Git Repo - qemu.git/blame_incremental

... / ...

Commit	Line	Data
	1	/*
	2	* gdb server stub
	3	*
	4	* Copyright (c) 2003-2005 Fabrice Bellard
	5	*
	6	* This library is free software; you can redistribute it and/or
	7	* modify it under the terms of the GNU Lesser General Public
	8	* License as published by the Free Software Foundation; either
	9	* version 2 of the License, or (at your option) any later version.
	10	*
	11	* This library is distributed in the hope that it will be useful,
	12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	14	* Lesser General Public License for more details.
	15	*
	16	* You should have received a copy of the GNU Lesser General Public
	17	* License along with this library; if not, see <http://www.gnu.org/licenses/>.
	18	*/
	19	#include "qemu/osdep.h"
	20	#include "qapi/error.h"
	21	#include "qemu/cutils.h"
	22	#include "cpu.h"
	23	#ifdef CONFIG_USER_ONLY
	24	#include "qemu.h"
	25	#else
	26	#include "monitor/monitor.h"
	27	#include "sysemu/char.h"
	28	#include "sysemu/sysemu.h"
	29	#include "exec/gdbstub.h"
	30	#endif
	31
	32	#define MAX_PACKET_LENGTH 4096
	33
	34	#include "cpu.h"
	35	#include "qemu/sockets.h"
	36	#include "sysemu/kvm.h"
	37	#include "exec/semihost.h"
	38
	39	#ifdef CONFIG_USER_ONLY
	40	#define GDB_ATTACHED "0"
	41	#else
	42	#define GDB_ATTACHED "1"
	43	#endif
	44
	45	static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
	46	uint8_t *buf, int len, bool is_write)
	47	{
	48	CPUClass *cc = CPU_GET_CLASS(cpu);
	49
	50	if (cc->memory_rw_debug) {
	51	return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
	52	}
	53	return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
	54	}
	55
	56	enum {
	57	GDB_SIGNAL_0 = 0,
	58	GDB_SIGNAL_INT = 2,
	59	GDB_SIGNAL_QUIT = 3,
	60	GDB_SIGNAL_TRAP = 5,
	61	GDB_SIGNAL_ABRT = 6,
	62	GDB_SIGNAL_ALRM = 14,
	63	GDB_SIGNAL_IO = 23,
	64	GDB_SIGNAL_XCPU = 24,
	65	GDB_SIGNAL_UNKNOWN = 143
	66	};
	67
	68	#ifdef CONFIG_USER_ONLY
	69
	70	/* Map target signal numbers to GDB protocol signal numbers and vice
	71	* versa. For user emulation's currently supported systems, we can
	72	* assume most signals are defined.
	73	*/
	74
	75	static int gdb_signal_table[] = {
	76	0,
	77	TARGET_SIGHUP,
	78	TARGET_SIGINT,
	79	TARGET_SIGQUIT,
	80	TARGET_SIGILL,
	81	TARGET_SIGTRAP,
	82	TARGET_SIGABRT,
	83	-1, /* SIGEMT */
	84	TARGET_SIGFPE,
	85	TARGET_SIGKILL,
	86	TARGET_SIGBUS,
	87	TARGET_SIGSEGV,
	88	TARGET_SIGSYS,
	89	TARGET_SIGPIPE,
	90	TARGET_SIGALRM,
	91	TARGET_SIGTERM,
	92	TARGET_SIGURG,
	93	TARGET_SIGSTOP,
	94	TARGET_SIGTSTP,
	95	TARGET_SIGCONT,
	96	TARGET_SIGCHLD,
	97	TARGET_SIGTTIN,
	98	TARGET_SIGTTOU,
	99	TARGET_SIGIO,
	100	TARGET_SIGXCPU,
	101	TARGET_SIGXFSZ,
	102	TARGET_SIGVTALRM,
	103	TARGET_SIGPROF,
	104	TARGET_SIGWINCH,
	105	-1, /* SIGLOST */
	106	TARGET_SIGUSR1,
	107	TARGET_SIGUSR2,
	108	#ifdef TARGET_SIGPWR
	109	TARGET_SIGPWR,
	110	#else
	111	-1,
	112	#endif
	113	-1, /* SIGPOLL */
	114	-1,
	115	-1,
	116	-1,
	117	-1,
	118	-1,
	119	-1,
	120	-1,
	121	-1,
	122	-1,
	123	-1,
	124	-1,
	125	#ifdef __SIGRTMIN
	126	__SIGRTMIN + 1,
	127	__SIGRTMIN + 2,
	128	__SIGRTMIN + 3,
	129	__SIGRTMIN + 4,
	130	__SIGRTMIN + 5,
	131	__SIGRTMIN + 6,
	132	__SIGRTMIN + 7,
	133	__SIGRTMIN + 8,
	134	__SIGRTMIN + 9,
	135	__SIGRTMIN + 10,
	136	__SIGRTMIN + 11,
	137	__SIGRTMIN + 12,
	138	__SIGRTMIN + 13,
	139	__SIGRTMIN + 14,
	140	__SIGRTMIN + 15,
	141	__SIGRTMIN + 16,
	142	__SIGRTMIN + 17,
	143	__SIGRTMIN + 18,
	144	__SIGRTMIN + 19,
	145	__SIGRTMIN + 20,
	146	__SIGRTMIN + 21,
	147	__SIGRTMIN + 22,
	148	__SIGRTMIN + 23,
	149	__SIGRTMIN + 24,
	150	__SIGRTMIN + 25,
	151	__SIGRTMIN + 26,
	152	__SIGRTMIN + 27,
	153	__SIGRTMIN + 28,
	154	__SIGRTMIN + 29,
	155	__SIGRTMIN + 30,
	156	__SIGRTMIN + 31,
	157	-1, /* SIGCANCEL */
	158	__SIGRTMIN,
	159	__SIGRTMIN + 32,
	160	__SIGRTMIN + 33,
	161	__SIGRTMIN + 34,
	162	__SIGRTMIN + 35,
	163	__SIGRTMIN + 36,
	164	__SIGRTMIN + 37,
	165	__SIGRTMIN + 38,
	166	__SIGRTMIN + 39,
	167	__SIGRTMIN + 40,
	168	__SIGRTMIN + 41,
	169	__SIGRTMIN + 42,
	170	__SIGRTMIN + 43,
	171	__SIGRTMIN + 44,
	172	__SIGRTMIN + 45,
	173	__SIGRTMIN + 46,
	174	__SIGRTMIN + 47,
	175	__SIGRTMIN + 48,
	176	__SIGRTMIN + 49,
	177	__SIGRTMIN + 50,
	178	__SIGRTMIN + 51,
	179	__SIGRTMIN + 52,
	180	__SIGRTMIN + 53,
	181	__SIGRTMIN + 54,
	182	__SIGRTMIN + 55,
	183	__SIGRTMIN + 56,
	184	__SIGRTMIN + 57,
	185	__SIGRTMIN + 58,
	186	__SIGRTMIN + 59,
	187	__SIGRTMIN + 60,
	188	__SIGRTMIN + 61,
	189	__SIGRTMIN + 62,
	190	__SIGRTMIN + 63,
	191	__SIGRTMIN + 64,
	192	__SIGRTMIN + 65,
	193	__SIGRTMIN + 66,
	194	__SIGRTMIN + 67,
	195	__SIGRTMIN + 68,
	196	__SIGRTMIN + 69,
	197	__SIGRTMIN + 70,
	198	__SIGRTMIN + 71,
	199	__SIGRTMIN + 72,
	200	__SIGRTMIN + 73,
	201	__SIGRTMIN + 74,
	202	__SIGRTMIN + 75,
	203	__SIGRTMIN + 76,
	204	__SIGRTMIN + 77,
	205	__SIGRTMIN + 78,
	206	__SIGRTMIN + 79,
	207	__SIGRTMIN + 80,
	208	__SIGRTMIN + 81,
	209	__SIGRTMIN + 82,
	210	__SIGRTMIN + 83,
	211	__SIGRTMIN + 84,
	212	__SIGRTMIN + 85,
	213	__SIGRTMIN + 86,
	214	__SIGRTMIN + 87,
	215	__SIGRTMIN + 88,
	216	__SIGRTMIN + 89,
	217	__SIGRTMIN + 90,
	218	__SIGRTMIN + 91,
	219	__SIGRTMIN + 92,
	220	__SIGRTMIN + 93,
	221	__SIGRTMIN + 94,
	222	__SIGRTMIN + 95,
	223	-1, /* SIGINFO */
	224	-1, /* UNKNOWN */
	225	-1, /* DEFAULT */
	226	-1,
	227	-1,
	228	-1,
	229	-1,
	230	-1,
	231	-1
	232	#endif
	233	};
	234	#else
	235	/* In system mode we only need SIGINT and SIGTRAP; other signals
	236	are not yet supported. */
	237
	238	enum {
	239	TARGET_SIGINT = 2,
	240	TARGET_SIGTRAP = 5
	241	};
	242
	243	static int gdb_signal_table[] = {
	244	-1,
	245	-1,
	246	TARGET_SIGINT,
	247	-1,
	248	-1,
	249	TARGET_SIGTRAP
	250	};
	251	#endif
	252
	253	#ifdef CONFIG_USER_ONLY
	254	static int target_signal_to_gdb (int sig)
	255	{
	256	int i;
	257	for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
	258	if (gdb_signal_table[i] == sig)
	259	return i;
	260	return GDB_SIGNAL_UNKNOWN;
	261	}
	262	#endif
	263
	264	static int gdb_signal_to_target (int sig)
	265	{
	266	if (sig < ARRAY_SIZE (gdb_signal_table))
	267	return gdb_signal_table[sig];
	268	else
	269	return -1;
	270	}
	271
	272	//#define DEBUG_GDB
	273
	274	typedef struct GDBRegisterState {
	275	int base_reg;
	276	int num_regs;
	277	gdb_reg_cb get_reg;
	278	gdb_reg_cb set_reg;
	279	const char *xml;
	280	struct GDBRegisterState *next;
	281	} GDBRegisterState;
	282
	283	enum RSState {
	284	RS_INACTIVE,
	285	RS_IDLE,
	286	RS_GETLINE,
	287	RS_CHKSUM1,
	288	RS_CHKSUM2,
	289	};
	290	typedef struct GDBState {
	291	CPUState c_cpu; / current CPU for step/continue ops */
	292	CPUState g_cpu; / current CPU for other ops */
	293	CPUState query_cpu; / for q{f\|s}ThreadInfo */
	294	enum RSState state; /* parsing state */
	295	char line_buf[MAX_PACKET_LENGTH];
	296	int line_buf_index;
	297	int line_csum;
	298	uint8_t last_packet[MAX_PACKET_LENGTH + 4];
	299	int last_packet_len;
	300	int signal;
	301	#ifdef CONFIG_USER_ONLY
	302	int fd;
	303	int running_state;
	304	#else
	305	CharDriverState *chr;
	306	CharDriverState *mon_chr;
	307	#endif
	308	char syscall_buf[256];
	309	gdb_syscall_complete_cb current_syscall_cb;
	310	} GDBState;
	311
	312	/* By default use no IRQs and no timers while single stepping so as to
	313	* make single stepping like an ICE HW step.
	314	*/
	315	static int sstep_flags = SSTEP_ENABLE\|SSTEP_NOIRQ\|SSTEP_NOTIMER;
	316
	317	static GDBState *gdbserver_state;
	318
	319	bool gdb_has_xml;
	320
	321	#ifdef CONFIG_USER_ONLY
	322	/* XXX: This is not thread safe. Do we care? */
	323	static int gdbserver_fd = -1;
	324
	325	static int get_char(GDBState *s)
	326	{
	327	uint8_t ch;
	328	int ret;
	329
	330	for(;;) {
	331	ret = qemu_recv(s->fd, &ch, 1, 0);
	332	if (ret < 0) {
	333	if (errno == ECONNRESET)
	334	s->fd = -1;
	335	if (errno != EINTR && errno != EAGAIN)
	336	return -1;
	337	} else if (ret == 0) {
	338	close(s->fd);
	339	s->fd = -1;
	340	return -1;
	341	} else {
	342	break;
	343	}
	344	}
	345	return ch;
	346	}
	347	#endif
	348
	349	static enum {
	350	GDB_SYS_UNKNOWN,
	351	GDB_SYS_ENABLED,
	352	GDB_SYS_DISABLED,
	353	} gdb_syscall_mode;
	354
	355	/* Decide if either remote gdb syscalls or native file IO should be used. */
	356	int use_gdb_syscalls(void)
	357	{
	358	SemihostingTarget target = semihosting_get_target();
	359	if (target == SEMIHOSTING_TARGET_NATIVE) {
	360	/* -semihosting-config target=native */
	361	return false;
	362	} else if (target == SEMIHOSTING_TARGET_GDB) {
	363	/* -semihosting-config target=gdb */
	364	return true;
	365	}
	366
	367	/* -semihosting-config target=auto */
	368	/* On the first call check if gdb is connected and remember. */
	369	if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
	370	gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
	371	: GDB_SYS_DISABLED);
	372	}
	373	return gdb_syscall_mode == GDB_SYS_ENABLED;
	374	}
	375
	376	/* Resume execution. */
	377	static inline void gdb_continue(GDBState *s)
	378	{
	379	#ifdef CONFIG_USER_ONLY
	380	s->running_state = 1;
	381	#else
	382	if (!runstate_needs_reset()) {
	383	vm_start();
	384	}
	385	#endif
	386	}
	387
	388	static void put_buffer(GDBState s, const uint8_t buf, int len)
	389	{
	390	#ifdef CONFIG_USER_ONLY
	391	int ret;
	392
	393	while (len > 0) {
	394	ret = send(s->fd, buf, len, 0);
	395	if (ret < 0) {
	396	if (errno != EINTR && errno != EAGAIN)
	397	return;
	398	} else {
	399	buf += ret;
	400	len -= ret;
	401	}
	402	}
	403	#else
	404	qemu_chr_fe_write(s->chr, buf, len);
	405	#endif
	406	}
	407
	408	static inline int fromhex(int v)
	409	{
	410	if (v >= '0' && v <= '9')
	411	return v - '0';
	412	else if (v >= 'A' && v <= 'F')
	413	return v - 'A' + 10;
	414	else if (v >= 'a' && v <= 'f')
	415	return v - 'a' + 10;
	416	else
	417	return 0;
	418	}
	419
	420	static inline int tohex(int v)
	421	{
	422	if (v < 10)
	423	return v + '0';
	424	else
	425	return v - 10 + 'a';
	426	}
	427
	428	static void memtohex(char buf, const uint8_t mem, int len)
	429	{
	430	int i, c;
	431	char *q;
	432	q = buf;
	433	for(i = 0; i < len; i++) {
	434	c = mem[i];
	435	*q++ = tohex(c >> 4);
	436	*q++ = tohex(c & 0xf);
	437	}
	438	*q = '\0';
	439	}
	440
	441	static void hextomem(uint8_t mem, const char buf, int len)
	442	{
	443	int i;
	444
	445	for(i = 0; i < len; i++) {
	446	mem[i] = (fromhex(buf[0]) << 4) \| fromhex(buf[1]);
	447	buf += 2;
	448	}
	449	}
	450
	451	/* return -1 if error, 0 if OK */
	452	static int put_packet_binary(GDBState s, const char buf, int len)
	453	{
	454	int csum, i;
	455	uint8_t *p;
	456
	457	for(;;) {
	458	p = s->last_packet;
	459	*(p++) = '$';
	460	memcpy(p, buf, len);
	461	p += len;
	462	csum = 0;
	463	for(i = 0; i < len; i++) {
	464	csum += buf[i];
	465	}
	466	*(p++) = '#';
	467	*(p++) = tohex((csum >> 4) & 0xf);
	468	*(p++) = tohex((csum) & 0xf);
	469
	470	s->last_packet_len = p - s->last_packet;
	471	put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
	472
	473	#ifdef CONFIG_USER_ONLY
	474	i = get_char(s);
	475	if (i < 0)
	476	return -1;
	477	if (i == '+')
	478	break;
	479	#else
	480	break;
	481	#endif
	482	}
	483	return 0;
	484	}
	485
	486	/* return -1 if error, 0 if OK */
	487	static int put_packet(GDBState s, const char buf)
	488	{
	489	#ifdef DEBUG_GDB
	490	printf("reply='%s'\n", buf);
	491	#endif
	492
	493	return put_packet_binary(s, buf, strlen(buf));
	494	}
	495
	496	/* Encode data using the encoding for 'x' packets. */
	497	static int memtox(char buf, const char mem, int len)
	498	{
	499	char *p = buf;
	500	char c;
	501
	502	while (len--) {
	503	c = *(mem++);
	504	switch (c) {
	505	case '#': case '$': case '*': case '}':
	506	*(p++) = '}';
	507	*(p++) = c ^ 0x20;
	508	break;
	509	default:
	510	*(p++) = c;
	511	break;
	512	}
	513	}
	514	return p - buf;
	515	}
	516
	517	static const char get_feature_xml(const char p, const char **newp,
	518	CPUClass *cc)
	519	{
	520	size_t len;
	521	int i;
	522	const char *name;
	523	static char target_xml[1024];
	524
	525	len = 0;
	526	while (p[len] && p[len] != ':')
	527	len++;
	528	*newp = p + len;
	529
	530	name = NULL;
	531	if (strncmp(p, "target.xml", len) == 0) {
	532	/* Generate the XML description for this CPU. */
	533	if (!target_xml[0]) {
	534	GDBRegisterState *r;
	535	CPUState *cpu = first_cpu;
	536
	537	pstrcat(target_xml, sizeof(target_xml),
	538	"<?xml version=\"1.0\"?>"
	539	"<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
	540	"<target>");
	541	if (cc->gdb_arch_name) {
	542	gchar *arch = cc->gdb_arch_name(cpu);
	543	pstrcat(target_xml, sizeof(target_xml), "<architecture>");
	544	pstrcat(target_xml, sizeof(target_xml), arch);
	545	pstrcat(target_xml, sizeof(target_xml), "</architecture>");
	546	g_free(arch);
	547	}
	548	pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
	549	pstrcat(target_xml, sizeof(target_xml), cc->gdb_core_xml_file);
	550	pstrcat(target_xml, sizeof(target_xml), "\"/>");
	551	for (r = cpu->gdb_regs; r; r = r->next) {
	552	pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
	553	pstrcat(target_xml, sizeof(target_xml), r->xml);
	554	pstrcat(target_xml, sizeof(target_xml), "\"/>");
	555	}
	556	pstrcat(target_xml, sizeof(target_xml), "</target>");
	557	}
	558	return target_xml;
	559	}
	560	for (i = 0; ; i++) {
	561	name = xml_builtin[i][0];
	562	if (!name \|\| (strncmp(name, p, len) == 0 && strlen(name) == len))
	563	break;
	564	}
	565	return name ? xml_builtin[i][1] : NULL;
	566	}
	567
	568	static int gdb_read_register(CPUState cpu, uint8_t mem_buf, int reg)
	569	{
	570	CPUClass *cc = CPU_GET_CLASS(cpu);
	571	CPUArchState *env = cpu->env_ptr;
	572	GDBRegisterState *r;
	573
	574	if (reg < cc->gdb_num_core_regs) {
	575	return cc->gdb_read_register(cpu, mem_buf, reg);
	576	}
	577
	578	for (r = cpu->gdb_regs; r; r = r->next) {
	579	if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
	580	return r->get_reg(env, mem_buf, reg - r->base_reg);
	581	}
	582	}
	583	return 0;
	584	}
	585
	586	static int gdb_write_register(CPUState cpu, uint8_t mem_buf, int reg)
	587	{
	588	CPUClass *cc = CPU_GET_CLASS(cpu);
	589	CPUArchState *env = cpu->env_ptr;
	590	GDBRegisterState *r;
	591
	592	if (reg < cc->gdb_num_core_regs) {
	593	return cc->gdb_write_register(cpu, mem_buf, reg);
	594	}
	595
	596	for (r = cpu->gdb_regs; r; r = r->next) {
	597	if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
	598	return r->set_reg(env, mem_buf, reg - r->base_reg);
	599	}
	600	}
	601	return 0;
	602	}
	603
	604	/* Register a supplemental set of CPU registers. If g_pos is nonzero it
	605	specifies the first register number and these registers are included in
	606	a standard "g" packet. Direction is relative to gdb, i.e. get_reg is
	607	gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
	608	*/
	609
	610	void gdb_register_coprocessor(CPUState *cpu,
	611	gdb_reg_cb get_reg, gdb_reg_cb set_reg,
	612	int num_regs, const char *xml, int g_pos)
	613	{
	614	GDBRegisterState *s;
	615	GDBRegisterState **p;
	616
	617	p = &cpu->gdb_regs;
	618	while (*p) {
	619	/* Check for duplicates. */
	620	if (strcmp((*p)->xml, xml) == 0)
	621	return;
	622	p = &(*p)->next;
	623	}
	624
	625	s = g_new0(GDBRegisterState, 1);
	626	s->base_reg = cpu->gdb_num_regs;
	627	s->num_regs = num_regs;
	628	s->get_reg = get_reg;
	629	s->set_reg = set_reg;
	630	s->xml = xml;
	631
	632	/* Add to end of list. */
	633	cpu->gdb_num_regs += num_regs;
	634	*p = s;
	635	if (g_pos) {
	636	if (g_pos != s->base_reg) {
	637	fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
	638	"Expected %d got %d\n", xml, g_pos, s->base_reg);
	639	} else {
	640	cpu->gdb_num_g_regs = cpu->gdb_num_regs;
	641	}
	642	}
	643	}
	644
	645	#ifndef CONFIG_USER_ONLY
	646	/* Translate GDB watchpoint type to a flags value for cpu_watchpoint_* */
	647	static inline int xlat_gdb_type(CPUState *cpu, int gdbtype)
	648	{
	649	static const int xlat[] = {
	650	[GDB_WATCHPOINT_WRITE] = BP_GDB \| BP_MEM_WRITE,
	651	[GDB_WATCHPOINT_READ] = BP_GDB \| BP_MEM_READ,
	652	[GDB_WATCHPOINT_ACCESS] = BP_GDB \| BP_MEM_ACCESS,
	653	};
	654
	655	CPUClass *cc = CPU_GET_CLASS(cpu);
	656	int cputype = xlat[gdbtype];
	657
	658	if (cc->gdb_stop_before_watchpoint) {
	659	cputype \|= BP_STOP_BEFORE_ACCESS;
	660	}
	661	return cputype;
	662	}
	663	#endif
	664
	665	static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
	666	{
	667	CPUState *cpu;
	668	int err = 0;
	669
	670	if (kvm_enabled()) {
	671	return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
	672	}
	673
	674	switch (type) {
	675	case GDB_BREAKPOINT_SW:
	676	case GDB_BREAKPOINT_HW:
	677	CPU_FOREACH(cpu) {
	678	err = cpu_breakpoint_insert(cpu, addr, BP_GDB, NULL);
	679	if (err) {
	680	break;
	681	}
	682	}
	683	return err;
	684	#ifndef CONFIG_USER_ONLY
	685	case GDB_WATCHPOINT_WRITE:
	686	case GDB_WATCHPOINT_READ:
	687	case GDB_WATCHPOINT_ACCESS:
	688	CPU_FOREACH(cpu) {
	689	err = cpu_watchpoint_insert(cpu, addr, len,
	690	xlat_gdb_type(cpu, type), NULL);
	691	if (err) {
	692	break;
	693	}
	694	}
	695	return err;
	696	#endif
	697	default:
	698	return -ENOSYS;
	699	}
	700	}
	701
	702	static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
	703	{
	704	CPUState *cpu;
	705	int err = 0;
	706
	707	if (kvm_enabled()) {
	708	return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
	709	}
	710
	711	switch (type) {
	712	case GDB_BREAKPOINT_SW:
	713	case GDB_BREAKPOINT_HW:
	714	CPU_FOREACH(cpu) {
	715	err = cpu_breakpoint_remove(cpu, addr, BP_GDB);
	716	if (err) {
	717	break;
	718	}
	719	}
	720	return err;
	721	#ifndef CONFIG_USER_ONLY
	722	case GDB_WATCHPOINT_WRITE:
	723	case GDB_WATCHPOINT_READ:
	724	case GDB_WATCHPOINT_ACCESS:
	725	CPU_FOREACH(cpu) {
	726	err = cpu_watchpoint_remove(cpu, addr, len,
	727	xlat_gdb_type(cpu, type));
	728	if (err)
	729	break;
	730	}
	731	return err;
	732	#endif
	733	default:
	734	return -ENOSYS;
	735	}
	736	}
	737
	738	static void gdb_breakpoint_remove_all(void)
	739	{
	740	CPUState *cpu;
	741
	742	if (kvm_enabled()) {
	743	kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
	744	return;
	745	}
	746
	747	CPU_FOREACH(cpu) {
	748	cpu_breakpoint_remove_all(cpu, BP_GDB);
	749	#ifndef CONFIG_USER_ONLY
	750	cpu_watchpoint_remove_all(cpu, BP_GDB);
	751	#endif
	752	}
	753	}
	754
	755	static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
	756	{
	757	CPUState *cpu = s->c_cpu;
	758
	759	cpu_synchronize_state(cpu);
	760	cpu_set_pc(cpu, pc);
	761	}
	762
	763	static CPUState *find_cpu(uint32_t thread_id)
	764	{
	765	CPUState *cpu;
	766
	767	CPU_FOREACH(cpu) {
	768	if (cpu_index(cpu) == thread_id) {
	769	return cpu;
	770	}
	771	}
	772
	773	return NULL;
	774	}
	775
	776	static int is_query_packet(const char p, const char query, char separator)
	777	{
	778	unsigned int query_len = strlen(query);
	779
	780	return strncmp(p, query, query_len) == 0 &&
	781	(p[query_len] == '\0' \|\| p[query_len] == separator);
	782	}
	783
	784	static int gdb_handle_packet(GDBState s, const char line_buf)
	785	{
	786	CPUState *cpu;
	787	CPUClass *cc;
	788	const char *p;
	789	uint32_t thread;
	790	int ch, reg_size, type, res;
	791	char buf[MAX_PACKET_LENGTH];
	792	uint8_t mem_buf[MAX_PACKET_LENGTH];
	793	uint8_t *registers;
	794	target_ulong addr, len;
	795
	796	#ifdef DEBUG_GDB
	797	printf("command='%s'\n", line_buf);
	798	#endif
	799	p = line_buf;
	800	ch = *p++;
	801	switch(ch) {
	802	case '?':
	803	/* TODO: Make this return the correct value for user-mode. */
	804	snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
	805	cpu_index(s->c_cpu));
	806	put_packet(s, buf);
	807	/* Remove all the breakpoints when this query is issued,
	808	* because gdb is doing and initial connect and the state
	809	* should be cleaned up.
	810	*/
	811	gdb_breakpoint_remove_all();
	812	break;
	813	case 'c':
	814	if (*p != '\0') {
	815	addr = strtoull(p, (char **)&p, 16);
	816	gdb_set_cpu_pc(s, addr);
	817	}
	818	s->signal = 0;
	819	gdb_continue(s);
	820	return RS_IDLE;
	821	case 'C':
	822	s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
	823	if (s->signal == -1)
	824	s->signal = 0;
	825	gdb_continue(s);
	826	return RS_IDLE;
	827	case 'v':
	828	if (strncmp(p, "Cont", 4) == 0) {
	829	int res_signal, res_thread;
	830
	831	p += 4;
	832	if (*p == '?') {
	833	put_packet(s, "vCont;c;C;s;S");
	834	break;
	835	}
	836	res = 0;
	837	res_signal = 0;
	838	res_thread = 0;
	839	while (*p) {
	840	int action, signal;
	841
	842	if (*p++ != ';') {
	843	res = 0;
	844	break;
	845	}
	846	action = *p++;
	847	signal = 0;
	848	if (action == 'C' \|\| action == 'S') {
	849	signal = gdb_signal_to_target(strtoul(p, (char **)&p, 16));
	850	if (signal == -1) {
	851	signal = 0;
	852	}
	853	} else if (action != 'c' && action != 's') {
	854	res = 0;
	855	break;
	856	}
	857	thread = 0;
	858	if (*p == ':') {
	859	thread = strtoull(p+1, (char **)&p, 16);
	860	}
	861	action = tolower(action);
	862	if (res == 0 \|\| (res == 'c' && action == 's')) {
	863	res = action;
	864	res_signal = signal;
	865	res_thread = thread;
	866	}
	867	}
	868	if (res) {
	869	if (res_thread != -1 && res_thread != 0) {
	870	cpu = find_cpu(res_thread);
	871	if (cpu == NULL) {
	872	put_packet(s, "E22");
	873	break;
	874	}
	875	s->c_cpu = cpu;
	876	}
	877	if (res == 's') {
	878	cpu_single_step(s->c_cpu, sstep_flags);
	879	}
	880	s->signal = res_signal;
	881	gdb_continue(s);
	882	return RS_IDLE;
	883	}
	884	break;
	885	} else {
	886	goto unknown_command;
	887	}
	888	case 'k':
	889	/* Kill the target */
	890	fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
	891	exit(0);
	892	case 'D':
	893	/* Detach packet */
	894	gdb_breakpoint_remove_all();
	895	gdb_syscall_mode = GDB_SYS_DISABLED;
	896	gdb_continue(s);
	897	put_packet(s, "OK");
	898	break;
	899	case 's':
	900	if (*p != '\0') {
	901	addr = strtoull(p, (char **)&p, 16);
	902	gdb_set_cpu_pc(s, addr);
	903	}
	904	cpu_single_step(s->c_cpu, sstep_flags);
	905	gdb_continue(s);
	906	return RS_IDLE;
	907	case 'F':
	908	{
	909	target_ulong ret;
	910	target_ulong err;
	911
	912	ret = strtoull(p, (char **)&p, 16);
	913	if (*p == ',') {
	914	p++;
	915	err = strtoull(p, (char **)&p, 16);
	916	} else {
	917	err = 0;
	918	}
	919	if (*p == ',')
	920	p++;
	921	type = *p;
	922	if (s->current_syscall_cb) {
	923	s->current_syscall_cb(s->c_cpu, ret, err);
	924	s->current_syscall_cb = NULL;
	925	}
	926	if (type == 'C') {
	927	put_packet(s, "T02");
	928	} else {
	929	gdb_continue(s);
	930	}
	931	}
	932	break;
	933	case 'g':
	934	cpu_synchronize_state(s->g_cpu);
	935	len = 0;
	936	for (addr = 0; addr < s->g_cpu->gdb_num_g_regs; addr++) {
	937	reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
	938	len += reg_size;
	939	}
	940	memtohex(buf, mem_buf, len);
	941	put_packet(s, buf);
	942	break;
	943	case 'G':
	944	cpu_synchronize_state(s->g_cpu);
	945	registers = mem_buf;
	946	len = strlen(p) / 2;
	947	hextomem((uint8_t *)registers, p, len);
	948	for (addr = 0; addr < s->g_cpu->gdb_num_g_regs && len > 0; addr++) {
	949	reg_size = gdb_write_register(s->g_cpu, registers, addr);
	950	len -= reg_size;
	951	registers += reg_size;
	952	}
	953	put_packet(s, "OK");
	954	break;
	955	case 'm':
	956	addr = strtoull(p, (char **)&p, 16);
	957	if (*p == ',')
	958	p++;
	959	len = strtoull(p, NULL, 16);
	960
	961	/* memtohex() doubles the required space */
	962	if (len > MAX_PACKET_LENGTH / 2) {
	963	put_packet (s, "E22");
	964	break;
	965	}
	966
	967	if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
	968	put_packet (s, "E14");
	969	} else {
	970	memtohex(buf, mem_buf, len);
	971	put_packet(s, buf);
	972	}
	973	break;
	974	case 'M':
	975	addr = strtoull(p, (char **)&p, 16);
	976	if (*p == ',')
	977	p++;
	978	len = strtoull(p, (char **)&p, 16);
	979	if (*p == ':')
	980	p++;
	981
	982	/* hextomem() reads 2len bytes /
	983	if (len > strlen(p) / 2) {
	984	put_packet (s, "E22");
	985	break;
	986	}
	987	hextomem(mem_buf, p, len);
	988	if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
	989	true) != 0) {
	990	put_packet(s, "E14");
	991	} else {
	992	put_packet(s, "OK");
	993	}
	994	break;
	995	case 'p':
	996	/* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
	997	This works, but can be very slow. Anything new enough to
	998	understand XML also knows how to use this properly. */
	999	if (!gdb_has_xml)
	1000	goto unknown_command;
	1001	addr = strtoull(p, (char **)&p, 16);
	1002	reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
	1003	if (reg_size) {
	1004	memtohex(buf, mem_buf, reg_size);
	1005	put_packet(s, buf);
	1006	} else {
	1007	put_packet(s, "E14");
	1008	}
	1009	break;
	1010	case 'P':
	1011	if (!gdb_has_xml)
	1012	goto unknown_command;
	1013	addr = strtoull(p, (char **)&p, 16);
	1014	if (*p == '=')
	1015	p++;
	1016	reg_size = strlen(p) / 2;
	1017	hextomem(mem_buf, p, reg_size);
	1018	gdb_write_register(s->g_cpu, mem_buf, addr);
	1019	put_packet(s, "OK");
	1020	break;
	1021	case 'Z':
	1022	case 'z':
	1023	type = strtoul(p, (char **)&p, 16);
	1024	if (*p == ',')
	1025	p++;
	1026	addr = strtoull(p, (char **)&p, 16);
	1027	if (*p == ',')
	1028	p++;
	1029	len = strtoull(p, (char **)&p, 16);
	1030	if (ch == 'Z')
	1031	res = gdb_breakpoint_insert(addr, len, type);
	1032	else
	1033	res = gdb_breakpoint_remove(addr, len, type);
	1034	if (res >= 0)
	1035	put_packet(s, "OK");
	1036	else if (res == -ENOSYS)
	1037	put_packet(s, "");
	1038	else
	1039	put_packet(s, "E22");
	1040	break;
	1041	case 'H':
	1042	type = *p++;
	1043	thread = strtoull(p, (char **)&p, 16);
	1044	if (thread == -1 \|\| thread == 0) {
	1045	put_packet(s, "OK");
	1046	break;
	1047	}
	1048	cpu = find_cpu(thread);
	1049	if (cpu == NULL) {
	1050	put_packet(s, "E22");
	1051	break;
	1052	}
	1053	switch (type) {
	1054	case 'c':
	1055	s->c_cpu = cpu;
	1056	put_packet(s, "OK");
	1057	break;
	1058	case 'g':
	1059	s->g_cpu = cpu;
	1060	put_packet(s, "OK");
	1061	break;
	1062	default:
	1063	put_packet(s, "E22");
	1064	break;
	1065	}
	1066	break;
	1067	case 'T':
	1068	thread = strtoull(p, (char **)&p, 16);
	1069	cpu = find_cpu(thread);
	1070
	1071	if (cpu != NULL) {
	1072	put_packet(s, "OK");
	1073	} else {
	1074	put_packet(s, "E22");
	1075	}
	1076	break;
	1077	case 'q':
	1078	case 'Q':
	1079	/* parse any 'q' packets here */
	1080	if (!strcmp(p,"qemu.sstepbits")) {
	1081	/* Query Breakpoint bit definitions */
	1082	snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
	1083	SSTEP_ENABLE,
	1084	SSTEP_NOIRQ,
	1085	SSTEP_NOTIMER);
	1086	put_packet(s, buf);
	1087	break;
	1088	} else if (is_query_packet(p, "qemu.sstep", '=')) {
	1089	/* Display or change the sstep_flags */
	1090	p += 10;
	1091	if (*p != '=') {
	1092	/* Display current setting */
	1093	snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
	1094	put_packet(s, buf);
	1095	break;
	1096	}
	1097	p++;
	1098	type = strtoul(p, (char **)&p, 16);
	1099	sstep_flags = type;
	1100	put_packet(s, "OK");
	1101	break;
	1102	} else if (strcmp(p,"C") == 0) {
	1103	/* "Current thread" remains vague in the spec, so always return
	1104	* the first CPU (gdb returns the first thread). */
	1105	put_packet(s, "QC1");
	1106	break;
	1107	} else if (strcmp(p,"fThreadInfo") == 0) {
	1108	s->query_cpu = first_cpu;
	1109	goto report_cpuinfo;
	1110	} else if (strcmp(p,"sThreadInfo") == 0) {
	1111	report_cpuinfo:
	1112	if (s->query_cpu) {
	1113	snprintf(buf, sizeof(buf), "m%x", cpu_index(s->query_cpu));
	1114	put_packet(s, buf);
	1115	s->query_cpu = CPU_NEXT(s->query_cpu);
	1116	} else
	1117	put_packet(s, "l");
	1118	break;
	1119	} else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
	1120	thread = strtoull(p+16, (char **)&p, 16);
	1121	cpu = find_cpu(thread);
	1122	if (cpu != NULL) {
	1123	cpu_synchronize_state(cpu);
	1124	/* memtohex() doubles the required space */
	1125	len = snprintf((char *)mem_buf, sizeof(buf) / 2,
	1126	"CPU#%d [%s]", cpu->cpu_index,
	1127	cpu->halted ? "halted " : "running");
	1128	memtohex(buf, mem_buf, len);
	1129	put_packet(s, buf);
	1130	}
	1131	break;
	1132	}
	1133	#ifdef CONFIG_USER_ONLY
	1134	else if (strcmp(p, "Offsets") == 0) {
	1135	TaskState *ts = s->c_cpu->opaque;
	1136
	1137	snprintf(buf, sizeof(buf),
	1138	"Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
	1139	";Bss=" TARGET_ABI_FMT_lx,
	1140	ts->info->code_offset,
	1141	ts->info->data_offset,
	1142	ts->info->data_offset);
	1143	put_packet(s, buf);
	1144	break;
	1145	}
	1146	#else /* !CONFIG_USER_ONLY */
	1147	else if (strncmp(p, "Rcmd,", 5) == 0) {
	1148	int len = strlen(p + 5);
	1149
	1150	if ((len % 2) != 0) {
	1151	put_packet(s, "E01");
	1152	break;
	1153	}
	1154	len = len / 2;
	1155	hextomem(mem_buf, p + 5, len);
	1156	mem_buf[len++] = 0;
	1157	qemu_chr_be_write(s->mon_chr, mem_buf, len);
	1158	put_packet(s, "OK");
	1159	break;
	1160	}
	1161	#endif /* !CONFIG_USER_ONLY */
	1162	if (is_query_packet(p, "Supported", ':')) {
	1163	snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
	1164	cc = CPU_GET_CLASS(first_cpu);
	1165	if (cc->gdb_core_xml_file != NULL) {
	1166	pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
	1167	}
	1168	put_packet(s, buf);
	1169	break;
	1170	}
	1171	if (strncmp(p, "Xfer:features:read:", 19) == 0) {
	1172	const char *xml;
	1173	target_ulong total_len;
	1174
	1175	cc = CPU_GET_CLASS(first_cpu);
	1176	if (cc->gdb_core_xml_file == NULL) {
	1177	goto unknown_command;
	1178	}
	1179
	1180	gdb_has_xml = true;
	1181	p += 19;
	1182	xml = get_feature_xml(p, &p, cc);
	1183	if (!xml) {
	1184	snprintf(buf, sizeof(buf), "E00");
	1185	put_packet(s, buf);
	1186	break;
	1187	}
	1188
	1189	if (*p == ':')
	1190	p++;
	1191	addr = strtoul(p, (char **)&p, 16);
	1192	if (*p == ',')
	1193	p++;
	1194	len = strtoul(p, (char **)&p, 16);
	1195
	1196	total_len = strlen(xml);
	1197	if (addr > total_len) {
	1198	snprintf(buf, sizeof(buf), "E00");
	1199	put_packet(s, buf);
	1200	break;
	1201	}
	1202	if (len > (MAX_PACKET_LENGTH - 5) / 2)
	1203	len = (MAX_PACKET_LENGTH - 5) / 2;
	1204	if (len < total_len - addr) {
	1205	buf[0] = 'm';
	1206	len = memtox(buf + 1, xml + addr, len);
	1207	} else {
	1208	buf[0] = 'l';
	1209	len = memtox(buf + 1, xml + addr, total_len - addr);
	1210	}
	1211	put_packet_binary(s, buf, len + 1);
	1212	break;
	1213	}
	1214	if (is_query_packet(p, "Attached", ':')) {
	1215	put_packet(s, GDB_ATTACHED);
	1216	break;
	1217	}
	1218	/* Unrecognised 'q' command. */
	1219	goto unknown_command;
	1220
	1221	default:
	1222	unknown_command:
	1223	/* put empty packet */
	1224	buf[0] = '\0';
	1225	put_packet(s, buf);
	1226	break;
	1227	}
	1228	return RS_IDLE;
	1229	}
	1230
	1231	void gdb_set_stop_cpu(CPUState *cpu)
	1232	{
	1233	gdbserver_state->c_cpu = cpu;
	1234	gdbserver_state->g_cpu = cpu;
	1235	}
	1236
	1237	#ifndef CONFIG_USER_ONLY
	1238	static void gdb_vm_state_change(void *opaque, int running, RunState state)
	1239	{
	1240	GDBState *s = gdbserver_state;
	1241	CPUState *cpu = s->c_cpu;
	1242	char buf[256];
	1243	const char *type;
	1244	int ret;
	1245
	1246	if (running \|\| s->state == RS_INACTIVE) {
	1247	return;
	1248	}
	1249	/* Is there a GDB syscall waiting to be sent? */
	1250	if (s->current_syscall_cb) {
	1251	put_packet(s, s->syscall_buf);
	1252	return;
	1253	}
	1254	switch (state) {
	1255	case RUN_STATE_DEBUG:
	1256	if (cpu->watchpoint_hit) {
	1257	switch (cpu->watchpoint_hit->flags & BP_MEM_ACCESS) {
	1258	case BP_MEM_READ:
	1259	type = "r";
	1260	break;
	1261	case BP_MEM_ACCESS:
	1262	type = "a";
	1263	break;
	1264	default:
	1265	type = "";
	1266	break;
	1267	}
	1268	snprintf(buf, sizeof(buf),
	1269	"T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
	1270	GDB_SIGNAL_TRAP, cpu_index(cpu), type,
	1271	(target_ulong)cpu->watchpoint_hit->vaddr);
	1272	cpu->watchpoint_hit = NULL;
	1273	goto send_packet;
	1274	}
	1275	tb_flush(cpu);
	1276	ret = GDB_SIGNAL_TRAP;
	1277	break;
	1278	case RUN_STATE_PAUSED:
	1279	ret = GDB_SIGNAL_INT;
	1280	break;
	1281	case RUN_STATE_SHUTDOWN:
	1282	ret = GDB_SIGNAL_QUIT;
	1283	break;
	1284	case RUN_STATE_IO_ERROR:
	1285	ret = GDB_SIGNAL_IO;
	1286	break;
	1287	case RUN_STATE_WATCHDOG:
	1288	ret = GDB_SIGNAL_ALRM;
	1289	break;
	1290	case RUN_STATE_INTERNAL_ERROR:
	1291	ret = GDB_SIGNAL_ABRT;
	1292	break;
	1293	case RUN_STATE_SAVE_VM:
	1294	case RUN_STATE_RESTORE_VM:
	1295	return;
	1296	case RUN_STATE_FINISH_MIGRATE:
	1297	ret = GDB_SIGNAL_XCPU;
	1298	break;
	1299	default:
	1300	ret = GDB_SIGNAL_UNKNOWN;
	1301	break;
	1302	}
	1303	gdb_set_stop_cpu(cpu);
	1304	snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, cpu_index(cpu));
	1305
	1306	send_packet:
	1307	put_packet(s, buf);
	1308
	1309	/* disable single step if it was enabled */
	1310	cpu_single_step(cpu, 0);
	1311	}
	1312	#endif
	1313
	1314	/* Send a gdb syscall request.
	1315	This accepts limited printf-style format specifiers, specifically:
	1316	%x - target_ulong argument printed in hex.
	1317	%lx - 64-bit argument printed in hex.
	1318	%s - string pointer (target_ulong) and length (int) pair. */
	1319	void gdb_do_syscallv(gdb_syscall_complete_cb cb, const char *fmt, va_list va)
	1320	{
	1321	char *p;
	1322	char *p_end;
	1323	target_ulong addr;
	1324	uint64_t i64;
	1325	GDBState *s;
	1326
	1327	s = gdbserver_state;
	1328	if (!s)
	1329	return;
	1330	s->current_syscall_cb = cb;
	1331	#ifndef CONFIG_USER_ONLY
	1332	vm_stop(RUN_STATE_DEBUG);
	1333	#endif
	1334	p = s->syscall_buf;
	1335	p_end = &s->syscall_buf[sizeof(s->syscall_buf)];
	1336	*(p++) = 'F';
	1337	while (*fmt) {
	1338	if (*fmt == '%') {
	1339	fmt++;
	1340	switch (*fmt++) {
	1341	case 'x':
	1342	addr = va_arg(va, target_ulong);
	1343	p += snprintf(p, p_end - p, TARGET_FMT_lx, addr);
	1344	break;
	1345	case 'l':
	1346	if (*(fmt++) != 'x')
	1347	goto bad_format;
	1348	i64 = va_arg(va, uint64_t);
	1349	p += snprintf(p, p_end - p, "%" PRIx64, i64);
	1350	break;
	1351	case 's':
	1352	addr = va_arg(va, target_ulong);
	1353	p += snprintf(p, p_end - p, TARGET_FMT_lx "/%x",
	1354	addr, va_arg(va, int));
	1355	break;
	1356	default:
	1357	bad_format:
	1358	fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
	1359	fmt - 1);
	1360	break;
	1361	}
	1362	} else {
	1363	(p++) = (fmt++);
	1364	}
	1365	}
	1366	*p = 0;
	1367	#ifdef CONFIG_USER_ONLY
	1368	put_packet(s, s->syscall_buf);
	1369	gdb_handlesig(s->c_cpu, 0);
	1370	#else
	1371	/* In this case wait to send the syscall packet until notification that
	1372	the CPU has stopped. This must be done because if the packet is sent
	1373	now the reply from the syscall request could be received while the CPU
	1374	is still in the running state, which can cause packets to be dropped
	1375	and state transition 'T' packets to be sent while the syscall is still
	1376	being processed. */
	1377	qemu_cpu_kick(s->c_cpu);
	1378	#endif
	1379	}
	1380
	1381	void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
	1382	{
	1383	va_list va;
	1384
	1385	va_start(va, fmt);
	1386	gdb_do_syscallv(cb, fmt, va);
	1387	va_end(va);
	1388	}
	1389
	1390	static void gdb_read_byte(GDBState *s, int ch)
	1391	{
	1392	int i, csum;
	1393	uint8_t reply;
	1394
	1395	#ifndef CONFIG_USER_ONLY
	1396	if (s->last_packet_len) {
	1397	/* Waiting for a response to the last packet. If we see the start
	1398	of a new command then abandon the previous response. */
	1399	if (ch == '-') {
	1400	#ifdef DEBUG_GDB
	1401	printf("Got NACK, retransmitting\n");
	1402	#endif
	1403	put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
	1404	}
	1405	#ifdef DEBUG_GDB
	1406	else if (ch == '+')
	1407	printf("Got ACK\n");
	1408	else
	1409	printf("Got '%c' when expecting ACK/NACK\n", ch);
	1410	#endif
	1411	if (ch == '+' \|\| ch == '$')
	1412	s->last_packet_len = 0;
	1413	if (ch != '$')
	1414	return;
	1415	}
	1416	if (runstate_is_running()) {
	1417	/* when the CPU is running, we cannot do anything except stop
	1418	it when receiving a char */
	1419	vm_stop(RUN_STATE_PAUSED);
	1420	} else
	1421	#endif
	1422	{
	1423	switch(s->state) {
	1424	case RS_IDLE:
	1425	if (ch == '$') {
	1426	s->line_buf_index = 0;
	1427	s->state = RS_GETLINE;
	1428	}
	1429	break;
	1430	case RS_GETLINE:
	1431	if (ch == '#') {
	1432	s->state = RS_CHKSUM1;
	1433	} else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
	1434	s->state = RS_IDLE;
	1435	} else {
	1436	s->line_buf[s->line_buf_index++] = ch;
	1437	}
	1438	break;
	1439	case RS_CHKSUM1:
	1440	s->line_buf[s->line_buf_index] = '\0';
	1441	s->line_csum = fromhex(ch) << 4;
	1442	s->state = RS_CHKSUM2;
	1443	break;
	1444	case RS_CHKSUM2:
	1445	s->line_csum \|= fromhex(ch);
	1446	csum = 0;
	1447	for(i = 0; i < s->line_buf_index; i++) {
	1448	csum += s->line_buf[i];
	1449	}
	1450	if (s->line_csum != (csum & 0xff)) {
	1451	reply = '-';
	1452	put_buffer(s, &reply, 1);
	1453	s->state = RS_IDLE;
	1454	} else {
	1455	reply = '+';
	1456	put_buffer(s, &reply, 1);
	1457	s->state = gdb_handle_packet(s, s->line_buf);
	1458	}
	1459	break;
	1460	default:
	1461	abort();
	1462	}
	1463	}
	1464	}
	1465
	1466	/* Tell the remote gdb that the process has exited. */
	1467	void gdb_exit(CPUArchState *env, int code)
	1468	{
	1469	GDBState *s;
	1470	char buf[4];
	1471
	1472	s = gdbserver_state;
	1473	if (!s) {
	1474	return;
	1475	}
	1476	#ifdef CONFIG_USER_ONLY
	1477	if (gdbserver_fd < 0 \|\| s->fd < 0) {
	1478	return;
	1479	}
	1480	#else
	1481	if (!s->chr) {
	1482	return;
	1483	}
	1484	#endif
	1485
	1486	snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
	1487	put_packet(s, buf);
	1488
	1489	#ifndef CONFIG_USER_ONLY
	1490	qemu_chr_delete(s->chr);
	1491	#endif
	1492	}
	1493
	1494	#ifdef CONFIG_USER_ONLY
	1495	int
	1496	gdb_queuesig (void)
	1497	{
	1498	GDBState *s;
	1499
	1500	s = gdbserver_state;
	1501
	1502	if (gdbserver_fd < 0 \|\| s->fd < 0)
	1503	return 0;
	1504	else
	1505	return 1;
	1506	}
	1507
	1508	int
	1509	gdb_handlesig(CPUState *cpu, int sig)
	1510	{
	1511	GDBState *s;
	1512	char buf[256];
	1513	int n;
	1514
	1515	s = gdbserver_state;
	1516	if (gdbserver_fd < 0 \|\| s->fd < 0) {
	1517	return sig;
	1518	}
	1519
	1520	/* disable single step if it was enabled */
	1521	cpu_single_step(cpu, 0);
	1522	tb_flush(cpu);
	1523
	1524	if (sig != 0) {
	1525	snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));
	1526	put_packet(s, buf);
	1527	}
	1528	/* put_packet() might have detected that the peer terminated the
	1529	connection. */
	1530	if (s->fd < 0) {
	1531	return sig;
	1532	}
	1533
	1534	sig = 0;
	1535	s->state = RS_IDLE;
	1536	s->running_state = 0;
	1537	while (s->running_state == 0) {
	1538	n = read(s->fd, buf, 256);
	1539	if (n > 0) {
	1540	int i;
	1541
	1542	for (i = 0; i < n; i++) {
	1543	gdb_read_byte(s, buf[i]);
	1544	}
	1545	} else if (n == 0 \|\| errno != EAGAIN) {
	1546	/* XXX: Connection closed. Should probably wait for another
	1547	connection before continuing. */
	1548	return sig;
	1549	}
	1550	}
	1551	sig = s->signal;
	1552	s->signal = 0;
	1553	return sig;
	1554	}
	1555
	1556	/* Tell the remote gdb that the process has exited due to SIG. */
	1557	void gdb_signalled(CPUArchState *env, int sig)
	1558	{
	1559	GDBState *s;
	1560	char buf[4];
	1561
	1562	s = gdbserver_state;
	1563	if (gdbserver_fd < 0 \|\| s->fd < 0) {
	1564	return;
	1565	}
	1566
	1567	snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb(sig));
	1568	put_packet(s, buf);
	1569	}
	1570
	1571	static void gdb_accept(void)
	1572	{
	1573	GDBState *s;
	1574	struct sockaddr_in sockaddr;
	1575	socklen_t len;
	1576	int fd;
	1577
	1578	for(;;) {
	1579	len = sizeof(sockaddr);
	1580	fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
	1581	if (fd < 0 && errno != EINTR) {
	1582	perror("accept");
	1583	return;
	1584	} else if (fd >= 0) {
	1585	#ifndef _WIN32
	1586	fcntl(fd, F_SETFD, FD_CLOEXEC);
	1587	#endif
	1588	break;
	1589	}
	1590	}
	1591
	1592	/* set short latency */
	1593	socket_set_nodelay(fd);
	1594
	1595	s = g_malloc0(sizeof(GDBState));
	1596	s->c_cpu = first_cpu;
	1597	s->g_cpu = first_cpu;
	1598	s->fd = fd;
	1599	gdb_has_xml = false;
	1600
	1601	gdbserver_state = s;
	1602
	1603	fcntl(fd, F_SETFL, O_NONBLOCK);
	1604	}
	1605
	1606	static int gdbserver_open(int port)
	1607	{
	1608	struct sockaddr_in sockaddr;
	1609	int fd, ret;
	1610
	1611	fd = socket(PF_INET, SOCK_STREAM, 0);
	1612	if (fd < 0) {
	1613	perror("socket");
	1614	return -1;
	1615	}
	1616	#ifndef _WIN32
	1617	fcntl(fd, F_SETFD, FD_CLOEXEC);
	1618	#endif
	1619
	1620	socket_set_fast_reuse(fd);
	1621
	1622	sockaddr.sin_family = AF_INET;
	1623	sockaddr.sin_port = htons(port);
	1624	sockaddr.sin_addr.s_addr = 0;
	1625	ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
	1626	if (ret < 0) {
	1627	perror("bind");
	1628	close(fd);
	1629	return -1;
	1630	}
	1631	ret = listen(fd, 0);
	1632	if (ret < 0) {
	1633	perror("listen");
	1634	close(fd);
	1635	return -1;
	1636	}
	1637	return fd;
	1638	}
	1639
	1640	int gdbserver_start(int port)
	1641	{
	1642	gdbserver_fd = gdbserver_open(port);
	1643	if (gdbserver_fd < 0)
	1644	return -1;
	1645	/* accept connections */
	1646	gdb_accept();
	1647	return 0;
	1648	}
	1649
	1650	/* Disable gdb stub for child processes. */
	1651	void gdbserver_fork(CPUState *cpu)
	1652	{
	1653	GDBState *s = gdbserver_state;
	1654
	1655	if (gdbserver_fd < 0 \|\| s->fd < 0) {
	1656	return;
	1657	}
	1658	close(s->fd);
	1659	s->fd = -1;
	1660	cpu_breakpoint_remove_all(cpu, BP_GDB);
	1661	cpu_watchpoint_remove_all(cpu, BP_GDB);
	1662	}
	1663	#else
	1664	static int gdb_chr_can_receive(void *opaque)
	1665	{
	1666	/* We can handle an arbitrarily large amount of data.
	1667	Pick the maximum packet size, which is as good as anything. */
	1668	return MAX_PACKET_LENGTH;
	1669	}
	1670
	1671	static void gdb_chr_receive(void opaque, const uint8_t buf, int size)
	1672	{
	1673	int i;
	1674
	1675	for (i = 0; i < size; i++) {
	1676	gdb_read_byte(gdbserver_state, buf[i]);
	1677	}
	1678	}
	1679
	1680	static void gdb_chr_event(void *opaque, int event)
	1681	{
	1682	switch (event) {
	1683	case CHR_EVENT_OPENED:
	1684	vm_stop(RUN_STATE_PAUSED);
	1685	gdb_has_xml = false;
	1686	break;
	1687	default:
	1688	break;
	1689	}
	1690	}
	1691
	1692	static void gdb_monitor_output(GDBState s, const char msg, int len)
	1693	{
	1694	char buf[MAX_PACKET_LENGTH];
	1695
	1696	buf[0] = 'O';
	1697	if (len > (MAX_PACKET_LENGTH/2) - 1)
	1698	len = (MAX_PACKET_LENGTH/2) - 1;
	1699	memtohex(buf + 1, (uint8_t *)msg, len);
	1700	put_packet(s, buf);
	1701	}
	1702
	1703	static int gdb_monitor_write(CharDriverState chr, const uint8_t buf, int len)
	1704	{
	1705	const char p = (const char )buf;
	1706	int max_sz;
	1707
	1708	max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
	1709	for (;;) {
	1710	if (len <= max_sz) {
	1711	gdb_monitor_output(gdbserver_state, p, len);
	1712	break;
	1713	}
	1714	gdb_monitor_output(gdbserver_state, p, max_sz);
	1715	p += max_sz;
	1716	len -= max_sz;
	1717	}
	1718	return len;
	1719	}
	1720
	1721	#ifndef _WIN32
	1722	static void gdb_sigterm_handler(int signal)
	1723	{
	1724	if (runstate_is_running()) {
	1725	vm_stop(RUN_STATE_PAUSED);
	1726	}
	1727	}
	1728	#endif
	1729
	1730	int gdbserver_start(const char *device)
	1731	{
	1732	GDBState *s;
	1733	char gdbstub_device_name[128];
	1734	CharDriverState *chr = NULL;
	1735	CharDriverState *mon_chr;
	1736	ChardevCommon common = { 0 };
	1737
	1738	if (!device)
	1739	return -1;
	1740	if (strcmp(device, "none") != 0) {
	1741	if (strstart(device, "tcp:", NULL)) {
	1742	/* enforce required TCP attributes */
	1743	snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
	1744	"%s,nowait,nodelay,server", device);
	1745	device = gdbstub_device_name;
	1746	}
	1747	#ifndef _WIN32
	1748	else if (strcmp(device, "stdio") == 0) {
	1749	struct sigaction act;
	1750
	1751	memset(&act, 0, sizeof(act));
	1752	act.sa_handler = gdb_sigterm_handler;
	1753	sigaction(SIGINT, &act, NULL);
	1754	}
	1755	#endif
	1756	chr = qemu_chr_new_noreplay("gdb", device, NULL);
	1757	if (!chr)
	1758	return -1;
	1759
	1760	qemu_chr_fe_claim_no_fail(chr);
	1761	qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
	1762	gdb_chr_event, NULL);
	1763	}
	1764
	1765	s = gdbserver_state;
	1766	if (!s) {
	1767	s = g_malloc0(sizeof(GDBState));
	1768	gdbserver_state = s;
	1769
	1770	qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
	1771
	1772	/* Initialize a monitor terminal for gdb */
	1773	mon_chr = qemu_chr_alloc(&common, &error_abort);
	1774	mon_chr->chr_write = gdb_monitor_write;
	1775	monitor_init(mon_chr, 0);
	1776	} else {
	1777	if (s->chr)
	1778	qemu_chr_delete(s->chr);
	1779	mon_chr = s->mon_chr;
	1780	memset(s, 0, sizeof(GDBState));
	1781	}
	1782	s->c_cpu = first_cpu;
	1783	s->g_cpu = first_cpu;
	1784	s->chr = chr;
	1785	s->state = chr ? RS_IDLE : RS_INACTIVE;
	1786	s->mon_chr = mon_chr;
	1787	s->current_syscall_cb = NULL;
	1788
	1789	return 0;
	1790	}
	1791	#endif