gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "qemu/osdep.h"
  21 #include "qemu-common.h"
  22 #include "qapi/error.h"
  23 #include "qemu/error-report.h"
  24 #include "qemu/ctype.h"
  25 #include "qemu/cutils.h"
  26 #include "qemu/module.h"
  27 #include "trace-root.h"
  28 #ifdef CONFIG_USER_ONLY
  29 #include "qemu.h"
  30 #else
  31 #include "monitor/monitor.h"
  32 #include "chardev/char.h"
  33 #include "chardev/char-fe.h"
  34 #include "sysemu/sysemu.h"
  35 #include "exec/gdbstub.h"
  36 #include "hw/cpu/cluster.h"
  37 #endif
  38
  39 #define MAX_PACKET_LENGTH 4096
  40
  41 #include "qemu/sockets.h"
  42 #include "sysemu/hw_accel.h"
  43 #include "sysemu/kvm.h"
  44 #include "hw/semihosting/semihost.h"
  45 #include "exec/exec-all.h"
  46
  47 #ifdef CONFIG_USER_ONLY
  48 #define GDB_ATTACHED "0"
  49 #else
  50 #define GDB_ATTACHED "1"
  51 #endif
  52
  53 static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
  54                                          uint8_t *buf, int len, bool is_write)
  55 {
  56     CPUClass *cc = CPU_GET_CLASS(cpu);
  57
  58     if (cc->memory_rw_debug) {
  59         return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
  60     }
  61     return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
  62 }
  63
  64 /* Return the GDB index for a given vCPU state.
  65  *
  66  * For user mode this is simply the thread id. In system mode GDB
  67  * numbers CPUs from 1 as 0 is reserved as an "any cpu" index.
  68  */
  69 static inline int cpu_gdb_index(CPUState *cpu)
  70 {
  71 #if defined(CONFIG_USER_ONLY)
  72     TaskState *ts = (TaskState *) cpu->opaque;
  73     return ts->ts_tid;
  74 #else
  75     return cpu->cpu_index + 1;
  76 #endif
  77 }
  78
  79 enum {
  80     GDB_SIGNAL_0 = 0,
  81     GDB_SIGNAL_INT = 2,
  82     GDB_SIGNAL_QUIT = 3,
  83     GDB_SIGNAL_TRAP = 5,
  84     GDB_SIGNAL_ABRT = 6,
  85     GDB_SIGNAL_ALRM = 14,
  86     GDB_SIGNAL_IO = 23,
  87     GDB_SIGNAL_XCPU = 24,
  88     GDB_SIGNAL_UNKNOWN = 143
  89 };
  90
  91 #ifdef CONFIG_USER_ONLY
  92
  93 /* Map target signal numbers to GDB protocol signal numbers and vice
  94  * versa.  For user emulation's currently supported systems, we can
  95  * assume most signals are defined.
  96  */
  97
  98 static int gdb_signal_table[] = {
  99     0,
 100     TARGET_SIGHUP,
 101     TARGET_SIGINT,
 102     TARGET_SIGQUIT,
 103     TARGET_SIGILL,
 104     TARGET_SIGTRAP,
 105     TARGET_SIGABRT,
 106     -1, /* SIGEMT */
 107     TARGET_SIGFPE,
 108     TARGET_SIGKILL,
 109     TARGET_SIGBUS,
 110     TARGET_SIGSEGV,
 111     TARGET_SIGSYS,
 112     TARGET_SIGPIPE,
 113     TARGET_SIGALRM,
 114     TARGET_SIGTERM,
 115     TARGET_SIGURG,
 116     TARGET_SIGSTOP,
 117     TARGET_SIGTSTP,
 118     TARGET_SIGCONT,
 119     TARGET_SIGCHLD,
 120     TARGET_SIGTTIN,
 121     TARGET_SIGTTOU,
 122     TARGET_SIGIO,
 123     TARGET_SIGXCPU,
 124     TARGET_SIGXFSZ,
 125     TARGET_SIGVTALRM,
 126     TARGET_SIGPROF,
 127     TARGET_SIGWINCH,
 128     -1, /* SIGLOST */
 129     TARGET_SIGUSR1,
 130     TARGET_SIGUSR2,
 131 #ifdef TARGET_SIGPWR
 132     TARGET_SIGPWR,
 133 #else
 134     -1,
 135 #endif
 136     -1, /* SIGPOLL */
 137     -1,
 138     -1,
 139     -1,
 140     -1,
 141     -1,
 142     -1,
 143     -1,
 144     -1,
 145     -1,
 146     -1,
 147     -1,
 148 #ifdef __SIGRTMIN
 149     __SIGRTMIN + 1,
 150     __SIGRTMIN + 2,
 151     __SIGRTMIN + 3,
 152     __SIGRTMIN + 4,
 153     __SIGRTMIN + 5,
 154     __SIGRTMIN + 6,
 155     __SIGRTMIN + 7,
 156     __SIGRTMIN + 8,
 157     __SIGRTMIN + 9,
 158     __SIGRTMIN + 10,
 159     __SIGRTMIN + 11,
 160     __SIGRTMIN + 12,
 161     __SIGRTMIN + 13,
 162     __SIGRTMIN + 14,
 163     __SIGRTMIN + 15,
 164     __SIGRTMIN + 16,
 165     __SIGRTMIN + 17,
 166     __SIGRTMIN + 18,
 167     __SIGRTMIN + 19,
 168     __SIGRTMIN + 20,
 169     __SIGRTMIN + 21,
 170     __SIGRTMIN + 22,
 171     __SIGRTMIN + 23,
 172     __SIGRTMIN + 24,
 173     __SIGRTMIN + 25,
 174     __SIGRTMIN + 26,
 175     __SIGRTMIN + 27,
 176     __SIGRTMIN + 28,
 177     __SIGRTMIN + 29,
 178     __SIGRTMIN + 30,
 179     __SIGRTMIN + 31,
 180     -1, /* SIGCANCEL */
 181     __SIGRTMIN,
 182     __SIGRTMIN + 32,
 183     __SIGRTMIN + 33,
 184     __SIGRTMIN + 34,
 185     __SIGRTMIN + 35,
 186     __SIGRTMIN + 36,
 187     __SIGRTMIN + 37,
 188     __SIGRTMIN + 38,
 189     __SIGRTMIN + 39,
 190     __SIGRTMIN + 40,
 191     __SIGRTMIN + 41,
 192     __SIGRTMIN + 42,
 193     __SIGRTMIN + 43,
 194     __SIGRTMIN + 44,
 195     __SIGRTMIN + 45,
 196     __SIGRTMIN + 46,
 197     __SIGRTMIN + 47,
 198     __SIGRTMIN + 48,
 199     __SIGRTMIN + 49,
 200     __SIGRTMIN + 50,
 201     __SIGRTMIN + 51,
 202     __SIGRTMIN + 52,
 203     __SIGRTMIN + 53,
 204     __SIGRTMIN + 54,
 205     __SIGRTMIN + 55,
 206     __SIGRTMIN + 56,
 207     __SIGRTMIN + 57,
 208     __SIGRTMIN + 58,
 209     __SIGRTMIN + 59,
 210     __SIGRTMIN + 60,
 211     __SIGRTMIN + 61,
 212     __SIGRTMIN + 62,
 213     __SIGRTMIN + 63,
 214     __SIGRTMIN + 64,
 215     __SIGRTMIN + 65,
 216     __SIGRTMIN + 66,
 217     __SIGRTMIN + 67,
 218     __SIGRTMIN + 68,
 219     __SIGRTMIN + 69,
 220     __SIGRTMIN + 70,
 221     __SIGRTMIN + 71,
 222     __SIGRTMIN + 72,
 223     __SIGRTMIN + 73,
 224     __SIGRTMIN + 74,
 225     __SIGRTMIN + 75,
 226     __SIGRTMIN + 76,
 227     __SIGRTMIN + 77,
 228     __SIGRTMIN + 78,
 229     __SIGRTMIN + 79,
 230     __SIGRTMIN + 80,
 231     __SIGRTMIN + 81,
 232     __SIGRTMIN + 82,
 233     __SIGRTMIN + 83,
 234     __SIGRTMIN + 84,
 235     __SIGRTMIN + 85,
 236     __SIGRTMIN + 86,
 237     __SIGRTMIN + 87,
 238     __SIGRTMIN + 88,
 239     __SIGRTMIN + 89,
 240     __SIGRTMIN + 90,
 241     __SIGRTMIN + 91,
 242     __SIGRTMIN + 92,
 243     __SIGRTMIN + 93,
 244     __SIGRTMIN + 94,
 245     __SIGRTMIN + 95,
 246     -1, /* SIGINFO */
 247     -1, /* UNKNOWN */
 248     -1, /* DEFAULT */
 249     -1,
 250     -1,
 251     -1,
 252     -1,
 253     -1,
 254     -1
 255 #endif
 256 };
 257 #else
 258 /* In system mode we only need SIGINT and SIGTRAP; other signals
 259    are not yet supported.  */
 260
 261 enum {
 262     TARGET_SIGINT = 2,
 263     TARGET_SIGTRAP = 5
 264 };
 265
 266 static int gdb_signal_table[] = {
 267     -1,
 268     -1,
 269     TARGET_SIGINT,
 270     -1,
 271     -1,
 272     TARGET_SIGTRAP
 273 };
 274 #endif
 275
 276 #ifdef CONFIG_USER_ONLY
 277 static int target_signal_to_gdb (int sig)
 278 {
 279     int i;
 280     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 281         if (gdb_signal_table[i] == sig)
 282             return i;
 283     return GDB_SIGNAL_UNKNOWN;
 284 }
 285 #endif
 286
 287 static int gdb_signal_to_target (int sig)
 288 {
 289     if (sig < ARRAY_SIZE (gdb_signal_table))
 290         return gdb_signal_table[sig];
 291     else
 292         return -1;
 293 }
 294
 295 typedef struct GDBRegisterState {
 296     int base_reg;
 297     int num_regs;
 298     gdb_reg_cb get_reg;
 299     gdb_reg_cb set_reg;
 300     const char *xml;
 301     struct GDBRegisterState *next;
 302 } GDBRegisterState;
 303
 304 typedef struct GDBProcess {
 305     uint32_t pid;
 306     bool attached;
 307
 308     char target_xml[1024];
 309 } GDBProcess;
 310
 311 enum RSState {
 312     RS_INACTIVE,
 313     RS_IDLE,
 314     RS_GETLINE,
 315     RS_GETLINE_ESC,
 316     RS_GETLINE_RLE,
 317     RS_CHKSUM1,
 318     RS_CHKSUM2,
 319 };
 320 typedef struct GDBState {
 321     CPUState *c_cpu; /* current CPU for step/continue ops */
 322     CPUState *g_cpu; /* current CPU for other ops */
 323     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 324     enum RSState state; /* parsing state */
 325     char line_buf[MAX_PACKET_LENGTH];
 326     int line_buf_index;
 327     int line_sum; /* running checksum */
 328     int line_csum; /* checksum at the end of the packet */
 329     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 330     int last_packet_len;
 331     int signal;
 332 #ifdef CONFIG_USER_ONLY
 333     int fd;
 334     int running_state;
 335 #else
 336     CharBackend chr;
 337     Chardev *mon_chr;
 338 #endif
 339     bool multiprocess;
 340     GDBProcess *processes;
 341     int process_num;
 342     char syscall_buf[256];
 343     gdb_syscall_complete_cb current_syscall_cb;
 344 } GDBState;
 345
 346 /* By default use no IRQs and no timers while single stepping so as to
 347  * make single stepping like an ICE HW step.
 348  */
 349 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 350
 351 static GDBState *gdbserver_state;
 352
 353 bool gdb_has_xml;
 354
 355 #ifdef CONFIG_USER_ONLY
 356 /* XXX: This is not thread safe.  Do we care?  */
 357 static int gdbserver_fd = -1;
 358
 359 static int get_char(GDBState *s)
 360 {
 361     uint8_t ch;
 362     int ret;
 363
 364     for(;;) {
 365         ret = qemu_recv(s->fd, &ch, 1, 0);
 366         if (ret < 0) {
 367             if (errno == ECONNRESET)
 368                 s->fd = -1;
 369             if (errno != EINTR)
 370                 return -1;
 371         } else if (ret == 0) {
 372             close(s->fd);
 373             s->fd = -1;
 374             return -1;
 375         } else {
 376             break;
 377         }
 378     }
 379     return ch;
 380 }
 381 #endif
 382
 383 static enum {
 384     GDB_SYS_UNKNOWN,
 385     GDB_SYS_ENABLED,
 386     GDB_SYS_DISABLED,
 387 } gdb_syscall_mode;
 388
 389 /* Decide if either remote gdb syscalls or native file IO should be used. */
 390 int use_gdb_syscalls(void)
 391 {
 392     SemihostingTarget target = semihosting_get_target();
 393     if (target == SEMIHOSTING_TARGET_NATIVE) {
 394         /* -semihosting-config target=native */
 395         return false;
 396     } else if (target == SEMIHOSTING_TARGET_GDB) {
 397         /* -semihosting-config target=gdb */
 398         return true;
 399     }
 400
 401     /* -semihosting-config target=auto */
 402     /* On the first call check if gdb is connected and remember. */
 403     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 404         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 405                                             : GDB_SYS_DISABLED);
 406     }
 407     return gdb_syscall_mode == GDB_SYS_ENABLED;
 408 }
 409
 410 /* Resume execution.  */
 411 static inline void gdb_continue(GDBState *s)
 412 {
 413
 414 #ifdef CONFIG_USER_ONLY
 415     s->running_state = 1;
 416     trace_gdbstub_op_continue();
 417 #else
 418     if (!runstate_needs_reset()) {
 419         trace_gdbstub_op_continue();
 420         vm_start();
 421     }
 422 #endif
 423 }
 424
 425 /*
 426  * Resume execution, per CPU actions. For user-mode emulation it's
 427  * equivalent to gdb_continue.
 428  */
 429 static int gdb_continue_partial(GDBState *s, char *newstates)
 430 {
 431     CPUState *cpu;
 432     int res = 0;
 433 #ifdef CONFIG_USER_ONLY
 434     /*
 435      * This is not exactly accurate, but it's an improvement compared to the
 436      * previous situation, where only one CPU would be single-stepped.
 437      */
 438     CPU_FOREACH(cpu) {
 439         if (newstates[cpu->cpu_index] == 's') {
 440             trace_gdbstub_op_stepping(cpu->cpu_index);
 441             cpu_single_step(cpu, sstep_flags);
 442         }
 443     }
 444     s->running_state = 1;
 445 #else
 446     int flag = 0;
 447
 448     if (!runstate_needs_reset()) {
 449         if (vm_prepare_start()) {
 450             return 0;
 451         }
 452
 453         CPU_FOREACH(cpu) {
 454             switch (newstates[cpu->cpu_index]) {
 455             case 0:
 456             case 1:
 457                 break; /* nothing to do here */
 458             case 's':
 459                 trace_gdbstub_op_stepping(cpu->cpu_index);
 460                 cpu_single_step(cpu, sstep_flags);
 461                 cpu_resume(cpu);
 462                 flag = 1;
 463                 break;
 464             case 'c':
 465                 trace_gdbstub_op_continue_cpu(cpu->cpu_index);
 466                 cpu_resume(cpu);
 467                 flag = 1;
 468                 break;
 469             default:
 470                 res = -1;
 471                 break;
 472             }
 473         }
 474     }
 475     if (flag) {
 476         qemu_clock_enable(QEMU_CLOCK_VIRTUAL, true);
 477     }
 478 #endif
 479     return res;
 480 }
 481
 482 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 483 {
 484 #ifdef CONFIG_USER_ONLY
 485     int ret;
 486
 487     while (len > 0) {
 488         ret = send(s->fd, buf, len, 0);
 489         if (ret < 0) {
 490             if (errno != EINTR)
 491                 return;
 492         } else {
 493             buf += ret;
 494             len -= ret;
 495         }
 496     }
 497 #else
 498     /* XXX this blocks entire thread. Rewrite to use
 499      * qemu_chr_fe_write and background I/O callbacks */
 500     qemu_chr_fe_write_all(&s->chr, buf, len);
 501 #endif
 502 }
 503
 504 static inline int fromhex(int v)
 505 {
 506     if (v >= '0' && v <= '9')
 507         return v - '0';
 508     else if (v >= 'A' && v <= 'F')
 509         return v - 'A' + 10;
 510     else if (v >= 'a' && v <= 'f')
 511         return v - 'a' + 10;
 512     else
 513         return 0;
 514 }
 515
 516 static inline int tohex(int v)
 517 {
 518     if (v < 10)
 519         return v + '0';
 520     else
 521         return v - 10 + 'a';
 522 }
 523
 524 /* writes 2*len+1 bytes in buf */
 525 static void memtohex(char *buf, const uint8_t *mem, int len)
 526 {
 527     int i, c;
 528     char *q;
 529     q = buf;
 530     for(i = 0; i < len; i++) {
 531         c = mem[i];
 532         *q++ = tohex(c >> 4);
 533         *q++ = tohex(c & 0xf);
 534     }
 535     *q = '\0';
 536 }
 537
 538 static void hextomem(uint8_t *mem, const char *buf, int len)
 539 {
 540     int i;
 541
 542     for(i = 0; i < len; i++) {
 543         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 544         buf += 2;
 545     }
 546 }
 547
 548 static void hexdump(const char *buf, int len,
 549                     void (*trace_fn)(size_t ofs, char const *text))
 550 {
 551     char line_buffer[3 * 16 + 4 + 16 + 1];
 552
 553     size_t i;
 554     for (i = 0; i < len || (i & 0xF); ++i) {
 555         size_t byte_ofs = i & 15;
 556
 557         if (byte_ofs == 0) {
 558             memset(line_buffer, ' ', 3 * 16 + 4 + 16);
 559             line_buffer[3 * 16 + 4 + 16] = 0;
 560         }
 561
 562         size_t col_group = (i >> 2) & 3;
 563         size_t hex_col = byte_ofs * 3 + col_group;
 564         size_t txt_col = 3 * 16 + 4 + byte_ofs;
 565
 566         if (i < len) {
 567             char value = buf[i];
 568
 569             line_buffer[hex_col + 0] = tohex((value >> 4) & 0xF);
 570             line_buffer[hex_col + 1] = tohex((value >> 0) & 0xF);
 571             line_buffer[txt_col + 0] = (value >= ' ' && value < 127)
 572                     ? value
 573                     : '.';
 574         }
 575
 576         if (byte_ofs == 0xF)
 577             trace_fn(i & -16, line_buffer);
 578     }
 579 }
 580
 581 /* return -1 if error, 0 if OK */
 582 static int put_packet_binary(GDBState *s, const char *buf, int len, bool dump)
 583 {
 584     int csum, i;
 585     uint8_t *p;
 586
 587     if (dump && trace_event_get_state_backends(TRACE_GDBSTUB_IO_BINARYREPLY)) {
 588         hexdump(buf, len, trace_gdbstub_io_binaryreply);
 589     }
 590
 591     for(;;) {
 592         p = s->last_packet;
 593         *(p++) = '$';
 594         memcpy(p, buf, len);
 595         p += len;
 596         csum = 0;
 597         for(i = 0; i < len; i++) {
 598             csum += buf[i];
 599         }
 600         *(p++) = '#';
 601         *(p++) = tohex((csum >> 4) & 0xf);
 602         *(p++) = tohex((csum) & 0xf);
 603
 604         s->last_packet_len = p - s->last_packet;
 605         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 606
 607 #ifdef CONFIG_USER_ONLY
 608         i = get_char(s);
 609         if (i < 0)
 610             return -1;
 611         if (i == '+')
 612             break;
 613 #else
 614         break;
 615 #endif
 616     }
 617     return 0;
 618 }
 619
 620 /* return -1 if error, 0 if OK */
 621 static int put_packet(GDBState *s, const char *buf)
 622 {
 623     trace_gdbstub_io_reply(buf);
 624
 625     return put_packet_binary(s, buf, strlen(buf), false);
 626 }
 627
 628 /* Encode data using the encoding for 'x' packets.  */
 629 static int memtox(char *buf, const char *mem, int len)
 630 {
 631     char *p = buf;
 632     char c;
 633
 634     while (len--) {
 635         c = *(mem++);
 636         switch (c) {
 637         case '#': case '$': case '*': case '}':
 638             *(p++) = '}';
 639             *(p++) = c ^ 0x20;
 640             break;
 641         default:
 642             *(p++) = c;
 643             break;
 644         }
 645     }
 646     return p - buf;
 647 }
 648
 649 static uint32_t gdb_get_cpu_pid(const GDBState *s, CPUState *cpu)
 650 {
 651     /* TODO: In user mode, we should use the task state PID */
 652     if (cpu->cluster_index == UNASSIGNED_CLUSTER_INDEX) {
 653         /* Return the default process' PID */
 654         return s->processes[s->process_num - 1].pid;
 655     }
 656     return cpu->cluster_index + 1;
 657 }
 658
 659 static GDBProcess *gdb_get_process(const GDBState *s, uint32_t pid)
 660 {
 661     int i;
 662
 663     if (!pid) {
 664         /* 0 means any process, we take the first one */
 665         return &s->processes[0];
 666     }
 667
 668     for (i = 0; i < s->process_num; i++) {
 669         if (s->processes[i].pid == pid) {
 670             return &s->processes[i];
 671         }
 672     }
 673
 674     return NULL;
 675 }
 676
 677 static GDBProcess *gdb_get_cpu_process(const GDBState *s, CPUState *cpu)
 678 {
 679     return gdb_get_process(s, gdb_get_cpu_pid(s, cpu));
 680 }
 681
 682 static CPUState *find_cpu(uint32_t thread_id)
 683 {
 684     CPUState *cpu;
 685
 686     CPU_FOREACH(cpu) {
 687         if (cpu_gdb_index(cpu) == thread_id) {
 688             return cpu;
 689         }
 690     }
 691
 692     return NULL;
 693 }
 694
 695 static CPUState *get_first_cpu_in_process(const GDBState *s,
 696                                           GDBProcess *process)
 697 {
 698     CPUState *cpu;
 699
 700     CPU_FOREACH(cpu) {
 701         if (gdb_get_cpu_pid(s, cpu) == process->pid) {
 702             return cpu;
 703         }
 704     }
 705
 706     return NULL;
 707 }
 708
 709 static CPUState *gdb_next_cpu_in_process(const GDBState *s, CPUState *cpu)
 710 {
 711     uint32_t pid = gdb_get_cpu_pid(s, cpu);
 712     cpu = CPU_NEXT(cpu);
 713
 714     while (cpu) {
 715         if (gdb_get_cpu_pid(s, cpu) == pid) {
 716             break;
 717         }
 718
 719         cpu = CPU_NEXT(cpu);
 720     }
 721
 722     return cpu;
 723 }
 724
 725 /* Return the cpu following @cpu, while ignoring unattached processes. */
 726 static CPUState *gdb_next_attached_cpu(const GDBState *s, CPUState *cpu)
 727 {
 728     cpu = CPU_NEXT(cpu);
 729
 730     while (cpu) {
 731         if (gdb_get_cpu_process(s, cpu)->attached) {
 732             break;
 733         }
 734
 735         cpu = CPU_NEXT(cpu);
 736     }
 737
 738     return cpu;
 739 }
 740
 741 /* Return the first attached cpu */
 742 static CPUState *gdb_first_attached_cpu(const GDBState *s)
 743 {
 744     CPUState *cpu = first_cpu;
 745     GDBProcess *process = gdb_get_cpu_process(s, cpu);
 746
 747     if (!process->attached) {
 748         return gdb_next_attached_cpu(s, cpu);
 749     }
 750
 751     return cpu;
 752 }
 753
 754 static CPUState *gdb_get_cpu(const GDBState *s, uint32_t pid, uint32_t tid)
 755 {
 756     GDBProcess *process;
 757     CPUState *cpu;
 758
 759     if (!pid && !tid) {
 760         /* 0 means any process/thread, we take the first attached one */
 761         return gdb_first_attached_cpu(s);
 762     } else if (pid && !tid) {
 763         /* any thread in a specific process */
 764         process = gdb_get_process(s, pid);
 765
 766         if (process == NULL) {
 767             return NULL;
 768         }
 769
 770         if (!process->attached) {
 771             return NULL;
 772         }
 773
 774         return get_first_cpu_in_process(s, process);
 775     } else {
 776         /* a specific thread */
 777         cpu = find_cpu(tid);
 778
 779         if (cpu == NULL) {
 780             return NULL;
 781         }
 782
 783         process = gdb_get_cpu_process(s, cpu);
 784
 785         if (pid && process->pid != pid) {
 786             return NULL;
 787         }
 788
 789         if (!process->attached) {
 790             return NULL;
 791         }
 792
 793         return cpu;
 794     }
 795 }
 796
 797 static const char *get_feature_xml(const GDBState *s, const char *p,
 798                                    const char **newp, GDBProcess *process)
 799 {
 800     size_t len;
 801     int i;
 802     const char *name;
 803     CPUState *cpu = get_first_cpu_in_process(s, process);
 804     CPUClass *cc = CPU_GET_CLASS(cpu);
 805
 806     len = 0;
 807     while (p[len] && p[len] != ':')
 808         len++;
 809     *newp = p + len;
 810
 811     name = NULL;
 812     if (strncmp(p, "target.xml", len) == 0) {
 813         char *buf = process->target_xml;
 814         const size_t buf_sz = sizeof(process->target_xml);
 815
 816         /* Generate the XML description for this CPU.  */
 817         if (!buf[0]) {
 818             GDBRegisterState *r;
 819
 820             pstrcat(buf, buf_sz,
 821                     "<?xml version=\"1.0\"?>"
 822                     "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
 823                     "<target>");
 824             if (cc->gdb_arch_name) {
 825                 gchar *arch = cc->gdb_arch_name(cpu);
 826                 pstrcat(buf, buf_sz, "<architecture>");
 827                 pstrcat(buf, buf_sz, arch);
 828                 pstrcat(buf, buf_sz, "</architecture>");
 829                 g_free(arch);
 830             }
 831             pstrcat(buf, buf_sz, "<xi:include href=\"");
 832             pstrcat(buf, buf_sz, cc->gdb_core_xml_file);
 833             pstrcat(buf, buf_sz, "\"/>");
 834             for (r = cpu->gdb_regs; r; r = r->next) {
 835                 pstrcat(buf, buf_sz, "<xi:include href=\"");
 836                 pstrcat(buf, buf_sz, r->xml);
 837                 pstrcat(buf, buf_sz, "\"/>");
 838             }
 839             pstrcat(buf, buf_sz, "</target>");
 840         }
 841         return buf;
 842     }
 843     if (cc->gdb_get_dynamic_xml) {
 844         char *xmlname = g_strndup(p, len);
 845         const char *xml = cc->gdb_get_dynamic_xml(cpu, xmlname);
 846
 847         g_free(xmlname);
 848         if (xml) {
 849             return xml;
 850         }
 851     }
 852     for (i = 0; ; i++) {
 853         name = xml_builtin[i][0];
 854         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
 855             break;
 856     }
 857     return name ? xml_builtin[i][1] : NULL;
 858 }
 859
 860 static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 861 {
 862     CPUClass *cc = CPU_GET_CLASS(cpu);
 863     CPUArchState *env = cpu->env_ptr;
 864     GDBRegisterState *r;
 865
 866     if (reg < cc->gdb_num_core_regs) {
 867         return cc->gdb_read_register(cpu, mem_buf, reg);
 868     }
 869
 870     for (r = cpu->gdb_regs; r; r = r->next) {
 871         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 872             return r->get_reg(env, mem_buf, reg - r->base_reg);
 873         }
 874     }
 875     return 0;
 876 }
 877
 878 static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 879 {
 880     CPUClass *cc = CPU_GET_CLASS(cpu);
 881     CPUArchState *env = cpu->env_ptr;
 882     GDBRegisterState *r;
 883
 884     if (reg < cc->gdb_num_core_regs) {
 885         return cc->gdb_write_register(cpu, mem_buf, reg);
 886     }
 887
 888     for (r = cpu->gdb_regs; r; r = r->next) {
 889         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
 890             return r->set_reg(env, mem_buf, reg - r->base_reg);
 891         }
 892     }
 893     return 0;
 894 }
 895
 896 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
 897    specifies the first register number and these registers are included in
 898    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
 899    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
 900  */
 901
 902 void gdb_register_coprocessor(CPUState *cpu,
 903                               gdb_reg_cb get_reg, gdb_reg_cb set_reg,
 904                               int num_regs, const char *xml, int g_pos)
 905 {
 906     GDBRegisterState *s;
 907     GDBRegisterState **p;
 908
 909     p = &cpu->gdb_regs;
 910     while (*p) {
 911         /* Check for duplicates.  */
 912         if (strcmp((*p)->xml, xml) == 0)
 913             return;
 914         p = &(*p)->next;
 915     }
 916
 917     s = g_new0(GDBRegisterState, 1);
 918     s->base_reg = cpu->gdb_num_regs;
 919     s->num_regs = num_regs;
 920     s->get_reg = get_reg;
 921     s->set_reg = set_reg;
 922     s->xml = xml;
 923
 924     /* Add to end of list.  */
 925     cpu->gdb_num_regs += num_regs;
 926     *p = s;
 927     if (g_pos) {
 928         if (g_pos != s->base_reg) {
 929             error_report("Error: Bad gdb register numbering for '%s', "
 930                          "expected %d got %d", xml, g_pos, s->base_reg);
 931         } else {
 932             cpu->gdb_num_g_regs = cpu->gdb_num_regs;
 933         }
 934     }
 935 }
 936
 937 #ifndef CONFIG_USER_ONLY
 938 /* Translate GDB watchpoint type to a flags value for cpu_watchpoint_* */
 939 static inline int xlat_gdb_type(CPUState *cpu, int gdbtype)
 940 {
 941     static const int xlat[] = {
 942         [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
 943         [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
 944         [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
 945     };
 946
 947     CPUClass *cc = CPU_GET_CLASS(cpu);
 948     int cputype = xlat[gdbtype];
 949
 950     if (cc->gdb_stop_before_watchpoint) {
 951         cputype |= BP_STOP_BEFORE_ACCESS;
 952     }
 953     return cputype;
 954 }
 955 #endif
 956
 957 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
 958 {
 959     CPUState *cpu;
 960     int err = 0;
 961
 962     if (kvm_enabled()) {
 963         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
 964     }
 965
 966     switch (type) {
 967     case GDB_BREAKPOINT_SW:
 968     case GDB_BREAKPOINT_HW:
 969         CPU_FOREACH(cpu) {
 970             err = cpu_breakpoint_insert(cpu, addr, BP_GDB, NULL);
 971             if (err) {
 972                 break;
 973             }
 974         }
 975         return err;
 976 #ifndef CONFIG_USER_ONLY
 977     case GDB_WATCHPOINT_WRITE:
 978     case GDB_WATCHPOINT_READ:
 979     case GDB_WATCHPOINT_ACCESS:
 980         CPU_FOREACH(cpu) {
 981             err = cpu_watchpoint_insert(cpu, addr, len,
 982                                         xlat_gdb_type(cpu, type), NULL);
 983             if (err) {
 984                 break;
 985             }
 986         }
 987         return err;
 988 #endif
 989     default:
 990         return -ENOSYS;
 991     }
 992 }
 993
 994 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
 995 {
 996     CPUState *cpu;
 997     int err = 0;
 998
 999     if (kvm_enabled()) {
1000         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1001     }
1002
1003     switch (type) {
1004     case GDB_BREAKPOINT_SW:
1005     case GDB_BREAKPOINT_HW:
1006         CPU_FOREACH(cpu) {
1007             err = cpu_breakpoint_remove(cpu, addr, BP_GDB);
1008             if (err) {
1009                 break;
1010             }
1011         }
1012         return err;
1013 #ifndef CONFIG_USER_ONLY
1014     case GDB_WATCHPOINT_WRITE:
1015     case GDB_WATCHPOINT_READ:
1016     case GDB_WATCHPOINT_ACCESS:
1017         CPU_FOREACH(cpu) {
1018             err = cpu_watchpoint_remove(cpu, addr, len,
1019                                         xlat_gdb_type(cpu, type));
1020             if (err)
1021                 break;
1022         }
1023         return err;
1024 #endif
1025     default:
1026         return -ENOSYS;
1027     }
1028 }
1029
1030 static inline void gdb_cpu_breakpoint_remove_all(CPUState *cpu)
1031 {
1032     cpu_breakpoint_remove_all(cpu, BP_GDB);
1033 #ifndef CONFIG_USER_ONLY
1034     cpu_watchpoint_remove_all(cpu, BP_GDB);
1035 #endif
1036 }
1037
1038 static void gdb_process_breakpoint_remove_all(const GDBState *s, GDBProcess *p)
1039 {
1040     CPUState *cpu = get_first_cpu_in_process(s, p);
1041
1042     while (cpu) {
1043         gdb_cpu_breakpoint_remove_all(cpu);
1044         cpu = gdb_next_cpu_in_process(s, cpu);
1045     }
1046 }
1047
1048 static void gdb_breakpoint_remove_all(void)
1049 {
1050     CPUState *cpu;
1051
1052     if (kvm_enabled()) {
1053         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1054         return;
1055     }
1056
1057     CPU_FOREACH(cpu) {
1058         gdb_cpu_breakpoint_remove_all(cpu);
1059     }
1060 }
1061
1062 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1063 {
1064     CPUState *cpu = s->c_cpu;
1065
1066     cpu_synchronize_state(cpu);
1067     cpu_set_pc(cpu, pc);
1068 }
1069
1070 static char *gdb_fmt_thread_id(const GDBState *s, CPUState *cpu,
1071                            char *buf, size_t buf_size)
1072 {
1073     if (s->multiprocess) {
1074         snprintf(buf, buf_size, "p%02x.%02x",
1075                  gdb_get_cpu_pid(s, cpu), cpu_gdb_index(cpu));
1076     } else {
1077         snprintf(buf, buf_size, "%02x", cpu_gdb_index(cpu));
1078     }
1079
1080     return buf;
1081 }
1082
1083 typedef enum GDBThreadIdKind {
1084     GDB_ONE_THREAD = 0,
1085     GDB_ALL_THREADS,     /* One process, all threads */
1086     GDB_ALL_PROCESSES,
1087     GDB_READ_THREAD_ERR
1088 } GDBThreadIdKind;
1089
1090 static GDBThreadIdKind read_thread_id(const char *buf, const char **end_buf,
1091                                       uint32_t *pid, uint32_t *tid)
1092 {
1093     unsigned long p, t;
1094     int ret;
1095
1096     if (*buf == 'p') {
1097         buf++;
1098         ret = qemu_strtoul(buf, &buf, 16, &p);
1099
1100         if (ret) {
1101             return GDB_READ_THREAD_ERR;
1102         }
1103
1104         /* Skip '.' */
1105         buf++;
1106     } else {
1107         p = 1;
1108     }
1109
1110     ret = qemu_strtoul(buf, &buf, 16, &t);
1111
1112     if (ret) {
1113         return GDB_READ_THREAD_ERR;
1114     }
1115
1116     *end_buf = buf;
1117
1118     if (p == -1) {
1119         return GDB_ALL_PROCESSES;
1120     }
1121
1122     if (pid) {
1123         *pid = p;
1124     }
1125
1126     if (t == -1) {
1127         return GDB_ALL_THREADS;
1128     }
1129
1130     if (tid) {
1131         *tid = t;
1132     }
1133
1134     return GDB_ONE_THREAD;
1135 }
1136
1137 static int is_query_packet(const char *p, const char *query, char separator)
1138 {
1139     unsigned int query_len = strlen(query);
1140
1141     return strncmp(p, query, query_len) == 0 &&
1142         (p[query_len] == '\0' || p[query_len] == separator);
1143 }
1144
1145 /**
1146  * gdb_handle_vcont - Parses and handles a vCont packet.
1147  * returns -ENOTSUP if a command is unsupported, -EINVAL or -ERANGE if there is
1148  *         a format error, 0 on success.
1149  */
1150 static int gdb_handle_vcont(GDBState *s, const char *p)
1151 {
1152     int res, signal = 0;
1153     char cur_action;
1154     char *newstates;
1155     unsigned long tmp;
1156     uint32_t pid, tid;
1157     GDBProcess *process;
1158     CPUState *cpu;
1159     GDBThreadIdKind kind;
1160 #ifdef CONFIG_USER_ONLY
1161     int max_cpus = 1; /* global variable max_cpus exists only in system mode */
1162
1163     CPU_FOREACH(cpu) {
1164         max_cpus = max_cpus <= cpu->cpu_index ? cpu->cpu_index + 1 : max_cpus;
1165     }
1166 #endif
1167     /* uninitialised CPUs stay 0 */
1168     newstates = g_new0(char, max_cpus);
1169
1170     /* mark valid CPUs with 1 */
1171     CPU_FOREACH(cpu) {
1172         newstates[cpu->cpu_index] = 1;
1173     }
1174
1175     /*
1176      * res keeps track of what error we are returning, with -ENOTSUP meaning
1177      * that the command is unknown or unsupported, thus returning an empty
1178      * packet, while -EINVAL and -ERANGE cause an E22 packet, due to invalid,
1179      *  or incorrect parameters passed.
1180      */
1181     res = 0;
1182     while (*p) {
1183         if (*p++ != ';') {
1184             res = -ENOTSUP;
1185             goto out;
1186         }
1187
1188         cur_action = *p++;
1189         if (cur_action == 'C' || cur_action == 'S') {
1190             cur_action = qemu_tolower(cur_action);
1191             res = qemu_strtoul(p + 1, &p, 16, &tmp);
1192             if (res) {
1193                 goto out;
1194             }
1195             signal = gdb_signal_to_target(tmp);
1196         } else if (cur_action != 'c' && cur_action != 's') {
1197             /* unknown/invalid/unsupported command */
1198             res = -ENOTSUP;
1199             goto out;
1200         }
1201
1202         if (*p == '\0' || *p == ';') {
1203             /*
1204              * No thread specifier, action is on "all threads". The
1205              * specification is unclear regarding the process to act on. We
1206              * choose all processes.
1207              */
1208             kind = GDB_ALL_PROCESSES;
1209         } else if (*p++ == ':') {
1210             kind = read_thread_id(p, &p, &pid, &tid);
1211         } else {
1212             res = -ENOTSUP;
1213             goto out;
1214         }
1215
1216         switch (kind) {
1217         case GDB_READ_THREAD_ERR:
1218             res = -EINVAL;
1219             goto out;
1220
1221         case GDB_ALL_PROCESSES:
1222             cpu = gdb_first_attached_cpu(s);
1223             while (cpu) {
1224                 if (newstates[cpu->cpu_index] == 1) {
1225                     newstates[cpu->cpu_index] = cur_action;
1226                 }
1227
1228                 cpu = gdb_next_attached_cpu(s, cpu);
1229             }
1230             break;
1231
1232         case GDB_ALL_THREADS:
1233             process = gdb_get_process(s, pid);
1234
1235             if (!process->attached) {
1236                 res = -EINVAL;
1237                 goto out;
1238             }
1239
1240             cpu = get_first_cpu_in_process(s, process);
1241             while (cpu) {
1242                 if (newstates[cpu->cpu_index] == 1) {
1243                     newstates[cpu->cpu_index] = cur_action;
1244                 }
1245
1246                 cpu = gdb_next_cpu_in_process(s, cpu);
1247             }
1248             break;
1249
1250         case GDB_ONE_THREAD:
1251             cpu = gdb_get_cpu(s, pid, tid);
1252
1253             /* invalid CPU/thread specified */
1254             if (!cpu) {
1255                 res = -EINVAL;
1256                 goto out;
1257             }
1258
1259             /* only use if no previous match occourred */
1260             if (newstates[cpu->cpu_index] == 1) {
1261                 newstates[cpu->cpu_index] = cur_action;
1262             }
1263             break;
1264         }
1265     }
1266     s->signal = signal;
1267     gdb_continue_partial(s, newstates);
1268
1269 out:
1270     g_free(newstates);
1271
1272     return res;
1273 }
1274
1275 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1276 {
1277     CPUState *cpu;
1278     GDBProcess *process;
1279     CPUClass *cc;
1280     const char *p;
1281     uint32_t pid, tid;
1282     int ch, reg_size, type, res;
1283     uint8_t mem_buf[MAX_PACKET_LENGTH];
1284     char buf[sizeof(mem_buf) + 1 /* trailing NUL */];
1285     char thread_id[16];
1286     uint8_t *registers;
1287     target_ulong addr, len;
1288     GDBThreadIdKind thread_kind;
1289
1290     trace_gdbstub_io_command(line_buf);
1291
1292     p = line_buf;
1293     ch = *p++;
1294     switch(ch) {
1295     case '!':
1296         put_packet(s, "OK");
1297         break;
1298     case '?':
1299         /* TODO: Make this return the correct value for user-mode.  */
1300         snprintf(buf, sizeof(buf), "T%02xthread:%s;", GDB_SIGNAL_TRAP,
1301                  gdb_fmt_thread_id(s, s->c_cpu, thread_id, sizeof(thread_id)));
1302         put_packet(s, buf);
1303         /* Remove all the breakpoints when this query is issued,
1304          * because gdb is doing and initial connect and the state
1305          * should be cleaned up.
1306          */
1307         gdb_breakpoint_remove_all();
1308         break;
1309     case 'c':
1310         if (*p != '\0') {
1311             addr = strtoull(p, (char **)&p, 16);
1312             gdb_set_cpu_pc(s, addr);
1313         }
1314         s->signal = 0;
1315         gdb_continue(s);
1316         return RS_IDLE;
1317     case 'C':
1318         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1319         if (s->signal == -1)
1320             s->signal = 0;
1321         gdb_continue(s);
1322         return RS_IDLE;
1323     case 'v':
1324         if (strncmp(p, "Cont", 4) == 0) {
1325             p += 4;
1326             if (*p == '?') {
1327                 put_packet(s, "vCont;c;C;s;S");
1328                 break;
1329             }
1330
1331             res = gdb_handle_vcont(s, p);
1332
1333             if (res) {
1334                 if ((res == -EINVAL) || (res == -ERANGE)) {
1335                     put_packet(s, "E22");
1336                     break;
1337                 }
1338                 goto unknown_command;
1339             }
1340             break;
1341         } else if (strncmp(p, "Attach;", 7) == 0) {
1342             unsigned long pid;
1343
1344             p += 7;
1345
1346             if (qemu_strtoul(p, &p, 16, &pid)) {
1347                 put_packet(s, "E22");
1348                 break;
1349             }
1350
1351             process = gdb_get_process(s, pid);
1352
1353             if (process == NULL) {
1354                 put_packet(s, "E22");
1355                 break;
1356             }
1357
1358             cpu = get_first_cpu_in_process(s, process);
1359
1360             if (cpu == NULL) {
1361                 /* Refuse to attach an empty process */
1362                 put_packet(s, "E22");
1363                 break;
1364             }
1365
1366             process->attached = true;
1367
1368             s->g_cpu = cpu;
1369             s->c_cpu = cpu;
1370
1371             snprintf(buf, sizeof(buf), "T%02xthread:%s;", GDB_SIGNAL_TRAP,
1372                      gdb_fmt_thread_id(s, cpu, thread_id, sizeof(thread_id)));
1373
1374             put_packet(s, buf);
1375             break;
1376         } else if (strncmp(p, "Kill;", 5) == 0) {
1377             /* Kill the target */
1378             put_packet(s, "OK");
1379             error_report("QEMU: Terminated via GDBstub");
1380             exit(0);
1381         } else {
1382             goto unknown_command;
1383         }
1384     case 'k':
1385         /* Kill the target */
1386         error_report("QEMU: Terminated via GDBstub");
1387         exit(0);
1388     case 'D':
1389         /* Detach packet */
1390         pid = 1;
1391
1392         if (s->multiprocess) {
1393             unsigned long lpid;
1394             if (*p != ';') {
1395                 put_packet(s, "E22");
1396                 break;
1397             }
1398
1399             if (qemu_strtoul(p + 1, &p, 16, &lpid)) {
1400                 put_packet(s, "E22");
1401                 break;
1402             }
1403
1404             pid = lpid;
1405         }
1406
1407         process = gdb_get_process(s, pid);
1408         gdb_process_breakpoint_remove_all(s, process);
1409         process->attached = false;
1410
1411         if (pid == gdb_get_cpu_pid(s, s->c_cpu)) {
1412             s->c_cpu = gdb_first_attached_cpu(s);
1413         }
1414
1415         if (pid == gdb_get_cpu_pid(s, s->g_cpu)) {
1416             s->g_cpu = gdb_first_attached_cpu(s);
1417         }
1418
1419         if (s->c_cpu == NULL) {
1420             /* No more process attached */
1421             gdb_syscall_mode = GDB_SYS_DISABLED;
1422             gdb_continue(s);
1423         }
1424         put_packet(s, "OK");
1425         break;
1426     case 's':
1427         if (*p != '\0') {
1428             addr = strtoull(p, (char **)&p, 16);
1429             gdb_set_cpu_pc(s, addr);
1430         }
1431         cpu_single_step(s->c_cpu, sstep_flags);
1432         gdb_continue(s);
1433         return RS_IDLE;
1434     case 'F':
1435         {
1436             target_ulong ret;
1437             target_ulong err;
1438
1439             ret = strtoull(p, (char **)&p, 16);
1440             if (*p == ',') {
1441                 p++;
1442                 err = strtoull(p, (char **)&p, 16);
1443             } else {
1444                 err = 0;
1445             }
1446             if (*p == ',')
1447                 p++;
1448             type = *p;
1449             if (s->current_syscall_cb) {
1450                 s->current_syscall_cb(s->c_cpu, ret, err);
1451                 s->current_syscall_cb = NULL;
1452             }
1453             if (type == 'C') {
1454                 put_packet(s, "T02");
1455             } else {
1456                 gdb_continue(s);
1457             }
1458         }
1459         break;
1460     case 'g':
1461         cpu_synchronize_state(s->g_cpu);
1462         len = 0;
1463         for (addr = 0; addr < s->g_cpu->gdb_num_g_regs; addr++) {
1464             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1465             len += reg_size;
1466         }
1467         memtohex(buf, mem_buf, len);
1468         put_packet(s, buf);
1469         break;
1470     case 'G':
1471         cpu_synchronize_state(s->g_cpu);
1472         registers = mem_buf;
1473         len = strlen(p) / 2;
1474         hextomem((uint8_t *)registers, p, len);
1475         for (addr = 0; addr < s->g_cpu->gdb_num_g_regs && len > 0; addr++) {
1476             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1477             len -= reg_size;
1478             registers += reg_size;
1479         }
1480         put_packet(s, "OK");
1481         break;
1482     case 'm':
1483         addr = strtoull(p, (char **)&p, 16);
1484         if (*p == ',')
1485             p++;
1486         len = strtoull(p, NULL, 16);
1487
1488         /* memtohex() doubles the required space */
1489         if (len > MAX_PACKET_LENGTH / 2) {
1490             put_packet (s, "E22");
1491             break;
1492         }
1493
1494         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
1495             put_packet (s, "E14");
1496         } else {
1497             memtohex(buf, mem_buf, len);
1498             put_packet(s, buf);
1499         }
1500         break;
1501     case 'M':
1502         addr = strtoull(p, (char **)&p, 16);
1503         if (*p == ',')
1504             p++;
1505         len = strtoull(p, (char **)&p, 16);
1506         if (*p == ':')
1507             p++;
1508
1509         /* hextomem() reads 2*len bytes */
1510         if (len > strlen(p) / 2) {
1511             put_packet (s, "E22");
1512             break;
1513         }
1514         hextomem(mem_buf, p, len);
1515         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
1516                                    true) != 0) {
1517             put_packet(s, "E14");
1518         } else {
1519             put_packet(s, "OK");
1520         }
1521         break;
1522     case 'p':
1523         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1524            This works, but can be very slow.  Anything new enough to
1525            understand XML also knows how to use this properly.  */
1526         if (!gdb_has_xml)
1527             goto unknown_command;
1528         addr = strtoull(p, (char **)&p, 16);
1529         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1530         if (reg_size) {
1531             memtohex(buf, mem_buf, reg_size);
1532             put_packet(s, buf);
1533         } else {
1534             put_packet(s, "E14");
1535         }
1536         break;
1537     case 'P':
1538         if (!gdb_has_xml)
1539             goto unknown_command;
1540         addr = strtoull(p, (char **)&p, 16);
1541         if (*p == '=')
1542             p++;
1543         reg_size = strlen(p) / 2;
1544         hextomem(mem_buf, p, reg_size);
1545         gdb_write_register(s->g_cpu, mem_buf, addr);
1546         put_packet(s, "OK");
1547         break;
1548     case 'Z':
1549     case 'z':
1550         type = strtoul(p, (char **)&p, 16);
1551         if (*p == ',')
1552             p++;
1553         addr = strtoull(p, (char **)&p, 16);
1554         if (*p == ',')
1555             p++;
1556         len = strtoull(p, (char **)&p, 16);
1557         if (ch == 'Z')
1558             res = gdb_breakpoint_insert(addr, len, type);
1559         else
1560             res = gdb_breakpoint_remove(addr, len, type);
1561         if (res >= 0)
1562              put_packet(s, "OK");
1563         else if (res == -ENOSYS)
1564             put_packet(s, "");
1565         else
1566             put_packet(s, "E22");
1567         break;
1568     case 'H':
1569         type = *p++;
1570
1571         thread_kind = read_thread_id(p, &p, &pid, &tid);
1572         if (thread_kind == GDB_READ_THREAD_ERR) {
1573             put_packet(s, "E22");
1574             break;
1575         }
1576
1577         if (thread_kind != GDB_ONE_THREAD) {
1578             put_packet(s, "OK");
1579             break;
1580         }
1581         cpu = gdb_get_cpu(s, pid, tid);
1582         if (cpu == NULL) {
1583             put_packet(s, "E22");
1584             break;
1585         }
1586         switch (type) {
1587         case 'c':
1588             s->c_cpu = cpu;
1589             put_packet(s, "OK");
1590             break;
1591         case 'g':
1592             s->g_cpu = cpu;
1593             put_packet(s, "OK");
1594             break;
1595         default:
1596              put_packet(s, "E22");
1597              break;
1598         }
1599         break;
1600     case 'T':
1601         thread_kind = read_thread_id(p, &p, &pid, &tid);
1602         if (thread_kind == GDB_READ_THREAD_ERR) {
1603             put_packet(s, "E22");
1604             break;
1605         }
1606         cpu = gdb_get_cpu(s, pid, tid);
1607
1608         if (cpu != NULL) {
1609             put_packet(s, "OK");
1610         } else {
1611             put_packet(s, "E22");
1612         }
1613         break;
1614     case 'q':
1615     case 'Q':
1616         /* parse any 'q' packets here */
1617         if (!strcmp(p,"qemu.sstepbits")) {
1618             /* Query Breakpoint bit definitions */
1619             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1620                      SSTEP_ENABLE,
1621                      SSTEP_NOIRQ,
1622                      SSTEP_NOTIMER);
1623             put_packet(s, buf);
1624             break;
1625         } else if (is_query_packet(p, "qemu.sstep", '=')) {
1626             /* Display or change the sstep_flags */
1627             p += 10;
1628             if (*p != '=') {
1629                 /* Display current setting */
1630                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1631                 put_packet(s, buf);
1632                 break;
1633             }
1634             p++;
1635             type = strtoul(p, (char **)&p, 16);
1636             sstep_flags = type;
1637             put_packet(s, "OK");
1638             break;
1639         } else if (strcmp(p,"C") == 0) {
1640             /*
1641              * "Current thread" remains vague in the spec, so always return
1642              * the first thread of the current process (gdb returns the
1643              * first thread).
1644              */
1645             cpu = get_first_cpu_in_process(s, gdb_get_cpu_process(s, s->g_cpu));
1646             snprintf(buf, sizeof(buf), "QC%s",
1647                      gdb_fmt_thread_id(s, cpu, thread_id, sizeof(thread_id)));
1648             put_packet(s, buf);
1649             break;
1650         } else if (strcmp(p,"fThreadInfo") == 0) {
1651             s->query_cpu = gdb_first_attached_cpu(s);
1652             goto report_cpuinfo;
1653         } else if (strcmp(p,"sThreadInfo") == 0) {
1654         report_cpuinfo:
1655             if (s->query_cpu) {
1656                 snprintf(buf, sizeof(buf), "m%s",
1657                          gdb_fmt_thread_id(s, s->query_cpu,
1658                                        thread_id, sizeof(thread_id)));
1659                 put_packet(s, buf);
1660                 s->query_cpu = gdb_next_attached_cpu(s, s->query_cpu);
1661             } else
1662                 put_packet(s, "l");
1663             break;
1664         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1665             if (read_thread_id(p + 16, &p, &pid, &tid) == GDB_READ_THREAD_ERR) {
1666                 put_packet(s, "E22");
1667                 break;
1668             }
1669             cpu = gdb_get_cpu(s, pid, tid);
1670             if (cpu != NULL) {
1671                 cpu_synchronize_state(cpu);
1672
1673                 if (s->multiprocess && (s->process_num > 1)) {
1674                     /* Print the CPU model and name in multiprocess mode */
1675                     ObjectClass *oc = object_get_class(OBJECT(cpu));
1676                     const char *cpu_model = object_class_get_name(oc);
1677                     char *cpu_name =
1678                         object_get_canonical_path_component(OBJECT(cpu));
1679                     len = snprintf((char *)mem_buf, sizeof(buf) / 2,
1680                                    "%s %s [%s]", cpu_model, cpu_name,
1681                                    cpu->halted ? "halted " : "running");
1682                     g_free(cpu_name);
1683                 } else {
1684                     /* memtohex() doubles the required space */
1685                     len = snprintf((char *)mem_buf, sizeof(buf) / 2,
1686                                    "CPU#%d [%s]", cpu->cpu_index,
1687                                    cpu->halted ? "halted " : "running");
1688                 }
1689                 trace_gdbstub_op_extra_info((char *)mem_buf);
1690                 memtohex(buf, mem_buf, len);
1691                 put_packet(s, buf);
1692             }
1693             break;
1694         }
1695 #ifdef CONFIG_USER_ONLY
1696         else if (strcmp(p, "Offsets") == 0) {
1697             TaskState *ts = s->c_cpu->opaque;
1698
1699             snprintf(buf, sizeof(buf),
1700                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1701                      ";Bss=" TARGET_ABI_FMT_lx,
1702                      ts->info->code_offset,
1703                      ts->info->data_offset,
1704                      ts->info->data_offset);
1705             put_packet(s, buf);
1706             break;
1707         }
1708 #else /* !CONFIG_USER_ONLY */
1709         else if (strncmp(p, "Rcmd,", 5) == 0) {
1710             int len = strlen(p + 5);
1711
1712             if ((len % 2) != 0) {
1713                 put_packet(s, "E01");
1714                 break;
1715             }
1716             len = len / 2;
1717             hextomem(mem_buf, p + 5, len);
1718             mem_buf[len++] = 0;
1719             qemu_chr_be_write(s->mon_chr, mem_buf, len);
1720             put_packet(s, "OK");
1721             break;
1722         }
1723 #endif /* !CONFIG_USER_ONLY */
1724         if (is_query_packet(p, "Supported", ':')) {
1725             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1726             cc = CPU_GET_CLASS(first_cpu);
1727             if (cc->gdb_core_xml_file != NULL) {
1728                 pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1729             }
1730
1731             if (strstr(p, "multiprocess+")) {
1732                 s->multiprocess = true;
1733             }
1734             pstrcat(buf, sizeof(buf), ";multiprocess+");
1735
1736             put_packet(s, buf);
1737             break;
1738         }
1739         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1740             const char *xml;
1741             target_ulong total_len;
1742
1743             process = gdb_get_cpu_process(s, s->g_cpu);
1744             cc = CPU_GET_CLASS(s->g_cpu);
1745             if (cc->gdb_core_xml_file == NULL) {
1746                 goto unknown_command;
1747             }
1748
1749             gdb_has_xml = true;
1750             p += 19;
1751             xml = get_feature_xml(s, p, &p, process);
1752             if (!xml) {
1753                 snprintf(buf, sizeof(buf), "E00");
1754                 put_packet(s, buf);
1755                 break;
1756             }
1757
1758             if (*p == ':')
1759                 p++;
1760             addr = strtoul(p, (char **)&p, 16);
1761             if (*p == ',')
1762                 p++;
1763             len = strtoul(p, (char **)&p, 16);
1764
1765             total_len = strlen(xml);
1766             if (addr > total_len) {
1767                 snprintf(buf, sizeof(buf), "E00");
1768                 put_packet(s, buf);
1769                 break;
1770             }
1771             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1772                 len = (MAX_PACKET_LENGTH - 5) / 2;
1773             if (len < total_len - addr) {
1774                 buf[0] = 'm';
1775                 len = memtox(buf + 1, xml + addr, len);
1776             } else {
1777                 buf[0] = 'l';
1778                 len = memtox(buf + 1, xml + addr, total_len - addr);
1779             }
1780             put_packet_binary(s, buf, len + 1, true);
1781             break;
1782         }
1783         if (is_query_packet(p, "Attached", ':')) {
1784             put_packet(s, GDB_ATTACHED);
1785             break;
1786         }
1787         /* Unrecognised 'q' command.  */
1788         goto unknown_command;
1789
1790     default:
1791     unknown_command:
1792         /* put empty packet */
1793         buf[0] = '\0';
1794         put_packet(s, buf);
1795         break;
1796     }
1797     return RS_IDLE;
1798 }
1799
1800 void gdb_set_stop_cpu(CPUState *cpu)
1801 {
1802     GDBProcess *p = gdb_get_cpu_process(gdbserver_state, cpu);
1803
1804     if (!p->attached) {
1805         /*
1806          * Having a stop CPU corresponding to a process that is not attached
1807          * confuses GDB. So we ignore the request.
1808          */
1809         return;
1810     }
1811
1812     gdbserver_state->c_cpu = cpu;
1813     gdbserver_state->g_cpu = cpu;
1814 }
1815
1816 #ifndef CONFIG_USER_ONLY
1817 static void gdb_vm_state_change(void *opaque, int running, RunState state)
1818 {
1819     GDBState *s = gdbserver_state;
1820     CPUState *cpu = s->c_cpu;
1821     char buf[256];
1822     char thread_id[16];
1823     const char *type;
1824     int ret;
1825
1826     if (running || s->state == RS_INACTIVE) {
1827         return;
1828     }
1829     /* Is there a GDB syscall waiting to be sent?  */
1830     if (s->current_syscall_cb) {
1831         put_packet(s, s->syscall_buf);
1832         return;
1833     }
1834
1835     if (cpu == NULL) {
1836         /* No process attached */
1837         return;
1838     }
1839
1840     gdb_fmt_thread_id(s, cpu, thread_id, sizeof(thread_id));
1841
1842     switch (state) {
1843     case RUN_STATE_DEBUG:
1844         if (cpu->watchpoint_hit) {
1845             switch (cpu->watchpoint_hit->flags & BP_MEM_ACCESS) {
1846             case BP_MEM_READ:
1847                 type = "r";
1848                 break;
1849             case BP_MEM_ACCESS:
1850                 type = "a";
1851                 break;
1852             default:
1853                 type = "";
1854                 break;
1855             }
1856             trace_gdbstub_hit_watchpoint(type, cpu_gdb_index(cpu),
1857                     (target_ulong)cpu->watchpoint_hit->vaddr);
1858             snprintf(buf, sizeof(buf),
1859                      "T%02xthread:%s;%swatch:" TARGET_FMT_lx ";",
1860                      GDB_SIGNAL_TRAP, thread_id, type,
1861                      (target_ulong)cpu->watchpoint_hit->vaddr);
1862             cpu->watchpoint_hit = NULL;
1863             goto send_packet;
1864         } else {
1865             trace_gdbstub_hit_break();
1866         }
1867         tb_flush(cpu);
1868         ret = GDB_SIGNAL_TRAP;
1869         break;
1870     case RUN_STATE_PAUSED:
1871         trace_gdbstub_hit_paused();
1872         ret = GDB_SIGNAL_INT;
1873         break;
1874     case RUN_STATE_SHUTDOWN:
1875         trace_gdbstub_hit_shutdown();
1876         ret = GDB_SIGNAL_QUIT;
1877         break;
1878     case RUN_STATE_IO_ERROR:
1879         trace_gdbstub_hit_io_error();
1880         ret = GDB_SIGNAL_IO;
1881         break;
1882     case RUN_STATE_WATCHDOG:
1883         trace_gdbstub_hit_watchdog();
1884         ret = GDB_SIGNAL_ALRM;
1885         break;
1886     case RUN_STATE_INTERNAL_ERROR:
1887         trace_gdbstub_hit_internal_error();
1888         ret = GDB_SIGNAL_ABRT;
1889         break;
1890     case RUN_STATE_SAVE_VM:
1891     case RUN_STATE_RESTORE_VM:
1892         return;
1893     case RUN_STATE_FINISH_MIGRATE:
1894         ret = GDB_SIGNAL_XCPU;
1895         break;
1896     default:
1897         trace_gdbstub_hit_unknown(state);
1898         ret = GDB_SIGNAL_UNKNOWN;
1899         break;
1900     }
1901     gdb_set_stop_cpu(cpu);
1902     snprintf(buf, sizeof(buf), "T%02xthread:%s;", ret, thread_id);
1903
1904 send_packet:
1905     put_packet(s, buf);
1906
1907     /* disable single step if it was enabled */
1908     cpu_single_step(cpu, 0);
1909 }
1910 #endif
1911
1912 /* Send a gdb syscall request.
1913    This accepts limited printf-style format specifiers, specifically:
1914     %x  - target_ulong argument printed in hex.
1915     %lx - 64-bit argument printed in hex.
1916     %s  - string pointer (target_ulong) and length (int) pair.  */
1917 void gdb_do_syscallv(gdb_syscall_complete_cb cb, const char *fmt, va_list va)
1918 {
1919     char *p;
1920     char *p_end;
1921     target_ulong addr;
1922     uint64_t i64;
1923     GDBState *s;
1924
1925     s = gdbserver_state;
1926     if (!s)
1927         return;
1928     s->current_syscall_cb = cb;
1929 #ifndef CONFIG_USER_ONLY
1930     vm_stop(RUN_STATE_DEBUG);
1931 #endif
1932     p = s->syscall_buf;
1933     p_end = &s->syscall_buf[sizeof(s->syscall_buf)];
1934     *(p++) = 'F';
1935     while (*fmt) {
1936         if (*fmt == '%') {
1937             fmt++;
1938             switch (*fmt++) {
1939             case 'x':
1940                 addr = va_arg(va, target_ulong);
1941                 p += snprintf(p, p_end - p, TARGET_FMT_lx, addr);
1942                 break;
1943             case 'l':
1944                 if (*(fmt++) != 'x')
1945                     goto bad_format;
1946                 i64 = va_arg(va, uint64_t);
1947                 p += snprintf(p, p_end - p, "%" PRIx64, i64);
1948                 break;
1949             case 's':
1950                 addr = va_arg(va, target_ulong);
1951                 p += snprintf(p, p_end - p, TARGET_FMT_lx "/%x",
1952                               addr, va_arg(va, int));
1953                 break;
1954             default:
1955             bad_format:
1956                 error_report("gdbstub: Bad syscall format string '%s'",
1957                              fmt - 1);
1958                 break;
1959             }
1960         } else {
1961             *(p++) = *(fmt++);
1962         }
1963     }
1964     *p = 0;
1965 #ifdef CONFIG_USER_ONLY
1966     put_packet(s, s->syscall_buf);
1967     /* Return control to gdb for it to process the syscall request.
1968      * Since the protocol requires that gdb hands control back to us
1969      * using a "here are the results" F packet, we don't need to check
1970      * gdb_handlesig's return value (which is the signal to deliver if
1971      * execution was resumed via a continue packet).
1972      */
1973     gdb_handlesig(s->c_cpu, 0);
1974 #else
1975     /* In this case wait to send the syscall packet until notification that
1976        the CPU has stopped.  This must be done because if the packet is sent
1977        now the reply from the syscall request could be received while the CPU
1978        is still in the running state, which can cause packets to be dropped
1979        and state transition 'T' packets to be sent while the syscall is still
1980        being processed.  */
1981     qemu_cpu_kick(s->c_cpu);
1982 #endif
1983 }
1984
1985 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1986 {
1987     va_list va;
1988
1989     va_start(va, fmt);
1990     gdb_do_syscallv(cb, fmt, va);
1991     va_end(va);
1992 }
1993
1994 static void gdb_read_byte(GDBState *s, uint8_t ch)
1995 {
1996     uint8_t reply;
1997
1998 #ifndef CONFIG_USER_ONLY
1999     if (s->last_packet_len) {
2000         /* Waiting for a response to the last packet.  If we see the start
2001            of a new command then abandon the previous response.  */
2002         if (ch == '-') {
2003             trace_gdbstub_err_got_nack();
2004             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2005         } else if (ch == '+') {
2006             trace_gdbstub_io_got_ack();
2007         } else {
2008             trace_gdbstub_io_got_unexpected(ch);
2009         }
2010
2011         if (ch == '+' || ch == '$')
2012             s->last_packet_len = 0;
2013         if (ch != '$')
2014             return;
2015     }
2016     if (runstate_is_running()) {
2017         /* when the CPU is running, we cannot do anything except stop
2018            it when receiving a char */
2019         vm_stop(RUN_STATE_PAUSED);
2020     } else
2021 #endif
2022     {
2023         switch(s->state) {
2024         case RS_IDLE:
2025             if (ch == '$') {
2026                 /* start of command packet */
2027                 s->line_buf_index = 0;
2028                 s->line_sum = 0;
2029                 s->state = RS_GETLINE;
2030             } else {
2031                 trace_gdbstub_err_garbage(ch);
2032             }
2033             break;
2034         case RS_GETLINE:
2035             if (ch == '}') {
2036                 /* start escape sequence */
2037                 s->state = RS_GETLINE_ESC;
2038                 s->line_sum += ch;
2039             } else if (ch == '*') {
2040                 /* start run length encoding sequence */
2041                 s->state = RS_GETLINE_RLE;
2042                 s->line_sum += ch;
2043             } else if (ch == '#') {
2044                 /* end of command, start of checksum*/
2045                 s->state = RS_CHKSUM1;
2046             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2047                 trace_gdbstub_err_overrun();
2048                 s->state = RS_IDLE;
2049             } else {
2050                 /* unescaped command character */
2051                 s->line_buf[s->line_buf_index++] = ch;
2052                 s->line_sum += ch;
2053             }
2054             break;
2055         case RS_GETLINE_ESC:
2056             if (ch == '#') {
2057                 /* unexpected end of command in escape sequence */
2058                 s->state = RS_CHKSUM1;
2059             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2060                 /* command buffer overrun */
2061                 trace_gdbstub_err_overrun();
2062                 s->state = RS_IDLE;
2063             } else {
2064                 /* parse escaped character and leave escape state */
2065                 s->line_buf[s->line_buf_index++] = ch ^ 0x20;
2066                 s->line_sum += ch;
2067                 s->state = RS_GETLINE;
2068             }
2069             break;
2070         case RS_GETLINE_RLE:
2071             /*
2072              * Run-length encoding is explained in "Debugging with GDB /
2073              * Appendix E GDB Remote Serial Protocol / Overview".
2074              */
2075             if (ch < ' ' || ch == '#' || ch == '$' || ch > 126) {
2076                 /* invalid RLE count encoding */
2077                 trace_gdbstub_err_invalid_repeat(ch);
2078                 s->state = RS_GETLINE;
2079             } else {
2080                 /* decode repeat length */
2081                 int repeat = ch - ' ' + 3;
2082                 if (s->line_buf_index + repeat >= sizeof(s->line_buf) - 1) {
2083                     /* that many repeats would overrun the command buffer */
2084                     trace_gdbstub_err_overrun();
2085                     s->state = RS_IDLE;
2086                 } else if (s->line_buf_index < 1) {
2087                     /* got a repeat but we have nothing to repeat */
2088                     trace_gdbstub_err_invalid_rle();
2089                     s->state = RS_GETLINE;
2090                 } else {
2091                     /* repeat the last character */
2092                     memset(s->line_buf + s->line_buf_index,
2093                            s->line_buf[s->line_buf_index - 1], repeat);
2094                     s->line_buf_index += repeat;
2095                     s->line_sum += ch;
2096                     s->state = RS_GETLINE;
2097                 }
2098             }
2099             break;
2100         case RS_CHKSUM1:
2101             /* get high hex digit of checksum */
2102             if (!isxdigit(ch)) {
2103                 trace_gdbstub_err_checksum_invalid(ch);
2104                 s->state = RS_GETLINE;
2105                 break;
2106             }
2107             s->line_buf[s->line_buf_index] = '\0';
2108             s->line_csum = fromhex(ch) << 4;
2109             s->state = RS_CHKSUM2;
2110             break;
2111         case RS_CHKSUM2:
2112             /* get low hex digit of checksum */
2113             if (!isxdigit(ch)) {
2114                 trace_gdbstub_err_checksum_invalid(ch);
2115                 s->state = RS_GETLINE;
2116                 break;
2117             }
2118             s->line_csum |= fromhex(ch);
2119
2120             if (s->line_csum != (s->line_sum & 0xff)) {
2121                 trace_gdbstub_err_checksum_incorrect(s->line_sum, s->line_csum);
2122                 /* send NAK reply */
2123                 reply = '-';
2124                 put_buffer(s, &reply, 1);
2125                 s->state = RS_IDLE;
2126             } else {
2127                 /* send ACK reply */
2128                 reply = '+';
2129                 put_buffer(s, &reply, 1);
2130                 s->state = gdb_handle_packet(s, s->line_buf);
2131             }
2132             break;
2133         default:
2134             abort();
2135         }
2136     }
2137 }
2138
2139 /* Tell the remote gdb that the process has exited.  */
2140 void gdb_exit(CPUArchState *env, int code)
2141 {
2142   GDBState *s;
2143   char buf[4];
2144
2145   s = gdbserver_state;
2146   if (!s) {
2147       return;
2148   }
2149 #ifdef CONFIG_USER_ONLY
2150   if (gdbserver_fd < 0 || s->fd < 0) {
2151       return;
2152   }
2153 #endif
2154
2155   trace_gdbstub_op_exiting((uint8_t)code);
2156
2157   snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
2158   put_packet(s, buf);
2159
2160 #ifndef CONFIG_USER_ONLY
2161   qemu_chr_fe_deinit(&s->chr, true);
2162 #endif
2163 }
2164
2165 /*
2166  * Create the process that will contain all the "orphan" CPUs (that are not
2167  * part of a CPU cluster). Note that if this process contains no CPUs, it won't
2168  * be attachable and thus will be invisible to the user.
2169  */
2170 static void create_default_process(GDBState *s)
2171 {
2172     GDBProcess *process;
2173     int max_pid = 0;
2174
2175     if (s->process_num) {
2176         max_pid = s->processes[s->process_num - 1].pid;
2177     }
2178
2179     s->processes = g_renew(GDBProcess, s->processes, ++s->process_num);
2180     process = &s->processes[s->process_num - 1];
2181
2182     /* We need an available PID slot for this process */
2183     assert(max_pid < UINT32_MAX);
2184
2185     process->pid = max_pid + 1;
2186     process->attached = false;
2187     process->target_xml[0] = '\0';
2188 }
2189
2190 #ifdef CONFIG_USER_ONLY
2191 int
2192 gdb_handlesig(CPUState *cpu, int sig)
2193 {
2194     GDBState *s;
2195     char buf[256];
2196     int n;
2197
2198     s = gdbserver_state;
2199     if (gdbserver_fd < 0 || s->fd < 0) {
2200         return sig;
2201     }
2202
2203     /* disable single step if it was enabled */
2204     cpu_single_step(cpu, 0);
2205     tb_flush(cpu);
2206
2207     if (sig != 0) {
2208         snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));
2209         put_packet(s, buf);
2210     }
2211     /* put_packet() might have detected that the peer terminated the
2212        connection.  */
2213     if (s->fd < 0) {
2214         return sig;
2215     }
2216
2217     sig = 0;
2218     s->state = RS_IDLE;
2219     s->running_state = 0;
2220     while (s->running_state == 0) {
2221         n = read(s->fd, buf, 256);
2222         if (n > 0) {
2223             int i;
2224
2225             for (i = 0; i < n; i++) {
2226                 gdb_read_byte(s, buf[i]);
2227             }
2228         } else {
2229             /* XXX: Connection closed.  Should probably wait for another
2230                connection before continuing.  */
2231             if (n == 0) {
2232                 close(s->fd);
2233             }
2234             s->fd = -1;
2235             return sig;
2236         }
2237     }
2238     sig = s->signal;
2239     s->signal = 0;
2240     return sig;
2241 }
2242
2243 /* Tell the remote gdb that the process has exited due to SIG.  */
2244 void gdb_signalled(CPUArchState *env, int sig)
2245 {
2246     GDBState *s;
2247     char buf[4];
2248
2249     s = gdbserver_state;
2250     if (gdbserver_fd < 0 || s->fd < 0) {
2251         return;
2252     }
2253
2254     snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb(sig));
2255     put_packet(s, buf);
2256 }
2257
2258 static bool gdb_accept(void)
2259 {
2260     GDBState *s;
2261     struct sockaddr_in sockaddr;
2262     socklen_t len;
2263     int fd;
2264
2265     for(;;) {
2266         len = sizeof(sockaddr);
2267         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2268         if (fd < 0 && errno != EINTR) {
2269             perror("accept");
2270             return false;
2271         } else if (fd >= 0) {
2272             qemu_set_cloexec(fd);
2273             break;
2274         }
2275     }
2276
2277     /* set short latency */
2278     if (socket_set_nodelay(fd)) {
2279         perror("setsockopt");
2280         close(fd);
2281         return false;
2282     }
2283
2284     s = g_malloc0(sizeof(GDBState));
2285     create_default_process(s);
2286     s->processes[0].attached = true;
2287     s->c_cpu = gdb_first_attached_cpu(s);
2288     s->g_cpu = s->c_cpu;
2289     s->fd = fd;
2290     gdb_has_xml = false;
2291
2292     gdbserver_state = s;
2293     return true;
2294 }
2295
2296 static int gdbserver_open(int port)
2297 {
2298     struct sockaddr_in sockaddr;
2299     int fd, ret;
2300
2301     fd = socket(PF_INET, SOCK_STREAM, 0);
2302     if (fd < 0) {
2303         perror("socket");
2304         return -1;
2305     }
2306     qemu_set_cloexec(fd);
2307
2308     socket_set_fast_reuse(fd);
2309
2310     sockaddr.sin_family = AF_INET;
2311     sockaddr.sin_port = htons(port);
2312     sockaddr.sin_addr.s_addr = 0;
2313     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2314     if (ret < 0) {
2315         perror("bind");
2316         close(fd);
2317         return -1;
2318     }
2319     ret = listen(fd, 1);
2320     if (ret < 0) {
2321         perror("listen");
2322         close(fd);
2323         return -1;
2324     }
2325     return fd;
2326 }
2327
2328 int gdbserver_start(int port)
2329 {
2330     gdbserver_fd = gdbserver_open(port);
2331     if (gdbserver_fd < 0)
2332         return -1;
2333     /* accept connections */
2334     if (!gdb_accept()) {
2335         close(gdbserver_fd);
2336         gdbserver_fd = -1;
2337         return -1;
2338     }
2339     return 0;
2340 }
2341
2342 /* Disable gdb stub for child processes.  */
2343 void gdbserver_fork(CPUState *cpu)
2344 {
2345     GDBState *s = gdbserver_state;
2346
2347     if (gdbserver_fd < 0 || s->fd < 0) {
2348         return;
2349     }
2350     close(s->fd);
2351     s->fd = -1;
2352     cpu_breakpoint_remove_all(cpu, BP_GDB);
2353     cpu_watchpoint_remove_all(cpu, BP_GDB);
2354 }
2355 #else
2356 static int gdb_chr_can_receive(void *opaque)
2357 {
2358   /* We can handle an arbitrarily large amount of data.
2359    Pick the maximum packet size, which is as good as anything.  */
2360   return MAX_PACKET_LENGTH;
2361 }
2362
2363 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2364 {
2365     int i;
2366
2367     for (i = 0; i < size; i++) {
2368         gdb_read_byte(gdbserver_state, buf[i]);
2369     }
2370 }
2371
2372 static void gdb_chr_event(void *opaque, int event)
2373 {
2374     int i;
2375     GDBState *s = (GDBState *) opaque;
2376
2377     switch (event) {
2378     case CHR_EVENT_OPENED:
2379         /* Start with first process attached, others detached */
2380         for (i = 0; i < s->process_num; i++) {
2381             s->processes[i].attached = !i;
2382         }
2383
2384         s->c_cpu = gdb_first_attached_cpu(s);
2385         s->g_cpu = s->c_cpu;
2386
2387         vm_stop(RUN_STATE_PAUSED);
2388         gdb_has_xml = false;
2389         break;
2390     default:
2391         break;
2392     }
2393 }
2394
2395 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2396 {
2397     char buf[MAX_PACKET_LENGTH];
2398
2399     buf[0] = 'O';
2400     if (len > (MAX_PACKET_LENGTH/2) - 1)
2401         len = (MAX_PACKET_LENGTH/2) - 1;
2402     memtohex(buf + 1, (uint8_t *)msg, len);
2403     put_packet(s, buf);
2404 }
2405
2406 static int gdb_monitor_write(Chardev *chr, const uint8_t *buf, int len)
2407 {
2408     const char *p = (const char *)buf;
2409     int max_sz;
2410
2411     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2412     for (;;) {
2413         if (len <= max_sz) {
2414             gdb_monitor_output(gdbserver_state, p, len);
2415             break;
2416         }
2417         gdb_monitor_output(gdbserver_state, p, max_sz);
2418         p += max_sz;
2419         len -= max_sz;
2420     }
2421     return len;
2422 }
2423
2424 #ifndef _WIN32
2425 static void gdb_sigterm_handler(int signal)
2426 {
2427     if (runstate_is_running()) {
2428         vm_stop(RUN_STATE_PAUSED);
2429     }
2430 }
2431 #endif
2432
2433 static void gdb_monitor_open(Chardev *chr, ChardevBackend *backend,
2434                              bool *be_opened, Error **errp)
2435 {
2436     *be_opened = false;
2437 }
2438
2439 static void char_gdb_class_init(ObjectClass *oc, void *data)
2440 {
2441     ChardevClass *cc = CHARDEV_CLASS(oc);
2442
2443     cc->internal = true;
2444     cc->open = gdb_monitor_open;
2445     cc->chr_write = gdb_monitor_write;
2446 }
2447
2448 #define TYPE_CHARDEV_GDB "chardev-gdb"
2449
2450 static const TypeInfo char_gdb_type_info = {
2451     .name = TYPE_CHARDEV_GDB,
2452     .parent = TYPE_CHARDEV,
2453     .class_init = char_gdb_class_init,
2454 };
2455
2456 static int find_cpu_clusters(Object *child, void *opaque)
2457 {
2458     if (object_dynamic_cast(child, TYPE_CPU_CLUSTER)) {
2459         GDBState *s = (GDBState *) opaque;
2460         CPUClusterState *cluster = CPU_CLUSTER(child);
2461         GDBProcess *process;
2462
2463         s->processes = g_renew(GDBProcess, s->processes, ++s->process_num);
2464
2465         process = &s->processes[s->process_num - 1];
2466
2467         /*
2468          * GDB process IDs -1 and 0 are reserved. To avoid subtle errors at
2469          * runtime, we enforce here that the machine does not use a cluster ID
2470          * that would lead to PID 0.
2471          */
2472         assert(cluster->cluster_id != UINT32_MAX);
2473         process->pid = cluster->cluster_id + 1;
2474         process->attached = false;
2475         process->target_xml[0] = '\0';
2476
2477         return 0;
2478     }
2479
2480     return object_child_foreach(child, find_cpu_clusters, opaque);
2481 }
2482
2483 static int pid_order(const void *a, const void *b)
2484 {
2485     GDBProcess *pa = (GDBProcess *) a;
2486     GDBProcess *pb = (GDBProcess *) b;
2487
2488     if (pa->pid < pb->pid) {
2489         return -1;
2490     } else if (pa->pid > pb->pid) {
2491         return 1;
2492     } else {
2493         return 0;
2494     }
2495 }
2496
2497 static void create_processes(GDBState *s)
2498 {
2499     object_child_foreach(object_get_root(), find_cpu_clusters, s);
2500
2501     if (s->processes) {
2502         /* Sort by PID */
2503         qsort(s->processes, s->process_num, sizeof(s->processes[0]), pid_order);
2504     }
2505
2506     create_default_process(s);
2507 }
2508
2509 static void cleanup_processes(GDBState *s)
2510 {
2511     g_free(s->processes);
2512     s->process_num = 0;
2513     s->processes = NULL;
2514 }
2515
2516 int gdbserver_start(const char *device)
2517 {
2518     trace_gdbstub_op_start(device);
2519
2520     GDBState *s;
2521     char gdbstub_device_name[128];
2522     Chardev *chr = NULL;
2523     Chardev *mon_chr;
2524
2525     if (!first_cpu) {
2526         error_report("gdbstub: meaningless to attach gdb to a "
2527                      "machine without any CPU.");
2528         return -1;
2529     }
2530
2531     if (!device)
2532         return -1;
2533     if (strcmp(device, "none") != 0) {
2534         if (strstart(device, "tcp:", NULL)) {
2535             /* enforce required TCP attributes */
2536             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2537                      "%s,nowait,nodelay,server", device);
2538             device = gdbstub_device_name;
2539         }
2540 #ifndef _WIN32
2541         else if (strcmp(device, "stdio") == 0) {
2542             struct sigaction act;
2543
2544             memset(&act, 0, sizeof(act));
2545             act.sa_handler = gdb_sigterm_handler;
2546             sigaction(SIGINT, &act, NULL);
2547         }
2548 #endif
2549         /*
2550          * FIXME: it's a bit weird to allow using a mux chardev here
2551          * and implicitly setup a monitor. We may want to break this.
2552          */
2553         chr = qemu_chr_new_noreplay("gdb", device, true, NULL);
2554         if (!chr)
2555             return -1;
2556     }
2557
2558     s = gdbserver_state;
2559     if (!s) {
2560         s = g_malloc0(sizeof(GDBState));
2561         gdbserver_state = s;
2562
2563         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2564
2565         /* Initialize a monitor terminal for gdb */
2566         mon_chr = qemu_chardev_new(NULL, TYPE_CHARDEV_GDB,
2567                                    NULL, NULL, &error_abort);
2568         monitor_init(mon_chr, 0);
2569     } else {
2570         qemu_chr_fe_deinit(&s->chr, true);
2571         mon_chr = s->mon_chr;
2572         cleanup_processes(s);
2573         memset(s, 0, sizeof(GDBState));
2574         s->mon_chr = mon_chr;
2575     }
2576
2577     create_processes(s);
2578
2579     if (chr) {
2580         qemu_chr_fe_init(&s->chr, chr, &error_abort);
2581         qemu_chr_fe_set_handlers(&s->chr, gdb_chr_can_receive, gdb_chr_receive,
2582                                  gdb_chr_event, NULL, s, NULL, true);
2583     }
2584     s->state = chr ? RS_IDLE : RS_INACTIVE;
2585     s->mon_chr = mon_chr;
2586     s->current_syscall_cb = NULL;
2587
2588     return 0;
2589 }
2590
2591 void gdbserver_cleanup(void)
2592 {
2593     if (gdbserver_state) {
2594         put_packet(gdbserver_state, "W00");
2595     }
2596 }
2597
2598 static void register_types(void)
2599 {
2600     type_register_static(&char_gdb_type_info);
2601 }
2602
2603 type_init(register_types);
2604 #endif