qemu/gdbstub.c
<<
>>
Prefs
   1/*
   2 * gdb server stub
   3 *
   4 * Copyright (c) 2003-2005 Fabrice Bellard
   5 *
   6 * This library is free software; you can redistribute it and/or
   7 * modify it under the terms of the GNU Lesser General Public
   8 * License as published by the Free Software Foundation; either
   9 * version 2 of the License, or (at your option) any later version.
  10 *
  11 * This library is distributed in the hope that it will be useful,
  12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14 * Lesser General Public License for more details.
  15 *
  16 * You should have received a copy of the GNU Lesser General Public
  17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18 */
  19#include "config.h"
  20#include "qemu-common.h"
  21#ifdef CONFIG_USER_ONLY
  22#include <stdlib.h>
  23#include <stdio.h>
  24#include <stdarg.h>
  25#include <string.h>
  26#include <errno.h>
  27#include <unistd.h>
  28#include <fcntl.h>
  29
  30#include "qemu.h"
  31#else
  32#include "monitor/monitor.h"
  33#include "sysemu/char.h"
  34#include "sysemu/sysemu.h"
  35#include "exec/gdbstub.h"
  36#endif
  37
  38#define MAX_PACKET_LENGTH 4096
  39
  40#include "cpu.h"
  41#include "qemu/sockets.h"
  42#include "sysemu/kvm.h"
  43#include "exec/semihost.h"
  44
  45#ifdef CONFIG_USER_ONLY
  46#define GDB_ATTACHED "0"
  47#else
  48#define GDB_ATTACHED "1"
  49#endif
  50
  51static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
  52                                         uint8_t *buf, int len, bool is_write)
  53{
  54    CPUClass *cc = CPU_GET_CLASS(cpu);
  55
  56    if (cc->memory_rw_debug) {
  57        return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
  58    }
  59    return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
  60}
  61
  62enum {
  63    GDB_SIGNAL_0 = 0,
  64    GDB_SIGNAL_INT = 2,
  65    GDB_SIGNAL_QUIT = 3,
  66    GDB_SIGNAL_TRAP = 5,
  67    GDB_SIGNAL_ABRT = 6,
  68    GDB_SIGNAL_ALRM = 14,
  69    GDB_SIGNAL_IO = 23,
  70    GDB_SIGNAL_XCPU = 24,
  71    GDB_SIGNAL_UNKNOWN = 143
  72};
  73
  74#ifdef CONFIG_USER_ONLY
  75
  76/* Map target signal numbers to GDB protocol signal numbers and vice
  77 * versa.  For user emulation's currently supported systems, we can
  78 * assume most signals are defined.
  79 */
  80
  81static int gdb_signal_table[] = {
  82    0,
  83    TARGET_SIGHUP,
  84    TARGET_SIGINT,
  85    TARGET_SIGQUIT,
  86    TARGET_SIGILL,
  87    TARGET_SIGTRAP,
  88    TARGET_SIGABRT,
  89    -1, /* SIGEMT */
  90    TARGET_SIGFPE,
  91    TARGET_SIGKILL,
  92    TARGET_SIGBUS,
  93    TARGET_SIGSEGV,
  94    TARGET_SIGSYS,
  95    TARGET_SIGPIPE,
  96    TARGET_SIGALRM,
  97    TARGET_SIGTERM,
  98    TARGET_SIGURG,
  99    TARGET_SIGSTOP,
 100    TARGET_SIGTSTP,
 101    TARGET_SIGCONT,
 102    TARGET_SIGCHLD,
 103    TARGET_SIGTTIN,
 104    TARGET_SIGTTOU,
 105    TARGET_SIGIO,
 106    TARGET_SIGXCPU,
 107    TARGET_SIGXFSZ,
 108    TARGET_SIGVTALRM,
 109    TARGET_SIGPROF,
 110    TARGET_SIGWINCH,
 111    -1, /* SIGLOST */
 112    TARGET_SIGUSR1,
 113    TARGET_SIGUSR2,
 114#ifdef TARGET_SIGPWR
 115    TARGET_SIGPWR,
 116#else
 117    -1,
 118#endif
 119    -1, /* SIGPOLL */
 120    -1,
 121    -1,
 122    -1,
 123    -1,
 124    -1,
 125    -1,
 126    -1,
 127    -1,
 128    -1,
 129    -1,
 130    -1,
 131#ifdef __SIGRTMIN
 132    __SIGRTMIN + 1,
 133    __SIGRTMIN + 2,
 134    __SIGRTMIN + 3,
 135    __SIGRTMIN + 4,
 136    __SIGRTMIN + 5,
 137    __SIGRTMIN + 6,
 138    __SIGRTMIN + 7,
 139    __SIGRTMIN + 8,
 140    __SIGRTMIN + 9,
 141    __SIGRTMIN + 10,
 142    __SIGRTMIN + 11,
 143    __SIGRTMIN + 12,
 144    __SIGRTMIN + 13,
 145    __SIGRTMIN + 14,
 146    __SIGRTMIN + 15,
 147    __SIGRTMIN + 16,
 148    __SIGRTMIN + 17,
 149    __SIGRTMIN + 18,
 150    __SIGRTMIN + 19,
 151    __SIGRTMIN + 20,
 152    __SIGRTMIN + 21,
 153    __SIGRTMIN + 22,
 154    __SIGRTMIN + 23,
 155    __SIGRTMIN + 24,
 156    __SIGRTMIN + 25,
 157    __SIGRTMIN + 26,
 158    __SIGRTMIN + 27,
 159    __SIGRTMIN + 28,
 160    __SIGRTMIN + 29,
 161    __SIGRTMIN + 30,
 162    __SIGRTMIN + 31,
 163    -1, /* SIGCANCEL */
 164    __SIGRTMIN,
 165    __SIGRTMIN + 32,
 166    __SIGRTMIN + 33,
 167    __SIGRTMIN + 34,
 168    __SIGRTMIN + 35,
 169    __SIGRTMIN + 36,
 170    __SIGRTMIN + 37,
 171    __SIGRTMIN + 38,
 172    __SIGRTMIN + 39,
 173    __SIGRTMIN + 40,
 174    __SIGRTMIN + 41,
 175    __SIGRTMIN + 42,
 176    __SIGRTMIN + 43,
 177    __SIGRTMIN + 44,
 178    __SIGRTMIN + 45,
 179    __SIGRTMIN + 46,
 180    __SIGRTMIN + 47,
 181    __SIGRTMIN + 48,
 182    __SIGRTMIN + 49,
 183    __SIGRTMIN + 50,
 184    __SIGRTMIN + 51,
 185    __SIGRTMIN + 52,
 186    __SIGRTMIN + 53,
 187    __SIGRTMIN + 54,
 188    __SIGRTMIN + 55,
 189    __SIGRTMIN + 56,
 190    __SIGRTMIN + 57,
 191    __SIGRTMIN + 58,
 192    __SIGRTMIN + 59,
 193    __SIGRTMIN + 60,
 194    __SIGRTMIN + 61,
 195    __SIGRTMIN + 62,
 196    __SIGRTMIN + 63,
 197    __SIGRTMIN + 64,
 198    __SIGRTMIN + 65,
 199    __SIGRTMIN + 66,
 200    __SIGRTMIN + 67,
 201    __SIGRTMIN + 68,
 202    __SIGRTMIN + 69,
 203    __SIGRTMIN + 70,
 204    __SIGRTMIN + 71,
 205    __SIGRTMIN + 72,
 206    __SIGRTMIN + 73,
 207    __SIGRTMIN + 74,
 208    __SIGRTMIN + 75,
 209    __SIGRTMIN + 76,
 210    __SIGRTMIN + 77,
 211    __SIGRTMIN + 78,
 212    __SIGRTMIN + 79,
 213    __SIGRTMIN + 80,
 214    __SIGRTMIN + 81,
 215    __SIGRTMIN + 82,
 216    __SIGRTMIN + 83,
 217    __SIGRTMIN + 84,
 218    __SIGRTMIN + 85,
 219    __SIGRTMIN + 86,
 220    __SIGRTMIN + 87,
 221    __SIGRTMIN + 88,
 222    __SIGRTMIN + 89,
 223    __SIGRTMIN + 90,
 224    __SIGRTMIN + 91,
 225    __SIGRTMIN + 92,
 226    __SIGRTMIN + 93,
 227    __SIGRTMIN + 94,
 228    __SIGRTMIN + 95,
 229    -1, /* SIGINFO */
 230    -1, /* UNKNOWN */
 231    -1, /* DEFAULT */
 232    -1,
 233    -1,
 234    -1,
 235    -1,
 236    -1,
 237    -1
 238#endif
 239};
 240#else
 241/* In system mode we only need SIGINT and SIGTRAP; other signals
 242   are not yet supported.  */
 243
 244enum {
 245    TARGET_SIGINT = 2,
 246    TARGET_SIGTRAP = 5
 247};
 248
 249static int gdb_signal_table[] = {
 250    -1,
 251    -1,
 252    TARGET_SIGINT,
 253    -1,
 254    -1,
 255    TARGET_SIGTRAP
 256};
 257#endif
 258
 259#ifdef CONFIG_USER_ONLY
 260static int target_signal_to_gdb (int sig)
 261{
 262    int i;
 263    for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 264        if (gdb_signal_table[i] == sig)
 265            return i;
 266    return GDB_SIGNAL_UNKNOWN;
 267}
 268#endif
 269
 270static int gdb_signal_to_target (int sig)
 271{
 272    if (sig < ARRAY_SIZE (gdb_signal_table))
 273        return gdb_signal_table[sig];
 274    else
 275        return -1;
 276}
 277
 278//#define DEBUG_GDB
 279
 280typedef struct GDBRegisterState {
 281    int base_reg;
 282    int num_regs;
 283    gdb_reg_cb get_reg;
 284    gdb_reg_cb set_reg;
 285    const char *xml;
 286    struct GDBRegisterState *next;
 287} GDBRegisterState;
 288
 289enum RSState {
 290    RS_INACTIVE,
 291    RS_IDLE,
 292    RS_GETLINE,
 293    RS_CHKSUM1,
 294    RS_CHKSUM2,
 295};
 296typedef struct GDBState {
 297    CPUState *c_cpu; /* current CPU for step/continue ops */
 298    CPUState *g_cpu; /* current CPU for other ops */
 299    CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 300    enum RSState state; /* parsing state */
 301    char line_buf[MAX_PACKET_LENGTH];
 302    int line_buf_index;
 303    int line_csum;
 304    uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 305    int last_packet_len;
 306    int signal;
 307#ifdef CONFIG_USER_ONLY
 308    int fd;
 309    int running_state;
 310#else
 311    CharDriverState *chr;
 312    CharDriverState *mon_chr;
 313#endif
 314    char syscall_buf[256];
 315    gdb_syscall_complete_cb current_syscall_cb;
 316} GDBState;
 317
 318/* By default use no IRQs and no timers while single stepping so as to
 319 * make single stepping like an ICE HW step.
 320 */
 321static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 322
 323static GDBState *gdbserver_state;
 324
 325bool gdb_has_xml;
 326
 327#ifdef CONFIG_USER_ONLY
 328/* XXX: This is not thread safe.  Do we care?  */
 329static int gdbserver_fd = -1;
 330
 331static int get_char(GDBState *s)
 332{
 333    uint8_t ch;
 334    int ret;
 335
 336    for(;;) {
 337        ret = qemu_recv(s->fd, &ch, 1, 0);
 338        if (ret < 0) {
 339            if (errno == ECONNRESET)
 340                s->fd = -1;
 341            if (errno != EINTR && errno != EAGAIN)
 342                return -1;
 343        } else if (ret == 0) {
 344            close(s->fd);
 345            s->fd = -1;
 346            return -1;
 347        } else {
 348            break;
 349        }
 350    }
 351    return ch;
 352}
 353#endif
 354
 355static enum {
 356    GDB_SYS_UNKNOWN,
 357    GDB_SYS_ENABLED,
 358    GDB_SYS_DISABLED,
 359} gdb_syscall_mode;
 360
 361/* Decide if either remote gdb syscalls or native file IO should be used. */
 362int use_gdb_syscalls(void)
 363{
 364    SemihostingTarget target = semihosting_get_target();
 365    if (target == SEMIHOSTING_TARGET_NATIVE) {
 366        /* -semihosting-config target=native */
 367        return false;
 368    } else if (target == SEMIHOSTING_TARGET_GDB) {
 369        /* -semihosting-config target=gdb */
 370        return true;
 371    }
 372
 373    /* -semihosting-config target=auto */
 374    /* On the first call check if gdb is connected and remember. */
 375    if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 376        gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 377                                            : GDB_SYS_DISABLED);
 378    }
 379    return gdb_syscall_mode == GDB_SYS_ENABLED;
 380}
 381
 382/* Resume execution.  */
 383static inline void gdb_continue(GDBState *s)
 384{
 385#ifdef CONFIG_USER_ONLY
 386    s->running_state = 1;
 387#else
 388    if (!runstate_needs_reset()) {
 389        vm_start();
 390    }
 391#endif
 392}
 393
 394static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 395{
 396#ifdef CONFIG_USER_ONLY
 397    int ret;
 398
 399    while (len > 0) {
 400        ret = send(s->fd, buf, len, 0);
 401        if (ret < 0) {
 402            if (errno != EINTR && errno != EAGAIN)
 403                return;
 404        } else {
 405            buf += ret;
 406            len -= ret;
 407        }
 408    }
 409#else
 410    qemu_chr_fe_write(s->chr, buf, len);
 411#endif
 412}
 413
 414static inline int fromhex(int v)
 415{
 416    if (v >= '0' && v <= '9')
 417        return v - '0';
 418    else if (v >= 'A' && v <= 'F')
 419        return v - 'A' + 10;
 420    else if (v >= 'a' && v <= 'f')
 421        return v - 'a' + 10;
 422    else
 423        return 0;
 424}
 425
 426static inline int tohex(int v)
 427{
 428    if (v < 10)
 429        return v + '0';
 430    else
 431        return v - 10 + 'a';
 432}
 433
 434static void memtohex(char *buf, const uint8_t *mem, int len)
 435{
 436    int i, c;
 437    char *q;
 438    q = buf;
 439    for(i = 0; i < len; i++) {
 440        c = mem[i];
 441        *q++ = tohex(c >> 4);
 442        *q++ = tohex(c & 0xf);
 443    }
 444    *q = '\0';
 445}
 446
 447static void hextomem(uint8_t *mem, const char *buf, int len)
 448{
 449    int i;
 450
 451    for(i = 0; i < len; i++) {
 452        mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 453        buf += 2;
 454    }
 455}
 456
 457/* return -1 if error, 0 if OK */
 458static int put_packet_binary(GDBState *s, const char *buf, int len)
 459{
 460    int csum, i;
 461    uint8_t *p;
 462
 463    for(;;) {
 464        p = s->last_packet;
 465        *(p++) = '$';
 466        memcpy(p, buf, len);
 467        p += len;
 468        csum = 0;
 469        for(i = 0; i < len; i++) {
 470            csum += buf[i];
 471        }
 472        *(p++) = '#';
 473        *(p++) = tohex((csum >> 4) & 0xf);
 474        *(p++) = tohex((csum) & 0xf);
 475
 476        s->last_packet_len = p - s->last_packet;
 477        put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 478
 479#ifdef CONFIG_USER_ONLY
 480        i = get_char(s);
 481        if (i < 0)
 482            return -1;
 483        if (i == '+')
 484            break;
 485#else
 486        break;
 487#endif
 488    }
 489    return 0;
 490}
 491
 492/* return -1 if error, 0 if OK */
 493static int put_packet(GDBState *s, const char *buf)
 494{
 495#ifdef DEBUG_GDB
 496    printf("reply='%s'\n", buf);
 497#endif
 498
 499    return put_packet_binary(s, buf, strlen(buf));
 500}
 501
 502/* Encode data using the encoding for 'x' packets.  */
 503static int memtox(char *buf, const char *mem, int len)
 504{
 505    char *p = buf;
 506    char c;
 507
 508    while (len--) {
 509        c = *(mem++);
 510        switch (c) {
 511        case '#': case '$': case '*': case '}':
 512            *(p++) = '}';
 513            *(p++) = c ^ 0x20;
 514            break;
 515        default:
 516            *(p++) = c;
 517            break;
 518        }
 519    }
 520    return p - buf;
 521}
 522
 523static const char *get_feature_xml(const char *p, const char **newp,
 524                                   CPUClass *cc)
 525{
 526    size_t len;
 527    int i;
 528    const char *name;
 529    static char target_xml[1024];
 530
 531    len = 0;
 532    while (p[len] && p[len] != ':')
 533        len++;
 534    *newp = p + len;
 535
 536    name = NULL;
 537    if (strncmp(p, "target.xml", len) == 0) {
 538        /* Generate the XML description for this CPU.  */
 539        if (!target_xml[0]) {
 540            GDBRegisterState *r;
 541            CPUState *cpu = first_cpu;
 542
 543            snprintf(target_xml, sizeof(target_xml),
 544                     "<?xml version=\"1.0\"?>"
 545                     "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
 546                     "<target>"
 547                     "<xi:include href=\"%s\"/>",
 548                     cc->gdb_core_xml_file);
 549
 550            for (r = cpu->gdb_regs; r; r = r->next) {
 551                pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
 552                pstrcat(target_xml, sizeof(target_xml), r->xml);
 553                pstrcat(target_xml, sizeof(target_xml), "\"/>");
 554            }
 555            pstrcat(target_xml, sizeof(target_xml), "</target>");
 556        }
 557        return target_xml;
 558    }
 559    for (i = 0; ; i++) {
 560        name = xml_builtin[i][0];
 561        if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
 562            break;
 563    }
 564    return name ? xml_builtin[i][1] : NULL;
 565}
 566
 567static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 568{
 569    CPUClass *cc = CPU_GET_CLASS(cpu);
 570    CPUArchState *env = cpu->env_ptr;
 571    GDBRegisterState *r;
 572
 573    if (reg < cc->gdb_num_core_regs) {
 574        return cc->gdb_read_register(cpu, mem_buf, reg);
 575    }
 576
 577    for (r = cpu->gdb_regs; r; r = r->next) {
 578        if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 579            return r->get_reg(env, mem_buf, reg - r->base_reg);
 580        }
 581    }
 582    return 0;
 583}
 584
 585static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 586{
 587    CPUClass *cc = CPU_GET_CLASS(cpu);
 588    CPUArchState *env = cpu->env_ptr;
 589    GDBRegisterState *r;
 590
 591    if (reg < cc->gdb_num_core_regs) {
 592        return cc->gdb_write_register(cpu, mem_buf, reg);
 593    }
 594
 595    for (r = cpu->gdb_regs; r; r = r->next) {
 596        if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 597            return r->set_reg(env, mem_buf, reg - r->base_reg);
 598        }
 599    }
 600    return 0;
 601}
 602
 603/* Register a supplemental set of CPU registers.  If g_pos is nonzero it
 604   specifies the first register number and these registers are included in
 605   a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
 606   gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
 607 */
 608
 609void gdb_register_coprocessor(CPUState *cpu,
 610                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
 611                              int num_regs, const char *xml, int g_pos)
 612{
 613    GDBRegisterState *s;
 614    GDBRegisterState **p;
 615
 616    p = &cpu->gdb_regs;
 617    while (*p) {
 618        /* Check for duplicates.  */
 619        if (strcmp((*p)->xml, xml) == 0)
 620            return;
 621        p = &(*p)->next;
 622    }
 623
 624    s = g_new0(GDBRegisterState, 1);
 625    s->base_reg = cpu->gdb_num_regs;
 626    s->num_regs = num_regs;
 627    s->get_reg = get_reg;
 628    s->set_reg = set_reg;
 629    s->xml = xml;
 630
 631    /* Add to end of list.  */
 632    cpu->gdb_num_regs += num_regs;
 633    *p = s;
 634    if (g_pos) {
 635        if (g_pos != s->base_reg) {
 636            fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
 637                    "Expected %d got %d\n", xml, g_pos, s->base_reg);
 638        } else {
 639            cpu->gdb_num_g_regs = cpu->gdb_num_regs;
 640        }
 641    }
 642}
 643
 644#ifndef CONFIG_USER_ONLY
 645/* Translate GDB watchpoint type to a flags value for cpu_watchpoint_* */
 646static inline int xlat_gdb_type(CPUState *cpu, int gdbtype)
 647{
 648    static const int xlat[] = {
 649        [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
 650        [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
 651        [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
 652    };
 653
 654    CPUClass *cc = CPU_GET_CLASS(cpu);
 655    int cputype = xlat[gdbtype];
 656
 657    if (cc->gdb_stop_before_watchpoint) {
 658        cputype |= BP_STOP_BEFORE_ACCESS;
 659    }
 660    return cputype;
 661}
 662#endif
 663
 664static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
 665{
 666    CPUState *cpu;
 667    int err = 0;
 668
 669    if (kvm_enabled()) {
 670        return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 671    }
 672
 673    switch (type) {
 674    case GDB_BREAKPOINT_SW:
 675    case GDB_BREAKPOINT_HW:
 676        CPU_FOREACH(cpu) {
 677            err = cpu_breakpoint_insert(cpu, addr, BP_GDB, NULL);
 678            if (err) {
 679                break;
 680            }
 681        }
 682        return err;
 683#ifndef CONFIG_USER_ONLY
 684    case GDB_WATCHPOINT_WRITE:
 685    case GDB_WATCHPOINT_READ:
 686    case GDB_WATCHPOINT_ACCESS:
 687        CPU_FOREACH(cpu) {
 688            err = cpu_watchpoint_insert(cpu, addr, len,
 689                                        xlat_gdb_type(cpu, type), NULL);
 690            if (err) {
 691                break;
 692            }
 693        }
 694        return err;
 695#endif
 696    default:
 697        return -ENOSYS;
 698    }
 699}
 700
 701static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
 702{
 703    CPUState *cpu;
 704    int err = 0;
 705
 706    if (kvm_enabled()) {
 707        return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 708    }
 709
 710    switch (type) {
 711    case GDB_BREAKPOINT_SW:
 712    case GDB_BREAKPOINT_HW:
 713        CPU_FOREACH(cpu) {
 714            err = cpu_breakpoint_remove(cpu, addr, BP_GDB);
 715            if (err) {
 716                break;
 717            }
 718        }
 719        return err;
 720#ifndef CONFIG_USER_ONLY
 721    case GDB_WATCHPOINT_WRITE:
 722    case GDB_WATCHPOINT_READ:
 723    case GDB_WATCHPOINT_ACCESS:
 724        CPU_FOREACH(cpu) {
 725            err = cpu_watchpoint_remove(cpu, addr, len,
 726                                        xlat_gdb_type(cpu, type));
 727            if (err)
 728                break;
 729        }
 730        return err;
 731#endif
 732    default:
 733        return -ENOSYS;
 734    }
 735}
 736
 737static void gdb_breakpoint_remove_all(void)
 738{
 739    CPUState *cpu;
 740
 741    if (kvm_enabled()) {
 742        kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
 743        return;
 744    }
 745
 746    CPU_FOREACH(cpu) {
 747        cpu_breakpoint_remove_all(cpu, BP_GDB);
 748#ifndef CONFIG_USER_ONLY
 749        cpu_watchpoint_remove_all(cpu, BP_GDB);
 750#endif
 751    }
 752}
 753
 754static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 755{
 756    CPUState *cpu = s->c_cpu;
 757
 758    cpu_synchronize_state(cpu);
 759    cpu_set_pc(cpu, pc);
 760}
 761
 762static CPUState *find_cpu(uint32_t thread_id)
 763{
 764    CPUState *cpu;
 765
 766    CPU_FOREACH(cpu) {
 767        if (cpu_index(cpu) == thread_id) {
 768            return cpu;
 769        }
 770    }
 771
 772    return NULL;
 773}
 774
 775static int is_query_packet(const char *p, const char *query, char separator)
 776{
 777    unsigned int query_len = strlen(query);
 778
 779    return strncmp(p, query, query_len) == 0 &&
 780        (p[query_len] == '\0' || p[query_len] == separator);
 781}
 782
 783static int gdb_handle_packet(GDBState *s, const char *line_buf)
 784{
 785    CPUState *cpu;
 786    CPUClass *cc;
 787    const char *p;
 788    uint32_t thread;
 789    int ch, reg_size, type, res;
 790    char buf[MAX_PACKET_LENGTH];
 791    uint8_t mem_buf[MAX_PACKET_LENGTH];
 792    uint8_t *registers;
 793    target_ulong addr, len;
 794
 795#ifdef DEBUG_GDB
 796    printf("command='%s'\n", line_buf);
 797#endif
 798    p = line_buf;
 799    ch = *p++;
 800    switch(ch) {
 801    case '?':
 802        /* TODO: Make this return the correct value for user-mode.  */
 803        snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
 804                 cpu_index(s->c_cpu));
 805        put_packet(s, buf);
 806        /* Remove all the breakpoints when this query is issued,
 807         * because gdb is doing and initial connect and the state
 808         * should be cleaned up.
 809         */
 810        gdb_breakpoint_remove_all();
 811        break;
 812    case 'c':
 813        if (*p != '\0') {
 814            addr = strtoull(p, (char **)&p, 16);
 815            gdb_set_cpu_pc(s, addr);
 816        }
 817        s->signal = 0;
 818        gdb_continue(s);
 819        return RS_IDLE;
 820    case 'C':
 821        s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
 822        if (s->signal == -1)
 823            s->signal = 0;
 824        gdb_continue(s);
 825        return RS_IDLE;
 826    case 'v':
 827        if (strncmp(p, "Cont", 4) == 0) {
 828            int res_signal, res_thread;
 829
 830            p += 4;
 831            if (*p == '?') {
 832                put_packet(s, "vCont;c;C;s;S");
 833                break;
 834            }
 835            res = 0;
 836            res_signal = 0;
 837            res_thread = 0;
 838            while (*p) {
 839                int action, signal;
 840
 841                if (*p++ != ';') {
 842                    res = 0;
 843                    break;
 844                }
 845                action = *p++;
 846                signal = 0;
 847                if (action == 'C' || action == 'S') {
 848                    signal = gdb_signal_to_target(strtoul(p, (char **)&p, 16));
 849                    if (signal == -1) {
 850                        signal = 0;
 851                    }
 852                } else if (action != 'c' && action != 's') {
 853                    res = 0;
 854                    break;
 855                }
 856                thread = 0;
 857                if (*p == ':') {
 858                    thread = strtoull(p+1, (char **)&p, 16);
 859                }
 860                action = tolower(action);
 861                if (res == 0 || (res == 'c' && action == 's')) {
 862                    res = action;
 863                    res_signal = signal;
 864                    res_thread = thread;
 865                }
 866            }
 867            if (res) {
 868                if (res_thread != -1 && res_thread != 0) {
 869                    cpu = find_cpu(res_thread);
 870                    if (cpu == NULL) {
 871                        put_packet(s, "E22");
 872                        break;
 873                    }
 874                    s->c_cpu = cpu;
 875                }
 876                if (res == 's') {
 877                    cpu_single_step(s->c_cpu, sstep_flags);
 878                }
 879                s->signal = res_signal;
 880                gdb_continue(s);
 881                return RS_IDLE;
 882            }
 883            break;
 884        } else {
 885            goto unknown_command;
 886        }
 887    case 'k':
 888        /* Kill the target */
 889        fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
 890        exit(0);
 891    case 'D':
 892        /* Detach packet */
 893        gdb_breakpoint_remove_all();
 894        gdb_syscall_mode = GDB_SYS_DISABLED;
 895        gdb_continue(s);
 896        put_packet(s, "OK");
 897        break;
 898    case 's':
 899        if (*p != '\0') {
 900            addr = strtoull(p, (char **)&p, 16);
 901            gdb_set_cpu_pc(s, addr);
 902        }
 903        cpu_single_step(s->c_cpu, sstep_flags);
 904        gdb_continue(s);
 905        return RS_IDLE;
 906    case 'F':
 907        {
 908            target_ulong ret;
 909            target_ulong err;
 910
 911            ret = strtoull(p, (char **)&p, 16);
 912            if (*p == ',') {
 913                p++;
 914                err = strtoull(p, (char **)&p, 16);
 915            } else {
 916                err = 0;
 917            }
 918            if (*p == ',')
 919                p++;
 920            type = *p;
 921            if (s->current_syscall_cb) {
 922                s->current_syscall_cb(s->c_cpu, ret, err);
 923                s->current_syscall_cb = NULL;
 924            }
 925            if (type == 'C') {
 926                put_packet(s, "T02");
 927            } else {
 928                gdb_continue(s);
 929            }
 930        }
 931        break;
 932    case 'g':
 933        cpu_synchronize_state(s->g_cpu);
 934        len = 0;
 935        for (addr = 0; addr < s->g_cpu->gdb_num_g_regs; addr++) {
 936            reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
 937            len += reg_size;
 938        }
 939        memtohex(buf, mem_buf, len);
 940        put_packet(s, buf);
 941        break;
 942    case 'G':
 943        cpu_synchronize_state(s->g_cpu);
 944        registers = mem_buf;
 945        len = strlen(p) / 2;
 946        hextomem((uint8_t *)registers, p, len);
 947        for (addr = 0; addr < s->g_cpu->gdb_num_g_regs && len > 0; addr++) {
 948            reg_size = gdb_write_register(s->g_cpu, registers, addr);
 949            len -= reg_size;
 950            registers += reg_size;
 951        }
 952        put_packet(s, "OK");
 953        break;
 954    case 'm':
 955        addr = strtoull(p, (char **)&p, 16);
 956        if (*p == ',')
 957            p++;
 958        len = strtoull(p, NULL, 16);
 959
 960        /* memtohex() doubles the required space */
 961        if (len > MAX_PACKET_LENGTH / 2) {
 962            put_packet (s, "E22");
 963            break;
 964        }
 965
 966        if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
 967            put_packet (s, "E14");
 968        } else {
 969            memtohex(buf, mem_buf, len);
 970            put_packet(s, buf);
 971        }
 972        break;
 973    case 'M':
 974        addr = strtoull(p, (char **)&p, 16);
 975        if (*p == ',')
 976            p++;
 977        len = strtoull(p, (char **)&p, 16);
 978        if (*p == ':')
 979            p++;
 980
 981        /* hextomem() reads 2*len bytes */
 982        if (len > strlen(p) / 2) {
 983            put_packet (s, "E22");
 984            break;
 985        }
 986        hextomem(mem_buf, p, len);
 987        if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
 988                                   true) != 0) {
 989            put_packet(s, "E14");
 990        } else {
 991            put_packet(s, "OK");
 992        }
 993        break;
 994    case 'p':
 995        /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
 996           This works, but can be very slow.  Anything new enough to
 997           understand XML also knows how to use this properly.  */
 998        if (!gdb_has_xml)
 999            goto unknown_command;
1000        addr = strtoull(p, (char **)&p, 16);
1001        reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1002        if (reg_size) {
1003            memtohex(buf, mem_buf, reg_size);
1004            put_packet(s, buf);
1005        } else {
1006            put_packet(s, "E14");
1007        }
1008        break;
1009    case 'P':
1010        if (!gdb_has_xml)
1011            goto unknown_command;
1012        addr = strtoull(p, (char **)&p, 16);
1013        if (*p == '=')
1014            p++;
1015        reg_size = strlen(p) / 2;
1016        hextomem(mem_buf, p, reg_size);
1017        gdb_write_register(s->g_cpu, mem_buf, addr);
1018        put_packet(s, "OK");
1019        break;
1020    case 'Z':
1021    case 'z':
1022        type = strtoul(p, (char **)&p, 16);
1023        if (*p == ',')
1024            p++;
1025        addr = strtoull(p, (char **)&p, 16);
1026        if (*p == ',')
1027            p++;
1028        len = strtoull(p, (char **)&p, 16);
1029        if (ch == 'Z')
1030            res = gdb_breakpoint_insert(addr, len, type);
1031        else
1032            res = gdb_breakpoint_remove(addr, len, type);
1033        if (res >= 0)
1034             put_packet(s, "OK");
1035        else if (res == -ENOSYS)
1036            put_packet(s, "");
1037        else
1038            put_packet(s, "E22");
1039        break;
1040    case 'H':
1041        type = *p++;
1042        thread = strtoull(p, (char **)&p, 16);
1043        if (thread == -1 || thread == 0) {
1044            put_packet(s, "OK");
1045            break;
1046        }
1047        cpu = find_cpu(thread);
1048        if (cpu == NULL) {
1049            put_packet(s, "E22");
1050            break;
1051        }
1052        switch (type) {
1053        case 'c':
1054            s->c_cpu = cpu;
1055            put_packet(s, "OK");
1056            break;
1057        case 'g':
1058            s->g_cpu = cpu;
1059            put_packet(s, "OK");
1060            break;
1061        default:
1062             put_packet(s, "E22");
1063             break;
1064        }
1065        break;
1066    case 'T':
1067        thread = strtoull(p, (char **)&p, 16);
1068        cpu = find_cpu(thread);
1069
1070        if (cpu != NULL) {
1071            put_packet(s, "OK");
1072        } else {
1073            put_packet(s, "E22");
1074        }
1075        break;
1076    case 'q':
1077    case 'Q':
1078        /* parse any 'q' packets here */
1079        if (!strcmp(p,"qemu.sstepbits")) {
1080            /* Query Breakpoint bit definitions */
1081            snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1082                     SSTEP_ENABLE,
1083                     SSTEP_NOIRQ,
1084                     SSTEP_NOTIMER);
1085            put_packet(s, buf);
1086            break;
1087        } else if (is_query_packet(p, "qemu.sstep", '=')) {
1088            /* Display or change the sstep_flags */
1089            p += 10;
1090            if (*p != '=') {
1091                /* Display current setting */
1092                snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1093                put_packet(s, buf);
1094                break;
1095            }
1096            p++;
1097            type = strtoul(p, (char **)&p, 16);
1098            sstep_flags = type;
1099            put_packet(s, "OK");
1100            break;
1101        } else if (strcmp(p,"C") == 0) {
1102            /* "Current thread" remains vague in the spec, so always return
1103             *  the first CPU (gdb returns the first thread). */
1104            put_packet(s, "QC1");
1105            break;
1106        } else if (strcmp(p,"fThreadInfo") == 0) {
1107            s->query_cpu = first_cpu;
1108            goto report_cpuinfo;
1109        } else if (strcmp(p,"sThreadInfo") == 0) {
1110        report_cpuinfo:
1111            if (s->query_cpu) {
1112                snprintf(buf, sizeof(buf), "m%x", cpu_index(s->query_cpu));
1113                put_packet(s, buf);
1114                s->query_cpu = CPU_NEXT(s->query_cpu);
1115            } else
1116                put_packet(s, "l");
1117            break;
1118        } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1119            thread = strtoull(p+16, (char **)&p, 16);
1120            cpu = find_cpu(thread);
1121            if (cpu != NULL) {
1122                cpu_synchronize_state(cpu);
1123                /* memtohex() doubles the required space */
1124                len = snprintf((char *)mem_buf, sizeof(buf) / 2,
1125                               "CPU#%d [%s]", cpu->cpu_index,
1126                               cpu->halted ? "halted " : "running");
1127                memtohex(buf, mem_buf, len);
1128                put_packet(s, buf);
1129            }
1130            break;
1131        }
1132#ifdef CONFIG_USER_ONLY
1133        else if (strcmp(p, "Offsets") == 0) {
1134            TaskState *ts = s->c_cpu->opaque;
1135
1136            snprintf(buf, sizeof(buf),
1137                     "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1138                     ";Bss=" TARGET_ABI_FMT_lx,
1139                     ts->info->code_offset,
1140                     ts->info->data_offset,
1141                     ts->info->data_offset);
1142            put_packet(s, buf);
1143            break;
1144        }
1145#else /* !CONFIG_USER_ONLY */
1146        else if (strncmp(p, "Rcmd,", 5) == 0) {
1147            int len = strlen(p + 5);
1148
1149            if ((len % 2) != 0) {
1150                put_packet(s, "E01");
1151                break;
1152            }
1153            len = len / 2;
1154            hextomem(mem_buf, p + 5, len);
1155            mem_buf[len++] = 0;
1156            qemu_chr_be_write(s->mon_chr, mem_buf, len);
1157            put_packet(s, "OK");
1158            break;
1159        }
1160#endif /* !CONFIG_USER_ONLY */
1161        if (is_query_packet(p, "Supported", ':')) {
1162            snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1163            cc = CPU_GET_CLASS(first_cpu);
1164            if (cc->gdb_core_xml_file != NULL) {
1165                pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1166            }
1167            put_packet(s, buf);
1168            break;
1169        }
1170        if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1171            const char *xml;
1172            target_ulong total_len;
1173
1174            cc = CPU_GET_CLASS(first_cpu);
1175            if (cc->gdb_core_xml_file == NULL) {
1176                goto unknown_command;
1177            }
1178
1179            gdb_has_xml = true;
1180            p += 19;
1181            xml = get_feature_xml(p, &p, cc);
1182            if (!xml) {
1183                snprintf(buf, sizeof(buf), "E00");
1184                put_packet(s, buf);
1185                break;
1186            }
1187
1188            if (*p == ':')
1189                p++;
1190            addr = strtoul(p, (char **)&p, 16);
1191            if (*p == ',')
1192                p++;
1193            len = strtoul(p, (char **)&p, 16);
1194
1195            total_len = strlen(xml);
1196            if (addr > total_len) {
1197                snprintf(buf, sizeof(buf), "E00");
1198                put_packet(s, buf);
1199                break;
1200            }
1201            if (len > (MAX_PACKET_LENGTH - 5) / 2)
1202                len = (MAX_PACKET_LENGTH - 5) / 2;
1203            if (len < total_len - addr) {
1204                buf[0] = 'm';
1205                len = memtox(buf + 1, xml + addr, len);
1206            } else {
1207                buf[0] = 'l';
1208                len = memtox(buf + 1, xml + addr, total_len - addr);
1209            }
1210            put_packet_binary(s, buf, len + 1);
1211            break;
1212        }
1213        if (is_query_packet(p, "Attached", ':')) {
1214            put_packet(s, GDB_ATTACHED);
1215            break;
1216        }
1217        /* Unrecognised 'q' command.  */
1218        goto unknown_command;
1219
1220    default:
1221    unknown_command:
1222        /* put empty packet */
1223        buf[0] = '\0';
1224        put_packet(s, buf);
1225        break;
1226    }
1227    return RS_IDLE;
1228}
1229
1230void gdb_set_stop_cpu(CPUState *cpu)
1231{
1232    gdbserver_state->c_cpu = cpu;
1233    gdbserver_state->g_cpu = cpu;
1234}
1235
1236#ifndef CONFIG_USER_ONLY
1237static void gdb_vm_state_change(void *opaque, int running, RunState state)
1238{
1239    GDBState *s = gdbserver_state;
1240    CPUState *cpu = s->c_cpu;
1241    char buf[256];
1242    const char *type;
1243    int ret;
1244
1245    if (running || s->state == RS_INACTIVE) {
1246        return;
1247    }
1248    /* Is there a GDB syscall waiting to be sent?  */
1249    if (s->current_syscall_cb) {
1250        put_packet(s, s->syscall_buf);
1251        return;
1252    }
1253    switch (state) {
1254    case RUN_STATE_DEBUG:
1255        if (cpu->watchpoint_hit) {
1256            switch (cpu->watchpoint_hit->flags & BP_MEM_ACCESS) {
1257            case BP_MEM_READ:
1258                type = "r";
1259                break;
1260            case BP_MEM_ACCESS:
1261                type = "a";
1262                break;
1263            default:
1264                type = "";
1265                break;
1266            }
1267            snprintf(buf, sizeof(buf),
1268                     "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1269                     GDB_SIGNAL_TRAP, cpu_index(cpu), type,
1270                     (target_ulong)cpu->watchpoint_hit->vaddr);
1271            cpu->watchpoint_hit = NULL;
1272            goto send_packet;
1273        }
1274        tb_flush(cpu);
1275        ret = GDB_SIGNAL_TRAP;
1276        break;
1277    case RUN_STATE_PAUSED:
1278        ret = GDB_SIGNAL_INT;
1279        break;
1280    case RUN_STATE_SHUTDOWN:
1281        ret = GDB_SIGNAL_QUIT;
1282        break;
1283    case RUN_STATE_IO_ERROR:
1284        ret = GDB_SIGNAL_IO;
1285        break;
1286    case RUN_STATE_WATCHDOG:
1287        ret = GDB_SIGNAL_ALRM;
1288        break;
1289    case RUN_STATE_INTERNAL_ERROR:
1290        ret = GDB_SIGNAL_ABRT;
1291        break;
1292    case RUN_STATE_SAVE_VM:
1293    case RUN_STATE_RESTORE_VM:
1294        return;
1295    case RUN_STATE_FINISH_MIGRATE:
1296        ret = GDB_SIGNAL_XCPU;
1297        break;
1298    default:
1299        ret = GDB_SIGNAL_UNKNOWN;
1300        break;
1301    }
1302    gdb_set_stop_cpu(cpu);
1303    snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, cpu_index(cpu));
1304
1305send_packet:
1306    put_packet(s, buf);
1307
1308    /* disable single step if it was enabled */
1309    cpu_single_step(cpu, 0);
1310}
1311#endif
1312
1313/* Send a gdb syscall request.
1314   This accepts limited printf-style format specifiers, specifically:
1315    %x  - target_ulong argument printed in hex.
1316    %lx - 64-bit argument printed in hex.
1317    %s  - string pointer (target_ulong) and length (int) pair.  */
1318void gdb_do_syscallv(gdb_syscall_complete_cb cb, const char *fmt, va_list va)
1319{
1320    char *p;
1321    char *p_end;
1322    target_ulong addr;
1323    uint64_t i64;
1324    GDBState *s;
1325
1326    s = gdbserver_state;
1327    if (!s)
1328        return;
1329    s->current_syscall_cb = cb;
1330#ifndef CONFIG_USER_ONLY
1331    vm_stop(RUN_STATE_DEBUG);
1332#endif
1333    p = s->syscall_buf;
1334    p_end = &s->syscall_buf[sizeof(s->syscall_buf)];
1335    *(p++) = 'F';
1336    while (*fmt) {
1337        if (*fmt == '%') {
1338            fmt++;
1339            switch (*fmt++) {
1340            case 'x':
1341                addr = va_arg(va, target_ulong);
1342                p += snprintf(p, p_end - p, TARGET_FMT_lx, addr);
1343                break;
1344            case 'l':
1345                if (*(fmt++) != 'x')
1346                    goto bad_format;
1347                i64 = va_arg(va, uint64_t);
1348                p += snprintf(p, p_end - p, "%" PRIx64, i64);
1349                break;
1350            case 's':
1351                addr = va_arg(va, target_ulong);
1352                p += snprintf(p, p_end - p, TARGET_FMT_lx "/%x",
1353                              addr, va_arg(va, int));
1354                break;
1355            default:
1356            bad_format:
1357                fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
1358                        fmt - 1);
1359                break;
1360            }
1361        } else {
1362            *(p++) = *(fmt++);
1363        }
1364    }
1365    *p = 0;
1366#ifdef CONFIG_USER_ONLY
1367    put_packet(s, s->syscall_buf);
1368    gdb_handlesig(s->c_cpu, 0);
1369#else
1370    /* In this case wait to send the syscall packet until notification that
1371       the CPU has stopped.  This must be done because if the packet is sent
1372       now the reply from the syscall request could be received while the CPU
1373       is still in the running state, which can cause packets to be dropped
1374       and state transition 'T' packets to be sent while the syscall is still
1375       being processed.  */
1376    qemu_cpu_kick(s->c_cpu);
1377#endif
1378}
1379
1380void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1381{
1382    va_list va;
1383
1384    va_start(va, fmt);
1385    gdb_do_syscallv(cb, fmt, va);
1386    va_end(va);
1387}
1388
1389static void gdb_read_byte(GDBState *s, int ch)
1390{
1391    int i, csum;
1392    uint8_t reply;
1393
1394#ifndef CONFIG_USER_ONLY
1395    if (s->last_packet_len) {
1396        /* Waiting for a response to the last packet.  If we see the start
1397           of a new command then abandon the previous response.  */
1398        if (ch == '-') {
1399#ifdef DEBUG_GDB
1400            printf("Got NACK, retransmitting\n");
1401#endif
1402            put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
1403        }
1404#ifdef DEBUG_GDB
1405        else if (ch == '+')
1406            printf("Got ACK\n");
1407        else
1408            printf("Got '%c' when expecting ACK/NACK\n", ch);
1409#endif
1410        if (ch == '+' || ch == '$')
1411            s->last_packet_len = 0;
1412        if (ch != '$')
1413            return;
1414    }
1415    if (runstate_is_running()) {
1416        /* when the CPU is running, we cannot do anything except stop
1417           it when receiving a char */
1418        vm_stop(RUN_STATE_PAUSED);
1419    } else
1420#endif
1421    {
1422        switch(s->state) {
1423        case RS_IDLE:
1424            if (ch == '$') {
1425                s->line_buf_index = 0;
1426                s->state = RS_GETLINE;
1427            }
1428            break;
1429        case RS_GETLINE:
1430            if (ch == '#') {
1431            s->state = RS_CHKSUM1;
1432            } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1433                s->state = RS_IDLE;
1434            } else {
1435            s->line_buf[s->line_buf_index++] = ch;
1436            }
1437            break;
1438        case RS_CHKSUM1:
1439            s->line_buf[s->line_buf_index] = '\0';
1440            s->line_csum = fromhex(ch) << 4;
1441            s->state = RS_CHKSUM2;
1442            break;
1443        case RS_CHKSUM2:
1444            s->line_csum |= fromhex(ch);
1445            csum = 0;
1446            for(i = 0; i < s->line_buf_index; i++) {
1447                csum += s->line_buf[i];
1448            }
1449            if (s->line_csum != (csum & 0xff)) {
1450                reply = '-';
1451                put_buffer(s, &reply, 1);
1452                s->state = RS_IDLE;
1453            } else {
1454                reply = '+';
1455                put_buffer(s, &reply, 1);
1456                s->state = gdb_handle_packet(s, s->line_buf);
1457            }
1458            break;
1459        default:
1460            abort();
1461        }
1462    }
1463}
1464
1465/* Tell the remote gdb that the process has exited.  */
1466void gdb_exit(CPUArchState *env, int code)
1467{
1468  GDBState *s;
1469  char buf[4];
1470
1471  s = gdbserver_state;
1472  if (!s) {
1473      return;
1474  }
1475#ifdef CONFIG_USER_ONLY
1476  if (gdbserver_fd < 0 || s->fd < 0) {
1477      return;
1478  }
1479#else
1480  if (!s->chr) {
1481      return;
1482  }
1483#endif
1484
1485  snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
1486  put_packet(s, buf);
1487
1488#ifndef CONFIG_USER_ONLY
1489  qemu_chr_delete(s->chr);
1490#endif
1491}
1492
1493#ifdef CONFIG_USER_ONLY
1494int
1495gdb_queuesig (void)
1496{
1497    GDBState *s;
1498
1499    s = gdbserver_state;
1500
1501    if (gdbserver_fd < 0 || s->fd < 0)
1502        return 0;
1503    else
1504        return 1;
1505}
1506
1507int
1508gdb_handlesig(CPUState *cpu, int sig)
1509{
1510    GDBState *s;
1511    char buf[256];
1512    int n;
1513
1514    s = gdbserver_state;
1515    if (gdbserver_fd < 0 || s->fd < 0) {
1516        return sig;
1517    }
1518
1519    /* disable single step if it was enabled */
1520    cpu_single_step(cpu, 0);
1521    tb_flush(cpu);
1522
1523    if (sig != 0) {
1524        snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));
1525        put_packet(s, buf);
1526    }
1527    /* put_packet() might have detected that the peer terminated the
1528       connection.  */
1529    if (s->fd < 0) {
1530        return sig;
1531    }
1532
1533    sig = 0;
1534    s->state = RS_IDLE;
1535    s->running_state = 0;
1536    while (s->running_state == 0) {
1537        n = read(s->fd, buf, 256);
1538        if (n > 0) {
1539            int i;
1540
1541            for (i = 0; i < n; i++) {
1542                gdb_read_byte(s, buf[i]);
1543            }
1544        } else if (n == 0 || errno != EAGAIN) {
1545            /* XXX: Connection closed.  Should probably wait for another
1546               connection before continuing.  */
1547            return sig;
1548        }
1549    }
1550    sig = s->signal;
1551    s->signal = 0;
1552    return sig;
1553}
1554
1555/* Tell the remote gdb that the process has exited due to SIG.  */
1556void gdb_signalled(CPUArchState *env, int sig)
1557{
1558    GDBState *s;
1559    char buf[4];
1560
1561    s = gdbserver_state;
1562    if (gdbserver_fd < 0 || s->fd < 0) {
1563        return;
1564    }
1565
1566    snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb(sig));
1567    put_packet(s, buf);
1568}
1569
1570static void gdb_accept(void)
1571{
1572    GDBState *s;
1573    struct sockaddr_in sockaddr;
1574    socklen_t len;
1575    int fd;
1576
1577    for(;;) {
1578        len = sizeof(sockaddr);
1579        fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
1580        if (fd < 0 && errno != EINTR) {
1581            perror("accept");
1582            return;
1583        } else if (fd >= 0) {
1584#ifndef _WIN32
1585            fcntl(fd, F_SETFD, FD_CLOEXEC);
1586#endif
1587            break;
1588        }
1589    }
1590
1591    /* set short latency */
1592    socket_set_nodelay(fd);
1593
1594    s = g_malloc0(sizeof(GDBState));
1595    s->c_cpu = first_cpu;
1596    s->g_cpu = first_cpu;
1597    s->fd = fd;
1598    gdb_has_xml = false;
1599
1600    gdbserver_state = s;
1601
1602    fcntl(fd, F_SETFL, O_NONBLOCK);
1603}
1604
1605static int gdbserver_open(int port)
1606{
1607    struct sockaddr_in sockaddr;
1608    int fd, ret;
1609
1610    fd = socket(PF_INET, SOCK_STREAM, 0);
1611    if (fd < 0) {
1612        perror("socket");
1613        return -1;
1614    }
1615#ifndef _WIN32
1616    fcntl(fd, F_SETFD, FD_CLOEXEC);
1617#endif
1618
1619    socket_set_fast_reuse(fd);
1620
1621    sockaddr.sin_family = AF_INET;
1622    sockaddr.sin_port = htons(port);
1623    sockaddr.sin_addr.s_addr = 0;
1624    ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
1625    if (ret < 0) {
1626        perror("bind");
1627        close(fd);
1628        return -1;
1629    }
1630    ret = listen(fd, 0);
1631    if (ret < 0) {
1632        perror("listen");
1633        close(fd);
1634        return -1;
1635    }
1636    return fd;
1637}
1638
1639int gdbserver_start(int port)
1640{
1641    gdbserver_fd = gdbserver_open(port);
1642    if (gdbserver_fd < 0)
1643        return -1;
1644    /* accept connections */
1645    gdb_accept();
1646    return 0;
1647}
1648
1649/* Disable gdb stub for child processes.  */
1650void gdbserver_fork(CPUState *cpu)
1651{
1652    GDBState *s = gdbserver_state;
1653
1654    if (gdbserver_fd < 0 || s->fd < 0) {
1655        return;
1656    }
1657    close(s->fd);
1658    s->fd = -1;
1659    cpu_breakpoint_remove_all(cpu, BP_GDB);
1660    cpu_watchpoint_remove_all(cpu, BP_GDB);
1661}
1662#else
1663static int gdb_chr_can_receive(void *opaque)
1664{
1665  /* We can handle an arbitrarily large amount of data.
1666   Pick the maximum packet size, which is as good as anything.  */
1667  return MAX_PACKET_LENGTH;
1668}
1669
1670static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
1671{
1672    int i;
1673
1674    for (i = 0; i < size; i++) {
1675        gdb_read_byte(gdbserver_state, buf[i]);
1676    }
1677}
1678
1679static void gdb_chr_event(void *opaque, int event)
1680{
1681    switch (event) {
1682    case CHR_EVENT_OPENED:
1683        vm_stop(RUN_STATE_PAUSED);
1684        gdb_has_xml = false;
1685        break;
1686    default:
1687        break;
1688    }
1689}
1690
1691static void gdb_monitor_output(GDBState *s, const char *msg, int len)
1692{
1693    char buf[MAX_PACKET_LENGTH];
1694
1695    buf[0] = 'O';
1696    if (len > (MAX_PACKET_LENGTH/2) - 1)
1697        len = (MAX_PACKET_LENGTH/2) - 1;
1698    memtohex(buf + 1, (uint8_t *)msg, len);
1699    put_packet(s, buf);
1700}
1701
1702static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
1703{
1704    const char *p = (const char *)buf;
1705    int max_sz;
1706
1707    max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
1708    for (;;) {
1709        if (len <= max_sz) {
1710            gdb_monitor_output(gdbserver_state, p, len);
1711            break;
1712        }
1713        gdb_monitor_output(gdbserver_state, p, max_sz);
1714        p += max_sz;
1715        len -= max_sz;
1716    }
1717    return len;
1718}
1719
1720#ifndef _WIN32
1721static void gdb_sigterm_handler(int signal)
1722{
1723    if (runstate_is_running()) {
1724        vm_stop(RUN_STATE_PAUSED);
1725    }
1726}
1727#endif
1728
1729int gdbserver_start(const char *device)
1730{
1731    GDBState *s;
1732    char gdbstub_device_name[128];
1733    CharDriverState *chr = NULL;
1734    CharDriverState *mon_chr;
1735
1736    if (!device)
1737        return -1;
1738    if (strcmp(device, "none") != 0) {
1739        if (strstart(device, "tcp:", NULL)) {
1740            /* enforce required TCP attributes */
1741            snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
1742                     "%s,nowait,nodelay,server", device);
1743            device = gdbstub_device_name;
1744        }
1745#ifndef _WIN32
1746        else if (strcmp(device, "stdio") == 0) {
1747            struct sigaction act;
1748
1749            memset(&act, 0, sizeof(act));
1750            act.sa_handler = gdb_sigterm_handler;
1751            sigaction(SIGINT, &act, NULL);
1752        }
1753#endif
1754        chr = qemu_chr_new("gdb", device, NULL);
1755        if (!chr)
1756            return -1;
1757
1758        qemu_chr_fe_claim_no_fail(chr);
1759        qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
1760                              gdb_chr_event, NULL);
1761    }
1762
1763    s = gdbserver_state;
1764    if (!s) {
1765        s = g_malloc0(sizeof(GDBState));
1766        gdbserver_state = s;
1767
1768        qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
1769
1770        /* Initialize a monitor terminal for gdb */
1771        mon_chr = qemu_chr_alloc();
1772        mon_chr->chr_write = gdb_monitor_write;
1773        monitor_init(mon_chr, 0);
1774    } else {
1775        if (s->chr)
1776            qemu_chr_delete(s->chr);
1777        mon_chr = s->mon_chr;
1778        memset(s, 0, sizeof(GDBState));
1779    }
1780    s->c_cpu = first_cpu;
1781    s->g_cpu = first_cpu;
1782    s->chr = chr;
1783    s->state = chr ? RS_IDLE : RS_INACTIVE;
1784    s->mon_chr = mon_chr;
1785    s->current_syscall_cb = NULL;
1786
1787    return 0;
1788}
1789#endif
1790