gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "qemu/osdep.h"
  20 #include "qapi/error.h"
  21 #include "qemu/error-report.h"
  22 #include "qemu/cutils.h"
  23 #include "trace-root.h"
  24 #ifdef CONFIG_USER_ONLY
  25 #include "qemu.h"
  26 #else
  27 #include "monitor/monitor.h"
  28 #include "chardev/char.h"
  29 #include "chardev/char-fe.h"
  30 #include "sysemu/sysemu.h"
  31 #include "exec/gdbstub.h"
  32 #include "hw/cpu/cluster.h"
  33 #endif
  34
  35 #define MAX_PACKET_LENGTH 4096
  36
  37 #include "qemu/sockets.h"
  38 #include "sysemu/hw_accel.h"
  39 #include "sysemu/kvm.h"
  40 #include "exec/semihost.h"
  41 #include "exec/exec-all.h"
  42
  43 #ifdef CONFIG_USER_ONLY
  44 #define GDB_ATTACHED "0"
  45 #else
  46 #define GDB_ATTACHED "1"
  47 #endif
  48
  49 static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
  50                                          uint8_t *buf, int len, bool is_write)
  51 {
  52     CPUClass *cc = CPU_GET_CLASS(cpu);
  53
  54     if (cc->memory_rw_debug) {
  55         return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
  56     }
  57     return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
  58 }
  59
  60 /* Return the GDB index for a given vCPU state.
  61  *
  62  * For user mode this is simply the thread id. In system mode GDB
  63  * numbers CPUs from 1 as 0 is reserved as an "any cpu" index.
  64  */
  65 static inline int cpu_gdb_index(CPUState *cpu)
  66 {
  67 #if defined(CONFIG_USER_ONLY)
  68     TaskState *ts = (TaskState *) cpu->opaque;
  69     return ts->ts_tid;
  70 #else
  71     return cpu->cpu_index + 1;
  72 #endif
  73 }
  74
  75 enum {
  76     GDB_SIGNAL_0 = 0,
  77     GDB_SIGNAL_INT = 2,
  78     GDB_SIGNAL_QUIT = 3,
  79     GDB_SIGNAL_TRAP = 5,
  80     GDB_SIGNAL_ABRT = 6,
  81     GDB_SIGNAL_ALRM = 14,
  82     GDB_SIGNAL_IO = 23,
  83     GDB_SIGNAL_XCPU = 24,
  84     GDB_SIGNAL_UNKNOWN = 143
  85 };
  86
  87 #ifdef CONFIG_USER_ONLY
  88
  89 /* Map target signal numbers to GDB protocol signal numbers and vice
  90  * versa.  For user emulation's currently supported systems, we can
  91  * assume most signals are defined.
  92  */
  93
  94 static int gdb_signal_table[] = {
  95     0,
  96     TARGET_SIGHUP,
  97     TARGET_SIGINT,
  98     TARGET_SIGQUIT,
  99     TARGET_SIGILL,
 100     TARGET_SIGTRAP,
 101     TARGET_SIGABRT,
 102     -1, /* SIGEMT */
 103     TARGET_SIGFPE,
 104     TARGET_SIGKILL,
 105     TARGET_SIGBUS,
 106     TARGET_SIGSEGV,
 107     TARGET_SIGSYS,
 108     TARGET_SIGPIPE,
 109     TARGET_SIGALRM,
 110     TARGET_SIGTERM,
 111     TARGET_SIGURG,
 112     TARGET_SIGSTOP,
 113     TARGET_SIGTSTP,
 114     TARGET_SIGCONT,
 115     TARGET_SIGCHLD,
 116     TARGET_SIGTTIN,
 117     TARGET_SIGTTOU,
 118     TARGET_SIGIO,
 119     TARGET_SIGXCPU,
 120     TARGET_SIGXFSZ,
 121     TARGET_SIGVTALRM,
 122     TARGET_SIGPROF,
 123     TARGET_SIGWINCH,
 124     -1, /* SIGLOST */
 125     TARGET_SIGUSR1,
 126     TARGET_SIGUSR2,
 127 #ifdef TARGET_SIGPWR
 128     TARGET_SIGPWR,
 129 #else
 130     -1,
 131 #endif
 132     -1, /* SIGPOLL */
 133     -1,
 134     -1,
 135     -1,
 136     -1,
 137     -1,
 138     -1,
 139     -1,
 140     -1,
 141     -1,
 142     -1,
 143     -1,
 144 #ifdef __SIGRTMIN
 145     __SIGRTMIN + 1,
 146     __SIGRTMIN + 2,
 147     __SIGRTMIN + 3,
 148     __SIGRTMIN + 4,
 149     __SIGRTMIN + 5,
 150     __SIGRTMIN + 6,
 151     __SIGRTMIN + 7,
 152     __SIGRTMIN + 8,
 153     __SIGRTMIN + 9,
 154     __SIGRTMIN + 10,
 155     __SIGRTMIN + 11,
 156     __SIGRTMIN + 12,
 157     __SIGRTMIN + 13,
 158     __SIGRTMIN + 14,
 159     __SIGRTMIN + 15,
 160     __SIGRTMIN + 16,
 161     __SIGRTMIN + 17,
 162     __SIGRTMIN + 18,
 163     __SIGRTMIN + 19,
 164     __SIGRTMIN + 20,
 165     __SIGRTMIN + 21,
 166     __SIGRTMIN + 22,
 167     __SIGRTMIN + 23,
 168     __SIGRTMIN + 24,
 169     __SIGRTMIN + 25,
 170     __SIGRTMIN + 26,
 171     __SIGRTMIN + 27,
 172     __SIGRTMIN + 28,
 173     __SIGRTMIN + 29,
 174     __SIGRTMIN + 30,
 175     __SIGRTMIN + 31,
 176     -1, /* SIGCANCEL */
 177     __SIGRTMIN,
 178     __SIGRTMIN + 32,
 179     __SIGRTMIN + 33,
 180     __SIGRTMIN + 34,
 181     __SIGRTMIN + 35,
 182     __SIGRTMIN + 36,
 183     __SIGRTMIN + 37,
 184     __SIGRTMIN + 38,
 185     __SIGRTMIN + 39,
 186     __SIGRTMIN + 40,
 187     __SIGRTMIN + 41,
 188     __SIGRTMIN + 42,
 189     __SIGRTMIN + 43,
 190     __SIGRTMIN + 44,
 191     __SIGRTMIN + 45,
 192     __SIGRTMIN + 46,
 193     __SIGRTMIN + 47,
 194     __SIGRTMIN + 48,
 195     __SIGRTMIN + 49,
 196     __SIGRTMIN + 50,
 197     __SIGRTMIN + 51,
 198     __SIGRTMIN + 52,
 199     __SIGRTMIN + 53,
 200     __SIGRTMIN + 54,
 201     __SIGRTMIN + 55,
 202     __SIGRTMIN + 56,
 203     __SIGRTMIN + 57,
 204     __SIGRTMIN + 58,
 205     __SIGRTMIN + 59,
 206     __SIGRTMIN + 60,
 207     __SIGRTMIN + 61,
 208     __SIGRTMIN + 62,
 209     __SIGRTMIN + 63,
 210     __SIGRTMIN + 64,
 211     __SIGRTMIN + 65,
 212     __SIGRTMIN + 66,
 213     __SIGRTMIN + 67,
 214     __SIGRTMIN + 68,
 215     __SIGRTMIN + 69,
 216     __SIGRTMIN + 70,
 217     __SIGRTMIN + 71,
 218     __SIGRTMIN + 72,
 219     __SIGRTMIN + 73,
 220     __SIGRTMIN + 74,
 221     __SIGRTMIN + 75,
 222     __SIGRTMIN + 76,
 223     __SIGRTMIN + 77,
 224     __SIGRTMIN + 78,
 225     __SIGRTMIN + 79,
 226     __SIGRTMIN + 80,
 227     __SIGRTMIN + 81,
 228     __SIGRTMIN + 82,
 229     __SIGRTMIN + 83,
 230     __SIGRTMIN + 84,
 231     __SIGRTMIN + 85,
 232     __SIGRTMIN + 86,
 233     __SIGRTMIN + 87,
 234     __SIGRTMIN + 88,
 235     __SIGRTMIN + 89,
 236     __SIGRTMIN + 90,
 237     __SIGRTMIN + 91,
 238     __SIGRTMIN + 92,
 239     __SIGRTMIN + 93,
 240     __SIGRTMIN + 94,
 241     __SIGRTMIN + 95,
 242     -1, /* SIGINFO */
 243     -1, /* UNKNOWN */
 244     -1, /* DEFAULT */
 245     -1,
 246     -1,
 247     -1,
 248     -1,
 249     -1,
 250     -1
 251 #endif
 252 };
 253 #else
 254 /* In system mode we only need SIGINT and SIGTRAP; other signals
 255    are not yet supported.  */
 256
 257 enum {
 258     TARGET_SIGINT = 2,
 259     TARGET_SIGTRAP = 5
 260 };
 261
 262 static int gdb_signal_table[] = {
 263     -1,
 264     -1,
 265     TARGET_SIGINT,
 266     -1,
 267     -1,
 268     TARGET_SIGTRAP
 269 };
 270 #endif
 271
 272 #ifdef CONFIG_USER_ONLY
 273 static int target_signal_to_gdb (int sig)
 274 {
 275     int i;
 276     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 277         if (gdb_signal_table[i] == sig)
 278             return i;
 279     return GDB_SIGNAL_UNKNOWN;
 280 }
 281 #endif
 282
 283 static int gdb_signal_to_target (int sig)
 284 {
 285     if (sig < ARRAY_SIZE (gdb_signal_table))
 286         return gdb_signal_table[sig];
 287     else
 288         return -1;
 289 }
 290
 291 typedef struct GDBRegisterState {
 292     int base_reg;
 293     int num_regs;
 294     gdb_reg_cb get_reg;
 295     gdb_reg_cb set_reg;
 296     const char *xml;
 297     struct GDBRegisterState *next;
 298 } GDBRegisterState;
 299
 300 typedef struct GDBProcess {
 301     uint32_t pid;
 302     bool attached;
 303 } GDBProcess;
 304
 305 enum RSState {
 306     RS_INACTIVE,
 307     RS_IDLE,
 308     RS_GETLINE,
 309     RS_GETLINE_ESC,
 310     RS_GETLINE_RLE,
 311     RS_CHKSUM1,
 312     RS_CHKSUM2,
 313 };
 314 typedef struct GDBState {
 315     CPUState *c_cpu; /* current CPU for step/continue ops */
 316     CPUState *g_cpu; /* current CPU for other ops */
 317     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 318     enum RSState state; /* parsing state */
 319     char line_buf[MAX_PACKET_LENGTH];
 320     int line_buf_index;
 321     int line_sum; /* running checksum */
 322     int line_csum; /* checksum at the end of the packet */
 323     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 324     int last_packet_len;
 325     int signal;
 326 #ifdef CONFIG_USER_ONLY
 327     int fd;
 328     int running_state;
 329 #else
 330     CharBackend chr;
 331     Chardev *mon_chr;
 332 #endif
 333     bool multiprocess;
 334     GDBProcess *processes;
 335     int process_num;
 336     char syscall_buf[256];
 337     gdb_syscall_complete_cb current_syscall_cb;
 338 } GDBState;
 339
 340 /* By default use no IRQs and no timers while single stepping so as to
 341  * make single stepping like an ICE HW step.
 342  */
 343 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 344
 345 static GDBState *gdbserver_state;
 346
 347 bool gdb_has_xml;
 348
 349 #ifdef CONFIG_USER_ONLY
 350 /* XXX: This is not thread safe.  Do we care?  */
 351 static int gdbserver_fd = -1;
 352
 353 static int get_char(GDBState *s)
 354 {
 355     uint8_t ch;
 356     int ret;
 357
 358     for(;;) {
 359         ret = qemu_recv(s->fd, &ch, 1, 0);
 360         if (ret < 0) {
 361             if (errno == ECONNRESET)
 362                 s->fd = -1;
 363             if (errno != EINTR)
 364                 return -1;
 365         } else if (ret == 0) {
 366             close(s->fd);
 367             s->fd = -1;
 368             return -1;
 369         } else {
 370             break;
 371         }
 372     }
 373     return ch;
 374 }
 375 #endif
 376
 377 static enum {
 378     GDB_SYS_UNKNOWN,
 379     GDB_SYS_ENABLED,
 380     GDB_SYS_DISABLED,
 381 } gdb_syscall_mode;
 382
 383 /* Decide if either remote gdb syscalls or native file IO should be used. */
 384 int use_gdb_syscalls(void)
 385 {
 386     SemihostingTarget target = semihosting_get_target();
 387     if (target == SEMIHOSTING_TARGET_NATIVE) {
 388         /* -semihosting-config target=native */
 389         return false;
 390     } else if (target == SEMIHOSTING_TARGET_GDB) {
 391         /* -semihosting-config target=gdb */
 392         return true;
 393     }
 394
 395     /* -semihosting-config target=auto */
 396     /* On the first call check if gdb is connected and remember. */
 397     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 398         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 399                                             : GDB_SYS_DISABLED);
 400     }
 401     return gdb_syscall_mode == GDB_SYS_ENABLED;
 402 }
 403
 404 /* Resume execution.  */
 405 static inline void gdb_continue(GDBState *s)
 406 {
 407
 408 #ifdef CONFIG_USER_ONLY
 409     s->running_state = 1;
 410     trace_gdbstub_op_continue();
 411 #else
 412     if (!runstate_needs_reset()) {
 413         trace_gdbstub_op_continue();
 414         vm_start();
 415     }
 416 #endif
 417 }
 418
 419 /*
 420  * Resume execution, per CPU actions. For user-mode emulation it's
 421  * equivalent to gdb_continue.
 422  */
 423 static int gdb_continue_partial(GDBState *s, char *newstates)
 424 {
 425     CPUState *cpu;
 426     int res = 0;
 427 #ifdef CONFIG_USER_ONLY
 428     /*
 429      * This is not exactly accurate, but it's an improvement compared to the
 430      * previous situation, where only one CPU would be single-stepped.
 431      */
 432     CPU_FOREACH(cpu) {
 433         if (newstates[cpu->cpu_index] == 's') {
 434             trace_gdbstub_op_stepping(cpu->cpu_index);
 435             cpu_single_step(cpu, sstep_flags);
 436         }
 437     }
 438     s->running_state = 1;
 439 #else
 440     int flag = 0;
 441
 442     if (!runstate_needs_reset()) {
 443         if (vm_prepare_start()) {
 444             return 0;
 445         }
 446
 447         CPU_FOREACH(cpu) {
 448             switch (newstates[cpu->cpu_index]) {
 449             case 0:
 450             case 1:
 451                 break; /* nothing to do here */
 452             case 's':
 453                 trace_gdbstub_op_stepping(cpu->cpu_index);
 454                 cpu_single_step(cpu, sstep_flags);
 455                 cpu_resume(cpu);
 456                 flag = 1;
 457                 break;
 458             case 'c':
 459                 trace_gdbstub_op_continue_cpu(cpu->cpu_index);
 460                 cpu_resume(cpu);
 461                 flag = 1;
 462                 break;
 463             default:
 464                 res = -1;
 465                 break;
 466             }
 467         }
 468     }
 469     if (flag) {
 470         qemu_clock_enable(QEMU_CLOCK_VIRTUAL, true);
 471     }
 472 #endif
 473     return res;
 474 }
 475
 476 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 477 {
 478 #ifdef CONFIG_USER_ONLY
 479     int ret;
 480
 481     while (len > 0) {
 482         ret = send(s->fd, buf, len, 0);
 483         if (ret < 0) {
 484             if (errno != EINTR)
 485                 return;
 486         } else {
 487             buf += ret;
 488             len -= ret;
 489         }
 490     }
 491 #else
 492     /* XXX this blocks entire thread. Rewrite to use
 493      * qemu_chr_fe_write and background I/O callbacks */
 494     qemu_chr_fe_write_all(&s->chr, buf, len);
 495 #endif
 496 }
 497
 498 static inline int fromhex(int v)
 499 {
 500     if (v >= '0' && v <= '9')
 501         return v - '0';
 502     else if (v >= 'A' && v <= 'F')
 503         return v - 'A' + 10;
 504     else if (v >= 'a' && v <= 'f')
 505         return v - 'a' + 10;
 506     else
 507         return 0;
 508 }
 509
 510 static inline int tohex(int v)
 511 {
 512     if (v < 10)
 513         return v + '0';
 514     else
 515         return v - 10 + 'a';
 516 }
 517
 518 /* writes 2*len+1 bytes in buf */
 519 static void memtohex(char *buf, const uint8_t *mem, int len)
 520 {
 521     int i, c;
 522     char *q;
 523     q = buf;
 524     for(i = 0; i < len; i++) {
 525         c = mem[i];
 526         *q++ = tohex(c >> 4);
 527         *q++ = tohex(c & 0xf);
 528     }
 529     *q = '\0';
 530 }
 531
 532 static void hextomem(uint8_t *mem, const char *buf, int len)
 533 {
 534     int i;
 535
 536     for(i = 0; i < len; i++) {
 537         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 538         buf += 2;
 539     }
 540 }
 541
 542 static void hexdump(const char *buf, int len,
 543                     void (*trace_fn)(size_t ofs, char const *text))
 544 {
 545     char line_buffer[3 * 16 + 4 + 16 + 1];
 546
 547     size_t i;
 548     for (i = 0; i < len || (i & 0xF); ++i) {
 549         size_t byte_ofs = i & 15;
 550
 551         if (byte_ofs == 0) {
 552             memset(line_buffer, ' ', 3 * 16 + 4 + 16);
 553             line_buffer[3 * 16 + 4 + 16] = 0;
 554         }
 555
 556         size_t col_group = (i >> 2) & 3;
 557         size_t hex_col = byte_ofs * 3 + col_group;
 558         size_t txt_col = 3 * 16 + 4 + byte_ofs;
 559
 560         if (i < len) {
 561             char value = buf[i];
 562
 563             line_buffer[hex_col + 0] = tohex((value >> 4) & 0xF);
 564             line_buffer[hex_col + 1] = tohex((value >> 0) & 0xF);
 565             line_buffer[txt_col + 0] = (value >= ' ' && value < 127)
 566                     ? value
 567                     : '.';
 568         }
 569
 570         if (byte_ofs == 0xF)
 571             trace_fn(i & -16, line_buffer);
 572     }
 573 }
 574
 575 /* return -1 if error, 0 if OK */
 576 static int put_packet_binary(GDBState *s, const char *buf, int len, bool dump)
 577 {
 578     int csum, i;
 579     uint8_t *p;
 580
 581     if (dump && trace_event_get_state_backends(TRACE_GDBSTUB_IO_BINARYREPLY)) {
 582         hexdump(buf, len, trace_gdbstub_io_binaryreply);
 583     }
 584
 585     for(;;) {
 586         p = s->last_packet;
 587         *(p++) = '$';
 588         memcpy(p, buf, len);
 589         p += len;
 590         csum = 0;
 591         for(i = 0; i < len; i++) {
 592             csum += buf[i];
 593         }
 594         *(p++) = '#';
 595         *(p++) = tohex((csum >> 4) & 0xf);
 596         *(p++) = tohex((csum) & 0xf);
 597
 598         s->last_packet_len = p - s->last_packet;
 599         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 600
 601 #ifdef CONFIG_USER_ONLY
 602         i = get_char(s);
 603         if (i < 0)
 604             return -1;
 605         if (i == '+')
 606             break;
 607 #else
 608         break;
 609 #endif
 610     }
 611     return 0;
 612 }
 613
 614 /* return -1 if error, 0 if OK */
 615 static int put_packet(GDBState *s, const char *buf)
 616 {
 617     trace_gdbstub_io_reply(buf);
 618
 619     return put_packet_binary(s, buf, strlen(buf), false);
 620 }
 621
 622 /* Encode data using the encoding for 'x' packets.  */
 623 static int memtox(char *buf, const char *mem, int len)
 624 {
 625     char *p = buf;
 626     char c;
 627
 628     while (len--) {
 629         c = *(mem++);
 630         switch (c) {
 631         case '#': case '$': case '*': case '}':
 632             *(p++) = '}';
 633             *(p++) = c ^ 0x20;
 634             break;
 635         default:
 636             *(p++) = c;
 637             break;
 638         }
 639     }
 640     return p - buf;
 641 }
 642
 643 static uint32_t gdb_get_cpu_pid(const GDBState *s, CPUState *cpu)
 644 {
 645 #ifndef CONFIG_USER_ONLY
 646     gchar *path, *name = NULL;
 647     Object *obj;
 648     CPUClusterState *cluster;
 649     uint32_t ret;
 650
 651     path = object_get_canonical_path(OBJECT(cpu));
 652
 653     if (path == NULL) {
 654         /* Return the default process' PID */
 655         ret = s->processes[s->process_num - 1].pid;
 656         goto out;
 657     }
 658
 659     name = object_get_canonical_path_component(OBJECT(cpu));
 660     assert(name != NULL);
 661
 662     /*
 663      * Retrieve the CPU parent path by removing the last '/' and the CPU name
 664      * from the CPU canonical path.
 665      */
 666     path[strlen(path) - strlen(name) - 1] = '\0';
 667
 668     obj = object_resolve_path_type(path, TYPE_CPU_CLUSTER, NULL);
 669
 670     if (obj == NULL) {
 671         /* Return the default process' PID */
 672         ret = s->processes[s->process_num - 1].pid;
 673         goto out;
 674     }
 675
 676     cluster = CPU_CLUSTER(obj);
 677     ret = cluster->cluster_id + 1;
 678
 679 out:
 680     g_free(name);
 681     g_free(path);
 682
 683     return ret;
 684
 685 #else
 686     /* TODO: In user mode, we should use the task state PID */
 687     return s->processes[s->process_num - 1].pid;
 688 #endif
 689 }
 690
 691 static const char *get_feature_xml(const char *p, const char **newp,
 692                                    CPUClass *cc)
 693 {
 694     size_t len;
 695     int i;
 696     const char *name;
 697     static char target_xml[1024];
 698
 699     len = 0;
 700     while (p[len] && p[len] != ':')
 701         len++;
 702     *newp = p + len;
 703
 704     name = NULL;
 705     if (strncmp(p, "target.xml", len) == 0) {
 706         /* Generate the XML description for this CPU.  */
 707         if (!target_xml[0]) {
 708             GDBRegisterState *r;
 709             CPUState *cpu = first_cpu;
 710
 711             pstrcat(target_xml, sizeof(target_xml),
 712                     "<?xml version=\"1.0\"?>"
 713                     "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
 714                     "<target>");
 715             if (cc->gdb_arch_name) {
 716                 gchar *arch = cc->gdb_arch_name(cpu);
 717                 pstrcat(target_xml, sizeof(target_xml), "<architecture>");
 718                 pstrcat(target_xml, sizeof(target_xml), arch);
 719                 pstrcat(target_xml, sizeof(target_xml), "</architecture>");
 720                 g_free(arch);
 721             }
 722             pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
 723             pstrcat(target_xml, sizeof(target_xml), cc->gdb_core_xml_file);
 724             pstrcat(target_xml, sizeof(target_xml), "\"/>");
 725             for (r = cpu->gdb_regs; r; r = r->next) {
 726                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
 727                 pstrcat(target_xml, sizeof(target_xml), r->xml);
 728                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
 729             }
 730             pstrcat(target_xml, sizeof(target_xml), "</target>");
 731         }
 732         return target_xml;
 733     }
 734     if (cc->gdb_get_dynamic_xml) {
 735         CPUState *cpu = first_cpu;
 736         char *xmlname = g_strndup(p, len);
 737         const char *xml = cc->gdb_get_dynamic_xml(cpu, xmlname);
 738
 739         g_free(xmlname);
 740         if (xml) {
 741             return xml;
 742         }
 743     }
 744     for (i = 0; ; i++) {
 745         name = xml_builtin[i][0];
 746         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
 747             break;
 748     }
 749     return name ? xml_builtin[i][1] : NULL;
 750 }
 751
 752 static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 753 {
 754     CPUClass *cc = CPU_GET_CLASS(cpu);
 755     CPUArchState *env = cpu->env_ptr;
 756     GDBRegisterState *r;
 757
 758     if (reg < cc->gdb_num_core_regs) {
 759         return cc->gdb_read_register(cpu, mem_buf, reg);
 760     }
 761
 762     for (r = cpu->gdb_regs; r; r = r->next) {
 763         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 764             return r->get_reg(env, mem_buf, reg - r->base_reg);
 765         }
 766     }
 767     return 0;
 768 }
 769
 770 static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 771 {
 772     CPUClass *cc = CPU_GET_CLASS(cpu);
 773     CPUArchState *env = cpu->env_ptr;
 774     GDBRegisterState *r;
 775
 776     if (reg < cc->gdb_num_core_regs) {
 777         return cc->gdb_write_register(cpu, mem_buf, reg);
 778     }
 779
 780     for (r = cpu->gdb_regs; r; r = r->next) {
 781         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 782             return r->set_reg(env, mem_buf, reg - r->base_reg);
 783         }
 784     }
 785     return 0;
 786 }
 787
 788 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
 789    specifies the first register number and these registers are included in
 790    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
 791    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
 792  */
 793
 794 void gdb_register_coprocessor(CPUState *cpu,
 795                               gdb_reg_cb get_reg, gdb_reg_cb set_reg,
 796                               int num_regs, const char *xml, int g_pos)
 797 {
 798     GDBRegisterState *s;
 799     GDBRegisterState **p;
 800
 801     p = &cpu->gdb_regs;
 802     while (*p) {
 803         /* Check for duplicates.  */
 804         if (strcmp((*p)->xml, xml) == 0)
 805             return;
 806         p = &(*p)->next;
 807     }
 808
 809     s = g_new0(GDBRegisterState, 1);
 810     s->base_reg = cpu->gdb_num_regs;
 811     s->num_regs = num_regs;
 812     s->get_reg = get_reg;
 813     s->set_reg = set_reg;
 814     s->xml = xml;
 815
 816     /* Add to end of list.  */
 817     cpu->gdb_num_regs += num_regs;
 818     *p = s;
 819     if (g_pos) {
 820         if (g_pos != s->base_reg) {
 821             error_report("Error: Bad gdb register numbering for '%s', "
 822                          "expected %d got %d", xml, g_pos, s->base_reg);
 823         } else {
 824             cpu->gdb_num_g_regs = cpu->gdb_num_regs;
 825         }
 826     }
 827 }
 828
 829 #ifndef CONFIG_USER_ONLY
 830 /* Translate GDB watchpoint type to a flags value for cpu_watchpoint_* */
 831 static inline int xlat_gdb_type(CPUState *cpu, int gdbtype)
 832 {
 833     static const int xlat[] = {
 834         [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
 835         [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
 836         [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
 837     };
 838
 839     CPUClass *cc = CPU_GET_CLASS(cpu);
 840     int cputype = xlat[gdbtype];
 841
 842     if (cc->gdb_stop_before_watchpoint) {
 843         cputype |= BP_STOP_BEFORE_ACCESS;
 844     }
 845     return cputype;
 846 }
 847 #endif
 848
 849 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
 850 {
 851     CPUState *cpu;
 852     int err = 0;
 853
 854     if (kvm_enabled()) {
 855         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 856     }
 857
 858     switch (type) {
 859     case GDB_BREAKPOINT_SW:
 860     case GDB_BREAKPOINT_HW:
 861         CPU_FOREACH(cpu) {
 862             err = cpu_breakpoint_insert(cpu, addr, BP_GDB, NULL);
 863             if (err) {
 864                 break;
 865             }
 866         }
 867         return err;
 868 #ifndef CONFIG_USER_ONLY
 869     case GDB_WATCHPOINT_WRITE:
 870     case GDB_WATCHPOINT_READ:
 871     case GDB_WATCHPOINT_ACCESS:
 872         CPU_FOREACH(cpu) {
 873             err = cpu_watchpoint_insert(cpu, addr, len,
 874                                         xlat_gdb_type(cpu, type), NULL);
 875             if (err) {
 876                 break;
 877             }
 878         }
 879         return err;
 880 #endif
 881     default:
 882         return -ENOSYS;
 883     }
 884 }
 885
 886 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
 887 {
 888     CPUState *cpu;
 889     int err = 0;
 890
 891     if (kvm_enabled()) {
 892         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 893     }
 894
 895     switch (type) {
 896     case GDB_BREAKPOINT_SW:
 897     case GDB_BREAKPOINT_HW:
 898         CPU_FOREACH(cpu) {
 899             err = cpu_breakpoint_remove(cpu, addr, BP_GDB);
 900             if (err) {
 901                 break;
 902             }
 903         }
 904         return err;
 905 #ifndef CONFIG_USER_ONLY
 906     case GDB_WATCHPOINT_WRITE:
 907     case GDB_WATCHPOINT_READ:
 908     case GDB_WATCHPOINT_ACCESS:
 909         CPU_FOREACH(cpu) {
 910             err = cpu_watchpoint_remove(cpu, addr, len,
 911                                         xlat_gdb_type(cpu, type));
 912             if (err)
 913                 break;
 914         }
 915         return err;
 916 #endif
 917     default:
 918         return -ENOSYS;
 919     }
 920 }
 921
 922 static void gdb_breakpoint_remove_all(void)
 923 {
 924     CPUState *cpu;
 925
 926     if (kvm_enabled()) {
 927         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
 928         return;
 929     }
 930
 931     CPU_FOREACH(cpu) {
 932         cpu_breakpoint_remove_all(cpu, BP_GDB);
 933 #ifndef CONFIG_USER_ONLY
 934         cpu_watchpoint_remove_all(cpu, BP_GDB);
 935 #endif
 936     }
 937 }
 938
 939 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 940 {
 941     CPUState *cpu = s->c_cpu;
 942
 943     cpu_synchronize_state(cpu);
 944     cpu_set_pc(cpu, pc);
 945 }
 946
 947 static CPUState *find_cpu(uint32_t thread_id)
 948 {
 949     CPUState *cpu;
 950
 951     CPU_FOREACH(cpu) {
 952         if (cpu_gdb_index(cpu) == thread_id) {
 953             return cpu;
 954         }
 955     }
 956
 957     return NULL;
 958 }
 959
 960 static char *gdb_fmt_thread_id(const GDBState *s, CPUState *cpu,
 961                            char *buf, size_t buf_size)
 962 {
 963     if (s->multiprocess) {
 964         snprintf(buf, buf_size, "p%02x.%02x",
 965                  gdb_get_cpu_pid(s, cpu), cpu_gdb_index(cpu));
 966     } else {
 967         snprintf(buf, buf_size, "%02x", cpu_gdb_index(cpu));
 968     }
 969
 970     return buf;
 971 }
 972
 973 static int is_query_packet(const char *p, const char *query, char separator)
 974 {
 975     unsigned int query_len = strlen(query);
 976
 977     return strncmp(p, query, query_len) == 0 &&
 978         (p[query_len] == '\0' || p[query_len] == separator);
 979 }
 980
 981 /**
 982  * gdb_handle_vcont - Parses and handles a vCont packet.
 983  * returns -ENOTSUP if a command is unsupported, -EINVAL or -ERANGE if there is
 984  *         a format error, 0 on success.
 985  */
 986 static int gdb_handle_vcont(GDBState *s, const char *p)
 987 {
 988     int res, idx, signal = 0;
 989     char cur_action;
 990     char *newstates;
 991     unsigned long tmp;
 992     CPUState *cpu;
 993 #ifdef CONFIG_USER_ONLY
 994     int max_cpus = 1; /* global variable max_cpus exists only in system mode */
 995
 996     CPU_FOREACH(cpu) {
 997         max_cpus = max_cpus <= cpu->cpu_index ? cpu->cpu_index + 1 : max_cpus;
 998     }
 999 #endif
1000     /* uninitialised CPUs stay 0 */
1001     newstates = g_new0(char, max_cpus);
1002
1003     /* mark valid CPUs with 1 */
1004     CPU_FOREACH(cpu) {
1005         newstates[cpu->cpu_index] = 1;
1006     }
1007
1008     /*
1009      * res keeps track of what error we are returning, with -ENOTSUP meaning
1010      * that the command is unknown or unsupported, thus returning an empty
1011      * packet, while -EINVAL and -ERANGE cause an E22 packet, due to invalid,
1012      *  or incorrect parameters passed.
1013      */
1014     res = 0;
1015     while (*p) {
1016         if (*p++ != ';') {
1017             res = -ENOTSUP;
1018             goto out;
1019         }
1020
1021         cur_action = *p++;
1022         if (cur_action == 'C' || cur_action == 'S') {
1023             cur_action = qemu_tolower(cur_action);
1024             res = qemu_strtoul(p + 1, &p, 16, &tmp);
1025             if (res) {
1026                 goto out;
1027             }
1028             signal = gdb_signal_to_target(tmp);
1029         } else if (cur_action != 'c' && cur_action != 's') {
1030             /* unknown/invalid/unsupported command */
1031             res = -ENOTSUP;
1032             goto out;
1033         }
1034         /* thread specification. special values: (none), -1 = all; 0 = any */
1035         if ((p[0] == ':' && p[1] == '-' && p[2] == '1') || (p[0] != ':')) {
1036             if (*p == ':') {
1037                 p += 3;
1038             }
1039             for (idx = 0; idx < max_cpus; idx++) {
1040                 if (newstates[idx] == 1) {
1041                     newstates[idx] = cur_action;
1042                 }
1043             }
1044         } else if (*p == ':') {
1045             p++;
1046             res = qemu_strtoul(p, &p, 16, &tmp);
1047             if (res) {
1048                 goto out;
1049             }
1050
1051             /* 0 means any thread, so we pick the first valid CPU */
1052             cpu = tmp ? find_cpu(tmp) : first_cpu;
1053
1054             /* invalid CPU/thread specified */
1055             if (!cpu) {
1056                 res = -EINVAL;
1057                 goto out;
1058             }
1059
1060             /* only use if no previous match occourred */
1061             if (newstates[cpu->cpu_index] == 1) {
1062                 newstates[cpu->cpu_index] = cur_action;
1063             }
1064         }
1065     }
1066     s->signal = signal;
1067     gdb_continue_partial(s, newstates);
1068
1069 out:
1070     g_free(newstates);
1071
1072     return res;
1073 }
1074
1075 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1076 {
1077     CPUState *cpu;
1078     CPUClass *cc;
1079     const char *p;
1080     uint32_t thread;
1081     int ch, reg_size, type, res;
1082     uint8_t mem_buf[MAX_PACKET_LENGTH];
1083     char buf[sizeof(mem_buf) + 1 /* trailing NUL */];
1084     char thread_id[16];
1085     uint8_t *registers;
1086     target_ulong addr, len;
1087
1088     trace_gdbstub_io_command(line_buf);
1089
1090     p = line_buf;
1091     ch = *p++;
1092     switch(ch) {
1093     case '?':
1094         /* TODO: Make this return the correct value for user-mode.  */
1095         snprintf(buf, sizeof(buf), "T%02xthread:%s;", GDB_SIGNAL_TRAP,
1096                  gdb_fmt_thread_id(s, s->c_cpu, thread_id, sizeof(thread_id)));
1097         put_packet(s, buf);
1098         /* Remove all the breakpoints when this query is issued,
1099          * because gdb is doing and initial connect and the state
1100          * should be cleaned up.
1101          */
1102         gdb_breakpoint_remove_all();
1103         break;
1104     case 'c':
1105         if (*p != '\0') {
1106             addr = strtoull(p, (char **)&p, 16);
1107             gdb_set_cpu_pc(s, addr);
1108         }
1109         s->signal = 0;
1110         gdb_continue(s);
1111         return RS_IDLE;
1112     case 'C':
1113         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1114         if (s->signal == -1)
1115             s->signal = 0;
1116         gdb_continue(s);
1117         return RS_IDLE;
1118     case 'v':
1119         if (strncmp(p, "Cont", 4) == 0) {
1120             p += 4;
1121             if (*p == '?') {
1122                 put_packet(s, "vCont;c;C;s;S");
1123                 break;
1124             }
1125
1126             res = gdb_handle_vcont(s, p);
1127
1128             if (res) {
1129                 if ((res == -EINVAL) || (res == -ERANGE)) {
1130                     put_packet(s, "E22");
1131                     break;
1132                 }
1133                 goto unknown_command;
1134             }
1135             break;
1136         } else {
1137             goto unknown_command;
1138         }
1139     case 'k':
1140         /* Kill the target */
1141         error_report("QEMU: Terminated via GDBstub");
1142         exit(0);
1143     case 'D':
1144         /* Detach packet */
1145         gdb_breakpoint_remove_all();
1146         gdb_syscall_mode = GDB_SYS_DISABLED;
1147         gdb_continue(s);
1148         put_packet(s, "OK");
1149         break;
1150     case 's':
1151         if (*p != '\0') {
1152             addr = strtoull(p, (char **)&p, 16);
1153             gdb_set_cpu_pc(s, addr);
1154         }
1155         cpu_single_step(s->c_cpu, sstep_flags);
1156         gdb_continue(s);
1157         return RS_IDLE;
1158     case 'F':
1159         {
1160             target_ulong ret;
1161             target_ulong err;
1162
1163             ret = strtoull(p, (char **)&p, 16);
1164             if (*p == ',') {
1165                 p++;
1166                 err = strtoull(p, (char **)&p, 16);
1167             } else {
1168                 err = 0;
1169             }
1170             if (*p == ',')
1171                 p++;
1172             type = *p;
1173             if (s->current_syscall_cb) {
1174                 s->current_syscall_cb(s->c_cpu, ret, err);
1175                 s->current_syscall_cb = NULL;
1176             }
1177             if (type == 'C') {
1178                 put_packet(s, "T02");
1179             } else {
1180                 gdb_continue(s);
1181             }
1182         }
1183         break;
1184     case 'g':
1185         cpu_synchronize_state(s->g_cpu);
1186         len = 0;
1187         for (addr = 0; addr < s->g_cpu->gdb_num_g_regs; addr++) {
1188             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1189             len += reg_size;
1190         }
1191         memtohex(buf, mem_buf, len);
1192         put_packet(s, buf);
1193         break;
1194     case 'G':
1195         cpu_synchronize_state(s->g_cpu);
1196         registers = mem_buf;
1197         len = strlen(p) / 2;
1198         hextomem((uint8_t *)registers, p, len);
1199         for (addr = 0; addr < s->g_cpu->gdb_num_g_regs && len > 0; addr++) {
1200             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1201             len -= reg_size;
1202             registers += reg_size;
1203         }
1204         put_packet(s, "OK");
1205         break;
1206     case 'm':
1207         addr = strtoull(p, (char **)&p, 16);
1208         if (*p == ',')
1209             p++;
1210         len = strtoull(p, NULL, 16);
1211
1212         /* memtohex() doubles the required space */
1213         if (len > MAX_PACKET_LENGTH / 2) {
1214             put_packet (s, "E22");
1215             break;
1216         }
1217
1218         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
1219             put_packet (s, "E14");
1220         } else {
1221             memtohex(buf, mem_buf, len);
1222             put_packet(s, buf);
1223         }
1224         break;
1225     case 'M':
1226         addr = strtoull(p, (char **)&p, 16);
1227         if (*p == ',')
1228             p++;
1229         len = strtoull(p, (char **)&p, 16);
1230         if (*p == ':')
1231             p++;
1232
1233         /* hextomem() reads 2*len bytes */
1234         if (len > strlen(p) / 2) {
1235             put_packet (s, "E22");
1236             break;
1237         }
1238         hextomem(mem_buf, p, len);
1239         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
1240                                    true) != 0) {
1241             put_packet(s, "E14");
1242         } else {
1243             put_packet(s, "OK");
1244         }
1245         break;
1246     case 'p':
1247         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1248            This works, but can be very slow.  Anything new enough to
1249            understand XML also knows how to use this properly.  */
1250         if (!gdb_has_xml)
1251             goto unknown_command;
1252         addr = strtoull(p, (char **)&p, 16);
1253         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1254         if (reg_size) {
1255             memtohex(buf, mem_buf, reg_size);
1256             put_packet(s, buf);
1257         } else {
1258             put_packet(s, "E14");
1259         }
1260         break;
1261     case 'P':
1262         if (!gdb_has_xml)
1263             goto unknown_command;
1264         addr = strtoull(p, (char **)&p, 16);
1265         if (*p == '=')
1266             p++;
1267         reg_size = strlen(p) / 2;
1268         hextomem(mem_buf, p, reg_size);
1269         gdb_write_register(s->g_cpu, mem_buf, addr);
1270         put_packet(s, "OK");
1271         break;
1272     case 'Z':
1273     case 'z':
1274         type = strtoul(p, (char **)&p, 16);
1275         if (*p == ',')
1276             p++;
1277         addr = strtoull(p, (char **)&p, 16);
1278         if (*p == ',')
1279             p++;
1280         len = strtoull(p, (char **)&p, 16);
1281         if (ch == 'Z')
1282             res = gdb_breakpoint_insert(addr, len, type);
1283         else
1284             res = gdb_breakpoint_remove(addr, len, type);
1285         if (res >= 0)
1286              put_packet(s, "OK");
1287         else if (res == -ENOSYS)
1288             put_packet(s, "");
1289         else
1290             put_packet(s, "E22");
1291         break;
1292     case 'H':
1293         type = *p++;
1294         thread = strtoull(p, (char **)&p, 16);
1295         if (thread == -1 || thread == 0) {
1296             put_packet(s, "OK");
1297             break;
1298         }
1299         cpu = find_cpu(thread);
1300         if (cpu == NULL) {
1301             put_packet(s, "E22");
1302             break;
1303         }
1304         switch (type) {
1305         case 'c':
1306             s->c_cpu = cpu;
1307             put_packet(s, "OK");
1308             break;
1309         case 'g':
1310             s->g_cpu = cpu;
1311             put_packet(s, "OK");
1312             break;
1313         default:
1314              put_packet(s, "E22");
1315              break;
1316         }
1317         break;
1318     case 'T':
1319         thread = strtoull(p, (char **)&p, 16);
1320         cpu = find_cpu(thread);
1321
1322         if (cpu != NULL) {
1323             put_packet(s, "OK");
1324         } else {
1325             put_packet(s, "E22");
1326         }
1327         break;
1328     case 'q':
1329     case 'Q':
1330         /* parse any 'q' packets here */
1331         if (!strcmp(p,"qemu.sstepbits")) {
1332             /* Query Breakpoint bit definitions */
1333             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1334                      SSTEP_ENABLE,
1335                      SSTEP_NOIRQ,
1336                      SSTEP_NOTIMER);
1337             put_packet(s, buf);
1338             break;
1339         } else if (is_query_packet(p, "qemu.sstep", '=')) {
1340             /* Display or change the sstep_flags */
1341             p += 10;
1342             if (*p != '=') {
1343                 /* Display current setting */
1344                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1345                 put_packet(s, buf);
1346                 break;
1347             }
1348             p++;
1349             type = strtoul(p, (char **)&p, 16);
1350             sstep_flags = type;
1351             put_packet(s, "OK");
1352             break;
1353         } else if (strcmp(p,"C") == 0) {
1354             /* "Current thread" remains vague in the spec, so always return
1355              *  the first CPU (gdb returns the first thread). */
1356             put_packet(s, "QC1");
1357             break;
1358         } else if (strcmp(p,"fThreadInfo") == 0) {
1359             s->query_cpu = first_cpu;
1360             goto report_cpuinfo;
1361         } else if (strcmp(p,"sThreadInfo") == 0) {
1362         report_cpuinfo:
1363             if (s->query_cpu) {
1364                 snprintf(buf, sizeof(buf), "m%x", cpu_gdb_index(s->query_cpu));
1365                 put_packet(s, buf);
1366                 s->query_cpu = CPU_NEXT(s->query_cpu);
1367             } else
1368                 put_packet(s, "l");
1369             break;
1370         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1371             thread = strtoull(p+16, (char **)&p, 16);
1372             cpu = find_cpu(thread);
1373             if (cpu != NULL) {
1374                 cpu_synchronize_state(cpu);
1375                 /* memtohex() doubles the required space */
1376                 len = snprintf((char *)mem_buf, sizeof(buf) / 2,
1377                                "CPU#%d [%s]", cpu->cpu_index,
1378                                cpu->halted ? "halted " : "running");
1379                 trace_gdbstub_op_extra_info((char *)mem_buf);
1380                 memtohex(buf, mem_buf, len);
1381                 put_packet(s, buf);
1382             }
1383             break;
1384         }
1385 #ifdef CONFIG_USER_ONLY
1386         else if (strcmp(p, "Offsets") == 0) {
1387             TaskState *ts = s->c_cpu->opaque;
1388
1389             snprintf(buf, sizeof(buf),
1390                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1391                      ";Bss=" TARGET_ABI_FMT_lx,
1392                      ts->info->code_offset,
1393                      ts->info->data_offset,
1394                      ts->info->data_offset);
1395             put_packet(s, buf);
1396             break;
1397         }
1398 #else /* !CONFIG_USER_ONLY */
1399         else if (strncmp(p, "Rcmd,", 5) == 0) {
1400             int len = strlen(p + 5);
1401
1402             if ((len % 2) != 0) {
1403                 put_packet(s, "E01");
1404                 break;
1405             }
1406             len = len / 2;
1407             hextomem(mem_buf, p + 5, len);
1408             mem_buf[len++] = 0;
1409             qemu_chr_be_write(s->mon_chr, mem_buf, len);
1410             put_packet(s, "OK");
1411             break;
1412         }
1413 #endif /* !CONFIG_USER_ONLY */
1414         if (is_query_packet(p, "Supported", ':')) {
1415             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1416             cc = CPU_GET_CLASS(first_cpu);
1417             if (cc->gdb_core_xml_file != NULL) {
1418                 pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1419             }
1420             put_packet(s, buf);
1421             break;
1422         }
1423         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1424             const char *xml;
1425             target_ulong total_len;
1426
1427             cc = CPU_GET_CLASS(first_cpu);
1428             if (cc->gdb_core_xml_file == NULL) {
1429                 goto unknown_command;
1430             }
1431
1432             gdb_has_xml = true;
1433             p += 19;
1434             xml = get_feature_xml(p, &p, cc);
1435             if (!xml) {
1436                 snprintf(buf, sizeof(buf), "E00");
1437                 put_packet(s, buf);
1438                 break;
1439             }
1440
1441             if (*p == ':')
1442                 p++;
1443             addr = strtoul(p, (char **)&p, 16);
1444             if (*p == ',')
1445                 p++;
1446             len = strtoul(p, (char **)&p, 16);
1447
1448             total_len = strlen(xml);
1449             if (addr > total_len) {
1450                 snprintf(buf, sizeof(buf), "E00");
1451                 put_packet(s, buf);
1452                 break;
1453             }
1454             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1455                 len = (MAX_PACKET_LENGTH - 5) / 2;
1456             if (len < total_len - addr) {
1457                 buf[0] = 'm';
1458                 len = memtox(buf + 1, xml + addr, len);
1459             } else {
1460                 buf[0] = 'l';
1461                 len = memtox(buf + 1, xml + addr, total_len - addr);
1462             }
1463             put_packet_binary(s, buf, len + 1, true);
1464             break;
1465         }
1466         if (is_query_packet(p, "Attached", ':')) {
1467             put_packet(s, GDB_ATTACHED);
1468             break;
1469         }
1470         /* Unrecognised 'q' command.  */
1471         goto unknown_command;
1472
1473     default:
1474     unknown_command:
1475         /* put empty packet */
1476         buf[0] = '\0';
1477         put_packet(s, buf);
1478         break;
1479     }
1480     return RS_IDLE;
1481 }
1482
1483 void gdb_set_stop_cpu(CPUState *cpu)
1484 {
1485     gdbserver_state->c_cpu = cpu;
1486     gdbserver_state->g_cpu = cpu;
1487 }
1488
1489 #ifndef CONFIG_USER_ONLY
1490 static void gdb_vm_state_change(void *opaque, int running, RunState state)
1491 {
1492     GDBState *s = gdbserver_state;
1493     CPUState *cpu = s->c_cpu;
1494     char buf[256];
1495     const char *type;
1496     int ret;
1497
1498     if (running || s->state == RS_INACTIVE) {
1499         return;
1500     }
1501     /* Is there a GDB syscall waiting to be sent?  */
1502     if (s->current_syscall_cb) {
1503         put_packet(s, s->syscall_buf);
1504         return;
1505     }
1506     switch (state) {
1507     case RUN_STATE_DEBUG:
1508         if (cpu->watchpoint_hit) {
1509             switch (cpu->watchpoint_hit->flags & BP_MEM_ACCESS) {
1510             case BP_MEM_READ:
1511                 type = "r";
1512                 break;
1513             case BP_MEM_ACCESS:
1514                 type = "a";
1515                 break;
1516             default:
1517                 type = "";
1518                 break;
1519             }
1520             trace_gdbstub_hit_watchpoint(type, cpu_gdb_index(cpu),
1521                     (target_ulong)cpu->watchpoint_hit->vaddr);
1522             snprintf(buf, sizeof(buf),
1523                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1524                      GDB_SIGNAL_TRAP, cpu_gdb_index(cpu), type,
1525                      (target_ulong)cpu->watchpoint_hit->vaddr);
1526             cpu->watchpoint_hit = NULL;
1527             goto send_packet;
1528         } else {
1529             trace_gdbstub_hit_break();
1530         }
1531         tb_flush(cpu);
1532         ret = GDB_SIGNAL_TRAP;
1533         break;
1534     case RUN_STATE_PAUSED:
1535         trace_gdbstub_hit_paused();
1536         ret = GDB_SIGNAL_INT;
1537         break;
1538     case RUN_STATE_SHUTDOWN:
1539         trace_gdbstub_hit_shutdown();
1540         ret = GDB_SIGNAL_QUIT;
1541         break;
1542     case RUN_STATE_IO_ERROR:
1543         trace_gdbstub_hit_io_error();
1544         ret = GDB_SIGNAL_IO;
1545         break;
1546     case RUN_STATE_WATCHDOG:
1547         trace_gdbstub_hit_watchdog();
1548         ret = GDB_SIGNAL_ALRM;
1549         break;
1550     case RUN_STATE_INTERNAL_ERROR:
1551         trace_gdbstub_hit_internal_error();
1552         ret = GDB_SIGNAL_ABRT;
1553         break;
1554     case RUN_STATE_SAVE_VM:
1555     case RUN_STATE_RESTORE_VM:
1556         return;
1557     case RUN_STATE_FINISH_MIGRATE:
1558         ret = GDB_SIGNAL_XCPU;
1559         break;
1560     default:
1561         trace_gdbstub_hit_unknown(state);
1562         ret = GDB_SIGNAL_UNKNOWN;
1563         break;
1564     }
1565     gdb_set_stop_cpu(cpu);
1566     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, cpu_gdb_index(cpu));
1567
1568 send_packet:
1569     put_packet(s, buf);
1570
1571     /* disable single step if it was enabled */
1572     cpu_single_step(cpu, 0);
1573 }
1574 #endif
1575
1576 /* Send a gdb syscall request.
1577    This accepts limited printf-style format specifiers, specifically:
1578     %x  - target_ulong argument printed in hex.
1579     %lx - 64-bit argument printed in hex.
1580     %s  - string pointer (target_ulong) and length (int) pair.  */
1581 void gdb_do_syscallv(gdb_syscall_complete_cb cb, const char *fmt, va_list va)
1582 {
1583     char *p;
1584     char *p_end;
1585     target_ulong addr;
1586     uint64_t i64;
1587     GDBState *s;
1588
1589     s = gdbserver_state;
1590     if (!s)
1591         return;
1592     s->current_syscall_cb = cb;
1593 #ifndef CONFIG_USER_ONLY
1594     vm_stop(RUN_STATE_DEBUG);
1595 #endif
1596     p = s->syscall_buf;
1597     p_end = &s->syscall_buf[sizeof(s->syscall_buf)];
1598     *(p++) = 'F';
1599     while (*fmt) {
1600         if (*fmt == '%') {
1601             fmt++;
1602             switch (*fmt++) {
1603             case 'x':
1604                 addr = va_arg(va, target_ulong);
1605                 p += snprintf(p, p_end - p, TARGET_FMT_lx, addr);
1606                 break;
1607             case 'l':
1608                 if (*(fmt++) != 'x')
1609                     goto bad_format;
1610                 i64 = va_arg(va, uint64_t);
1611                 p += snprintf(p, p_end - p, "%" PRIx64, i64);
1612                 break;
1613             case 's':
1614                 addr = va_arg(va, target_ulong);
1615                 p += snprintf(p, p_end - p, TARGET_FMT_lx "/%x",
1616                               addr, va_arg(va, int));
1617                 break;
1618             default:
1619             bad_format:
1620                 error_report("gdbstub: Bad syscall format string '%s'",
1621                              fmt - 1);
1622                 break;
1623             }
1624         } else {
1625             *(p++) = *(fmt++);
1626         }
1627     }
1628     *p = 0;
1629 #ifdef CONFIG_USER_ONLY
1630     put_packet(s, s->syscall_buf);
1631     /* Return control to gdb for it to process the syscall request.
1632      * Since the protocol requires that gdb hands control back to us
1633      * using a "here are the results" F packet, we don't need to check
1634      * gdb_handlesig's return value (which is the signal to deliver if
1635      * execution was resumed via a continue packet).
1636      */
1637     gdb_handlesig(s->c_cpu, 0);
1638 #else
1639     /* In this case wait to send the syscall packet until notification that
1640        the CPU has stopped.  This must be done because if the packet is sent
1641        now the reply from the syscall request could be received while the CPU
1642        is still in the running state, which can cause packets to be dropped
1643        and state transition 'T' packets to be sent while the syscall is still
1644        being processed.  */
1645     qemu_cpu_kick(s->c_cpu);
1646 #endif
1647 }
1648
1649 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1650 {
1651     va_list va;
1652
1653     va_start(va, fmt);
1654     gdb_do_syscallv(cb, fmt, va);
1655     va_end(va);
1656 }
1657
1658 static void gdb_read_byte(GDBState *s, int ch)
1659 {
1660     uint8_t reply;
1661
1662 #ifndef CONFIG_USER_ONLY
1663     if (s->last_packet_len) {
1664         /* Waiting for a response to the last packet.  If we see the start
1665            of a new command then abandon the previous response.  */
1666         if (ch == '-') {
1667             trace_gdbstub_err_got_nack();
1668             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
1669         } else if (ch == '+') {
1670             trace_gdbstub_io_got_ack();
1671         } else {
1672             trace_gdbstub_io_got_unexpected((uint8_t)ch);
1673         }
1674
1675         if (ch == '+' || ch == '$')
1676             s->last_packet_len = 0;
1677         if (ch != '$')
1678             return;
1679     }
1680     if (runstate_is_running()) {
1681         /* when the CPU is running, we cannot do anything except stop
1682            it when receiving a char */
1683         vm_stop(RUN_STATE_PAUSED);
1684     } else
1685 #endif
1686     {
1687         switch(s->state) {
1688         case RS_IDLE:
1689             if (ch == '$') {
1690                 /* start of command packet */
1691                 s->line_buf_index = 0;
1692                 s->line_sum = 0;
1693                 s->state = RS_GETLINE;
1694             } else {
1695                 trace_gdbstub_err_garbage((uint8_t)ch);
1696             }
1697             break;
1698         case RS_GETLINE:
1699             if (ch == '}') {
1700                 /* start escape sequence */
1701                 s->state = RS_GETLINE_ESC;
1702                 s->line_sum += ch;
1703             } else if (ch == '*') {
1704                 /* start run length encoding sequence */
1705                 s->state = RS_GETLINE_RLE;
1706                 s->line_sum += ch;
1707             } else if (ch == '#') {
1708                 /* end of command, start of checksum*/
1709                 s->state = RS_CHKSUM1;
1710             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1711                 trace_gdbstub_err_overrun();
1712                 s->state = RS_IDLE;
1713             } else {
1714                 /* unescaped command character */
1715                 s->line_buf[s->line_buf_index++] = ch;
1716                 s->line_sum += ch;
1717             }
1718             break;
1719         case RS_GETLINE_ESC:
1720             if (ch == '#') {
1721                 /* unexpected end of command in escape sequence */
1722                 s->state = RS_CHKSUM1;
1723             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1724                 /* command buffer overrun */
1725                 trace_gdbstub_err_overrun();
1726                 s->state = RS_IDLE;
1727             } else {
1728                 /* parse escaped character and leave escape state */
1729                 s->line_buf[s->line_buf_index++] = ch ^ 0x20;
1730                 s->line_sum += ch;
1731                 s->state = RS_GETLINE;
1732             }
1733             break;
1734         case RS_GETLINE_RLE:
1735             if (ch < ' ') {
1736                 /* invalid RLE count encoding */
1737                 trace_gdbstub_err_invalid_repeat((uint8_t)ch);
1738                 s->state = RS_GETLINE;
1739             } else {
1740                 /* decode repeat length */
1741                 int repeat = (unsigned char)ch - ' ' + 3;
1742                 if (s->line_buf_index + repeat >= sizeof(s->line_buf) - 1) {
1743                     /* that many repeats would overrun the command buffer */
1744                     trace_gdbstub_err_overrun();
1745                     s->state = RS_IDLE;
1746                 } else if (s->line_buf_index < 1) {
1747                     /* got a repeat but we have nothing to repeat */
1748                     trace_gdbstub_err_invalid_rle();
1749                     s->state = RS_GETLINE;
1750                 } else {
1751                     /* repeat the last character */
1752                     memset(s->line_buf + s->line_buf_index,
1753                            s->line_buf[s->line_buf_index - 1], repeat);
1754                     s->line_buf_index += repeat;
1755                     s->line_sum += ch;
1756                     s->state = RS_GETLINE;
1757                 }
1758             }
1759             break;
1760         case RS_CHKSUM1:
1761             /* get high hex digit of checksum */
1762             if (!isxdigit(ch)) {
1763                 trace_gdbstub_err_checksum_invalid((uint8_t)ch);
1764                 s->state = RS_GETLINE;
1765                 break;
1766             }
1767             s->line_buf[s->line_buf_index] = '\0';
1768             s->line_csum = fromhex(ch) << 4;
1769             s->state = RS_CHKSUM2;
1770             break;
1771         case RS_CHKSUM2:
1772             /* get low hex digit of checksum */
1773             if (!isxdigit(ch)) {
1774                 trace_gdbstub_err_checksum_invalid((uint8_t)ch);
1775                 s->state = RS_GETLINE;
1776                 break;
1777             }
1778             s->line_csum |= fromhex(ch);
1779
1780             if (s->line_csum != (s->line_sum & 0xff)) {
1781                 trace_gdbstub_err_checksum_incorrect(s->line_sum, s->line_csum);
1782                 /* send NAK reply */
1783                 reply = '-';
1784                 put_buffer(s, &reply, 1);
1785                 s->state = RS_IDLE;
1786             } else {
1787                 /* send ACK reply */
1788                 reply = '+';
1789                 put_buffer(s, &reply, 1);
1790                 s->state = gdb_handle_packet(s, s->line_buf);
1791             }
1792             break;
1793         default:
1794             abort();
1795         }
1796     }
1797 }
1798
1799 /* Tell the remote gdb that the process has exited.  */
1800 void gdb_exit(CPUArchState *env, int code)
1801 {
1802   GDBState *s;
1803   char buf[4];
1804
1805   s = gdbserver_state;
1806   if (!s) {
1807       return;
1808   }
1809 #ifdef CONFIG_USER_ONLY
1810   if (gdbserver_fd < 0 || s->fd < 0) {
1811       return;
1812   }
1813 #endif
1814
1815   trace_gdbstub_op_exiting((uint8_t)code);
1816
1817   snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
1818   put_packet(s, buf);
1819
1820 #ifndef CONFIG_USER_ONLY
1821   qemu_chr_fe_deinit(&s->chr, true);
1822 #endif
1823 }
1824
1825 /*
1826  * Create the process that will contain all the "orphan" CPUs (that are not
1827  * part of a CPU cluster). Note that if this process contains no CPUs, it won't
1828  * be attachable and thus will be invisible to the user.
1829  */
1830 static void create_default_process(GDBState *s)
1831 {
1832     GDBProcess *process;
1833     int max_pid = 0;
1834
1835     if (s->process_num) {
1836         max_pid = s->processes[s->process_num - 1].pid;
1837     }
1838
1839     s->processes = g_renew(GDBProcess, s->processes, ++s->process_num);
1840     process = &s->processes[s->process_num - 1];
1841
1842     /* We need an available PID slot for this process */
1843     assert(max_pid < UINT32_MAX);
1844
1845     process->pid = max_pid + 1;
1846     process->attached = false;
1847 }
1848
1849 #ifdef CONFIG_USER_ONLY
1850 int
1851 gdb_handlesig(CPUState *cpu, int sig)
1852 {
1853     GDBState *s;
1854     char buf[256];
1855     int n;
1856
1857     s = gdbserver_state;
1858     if (gdbserver_fd < 0 || s->fd < 0) {
1859         return sig;
1860     }
1861
1862     /* disable single step if it was enabled */
1863     cpu_single_step(cpu, 0);
1864     tb_flush(cpu);
1865
1866     if (sig != 0) {
1867         snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));
1868         put_packet(s, buf);
1869     }
1870     /* put_packet() might have detected that the peer terminated the
1871        connection.  */
1872     if (s->fd < 0) {
1873         return sig;
1874     }
1875
1876     sig = 0;
1877     s->state = RS_IDLE;
1878     s->running_state = 0;
1879     while (s->running_state == 0) {
1880         n = read(s->fd, buf, 256);
1881         if (n > 0) {
1882             int i;
1883
1884             for (i = 0; i < n; i++) {
1885                 gdb_read_byte(s, buf[i]);
1886             }
1887         } else {
1888             /* XXX: Connection closed.  Should probably wait for another
1889                connection before continuing.  */
1890             if (n == 0) {
1891                 close(s->fd);
1892             }
1893             s->fd = -1;
1894             return sig;
1895         }
1896     }
1897     sig = s->signal;
1898     s->signal = 0;
1899     return sig;
1900 }
1901
1902 /* Tell the remote gdb that the process has exited due to SIG.  */
1903 void gdb_signalled(CPUArchState *env, int sig)
1904 {
1905     GDBState *s;
1906     char buf[4];
1907
1908     s = gdbserver_state;
1909     if (gdbserver_fd < 0 || s->fd < 0) {
1910         return;
1911     }
1912
1913     snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb(sig));
1914     put_packet(s, buf);
1915 }
1916
1917 static bool gdb_accept(void)
1918 {
1919     GDBState *s;
1920     struct sockaddr_in sockaddr;
1921     socklen_t len;
1922     int fd;
1923
1924     for(;;) {
1925         len = sizeof(sockaddr);
1926         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
1927         if (fd < 0 && errno != EINTR) {
1928             perror("accept");
1929             return false;
1930         } else if (fd >= 0) {
1931             qemu_set_cloexec(fd);
1932             break;
1933         }
1934     }
1935
1936     /* set short latency */
1937     if (socket_set_nodelay(fd)) {
1938         perror("setsockopt");
1939         close(fd);
1940         return false;
1941     }
1942
1943     s = g_malloc0(sizeof(GDBState));
1944     s->c_cpu = first_cpu;
1945     s->g_cpu = first_cpu;
1946     create_default_process(s);
1947     s->fd = fd;
1948     gdb_has_xml = false;
1949
1950     gdbserver_state = s;
1951     return true;
1952 }
1953
1954 static int gdbserver_open(int port)
1955 {
1956     struct sockaddr_in sockaddr;
1957     int fd, ret;
1958
1959     fd = socket(PF_INET, SOCK_STREAM, 0);
1960     if (fd < 0) {
1961         perror("socket");
1962         return -1;
1963     }
1964     qemu_set_cloexec(fd);
1965
1966     socket_set_fast_reuse(fd);
1967
1968     sockaddr.sin_family = AF_INET;
1969     sockaddr.sin_port = htons(port);
1970     sockaddr.sin_addr.s_addr = 0;
1971     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
1972     if (ret < 0) {
1973         perror("bind");
1974         close(fd);
1975         return -1;
1976     }
1977     ret = listen(fd, 1);
1978     if (ret < 0) {
1979         perror("listen");
1980         close(fd);
1981         return -1;
1982     }
1983     return fd;
1984 }
1985
1986 int gdbserver_start(int port)
1987 {
1988     gdbserver_fd = gdbserver_open(port);
1989     if (gdbserver_fd < 0)
1990         return -1;
1991     /* accept connections */
1992     if (!gdb_accept()) {
1993         close(gdbserver_fd);
1994         gdbserver_fd = -1;
1995         return -1;
1996     }
1997     return 0;
1998 }
1999
2000 /* Disable gdb stub for child processes.  */
2001 void gdbserver_fork(CPUState *cpu)
2002 {
2003     GDBState *s = gdbserver_state;
2004
2005     if (gdbserver_fd < 0 || s->fd < 0) {
2006         return;
2007     }
2008     close(s->fd);
2009     s->fd = -1;
2010     cpu_breakpoint_remove_all(cpu, BP_GDB);
2011     cpu_watchpoint_remove_all(cpu, BP_GDB);
2012 }
2013 #else
2014 static int gdb_chr_can_receive(void *opaque)
2015 {
2016   /* We can handle an arbitrarily large amount of data.
2017    Pick the maximum packet size, which is as good as anything.  */
2018   return MAX_PACKET_LENGTH;
2019 }
2020
2021 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2022 {
2023     int i;
2024
2025     for (i = 0; i < size; i++) {
2026         gdb_read_byte(gdbserver_state, buf[i]);
2027     }
2028 }
2029
2030 static void gdb_chr_event(void *opaque, int event)
2031 {
2032     switch (event) {
2033     case CHR_EVENT_OPENED:
2034         vm_stop(RUN_STATE_PAUSED);
2035         gdb_has_xml = false;
2036         break;
2037     default:
2038         break;
2039     }
2040 }
2041
2042 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2043 {
2044     char buf[MAX_PACKET_LENGTH];
2045
2046     buf[0] = 'O';
2047     if (len > (MAX_PACKET_LENGTH/2) - 1)
2048         len = (MAX_PACKET_LENGTH/2) - 1;
2049     memtohex(buf + 1, (uint8_t *)msg, len);
2050     put_packet(s, buf);
2051 }
2052
2053 static int gdb_monitor_write(Chardev *chr, const uint8_t *buf, int len)
2054 {
2055     const char *p = (const char *)buf;
2056     int max_sz;
2057
2058     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2059     for (;;) {
2060         if (len <= max_sz) {
2061             gdb_monitor_output(gdbserver_state, p, len);
2062             break;
2063         }
2064         gdb_monitor_output(gdbserver_state, p, max_sz);
2065         p += max_sz;
2066         len -= max_sz;
2067     }
2068     return len;
2069 }
2070
2071 #ifndef _WIN32
2072 static void gdb_sigterm_handler(int signal)
2073 {
2074     if (runstate_is_running()) {
2075         vm_stop(RUN_STATE_PAUSED);
2076     }
2077 }
2078 #endif
2079
2080 static void gdb_monitor_open(Chardev *chr, ChardevBackend *backend,
2081                              bool *be_opened, Error **errp)
2082 {
2083     *be_opened = false;
2084 }
2085
2086 static void char_gdb_class_init(ObjectClass *oc, void *data)
2087 {
2088     ChardevClass *cc = CHARDEV_CLASS(oc);
2089
2090     cc->internal = true;
2091     cc->open = gdb_monitor_open;
2092     cc->chr_write = gdb_monitor_write;
2093 }
2094
2095 #define TYPE_CHARDEV_GDB "chardev-gdb"
2096
2097 static const TypeInfo char_gdb_type_info = {
2098     .name = TYPE_CHARDEV_GDB,
2099     .parent = TYPE_CHARDEV,
2100     .class_init = char_gdb_class_init,
2101 };
2102
2103 static int find_cpu_clusters(Object *child, void *opaque)
2104 {
2105     if (object_dynamic_cast(child, TYPE_CPU_CLUSTER)) {
2106         GDBState *s = (GDBState *) opaque;
2107         CPUClusterState *cluster = CPU_CLUSTER(child);
2108         GDBProcess *process;
2109
2110         s->processes = g_renew(GDBProcess, s->processes, ++s->process_num);
2111
2112         process = &s->processes[s->process_num - 1];
2113
2114         /*
2115          * GDB process IDs -1 and 0 are reserved. To avoid subtle errors at
2116          * runtime, we enforce here that the machine does not use a cluster ID
2117          * that would lead to PID 0.
2118          */
2119         assert(cluster->cluster_id != UINT32_MAX);
2120         process->pid = cluster->cluster_id + 1;
2121         process->attached = false;
2122
2123         return 0;
2124     }
2125
2126     return object_child_foreach(child, find_cpu_clusters, opaque);
2127 }
2128
2129 static int pid_order(const void *a, const void *b)
2130 {
2131     GDBProcess *pa = (GDBProcess *) a;
2132     GDBProcess *pb = (GDBProcess *) b;
2133
2134     if (pa->pid < pb->pid) {
2135         return -1;
2136     } else if (pa->pid > pb->pid) {
2137         return 1;
2138     } else {
2139         return 0;
2140     }
2141 }
2142
2143 static void create_processes(GDBState *s)
2144 {
2145     object_child_foreach(object_get_root(), find_cpu_clusters, s);
2146
2147     if (s->processes) {
2148         /* Sort by PID */
2149         qsort(s->processes, s->process_num, sizeof(s->processes[0]), pid_order);
2150     }
2151
2152     create_default_process(s);
2153 }
2154
2155 static void cleanup_processes(GDBState *s)
2156 {
2157     g_free(s->processes);
2158     s->process_num = 0;
2159     s->processes = NULL;
2160 }
2161
2162 int gdbserver_start(const char *device)
2163 {
2164     trace_gdbstub_op_start(device);
2165
2166     GDBState *s;
2167     char gdbstub_device_name[128];
2168     Chardev *chr = NULL;
2169     Chardev *mon_chr;
2170
2171     if (!first_cpu) {
2172         error_report("gdbstub: meaningless to attach gdb to a "
2173                      "machine without any CPU.");
2174         return -1;
2175     }
2176
2177     if (!device)
2178         return -1;
2179     if (strcmp(device, "none") != 0) {
2180         if (strstart(device, "tcp:", NULL)) {
2181             /* enforce required TCP attributes */
2182             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2183                      "%s,nowait,nodelay,server", device);
2184             device = gdbstub_device_name;
2185         }
2186 #ifndef _WIN32
2187         else if (strcmp(device, "stdio") == 0) {
2188             struct sigaction act;
2189
2190             memset(&act, 0, sizeof(act));
2191             act.sa_handler = gdb_sigterm_handler;
2192             sigaction(SIGINT, &act, NULL);
2193         }
2194 #endif
2195         /*
2196          * FIXME: it's a bit weird to allow using a mux chardev here
2197          * and implicitly setup a monitor. We may want to break this.
2198          */
2199         chr = qemu_chr_new_noreplay("gdb", device, true);
2200         if (!chr)
2201             return -1;
2202     }
2203
2204     s = gdbserver_state;
2205     if (!s) {
2206         s = g_malloc0(sizeof(GDBState));
2207         gdbserver_state = s;
2208
2209         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2210
2211         /* Initialize a monitor terminal for gdb */
2212         mon_chr = qemu_chardev_new(NULL, TYPE_CHARDEV_GDB,
2213                                    NULL, &error_abort);
2214         monitor_init(mon_chr, 0);
2215     } else {
2216         qemu_chr_fe_deinit(&s->chr, true);
2217         mon_chr = s->mon_chr;
2218         cleanup_processes(s);
2219         memset(s, 0, sizeof(GDBState));
2220         s->mon_chr = mon_chr;
2221     }
2222     s->c_cpu = first_cpu;
2223     s->g_cpu = first_cpu;
2224
2225     create_processes(s);
2226
2227     if (chr) {
2228         qemu_chr_fe_init(&s->chr, chr, &error_abort);
2229         qemu_chr_fe_set_handlers(&s->chr, gdb_chr_can_receive, gdb_chr_receive,
2230                                  gdb_chr_event, NULL, NULL, NULL, true);
2231     }
2232     s->state = chr ? RS_IDLE : RS_INACTIVE;
2233     s->mon_chr = mon_chr;
2234     s->current_syscall_cb = NULL;
2235
2236     return 0;
2237 }
2238
2239 void gdbserver_cleanup(void)
2240 {
2241     if (gdbserver_state) {
2242         put_packet(gdbserver_state, "W00");
2243     }
2244 }
2245
2246 static void register_types(void)
2247 {
2248     type_register_static(&char_gdb_type_info);
2249 }
2250
2251 type_init(register_types);
2252 #endif