gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "qemu/osdep.h"
  20 #include "qapi/error.h"
  21 #include "qemu/error-report.h"
  22 #include "qemu/cutils.h"
  23 #include "trace-root.h"
  24 #ifdef CONFIG_USER_ONLY
  25 #include "qemu.h"
  26 #else
  27 #include "monitor/monitor.h"
  28 #include "chardev/char.h"
  29 #include "chardev/char-fe.h"
  30 #include "sysemu/sysemu.h"
  31 #include "exec/gdbstub.h"
  32 #include "hw/cpu/cluster.h"
  33 #endif
  34
  35 #define MAX_PACKET_LENGTH 4096
  36
  37 #include "qemu/sockets.h"
  38 #include "sysemu/hw_accel.h"
  39 #include "sysemu/kvm.h"
  40 #include "exec/semihost.h"
  41 #include "exec/exec-all.h"
  42
  43 #ifdef CONFIG_USER_ONLY
  44 #define GDB_ATTACHED "0"
  45 #else
  46 #define GDB_ATTACHED "1"
  47 #endif
  48
  49 static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
  50                                          uint8_t *buf, int len, bool is_write)
  51 {
  52     CPUClass *cc = CPU_GET_CLASS(cpu);
  53
  54     if (cc->memory_rw_debug) {
  55         return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
  56     }
  57     return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
  58 }
  59
  60 /* Return the GDB index for a given vCPU state.
  61  *
  62  * For user mode this is simply the thread id. In system mode GDB
  63  * numbers CPUs from 1 as 0 is reserved as an "any cpu" index.
  64  */
  65 static inline int cpu_gdb_index(CPUState *cpu)
  66 {
  67 #if defined(CONFIG_USER_ONLY)
  68     TaskState *ts = (TaskState *) cpu->opaque;
  69     return ts->ts_tid;
  70 #else
  71     return cpu->cpu_index + 1;
  72 #endif
  73 }
  74
  75 enum {
  76     GDB_SIGNAL_0 = 0,
  77     GDB_SIGNAL_INT = 2,
  78     GDB_SIGNAL_QUIT = 3,
  79     GDB_SIGNAL_TRAP = 5,
  80     GDB_SIGNAL_ABRT = 6,
  81     GDB_SIGNAL_ALRM = 14,
  82     GDB_SIGNAL_IO = 23,
  83     GDB_SIGNAL_XCPU = 24,
  84     GDB_SIGNAL_UNKNOWN = 143
  85 };
  86
  87 #ifdef CONFIG_USER_ONLY
  88
  89 /* Map target signal numbers to GDB protocol signal numbers and vice
  90  * versa.  For user emulation's currently supported systems, we can
  91  * assume most signals are defined.
  92  */
  93
  94 static int gdb_signal_table[] = {
  95     0,
  96     TARGET_SIGHUP,
  97     TARGET_SIGINT,
  98     TARGET_SIGQUIT,
  99     TARGET_SIGILL,
 100     TARGET_SIGTRAP,
 101     TARGET_SIGABRT,
 102     -1, /* SIGEMT */
 103     TARGET_SIGFPE,
 104     TARGET_SIGKILL,
 105     TARGET_SIGBUS,
 106     TARGET_SIGSEGV,
 107     TARGET_SIGSYS,
 108     TARGET_SIGPIPE,
 109     TARGET_SIGALRM,
 110     TARGET_SIGTERM,
 111     TARGET_SIGURG,
 112     TARGET_SIGSTOP,
 113     TARGET_SIGTSTP,
 114     TARGET_SIGCONT,
 115     TARGET_SIGCHLD,
 116     TARGET_SIGTTIN,
 117     TARGET_SIGTTOU,
 118     TARGET_SIGIO,
 119     TARGET_SIGXCPU,
 120     TARGET_SIGXFSZ,
 121     TARGET_SIGVTALRM,
 122     TARGET_SIGPROF,
 123     TARGET_SIGWINCH,
 124     -1, /* SIGLOST */
 125     TARGET_SIGUSR1,
 126     TARGET_SIGUSR2,
 127 #ifdef TARGET_SIGPWR
 128     TARGET_SIGPWR,
 129 #else
 130     -1,
 131 #endif
 132     -1, /* SIGPOLL */
 133     -1,
 134     -1,
 135     -1,
 136     -1,
 137     -1,
 138     -1,
 139     -1,
 140     -1,
 141     -1,
 142     -1,
 143     -1,
 144 #ifdef __SIGRTMIN
 145     __SIGRTMIN + 1,
 146     __SIGRTMIN + 2,
 147     __SIGRTMIN + 3,
 148     __SIGRTMIN + 4,
 149     __SIGRTMIN + 5,
 150     __SIGRTMIN + 6,
 151     __SIGRTMIN + 7,
 152     __SIGRTMIN + 8,
 153     __SIGRTMIN + 9,
 154     __SIGRTMIN + 10,
 155     __SIGRTMIN + 11,
 156     __SIGRTMIN + 12,
 157     __SIGRTMIN + 13,
 158     __SIGRTMIN + 14,
 159     __SIGRTMIN + 15,
 160     __SIGRTMIN + 16,
 161     __SIGRTMIN + 17,
 162     __SIGRTMIN + 18,
 163     __SIGRTMIN + 19,
 164     __SIGRTMIN + 20,
 165     __SIGRTMIN + 21,
 166     __SIGRTMIN + 22,
 167     __SIGRTMIN + 23,
 168     __SIGRTMIN + 24,
 169     __SIGRTMIN + 25,
 170     __SIGRTMIN + 26,
 171     __SIGRTMIN + 27,
 172     __SIGRTMIN + 28,
 173     __SIGRTMIN + 29,
 174     __SIGRTMIN + 30,
 175     __SIGRTMIN + 31,
 176     -1, /* SIGCANCEL */
 177     __SIGRTMIN,
 178     __SIGRTMIN + 32,
 179     __SIGRTMIN + 33,
 180     __SIGRTMIN + 34,
 181     __SIGRTMIN + 35,
 182     __SIGRTMIN + 36,
 183     __SIGRTMIN + 37,
 184     __SIGRTMIN + 38,
 185     __SIGRTMIN + 39,
 186     __SIGRTMIN + 40,
 187     __SIGRTMIN + 41,
 188     __SIGRTMIN + 42,
 189     __SIGRTMIN + 43,
 190     __SIGRTMIN + 44,
 191     __SIGRTMIN + 45,
 192     __SIGRTMIN + 46,
 193     __SIGRTMIN + 47,
 194     __SIGRTMIN + 48,
 195     __SIGRTMIN + 49,
 196     __SIGRTMIN + 50,
 197     __SIGRTMIN + 51,
 198     __SIGRTMIN + 52,
 199     __SIGRTMIN + 53,
 200     __SIGRTMIN + 54,
 201     __SIGRTMIN + 55,
 202     __SIGRTMIN + 56,
 203     __SIGRTMIN + 57,
 204     __SIGRTMIN + 58,
 205     __SIGRTMIN + 59,
 206     __SIGRTMIN + 60,
 207     __SIGRTMIN + 61,
 208     __SIGRTMIN + 62,
 209     __SIGRTMIN + 63,
 210     __SIGRTMIN + 64,
 211     __SIGRTMIN + 65,
 212     __SIGRTMIN + 66,
 213     __SIGRTMIN + 67,
 214     __SIGRTMIN + 68,
 215     __SIGRTMIN + 69,
 216     __SIGRTMIN + 70,
 217     __SIGRTMIN + 71,
 218     __SIGRTMIN + 72,
 219     __SIGRTMIN + 73,
 220     __SIGRTMIN + 74,
 221     __SIGRTMIN + 75,
 222     __SIGRTMIN + 76,
 223     __SIGRTMIN + 77,
 224     __SIGRTMIN + 78,
 225     __SIGRTMIN + 79,
 226     __SIGRTMIN + 80,
 227     __SIGRTMIN + 81,
 228     __SIGRTMIN + 82,
 229     __SIGRTMIN + 83,
 230     __SIGRTMIN + 84,
 231     __SIGRTMIN + 85,
 232     __SIGRTMIN + 86,
 233     __SIGRTMIN + 87,
 234     __SIGRTMIN + 88,
 235     __SIGRTMIN + 89,
 236     __SIGRTMIN + 90,
 237     __SIGRTMIN + 91,
 238     __SIGRTMIN + 92,
 239     __SIGRTMIN + 93,
 240     __SIGRTMIN + 94,
 241     __SIGRTMIN + 95,
 242     -1, /* SIGINFO */
 243     -1, /* UNKNOWN */
 244     -1, /* DEFAULT */
 245     -1,
 246     -1,
 247     -1,
 248     -1,
 249     -1,
 250     -1
 251 #endif
 252 };
 253 #else
 254 /* In system mode we only need SIGINT and SIGTRAP; other signals
 255    are not yet supported.  */
 256
 257 enum {
 258     TARGET_SIGINT = 2,
 259     TARGET_SIGTRAP = 5
 260 };
 261
 262 static int gdb_signal_table[] = {
 263     -1,
 264     -1,
 265     TARGET_SIGINT,
 266     -1,
 267     -1,
 268     TARGET_SIGTRAP
 269 };
 270 #endif
 271
 272 #ifdef CONFIG_USER_ONLY
 273 static int target_signal_to_gdb (int sig)
 274 {
 275     int i;
 276     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 277         if (gdb_signal_table[i] == sig)
 278             return i;
 279     return GDB_SIGNAL_UNKNOWN;
 280 }
 281 #endif
 282
 283 static int gdb_signal_to_target (int sig)
 284 {
 285     if (sig < ARRAY_SIZE (gdb_signal_table))
 286         return gdb_signal_table[sig];
 287     else
 288         return -1;
 289 }
 290
 291 typedef struct GDBRegisterState {
 292     int base_reg;
 293     int num_regs;
 294     gdb_reg_cb get_reg;
 295     gdb_reg_cb set_reg;
 296     const char *xml;
 297     struct GDBRegisterState *next;
 298 } GDBRegisterState;
 299
 300 typedef struct GDBProcess {
 301     uint32_t pid;
 302     bool attached;
 303
 304     char target_xml[1024];
 305 } GDBProcess;
 306
 307 enum RSState {
 308     RS_INACTIVE,
 309     RS_IDLE,
 310     RS_GETLINE,
 311     RS_GETLINE_ESC,
 312     RS_GETLINE_RLE,
 313     RS_CHKSUM1,
 314     RS_CHKSUM2,
 315 };
 316 typedef struct GDBState {
 317     CPUState *c_cpu; /* current CPU for step/continue ops */
 318     CPUState *g_cpu; /* current CPU for other ops */
 319     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 320     enum RSState state; /* parsing state */
 321     char line_buf[MAX_PACKET_LENGTH];
 322     int line_buf_index;
 323     int line_sum; /* running checksum */
 324     int line_csum; /* checksum at the end of the packet */
 325     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 326     int last_packet_len;
 327     int signal;
 328 #ifdef CONFIG_USER_ONLY
 329     int fd;
 330     int running_state;
 331 #else
 332     CharBackend chr;
 333     Chardev *mon_chr;
 334 #endif
 335     bool multiprocess;
 336     GDBProcess *processes;
 337     int process_num;
 338     char syscall_buf[256];
 339     gdb_syscall_complete_cb current_syscall_cb;
 340 } GDBState;
 341
 342 /* By default use no IRQs and no timers while single stepping so as to
 343  * make single stepping like an ICE HW step.
 344  */
 345 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 346
 347 static GDBState *gdbserver_state;
 348
 349 bool gdb_has_xml;
 350
 351 #ifdef CONFIG_USER_ONLY
 352 /* XXX: This is not thread safe.  Do we care?  */
 353 static int gdbserver_fd = -1;
 354
 355 static int get_char(GDBState *s)
 356 {
 357     uint8_t ch;
 358     int ret;
 359
 360     for(;;) {
 361         ret = qemu_recv(s->fd, &ch, 1, 0);
 362         if (ret < 0) {
 363             if (errno == ECONNRESET)
 364                 s->fd = -1;
 365             if (errno != EINTR)
 366                 return -1;
 367         } else if (ret == 0) {
 368             close(s->fd);
 369             s->fd = -1;
 370             return -1;
 371         } else {
 372             break;
 373         }
 374     }
 375     return ch;
 376 }
 377 #endif
 378
 379 static enum {
 380     GDB_SYS_UNKNOWN,
 381     GDB_SYS_ENABLED,
 382     GDB_SYS_DISABLED,
 383 } gdb_syscall_mode;
 384
 385 /* Decide if either remote gdb syscalls or native file IO should be used. */
 386 int use_gdb_syscalls(void)
 387 {
 388     SemihostingTarget target = semihosting_get_target();
 389     if (target == SEMIHOSTING_TARGET_NATIVE) {
 390         /* -semihosting-config target=native */
 391         return false;
 392     } else if (target == SEMIHOSTING_TARGET_GDB) {
 393         /* -semihosting-config target=gdb */
 394         return true;
 395     }
 396
 397     /* -semihosting-config target=auto */
 398     /* On the first call check if gdb is connected and remember. */
 399     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 400         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 401                                             : GDB_SYS_DISABLED);
 402     }
 403     return gdb_syscall_mode == GDB_SYS_ENABLED;
 404 }
 405
 406 /* Resume execution.  */
 407 static inline void gdb_continue(GDBState *s)
 408 {
 409
 410 #ifdef CONFIG_USER_ONLY
 411     s->running_state = 1;
 412     trace_gdbstub_op_continue();
 413 #else
 414     if (!runstate_needs_reset()) {
 415         trace_gdbstub_op_continue();
 416         vm_start();
 417     }
 418 #endif
 419 }
 420
 421 /*
 422  * Resume execution, per CPU actions. For user-mode emulation it's
 423  * equivalent to gdb_continue.
 424  */
 425 static int gdb_continue_partial(GDBState *s, char *newstates)
 426 {
 427     CPUState *cpu;
 428     int res = 0;
 429 #ifdef CONFIG_USER_ONLY
 430     /*
 431      * This is not exactly accurate, but it's an improvement compared to the
 432      * previous situation, where only one CPU would be single-stepped.
 433      */
 434     CPU_FOREACH(cpu) {
 435         if (newstates[cpu->cpu_index] == 's') {
 436             trace_gdbstub_op_stepping(cpu->cpu_index);
 437             cpu_single_step(cpu, sstep_flags);
 438         }
 439     }
 440     s->running_state = 1;
 441 #else
 442     int flag = 0;
 443
 444     if (!runstate_needs_reset()) {
 445         if (vm_prepare_start()) {
 446             return 0;
 447         }
 448
 449         CPU_FOREACH(cpu) {
 450             switch (newstates[cpu->cpu_index]) {
 451             case 0:
 452             case 1:
 453                 break; /* nothing to do here */
 454             case 's':
 455                 trace_gdbstub_op_stepping(cpu->cpu_index);
 456                 cpu_single_step(cpu, sstep_flags);
 457                 cpu_resume(cpu);
 458                 flag = 1;
 459                 break;
 460             case 'c':
 461                 trace_gdbstub_op_continue_cpu(cpu->cpu_index);
 462                 cpu_resume(cpu);
 463                 flag = 1;
 464                 break;
 465             default:
 466                 res = -1;
 467                 break;
 468             }
 469         }
 470     }
 471     if (flag) {
 472         qemu_clock_enable(QEMU_CLOCK_VIRTUAL, true);
 473     }
 474 #endif
 475     return res;
 476 }
 477
 478 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 479 {
 480 #ifdef CONFIG_USER_ONLY
 481     int ret;
 482
 483     while (len > 0) {
 484         ret = send(s->fd, buf, len, 0);
 485         if (ret < 0) {
 486             if (errno != EINTR)
 487                 return;
 488         } else {
 489             buf += ret;
 490             len -= ret;
 491         }
 492     }
 493 #else
 494     /* XXX this blocks entire thread. Rewrite to use
 495      * qemu_chr_fe_write and background I/O callbacks */
 496     qemu_chr_fe_write_all(&s->chr, buf, len);
 497 #endif
 498 }
 499
 500 static inline int fromhex(int v)
 501 {
 502     if (v >= '0' && v <= '9')
 503         return v - '0';
 504     else if (v >= 'A' && v <= 'F')
 505         return v - 'A' + 10;
 506     else if (v >= 'a' && v <= 'f')
 507         return v - 'a' + 10;
 508     else
 509         return 0;
 510 }
 511
 512 static inline int tohex(int v)
 513 {
 514     if (v < 10)
 515         return v + '0';
 516     else
 517         return v - 10 + 'a';
 518 }
 519
 520 /* writes 2*len+1 bytes in buf */
 521 static void memtohex(char *buf, const uint8_t *mem, int len)
 522 {
 523     int i, c;
 524     char *q;
 525     q = buf;
 526     for(i = 0; i < len; i++) {
 527         c = mem[i];
 528         *q++ = tohex(c >> 4);
 529         *q++ = tohex(c & 0xf);
 530     }
 531     *q = '\0';
 532 }
 533
 534 static void hextomem(uint8_t *mem, const char *buf, int len)
 535 {
 536     int i;
 537
 538     for(i = 0; i < len; i++) {
 539         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 540         buf += 2;
 541     }
 542 }
 543
 544 static void hexdump(const char *buf, int len,
 545                     void (*trace_fn)(size_t ofs, char const *text))
 546 {
 547     char line_buffer[3 * 16 + 4 + 16 + 1];
 548
 549     size_t i;
 550     for (i = 0; i < len || (i & 0xF); ++i) {
 551         size_t byte_ofs = i & 15;
 552
 553         if (byte_ofs == 0) {
 554             memset(line_buffer, ' ', 3 * 16 + 4 + 16);
 555             line_buffer[3 * 16 + 4 + 16] = 0;
 556         }
 557
 558         size_t col_group = (i >> 2) & 3;
 559         size_t hex_col = byte_ofs * 3 + col_group;
 560         size_t txt_col = 3 * 16 + 4 + byte_ofs;
 561
 562         if (i < len) {
 563             char value = buf[i];
 564
 565             line_buffer[hex_col + 0] = tohex((value >> 4) & 0xF);
 566             line_buffer[hex_col + 1] = tohex((value >> 0) & 0xF);
 567             line_buffer[txt_col + 0] = (value >= ' ' && value < 127)
 568                     ? value
 569                     : '.';
 570         }
 571
 572         if (byte_ofs == 0xF)
 573             trace_fn(i & -16, line_buffer);
 574     }
 575 }
 576
 577 /* return -1 if error, 0 if OK */
 578 static int put_packet_binary(GDBState *s, const char *buf, int len, bool dump)
 579 {
 580     int csum, i;
 581     uint8_t *p;
 582
 583     if (dump && trace_event_get_state_backends(TRACE_GDBSTUB_IO_BINARYREPLY)) {
 584         hexdump(buf, len, trace_gdbstub_io_binaryreply);
 585     }
 586
 587     for(;;) {
 588         p = s->last_packet;
 589         *(p++) = '$';
 590         memcpy(p, buf, len);
 591         p += len;
 592         csum = 0;
 593         for(i = 0; i < len; i++) {
 594             csum += buf[i];
 595         }
 596         *(p++) = '#';
 597         *(p++) = tohex((csum >> 4) & 0xf);
 598         *(p++) = tohex((csum) & 0xf);
 599
 600         s->last_packet_len = p - s->last_packet;
 601         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 602
 603 #ifdef CONFIG_USER_ONLY
 604         i = get_char(s);
 605         if (i < 0)
 606             return -1;
 607         if (i == '+')
 608             break;
 609 #else
 610         break;
 611 #endif
 612     }
 613     return 0;
 614 }
 615
 616 /* return -1 if error, 0 if OK */
 617 static int put_packet(GDBState *s, const char *buf)
 618 {
 619     trace_gdbstub_io_reply(buf);
 620
 621     return put_packet_binary(s, buf, strlen(buf), false);
 622 }
 623
 624 /* Encode data using the encoding for 'x' packets.  */
 625 static int memtox(char *buf, const char *mem, int len)
 626 {
 627     char *p = buf;
 628     char c;
 629
 630     while (len--) {
 631         c = *(mem++);
 632         switch (c) {
 633         case '#': case '$': case '*': case '}':
 634             *(p++) = '}';
 635             *(p++) = c ^ 0x20;
 636             break;
 637         default:
 638             *(p++) = c;
 639             break;
 640         }
 641     }
 642     return p - buf;
 643 }
 644
 645 static uint32_t gdb_get_cpu_pid(const GDBState *s, CPUState *cpu)
 646 {
 647 #ifndef CONFIG_USER_ONLY
 648     gchar *path, *name = NULL;
 649     Object *obj;
 650     CPUClusterState *cluster;
 651     uint32_t ret;
 652
 653     path = object_get_canonical_path(OBJECT(cpu));
 654
 655     if (path == NULL) {
 656         /* Return the default process' PID */
 657         ret = s->processes[s->process_num - 1].pid;
 658         goto out;
 659     }
 660
 661     name = object_get_canonical_path_component(OBJECT(cpu));
 662     assert(name != NULL);
 663
 664     /*
 665      * Retrieve the CPU parent path by removing the last '/' and the CPU name
 666      * from the CPU canonical path.
 667      */
 668     path[strlen(path) - strlen(name) - 1] = '\0';
 669
 670     obj = object_resolve_path_type(path, TYPE_CPU_CLUSTER, NULL);
 671
 672     if (obj == NULL) {
 673         /* Return the default process' PID */
 674         ret = s->processes[s->process_num - 1].pid;
 675         goto out;
 676     }
 677
 678     cluster = CPU_CLUSTER(obj);
 679     ret = cluster->cluster_id + 1;
 680
 681 out:
 682     g_free(name);
 683     g_free(path);
 684
 685     return ret;
 686
 687 #else
 688     /* TODO: In user mode, we should use the task state PID */
 689     return s->processes[s->process_num - 1].pid;
 690 #endif
 691 }
 692
 693 static GDBProcess *gdb_get_process(const GDBState *s, uint32_t pid)
 694 {
 695     int i;
 696
 697     if (!pid) {
 698         /* 0 means any process, we take the first one */
 699         return &s->processes[0];
 700     }
 701
 702     for (i = 0; i < s->process_num; i++) {
 703         if (s->processes[i].pid == pid) {
 704             return &s->processes[i];
 705         }
 706     }
 707
 708     return NULL;
 709 }
 710
 711 static GDBProcess *gdb_get_cpu_process(const GDBState *s, CPUState *cpu)
 712 {
 713     return gdb_get_process(s, gdb_get_cpu_pid(s, cpu));
 714 }
 715
 716 static CPUState *find_cpu(uint32_t thread_id)
 717 {
 718     CPUState *cpu;
 719
 720     CPU_FOREACH(cpu) {
 721         if (cpu_gdb_index(cpu) == thread_id) {
 722             return cpu;
 723         }
 724     }
 725
 726     return NULL;
 727 }
 728
 729 static CPUState *get_first_cpu_in_process(const GDBState *s,
 730                                           GDBProcess *process)
 731 {
 732     CPUState *cpu;
 733
 734     CPU_FOREACH(cpu) {
 735         if (gdb_get_cpu_pid(s, cpu) == process->pid) {
 736             return cpu;
 737         }
 738     }
 739
 740     return NULL;
 741 }
 742
 743 static CPUState *gdb_next_cpu_in_process(const GDBState *s, CPUState *cpu)
 744 {
 745     uint32_t pid = gdb_get_cpu_pid(s, cpu);
 746     cpu = CPU_NEXT(cpu);
 747
 748     while (cpu) {
 749         if (gdb_get_cpu_pid(s, cpu) == pid) {
 750             break;
 751         }
 752
 753         cpu = CPU_NEXT(cpu);
 754     }
 755
 756     return cpu;
 757 }
 758
 759 static CPUState *gdb_get_cpu(const GDBState *s, uint32_t pid, uint32_t tid)
 760 {
 761     GDBProcess *process;
 762     CPUState *cpu;
 763
 764     if (!tid) {
 765         /* 0 means any thread, we take the first one */
 766         tid = 1;
 767     }
 768
 769     cpu = find_cpu(tid);
 770
 771     if (cpu == NULL) {
 772         return NULL;
 773     }
 774
 775     process = gdb_get_cpu_process(s, cpu);
 776
 777     if (process->pid != pid) {
 778         return NULL;
 779     }
 780
 781     if (!process->attached) {
 782         return NULL;
 783     }
 784
 785     return cpu;
 786 }
 787
 788 /* Return the cpu following @cpu, while ignoring unattached processes. */
 789 static CPUState *gdb_next_attached_cpu(const GDBState *s, CPUState *cpu)
 790 {
 791     cpu = CPU_NEXT(cpu);
 792
 793     while (cpu) {
 794         if (gdb_get_cpu_process(s, cpu)->attached) {
 795             break;
 796         }
 797
 798         cpu = CPU_NEXT(cpu);
 799     }
 800
 801     return cpu;
 802 }
 803
 804 /* Return the first attached cpu */
 805 static CPUState *gdb_first_attached_cpu(const GDBState *s)
 806 {
 807     CPUState *cpu = first_cpu;
 808     GDBProcess *process = gdb_get_cpu_process(s, cpu);
 809
 810     if (!process->attached) {
 811         return gdb_next_attached_cpu(s, cpu);
 812     }
 813
 814     return cpu;
 815 }
 816
 817 static const char *get_feature_xml(const GDBState *s, const char *p,
 818                                    const char **newp, GDBProcess *process)
 819 {
 820     size_t len;
 821     int i;
 822     const char *name;
 823     CPUState *cpu = get_first_cpu_in_process(s, process);
 824     CPUClass *cc = CPU_GET_CLASS(cpu);
 825
 826     len = 0;
 827     while (p[len] && p[len] != ':')
 828         len++;
 829     *newp = p + len;
 830
 831     name = NULL;
 832     if (strncmp(p, "target.xml", len) == 0) {
 833         char *buf = process->target_xml;
 834         const size_t buf_sz = sizeof(process->target_xml);
 835
 836         /* Generate the XML description for this CPU.  */
 837         if (!buf[0]) {
 838             GDBRegisterState *r;
 839
 840             pstrcat(buf, buf_sz,
 841                     "<?xml version=\"1.0\"?>"
 842                     "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
 843                     "<target>");
 844             if (cc->gdb_arch_name) {
 845                 gchar *arch = cc->gdb_arch_name(cpu);
 846                 pstrcat(buf, buf_sz, "<architecture>");
 847                 pstrcat(buf, buf_sz, arch);
 848                 pstrcat(buf, buf_sz, "</architecture>");
 849                 g_free(arch);
 850             }
 851             pstrcat(buf, buf_sz, "<xi:include href=\"");
 852             pstrcat(buf, buf_sz, cc->gdb_core_xml_file);
 853             pstrcat(buf, buf_sz, "\"/>");
 854             for (r = cpu->gdb_regs; r; r = r->next) {
 855                 pstrcat(buf, buf_sz, "<xi:include href=\"");
 856                 pstrcat(buf, buf_sz, r->xml);
 857                 pstrcat(buf, buf_sz, "\"/>");
 858             }
 859             pstrcat(buf, buf_sz, "</target>");
 860         }
 861         return buf;
 862     }
 863     if (cc->gdb_get_dynamic_xml) {
 864         char *xmlname = g_strndup(p, len);
 865         const char *xml = cc->gdb_get_dynamic_xml(cpu, xmlname);
 866
 867         g_free(xmlname);
 868         if (xml) {
 869             return xml;
 870         }
 871     }
 872     for (i = 0; ; i++) {
 873         name = xml_builtin[i][0];
 874         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
 875             break;
 876     }
 877     return name ? xml_builtin[i][1] : NULL;
 878 }
 879
 880 static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 881 {
 882     CPUClass *cc = CPU_GET_CLASS(cpu);
 883     CPUArchState *env = cpu->env_ptr;
 884     GDBRegisterState *r;
 885
 886     if (reg < cc->gdb_num_core_regs) {
 887         return cc->gdb_read_register(cpu, mem_buf, reg);
 888     }
 889
 890     for (r = cpu->gdb_regs; r; r = r->next) {
 891         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 892             return r->get_reg(env, mem_buf, reg - r->base_reg);
 893         }
 894     }
 895     return 0;
 896 }
 897
 898 static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 899 {
 900     CPUClass *cc = CPU_GET_CLASS(cpu);
 901     CPUArchState *env = cpu->env_ptr;
 902     GDBRegisterState *r;
 903
 904     if (reg < cc->gdb_num_core_regs) {
 905         return cc->gdb_write_register(cpu, mem_buf, reg);
 906     }
 907
 908     for (r = cpu->gdb_regs; r; r = r->next) {
 909         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 910             return r->set_reg(env, mem_buf, reg - r->base_reg);
 911         }
 912     }
 913     return 0;
 914 }
 915
 916 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
 917    specifies the first register number and these registers are included in
 918    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
 919    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
 920  */
 921
 922 void gdb_register_coprocessor(CPUState *cpu,
 923                               gdb_reg_cb get_reg, gdb_reg_cb set_reg,
 924                               int num_regs, const char *xml, int g_pos)
 925 {
 926     GDBRegisterState *s;
 927     GDBRegisterState **p;
 928
 929     p = &cpu->gdb_regs;
 930     while (*p) {
 931         /* Check for duplicates.  */
 932         if (strcmp((*p)->xml, xml) == 0)
 933             return;
 934         p = &(*p)->next;
 935     }
 936
 937     s = g_new0(GDBRegisterState, 1);
 938     s->base_reg = cpu->gdb_num_regs;
 939     s->num_regs = num_regs;
 940     s->get_reg = get_reg;
 941     s->set_reg = set_reg;
 942     s->xml = xml;
 943
 944     /* Add to end of list.  */
 945     cpu->gdb_num_regs += num_regs;
 946     *p = s;
 947     if (g_pos) {
 948         if (g_pos != s->base_reg) {
 949             error_report("Error: Bad gdb register numbering for '%s', "
 950                          "expected %d got %d", xml, g_pos, s->base_reg);
 951         } else {
 952             cpu->gdb_num_g_regs = cpu->gdb_num_regs;
 953         }
 954     }
 955 }
 956
 957 #ifndef CONFIG_USER_ONLY
 958 /* Translate GDB watchpoint type to a flags value for cpu_watchpoint_* */
 959 static inline int xlat_gdb_type(CPUState *cpu, int gdbtype)
 960 {
 961     static const int xlat[] = {
 962         [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
 963         [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
 964         [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
 965     };
 966
 967     CPUClass *cc = CPU_GET_CLASS(cpu);
 968     int cputype = xlat[gdbtype];
 969
 970     if (cc->gdb_stop_before_watchpoint) {
 971         cputype |= BP_STOP_BEFORE_ACCESS;
 972     }
 973     return cputype;
 974 }
 975 #endif
 976
 977 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
 978 {
 979     CPUState *cpu;
 980     int err = 0;
 981
 982     if (kvm_enabled()) {
 983         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 984     }
 985
 986     switch (type) {
 987     case GDB_BREAKPOINT_SW:
 988     case GDB_BREAKPOINT_HW:
 989         CPU_FOREACH(cpu) {
 990             err = cpu_breakpoint_insert(cpu, addr, BP_GDB, NULL);
 991             if (err) {
 992                 break;
 993             }
 994         }
 995         return err;
 996 #ifndef CONFIG_USER_ONLY
 997     case GDB_WATCHPOINT_WRITE:
 998     case GDB_WATCHPOINT_READ:
 999     case GDB_WATCHPOINT_ACCESS:
1000         CPU_FOREACH(cpu) {
1001             err = cpu_watchpoint_insert(cpu, addr, len,
1002                                         xlat_gdb_type(cpu, type), NULL);
1003             if (err) {
1004                 break;
1005             }
1006         }
1007         return err;
1008 #endif
1009     default:
1010         return -ENOSYS;
1011     }
1012 }
1013
1014 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1015 {
1016     CPUState *cpu;
1017     int err = 0;
1018
1019     if (kvm_enabled()) {
1020         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1021     }
1022
1023     switch (type) {
1024     case GDB_BREAKPOINT_SW:
1025     case GDB_BREAKPOINT_HW:
1026         CPU_FOREACH(cpu) {
1027             err = cpu_breakpoint_remove(cpu, addr, BP_GDB);
1028             if (err) {
1029                 break;
1030             }
1031         }
1032         return err;
1033 #ifndef CONFIG_USER_ONLY
1034     case GDB_WATCHPOINT_WRITE:
1035     case GDB_WATCHPOINT_READ:
1036     case GDB_WATCHPOINT_ACCESS:
1037         CPU_FOREACH(cpu) {
1038             err = cpu_watchpoint_remove(cpu, addr, len,
1039                                         xlat_gdb_type(cpu, type));
1040             if (err)
1041                 break;
1042         }
1043         return err;
1044 #endif
1045     default:
1046         return -ENOSYS;
1047     }
1048 }
1049
1050 static inline void gdb_cpu_breakpoint_remove_all(CPUState *cpu)
1051 {
1052     cpu_breakpoint_remove_all(cpu, BP_GDB);
1053 #ifndef CONFIG_USER_ONLY
1054     cpu_watchpoint_remove_all(cpu, BP_GDB);
1055 #endif
1056 }
1057
1058 static void gdb_process_breakpoint_remove_all(const GDBState *s, GDBProcess *p)
1059 {
1060     CPUState *cpu = get_first_cpu_in_process(s, p);
1061
1062     while (cpu) {
1063         gdb_cpu_breakpoint_remove_all(cpu);
1064         cpu = gdb_next_cpu_in_process(s, cpu);
1065     }
1066 }
1067
1068 static void gdb_breakpoint_remove_all(void)
1069 {
1070     CPUState *cpu;
1071
1072     if (kvm_enabled()) {
1073         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1074         return;
1075     }
1076
1077     CPU_FOREACH(cpu) {
1078         gdb_cpu_breakpoint_remove_all(cpu);
1079     }
1080 }
1081
1082 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1083 {
1084     CPUState *cpu = s->c_cpu;
1085
1086     cpu_synchronize_state(cpu);
1087     cpu_set_pc(cpu, pc);
1088 }
1089
1090 static char *gdb_fmt_thread_id(const GDBState *s, CPUState *cpu,
1091                            char *buf, size_t buf_size)
1092 {
1093     if (s->multiprocess) {
1094         snprintf(buf, buf_size, "p%02x.%02x",
1095                  gdb_get_cpu_pid(s, cpu), cpu_gdb_index(cpu));
1096     } else {
1097         snprintf(buf, buf_size, "%02x", cpu_gdb_index(cpu));
1098     }
1099
1100     return buf;
1101 }
1102
1103 typedef enum GDBThreadIdKind {
1104     GDB_ONE_THREAD = 0,
1105     GDB_ALL_THREADS,     /* One process, all threads */
1106     GDB_ALL_PROCESSES,
1107     GDB_READ_THREAD_ERR
1108 } GDBThreadIdKind;
1109
1110 static GDBThreadIdKind read_thread_id(const char *buf, const char **end_buf,
1111                                       uint32_t *pid, uint32_t *tid)
1112 {
1113     unsigned long p, t;
1114     int ret;
1115
1116     if (*buf == 'p') {
1117         buf++;
1118         ret = qemu_strtoul(buf, &buf, 16, &p);
1119
1120         if (ret) {
1121             return GDB_READ_THREAD_ERR;
1122         }
1123
1124         /* Skip '.' */
1125         buf++;
1126     } else {
1127         p = 1;
1128     }
1129
1130     ret = qemu_strtoul(buf, &buf, 16, &t);
1131
1132     if (ret) {
1133         return GDB_READ_THREAD_ERR;
1134     }
1135
1136     *end_buf = buf;
1137
1138     if (p == -1) {
1139         return GDB_ALL_PROCESSES;
1140     }
1141
1142     if (pid) {
1143         *pid = p;
1144     }
1145
1146     if (t == -1) {
1147         return GDB_ALL_THREADS;
1148     }
1149
1150     if (tid) {
1151         *tid = t;
1152     }
1153
1154     return GDB_ONE_THREAD;
1155 }
1156
1157 static int is_query_packet(const char *p, const char *query, char separator)
1158 {
1159     unsigned int query_len = strlen(query);
1160
1161     return strncmp(p, query, query_len) == 0 &&
1162         (p[query_len] == '\0' || p[query_len] == separator);
1163 }
1164
1165 /**
1166  * gdb_handle_vcont - Parses and handles a vCont packet.
1167  * returns -ENOTSUP if a command is unsupported, -EINVAL or -ERANGE if there is
1168  *         a format error, 0 on success.
1169  */
1170 static int gdb_handle_vcont(GDBState *s, const char *p)
1171 {
1172     int res, signal = 0;
1173     char cur_action;
1174     char *newstates;
1175     unsigned long tmp;
1176     uint32_t pid, tid;
1177     GDBProcess *process;
1178     CPUState *cpu;
1179 #ifdef CONFIG_USER_ONLY
1180     int max_cpus = 1; /* global variable max_cpus exists only in system mode */
1181
1182     CPU_FOREACH(cpu) {
1183         max_cpus = max_cpus <= cpu->cpu_index ? cpu->cpu_index + 1 : max_cpus;
1184     }
1185 #endif
1186     /* uninitialised CPUs stay 0 */
1187     newstates = g_new0(char, max_cpus);
1188
1189     /* mark valid CPUs with 1 */
1190     CPU_FOREACH(cpu) {
1191         newstates[cpu->cpu_index] = 1;
1192     }
1193
1194     /*
1195      * res keeps track of what error we are returning, with -ENOTSUP meaning
1196      * that the command is unknown or unsupported, thus returning an empty
1197      * packet, while -EINVAL and -ERANGE cause an E22 packet, due to invalid,
1198      *  or incorrect parameters passed.
1199      */
1200     res = 0;
1201     while (*p) {
1202         if (*p++ != ';') {
1203             res = -ENOTSUP;
1204             goto out;
1205         }
1206
1207         cur_action = *p++;
1208         if (cur_action == 'C' || cur_action == 'S') {
1209             cur_action = qemu_tolower(cur_action);
1210             res = qemu_strtoul(p + 1, &p, 16, &tmp);
1211             if (res) {
1212                 goto out;
1213             }
1214             signal = gdb_signal_to_target(tmp);
1215         } else if (cur_action != 'c' && cur_action != 's') {
1216             /* unknown/invalid/unsupported command */
1217             res = -ENOTSUP;
1218             goto out;
1219         }
1220
1221         if (*p++ != ':') {
1222             res = -ENOTSUP;
1223             goto out;
1224         }
1225
1226         switch (read_thread_id(p, &p, &pid, &tid)) {
1227         case GDB_READ_THREAD_ERR:
1228             res = -EINVAL;
1229             goto out;
1230
1231         case GDB_ALL_PROCESSES:
1232             cpu = gdb_first_attached_cpu(s);
1233             while (cpu) {
1234                 if (newstates[cpu->cpu_index] == 1) {
1235                     newstates[cpu->cpu_index] = cur_action;
1236                 }
1237
1238                 cpu = gdb_next_attached_cpu(s, cpu);
1239             }
1240             break;
1241
1242         case GDB_ALL_THREADS:
1243             process = gdb_get_process(s, pid);
1244
1245             if (!process->attached) {
1246                 res = -EINVAL;
1247                 goto out;
1248             }
1249
1250             cpu = get_first_cpu_in_process(s, process);
1251             while (cpu) {
1252                 if (newstates[cpu->cpu_index] == 1) {
1253                     newstates[cpu->cpu_index] = cur_action;
1254                 }
1255
1256                 cpu = gdb_next_cpu_in_process(s, cpu);
1257             }
1258             break;
1259
1260         case GDB_ONE_THREAD:
1261             cpu = gdb_get_cpu(s, pid, tid);
1262
1263             /* invalid CPU/thread specified */
1264             if (!cpu) {
1265                 res = -EINVAL;
1266                 goto out;
1267             }
1268
1269             /* only use if no previous match occourred */
1270             if (newstates[cpu->cpu_index] == 1) {
1271                 newstates[cpu->cpu_index] = cur_action;
1272             }
1273             break;
1274         }
1275     }
1276     s->signal = signal;
1277     gdb_continue_partial(s, newstates);
1278
1279 out:
1280     g_free(newstates);
1281
1282     return res;
1283 }
1284
1285 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1286 {
1287     CPUState *cpu;
1288     GDBProcess *process;
1289     CPUClass *cc;
1290     const char *p;
1291     uint32_t pid, tid;
1292     int ch, reg_size, type, res;
1293     uint8_t mem_buf[MAX_PACKET_LENGTH];
1294     char buf[sizeof(mem_buf) + 1 /* trailing NUL */];
1295     char thread_id[16];
1296     uint8_t *registers;
1297     target_ulong addr, len;
1298     GDBThreadIdKind thread_kind;
1299
1300     trace_gdbstub_io_command(line_buf);
1301
1302     p = line_buf;
1303     ch = *p++;
1304     switch(ch) {
1305     case '!':
1306         put_packet(s, "OK");
1307         break;
1308     case '?':
1309         /* TODO: Make this return the correct value for user-mode.  */
1310         snprintf(buf, sizeof(buf), "T%02xthread:%s;", GDB_SIGNAL_TRAP,
1311                  gdb_fmt_thread_id(s, s->c_cpu, thread_id, sizeof(thread_id)));
1312         put_packet(s, buf);
1313         /* Remove all the breakpoints when this query is issued,
1314          * because gdb is doing and initial connect and the state
1315          * should be cleaned up.
1316          */
1317         gdb_breakpoint_remove_all();
1318         break;
1319     case 'c':
1320         if (*p != '\0') {
1321             addr = strtoull(p, (char **)&p, 16);
1322             gdb_set_cpu_pc(s, addr);
1323         }
1324         s->signal = 0;
1325         gdb_continue(s);
1326         return RS_IDLE;
1327     case 'C':
1328         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1329         if (s->signal == -1)
1330             s->signal = 0;
1331         gdb_continue(s);
1332         return RS_IDLE;
1333     case 'v':
1334         if (strncmp(p, "Cont", 4) == 0) {
1335             p += 4;
1336             if (*p == '?') {
1337                 put_packet(s, "vCont;c;C;s;S");
1338                 break;
1339             }
1340
1341             res = gdb_handle_vcont(s, p);
1342
1343             if (res) {
1344                 if ((res == -EINVAL) || (res == -ERANGE)) {
1345                     put_packet(s, "E22");
1346                     break;
1347                 }
1348                 goto unknown_command;
1349             }
1350             break;
1351         } else if (strncmp(p, "Attach;", 7) == 0) {
1352             unsigned long pid;
1353
1354             p += 7;
1355
1356             if (qemu_strtoul(p, &p, 16, &pid)) {
1357                 put_packet(s, "E22");
1358                 break;
1359             }
1360
1361             process = gdb_get_process(s, pid);
1362
1363             if (process == NULL) {
1364                 put_packet(s, "E22");
1365                 break;
1366             }
1367
1368             cpu = get_first_cpu_in_process(s, process);
1369
1370             if (cpu == NULL) {
1371                 /* Refuse to attach an empty process */
1372                 put_packet(s, "E22");
1373                 break;
1374             }
1375
1376             process->attached = true;
1377
1378             s->g_cpu = cpu;
1379             s->c_cpu = cpu;
1380
1381             snprintf(buf, sizeof(buf), "T%02xthread:%s;", GDB_SIGNAL_TRAP,
1382                      gdb_fmt_thread_id(s, cpu, thread_id, sizeof(thread_id)));
1383
1384             put_packet(s, buf);
1385             break;
1386         } else {
1387             goto unknown_command;
1388         }
1389     case 'k':
1390         /* Kill the target */
1391         error_report("QEMU: Terminated via GDBstub");
1392         exit(0);
1393     case 'D':
1394         /* Detach packet */
1395         pid = 1;
1396
1397         if (s->multiprocess) {
1398             unsigned long lpid;
1399             if (*p != ';') {
1400                 put_packet(s, "E22");
1401                 break;
1402             }
1403
1404             if (qemu_strtoul(p + 1, &p, 16, &lpid)) {
1405                 put_packet(s, "E22");
1406                 break;
1407             }
1408
1409             pid = lpid;
1410         }
1411
1412         process = gdb_get_process(s, pid);
1413         gdb_process_breakpoint_remove_all(s, process);
1414         process->attached = false;
1415
1416         if (pid == gdb_get_cpu_pid(s, s->c_cpu)) {
1417             s->c_cpu = gdb_first_attached_cpu(s);
1418         }
1419
1420         if (pid == gdb_get_cpu_pid(s, s->g_cpu)) {
1421             s->g_cpu = gdb_first_attached_cpu(s);
1422         }
1423
1424         if (s->c_cpu == NULL) {
1425             /* No more process attached */
1426             gdb_syscall_mode = GDB_SYS_DISABLED;
1427             gdb_continue(s);
1428         }
1429         put_packet(s, "OK");
1430         break;
1431     case 's':
1432         if (*p != '\0') {
1433             addr = strtoull(p, (char **)&p, 16);
1434             gdb_set_cpu_pc(s, addr);
1435         }
1436         cpu_single_step(s->c_cpu, sstep_flags);
1437         gdb_continue(s);
1438         return RS_IDLE;
1439     case 'F':
1440         {
1441             target_ulong ret;
1442             target_ulong err;
1443
1444             ret = strtoull(p, (char **)&p, 16);
1445             if (*p == ',') {
1446                 p++;
1447                 err = strtoull(p, (char **)&p, 16);
1448             } else {
1449                 err = 0;
1450             }
1451             if (*p == ',')
1452                 p++;
1453             type = *p;
1454             if (s->current_syscall_cb) {
1455                 s->current_syscall_cb(s->c_cpu, ret, err);
1456                 s->current_syscall_cb = NULL;
1457             }
1458             if (type == 'C') {
1459                 put_packet(s, "T02");
1460             } else {
1461                 gdb_continue(s);
1462             }
1463         }
1464         break;
1465     case 'g':
1466         cpu_synchronize_state(s->g_cpu);
1467         len = 0;
1468         for (addr = 0; addr < s->g_cpu->gdb_num_g_regs; addr++) {
1469             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1470             len += reg_size;
1471         }
1472         memtohex(buf, mem_buf, len);
1473         put_packet(s, buf);
1474         break;
1475     case 'G':
1476         cpu_synchronize_state(s->g_cpu);
1477         registers = mem_buf;
1478         len = strlen(p) / 2;
1479         hextomem((uint8_t *)registers, p, len);
1480         for (addr = 0; addr < s->g_cpu->gdb_num_g_regs && len > 0; addr++) {
1481             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1482             len -= reg_size;
1483             registers += reg_size;
1484         }
1485         put_packet(s, "OK");
1486         break;
1487     case 'm':
1488         addr = strtoull(p, (char **)&p, 16);
1489         if (*p == ',')
1490             p++;
1491         len = strtoull(p, NULL, 16);
1492
1493         /* memtohex() doubles the required space */
1494         if (len > MAX_PACKET_LENGTH / 2) {
1495             put_packet (s, "E22");
1496             break;
1497         }
1498
1499         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
1500             put_packet (s, "E14");
1501         } else {
1502             memtohex(buf, mem_buf, len);
1503             put_packet(s, buf);
1504         }
1505         break;
1506     case 'M':
1507         addr = strtoull(p, (char **)&p, 16);
1508         if (*p == ',')
1509             p++;
1510         len = strtoull(p, (char **)&p, 16);
1511         if (*p == ':')
1512             p++;
1513
1514         /* hextomem() reads 2*len bytes */
1515         if (len > strlen(p) / 2) {
1516             put_packet (s, "E22");
1517             break;
1518         }
1519         hextomem(mem_buf, p, len);
1520         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
1521                                    true) != 0) {
1522             put_packet(s, "E14");
1523         } else {
1524             put_packet(s, "OK");
1525         }
1526         break;
1527     case 'p':
1528         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1529            This works, but can be very slow.  Anything new enough to
1530            understand XML also knows how to use this properly.  */
1531         if (!gdb_has_xml)
1532             goto unknown_command;
1533         addr = strtoull(p, (char **)&p, 16);
1534         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1535         if (reg_size) {
1536             memtohex(buf, mem_buf, reg_size);
1537             put_packet(s, buf);
1538         } else {
1539             put_packet(s, "E14");
1540         }
1541         break;
1542     case 'P':
1543         if (!gdb_has_xml)
1544             goto unknown_command;
1545         addr = strtoull(p, (char **)&p, 16);
1546         if (*p == '=')
1547             p++;
1548         reg_size = strlen(p) / 2;
1549         hextomem(mem_buf, p, reg_size);
1550         gdb_write_register(s->g_cpu, mem_buf, addr);
1551         put_packet(s, "OK");
1552         break;
1553     case 'Z':
1554     case 'z':
1555         type = strtoul(p, (char **)&p, 16);
1556         if (*p == ',')
1557             p++;
1558         addr = strtoull(p, (char **)&p, 16);
1559         if (*p == ',')
1560             p++;
1561         len = strtoull(p, (char **)&p, 16);
1562         if (ch == 'Z')
1563             res = gdb_breakpoint_insert(addr, len, type);
1564         else
1565             res = gdb_breakpoint_remove(addr, len, type);
1566         if (res >= 0)
1567              put_packet(s, "OK");
1568         else if (res == -ENOSYS)
1569             put_packet(s, "");
1570         else
1571             put_packet(s, "E22");
1572         break;
1573     case 'H':
1574         type = *p++;
1575
1576         thread_kind = read_thread_id(p, &p, &pid, &tid);
1577         if (thread_kind == GDB_READ_THREAD_ERR) {
1578             put_packet(s, "E22");
1579             break;
1580         }
1581
1582         if (thread_kind != GDB_ONE_THREAD) {
1583             put_packet(s, "OK");
1584             break;
1585         }
1586         cpu = gdb_get_cpu(s, pid, tid);
1587         if (cpu == NULL) {
1588             put_packet(s, "E22");
1589             break;
1590         }
1591         switch (type) {
1592         case 'c':
1593             s->c_cpu = cpu;
1594             put_packet(s, "OK");
1595             break;
1596         case 'g':
1597             s->g_cpu = cpu;
1598             put_packet(s, "OK");
1599             break;
1600         default:
1601              put_packet(s, "E22");
1602              break;
1603         }
1604         break;
1605     case 'T':
1606         thread_kind = read_thread_id(p, &p, &pid, &tid);
1607         if (thread_kind == GDB_READ_THREAD_ERR) {
1608             put_packet(s, "E22");
1609             break;
1610         }
1611         cpu = gdb_get_cpu(s, pid, tid);
1612
1613         if (cpu != NULL) {
1614             put_packet(s, "OK");
1615         } else {
1616             put_packet(s, "E22");
1617         }
1618         break;
1619     case 'q':
1620     case 'Q':
1621         /* parse any 'q' packets here */
1622         if (!strcmp(p,"qemu.sstepbits")) {
1623             /* Query Breakpoint bit definitions */
1624             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1625                      SSTEP_ENABLE,
1626                      SSTEP_NOIRQ,
1627                      SSTEP_NOTIMER);
1628             put_packet(s, buf);
1629             break;
1630         } else if (is_query_packet(p, "qemu.sstep", '=')) {
1631             /* Display or change the sstep_flags */
1632             p += 10;
1633             if (*p != '=') {
1634                 /* Display current setting */
1635                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1636                 put_packet(s, buf);
1637                 break;
1638             }
1639             p++;
1640             type = strtoul(p, (char **)&p, 16);
1641             sstep_flags = type;
1642             put_packet(s, "OK");
1643             break;
1644         } else if (strcmp(p,"C") == 0) {
1645             /*
1646              * "Current thread" remains vague in the spec, so always return
1647              * the first thread of the current process (gdb returns the
1648              * first thread).
1649              */
1650             cpu = get_first_cpu_in_process(s, gdb_get_cpu_process(s, s->g_cpu));
1651             snprintf(buf, sizeof(buf), "QC%s",
1652                      gdb_fmt_thread_id(s, cpu, thread_id, sizeof(thread_id)));
1653             put_packet(s, buf);
1654             break;
1655         } else if (strcmp(p,"fThreadInfo") == 0) {
1656             s->query_cpu = gdb_first_attached_cpu(s);
1657             goto report_cpuinfo;
1658         } else if (strcmp(p,"sThreadInfo") == 0) {
1659         report_cpuinfo:
1660             if (s->query_cpu) {
1661                 snprintf(buf, sizeof(buf), "m%s",
1662                          gdb_fmt_thread_id(s, s->query_cpu,
1663                                        thread_id, sizeof(thread_id)));
1664                 put_packet(s, buf);
1665                 s->query_cpu = gdb_next_attached_cpu(s, s->query_cpu);
1666             } else
1667                 put_packet(s, "l");
1668             break;
1669         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1670             if (read_thread_id(p + 16, &p, &pid, &tid) == GDB_READ_THREAD_ERR) {
1671                 put_packet(s, "E22");
1672                 break;
1673             }
1674             cpu = gdb_get_cpu(s, pid, tid);
1675             if (cpu != NULL) {
1676                 cpu_synchronize_state(cpu);
1677
1678                 if (s->multiprocess && (s->process_num > 1)) {
1679                     /* Print the CPU model and name in multiprocess mode */
1680                     ObjectClass *oc = object_get_class(OBJECT(cpu));
1681                     const char *cpu_model = object_class_get_name(oc);
1682                     char *cpu_name =
1683                         object_get_canonical_path_component(OBJECT(cpu));
1684                     len = snprintf((char *)mem_buf, sizeof(buf) / 2,
1685                                    "%s %s [%s]", cpu_model, cpu_name,
1686                                    cpu->halted ? "halted " : "running");
1687                     g_free(cpu_name);
1688                 } else {
1689                     /* memtohex() doubles the required space */
1690                     len = snprintf((char *)mem_buf, sizeof(buf) / 2,
1691                                    "CPU#%d [%s]", cpu->cpu_index,
1692                                    cpu->halted ? "halted " : "running");
1693                 }
1694                 trace_gdbstub_op_extra_info((char *)mem_buf);
1695                 memtohex(buf, mem_buf, len);
1696                 put_packet(s, buf);
1697             }
1698             break;
1699         }
1700 #ifdef CONFIG_USER_ONLY
1701         else if (strcmp(p, "Offsets") == 0) {
1702             TaskState *ts = s->c_cpu->opaque;
1703
1704             snprintf(buf, sizeof(buf),
1705                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1706                      ";Bss=" TARGET_ABI_FMT_lx,
1707                      ts->info->code_offset,
1708                      ts->info->data_offset,
1709                      ts->info->data_offset);
1710             put_packet(s, buf);
1711             break;
1712         }
1713 #else /* !CONFIG_USER_ONLY */
1714         else if (strncmp(p, "Rcmd,", 5) == 0) {
1715             int len = strlen(p + 5);
1716
1717             if ((len % 2) != 0) {
1718                 put_packet(s, "E01");
1719                 break;
1720             }
1721             len = len / 2;
1722             hextomem(mem_buf, p + 5, len);
1723             mem_buf[len++] = 0;
1724             qemu_chr_be_write(s->mon_chr, mem_buf, len);
1725             put_packet(s, "OK");
1726             break;
1727         }
1728 #endif /* !CONFIG_USER_ONLY */
1729         if (is_query_packet(p, "Supported", ':')) {
1730             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1731             cc = CPU_GET_CLASS(first_cpu);
1732             if (cc->gdb_core_xml_file != NULL) {
1733                 pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1734             }
1735             put_packet(s, buf);
1736             break;
1737         }
1738         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1739             const char *xml;
1740             target_ulong total_len;
1741
1742             process = gdb_get_cpu_process(s, s->g_cpu);
1743             cc = CPU_GET_CLASS(s->g_cpu);
1744             if (cc->gdb_core_xml_file == NULL) {
1745                 goto unknown_command;
1746             }
1747
1748             gdb_has_xml = true;
1749             p += 19;
1750             xml = get_feature_xml(s, p, &p, process);
1751             if (!xml) {
1752                 snprintf(buf, sizeof(buf), "E00");
1753                 put_packet(s, buf);
1754                 break;
1755             }
1756
1757             if (*p == ':')
1758                 p++;
1759             addr = strtoul(p, (char **)&p, 16);
1760             if (*p == ',')
1761                 p++;
1762             len = strtoul(p, (char **)&p, 16);
1763
1764             total_len = strlen(xml);
1765             if (addr > total_len) {
1766                 snprintf(buf, sizeof(buf), "E00");
1767                 put_packet(s, buf);
1768                 break;
1769             }
1770             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1771                 len = (MAX_PACKET_LENGTH - 5) / 2;
1772             if (len < total_len - addr) {
1773                 buf[0] = 'm';
1774                 len = memtox(buf + 1, xml + addr, len);
1775             } else {
1776                 buf[0] = 'l';
1777                 len = memtox(buf + 1, xml + addr, total_len - addr);
1778             }
1779             put_packet_binary(s, buf, len + 1, true);
1780             break;
1781         }
1782         if (is_query_packet(p, "Attached", ':')) {
1783             put_packet(s, GDB_ATTACHED);
1784             break;
1785         }
1786         /* Unrecognised 'q' command.  */
1787         goto unknown_command;
1788
1789     default:
1790     unknown_command:
1791         /* put empty packet */
1792         buf[0] = '\0';
1793         put_packet(s, buf);
1794         break;
1795     }
1796     return RS_IDLE;
1797 }
1798
1799 void gdb_set_stop_cpu(CPUState *cpu)
1800 {
1801     gdbserver_state->c_cpu = cpu;
1802     gdbserver_state->g_cpu = cpu;
1803 }
1804
1805 #ifndef CONFIG_USER_ONLY
1806 static void gdb_vm_state_change(void *opaque, int running, RunState state)
1807 {
1808     GDBState *s = gdbserver_state;
1809     CPUState *cpu = s->c_cpu;
1810     char buf[256];
1811     char thread_id[16];
1812     const char *type;
1813     int ret;
1814
1815     if (running || s->state == RS_INACTIVE) {
1816         return;
1817     }
1818     /* Is there a GDB syscall waiting to be sent?  */
1819     if (s->current_syscall_cb) {
1820         put_packet(s, s->syscall_buf);
1821         return;
1822     }
1823
1824     if (cpu == NULL) {
1825         /* No process attached */
1826         return;
1827     }
1828
1829     gdb_fmt_thread_id(s, cpu, thread_id, sizeof(thread_id));
1830
1831     switch (state) {
1832     case RUN_STATE_DEBUG:
1833         if (cpu->watchpoint_hit) {
1834             switch (cpu->watchpoint_hit->flags & BP_MEM_ACCESS) {
1835             case BP_MEM_READ:
1836                 type = "r";
1837                 break;
1838             case BP_MEM_ACCESS:
1839                 type = "a";
1840                 break;
1841             default:
1842                 type = "";
1843                 break;
1844             }
1845             trace_gdbstub_hit_watchpoint(type, cpu_gdb_index(cpu),
1846                     (target_ulong)cpu->watchpoint_hit->vaddr);
1847             snprintf(buf, sizeof(buf),
1848                      "T%02xthread:%s;%swatch:" TARGET_FMT_lx ";",
1849                      GDB_SIGNAL_TRAP, thread_id, type,
1850                      (target_ulong)cpu->watchpoint_hit->vaddr);
1851             cpu->watchpoint_hit = NULL;
1852             goto send_packet;
1853         } else {
1854             trace_gdbstub_hit_break();
1855         }
1856         tb_flush(cpu);
1857         ret = GDB_SIGNAL_TRAP;
1858         break;
1859     case RUN_STATE_PAUSED:
1860         trace_gdbstub_hit_paused();
1861         ret = GDB_SIGNAL_INT;
1862         break;
1863     case RUN_STATE_SHUTDOWN:
1864         trace_gdbstub_hit_shutdown();
1865         ret = GDB_SIGNAL_QUIT;
1866         break;
1867     case RUN_STATE_IO_ERROR:
1868         trace_gdbstub_hit_io_error();
1869         ret = GDB_SIGNAL_IO;
1870         break;
1871     case RUN_STATE_WATCHDOG:
1872         trace_gdbstub_hit_watchdog();
1873         ret = GDB_SIGNAL_ALRM;
1874         break;
1875     case RUN_STATE_INTERNAL_ERROR:
1876         trace_gdbstub_hit_internal_error();
1877         ret = GDB_SIGNAL_ABRT;
1878         break;
1879     case RUN_STATE_SAVE_VM:
1880     case RUN_STATE_RESTORE_VM:
1881         return;
1882     case RUN_STATE_FINISH_MIGRATE:
1883         ret = GDB_SIGNAL_XCPU;
1884         break;
1885     default:
1886         trace_gdbstub_hit_unknown(state);
1887         ret = GDB_SIGNAL_UNKNOWN;
1888         break;
1889     }
1890     gdb_set_stop_cpu(cpu);
1891     snprintf(buf, sizeof(buf), "T%02xthread:%s;", ret, thread_id);
1892
1893 send_packet:
1894     put_packet(s, buf);
1895
1896     /* disable single step if it was enabled */
1897     cpu_single_step(cpu, 0);
1898 }
1899 #endif
1900
1901 /* Send a gdb syscall request.
1902    This accepts limited printf-style format specifiers, specifically:
1903     %x  - target_ulong argument printed in hex.
1904     %lx - 64-bit argument printed in hex.
1905     %s  - string pointer (target_ulong) and length (int) pair.  */
1906 void gdb_do_syscallv(gdb_syscall_complete_cb cb, const char *fmt, va_list va)
1907 {
1908     char *p;
1909     char *p_end;
1910     target_ulong addr;
1911     uint64_t i64;
1912     GDBState *s;
1913
1914     s = gdbserver_state;
1915     if (!s)
1916         return;
1917     s->current_syscall_cb = cb;
1918 #ifndef CONFIG_USER_ONLY
1919     vm_stop(RUN_STATE_DEBUG);
1920 #endif
1921     p = s->syscall_buf;
1922     p_end = &s->syscall_buf[sizeof(s->syscall_buf)];
1923     *(p++) = 'F';
1924     while (*fmt) {
1925         if (*fmt == '%') {
1926             fmt++;
1927             switch (*fmt++) {
1928             case 'x':
1929                 addr = va_arg(va, target_ulong);
1930                 p += snprintf(p, p_end - p, TARGET_FMT_lx, addr);
1931                 break;
1932             case 'l':
1933                 if (*(fmt++) != 'x')
1934                     goto bad_format;
1935                 i64 = va_arg(va, uint64_t);
1936                 p += snprintf(p, p_end - p, "%" PRIx64, i64);
1937                 break;
1938             case 's':
1939                 addr = va_arg(va, target_ulong);
1940                 p += snprintf(p, p_end - p, TARGET_FMT_lx "/%x",
1941                               addr, va_arg(va, int));
1942                 break;
1943             default:
1944             bad_format:
1945                 error_report("gdbstub: Bad syscall format string '%s'",
1946                              fmt - 1);
1947                 break;
1948             }
1949         } else {
1950             *(p++) = *(fmt++);
1951         }
1952     }
1953     *p = 0;
1954 #ifdef CONFIG_USER_ONLY
1955     put_packet(s, s->syscall_buf);
1956     /* Return control to gdb for it to process the syscall request.
1957      * Since the protocol requires that gdb hands control back to us
1958      * using a "here are the results" F packet, we don't need to check
1959      * gdb_handlesig's return value (which is the signal to deliver if
1960      * execution was resumed via a continue packet).
1961      */
1962     gdb_handlesig(s->c_cpu, 0);
1963 #else
1964     /* In this case wait to send the syscall packet until notification that
1965        the CPU has stopped.  This must be done because if the packet is sent
1966        now the reply from the syscall request could be received while the CPU
1967        is still in the running state, which can cause packets to be dropped
1968        and state transition 'T' packets to be sent while the syscall is still
1969        being processed.  */
1970     qemu_cpu_kick(s->c_cpu);
1971 #endif
1972 }
1973
1974 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1975 {
1976     va_list va;
1977
1978     va_start(va, fmt);
1979     gdb_do_syscallv(cb, fmt, va);
1980     va_end(va);
1981 }
1982
1983 static void gdb_read_byte(GDBState *s, int ch)
1984 {
1985     uint8_t reply;
1986
1987 #ifndef CONFIG_USER_ONLY
1988     if (s->last_packet_len) {
1989         /* Waiting for a response to the last packet.  If we see the start
1990            of a new command then abandon the previous response.  */
1991         if (ch == '-') {
1992             trace_gdbstub_err_got_nack();
1993             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
1994         } else if (ch == '+') {
1995             trace_gdbstub_io_got_ack();
1996         } else {
1997             trace_gdbstub_io_got_unexpected((uint8_t)ch);
1998         }
1999
2000         if (ch == '+' || ch == '$')
2001             s->last_packet_len = 0;
2002         if (ch != '$')
2003             return;
2004     }
2005     if (runstate_is_running()) {
2006         /* when the CPU is running, we cannot do anything except stop
2007            it when receiving a char */
2008         vm_stop(RUN_STATE_PAUSED);
2009     } else
2010 #endif
2011     {
2012         switch(s->state) {
2013         case RS_IDLE:
2014             if (ch == '$') {
2015                 /* start of command packet */
2016                 s->line_buf_index = 0;
2017                 s->line_sum = 0;
2018                 s->state = RS_GETLINE;
2019             } else {
2020                 trace_gdbstub_err_garbage((uint8_t)ch);
2021             }
2022             break;
2023         case RS_GETLINE:
2024             if (ch == '}') {
2025                 /* start escape sequence */
2026                 s->state = RS_GETLINE_ESC;
2027                 s->line_sum += ch;
2028             } else if (ch == '*') {
2029                 /* start run length encoding sequence */
2030                 s->state = RS_GETLINE_RLE;
2031                 s->line_sum += ch;
2032             } else if (ch == '#') {
2033                 /* end of command, start of checksum*/
2034                 s->state = RS_CHKSUM1;
2035             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2036                 trace_gdbstub_err_overrun();
2037                 s->state = RS_IDLE;
2038             } else {
2039                 /* unescaped command character */
2040                 s->line_buf[s->line_buf_index++] = ch;
2041                 s->line_sum += ch;
2042             }
2043             break;
2044         case RS_GETLINE_ESC:
2045             if (ch == '#') {
2046                 /* unexpected end of command in escape sequence */
2047                 s->state = RS_CHKSUM1;
2048             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2049                 /* command buffer overrun */
2050                 trace_gdbstub_err_overrun();
2051                 s->state = RS_IDLE;
2052             } else {
2053                 /* parse escaped character and leave escape state */
2054                 s->line_buf[s->line_buf_index++] = ch ^ 0x20;
2055                 s->line_sum += ch;
2056                 s->state = RS_GETLINE;
2057             }
2058             break;
2059         case RS_GETLINE_RLE:
2060             if (ch < ' ') {
2061                 /* invalid RLE count encoding */
2062                 trace_gdbstub_err_invalid_repeat((uint8_t)ch);
2063                 s->state = RS_GETLINE;
2064             } else {
2065                 /* decode repeat length */
2066                 int repeat = (unsigned char)ch - ' ' + 3;
2067                 if (s->line_buf_index + repeat >= sizeof(s->line_buf) - 1) {
2068                     /* that many repeats would overrun the command buffer */
2069                     trace_gdbstub_err_overrun();
2070                     s->state = RS_IDLE;
2071                 } else if (s->line_buf_index < 1) {
2072                     /* got a repeat but we have nothing to repeat */
2073                     trace_gdbstub_err_invalid_rle();
2074                     s->state = RS_GETLINE;
2075                 } else {
2076                     /* repeat the last character */
2077                     memset(s->line_buf + s->line_buf_index,
2078                            s->line_buf[s->line_buf_index - 1], repeat);
2079                     s->line_buf_index += repeat;
2080                     s->line_sum += ch;
2081                     s->state = RS_GETLINE;
2082                 }
2083             }
2084             break;
2085         case RS_CHKSUM1:
2086             /* get high hex digit of checksum */
2087             if (!isxdigit(ch)) {
2088                 trace_gdbstub_err_checksum_invalid((uint8_t)ch);
2089                 s->state = RS_GETLINE;
2090                 break;
2091             }
2092             s->line_buf[s->line_buf_index] = '\0';
2093             s->line_csum = fromhex(ch) << 4;
2094             s->state = RS_CHKSUM2;
2095             break;
2096         case RS_CHKSUM2:
2097             /* get low hex digit of checksum */
2098             if (!isxdigit(ch)) {
2099                 trace_gdbstub_err_checksum_invalid((uint8_t)ch);
2100                 s->state = RS_GETLINE;
2101                 break;
2102             }
2103             s->line_csum |= fromhex(ch);
2104
2105             if (s->line_csum != (s->line_sum & 0xff)) {
2106                 trace_gdbstub_err_checksum_incorrect(s->line_sum, s->line_csum);
2107                 /* send NAK reply */
2108                 reply = '-';
2109                 put_buffer(s, &reply, 1);
2110                 s->state = RS_IDLE;
2111             } else {
2112                 /* send ACK reply */
2113                 reply = '+';
2114                 put_buffer(s, &reply, 1);
2115                 s->state = gdb_handle_packet(s, s->line_buf);
2116             }
2117             break;
2118         default:
2119             abort();
2120         }
2121     }
2122 }
2123
2124 /* Tell the remote gdb that the process has exited.  */
2125 void gdb_exit(CPUArchState *env, int code)
2126 {
2127   GDBState *s;
2128   char buf[4];
2129
2130   s = gdbserver_state;
2131   if (!s) {
2132       return;
2133   }
2134 #ifdef CONFIG_USER_ONLY
2135   if (gdbserver_fd < 0 || s->fd < 0) {
2136       return;
2137   }
2138 #endif
2139
2140   trace_gdbstub_op_exiting((uint8_t)code);
2141
2142   snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
2143   put_packet(s, buf);
2144
2145 #ifndef CONFIG_USER_ONLY
2146   qemu_chr_fe_deinit(&s->chr, true);
2147 #endif
2148 }
2149
2150 /*
2151  * Create the process that will contain all the "orphan" CPUs (that are not
2152  * part of a CPU cluster). Note that if this process contains no CPUs, it won't
2153  * be attachable and thus will be invisible to the user.
2154  */
2155 static void create_default_process(GDBState *s)
2156 {
2157     GDBProcess *process;
2158     int max_pid = 0;
2159
2160     if (s->process_num) {
2161         max_pid = s->processes[s->process_num - 1].pid;
2162     }
2163
2164     s->processes = g_renew(GDBProcess, s->processes, ++s->process_num);
2165     process = &s->processes[s->process_num - 1];
2166
2167     /* We need an available PID slot for this process */
2168     assert(max_pid < UINT32_MAX);
2169
2170     process->pid = max_pid + 1;
2171     process->attached = false;
2172     process->target_xml[0] = '\0';
2173 }
2174
2175 #ifdef CONFIG_USER_ONLY
2176 int
2177 gdb_handlesig(CPUState *cpu, int sig)
2178 {
2179     GDBState *s;
2180     char buf[256];
2181     int n;
2182
2183     s = gdbserver_state;
2184     if (gdbserver_fd < 0 || s->fd < 0) {
2185         return sig;
2186     }
2187
2188     /* disable single step if it was enabled */
2189     cpu_single_step(cpu, 0);
2190     tb_flush(cpu);
2191
2192     if (sig != 0) {
2193         snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));
2194         put_packet(s, buf);
2195     }
2196     /* put_packet() might have detected that the peer terminated the
2197        connection.  */
2198     if (s->fd < 0) {
2199         return sig;
2200     }
2201
2202     sig = 0;
2203     s->state = RS_IDLE;
2204     s->running_state = 0;
2205     while (s->running_state == 0) {
2206         n = read(s->fd, buf, 256);
2207         if (n > 0) {
2208             int i;
2209
2210             for (i = 0; i < n; i++) {
2211                 gdb_read_byte(s, buf[i]);
2212             }
2213         } else {
2214             /* XXX: Connection closed.  Should probably wait for another
2215                connection before continuing.  */
2216             if (n == 0) {
2217                 close(s->fd);
2218             }
2219             s->fd = -1;
2220             return sig;
2221         }
2222     }
2223     sig = s->signal;
2224     s->signal = 0;
2225     return sig;
2226 }
2227
2228 /* Tell the remote gdb that the process has exited due to SIG.  */
2229 void gdb_signalled(CPUArchState *env, int sig)
2230 {
2231     GDBState *s;
2232     char buf[4];
2233
2234     s = gdbserver_state;
2235     if (gdbserver_fd < 0 || s->fd < 0) {
2236         return;
2237     }
2238
2239     snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb(sig));
2240     put_packet(s, buf);
2241 }
2242
2243 static bool gdb_accept(void)
2244 {
2245     GDBState *s;
2246     struct sockaddr_in sockaddr;
2247     socklen_t len;
2248     int fd;
2249
2250     for(;;) {
2251         len = sizeof(sockaddr);
2252         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2253         if (fd < 0 && errno != EINTR) {
2254             perror("accept");
2255             return false;
2256         } else if (fd >= 0) {
2257             qemu_set_cloexec(fd);
2258             break;
2259         }
2260     }
2261
2262     /* set short latency */
2263     if (socket_set_nodelay(fd)) {
2264         perror("setsockopt");
2265         close(fd);
2266         return false;
2267     }
2268
2269     s = g_malloc0(sizeof(GDBState));
2270     create_default_process(s);
2271     s->processes[0].attached = true;
2272     s->c_cpu = gdb_first_attached_cpu(s);
2273     s->g_cpu = s->c_cpu;
2274     s->fd = fd;
2275     gdb_has_xml = false;
2276
2277     gdbserver_state = s;
2278     return true;
2279 }
2280
2281 static int gdbserver_open(int port)
2282 {
2283     struct sockaddr_in sockaddr;
2284     int fd, ret;
2285
2286     fd = socket(PF_INET, SOCK_STREAM, 0);
2287     if (fd < 0) {
2288         perror("socket");
2289         return -1;
2290     }
2291     qemu_set_cloexec(fd);
2292
2293     socket_set_fast_reuse(fd);
2294
2295     sockaddr.sin_family = AF_INET;
2296     sockaddr.sin_port = htons(port);
2297     sockaddr.sin_addr.s_addr = 0;
2298     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2299     if (ret < 0) {
2300         perror("bind");
2301         close(fd);
2302         return -1;
2303     }
2304     ret = listen(fd, 1);
2305     if (ret < 0) {
2306         perror("listen");
2307         close(fd);
2308         return -1;
2309     }
2310     return fd;
2311 }
2312
2313 int gdbserver_start(int port)
2314 {
2315     gdbserver_fd = gdbserver_open(port);
2316     if (gdbserver_fd < 0)
2317         return -1;
2318     /* accept connections */
2319     if (!gdb_accept()) {
2320         close(gdbserver_fd);
2321         gdbserver_fd = -1;
2322         return -1;
2323     }
2324     return 0;
2325 }
2326
2327 /* Disable gdb stub for child processes.  */
2328 void gdbserver_fork(CPUState *cpu)
2329 {
2330     GDBState *s = gdbserver_state;
2331
2332     if (gdbserver_fd < 0 || s->fd < 0) {
2333         return;
2334     }
2335     close(s->fd);
2336     s->fd = -1;
2337     cpu_breakpoint_remove_all(cpu, BP_GDB);
2338     cpu_watchpoint_remove_all(cpu, BP_GDB);
2339 }
2340 #else
2341 static int gdb_chr_can_receive(void *opaque)
2342 {
2343   /* We can handle an arbitrarily large amount of data.
2344    Pick the maximum packet size, which is as good as anything.  */
2345   return MAX_PACKET_LENGTH;
2346 }
2347
2348 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2349 {
2350     int i;
2351
2352     for (i = 0; i < size; i++) {
2353         gdb_read_byte(gdbserver_state, buf[i]);
2354     }
2355 }
2356
2357 static void gdb_chr_event(void *opaque, int event)
2358 {
2359     int i;
2360     GDBState *s = (GDBState *) opaque;
2361
2362     switch (event) {
2363     case CHR_EVENT_OPENED:
2364         /* Start with first process attached, others detached */
2365         for (i = 0; i < s->process_num; i++) {
2366             s->processes[i].attached = !i;
2367         }
2368
2369         s->c_cpu = gdb_first_attached_cpu(s);
2370         s->g_cpu = s->c_cpu;
2371
2372         vm_stop(RUN_STATE_PAUSED);
2373         gdb_has_xml = false;
2374         break;
2375     default:
2376         break;
2377     }
2378 }
2379
2380 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2381 {
2382     char buf[MAX_PACKET_LENGTH];
2383
2384     buf[0] = 'O';
2385     if (len > (MAX_PACKET_LENGTH/2) - 1)
2386         len = (MAX_PACKET_LENGTH/2) - 1;
2387     memtohex(buf + 1, (uint8_t *)msg, len);
2388     put_packet(s, buf);
2389 }
2390
2391 static int gdb_monitor_write(Chardev *chr, const uint8_t *buf, int len)
2392 {
2393     const char *p = (const char *)buf;
2394     int max_sz;
2395
2396     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2397     for (;;) {
2398         if (len <= max_sz) {
2399             gdb_monitor_output(gdbserver_state, p, len);
2400             break;
2401         }
2402         gdb_monitor_output(gdbserver_state, p, max_sz);
2403         p += max_sz;
2404         len -= max_sz;
2405     }
2406     return len;
2407 }
2408
2409 #ifndef _WIN32
2410 static void gdb_sigterm_handler(int signal)
2411 {
2412     if (runstate_is_running()) {
2413         vm_stop(RUN_STATE_PAUSED);
2414     }
2415 }
2416 #endif
2417
2418 static void gdb_monitor_open(Chardev *chr, ChardevBackend *backend,
2419                              bool *be_opened, Error **errp)
2420 {
2421     *be_opened = false;
2422 }
2423
2424 static void char_gdb_class_init(ObjectClass *oc, void *data)
2425 {
2426     ChardevClass *cc = CHARDEV_CLASS(oc);
2427
2428     cc->internal = true;
2429     cc->open = gdb_monitor_open;
2430     cc->chr_write = gdb_monitor_write;
2431 }
2432
2433 #define TYPE_CHARDEV_GDB "chardev-gdb"
2434
2435 static const TypeInfo char_gdb_type_info = {
2436     .name = TYPE_CHARDEV_GDB,
2437     .parent = TYPE_CHARDEV,
2438     .class_init = char_gdb_class_init,
2439 };
2440
2441 static int find_cpu_clusters(Object *child, void *opaque)
2442 {
2443     if (object_dynamic_cast(child, TYPE_CPU_CLUSTER)) {
2444         GDBState *s = (GDBState *) opaque;
2445         CPUClusterState *cluster = CPU_CLUSTER(child);
2446         GDBProcess *process;
2447
2448         s->processes = g_renew(GDBProcess, s->processes, ++s->process_num);
2449
2450         process = &s->processes[s->process_num - 1];
2451
2452         /*
2453          * GDB process IDs -1 and 0 are reserved. To avoid subtle errors at
2454          * runtime, we enforce here that the machine does not use a cluster ID
2455          * that would lead to PID 0.
2456          */
2457         assert(cluster->cluster_id != UINT32_MAX);
2458         process->pid = cluster->cluster_id + 1;
2459         process->attached = false;
2460         process->target_xml[0] = '\0';
2461
2462         return 0;
2463     }
2464
2465     return object_child_foreach(child, find_cpu_clusters, opaque);
2466 }
2467
2468 static int pid_order(const void *a, const void *b)
2469 {
2470     GDBProcess *pa = (GDBProcess *) a;
2471     GDBProcess *pb = (GDBProcess *) b;
2472
2473     if (pa->pid < pb->pid) {
2474         return -1;
2475     } else if (pa->pid > pb->pid) {
2476         return 1;
2477     } else {
2478         return 0;
2479     }
2480 }
2481
2482 static void create_processes(GDBState *s)
2483 {
2484     object_child_foreach(object_get_root(), find_cpu_clusters, s);
2485
2486     if (s->processes) {
2487         /* Sort by PID */
2488         qsort(s->processes, s->process_num, sizeof(s->processes[0]), pid_order);
2489     }
2490
2491     create_default_process(s);
2492 }
2493
2494 static void cleanup_processes(GDBState *s)
2495 {
2496     g_free(s->processes);
2497     s->process_num = 0;
2498     s->processes = NULL;
2499 }
2500
2501 int gdbserver_start(const char *device)
2502 {
2503     trace_gdbstub_op_start(device);
2504
2505     GDBState *s;
2506     char gdbstub_device_name[128];
2507     Chardev *chr = NULL;
2508     Chardev *mon_chr;
2509
2510     if (!first_cpu) {
2511         error_report("gdbstub: meaningless to attach gdb to a "
2512                      "machine without any CPU.");
2513         return -1;
2514     }
2515
2516     if (!device)
2517         return -1;
2518     if (strcmp(device, "none") != 0) {
2519         if (strstart(device, "tcp:", NULL)) {
2520             /* enforce required TCP attributes */
2521             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2522                      "%s,nowait,nodelay,server", device);
2523             device = gdbstub_device_name;
2524         }
2525 #ifndef _WIN32
2526         else if (strcmp(device, "stdio") == 0) {
2527             struct sigaction act;
2528
2529             memset(&act, 0, sizeof(act));
2530             act.sa_handler = gdb_sigterm_handler;
2531             sigaction(SIGINT, &act, NULL);
2532         }
2533 #endif
2534         /*
2535          * FIXME: it's a bit weird to allow using a mux chardev here
2536          * and implicitly setup a monitor. We may want to break this.
2537          */
2538         chr = qemu_chr_new_noreplay("gdb", device, true);
2539         if (!chr)
2540             return -1;
2541     }
2542
2543     s = gdbserver_state;
2544     if (!s) {
2545         s = g_malloc0(sizeof(GDBState));
2546         gdbserver_state = s;
2547
2548         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2549
2550         /* Initialize a monitor terminal for gdb */
2551         mon_chr = qemu_chardev_new(NULL, TYPE_CHARDEV_GDB,
2552                                    NULL, &error_abort);
2553         monitor_init(mon_chr, 0);
2554     } else {
2555         qemu_chr_fe_deinit(&s->chr, true);
2556         mon_chr = s->mon_chr;
2557         cleanup_processes(s);
2558         memset(s, 0, sizeof(GDBState));
2559         s->mon_chr = mon_chr;
2560     }
2561
2562     create_processes(s);
2563
2564     if (chr) {
2565         qemu_chr_fe_init(&s->chr, chr, &error_abort);
2566         qemu_chr_fe_set_handlers(&s->chr, gdb_chr_can_receive, gdb_chr_receive,
2567                                  gdb_chr_event, NULL, s, NULL, true);
2568     }
2569     s->state = chr ? RS_IDLE : RS_INACTIVE;
2570     s->mon_chr = mon_chr;
2571     s->current_syscall_cb = NULL;
2572
2573     return 0;
2574 }
2575
2576 void gdbserver_cleanup(void)
2577 {
2578     if (gdbserver_state) {
2579         put_packet(gdbserver_state, "W00");
2580     }
2581 }
2582
2583 static void register_types(void)
2584 {
2585     type_register_static(&char_gdb_type_info);
2586 }
2587
2588 type_init(register_types);
2589 #endif