gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "qemu-common.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "monitor/monitor.h"
  33 #include "sysemu/char.h"
  34 #include "sysemu/sysemu.h"
  35 #include "exec/gdbstub.h"
  36 #endif
  37
  38 #define MAX_PACKET_LENGTH 4096
  39
  40 #include "cpu.h"
  41 #include "qemu/sockets.h"
  42 #include "sysemu/kvm.h"
  43
  44 static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
  45                                          uint8_t *buf, int len, bool is_write)
  46 {
  47     CPUClass *cc = CPU_GET_CLASS(cpu);
  48
  49     if (cc->memory_rw_debug) {
  50         return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
  51     }
  52     return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
  53 }
  54
  55 enum {
  56     GDB_SIGNAL_0 = 0,
  57     GDB_SIGNAL_INT = 2,
  58     GDB_SIGNAL_QUIT = 3,
  59     GDB_SIGNAL_TRAP = 5,
  60     GDB_SIGNAL_ABRT = 6,
  61     GDB_SIGNAL_ALRM = 14,
  62     GDB_SIGNAL_IO = 23,
  63     GDB_SIGNAL_XCPU = 24,
  64     GDB_SIGNAL_UNKNOWN = 143
  65 };
  66
  67 #ifdef CONFIG_USER_ONLY
  68
  69 /* Map target signal numbers to GDB protocol signal numbers and vice
  70  * versa.  For user emulation's currently supported systems, we can
  71  * assume most signals are defined.
  72  */
  73
  74 static int gdb_signal_table[] = {
  75     0,
  76     TARGET_SIGHUP,
  77     TARGET_SIGINT,
  78     TARGET_SIGQUIT,
  79     TARGET_SIGILL,
  80     TARGET_SIGTRAP,
  81     TARGET_SIGABRT,
  82     -1, /* SIGEMT */
  83     TARGET_SIGFPE,
  84     TARGET_SIGKILL,
  85     TARGET_SIGBUS,
  86     TARGET_SIGSEGV,
  87     TARGET_SIGSYS,
  88     TARGET_SIGPIPE,
  89     TARGET_SIGALRM,
  90     TARGET_SIGTERM,
  91     TARGET_SIGURG,
  92     TARGET_SIGSTOP,
  93     TARGET_SIGTSTP,
  94     TARGET_SIGCONT,
  95     TARGET_SIGCHLD,
  96     TARGET_SIGTTIN,
  97     TARGET_SIGTTOU,
  98     TARGET_SIGIO,
  99     TARGET_SIGXCPU,
 100     TARGET_SIGXFSZ,
 101     TARGET_SIGVTALRM,
 102     TARGET_SIGPROF,
 103     TARGET_SIGWINCH,
 104     -1, /* SIGLOST */
 105     TARGET_SIGUSR1,
 106     TARGET_SIGUSR2,
 107 #ifdef TARGET_SIGPWR
 108     TARGET_SIGPWR,
 109 #else
 110     -1,
 111 #endif
 112     -1, /* SIGPOLL */
 113     -1,
 114     -1,
 115     -1,
 116     -1,
 117     -1,
 118     -1,
 119     -1,
 120     -1,
 121     -1,
 122     -1,
 123     -1,
 124 #ifdef __SIGRTMIN
 125     __SIGRTMIN + 1,
 126     __SIGRTMIN + 2,
 127     __SIGRTMIN + 3,
 128     __SIGRTMIN + 4,
 129     __SIGRTMIN + 5,
 130     __SIGRTMIN + 6,
 131     __SIGRTMIN + 7,
 132     __SIGRTMIN + 8,
 133     __SIGRTMIN + 9,
 134     __SIGRTMIN + 10,
 135     __SIGRTMIN + 11,
 136     __SIGRTMIN + 12,
 137     __SIGRTMIN + 13,
 138     __SIGRTMIN + 14,
 139     __SIGRTMIN + 15,
 140     __SIGRTMIN + 16,
 141     __SIGRTMIN + 17,
 142     __SIGRTMIN + 18,
 143     __SIGRTMIN + 19,
 144     __SIGRTMIN + 20,
 145     __SIGRTMIN + 21,
 146     __SIGRTMIN + 22,
 147     __SIGRTMIN + 23,
 148     __SIGRTMIN + 24,
 149     __SIGRTMIN + 25,
 150     __SIGRTMIN + 26,
 151     __SIGRTMIN + 27,
 152     __SIGRTMIN + 28,
 153     __SIGRTMIN + 29,
 154     __SIGRTMIN + 30,
 155     __SIGRTMIN + 31,
 156     -1, /* SIGCANCEL */
 157     __SIGRTMIN,
 158     __SIGRTMIN + 32,
 159     __SIGRTMIN + 33,
 160     __SIGRTMIN + 34,
 161     __SIGRTMIN + 35,
 162     __SIGRTMIN + 36,
 163     __SIGRTMIN + 37,
 164     __SIGRTMIN + 38,
 165     __SIGRTMIN + 39,
 166     __SIGRTMIN + 40,
 167     __SIGRTMIN + 41,
 168     __SIGRTMIN + 42,
 169     __SIGRTMIN + 43,
 170     __SIGRTMIN + 44,
 171     __SIGRTMIN + 45,
 172     __SIGRTMIN + 46,
 173     __SIGRTMIN + 47,
 174     __SIGRTMIN + 48,
 175     __SIGRTMIN + 49,
 176     __SIGRTMIN + 50,
 177     __SIGRTMIN + 51,
 178     __SIGRTMIN + 52,
 179     __SIGRTMIN + 53,
 180     __SIGRTMIN + 54,
 181     __SIGRTMIN + 55,
 182     __SIGRTMIN + 56,
 183     __SIGRTMIN + 57,
 184     __SIGRTMIN + 58,
 185     __SIGRTMIN + 59,
 186     __SIGRTMIN + 60,
 187     __SIGRTMIN + 61,
 188     __SIGRTMIN + 62,
 189     __SIGRTMIN + 63,
 190     __SIGRTMIN + 64,
 191     __SIGRTMIN + 65,
 192     __SIGRTMIN + 66,
 193     __SIGRTMIN + 67,
 194     __SIGRTMIN + 68,
 195     __SIGRTMIN + 69,
 196     __SIGRTMIN + 70,
 197     __SIGRTMIN + 71,
 198     __SIGRTMIN + 72,
 199     __SIGRTMIN + 73,
 200     __SIGRTMIN + 74,
 201     __SIGRTMIN + 75,
 202     __SIGRTMIN + 76,
 203     __SIGRTMIN + 77,
 204     __SIGRTMIN + 78,
 205     __SIGRTMIN + 79,
 206     __SIGRTMIN + 80,
 207     __SIGRTMIN + 81,
 208     __SIGRTMIN + 82,
 209     __SIGRTMIN + 83,
 210     __SIGRTMIN + 84,
 211     __SIGRTMIN + 85,
 212     __SIGRTMIN + 86,
 213     __SIGRTMIN + 87,
 214     __SIGRTMIN + 88,
 215     __SIGRTMIN + 89,
 216     __SIGRTMIN + 90,
 217     __SIGRTMIN + 91,
 218     __SIGRTMIN + 92,
 219     __SIGRTMIN + 93,
 220     __SIGRTMIN + 94,
 221     __SIGRTMIN + 95,
 222     -1, /* SIGINFO */
 223     -1, /* UNKNOWN */
 224     -1, /* DEFAULT */
 225     -1,
 226     -1,
 227     -1,
 228     -1,
 229     -1,
 230     -1
 231 #endif
 232 };
 233 #else
 234 /* In system mode we only need SIGINT and SIGTRAP; other signals
 235    are not yet supported.  */
 236
 237 enum {
 238     TARGET_SIGINT = 2,
 239     TARGET_SIGTRAP = 5
 240 };
 241
 242 static int gdb_signal_table[] = {
 243     -1,
 244     -1,
 245     TARGET_SIGINT,
 246     -1,
 247     -1,
 248     TARGET_SIGTRAP
 249 };
 250 #endif
 251
 252 #ifdef CONFIG_USER_ONLY
 253 static int target_signal_to_gdb (int sig)
 254 {
 255     int i;
 256     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 257         if (gdb_signal_table[i] == sig)
 258             return i;
 259     return GDB_SIGNAL_UNKNOWN;
 260 }
 261 #endif
 262
 263 static int gdb_signal_to_target (int sig)
 264 {
 265     if (sig < ARRAY_SIZE (gdb_signal_table))
 266         return gdb_signal_table[sig];
 267     else
 268         return -1;
 269 }
 270
 271 //#define DEBUG_GDB
 272
 273 typedef struct GDBRegisterState {
 274     int base_reg;
 275     int num_regs;
 276     gdb_reg_cb get_reg;
 277     gdb_reg_cb set_reg;
 278     const char *xml;
 279     struct GDBRegisterState *next;
 280 } GDBRegisterState;
 281
 282 enum RSState {
 283     RS_INACTIVE,
 284     RS_IDLE,
 285     RS_GETLINE,
 286     RS_CHKSUM1,
 287     RS_CHKSUM2,
 288 };
 289 typedef struct GDBState {
 290     CPUState *c_cpu; /* current CPU for step/continue ops */
 291     CPUState *g_cpu; /* current CPU for other ops */
 292     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 293     enum RSState state; /* parsing state */
 294     char line_buf[MAX_PACKET_LENGTH];
 295     int line_buf_index;
 296     int line_csum;
 297     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 298     int last_packet_len;
 299     int signal;
 300 #ifdef CONFIG_USER_ONLY
 301     int fd;
 302     int running_state;
 303 #else
 304     CharDriverState *chr;
 305     CharDriverState *mon_chr;
 306 #endif
 307     char syscall_buf[256];
 308     gdb_syscall_complete_cb current_syscall_cb;
 309 } GDBState;
 310
 311 /* By default use no IRQs and no timers while single stepping so as to
 312  * make single stepping like an ICE HW step.
 313  */
 314 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 315
 316 static GDBState *gdbserver_state;
 317
 318 bool gdb_has_xml;
 319
 320 int semihosting_target = SEMIHOSTING_TARGET_AUTO;
 321
 322 #ifdef CONFIG_USER_ONLY
 323 /* XXX: This is not thread safe.  Do we care?  */
 324 static int gdbserver_fd = -1;
 325
 326 static int get_char(GDBState *s)
 327 {
 328     uint8_t ch;
 329     int ret;
 330
 331     for(;;) {
 332         ret = qemu_recv(s->fd, &ch, 1, 0);
 333         if (ret < 0) {
 334             if (errno == ECONNRESET)
 335                 s->fd = -1;
 336             if (errno != EINTR && errno != EAGAIN)
 337                 return -1;
 338         } else if (ret == 0) {
 339             close(s->fd);
 340             s->fd = -1;
 341             return -1;
 342         } else {
 343             break;
 344         }
 345     }
 346     return ch;
 347 }
 348 #endif
 349
 350 static enum {
 351     GDB_SYS_UNKNOWN,
 352     GDB_SYS_ENABLED,
 353     GDB_SYS_DISABLED,
 354 } gdb_syscall_mode;
 355
 356 /* Decide if either remote gdb syscalls or native file IO should be used. */
 357 int use_gdb_syscalls(void)
 358 {
 359     if (semihosting_target == SEMIHOSTING_TARGET_NATIVE) {
 360         /* -semihosting-config target=native */
 361         return false;
 362     } else if (semihosting_target == SEMIHOSTING_TARGET_GDB) {
 363         /* -semihosting-config target=gdb */
 364         return true;
 365     }
 366
 367     /* -semihosting-config target=auto */
 368     /* On the first call check if gdb is connected and remember. */
 369     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 370         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 371                                             : GDB_SYS_DISABLED);
 372     }
 373     return gdb_syscall_mode == GDB_SYS_ENABLED;
 374 }
 375
 376 /* Resume execution.  */
 377 static inline void gdb_continue(GDBState *s)
 378 {
 379 #ifdef CONFIG_USER_ONLY
 380     s->running_state = 1;
 381 #else
 382     if (!runstate_needs_reset()) {
 383         vm_start();
 384     }
 385 #endif
 386 }
 387
 388 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 389 {
 390 #ifdef CONFIG_USER_ONLY
 391     int ret;
 392
 393     while (len > 0) {
 394         ret = send(s->fd, buf, len, 0);
 395         if (ret < 0) {
 396             if (errno != EINTR && errno != EAGAIN)
 397                 return;
 398         } else {
 399             buf += ret;
 400             len -= ret;
 401         }
 402     }
 403 #else
 404     qemu_chr_fe_write(s->chr, buf, len);
 405 #endif
 406 }
 407
 408 static inline int fromhex(int v)
 409 {
 410     if (v >= '0' && v <= '9')
 411         return v - '0';
 412     else if (v >= 'A' && v <= 'F')
 413         return v - 'A' + 10;
 414     else if (v >= 'a' && v <= 'f')
 415         return v - 'a' + 10;
 416     else
 417         return 0;
 418 }
 419
 420 static inline int tohex(int v)
 421 {
 422     if (v < 10)
 423         return v + '0';
 424     else
 425         return v - 10 + 'a';
 426 }
 427
 428 static void memtohex(char *buf, const uint8_t *mem, int len)
 429 {
 430     int i, c;
 431     char *q;
 432     q = buf;
 433     for(i = 0; i < len; i++) {
 434         c = mem[i];
 435         *q++ = tohex(c >> 4);
 436         *q++ = tohex(c & 0xf);
 437     }
 438     *q = '\0';
 439 }
 440
 441 static void hextomem(uint8_t *mem, const char *buf, int len)
 442 {
 443     int i;
 444
 445     for(i = 0; i < len; i++) {
 446         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 447         buf += 2;
 448     }
 449 }
 450
 451 /* return -1 if error, 0 if OK */
 452 static int put_packet_binary(GDBState *s, const char *buf, int len)
 453 {
 454     int csum, i;
 455     uint8_t *p;
 456
 457     for(;;) {
 458         p = s->last_packet;
 459         *(p++) = '$';
 460         memcpy(p, buf, len);
 461         p += len;
 462         csum = 0;
 463         for(i = 0; i < len; i++) {
 464             csum += buf[i];
 465         }
 466         *(p++) = '#';
 467         *(p++) = tohex((csum >> 4) & 0xf);
 468         *(p++) = tohex((csum) & 0xf);
 469
 470         s->last_packet_len = p - s->last_packet;
 471         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 472
 473 #ifdef CONFIG_USER_ONLY
 474         i = get_char(s);
 475         if (i < 0)
 476             return -1;
 477         if (i == '+')
 478             break;
 479 #else
 480         break;
 481 #endif
 482     }
 483     return 0;
 484 }
 485
 486 /* return -1 if error, 0 if OK */
 487 static int put_packet(GDBState *s, const char *buf)
 488 {
 489 #ifdef DEBUG_GDB
 490     printf("reply='%s'\n", buf);
 491 #endif
 492
 493     return put_packet_binary(s, buf, strlen(buf));
 494 }
 495
 496 /* Encode data using the encoding for 'x' packets.  */
 497 static int memtox(char *buf, const char *mem, int len)
 498 {
 499     char *p = buf;
 500     char c;
 501
 502     while (len--) {
 503         c = *(mem++);
 504         switch (c) {
 505         case '#': case '$': case '*': case '}':
 506             *(p++) = '}';
 507             *(p++) = c ^ 0x20;
 508             break;
 509         default:
 510             *(p++) = c;
 511             break;
 512         }
 513     }
 514     return p - buf;
 515 }
 516
 517 static const char *get_feature_xml(const char *p, const char **newp,
 518                                    CPUClass *cc)
 519 {
 520     size_t len;
 521     int i;
 522     const char *name;
 523     static char target_xml[1024];
 524
 525     len = 0;
 526     while (p[len] && p[len] != ':')
 527         len++;
 528     *newp = p + len;
 529
 530     name = NULL;
 531     if (strncmp(p, "target.xml", len) == 0) {
 532         /* Generate the XML description for this CPU.  */
 533         if (!target_xml[0]) {
 534             GDBRegisterState *r;
 535             CPUState *cpu = first_cpu;
 536
 537             snprintf(target_xml, sizeof(target_xml),
 538                      "<?xml version=\"1.0\"?>"
 539                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
 540                      "<target>"
 541                      "<xi:include href=\"%s\"/>",
 542                      cc->gdb_core_xml_file);
 543
 544             for (r = cpu->gdb_regs; r; r = r->next) {
 545                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
 546                 pstrcat(target_xml, sizeof(target_xml), r->xml);
 547                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
 548             }
 549             pstrcat(target_xml, sizeof(target_xml), "</target>");
 550         }
 551         return target_xml;
 552     }
 553     for (i = 0; ; i++) {
 554         name = xml_builtin[i][0];
 555         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
 556             break;
 557     }
 558     return name ? xml_builtin[i][1] : NULL;
 559 }
 560
 561 static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 562 {
 563     CPUClass *cc = CPU_GET_CLASS(cpu);
 564     CPUArchState *env = cpu->env_ptr;
 565     GDBRegisterState *r;
 566
 567     if (reg < cc->gdb_num_core_regs) {
 568         return cc->gdb_read_register(cpu, mem_buf, reg);
 569     }
 570
 571     for (r = cpu->gdb_regs; r; r = r->next) {
 572         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 573             return r->get_reg(env, mem_buf, reg - r->base_reg);
 574         }
 575     }
 576     return 0;
 577 }
 578
 579 static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 580 {
 581     CPUClass *cc = CPU_GET_CLASS(cpu);
 582     CPUArchState *env = cpu->env_ptr;
 583     GDBRegisterState *r;
 584
 585     if (reg < cc->gdb_num_core_regs) {
 586         return cc->gdb_write_register(cpu, mem_buf, reg);
 587     }
 588
 589     for (r = cpu->gdb_regs; r; r = r->next) {
 590         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 591             return r->set_reg(env, mem_buf, reg - r->base_reg);
 592         }
 593     }
 594     return 0;
 595 }
 596
 597 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
 598    specifies the first register number and these registers are included in
 599    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
 600    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
 601  */
 602
 603 void gdb_register_coprocessor(CPUState *cpu,
 604                               gdb_reg_cb get_reg, gdb_reg_cb set_reg,
 605                               int num_regs, const char *xml, int g_pos)
 606 {
 607     GDBRegisterState *s;
 608     GDBRegisterState **p;
 609
 610     p = &cpu->gdb_regs;
 611     while (*p) {
 612         /* Check for duplicates.  */
 613         if (strcmp((*p)->xml, xml) == 0)
 614             return;
 615         p = &(*p)->next;
 616     }
 617
 618     s = g_new0(GDBRegisterState, 1);
 619     s->base_reg = cpu->gdb_num_regs;
 620     s->num_regs = num_regs;
 621     s->get_reg = get_reg;
 622     s->set_reg = set_reg;
 623     s->xml = xml;
 624
 625     /* Add to end of list.  */
 626     cpu->gdb_num_regs += num_regs;
 627     *p = s;
 628     if (g_pos) {
 629         if (g_pos != s->base_reg) {
 630             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
 631                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
 632         } else {
 633             cpu->gdb_num_g_regs = cpu->gdb_num_regs;
 634         }
 635     }
 636 }
 637
 638 #ifndef CONFIG_USER_ONLY
 639 /* Translate GDB watchpoint type to a flags value for cpu_watchpoint_* */
 640 static inline int xlat_gdb_type(CPUState *cpu, int gdbtype)
 641 {
 642     static const int xlat[] = {
 643         [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
 644         [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
 645         [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
 646     };
 647
 648     CPUClass *cc = CPU_GET_CLASS(cpu);
 649     int cputype = xlat[gdbtype];
 650
 651     if (cc->gdb_stop_before_watchpoint) {
 652         cputype |= BP_STOP_BEFORE_ACCESS;
 653     }
 654     return cputype;
 655 }
 656 #endif
 657
 658 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
 659 {
 660     CPUState *cpu;
 661     int err = 0;
 662
 663     if (kvm_enabled()) {
 664         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 665     }
 666
 667     switch (type) {
 668     case GDB_BREAKPOINT_SW:
 669     case GDB_BREAKPOINT_HW:
 670         CPU_FOREACH(cpu) {
 671             err = cpu_breakpoint_insert(cpu, addr, BP_GDB, NULL);
 672             if (err) {
 673                 break;
 674             }
 675         }
 676         return err;
 677 #ifndef CONFIG_USER_ONLY
 678     case GDB_WATCHPOINT_WRITE:
 679     case GDB_WATCHPOINT_READ:
 680     case GDB_WATCHPOINT_ACCESS:
 681         CPU_FOREACH(cpu) {
 682             err = cpu_watchpoint_insert(cpu, addr, len,
 683                                         xlat_gdb_type(cpu, type), NULL);
 684             if (err) {
 685                 break;
 686             }
 687         }
 688         return err;
 689 #endif
 690     default:
 691         return -ENOSYS;
 692     }
 693 }
 694
 695 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
 696 {
 697     CPUState *cpu;
 698     int err = 0;
 699
 700     if (kvm_enabled()) {
 701         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 702     }
 703
 704     switch (type) {
 705     case GDB_BREAKPOINT_SW:
 706     case GDB_BREAKPOINT_HW:
 707         CPU_FOREACH(cpu) {
 708             err = cpu_breakpoint_remove(cpu, addr, BP_GDB);
 709             if (err) {
 710                 break;
 711             }
 712         }
 713         return err;
 714 #ifndef CONFIG_USER_ONLY
 715     case GDB_WATCHPOINT_WRITE:
 716     case GDB_WATCHPOINT_READ:
 717     case GDB_WATCHPOINT_ACCESS:
 718         CPU_FOREACH(cpu) {
 719             err = cpu_watchpoint_remove(cpu, addr, len,
 720                                         xlat_gdb_type(cpu, type));
 721             if (err)
 722                 break;
 723         }
 724         return err;
 725 #endif
 726     default:
 727         return -ENOSYS;
 728     }
 729 }
 730
 731 static void gdb_breakpoint_remove_all(void)
 732 {
 733     CPUState *cpu;
 734
 735     if (kvm_enabled()) {
 736         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
 737         return;
 738     }
 739
 740     CPU_FOREACH(cpu) {
 741         cpu_breakpoint_remove_all(cpu, BP_GDB);
 742 #ifndef CONFIG_USER_ONLY
 743         cpu_watchpoint_remove_all(cpu, BP_GDB);
 744 #endif
 745     }
 746 }
 747
 748 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 749 {
 750     CPUState *cpu = s->c_cpu;
 751     CPUClass *cc = CPU_GET_CLASS(cpu);
 752
 753     cpu_synchronize_state(cpu);
 754     if (cc->set_pc) {
 755         cc->set_pc(cpu, pc);
 756     }
 757 }
 758
 759 static CPUState *find_cpu(uint32_t thread_id)
 760 {
 761     CPUState *cpu;
 762
 763     CPU_FOREACH(cpu) {
 764         if (cpu_index(cpu) == thread_id) {
 765             return cpu;
 766         }
 767     }
 768
 769     return NULL;
 770 }
 771
 772 static int gdb_handle_packet(GDBState *s, const char *line_buf)
 773 {
 774     CPUState *cpu;
 775     CPUClass *cc;
 776     const char *p;
 777     uint32_t thread;
 778     int ch, reg_size, type, res;
 779     char buf[MAX_PACKET_LENGTH];
 780     uint8_t mem_buf[MAX_PACKET_LENGTH];
 781     uint8_t *registers;
 782     target_ulong addr, len;
 783
 784 #ifdef DEBUG_GDB
 785     printf("command='%s'\n", line_buf);
 786 #endif
 787     p = line_buf;
 788     ch = *p++;
 789     switch(ch) {
 790     case '?':
 791         /* TODO: Make this return the correct value for user-mode.  */
 792         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
 793                  cpu_index(s->c_cpu));
 794         put_packet(s, buf);
 795         /* Remove all the breakpoints when this query is issued,
 796          * because gdb is doing and initial connect and the state
 797          * should be cleaned up.
 798          */
 799         gdb_breakpoint_remove_all();
 800         break;
 801     case 'c':
 802         if (*p != '\0') {
 803             addr = strtoull(p, (char **)&p, 16);
 804             gdb_set_cpu_pc(s, addr);
 805         }
 806         s->signal = 0;
 807         gdb_continue(s);
 808         return RS_IDLE;
 809     case 'C':
 810         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
 811         if (s->signal == -1)
 812             s->signal = 0;
 813         gdb_continue(s);
 814         return RS_IDLE;
 815     case 'v':
 816         if (strncmp(p, "Cont", 4) == 0) {
 817             int res_signal, res_thread;
 818
 819             p += 4;
 820             if (*p == '?') {
 821                 put_packet(s, "vCont;c;C;s;S");
 822                 break;
 823             }
 824             res = 0;
 825             res_signal = 0;
 826             res_thread = 0;
 827             while (*p) {
 828                 int action, signal;
 829
 830                 if (*p++ != ';') {
 831                     res = 0;
 832                     break;
 833                 }
 834                 action = *p++;
 835                 signal = 0;
 836                 if (action == 'C' || action == 'S') {
 837                     signal = gdb_signal_to_target(strtoul(p, (char **)&p, 16));
 838                     if (signal == -1) {
 839                         signal = 0;
 840                     }
 841                 } else if (action != 'c' && action != 's') {
 842                     res = 0;
 843                     break;
 844                 }
 845                 thread = 0;
 846                 if (*p == ':') {
 847                     thread = strtoull(p+1, (char **)&p, 16);
 848                 }
 849                 action = tolower(action);
 850                 if (res == 0 || (res == 'c' && action == 's')) {
 851                     res = action;
 852                     res_signal = signal;
 853                     res_thread = thread;
 854                 }
 855             }
 856             if (res) {
 857                 if (res_thread != -1 && res_thread != 0) {
 858                     cpu = find_cpu(res_thread);
 859                     if (cpu == NULL) {
 860                         put_packet(s, "E22");
 861                         break;
 862                     }
 863                     s->c_cpu = cpu;
 864                 }
 865                 if (res == 's') {
 866                     cpu_single_step(s->c_cpu, sstep_flags);
 867                 }
 868                 s->signal = res_signal;
 869                 gdb_continue(s);
 870                 return RS_IDLE;
 871             }
 872             break;
 873         } else {
 874             goto unknown_command;
 875         }
 876     case 'k':
 877 #ifdef CONFIG_USER_ONLY
 878         /* Kill the target */
 879         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
 880         exit(0);
 881 #endif
 882     case 'D':
 883         /* Detach packet */
 884         gdb_breakpoint_remove_all();
 885         gdb_syscall_mode = GDB_SYS_DISABLED;
 886         gdb_continue(s);
 887         put_packet(s, "OK");
 888         break;
 889     case 's':
 890         if (*p != '\0') {
 891             addr = strtoull(p, (char **)&p, 16);
 892             gdb_set_cpu_pc(s, addr);
 893         }
 894         cpu_single_step(s->c_cpu, sstep_flags);
 895         gdb_continue(s);
 896         return RS_IDLE;
 897     case 'F':
 898         {
 899             target_ulong ret;
 900             target_ulong err;
 901
 902             ret = strtoull(p, (char **)&p, 16);
 903             if (*p == ',') {
 904                 p++;
 905                 err = strtoull(p, (char **)&p, 16);
 906             } else {
 907                 err = 0;
 908             }
 909             if (*p == ',')
 910                 p++;
 911             type = *p;
 912             if (s->current_syscall_cb) {
 913                 s->current_syscall_cb(s->c_cpu, ret, err);
 914                 s->current_syscall_cb = NULL;
 915             }
 916             if (type == 'C') {
 917                 put_packet(s, "T02");
 918             } else {
 919                 gdb_continue(s);
 920             }
 921         }
 922         break;
 923     case 'g':
 924         cpu_synchronize_state(s->g_cpu);
 925         len = 0;
 926         for (addr = 0; addr < s->g_cpu->gdb_num_g_regs; addr++) {
 927             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
 928             len += reg_size;
 929         }
 930         memtohex(buf, mem_buf, len);
 931         put_packet(s, buf);
 932         break;
 933     case 'G':
 934         cpu_synchronize_state(s->g_cpu);
 935         registers = mem_buf;
 936         len = strlen(p) / 2;
 937         hextomem((uint8_t *)registers, p, len);
 938         for (addr = 0; addr < s->g_cpu->gdb_num_g_regs && len > 0; addr++) {
 939             reg_size = gdb_write_register(s->g_cpu, registers, addr);
 940             len -= reg_size;
 941             registers += reg_size;
 942         }
 943         put_packet(s, "OK");
 944         break;
 945     case 'm':
 946         addr = strtoull(p, (char **)&p, 16);
 947         if (*p == ',')
 948             p++;
 949         len = strtoull(p, NULL, 16);
 950         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
 951             put_packet (s, "E14");
 952         } else {
 953             memtohex(buf, mem_buf, len);
 954             put_packet(s, buf);
 955         }
 956         break;
 957     case 'M':
 958         addr = strtoull(p, (char **)&p, 16);
 959         if (*p == ',')
 960             p++;
 961         len = strtoull(p, (char **)&p, 16);
 962         if (*p == ':')
 963             p++;
 964         hextomem(mem_buf, p, len);
 965         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
 966                                    true) != 0) {
 967             put_packet(s, "E14");
 968         } else {
 969             put_packet(s, "OK");
 970         }
 971         break;
 972     case 'p':
 973         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
 974            This works, but can be very slow.  Anything new enough to
 975            understand XML also knows how to use this properly.  */
 976         if (!gdb_has_xml)
 977             goto unknown_command;
 978         addr = strtoull(p, (char **)&p, 16);
 979         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
 980         if (reg_size) {
 981             memtohex(buf, mem_buf, reg_size);
 982             put_packet(s, buf);
 983         } else {
 984             put_packet(s, "E14");
 985         }
 986         break;
 987     case 'P':
 988         if (!gdb_has_xml)
 989             goto unknown_command;
 990         addr = strtoull(p, (char **)&p, 16);
 991         if (*p == '=')
 992             p++;
 993         reg_size = strlen(p) / 2;
 994         hextomem(mem_buf, p, reg_size);
 995         gdb_write_register(s->g_cpu, mem_buf, addr);
 996         put_packet(s, "OK");
 997         break;
 998     case 'Z':
 999     case 'z':
1000         type = strtoul(p, (char **)&p, 16);
1001         if (*p == ',')
1002             p++;
1003         addr = strtoull(p, (char **)&p, 16);
1004         if (*p == ',')
1005             p++;
1006         len = strtoull(p, (char **)&p, 16);
1007         if (ch == 'Z')
1008             res = gdb_breakpoint_insert(addr, len, type);
1009         else
1010             res = gdb_breakpoint_remove(addr, len, type);
1011         if (res >= 0)
1012              put_packet(s, "OK");
1013         else if (res == -ENOSYS)
1014             put_packet(s, "");
1015         else
1016             put_packet(s, "E22");
1017         break;
1018     case 'H':
1019         type = *p++;
1020         thread = strtoull(p, (char **)&p, 16);
1021         if (thread == -1 || thread == 0) {
1022             put_packet(s, "OK");
1023             break;
1024         }
1025         cpu = find_cpu(thread);
1026         if (cpu == NULL) {
1027             put_packet(s, "E22");
1028             break;
1029         }
1030         switch (type) {
1031         case 'c':
1032             s->c_cpu = cpu;
1033             put_packet(s, "OK");
1034             break;
1035         case 'g':
1036             s->g_cpu = cpu;
1037             put_packet(s, "OK");
1038             break;
1039         default:
1040              put_packet(s, "E22");
1041              break;
1042         }
1043         break;
1044     case 'T':
1045         thread = strtoull(p, (char **)&p, 16);
1046         cpu = find_cpu(thread);
1047
1048         if (cpu != NULL) {
1049             put_packet(s, "OK");
1050         } else {
1051             put_packet(s, "E22");
1052         }
1053         break;
1054     case 'q':
1055     case 'Q':
1056         /* parse any 'q' packets here */
1057         if (!strcmp(p,"qemu.sstepbits")) {
1058             /* Query Breakpoint bit definitions */
1059             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1060                      SSTEP_ENABLE,
1061                      SSTEP_NOIRQ,
1062                      SSTEP_NOTIMER);
1063             put_packet(s, buf);
1064             break;
1065         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1066             /* Display or change the sstep_flags */
1067             p += 10;
1068             if (*p != '=') {
1069                 /* Display current setting */
1070                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1071                 put_packet(s, buf);
1072                 break;
1073             }
1074             p++;
1075             type = strtoul(p, (char **)&p, 16);
1076             sstep_flags = type;
1077             put_packet(s, "OK");
1078             break;
1079         } else if (strcmp(p,"C") == 0) {
1080             /* "Current thread" remains vague in the spec, so always return
1081              *  the first CPU (gdb returns the first thread). */
1082             put_packet(s, "QC1");
1083             break;
1084         } else if (strcmp(p,"fThreadInfo") == 0) {
1085             s->query_cpu = first_cpu;
1086             goto report_cpuinfo;
1087         } else if (strcmp(p,"sThreadInfo") == 0) {
1088         report_cpuinfo:
1089             if (s->query_cpu) {
1090                 snprintf(buf, sizeof(buf), "m%x", cpu_index(s->query_cpu));
1091                 put_packet(s, buf);
1092                 s->query_cpu = CPU_NEXT(s->query_cpu);
1093             } else
1094                 put_packet(s, "l");
1095             break;
1096         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1097             thread = strtoull(p+16, (char **)&p, 16);
1098             cpu = find_cpu(thread);
1099             if (cpu != NULL) {
1100                 cpu_synchronize_state(cpu);
1101                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
1102                                "CPU#%d [%s]", cpu->cpu_index,
1103                                cpu->halted ? "halted " : "running");
1104                 memtohex(buf, mem_buf, len);
1105                 put_packet(s, buf);
1106             }
1107             break;
1108         }
1109 #ifdef CONFIG_USER_ONLY
1110         else if (strncmp(p, "Offsets", 7) == 0) {
1111             TaskState *ts = s->c_cpu->opaque;
1112
1113             snprintf(buf, sizeof(buf),
1114                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1115                      ";Bss=" TARGET_ABI_FMT_lx,
1116                      ts->info->code_offset,
1117                      ts->info->data_offset,
1118                      ts->info->data_offset);
1119             put_packet(s, buf);
1120             break;
1121         }
1122 #else /* !CONFIG_USER_ONLY */
1123         else if (strncmp(p, "Rcmd,", 5) == 0) {
1124             int len = strlen(p + 5);
1125
1126             if ((len % 2) != 0) {
1127                 put_packet(s, "E01");
1128                 break;
1129             }
1130             hextomem(mem_buf, p + 5, len);
1131             len = len / 2;
1132             mem_buf[len++] = 0;
1133             qemu_chr_be_write(s->mon_chr, mem_buf, len);
1134             put_packet(s, "OK");
1135             break;
1136         }
1137 #endif /* !CONFIG_USER_ONLY */
1138         if (strncmp(p, "Supported", 9) == 0) {
1139             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1140             cc = CPU_GET_CLASS(first_cpu);
1141             if (cc->gdb_core_xml_file != NULL) {
1142                 pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1143             }
1144             put_packet(s, buf);
1145             break;
1146         }
1147         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1148             const char *xml;
1149             target_ulong total_len;
1150
1151             cc = CPU_GET_CLASS(first_cpu);
1152             if (cc->gdb_core_xml_file == NULL) {
1153                 goto unknown_command;
1154             }
1155
1156             gdb_has_xml = true;
1157             p += 19;
1158             xml = get_feature_xml(p, &p, cc);
1159             if (!xml) {
1160                 snprintf(buf, sizeof(buf), "E00");
1161                 put_packet(s, buf);
1162                 break;
1163             }
1164
1165             if (*p == ':')
1166                 p++;
1167             addr = strtoul(p, (char **)&p, 16);
1168             if (*p == ',')
1169                 p++;
1170             len = strtoul(p, (char **)&p, 16);
1171
1172             total_len = strlen(xml);
1173             if (addr > total_len) {
1174                 snprintf(buf, sizeof(buf), "E00");
1175                 put_packet(s, buf);
1176                 break;
1177             }
1178             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1179                 len = (MAX_PACKET_LENGTH - 5) / 2;
1180             if (len < total_len - addr) {
1181                 buf[0] = 'm';
1182                 len = memtox(buf + 1, xml + addr, len);
1183             } else {
1184                 buf[0] = 'l';
1185                 len = memtox(buf + 1, xml + addr, total_len - addr);
1186             }
1187             put_packet_binary(s, buf, len + 1);
1188             break;
1189         }
1190         /* Unrecognised 'q' command.  */
1191         goto unknown_command;
1192
1193     default:
1194     unknown_command:
1195         /* put empty packet */
1196         buf[0] = '\0';
1197         put_packet(s, buf);
1198         break;
1199     }
1200     return RS_IDLE;
1201 }
1202
1203 void gdb_set_stop_cpu(CPUState *cpu)
1204 {
1205     gdbserver_state->c_cpu = cpu;
1206     gdbserver_state->g_cpu = cpu;
1207 }
1208
1209 #ifndef CONFIG_USER_ONLY
1210 static void gdb_vm_state_change(void *opaque, int running, RunState state)
1211 {
1212     GDBState *s = gdbserver_state;
1213     CPUArchState *env = s->c_cpu->env_ptr;
1214     CPUState *cpu = s->c_cpu;
1215     char buf[256];
1216     const char *type;
1217     int ret;
1218
1219     if (running || s->state == RS_INACTIVE) {
1220         return;
1221     }
1222     /* Is there a GDB syscall waiting to be sent?  */
1223     if (s->current_syscall_cb) {
1224         put_packet(s, s->syscall_buf);
1225         return;
1226     }
1227     switch (state) {
1228     case RUN_STATE_DEBUG:
1229         if (cpu->watchpoint_hit) {
1230             switch (cpu->watchpoint_hit->flags & BP_MEM_ACCESS) {
1231             case BP_MEM_READ:
1232                 type = "r";
1233                 break;
1234             case BP_MEM_ACCESS:
1235                 type = "a";
1236                 break;
1237             default:
1238                 type = "";
1239                 break;
1240             }
1241             snprintf(buf, sizeof(buf),
1242                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1243                      GDB_SIGNAL_TRAP, cpu_index(cpu), type,
1244                      (target_ulong)cpu->watchpoint_hit->vaddr);
1245             cpu->watchpoint_hit = NULL;
1246             goto send_packet;
1247         }
1248         tb_flush(env);
1249         ret = GDB_SIGNAL_TRAP;
1250         break;
1251     case RUN_STATE_PAUSED:
1252         ret = GDB_SIGNAL_INT;
1253         break;
1254     case RUN_STATE_SHUTDOWN:
1255         ret = GDB_SIGNAL_QUIT;
1256         break;
1257     case RUN_STATE_IO_ERROR:
1258         ret = GDB_SIGNAL_IO;
1259         break;
1260     case RUN_STATE_WATCHDOG:
1261         ret = GDB_SIGNAL_ALRM;
1262         break;
1263     case RUN_STATE_INTERNAL_ERROR:
1264         ret = GDB_SIGNAL_ABRT;
1265         break;
1266     case RUN_STATE_SAVE_VM:
1267     case RUN_STATE_RESTORE_VM:
1268         return;
1269     case RUN_STATE_FINISH_MIGRATE:
1270         ret = GDB_SIGNAL_XCPU;
1271         break;
1272     default:
1273         ret = GDB_SIGNAL_UNKNOWN;
1274         break;
1275     }
1276     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, cpu_index(cpu));
1277
1278 send_packet:
1279     put_packet(s, buf);
1280
1281     /* disable single step if it was enabled */
1282     cpu_single_step(cpu, 0);
1283 }
1284 #endif
1285
1286 /* Send a gdb syscall request.
1287    This accepts limited printf-style format specifiers, specifically:
1288     %x  - target_ulong argument printed in hex.
1289     %lx - 64-bit argument printed in hex.
1290     %s  - string pointer (target_ulong) and length (int) pair.  */
1291 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1292 {
1293     va_list va;
1294     char *p;
1295     char *p_end;
1296     target_ulong addr;
1297     uint64_t i64;
1298     GDBState *s;
1299
1300     s = gdbserver_state;
1301     if (!s)
1302         return;
1303     s->current_syscall_cb = cb;
1304 #ifndef CONFIG_USER_ONLY
1305     vm_stop(RUN_STATE_DEBUG);
1306 #endif
1307     va_start(va, fmt);
1308     p = s->syscall_buf;
1309     p_end = &s->syscall_buf[sizeof(s->syscall_buf)];
1310     *(p++) = 'F';
1311     while (*fmt) {
1312         if (*fmt == '%') {
1313             fmt++;
1314             switch (*fmt++) {
1315             case 'x':
1316                 addr = va_arg(va, target_ulong);
1317                 p += snprintf(p, p_end - p, TARGET_FMT_lx, addr);
1318                 break;
1319             case 'l':
1320                 if (*(fmt++) != 'x')
1321                     goto bad_format;
1322                 i64 = va_arg(va, uint64_t);
1323                 p += snprintf(p, p_end - p, "%" PRIx64, i64);
1324                 break;
1325             case 's':
1326                 addr = va_arg(va, target_ulong);
1327                 p += snprintf(p, p_end - p, TARGET_FMT_lx "/%x",
1328                               addr, va_arg(va, int));
1329                 break;
1330             default:
1331             bad_format:
1332                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
1333                         fmt - 1);
1334                 break;
1335             }
1336         } else {
1337             *(p++) = *(fmt++);
1338         }
1339     }
1340     *p = 0;
1341     va_end(va);
1342 #ifdef CONFIG_USER_ONLY
1343     put_packet(s, s->syscall_buf);
1344     gdb_handlesig(s->c_cpu, 0);
1345 #else
1346     /* In this case wait to send the syscall packet until notification that
1347        the CPU has stopped.  This must be done because if the packet is sent
1348        now the reply from the syscall request could be received while the CPU
1349        is still in the running state, which can cause packets to be dropped
1350        and state transition 'T' packets to be sent while the syscall is still
1351        being processed.  */
1352     cpu_exit(s->c_cpu);
1353 #endif
1354 }
1355
1356 static void gdb_read_byte(GDBState *s, int ch)
1357 {
1358     int i, csum;
1359     uint8_t reply;
1360
1361 #ifndef CONFIG_USER_ONLY
1362     if (s->last_packet_len) {
1363         /* Waiting for a response to the last packet.  If we see the start
1364            of a new command then abandon the previous response.  */
1365         if (ch == '-') {
1366 #ifdef DEBUG_GDB
1367             printf("Got NACK, retransmitting\n");
1368 #endif
1369             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
1370         }
1371 #ifdef DEBUG_GDB
1372         else if (ch == '+')
1373             printf("Got ACK\n");
1374         else
1375             printf("Got '%c' when expecting ACK/NACK\n", ch);
1376 #endif
1377         if (ch == '+' || ch == '$')
1378             s->last_packet_len = 0;
1379         if (ch != '$')
1380             return;
1381     }
1382     if (runstate_is_running()) {
1383         /* when the CPU is running, we cannot do anything except stop
1384            it when receiving a char */
1385         vm_stop(RUN_STATE_PAUSED);
1386     } else
1387 #endif
1388     {
1389         switch(s->state) {
1390         case RS_IDLE:
1391             if (ch == '$') {
1392                 s->line_buf_index = 0;
1393                 s->state = RS_GETLINE;
1394             }
1395             break;
1396         case RS_GETLINE:
1397             if (ch == '#') {
1398             s->state = RS_CHKSUM1;
1399             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1400                 s->state = RS_IDLE;
1401             } else {
1402             s->line_buf[s->line_buf_index++] = ch;
1403             }
1404             break;
1405         case RS_CHKSUM1:
1406             s->line_buf[s->line_buf_index] = '\0';
1407             s->line_csum = fromhex(ch) << 4;
1408             s->state = RS_CHKSUM2;
1409             break;
1410         case RS_CHKSUM2:
1411             s->line_csum |= fromhex(ch);
1412             csum = 0;
1413             for(i = 0; i < s->line_buf_index; i++) {
1414                 csum += s->line_buf[i];
1415             }
1416             if (s->line_csum != (csum & 0xff)) {
1417                 reply = '-';
1418                 put_buffer(s, &reply, 1);
1419                 s->state = RS_IDLE;
1420             } else {
1421                 reply = '+';
1422                 put_buffer(s, &reply, 1);
1423                 s->state = gdb_handle_packet(s, s->line_buf);
1424             }
1425             break;
1426         default:
1427             abort();
1428         }
1429     }
1430 }
1431
1432 /* Tell the remote gdb that the process has exited.  */
1433 void gdb_exit(CPUArchState *env, int code)
1434 {
1435   GDBState *s;
1436   char buf[4];
1437
1438   s = gdbserver_state;
1439   if (!s) {
1440       return;
1441   }
1442 #ifdef CONFIG_USER_ONLY
1443   if (gdbserver_fd < 0 || s->fd < 0) {
1444       return;
1445   }
1446 #endif
1447
1448   snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
1449   put_packet(s, buf);
1450
1451 #ifndef CONFIG_USER_ONLY
1452   if (s->chr) {
1453       qemu_chr_delete(s->chr);
1454   }
1455 #endif
1456 }
1457
1458 #ifdef CONFIG_USER_ONLY
1459 int
1460 gdb_queuesig (void)
1461 {
1462     GDBState *s;
1463
1464     s = gdbserver_state;
1465
1466     if (gdbserver_fd < 0 || s->fd < 0)
1467         return 0;
1468     else
1469         return 1;
1470 }
1471
1472 int
1473 gdb_handlesig(CPUState *cpu, int sig)
1474 {
1475     CPUArchState *env = cpu->env_ptr;
1476     GDBState *s;
1477     char buf[256];
1478     int n;
1479
1480     s = gdbserver_state;
1481     if (gdbserver_fd < 0 || s->fd < 0) {
1482         return sig;
1483     }
1484
1485     /* disable single step if it was enabled */
1486     cpu_single_step(cpu, 0);
1487     tb_flush(env);
1488
1489     if (sig != 0) {
1490         snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));
1491         put_packet(s, buf);
1492     }
1493     /* put_packet() might have detected that the peer terminated the
1494        connection.  */
1495     if (s->fd < 0) {
1496         return sig;
1497     }
1498
1499     sig = 0;
1500     s->state = RS_IDLE;
1501     s->running_state = 0;
1502     while (s->running_state == 0) {
1503         n = read(s->fd, buf, 256);
1504         if (n > 0) {
1505             int i;
1506
1507             for (i = 0; i < n; i++) {
1508                 gdb_read_byte(s, buf[i]);
1509             }
1510         } else if (n == 0 || errno != EAGAIN) {
1511             /* XXX: Connection closed.  Should probably wait for another
1512                connection before continuing.  */
1513             return sig;
1514         }
1515     }
1516     sig = s->signal;
1517     s->signal = 0;
1518     return sig;
1519 }
1520
1521 /* Tell the remote gdb that the process has exited due to SIG.  */
1522 void gdb_signalled(CPUArchState *env, int sig)
1523 {
1524     GDBState *s;
1525     char buf[4];
1526
1527     s = gdbserver_state;
1528     if (gdbserver_fd < 0 || s->fd < 0) {
1529         return;
1530     }
1531
1532     snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb(sig));
1533     put_packet(s, buf);
1534 }
1535
1536 static void gdb_accept(void)
1537 {
1538     GDBState *s;
1539     struct sockaddr_in sockaddr;
1540     socklen_t len;
1541     int fd;
1542
1543     for(;;) {
1544         len = sizeof(sockaddr);
1545         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
1546         if (fd < 0 && errno != EINTR) {
1547             perror("accept");
1548             return;
1549         } else if (fd >= 0) {
1550 #ifndef _WIN32
1551             fcntl(fd, F_SETFD, FD_CLOEXEC);
1552 #endif
1553             break;
1554         }
1555     }
1556
1557     /* set short latency */
1558     socket_set_nodelay(fd);
1559
1560     s = g_malloc0(sizeof(GDBState));
1561     s->c_cpu = first_cpu;
1562     s->g_cpu = first_cpu;
1563     s->fd = fd;
1564     gdb_has_xml = false;
1565
1566     gdbserver_state = s;
1567
1568     fcntl(fd, F_SETFL, O_NONBLOCK);
1569 }
1570
1571 static int gdbserver_open(int port)
1572 {
1573     struct sockaddr_in sockaddr;
1574     int fd, ret;
1575
1576     fd = socket(PF_INET, SOCK_STREAM, 0);
1577     if (fd < 0) {
1578         perror("socket");
1579         return -1;
1580     }
1581 #ifndef _WIN32
1582     fcntl(fd, F_SETFD, FD_CLOEXEC);
1583 #endif
1584
1585     socket_set_fast_reuse(fd);
1586
1587     sockaddr.sin_family = AF_INET;
1588     sockaddr.sin_port = htons(port);
1589     sockaddr.sin_addr.s_addr = 0;
1590     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
1591     if (ret < 0) {
1592         perror("bind");
1593         close(fd);
1594         return -1;
1595     }
1596     ret = listen(fd, 0);
1597     if (ret < 0) {
1598         perror("listen");
1599         close(fd);
1600         return -1;
1601     }
1602     return fd;
1603 }
1604
1605 int gdbserver_start(int port)
1606 {
1607     gdbserver_fd = gdbserver_open(port);
1608     if (gdbserver_fd < 0)
1609         return -1;
1610     /* accept connections */
1611     gdb_accept();
1612     return 0;
1613 }
1614
1615 /* Disable gdb stub for child processes.  */
1616 void gdbserver_fork(CPUArchState *env)
1617 {
1618     CPUState *cpu = ENV_GET_CPU(env);
1619     GDBState *s = gdbserver_state;
1620
1621     if (gdbserver_fd < 0 || s->fd < 0) {
1622         return;
1623     }
1624     close(s->fd);
1625     s->fd = -1;
1626     cpu_breakpoint_remove_all(cpu, BP_GDB);
1627     cpu_watchpoint_remove_all(cpu, BP_GDB);
1628 }
1629 #else
1630 static int gdb_chr_can_receive(void *opaque)
1631 {
1632   /* We can handle an arbitrarily large amount of data.
1633    Pick the maximum packet size, which is as good as anything.  */
1634   return MAX_PACKET_LENGTH;
1635 }
1636
1637 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
1638 {
1639     int i;
1640
1641     for (i = 0; i < size; i++) {
1642         gdb_read_byte(gdbserver_state, buf[i]);
1643     }
1644 }
1645
1646 static void gdb_chr_event(void *opaque, int event)
1647 {
1648     switch (event) {
1649     case CHR_EVENT_OPENED:
1650         vm_stop(RUN_STATE_PAUSED);
1651         gdb_has_xml = false;
1652         break;
1653     default:
1654         break;
1655     }
1656 }
1657
1658 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
1659 {
1660     char buf[MAX_PACKET_LENGTH];
1661
1662     buf[0] = 'O';
1663     if (len > (MAX_PACKET_LENGTH/2) - 1)
1664         len = (MAX_PACKET_LENGTH/2) - 1;
1665     memtohex(buf + 1, (uint8_t *)msg, len);
1666     put_packet(s, buf);
1667 }
1668
1669 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
1670 {
1671     const char *p = (const char *)buf;
1672     int max_sz;
1673
1674     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
1675     for (;;) {
1676         if (len <= max_sz) {
1677             gdb_monitor_output(gdbserver_state, p, len);
1678             break;
1679         }
1680         gdb_monitor_output(gdbserver_state, p, max_sz);
1681         p += max_sz;
1682         len -= max_sz;
1683     }
1684     return len;
1685 }
1686
1687 #ifndef _WIN32
1688 static void gdb_sigterm_handler(int signal)
1689 {
1690     if (runstate_is_running()) {
1691         vm_stop(RUN_STATE_PAUSED);
1692     }
1693 }
1694 #endif
1695
1696 int gdbserver_start(const char *device)
1697 {
1698     GDBState *s;
1699     char gdbstub_device_name[128];
1700     CharDriverState *chr = NULL;
1701     CharDriverState *mon_chr;
1702
1703     if (!device)
1704         return -1;
1705     if (strcmp(device, "none") != 0) {
1706         if (strstart(device, "tcp:", NULL)) {
1707             /* enforce required TCP attributes */
1708             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
1709                      "%s,nowait,nodelay,server", device);
1710             device = gdbstub_device_name;
1711         }
1712 #ifndef _WIN32
1713         else if (strcmp(device, "stdio") == 0) {
1714             struct sigaction act;
1715
1716             memset(&act, 0, sizeof(act));
1717             act.sa_handler = gdb_sigterm_handler;
1718             sigaction(SIGINT, &act, NULL);
1719         }
1720 #endif
1721         chr = qemu_chr_new("gdb", device, NULL);
1722         if (!chr)
1723             return -1;
1724
1725         qemu_chr_fe_claim_no_fail(chr);
1726         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
1727                               gdb_chr_event, NULL);
1728     }
1729
1730     s = gdbserver_state;
1731     if (!s) {
1732         s = g_malloc0(sizeof(GDBState));
1733         gdbserver_state = s;
1734
1735         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
1736
1737         /* Initialize a monitor terminal for gdb */
1738         mon_chr = qemu_chr_alloc();
1739         mon_chr->chr_write = gdb_monitor_write;
1740         monitor_init(mon_chr, 0);
1741     } else {
1742         if (s->chr)
1743             qemu_chr_delete(s->chr);
1744         mon_chr = s->mon_chr;
1745         memset(s, 0, sizeof(GDBState));
1746     }
1747     s->c_cpu = first_cpu;
1748     s->g_cpu = first_cpu;
1749     s->chr = chr;
1750     s->state = chr ? RS_IDLE : RS_INACTIVE;
1751     s->mon_chr = mon_chr;
1752     s->current_syscall_cb = NULL;
1753
1754     return 0;
1755 }
1756 #endif