gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20 #include "config.h"
  21 #include "qemu-common.h"
  22 #ifdef CONFIG_USER_ONLY
  23 #include <stdlib.h>
  24 #include <stdio.h>
  25 #include <stdarg.h>
  26 #include <string.h>
  27 #include <errno.h>
  28 #include <unistd.h>
  29 #include <fcntl.h>
  30
  31 #include "qemu.h"
  32 #else
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #include "qemu-kvm.h"
  37 #endif
  38
  39 #define MAX_PACKET_LENGTH 4096
  40
  41 #include "qemu_socket.h"
  42 #ifdef _WIN32
  43 /* XXX: these constants may be independent of the host ones even for Unix */
  44 #ifndef SIGTRAP
  45 #define SIGTRAP 5
  46 #endif
  47 #ifndef SIGINT
  48 #define SIGINT 2
  49 #endif
  50 #else
  51 #include <signal.h>
  52 #endif
  53
  54 //#define DEBUG_GDB
  55
  56 typedef struct GDBRegisterState {
  57     int base_reg;
  58     int num_regs;
  59     gdb_reg_cb get_reg;
  60     gdb_reg_cb set_reg;
  61     const char *xml;
  62     struct GDBRegisterState *next;
  63 } GDBRegisterState;
  64
  65 enum RSState {
  66     RS_IDLE,
  67     RS_GETLINE,
  68     RS_CHKSUM1,
  69     RS_CHKSUM2,
  70     RS_SYSCALL,
  71 };
  72 typedef struct GDBState {
  73     CPUState *c_cpu; /* current CPU for step/continue ops */
  74     CPUState *g_cpu; /* current CPU for other ops */
  75     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
  76     enum RSState state; /* parsing state */
  77     char line_buf[MAX_PACKET_LENGTH];
  78     int line_buf_index;
  79     int line_csum;
  80     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
  81     int last_packet_len;
  82     int signal;
  83 #ifdef CONFIG_USER_ONLY
  84     int fd;
  85     int running_state;
  86 #else
  87     CharDriverState *chr;
  88 #endif
  89 } GDBState;
  90
  91 /* By default use no IRQs and no timers while single stepping so as to
  92  * make single stepping like an ICE HW step.
  93  */
  94 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
  95
  96 static GDBState *gdbserver_state;
  97
  98 /* This is an ugly hack to cope with both new and old gdb.
  99    If gdb sends qXfer:features:read then assume we're talking to a newish
 100    gdb that understands target descriptions.  */
 101 static int gdb_has_xml;
 102
 103 #ifdef CONFIG_USER_ONLY
 104 /* XXX: This is not thread safe.  Do we care?  */
 105 static int gdbserver_fd = -1;
 106
 107 static int get_char(GDBState *s)
 108 {
 109     uint8_t ch;
 110     int ret;
 111
 112     for(;;) {
 113         ret = recv(s->fd, &ch, 1, 0);
 114         if (ret < 0) {
 115             if (errno == ECONNRESET)
 116                 s->fd = -1;
 117             if (errno != EINTR && errno != EAGAIN)
 118                 return -1;
 119         } else if (ret == 0) {
 120             close(s->fd);
 121             s->fd = -1;
 122             return -1;
 123         } else {
 124             break;
 125         }
 126     }
 127     return ch;
 128 }
 129 #endif
 130
 131 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 132
 133 enum {
 134     GDB_SYS_UNKNOWN,
 135     GDB_SYS_ENABLED,
 136     GDB_SYS_DISABLED,
 137 } gdb_syscall_mode;
 138
 139 /* If gdb is connected when the first semihosting syscall occurs then use
 140    remote gdb syscalls.  Otherwise use native file IO.  */
 141 int use_gdb_syscalls(void)
 142 {
 143     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 144         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 145                                             : GDB_SYS_DISABLED);
 146     }
 147     return gdb_syscall_mode == GDB_SYS_ENABLED;
 148 }
 149
 150 /* Resume execution.  */
 151 static inline void gdb_continue(GDBState *s)
 152 {
 153 #ifdef CONFIG_USER_ONLY
 154     s->running_state = 1;
 155 #else
 156     vm_start();
 157 #endif
 158 }
 159
 160 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 161 {
 162 #ifdef CONFIG_USER_ONLY
 163     int ret;
 164
 165     while (len > 0) {
 166         ret = send(s->fd, buf, len, 0);
 167         if (ret < 0) {
 168             if (errno != EINTR && errno != EAGAIN)
 169                 return;
 170         } else {
 171             buf += ret;
 172             len -= ret;
 173         }
 174     }
 175 #else
 176     qemu_chr_write(s->chr, buf, len);
 177 #endif
 178 }
 179
 180 static inline int fromhex(int v)
 181 {
 182     if (v >= '0' && v <= '9')
 183         return v - '0';
 184     else if (v >= 'A' && v <= 'F')
 185         return v - 'A' + 10;
 186     else if (v >= 'a' && v <= 'f')
 187         return v - 'a' + 10;
 188     else
 189         return 0;
 190 }
 191
 192 static inline int tohex(int v)
 193 {
 194     if (v < 10)
 195         return v + '0';
 196     else
 197         return v - 10 + 'a';
 198 }
 199
 200 static void memtohex(char *buf, const uint8_t *mem, int len)
 201 {
 202     int i, c;
 203     char *q;
 204     q = buf;
 205     for(i = 0; i < len; i++) {
 206         c = mem[i];
 207         *q++ = tohex(c >> 4);
 208         *q++ = tohex(c & 0xf);
 209     }
 210     *q = '\0';
 211 }
 212
 213 static void hextomem(uint8_t *mem, const char *buf, int len)
 214 {
 215     int i;
 216
 217     for(i = 0; i < len; i++) {
 218         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 219         buf += 2;
 220     }
 221 }
 222
 223 /* return -1 if error, 0 if OK */
 224 static int put_packet_binary(GDBState *s, const char *buf, int len)
 225 {
 226     int csum, i;
 227     uint8_t *p;
 228
 229     for(;;) {
 230         p = s->last_packet;
 231         *(p++) = '$';
 232         memcpy(p, buf, len);
 233         p += len;
 234         csum = 0;
 235         for(i = 0; i < len; i++) {
 236             csum += buf[i];
 237         }
 238         *(p++) = '#';
 239         *(p++) = tohex((csum >> 4) & 0xf);
 240         *(p++) = tohex((csum) & 0xf);
 241
 242         s->last_packet_len = p - s->last_packet;
 243         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 244
 245 #ifdef CONFIG_USER_ONLY
 246         i = get_char(s);
 247         if (i < 0)
 248             return -1;
 249         if (i == '+')
 250             break;
 251 #else
 252         break;
 253 #endif
 254     }
 255     return 0;
 256 }
 257
 258 /* return -1 if error, 0 if OK */
 259 static int put_packet(GDBState *s, const char *buf)
 260 {
 261 #ifdef DEBUG_GDB
 262     printf("reply='%s'\n", buf);
 263 #endif
 264
 265     return put_packet_binary(s, buf, strlen(buf));
 266 }
 267
 268 /* The GDB remote protocol transfers values in target byte order.  This means
 269    we can use the raw memory access routines to access the value buffer.
 270    Conveniently, these also handle the case where the buffer is mis-aligned.
 271  */
 272 #define GET_REG8(val) do { \
 273     stb_p(mem_buf, val); \
 274     return 1; \
 275     } while(0)
 276 #define GET_REG16(val) do { \
 277     stw_p(mem_buf, val); \
 278     return 2; \
 279     } while(0)
 280 #define GET_REG32(val) do { \
 281     stl_p(mem_buf, val); \
 282     return 4; \
 283     } while(0)
 284 #define GET_REG64(val) do { \
 285     stq_p(mem_buf, val); \
 286     return 8; \
 287     } while(0)
 288
 289 #if TARGET_LONG_BITS == 64
 290 #define GET_REGL(val) GET_REG64(val)
 291 #define ldtul_p(addr) ldq_p(addr)
 292 #else
 293 #define GET_REGL(val) GET_REG32(val)
 294 #define ldtul_p(addr) ldl_p(addr)
 295 #endif
 296
 297 #if defined(TARGET_I386)
 298
 299 #ifdef TARGET_X86_64
 300 static const int gpr_map[16] = {
 301     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 302     8, 9, 10, 11, 12, 13, 14, 15
 303 };
 304 #else
 305 static const int gpr_map[8] = {0, 1, 2, 3, 4, 5, 6, 7};
 306 #endif
 307
 308 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 309
 310 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 311 {
 312     if (n < CPU_NB_REGS) {
 313         GET_REGL(env->regs[gpr_map[n]]);
 314     } else if (n >= CPU_NB_REGS + 8 && n < CPU_NB_REGS + 16) {
 315         /* FIXME: byteswap float values.  */
 316 #ifdef USE_X86LDOUBLE
 317         memcpy(mem_buf, &env->fpregs[n - (CPU_NB_REGS + 8)], 10);
 318 #else
 319         memset(mem_buf, 0, 10);
 320 #endif
 321         return 10;
 322     } else if (n >= CPU_NB_REGS + 24) {
 323         n -= CPU_NB_REGS + 24;
 324         if (n < CPU_NB_REGS) {
 325             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 326             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 327             return 16;
 328         } else if (n == CPU_NB_REGS) {
 329             GET_REG32(env->mxcsr);
 330         }
 331     } else {
 332         n -= CPU_NB_REGS;
 333         switch (n) {
 334         case 0: GET_REGL(env->eip);
 335         case 1: GET_REG32(env->eflags);
 336         case 2: GET_REG32(env->segs[R_CS].selector);
 337         case 3: GET_REG32(env->segs[R_SS].selector);
 338         case 4: GET_REG32(env->segs[R_DS].selector);
 339         case 5: GET_REG32(env->segs[R_ES].selector);
 340         case 6: GET_REG32(env->segs[R_FS].selector);
 341         case 7: GET_REG32(env->segs[R_GS].selector);
 342         /* 8...15 x87 regs.  */
 343         case 16: GET_REG32(env->fpuc);
 344         case 17: GET_REG32((env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11);
 345         case 18: GET_REG32(0); /* ftag */
 346         case 19: GET_REG32(0); /* fiseg */
 347         case 20: GET_REG32(0); /* fioff */
 348         case 21: GET_REG32(0); /* foseg */
 349         case 22: GET_REG32(0); /* fooff */
 350         case 23: GET_REG32(0); /* fop */
 351         /* 24+ xmm regs.  */
 352         }
 353     }
 354     return 0;
 355 }
 356
 357 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int i)
 358 {
 359     uint32_t tmp;
 360
 361     if (i < CPU_NB_REGS) {
 362         env->regs[gpr_map[i]] = ldtul_p(mem_buf);
 363         return sizeof(target_ulong);
 364     } else if (i >= CPU_NB_REGS + 8 && i < CPU_NB_REGS + 16) {
 365         i -= CPU_NB_REGS + 8;
 366 #ifdef USE_X86LDOUBLE
 367         memcpy(&env->fpregs[i], mem_buf, 10);
 368 #endif
 369         return 10;
 370     } else if (i >= CPU_NB_REGS + 24) {
 371         i -= CPU_NB_REGS + 24;
 372         if (i < CPU_NB_REGS) {
 373             env->xmm_regs[i].XMM_Q(0) = ldq_p(mem_buf);
 374             env->xmm_regs[i].XMM_Q(1) = ldq_p(mem_buf + 8);
 375             return 16;
 376         } else if (i == CPU_NB_REGS) {
 377             env->mxcsr = ldl_p(mem_buf);
 378             return 4;
 379         }
 380     } else {
 381         i -= CPU_NB_REGS;
 382         switch (i) {
 383         case 0: env->eip = ldtul_p(mem_buf); return sizeof(target_ulong);
 384         case 1: env->eflags = ldl_p(mem_buf); return 4;
 385 #if defined(CONFIG_USER_ONLY)
 386 #define LOAD_SEG(index, sreg)\
 387             tmp = ldl_p(mem_buf);\
 388             if (tmp != env->segs[sreg].selector)\
 389                 cpu_x86_load_seg(env, sreg, tmp);
 390 #else
 391 /* FIXME: Honor segment registers.  Needs to avoid raising an exception
 392    when the selector is invalid.  */
 393 #define LOAD_SEG(index, sreg) do {} while(0)
 394 #endif
 395         case 2: LOAD_SEG(10, R_CS); return 4;
 396         case 3: LOAD_SEG(11, R_SS); return 4;
 397         case 4: LOAD_SEG(12, R_DS); return 4;
 398         case 5: LOAD_SEG(13, R_ES); return 4;
 399         case 6: LOAD_SEG(14, R_FS); return 4;
 400         case 7: LOAD_SEG(15, R_GS); return 4;
 401         /* 8...15 x87 regs.  */
 402         case 16: env->fpuc = ldl_p(mem_buf); return 4;
 403         case 17:
 404                  tmp = ldl_p(mem_buf);
 405                  env->fpstt = (tmp >> 11) & 7;
 406                  env->fpus = tmp & ~0x3800;
 407                  return 4;
 408         case 18: /* ftag */ return 4;
 409         case 19: /* fiseg */ return 4;
 410         case 20: /* fioff */ return 4;
 411         case 21: /* foseg */ return 4;
 412         case 22: /* fooff */ return 4;
 413         case 23: /* fop */ return 4;
 414         /* 24+ xmm regs.  */
 415         }
 416     }
 417     /* Unrecognised register.  */
 418     return 0;
 419 }
 420
 421 #elif defined (TARGET_PPC)
 422
 423 #define NUM_CORE_REGS 71
 424
 425 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 426 {
 427     if (n < 32) {
 428         /* gprs */
 429         GET_REGL(env->gpr[n]);
 430     } else if (n < 64) {
 431         /* fprs */
 432         stfq_p(mem_buf, env->fpr[n-32]);
 433         return 8;
 434     } else {
 435         switch (n) {
 436         case 64: GET_REGL(env->nip);
 437         case 65: GET_REGL(env->msr);
 438         case 66:
 439             {
 440                 uint32_t cr = 0;
 441                 int i;
 442                 for (i = 0; i < 8; i++)
 443                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 444                 GET_REG32(cr);
 445             }
 446         case 67: GET_REGL(env->lr);
 447         case 68: GET_REGL(env->ctr);
 448         case 69: GET_REGL(env->xer);
 449         case 70: GET_REG32(0); /* fpscr */
 450         }
 451     }
 452     return 0;
 453 }
 454
 455 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 456 {
 457     if (n < 32) {
 458         /* gprs */
 459         env->gpr[n] = ldtul_p(mem_buf);
 460         return sizeof(target_ulong);
 461     } else if (n < 64) {
 462         /* fprs */
 463         env->fpr[n-32] = ldfq_p(mem_buf);
 464         return 8;
 465     } else {
 466         switch (n) {
 467         case 64:
 468             env->nip = ldtul_p(mem_buf);
 469             return sizeof(target_ulong);
 470         case 65:
 471             ppc_store_msr(env, ldtul_p(mem_buf));
 472             return sizeof(target_ulong);
 473         case 66:
 474             {
 475                 uint32_t cr = ldl_p(mem_buf);
 476                 int i;
 477                 for (i = 0; i < 8; i++)
 478                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 479                 return 4;
 480             }
 481         case 67:
 482             env->lr = ldtul_p(mem_buf);
 483             return sizeof(target_ulong);
 484         case 68:
 485             env->ctr = ldtul_p(mem_buf);
 486             return sizeof(target_ulong);
 487         case 69:
 488             env->xer = ldtul_p(mem_buf);
 489             return sizeof(target_ulong);
 490         case 70:
 491             /* fpscr */
 492             return 4;
 493         }
 494     }
 495     return 0;
 496 }
 497
 498 #elif defined (TARGET_SPARC)
 499
 500 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 501 #define NUM_CORE_REGS 86
 502 #else
 503 #define NUM_CORE_REGS 73
 504 #endif
 505
 506 #ifdef TARGET_ABI32
 507 #define GET_REGA(val) GET_REG32(val)
 508 #else
 509 #define GET_REGA(val) GET_REGL(val)
 510 #endif
 511
 512 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 513 {
 514     if (n < 8) {
 515         /* g0..g7 */
 516         GET_REGA(env->gregs[n]);
 517     }
 518     if (n < 32) {
 519         /* register window */
 520         GET_REGA(env->regwptr[n - 8]);
 521     }
 522 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 523     if (n < 64) {
 524         /* fprs */
 525         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 526     }
 527     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 528     switch (n) {
 529     case 64: GET_REGA(env->y);
 530     case 65: GET_REGA(GET_PSR(env));
 531     case 66: GET_REGA(env->wim);
 532     case 67: GET_REGA(env->tbr);
 533     case 68: GET_REGA(env->pc);
 534     case 69: GET_REGA(env->npc);
 535     case 70: GET_REGA(env->fsr);
 536     case 71: GET_REGA(0); /* csr */
 537     case 72: GET_REGA(0);
 538     }
 539 #else
 540     if (n < 64) {
 541         /* f0-f31 */
 542         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 543     }
 544     if (n < 80) {
 545         /* f32-f62 (double width, even numbers only) */
 546         uint64_t val;
 547
 548         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 549         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 550         GET_REG64(val);
 551     }
 552     switch (n) {
 553     case 80: GET_REGL(env->pc);
 554     case 81: GET_REGL(env->npc);
 555     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 556                            ((env->asi & 0xff) << 24) |
 557                            ((env->pstate & 0xfff) << 8) |
 558                            GET_CWP64(env));
 559     case 83: GET_REGL(env->fsr);
 560     case 84: GET_REGL(env->fprs);
 561     case 85: GET_REGL(env->y);
 562     }
 563 #endif
 564     return 0;
 565 }
 566
 567 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 568 {
 569 #if defined(TARGET_ABI32)
 570     abi_ulong tmp;
 571
 572     tmp = ldl_p(mem_buf);
 573 #else
 574     target_ulong tmp;
 575
 576     tmp = ldtul_p(mem_buf);
 577 #endif
 578
 579     if (n < 8) {
 580         /* g0..g7 */
 581         env->gregs[n] = tmp;
 582     } else if (n < 32) {
 583         /* register window */
 584         env->regwptr[n - 8] = tmp;
 585     }
 586 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 587     else if (n < 64) {
 588         /* fprs */
 589         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 590     } else {
 591         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 592         switch (n) {
 593         case 64: env->y = tmp; break;
 594         case 65: PUT_PSR(env, tmp); break;
 595         case 66: env->wim = tmp; break;
 596         case 67: env->tbr = tmp; break;
 597         case 68: env->pc = tmp; break;
 598         case 69: env->npc = tmp; break;
 599         case 70: env->fsr = tmp; break;
 600         default: return 0;
 601         }
 602     }
 603     return 4;
 604 #else
 605     else if (n < 64) {
 606         /* f0-f31 */
 607         env->fpr[n] = ldfl_p(mem_buf);
 608         return 4;
 609     } else if (n < 80) {
 610         /* f32-f62 (double width, even numbers only) */
 611         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 612         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 613     } else {
 614         switch (n) {
 615         case 80: env->pc = tmp; break;
 616         case 81: env->npc = tmp; break;
 617         case 82:
 618             PUT_CCR(env, tmp >> 32);
 619             env->asi = (tmp >> 24) & 0xff;
 620             env->pstate = (tmp >> 8) & 0xfff;
 621             PUT_CWP64(env, tmp & 0xff);
 622             break;
 623         case 83: env->fsr = tmp; break;
 624         case 84: env->fprs = tmp; break;
 625         case 85: env->y = tmp; break;
 626         default: return 0;
 627         }
 628     }
 629     return 8;
 630 #endif
 631 }
 632 #elif defined (TARGET_ARM)
 633
 634 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 635    whatever the target description contains.  Due to a historical mishap
 636    the FPA registers appear in between core integer regs and the CPSR.
 637    We hack round this by giving the FPA regs zero size when talking to a
 638    newer gdb.  */
 639 #define NUM_CORE_REGS 26
 640 #define GDB_CORE_XML "arm-core.xml"
 641
 642 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 643 {
 644     if (n < 16) {
 645         /* Core integer register.  */
 646         GET_REG32(env->regs[n]);
 647     }
 648     if (n < 24) {
 649         /* FPA registers.  */
 650         if (gdb_has_xml)
 651             return 0;
 652         memset(mem_buf, 0, 12);
 653         return 12;
 654     }
 655     switch (n) {
 656     case 24:
 657         /* FPA status register.  */
 658         if (gdb_has_xml)
 659             return 0;
 660         GET_REG32(0);
 661     case 25:
 662         /* CPSR */
 663         GET_REG32(cpsr_read(env));
 664     }
 665     /* Unknown register.  */
 666     return 0;
 667 }
 668
 669 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 670 {
 671     uint32_t tmp;
 672
 673     tmp = ldl_p(mem_buf);
 674
 675     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 676        cause problems if we ever implement the Jazelle DBX extensions.  */
 677     if (n == 15)
 678         tmp &= ~1;
 679
 680     if (n < 16) {
 681         /* Core integer register.  */
 682         env->regs[n] = tmp;
 683         return 4;
 684     }
 685     if (n < 24) { /* 16-23 */
 686         /* FPA registers (ignored).  */
 687         if (gdb_has_xml)
 688             return 0;
 689         return 12;
 690     }
 691     switch (n) {
 692     case 24:
 693         /* FPA status register (ignored).  */
 694         if (gdb_has_xml)
 695             return 0;
 696         return 4;
 697     case 25:
 698         /* CPSR */
 699         cpsr_write (env, tmp, 0xffffffff);
 700         return 4;
 701     }
 702     /* Unknown register.  */
 703     return 0;
 704 }
 705
 706 #elif defined (TARGET_M68K)
 707
 708 #define NUM_CORE_REGS 18
 709
 710 #define GDB_CORE_XML "cf-core.xml"
 711
 712 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 713 {
 714     if (n < 8) {
 715         /* D0-D7 */
 716         GET_REG32(env->dregs[n]);
 717     } else if (n < 16) {
 718         /* A0-A7 */
 719         GET_REG32(env->aregs[n - 8]);
 720     } else {
 721         switch (n) {
 722         case 16: GET_REG32(env->sr);
 723         case 17: GET_REG32(env->pc);
 724         }
 725     }
 726     /* FP registers not included here because they vary between
 727        ColdFire and m68k.  Use XML bits for these.  */
 728     return 0;
 729 }
 730
 731 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 732 {
 733     uint32_t tmp;
 734
 735     tmp = ldl_p(mem_buf);
 736
 737     if (n < 8) {
 738         /* D0-D7 */
 739         env->dregs[n] = tmp;
 740     } else if (n < 8) {
 741         /* A0-A7 */
 742         env->aregs[n - 8] = tmp;
 743     } else {
 744         switch (n) {
 745         case 16: env->sr = tmp; break;
 746         case 17: env->pc = tmp; break;
 747         default: return 0;
 748         }
 749     }
 750     return 4;
 751 }
 752 #elif defined (TARGET_MIPS)
 753
 754 #define NUM_CORE_REGS 73
 755
 756 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 757 {
 758     if (n < 32) {
 759         GET_REGL(env->active_tc.gpr[n]);
 760     }
 761     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
 762         if (n >= 38 && n < 70) {
 763             if (env->CP0_Status & (1 << CP0St_FR))
 764                 GET_REGL(env->active_fpu.fpr[n - 38].d);
 765             else
 766                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
 767         }
 768         switch (n) {
 769         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
 770         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
 771         }
 772     }
 773     switch (n) {
 774     case 32: GET_REGL((int32_t)env->CP0_Status);
 775     case 33: GET_REGL(env->active_tc.LO[0]);
 776     case 34: GET_REGL(env->active_tc.HI[0]);
 777     case 35: GET_REGL(env->CP0_BadVAddr);
 778     case 36: GET_REGL((int32_t)env->CP0_Cause);
 779     case 37: GET_REGL(env->active_tc.PC);
 780     case 72: GET_REGL(0); /* fp */
 781     case 89: GET_REGL((int32_t)env->CP0_PRid);
 782     }
 783     if (n >= 73 && n <= 88) {
 784         /* 16 embedded regs.  */
 785         GET_REGL(0);
 786     }
 787
 788     return 0;
 789 }
 790
 791 /* convert MIPS rounding mode in FCR31 to IEEE library */
 792 static unsigned int ieee_rm[] =
 793   {
 794     float_round_nearest_even,
 795     float_round_to_zero,
 796     float_round_up,
 797     float_round_down
 798   };
 799 #define RESTORE_ROUNDING_MODE \
 800     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
 801
 802 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 803 {
 804     target_ulong tmp;
 805
 806     tmp = ldtul_p(mem_buf);
 807
 808     if (n < 32) {
 809         env->active_tc.gpr[n] = tmp;
 810         return sizeof(target_ulong);
 811     }
 812     if (env->CP0_Config1 & (1 << CP0C1_FP)
 813             && n >= 38 && n < 73) {
 814         if (n < 70) {
 815             if (env->CP0_Status & (1 << CP0St_FR))
 816               env->active_fpu.fpr[n - 38].d = tmp;
 817             else
 818               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
 819         }
 820         switch (n) {
 821         case 70:
 822             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
 823             /* set rounding mode */
 824             RESTORE_ROUNDING_MODE;
 825 #ifndef CONFIG_SOFTFLOAT
 826             /* no floating point exception for native float */
 827             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
 828 #endif
 829             break;
 830         case 71: env->active_fpu.fcr0 = tmp; break;
 831         }
 832         return sizeof(target_ulong);
 833     }
 834     switch (n) {
 835     case 32: env->CP0_Status = tmp; break;
 836     case 33: env->active_tc.LO[0] = tmp; break;
 837     case 34: env->active_tc.HI[0] = tmp; break;
 838     case 35: env->CP0_BadVAddr = tmp; break;
 839     case 36: env->CP0_Cause = tmp; break;
 840     case 37: env->active_tc.PC = tmp; break;
 841     case 72: /* fp, ignored */ break;
 842     default:
 843         if (n > 89)
 844             return 0;
 845         /* Other registers are readonly.  Ignore writes.  */
 846         break;
 847     }
 848
 849     return sizeof(target_ulong);
 850 }
 851 #elif defined (TARGET_SH4)
 852
 853 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
 854 /* FIXME: We should use XML for this.  */
 855
 856 #define NUM_CORE_REGS 59
 857
 858 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 859 {
 860     if (n < 8) {
 861         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
 862             GET_REGL(env->gregs[n + 16]);
 863         } else {
 864             GET_REGL(env->gregs[n]);
 865         }
 866     } else if (n < 16) {
 867         GET_REGL(env->gregs[n - 8]);
 868     } else if (n >= 25 && n < 41) {
 869         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
 870     } else if (n >= 43 && n < 51) {
 871         GET_REGL(env->gregs[n - 43]);
 872     } else if (n >= 51 && n < 59) {
 873         GET_REGL(env->gregs[n - (51 - 16)]);
 874     }
 875     switch (n) {
 876     case 16: GET_REGL(env->pc);
 877     case 17: GET_REGL(env->pr);
 878     case 18: GET_REGL(env->gbr);
 879     case 19: GET_REGL(env->vbr);
 880     case 20: GET_REGL(env->mach);
 881     case 21: GET_REGL(env->macl);
 882     case 22: GET_REGL(env->sr);
 883     case 23: GET_REGL(env->fpul);
 884     case 24: GET_REGL(env->fpscr);
 885     case 41: GET_REGL(env->ssr);
 886     case 42: GET_REGL(env->spc);
 887     }
 888
 889     return 0;
 890 }
 891
 892 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 893 {
 894     uint32_t tmp;
 895
 896     tmp = ldl_p(mem_buf);
 897
 898     if (n < 8) {
 899         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
 900             env->gregs[n + 16] = tmp;
 901         } else {
 902             env->gregs[n] = tmp;
 903         }
 904         return 4;
 905     } else if (n < 16) {
 906         env->gregs[n - 8] = tmp;
 907         return 4;
 908     } else if (n >= 25 && n < 41) {
 909         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
 910     } else if (n >= 43 && n < 51) {
 911         env->gregs[n - 43] = tmp;
 912         return 4;
 913     } else if (n >= 51 && n < 59) {
 914         env->gregs[n - (51 - 16)] = tmp;
 915         return 4;
 916     }
 917     switch (n) {
 918     case 16: env->pc = tmp;
 919     case 17: env->pr = tmp;
 920     case 18: env->gbr = tmp;
 921     case 19: env->vbr = tmp;
 922     case 20: env->mach = tmp;
 923     case 21: env->macl = tmp;
 924     case 22: env->sr = tmp;
 925     case 23: env->fpul = tmp;
 926     case 24: env->fpscr = tmp;
 927     case 41: env->ssr = tmp;
 928     case 42: env->spc = tmp;
 929     default: return 0;
 930     }
 931
 932     return 4;
 933 }
 934 #elif defined (TARGET_CRIS)
 935
 936 #define NUM_CORE_REGS 49
 937
 938 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 939 {
 940     uint8_t srs;
 941
 942     srs = env->pregs[PR_SRS];
 943     if (n < 16) {
 944         GET_REG32(env->regs[n]);
 945     }
 946
 947     if (n >= 21 && n < 32) {
 948         GET_REG32(env->pregs[n - 16]);
 949     }
 950     if (n >= 33 && n < 49) {
 951         GET_REG32(env->sregs[srs][n - 33]);
 952     }
 953     switch (n) {
 954     case 16: GET_REG8(env->pregs[0]);
 955     case 17: GET_REG8(env->pregs[1]);
 956     case 18: GET_REG32(env->pregs[2]);
 957     case 19: GET_REG8(srs);
 958     case 20: GET_REG16(env->pregs[4]);
 959     case 32: GET_REG32(env->pc);
 960     }
 961
 962     return 0;
 963 }
 964
 965 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 966 {
 967     uint32_t tmp;
 968
 969     if (n > 49)
 970         return 0;
 971
 972     tmp = ldl_p(mem_buf);
 973
 974     if (n < 16) {
 975         env->regs[n] = tmp;
 976     }
 977
 978     if (n >= 21 && n < 32) {
 979         env->pregs[n - 16] = tmp;
 980     }
 981
 982     /* FIXME: Should support function regs be writable?  */
 983     switch (n) {
 984     case 16: return 1;
 985     case 17: return 1;
 986     case 18: env->pregs[PR_PID] = tmp; break;
 987     case 19: return 1;
 988     case 20: return 2;
 989     case 32: env->pc = tmp; break;
 990     }
 991
 992     return 4;
 993 }
 994 #elif defined (TARGET_ALPHA)
 995
 996 #define NUM_CORE_REGS 65
 997
 998 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 999 {
1000     if (n < 31) {
1001        GET_REGL(env->ir[n]);
1002     }
1003     else if (n == 31) {
1004        GET_REGL(0);
1005     }
1006     else if (n<63) {
1007        uint64_t val;
1008
1009        val=*((uint64_t *)&env->fir[n-32]);
1010        GET_REGL(val);
1011     }
1012     else if (n==63) {
1013        GET_REGL(env->fpcr);
1014     }
1015     else if (n==64) {
1016        GET_REGL(env->pc);
1017     }
1018     else {
1019        GET_REGL(0);
1020     }
1021
1022     return 0;
1023 }
1024
1025 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1026 {
1027     target_ulong tmp;
1028     tmp = ldtul_p(mem_buf);
1029
1030     if (n < 31) {
1031         env->ir[n] = tmp;
1032     }
1033
1034     if (n > 31 && n < 63) {
1035         env->fir[n - 32] = ldfl_p(mem_buf);
1036     }
1037
1038     if (n == 64 ) {
1039        env->pc=tmp;
1040     }
1041
1042     return 8;
1043 }
1044 #else
1045
1046 #define NUM_CORE_REGS 0
1047
1048 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1049 {
1050     return 0;
1051 }
1052
1053 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1054 {
1055     return 0;
1056 }
1057
1058 #endif
1059
1060 static int num_g_regs = NUM_CORE_REGS;
1061
1062 #ifdef GDB_CORE_XML
1063 /* Encode data using the encoding for 'x' packets.  */
1064 static int memtox(char *buf, const char *mem, int len)
1065 {
1066     char *p = buf;
1067     char c;
1068
1069     while (len--) {
1070         c = *(mem++);
1071         switch (c) {
1072         case '#': case '$': case '*': case '}':
1073             *(p++) = '}';
1074             *(p++) = c ^ 0x20;
1075             break;
1076         default:
1077             *(p++) = c;
1078             break;
1079         }
1080     }
1081     return p - buf;
1082 }
1083
1084 static const char *get_feature_xml(const char *p, const char **newp)
1085 {
1086     extern const char *const xml_builtin[][2];
1087     size_t len;
1088     int i;
1089     const char *name;
1090     static char target_xml[1024];
1091
1092     len = 0;
1093     while (p[len] && p[len] != ':')
1094         len++;
1095     *newp = p + len;
1096
1097     name = NULL;
1098     if (strncmp(p, "target.xml", len) == 0) {
1099         /* Generate the XML description for this CPU.  */
1100         if (!target_xml[0]) {
1101             GDBRegisterState *r;
1102
1103             snprintf(target_xml, sizeof(target_xml),
1104                      "<?xml version=\"1.0\"?>"
1105                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1106                      "<target>"
1107                      "<xi:include href=\"%s\"/>",
1108                      GDB_CORE_XML);
1109
1110             for (r = first_cpu->gdb_regs; r; r = r->next) {
1111                 strcat(target_xml, "<xi:include href=\"");
1112                 strcat(target_xml, r->xml);
1113                 strcat(target_xml, "\"/>");
1114             }
1115             strcat(target_xml, "</target>");
1116         }
1117         return target_xml;
1118     }
1119     for (i = 0; ; i++) {
1120         name = xml_builtin[i][0];
1121         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1122             break;
1123     }
1124     return name ? xml_builtin[i][1] : NULL;
1125 }
1126 #endif
1127
1128 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1129 {
1130     GDBRegisterState *r;
1131
1132     if (reg < NUM_CORE_REGS)
1133         return cpu_gdb_read_register(env, mem_buf, reg);
1134
1135     for (r = env->gdb_regs; r; r = r->next) {
1136         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1137             return r->get_reg(env, mem_buf, reg - r->base_reg);
1138         }
1139     }
1140     return 0;
1141 }
1142
1143 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1144 {
1145     GDBRegisterState *r;
1146
1147     if (reg < NUM_CORE_REGS)
1148         return cpu_gdb_write_register(env, mem_buf, reg);
1149
1150     for (r = env->gdb_regs; r; r = r->next) {
1151         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1152             return r->set_reg(env, mem_buf, reg - r->base_reg);
1153         }
1154     }
1155     return 0;
1156 }
1157
1158 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1159    specifies the first register number and these registers are included in
1160    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1161    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1162  */
1163
1164 void gdb_register_coprocessor(CPUState * env,
1165                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1166                              int num_regs, const char *xml, int g_pos)
1167 {
1168     GDBRegisterState *s;
1169     GDBRegisterState **p;
1170     static int last_reg = NUM_CORE_REGS;
1171
1172     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1173     s->base_reg = last_reg;
1174     s->num_regs = num_regs;
1175     s->get_reg = get_reg;
1176     s->set_reg = set_reg;
1177     s->xml = xml;
1178     p = &env->gdb_regs;
1179     while (*p) {
1180         /* Check for duplicates.  */
1181         if (strcmp((*p)->xml, xml) == 0)
1182             return;
1183         p = &(*p)->next;
1184     }
1185     /* Add to end of list.  */
1186     last_reg += num_regs;
1187     *p = s;
1188     if (g_pos) {
1189         if (g_pos != s->base_reg) {
1190             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1191                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1192         } else {
1193             num_g_regs = last_reg;
1194         }
1195     }
1196 }
1197
1198 #ifndef CONFIG_USER_ONLY
1199 static const int xlat_gdb_type[] = {
1200     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1201     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1202     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1203 };
1204 #endif
1205
1206 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1207 {
1208     CPUState *env;
1209     int err = 0;
1210
1211     if (kvm_enabled())
1212         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1213
1214     switch (type) {
1215     case GDB_BREAKPOINT_SW:
1216     case GDB_BREAKPOINT_HW:
1217         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1218             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1219             if (err)
1220                 break;
1221         }
1222         return err;
1223 #ifndef CONFIG_USER_ONLY
1224     case GDB_WATCHPOINT_WRITE:
1225     case GDB_WATCHPOINT_READ:
1226     case GDB_WATCHPOINT_ACCESS:
1227         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1228             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1229                                         NULL);
1230             if (err)
1231                 break;
1232         }
1233         return err;
1234 #endif
1235     default:
1236         return -ENOSYS;
1237     }
1238 }
1239
1240 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1241 {
1242     CPUState *env;
1243     int err = 0;
1244
1245     if (kvm_enabled())
1246         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1247
1248     switch (type) {
1249     case GDB_BREAKPOINT_SW:
1250     case GDB_BREAKPOINT_HW:
1251         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1252             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1253             if (err)
1254                 break;
1255         }
1256         return err;
1257 #ifndef CONFIG_USER_ONLY
1258     case GDB_WATCHPOINT_WRITE:
1259     case GDB_WATCHPOINT_READ:
1260     case GDB_WATCHPOINT_ACCESS:
1261         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1262             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1263             if (err)
1264                 break;
1265         }
1266         return err;
1267 #endif
1268     default:
1269         return -ENOSYS;
1270     }
1271 }
1272
1273 static void gdb_breakpoint_remove_all(void)
1274 {
1275     CPUState *env;
1276
1277     if (kvm_enabled()) {
1278         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1279         return;
1280     }
1281
1282     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1283         cpu_breakpoint_remove_all(env, BP_GDB);
1284 #ifndef CONFIG_USER_ONLY
1285         cpu_watchpoint_remove_all(env, BP_GDB);
1286 #endif
1287     }
1288 }
1289
1290 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1291 {
1292     CPUState *env;
1293     const char *p;
1294     int ch, reg_size, type, res, thread;
1295     char buf[MAX_PACKET_LENGTH];
1296     uint8_t mem_buf[MAX_PACKET_LENGTH];
1297     uint8_t *registers;
1298     target_ulong addr, len;
1299
1300 #ifdef DEBUG_GDB
1301     printf("command='%s'\n", line_buf);
1302 #endif
1303     p = line_buf;
1304     ch = *p++;
1305     switch(ch) {
1306     case '?':
1307         /* TODO: Make this return the correct value for user-mode.  */
1308         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", SIGTRAP,
1309                  s->c_cpu->cpu_index+1);
1310         put_packet(s, buf);
1311         /* Remove all the breakpoints when this query is issued,
1312          * because gdb is doing and initial connect and the state
1313          * should be cleaned up.
1314          */
1315         gdb_breakpoint_remove_all();
1316         break;
1317     case 'c':
1318         if (*p != '\0') {
1319             addr = strtoull(p, (char **)&p, 16);
1320 #if defined(TARGET_I386)
1321             s->c_cpu->eip = addr;
1322             kvm_load_registers(s->c_cpu);
1323 #elif defined (TARGET_PPC)
1324             s->c_cpu->nip = addr;
1325             kvm_load_registers(s->c_cpu);
1326 #elif defined (TARGET_SPARC)
1327             s->c_cpu->pc = addr;
1328             s->c_cpu->npc = addr + 4;
1329 #elif defined (TARGET_ARM)
1330             s->c_cpu->regs[15] = addr;
1331 #elif defined (TARGET_SH4)
1332             s->c_cpu->pc = addr;
1333 #elif defined (TARGET_MIPS)
1334             s->c_cpu->active_tc.PC = addr;
1335 #elif defined (TARGET_CRIS)
1336             s->c_cpu->pc = addr;
1337 #elif defined (TARGET_ALPHA)
1338             s->c_cpu->pc = addr;
1339 #endif
1340         }
1341         gdb_continue(s);
1342         return RS_IDLE;
1343     case 'C':
1344         s->signal = strtoul(p, (char **)&p, 16);
1345         gdb_continue(s);
1346         return RS_IDLE;
1347     case 'k':
1348         /* Kill the target */
1349         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1350         exit(0);
1351     case 'D':
1352         /* Detach packet */
1353         gdb_breakpoint_remove_all();
1354         gdb_continue(s);
1355         put_packet(s, "OK");
1356         break;
1357     case 's':
1358         if (*p != '\0') {
1359             addr = strtoull(p, (char **)&p, 16);
1360 #if defined(TARGET_I386)
1361             s->c_cpu->eip = addr;
1362             kvm_load_registers(s->c_cpu);
1363 #elif defined (TARGET_PPC)
1364             s->c_cpu->nip = addr;
1365             kvm_load_registers(s->c_cpu);
1366 #elif defined (TARGET_SPARC)
1367             s->c_cpu->pc = addr;
1368             s->c_cpu->npc = addr + 4;
1369 #elif defined (TARGET_ARM)
1370             s->c_cpu->regs[15] = addr;
1371 #elif defined (TARGET_SH4)
1372             s->c_cpu->pc = addr;
1373 #elif defined (TARGET_MIPS)
1374             s->c_cpu->active_tc.PC = addr;
1375 #elif defined (TARGET_CRIS)
1376             s->c_cpu->pc = addr;
1377 #elif defined (TARGET_ALPHA)
1378             s->c_cpu->pc = addr;
1379 #endif
1380         }
1381         cpu_single_step(s->c_cpu, sstep_flags);
1382         gdb_continue(s);
1383         return RS_IDLE;
1384     case 'F':
1385         {
1386             target_ulong ret;
1387             target_ulong err;
1388
1389             ret = strtoull(p, (char **)&p, 16);
1390             if (*p == ',') {
1391                 p++;
1392                 err = strtoull(p, (char **)&p, 16);
1393             } else {
1394                 err = 0;
1395             }
1396             if (*p == ',')
1397                 p++;
1398             type = *p;
1399             if (gdb_current_syscall_cb)
1400                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1401             if (type == 'C') {
1402                 put_packet(s, "T02");
1403             } else {
1404                 gdb_continue(s);
1405             }
1406         }
1407         break;
1408     case 'g':
1409         kvm_save_registers(s->g_cpu);
1410         len = 0;
1411         for (addr = 0; addr < num_g_regs; addr++) {
1412             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1413             len += reg_size;
1414         }
1415         memtohex(buf, mem_buf, len);
1416         put_packet(s, buf);
1417         break;
1418     case 'G':
1419         registers = mem_buf;
1420         len = strlen(p) / 2;
1421         hextomem((uint8_t *)registers, p, len);
1422         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1423             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1424             len -= reg_size;
1425             registers += reg_size;
1426         }
1427         kvm_load_registers(s->g_cpu);
1428         put_packet(s, "OK");
1429         break;
1430     case 'm':
1431         addr = strtoull(p, (char **)&p, 16);
1432         if (*p == ',')
1433             p++;
1434         len = strtoull(p, NULL, 16);
1435         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1436             put_packet (s, "E14");
1437         } else {
1438             memtohex(buf, mem_buf, len);
1439             put_packet(s, buf);
1440         }
1441         break;
1442     case 'M':
1443         addr = strtoull(p, (char **)&p, 16);
1444         if (*p == ',')
1445             p++;
1446         len = strtoull(p, (char **)&p, 16);
1447         if (*p == ':')
1448             p++;
1449         hextomem(mem_buf, p, len);
1450         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1451             put_packet(s, "E14");
1452         else
1453             put_packet(s, "OK");
1454         break;
1455     case 'p':
1456         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1457            This works, but can be very slow.  Anything new enough to
1458            understand XML also knows how to use this properly.  */
1459         if (!gdb_has_xml)
1460             goto unknown_command;
1461         addr = strtoull(p, (char **)&p, 16);
1462         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1463         if (reg_size) {
1464             memtohex(buf, mem_buf, reg_size);
1465             put_packet(s, buf);
1466         } else {
1467             put_packet(s, "E14");
1468         }
1469         break;
1470     case 'P':
1471         if (!gdb_has_xml)
1472             goto unknown_command;
1473         addr = strtoull(p, (char **)&p, 16);
1474         if (*p == '=')
1475             p++;
1476         reg_size = strlen(p) / 2;
1477         hextomem(mem_buf, p, reg_size);
1478         gdb_write_register(s->g_cpu, mem_buf, addr);
1479         put_packet(s, "OK");
1480         break;
1481     case 'Z':
1482     case 'z':
1483         type = strtoul(p, (char **)&p, 16);
1484         if (*p == ',')
1485             p++;
1486         addr = strtoull(p, (char **)&p, 16);
1487         if (*p == ',')
1488             p++;
1489         len = strtoull(p, (char **)&p, 16);
1490         if (ch == 'Z')
1491             res = gdb_breakpoint_insert(addr, len, type);
1492         else
1493             res = gdb_breakpoint_remove(addr, len, type);
1494         if (res >= 0)
1495              put_packet(s, "OK");
1496         else if (res == -ENOSYS)
1497             put_packet(s, "");
1498         else
1499             put_packet(s, "E22");
1500         break;
1501     case 'H':
1502         type = *p++;
1503         thread = strtoull(p, (char **)&p, 16);
1504         if (thread == -1 || thread == 0) {
1505             put_packet(s, "OK");
1506             break;
1507         }
1508         for (env = first_cpu; env != NULL; env = env->next_cpu)
1509             if (env->cpu_index + 1 == thread)
1510                 break;
1511         if (env == NULL) {
1512             put_packet(s, "E22");
1513             break;
1514         }
1515         switch (type) {
1516         case 'c':
1517             s->c_cpu = env;
1518             put_packet(s, "OK");
1519             break;
1520         case 'g':
1521             s->g_cpu = env;
1522             put_packet(s, "OK");
1523             break;
1524         default:
1525              put_packet(s, "E22");
1526              break;
1527         }
1528         break;
1529     case 'T':
1530         thread = strtoull(p, (char **)&p, 16);
1531 #ifndef CONFIG_USER_ONLY
1532         if (thread > 0 && thread < smp_cpus + 1)
1533 #else
1534         if (thread == 1)
1535 #endif
1536              put_packet(s, "OK");
1537         else
1538             put_packet(s, "E22");
1539         break;
1540     case 'q':
1541     case 'Q':
1542         /* parse any 'q' packets here */
1543         if (!strcmp(p,"qemu.sstepbits")) {
1544             /* Query Breakpoint bit definitions */
1545             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1546                      SSTEP_ENABLE,
1547                      SSTEP_NOIRQ,
1548                      SSTEP_NOTIMER);
1549             put_packet(s, buf);
1550             break;
1551         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1552             /* Display or change the sstep_flags */
1553             p += 10;
1554             if (*p != '=') {
1555                 /* Display current setting */
1556                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1557                 put_packet(s, buf);
1558                 break;
1559             }
1560             p++;
1561             type = strtoul(p, (char **)&p, 16);
1562             sstep_flags = type;
1563             put_packet(s, "OK");
1564             break;
1565         } else if (strcmp(p,"C") == 0) {
1566             /* "Current thread" remains vague in the spec, so always return
1567              *  the first CPU (gdb returns the first thread). */
1568             put_packet(s, "QC1");
1569             break;
1570         } else if (strcmp(p,"fThreadInfo") == 0) {
1571             s->query_cpu = first_cpu;
1572             goto report_cpuinfo;
1573         } else if (strcmp(p,"sThreadInfo") == 0) {
1574         report_cpuinfo:
1575             if (s->query_cpu) {
1576                 snprintf(buf, sizeof(buf), "m%x", s->query_cpu->cpu_index+1);
1577                 put_packet(s, buf);
1578                 s->query_cpu = s->query_cpu->next_cpu;
1579             } else
1580                 put_packet(s, "l");
1581             break;
1582         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1583             thread = strtoull(p+16, (char **)&p, 16);
1584             for (env = first_cpu; env != NULL; env = env->next_cpu)
1585                 if (env->cpu_index + 1 == thread) {
1586                     kvm_save_registers(env);
1587                     len = snprintf((char *)mem_buf, sizeof(mem_buf),
1588                                    "CPU#%d [%s]", env->cpu_index,
1589                                    env->halted ? "halted " : "running");
1590                     memtohex(buf, mem_buf, len);
1591                     put_packet(s, buf);
1592                     break;
1593                 }
1594             break;
1595         }
1596 #ifdef CONFIG_LINUX_USER
1597         else if (strncmp(p, "Offsets", 7) == 0) {
1598             TaskState *ts = s->c_cpu->opaque;
1599
1600             snprintf(buf, sizeof(buf),
1601                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1602                      ";Bss=" TARGET_ABI_FMT_lx,
1603                      ts->info->code_offset,
1604                      ts->info->data_offset,
1605                      ts->info->data_offset);
1606             put_packet(s, buf);
1607             break;
1608         }
1609 #endif
1610         if (strncmp(p, "Supported", 9) == 0) {
1611             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1612 #ifdef GDB_CORE_XML
1613             strcat(buf, ";qXfer:features:read+");
1614 #endif
1615             put_packet(s, buf);
1616             break;
1617         }
1618 #ifdef GDB_CORE_XML
1619         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1620             const char *xml;
1621             target_ulong total_len;
1622
1623             gdb_has_xml = 1;
1624             p += 19;
1625             xml = get_feature_xml(p, &p);
1626             if (!xml) {
1627                 snprintf(buf, sizeof(buf), "E00");
1628                 put_packet(s, buf);
1629                 break;
1630             }
1631
1632             if (*p == ':')
1633                 p++;
1634             addr = strtoul(p, (char **)&p, 16);
1635             if (*p == ',')
1636                 p++;
1637             len = strtoul(p, (char **)&p, 16);
1638
1639             total_len = strlen(xml);
1640             if (addr > total_len) {
1641                 snprintf(buf, sizeof(buf), "E00");
1642                 put_packet(s, buf);
1643                 break;
1644             }
1645             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1646                 len = (MAX_PACKET_LENGTH - 5) / 2;
1647             if (len < total_len - addr) {
1648                 buf[0] = 'm';
1649                 len = memtox(buf + 1, xml + addr, len);
1650             } else {
1651                 buf[0] = 'l';
1652                 len = memtox(buf + 1, xml + addr, total_len - addr);
1653             }
1654             put_packet_binary(s, buf, len + 1);
1655             break;
1656         }
1657 #endif
1658         /* Unrecognised 'q' command.  */
1659         goto unknown_command;
1660
1661     default:
1662     unknown_command:
1663         /* put empty packet */
1664         buf[0] = '\0';
1665         put_packet(s, buf);
1666         break;
1667     }
1668     return RS_IDLE;
1669 }
1670
1671 void gdb_set_stop_cpu(CPUState *env)
1672 {
1673     gdbserver_state->c_cpu = env;
1674     gdbserver_state->g_cpu = env;
1675 }
1676
1677 #ifndef CONFIG_USER_ONLY
1678 static void gdb_vm_stopped(void *opaque, int reason)
1679 {
1680     GDBState *s = gdbserver_state;
1681     CPUState *env = s->c_cpu;
1682     char buf[256];
1683     const char *type;
1684     int ret;
1685
1686     if (s->state == RS_SYSCALL)
1687         return;
1688
1689     /* disable single step if it was enable */
1690     cpu_single_step(env, 0);
1691
1692     if (reason == EXCP_DEBUG) {
1693         if (env->watchpoint_hit) {
1694             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
1695             case BP_MEM_READ:
1696                 type = "r";
1697                 break;
1698             case BP_MEM_ACCESS:
1699                 type = "a";
1700                 break;
1701             default:
1702                 type = "";
1703                 break;
1704             }
1705             snprintf(buf, sizeof(buf),
1706                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1707                      SIGTRAP, env->cpu_index+1, type,
1708                      env->watchpoint_hit->vaddr);
1709             put_packet(s, buf);
1710             env->watchpoint_hit = NULL;
1711             return;
1712         }
1713         tb_flush(env);
1714         ret = SIGTRAP;
1715     } else if (reason == EXCP_INTERRUPT) {
1716         ret = SIGINT;
1717     } else {
1718         ret = 0;
1719     }
1720     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, env->cpu_index+1);
1721     put_packet(s, buf);
1722 }
1723 #endif
1724
1725 /* Send a gdb syscall request.
1726    This accepts limited printf-style format specifiers, specifically:
1727     %x  - target_ulong argument printed in hex.
1728     %lx - 64-bit argument printed in hex.
1729     %s  - string pointer (target_ulong) and length (int) pair.  */
1730 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1731 {
1732     va_list va;
1733     char buf[256];
1734     char *p;
1735     target_ulong addr;
1736     uint64_t i64;
1737     GDBState *s;
1738
1739     s = gdbserver_state;
1740     if (!s)
1741         return;
1742     gdb_current_syscall_cb = cb;
1743     s->state = RS_SYSCALL;
1744 #ifndef CONFIG_USER_ONLY
1745     vm_stop(EXCP_DEBUG);
1746 #endif
1747     s->state = RS_IDLE;
1748     va_start(va, fmt);
1749     p = buf;
1750     *(p++) = 'F';
1751     while (*fmt) {
1752         if (*fmt == '%') {
1753             fmt++;
1754             switch (*fmt++) {
1755             case 'x':
1756                 addr = va_arg(va, target_ulong);
1757                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
1758                 break;
1759             case 'l':
1760                 if (*(fmt++) != 'x')
1761                     goto bad_format;
1762                 i64 = va_arg(va, uint64_t);
1763                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
1764                 break;
1765             case 's':
1766                 addr = va_arg(va, target_ulong);
1767                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
1768                               addr, va_arg(va, int));
1769                 break;
1770             default:
1771             bad_format:
1772                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
1773                         fmt - 1);
1774                 break;
1775             }
1776         } else {
1777             *(p++) = *(fmt++);
1778         }
1779     }
1780     *p = 0;
1781     va_end(va);
1782     put_packet(s, buf);
1783 #ifdef CONFIG_USER_ONLY
1784     gdb_handlesig(s->c_cpu, 0);
1785 #else
1786     cpu_interrupt(s->c_cpu, CPU_INTERRUPT_EXIT);
1787 #endif
1788 }
1789
1790 static void gdb_read_byte(GDBState *s, int ch)
1791 {
1792     int i, csum;
1793     uint8_t reply;
1794
1795 #ifndef CONFIG_USER_ONLY
1796     if (s->last_packet_len) {
1797         /* Waiting for a response to the last packet.  If we see the start
1798            of a new command then abandon the previous response.  */
1799         if (ch == '-') {
1800 #ifdef DEBUG_GDB
1801             printf("Got NACK, retransmitting\n");
1802 #endif
1803             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
1804         }
1805 #ifdef DEBUG_GDB
1806         else if (ch == '+')
1807             printf("Got ACK\n");
1808         else
1809             printf("Got '%c' when expecting ACK/NACK\n", ch);
1810 #endif
1811         if (ch == '+' || ch == '$')
1812             s->last_packet_len = 0;
1813         if (ch != '$')
1814             return;
1815     }
1816     if (vm_running) {
1817         /* when the CPU is running, we cannot do anything except stop
1818            it when receiving a char */
1819         vm_stop(EXCP_INTERRUPT);
1820     } else
1821 #endif
1822     {
1823         switch(s->state) {
1824         case RS_IDLE:
1825             if (ch == '$') {
1826                 s->line_buf_index = 0;
1827                 s->state = RS_GETLINE;
1828             }
1829             break;
1830         case RS_GETLINE:
1831             if (ch == '#') {
1832             s->state = RS_CHKSUM1;
1833             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1834                 s->state = RS_IDLE;
1835             } else {
1836             s->line_buf[s->line_buf_index++] = ch;
1837             }
1838             break;
1839         case RS_CHKSUM1:
1840             s->line_buf[s->line_buf_index] = '\0';
1841             s->line_csum = fromhex(ch) << 4;
1842             s->state = RS_CHKSUM2;
1843             break;
1844         case RS_CHKSUM2:
1845             s->line_csum |= fromhex(ch);
1846             csum = 0;
1847             for(i = 0; i < s->line_buf_index; i++) {
1848                 csum += s->line_buf[i];
1849             }
1850             if (s->line_csum != (csum & 0xff)) {
1851                 reply = '-';
1852                 put_buffer(s, &reply, 1);
1853                 s->state = RS_IDLE;
1854             } else {
1855                 reply = '+';
1856                 put_buffer(s, &reply, 1);
1857                 s->state = gdb_handle_packet(s, s->line_buf);
1858             }
1859             break;
1860         default:
1861             abort();
1862         }
1863     }
1864 }
1865
1866 #ifdef CONFIG_USER_ONLY
1867 int
1868 gdb_handlesig (CPUState *env, int sig)
1869 {
1870   GDBState *s;
1871   char buf[256];
1872   int n;
1873
1874   s = gdbserver_state;
1875   if (gdbserver_fd < 0 || s->fd < 0)
1876     return sig;
1877
1878   /* disable single step if it was enabled */
1879   cpu_single_step(env, 0);
1880   tb_flush(env);
1881
1882   if (sig != 0)
1883     {
1884       snprintf(buf, sizeof(buf), "S%02x", sig);
1885       put_packet(s, buf);
1886     }
1887   /* put_packet() might have detected that the peer terminated the
1888      connection.  */
1889   if (s->fd < 0)
1890       return sig;
1891
1892   sig = 0;
1893   s->state = RS_IDLE;
1894   s->running_state = 0;
1895   while (s->running_state == 0) {
1896       n = read (s->fd, buf, 256);
1897       if (n > 0)
1898         {
1899           int i;
1900
1901           for (i = 0; i < n; i++)
1902             gdb_read_byte (s, buf[i]);
1903         }
1904       else if (n == 0 || errno != EAGAIN)
1905         {
1906           /* XXX: Connection closed.  Should probably wait for annother
1907              connection before continuing.  */
1908           return sig;
1909         }
1910   }
1911   sig = s->signal;
1912   s->signal = 0;
1913   return sig;
1914 }
1915
1916 /* Tell the remote gdb that the process has exited.  */
1917 void gdb_exit(CPUState *env, int code)
1918 {
1919   GDBState *s;
1920   char buf[4];
1921
1922   s = gdbserver_state;
1923   if (gdbserver_fd < 0 || s->fd < 0)
1924     return;
1925
1926   snprintf(buf, sizeof(buf), "W%02x", code);
1927   put_packet(s, buf);
1928 }
1929
1930
1931 static void gdb_accept(void)
1932 {
1933     GDBState *s;
1934     struct sockaddr_in sockaddr;
1935     socklen_t len;
1936     int val, fd;
1937
1938     for(;;) {
1939         len = sizeof(sockaddr);
1940         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
1941         if (fd < 0 && errno != EINTR) {
1942             perror("accept");
1943             return;
1944         } else if (fd >= 0) {
1945             break;
1946         }
1947     }
1948
1949     /* set short latency */
1950     val = 1;
1951     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
1952
1953     s = qemu_mallocz(sizeof(GDBState));
1954     if (!s) {
1955         errno = ENOMEM;
1956         perror("accept");
1957         return;
1958     }
1959
1960     memset (s, 0, sizeof (GDBState));
1961     s->c_cpu = first_cpu;
1962     s->g_cpu = first_cpu;
1963     s->fd = fd;
1964     gdb_has_xml = 0;
1965
1966     gdbserver_state = s;
1967
1968     fcntl(fd, F_SETFL, O_NONBLOCK);
1969 }
1970
1971 static int gdbserver_open(int port)
1972 {
1973     struct sockaddr_in sockaddr;
1974     int fd, val, ret;
1975
1976     fd = socket(PF_INET, SOCK_STREAM, 0);
1977     if (fd < 0) {
1978         perror("socket");
1979         return -1;
1980     }
1981
1982     /* allow fast reuse */
1983     val = 1;
1984     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
1985
1986     sockaddr.sin_family = AF_INET;
1987     sockaddr.sin_port = htons(port);
1988     sockaddr.sin_addr.s_addr = 0;
1989     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
1990     if (ret < 0) {
1991         perror("bind");
1992         return -1;
1993     }
1994     ret = listen(fd, 0);
1995     if (ret < 0) {
1996         perror("listen");
1997         return -1;
1998     }
1999     return fd;
2000 }
2001
2002 int gdbserver_start(int port)
2003 {
2004     gdbserver_fd = gdbserver_open(port);
2005     if (gdbserver_fd < 0)
2006         return -1;
2007     /* accept connections */
2008     gdb_accept();
2009     return 0;
2010 }
2011 #else
2012 static int gdb_chr_can_receive(void *opaque)
2013 {
2014   /* We can handle an arbitrarily large amount of data.
2015    Pick the maximum packet size, which is as good as anything.  */
2016   return MAX_PACKET_LENGTH;
2017 }
2018
2019 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2020 {
2021     int i;
2022
2023     for (i = 0; i < size; i++) {
2024         gdb_read_byte(gdbserver_state, buf[i]);
2025     }
2026 }
2027
2028 static void gdb_chr_event(void *opaque, int event)
2029 {
2030     switch (event) {
2031     case CHR_EVENT_RESET:
2032         vm_stop(EXCP_INTERRUPT);
2033         gdb_has_xml = 0;
2034         break;
2035     default:
2036         break;
2037     }
2038 }
2039
2040 int gdbserver_start(const char *port)
2041 {
2042     GDBState *s;
2043     char gdbstub_port_name[128];
2044     int port_num;
2045     char *p;
2046     CharDriverState *chr;
2047
2048     if (!port || !*port)
2049       return -1;
2050
2051     port_num = strtol(port, &p, 10);
2052     if (*p == 0) {
2053         /* A numeric value is interpreted as a port number.  */
2054         snprintf(gdbstub_port_name, sizeof(gdbstub_port_name),
2055                  "tcp::%d,nowait,nodelay,server", port_num);
2056         port = gdbstub_port_name;
2057     }
2058
2059     chr = qemu_chr_open("gdb", port);
2060     if (!chr)
2061         return -1;
2062
2063     s = qemu_mallocz(sizeof(GDBState));
2064     if (!s) {
2065         return -1;
2066     }
2067     s->c_cpu = first_cpu;
2068     s->g_cpu = first_cpu;
2069     s->chr = chr;
2070     gdbserver_state = s;
2071     qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2072                           gdb_chr_event, NULL);
2073     qemu_add_vm_stop_handler(gdb_vm_stopped, NULL);
2074     return 0;
2075 }
2076 #endif