xref: /openbmc/qemu/gdbstub/gdbstub.c (revision 72fa42cf)
1 /*
2  * gdb server stub
3  *
4  * This implements a subset of the remote protocol as described in:
5  *
6  *   https://sourceware.org/gdb/onlinedocs/gdb/Remote-Protocol.html
7  *
8  * Copyright (c) 2003-2005 Fabrice Bellard
9  *
10  * This library is free software; you can redistribute it and/or
11  * modify it under the terms of the GNU Lesser General Public
12  * License as published by the Free Software Foundation; either
13  * version 2 of the License, or (at your option) any later version.
14  *
15  * This library is distributed in the hope that it will be useful,
16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
18  * Lesser General Public License for more details.
19  *
20  * You should have received a copy of the GNU Lesser General Public
21  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
22  *
23  * SPDX-License-Identifier: LGPL-2.0+
24  */
25 
26 #include "qemu/osdep.h"
27 #include "qemu/ctype.h"
28 #include "qemu/cutils.h"
29 #include "qemu/module.h"
30 #include "qemu/error-report.h"
31 #include "trace.h"
32 #include "exec/gdbstub.h"
33 #include "gdbstub/syscalls.h"
34 #ifdef CONFIG_USER_ONLY
35 #include "accel/tcg/vcpu-state.h"
36 #include "gdbstub/user.h"
37 #else
38 #include "hw/cpu/cluster.h"
39 #include "hw/boards.h"
40 #endif
41 #include "hw/core/cpu.h"
42 
43 #include "sysemu/hw_accel.h"
44 #include "sysemu/runstate.h"
45 #include "exec/replay-core.h"
46 #include "exec/hwaddr.h"
47 
48 #include "internals.h"
49 
50 typedef struct GDBRegisterState {
51     int base_reg;
52     gdb_get_reg_cb get_reg;
53     gdb_set_reg_cb set_reg;
54     const GDBFeature *feature;
55 } GDBRegisterState;
56 
57 GDBState gdbserver_state;
58 
59 void gdb_init_gdbserver_state(void)
60 {
61     g_assert(!gdbserver_state.init);
62     memset(&gdbserver_state, 0, sizeof(GDBState));
63     gdbserver_state.init = true;
64     gdbserver_state.str_buf = g_string_new(NULL);
65     gdbserver_state.mem_buf = g_byte_array_sized_new(MAX_PACKET_LENGTH);
66     gdbserver_state.last_packet = g_byte_array_sized_new(MAX_PACKET_LENGTH + 4);
67 
68     /*
69      * What single-step modes are supported is accelerator dependent.
70      * By default try to use no IRQs and no timers while single
71      * stepping so as to make single stepping like a typical ICE HW step.
72      */
73     gdbserver_state.supported_sstep_flags = accel_supported_gdbstub_sstep_flags();
74     gdbserver_state.sstep_flags = SSTEP_ENABLE | SSTEP_NOIRQ | SSTEP_NOTIMER;
75     gdbserver_state.sstep_flags &= gdbserver_state.supported_sstep_flags;
76 }
77 
78 /* writes 2*len+1 bytes in buf */
79 void gdb_memtohex(GString *buf, const uint8_t *mem, int len)
80 {
81     int i, c;
82     for(i = 0; i < len; i++) {
83         c = mem[i];
84         g_string_append_c(buf, tohex(c >> 4));
85         g_string_append_c(buf, tohex(c & 0xf));
86     }
87     g_string_append_c(buf, '\0');
88 }
89 
90 void gdb_hextomem(GByteArray *mem, const char *buf, int len)
91 {
92     int i;
93 
94     for(i = 0; i < len; i++) {
95         guint8 byte = fromhex(buf[0]) << 4 | fromhex(buf[1]);
96         g_byte_array_append(mem, &byte, 1);
97         buf += 2;
98     }
99 }
100 
101 static void hexdump(const char *buf, int len,
102                     void (*trace_fn)(size_t ofs, char const *text))
103 {
104     char line_buffer[3 * 16 + 4 + 16 + 1];
105 
106     size_t i;
107     for (i = 0; i < len || (i & 0xF); ++i) {
108         size_t byte_ofs = i & 15;
109 
110         if (byte_ofs == 0) {
111             memset(line_buffer, ' ', 3 * 16 + 4 + 16);
112             line_buffer[3 * 16 + 4 + 16] = 0;
113         }
114 
115         size_t col_group = (i >> 2) & 3;
116         size_t hex_col = byte_ofs * 3 + col_group;
117         size_t txt_col = 3 * 16 + 4 + byte_ofs;
118 
119         if (i < len) {
120             char value = buf[i];
121 
122             line_buffer[hex_col + 0] = tohex((value >> 4) & 0xF);
123             line_buffer[hex_col + 1] = tohex((value >> 0) & 0xF);
124             line_buffer[txt_col + 0] = (value >= ' ' && value < 127)
125                     ? value
126                     : '.';
127         }
128 
129         if (byte_ofs == 0xF)
130             trace_fn(i & -16, line_buffer);
131     }
132 }
133 
134 /* return -1 if error, 0 if OK */
135 int gdb_put_packet_binary(const char *buf, int len, bool dump)
136 {
137     int csum, i;
138     uint8_t footer[3];
139 
140     if (dump && trace_event_get_state_backends(TRACE_GDBSTUB_IO_BINARYREPLY)) {
141         hexdump(buf, len, trace_gdbstub_io_binaryreply);
142     }
143 
144     for(;;) {
145         g_byte_array_set_size(gdbserver_state.last_packet, 0);
146         g_byte_array_append(gdbserver_state.last_packet,
147                             (const uint8_t *) "$", 1);
148         g_byte_array_append(gdbserver_state.last_packet,
149                             (const uint8_t *) buf, len);
150         csum = 0;
151         for(i = 0; i < len; i++) {
152             csum += buf[i];
153         }
154         footer[0] = '#';
155         footer[1] = tohex((csum >> 4) & 0xf);
156         footer[2] = tohex((csum) & 0xf);
157         g_byte_array_append(gdbserver_state.last_packet, footer, 3);
158 
159         gdb_put_buffer(gdbserver_state.last_packet->data,
160                    gdbserver_state.last_packet->len);
161 
162         if (gdb_got_immediate_ack()) {
163             break;
164         }
165     }
166     return 0;
167 }
168 
169 /* return -1 if error, 0 if OK */
170 int gdb_put_packet(const char *buf)
171 {
172     trace_gdbstub_io_reply(buf);
173 
174     return gdb_put_packet_binary(buf, strlen(buf), false);
175 }
176 
177 void gdb_put_strbuf(void)
178 {
179     gdb_put_packet(gdbserver_state.str_buf->str);
180 }
181 
182 /* Encode data using the encoding for 'x' packets.  */
183 void gdb_memtox(GString *buf, const char *mem, int len)
184 {
185     char c;
186 
187     while (len--) {
188         c = *(mem++);
189         switch (c) {
190         case '#': case '$': case '*': case '}':
191             g_string_append_c(buf, '}');
192             g_string_append_c(buf, c ^ 0x20);
193             break;
194         default:
195             g_string_append_c(buf, c);
196             break;
197         }
198     }
199 }
200 
201 static uint32_t gdb_get_cpu_pid(CPUState *cpu)
202 {
203 #ifdef CONFIG_USER_ONLY
204     return getpid();
205 #else
206     if (cpu->cluster_index == UNASSIGNED_CLUSTER_INDEX) {
207         /* Return the default process' PID */
208         int index = gdbserver_state.process_num - 1;
209         return gdbserver_state.processes[index].pid;
210     }
211     return cpu->cluster_index + 1;
212 #endif
213 }
214 
215 GDBProcess *gdb_get_process(uint32_t pid)
216 {
217     int i;
218 
219     if (!pid) {
220         /* 0 means any process, we take the first one */
221         return &gdbserver_state.processes[0];
222     }
223 
224     for (i = 0; i < gdbserver_state.process_num; i++) {
225         if (gdbserver_state.processes[i].pid == pid) {
226             return &gdbserver_state.processes[i];
227         }
228     }
229 
230     return NULL;
231 }
232 
233 static GDBProcess *gdb_get_cpu_process(CPUState *cpu)
234 {
235     return gdb_get_process(gdb_get_cpu_pid(cpu));
236 }
237 
238 static CPUState *find_cpu(uint32_t thread_id)
239 {
240     CPUState *cpu;
241 
242     CPU_FOREACH(cpu) {
243         if (gdb_get_cpu_index(cpu) == thread_id) {
244             return cpu;
245         }
246     }
247 
248     return NULL;
249 }
250 
251 CPUState *gdb_get_first_cpu_in_process(GDBProcess *process)
252 {
253     CPUState *cpu;
254 
255     CPU_FOREACH(cpu) {
256         if (gdb_get_cpu_pid(cpu) == process->pid) {
257             return cpu;
258         }
259     }
260 
261     return NULL;
262 }
263 
264 static CPUState *gdb_next_cpu_in_process(CPUState *cpu)
265 {
266     uint32_t pid = gdb_get_cpu_pid(cpu);
267     cpu = CPU_NEXT(cpu);
268 
269     while (cpu) {
270         if (gdb_get_cpu_pid(cpu) == pid) {
271             break;
272         }
273 
274         cpu = CPU_NEXT(cpu);
275     }
276 
277     return cpu;
278 }
279 
280 /* Return the cpu following @cpu, while ignoring unattached processes. */
281 static CPUState *gdb_next_attached_cpu(CPUState *cpu)
282 {
283     cpu = CPU_NEXT(cpu);
284 
285     while (cpu) {
286         if (gdb_get_cpu_process(cpu)->attached) {
287             break;
288         }
289 
290         cpu = CPU_NEXT(cpu);
291     }
292 
293     return cpu;
294 }
295 
296 /* Return the first attached cpu */
297 CPUState *gdb_first_attached_cpu(void)
298 {
299     CPUState *cpu = first_cpu;
300     GDBProcess *process = gdb_get_cpu_process(cpu);
301 
302     if (!process->attached) {
303         return gdb_next_attached_cpu(cpu);
304     }
305 
306     return cpu;
307 }
308 
309 static CPUState *gdb_get_cpu(uint32_t pid, uint32_t tid)
310 {
311     GDBProcess *process;
312     CPUState *cpu;
313 
314     if (!pid && !tid) {
315         /* 0 means any process/thread, we take the first attached one */
316         return gdb_first_attached_cpu();
317     } else if (pid && !tid) {
318         /* any thread in a specific process */
319         process = gdb_get_process(pid);
320 
321         if (process == NULL) {
322             return NULL;
323         }
324 
325         if (!process->attached) {
326             return NULL;
327         }
328 
329         return gdb_get_first_cpu_in_process(process);
330     } else {
331         /* a specific thread */
332         cpu = find_cpu(tid);
333 
334         if (cpu == NULL) {
335             return NULL;
336         }
337 
338         process = gdb_get_cpu_process(cpu);
339 
340         if (pid && process->pid != pid) {
341             return NULL;
342         }
343 
344         if (!process->attached) {
345             return NULL;
346         }
347 
348         return cpu;
349     }
350 }
351 
352 static const char *get_feature_xml(const char *p, const char **newp,
353                                    GDBProcess *process)
354 {
355     CPUState *cpu = gdb_get_first_cpu_in_process(process);
356     CPUClass *cc = CPU_GET_CLASS(cpu);
357     GDBRegisterState *r;
358     size_t len;
359 
360     /*
361      * qXfer:features:read:ANNEX:OFFSET,LENGTH'
362      *                     ^p    ^newp
363      */
364     char *term = strchr(p, ':');
365     *newp = term + 1;
366     len = term - p;
367 
368     /* Is it the main target xml? */
369     if (strncmp(p, "target.xml", len) == 0) {
370         if (!process->target_xml) {
371             g_autoptr(GPtrArray) xml = g_ptr_array_new_with_free_func(g_free);
372 
373             g_ptr_array_add(
374                 xml,
375                 g_strdup("<?xml version=\"1.0\"?>"
376                          "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
377                          "<target>"));
378 
379             if (cc->gdb_arch_name) {
380                 g_ptr_array_add(
381                     xml,
382                     g_markup_printf_escaped("<architecture>%s</architecture>",
383                                             cc->gdb_arch_name(cpu)));
384             }
385             for (guint i = 0; i < cpu->gdb_regs->len; i++) {
386                 r = &g_array_index(cpu->gdb_regs, GDBRegisterState, i);
387                 g_ptr_array_add(
388                     xml,
389                     g_markup_printf_escaped("<xi:include href=\"%s\"/>",
390                                             r->feature->xmlname));
391             }
392             g_ptr_array_add(xml, g_strdup("</target>"));
393             g_ptr_array_add(xml, NULL);
394 
395             process->target_xml = g_strjoinv(NULL, (void *)xml->pdata);
396         }
397         return process->target_xml;
398     }
399     /* Is it one of the features? */
400     for (guint i = 0; i < cpu->gdb_regs->len; i++) {
401         r = &g_array_index(cpu->gdb_regs, GDBRegisterState, i);
402         if (strncmp(p, r->feature->xmlname, len) == 0) {
403             return r->feature->xml;
404         }
405     }
406 
407     /* failed */
408     return NULL;
409 }
410 
411 void gdb_feature_builder_init(GDBFeatureBuilder *builder, GDBFeature *feature,
412                               const char *name, const char *xmlname,
413                               int base_reg)
414 {
415     char *header = g_markup_printf_escaped(
416         "<?xml version=\"1.0\"?>"
417         "<!DOCTYPE feature SYSTEM \"gdb-target.dtd\">"
418         "<feature name=\"%s\">",
419         name);
420 
421     builder->feature = feature;
422     builder->xml = g_ptr_array_new();
423     g_ptr_array_add(builder->xml, header);
424     builder->regs = g_ptr_array_new();
425     builder->base_reg = base_reg;
426     feature->xmlname = xmlname;
427     feature->name = name;
428 }
429 
430 void gdb_feature_builder_append_tag(const GDBFeatureBuilder *builder,
431                                     const char *format, ...)
432 {
433     va_list ap;
434     va_start(ap, format);
435     g_ptr_array_add(builder->xml, g_markup_vprintf_escaped(format, ap));
436     va_end(ap);
437 }
438 
439 void gdb_feature_builder_append_reg(const GDBFeatureBuilder *builder,
440                                     const char *name,
441                                     int bitsize,
442                                     int regnum,
443                                     const char *type,
444                                     const char *group)
445 {
446     if (builder->regs->len <= regnum) {
447         g_ptr_array_set_size(builder->regs, regnum + 1);
448     }
449 
450     builder->regs->pdata[regnum] = (gpointer *)name;
451 
452     if (group) {
453         gdb_feature_builder_append_tag(
454             builder,
455             "<reg name=\"%s\" bitsize=\"%d\" regnum=\"%d\" type=\"%s\" group=\"%s\"/>",
456             name, bitsize, builder->base_reg + regnum, type, group);
457     } else {
458         gdb_feature_builder_append_tag(
459             builder,
460             "<reg name=\"%s\" bitsize=\"%d\" regnum=\"%d\" type=\"%s\"/>",
461             name, bitsize, builder->base_reg + regnum, type);
462     }
463 }
464 
465 void gdb_feature_builder_end(const GDBFeatureBuilder *builder)
466 {
467     g_ptr_array_add(builder->xml, (void *)"</feature>");
468     g_ptr_array_add(builder->xml, NULL);
469 
470     builder->feature->xml = g_strjoinv(NULL, (void *)builder->xml->pdata);
471 
472     for (guint i = 0; i < builder->xml->len - 2; i++) {
473         g_free(g_ptr_array_index(builder->xml, i));
474     }
475 
476     g_ptr_array_free(builder->xml, TRUE);
477 
478     builder->feature->num_regs = builder->regs->len;
479     builder->feature->regs = (void *)g_ptr_array_free(builder->regs, FALSE);
480 }
481 
482 const GDBFeature *gdb_find_static_feature(const char *xmlname)
483 {
484     const GDBFeature *feature;
485 
486     for (feature = gdb_static_features; feature->xmlname; feature++) {
487         if (!strcmp(feature->xmlname, xmlname)) {
488             return feature;
489         }
490     }
491 
492     g_assert_not_reached();
493 }
494 
495 GArray *gdb_get_register_list(CPUState *cpu)
496 {
497     GArray *results = g_array_new(true, true, sizeof(GDBRegDesc));
498 
499     /* registers are only available once the CPU is initialised */
500     if (!cpu->gdb_regs) {
501         return results;
502     }
503 
504     for (int f = 0; f < cpu->gdb_regs->len; f++) {
505         GDBRegisterState *r = &g_array_index(cpu->gdb_regs, GDBRegisterState, f);
506         for (int i = 0; i < r->feature->num_regs; i++) {
507             const char *name = r->feature->regs[i];
508             GDBRegDesc desc = {
509                 r->base_reg + i,
510                 name,
511                 r->feature->name
512             };
513             g_array_append_val(results, desc);
514         }
515     }
516 
517     return results;
518 }
519 
520 int gdb_read_register(CPUState *cpu, GByteArray *buf, int reg)
521 {
522     CPUClass *cc = CPU_GET_CLASS(cpu);
523     GDBRegisterState *r;
524 
525     if (reg < cc->gdb_num_core_regs) {
526         return cc->gdb_read_register(cpu, buf, reg);
527     }
528 
529     for (guint i = 0; i < cpu->gdb_regs->len; i++) {
530         r = &g_array_index(cpu->gdb_regs, GDBRegisterState, i);
531         if (r->base_reg <= reg && reg < r->base_reg + r->feature->num_regs) {
532             return r->get_reg(cpu, buf, reg - r->base_reg);
533         }
534     }
535     return 0;
536 }
537 
538 static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
539 {
540     CPUClass *cc = CPU_GET_CLASS(cpu);
541     GDBRegisterState *r;
542 
543     if (reg < cc->gdb_num_core_regs) {
544         return cc->gdb_write_register(cpu, mem_buf, reg);
545     }
546 
547     for (guint i = 0; i < cpu->gdb_regs->len; i++) {
548         r =  &g_array_index(cpu->gdb_regs, GDBRegisterState, i);
549         if (r->base_reg <= reg && reg < r->base_reg + r->feature->num_regs) {
550             return r->set_reg(cpu, mem_buf, reg - r->base_reg);
551         }
552     }
553     return 0;
554 }
555 
556 static void gdb_register_feature(CPUState *cpu, int base_reg,
557                                  gdb_get_reg_cb get_reg, gdb_set_reg_cb set_reg,
558                                  const GDBFeature *feature)
559 {
560     GDBRegisterState s = {
561         .base_reg = base_reg,
562         .get_reg = get_reg,
563         .set_reg = set_reg,
564         .feature = feature
565     };
566 
567     g_array_append_val(cpu->gdb_regs, s);
568 }
569 
570 void gdb_init_cpu(CPUState *cpu)
571 {
572     CPUClass *cc = CPU_GET_CLASS(cpu);
573     const GDBFeature *feature;
574 
575     cpu->gdb_regs = g_array_new(false, false, sizeof(GDBRegisterState));
576 
577     if (cc->gdb_core_xml_file) {
578         feature = gdb_find_static_feature(cc->gdb_core_xml_file);
579         gdb_register_feature(cpu, 0,
580                              cc->gdb_read_register, cc->gdb_write_register,
581                              feature);
582         cpu->gdb_num_regs = cpu->gdb_num_g_regs = feature->num_regs;
583     }
584 
585     if (cc->gdb_num_core_regs) {
586         cpu->gdb_num_regs = cpu->gdb_num_g_regs = cc->gdb_num_core_regs;
587     }
588 }
589 
590 void gdb_register_coprocessor(CPUState *cpu,
591                               gdb_get_reg_cb get_reg, gdb_set_reg_cb set_reg,
592                               const GDBFeature *feature, int g_pos)
593 {
594     GDBRegisterState *s;
595     guint i;
596     int base_reg = cpu->gdb_num_regs;
597 
598     for (i = 0; i < cpu->gdb_regs->len; i++) {
599         /* Check for duplicates.  */
600         s = &g_array_index(cpu->gdb_regs, GDBRegisterState, i);
601         if (s->feature == feature) {
602             return;
603         }
604     }
605 
606     gdb_register_feature(cpu, base_reg, get_reg, set_reg, feature);
607 
608     /* Add to end of list.  */
609     cpu->gdb_num_regs += feature->num_regs;
610     if (g_pos) {
611         if (g_pos != base_reg) {
612             error_report("Error: Bad gdb register numbering for '%s', "
613                          "expected %d got %d", feature->xml, g_pos, base_reg);
614         } else {
615             cpu->gdb_num_g_regs = cpu->gdb_num_regs;
616         }
617     }
618 }
619 
620 static void gdb_process_breakpoint_remove_all(GDBProcess *p)
621 {
622     CPUState *cpu = gdb_get_first_cpu_in_process(p);
623 
624     while (cpu) {
625         gdb_breakpoint_remove_all(cpu);
626         cpu = gdb_next_cpu_in_process(cpu);
627     }
628 }
629 
630 
631 static void gdb_set_cpu_pc(vaddr pc)
632 {
633     CPUState *cpu = gdbserver_state.c_cpu;
634 
635     cpu_synchronize_state(cpu);
636     cpu_set_pc(cpu, pc);
637 }
638 
639 void gdb_append_thread_id(CPUState *cpu, GString *buf)
640 {
641     if (gdbserver_state.multiprocess) {
642         g_string_append_printf(buf, "p%02x.%02x",
643                                gdb_get_cpu_pid(cpu), gdb_get_cpu_index(cpu));
644     } else {
645         g_string_append_printf(buf, "%02x", gdb_get_cpu_index(cpu));
646     }
647 }
648 
649 static GDBThreadIdKind read_thread_id(const char *buf, const char **end_buf,
650                                       uint32_t *pid, uint32_t *tid)
651 {
652     unsigned long p, t;
653     int ret;
654 
655     if (*buf == 'p') {
656         buf++;
657         ret = qemu_strtoul(buf, &buf, 16, &p);
658 
659         if (ret) {
660             return GDB_READ_THREAD_ERR;
661         }
662 
663         /* Skip '.' */
664         buf++;
665     } else {
666         p = 0;
667     }
668 
669     ret = qemu_strtoul(buf, &buf, 16, &t);
670 
671     if (ret) {
672         return GDB_READ_THREAD_ERR;
673     }
674 
675     *end_buf = buf;
676 
677     if (p == -1) {
678         return GDB_ALL_PROCESSES;
679     }
680 
681     if (pid) {
682         *pid = p;
683     }
684 
685     if (t == -1) {
686         return GDB_ALL_THREADS;
687     }
688 
689     if (tid) {
690         *tid = t;
691     }
692 
693     return GDB_ONE_THREAD;
694 }
695 
696 /**
697  * gdb_handle_vcont - Parses and handles a vCont packet.
698  * returns -ENOTSUP if a command is unsupported, -EINVAL or -ERANGE if there is
699  *         a format error, 0 on success.
700  */
701 static int gdb_handle_vcont(const char *p)
702 {
703     int res, signal = 0;
704     char cur_action;
705     unsigned long tmp;
706     uint32_t pid, tid;
707     GDBProcess *process;
708     CPUState *cpu;
709     GDBThreadIdKind kind;
710     unsigned int max_cpus = gdb_get_max_cpus();
711     /* uninitialised CPUs stay 0 */
712     g_autofree char *newstates = g_new0(char, max_cpus);
713 
714     /* mark valid CPUs with 1 */
715     CPU_FOREACH(cpu) {
716         newstates[cpu->cpu_index] = 1;
717     }
718 
719     /*
720      * res keeps track of what error we are returning, with -ENOTSUP meaning
721      * that the command is unknown or unsupported, thus returning an empty
722      * packet, while -EINVAL and -ERANGE cause an E22 packet, due to invalid,
723      *  or incorrect parameters passed.
724      */
725     res = 0;
726 
727     /*
728      * target_count and last_target keep track of how many CPUs we are going to
729      * step or resume, and a pointer to the state structure of one of them,
730      * respectively
731      */
732     int target_count = 0;
733     CPUState *last_target = NULL;
734 
735     while (*p) {
736         if (*p++ != ';') {
737             return -ENOTSUP;
738         }
739 
740         cur_action = *p++;
741         if (cur_action == 'C' || cur_action == 'S') {
742             cur_action = qemu_tolower(cur_action);
743             res = qemu_strtoul(p, &p, 16, &tmp);
744             if (res) {
745                 return res;
746             }
747             signal = gdb_signal_to_target(tmp);
748         } else if (cur_action != 'c' && cur_action != 's') {
749             /* unknown/invalid/unsupported command */
750             return -ENOTSUP;
751         }
752 
753         if (*p == '\0' || *p == ';') {
754             /*
755              * No thread specifier, action is on "all threads". The
756              * specification is unclear regarding the process to act on. We
757              * choose all processes.
758              */
759             kind = GDB_ALL_PROCESSES;
760         } else if (*p++ == ':') {
761             kind = read_thread_id(p, &p, &pid, &tid);
762         } else {
763             return -ENOTSUP;
764         }
765 
766         switch (kind) {
767         case GDB_READ_THREAD_ERR:
768             return -EINVAL;
769 
770         case GDB_ALL_PROCESSES:
771             cpu = gdb_first_attached_cpu();
772             while (cpu) {
773                 if (newstates[cpu->cpu_index] == 1) {
774                     newstates[cpu->cpu_index] = cur_action;
775 
776                     target_count++;
777                     last_target = cpu;
778                 }
779 
780                 cpu = gdb_next_attached_cpu(cpu);
781             }
782             break;
783 
784         case GDB_ALL_THREADS:
785             process = gdb_get_process(pid);
786 
787             if (!process->attached) {
788                 return -EINVAL;
789             }
790 
791             cpu = gdb_get_first_cpu_in_process(process);
792             while (cpu) {
793                 if (newstates[cpu->cpu_index] == 1) {
794                     newstates[cpu->cpu_index] = cur_action;
795 
796                     target_count++;
797                     last_target = cpu;
798                 }
799 
800                 cpu = gdb_next_cpu_in_process(cpu);
801             }
802             break;
803 
804         case GDB_ONE_THREAD:
805             cpu = gdb_get_cpu(pid, tid);
806 
807             /* invalid CPU/thread specified */
808             if (!cpu) {
809                 return -EINVAL;
810             }
811 
812             /* only use if no previous match occourred */
813             if (newstates[cpu->cpu_index] == 1) {
814                 newstates[cpu->cpu_index] = cur_action;
815 
816                 target_count++;
817                 last_target = cpu;
818             }
819             break;
820         }
821     }
822 
823     /*
824      * if we're about to resume a specific set of CPUs/threads, make it so that
825      * in case execution gets interrupted, we can send GDB a stop reply with a
826      * correct value. it doesn't really matter which CPU we tell GDB the signal
827      * happened in (VM pauses stop all of them anyway), so long as it is one of
828      * the ones we resumed/single stepped here.
829      */
830     if (target_count > 0) {
831         gdbserver_state.c_cpu = last_target;
832     }
833 
834     gdbserver_state.signal = signal;
835     gdb_continue_partial(newstates);
836     return res;
837 }
838 
839 static const char *cmd_next_param(const char *param, const char delimiter)
840 {
841     static const char all_delimiters[] = ",;:=";
842     char curr_delimiters[2] = {0};
843     const char *delimiters;
844 
845     if (delimiter == '?') {
846         delimiters = all_delimiters;
847     } else if (delimiter == '0') {
848         return strchr(param, '\0');
849     } else if (delimiter == '.' && *param) {
850         return param + 1;
851     } else {
852         curr_delimiters[0] = delimiter;
853         delimiters = curr_delimiters;
854     }
855 
856     param += strcspn(param, delimiters);
857     if (*param) {
858         param++;
859     }
860     return param;
861 }
862 
863 static int cmd_parse_params(const char *data, const char *schema,
864                             GArray *params)
865 {
866     const char *curr_schema, *curr_data;
867 
868     g_assert(schema);
869     g_assert(params->len == 0);
870 
871     curr_schema = schema;
872     curr_data = data;
873     while (curr_schema[0] && curr_schema[1] && *curr_data) {
874         GdbCmdVariant this_param;
875 
876         switch (curr_schema[0]) {
877         case 'l':
878             if (qemu_strtoul(curr_data, &curr_data, 16,
879                              &this_param.val_ul)) {
880                 return -EINVAL;
881             }
882             curr_data = cmd_next_param(curr_data, curr_schema[1]);
883             g_array_append_val(params, this_param);
884             break;
885         case 'L':
886             if (qemu_strtou64(curr_data, &curr_data, 16,
887                               (uint64_t *)&this_param.val_ull)) {
888                 return -EINVAL;
889             }
890             curr_data = cmd_next_param(curr_data, curr_schema[1]);
891             g_array_append_val(params, this_param);
892             break;
893         case 's':
894             this_param.data = curr_data;
895             curr_data = cmd_next_param(curr_data, curr_schema[1]);
896             g_array_append_val(params, this_param);
897             break;
898         case 'o':
899             this_param.opcode = *(uint8_t *)curr_data;
900             curr_data = cmd_next_param(curr_data, curr_schema[1]);
901             g_array_append_val(params, this_param);
902             break;
903         case 't':
904             this_param.thread_id.kind =
905                 read_thread_id(curr_data, &curr_data,
906                                &this_param.thread_id.pid,
907                                &this_param.thread_id.tid);
908             curr_data = cmd_next_param(curr_data, curr_schema[1]);
909             g_array_append_val(params, this_param);
910             break;
911         case '?':
912             curr_data = cmd_next_param(curr_data, curr_schema[1]);
913             break;
914         default:
915             return -EINVAL;
916         }
917         curr_schema += 2;
918     }
919 
920     return 0;
921 }
922 
923 typedef void (*GdbCmdHandler)(GArray *params, void *user_ctx);
924 
925 /*
926  * cmd_startswith -> cmd is compared using startswith
927  *
928  * allow_stop_reply -> true iff the gdbstub can respond to this command with a
929  *   "stop reply" packet. The list of commands that accept such response is
930  *   defined at the GDB Remote Serial Protocol documentation. see:
931  *   https://sourceware.org/gdb/onlinedocs/gdb/Stop-Reply-Packets.html#Stop-Reply-Packets.
932  *
933  * schema definitions:
934  * Each schema parameter entry consists of 2 chars,
935  * the first char represents the parameter type handling
936  * the second char represents the delimiter for the next parameter
937  *
938  * Currently supported schema types:
939  * 'l' -> unsigned long (stored in .val_ul)
940  * 'L' -> unsigned long long (stored in .val_ull)
941  * 's' -> string (stored in .data)
942  * 'o' -> single char (stored in .opcode)
943  * 't' -> thread id (stored in .thread_id)
944  * '?' -> skip according to delimiter
945  *
946  * Currently supported delimiters:
947  * '?' -> Stop at any delimiter (",;:=\0")
948  * '0' -> Stop at "\0"
949  * '.' -> Skip 1 char unless reached "\0"
950  * Any other value is treated as the delimiter value itself
951  */
952 typedef struct GdbCmdParseEntry {
953     GdbCmdHandler handler;
954     const char *cmd;
955     bool cmd_startswith;
956     const char *schema;
957     bool allow_stop_reply;
958 } GdbCmdParseEntry;
959 
960 static inline int startswith(const char *string, const char *pattern)
961 {
962   return !strncmp(string, pattern, strlen(pattern));
963 }
964 
965 static int process_string_cmd(const char *data,
966                               const GdbCmdParseEntry *cmds, int num_cmds)
967 {
968     int i;
969     g_autoptr(GArray) params = g_array_new(false, true, sizeof(GdbCmdVariant));
970 
971     if (!cmds) {
972         return -1;
973     }
974 
975     for (i = 0; i < num_cmds; i++) {
976         const GdbCmdParseEntry *cmd = &cmds[i];
977         g_assert(cmd->handler && cmd->cmd);
978 
979         if ((cmd->cmd_startswith && !startswith(data, cmd->cmd)) ||
980             (!cmd->cmd_startswith && strcmp(cmd->cmd, data))) {
981             continue;
982         }
983 
984         if (cmd->schema) {
985             if (cmd_parse_params(&data[strlen(cmd->cmd)],
986                                  cmd->schema, params)) {
987                 return -1;
988             }
989         }
990 
991         gdbserver_state.allow_stop_reply = cmd->allow_stop_reply;
992         cmd->handler(params, NULL);
993         return 0;
994     }
995 
996     return -1;
997 }
998 
999 static void run_cmd_parser(const char *data, const GdbCmdParseEntry *cmd)
1000 {
1001     if (!data) {
1002         return;
1003     }
1004 
1005     g_string_set_size(gdbserver_state.str_buf, 0);
1006     g_byte_array_set_size(gdbserver_state.mem_buf, 0);
1007 
1008     /* In case there was an error during the command parsing we must
1009     * send a NULL packet to indicate the command is not supported */
1010     if (process_string_cmd(data, cmd, 1)) {
1011         gdb_put_packet("");
1012     }
1013 }
1014 
1015 static void handle_detach(GArray *params, void *user_ctx)
1016 {
1017     GDBProcess *process;
1018     uint32_t pid = 1;
1019 
1020     if (gdbserver_state.multiprocess) {
1021         if (!params->len) {
1022             gdb_put_packet("E22");
1023             return;
1024         }
1025 
1026         pid = get_param(params, 0)->val_ul;
1027     }
1028 
1029 #ifdef CONFIG_USER_ONLY
1030     if (gdb_handle_detach_user(pid)) {
1031         return;
1032     }
1033 #endif
1034 
1035     process = gdb_get_process(pid);
1036     gdb_process_breakpoint_remove_all(process);
1037     process->attached = false;
1038 
1039     if (pid == gdb_get_cpu_pid(gdbserver_state.c_cpu)) {
1040         gdbserver_state.c_cpu = gdb_first_attached_cpu();
1041     }
1042 
1043     if (pid == gdb_get_cpu_pid(gdbserver_state.g_cpu)) {
1044         gdbserver_state.g_cpu = gdb_first_attached_cpu();
1045     }
1046 
1047     if (!gdbserver_state.c_cpu) {
1048         /* No more process attached */
1049         gdb_disable_syscalls();
1050         gdb_continue();
1051     }
1052     gdb_put_packet("OK");
1053 }
1054 
1055 static void handle_thread_alive(GArray *params, void *user_ctx)
1056 {
1057     CPUState *cpu;
1058 
1059     if (!params->len) {
1060         gdb_put_packet("E22");
1061         return;
1062     }
1063 
1064     if (get_param(params, 0)->thread_id.kind == GDB_READ_THREAD_ERR) {
1065         gdb_put_packet("E22");
1066         return;
1067     }
1068 
1069     cpu = gdb_get_cpu(get_param(params, 0)->thread_id.pid,
1070                       get_param(params, 0)->thread_id.tid);
1071     if (!cpu) {
1072         gdb_put_packet("E22");
1073         return;
1074     }
1075 
1076     gdb_put_packet("OK");
1077 }
1078 
1079 static void handle_continue(GArray *params, void *user_ctx)
1080 {
1081     if (params->len) {
1082         gdb_set_cpu_pc(get_param(params, 0)->val_ull);
1083     }
1084 
1085     gdbserver_state.signal = 0;
1086     gdb_continue();
1087 }
1088 
1089 static void handle_cont_with_sig(GArray *params, void *user_ctx)
1090 {
1091     unsigned long signal = 0;
1092 
1093     /*
1094      * Note: C sig;[addr] is currently unsupported and we simply
1095      *       omit the addr parameter
1096      */
1097     if (params->len) {
1098         signal = get_param(params, 0)->val_ul;
1099     }
1100 
1101     gdbserver_state.signal = gdb_signal_to_target(signal);
1102     if (gdbserver_state.signal == -1) {
1103         gdbserver_state.signal = 0;
1104     }
1105     gdb_continue();
1106 }
1107 
1108 static void handle_set_thread(GArray *params, void *user_ctx)
1109 {
1110     uint32_t pid, tid;
1111     CPUState *cpu;
1112 
1113     if (params->len != 2) {
1114         gdb_put_packet("E22");
1115         return;
1116     }
1117 
1118     if (get_param(params, 1)->thread_id.kind == GDB_READ_THREAD_ERR) {
1119         gdb_put_packet("E22");
1120         return;
1121     }
1122 
1123     if (get_param(params, 1)->thread_id.kind != GDB_ONE_THREAD) {
1124         gdb_put_packet("OK");
1125         return;
1126     }
1127 
1128     pid = get_param(params, 1)->thread_id.pid;
1129     tid = get_param(params, 1)->thread_id.tid;
1130 #ifdef CONFIG_USER_ONLY
1131     if (gdb_handle_set_thread_user(pid, tid)) {
1132         return;
1133     }
1134 #endif
1135     cpu = gdb_get_cpu(pid, tid);
1136     if (!cpu) {
1137         gdb_put_packet("E22");
1138         return;
1139     }
1140 
1141     /*
1142      * Note: This command is deprecated and modern gdb's will be using the
1143      *       vCont command instead.
1144      */
1145     switch (get_param(params, 0)->opcode) {
1146     case 'c':
1147         gdbserver_state.c_cpu = cpu;
1148         gdb_put_packet("OK");
1149         break;
1150     case 'g':
1151         gdbserver_state.g_cpu = cpu;
1152         gdb_put_packet("OK");
1153         break;
1154     default:
1155         gdb_put_packet("E22");
1156         break;
1157     }
1158 }
1159 
1160 static void handle_insert_bp(GArray *params, void *user_ctx)
1161 {
1162     int res;
1163 
1164     if (params->len != 3) {
1165         gdb_put_packet("E22");
1166         return;
1167     }
1168 
1169     res = gdb_breakpoint_insert(gdbserver_state.c_cpu,
1170                                 get_param(params, 0)->val_ul,
1171                                 get_param(params, 1)->val_ull,
1172                                 get_param(params, 2)->val_ull);
1173     if (res >= 0) {
1174         gdb_put_packet("OK");
1175         return;
1176     } else if (res == -ENOSYS) {
1177         gdb_put_packet("");
1178         return;
1179     }
1180 
1181     gdb_put_packet("E22");
1182 }
1183 
1184 static void handle_remove_bp(GArray *params, void *user_ctx)
1185 {
1186     int res;
1187 
1188     if (params->len != 3) {
1189         gdb_put_packet("E22");
1190         return;
1191     }
1192 
1193     res = gdb_breakpoint_remove(gdbserver_state.c_cpu,
1194                                 get_param(params, 0)->val_ul,
1195                                 get_param(params, 1)->val_ull,
1196                                 get_param(params, 2)->val_ull);
1197     if (res >= 0) {
1198         gdb_put_packet("OK");
1199         return;
1200     } else if (res == -ENOSYS) {
1201         gdb_put_packet("");
1202         return;
1203     }
1204 
1205     gdb_put_packet("E22");
1206 }
1207 
1208 /*
1209  * handle_set/get_reg
1210  *
1211  * Older gdb are really dumb, and don't use 'G/g' if 'P/p' is available.
1212  * This works, but can be very slow. Anything new enough to understand
1213  * XML also knows how to use this properly. However to use this we
1214  * need to define a local XML file as well as be talking to a
1215  * reasonably modern gdb. Responding with an empty packet will cause
1216  * the remote gdb to fallback to older methods.
1217  */
1218 
1219 static void handle_set_reg(GArray *params, void *user_ctx)
1220 {
1221     int reg_size;
1222 
1223     if (params->len != 2) {
1224         gdb_put_packet("E22");
1225         return;
1226     }
1227 
1228     reg_size = strlen(get_param(params, 1)->data) / 2;
1229     gdb_hextomem(gdbserver_state.mem_buf, get_param(params, 1)->data, reg_size);
1230     gdb_write_register(gdbserver_state.g_cpu, gdbserver_state.mem_buf->data,
1231                        get_param(params, 0)->val_ull);
1232     gdb_put_packet("OK");
1233 }
1234 
1235 static void handle_get_reg(GArray *params, void *user_ctx)
1236 {
1237     int reg_size;
1238 
1239     if (!params->len) {
1240         gdb_put_packet("E14");
1241         return;
1242     }
1243 
1244     reg_size = gdb_read_register(gdbserver_state.g_cpu,
1245                                  gdbserver_state.mem_buf,
1246                                  get_param(params, 0)->val_ull);
1247     if (!reg_size) {
1248         gdb_put_packet("E14");
1249         return;
1250     } else {
1251         g_byte_array_set_size(gdbserver_state.mem_buf, reg_size);
1252     }
1253 
1254     gdb_memtohex(gdbserver_state.str_buf,
1255                  gdbserver_state.mem_buf->data, reg_size);
1256     gdb_put_strbuf();
1257 }
1258 
1259 static void handle_write_mem(GArray *params, void *user_ctx)
1260 {
1261     if (params->len != 3) {
1262         gdb_put_packet("E22");
1263         return;
1264     }
1265 
1266     /* gdb_hextomem() reads 2*len bytes */
1267     if (get_param(params, 1)->val_ull >
1268         strlen(get_param(params, 2)->data) / 2) {
1269         gdb_put_packet("E22");
1270         return;
1271     }
1272 
1273     gdb_hextomem(gdbserver_state.mem_buf, get_param(params, 2)->data,
1274                  get_param(params, 1)->val_ull);
1275     if (gdb_target_memory_rw_debug(gdbserver_state.g_cpu,
1276                                    get_param(params, 0)->val_ull,
1277                                    gdbserver_state.mem_buf->data,
1278                                    gdbserver_state.mem_buf->len, true)) {
1279         gdb_put_packet("E14");
1280         return;
1281     }
1282 
1283     gdb_put_packet("OK");
1284 }
1285 
1286 static void handle_read_mem(GArray *params, void *user_ctx)
1287 {
1288     if (params->len != 2) {
1289         gdb_put_packet("E22");
1290         return;
1291     }
1292 
1293     /* gdb_memtohex() doubles the required space */
1294     if (get_param(params, 1)->val_ull > MAX_PACKET_LENGTH / 2) {
1295         gdb_put_packet("E22");
1296         return;
1297     }
1298 
1299     g_byte_array_set_size(gdbserver_state.mem_buf,
1300                           get_param(params, 1)->val_ull);
1301 
1302     if (gdb_target_memory_rw_debug(gdbserver_state.g_cpu,
1303                                    get_param(params, 0)->val_ull,
1304                                    gdbserver_state.mem_buf->data,
1305                                    gdbserver_state.mem_buf->len, false)) {
1306         gdb_put_packet("E14");
1307         return;
1308     }
1309 
1310     gdb_memtohex(gdbserver_state.str_buf, gdbserver_state.mem_buf->data,
1311              gdbserver_state.mem_buf->len);
1312     gdb_put_strbuf();
1313 }
1314 
1315 static void handle_write_all_regs(GArray *params, void *user_ctx)
1316 {
1317     int reg_id;
1318     size_t len;
1319     uint8_t *registers;
1320     int reg_size;
1321 
1322     if (!params->len) {
1323         return;
1324     }
1325 
1326     cpu_synchronize_state(gdbserver_state.g_cpu);
1327     len = strlen(get_param(params, 0)->data) / 2;
1328     gdb_hextomem(gdbserver_state.mem_buf, get_param(params, 0)->data, len);
1329     registers = gdbserver_state.mem_buf->data;
1330     for (reg_id = 0;
1331          reg_id < gdbserver_state.g_cpu->gdb_num_g_regs && len > 0;
1332          reg_id++) {
1333         reg_size = gdb_write_register(gdbserver_state.g_cpu, registers, reg_id);
1334         len -= reg_size;
1335         registers += reg_size;
1336     }
1337     gdb_put_packet("OK");
1338 }
1339 
1340 static void handle_read_all_regs(GArray *params, void *user_ctx)
1341 {
1342     int reg_id;
1343     size_t len;
1344 
1345     cpu_synchronize_state(gdbserver_state.g_cpu);
1346     g_byte_array_set_size(gdbserver_state.mem_buf, 0);
1347     len = 0;
1348     for (reg_id = 0; reg_id < gdbserver_state.g_cpu->gdb_num_g_regs; reg_id++) {
1349         len += gdb_read_register(gdbserver_state.g_cpu,
1350                                  gdbserver_state.mem_buf,
1351                                  reg_id);
1352     }
1353     g_assert(len == gdbserver_state.mem_buf->len);
1354 
1355     gdb_memtohex(gdbserver_state.str_buf, gdbserver_state.mem_buf->data, len);
1356     gdb_put_strbuf();
1357 }
1358 
1359 
1360 static void handle_step(GArray *params, void *user_ctx)
1361 {
1362     if (params->len) {
1363         gdb_set_cpu_pc(get_param(params, 0)->val_ull);
1364     }
1365 
1366     cpu_single_step(gdbserver_state.c_cpu, gdbserver_state.sstep_flags);
1367     gdb_continue();
1368 }
1369 
1370 static void handle_backward(GArray *params, void *user_ctx)
1371 {
1372     if (!gdb_can_reverse()) {
1373         gdb_put_packet("E22");
1374     }
1375     if (params->len == 1) {
1376         switch (get_param(params, 0)->opcode) {
1377         case 's':
1378             if (replay_reverse_step()) {
1379                 gdb_continue();
1380             } else {
1381                 gdb_put_packet("E14");
1382             }
1383             return;
1384         case 'c':
1385             if (replay_reverse_continue()) {
1386                 gdb_continue();
1387             } else {
1388                 gdb_put_packet("E14");
1389             }
1390             return;
1391         }
1392     }
1393 
1394     /* Default invalid command */
1395     gdb_put_packet("");
1396 }
1397 
1398 static void handle_v_cont_query(GArray *params, void *user_ctx)
1399 {
1400     gdb_put_packet("vCont;c;C;s;S");
1401 }
1402 
1403 static void handle_v_cont(GArray *params, void *user_ctx)
1404 {
1405     int res;
1406 
1407     if (!params->len) {
1408         return;
1409     }
1410 
1411     res = gdb_handle_vcont(get_param(params, 0)->data);
1412     if ((res == -EINVAL) || (res == -ERANGE)) {
1413         gdb_put_packet("E22");
1414     } else if (res) {
1415         gdb_put_packet("");
1416     }
1417 }
1418 
1419 static void handle_v_attach(GArray *params, void *user_ctx)
1420 {
1421     GDBProcess *process;
1422     CPUState *cpu;
1423 
1424     g_string_assign(gdbserver_state.str_buf, "E22");
1425     if (!params->len) {
1426         goto cleanup;
1427     }
1428 
1429     process = gdb_get_process(get_param(params, 0)->val_ul);
1430     if (!process) {
1431         goto cleanup;
1432     }
1433 
1434     cpu = gdb_get_first_cpu_in_process(process);
1435     if (!cpu) {
1436         goto cleanup;
1437     }
1438 
1439     process->attached = true;
1440     gdbserver_state.g_cpu = cpu;
1441     gdbserver_state.c_cpu = cpu;
1442 
1443     if (gdbserver_state.allow_stop_reply) {
1444         g_string_printf(gdbserver_state.str_buf, "T%02xthread:", GDB_SIGNAL_TRAP);
1445         gdb_append_thread_id(cpu, gdbserver_state.str_buf);
1446         g_string_append_c(gdbserver_state.str_buf, ';');
1447         gdbserver_state.allow_stop_reply = false;
1448 cleanup:
1449         gdb_put_strbuf();
1450     }
1451 }
1452 
1453 static void handle_v_kill(GArray *params, void *user_ctx)
1454 {
1455     /* Kill the target */
1456     gdb_put_packet("OK");
1457     error_report("QEMU: Terminated via GDBstub");
1458     gdb_exit(0);
1459     gdb_qemu_exit(0);
1460 }
1461 
1462 static const GdbCmdParseEntry gdb_v_commands_table[] = {
1463     /* Order is important if has same prefix */
1464     {
1465         .handler = handle_v_cont_query,
1466         .cmd = "Cont?",
1467         .cmd_startswith = 1
1468     },
1469     {
1470         .handler = handle_v_cont,
1471         .cmd = "Cont",
1472         .cmd_startswith = 1,
1473         .allow_stop_reply = true,
1474         .schema = "s0"
1475     },
1476     {
1477         .handler = handle_v_attach,
1478         .cmd = "Attach;",
1479         .cmd_startswith = 1,
1480         .allow_stop_reply = true,
1481         .schema = "l0"
1482     },
1483     {
1484         .handler = handle_v_kill,
1485         .cmd = "Kill;",
1486         .cmd_startswith = 1
1487     },
1488 #ifdef CONFIG_USER_ONLY
1489     /*
1490      * Host I/O Packets. See [1] for details.
1491      * [1] https://sourceware.org/gdb/onlinedocs/gdb/Host-I_002fO-Packets.html
1492      */
1493     {
1494         .handler = gdb_handle_v_file_open,
1495         .cmd = "File:open:",
1496         .cmd_startswith = 1,
1497         .schema = "s,L,L0"
1498     },
1499     {
1500         .handler = gdb_handle_v_file_close,
1501         .cmd = "File:close:",
1502         .cmd_startswith = 1,
1503         .schema = "l0"
1504     },
1505     {
1506         .handler = gdb_handle_v_file_pread,
1507         .cmd = "File:pread:",
1508         .cmd_startswith = 1,
1509         .schema = "l,L,L0"
1510     },
1511     {
1512         .handler = gdb_handle_v_file_readlink,
1513         .cmd = "File:readlink:",
1514         .cmd_startswith = 1,
1515         .schema = "s0"
1516     },
1517 #endif
1518 };
1519 
1520 static void handle_v_commands(GArray *params, void *user_ctx)
1521 {
1522     if (!params->len) {
1523         return;
1524     }
1525 
1526     if (process_string_cmd(get_param(params, 0)->data,
1527                            gdb_v_commands_table,
1528                            ARRAY_SIZE(gdb_v_commands_table))) {
1529         gdb_put_packet("");
1530     }
1531 }
1532 
1533 static void handle_query_qemu_sstepbits(GArray *params, void *user_ctx)
1534 {
1535     g_string_printf(gdbserver_state.str_buf, "ENABLE=%x", SSTEP_ENABLE);
1536 
1537     if (gdbserver_state.supported_sstep_flags & SSTEP_NOIRQ) {
1538         g_string_append_printf(gdbserver_state.str_buf, ",NOIRQ=%x",
1539                                SSTEP_NOIRQ);
1540     }
1541 
1542     if (gdbserver_state.supported_sstep_flags & SSTEP_NOTIMER) {
1543         g_string_append_printf(gdbserver_state.str_buf, ",NOTIMER=%x",
1544                                SSTEP_NOTIMER);
1545     }
1546 
1547     gdb_put_strbuf();
1548 }
1549 
1550 static void handle_set_qemu_sstep(GArray *params, void *user_ctx)
1551 {
1552     int new_sstep_flags;
1553 
1554     if (!params->len) {
1555         return;
1556     }
1557 
1558     new_sstep_flags = get_param(params, 0)->val_ul;
1559 
1560     if (new_sstep_flags  & ~gdbserver_state.supported_sstep_flags) {
1561         gdb_put_packet("E22");
1562         return;
1563     }
1564 
1565     gdbserver_state.sstep_flags = new_sstep_flags;
1566     gdb_put_packet("OK");
1567 }
1568 
1569 static void handle_query_qemu_sstep(GArray *params, void *user_ctx)
1570 {
1571     g_string_printf(gdbserver_state.str_buf, "0x%x",
1572                     gdbserver_state.sstep_flags);
1573     gdb_put_strbuf();
1574 }
1575 
1576 static void handle_query_curr_tid(GArray *params, void *user_ctx)
1577 {
1578     CPUState *cpu;
1579     GDBProcess *process;
1580 
1581     /*
1582      * "Current thread" remains vague in the spec, so always return
1583      * the first thread of the current process (gdb returns the
1584      * first thread).
1585      */
1586     process = gdb_get_cpu_process(gdbserver_state.g_cpu);
1587     cpu = gdb_get_first_cpu_in_process(process);
1588     g_string_assign(gdbserver_state.str_buf, "QC");
1589     gdb_append_thread_id(cpu, gdbserver_state.str_buf);
1590     gdb_put_strbuf();
1591 }
1592 
1593 static void handle_query_threads(GArray *params, void *user_ctx)
1594 {
1595     if (!gdbserver_state.query_cpu) {
1596         gdb_put_packet("l");
1597         return;
1598     }
1599 
1600     g_string_assign(gdbserver_state.str_buf, "m");
1601     gdb_append_thread_id(gdbserver_state.query_cpu, gdbserver_state.str_buf);
1602     gdb_put_strbuf();
1603     gdbserver_state.query_cpu = gdb_next_attached_cpu(gdbserver_state.query_cpu);
1604 }
1605 
1606 static void handle_query_first_threads(GArray *params, void *user_ctx)
1607 {
1608     gdbserver_state.query_cpu = gdb_first_attached_cpu();
1609     handle_query_threads(params, user_ctx);
1610 }
1611 
1612 static void handle_query_thread_extra(GArray *params, void *user_ctx)
1613 {
1614     g_autoptr(GString) rs = g_string_new(NULL);
1615     CPUState *cpu;
1616 
1617     if (!params->len ||
1618         get_param(params, 0)->thread_id.kind == GDB_READ_THREAD_ERR) {
1619         gdb_put_packet("E22");
1620         return;
1621     }
1622 
1623     cpu = gdb_get_cpu(get_param(params, 0)->thread_id.pid,
1624                       get_param(params, 0)->thread_id.tid);
1625     if (!cpu) {
1626         return;
1627     }
1628 
1629     cpu_synchronize_state(cpu);
1630 
1631     if (gdbserver_state.multiprocess && (gdbserver_state.process_num > 1)) {
1632         /* Print the CPU model and name in multiprocess mode */
1633         ObjectClass *oc = object_get_class(OBJECT(cpu));
1634         const char *cpu_model = object_class_get_name(oc);
1635         const char *cpu_name =
1636             object_get_canonical_path_component(OBJECT(cpu));
1637         g_string_printf(rs, "%s %s [%s]", cpu_model, cpu_name,
1638                         cpu->halted ? "halted " : "running");
1639     } else {
1640         g_string_printf(rs, "CPU#%d [%s]", cpu->cpu_index,
1641                         cpu->halted ? "halted " : "running");
1642     }
1643     trace_gdbstub_op_extra_info(rs->str);
1644     gdb_memtohex(gdbserver_state.str_buf, (uint8_t *)rs->str, rs->len);
1645     gdb_put_strbuf();
1646 }
1647 
1648 static void handle_query_supported(GArray *params, void *user_ctx)
1649 {
1650     CPUClass *cc;
1651 
1652     g_string_printf(gdbserver_state.str_buf, "PacketSize=%x", MAX_PACKET_LENGTH);
1653     cc = CPU_GET_CLASS(first_cpu);
1654     if (cc->gdb_core_xml_file) {
1655         g_string_append(gdbserver_state.str_buf, ";qXfer:features:read+");
1656     }
1657 
1658     if (gdb_can_reverse()) {
1659         g_string_append(gdbserver_state.str_buf,
1660             ";ReverseStep+;ReverseContinue+");
1661     }
1662 
1663 #if defined(CONFIG_USER_ONLY)
1664 #if defined(CONFIG_LINUX)
1665     if (get_task_state(gdbserver_state.c_cpu)) {
1666         g_string_append(gdbserver_state.str_buf, ";qXfer:auxv:read+");
1667     }
1668     g_string_append(gdbserver_state.str_buf, ";QCatchSyscalls+");
1669 
1670     g_string_append(gdbserver_state.str_buf, ";qXfer:siginfo:read+");
1671 #endif
1672     g_string_append(gdbserver_state.str_buf, ";qXfer:exec-file:read+");
1673 #endif
1674 
1675     if (params->len) {
1676         const char *gdb_supported = get_param(params, 0)->data;
1677 
1678         if (strstr(gdb_supported, "multiprocess+")) {
1679             gdbserver_state.multiprocess = true;
1680         }
1681 #if defined(CONFIG_USER_ONLY)
1682         gdb_handle_query_supported_user(gdb_supported);
1683 #endif
1684     }
1685 
1686     g_string_append(gdbserver_state.str_buf, ";vContSupported+;multiprocess+");
1687     gdb_put_strbuf();
1688 }
1689 
1690 static void handle_query_xfer_features(GArray *params, void *user_ctx)
1691 {
1692     GDBProcess *process;
1693     CPUClass *cc;
1694     unsigned long len, total_len, addr;
1695     const char *xml;
1696     const char *p;
1697 
1698     if (params->len < 3) {
1699         gdb_put_packet("E22");
1700         return;
1701     }
1702 
1703     process = gdb_get_cpu_process(gdbserver_state.g_cpu);
1704     cc = CPU_GET_CLASS(gdbserver_state.g_cpu);
1705     if (!cc->gdb_core_xml_file) {
1706         gdb_put_packet("");
1707         return;
1708     }
1709 
1710     p = get_param(params, 0)->data;
1711     xml = get_feature_xml(p, &p, process);
1712     if (!xml) {
1713         gdb_put_packet("E00");
1714         return;
1715     }
1716 
1717     addr = get_param(params, 1)->val_ul;
1718     len = get_param(params, 2)->val_ul;
1719     total_len = strlen(xml);
1720     if (addr > total_len) {
1721         gdb_put_packet("E00");
1722         return;
1723     }
1724 
1725     if (len > (MAX_PACKET_LENGTH - 5) / 2) {
1726         len = (MAX_PACKET_LENGTH - 5) / 2;
1727     }
1728 
1729     if (len < total_len - addr) {
1730         g_string_assign(gdbserver_state.str_buf, "m");
1731         gdb_memtox(gdbserver_state.str_buf, xml + addr, len);
1732     } else {
1733         g_string_assign(gdbserver_state.str_buf, "l");
1734         gdb_memtox(gdbserver_state.str_buf, xml + addr, total_len - addr);
1735     }
1736 
1737     gdb_put_packet_binary(gdbserver_state.str_buf->str,
1738                       gdbserver_state.str_buf->len, true);
1739 }
1740 
1741 static void handle_query_qemu_supported(GArray *params, void *user_ctx)
1742 {
1743     g_string_printf(gdbserver_state.str_buf, "sstepbits;sstep");
1744 #ifndef CONFIG_USER_ONLY
1745     g_string_append(gdbserver_state.str_buf, ";PhyMemMode");
1746 #endif
1747     gdb_put_strbuf();
1748 }
1749 
1750 static const GdbCmdParseEntry gdb_gen_query_set_common_table[] = {
1751     /* Order is important if has same prefix */
1752     {
1753         .handler = handle_query_qemu_sstepbits,
1754         .cmd = "qemu.sstepbits",
1755     },
1756     {
1757         .handler = handle_query_qemu_sstep,
1758         .cmd = "qemu.sstep",
1759     },
1760     {
1761         .handler = handle_set_qemu_sstep,
1762         .cmd = "qemu.sstep=",
1763         .cmd_startswith = 1,
1764         .schema = "l0"
1765     },
1766 };
1767 
1768 static const GdbCmdParseEntry gdb_gen_query_table[] = {
1769     {
1770         .handler = handle_query_curr_tid,
1771         .cmd = "C",
1772     },
1773     {
1774         .handler = handle_query_threads,
1775         .cmd = "sThreadInfo",
1776     },
1777     {
1778         .handler = handle_query_first_threads,
1779         .cmd = "fThreadInfo",
1780     },
1781     {
1782         .handler = handle_query_thread_extra,
1783         .cmd = "ThreadExtraInfo,",
1784         .cmd_startswith = 1,
1785         .schema = "t0"
1786     },
1787 #ifdef CONFIG_USER_ONLY
1788     {
1789         .handler = gdb_handle_query_offsets,
1790         .cmd = "Offsets",
1791     },
1792 #else
1793     {
1794         .handler = gdb_handle_query_rcmd,
1795         .cmd = "Rcmd,",
1796         .cmd_startswith = 1,
1797         .schema = "s0"
1798     },
1799 #endif
1800     {
1801         .handler = handle_query_supported,
1802         .cmd = "Supported:",
1803         .cmd_startswith = 1,
1804         .schema = "s0"
1805     },
1806     {
1807         .handler = handle_query_supported,
1808         .cmd = "Supported",
1809         .schema = "s0"
1810     },
1811     {
1812         .handler = handle_query_xfer_features,
1813         .cmd = "Xfer:features:read:",
1814         .cmd_startswith = 1,
1815         .schema = "s:l,l0"
1816     },
1817 #if defined(CONFIG_USER_ONLY)
1818 #if defined(CONFIG_LINUX)
1819     {
1820         .handler = gdb_handle_query_xfer_auxv,
1821         .cmd = "Xfer:auxv:read::",
1822         .cmd_startswith = 1,
1823         .schema = "l,l0"
1824     },
1825     {
1826         .handler = gdb_handle_query_xfer_siginfo,
1827         .cmd = "Xfer:siginfo:read::",
1828         .cmd_startswith = 1,
1829         .schema = "l,l0"
1830      },
1831 #endif
1832     {
1833         .handler = gdb_handle_query_xfer_exec_file,
1834         .cmd = "Xfer:exec-file:read:",
1835         .cmd_startswith = 1,
1836         .schema = "l:l,l0"
1837     },
1838 #endif
1839     {
1840         .handler = gdb_handle_query_attached,
1841         .cmd = "Attached:",
1842         .cmd_startswith = 1
1843     },
1844     {
1845         .handler = gdb_handle_query_attached,
1846         .cmd = "Attached",
1847     },
1848     {
1849         .handler = handle_query_qemu_supported,
1850         .cmd = "qemu.Supported",
1851     },
1852 #ifndef CONFIG_USER_ONLY
1853     {
1854         .handler = gdb_handle_query_qemu_phy_mem_mode,
1855         .cmd = "qemu.PhyMemMode",
1856     },
1857 #endif
1858 };
1859 
1860 static const GdbCmdParseEntry gdb_gen_set_table[] = {
1861     /* Order is important if has same prefix */
1862     {
1863         .handler = handle_set_qemu_sstep,
1864         .cmd = "qemu.sstep:",
1865         .cmd_startswith = 1,
1866         .schema = "l0"
1867     },
1868 #ifndef CONFIG_USER_ONLY
1869     {
1870         .handler = gdb_handle_set_qemu_phy_mem_mode,
1871         .cmd = "qemu.PhyMemMode:",
1872         .cmd_startswith = 1,
1873         .schema = "l0"
1874     },
1875 #endif
1876 #if defined(CONFIG_USER_ONLY)
1877     {
1878         .handler = gdb_handle_set_catch_syscalls,
1879         .cmd = "CatchSyscalls:",
1880         .cmd_startswith = 1,
1881         .schema = "s0",
1882     },
1883 #endif
1884 };
1885 
1886 static void handle_gen_query(GArray *params, void *user_ctx)
1887 {
1888     if (!params->len) {
1889         return;
1890     }
1891 
1892     if (!process_string_cmd(get_param(params, 0)->data,
1893                             gdb_gen_query_set_common_table,
1894                             ARRAY_SIZE(gdb_gen_query_set_common_table))) {
1895         return;
1896     }
1897 
1898     if (process_string_cmd(get_param(params, 0)->data,
1899                            gdb_gen_query_table,
1900                            ARRAY_SIZE(gdb_gen_query_table))) {
1901         gdb_put_packet("");
1902     }
1903 }
1904 
1905 static void handle_gen_set(GArray *params, void *user_ctx)
1906 {
1907     if (!params->len) {
1908         return;
1909     }
1910 
1911     if (!process_string_cmd(get_param(params, 0)->data,
1912                             gdb_gen_query_set_common_table,
1913                             ARRAY_SIZE(gdb_gen_query_set_common_table))) {
1914         return;
1915     }
1916 
1917     if (process_string_cmd(get_param(params, 0)->data,
1918                            gdb_gen_set_table,
1919                            ARRAY_SIZE(gdb_gen_set_table))) {
1920         gdb_put_packet("");
1921     }
1922 }
1923 
1924 static void handle_target_halt(GArray *params, void *user_ctx)
1925 {
1926     if (gdbserver_state.allow_stop_reply) {
1927         g_string_printf(gdbserver_state.str_buf, "T%02xthread:", GDB_SIGNAL_TRAP);
1928         gdb_append_thread_id(gdbserver_state.c_cpu, gdbserver_state.str_buf);
1929         g_string_append_c(gdbserver_state.str_buf, ';');
1930         gdb_put_strbuf();
1931         gdbserver_state.allow_stop_reply = false;
1932     }
1933     /*
1934      * Remove all the breakpoints when this query is issued,
1935      * because gdb is doing an initial connect and the state
1936      * should be cleaned up.
1937      */
1938     gdb_breakpoint_remove_all(gdbserver_state.c_cpu);
1939 }
1940 
1941 static int gdb_handle_packet(const char *line_buf)
1942 {
1943     const GdbCmdParseEntry *cmd_parser = NULL;
1944 
1945     trace_gdbstub_io_command(line_buf);
1946 
1947     switch (line_buf[0]) {
1948     case '!':
1949         gdb_put_packet("OK");
1950         break;
1951     case '?':
1952         {
1953             static const GdbCmdParseEntry target_halted_cmd_desc = {
1954                 .handler = handle_target_halt,
1955                 .cmd = "?",
1956                 .cmd_startswith = 1,
1957                 .allow_stop_reply = true,
1958             };
1959             cmd_parser = &target_halted_cmd_desc;
1960         }
1961         break;
1962     case 'c':
1963         {
1964             static const GdbCmdParseEntry continue_cmd_desc = {
1965                 .handler = handle_continue,
1966                 .cmd = "c",
1967                 .cmd_startswith = 1,
1968                 .allow_stop_reply = true,
1969                 .schema = "L0"
1970             };
1971             cmd_parser = &continue_cmd_desc;
1972         }
1973         break;
1974     case 'C':
1975         {
1976             static const GdbCmdParseEntry cont_with_sig_cmd_desc = {
1977                 .handler = handle_cont_with_sig,
1978                 .cmd = "C",
1979                 .cmd_startswith = 1,
1980                 .allow_stop_reply = true,
1981                 .schema = "l0"
1982             };
1983             cmd_parser = &cont_with_sig_cmd_desc;
1984         }
1985         break;
1986     case 'v':
1987         {
1988             static const GdbCmdParseEntry v_cmd_desc = {
1989                 .handler = handle_v_commands,
1990                 .cmd = "v",
1991                 .cmd_startswith = 1,
1992                 .schema = "s0"
1993             };
1994             cmd_parser = &v_cmd_desc;
1995         }
1996         break;
1997     case 'k':
1998         /* Kill the target */
1999         error_report("QEMU: Terminated via GDBstub");
2000         gdb_exit(0);
2001         gdb_qemu_exit(0);
2002         break;
2003     case 'D':
2004         {
2005             static const GdbCmdParseEntry detach_cmd_desc = {
2006                 .handler = handle_detach,
2007                 .cmd = "D",
2008                 .cmd_startswith = 1,
2009                 .schema = "?.l0"
2010             };
2011             cmd_parser = &detach_cmd_desc;
2012         }
2013         break;
2014     case 's':
2015         {
2016             static const GdbCmdParseEntry step_cmd_desc = {
2017                 .handler = handle_step,
2018                 .cmd = "s",
2019                 .cmd_startswith = 1,
2020                 .allow_stop_reply = true,
2021                 .schema = "L0"
2022             };
2023             cmd_parser = &step_cmd_desc;
2024         }
2025         break;
2026     case 'b':
2027         {
2028             static const GdbCmdParseEntry backward_cmd_desc = {
2029                 .handler = handle_backward,
2030                 .cmd = "b",
2031                 .cmd_startswith = 1,
2032                 .allow_stop_reply = true,
2033                 .schema = "o0"
2034             };
2035             cmd_parser = &backward_cmd_desc;
2036         }
2037         break;
2038     case 'F':
2039         {
2040             static const GdbCmdParseEntry file_io_cmd_desc = {
2041                 .handler = gdb_handle_file_io,
2042                 .cmd = "F",
2043                 .cmd_startswith = 1,
2044                 .schema = "L,L,o0"
2045             };
2046             cmd_parser = &file_io_cmd_desc;
2047         }
2048         break;
2049     case 'g':
2050         {
2051             static const GdbCmdParseEntry read_all_regs_cmd_desc = {
2052                 .handler = handle_read_all_regs,
2053                 .cmd = "g",
2054                 .cmd_startswith = 1
2055             };
2056             cmd_parser = &read_all_regs_cmd_desc;
2057         }
2058         break;
2059     case 'G':
2060         {
2061             static const GdbCmdParseEntry write_all_regs_cmd_desc = {
2062                 .handler = handle_write_all_regs,
2063                 .cmd = "G",
2064                 .cmd_startswith = 1,
2065                 .schema = "s0"
2066             };
2067             cmd_parser = &write_all_regs_cmd_desc;
2068         }
2069         break;
2070     case 'm':
2071         {
2072             static const GdbCmdParseEntry read_mem_cmd_desc = {
2073                 .handler = handle_read_mem,
2074                 .cmd = "m",
2075                 .cmd_startswith = 1,
2076                 .schema = "L,L0"
2077             };
2078             cmd_parser = &read_mem_cmd_desc;
2079         }
2080         break;
2081     case 'M':
2082         {
2083             static const GdbCmdParseEntry write_mem_cmd_desc = {
2084                 .handler = handle_write_mem,
2085                 .cmd = "M",
2086                 .cmd_startswith = 1,
2087                 .schema = "L,L:s0"
2088             };
2089             cmd_parser = &write_mem_cmd_desc;
2090         }
2091         break;
2092     case 'p':
2093         {
2094             static const GdbCmdParseEntry get_reg_cmd_desc = {
2095                 .handler = handle_get_reg,
2096                 .cmd = "p",
2097                 .cmd_startswith = 1,
2098                 .schema = "L0"
2099             };
2100             cmd_parser = &get_reg_cmd_desc;
2101         }
2102         break;
2103     case 'P':
2104         {
2105             static const GdbCmdParseEntry set_reg_cmd_desc = {
2106                 .handler = handle_set_reg,
2107                 .cmd = "P",
2108                 .cmd_startswith = 1,
2109                 .schema = "L?s0"
2110             };
2111             cmd_parser = &set_reg_cmd_desc;
2112         }
2113         break;
2114     case 'Z':
2115         {
2116             static const GdbCmdParseEntry insert_bp_cmd_desc = {
2117                 .handler = handle_insert_bp,
2118                 .cmd = "Z",
2119                 .cmd_startswith = 1,
2120                 .schema = "l?L?L0"
2121             };
2122             cmd_parser = &insert_bp_cmd_desc;
2123         }
2124         break;
2125     case 'z':
2126         {
2127             static const GdbCmdParseEntry remove_bp_cmd_desc = {
2128                 .handler = handle_remove_bp,
2129                 .cmd = "z",
2130                 .cmd_startswith = 1,
2131                 .schema = "l?L?L0"
2132             };
2133             cmd_parser = &remove_bp_cmd_desc;
2134         }
2135         break;
2136     case 'H':
2137         {
2138             static const GdbCmdParseEntry set_thread_cmd_desc = {
2139                 .handler = handle_set_thread,
2140                 .cmd = "H",
2141                 .cmd_startswith = 1,
2142                 .schema = "o.t0"
2143             };
2144             cmd_parser = &set_thread_cmd_desc;
2145         }
2146         break;
2147     case 'T':
2148         {
2149             static const GdbCmdParseEntry thread_alive_cmd_desc = {
2150                 .handler = handle_thread_alive,
2151                 .cmd = "T",
2152                 .cmd_startswith = 1,
2153                 .schema = "t0"
2154             };
2155             cmd_parser = &thread_alive_cmd_desc;
2156         }
2157         break;
2158     case 'q':
2159         {
2160             static const GdbCmdParseEntry gen_query_cmd_desc = {
2161                 .handler = handle_gen_query,
2162                 .cmd = "q",
2163                 .cmd_startswith = 1,
2164                 .schema = "s0"
2165             };
2166             cmd_parser = &gen_query_cmd_desc;
2167         }
2168         break;
2169     case 'Q':
2170         {
2171             static const GdbCmdParseEntry gen_set_cmd_desc = {
2172                 .handler = handle_gen_set,
2173                 .cmd = "Q",
2174                 .cmd_startswith = 1,
2175                 .schema = "s0"
2176             };
2177             cmd_parser = &gen_set_cmd_desc;
2178         }
2179         break;
2180     default:
2181         /* put empty packet */
2182         gdb_put_packet("");
2183         break;
2184     }
2185 
2186     if (cmd_parser) {
2187         run_cmd_parser(line_buf, cmd_parser);
2188     }
2189 
2190     return RS_IDLE;
2191 }
2192 
2193 void gdb_set_stop_cpu(CPUState *cpu)
2194 {
2195     GDBProcess *p = gdb_get_cpu_process(cpu);
2196 
2197     if (!p->attached) {
2198         /*
2199          * Having a stop CPU corresponding to a process that is not attached
2200          * confuses GDB. So we ignore the request.
2201          */
2202         return;
2203     }
2204 
2205     gdbserver_state.c_cpu = cpu;
2206     gdbserver_state.g_cpu = cpu;
2207 }
2208 
2209 void gdb_read_byte(uint8_t ch)
2210 {
2211     uint8_t reply;
2212 
2213     gdbserver_state.allow_stop_reply = false;
2214 #ifndef CONFIG_USER_ONLY
2215     if (gdbserver_state.last_packet->len) {
2216         /* Waiting for a response to the last packet.  If we see the start
2217            of a new command then abandon the previous response.  */
2218         if (ch == '-') {
2219             trace_gdbstub_err_got_nack();
2220             gdb_put_buffer(gdbserver_state.last_packet->data,
2221                        gdbserver_state.last_packet->len);
2222         } else if (ch == '+') {
2223             trace_gdbstub_io_got_ack();
2224         } else {
2225             trace_gdbstub_io_got_unexpected(ch);
2226         }
2227 
2228         if (ch == '+' || ch == '$') {
2229             g_byte_array_set_size(gdbserver_state.last_packet, 0);
2230         }
2231         if (ch != '$')
2232             return;
2233     }
2234     if (runstate_is_running()) {
2235         /*
2236          * When the CPU is running, we cannot do anything except stop
2237          * it when receiving a char. This is expected on a Ctrl-C in the
2238          * gdb client. Because we are in all-stop mode, gdb sends a
2239          * 0x03 byte which is not a usual packet, so we handle it specially
2240          * here, but it does expect a stop reply.
2241          */
2242         if (ch != 0x03) {
2243             trace_gdbstub_err_unexpected_runpkt(ch);
2244         } else {
2245             gdbserver_state.allow_stop_reply = true;
2246         }
2247         vm_stop(RUN_STATE_PAUSED);
2248     } else
2249 #endif
2250     {
2251         switch(gdbserver_state.state) {
2252         case RS_IDLE:
2253             if (ch == '$') {
2254                 /* start of command packet */
2255                 gdbserver_state.line_buf_index = 0;
2256                 gdbserver_state.line_sum = 0;
2257                 gdbserver_state.state = RS_GETLINE;
2258             } else if (ch == '+') {
2259                 /*
2260                  * do nothing, gdb may preemptively send out ACKs on
2261                  * initial connection
2262                  */
2263             } else {
2264                 trace_gdbstub_err_garbage(ch);
2265             }
2266             break;
2267         case RS_GETLINE:
2268             if (ch == '}') {
2269                 /* start escape sequence */
2270                 gdbserver_state.state = RS_GETLINE_ESC;
2271                 gdbserver_state.line_sum += ch;
2272             } else if (ch == '*') {
2273                 /* start run length encoding sequence */
2274                 gdbserver_state.state = RS_GETLINE_RLE;
2275                 gdbserver_state.line_sum += ch;
2276             } else if (ch == '#') {
2277                 /* end of command, start of checksum*/
2278                 gdbserver_state.state = RS_CHKSUM1;
2279             } else if (gdbserver_state.line_buf_index >= sizeof(gdbserver_state.line_buf) - 1) {
2280                 trace_gdbstub_err_overrun();
2281                 gdbserver_state.state = RS_IDLE;
2282             } else {
2283                 /* unescaped command character */
2284                 gdbserver_state.line_buf[gdbserver_state.line_buf_index++] = ch;
2285                 gdbserver_state.line_sum += ch;
2286             }
2287             break;
2288         case RS_GETLINE_ESC:
2289             if (ch == '#') {
2290                 /* unexpected end of command in escape sequence */
2291                 gdbserver_state.state = RS_CHKSUM1;
2292             } else if (gdbserver_state.line_buf_index >= sizeof(gdbserver_state.line_buf) - 1) {
2293                 /* command buffer overrun */
2294                 trace_gdbstub_err_overrun();
2295                 gdbserver_state.state = RS_IDLE;
2296             } else {
2297                 /* parse escaped character and leave escape state */
2298                 gdbserver_state.line_buf[gdbserver_state.line_buf_index++] = ch ^ 0x20;
2299                 gdbserver_state.line_sum += ch;
2300                 gdbserver_state.state = RS_GETLINE;
2301             }
2302             break;
2303         case RS_GETLINE_RLE:
2304             /*
2305              * Run-length encoding is explained in "Debugging with GDB /
2306              * Appendix E GDB Remote Serial Protocol / Overview".
2307              */
2308             if (ch < ' ' || ch == '#' || ch == '$' || ch > 126) {
2309                 /* invalid RLE count encoding */
2310                 trace_gdbstub_err_invalid_repeat(ch);
2311                 gdbserver_state.state = RS_GETLINE;
2312             } else {
2313                 /* decode repeat length */
2314                 int repeat = ch - ' ' + 3;
2315                 if (gdbserver_state.line_buf_index + repeat >= sizeof(gdbserver_state.line_buf) - 1) {
2316                     /* that many repeats would overrun the command buffer */
2317                     trace_gdbstub_err_overrun();
2318                     gdbserver_state.state = RS_IDLE;
2319                 } else if (gdbserver_state.line_buf_index < 1) {
2320                     /* got a repeat but we have nothing to repeat */
2321                     trace_gdbstub_err_invalid_rle();
2322                     gdbserver_state.state = RS_GETLINE;
2323                 } else {
2324                     /* repeat the last character */
2325                     memset(gdbserver_state.line_buf + gdbserver_state.line_buf_index,
2326                            gdbserver_state.line_buf[gdbserver_state.line_buf_index - 1], repeat);
2327                     gdbserver_state.line_buf_index += repeat;
2328                     gdbserver_state.line_sum += ch;
2329                     gdbserver_state.state = RS_GETLINE;
2330                 }
2331             }
2332             break;
2333         case RS_CHKSUM1:
2334             /* get high hex digit of checksum */
2335             if (!isxdigit(ch)) {
2336                 trace_gdbstub_err_checksum_invalid(ch);
2337                 gdbserver_state.state = RS_GETLINE;
2338                 break;
2339             }
2340             gdbserver_state.line_buf[gdbserver_state.line_buf_index] = '\0';
2341             gdbserver_state.line_csum = fromhex(ch) << 4;
2342             gdbserver_state.state = RS_CHKSUM2;
2343             break;
2344         case RS_CHKSUM2:
2345             /* get low hex digit of checksum */
2346             if (!isxdigit(ch)) {
2347                 trace_gdbstub_err_checksum_invalid(ch);
2348                 gdbserver_state.state = RS_GETLINE;
2349                 break;
2350             }
2351             gdbserver_state.line_csum |= fromhex(ch);
2352 
2353             if (gdbserver_state.line_csum != (gdbserver_state.line_sum & 0xff)) {
2354                 trace_gdbstub_err_checksum_incorrect(gdbserver_state.line_sum, gdbserver_state.line_csum);
2355                 /* send NAK reply */
2356                 reply = '-';
2357                 gdb_put_buffer(&reply, 1);
2358                 gdbserver_state.state = RS_IDLE;
2359             } else {
2360                 /* send ACK reply */
2361                 reply = '+';
2362                 gdb_put_buffer(&reply, 1);
2363                 gdbserver_state.state = gdb_handle_packet(gdbserver_state.line_buf);
2364             }
2365             break;
2366         default:
2367             abort();
2368         }
2369     }
2370 }
2371 
2372 /*
2373  * Create the process that will contain all the "orphan" CPUs (that are not
2374  * part of a CPU cluster). Note that if this process contains no CPUs, it won't
2375  * be attachable and thus will be invisible to the user.
2376  */
2377 void gdb_create_default_process(GDBState *s)
2378 {
2379     GDBProcess *process;
2380     int pid;
2381 
2382 #ifdef CONFIG_USER_ONLY
2383     assert(gdbserver_state.process_num == 0);
2384     pid = getpid();
2385 #else
2386     if (gdbserver_state.process_num) {
2387         pid = s->processes[s->process_num - 1].pid;
2388     } else {
2389         pid = 0;
2390     }
2391     /* We need an available PID slot for this process */
2392     assert(pid < UINT32_MAX);
2393     pid++;
2394 #endif
2395 
2396     s->processes = g_renew(GDBProcess, s->processes, ++s->process_num);
2397     process = &s->processes[s->process_num - 1];
2398     process->pid = pid;
2399     process->attached = false;
2400     process->target_xml = NULL;
2401 }
2402 
2403