gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "qemu-common.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "monitor/monitor.h"
  33 #include "sysemu/char.h"
  34 #include "sysemu/sysemu.h"
  35 #include "exec/gdbstub.h"
  36 #endif
  37
  38 #define MAX_PACKET_LENGTH 4096
  39
  40 #include "cpu.h"
  41 #include "qemu/sockets.h"
  42 #include "sysemu/kvm.h"
  43
  44 static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
  45                                          uint8_t *buf, int len, bool is_write)
  46 {
  47     CPUClass *cc = CPU_GET_CLASS(cpu);
  48
  49     if (cc->memory_rw_debug) {
  50         return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
  51     }
  52     return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
  53 }
  54
  55 enum {
  56     GDB_SIGNAL_0 = 0,
  57     GDB_SIGNAL_INT = 2,
  58     GDB_SIGNAL_QUIT = 3,
  59     GDB_SIGNAL_TRAP = 5,
  60     GDB_SIGNAL_ABRT = 6,
  61     GDB_SIGNAL_ALRM = 14,
  62     GDB_SIGNAL_IO = 23,
  63     GDB_SIGNAL_XCPU = 24,
  64     GDB_SIGNAL_UNKNOWN = 143
  65 };
  66
  67 #ifdef CONFIG_USER_ONLY
  68
  69 /* Map target signal numbers to GDB protocol signal numbers and vice
  70  * versa.  For user emulation's currently supported systems, we can
  71  * assume most signals are defined.
  72  */
  73
  74 static int gdb_signal_table[] = {
  75     0,
  76     TARGET_SIGHUP,
  77     TARGET_SIGINT,
  78     TARGET_SIGQUIT,
  79     TARGET_SIGILL,
  80     TARGET_SIGTRAP,
  81     TARGET_SIGABRT,
  82     -1, /* SIGEMT */
  83     TARGET_SIGFPE,
  84     TARGET_SIGKILL,
  85     TARGET_SIGBUS,
  86     TARGET_SIGSEGV,
  87     TARGET_SIGSYS,
  88     TARGET_SIGPIPE,
  89     TARGET_SIGALRM,
  90     TARGET_SIGTERM,
  91     TARGET_SIGURG,
  92     TARGET_SIGSTOP,
  93     TARGET_SIGTSTP,
  94     TARGET_SIGCONT,
  95     TARGET_SIGCHLD,
  96     TARGET_SIGTTIN,
  97     TARGET_SIGTTOU,
  98     TARGET_SIGIO,
  99     TARGET_SIGXCPU,
 100     TARGET_SIGXFSZ,
 101     TARGET_SIGVTALRM,
 102     TARGET_SIGPROF,
 103     TARGET_SIGWINCH,
 104     -1, /* SIGLOST */
 105     TARGET_SIGUSR1,
 106     TARGET_SIGUSR2,
 107 #ifdef TARGET_SIGPWR
 108     TARGET_SIGPWR,
 109 #else
 110     -1,
 111 #endif
 112     -1, /* SIGPOLL */
 113     -1,
 114     -1,
 115     -1,
 116     -1,
 117     -1,
 118     -1,
 119     -1,
 120     -1,
 121     -1,
 122     -1,
 123     -1,
 124 #ifdef __SIGRTMIN
 125     __SIGRTMIN + 1,
 126     __SIGRTMIN + 2,
 127     __SIGRTMIN + 3,
 128     __SIGRTMIN + 4,
 129     __SIGRTMIN + 5,
 130     __SIGRTMIN + 6,
 131     __SIGRTMIN + 7,
 132     __SIGRTMIN + 8,
 133     __SIGRTMIN + 9,
 134     __SIGRTMIN + 10,
 135     __SIGRTMIN + 11,
 136     __SIGRTMIN + 12,
 137     __SIGRTMIN + 13,
 138     __SIGRTMIN + 14,
 139     __SIGRTMIN + 15,
 140     __SIGRTMIN + 16,
 141     __SIGRTMIN + 17,
 142     __SIGRTMIN + 18,
 143     __SIGRTMIN + 19,
 144     __SIGRTMIN + 20,
 145     __SIGRTMIN + 21,
 146     __SIGRTMIN + 22,
 147     __SIGRTMIN + 23,
 148     __SIGRTMIN + 24,
 149     __SIGRTMIN + 25,
 150     __SIGRTMIN + 26,
 151     __SIGRTMIN + 27,
 152     __SIGRTMIN + 28,
 153     __SIGRTMIN + 29,
 154     __SIGRTMIN + 30,
 155     __SIGRTMIN + 31,
 156     -1, /* SIGCANCEL */
 157     __SIGRTMIN,
 158     __SIGRTMIN + 32,
 159     __SIGRTMIN + 33,
 160     __SIGRTMIN + 34,
 161     __SIGRTMIN + 35,
 162     __SIGRTMIN + 36,
 163     __SIGRTMIN + 37,
 164     __SIGRTMIN + 38,
 165     __SIGRTMIN + 39,
 166     __SIGRTMIN + 40,
 167     __SIGRTMIN + 41,
 168     __SIGRTMIN + 42,
 169     __SIGRTMIN + 43,
 170     __SIGRTMIN + 44,
 171     __SIGRTMIN + 45,
 172     __SIGRTMIN + 46,
 173     __SIGRTMIN + 47,
 174     __SIGRTMIN + 48,
 175     __SIGRTMIN + 49,
 176     __SIGRTMIN + 50,
 177     __SIGRTMIN + 51,
 178     __SIGRTMIN + 52,
 179     __SIGRTMIN + 53,
 180     __SIGRTMIN + 54,
 181     __SIGRTMIN + 55,
 182     __SIGRTMIN + 56,
 183     __SIGRTMIN + 57,
 184     __SIGRTMIN + 58,
 185     __SIGRTMIN + 59,
 186     __SIGRTMIN + 60,
 187     __SIGRTMIN + 61,
 188     __SIGRTMIN + 62,
 189     __SIGRTMIN + 63,
 190     __SIGRTMIN + 64,
 191     __SIGRTMIN + 65,
 192     __SIGRTMIN + 66,
 193     __SIGRTMIN + 67,
 194     __SIGRTMIN + 68,
 195     __SIGRTMIN + 69,
 196     __SIGRTMIN + 70,
 197     __SIGRTMIN + 71,
 198     __SIGRTMIN + 72,
 199     __SIGRTMIN + 73,
 200     __SIGRTMIN + 74,
 201     __SIGRTMIN + 75,
 202     __SIGRTMIN + 76,
 203     __SIGRTMIN + 77,
 204     __SIGRTMIN + 78,
 205     __SIGRTMIN + 79,
 206     __SIGRTMIN + 80,
 207     __SIGRTMIN + 81,
 208     __SIGRTMIN + 82,
 209     __SIGRTMIN + 83,
 210     __SIGRTMIN + 84,
 211     __SIGRTMIN + 85,
 212     __SIGRTMIN + 86,
 213     __SIGRTMIN + 87,
 214     __SIGRTMIN + 88,
 215     __SIGRTMIN + 89,
 216     __SIGRTMIN + 90,
 217     __SIGRTMIN + 91,
 218     __SIGRTMIN + 92,
 219     __SIGRTMIN + 93,
 220     __SIGRTMIN + 94,
 221     __SIGRTMIN + 95,
 222     -1, /* SIGINFO */
 223     -1, /* UNKNOWN */
 224     -1, /* DEFAULT */
 225     -1,
 226     -1,
 227     -1,
 228     -1,
 229     -1,
 230     -1
 231 #endif
 232 };
 233 #else
 234 /* In system mode we only need SIGINT and SIGTRAP; other signals
 235    are not yet supported.  */
 236
 237 enum {
 238     TARGET_SIGINT = 2,
 239     TARGET_SIGTRAP = 5
 240 };
 241
 242 static int gdb_signal_table[] = {
 243     -1,
 244     -1,
 245     TARGET_SIGINT,
 246     -1,
 247     -1,
 248     TARGET_SIGTRAP
 249 };
 250 #endif
 251
 252 #ifdef CONFIG_USER_ONLY
 253 static int target_signal_to_gdb (int sig)
 254 {
 255     int i;
 256     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 257         if (gdb_signal_table[i] == sig)
 258             return i;
 259     return GDB_SIGNAL_UNKNOWN;
 260 }
 261 #endif
 262
 263 static int gdb_signal_to_target (int sig)
 264 {
 265     if (sig < ARRAY_SIZE (gdb_signal_table))
 266         return gdb_signal_table[sig];
 267     else
 268         return -1;
 269 }
 270
 271 //#define DEBUG_GDB
 272
 273 typedef struct GDBRegisterState {
 274     int base_reg;
 275     int num_regs;
 276     gdb_reg_cb get_reg;
 277     gdb_reg_cb set_reg;
 278     const char *xml;
 279     struct GDBRegisterState *next;
 280 } GDBRegisterState;
 281
 282 enum RSState {
 283     RS_INACTIVE,
 284     RS_IDLE,
 285     RS_GETLINE,
 286     RS_CHKSUM1,
 287     RS_CHKSUM2,
 288 };
 289 typedef struct GDBState {
 290     CPUState *c_cpu; /* current CPU for step/continue ops */
 291     CPUState *g_cpu; /* current CPU for other ops */
 292     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 293     enum RSState state; /* parsing state */
 294     char line_buf[MAX_PACKET_LENGTH];
 295     int line_buf_index;
 296     int line_csum;
 297     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 298     int last_packet_len;
 299     int signal;
 300 #ifdef CONFIG_USER_ONLY
 301     int fd;
 302     int running_state;
 303 #else
 304     CharDriverState *chr;
 305     CharDriverState *mon_chr;
 306 #endif
 307     char syscall_buf[256];
 308     gdb_syscall_complete_cb current_syscall_cb;
 309 } GDBState;
 310
 311 /* By default use no IRQs and no timers while single stepping so as to
 312  * make single stepping like an ICE HW step.
 313  */
 314 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 315
 316 static GDBState *gdbserver_state;
 317
 318 bool gdb_has_xml;
 319
 320 #ifdef CONFIG_USER_ONLY
 321 /* XXX: This is not thread safe.  Do we care?  */
 322 static int gdbserver_fd = -1;
 323
 324 static int get_char(GDBState *s)
 325 {
 326     uint8_t ch;
 327     int ret;
 328
 329     for(;;) {
 330         ret = qemu_recv(s->fd, &ch, 1, 0);
 331         if (ret < 0) {
 332             if (errno == ECONNRESET)
 333                 s->fd = -1;
 334             if (errno != EINTR && errno != EAGAIN)
 335                 return -1;
 336         } else if (ret == 0) {
 337             close(s->fd);
 338             s->fd = -1;
 339             return -1;
 340         } else {
 341             break;
 342         }
 343     }
 344     return ch;
 345 }
 346 #endif
 347
 348 static enum {
 349     GDB_SYS_UNKNOWN,
 350     GDB_SYS_ENABLED,
 351     GDB_SYS_DISABLED,
 352 } gdb_syscall_mode;
 353
 354 /* If gdb is connected when the first semihosting syscall occurs then use
 355    remote gdb syscalls.  Otherwise use native file IO.  */
 356 int use_gdb_syscalls(void)
 357 {
 358     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 359         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 360                                             : GDB_SYS_DISABLED);
 361     }
 362     return gdb_syscall_mode == GDB_SYS_ENABLED;
 363 }
 364
 365 /* Resume execution.  */
 366 static inline void gdb_continue(GDBState *s)
 367 {
 368 #ifdef CONFIG_USER_ONLY
 369     s->running_state = 1;
 370 #else
 371     if (runstate_check(RUN_STATE_GUEST_PANICKED)) {
 372         runstate_set(RUN_STATE_DEBUG);
 373     }
 374     if (!runstate_needs_reset()) {
 375         vm_start();
 376     }
 377 #endif
 378 }
 379
 380 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 381 {
 382 #ifdef CONFIG_USER_ONLY
 383     int ret;
 384
 385     while (len > 0) {
 386         ret = send(s->fd, buf, len, 0);
 387         if (ret < 0) {
 388             if (errno != EINTR && errno != EAGAIN)
 389                 return;
 390         } else {
 391             buf += ret;
 392             len -= ret;
 393         }
 394     }
 395 #else
 396     qemu_chr_fe_write(s->chr, buf, len);
 397 #endif
 398 }
 399
 400 static inline int fromhex(int v)
 401 {
 402     if (v >= '0' && v <= '9')
 403         return v - '0';
 404     else if (v >= 'A' && v <= 'F')
 405         return v - 'A' + 10;
 406     else if (v >= 'a' && v <= 'f')
 407         return v - 'a' + 10;
 408     else
 409         return 0;
 410 }
 411
 412 static inline int tohex(int v)
 413 {
 414     if (v < 10)
 415         return v + '0';
 416     else
 417         return v - 10 + 'a';
 418 }
 419
 420 static void memtohex(char *buf, const uint8_t *mem, int len)
 421 {
 422     int i, c;
 423     char *q;
 424     q = buf;
 425     for(i = 0; i < len; i++) {
 426         c = mem[i];
 427         *q++ = tohex(c >> 4);
 428         *q++ = tohex(c & 0xf);
 429     }
 430     *q = '\0';
 431 }
 432
 433 static void hextomem(uint8_t *mem, const char *buf, int len)
 434 {
 435     int i;
 436
 437     for(i = 0; i < len; i++) {
 438         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 439         buf += 2;
 440     }
 441 }
 442
 443 /* return -1 if error, 0 if OK */
 444 static int put_packet_binary(GDBState *s, const char *buf, int len)
 445 {
 446     int csum, i;
 447     uint8_t *p;
 448
 449     for(;;) {
 450         p = s->last_packet;
 451         *(p++) = '$';
 452         memcpy(p, buf, len);
 453         p += len;
 454         csum = 0;
 455         for(i = 0; i < len; i++) {
 456             csum += buf[i];
 457         }
 458         *(p++) = '#';
 459         *(p++) = tohex((csum >> 4) & 0xf);
 460         *(p++) = tohex((csum) & 0xf);
 461
 462         s->last_packet_len = p - s->last_packet;
 463         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 464
 465 #ifdef CONFIG_USER_ONLY
 466         i = get_char(s);
 467         if (i < 0)
 468             return -1;
 469         if (i == '+')
 470             break;
 471 #else
 472         break;
 473 #endif
 474     }
 475     return 0;
 476 }
 477
 478 /* return -1 if error, 0 if OK */
 479 static int put_packet(GDBState *s, const char *buf)
 480 {
 481 #ifdef DEBUG_GDB
 482     printf("reply='%s'\n", buf);
 483 #endif
 484
 485     return put_packet_binary(s, buf, strlen(buf));
 486 }
 487
 488 #if defined(TARGET_PPC)
 489
 490 #if defined (TARGET_PPC64)
 491 #define GDB_CORE_XML "power64-core.xml"
 492 #else
 493 #define GDB_CORE_XML "power-core.xml"
 494 #endif
 495
 496 #elif defined (TARGET_ARM)
 497
 498 #define GDB_CORE_XML "arm-core.xml"
 499
 500 #elif defined (TARGET_M68K)
 501
 502 #define GDB_CORE_XML "cf-core.xml"
 503
 504 #endif
 505
 506 #ifdef GDB_CORE_XML
 507 /* Encode data using the encoding for 'x' packets.  */
 508 static int memtox(char *buf, const char *mem, int len)
 509 {
 510     char *p = buf;
 511     char c;
 512
 513     while (len--) {
 514         c = *(mem++);
 515         switch (c) {
 516         case '#': case '$': case '*': case '}':
 517             *(p++) = '}';
 518             *(p++) = c ^ 0x20;
 519             break;
 520         default:
 521             *(p++) = c;
 522             break;
 523         }
 524     }
 525     return p - buf;
 526 }
 527
 528 static const char *get_feature_xml(const char *p, const char **newp)
 529 {
 530     size_t len;
 531     int i;
 532     const char *name;
 533     static char target_xml[1024];
 534
 535     len = 0;
 536     while (p[len] && p[len] != ':')
 537         len++;
 538     *newp = p + len;
 539
 540     name = NULL;
 541     if (strncmp(p, "target.xml", len) == 0) {
 542         /* Generate the XML description for this CPU.  */
 543         if (!target_xml[0]) {
 544             GDBRegisterState *r;
 545             CPUState *cpu = first_cpu;
 546
 547             snprintf(target_xml, sizeof(target_xml),
 548                      "<?xml version=\"1.0\"?>"
 549                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
 550                      "<target>"
 551                      "<xi:include href=\"%s\"/>",
 552                      GDB_CORE_XML);
 553
 554             for (r = cpu->gdb_regs; r; r = r->next) {
 555                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
 556                 pstrcat(target_xml, sizeof(target_xml), r->xml);
 557                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
 558             }
 559             pstrcat(target_xml, sizeof(target_xml), "</target>");
 560         }
 561         return target_xml;
 562     }
 563     for (i = 0; ; i++) {
 564         name = xml_builtin[i][0];
 565         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
 566             break;
 567     }
 568     return name ? xml_builtin[i][1] : NULL;
 569 }
 570 #endif
 571
 572 static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 573 {
 574     CPUClass *cc = CPU_GET_CLASS(cpu);
 575     CPUArchState *env = cpu->env_ptr;
 576     GDBRegisterState *r;
 577
 578     if (reg < cc->gdb_num_core_regs) {
 579         return cc->gdb_read_register(cpu, mem_buf, reg);
 580     }
 581
 582     for (r = cpu->gdb_regs; r; r = r->next) {
 583         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 584             return r->get_reg(env, mem_buf, reg - r->base_reg);
 585         }
 586     }
 587     return 0;
 588 }
 589
 590 static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 591 {
 592     CPUClass *cc = CPU_GET_CLASS(cpu);
 593     CPUArchState *env = cpu->env_ptr;
 594     GDBRegisterState *r;
 595
 596     if (reg < cc->gdb_num_core_regs) {
 597         return cc->gdb_write_register(cpu, mem_buf, reg);
 598     }
 599
 600     for (r = cpu->gdb_regs; r; r = r->next) {
 601         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 602             return r->set_reg(env, mem_buf, reg - r->base_reg);
 603         }
 604     }
 605     return 0;
 606 }
 607
 608 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
 609    specifies the first register number and these registers are included in
 610    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
 611    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
 612  */
 613
 614 void gdb_register_coprocessor(CPUState *cpu,
 615                               gdb_reg_cb get_reg, gdb_reg_cb set_reg,
 616                               int num_regs, const char *xml, int g_pos)
 617 {
 618     GDBRegisterState *s;
 619     GDBRegisterState **p;
 620
 621     p = &cpu->gdb_regs;
 622     while (*p) {
 623         /* Check for duplicates.  */
 624         if (strcmp((*p)->xml, xml) == 0)
 625             return;
 626         p = &(*p)->next;
 627     }
 628
 629     s = g_new0(GDBRegisterState, 1);
 630     s->base_reg = cpu->gdb_num_regs;
 631     s->num_regs = num_regs;
 632     s->get_reg = get_reg;
 633     s->set_reg = set_reg;
 634     s->xml = xml;
 635
 636     /* Add to end of list.  */
 637     cpu->gdb_num_regs += num_regs;
 638     *p = s;
 639     if (g_pos) {
 640         if (g_pos != s->base_reg) {
 641             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
 642                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
 643         }
 644     }
 645 }
 646
 647 #ifndef CONFIG_USER_ONLY
 648 static const int xlat_gdb_type[] = {
 649     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
 650     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
 651     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
 652 };
 653 #endif
 654
 655 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
 656 {
 657     CPUState *cpu;
 658     CPUArchState *env;
 659     int err = 0;
 660
 661     if (kvm_enabled()) {
 662         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 663     }
 664
 665     switch (type) {
 666     case GDB_BREAKPOINT_SW:
 667     case GDB_BREAKPOINT_HW:
 668         for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 669             env = cpu->env_ptr;
 670             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
 671             if (err)
 672                 break;
 673         }
 674         return err;
 675 #ifndef CONFIG_USER_ONLY
 676     case GDB_WATCHPOINT_WRITE:
 677     case GDB_WATCHPOINT_READ:
 678     case GDB_WATCHPOINT_ACCESS:
 679         for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 680             env = cpu->env_ptr;
 681             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
 682                                         NULL);
 683             if (err)
 684                 break;
 685         }
 686         return err;
 687 #endif
 688     default:
 689         return -ENOSYS;
 690     }
 691 }
 692
 693 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
 694 {
 695     CPUState *cpu;
 696     CPUArchState *env;
 697     int err = 0;
 698
 699     if (kvm_enabled()) {
 700         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 701     }
 702
 703     switch (type) {
 704     case GDB_BREAKPOINT_SW:
 705     case GDB_BREAKPOINT_HW:
 706         for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 707             env = cpu->env_ptr;
 708             err = cpu_breakpoint_remove(env, addr, BP_GDB);
 709             if (err)
 710                 break;
 711         }
 712         return err;
 713 #ifndef CONFIG_USER_ONLY
 714     case GDB_WATCHPOINT_WRITE:
 715     case GDB_WATCHPOINT_READ:
 716     case GDB_WATCHPOINT_ACCESS:
 717         for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 718             env = cpu->env_ptr;
 719             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
 720             if (err)
 721                 break;
 722         }
 723         return err;
 724 #endif
 725     default:
 726         return -ENOSYS;
 727     }
 728 }
 729
 730 static void gdb_breakpoint_remove_all(void)
 731 {
 732     CPUState *cpu;
 733     CPUArchState *env;
 734
 735     if (kvm_enabled()) {
 736         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
 737         return;
 738     }
 739
 740     for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 741         env = cpu->env_ptr;
 742         cpu_breakpoint_remove_all(env, BP_GDB);
 743 #ifndef CONFIG_USER_ONLY
 744         cpu_watchpoint_remove_all(env, BP_GDB);
 745 #endif
 746     }
 747 }
 748
 749 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 750 {
 751     CPUState *cpu = s->c_cpu;
 752     CPUClass *cc = CPU_GET_CLASS(cpu);
 753
 754     cpu_synchronize_state(cpu);
 755     if (cc->set_pc) {
 756         cc->set_pc(cpu, pc);
 757     }
 758 }
 759
 760 static CPUState *find_cpu(uint32_t thread_id)
 761 {
 762     CPUState *cpu;
 763
 764     for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
 765         if (cpu_index(cpu) == thread_id) {
 766             return cpu;
 767         }
 768     }
 769
 770     return NULL;
 771 }
 772
 773 static int gdb_handle_packet(GDBState *s, const char *line_buf)
 774 {
 775     CPUState *cpu;
 776     const char *p;
 777     uint32_t thread;
 778     int ch, reg_size, type, res;
 779     char buf[MAX_PACKET_LENGTH];
 780     uint8_t mem_buf[MAX_PACKET_LENGTH];
 781     uint8_t *registers;
 782     target_ulong addr, len;
 783
 784 #ifdef DEBUG_GDB
 785     printf("command='%s'\n", line_buf);
 786 #endif
 787     p = line_buf;
 788     ch = *p++;
 789     switch(ch) {
 790     case '?':
 791         /* TODO: Make this return the correct value for user-mode.  */
 792         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
 793                  cpu_index(s->c_cpu));
 794         put_packet(s, buf);
 795         /* Remove all the breakpoints when this query is issued,
 796          * because gdb is doing and initial connect and the state
 797          * should be cleaned up.
 798          */
 799         gdb_breakpoint_remove_all();
 800         break;
 801     case 'c':
 802         if (*p != '\0') {
 803             addr = strtoull(p, (char **)&p, 16);
 804             gdb_set_cpu_pc(s, addr);
 805         }
 806         s->signal = 0;
 807         gdb_continue(s);
 808         return RS_IDLE;
 809     case 'C':
 810         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
 811         if (s->signal == -1)
 812             s->signal = 0;
 813         gdb_continue(s);
 814         return RS_IDLE;
 815     case 'v':
 816         if (strncmp(p, "Cont", 4) == 0) {
 817             int res_signal, res_thread;
 818
 819             p += 4;
 820             if (*p == '?') {
 821                 put_packet(s, "vCont;c;C;s;S");
 822                 break;
 823             }
 824             res = 0;
 825             res_signal = 0;
 826             res_thread = 0;
 827             while (*p) {
 828                 int action, signal;
 829
 830                 if (*p++ != ';') {
 831                     res = 0;
 832                     break;
 833                 }
 834                 action = *p++;
 835                 signal = 0;
 836                 if (action == 'C' || action == 'S') {
 837                     signal = strtoul(p, (char **)&p, 16);
 838                 } else if (action != 'c' && action != 's') {
 839                     res = 0;
 840                     break;
 841                 }
 842                 thread = 0;
 843                 if (*p == ':') {
 844                     thread = strtoull(p+1, (char **)&p, 16);
 845                 }
 846                 action = tolower(action);
 847                 if (res == 0 || (res == 'c' && action == 's')) {
 848                     res = action;
 849                     res_signal = signal;
 850                     res_thread = thread;
 851                 }
 852             }
 853             if (res) {
 854                 if (res_thread != -1 && res_thread != 0) {
 855                     cpu = find_cpu(res_thread);
 856                     if (cpu == NULL) {
 857                         put_packet(s, "E22");
 858                         break;
 859                     }
 860                     s->c_cpu = cpu;
 861                 }
 862                 if (res == 's') {
 863                     cpu_single_step(s->c_cpu, sstep_flags);
 864                 }
 865                 s->signal = res_signal;
 866                 gdb_continue(s);
 867                 return RS_IDLE;
 868             }
 869             break;
 870         } else {
 871             goto unknown_command;
 872         }
 873     case 'k':
 874 #ifdef CONFIG_USER_ONLY
 875         /* Kill the target */
 876         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
 877         exit(0);
 878 #endif
 879     case 'D':
 880         /* Detach packet */
 881         gdb_breakpoint_remove_all();
 882         gdb_syscall_mode = GDB_SYS_DISABLED;
 883         gdb_continue(s);
 884         put_packet(s, "OK");
 885         break;
 886     case 's':
 887         if (*p != '\0') {
 888             addr = strtoull(p, (char **)&p, 16);
 889             gdb_set_cpu_pc(s, addr);
 890         }
 891         cpu_single_step(s->c_cpu, sstep_flags);
 892         gdb_continue(s);
 893         return RS_IDLE;
 894     case 'F':
 895         {
 896             target_ulong ret;
 897             target_ulong err;
 898
 899             ret = strtoull(p, (char **)&p, 16);
 900             if (*p == ',') {
 901                 p++;
 902                 err = strtoull(p, (char **)&p, 16);
 903             } else {
 904                 err = 0;
 905             }
 906             if (*p == ',')
 907                 p++;
 908             type = *p;
 909             if (s->current_syscall_cb) {
 910                 s->current_syscall_cb(s->c_cpu, ret, err);
 911                 s->current_syscall_cb = NULL;
 912             }
 913             if (type == 'C') {
 914                 put_packet(s, "T02");
 915             } else {
 916                 gdb_continue(s);
 917             }
 918         }
 919         break;
 920     case 'g':
 921         cpu_synchronize_state(s->g_cpu);
 922         len = 0;
 923         for (addr = 0; addr < s->g_cpu->gdb_num_regs; addr++) {
 924             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
 925             len += reg_size;
 926         }
 927         memtohex(buf, mem_buf, len);
 928         put_packet(s, buf);
 929         break;
 930     case 'G':
 931         cpu_synchronize_state(s->g_cpu);
 932         registers = mem_buf;
 933         len = strlen(p) / 2;
 934         hextomem((uint8_t *)registers, p, len);
 935         for (addr = 0; addr < s->g_cpu->gdb_num_regs && len > 0; addr++) {
 936             reg_size = gdb_write_register(s->g_cpu, registers, addr);
 937             len -= reg_size;
 938             registers += reg_size;
 939         }
 940         put_packet(s, "OK");
 941         break;
 942     case 'm':
 943         addr = strtoull(p, (char **)&p, 16);
 944         if (*p == ',')
 945             p++;
 946         len = strtoull(p, NULL, 16);
 947         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
 948             put_packet (s, "E14");
 949         } else {
 950             memtohex(buf, mem_buf, len);
 951             put_packet(s, buf);
 952         }
 953         break;
 954     case 'M':
 955         addr = strtoull(p, (char **)&p, 16);
 956         if (*p == ',')
 957             p++;
 958         len = strtoull(p, (char **)&p, 16);
 959         if (*p == ':')
 960             p++;
 961         hextomem(mem_buf, p, len);
 962         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
 963                                    true) != 0) {
 964             put_packet(s, "E14");
 965         } else {
 966             put_packet(s, "OK");
 967         }
 968         break;
 969     case 'p':
 970         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
 971            This works, but can be very slow.  Anything new enough to
 972            understand XML also knows how to use this properly.  */
 973         if (!gdb_has_xml)
 974             goto unknown_command;
 975         addr = strtoull(p, (char **)&p, 16);
 976         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
 977         if (reg_size) {
 978             memtohex(buf, mem_buf, reg_size);
 979             put_packet(s, buf);
 980         } else {
 981             put_packet(s, "E14");
 982         }
 983         break;
 984     case 'P':
 985         if (!gdb_has_xml)
 986             goto unknown_command;
 987         addr = strtoull(p, (char **)&p, 16);
 988         if (*p == '=')
 989             p++;
 990         reg_size = strlen(p) / 2;
 991         hextomem(mem_buf, p, reg_size);
 992         gdb_write_register(s->g_cpu, mem_buf, addr);
 993         put_packet(s, "OK");
 994         break;
 995     case 'Z':
 996     case 'z':
 997         type = strtoul(p, (char **)&p, 16);
 998         if (*p == ',')
 999             p++;
1000         addr = strtoull(p, (char **)&p, 16);
1001         if (*p == ',')
1002             p++;
1003         len = strtoull(p, (char **)&p, 16);
1004         if (ch == 'Z')
1005             res = gdb_breakpoint_insert(addr, len, type);
1006         else
1007             res = gdb_breakpoint_remove(addr, len, type);
1008         if (res >= 0)
1009              put_packet(s, "OK");
1010         else if (res == -ENOSYS)
1011             put_packet(s, "");
1012         else
1013             put_packet(s, "E22");
1014         break;
1015     case 'H':
1016         type = *p++;
1017         thread = strtoull(p, (char **)&p, 16);
1018         if (thread == -1 || thread == 0) {
1019             put_packet(s, "OK");
1020             break;
1021         }
1022         cpu = find_cpu(thread);
1023         if (cpu == NULL) {
1024             put_packet(s, "E22");
1025             break;
1026         }
1027         switch (type) {
1028         case 'c':
1029             s->c_cpu = cpu;
1030             put_packet(s, "OK");
1031             break;
1032         case 'g':
1033             s->g_cpu = cpu;
1034             put_packet(s, "OK");
1035             break;
1036         default:
1037              put_packet(s, "E22");
1038              break;
1039         }
1040         break;
1041     case 'T':
1042         thread = strtoull(p, (char **)&p, 16);
1043         cpu = find_cpu(thread);
1044
1045         if (cpu != NULL) {
1046             put_packet(s, "OK");
1047         } else {
1048             put_packet(s, "E22");
1049         }
1050         break;
1051     case 'q':
1052     case 'Q':
1053         /* parse any 'q' packets here */
1054         if (!strcmp(p,"qemu.sstepbits")) {
1055             /* Query Breakpoint bit definitions */
1056             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1057                      SSTEP_ENABLE,
1058                      SSTEP_NOIRQ,
1059                      SSTEP_NOTIMER);
1060             put_packet(s, buf);
1061             break;
1062         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1063             /* Display or change the sstep_flags */
1064             p += 10;
1065             if (*p != '=') {
1066                 /* Display current setting */
1067                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1068                 put_packet(s, buf);
1069                 break;
1070             }
1071             p++;
1072             type = strtoul(p, (char **)&p, 16);
1073             sstep_flags = type;
1074             put_packet(s, "OK");
1075             break;
1076         } else if (strcmp(p,"C") == 0) {
1077             /* "Current thread" remains vague in the spec, so always return
1078              *  the first CPU (gdb returns the first thread). */
1079             put_packet(s, "QC1");
1080             break;
1081         } else if (strcmp(p,"fThreadInfo") == 0) {
1082             s->query_cpu = first_cpu;
1083             goto report_cpuinfo;
1084         } else if (strcmp(p,"sThreadInfo") == 0) {
1085         report_cpuinfo:
1086             if (s->query_cpu) {
1087                 snprintf(buf, sizeof(buf), "m%x", cpu_index(s->query_cpu));
1088                 put_packet(s, buf);
1089                 s->query_cpu = s->query_cpu->next_cpu;
1090             } else
1091                 put_packet(s, "l");
1092             break;
1093         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1094             thread = strtoull(p+16, (char **)&p, 16);
1095             cpu = find_cpu(thread);
1096             if (cpu != NULL) {
1097                 cpu_synchronize_state(cpu);
1098                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
1099                                "CPU#%d [%s]", cpu->cpu_index,
1100                                cpu->halted ? "halted " : "running");
1101                 memtohex(buf, mem_buf, len);
1102                 put_packet(s, buf);
1103             }
1104             break;
1105         }
1106 #ifdef CONFIG_USER_ONLY
1107         else if (strncmp(p, "Offsets", 7) == 0) {
1108             CPUArchState *env = s->c_cpu->env_ptr;
1109             TaskState *ts = env->opaque;
1110
1111             snprintf(buf, sizeof(buf),
1112                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1113                      ";Bss=" TARGET_ABI_FMT_lx,
1114                      ts->info->code_offset,
1115                      ts->info->data_offset,
1116                      ts->info->data_offset);
1117             put_packet(s, buf);
1118             break;
1119         }
1120 #else /* !CONFIG_USER_ONLY */
1121         else if (strncmp(p, "Rcmd,", 5) == 0) {
1122             int len = strlen(p + 5);
1123
1124             if ((len % 2) != 0) {
1125                 put_packet(s, "E01");
1126                 break;
1127             }
1128             hextomem(mem_buf, p + 5, len);
1129             len = len / 2;
1130             mem_buf[len++] = 0;
1131             qemu_chr_be_write(s->mon_chr, mem_buf, len);
1132             put_packet(s, "OK");
1133             break;
1134         }
1135 #endif /* !CONFIG_USER_ONLY */
1136         if (strncmp(p, "Supported", 9) == 0) {
1137             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1138 #ifdef GDB_CORE_XML
1139             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1140 #endif
1141             put_packet(s, buf);
1142             break;
1143         }
1144 #ifdef GDB_CORE_XML
1145         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1146             const char *xml;
1147             target_ulong total_len;
1148
1149             gdb_has_xml = true;
1150             p += 19;
1151             xml = get_feature_xml(p, &p);
1152             if (!xml) {
1153                 snprintf(buf, sizeof(buf), "E00");
1154                 put_packet(s, buf);
1155                 break;
1156             }
1157
1158             if (*p == ':')
1159                 p++;
1160             addr = strtoul(p, (char **)&p, 16);
1161             if (*p == ',')
1162                 p++;
1163             len = strtoul(p, (char **)&p, 16);
1164
1165             total_len = strlen(xml);
1166             if (addr > total_len) {
1167                 snprintf(buf, sizeof(buf), "E00");
1168                 put_packet(s, buf);
1169                 break;
1170             }
1171             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1172                 len = (MAX_PACKET_LENGTH - 5) / 2;
1173             if (len < total_len - addr) {
1174                 buf[0] = 'm';
1175                 len = memtox(buf + 1, xml + addr, len);
1176             } else {
1177                 buf[0] = 'l';
1178                 len = memtox(buf + 1, xml + addr, total_len - addr);
1179             }
1180             put_packet_binary(s, buf, len + 1);
1181             break;
1182         }
1183 #endif
1184         /* Unrecognised 'q' command.  */
1185         goto unknown_command;
1186
1187     default:
1188     unknown_command:
1189         /* put empty packet */
1190         buf[0] = '\0';
1191         put_packet(s, buf);
1192         break;
1193     }
1194     return RS_IDLE;
1195 }
1196
1197 void gdb_set_stop_cpu(CPUState *cpu)
1198 {
1199     gdbserver_state->c_cpu = cpu;
1200     gdbserver_state->g_cpu = cpu;
1201 }
1202
1203 #ifndef CONFIG_USER_ONLY
1204 static void gdb_vm_state_change(void *opaque, int running, RunState state)
1205 {
1206     GDBState *s = gdbserver_state;
1207     CPUArchState *env = s->c_cpu->env_ptr;
1208     CPUState *cpu = s->c_cpu;
1209     char buf[256];
1210     const char *type;
1211     int ret;
1212
1213     if (running || s->state == RS_INACTIVE) {
1214         return;
1215     }
1216     /* Is there a GDB syscall waiting to be sent?  */
1217     if (s->current_syscall_cb) {
1218         put_packet(s, s->syscall_buf);
1219         return;
1220     }
1221     switch (state) {
1222     case RUN_STATE_DEBUG:
1223         if (env->watchpoint_hit) {
1224             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
1225             case BP_MEM_READ:
1226                 type = "r";
1227                 break;
1228             case BP_MEM_ACCESS:
1229                 type = "a";
1230                 break;
1231             default:
1232                 type = "";
1233                 break;
1234             }
1235             snprintf(buf, sizeof(buf),
1236                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1237                      GDB_SIGNAL_TRAP, cpu_index(cpu), type,
1238                      env->watchpoint_hit->vaddr);
1239             env->watchpoint_hit = NULL;
1240             goto send_packet;
1241         }
1242         tb_flush(env);
1243         ret = GDB_SIGNAL_TRAP;
1244         break;
1245     case RUN_STATE_PAUSED:
1246         ret = GDB_SIGNAL_INT;
1247         break;
1248     case RUN_STATE_SHUTDOWN:
1249         ret = GDB_SIGNAL_QUIT;
1250         break;
1251     case RUN_STATE_IO_ERROR:
1252         ret = GDB_SIGNAL_IO;
1253         break;
1254     case RUN_STATE_WATCHDOG:
1255         ret = GDB_SIGNAL_ALRM;
1256         break;
1257     case RUN_STATE_INTERNAL_ERROR:
1258         ret = GDB_SIGNAL_ABRT;
1259         break;
1260     case RUN_STATE_SAVE_VM:
1261     case RUN_STATE_RESTORE_VM:
1262         return;
1263     case RUN_STATE_FINISH_MIGRATE:
1264         ret = GDB_SIGNAL_XCPU;
1265         break;
1266     default:
1267         ret = GDB_SIGNAL_UNKNOWN;
1268         break;
1269     }
1270     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, cpu_index(cpu));
1271
1272 send_packet:
1273     put_packet(s, buf);
1274
1275     /* disable single step if it was enabled */
1276     cpu_single_step(cpu, 0);
1277 }
1278 #endif
1279
1280 /* Send a gdb syscall request.
1281    This accepts limited printf-style format specifiers, specifically:
1282     %x  - target_ulong argument printed in hex.
1283     %lx - 64-bit argument printed in hex.
1284     %s  - string pointer (target_ulong) and length (int) pair.  */
1285 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1286 {
1287     va_list va;
1288     char *p;
1289     char *p_end;
1290     target_ulong addr;
1291     uint64_t i64;
1292     GDBState *s;
1293
1294     s = gdbserver_state;
1295     if (!s)
1296         return;
1297     s->current_syscall_cb = cb;
1298 #ifndef CONFIG_USER_ONLY
1299     vm_stop(RUN_STATE_DEBUG);
1300 #endif
1301     va_start(va, fmt);
1302     p = s->syscall_buf;
1303     p_end = &s->syscall_buf[sizeof(s->syscall_buf)];
1304     *(p++) = 'F';
1305     while (*fmt) {
1306         if (*fmt == '%') {
1307             fmt++;
1308             switch (*fmt++) {
1309             case 'x':
1310                 addr = va_arg(va, target_ulong);
1311                 p += snprintf(p, p_end - p, TARGET_FMT_lx, addr);
1312                 break;
1313             case 'l':
1314                 if (*(fmt++) != 'x')
1315                     goto bad_format;
1316                 i64 = va_arg(va, uint64_t);
1317                 p += snprintf(p, p_end - p, "%" PRIx64, i64);
1318                 break;
1319             case 's':
1320                 addr = va_arg(va, target_ulong);
1321                 p += snprintf(p, p_end - p, TARGET_FMT_lx "/%x",
1322                               addr, va_arg(va, int));
1323                 break;
1324             default:
1325             bad_format:
1326                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
1327                         fmt - 1);
1328                 break;
1329             }
1330         } else {
1331             *(p++) = *(fmt++);
1332         }
1333     }
1334     *p = 0;
1335     va_end(va);
1336 #ifdef CONFIG_USER_ONLY
1337     put_packet(s, s->syscall_buf);
1338     gdb_handlesig(s->c_cpu, 0);
1339 #else
1340     /* In this case wait to send the syscall packet until notification that
1341        the CPU has stopped.  This must be done because if the packet is sent
1342        now the reply from the syscall request could be received while the CPU
1343        is still in the running state, which can cause packets to be dropped
1344        and state transition 'T' packets to be sent while the syscall is still
1345        being processed.  */
1346     cpu_exit(s->c_cpu);
1347 #endif
1348 }
1349
1350 static void gdb_read_byte(GDBState *s, int ch)
1351 {
1352     int i, csum;
1353     uint8_t reply;
1354
1355 #ifndef CONFIG_USER_ONLY
1356     if (s->last_packet_len) {
1357         /* Waiting for a response to the last packet.  If we see the start
1358            of a new command then abandon the previous response.  */
1359         if (ch == '-') {
1360 #ifdef DEBUG_GDB
1361             printf("Got NACK, retransmitting\n");
1362 #endif
1363             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
1364         }
1365 #ifdef DEBUG_GDB
1366         else if (ch == '+')
1367             printf("Got ACK\n");
1368         else
1369             printf("Got '%c' when expecting ACK/NACK\n", ch);
1370 #endif
1371         if (ch == '+' || ch == '$')
1372             s->last_packet_len = 0;
1373         if (ch != '$')
1374             return;
1375     }
1376     if (runstate_is_running()) {
1377         /* when the CPU is running, we cannot do anything except stop
1378            it when receiving a char */
1379         vm_stop(RUN_STATE_PAUSED);
1380     } else
1381 #endif
1382     {
1383         switch(s->state) {
1384         case RS_IDLE:
1385             if (ch == '$') {
1386                 s->line_buf_index = 0;
1387                 s->state = RS_GETLINE;
1388             }
1389             break;
1390         case RS_GETLINE:
1391             if (ch == '#') {
1392             s->state = RS_CHKSUM1;
1393             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1394                 s->state = RS_IDLE;
1395             } else {
1396             s->line_buf[s->line_buf_index++] = ch;
1397             }
1398             break;
1399         case RS_CHKSUM1:
1400             s->line_buf[s->line_buf_index] = '\0';
1401             s->line_csum = fromhex(ch) << 4;
1402             s->state = RS_CHKSUM2;
1403             break;
1404         case RS_CHKSUM2:
1405             s->line_csum |= fromhex(ch);
1406             csum = 0;
1407             for(i = 0; i < s->line_buf_index; i++) {
1408                 csum += s->line_buf[i];
1409             }
1410             if (s->line_csum != (csum & 0xff)) {
1411                 reply = '-';
1412                 put_buffer(s, &reply, 1);
1413                 s->state = RS_IDLE;
1414             } else {
1415                 reply = '+';
1416                 put_buffer(s, &reply, 1);
1417                 s->state = gdb_handle_packet(s, s->line_buf);
1418             }
1419             break;
1420         default:
1421             abort();
1422         }
1423     }
1424 }
1425
1426 /* Tell the remote gdb that the process has exited.  */
1427 void gdb_exit(CPUArchState *env, int code)
1428 {
1429   GDBState *s;
1430   char buf[4];
1431
1432   s = gdbserver_state;
1433   if (!s) {
1434       return;
1435   }
1436 #ifdef CONFIG_USER_ONLY
1437   if (gdbserver_fd < 0 || s->fd < 0) {
1438       return;
1439   }
1440 #endif
1441
1442   snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
1443   put_packet(s, buf);
1444
1445 #ifndef CONFIG_USER_ONLY
1446   if (s->chr) {
1447       qemu_chr_delete(s->chr);
1448   }
1449 #endif
1450 }
1451
1452 #ifdef CONFIG_USER_ONLY
1453 int
1454 gdb_queuesig (void)
1455 {
1456     GDBState *s;
1457
1458     s = gdbserver_state;
1459
1460     if (gdbserver_fd < 0 || s->fd < 0)
1461         return 0;
1462     else
1463         return 1;
1464 }
1465
1466 int
1467 gdb_handlesig(CPUState *cpu, int sig)
1468 {
1469     CPUArchState *env = cpu->env_ptr;
1470     GDBState *s;
1471     char buf[256];
1472     int n;
1473
1474     s = gdbserver_state;
1475     if (gdbserver_fd < 0 || s->fd < 0) {
1476         return sig;
1477     }
1478
1479     /* disable single step if it was enabled */
1480     cpu_single_step(cpu, 0);
1481     tb_flush(env);
1482
1483     if (sig != 0) {
1484         snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));
1485         put_packet(s, buf);
1486     }
1487     /* put_packet() might have detected that the peer terminated the
1488        connection.  */
1489     if (s->fd < 0) {
1490         return sig;
1491     }
1492
1493     sig = 0;
1494     s->state = RS_IDLE;
1495     s->running_state = 0;
1496     while (s->running_state == 0) {
1497         n = read(s->fd, buf, 256);
1498         if (n > 0) {
1499             int i;
1500
1501             for (i = 0; i < n; i++) {
1502                 gdb_read_byte(s, buf[i]);
1503             }
1504         } else if (n == 0 || errno != EAGAIN) {
1505             /* XXX: Connection closed.  Should probably wait for another
1506                connection before continuing.  */
1507             return sig;
1508         }
1509     }
1510     sig = s->signal;
1511     s->signal = 0;
1512     return sig;
1513 }
1514
1515 /* Tell the remote gdb that the process has exited due to SIG.  */
1516 void gdb_signalled(CPUArchState *env, int sig)
1517 {
1518     GDBState *s;
1519     char buf[4];
1520
1521     s = gdbserver_state;
1522     if (gdbserver_fd < 0 || s->fd < 0) {
1523         return;
1524     }
1525
1526     snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb(sig));
1527     put_packet(s, buf);
1528 }
1529
1530 static void gdb_accept(void)
1531 {
1532     GDBState *s;
1533     struct sockaddr_in sockaddr;
1534     socklen_t len;
1535     int fd;
1536
1537     for(;;) {
1538         len = sizeof(sockaddr);
1539         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
1540         if (fd < 0 && errno != EINTR) {
1541             perror("accept");
1542             return;
1543         } else if (fd >= 0) {
1544 #ifndef _WIN32
1545             fcntl(fd, F_SETFD, FD_CLOEXEC);
1546 #endif
1547             break;
1548         }
1549     }
1550
1551     /* set short latency */
1552     socket_set_nodelay(fd);
1553
1554     s = g_malloc0(sizeof(GDBState));
1555     s->c_cpu = first_cpu;
1556     s->g_cpu = first_cpu;
1557     s->fd = fd;
1558     gdb_has_xml = false;
1559
1560     gdbserver_state = s;
1561
1562     fcntl(fd, F_SETFL, O_NONBLOCK);
1563 }
1564
1565 static int gdbserver_open(int port)
1566 {
1567     struct sockaddr_in sockaddr;
1568     int fd, val, ret;
1569
1570     fd = socket(PF_INET, SOCK_STREAM, 0);
1571     if (fd < 0) {
1572         perror("socket");
1573         return -1;
1574     }
1575 #ifndef _WIN32
1576     fcntl(fd, F_SETFD, FD_CLOEXEC);
1577 #endif
1578
1579     /* allow fast reuse */
1580     val = 1;
1581     qemu_setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &val, sizeof(val));
1582
1583     sockaddr.sin_family = AF_INET;
1584     sockaddr.sin_port = htons(port);
1585     sockaddr.sin_addr.s_addr = 0;
1586     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
1587     if (ret < 0) {
1588         perror("bind");
1589         close(fd);
1590         return -1;
1591     }
1592     ret = listen(fd, 0);
1593     if (ret < 0) {
1594         perror("listen");
1595         close(fd);
1596         return -1;
1597     }
1598     return fd;
1599 }
1600
1601 int gdbserver_start(int port)
1602 {
1603     gdbserver_fd = gdbserver_open(port);
1604     if (gdbserver_fd < 0)
1605         return -1;
1606     /* accept connections */
1607     gdb_accept();
1608     return 0;
1609 }
1610
1611 /* Disable gdb stub for child processes.  */
1612 void gdbserver_fork(CPUArchState *env)
1613 {
1614     GDBState *s = gdbserver_state;
1615     if (gdbserver_fd < 0 || s->fd < 0)
1616       return;
1617     close(s->fd);
1618     s->fd = -1;
1619     cpu_breakpoint_remove_all(env, BP_GDB);
1620     cpu_watchpoint_remove_all(env, BP_GDB);
1621 }
1622 #else
1623 static int gdb_chr_can_receive(void *opaque)
1624 {
1625   /* We can handle an arbitrarily large amount of data.
1626    Pick the maximum packet size, which is as good as anything.  */
1627   return MAX_PACKET_LENGTH;
1628 }
1629
1630 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
1631 {
1632     int i;
1633
1634     for (i = 0; i < size; i++) {
1635         gdb_read_byte(gdbserver_state, buf[i]);
1636     }
1637 }
1638
1639 static void gdb_chr_event(void *opaque, int event)
1640 {
1641     switch (event) {
1642     case CHR_EVENT_OPENED:
1643         vm_stop(RUN_STATE_PAUSED);
1644         gdb_has_xml = false;
1645         break;
1646     default:
1647         break;
1648     }
1649 }
1650
1651 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
1652 {
1653     char buf[MAX_PACKET_LENGTH];
1654
1655     buf[0] = 'O';
1656     if (len > (MAX_PACKET_LENGTH/2) - 1)
1657         len = (MAX_PACKET_LENGTH/2) - 1;
1658     memtohex(buf + 1, (uint8_t *)msg, len);
1659     put_packet(s, buf);
1660 }
1661
1662 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
1663 {
1664     const char *p = (const char *)buf;
1665     int max_sz;
1666
1667     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
1668     for (;;) {
1669         if (len <= max_sz) {
1670             gdb_monitor_output(gdbserver_state, p, len);
1671             break;
1672         }
1673         gdb_monitor_output(gdbserver_state, p, max_sz);
1674         p += max_sz;
1675         len -= max_sz;
1676     }
1677     return len;
1678 }
1679
1680 #ifndef _WIN32
1681 static void gdb_sigterm_handler(int signal)
1682 {
1683     if (runstate_is_running()) {
1684         vm_stop(RUN_STATE_PAUSED);
1685     }
1686 }
1687 #endif
1688
1689 int gdbserver_start(const char *device)
1690 {
1691     GDBState *s;
1692     char gdbstub_device_name[128];
1693     CharDriverState *chr = NULL;
1694     CharDriverState *mon_chr;
1695
1696     if (!device)
1697         return -1;
1698     if (strcmp(device, "none") != 0) {
1699         if (strstart(device, "tcp:", NULL)) {
1700             /* enforce required TCP attributes */
1701             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
1702                      "%s,nowait,nodelay,server", device);
1703             device = gdbstub_device_name;
1704         }
1705 #ifndef _WIN32
1706         else if (strcmp(device, "stdio") == 0) {
1707             struct sigaction act;
1708
1709             memset(&act, 0, sizeof(act));
1710             act.sa_handler = gdb_sigterm_handler;
1711             sigaction(SIGINT, &act, NULL);
1712         }
1713 #endif
1714         chr = qemu_chr_new("gdb", device, NULL);
1715         if (!chr)
1716             return -1;
1717
1718         qemu_chr_fe_claim_no_fail(chr);
1719         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
1720                               gdb_chr_event, NULL);
1721     }
1722
1723     s = gdbserver_state;
1724     if (!s) {
1725         s = g_malloc0(sizeof(GDBState));
1726         gdbserver_state = s;
1727
1728         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
1729
1730         /* Initialize a monitor terminal for gdb */
1731         mon_chr = g_malloc0(sizeof(*mon_chr));
1732         mon_chr->chr_write = gdb_monitor_write;
1733         monitor_init(mon_chr, 0);
1734     } else {
1735         if (s->chr)
1736             qemu_chr_delete(s->chr);
1737         mon_chr = s->mon_chr;
1738         memset(s, 0, sizeof(GDBState));
1739     }
1740     s->c_cpu = first_cpu;
1741     s->g_cpu = first_cpu;
1742     s->chr = chr;
1743     s->state = chr ? RS_IDLE : RS_INACTIVE;
1744     s->mon_chr = mon_chr;
1745     s->current_syscall_cb = NULL;
1746
1747     return 0;
1748 }
1749 #endif