gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20 #include "config.h"
  21 #include "qemu-common.h"
  22 #ifdef CONFIG_USER_ONLY
  23 #include <stdlib.h>
  24 #include <stdio.h>
  25 #include <stdarg.h>
  26 #include <string.h>
  27 #include <errno.h>
  28 #include <unistd.h>
  29 #include <fcntl.h>
  30
  31 #include "qemu.h"
  32 #else
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #include "qemu-kvm.h"
  37 #endif
  38
  39 #define MAX_PACKET_LENGTH 4096
  40
  41 #include "qemu_socket.h"
  42 #ifdef _WIN32
  43 /* XXX: these constants may be independent of the host ones even for Unix */
  44 #ifndef SIGTRAP
  45 #define SIGTRAP 5
  46 #endif
  47 #ifndef SIGINT
  48 #define SIGINT 2
  49 #endif
  50 #else
  51 #include <signal.h>
  52 #endif
  53
  54 //#define DEBUG_GDB
  55
  56 typedef struct GDBRegisterState {
  57     int base_reg;
  58     int num_regs;
  59     gdb_reg_cb get_reg;
  60     gdb_reg_cb set_reg;
  61     const char *xml;
  62     struct GDBRegisterState *next;
  63 } GDBRegisterState;
  64
  65 enum RSState {
  66     RS_IDLE,
  67     RS_GETLINE,
  68     RS_CHKSUM1,
  69     RS_CHKSUM2,
  70     RS_SYSCALL,
  71 };
  72 typedef struct GDBState {
  73     CPUState *c_cpu; /* current CPU for step/continue ops */
  74     CPUState *g_cpu; /* current CPU for other ops */
  75     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
  76     enum RSState state; /* parsing state */
  77     char line_buf[MAX_PACKET_LENGTH];
  78     int line_buf_index;
  79     int line_csum;
  80     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
  81     int last_packet_len;
  82     int signal;
  83 #ifdef CONFIG_USER_ONLY
  84     int fd;
  85     int running_state;
  86 #else
  87     CharDriverState *chr;
  88 #endif
  89 } GDBState;
  90
  91 /* By default use no IRQs and no timers while single stepping so as to
  92  * make single stepping like an ICE HW step.
  93  */
  94 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
  95
  96 static GDBState *gdbserver_state;
  97
  98 /* This is an ugly hack to cope with both new and old gdb.
  99    If gdb sends qXfer:features:read then assume we're talking to a newish
 100    gdb that understands target descriptions.  */
 101 static int gdb_has_xml;
 102
 103 #ifdef CONFIG_USER_ONLY
 104 /* XXX: This is not thread safe.  Do we care?  */
 105 static int gdbserver_fd = -1;
 106
 107 static int get_char(GDBState *s)
 108 {
 109     uint8_t ch;
 110     int ret;
 111
 112     for(;;) {
 113         ret = recv(s->fd, &ch, 1, 0);
 114         if (ret < 0) {
 115             if (errno == ECONNRESET)
 116                 s->fd = -1;
 117             if (errno != EINTR && errno != EAGAIN)
 118                 return -1;
 119         } else if (ret == 0) {
 120             close(s->fd);
 121             s->fd = -1;
 122             return -1;
 123         } else {
 124             break;
 125         }
 126     }
 127     return ch;
 128 }
 129 #endif
 130
 131 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 132
 133 enum {
 134     GDB_SYS_UNKNOWN,
 135     GDB_SYS_ENABLED,
 136     GDB_SYS_DISABLED,
 137 } gdb_syscall_mode;
 138
 139 /* If gdb is connected when the first semihosting syscall occurs then use
 140    remote gdb syscalls.  Otherwise use native file IO.  */
 141 int use_gdb_syscalls(void)
 142 {
 143     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 144         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 145                                             : GDB_SYS_DISABLED);
 146     }
 147     return gdb_syscall_mode == GDB_SYS_ENABLED;
 148 }
 149
 150 /* Resume execution.  */
 151 static inline void gdb_continue(GDBState *s)
 152 {
 153 #ifdef CONFIG_USER_ONLY
 154     s->running_state = 1;
 155 #else
 156     vm_start();
 157 #endif
 158 }
 159
 160 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 161 {
 162 #ifdef CONFIG_USER_ONLY
 163     int ret;
 164
 165     while (len > 0) {
 166         ret = send(s->fd, buf, len, 0);
 167         if (ret < 0) {
 168             if (errno != EINTR && errno != EAGAIN)
 169                 return;
 170         } else {
 171             buf += ret;
 172             len -= ret;
 173         }
 174     }
 175 #else
 176     qemu_chr_write(s->chr, buf, len);
 177 #endif
 178 }
 179
 180 static inline int fromhex(int v)
 181 {
 182     if (v >= '0' && v <= '9')
 183         return v - '0';
 184     else if (v >= 'A' && v <= 'F')
 185         return v - 'A' + 10;
 186     else if (v >= 'a' && v <= 'f')
 187         return v - 'a' + 10;
 188     else
 189         return 0;
 190 }
 191
 192 static inline int tohex(int v)
 193 {
 194     if (v < 10)
 195         return v + '0';
 196     else
 197         return v - 10 + 'a';
 198 }
 199
 200 static void memtohex(char *buf, const uint8_t *mem, int len)
 201 {
 202     int i, c;
 203     char *q;
 204     q = buf;
 205     for(i = 0; i < len; i++) {
 206         c = mem[i];
 207         *q++ = tohex(c >> 4);
 208         *q++ = tohex(c & 0xf);
 209     }
 210     *q = '\0';
 211 }
 212
 213 static void hextomem(uint8_t *mem, const char *buf, int len)
 214 {
 215     int i;
 216
 217     for(i = 0; i < len; i++) {
 218         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 219         buf += 2;
 220     }
 221 }
 222
 223 /* return -1 if error, 0 if OK */
 224 static int put_packet_binary(GDBState *s, const char *buf, int len)
 225 {
 226     int csum, i;
 227     uint8_t *p;
 228
 229     for(;;) {
 230         p = s->last_packet;
 231         *(p++) = '$';
 232         memcpy(p, buf, len);
 233         p += len;
 234         csum = 0;
 235         for(i = 0; i < len; i++) {
 236             csum += buf[i];
 237         }
 238         *(p++) = '#';
 239         *(p++) = tohex((csum >> 4) & 0xf);
 240         *(p++) = tohex((csum) & 0xf);
 241
 242         s->last_packet_len = p - s->last_packet;
 243         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 244
 245 #ifdef CONFIG_USER_ONLY
 246         i = get_char(s);
 247         if (i < 0)
 248             return -1;
 249         if (i == '+')
 250             break;
 251 #else
 252         break;
 253 #endif
 254     }
 255     return 0;
 256 }
 257
 258 /* return -1 if error, 0 if OK */
 259 static int put_packet(GDBState *s, const char *buf)
 260 {
 261 #ifdef DEBUG_GDB
 262     printf("reply='%s'\n", buf);
 263 #endif
 264
 265     return put_packet_binary(s, buf, strlen(buf));
 266 }
 267
 268 /* The GDB remote protocol transfers values in target byte order.  This means
 269    we can use the raw memory access routines to access the value buffer.
 270    Conveniently, these also handle the case where the buffer is mis-aligned.
 271  */
 272 #define GET_REG8(val) do { \
 273     stb_p(mem_buf, val); \
 274     return 1; \
 275     } while(0)
 276 #define GET_REG16(val) do { \
 277     stw_p(mem_buf, val); \
 278     return 2; \
 279     } while(0)
 280 #define GET_REG32(val) do { \
 281     stl_p(mem_buf, val); \
 282     return 4; \
 283     } while(0)
 284 #define GET_REG64(val) do { \
 285     stq_p(mem_buf, val); \
 286     return 8; \
 287     } while(0)
 288
 289 #if TARGET_LONG_BITS == 64
 290 #define GET_REGL(val) GET_REG64(val)
 291 #define ldtul_p(addr) ldq_p(addr)
 292 #else
 293 #define GET_REGL(val) GET_REG32(val)
 294 #define ldtul_p(addr) ldl_p(addr)
 295 #endif
 296
 297 #if defined(TARGET_I386)
 298
 299 #ifdef TARGET_X86_64
 300 static const int gpr_map[16] = {
 301     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 302     8, 9, 10, 11, 12, 13, 14, 15
 303 };
 304 #else
 305 static const int gpr_map[8] = {0, 1, 2, 3, 4, 5, 6, 7};
 306 #endif
 307
 308 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 309
 310 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 311 {
 312     if (n < CPU_NB_REGS) {
 313         GET_REGL(env->regs[gpr_map[n]]);
 314     } else if (n >= CPU_NB_REGS + 8 && n < CPU_NB_REGS + 16) {
 315         /* FIXME: byteswap float values.  */
 316 #ifdef USE_X86LDOUBLE
 317         memcpy(mem_buf, &env->fpregs[n - (CPU_NB_REGS + 8)], 10);
 318 #else
 319         memset(mem_buf, 0, 10);
 320 #endif
 321         return 10;
 322     } else if (n >= CPU_NB_REGS + 24) {
 323         n -= CPU_NB_REGS + 24;
 324         if (n < CPU_NB_REGS) {
 325             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 326             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 327             return 16;
 328         } else if (n == CPU_NB_REGS) {
 329             GET_REG32(env->mxcsr);
 330         }
 331     } else {
 332         n -= CPU_NB_REGS;
 333         switch (n) {
 334         case 0: GET_REGL(env->eip);
 335         case 1: GET_REG32(env->eflags);
 336         case 2: GET_REG32(env->segs[R_CS].selector);
 337         case 3: GET_REG32(env->segs[R_SS].selector);
 338         case 4: GET_REG32(env->segs[R_DS].selector);
 339         case 5: GET_REG32(env->segs[R_ES].selector);
 340         case 6: GET_REG32(env->segs[R_FS].selector);
 341         case 7: GET_REG32(env->segs[R_GS].selector);
 342         /* 8...15 x87 regs.  */
 343         case 16: GET_REG32(env->fpuc);
 344         case 17: GET_REG32((env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11);
 345         case 18: GET_REG32(0); /* ftag */
 346         case 19: GET_REG32(0); /* fiseg */
 347         case 20: GET_REG32(0); /* fioff */
 348         case 21: GET_REG32(0); /* foseg */
 349         case 22: GET_REG32(0); /* fooff */
 350         case 23: GET_REG32(0); /* fop */
 351         /* 24+ xmm regs.  */
 352         }
 353     }
 354     return 0;
 355 }
 356
 357 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int i)
 358 {
 359     uint32_t tmp;
 360
 361     if (i < CPU_NB_REGS) {
 362         env->regs[gpr_map[i]] = ldtul_p(mem_buf);
 363         return sizeof(target_ulong);
 364     } else if (i >= CPU_NB_REGS + 8 && i < CPU_NB_REGS + 16) {
 365         i -= CPU_NB_REGS + 8;
 366 #ifdef USE_X86LDOUBLE
 367         memcpy(&env->fpregs[i], mem_buf, 10);
 368 #endif
 369         return 10;
 370     } else if (i >= CPU_NB_REGS + 24) {
 371         i -= CPU_NB_REGS + 24;
 372         if (i < CPU_NB_REGS) {
 373             env->xmm_regs[i].XMM_Q(0) = ldq_p(mem_buf);
 374             env->xmm_regs[i].XMM_Q(1) = ldq_p(mem_buf + 8);
 375             return 16;
 376         } else if (i == CPU_NB_REGS) {
 377             env->mxcsr = ldl_p(mem_buf);
 378             return 4;
 379         }
 380     } else {
 381         i -= CPU_NB_REGS;
 382         switch (i) {
 383         case 0: env->eip = ldtul_p(mem_buf); return sizeof(target_ulong);
 384         case 1: env->eflags = ldl_p(mem_buf); return 4;
 385 #if defined(CONFIG_USER_ONLY)
 386 #define LOAD_SEG(index, sreg)\
 387             tmp = ldl_p(mem_buf);\
 388             if (tmp != env->segs[sreg].selector)\
 389                 cpu_x86_load_seg(env, sreg, tmp);
 390 #else
 391 /* FIXME: Honor segment registers.  Needs to avoid raising an exception
 392    when the selector is invalid.  */
 393 #define LOAD_SEG(index, sreg) do {} while(0)
 394 #endif
 395         case 2: LOAD_SEG(10, R_CS); return 4;
 396         case 3: LOAD_SEG(11, R_SS); return 4;
 397         case 4: LOAD_SEG(12, R_DS); return 4;
 398         case 5: LOAD_SEG(13, R_ES); return 4;
 399         case 6: LOAD_SEG(14, R_FS); return 4;
 400         case 7: LOAD_SEG(15, R_GS); return 4;
 401         /* 8...15 x87 regs.  */
 402         case 16: env->fpuc = ldl_p(mem_buf); return 4;
 403         case 17:
 404                  tmp = ldl_p(mem_buf);
 405                  env->fpstt = (tmp >> 11) & 7;
 406                  env->fpus = tmp & ~0x3800;
 407                  return 4;
 408         case 18: /* ftag */ return 4;
 409         case 19: /* fiseg */ return 4;
 410         case 20: /* fioff */ return 4;
 411         case 21: /* foseg */ return 4;
 412         case 22: /* fooff */ return 4;
 413         case 23: /* fop */ return 4;
 414         /* 24+ xmm regs.  */
 415         }
 416     }
 417     /* Unrecognised register.  */
 418     return 0;
 419 }
 420
 421 #elif defined (TARGET_PPC)
 422
 423 #define NUM_CORE_REGS 71
 424
 425 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 426 {
 427     if (n < 32) {
 428         /* gprs */
 429         GET_REGL(env->gpr[n]);
 430     } else if (n < 64) {
 431         /* fprs */
 432         stfq_p(mem_buf, env->fpr[n]);
 433         return 8;
 434     } else {
 435         switch (n) {
 436         case 64: GET_REGL(env->nip);
 437         case 65: GET_REGL(env->msr);
 438         case 66:
 439             {
 440                 uint32_t cr = 0;
 441                 int i;
 442                 for (i = 0; i < 8; i++)
 443                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 444                 GET_REG32(cr);
 445             }
 446         case 67: GET_REGL(env->lr);
 447         case 68: GET_REGL(env->ctr);
 448         case 69: GET_REGL(env->xer);
 449         case 70: GET_REG32(0); /* fpscr */
 450         }
 451     }
 452     return 0;
 453 }
 454
 455 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 456 {
 457     if (n < 32) {
 458         /* gprs */
 459         env->gpr[n] = ldtul_p(mem_buf);
 460         return sizeof(target_ulong);
 461     } else if (n < 64) {
 462         /* fprs */
 463         env->fpr[n] = ldfq_p(mem_buf);
 464         return 8;
 465     } else {
 466         switch (n) {
 467         case 64:
 468             env->nip = ldtul_p(mem_buf);
 469             return sizeof(target_ulong);
 470         case 65:
 471             ppc_store_msr(env, ldtul_p(mem_buf));
 472             return sizeof(target_ulong);
 473         case 66:
 474             {
 475                 uint32_t cr = ldl_p(mem_buf);
 476                 int i;
 477                 for (i = 0; i < 8; i++)
 478                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 479                 return 4;
 480             }
 481         case 67:
 482             env->lr = ldtul_p(mem_buf);
 483             return sizeof(target_ulong);
 484         case 68:
 485             env->ctr = ldtul_p(mem_buf);
 486             return sizeof(target_ulong);
 487         case 69:
 488             env->xer = ldtul_p(mem_buf);
 489             return sizeof(target_ulong);
 490         case 70:
 491             /* fpscr */
 492             return 4;
 493         }
 494     }
 495     return 0;
 496 }
 497
 498 #elif defined (TARGET_SPARC)
 499
 500 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 501 #define NUM_CORE_REGS 86
 502 #else
 503 #define NUM_CORE_REGS 73
 504 #endif
 505
 506 #ifdef TARGET_ABI32
 507 #define GET_REGA(val) GET_REG32(val)
 508 #else
 509 #define GET_REGA(val) GET_REGL(val)
 510 #endif
 511
 512 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 513 {
 514     if (n < 8) {
 515         /* g0..g7 */
 516         GET_REGA(env->gregs[n]);
 517     }
 518     if (n < 32) {
 519         /* register window */
 520         GET_REGA(env->regwptr[n - 8]);
 521     }
 522 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 523     if (n < 64) {
 524         /* fprs */
 525         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 526     }
 527     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 528     switch (n) {
 529     case 64: GET_REGA(env->y);
 530     case 65: GET_REGA(GET_PSR(env));
 531     case 66: GET_REGA(env->wim);
 532     case 67: GET_REGA(env->tbr);
 533     case 68: GET_REGA(env->pc);
 534     case 69: GET_REGA(env->npc);
 535     case 70: GET_REGA(env->fsr);
 536     case 71: GET_REGA(0); /* csr */
 537     case 72: GET_REGA(0);
 538     }
 539 #else
 540     if (n < 64) {
 541         /* f0-f31 */
 542         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 543     }
 544     if (n < 80) {
 545         /* f32-f62 (double width, even numbers only) */
 546         uint64_t val;
 547
 548         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 549         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 550         GET_REG64(val);
 551     }
 552     switch (n) {
 553     case 80: GET_REGL(env->pc);
 554     case 81: GET_REGL(env->npc);
 555     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 556                            ((env->asi & 0xff) << 24) |
 557                            ((env->pstate & 0xfff) << 8) |
 558                            GET_CWP64(env));
 559     case 83: GET_REGL(env->fsr);
 560     case 84: GET_REGL(env->fprs);
 561     case 85: GET_REGL(env->y);
 562     }
 563 #endif
 564     return 0;
 565 }
 566
 567 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 568 {
 569 #if defined(TARGET_ABI32)
 570     abi_ulong tmp;
 571
 572     tmp = ldl_p(mem_buf);
 573 #else
 574     target_ulong tmp;
 575
 576     tmp = ldtul_p(mem_buf);
 577 #endif
 578
 579     if (n < 8) {
 580         /* g0..g7 */
 581         env->gregs[n] = tmp;
 582     } else if (n < 32) {
 583         /* register window */
 584         env->regwptr[n - 8] = tmp;
 585     }
 586 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 587     else if (n < 64) {
 588         /* fprs */
 589         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 590     } else {
 591         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 592         switch (n) {
 593         case 64: env->y = tmp; break;
 594         case 65: PUT_PSR(env, tmp); break;
 595         case 66: env->wim = tmp; break;
 596         case 67: env->tbr = tmp; break;
 597         case 68: env->pc = tmp; break;
 598         case 69: env->npc = tmp; break;
 599         case 70: env->fsr = tmp; break;
 600         default: return 0;
 601         }
 602     }
 603     return 4;
 604 #else
 605     else if (n < 64) {
 606         /* f0-f31 */
 607         env->fpr[n] = ldfl_p(mem_buf);
 608         return 4;
 609     } else if (n < 80) {
 610         /* f32-f62 (double width, even numbers only) */
 611         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 612         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 613     } else {
 614         switch (n) {
 615         case 80: env->pc = tmp; break;
 616         case 81: env->npc = tmp; break;
 617         case 82:
 618             PUT_CCR(env, tmp >> 32);
 619             env->asi = (tmp >> 24) & 0xff;
 620             env->pstate = (tmp >> 8) & 0xfff;
 621             PUT_CWP64(env, tmp & 0xff);
 622             break;
 623         case 83: env->fsr = tmp; break;
 624         case 84: env->fprs = tmp; break;
 625         case 85: env->y = tmp; break;
 626         default: return 0;
 627         }
 628     }
 629     return 8;
 630 #endif
 631 }
 632 #elif defined (TARGET_ARM)
 633
 634 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 635    whatever the target description contains.  Due to a historical mishap
 636    the FPA registers appear in between core integer regs and the CPSR.
 637    We hack round this by giving the FPA regs zero size when talking to a
 638    newer gdb.  */
 639 #define NUM_CORE_REGS 26
 640 #define GDB_CORE_XML "arm-core.xml"
 641
 642 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 643 {
 644     if (n < 16) {
 645         /* Core integer register.  */
 646         GET_REG32(env->regs[n]);
 647     }
 648     if (n < 24) {
 649         /* FPA registers.  */
 650         if (gdb_has_xml)
 651             return 0;
 652         memset(mem_buf, 0, 12);
 653         return 12;
 654     }
 655     switch (n) {
 656     case 24:
 657         /* FPA status register.  */
 658         if (gdb_has_xml)
 659             return 0;
 660         GET_REG32(0);
 661     case 25:
 662         /* CPSR */
 663         GET_REG32(cpsr_read(env));
 664     }
 665     /* Unknown register.  */
 666     return 0;
 667 }
 668
 669 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 670 {
 671     uint32_t tmp;
 672
 673     tmp = ldl_p(mem_buf);
 674
 675     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 676        cause problems if we ever implement the Jazelle DBX extensions.  */
 677     if (n == 15)
 678         tmp &= ~1;
 679
 680     if (n < 16) {
 681         /* Core integer register.  */
 682         env->regs[n] = tmp;
 683         return 4;
 684     }
 685     if (n < 24) { /* 16-23 */
 686         /* FPA registers (ignored).  */
 687         if (gdb_has_xml)
 688             return 0;
 689         return 12;
 690     }
 691     switch (n) {
 692     case 24:
 693         /* FPA status register (ignored).  */
 694         if (gdb_has_xml)
 695             return 0;
 696         return 4;
 697     case 25:
 698         /* CPSR */
 699         cpsr_write (env, tmp, 0xffffffff);
 700         return 4;
 701     }
 702     /* Unknown register.  */
 703     return 0;
 704 }
 705
 706 #elif defined (TARGET_M68K)
 707
 708 #define NUM_CORE_REGS 18
 709
 710 #define GDB_CORE_XML "cf-core.xml"
 711
 712 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 713 {
 714     if (n < 8) {
 715         /* D0-D7 */
 716         GET_REG32(env->dregs[n]);
 717     } else if (n < 16) {
 718         /* A0-A7 */
 719         GET_REG32(env->aregs[n - 8]);
 720     } else {
 721         switch (n) {
 722         case 16: GET_REG32(env->sr);
 723         case 17: GET_REG32(env->pc);
 724         }
 725     }
 726     /* FP registers not included here because they vary between
 727        ColdFire and m68k.  Use XML bits for these.  */
 728     return 0;
 729 }
 730
 731 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 732 {
 733     uint32_t tmp;
 734
 735     tmp = ldl_p(mem_buf);
 736
 737     if (n < 8) {
 738         /* D0-D7 */
 739         env->dregs[n] = tmp;
 740     } else if (n < 8) {
 741         /* A0-A7 */
 742         env->aregs[n - 8] = tmp;
 743     } else {
 744         switch (n) {
 745         case 16: env->sr = tmp; break;
 746         case 17: env->pc = tmp; break;
 747         default: return 0;
 748         }
 749     }
 750     return 4;
 751 }
 752 #elif defined (TARGET_MIPS)
 753
 754 #define NUM_CORE_REGS 73
 755
 756 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 757 {
 758     if (n < 32) {
 759         GET_REGL(env->active_tc.gpr[n]);
 760     }
 761     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
 762         if (n >= 38 && n < 70) {
 763             if (env->CP0_Status & (1 << CP0St_FR))
 764                 GET_REGL(env->active_fpu.fpr[n - 38].d);
 765             else
 766                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
 767         }
 768         switch (n) {
 769         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
 770         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
 771         }
 772     }
 773     switch (n) {
 774     case 32: GET_REGL((int32_t)env->CP0_Status);
 775     case 33: GET_REGL(env->active_tc.LO[0]);
 776     case 34: GET_REGL(env->active_tc.HI[0]);
 777     case 35: GET_REGL(env->CP0_BadVAddr);
 778     case 36: GET_REGL((int32_t)env->CP0_Cause);
 779     case 37: GET_REGL(env->active_tc.PC);
 780     case 72: GET_REGL(0); /* fp */
 781     case 89: GET_REGL((int32_t)env->CP0_PRid);
 782     }
 783     if (n >= 73 && n <= 88) {
 784         /* 16 embedded regs.  */
 785         GET_REGL(0);
 786     }
 787
 788     return 0;
 789 }
 790
 791 /* convert MIPS rounding mode in FCR31 to IEEE library */
 792 static unsigned int ieee_rm[] =
 793   {
 794     float_round_nearest_even,
 795     float_round_to_zero,
 796     float_round_up,
 797     float_round_down
 798   };
 799 #define RESTORE_ROUNDING_MODE \
 800     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
 801
 802 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 803 {
 804     target_ulong tmp;
 805
 806     tmp = ldtul_p(mem_buf);
 807
 808     if (n < 32) {
 809         env->active_tc.gpr[n] = tmp;
 810         return sizeof(target_ulong);
 811     }
 812     if (env->CP0_Config1 & (1 << CP0C1_FP)
 813             && n >= 38 && n < 73) {
 814         if (n < 70) {
 815             if (env->CP0_Status & (1 << CP0St_FR))
 816               env->active_fpu.fpr[n - 38].d = tmp;
 817             else
 818               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
 819         }
 820         switch (n) {
 821         case 70:
 822             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
 823             /* set rounding mode */
 824             RESTORE_ROUNDING_MODE;
 825 #ifndef CONFIG_SOFTFLOAT
 826             /* no floating point exception for native float */
 827             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
 828 #endif
 829             break;
 830         case 71: env->active_fpu.fcr0 = tmp; break;
 831         }
 832         return sizeof(target_ulong);
 833     }
 834     switch (n) {
 835     case 32: env->CP0_Status = tmp; break;
 836     case 33: env->active_tc.LO[0] = tmp; break;
 837     case 34: env->active_tc.HI[0] = tmp; break;
 838     case 35: env->CP0_BadVAddr = tmp; break;
 839     case 36: env->CP0_Cause = tmp; break;
 840     case 37: env->active_tc.PC = tmp; break;
 841     case 72: /* fp, ignored */ break;
 842     default:
 843         if (n > 89)
 844             return 0;
 845         /* Other registers are readonly.  Ignore writes.  */
 846         break;
 847     }
 848
 849     return sizeof(target_ulong);
 850 }
 851 #elif defined (TARGET_SH4)
 852
 853 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
 854 /* FIXME: We should use XML for this.  */
 855
 856 #define NUM_CORE_REGS 59
 857
 858 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 859 {
 860     if (n < 8) {
 861         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
 862             GET_REGL(env->gregs[n + 16]);
 863         } else {
 864             GET_REGL(env->gregs[n]);
 865         }
 866     } else if (n < 16) {
 867         GET_REGL(env->gregs[n - 8]);
 868     } else if (n >= 25 && n < 41) {
 869         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
 870     } else if (n >= 43 && n < 51) {
 871         GET_REGL(env->gregs[n - 43]);
 872     } else if (n >= 51 && n < 59) {
 873         GET_REGL(env->gregs[n - (51 - 16)]);
 874     }
 875     switch (n) {
 876     case 16: GET_REGL(env->pc);
 877     case 17: GET_REGL(env->pr);
 878     case 18: GET_REGL(env->gbr);
 879     case 19: GET_REGL(env->vbr);
 880     case 20: GET_REGL(env->mach);
 881     case 21: GET_REGL(env->macl);
 882     case 22: GET_REGL(env->sr);
 883     case 23: GET_REGL(env->fpul);
 884     case 24: GET_REGL(env->fpscr);
 885     case 41: GET_REGL(env->ssr);
 886     case 42: GET_REGL(env->spc);
 887     }
 888
 889     return 0;
 890 }
 891
 892 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 893 {
 894     uint32_t tmp;
 895
 896     tmp = ldl_p(mem_buf);
 897
 898     if (n < 8) {
 899         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
 900             env->gregs[n + 16] = tmp;
 901         } else {
 902             env->gregs[n] = tmp;
 903         }
 904         return 4;
 905     } else if (n < 16) {
 906         env->gregs[n - 8] = tmp;
 907         return 4;
 908     } else if (n >= 25 && n < 41) {
 909         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
 910     } else if (n >= 43 && n < 51) {
 911         env->gregs[n - 43] = tmp;
 912         return 4;
 913     } else if (n >= 51 && n < 59) {
 914         env->gregs[n - (51 - 16)] = tmp;
 915         return 4;
 916     }
 917     switch (n) {
 918     case 16: env->pc = tmp;
 919     case 17: env->pr = tmp;
 920     case 18: env->gbr = tmp;
 921     case 19: env->vbr = tmp;
 922     case 20: env->mach = tmp;
 923     case 21: env->macl = tmp;
 924     case 22: env->sr = tmp;
 925     case 23: env->fpul = tmp;
 926     case 24: env->fpscr = tmp;
 927     case 41: env->ssr = tmp;
 928     case 42: env->spc = tmp;
 929     default: return 0;
 930     }
 931
 932     return 4;
 933 }
 934 #elif defined (TARGET_CRIS)
 935
 936 #define NUM_CORE_REGS 49
 937
 938 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 939 {
 940     uint8_t srs;
 941
 942     srs = env->pregs[PR_SRS];
 943     if (n < 16) {
 944         GET_REG32(env->regs[n]);
 945     }
 946
 947     if (n >= 21 && n < 32) {
 948         GET_REG32(env->pregs[n - 16]);
 949     }
 950     if (n >= 33 && n < 49) {
 951         GET_REG32(env->sregs[srs][n - 33]);
 952     }
 953     switch (n) {
 954     case 16: GET_REG8(env->pregs[0]);
 955     case 17: GET_REG8(env->pregs[1]);
 956     case 18: GET_REG32(env->pregs[2]);
 957     case 19: GET_REG8(srs);
 958     case 20: GET_REG16(env->pregs[4]);
 959     case 32: GET_REG32(env->pc);
 960     }
 961
 962     return 0;
 963 }
 964
 965 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 966 {
 967     uint32_t tmp;
 968
 969     if (n > 49)
 970         return 0;
 971
 972     tmp = ldl_p(mem_buf);
 973
 974     if (n < 16) {
 975         env->regs[n] = tmp;
 976     }
 977
 978     if (n >= 21 && n < 32) {
 979         env->pregs[n - 16] = tmp;
 980     }
 981
 982     /* FIXME: Should support function regs be writable?  */
 983     switch (n) {
 984     case 16: return 1;
 985     case 17: return 1;
 986     case 18: env->pregs[PR_PID] = tmp; break;
 987     case 19: return 1;
 988     case 20: return 2;
 989     case 32: env->pc = tmp; break;
 990     }
 991
 992     return 4;
 993 }
 994 #else
 995
 996 #define NUM_CORE_REGS 0
 997
 998 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 999 {
1000     return 0;
1001 }
1002
1003 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1004 {
1005     return 0;
1006 }
1007
1008 #endif
1009
1010 static int num_g_regs = NUM_CORE_REGS;
1011
1012 #ifdef GDB_CORE_XML
1013 /* Encode data using the encoding for 'x' packets.  */
1014 static int memtox(char *buf, const char *mem, int len)
1015 {
1016     char *p = buf;
1017     char c;
1018
1019     while (len--) {
1020         c = *(mem++);
1021         switch (c) {
1022         case '#': case '$': case '*': case '}':
1023             *(p++) = '}';
1024             *(p++) = c ^ 0x20;
1025             break;
1026         default:
1027             *(p++) = c;
1028             break;
1029         }
1030     }
1031     return p - buf;
1032 }
1033
1034 const char *get_feature_xml(const char *p, const char **newp)
1035 {
1036     extern const char *const xml_builtin[][2];
1037     size_t len;
1038     int i;
1039     const char *name;
1040     static char target_xml[1024];
1041
1042     len = 0;
1043     while (p[len] && p[len] != ':')
1044         len++;
1045     *newp = p + len;
1046
1047     name = NULL;
1048     if (strncmp(p, "target.xml", len) == 0) {
1049         /* Generate the XML description for this CPU.  */
1050         if (!target_xml[0]) {
1051             GDBRegisterState *r;
1052
1053             snprintf(target_xml, sizeof(target_xml),
1054                      "<?xml version=\"1.0\"?>"
1055                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1056                      "<target>"
1057                      "<xi:include href=\"%s\"/>",
1058                      GDB_CORE_XML);
1059
1060             for (r = first_cpu->gdb_regs; r; r = r->next) {
1061                 strcat(target_xml, "<xi:include href=\"");
1062                 strcat(target_xml, r->xml);
1063                 strcat(target_xml, "\"/>");
1064             }
1065             strcat(target_xml, "</target>");
1066         }
1067         return target_xml;
1068     }
1069     for (i = 0; ; i++) {
1070         name = xml_builtin[i][0];
1071         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1072             break;
1073     }
1074     return name ? xml_builtin[i][1] : NULL;
1075 }
1076 #endif
1077
1078 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1079 {
1080     GDBRegisterState *r;
1081
1082     if (reg < NUM_CORE_REGS)
1083         return cpu_gdb_read_register(env, mem_buf, reg);
1084
1085     for (r = env->gdb_regs; r; r = r->next) {
1086         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1087             return r->get_reg(env, mem_buf, reg - r->base_reg);
1088         }
1089     }
1090     return 0;
1091 }
1092
1093 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1094 {
1095     GDBRegisterState *r;
1096
1097     if (reg < NUM_CORE_REGS)
1098         return cpu_gdb_write_register(env, mem_buf, reg);
1099
1100     for (r = env->gdb_regs; r; r = r->next) {
1101         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1102             return r->set_reg(env, mem_buf, reg - r->base_reg);
1103         }
1104     }
1105     return 0;
1106 }
1107
1108 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1109    specifies the first register number and these registers are included in
1110    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1111    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1112  */
1113
1114 void gdb_register_coprocessor(CPUState * env,
1115                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1116                              int num_regs, const char *xml, int g_pos)
1117 {
1118     GDBRegisterState *s;
1119     GDBRegisterState **p;
1120     static int last_reg = NUM_CORE_REGS;
1121
1122     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1123     s->base_reg = last_reg;
1124     s->num_regs = num_regs;
1125     s->get_reg = get_reg;
1126     s->set_reg = set_reg;
1127     s->xml = xml;
1128     p = &env->gdb_regs;
1129     while (*p) {
1130         /* Check for duplicates.  */
1131         if (strcmp((*p)->xml, xml) == 0)
1132             return;
1133         p = &(*p)->next;
1134     }
1135     /* Add to end of list.  */
1136     last_reg += num_regs;
1137     *p = s;
1138     if (g_pos) {
1139         if (g_pos != s->base_reg) {
1140             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1141                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1142         } else {
1143             num_g_regs = last_reg;
1144         }
1145     }
1146 }
1147
1148 /* GDB breakpoint/watchpoint types */
1149 #define GDB_BREAKPOINT_SW        0
1150 #define GDB_BREAKPOINT_HW        1
1151 #define GDB_WATCHPOINT_WRITE     2
1152 #define GDB_WATCHPOINT_READ      3
1153 #define GDB_WATCHPOINT_ACCESS    4
1154
1155 #ifndef CONFIG_USER_ONLY
1156 static const int xlat_gdb_type[] = {
1157     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1158     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1159     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1160 };
1161 #endif
1162
1163 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1164 {
1165     CPUState *env;
1166     int err = 0;
1167
1168     switch (type) {
1169     case GDB_BREAKPOINT_SW:
1170     case GDB_BREAKPOINT_HW:
1171         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1172             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1173             if (err)
1174                 break;
1175         }
1176         return err;
1177 #ifndef CONFIG_USER_ONLY
1178     case GDB_WATCHPOINT_WRITE:
1179     case GDB_WATCHPOINT_READ:
1180     case GDB_WATCHPOINT_ACCESS:
1181         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1182             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1183                                         NULL);
1184             if (err)
1185                 break;
1186         }
1187         return err;
1188 #endif
1189     default:
1190         return -ENOSYS;
1191     }
1192 }
1193
1194 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1195 {
1196     CPUState *env;
1197     int err = 0;
1198
1199     switch (type) {
1200     case GDB_BREAKPOINT_SW:
1201     case GDB_BREAKPOINT_HW:
1202         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1203             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1204             if (err)
1205                 break;
1206         }
1207         return err;
1208 #ifndef CONFIG_USER_ONLY
1209     case GDB_WATCHPOINT_WRITE:
1210     case GDB_WATCHPOINT_READ:
1211     case GDB_WATCHPOINT_ACCESS:
1212         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1213             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1214             if (err)
1215                 break;
1216         }
1217         return err;
1218 #endif
1219     default:
1220         return -ENOSYS;
1221     }
1222 }
1223
1224 static void gdb_breakpoint_remove_all(void)
1225 {
1226     CPUState *env;
1227
1228     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1229         cpu_breakpoint_remove_all(env, BP_GDB);
1230 #ifndef CONFIG_USER_ONLY
1231         cpu_watchpoint_remove_all(env, BP_GDB);
1232 #endif
1233     }
1234 }
1235
1236 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1237 {
1238     CPUState *env;
1239     const char *p;
1240     int ch, reg_size, type, res, thread;
1241     char buf[MAX_PACKET_LENGTH];
1242     uint8_t mem_buf[MAX_PACKET_LENGTH];
1243     uint8_t *registers;
1244     target_ulong addr, len;
1245
1246 #ifdef DEBUG_GDB
1247     printf("command='%s'\n", line_buf);
1248 #endif
1249     p = line_buf;
1250     ch = *p++;
1251     switch(ch) {
1252     case '?':
1253         /* TODO: Make this return the correct value for user-mode.  */
1254         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", SIGTRAP,
1255                  s->c_cpu->cpu_index+1);
1256         put_packet(s, buf);
1257         /* Remove all the breakpoints when this query is issued,
1258          * because gdb is doing and initial connect and the state
1259          * should be cleaned up.
1260          */
1261         gdb_breakpoint_remove_all();
1262         break;
1263     case 'c':
1264         if (*p != '\0') {
1265             addr = strtoull(p, (char **)&p, 16);
1266 #if defined(TARGET_I386)
1267             s->c_cpu->eip = addr;
1268             kvm_load_registers(s->c_cpu);
1269 #elif defined (TARGET_PPC)
1270             s->c_cpu->nip = addr;
1271             kvm_load_registers(s->c_cpu);
1272 #elif defined (TARGET_SPARC)
1273             s->c_cpu->pc = addr;
1274             s->c_cpu->npc = addr + 4;
1275 #elif defined (TARGET_ARM)
1276             s->c_cpu->regs[15] = addr;
1277 #elif defined (TARGET_SH4)
1278             s->c_cpu->pc = addr;
1279 #elif defined (TARGET_MIPS)
1280             s->c_cpu->active_tc.PC = addr;
1281 #elif defined (TARGET_CRIS)
1282             s->c_cpu->pc = addr;
1283 #endif
1284         }
1285         gdb_continue(s);
1286         return RS_IDLE;
1287     case 'C':
1288         s->signal = strtoul(p, (char **)&p, 16);
1289         gdb_continue(s);
1290         return RS_IDLE;
1291     case 'k':
1292         /* Kill the target */
1293         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1294         exit(0);
1295     case 'D':
1296         /* Detach packet */
1297         gdb_breakpoint_remove_all();
1298         gdb_continue(s);
1299         put_packet(s, "OK");
1300         break;
1301     case 's':
1302         if (*p != '\0') {
1303             addr = strtoull(p, (char **)&p, 16);
1304 #if defined(TARGET_I386)
1305             s->c_cpu->eip = addr;
1306             kvm_load_registers(s->c_cpu);
1307 #elif defined (TARGET_PPC)
1308             s->c_cpu->nip = addr;
1309             kvm_load_registers(s->c_cpu);
1310 #elif defined (TARGET_SPARC)
1311             s->c_cpu->pc = addr;
1312             s->c_cpu->npc = addr + 4;
1313 #elif defined (TARGET_ARM)
1314             s->c_cpu->regs[15] = addr;
1315 #elif defined (TARGET_SH4)
1316             s->c_cpu->pc = addr;
1317 #elif defined (TARGET_MIPS)
1318             s->c_cpu->active_tc.PC = addr;
1319 #elif defined (TARGET_CRIS)
1320             s->c_cpu->pc = addr;
1321 #endif
1322         }
1323         cpu_single_step(s->c_cpu, sstep_flags);
1324         gdb_continue(s);
1325         return RS_IDLE;
1326     case 'F':
1327         {
1328             target_ulong ret;
1329             target_ulong err;
1330
1331             ret = strtoull(p, (char **)&p, 16);
1332             if (*p == ',') {
1333                 p++;
1334                 err = strtoull(p, (char **)&p, 16);
1335             } else {
1336                 err = 0;
1337             }
1338             if (*p == ',')
1339                 p++;
1340             type = *p;
1341             if (gdb_current_syscall_cb)
1342                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1343             if (type == 'C') {
1344                 put_packet(s, "T02");
1345             } else {
1346                 gdb_continue(s);
1347             }
1348         }
1349         break;
1350     case 'g':
1351         kvm_save_registers(env);
1352         len = 0;
1353         for (addr = 0; addr < num_g_regs; addr++) {
1354             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1355             len += reg_size;
1356         }
1357         memtohex(buf, mem_buf, len);
1358         put_packet(s, buf);
1359         break;
1360     case 'G':
1361         registers = mem_buf;
1362         len = strlen(p) / 2;
1363         hextomem((uint8_t *)registers, p, len);
1364         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1365             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1366             len -= reg_size;
1367             registers += reg_size;
1368         }
1369         kvm_load_registers(env);
1370         put_packet(s, "OK");
1371         break;
1372     case 'm':
1373         addr = strtoull(p, (char **)&p, 16);
1374         if (*p == ',')
1375             p++;
1376         len = strtoull(p, NULL, 16);
1377         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1378             put_packet (s, "E14");
1379         } else {
1380             memtohex(buf, mem_buf, len);
1381             put_packet(s, buf);
1382         }
1383         break;
1384     case 'M':
1385         addr = strtoull(p, (char **)&p, 16);
1386         if (*p == ',')
1387             p++;
1388         len = strtoull(p, (char **)&p, 16);
1389         if (*p == ':')
1390             p++;
1391         hextomem(mem_buf, p, len);
1392         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1393             put_packet(s, "E14");
1394         else
1395             put_packet(s, "OK");
1396         break;
1397     case 'p':
1398         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1399            This works, but can be very slow.  Anything new enough to
1400            understand XML also knows how to use this properly.  */
1401         if (!gdb_has_xml)
1402             goto unknown_command;
1403         addr = strtoull(p, (char **)&p, 16);
1404         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1405         if (reg_size) {
1406             memtohex(buf, mem_buf, reg_size);
1407             put_packet(s, buf);
1408         } else {
1409             put_packet(s, "E14");
1410         }
1411         break;
1412     case 'P':
1413         if (!gdb_has_xml)
1414             goto unknown_command;
1415         addr = strtoull(p, (char **)&p, 16);
1416         if (*p == '=')
1417             p++;
1418         reg_size = strlen(p) / 2;
1419         hextomem(mem_buf, p, reg_size);
1420         gdb_write_register(s->g_cpu, mem_buf, addr);
1421         put_packet(s, "OK");
1422         break;
1423     case 'Z':
1424     case 'z':
1425         type = strtoul(p, (char **)&p, 16);
1426         if (*p == ',')
1427             p++;
1428         addr = strtoull(p, (char **)&p, 16);
1429         if (*p == ',')
1430             p++;
1431         len = strtoull(p, (char **)&p, 16);
1432         if (ch == 'Z')
1433             res = gdb_breakpoint_insert(addr, len, type);
1434         else
1435             res = gdb_breakpoint_remove(addr, len, type);
1436         if (res >= 0)
1437              put_packet(s, "OK");
1438         else if (res == -ENOSYS)
1439             put_packet(s, "");
1440         else
1441             put_packet(s, "E22");
1442         break;
1443     case 'H':
1444         type = *p++;
1445         thread = strtoull(p, (char **)&p, 16);
1446         if (thread == -1 || thread == 0) {
1447             put_packet(s, "OK");
1448             break;
1449         }
1450         for (env = first_cpu; env != NULL; env = env->next_cpu)
1451             if (env->cpu_index + 1 == thread)
1452                 break;
1453         if (env == NULL) {
1454             put_packet(s, "E22");
1455             break;
1456         }
1457         switch (type) {
1458         case 'c':
1459             s->c_cpu = env;
1460             put_packet(s, "OK");
1461             break;
1462         case 'g':
1463             s->g_cpu = env;
1464             put_packet(s, "OK");
1465             break;
1466         default:
1467              put_packet(s, "E22");
1468              break;
1469         }
1470         break;
1471     case 'T':
1472         thread = strtoull(p, (char **)&p, 16);
1473 #ifndef CONFIG_USER_ONLY
1474         if (thread > 0 && thread < smp_cpus + 1)
1475 #else
1476         if (thread == 1)
1477 #endif
1478              put_packet(s, "OK");
1479         else
1480             put_packet(s, "E22");
1481         break;
1482     case 'q':
1483     case 'Q':
1484         /* parse any 'q' packets here */
1485         if (!strcmp(p,"qemu.sstepbits")) {
1486             /* Query Breakpoint bit definitions */
1487             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1488                      SSTEP_ENABLE,
1489                      SSTEP_NOIRQ,
1490                      SSTEP_NOTIMER);
1491             put_packet(s, buf);
1492             break;
1493         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1494             /* Display or change the sstep_flags */
1495             p += 10;
1496             if (*p != '=') {
1497                 /* Display current setting */
1498                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1499                 put_packet(s, buf);
1500                 break;
1501             }
1502             p++;
1503             type = strtoul(p, (char **)&p, 16);
1504             sstep_flags = type;
1505             put_packet(s, "OK");
1506             break;
1507         } else if (strcmp(p,"C") == 0) {
1508             /* "Current thread" remains vague in the spec, so always return
1509              *  the first CPU (gdb returns the first thread). */
1510             put_packet(s, "QC1");
1511             break;
1512         } else if (strcmp(p,"fThreadInfo") == 0) {
1513             s->query_cpu = first_cpu;
1514             goto report_cpuinfo;
1515         } else if (strcmp(p,"sThreadInfo") == 0) {
1516         report_cpuinfo:
1517             if (s->query_cpu) {
1518                 snprintf(buf, sizeof(buf), "m%x", s->query_cpu->cpu_index+1);
1519                 put_packet(s, buf);
1520                 s->query_cpu = s->query_cpu->next_cpu;
1521             } else
1522                 put_packet(s, "l");
1523             break;
1524         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1525             thread = strtoull(p+16, (char **)&p, 16);
1526             for (env = first_cpu; env != NULL; env = env->next_cpu)
1527                 if (env->cpu_index + 1 == thread) {
1528                     len = snprintf((char *)mem_buf, sizeof(mem_buf),
1529                                    "CPU#%d [%s]", env->cpu_index,
1530                                    env->halted ? "halted " : "running");
1531                     memtohex(buf, mem_buf, len);
1532                     put_packet(s, buf);
1533                     break;
1534                 }
1535             break;
1536         }
1537 #ifdef CONFIG_LINUX_USER
1538         else if (strncmp(p, "Offsets", 7) == 0) {
1539             TaskState *ts = s->c_cpu->opaque;
1540
1541             snprintf(buf, sizeof(buf),
1542                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1543                      ";Bss=" TARGET_ABI_FMT_lx,
1544                      ts->info->code_offset,
1545                      ts->info->data_offset,
1546                      ts->info->data_offset);
1547             put_packet(s, buf);
1548             break;
1549         }
1550 #endif
1551         if (strncmp(p, "Supported", 9) == 0) {
1552             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1553 #ifdef GDB_CORE_XML
1554             strcat(buf, ";qXfer:features:read+");
1555 #endif
1556             put_packet(s, buf);
1557             break;
1558         }
1559 #ifdef GDB_CORE_XML
1560         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1561             const char *xml;
1562             target_ulong total_len;
1563
1564             gdb_has_xml = 1;
1565             p += 19;
1566             xml = get_feature_xml(p, &p);
1567             if (!xml) {
1568                 snprintf(buf, sizeof(buf), "E00");
1569                 put_packet(s, buf);
1570                 break;
1571             }
1572
1573             if (*p == ':')
1574                 p++;
1575             addr = strtoul(p, (char **)&p, 16);
1576             if (*p == ',')
1577                 p++;
1578             len = strtoul(p, (char **)&p, 16);
1579
1580             total_len = strlen(xml);
1581             if (addr > total_len) {
1582                 snprintf(buf, sizeof(buf), "E00");
1583                 put_packet(s, buf);
1584                 break;
1585             }
1586             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1587                 len = (MAX_PACKET_LENGTH - 5) / 2;
1588             if (len < total_len - addr) {
1589                 buf[0] = 'm';
1590                 len = memtox(buf + 1, xml + addr, len);
1591             } else {
1592                 buf[0] = 'l';
1593                 len = memtox(buf + 1, xml + addr, total_len - addr);
1594             }
1595             put_packet_binary(s, buf, len + 1);
1596             break;
1597         }
1598 #endif
1599         /* Unrecognised 'q' command.  */
1600         goto unknown_command;
1601
1602     default:
1603     unknown_command:
1604         /* put empty packet */
1605         buf[0] = '\0';
1606         put_packet(s, buf);
1607         break;
1608     }
1609     return RS_IDLE;
1610 }
1611
1612 extern void tb_flush(CPUState *env);
1613
1614 void gdb_set_stop_cpu(CPUState *env)
1615 {
1616     gdbserver_state->c_cpu = env;
1617     gdbserver_state->g_cpu = env;
1618 }
1619
1620 #ifndef CONFIG_USER_ONLY
1621 static void gdb_vm_stopped(void *opaque, int reason)
1622 {
1623     GDBState *s = gdbserver_state;
1624     CPUState *env = s->c_cpu;
1625     char buf[256];
1626     const char *type;
1627     int ret;
1628
1629     if (s->state == RS_SYSCALL)
1630         return;
1631
1632     /* disable single step if it was enable */
1633     cpu_single_step(env, 0);
1634
1635     if (reason == EXCP_DEBUG) {
1636         if (env->watchpoint_hit) {
1637             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
1638             case BP_MEM_READ:
1639                 type = "r";
1640                 break;
1641             case BP_MEM_ACCESS:
1642                 type = "a";
1643                 break;
1644             default:
1645                 type = "";
1646                 break;
1647             }
1648             snprintf(buf, sizeof(buf),
1649                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1650                      SIGTRAP, env->cpu_index+1, type,
1651                      env->watchpoint_hit->vaddr);
1652             put_packet(s, buf);
1653             env->watchpoint_hit = NULL;
1654             return;
1655         }
1656         tb_flush(env);
1657         ret = SIGTRAP;
1658     } else if (reason == EXCP_INTERRUPT) {
1659         ret = SIGINT;
1660     } else {
1661         ret = 0;
1662     }
1663     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, env->cpu_index+1);
1664     put_packet(s, buf);
1665 }
1666 #endif
1667
1668 /* Send a gdb syscall request.
1669    This accepts limited printf-style format specifiers, specifically:
1670     %x  - target_ulong argument printed in hex.
1671     %lx - 64-bit argument printed in hex.
1672     %s  - string pointer (target_ulong) and length (int) pair.  */
1673 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1674 {
1675     va_list va;
1676     char buf[256];
1677     char *p;
1678     target_ulong addr;
1679     uint64_t i64;
1680     GDBState *s;
1681
1682     s = gdbserver_state;
1683     if (!s)
1684         return;
1685     gdb_current_syscall_cb = cb;
1686     s->state = RS_SYSCALL;
1687 #ifndef CONFIG_USER_ONLY
1688     vm_stop(EXCP_DEBUG);
1689 #endif
1690     s->state = RS_IDLE;
1691     va_start(va, fmt);
1692     p = buf;
1693     *(p++) = 'F';
1694     while (*fmt) {
1695         if (*fmt == '%') {
1696             fmt++;
1697             switch (*fmt++) {
1698             case 'x':
1699                 addr = va_arg(va, target_ulong);
1700                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
1701                 break;
1702             case 'l':
1703                 if (*(fmt++) != 'x')
1704                     goto bad_format;
1705                 i64 = va_arg(va, uint64_t);
1706                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
1707                 break;
1708             case 's':
1709                 addr = va_arg(va, target_ulong);
1710                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
1711                               addr, va_arg(va, int));
1712                 break;
1713             default:
1714             bad_format:
1715                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
1716                         fmt - 1);
1717                 break;
1718             }
1719         } else {
1720             *(p++) = *(fmt++);
1721         }
1722     }
1723     *p = 0;
1724     va_end(va);
1725     put_packet(s, buf);
1726 #ifdef CONFIG_USER_ONLY
1727     gdb_handlesig(s->c_cpu, 0);
1728 #else
1729     cpu_interrupt(s->c_cpu, CPU_INTERRUPT_EXIT);
1730 #endif
1731 }
1732
1733 static void gdb_read_byte(GDBState *s, int ch)
1734 {
1735     int i, csum;
1736     uint8_t reply;
1737
1738 #ifndef CONFIG_USER_ONLY
1739     if (s->last_packet_len) {
1740         /* Waiting for a response to the last packet.  If we see the start
1741            of a new command then abandon the previous response.  */
1742         if (ch == '-') {
1743 #ifdef DEBUG_GDB
1744             printf("Got NACK, retransmitting\n");
1745 #endif
1746             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
1747         }
1748 #ifdef DEBUG_GDB
1749         else if (ch == '+')
1750             printf("Got ACK\n");
1751         else
1752             printf("Got '%c' when expecting ACK/NACK\n", ch);
1753 #endif
1754         if (ch == '+' || ch == '$')
1755             s->last_packet_len = 0;
1756         if (ch != '$')
1757             return;
1758     }
1759     if (vm_running) {
1760         /* when the CPU is running, we cannot do anything except stop
1761            it when receiving a char */
1762         vm_stop(EXCP_INTERRUPT);
1763     } else
1764 #endif
1765     {
1766         switch(s->state) {
1767         case RS_IDLE:
1768             if (ch == '$') {
1769                 s->line_buf_index = 0;
1770                 s->state = RS_GETLINE;
1771             }
1772             break;
1773         case RS_GETLINE:
1774             if (ch == '#') {
1775             s->state = RS_CHKSUM1;
1776             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1777                 s->state = RS_IDLE;
1778             } else {
1779             s->line_buf[s->line_buf_index++] = ch;
1780             }
1781             break;
1782         case RS_CHKSUM1:
1783             s->line_buf[s->line_buf_index] = '\0';
1784             s->line_csum = fromhex(ch) << 4;
1785             s->state = RS_CHKSUM2;
1786             break;
1787         case RS_CHKSUM2:
1788             s->line_csum |= fromhex(ch);
1789             csum = 0;
1790             for(i = 0; i < s->line_buf_index; i++) {
1791                 csum += s->line_buf[i];
1792             }
1793             if (s->line_csum != (csum & 0xff)) {
1794                 reply = '-';
1795                 put_buffer(s, &reply, 1);
1796                 s->state = RS_IDLE;
1797             } else {
1798                 reply = '+';
1799                 put_buffer(s, &reply, 1);
1800                 s->state = gdb_handle_packet(s, s->line_buf);
1801             }
1802             break;
1803         default:
1804             abort();
1805         }
1806     }
1807 }
1808
1809 #ifdef CONFIG_USER_ONLY
1810 int
1811 gdb_handlesig (CPUState *env, int sig)
1812 {
1813   GDBState *s;
1814   char buf[256];
1815   int n;
1816
1817   s = gdbserver_state;
1818   if (gdbserver_fd < 0 || s->fd < 0)
1819     return sig;
1820
1821   /* disable single step if it was enabled */
1822   cpu_single_step(env, 0);
1823   tb_flush(env);
1824
1825   if (sig != 0)
1826     {
1827       snprintf(buf, sizeof(buf), "S%02x", sig);
1828       put_packet(s, buf);
1829     }
1830   /* put_packet() might have detected that the peer terminated the
1831      connection.  */
1832   if (s->fd < 0)
1833       return sig;
1834
1835   sig = 0;
1836   s->state = RS_IDLE;
1837   s->running_state = 0;
1838   while (s->running_state == 0) {
1839       n = read (s->fd, buf, 256);
1840       if (n > 0)
1841         {
1842           int i;
1843
1844           for (i = 0; i < n; i++)
1845             gdb_read_byte (s, buf[i]);
1846         }
1847       else if (n == 0 || errno != EAGAIN)
1848         {
1849           /* XXX: Connection closed.  Should probably wait for annother
1850              connection before continuing.  */
1851           return sig;
1852         }
1853   }
1854   sig = s->signal;
1855   s->signal = 0;
1856   return sig;
1857 }
1858
1859 /* Tell the remote gdb that the process has exited.  */
1860 void gdb_exit(CPUState *env, int code)
1861 {
1862   GDBState *s;
1863   char buf[4];
1864
1865   s = gdbserver_state;
1866   if (gdbserver_fd < 0 || s->fd < 0)
1867     return;
1868
1869   snprintf(buf, sizeof(buf), "W%02x", code);
1870   put_packet(s, buf);
1871 }
1872
1873
1874 static void gdb_accept(void)
1875 {
1876     GDBState *s;
1877     struct sockaddr_in sockaddr;
1878     socklen_t len;
1879     int val, fd;
1880
1881     for(;;) {
1882         len = sizeof(sockaddr);
1883         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
1884         if (fd < 0 && errno != EINTR) {
1885             perror("accept");
1886             return;
1887         } else if (fd >= 0) {
1888             break;
1889         }
1890     }
1891
1892     /* set short latency */
1893     val = 1;
1894     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
1895
1896     s = qemu_mallocz(sizeof(GDBState));
1897     if (!s) {
1898         errno = ENOMEM;
1899         perror("accept");
1900         return;
1901     }
1902
1903     memset (s, 0, sizeof (GDBState));
1904     s->c_cpu = first_cpu;
1905     s->g_cpu = first_cpu;
1906     s->fd = fd;
1907     gdb_has_xml = 0;
1908
1909     gdbserver_state = s;
1910
1911     fcntl(fd, F_SETFL, O_NONBLOCK);
1912 }
1913
1914 static int gdbserver_open(int port)
1915 {
1916     struct sockaddr_in sockaddr;
1917     int fd, val, ret;
1918
1919     fd = socket(PF_INET, SOCK_STREAM, 0);
1920     if (fd < 0) {
1921         perror("socket");
1922         return -1;
1923     }
1924
1925     /* allow fast reuse */
1926     val = 1;
1927     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
1928
1929     sockaddr.sin_family = AF_INET;
1930     sockaddr.sin_port = htons(port);
1931     sockaddr.sin_addr.s_addr = 0;
1932     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
1933     if (ret < 0) {
1934         perror("bind");
1935         return -1;
1936     }
1937     ret = listen(fd, 0);
1938     if (ret < 0) {
1939         perror("listen");
1940         return -1;
1941     }
1942     return fd;
1943 }
1944
1945 int gdbserver_start(int port)
1946 {
1947     gdbserver_fd = gdbserver_open(port);
1948     if (gdbserver_fd < 0)
1949         return -1;
1950     /* accept connections */
1951     gdb_accept();
1952     return 0;
1953 }
1954 #else
1955 static int gdb_chr_can_receive(void *opaque)
1956 {
1957   /* We can handle an arbitrarily large amount of data.
1958    Pick the maximum packet size, which is as good as anything.  */
1959   return MAX_PACKET_LENGTH;
1960 }
1961
1962 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
1963 {
1964     int i;
1965
1966     for (i = 0; i < size; i++) {
1967         gdb_read_byte(gdbserver_state, buf[i]);
1968     }
1969 }
1970
1971 static void gdb_chr_event(void *opaque, int event)
1972 {
1973     switch (event) {
1974     case CHR_EVENT_RESET:
1975         vm_stop(EXCP_INTERRUPT);
1976         gdb_has_xml = 0;
1977         break;
1978     default:
1979         break;
1980     }
1981 }
1982
1983 int gdbserver_start(const char *port)
1984 {
1985     GDBState *s;
1986     char gdbstub_port_name[128];
1987     int port_num;
1988     char *p;
1989     CharDriverState *chr;
1990
1991     if (!port || !*port)
1992       return -1;
1993
1994     port_num = strtol(port, &p, 10);
1995     if (*p == 0) {
1996         /* A numeric value is interpreted as a port number.  */
1997         snprintf(gdbstub_port_name, sizeof(gdbstub_port_name),
1998                  "tcp::%d,nowait,nodelay,server", port_num);
1999         port = gdbstub_port_name;
2000     }
2001
2002     chr = qemu_chr_open("gdb", port);
2003     if (!chr)
2004         return -1;
2005
2006     s = qemu_mallocz(sizeof(GDBState));
2007     if (!s) {
2008         return -1;
2009     }
2010     s->c_cpu = first_cpu;
2011     s->g_cpu = first_cpu;
2012     s->chr = chr;
2013     gdbserver_state = s;
2014     qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2015                           gdb_chr_event, NULL);
2016     qemu_add_vm_stop_handler(gdb_vm_stopped, NULL);
2017     return 0;
2018 }
2019 #endif