qemu/gdbstub.c
<<
>>
Prefs
   1/*
   2 * gdb server stub
   3 *
   4 * Copyright (c) 2003-2005 Fabrice Bellard
   5 *
   6 * This library is free software; you can redistribute it and/or
   7 * modify it under the terms of the GNU Lesser General Public
   8 * License as published by the Free Software Foundation; either
   9 * version 2 of the License, or (at your option) any later version.
  10 *
  11 * This library is distributed in the hope that it will be useful,
  12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14 * Lesser General Public License for more details.
  15 *
  16 * You should have received a copy of the GNU Lesser General Public
  17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18 */
  19#include "qemu/osdep.h"
  20#include "qapi/error.h"
  21#include "qemu/error-report.h"
  22#include "qemu/cutils.h"
  23#include "trace-root.h"
  24#ifdef CONFIG_USER_ONLY
  25#include "qemu.h"
  26#else
  27#include "monitor/monitor.h"
  28#include "chardev/char.h"
  29#include "chardev/char-fe.h"
  30#include "sysemu/sysemu.h"
  31#include "exec/gdbstub.h"
  32#include "hw/cpu/cluster.h"
  33#endif
  34
  35#define MAX_PACKET_LENGTH 4096
  36
  37#include "qemu/sockets.h"
  38#include "sysemu/hw_accel.h"
  39#include "sysemu/kvm.h"
  40#include "exec/semihost.h"
  41#include "exec/exec-all.h"
  42
  43#ifdef CONFIG_USER_ONLY
  44#define GDB_ATTACHED "0"
  45#else
  46#define GDB_ATTACHED "1"
  47#endif
  48
  49static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
  50                                         uint8_t *buf, int len, bool is_write)
  51{
  52    CPUClass *cc = CPU_GET_CLASS(cpu);
  53
  54    if (cc->memory_rw_debug) {
  55        return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
  56    }
  57    return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
  58}
  59
  60/* Return the GDB index for a given vCPU state.
  61 *
  62 * For user mode this is simply the thread id. In system mode GDB
  63 * numbers CPUs from 1 as 0 is reserved as an "any cpu" index.
  64 */
  65static inline int cpu_gdb_index(CPUState *cpu)
  66{
  67#if defined(CONFIG_USER_ONLY)
  68    TaskState *ts = (TaskState *) cpu->opaque;
  69    return ts->ts_tid;
  70#else
  71    return cpu->cpu_index + 1;
  72#endif
  73}
  74
  75enum {
  76    GDB_SIGNAL_0 = 0,
  77    GDB_SIGNAL_INT = 2,
  78    GDB_SIGNAL_QUIT = 3,
  79    GDB_SIGNAL_TRAP = 5,
  80    GDB_SIGNAL_ABRT = 6,
  81    GDB_SIGNAL_ALRM = 14,
  82    GDB_SIGNAL_IO = 23,
  83    GDB_SIGNAL_XCPU = 24,
  84    GDB_SIGNAL_UNKNOWN = 143
  85};
  86
  87#ifdef CONFIG_USER_ONLY
  88
  89/* Map target signal numbers to GDB protocol signal numbers and vice
  90 * versa.  For user emulation's currently supported systems, we can
  91 * assume most signals are defined.
  92 */
  93
  94static int gdb_signal_table[] = {
  95    0,
  96    TARGET_SIGHUP,
  97    TARGET_SIGINT,
  98    TARGET_SIGQUIT,
  99    TARGET_SIGILL,
 100    TARGET_SIGTRAP,
 101    TARGET_SIGABRT,
 102    -1, /* SIGEMT */
 103    TARGET_SIGFPE,
 104    TARGET_SIGKILL,
 105    TARGET_SIGBUS,
 106    TARGET_SIGSEGV,
 107    TARGET_SIGSYS,
 108    TARGET_SIGPIPE,
 109    TARGET_SIGALRM,
 110    TARGET_SIGTERM,
 111    TARGET_SIGURG,
 112    TARGET_SIGSTOP,
 113    TARGET_SIGTSTP,
 114    TARGET_SIGCONT,
 115    TARGET_SIGCHLD,
 116    TARGET_SIGTTIN,
 117    TARGET_SIGTTOU,
 118    TARGET_SIGIO,
 119    TARGET_SIGXCPU,
 120    TARGET_SIGXFSZ,
 121    TARGET_SIGVTALRM,
 122    TARGET_SIGPROF,
 123    TARGET_SIGWINCH,
 124    -1, /* SIGLOST */
 125    TARGET_SIGUSR1,
 126    TARGET_SIGUSR2,
 127#ifdef TARGET_SIGPWR
 128    TARGET_SIGPWR,
 129#else
 130    -1,
 131#endif
 132    -1, /* SIGPOLL */
 133    -1,
 134    -1,
 135    -1,
 136    -1,
 137    -1,
 138    -1,
 139    -1,
 140    -1,
 141    -1,
 142    -1,
 143    -1,
 144#ifdef __SIGRTMIN
 145    __SIGRTMIN + 1,
 146    __SIGRTMIN + 2,
 147    __SIGRTMIN + 3,
 148    __SIGRTMIN + 4,
 149    __SIGRTMIN + 5,
 150    __SIGRTMIN + 6,
 151    __SIGRTMIN + 7,
 152    __SIGRTMIN + 8,
 153    __SIGRTMIN + 9,
 154    __SIGRTMIN + 10,
 155    __SIGRTMIN + 11,
 156    __SIGRTMIN + 12,
 157    __SIGRTMIN + 13,
 158    __SIGRTMIN + 14,
 159    __SIGRTMIN + 15,
 160    __SIGRTMIN + 16,
 161    __SIGRTMIN + 17,
 162    __SIGRTMIN + 18,
 163    __SIGRTMIN + 19,
 164    __SIGRTMIN + 20,
 165    __SIGRTMIN + 21,
 166    __SIGRTMIN + 22,
 167    __SIGRTMIN + 23,
 168    __SIGRTMIN + 24,
 169    __SIGRTMIN + 25,
 170    __SIGRTMIN + 26,
 171    __SIGRTMIN + 27,
 172    __SIGRTMIN + 28,
 173    __SIGRTMIN + 29,
 174    __SIGRTMIN + 30,
 175    __SIGRTMIN + 31,
 176    -1, /* SIGCANCEL */
 177    __SIGRTMIN,
 178    __SIGRTMIN + 32,
 179    __SIGRTMIN + 33,
 180    __SIGRTMIN + 34,
 181    __SIGRTMIN + 35,
 182    __SIGRTMIN + 36,
 183    __SIGRTMIN + 37,
 184    __SIGRTMIN + 38,
 185    __SIGRTMIN + 39,
 186    __SIGRTMIN + 40,
 187    __SIGRTMIN + 41,
 188    __SIGRTMIN + 42,
 189    __SIGRTMIN + 43,
 190    __SIGRTMIN + 44,
 191    __SIGRTMIN + 45,
 192    __SIGRTMIN + 46,
 193    __SIGRTMIN + 47,
 194    __SIGRTMIN + 48,
 195    __SIGRTMIN + 49,
 196    __SIGRTMIN + 50,
 197    __SIGRTMIN + 51,
 198    __SIGRTMIN + 52,
 199    __SIGRTMIN + 53,
 200    __SIGRTMIN + 54,
 201    __SIGRTMIN + 55,
 202    __SIGRTMIN + 56,
 203    __SIGRTMIN + 57,
 204    __SIGRTMIN + 58,
 205    __SIGRTMIN + 59,
 206    __SIGRTMIN + 60,
 207    __SIGRTMIN + 61,
 208    __SIGRTMIN + 62,
 209    __SIGRTMIN + 63,
 210    __SIGRTMIN + 64,
 211    __SIGRTMIN + 65,
 212    __SIGRTMIN + 66,
 213    __SIGRTMIN + 67,
 214    __SIGRTMIN + 68,
 215    __SIGRTMIN + 69,
 216    __SIGRTMIN + 70,
 217    __SIGRTMIN + 71,
 218    __SIGRTMIN + 72,
 219    __SIGRTMIN + 73,
 220    __SIGRTMIN + 74,
 221    __SIGRTMIN + 75,
 222    __SIGRTMIN + 76,
 223    __SIGRTMIN + 77,
 224    __SIGRTMIN + 78,
 225    __SIGRTMIN + 79,
 226    __SIGRTMIN + 80,
 227    __SIGRTMIN + 81,
 228    __SIGRTMIN + 82,
 229    __SIGRTMIN + 83,
 230    __SIGRTMIN + 84,
 231    __SIGRTMIN + 85,
 232    __SIGRTMIN + 86,
 233    __SIGRTMIN + 87,
 234    __SIGRTMIN + 88,
 235    __SIGRTMIN + 89,
 236    __SIGRTMIN + 90,
 237    __SIGRTMIN + 91,
 238    __SIGRTMIN + 92,
 239    __SIGRTMIN + 93,
 240    __SIGRTMIN + 94,
 241    __SIGRTMIN + 95,
 242    -1, /* SIGINFO */
 243    -1, /* UNKNOWN */
 244    -1, /* DEFAULT */
 245    -1,
 246    -1,
 247    -1,
 248    -1,
 249    -1,
 250    -1
 251#endif
 252};
 253#else
 254/* In system mode we only need SIGINT and SIGTRAP; other signals
 255   are not yet supported.  */
 256
 257enum {
 258    TARGET_SIGINT = 2,
 259    TARGET_SIGTRAP = 5
 260};
 261
 262static int gdb_signal_table[] = {
 263    -1,
 264    -1,
 265    TARGET_SIGINT,
 266    -1,
 267    -1,
 268    TARGET_SIGTRAP
 269};
 270#endif
 271
 272#ifdef CONFIG_USER_ONLY
 273static int target_signal_to_gdb (int sig)
 274{
 275    int i;
 276    for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 277        if (gdb_signal_table[i] == sig)
 278            return i;
 279    return GDB_SIGNAL_UNKNOWN;
 280}
 281#endif
 282
 283static int gdb_signal_to_target (int sig)
 284{
 285    if (sig < ARRAY_SIZE (gdb_signal_table))
 286        return gdb_signal_table[sig];
 287    else
 288        return -1;
 289}
 290
 291typedef struct GDBRegisterState {
 292    int base_reg;
 293    int num_regs;
 294    gdb_reg_cb get_reg;
 295    gdb_reg_cb set_reg;
 296    const char *xml;
 297    struct GDBRegisterState *next;
 298} GDBRegisterState;
 299
 300typedef struct GDBProcess {
 301    uint32_t pid;
 302    bool attached;
 303
 304    char target_xml[1024];
 305} GDBProcess;
 306
 307enum RSState {
 308    RS_INACTIVE,
 309    RS_IDLE,
 310    RS_GETLINE,
 311    RS_GETLINE_ESC,
 312    RS_GETLINE_RLE,
 313    RS_CHKSUM1,
 314    RS_CHKSUM2,
 315};
 316typedef struct GDBState {
 317    CPUState *c_cpu; /* current CPU for step/continue ops */
 318    CPUState *g_cpu; /* current CPU for other ops */
 319    CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 320    enum RSState state; /* parsing state */
 321    char line_buf[MAX_PACKET_LENGTH];
 322    int line_buf_index;
 323    int line_sum; /* running checksum */
 324    int line_csum; /* checksum at the end of the packet */
 325    uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 326    int last_packet_len;
 327    int signal;
 328#ifdef CONFIG_USER_ONLY
 329    int fd;
 330    int running_state;
 331#else
 332    CharBackend chr;
 333    Chardev *mon_chr;
 334#endif
 335    bool multiprocess;
 336    GDBProcess *processes;
 337    int process_num;
 338    char syscall_buf[256];
 339    gdb_syscall_complete_cb current_syscall_cb;
 340} GDBState;
 341
 342/* By default use no IRQs and no timers while single stepping so as to
 343 * make single stepping like an ICE HW step.
 344 */
 345static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 346
 347static GDBState *gdbserver_state;
 348
 349bool gdb_has_xml;
 350
 351#ifdef CONFIG_USER_ONLY
 352/* XXX: This is not thread safe.  Do we care?  */
 353static int gdbserver_fd = -1;
 354
 355static int get_char(GDBState *s)
 356{
 357    uint8_t ch;
 358    int ret;
 359
 360    for(;;) {
 361        ret = qemu_recv(s->fd, &ch, 1, 0);
 362        if (ret < 0) {
 363            if (errno == ECONNRESET)
 364                s->fd = -1;
 365            if (errno != EINTR)
 366                return -1;
 367        } else if (ret == 0) {
 368            close(s->fd);
 369            s->fd = -1;
 370            return -1;
 371        } else {
 372            break;
 373        }
 374    }
 375    return ch;
 376}
 377#endif
 378
 379static enum {
 380    GDB_SYS_UNKNOWN,
 381    GDB_SYS_ENABLED,
 382    GDB_SYS_DISABLED,
 383} gdb_syscall_mode;
 384
 385/* Decide if either remote gdb syscalls or native file IO should be used. */
 386int use_gdb_syscalls(void)
 387{
 388    SemihostingTarget target = semihosting_get_target();
 389    if (target == SEMIHOSTING_TARGET_NATIVE) {
 390        /* -semihosting-config target=native */
 391        return false;
 392    } else if (target == SEMIHOSTING_TARGET_GDB) {
 393        /* -semihosting-config target=gdb */
 394        return true;
 395    }
 396
 397    /* -semihosting-config target=auto */
 398    /* On the first call check if gdb is connected and remember. */
 399    if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 400        gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 401                                            : GDB_SYS_DISABLED);
 402    }
 403    return gdb_syscall_mode == GDB_SYS_ENABLED;
 404}
 405
 406/* Resume execution.  */
 407static inline void gdb_continue(GDBState *s)
 408{
 409
 410#ifdef CONFIG_USER_ONLY
 411    s->running_state = 1;
 412    trace_gdbstub_op_continue();
 413#else
 414    if (!runstate_needs_reset()) {
 415        trace_gdbstub_op_continue();
 416        vm_start();
 417    }
 418#endif
 419}
 420
 421/*
 422 * Resume execution, per CPU actions. For user-mode emulation it's
 423 * equivalent to gdb_continue.
 424 */
 425static int gdb_continue_partial(GDBState *s, char *newstates)
 426{
 427    CPUState *cpu;
 428    int res = 0;
 429#ifdef CONFIG_USER_ONLY
 430    /*
 431     * This is not exactly accurate, but it's an improvement compared to the
 432     * previous situation, where only one CPU would be single-stepped.
 433     */
 434    CPU_FOREACH(cpu) {
 435        if (newstates[cpu->cpu_index] == 's') {
 436            trace_gdbstub_op_stepping(cpu->cpu_index);
 437            cpu_single_step(cpu, sstep_flags);
 438        }
 439    }
 440    s->running_state = 1;
 441#else
 442    int flag = 0;
 443
 444    if (!runstate_needs_reset()) {
 445        if (vm_prepare_start()) {
 446            return 0;
 447        }
 448
 449        CPU_FOREACH(cpu) {
 450            switch (newstates[cpu->cpu_index]) {
 451            case 0:
 452            case 1:
 453                break; /* nothing to do here */
 454            case 's':
 455                trace_gdbstub_op_stepping(cpu->cpu_index);
 456                cpu_single_step(cpu, sstep_flags);
 457                cpu_resume(cpu);
 458                flag = 1;
 459                break;
 460            case 'c':
 461                trace_gdbstub_op_continue_cpu(cpu->cpu_index);
 462                cpu_resume(cpu);
 463                flag = 1;
 464                break;
 465            default:
 466                res = -1;
 467                break;
 468            }
 469        }
 470    }
 471    if (flag) {
 472        qemu_clock_enable(QEMU_CLOCK_VIRTUAL, true);
 473    }
 474#endif
 475    return res;
 476}
 477
 478static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 479{
 480#ifdef CONFIG_USER_ONLY
 481    int ret;
 482
 483    while (len > 0) {
 484        ret = send(s->fd, buf, len, 0);
 485        if (ret < 0) {
 486            if (errno != EINTR)
 487                return;
 488        } else {
 489            buf += ret;
 490            len -= ret;
 491        }
 492    }
 493#else
 494    /* XXX this blocks entire thread. Rewrite to use
 495     * qemu_chr_fe_write and background I/O callbacks */
 496    qemu_chr_fe_write_all(&s->chr, buf, len);
 497#endif
 498}
 499
 500static inline int fromhex(int v)
 501{
 502    if (v >= '0' && v <= '9')
 503        return v - '0';
 504    else if (v >= 'A' && v <= 'F')
 505        return v - 'A' + 10;
 506    else if (v >= 'a' && v <= 'f')
 507        return v - 'a' + 10;
 508    else
 509        return 0;
 510}
 511
 512static inline int tohex(int v)
 513{
 514    if (v < 10)
 515        return v + '0';
 516    else
 517        return v - 10 + 'a';
 518}
 519
 520/* writes 2*len+1 bytes in buf */
 521static void memtohex(char *buf, const uint8_t *mem, int len)
 522{
 523    int i, c;
 524    char *q;
 525    q = buf;
 526    for(i = 0; i < len; i++) {
 527        c = mem[i];
 528        *q++ = tohex(c >> 4);
 529        *q++ = tohex(c & 0xf);
 530    }
 531    *q = '\0';
 532}
 533
 534static void hextomem(uint8_t *mem, const char *buf, int len)
 535{
 536    int i;
 537
 538    for(i = 0; i < len; i++) {
 539        mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 540        buf += 2;
 541    }
 542}
 543
 544static void hexdump(const char *buf, int len,
 545                    void (*trace_fn)(size_t ofs, char const *text))
 546{
 547    char line_buffer[3 * 16 + 4 + 16 + 1];
 548
 549    size_t i;
 550    for (i = 0; i < len || (i & 0xF); ++i) {
 551        size_t byte_ofs = i & 15;
 552
 553        if (byte_ofs == 0) {
 554            memset(line_buffer, ' ', 3 * 16 + 4 + 16);
 555            line_buffer[3 * 16 + 4 + 16] = 0;
 556        }
 557
 558        size_t col_group = (i >> 2) & 3;
 559        size_t hex_col = byte_ofs * 3 + col_group;
 560        size_t txt_col = 3 * 16 + 4 + byte_ofs;
 561
 562        if (i < len) {
 563            char value = buf[i];
 564
 565            line_buffer[hex_col + 0] = tohex((value >> 4) & 0xF);
 566            line_buffer[hex_col + 1] = tohex((value >> 0) & 0xF);
 567            line_buffer[txt_col + 0] = (value >= ' ' && value < 127)
 568                    ? value
 569                    : '.';
 570        }
 571
 572        if (byte_ofs == 0xF)
 573            trace_fn(i & -16, line_buffer);
 574    }
 575}
 576
 577/* return -1 if error, 0 if OK */
 578static int put_packet_binary(GDBState *s, const char *buf, int len, bool dump)
 579{
 580    int csum, i;
 581    uint8_t *p;
 582
 583    if (dump && trace_event_get_state_backends(TRACE_GDBSTUB_IO_BINARYREPLY)) {
 584        hexdump(buf, len, trace_gdbstub_io_binaryreply);
 585    }
 586
 587    for(;;) {
 588        p = s->last_packet;
 589        *(p++) = '$';
 590        memcpy(p, buf, len);
 591        p += len;
 592        csum = 0;
 593        for(i = 0; i < len; i++) {
 594            csum += buf[i];
 595        }
 596        *(p++) = '#';
 597        *(p++) = tohex((csum >> 4) & 0xf);
 598        *(p++) = tohex((csum) & 0xf);
 599
 600        s->last_packet_len = p - s->last_packet;
 601        put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 602
 603#ifdef CONFIG_USER_ONLY
 604        i = get_char(s);
 605        if (i < 0)
 606            return -1;
 607        if (i == '+')
 608            break;
 609#else
 610        break;
 611#endif
 612    }
 613    return 0;
 614}
 615
 616/* return -1 if error, 0 if OK */
 617static int put_packet(GDBState *s, const char *buf)
 618{
 619    trace_gdbstub_io_reply(buf);
 620
 621    return put_packet_binary(s, buf, strlen(buf), false);
 622}
 623
 624/* Encode data using the encoding for 'x' packets.  */
 625static int memtox(char *buf, const char *mem, int len)
 626{
 627    char *p = buf;
 628    char c;
 629
 630    while (len--) {
 631        c = *(mem++);
 632        switch (c) {
 633        case '#': case '$': case '*': case '}':
 634            *(p++) = '}';
 635            *(p++) = c ^ 0x20;
 636            break;
 637        default:
 638            *(p++) = c;
 639            break;
 640        }
 641    }
 642    return p - buf;
 643}
 644
 645static uint32_t gdb_get_cpu_pid(const GDBState *s, CPUState *cpu)
 646{
 647    /* TODO: In user mode, we should use the task state PID */
 648    if (cpu->cluster_index == UNASSIGNED_CLUSTER_INDEX) {
 649        /* Return the default process' PID */
 650        return s->processes[s->process_num - 1].pid;
 651    }
 652    return cpu->cluster_index + 1;
 653}
 654
 655static GDBProcess *gdb_get_process(const GDBState *s, uint32_t pid)
 656{
 657    int i;
 658
 659    if (!pid) {
 660        /* 0 means any process, we take the first one */
 661        return &s->processes[0];
 662    }
 663
 664    for (i = 0; i < s->process_num; i++) {
 665        if (s->processes[i].pid == pid) {
 666            return &s->processes[i];
 667        }
 668    }
 669
 670    return NULL;
 671}
 672
 673static GDBProcess *gdb_get_cpu_process(const GDBState *s, CPUState *cpu)
 674{
 675    return gdb_get_process(s, gdb_get_cpu_pid(s, cpu));
 676}
 677
 678static CPUState *find_cpu(uint32_t thread_id)
 679{
 680    CPUState *cpu;
 681
 682    CPU_FOREACH(cpu) {
 683        if (cpu_gdb_index(cpu) == thread_id) {
 684            return cpu;
 685        }
 686    }
 687
 688    return NULL;
 689}
 690
 691static CPUState *get_first_cpu_in_process(const GDBState *s,
 692                                          GDBProcess *process)
 693{
 694    CPUState *cpu;
 695
 696    CPU_FOREACH(cpu) {
 697        if (gdb_get_cpu_pid(s, cpu) == process->pid) {
 698            return cpu;
 699        }
 700    }
 701
 702    return NULL;
 703}
 704
 705static CPUState *gdb_next_cpu_in_process(const GDBState *s, CPUState *cpu)
 706{
 707    uint32_t pid = gdb_get_cpu_pid(s, cpu);
 708    cpu = CPU_NEXT(cpu);
 709
 710    while (cpu) {
 711        if (gdb_get_cpu_pid(s, cpu) == pid) {
 712            break;
 713        }
 714
 715        cpu = CPU_NEXT(cpu);
 716    }
 717
 718    return cpu;
 719}
 720
 721/* Return the cpu following @cpu, while ignoring unattached processes. */
 722static CPUState *gdb_next_attached_cpu(const GDBState *s, CPUState *cpu)
 723{
 724    cpu = CPU_NEXT(cpu);
 725
 726    while (cpu) {
 727        if (gdb_get_cpu_process(s, cpu)->attached) {
 728            break;
 729        }
 730
 731        cpu = CPU_NEXT(cpu);
 732    }
 733
 734    return cpu;
 735}
 736
 737/* Return the first attached cpu */
 738static CPUState *gdb_first_attached_cpu(const GDBState *s)
 739{
 740    CPUState *cpu = first_cpu;
 741    GDBProcess *process = gdb_get_cpu_process(s, cpu);
 742
 743    if (!process->attached) {
 744        return gdb_next_attached_cpu(s, cpu);
 745    }
 746
 747    return cpu;
 748}
 749
 750static CPUState *gdb_get_cpu(const GDBState *s, uint32_t pid, uint32_t tid)
 751{
 752    GDBProcess *process;
 753    CPUState *cpu;
 754
 755    if (!pid && !tid) {
 756        /* 0 means any process/thread, we take the first attached one */
 757        return gdb_first_attached_cpu(s);
 758    } else if (pid && !tid) {
 759        /* any thread in a specific process */
 760        process = gdb_get_process(s, pid);
 761
 762        if (process == NULL) {
 763            return NULL;
 764        }
 765
 766        if (!process->attached) {
 767            return NULL;
 768        }
 769
 770        return get_first_cpu_in_process(s, process);
 771    } else {
 772        /* a specific thread */
 773        cpu = find_cpu(tid);
 774
 775        if (cpu == NULL) {
 776            return NULL;
 777        }
 778
 779        process = gdb_get_cpu_process(s, cpu);
 780
 781        if (pid && process->pid != pid) {
 782            return NULL;
 783        }
 784
 785        if (!process->attached) {
 786            return NULL;
 787        }
 788
 789        return cpu;
 790    }
 791}
 792
 793static const char *get_feature_xml(const GDBState *s, const char *p,
 794                                   const char **newp, GDBProcess *process)
 795{
 796    size_t len;
 797    int i;
 798    const char *name;
 799    CPUState *cpu = get_first_cpu_in_process(s, process);
 800    CPUClass *cc = CPU_GET_CLASS(cpu);
 801
 802    len = 0;
 803    while (p[len] && p[len] != ':')
 804        len++;
 805    *newp = p + len;
 806
 807    name = NULL;
 808    if (strncmp(p, "target.xml", len) == 0) {
 809        char *buf = process->target_xml;
 810        const size_t buf_sz = sizeof(process->target_xml);
 811
 812        /* Generate the XML description for this CPU.  */
 813        if (!buf[0]) {
 814            GDBRegisterState *r;
 815
 816            pstrcat(buf, buf_sz,
 817                    "<?xml version=\"1.0\"?>"
 818                    "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
 819                    "<target>");
 820            if (cc->gdb_arch_name) {
 821                gchar *arch = cc->gdb_arch_name(cpu);
 822                pstrcat(buf, buf_sz, "<architecture>");
 823                pstrcat(buf, buf_sz, arch);
 824                pstrcat(buf, buf_sz, "</architecture>");
 825                g_free(arch);
 826            }
 827            pstrcat(buf, buf_sz, "<xi:include href=\"");
 828            pstrcat(buf, buf_sz, cc->gdb_core_xml_file);
 829            pstrcat(buf, buf_sz, "\"/>");
 830            for (r = cpu->gdb_regs; r; r = r->next) {
 831                pstrcat(buf, buf_sz, "<xi:include href=\"");
 832                pstrcat(buf, buf_sz, r->xml);
 833                pstrcat(buf, buf_sz, "\"/>");
 834            }
 835            pstrcat(buf, buf_sz, "</target>");
 836        }
 837        return buf;
 838    }
 839    if (cc->gdb_get_dynamic_xml) {
 840        char *xmlname = g_strndup(p, len);
 841        const char *xml = cc->gdb_get_dynamic_xml(cpu, xmlname);
 842
 843        g_free(xmlname);
 844        if (xml) {
 845            return xml;
 846        }
 847    }
 848    for (i = 0; ; i++) {
 849        name = xml_builtin[i][0];
 850        if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
 851            break;
 852    }
 853    return name ? xml_builtin[i][1] : NULL;
 854}
 855
 856static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 857{
 858    CPUClass *cc = CPU_GET_CLASS(cpu);
 859    CPUArchState *env = cpu->env_ptr;
 860    GDBRegisterState *r;
 861
 862    if (reg < cc->gdb_num_core_regs) {
 863        return cc->gdb_read_register(cpu, mem_buf, reg);
 864    }
 865
 866    for (r = cpu->gdb_regs; r; r = r->next) {
 867        if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 868            return r->get_reg(env, mem_buf, reg - r->base_reg);
 869        }
 870    }
 871    return 0;
 872}
 873
 874static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 875{
 876    CPUClass *cc = CPU_GET_CLASS(cpu);
 877    CPUArchState *env = cpu->env_ptr;
 878    GDBRegisterState *r;
 879
 880    if (reg < cc->gdb_num_core_regs) {
 881        return cc->gdb_write_register(cpu, mem_buf, reg);
 882    }
 883
 884    for (r = cpu->gdb_regs; r; r = r->next) {
 885        if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 886            return r->set_reg(env, mem_buf, reg - r->base_reg);
 887        }
 888    }
 889    return 0;
 890}
 891
 892/* Register a supplemental set of CPU registers.  If g_pos is nonzero it
 893   specifies the first register number and these registers are included in
 894   a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
 895   gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
 896 */
 897
 898void gdb_register_coprocessor(CPUState *cpu,
 899                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
 900                              int num_regs, const char *xml, int g_pos)
 901{
 902    GDBRegisterState *s;
 903    GDBRegisterState **p;
 904
 905    p = &cpu->gdb_regs;
 906    while (*p) {
 907        /* Check for duplicates.  */
 908        if (strcmp((*p)->xml, xml) == 0)
 909            return;
 910        p = &(*p)->next;
 911    }
 912
 913    s = g_new0(GDBRegisterState, 1);
 914    s->base_reg = cpu->gdb_num_regs;
 915    s->num_regs = num_regs;
 916    s->get_reg = get_reg;
 917    s->set_reg = set_reg;
 918    s->xml = xml;
 919
 920    /* Add to end of list.  */
 921    cpu->gdb_num_regs += num_regs;
 922    *p = s;
 923    if (g_pos) {
 924        if (g_pos != s->base_reg) {
 925            error_report("Error: Bad gdb register numbering for '%s', "
 926                         "expected %d got %d", xml, g_pos, s->base_reg);
 927        } else {
 928            cpu->gdb_num_g_regs = cpu->gdb_num_regs;
 929        }
 930    }
 931}
 932
 933#ifndef CONFIG_USER_ONLY
 934/* Translate GDB watchpoint type to a flags value for cpu_watchpoint_* */
 935static inline int xlat_gdb_type(CPUState *cpu, int gdbtype)
 936{
 937    static const int xlat[] = {
 938        [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
 939        [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
 940        [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
 941    };
 942
 943    CPUClass *cc = CPU_GET_CLASS(cpu);
 944    int cputype = xlat[gdbtype];
 945
 946    if (cc->gdb_stop_before_watchpoint) {
 947        cputype |= BP_STOP_BEFORE_ACCESS;
 948    }
 949    return cputype;
 950}
 951#endif
 952
 953static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
 954{
 955    CPUState *cpu;
 956    int err = 0;
 957
 958    if (kvm_enabled()) {
 959        return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 960    }
 961
 962    switch (type) {
 963    case GDB_BREAKPOINT_SW:
 964    case GDB_BREAKPOINT_HW:
 965        CPU_FOREACH(cpu) {
 966            err = cpu_breakpoint_insert(cpu, addr, BP_GDB, NULL);
 967            if (err) {
 968                break;
 969            }
 970        }
 971        return err;
 972#ifndef CONFIG_USER_ONLY
 973    case GDB_WATCHPOINT_WRITE:
 974    case GDB_WATCHPOINT_READ:
 975    case GDB_WATCHPOINT_ACCESS:
 976        CPU_FOREACH(cpu) {
 977            err = cpu_watchpoint_insert(cpu, addr, len,
 978                                        xlat_gdb_type(cpu, type), NULL);
 979            if (err) {
 980                break;
 981            }
 982        }
 983        return err;
 984#endif
 985    default:
 986        return -ENOSYS;
 987    }
 988}
 989
 990static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
 991{
 992    CPUState *cpu;
 993    int err = 0;
 994
 995    if (kvm_enabled()) {
 996        return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 997    }
 998
 999    switch (type) {
1000    case GDB_BREAKPOINT_SW:
1001    case GDB_BREAKPOINT_HW:
1002        CPU_FOREACH(cpu) {
1003            err = cpu_breakpoint_remove(cpu, addr, BP_GDB);
1004            if (err) {
1005                break;
1006            }
1007        }
1008        return err;
1009#ifndef CONFIG_USER_ONLY
1010    case GDB_WATCHPOINT_WRITE:
1011    case GDB_WATCHPOINT_READ:
1012    case GDB_WATCHPOINT_ACCESS:
1013        CPU_FOREACH(cpu) {
1014            err = cpu_watchpoint_remove(cpu, addr, len,
1015                                        xlat_gdb_type(cpu, type));
1016            if (err)
1017                break;
1018        }
1019        return err;
1020#endif
1021    default:
1022        return -ENOSYS;
1023    }
1024}
1025
1026static inline void gdb_cpu_breakpoint_remove_all(CPUState *cpu)
1027{
1028    cpu_breakpoint_remove_all(cpu, BP_GDB);
1029#ifndef CONFIG_USER_ONLY
1030    cpu_watchpoint_remove_all(cpu, BP_GDB);
1031#endif
1032}
1033
1034static void gdb_process_breakpoint_remove_all(const GDBState *s, GDBProcess *p)
1035{
1036    CPUState *cpu = get_first_cpu_in_process(s, p);
1037
1038    while (cpu) {
1039        gdb_cpu_breakpoint_remove_all(cpu);
1040        cpu = gdb_next_cpu_in_process(s, cpu);
1041    }
1042}
1043
1044static void gdb_breakpoint_remove_all(void)
1045{
1046    CPUState *cpu;
1047
1048    if (kvm_enabled()) {
1049        kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1050        return;
1051    }
1052
1053    CPU_FOREACH(cpu) {
1054        gdb_cpu_breakpoint_remove_all(cpu);
1055    }
1056}
1057
1058static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1059{
1060    CPUState *cpu = s->c_cpu;
1061
1062    cpu_synchronize_state(cpu);
1063    cpu_set_pc(cpu, pc);
1064}
1065
1066static char *gdb_fmt_thread_id(const GDBState *s, CPUState *cpu,
1067                           char *buf, size_t buf_size)
1068{
1069    if (s->multiprocess) {
1070        snprintf(buf, buf_size, "p%02x.%02x",
1071                 gdb_get_cpu_pid(s, cpu), cpu_gdb_index(cpu));
1072    } else {
1073        snprintf(buf, buf_size, "%02x", cpu_gdb_index(cpu));
1074    }
1075
1076    return buf;
1077}
1078
1079typedef enum GDBThreadIdKind {
1080    GDB_ONE_THREAD = 0,
1081    GDB_ALL_THREADS,     /* One process, all threads */
1082    GDB_ALL_PROCESSES,
1083    GDB_READ_THREAD_ERR
1084} GDBThreadIdKind;
1085
1086static GDBThreadIdKind read_thread_id(const char *buf, const char **end_buf,
1087                                      uint32_t *pid, uint32_t *tid)
1088{
1089    unsigned long p, t;
1090    int ret;
1091
1092    if (*buf == 'p') {
1093        buf++;
1094        ret = qemu_strtoul(buf, &buf, 16, &p);
1095
1096        if (ret) {
1097            return GDB_READ_THREAD_ERR;
1098        }
1099
1100        /* Skip '.' */
1101        buf++;
1102    } else {
1103        p = 1;
1104    }
1105
1106    ret = qemu_strtoul(buf, &buf, 16, &t);
1107
1108    if (ret) {
1109        return GDB_READ_THREAD_ERR;
1110    }
1111
1112    *end_buf = buf;
1113
1114    if (p == -1) {
1115        return GDB_ALL_PROCESSES;
1116    }
1117
1118    if (pid) {
1119        *pid = p;
1120    }
1121
1122    if (t == -1) {
1123        return GDB_ALL_THREADS;
1124    }
1125
1126    if (tid) {
1127        *tid = t;
1128    }
1129
1130    return GDB_ONE_THREAD;
1131}
1132
1133static int is_query_packet(const char *p, const char *query, char separator)
1134{
1135    unsigned int query_len = strlen(query);
1136
1137    return strncmp(p, query, query_len) == 0 &&
1138        (p[query_len] == '\0' || p[query_len] == separator);
1139}
1140
1141/**
1142 * gdb_handle_vcont - Parses and handles a vCont packet.
1143 * returns -ENOTSUP if a command is unsupported, -EINVAL or -ERANGE if there is
1144 *         a format error, 0 on success.
1145 */
1146static int gdb_handle_vcont(GDBState *s, const char *p)
1147{
1148    int res, signal = 0;
1149    char cur_action;
1150    char *newstates;
1151    unsigned long tmp;
1152    uint32_t pid, tid;
1153    GDBProcess *process;
1154    CPUState *cpu;
1155    GDBThreadIdKind kind;
1156#ifdef CONFIG_USER_ONLY
1157    int max_cpus = 1; /* global variable max_cpus exists only in system mode */
1158
1159    CPU_FOREACH(cpu) {
1160        max_cpus = max_cpus <= cpu->cpu_index ? cpu->cpu_index + 1 : max_cpus;
1161    }
1162#endif
1163    /* uninitialised CPUs stay 0 */
1164    newstates = g_new0(char, max_cpus);
1165
1166    /* mark valid CPUs with 1 */
1167    CPU_FOREACH(cpu) {
1168        newstates[cpu->cpu_index] = 1;
1169    }
1170
1171    /*
1172     * res keeps track of what error we are returning, with -ENOTSUP meaning
1173     * that the command is unknown or unsupported, thus returning an empty
1174     * packet, while -EINVAL and -ERANGE cause an E22 packet, due to invalid,
1175     *  or incorrect parameters passed.
1176     */
1177    res = 0;
1178    while (*p) {
1179        if (*p++ != ';') {
1180            res = -ENOTSUP;
1181            goto out;
1182        }
1183
1184        cur_action = *p++;
1185        if (cur_action == 'C' || cur_action == 'S') {
1186            cur_action = qemu_tolower(cur_action);
1187            res = qemu_strtoul(p + 1, &p, 16, &tmp);
1188            if (res) {
1189                goto out;
1190            }
1191            signal = gdb_signal_to_target(tmp);
1192        } else if (cur_action != 'c' && cur_action != 's') {
1193            /* unknown/invalid/unsupported command */
1194            res = -ENOTSUP;
1195            goto out;
1196        }
1197
1198        if (*p == '\0' || *p == ';') {
1199            /*
1200             * No thread specifier, action is on "all threads". The
1201             * specification is unclear regarding the process to act on. We
1202             * choose all processes.
1203             */
1204            kind = GDB_ALL_PROCESSES;
1205        } else if (*p++ == ':') {
1206            kind = read_thread_id(p, &p, &pid, &tid);
1207        } else {
1208            res = -ENOTSUP;
1209            goto out;
1210        }
1211
1212        switch (kind) {
1213        case GDB_READ_THREAD_ERR:
1214            res = -EINVAL;
1215            goto out;
1216
1217        case GDB_ALL_PROCESSES:
1218            cpu = gdb_first_attached_cpu(s);
1219            while (cpu) {
1220                if (newstates[cpu->cpu_index] == 1) {
1221                    newstates[cpu->cpu_index] = cur_action;
1222                }
1223
1224                cpu = gdb_next_attached_cpu(s, cpu);
1225            }
1226            break;
1227
1228        case GDB_ALL_THREADS:
1229            process = gdb_get_process(s, pid);
1230
1231            if (!process->attached) {
1232                res = -EINVAL;
1233                goto out;
1234            }
1235
1236            cpu = get_first_cpu_in_process(s, process);
1237            while (cpu) {
1238                if (newstates[cpu->cpu_index] == 1) {
1239                    newstates[cpu->cpu_index] = cur_action;
1240                }
1241
1242                cpu = gdb_next_cpu_in_process(s, cpu);
1243            }
1244            break;
1245
1246        case GDB_ONE_THREAD:
1247            cpu = gdb_get_cpu(s, pid, tid);
1248
1249            /* invalid CPU/thread specified */
1250            if (!cpu) {
1251                res = -EINVAL;
1252                goto out;
1253            }
1254
1255            /* only use if no previous match occourred */
1256            if (newstates[cpu->cpu_index] == 1) {
1257                newstates[cpu->cpu_index] = cur_action;
1258            }
1259            break;
1260        }
1261    }
1262    s->signal = signal;
1263    gdb_continue_partial(s, newstates);
1264
1265out:
1266    g_free(newstates);
1267
1268    return res;
1269}
1270
1271static int gdb_handle_packet(GDBState *s, const char *line_buf)
1272{
1273    CPUState *cpu;
1274    GDBProcess *process;
1275    CPUClass *cc;
1276    const char *p;
1277    uint32_t pid, tid;
1278    int ch, reg_size, type, res;
1279    uint8_t mem_buf[MAX_PACKET_LENGTH];
1280    char buf[sizeof(mem_buf) + 1 /* trailing NUL */];
1281    char thread_id[16];
1282    uint8_t *registers;
1283    target_ulong addr, len;
1284    GDBThreadIdKind thread_kind;
1285
1286    trace_gdbstub_io_command(line_buf);
1287
1288    p = line_buf;
1289    ch = *p++;
1290    switch(ch) {
1291    case '!':
1292        put_packet(s, "OK");
1293        break;
1294    case '?':
1295        /* TODO: Make this return the correct value for user-mode.  */
1296        snprintf(buf, sizeof(buf), "T%02xthread:%s;", GDB_SIGNAL_TRAP,
1297                 gdb_fmt_thread_id(s, s->c_cpu, thread_id, sizeof(thread_id)));
1298        put_packet(s, buf);
1299        /* Remove all the breakpoints when this query is issued,
1300         * because gdb is doing and initial connect and the state
1301         * should be cleaned up.
1302         */
1303        gdb_breakpoint_remove_all();
1304        break;
1305    case 'c':
1306        if (*p != '\0') {
1307            addr = strtoull(p, (char **)&p, 16);
1308            gdb_set_cpu_pc(s, addr);
1309        }
1310        s->signal = 0;
1311        gdb_continue(s);
1312        return RS_IDLE;
1313    case 'C':
1314        s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1315        if (s->signal == -1)
1316            s->signal = 0;
1317        gdb_continue(s);
1318        return RS_IDLE;
1319    case 'v':
1320        if (strncmp(p, "Cont", 4) == 0) {
1321            p += 4;
1322            if (*p == '?') {
1323                put_packet(s, "vCont;c;C;s;S");
1324                break;
1325            }
1326
1327            res = gdb_handle_vcont(s, p);
1328
1329            if (res) {
1330                if ((res == -EINVAL) || (res == -ERANGE)) {
1331                    put_packet(s, "E22");
1332                    break;
1333                }
1334                goto unknown_command;
1335            }
1336            break;
1337        } else if (strncmp(p, "Attach;", 7) == 0) {
1338            unsigned long pid;
1339
1340            p += 7;
1341
1342            if (qemu_strtoul(p, &p, 16, &pid)) {
1343                put_packet(s, "E22");
1344                break;
1345            }
1346
1347            process = gdb_get_process(s, pid);
1348
1349            if (process == NULL) {
1350                put_packet(s, "E22");
1351                break;
1352            }
1353
1354            cpu = get_first_cpu_in_process(s, process);
1355
1356            if (cpu == NULL) {
1357                /* Refuse to attach an empty process */
1358                put_packet(s, "E22");
1359                break;
1360            }
1361
1362            process->attached = true;
1363
1364            s->g_cpu = cpu;
1365            s->c_cpu = cpu;
1366
1367            snprintf(buf, sizeof(buf), "T%02xthread:%s;", GDB_SIGNAL_TRAP,
1368                     gdb_fmt_thread_id(s, cpu, thread_id, sizeof(thread_id)));
1369
1370            put_packet(s, buf);
1371            break;
1372        } else if (strncmp(p, "Kill;", 5) == 0) {
1373            /* Kill the target */
1374            put_packet(s, "OK");
1375            error_report("QEMU: Terminated via GDBstub");
1376            exit(0);
1377        } else {
1378            goto unknown_command;
1379        }
1380    case 'k':
1381        /* Kill the target */
1382        error_report("QEMU: Terminated via GDBstub");
1383        exit(0);
1384    case 'D':
1385        /* Detach packet */
1386        pid = 1;
1387
1388        if (s->multiprocess) {
1389            unsigned long lpid;
1390            if (*p != ';') {
1391                put_packet(s, "E22");
1392                break;
1393            }
1394
1395            if (qemu_strtoul(p + 1, &p, 16, &lpid)) {
1396                put_packet(s, "E22");
1397                break;
1398            }
1399
1400            pid = lpid;
1401        }
1402
1403        process = gdb_get_process(s, pid);
1404        gdb_process_breakpoint_remove_all(s, process);
1405        process->attached = false;
1406
1407        if (pid == gdb_get_cpu_pid(s, s->c_cpu)) {
1408            s->c_cpu = gdb_first_attached_cpu(s);
1409        }
1410
1411        if (pid == gdb_get_cpu_pid(s, s->g_cpu)) {
1412            s->g_cpu = gdb_first_attached_cpu(s);
1413        }
1414
1415        if (s->c_cpu == NULL) {
1416            /* No more process attached */
1417            gdb_syscall_mode = GDB_SYS_DISABLED;
1418            gdb_continue(s);
1419        }
1420        put_packet(s, "OK");
1421        break;
1422    case 's':
1423        if (*p != '\0') {
1424            addr = strtoull(p, (char **)&p, 16);
1425            gdb_set_cpu_pc(s, addr);
1426        }
1427        cpu_single_step(s->c_cpu, sstep_flags);
1428        gdb_continue(s);
1429        return RS_IDLE;
1430    case 'F':
1431        {
1432            target_ulong ret;
1433            target_ulong err;
1434
1435            ret = strtoull(p, (char **)&p, 16);
1436            if (*p == ',') {
1437                p++;
1438                err = strtoull(p, (char **)&p, 16);
1439            } else {
1440                err = 0;
1441            }
1442            if (*p == ',')
1443                p++;
1444            type = *p;
1445            if (s->current_syscall_cb) {
1446                s->current_syscall_cb(s->c_cpu, ret, err);
1447                s->current_syscall_cb = NULL;
1448            }
1449            if (type == 'C') {
1450                put_packet(s, "T02");
1451            } else {
1452                gdb_continue(s);
1453            }
1454        }
1455        break;
1456    case 'g':
1457        cpu_synchronize_state(s->g_cpu);
1458        len = 0;
1459        for (addr = 0; addr < s->g_cpu->gdb_num_g_regs; addr++) {
1460            reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1461            len += reg_size;
1462        }
1463        memtohex(buf, mem_buf, len);
1464        put_packet(s, buf);
1465        break;
1466    case 'G':
1467        cpu_synchronize_state(s->g_cpu);
1468        registers = mem_buf;
1469        len = strlen(p) / 2;
1470        hextomem((uint8_t *)registers, p, len);
1471        for (addr = 0; addr < s->g_cpu->gdb_num_g_regs && len > 0; addr++) {
1472            reg_size = gdb_write_register(s->g_cpu, registers, addr);
1473            len -= reg_size;
1474            registers += reg_size;
1475        }
1476        put_packet(s, "OK");
1477        break;
1478    case 'm':
1479        addr = strtoull(p, (char **)&p, 16);
1480        if (*p == ',')
1481            p++;
1482        len = strtoull(p, NULL, 16);
1483
1484        /* memtohex() doubles the required space */
1485        if (len > MAX_PACKET_LENGTH / 2) {
1486            put_packet (s, "E22");
1487            break;
1488        }
1489
1490        if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
1491            put_packet (s, "E14");
1492        } else {
1493            memtohex(buf, mem_buf, len);
1494            put_packet(s, buf);
1495        }
1496        break;
1497    case 'M':
1498        addr = strtoull(p, (char **)&p, 16);
1499        if (*p == ',')
1500            p++;
1501        len = strtoull(p, (char **)&p, 16);
1502        if (*p == ':')
1503            p++;
1504
1505        /* hextomem() reads 2*len bytes */
1506        if (len > strlen(p) / 2) {
1507            put_packet (s, "E22");
1508            break;
1509        }
1510        hextomem(mem_buf, p, len);
1511        if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
1512                                   true) != 0) {
1513            put_packet(s, "E14");
1514        } else {
1515            put_packet(s, "OK");
1516        }
1517        break;
1518    case 'p':
1519        /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1520           This works, but can be very slow.  Anything new enough to
1521           understand XML also knows how to use this properly.  */
1522        if (!gdb_has_xml)
1523            goto unknown_command;
1524        addr = strtoull(p, (char **)&p, 16);
1525        reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1526        if (reg_size) {
1527            memtohex(buf, mem_buf, reg_size);
1528            put_packet(s, buf);
1529        } else {
1530            put_packet(s, "E14");
1531        }
1532        break;
1533    case 'P':
1534        if (!gdb_has_xml)
1535            goto unknown_command;
1536        addr = strtoull(p, (char **)&p, 16);
1537        if (*p == '=')
1538            p++;
1539        reg_size = strlen(p) / 2;
1540        hextomem(mem_buf, p, reg_size);
1541        gdb_write_register(s->g_cpu, mem_buf, addr);
1542        put_packet(s, "OK");
1543        break;
1544    case 'Z':
1545    case 'z':
1546        type = strtoul(p, (char **)&p, 16);
1547        if (*p == ',')
1548            p++;
1549        addr = strtoull(p, (char **)&p, 16);
1550        if (*p == ',')
1551            p++;
1552        len = strtoull(p, (char **)&p, 16);
1553        if (ch == 'Z')
1554            res = gdb_breakpoint_insert(addr, len, type);
1555        else
1556            res = gdb_breakpoint_remove(addr, len, type);
1557        if (res >= 0)
1558             put_packet(s, "OK");
1559        else if (res == -ENOSYS)
1560            put_packet(s, "");
1561        else
1562            put_packet(s, "E22");
1563        break;
1564    case 'H':
1565        type = *p++;
1566
1567        thread_kind = read_thread_id(p, &p, &pid, &tid);
1568        if (thread_kind == GDB_READ_THREAD_ERR) {
1569            put_packet(s, "E22");
1570            break;
1571        }
1572
1573        if (thread_kind != GDB_ONE_THREAD) {
1574            put_packet(s, "OK");
1575            break;
1576        }
1577        cpu = gdb_get_cpu(s, pid, tid);
1578        if (cpu == NULL) {
1579            put_packet(s, "E22");
1580            break;
1581        }
1582        switch (type) {
1583        case 'c':
1584            s->c_cpu = cpu;
1585            put_packet(s, "OK");
1586            break;
1587        case 'g':
1588            s->g_cpu = cpu;
1589            put_packet(s, "OK");
1590            break;
1591        default:
1592             put_packet(s, "E22");
1593             break;
1594        }
1595        break;
1596    case 'T':
1597        thread_kind = read_thread_id(p, &p, &pid, &tid);
1598        if (thread_kind == GDB_READ_THREAD_ERR) {
1599            put_packet(s, "E22");
1600            break;
1601        }
1602        cpu = gdb_get_cpu(s, pid, tid);
1603
1604        if (cpu != NULL) {
1605            put_packet(s, "OK");
1606        } else {
1607            put_packet(s, "E22");
1608        }
1609        break;
1610    case 'q':
1611    case 'Q':
1612        /* parse any 'q' packets here */
1613        if (!strcmp(p,"qemu.sstepbits")) {
1614            /* Query Breakpoint bit definitions */
1615            snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1616                     SSTEP_ENABLE,
1617                     SSTEP_NOIRQ,
1618                     SSTEP_NOTIMER);
1619            put_packet(s, buf);
1620            break;
1621        } else if (is_query_packet(p, "qemu.sstep", '=')) {
1622            /* Display or change the sstep_flags */
1623            p += 10;
1624            if (*p != '=') {
1625                /* Display current setting */
1626                snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1627                put_packet(s, buf);
1628                break;
1629            }
1630            p++;
1631            type = strtoul(p, (char **)&p, 16);
1632            sstep_flags = type;
1633            put_packet(s, "OK");
1634            break;
1635        } else if (strcmp(p,"C") == 0) {
1636            /*
1637             * "Current thread" remains vague in the spec, so always return
1638             * the first thread of the current process (gdb returns the
1639             * first thread).
1640             */
1641            cpu = get_first_cpu_in_process(s, gdb_get_cpu_process(s, s->g_cpu));
1642            snprintf(buf, sizeof(buf), "QC%s",
1643                     gdb_fmt_thread_id(s, cpu, thread_id, sizeof(thread_id)));
1644            put_packet(s, buf);
1645            break;
1646        } else if (strcmp(p,"fThreadInfo") == 0) {
1647            s->query_cpu = gdb_first_attached_cpu(s);
1648            goto report_cpuinfo;
1649        } else if (strcmp(p,"sThreadInfo") == 0) {
1650        report_cpuinfo:
1651            if (s->query_cpu) {
1652                snprintf(buf, sizeof(buf), "m%s",
1653                         gdb_fmt_thread_id(s, s->query_cpu,
1654                                       thread_id, sizeof(thread_id)));
1655                put_packet(s, buf);
1656                s->query_cpu = gdb_next_attached_cpu(s, s->query_cpu);
1657            } else
1658                put_packet(s, "l");
1659            break;
1660        } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1661            if (read_thread_id(p + 16, &p, &pid, &tid) == GDB_READ_THREAD_ERR) {
1662                put_packet(s, "E22");
1663                break;
1664            }
1665            cpu = gdb_get_cpu(s, pid, tid);
1666            if (cpu != NULL) {
1667                cpu_synchronize_state(cpu);
1668
1669                if (s->multiprocess && (s->process_num > 1)) {
1670                    /* Print the CPU model and name in multiprocess mode */
1671                    ObjectClass *oc = object_get_class(OBJECT(cpu));
1672                    const char *cpu_model = object_class_get_name(oc);
1673                    char *cpu_name =
1674                        object_get_canonical_path_component(OBJECT(cpu));
1675                    len = snprintf((char *)mem_buf, sizeof(buf) / 2,
1676                                   "%s %s [%s]", cpu_model, cpu_name,
1677                                   cpu->halted ? "halted " : "running");
1678                    g_free(cpu_name);
1679                } else {
1680                    /* memtohex() doubles the required space */
1681                    len = snprintf((char *)mem_buf, sizeof(buf) / 2,
1682                                   "CPU#%d [%s]", cpu->cpu_index,
1683                                   cpu->halted ? "halted " : "running");
1684                }
1685                trace_gdbstub_op_extra_info((char *)mem_buf);
1686                memtohex(buf, mem_buf, len);
1687                put_packet(s, buf);
1688            }
1689            break;
1690        }
1691#ifdef CONFIG_USER_ONLY
1692        else if (strcmp(p, "Offsets") == 0) {
1693            TaskState *ts = s->c_cpu->opaque;
1694
1695            snprintf(buf, sizeof(buf),
1696                     "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1697                     ";Bss=" TARGET_ABI_FMT_lx,
1698                     ts->info->code_offset,
1699                     ts->info->data_offset,
1700                     ts->info->data_offset);
1701            put_packet(s, buf);
1702            break;
1703        }
1704#else /* !CONFIG_USER_ONLY */
1705        else if (strncmp(p, "Rcmd,", 5) == 0) {
1706            int len = strlen(p + 5);
1707
1708            if ((len % 2) != 0) {
1709                put_packet(s, "E01");
1710                break;
1711            }
1712            len = len / 2;
1713            hextomem(mem_buf, p + 5, len);
1714            mem_buf[len++] = 0;
1715            qemu_chr_be_write(s->mon_chr, mem_buf, len);
1716            put_packet(s, "OK");
1717            break;
1718        }
1719#endif /* !CONFIG_USER_ONLY */
1720        if (is_query_packet(p, "Supported", ':')) {
1721            snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1722            cc = CPU_GET_CLASS(first_cpu);
1723            if (cc->gdb_core_xml_file != NULL) {
1724                pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1725            }
1726
1727            if (strstr(p, "multiprocess+")) {
1728                s->multiprocess = true;
1729            }
1730            pstrcat(buf, sizeof(buf), ";multiprocess+");
1731
1732            put_packet(s, buf);
1733            break;
1734        }
1735        if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1736            const char *xml;
1737            target_ulong total_len;
1738
1739            process = gdb_get_cpu_process(s, s->g_cpu);
1740            cc = CPU_GET_CLASS(s->g_cpu);
1741            if (cc->gdb_core_xml_file == NULL) {
1742                goto unknown_command;
1743            }
1744
1745            gdb_has_xml = true;
1746            p += 19;
1747            xml = get_feature_xml(s, p, &p, process);
1748            if (!xml) {
1749                snprintf(buf, sizeof(buf), "E00");
1750                put_packet(s, buf);
1751                break;
1752            }
1753
1754            if (*p == ':')
1755                p++;
1756            addr = strtoul(p, (char **)&p, 16);
1757            if (*p == ',')
1758                p++;
1759            len = strtoul(p, (char **)&p, 16);
1760
1761            total_len = strlen(xml);
1762            if (addr > total_len) {
1763                snprintf(buf, sizeof(buf), "E00");
1764                put_packet(s, buf);
1765                break;
1766            }
1767            if (len > (MAX_PACKET_LENGTH - 5) / 2)
1768                len = (MAX_PACKET_LENGTH - 5) / 2;
1769            if (len < total_len - addr) {
1770                buf[0] = 'm';
1771                len = memtox(buf + 1, xml + addr, len);
1772            } else {
1773                buf[0] = 'l';
1774                len = memtox(buf + 1, xml + addr, total_len - addr);
1775            }
1776            put_packet_binary(s, buf, len + 1, true);
1777            break;
1778        }
1779        if (is_query_packet(p, "Attached", ':')) {
1780            put_packet(s, GDB_ATTACHED);
1781            break;
1782        }
1783        /* Unrecognised 'q' command.  */
1784        goto unknown_command;
1785
1786    default:
1787    unknown_command:
1788        /* put empty packet */
1789        buf[0] = '\0';
1790        put_packet(s, buf);
1791        break;
1792    }
1793    return RS_IDLE;
1794}
1795
1796void gdb_set_stop_cpu(CPUState *cpu)
1797{
1798    GDBProcess *p = gdb_get_cpu_process(gdbserver_state, cpu);
1799
1800    if (!p->attached) {
1801        /*
1802         * Having a stop CPU corresponding to a process that is not attached
1803         * confuses GDB. So we ignore the request.
1804         */
1805        return;
1806    }
1807
1808    gdbserver_state->c_cpu = cpu;
1809    gdbserver_state->g_cpu = cpu;
1810}
1811
1812#ifndef CONFIG_USER_ONLY
1813static void gdb_vm_state_change(void *opaque, int running, RunState state)
1814{
1815    GDBState *s = gdbserver_state;
1816    CPUState *cpu = s->c_cpu;
1817    char buf[256];
1818    char thread_id[16];
1819    const char *type;
1820    int ret;
1821
1822    if (running || s->state == RS_INACTIVE) {
1823        return;
1824    }
1825    /* Is there a GDB syscall waiting to be sent?  */
1826    if (s->current_syscall_cb) {
1827        put_packet(s, s->syscall_buf);
1828        return;
1829    }
1830
1831    if (cpu == NULL) {
1832        /* No process attached */
1833        return;
1834    }
1835
1836    gdb_fmt_thread_id(s, cpu, thread_id, sizeof(thread_id));
1837
1838    switch (state) {
1839    case RUN_STATE_DEBUG:
1840        if (cpu->watchpoint_hit) {
1841            switch (cpu->watchpoint_hit->flags & BP_MEM_ACCESS) {
1842            case BP_MEM_READ:
1843                type = "r";
1844                break;
1845            case BP_MEM_ACCESS:
1846                type = "a";
1847                break;
1848            default:
1849                type = "";
1850                break;
1851            }
1852            trace_gdbstub_hit_watchpoint(type, cpu_gdb_index(cpu),
1853                    (target_ulong)cpu->watchpoint_hit->vaddr);
1854            snprintf(buf, sizeof(buf),
1855                     "T%02xthread:%s;%swatch:" TARGET_FMT_lx ";",
1856                     GDB_SIGNAL_TRAP, thread_id, type,
1857                     (target_ulong)cpu->watchpoint_hit->vaddr);
1858            cpu->watchpoint_hit = NULL;
1859            goto send_packet;
1860        } else {
1861            trace_gdbstub_hit_break();
1862        }
1863        tb_flush(cpu);
1864        ret = GDB_SIGNAL_TRAP;
1865        break;
1866    case RUN_STATE_PAUSED:
1867        trace_gdbstub_hit_paused();
1868        ret = GDB_SIGNAL_INT;
1869        break;
1870    case RUN_STATE_SHUTDOWN:
1871        trace_gdbstub_hit_shutdown();
1872        ret = GDB_SIGNAL_QUIT;
1873        break;
1874    case RUN_STATE_IO_ERROR:
1875        trace_gdbstub_hit_io_error();
1876        ret = GDB_SIGNAL_IO;
1877        break;
1878    case RUN_STATE_WATCHDOG:
1879        trace_gdbstub_hit_watchdog();
1880        ret = GDB_SIGNAL_ALRM;
1881        break;
1882    case RUN_STATE_INTERNAL_ERROR:
1883        trace_gdbstub_hit_internal_error();
1884        ret = GDB_SIGNAL_ABRT;
1885        break;
1886    case RUN_STATE_SAVE_VM:
1887    case RUN_STATE_RESTORE_VM:
1888        return;
1889    case RUN_STATE_FINISH_MIGRATE:
1890        ret = GDB_SIGNAL_XCPU;
1891        break;
1892    default:
1893        trace_gdbstub_hit_unknown(state);
1894        ret = GDB_SIGNAL_UNKNOWN;
1895        break;
1896    }
1897    gdb_set_stop_cpu(cpu);
1898    snprintf(buf, sizeof(buf), "T%02xthread:%s;", ret, thread_id);
1899
1900send_packet:
1901    put_packet(s, buf);
1902
1903    /* disable single step if it was enabled */
1904    cpu_single_step(cpu, 0);
1905}
1906#endif
1907
1908/* Send a gdb syscall request.
1909   This accepts limited printf-style format specifiers, specifically:
1910    %x  - target_ulong argument printed in hex.
1911    %lx - 64-bit argument printed in hex.
1912    %s  - string pointer (target_ulong) and length (int) pair.  */
1913void gdb_do_syscallv(gdb_syscall_complete_cb cb, const char *fmt, va_list va)
1914{
1915    char *p;
1916    char *p_end;
1917    target_ulong addr;
1918    uint64_t i64;
1919    GDBState *s;
1920
1921    s = gdbserver_state;
1922    if (!s)
1923        return;
1924    s->current_syscall_cb = cb;
1925#ifndef CONFIG_USER_ONLY
1926    vm_stop(RUN_STATE_DEBUG);
1927#endif
1928    p = s->syscall_buf;
1929    p_end = &s->syscall_buf[sizeof(s->syscall_buf)];
1930    *(p++) = 'F';
1931    while (*fmt) {
1932        if (*fmt == '%') {
1933            fmt++;
1934            switch (*fmt++) {
1935            case 'x':
1936                addr = va_arg(va, target_ulong);
1937                p += snprintf(p, p_end - p, TARGET_FMT_lx, addr);
1938                break;
1939            case 'l':
1940                if (*(fmt++) != 'x')
1941                    goto bad_format;
1942                i64 = va_arg(va, uint64_t);
1943                p += snprintf(p, p_end - p, "%" PRIx64, i64);
1944                break;
1945            case 's':
1946                addr = va_arg(va, target_ulong);
1947                p += snprintf(p, p_end - p, TARGET_FMT_lx "/%x",
1948                              addr, va_arg(va, int));
1949                break;
1950            default:
1951            bad_format:
1952                error_report("gdbstub: Bad syscall format string '%s'",
1953                             fmt - 1);
1954                break;
1955            }
1956        } else {
1957            *(p++) = *(fmt++);
1958        }
1959    }
1960    *p = 0;
1961#ifdef CONFIG_USER_ONLY
1962    put_packet(s, s->syscall_buf);
1963    /* Return control to gdb for it to process the syscall request.
1964     * Since the protocol requires that gdb hands control back to us
1965     * using a "here are the results" F packet, we don't need to check
1966     * gdb_handlesig's return value (which is the signal to deliver if
1967     * execution was resumed via a continue packet).
1968     */
1969    gdb_handlesig(s->c_cpu, 0);
1970#else
1971    /* In this case wait to send the syscall packet until notification that
1972       the CPU has stopped.  This must be done because if the packet is sent
1973       now the reply from the syscall request could be received while the CPU
1974       is still in the running state, which can cause packets to be dropped
1975       and state transition 'T' packets to be sent while the syscall is still
1976       being processed.  */
1977    qemu_cpu_kick(s->c_cpu);
1978#endif
1979}
1980
1981void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1982{
1983    va_list va;
1984
1985    va_start(va, fmt);
1986    gdb_do_syscallv(cb, fmt, va);
1987    va_end(va);
1988}
1989
1990static void gdb_read_byte(GDBState *s, int ch)
1991{
1992    uint8_t reply;
1993
1994#ifndef CONFIG_USER_ONLY
1995    if (s->last_packet_len) {
1996        /* Waiting for a response to the last packet.  If we see the start
1997           of a new command then abandon the previous response.  */
1998        if (ch == '-') {
1999            trace_gdbstub_err_got_nack();
2000            put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2001        } else if (ch == '+') {
2002            trace_gdbstub_io_got_ack();
2003        } else {
2004            trace_gdbstub_io_got_unexpected((uint8_t)ch);
2005        }
2006
2007        if (ch == '+' || ch == '$')
2008            s->last_packet_len = 0;
2009        if (ch != '$')
2010            return;
2011    }
2012    if (runstate_is_running()) {
2013        /* when the CPU is running, we cannot do anything except stop
2014           it when receiving a char */
2015        vm_stop(RUN_STATE_PAUSED);
2016    } else
2017#endif
2018    {
2019        switch(s->state) {
2020        case RS_IDLE:
2021            if (ch == '$') {
2022                /* start of command packet */
2023                s->line_buf_index = 0;
2024                s->line_sum = 0;
2025                s->state = RS_GETLINE;
2026            } else {
2027                trace_gdbstub_err_garbage((uint8_t)ch);
2028            }
2029            break;
2030        case RS_GETLINE:
2031            if (ch == '}') {
2032                /* start escape sequence */
2033                s->state = RS_GETLINE_ESC;
2034                s->line_sum += ch;
2035            } else if (ch == '*') {
2036                /* start run length encoding sequence */
2037                s->state = RS_GETLINE_RLE;
2038                s->line_sum += ch;
2039            } else if (ch == '#') {
2040                /* end of command, start of checksum*/
2041                s->state = RS_CHKSUM1;
2042            } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2043                trace_gdbstub_err_overrun();
2044                s->state = RS_IDLE;
2045            } else {
2046                /* unescaped command character */
2047                s->line_buf[s->line_buf_index++] = ch;
2048                s->line_sum += ch;
2049            }
2050            break;
2051        case RS_GETLINE_ESC:
2052            if (ch == '#') {
2053                /* unexpected end of command in escape sequence */
2054                s->state = RS_CHKSUM1;
2055            } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2056                /* command buffer overrun */
2057                trace_gdbstub_err_overrun();
2058                s->state = RS_IDLE;
2059            } else {
2060                /* parse escaped character and leave escape state */
2061                s->line_buf[s->line_buf_index++] = ch ^ 0x20;
2062                s->line_sum += ch;
2063                s->state = RS_GETLINE;
2064            }
2065            break;
2066        case RS_GETLINE_RLE:
2067            if (ch < ' ') {
2068                /* invalid RLE count encoding */
2069                trace_gdbstub_err_invalid_repeat((uint8_t)ch);
2070                s->state = RS_GETLINE;
2071            } else {
2072                /* decode repeat length */
2073                int repeat = (unsigned char)ch - ' ' + 3;
2074                if (s->line_buf_index + repeat >= sizeof(s->line_buf) - 1) {
2075                    /* that many repeats would overrun the command buffer */
2076                    trace_gdbstub_err_overrun();
2077                    s->state = RS_IDLE;
2078                } else if (s->line_buf_index < 1) {
2079                    /* got a repeat but we have nothing to repeat */
2080                    trace_gdbstub_err_invalid_rle();
2081                    s->state = RS_GETLINE;
2082                } else {
2083                    /* repeat the last character */
2084                    memset(s->line_buf + s->line_buf_index,
2085                           s->line_buf[s->line_buf_index - 1], repeat);
2086                    s->line_buf_index += repeat;
2087                    s->line_sum += ch;
2088                    s->state = RS_GETLINE;
2089                }
2090            }
2091            break;
2092        case RS_CHKSUM1:
2093            /* get high hex digit of checksum */
2094            if (!isxdigit(ch)) {
2095                trace_gdbstub_err_checksum_invalid((uint8_t)ch);
2096                s->state = RS_GETLINE;
2097                break;
2098            }
2099            s->line_buf[s->line_buf_index] = '\0';
2100            s->line_csum = fromhex(ch) << 4;
2101            s->state = RS_CHKSUM2;
2102            break;
2103        case RS_CHKSUM2:
2104            /* get low hex digit of checksum */
2105            if (!isxdigit(ch)) {
2106                trace_gdbstub_err_checksum_invalid((uint8_t)ch);
2107                s->state = RS_GETLINE;
2108                break;
2109            }
2110            s->line_csum |= fromhex(ch);
2111
2112            if (s->line_csum != (s->line_sum & 0xff)) {
2113                trace_gdbstub_err_checksum_incorrect(s->line_sum, s->line_csum);
2114                /* send NAK reply */
2115                reply = '-';
2116                put_buffer(s, &reply, 1);
2117                s->state = RS_IDLE;
2118            } else {
2119                /* send ACK reply */
2120                reply = '+';
2121                put_buffer(s, &reply, 1);
2122                s->state = gdb_handle_packet(s, s->line_buf);
2123            }
2124            break;
2125        default:
2126            abort();
2127        }
2128    }
2129}
2130
2131/* Tell the remote gdb that the process has exited.  */
2132void gdb_exit(CPUArchState *env, int code)
2133{
2134  GDBState *s;
2135  char buf[4];
2136
2137  s = gdbserver_state;
2138  if (!s) {
2139      return;
2140  }
2141#ifdef CONFIG_USER_ONLY
2142  if (gdbserver_fd < 0 || s->fd < 0) {
2143      return;
2144  }
2145#endif
2146
2147  trace_gdbstub_op_exiting((uint8_t)code);
2148
2149  snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
2150  put_packet(s, buf);
2151
2152#ifndef CONFIG_USER_ONLY
2153  qemu_chr_fe_deinit(&s->chr, true);
2154#endif
2155}
2156
2157/*
2158 * Create the process that will contain all the "orphan" CPUs (that are not
2159 * part of a CPU cluster). Note that if this process contains no CPUs, it won't
2160 * be attachable and thus will be invisible to the user.
2161 */
2162static void create_default_process(GDBState *s)
2163{
2164    GDBProcess *process;
2165    int max_pid = 0;
2166
2167    if (s->process_num) {
2168        max_pid = s->processes[s->process_num - 1].pid;
2169    }
2170
2171    s->processes = g_renew(GDBProcess, s->processes, ++s->process_num);
2172    process = &s->processes[s->process_num - 1];
2173
2174    /* We need an available PID slot for this process */
2175    assert(max_pid < UINT32_MAX);
2176
2177    process->pid = max_pid + 1;
2178    process->attached = false;
2179    process->target_xml[0] = '\0';
2180}
2181
2182#ifdef CONFIG_USER_ONLY
2183int
2184gdb_handlesig(CPUState *cpu, int sig)
2185{
2186    GDBState *s;
2187    char buf[256];
2188    int n;
2189
2190    s = gdbserver_state;
2191    if (gdbserver_fd < 0 || s->fd < 0) {
2192        return sig;
2193    }
2194
2195    /* disable single step if it was enabled */
2196    cpu_single_step(cpu, 0);
2197    tb_flush(cpu);
2198
2199    if (sig != 0) {
2200        snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));
2201        put_packet(s, buf);
2202    }
2203    /* put_packet() might have detected that the peer terminated the
2204       connection.  */
2205    if (s->fd < 0) {
2206        return sig;
2207    }
2208
2209    sig = 0;
2210    s->state = RS_IDLE;
2211    s->running_state = 0;
2212    while (s->running_state == 0) {
2213        n = read(s->fd, buf, 256);
2214        if (n > 0) {
2215            int i;
2216
2217            for (i = 0; i < n; i++) {
2218                gdb_read_byte(s, buf[i]);
2219            }
2220        } else {
2221            /* XXX: Connection closed.  Should probably wait for another
2222               connection before continuing.  */
2223            if (n == 0) {
2224                close(s->fd);
2225            }
2226            s->fd = -1;
2227            return sig;
2228        }
2229    }
2230    sig = s->signal;
2231    s->signal = 0;
2232    return sig;
2233}
2234
2235/* Tell the remote gdb that the process has exited due to SIG.  */
2236void gdb_signalled(CPUArchState *env, int sig)
2237{
2238    GDBState *s;
2239    char buf[4];
2240
2241    s = gdbserver_state;
2242    if (gdbserver_fd < 0 || s->fd < 0) {
2243        return;
2244    }
2245
2246    snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb(sig));
2247    put_packet(s, buf);
2248}
2249
2250static bool gdb_accept(void)
2251{
2252    GDBState *s;
2253    struct sockaddr_in sockaddr;
2254    socklen_t len;
2255    int fd;
2256
2257    for(;;) {
2258        len = sizeof(sockaddr);
2259        fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2260        if (fd < 0 && errno != EINTR) {
2261            perror("accept");
2262            return false;
2263        } else if (fd >= 0) {
2264            qemu_set_cloexec(fd);
2265            break;
2266        }
2267    }
2268
2269    /* set short latency */
2270    if (socket_set_nodelay(fd)) {
2271        perror("setsockopt");
2272        close(fd);
2273        return false;
2274    }
2275
2276    s = g_malloc0(sizeof(GDBState));
2277    create_default_process(s);
2278    s->processes[0].attached = true;
2279    s->c_cpu = gdb_first_attached_cpu(s);
2280    s->g_cpu = s->c_cpu;
2281    s->fd = fd;
2282    gdb_has_xml = false;
2283
2284    gdbserver_state = s;
2285    return true;
2286}
2287
2288static int gdbserver_open(int port)
2289{
2290    struct sockaddr_in sockaddr;
2291    int fd, ret;
2292
2293    fd = socket(PF_INET, SOCK_STREAM, 0);
2294    if (fd < 0) {
2295        perror("socket");
2296        return -1;
2297    }
2298    qemu_set_cloexec(fd);
2299
2300    socket_set_fast_reuse(fd);
2301
2302    sockaddr.sin_family = AF_INET;
2303    sockaddr.sin_port = htons(port);
2304    sockaddr.sin_addr.s_addr = 0;
2305    ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2306    if (ret < 0) {
2307        perror("bind");
2308        close(fd);
2309        return -1;
2310    }
2311    ret = listen(fd, 1);
2312    if (ret < 0) {
2313        perror("listen");
2314        close(fd);
2315        return -1;
2316    }
2317    return fd;
2318}
2319
2320int gdbserver_start(int port)
2321{
2322    gdbserver_fd = gdbserver_open(port);
2323    if (gdbserver_fd < 0)
2324        return -1;
2325    /* accept connections */
2326    if (!gdb_accept()) {
2327        close(gdbserver_fd);
2328        gdbserver_fd = -1;
2329        return -1;
2330    }
2331    return 0;
2332}
2333
2334/* Disable gdb stub for child processes.  */
2335void gdbserver_fork(CPUState *cpu)
2336{
2337    GDBState *s = gdbserver_state;
2338
2339    if (gdbserver_fd < 0 || s->fd < 0) {
2340        return;
2341    }
2342    close(s->fd);
2343    s->fd = -1;
2344    cpu_breakpoint_remove_all(cpu, BP_GDB);
2345    cpu_watchpoint_remove_all(cpu, BP_GDB);
2346}
2347#else
2348static int gdb_chr_can_receive(void *opaque)
2349{
2350  /* We can handle an arbitrarily large amount of data.
2351   Pick the maximum packet size, which is as good as anything.  */
2352  return MAX_PACKET_LENGTH;
2353}
2354
2355static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2356{
2357    int i;
2358
2359    for (i = 0; i < size; i++) {
2360        gdb_read_byte(gdbserver_state, buf[i]);
2361    }
2362}
2363
2364static void gdb_chr_event(void *opaque, int event)
2365{
2366    int i;
2367    GDBState *s = (GDBState *) opaque;
2368
2369    switch (event) {
2370    case CHR_EVENT_OPENED:
2371        /* Start with first process attached, others detached */
2372        for (i = 0; i < s->process_num; i++) {
2373            s->processes[i].attached = !i;
2374        }
2375
2376        s->c_cpu = gdb_first_attached_cpu(s);
2377        s->g_cpu = s->c_cpu;
2378
2379        vm_stop(RUN_STATE_PAUSED);
2380        gdb_has_xml = false;
2381        break;
2382    default:
2383        break;
2384    }
2385}
2386
2387static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2388{
2389    char buf[MAX_PACKET_LENGTH];
2390
2391    buf[0] = 'O';
2392    if (len > (MAX_PACKET_LENGTH/2) - 1)
2393        len = (MAX_PACKET_LENGTH/2) - 1;
2394    memtohex(buf + 1, (uint8_t *)msg, len);
2395    put_packet(s, buf);
2396}
2397
2398static int gdb_monitor_write(Chardev *chr, const uint8_t *buf, int len)
2399{
2400    const char *p = (const char *)buf;
2401    int max_sz;
2402
2403    max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2404    for (;;) {
2405        if (len <= max_sz) {
2406            gdb_monitor_output(gdbserver_state, p, len);
2407            break;
2408        }
2409        gdb_monitor_output(gdbserver_state, p, max_sz);
2410        p += max_sz;
2411        len -= max_sz;
2412    }
2413    return len;
2414}
2415
2416#ifndef _WIN32
2417static void gdb_sigterm_handler(int signal)
2418{
2419    if (runstate_is_running()) {
2420        vm_stop(RUN_STATE_PAUSED);
2421    }
2422}
2423#endif
2424
2425static void gdb_monitor_open(Chardev *chr, ChardevBackend *backend,
2426                             bool *be_opened, Error **errp)
2427{
2428    *be_opened = false;
2429}
2430
2431static void char_gdb_class_init(ObjectClass *oc, void *data)
2432{
2433    ChardevClass *cc = CHARDEV_CLASS(oc);
2434
2435    cc->internal = true;
2436    cc->open = gdb_monitor_open;
2437    cc->chr_write = gdb_monitor_write;
2438}
2439
2440#define TYPE_CHARDEV_GDB "chardev-gdb"
2441
2442static const TypeInfo char_gdb_type_info = {
2443    .name = TYPE_CHARDEV_GDB,
2444    .parent = TYPE_CHARDEV,
2445    .class_init = char_gdb_class_init,
2446};
2447
2448static int find_cpu_clusters(Object *child, void *opaque)
2449{
2450    if (object_dynamic_cast(child, TYPE_CPU_CLUSTER)) {
2451        GDBState *s = (GDBState *) opaque;
2452        CPUClusterState *cluster = CPU_CLUSTER(child);
2453        GDBProcess *process;
2454
2455        s->processes = g_renew(GDBProcess, s->processes, ++s->process_num);
2456
2457        process = &s->processes[s->process_num - 1];
2458
2459        /*
2460         * GDB process IDs -1 and 0 are reserved. To avoid subtle errors at
2461         * runtime, we enforce here that the machine does not use a cluster ID
2462         * that would lead to PID 0.
2463         */
2464        assert(cluster->cluster_id != UINT32_MAX);
2465        process->pid = cluster->cluster_id + 1;
2466        process->attached = false;
2467        process->target_xml[0] = '\0';
2468
2469        return 0;
2470    }
2471
2472    return object_child_foreach(child, find_cpu_clusters, opaque);
2473}
2474
2475static int pid_order(const void *a, const void *b)
2476{
2477    GDBProcess *pa = (GDBProcess *) a;
2478    GDBProcess *pb = (GDBProcess *) b;
2479
2480    if (pa->pid < pb->pid) {
2481        return -1;
2482    } else if (pa->pid > pb->pid) {
2483        return 1;
2484    } else {
2485        return 0;
2486    }
2487}
2488
2489static void create_processes(GDBState *s)
2490{
2491    object_child_foreach(object_get_root(), find_cpu_clusters, s);
2492
2493    if (s->processes) {
2494        /* Sort by PID */
2495        qsort(s->processes, s->process_num, sizeof(s->processes[0]), pid_order);
2496    }
2497
2498    create_default_process(s);
2499}
2500
2501static void cleanup_processes(GDBState *s)
2502{
2503    g_free(s->processes);
2504    s->process_num = 0;
2505    s->processes = NULL;
2506}
2507
2508int gdbserver_start(const char *device)
2509{
2510    trace_gdbstub_op_start(device);
2511
2512    GDBState *s;
2513    char gdbstub_device_name[128];
2514    Chardev *chr = NULL;
2515    Chardev *mon_chr;
2516
2517    if (!first_cpu) {
2518        error_report("gdbstub: meaningless to attach gdb to a "
2519                     "machine without any CPU.");
2520        return -1;
2521    }
2522
2523    if (!device)
2524        return -1;
2525    if (strcmp(device, "none") != 0) {
2526        if (strstart(device, "tcp:", NULL)) {
2527            /* enforce required TCP attributes */
2528            snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2529                     "%s,nowait,nodelay,server", device);
2530            device = gdbstub_device_name;
2531        }
2532#ifndef _WIN32
2533        else if (strcmp(device, "stdio") == 0) {
2534            struct sigaction act;
2535
2536            memset(&act, 0, sizeof(act));
2537            act.sa_handler = gdb_sigterm_handler;
2538            sigaction(SIGINT, &act, NULL);
2539        }
2540#endif
2541        /*
2542         * FIXME: it's a bit weird to allow using a mux chardev here
2543         * and implicitly setup a monitor. We may want to break this.
2544         */
2545        chr = qemu_chr_new_noreplay("gdb", device, true, NULL);
2546        if (!chr)
2547            return -1;
2548    }
2549
2550    s = gdbserver_state;
2551    if (!s) {
2552        s = g_malloc0(sizeof(GDBState));
2553        gdbserver_state = s;
2554
2555        qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2556
2557        /* Initialize a monitor terminal for gdb */
2558        mon_chr = qemu_chardev_new(NULL, TYPE_CHARDEV_GDB,
2559                                   NULL, NULL, &error_abort);
2560        monitor_init(mon_chr, 0);
2561    } else {
2562        qemu_chr_fe_deinit(&s->chr, true);
2563        mon_chr = s->mon_chr;
2564        cleanup_processes(s);
2565        memset(s, 0, sizeof(GDBState));
2566        s->mon_chr = mon_chr;
2567    }
2568
2569    create_processes(s);
2570
2571    if (chr) {
2572        qemu_chr_fe_init(&s->chr, chr, &error_abort);
2573        qemu_chr_fe_set_handlers(&s->chr, gdb_chr_can_receive, gdb_chr_receive,
2574                                 gdb_chr_event, NULL, s, NULL, true);
2575    }
2576    s->state = chr ? RS_IDLE : RS_INACTIVE;
2577    s->mon_chr = mon_chr;
2578    s->current_syscall_cb = NULL;
2579
2580    return 0;
2581}
2582
2583void gdbserver_cleanup(void)
2584{
2585    if (gdbserver_state) {
2586        put_packet(gdbserver_state, "W00");
2587    }
2588}
2589
2590static void register_types(void)
2591{
2592    type_register_static(&char_gdb_type_info);
2593}
2594
2595type_init(register_types);
2596#endif
2597