length - plength);
644 
645  mmap = ram_mmap_start + paddr;
646  if (i == 0)
647  mmap += voffset;
648 
649  if (mmap < ram_mmap_start || mmap >= ram_mmap_end) {
650  verror("Bad physical address 0x%"PRIxADDR"!\n",paddr);
651  errno = EFAULT;
652  return 0;
653  }
654  else {
655  /* Copy the whole chunk to the end of the page or @length. */
656  memcpy(mmap,buf + plength,mlen);
657  /* Update our total bytes written. */
658  plength += mlen;
659  }
660  }
661 
662  return plength;
663 }
664 
665 unsigned char *gdb_helper_qemu_read_v_str(struct target *target,
666  tid_t tid,ADDR pgd,ADDR addr) {
667  int j;
668  unsigned char *lbuf = NULL;
669  int lbuf_alen;
670  int lbuf_len;
671 
672  /*
673  * Best strategy is to read page by page (starting with the remnant
674  * of the page containing @addr), or byte by byte -- depending on
675  * the GDB stub. A page should always be safe, so do that for now.
676  *
677  * Ok, turns out a page is *not* safe, and for instance, will cause
678  * the QEMU GDB stub to crash. So stick with target wordsize, ugh!!!
679  */
680 
681  //lbuf_alen = __PAGE_SIZE - (addr & (__PAGE_SIZE - 1));
682  lbuf_alen = target->arch->wordsize;
683  lbuf = realloc(lbuf,lbuf_alen);
684  lbuf_len = 0;
685 
686  do {
687  if (!gdb_helper_qemu_read_tid(target,tid,pgd,addr + lbuf_len,
688  lbuf_alen - lbuf_len,lbuf + lbuf_len)) {
689  verror("failed to read string at 0x%"PRIxADDR" (target %s)!\n",
690  addr,target->name);
691  free(lbuf);
692  return NULL;
693  }
694 
695  /*
696  * Scan the mmap as necessary for '\0', malloc as necessary, and
697  * break or keep going.
698  */
699  for (j = lbuf_len; j < lbuf_alen; ++j) {
700  if (lbuf[j] == '\0')
701  break;
702  }
703 
704  if (j < lbuf_alen) {
705  /* Found it! realloc and return. */
706  lbuf = realloc(lbuf,j + 1);
707  return lbuf;
708  }
709  else {
710  lbuf_len = lbuf_alen;
711  //lbuf_alen += __PAGE_SIZE;
712  lbuf_alen += target->arch->wordsize;
713  lbuf = realloc(lbuf,lbuf_alen);
714  }
715  } while (1);
716 
717  return (unsigned char *)lbuf;
718 }
719 
720 /*
721  * XXX NB: When we talk to the QEMU GDB, we can't seem to read/write
722  * "big chunks" without crashing the GDB stub, and thus QEMU --- so just
723  * read 1KB at a time.
724  */
725 #define GDB_MAX_IO 1024
726 
727 /*
728  * Reads a block of memory from the target. If @buf is non-NULL, we
729  * assume it is at least @length bytes long; the result is placed into
730  * @buf and @buf is returned. If @buf is NULL, we allocate a buffer
731  * large enough to hold the result (@length if @length >0; if @length is
732  * 0 we attempt to read a string at that address; we stop when we hit a
733  * NULL byte).
734  *
735  * On error, returns NULL, and sets errno.
736  */
737 unsigned char *gdb_helper_qemu_read_tid(struct target *target,
738  tid_t tid,ADDR pgd,ADDR addr,
739  unsigned long length,
740  unsigned char *buf) {
741  struct target_thread *tthread;
742  int rc;
743  int didalloc = 0;
744  unsigned long bread,left;
745  struct gdb_state *xstate;
746  struct gdb_helper_qemu_state *mstate;
747 
748  xstate = (struct gdb_state *)target->state;
749  mstate = (struct gdb_helper_qemu_state *)xstate->hops_priv;
750 
751  if (mstate->ram_mmap) {
752  vdebug(5,LA_TARGET,LF_GDB,"trying QEMU -mem-path!\n");
753 
754  return gdb_helper_qemu_read_tid_mem_path(target,tid,pgd,addr,length,buf);
755  }
756 
757  /*
758  * Check @tid is current thread or global thread or that all threads
759  * share a single address space!
760  *
761  * How to check if all threads share a single address space? Maybe
762  * just by checking the target type for now; if OS, assume threads
763  * need not share an address space; if process or higher-level,
764  * assume they do?
765  */
766  if (target->personality <= TARGET_PERSONALITY_OS && tid != TID_GLOBAL) {
767  tthread = target_load_current_thread(target,0);
768  if (!tthread) {
769  vwarn("could not load current thread; assuming tid %d is current!\n",
770  tid);
771  }
772  else {
773  if (tthread->tid != tid) {
774  verror("tid %d is not current nor global; cannot read!\n",tid);
775  return NULL;
776  }
777  }
778  }
779 
780  if (length == 0)
781  return gdb_helper_qemu_read_v_str(target,tid,pgd,addr);
782 
783  if (!buf) {
784  didalloc = 1;
785  buf = malloc(length);
786  }
787 
788  bread = 0;
789  while (bread < length) {
790  left = length - bread;
791  rc = gdb_rsp_read_mem(target,addr + bread,
792  (left) > GDB_MAX_IO ? GDB_MAX_IO : left,
793  buf + bread);
794  if (rc == 0) {
795  if (left > GDB_MAX_IO)
796  bread += GDB_MAX_IO;
797  else
798  bread += left;
799 
800  if (bread >= length)
801  return buf;
802  else
803  continue;
804  }
805  else {
806  verror("v 0x%"PRIxADDR" len %lu: %s (%d); continuing\n",
807  addr,length,strerror(errno),rc);
808  if (didalloc)
809  free(buf);
810  return NULL;
811  }
812  }
813 }
814 
815 /*
816  * Writes @length bytes from @buf to @addr. Returns the number of bytes
817  * written (and sets errno nonzero if there is an error). Successful if
818  * @return == @length.
819  */
821  tid_t tid,ADDR pgd,ADDR addr,
822  unsigned long length,
823  unsigned char *buf) {
824  struct target_thread *tthread;
825  int rc;
826  unsigned long bwrote,left;
827  struct gdb_state *xstate;
828  struct gdb_helper_qemu_state *mstate;
829 
830  xstate = (struct gdb_state *)target->state;
831  mstate = (struct gdb_helper_qemu_state *)xstate->hops_priv;
832 
833  if (mstate->ram_mmap) {
834  vdebug(5,LA_TARGET,LF_GDB,"trying QEMU -mem-path!\n");
835 
836  return gdb_helper_qemu_write_tid_mem_path(target,tid,pgd,addr,length,buf);
837  }
838 
839  /*
840  * Check @tid is current thread or global thread or that all threads
841  * share a single address space!
842  *
843  * How to check if all threads share a single address space? Maybe
844  * just by checking the target type for now; if OS, assume threads
845  * need not share an address space; if process or higher-level,
846  * assume they do?
847  */
848  if (target->personality <= TARGET_PERSONALITY_OS && tid != TID_GLOBAL) {
849  tthread = target_load_current_thread(target,0);
850  if (!tthread) {
851  vwarn("could not load current thread; assuming tid %d is current!\n",
852  tid);
853  }
854  else {
855  if (tthread->tid != tid) {
856  verror("tid %d is not current nor global; cannot read!\n",tid);
857  errno = EINVAL;
858  return 0;
859  }
860  }
861  }
862 
863  bwrote = 0;
864  while (bwrote < length) {
865  left = length - bwrote;
866  rc = gdb_rsp_write_mem(target,addr + bwrote,
867  (left) > GDB_MAX_IO ? GDB_MAX_IO : left,
868  buf + bwrote);
869  if (rc == 0) {
870  if (left > GDB_MAX_IO)
871  bwrote += GDB_MAX_IO;
872  else
873  bwrote += left;
874 
875  if (bwrote >= length)
876  return length;
877  else
878  continue;
879  }
880  else {
881  verror("v 0x%"PRIxADDR" len %lu: %s (%d)\n",
882  addr,length,strerror(errno),rc);
883  return 0;
884  }
885  }
886 
887  /* NB: only way we get here is if length == 0 */
888  return 0;
889 }
890 
892  ADDR vaddr,ADDR *paddr) {
893  struct gdb_state *xstate;
894  struct gdb_helper_qemu_state *mstate;
895  ADDR tvaddr,tpaddr;
896  int rc;
897 
898  xstate = (struct gdb_state *)target->state;
899  mstate = (struct gdb_helper_qemu_state *)xstate->hops_priv;
900 
901  if (!mstate->ram_mmap) {
902  vwarnopt(5,LA_TARGET,LF_GDB,"QEMU -mem-path option not enabled!\n");
903  errno = ENOTSUP;
904  return -1;
905  }
906 
907  /*
908  * Strip the offset bits to improve builtin/xenaccess cache perf.
909  */
910  tvaddr = vaddr & ~(__PAGE_SIZE - 1);
911 
912  rc = memcache_get_v2p(target->memcache,pgd,tvaddr,paddr,NULL);
913  if (rc == 0)
914  return 0;
915  else if (rc < 0) {
916  vwarn("error while looking up vaddr 0x%"PRIxADDR" (for vaddr"
917  " 0x%"PRIxADDR") in memcache: %s (%d); trying full lookup!\n",
918  tvaddr,vaddr,strerror(errno),rc);
919  }
920 
921  rc = target_arch_x86_v2p(target,pgd,vaddr,ARCH_X86_V2P_LMA,&tpaddr);
922  if (rc) {
923  verror("could not lookup vaddr 0x%"PRIxADDR" in tid %"PRIiTID
924  " pgd 0x%"PRIxADDR"!\n",
925  vaddr,tid,pgd);
926  return -1;
927  }
928 
929  *paddr = tpaddr | (vaddr & (__PAGE_SIZE - 1));
930 
932  "tid %"PRIiTID" vaddr 0x%"PRIxADDR" -> paddr 0x%"PRIxADDR"\n",
933  tid,vaddr,*paddr);
934 
935  memcache_set_v2p(target->memcache,pgd,vaddr,*paddr);
936 
937  return 0;
938 }
939 
941  ADDR addr) {
942  struct gdb_state *xstate;
943  struct gdb_helper_qemu_state *mstate;
944  char *end;
945  char *ram_mmap_start,*ram_mmap_end;
946  unsigned long mlen;
947  char *retval;
948 
949  xstate = (struct gdb_state *)target->state;
950  mstate = (struct gdb_helper_qemu_state *)xstate->hops_priv;
951 
952  if (!mstate->ram_mmap) {
953  vwarnopt(5,LA_TARGET,LF_GDB,"QEMU -mem-path option not enabled!\n");
954  errno = ENOTSUP;
955  return NULL;
956  }
957 
958  /*
959  * Read phys pages until we see a '\0'.
960  */
961  ram_mmap_start = (char *)mstate->ram_mmap + addr;
962  ram_mmap_end = (char *)mstate->ram_mmap + mstate->ram_mmap_size;
963  end = ram_mmap_start;
964 
965  while (end >= (char *)mstate->ram_mmap && end < ram_mmap_end) {
966  if (*end == '\0')
967  break;
968  ++end;
969  }
970 
971  mlen = end - ram_mmap_start;
972  retval = malloc(mlen + 1);
973  if (mlen > 0)
974  memcpy(retval,ram_mmap_start,mlen);
975  retval[mlen] = '\0';
976 
977  return (unsigned char *)retval;
978 }
979 
980 unsigned char *gdb_helper_qemu_read_phys(struct target *target,ADDR paddr,
981  unsigned long length,
982  unsigned char *buf) {
983  struct gdb_state *xstate;
984  struct gdb_helper_qemu_state *mstate;
985  char *ram_mmap_start,*ram_mmap_end;
986 
987  xstate = (struct gdb_state *)target->state;
988  mstate = (struct gdb_helper_qemu_state *)xstate->hops_priv;
989 
990  if (!mstate->ram_mmap) {
991  vwarnopt(5,LA_TARGET,LF_GDB,"QEMU -mem-path option not enabled!\n");
992  errno = ENOTSUP;
993  return NULL;
994  }
995 
996  ram_mmap_start = (char *)mstate->ram_mmap + paddr;
997  ram_mmap_end = (char *)mstate->ram_mmap + mstate->ram_mmap_size;
998 
999  if (ram_mmap_start >= (char *)mstate->ram_mmap
1000  && (ram_mmap_start + length) < ram_mmap_end) {
1001  /* allocate buffer if necessary */
1002  if (!buf) {
1003  buf = malloc(length + 1);
1004  buf[length] = '\0';
1005  }
1006  memcpy(buf,ram_mmap_start,length);
1007  }
1008  else {
1009  verror("bad read paddr/length 0x%"PRIxADDR" %lu\n",paddr,length);
1010  errno = EFAULT;
1011  return NULL;
1012  }
1013 
1014  return (unsigned char *)buf;
1015 }
1016 
1017 unsigned long gdb_helper_qemu_write_phys(struct target *target,ADDR paddr,
1018  unsigned long length,
1019  unsigned char *buf) {
1020  struct gdb_state *xstate;
1021  struct gdb_helper_qemu_state *mstate;
1022  char *ram_mmap_start,*ram_mmap_end;
1023 
1024  xstate = (struct gdb_state *)target->state;
1025  mstate = (struct gdb_helper_qemu_state *)xstate->hops_priv;
1026 
1027  if (!mstate->ram_mmap) {
1028  vwarnopt(5,LA_TARGET,LF_GDB,"QEMU -mem-path option not enabled!\n");
1029  errno = ENOTSUP;
1030  return 0;
1031  }
1032 
1033  ram_mmap_start = (char *)mstate->ram_mmap + paddr;
1034  ram_mmap_end = (char *)mstate->ram_mmap + mstate->ram_mmap_size;
1035 
1036  if (ram_mmap_start >= (char *)mstate->ram_mmap
1037  && (ram_mmap_start + length) < ram_mmap_end) {
1038  memcpy(ram_mmap_start,buf,length);
1039  return length;
1040  }
1041  else {
1042  verror("bad write paddr/length 0x%"PRIxADDR" %lu\n",paddr,length);
1043  errno = EFAULT;
1044  return 0;
1045  }
1046 }
1047 
1049  struct gdb_state *gstate = (struct gdb_state *)target->state;
1050  struct gdb_helper_qemu_state *qstate = calloc(1,sizeof(*qstate));
1051 
1052  if (qstate->qemu_qmp_fd > -1) {
1053  close(qstate->qemu_qmp_fd);
1054  qstate->qemu_qmp_fd = -1;
1055  }
1056 #ifdef ENABLE_LIBVIRT
1057  else if (qstate->qemu_libvirt_conn) {
1058  qstate->qemu_libvirt_dom = 0;
1059  virConnectClose(qstate->qemu_libvirt_conn);
1060  qstate->qemu_libvirt_conn = 0;
1061  }
1062 #endif
1063 
1064  if (qstate->ram_mmap) {
1065  munmap(qstate->ram_mmap,qstate->ram_mmap_size);
1066  qstate->ram_mmap = NULL;
1067  qstate->ram_mmap_size = 0;
1068  close(qstate->ram_mmap_fd);
1069  }
1070 
1071  free(qstate);
1072  gstate->hops_priv = NULL;
1073 
1074  return 0;
1075 }
1076 
1079  .attach = gdb_helper_qemu_attach,
1080 
1081  .handle_exception_any = gdb_helper_qemu_handle_exception_any,
1082  .handle_exception_ours = gdb_helper_qemu_handle_exception_ours,
1083  .handle_pause = gdb_helper_qemu_handle_pause,
1084 
1085  .load_machine = gdb_helper_qemu_load_machine,
1086  /*
1087  * No physical address space access; see comments at top!
1088  */
1089  .addr_v2p = gdb_helper_qemu_addr_v2p,
1090  .read_phys = gdb_helper_qemu_read_phys,
1091  .write_phys = gdb_helper_qemu_write_phys,
1092 
1093  .read_tid = gdb_helper_qemu_read_tid,
1094  .write_tid = gdb_helper_qemu_write_tid,
1095 
1096  .fini = gdb_helper_qemu_fini,
1097 };
arch_type_t type
Definition: arch.h:117
int target_arch_x86_v2p(struct target *target, ADDR pgd, ADDR virt, arch_x86_v2p_flags_t flags, ADDR *phys)
#define vwarnopt(level, area, flags, format,...)
Definition: log.h:37
GHashTable * config
Definition: target_api.h:2582
void * state
Definition: target_api.h:2488
void * backend_spec
Definition: target_api.h:2252
int32_t tid_t
Definition: common.h:36
target_personality_t personality
Definition: target_api.h:2477
Definition: log.h:175
#define REG_X86_64_CR4
Definition: arch_x86_64.h:140
int gdb_helper_qemu_handle_exception_any(struct target *target)
int __recv_til_block(int fd, char *buf, unsigned int len, int blockfirst)
int regcache_init_reg(struct regcache *regcache, REG reg, REGVAL regval)
Definition: regcache.c:153
#define REG_X86_CR4
Definition: arch_x86.h:103
char * qemu_mem_path
Definition: target_gdb.h:61
int gdb_rsp_write_mem(struct target *target, ADDR addr, unsigned long length, unsigned char *buf)
#define REG_X86_CR3
Definition: arch_x86.h:102
int32_t OFFSET
Definition: common.h:65
unsigned char * gdb_helper_qemu_read_tid(struct target *target, tid_t tid, ADDR pgd, ADDR addr, unsigned long length, unsigned char *buf)
#define verror(format,...)
Definition: log.h:30
unsigned char * gdb_helper_qemu_read_tid_mem_path(struct target *target, tid_t tid, ADDR pgd, ADDR addr, unsigned long length, unsigned char *buf)
#define REG_X86_MSR_EFER
Definition: arch_x86.h:114
unsigned long gdb_helper_qemu_write_phys(struct target *target, ADDR paddr, unsigned long length, unsigned char *buf)
int gdb_helper_qemu_attach(struct target *target)
unsigned char * gdb_helper_qemu_read_phys(struct target *target, ADDR paddr, unsigned long length, unsigned char *buf)
#define vwarn(format,...)
Definition: log.h:33
struct target_thread * target_load_current_thread(struct target *target, int force)
Definition: target_api.c:1240
int memcache_get_v2p(struct memcache *memcache, ADDR tag, ADDR va, ADDR *pa, void **tag_priv)
Definition: memcache.c:232
int gdb_helper_qemu_handle_exception_ours(struct target *target)
int gdb_helper_qemu_addr_v2p(struct target *target, tid_t tid, ADDR pgd, ADDR vaddr, ADDR *paddr)
unsigned int clear_mem_caches_each_exception
Definition: target_gdb.h:39
int memcache_set_v2p(struct memcache *memcache, ADDR tag, ADDR va, ADDR pa)
Definition: memcache.c:369
#define __PAGE_SIZE
#define REG_X86_64_DR6
Definition: arch_x86_64.h:151
void * hops_priv
Definition: target_gdb.h:132
void * mmap(void *addr, size_t length, int prot, int flags, int fd, off_t offset)
Definition: qemuhacks.c:211
struct memcache * memcache
Definition: target_api.h:2751
#define REG_X86_DR6
Definition: arch_x86.h:111
unsigned long gdb_helper_qemu_write_tid_mem_path(struct target *target, tid_t tid, ADDR pgd, ADDR addr, unsigned long length, unsigned char *buf)
unsigned char * gdb_helper_qemu_read_v_str(struct target *target, tid_t tid, ADDR pgd, ADDR addr)
int len
Definition: dumptarget.c:52
#define REG_X86_64_MSR_EFER
Definition: arch_x86_64.h:154
#define PROT_WRITE
Definition: common.h:107
#define vdebug(devel, areas, flags, format,...)
Definition: log.h:302
int memcache_invalidate_all(struct memcache *memcache)
Definition: memcache.c:138
Definition: log.h:172
struct gdb_helper_ops gdb_helper_ops_qemu
struct arch * arch
Definition: target_api.h:2563
unsigned int wordsize
Definition: arch.h:121
unsigned long gdb_helper_qemu_write_tid(struct target *target, tid_t tid, ADDR pgd, ADDR addr, unsigned long length, unsigned char *buf)
Definition: log.h:70
int gdb_rsp_read_mem(struct target *target, ADDR addr, unsigned long length, unsigned char *buf)
uint32_t REGVAL
Definition: common.h:66
int gdb_helper_qemu_fini(struct target *target)
int gdb_helper_qemu_load_machine(struct target *target, struct regcache *regcache)
#define PRIiTID
Definition: common.h:37
int gdb_helper_qemu_init(struct target *target)
int h_errno
#define REG_X86_64_GS_BASE
Definition: arch_x86_64.h:110
uint32_t ADDR
Definition: common.h:64
char * name
Definition: target_api.h:2483
struct memcache * memcache_create(unsigned long int max_v2p, unsigned long int max_mmap_size, memcache_tag_priv_dtor pdtor)
Definition: memcache.c:33
void memcache_inc_ticks(struct memcache *memcache, unsigned int new_ticks)
Definition: memcache.c:220
#define PROT_READ
Definition: common.h:106
#define PRIxADDR
Definition: common.h:67
struct target_spec * spec
Definition: target_api.h:2565
#define REG_X86_CR0
Definition: arch_x86.h:99
#define REG_X86_64_CR0
Definition: arch_x86_64.h:136
unsigned char * gdb_helper_qemu_read_phys_str(struct target *target, ADDR addr)
#define GDB_MAX_IO
int gdb_helper_qemu_handle_pause(struct target *target)
int(* init)(struct target *target)
Definition: target_gdb.h:147
#define REG_X86_64_CR3
Definition: arch_x86_64.h:139
#define TID_GLOBAL
Definition: target_api.h:145
#define PRIxREGVAL
Definition: common.h:72