gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA  02110-1301 USA
  19  */
  20 #include "config.h"
  21 #include "qemu-common.h"
  22 #ifdef CONFIG_USER_ONLY
  23 #include <stdlib.h>
  24 #include <stdio.h>
  25 #include <stdarg.h>
  26 #include <string.h>
  27 #include <errno.h>
  28 #include <unistd.h>
  29 #include <fcntl.h>
  30
  31 #include "qemu.h"
  32 #else
  33 #include "monitor.h"
  34 #include "qemu-char.h"
  35 #include "sysemu.h"
  36 #include "gdbstub.h"
  37 #endif
  38 #include "qemu-kvm.h"
  39
  40 #define MAX_PACKET_LENGTH 4096
  41
  42 #include "qemu_socket.h"
  43 #include "kvm.h"
  44
  45
  46 enum {
  47     GDB_SIGNAL_0 = 0,
  48     GDB_SIGNAL_INT = 2,
  49     GDB_SIGNAL_TRAP = 5,
  50     GDB_SIGNAL_UNKNOWN = 143
  51 };
  52
  53 #ifdef CONFIG_USER_ONLY
  54
  55 /* Map target signal numbers to GDB protocol signal numbers and vice
  56  * versa.  For user emulation's currently supported systems, we can
  57  * assume most signals are defined.
  58  */
  59
  60 static int gdb_signal_table[] = {
  61     0,
  62     TARGET_SIGHUP,
  63     TARGET_SIGINT,
  64     TARGET_SIGQUIT,
  65     TARGET_SIGILL,
  66     TARGET_SIGTRAP,
  67     TARGET_SIGABRT,
  68     -1, /* SIGEMT */
  69     TARGET_SIGFPE,
  70     TARGET_SIGKILL,
  71     TARGET_SIGBUS,
  72     TARGET_SIGSEGV,
  73     TARGET_SIGSYS,
  74     TARGET_SIGPIPE,
  75     TARGET_SIGALRM,
  76     TARGET_SIGTERM,
  77     TARGET_SIGURG,
  78     TARGET_SIGSTOP,
  79     TARGET_SIGTSTP,
  80     TARGET_SIGCONT,
  81     TARGET_SIGCHLD,
  82     TARGET_SIGTTIN,
  83     TARGET_SIGTTOU,
  84     TARGET_SIGIO,
  85     TARGET_SIGXCPU,
  86     TARGET_SIGXFSZ,
  87     TARGET_SIGVTALRM,
  88     TARGET_SIGPROF,
  89     TARGET_SIGWINCH,
  90     -1, /* SIGLOST */
  91     TARGET_SIGUSR1,
  92     TARGET_SIGUSR2,
  93 #ifdef TARGET_SIGPWR
  94     TARGET_SIGPWR,
  95 #else
  96     -1,
  97 #endif
  98     -1, /* SIGPOLL */
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108     -1,
 109     -1,
 110 #ifdef __SIGRTMIN
 111     __SIGRTMIN + 1,
 112     __SIGRTMIN + 2,
 113     __SIGRTMIN + 3,
 114     __SIGRTMIN + 4,
 115     __SIGRTMIN + 5,
 116     __SIGRTMIN + 6,
 117     __SIGRTMIN + 7,
 118     __SIGRTMIN + 8,
 119     __SIGRTMIN + 9,
 120     __SIGRTMIN + 10,
 121     __SIGRTMIN + 11,
 122     __SIGRTMIN + 12,
 123     __SIGRTMIN + 13,
 124     __SIGRTMIN + 14,
 125     __SIGRTMIN + 15,
 126     __SIGRTMIN + 16,
 127     __SIGRTMIN + 17,
 128     __SIGRTMIN + 18,
 129     __SIGRTMIN + 19,
 130     __SIGRTMIN + 20,
 131     __SIGRTMIN + 21,
 132     __SIGRTMIN + 22,
 133     __SIGRTMIN + 23,
 134     __SIGRTMIN + 24,
 135     __SIGRTMIN + 25,
 136     __SIGRTMIN + 26,
 137     __SIGRTMIN + 27,
 138     __SIGRTMIN + 28,
 139     __SIGRTMIN + 29,
 140     __SIGRTMIN + 30,
 141     __SIGRTMIN + 31,
 142     -1, /* SIGCANCEL */
 143     __SIGRTMIN,
 144     __SIGRTMIN + 32,
 145     __SIGRTMIN + 33,
 146     __SIGRTMIN + 34,
 147     __SIGRTMIN + 35,
 148     __SIGRTMIN + 36,
 149     __SIGRTMIN + 37,
 150     __SIGRTMIN + 38,
 151     __SIGRTMIN + 39,
 152     __SIGRTMIN + 40,
 153     __SIGRTMIN + 41,
 154     __SIGRTMIN + 42,
 155     __SIGRTMIN + 43,
 156     __SIGRTMIN + 44,
 157     __SIGRTMIN + 45,
 158     __SIGRTMIN + 46,
 159     __SIGRTMIN + 47,
 160     __SIGRTMIN + 48,
 161     __SIGRTMIN + 49,
 162     __SIGRTMIN + 50,
 163     __SIGRTMIN + 51,
 164     __SIGRTMIN + 52,
 165     __SIGRTMIN + 53,
 166     __SIGRTMIN + 54,
 167     __SIGRTMIN + 55,
 168     __SIGRTMIN + 56,
 169     __SIGRTMIN + 57,
 170     __SIGRTMIN + 58,
 171     __SIGRTMIN + 59,
 172     __SIGRTMIN + 60,
 173     __SIGRTMIN + 61,
 174     __SIGRTMIN + 62,
 175     __SIGRTMIN + 63,
 176     __SIGRTMIN + 64,
 177     __SIGRTMIN + 65,
 178     __SIGRTMIN + 66,
 179     __SIGRTMIN + 67,
 180     __SIGRTMIN + 68,
 181     __SIGRTMIN + 69,
 182     __SIGRTMIN + 70,
 183     __SIGRTMIN + 71,
 184     __SIGRTMIN + 72,
 185     __SIGRTMIN + 73,
 186     __SIGRTMIN + 74,
 187     __SIGRTMIN + 75,
 188     __SIGRTMIN + 76,
 189     __SIGRTMIN + 77,
 190     __SIGRTMIN + 78,
 191     __SIGRTMIN + 79,
 192     __SIGRTMIN + 80,
 193     __SIGRTMIN + 81,
 194     __SIGRTMIN + 82,
 195     __SIGRTMIN + 83,
 196     __SIGRTMIN + 84,
 197     __SIGRTMIN + 85,
 198     __SIGRTMIN + 86,
 199     __SIGRTMIN + 87,
 200     __SIGRTMIN + 88,
 201     __SIGRTMIN + 89,
 202     __SIGRTMIN + 90,
 203     __SIGRTMIN + 91,
 204     __SIGRTMIN + 92,
 205     __SIGRTMIN + 93,
 206     __SIGRTMIN + 94,
 207     __SIGRTMIN + 95,
 208     -1, /* SIGINFO */
 209     -1, /* UNKNOWN */
 210     -1, /* DEFAULT */
 211     -1,
 212     -1,
 213     -1,
 214     -1,
 215     -1,
 216     -1
 217 #endif
 218 };
 219 #else
 220 /* In system mode we only need SIGINT and SIGTRAP; other signals
 221    are not yet supported.  */
 222
 223 enum {
 224     TARGET_SIGINT = 2,
 225     TARGET_SIGTRAP = 5
 226 };
 227
 228 static int gdb_signal_table[] = {
 229     -1,
 230     -1,
 231     TARGET_SIGINT,
 232     -1,
 233     -1,
 234     TARGET_SIGTRAP
 235 };
 236 #endif
 237
 238 #ifdef CONFIG_USER_ONLY
 239 static int target_signal_to_gdb (int sig)
 240 {
 241     int i;
 242     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 243         if (gdb_signal_table[i] == sig)
 244             return i;
 245     return GDB_SIGNAL_UNKNOWN;
 246 }
 247 #endif
 248
 249 static int gdb_signal_to_target (int sig)
 250 {
 251     if (sig < ARRAY_SIZE (gdb_signal_table))
 252         return gdb_signal_table[sig];
 253     else
 254         return -1;
 255 }
 256
 257 //#define DEBUG_GDB
 258
 259 typedef struct GDBRegisterState {
 260     int base_reg;
 261     int num_regs;
 262     gdb_reg_cb get_reg;
 263     gdb_reg_cb set_reg;
 264     const char *xml;
 265     struct GDBRegisterState *next;
 266 } GDBRegisterState;
 267
 268 enum RSState {
 269     RS_INACTIVE,
 270     RS_IDLE,
 271     RS_GETLINE,
 272     RS_CHKSUM1,
 273     RS_CHKSUM2,
 274     RS_SYSCALL,
 275 };
 276 typedef struct GDBState {
 277     CPUState *c_cpu; /* current CPU for step/continue ops */
 278     CPUState *g_cpu; /* current CPU for other ops */
 279     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 280     enum RSState state; /* parsing state */
 281     char line_buf[MAX_PACKET_LENGTH];
 282     int line_buf_index;
 283     int line_csum;
 284     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 285     int last_packet_len;
 286     int signal;
 287 #ifdef CONFIG_USER_ONLY
 288     int fd;
 289     int running_state;
 290 #else
 291     CharDriverState *chr;
 292     CharDriverState *mon_chr;
 293 #endif
 294 } GDBState;
 295
 296 /* By default use no IRQs and no timers while single stepping so as to
 297  * make single stepping like an ICE HW step.
 298  */
 299 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 300
 301 static GDBState *gdbserver_state;
 302
 303 /* This is an ugly hack to cope with both new and old gdb.
 304    If gdb sends qXfer:features:read then assume we're talking to a newish
 305    gdb that understands target descriptions.  */
 306 static int gdb_has_xml;
 307
 308 #ifdef CONFIG_USER_ONLY
 309 /* XXX: This is not thread safe.  Do we care?  */
 310 static int gdbserver_fd = -1;
 311
 312 static int get_char(GDBState *s)
 313 {
 314     uint8_t ch;
 315     int ret;
 316
 317     for(;;) {
 318         ret = recv(s->fd, &ch, 1, 0);
 319         if (ret < 0) {
 320             if (errno == ECONNRESET)
 321                 s->fd = -1;
 322             if (errno != EINTR && errno != EAGAIN)
 323                 return -1;
 324         } else if (ret == 0) {
 325             close(s->fd);
 326             s->fd = -1;
 327             return -1;
 328         } else {
 329             break;
 330         }
 331     }
 332     return ch;
 333 }
 334 #endif
 335
 336 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 337
 338 static enum {
 339     GDB_SYS_UNKNOWN,
 340     GDB_SYS_ENABLED,
 341     GDB_SYS_DISABLED,
 342 } gdb_syscall_mode;
 343
 344 /* If gdb is connected when the first semihosting syscall occurs then use
 345    remote gdb syscalls.  Otherwise use native file IO.  */
 346 int use_gdb_syscalls(void)
 347 {
 348     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 349         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 350                                             : GDB_SYS_DISABLED);
 351     }
 352     return gdb_syscall_mode == GDB_SYS_ENABLED;
 353 }
 354
 355 /* Resume execution.  */
 356 static inline void gdb_continue(GDBState *s)
 357 {
 358 #ifdef CONFIG_USER_ONLY
 359     s->running_state = 1;
 360 #else
 361     vm_start();
 362 #endif
 363 }
 364
 365 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 366 {
 367 #ifdef CONFIG_USER_ONLY
 368     int ret;
 369
 370     while (len > 0) {
 371         ret = send(s->fd, buf, len, 0);
 372         if (ret < 0) {
 373             if (errno != EINTR && errno != EAGAIN)
 374                 return;
 375         } else {
 376             buf += ret;
 377             len -= ret;
 378         }
 379     }
 380 #else
 381     qemu_chr_write(s->chr, buf, len);
 382 #endif
 383 }
 384
 385 static inline int fromhex(int v)
 386 {
 387     if (v >= '0' && v <= '9')
 388         return v - '0';
 389     else if (v >= 'A' && v <= 'F')
 390         return v - 'A' + 10;
 391     else if (v >= 'a' && v <= 'f')
 392         return v - 'a' + 10;
 393     else
 394         return 0;
 395 }
 396
 397 static inline int tohex(int v)
 398 {
 399     if (v < 10)
 400         return v + '0';
 401     else
 402         return v - 10 + 'a';
 403 }
 404
 405 static void memtohex(char *buf, const uint8_t *mem, int len)
 406 {
 407     int i, c;
 408     char *q;
 409     q = buf;
 410     for(i = 0; i < len; i++) {
 411         c = mem[i];
 412         *q++ = tohex(c >> 4);
 413         *q++ = tohex(c & 0xf);
 414     }
 415     *q = '\0';
 416 }
 417
 418 static void hextomem(uint8_t *mem, const char *buf, int len)
 419 {
 420     int i;
 421
 422     for(i = 0; i < len; i++) {
 423         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 424         buf += 2;
 425     }
 426 }
 427
 428 /* return -1 if error, 0 if OK */
 429 static int put_packet_binary(GDBState *s, const char *buf, int len)
 430 {
 431     int csum, i;
 432     uint8_t *p;
 433
 434     for(;;) {
 435         p = s->last_packet;
 436         *(p++) = '$';
 437         memcpy(p, buf, len);
 438         p += len;
 439         csum = 0;
 440         for(i = 0; i < len; i++) {
 441             csum += buf[i];
 442         }
 443         *(p++) = '#';
 444         *(p++) = tohex((csum >> 4) & 0xf);
 445         *(p++) = tohex((csum) & 0xf);
 446
 447         s->last_packet_len = p - s->last_packet;
 448         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 449
 450 #ifdef CONFIG_USER_ONLY
 451         i = get_char(s);
 452         if (i < 0)
 453             return -1;
 454         if (i == '+')
 455             break;
 456 #else
 457         break;
 458 #endif
 459     }
 460     return 0;
 461 }
 462
 463 /* return -1 if error, 0 if OK */
 464 static int put_packet(GDBState *s, const char *buf)
 465 {
 466 #ifdef DEBUG_GDB
 467     printf("reply='%s'\n", buf);
 468 #endif
 469
 470     return put_packet_binary(s, buf, strlen(buf));
 471 }
 472
 473 /* The GDB remote protocol transfers values in target byte order.  This means
 474    we can use the raw memory access routines to access the value buffer.
 475    Conveniently, these also handle the case where the buffer is mis-aligned.
 476  */
 477 #define GET_REG8(val) do { \
 478     stb_p(mem_buf, val); \
 479     return 1; \
 480     } while(0)
 481 #define GET_REG16(val) do { \
 482     stw_p(mem_buf, val); \
 483     return 2; \
 484     } while(0)
 485 #define GET_REG32(val) do { \
 486     stl_p(mem_buf, val); \
 487     return 4; \
 488     } while(0)
 489 #define GET_REG64(val) do { \
 490     stq_p(mem_buf, val); \
 491     return 8; \
 492     } while(0)
 493
 494 #if TARGET_LONG_BITS == 64
 495 #define GET_REGL(val) GET_REG64(val)
 496 #define ldtul_p(addr) ldq_p(addr)
 497 #else
 498 #define GET_REGL(val) GET_REG32(val)
 499 #define ldtul_p(addr) ldl_p(addr)
 500 #endif
 501
 502 #if defined(TARGET_I386)
 503
 504 #ifdef TARGET_X86_64
 505 static const int gpr_map[16] = {
 506     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 507     8, 9, 10, 11, 12, 13, 14, 15
 508 };
 509 #else
 510 static const int gpr_map[8] = {0, 1, 2, 3, 4, 5, 6, 7};
 511 #endif
 512
 513 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 514
 515 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 516 {
 517     if (n < CPU_NB_REGS) {
 518         GET_REGL(env->regs[gpr_map[n]]);
 519     } else if (n >= CPU_NB_REGS + 8 && n < CPU_NB_REGS + 16) {
 520         /* FIXME: byteswap float values.  */
 521 #ifdef USE_X86LDOUBLE
 522         memcpy(mem_buf, &env->fpregs[n - (CPU_NB_REGS + 8)], 10);
 523 #else
 524         memset(mem_buf, 0, 10);
 525 #endif
 526         return 10;
 527     } else if (n >= CPU_NB_REGS + 24) {
 528         n -= CPU_NB_REGS + 24;
 529         if (n < CPU_NB_REGS) {
 530             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 531             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 532             return 16;
 533         } else if (n == CPU_NB_REGS) {
 534             GET_REG32(env->mxcsr);
 535         }
 536     } else {
 537         n -= CPU_NB_REGS;
 538         switch (n) {
 539         case 0: GET_REGL(env->eip);
 540         case 1: GET_REG32(env->eflags);
 541         case 2: GET_REG32(env->segs[R_CS].selector);
 542         case 3: GET_REG32(env->segs[R_SS].selector);
 543         case 4: GET_REG32(env->segs[R_DS].selector);
 544         case 5: GET_REG32(env->segs[R_ES].selector);
 545         case 6: GET_REG32(env->segs[R_FS].selector);
 546         case 7: GET_REG32(env->segs[R_GS].selector);
 547         /* 8...15 x87 regs.  */
 548         case 16: GET_REG32(env->fpuc);
 549         case 17: GET_REG32((env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11);
 550         case 18: GET_REG32(0); /* ftag */
 551         case 19: GET_REG32(0); /* fiseg */
 552         case 20: GET_REG32(0); /* fioff */
 553         case 21: GET_REG32(0); /* foseg */
 554         case 22: GET_REG32(0); /* fooff */
 555         case 23: GET_REG32(0); /* fop */
 556         /* 24+ xmm regs.  */
 557         }
 558     }
 559     return 0;
 560 }
 561
 562 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int i)
 563 {
 564     uint32_t tmp;
 565
 566     if (i < CPU_NB_REGS) {
 567         env->regs[gpr_map[i]] = ldtul_p(mem_buf);
 568         return sizeof(target_ulong);
 569     } else if (i >= CPU_NB_REGS + 8 && i < CPU_NB_REGS + 16) {
 570         i -= CPU_NB_REGS + 8;
 571 #ifdef USE_X86LDOUBLE
 572         memcpy(&env->fpregs[i], mem_buf, 10);
 573 #endif
 574         return 10;
 575     } else if (i >= CPU_NB_REGS + 24) {
 576         i -= CPU_NB_REGS + 24;
 577         if (i < CPU_NB_REGS) {
 578             env->xmm_regs[i].XMM_Q(0) = ldq_p(mem_buf);
 579             env->xmm_regs[i].XMM_Q(1) = ldq_p(mem_buf + 8);
 580             return 16;
 581         } else if (i == CPU_NB_REGS) {
 582             env->mxcsr = ldl_p(mem_buf);
 583             return 4;
 584         }
 585     } else {
 586         i -= CPU_NB_REGS;
 587         switch (i) {
 588         case 0: env->eip = ldtul_p(mem_buf); return sizeof(target_ulong);
 589         case 1: env->eflags = ldl_p(mem_buf); return 4;
 590 #if defined(CONFIG_USER_ONLY)
 591 #define LOAD_SEG(index, sreg)\
 592             tmp = ldl_p(mem_buf);\
 593             if (tmp != env->segs[sreg].selector)\
 594                 cpu_x86_load_seg(env, sreg, tmp);
 595 #else
 596 /* FIXME: Honor segment registers.  Needs to avoid raising an exception
 597    when the selector is invalid.  */
 598 #define LOAD_SEG(index, sreg) do {} while(0)
 599 #endif
 600         case 2: LOAD_SEG(10, R_CS); return 4;
 601         case 3: LOAD_SEG(11, R_SS); return 4;
 602         case 4: LOAD_SEG(12, R_DS); return 4;
 603         case 5: LOAD_SEG(13, R_ES); return 4;
 604         case 6: LOAD_SEG(14, R_FS); return 4;
 605         case 7: LOAD_SEG(15, R_GS); return 4;
 606         /* 8...15 x87 regs.  */
 607         case 16: env->fpuc = ldl_p(mem_buf); return 4;
 608         case 17:
 609                  tmp = ldl_p(mem_buf);
 610                  env->fpstt = (tmp >> 11) & 7;
 611                  env->fpus = tmp & ~0x3800;
 612                  return 4;
 613         case 18: /* ftag */ return 4;
 614         case 19: /* fiseg */ return 4;
 615         case 20: /* fioff */ return 4;
 616         case 21: /* foseg */ return 4;
 617         case 22: /* fooff */ return 4;
 618         case 23: /* fop */ return 4;
 619         /* 24+ xmm regs.  */
 620         }
 621     }
 622     /* Unrecognised register.  */
 623     return 0;
 624 }
 625
 626 #elif defined (TARGET_PPC)
 627
 628 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 629    expects whatever the target description contains.  Due to a
 630    historical mishap the FP registers appear in between core integer
 631    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 632    FP regs zero size when talking to a newer gdb.  */
 633 #define NUM_CORE_REGS 71
 634 #if defined (TARGET_PPC64)
 635 #define GDB_CORE_XML "power64-core.xml"
 636 #else
 637 #define GDB_CORE_XML "power-core.xml"
 638 #endif
 639
 640 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 641 {
 642     if (n < 32) {
 643         /* gprs */
 644         GET_REGL(env->gpr[n]);
 645     } else if (n < 64) {
 646         /* fprs */
 647         if (gdb_has_xml)
 648             return 0;
 649         stfq_p(mem_buf, env->fpr[n-32]);
 650         return 8;
 651     } else {
 652         switch (n) {
 653         case 64: GET_REGL(env->nip);
 654         case 65: GET_REGL(env->msr);
 655         case 66:
 656             {
 657                 uint32_t cr = 0;
 658                 int i;
 659                 for (i = 0; i < 8; i++)
 660                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 661                 GET_REG32(cr);
 662             }
 663         case 67: GET_REGL(env->lr);
 664         case 68: GET_REGL(env->ctr);
 665         case 69: GET_REGL(env->xer);
 666         case 70:
 667             {
 668                 if (gdb_has_xml)
 669                     return 0;
 670                 GET_REG32(0); /* fpscr */
 671             }
 672         }
 673     }
 674     return 0;
 675 }
 676
 677 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 678 {
 679     if (n < 32) {
 680         /* gprs */
 681         env->gpr[n] = ldtul_p(mem_buf);
 682         return sizeof(target_ulong);
 683     } else if (n < 64) {
 684         /* fprs */
 685         if (gdb_has_xml)
 686             return 0;
 687         env->fpr[n-32] = ldfq_p(mem_buf);
 688         return 8;
 689     } else {
 690         switch (n) {
 691         case 64:
 692             env->nip = ldtul_p(mem_buf);
 693             return sizeof(target_ulong);
 694         case 65:
 695             ppc_store_msr(env, ldtul_p(mem_buf));
 696             return sizeof(target_ulong);
 697         case 66:
 698             {
 699                 uint32_t cr = ldl_p(mem_buf);
 700                 int i;
 701                 for (i = 0; i < 8; i++)
 702                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 703                 return 4;
 704             }
 705         case 67:
 706             env->lr = ldtul_p(mem_buf);
 707             return sizeof(target_ulong);
 708         case 68:
 709             env->ctr = ldtul_p(mem_buf);
 710             return sizeof(target_ulong);
 711         case 69:
 712             env->xer = ldtul_p(mem_buf);
 713             return sizeof(target_ulong);
 714         case 70:
 715             /* fpscr */
 716             if (gdb_has_xml)
 717                 return 0;
 718             return 4;
 719         }
 720     }
 721     return 0;
 722 }
 723
 724 #elif defined (TARGET_SPARC)
 725
 726 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 727 #define NUM_CORE_REGS 86
 728 #else
 729 #define NUM_CORE_REGS 72
 730 #endif
 731
 732 #ifdef TARGET_ABI32
 733 #define GET_REGA(val) GET_REG32(val)
 734 #else
 735 #define GET_REGA(val) GET_REGL(val)
 736 #endif
 737
 738 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 739 {
 740     if (n < 8) {
 741         /* g0..g7 */
 742         GET_REGA(env->gregs[n]);
 743     }
 744     if (n < 32) {
 745         /* register window */
 746         GET_REGA(env->regwptr[n - 8]);
 747     }
 748 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 749     if (n < 64) {
 750         /* fprs */
 751         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 752     }
 753     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 754     switch (n) {
 755     case 64: GET_REGA(env->y);
 756     case 65: GET_REGA(GET_PSR(env));
 757     case 66: GET_REGA(env->wim);
 758     case 67: GET_REGA(env->tbr);
 759     case 68: GET_REGA(env->pc);
 760     case 69: GET_REGA(env->npc);
 761     case 70: GET_REGA(env->fsr);
 762     case 71: GET_REGA(0); /* csr */
 763     default: GET_REGA(0);
 764     }
 765 #else
 766     if (n < 64) {
 767         /* f0-f31 */
 768         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 769     }
 770     if (n < 80) {
 771         /* f32-f62 (double width, even numbers only) */
 772         uint64_t val;
 773
 774         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 775         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 776         GET_REG64(val);
 777     }
 778     switch (n) {
 779     case 80: GET_REGL(env->pc);
 780     case 81: GET_REGL(env->npc);
 781     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 782                            ((env->asi & 0xff) << 24) |
 783                            ((env->pstate & 0xfff) << 8) |
 784                            GET_CWP64(env));
 785     case 83: GET_REGL(env->fsr);
 786     case 84: GET_REGL(env->fprs);
 787     case 85: GET_REGL(env->y);
 788     }
 789 #endif
 790     return 0;
 791 }
 792
 793 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 794 {
 795 #if defined(TARGET_ABI32)
 796     abi_ulong tmp;
 797
 798     tmp = ldl_p(mem_buf);
 799 #else
 800     target_ulong tmp;
 801
 802     tmp = ldtul_p(mem_buf);
 803 #endif
 804
 805     if (n < 8) {
 806         /* g0..g7 */
 807         env->gregs[n] = tmp;
 808     } else if (n < 32) {
 809         /* register window */
 810         env->regwptr[n - 8] = tmp;
 811     }
 812 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 813     else if (n < 64) {
 814         /* fprs */
 815         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 816     } else {
 817         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 818         switch (n) {
 819         case 64: env->y = tmp; break;
 820         case 65: PUT_PSR(env, tmp); break;
 821         case 66: env->wim = tmp; break;
 822         case 67: env->tbr = tmp; break;
 823         case 68: env->pc = tmp; break;
 824         case 69: env->npc = tmp; break;
 825         case 70: env->fsr = tmp; break;
 826         default: return 0;
 827         }
 828     }
 829     return 4;
 830 #else
 831     else if (n < 64) {
 832         /* f0-f31 */
 833         env->fpr[n] = ldfl_p(mem_buf);
 834         return 4;
 835     } else if (n < 80) {
 836         /* f32-f62 (double width, even numbers only) */
 837         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 838         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 839     } else {
 840         switch (n) {
 841         case 80: env->pc = tmp; break;
 842         case 81: env->npc = tmp; break;
 843         case 82:
 844             PUT_CCR(env, tmp >> 32);
 845             env->asi = (tmp >> 24) & 0xff;
 846             env->pstate = (tmp >> 8) & 0xfff;
 847             PUT_CWP64(env, tmp & 0xff);
 848             break;
 849         case 83: env->fsr = tmp; break;
 850         case 84: env->fprs = tmp; break;
 851         case 85: env->y = tmp; break;
 852         default: return 0;
 853         }
 854     }
 855     return 8;
 856 #endif
 857 }
 858 #elif defined (TARGET_ARM)
 859
 860 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 861    whatever the target description contains.  Due to a historical mishap
 862    the FPA registers appear in between core integer regs and the CPSR.
 863    We hack round this by giving the FPA regs zero size when talking to a
 864    newer gdb.  */
 865 #define NUM_CORE_REGS 26
 866 #define GDB_CORE_XML "arm-core.xml"
 867
 868 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 869 {
 870     if (n < 16) {
 871         /* Core integer register.  */
 872         GET_REG32(env->regs[n]);
 873     }
 874     if (n < 24) {
 875         /* FPA registers.  */
 876         if (gdb_has_xml)
 877             return 0;
 878         memset(mem_buf, 0, 12);
 879         return 12;
 880     }
 881     switch (n) {
 882     case 24:
 883         /* FPA status register.  */
 884         if (gdb_has_xml)
 885             return 0;
 886         GET_REG32(0);
 887     case 25:
 888         /* CPSR */
 889         GET_REG32(cpsr_read(env));
 890     }
 891     /* Unknown register.  */
 892     return 0;
 893 }
 894
 895 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 896 {
 897     uint32_t tmp;
 898
 899     tmp = ldl_p(mem_buf);
 900
 901     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 902        cause problems if we ever implement the Jazelle DBX extensions.  */
 903     if (n == 15)
 904         tmp &= ~1;
 905
 906     if (n < 16) {
 907         /* Core integer register.  */
 908         env->regs[n] = tmp;
 909         return 4;
 910     }
 911     if (n < 24) { /* 16-23 */
 912         /* FPA registers (ignored).  */
 913         if (gdb_has_xml)
 914             return 0;
 915         return 12;
 916     }
 917     switch (n) {
 918     case 24:
 919         /* FPA status register (ignored).  */
 920         if (gdb_has_xml)
 921             return 0;
 922         return 4;
 923     case 25:
 924         /* CPSR */
 925         cpsr_write (env, tmp, 0xffffffff);
 926         return 4;
 927     }
 928     /* Unknown register.  */
 929     return 0;
 930 }
 931
 932 #elif defined (TARGET_M68K)
 933
 934 #define NUM_CORE_REGS 18
 935
 936 #define GDB_CORE_XML "cf-core.xml"
 937
 938 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 939 {
 940     if (n < 8) {
 941         /* D0-D7 */
 942         GET_REG32(env->dregs[n]);
 943     } else if (n < 16) {
 944         /* A0-A7 */
 945         GET_REG32(env->aregs[n - 8]);
 946     } else {
 947         switch (n) {
 948         case 16: GET_REG32(env->sr);
 949         case 17: GET_REG32(env->pc);
 950         }
 951     }
 952     /* FP registers not included here because they vary between
 953        ColdFire and m68k.  Use XML bits for these.  */
 954     return 0;
 955 }
 956
 957 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 958 {
 959     uint32_t tmp;
 960
 961     tmp = ldl_p(mem_buf);
 962
 963     if (n < 8) {
 964         /* D0-D7 */
 965         env->dregs[n] = tmp;
 966     } else if (n < 8) {
 967         /* A0-A7 */
 968         env->aregs[n - 8] = tmp;
 969     } else {
 970         switch (n) {
 971         case 16: env->sr = tmp; break;
 972         case 17: env->pc = tmp; break;
 973         default: return 0;
 974         }
 975     }
 976     return 4;
 977 }
 978 #elif defined (TARGET_MIPS)
 979
 980 #define NUM_CORE_REGS 73
 981
 982 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 983 {
 984     if (n < 32) {
 985         GET_REGL(env->active_tc.gpr[n]);
 986     }
 987     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
 988         if (n >= 38 && n < 70) {
 989             if (env->CP0_Status & (1 << CP0St_FR))
 990                 GET_REGL(env->active_fpu.fpr[n - 38].d);
 991             else
 992                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
 993         }
 994         switch (n) {
 995         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
 996         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
 997         }
 998     }
 999     switch (n) {
1000     case 32: GET_REGL((int32_t)env->CP0_Status);
1001     case 33: GET_REGL(env->active_tc.LO[0]);
1002     case 34: GET_REGL(env->active_tc.HI[0]);
1003     case 35: GET_REGL(env->CP0_BadVAddr);
1004     case 36: GET_REGL((int32_t)env->CP0_Cause);
1005     case 37: GET_REGL(env->active_tc.PC);
1006     case 72: GET_REGL(0); /* fp */
1007     case 89: GET_REGL((int32_t)env->CP0_PRid);
1008     }
1009     if (n >= 73 && n <= 88) {
1010         /* 16 embedded regs.  */
1011         GET_REGL(0);
1012     }
1013
1014     return 0;
1015 }
1016
1017 /* convert MIPS rounding mode in FCR31 to IEEE library */
1018 static unsigned int ieee_rm[] =
1019   {
1020     float_round_nearest_even,
1021     float_round_to_zero,
1022     float_round_up,
1023     float_round_down
1024   };
1025 #define RESTORE_ROUNDING_MODE \
1026     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1027
1028 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1029 {
1030     target_ulong tmp;
1031
1032     tmp = ldtul_p(mem_buf);
1033
1034     if (n < 32) {
1035         env->active_tc.gpr[n] = tmp;
1036         return sizeof(target_ulong);
1037     }
1038     if (env->CP0_Config1 & (1 << CP0C1_FP)
1039             && n >= 38 && n < 73) {
1040         if (n < 70) {
1041             if (env->CP0_Status & (1 << CP0St_FR))
1042               env->active_fpu.fpr[n - 38].d = tmp;
1043             else
1044               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1045         }
1046         switch (n) {
1047         case 70:
1048             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1049             /* set rounding mode */
1050             RESTORE_ROUNDING_MODE;
1051 #ifndef CONFIG_SOFTFLOAT
1052             /* no floating point exception for native float */
1053             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1054 #endif
1055             break;
1056         case 71: env->active_fpu.fcr0 = tmp; break;
1057         }
1058         return sizeof(target_ulong);
1059     }
1060     switch (n) {
1061     case 32: env->CP0_Status = tmp; break;
1062     case 33: env->active_tc.LO[0] = tmp; break;
1063     case 34: env->active_tc.HI[0] = tmp; break;
1064     case 35: env->CP0_BadVAddr = tmp; break;
1065     case 36: env->CP0_Cause = tmp; break;
1066     case 37: env->active_tc.PC = tmp; break;
1067     case 72: /* fp, ignored */ break;
1068     default:
1069         if (n > 89)
1070             return 0;
1071         /* Other registers are readonly.  Ignore writes.  */
1072         break;
1073     }
1074
1075     return sizeof(target_ulong);
1076 }
1077 #elif defined (TARGET_SH4)
1078
1079 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1080 /* FIXME: We should use XML for this.  */
1081
1082 #define NUM_CORE_REGS 59
1083
1084 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1085 {
1086     if (n < 8) {
1087         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1088             GET_REGL(env->gregs[n + 16]);
1089         } else {
1090             GET_REGL(env->gregs[n]);
1091         }
1092     } else if (n < 16) {
1093         GET_REGL(env->gregs[n - 8]);
1094     } else if (n >= 25 && n < 41) {
1095         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1096     } else if (n >= 43 && n < 51) {
1097         GET_REGL(env->gregs[n - 43]);
1098     } else if (n >= 51 && n < 59) {
1099         GET_REGL(env->gregs[n - (51 - 16)]);
1100     }
1101     switch (n) {
1102     case 16: GET_REGL(env->pc);
1103     case 17: GET_REGL(env->pr);
1104     case 18: GET_REGL(env->gbr);
1105     case 19: GET_REGL(env->vbr);
1106     case 20: GET_REGL(env->mach);
1107     case 21: GET_REGL(env->macl);
1108     case 22: GET_REGL(env->sr);
1109     case 23: GET_REGL(env->fpul);
1110     case 24: GET_REGL(env->fpscr);
1111     case 41: GET_REGL(env->ssr);
1112     case 42: GET_REGL(env->spc);
1113     }
1114
1115     return 0;
1116 }
1117
1118 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1119 {
1120     uint32_t tmp;
1121
1122     tmp = ldl_p(mem_buf);
1123
1124     if (n < 8) {
1125         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1126             env->gregs[n + 16] = tmp;
1127         } else {
1128             env->gregs[n] = tmp;
1129         }
1130         return 4;
1131     } else if (n < 16) {
1132         env->gregs[n - 8] = tmp;
1133         return 4;
1134     } else if (n >= 25 && n < 41) {
1135         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1136     } else if (n >= 43 && n < 51) {
1137         env->gregs[n - 43] = tmp;
1138         return 4;
1139     } else if (n >= 51 && n < 59) {
1140         env->gregs[n - (51 - 16)] = tmp;
1141         return 4;
1142     }
1143     switch (n) {
1144     case 16: env->pc = tmp;
1145     case 17: env->pr = tmp;
1146     case 18: env->gbr = tmp;
1147     case 19: env->vbr = tmp;
1148     case 20: env->mach = tmp;
1149     case 21: env->macl = tmp;
1150     case 22: env->sr = tmp;
1151     case 23: env->fpul = tmp;
1152     case 24: env->fpscr = tmp;
1153     case 41: env->ssr = tmp;
1154     case 42: env->spc = tmp;
1155     default: return 0;
1156     }
1157
1158     return 4;
1159 }
1160 #elif defined (TARGET_MICROBLAZE)
1161
1162 #define NUM_CORE_REGS (32 + 5)
1163
1164 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1165 {
1166     if (n < 32) {
1167         GET_REG32(env->regs[n]);
1168     } else {
1169         GET_REG32(env->sregs[n - 32]);
1170     }
1171     return 0;
1172 }
1173
1174 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1175 {
1176     uint32_t tmp;
1177
1178     if (n > NUM_CORE_REGS)
1179         return 0;
1180
1181     tmp = ldl_p(mem_buf);
1182
1183     if (n < 32) {
1184         env->regs[n] = tmp;
1185     } else {
1186         env->sregs[n - 32] = tmp;
1187     }
1188     return 4;
1189 }
1190 #elif defined (TARGET_CRIS)
1191
1192 #define NUM_CORE_REGS 49
1193
1194 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1195 {
1196     uint8_t srs;
1197
1198     srs = env->pregs[PR_SRS];
1199     if (n < 16) {
1200         GET_REG32(env->regs[n]);
1201     }
1202
1203     if (n >= 21 && n < 32) {
1204         GET_REG32(env->pregs[n - 16]);
1205     }
1206     if (n >= 33 && n < 49) {
1207         GET_REG32(env->sregs[srs][n - 33]);
1208     }
1209     switch (n) {
1210     case 16: GET_REG8(env->pregs[0]);
1211     case 17: GET_REG8(env->pregs[1]);
1212     case 18: GET_REG32(env->pregs[2]);
1213     case 19: GET_REG8(srs);
1214     case 20: GET_REG16(env->pregs[4]);
1215     case 32: GET_REG32(env->pc);
1216     }
1217
1218     return 0;
1219 }
1220
1221 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1222 {
1223     uint32_t tmp;
1224
1225     if (n > 49)
1226         return 0;
1227
1228     tmp = ldl_p(mem_buf);
1229
1230     if (n < 16) {
1231         env->regs[n] = tmp;
1232     }
1233
1234     if (n >= 21 && n < 32) {
1235         env->pregs[n - 16] = tmp;
1236     }
1237
1238     /* FIXME: Should support function regs be writable?  */
1239     switch (n) {
1240     case 16: return 1;
1241     case 17: return 1;
1242     case 18: env->pregs[PR_PID] = tmp; break;
1243     case 19: return 1;
1244     case 20: return 2;
1245     case 32: env->pc = tmp; break;
1246     }
1247
1248     return 4;
1249 }
1250 #elif defined (TARGET_ALPHA)
1251
1252 #define NUM_CORE_REGS 65
1253
1254 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1255 {
1256     if (n < 31) {
1257        GET_REGL(env->ir[n]);
1258     }
1259     else if (n == 31) {
1260        GET_REGL(0);
1261     }
1262     else if (n<63) {
1263        uint64_t val;
1264
1265        val=*((uint64_t *)&env->fir[n-32]);
1266        GET_REGL(val);
1267     }
1268     else if (n==63) {
1269        GET_REGL(env->fpcr);
1270     }
1271     else if (n==64) {
1272        GET_REGL(env->pc);
1273     }
1274     else {
1275        GET_REGL(0);
1276     }
1277
1278     return 0;
1279 }
1280
1281 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1282 {
1283     target_ulong tmp;
1284     tmp = ldtul_p(mem_buf);
1285
1286     if (n < 31) {
1287         env->ir[n] = tmp;
1288     }
1289
1290     if (n > 31 && n < 63) {
1291         env->fir[n - 32] = ldfl_p(mem_buf);
1292     }
1293
1294     if (n == 64 ) {
1295        env->pc=tmp;
1296     }
1297
1298     return 8;
1299 }
1300 #else
1301
1302 #define NUM_CORE_REGS 0
1303
1304 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1305 {
1306     return 0;
1307 }
1308
1309 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1310 {
1311     return 0;
1312 }
1313
1314 #endif
1315
1316 static int num_g_regs = NUM_CORE_REGS;
1317
1318 #ifdef GDB_CORE_XML
1319 /* Encode data using the encoding for 'x' packets.  */
1320 static int memtox(char *buf, const char *mem, int len)
1321 {
1322     char *p = buf;
1323     char c;
1324
1325     while (len--) {
1326         c = *(mem++);
1327         switch (c) {
1328         case '#': case '$': case '*': case '}':
1329             *(p++) = '}';
1330             *(p++) = c ^ 0x20;
1331             break;
1332         default:
1333             *(p++) = c;
1334             break;
1335         }
1336     }
1337     return p - buf;
1338 }
1339
1340 static const char *get_feature_xml(const char *p, const char **newp)
1341 {
1342     extern const char *const xml_builtin[][2];
1343     size_t len;
1344     int i;
1345     const char *name;
1346     static char target_xml[1024];
1347
1348     len = 0;
1349     while (p[len] && p[len] != ':')
1350         len++;
1351     *newp = p + len;
1352
1353     name = NULL;
1354     if (strncmp(p, "target.xml", len) == 0) {
1355         /* Generate the XML description for this CPU.  */
1356         if (!target_xml[0]) {
1357             GDBRegisterState *r;
1358
1359             snprintf(target_xml, sizeof(target_xml),
1360                      "<?xml version=\"1.0\"?>"
1361                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1362                      "<target>"
1363                      "<xi:include href=\"%s\"/>",
1364                      GDB_CORE_XML);
1365
1366             for (r = first_cpu->gdb_regs; r; r = r->next) {
1367                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
1368                 pstrcat(target_xml, sizeof(target_xml), r->xml);
1369                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
1370             }
1371             pstrcat(target_xml, sizeof(target_xml), "</target>");
1372         }
1373         return target_xml;
1374     }
1375     for (i = 0; ; i++) {
1376         name = xml_builtin[i][0];
1377         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1378             break;
1379     }
1380     return name ? xml_builtin[i][1] : NULL;
1381 }
1382 #endif
1383
1384 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1385 {
1386     GDBRegisterState *r;
1387
1388     if (reg < NUM_CORE_REGS)
1389         return cpu_gdb_read_register(env, mem_buf, reg);
1390
1391     for (r = env->gdb_regs; r; r = r->next) {
1392         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1393             return r->get_reg(env, mem_buf, reg - r->base_reg);
1394         }
1395     }
1396     return 0;
1397 }
1398
1399 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1400 {
1401     GDBRegisterState *r;
1402
1403     if (reg < NUM_CORE_REGS)
1404         return cpu_gdb_write_register(env, mem_buf, reg);
1405
1406     for (r = env->gdb_regs; r; r = r->next) {
1407         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1408             return r->set_reg(env, mem_buf, reg - r->base_reg);
1409         }
1410     }
1411     return 0;
1412 }
1413
1414 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1415    specifies the first register number and these registers are included in
1416    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1417    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1418  */
1419
1420 void gdb_register_coprocessor(CPUState * env,
1421                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1422                              int num_regs, const char *xml, int g_pos)
1423 {
1424     GDBRegisterState *s;
1425     GDBRegisterState **p;
1426     static int last_reg = NUM_CORE_REGS;
1427
1428     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1429     s->base_reg = last_reg;
1430     s->num_regs = num_regs;
1431     s->get_reg = get_reg;
1432     s->set_reg = set_reg;
1433     s->xml = xml;
1434     p = &env->gdb_regs;
1435     while (*p) {
1436         /* Check for duplicates.  */
1437         if (strcmp((*p)->xml, xml) == 0)
1438             return;
1439         p = &(*p)->next;
1440     }
1441     /* Add to end of list.  */
1442     last_reg += num_regs;
1443     *p = s;
1444     if (g_pos) {
1445         if (g_pos != s->base_reg) {
1446             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1447                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1448         } else {
1449             num_g_regs = last_reg;
1450         }
1451     }
1452 }
1453
1454 #ifndef CONFIG_USER_ONLY
1455 static const int xlat_gdb_type[] = {
1456     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1457     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1458     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1459 };
1460 #endif
1461
1462 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1463 {
1464     CPUState *env;
1465     int err = 0;
1466
1467     if (kvm_enabled())
1468         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1469
1470     switch (type) {
1471     case GDB_BREAKPOINT_SW:
1472     case GDB_BREAKPOINT_HW:
1473         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1474             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1475             if (err)
1476                 break;
1477         }
1478         return err;
1479 #ifndef CONFIG_USER_ONLY
1480     case GDB_WATCHPOINT_WRITE:
1481     case GDB_WATCHPOINT_READ:
1482     case GDB_WATCHPOINT_ACCESS:
1483         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1484             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1485                                         NULL);
1486             if (err)
1487                 break;
1488         }
1489         return err;
1490 #endif
1491     default:
1492         return -ENOSYS;
1493     }
1494 }
1495
1496 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1497 {
1498     CPUState *env;
1499     int err = 0;
1500
1501     if (kvm_enabled())
1502         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1503
1504     switch (type) {
1505     case GDB_BREAKPOINT_SW:
1506     case GDB_BREAKPOINT_HW:
1507         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1508             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1509             if (err)
1510                 break;
1511         }
1512         return err;
1513 #ifndef CONFIG_USER_ONLY
1514     case GDB_WATCHPOINT_WRITE:
1515     case GDB_WATCHPOINT_READ:
1516     case GDB_WATCHPOINT_ACCESS:
1517         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1518             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1519             if (err)
1520                 break;
1521         }
1522         return err;
1523 #endif
1524     default:
1525         return -ENOSYS;
1526     }
1527 }
1528
1529 static void gdb_breakpoint_remove_all(void)
1530 {
1531     CPUState *env;
1532
1533     if (kvm_enabled()) {
1534         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1535         return;
1536     }
1537
1538     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1539         cpu_breakpoint_remove_all(env, BP_GDB);
1540 #ifndef CONFIG_USER_ONLY
1541         cpu_watchpoint_remove_all(env, BP_GDB);
1542 #endif
1543     }
1544 }
1545
1546 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1547 {
1548 #if defined(TARGET_I386)
1549     s->c_cpu->eip = pc;
1550     cpu_synchronize_state(s->c_cpu, 1);
1551 #elif defined (TARGET_PPC)
1552     s->c_cpu->nip = pc;
1553 #elif defined (TARGET_SPARC)
1554     s->c_cpu->pc = pc;
1555     s->c_cpu->npc = pc + 4;
1556 #elif defined (TARGET_ARM)
1557     s->c_cpu->regs[15] = pc;
1558 #elif defined (TARGET_SH4)
1559     s->c_cpu->pc = pc;
1560 #elif defined (TARGET_MIPS)
1561     s->c_cpu->active_tc.PC = pc;
1562 #elif defined (TARGET_MICROBLAZE)
1563     s->c_cpu->sregs[SR_PC] = pc;
1564 #elif defined (TARGET_CRIS)
1565     s->c_cpu->pc = pc;
1566 #elif defined (TARGET_ALPHA)
1567     s->c_cpu->pc = pc;
1568 #endif
1569 }
1570
1571 static inline int gdb_id(CPUState *env)
1572 {
1573 #if defined(CONFIG_USER_ONLY) && defined(USE_NPTL)
1574     return env->host_tid;
1575 #else
1576     return env->cpu_index + 1;
1577 #endif
1578 }
1579
1580 static CPUState *find_cpu(uint32_t thread_id)
1581 {
1582     CPUState *env;
1583
1584     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1585         if (gdb_id(env) == thread_id) {
1586             return env;
1587         }
1588     }
1589
1590     return NULL;
1591 }
1592
1593 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1594 {
1595     CPUState *env;
1596     const char *p;
1597     uint32_t thread;
1598     int ch, reg_size, type, res;
1599     char buf[MAX_PACKET_LENGTH];
1600     uint8_t mem_buf[MAX_PACKET_LENGTH];
1601     uint8_t *registers;
1602     target_ulong addr, len;
1603
1604 #ifdef DEBUG_GDB
1605     printf("command='%s'\n", line_buf);
1606 #endif
1607     p = line_buf;
1608     ch = *p++;
1609     switch(ch) {
1610     case '?':
1611         /* TODO: Make this return the correct value for user-mode.  */
1612         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1613                  gdb_id(s->c_cpu));
1614         put_packet(s, buf);
1615         /* Remove all the breakpoints when this query is issued,
1616          * because gdb is doing and initial connect and the state
1617          * should be cleaned up.
1618          */
1619         gdb_breakpoint_remove_all();
1620         break;
1621     case 'c':
1622         if (*p != '\0') {
1623             addr = strtoull(p, (char **)&p, 16);
1624             gdb_set_cpu_pc(s, addr);
1625         }
1626         s->signal = 0;
1627         gdb_continue(s);
1628         return RS_IDLE;
1629     case 'C':
1630         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1631         if (s->signal == -1)
1632             s->signal = 0;
1633         gdb_continue(s);
1634         return RS_IDLE;
1635     case 'k':
1636         /* Kill the target */
1637         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1638         exit(0);
1639     case 'D':
1640         /* Detach packet */
1641         gdb_breakpoint_remove_all();
1642         gdb_continue(s);
1643         put_packet(s, "OK");
1644         break;
1645     case 's':
1646         if (*p != '\0') {
1647             addr = strtoull(p, (char **)&p, 16);
1648             gdb_set_cpu_pc(s, addr);
1649         }
1650         cpu_single_step(s->c_cpu, sstep_flags);
1651         gdb_continue(s);
1652         return RS_IDLE;
1653     case 'F':
1654         {
1655             target_ulong ret;
1656             target_ulong err;
1657
1658             ret = strtoull(p, (char **)&p, 16);
1659             if (*p == ',') {
1660                 p++;
1661                 err = strtoull(p, (char **)&p, 16);
1662             } else {
1663                 err = 0;
1664             }
1665             if (*p == ',')
1666                 p++;
1667             type = *p;
1668             if (gdb_current_syscall_cb)
1669                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1670             if (type == 'C') {
1671                 put_packet(s, "T02");
1672             } else {
1673                 gdb_continue(s);
1674             }
1675         }
1676         break;
1677     case 'g':
1678         cpu_synchronize_state(s->g_cpu, 0);
1679         len = 0;
1680         for (addr = 0; addr < num_g_regs; addr++) {
1681             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1682             len += reg_size;
1683         }
1684         memtohex(buf, mem_buf, len);
1685         put_packet(s, buf);
1686         break;
1687     case 'G':
1688         registers = mem_buf;
1689         len = strlen(p) / 2;
1690         hextomem((uint8_t *)registers, p, len);
1691         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1692             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1693             len -= reg_size;
1694             registers += reg_size;
1695         }
1696         cpu_synchronize_state(s->g_cpu, 1);
1697         put_packet(s, "OK");
1698         break;
1699     case 'm':
1700         addr = strtoull(p, (char **)&p, 16);
1701         if (*p == ',')
1702             p++;
1703         len = strtoull(p, NULL, 16);
1704         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1705             put_packet (s, "E14");
1706         } else {
1707             memtohex(buf, mem_buf, len);
1708             put_packet(s, buf);
1709         }
1710         break;
1711     case 'M':
1712         addr = strtoull(p, (char **)&p, 16);
1713         if (*p == ',')
1714             p++;
1715         len = strtoull(p, (char **)&p, 16);
1716         if (*p == ':')
1717             p++;
1718         hextomem(mem_buf, p, len);
1719         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1720             put_packet(s, "E14");
1721         else
1722             put_packet(s, "OK");
1723         break;
1724     case 'p':
1725         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1726            This works, but can be very slow.  Anything new enough to
1727            understand XML also knows how to use this properly.  */
1728         if (!gdb_has_xml)
1729             goto unknown_command;
1730         addr = strtoull(p, (char **)&p, 16);
1731         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1732         if (reg_size) {
1733             memtohex(buf, mem_buf, reg_size);
1734             put_packet(s, buf);
1735         } else {
1736             put_packet(s, "E14");
1737         }
1738         break;
1739     case 'P':
1740         if (!gdb_has_xml)
1741             goto unknown_command;
1742         addr = strtoull(p, (char **)&p, 16);
1743         if (*p == '=')
1744             p++;
1745         reg_size = strlen(p) / 2;
1746         hextomem(mem_buf, p, reg_size);
1747         gdb_write_register(s->g_cpu, mem_buf, addr);
1748         put_packet(s, "OK");
1749         break;
1750     case 'Z':
1751     case 'z':
1752         type = strtoul(p, (char **)&p, 16);
1753         if (*p == ',')
1754             p++;
1755         addr = strtoull(p, (char **)&p, 16);
1756         if (*p == ',')
1757             p++;
1758         len = strtoull(p, (char **)&p, 16);
1759         if (ch == 'Z')
1760             res = gdb_breakpoint_insert(addr, len, type);
1761         else
1762             res = gdb_breakpoint_remove(addr, len, type);
1763         if (res >= 0)
1764              put_packet(s, "OK");
1765         else if (res == -ENOSYS)
1766             put_packet(s, "");
1767         else
1768             put_packet(s, "E22");
1769         break;
1770     case 'H':
1771         type = *p++;
1772         thread = strtoull(p, (char **)&p, 16);
1773         if (thread == -1 || thread == 0) {
1774             put_packet(s, "OK");
1775             break;
1776         }
1777         env = find_cpu(thread);
1778         if (env == NULL) {
1779             put_packet(s, "E22");
1780             break;
1781         }
1782         switch (type) {
1783         case 'c':
1784             s->c_cpu = env;
1785             put_packet(s, "OK");
1786             break;
1787         case 'g':
1788             s->g_cpu = env;
1789             put_packet(s, "OK");
1790             break;
1791         default:
1792              put_packet(s, "E22");
1793              break;
1794         }
1795         break;
1796     case 'T':
1797         thread = strtoull(p, (char **)&p, 16);
1798         env = find_cpu(thread);
1799
1800         if (env != NULL) {
1801             put_packet(s, "OK");
1802         } else {
1803             put_packet(s, "E22");
1804         }
1805         break;
1806     case 'q':
1807     case 'Q':
1808         /* parse any 'q' packets here */
1809         if (!strcmp(p,"qemu.sstepbits")) {
1810             /* Query Breakpoint bit definitions */
1811             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1812                      SSTEP_ENABLE,
1813                      SSTEP_NOIRQ,
1814                      SSTEP_NOTIMER);
1815             put_packet(s, buf);
1816             break;
1817         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1818             /* Display or change the sstep_flags */
1819             p += 10;
1820             if (*p != '=') {
1821                 /* Display current setting */
1822                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1823                 put_packet(s, buf);
1824                 break;
1825             }
1826             p++;
1827             type = strtoul(p, (char **)&p, 16);
1828             sstep_flags = type;
1829             put_packet(s, "OK");
1830             break;
1831         } else if (strcmp(p,"C") == 0) {
1832             /* "Current thread" remains vague in the spec, so always return
1833              *  the first CPU (gdb returns the first thread). */
1834             put_packet(s, "QC1");
1835             break;
1836         } else if (strcmp(p,"fThreadInfo") == 0) {
1837             s->query_cpu = first_cpu;
1838             goto report_cpuinfo;
1839         } else if (strcmp(p,"sThreadInfo") == 0) {
1840         report_cpuinfo:
1841             if (s->query_cpu) {
1842                 snprintf(buf, sizeof(buf), "m%x", gdb_id(s->query_cpu));
1843                 put_packet(s, buf);
1844                 s->query_cpu = s->query_cpu->next_cpu;
1845             } else
1846                 put_packet(s, "l");
1847             break;
1848         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1849             thread = strtoull(p+16, (char **)&p, 16);
1850             env = find_cpu(thread);
1851             if (env != NULL) {
1852                 cpu_synchronize_state(env, 0);
1853                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
1854                                "CPU#%d [%s]", env->cpu_index,
1855                                env->halted ? "halted " : "running");
1856                 memtohex(buf, mem_buf, len);
1857                 put_packet(s, buf);
1858             }
1859             break;
1860         }
1861 #ifdef CONFIG_USER_ONLY
1862         else if (strncmp(p, "Offsets", 7) == 0) {
1863             TaskState *ts = s->c_cpu->opaque;
1864
1865             snprintf(buf, sizeof(buf),
1866                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1867                      ";Bss=" TARGET_ABI_FMT_lx,
1868                      ts->info->code_offset,
1869                      ts->info->data_offset,
1870                      ts->info->data_offset);
1871             put_packet(s, buf);
1872             break;
1873         }
1874 #else /* !CONFIG_USER_ONLY */
1875         else if (strncmp(p, "Rcmd,", 5) == 0) {
1876             int len = strlen(p + 5);
1877
1878             if ((len % 2) != 0) {
1879                 put_packet(s, "E01");
1880                 break;
1881             }
1882             hextomem(mem_buf, p + 5, len);
1883             len = len / 2;
1884             mem_buf[len++] = 0;
1885             qemu_chr_read(s->mon_chr, mem_buf, len);
1886             put_packet(s, "OK");
1887             break;
1888         }
1889 #endif /* !CONFIG_USER_ONLY */
1890         if (strncmp(p, "Supported", 9) == 0) {
1891             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1892 #ifdef GDB_CORE_XML
1893             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1894 #endif
1895             put_packet(s, buf);
1896             break;
1897         }
1898 #ifdef GDB_CORE_XML
1899         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1900             const char *xml;
1901             target_ulong total_len;
1902
1903             gdb_has_xml = 1;
1904             p += 19;
1905             xml = get_feature_xml(p, &p);
1906             if (!xml) {
1907                 snprintf(buf, sizeof(buf), "E00");
1908                 put_packet(s, buf);
1909                 break;
1910             }
1911
1912             if (*p == ':')
1913                 p++;
1914             addr = strtoul(p, (char **)&p, 16);
1915             if (*p == ',')
1916                 p++;
1917             len = strtoul(p, (char **)&p, 16);
1918
1919             total_len = strlen(xml);
1920             if (addr > total_len) {
1921                 snprintf(buf, sizeof(buf), "E00");
1922                 put_packet(s, buf);
1923                 break;
1924             }
1925             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1926                 len = (MAX_PACKET_LENGTH - 5) / 2;
1927             if (len < total_len - addr) {
1928                 buf[0] = 'm';
1929                 len = memtox(buf + 1, xml + addr, len);
1930             } else {
1931                 buf[0] = 'l';
1932                 len = memtox(buf + 1, xml + addr, total_len - addr);
1933             }
1934             put_packet_binary(s, buf, len + 1);
1935             break;
1936         }
1937 #endif
1938         /* Unrecognised 'q' command.  */
1939         goto unknown_command;
1940
1941     default:
1942     unknown_command:
1943         /* put empty packet */
1944         buf[0] = '\0';
1945         put_packet(s, buf);
1946         break;
1947     }
1948     return RS_IDLE;
1949 }
1950
1951 void gdb_set_stop_cpu(CPUState *env)
1952 {
1953     gdbserver_state->c_cpu = env;
1954     gdbserver_state->g_cpu = env;
1955 }
1956
1957 #ifndef CONFIG_USER_ONLY
1958 static void gdb_vm_state_change(void *opaque, int running, int reason)
1959 {
1960     GDBState *s = gdbserver_state;
1961     CPUState *env = s->c_cpu;
1962     char buf[256];
1963     const char *type;
1964     int ret;
1965
1966     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
1967         s->state == RS_INACTIVE || s->state == RS_SYSCALL)
1968         return;
1969
1970     /* disable single step if it was enable */
1971     cpu_single_step(env, 0);
1972
1973     if (reason == EXCP_DEBUG) {
1974         if (env->watchpoint_hit) {
1975             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
1976             case BP_MEM_READ:
1977                 type = "r";
1978                 break;
1979             case BP_MEM_ACCESS:
1980                 type = "a";
1981                 break;
1982             default:
1983                 type = "";
1984                 break;
1985             }
1986             snprintf(buf, sizeof(buf),
1987                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1988                      GDB_SIGNAL_TRAP, gdb_id(env), type,
1989                      env->watchpoint_hit->vaddr);
1990             put_packet(s, buf);
1991             env->watchpoint_hit = NULL;
1992             return;
1993         }
1994         tb_flush(env);
1995         ret = GDB_SIGNAL_TRAP;
1996     } else {
1997         ret = GDB_SIGNAL_INT;
1998     }
1999     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, gdb_id(env));
2000     put_packet(s, buf);
2001 }
2002 #endif
2003
2004 /* Send a gdb syscall request.
2005    This accepts limited printf-style format specifiers, specifically:
2006     %x  - target_ulong argument printed in hex.
2007     %lx - 64-bit argument printed in hex.
2008     %s  - string pointer (target_ulong) and length (int) pair.  */
2009 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
2010 {
2011     va_list va;
2012     char buf[256];
2013     char *p;
2014     target_ulong addr;
2015     uint64_t i64;
2016     GDBState *s;
2017
2018     s = gdbserver_state;
2019     if (!s)
2020         return;
2021     gdb_current_syscall_cb = cb;
2022     s->state = RS_SYSCALL;
2023 #ifndef CONFIG_USER_ONLY
2024     vm_stop(EXCP_DEBUG);
2025 #endif
2026     s->state = RS_IDLE;
2027     va_start(va, fmt);
2028     p = buf;
2029     *(p++) = 'F';
2030     while (*fmt) {
2031         if (*fmt == '%') {
2032             fmt++;
2033             switch (*fmt++) {
2034             case 'x':
2035                 addr = va_arg(va, target_ulong);
2036                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
2037                 break;
2038             case 'l':
2039                 if (*(fmt++) != 'x')
2040                     goto bad_format;
2041                 i64 = va_arg(va, uint64_t);
2042                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
2043                 break;
2044             case 's':
2045                 addr = va_arg(va, target_ulong);
2046                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
2047                               addr, va_arg(va, int));
2048                 break;
2049             default:
2050             bad_format:
2051                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2052                         fmt - 1);
2053                 break;
2054             }
2055         } else {
2056             *(p++) = *(fmt++);
2057         }
2058     }
2059     *p = 0;
2060     va_end(va);
2061     put_packet(s, buf);
2062 #ifdef CONFIG_USER_ONLY
2063     gdb_handlesig(s->c_cpu, 0);
2064 #else
2065     cpu_exit(s->c_cpu);
2066 #endif
2067 }
2068
2069 static void gdb_read_byte(GDBState *s, int ch)
2070 {
2071     int i, csum;
2072     uint8_t reply;
2073
2074 #ifndef CONFIG_USER_ONLY
2075     if (s->last_packet_len) {
2076         /* Waiting for a response to the last packet.  If we see the start
2077            of a new command then abandon the previous response.  */
2078         if (ch == '-') {
2079 #ifdef DEBUG_GDB
2080             printf("Got NACK, retransmitting\n");
2081 #endif
2082             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2083         }
2084 #ifdef DEBUG_GDB
2085         else if (ch == '+')
2086             printf("Got ACK\n");
2087         else
2088             printf("Got '%c' when expecting ACK/NACK\n", ch);
2089 #endif
2090         if (ch == '+' || ch == '$')
2091             s->last_packet_len = 0;
2092         if (ch != '$')
2093             return;
2094     }
2095     if (vm_running) {
2096         /* when the CPU is running, we cannot do anything except stop
2097            it when receiving a char */
2098         vm_stop(EXCP_INTERRUPT);
2099     } else
2100 #endif
2101     {
2102         switch(s->state) {
2103         case RS_IDLE:
2104             if (ch == '$') {
2105                 s->line_buf_index = 0;
2106                 s->state = RS_GETLINE;
2107             }
2108             break;
2109         case RS_GETLINE:
2110             if (ch == '#') {
2111             s->state = RS_CHKSUM1;
2112             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2113                 s->state = RS_IDLE;
2114             } else {
2115             s->line_buf[s->line_buf_index++] = ch;
2116             }
2117             break;
2118         case RS_CHKSUM1:
2119             s->line_buf[s->line_buf_index] = '\0';
2120             s->line_csum = fromhex(ch) << 4;
2121             s->state = RS_CHKSUM2;
2122             break;
2123         case RS_CHKSUM2:
2124             s->line_csum |= fromhex(ch);
2125             csum = 0;
2126             for(i = 0; i < s->line_buf_index; i++) {
2127                 csum += s->line_buf[i];
2128             }
2129             if (s->line_csum != (csum & 0xff)) {
2130                 reply = '-';
2131                 put_buffer(s, &reply, 1);
2132                 s->state = RS_IDLE;
2133             } else {
2134                 reply = '+';
2135                 put_buffer(s, &reply, 1);
2136                 s->state = gdb_handle_packet(s, s->line_buf);
2137             }
2138             break;
2139         default:
2140             abort();
2141         }
2142     }
2143 }
2144
2145 #ifdef CONFIG_USER_ONLY
2146 int
2147 gdb_queuesig (void)
2148 {
2149     GDBState *s;
2150
2151     s = gdbserver_state;
2152
2153     if (gdbserver_fd < 0 || s->fd < 0)
2154         return 0;
2155     else
2156         return 1;
2157 }
2158
2159 int
2160 gdb_handlesig (CPUState *env, int sig)
2161 {
2162   GDBState *s;
2163   char buf[256];
2164   int n;
2165
2166   s = gdbserver_state;
2167   if (gdbserver_fd < 0 || s->fd < 0)
2168     return sig;
2169
2170   /* disable single step if it was enabled */
2171   cpu_single_step(env, 0);
2172   tb_flush(env);
2173
2174   if (sig != 0)
2175     {
2176       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2177       put_packet(s, buf);
2178     }
2179   /* put_packet() might have detected that the peer terminated the
2180      connection.  */
2181   if (s->fd < 0)
2182       return sig;
2183
2184   sig = 0;
2185   s->state = RS_IDLE;
2186   s->running_state = 0;
2187   while (s->running_state == 0) {
2188       n = read (s->fd, buf, 256);
2189       if (n > 0)
2190         {
2191           int i;
2192
2193           for (i = 0; i < n; i++)
2194             gdb_read_byte (s, buf[i]);
2195         }
2196       else if (n == 0 || errno != EAGAIN)
2197         {
2198           /* XXX: Connection closed.  Should probably wait for annother
2199              connection before continuing.  */
2200           return sig;
2201         }
2202   }
2203   sig = s->signal;
2204   s->signal = 0;
2205   return sig;
2206 }
2207
2208 /* Tell the remote gdb that the process has exited.  */
2209 void gdb_exit(CPUState *env, int code)
2210 {
2211   GDBState *s;
2212   char buf[4];
2213
2214   s = gdbserver_state;
2215   if (gdbserver_fd < 0 || s->fd < 0)
2216     return;
2217
2218   snprintf(buf, sizeof(buf), "W%02x", code);
2219   put_packet(s, buf);
2220 }
2221
2222 /* Tell the remote gdb that the process has exited due to SIG.  */
2223 void gdb_signalled(CPUState *env, int sig)
2224 {
2225   GDBState *s;
2226   char buf[4];
2227
2228   s = gdbserver_state;
2229   if (gdbserver_fd < 0 || s->fd < 0)
2230     return;
2231
2232   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2233   put_packet(s, buf);
2234 }
2235
2236 static void gdb_accept(void)
2237 {
2238     GDBState *s;
2239     struct sockaddr_in sockaddr;
2240     socklen_t len;
2241     int val, fd;
2242
2243     for(;;) {
2244         len = sizeof(sockaddr);
2245         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2246         if (fd < 0 && errno != EINTR) {
2247             perror("accept");
2248             return;
2249         } else if (fd >= 0) {
2250             break;
2251         }
2252     }
2253
2254     /* set short latency */
2255     val = 1;
2256     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2257
2258     s = qemu_mallocz(sizeof(GDBState));
2259     s->c_cpu = first_cpu;
2260     s->g_cpu = first_cpu;
2261     s->fd = fd;
2262     gdb_has_xml = 0;
2263
2264     gdbserver_state = s;
2265
2266     fcntl(fd, F_SETFL, O_NONBLOCK);
2267 }
2268
2269 static int gdbserver_open(int port)
2270 {
2271     struct sockaddr_in sockaddr;
2272     int fd, val, ret;
2273
2274     fd = socket(PF_INET, SOCK_STREAM, 0);
2275     if (fd < 0) {
2276         perror("socket");
2277         return -1;
2278     }
2279
2280     /* allow fast reuse */
2281     val = 1;
2282     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2283
2284     sockaddr.sin_family = AF_INET;
2285     sockaddr.sin_port = htons(port);
2286     sockaddr.sin_addr.s_addr = 0;
2287     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2288     if (ret < 0) {
2289         perror("bind");
2290         return -1;
2291     }
2292     ret = listen(fd, 0);
2293     if (ret < 0) {
2294         perror("listen");
2295         return -1;
2296     }
2297     return fd;
2298 }
2299
2300 int gdbserver_start(int port)
2301 {
2302     gdbserver_fd = gdbserver_open(port);
2303     if (gdbserver_fd < 0)
2304         return -1;
2305     /* accept connections */
2306     gdb_accept();
2307     return 0;
2308 }
2309
2310 /* Disable gdb stub for child processes.  */
2311 void gdbserver_fork(CPUState *env)
2312 {
2313     GDBState *s = gdbserver_state;
2314     if (gdbserver_fd < 0 || s->fd < 0)
2315       return;
2316     close(s->fd);
2317     s->fd = -1;
2318     cpu_breakpoint_remove_all(env, BP_GDB);
2319     cpu_watchpoint_remove_all(env, BP_GDB);
2320 }
2321 #else
2322 static int gdb_chr_can_receive(void *opaque)
2323 {
2324   /* We can handle an arbitrarily large amount of data.
2325    Pick the maximum packet size, which is as good as anything.  */
2326   return MAX_PACKET_LENGTH;
2327 }
2328
2329 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2330 {
2331     int i;
2332
2333     for (i = 0; i < size; i++) {
2334         gdb_read_byte(gdbserver_state, buf[i]);
2335     }
2336 }
2337
2338 static void gdb_chr_event(void *opaque, int event)
2339 {
2340     switch (event) {
2341     case CHR_EVENT_RESET:
2342         vm_stop(EXCP_INTERRUPT);
2343         gdb_has_xml = 0;
2344         break;
2345     default:
2346         break;
2347     }
2348 }
2349
2350 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2351 {
2352     char buf[MAX_PACKET_LENGTH];
2353
2354     buf[0] = 'O';
2355     if (len > (MAX_PACKET_LENGTH/2) - 1)
2356         len = (MAX_PACKET_LENGTH/2) - 1;
2357     memtohex(buf + 1, (uint8_t *)msg, len);
2358     put_packet(s, buf);
2359 }
2360
2361 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2362 {
2363     const char *p = (const char *)buf;
2364     int max_sz;
2365
2366     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2367     for (;;) {
2368         if (len <= max_sz) {
2369             gdb_monitor_output(gdbserver_state, p, len);
2370             break;
2371         }
2372         gdb_monitor_output(gdbserver_state, p, max_sz);
2373         p += max_sz;
2374         len -= max_sz;
2375     }
2376     return len;
2377 }
2378
2379 #ifndef _WIN32
2380 static void gdb_sigterm_handler(int signal)
2381 {
2382     if (vm_running)
2383         vm_stop(EXCP_INTERRUPT);
2384 }
2385 #endif
2386
2387 int gdbserver_start(const char *device)
2388 {
2389     GDBState *s;
2390     char gdbstub_device_name[128];
2391     CharDriverState *chr = NULL;
2392     CharDriverState *mon_chr;
2393
2394     if (!device)
2395         return -1;
2396     if (strcmp(device, "none") != 0) {
2397         if (strstart(device, "tcp:", NULL)) {
2398             /* enforce required TCP attributes */
2399             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2400                      "%s,nowait,nodelay,server", device);
2401             device = gdbstub_device_name;
2402         }
2403 #ifndef _WIN32
2404         else if (strcmp(device, "stdio") == 0) {
2405             struct sigaction act;
2406
2407             memset(&act, 0, sizeof(act));
2408             act.sa_handler = gdb_sigterm_handler;
2409             sigaction(SIGINT, &act, NULL);
2410         }
2411 #endif
2412         chr = qemu_chr_open("gdb", device, NULL);
2413         if (!chr)
2414             return -1;
2415
2416         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2417                               gdb_chr_event, NULL);
2418     }
2419
2420     s = gdbserver_state;
2421     if (!s) {
2422         s = qemu_mallocz(sizeof(GDBState));
2423         gdbserver_state = s;
2424
2425         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2426
2427         /* Initialize a monitor terminal for gdb */
2428         mon_chr = qemu_mallocz(sizeof(*mon_chr));
2429         mon_chr->chr_write = gdb_monitor_write;
2430         monitor_init(mon_chr, 0);
2431     } else {
2432         if (s->chr)
2433             qemu_chr_close(s->chr);
2434         mon_chr = s->mon_chr;
2435         memset(s, 0, sizeof(GDBState));
2436     }
2437     s->c_cpu = first_cpu;
2438     s->g_cpu = first_cpu;
2439     s->chr = chr;
2440     s->state = chr ? RS_IDLE : RS_INACTIVE;
2441     s->mon_chr = mon_chr;
2442
2443     return 0;
2444 }
2445 #endif