gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "qemu/osdep.h"
  20 #include "qapi/error.h"
  21 #include "qemu/error-report.h"
  22 #include "qemu/cutils.h"
  23 #include "trace-root.h"
  24 #ifdef CONFIG_USER_ONLY
  25 #include "qemu.h"
  26 #else
  27 #include "monitor/monitor.h"
  28 #include "chardev/char.h"
  29 #include "chardev/char-fe.h"
  30 #include "sysemu/sysemu.h"
  31 #include "exec/gdbstub.h"
  32 #include "hw/cpu/cluster.h"
  33 #endif
  34
  35 #define MAX_PACKET_LENGTH 4096
  36
  37 #include "qemu/sockets.h"
  38 #include "sysemu/hw_accel.h"
  39 #include "sysemu/kvm.h"
  40 #include "exec/semihost.h"
  41 #include "exec/exec-all.h"
  42
  43 #ifdef CONFIG_USER_ONLY
  44 #define GDB_ATTACHED "0"
  45 #else
  46 #define GDB_ATTACHED "1"
  47 #endif
  48
  49 static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
  50                                          uint8_t *buf, int len, bool is_write)
  51 {
  52     CPUClass *cc = CPU_GET_CLASS(cpu);
  53
  54     if (cc->memory_rw_debug) {
  55         return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
  56     }
  57     return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
  58 }
  59
  60 /* Return the GDB index for a given vCPU state.
  61  *
  62  * For user mode this is simply the thread id. In system mode GDB
  63  * numbers CPUs from 1 as 0 is reserved as an "any cpu" index.
  64  */
  65 static inline int cpu_gdb_index(CPUState *cpu)
  66 {
  67 #if defined(CONFIG_USER_ONLY)
  68     TaskState *ts = (TaskState *) cpu->opaque;
  69     return ts->ts_tid;
  70 #else
  71     return cpu->cpu_index + 1;
  72 #endif
  73 }
  74
  75 enum {
  76     GDB_SIGNAL_0 = 0,
  77     GDB_SIGNAL_INT = 2,
  78     GDB_SIGNAL_QUIT = 3,
  79     GDB_SIGNAL_TRAP = 5,
  80     GDB_SIGNAL_ABRT = 6,
  81     GDB_SIGNAL_ALRM = 14,
  82     GDB_SIGNAL_IO = 23,
  83     GDB_SIGNAL_XCPU = 24,
  84     GDB_SIGNAL_UNKNOWN = 143
  85 };
  86
  87 #ifdef CONFIG_USER_ONLY
  88
  89 /* Map target signal numbers to GDB protocol signal numbers and vice
  90  * versa.  For user emulation's currently supported systems, we can
  91  * assume most signals are defined.
  92  */
  93
  94 static int gdb_signal_table[] = {
  95     0,
  96     TARGET_SIGHUP,
  97     TARGET_SIGINT,
  98     TARGET_SIGQUIT,
  99     TARGET_SIGILL,
 100     TARGET_SIGTRAP,
 101     TARGET_SIGABRT,
 102     -1, /* SIGEMT */
 103     TARGET_SIGFPE,
 104     TARGET_SIGKILL,
 105     TARGET_SIGBUS,
 106     TARGET_SIGSEGV,
 107     TARGET_SIGSYS,
 108     TARGET_SIGPIPE,
 109     TARGET_SIGALRM,
 110     TARGET_SIGTERM,
 111     TARGET_SIGURG,
 112     TARGET_SIGSTOP,
 113     TARGET_SIGTSTP,
 114     TARGET_SIGCONT,
 115     TARGET_SIGCHLD,
 116     TARGET_SIGTTIN,
 117     TARGET_SIGTTOU,
 118     TARGET_SIGIO,
 119     TARGET_SIGXCPU,
 120     TARGET_SIGXFSZ,
 121     TARGET_SIGVTALRM,
 122     TARGET_SIGPROF,
 123     TARGET_SIGWINCH,
 124     -1, /* SIGLOST */
 125     TARGET_SIGUSR1,
 126     TARGET_SIGUSR2,
 127 #ifdef TARGET_SIGPWR
 128     TARGET_SIGPWR,
 129 #else
 130     -1,
 131 #endif
 132     -1, /* SIGPOLL */
 133     -1,
 134     -1,
 135     -1,
 136     -1,
 137     -1,
 138     -1,
 139     -1,
 140     -1,
 141     -1,
 142     -1,
 143     -1,
 144 #ifdef __SIGRTMIN
 145     __SIGRTMIN + 1,
 146     __SIGRTMIN + 2,
 147     __SIGRTMIN + 3,
 148     __SIGRTMIN + 4,
 149     __SIGRTMIN + 5,
 150     __SIGRTMIN + 6,
 151     __SIGRTMIN + 7,
 152     __SIGRTMIN + 8,
 153     __SIGRTMIN + 9,
 154     __SIGRTMIN + 10,
 155     __SIGRTMIN + 11,
 156     __SIGRTMIN + 12,
 157     __SIGRTMIN + 13,
 158     __SIGRTMIN + 14,
 159     __SIGRTMIN + 15,
 160     __SIGRTMIN + 16,
 161     __SIGRTMIN + 17,
 162     __SIGRTMIN + 18,
 163     __SIGRTMIN + 19,
 164     __SIGRTMIN + 20,
 165     __SIGRTMIN + 21,
 166     __SIGRTMIN + 22,
 167     __SIGRTMIN + 23,
 168     __SIGRTMIN + 24,
 169     __SIGRTMIN + 25,
 170     __SIGRTMIN + 26,
 171     __SIGRTMIN + 27,
 172     __SIGRTMIN + 28,
 173     __SIGRTMIN + 29,
 174     __SIGRTMIN + 30,
 175     __SIGRTMIN + 31,
 176     -1, /* SIGCANCEL */
 177     __SIGRTMIN,
 178     __SIGRTMIN + 32,
 179     __SIGRTMIN + 33,
 180     __SIGRTMIN + 34,
 181     __SIGRTMIN + 35,
 182     __SIGRTMIN + 36,
 183     __SIGRTMIN + 37,
 184     __SIGRTMIN + 38,
 185     __SIGRTMIN + 39,
 186     __SIGRTMIN + 40,
 187     __SIGRTMIN + 41,
 188     __SIGRTMIN + 42,
 189     __SIGRTMIN + 43,
 190     __SIGRTMIN + 44,
 191     __SIGRTMIN + 45,
 192     __SIGRTMIN + 46,
 193     __SIGRTMIN + 47,
 194     __SIGRTMIN + 48,
 195     __SIGRTMIN + 49,
 196     __SIGRTMIN + 50,
 197     __SIGRTMIN + 51,
 198     __SIGRTMIN + 52,
 199     __SIGRTMIN + 53,
 200     __SIGRTMIN + 54,
 201     __SIGRTMIN + 55,
 202     __SIGRTMIN + 56,
 203     __SIGRTMIN + 57,
 204     __SIGRTMIN + 58,
 205     __SIGRTMIN + 59,
 206     __SIGRTMIN + 60,
 207     __SIGRTMIN + 61,
 208     __SIGRTMIN + 62,
 209     __SIGRTMIN + 63,
 210     __SIGRTMIN + 64,
 211     __SIGRTMIN + 65,
 212     __SIGRTMIN + 66,
 213     __SIGRTMIN + 67,
 214     __SIGRTMIN + 68,
 215     __SIGRTMIN + 69,
 216     __SIGRTMIN + 70,
 217     __SIGRTMIN + 71,
 218     __SIGRTMIN + 72,
 219     __SIGRTMIN + 73,
 220     __SIGRTMIN + 74,
 221     __SIGRTMIN + 75,
 222     __SIGRTMIN + 76,
 223     __SIGRTMIN + 77,
 224     __SIGRTMIN + 78,
 225     __SIGRTMIN + 79,
 226     __SIGRTMIN + 80,
 227     __SIGRTMIN + 81,
 228     __SIGRTMIN + 82,
 229     __SIGRTMIN + 83,
 230     __SIGRTMIN + 84,
 231     __SIGRTMIN + 85,
 232     __SIGRTMIN + 86,
 233     __SIGRTMIN + 87,
 234     __SIGRTMIN + 88,
 235     __SIGRTMIN + 89,
 236     __SIGRTMIN + 90,
 237     __SIGRTMIN + 91,
 238     __SIGRTMIN + 92,
 239     __SIGRTMIN + 93,
 240     __SIGRTMIN + 94,
 241     __SIGRTMIN + 95,
 242     -1, /* SIGINFO */
 243     -1, /* UNKNOWN */
 244     -1, /* DEFAULT */
 245     -1,
 246     -1,
 247     -1,
 248     -1,
 249     -1,
 250     -1
 251 #endif
 252 };
 253 #else
 254 /* In system mode we only need SIGINT and SIGTRAP; other signals
 255    are not yet supported.  */
 256
 257 enum {
 258     TARGET_SIGINT = 2,
 259     TARGET_SIGTRAP = 5
 260 };
 261
 262 static int gdb_signal_table[] = {
 263     -1,
 264     -1,
 265     TARGET_SIGINT,
 266     -1,
 267     -1,
 268     TARGET_SIGTRAP
 269 };
 270 #endif
 271
 272 #ifdef CONFIG_USER_ONLY
 273 static int target_signal_to_gdb (int sig)
 274 {
 275     int i;
 276     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 277         if (gdb_signal_table[i] == sig)
 278             return i;
 279     return GDB_SIGNAL_UNKNOWN;
 280 }
 281 #endif
 282
 283 static int gdb_signal_to_target (int sig)
 284 {
 285     if (sig < ARRAY_SIZE (gdb_signal_table))
 286         return gdb_signal_table[sig];
 287     else
 288         return -1;
 289 }
 290
 291 typedef struct GDBRegisterState {
 292     int base_reg;
 293     int num_regs;
 294     gdb_reg_cb get_reg;
 295     gdb_reg_cb set_reg;
 296     const char *xml;
 297     struct GDBRegisterState *next;
 298 } GDBRegisterState;
 299
 300 typedef struct GDBProcess {
 301     uint32_t pid;
 302     bool attached;
 303
 304     char target_xml[1024];
 305 } GDBProcess;
 306
 307 enum RSState {
 308     RS_INACTIVE,
 309     RS_IDLE,
 310     RS_GETLINE,
 311     RS_GETLINE_ESC,
 312     RS_GETLINE_RLE,
 313     RS_CHKSUM1,
 314     RS_CHKSUM2,
 315 };
 316 typedef struct GDBState {
 317     CPUState *c_cpu; /* current CPU for step/continue ops */
 318     CPUState *g_cpu; /* current CPU for other ops */
 319     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 320     enum RSState state; /* parsing state */
 321     char line_buf[MAX_PACKET_LENGTH];
 322     int line_buf_index;
 323     int line_sum; /* running checksum */
 324     int line_csum; /* checksum at the end of the packet */
 325     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 326     int last_packet_len;
 327     int signal;
 328 #ifdef CONFIG_USER_ONLY
 329     int fd;
 330     int running_state;
 331 #else
 332     CharBackend chr;
 333     Chardev *mon_chr;
 334 #endif
 335     bool multiprocess;
 336     GDBProcess *processes;
 337     int process_num;
 338     char syscall_buf[256];
 339     gdb_syscall_complete_cb current_syscall_cb;
 340 } GDBState;
 341
 342 /* By default use no IRQs and no timers while single stepping so as to
 343  * make single stepping like an ICE HW step.
 344  */
 345 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 346
 347 static GDBState *gdbserver_state;
 348
 349 bool gdb_has_xml;
 350
 351 #ifdef CONFIG_USER_ONLY
 352 /* XXX: This is not thread safe.  Do we care?  */
 353 static int gdbserver_fd = -1;
 354
 355 static int get_char(GDBState *s)
 356 {
 357     uint8_t ch;
 358     int ret;
 359
 360     for(;;) {
 361         ret = qemu_recv(s->fd, &ch, 1, 0);
 362         if (ret < 0) {
 363             if (errno == ECONNRESET)
 364                 s->fd = -1;
 365             if (errno != EINTR)
 366                 return -1;
 367         } else if (ret == 0) {
 368             close(s->fd);
 369             s->fd = -1;
 370             return -1;
 371         } else {
 372             break;
 373         }
 374     }
 375     return ch;
 376 }
 377 #endif
 378
 379 static enum {
 380     GDB_SYS_UNKNOWN,
 381     GDB_SYS_ENABLED,
 382     GDB_SYS_DISABLED,
 383 } gdb_syscall_mode;
 384
 385 /* Decide if either remote gdb syscalls or native file IO should be used. */
 386 int use_gdb_syscalls(void)
 387 {
 388     SemihostingTarget target = semihosting_get_target();
 389     if (target == SEMIHOSTING_TARGET_NATIVE) {
 390         /* -semihosting-config target=native */
 391         return false;
 392     } else if (target == SEMIHOSTING_TARGET_GDB) {
 393         /* -semihosting-config target=gdb */
 394         return true;
 395     }
 396
 397     /* -semihosting-config target=auto */
 398     /* On the first call check if gdb is connected and remember. */
 399     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 400         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 401                                             : GDB_SYS_DISABLED);
 402     }
 403     return gdb_syscall_mode == GDB_SYS_ENABLED;
 404 }
 405
 406 /* Resume execution.  */
 407 static inline void gdb_continue(GDBState *s)
 408 {
 409
 410 #ifdef CONFIG_USER_ONLY
 411     s->running_state = 1;
 412     trace_gdbstub_op_continue();
 413 #else
 414     if (!runstate_needs_reset()) {
 415         trace_gdbstub_op_continue();
 416         vm_start();
 417     }
 418 #endif
 419 }
 420
 421 /*
 422  * Resume execution, per CPU actions. For user-mode emulation it's
 423  * equivalent to gdb_continue.
 424  */
 425 static int gdb_continue_partial(GDBState *s, char *newstates)
 426 {
 427     CPUState *cpu;
 428     int res = 0;
 429 #ifdef CONFIG_USER_ONLY
 430     /*
 431      * This is not exactly accurate, but it's an improvement compared to the
 432      * previous situation, where only one CPU would be single-stepped.
 433      */
 434     CPU_FOREACH(cpu) {
 435         if (newstates[cpu->cpu_index] == 's') {
 436             trace_gdbstub_op_stepping(cpu->cpu_index);
 437             cpu_single_step(cpu, sstep_flags);
 438         }
 439     }
 440     s->running_state = 1;
 441 #else
 442     int flag = 0;
 443
 444     if (!runstate_needs_reset()) {
 445         if (vm_prepare_start()) {
 446             return 0;
 447         }
 448
 449         CPU_FOREACH(cpu) {
 450             switch (newstates[cpu->cpu_index]) {
 451             case 0:
 452             case 1:
 453                 break; /* nothing to do here */
 454             case 's':
 455                 trace_gdbstub_op_stepping(cpu->cpu_index);
 456                 cpu_single_step(cpu, sstep_flags);
 457                 cpu_resume(cpu);
 458                 flag = 1;
 459                 break;
 460             case 'c':
 461                 trace_gdbstub_op_continue_cpu(cpu->cpu_index);
 462                 cpu_resume(cpu);
 463                 flag = 1;
 464                 break;
 465             default:
 466                 res = -1;
 467                 break;
 468             }
 469         }
 470     }
 471     if (flag) {
 472         qemu_clock_enable(QEMU_CLOCK_VIRTUAL, true);
 473     }
 474 #endif
 475     return res;
 476 }
 477
 478 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 479 {
 480 #ifdef CONFIG_USER_ONLY
 481     int ret;
 482
 483     while (len > 0) {
 484         ret = send(s->fd, buf, len, 0);
 485         if (ret < 0) {
 486             if (errno != EINTR)
 487                 return;
 488         } else {
 489             buf += ret;
 490             len -= ret;
 491         }
 492     }
 493 #else
 494     /* XXX this blocks entire thread. Rewrite to use
 495      * qemu_chr_fe_write and background I/O callbacks */
 496     qemu_chr_fe_write_all(&s->chr, buf, len);
 497 #endif
 498 }
 499
 500 static inline int fromhex(int v)
 501 {
 502     if (v >= '0' && v <= '9')
 503         return v - '0';
 504     else if (v >= 'A' && v <= 'F')
 505         return v - 'A' + 10;
 506     else if (v >= 'a' && v <= 'f')
 507         return v - 'a' + 10;
 508     else
 509         return 0;
 510 }
 511
 512 static inline int tohex(int v)
 513 {
 514     if (v < 10)
 515         return v + '0';
 516     else
 517         return v - 10 + 'a';
 518 }
 519
 520 /* writes 2*len+1 bytes in buf */
 521 static void memtohex(char *buf, const uint8_t *mem, int len)
 522 {
 523     int i, c;
 524     char *q;
 525     q = buf;
 526     for(i = 0; i < len; i++) {
 527         c = mem[i];
 528         *q++ = tohex(c >> 4);
 529         *q++ = tohex(c & 0xf);
 530     }
 531     *q = '\0';
 532 }
 533
 534 static void hextomem(uint8_t *mem, const char *buf, int len)
 535 {
 536     int i;
 537
 538     for(i = 0; i < len; i++) {
 539         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 540         buf += 2;
 541     }
 542 }
 543
 544 static void hexdump(const char *buf, int len,
 545                     void (*trace_fn)(size_t ofs, char const *text))
 546 {
 547     char line_buffer[3 * 16 + 4 + 16 + 1];
 548
 549     size_t i;
 550     for (i = 0; i < len || (i & 0xF); ++i) {
 551         size_t byte_ofs = i & 15;
 552
 553         if (byte_ofs == 0) {
 554             memset(line_buffer, ' ', 3 * 16 + 4 + 16);
 555             line_buffer[3 * 16 + 4 + 16] = 0;
 556         }
 557
 558         size_t col_group = (i >> 2) & 3;
 559         size_t hex_col = byte_ofs * 3 + col_group;
 560         size_t txt_col = 3 * 16 + 4 + byte_ofs;
 561
 562         if (i < len) {
 563             char value = buf[i];
 564
 565             line_buffer[hex_col + 0] = tohex((value >> 4) & 0xF);
 566             line_buffer[hex_col + 1] = tohex((value >> 0) & 0xF);
 567             line_buffer[txt_col + 0] = (value >= ' ' && value < 127)
 568                     ? value
 569                     : '.';
 570         }
 571
 572         if (byte_ofs == 0xF)
 573             trace_fn(i & -16, line_buffer);
 574     }
 575 }
 576
 577 /* return -1 if error, 0 if OK */
 578 static int put_packet_binary(GDBState *s, const char *buf, int len, bool dump)
 579 {
 580     int csum, i;
 581     uint8_t *p;
 582
 583     if (dump && trace_event_get_state_backends(TRACE_GDBSTUB_IO_BINARYREPLY)) {
 584         hexdump(buf, len, trace_gdbstub_io_binaryreply);
 585     }
 586
 587     for(;;) {
 588         p = s->last_packet;
 589         *(p++) = '$';
 590         memcpy(p, buf, len);
 591         p += len;
 592         csum = 0;
 593         for(i = 0; i < len; i++) {
 594             csum += buf[i];
 595         }
 596         *(p++) = '#';
 597         *(p++) = tohex((csum >> 4) & 0xf);
 598         *(p++) = tohex((csum) & 0xf);
 599
 600         s->last_packet_len = p - s->last_packet;
 601         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 602
 603 #ifdef CONFIG_USER_ONLY
 604         i = get_char(s);
 605         if (i < 0)
 606             return -1;
 607         if (i == '+')
 608             break;
 609 #else
 610         break;
 611 #endif
 612     }
 613     return 0;
 614 }
 615
 616 /* return -1 if error, 0 if OK */
 617 static int put_packet(GDBState *s, const char *buf)
 618 {
 619     trace_gdbstub_io_reply(buf);
 620
 621     return put_packet_binary(s, buf, strlen(buf), false);
 622 }
 623
 624 /* Encode data using the encoding for 'x' packets.  */
 625 static int memtox(char *buf, const char *mem, int len)
 626 {
 627     char *p = buf;
 628     char c;
 629
 630     while (len--) {
 631         c = *(mem++);
 632         switch (c) {
 633         case '#': case '$': case '*': case '}':
 634             *(p++) = '}';
 635             *(p++) = c ^ 0x20;
 636             break;
 637         default:
 638             *(p++) = c;
 639             break;
 640         }
 641     }
 642     return p - buf;
 643 }
 644
 645 static uint32_t gdb_get_cpu_pid(const GDBState *s, CPUState *cpu)
 646 {
 647 #ifndef CONFIG_USER_ONLY
 648     gchar *path, *name = NULL;
 649     Object *obj;
 650     CPUClusterState *cluster;
 651     uint32_t ret;
 652
 653     path = object_get_canonical_path(OBJECT(cpu));
 654
 655     if (path == NULL) {
 656         /* Return the default process' PID */
 657         ret = s->processes[s->process_num - 1].pid;
 658         goto out;
 659     }
 660
 661     name = object_get_canonical_path_component(OBJECT(cpu));
 662     assert(name != NULL);
 663
 664     /*
 665      * Retrieve the CPU parent path by removing the last '/' and the CPU name
 666      * from the CPU canonical path.
 667      */
 668     path[strlen(path) - strlen(name) - 1] = '\0';
 669
 670     obj = object_resolve_path_type(path, TYPE_CPU_CLUSTER, NULL);
 671
 672     if (obj == NULL) {
 673         /* Return the default process' PID */
 674         ret = s->processes[s->process_num - 1].pid;
 675         goto out;
 676     }
 677
 678     cluster = CPU_CLUSTER(obj);
 679     ret = cluster->cluster_id + 1;
 680
 681 out:
 682     g_free(name);
 683     g_free(path);
 684
 685     return ret;
 686
 687 #else
 688     /* TODO: In user mode, we should use the task state PID */
 689     return s->processes[s->process_num - 1].pid;
 690 #endif
 691 }
 692
 693 static GDBProcess *gdb_get_process(const GDBState *s, uint32_t pid)
 694 {
 695     int i;
 696
 697     if (!pid) {
 698         /* 0 means any process, we take the first one */
 699         return &s->processes[0];
 700     }
 701
 702     for (i = 0; i < s->process_num; i++) {
 703         if (s->processes[i].pid == pid) {
 704             return &s->processes[i];
 705         }
 706     }
 707
 708     return NULL;
 709 }
 710
 711 static GDBProcess *gdb_get_cpu_process(const GDBState *s, CPUState *cpu)
 712 {
 713     return gdb_get_process(s, gdb_get_cpu_pid(s, cpu));
 714 }
 715
 716 static CPUState *find_cpu(uint32_t thread_id)
 717 {
 718     CPUState *cpu;
 719
 720     CPU_FOREACH(cpu) {
 721         if (cpu_gdb_index(cpu) == thread_id) {
 722             return cpu;
 723         }
 724     }
 725
 726     return NULL;
 727 }
 728
 729 static CPUState *get_first_cpu_in_process(const GDBState *s,
 730                                           GDBProcess *process)
 731 {
 732     CPUState *cpu;
 733
 734     CPU_FOREACH(cpu) {
 735         if (gdb_get_cpu_pid(s, cpu) == process->pid) {
 736             return cpu;
 737         }
 738     }
 739
 740     return NULL;
 741 }
 742
 743 static CPUState *gdb_next_cpu_in_process(const GDBState *s, CPUState *cpu)
 744 {
 745     uint32_t pid = gdb_get_cpu_pid(s, cpu);
 746     cpu = CPU_NEXT(cpu);
 747
 748     while (cpu) {
 749         if (gdb_get_cpu_pid(s, cpu) == pid) {
 750             break;
 751         }
 752
 753         cpu = CPU_NEXT(cpu);
 754     }
 755
 756     return cpu;
 757 }
 758
 759 static CPUState *gdb_get_cpu(const GDBState *s, uint32_t pid, uint32_t tid)
 760 {
 761     GDBProcess *process;
 762     CPUState *cpu;
 763
 764     if (!tid) {
 765         /* 0 means any thread, we take the first one */
 766         tid = 1;
 767     }
 768
 769     cpu = find_cpu(tid);
 770
 771     if (cpu == NULL) {
 772         return NULL;
 773     }
 774
 775     process = gdb_get_cpu_process(s, cpu);
 776
 777     if (process->pid != pid) {
 778         return NULL;
 779     }
 780
 781     if (!process->attached) {
 782         return NULL;
 783     }
 784
 785     return cpu;
 786 }
 787
 788 /* Return the cpu following @cpu, while ignoring unattached processes. */
 789 static CPUState *gdb_next_attached_cpu(const GDBState *s, CPUState *cpu)
 790 {
 791     cpu = CPU_NEXT(cpu);
 792
 793     while (cpu) {
 794         if (gdb_get_cpu_process(s, cpu)->attached) {
 795             break;
 796         }
 797
 798         cpu = CPU_NEXT(cpu);
 799     }
 800
 801     return cpu;
 802 }
 803
 804 /* Return the first attached cpu */
 805 static CPUState *gdb_first_attached_cpu(const GDBState *s)
 806 {
 807     CPUState *cpu = first_cpu;
 808     GDBProcess *process = gdb_get_cpu_process(s, cpu);
 809
 810     if (!process->attached) {
 811         return gdb_next_attached_cpu(s, cpu);
 812     }
 813
 814     return cpu;
 815 }
 816
 817 static const char *get_feature_xml(const GDBState *s, const char *p,
 818                                    const char **newp, GDBProcess *process)
 819 {
 820     size_t len;
 821     int i;
 822     const char *name;
 823     CPUState *cpu = get_first_cpu_in_process(s, process);
 824     CPUClass *cc = CPU_GET_CLASS(cpu);
 825
 826     len = 0;
 827     while (p[len] && p[len] != ':')
 828         len++;
 829     *newp = p + len;
 830
 831     name = NULL;
 832     if (strncmp(p, "target.xml", len) == 0) {
 833         char *buf = process->target_xml;
 834         const size_t buf_sz = sizeof(process->target_xml);
 835
 836         /* Generate the XML description for this CPU.  */
 837         if (!buf[0]) {
 838             GDBRegisterState *r;
 839
 840             pstrcat(buf, buf_sz,
 841                     "<?xml version=\"1.0\"?>"
 842                     "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
 843                     "<target>");
 844             if (cc->gdb_arch_name) {
 845                 gchar *arch = cc->gdb_arch_name(cpu);
 846                 pstrcat(buf, buf_sz, "<architecture>");
 847                 pstrcat(buf, buf_sz, arch);
 848                 pstrcat(buf, buf_sz, "</architecture>");
 849                 g_free(arch);
 850             }
 851             pstrcat(buf, buf_sz, "<xi:include href=\"");
 852             pstrcat(buf, buf_sz, cc->gdb_core_xml_file);
 853             pstrcat(buf, buf_sz, "\"/>");
 854             for (r = cpu->gdb_regs; r; r = r->next) {
 855                 pstrcat(buf, buf_sz, "<xi:include href=\"");
 856                 pstrcat(buf, buf_sz, r->xml);
 857                 pstrcat(buf, buf_sz, "\"/>");
 858             }
 859             pstrcat(buf, buf_sz, "</target>");
 860         }
 861         return buf;
 862     }
 863     if (cc->gdb_get_dynamic_xml) {
 864         char *xmlname = g_strndup(p, len);
 865         const char *xml = cc->gdb_get_dynamic_xml(cpu, xmlname);
 866
 867         g_free(xmlname);
 868         if (xml) {
 869             return xml;
 870         }
 871     }
 872     for (i = 0; ; i++) {
 873         name = xml_builtin[i][0];
 874         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
 875             break;
 876     }
 877     return name ? xml_builtin[i][1] : NULL;
 878 }
 879
 880 static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 881 {
 882     CPUClass *cc = CPU_GET_CLASS(cpu);
 883     CPUArchState *env = cpu->env_ptr;
 884     GDBRegisterState *r;
 885
 886     if (reg < cc->gdb_num_core_regs) {
 887         return cc->gdb_read_register(cpu, mem_buf, reg);
 888     }
 889
 890     for (r = cpu->gdb_regs; r; r = r->next) {
 891         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 892             return r->get_reg(env, mem_buf, reg - r->base_reg);
 893         }
 894     }
 895     return 0;
 896 }
 897
 898 static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 899 {
 900     CPUClass *cc = CPU_GET_CLASS(cpu);
 901     CPUArchState *env = cpu->env_ptr;
 902     GDBRegisterState *r;
 903
 904     if (reg < cc->gdb_num_core_regs) {
 905         return cc->gdb_write_register(cpu, mem_buf, reg);
 906     }
 907
 908     for (r = cpu->gdb_regs; r; r = r->next) {
 909         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 910             return r->set_reg(env, mem_buf, reg - r->base_reg);
 911         }
 912     }
 913     return 0;
 914 }
 915
 916 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
 917    specifies the first register number and these registers are included in
 918    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
 919    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
 920  */
 921
 922 void gdb_register_coprocessor(CPUState *cpu,
 923                               gdb_reg_cb get_reg, gdb_reg_cb set_reg,
 924                               int num_regs, const char *xml, int g_pos)
 925 {
 926     GDBRegisterState *s;
 927     GDBRegisterState **p;
 928
 929     p = &cpu->gdb_regs;
 930     while (*p) {
 931         /* Check for duplicates.  */
 932         if (strcmp((*p)->xml, xml) == 0)
 933             return;
 934         p = &(*p)->next;
 935     }
 936
 937     s = g_new0(GDBRegisterState, 1);
 938     s->base_reg = cpu->gdb_num_regs;
 939     s->num_regs = num_regs;
 940     s->get_reg = get_reg;
 941     s->set_reg = set_reg;
 942     s->xml = xml;
 943
 944     /* Add to end of list.  */
 945     cpu->gdb_num_regs += num_regs;
 946     *p = s;
 947     if (g_pos) {
 948         if (g_pos != s->base_reg) {
 949             error_report("Error: Bad gdb register numbering for '%s', "
 950                          "expected %d got %d", xml, g_pos, s->base_reg);
 951         } else {
 952             cpu->gdb_num_g_regs = cpu->gdb_num_regs;
 953         }
 954     }
 955 }
 956
 957 #ifndef CONFIG_USER_ONLY
 958 /* Translate GDB watchpoint type to a flags value for cpu_watchpoint_* */
 959 static inline int xlat_gdb_type(CPUState *cpu, int gdbtype)
 960 {
 961     static const int xlat[] = {
 962         [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
 963         [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
 964         [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
 965     };
 966
 967     CPUClass *cc = CPU_GET_CLASS(cpu);
 968     int cputype = xlat[gdbtype];
 969
 970     if (cc->gdb_stop_before_watchpoint) {
 971         cputype |= BP_STOP_BEFORE_ACCESS;
 972     }
 973     return cputype;
 974 }
 975 #endif
 976
 977 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
 978 {
 979     CPUState *cpu;
 980     int err = 0;
 981
 982     if (kvm_enabled()) {
 983         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 984     }
 985
 986     switch (type) {
 987     case GDB_BREAKPOINT_SW:
 988     case GDB_BREAKPOINT_HW:
 989         CPU_FOREACH(cpu) {
 990             err = cpu_breakpoint_insert(cpu, addr, BP_GDB, NULL);
 991             if (err) {
 992                 break;
 993             }
 994         }
 995         return err;
 996 #ifndef CONFIG_USER_ONLY
 997     case GDB_WATCHPOINT_WRITE:
 998     case GDB_WATCHPOINT_READ:
 999     case GDB_WATCHPOINT_ACCESS:
1000         CPU_FOREACH(cpu) {
1001             err = cpu_watchpoint_insert(cpu, addr, len,
1002                                         xlat_gdb_type(cpu, type), NULL);
1003             if (err) {
1004                 break;
1005             }
1006         }
1007         return err;
1008 #endif
1009     default:
1010         return -ENOSYS;
1011     }
1012 }
1013
1014 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1015 {
1016     CPUState *cpu;
1017     int err = 0;
1018
1019     if (kvm_enabled()) {
1020         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1021     }
1022
1023     switch (type) {
1024     case GDB_BREAKPOINT_SW:
1025     case GDB_BREAKPOINT_HW:
1026         CPU_FOREACH(cpu) {
1027             err = cpu_breakpoint_remove(cpu, addr, BP_GDB);
1028             if (err) {
1029                 break;
1030             }
1031         }
1032         return err;
1033 #ifndef CONFIG_USER_ONLY
1034     case GDB_WATCHPOINT_WRITE:
1035     case GDB_WATCHPOINT_READ:
1036     case GDB_WATCHPOINT_ACCESS:
1037         CPU_FOREACH(cpu) {
1038             err = cpu_watchpoint_remove(cpu, addr, len,
1039                                         xlat_gdb_type(cpu, type));
1040             if (err)
1041                 break;
1042         }
1043         return err;
1044 #endif
1045     default:
1046         return -ENOSYS;
1047     }
1048 }
1049
1050 static void gdb_breakpoint_remove_all(void)
1051 {
1052     CPUState *cpu;
1053
1054     if (kvm_enabled()) {
1055         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1056         return;
1057     }
1058
1059     CPU_FOREACH(cpu) {
1060         cpu_breakpoint_remove_all(cpu, BP_GDB);
1061 #ifndef CONFIG_USER_ONLY
1062         cpu_watchpoint_remove_all(cpu, BP_GDB);
1063 #endif
1064     }
1065 }
1066
1067 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1068 {
1069     CPUState *cpu = s->c_cpu;
1070
1071     cpu_synchronize_state(cpu);
1072     cpu_set_pc(cpu, pc);
1073 }
1074
1075 static char *gdb_fmt_thread_id(const GDBState *s, CPUState *cpu,
1076                            char *buf, size_t buf_size)
1077 {
1078     if (s->multiprocess) {
1079         snprintf(buf, buf_size, "p%02x.%02x",
1080                  gdb_get_cpu_pid(s, cpu), cpu_gdb_index(cpu));
1081     } else {
1082         snprintf(buf, buf_size, "%02x", cpu_gdb_index(cpu));
1083     }
1084
1085     return buf;
1086 }
1087
1088 typedef enum GDBThreadIdKind {
1089     GDB_ONE_THREAD = 0,
1090     GDB_ALL_THREADS,     /* One process, all threads */
1091     GDB_ALL_PROCESSES,
1092     GDB_READ_THREAD_ERR
1093 } GDBThreadIdKind;
1094
1095 static GDBThreadIdKind read_thread_id(const char *buf, const char **end_buf,
1096                                       uint32_t *pid, uint32_t *tid)
1097 {
1098     unsigned long p, t;
1099     int ret;
1100
1101     if (*buf == 'p') {
1102         buf++;
1103         ret = qemu_strtoul(buf, &buf, 16, &p);
1104
1105         if (ret) {
1106             return GDB_READ_THREAD_ERR;
1107         }
1108
1109         /* Skip '.' */
1110         buf++;
1111     } else {
1112         p = 1;
1113     }
1114
1115     ret = qemu_strtoul(buf, &buf, 16, &t);
1116
1117     if (ret) {
1118         return GDB_READ_THREAD_ERR;
1119     }
1120
1121     *end_buf = buf;
1122
1123     if (p == -1) {
1124         return GDB_ALL_PROCESSES;
1125     }
1126
1127     if (pid) {
1128         *pid = p;
1129     }
1130
1131     if (t == -1) {
1132         return GDB_ALL_THREADS;
1133     }
1134
1135     if (tid) {
1136         *tid = t;
1137     }
1138
1139     return GDB_ONE_THREAD;
1140 }
1141
1142 static int is_query_packet(const char *p, const char *query, char separator)
1143 {
1144     unsigned int query_len = strlen(query);
1145
1146     return strncmp(p, query, query_len) == 0 &&
1147         (p[query_len] == '\0' || p[query_len] == separator);
1148 }
1149
1150 /**
1151  * gdb_handle_vcont - Parses and handles a vCont packet.
1152  * returns -ENOTSUP if a command is unsupported, -EINVAL or -ERANGE if there is
1153  *         a format error, 0 on success.
1154  */
1155 static int gdb_handle_vcont(GDBState *s, const char *p)
1156 {
1157     int res, signal = 0;
1158     char cur_action;
1159     char *newstates;
1160     unsigned long tmp;
1161     uint32_t pid, tid;
1162     GDBProcess *process;
1163     CPUState *cpu;
1164 #ifdef CONFIG_USER_ONLY
1165     int max_cpus = 1; /* global variable max_cpus exists only in system mode */
1166
1167     CPU_FOREACH(cpu) {
1168         max_cpus = max_cpus <= cpu->cpu_index ? cpu->cpu_index + 1 : max_cpus;
1169     }
1170 #endif
1171     /* uninitialised CPUs stay 0 */
1172     newstates = g_new0(char, max_cpus);
1173
1174     /* mark valid CPUs with 1 */
1175     CPU_FOREACH(cpu) {
1176         newstates[cpu->cpu_index] = 1;
1177     }
1178
1179     /*
1180      * res keeps track of what error we are returning, with -ENOTSUP meaning
1181      * that the command is unknown or unsupported, thus returning an empty
1182      * packet, while -EINVAL and -ERANGE cause an E22 packet, due to invalid,
1183      *  or incorrect parameters passed.
1184      */
1185     res = 0;
1186     while (*p) {
1187         if (*p++ != ';') {
1188             res = -ENOTSUP;
1189             goto out;
1190         }
1191
1192         cur_action = *p++;
1193         if (cur_action == 'C' || cur_action == 'S') {
1194             cur_action = qemu_tolower(cur_action);
1195             res = qemu_strtoul(p + 1, &p, 16, &tmp);
1196             if (res) {
1197                 goto out;
1198             }
1199             signal = gdb_signal_to_target(tmp);
1200         } else if (cur_action != 'c' && cur_action != 's') {
1201             /* unknown/invalid/unsupported command */
1202             res = -ENOTSUP;
1203             goto out;
1204         }
1205
1206         if (*p++ != ':') {
1207             res = -ENOTSUP;
1208             goto out;
1209         }
1210
1211         switch (read_thread_id(p, &p, &pid, &tid)) {
1212         case GDB_READ_THREAD_ERR:
1213             res = -EINVAL;
1214             goto out;
1215
1216         case GDB_ALL_PROCESSES:
1217             cpu = gdb_first_attached_cpu(s);
1218             while (cpu) {
1219                 if (newstates[cpu->cpu_index] == 1) {
1220                     newstates[cpu->cpu_index] = cur_action;
1221                 }
1222
1223                 cpu = gdb_next_attached_cpu(s, cpu);
1224             }
1225             break;
1226
1227         case GDB_ALL_THREADS:
1228             process = gdb_get_process(s, pid);
1229
1230             if (!process->attached) {
1231                 res = -EINVAL;
1232                 goto out;
1233             }
1234
1235             cpu = get_first_cpu_in_process(s, process);
1236             while (cpu) {
1237                 if (newstates[cpu->cpu_index] == 1) {
1238                     newstates[cpu->cpu_index] = cur_action;
1239                 }
1240
1241                 cpu = gdb_next_cpu_in_process(s, cpu);
1242             }
1243             break;
1244
1245         case GDB_ONE_THREAD:
1246             cpu = gdb_get_cpu(s, pid, tid);
1247
1248             /* invalid CPU/thread specified */
1249             if (!cpu) {
1250                 res = -EINVAL;
1251                 goto out;
1252             }
1253
1254             /* only use if no previous match occourred */
1255             if (newstates[cpu->cpu_index] == 1) {
1256                 newstates[cpu->cpu_index] = cur_action;
1257             }
1258             break;
1259         }
1260     }
1261     s->signal = signal;
1262     gdb_continue_partial(s, newstates);
1263
1264 out:
1265     g_free(newstates);
1266
1267     return res;
1268 }
1269
1270 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1271 {
1272     CPUState *cpu;
1273     GDBProcess *process;
1274     CPUClass *cc;
1275     const char *p;
1276     uint32_t pid, tid;
1277     int ch, reg_size, type, res;
1278     uint8_t mem_buf[MAX_PACKET_LENGTH];
1279     char buf[sizeof(mem_buf) + 1 /* trailing NUL */];
1280     char thread_id[16];
1281     uint8_t *registers;
1282     target_ulong addr, len;
1283     GDBThreadIdKind thread_kind;
1284
1285     trace_gdbstub_io_command(line_buf);
1286
1287     p = line_buf;
1288     ch = *p++;
1289     switch(ch) {
1290     case '?':
1291         /* TODO: Make this return the correct value for user-mode.  */
1292         snprintf(buf, sizeof(buf), "T%02xthread:%s;", GDB_SIGNAL_TRAP,
1293                  gdb_fmt_thread_id(s, s->c_cpu, thread_id, sizeof(thread_id)));
1294         put_packet(s, buf);
1295         /* Remove all the breakpoints when this query is issued,
1296          * because gdb is doing and initial connect and the state
1297          * should be cleaned up.
1298          */
1299         gdb_breakpoint_remove_all();
1300         break;
1301     case 'c':
1302         if (*p != '\0') {
1303             addr = strtoull(p, (char **)&p, 16);
1304             gdb_set_cpu_pc(s, addr);
1305         }
1306         s->signal = 0;
1307         gdb_continue(s);
1308         return RS_IDLE;
1309     case 'C':
1310         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1311         if (s->signal == -1)
1312             s->signal = 0;
1313         gdb_continue(s);
1314         return RS_IDLE;
1315     case 'v':
1316         if (strncmp(p, "Cont", 4) == 0) {
1317             p += 4;
1318             if (*p == '?') {
1319                 put_packet(s, "vCont;c;C;s;S");
1320                 break;
1321             }
1322
1323             res = gdb_handle_vcont(s, p);
1324
1325             if (res) {
1326                 if ((res == -EINVAL) || (res == -ERANGE)) {
1327                     put_packet(s, "E22");
1328                     break;
1329                 }
1330                 goto unknown_command;
1331             }
1332             break;
1333         } else {
1334             goto unknown_command;
1335         }
1336     case 'k':
1337         /* Kill the target */
1338         error_report("QEMU: Terminated via GDBstub");
1339         exit(0);
1340     case 'D':
1341         /* Detach packet */
1342         gdb_breakpoint_remove_all();
1343         gdb_syscall_mode = GDB_SYS_DISABLED;
1344         gdb_continue(s);
1345         put_packet(s, "OK");
1346         break;
1347     case 's':
1348         if (*p != '\0') {
1349             addr = strtoull(p, (char **)&p, 16);
1350             gdb_set_cpu_pc(s, addr);
1351         }
1352         cpu_single_step(s->c_cpu, sstep_flags);
1353         gdb_continue(s);
1354         return RS_IDLE;
1355     case 'F':
1356         {
1357             target_ulong ret;
1358             target_ulong err;
1359
1360             ret = strtoull(p, (char **)&p, 16);
1361             if (*p == ',') {
1362                 p++;
1363                 err = strtoull(p, (char **)&p, 16);
1364             } else {
1365                 err = 0;
1366             }
1367             if (*p == ',')
1368                 p++;
1369             type = *p;
1370             if (s->current_syscall_cb) {
1371                 s->current_syscall_cb(s->c_cpu, ret, err);
1372                 s->current_syscall_cb = NULL;
1373             }
1374             if (type == 'C') {
1375                 put_packet(s, "T02");
1376             } else {
1377                 gdb_continue(s);
1378             }
1379         }
1380         break;
1381     case 'g':
1382         cpu_synchronize_state(s->g_cpu);
1383         len = 0;
1384         for (addr = 0; addr < s->g_cpu->gdb_num_g_regs; addr++) {
1385             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1386             len += reg_size;
1387         }
1388         memtohex(buf, mem_buf, len);
1389         put_packet(s, buf);
1390         break;
1391     case 'G':
1392         cpu_synchronize_state(s->g_cpu);
1393         registers = mem_buf;
1394         len = strlen(p) / 2;
1395         hextomem((uint8_t *)registers, p, len);
1396         for (addr = 0; addr < s->g_cpu->gdb_num_g_regs && len > 0; addr++) {
1397             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1398             len -= reg_size;
1399             registers += reg_size;
1400         }
1401         put_packet(s, "OK");
1402         break;
1403     case 'm':
1404         addr = strtoull(p, (char **)&p, 16);
1405         if (*p == ',')
1406             p++;
1407         len = strtoull(p, NULL, 16);
1408
1409         /* memtohex() doubles the required space */
1410         if (len > MAX_PACKET_LENGTH / 2) {
1411             put_packet (s, "E22");
1412             break;
1413         }
1414
1415         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
1416             put_packet (s, "E14");
1417         } else {
1418             memtohex(buf, mem_buf, len);
1419             put_packet(s, buf);
1420         }
1421         break;
1422     case 'M':
1423         addr = strtoull(p, (char **)&p, 16);
1424         if (*p == ',')
1425             p++;
1426         len = strtoull(p, (char **)&p, 16);
1427         if (*p == ':')
1428             p++;
1429
1430         /* hextomem() reads 2*len bytes */
1431         if (len > strlen(p) / 2) {
1432             put_packet (s, "E22");
1433             break;
1434         }
1435         hextomem(mem_buf, p, len);
1436         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
1437                                    true) != 0) {
1438             put_packet(s, "E14");
1439         } else {
1440             put_packet(s, "OK");
1441         }
1442         break;
1443     case 'p':
1444         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1445            This works, but can be very slow.  Anything new enough to
1446            understand XML also knows how to use this properly.  */
1447         if (!gdb_has_xml)
1448             goto unknown_command;
1449         addr = strtoull(p, (char **)&p, 16);
1450         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1451         if (reg_size) {
1452             memtohex(buf, mem_buf, reg_size);
1453             put_packet(s, buf);
1454         } else {
1455             put_packet(s, "E14");
1456         }
1457         break;
1458     case 'P':
1459         if (!gdb_has_xml)
1460             goto unknown_command;
1461         addr = strtoull(p, (char **)&p, 16);
1462         if (*p == '=')
1463             p++;
1464         reg_size = strlen(p) / 2;
1465         hextomem(mem_buf, p, reg_size);
1466         gdb_write_register(s->g_cpu, mem_buf, addr);
1467         put_packet(s, "OK");
1468         break;
1469     case 'Z':
1470     case 'z':
1471         type = strtoul(p, (char **)&p, 16);
1472         if (*p == ',')
1473             p++;
1474         addr = strtoull(p, (char **)&p, 16);
1475         if (*p == ',')
1476             p++;
1477         len = strtoull(p, (char **)&p, 16);
1478         if (ch == 'Z')
1479             res = gdb_breakpoint_insert(addr, len, type);
1480         else
1481             res = gdb_breakpoint_remove(addr, len, type);
1482         if (res >= 0)
1483              put_packet(s, "OK");
1484         else if (res == -ENOSYS)
1485             put_packet(s, "");
1486         else
1487             put_packet(s, "E22");
1488         break;
1489     case 'H':
1490         type = *p++;
1491
1492         thread_kind = read_thread_id(p, &p, &pid, &tid);
1493         if (thread_kind == GDB_READ_THREAD_ERR) {
1494             put_packet(s, "E22");
1495             break;
1496         }
1497
1498         if (thread_kind != GDB_ONE_THREAD) {
1499             put_packet(s, "OK");
1500             break;
1501         }
1502         cpu = gdb_get_cpu(s, pid, tid);
1503         if (cpu == NULL) {
1504             put_packet(s, "E22");
1505             break;
1506         }
1507         switch (type) {
1508         case 'c':
1509             s->c_cpu = cpu;
1510             put_packet(s, "OK");
1511             break;
1512         case 'g':
1513             s->g_cpu = cpu;
1514             put_packet(s, "OK");
1515             break;
1516         default:
1517              put_packet(s, "E22");
1518              break;
1519         }
1520         break;
1521     case 'T':
1522         thread_kind = read_thread_id(p, &p, &pid, &tid);
1523         if (thread_kind == GDB_READ_THREAD_ERR) {
1524             put_packet(s, "E22");
1525             break;
1526         }
1527         cpu = gdb_get_cpu(s, pid, tid);
1528
1529         if (cpu != NULL) {
1530             put_packet(s, "OK");
1531         } else {
1532             put_packet(s, "E22");
1533         }
1534         break;
1535     case 'q':
1536     case 'Q':
1537         /* parse any 'q' packets here */
1538         if (!strcmp(p,"qemu.sstepbits")) {
1539             /* Query Breakpoint bit definitions */
1540             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1541                      SSTEP_ENABLE,
1542                      SSTEP_NOIRQ,
1543                      SSTEP_NOTIMER);
1544             put_packet(s, buf);
1545             break;
1546         } else if (is_query_packet(p, "qemu.sstep", '=')) {
1547             /* Display or change the sstep_flags */
1548             p += 10;
1549             if (*p != '=') {
1550                 /* Display current setting */
1551                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1552                 put_packet(s, buf);
1553                 break;
1554             }
1555             p++;
1556             type = strtoul(p, (char **)&p, 16);
1557             sstep_flags = type;
1558             put_packet(s, "OK");
1559             break;
1560         } else if (strcmp(p,"C") == 0) {
1561             /*
1562              * "Current thread" remains vague in the spec, so always return
1563              * the first thread of the current process (gdb returns the
1564              * first thread).
1565              */
1566             cpu = get_first_cpu_in_process(s, gdb_get_cpu_process(s, s->g_cpu));
1567             snprintf(buf, sizeof(buf), "QC%s",
1568                      gdb_fmt_thread_id(s, cpu, thread_id, sizeof(thread_id)));
1569             put_packet(s, buf);
1570             break;
1571         } else if (strcmp(p,"fThreadInfo") == 0) {
1572             s->query_cpu = gdb_first_attached_cpu(s);
1573             goto report_cpuinfo;
1574         } else if (strcmp(p,"sThreadInfo") == 0) {
1575         report_cpuinfo:
1576             if (s->query_cpu) {
1577                 snprintf(buf, sizeof(buf), "m%s",
1578                          gdb_fmt_thread_id(s, s->query_cpu,
1579                                        thread_id, sizeof(thread_id)));
1580                 put_packet(s, buf);
1581                 s->query_cpu = gdb_next_attached_cpu(s, s->query_cpu);
1582             } else
1583                 put_packet(s, "l");
1584             break;
1585         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1586             if (read_thread_id(p + 16, &p, &pid, &tid) == GDB_READ_THREAD_ERR) {
1587                 put_packet(s, "E22");
1588                 break;
1589             }
1590             cpu = gdb_get_cpu(s, pid, tid);
1591             if (cpu != NULL) {
1592                 cpu_synchronize_state(cpu);
1593
1594                 if (s->multiprocess && (s->process_num > 1)) {
1595                     /* Print the CPU model and name in multiprocess mode */
1596                     ObjectClass *oc = object_get_class(OBJECT(cpu));
1597                     const char *cpu_model = object_class_get_name(oc);
1598                     char *cpu_name =
1599                         object_get_canonical_path_component(OBJECT(cpu));
1600                     len = snprintf((char *)mem_buf, sizeof(buf) / 2,
1601                                    "%s %s [%s]", cpu_model, cpu_name,
1602                                    cpu->halted ? "halted " : "running");
1603                     g_free(cpu_name);
1604                 } else {
1605                     /* memtohex() doubles the required space */
1606                     len = snprintf((char *)mem_buf, sizeof(buf) / 2,
1607                                    "CPU#%d [%s]", cpu->cpu_index,
1608                                    cpu->halted ? "halted " : "running");
1609                 }
1610                 trace_gdbstub_op_extra_info((char *)mem_buf);
1611                 memtohex(buf, mem_buf, len);
1612                 put_packet(s, buf);
1613             }
1614             break;
1615         }
1616 #ifdef CONFIG_USER_ONLY
1617         else if (strcmp(p, "Offsets") == 0) {
1618             TaskState *ts = s->c_cpu->opaque;
1619
1620             snprintf(buf, sizeof(buf),
1621                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1622                      ";Bss=" TARGET_ABI_FMT_lx,
1623                      ts->info->code_offset,
1624                      ts->info->data_offset,
1625                      ts->info->data_offset);
1626             put_packet(s, buf);
1627             break;
1628         }
1629 #else /* !CONFIG_USER_ONLY */
1630         else if (strncmp(p, "Rcmd,", 5) == 0) {
1631             int len = strlen(p + 5);
1632
1633             if ((len % 2) != 0) {
1634                 put_packet(s, "E01");
1635                 break;
1636             }
1637             len = len / 2;
1638             hextomem(mem_buf, p + 5, len);
1639             mem_buf[len++] = 0;
1640             qemu_chr_be_write(s->mon_chr, mem_buf, len);
1641             put_packet(s, "OK");
1642             break;
1643         }
1644 #endif /* !CONFIG_USER_ONLY */
1645         if (is_query_packet(p, "Supported", ':')) {
1646             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1647             cc = CPU_GET_CLASS(first_cpu);
1648             if (cc->gdb_core_xml_file != NULL) {
1649                 pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1650             }
1651             put_packet(s, buf);
1652             break;
1653         }
1654         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1655             const char *xml;
1656             target_ulong total_len;
1657
1658             process = gdb_get_cpu_process(s, s->g_cpu);
1659             cc = CPU_GET_CLASS(s->g_cpu);
1660             if (cc->gdb_core_xml_file == NULL) {
1661                 goto unknown_command;
1662             }
1663
1664             gdb_has_xml = true;
1665             p += 19;
1666             xml = get_feature_xml(s, p, &p, process);
1667             if (!xml) {
1668                 snprintf(buf, sizeof(buf), "E00");
1669                 put_packet(s, buf);
1670                 break;
1671             }
1672
1673             if (*p == ':')
1674                 p++;
1675             addr = strtoul(p, (char **)&p, 16);
1676             if (*p == ',')
1677                 p++;
1678             len = strtoul(p, (char **)&p, 16);
1679
1680             total_len = strlen(xml);
1681             if (addr > total_len) {
1682                 snprintf(buf, sizeof(buf), "E00");
1683                 put_packet(s, buf);
1684                 break;
1685             }
1686             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1687                 len = (MAX_PACKET_LENGTH - 5) / 2;
1688             if (len < total_len - addr) {
1689                 buf[0] = 'm';
1690                 len = memtox(buf + 1, xml + addr, len);
1691             } else {
1692                 buf[0] = 'l';
1693                 len = memtox(buf + 1, xml + addr, total_len - addr);
1694             }
1695             put_packet_binary(s, buf, len + 1, true);
1696             break;
1697         }
1698         if (is_query_packet(p, "Attached", ':')) {
1699             put_packet(s, GDB_ATTACHED);
1700             break;
1701         }
1702         /* Unrecognised 'q' command.  */
1703         goto unknown_command;
1704
1705     default:
1706     unknown_command:
1707         /* put empty packet */
1708         buf[0] = '\0';
1709         put_packet(s, buf);
1710         break;
1711     }
1712     return RS_IDLE;
1713 }
1714
1715 void gdb_set_stop_cpu(CPUState *cpu)
1716 {
1717     gdbserver_state->c_cpu = cpu;
1718     gdbserver_state->g_cpu = cpu;
1719 }
1720
1721 #ifndef CONFIG_USER_ONLY
1722 static void gdb_vm_state_change(void *opaque, int running, RunState state)
1723 {
1724     GDBState *s = gdbserver_state;
1725     CPUState *cpu = s->c_cpu;
1726     char buf[256];
1727     const char *type;
1728     int ret;
1729
1730     if (running || s->state == RS_INACTIVE) {
1731         return;
1732     }
1733     /* Is there a GDB syscall waiting to be sent?  */
1734     if (s->current_syscall_cb) {
1735         put_packet(s, s->syscall_buf);
1736         return;
1737     }
1738     switch (state) {
1739     case RUN_STATE_DEBUG:
1740         if (cpu->watchpoint_hit) {
1741             switch (cpu->watchpoint_hit->flags & BP_MEM_ACCESS) {
1742             case BP_MEM_READ:
1743                 type = "r";
1744                 break;
1745             case BP_MEM_ACCESS:
1746                 type = "a";
1747                 break;
1748             default:
1749                 type = "";
1750                 break;
1751             }
1752             trace_gdbstub_hit_watchpoint(type, cpu_gdb_index(cpu),
1753                     (target_ulong)cpu->watchpoint_hit->vaddr);
1754             snprintf(buf, sizeof(buf),
1755                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1756                      GDB_SIGNAL_TRAP, cpu_gdb_index(cpu), type,
1757                      (target_ulong)cpu->watchpoint_hit->vaddr);
1758             cpu->watchpoint_hit = NULL;
1759             goto send_packet;
1760         } else {
1761             trace_gdbstub_hit_break();
1762         }
1763         tb_flush(cpu);
1764         ret = GDB_SIGNAL_TRAP;
1765         break;
1766     case RUN_STATE_PAUSED:
1767         trace_gdbstub_hit_paused();
1768         ret = GDB_SIGNAL_INT;
1769         break;
1770     case RUN_STATE_SHUTDOWN:
1771         trace_gdbstub_hit_shutdown();
1772         ret = GDB_SIGNAL_QUIT;
1773         break;
1774     case RUN_STATE_IO_ERROR:
1775         trace_gdbstub_hit_io_error();
1776         ret = GDB_SIGNAL_IO;
1777         break;
1778     case RUN_STATE_WATCHDOG:
1779         trace_gdbstub_hit_watchdog();
1780         ret = GDB_SIGNAL_ALRM;
1781         break;
1782     case RUN_STATE_INTERNAL_ERROR:
1783         trace_gdbstub_hit_internal_error();
1784         ret = GDB_SIGNAL_ABRT;
1785         break;
1786     case RUN_STATE_SAVE_VM:
1787     case RUN_STATE_RESTORE_VM:
1788         return;
1789     case RUN_STATE_FINISH_MIGRATE:
1790         ret = GDB_SIGNAL_XCPU;
1791         break;
1792     default:
1793         trace_gdbstub_hit_unknown(state);
1794         ret = GDB_SIGNAL_UNKNOWN;
1795         break;
1796     }
1797     gdb_set_stop_cpu(cpu);
1798     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, cpu_gdb_index(cpu));
1799
1800 send_packet:
1801     put_packet(s, buf);
1802
1803     /* disable single step if it was enabled */
1804     cpu_single_step(cpu, 0);
1805 }
1806 #endif
1807
1808 /* Send a gdb syscall request.
1809    This accepts limited printf-style format specifiers, specifically:
1810     %x  - target_ulong argument printed in hex.
1811     %lx - 64-bit argument printed in hex.
1812     %s  - string pointer (target_ulong) and length (int) pair.  */
1813 void gdb_do_syscallv(gdb_syscall_complete_cb cb, const char *fmt, va_list va)
1814 {
1815     char *p;
1816     char *p_end;
1817     target_ulong addr;
1818     uint64_t i64;
1819     GDBState *s;
1820
1821     s = gdbserver_state;
1822     if (!s)
1823         return;
1824     s->current_syscall_cb = cb;
1825 #ifndef CONFIG_USER_ONLY
1826     vm_stop(RUN_STATE_DEBUG);
1827 #endif
1828     p = s->syscall_buf;
1829     p_end = &s->syscall_buf[sizeof(s->syscall_buf)];
1830     *(p++) = 'F';
1831     while (*fmt) {
1832         if (*fmt == '%') {
1833             fmt++;
1834             switch (*fmt++) {
1835             case 'x':
1836                 addr = va_arg(va, target_ulong);
1837                 p += snprintf(p, p_end - p, TARGET_FMT_lx, addr);
1838                 break;
1839             case 'l':
1840                 if (*(fmt++) != 'x')
1841                     goto bad_format;
1842                 i64 = va_arg(va, uint64_t);
1843                 p += snprintf(p, p_end - p, "%" PRIx64, i64);
1844                 break;
1845             case 's':
1846                 addr = va_arg(va, target_ulong);
1847                 p += snprintf(p, p_end - p, TARGET_FMT_lx "/%x",
1848                               addr, va_arg(va, int));
1849                 break;
1850             default:
1851             bad_format:
1852                 error_report("gdbstub: Bad syscall format string '%s'",
1853                              fmt - 1);
1854                 break;
1855             }
1856         } else {
1857             *(p++) = *(fmt++);
1858         }
1859     }
1860     *p = 0;
1861 #ifdef CONFIG_USER_ONLY
1862     put_packet(s, s->syscall_buf);
1863     /* Return control to gdb for it to process the syscall request.
1864      * Since the protocol requires that gdb hands control back to us
1865      * using a "here are the results" F packet, we don't need to check
1866      * gdb_handlesig's return value (which is the signal to deliver if
1867      * execution was resumed via a continue packet).
1868      */
1869     gdb_handlesig(s->c_cpu, 0);
1870 #else
1871     /* In this case wait to send the syscall packet until notification that
1872        the CPU has stopped.  This must be done because if the packet is sent
1873        now the reply from the syscall request could be received while the CPU
1874        is still in the running state, which can cause packets to be dropped
1875        and state transition 'T' packets to be sent while the syscall is still
1876        being processed.  */
1877     qemu_cpu_kick(s->c_cpu);
1878 #endif
1879 }
1880
1881 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1882 {
1883     va_list va;
1884
1885     va_start(va, fmt);
1886     gdb_do_syscallv(cb, fmt, va);
1887     va_end(va);
1888 }
1889
1890 static void gdb_read_byte(GDBState *s, int ch)
1891 {
1892     uint8_t reply;
1893
1894 #ifndef CONFIG_USER_ONLY
1895     if (s->last_packet_len) {
1896         /* Waiting for a response to the last packet.  If we see the start
1897            of a new command then abandon the previous response.  */
1898         if (ch == '-') {
1899             trace_gdbstub_err_got_nack();
1900             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
1901         } else if (ch == '+') {
1902             trace_gdbstub_io_got_ack();
1903         } else {
1904             trace_gdbstub_io_got_unexpected((uint8_t)ch);
1905         }
1906
1907         if (ch == '+' || ch == '$')
1908             s->last_packet_len = 0;
1909         if (ch != '$')
1910             return;
1911     }
1912     if (runstate_is_running()) {
1913         /* when the CPU is running, we cannot do anything except stop
1914            it when receiving a char */
1915         vm_stop(RUN_STATE_PAUSED);
1916     } else
1917 #endif
1918     {
1919         switch(s->state) {
1920         case RS_IDLE:
1921             if (ch == '$') {
1922                 /* start of command packet */
1923                 s->line_buf_index = 0;
1924                 s->line_sum = 0;
1925                 s->state = RS_GETLINE;
1926             } else {
1927                 trace_gdbstub_err_garbage((uint8_t)ch);
1928             }
1929             break;
1930         case RS_GETLINE:
1931             if (ch == '}') {
1932                 /* start escape sequence */
1933                 s->state = RS_GETLINE_ESC;
1934                 s->line_sum += ch;
1935             } else if (ch == '*') {
1936                 /* start run length encoding sequence */
1937                 s->state = RS_GETLINE_RLE;
1938                 s->line_sum += ch;
1939             } else if (ch == '#') {
1940                 /* end of command, start of checksum*/
1941                 s->state = RS_CHKSUM1;
1942             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1943                 trace_gdbstub_err_overrun();
1944                 s->state = RS_IDLE;
1945             } else {
1946                 /* unescaped command character */
1947                 s->line_buf[s->line_buf_index++] = ch;
1948                 s->line_sum += ch;
1949             }
1950             break;
1951         case RS_GETLINE_ESC:
1952             if (ch == '#') {
1953                 /* unexpected end of command in escape sequence */
1954                 s->state = RS_CHKSUM1;
1955             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1956                 /* command buffer overrun */
1957                 trace_gdbstub_err_overrun();
1958                 s->state = RS_IDLE;
1959             } else {
1960                 /* parse escaped character and leave escape state */
1961                 s->line_buf[s->line_buf_index++] = ch ^ 0x20;
1962                 s->line_sum += ch;
1963                 s->state = RS_GETLINE;
1964             }
1965             break;
1966         case RS_GETLINE_RLE:
1967             if (ch < ' ') {
1968                 /* invalid RLE count encoding */
1969                 trace_gdbstub_err_invalid_repeat((uint8_t)ch);
1970                 s->state = RS_GETLINE;
1971             } else {
1972                 /* decode repeat length */
1973                 int repeat = (unsigned char)ch - ' ' + 3;
1974                 if (s->line_buf_index + repeat >= sizeof(s->line_buf) - 1) {
1975                     /* that many repeats would overrun the command buffer */
1976                     trace_gdbstub_err_overrun();
1977                     s->state = RS_IDLE;
1978                 } else if (s->line_buf_index < 1) {
1979                     /* got a repeat but we have nothing to repeat */
1980                     trace_gdbstub_err_invalid_rle();
1981                     s->state = RS_GETLINE;
1982                 } else {
1983                     /* repeat the last character */
1984                     memset(s->line_buf + s->line_buf_index,
1985                            s->line_buf[s->line_buf_index - 1], repeat);
1986                     s->line_buf_index += repeat;
1987                     s->line_sum += ch;
1988                     s->state = RS_GETLINE;
1989                 }
1990             }
1991             break;
1992         case RS_CHKSUM1:
1993             /* get high hex digit of checksum */
1994             if (!isxdigit(ch)) {
1995                 trace_gdbstub_err_checksum_invalid((uint8_t)ch);
1996                 s->state = RS_GETLINE;
1997                 break;
1998             }
1999             s->line_buf[s->line_buf_index] = '\0';
2000             s->line_csum = fromhex(ch) << 4;
2001             s->state = RS_CHKSUM2;
2002             break;
2003         case RS_CHKSUM2:
2004             /* get low hex digit of checksum */
2005             if (!isxdigit(ch)) {
2006                 trace_gdbstub_err_checksum_invalid((uint8_t)ch);
2007                 s->state = RS_GETLINE;
2008                 break;
2009             }
2010             s->line_csum |= fromhex(ch);
2011
2012             if (s->line_csum != (s->line_sum & 0xff)) {
2013                 trace_gdbstub_err_checksum_incorrect(s->line_sum, s->line_csum);
2014                 /* send NAK reply */
2015                 reply = '-';
2016                 put_buffer(s, &reply, 1);
2017                 s->state = RS_IDLE;
2018             } else {
2019                 /* send ACK reply */
2020                 reply = '+';
2021                 put_buffer(s, &reply, 1);
2022                 s->state = gdb_handle_packet(s, s->line_buf);
2023             }
2024             break;
2025         default:
2026             abort();
2027         }
2028     }
2029 }
2030
2031 /* Tell the remote gdb that the process has exited.  */
2032 void gdb_exit(CPUArchState *env, int code)
2033 {
2034   GDBState *s;
2035   char buf[4];
2036
2037   s = gdbserver_state;
2038   if (!s) {
2039       return;
2040   }
2041 #ifdef CONFIG_USER_ONLY
2042   if (gdbserver_fd < 0 || s->fd < 0) {
2043       return;
2044   }
2045 #endif
2046
2047   trace_gdbstub_op_exiting((uint8_t)code);
2048
2049   snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
2050   put_packet(s, buf);
2051
2052 #ifndef CONFIG_USER_ONLY
2053   qemu_chr_fe_deinit(&s->chr, true);
2054 #endif
2055 }
2056
2057 /*
2058  * Create the process that will contain all the "orphan" CPUs (that are not
2059  * part of a CPU cluster). Note that if this process contains no CPUs, it won't
2060  * be attachable and thus will be invisible to the user.
2061  */
2062 static void create_default_process(GDBState *s)
2063 {
2064     GDBProcess *process;
2065     int max_pid = 0;
2066
2067     if (s->process_num) {
2068         max_pid = s->processes[s->process_num - 1].pid;
2069     }
2070
2071     s->processes = g_renew(GDBProcess, s->processes, ++s->process_num);
2072     process = &s->processes[s->process_num - 1];
2073
2074     /* We need an available PID slot for this process */
2075     assert(max_pid < UINT32_MAX);
2076
2077     process->pid = max_pid + 1;
2078     process->attached = false;
2079     process->target_xml[0] = '\0';
2080 }
2081
2082 #ifdef CONFIG_USER_ONLY
2083 int
2084 gdb_handlesig(CPUState *cpu, int sig)
2085 {
2086     GDBState *s;
2087     char buf[256];
2088     int n;
2089
2090     s = gdbserver_state;
2091     if (gdbserver_fd < 0 || s->fd < 0) {
2092         return sig;
2093     }
2094
2095     /* disable single step if it was enabled */
2096     cpu_single_step(cpu, 0);
2097     tb_flush(cpu);
2098
2099     if (sig != 0) {
2100         snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));
2101         put_packet(s, buf);
2102     }
2103     /* put_packet() might have detected that the peer terminated the
2104        connection.  */
2105     if (s->fd < 0) {
2106         return sig;
2107     }
2108
2109     sig = 0;
2110     s->state = RS_IDLE;
2111     s->running_state = 0;
2112     while (s->running_state == 0) {
2113         n = read(s->fd, buf, 256);
2114         if (n > 0) {
2115             int i;
2116
2117             for (i = 0; i < n; i++) {
2118                 gdb_read_byte(s, buf[i]);
2119             }
2120         } else {
2121             /* XXX: Connection closed.  Should probably wait for another
2122                connection before continuing.  */
2123             if (n == 0) {
2124                 close(s->fd);
2125             }
2126             s->fd = -1;
2127             return sig;
2128         }
2129     }
2130     sig = s->signal;
2131     s->signal = 0;
2132     return sig;
2133 }
2134
2135 /* Tell the remote gdb that the process has exited due to SIG.  */
2136 void gdb_signalled(CPUArchState *env, int sig)
2137 {
2138     GDBState *s;
2139     char buf[4];
2140
2141     s = gdbserver_state;
2142     if (gdbserver_fd < 0 || s->fd < 0) {
2143         return;
2144     }
2145
2146     snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb(sig));
2147     put_packet(s, buf);
2148 }
2149
2150 static bool gdb_accept(void)
2151 {
2152     GDBState *s;
2153     struct sockaddr_in sockaddr;
2154     socklen_t len;
2155     int fd;
2156
2157     for(;;) {
2158         len = sizeof(sockaddr);
2159         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2160         if (fd < 0 && errno != EINTR) {
2161             perror("accept");
2162             return false;
2163         } else if (fd >= 0) {
2164             qemu_set_cloexec(fd);
2165             break;
2166         }
2167     }
2168
2169     /* set short latency */
2170     if (socket_set_nodelay(fd)) {
2171         perror("setsockopt");
2172         close(fd);
2173         return false;
2174     }
2175
2176     s = g_malloc0(sizeof(GDBState));
2177     s->c_cpu = first_cpu;
2178     s->g_cpu = first_cpu;
2179     create_default_process(s);
2180     s->fd = fd;
2181     gdb_has_xml = false;
2182
2183     gdbserver_state = s;
2184     return true;
2185 }
2186
2187 static int gdbserver_open(int port)
2188 {
2189     struct sockaddr_in sockaddr;
2190     int fd, ret;
2191
2192     fd = socket(PF_INET, SOCK_STREAM, 0);
2193     if (fd < 0) {
2194         perror("socket");
2195         return -1;
2196     }
2197     qemu_set_cloexec(fd);
2198
2199     socket_set_fast_reuse(fd);
2200
2201     sockaddr.sin_family = AF_INET;
2202     sockaddr.sin_port = htons(port);
2203     sockaddr.sin_addr.s_addr = 0;
2204     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2205     if (ret < 0) {
2206         perror("bind");
2207         close(fd);
2208         return -1;
2209     }
2210     ret = listen(fd, 1);
2211     if (ret < 0) {
2212         perror("listen");
2213         close(fd);
2214         return -1;
2215     }
2216     return fd;
2217 }
2218
2219 int gdbserver_start(int port)
2220 {
2221     gdbserver_fd = gdbserver_open(port);
2222     if (gdbserver_fd < 0)
2223         return -1;
2224     /* accept connections */
2225     if (!gdb_accept()) {
2226         close(gdbserver_fd);
2227         gdbserver_fd = -1;
2228         return -1;
2229     }
2230     return 0;
2231 }
2232
2233 /* Disable gdb stub for child processes.  */
2234 void gdbserver_fork(CPUState *cpu)
2235 {
2236     GDBState *s = gdbserver_state;
2237
2238     if (gdbserver_fd < 0 || s->fd < 0) {
2239         return;
2240     }
2241     close(s->fd);
2242     s->fd = -1;
2243     cpu_breakpoint_remove_all(cpu, BP_GDB);
2244     cpu_watchpoint_remove_all(cpu, BP_GDB);
2245 }
2246 #else
2247 static int gdb_chr_can_receive(void *opaque)
2248 {
2249   /* We can handle an arbitrarily large amount of data.
2250    Pick the maximum packet size, which is as good as anything.  */
2251   return MAX_PACKET_LENGTH;
2252 }
2253
2254 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2255 {
2256     int i;
2257
2258     for (i = 0; i < size; i++) {
2259         gdb_read_byte(gdbserver_state, buf[i]);
2260     }
2261 }
2262
2263 static void gdb_chr_event(void *opaque, int event)
2264 {
2265     switch (event) {
2266     case CHR_EVENT_OPENED:
2267         vm_stop(RUN_STATE_PAUSED);
2268         gdb_has_xml = false;
2269         break;
2270     default:
2271         break;
2272     }
2273 }
2274
2275 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2276 {
2277     char buf[MAX_PACKET_LENGTH];
2278
2279     buf[0] = 'O';
2280     if (len > (MAX_PACKET_LENGTH/2) - 1)
2281         len = (MAX_PACKET_LENGTH/2) - 1;
2282     memtohex(buf + 1, (uint8_t *)msg, len);
2283     put_packet(s, buf);
2284 }
2285
2286 static int gdb_monitor_write(Chardev *chr, const uint8_t *buf, int len)
2287 {
2288     const char *p = (const char *)buf;
2289     int max_sz;
2290
2291     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2292     for (;;) {
2293         if (len <= max_sz) {
2294             gdb_monitor_output(gdbserver_state, p, len);
2295             break;
2296         }
2297         gdb_monitor_output(gdbserver_state, p, max_sz);
2298         p += max_sz;
2299         len -= max_sz;
2300     }
2301     return len;
2302 }
2303
2304 #ifndef _WIN32
2305 static void gdb_sigterm_handler(int signal)
2306 {
2307     if (runstate_is_running()) {
2308         vm_stop(RUN_STATE_PAUSED);
2309     }
2310 }
2311 #endif
2312
2313 static void gdb_monitor_open(Chardev *chr, ChardevBackend *backend,
2314                              bool *be_opened, Error **errp)
2315 {
2316     *be_opened = false;
2317 }
2318
2319 static void char_gdb_class_init(ObjectClass *oc, void *data)
2320 {
2321     ChardevClass *cc = CHARDEV_CLASS(oc);
2322
2323     cc->internal = true;
2324     cc->open = gdb_monitor_open;
2325     cc->chr_write = gdb_monitor_write;
2326 }
2327
2328 #define TYPE_CHARDEV_GDB "chardev-gdb"
2329
2330 static const TypeInfo char_gdb_type_info = {
2331     .name = TYPE_CHARDEV_GDB,
2332     .parent = TYPE_CHARDEV,
2333     .class_init = char_gdb_class_init,
2334 };
2335
2336 static int find_cpu_clusters(Object *child, void *opaque)
2337 {
2338     if (object_dynamic_cast(child, TYPE_CPU_CLUSTER)) {
2339         GDBState *s = (GDBState *) opaque;
2340         CPUClusterState *cluster = CPU_CLUSTER(child);
2341         GDBProcess *process;
2342
2343         s->processes = g_renew(GDBProcess, s->processes, ++s->process_num);
2344
2345         process = &s->processes[s->process_num - 1];
2346
2347         /*
2348          * GDB process IDs -1 and 0 are reserved. To avoid subtle errors at
2349          * runtime, we enforce here that the machine does not use a cluster ID
2350          * that would lead to PID 0.
2351          */
2352         assert(cluster->cluster_id != UINT32_MAX);
2353         process->pid = cluster->cluster_id + 1;
2354         process->attached = false;
2355         process->target_xml[0] = '\0';
2356
2357         return 0;
2358     }
2359
2360     return object_child_foreach(child, find_cpu_clusters, opaque);
2361 }
2362
2363 static int pid_order(const void *a, const void *b)
2364 {
2365     GDBProcess *pa = (GDBProcess *) a;
2366     GDBProcess *pb = (GDBProcess *) b;
2367
2368     if (pa->pid < pb->pid) {
2369         return -1;
2370     } else if (pa->pid > pb->pid) {
2371         return 1;
2372     } else {
2373         return 0;
2374     }
2375 }
2376
2377 static void create_processes(GDBState *s)
2378 {
2379     object_child_foreach(object_get_root(), find_cpu_clusters, s);
2380
2381     if (s->processes) {
2382         /* Sort by PID */
2383         qsort(s->processes, s->process_num, sizeof(s->processes[0]), pid_order);
2384     }
2385
2386     create_default_process(s);
2387 }
2388
2389 static void cleanup_processes(GDBState *s)
2390 {
2391     g_free(s->processes);
2392     s->process_num = 0;
2393     s->processes = NULL;
2394 }
2395
2396 int gdbserver_start(const char *device)
2397 {
2398     trace_gdbstub_op_start(device);
2399
2400     GDBState *s;
2401     char gdbstub_device_name[128];
2402     Chardev *chr = NULL;
2403     Chardev *mon_chr;
2404
2405     if (!first_cpu) {
2406         error_report("gdbstub: meaningless to attach gdb to a "
2407                      "machine without any CPU.");
2408         return -1;
2409     }
2410
2411     if (!device)
2412         return -1;
2413     if (strcmp(device, "none") != 0) {
2414         if (strstart(device, "tcp:", NULL)) {
2415             /* enforce required TCP attributes */
2416             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2417                      "%s,nowait,nodelay,server", device);
2418             device = gdbstub_device_name;
2419         }
2420 #ifndef _WIN32
2421         else if (strcmp(device, "stdio") == 0) {
2422             struct sigaction act;
2423
2424             memset(&act, 0, sizeof(act));
2425             act.sa_handler = gdb_sigterm_handler;
2426             sigaction(SIGINT, &act, NULL);
2427         }
2428 #endif
2429         /*
2430          * FIXME: it's a bit weird to allow using a mux chardev here
2431          * and implicitly setup a monitor. We may want to break this.
2432          */
2433         chr = qemu_chr_new_noreplay("gdb", device, true);
2434         if (!chr)
2435             return -1;
2436     }
2437
2438     s = gdbserver_state;
2439     if (!s) {
2440         s = g_malloc0(sizeof(GDBState));
2441         gdbserver_state = s;
2442
2443         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2444
2445         /* Initialize a monitor terminal for gdb */
2446         mon_chr = qemu_chardev_new(NULL, TYPE_CHARDEV_GDB,
2447                                    NULL, &error_abort);
2448         monitor_init(mon_chr, 0);
2449     } else {
2450         qemu_chr_fe_deinit(&s->chr, true);
2451         mon_chr = s->mon_chr;
2452         cleanup_processes(s);
2453         memset(s, 0, sizeof(GDBState));
2454         s->mon_chr = mon_chr;
2455     }
2456     s->c_cpu = first_cpu;
2457     s->g_cpu = first_cpu;
2458
2459     create_processes(s);
2460
2461     if (chr) {
2462         qemu_chr_fe_init(&s->chr, chr, &error_abort);
2463         qemu_chr_fe_set_handlers(&s->chr, gdb_chr_can_receive, gdb_chr_receive,
2464                                  gdb_chr_event, NULL, NULL, NULL, true);
2465     }
2466     s->state = chr ? RS_IDLE : RS_INACTIVE;
2467     s->mon_chr = mon_chr;
2468     s->current_syscall_cb = NULL;
2469
2470     return 0;
2471 }
2472
2473 void gdbserver_cleanup(void)
2474 {
2475     if (gdbserver_state) {
2476         put_packet(gdbserver_state, "W00");
2477     }
2478 }
2479
2480 static void register_types(void)
2481 {
2482     type_register_static(&char_gdb_type_info);
2483 }
2484
2485 type_init(register_types);
2486 #endif