gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20 #include "config.h"
  21 #include "qemu-common.h"
  22 #ifdef CONFIG_USER_ONLY
  23 #include <stdlib.h>
  24 #include <stdio.h>
  25 #include <stdarg.h>
  26 #include <string.h>
  27 #include <errno.h>
  28 #include <unistd.h>
  29 #include <fcntl.h>
  30
  31 #include "qemu.h"
  32 #else
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #include "qemu-kvm.h"
  37 #endif
  38
  39 #define MAX_PACKET_LENGTH 4096
  40
  41 #include "qemu_socket.h"
  42 #ifdef _WIN32
  43 /* XXX: these constants may be independent of the host ones even for Unix */
  44 #ifndef SIGTRAP
  45 #define SIGTRAP 5
  46 #endif
  47 #ifndef SIGINT
  48 #define SIGINT 2
  49 #endif
  50 #else
  51 #include <signal.h>
  52 #endif
  53
  54 //#define DEBUG_GDB
  55
  56 typedef struct GDBRegisterState {
  57     int base_reg;
  58     int num_regs;
  59     gdb_reg_cb get_reg;
  60     gdb_reg_cb set_reg;
  61     const char *xml;
  62     struct GDBRegisterState *next;
  63 } GDBRegisterState;
  64
  65 enum RSState {
  66     RS_IDLE,
  67     RS_GETLINE,
  68     RS_CHKSUM1,
  69     RS_CHKSUM2,
  70     RS_SYSCALL,
  71 };
  72 typedef struct GDBState {
  73     CPUState *env; /* current CPU */
  74     enum RSState state; /* parsing state */
  75     char line_buf[MAX_PACKET_LENGTH];
  76     int line_buf_index;
  77     int line_csum;
  78     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
  79     int last_packet_len;
  80     int signal;
  81 #ifdef CONFIG_USER_ONLY
  82     int fd;
  83     int running_state;
  84 #else
  85     CharDriverState *chr;
  86 #endif
  87 } GDBState;
  88
  89 /* By default use no IRQs and no timers while single stepping so as to
  90  * make single stepping like an ICE HW step.
  91  */
  92 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
  93
  94 /* This is an ugly hack to cope with both new and old gdb.
  95    If gdb sends qXfer:features:read then assume we're talking to a newish
  96    gdb that understands target descriptions.  */
  97 static int gdb_has_xml;
  98
  99 #ifdef CONFIG_USER_ONLY
 100 /* XXX: This is not thread safe.  Do we care?  */
 101 static int gdbserver_fd = -1;
 102
 103 /* XXX: remove this hack.  */
 104 static GDBState gdbserver_state;
 105
 106 static int get_char(GDBState *s)
 107 {
 108     uint8_t ch;
 109     int ret;
 110
 111     for(;;) {
 112         ret = recv(s->fd, &ch, 1, 0);
 113         if (ret < 0) {
 114             if (errno == ECONNRESET)
 115                 s->fd = -1;
 116             if (errno != EINTR && errno != EAGAIN)
 117                 return -1;
 118         } else if (ret == 0) {
 119             close(s->fd);
 120             s->fd = -1;
 121             return -1;
 122         } else {
 123             break;
 124         }
 125     }
 126     return ch;
 127 }
 128 #endif
 129
 130 /* GDB stub state for use by semihosting syscalls.  */
 131 static GDBState *gdb_syscall_state;
 132 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 133
 134 enum {
 135     GDB_SYS_UNKNOWN,
 136     GDB_SYS_ENABLED,
 137     GDB_SYS_DISABLED,
 138 } gdb_syscall_mode;
 139
 140 /* If gdb is connected when the first semihosting syscall occurs then use
 141    remote gdb syscalls.  Otherwise use native file IO.  */
 142 int use_gdb_syscalls(void)
 143 {
 144     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 145         gdb_syscall_mode = (gdb_syscall_state ? GDB_SYS_ENABLED
 146                                               : GDB_SYS_DISABLED);
 147     }
 148     return gdb_syscall_mode == GDB_SYS_ENABLED;
 149 }
 150
 151 /* Resume execution.  */
 152 static inline void gdb_continue(GDBState *s)
 153 {
 154 #ifdef CONFIG_USER_ONLY
 155     s->running_state = 1;
 156 #else
 157     vm_start();
 158 #endif
 159 }
 160
 161 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 162 {
 163 #ifdef CONFIG_USER_ONLY
 164     int ret;
 165
 166     while (len > 0) {
 167         ret = send(s->fd, buf, len, 0);
 168         if (ret < 0) {
 169             if (errno != EINTR && errno != EAGAIN)
 170                 return;
 171         } else {
 172             buf += ret;
 173             len -= ret;
 174         }
 175     }
 176 #else
 177     qemu_chr_write(s->chr, buf, len);
 178 #endif
 179 }
 180
 181 static inline int fromhex(int v)
 182 {
 183     if (v >= '0' && v <= '9')
 184         return v - '0';
 185     else if (v >= 'A' && v <= 'F')
 186         return v - 'A' + 10;
 187     else if (v >= 'a' && v <= 'f')
 188         return v - 'a' + 10;
 189     else
 190         return 0;
 191 }
 192
 193 static inline int tohex(int v)
 194 {
 195     if (v < 10)
 196         return v + '0';
 197     else
 198         return v - 10 + 'a';
 199 }
 200
 201 static void memtohex(char *buf, const uint8_t *mem, int len)
 202 {
 203     int i, c;
 204     char *q;
 205     q = buf;
 206     for(i = 0; i < len; i++) {
 207         c = mem[i];
 208         *q++ = tohex(c >> 4);
 209         *q++ = tohex(c & 0xf);
 210     }
 211     *q = '\0';
 212 }
 213
 214 static void hextomem(uint8_t *mem, const char *buf, int len)
 215 {
 216     int i;
 217
 218     for(i = 0; i < len; i++) {
 219         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 220         buf += 2;
 221     }
 222 }
 223
 224 /* return -1 if error, 0 if OK */
 225 static int put_packet_binary(GDBState *s, const char *buf, int len)
 226 {
 227     int csum, i;
 228     uint8_t *p;
 229
 230     for(;;) {
 231         p = s->last_packet;
 232         *(p++) = '$';
 233         memcpy(p, buf, len);
 234         p += len;
 235         csum = 0;
 236         for(i = 0; i < len; i++) {
 237             csum += buf[i];
 238         }
 239         *(p++) = '#';
 240         *(p++) = tohex((csum >> 4) & 0xf);
 241         *(p++) = tohex((csum) & 0xf);
 242
 243         s->last_packet_len = p - s->last_packet;
 244         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 245
 246 #ifdef CONFIG_USER_ONLY
 247         i = get_char(s);
 248         if (i < 0)
 249             return -1;
 250         if (i == '+')
 251             break;
 252 #else
 253         break;
 254 #endif
 255     }
 256     return 0;
 257 }
 258
 259 /* return -1 if error, 0 if OK */
 260 static int put_packet(GDBState *s, const char *buf)
 261 {
 262 #ifdef DEBUG_GDB
 263     printf("reply='%s'\n", buf);
 264 #endif
 265
 266     return put_packet_binary(s, buf, strlen(buf));
 267 }
 268
 269 /* The GDB remote protocol transfers values in target byte order.  This means
 270    we can use the raw memory access routines to access the value buffer.
 271    Conveniently, these also handle the case where the buffer is mis-aligned.
 272  */
 273 #define GET_REG8(val) do { \
 274     stb_p(mem_buf, val); \
 275     return 1; \
 276     } while(0)
 277 #define GET_REG16(val) do { \
 278     stw_p(mem_buf, val); \
 279     return 2; \
 280     } while(0)
 281 #define GET_REG32(val) do { \
 282     stl_p(mem_buf, val); \
 283     return 4; \
 284     } while(0)
 285 #define GET_REG64(val) do { \
 286     stq_p(mem_buf, val); \
 287     return 8; \
 288     } while(0)
 289
 290 #if TARGET_LONG_BITS == 64
 291 #define GET_REGL(val) GET_REG64(val)
 292 #define ldtul_p(addr) ldq_p(addr)
 293 #else
 294 #define GET_REGL(val) GET_REG32(val)
 295 #define ldtul_p(addr) ldl_p(addr)
 296 #endif
 297
 298 #if defined(TARGET_I386)
 299
 300 #ifdef TARGET_X86_64
 301 static const int gpr_map[16] = {
 302     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 303     8, 9, 10, 11, 12, 13, 14, 15
 304 };
 305 #else
 306 static const int gpr_map[8] = {0, 1, 2, 3, 4, 5, 6, 7};
 307 #endif
 308
 309 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 310
 311 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 312 {
 313     if (n < CPU_NB_REGS) {
 314         GET_REGL(env->regs[gpr_map[n]]);
 315     } else if (n >= CPU_NB_REGS + 8 && n < CPU_NB_REGS + 16) {
 316         /* FIXME: byteswap float values.  */
 317 #ifdef USE_X86LDOUBLE
 318         memcpy(mem_buf, &env->fpregs[n - (CPU_NB_REGS + 8)], 10);
 319 #else
 320         memset(mem_buf, 0, 10);
 321 #endif
 322         return 10;
 323     } else if (n >= CPU_NB_REGS + 24) {
 324         n -= CPU_NB_REGS + 24;
 325         if (n < CPU_NB_REGS) {
 326             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 327             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 328             return 16;
 329         } else if (n == CPU_NB_REGS) {
 330             GET_REG32(env->mxcsr);
 331         }
 332     } else {
 333         n -= CPU_NB_REGS;
 334         switch (n) {
 335         case 0: GET_REGL(env->eip);
 336         case 1: GET_REG32(env->eflags);
 337         case 2: GET_REG32(env->segs[R_CS].selector);
 338         case 3: GET_REG32(env->segs[R_SS].selector);
 339         case 4: GET_REG32(env->segs[R_DS].selector);
 340         case 5: GET_REG32(env->segs[R_ES].selector);
 341         case 6: GET_REG32(env->segs[R_FS].selector);
 342         case 7: GET_REG32(env->segs[R_GS].selector);
 343         /* 8...15 x87 regs.  */
 344         case 16: GET_REG32(env->fpuc);
 345         case 17: GET_REG32((env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11);
 346         case 18: GET_REG32(0); /* ftag */
 347         case 19: GET_REG32(0); /* fiseg */
 348         case 20: GET_REG32(0); /* fioff */
 349         case 21: GET_REG32(0); /* foseg */
 350         case 22: GET_REG32(0); /* fooff */
 351         case 23: GET_REG32(0); /* fop */
 352         /* 24+ xmm regs.  */
 353         }
 354     }
 355     return 0;
 356 }
 357
 358 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int i)
 359 {
 360     uint32_t tmp;
 361
 362     if (i < CPU_NB_REGS) {
 363         env->regs[gpr_map[i]] = ldtul_p(mem_buf);
 364         return sizeof(target_ulong);
 365     } else if (i >= CPU_NB_REGS + 8 && i < CPU_NB_REGS + 16) {
 366         i -= CPU_NB_REGS + 8;
 367 #ifdef USE_X86LDOUBLE
 368         memcpy(&env->fpregs[i], mem_buf, 10);
 369 #endif
 370         return 10;
 371     } else if (i >= CPU_NB_REGS + 24) {
 372         i -= CPU_NB_REGS + 24;
 373         if (i < CPU_NB_REGS) {
 374             env->xmm_regs[i].XMM_Q(0) = ldq_p(mem_buf);
 375             env->xmm_regs[i].XMM_Q(1) = ldq_p(mem_buf + 8);
 376             return 16;
 377         } else if (i == CPU_NB_REGS) {
 378             env->mxcsr = ldl_p(mem_buf);
 379             return 4;
 380         }
 381     } else {
 382         i -= CPU_NB_REGS;
 383         switch (i) {
 384         case 0: env->eip = ldtul_p(mem_buf); return sizeof(target_ulong);
 385         case 1: env->eflags = ldl_p(mem_buf); return 4;
 386 #if defined(CONFIG_USER_ONLY)
 387 #define LOAD_SEG(index, sreg)\
 388             tmp = ldl_p(mem_buf);\
 389             if (tmp != env->segs[sreg].selector)\
 390                 cpu_x86_load_seg(env, sreg, tmp);
 391 #else
 392 /* FIXME: Honor segment registers.  Needs to avoid raising an exception
 393    when the selector is invalid.  */
 394 #define LOAD_SEG(index, sreg) do {} while(0)
 395 #endif
 396         case 2: LOAD_SEG(10, R_CS); return 4;
 397         case 3: LOAD_SEG(11, R_SS); return 4;
 398         case 4: LOAD_SEG(12, R_DS); return 4;
 399         case 5: LOAD_SEG(13, R_ES); return 4;
 400         case 6: LOAD_SEG(14, R_FS); return 4;
 401         case 7: LOAD_SEG(15, R_GS); return 4;
 402         /* 8...15 x87 regs.  */
 403         case 16: env->fpuc = ldl_p(mem_buf); return 4;
 404         case 17:
 405                  tmp = ldl_p(mem_buf);
 406                  env->fpstt = (tmp >> 11) & 7;
 407                  env->fpus = tmp & ~0x3800;
 408                  return 4;
 409         case 18: /* ftag */ return 4;
 410         case 19: /* fiseg */ return 4;
 411         case 20: /* fioff */ return 4;
 412         case 21: /* foseg */ return 4;
 413         case 22: /* fooff */ return 4;
 414         case 23: /* fop */ return 4;
 415         /* 24+ xmm regs.  */
 416         }
 417     }
 418     /* Unrecognised register.  */
 419     return 0;
 420 }
 421
 422 #elif defined (TARGET_PPC)
 423
 424 #define NUM_CORE_REGS 71
 425
 426 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 427 {
 428     if (n < 32) {
 429         /* gprs */
 430         GET_REGL(env->gpr[n]);
 431     } else if (n < 64) {
 432         /* fprs */
 433         stfq_p(mem_buf, env->fpr[n]);
 434         return 8;
 435     } else {
 436         switch (n) {
 437         case 64: GET_REGL(env->nip);
 438         case 65: GET_REGL(env->msr);
 439         case 66:
 440             {
 441                 uint32_t cr = 0;
 442                 int i;
 443                 for (i = 0; i < 8; i++)
 444                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 445                 GET_REG32(cr);
 446             }
 447         case 67: GET_REGL(env->lr);
 448         case 68: GET_REGL(env->ctr);
 449         case 69: GET_REGL(env->xer);
 450         case 70: GET_REG32(0); /* fpscr */
 451         }
 452     }
 453     return 0;
 454 }
 455
 456 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 457 {
 458     if (n < 32) {
 459         /* gprs */
 460         env->gpr[n] = ldtul_p(mem_buf);
 461         return sizeof(target_ulong);
 462     } else if (n < 64) {
 463         /* fprs */
 464         env->fpr[n] = ldfq_p(mem_buf);
 465         return 8;
 466     } else {
 467         switch (n) {
 468         case 64:
 469             env->nip = ldtul_p(mem_buf);
 470             return sizeof(target_ulong);
 471         case 65:
 472             ppc_store_msr(env, ldtul_p(mem_buf));
 473             return sizeof(target_ulong);
 474         case 66:
 475             {
 476                 uint32_t cr = ldl_p(mem_buf);
 477                 int i;
 478                 for (i = 0; i < 8; i++)
 479                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 480                 return 4;
 481             }
 482         case 67:
 483             env->lr = ldtul_p(mem_buf);
 484             return sizeof(target_ulong);
 485         case 68:
 486             env->ctr = ldtul_p(mem_buf);
 487             return sizeof(target_ulong);
 488         case 69:
 489             env->xer = ldtul_p(mem_buf);
 490             return sizeof(target_ulong);
 491         case 70:
 492             /* fpscr */
 493             return 4;
 494         }
 495     }
 496     return 0;
 497 }
 498
 499 #elif defined (TARGET_SPARC)
 500
 501 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 502 #define NUM_CORE_REGS 86
 503 #else
 504 #define NUM_CORE_REGS 73
 505 #endif
 506
 507 #ifdef TARGET_ABI32
 508 #define GET_REGA(val) GET_REG32(val)
 509 #else
 510 #define GET_REGA(val) GET_REGL(val)
 511 #endif
 512
 513 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 514 {
 515     if (n < 8) {
 516         /* g0..g7 */
 517         GET_REGA(env->gregs[n]);
 518     }
 519     if (n < 32) {
 520         /* register window */
 521         GET_REGA(env->regwptr[n - 8]);
 522     }
 523 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 524     if (n < 64) {
 525         /* fprs */
 526         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 527     }
 528     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 529     switch (n) {
 530     case 64: GET_REGA(env->y);
 531     case 65: GET_REGA(GET_PSR(env));
 532     case 66: GET_REGA(env->wim);
 533     case 67: GET_REGA(env->tbr);
 534     case 68: GET_REGA(env->pc);
 535     case 69: GET_REGA(env->npc);
 536     case 70: GET_REGA(env->fsr);
 537     case 71: GET_REGA(0); /* csr */
 538     case 72: GET_REGA(0);
 539     }
 540 #else
 541     if (n < 64) {
 542         /* f0-f31 */
 543         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 544     }
 545     if (n < 80) {
 546         /* f32-f62 (double width, even numbers only) */
 547         uint64_t val;
 548
 549         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 550         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 551         GET_REG64(val);
 552     }
 553     switch (n) {
 554     case 80: GET_REGL(env->pc);
 555     case 81: GET_REGL(env->npc);
 556     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 557                            ((env->asi & 0xff) << 24) |
 558                            ((env->pstate & 0xfff) << 8) |
 559                            GET_CWP64(env));
 560     case 83: GET_REGL(env->fsr);
 561     case 84: GET_REGL(env->fprs);
 562     case 85: GET_REGL(env->y);
 563     }
 564 #endif
 565     return 0;
 566 }
 567
 568 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 569 {
 570 #if defined(TARGET_ABI32)
 571     abi_ulong tmp;
 572
 573     tmp = ldl_p(mem_buf);
 574 #else
 575     target_ulong tmp;
 576
 577     tmp = ldtul_p(mem_buf);
 578 #endif
 579
 580     if (n < 8) {
 581         /* g0..g7 */
 582         env->gregs[n] = tmp;
 583     } else if (n < 32) {
 584         /* register window */
 585         env->regwptr[n - 8] = tmp;
 586     }
 587 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 588     else if (n < 64) {
 589         /* fprs */
 590         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 591     } else {
 592         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 593         switch (n) {
 594         case 64: env->y = tmp; break;
 595         case 65: PUT_PSR(env, tmp); break;
 596         case 66: env->wim = tmp; break;
 597         case 67: env->tbr = tmp; break;
 598         case 68: env->pc = tmp; break;
 599         case 69: env->npc = tmp; break;
 600         case 70: env->fsr = tmp; break;
 601         default: return 0;
 602         }
 603     }
 604     return 4;
 605 #else
 606     else if (n < 64) {
 607         /* f0-f31 */
 608         env->fpr[n] = ldfl_p(mem_buf);
 609         return 4;
 610     } else if (n < 80) {
 611         /* f32-f62 (double width, even numbers only) */
 612         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 613         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 614     } else {
 615         switch (n) {
 616         case 80: env->pc = tmp; break;
 617         case 81: env->npc = tmp; break;
 618         case 82:
 619             PUT_CCR(env, tmp >> 32);
 620             env->asi = (tmp >> 24) & 0xff;
 621             env->pstate = (tmp >> 8) & 0xfff;
 622             PUT_CWP64(env, tmp & 0xff);
 623             break;
 624         case 83: env->fsr = tmp; break;
 625         case 84: env->fprs = tmp; break;
 626         case 85: env->y = tmp; break;
 627         default: return 0;
 628         }
 629     }
 630     return 8;
 631 #endif
 632 }
 633 #elif defined (TARGET_ARM)
 634
 635 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 636    whatever the target description contains.  Due to a historical mishap
 637    the FPA registers appear in between core integer regs and the CPSR.
 638    We hack round this by giving the FPA regs zero size when talking to a
 639    newer gdb.  */
 640 #define NUM_CORE_REGS 26
 641 #define GDB_CORE_XML "arm-core.xml"
 642
 643 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 644 {
 645     if (n < 16) {
 646         /* Core integer register.  */
 647         GET_REG32(env->regs[n]);
 648     }
 649     if (n < 24) {
 650         /* FPA registers.  */
 651         if (gdb_has_xml)
 652             return 0;
 653         memset(mem_buf, 0, 12);
 654         return 12;
 655     }
 656     switch (n) {
 657     case 24:
 658         /* FPA status register.  */
 659         if (gdb_has_xml)
 660             return 0;
 661         GET_REG32(0);
 662     case 25:
 663         /* CPSR */
 664         GET_REG32(cpsr_read(env));
 665     }
 666     /* Unknown register.  */
 667     return 0;
 668 }
 669
 670 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 671 {
 672     uint32_t tmp;
 673
 674     tmp = ldl_p(mem_buf);
 675
 676     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 677        cause problems if we ever implement the Jazelle DBX extensions.  */
 678     if (n == 15)
 679         tmp &= ~1;
 680
 681     if (n < 16) {
 682         /* Core integer register.  */
 683         env->regs[n] = tmp;
 684         return 4;
 685     }
 686     if (n < 24) { /* 16-23 */
 687         /* FPA registers (ignored).  */
 688         if (gdb_has_xml)
 689             return 0;
 690         return 12;
 691     }
 692     switch (n) {
 693     case 24:
 694         /* FPA status register (ignored).  */
 695         if (gdb_has_xml)
 696             return 0;
 697         return 4;
 698     case 25:
 699         /* CPSR */
 700         cpsr_write (env, tmp, 0xffffffff);
 701         return 4;
 702     }
 703     /* Unknown register.  */
 704     return 0;
 705 }
 706
 707 #elif defined (TARGET_M68K)
 708
 709 #define NUM_CORE_REGS 18
 710
 711 #define GDB_CORE_XML "cf-core.xml"
 712
 713 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 714 {
 715     if (n < 8) {
 716         /* D0-D7 */
 717         GET_REG32(env->dregs[n]);
 718     } else if (n < 16) {
 719         /* A0-A7 */
 720         GET_REG32(env->aregs[n - 8]);
 721     } else {
 722         switch (n) {
 723         case 16: GET_REG32(env->sr);
 724         case 17: GET_REG32(env->pc);
 725         }
 726     }
 727     /* FP registers not included here because they vary between
 728        ColdFire and m68k.  Use XML bits for these.  */
 729     return 0;
 730 }
 731
 732 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 733 {
 734     uint32_t tmp;
 735
 736     tmp = ldl_p(mem_buf);
 737
 738     if (n < 8) {
 739         /* D0-D7 */
 740         env->dregs[n] = tmp;
 741     } else if (n < 8) {
 742         /* A0-A7 */
 743         env->aregs[n - 8] = tmp;
 744     } else {
 745         switch (n) {
 746         case 16: env->sr = tmp; break;
 747         case 17: env->pc = tmp; break;
 748         default: return 0;
 749         }
 750     }
 751     return 4;
 752 }
 753 #elif defined (TARGET_MIPS)
 754
 755 #define NUM_CORE_REGS 73
 756
 757 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 758 {
 759     if (n < 32) {
 760         GET_REGL(env->active_tc.gpr[n]);
 761     }
 762     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
 763         if (n >= 38 && n < 70) {
 764             if (env->CP0_Status & (1 << CP0St_FR))
 765                 GET_REGL(env->active_fpu.fpr[n - 38].d);
 766             else
 767                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
 768         }
 769         switch (n) {
 770         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
 771         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
 772         }
 773     }
 774     switch (n) {
 775     case 32: GET_REGL((int32_t)env->CP0_Status);
 776     case 33: GET_REGL(env->active_tc.LO[0]);
 777     case 34: GET_REGL(env->active_tc.HI[0]);
 778     case 35: GET_REGL(env->CP0_BadVAddr);
 779     case 36: GET_REGL((int32_t)env->CP0_Cause);
 780     case 37: GET_REGL(env->active_tc.PC);
 781     case 72: GET_REGL(0); /* fp */
 782     case 89: GET_REGL((int32_t)env->CP0_PRid);
 783     }
 784     if (n >= 73 && n <= 88) {
 785         /* 16 embedded regs.  */
 786         GET_REGL(0);
 787     }
 788
 789     return 0;
 790 }
 791
 792 /* convert MIPS rounding mode in FCR31 to IEEE library */
 793 static unsigned int ieee_rm[] =
 794   {
 795     float_round_nearest_even,
 796     float_round_to_zero,
 797     float_round_up,
 798     float_round_down
 799   };
 800 #define RESTORE_ROUNDING_MODE \
 801     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
 802
 803 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 804 {
 805     target_ulong tmp;
 806
 807     tmp = ldtul_p(mem_buf);
 808
 809     if (n < 32) {
 810         env->active_tc.gpr[n] = tmp;
 811         return sizeof(target_ulong);
 812     }
 813     if (env->CP0_Config1 & (1 << CP0C1_FP)
 814             && n >= 38 && n < 73) {
 815         if (n < 70) {
 816             if (env->CP0_Status & (1 << CP0St_FR))
 817               env->active_fpu.fpr[n - 38].d = tmp;
 818             else
 819               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
 820         }
 821         switch (n) {
 822         case 70:
 823             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
 824             /* set rounding mode */
 825             RESTORE_ROUNDING_MODE;
 826 #ifndef CONFIG_SOFTFLOAT
 827             /* no floating point exception for native float */
 828             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
 829 #endif
 830             break;
 831         case 71: env->active_fpu.fcr0 = tmp; break;
 832         }
 833         return sizeof(target_ulong);
 834     }
 835     switch (n) {
 836     case 32: env->CP0_Status = tmp; break;
 837     case 33: env->active_tc.LO[0] = tmp; break;
 838     case 34: env->active_tc.HI[0] = tmp; break;
 839     case 35: env->CP0_BadVAddr = tmp; break;
 840     case 36: env->CP0_Cause = tmp; break;
 841     case 37: env->active_tc.PC = tmp; break;
 842     case 72: /* fp, ignored */ break;
 843     default:
 844         if (n > 89)
 845             return 0;
 846         /* Other registers are readonly.  Ignore writes.  */
 847         break;
 848     }
 849
 850     return sizeof(target_ulong);
 851 }
 852 #elif defined (TARGET_SH4)
 853
 854 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
 855 /* FIXME: We should use XML for this.  */
 856
 857 #define NUM_CORE_REGS 59
 858
 859 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 860 {
 861     if (n < 8) {
 862         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
 863             GET_REGL(env->gregs[n + 16]);
 864         } else {
 865             GET_REGL(env->gregs[n]);
 866         }
 867     } else if (n < 16) {
 868         GET_REGL(env->gregs[n - 8]);
 869     } else if (n >= 25 && n < 41) {
 870         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
 871     } else if (n >= 43 && n < 51) {
 872         GET_REGL(env->gregs[n - 43]);
 873     } else if (n >= 51 && n < 59) {
 874         GET_REGL(env->gregs[n - (51 - 16)]);
 875     }
 876     switch (n) {
 877     case 16: GET_REGL(env->pc);
 878     case 17: GET_REGL(env->pr);
 879     case 18: GET_REGL(env->gbr);
 880     case 19: GET_REGL(env->vbr);
 881     case 20: GET_REGL(env->mach);
 882     case 21: GET_REGL(env->macl);
 883     case 22: GET_REGL(env->sr);
 884     case 23: GET_REGL(env->fpul);
 885     case 24: GET_REGL(env->fpscr);
 886     case 41: GET_REGL(env->ssr);
 887     case 42: GET_REGL(env->spc);
 888     }
 889
 890     return 0;
 891 }
 892
 893 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 894 {
 895     uint32_t tmp;
 896
 897     tmp = ldl_p(mem_buf);
 898
 899     if (n < 8) {
 900         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
 901             env->gregs[n + 16] = tmp;
 902         } else {
 903             env->gregs[n] = tmp;
 904         }
 905         return 4;
 906     } else if (n < 16) {
 907         env->gregs[n - 8] = tmp;
 908         return 4;
 909     } else if (n >= 25 && n < 41) {
 910         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
 911     } else if (n >= 43 && n < 51) {
 912         env->gregs[n - 43] = tmp;
 913         return 4;
 914     } else if (n >= 51 && n < 59) {
 915         env->gregs[n - (51 - 16)] = tmp;
 916         return 4;
 917     }
 918     switch (n) {
 919     case 16: env->pc = tmp;
 920     case 17: env->pr = tmp;
 921     case 18: env->gbr = tmp;
 922     case 19: env->vbr = tmp;
 923     case 20: env->mach = tmp;
 924     case 21: env->macl = tmp;
 925     case 22: env->sr = tmp;
 926     case 23: env->fpul = tmp;
 927     case 24: env->fpscr = tmp;
 928     case 41: env->ssr = tmp;
 929     case 42: env->spc = tmp;
 930     default: return 0;
 931     }
 932
 933     return 4;
 934 }
 935 #elif defined (TARGET_CRIS)
 936
 937 #define NUM_CORE_REGS 49
 938
 939 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 940 {
 941     uint8_t srs;
 942
 943     srs = env->pregs[PR_SRS];
 944     if (n < 16) {
 945         GET_REG32(env->regs[n]);
 946     }
 947
 948     if (n >= 21 && n < 32) {
 949         GET_REG32(env->pregs[n - 16]);
 950     }
 951     if (n >= 33 && n < 49) {
 952         GET_REG32(env->sregs[srs][n - 33]);
 953     }
 954     switch (n) {
 955     case 16: GET_REG8(env->pregs[0]);
 956     case 17: GET_REG8(env->pregs[1]);
 957     case 18: GET_REG32(env->pregs[2]);
 958     case 19: GET_REG8(srs);
 959     case 20: GET_REG16(env->pregs[4]);
 960     case 32: GET_REG32(env->pc);
 961     }
 962
 963     return 0;
 964 }
 965
 966 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 967 {
 968     uint32_t tmp;
 969
 970     if (n > 49)
 971         return 0;
 972
 973     tmp = ldl_p(mem_buf);
 974
 975     if (n < 16) {
 976         env->regs[n] = tmp;
 977     }
 978
 979     if (n >= 21 && n < 32) {
 980         env->pregs[n - 16] = tmp;
 981     }
 982
 983     /* FIXME: Should support function regs be writable?  */
 984     switch (n) {
 985     case 16: return 1;
 986     case 17: return 1;
 987     case 18: env->pregs[PR_PID] = tmp; break;
 988     case 19: return 1;
 989     case 20: return 2;
 990     case 32: env->pc = tmp; break;
 991     }
 992
 993     return 4;
 994 }
 995 #else
 996
 997 #define NUM_CORE_REGS 0
 998
 999 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1000 {
1001     return 0;
1002 }
1003
1004 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1005 {
1006     return 0;
1007 }
1008
1009 #endif
1010
1011 static int num_g_regs = NUM_CORE_REGS;
1012
1013 #ifdef GDB_CORE_XML
1014 /* Encode data using the encoding for 'x' packets.  */
1015 static int memtox(char *buf, const char *mem, int len)
1016 {
1017     char *p = buf;
1018     char c;
1019
1020     while (len--) {
1021         c = *(mem++);
1022         switch (c) {
1023         case '#': case '$': case '*': case '}':
1024             *(p++) = '}';
1025             *(p++) = c ^ 0x20;
1026             break;
1027         default:
1028             *(p++) = c;
1029             break;
1030         }
1031     }
1032     return p - buf;
1033 }
1034
1035 const char *get_feature_xml(CPUState *env, const char *p, const char **newp)
1036 {
1037     extern const char *const xml_builtin[][2];
1038     size_t len;
1039     int i;
1040     const char *name;
1041     static char target_xml[1024];
1042
1043     len = 0;
1044     while (p[len] && p[len] != ':')
1045         len++;
1046     *newp = p + len;
1047
1048     name = NULL;
1049     if (strncmp(p, "target.xml", len) == 0) {
1050         /* Generate the XML description for this CPU.  */
1051         if (!target_xml[0]) {
1052             GDBRegisterState *r;
1053
1054             snprintf(target_xml, sizeof(target_xml),
1055                      "<?xml version=\"1.0\"?>"
1056                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1057                      "<target>"
1058                      "<xi:include href=\"%s\"/>",
1059                      GDB_CORE_XML);
1060
1061             for (r = env->gdb_regs; r; r = r->next) {
1062                 strcat(target_xml, "<xi:include href=\"");
1063                 strcat(target_xml, r->xml);
1064                 strcat(target_xml, "\"/>");
1065             }
1066             strcat(target_xml, "</target>");
1067         }
1068         return target_xml;
1069     }
1070     for (i = 0; ; i++) {
1071         name = xml_builtin[i][0];
1072         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1073             break;
1074     }
1075     return name ? xml_builtin[i][1] : NULL;
1076 }
1077 #endif
1078
1079 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1080 {
1081     GDBRegisterState *r;
1082
1083     if (reg < NUM_CORE_REGS)
1084         return cpu_gdb_read_register(env, mem_buf, reg);
1085
1086     for (r = env->gdb_regs; r; r = r->next) {
1087         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1088             return r->get_reg(env, mem_buf, reg - r->base_reg);
1089         }
1090     }
1091     return 0;
1092 }
1093
1094 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1095 {
1096     GDBRegisterState *r;
1097
1098     if (reg < NUM_CORE_REGS)
1099         return cpu_gdb_write_register(env, mem_buf, reg);
1100
1101     for (r = env->gdb_regs; r; r = r->next) {
1102         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1103             return r->set_reg(env, mem_buf, reg - r->base_reg);
1104         }
1105     }
1106     return 0;
1107 }
1108
1109 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1110    specifies the first register number and these registers are included in
1111    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1112    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1113  */
1114
1115 void gdb_register_coprocessor(CPUState * env,
1116                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1117                              int num_regs, const char *xml, int g_pos)
1118 {
1119     GDBRegisterState *s;
1120     GDBRegisterState **p;
1121     static int last_reg = NUM_CORE_REGS;
1122
1123     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1124     s->base_reg = last_reg;
1125     s->num_regs = num_regs;
1126     s->get_reg = get_reg;
1127     s->set_reg = set_reg;
1128     s->xml = xml;
1129     p = &env->gdb_regs;
1130     while (*p) {
1131         /* Check for duplicates.  */
1132         if (strcmp((*p)->xml, xml) == 0)
1133             return;
1134         p = &(*p)->next;
1135     }
1136     /* Add to end of list.  */
1137     last_reg += num_regs;
1138     *p = s;
1139     if (g_pos) {
1140         if (g_pos != s->base_reg) {
1141             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1142                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1143         } else {
1144             num_g_regs = last_reg;
1145         }
1146     }
1147 }
1148
1149 static int gdb_handle_packet(GDBState *s, CPUState *env, const char *line_buf)
1150 {
1151     const char *p;
1152     int ch, reg_size, type;
1153     char buf[MAX_PACKET_LENGTH];
1154     uint8_t mem_buf[MAX_PACKET_LENGTH];
1155     uint8_t *registers;
1156     target_ulong addr, len;
1157
1158 #ifdef DEBUG_GDB
1159     printf("command='%s'\n", line_buf);
1160 #endif
1161     p = line_buf;
1162     ch = *p++;
1163     switch(ch) {
1164     case '?':
1165         /* TODO: Make this return the correct value for user-mode.  */
1166         snprintf(buf, sizeof(buf), "S%02x", SIGTRAP);
1167         put_packet(s, buf);
1168         /* Remove all the breakpoints when this query is issued,
1169          * because gdb is doing and initial connect and the state
1170          * should be cleaned up.
1171          */
1172         cpu_breakpoint_remove_all(env);
1173         cpu_watchpoint_remove_all(env);
1174         break;
1175     case 'c':
1176         if (*p != '\0') {
1177             addr = strtoull(p, (char **)&p, 16);
1178 #if defined(TARGET_I386)
1179             env->eip = addr;
1180             kvm_load_registers(env);
1181 #elif defined (TARGET_PPC)
1182             env->nip = addr;
1183             kvm_load_registers(env);
1184 #elif defined (TARGET_SPARC)
1185             env->pc = addr;
1186             env->npc = addr + 4;
1187 #elif defined (TARGET_ARM)
1188             env->regs[15] = addr;
1189 #elif defined (TARGET_SH4)
1190             env->pc = addr;
1191 #elif defined (TARGET_MIPS)
1192             env->active_tc.PC = addr;
1193 #elif defined (TARGET_CRIS)
1194             env->pc = addr;
1195 #endif
1196         }
1197         gdb_continue(s);
1198         return RS_IDLE;
1199     case 'C':
1200         s->signal = strtoul(p, (char **)&p, 16);
1201         gdb_continue(s);
1202         return RS_IDLE;
1203     case 'k':
1204         /* Kill the target */
1205         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1206         exit(0);
1207     case 'D':
1208         /* Detach packet */
1209         cpu_breakpoint_remove_all(env);
1210         cpu_watchpoint_remove_all(env);
1211         gdb_continue(s);
1212         put_packet(s, "OK");
1213         break;
1214     case 's':
1215         if (*p != '\0') {
1216             addr = strtoull(p, (char **)&p, 16);
1217 #if defined(TARGET_I386)
1218             env->eip = addr;
1219             kvm_load_registers(env);
1220 #elif defined (TARGET_PPC)
1221             env->nip = addr;
1222             kvm_load_registers(env);
1223 #elif defined (TARGET_SPARC)
1224             env->pc = addr;
1225             env->npc = addr + 4;
1226 #elif defined (TARGET_ARM)
1227             env->regs[15] = addr;
1228 #elif defined (TARGET_SH4)
1229             env->pc = addr;
1230 #elif defined (TARGET_MIPS)
1231             env->active_tc.PC = addr;
1232 #elif defined (TARGET_CRIS)
1233             env->pc = addr;
1234 #endif
1235         }
1236         cpu_single_step(env, sstep_flags);
1237         gdb_continue(s);
1238         return RS_IDLE;
1239     case 'F':
1240         {
1241             target_ulong ret;
1242             target_ulong err;
1243
1244             ret = strtoull(p, (char **)&p, 16);
1245             if (*p == ',') {
1246                 p++;
1247                 err = strtoull(p, (char **)&p, 16);
1248             } else {
1249                 err = 0;
1250             }
1251             if (*p == ',')
1252                 p++;
1253             type = *p;
1254             if (gdb_current_syscall_cb)
1255                 gdb_current_syscall_cb(s->env, ret, err);
1256             if (type == 'C') {
1257                 put_packet(s, "T02");
1258             } else {
1259                 gdb_continue(s);
1260             }
1261         }
1262         break;
1263     case 'g':
1264         kvm_save_registers(env);
1265         len = 0;
1266         for (addr = 0; addr < num_g_regs; addr++) {
1267             reg_size = gdb_read_register(env, mem_buf + len, addr);
1268             len += reg_size;
1269         }
1270         memtohex(buf, mem_buf, len);
1271         put_packet(s, buf);
1272         break;
1273     case 'G':
1274         registers = mem_buf;
1275         len = strlen(p) / 2;
1276         hextomem((uint8_t *)registers, p, len);
1277         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1278             reg_size = gdb_write_register(env, registers, addr);
1279             len -= reg_size;
1280             registers += reg_size;
1281         }
1282         kvm_load_registers(env);
1283         put_packet(s, "OK");
1284         break;
1285     case 'm':
1286         addr = strtoull(p, (char **)&p, 16);
1287         if (*p == ',')
1288             p++;
1289         len = strtoull(p, NULL, 16);
1290         if (cpu_memory_rw_debug(env, addr, mem_buf, len, 0) != 0) {
1291             put_packet (s, "E14");
1292         } else {
1293             memtohex(buf, mem_buf, len);
1294             put_packet(s, buf);
1295         }
1296         break;
1297     case 'M':
1298         addr = strtoull(p, (char **)&p, 16);
1299         if (*p == ',')
1300             p++;
1301         len = strtoull(p, (char **)&p, 16);
1302         if (*p == ':')
1303             p++;
1304         hextomem(mem_buf, p, len);
1305         if (cpu_memory_rw_debug(env, addr, mem_buf, len, 1) != 0)
1306             put_packet(s, "E14");
1307         else
1308             put_packet(s, "OK");
1309         break;
1310     case 'p':
1311         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1312            This works, but can be very slow.  Anything new enough to
1313            understand XML also knows how to use this properly.  */
1314         if (!gdb_has_xml)
1315             goto unknown_command;
1316         addr = strtoull(p, (char **)&p, 16);
1317         reg_size = gdb_read_register(env, mem_buf, addr);
1318         if (reg_size) {
1319             memtohex(buf, mem_buf, reg_size);
1320             put_packet(s, buf);
1321         } else {
1322             put_packet(s, "E14");
1323         }
1324         break;
1325     case 'P':
1326         if (!gdb_has_xml)
1327             goto unknown_command;
1328         addr = strtoull(p, (char **)&p, 16);
1329         if (*p == '=')
1330             p++;
1331         reg_size = strlen(p) / 2;
1332         hextomem(mem_buf, p, reg_size);
1333         gdb_write_register(env, mem_buf, addr);
1334         put_packet(s, "OK");
1335         break;
1336     case 'Z':
1337         type = strtoul(p, (char **)&p, 16);
1338         if (*p == ',')
1339             p++;
1340         addr = strtoull(p, (char **)&p, 16);
1341         if (*p == ',')
1342             p++;
1343         len = strtoull(p, (char **)&p, 16);
1344         switch (type) {
1345         case 0:
1346         case 1:
1347             if (cpu_breakpoint_insert(env, addr) < 0)
1348                 goto breakpoint_error;
1349             put_packet(s, "OK");
1350             break;
1351 #ifndef CONFIG_USER_ONLY
1352         case 2:
1353             type = PAGE_WRITE;
1354             goto insert_watchpoint;
1355         case 3:
1356             type = PAGE_READ;
1357             goto insert_watchpoint;
1358         case 4:
1359             type = PAGE_READ | PAGE_WRITE;
1360         insert_watchpoint:
1361             if (cpu_watchpoint_insert(env, addr, type) < 0)
1362                 goto breakpoint_error;
1363             put_packet(s, "OK");
1364             break;
1365 #endif
1366         default:
1367             put_packet(s, "");
1368             break;
1369         }
1370         break;
1371     breakpoint_error:
1372         put_packet(s, "E22");
1373         break;
1374
1375     case 'z':
1376         type = strtoul(p, (char **)&p, 16);
1377         if (*p == ',')
1378             p++;
1379         addr = strtoull(p, (char **)&p, 16);
1380         if (*p == ',')
1381             p++;
1382         len = strtoull(p, (char **)&p, 16);
1383         if (type == 0 || type == 1) {
1384             cpu_breakpoint_remove(env, addr);
1385             put_packet(s, "OK");
1386 #ifndef CONFIG_USER_ONLY
1387         } else if (type >= 2 || type <= 4) {
1388             cpu_watchpoint_remove(env, addr);
1389             put_packet(s, "OK");
1390 #endif
1391         } else {
1392             put_packet(s, "");
1393         }
1394         break;
1395     case 'q':
1396     case 'Q':
1397         /* parse any 'q' packets here */
1398         if (!strcmp(p,"qemu.sstepbits")) {
1399             /* Query Breakpoint bit definitions */
1400             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1401                      SSTEP_ENABLE,
1402                      SSTEP_NOIRQ,
1403                      SSTEP_NOTIMER);
1404             put_packet(s, buf);
1405             break;
1406         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1407             /* Display or change the sstep_flags */
1408             p += 10;
1409             if (*p != '=') {
1410                 /* Display current setting */
1411                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1412                 put_packet(s, buf);
1413                 break;
1414             }
1415             p++;
1416             type = strtoul(p, (char **)&p, 16);
1417             sstep_flags = type;
1418             put_packet(s, "OK");
1419             break;
1420         }
1421 #ifdef CONFIG_LINUX_USER
1422         else if (strncmp(p, "Offsets", 7) == 0) {
1423             TaskState *ts = env->opaque;
1424
1425             snprintf(buf, sizeof(buf),
1426                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1427                      ";Bss=" TARGET_ABI_FMT_lx,
1428                      ts->info->code_offset,
1429                      ts->info->data_offset,
1430                      ts->info->data_offset);
1431             put_packet(s, buf);
1432             break;
1433         }
1434 #endif
1435         if (strncmp(p, "Supported", 9) == 0) {
1436             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1437 #ifdef GDB_CORE_XML
1438             strcat(buf, ";qXfer:features:read+");
1439 #endif
1440             put_packet(s, buf);
1441             break;
1442         }
1443 #ifdef GDB_CORE_XML
1444         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1445             const char *xml;
1446             target_ulong total_len;
1447
1448             gdb_has_xml = 1;
1449             p += 19;
1450             xml = get_feature_xml(env, p, &p);
1451             if (!xml) {
1452                 snprintf(buf, sizeof(buf), "E00");
1453                 put_packet(s, buf);
1454                 break;
1455             }
1456
1457             if (*p == ':')
1458                 p++;
1459             addr = strtoul(p, (char **)&p, 16);
1460             if (*p == ',')
1461                 p++;
1462             len = strtoul(p, (char **)&p, 16);
1463
1464             total_len = strlen(xml);
1465             if (addr > total_len) {
1466                 snprintf(buf, sizeof(buf), "E00");
1467                 put_packet(s, buf);
1468                 break;
1469             }
1470             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1471                 len = (MAX_PACKET_LENGTH - 5) / 2;
1472             if (len < total_len - addr) {
1473                 buf[0] = 'm';
1474                 len = memtox(buf + 1, xml + addr, len);
1475             } else {
1476                 buf[0] = 'l';
1477                 len = memtox(buf + 1, xml + addr, total_len - addr);
1478             }
1479             put_packet_binary(s, buf, len + 1);
1480             break;
1481         }
1482 #endif
1483         /* Unrecognised 'q' command.  */
1484         goto unknown_command;
1485
1486     default:
1487     unknown_command:
1488         /* put empty packet */
1489         buf[0] = '\0';
1490         put_packet(s, buf);
1491         break;
1492     }
1493     return RS_IDLE;
1494 }
1495
1496 extern void tb_flush(CPUState *env);
1497
1498 #ifndef CONFIG_USER_ONLY
1499 static void gdb_vm_stopped(void *opaque, int reason)
1500 {
1501     GDBState *s = opaque;
1502     char buf[256];
1503     int ret;
1504
1505     if (s->state == RS_SYSCALL)
1506         return;
1507
1508     /* disable single step if it was enable */
1509     cpu_single_step(s->env, 0);
1510
1511     if (reason == EXCP_DEBUG) {
1512         if (s->env->watchpoint_hit) {
1513             snprintf(buf, sizeof(buf), "T%02xwatch:" TARGET_FMT_lx ";",
1514                      SIGTRAP,
1515                      s->env->watchpoint[s->env->watchpoint_hit - 1].vaddr);
1516             put_packet(s, buf);
1517             s->env->watchpoint_hit = 0;
1518             return;
1519         }
1520         tb_flush(s->env);
1521         ret = SIGTRAP;
1522     } else if (reason == EXCP_INTERRUPT) {
1523         ret = SIGINT;
1524     } else {
1525         ret = 0;
1526     }
1527     snprintf(buf, sizeof(buf), "S%02x", ret);
1528     put_packet(s, buf);
1529 }
1530 #endif
1531
1532 /* Send a gdb syscall request.
1533    This accepts limited printf-style format specifiers, specifically:
1534     %x  - target_ulong argument printed in hex.
1535     %lx - 64-bit argument printed in hex.
1536     %s  - string pointer (target_ulong) and length (int) pair.  */
1537 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1538 {
1539     va_list va;
1540     char buf[256];
1541     char *p;
1542     target_ulong addr;
1543     uint64_t i64;
1544     GDBState *s;
1545
1546     s = gdb_syscall_state;
1547     if (!s)
1548         return;
1549     gdb_current_syscall_cb = cb;
1550     s->state = RS_SYSCALL;
1551 #ifndef CONFIG_USER_ONLY
1552     vm_stop(EXCP_DEBUG);
1553 #endif
1554     s->state = RS_IDLE;
1555     va_start(va, fmt);
1556     p = buf;
1557     *(p++) = 'F';
1558     while (*fmt) {
1559         if (*fmt == '%') {
1560             fmt++;
1561             switch (*fmt++) {
1562             case 'x':
1563                 addr = va_arg(va, target_ulong);
1564                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
1565                 break;
1566             case 'l':
1567                 if (*(fmt++) != 'x')
1568                     goto bad_format;
1569                 i64 = va_arg(va, uint64_t);
1570                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
1571                 break;
1572             case 's':
1573                 addr = va_arg(va, target_ulong);
1574                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
1575                               addr, va_arg(va, int));
1576                 break;
1577             default:
1578             bad_format:
1579                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
1580                         fmt - 1);
1581                 break;
1582             }
1583         } else {
1584             *(p++) = *(fmt++);
1585         }
1586     }
1587     *p = 0;
1588     va_end(va);
1589     put_packet(s, buf);
1590 #ifdef CONFIG_USER_ONLY
1591     gdb_handlesig(s->env, 0);
1592 #else
1593     cpu_interrupt(s->env, CPU_INTERRUPT_EXIT);
1594 #endif
1595 }
1596
1597 static void gdb_read_byte(GDBState *s, int ch)
1598 {
1599     CPUState *env = s->env;
1600     int i, csum;
1601     uint8_t reply;
1602
1603 #ifndef CONFIG_USER_ONLY
1604     if (s->last_packet_len) {
1605         /* Waiting for a response to the last packet.  If we see the start
1606            of a new command then abandon the previous response.  */
1607         if (ch == '-') {
1608 #ifdef DEBUG_GDB
1609             printf("Got NACK, retransmitting\n");
1610 #endif
1611             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
1612         }
1613 #ifdef DEBUG_GDB
1614         else if (ch == '+')
1615             printf("Got ACK\n");
1616         else
1617             printf("Got '%c' when expecting ACK/NACK\n", ch);
1618 #endif
1619         if (ch == '+' || ch == '$')
1620             s->last_packet_len = 0;
1621         if (ch != '$')
1622             return;
1623     }
1624     if (vm_running) {
1625         /* when the CPU is running, we cannot do anything except stop
1626            it when receiving a char */
1627         vm_stop(EXCP_INTERRUPT);
1628     } else
1629 #endif
1630     {
1631         switch(s->state) {
1632         case RS_IDLE:
1633             if (ch == '$') {
1634                 s->line_buf_index = 0;
1635                 s->state = RS_GETLINE;
1636             }
1637             break;
1638         case RS_GETLINE:
1639             if (ch == '#') {
1640             s->state = RS_CHKSUM1;
1641             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1642                 s->state = RS_IDLE;
1643             } else {
1644             s->line_buf[s->line_buf_index++] = ch;
1645             }
1646             break;
1647         case RS_CHKSUM1:
1648             s->line_buf[s->line_buf_index] = '\0';
1649             s->line_csum = fromhex(ch) << 4;
1650             s->state = RS_CHKSUM2;
1651             break;
1652         case RS_CHKSUM2:
1653             s->line_csum |= fromhex(ch);
1654             csum = 0;
1655             for(i = 0; i < s->line_buf_index; i++) {
1656                 csum += s->line_buf[i];
1657             }
1658             if (s->line_csum != (csum & 0xff)) {
1659                 reply = '-';
1660                 put_buffer(s, &reply, 1);
1661                 s->state = RS_IDLE;
1662             } else {
1663                 reply = '+';
1664                 put_buffer(s, &reply, 1);
1665                 s->state = gdb_handle_packet(s, env, s->line_buf);
1666             }
1667             break;
1668         default:
1669             abort();
1670         }
1671     }
1672 }
1673
1674 #ifdef CONFIG_USER_ONLY
1675 int
1676 gdb_handlesig (CPUState *env, int sig)
1677 {
1678   GDBState *s;
1679   char buf[256];
1680   int n;
1681
1682   s = &gdbserver_state;
1683   if (gdbserver_fd < 0 || s->fd < 0)
1684     return sig;
1685
1686   /* disable single step if it was enabled */
1687   cpu_single_step(env, 0);
1688   tb_flush(env);
1689
1690   if (sig != 0)
1691     {
1692       snprintf(buf, sizeof(buf), "S%02x", sig);
1693       put_packet(s, buf);
1694     }
1695   /* put_packet() might have detected that the peer terminated the
1696      connection.  */
1697   if (s->fd < 0)
1698       return sig;
1699
1700   sig = 0;
1701   s->state = RS_IDLE;
1702   s->running_state = 0;
1703   while (s->running_state == 0) {
1704       n = read (s->fd, buf, 256);
1705       if (n > 0)
1706         {
1707           int i;
1708
1709           for (i = 0; i < n; i++)
1710             gdb_read_byte (s, buf[i]);
1711         }
1712       else if (n == 0 || errno != EAGAIN)
1713         {
1714           /* XXX: Connection closed.  Should probably wait for annother
1715              connection before continuing.  */
1716           return sig;
1717         }
1718   }
1719   sig = s->signal;
1720   s->signal = 0;
1721   return sig;
1722 }
1723
1724 /* Tell the remote gdb that the process has exited.  */
1725 void gdb_exit(CPUState *env, int code)
1726 {
1727   GDBState *s;
1728   char buf[4];
1729
1730   s = &gdbserver_state;
1731   if (gdbserver_fd < 0 || s->fd < 0)
1732     return;
1733
1734   snprintf(buf, sizeof(buf), "W%02x", code);
1735   put_packet(s, buf);
1736 }
1737
1738
1739 static void gdb_accept(void *opaque)
1740 {
1741     GDBState *s;
1742     struct sockaddr_in sockaddr;
1743     socklen_t len;
1744     int val, fd;
1745
1746     for(;;) {
1747         len = sizeof(sockaddr);
1748         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
1749         if (fd < 0 && errno != EINTR) {
1750             perror("accept");
1751             return;
1752         } else if (fd >= 0) {
1753             break;
1754         }
1755     }
1756
1757     /* set short latency */
1758     val = 1;
1759     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
1760
1761     s = &gdbserver_state;
1762     memset (s, 0, sizeof (GDBState));
1763     s->env = first_cpu; /* XXX: allow to change CPU */
1764     s->fd = fd;
1765     gdb_has_xml = 0;
1766
1767     gdb_syscall_state = s;
1768
1769     fcntl(fd, F_SETFL, O_NONBLOCK);
1770 }
1771
1772 static int gdbserver_open(int port)
1773 {
1774     struct sockaddr_in sockaddr;
1775     int fd, val, ret;
1776
1777     fd = socket(PF_INET, SOCK_STREAM, 0);
1778     if (fd < 0) {
1779         perror("socket");
1780         return -1;
1781     }
1782
1783     /* allow fast reuse */
1784     val = 1;
1785     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
1786
1787     sockaddr.sin_family = AF_INET;
1788     sockaddr.sin_port = htons(port);
1789     sockaddr.sin_addr.s_addr = 0;
1790     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
1791     if (ret < 0) {
1792         perror("bind");
1793         return -1;
1794     }
1795     ret = listen(fd, 0);
1796     if (ret < 0) {
1797         perror("listen");
1798         return -1;
1799     }
1800     return fd;
1801 }
1802
1803 int gdbserver_start(int port)
1804 {
1805     gdbserver_fd = gdbserver_open(port);
1806     if (gdbserver_fd < 0)
1807         return -1;
1808     /* accept connections */
1809     gdb_accept (NULL);
1810     return 0;
1811 }
1812 #else
1813 static int gdb_chr_can_receive(void *opaque)
1814 {
1815   /* We can handle an arbitrarily large amount of data.
1816    Pick the maximum packet size, which is as good as anything.  */
1817   return MAX_PACKET_LENGTH;
1818 }
1819
1820 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
1821 {
1822     GDBState *s = opaque;
1823     int i;
1824
1825     for (i = 0; i < size; i++) {
1826         gdb_read_byte(s, buf[i]);
1827     }
1828 }
1829
1830 static void gdb_chr_event(void *opaque, int event)
1831 {
1832     switch (event) {
1833     case CHR_EVENT_RESET:
1834         vm_stop(EXCP_INTERRUPT);
1835         gdb_syscall_state = opaque;
1836         gdb_has_xml = 0;
1837         break;
1838     default:
1839         break;
1840     }
1841 }
1842
1843 int gdbserver_start(const char *port)
1844 {
1845     GDBState *s;
1846     char gdbstub_port_name[128];
1847     int port_num;
1848     char *p;
1849     CharDriverState *chr;
1850
1851     if (!port || !*port)
1852       return -1;
1853
1854     port_num = strtol(port, &p, 10);
1855     if (*p == 0) {
1856         /* A numeric value is interpreted as a port number.  */
1857         snprintf(gdbstub_port_name, sizeof(gdbstub_port_name),
1858                  "tcp::%d,nowait,nodelay,server", port_num);
1859         port = gdbstub_port_name;
1860     }
1861
1862     chr = qemu_chr_open("gdb", port);
1863     if (!chr)
1864         return -1;
1865
1866     s = qemu_mallocz(sizeof(GDBState));
1867     if (!s) {
1868         return -1;
1869     }
1870     s->env = first_cpu; /* XXX: allow to change CPU */
1871     s->chr = chr;
1872     qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
1873                           gdb_chr_event, s);
1874     qemu_add_vm_stop_handler(gdb_vm_stopped, s);
1875     return 0;
1876 }
1877 #endif