qemu/gdbstub.c
<<
>>
Prefs
   1/*
   2 * gdb server stub
   3 *
   4 * Copyright (c) 2003-2005 Fabrice Bellard
   5 *
   6 * This library is free software; you can redistribute it and/or
   7 * modify it under the terms of the GNU Lesser General Public
   8 * License as published by the Free Software Foundation; either
   9 * version 2 of the License, or (at your option) any later version.
  10 *
  11 * This library is distributed in the hope that it will be useful,
  12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14 * Lesser General Public License for more details.
  15 *
  16 * You should have received a copy of the GNU Lesser General Public
  17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18 */
  19#include "config.h"
  20#include "qemu-common.h"
  21#ifdef CONFIG_USER_ONLY
  22#include <stdlib.h>
  23#include <stdio.h>
  24#include <stdarg.h>
  25#include <string.h>
  26#include <errno.h>
  27#include <unistd.h>
  28#include <fcntl.h>
  29
  30#include "qemu.h"
  31#else
  32#include "monitor/monitor.h"
  33#include "sysemu/char.h"
  34#include "sysemu/sysemu.h"
  35#include "exec/gdbstub.h"
  36#endif
  37
  38#define MAX_PACKET_LENGTH 4096
  39
  40#include "cpu.h"
  41#include "qemu/sockets.h"
  42#include "sysemu/kvm.h"
  43
  44static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
  45                                         uint8_t *buf, int len, bool is_write)
  46{
  47    CPUClass *cc = CPU_GET_CLASS(cpu);
  48
  49    if (cc->memory_rw_debug) {
  50        return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
  51    }
  52    return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
  53}
  54
  55enum {
  56    GDB_SIGNAL_0 = 0,
  57    GDB_SIGNAL_INT = 2,
  58    GDB_SIGNAL_QUIT = 3,
  59    GDB_SIGNAL_TRAP = 5,
  60    GDB_SIGNAL_ABRT = 6,
  61    GDB_SIGNAL_ALRM = 14,
  62    GDB_SIGNAL_IO = 23,
  63    GDB_SIGNAL_XCPU = 24,
  64    GDB_SIGNAL_UNKNOWN = 143
  65};
  66
  67#ifdef CONFIG_USER_ONLY
  68
  69/* Map target signal numbers to GDB protocol signal numbers and vice
  70 * versa.  For user emulation's currently supported systems, we can
  71 * assume most signals are defined.
  72 */
  73
  74static int gdb_signal_table[] = {
  75    0,
  76    TARGET_SIGHUP,
  77    TARGET_SIGINT,
  78    TARGET_SIGQUIT,
  79    TARGET_SIGILL,
  80    TARGET_SIGTRAP,
  81    TARGET_SIGABRT,
  82    -1, /* SIGEMT */
  83    TARGET_SIGFPE,
  84    TARGET_SIGKILL,
  85    TARGET_SIGBUS,
  86    TARGET_SIGSEGV,
  87    TARGET_SIGSYS,
  88    TARGET_SIGPIPE,
  89    TARGET_SIGALRM,
  90    TARGET_SIGTERM,
  91    TARGET_SIGURG,
  92    TARGET_SIGSTOP,
  93    TARGET_SIGTSTP,
  94    TARGET_SIGCONT,
  95    TARGET_SIGCHLD,
  96    TARGET_SIGTTIN,
  97    TARGET_SIGTTOU,
  98    TARGET_SIGIO,
  99    TARGET_SIGXCPU,
 100    TARGET_SIGXFSZ,
 101    TARGET_SIGVTALRM,
 102    TARGET_SIGPROF,
 103    TARGET_SIGWINCH,
 104    -1, /* SIGLOST */
 105    TARGET_SIGUSR1,
 106    TARGET_SIGUSR2,
 107#ifdef TARGET_SIGPWR
 108    TARGET_SIGPWR,
 109#else
 110    -1,
 111#endif
 112    -1, /* SIGPOLL */
 113    -1,
 114    -1,
 115    -1,
 116    -1,
 117    -1,
 118    -1,
 119    -1,
 120    -1,
 121    -1,
 122    -1,
 123    -1,
 124#ifdef __SIGRTMIN
 125    __SIGRTMIN + 1,
 126    __SIGRTMIN + 2,
 127    __SIGRTMIN + 3,
 128    __SIGRTMIN + 4,
 129    __SIGRTMIN + 5,
 130    __SIGRTMIN + 6,
 131    __SIGRTMIN + 7,
 132    __SIGRTMIN + 8,
 133    __SIGRTMIN + 9,
 134    __SIGRTMIN + 10,
 135    __SIGRTMIN + 11,
 136    __SIGRTMIN + 12,
 137    __SIGRTMIN + 13,
 138    __SIGRTMIN + 14,
 139    __SIGRTMIN + 15,
 140    __SIGRTMIN + 16,
 141    __SIGRTMIN + 17,
 142    __SIGRTMIN + 18,
 143    __SIGRTMIN + 19,
 144    __SIGRTMIN + 20,
 145    __SIGRTMIN + 21,
 146    __SIGRTMIN + 22,
 147    __SIGRTMIN + 23,
 148    __SIGRTMIN + 24,
 149    __SIGRTMIN + 25,
 150    __SIGRTMIN + 26,
 151    __SIGRTMIN + 27,
 152    __SIGRTMIN + 28,
 153    __SIGRTMIN + 29,
 154    __SIGRTMIN + 30,
 155    __SIGRTMIN + 31,
 156    -1, /* SIGCANCEL */
 157    __SIGRTMIN,
 158    __SIGRTMIN + 32,
 159    __SIGRTMIN + 33,
 160    __SIGRTMIN + 34,
 161    __SIGRTMIN + 35,
 162    __SIGRTMIN + 36,
 163    __SIGRTMIN + 37,
 164    __SIGRTMIN + 38,
 165    __SIGRTMIN + 39,
 166    __SIGRTMIN + 40,
 167    __SIGRTMIN + 41,
 168    __SIGRTMIN + 42,
 169    __SIGRTMIN + 43,
 170    __SIGRTMIN + 44,
 171    __SIGRTMIN + 45,
 172    __SIGRTMIN + 46,
 173    __SIGRTMIN + 47,
 174    __SIGRTMIN + 48,
 175    __SIGRTMIN + 49,
 176    __SIGRTMIN + 50,
 177    __SIGRTMIN + 51,
 178    __SIGRTMIN + 52,
 179    __SIGRTMIN + 53,
 180    __SIGRTMIN + 54,
 181    __SIGRTMIN + 55,
 182    __SIGRTMIN + 56,
 183    __SIGRTMIN + 57,
 184    __SIGRTMIN + 58,
 185    __SIGRTMIN + 59,
 186    __SIGRTMIN + 60,
 187    __SIGRTMIN + 61,
 188    __SIGRTMIN + 62,
 189    __SIGRTMIN + 63,
 190    __SIGRTMIN + 64,
 191    __SIGRTMIN + 65,
 192    __SIGRTMIN + 66,
 193    __SIGRTMIN + 67,
 194    __SIGRTMIN + 68,
 195    __SIGRTMIN + 69,
 196    __SIGRTMIN + 70,
 197    __SIGRTMIN + 71,
 198    __SIGRTMIN + 72,
 199    __SIGRTMIN + 73,
 200    __SIGRTMIN + 74,
 201    __SIGRTMIN + 75,
 202    __SIGRTMIN + 76,
 203    __SIGRTMIN + 77,
 204    __SIGRTMIN + 78,
 205    __SIGRTMIN + 79,
 206    __SIGRTMIN + 80,
 207    __SIGRTMIN + 81,
 208    __SIGRTMIN + 82,
 209    __SIGRTMIN + 83,
 210    __SIGRTMIN + 84,
 211    __SIGRTMIN + 85,
 212    __SIGRTMIN + 86,
 213    __SIGRTMIN + 87,
 214    __SIGRTMIN + 88,
 215    __SIGRTMIN + 89,
 216    __SIGRTMIN + 90,
 217    __SIGRTMIN + 91,
 218    __SIGRTMIN + 92,
 219    __SIGRTMIN + 93,
 220    __SIGRTMIN + 94,
 221    __SIGRTMIN + 95,
 222    -1, /* SIGINFO */
 223    -1, /* UNKNOWN */
 224    -1, /* DEFAULT */
 225    -1,
 226    -1,
 227    -1,
 228    -1,
 229    -1,
 230    -1
 231#endif
 232};
 233#else
 234/* In system mode we only need SIGINT and SIGTRAP; other signals
 235   are not yet supported.  */
 236
 237enum {
 238    TARGET_SIGINT = 2,
 239    TARGET_SIGTRAP = 5
 240};
 241
 242static int gdb_signal_table[] = {
 243    -1,
 244    -1,
 245    TARGET_SIGINT,
 246    -1,
 247    -1,
 248    TARGET_SIGTRAP
 249};
 250#endif
 251
 252#ifdef CONFIG_USER_ONLY
 253static int target_signal_to_gdb (int sig)
 254{
 255    int i;
 256    for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 257        if (gdb_signal_table[i] == sig)
 258            return i;
 259    return GDB_SIGNAL_UNKNOWN;
 260}
 261#endif
 262
 263static int gdb_signal_to_target (int sig)
 264{
 265    if (sig < ARRAY_SIZE (gdb_signal_table))
 266        return gdb_signal_table[sig];
 267    else
 268        return -1;
 269}
 270
 271//#define DEBUG_GDB
 272
 273typedef struct GDBRegisterState {
 274    int base_reg;
 275    int num_regs;
 276    gdb_reg_cb get_reg;
 277    gdb_reg_cb set_reg;
 278    const char *xml;
 279    struct GDBRegisterState *next;
 280} GDBRegisterState;
 281
 282enum RSState {
 283    RS_INACTIVE,
 284    RS_IDLE,
 285    RS_GETLINE,
 286    RS_CHKSUM1,
 287    RS_CHKSUM2,
 288};
 289typedef struct GDBState {
 290    CPUState *c_cpu; /* current CPU for step/continue ops */
 291    CPUState *g_cpu; /* current CPU for other ops */
 292    CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 293    enum RSState state; /* parsing state */
 294    char line_buf[MAX_PACKET_LENGTH];
 295    int line_buf_index;
 296    int line_csum;
 297    uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 298    int last_packet_len;
 299    int signal;
 300#ifdef CONFIG_USER_ONLY
 301    int fd;
 302    int running_state;
 303#else
 304    CharDriverState *chr;
 305    CharDriverState *mon_chr;
 306#endif
 307    char syscall_buf[256];
 308    gdb_syscall_complete_cb current_syscall_cb;
 309} GDBState;
 310
 311/* By default use no IRQs and no timers while single stepping so as to
 312 * make single stepping like an ICE HW step.
 313 */
 314static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 315
 316static GDBState *gdbserver_state;
 317
 318bool gdb_has_xml;
 319
 320#ifdef CONFIG_USER_ONLY
 321/* XXX: This is not thread safe.  Do we care?  */
 322static int gdbserver_fd = -1;
 323
 324static int get_char(GDBState *s)
 325{
 326    uint8_t ch;
 327    int ret;
 328
 329    for(;;) {
 330        ret = qemu_recv(s->fd, &ch, 1, 0);
 331        if (ret < 0) {
 332            if (errno == ECONNRESET)
 333                s->fd = -1;
 334            if (errno != EINTR && errno != EAGAIN)
 335                return -1;
 336        } else if (ret == 0) {
 337            close(s->fd);
 338            s->fd = -1;
 339            return -1;
 340        } else {
 341            break;
 342        }
 343    }
 344    return ch;
 345}
 346#endif
 347
 348static enum {
 349    GDB_SYS_UNKNOWN,
 350    GDB_SYS_ENABLED,
 351    GDB_SYS_DISABLED,
 352} gdb_syscall_mode;
 353
 354/* If gdb is connected when the first semihosting syscall occurs then use
 355   remote gdb syscalls.  Otherwise use native file IO.  */
 356int use_gdb_syscalls(void)
 357{
 358    if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 359        gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 360                                            : GDB_SYS_DISABLED);
 361    }
 362    return gdb_syscall_mode == GDB_SYS_ENABLED;
 363}
 364
 365/* Resume execution.  */
 366static inline void gdb_continue(GDBState *s)
 367{
 368#ifdef CONFIG_USER_ONLY
 369    s->running_state = 1;
 370#else
 371    if (runstate_check(RUN_STATE_GUEST_PANICKED)) {
 372        runstate_set(RUN_STATE_DEBUG);
 373    }
 374    if (!runstate_needs_reset()) {
 375        vm_start();
 376    }
 377#endif
 378}
 379
 380static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 381{
 382#ifdef CONFIG_USER_ONLY
 383    int ret;
 384
 385    while (len > 0) {
 386        ret = send(s->fd, buf, len, 0);
 387        if (ret < 0) {
 388            if (errno != EINTR && errno != EAGAIN)
 389                return;
 390        } else {
 391            buf += ret;
 392            len -= ret;
 393        }
 394    }
 395#else
 396    qemu_chr_fe_write(s->chr, buf, len);
 397#endif
 398}
 399
 400static inline int fromhex(int v)
 401{
 402    if (v >= '0' && v <= '9')
 403        return v - '0';
 404    else if (v >= 'A' && v <= 'F')
 405        return v - 'A' + 10;
 406    else if (v >= 'a' && v <= 'f')
 407        return v - 'a' + 10;
 408    else
 409        return 0;
 410}
 411
 412static inline int tohex(int v)
 413{
 414    if (v < 10)
 415        return v + '0';
 416    else
 417        return v - 10 + 'a';
 418}
 419
 420static void memtohex(char *buf, const uint8_t *mem, int len)
 421{
 422    int i, c;
 423    char *q;
 424    q = buf;
 425    for(i = 0; i < len; i++) {
 426        c = mem[i];
 427        *q++ = tohex(c >> 4);
 428        *q++ = tohex(c & 0xf);
 429    }
 430    *q = '\0';
 431}
 432
 433static void hextomem(uint8_t *mem, const char *buf, int len)
 434{
 435    int i;
 436
 437    for(i = 0; i < len; i++) {
 438        mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 439        buf += 2;
 440    }
 441}
 442
 443/* return -1 if error, 0 if OK */
 444static int put_packet_binary(GDBState *s, const char *buf, int len)
 445{
 446    int csum, i;
 447    uint8_t *p;
 448
 449    for(;;) {
 450        p = s->last_packet;
 451        *(p++) = '$';
 452        memcpy(p, buf, len);
 453        p += len;
 454        csum = 0;
 455        for(i = 0; i < len; i++) {
 456            csum += buf[i];
 457        }
 458        *(p++) = '#';
 459        *(p++) = tohex((csum >> 4) & 0xf);
 460        *(p++) = tohex((csum) & 0xf);
 461
 462        s->last_packet_len = p - s->last_packet;
 463        put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 464
 465#ifdef CONFIG_USER_ONLY
 466        i = get_char(s);
 467        if (i < 0)
 468            return -1;
 469        if (i == '+')
 470            break;
 471#else
 472        break;
 473#endif
 474    }
 475    return 0;
 476}
 477
 478/* return -1 if error, 0 if OK */
 479static int put_packet(GDBState *s, const char *buf)
 480{
 481#ifdef DEBUG_GDB
 482    printf("reply='%s'\n", buf);
 483#endif
 484
 485    return put_packet_binary(s, buf, strlen(buf));
 486}
 487
 488/* Encode data using the encoding for 'x' packets.  */
 489static int memtox(char *buf, const char *mem, int len)
 490{
 491    char *p = buf;
 492    char c;
 493
 494    while (len--) {
 495        c = *(mem++);
 496        switch (c) {
 497        case '#': case '$': case '*': case '}':
 498            *(p++) = '}';
 499            *(p++) = c ^ 0x20;
 500            break;
 501        default:
 502            *(p++) = c;
 503            break;
 504        }
 505    }
 506    return p - buf;
 507}
 508
 509static const char *get_feature_xml(const char *p, const char **newp,
 510                                   CPUClass *cc)
 511{
 512    size_t len;
 513    int i;
 514    const char *name;
 515    static char target_xml[1024];
 516
 517    len = 0;
 518    while (p[len] && p[len] != ':')
 519        len++;
 520    *newp = p + len;
 521
 522    name = NULL;
 523    if (strncmp(p, "target.xml", len) == 0) {
 524        /* Generate the XML description for this CPU.  */
 525        if (!target_xml[0]) {
 526            GDBRegisterState *r;
 527            CPUState *cpu = first_cpu;
 528
 529            snprintf(target_xml, sizeof(target_xml),
 530                     "<?xml version=\"1.0\"?>"
 531                     "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
 532                     "<target>"
 533                     "<xi:include href=\"%s\"/>",
 534                     cc->gdb_core_xml_file);
 535
 536            for (r = cpu->gdb_regs; r; r = r->next) {
 537                pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
 538                pstrcat(target_xml, sizeof(target_xml), r->xml);
 539                pstrcat(target_xml, sizeof(target_xml), "\"/>");
 540            }
 541            pstrcat(target_xml, sizeof(target_xml), "</target>");
 542        }
 543        return target_xml;
 544    }
 545    for (i = 0; ; i++) {
 546        name = xml_builtin[i][0];
 547        if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
 548            break;
 549    }
 550    return name ? xml_builtin[i][1] : NULL;
 551}
 552
 553static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 554{
 555    CPUClass *cc = CPU_GET_CLASS(cpu);
 556    CPUArchState *env = cpu->env_ptr;
 557    GDBRegisterState *r;
 558
 559    if (reg < cc->gdb_num_core_regs) {
 560        return cc->gdb_read_register(cpu, mem_buf, reg);
 561    }
 562
 563    for (r = cpu->gdb_regs; r; r = r->next) {
 564        if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 565            return r->get_reg(env, mem_buf, reg - r->base_reg);
 566        }
 567    }
 568    return 0;
 569}
 570
 571static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 572{
 573    CPUClass *cc = CPU_GET_CLASS(cpu);
 574    CPUArchState *env = cpu->env_ptr;
 575    GDBRegisterState *r;
 576
 577    if (reg < cc->gdb_num_core_regs) {
 578        return cc->gdb_write_register(cpu, mem_buf, reg);
 579    }
 580
 581    for (r = cpu->gdb_regs; r; r = r->next) {
 582        if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 583            return r->set_reg(env, mem_buf, reg - r->base_reg);
 584        }
 585    }
 586    return 0;
 587}
 588
 589/* Register a supplemental set of CPU registers.  If g_pos is nonzero it
 590   specifies the first register number and these registers are included in
 591   a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
 592   gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
 593 */
 594
 595void gdb_register_coprocessor(CPUState *cpu,
 596                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
 597                              int num_regs, const char *xml, int g_pos)
 598{
 599    GDBRegisterState *s;
 600    GDBRegisterState **p;
 601
 602    p = &cpu->gdb_regs;
 603    while (*p) {
 604        /* Check for duplicates.  */
 605        if (strcmp((*p)->xml, xml) == 0)
 606            return;
 607        p = &(*p)->next;
 608    }
 609
 610    s = g_new0(GDBRegisterState, 1);
 611    s->base_reg = cpu->gdb_num_regs;
 612    s->num_regs = num_regs;
 613    s->get_reg = get_reg;
 614    s->set_reg = set_reg;
 615    s->xml = xml;
 616
 617    /* Add to end of list.  */
 618    cpu->gdb_num_regs += num_regs;
 619    *p = s;
 620    if (g_pos) {
 621        if (g_pos != s->base_reg) {
 622            fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
 623                    "Expected %d got %d\n", xml, g_pos, s->base_reg);
 624        }
 625    }
 626}
 627
 628#ifndef CONFIG_USER_ONLY
 629static const int xlat_gdb_type[] = {
 630    [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
 631    [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
 632    [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
 633};
 634#endif
 635
 636static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
 637{
 638    CPUState *cpu;
 639    CPUArchState *env;
 640    int err = 0;
 641
 642    if (kvm_enabled()) {
 643        return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 644    }
 645
 646    switch (type) {
 647    case GDB_BREAKPOINT_SW:
 648    case GDB_BREAKPOINT_HW:
 649        for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 650            env = cpu->env_ptr;
 651            err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
 652            if (err)
 653                break;
 654        }
 655        return err;
 656#ifndef CONFIG_USER_ONLY
 657    case GDB_WATCHPOINT_WRITE:
 658    case GDB_WATCHPOINT_READ:
 659    case GDB_WATCHPOINT_ACCESS:
 660        for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 661            env = cpu->env_ptr;
 662            err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
 663                                        NULL);
 664            if (err)
 665                break;
 666        }
 667        return err;
 668#endif
 669    default:
 670        return -ENOSYS;
 671    }
 672}
 673
 674static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
 675{
 676    CPUState *cpu;
 677    CPUArchState *env;
 678    int err = 0;
 679
 680    if (kvm_enabled()) {
 681        return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 682    }
 683
 684    switch (type) {
 685    case GDB_BREAKPOINT_SW:
 686    case GDB_BREAKPOINT_HW:
 687        for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 688            env = cpu->env_ptr;
 689            err = cpu_breakpoint_remove(env, addr, BP_GDB);
 690            if (err)
 691                break;
 692        }
 693        return err;
 694#ifndef CONFIG_USER_ONLY
 695    case GDB_WATCHPOINT_WRITE:
 696    case GDB_WATCHPOINT_READ:
 697    case GDB_WATCHPOINT_ACCESS:
 698        for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 699            env = cpu->env_ptr;
 700            err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
 701            if (err)
 702                break;
 703        }
 704        return err;
 705#endif
 706    default:
 707        return -ENOSYS;
 708    }
 709}
 710
 711static void gdb_breakpoint_remove_all(void)
 712{
 713    CPUState *cpu;
 714    CPUArchState *env;
 715
 716    if (kvm_enabled()) {
 717        kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
 718        return;
 719    }
 720
 721    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 722        env = cpu->env_ptr;
 723        cpu_breakpoint_remove_all(env, BP_GDB);
 724#ifndef CONFIG_USER_ONLY
 725        cpu_watchpoint_remove_all(env, BP_GDB);
 726#endif
 727    }
 728}
 729
 730static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 731{
 732    CPUState *cpu = s->c_cpu;
 733    CPUClass *cc = CPU_GET_CLASS(cpu);
 734
 735    cpu_synchronize_state(cpu);
 736    if (cc->set_pc) {
 737        cc->set_pc(cpu, pc);
 738    }
 739}
 740
 741static CPUState *find_cpu(uint32_t thread_id)
 742{
 743    CPUState *cpu;
 744
 745    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 746        if (cpu_index(cpu) == thread_id) {
 747            return cpu;
 748        }
 749    }
 750
 751    return NULL;
 752}
 753
 754static int gdb_handle_packet(GDBState *s, const char *line_buf)
 755{
 756    CPUState *cpu;
 757    CPUClass *cc;
 758    const char *p;
 759    uint32_t thread;
 760    int ch, reg_size, type, res;
 761    char buf[MAX_PACKET_LENGTH];
 762    uint8_t mem_buf[MAX_PACKET_LENGTH];
 763    uint8_t *registers;
 764    target_ulong addr, len;
 765
 766#ifdef DEBUG_GDB
 767    printf("command='%s'\n", line_buf);
 768#endif
 769    p = line_buf;
 770    ch = *p++;
 771    switch(ch) {
 772    case '?':
 773        /* TODO: Make this return the correct value for user-mode.  */
 774        snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
 775                 cpu_index(s->c_cpu));
 776        put_packet(s, buf);
 777        /* Remove all the breakpoints when this query is issued,
 778         * because gdb is doing and initial connect and the state
 779         * should be cleaned up.
 780         */
 781        gdb_breakpoint_remove_all();
 782        break;
 783    case 'c':
 784        if (*p != '\0') {
 785            addr = strtoull(p, (char **)&p, 16);
 786            gdb_set_cpu_pc(s, addr);
 787        }
 788        s->signal = 0;
 789        gdb_continue(s);
 790        return RS_IDLE;
 791    case 'C':
 792        s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
 793        if (s->signal == -1)
 794            s->signal = 0;
 795        gdb_continue(s);
 796        return RS_IDLE;
 797    case 'v':
 798        if (strncmp(p, "Cont", 4) == 0) {
 799            int res_signal, res_thread;
 800
 801            p += 4;
 802            if (*p == '?') {
 803                put_packet(s, "vCont;c;C;s;S");
 804                break;
 805            }
 806            res = 0;
 807            res_signal = 0;
 808            res_thread = 0;
 809            while (*p) {
 810                int action, signal;
 811
 812                if (*p++ != ';') {
 813                    res = 0;
 814                    break;
 815                }
 816                action = *p++;
 817                signal = 0;
 818                if (action == 'C' || action == 'S') {
 819                    signal = strtoul(p, (char **)&p, 16);
 820                } else if (action != 'c' && action != 's') {
 821                    res = 0;
 822                    break;
 823                }
 824                thread = 0;
 825                if (*p == ':') {
 826                    thread = strtoull(p+1, (char **)&p, 16);
 827                }
 828                action = tolower(action);
 829                if (res == 0 || (res == 'c' && action == 's')) {
 830                    res = action;
 831                    res_signal = signal;
 832                    res_thread = thread;
 833                }
 834            }
 835            if (res) {
 836                if (res_thread != -1 && res_thread != 0) {
 837                    cpu = find_cpu(res_thread);
 838                    if (cpu == NULL) {
 839                        put_packet(s, "E22");
 840                        break;
 841                    }
 842                    s->c_cpu = cpu;
 843                }
 844                if (res == 's') {
 845                    cpu_single_step(s->c_cpu, sstep_flags);
 846                }
 847                s->signal = res_signal;
 848                gdb_continue(s);
 849                return RS_IDLE;
 850            }
 851            break;
 852        } else {
 853            goto unknown_command;
 854        }
 855    case 'k':
 856#ifdef CONFIG_USER_ONLY
 857        /* Kill the target */
 858        fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
 859        exit(0);
 860#endif
 861    case 'D':
 862        /* Detach packet */
 863        gdb_breakpoint_remove_all();
 864        gdb_syscall_mode = GDB_SYS_DISABLED;
 865        gdb_continue(s);
 866        put_packet(s, "OK");
 867        break;
 868    case 's':
 869        if (*p != '\0') {
 870            addr = strtoull(p, (char **)&p, 16);
 871            gdb_set_cpu_pc(s, addr);
 872        }
 873        cpu_single_step(s->c_cpu, sstep_flags);
 874        gdb_continue(s);
 875        return RS_IDLE;
 876    case 'F':
 877        {
 878            target_ulong ret;
 879            target_ulong err;
 880
 881            ret = strtoull(p, (char **)&p, 16);
 882            if (*p == ',') {
 883                p++;
 884                err = strtoull(p, (char **)&p, 16);
 885            } else {
 886                err = 0;
 887            }
 888            if (*p == ',')
 889                p++;
 890            type = *p;
 891            if (s->current_syscall_cb) {
 892                s->current_syscall_cb(s->c_cpu, ret, err);
 893                s->current_syscall_cb = NULL;
 894            }
 895            if (type == 'C') {
 896                put_packet(s, "T02");
 897            } else {
 898                gdb_continue(s);
 899            }
 900        }
 901        break;
 902    case 'g':
 903        cpu_synchronize_state(s->g_cpu);
 904        len = 0;
 905        for (addr = 0; addr < s->g_cpu->gdb_num_regs; addr++) {
 906            reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
 907            len += reg_size;
 908        }
 909        memtohex(buf, mem_buf, len);
 910        put_packet(s, buf);
 911        break;
 912    case 'G':
 913        cpu_synchronize_state(s->g_cpu);
 914        registers = mem_buf;
 915        len = strlen(p) / 2;
 916        hextomem((uint8_t *)registers, p, len);
 917        for (addr = 0; addr < s->g_cpu->gdb_num_regs && len > 0; addr++) {
 918            reg_size = gdb_write_register(s->g_cpu, registers, addr);
 919            len -= reg_size;
 920            registers += reg_size;
 921        }
 922        put_packet(s, "OK");
 923        break;
 924    case 'm':
 925        addr = strtoull(p, (char **)&p, 16);
 926        if (*p == ',')
 927            p++;
 928        len = strtoull(p, NULL, 16);
 929        if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
 930            put_packet (s, "E14");
 931        } else {
 932            memtohex(buf, mem_buf, len);
 933            put_packet(s, buf);
 934        }
 935        break;
 936    case 'M':
 937        addr = strtoull(p, (char **)&p, 16);
 938        if (*p == ',')
 939            p++;
 940        len = strtoull(p, (char **)&p, 16);
 941        if (*p == ':')
 942            p++;
 943        hextomem(mem_buf, p, len);
 944        if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
 945                                   true) != 0) {
 946            put_packet(s, "E14");
 947        } else {
 948            put_packet(s, "OK");
 949        }
 950        break;
 951    case 'p':
 952        /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
 953           This works, but can be very slow.  Anything new enough to
 954           understand XML also knows how to use this properly.  */
 955        if (!gdb_has_xml)
 956            goto unknown_command;
 957        addr = strtoull(p, (char **)&p, 16);
 958        reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
 959        if (reg_size) {
 960            memtohex(buf, mem_buf, reg_size);
 961            put_packet(s, buf);
 962        } else {
 963            put_packet(s, "E14");
 964        }
 965        break;
 966    case 'P':
 967        if (!gdb_has_xml)
 968            goto unknown_command;
 969        addr = strtoull(p, (char **)&p, 16);
 970        if (*p == '=')
 971            p++;
 972        reg_size = strlen(p) / 2;
 973        hextomem(mem_buf, p, reg_size);
 974        gdb_write_register(s->g_cpu, mem_buf, addr);
 975        put_packet(s, "OK");
 976        break;
 977    case 'Z':
 978    case 'z':
 979        type = strtoul(p, (char **)&p, 16);
 980        if (*p == ',')
 981            p++;
 982        addr = strtoull(p, (char **)&p, 16);
 983        if (*p == ',')
 984            p++;
 985        len = strtoull(p, (char **)&p, 16);
 986        if (ch == 'Z')
 987            res = gdb_breakpoint_insert(addr, len, type);
 988        else
 989            res = gdb_breakpoint_remove(addr, len, type);
 990        if (res >= 0)
 991             put_packet(s, "OK");
 992        else if (res == -ENOSYS)
 993            put_packet(s, "");
 994        else
 995            put_packet(s, "E22");
 996        break;
 997    case 'H':
 998        type = *p++;
 999        thread = strtoull(p, (char **)&p, 16);
1000        if (thread == -1 || thread == 0) {
1001            put_packet(s, "OK");
1002            break;
1003        }
1004        cpu = find_cpu(thread);
1005        if (cpu == NULL) {
1006            put_packet(s, "E22");
1007            break;
1008        }
1009        switch (type) {
1010        case 'c':
1011            s->c_cpu = cpu;
1012            put_packet(s, "OK");
1013            break;
1014        case 'g':
1015            s->g_cpu = cpu;
1016            put_packet(s, "OK");
1017            break;
1018        default:
1019             put_packet(s, "E22");
1020             break;
1021        }
1022        break;
1023    case 'T':
1024        thread = strtoull(p, (char **)&p, 16);
1025        cpu = find_cpu(thread);
1026
1027        if (cpu != NULL) {
1028            put_packet(s, "OK");
1029        } else {
1030            put_packet(s, "E22");
1031        }
1032        break;
1033    case 'q':
1034    case 'Q':
1035        /* parse any 'q' packets here */
1036        if (!strcmp(p,"qemu.sstepbits")) {
1037            /* Query Breakpoint bit definitions */
1038            snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1039                     SSTEP_ENABLE,
1040                     SSTEP_NOIRQ,
1041                     SSTEP_NOTIMER);
1042            put_packet(s, buf);
1043            break;
1044        } else if (strncmp(p,"qemu.sstep",10) == 0) {
1045            /* Display or change the sstep_flags */
1046            p += 10;
1047            if (*p != '=') {
1048                /* Display current setting */
1049                snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1050                put_packet(s, buf);
1051                break;
1052            }
1053            p++;
1054            type = strtoul(p, (char **)&p, 16);
1055            sstep_flags = type;
1056            put_packet(s, "OK");
1057            break;
1058        } else if (strcmp(p,"C") == 0) {
1059            /* "Current thread" remains vague in the spec, so always return
1060             *  the first CPU (gdb returns the first thread). */
1061            put_packet(s, "QC1");
1062            break;
1063        } else if (strcmp(p,"fThreadInfo") == 0) {
1064            s->query_cpu = first_cpu;
1065            goto report_cpuinfo;
1066        } else if (strcmp(p,"sThreadInfo") == 0) {
1067        report_cpuinfo:
1068            if (s->query_cpu) {
1069                snprintf(buf, sizeof(buf), "m%x", cpu_index(s->query_cpu));
1070                put_packet(s, buf);
1071                s->query_cpu = s->query_cpu->next_cpu;
1072            } else
1073                put_packet(s, "l");
1074            break;
1075        } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1076            thread = strtoull(p+16, (char **)&p, 16);
1077            cpu = find_cpu(thread);
1078            if (cpu != NULL) {
1079                cpu_synchronize_state(cpu);
1080                len = snprintf((char *)mem_buf, sizeof(mem_buf),
1081                               "CPU#%d [%s]", cpu->cpu_index,
1082                               cpu->halted ? "halted " : "running");
1083                memtohex(buf, mem_buf, len);
1084                put_packet(s, buf);
1085            }
1086            break;
1087        }
1088#ifdef CONFIG_USER_ONLY
1089        else if (strncmp(p, "Offsets", 7) == 0) {
1090            CPUArchState *env = s->c_cpu->env_ptr;
1091            TaskState *ts = env->opaque;
1092
1093            snprintf(buf, sizeof(buf),
1094                     "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1095                     ";Bss=" TARGET_ABI_FMT_lx,
1096                     ts->info->code_offset,
1097                     ts->info->data_offset,
1098                     ts->info->data_offset);
1099            put_packet(s, buf);
1100            break;
1101        }
1102#else /* !CONFIG_USER_ONLY */
1103        else if (strncmp(p, "Rcmd,", 5) == 0) {
1104            int len = strlen(p + 5);
1105
1106            if ((len % 2) != 0) {
1107                put_packet(s, "E01");
1108                break;
1109            }
1110            hextomem(mem_buf, p + 5, len);
1111            len = len / 2;
1112            mem_buf[len++] = 0;
1113            qemu_chr_be_write(s->mon_chr, mem_buf, len);
1114            put_packet(s, "OK");
1115            break;
1116        }
1117#endif /* !CONFIG_USER_ONLY */
1118        if (strncmp(p, "Supported", 9) == 0) {
1119            snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1120            cc = CPU_GET_CLASS(first_cpu);
1121            if (cc->gdb_core_xml_file != NULL) {
1122                pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1123            }
1124            put_packet(s, buf);
1125            break;
1126        }
1127        if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1128            const char *xml;
1129            target_ulong total_len;
1130
1131            cc = CPU_GET_CLASS(first_cpu);
1132            if (cc->gdb_core_xml_file == NULL) {
1133                goto unknown_command;
1134            }
1135
1136            gdb_has_xml = true;
1137            p += 19;
1138            xml = get_feature_xml(p, &p, cc);
1139            if (!xml) {
1140                snprintf(buf, sizeof(buf), "E00");
1141                put_packet(s, buf);
1142                break;
1143            }
1144
1145            if (*p == ':')
1146                p++;
1147            addr = strtoul(p, (char **)&p, 16);
1148            if (*p == ',')
1149                p++;
1150            len = strtoul(p, (char **)&p, 16);
1151
1152            total_len = strlen(xml);
1153            if (addr > total_len) {
1154                snprintf(buf, sizeof(buf), "E00");
1155                put_packet(s, buf);
1156                break;
1157            }
1158            if (len > (MAX_PACKET_LENGTH - 5) / 2)
1159                len = (MAX_PACKET_LENGTH - 5) / 2;
1160            if (len < total_len - addr) {
1161                buf[0] = 'm';
1162                len = memtox(buf + 1, xml + addr, len);
1163            } else {
1164                buf[0] = 'l';
1165                len = memtox(buf + 1, xml + addr, total_len - addr);
1166            }
1167            put_packet_binary(s, buf, len + 1);
1168            break;
1169        }
1170        /* Unrecognised 'q' command.  */
1171        goto unknown_command;
1172
1173    default:
1174    unknown_command:
1175        /* put empty packet */
1176        buf[0] = '\0';
1177        put_packet(s, buf);
1178        break;
1179    }
1180    return RS_IDLE;
1181}
1182
1183void gdb_set_stop_cpu(CPUState *cpu)
1184{
1185    gdbserver_state->c_cpu = cpu;
1186    gdbserver_state->g_cpu = cpu;
1187}
1188
1189#ifndef CONFIG_USER_ONLY
1190static void gdb_vm_state_change(void *opaque, int running, RunState state)
1191{
1192    GDBState *s = gdbserver_state;
1193    CPUArchState *env = s->c_cpu->env_ptr;
1194    CPUState *cpu = s->c_cpu;
1195    char buf[256];
1196    const char *type;
1197    int ret;
1198
1199    if (running || s->state == RS_INACTIVE) {
1200        return;
1201    }
1202    /* Is there a GDB syscall waiting to be sent?  */
1203    if (s->current_syscall_cb) {
1204        put_packet(s, s->syscall_buf);
1205        return;
1206    }
1207    switch (state) {
1208    case RUN_STATE_DEBUG:
1209        if (env->watchpoint_hit) {
1210            switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
1211            case BP_MEM_READ:
1212                type = "r";
1213                break;
1214            case BP_MEM_ACCESS:
1215                type = "a";
1216                break;
1217            default:
1218                type = "";
1219                break;
1220            }
1221            snprintf(buf, sizeof(buf),
1222                     "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1223                     GDB_SIGNAL_TRAP, cpu_index(cpu), type,
1224                     env->watchpoint_hit->vaddr);
1225            env->watchpoint_hit = NULL;
1226            goto send_packet;
1227        }
1228        tb_flush(env);
1229        ret = GDB_SIGNAL_TRAP;
1230        break;
1231    case RUN_STATE_PAUSED:
1232        ret = GDB_SIGNAL_INT;
1233        break;
1234    case RUN_STATE_SHUTDOWN:
1235        ret = GDB_SIGNAL_QUIT;
1236        break;
1237    case RUN_STATE_IO_ERROR:
1238        ret = GDB_SIGNAL_IO;
1239        break;
1240    case RUN_STATE_WATCHDOG:
1241        ret = GDB_SIGNAL_ALRM;
1242        break;
1243    case RUN_STATE_INTERNAL_ERROR:
1244        ret = GDB_SIGNAL_ABRT;
1245        break;
1246    case RUN_STATE_SAVE_VM:
1247    case RUN_STATE_RESTORE_VM:
1248        return;
1249    case RUN_STATE_FINISH_MIGRATE:
1250        ret = GDB_SIGNAL_XCPU;
1251        break;
1252    default:
1253        ret = GDB_SIGNAL_UNKNOWN;
1254        break;
1255    }
1256    snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, cpu_index(cpu));
1257
1258send_packet:
1259    put_packet(s, buf);
1260
1261    /* disable single step if it was enabled */
1262    cpu_single_step(cpu, 0);
1263}
1264#endif
1265
1266/* Send a gdb syscall request.
1267   This accepts limited printf-style format specifiers, specifically:
1268    %x  - target_ulong argument printed in hex.
1269    %lx - 64-bit argument printed in hex.
1270    %s  - string pointer (target_ulong) and length (int) pair.  */
1271void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1272{
1273    va_list va;
1274    char *p;
1275    char *p_end;
1276    target_ulong addr;
1277    uint64_t i64;
1278    GDBState *s;
1279
1280    s = gdbserver_state;
1281    if (!s)
1282        return;
1283    s->current_syscall_cb = cb;
1284#ifndef CONFIG_USER_ONLY
1285    vm_stop(RUN_STATE_DEBUG);
1286#endif
1287    va_start(va, fmt);
1288    p = s->syscall_buf;
1289    p_end = &s->syscall_buf[sizeof(s->syscall_buf)];
1290    *(p++) = 'F';
1291    while (*fmt) {
1292        if (*fmt == '%') {
1293            fmt++;
1294            switch (*fmt++) {
1295            case 'x':
1296                addr = va_arg(va, target_ulong);
1297                p += snprintf(p, p_end - p, TARGET_FMT_lx, addr);
1298                break;
1299            case 'l':
1300                if (*(fmt++) != 'x')
1301                    goto bad_format;
1302                i64 = va_arg(va, uint64_t);
1303                p += snprintf(p, p_end - p, "%" PRIx64, i64);
1304                break;
1305            case 's':
1306                addr = va_arg(va, target_ulong);
1307                p += snprintf(p, p_end - p, TARGET_FMT_lx "/%x",
1308                              addr, va_arg(va, int));
1309                break;
1310            default:
1311            bad_format:
1312                fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
1313                        fmt - 1);
1314                break;
1315            }
1316        } else {
1317            *(p++) = *(fmt++);
1318        }
1319    }
1320    *p = 0;
1321    va_end(va);
1322#ifdef CONFIG_USER_ONLY
1323    put_packet(s, s->syscall_buf);
1324    gdb_handlesig(s->c_cpu, 0);
1325#else
1326    /* In this case wait to send the syscall packet until notification that
1327       the CPU has stopped.  This must be done because if the packet is sent
1328       now the reply from the syscall request could be received while the CPU
1329       is still in the running state, which can cause packets to be dropped
1330       and state transition 'T' packets to be sent while the syscall is still
1331       being processed.  */
1332    cpu_exit(s->c_cpu);
1333#endif
1334}
1335
1336static void gdb_read_byte(GDBState *s, int ch)
1337{
1338    int i, csum;
1339    uint8_t reply;
1340
1341#ifndef CONFIG_USER_ONLY
1342    if (s->last_packet_len) {
1343        /* Waiting for a response to the last packet.  If we see the start
1344           of a new command then abandon the previous response.  */
1345        if (ch == '-') {
1346#ifdef DEBUG_GDB
1347            printf("Got NACK, retransmitting\n");
1348#endif
1349            put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
1350        }
1351#ifdef DEBUG_GDB
1352        else if (ch == '+')
1353            printf("Got ACK\n");
1354        else
1355            printf("Got '%c' when expecting ACK/NACK\n", ch);
1356#endif
1357        if (ch == '+' || ch == '$')
1358            s->last_packet_len = 0;
1359        if (ch != '$')
1360            return;
1361    }
1362    if (runstate_is_running()) {
1363        /* when the CPU is running, we cannot do anything except stop
1364           it when receiving a char */
1365        vm_stop(RUN_STATE_PAUSED);
1366    } else
1367#endif
1368    {
1369        switch(s->state) {
1370        case RS_IDLE:
1371            if (ch == '$') {
1372                s->line_buf_index = 0;
1373                s->state = RS_GETLINE;
1374            }
1375            break;
1376        case RS_GETLINE:
1377            if (ch == '#') {
1378            s->state = RS_CHKSUM1;
1379            } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1380                s->state = RS_IDLE;
1381            } else {
1382            s->line_buf[s->line_buf_index++] = ch;
1383            }
1384            break;
1385        case RS_CHKSUM1:
1386            s->line_buf[s->line_buf_index] = '\0';
1387            s->line_csum = fromhex(ch) << 4;
1388            s->state = RS_CHKSUM2;
1389            break;
1390        case RS_CHKSUM2:
1391            s->line_csum |= fromhex(ch);
1392            csum = 0;
1393            for(i = 0; i < s->line_buf_index; i++) {
1394                csum += s->line_buf[i];
1395            }
1396            if (s->line_csum != (csum & 0xff)) {
1397                reply = '-';
1398                put_buffer(s, &reply, 1);
1399                s->state = RS_IDLE;
1400            } else {
1401                reply = '+';
1402                put_buffer(s, &reply, 1);
1403                s->state = gdb_handle_packet(s, s->line_buf);
1404            }
1405            break;
1406        default:
1407            abort();
1408        }
1409    }
1410}
1411
1412/* Tell the remote gdb that the process has exited.  */
1413void gdb_exit(CPUArchState *env, int code)
1414{
1415  GDBState *s;
1416  char buf[4];
1417
1418  s = gdbserver_state;
1419  if (!s) {
1420      return;
1421  }
1422#ifdef CONFIG_USER_ONLY
1423  if (gdbserver_fd < 0 || s->fd < 0) {
1424      return;
1425  }
1426#endif
1427
1428  snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
1429  put_packet(s, buf);
1430
1431#ifndef CONFIG_USER_ONLY
1432  if (s->chr) {
1433      qemu_chr_delete(s->chr);
1434  }
1435#endif
1436}
1437
1438#ifdef CONFIG_USER_ONLY
1439int
1440gdb_queuesig (void)
1441{
1442    GDBState *s;
1443
1444    s = gdbserver_state;
1445
1446    if (gdbserver_fd < 0 || s->fd < 0)
1447        return 0;
1448    else
1449        return 1;
1450}
1451
1452int
1453gdb_handlesig(CPUState *cpu, int sig)
1454{
1455    CPUArchState *env = cpu->env_ptr;
1456    GDBState *s;
1457    char buf[256];
1458    int n;
1459
1460    s = gdbserver_state;
1461    if (gdbserver_fd < 0 || s->fd < 0) {
1462        return sig;
1463    }
1464
1465    /* disable single step if it was enabled */
1466    cpu_single_step(cpu, 0);
1467    tb_flush(env);
1468
1469    if (sig != 0) {
1470        snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));
1471        put_packet(s, buf);
1472    }
1473    /* put_packet() might have detected that the peer terminated the
1474       connection.  */
1475    if (s->fd < 0) {
1476        return sig;
1477    }
1478
1479    sig = 0;
1480    s->state = RS_IDLE;
1481    s->running_state = 0;
1482    while (s->running_state == 0) {
1483        n = read(s->fd, buf, 256);
1484        if (n > 0) {
1485            int i;
1486
1487            for (i = 0; i < n; i++) {
1488                gdb_read_byte(s, buf[i]);
1489            }
1490        } else if (n == 0 || errno != EAGAIN) {
1491            /* XXX: Connection closed.  Should probably wait for another
1492               connection before continuing.  */
1493            return sig;
1494        }
1495    }
1496    sig = s->signal;
1497    s->signal = 0;
1498    return sig;
1499}
1500
1501/* Tell the remote gdb that the process has exited due to SIG.  */
1502void gdb_signalled(CPUArchState *env, int sig)
1503{
1504    GDBState *s;
1505    char buf[4];
1506
1507    s = gdbserver_state;
1508    if (gdbserver_fd < 0 || s->fd < 0) {
1509        return;
1510    }
1511
1512    snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb(sig));
1513    put_packet(s, buf);
1514}
1515
1516static void gdb_accept(void)
1517{
1518    GDBState *s;
1519    struct sockaddr_in sockaddr;
1520    socklen_t len;
1521    int fd;
1522
1523    for(;;) {
1524        len = sizeof(sockaddr);
1525        fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
1526        if (fd < 0 && errno != EINTR) {
1527            perror("accept");
1528            return;
1529        } else if (fd >= 0) {
1530#ifndef _WIN32
1531            fcntl(fd, F_SETFD, FD_CLOEXEC);
1532#endif
1533            break;
1534        }
1535    }
1536
1537    /* set short latency */
1538    socket_set_nodelay(fd);
1539
1540    s = g_malloc0(sizeof(GDBState));
1541    s->c_cpu = first_cpu;
1542    s->g_cpu = first_cpu;
1543    s->fd = fd;
1544    gdb_has_xml = false;
1545
1546    gdbserver_state = s;
1547
1548    fcntl(fd, F_SETFL, O_NONBLOCK);
1549}
1550
1551static int gdbserver_open(int port)
1552{
1553    struct sockaddr_in sockaddr;
1554    int fd, val, ret;
1555
1556    fd = socket(PF_INET, SOCK_STREAM, 0);
1557    if (fd < 0) {
1558        perror("socket");
1559        return -1;
1560    }
1561#ifndef _WIN32
1562    fcntl(fd, F_SETFD, FD_CLOEXEC);
1563#endif
1564
1565    /* allow fast reuse */
1566    val = 1;
1567    qemu_setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &val, sizeof(val));
1568
1569    sockaddr.sin_family = AF_INET;
1570    sockaddr.sin_port = htons(port);
1571    sockaddr.sin_addr.s_addr = 0;
1572    ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
1573    if (ret < 0) {
1574        perror("bind");
1575        close(fd);
1576        return -1;
1577    }
1578    ret = listen(fd, 0);
1579    if (ret < 0) {
1580        perror("listen");
1581        close(fd);
1582        return -1;
1583    }
1584    return fd;
1585}
1586
1587int gdbserver_start(int port)
1588{
1589    gdbserver_fd = gdbserver_open(port);
1590    if (gdbserver_fd < 0)
1591        return -1;
1592    /* accept connections */
1593    gdb_accept();
1594    return 0;
1595}
1596
1597/* Disable gdb stub for child processes.  */
1598void gdbserver_fork(CPUArchState *env)
1599{
1600    GDBState *s = gdbserver_state;
1601    if (gdbserver_fd < 0 || s->fd < 0)
1602      return;
1603    close(s->fd);
1604    s->fd = -1;
1605    cpu_breakpoint_remove_all(env, BP_GDB);
1606    cpu_watchpoint_remove_all(env, BP_GDB);
1607}
1608#else
1609static int gdb_chr_can_receive(void *opaque)
1610{
1611  /* We can handle an arbitrarily large amount of data.
1612   Pick the maximum packet size, which is as good as anything.  */
1613  return MAX_PACKET_LENGTH;
1614}
1615
1616static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
1617{
1618    int i;
1619
1620    for (i = 0; i < size; i++) {
1621        gdb_read_byte(gdbserver_state, buf[i]);
1622    }
1623}
1624
1625static void gdb_chr_event(void *opaque, int event)
1626{
1627    switch (event) {
1628    case CHR_EVENT_OPENED:
1629        vm_stop(RUN_STATE_PAUSED);
1630        gdb_has_xml = false;
1631        break;
1632    default:
1633        break;
1634    }
1635}
1636
1637static void gdb_monitor_output(GDBState *s, const char *msg, int len)
1638{
1639    char buf[MAX_PACKET_LENGTH];
1640
1641    buf[0] = 'O';
1642    if (len > (MAX_PACKET_LENGTH/2) - 1)
1643        len = (MAX_PACKET_LENGTH/2) - 1;
1644    memtohex(buf + 1, (uint8_t *)msg, len);
1645    put_packet(s, buf);
1646}
1647
1648static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
1649{
1650    const char *p = (const char *)buf;
1651    int max_sz;
1652
1653    max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
1654    for (;;) {
1655        if (len <= max_sz) {
1656            gdb_monitor_output(gdbserver_state, p, len);
1657            break;
1658        }
1659        gdb_monitor_output(gdbserver_state, p, max_sz);
1660        p += max_sz;
1661        len -= max_sz;
1662    }
1663    return len;
1664}
1665
1666#ifndef _WIN32
1667static void gdb_sigterm_handler(int signal)
1668{
1669    if (runstate_is_running()) {
1670        vm_stop(RUN_STATE_PAUSED);
1671    }
1672}
1673#endif
1674
1675int gdbserver_start(const char *device)
1676{
1677    GDBState *s;
1678    char gdbstub_device_name[128];
1679    CharDriverState *chr = NULL;
1680    CharDriverState *mon_chr;
1681
1682    if (!device)
1683        return -1;
1684    if (strcmp(device, "none") != 0) {
1685        if (strstart(device, "tcp:", NULL)) {
1686            /* enforce required TCP attributes */
1687            snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
1688                     "%s,nowait,nodelay,server", device);
1689            device = gdbstub_device_name;
1690        }
1691#ifndef _WIN32
1692        else if (strcmp(device, "stdio") == 0) {
1693            struct sigaction act;
1694
1695            memset(&act, 0, sizeof(act));
1696            act.sa_handler = gdb_sigterm_handler;
1697            sigaction(SIGINT, &act, NULL);
1698        }
1699#endif
1700        chr = qemu_chr_new("gdb", device, NULL);
1701        if (!chr)
1702            return -1;
1703
1704        qemu_chr_fe_claim_no_fail(chr);
1705        qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
1706                              gdb_chr_event, NULL);
1707    }
1708
1709    s = gdbserver_state;
1710    if (!s) {
1711        s = g_malloc0(sizeof(GDBState));
1712        gdbserver_state = s;
1713
1714        qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
1715
1716        /* Initialize a monitor terminal for gdb */
1717        mon_chr = g_malloc0(sizeof(*mon_chr));
1718        mon_chr->chr_write = gdb_monitor_write;
1719        monitor_init(mon_chr, 0);
1720    } else {
1721        if (s->chr)
1722            qemu_chr_delete(s->chr);
1723        mon_chr = s->mon_chr;
1724        memset(s, 0, sizeof(GDBState));
1725    }
1726    s->c_cpu = first_cpu;
1727    s->g_cpu = first_cpu;
1728    s->chr = chr;
1729    s->state = chr ? RS_IDLE : RS_INACTIVE;
1730    s->mon_chr = mon_chr;
1731    s->current_syscall_cb = NULL;
1732
1733    return 0;
1734}
1735#endif
1736