gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "qemu-common.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "monitor.h"
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #endif
  37
  38 #define MAX_PACKET_LENGTH 4096
  39
  40 #include "qemu_socket.h"
  41 #include "kvm.h"
  42
  43
  44 enum {
  45     GDB_SIGNAL_0 = 0,
  46     GDB_SIGNAL_INT = 2,
  47     GDB_SIGNAL_TRAP = 5,
  48     GDB_SIGNAL_UNKNOWN = 143
  49 };
  50
  51 #ifdef CONFIG_USER_ONLY
  52
  53 /* Map target signal numbers to GDB protocol signal numbers and vice
  54  * versa.  For user emulation's currently supported systems, we can
  55  * assume most signals are defined.
  56  */
  57
  58 static int gdb_signal_table[] = {
  59     0,
  60     TARGET_SIGHUP,
  61     TARGET_SIGINT,
  62     TARGET_SIGQUIT,
  63     TARGET_SIGILL,
  64     TARGET_SIGTRAP,
  65     TARGET_SIGABRT,
  66     -1, /* SIGEMT */
  67     TARGET_SIGFPE,
  68     TARGET_SIGKILL,
  69     TARGET_SIGBUS,
  70     TARGET_SIGSEGV,
  71     TARGET_SIGSYS,
  72     TARGET_SIGPIPE,
  73     TARGET_SIGALRM,
  74     TARGET_SIGTERM,
  75     TARGET_SIGURG,
  76     TARGET_SIGSTOP,
  77     TARGET_SIGTSTP,
  78     TARGET_SIGCONT,
  79     TARGET_SIGCHLD,
  80     TARGET_SIGTTIN,
  81     TARGET_SIGTTOU,
  82     TARGET_SIGIO,
  83     TARGET_SIGXCPU,
  84     TARGET_SIGXFSZ,
  85     TARGET_SIGVTALRM,
  86     TARGET_SIGPROF,
  87     TARGET_SIGWINCH,
  88     -1, /* SIGLOST */
  89     TARGET_SIGUSR1,
  90     TARGET_SIGUSR2,
  91 #ifdef TARGET_SIGPWR
  92     TARGET_SIGPWR,
  93 #else
  94     -1,
  95 #endif
  96     -1, /* SIGPOLL */
  97     -1,
  98     -1,
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108 #ifdef __SIGRTMIN
 109     __SIGRTMIN + 1,
 110     __SIGRTMIN + 2,
 111     __SIGRTMIN + 3,
 112     __SIGRTMIN + 4,
 113     __SIGRTMIN + 5,
 114     __SIGRTMIN + 6,
 115     __SIGRTMIN + 7,
 116     __SIGRTMIN + 8,
 117     __SIGRTMIN + 9,
 118     __SIGRTMIN + 10,
 119     __SIGRTMIN + 11,
 120     __SIGRTMIN + 12,
 121     __SIGRTMIN + 13,
 122     __SIGRTMIN + 14,
 123     __SIGRTMIN + 15,
 124     __SIGRTMIN + 16,
 125     __SIGRTMIN + 17,
 126     __SIGRTMIN + 18,
 127     __SIGRTMIN + 19,
 128     __SIGRTMIN + 20,
 129     __SIGRTMIN + 21,
 130     __SIGRTMIN + 22,
 131     __SIGRTMIN + 23,
 132     __SIGRTMIN + 24,
 133     __SIGRTMIN + 25,
 134     __SIGRTMIN + 26,
 135     __SIGRTMIN + 27,
 136     __SIGRTMIN + 28,
 137     __SIGRTMIN + 29,
 138     __SIGRTMIN + 30,
 139     __SIGRTMIN + 31,
 140     -1, /* SIGCANCEL */
 141     __SIGRTMIN,
 142     __SIGRTMIN + 32,
 143     __SIGRTMIN + 33,
 144     __SIGRTMIN + 34,
 145     __SIGRTMIN + 35,
 146     __SIGRTMIN + 36,
 147     __SIGRTMIN + 37,
 148     __SIGRTMIN + 38,
 149     __SIGRTMIN + 39,
 150     __SIGRTMIN + 40,
 151     __SIGRTMIN + 41,
 152     __SIGRTMIN + 42,
 153     __SIGRTMIN + 43,
 154     __SIGRTMIN + 44,
 155     __SIGRTMIN + 45,
 156     __SIGRTMIN + 46,
 157     __SIGRTMIN + 47,
 158     __SIGRTMIN + 48,
 159     __SIGRTMIN + 49,
 160     __SIGRTMIN + 50,
 161     __SIGRTMIN + 51,
 162     __SIGRTMIN + 52,
 163     __SIGRTMIN + 53,
 164     __SIGRTMIN + 54,
 165     __SIGRTMIN + 55,
 166     __SIGRTMIN + 56,
 167     __SIGRTMIN + 57,
 168     __SIGRTMIN + 58,
 169     __SIGRTMIN + 59,
 170     __SIGRTMIN + 60,
 171     __SIGRTMIN + 61,
 172     __SIGRTMIN + 62,
 173     __SIGRTMIN + 63,
 174     __SIGRTMIN + 64,
 175     __SIGRTMIN + 65,
 176     __SIGRTMIN + 66,
 177     __SIGRTMIN + 67,
 178     __SIGRTMIN + 68,
 179     __SIGRTMIN + 69,
 180     __SIGRTMIN + 70,
 181     __SIGRTMIN + 71,
 182     __SIGRTMIN + 72,
 183     __SIGRTMIN + 73,
 184     __SIGRTMIN + 74,
 185     __SIGRTMIN + 75,
 186     __SIGRTMIN + 76,
 187     __SIGRTMIN + 77,
 188     __SIGRTMIN + 78,
 189     __SIGRTMIN + 79,
 190     __SIGRTMIN + 80,
 191     __SIGRTMIN + 81,
 192     __SIGRTMIN + 82,
 193     __SIGRTMIN + 83,
 194     __SIGRTMIN + 84,
 195     __SIGRTMIN + 85,
 196     __SIGRTMIN + 86,
 197     __SIGRTMIN + 87,
 198     __SIGRTMIN + 88,
 199     __SIGRTMIN + 89,
 200     __SIGRTMIN + 90,
 201     __SIGRTMIN + 91,
 202     __SIGRTMIN + 92,
 203     __SIGRTMIN + 93,
 204     __SIGRTMIN + 94,
 205     __SIGRTMIN + 95,
 206     -1, /* SIGINFO */
 207     -1, /* UNKNOWN */
 208     -1, /* DEFAULT */
 209     -1,
 210     -1,
 211     -1,
 212     -1,
 213     -1,
 214     -1
 215 #endif
 216 };
 217 #else
 218 /* In system mode we only need SIGINT and SIGTRAP; other signals
 219    are not yet supported.  */
 220
 221 enum {
 222     TARGET_SIGINT = 2,
 223     TARGET_SIGTRAP = 5
 224 };
 225
 226 static int gdb_signal_table[] = {
 227     -1,
 228     -1,
 229     TARGET_SIGINT,
 230     -1,
 231     -1,
 232     TARGET_SIGTRAP
 233 };
 234 #endif
 235
 236 #ifdef CONFIG_USER_ONLY
 237 static int target_signal_to_gdb (int sig)
 238 {
 239     int i;
 240     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 241         if (gdb_signal_table[i] == sig)
 242             return i;
 243     return GDB_SIGNAL_UNKNOWN;
 244 }
 245 #endif
 246
 247 static int gdb_signal_to_target (int sig)
 248 {
 249     if (sig < ARRAY_SIZE (gdb_signal_table))
 250         return gdb_signal_table[sig];
 251     else
 252         return -1;
 253 }
 254
 255 //#define DEBUG_GDB
 256
 257 typedef struct GDBRegisterState {
 258     int base_reg;
 259     int num_regs;
 260     gdb_reg_cb get_reg;
 261     gdb_reg_cb set_reg;
 262     const char *xml;
 263     struct GDBRegisterState *next;
 264 } GDBRegisterState;
 265
 266 enum RSState {
 267     RS_INACTIVE,
 268     RS_IDLE,
 269     RS_GETLINE,
 270     RS_CHKSUM1,
 271     RS_CHKSUM2,
 272     RS_SYSCALL,
 273 };
 274 typedef struct GDBState {
 275     CPUState *c_cpu; /* current CPU for step/continue ops */
 276     CPUState *g_cpu; /* current CPU for other ops */
 277     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 278     enum RSState state; /* parsing state */
 279     char line_buf[MAX_PACKET_LENGTH];
 280     int line_buf_index;
 281     int line_csum;
 282     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 283     int last_packet_len;
 284     int signal;
 285 #ifdef CONFIG_USER_ONLY
 286     int fd;
 287     int running_state;
 288 #else
 289     CharDriverState *chr;
 290     CharDriverState *mon_chr;
 291 #endif
 292 } GDBState;
 293
 294 /* By default use no IRQs and no timers while single stepping so as to
 295  * make single stepping like an ICE HW step.
 296  */
 297 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 298
 299 static GDBState *gdbserver_state;
 300
 301 /* This is an ugly hack to cope with both new and old gdb.
 302    If gdb sends qXfer:features:read then assume we're talking to a newish
 303    gdb that understands target descriptions.  */
 304 static int gdb_has_xml;
 305
 306 #ifdef CONFIG_USER_ONLY
 307 /* XXX: This is not thread safe.  Do we care?  */
 308 static int gdbserver_fd = -1;
 309
 310 static int get_char(GDBState *s)
 311 {
 312     uint8_t ch;
 313     int ret;
 314
 315     for(;;) {
 316         ret = recv(s->fd, &ch, 1, 0);
 317         if (ret < 0) {
 318             if (errno == ECONNRESET)
 319                 s->fd = -1;
 320             if (errno != EINTR && errno != EAGAIN)
 321                 return -1;
 322         } else if (ret == 0) {
 323             close(s->fd);
 324             s->fd = -1;
 325             return -1;
 326         } else {
 327             break;
 328         }
 329     }
 330     return ch;
 331 }
 332 #endif
 333
 334 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 335
 336 static enum {
 337     GDB_SYS_UNKNOWN,
 338     GDB_SYS_ENABLED,
 339     GDB_SYS_DISABLED,
 340 } gdb_syscall_mode;
 341
 342 /* If gdb is connected when the first semihosting syscall occurs then use
 343    remote gdb syscalls.  Otherwise use native file IO.  */
 344 int use_gdb_syscalls(void)
 345 {
 346     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 347         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 348                                             : GDB_SYS_DISABLED);
 349     }
 350     return gdb_syscall_mode == GDB_SYS_ENABLED;
 351 }
 352
 353 /* Resume execution.  */
 354 static inline void gdb_continue(GDBState *s)
 355 {
 356 #ifdef CONFIG_USER_ONLY
 357     s->running_state = 1;
 358 #else
 359     vm_start();
 360 #endif
 361 }
 362
 363 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 364 {
 365 #ifdef CONFIG_USER_ONLY
 366     int ret;
 367
 368     while (len > 0) {
 369         ret = send(s->fd, buf, len, 0);
 370         if (ret < 0) {
 371             if (errno != EINTR && errno != EAGAIN)
 372                 return;
 373         } else {
 374             buf += ret;
 375             len -= ret;
 376         }
 377     }
 378 #else
 379     qemu_chr_write(s->chr, buf, len);
 380 #endif
 381 }
 382
 383 static inline int fromhex(int v)
 384 {
 385     if (v >= '0' && v <= '9')
 386         return v - '0';
 387     else if (v >= 'A' && v <= 'F')
 388         return v - 'A' + 10;
 389     else if (v >= 'a' && v <= 'f')
 390         return v - 'a' + 10;
 391     else
 392         return 0;
 393 }
 394
 395 static inline int tohex(int v)
 396 {
 397     if (v < 10)
 398         return v + '0';
 399     else
 400         return v - 10 + 'a';
 401 }
 402
 403 static void memtohex(char *buf, const uint8_t *mem, int len)
 404 {
 405     int i, c;
 406     char *q;
 407     q = buf;
 408     for(i = 0; i < len; i++) {
 409         c = mem[i];
 410         *q++ = tohex(c >> 4);
 411         *q++ = tohex(c & 0xf);
 412     }
 413     *q = '\0';
 414 }
 415
 416 static void hextomem(uint8_t *mem, const char *buf, int len)
 417 {
 418     int i;
 419
 420     for(i = 0; i < len; i++) {
 421         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 422         buf += 2;
 423     }
 424 }
 425
 426 /* return -1 if error, 0 if OK */
 427 static int put_packet_binary(GDBState *s, const char *buf, int len)
 428 {
 429     int csum, i;
 430     uint8_t *p;
 431
 432     for(;;) {
 433         p = s->last_packet;
 434         *(p++) = '$';
 435         memcpy(p, buf, len);
 436         p += len;
 437         csum = 0;
 438         for(i = 0; i < len; i++) {
 439             csum += buf[i];
 440         }
 441         *(p++) = '#';
 442         *(p++) = tohex((csum >> 4) & 0xf);
 443         *(p++) = tohex((csum) & 0xf);
 444
 445         s->last_packet_len = p - s->last_packet;
 446         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 447
 448 #ifdef CONFIG_USER_ONLY
 449         i = get_char(s);
 450         if (i < 0)
 451             return -1;
 452         if (i == '+')
 453             break;
 454 #else
 455         break;
 456 #endif
 457     }
 458     return 0;
 459 }
 460
 461 /* return -1 if error, 0 if OK */
 462 static int put_packet(GDBState *s, const char *buf)
 463 {
 464 #ifdef DEBUG_GDB
 465     printf("reply='%s'\n", buf);
 466 #endif
 467
 468     return put_packet_binary(s, buf, strlen(buf));
 469 }
 470
 471 /* The GDB remote protocol transfers values in target byte order.  This means
 472    we can use the raw memory access routines to access the value buffer.
 473    Conveniently, these also handle the case where the buffer is mis-aligned.
 474  */
 475 #define GET_REG8(val) do { \
 476     stb_p(mem_buf, val); \
 477     return 1; \
 478     } while(0)
 479 #define GET_REG16(val) do { \
 480     stw_p(mem_buf, val); \
 481     return 2; \
 482     } while(0)
 483 #define GET_REG32(val) do { \
 484     stl_p(mem_buf, val); \
 485     return 4; \
 486     } while(0)
 487 #define GET_REG64(val) do { \
 488     stq_p(mem_buf, val); \
 489     return 8; \
 490     } while(0)
 491
 492 #if TARGET_LONG_BITS == 64
 493 #define GET_REGL(val) GET_REG64(val)
 494 #define ldtul_p(addr) ldq_p(addr)
 495 #else
 496 #define GET_REGL(val) GET_REG32(val)
 497 #define ldtul_p(addr) ldl_p(addr)
 498 #endif
 499
 500 #if defined(TARGET_I386)
 501
 502 #ifdef TARGET_X86_64
 503 static const int gpr_map[16] = {
 504     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 505     8, 9, 10, 11, 12, 13, 14, 15
 506 };
 507 #else
 508 static const int gpr_map[8] = {0, 1, 2, 3, 4, 5, 6, 7};
 509 #endif
 510
 511 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 512
 513 #define IDX_IP_REG      CPU_NB_REGS
 514 #define IDX_FLAGS_REG   (IDX_IP_REG + 1)
 515 #define IDX_SEG_REGS    (IDX_FLAGS_REG + 1)
 516 #define IDX_FP_REGS     (IDX_SEG_REGS + 6)
 517 #define IDX_XMM_REGS    (IDX_FP_REGS + 16)
 518 #define IDX_MXCSR_REG   (IDX_XMM_REGS + CPU_NB_REGS)
 519
 520 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 521 {
 522     if (n < CPU_NB_REGS) {
 523         GET_REGL(env->regs[gpr_map[n]]);
 524     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 525 #ifdef USE_X86LDOUBLE
 526         /* FIXME: byteswap float values - after fixing fpregs layout. */
 527         memcpy(mem_buf, &env->fpregs[n - IDX_FP_REGS], 10);
 528 #else
 529         memset(mem_buf, 0, 10);
 530 #endif
 531         return 10;
 532     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 533         n -= IDX_XMM_REGS;
 534         stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 535         stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 536         return 16;
 537     } else {
 538         switch (n) {
 539         case IDX_IP_REG:    GET_REGL(env->eip);
 540         case IDX_FLAGS_REG: GET_REG32(env->eflags);
 541
 542         case IDX_SEG_REGS:     GET_REG32(env->segs[R_CS].selector);
 543         case IDX_SEG_REGS + 1: GET_REG32(env->segs[R_SS].selector);
 544         case IDX_SEG_REGS + 2: GET_REG32(env->segs[R_DS].selector);
 545         case IDX_SEG_REGS + 3: GET_REG32(env->segs[R_ES].selector);
 546         case IDX_SEG_REGS + 4: GET_REG32(env->segs[R_FS].selector);
 547         case IDX_SEG_REGS + 5: GET_REG32(env->segs[R_GS].selector);
 548
 549         case IDX_FP_REGS + 8:  GET_REG32(env->fpuc);
 550         case IDX_FP_REGS + 9:  GET_REG32((env->fpus & ~0x3800) |
 551                                          (env->fpstt & 0x7) << 11);
 552         case IDX_FP_REGS + 10: GET_REG32(0); /* ftag */
 553         case IDX_FP_REGS + 11: GET_REG32(0); /* fiseg */
 554         case IDX_FP_REGS + 12: GET_REG32(0); /* fioff */
 555         case IDX_FP_REGS + 13: GET_REG32(0); /* foseg */
 556         case IDX_FP_REGS + 14: GET_REG32(0); /* fooff */
 557         case IDX_FP_REGS + 15: GET_REG32(0); /* fop */
 558
 559         case IDX_MXCSR_REG: GET_REG32(env->mxcsr);
 560         }
 561     }
 562     return 0;
 563 }
 564
 565 static int cpu_x86_gdb_load_seg(CPUState *env, int sreg, uint8_t *mem_buf)
 566 {
 567     uint16_t selector = ldl_p(mem_buf);
 568
 569     if (selector != env->segs[sreg].selector) {
 570 #if defined(CONFIG_USER_ONLY)
 571         cpu_x86_load_seg(env, sreg, selector);
 572 #else
 573         unsigned int limit, flags;
 574         target_ulong base;
 575
 576         if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK)) {
 577             base = selector << 4;
 578             limit = 0xffff;
 579             flags = 0;
 580         } else {
 581             if (!cpu_x86_get_descr_debug(env, selector, &base, &limit, &flags))
 582                 return 4;
 583         }
 584         cpu_x86_load_seg_cache(env, sreg, selector, base, limit, flags);
 585 #endif
 586     }
 587     return 4;
 588 }
 589
 590 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 591 {
 592     uint32_t tmp;
 593
 594     if (n < CPU_NB_REGS) {
 595         env->regs[gpr_map[n]] = ldtul_p(mem_buf);
 596         return sizeof(target_ulong);
 597     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 598 #ifdef USE_X86LDOUBLE
 599         /* FIXME: byteswap float values - after fixing fpregs layout. */
 600         memcpy(&env->fpregs[n - IDX_FP_REGS], mem_buf, 10);
 601 #endif
 602         return 10;
 603     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 604         n -= IDX_XMM_REGS;
 605         env->xmm_regs[n].XMM_Q(0) = ldq_p(mem_buf);
 606         env->xmm_regs[n].XMM_Q(1) = ldq_p(mem_buf + 8);
 607         return 16;
 608     } else {
 609         switch (n) {
 610         case IDX_IP_REG:
 611             env->eip = ldtul_p(mem_buf);
 612             return sizeof(target_ulong);
 613         case IDX_FLAGS_REG:
 614             env->eflags = ldl_p(mem_buf);
 615             return 4;
 616
 617         case IDX_SEG_REGS:     return cpu_x86_gdb_load_seg(env, R_CS, mem_buf);
 618         case IDX_SEG_REGS + 1: return cpu_x86_gdb_load_seg(env, R_SS, mem_buf);
 619         case IDX_SEG_REGS + 2: return cpu_x86_gdb_load_seg(env, R_DS, mem_buf);
 620         case IDX_SEG_REGS + 3: return cpu_x86_gdb_load_seg(env, R_ES, mem_buf);
 621         case IDX_SEG_REGS + 4: return cpu_x86_gdb_load_seg(env, R_FS, mem_buf);
 622         case IDX_SEG_REGS + 5: return cpu_x86_gdb_load_seg(env, R_GS, mem_buf);
 623
 624         case IDX_FP_REGS + 8:
 625             env->fpuc = ldl_p(mem_buf);
 626             return 4;
 627         case IDX_FP_REGS + 9:
 628             tmp = ldl_p(mem_buf);
 629             env->fpstt = (tmp >> 11) & 7;
 630             env->fpus = tmp & ~0x3800;
 631             return 4;
 632         case IDX_FP_REGS + 10: /* ftag */  return 4;
 633         case IDX_FP_REGS + 11: /* fiseg */ return 4;
 634         case IDX_FP_REGS + 12: /* fioff */ return 4;
 635         case IDX_FP_REGS + 13: /* foseg */ return 4;
 636         case IDX_FP_REGS + 14: /* fooff */ return 4;
 637         case IDX_FP_REGS + 15: /* fop */   return 4;
 638
 639         case IDX_MXCSR_REG:
 640             env->mxcsr = ldl_p(mem_buf);
 641             return 4;
 642         }
 643     }
 644     /* Unrecognised register.  */
 645     return 0;
 646 }
 647
 648 #elif defined (TARGET_PPC)
 649
 650 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 651    expects whatever the target description contains.  Due to a
 652    historical mishap the FP registers appear in between core integer
 653    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 654    FP regs zero size when talking to a newer gdb.  */
 655 #define NUM_CORE_REGS 71
 656 #if defined (TARGET_PPC64)
 657 #define GDB_CORE_XML "power64-core.xml"
 658 #else
 659 #define GDB_CORE_XML "power-core.xml"
 660 #endif
 661
 662 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 663 {
 664     if (n < 32) {
 665         /* gprs */
 666         GET_REGL(env->gpr[n]);
 667     } else if (n < 64) {
 668         /* fprs */
 669         if (gdb_has_xml)
 670             return 0;
 671         stfq_p(mem_buf, env->fpr[n-32]);
 672         return 8;
 673     } else {
 674         switch (n) {
 675         case 64: GET_REGL(env->nip);
 676         case 65: GET_REGL(env->msr);
 677         case 66:
 678             {
 679                 uint32_t cr = 0;
 680                 int i;
 681                 for (i = 0; i < 8; i++)
 682                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 683                 GET_REG32(cr);
 684             }
 685         case 67: GET_REGL(env->lr);
 686         case 68: GET_REGL(env->ctr);
 687         case 69: GET_REGL(env->xer);
 688         case 70:
 689             {
 690                 if (gdb_has_xml)
 691                     return 0;
 692                 GET_REG32(0); /* fpscr */
 693             }
 694         }
 695     }
 696     return 0;
 697 }
 698
 699 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 700 {
 701     if (n < 32) {
 702         /* gprs */
 703         env->gpr[n] = ldtul_p(mem_buf);
 704         return sizeof(target_ulong);
 705     } else if (n < 64) {
 706         /* fprs */
 707         if (gdb_has_xml)
 708             return 0;
 709         env->fpr[n-32] = ldfq_p(mem_buf);
 710         return 8;
 711     } else {
 712         switch (n) {
 713         case 64:
 714             env->nip = ldtul_p(mem_buf);
 715             return sizeof(target_ulong);
 716         case 65:
 717             ppc_store_msr(env, ldtul_p(mem_buf));
 718             return sizeof(target_ulong);
 719         case 66:
 720             {
 721                 uint32_t cr = ldl_p(mem_buf);
 722                 int i;
 723                 for (i = 0; i < 8; i++)
 724                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 725                 return 4;
 726             }
 727         case 67:
 728             env->lr = ldtul_p(mem_buf);
 729             return sizeof(target_ulong);
 730         case 68:
 731             env->ctr = ldtul_p(mem_buf);
 732             return sizeof(target_ulong);
 733         case 69:
 734             env->xer = ldtul_p(mem_buf);
 735             return sizeof(target_ulong);
 736         case 70:
 737             /* fpscr */
 738             if (gdb_has_xml)
 739                 return 0;
 740             return 4;
 741         }
 742     }
 743     return 0;
 744 }
 745
 746 #elif defined (TARGET_SPARC)
 747
 748 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 749 #define NUM_CORE_REGS 86
 750 #else
 751 #define NUM_CORE_REGS 72
 752 #endif
 753
 754 #ifdef TARGET_ABI32
 755 #define GET_REGA(val) GET_REG32(val)
 756 #else
 757 #define GET_REGA(val) GET_REGL(val)
 758 #endif
 759
 760 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 761 {
 762     if (n < 8) {
 763         /* g0..g7 */
 764         GET_REGA(env->gregs[n]);
 765     }
 766     if (n < 32) {
 767         /* register window */
 768         GET_REGA(env->regwptr[n - 8]);
 769     }
 770 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 771     if (n < 64) {
 772         /* fprs */
 773         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 774     }
 775     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 776     switch (n) {
 777     case 64: GET_REGA(env->y);
 778     case 65: GET_REGA(GET_PSR(env));
 779     case 66: GET_REGA(env->wim);
 780     case 67: GET_REGA(env->tbr);
 781     case 68: GET_REGA(env->pc);
 782     case 69: GET_REGA(env->npc);
 783     case 70: GET_REGA(env->fsr);
 784     case 71: GET_REGA(0); /* csr */
 785     default: GET_REGA(0);
 786     }
 787 #else
 788     if (n < 64) {
 789         /* f0-f31 */
 790         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 791     }
 792     if (n < 80) {
 793         /* f32-f62 (double width, even numbers only) */
 794         uint64_t val;
 795
 796         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 797         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 798         GET_REG64(val);
 799     }
 800     switch (n) {
 801     case 80: GET_REGL(env->pc);
 802     case 81: GET_REGL(env->npc);
 803     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 804                            ((env->asi & 0xff) << 24) |
 805                            ((env->pstate & 0xfff) << 8) |
 806                            GET_CWP64(env));
 807     case 83: GET_REGL(env->fsr);
 808     case 84: GET_REGL(env->fprs);
 809     case 85: GET_REGL(env->y);
 810     }
 811 #endif
 812     return 0;
 813 }
 814
 815 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 816 {
 817 #if defined(TARGET_ABI32)
 818     abi_ulong tmp;
 819
 820     tmp = ldl_p(mem_buf);
 821 #else
 822     target_ulong tmp;
 823
 824     tmp = ldtul_p(mem_buf);
 825 #endif
 826
 827     if (n < 8) {
 828         /* g0..g7 */
 829         env->gregs[n] = tmp;
 830     } else if (n < 32) {
 831         /* register window */
 832         env->regwptr[n - 8] = tmp;
 833     }
 834 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 835     else if (n < 64) {
 836         /* fprs */
 837         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 838     } else {
 839         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 840         switch (n) {
 841         case 64: env->y = tmp; break;
 842         case 65: PUT_PSR(env, tmp); break;
 843         case 66: env->wim = tmp; break;
 844         case 67: env->tbr = tmp; break;
 845         case 68: env->pc = tmp; break;
 846         case 69: env->npc = tmp; break;
 847         case 70: env->fsr = tmp; break;
 848         default: return 0;
 849         }
 850     }
 851     return 4;
 852 #else
 853     else if (n < 64) {
 854         /* f0-f31 */
 855         env->fpr[n] = ldfl_p(mem_buf);
 856         return 4;
 857     } else if (n < 80) {
 858         /* f32-f62 (double width, even numbers only) */
 859         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 860         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 861     } else {
 862         switch (n) {
 863         case 80: env->pc = tmp; break;
 864         case 81: env->npc = tmp; break;
 865         case 82:
 866             PUT_CCR(env, tmp >> 32);
 867             env->asi = (tmp >> 24) & 0xff;
 868             env->pstate = (tmp >> 8) & 0xfff;
 869             PUT_CWP64(env, tmp & 0xff);
 870             break;
 871         case 83: env->fsr = tmp; break;
 872         case 84: env->fprs = tmp; break;
 873         case 85: env->y = tmp; break;
 874         default: return 0;
 875         }
 876     }
 877     return 8;
 878 #endif
 879 }
 880 #elif defined (TARGET_ARM)
 881
 882 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 883    whatever the target description contains.  Due to a historical mishap
 884    the FPA registers appear in between core integer regs and the CPSR.
 885    We hack round this by giving the FPA regs zero size when talking to a
 886    newer gdb.  */
 887 #define NUM_CORE_REGS 26
 888 #define GDB_CORE_XML "arm-core.xml"
 889
 890 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 891 {
 892     if (n < 16) {
 893         /* Core integer register.  */
 894         GET_REG32(env->regs[n]);
 895     }
 896     if (n < 24) {
 897         /* FPA registers.  */
 898         if (gdb_has_xml)
 899             return 0;
 900         memset(mem_buf, 0, 12);
 901         return 12;
 902     }
 903     switch (n) {
 904     case 24:
 905         /* FPA status register.  */
 906         if (gdb_has_xml)
 907             return 0;
 908         GET_REG32(0);
 909     case 25:
 910         /* CPSR */
 911         GET_REG32(cpsr_read(env));
 912     }
 913     /* Unknown register.  */
 914     return 0;
 915 }
 916
 917 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 918 {
 919     uint32_t tmp;
 920
 921     tmp = ldl_p(mem_buf);
 922
 923     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 924        cause problems if we ever implement the Jazelle DBX extensions.  */
 925     if (n == 15)
 926         tmp &= ~1;
 927
 928     if (n < 16) {
 929         /* Core integer register.  */
 930         env->regs[n] = tmp;
 931         return 4;
 932     }
 933     if (n < 24) { /* 16-23 */
 934         /* FPA registers (ignored).  */
 935         if (gdb_has_xml)
 936             return 0;
 937         return 12;
 938     }
 939     switch (n) {
 940     case 24:
 941         /* FPA status register (ignored).  */
 942         if (gdb_has_xml)
 943             return 0;
 944         return 4;
 945     case 25:
 946         /* CPSR */
 947         cpsr_write (env, tmp, 0xffffffff);
 948         return 4;
 949     }
 950     /* Unknown register.  */
 951     return 0;
 952 }
 953
 954 #elif defined (TARGET_M68K)
 955
 956 #define NUM_CORE_REGS 18
 957
 958 #define GDB_CORE_XML "cf-core.xml"
 959
 960 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 961 {
 962     if (n < 8) {
 963         /* D0-D7 */
 964         GET_REG32(env->dregs[n]);
 965     } else if (n < 16) {
 966         /* A0-A7 */
 967         GET_REG32(env->aregs[n - 8]);
 968     } else {
 969         switch (n) {
 970         case 16: GET_REG32(env->sr);
 971         case 17: GET_REG32(env->pc);
 972         }
 973     }
 974     /* FP registers not included here because they vary between
 975        ColdFire and m68k.  Use XML bits for these.  */
 976     return 0;
 977 }
 978
 979 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 980 {
 981     uint32_t tmp;
 982
 983     tmp = ldl_p(mem_buf);
 984
 985     if (n < 8) {
 986         /* D0-D7 */
 987         env->dregs[n] = tmp;
 988     } else if (n < 8) {
 989         /* A0-A7 */
 990         env->aregs[n - 8] = tmp;
 991     } else {
 992         switch (n) {
 993         case 16: env->sr = tmp; break;
 994         case 17: env->pc = tmp; break;
 995         default: return 0;
 996         }
 997     }
 998     return 4;
 999 }
1000 #elif defined (TARGET_MIPS)
1001
1002 #define NUM_CORE_REGS 73
1003
1004 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1005 {
1006     if (n < 32) {
1007         GET_REGL(env->active_tc.gpr[n]);
1008     }
1009     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
1010         if (n >= 38 && n < 70) {
1011             if (env->CP0_Status & (1 << CP0St_FR))
1012                 GET_REGL(env->active_fpu.fpr[n - 38].d);
1013             else
1014                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
1015         }
1016         switch (n) {
1017         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
1018         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
1019         }
1020     }
1021     switch (n) {
1022     case 32: GET_REGL((int32_t)env->CP0_Status);
1023     case 33: GET_REGL(env->active_tc.LO[0]);
1024     case 34: GET_REGL(env->active_tc.HI[0]);
1025     case 35: GET_REGL(env->CP0_BadVAddr);
1026     case 36: GET_REGL((int32_t)env->CP0_Cause);
1027     case 37: GET_REGL(env->active_tc.PC);
1028     case 72: GET_REGL(0); /* fp */
1029     case 89: GET_REGL((int32_t)env->CP0_PRid);
1030     }
1031     if (n >= 73 && n <= 88) {
1032         /* 16 embedded regs.  */
1033         GET_REGL(0);
1034     }
1035
1036     return 0;
1037 }
1038
1039 /* convert MIPS rounding mode in FCR31 to IEEE library */
1040 static unsigned int ieee_rm[] =
1041   {
1042     float_round_nearest_even,
1043     float_round_to_zero,
1044     float_round_up,
1045     float_round_down
1046   };
1047 #define RESTORE_ROUNDING_MODE \
1048     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1049
1050 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1051 {
1052     target_ulong tmp;
1053
1054     tmp = ldtul_p(mem_buf);
1055
1056     if (n < 32) {
1057         env->active_tc.gpr[n] = tmp;
1058         return sizeof(target_ulong);
1059     }
1060     if (env->CP0_Config1 & (1 << CP0C1_FP)
1061             && n >= 38 && n < 73) {
1062         if (n < 70) {
1063             if (env->CP0_Status & (1 << CP0St_FR))
1064               env->active_fpu.fpr[n - 38].d = tmp;
1065             else
1066               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1067         }
1068         switch (n) {
1069         case 70:
1070             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1071             /* set rounding mode */
1072             RESTORE_ROUNDING_MODE;
1073 #ifndef CONFIG_SOFTFLOAT
1074             /* no floating point exception for native float */
1075             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1076 #endif
1077             break;
1078         case 71: env->active_fpu.fcr0 = tmp; break;
1079         }
1080         return sizeof(target_ulong);
1081     }
1082     switch (n) {
1083     case 32: env->CP0_Status = tmp; break;
1084     case 33: env->active_tc.LO[0] = tmp; break;
1085     case 34: env->active_tc.HI[0] = tmp; break;
1086     case 35: env->CP0_BadVAddr = tmp; break;
1087     case 36: env->CP0_Cause = tmp; break;
1088     case 37: env->active_tc.PC = tmp; break;
1089     case 72: /* fp, ignored */ break;
1090     default:
1091         if (n > 89)
1092             return 0;
1093         /* Other registers are readonly.  Ignore writes.  */
1094         break;
1095     }
1096
1097     return sizeof(target_ulong);
1098 }
1099 #elif defined (TARGET_SH4)
1100
1101 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1102 /* FIXME: We should use XML for this.  */
1103
1104 #define NUM_CORE_REGS 59
1105
1106 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1107 {
1108     if (n < 8) {
1109         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1110             GET_REGL(env->gregs[n + 16]);
1111         } else {
1112             GET_REGL(env->gregs[n]);
1113         }
1114     } else if (n < 16) {
1115         GET_REGL(env->gregs[n - 8]);
1116     } else if (n >= 25 && n < 41) {
1117         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1118     } else if (n >= 43 && n < 51) {
1119         GET_REGL(env->gregs[n - 43]);
1120     } else if (n >= 51 && n < 59) {
1121         GET_REGL(env->gregs[n - (51 - 16)]);
1122     }
1123     switch (n) {
1124     case 16: GET_REGL(env->pc);
1125     case 17: GET_REGL(env->pr);
1126     case 18: GET_REGL(env->gbr);
1127     case 19: GET_REGL(env->vbr);
1128     case 20: GET_REGL(env->mach);
1129     case 21: GET_REGL(env->macl);
1130     case 22: GET_REGL(env->sr);
1131     case 23: GET_REGL(env->fpul);
1132     case 24: GET_REGL(env->fpscr);
1133     case 41: GET_REGL(env->ssr);
1134     case 42: GET_REGL(env->spc);
1135     }
1136
1137     return 0;
1138 }
1139
1140 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1141 {
1142     uint32_t tmp;
1143
1144     tmp = ldl_p(mem_buf);
1145
1146     if (n < 8) {
1147         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1148             env->gregs[n + 16] = tmp;
1149         } else {
1150             env->gregs[n] = tmp;
1151         }
1152         return 4;
1153     } else if (n < 16) {
1154         env->gregs[n - 8] = tmp;
1155         return 4;
1156     } else if (n >= 25 && n < 41) {
1157         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1158     } else if (n >= 43 && n < 51) {
1159         env->gregs[n - 43] = tmp;
1160         return 4;
1161     } else if (n >= 51 && n < 59) {
1162         env->gregs[n - (51 - 16)] = tmp;
1163         return 4;
1164     }
1165     switch (n) {
1166     case 16: env->pc = tmp;
1167     case 17: env->pr = tmp;
1168     case 18: env->gbr = tmp;
1169     case 19: env->vbr = tmp;
1170     case 20: env->mach = tmp;
1171     case 21: env->macl = tmp;
1172     case 22: env->sr = tmp;
1173     case 23: env->fpul = tmp;
1174     case 24: env->fpscr = tmp;
1175     case 41: env->ssr = tmp;
1176     case 42: env->spc = tmp;
1177     default: return 0;
1178     }
1179
1180     return 4;
1181 }
1182 #elif defined (TARGET_MICROBLAZE)
1183
1184 #define NUM_CORE_REGS (32 + 5)
1185
1186 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1187 {
1188     if (n < 32) {
1189         GET_REG32(env->regs[n]);
1190     } else {
1191         GET_REG32(env->sregs[n - 32]);
1192     }
1193     return 0;
1194 }
1195
1196 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1197 {
1198     uint32_t tmp;
1199
1200     if (n > NUM_CORE_REGS)
1201         return 0;
1202
1203     tmp = ldl_p(mem_buf);
1204
1205     if (n < 32) {
1206         env->regs[n] = tmp;
1207     } else {
1208         env->sregs[n - 32] = tmp;
1209     }
1210     return 4;
1211 }
1212 #elif defined (TARGET_CRIS)
1213
1214 #define NUM_CORE_REGS 49
1215
1216 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1217 {
1218     uint8_t srs;
1219
1220     srs = env->pregs[PR_SRS];
1221     if (n < 16) {
1222         GET_REG32(env->regs[n]);
1223     }
1224
1225     if (n >= 21 && n < 32) {
1226         GET_REG32(env->pregs[n - 16]);
1227     }
1228     if (n >= 33 && n < 49) {
1229         GET_REG32(env->sregs[srs][n - 33]);
1230     }
1231     switch (n) {
1232     case 16: GET_REG8(env->pregs[0]);
1233     case 17: GET_REG8(env->pregs[1]);
1234     case 18: GET_REG32(env->pregs[2]);
1235     case 19: GET_REG8(srs);
1236     case 20: GET_REG16(env->pregs[4]);
1237     case 32: GET_REG32(env->pc);
1238     }
1239
1240     return 0;
1241 }
1242
1243 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1244 {
1245     uint32_t tmp;
1246
1247     if (n > 49)
1248         return 0;
1249
1250     tmp = ldl_p(mem_buf);
1251
1252     if (n < 16) {
1253         env->regs[n] = tmp;
1254     }
1255
1256     if (n >= 21 && n < 32) {
1257         env->pregs[n - 16] = tmp;
1258     }
1259
1260     /* FIXME: Should support function regs be writable?  */
1261     switch (n) {
1262     case 16: return 1;
1263     case 17: return 1;
1264     case 18: env->pregs[PR_PID] = tmp; break;
1265     case 19: return 1;
1266     case 20: return 2;
1267     case 32: env->pc = tmp; break;
1268     }
1269
1270     return 4;
1271 }
1272 #elif defined (TARGET_ALPHA)
1273
1274 #define NUM_CORE_REGS 65
1275
1276 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1277 {
1278     if (n < 31) {
1279        GET_REGL(env->ir[n]);
1280     }
1281     else if (n == 31) {
1282        GET_REGL(0);
1283     }
1284     else if (n<63) {
1285        uint64_t val;
1286
1287        val = *((uint64_t *)&env->fir[n-32]);
1288        GET_REGL(val);
1289     }
1290     else if (n==63) {
1291        GET_REGL(env->fpcr);
1292     }
1293     else if (n==64) {
1294        GET_REGL(env->pc);
1295     }
1296     else {
1297        GET_REGL(0);
1298     }
1299
1300     return 0;
1301 }
1302
1303 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1304 {
1305     target_ulong tmp;
1306     tmp = ldtul_p(mem_buf);
1307
1308     if (n < 31) {
1309         env->ir[n] = tmp;
1310     }
1311
1312     if (n > 31 && n < 63) {
1313         env->fir[n - 32] = ldfl_p(mem_buf);
1314     }
1315
1316     if (n == 64 ) {
1317        env->pc=tmp;
1318     }
1319
1320     return 8;
1321 }
1322 #else
1323
1324 #define NUM_CORE_REGS 0
1325
1326 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1327 {
1328     return 0;
1329 }
1330
1331 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1332 {
1333     return 0;
1334 }
1335
1336 #endif
1337
1338 static int num_g_regs = NUM_CORE_REGS;
1339
1340 #ifdef GDB_CORE_XML
1341 /* Encode data using the encoding for 'x' packets.  */
1342 static int memtox(char *buf, const char *mem, int len)
1343 {
1344     char *p = buf;
1345     char c;
1346
1347     while (len--) {
1348         c = *(mem++);
1349         switch (c) {
1350         case '#': case '$': case '*': case '}':
1351             *(p++) = '}';
1352             *(p++) = c ^ 0x20;
1353             break;
1354         default:
1355             *(p++) = c;
1356             break;
1357         }
1358     }
1359     return p - buf;
1360 }
1361
1362 static const char *get_feature_xml(const char *p, const char **newp)
1363 {
1364     extern const char *const xml_builtin[][2];
1365     size_t len;
1366     int i;
1367     const char *name;
1368     static char target_xml[1024];
1369
1370     len = 0;
1371     while (p[len] && p[len] != ':')
1372         len++;
1373     *newp = p + len;
1374
1375     name = NULL;
1376     if (strncmp(p, "target.xml", len) == 0) {
1377         /* Generate the XML description for this CPU.  */
1378         if (!target_xml[0]) {
1379             GDBRegisterState *r;
1380
1381             snprintf(target_xml, sizeof(target_xml),
1382                      "<?xml version=\"1.0\"?>"
1383                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1384                      "<target>"
1385                      "<xi:include href=\"%s\"/>",
1386                      GDB_CORE_XML);
1387
1388             for (r = first_cpu->gdb_regs; r; r = r->next) {
1389                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
1390                 pstrcat(target_xml, sizeof(target_xml), r->xml);
1391                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
1392             }
1393             pstrcat(target_xml, sizeof(target_xml), "</target>");
1394         }
1395         return target_xml;
1396     }
1397     for (i = 0; ; i++) {
1398         name = xml_builtin[i][0];
1399         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1400             break;
1401     }
1402     return name ? xml_builtin[i][1] : NULL;
1403 }
1404 #endif
1405
1406 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1407 {
1408     GDBRegisterState *r;
1409
1410     if (reg < NUM_CORE_REGS)
1411         return cpu_gdb_read_register(env, mem_buf, reg);
1412
1413     for (r = env->gdb_regs; r; r = r->next) {
1414         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1415             return r->get_reg(env, mem_buf, reg - r->base_reg);
1416         }
1417     }
1418     return 0;
1419 }
1420
1421 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1422 {
1423     GDBRegisterState *r;
1424
1425     if (reg < NUM_CORE_REGS)
1426         return cpu_gdb_write_register(env, mem_buf, reg);
1427
1428     for (r = env->gdb_regs; r; r = r->next) {
1429         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1430             return r->set_reg(env, mem_buf, reg - r->base_reg);
1431         }
1432     }
1433     return 0;
1434 }
1435
1436 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1437    specifies the first register number and these registers are included in
1438    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1439    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1440  */
1441
1442 void gdb_register_coprocessor(CPUState * env,
1443                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1444                              int num_regs, const char *xml, int g_pos)
1445 {
1446     GDBRegisterState *s;
1447     GDBRegisterState **p;
1448     static int last_reg = NUM_CORE_REGS;
1449
1450     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1451     s->base_reg = last_reg;
1452     s->num_regs = num_regs;
1453     s->get_reg = get_reg;
1454     s->set_reg = set_reg;
1455     s->xml = xml;
1456     p = &env->gdb_regs;
1457     while (*p) {
1458         /* Check for duplicates.  */
1459         if (strcmp((*p)->xml, xml) == 0)
1460             return;
1461         p = &(*p)->next;
1462     }
1463     /* Add to end of list.  */
1464     last_reg += num_regs;
1465     *p = s;
1466     if (g_pos) {
1467         if (g_pos != s->base_reg) {
1468             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1469                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1470         } else {
1471             num_g_regs = last_reg;
1472         }
1473     }
1474 }
1475
1476 #ifndef CONFIG_USER_ONLY
1477 static const int xlat_gdb_type[] = {
1478     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1479     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1480     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1481 };
1482 #endif
1483
1484 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1485 {
1486     CPUState *env;
1487     int err = 0;
1488
1489     if (kvm_enabled())
1490         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1491
1492     switch (type) {
1493     case GDB_BREAKPOINT_SW:
1494     case GDB_BREAKPOINT_HW:
1495         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1496             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1497             if (err)
1498                 break;
1499         }
1500         return err;
1501 #ifndef CONFIG_USER_ONLY
1502     case GDB_WATCHPOINT_WRITE:
1503     case GDB_WATCHPOINT_READ:
1504     case GDB_WATCHPOINT_ACCESS:
1505         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1506             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1507                                         NULL);
1508             if (err)
1509                 break;
1510         }
1511         return err;
1512 #endif
1513     default:
1514         return -ENOSYS;
1515     }
1516 }
1517
1518 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1519 {
1520     CPUState *env;
1521     int err = 0;
1522
1523     if (kvm_enabled())
1524         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1525
1526     switch (type) {
1527     case GDB_BREAKPOINT_SW:
1528     case GDB_BREAKPOINT_HW:
1529         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1530             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1531             if (err)
1532                 break;
1533         }
1534         return err;
1535 #ifndef CONFIG_USER_ONLY
1536     case GDB_WATCHPOINT_WRITE:
1537     case GDB_WATCHPOINT_READ:
1538     case GDB_WATCHPOINT_ACCESS:
1539         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1540             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1541             if (err)
1542                 break;
1543         }
1544         return err;
1545 #endif
1546     default:
1547         return -ENOSYS;
1548     }
1549 }
1550
1551 static void gdb_breakpoint_remove_all(void)
1552 {
1553     CPUState *env;
1554
1555     if (kvm_enabled()) {
1556         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1557         return;
1558     }
1559
1560     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1561         cpu_breakpoint_remove_all(env, BP_GDB);
1562 #ifndef CONFIG_USER_ONLY
1563         cpu_watchpoint_remove_all(env, BP_GDB);
1564 #endif
1565     }
1566 }
1567
1568 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1569 {
1570 #if defined(TARGET_I386)
1571     cpu_synchronize_state(s->c_cpu);
1572     s->c_cpu->eip = pc;
1573 #elif defined (TARGET_PPC)
1574     s->c_cpu->nip = pc;
1575 #elif defined (TARGET_SPARC)
1576     s->c_cpu->pc = pc;
1577     s->c_cpu->npc = pc + 4;
1578 #elif defined (TARGET_ARM)
1579     s->c_cpu->regs[15] = pc;
1580 #elif defined (TARGET_SH4)
1581     s->c_cpu->pc = pc;
1582 #elif defined (TARGET_MIPS)
1583     s->c_cpu->active_tc.PC = pc;
1584 #elif defined (TARGET_MICROBLAZE)
1585     s->c_cpu->sregs[SR_PC] = pc;
1586 #elif defined (TARGET_CRIS)
1587     s->c_cpu->pc = pc;
1588 #elif defined (TARGET_ALPHA)
1589     s->c_cpu->pc = pc;
1590 #endif
1591 }
1592
1593 static inline int gdb_id(CPUState *env)
1594 {
1595 #if defined(CONFIG_USER_ONLY) && defined(CONFIG_USE_NPTL)
1596     return env->host_tid;
1597 #else
1598     return env->cpu_index + 1;
1599 #endif
1600 }
1601
1602 static CPUState *find_cpu(uint32_t thread_id)
1603 {
1604     CPUState *env;
1605
1606     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1607         if (gdb_id(env) == thread_id) {
1608             return env;
1609         }
1610     }
1611
1612     return NULL;
1613 }
1614
1615 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1616 {
1617     CPUState *env;
1618     const char *p;
1619     uint32_t thread;
1620     int ch, reg_size, type, res;
1621     char buf[MAX_PACKET_LENGTH];
1622     uint8_t mem_buf[MAX_PACKET_LENGTH];
1623     uint8_t *registers;
1624     target_ulong addr, len;
1625
1626 #ifdef DEBUG_GDB
1627     printf("command='%s'\n", line_buf);
1628 #endif
1629     p = line_buf;
1630     ch = *p++;
1631     switch(ch) {
1632     case '?':
1633         /* TODO: Make this return the correct value for user-mode.  */
1634         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1635                  gdb_id(s->c_cpu));
1636         put_packet(s, buf);
1637         /* Remove all the breakpoints when this query is issued,
1638          * because gdb is doing and initial connect and the state
1639          * should be cleaned up.
1640          */
1641         gdb_breakpoint_remove_all();
1642         break;
1643     case 'c':
1644         if (*p != '\0') {
1645             addr = strtoull(p, (char **)&p, 16);
1646             gdb_set_cpu_pc(s, addr);
1647         }
1648         s->signal = 0;
1649         gdb_continue(s);
1650         return RS_IDLE;
1651     case 'C':
1652         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1653         if (s->signal == -1)
1654             s->signal = 0;
1655         gdb_continue(s);
1656         return RS_IDLE;
1657     case 'v':
1658         if (strncmp(p, "Cont", 4) == 0) {
1659             int res_signal, res_thread;
1660
1661             p += 4;
1662             if (*p == '?') {
1663                 put_packet(s, "vCont;c;C;s;S");
1664                 break;
1665             }
1666             res = 0;
1667             res_signal = 0;
1668             res_thread = 0;
1669             while (*p) {
1670                 int action, signal;
1671
1672                 if (*p++ != ';') {
1673                     res = 0;
1674                     break;
1675                 }
1676                 action = *p++;
1677                 signal = 0;
1678                 if (action == 'C' || action == 'S') {
1679                     signal = strtoul(p, (char **)&p, 16);
1680                 } else if (action != 'c' && action != 's') {
1681                     res = 0;
1682                     break;
1683                 }
1684                 thread = 0;
1685                 if (*p == ':') {
1686                     thread = strtoull(p+1, (char **)&p, 16);
1687                 }
1688                 action = tolower(action);
1689                 if (res == 0 || (res == 'c' && action == 's')) {
1690                     res = action;
1691                     res_signal = signal;
1692                     res_thread = thread;
1693                 }
1694             }
1695             if (res) {
1696                 if (res_thread != -1 && res_thread != 0) {
1697                     env = find_cpu(res_thread);
1698                     if (env == NULL) {
1699                         put_packet(s, "E22");
1700                         break;
1701                     }
1702                     s->c_cpu = env;
1703                 }
1704                 if (res == 's') {
1705                     cpu_single_step(s->c_cpu, sstep_flags);
1706                 }
1707                 s->signal = res_signal;
1708                 gdb_continue(s);
1709                 return RS_IDLE;
1710             }
1711             break;
1712         } else {
1713             goto unknown_command;
1714         }
1715     case 'k':
1716         /* Kill the target */
1717         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1718         exit(0);
1719     case 'D':
1720         /* Detach packet */
1721         gdb_breakpoint_remove_all();
1722         gdb_continue(s);
1723         put_packet(s, "OK");
1724         break;
1725     case 's':
1726         if (*p != '\0') {
1727             addr = strtoull(p, (char **)&p, 16);
1728             gdb_set_cpu_pc(s, addr);
1729         }
1730         cpu_single_step(s->c_cpu, sstep_flags);
1731         gdb_continue(s);
1732         return RS_IDLE;
1733     case 'F':
1734         {
1735             target_ulong ret;
1736             target_ulong err;
1737
1738             ret = strtoull(p, (char **)&p, 16);
1739             if (*p == ',') {
1740                 p++;
1741                 err = strtoull(p, (char **)&p, 16);
1742             } else {
1743                 err = 0;
1744             }
1745             if (*p == ',')
1746                 p++;
1747             type = *p;
1748             if (gdb_current_syscall_cb)
1749                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1750             if (type == 'C') {
1751                 put_packet(s, "T02");
1752             } else {
1753                 gdb_continue(s);
1754             }
1755         }
1756         break;
1757     case 'g':
1758         cpu_synchronize_state(s->g_cpu);
1759         len = 0;
1760         for (addr = 0; addr < num_g_regs; addr++) {
1761             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1762             len += reg_size;
1763         }
1764         memtohex(buf, mem_buf, len);
1765         put_packet(s, buf);
1766         break;
1767     case 'G':
1768         cpu_synchronize_state(s->g_cpu);
1769         registers = mem_buf;
1770         len = strlen(p) / 2;
1771         hextomem((uint8_t *)registers, p, len);
1772         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1773             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1774             len -= reg_size;
1775             registers += reg_size;
1776         }
1777         put_packet(s, "OK");
1778         break;
1779     case 'm':
1780         addr = strtoull(p, (char **)&p, 16);
1781         if (*p == ',')
1782             p++;
1783         len = strtoull(p, NULL, 16);
1784         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1785             put_packet (s, "E14");
1786         } else {
1787             memtohex(buf, mem_buf, len);
1788             put_packet(s, buf);
1789         }
1790         break;
1791     case 'M':
1792         addr = strtoull(p, (char **)&p, 16);
1793         if (*p == ',')
1794             p++;
1795         len = strtoull(p, (char **)&p, 16);
1796         if (*p == ':')
1797             p++;
1798         hextomem(mem_buf, p, len);
1799         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1800             put_packet(s, "E14");
1801         else
1802             put_packet(s, "OK");
1803         break;
1804     case 'p':
1805         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1806            This works, but can be very slow.  Anything new enough to
1807            understand XML also knows how to use this properly.  */
1808         if (!gdb_has_xml)
1809             goto unknown_command;
1810         addr = strtoull(p, (char **)&p, 16);
1811         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1812         if (reg_size) {
1813             memtohex(buf, mem_buf, reg_size);
1814             put_packet(s, buf);
1815         } else {
1816             put_packet(s, "E14");
1817         }
1818         break;
1819     case 'P':
1820         if (!gdb_has_xml)
1821             goto unknown_command;
1822         addr = strtoull(p, (char **)&p, 16);
1823         if (*p == '=')
1824             p++;
1825         reg_size = strlen(p) / 2;
1826         hextomem(mem_buf, p, reg_size);
1827         gdb_write_register(s->g_cpu, mem_buf, addr);
1828         put_packet(s, "OK");
1829         break;
1830     case 'Z':
1831     case 'z':
1832         type = strtoul(p, (char **)&p, 16);
1833         if (*p == ',')
1834             p++;
1835         addr = strtoull(p, (char **)&p, 16);
1836         if (*p == ',')
1837             p++;
1838         len = strtoull(p, (char **)&p, 16);
1839         if (ch == 'Z')
1840             res = gdb_breakpoint_insert(addr, len, type);
1841         else
1842             res = gdb_breakpoint_remove(addr, len, type);
1843         if (res >= 0)
1844              put_packet(s, "OK");
1845         else if (res == -ENOSYS)
1846             put_packet(s, "");
1847         else
1848             put_packet(s, "E22");
1849         break;
1850     case 'H':
1851         type = *p++;
1852         thread = strtoull(p, (char **)&p, 16);
1853         if (thread == -1 || thread == 0) {
1854             put_packet(s, "OK");
1855             break;
1856         }
1857         env = find_cpu(thread);
1858         if (env == NULL) {
1859             put_packet(s, "E22");
1860             break;
1861         }
1862         switch (type) {
1863         case 'c':
1864             s->c_cpu = env;
1865             put_packet(s, "OK");
1866             break;
1867         case 'g':
1868             s->g_cpu = env;
1869             put_packet(s, "OK");
1870             break;
1871         default:
1872              put_packet(s, "E22");
1873              break;
1874         }
1875         break;
1876     case 'T':
1877         thread = strtoull(p, (char **)&p, 16);
1878         env = find_cpu(thread);
1879
1880         if (env != NULL) {
1881             put_packet(s, "OK");
1882         } else {
1883             put_packet(s, "E22");
1884         }
1885         break;
1886     case 'q':
1887     case 'Q':
1888         /* parse any 'q' packets here */
1889         if (!strcmp(p,"qemu.sstepbits")) {
1890             /* Query Breakpoint bit definitions */
1891             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1892                      SSTEP_ENABLE,
1893                      SSTEP_NOIRQ,
1894                      SSTEP_NOTIMER);
1895             put_packet(s, buf);
1896             break;
1897         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1898             /* Display or change the sstep_flags */
1899             p += 10;
1900             if (*p != '=') {
1901                 /* Display current setting */
1902                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1903                 put_packet(s, buf);
1904                 break;
1905             }
1906             p++;
1907             type = strtoul(p, (char **)&p, 16);
1908             sstep_flags = type;
1909             put_packet(s, "OK");
1910             break;
1911         } else if (strcmp(p,"C") == 0) {
1912             /* "Current thread" remains vague in the spec, so always return
1913              *  the first CPU (gdb returns the first thread). */
1914             put_packet(s, "QC1");
1915             break;
1916         } else if (strcmp(p,"fThreadInfo") == 0) {
1917             s->query_cpu = first_cpu;
1918             goto report_cpuinfo;
1919         } else if (strcmp(p,"sThreadInfo") == 0) {
1920         report_cpuinfo:
1921             if (s->query_cpu) {
1922                 snprintf(buf, sizeof(buf), "m%x", gdb_id(s->query_cpu));
1923                 put_packet(s, buf);
1924                 s->query_cpu = s->query_cpu->next_cpu;
1925             } else
1926                 put_packet(s, "l");
1927             break;
1928         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1929             thread = strtoull(p+16, (char **)&p, 16);
1930             env = find_cpu(thread);
1931             if (env != NULL) {
1932                 cpu_synchronize_state(env);
1933                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
1934                                "CPU#%d [%s]", env->cpu_index,
1935                                env->halted ? "halted " : "running");
1936                 memtohex(buf, mem_buf, len);
1937                 put_packet(s, buf);
1938             }
1939             break;
1940         }
1941 #ifdef CONFIG_USER_ONLY
1942         else if (strncmp(p, "Offsets", 7) == 0) {
1943             TaskState *ts = s->c_cpu->opaque;
1944
1945             snprintf(buf, sizeof(buf),
1946                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1947                      ";Bss=" TARGET_ABI_FMT_lx,
1948                      ts->info->code_offset,
1949                      ts->info->data_offset,
1950                      ts->info->data_offset);
1951             put_packet(s, buf);
1952             break;
1953         }
1954 #else /* !CONFIG_USER_ONLY */
1955         else if (strncmp(p, "Rcmd,", 5) == 0) {
1956             int len = strlen(p + 5);
1957
1958             if ((len % 2) != 0) {
1959                 put_packet(s, "E01");
1960                 break;
1961             }
1962             hextomem(mem_buf, p + 5, len);
1963             len = len / 2;
1964             mem_buf[len++] = 0;
1965             qemu_chr_read(s->mon_chr, mem_buf, len);
1966             put_packet(s, "OK");
1967             break;
1968         }
1969 #endif /* !CONFIG_USER_ONLY */
1970         if (strncmp(p, "Supported", 9) == 0) {
1971             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1972 #ifdef GDB_CORE_XML
1973             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1974 #endif
1975             put_packet(s, buf);
1976             break;
1977         }
1978 #ifdef GDB_CORE_XML
1979         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1980             const char *xml;
1981             target_ulong total_len;
1982
1983             gdb_has_xml = 1;
1984             p += 19;
1985             xml = get_feature_xml(p, &p);
1986             if (!xml) {
1987                 snprintf(buf, sizeof(buf), "E00");
1988                 put_packet(s, buf);
1989                 break;
1990             }
1991
1992             if (*p == ':')
1993                 p++;
1994             addr = strtoul(p, (char **)&p, 16);
1995             if (*p == ',')
1996                 p++;
1997             len = strtoul(p, (char **)&p, 16);
1998
1999             total_len = strlen(xml);
2000             if (addr > total_len) {
2001                 snprintf(buf, sizeof(buf), "E00");
2002                 put_packet(s, buf);
2003                 break;
2004             }
2005             if (len > (MAX_PACKET_LENGTH - 5) / 2)
2006                 len = (MAX_PACKET_LENGTH - 5) / 2;
2007             if (len < total_len - addr) {
2008                 buf[0] = 'm';
2009                 len = memtox(buf + 1, xml + addr, len);
2010             } else {
2011                 buf[0] = 'l';
2012                 len = memtox(buf + 1, xml + addr, total_len - addr);
2013             }
2014             put_packet_binary(s, buf, len + 1);
2015             break;
2016         }
2017 #endif
2018         /* Unrecognised 'q' command.  */
2019         goto unknown_command;
2020
2021     default:
2022     unknown_command:
2023         /* put empty packet */
2024         buf[0] = '\0';
2025         put_packet(s, buf);
2026         break;
2027     }
2028     return RS_IDLE;
2029 }
2030
2031 void gdb_set_stop_cpu(CPUState *env)
2032 {
2033     gdbserver_state->c_cpu = env;
2034     gdbserver_state->g_cpu = env;
2035 }
2036
2037 #ifndef CONFIG_USER_ONLY
2038 static void gdb_vm_state_change(void *opaque, int running, int reason)
2039 {
2040     GDBState *s = gdbserver_state;
2041     CPUState *env = s->c_cpu;
2042     char buf[256];
2043     const char *type;
2044     int ret;
2045
2046     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
2047         s->state == RS_INACTIVE || s->state == RS_SYSCALL)
2048         return;
2049
2050     /* disable single step if it was enable */
2051     cpu_single_step(env, 0);
2052
2053     if (reason == EXCP_DEBUG) {
2054         if (env->watchpoint_hit) {
2055             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
2056             case BP_MEM_READ:
2057                 type = "r";
2058                 break;
2059             case BP_MEM_ACCESS:
2060                 type = "a";
2061                 break;
2062             default:
2063                 type = "";
2064                 break;
2065             }
2066             snprintf(buf, sizeof(buf),
2067                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
2068                      GDB_SIGNAL_TRAP, gdb_id(env), type,
2069                      env->watchpoint_hit->vaddr);
2070             put_packet(s, buf);
2071             env->watchpoint_hit = NULL;
2072             return;
2073         }
2074         tb_flush(env);
2075         ret = GDB_SIGNAL_TRAP;
2076     } else {
2077         ret = GDB_SIGNAL_INT;
2078     }
2079     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, gdb_id(env));
2080     put_packet(s, buf);
2081 }
2082 #endif
2083
2084 /* Send a gdb syscall request.
2085    This accepts limited printf-style format specifiers, specifically:
2086     %x  - target_ulong argument printed in hex.
2087     %lx - 64-bit argument printed in hex.
2088     %s  - string pointer (target_ulong) and length (int) pair.  */
2089 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
2090 {
2091     va_list va;
2092     char buf[256];
2093     char *p;
2094     target_ulong addr;
2095     uint64_t i64;
2096     GDBState *s;
2097
2098     s = gdbserver_state;
2099     if (!s)
2100         return;
2101     gdb_current_syscall_cb = cb;
2102     s->state = RS_SYSCALL;
2103 #ifndef CONFIG_USER_ONLY
2104     vm_stop(EXCP_DEBUG);
2105 #endif
2106     s->state = RS_IDLE;
2107     va_start(va, fmt);
2108     p = buf;
2109     *(p++) = 'F';
2110     while (*fmt) {
2111         if (*fmt == '%') {
2112             fmt++;
2113             switch (*fmt++) {
2114             case 'x':
2115                 addr = va_arg(va, target_ulong);
2116                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
2117                 break;
2118             case 'l':
2119                 if (*(fmt++) != 'x')
2120                     goto bad_format;
2121                 i64 = va_arg(va, uint64_t);
2122                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
2123                 break;
2124             case 's':
2125                 addr = va_arg(va, target_ulong);
2126                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
2127                               addr, va_arg(va, int));
2128                 break;
2129             default:
2130             bad_format:
2131                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2132                         fmt - 1);
2133                 break;
2134             }
2135         } else {
2136             *(p++) = *(fmt++);
2137         }
2138     }
2139     *p = 0;
2140     va_end(va);
2141     put_packet(s, buf);
2142 #ifdef CONFIG_USER_ONLY
2143     gdb_handlesig(s->c_cpu, 0);
2144 #else
2145     cpu_exit(s->c_cpu);
2146 #endif
2147 }
2148
2149 static void gdb_read_byte(GDBState *s, int ch)
2150 {
2151     int i, csum;
2152     uint8_t reply;
2153
2154 #ifndef CONFIG_USER_ONLY
2155     if (s->last_packet_len) {
2156         /* Waiting for a response to the last packet.  If we see the start
2157            of a new command then abandon the previous response.  */
2158         if (ch == '-') {
2159 #ifdef DEBUG_GDB
2160             printf("Got NACK, retransmitting\n");
2161 #endif
2162             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2163         }
2164 #ifdef DEBUG_GDB
2165         else if (ch == '+')
2166             printf("Got ACK\n");
2167         else
2168             printf("Got '%c' when expecting ACK/NACK\n", ch);
2169 #endif
2170         if (ch == '+' || ch == '$')
2171             s->last_packet_len = 0;
2172         if (ch != '$')
2173             return;
2174     }
2175     if (vm_running) {
2176         /* when the CPU is running, we cannot do anything except stop
2177            it when receiving a char */
2178         vm_stop(EXCP_INTERRUPT);
2179     } else
2180 #endif
2181     {
2182         switch(s->state) {
2183         case RS_IDLE:
2184             if (ch == '$') {
2185                 s->line_buf_index = 0;
2186                 s->state = RS_GETLINE;
2187             }
2188             break;
2189         case RS_GETLINE:
2190             if (ch == '#') {
2191             s->state = RS_CHKSUM1;
2192             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2193                 s->state = RS_IDLE;
2194             } else {
2195             s->line_buf[s->line_buf_index++] = ch;
2196             }
2197             break;
2198         case RS_CHKSUM1:
2199             s->line_buf[s->line_buf_index] = '\0';
2200             s->line_csum = fromhex(ch) << 4;
2201             s->state = RS_CHKSUM2;
2202             break;
2203         case RS_CHKSUM2:
2204             s->line_csum |= fromhex(ch);
2205             csum = 0;
2206             for(i = 0; i < s->line_buf_index; i++) {
2207                 csum += s->line_buf[i];
2208             }
2209             if (s->line_csum != (csum & 0xff)) {
2210                 reply = '-';
2211                 put_buffer(s, &reply, 1);
2212                 s->state = RS_IDLE;
2213             } else {
2214                 reply = '+';
2215                 put_buffer(s, &reply, 1);
2216                 s->state = gdb_handle_packet(s, s->line_buf);
2217             }
2218             break;
2219         default:
2220             abort();
2221         }
2222     }
2223 }
2224
2225 #ifdef CONFIG_USER_ONLY
2226 int
2227 gdb_queuesig (void)
2228 {
2229     GDBState *s;
2230
2231     s = gdbserver_state;
2232
2233     if (gdbserver_fd < 0 || s->fd < 0)
2234         return 0;
2235     else
2236         return 1;
2237 }
2238
2239 int
2240 gdb_handlesig (CPUState *env, int sig)
2241 {
2242   GDBState *s;
2243   char buf[256];
2244   int n;
2245
2246   s = gdbserver_state;
2247   if (gdbserver_fd < 0 || s->fd < 0)
2248     return sig;
2249
2250   /* disable single step if it was enabled */
2251   cpu_single_step(env, 0);
2252   tb_flush(env);
2253
2254   if (sig != 0)
2255     {
2256       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2257       put_packet(s, buf);
2258     }
2259   /* put_packet() might have detected that the peer terminated the
2260      connection.  */
2261   if (s->fd < 0)
2262       return sig;
2263
2264   sig = 0;
2265   s->state = RS_IDLE;
2266   s->running_state = 0;
2267   while (s->running_state == 0) {
2268       n = read (s->fd, buf, 256);
2269       if (n > 0)
2270         {
2271           int i;
2272
2273           for (i = 0; i < n; i++)
2274             gdb_read_byte (s, buf[i]);
2275         }
2276       else if (n == 0 || errno != EAGAIN)
2277         {
2278           /* XXX: Connection closed.  Should probably wait for annother
2279              connection before continuing.  */
2280           return sig;
2281         }
2282   }
2283   sig = s->signal;
2284   s->signal = 0;
2285   return sig;
2286 }
2287
2288 /* Tell the remote gdb that the process has exited.  */
2289 void gdb_exit(CPUState *env, int code)
2290 {
2291   GDBState *s;
2292   char buf[4];
2293
2294   s = gdbserver_state;
2295   if (gdbserver_fd < 0 || s->fd < 0)
2296     return;
2297
2298   snprintf(buf, sizeof(buf), "W%02x", code);
2299   put_packet(s, buf);
2300 }
2301
2302 /* Tell the remote gdb that the process has exited due to SIG.  */
2303 void gdb_signalled(CPUState *env, int sig)
2304 {
2305   GDBState *s;
2306   char buf[4];
2307
2308   s = gdbserver_state;
2309   if (gdbserver_fd < 0 || s->fd < 0)
2310     return;
2311
2312   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2313   put_packet(s, buf);
2314 }
2315
2316 static void gdb_accept(void)
2317 {
2318     GDBState *s;
2319     struct sockaddr_in sockaddr;
2320     socklen_t len;
2321     int val, fd;
2322
2323     for(;;) {
2324         len = sizeof(sockaddr);
2325         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2326         if (fd < 0 && errno != EINTR) {
2327             perror("accept");
2328             return;
2329         } else if (fd >= 0) {
2330             break;
2331         }
2332     }
2333
2334     /* set short latency */
2335     val = 1;
2336     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2337
2338     s = qemu_mallocz(sizeof(GDBState));
2339     s->c_cpu = first_cpu;
2340     s->g_cpu = first_cpu;
2341     s->fd = fd;
2342     gdb_has_xml = 0;
2343
2344     gdbserver_state = s;
2345
2346     fcntl(fd, F_SETFL, O_NONBLOCK);
2347 }
2348
2349 static int gdbserver_open(int port)
2350 {
2351     struct sockaddr_in sockaddr;
2352     int fd, val, ret;
2353
2354     fd = socket(PF_INET, SOCK_STREAM, 0);
2355     if (fd < 0) {
2356         perror("socket");
2357         return -1;
2358     }
2359
2360     /* allow fast reuse */
2361     val = 1;
2362     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2363
2364     sockaddr.sin_family = AF_INET;
2365     sockaddr.sin_port = htons(port);
2366     sockaddr.sin_addr.s_addr = 0;
2367     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2368     if (ret < 0) {
2369         perror("bind");
2370         return -1;
2371     }
2372     ret = listen(fd, 0);
2373     if (ret < 0) {
2374         perror("listen");
2375         return -1;
2376     }
2377     return fd;
2378 }
2379
2380 int gdbserver_start(int port)
2381 {
2382     gdbserver_fd = gdbserver_open(port);
2383     if (gdbserver_fd < 0)
2384         return -1;
2385     /* accept connections */
2386     gdb_accept();
2387     return 0;
2388 }
2389
2390 /* Disable gdb stub for child processes.  */
2391 void gdbserver_fork(CPUState *env)
2392 {
2393     GDBState *s = gdbserver_state;
2394     if (gdbserver_fd < 0 || s->fd < 0)
2395       return;
2396     close(s->fd);
2397     s->fd = -1;
2398     cpu_breakpoint_remove_all(env, BP_GDB);
2399     cpu_watchpoint_remove_all(env, BP_GDB);
2400 }
2401 #else
2402 static int gdb_chr_can_receive(void *opaque)
2403 {
2404   /* We can handle an arbitrarily large amount of data.
2405    Pick the maximum packet size, which is as good as anything.  */
2406   return MAX_PACKET_LENGTH;
2407 }
2408
2409 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2410 {
2411     int i;
2412
2413     for (i = 0; i < size; i++) {
2414         gdb_read_byte(gdbserver_state, buf[i]);
2415     }
2416 }
2417
2418 static void gdb_chr_event(void *opaque, int event)
2419 {
2420     switch (event) {
2421     case CHR_EVENT_RESET:
2422         vm_stop(EXCP_INTERRUPT);
2423         gdb_has_xml = 0;
2424         break;
2425     default:
2426         break;
2427     }
2428 }
2429
2430 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2431 {
2432     char buf[MAX_PACKET_LENGTH];
2433
2434     buf[0] = 'O';
2435     if (len > (MAX_PACKET_LENGTH/2) - 1)
2436         len = (MAX_PACKET_LENGTH/2) - 1;
2437     memtohex(buf + 1, (uint8_t *)msg, len);
2438     put_packet(s, buf);
2439 }
2440
2441 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2442 {
2443     const char *p = (const char *)buf;
2444     int max_sz;
2445
2446     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2447     for (;;) {
2448         if (len <= max_sz) {
2449             gdb_monitor_output(gdbserver_state, p, len);
2450             break;
2451         }
2452         gdb_monitor_output(gdbserver_state, p, max_sz);
2453         p += max_sz;
2454         len -= max_sz;
2455     }
2456     return len;
2457 }
2458
2459 #ifndef _WIN32
2460 static void gdb_sigterm_handler(int signal)
2461 {
2462     if (vm_running)
2463         vm_stop(EXCP_INTERRUPT);
2464 }
2465 #endif
2466
2467 int gdbserver_start(const char *device)
2468 {
2469     GDBState *s;
2470     char gdbstub_device_name[128];
2471     CharDriverState *chr = NULL;
2472     CharDriverState *mon_chr;
2473
2474     if (!device)
2475         return -1;
2476     if (strcmp(device, "none") != 0) {
2477         if (strstart(device, "tcp:", NULL)) {
2478             /* enforce required TCP attributes */
2479             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2480                      "%s,nowait,nodelay,server", device);
2481             device = gdbstub_device_name;
2482         }
2483 #ifndef _WIN32
2484         else if (strcmp(device, "stdio") == 0) {
2485             struct sigaction act;
2486
2487             memset(&act, 0, sizeof(act));
2488             act.sa_handler = gdb_sigterm_handler;
2489             sigaction(SIGINT, &act, NULL);
2490         }
2491 #endif
2492         chr = qemu_chr_open("gdb", device, NULL);
2493         if (!chr)
2494             return -1;
2495
2496         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2497                               gdb_chr_event, NULL);
2498     }
2499
2500     s = gdbserver_state;
2501     if (!s) {
2502         s = qemu_mallocz(sizeof(GDBState));
2503         gdbserver_state = s;
2504
2505         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2506
2507         /* Initialize a monitor terminal for gdb */
2508         mon_chr = qemu_mallocz(sizeof(*mon_chr));
2509         mon_chr->chr_write = gdb_monitor_write;
2510         monitor_init(mon_chr, 0);
2511     } else {
2512         if (s->chr)
2513             qemu_chr_close(s->chr);
2514         mon_chr = s->mon_chr;
2515         memset(s, 0, sizeof(GDBState));
2516     }
2517     s->c_cpu = first_cpu;
2518     s->g_cpu = first_cpu;
2519     s->chr = chr;
2520     s->state = chr ? RS_IDLE : RS_INACTIVE;
2521     s->mon_chr = mon_chr;
2522
2523     return 0;
2524 }
2525 #endif