gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "qemu-common.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "monitor/monitor.h"
  33 #include "sysemu/char.h"
  34 #include "sysemu/sysemu.h"
  35 #include "exec/gdbstub.h"
  36 #endif
  37
  38 #define MAX_PACKET_LENGTH 4096
  39
  40 #include "cpu.h"
  41 #include "qemu/sockets.h"
  42 #include "sysemu/kvm.h"
  43 #include "exec/semihost.h"
  44
  45 #ifdef CONFIG_USER_ONLY
  46 #define GDB_ATTACHED "0"
  47 #else
  48 #define GDB_ATTACHED "1"
  49 #endif
  50
  51 static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
  52                                          uint8_t *buf, int len, bool is_write)
  53 {
  54     CPUClass *cc = CPU_GET_CLASS(cpu);
  55
  56     if (cc->memory_rw_debug) {
  57         return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
  58     }
  59     return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
  60 }
  61
  62 enum {
  63     GDB_SIGNAL_0 = 0,
  64     GDB_SIGNAL_INT = 2,
  65     GDB_SIGNAL_QUIT = 3,
  66     GDB_SIGNAL_TRAP = 5,
  67     GDB_SIGNAL_ABRT = 6,
  68     GDB_SIGNAL_ALRM = 14,
  69     GDB_SIGNAL_IO = 23,
  70     GDB_SIGNAL_XCPU = 24,
  71     GDB_SIGNAL_UNKNOWN = 143
  72 };
  73
  74 #ifdef CONFIG_USER_ONLY
  75
  76 /* Map target signal numbers to GDB protocol signal numbers and vice
  77  * versa.  For user emulation's currently supported systems, we can
  78  * assume most signals are defined.
  79  */
  80
  81 static int gdb_signal_table[] = {
  82     0,
  83     TARGET_SIGHUP,
  84     TARGET_SIGINT,
  85     TARGET_SIGQUIT,
  86     TARGET_SIGILL,
  87     TARGET_SIGTRAP,
  88     TARGET_SIGABRT,
  89     -1, /* SIGEMT */
  90     TARGET_SIGFPE,
  91     TARGET_SIGKILL,
  92     TARGET_SIGBUS,
  93     TARGET_SIGSEGV,
  94     TARGET_SIGSYS,
  95     TARGET_SIGPIPE,
  96     TARGET_SIGALRM,
  97     TARGET_SIGTERM,
  98     TARGET_SIGURG,
  99     TARGET_SIGSTOP,
 100     TARGET_SIGTSTP,
 101     TARGET_SIGCONT,
 102     TARGET_SIGCHLD,
 103     TARGET_SIGTTIN,
 104     TARGET_SIGTTOU,
 105     TARGET_SIGIO,
 106     TARGET_SIGXCPU,
 107     TARGET_SIGXFSZ,
 108     TARGET_SIGVTALRM,
 109     TARGET_SIGPROF,
 110     TARGET_SIGWINCH,
 111     -1, /* SIGLOST */
 112     TARGET_SIGUSR1,
 113     TARGET_SIGUSR2,
 114 #ifdef TARGET_SIGPWR
 115     TARGET_SIGPWR,
 116 #else
 117     -1,
 118 #endif
 119     -1, /* SIGPOLL */
 120     -1,
 121     -1,
 122     -1,
 123     -1,
 124     -1,
 125     -1,
 126     -1,
 127     -1,
 128     -1,
 129     -1,
 130     -1,
 131 #ifdef __SIGRTMIN
 132     __SIGRTMIN + 1,
 133     __SIGRTMIN + 2,
 134     __SIGRTMIN + 3,
 135     __SIGRTMIN + 4,
 136     __SIGRTMIN + 5,
 137     __SIGRTMIN + 6,
 138     __SIGRTMIN + 7,
 139     __SIGRTMIN + 8,
 140     __SIGRTMIN + 9,
 141     __SIGRTMIN + 10,
 142     __SIGRTMIN + 11,
 143     __SIGRTMIN + 12,
 144     __SIGRTMIN + 13,
 145     __SIGRTMIN + 14,
 146     __SIGRTMIN + 15,
 147     __SIGRTMIN + 16,
 148     __SIGRTMIN + 17,
 149     __SIGRTMIN + 18,
 150     __SIGRTMIN + 19,
 151     __SIGRTMIN + 20,
 152     __SIGRTMIN + 21,
 153     __SIGRTMIN + 22,
 154     __SIGRTMIN + 23,
 155     __SIGRTMIN + 24,
 156     __SIGRTMIN + 25,
 157     __SIGRTMIN + 26,
 158     __SIGRTMIN + 27,
 159     __SIGRTMIN + 28,
 160     __SIGRTMIN + 29,
 161     __SIGRTMIN + 30,
 162     __SIGRTMIN + 31,
 163     -1, /* SIGCANCEL */
 164     __SIGRTMIN,
 165     __SIGRTMIN + 32,
 166     __SIGRTMIN + 33,
 167     __SIGRTMIN + 34,
 168     __SIGRTMIN + 35,
 169     __SIGRTMIN + 36,
 170     __SIGRTMIN + 37,
 171     __SIGRTMIN + 38,
 172     __SIGRTMIN + 39,
 173     __SIGRTMIN + 40,
 174     __SIGRTMIN + 41,
 175     __SIGRTMIN + 42,
 176     __SIGRTMIN + 43,
 177     __SIGRTMIN + 44,
 178     __SIGRTMIN + 45,
 179     __SIGRTMIN + 46,
 180     __SIGRTMIN + 47,
 181     __SIGRTMIN + 48,
 182     __SIGRTMIN + 49,
 183     __SIGRTMIN + 50,
 184     __SIGRTMIN + 51,
 185     __SIGRTMIN + 52,
 186     __SIGRTMIN + 53,
 187     __SIGRTMIN + 54,
 188     __SIGRTMIN + 55,
 189     __SIGRTMIN + 56,
 190     __SIGRTMIN + 57,
 191     __SIGRTMIN + 58,
 192     __SIGRTMIN + 59,
 193     __SIGRTMIN + 60,
 194     __SIGRTMIN + 61,
 195     __SIGRTMIN + 62,
 196     __SIGRTMIN + 63,
 197     __SIGRTMIN + 64,
 198     __SIGRTMIN + 65,
 199     __SIGRTMIN + 66,
 200     __SIGRTMIN + 67,
 201     __SIGRTMIN + 68,
 202     __SIGRTMIN + 69,
 203     __SIGRTMIN + 70,
 204     __SIGRTMIN + 71,
 205     __SIGRTMIN + 72,
 206     __SIGRTMIN + 73,
 207     __SIGRTMIN + 74,
 208     __SIGRTMIN + 75,
 209     __SIGRTMIN + 76,
 210     __SIGRTMIN + 77,
 211     __SIGRTMIN + 78,
 212     __SIGRTMIN + 79,
 213     __SIGRTMIN + 80,
 214     __SIGRTMIN + 81,
 215     __SIGRTMIN + 82,
 216     __SIGRTMIN + 83,
 217     __SIGRTMIN + 84,
 218     __SIGRTMIN + 85,
 219     __SIGRTMIN + 86,
 220     __SIGRTMIN + 87,
 221     __SIGRTMIN + 88,
 222     __SIGRTMIN + 89,
 223     __SIGRTMIN + 90,
 224     __SIGRTMIN + 91,
 225     __SIGRTMIN + 92,
 226     __SIGRTMIN + 93,
 227     __SIGRTMIN + 94,
 228     __SIGRTMIN + 95,
 229     -1, /* SIGINFO */
 230     -1, /* UNKNOWN */
 231     -1, /* DEFAULT */
 232     -1,
 233     -1,
 234     -1,
 235     -1,
 236     -1,
 237     -1
 238 #endif
 239 };
 240 #else
 241 /* In system mode we only need SIGINT and SIGTRAP; other signals
 242    are not yet supported.  */
 243
 244 enum {
 245     TARGET_SIGINT = 2,
 246     TARGET_SIGTRAP = 5
 247 };
 248
 249 static int gdb_signal_table[] = {
 250     -1,
 251     -1,
 252     TARGET_SIGINT,
 253     -1,
 254     -1,
 255     TARGET_SIGTRAP
 256 };
 257 #endif
 258
 259 #ifdef CONFIG_USER_ONLY
 260 static int target_signal_to_gdb (int sig)
 261 {
 262     int i;
 263     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 264         if (gdb_signal_table[i] == sig)
 265             return i;
 266     return GDB_SIGNAL_UNKNOWN;
 267 }
 268 #endif
 269
 270 static int gdb_signal_to_target (int sig)
 271 {
 272     if (sig < ARRAY_SIZE (gdb_signal_table))
 273         return gdb_signal_table[sig];
 274     else
 275         return -1;
 276 }
 277
 278 //#define DEBUG_GDB
 279
 280 typedef struct GDBRegisterState {
 281     int base_reg;
 282     int num_regs;
 283     gdb_reg_cb get_reg;
 284     gdb_reg_cb set_reg;
 285     const char *xml;
 286     struct GDBRegisterState *next;
 287 } GDBRegisterState;
 288
 289 enum RSState {
 290     RS_INACTIVE,
 291     RS_IDLE,
 292     RS_GETLINE,
 293     RS_CHKSUM1,
 294     RS_CHKSUM2,
 295 };
 296 typedef struct GDBState {
 297     CPUState *c_cpu; /* current CPU for step/continue ops */
 298     CPUState *g_cpu; /* current CPU for other ops */
 299     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 300     enum RSState state; /* parsing state */
 301     char line_buf[MAX_PACKET_LENGTH];
 302     int line_buf_index;
 303     int line_csum;
 304     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 305     int last_packet_len;
 306     int signal;
 307 #ifdef CONFIG_USER_ONLY
 308     int fd;
 309     int running_state;
 310 #else
 311     CharDriverState *chr;
 312     CharDriverState *mon_chr;
 313 #endif
 314     char syscall_buf[256];
 315     gdb_syscall_complete_cb current_syscall_cb;
 316 } GDBState;
 317
 318 /* By default use no IRQs and no timers while single stepping so as to
 319  * make single stepping like an ICE HW step.
 320  */
 321 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 322
 323 static GDBState *gdbserver_state;
 324
 325 bool gdb_has_xml;
 326
 327 #ifdef CONFIG_USER_ONLY
 328 /* XXX: This is not thread safe.  Do we care?  */
 329 static int gdbserver_fd = -1;
 330
 331 static int get_char(GDBState *s)
 332 {
 333     uint8_t ch;
 334     int ret;
 335
 336     for(;;) {
 337         ret = qemu_recv(s->fd, &ch, 1, 0);
 338         if (ret < 0) {
 339             if (errno == ECONNRESET)
 340                 s->fd = -1;
 341             if (errno != EINTR && errno != EAGAIN)
 342                 return -1;
 343         } else if (ret == 0) {
 344             close(s->fd);
 345             s->fd = -1;
 346             return -1;
 347         } else {
 348             break;
 349         }
 350     }
 351     return ch;
 352 }
 353 #endif
 354
 355 static enum {
 356     GDB_SYS_UNKNOWN,
 357     GDB_SYS_ENABLED,
 358     GDB_SYS_DISABLED,
 359 } gdb_syscall_mode;
 360
 361 /* Decide if either remote gdb syscalls or native file IO should be used. */
 362 int use_gdb_syscalls(void)
 363 {
 364     SemihostingTarget target = semihosting_get_target();
 365     if (target == SEMIHOSTING_TARGET_NATIVE) {
 366         /* -semihosting-config target=native */
 367         return false;
 368     } else if (target == SEMIHOSTING_TARGET_GDB) {
 369         /* -semihosting-config target=gdb */
 370         return true;
 371     }
 372
 373     /* -semihosting-config target=auto */
 374     /* On the first call check if gdb is connected and remember. */
 375     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 376         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 377                                             : GDB_SYS_DISABLED);
 378     }
 379     return gdb_syscall_mode == GDB_SYS_ENABLED;
 380 }
 381
 382 /* Resume execution.  */
 383 static inline void gdb_continue(GDBState *s)
 384 {
 385 #ifdef CONFIG_USER_ONLY
 386     s->running_state = 1;
 387 #else
 388     if (!runstate_needs_reset()) {
 389         vm_start();
 390     }
 391 #endif
 392 }
 393
 394 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 395 {
 396 #ifdef CONFIG_USER_ONLY
 397     int ret;
 398
 399     while (len > 0) {
 400         ret = send(s->fd, buf, len, 0);
 401         if (ret < 0) {
 402             if (errno != EINTR && errno != EAGAIN)
 403                 return;
 404         } else {
 405             buf += ret;
 406             len -= ret;
 407         }
 408     }
 409 #else
 410     qemu_chr_fe_write(s->chr, buf, len);
 411 #endif
 412 }
 413
 414 static inline int fromhex(int v)
 415 {
 416     if (v >= '0' && v <= '9')
 417         return v - '0';
 418     else if (v >= 'A' && v <= 'F')
 419         return v - 'A' + 10;
 420     else if (v >= 'a' && v <= 'f')
 421         return v - 'a' + 10;
 422     else
 423         return 0;
 424 }
 425
 426 static inline int tohex(int v)
 427 {
 428     if (v < 10)
 429         return v + '0';
 430     else
 431         return v - 10 + 'a';
 432 }
 433
 434 static void memtohex(char *buf, const uint8_t *mem, int len)
 435 {
 436     int i, c;
 437     char *q;
 438     q = buf;
 439     for(i = 0; i < len; i++) {
 440         c = mem[i];
 441         *q++ = tohex(c >> 4);
 442         *q++ = tohex(c & 0xf);
 443     }
 444     *q = '\0';
 445 }
 446
 447 static void hextomem(uint8_t *mem, const char *buf, int len)
 448 {
 449     int i;
 450
 451     for(i = 0; i < len; i++) {
 452         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 453         buf += 2;
 454     }
 455 }
 456
 457 /* return -1 if error, 0 if OK */
 458 static int put_packet_binary(GDBState *s, const char *buf, int len)
 459 {
 460     int csum, i;
 461     uint8_t *p;
 462
 463     for(;;) {
 464         p = s->last_packet;
 465         *(p++) = '$';
 466         memcpy(p, buf, len);
 467         p += len;
 468         csum = 0;
 469         for(i = 0; i < len; i++) {
 470             csum += buf[i];
 471         }
 472         *(p++) = '#';
 473         *(p++) = tohex((csum >> 4) & 0xf);
 474         *(p++) = tohex((csum) & 0xf);
 475
 476         s->last_packet_len = p - s->last_packet;
 477         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 478
 479 #ifdef CONFIG_USER_ONLY
 480         i = get_char(s);
 481         if (i < 0)
 482             return -1;
 483         if (i == '+')
 484             break;
 485 #else
 486         break;
 487 #endif
 488     }
 489     return 0;
 490 }
 491
 492 /* return -1 if error, 0 if OK */
 493 static int put_packet(GDBState *s, const char *buf)
 494 {
 495 #ifdef DEBUG_GDB
 496     printf("reply='%s'\n", buf);
 497 #endif
 498
 499     return put_packet_binary(s, buf, strlen(buf));
 500 }
 501
 502 /* Encode data using the encoding for 'x' packets.  */
 503 static int memtox(char *buf, const char *mem, int len)
 504 {
 505     char *p = buf;
 506     char c;
 507
 508     while (len--) {
 509         c = *(mem++);
 510         switch (c) {
 511         case '#': case '$': case '*': case '}':
 512             *(p++) = '}';
 513             *(p++) = c ^ 0x20;
 514             break;
 515         default:
 516             *(p++) = c;
 517             break;
 518         }
 519     }
 520     return p - buf;
 521 }
 522
 523 static const char *get_feature_xml(const char *p, const char **newp,
 524                                    CPUClass *cc)
 525 {
 526     size_t len;
 527     int i;
 528     const char *name;
 529     static char target_xml[1024];
 530
 531     len = 0;
 532     while (p[len] && p[len] != ':')
 533         len++;
 534     *newp = p + len;
 535
 536     name = NULL;
 537     if (strncmp(p, "target.xml", len) == 0) {
 538         /* Generate the XML description for this CPU.  */
 539         if (!target_xml[0]) {
 540             GDBRegisterState *r;
 541             CPUState *cpu = first_cpu;
 542
 543             pstrcat(target_xml, sizeof(target_xml),
 544                     "<?xml version=\"1.0\"?>"
 545                     "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
 546                     "<target>");
 547             if (cc->gdb_arch_name) {
 548                 gchar *arch = cc->gdb_arch_name(cpu);
 549                 pstrcat(target_xml, sizeof(target_xml), "<architecture>");
 550                 pstrcat(target_xml, sizeof(target_xml), arch);
 551                 pstrcat(target_xml, sizeof(target_xml), "</architecture>");
 552                 g_free(arch);
 553             }
 554             pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
 555             pstrcat(target_xml, sizeof(target_xml), cc->gdb_core_xml_file);
 556             pstrcat(target_xml, sizeof(target_xml), "\"/>");
 557             for (r = cpu->gdb_regs; r; r = r->next) {
 558                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
 559                 pstrcat(target_xml, sizeof(target_xml), r->xml);
 560                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
 561             }
 562             pstrcat(target_xml, sizeof(target_xml), "</target>");
 563         }
 564         return target_xml;
 565     }
 566     for (i = 0; ; i++) {
 567         name = xml_builtin[i][0];
 568         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
 569             break;
 570     }
 571     return name ? xml_builtin[i][1] : NULL;
 572 }
 573
 574 static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 575 {
 576     CPUClass *cc = CPU_GET_CLASS(cpu);
 577     CPUArchState *env = cpu->env_ptr;
 578     GDBRegisterState *r;
 579
 580     if (reg < cc->gdb_num_core_regs) {
 581         return cc->gdb_read_register(cpu, mem_buf, reg);
 582     }
 583
 584     for (r = cpu->gdb_regs; r; r = r->next) {
 585         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 586             return r->get_reg(env, mem_buf, reg - r->base_reg);
 587         }
 588     }
 589     return 0;
 590 }
 591
 592 static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 593 {
 594     CPUClass *cc = CPU_GET_CLASS(cpu);
 595     CPUArchState *env = cpu->env_ptr;
 596     GDBRegisterState *r;
 597
 598     if (reg < cc->gdb_num_core_regs) {
 599         return cc->gdb_write_register(cpu, mem_buf, reg);
 600     }
 601
 602     for (r = cpu->gdb_regs; r; r = r->next) {
 603         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 604             return r->set_reg(env, mem_buf, reg - r->base_reg);
 605         }
 606     }
 607     return 0;
 608 }
 609
 610 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
 611    specifies the first register number and these registers are included in
 612    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
 613    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
 614  */
 615
 616 void gdb_register_coprocessor(CPUState *cpu,
 617                               gdb_reg_cb get_reg, gdb_reg_cb set_reg,
 618                               int num_regs, const char *xml, int g_pos)
 619 {
 620     GDBRegisterState *s;
 621     GDBRegisterState **p;
 622
 623     p = &cpu->gdb_regs;
 624     while (*p) {
 625         /* Check for duplicates.  */
 626         if (strcmp((*p)->xml, xml) == 0)
 627             return;
 628         p = &(*p)->next;
 629     }
 630
 631     s = g_new0(GDBRegisterState, 1);
 632     s->base_reg = cpu->gdb_num_regs;
 633     s->num_regs = num_regs;
 634     s->get_reg = get_reg;
 635     s->set_reg = set_reg;
 636     s->xml = xml;
 637
 638     /* Add to end of list.  */
 639     cpu->gdb_num_regs += num_regs;
 640     *p = s;
 641     if (g_pos) {
 642         if (g_pos != s->base_reg) {
 643             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
 644                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
 645         } else {
 646             cpu->gdb_num_g_regs = cpu->gdb_num_regs;
 647         }
 648     }
 649 }
 650
 651 #ifndef CONFIG_USER_ONLY
 652 /* Translate GDB watchpoint type to a flags value for cpu_watchpoint_* */
 653 static inline int xlat_gdb_type(CPUState *cpu, int gdbtype)
 654 {
 655     static const int xlat[] = {
 656         [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
 657         [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
 658         [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
 659     };
 660
 661     CPUClass *cc = CPU_GET_CLASS(cpu);
 662     int cputype = xlat[gdbtype];
 663
 664     if (cc->gdb_stop_before_watchpoint) {
 665         cputype |= BP_STOP_BEFORE_ACCESS;
 666     }
 667     return cputype;
 668 }
 669 #endif
 670
 671 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
 672 {
 673     CPUState *cpu;
 674     int err = 0;
 675
 676     if (kvm_enabled()) {
 677         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 678     }
 679
 680     switch (type) {
 681     case GDB_BREAKPOINT_SW:
 682     case GDB_BREAKPOINT_HW:
 683         CPU_FOREACH(cpu) {
 684             err = cpu_breakpoint_insert(cpu, addr, BP_GDB, NULL);
 685             if (err) {
 686                 break;
 687             }
 688         }
 689         return err;
 690 #ifndef CONFIG_USER_ONLY
 691     case GDB_WATCHPOINT_WRITE:
 692     case GDB_WATCHPOINT_READ:
 693     case GDB_WATCHPOINT_ACCESS:
 694         CPU_FOREACH(cpu) {
 695             err = cpu_watchpoint_insert(cpu, addr, len,
 696                                         xlat_gdb_type(cpu, type), NULL);
 697             if (err) {
 698                 break;
 699             }
 700         }
 701         return err;
 702 #endif
 703     default:
 704         return -ENOSYS;
 705     }
 706 }
 707
 708 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
 709 {
 710     CPUState *cpu;
 711     int err = 0;
 712
 713     if (kvm_enabled()) {
 714         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 715     }
 716
 717     switch (type) {
 718     case GDB_BREAKPOINT_SW:
 719     case GDB_BREAKPOINT_HW:
 720         CPU_FOREACH(cpu) {
 721             err = cpu_breakpoint_remove(cpu, addr, BP_GDB);
 722             if (err) {
 723                 break;
 724             }
 725         }
 726         return err;
 727 #ifndef CONFIG_USER_ONLY
 728     case GDB_WATCHPOINT_WRITE:
 729     case GDB_WATCHPOINT_READ:
 730     case GDB_WATCHPOINT_ACCESS:
 731         CPU_FOREACH(cpu) {
 732             err = cpu_watchpoint_remove(cpu, addr, len,
 733                                         xlat_gdb_type(cpu, type));
 734             if (err)
 735                 break;
 736         }
 737         return err;
 738 #endif
 739     default:
 740         return -ENOSYS;
 741     }
 742 }
 743
 744 static void gdb_breakpoint_remove_all(void)
 745 {
 746     CPUState *cpu;
 747
 748     if (kvm_enabled()) {
 749         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
 750         return;
 751     }
 752
 753     CPU_FOREACH(cpu) {
 754         cpu_breakpoint_remove_all(cpu, BP_GDB);
 755 #ifndef CONFIG_USER_ONLY
 756         cpu_watchpoint_remove_all(cpu, BP_GDB);
 757 #endif
 758     }
 759 }
 760
 761 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 762 {
 763     CPUState *cpu = s->c_cpu;
 764
 765     cpu_synchronize_state(cpu);
 766     cpu_set_pc(cpu, pc);
 767 }
 768
 769 static CPUState *find_cpu(uint32_t thread_id)
 770 {
 771     CPUState *cpu;
 772
 773     CPU_FOREACH(cpu) {
 774         if (cpu_index(cpu) == thread_id) {
 775             return cpu;
 776         }
 777     }
 778
 779     return NULL;
 780 }
 781
 782 static int is_query_packet(const char *p, const char *query, char separator)
 783 {
 784     unsigned int query_len = strlen(query);
 785
 786     return strncmp(p, query, query_len) == 0 &&
 787         (p[query_len] == '\0' || p[query_len] == separator);
 788 }
 789
 790 static int gdb_handle_packet(GDBState *s, const char *line_buf)
 791 {
 792     CPUState *cpu;
 793     CPUClass *cc;
 794     const char *p;
 795     uint32_t thread;
 796     int ch, reg_size, type, res;
 797     char buf[MAX_PACKET_LENGTH];
 798     uint8_t mem_buf[MAX_PACKET_LENGTH];
 799     uint8_t *registers;
 800     target_ulong addr, len;
 801
 802 #ifdef DEBUG_GDB
 803     printf("command='%s'\n", line_buf);
 804 #endif
 805     p = line_buf;
 806     ch = *p++;
 807     switch(ch) {
 808     case '?':
 809         /* TODO: Make this return the correct value for user-mode.  */
 810         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
 811                  cpu_index(s->c_cpu));
 812         put_packet(s, buf);
 813         /* Remove all the breakpoints when this query is issued,
 814          * because gdb is doing and initial connect and the state
 815          * should be cleaned up.
 816          */
 817         gdb_breakpoint_remove_all();
 818         break;
 819     case 'c':
 820         if (*p != '\0') {
 821             addr = strtoull(p, (char **)&p, 16);
 822             gdb_set_cpu_pc(s, addr);
 823         }
 824         s->signal = 0;
 825         gdb_continue(s);
 826         return RS_IDLE;
 827     case 'C':
 828         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
 829         if (s->signal == -1)
 830             s->signal = 0;
 831         gdb_continue(s);
 832         return RS_IDLE;
 833     case 'v':
 834         if (strncmp(p, "Cont", 4) == 0) {
 835             int res_signal, res_thread;
 836
 837             p += 4;
 838             if (*p == '?') {
 839                 put_packet(s, "vCont;c;C;s;S");
 840                 break;
 841             }
 842             res = 0;
 843             res_signal = 0;
 844             res_thread = 0;
 845             while (*p) {
 846                 int action, signal;
 847
 848                 if (*p++ != ';') {
 849                     res = 0;
 850                     break;
 851                 }
 852                 action = *p++;
 853                 signal = 0;
 854                 if (action == 'C' || action == 'S') {
 855                     signal = gdb_signal_to_target(strtoul(p, (char **)&p, 16));
 856                     if (signal == -1) {
 857                         signal = 0;
 858                     }
 859                 } else if (action != 'c' && action != 's') {
 860                     res = 0;
 861                     break;
 862                 }
 863                 thread = 0;
 864                 if (*p == ':') {
 865                     thread = strtoull(p+1, (char **)&p, 16);
 866                 }
 867                 action = tolower(action);
 868                 if (res == 0 || (res == 'c' && action == 's')) {
 869                     res = action;
 870                     res_signal = signal;
 871                     res_thread = thread;
 872                 }
 873             }
 874             if (res) {
 875                 if (res_thread != -1 && res_thread != 0) {
 876                     cpu = find_cpu(res_thread);
 877                     if (cpu == NULL) {
 878                         put_packet(s, "E22");
 879                         break;
 880                     }
 881                     s->c_cpu = cpu;
 882                 }
 883                 if (res == 's') {
 884                     cpu_single_step(s->c_cpu, sstep_flags);
 885                 }
 886                 s->signal = res_signal;
 887                 gdb_continue(s);
 888                 return RS_IDLE;
 889             }
 890             break;
 891         } else {
 892             goto unknown_command;
 893         }
 894     case 'k':
 895         /* Kill the target */
 896         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
 897         exit(0);
 898     case 'D':
 899         /* Detach packet */
 900         gdb_breakpoint_remove_all();
 901         gdb_syscall_mode = GDB_SYS_DISABLED;
 902         gdb_continue(s);
 903         put_packet(s, "OK");
 904         break;
 905     case 's':
 906         if (*p != '\0') {
 907             addr = strtoull(p, (char **)&p, 16);
 908             gdb_set_cpu_pc(s, addr);
 909         }
 910         cpu_single_step(s->c_cpu, sstep_flags);
 911         gdb_continue(s);
 912         return RS_IDLE;
 913     case 'F':
 914         {
 915             target_ulong ret;
 916             target_ulong err;
 917
 918             ret = strtoull(p, (char **)&p, 16);
 919             if (*p == ',') {
 920                 p++;
 921                 err = strtoull(p, (char **)&p, 16);
 922             } else {
 923                 err = 0;
 924             }
 925             if (*p == ',')
 926                 p++;
 927             type = *p;
 928             if (s->current_syscall_cb) {
 929                 s->current_syscall_cb(s->c_cpu, ret, err);
 930                 s->current_syscall_cb = NULL;
 931             }
 932             if (type == 'C') {
 933                 put_packet(s, "T02");
 934             } else {
 935                 gdb_continue(s);
 936             }
 937         }
 938         break;
 939     case 'g':
 940         cpu_synchronize_state(s->g_cpu);
 941         len = 0;
 942         for (addr = 0; addr < s->g_cpu->gdb_num_g_regs; addr++) {
 943             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
 944             len += reg_size;
 945         }
 946         memtohex(buf, mem_buf, len);
 947         put_packet(s, buf);
 948         break;
 949     case 'G':
 950         cpu_synchronize_state(s->g_cpu);
 951         registers = mem_buf;
 952         len = strlen(p) / 2;
 953         hextomem((uint8_t *)registers, p, len);
 954         for (addr = 0; addr < s->g_cpu->gdb_num_g_regs && len > 0; addr++) {
 955             reg_size = gdb_write_register(s->g_cpu, registers, addr);
 956             len -= reg_size;
 957             registers += reg_size;
 958         }
 959         put_packet(s, "OK");
 960         break;
 961     case 'm':
 962         addr = strtoull(p, (char **)&p, 16);
 963         if (*p == ',')
 964             p++;
 965         len = strtoull(p, NULL, 16);
 966
 967         /* memtohex() doubles the required space */
 968         if (len > MAX_PACKET_LENGTH / 2) {
 969             put_packet (s, "E22");
 970             break;
 971         }
 972
 973         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
 974             put_packet (s, "E14");
 975         } else {
 976             memtohex(buf, mem_buf, len);
 977             put_packet(s, buf);
 978         }
 979         break;
 980     case 'M':
 981         addr = strtoull(p, (char **)&p, 16);
 982         if (*p == ',')
 983             p++;
 984         len = strtoull(p, (char **)&p, 16);
 985         if (*p == ':')
 986             p++;
 987
 988         /* hextomem() reads 2*len bytes */
 989         if (len > strlen(p) / 2) {
 990             put_packet (s, "E22");
 991             break;
 992         }
 993         hextomem(mem_buf, p, len);
 994         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
 995                                    true) != 0) {
 996             put_packet(s, "E14");
 997         } else {
 998             put_packet(s, "OK");
 999         }
1000         break;
1001     case 'p':
1002         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1003            This works, but can be very slow.  Anything new enough to
1004            understand XML also knows how to use this properly.  */
1005         if (!gdb_has_xml)
1006             goto unknown_command;
1007         addr = strtoull(p, (char **)&p, 16);
1008         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1009         if (reg_size) {
1010             memtohex(buf, mem_buf, reg_size);
1011             put_packet(s, buf);
1012         } else {
1013             put_packet(s, "E14");
1014         }
1015         break;
1016     case 'P':
1017         if (!gdb_has_xml)
1018             goto unknown_command;
1019         addr = strtoull(p, (char **)&p, 16);
1020         if (*p == '=')
1021             p++;
1022         reg_size = strlen(p) / 2;
1023         hextomem(mem_buf, p, reg_size);
1024         gdb_write_register(s->g_cpu, mem_buf, addr);
1025         put_packet(s, "OK");
1026         break;
1027     case 'Z':
1028     case 'z':
1029         type = strtoul(p, (char **)&p, 16);
1030         if (*p == ',')
1031             p++;
1032         addr = strtoull(p, (char **)&p, 16);
1033         if (*p == ',')
1034             p++;
1035         len = strtoull(p, (char **)&p, 16);
1036         if (ch == 'Z')
1037             res = gdb_breakpoint_insert(addr, len, type);
1038         else
1039             res = gdb_breakpoint_remove(addr, len, type);
1040         if (res >= 0)
1041              put_packet(s, "OK");
1042         else if (res == -ENOSYS)
1043             put_packet(s, "");
1044         else
1045             put_packet(s, "E22");
1046         break;
1047     case 'H':
1048         type = *p++;
1049         thread = strtoull(p, (char **)&p, 16);
1050         if (thread == -1 || thread == 0) {
1051             put_packet(s, "OK");
1052             break;
1053         }
1054         cpu = find_cpu(thread);
1055         if (cpu == NULL) {
1056             put_packet(s, "E22");
1057             break;
1058         }
1059         switch (type) {
1060         case 'c':
1061             s->c_cpu = cpu;
1062             put_packet(s, "OK");
1063             break;
1064         case 'g':
1065             s->g_cpu = cpu;
1066             put_packet(s, "OK");
1067             break;
1068         default:
1069              put_packet(s, "E22");
1070              break;
1071         }
1072         break;
1073     case 'T':
1074         thread = strtoull(p, (char **)&p, 16);
1075         cpu = find_cpu(thread);
1076
1077         if (cpu != NULL) {
1078             put_packet(s, "OK");
1079         } else {
1080             put_packet(s, "E22");
1081         }
1082         break;
1083     case 'q':
1084     case 'Q':
1085         /* parse any 'q' packets here */
1086         if (!strcmp(p,"qemu.sstepbits")) {
1087             /* Query Breakpoint bit definitions */
1088             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1089                      SSTEP_ENABLE,
1090                      SSTEP_NOIRQ,
1091                      SSTEP_NOTIMER);
1092             put_packet(s, buf);
1093             break;
1094         } else if (is_query_packet(p, "qemu.sstep", '=')) {
1095             /* Display or change the sstep_flags */
1096             p += 10;
1097             if (*p != '=') {
1098                 /* Display current setting */
1099                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1100                 put_packet(s, buf);
1101                 break;
1102             }
1103             p++;
1104             type = strtoul(p, (char **)&p, 16);
1105             sstep_flags = type;
1106             put_packet(s, "OK");
1107             break;
1108         } else if (strcmp(p,"C") == 0) {
1109             /* "Current thread" remains vague in the spec, so always return
1110              *  the first CPU (gdb returns the first thread). */
1111             put_packet(s, "QC1");
1112             break;
1113         } else if (strcmp(p,"fThreadInfo") == 0) {
1114             s->query_cpu = first_cpu;
1115             goto report_cpuinfo;
1116         } else if (strcmp(p,"sThreadInfo") == 0) {
1117         report_cpuinfo:
1118             if (s->query_cpu) {
1119                 snprintf(buf, sizeof(buf), "m%x", cpu_index(s->query_cpu));
1120                 put_packet(s, buf);
1121                 s->query_cpu = CPU_NEXT(s->query_cpu);
1122             } else
1123                 put_packet(s, "l");
1124             break;
1125         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1126             thread = strtoull(p+16, (char **)&p, 16);
1127             cpu = find_cpu(thread);
1128             if (cpu != NULL) {
1129                 cpu_synchronize_state(cpu);
1130                 /* memtohex() doubles the required space */
1131                 len = snprintf((char *)mem_buf, sizeof(buf) / 2,
1132                                "CPU#%d [%s]", cpu->cpu_index,
1133                                cpu->halted ? "halted " : "running");
1134                 memtohex(buf, mem_buf, len);
1135                 put_packet(s, buf);
1136             }
1137             break;
1138         }
1139 #ifdef CONFIG_USER_ONLY
1140         else if (strcmp(p, "Offsets") == 0) {
1141             TaskState *ts = s->c_cpu->opaque;
1142
1143             snprintf(buf, sizeof(buf),
1144                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1145                      ";Bss=" TARGET_ABI_FMT_lx,
1146                      ts->info->code_offset,
1147                      ts->info->data_offset,
1148                      ts->info->data_offset);
1149             put_packet(s, buf);
1150             break;
1151         }
1152 #else /* !CONFIG_USER_ONLY */
1153         else if (strncmp(p, "Rcmd,", 5) == 0) {
1154             int len = strlen(p + 5);
1155
1156             if ((len % 2) != 0) {
1157                 put_packet(s, "E01");
1158                 break;
1159             }
1160             len = len / 2;
1161             hextomem(mem_buf, p + 5, len);
1162             mem_buf[len++] = 0;
1163             qemu_chr_be_write(s->mon_chr, mem_buf, len);
1164             put_packet(s, "OK");
1165             break;
1166         }
1167 #endif /* !CONFIG_USER_ONLY */
1168         if (is_query_packet(p, "Supported", ':')) {
1169             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1170             cc = CPU_GET_CLASS(first_cpu);
1171             if (cc->gdb_core_xml_file != NULL) {
1172                 pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1173             }
1174             put_packet(s, buf);
1175             break;
1176         }
1177         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1178             const char *xml;
1179             target_ulong total_len;
1180
1181             cc = CPU_GET_CLASS(first_cpu);
1182             if (cc->gdb_core_xml_file == NULL) {
1183                 goto unknown_command;
1184             }
1185
1186             gdb_has_xml = true;
1187             p += 19;
1188             xml = get_feature_xml(p, &p, cc);
1189             if (!xml) {
1190                 snprintf(buf, sizeof(buf), "E00");
1191                 put_packet(s, buf);
1192                 break;
1193             }
1194
1195             if (*p == ':')
1196                 p++;
1197             addr = strtoul(p, (char **)&p, 16);
1198             if (*p == ',')
1199                 p++;
1200             len = strtoul(p, (char **)&p, 16);
1201
1202             total_len = strlen(xml);
1203             if (addr > total_len) {
1204                 snprintf(buf, sizeof(buf), "E00");
1205                 put_packet(s, buf);
1206                 break;
1207             }
1208             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1209                 len = (MAX_PACKET_LENGTH - 5) / 2;
1210             if (len < total_len - addr) {
1211                 buf[0] = 'm';
1212                 len = memtox(buf + 1, xml + addr, len);
1213             } else {
1214                 buf[0] = 'l';
1215                 len = memtox(buf + 1, xml + addr, total_len - addr);
1216             }
1217             put_packet_binary(s, buf, len + 1);
1218             break;
1219         }
1220         if (is_query_packet(p, "Attached", ':')) {
1221             put_packet(s, GDB_ATTACHED);
1222             break;
1223         }
1224         /* Unrecognised 'q' command.  */
1225         goto unknown_command;
1226
1227     default:
1228     unknown_command:
1229         /* put empty packet */
1230         buf[0] = '\0';
1231         put_packet(s, buf);
1232         break;
1233     }
1234     return RS_IDLE;
1235 }
1236
1237 void gdb_set_stop_cpu(CPUState *cpu)
1238 {
1239     gdbserver_state->c_cpu = cpu;
1240     gdbserver_state->g_cpu = cpu;
1241 }
1242
1243 #ifndef CONFIG_USER_ONLY
1244 static void gdb_vm_state_change(void *opaque, int running, RunState state)
1245 {
1246     GDBState *s = gdbserver_state;
1247     CPUState *cpu = s->c_cpu;
1248     char buf[256];
1249     const char *type;
1250     int ret;
1251
1252     if (running || s->state == RS_INACTIVE) {
1253         return;
1254     }
1255     /* Is there a GDB syscall waiting to be sent?  */
1256     if (s->current_syscall_cb) {
1257         put_packet(s, s->syscall_buf);
1258         return;
1259     }
1260     switch (state) {
1261     case RUN_STATE_DEBUG:
1262         if (cpu->watchpoint_hit) {
1263             switch (cpu->watchpoint_hit->flags & BP_MEM_ACCESS) {
1264             case BP_MEM_READ:
1265                 type = "r";
1266                 break;
1267             case BP_MEM_ACCESS:
1268                 type = "a";
1269                 break;
1270             default:
1271                 type = "";
1272                 break;
1273             }
1274             snprintf(buf, sizeof(buf),
1275                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1276                      GDB_SIGNAL_TRAP, cpu_index(cpu), type,
1277                      (target_ulong)cpu->watchpoint_hit->vaddr);
1278             cpu->watchpoint_hit = NULL;
1279             goto send_packet;
1280         }
1281         tb_flush(cpu);
1282         ret = GDB_SIGNAL_TRAP;
1283         break;
1284     case RUN_STATE_PAUSED:
1285         ret = GDB_SIGNAL_INT;
1286         break;
1287     case RUN_STATE_SHUTDOWN:
1288         ret = GDB_SIGNAL_QUIT;
1289         break;
1290     case RUN_STATE_IO_ERROR:
1291         ret = GDB_SIGNAL_IO;
1292         break;
1293     case RUN_STATE_WATCHDOG:
1294         ret = GDB_SIGNAL_ALRM;
1295         break;
1296     case RUN_STATE_INTERNAL_ERROR:
1297         ret = GDB_SIGNAL_ABRT;
1298         break;
1299     case RUN_STATE_SAVE_VM:
1300     case RUN_STATE_RESTORE_VM:
1301         return;
1302     case RUN_STATE_FINISH_MIGRATE:
1303         ret = GDB_SIGNAL_XCPU;
1304         break;
1305     default:
1306         ret = GDB_SIGNAL_UNKNOWN;
1307         break;
1308     }
1309     gdb_set_stop_cpu(cpu);
1310     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, cpu_index(cpu));
1311
1312 send_packet:
1313     put_packet(s, buf);
1314
1315     /* disable single step if it was enabled */
1316     cpu_single_step(cpu, 0);
1317 }
1318 #endif
1319
1320 /* Send a gdb syscall request.
1321    This accepts limited printf-style format specifiers, specifically:
1322     %x  - target_ulong argument printed in hex.
1323     %lx - 64-bit argument printed in hex.
1324     %s  - string pointer (target_ulong) and length (int) pair.  */
1325 void gdb_do_syscallv(gdb_syscall_complete_cb cb, const char *fmt, va_list va)
1326 {
1327     char *p;
1328     char *p_end;
1329     target_ulong addr;
1330     uint64_t i64;
1331     GDBState *s;
1332
1333     s = gdbserver_state;
1334     if (!s)
1335         return;
1336     s->current_syscall_cb = cb;
1337 #ifndef CONFIG_USER_ONLY
1338     vm_stop(RUN_STATE_DEBUG);
1339 #endif
1340     p = s->syscall_buf;
1341     p_end = &s->syscall_buf[sizeof(s->syscall_buf)];
1342     *(p++) = 'F';
1343     while (*fmt) {
1344         if (*fmt == '%') {
1345             fmt++;
1346             switch (*fmt++) {
1347             case 'x':
1348                 addr = va_arg(va, target_ulong);
1349                 p += snprintf(p, p_end - p, TARGET_FMT_lx, addr);
1350                 break;
1351             case 'l':
1352                 if (*(fmt++) != 'x')
1353                     goto bad_format;
1354                 i64 = va_arg(va, uint64_t);
1355                 p += snprintf(p, p_end - p, "%" PRIx64, i64);
1356                 break;
1357             case 's':
1358                 addr = va_arg(va, target_ulong);
1359                 p += snprintf(p, p_end - p, TARGET_FMT_lx "/%x",
1360                               addr, va_arg(va, int));
1361                 break;
1362             default:
1363             bad_format:
1364                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
1365                         fmt - 1);
1366                 break;
1367             }
1368         } else {
1369             *(p++) = *(fmt++);
1370         }
1371     }
1372     *p = 0;
1373 #ifdef CONFIG_USER_ONLY
1374     put_packet(s, s->syscall_buf);
1375     gdb_handlesig(s->c_cpu, 0);
1376 #else
1377     /* In this case wait to send the syscall packet until notification that
1378        the CPU has stopped.  This must be done because if the packet is sent
1379        now the reply from the syscall request could be received while the CPU
1380        is still in the running state, which can cause packets to be dropped
1381        and state transition 'T' packets to be sent while the syscall is still
1382        being processed.  */
1383     qemu_cpu_kick(s->c_cpu);
1384 #endif
1385 }
1386
1387 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1388 {
1389     va_list va;
1390
1391     va_start(va, fmt);
1392     gdb_do_syscallv(cb, fmt, va);
1393     va_end(va);
1394 }
1395
1396 static void gdb_read_byte(GDBState *s, int ch)
1397 {
1398     int i, csum;
1399     uint8_t reply;
1400
1401 #ifndef CONFIG_USER_ONLY
1402     if (s->last_packet_len) {
1403         /* Waiting for a response to the last packet.  If we see the start
1404            of a new command then abandon the previous response.  */
1405         if (ch == '-') {
1406 #ifdef DEBUG_GDB
1407             printf("Got NACK, retransmitting\n");
1408 #endif
1409             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
1410         }
1411 #ifdef DEBUG_GDB
1412         else if (ch == '+')
1413             printf("Got ACK\n");
1414         else
1415             printf("Got '%c' when expecting ACK/NACK\n", ch);
1416 #endif
1417         if (ch == '+' || ch == '$')
1418             s->last_packet_len = 0;
1419         if (ch != '$')
1420             return;
1421     }
1422     if (runstate_is_running()) {
1423         /* when the CPU is running, we cannot do anything except stop
1424            it when receiving a char */
1425         vm_stop(RUN_STATE_PAUSED);
1426     } else
1427 #endif
1428     {
1429         switch(s->state) {
1430         case RS_IDLE:
1431             if (ch == '$') {
1432                 s->line_buf_index = 0;
1433                 s->state = RS_GETLINE;
1434             }
1435             break;
1436         case RS_GETLINE:
1437             if (ch == '#') {
1438             s->state = RS_CHKSUM1;
1439             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1440                 s->state = RS_IDLE;
1441             } else {
1442             s->line_buf[s->line_buf_index++] = ch;
1443             }
1444             break;
1445         case RS_CHKSUM1:
1446             s->line_buf[s->line_buf_index] = '\0';
1447             s->line_csum = fromhex(ch) << 4;
1448             s->state = RS_CHKSUM2;
1449             break;
1450         case RS_CHKSUM2:
1451             s->line_csum |= fromhex(ch);
1452             csum = 0;
1453             for(i = 0; i < s->line_buf_index; i++) {
1454                 csum += s->line_buf[i];
1455             }
1456             if (s->line_csum != (csum & 0xff)) {
1457                 reply = '-';
1458                 put_buffer(s, &reply, 1);
1459                 s->state = RS_IDLE;
1460             } else {
1461                 reply = '+';
1462                 put_buffer(s, &reply, 1);
1463                 s->state = gdb_handle_packet(s, s->line_buf);
1464             }
1465             break;
1466         default:
1467             abort();
1468         }
1469     }
1470 }
1471
1472 /* Tell the remote gdb that the process has exited.  */
1473 void gdb_exit(CPUArchState *env, int code)
1474 {
1475   GDBState *s;
1476   char buf[4];
1477
1478   s = gdbserver_state;
1479   if (!s) {
1480       return;
1481   }
1482 #ifdef CONFIG_USER_ONLY
1483   if (gdbserver_fd < 0 || s->fd < 0) {
1484       return;
1485   }
1486 #else
1487   if (!s->chr) {
1488       return;
1489   }
1490 #endif
1491
1492   snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
1493   put_packet(s, buf);
1494
1495 #ifndef CONFIG_USER_ONLY
1496   qemu_chr_delete(s->chr);
1497 #endif
1498 }
1499
1500 #ifdef CONFIG_USER_ONLY
1501 int
1502 gdb_queuesig (void)
1503 {
1504     GDBState *s;
1505
1506     s = gdbserver_state;
1507
1508     if (gdbserver_fd < 0 || s->fd < 0)
1509         return 0;
1510     else
1511         return 1;
1512 }
1513
1514 int
1515 gdb_handlesig(CPUState *cpu, int sig)
1516 {
1517     GDBState *s;
1518     char buf[256];
1519     int n;
1520
1521     s = gdbserver_state;
1522     if (gdbserver_fd < 0 || s->fd < 0) {
1523         return sig;
1524     }
1525
1526     /* disable single step if it was enabled */
1527     cpu_single_step(cpu, 0);
1528     tb_flush(cpu);
1529
1530     if (sig != 0) {
1531         snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));
1532         put_packet(s, buf);
1533     }
1534     /* put_packet() might have detected that the peer terminated the
1535        connection.  */
1536     if (s->fd < 0) {
1537         return sig;
1538     }
1539
1540     sig = 0;
1541     s->state = RS_IDLE;
1542     s->running_state = 0;
1543     while (s->running_state == 0) {
1544         n = read(s->fd, buf, 256);
1545         if (n > 0) {
1546             int i;
1547
1548             for (i = 0; i < n; i++) {
1549                 gdb_read_byte(s, buf[i]);
1550             }
1551         } else if (n == 0 || errno != EAGAIN) {
1552             /* XXX: Connection closed.  Should probably wait for another
1553                connection before continuing.  */
1554             return sig;
1555         }
1556     }
1557     sig = s->signal;
1558     s->signal = 0;
1559     return sig;
1560 }
1561
1562 /* Tell the remote gdb that the process has exited due to SIG.  */
1563 void gdb_signalled(CPUArchState *env, int sig)
1564 {
1565     GDBState *s;
1566     char buf[4];
1567
1568     s = gdbserver_state;
1569     if (gdbserver_fd < 0 || s->fd < 0) {
1570         return;
1571     }
1572
1573     snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb(sig));
1574     put_packet(s, buf);
1575 }
1576
1577 static void gdb_accept(void)
1578 {
1579     GDBState *s;
1580     struct sockaddr_in sockaddr;
1581     socklen_t len;
1582     int fd;
1583
1584     for(;;) {
1585         len = sizeof(sockaddr);
1586         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
1587         if (fd < 0 && errno != EINTR) {
1588             perror("accept");
1589             return;
1590         } else if (fd >= 0) {
1591 #ifndef _WIN32
1592             fcntl(fd, F_SETFD, FD_CLOEXEC);
1593 #endif
1594             break;
1595         }
1596     }
1597
1598     /* set short latency */
1599     socket_set_nodelay(fd);
1600
1601     s = g_malloc0(sizeof(GDBState));
1602     s->c_cpu = first_cpu;
1603     s->g_cpu = first_cpu;
1604     s->fd = fd;
1605     gdb_has_xml = false;
1606
1607     gdbserver_state = s;
1608
1609     fcntl(fd, F_SETFL, O_NONBLOCK);
1610 }
1611
1612 static int gdbserver_open(int port)
1613 {
1614     struct sockaddr_in sockaddr;
1615     int fd, ret;
1616
1617     fd = socket(PF_INET, SOCK_STREAM, 0);
1618     if (fd < 0) {
1619         perror("socket");
1620         return -1;
1621     }
1622 #ifndef _WIN32
1623     fcntl(fd, F_SETFD, FD_CLOEXEC);
1624 #endif
1625
1626     socket_set_fast_reuse(fd);
1627
1628     sockaddr.sin_family = AF_INET;
1629     sockaddr.sin_port = htons(port);
1630     sockaddr.sin_addr.s_addr = 0;
1631     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
1632     if (ret < 0) {
1633         perror("bind");
1634         close(fd);
1635         return -1;
1636     }
1637     ret = listen(fd, 0);
1638     if (ret < 0) {
1639         perror("listen");
1640         close(fd);
1641         return -1;
1642     }
1643     return fd;
1644 }
1645
1646 int gdbserver_start(int port)
1647 {
1648     gdbserver_fd = gdbserver_open(port);
1649     if (gdbserver_fd < 0)
1650         return -1;
1651     /* accept connections */
1652     gdb_accept();
1653     return 0;
1654 }
1655
1656 /* Disable gdb stub for child processes.  */
1657 void gdbserver_fork(CPUState *cpu)
1658 {
1659     GDBState *s = gdbserver_state;
1660
1661     if (gdbserver_fd < 0 || s->fd < 0) {
1662         return;
1663     }
1664     close(s->fd);
1665     s->fd = -1;
1666     cpu_breakpoint_remove_all(cpu, BP_GDB);
1667     cpu_watchpoint_remove_all(cpu, BP_GDB);
1668 }
1669 #else
1670 static int gdb_chr_can_receive(void *opaque)
1671 {
1672   /* We can handle an arbitrarily large amount of data.
1673    Pick the maximum packet size, which is as good as anything.  */
1674   return MAX_PACKET_LENGTH;
1675 }
1676
1677 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
1678 {
1679     int i;
1680
1681     for (i = 0; i < size; i++) {
1682         gdb_read_byte(gdbserver_state, buf[i]);
1683     }
1684 }
1685
1686 static void gdb_chr_event(void *opaque, int event)
1687 {
1688     switch (event) {
1689     case CHR_EVENT_OPENED:
1690         vm_stop(RUN_STATE_PAUSED);
1691         gdb_has_xml = false;
1692         break;
1693     default:
1694         break;
1695     }
1696 }
1697
1698 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
1699 {
1700     char buf[MAX_PACKET_LENGTH];
1701
1702     buf[0] = 'O';
1703     if (len > (MAX_PACKET_LENGTH/2) - 1)
1704         len = (MAX_PACKET_LENGTH/2) - 1;
1705     memtohex(buf + 1, (uint8_t *)msg, len);
1706     put_packet(s, buf);
1707 }
1708
1709 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
1710 {
1711     const char *p = (const char *)buf;
1712     int max_sz;
1713
1714     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
1715     for (;;) {
1716         if (len <= max_sz) {
1717             gdb_monitor_output(gdbserver_state, p, len);
1718             break;
1719         }
1720         gdb_monitor_output(gdbserver_state, p, max_sz);
1721         p += max_sz;
1722         len -= max_sz;
1723     }
1724     return len;
1725 }
1726
1727 #ifndef _WIN32
1728 static void gdb_sigterm_handler(int signal)
1729 {
1730     if (runstate_is_running()) {
1731         vm_stop(RUN_STATE_PAUSED);
1732     }
1733 }
1734 #endif
1735
1736 int gdbserver_start(const char *device)
1737 {
1738     GDBState *s;
1739     char gdbstub_device_name[128];
1740     CharDriverState *chr = NULL;
1741     CharDriverState *mon_chr;
1742     ChardevCommon common = { 0 };
1743
1744     if (!device)
1745         return -1;
1746     if (strcmp(device, "none") != 0) {
1747         if (strstart(device, "tcp:", NULL)) {
1748             /* enforce required TCP attributes */
1749             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
1750                      "%s,nowait,nodelay,server", device);
1751             device = gdbstub_device_name;
1752         }
1753 #ifndef _WIN32
1754         else if (strcmp(device, "stdio") == 0) {
1755             struct sigaction act;
1756
1757             memset(&act, 0, sizeof(act));
1758             act.sa_handler = gdb_sigterm_handler;
1759             sigaction(SIGINT, &act, NULL);
1760         }
1761 #endif
1762         chr = qemu_chr_new("gdb", device, NULL);
1763         if (!chr)
1764             return -1;
1765
1766         qemu_chr_fe_claim_no_fail(chr);
1767         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
1768                               gdb_chr_event, NULL);
1769     }
1770
1771     s = gdbserver_state;
1772     if (!s) {
1773         s = g_malloc0(sizeof(GDBState));
1774         gdbserver_state = s;
1775
1776         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
1777
1778         /* Initialize a monitor terminal for gdb */
1779         mon_chr = qemu_chr_alloc(&common, &error_abort);
1780         mon_chr->chr_write = gdb_monitor_write;
1781         monitor_init(mon_chr, 0);
1782     } else {
1783         if (s->chr)
1784             qemu_chr_delete(s->chr);
1785         mon_chr = s->mon_chr;
1786         memset(s, 0, sizeof(GDBState));
1787     }
1788     s->c_cpu = first_cpu;
1789     s->g_cpu = first_cpu;
1790     s->chr = chr;
1791     s->state = chr ? RS_IDLE : RS_INACTIVE;
1792     s->mon_chr = mon_chr;
1793     s->current_syscall_cb = NULL;
1794
1795     return 0;
1796 }
1797 #endif