qemu/gdbstub.c
<<
>>
Prefs
   1/*
   2 * gdb server stub
   3 *
   4 * Copyright (c) 2003-2005 Fabrice Bellard
   5 *
   6 * This library is free software; you can redistribute it and/or
   7 * modify it under the terms of the GNU Lesser General Public
   8 * License as published by the Free Software Foundation; either
   9 * version 2 of the License, or (at your option) any later version.
  10 *
  11 * This library is distributed in the hope that it will be useful,
  12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14 * Lesser General Public License for more details.
  15 *
  16 * You should have received a copy of the GNU Lesser General Public
  17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18 */
  19#include "config.h"
  20#include "qemu-common.h"
  21#ifdef CONFIG_USER_ONLY
  22#include <stdlib.h>
  23#include <stdio.h>
  24#include <stdarg.h>
  25#include <string.h>
  26#include <errno.h>
  27#include <unistd.h>
  28#include <fcntl.h>
  29
  30#include "qemu.h"
  31#else
  32#include "monitor/monitor.h"
  33#include "sysemu/char.h"
  34#include "sysemu/sysemu.h"
  35#include "exec/gdbstub.h"
  36#endif
  37
  38#define MAX_PACKET_LENGTH 4096
  39
  40#include "cpu.h"
  41#include "qemu/sockets.h"
  42#include "sysemu/kvm.h"
  43
  44static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
  45                                         uint8_t *buf, int len, bool is_write)
  46{
  47    CPUClass *cc = CPU_GET_CLASS(cpu);
  48
  49    if (cc->memory_rw_debug) {
  50        return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
  51    }
  52    return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
  53}
  54
  55enum {
  56    GDB_SIGNAL_0 = 0,
  57    GDB_SIGNAL_INT = 2,
  58    GDB_SIGNAL_QUIT = 3,
  59    GDB_SIGNAL_TRAP = 5,
  60    GDB_SIGNAL_ABRT = 6,
  61    GDB_SIGNAL_ALRM = 14,
  62    GDB_SIGNAL_IO = 23,
  63    GDB_SIGNAL_XCPU = 24,
  64    GDB_SIGNAL_UNKNOWN = 143
  65};
  66
  67#ifdef CONFIG_USER_ONLY
  68
  69/* Map target signal numbers to GDB protocol signal numbers and vice
  70 * versa.  For user emulation's currently supported systems, we can
  71 * assume most signals are defined.
  72 */
  73
  74static int gdb_signal_table[] = {
  75    0,
  76    TARGET_SIGHUP,
  77    TARGET_SIGINT,
  78    TARGET_SIGQUIT,
  79    TARGET_SIGILL,
  80    TARGET_SIGTRAP,
  81    TARGET_SIGABRT,
  82    -1, /* SIGEMT */
  83    TARGET_SIGFPE,
  84    TARGET_SIGKILL,
  85    TARGET_SIGBUS,
  86    TARGET_SIGSEGV,
  87    TARGET_SIGSYS,
  88    TARGET_SIGPIPE,
  89    TARGET_SIGALRM,
  90    TARGET_SIGTERM,
  91    TARGET_SIGURG,
  92    TARGET_SIGSTOP,
  93    TARGET_SIGTSTP,
  94    TARGET_SIGCONT,
  95    TARGET_SIGCHLD,
  96    TARGET_SIGTTIN,
  97    TARGET_SIGTTOU,
  98    TARGET_SIGIO,
  99    TARGET_SIGXCPU,
 100    TARGET_SIGXFSZ,
 101    TARGET_SIGVTALRM,
 102    TARGET_SIGPROF,
 103    TARGET_SIGWINCH,
 104    -1, /* SIGLOST */
 105    TARGET_SIGUSR1,
 106    TARGET_SIGUSR2,
 107#ifdef TARGET_SIGPWR
 108    TARGET_SIGPWR,
 109#else
 110    -1,
 111#endif
 112    -1, /* SIGPOLL */
 113    -1,
 114    -1,
 115    -1,
 116    -1,
 117    -1,
 118    -1,
 119    -1,
 120    -1,
 121    -1,
 122    -1,
 123    -1,
 124#ifdef __SIGRTMIN
 125    __SIGRTMIN + 1,
 126    __SIGRTMIN + 2,
 127    __SIGRTMIN + 3,
 128    __SIGRTMIN + 4,
 129    __SIGRTMIN + 5,
 130    __SIGRTMIN + 6,
 131    __SIGRTMIN + 7,
 132    __SIGRTMIN + 8,
 133    __SIGRTMIN + 9,
 134    __SIGRTMIN + 10,
 135    __SIGRTMIN + 11,
 136    __SIGRTMIN + 12,
 137    __SIGRTMIN + 13,
 138    __SIGRTMIN + 14,
 139    __SIGRTMIN + 15,
 140    __SIGRTMIN + 16,
 141    __SIGRTMIN + 17,
 142    __SIGRTMIN + 18,
 143    __SIGRTMIN + 19,
 144    __SIGRTMIN + 20,
 145    __SIGRTMIN + 21,
 146    __SIGRTMIN + 22,
 147    __SIGRTMIN + 23,
 148    __SIGRTMIN + 24,
 149    __SIGRTMIN + 25,
 150    __SIGRTMIN + 26,
 151    __SIGRTMIN + 27,
 152    __SIGRTMIN + 28,
 153    __SIGRTMIN + 29,
 154    __SIGRTMIN + 30,
 155    __SIGRTMIN + 31,
 156    -1, /* SIGCANCEL */
 157    __SIGRTMIN,
 158    __SIGRTMIN + 32,
 159    __SIGRTMIN + 33,
 160    __SIGRTMIN + 34,
 161    __SIGRTMIN + 35,
 162    __SIGRTMIN + 36,
 163    __SIGRTMIN + 37,
 164    __SIGRTMIN + 38,
 165    __SIGRTMIN + 39,
 166    __SIGRTMIN + 40,
 167    __SIGRTMIN + 41,
 168    __SIGRTMIN + 42,
 169    __SIGRTMIN + 43,
 170    __SIGRTMIN + 44,
 171    __SIGRTMIN + 45,
 172    __SIGRTMIN + 46,
 173    __SIGRTMIN + 47,
 174    __SIGRTMIN + 48,
 175    __SIGRTMIN + 49,
 176    __SIGRTMIN + 50,
 177    __SIGRTMIN + 51,
 178    __SIGRTMIN + 52,
 179    __SIGRTMIN + 53,
 180    __SIGRTMIN + 54,
 181    __SIGRTMIN + 55,
 182    __SIGRTMIN + 56,
 183    __SIGRTMIN + 57,
 184    __SIGRTMIN + 58,
 185    __SIGRTMIN + 59,
 186    __SIGRTMIN + 60,
 187    __SIGRTMIN + 61,
 188    __SIGRTMIN + 62,
 189    __SIGRTMIN + 63,
 190    __SIGRTMIN + 64,
 191    __SIGRTMIN + 65,
 192    __SIGRTMIN + 66,
 193    __SIGRTMIN + 67,
 194    __SIGRTMIN + 68,
 195    __SIGRTMIN + 69,
 196    __SIGRTMIN + 70,
 197    __SIGRTMIN + 71,
 198    __SIGRTMIN + 72,
 199    __SIGRTMIN + 73,
 200    __SIGRTMIN + 74,
 201    __SIGRTMIN + 75,
 202    __SIGRTMIN + 76,
 203    __SIGRTMIN + 77,
 204    __SIGRTMIN + 78,
 205    __SIGRTMIN + 79,
 206    __SIGRTMIN + 80,
 207    __SIGRTMIN + 81,
 208    __SIGRTMIN + 82,
 209    __SIGRTMIN + 83,
 210    __SIGRTMIN + 84,
 211    __SIGRTMIN + 85,
 212    __SIGRTMIN + 86,
 213    __SIGRTMIN + 87,
 214    __SIGRTMIN + 88,
 215    __SIGRTMIN + 89,
 216    __SIGRTMIN + 90,
 217    __SIGRTMIN + 91,
 218    __SIGRTMIN + 92,
 219    __SIGRTMIN + 93,
 220    __SIGRTMIN + 94,
 221    __SIGRTMIN + 95,
 222    -1, /* SIGINFO */
 223    -1, /* UNKNOWN */
 224    -1, /* DEFAULT */
 225    -1,
 226    -1,
 227    -1,
 228    -1,
 229    -1,
 230    -1
 231#endif
 232};
 233#else
 234/* In system mode we only need SIGINT and SIGTRAP; other signals
 235   are not yet supported.  */
 236
 237enum {
 238    TARGET_SIGINT = 2,
 239    TARGET_SIGTRAP = 5
 240};
 241
 242static int gdb_signal_table[] = {
 243    -1,
 244    -1,
 245    TARGET_SIGINT,
 246    -1,
 247    -1,
 248    TARGET_SIGTRAP
 249};
 250#endif
 251
 252#ifdef CONFIG_USER_ONLY
 253static int target_signal_to_gdb (int sig)
 254{
 255    int i;
 256    for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 257        if (gdb_signal_table[i] == sig)
 258            return i;
 259    return GDB_SIGNAL_UNKNOWN;
 260}
 261#endif
 262
 263static int gdb_signal_to_target (int sig)
 264{
 265    if (sig < ARRAY_SIZE (gdb_signal_table))
 266        return gdb_signal_table[sig];
 267    else
 268        return -1;
 269}
 270
 271//#define DEBUG_GDB
 272
 273typedef struct GDBRegisterState {
 274    int base_reg;
 275    int num_regs;
 276    gdb_reg_cb get_reg;
 277    gdb_reg_cb set_reg;
 278    const char *xml;
 279    struct GDBRegisterState *next;
 280} GDBRegisterState;
 281
 282enum RSState {
 283    RS_INACTIVE,
 284    RS_IDLE,
 285    RS_GETLINE,
 286    RS_CHKSUM1,
 287    RS_CHKSUM2,
 288};
 289typedef struct GDBState {
 290    CPUState *c_cpu; /* current CPU for step/continue ops */
 291    CPUState *g_cpu; /* current CPU for other ops */
 292    CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 293    enum RSState state; /* parsing state */
 294    char line_buf[MAX_PACKET_LENGTH];
 295    int line_buf_index;
 296    int line_csum;
 297    uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 298    int last_packet_len;
 299    int signal;
 300#ifdef CONFIG_USER_ONLY
 301    int fd;
 302    int running_state;
 303#else
 304    CharDriverState *chr;
 305    CharDriverState *mon_chr;
 306#endif
 307    char syscall_buf[256];
 308    gdb_syscall_complete_cb current_syscall_cb;
 309} GDBState;
 310
 311/* By default use no IRQs and no timers while single stepping so as to
 312 * make single stepping like an ICE HW step.
 313 */
 314static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 315
 316static GDBState *gdbserver_state;
 317
 318bool gdb_has_xml;
 319
 320#ifdef CONFIG_USER_ONLY
 321/* XXX: This is not thread safe.  Do we care?  */
 322static int gdbserver_fd = -1;
 323
 324static int get_char(GDBState *s)
 325{
 326    uint8_t ch;
 327    int ret;
 328
 329    for(;;) {
 330        ret = qemu_recv(s->fd, &ch, 1, 0);
 331        if (ret < 0) {
 332            if (errno == ECONNRESET)
 333                s->fd = -1;
 334            if (errno != EINTR && errno != EAGAIN)
 335                return -1;
 336        } else if (ret == 0) {
 337            close(s->fd);
 338            s->fd = -1;
 339            return -1;
 340        } else {
 341            break;
 342        }
 343    }
 344    return ch;
 345}
 346#endif
 347
 348static enum {
 349    GDB_SYS_UNKNOWN,
 350    GDB_SYS_ENABLED,
 351    GDB_SYS_DISABLED,
 352} gdb_syscall_mode;
 353
 354/* If gdb is connected when the first semihosting syscall occurs then use
 355   remote gdb syscalls.  Otherwise use native file IO.  */
 356int use_gdb_syscalls(void)
 357{
 358    if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 359        gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 360                                            : GDB_SYS_DISABLED);
 361    }
 362    return gdb_syscall_mode == GDB_SYS_ENABLED;
 363}
 364
 365/* Resume execution.  */
 366static inline void gdb_continue(GDBState *s)
 367{
 368#ifdef CONFIG_USER_ONLY
 369    s->running_state = 1;
 370#else
 371    if (runstate_check(RUN_STATE_GUEST_PANICKED)) {
 372        runstate_set(RUN_STATE_DEBUG);
 373    }
 374    if (!runstate_needs_reset()) {
 375        vm_start();
 376    }
 377#endif
 378}
 379
 380static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 381{
 382#ifdef CONFIG_USER_ONLY
 383    int ret;
 384
 385    while (len > 0) {
 386        ret = send(s->fd, buf, len, 0);
 387        if (ret < 0) {
 388            if (errno != EINTR && errno != EAGAIN)
 389                return;
 390        } else {
 391            buf += ret;
 392            len -= ret;
 393        }
 394    }
 395#else
 396    qemu_chr_fe_write(s->chr, buf, len);
 397#endif
 398}
 399
 400static inline int fromhex(int v)
 401{
 402    if (v >= '0' && v <= '9')
 403        return v - '0';
 404    else if (v >= 'A' && v <= 'F')
 405        return v - 'A' + 10;
 406    else if (v >= 'a' && v <= 'f')
 407        return v - 'a' + 10;
 408    else
 409        return 0;
 410}
 411
 412static inline int tohex(int v)
 413{
 414    if (v < 10)
 415        return v + '0';
 416    else
 417        return v - 10 + 'a';
 418}
 419
 420static void memtohex(char *buf, const uint8_t *mem, int len)
 421{
 422    int i, c;
 423    char *q;
 424    q = buf;
 425    for(i = 0; i < len; i++) {
 426        c = mem[i];
 427        *q++ = tohex(c >> 4);
 428        *q++ = tohex(c & 0xf);
 429    }
 430    *q = '\0';
 431}
 432
 433static void hextomem(uint8_t *mem, const char *buf, int len)
 434{
 435    int i;
 436
 437    for(i = 0; i < len; i++) {
 438        mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 439        buf += 2;
 440    }
 441}
 442
 443/* return -1 if error, 0 if OK */
 444static int put_packet_binary(GDBState *s, const char *buf, int len)
 445{
 446    int csum, i;
 447    uint8_t *p;
 448
 449    for(;;) {
 450        p = s->last_packet;
 451        *(p++) = '$';
 452        memcpy(p, buf, len);
 453        p += len;
 454        csum = 0;
 455        for(i = 0; i < len; i++) {
 456            csum += buf[i];
 457        }
 458        *(p++) = '#';
 459        *(p++) = tohex((csum >> 4) & 0xf);
 460        *(p++) = tohex((csum) & 0xf);
 461
 462        s->last_packet_len = p - s->last_packet;
 463        put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 464
 465#ifdef CONFIG_USER_ONLY
 466        i = get_char(s);
 467        if (i < 0)
 468            return -1;
 469        if (i == '+')
 470            break;
 471#else
 472        break;
 473#endif
 474    }
 475    return 0;
 476}
 477
 478/* return -1 if error, 0 if OK */
 479static int put_packet(GDBState *s, const char *buf)
 480{
 481#ifdef DEBUG_GDB
 482    printf("reply='%s'\n", buf);
 483#endif
 484
 485    return put_packet_binary(s, buf, strlen(buf));
 486}
 487
 488/* Encode data using the encoding for 'x' packets.  */
 489static int memtox(char *buf, const char *mem, int len)
 490{
 491    char *p = buf;
 492    char c;
 493
 494    while (len--) {
 495        c = *(mem++);
 496        switch (c) {
 497        case '#': case '$': case '*': case '}':
 498            *(p++) = '}';
 499            *(p++) = c ^ 0x20;
 500            break;
 501        default:
 502            *(p++) = c;
 503            break;
 504        }
 505    }
 506    return p - buf;
 507}
 508
 509static const char *get_feature_xml(const char *p, const char **newp,
 510                                   CPUClass *cc)
 511{
 512    size_t len;
 513    int i;
 514    const char *name;
 515    static char target_xml[1024];
 516
 517    len = 0;
 518    while (p[len] && p[len] != ':')
 519        len++;
 520    *newp = p + len;
 521
 522    name = NULL;
 523    if (strncmp(p, "target.xml", len) == 0) {
 524        /* Generate the XML description for this CPU.  */
 525        if (!target_xml[0]) {
 526            GDBRegisterState *r;
 527            CPUState *cpu = first_cpu;
 528
 529            snprintf(target_xml, sizeof(target_xml),
 530                     "<?xml version=\"1.0\"?>"
 531                     "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
 532                     "<target>"
 533                     "<xi:include href=\"%s\"/>",
 534                     cc->gdb_core_xml_file);
 535
 536            for (r = cpu->gdb_regs; r; r = r->next) {
 537                pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
 538                pstrcat(target_xml, sizeof(target_xml), r->xml);
 539                pstrcat(target_xml, sizeof(target_xml), "\"/>");
 540            }
 541            pstrcat(target_xml, sizeof(target_xml), "</target>");
 542        }
 543        return target_xml;
 544    }
 545    for (i = 0; ; i++) {
 546        name = xml_builtin[i][0];
 547        if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
 548            break;
 549    }
 550    return name ? xml_builtin[i][1] : NULL;
 551}
 552
 553static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 554{
 555    CPUClass *cc = CPU_GET_CLASS(cpu);
 556    CPUArchState *env = cpu->env_ptr;
 557    GDBRegisterState *r;
 558
 559    if (reg < cc->gdb_num_core_regs) {
 560        return cc->gdb_read_register(cpu, mem_buf, reg);
 561    }
 562
 563    for (r = cpu->gdb_regs; r; r = r->next) {
 564        if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 565            return r->get_reg(env, mem_buf, reg - r->base_reg);
 566        }
 567    }
 568    return 0;
 569}
 570
 571static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 572{
 573    CPUClass *cc = CPU_GET_CLASS(cpu);
 574    CPUArchState *env = cpu->env_ptr;
 575    GDBRegisterState *r;
 576
 577    if (reg < cc->gdb_num_core_regs) {
 578        return cc->gdb_write_register(cpu, mem_buf, reg);
 579    }
 580
 581    for (r = cpu->gdb_regs; r; r = r->next) {
 582        if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 583            return r->set_reg(env, mem_buf, reg - r->base_reg);
 584        }
 585    }
 586    return 0;
 587}
 588
 589/* Register a supplemental set of CPU registers.  If g_pos is nonzero it
 590   specifies the first register number and these registers are included in
 591   a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
 592   gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
 593 */
 594
 595void gdb_register_coprocessor(CPUState *cpu,
 596                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
 597                              int num_regs, const char *xml, int g_pos)
 598{
 599    GDBRegisterState *s;
 600    GDBRegisterState **p;
 601
 602    p = &cpu->gdb_regs;
 603    while (*p) {
 604        /* Check for duplicates.  */
 605        if (strcmp((*p)->xml, xml) == 0)
 606            return;
 607        p = &(*p)->next;
 608    }
 609
 610    s = g_new0(GDBRegisterState, 1);
 611    s->base_reg = cpu->gdb_num_regs;
 612    s->num_regs = num_regs;
 613    s->get_reg = get_reg;
 614    s->set_reg = set_reg;
 615    s->xml = xml;
 616
 617    /* Add to end of list.  */
 618    cpu->gdb_num_regs += num_regs;
 619    *p = s;
 620    if (g_pos) {
 621        if (g_pos != s->base_reg) {
 622            fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
 623                    "Expected %d got %d\n", xml, g_pos, s->base_reg);
 624        } else {
 625            cpu->gdb_num_g_regs = cpu->gdb_num_regs;
 626        }
 627    }
 628}
 629
 630#ifndef CONFIG_USER_ONLY
 631static const int xlat_gdb_type[] = {
 632    [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
 633    [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
 634    [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
 635};
 636#endif
 637
 638static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
 639{
 640    CPUState *cpu;
 641    CPUArchState *env;
 642    int err = 0;
 643
 644    if (kvm_enabled()) {
 645        return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 646    }
 647
 648    switch (type) {
 649    case GDB_BREAKPOINT_SW:
 650    case GDB_BREAKPOINT_HW:
 651        for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 652            env = cpu->env_ptr;
 653            err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
 654            if (err)
 655                break;
 656        }
 657        return err;
 658#ifndef CONFIG_USER_ONLY
 659    case GDB_WATCHPOINT_WRITE:
 660    case GDB_WATCHPOINT_READ:
 661    case GDB_WATCHPOINT_ACCESS:
 662        for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 663            env = cpu->env_ptr;
 664            err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
 665                                        NULL);
 666            if (err)
 667                break;
 668        }
 669        return err;
 670#endif
 671    default:
 672        return -ENOSYS;
 673    }
 674}
 675
 676static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
 677{
 678    CPUState *cpu;
 679    CPUArchState *env;
 680    int err = 0;
 681
 682    if (kvm_enabled()) {
 683        return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 684    }
 685
 686    switch (type) {
 687    case GDB_BREAKPOINT_SW:
 688    case GDB_BREAKPOINT_HW:
 689        for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 690            env = cpu->env_ptr;
 691            err = cpu_breakpoint_remove(env, addr, BP_GDB);
 692            if (err)
 693                break;
 694        }
 695        return err;
 696#ifndef CONFIG_USER_ONLY
 697    case GDB_WATCHPOINT_WRITE:
 698    case GDB_WATCHPOINT_READ:
 699    case GDB_WATCHPOINT_ACCESS:
 700        for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 701            env = cpu->env_ptr;
 702            err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
 703            if (err)
 704                break;
 705        }
 706        return err;
 707#endif
 708    default:
 709        return -ENOSYS;
 710    }
 711}
 712
 713static void gdb_breakpoint_remove_all(void)
 714{
 715    CPUState *cpu;
 716    CPUArchState *env;
 717
 718    if (kvm_enabled()) {
 719        kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
 720        return;
 721    }
 722
 723    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 724        env = cpu->env_ptr;
 725        cpu_breakpoint_remove_all(env, BP_GDB);
 726#ifndef CONFIG_USER_ONLY
 727        cpu_watchpoint_remove_all(env, BP_GDB);
 728#endif
 729    }
 730}
 731
 732static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 733{
 734    CPUState *cpu = s->c_cpu;
 735    CPUClass *cc = CPU_GET_CLASS(cpu);
 736
 737    cpu_synchronize_state(cpu);
 738    if (cc->set_pc) {
 739        cc->set_pc(cpu, pc);
 740    }
 741}
 742
 743static CPUState *find_cpu(uint32_t thread_id)
 744{
 745    CPUState *cpu;
 746
 747    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 748        if (cpu_index(cpu) == thread_id) {
 749            return cpu;
 750        }
 751    }
 752
 753    return NULL;
 754}
 755
 756static int gdb_handle_packet(GDBState *s, const char *line_buf)
 757{
 758    CPUState *cpu;
 759    CPUClass *cc;
 760    const char *p;
 761    uint32_t thread;
 762    int ch, reg_size, type, res;
 763    char buf[MAX_PACKET_LENGTH];
 764    uint8_t mem_buf[MAX_PACKET_LENGTH];
 765    uint8_t *registers;
 766    target_ulong addr, len;
 767
 768#ifdef DEBUG_GDB
 769    printf("command='%s'\n", line_buf);
 770#endif
 771    p = line_buf;
 772    ch = *p++;
 773    switch(ch) {
 774    case '?':
 775        /* TODO: Make this return the correct value for user-mode.  */
 776        snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
 777                 cpu_index(s->c_cpu));
 778        put_packet(s, buf);
 779        /* Remove all the breakpoints when this query is issued,
 780         * because gdb is doing and initial connect and the state
 781         * should be cleaned up.
 782         */
 783        gdb_breakpoint_remove_all();
 784        break;
 785    case 'c':
 786        if (*p != '\0') {
 787            addr = strtoull(p, (char **)&p, 16);
 788            gdb_set_cpu_pc(s, addr);
 789        }
 790        s->signal = 0;
 791        gdb_continue(s);
 792        return RS_IDLE;
 793    case 'C':
 794        s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
 795        if (s->signal == -1)
 796            s->signal = 0;
 797        gdb_continue(s);
 798        return RS_IDLE;
 799    case 'v':
 800        if (strncmp(p, "Cont", 4) == 0) {
 801            int res_signal, res_thread;
 802
 803            p += 4;
 804            if (*p == '?') {
 805                put_packet(s, "vCont;c;C;s;S");
 806                break;
 807            }
 808            res = 0;
 809            res_signal = 0;
 810            res_thread = 0;
 811            while (*p) {
 812                int action, signal;
 813
 814                if (*p++ != ';') {
 815                    res = 0;
 816                    break;
 817                }
 818                action = *p++;
 819                signal = 0;
 820                if (action == 'C' || action == 'S') {
 821                    signal = strtoul(p, (char **)&p, 16);
 822                } else if (action != 'c' && action != 's') {
 823                    res = 0;
 824                    break;
 825                }
 826                thread = 0;
 827                if (*p == ':') {
 828                    thread = strtoull(p+1, (char **)&p, 16);
 829                }
 830                action = tolower(action);
 831                if (res == 0 || (res == 'c' && action == 's')) {
 832                    res = action;
 833                    res_signal = signal;
 834                    res_thread = thread;
 835                }
 836            }
 837            if (res) {
 838                if (res_thread != -1 && res_thread != 0) {
 839                    cpu = find_cpu(res_thread);
 840                    if (cpu == NULL) {
 841                        put_packet(s, "E22");
 842                        break;
 843                    }
 844                    s->c_cpu = cpu;
 845                }
 846                if (res == 's') {
 847                    cpu_single_step(s->c_cpu, sstep_flags);
 848                }
 849                s->signal = res_signal;
 850                gdb_continue(s);
 851                return RS_IDLE;
 852            }
 853            break;
 854        } else {
 855            goto unknown_command;
 856        }
 857    case 'k':
 858#ifdef CONFIG_USER_ONLY
 859        /* Kill the target */
 860        fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
 861        exit(0);
 862#endif
 863    case 'D':
 864        /* Detach packet */
 865        gdb_breakpoint_remove_all();
 866        gdb_syscall_mode = GDB_SYS_DISABLED;
 867        gdb_continue(s);
 868        put_packet(s, "OK");
 869        break;
 870    case 's':
 871        if (*p != '\0') {
 872            addr = strtoull(p, (char **)&p, 16);
 873            gdb_set_cpu_pc(s, addr);
 874        }
 875        cpu_single_step(s->c_cpu, sstep_flags);
 876        gdb_continue(s);
 877        return RS_IDLE;
 878    case 'F':
 879        {
 880            target_ulong ret;
 881            target_ulong err;
 882
 883            ret = strtoull(p, (char **)&p, 16);
 884            if (*p == ',') {
 885                p++;
 886                err = strtoull(p, (char **)&p, 16);
 887            } else {
 888                err = 0;
 889            }
 890            if (*p == ',')
 891                p++;
 892            type = *p;
 893            if (s->current_syscall_cb) {
 894                s->current_syscall_cb(s->c_cpu, ret, err);
 895                s->current_syscall_cb = NULL;
 896            }
 897            if (type == 'C') {
 898                put_packet(s, "T02");
 899            } else {
 900                gdb_continue(s);
 901            }
 902        }
 903        break;
 904    case 'g':
 905        cpu_synchronize_state(s->g_cpu);
 906        len = 0;
 907        for (addr = 0; addr < s->g_cpu->gdb_num_g_regs; addr++) {
 908            reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
 909            len += reg_size;
 910        }
 911        memtohex(buf, mem_buf, len);
 912        put_packet(s, buf);
 913        break;
 914    case 'G':
 915        cpu_synchronize_state(s->g_cpu);
 916        registers = mem_buf;
 917        len = strlen(p) / 2;
 918        hextomem((uint8_t *)registers, p, len);
 919        for (addr = 0; addr < s->g_cpu->gdb_num_g_regs && len > 0; addr++) {
 920            reg_size = gdb_write_register(s->g_cpu, registers, addr);
 921            len -= reg_size;
 922            registers += reg_size;
 923        }
 924        put_packet(s, "OK");
 925        break;
 926    case 'm':
 927        addr = strtoull(p, (char **)&p, 16);
 928        if (*p == ',')
 929            p++;
 930        len = strtoull(p, NULL, 16);
 931        if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
 932            put_packet (s, "E14");
 933        } else {
 934            memtohex(buf, mem_buf, len);
 935            put_packet(s, buf);
 936        }
 937        break;
 938    case 'M':
 939        addr = strtoull(p, (char **)&p, 16);
 940        if (*p == ',')
 941            p++;
 942        len = strtoull(p, (char **)&p, 16);
 943        if (*p == ':')
 944            p++;
 945        hextomem(mem_buf, p, len);
 946        if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
 947                                   true) != 0) {
 948            put_packet(s, "E14");
 949        } else {
 950            put_packet(s, "OK");
 951        }
 952        break;
 953    case 'p':
 954        /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
 955           This works, but can be very slow.  Anything new enough to
 956           understand XML also knows how to use this properly.  */
 957        if (!gdb_has_xml)
 958            goto unknown_command;
 959        addr = strtoull(p, (char **)&p, 16);
 960        reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
 961        if (reg_size) {
 962            memtohex(buf, mem_buf, reg_size);
 963            put_packet(s, buf);
 964        } else {
 965            put_packet(s, "E14");
 966        }
 967        break;
 968    case 'P':
 969        if (!gdb_has_xml)
 970            goto unknown_command;
 971        addr = strtoull(p, (char **)&p, 16);
 972        if (*p == '=')
 973            p++;
 974        reg_size = strlen(p) / 2;
 975        hextomem(mem_buf, p, reg_size);
 976        gdb_write_register(s->g_cpu, mem_buf, addr);
 977        put_packet(s, "OK");
 978        break;
 979    case 'Z':
 980    case 'z':
 981        type = strtoul(p, (char **)&p, 16);
 982        if (*p == ',')
 983            p++;
 984        addr = strtoull(p, (char **)&p, 16);
 985        if (*p == ',')
 986            p++;
 987        len = strtoull(p, (char **)&p, 16);
 988        if (ch == 'Z')
 989            res = gdb_breakpoint_insert(addr, len, type);
 990        else
 991            res = gdb_breakpoint_remove(addr, len, type);
 992        if (res >= 0)
 993             put_packet(s, "OK");
 994        else if (res == -ENOSYS)
 995            put_packet(s, "");
 996        else
 997            put_packet(s, "E22");
 998        break;
 999    case 'H':
1000        type = *p++;
1001        thread = strtoull(p, (char **)&p, 16);
1002        if (thread == -1 || thread == 0) {
1003            put_packet(s, "OK");
1004            break;
1005        }
1006        cpu = find_cpu(thread);
1007        if (cpu == NULL) {
1008            put_packet(s, "E22");
1009            break;
1010        }
1011        switch (type) {
1012        case 'c':
1013            s->c_cpu = cpu;
1014            put_packet(s, "OK");
1015            break;
1016        case 'g':
1017            s->g_cpu = cpu;
1018            put_packet(s, "OK");
1019            break;
1020        default:
1021             put_packet(s, "E22");
1022             break;
1023        }
1024        break;
1025    case 'T':
1026        thread = strtoull(p, (char **)&p, 16);
1027        cpu = find_cpu(thread);
1028
1029        if (cpu != NULL) {
1030            put_packet(s, "OK");
1031        } else {
1032            put_packet(s, "E22");
1033        }
1034        break;
1035    case 'q':
1036    case 'Q':
1037        /* parse any 'q' packets here */
1038        if (!strcmp(p,"qemu.sstepbits")) {
1039            /* Query Breakpoint bit definitions */
1040            snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1041                     SSTEP_ENABLE,
1042                     SSTEP_NOIRQ,
1043                     SSTEP_NOTIMER);
1044            put_packet(s, buf);
1045            break;
1046        } else if (strncmp(p,"qemu.sstep",10) == 0) {
1047            /* Display or change the sstep_flags */
1048            p += 10;
1049            if (*p != '=') {
1050                /* Display current setting */
1051                snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1052                put_packet(s, buf);
1053                break;
1054            }
1055            p++;
1056            type = strtoul(p, (char **)&p, 16);
1057            sstep_flags = type;
1058            put_packet(s, "OK");
1059            break;
1060        } else if (strcmp(p,"C") == 0) {
1061            /* "Current thread" remains vague in the spec, so always return
1062             *  the first CPU (gdb returns the first thread). */
1063            put_packet(s, "QC1");
1064            break;
1065        } else if (strcmp(p,"fThreadInfo") == 0) {
1066            s->query_cpu = first_cpu;
1067            goto report_cpuinfo;
1068        } else if (strcmp(p,"sThreadInfo") == 0) {
1069        report_cpuinfo:
1070            if (s->query_cpu) {
1071                snprintf(buf, sizeof(buf), "m%x", cpu_index(s->query_cpu));
1072                put_packet(s, buf);
1073                s->query_cpu = s->query_cpu->next_cpu;
1074            } else
1075                put_packet(s, "l");
1076            break;
1077        } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1078            thread = strtoull(p+16, (char **)&p, 16);
1079            cpu = find_cpu(thread);
1080            if (cpu != NULL) {
1081                cpu_synchronize_state(cpu);
1082                len = snprintf((char *)mem_buf, sizeof(mem_buf),
1083                               "CPU#%d [%s]", cpu->cpu_index,
1084                               cpu->halted ? "halted " : "running");
1085                memtohex(buf, mem_buf, len);
1086                put_packet(s, buf);
1087            }
1088            break;
1089        }
1090#ifdef CONFIG_USER_ONLY
1091        else if (strncmp(p, "Offsets", 7) == 0) {
1092            CPUArchState *env = s->c_cpu->env_ptr;
1093            TaskState *ts = env->opaque;
1094
1095            snprintf(buf, sizeof(buf),
1096                     "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1097                     ";Bss=" TARGET_ABI_FMT_lx,
1098                     ts->info->code_offset,
1099                     ts->info->data_offset,
1100                     ts->info->data_offset);
1101            put_packet(s, buf);
1102            break;
1103        }
1104#else /* !CONFIG_USER_ONLY */
1105        else if (strncmp(p, "Rcmd,", 5) == 0) {
1106            int len = strlen(p + 5);
1107
1108            if ((len % 2) != 0) {
1109                put_packet(s, "E01");
1110                break;
1111            }
1112            hextomem(mem_buf, p + 5, len);
1113            len = len / 2;
1114            mem_buf[len++] = 0;
1115            qemu_chr_be_write(s->mon_chr, mem_buf, len);
1116            put_packet(s, "OK");
1117            break;
1118        }
1119#endif /* !CONFIG_USER_ONLY */
1120        if (strncmp(p, "Supported", 9) == 0) {
1121            snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1122            cc = CPU_GET_CLASS(first_cpu);
1123            if (cc->gdb_core_xml_file != NULL) {
1124                pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1125            }
1126            put_packet(s, buf);
1127            break;
1128        }
1129        if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1130            const char *xml;
1131            target_ulong total_len;
1132
1133            cc = CPU_GET_CLASS(first_cpu);
1134            if (cc->gdb_core_xml_file == NULL) {
1135                goto unknown_command;
1136            }
1137
1138            gdb_has_xml = true;
1139            p += 19;
1140            xml = get_feature_xml(p, &p, cc);
1141            if (!xml) {
1142                snprintf(buf, sizeof(buf), "E00");
1143                put_packet(s, buf);
1144                break;
1145            }
1146
1147            if (*p == ':')
1148                p++;
1149            addr = strtoul(p, (char **)&p, 16);
1150            if (*p == ',')
1151                p++;
1152            len = strtoul(p, (char **)&p, 16);
1153
1154            total_len = strlen(xml);
1155            if (addr > total_len) {
1156                snprintf(buf, sizeof(buf), "E00");
1157                put_packet(s, buf);
1158                break;
1159            }
1160            if (len > (MAX_PACKET_LENGTH - 5) / 2)
1161                len = (MAX_PACKET_LENGTH - 5) / 2;
1162            if (len < total_len - addr) {
1163                buf[0] = 'm';
1164                len = memtox(buf + 1, xml + addr, len);
1165            } else {
1166                buf[0] = 'l';
1167                len = memtox(buf + 1, xml + addr, total_len - addr);
1168            }
1169            put_packet_binary(s, buf, len + 1);
1170            break;
1171        }
1172        /* Unrecognised 'q' command.  */
1173        goto unknown_command;
1174
1175    default:
1176    unknown_command:
1177        /* put empty packet */
1178        buf[0] = '\0';
1179        put_packet(s, buf);
1180        break;
1181    }
1182    return RS_IDLE;
1183}
1184
1185void gdb_set_stop_cpu(CPUState *cpu)
1186{
1187    gdbserver_state->c_cpu = cpu;
1188    gdbserver_state->g_cpu = cpu;
1189}
1190
1191#ifndef CONFIG_USER_ONLY
1192static void gdb_vm_state_change(void *opaque, int running, RunState state)
1193{
1194    GDBState *s = gdbserver_state;
1195    CPUArchState *env = s->c_cpu->env_ptr;
1196    CPUState *cpu = s->c_cpu;
1197    char buf[256];
1198    const char *type;
1199    int ret;
1200
1201    if (running || s->state == RS_INACTIVE) {
1202        return;
1203    }
1204    /* Is there a GDB syscall waiting to be sent?  */
1205    if (s->current_syscall_cb) {
1206        put_packet(s, s->syscall_buf);
1207        return;
1208    }
1209    switch (state) {
1210    case RUN_STATE_DEBUG:
1211        if (env->watchpoint_hit) {
1212            switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
1213            case BP_MEM_READ:
1214                type = "r";
1215                break;
1216            case BP_MEM_ACCESS:
1217                type = "a";
1218                break;
1219            default:
1220                type = "";
1221                break;
1222            }
1223            snprintf(buf, sizeof(buf),
1224                     "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1225                     GDB_SIGNAL_TRAP, cpu_index(cpu), type,
1226                     env->watchpoint_hit->vaddr);
1227            env->watchpoint_hit = NULL;
1228            goto send_packet;
1229        }
1230        tb_flush(env);
1231        ret = GDB_SIGNAL_TRAP;
1232        break;
1233    case RUN_STATE_PAUSED:
1234        ret = GDB_SIGNAL_INT;
1235        break;
1236    case RUN_STATE_SHUTDOWN:
1237        ret = GDB_SIGNAL_QUIT;
1238        break;
1239    case RUN_STATE_IO_ERROR:
1240        ret = GDB_SIGNAL_IO;
1241        break;
1242    case RUN_STATE_WATCHDOG:
1243        ret = GDB_SIGNAL_ALRM;
1244        break;
1245    case RUN_STATE_INTERNAL_ERROR:
1246        ret = GDB_SIGNAL_ABRT;
1247        break;
1248    case RUN_STATE_SAVE_VM:
1249    case RUN_STATE_RESTORE_VM:
1250        return;
1251    case RUN_STATE_FINISH_MIGRATE:
1252        ret = GDB_SIGNAL_XCPU;
1253        break;
1254    default:
1255        ret = GDB_SIGNAL_UNKNOWN;
1256        break;
1257    }
1258    snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, cpu_index(cpu));
1259
1260send_packet:
1261    put_packet(s, buf);
1262
1263    /* disable single step if it was enabled */
1264    cpu_single_step(cpu, 0);
1265}
1266#endif
1267
1268/* Send a gdb syscall request.
1269   This accepts limited printf-style format specifiers, specifically:
1270    %x  - target_ulong argument printed in hex.
1271    %lx - 64-bit argument printed in hex.
1272    %s  - string pointer (target_ulong) and length (int) pair.  */
1273void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1274{
1275    va_list va;
1276    char *p;
1277    char *p_end;
1278    target_ulong addr;
1279    uint64_t i64;
1280    GDBState *s;
1281
1282    s = gdbserver_state;
1283    if (!s)
1284        return;
1285    s->current_syscall_cb = cb;
1286#ifndef CONFIG_USER_ONLY
1287    vm_stop(RUN_STATE_DEBUG);
1288#endif
1289    va_start(va, fmt);
1290    p = s->syscall_buf;
1291    p_end = &s->syscall_buf[sizeof(s->syscall_buf)];
1292    *(p++) = 'F';
1293    while (*fmt) {
1294        if (*fmt == '%') {
1295            fmt++;
1296            switch (*fmt++) {
1297            case 'x':
1298                addr = va_arg(va, target_ulong);
1299                p += snprintf(p, p_end - p, TARGET_FMT_lx, addr);
1300                break;
1301            case 'l':
1302                if (*(fmt++) != 'x')
1303                    goto bad_format;
1304                i64 = va_arg(va, uint64_t);
1305                p += snprintf(p, p_end - p, "%" PRIx64, i64);
1306                break;
1307            case 's':
1308                addr = va_arg(va, target_ulong);
1309                p += snprintf(p, p_end - p, TARGET_FMT_lx "/%x",
1310                              addr, va_arg(va, int));
1311                break;
1312            default:
1313            bad_format:
1314                fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
1315                        fmt - 1);
1316                break;
1317            }
1318        } else {
1319            *(p++) = *(fmt++);
1320        }
1321    }
1322    *p = 0;
1323    va_end(va);
1324#ifdef CONFIG_USER_ONLY
1325    put_packet(s, s->syscall_buf);
1326    gdb_handlesig(s->c_cpu, 0);
1327#else
1328    /* In this case wait to send the syscall packet until notification that
1329       the CPU has stopped.  This must be done because if the packet is sent
1330       now the reply from the syscall request could be received while the CPU
1331       is still in the running state, which can cause packets to be dropped
1332       and state transition 'T' packets to be sent while the syscall is still
1333       being processed.  */
1334    cpu_exit(s->c_cpu);
1335#endif
1336}
1337
1338static void gdb_read_byte(GDBState *s, int ch)
1339{
1340    int i, csum;
1341    uint8_t reply;
1342
1343#ifndef CONFIG_USER_ONLY
1344    if (s->last_packet_len) {
1345        /* Waiting for a response to the last packet.  If we see the start
1346           of a new command then abandon the previous response.  */
1347        if (ch == '-') {
1348#ifdef DEBUG_GDB
1349            printf("Got NACK, retransmitting\n");
1350#endif
1351            put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
1352        }
1353#ifdef DEBUG_GDB
1354        else if (ch == '+')
1355            printf("Got ACK\n");
1356        else
1357            printf("Got '%c' when expecting ACK/NACK\n", ch);
1358#endif
1359        if (ch == '+' || ch == '$')
1360            s->last_packet_len = 0;
1361        if (ch != '$')
1362            return;
1363    }
1364    if (runstate_is_running()) {
1365        /* when the CPU is running, we cannot do anything except stop
1366           it when receiving a char */
1367        vm_stop(RUN_STATE_PAUSED);
1368    } else
1369#endif
1370    {
1371        switch(s->state) {
1372        case RS_IDLE:
1373            if (ch == '$') {
1374                s->line_buf_index = 0;
1375                s->state = RS_GETLINE;
1376            }
1377            break;
1378        case RS_GETLINE:
1379            if (ch == '#') {
1380            s->state = RS_CHKSUM1;
1381            } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1382                s->state = RS_IDLE;
1383            } else {
1384            s->line_buf[s->line_buf_index++] = ch;
1385            }
1386            break;
1387        case RS_CHKSUM1:
1388            s->line_buf[s->line_buf_index] = '\0';
1389            s->line_csum = fromhex(ch) << 4;
1390            s->state = RS_CHKSUM2;
1391            break;
1392        case RS_CHKSUM2:
1393            s->line_csum |= fromhex(ch);
1394            csum = 0;
1395            for(i = 0; i < s->line_buf_index; i++) {
1396                csum += s->line_buf[i];
1397            }
1398            if (s->line_csum != (csum & 0xff)) {
1399                reply = '-';
1400                put_buffer(s, &reply, 1);
1401                s->state = RS_IDLE;
1402            } else {
1403                reply = '+';
1404                put_buffer(s, &reply, 1);
1405                s->state = gdb_handle_packet(s, s->line_buf);
1406            }
1407            break;
1408        default:
1409            abort();
1410        }
1411    }
1412}
1413
1414/* Tell the remote gdb that the process has exited.  */
1415void gdb_exit(CPUArchState *env, int code)
1416{
1417  GDBState *s;
1418  char buf[4];
1419
1420  s = gdbserver_state;
1421  if (!s) {
1422      return;
1423  }
1424#ifdef CONFIG_USER_ONLY
1425  if (gdbserver_fd < 0 || s->fd < 0) {
1426      return;
1427  }
1428#endif
1429
1430  snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
1431  put_packet(s, buf);
1432
1433#ifndef CONFIG_USER_ONLY
1434  if (s->chr) {
1435      qemu_chr_delete(s->chr);
1436  }
1437#endif
1438}
1439
1440#ifdef CONFIG_USER_ONLY
1441int
1442gdb_queuesig (void)
1443{
1444    GDBState *s;
1445
1446    s = gdbserver_state;
1447
1448    if (gdbserver_fd < 0 || s->fd < 0)
1449        return 0;
1450    else
1451        return 1;
1452}
1453
1454int
1455gdb_handlesig(CPUState *cpu, int sig)
1456{
1457    CPUArchState *env = cpu->env_ptr;
1458    GDBState *s;
1459    char buf[256];
1460    int n;
1461
1462    s = gdbserver_state;
1463    if (gdbserver_fd < 0 || s->fd < 0) {
1464        return sig;
1465    }
1466
1467    /* disable single step if it was enabled */
1468    cpu_single_step(cpu, 0);
1469    tb_flush(env);
1470
1471    if (sig != 0) {
1472        snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));
1473        put_packet(s, buf);
1474    }
1475    /* put_packet() might have detected that the peer terminated the
1476       connection.  */
1477    if (s->fd < 0) {
1478        return sig;
1479    }
1480
1481    sig = 0;
1482    s->state = RS_IDLE;
1483    s->running_state = 0;
1484    while (s->running_state == 0) {
1485        n = read(s->fd, buf, 256);
1486        if (n > 0) {
1487            int i;
1488
1489            for (i = 0; i < n; i++) {
1490                gdb_read_byte(s, buf[i]);
1491            }
1492        } else if (n == 0 || errno != EAGAIN) {
1493            /* XXX: Connection closed.  Should probably wait for another
1494               connection before continuing.  */
1495            return sig;
1496        }
1497    }
1498    sig = s->signal;
1499    s->signal = 0;
1500    return sig;
1501}
1502
1503/* Tell the remote gdb that the process has exited due to SIG.  */
1504void gdb_signalled(CPUArchState *env, int sig)
1505{
1506    GDBState *s;
1507    char buf[4];
1508
1509    s = gdbserver_state;
1510    if (gdbserver_fd < 0 || s->fd < 0) {
1511        return;
1512    }
1513
1514    snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb(sig));
1515    put_packet(s, buf);
1516}
1517
1518static void gdb_accept(void)
1519{
1520    GDBState *s;
1521    struct sockaddr_in sockaddr;
1522    socklen_t len;
1523    int fd;
1524
1525    for(;;) {
1526        len = sizeof(sockaddr);
1527        fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
1528        if (fd < 0 && errno != EINTR) {
1529            perror("accept");
1530            return;
1531        } else if (fd >= 0) {
1532#ifndef _WIN32
1533            fcntl(fd, F_SETFD, FD_CLOEXEC);
1534#endif
1535            break;
1536        }
1537    }
1538
1539    /* set short latency */
1540    socket_set_nodelay(fd);
1541
1542    s = g_malloc0(sizeof(GDBState));
1543    s->c_cpu = first_cpu;
1544    s->g_cpu = first_cpu;
1545    s->fd = fd;
1546    gdb_has_xml = false;
1547
1548    gdbserver_state = s;
1549
1550    fcntl(fd, F_SETFL, O_NONBLOCK);
1551}
1552
1553static int gdbserver_open(int port)
1554{
1555    struct sockaddr_in sockaddr;
1556    int fd, val, ret;
1557
1558    fd = socket(PF_INET, SOCK_STREAM, 0);
1559    if (fd < 0) {
1560        perror("socket");
1561        return -1;
1562    }
1563#ifndef _WIN32
1564    fcntl(fd, F_SETFD, FD_CLOEXEC);
1565#endif
1566
1567    /* allow fast reuse */
1568    val = 1;
1569    qemu_setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &val, sizeof(val));
1570
1571    sockaddr.sin_family = AF_INET;
1572    sockaddr.sin_port = htons(port);
1573    sockaddr.sin_addr.s_addr = 0;
1574    ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
1575    if (ret < 0) {
1576        perror("bind");
1577        close(fd);
1578        return -1;
1579    }
1580    ret = listen(fd, 0);
1581    if (ret < 0) {
1582        perror("listen");
1583        close(fd);
1584        return -1;
1585    }
1586    return fd;
1587}
1588
1589int gdbserver_start(int port)
1590{
1591    gdbserver_fd = gdbserver_open(port);
1592    if (gdbserver_fd < 0)
1593        return -1;
1594    /* accept connections */
1595    gdb_accept();
1596    return 0;
1597}
1598
1599/* Disable gdb stub for child processes.  */
1600void gdbserver_fork(CPUArchState *env)
1601{
1602    GDBState *s = gdbserver_state;
1603    if (gdbserver_fd < 0 || s->fd < 0)
1604      return;
1605    close(s->fd);
1606    s->fd = -1;
1607    cpu_breakpoint_remove_all(env, BP_GDB);
1608    cpu_watchpoint_remove_all(env, BP_GDB);
1609}
1610#else
1611static int gdb_chr_can_receive(void *opaque)
1612{
1613  /* We can handle an arbitrarily large amount of data.
1614   Pick the maximum packet size, which is as good as anything.  */
1615  return MAX_PACKET_LENGTH;
1616}
1617
1618static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
1619{
1620    int i;
1621
1622    for (i = 0; i < size; i++) {
1623        gdb_read_byte(gdbserver_state, buf[i]);
1624    }
1625}
1626
1627static void gdb_chr_event(void *opaque, int event)
1628{
1629    switch (event) {
1630    case CHR_EVENT_OPENED:
1631        vm_stop(RUN_STATE_PAUSED);
1632        gdb_has_xml = false;
1633        break;
1634    default:
1635        break;
1636    }
1637}
1638
1639static void gdb_monitor_output(GDBState *s, const char *msg, int len)
1640{
1641    char buf[MAX_PACKET_LENGTH];
1642
1643    buf[0] = 'O';
1644    if (len > (MAX_PACKET_LENGTH/2) - 1)
1645        len = (MAX_PACKET_LENGTH/2) - 1;
1646    memtohex(buf + 1, (uint8_t *)msg, len);
1647    put_packet(s, buf);
1648}
1649
1650static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
1651{
1652    const char *p = (const char *)buf;
1653    int max_sz;
1654
1655    max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
1656    for (;;) {
1657        if (len <= max_sz) {
1658            gdb_monitor_output(gdbserver_state, p, len);
1659            break;
1660        }
1661        gdb_monitor_output(gdbserver_state, p, max_sz);
1662        p += max_sz;
1663        len -= max_sz;
1664    }
1665    return len;
1666}
1667
1668#ifndef _WIN32
1669static void gdb_sigterm_handler(int signal)
1670{
1671    if (runstate_is_running()) {
1672        vm_stop(RUN_STATE_PAUSED);
1673    }
1674}
1675#endif
1676
1677int gdbserver_start(const char *device)
1678{
1679    GDBState *s;
1680    char gdbstub_device_name[128];
1681    CharDriverState *chr = NULL;
1682    CharDriverState *mon_chr;
1683
1684    if (!device)
1685        return -1;
1686    if (strcmp(device, "none") != 0) {
1687        if (strstart(device, "tcp:", NULL)) {
1688            /* enforce required TCP attributes */
1689            snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
1690                     "%s,nowait,nodelay,server", device);
1691            device = gdbstub_device_name;
1692        }
1693#ifndef _WIN32
1694        else if (strcmp(device, "stdio") == 0) {
1695            struct sigaction act;
1696
1697            memset(&act, 0, sizeof(act));
1698            act.sa_handler = gdb_sigterm_handler;
1699            sigaction(SIGINT, &act, NULL);
1700        }
1701#endif
1702        chr = qemu_chr_new("gdb", device, NULL);
1703        if (!chr)
1704            return -1;
1705
1706        qemu_chr_fe_claim_no_fail(chr);
1707        qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
1708                              gdb_chr_event, NULL);
1709    }
1710
1711    s = gdbserver_state;
1712    if (!s) {
1713        s = g_malloc0(sizeof(GDBState));
1714        gdbserver_state = s;
1715
1716        qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
1717
1718        /* Initialize a monitor terminal for gdb */
1719        mon_chr = g_malloc0(sizeof(*mon_chr));
1720        mon_chr->chr_write = gdb_monitor_write;
1721        monitor_init(mon_chr, 0);
1722    } else {
1723        if (s->chr)
1724            qemu_chr_delete(s->chr);
1725        mon_chr = s->mon_chr;
1726        memset(s, 0, sizeof(GDBState));
1727    }
1728    s->c_cpu = first_cpu;
1729    s->g_cpu = first_cpu;
1730    s->chr = chr;
1731    s->state = chr ? RS_IDLE : RS_INACTIVE;
1732    s->mon_chr = mon_chr;
1733    s->current_syscall_cb = NULL;
1734
1735    return 0;
1736}
1737#endif
1738