gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "qemu/osdep.h"
  20 #include "qapi/error.h"
  21 #include "qemu/error-report.h"
  22 #include "qemu/cutils.h"
  23 #include "cpu.h"
  24 #ifdef CONFIG_USER_ONLY
  25 #include "qemu.h"
  26 #else
  27 #include "monitor/monitor.h"
  28 #include "chardev/char.h"
  29 #include "chardev/char-fe.h"
  30 #include "sysemu/sysemu.h"
  31 #include "exec/gdbstub.h"
  32 #endif
  33
  34 #define MAX_PACKET_LENGTH 4096
  35
  36 #include "qemu/sockets.h"
  37 #include "sysemu/hw_accel.h"
  38 #include "sysemu/kvm.h"
  39 #include "exec/semihost.h"
  40 #include "exec/exec-all.h"
  41
  42 #ifdef CONFIG_USER_ONLY
  43 #define GDB_ATTACHED "0"
  44 #else
  45 #define GDB_ATTACHED "1"
  46 #endif
  47
  48 static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
  49                                          uint8_t *buf, int len, bool is_write)
  50 {
  51     CPUClass *cc = CPU_GET_CLASS(cpu);
  52
  53     if (cc->memory_rw_debug) {
  54         return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
  55     }
  56     return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
  57 }
  58
  59 enum {
  60     GDB_SIGNAL_0 = 0,
  61     GDB_SIGNAL_INT = 2,
  62     GDB_SIGNAL_QUIT = 3,
  63     GDB_SIGNAL_TRAP = 5,
  64     GDB_SIGNAL_ABRT = 6,
  65     GDB_SIGNAL_ALRM = 14,
  66     GDB_SIGNAL_IO = 23,
  67     GDB_SIGNAL_XCPU = 24,
  68     GDB_SIGNAL_UNKNOWN = 143
  69 };
  70
  71 #ifdef CONFIG_USER_ONLY
  72
  73 /* Map target signal numbers to GDB protocol signal numbers and vice
  74  * versa.  For user emulation's currently supported systems, we can
  75  * assume most signals are defined.
  76  */
  77
  78 static int gdb_signal_table[] = {
  79     0,
  80     TARGET_SIGHUP,
  81     TARGET_SIGINT,
  82     TARGET_SIGQUIT,
  83     TARGET_SIGILL,
  84     TARGET_SIGTRAP,
  85     TARGET_SIGABRT,
  86     -1, /* SIGEMT */
  87     TARGET_SIGFPE,
  88     TARGET_SIGKILL,
  89     TARGET_SIGBUS,
  90     TARGET_SIGSEGV,
  91     TARGET_SIGSYS,
  92     TARGET_SIGPIPE,
  93     TARGET_SIGALRM,
  94     TARGET_SIGTERM,
  95     TARGET_SIGURG,
  96     TARGET_SIGSTOP,
  97     TARGET_SIGTSTP,
  98     TARGET_SIGCONT,
  99     TARGET_SIGCHLD,
 100     TARGET_SIGTTIN,
 101     TARGET_SIGTTOU,
 102     TARGET_SIGIO,
 103     TARGET_SIGXCPU,
 104     TARGET_SIGXFSZ,
 105     TARGET_SIGVTALRM,
 106     TARGET_SIGPROF,
 107     TARGET_SIGWINCH,
 108     -1, /* SIGLOST */
 109     TARGET_SIGUSR1,
 110     TARGET_SIGUSR2,
 111 #ifdef TARGET_SIGPWR
 112     TARGET_SIGPWR,
 113 #else
 114     -1,
 115 #endif
 116     -1, /* SIGPOLL */
 117     -1,
 118     -1,
 119     -1,
 120     -1,
 121     -1,
 122     -1,
 123     -1,
 124     -1,
 125     -1,
 126     -1,
 127     -1,
 128 #ifdef __SIGRTMIN
 129     __SIGRTMIN + 1,
 130     __SIGRTMIN + 2,
 131     __SIGRTMIN + 3,
 132     __SIGRTMIN + 4,
 133     __SIGRTMIN + 5,
 134     __SIGRTMIN + 6,
 135     __SIGRTMIN + 7,
 136     __SIGRTMIN + 8,
 137     __SIGRTMIN + 9,
 138     __SIGRTMIN + 10,
 139     __SIGRTMIN + 11,
 140     __SIGRTMIN + 12,
 141     __SIGRTMIN + 13,
 142     __SIGRTMIN + 14,
 143     __SIGRTMIN + 15,
 144     __SIGRTMIN + 16,
 145     __SIGRTMIN + 17,
 146     __SIGRTMIN + 18,
 147     __SIGRTMIN + 19,
 148     __SIGRTMIN + 20,
 149     __SIGRTMIN + 21,
 150     __SIGRTMIN + 22,
 151     __SIGRTMIN + 23,
 152     __SIGRTMIN + 24,
 153     __SIGRTMIN + 25,
 154     __SIGRTMIN + 26,
 155     __SIGRTMIN + 27,
 156     __SIGRTMIN + 28,
 157     __SIGRTMIN + 29,
 158     __SIGRTMIN + 30,
 159     __SIGRTMIN + 31,
 160     -1, /* SIGCANCEL */
 161     __SIGRTMIN,
 162     __SIGRTMIN + 32,
 163     __SIGRTMIN + 33,
 164     __SIGRTMIN + 34,
 165     __SIGRTMIN + 35,
 166     __SIGRTMIN + 36,
 167     __SIGRTMIN + 37,
 168     __SIGRTMIN + 38,
 169     __SIGRTMIN + 39,
 170     __SIGRTMIN + 40,
 171     __SIGRTMIN + 41,
 172     __SIGRTMIN + 42,
 173     __SIGRTMIN + 43,
 174     __SIGRTMIN + 44,
 175     __SIGRTMIN + 45,
 176     __SIGRTMIN + 46,
 177     __SIGRTMIN + 47,
 178     __SIGRTMIN + 48,
 179     __SIGRTMIN + 49,
 180     __SIGRTMIN + 50,
 181     __SIGRTMIN + 51,
 182     __SIGRTMIN + 52,
 183     __SIGRTMIN + 53,
 184     __SIGRTMIN + 54,
 185     __SIGRTMIN + 55,
 186     __SIGRTMIN + 56,
 187     __SIGRTMIN + 57,
 188     __SIGRTMIN + 58,
 189     __SIGRTMIN + 59,
 190     __SIGRTMIN + 60,
 191     __SIGRTMIN + 61,
 192     __SIGRTMIN + 62,
 193     __SIGRTMIN + 63,
 194     __SIGRTMIN + 64,
 195     __SIGRTMIN + 65,
 196     __SIGRTMIN + 66,
 197     __SIGRTMIN + 67,
 198     __SIGRTMIN + 68,
 199     __SIGRTMIN + 69,
 200     __SIGRTMIN + 70,
 201     __SIGRTMIN + 71,
 202     __SIGRTMIN + 72,
 203     __SIGRTMIN + 73,
 204     __SIGRTMIN + 74,
 205     __SIGRTMIN + 75,
 206     __SIGRTMIN + 76,
 207     __SIGRTMIN + 77,
 208     __SIGRTMIN + 78,
 209     __SIGRTMIN + 79,
 210     __SIGRTMIN + 80,
 211     __SIGRTMIN + 81,
 212     __SIGRTMIN + 82,
 213     __SIGRTMIN + 83,
 214     __SIGRTMIN + 84,
 215     __SIGRTMIN + 85,
 216     __SIGRTMIN + 86,
 217     __SIGRTMIN + 87,
 218     __SIGRTMIN + 88,
 219     __SIGRTMIN + 89,
 220     __SIGRTMIN + 90,
 221     __SIGRTMIN + 91,
 222     __SIGRTMIN + 92,
 223     __SIGRTMIN + 93,
 224     __SIGRTMIN + 94,
 225     __SIGRTMIN + 95,
 226     -1, /* SIGINFO */
 227     -1, /* UNKNOWN */
 228     -1, /* DEFAULT */
 229     -1,
 230     -1,
 231     -1,
 232     -1,
 233     -1,
 234     -1
 235 #endif
 236 };
 237 #else
 238 /* In system mode we only need SIGINT and SIGTRAP; other signals
 239    are not yet supported.  */
 240
 241 enum {
 242     TARGET_SIGINT = 2,
 243     TARGET_SIGTRAP = 5
 244 };
 245
 246 static int gdb_signal_table[] = {
 247     -1,
 248     -1,
 249     TARGET_SIGINT,
 250     -1,
 251     -1,
 252     TARGET_SIGTRAP
 253 };
 254 #endif
 255
 256 #ifdef CONFIG_USER_ONLY
 257 static int target_signal_to_gdb (int sig)
 258 {
 259     int i;
 260     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 261         if (gdb_signal_table[i] == sig)
 262             return i;
 263     return GDB_SIGNAL_UNKNOWN;
 264 }
 265 #endif
 266
 267 static int gdb_signal_to_target (int sig)
 268 {
 269     if (sig < ARRAY_SIZE (gdb_signal_table))
 270         return gdb_signal_table[sig];
 271     else
 272         return -1;
 273 }
 274
 275 //#define DEBUG_GDB
 276
 277 typedef struct GDBRegisterState {
 278     int base_reg;
 279     int num_regs;
 280     gdb_reg_cb get_reg;
 281     gdb_reg_cb set_reg;
 282     const char *xml;
 283     struct GDBRegisterState *next;
 284 } GDBRegisterState;
 285
 286 enum RSState {
 287     RS_INACTIVE,
 288     RS_IDLE,
 289     RS_GETLINE,
 290     RS_GETLINE_ESC,
 291     RS_GETLINE_RLE,
 292     RS_CHKSUM1,
 293     RS_CHKSUM2,
 294 };
 295 typedef struct GDBState {
 296     CPUState *c_cpu; /* current CPU for step/continue ops */
 297     CPUState *g_cpu; /* current CPU for other ops */
 298     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 299     enum RSState state; /* parsing state */
 300     char line_buf[MAX_PACKET_LENGTH];
 301     int line_buf_index;
 302     int line_sum; /* running checksum */
 303     int line_csum; /* checksum at the end of the packet */
 304     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 305     int last_packet_len;
 306     int signal;
 307 #ifdef CONFIG_USER_ONLY
 308     int fd;
 309     int running_state;
 310 #else
 311     CharBackend chr;
 312     Chardev *mon_chr;
 313 #endif
 314     char syscall_buf[256];
 315     gdb_syscall_complete_cb current_syscall_cb;
 316 } GDBState;
 317
 318 /* By default use no IRQs and no timers while single stepping so as to
 319  * make single stepping like an ICE HW step.
 320  */
 321 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 322
 323 static GDBState *gdbserver_state;
 324
 325 bool gdb_has_xml;
 326
 327 #ifdef CONFIG_USER_ONLY
 328 /* XXX: This is not thread safe.  Do we care?  */
 329 static int gdbserver_fd = -1;
 330
 331 static int get_char(GDBState *s)
 332 {
 333     uint8_t ch;
 334     int ret;
 335
 336     for(;;) {
 337         ret = qemu_recv(s->fd, &ch, 1, 0);
 338         if (ret < 0) {
 339             if (errno == ECONNRESET)
 340                 s->fd = -1;
 341             if (errno != EINTR)
 342                 return -1;
 343         } else if (ret == 0) {
 344             close(s->fd);
 345             s->fd = -1;
 346             return -1;
 347         } else {
 348             break;
 349         }
 350     }
 351     return ch;
 352 }
 353 #endif
 354
 355 static enum {
 356     GDB_SYS_UNKNOWN,
 357     GDB_SYS_ENABLED,
 358     GDB_SYS_DISABLED,
 359 } gdb_syscall_mode;
 360
 361 /* Decide if either remote gdb syscalls or native file IO should be used. */
 362 int use_gdb_syscalls(void)
 363 {
 364     SemihostingTarget target = semihosting_get_target();
 365     if (target == SEMIHOSTING_TARGET_NATIVE) {
 366         /* -semihosting-config target=native */
 367         return false;
 368     } else if (target == SEMIHOSTING_TARGET_GDB) {
 369         /* -semihosting-config target=gdb */
 370         return true;
 371     }
 372
 373     /* -semihosting-config target=auto */
 374     /* On the first call check if gdb is connected and remember. */
 375     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 376         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 377                                             : GDB_SYS_DISABLED);
 378     }
 379     return gdb_syscall_mode == GDB_SYS_ENABLED;
 380 }
 381
 382 /* Resume execution.  */
 383 static inline void gdb_continue(GDBState *s)
 384 {
 385 #ifdef CONFIG_USER_ONLY
 386     s->running_state = 1;
 387 #else
 388     if (!runstate_needs_reset()) {
 389         vm_start();
 390     }
 391 #endif
 392 }
 393
 394 /*
 395  * Resume execution, per CPU actions. For user-mode emulation it's
 396  * equivalent to gdb_continue.
 397  */
 398 static int gdb_continue_partial(GDBState *s, char *newstates)
 399 {
 400     CPUState *cpu;
 401     int res = 0;
 402 #ifdef CONFIG_USER_ONLY
 403     /*
 404      * This is not exactly accurate, but it's an improvement compared to the
 405      * previous situation, where only one CPU would be single-stepped.
 406      */
 407     CPU_FOREACH(cpu) {
 408         if (newstates[cpu->cpu_index] == 's') {
 409             cpu_single_step(cpu, sstep_flags);
 410         }
 411     }
 412     s->running_state = 1;
 413 #else
 414     int flag = 0;
 415
 416     if (!runstate_needs_reset()) {
 417         if (vm_prepare_start()) {
 418             return 0;
 419         }
 420
 421         CPU_FOREACH(cpu) {
 422             switch (newstates[cpu->cpu_index]) {
 423             case 0:
 424             case 1:
 425                 break; /* nothing to do here */
 426             case 's':
 427                 cpu_single_step(cpu, sstep_flags);
 428                 cpu_resume(cpu);
 429                 flag = 1;
 430                 break;
 431             case 'c':
 432                 cpu_resume(cpu);
 433                 flag = 1;
 434                 break;
 435             default:
 436                 res = -1;
 437                 break;
 438             }
 439         }
 440     }
 441     if (flag) {
 442         qemu_clock_enable(QEMU_CLOCK_VIRTUAL, true);
 443     }
 444 #endif
 445     return res;
 446 }
 447
 448 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 449 {
 450 #ifdef CONFIG_USER_ONLY
 451     int ret;
 452
 453     while (len > 0) {
 454         ret = send(s->fd, buf, len, 0);
 455         if (ret < 0) {
 456             if (errno != EINTR)
 457                 return;
 458         } else {
 459             buf += ret;
 460             len -= ret;
 461         }
 462     }
 463 #else
 464     /* XXX this blocks entire thread. Rewrite to use
 465      * qemu_chr_fe_write and background I/O callbacks */
 466     qemu_chr_fe_write_all(&s->chr, buf, len);
 467 #endif
 468 }
 469
 470 static inline int fromhex(int v)
 471 {
 472     if (v >= '0' && v <= '9')
 473         return v - '0';
 474     else if (v >= 'A' && v <= 'F')
 475         return v - 'A' + 10;
 476     else if (v >= 'a' && v <= 'f')
 477         return v - 'a' + 10;
 478     else
 479         return 0;
 480 }
 481
 482 static inline int tohex(int v)
 483 {
 484     if (v < 10)
 485         return v + '0';
 486     else
 487         return v - 10 + 'a';
 488 }
 489
 490 static void memtohex(char *buf, const uint8_t *mem, int len)
 491 {
 492     int i, c;
 493     char *q;
 494     q = buf;
 495     for(i = 0; i < len; i++) {
 496         c = mem[i];
 497         *q++ = tohex(c >> 4);
 498         *q++ = tohex(c & 0xf);
 499     }
 500     *q = '\0';
 501 }
 502
 503 static void hextomem(uint8_t *mem, const char *buf, int len)
 504 {
 505     int i;
 506
 507     for(i = 0; i < len; i++) {
 508         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 509         buf += 2;
 510     }
 511 }
 512
 513 /* return -1 if error, 0 if OK */
 514 static int put_packet_binary(GDBState *s, const char *buf, int len)
 515 {
 516     int csum, i;
 517     uint8_t *p;
 518
 519     for(;;) {
 520         p = s->last_packet;
 521         *(p++) = '$';
 522         memcpy(p, buf, len);
 523         p += len;
 524         csum = 0;
 525         for(i = 0; i < len; i++) {
 526             csum += buf[i];
 527         }
 528         *(p++) = '#';
 529         *(p++) = tohex((csum >> 4) & 0xf);
 530         *(p++) = tohex((csum) & 0xf);
 531
 532         s->last_packet_len = p - s->last_packet;
 533         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 534
 535 #ifdef CONFIG_USER_ONLY
 536         i = get_char(s);
 537         if (i < 0)
 538             return -1;
 539         if (i == '+')
 540             break;
 541 #else
 542         break;
 543 #endif
 544     }
 545     return 0;
 546 }
 547
 548 /* return -1 if error, 0 if OK */
 549 static int put_packet(GDBState *s, const char *buf)
 550 {
 551 #ifdef DEBUG_GDB
 552     printf("reply='%s'\n", buf);
 553 #endif
 554
 555     return put_packet_binary(s, buf, strlen(buf));
 556 }
 557
 558 /* Encode data using the encoding for 'x' packets.  */
 559 static int memtox(char *buf, const char *mem, int len)
 560 {
 561     char *p = buf;
 562     char c;
 563
 564     while (len--) {
 565         c = *(mem++);
 566         switch (c) {
 567         case '#': case '$': case '*': case '}':
 568             *(p++) = '}';
 569             *(p++) = c ^ 0x20;
 570             break;
 571         default:
 572             *(p++) = c;
 573             break;
 574         }
 575     }
 576     return p - buf;
 577 }
 578
 579 static const char *get_feature_xml(const char *p, const char **newp,
 580                                    CPUClass *cc)
 581 {
 582     size_t len;
 583     int i;
 584     const char *name;
 585     static char target_xml[1024];
 586
 587     len = 0;
 588     while (p[len] && p[len] != ':')
 589         len++;
 590     *newp = p + len;
 591
 592     name = NULL;
 593     if (strncmp(p, "target.xml", len) == 0) {
 594         /* Generate the XML description for this CPU.  */
 595         if (!target_xml[0]) {
 596             GDBRegisterState *r;
 597             CPUState *cpu = first_cpu;
 598
 599             pstrcat(target_xml, sizeof(target_xml),
 600                     "<?xml version=\"1.0\"?>"
 601                     "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
 602                     "<target>");
 603             if (cc->gdb_arch_name) {
 604                 gchar *arch = cc->gdb_arch_name(cpu);
 605                 pstrcat(target_xml, sizeof(target_xml), "<architecture>");
 606                 pstrcat(target_xml, sizeof(target_xml), arch);
 607                 pstrcat(target_xml, sizeof(target_xml), "</architecture>");
 608                 g_free(arch);
 609             }
 610             pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
 611             pstrcat(target_xml, sizeof(target_xml), cc->gdb_core_xml_file);
 612             pstrcat(target_xml, sizeof(target_xml), "\"/>");
 613             for (r = cpu->gdb_regs; r; r = r->next) {
 614                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
 615                 pstrcat(target_xml, sizeof(target_xml), r->xml);
 616                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
 617             }
 618             pstrcat(target_xml, sizeof(target_xml), "</target>");
 619         }
 620         return target_xml;
 621     }
 622     for (i = 0; ; i++) {
 623         name = xml_builtin[i][0];
 624         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
 625             break;
 626     }
 627     return name ? xml_builtin[i][1] : NULL;
 628 }
 629
 630 static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 631 {
 632     CPUClass *cc = CPU_GET_CLASS(cpu);
 633     CPUArchState *env = cpu->env_ptr;
 634     GDBRegisterState *r;
 635
 636     if (reg < cc->gdb_num_core_regs) {
 637         return cc->gdb_read_register(cpu, mem_buf, reg);
 638     }
 639
 640     for (r = cpu->gdb_regs; r; r = r->next) {
 641         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 642             return r->get_reg(env, mem_buf, reg - r->base_reg);
 643         }
 644     }
 645     return 0;
 646 }
 647
 648 static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 649 {
 650     CPUClass *cc = CPU_GET_CLASS(cpu);
 651     CPUArchState *env = cpu->env_ptr;
 652     GDBRegisterState *r;
 653
 654     if (reg < cc->gdb_num_core_regs) {
 655         return cc->gdb_write_register(cpu, mem_buf, reg);
 656     }
 657
 658     for (r = cpu->gdb_regs; r; r = r->next) {
 659         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 660             return r->set_reg(env, mem_buf, reg - r->base_reg);
 661         }
 662     }
 663     return 0;
 664 }
 665
 666 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
 667    specifies the first register number and these registers are included in
 668    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
 669    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
 670  */
 671
 672 void gdb_register_coprocessor(CPUState *cpu,
 673                               gdb_reg_cb get_reg, gdb_reg_cb set_reg,
 674                               int num_regs, const char *xml, int g_pos)
 675 {
 676     GDBRegisterState *s;
 677     GDBRegisterState **p;
 678
 679     p = &cpu->gdb_regs;
 680     while (*p) {
 681         /* Check for duplicates.  */
 682         if (strcmp((*p)->xml, xml) == 0)
 683             return;
 684         p = &(*p)->next;
 685     }
 686
 687     s = g_new0(GDBRegisterState, 1);
 688     s->base_reg = cpu->gdb_num_regs;
 689     s->num_regs = num_regs;
 690     s->get_reg = get_reg;
 691     s->set_reg = set_reg;
 692     s->xml = xml;
 693
 694     /* Add to end of list.  */
 695     cpu->gdb_num_regs += num_regs;
 696     *p = s;
 697     if (g_pos) {
 698         if (g_pos != s->base_reg) {
 699             error_report("Error: Bad gdb register numbering for '%s', "
 700                          "expected %d got %d", xml, g_pos, s->base_reg);
 701         } else {
 702             cpu->gdb_num_g_regs = cpu->gdb_num_regs;
 703         }
 704     }
 705 }
 706
 707 #ifndef CONFIG_USER_ONLY
 708 /* Translate GDB watchpoint type to a flags value for cpu_watchpoint_* */
 709 static inline int xlat_gdb_type(CPUState *cpu, int gdbtype)
 710 {
 711     static const int xlat[] = {
 712         [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
 713         [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
 714         [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
 715     };
 716
 717     CPUClass *cc = CPU_GET_CLASS(cpu);
 718     int cputype = xlat[gdbtype];
 719
 720     if (cc->gdb_stop_before_watchpoint) {
 721         cputype |= BP_STOP_BEFORE_ACCESS;
 722     }
 723     return cputype;
 724 }
 725 #endif
 726
 727 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
 728 {
 729     CPUState *cpu;
 730     int err = 0;
 731
 732     if (kvm_enabled()) {
 733         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 734     }
 735
 736     switch (type) {
 737     case GDB_BREAKPOINT_SW:
 738     case GDB_BREAKPOINT_HW:
 739         CPU_FOREACH(cpu) {
 740             err = cpu_breakpoint_insert(cpu, addr, BP_GDB, NULL);
 741             if (err) {
 742                 break;
 743             }
 744         }
 745         return err;
 746 #ifndef CONFIG_USER_ONLY
 747     case GDB_WATCHPOINT_WRITE:
 748     case GDB_WATCHPOINT_READ:
 749     case GDB_WATCHPOINT_ACCESS:
 750         CPU_FOREACH(cpu) {
 751             err = cpu_watchpoint_insert(cpu, addr, len,
 752                                         xlat_gdb_type(cpu, type), NULL);
 753             if (err) {
 754                 break;
 755             }
 756         }
 757         return err;
 758 #endif
 759     default:
 760         return -ENOSYS;
 761     }
 762 }
 763
 764 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
 765 {
 766     CPUState *cpu;
 767     int err = 0;
 768
 769     if (kvm_enabled()) {
 770         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 771     }
 772
 773     switch (type) {
 774     case GDB_BREAKPOINT_SW:
 775     case GDB_BREAKPOINT_HW:
 776         CPU_FOREACH(cpu) {
 777             err = cpu_breakpoint_remove(cpu, addr, BP_GDB);
 778             if (err) {
 779                 break;
 780             }
 781         }
 782         return err;
 783 #ifndef CONFIG_USER_ONLY
 784     case GDB_WATCHPOINT_WRITE:
 785     case GDB_WATCHPOINT_READ:
 786     case GDB_WATCHPOINT_ACCESS:
 787         CPU_FOREACH(cpu) {
 788             err = cpu_watchpoint_remove(cpu, addr, len,
 789                                         xlat_gdb_type(cpu, type));
 790             if (err)
 791                 break;
 792         }
 793         return err;
 794 #endif
 795     default:
 796         return -ENOSYS;
 797     }
 798 }
 799
 800 static void gdb_breakpoint_remove_all(void)
 801 {
 802     CPUState *cpu;
 803
 804     if (kvm_enabled()) {
 805         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
 806         return;
 807     }
 808
 809     CPU_FOREACH(cpu) {
 810         cpu_breakpoint_remove_all(cpu, BP_GDB);
 811 #ifndef CONFIG_USER_ONLY
 812         cpu_watchpoint_remove_all(cpu, BP_GDB);
 813 #endif
 814     }
 815 }
 816
 817 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 818 {
 819     CPUState *cpu = s->c_cpu;
 820
 821     cpu_synchronize_state(cpu);
 822     cpu_set_pc(cpu, pc);
 823 }
 824
 825 static CPUState *find_cpu(uint32_t thread_id)
 826 {
 827     CPUState *cpu;
 828
 829     CPU_FOREACH(cpu) {
 830         if (cpu_index(cpu) == thread_id) {
 831             return cpu;
 832         }
 833     }
 834
 835     return NULL;
 836 }
 837
 838 static int is_query_packet(const char *p, const char *query, char separator)
 839 {
 840     unsigned int query_len = strlen(query);
 841
 842     return strncmp(p, query, query_len) == 0 &&
 843         (p[query_len] == '\0' || p[query_len] == separator);
 844 }
 845
 846 /**
 847  * gdb_handle_vcont - Parses and handles a vCont packet.
 848  * returns -ENOTSUP if a command is unsupported, -EINVAL or -ERANGE if there is
 849  *         a format error, 0 on success.
 850  */
 851 static int gdb_handle_vcont(GDBState *s, const char *p)
 852 {
 853     int res, idx, signal = 0;
 854     char cur_action;
 855     char *newstates;
 856     unsigned long tmp;
 857     CPUState *cpu;
 858 #ifdef CONFIG_USER_ONLY
 859     int max_cpus = 1; /* global variable max_cpus exists only in system mode */
 860
 861     CPU_FOREACH(cpu) {
 862         max_cpus = max_cpus <= cpu->cpu_index ? cpu->cpu_index + 1 : max_cpus;
 863     }
 864 #endif
 865     /* uninitialised CPUs stay 0 */
 866     newstates = g_new0(char, max_cpus);
 867
 868     /* mark valid CPUs with 1 */
 869     CPU_FOREACH(cpu) {
 870         newstates[cpu->cpu_index] = 1;
 871     }
 872
 873     /*
 874      * res keeps track of what error we are returning, with -ENOTSUP meaning
 875      * that the command is unknown or unsupported, thus returning an empty
 876      * packet, while -EINVAL and -ERANGE cause an E22 packet, due to invalid,
 877      *  or incorrect parameters passed.
 878      */
 879     res = 0;
 880     while (*p) {
 881         if (*p++ != ';') {
 882             res = -ENOTSUP;
 883             goto out;
 884         }
 885
 886         cur_action = *p++;
 887         if (cur_action == 'C' || cur_action == 'S') {
 888             cur_action = tolower(cur_action);
 889             res = qemu_strtoul(p + 1, &p, 16, &tmp);
 890             if (res) {
 891                 goto out;
 892             }
 893             signal = gdb_signal_to_target(tmp);
 894         } else if (cur_action != 'c' && cur_action != 's') {
 895             /* unknown/invalid/unsupported command */
 896             res = -ENOTSUP;
 897             goto out;
 898         }
 899         /* thread specification. special values: (none), -1 = all; 0 = any */
 900         if ((p[0] == ':' && p[1] == '-' && p[2] == '1') || (p[0] != ':')) {
 901             if (*p == ':') {
 902                 p += 3;
 903             }
 904             for (idx = 0; idx < max_cpus; idx++) {
 905                 if (newstates[idx] == 1) {
 906                     newstates[idx] = cur_action;
 907                 }
 908             }
 909         } else if (*p == ':') {
 910             p++;
 911             res = qemu_strtoul(p, &p, 16, &tmp);
 912             if (res) {
 913                 goto out;
 914             }
 915             idx = tmp;
 916             /* 0 means any thread, so we pick the first valid CPU */
 917             if (!idx) {
 918                 idx = cpu_index(first_cpu);
 919             }
 920
 921             /*
 922              * If we are in user mode, the thread specified is actually a
 923              * thread id, and not an index. We need to find the actual
 924              * CPU first, and only then we can use its index.
 925              */
 926             cpu = find_cpu(idx);
 927             /* invalid CPU/thread specified */
 928             if (!idx || !cpu) {
 929                 res = -EINVAL;
 930                 goto out;
 931             }
 932             /* only use if no previous match occourred */
 933             if (newstates[cpu->cpu_index] == 1) {
 934                 newstates[cpu->cpu_index] = cur_action;
 935             }
 936         }
 937     }
 938     s->signal = signal;
 939     gdb_continue_partial(s, newstates);
 940
 941 out:
 942     g_free(newstates);
 943
 944     return res;
 945 }
 946
 947 static int gdb_handle_packet(GDBState *s, const char *line_buf)
 948 {
 949     CPUState *cpu;
 950     CPUClass *cc;
 951     const char *p;
 952     uint32_t thread;
 953     int ch, reg_size, type, res;
 954     char buf[MAX_PACKET_LENGTH];
 955     uint8_t mem_buf[MAX_PACKET_LENGTH];
 956     uint8_t *registers;
 957     target_ulong addr, len;
 958
 959 #ifdef DEBUG_GDB
 960     printf("command='%s'\n", line_buf);
 961 #endif
 962     p = line_buf;
 963     ch = *p++;
 964     switch(ch) {
 965     case '?':
 966         /* TODO: Make this return the correct value for user-mode.  */
 967         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
 968                  cpu_index(s->c_cpu));
 969         put_packet(s, buf);
 970         /* Remove all the breakpoints when this query is issued,
 971          * because gdb is doing and initial connect and the state
 972          * should be cleaned up.
 973          */
 974         gdb_breakpoint_remove_all();
 975         break;
 976     case 'c':
 977         if (*p != '\0') {
 978             addr = strtoull(p, (char **)&p, 16);
 979             gdb_set_cpu_pc(s, addr);
 980         }
 981         s->signal = 0;
 982         gdb_continue(s);
 983         return RS_IDLE;
 984     case 'C':
 985         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
 986         if (s->signal == -1)
 987             s->signal = 0;
 988         gdb_continue(s);
 989         return RS_IDLE;
 990     case 'v':
 991         if (strncmp(p, "Cont", 4) == 0) {
 992             p += 4;
 993             if (*p == '?') {
 994                 put_packet(s, "vCont;c;C;s;S");
 995                 break;
 996             }
 997
 998             res = gdb_handle_vcont(s, p);
 999
1000             if (res) {
1001                 if ((res == -EINVAL) || (res == -ERANGE)) {
1002                     put_packet(s, "E22");
1003                     break;
1004                 }
1005                 goto unknown_command;
1006             }
1007             break;
1008         } else {
1009             goto unknown_command;
1010         }
1011     case 'k':
1012         /* Kill the target */
1013         error_report("QEMU: Terminated via GDBstub");
1014         exit(0);
1015     case 'D':
1016         /* Detach packet */
1017         gdb_breakpoint_remove_all();
1018         gdb_syscall_mode = GDB_SYS_DISABLED;
1019         gdb_continue(s);
1020         put_packet(s, "OK");
1021         break;
1022     case 's':
1023         if (*p != '\0') {
1024             addr = strtoull(p, (char **)&p, 16);
1025             gdb_set_cpu_pc(s, addr);
1026         }
1027         cpu_single_step(s->c_cpu, sstep_flags);
1028         gdb_continue(s);
1029         return RS_IDLE;
1030     case 'F':
1031         {
1032             target_ulong ret;
1033             target_ulong err;
1034
1035             ret = strtoull(p, (char **)&p, 16);
1036             if (*p == ',') {
1037                 p++;
1038                 err = strtoull(p, (char **)&p, 16);
1039             } else {
1040                 err = 0;
1041             }
1042             if (*p == ',')
1043                 p++;
1044             type = *p;
1045             if (s->current_syscall_cb) {
1046                 s->current_syscall_cb(s->c_cpu, ret, err);
1047                 s->current_syscall_cb = NULL;
1048             }
1049             if (type == 'C') {
1050                 put_packet(s, "T02");
1051             } else {
1052                 gdb_continue(s);
1053             }
1054         }
1055         break;
1056     case 'g':
1057         cpu_synchronize_state(s->g_cpu);
1058         len = 0;
1059         for (addr = 0; addr < s->g_cpu->gdb_num_g_regs; addr++) {
1060             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1061             len += reg_size;
1062         }
1063         memtohex(buf, mem_buf, len);
1064         put_packet(s, buf);
1065         break;
1066     case 'G':
1067         cpu_synchronize_state(s->g_cpu);
1068         registers = mem_buf;
1069         len = strlen(p) / 2;
1070         hextomem((uint8_t *)registers, p, len);
1071         for (addr = 0; addr < s->g_cpu->gdb_num_g_regs && len > 0; addr++) {
1072             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1073             len -= reg_size;
1074             registers += reg_size;
1075         }
1076         put_packet(s, "OK");
1077         break;
1078     case 'm':
1079         addr = strtoull(p, (char **)&p, 16);
1080         if (*p == ',')
1081             p++;
1082         len = strtoull(p, NULL, 16);
1083
1084         /* memtohex() doubles the required space */
1085         if (len > MAX_PACKET_LENGTH / 2) {
1086             put_packet (s, "E22");
1087             break;
1088         }
1089
1090         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
1091             put_packet (s, "E14");
1092         } else {
1093             memtohex(buf, mem_buf, len);
1094             put_packet(s, buf);
1095         }
1096         break;
1097     case 'M':
1098         addr = strtoull(p, (char **)&p, 16);
1099         if (*p == ',')
1100             p++;
1101         len = strtoull(p, (char **)&p, 16);
1102         if (*p == ':')
1103             p++;
1104
1105         /* hextomem() reads 2*len bytes */
1106         if (len > strlen(p) / 2) {
1107             put_packet (s, "E22");
1108             break;
1109         }
1110         hextomem(mem_buf, p, len);
1111         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
1112                                    true) != 0) {
1113             put_packet(s, "E14");
1114         } else {
1115             put_packet(s, "OK");
1116         }
1117         break;
1118     case 'p':
1119         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1120            This works, but can be very slow.  Anything new enough to
1121            understand XML also knows how to use this properly.  */
1122         if (!gdb_has_xml)
1123             goto unknown_command;
1124         addr = strtoull(p, (char **)&p, 16);
1125         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1126         if (reg_size) {
1127             memtohex(buf, mem_buf, reg_size);
1128             put_packet(s, buf);
1129         } else {
1130             put_packet(s, "E14");
1131         }
1132         break;
1133     case 'P':
1134         if (!gdb_has_xml)
1135             goto unknown_command;
1136         addr = strtoull(p, (char **)&p, 16);
1137         if (*p == '=')
1138             p++;
1139         reg_size = strlen(p) / 2;
1140         hextomem(mem_buf, p, reg_size);
1141         gdb_write_register(s->g_cpu, mem_buf, addr);
1142         put_packet(s, "OK");
1143         break;
1144     case 'Z':
1145     case 'z':
1146         type = strtoul(p, (char **)&p, 16);
1147         if (*p == ',')
1148             p++;
1149         addr = strtoull(p, (char **)&p, 16);
1150         if (*p == ',')
1151             p++;
1152         len = strtoull(p, (char **)&p, 16);
1153         if (ch == 'Z')
1154             res = gdb_breakpoint_insert(addr, len, type);
1155         else
1156             res = gdb_breakpoint_remove(addr, len, type);
1157         if (res >= 0)
1158              put_packet(s, "OK");
1159         else if (res == -ENOSYS)
1160             put_packet(s, "");
1161         else
1162             put_packet(s, "E22");
1163         break;
1164     case 'H':
1165         type = *p++;
1166         thread = strtoull(p, (char **)&p, 16);
1167         if (thread == -1 || thread == 0) {
1168             put_packet(s, "OK");
1169             break;
1170         }
1171         cpu = find_cpu(thread);
1172         if (cpu == NULL) {
1173             put_packet(s, "E22");
1174             break;
1175         }
1176         switch (type) {
1177         case 'c':
1178             s->c_cpu = cpu;
1179             put_packet(s, "OK");
1180             break;
1181         case 'g':
1182             s->g_cpu = cpu;
1183             put_packet(s, "OK");
1184             break;
1185         default:
1186              put_packet(s, "E22");
1187              break;
1188         }
1189         break;
1190     case 'T':
1191         thread = strtoull(p, (char **)&p, 16);
1192         cpu = find_cpu(thread);
1193
1194         if (cpu != NULL) {
1195             put_packet(s, "OK");
1196         } else {
1197             put_packet(s, "E22");
1198         }
1199         break;
1200     case 'q':
1201     case 'Q':
1202         /* parse any 'q' packets here */
1203         if (!strcmp(p,"qemu.sstepbits")) {
1204             /* Query Breakpoint bit definitions */
1205             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1206                      SSTEP_ENABLE,
1207                      SSTEP_NOIRQ,
1208                      SSTEP_NOTIMER);
1209             put_packet(s, buf);
1210             break;
1211         } else if (is_query_packet(p, "qemu.sstep", '=')) {
1212             /* Display or change the sstep_flags */
1213             p += 10;
1214             if (*p != '=') {
1215                 /* Display current setting */
1216                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1217                 put_packet(s, buf);
1218                 break;
1219             }
1220             p++;
1221             type = strtoul(p, (char **)&p, 16);
1222             sstep_flags = type;
1223             put_packet(s, "OK");
1224             break;
1225         } else if (strcmp(p,"C") == 0) {
1226             /* "Current thread" remains vague in the spec, so always return
1227              *  the first CPU (gdb returns the first thread). */
1228             put_packet(s, "QC1");
1229             break;
1230         } else if (strcmp(p,"fThreadInfo") == 0) {
1231             s->query_cpu = first_cpu;
1232             goto report_cpuinfo;
1233         } else if (strcmp(p,"sThreadInfo") == 0) {
1234         report_cpuinfo:
1235             if (s->query_cpu) {
1236                 snprintf(buf, sizeof(buf), "m%x", cpu_index(s->query_cpu));
1237                 put_packet(s, buf);
1238                 s->query_cpu = CPU_NEXT(s->query_cpu);
1239             } else
1240                 put_packet(s, "l");
1241             break;
1242         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1243             thread = strtoull(p+16, (char **)&p, 16);
1244             cpu = find_cpu(thread);
1245             if (cpu != NULL) {
1246                 cpu_synchronize_state(cpu);
1247                 /* memtohex() doubles the required space */
1248                 len = snprintf((char *)mem_buf, sizeof(buf) / 2,
1249                                "CPU#%d [%s]", cpu->cpu_index,
1250                                cpu->halted ? "halted " : "running");
1251                 memtohex(buf, mem_buf, len);
1252                 put_packet(s, buf);
1253             }
1254             break;
1255         }
1256 #ifdef CONFIG_USER_ONLY
1257         else if (strcmp(p, "Offsets") == 0) {
1258             TaskState *ts = s->c_cpu->opaque;
1259
1260             snprintf(buf, sizeof(buf),
1261                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1262                      ";Bss=" TARGET_ABI_FMT_lx,
1263                      ts->info->code_offset,
1264                      ts->info->data_offset,
1265                      ts->info->data_offset);
1266             put_packet(s, buf);
1267             break;
1268         }
1269 #else /* !CONFIG_USER_ONLY */
1270         else if (strncmp(p, "Rcmd,", 5) == 0) {
1271             int len = strlen(p + 5);
1272
1273             if ((len % 2) != 0) {
1274                 put_packet(s, "E01");
1275                 break;
1276             }
1277             len = len / 2;
1278             hextomem(mem_buf, p + 5, len);
1279             mem_buf[len++] = 0;
1280             qemu_chr_be_write(s->mon_chr, mem_buf, len);
1281             put_packet(s, "OK");
1282             break;
1283         }
1284 #endif /* !CONFIG_USER_ONLY */
1285         if (is_query_packet(p, "Supported", ':')) {
1286             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1287             cc = CPU_GET_CLASS(first_cpu);
1288             if (cc->gdb_core_xml_file != NULL) {
1289                 pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1290             }
1291             put_packet(s, buf);
1292             break;
1293         }
1294         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1295             const char *xml;
1296             target_ulong total_len;
1297
1298             cc = CPU_GET_CLASS(first_cpu);
1299             if (cc->gdb_core_xml_file == NULL) {
1300                 goto unknown_command;
1301             }
1302
1303             gdb_has_xml = true;
1304             p += 19;
1305             xml = get_feature_xml(p, &p, cc);
1306             if (!xml) {
1307                 snprintf(buf, sizeof(buf), "E00");
1308                 put_packet(s, buf);
1309                 break;
1310             }
1311
1312             if (*p == ':')
1313                 p++;
1314             addr = strtoul(p, (char **)&p, 16);
1315             if (*p == ',')
1316                 p++;
1317             len = strtoul(p, (char **)&p, 16);
1318
1319             total_len = strlen(xml);
1320             if (addr > total_len) {
1321                 snprintf(buf, sizeof(buf), "E00");
1322                 put_packet(s, buf);
1323                 break;
1324             }
1325             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1326                 len = (MAX_PACKET_LENGTH - 5) / 2;
1327             if (len < total_len - addr) {
1328                 buf[0] = 'm';
1329                 len = memtox(buf + 1, xml + addr, len);
1330             } else {
1331                 buf[0] = 'l';
1332                 len = memtox(buf + 1, xml + addr, total_len - addr);
1333             }
1334             put_packet_binary(s, buf, len + 1);
1335             break;
1336         }
1337         if (is_query_packet(p, "Attached", ':')) {
1338             put_packet(s, GDB_ATTACHED);
1339             break;
1340         }
1341         /* Unrecognised 'q' command.  */
1342         goto unknown_command;
1343
1344     default:
1345     unknown_command:
1346         /* put empty packet */
1347         buf[0] = '\0';
1348         put_packet(s, buf);
1349         break;
1350     }
1351     return RS_IDLE;
1352 }
1353
1354 void gdb_set_stop_cpu(CPUState *cpu)
1355 {
1356     gdbserver_state->c_cpu = cpu;
1357     gdbserver_state->g_cpu = cpu;
1358 }
1359
1360 #ifndef CONFIG_USER_ONLY
1361 static void gdb_vm_state_change(void *opaque, int running, RunState state)
1362 {
1363     GDBState *s = gdbserver_state;
1364     CPUState *cpu = s->c_cpu;
1365     char buf[256];
1366     const char *type;
1367     int ret;
1368
1369     if (running || s->state == RS_INACTIVE) {
1370         return;
1371     }
1372     /* Is there a GDB syscall waiting to be sent?  */
1373     if (s->current_syscall_cb) {
1374         put_packet(s, s->syscall_buf);
1375         return;
1376     }
1377     switch (state) {
1378     case RUN_STATE_DEBUG:
1379         if (cpu->watchpoint_hit) {
1380             switch (cpu->watchpoint_hit->flags & BP_MEM_ACCESS) {
1381             case BP_MEM_READ:
1382                 type = "r";
1383                 break;
1384             case BP_MEM_ACCESS:
1385                 type = "a";
1386                 break;
1387             default:
1388                 type = "";
1389                 break;
1390             }
1391             snprintf(buf, sizeof(buf),
1392                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1393                      GDB_SIGNAL_TRAP, cpu_index(cpu), type,
1394                      (target_ulong)cpu->watchpoint_hit->vaddr);
1395             cpu->watchpoint_hit = NULL;
1396             goto send_packet;
1397         }
1398         tb_flush(cpu);
1399         ret = GDB_SIGNAL_TRAP;
1400         break;
1401     case RUN_STATE_PAUSED:
1402         ret = GDB_SIGNAL_INT;
1403         break;
1404     case RUN_STATE_SHUTDOWN:
1405         ret = GDB_SIGNAL_QUIT;
1406         break;
1407     case RUN_STATE_IO_ERROR:
1408         ret = GDB_SIGNAL_IO;
1409         break;
1410     case RUN_STATE_WATCHDOG:
1411         ret = GDB_SIGNAL_ALRM;
1412         break;
1413     case RUN_STATE_INTERNAL_ERROR:
1414         ret = GDB_SIGNAL_ABRT;
1415         break;
1416     case RUN_STATE_SAVE_VM:
1417     case RUN_STATE_RESTORE_VM:
1418         return;
1419     case RUN_STATE_FINISH_MIGRATE:
1420         ret = GDB_SIGNAL_XCPU;
1421         break;
1422     default:
1423         ret = GDB_SIGNAL_UNKNOWN;
1424         break;
1425     }
1426     gdb_set_stop_cpu(cpu);
1427     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, cpu_index(cpu));
1428
1429 send_packet:
1430     put_packet(s, buf);
1431
1432     /* disable single step if it was enabled */
1433     cpu_single_step(cpu, 0);
1434 }
1435 #endif
1436
1437 /* Send a gdb syscall request.
1438    This accepts limited printf-style format specifiers, specifically:
1439     %x  - target_ulong argument printed in hex.
1440     %lx - 64-bit argument printed in hex.
1441     %s  - string pointer (target_ulong) and length (int) pair.  */
1442 void gdb_do_syscallv(gdb_syscall_complete_cb cb, const char *fmt, va_list va)
1443 {
1444     char *p;
1445     char *p_end;
1446     target_ulong addr;
1447     uint64_t i64;
1448     GDBState *s;
1449
1450     s = gdbserver_state;
1451     if (!s)
1452         return;
1453     s->current_syscall_cb = cb;
1454 #ifndef CONFIG_USER_ONLY
1455     vm_stop(RUN_STATE_DEBUG);
1456 #endif
1457     p = s->syscall_buf;
1458     p_end = &s->syscall_buf[sizeof(s->syscall_buf)];
1459     *(p++) = 'F';
1460     while (*fmt) {
1461         if (*fmt == '%') {
1462             fmt++;
1463             switch (*fmt++) {
1464             case 'x':
1465                 addr = va_arg(va, target_ulong);
1466                 p += snprintf(p, p_end - p, TARGET_FMT_lx, addr);
1467                 break;
1468             case 'l':
1469                 if (*(fmt++) != 'x')
1470                     goto bad_format;
1471                 i64 = va_arg(va, uint64_t);
1472                 p += snprintf(p, p_end - p, "%" PRIx64, i64);
1473                 break;
1474             case 's':
1475                 addr = va_arg(va, target_ulong);
1476                 p += snprintf(p, p_end - p, TARGET_FMT_lx "/%x",
1477                               addr, va_arg(va, int));
1478                 break;
1479             default:
1480             bad_format:
1481                 error_report("gdbstub: Bad syscall format string '%s'",
1482                              fmt - 1);
1483                 break;
1484             }
1485         } else {
1486             *(p++) = *(fmt++);
1487         }
1488     }
1489     *p = 0;
1490 #ifdef CONFIG_USER_ONLY
1491     put_packet(s, s->syscall_buf);
1492     gdb_handlesig(s->c_cpu, 0);
1493 #else
1494     /* In this case wait to send the syscall packet until notification that
1495        the CPU has stopped.  This must be done because if the packet is sent
1496        now the reply from the syscall request could be received while the CPU
1497        is still in the running state, which can cause packets to be dropped
1498        and state transition 'T' packets to be sent while the syscall is still
1499        being processed.  */
1500     qemu_cpu_kick(s->c_cpu);
1501 #endif
1502 }
1503
1504 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1505 {
1506     va_list va;
1507
1508     va_start(va, fmt);
1509     gdb_do_syscallv(cb, fmt, va);
1510     va_end(va);
1511 }
1512
1513 static void gdb_read_byte(GDBState *s, int ch)
1514 {
1515     uint8_t reply;
1516
1517 #ifndef CONFIG_USER_ONLY
1518     if (s->last_packet_len) {
1519         /* Waiting for a response to the last packet.  If we see the start
1520            of a new command then abandon the previous response.  */
1521         if (ch == '-') {
1522 #ifdef DEBUG_GDB
1523             printf("Got NACK, retransmitting\n");
1524 #endif
1525             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
1526         }
1527 #ifdef DEBUG_GDB
1528         else if (ch == '+')
1529             printf("Got ACK\n");
1530         else
1531             printf("Got '%c' when expecting ACK/NACK\n", ch);
1532 #endif
1533         if (ch == '+' || ch == '$')
1534             s->last_packet_len = 0;
1535         if (ch != '$')
1536             return;
1537     }
1538     if (runstate_is_running()) {
1539         /* when the CPU is running, we cannot do anything except stop
1540            it when receiving a char */
1541         vm_stop(RUN_STATE_PAUSED);
1542     } else
1543 #endif
1544     {
1545         switch(s->state) {
1546         case RS_IDLE:
1547             if (ch == '$') {
1548                 /* start of command packet */
1549                 s->line_buf_index = 0;
1550                 s->line_sum = 0;
1551                 s->state = RS_GETLINE;
1552             } else {
1553 #ifdef DEBUG_GDB
1554                 printf("gdbstub received garbage between packets: 0x%x\n", ch);
1555 #endif
1556             }
1557             break;
1558         case RS_GETLINE:
1559             if (ch == '}') {
1560                 /* start escape sequence */
1561                 s->state = RS_GETLINE_ESC;
1562                 s->line_sum += ch;
1563             } else if (ch == '*') {
1564                 /* start run length encoding sequence */
1565                 s->state = RS_GETLINE_RLE;
1566                 s->line_sum += ch;
1567             } else if (ch == '#') {
1568                 /* end of command, start of checksum*/
1569                 s->state = RS_CHKSUM1;
1570             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1571 #ifdef DEBUG_GDB
1572                 printf("gdbstub command buffer overrun, dropping command\n");
1573 #endif
1574                 s->state = RS_IDLE;
1575             } else {
1576                 /* unescaped command character */
1577                 s->line_buf[s->line_buf_index++] = ch;
1578                 s->line_sum += ch;
1579             }
1580             break;
1581         case RS_GETLINE_ESC:
1582             if (ch == '#') {
1583                 /* unexpected end of command in escape sequence */
1584                 s->state = RS_CHKSUM1;
1585             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1586                 /* command buffer overrun */
1587 #ifdef DEBUG_GDB
1588                 printf("gdbstub command buffer overrun, dropping command\n");
1589 #endif
1590                 s->state = RS_IDLE;
1591             } else {
1592                 /* parse escaped character and leave escape state */
1593                 s->line_buf[s->line_buf_index++] = ch ^ 0x20;
1594                 s->line_sum += ch;
1595                 s->state = RS_GETLINE;
1596             }
1597             break;
1598         case RS_GETLINE_RLE:
1599             if (ch < ' ') {
1600                 /* invalid RLE count encoding */
1601 #ifdef DEBUG_GDB
1602                 printf("gdbstub got invalid RLE count: 0x%x\n", ch);
1603 #endif
1604                 s->state = RS_GETLINE;
1605             } else {
1606                 /* decode repeat length */
1607                 int repeat = (unsigned char)ch - ' ' + 3;
1608                 if (s->line_buf_index + repeat >= sizeof(s->line_buf) - 1) {
1609                     /* that many repeats would overrun the command buffer */
1610 #ifdef DEBUG_GDB
1611                     printf("gdbstub command buffer overrun,"
1612                            " dropping command\n");
1613 #endif
1614                     s->state = RS_IDLE;
1615                 } else if (s->line_buf_index < 1) {
1616                     /* got a repeat but we have nothing to repeat */
1617 #ifdef DEBUG_GDB
1618                     printf("gdbstub got invalid RLE sequence\n");
1619 #endif
1620                     s->state = RS_GETLINE;
1621                 } else {
1622                     /* repeat the last character */
1623                     memset(s->line_buf + s->line_buf_index,
1624                            s->line_buf[s->line_buf_index - 1], repeat);
1625                     s->line_buf_index += repeat;
1626                     s->line_sum += ch;
1627                     s->state = RS_GETLINE;
1628                 }
1629             }
1630             break;
1631         case RS_CHKSUM1:
1632             /* get high hex digit of checksum */
1633             if (!isxdigit(ch)) {
1634 #ifdef DEBUG_GDB
1635                 printf("gdbstub got invalid command checksum digit\n");
1636 #endif
1637                 s->state = RS_GETLINE;
1638                 break;
1639             }
1640             s->line_buf[s->line_buf_index] = '\0';
1641             s->line_csum = fromhex(ch) << 4;
1642             s->state = RS_CHKSUM2;
1643             break;
1644         case RS_CHKSUM2:
1645             /* get low hex digit of checksum */
1646             if (!isxdigit(ch)) {
1647 #ifdef DEBUG_GDB
1648                 printf("gdbstub got invalid command checksum digit\n");
1649 #endif
1650                 s->state = RS_GETLINE;
1651                 break;
1652             }
1653             s->line_csum |= fromhex(ch);
1654
1655             if (s->line_csum != (s->line_sum & 0xff)) {
1656                 /* send NAK reply */
1657                 reply = '-';
1658                 put_buffer(s, &reply, 1);
1659 #ifdef DEBUG_GDB
1660                 printf("gdbstub got command packet with incorrect checksum\n");
1661 #endif
1662                 s->state = RS_IDLE;
1663             } else {
1664                 /* send ACK reply */
1665                 reply = '+';
1666                 put_buffer(s, &reply, 1);
1667                 s->state = gdb_handle_packet(s, s->line_buf);
1668             }
1669             break;
1670         default:
1671             abort();
1672         }
1673     }
1674 }
1675
1676 /* Tell the remote gdb that the process has exited.  */
1677 void gdb_exit(CPUArchState *env, int code)
1678 {
1679   GDBState *s;
1680   char buf[4];
1681
1682   s = gdbserver_state;
1683   if (!s) {
1684       return;
1685   }
1686 #ifdef CONFIG_USER_ONLY
1687   if (gdbserver_fd < 0 || s->fd < 0) {
1688       return;
1689   }
1690 #endif
1691
1692   snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
1693   put_packet(s, buf);
1694
1695 #ifndef CONFIG_USER_ONLY
1696   qemu_chr_fe_deinit(&s->chr, true);
1697 #endif
1698 }
1699
1700 #ifdef CONFIG_USER_ONLY
1701 int
1702 gdb_handlesig(CPUState *cpu, int sig)
1703 {
1704     GDBState *s;
1705     char buf[256];
1706     int n;
1707
1708     s = gdbserver_state;
1709     if (gdbserver_fd < 0 || s->fd < 0) {
1710         return sig;
1711     }
1712
1713     /* disable single step if it was enabled */
1714     cpu_single_step(cpu, 0);
1715     tb_flush(cpu);
1716
1717     if (sig != 0) {
1718         snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));
1719         put_packet(s, buf);
1720     }
1721     /* put_packet() might have detected that the peer terminated the
1722        connection.  */
1723     if (s->fd < 0) {
1724         return sig;
1725     }
1726
1727     sig = 0;
1728     s->state = RS_IDLE;
1729     s->running_state = 0;
1730     while (s->running_state == 0) {
1731         n = read(s->fd, buf, 256);
1732         if (n > 0) {
1733             int i;
1734
1735             for (i = 0; i < n; i++) {
1736                 gdb_read_byte(s, buf[i]);
1737             }
1738         } else {
1739             /* XXX: Connection closed.  Should probably wait for another
1740                connection before continuing.  */
1741             if (n == 0) {
1742                 close(s->fd);
1743             }
1744             s->fd = -1;
1745             return sig;
1746         }
1747     }
1748     sig = s->signal;
1749     s->signal = 0;
1750     return sig;
1751 }
1752
1753 /* Tell the remote gdb that the process has exited due to SIG.  */
1754 void gdb_signalled(CPUArchState *env, int sig)
1755 {
1756     GDBState *s;
1757     char buf[4];
1758
1759     s = gdbserver_state;
1760     if (gdbserver_fd < 0 || s->fd < 0) {
1761         return;
1762     }
1763
1764     snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb(sig));
1765     put_packet(s, buf);
1766 }
1767
1768 static void gdb_accept(void)
1769 {
1770     GDBState *s;
1771     struct sockaddr_in sockaddr;
1772     socklen_t len;
1773     int fd;
1774
1775     for(;;) {
1776         len = sizeof(sockaddr);
1777         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
1778         if (fd < 0 && errno != EINTR) {
1779             perror("accept");
1780             return;
1781         } else if (fd >= 0) {
1782 #ifndef _WIN32
1783             fcntl(fd, F_SETFD, FD_CLOEXEC);
1784 #endif
1785             break;
1786         }
1787     }
1788
1789     /* set short latency */
1790     socket_set_nodelay(fd);
1791
1792     s = g_malloc0(sizeof(GDBState));
1793     s->c_cpu = first_cpu;
1794     s->g_cpu = first_cpu;
1795     s->fd = fd;
1796     gdb_has_xml = false;
1797
1798     gdbserver_state = s;
1799 }
1800
1801 static int gdbserver_open(int port)
1802 {
1803     struct sockaddr_in sockaddr;
1804     int fd, ret;
1805
1806     fd = socket(PF_INET, SOCK_STREAM, 0);
1807     if (fd < 0) {
1808         perror("socket");
1809         return -1;
1810     }
1811 #ifndef _WIN32
1812     fcntl(fd, F_SETFD, FD_CLOEXEC);
1813 #endif
1814
1815     socket_set_fast_reuse(fd);
1816
1817     sockaddr.sin_family = AF_INET;
1818     sockaddr.sin_port = htons(port);
1819     sockaddr.sin_addr.s_addr = 0;
1820     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
1821     if (ret < 0) {
1822         perror("bind");
1823         close(fd);
1824         return -1;
1825     }
1826     ret = listen(fd, 1);
1827     if (ret < 0) {
1828         perror("listen");
1829         close(fd);
1830         return -1;
1831     }
1832     return fd;
1833 }
1834
1835 int gdbserver_start(int port)
1836 {
1837     gdbserver_fd = gdbserver_open(port);
1838     if (gdbserver_fd < 0)
1839         return -1;
1840     /* accept connections */
1841     gdb_accept();
1842     return 0;
1843 }
1844
1845 /* Disable gdb stub for child processes.  */
1846 void gdbserver_fork(CPUState *cpu)
1847 {
1848     GDBState *s = gdbserver_state;
1849
1850     if (gdbserver_fd < 0 || s->fd < 0) {
1851         return;
1852     }
1853     close(s->fd);
1854     s->fd = -1;
1855     cpu_breakpoint_remove_all(cpu, BP_GDB);
1856     cpu_watchpoint_remove_all(cpu, BP_GDB);
1857 }
1858 #else
1859 static int gdb_chr_can_receive(void *opaque)
1860 {
1861   /* We can handle an arbitrarily large amount of data.
1862    Pick the maximum packet size, which is as good as anything.  */
1863   return MAX_PACKET_LENGTH;
1864 }
1865
1866 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
1867 {
1868     int i;
1869
1870     for (i = 0; i < size; i++) {
1871         gdb_read_byte(gdbserver_state, buf[i]);
1872     }
1873 }
1874
1875 static void gdb_chr_event(void *opaque, int event)
1876 {
1877     switch (event) {
1878     case CHR_EVENT_OPENED:
1879         vm_stop(RUN_STATE_PAUSED);
1880         gdb_has_xml = false;
1881         break;
1882     default:
1883         break;
1884     }
1885 }
1886
1887 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
1888 {
1889     char buf[MAX_PACKET_LENGTH];
1890
1891     buf[0] = 'O';
1892     if (len > (MAX_PACKET_LENGTH/2) - 1)
1893         len = (MAX_PACKET_LENGTH/2) - 1;
1894     memtohex(buf + 1, (uint8_t *)msg, len);
1895     put_packet(s, buf);
1896 }
1897
1898 static int gdb_monitor_write(Chardev *chr, const uint8_t *buf, int len)
1899 {
1900     const char *p = (const char *)buf;
1901     int max_sz;
1902
1903     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
1904     for (;;) {
1905         if (len <= max_sz) {
1906             gdb_monitor_output(gdbserver_state, p, len);
1907             break;
1908         }
1909         gdb_monitor_output(gdbserver_state, p, max_sz);
1910         p += max_sz;
1911         len -= max_sz;
1912     }
1913     return len;
1914 }
1915
1916 #ifndef _WIN32
1917 static void gdb_sigterm_handler(int signal)
1918 {
1919     if (runstate_is_running()) {
1920         vm_stop(RUN_STATE_PAUSED);
1921     }
1922 }
1923 #endif
1924
1925 static void gdb_monitor_open(Chardev *chr, ChardevBackend *backend,
1926                              bool *be_opened, Error **errp)
1927 {
1928     *be_opened = false;
1929 }
1930
1931 static void char_gdb_class_init(ObjectClass *oc, void *data)
1932 {
1933     ChardevClass *cc = CHARDEV_CLASS(oc);
1934
1935     cc->internal = true;
1936     cc->open = gdb_monitor_open;
1937     cc->chr_write = gdb_monitor_write;
1938 }
1939
1940 #define TYPE_CHARDEV_GDB "chardev-gdb"
1941
1942 static const TypeInfo char_gdb_type_info = {
1943     .name = TYPE_CHARDEV_GDB,
1944     .parent = TYPE_CHARDEV,
1945     .class_init = char_gdb_class_init,
1946 };
1947
1948 int gdbserver_start(const char *device)
1949 {
1950     GDBState *s;
1951     char gdbstub_device_name[128];
1952     Chardev *chr = NULL;
1953     Chardev *mon_chr;
1954
1955     if (!first_cpu) {
1956         error_report("gdbstub: meaningless to attach gdb to a "
1957                      "machine without any CPU.");
1958         return -1;
1959     }
1960
1961     if (!device)
1962         return -1;
1963     if (strcmp(device, "none") != 0) {
1964         if (strstart(device, "tcp:", NULL)) {
1965             /* enforce required TCP attributes */
1966             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
1967                      "%s,nowait,nodelay,server", device);
1968             device = gdbstub_device_name;
1969         }
1970 #ifndef _WIN32
1971         else if (strcmp(device, "stdio") == 0) {
1972             struct sigaction act;
1973
1974             memset(&act, 0, sizeof(act));
1975             act.sa_handler = gdb_sigterm_handler;
1976             sigaction(SIGINT, &act, NULL);
1977         }
1978 #endif
1979         chr = qemu_chr_new_noreplay("gdb", device);
1980         if (!chr)
1981             return -1;
1982     }
1983
1984     s = gdbserver_state;
1985     if (!s) {
1986         s = g_malloc0(sizeof(GDBState));
1987         gdbserver_state = s;
1988
1989         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
1990
1991         /* Initialize a monitor terminal for gdb */
1992         mon_chr = qemu_chardev_new(NULL, TYPE_CHARDEV_GDB,
1993                                    NULL, &error_abort);
1994         monitor_init(mon_chr, 0);
1995     } else {
1996         qemu_chr_fe_deinit(&s->chr, true);
1997         mon_chr = s->mon_chr;
1998         memset(s, 0, sizeof(GDBState));
1999         s->mon_chr = mon_chr;
2000     }
2001     s->c_cpu = first_cpu;
2002     s->g_cpu = first_cpu;
2003     if (chr) {
2004         qemu_chr_fe_init(&s->chr, chr, &error_abort);
2005         qemu_chr_fe_set_handlers(&s->chr, gdb_chr_can_receive, gdb_chr_receive,
2006                                  gdb_chr_event, NULL, NULL, true);
2007     }
2008     s->state = chr ? RS_IDLE : RS_INACTIVE;
2009     s->mon_chr = mon_chr;
2010     s->current_syscall_cb = NULL;
2011
2012     return 0;
2013 }
2014
2015 static void register_types(void)
2016 {
2017     type_register_static(&char_gdb_type_info);
2018 }
2019
2020 type_init(register_types);
2021 #endif