gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "qemu-common.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "monitor/monitor.h"
  33 #include "sysemu/char.h"
  34 #include "sysemu/sysemu.h"
  35 #include "exec/gdbstub.h"
  36 #endif
  37
  38 #define MAX_PACKET_LENGTH 4096
  39
  40 #include "cpu.h"
  41 #include "qemu/sockets.h"
  42 #include "sysemu/kvm.h"
  43
  44 #ifdef CONFIG_USER_ONLY
  45 #define GDB_ATTACHED "0"
  46 #else
  47 #define GDB_ATTACHED "1"
  48 #endif
  49
  50 static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
  51                                          uint8_t *buf, int len, bool is_write)
  52 {
  53     CPUClass *cc = CPU_GET_CLASS(cpu);
  54
  55     if (cc->memory_rw_debug) {
  56         return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
  57     }
  58     return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
  59 }
  60
  61 enum {
  62     GDB_SIGNAL_0 = 0,
  63     GDB_SIGNAL_INT = 2,
  64     GDB_SIGNAL_QUIT = 3,
  65     GDB_SIGNAL_TRAP = 5,
  66     GDB_SIGNAL_ABRT = 6,
  67     GDB_SIGNAL_ALRM = 14,
  68     GDB_SIGNAL_IO = 23,
  69     GDB_SIGNAL_XCPU = 24,
  70     GDB_SIGNAL_UNKNOWN = 143
  71 };
  72
  73 #ifdef CONFIG_USER_ONLY
  74
  75 /* Map target signal numbers to GDB protocol signal numbers and vice
  76  * versa.  For user emulation's currently supported systems, we can
  77  * assume most signals are defined.
  78  */
  79
  80 static int gdb_signal_table[] = {
  81     0,
  82     TARGET_SIGHUP,
  83     TARGET_SIGINT,
  84     TARGET_SIGQUIT,
  85     TARGET_SIGILL,
  86     TARGET_SIGTRAP,
  87     TARGET_SIGABRT,
  88     -1, /* SIGEMT */
  89     TARGET_SIGFPE,
  90     TARGET_SIGKILL,
  91     TARGET_SIGBUS,
  92     TARGET_SIGSEGV,
  93     TARGET_SIGSYS,
  94     TARGET_SIGPIPE,
  95     TARGET_SIGALRM,
  96     TARGET_SIGTERM,
  97     TARGET_SIGURG,
  98     TARGET_SIGSTOP,
  99     TARGET_SIGTSTP,
 100     TARGET_SIGCONT,
 101     TARGET_SIGCHLD,
 102     TARGET_SIGTTIN,
 103     TARGET_SIGTTOU,
 104     TARGET_SIGIO,
 105     TARGET_SIGXCPU,
 106     TARGET_SIGXFSZ,
 107     TARGET_SIGVTALRM,
 108     TARGET_SIGPROF,
 109     TARGET_SIGWINCH,
 110     -1, /* SIGLOST */
 111     TARGET_SIGUSR1,
 112     TARGET_SIGUSR2,
 113 #ifdef TARGET_SIGPWR
 114     TARGET_SIGPWR,
 115 #else
 116     -1,
 117 #endif
 118     -1, /* SIGPOLL */
 119     -1,
 120     -1,
 121     -1,
 122     -1,
 123     -1,
 124     -1,
 125     -1,
 126     -1,
 127     -1,
 128     -1,
 129     -1,
 130 #ifdef __SIGRTMIN
 131     __SIGRTMIN + 1,
 132     __SIGRTMIN + 2,
 133     __SIGRTMIN + 3,
 134     __SIGRTMIN + 4,
 135     __SIGRTMIN + 5,
 136     __SIGRTMIN + 6,
 137     __SIGRTMIN + 7,
 138     __SIGRTMIN + 8,
 139     __SIGRTMIN + 9,
 140     __SIGRTMIN + 10,
 141     __SIGRTMIN + 11,
 142     __SIGRTMIN + 12,
 143     __SIGRTMIN + 13,
 144     __SIGRTMIN + 14,
 145     __SIGRTMIN + 15,
 146     __SIGRTMIN + 16,
 147     __SIGRTMIN + 17,
 148     __SIGRTMIN + 18,
 149     __SIGRTMIN + 19,
 150     __SIGRTMIN + 20,
 151     __SIGRTMIN + 21,
 152     __SIGRTMIN + 22,
 153     __SIGRTMIN + 23,
 154     __SIGRTMIN + 24,
 155     __SIGRTMIN + 25,
 156     __SIGRTMIN + 26,
 157     __SIGRTMIN + 27,
 158     __SIGRTMIN + 28,
 159     __SIGRTMIN + 29,
 160     __SIGRTMIN + 30,
 161     __SIGRTMIN + 31,
 162     -1, /* SIGCANCEL */
 163     __SIGRTMIN,
 164     __SIGRTMIN + 32,
 165     __SIGRTMIN + 33,
 166     __SIGRTMIN + 34,
 167     __SIGRTMIN + 35,
 168     __SIGRTMIN + 36,
 169     __SIGRTMIN + 37,
 170     __SIGRTMIN + 38,
 171     __SIGRTMIN + 39,
 172     __SIGRTMIN + 40,
 173     __SIGRTMIN + 41,
 174     __SIGRTMIN + 42,
 175     __SIGRTMIN + 43,
 176     __SIGRTMIN + 44,
 177     __SIGRTMIN + 45,
 178     __SIGRTMIN + 46,
 179     __SIGRTMIN + 47,
 180     __SIGRTMIN + 48,
 181     __SIGRTMIN + 49,
 182     __SIGRTMIN + 50,
 183     __SIGRTMIN + 51,
 184     __SIGRTMIN + 52,
 185     __SIGRTMIN + 53,
 186     __SIGRTMIN + 54,
 187     __SIGRTMIN + 55,
 188     __SIGRTMIN + 56,
 189     __SIGRTMIN + 57,
 190     __SIGRTMIN + 58,
 191     __SIGRTMIN + 59,
 192     __SIGRTMIN + 60,
 193     __SIGRTMIN + 61,
 194     __SIGRTMIN + 62,
 195     __SIGRTMIN + 63,
 196     __SIGRTMIN + 64,
 197     __SIGRTMIN + 65,
 198     __SIGRTMIN + 66,
 199     __SIGRTMIN + 67,
 200     __SIGRTMIN + 68,
 201     __SIGRTMIN + 69,
 202     __SIGRTMIN + 70,
 203     __SIGRTMIN + 71,
 204     __SIGRTMIN + 72,
 205     __SIGRTMIN + 73,
 206     __SIGRTMIN + 74,
 207     __SIGRTMIN + 75,
 208     __SIGRTMIN + 76,
 209     __SIGRTMIN + 77,
 210     __SIGRTMIN + 78,
 211     __SIGRTMIN + 79,
 212     __SIGRTMIN + 80,
 213     __SIGRTMIN + 81,
 214     __SIGRTMIN + 82,
 215     __SIGRTMIN + 83,
 216     __SIGRTMIN + 84,
 217     __SIGRTMIN + 85,
 218     __SIGRTMIN + 86,
 219     __SIGRTMIN + 87,
 220     __SIGRTMIN + 88,
 221     __SIGRTMIN + 89,
 222     __SIGRTMIN + 90,
 223     __SIGRTMIN + 91,
 224     __SIGRTMIN + 92,
 225     __SIGRTMIN + 93,
 226     __SIGRTMIN + 94,
 227     __SIGRTMIN + 95,
 228     -1, /* SIGINFO */
 229     -1, /* UNKNOWN */
 230     -1, /* DEFAULT */
 231     -1,
 232     -1,
 233     -1,
 234     -1,
 235     -1,
 236     -1
 237 #endif
 238 };
 239 #else
 240 /* In system mode we only need SIGINT and SIGTRAP; other signals
 241    are not yet supported.  */
 242
 243 enum {
 244     TARGET_SIGINT = 2,
 245     TARGET_SIGTRAP = 5
 246 };
 247
 248 static int gdb_signal_table[] = {
 249     -1,
 250     -1,
 251     TARGET_SIGINT,
 252     -1,
 253     -1,
 254     TARGET_SIGTRAP
 255 };
 256 #endif
 257
 258 #ifdef CONFIG_USER_ONLY
 259 static int target_signal_to_gdb (int sig)
 260 {
 261     int i;
 262     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 263         if (gdb_signal_table[i] == sig)
 264             return i;
 265     return GDB_SIGNAL_UNKNOWN;
 266 }
 267 #endif
 268
 269 static int gdb_signal_to_target (int sig)
 270 {
 271     if (sig < ARRAY_SIZE (gdb_signal_table))
 272         return gdb_signal_table[sig];
 273     else
 274         return -1;
 275 }
 276
 277 //#define DEBUG_GDB
 278
 279 typedef struct GDBRegisterState {
 280     int base_reg;
 281     int num_regs;
 282     gdb_reg_cb get_reg;
 283     gdb_reg_cb set_reg;
 284     const char *xml;
 285     struct GDBRegisterState *next;
 286 } GDBRegisterState;
 287
 288 enum RSState {
 289     RS_INACTIVE,
 290     RS_IDLE,
 291     RS_GETLINE,
 292     RS_CHKSUM1,
 293     RS_CHKSUM2,
 294 };
 295 typedef struct GDBState {
 296     CPUState *c_cpu; /* current CPU for step/continue ops */
 297     CPUState *g_cpu; /* current CPU for other ops */
 298     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 299     enum RSState state; /* parsing state */
 300     char line_buf[MAX_PACKET_LENGTH];
 301     int line_buf_index;
 302     int line_csum;
 303     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 304     int last_packet_len;
 305     int signal;
 306 #ifdef CONFIG_USER_ONLY
 307     int fd;
 308     int running_state;
 309 #else
 310     CharDriverState *chr;
 311     CharDriverState *mon_chr;
 312 #endif
 313     char syscall_buf[256];
 314     gdb_syscall_complete_cb current_syscall_cb;
 315 } GDBState;
 316
 317 /* By default use no IRQs and no timers while single stepping so as to
 318  * make single stepping like an ICE HW step.
 319  */
 320 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 321
 322 static GDBState *gdbserver_state;
 323
 324 bool gdb_has_xml;
 325
 326 int semihosting_target = SEMIHOSTING_TARGET_AUTO;
 327
 328 #ifdef CONFIG_USER_ONLY
 329 /* XXX: This is not thread safe.  Do we care?  */
 330 static int gdbserver_fd = -1;
 331
 332 static int get_char(GDBState *s)
 333 {
 334     uint8_t ch;
 335     int ret;
 336
 337     for(;;) {
 338         ret = qemu_recv(s->fd, &ch, 1, 0);
 339         if (ret < 0) {
 340             if (errno == ECONNRESET)
 341                 s->fd = -1;
 342             if (errno != EINTR && errno != EAGAIN)
 343                 return -1;
 344         } else if (ret == 0) {
 345             close(s->fd);
 346             s->fd = -1;
 347             return -1;
 348         } else {
 349             break;
 350         }
 351     }
 352     return ch;
 353 }
 354 #endif
 355
 356 static enum {
 357     GDB_SYS_UNKNOWN,
 358     GDB_SYS_ENABLED,
 359     GDB_SYS_DISABLED,
 360 } gdb_syscall_mode;
 361
 362 /* Decide if either remote gdb syscalls or native file IO should be used. */
 363 int use_gdb_syscalls(void)
 364 {
 365     if (semihosting_target == SEMIHOSTING_TARGET_NATIVE) {
 366         /* -semihosting-config target=native */
 367         return false;
 368     } else if (semihosting_target == SEMIHOSTING_TARGET_GDB) {
 369         /* -semihosting-config target=gdb */
 370         return true;
 371     }
 372
 373     /* -semihosting-config target=auto */
 374     /* On the first call check if gdb is connected and remember. */
 375     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 376         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 377                                             : GDB_SYS_DISABLED);
 378     }
 379     return gdb_syscall_mode == GDB_SYS_ENABLED;
 380 }
 381
 382 /* Resume execution.  */
 383 static inline void gdb_continue(GDBState *s)
 384 {
 385 #ifdef CONFIG_USER_ONLY
 386     s->running_state = 1;
 387 #else
 388     if (!runstate_needs_reset()) {
 389         vm_start();
 390     }
 391 #endif
 392 }
 393
 394 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 395 {
 396 #ifdef CONFIG_USER_ONLY
 397     int ret;
 398
 399     while (len > 0) {
 400         ret = send(s->fd, buf, len, 0);
 401         if (ret < 0) {
 402             if (errno != EINTR && errno != EAGAIN)
 403                 return;
 404         } else {
 405             buf += ret;
 406             len -= ret;
 407         }
 408     }
 409 #else
 410     qemu_chr_fe_write(s->chr, buf, len);
 411 #endif
 412 }
 413
 414 static inline int fromhex(int v)
 415 {
 416     if (v >= '0' && v <= '9')
 417         return v - '0';
 418     else if (v >= 'A' && v <= 'F')
 419         return v - 'A' + 10;
 420     else if (v >= 'a' && v <= 'f')
 421         return v - 'a' + 10;
 422     else
 423         return 0;
 424 }
 425
 426 static inline int tohex(int v)
 427 {
 428     if (v < 10)
 429         return v + '0';
 430     else
 431         return v - 10 + 'a';
 432 }
 433
 434 static void memtohex(char *buf, const uint8_t *mem, int len)
 435 {
 436     int i, c;
 437     char *q;
 438     q = buf;
 439     for(i = 0; i < len; i++) {
 440         c = mem[i];
 441         *q++ = tohex(c >> 4);
 442         *q++ = tohex(c & 0xf);
 443     }
 444     *q = '\0';
 445 }
 446
 447 static void hextomem(uint8_t *mem, const char *buf, int len)
 448 {
 449     int i;
 450
 451     for(i = 0; i < len; i++) {
 452         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 453         buf += 2;
 454     }
 455 }
 456
 457 /* return -1 if error, 0 if OK */
 458 static int put_packet_binary(GDBState *s, const char *buf, int len)
 459 {
 460     int csum, i;
 461     uint8_t *p;
 462
 463     for(;;) {
 464         p = s->last_packet;
 465         *(p++) = '$';
 466         memcpy(p, buf, len);
 467         p += len;
 468         csum = 0;
 469         for(i = 0; i < len; i++) {
 470             csum += buf[i];
 471         }
 472         *(p++) = '#';
 473         *(p++) = tohex((csum >> 4) & 0xf);
 474         *(p++) = tohex((csum) & 0xf);
 475
 476         s->last_packet_len = p - s->last_packet;
 477         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 478
 479 #ifdef CONFIG_USER_ONLY
 480         i = get_char(s);
 481         if (i < 0)
 482             return -1;
 483         if (i == '+')
 484             break;
 485 #else
 486         break;
 487 #endif
 488     }
 489     return 0;
 490 }
 491
 492 /* return -1 if error, 0 if OK */
 493 static int put_packet(GDBState *s, const char *buf)
 494 {
 495 #ifdef DEBUG_GDB
 496     printf("reply='%s'\n", buf);
 497 #endif
 498
 499     return put_packet_binary(s, buf, strlen(buf));
 500 }
 501
 502 /* Encode data using the encoding for 'x' packets.  */
 503 static int memtox(char *buf, const char *mem, int len)
 504 {
 505     char *p = buf;
 506     char c;
 507
 508     while (len--) {
 509         c = *(mem++);
 510         switch (c) {
 511         case '#': case '$': case '*': case '}':
 512             *(p++) = '}';
 513             *(p++) = c ^ 0x20;
 514             break;
 515         default:
 516             *(p++) = c;
 517             break;
 518         }
 519     }
 520     return p - buf;
 521 }
 522
 523 static const char *get_feature_xml(const char *p, const char **newp,
 524                                    CPUClass *cc)
 525 {
 526     size_t len;
 527     int i;
 528     const char *name;
 529     static char target_xml[1024];
 530
 531     len = 0;
 532     while (p[len] && p[len] != ':')
 533         len++;
 534     *newp = p + len;
 535
 536     name = NULL;
 537     if (strncmp(p, "target.xml", len) == 0) {
 538         /* Generate the XML description for this CPU.  */
 539         if (!target_xml[0]) {
 540             GDBRegisterState *r;
 541             CPUState *cpu = first_cpu;
 542
 543             snprintf(target_xml, sizeof(target_xml),
 544                      "<?xml version=\"1.0\"?>"
 545                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
 546                      "<target>"
 547                      "<xi:include href=\"%s\"/>",
 548                      cc->gdb_core_xml_file);
 549
 550             for (r = cpu->gdb_regs; r; r = r->next) {
 551                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
 552                 pstrcat(target_xml, sizeof(target_xml), r->xml);
 553                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
 554             }
 555             pstrcat(target_xml, sizeof(target_xml), "</target>");
 556         }
 557         return target_xml;
 558     }
 559     for (i = 0; ; i++) {
 560         name = xml_builtin[i][0];
 561         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
 562             break;
 563     }
 564     return name ? xml_builtin[i][1] : NULL;
 565 }
 566
 567 static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 568 {
 569     CPUClass *cc = CPU_GET_CLASS(cpu);
 570     CPUArchState *env = cpu->env_ptr;
 571     GDBRegisterState *r;
 572
 573     if (reg < cc->gdb_num_core_regs) {
 574         return cc->gdb_read_register(cpu, mem_buf, reg);
 575     }
 576
 577     for (r = cpu->gdb_regs; r; r = r->next) {
 578         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 579             return r->get_reg(env, mem_buf, reg - r->base_reg);
 580         }
 581     }
 582     return 0;
 583 }
 584
 585 static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 586 {
 587     CPUClass *cc = CPU_GET_CLASS(cpu);
 588     CPUArchState *env = cpu->env_ptr;
 589     GDBRegisterState *r;
 590
 591     if (reg < cc->gdb_num_core_regs) {
 592         return cc->gdb_write_register(cpu, mem_buf, reg);
 593     }
 594
 595     for (r = cpu->gdb_regs; r; r = r->next) {
 596         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 597             return r->set_reg(env, mem_buf, reg - r->base_reg);
 598         }
 599     }
 600     return 0;
 601 }
 602
 603 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
 604    specifies the first register number and these registers are included in
 605    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
 606    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
 607  */
 608
 609 void gdb_register_coprocessor(CPUState *cpu,
 610                               gdb_reg_cb get_reg, gdb_reg_cb set_reg,
 611                               int num_regs, const char *xml, int g_pos)
 612 {
 613     GDBRegisterState *s;
 614     GDBRegisterState **p;
 615
 616     p = &cpu->gdb_regs;
 617     while (*p) {
 618         /* Check for duplicates.  */
 619         if (strcmp((*p)->xml, xml) == 0)
 620             return;
 621         p = &(*p)->next;
 622     }
 623
 624     s = g_new0(GDBRegisterState, 1);
 625     s->base_reg = cpu->gdb_num_regs;
 626     s->num_regs = num_regs;
 627     s->get_reg = get_reg;
 628     s->set_reg = set_reg;
 629     s->xml = xml;
 630
 631     /* Add to end of list.  */
 632     cpu->gdb_num_regs += num_regs;
 633     *p = s;
 634     if (g_pos) {
 635         if (g_pos != s->base_reg) {
 636             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
 637                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
 638         } else {
 639             cpu->gdb_num_g_regs = cpu->gdb_num_regs;
 640         }
 641     }
 642 }
 643
 644 #ifndef CONFIG_USER_ONLY
 645 /* Translate GDB watchpoint type to a flags value for cpu_watchpoint_* */
 646 static inline int xlat_gdb_type(CPUState *cpu, int gdbtype)
 647 {
 648     static const int xlat[] = {
 649         [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
 650         [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
 651         [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
 652     };
 653
 654     CPUClass *cc = CPU_GET_CLASS(cpu);
 655     int cputype = xlat[gdbtype];
 656
 657     if (cc->gdb_stop_before_watchpoint) {
 658         cputype |= BP_STOP_BEFORE_ACCESS;
 659     }
 660     return cputype;
 661 }
 662 #endif
 663
 664 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
 665 {
 666     CPUState *cpu;
 667     int err = 0;
 668
 669     if (kvm_enabled()) {
 670         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 671     }
 672
 673     switch (type) {
 674     case GDB_BREAKPOINT_SW:
 675     case GDB_BREAKPOINT_HW:
 676         CPU_FOREACH(cpu) {
 677             err = cpu_breakpoint_insert(cpu, addr, BP_GDB, NULL);
 678             if (err) {
 679                 break;
 680             }
 681         }
 682         return err;
 683 #ifndef CONFIG_USER_ONLY
 684     case GDB_WATCHPOINT_WRITE:
 685     case GDB_WATCHPOINT_READ:
 686     case GDB_WATCHPOINT_ACCESS:
 687         CPU_FOREACH(cpu) {
 688             err = cpu_watchpoint_insert(cpu, addr, len,
 689                                         xlat_gdb_type(cpu, type), NULL);
 690             if (err) {
 691                 break;
 692             }
 693         }
 694         return err;
 695 #endif
 696     default:
 697         return -ENOSYS;
 698     }
 699 }
 700
 701 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
 702 {
 703     CPUState *cpu;
 704     int err = 0;
 705
 706     if (kvm_enabled()) {
 707         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 708     }
 709
 710     switch (type) {
 711     case GDB_BREAKPOINT_SW:
 712     case GDB_BREAKPOINT_HW:
 713         CPU_FOREACH(cpu) {
 714             err = cpu_breakpoint_remove(cpu, addr, BP_GDB);
 715             if (err) {
 716                 break;
 717             }
 718         }
 719         return err;
 720 #ifndef CONFIG_USER_ONLY
 721     case GDB_WATCHPOINT_WRITE:
 722     case GDB_WATCHPOINT_READ:
 723     case GDB_WATCHPOINT_ACCESS:
 724         CPU_FOREACH(cpu) {
 725             err = cpu_watchpoint_remove(cpu, addr, len,
 726                                         xlat_gdb_type(cpu, type));
 727             if (err)
 728                 break;
 729         }
 730         return err;
 731 #endif
 732     default:
 733         return -ENOSYS;
 734     }
 735 }
 736
 737 static void gdb_breakpoint_remove_all(void)
 738 {
 739     CPUState *cpu;
 740
 741     if (kvm_enabled()) {
 742         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
 743         return;
 744     }
 745
 746     CPU_FOREACH(cpu) {
 747         cpu_breakpoint_remove_all(cpu, BP_GDB);
 748 #ifndef CONFIG_USER_ONLY
 749         cpu_watchpoint_remove_all(cpu, BP_GDB);
 750 #endif
 751     }
 752 }
 753
 754 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 755 {
 756     CPUState *cpu = s->c_cpu;
 757     CPUClass *cc = CPU_GET_CLASS(cpu);
 758
 759     cpu_synchronize_state(cpu);
 760     if (cc->set_pc) {
 761         cc->set_pc(cpu, pc);
 762     }
 763 }
 764
 765 static CPUState *find_cpu(uint32_t thread_id)
 766 {
 767     CPUState *cpu;
 768
 769     CPU_FOREACH(cpu) {
 770         if (cpu_index(cpu) == thread_id) {
 771             return cpu;
 772         }
 773     }
 774
 775     return NULL;
 776 }
 777
 778 static int is_query_packet(const char *p, const char *query, char separator)
 779 {
 780     unsigned int query_len = strlen(query);
 781
 782     return strncmp(p, query, query_len) == 0 &&
 783         (p[query_len] == '\0' || p[query_len] == separator);
 784 }
 785
 786 static int gdb_handle_packet(GDBState *s, const char *line_buf)
 787 {
 788     CPUState *cpu;
 789     CPUClass *cc;
 790     const char *p;
 791     uint32_t thread;
 792     int ch, reg_size, type, res;
 793     char buf[MAX_PACKET_LENGTH];
 794     uint8_t mem_buf[MAX_PACKET_LENGTH];
 795     uint8_t *registers;
 796     target_ulong addr, len;
 797
 798 #ifdef DEBUG_GDB
 799     printf("command='%s'\n", line_buf);
 800 #endif
 801     p = line_buf;
 802     ch = *p++;
 803     switch(ch) {
 804     case '?':
 805         /* TODO: Make this return the correct value for user-mode.  */
 806         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
 807                  cpu_index(s->c_cpu));
 808         put_packet(s, buf);
 809         /* Remove all the breakpoints when this query is issued,
 810          * because gdb is doing and initial connect and the state
 811          * should be cleaned up.
 812          */
 813         gdb_breakpoint_remove_all();
 814         break;
 815     case 'c':
 816         if (*p != '\0') {
 817             addr = strtoull(p, (char **)&p, 16);
 818             gdb_set_cpu_pc(s, addr);
 819         }
 820         s->signal = 0;
 821         gdb_continue(s);
 822         return RS_IDLE;
 823     case 'C':
 824         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
 825         if (s->signal == -1)
 826             s->signal = 0;
 827         gdb_continue(s);
 828         return RS_IDLE;
 829     case 'v':
 830         if (strncmp(p, "Cont", 4) == 0) {
 831             int res_signal, res_thread;
 832
 833             p += 4;
 834             if (*p == '?') {
 835                 put_packet(s, "vCont;c;C;s;S");
 836                 break;
 837             }
 838             res = 0;
 839             res_signal = 0;
 840             res_thread = 0;
 841             while (*p) {
 842                 int action, signal;
 843
 844                 if (*p++ != ';') {
 845                     res = 0;
 846                     break;
 847                 }
 848                 action = *p++;
 849                 signal = 0;
 850                 if (action == 'C' || action == 'S') {
 851                     signal = gdb_signal_to_target(strtoul(p, (char **)&p, 16));
 852                     if (signal == -1) {
 853                         signal = 0;
 854                     }
 855                 } else if (action != 'c' && action != 's') {
 856                     res = 0;
 857                     break;
 858                 }
 859                 thread = 0;
 860                 if (*p == ':') {
 861                     thread = strtoull(p+1, (char **)&p, 16);
 862                 }
 863                 action = tolower(action);
 864                 if (res == 0 || (res == 'c' && action == 's')) {
 865                     res = action;
 866                     res_signal = signal;
 867                     res_thread = thread;
 868                 }
 869             }
 870             if (res) {
 871                 if (res_thread != -1 && res_thread != 0) {
 872                     cpu = find_cpu(res_thread);
 873                     if (cpu == NULL) {
 874                         put_packet(s, "E22");
 875                         break;
 876                     }
 877                     s->c_cpu = cpu;
 878                 }
 879                 if (res == 's') {
 880                     cpu_single_step(s->c_cpu, sstep_flags);
 881                 }
 882                 s->signal = res_signal;
 883                 gdb_continue(s);
 884                 return RS_IDLE;
 885             }
 886             break;
 887         } else {
 888             goto unknown_command;
 889         }
 890     case 'k':
 891 #ifdef CONFIG_USER_ONLY
 892         /* Kill the target */
 893         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
 894         exit(0);
 895 #endif
 896     case 'D':
 897         /* Detach packet */
 898         gdb_breakpoint_remove_all();
 899         gdb_syscall_mode = GDB_SYS_DISABLED;
 900         gdb_continue(s);
 901         put_packet(s, "OK");
 902         break;
 903     case 's':
 904         if (*p != '\0') {
 905             addr = strtoull(p, (char **)&p, 16);
 906             gdb_set_cpu_pc(s, addr);
 907         }
 908         cpu_single_step(s->c_cpu, sstep_flags);
 909         gdb_continue(s);
 910         return RS_IDLE;
 911     case 'F':
 912         {
 913             target_ulong ret;
 914             target_ulong err;
 915
 916             ret = strtoull(p, (char **)&p, 16);
 917             if (*p == ',') {
 918                 p++;
 919                 err = strtoull(p, (char **)&p, 16);
 920             } else {
 921                 err = 0;
 922             }
 923             if (*p == ',')
 924                 p++;
 925             type = *p;
 926             if (s->current_syscall_cb) {
 927                 s->current_syscall_cb(s->c_cpu, ret, err);
 928                 s->current_syscall_cb = NULL;
 929             }
 930             if (type == 'C') {
 931                 put_packet(s, "T02");
 932             } else {
 933                 gdb_continue(s);
 934             }
 935         }
 936         break;
 937     case 'g':
 938         cpu_synchronize_state(s->g_cpu);
 939         len = 0;
 940         for (addr = 0; addr < s->g_cpu->gdb_num_g_regs; addr++) {
 941             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
 942             len += reg_size;
 943         }
 944         memtohex(buf, mem_buf, len);
 945         put_packet(s, buf);
 946         break;
 947     case 'G':
 948         cpu_synchronize_state(s->g_cpu);
 949         registers = mem_buf;
 950         len = strlen(p) / 2;
 951         hextomem((uint8_t *)registers, p, len);
 952         for (addr = 0; addr < s->g_cpu->gdb_num_g_regs && len > 0; addr++) {
 953             reg_size = gdb_write_register(s->g_cpu, registers, addr);
 954             len -= reg_size;
 955             registers += reg_size;
 956         }
 957         put_packet(s, "OK");
 958         break;
 959     case 'm':
 960         addr = strtoull(p, (char **)&p, 16);
 961         if (*p == ',')
 962             p++;
 963         len = strtoull(p, NULL, 16);
 964         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
 965             put_packet (s, "E14");
 966         } else {
 967             memtohex(buf, mem_buf, len);
 968             put_packet(s, buf);
 969         }
 970         break;
 971     case 'M':
 972         addr = strtoull(p, (char **)&p, 16);
 973         if (*p == ',')
 974             p++;
 975         len = strtoull(p, (char **)&p, 16);
 976         if (*p == ':')
 977             p++;
 978         hextomem(mem_buf, p, len);
 979         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
 980                                    true) != 0) {
 981             put_packet(s, "E14");
 982         } else {
 983             put_packet(s, "OK");
 984         }
 985         break;
 986     case 'p':
 987         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
 988            This works, but can be very slow.  Anything new enough to
 989            understand XML also knows how to use this properly.  */
 990         if (!gdb_has_xml)
 991             goto unknown_command;
 992         addr = strtoull(p, (char **)&p, 16);
 993         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
 994         if (reg_size) {
 995             memtohex(buf, mem_buf, reg_size);
 996             put_packet(s, buf);
 997         } else {
 998             put_packet(s, "E14");
 999         }
1000         break;
1001     case 'P':
1002         if (!gdb_has_xml)
1003             goto unknown_command;
1004         addr = strtoull(p, (char **)&p, 16);
1005         if (*p == '=')
1006             p++;
1007         reg_size = strlen(p) / 2;
1008         hextomem(mem_buf, p, reg_size);
1009         gdb_write_register(s->g_cpu, mem_buf, addr);
1010         put_packet(s, "OK");
1011         break;
1012     case 'Z':
1013     case 'z':
1014         type = strtoul(p, (char **)&p, 16);
1015         if (*p == ',')
1016             p++;
1017         addr = strtoull(p, (char **)&p, 16);
1018         if (*p == ',')
1019             p++;
1020         len = strtoull(p, (char **)&p, 16);
1021         if (ch == 'Z')
1022             res = gdb_breakpoint_insert(addr, len, type);
1023         else
1024             res = gdb_breakpoint_remove(addr, len, type);
1025         if (res >= 0)
1026              put_packet(s, "OK");
1027         else if (res == -ENOSYS)
1028             put_packet(s, "");
1029         else
1030             put_packet(s, "E22");
1031         break;
1032     case 'H':
1033         type = *p++;
1034         thread = strtoull(p, (char **)&p, 16);
1035         if (thread == -1 || thread == 0) {
1036             put_packet(s, "OK");
1037             break;
1038         }
1039         cpu = find_cpu(thread);
1040         if (cpu == NULL) {
1041             put_packet(s, "E22");
1042             break;
1043         }
1044         switch (type) {
1045         case 'c':
1046             s->c_cpu = cpu;
1047             put_packet(s, "OK");
1048             break;
1049         case 'g':
1050             s->g_cpu = cpu;
1051             put_packet(s, "OK");
1052             break;
1053         default:
1054              put_packet(s, "E22");
1055              break;
1056         }
1057         break;
1058     case 'T':
1059         thread = strtoull(p, (char **)&p, 16);
1060         cpu = find_cpu(thread);
1061
1062         if (cpu != NULL) {
1063             put_packet(s, "OK");
1064         } else {
1065             put_packet(s, "E22");
1066         }
1067         break;
1068     case 'q':
1069     case 'Q':
1070         /* parse any 'q' packets here */
1071         if (!strcmp(p,"qemu.sstepbits")) {
1072             /* Query Breakpoint bit definitions */
1073             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1074                      SSTEP_ENABLE,
1075                      SSTEP_NOIRQ,
1076                      SSTEP_NOTIMER);
1077             put_packet(s, buf);
1078             break;
1079         } else if (is_query_packet(p, "qemu.sstep", '=')) {
1080             /* Display or change the sstep_flags */
1081             p += 10;
1082             if (*p != '=') {
1083                 /* Display current setting */
1084                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1085                 put_packet(s, buf);
1086                 break;
1087             }
1088             p++;
1089             type = strtoul(p, (char **)&p, 16);
1090             sstep_flags = type;
1091             put_packet(s, "OK");
1092             break;
1093         } else if (strcmp(p,"C") == 0) {
1094             /* "Current thread" remains vague in the spec, so always return
1095              *  the first CPU (gdb returns the first thread). */
1096             put_packet(s, "QC1");
1097             break;
1098         } else if (strcmp(p,"fThreadInfo") == 0) {
1099             s->query_cpu = first_cpu;
1100             goto report_cpuinfo;
1101         } else if (strcmp(p,"sThreadInfo") == 0) {
1102         report_cpuinfo:
1103             if (s->query_cpu) {
1104                 snprintf(buf, sizeof(buf), "m%x", cpu_index(s->query_cpu));
1105                 put_packet(s, buf);
1106                 s->query_cpu = CPU_NEXT(s->query_cpu);
1107             } else
1108                 put_packet(s, "l");
1109             break;
1110         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1111             thread = strtoull(p+16, (char **)&p, 16);
1112             cpu = find_cpu(thread);
1113             if (cpu != NULL) {
1114                 cpu_synchronize_state(cpu);
1115                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
1116                                "CPU#%d [%s]", cpu->cpu_index,
1117                                cpu->halted ? "halted " : "running");
1118                 memtohex(buf, mem_buf, len);
1119                 put_packet(s, buf);
1120             }
1121             break;
1122         }
1123 #ifdef CONFIG_USER_ONLY
1124         else if (strcmp(p, "Offsets") == 0) {
1125             TaskState *ts = s->c_cpu->opaque;
1126
1127             snprintf(buf, sizeof(buf),
1128                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1129                      ";Bss=" TARGET_ABI_FMT_lx,
1130                      ts->info->code_offset,
1131                      ts->info->data_offset,
1132                      ts->info->data_offset);
1133             put_packet(s, buf);
1134             break;
1135         }
1136 #else /* !CONFIG_USER_ONLY */
1137         else if (strncmp(p, "Rcmd,", 5) == 0) {
1138             int len = strlen(p + 5);
1139
1140             if ((len % 2) != 0) {
1141                 put_packet(s, "E01");
1142                 break;
1143             }
1144             hextomem(mem_buf, p + 5, len);
1145             len = len / 2;
1146             mem_buf[len++] = 0;
1147             qemu_chr_be_write(s->mon_chr, mem_buf, len);
1148             put_packet(s, "OK");
1149             break;
1150         }
1151 #endif /* !CONFIG_USER_ONLY */
1152         if (is_query_packet(p, "Supported", ':')) {
1153             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1154             cc = CPU_GET_CLASS(first_cpu);
1155             if (cc->gdb_core_xml_file != NULL) {
1156                 pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1157             }
1158             put_packet(s, buf);
1159             break;
1160         }
1161         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1162             const char *xml;
1163             target_ulong total_len;
1164
1165             cc = CPU_GET_CLASS(first_cpu);
1166             if (cc->gdb_core_xml_file == NULL) {
1167                 goto unknown_command;
1168             }
1169
1170             gdb_has_xml = true;
1171             p += 19;
1172             xml = get_feature_xml(p, &p, cc);
1173             if (!xml) {
1174                 snprintf(buf, sizeof(buf), "E00");
1175                 put_packet(s, buf);
1176                 break;
1177             }
1178
1179             if (*p == ':')
1180                 p++;
1181             addr = strtoul(p, (char **)&p, 16);
1182             if (*p == ',')
1183                 p++;
1184             len = strtoul(p, (char **)&p, 16);
1185
1186             total_len = strlen(xml);
1187             if (addr > total_len) {
1188                 snprintf(buf, sizeof(buf), "E00");
1189                 put_packet(s, buf);
1190                 break;
1191             }
1192             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1193                 len = (MAX_PACKET_LENGTH - 5) / 2;
1194             if (len < total_len - addr) {
1195                 buf[0] = 'm';
1196                 len = memtox(buf + 1, xml + addr, len);
1197             } else {
1198                 buf[0] = 'l';
1199                 len = memtox(buf + 1, xml + addr, total_len - addr);
1200             }
1201             put_packet_binary(s, buf, len + 1);
1202             break;
1203         }
1204         if (is_query_packet(p, "Attached", ':')) {
1205             put_packet(s, GDB_ATTACHED);
1206             break;
1207         }
1208         /* Unrecognised 'q' command.  */
1209         goto unknown_command;
1210
1211     default:
1212     unknown_command:
1213         /* put empty packet */
1214         buf[0] = '\0';
1215         put_packet(s, buf);
1216         break;
1217     }
1218     return RS_IDLE;
1219 }
1220
1221 void gdb_set_stop_cpu(CPUState *cpu)
1222 {
1223     gdbserver_state->c_cpu = cpu;
1224     gdbserver_state->g_cpu = cpu;
1225 }
1226
1227 #ifndef CONFIG_USER_ONLY
1228 static void gdb_vm_state_change(void *opaque, int running, RunState state)
1229 {
1230     GDBState *s = gdbserver_state;
1231     CPUArchState *env = s->c_cpu->env_ptr;
1232     CPUState *cpu = s->c_cpu;
1233     char buf[256];
1234     const char *type;
1235     int ret;
1236
1237     if (running || s->state == RS_INACTIVE) {
1238         return;
1239     }
1240     /* Is there a GDB syscall waiting to be sent?  */
1241     if (s->current_syscall_cb) {
1242         put_packet(s, s->syscall_buf);
1243         return;
1244     }
1245     switch (state) {
1246     case RUN_STATE_DEBUG:
1247         if (cpu->watchpoint_hit) {
1248             switch (cpu->watchpoint_hit->flags & BP_MEM_ACCESS) {
1249             case BP_MEM_READ:
1250                 type = "r";
1251                 break;
1252             case BP_MEM_ACCESS:
1253                 type = "a";
1254                 break;
1255             default:
1256                 type = "";
1257                 break;
1258             }
1259             snprintf(buf, sizeof(buf),
1260                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1261                      GDB_SIGNAL_TRAP, cpu_index(cpu), type,
1262                      (target_ulong)cpu->watchpoint_hit->vaddr);
1263             cpu->watchpoint_hit = NULL;
1264             goto send_packet;
1265         }
1266         tb_flush(env);
1267         ret = GDB_SIGNAL_TRAP;
1268         break;
1269     case RUN_STATE_PAUSED:
1270         ret = GDB_SIGNAL_INT;
1271         break;
1272     case RUN_STATE_SHUTDOWN:
1273         ret = GDB_SIGNAL_QUIT;
1274         break;
1275     case RUN_STATE_IO_ERROR:
1276         ret = GDB_SIGNAL_IO;
1277         break;
1278     case RUN_STATE_WATCHDOG:
1279         ret = GDB_SIGNAL_ALRM;
1280         break;
1281     case RUN_STATE_INTERNAL_ERROR:
1282         ret = GDB_SIGNAL_ABRT;
1283         break;
1284     case RUN_STATE_SAVE_VM:
1285     case RUN_STATE_RESTORE_VM:
1286         return;
1287     case RUN_STATE_FINISH_MIGRATE:
1288         ret = GDB_SIGNAL_XCPU;
1289         break;
1290     default:
1291         ret = GDB_SIGNAL_UNKNOWN;
1292         break;
1293     }
1294     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, cpu_index(cpu));
1295
1296 send_packet:
1297     put_packet(s, buf);
1298
1299     /* disable single step if it was enabled */
1300     cpu_single_step(cpu, 0);
1301 }
1302 #endif
1303
1304 /* Send a gdb syscall request.
1305    This accepts limited printf-style format specifiers, specifically:
1306     %x  - target_ulong argument printed in hex.
1307     %lx - 64-bit argument printed in hex.
1308     %s  - string pointer (target_ulong) and length (int) pair.  */
1309 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1310 {
1311     va_list va;
1312     char *p;
1313     char *p_end;
1314     target_ulong addr;
1315     uint64_t i64;
1316     GDBState *s;
1317
1318     s = gdbserver_state;
1319     if (!s)
1320         return;
1321     s->current_syscall_cb = cb;
1322 #ifndef CONFIG_USER_ONLY
1323     vm_stop(RUN_STATE_DEBUG);
1324 #endif
1325     va_start(va, fmt);
1326     p = s->syscall_buf;
1327     p_end = &s->syscall_buf[sizeof(s->syscall_buf)];
1328     *(p++) = 'F';
1329     while (*fmt) {
1330         if (*fmt == '%') {
1331             fmt++;
1332             switch (*fmt++) {
1333             case 'x':
1334                 addr = va_arg(va, target_ulong);
1335                 p += snprintf(p, p_end - p, TARGET_FMT_lx, addr);
1336                 break;
1337             case 'l':
1338                 if (*(fmt++) != 'x')
1339                     goto bad_format;
1340                 i64 = va_arg(va, uint64_t);
1341                 p += snprintf(p, p_end - p, "%" PRIx64, i64);
1342                 break;
1343             case 's':
1344                 addr = va_arg(va, target_ulong);
1345                 p += snprintf(p, p_end - p, TARGET_FMT_lx "/%x",
1346                               addr, va_arg(va, int));
1347                 break;
1348             default:
1349             bad_format:
1350                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
1351                         fmt - 1);
1352                 break;
1353             }
1354         } else {
1355             *(p++) = *(fmt++);
1356         }
1357     }
1358     *p = 0;
1359     va_end(va);
1360 #ifdef CONFIG_USER_ONLY
1361     put_packet(s, s->syscall_buf);
1362     gdb_handlesig(s->c_cpu, 0);
1363 #else
1364     /* In this case wait to send the syscall packet until notification that
1365        the CPU has stopped.  This must be done because if the packet is sent
1366        now the reply from the syscall request could be received while the CPU
1367        is still in the running state, which can cause packets to be dropped
1368        and state transition 'T' packets to be sent while the syscall is still
1369        being processed.  */
1370     cpu_exit(s->c_cpu);
1371 #endif
1372 }
1373
1374 static void gdb_read_byte(GDBState *s, int ch)
1375 {
1376     int i, csum;
1377     uint8_t reply;
1378
1379 #ifndef CONFIG_USER_ONLY
1380     if (s->last_packet_len) {
1381         /* Waiting for a response to the last packet.  If we see the start
1382            of a new command then abandon the previous response.  */
1383         if (ch == '-') {
1384 #ifdef DEBUG_GDB
1385             printf("Got NACK, retransmitting\n");
1386 #endif
1387             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
1388         }
1389 #ifdef DEBUG_GDB
1390         else if (ch == '+')
1391             printf("Got ACK\n");
1392         else
1393             printf("Got '%c' when expecting ACK/NACK\n", ch);
1394 #endif
1395         if (ch == '+' || ch == '$')
1396             s->last_packet_len = 0;
1397         if (ch != '$')
1398             return;
1399     }
1400     if (runstate_is_running()) {
1401         /* when the CPU is running, we cannot do anything except stop
1402            it when receiving a char */
1403         vm_stop(RUN_STATE_PAUSED);
1404     } else
1405 #endif
1406     {
1407         switch(s->state) {
1408         case RS_IDLE:
1409             if (ch == '$') {
1410                 s->line_buf_index = 0;
1411                 s->state = RS_GETLINE;
1412             }
1413             break;
1414         case RS_GETLINE:
1415             if (ch == '#') {
1416             s->state = RS_CHKSUM1;
1417             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1418                 s->state = RS_IDLE;
1419             } else {
1420             s->line_buf[s->line_buf_index++] = ch;
1421             }
1422             break;
1423         case RS_CHKSUM1:
1424             s->line_buf[s->line_buf_index] = '\0';
1425             s->line_csum = fromhex(ch) << 4;
1426             s->state = RS_CHKSUM2;
1427             break;
1428         case RS_CHKSUM2:
1429             s->line_csum |= fromhex(ch);
1430             csum = 0;
1431             for(i = 0; i < s->line_buf_index; i++) {
1432                 csum += s->line_buf[i];
1433             }
1434             if (s->line_csum != (csum & 0xff)) {
1435                 reply = '-';
1436                 put_buffer(s, &reply, 1);
1437                 s->state = RS_IDLE;
1438             } else {
1439                 reply = '+';
1440                 put_buffer(s, &reply, 1);
1441                 s->state = gdb_handle_packet(s, s->line_buf);
1442             }
1443             break;
1444         default:
1445             abort();
1446         }
1447     }
1448 }
1449
1450 /* Tell the remote gdb that the process has exited.  */
1451 void gdb_exit(CPUArchState *env, int code)
1452 {
1453   GDBState *s;
1454   char buf[4];
1455
1456   s = gdbserver_state;
1457   if (!s) {
1458       return;
1459   }
1460 #ifdef CONFIG_USER_ONLY
1461   if (gdbserver_fd < 0 || s->fd < 0) {
1462       return;
1463   }
1464 #else
1465   if (!s->chr) {
1466       return;
1467   }
1468 #endif
1469
1470   snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
1471   put_packet(s, buf);
1472
1473 #ifndef CONFIG_USER_ONLY
1474   qemu_chr_delete(s->chr);
1475 #endif
1476 }
1477
1478 #ifdef CONFIG_USER_ONLY
1479 int
1480 gdb_queuesig (void)
1481 {
1482     GDBState *s;
1483
1484     s = gdbserver_state;
1485
1486     if (gdbserver_fd < 0 || s->fd < 0)
1487         return 0;
1488     else
1489         return 1;
1490 }
1491
1492 int
1493 gdb_handlesig(CPUState *cpu, int sig)
1494 {
1495     CPUArchState *env = cpu->env_ptr;
1496     GDBState *s;
1497     char buf[256];
1498     int n;
1499
1500     s = gdbserver_state;
1501     if (gdbserver_fd < 0 || s->fd < 0) {
1502         return sig;
1503     }
1504
1505     /* disable single step if it was enabled */
1506     cpu_single_step(cpu, 0);
1507     tb_flush(env);
1508
1509     if (sig != 0) {
1510         snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));
1511         put_packet(s, buf);
1512     }
1513     /* put_packet() might have detected that the peer terminated the
1514        connection.  */
1515     if (s->fd < 0) {
1516         return sig;
1517     }
1518
1519     sig = 0;
1520     s->state = RS_IDLE;
1521     s->running_state = 0;
1522     while (s->running_state == 0) {
1523         n = read(s->fd, buf, 256);
1524         if (n > 0) {
1525             int i;
1526
1527             for (i = 0; i < n; i++) {
1528                 gdb_read_byte(s, buf[i]);
1529             }
1530         } else if (n == 0 || errno != EAGAIN) {
1531             /* XXX: Connection closed.  Should probably wait for another
1532                connection before continuing.  */
1533             return sig;
1534         }
1535     }
1536     sig = s->signal;
1537     s->signal = 0;
1538     return sig;
1539 }
1540
1541 /* Tell the remote gdb that the process has exited due to SIG.  */
1542 void gdb_signalled(CPUArchState *env, int sig)
1543 {
1544     GDBState *s;
1545     char buf[4];
1546
1547     s = gdbserver_state;
1548     if (gdbserver_fd < 0 || s->fd < 0) {
1549         return;
1550     }
1551
1552     snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb(sig));
1553     put_packet(s, buf);
1554 }
1555
1556 static void gdb_accept(void)
1557 {
1558     GDBState *s;
1559     struct sockaddr_in sockaddr;
1560     socklen_t len;
1561     int fd;
1562
1563     for(;;) {
1564         len = sizeof(sockaddr);
1565         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
1566         if (fd < 0 && errno != EINTR) {
1567             perror("accept");
1568             return;
1569         } else if (fd >= 0) {
1570 #ifndef _WIN32
1571             fcntl(fd, F_SETFD, FD_CLOEXEC);
1572 #endif
1573             break;
1574         }
1575     }
1576
1577     /* set short latency */
1578     socket_set_nodelay(fd);
1579
1580     s = g_malloc0(sizeof(GDBState));
1581     s->c_cpu = first_cpu;
1582     s->g_cpu = first_cpu;
1583     s->fd = fd;
1584     gdb_has_xml = false;
1585
1586     gdbserver_state = s;
1587
1588     fcntl(fd, F_SETFL, O_NONBLOCK);
1589 }
1590
1591 static int gdbserver_open(int port)
1592 {
1593     struct sockaddr_in sockaddr;
1594     int fd, ret;
1595
1596     fd = socket(PF_INET, SOCK_STREAM, 0);
1597     if (fd < 0) {
1598         perror("socket");
1599         return -1;
1600     }
1601 #ifndef _WIN32
1602     fcntl(fd, F_SETFD, FD_CLOEXEC);
1603 #endif
1604
1605     socket_set_fast_reuse(fd);
1606
1607     sockaddr.sin_family = AF_INET;
1608     sockaddr.sin_port = htons(port);
1609     sockaddr.sin_addr.s_addr = 0;
1610     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
1611     if (ret < 0) {
1612         perror("bind");
1613         close(fd);
1614         return -1;
1615     }
1616     ret = listen(fd, 0);
1617     if (ret < 0) {
1618         perror("listen");
1619         close(fd);
1620         return -1;
1621     }
1622     return fd;
1623 }
1624
1625 int gdbserver_start(int port)
1626 {
1627     gdbserver_fd = gdbserver_open(port);
1628     if (gdbserver_fd < 0)
1629         return -1;
1630     /* accept connections */
1631     gdb_accept();
1632     return 0;
1633 }
1634
1635 /* Disable gdb stub for child processes.  */
1636 void gdbserver_fork(CPUArchState *env)
1637 {
1638     CPUState *cpu = ENV_GET_CPU(env);
1639     GDBState *s = gdbserver_state;
1640
1641     if (gdbserver_fd < 0 || s->fd < 0) {
1642         return;
1643     }
1644     close(s->fd);
1645     s->fd = -1;
1646     cpu_breakpoint_remove_all(cpu, BP_GDB);
1647     cpu_watchpoint_remove_all(cpu, BP_GDB);
1648 }
1649 #else
1650 static int gdb_chr_can_receive(void *opaque)
1651 {
1652   /* We can handle an arbitrarily large amount of data.
1653    Pick the maximum packet size, which is as good as anything.  */
1654   return MAX_PACKET_LENGTH;
1655 }
1656
1657 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
1658 {
1659     int i;
1660
1661     for (i = 0; i < size; i++) {
1662         gdb_read_byte(gdbserver_state, buf[i]);
1663     }
1664 }
1665
1666 static void gdb_chr_event(void *opaque, int event)
1667 {
1668     switch (event) {
1669     case CHR_EVENT_OPENED:
1670         vm_stop(RUN_STATE_PAUSED);
1671         gdb_has_xml = false;
1672         break;
1673     default:
1674         break;
1675     }
1676 }
1677
1678 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
1679 {
1680     char buf[MAX_PACKET_LENGTH];
1681
1682     buf[0] = 'O';
1683     if (len > (MAX_PACKET_LENGTH/2) - 1)
1684         len = (MAX_PACKET_LENGTH/2) - 1;
1685     memtohex(buf + 1, (uint8_t *)msg, len);
1686     put_packet(s, buf);
1687 }
1688
1689 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
1690 {
1691     const char *p = (const char *)buf;
1692     int max_sz;
1693
1694     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
1695     for (;;) {
1696         if (len <= max_sz) {
1697             gdb_monitor_output(gdbserver_state, p, len);
1698             break;
1699         }
1700         gdb_monitor_output(gdbserver_state, p, max_sz);
1701         p += max_sz;
1702         len -= max_sz;
1703     }
1704     return len;
1705 }
1706
1707 #ifndef _WIN32
1708 static void gdb_sigterm_handler(int signal)
1709 {
1710     if (runstate_is_running()) {
1711         vm_stop(RUN_STATE_PAUSED);
1712     }
1713 }
1714 #endif
1715
1716 int gdbserver_start(const char *device)
1717 {
1718     GDBState *s;
1719     char gdbstub_device_name[128];
1720     CharDriverState *chr = NULL;
1721     CharDriverState *mon_chr;
1722
1723     if (!device)
1724         return -1;
1725     if (strcmp(device, "none") != 0) {
1726         if (strstart(device, "tcp:", NULL)) {
1727             /* enforce required TCP attributes */
1728             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
1729                      "%s,nowait,nodelay,server", device);
1730             device = gdbstub_device_name;
1731         }
1732 #ifndef _WIN32
1733         else if (strcmp(device, "stdio") == 0) {
1734             struct sigaction act;
1735
1736             memset(&act, 0, sizeof(act));
1737             act.sa_handler = gdb_sigterm_handler;
1738             sigaction(SIGINT, &act, NULL);
1739         }
1740 #endif
1741         chr = qemu_chr_new("gdb", device, NULL);
1742         if (!chr)
1743             return -1;
1744
1745         qemu_chr_fe_claim_no_fail(chr);
1746         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
1747                               gdb_chr_event, NULL);
1748     }
1749
1750     s = gdbserver_state;
1751     if (!s) {
1752         s = g_malloc0(sizeof(GDBState));
1753         gdbserver_state = s;
1754
1755         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
1756
1757         /* Initialize a monitor terminal for gdb */
1758         mon_chr = qemu_chr_alloc();
1759         mon_chr->chr_write = gdb_monitor_write;
1760         monitor_init(mon_chr, 0);
1761     } else {
1762         if (s->chr)
1763             qemu_chr_delete(s->chr);
1764         mon_chr = s->mon_chr;
1765         memset(s, 0, sizeof(GDBState));
1766     }
1767     s->c_cpu = first_cpu;
1768     s->g_cpu = first_cpu;
1769     s->chr = chr;
1770     s->state = chr ? RS_IDLE : RS_INACTIVE;
1771     s->mon_chr = mon_chr;
1772     s->current_syscall_cb = NULL;
1773
1774     return 0;
1775 }
1776 #endif