qemu/gdbstub.c
<<
>>
Prefs
   1/*
   2 * gdb server stub
   3 *
   4 * Copyright (c) 2003-2005 Fabrice Bellard
   5 *
   6 * This library is free software; you can redistribute it and/or
   7 * modify it under the terms of the GNU Lesser General Public
   8 * License as published by the Free Software Foundation; either
   9 * version 2 of the License, or (at your option) any later version.
  10 *
  11 * This library is distributed in the hope that it will be useful,
  12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14 * Lesser General Public License for more details.
  15 *
  16 * You should have received a copy of the GNU Lesser General Public
  17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18 */
  19#include "qemu/osdep.h"
  20#include "qapi/error.h"
  21#include "qemu/cutils.h"
  22
  23#ifdef CONFIG_USER_ONLY
  24#include "qemu.h"
  25#else
  26#include "monitor/monitor.h"
  27#include "sysemu/char.h"
  28#include "sysemu/sysemu.h"
  29#include "exec/gdbstub.h"
  30#endif
  31
  32#define MAX_PACKET_LENGTH 4096
  33
  34#include "cpu.h"
  35#include "qemu/sockets.h"
  36#include "sysemu/kvm.h"
  37#include "exec/semihost.h"
  38
  39#ifdef CONFIG_USER_ONLY
  40#define GDB_ATTACHED "0"
  41#else
  42#define GDB_ATTACHED "1"
  43#endif
  44
  45static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
  46                                         uint8_t *buf, int len, bool is_write)
  47{
  48    CPUClass *cc = CPU_GET_CLASS(cpu);
  49
  50    if (cc->memory_rw_debug) {
  51        return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
  52    }
  53    return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
  54}
  55
  56enum {
  57    GDB_SIGNAL_0 = 0,
  58    GDB_SIGNAL_INT = 2,
  59    GDB_SIGNAL_QUIT = 3,
  60    GDB_SIGNAL_TRAP = 5,
  61    GDB_SIGNAL_ABRT = 6,
  62    GDB_SIGNAL_ALRM = 14,
  63    GDB_SIGNAL_IO = 23,
  64    GDB_SIGNAL_XCPU = 24,
  65    GDB_SIGNAL_UNKNOWN = 143
  66};
  67
  68#ifdef CONFIG_USER_ONLY
  69
  70/* Map target signal numbers to GDB protocol signal numbers and vice
  71 * versa.  For user emulation's currently supported systems, we can
  72 * assume most signals are defined.
  73 */
  74
  75static int gdb_signal_table[] = {
  76    0,
  77    TARGET_SIGHUP,
  78    TARGET_SIGINT,
  79    TARGET_SIGQUIT,
  80    TARGET_SIGILL,
  81    TARGET_SIGTRAP,
  82    TARGET_SIGABRT,
  83    -1, /* SIGEMT */
  84    TARGET_SIGFPE,
  85    TARGET_SIGKILL,
  86    TARGET_SIGBUS,
  87    TARGET_SIGSEGV,
  88    TARGET_SIGSYS,
  89    TARGET_SIGPIPE,
  90    TARGET_SIGALRM,
  91    TARGET_SIGTERM,
  92    TARGET_SIGURG,
  93    TARGET_SIGSTOP,
  94    TARGET_SIGTSTP,
  95    TARGET_SIGCONT,
  96    TARGET_SIGCHLD,
  97    TARGET_SIGTTIN,
  98    TARGET_SIGTTOU,
  99    TARGET_SIGIO,
 100    TARGET_SIGXCPU,
 101    TARGET_SIGXFSZ,
 102    TARGET_SIGVTALRM,
 103    TARGET_SIGPROF,
 104    TARGET_SIGWINCH,
 105    -1, /* SIGLOST */
 106    TARGET_SIGUSR1,
 107    TARGET_SIGUSR2,
 108#ifdef TARGET_SIGPWR
 109    TARGET_SIGPWR,
 110#else
 111    -1,
 112#endif
 113    -1, /* SIGPOLL */
 114    -1,
 115    -1,
 116    -1,
 117    -1,
 118    -1,
 119    -1,
 120    -1,
 121    -1,
 122    -1,
 123    -1,
 124    -1,
 125#ifdef __SIGRTMIN
 126    __SIGRTMIN + 1,
 127    __SIGRTMIN + 2,
 128    __SIGRTMIN + 3,
 129    __SIGRTMIN + 4,
 130    __SIGRTMIN + 5,
 131    __SIGRTMIN + 6,
 132    __SIGRTMIN + 7,
 133    __SIGRTMIN + 8,
 134    __SIGRTMIN + 9,
 135    __SIGRTMIN + 10,
 136    __SIGRTMIN + 11,
 137    __SIGRTMIN + 12,
 138    __SIGRTMIN + 13,
 139    __SIGRTMIN + 14,
 140    __SIGRTMIN + 15,
 141    __SIGRTMIN + 16,
 142    __SIGRTMIN + 17,
 143    __SIGRTMIN + 18,
 144    __SIGRTMIN + 19,
 145    __SIGRTMIN + 20,
 146    __SIGRTMIN + 21,
 147    __SIGRTMIN + 22,
 148    __SIGRTMIN + 23,
 149    __SIGRTMIN + 24,
 150    __SIGRTMIN + 25,
 151    __SIGRTMIN + 26,
 152    __SIGRTMIN + 27,
 153    __SIGRTMIN + 28,
 154    __SIGRTMIN + 29,
 155    __SIGRTMIN + 30,
 156    __SIGRTMIN + 31,
 157    -1, /* SIGCANCEL */
 158    __SIGRTMIN,
 159    __SIGRTMIN + 32,
 160    __SIGRTMIN + 33,
 161    __SIGRTMIN + 34,
 162    __SIGRTMIN + 35,
 163    __SIGRTMIN + 36,
 164    __SIGRTMIN + 37,
 165    __SIGRTMIN + 38,
 166    __SIGRTMIN + 39,
 167    __SIGRTMIN + 40,
 168    __SIGRTMIN + 41,
 169    __SIGRTMIN + 42,
 170    __SIGRTMIN + 43,
 171    __SIGRTMIN + 44,
 172    __SIGRTMIN + 45,
 173    __SIGRTMIN + 46,
 174    __SIGRTMIN + 47,
 175    __SIGRTMIN + 48,
 176    __SIGRTMIN + 49,
 177    __SIGRTMIN + 50,
 178    __SIGRTMIN + 51,
 179    __SIGRTMIN + 52,
 180    __SIGRTMIN + 53,
 181    __SIGRTMIN + 54,
 182    __SIGRTMIN + 55,
 183    __SIGRTMIN + 56,
 184    __SIGRTMIN + 57,
 185    __SIGRTMIN + 58,
 186    __SIGRTMIN + 59,
 187    __SIGRTMIN + 60,
 188    __SIGRTMIN + 61,
 189    __SIGRTMIN + 62,
 190    __SIGRTMIN + 63,
 191    __SIGRTMIN + 64,
 192    __SIGRTMIN + 65,
 193    __SIGRTMIN + 66,
 194    __SIGRTMIN + 67,
 195    __SIGRTMIN + 68,
 196    __SIGRTMIN + 69,
 197    __SIGRTMIN + 70,
 198    __SIGRTMIN + 71,
 199    __SIGRTMIN + 72,
 200    __SIGRTMIN + 73,
 201    __SIGRTMIN + 74,
 202    __SIGRTMIN + 75,
 203    __SIGRTMIN + 76,
 204    __SIGRTMIN + 77,
 205    __SIGRTMIN + 78,
 206    __SIGRTMIN + 79,
 207    __SIGRTMIN + 80,
 208    __SIGRTMIN + 81,
 209    __SIGRTMIN + 82,
 210    __SIGRTMIN + 83,
 211    __SIGRTMIN + 84,
 212    __SIGRTMIN + 85,
 213    __SIGRTMIN + 86,
 214    __SIGRTMIN + 87,
 215    __SIGRTMIN + 88,
 216    __SIGRTMIN + 89,
 217    __SIGRTMIN + 90,
 218    __SIGRTMIN + 91,
 219    __SIGRTMIN + 92,
 220    __SIGRTMIN + 93,
 221    __SIGRTMIN + 94,
 222    __SIGRTMIN + 95,
 223    -1, /* SIGINFO */
 224    -1, /* UNKNOWN */
 225    -1, /* DEFAULT */
 226    -1,
 227    -1,
 228    -1,
 229    -1,
 230    -1,
 231    -1
 232#endif
 233};
 234#else
 235/* In system mode we only need SIGINT and SIGTRAP; other signals
 236   are not yet supported.  */
 237
 238enum {
 239    TARGET_SIGINT = 2,
 240    TARGET_SIGTRAP = 5
 241};
 242
 243static int gdb_signal_table[] = {
 244    -1,
 245    -1,
 246    TARGET_SIGINT,
 247    -1,
 248    -1,
 249    TARGET_SIGTRAP
 250};
 251#endif
 252
 253#ifdef CONFIG_USER_ONLY
 254static int target_signal_to_gdb (int sig)
 255{
 256    int i;
 257    for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 258        if (gdb_signal_table[i] == sig)
 259            return i;
 260    return GDB_SIGNAL_UNKNOWN;
 261}
 262#endif
 263
 264static int gdb_signal_to_target (int sig)
 265{
 266    if (sig < ARRAY_SIZE (gdb_signal_table))
 267        return gdb_signal_table[sig];
 268    else
 269        return -1;
 270}
 271
 272//#define DEBUG_GDB
 273
 274typedef struct GDBRegisterState {
 275    int base_reg;
 276    int num_regs;
 277    gdb_reg_cb get_reg;
 278    gdb_reg_cb set_reg;
 279    const char *xml;
 280    struct GDBRegisterState *next;
 281} GDBRegisterState;
 282
 283enum RSState {
 284    RS_INACTIVE,
 285    RS_IDLE,
 286    RS_GETLINE,
 287    RS_CHKSUM1,
 288    RS_CHKSUM2,
 289};
 290typedef struct GDBState {
 291    CPUState *c_cpu; /* current CPU for step/continue ops */
 292    CPUState *g_cpu; /* current CPU for other ops */
 293    CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 294    enum RSState state; /* parsing state */
 295    char line_buf[MAX_PACKET_LENGTH];
 296    int line_buf_index;
 297    int line_csum;
 298    uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 299    int last_packet_len;
 300    int signal;
 301#ifdef CONFIG_USER_ONLY
 302    int fd;
 303    int running_state;
 304#else
 305    CharDriverState *chr;
 306    CharDriverState *mon_chr;
 307#endif
 308    char syscall_buf[256];
 309    gdb_syscall_complete_cb current_syscall_cb;
 310} GDBState;
 311
 312/* By default use no IRQs and no timers while single stepping so as to
 313 * make single stepping like an ICE HW step.
 314 */
 315static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 316
 317static GDBState *gdbserver_state;
 318
 319bool gdb_has_xml;
 320
 321#ifdef CONFIG_USER_ONLY
 322/* XXX: This is not thread safe.  Do we care?  */
 323static int gdbserver_fd = -1;
 324
 325static int get_char(GDBState *s)
 326{
 327    uint8_t ch;
 328    int ret;
 329
 330    for(;;) {
 331        ret = qemu_recv(s->fd, &ch, 1, 0);
 332        if (ret < 0) {
 333            if (errno == ECONNRESET)
 334                s->fd = -1;
 335            if (errno != EINTR && errno != EAGAIN)
 336                return -1;
 337        } else if (ret == 0) {
 338            close(s->fd);
 339            s->fd = -1;
 340            return -1;
 341        } else {
 342            break;
 343        }
 344    }
 345    return ch;
 346}
 347#endif
 348
 349static enum {
 350    GDB_SYS_UNKNOWN,
 351    GDB_SYS_ENABLED,
 352    GDB_SYS_DISABLED,
 353} gdb_syscall_mode;
 354
 355/* Decide if either remote gdb syscalls or native file IO should be used. */
 356int use_gdb_syscalls(void)
 357{
 358    SemihostingTarget target = semihosting_get_target();
 359    if (target == SEMIHOSTING_TARGET_NATIVE) {
 360        /* -semihosting-config target=native */
 361        return false;
 362    } else if (target == SEMIHOSTING_TARGET_GDB) {
 363        /* -semihosting-config target=gdb */
 364        return true;
 365    }
 366
 367    /* -semihosting-config target=auto */
 368    /* On the first call check if gdb is connected and remember. */
 369    if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 370        gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 371                                            : GDB_SYS_DISABLED);
 372    }
 373    return gdb_syscall_mode == GDB_SYS_ENABLED;
 374}
 375
 376/* Resume execution.  */
 377static inline void gdb_continue(GDBState *s)
 378{
 379#ifdef CONFIG_USER_ONLY
 380    s->running_state = 1;
 381#else
 382    if (!runstate_needs_reset()) {
 383        vm_start();
 384    }
 385#endif
 386}
 387
 388static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 389{
 390#ifdef CONFIG_USER_ONLY
 391    int ret;
 392
 393    while (len > 0) {
 394        ret = send(s->fd, buf, len, 0);
 395        if (ret < 0) {
 396            if (errno != EINTR && errno != EAGAIN)
 397                return;
 398        } else {
 399            buf += ret;
 400            len -= ret;
 401        }
 402    }
 403#else
 404    qemu_chr_fe_write(s->chr, buf, len);
 405#endif
 406}
 407
 408static inline int fromhex(int v)
 409{
 410    if (v >= '0' && v <= '9')
 411        return v - '0';
 412    else if (v >= 'A' && v <= 'F')
 413        return v - 'A' + 10;
 414    else if (v >= 'a' && v <= 'f')
 415        return v - 'a' + 10;
 416    else
 417        return 0;
 418}
 419
 420static inline int tohex(int v)
 421{
 422    if (v < 10)
 423        return v + '0';
 424    else
 425        return v - 10 + 'a';
 426}
 427
 428static void memtohex(char *buf, const uint8_t *mem, int len)
 429{
 430    int i, c;
 431    char *q;
 432    q = buf;
 433    for(i = 0; i < len; i++) {
 434        c = mem[i];
 435        *q++ = tohex(c >> 4);
 436        *q++ = tohex(c & 0xf);
 437    }
 438    *q = '\0';
 439}
 440
 441static void hextomem(uint8_t *mem, const char *buf, int len)
 442{
 443    int i;
 444
 445    for(i = 0; i < len; i++) {
 446        mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 447        buf += 2;
 448    }
 449}
 450
 451/* return -1 if error, 0 if OK */
 452static int put_packet_binary(GDBState *s, const char *buf, int len)
 453{
 454    int csum, i;
 455    uint8_t *p;
 456
 457    for(;;) {
 458        p = s->last_packet;
 459        *(p++) = '$';
 460        memcpy(p, buf, len);
 461        p += len;
 462        csum = 0;
 463        for(i = 0; i < len; i++) {
 464            csum += buf[i];
 465        }
 466        *(p++) = '#';
 467        *(p++) = tohex((csum >> 4) & 0xf);
 468        *(p++) = tohex((csum) & 0xf);
 469
 470        s->last_packet_len = p - s->last_packet;
 471        put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 472
 473#ifdef CONFIG_USER_ONLY
 474        i = get_char(s);
 475        if (i < 0)
 476            return -1;
 477        if (i == '+')
 478            break;
 479#else
 480        break;
 481#endif
 482    }
 483    return 0;
 484}
 485
 486/* return -1 if error, 0 if OK */
 487static int put_packet(GDBState *s, const char *buf)
 488{
 489#ifdef DEBUG_GDB
 490    printf("reply='%s'\n", buf);
 491#endif
 492
 493    return put_packet_binary(s, buf, strlen(buf));
 494}
 495
 496/* Encode data using the encoding for 'x' packets.  */
 497static int memtox(char *buf, const char *mem, int len)
 498{
 499    char *p = buf;
 500    char c;
 501
 502    while (len--) {
 503        c = *(mem++);
 504        switch (c) {
 505        case '#': case '$': case '*': case '}':
 506            *(p++) = '}';
 507            *(p++) = c ^ 0x20;
 508            break;
 509        default:
 510            *(p++) = c;
 511            break;
 512        }
 513    }
 514    return p - buf;
 515}
 516
 517static const char *get_feature_xml(const char *p, const char **newp,
 518                                   CPUClass *cc)
 519{
 520    size_t len;
 521    int i;
 522    const char *name;
 523    static char target_xml[1024];
 524
 525    len = 0;
 526    while (p[len] && p[len] != ':')
 527        len++;
 528    *newp = p + len;
 529
 530    name = NULL;
 531    if (strncmp(p, "target.xml", len) == 0) {
 532        /* Generate the XML description for this CPU.  */
 533        if (!target_xml[0]) {
 534            GDBRegisterState *r;
 535            CPUState *cpu = first_cpu;
 536
 537            pstrcat(target_xml, sizeof(target_xml),
 538                    "<?xml version=\"1.0\"?>"
 539                    "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
 540                    "<target>");
 541            if (cc->gdb_arch_name) {
 542                gchar *arch = cc->gdb_arch_name(cpu);
 543                pstrcat(target_xml, sizeof(target_xml), "<architecture>");
 544                pstrcat(target_xml, sizeof(target_xml), arch);
 545                pstrcat(target_xml, sizeof(target_xml), "</architecture>");
 546                g_free(arch);
 547            }
 548            pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
 549            pstrcat(target_xml, sizeof(target_xml), cc->gdb_core_xml_file);
 550            pstrcat(target_xml, sizeof(target_xml), "\"/>");
 551            for (r = cpu->gdb_regs; r; r = r->next) {
 552                pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
 553                pstrcat(target_xml, sizeof(target_xml), r->xml);
 554                pstrcat(target_xml, sizeof(target_xml), "\"/>");
 555            }
 556            pstrcat(target_xml, sizeof(target_xml), "</target>");
 557        }
 558        return target_xml;
 559    }
 560    for (i = 0; ; i++) {
 561        name = xml_builtin[i][0];
 562        if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
 563            break;
 564    }
 565    return name ? xml_builtin[i][1] : NULL;
 566}
 567
 568static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 569{
 570    CPUClass *cc = CPU_GET_CLASS(cpu);
 571    CPUArchState *env = cpu->env_ptr;
 572    GDBRegisterState *r;
 573
 574    if (reg < cc->gdb_num_core_regs) {
 575        return cc->gdb_read_register(cpu, mem_buf, reg);
 576    }
 577
 578    for (r = cpu->gdb_regs; r; r = r->next) {
 579        if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 580            return r->get_reg(env, mem_buf, reg - r->base_reg);
 581        }
 582    }
 583    return 0;
 584}
 585
 586static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 587{
 588    CPUClass *cc = CPU_GET_CLASS(cpu);
 589    CPUArchState *env = cpu->env_ptr;
 590    GDBRegisterState *r;
 591
 592    if (reg < cc->gdb_num_core_regs) {
 593        return cc->gdb_write_register(cpu, mem_buf, reg);
 594    }
 595
 596    for (r = cpu->gdb_regs; r; r = r->next) {
 597        if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 598            return r->set_reg(env, mem_buf, reg - r->base_reg);
 599        }
 600    }
 601    return 0;
 602}
 603
 604/* Register a supplemental set of CPU registers.  If g_pos is nonzero it
 605   specifies the first register number and these registers are included in
 606   a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
 607   gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
 608 */
 609
 610void gdb_register_coprocessor(CPUState *cpu,
 611                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
 612                              int num_regs, const char *xml, int g_pos)
 613{
 614    GDBRegisterState *s;
 615    GDBRegisterState **p;
 616
 617    p = &cpu->gdb_regs;
 618    while (*p) {
 619        /* Check for duplicates.  */
 620        if (strcmp((*p)->xml, xml) == 0)
 621            return;
 622        p = &(*p)->next;
 623    }
 624
 625    s = g_new0(GDBRegisterState, 1);
 626    s->base_reg = cpu->gdb_num_regs;
 627    s->num_regs = num_regs;
 628    s->get_reg = get_reg;
 629    s->set_reg = set_reg;
 630    s->xml = xml;
 631
 632    /* Add to end of list.  */
 633    cpu->gdb_num_regs += num_regs;
 634    *p = s;
 635    if (g_pos) {
 636        if (g_pos != s->base_reg) {
 637            fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
 638                    "Expected %d got %d\n", xml, g_pos, s->base_reg);
 639        } else {
 640            cpu->gdb_num_g_regs = cpu->gdb_num_regs;
 641        }
 642    }
 643}
 644
 645#ifndef CONFIG_USER_ONLY
 646/* Translate GDB watchpoint type to a flags value for cpu_watchpoint_* */
 647static inline int xlat_gdb_type(CPUState *cpu, int gdbtype)
 648{
 649    static const int xlat[] = {
 650        [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
 651        [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
 652        [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
 653    };
 654
 655    CPUClass *cc = CPU_GET_CLASS(cpu);
 656    int cputype = xlat[gdbtype];
 657
 658    if (cc->gdb_stop_before_watchpoint) {
 659        cputype |= BP_STOP_BEFORE_ACCESS;
 660    }
 661    return cputype;
 662}
 663#endif
 664
 665static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
 666{
 667    CPUState *cpu;
 668    int err = 0;
 669
 670    if (kvm_enabled()) {
 671        return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 672    }
 673
 674    switch (type) {
 675    case GDB_BREAKPOINT_SW:
 676    case GDB_BREAKPOINT_HW:
 677        CPU_FOREACH(cpu) {
 678            err = cpu_breakpoint_insert(cpu, addr, BP_GDB, NULL);
 679            if (err) {
 680                break;
 681            }
 682        }
 683        return err;
 684#ifndef CONFIG_USER_ONLY
 685    case GDB_WATCHPOINT_WRITE:
 686    case GDB_WATCHPOINT_READ:
 687    case GDB_WATCHPOINT_ACCESS:
 688        CPU_FOREACH(cpu) {
 689            err = cpu_watchpoint_insert(cpu, addr, len,
 690                                        xlat_gdb_type(cpu, type), NULL);
 691            if (err) {
 692                break;
 693            }
 694        }
 695        return err;
 696#endif
 697    default:
 698        return -ENOSYS;
 699    }
 700}
 701
 702static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
 703{
 704    CPUState *cpu;
 705    int err = 0;
 706
 707    if (kvm_enabled()) {
 708        return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 709    }
 710
 711    switch (type) {
 712    case GDB_BREAKPOINT_SW:
 713    case GDB_BREAKPOINT_HW:
 714        CPU_FOREACH(cpu) {
 715            err = cpu_breakpoint_remove(cpu, addr, BP_GDB);
 716            if (err) {
 717                break;
 718            }
 719        }
 720        return err;
 721#ifndef CONFIG_USER_ONLY
 722    case GDB_WATCHPOINT_WRITE:
 723    case GDB_WATCHPOINT_READ:
 724    case GDB_WATCHPOINT_ACCESS:
 725        CPU_FOREACH(cpu) {
 726            err = cpu_watchpoint_remove(cpu, addr, len,
 727                                        xlat_gdb_type(cpu, type));
 728            if (err)
 729                break;
 730        }
 731        return err;
 732#endif
 733    default:
 734        return -ENOSYS;
 735    }
 736}
 737
 738static void gdb_breakpoint_remove_all(void)
 739{
 740    CPUState *cpu;
 741
 742    if (kvm_enabled()) {
 743        kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
 744        return;
 745    }
 746
 747    CPU_FOREACH(cpu) {
 748        cpu_breakpoint_remove_all(cpu, BP_GDB);
 749#ifndef CONFIG_USER_ONLY
 750        cpu_watchpoint_remove_all(cpu, BP_GDB);
 751#endif
 752    }
 753}
 754
 755static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 756{
 757    CPUState *cpu = s->c_cpu;
 758
 759    cpu_synchronize_state(cpu);
 760    cpu_set_pc(cpu, pc);
 761}
 762
 763static CPUState *find_cpu(uint32_t thread_id)
 764{
 765    CPUState *cpu;
 766
 767    CPU_FOREACH(cpu) {
 768        if (cpu_index(cpu) == thread_id) {
 769            return cpu;
 770        }
 771    }
 772
 773    return NULL;
 774}
 775
 776static int is_query_packet(const char *p, const char *query, char separator)
 777{
 778    unsigned int query_len = strlen(query);
 779
 780    return strncmp(p, query, query_len) == 0 &&
 781        (p[query_len] == '\0' || p[query_len] == separator);
 782}
 783
 784static int gdb_handle_packet(GDBState *s, const char *line_buf)
 785{
 786    CPUState *cpu;
 787    CPUClass *cc;
 788    const char *p;
 789    uint32_t thread;
 790    int ch, reg_size, type, res;
 791    char buf[MAX_PACKET_LENGTH];
 792    uint8_t mem_buf[MAX_PACKET_LENGTH];
 793    uint8_t *registers;
 794    target_ulong addr, len;
 795
 796#ifdef DEBUG_GDB
 797    printf("command='%s'\n", line_buf);
 798#endif
 799    p = line_buf;
 800    ch = *p++;
 801    switch(ch) {
 802    case '?':
 803        /* TODO: Make this return the correct value for user-mode.  */
 804        snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
 805                 cpu_index(s->c_cpu));
 806        put_packet(s, buf);
 807        /* Remove all the breakpoints when this query is issued,
 808         * because gdb is doing and initial connect and the state
 809         * should be cleaned up.
 810         */
 811        gdb_breakpoint_remove_all();
 812        break;
 813    case 'c':
 814        if (*p != '\0') {
 815            addr = strtoull(p, (char **)&p, 16);
 816            gdb_set_cpu_pc(s, addr);
 817        }
 818        s->signal = 0;
 819        gdb_continue(s);
 820        return RS_IDLE;
 821    case 'C':
 822        s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
 823        if (s->signal == -1)
 824            s->signal = 0;
 825        gdb_continue(s);
 826        return RS_IDLE;
 827    case 'v':
 828        if (strncmp(p, "Cont", 4) == 0) {
 829            int res_signal, res_thread;
 830
 831            p += 4;
 832            if (*p == '?') {
 833                put_packet(s, "vCont;c;C;s;S");
 834                break;
 835            }
 836            res = 0;
 837            res_signal = 0;
 838            res_thread = 0;
 839            while (*p) {
 840                int action, signal;
 841
 842                if (*p++ != ';') {
 843                    res = 0;
 844                    break;
 845                }
 846                action = *p++;
 847                signal = 0;
 848                if (action == 'C' || action == 'S') {
 849                    signal = gdb_signal_to_target(strtoul(p, (char **)&p, 16));
 850                    if (signal == -1) {
 851                        signal = 0;
 852                    }
 853                } else if (action != 'c' && action != 's') {
 854                    res = 0;
 855                    break;
 856                }
 857                thread = 0;
 858                if (*p == ':') {
 859                    thread = strtoull(p+1, (char **)&p, 16);
 860                }
 861                action = tolower(action);
 862                if (res == 0 || (res == 'c' && action == 's')) {
 863                    res = action;
 864                    res_signal = signal;
 865                    res_thread = thread;
 866                }
 867            }
 868            if (res) {
 869                if (res_thread != -1 && res_thread != 0) {
 870                    cpu = find_cpu(res_thread);
 871                    if (cpu == NULL) {
 872                        put_packet(s, "E22");
 873                        break;
 874                    }
 875                    s->c_cpu = cpu;
 876                }
 877                if (res == 's') {
 878                    cpu_single_step(s->c_cpu, sstep_flags);
 879                }
 880                s->signal = res_signal;
 881                gdb_continue(s);
 882                return RS_IDLE;
 883            }
 884            break;
 885        } else {
 886            goto unknown_command;
 887        }
 888    case 'k':
 889        /* Kill the target */
 890        fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
 891        exit(0);
 892    case 'D':
 893        /* Detach packet */
 894        gdb_breakpoint_remove_all();
 895        gdb_syscall_mode = GDB_SYS_DISABLED;
 896        gdb_continue(s);
 897        put_packet(s, "OK");
 898        break;
 899    case 's':
 900        if (*p != '\0') {
 901            addr = strtoull(p, (char **)&p, 16);
 902            gdb_set_cpu_pc(s, addr);
 903        }
 904        cpu_single_step(s->c_cpu, sstep_flags);
 905        gdb_continue(s);
 906        return RS_IDLE;
 907    case 'F':
 908        {
 909            target_ulong ret;
 910            target_ulong err;
 911
 912            ret = strtoull(p, (char **)&p, 16);
 913            if (*p == ',') {
 914                p++;
 915                err = strtoull(p, (char **)&p, 16);
 916            } else {
 917                err = 0;
 918            }
 919            if (*p == ',')
 920                p++;
 921            type = *p;
 922            if (s->current_syscall_cb) {
 923                s->current_syscall_cb(s->c_cpu, ret, err);
 924                s->current_syscall_cb = NULL;
 925            }
 926            if (type == 'C') {
 927                put_packet(s, "T02");
 928            } else {
 929                gdb_continue(s);
 930            }
 931        }
 932        break;
 933    case 'g':
 934        cpu_synchronize_state(s->g_cpu);
 935        len = 0;
 936        for (addr = 0; addr < s->g_cpu->gdb_num_g_regs; addr++) {
 937            reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
 938            len += reg_size;
 939        }
 940        memtohex(buf, mem_buf, len);
 941        put_packet(s, buf);
 942        break;
 943    case 'G':
 944        cpu_synchronize_state(s->g_cpu);
 945        registers = mem_buf;
 946        len = strlen(p) / 2;
 947        hextomem((uint8_t *)registers, p, len);
 948        for (addr = 0; addr < s->g_cpu->gdb_num_g_regs && len > 0; addr++) {
 949            reg_size = gdb_write_register(s->g_cpu, registers, addr);
 950            len -= reg_size;
 951            registers += reg_size;
 952        }
 953        put_packet(s, "OK");
 954        break;
 955    case 'm':
 956        addr = strtoull(p, (char **)&p, 16);
 957        if (*p == ',')
 958            p++;
 959        len = strtoull(p, NULL, 16);
 960
 961        /* memtohex() doubles the required space */
 962        if (len > MAX_PACKET_LENGTH / 2) {
 963            put_packet (s, "E22");
 964            break;
 965        }
 966
 967        if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
 968            put_packet (s, "E14");
 969        } else {
 970            memtohex(buf, mem_buf, len);
 971            put_packet(s, buf);
 972        }
 973        break;
 974    case 'M':
 975        addr = strtoull(p, (char **)&p, 16);
 976        if (*p == ',')
 977            p++;
 978        len = strtoull(p, (char **)&p, 16);
 979        if (*p == ':')
 980            p++;
 981
 982        /* hextomem() reads 2*len bytes */
 983        if (len > strlen(p) / 2) {
 984            put_packet (s, "E22");
 985            break;
 986        }
 987        hextomem(mem_buf, p, len);
 988        if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
 989                                   true) != 0) {
 990            put_packet(s, "E14");
 991        } else {
 992            put_packet(s, "OK");
 993        }
 994        break;
 995    case 'p':
 996        /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
 997           This works, but can be very slow.  Anything new enough to
 998           understand XML also knows how to use this properly.  */
 999        if (!gdb_has_xml)
1000            goto unknown_command;
1001        addr = strtoull(p, (char **)&p, 16);
1002        reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1003        if (reg_size) {
1004            memtohex(buf, mem_buf, reg_size);
1005            put_packet(s, buf);
1006        } else {
1007            put_packet(s, "E14");
1008        }
1009        break;
1010    case 'P':
1011        if (!gdb_has_xml)
1012            goto unknown_command;
1013        addr = strtoull(p, (char **)&p, 16);
1014        if (*p == '=')
1015            p++;
1016        reg_size = strlen(p) / 2;
1017        hextomem(mem_buf, p, reg_size);
1018        gdb_write_register(s->g_cpu, mem_buf, addr);
1019        put_packet(s, "OK");
1020        break;
1021    case 'Z':
1022    case 'z':
1023        type = strtoul(p, (char **)&p, 16);
1024        if (*p == ',')
1025            p++;
1026        addr = strtoull(p, (char **)&p, 16);
1027        if (*p == ',')
1028            p++;
1029        len = strtoull(p, (char **)&p, 16);
1030        if (ch == 'Z')
1031            res = gdb_breakpoint_insert(addr, len, type);
1032        else
1033            res = gdb_breakpoint_remove(addr, len, type);
1034        if (res >= 0)
1035             put_packet(s, "OK");
1036        else if (res == -ENOSYS)
1037            put_packet(s, "");
1038        else
1039            put_packet(s, "E22");
1040        break;
1041    case 'H':
1042        type = *p++;
1043        thread = strtoull(p, (char **)&p, 16);
1044        if (thread == -1 || thread == 0) {
1045            put_packet(s, "OK");
1046            break;
1047        }
1048        cpu = find_cpu(thread);
1049        if (cpu == NULL) {
1050            put_packet(s, "E22");
1051            break;
1052        }
1053        switch (type) {
1054        case 'c':
1055            s->c_cpu = cpu;
1056            put_packet(s, "OK");
1057            break;
1058        case 'g':
1059            s->g_cpu = cpu;
1060            put_packet(s, "OK");
1061            break;
1062        default:
1063             put_packet(s, "E22");
1064             break;
1065        }
1066        break;
1067    case 'T':
1068        thread = strtoull(p, (char **)&p, 16);
1069        cpu = find_cpu(thread);
1070
1071        if (cpu != NULL) {
1072            put_packet(s, "OK");
1073        } else {
1074            put_packet(s, "E22");
1075        }
1076        break;
1077    case 'q':
1078    case 'Q':
1079        /* parse any 'q' packets here */
1080        if (!strcmp(p,"qemu.sstepbits")) {
1081            /* Query Breakpoint bit definitions */
1082            snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1083                     SSTEP_ENABLE,
1084                     SSTEP_NOIRQ,
1085                     SSTEP_NOTIMER);
1086            put_packet(s, buf);
1087            break;
1088        } else if (is_query_packet(p, "qemu.sstep", '=')) {
1089            /* Display or change the sstep_flags */
1090            p += 10;
1091            if (*p != '=') {
1092                /* Display current setting */
1093                snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1094                put_packet(s, buf);
1095                break;
1096            }
1097            p++;
1098            type = strtoul(p, (char **)&p, 16);
1099            sstep_flags = type;
1100            put_packet(s, "OK");
1101            break;
1102        } else if (strcmp(p,"C") == 0) {
1103            /* "Current thread" remains vague in the spec, so always return
1104             *  the first CPU (gdb returns the first thread). */
1105            put_packet(s, "QC1");
1106            break;
1107        } else if (strcmp(p,"fThreadInfo") == 0) {
1108            s->query_cpu = first_cpu;
1109            goto report_cpuinfo;
1110        } else if (strcmp(p,"sThreadInfo") == 0) {
1111        report_cpuinfo:
1112            if (s->query_cpu) {
1113                snprintf(buf, sizeof(buf), "m%x", cpu_index(s->query_cpu));
1114                put_packet(s, buf);
1115                s->query_cpu = CPU_NEXT(s->query_cpu);
1116            } else
1117                put_packet(s, "l");
1118            break;
1119        } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1120            thread = strtoull(p+16, (char **)&p, 16);
1121            cpu = find_cpu(thread);
1122            if (cpu != NULL) {
1123                cpu_synchronize_state(cpu);
1124                /* memtohex() doubles the required space */
1125                len = snprintf((char *)mem_buf, sizeof(buf) / 2,
1126                               "CPU#%d [%s]", cpu->cpu_index,
1127                               cpu->halted ? "halted " : "running");
1128                memtohex(buf, mem_buf, len);
1129                put_packet(s, buf);
1130            }
1131            break;
1132        }
1133#ifdef CONFIG_USER_ONLY
1134        else if (strcmp(p, "Offsets") == 0) {
1135            TaskState *ts = s->c_cpu->opaque;
1136
1137            snprintf(buf, sizeof(buf),
1138                     "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1139                     ";Bss=" TARGET_ABI_FMT_lx,
1140                     ts->info->code_offset,
1141                     ts->info->data_offset,
1142                     ts->info->data_offset);
1143            put_packet(s, buf);
1144            break;
1145        }
1146#else /* !CONFIG_USER_ONLY */
1147        else if (strncmp(p, "Rcmd,", 5) == 0) {
1148            int len = strlen(p + 5);
1149
1150            if ((len % 2) != 0) {
1151                put_packet(s, "E01");
1152                break;
1153            }
1154            len = len / 2;
1155            hextomem(mem_buf, p + 5, len);
1156            mem_buf[len++] = 0;
1157            qemu_chr_be_write(s->mon_chr, mem_buf, len);
1158            put_packet(s, "OK");
1159            break;
1160        }
1161#endif /* !CONFIG_USER_ONLY */
1162        if (is_query_packet(p, "Supported", ':')) {
1163            snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1164            cc = CPU_GET_CLASS(first_cpu);
1165            if (cc->gdb_core_xml_file != NULL) {
1166                pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1167            }
1168            put_packet(s, buf);
1169            break;
1170        }
1171        if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1172            const char *xml;
1173            target_ulong total_len;
1174
1175            cc = CPU_GET_CLASS(first_cpu);
1176            if (cc->gdb_core_xml_file == NULL) {
1177                goto unknown_command;
1178            }
1179
1180            gdb_has_xml = true;
1181            p += 19;
1182            xml = get_feature_xml(p, &p, cc);
1183            if (!xml) {
1184                snprintf(buf, sizeof(buf), "E00");
1185                put_packet(s, buf);
1186                break;
1187            }
1188
1189            if (*p == ':')
1190                p++;
1191            addr = strtoul(p, (char **)&p, 16);
1192            if (*p == ',')
1193                p++;
1194            len = strtoul(p, (char **)&p, 16);
1195
1196            total_len = strlen(xml);
1197            if (addr > total_len) {
1198                snprintf(buf, sizeof(buf), "E00");
1199                put_packet(s, buf);
1200                break;
1201            }
1202            if (len > (MAX_PACKET_LENGTH - 5) / 2)
1203                len = (MAX_PACKET_LENGTH - 5) / 2;
1204            if (len < total_len - addr) {
1205                buf[0] = 'm';
1206                len = memtox(buf + 1, xml + addr, len);
1207            } else {
1208                buf[0] = 'l';
1209                len = memtox(buf + 1, xml + addr, total_len - addr);
1210            }
1211            put_packet_binary(s, buf, len + 1);
1212            break;
1213        }
1214        if (is_query_packet(p, "Attached", ':')) {
1215            put_packet(s, GDB_ATTACHED);
1216            break;
1217        }
1218        /* Unrecognised 'q' command.  */
1219        goto unknown_command;
1220
1221    default:
1222    unknown_command:
1223        /* put empty packet */
1224        buf[0] = '\0';
1225        put_packet(s, buf);
1226        break;
1227    }
1228    return RS_IDLE;
1229}
1230
1231void gdb_set_stop_cpu(CPUState *cpu)
1232{
1233    gdbserver_state->c_cpu = cpu;
1234    gdbserver_state->g_cpu = cpu;
1235}
1236
1237#ifndef CONFIG_USER_ONLY
1238static void gdb_vm_state_change(void *opaque, int running, RunState state)
1239{
1240    GDBState *s = gdbserver_state;
1241    CPUState *cpu = s->c_cpu;
1242    char buf[256];
1243    const char *type;
1244    int ret;
1245
1246    if (running || s->state == RS_INACTIVE) {
1247        return;
1248    }
1249    /* Is there a GDB syscall waiting to be sent?  */
1250    if (s->current_syscall_cb) {
1251        put_packet(s, s->syscall_buf);
1252        return;
1253    }
1254    switch (state) {
1255    case RUN_STATE_DEBUG:
1256        if (cpu->watchpoint_hit) {
1257            switch (cpu->watchpoint_hit->flags & BP_MEM_ACCESS) {
1258            case BP_MEM_READ:
1259                type = "r";
1260                break;
1261            case BP_MEM_ACCESS:
1262                type = "a";
1263                break;
1264            default:
1265                type = "";
1266                break;
1267            }
1268            snprintf(buf, sizeof(buf),
1269                     "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1270                     GDB_SIGNAL_TRAP, cpu_index(cpu), type,
1271                     (target_ulong)cpu->watchpoint_hit->vaddr);
1272            cpu->watchpoint_hit = NULL;
1273            goto send_packet;
1274        }
1275        tb_flush(cpu);
1276        ret = GDB_SIGNAL_TRAP;
1277        break;
1278    case RUN_STATE_PAUSED:
1279        ret = GDB_SIGNAL_INT;
1280        break;
1281    case RUN_STATE_SHUTDOWN:
1282        ret = GDB_SIGNAL_QUIT;
1283        break;
1284    case RUN_STATE_IO_ERROR:
1285        ret = GDB_SIGNAL_IO;
1286        break;
1287    case RUN_STATE_WATCHDOG:
1288        ret = GDB_SIGNAL_ALRM;
1289        break;
1290    case RUN_STATE_INTERNAL_ERROR:
1291        ret = GDB_SIGNAL_ABRT;
1292        break;
1293    case RUN_STATE_SAVE_VM:
1294    case RUN_STATE_RESTORE_VM:
1295        return;
1296    case RUN_STATE_FINISH_MIGRATE:
1297        ret = GDB_SIGNAL_XCPU;
1298        break;
1299    default:
1300        ret = GDB_SIGNAL_UNKNOWN;
1301        break;
1302    }
1303    gdb_set_stop_cpu(cpu);
1304    snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, cpu_index(cpu));
1305
1306send_packet:
1307    put_packet(s, buf);
1308
1309    /* disable single step if it was enabled */
1310    cpu_single_step(cpu, 0);
1311}
1312#endif
1313
1314/* Send a gdb syscall request.
1315   This accepts limited printf-style format specifiers, specifically:
1316    %x  - target_ulong argument printed in hex.
1317    %lx - 64-bit argument printed in hex.
1318    %s  - string pointer (target_ulong) and length (int) pair.  */
1319void gdb_do_syscallv(gdb_syscall_complete_cb cb, const char *fmt, va_list va)
1320{
1321    char *p;
1322    char *p_end;
1323    target_ulong addr;
1324    uint64_t i64;
1325    GDBState *s;
1326
1327    s = gdbserver_state;
1328    if (!s)
1329        return;
1330    s->current_syscall_cb = cb;
1331#ifndef CONFIG_USER_ONLY
1332    vm_stop(RUN_STATE_DEBUG);
1333#endif
1334    p = s->syscall_buf;
1335    p_end = &s->syscall_buf[sizeof(s->syscall_buf)];
1336    *(p++) = 'F';
1337    while (*fmt) {
1338        if (*fmt == '%') {
1339            fmt++;
1340            switch (*fmt++) {
1341            case 'x':
1342                addr = va_arg(va, target_ulong);
1343                p += snprintf(p, p_end - p, TARGET_FMT_lx, addr);
1344                break;
1345            case 'l':
1346                if (*(fmt++) != 'x')
1347                    goto bad_format;
1348                i64 = va_arg(va, uint64_t);
1349                p += snprintf(p, p_end - p, "%" PRIx64, i64);
1350                break;
1351            case 's':
1352                addr = va_arg(va, target_ulong);
1353                p += snprintf(p, p_end - p, TARGET_FMT_lx "/%x",
1354                              addr, va_arg(va, int));
1355                break;
1356            default:
1357            bad_format:
1358                fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
1359                        fmt - 1);
1360                break;
1361            }
1362        } else {
1363            *(p++) = *(fmt++);
1364        }
1365    }
1366    *p = 0;
1367#ifdef CONFIG_USER_ONLY
1368    put_packet(s, s->syscall_buf);
1369    gdb_handlesig(s->c_cpu, 0);
1370#else
1371    /* In this case wait to send the syscall packet until notification that
1372       the CPU has stopped.  This must be done because if the packet is sent
1373       now the reply from the syscall request could be received while the CPU
1374       is still in the running state, which can cause packets to be dropped
1375       and state transition 'T' packets to be sent while the syscall is still
1376       being processed.  */
1377    qemu_cpu_kick(s->c_cpu);
1378#endif
1379}
1380
1381void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1382{
1383    va_list va;
1384
1385    va_start(va, fmt);
1386    gdb_do_syscallv(cb, fmt, va);
1387    va_end(va);
1388}
1389
1390static void gdb_read_byte(GDBState *s, int ch)
1391{
1392    int i, csum;
1393    uint8_t reply;
1394
1395#ifndef CONFIG_USER_ONLY
1396    if (s->last_packet_len) {
1397        /* Waiting for a response to the last packet.  If we see the start
1398           of a new command then abandon the previous response.  */
1399        if (ch == '-') {
1400#ifdef DEBUG_GDB
1401            printf("Got NACK, retransmitting\n");
1402#endif
1403            put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
1404        }
1405#ifdef DEBUG_GDB
1406        else if (ch == '+')
1407            printf("Got ACK\n");
1408        else
1409            printf("Got '%c' when expecting ACK/NACK\n", ch);
1410#endif
1411        if (ch == '+' || ch == '$')
1412            s->last_packet_len = 0;
1413        if (ch != '$')
1414            return;
1415    }
1416    if (runstate_is_running()) {
1417        /* when the CPU is running, we cannot do anything except stop
1418           it when receiving a char */
1419        vm_stop(RUN_STATE_PAUSED);
1420    } else
1421#endif
1422    {
1423        switch(s->state) {
1424        case RS_IDLE:
1425            if (ch == '$') {
1426                s->line_buf_index = 0;
1427                s->state = RS_GETLINE;
1428            }
1429            break;
1430        case RS_GETLINE:
1431            if (ch == '#') {
1432            s->state = RS_CHKSUM1;
1433            } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1434                s->state = RS_IDLE;
1435            } else {
1436            s->line_buf[s->line_buf_index++] = ch;
1437            }
1438            break;
1439        case RS_CHKSUM1:
1440            s->line_buf[s->line_buf_index] = '\0';
1441            s->line_csum = fromhex(ch) << 4;
1442            s->state = RS_CHKSUM2;
1443            break;
1444        case RS_CHKSUM2:
1445            s->line_csum |= fromhex(ch);
1446            csum = 0;
1447            for(i = 0; i < s->line_buf_index; i++) {
1448                csum += s->line_buf[i];
1449            }
1450            if (s->line_csum != (csum & 0xff)) {
1451                reply = '-';
1452                put_buffer(s, &reply, 1);
1453                s->state = RS_IDLE;
1454            } else {
1455                reply = '+';
1456                put_buffer(s, &reply, 1);
1457                s->state = gdb_handle_packet(s, s->line_buf);
1458            }
1459            break;
1460        default:
1461            abort();
1462        }
1463    }
1464}
1465
1466/* Tell the remote gdb that the process has exited.  */
1467void gdb_exit(CPUArchState *env, int code)
1468{
1469  GDBState *s;
1470  char buf[4];
1471
1472  s = gdbserver_state;
1473  if (!s) {
1474      return;
1475  }
1476#ifdef CONFIG_USER_ONLY
1477  if (gdbserver_fd < 0 || s->fd < 0) {
1478      return;
1479  }
1480#else
1481  if (!s->chr) {
1482      return;
1483  }
1484#endif
1485
1486  snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
1487  put_packet(s, buf);
1488
1489#ifndef CONFIG_USER_ONLY
1490  qemu_chr_delete(s->chr);
1491#endif
1492}
1493
1494#ifdef CONFIG_USER_ONLY
1495int
1496gdb_queuesig (void)
1497{
1498    GDBState *s;
1499
1500    s = gdbserver_state;
1501
1502    if (gdbserver_fd < 0 || s->fd < 0)
1503        return 0;
1504    else
1505        return 1;
1506}
1507
1508int
1509gdb_handlesig(CPUState *cpu, int sig)
1510{
1511    GDBState *s;
1512    char buf[256];
1513    int n;
1514
1515    s = gdbserver_state;
1516    if (gdbserver_fd < 0 || s->fd < 0) {
1517        return sig;
1518    }
1519
1520    /* disable single step if it was enabled */
1521    cpu_single_step(cpu, 0);
1522    tb_flush(cpu);
1523
1524    if (sig != 0) {
1525        snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));
1526        put_packet(s, buf);
1527    }
1528    /* put_packet() might have detected that the peer terminated the
1529       connection.  */
1530    if (s->fd < 0) {
1531        return sig;
1532    }
1533
1534    sig = 0;
1535    s->state = RS_IDLE;
1536    s->running_state = 0;
1537    while (s->running_state == 0) {
1538        n = read(s->fd, buf, 256);
1539        if (n > 0) {
1540            int i;
1541
1542            for (i = 0; i < n; i++) {
1543                gdb_read_byte(s, buf[i]);
1544            }
1545        } else if (n == 0 || errno != EAGAIN) {
1546            /* XXX: Connection closed.  Should probably wait for another
1547               connection before continuing.  */
1548            return sig;
1549        }
1550    }
1551    sig = s->signal;
1552    s->signal = 0;
1553    return sig;
1554}
1555
1556/* Tell the remote gdb that the process has exited due to SIG.  */
1557void gdb_signalled(CPUArchState *env, int sig)
1558{
1559    GDBState *s;
1560    char buf[4];
1561
1562    s = gdbserver_state;
1563    if (gdbserver_fd < 0 || s->fd < 0) {
1564        return;
1565    }
1566
1567    snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb(sig));
1568    put_packet(s, buf);
1569}
1570
1571static void gdb_accept(void)
1572{
1573    GDBState *s;
1574    struct sockaddr_in sockaddr;
1575    socklen_t len;
1576    int fd;
1577
1578    for(;;) {
1579        len = sizeof(sockaddr);
1580        fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
1581        if (fd < 0 && errno != EINTR) {
1582            perror("accept");
1583            return;
1584        } else if (fd >= 0) {
1585#ifndef _WIN32
1586            fcntl(fd, F_SETFD, FD_CLOEXEC);
1587#endif
1588            break;
1589        }
1590    }
1591
1592    /* set short latency */
1593    socket_set_nodelay(fd);
1594
1595    s = g_malloc0(sizeof(GDBState));
1596    s->c_cpu = first_cpu;
1597    s->g_cpu = first_cpu;
1598    s->fd = fd;
1599    gdb_has_xml = false;
1600
1601    gdbserver_state = s;
1602
1603    fcntl(fd, F_SETFL, O_NONBLOCK);
1604}
1605
1606static int gdbserver_open(int port)
1607{
1608    struct sockaddr_in sockaddr;
1609    int fd, ret;
1610
1611    fd = socket(PF_INET, SOCK_STREAM, 0);
1612    if (fd < 0) {
1613        perror("socket");
1614        return -1;
1615    }
1616#ifndef _WIN32
1617    fcntl(fd, F_SETFD, FD_CLOEXEC);
1618#endif
1619
1620    socket_set_fast_reuse(fd);
1621
1622    sockaddr.sin_family = AF_INET;
1623    sockaddr.sin_port = htons(port);
1624    sockaddr.sin_addr.s_addr = 0;
1625    ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
1626    if (ret < 0) {
1627        perror("bind");
1628        close(fd);
1629        return -1;
1630    }
1631    ret = listen(fd, 0);
1632    if (ret < 0) {
1633        perror("listen");
1634        close(fd);
1635        return -1;
1636    }
1637    return fd;
1638}
1639
1640int gdbserver_start(int port)
1641{
1642    gdbserver_fd = gdbserver_open(port);
1643    if (gdbserver_fd < 0)
1644        return -1;
1645    /* accept connections */
1646    gdb_accept();
1647    return 0;
1648}
1649
1650/* Disable gdb stub for child processes.  */
1651void gdbserver_fork(CPUState *cpu)
1652{
1653    GDBState *s = gdbserver_state;
1654
1655    if (gdbserver_fd < 0 || s->fd < 0) {
1656        return;
1657    }
1658    close(s->fd);
1659    s->fd = -1;
1660    cpu_breakpoint_remove_all(cpu, BP_GDB);
1661    cpu_watchpoint_remove_all(cpu, BP_GDB);
1662}
1663#else
1664static int gdb_chr_can_receive(void *opaque)
1665{
1666  /* We can handle an arbitrarily large amount of data.
1667   Pick the maximum packet size, which is as good as anything.  */
1668  return MAX_PACKET_LENGTH;
1669}
1670
1671static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
1672{
1673    int i;
1674
1675    for (i = 0; i < size; i++) {
1676        gdb_read_byte(gdbserver_state, buf[i]);
1677    }
1678}
1679
1680static void gdb_chr_event(void *opaque, int event)
1681{
1682    switch (event) {
1683    case CHR_EVENT_OPENED:
1684        vm_stop(RUN_STATE_PAUSED);
1685        gdb_has_xml = false;
1686        break;
1687    default:
1688        break;
1689    }
1690}
1691
1692static void gdb_monitor_output(GDBState *s, const char *msg, int len)
1693{
1694    char buf[MAX_PACKET_LENGTH];
1695
1696    buf[0] = 'O';
1697    if (len > (MAX_PACKET_LENGTH/2) - 1)
1698        len = (MAX_PACKET_LENGTH/2) - 1;
1699    memtohex(buf + 1, (uint8_t *)msg, len);
1700    put_packet(s, buf);
1701}
1702
1703static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
1704{
1705    const char *p = (const char *)buf;
1706    int max_sz;
1707
1708    max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
1709    for (;;) {
1710        if (len <= max_sz) {
1711            gdb_monitor_output(gdbserver_state, p, len);
1712            break;
1713        }
1714        gdb_monitor_output(gdbserver_state, p, max_sz);
1715        p += max_sz;
1716        len -= max_sz;
1717    }
1718    return len;
1719}
1720
1721#ifndef _WIN32
1722static void gdb_sigterm_handler(int signal)
1723{
1724    if (runstate_is_running()) {
1725        vm_stop(RUN_STATE_PAUSED);
1726    }
1727}
1728#endif
1729
1730int gdbserver_start(const char *device)
1731{
1732    GDBState *s;
1733    char gdbstub_device_name[128];
1734    CharDriverState *chr = NULL;
1735    CharDriverState *mon_chr;
1736    ChardevCommon common = { 0 };
1737
1738    if (!device)
1739        return -1;
1740    if (strcmp(device, "none") != 0) {
1741        if (strstart(device, "tcp:", NULL)) {
1742            /* enforce required TCP attributes */
1743            snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
1744                     "%s,nowait,nodelay,server", device);
1745            device = gdbstub_device_name;
1746        }
1747#ifndef _WIN32
1748        else if (strcmp(device, "stdio") == 0) {
1749            struct sigaction act;
1750
1751            memset(&act, 0, sizeof(act));
1752            act.sa_handler = gdb_sigterm_handler;
1753            sigaction(SIGINT, &act, NULL);
1754        }
1755#endif
1756        chr = qemu_chr_new_noreplay("gdb", device, NULL);
1757        if (!chr)
1758            return -1;
1759
1760        qemu_chr_fe_claim_no_fail(chr);
1761        qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
1762                              gdb_chr_event, NULL);
1763    }
1764
1765    s = gdbserver_state;
1766    if (!s) {
1767        s = g_malloc0(sizeof(GDBState));
1768        gdbserver_state = s;
1769
1770        qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
1771
1772        /* Initialize a monitor terminal for gdb */
1773        mon_chr = qemu_chr_alloc(&common, &error_abort);
1774        mon_chr->chr_write = gdb_monitor_write;
1775        monitor_init(mon_chr, 0);
1776    } else {
1777        if (s->chr)
1778            qemu_chr_delete(s->chr);
1779        mon_chr = s->mon_chr;
1780        memset(s, 0, sizeof(GDBState));
1781    }
1782    s->c_cpu = first_cpu;
1783    s->g_cpu = first_cpu;
1784    s->chr = chr;
1785    s->state = chr ? RS_IDLE : RS_INACTIVE;
1786    s->mon_chr = mon_chr;
1787    s->current_syscall_cb = NULL;
1788
1789    return 0;
1790}
1791#endif
1792