gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "qemu-common.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "monitor.h"
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #endif
  37 #include "qemu-kvm.h"
  38
  39 #define MAX_PACKET_LENGTH 4096
  40
  41 #include "qemu_socket.h"
  42 #include "kvm.h"
  43
  44
  45 enum {
  46     GDB_SIGNAL_0 = 0,
  47     GDB_SIGNAL_INT = 2,
  48     GDB_SIGNAL_TRAP = 5,
  49     GDB_SIGNAL_UNKNOWN = 143
  50 };
  51
  52 #ifdef CONFIG_USER_ONLY
  53
  54 /* Map target signal numbers to GDB protocol signal numbers and vice
  55  * versa.  For user emulation's currently supported systems, we can
  56  * assume most signals are defined.
  57  */
  58
  59 static int gdb_signal_table[] = {
  60     0,
  61     TARGET_SIGHUP,
  62     TARGET_SIGINT,
  63     TARGET_SIGQUIT,
  64     TARGET_SIGILL,
  65     TARGET_SIGTRAP,
  66     TARGET_SIGABRT,
  67     -1, /* SIGEMT */
  68     TARGET_SIGFPE,
  69     TARGET_SIGKILL,
  70     TARGET_SIGBUS,
  71     TARGET_SIGSEGV,
  72     TARGET_SIGSYS,
  73     TARGET_SIGPIPE,
  74     TARGET_SIGALRM,
  75     TARGET_SIGTERM,
  76     TARGET_SIGURG,
  77     TARGET_SIGSTOP,
  78     TARGET_SIGTSTP,
  79     TARGET_SIGCONT,
  80     TARGET_SIGCHLD,
  81     TARGET_SIGTTIN,
  82     TARGET_SIGTTOU,
  83     TARGET_SIGIO,
  84     TARGET_SIGXCPU,
  85     TARGET_SIGXFSZ,
  86     TARGET_SIGVTALRM,
  87     TARGET_SIGPROF,
  88     TARGET_SIGWINCH,
  89     -1, /* SIGLOST */
  90     TARGET_SIGUSR1,
  91     TARGET_SIGUSR2,
  92 #ifdef TARGET_SIGPWR
  93     TARGET_SIGPWR,
  94 #else
  95     -1,
  96 #endif
  97     -1, /* SIGPOLL */
  98     -1,
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108     -1,
 109 #ifdef __SIGRTMIN
 110     __SIGRTMIN + 1,
 111     __SIGRTMIN + 2,
 112     __SIGRTMIN + 3,
 113     __SIGRTMIN + 4,
 114     __SIGRTMIN + 5,
 115     __SIGRTMIN + 6,
 116     __SIGRTMIN + 7,
 117     __SIGRTMIN + 8,
 118     __SIGRTMIN + 9,
 119     __SIGRTMIN + 10,
 120     __SIGRTMIN + 11,
 121     __SIGRTMIN + 12,
 122     __SIGRTMIN + 13,
 123     __SIGRTMIN + 14,
 124     __SIGRTMIN + 15,
 125     __SIGRTMIN + 16,
 126     __SIGRTMIN + 17,
 127     __SIGRTMIN + 18,
 128     __SIGRTMIN + 19,
 129     __SIGRTMIN + 20,
 130     __SIGRTMIN + 21,
 131     __SIGRTMIN + 22,
 132     __SIGRTMIN + 23,
 133     __SIGRTMIN + 24,
 134     __SIGRTMIN + 25,
 135     __SIGRTMIN + 26,
 136     __SIGRTMIN + 27,
 137     __SIGRTMIN + 28,
 138     __SIGRTMIN + 29,
 139     __SIGRTMIN + 30,
 140     __SIGRTMIN + 31,
 141     -1, /* SIGCANCEL */
 142     __SIGRTMIN,
 143     __SIGRTMIN + 32,
 144     __SIGRTMIN + 33,
 145     __SIGRTMIN + 34,
 146     __SIGRTMIN + 35,
 147     __SIGRTMIN + 36,
 148     __SIGRTMIN + 37,
 149     __SIGRTMIN + 38,
 150     __SIGRTMIN + 39,
 151     __SIGRTMIN + 40,
 152     __SIGRTMIN + 41,
 153     __SIGRTMIN + 42,
 154     __SIGRTMIN + 43,
 155     __SIGRTMIN + 44,
 156     __SIGRTMIN + 45,
 157     __SIGRTMIN + 46,
 158     __SIGRTMIN + 47,
 159     __SIGRTMIN + 48,
 160     __SIGRTMIN + 49,
 161     __SIGRTMIN + 50,
 162     __SIGRTMIN + 51,
 163     __SIGRTMIN + 52,
 164     __SIGRTMIN + 53,
 165     __SIGRTMIN + 54,
 166     __SIGRTMIN + 55,
 167     __SIGRTMIN + 56,
 168     __SIGRTMIN + 57,
 169     __SIGRTMIN + 58,
 170     __SIGRTMIN + 59,
 171     __SIGRTMIN + 60,
 172     __SIGRTMIN + 61,
 173     __SIGRTMIN + 62,
 174     __SIGRTMIN + 63,
 175     __SIGRTMIN + 64,
 176     __SIGRTMIN + 65,
 177     __SIGRTMIN + 66,
 178     __SIGRTMIN + 67,
 179     __SIGRTMIN + 68,
 180     __SIGRTMIN + 69,
 181     __SIGRTMIN + 70,
 182     __SIGRTMIN + 71,
 183     __SIGRTMIN + 72,
 184     __SIGRTMIN + 73,
 185     __SIGRTMIN + 74,
 186     __SIGRTMIN + 75,
 187     __SIGRTMIN + 76,
 188     __SIGRTMIN + 77,
 189     __SIGRTMIN + 78,
 190     __SIGRTMIN + 79,
 191     __SIGRTMIN + 80,
 192     __SIGRTMIN + 81,
 193     __SIGRTMIN + 82,
 194     __SIGRTMIN + 83,
 195     __SIGRTMIN + 84,
 196     __SIGRTMIN + 85,
 197     __SIGRTMIN + 86,
 198     __SIGRTMIN + 87,
 199     __SIGRTMIN + 88,
 200     __SIGRTMIN + 89,
 201     __SIGRTMIN + 90,
 202     __SIGRTMIN + 91,
 203     __SIGRTMIN + 92,
 204     __SIGRTMIN + 93,
 205     __SIGRTMIN + 94,
 206     __SIGRTMIN + 95,
 207     -1, /* SIGINFO */
 208     -1, /* UNKNOWN */
 209     -1, /* DEFAULT */
 210     -1,
 211     -1,
 212     -1,
 213     -1,
 214     -1,
 215     -1
 216 #endif
 217 };
 218 #else
 219 /* In system mode we only need SIGINT and SIGTRAP; other signals
 220    are not yet supported.  */
 221
 222 enum {
 223     TARGET_SIGINT = 2,
 224     TARGET_SIGTRAP = 5
 225 };
 226
 227 static int gdb_signal_table[] = {
 228     -1,
 229     -1,
 230     TARGET_SIGINT,
 231     -1,
 232     -1,
 233     TARGET_SIGTRAP
 234 };
 235 #endif
 236
 237 #ifdef CONFIG_USER_ONLY
 238 static int target_signal_to_gdb (int sig)
 239 {
 240     int i;
 241     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 242         if (gdb_signal_table[i] == sig)
 243             return i;
 244     return GDB_SIGNAL_UNKNOWN;
 245 }
 246 #endif
 247
 248 static int gdb_signal_to_target (int sig)
 249 {
 250     if (sig < ARRAY_SIZE (gdb_signal_table))
 251         return gdb_signal_table[sig];
 252     else
 253         return -1;
 254 }
 255
 256 //#define DEBUG_GDB
 257
 258 typedef struct GDBRegisterState {
 259     int base_reg;
 260     int num_regs;
 261     gdb_reg_cb get_reg;
 262     gdb_reg_cb set_reg;
 263     const char *xml;
 264     struct GDBRegisterState *next;
 265 } GDBRegisterState;
 266
 267 enum RSState {
 268     RS_INACTIVE,
 269     RS_IDLE,
 270     RS_GETLINE,
 271     RS_CHKSUM1,
 272     RS_CHKSUM2,
 273     RS_SYSCALL,
 274 };
 275 typedef struct GDBState {
 276     CPUState *c_cpu; /* current CPU for step/continue ops */
 277     CPUState *g_cpu; /* current CPU for other ops */
 278     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 279     enum RSState state; /* parsing state */
 280     char line_buf[MAX_PACKET_LENGTH];
 281     int line_buf_index;
 282     int line_csum;
 283     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 284     int last_packet_len;
 285     int signal;
 286 #ifdef CONFIG_USER_ONLY
 287     int fd;
 288     int running_state;
 289 #else
 290     CharDriverState *chr;
 291     CharDriverState *mon_chr;
 292 #endif
 293 } GDBState;
 294
 295 /* By default use no IRQs and no timers while single stepping so as to
 296  * make single stepping like an ICE HW step.
 297  */
 298 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 299
 300 static GDBState *gdbserver_state;
 301
 302 /* This is an ugly hack to cope with both new and old gdb.
 303    If gdb sends qXfer:features:read then assume we're talking to a newish
 304    gdb that understands target descriptions.  */
 305 static int gdb_has_xml;
 306
 307 #ifdef CONFIG_USER_ONLY
 308 /* XXX: This is not thread safe.  Do we care?  */
 309 static int gdbserver_fd = -1;
 310
 311 static int get_char(GDBState *s)
 312 {
 313     uint8_t ch;
 314     int ret;
 315
 316     for(;;) {
 317         ret = recv(s->fd, &ch, 1, 0);
 318         if (ret < 0) {
 319             if (errno == ECONNRESET)
 320                 s->fd = -1;
 321             if (errno != EINTR && errno != EAGAIN)
 322                 return -1;
 323         } else if (ret == 0) {
 324             close(s->fd);
 325             s->fd = -1;
 326             return -1;
 327         } else {
 328             break;
 329         }
 330     }
 331     return ch;
 332 }
 333 #endif
 334
 335 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 336
 337 static enum {
 338     GDB_SYS_UNKNOWN,
 339     GDB_SYS_ENABLED,
 340     GDB_SYS_DISABLED,
 341 } gdb_syscall_mode;
 342
 343 /* If gdb is connected when the first semihosting syscall occurs then use
 344    remote gdb syscalls.  Otherwise use native file IO.  */
 345 int use_gdb_syscalls(void)
 346 {
 347     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 348         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 349                                             : GDB_SYS_DISABLED);
 350     }
 351     return gdb_syscall_mode == GDB_SYS_ENABLED;
 352 }
 353
 354 /* Resume execution.  */
 355 static inline void gdb_continue(GDBState *s)
 356 {
 357 #ifdef CONFIG_USER_ONLY
 358     s->running_state = 1;
 359 #else
 360     vm_start();
 361 #endif
 362 }
 363
 364 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 365 {
 366 #ifdef CONFIG_USER_ONLY
 367     int ret;
 368
 369     while (len > 0) {
 370         ret = send(s->fd, buf, len, 0);
 371         if (ret < 0) {
 372             if (errno != EINTR && errno != EAGAIN)
 373                 return;
 374         } else {
 375             buf += ret;
 376             len -= ret;
 377         }
 378     }
 379 #else
 380     qemu_chr_write(s->chr, buf, len);
 381 #endif
 382 }
 383
 384 static inline int fromhex(int v)
 385 {
 386     if (v >= '0' && v <= '9')
 387         return v - '0';
 388     else if (v >= 'A' && v <= 'F')
 389         return v - 'A' + 10;
 390     else if (v >= 'a' && v <= 'f')
 391         return v - 'a' + 10;
 392     else
 393         return 0;
 394 }
 395
 396 static inline int tohex(int v)
 397 {
 398     if (v < 10)
 399         return v + '0';
 400     else
 401         return v - 10 + 'a';
 402 }
 403
 404 static void memtohex(char *buf, const uint8_t *mem, int len)
 405 {
 406     int i, c;
 407     char *q;
 408     q = buf;
 409     for(i = 0; i < len; i++) {
 410         c = mem[i];
 411         *q++ = tohex(c >> 4);
 412         *q++ = tohex(c & 0xf);
 413     }
 414     *q = '\0';
 415 }
 416
 417 static void hextomem(uint8_t *mem, const char *buf, int len)
 418 {
 419     int i;
 420
 421     for(i = 0; i < len; i++) {
 422         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 423         buf += 2;
 424     }
 425 }
 426
 427 /* return -1 if error, 0 if OK */
 428 static int put_packet_binary(GDBState *s, const char *buf, int len)
 429 {
 430     int csum, i;
 431     uint8_t *p;
 432
 433     for(;;) {
 434         p = s->last_packet;
 435         *(p++) = '$';
 436         memcpy(p, buf, len);
 437         p += len;
 438         csum = 0;
 439         for(i = 0; i < len; i++) {
 440             csum += buf[i];
 441         }
 442         *(p++) = '#';
 443         *(p++) = tohex((csum >> 4) & 0xf);
 444         *(p++) = tohex((csum) & 0xf);
 445
 446         s->last_packet_len = p - s->last_packet;
 447         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 448
 449 #ifdef CONFIG_USER_ONLY
 450         i = get_char(s);
 451         if (i < 0)
 452             return -1;
 453         if (i == '+')
 454             break;
 455 #else
 456         break;
 457 #endif
 458     }
 459     return 0;
 460 }
 461
 462 /* return -1 if error, 0 if OK */
 463 static int put_packet(GDBState *s, const char *buf)
 464 {
 465 #ifdef DEBUG_GDB
 466     printf("reply='%s'\n", buf);
 467 #endif
 468
 469     return put_packet_binary(s, buf, strlen(buf));
 470 }
 471
 472 /* The GDB remote protocol transfers values in target byte order.  This means
 473    we can use the raw memory access routines to access the value buffer.
 474    Conveniently, these also handle the case where the buffer is mis-aligned.
 475  */
 476 #define GET_REG8(val) do { \
 477     stb_p(mem_buf, val); \
 478     return 1; \
 479     } while(0)
 480 #define GET_REG16(val) do { \
 481     stw_p(mem_buf, val); \
 482     return 2; \
 483     } while(0)
 484 #define GET_REG32(val) do { \
 485     stl_p(mem_buf, val); \
 486     return 4; \
 487     } while(0)
 488 #define GET_REG64(val) do { \
 489     stq_p(mem_buf, val); \
 490     return 8; \
 491     } while(0)
 492
 493 #if TARGET_LONG_BITS == 64
 494 #define GET_REGL(val) GET_REG64(val)
 495 #define ldtul_p(addr) ldq_p(addr)
 496 #else
 497 #define GET_REGL(val) GET_REG32(val)
 498 #define ldtul_p(addr) ldl_p(addr)
 499 #endif
 500
 501 #if defined(TARGET_I386)
 502
 503 #ifdef TARGET_X86_64
 504 static const int gpr_map[16] = {
 505     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 506     8, 9, 10, 11, 12, 13, 14, 15
 507 };
 508 #else
 509 static const int gpr_map[8] = {0, 1, 2, 3, 4, 5, 6, 7};
 510 #endif
 511
 512 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 513
 514 #define IDX_IP_REG      CPU_NB_REGS
 515 #define IDX_FLAGS_REG   (IDX_IP_REG + 1)
 516 #define IDX_SEG_REGS    (IDX_FLAGS_REG + 1)
 517 #define IDX_FP_REGS     (IDX_SEG_REGS + 6)
 518 #define IDX_XMM_REGS    (IDX_FP_REGS + 16)
 519 #define IDX_MXCSR_REG   (IDX_XMM_REGS + CPU_NB_REGS)
 520
 521 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 522 {
 523     if (n < CPU_NB_REGS) {
 524         GET_REGL(env->regs[gpr_map[n]]);
 525     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 526 #ifdef USE_X86LDOUBLE
 527         /* FIXME: byteswap float values - after fixing fpregs layout. */
 528         memcpy(mem_buf, &env->fpregs[n - IDX_FP_REGS], 10);
 529 #else
 530         memset(mem_buf, 0, 10);
 531 #endif
 532         return 10;
 533     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 534         n -= IDX_XMM_REGS;
 535         stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 536         stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 537         return 16;
 538     } else {
 539         switch (n) {
 540         case IDX_IP_REG:    GET_REGL(env->eip);
 541         case IDX_FLAGS_REG: GET_REG32(env->eflags);
 542
 543         case IDX_SEG_REGS:     GET_REG32(env->segs[R_CS].selector);
 544         case IDX_SEG_REGS + 1: GET_REG32(env->segs[R_SS].selector);
 545         case IDX_SEG_REGS + 2: GET_REG32(env->segs[R_DS].selector);
 546         case IDX_SEG_REGS + 3: GET_REG32(env->segs[R_ES].selector);
 547         case IDX_SEG_REGS + 4: GET_REG32(env->segs[R_FS].selector);
 548         case IDX_SEG_REGS + 5: GET_REG32(env->segs[R_GS].selector);
 549
 550         case IDX_FP_REGS + 8:  GET_REG32(env->fpuc);
 551         case IDX_FP_REGS + 9:  GET_REG32((env->fpus & ~0x3800) |
 552                                          (env->fpstt & 0x7) << 11);
 553         case IDX_FP_REGS + 10: GET_REG32(0); /* ftag */
 554         case IDX_FP_REGS + 11: GET_REG32(0); /* fiseg */
 555         case IDX_FP_REGS + 12: GET_REG32(0); /* fioff */
 556         case IDX_FP_REGS + 13: GET_REG32(0); /* foseg */
 557         case IDX_FP_REGS + 14: GET_REG32(0); /* fooff */
 558         case IDX_FP_REGS + 15: GET_REG32(0); /* fop */
 559
 560         case IDX_MXCSR_REG: GET_REG32(env->mxcsr);
 561         }
 562     }
 563     return 0;
 564 }
 565
 566 static int cpu_x86_gdb_load_seg(CPUState *env, int sreg, uint8_t *mem_buf)
 567 {
 568     uint16_t selector = ldl_p(mem_buf);
 569
 570     if (selector != env->segs[sreg].selector) {
 571 #if defined(CONFIG_USER_ONLY)
 572         cpu_x86_load_seg(env, sreg, selector);
 573 #else
 574         unsigned int limit, flags;
 575         target_ulong base;
 576
 577         if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK)) {
 578             base = selector << 4;
 579             limit = 0xffff;
 580             flags = 0;
 581         } else {
 582             if (!cpu_x86_get_descr_debug(env, selector, &base, &limit, &flags))
 583                 return 4;
 584         }
 585         cpu_x86_load_seg_cache(env, sreg, selector, base, limit, flags);
 586 #endif
 587     }
 588     return 4;
 589 }
 590
 591 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 592 {
 593     uint32_t tmp;
 594
 595     if (n < CPU_NB_REGS) {
 596         env->regs[gpr_map[n]] = ldtul_p(mem_buf);
 597         return sizeof(target_ulong);
 598     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 599 #ifdef USE_X86LDOUBLE
 600         /* FIXME: byteswap float values - after fixing fpregs layout. */
 601         memcpy(&env->fpregs[n - IDX_FP_REGS], mem_buf, 10);
 602 #endif
 603         return 10;
 604     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 605         n -= IDX_XMM_REGS;
 606         env->xmm_regs[n].XMM_Q(0) = ldq_p(mem_buf);
 607         env->xmm_regs[n].XMM_Q(1) = ldq_p(mem_buf + 8);
 608         return 16;
 609     } else {
 610         switch (n) {
 611         case IDX_IP_REG:
 612             env->eip = ldtul_p(mem_buf);
 613             return sizeof(target_ulong);
 614         case IDX_FLAGS_REG:
 615             env->eflags = ldl_p(mem_buf);
 616             return 4;
 617
 618         case IDX_SEG_REGS:     return cpu_x86_gdb_load_seg(env, R_CS, mem_buf);
 619         case IDX_SEG_REGS + 1: return cpu_x86_gdb_load_seg(env, R_SS, mem_buf);
 620         case IDX_SEG_REGS + 2: return cpu_x86_gdb_load_seg(env, R_DS, mem_buf);
 621         case IDX_SEG_REGS + 3: return cpu_x86_gdb_load_seg(env, R_ES, mem_buf);
 622         case IDX_SEG_REGS + 4: return cpu_x86_gdb_load_seg(env, R_FS, mem_buf);
 623         case IDX_SEG_REGS + 5: return cpu_x86_gdb_load_seg(env, R_GS, mem_buf);
 624
 625         case IDX_FP_REGS + 8:
 626             env->fpuc = ldl_p(mem_buf);
 627             return 4;
 628         case IDX_FP_REGS + 9:
 629             tmp = ldl_p(mem_buf);
 630             env->fpstt = (tmp >> 11) & 7;
 631             env->fpus = tmp & ~0x3800;
 632             return 4;
 633         case IDX_FP_REGS + 10: /* ftag */  return 4;
 634         case IDX_FP_REGS + 11: /* fiseg */ return 4;
 635         case IDX_FP_REGS + 12: /* fioff */ return 4;
 636         case IDX_FP_REGS + 13: /* foseg */ return 4;
 637         case IDX_FP_REGS + 14: /* fooff */ return 4;
 638         case IDX_FP_REGS + 15: /* fop */   return 4;
 639
 640         case IDX_MXCSR_REG:
 641             env->mxcsr = ldl_p(mem_buf);
 642             return 4;
 643         }
 644     }
 645     /* Unrecognised register.  */
 646     return 0;
 647 }
 648
 649 #elif defined (TARGET_PPC)
 650
 651 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 652    expects whatever the target description contains.  Due to a
 653    historical mishap the FP registers appear in between core integer
 654    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 655    FP regs zero size when talking to a newer gdb.  */
 656 #define NUM_CORE_REGS 71
 657 #if defined (TARGET_PPC64)
 658 #define GDB_CORE_XML "power64-core.xml"
 659 #else
 660 #define GDB_CORE_XML "power-core.xml"
 661 #endif
 662
 663 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 664 {
 665     if (n < 32) {
 666         /* gprs */
 667         GET_REGL(env->gpr[n]);
 668     } else if (n < 64) {
 669         /* fprs */
 670         if (gdb_has_xml)
 671             return 0;
 672         stfq_p(mem_buf, env->fpr[n-32]);
 673         return 8;
 674     } else {
 675         switch (n) {
 676         case 64: GET_REGL(env->nip);
 677         case 65: GET_REGL(env->msr);
 678         case 66:
 679             {
 680                 uint32_t cr = 0;
 681                 int i;
 682                 for (i = 0; i < 8; i++)
 683                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 684                 GET_REG32(cr);
 685             }
 686         case 67: GET_REGL(env->lr);
 687         case 68: GET_REGL(env->ctr);
 688         case 69: GET_REGL(env->xer);
 689         case 70:
 690             {
 691                 if (gdb_has_xml)
 692                     return 0;
 693                 GET_REG32(0); /* fpscr */
 694             }
 695         }
 696     }
 697     return 0;
 698 }
 699
 700 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 701 {
 702     if (n < 32) {
 703         /* gprs */
 704         env->gpr[n] = ldtul_p(mem_buf);
 705         return sizeof(target_ulong);
 706     } else if (n < 64) {
 707         /* fprs */
 708         if (gdb_has_xml)
 709             return 0;
 710         env->fpr[n-32] = ldfq_p(mem_buf);
 711         return 8;
 712     } else {
 713         switch (n) {
 714         case 64:
 715             env->nip = ldtul_p(mem_buf);
 716             return sizeof(target_ulong);
 717         case 65:
 718             ppc_store_msr(env, ldtul_p(mem_buf));
 719             return sizeof(target_ulong);
 720         case 66:
 721             {
 722                 uint32_t cr = ldl_p(mem_buf);
 723                 int i;
 724                 for (i = 0; i < 8; i++)
 725                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 726                 return 4;
 727             }
 728         case 67:
 729             env->lr = ldtul_p(mem_buf);
 730             return sizeof(target_ulong);
 731         case 68:
 732             env->ctr = ldtul_p(mem_buf);
 733             return sizeof(target_ulong);
 734         case 69:
 735             env->xer = ldtul_p(mem_buf);
 736             return sizeof(target_ulong);
 737         case 70:
 738             /* fpscr */
 739             if (gdb_has_xml)
 740                 return 0;
 741             return 4;
 742         }
 743     }
 744     return 0;
 745 }
 746
 747 #elif defined (TARGET_SPARC)
 748
 749 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 750 #define NUM_CORE_REGS 86
 751 #else
 752 #define NUM_CORE_REGS 72
 753 #endif
 754
 755 #ifdef TARGET_ABI32
 756 #define GET_REGA(val) GET_REG32(val)
 757 #else
 758 #define GET_REGA(val) GET_REGL(val)
 759 #endif
 760
 761 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 762 {
 763     if (n < 8) {
 764         /* g0..g7 */
 765         GET_REGA(env->gregs[n]);
 766     }
 767     if (n < 32) {
 768         /* register window */
 769         GET_REGA(env->regwptr[n - 8]);
 770     }
 771 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 772     if (n < 64) {
 773         /* fprs */
 774         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 775     }
 776     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 777     switch (n) {
 778     case 64: GET_REGA(env->y);
 779     case 65: GET_REGA(GET_PSR(env));
 780     case 66: GET_REGA(env->wim);
 781     case 67: GET_REGA(env->tbr);
 782     case 68: GET_REGA(env->pc);
 783     case 69: GET_REGA(env->npc);
 784     case 70: GET_REGA(env->fsr);
 785     case 71: GET_REGA(0); /* csr */
 786     default: GET_REGA(0);
 787     }
 788 #else
 789     if (n < 64) {
 790         /* f0-f31 */
 791         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 792     }
 793     if (n < 80) {
 794         /* f32-f62 (double width, even numbers only) */
 795         uint64_t val;
 796
 797         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 798         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 799         GET_REG64(val);
 800     }
 801     switch (n) {
 802     case 80: GET_REGL(env->pc);
 803     case 81: GET_REGL(env->npc);
 804     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 805                            ((env->asi & 0xff) << 24) |
 806                            ((env->pstate & 0xfff) << 8) |
 807                            GET_CWP64(env));
 808     case 83: GET_REGL(env->fsr);
 809     case 84: GET_REGL(env->fprs);
 810     case 85: GET_REGL(env->y);
 811     }
 812 #endif
 813     return 0;
 814 }
 815
 816 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 817 {
 818 #if defined(TARGET_ABI32)
 819     abi_ulong tmp;
 820
 821     tmp = ldl_p(mem_buf);
 822 #else
 823     target_ulong tmp;
 824
 825     tmp = ldtul_p(mem_buf);
 826 #endif
 827
 828     if (n < 8) {
 829         /* g0..g7 */
 830         env->gregs[n] = tmp;
 831     } else if (n < 32) {
 832         /* register window */
 833         env->regwptr[n - 8] = tmp;
 834     }
 835 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 836     else if (n < 64) {
 837         /* fprs */
 838         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 839     } else {
 840         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 841         switch (n) {
 842         case 64: env->y = tmp; break;
 843         case 65: PUT_PSR(env, tmp); break;
 844         case 66: env->wim = tmp; break;
 845         case 67: env->tbr = tmp; break;
 846         case 68: env->pc = tmp; break;
 847         case 69: env->npc = tmp; break;
 848         case 70: env->fsr = tmp; break;
 849         default: return 0;
 850         }
 851     }
 852     return 4;
 853 #else
 854     else if (n < 64) {
 855         /* f0-f31 */
 856         env->fpr[n] = ldfl_p(mem_buf);
 857         return 4;
 858     } else if (n < 80) {
 859         /* f32-f62 (double width, even numbers only) */
 860         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 861         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 862     } else {
 863         switch (n) {
 864         case 80: env->pc = tmp; break;
 865         case 81: env->npc = tmp; break;
 866         case 82:
 867             PUT_CCR(env, tmp >> 32);
 868             env->asi = (tmp >> 24) & 0xff;
 869             env->pstate = (tmp >> 8) & 0xfff;
 870             PUT_CWP64(env, tmp & 0xff);
 871             break;
 872         case 83: env->fsr = tmp; break;
 873         case 84: env->fprs = tmp; break;
 874         case 85: env->y = tmp; break;
 875         default: return 0;
 876         }
 877     }
 878     return 8;
 879 #endif
 880 }
 881 #elif defined (TARGET_ARM)
 882
 883 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 884    whatever the target description contains.  Due to a historical mishap
 885    the FPA registers appear in between core integer regs and the CPSR.
 886    We hack round this by giving the FPA regs zero size when talking to a
 887    newer gdb.  */
 888 #define NUM_CORE_REGS 26
 889 #define GDB_CORE_XML "arm-core.xml"
 890
 891 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 892 {
 893     if (n < 16) {
 894         /* Core integer register.  */
 895         GET_REG32(env->regs[n]);
 896     }
 897     if (n < 24) {
 898         /* FPA registers.  */
 899         if (gdb_has_xml)
 900             return 0;
 901         memset(mem_buf, 0, 12);
 902         return 12;
 903     }
 904     switch (n) {
 905     case 24:
 906         /* FPA status register.  */
 907         if (gdb_has_xml)
 908             return 0;
 909         GET_REG32(0);
 910     case 25:
 911         /* CPSR */
 912         GET_REG32(cpsr_read(env));
 913     }
 914     /* Unknown register.  */
 915     return 0;
 916 }
 917
 918 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 919 {
 920     uint32_t tmp;
 921
 922     tmp = ldl_p(mem_buf);
 923
 924     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 925        cause problems if we ever implement the Jazelle DBX extensions.  */
 926     if (n == 15)
 927         tmp &= ~1;
 928
 929     if (n < 16) {
 930         /* Core integer register.  */
 931         env->regs[n] = tmp;
 932         return 4;
 933     }
 934     if (n < 24) { /* 16-23 */
 935         /* FPA registers (ignored).  */
 936         if (gdb_has_xml)
 937             return 0;
 938         return 12;
 939     }
 940     switch (n) {
 941     case 24:
 942         /* FPA status register (ignored).  */
 943         if (gdb_has_xml)
 944             return 0;
 945         return 4;
 946     case 25:
 947         /* CPSR */
 948         cpsr_write (env, tmp, 0xffffffff);
 949         return 4;
 950     }
 951     /* Unknown register.  */
 952     return 0;
 953 }
 954
 955 #elif defined (TARGET_M68K)
 956
 957 #define NUM_CORE_REGS 18
 958
 959 #define GDB_CORE_XML "cf-core.xml"
 960
 961 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 962 {
 963     if (n < 8) {
 964         /* D0-D7 */
 965         GET_REG32(env->dregs[n]);
 966     } else if (n < 16) {
 967         /* A0-A7 */
 968         GET_REG32(env->aregs[n - 8]);
 969     } else {
 970         switch (n) {
 971         case 16: GET_REG32(env->sr);
 972         case 17: GET_REG32(env->pc);
 973         }
 974     }
 975     /* FP registers not included here because they vary between
 976        ColdFire and m68k.  Use XML bits for these.  */
 977     return 0;
 978 }
 979
 980 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 981 {
 982     uint32_t tmp;
 983
 984     tmp = ldl_p(mem_buf);
 985
 986     if (n < 8) {
 987         /* D0-D7 */
 988         env->dregs[n] = tmp;
 989     } else if (n < 8) {
 990         /* A0-A7 */
 991         env->aregs[n - 8] = tmp;
 992     } else {
 993         switch (n) {
 994         case 16: env->sr = tmp; break;
 995         case 17: env->pc = tmp; break;
 996         default: return 0;
 997         }
 998     }
 999     return 4;
1000 }
1001 #elif defined (TARGET_MIPS)
1002
1003 #define NUM_CORE_REGS 73
1004
1005 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1006 {
1007     if (n < 32) {
1008         GET_REGL(env->active_tc.gpr[n]);
1009     }
1010     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
1011         if (n >= 38 && n < 70) {
1012             if (env->CP0_Status & (1 << CP0St_FR))
1013                 GET_REGL(env->active_fpu.fpr[n - 38].d);
1014             else
1015                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
1016         }
1017         switch (n) {
1018         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
1019         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
1020         }
1021     }
1022     switch (n) {
1023     case 32: GET_REGL((int32_t)env->CP0_Status);
1024     case 33: GET_REGL(env->active_tc.LO[0]);
1025     case 34: GET_REGL(env->active_tc.HI[0]);
1026     case 35: GET_REGL(env->CP0_BadVAddr);
1027     case 36: GET_REGL((int32_t)env->CP0_Cause);
1028     case 37: GET_REGL(env->active_tc.PC);
1029     case 72: GET_REGL(0); /* fp */
1030     case 89: GET_REGL((int32_t)env->CP0_PRid);
1031     }
1032     if (n >= 73 && n <= 88) {
1033         /* 16 embedded regs.  */
1034         GET_REGL(0);
1035     }
1036
1037     return 0;
1038 }
1039
1040 /* convert MIPS rounding mode in FCR31 to IEEE library */
1041 static unsigned int ieee_rm[] =
1042   {
1043     float_round_nearest_even,
1044     float_round_to_zero,
1045     float_round_up,
1046     float_round_down
1047   };
1048 #define RESTORE_ROUNDING_MODE \
1049     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1050
1051 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1052 {
1053     target_ulong tmp;
1054
1055     tmp = ldtul_p(mem_buf);
1056
1057     if (n < 32) {
1058         env->active_tc.gpr[n] = tmp;
1059         return sizeof(target_ulong);
1060     }
1061     if (env->CP0_Config1 & (1 << CP0C1_FP)
1062             && n >= 38 && n < 73) {
1063         if (n < 70) {
1064             if (env->CP0_Status & (1 << CP0St_FR))
1065               env->active_fpu.fpr[n - 38].d = tmp;
1066             else
1067               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1068         }
1069         switch (n) {
1070         case 70:
1071             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1072             /* set rounding mode */
1073             RESTORE_ROUNDING_MODE;
1074 #ifndef CONFIG_SOFTFLOAT
1075             /* no floating point exception for native float */
1076             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1077 #endif
1078             break;
1079         case 71: env->active_fpu.fcr0 = tmp; break;
1080         }
1081         return sizeof(target_ulong);
1082     }
1083     switch (n) {
1084     case 32: env->CP0_Status = tmp; break;
1085     case 33: env->active_tc.LO[0] = tmp; break;
1086     case 34: env->active_tc.HI[0] = tmp; break;
1087     case 35: env->CP0_BadVAddr = tmp; break;
1088     case 36: env->CP0_Cause = tmp; break;
1089     case 37: env->active_tc.PC = tmp; break;
1090     case 72: /* fp, ignored */ break;
1091     default:
1092         if (n > 89)
1093             return 0;
1094         /* Other registers are readonly.  Ignore writes.  */
1095         break;
1096     }
1097
1098     return sizeof(target_ulong);
1099 }
1100 #elif defined (TARGET_SH4)
1101
1102 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1103 /* FIXME: We should use XML for this.  */
1104
1105 #define NUM_CORE_REGS 59
1106
1107 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1108 {
1109     if (n < 8) {
1110         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1111             GET_REGL(env->gregs[n + 16]);
1112         } else {
1113             GET_REGL(env->gregs[n]);
1114         }
1115     } else if (n < 16) {
1116         GET_REGL(env->gregs[n - 8]);
1117     } else if (n >= 25 && n < 41) {
1118         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1119     } else if (n >= 43 && n < 51) {
1120         GET_REGL(env->gregs[n - 43]);
1121     } else if (n >= 51 && n < 59) {
1122         GET_REGL(env->gregs[n - (51 - 16)]);
1123     }
1124     switch (n) {
1125     case 16: GET_REGL(env->pc);
1126     case 17: GET_REGL(env->pr);
1127     case 18: GET_REGL(env->gbr);
1128     case 19: GET_REGL(env->vbr);
1129     case 20: GET_REGL(env->mach);
1130     case 21: GET_REGL(env->macl);
1131     case 22: GET_REGL(env->sr);
1132     case 23: GET_REGL(env->fpul);
1133     case 24: GET_REGL(env->fpscr);
1134     case 41: GET_REGL(env->ssr);
1135     case 42: GET_REGL(env->spc);
1136     }
1137
1138     return 0;
1139 }
1140
1141 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1142 {
1143     uint32_t tmp;
1144
1145     tmp = ldl_p(mem_buf);
1146
1147     if (n < 8) {
1148         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1149             env->gregs[n + 16] = tmp;
1150         } else {
1151             env->gregs[n] = tmp;
1152         }
1153         return 4;
1154     } else if (n < 16) {
1155         env->gregs[n - 8] = tmp;
1156         return 4;
1157     } else if (n >= 25 && n < 41) {
1158         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1159     } else if (n >= 43 && n < 51) {
1160         env->gregs[n - 43] = tmp;
1161         return 4;
1162     } else if (n >= 51 && n < 59) {
1163         env->gregs[n - (51 - 16)] = tmp;
1164         return 4;
1165     }
1166     switch (n) {
1167     case 16: env->pc = tmp;
1168     case 17: env->pr = tmp;
1169     case 18: env->gbr = tmp;
1170     case 19: env->vbr = tmp;
1171     case 20: env->mach = tmp;
1172     case 21: env->macl = tmp;
1173     case 22: env->sr = tmp;
1174     case 23: env->fpul = tmp;
1175     case 24: env->fpscr = tmp;
1176     case 41: env->ssr = tmp;
1177     case 42: env->spc = tmp;
1178     default: return 0;
1179     }
1180
1181     return 4;
1182 }
1183 #elif defined (TARGET_MICROBLAZE)
1184
1185 #define NUM_CORE_REGS (32 + 5)
1186
1187 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1188 {
1189     if (n < 32) {
1190         GET_REG32(env->regs[n]);
1191     } else {
1192         GET_REG32(env->sregs[n - 32]);
1193     }
1194     return 0;
1195 }
1196
1197 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1198 {
1199     uint32_t tmp;
1200
1201     if (n > NUM_CORE_REGS)
1202         return 0;
1203
1204     tmp = ldl_p(mem_buf);
1205
1206     if (n < 32) {
1207         env->regs[n] = tmp;
1208     } else {
1209         env->sregs[n - 32] = tmp;
1210     }
1211     return 4;
1212 }
1213 #elif defined (TARGET_CRIS)
1214
1215 #define NUM_CORE_REGS 49
1216
1217 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1218 {
1219     uint8_t srs;
1220
1221     srs = env->pregs[PR_SRS];
1222     if (n < 16) {
1223         GET_REG32(env->regs[n]);
1224     }
1225
1226     if (n >= 21 && n < 32) {
1227         GET_REG32(env->pregs[n - 16]);
1228     }
1229     if (n >= 33 && n < 49) {
1230         GET_REG32(env->sregs[srs][n - 33]);
1231     }
1232     switch (n) {
1233     case 16: GET_REG8(env->pregs[0]);
1234     case 17: GET_REG8(env->pregs[1]);
1235     case 18: GET_REG32(env->pregs[2]);
1236     case 19: GET_REG8(srs);
1237     case 20: GET_REG16(env->pregs[4]);
1238     case 32: GET_REG32(env->pc);
1239     }
1240
1241     return 0;
1242 }
1243
1244 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1245 {
1246     uint32_t tmp;
1247
1248     if (n > 49)
1249         return 0;
1250
1251     tmp = ldl_p(mem_buf);
1252
1253     if (n < 16) {
1254         env->regs[n] = tmp;
1255     }
1256
1257     if (n >= 21 && n < 32) {
1258         env->pregs[n - 16] = tmp;
1259     }
1260
1261     /* FIXME: Should support function regs be writable?  */
1262     switch (n) {
1263     case 16: return 1;
1264     case 17: return 1;
1265     case 18: env->pregs[PR_PID] = tmp; break;
1266     case 19: return 1;
1267     case 20: return 2;
1268     case 32: env->pc = tmp; break;
1269     }
1270
1271     return 4;
1272 }
1273 #elif defined (TARGET_ALPHA)
1274
1275 #define NUM_CORE_REGS 65
1276
1277 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1278 {
1279     if (n < 31) {
1280        GET_REGL(env->ir[n]);
1281     }
1282     else if (n == 31) {
1283        GET_REGL(0);
1284     }
1285     else if (n<63) {
1286        uint64_t val;
1287
1288        val=*((uint64_t *)&env->fir[n-32]);
1289        GET_REGL(val);
1290     }
1291     else if (n==63) {
1292        GET_REGL(env->fpcr);
1293     }
1294     else if (n==64) {
1295        GET_REGL(env->pc);
1296     }
1297     else {
1298        GET_REGL(0);
1299     }
1300
1301     return 0;
1302 }
1303
1304 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1305 {
1306     target_ulong tmp;
1307     tmp = ldtul_p(mem_buf);
1308
1309     if (n < 31) {
1310         env->ir[n] = tmp;
1311     }
1312
1313     if (n > 31 && n < 63) {
1314         env->fir[n - 32] = ldfl_p(mem_buf);
1315     }
1316
1317     if (n == 64 ) {
1318        env->pc=tmp;
1319     }
1320
1321     return 8;
1322 }
1323 #else
1324
1325 #define NUM_CORE_REGS 0
1326
1327 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1328 {
1329     return 0;
1330 }
1331
1332 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1333 {
1334     return 0;
1335 }
1336
1337 #endif
1338
1339 static int num_g_regs = NUM_CORE_REGS;
1340
1341 #ifdef GDB_CORE_XML
1342 /* Encode data using the encoding for 'x' packets.  */
1343 static int memtox(char *buf, const char *mem, int len)
1344 {
1345     char *p = buf;
1346     char c;
1347
1348     while (len--) {
1349         c = *(mem++);
1350         switch (c) {
1351         case '#': case '$': case '*': case '}':
1352             *(p++) = '}';
1353             *(p++) = c ^ 0x20;
1354             break;
1355         default:
1356             *(p++) = c;
1357             break;
1358         }
1359     }
1360     return p - buf;
1361 }
1362
1363 static const char *get_feature_xml(const char *p, const char **newp)
1364 {
1365     extern const char *const xml_builtin[][2];
1366     size_t len;
1367     int i;
1368     const char *name;
1369     static char target_xml[1024];
1370
1371     len = 0;
1372     while (p[len] && p[len] != ':')
1373         len++;
1374     *newp = p + len;
1375
1376     name = NULL;
1377     if (strncmp(p, "target.xml", len) == 0) {
1378         /* Generate the XML description for this CPU.  */
1379         if (!target_xml[0]) {
1380             GDBRegisterState *r;
1381
1382             snprintf(target_xml, sizeof(target_xml),
1383                      "<?xml version=\"1.0\"?>"
1384                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1385                      "<target>"
1386                      "<xi:include href=\"%s\"/>",
1387                      GDB_CORE_XML);
1388
1389             for (r = first_cpu->gdb_regs; r; r = r->next) {
1390                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
1391                 pstrcat(target_xml, sizeof(target_xml), r->xml);
1392                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
1393             }
1394             pstrcat(target_xml, sizeof(target_xml), "</target>");
1395         }
1396         return target_xml;
1397     }
1398     for (i = 0; ; i++) {
1399         name = xml_builtin[i][0];
1400         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1401             break;
1402     }
1403     return name ? xml_builtin[i][1] : NULL;
1404 }
1405 #endif
1406
1407 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1408 {
1409     GDBRegisterState *r;
1410
1411     if (reg < NUM_CORE_REGS)
1412         return cpu_gdb_read_register(env, mem_buf, reg);
1413
1414     for (r = env->gdb_regs; r; r = r->next) {
1415         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1416             return r->get_reg(env, mem_buf, reg - r->base_reg);
1417         }
1418     }
1419     return 0;
1420 }
1421
1422 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1423 {
1424     GDBRegisterState *r;
1425
1426     if (reg < NUM_CORE_REGS)
1427         return cpu_gdb_write_register(env, mem_buf, reg);
1428
1429     for (r = env->gdb_regs; r; r = r->next) {
1430         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1431             return r->set_reg(env, mem_buf, reg - r->base_reg);
1432         }
1433     }
1434     return 0;
1435 }
1436
1437 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1438    specifies the first register number and these registers are included in
1439    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1440    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1441  */
1442
1443 void gdb_register_coprocessor(CPUState * env,
1444                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1445                              int num_regs, const char *xml, int g_pos)
1446 {
1447     GDBRegisterState *s;
1448     GDBRegisterState **p;
1449     static int last_reg = NUM_CORE_REGS;
1450
1451     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1452     s->base_reg = last_reg;
1453     s->num_regs = num_regs;
1454     s->get_reg = get_reg;
1455     s->set_reg = set_reg;
1456     s->xml = xml;
1457     p = &env->gdb_regs;
1458     while (*p) {
1459         /* Check for duplicates.  */
1460         if (strcmp((*p)->xml, xml) == 0)
1461             return;
1462         p = &(*p)->next;
1463     }
1464     /* Add to end of list.  */
1465     last_reg += num_regs;
1466     *p = s;
1467     if (g_pos) {
1468         if (g_pos != s->base_reg) {
1469             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1470                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1471         } else {
1472             num_g_regs = last_reg;
1473         }
1474     }
1475 }
1476
1477 #ifndef CONFIG_USER_ONLY
1478 static const int xlat_gdb_type[] = {
1479     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1480     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1481     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1482 };
1483 #endif
1484
1485 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1486 {
1487     CPUState *env;
1488     int err = 0;
1489
1490     if (kvm_enabled())
1491         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1492
1493     switch (type) {
1494     case GDB_BREAKPOINT_SW:
1495     case GDB_BREAKPOINT_HW:
1496         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1497             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1498             if (err)
1499                 break;
1500         }
1501         return err;
1502 #ifndef CONFIG_USER_ONLY
1503     case GDB_WATCHPOINT_WRITE:
1504     case GDB_WATCHPOINT_READ:
1505     case GDB_WATCHPOINT_ACCESS:
1506         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1507             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1508                                         NULL);
1509             if (err)
1510                 break;
1511         }
1512         return err;
1513 #endif
1514     default:
1515         return -ENOSYS;
1516     }
1517 }
1518
1519 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1520 {
1521     CPUState *env;
1522     int err = 0;
1523
1524     if (kvm_enabled())
1525         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1526
1527     switch (type) {
1528     case GDB_BREAKPOINT_SW:
1529     case GDB_BREAKPOINT_HW:
1530         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1531             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1532             if (err)
1533                 break;
1534         }
1535         return err;
1536 #ifndef CONFIG_USER_ONLY
1537     case GDB_WATCHPOINT_WRITE:
1538     case GDB_WATCHPOINT_READ:
1539     case GDB_WATCHPOINT_ACCESS:
1540         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1541             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1542             if (err)
1543                 break;
1544         }
1545         return err;
1546 #endif
1547     default:
1548         return -ENOSYS;
1549     }
1550 }
1551
1552 static void gdb_breakpoint_remove_all(void)
1553 {
1554     CPUState *env;
1555
1556     if (kvm_enabled()) {
1557         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1558         return;
1559     }
1560
1561     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1562         cpu_breakpoint_remove_all(env, BP_GDB);
1563 #ifndef CONFIG_USER_ONLY
1564         cpu_watchpoint_remove_all(env, BP_GDB);
1565 #endif
1566     }
1567 }
1568
1569 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1570 {
1571 #if defined(TARGET_I386)
1572     s->c_cpu->eip = pc;
1573     cpu_synchronize_state(s->c_cpu, 1);
1574 #elif defined (TARGET_PPC)
1575     s->c_cpu->nip = pc;
1576 #elif defined (TARGET_SPARC)
1577     s->c_cpu->pc = pc;
1578     s->c_cpu->npc = pc + 4;
1579 #elif defined (TARGET_ARM)
1580     s->c_cpu->regs[15] = pc;
1581 #elif defined (TARGET_SH4)
1582     s->c_cpu->pc = pc;
1583 #elif defined (TARGET_MIPS)
1584     s->c_cpu->active_tc.PC = pc;
1585 #elif defined (TARGET_MICROBLAZE)
1586     s->c_cpu->sregs[SR_PC] = pc;
1587 #elif defined (TARGET_CRIS)
1588     s->c_cpu->pc = pc;
1589 #elif defined (TARGET_ALPHA)
1590     s->c_cpu->pc = pc;
1591 #endif
1592 }
1593
1594 static inline int gdb_id(CPUState *env)
1595 {
1596 #if defined(CONFIG_USER_ONLY) && defined(USE_NPTL)
1597     return env->host_tid;
1598 #else
1599     return env->cpu_index + 1;
1600 #endif
1601 }
1602
1603 static CPUState *find_cpu(uint32_t thread_id)
1604 {
1605     CPUState *env;
1606
1607     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1608         if (gdb_id(env) == thread_id) {
1609             return env;
1610         }
1611     }
1612
1613     return NULL;
1614 }
1615
1616 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1617 {
1618     CPUState *env;
1619     const char *p;
1620     uint32_t thread;
1621     int ch, reg_size, type, res;
1622     char buf[MAX_PACKET_LENGTH];
1623     uint8_t mem_buf[MAX_PACKET_LENGTH];
1624     uint8_t *registers;
1625     target_ulong addr, len;
1626
1627 #ifdef DEBUG_GDB
1628     printf("command='%s'\n", line_buf);
1629 #endif
1630     p = line_buf;
1631     ch = *p++;
1632     switch(ch) {
1633     case '?':
1634         /* TODO: Make this return the correct value for user-mode.  */
1635         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1636                  gdb_id(s->c_cpu));
1637         put_packet(s, buf);
1638         /* Remove all the breakpoints when this query is issued,
1639          * because gdb is doing and initial connect and the state
1640          * should be cleaned up.
1641          */
1642         gdb_breakpoint_remove_all();
1643         break;
1644     case 'c':
1645         if (*p != '\0') {
1646             addr = strtoull(p, (char **)&p, 16);
1647             gdb_set_cpu_pc(s, addr);
1648         }
1649         s->signal = 0;
1650         gdb_continue(s);
1651         return RS_IDLE;
1652     case 'C':
1653         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1654         if (s->signal == -1)
1655             s->signal = 0;
1656         gdb_continue(s);
1657         return RS_IDLE;
1658     case 'v':
1659         if (strncmp(p, "Cont", 4) == 0) {
1660             int res_signal, res_thread;
1661
1662             p += 4;
1663             if (*p == '?') {
1664                 put_packet(s, "vCont;c;C;s;S");
1665                 break;
1666             }
1667             res = 0;
1668             res_signal = 0;
1669             res_thread = 0;
1670             while (*p) {
1671                 int action, signal;
1672
1673                 if (*p++ != ';') {
1674                     res = 0;
1675                     break;
1676                 }
1677                 action = *p++;
1678                 signal = 0;
1679                 if (action == 'C' || action == 'S') {
1680                     signal = strtoul(p, (char **)&p, 16);
1681                 } else if (action != 'c' && action != 's') {
1682                     res = 0;
1683                     break;
1684                 }
1685                 thread = 0;
1686                 if (*p == ':') {
1687                     thread = strtoull(p+1, (char **)&p, 16);
1688                 }
1689                 action = tolower(action);
1690                 if (res == 0 || (res == 'c' && action == 's')) {
1691                     res = action;
1692                     res_signal = signal;
1693                     res_thread = thread;
1694                 }
1695             }
1696             if (res) {
1697                 if (res_thread != -1 && res_thread != 0) {
1698                     env = find_cpu(res_thread);
1699                     if (env == NULL) {
1700                         put_packet(s, "E22");
1701                         break;
1702                     }
1703                     s->c_cpu = env;
1704                 }
1705                 if (res == 's') {
1706                     cpu_single_step(s->c_cpu, sstep_flags);
1707                 }
1708                 s->signal = res_signal;
1709                 gdb_continue(s);
1710                 return RS_IDLE;
1711             }
1712             break;
1713         } else {
1714             goto unknown_command;
1715         }
1716     case 'k':
1717         /* Kill the target */
1718         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1719         exit(0);
1720     case 'D':
1721         /* Detach packet */
1722         gdb_breakpoint_remove_all();
1723         gdb_continue(s);
1724         put_packet(s, "OK");
1725         break;
1726     case 's':
1727         if (*p != '\0') {
1728             addr = strtoull(p, (char **)&p, 16);
1729             gdb_set_cpu_pc(s, addr);
1730         }
1731         cpu_single_step(s->c_cpu, sstep_flags);
1732         gdb_continue(s);
1733         return RS_IDLE;
1734     case 'F':
1735         {
1736             target_ulong ret;
1737             target_ulong err;
1738
1739             ret = strtoull(p, (char **)&p, 16);
1740             if (*p == ',') {
1741                 p++;
1742                 err = strtoull(p, (char **)&p, 16);
1743             } else {
1744                 err = 0;
1745             }
1746             if (*p == ',')
1747                 p++;
1748             type = *p;
1749             if (gdb_current_syscall_cb)
1750                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1751             if (type == 'C') {
1752                 put_packet(s, "T02");
1753             } else {
1754                 gdb_continue(s);
1755             }
1756         }
1757         break;
1758     case 'g':
1759         cpu_synchronize_state(s->g_cpu, 0);
1760         len = 0;
1761         for (addr = 0; addr < num_g_regs; addr++) {
1762             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1763             len += reg_size;
1764         }
1765         memtohex(buf, mem_buf, len);
1766         put_packet(s, buf);
1767         break;
1768     case 'G':
1769         registers = mem_buf;
1770         len = strlen(p) / 2;
1771         hextomem((uint8_t *)registers, p, len);
1772         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1773             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1774             len -= reg_size;
1775             registers += reg_size;
1776         }
1777         cpu_synchronize_state(s->g_cpu, 1);
1778         put_packet(s, "OK");
1779         break;
1780     case 'm':
1781         addr = strtoull(p, (char **)&p, 16);
1782         if (*p == ',')
1783             p++;
1784         len = strtoull(p, NULL, 16);
1785         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1786             put_packet (s, "E14");
1787         } else {
1788             memtohex(buf, mem_buf, len);
1789             put_packet(s, buf);
1790         }
1791         break;
1792     case 'M':
1793         addr = strtoull(p, (char **)&p, 16);
1794         if (*p == ',')
1795             p++;
1796         len = strtoull(p, (char **)&p, 16);
1797         if (*p == ':')
1798             p++;
1799         hextomem(mem_buf, p, len);
1800         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1801             put_packet(s, "E14");
1802         else
1803             put_packet(s, "OK");
1804         break;
1805     case 'p':
1806         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1807            This works, but can be very slow.  Anything new enough to
1808            understand XML also knows how to use this properly.  */
1809         if (!gdb_has_xml)
1810             goto unknown_command;
1811         addr = strtoull(p, (char **)&p, 16);
1812         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1813         if (reg_size) {
1814             memtohex(buf, mem_buf, reg_size);
1815             put_packet(s, buf);
1816         } else {
1817             put_packet(s, "E14");
1818         }
1819         break;
1820     case 'P':
1821         if (!gdb_has_xml)
1822             goto unknown_command;
1823         addr = strtoull(p, (char **)&p, 16);
1824         if (*p == '=')
1825             p++;
1826         reg_size = strlen(p) / 2;
1827         hextomem(mem_buf, p, reg_size);
1828         gdb_write_register(s->g_cpu, mem_buf, addr);
1829         put_packet(s, "OK");
1830         break;
1831     case 'Z':
1832     case 'z':
1833         type = strtoul(p, (char **)&p, 16);
1834         if (*p == ',')
1835             p++;
1836         addr = strtoull(p, (char **)&p, 16);
1837         if (*p == ',')
1838             p++;
1839         len = strtoull(p, (char **)&p, 16);
1840         if (ch == 'Z')
1841             res = gdb_breakpoint_insert(addr, len, type);
1842         else
1843             res = gdb_breakpoint_remove(addr, len, type);
1844         if (res >= 0)
1845              put_packet(s, "OK");
1846         else if (res == -ENOSYS)
1847             put_packet(s, "");
1848         else
1849             put_packet(s, "E22");
1850         break;
1851     case 'H':
1852         type = *p++;
1853         thread = strtoull(p, (char **)&p, 16);
1854         if (thread == -1 || thread == 0) {
1855             put_packet(s, "OK");
1856             break;
1857         }
1858         env = find_cpu(thread);
1859         if (env == NULL) {
1860             put_packet(s, "E22");
1861             break;
1862         }
1863         switch (type) {
1864         case 'c':
1865             s->c_cpu = env;
1866             put_packet(s, "OK");
1867             break;
1868         case 'g':
1869             s->g_cpu = env;
1870             put_packet(s, "OK");
1871             break;
1872         default:
1873              put_packet(s, "E22");
1874              break;
1875         }
1876         break;
1877     case 'T':
1878         thread = strtoull(p, (char **)&p, 16);
1879         env = find_cpu(thread);
1880
1881         if (env != NULL) {
1882             put_packet(s, "OK");
1883         } else {
1884             put_packet(s, "E22");
1885         }
1886         break;
1887     case 'q':
1888     case 'Q':
1889         /* parse any 'q' packets here */
1890         if (!strcmp(p,"qemu.sstepbits")) {
1891             /* Query Breakpoint bit definitions */
1892             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1893                      SSTEP_ENABLE,
1894                      SSTEP_NOIRQ,
1895                      SSTEP_NOTIMER);
1896             put_packet(s, buf);
1897             break;
1898         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1899             /* Display or change the sstep_flags */
1900             p += 10;
1901             if (*p != '=') {
1902                 /* Display current setting */
1903                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1904                 put_packet(s, buf);
1905                 break;
1906             }
1907             p++;
1908             type = strtoul(p, (char **)&p, 16);
1909             sstep_flags = type;
1910             put_packet(s, "OK");
1911             break;
1912         } else if (strcmp(p,"C") == 0) {
1913             /* "Current thread" remains vague in the spec, so always return
1914              *  the first CPU (gdb returns the first thread). */
1915             put_packet(s, "QC1");
1916             break;
1917         } else if (strcmp(p,"fThreadInfo") == 0) {
1918             s->query_cpu = first_cpu;
1919             goto report_cpuinfo;
1920         } else if (strcmp(p,"sThreadInfo") == 0) {
1921         report_cpuinfo:
1922             if (s->query_cpu) {
1923                 snprintf(buf, sizeof(buf), "m%x", gdb_id(s->query_cpu));
1924                 put_packet(s, buf);
1925                 s->query_cpu = s->query_cpu->next_cpu;
1926             } else
1927                 put_packet(s, "l");
1928             break;
1929         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1930             thread = strtoull(p+16, (char **)&p, 16);
1931             env = find_cpu(thread);
1932             if (env != NULL) {
1933                 cpu_synchronize_state(env, 0);
1934                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
1935                                "CPU#%d [%s]", env->cpu_index,
1936                                env->halted ? "halted " : "running");
1937                 memtohex(buf, mem_buf, len);
1938                 put_packet(s, buf);
1939             }
1940             break;
1941         }
1942 #ifdef CONFIG_USER_ONLY
1943         else if (strncmp(p, "Offsets", 7) == 0) {
1944             TaskState *ts = s->c_cpu->opaque;
1945
1946             snprintf(buf, sizeof(buf),
1947                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1948                      ";Bss=" TARGET_ABI_FMT_lx,
1949                      ts->info->code_offset,
1950                      ts->info->data_offset,
1951                      ts->info->data_offset);
1952             put_packet(s, buf);
1953             break;
1954         }
1955 #else /* !CONFIG_USER_ONLY */
1956         else if (strncmp(p, "Rcmd,", 5) == 0) {
1957             int len = strlen(p + 5);
1958
1959             if ((len % 2) != 0) {
1960                 put_packet(s, "E01");
1961                 break;
1962             }
1963             hextomem(mem_buf, p + 5, len);
1964             len = len / 2;
1965             mem_buf[len++] = 0;
1966             qemu_chr_read(s->mon_chr, mem_buf, len);
1967             put_packet(s, "OK");
1968             break;
1969         }
1970 #endif /* !CONFIG_USER_ONLY */
1971         if (strncmp(p, "Supported", 9) == 0) {
1972             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1973 #ifdef GDB_CORE_XML
1974             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1975 #endif
1976             put_packet(s, buf);
1977             break;
1978         }
1979 #ifdef GDB_CORE_XML
1980         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1981             const char *xml;
1982             target_ulong total_len;
1983
1984             gdb_has_xml = 1;
1985             p += 19;
1986             xml = get_feature_xml(p, &p);
1987             if (!xml) {
1988                 snprintf(buf, sizeof(buf), "E00");
1989                 put_packet(s, buf);
1990                 break;
1991             }
1992
1993             if (*p == ':')
1994                 p++;
1995             addr = strtoul(p, (char **)&p, 16);
1996             if (*p == ',')
1997                 p++;
1998             len = strtoul(p, (char **)&p, 16);
1999
2000             total_len = strlen(xml);
2001             if (addr > total_len) {
2002                 snprintf(buf, sizeof(buf), "E00");
2003                 put_packet(s, buf);
2004                 break;
2005             }
2006             if (len > (MAX_PACKET_LENGTH - 5) / 2)
2007                 len = (MAX_PACKET_LENGTH - 5) / 2;
2008             if (len < total_len - addr) {
2009                 buf[0] = 'm';
2010                 len = memtox(buf + 1, xml + addr, len);
2011             } else {
2012                 buf[0] = 'l';
2013                 len = memtox(buf + 1, xml + addr, total_len - addr);
2014             }
2015             put_packet_binary(s, buf, len + 1);
2016             break;
2017         }
2018 #endif
2019         /* Unrecognised 'q' command.  */
2020         goto unknown_command;
2021
2022     default:
2023     unknown_command:
2024         /* put empty packet */
2025         buf[0] = '\0';
2026         put_packet(s, buf);
2027         break;
2028     }
2029     return RS_IDLE;
2030 }
2031
2032 void gdb_set_stop_cpu(CPUState *env)
2033 {
2034     gdbserver_state->c_cpu = env;
2035     gdbserver_state->g_cpu = env;
2036 }
2037
2038 #ifndef CONFIG_USER_ONLY
2039 static void gdb_vm_state_change(void *opaque, int running, int reason)
2040 {
2041     GDBState *s = gdbserver_state;
2042     CPUState *env = s->c_cpu;
2043     char buf[256];
2044     const char *type;
2045     int ret;
2046
2047     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
2048         s->state == RS_INACTIVE || s->state == RS_SYSCALL)
2049         return;
2050
2051     /* disable single step if it was enable */
2052     cpu_single_step(env, 0);
2053
2054     if (reason == EXCP_DEBUG) {
2055         if (env->watchpoint_hit) {
2056             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
2057             case BP_MEM_READ:
2058                 type = "r";
2059                 break;
2060             case BP_MEM_ACCESS:
2061                 type = "a";
2062                 break;
2063             default:
2064                 type = "";
2065                 break;
2066             }
2067             snprintf(buf, sizeof(buf),
2068                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
2069                      GDB_SIGNAL_TRAP, gdb_id(env), type,
2070                      env->watchpoint_hit->vaddr);
2071             put_packet(s, buf);
2072             env->watchpoint_hit = NULL;
2073             return;
2074         }
2075         tb_flush(env);
2076         ret = GDB_SIGNAL_TRAP;
2077     } else {
2078         ret = GDB_SIGNAL_INT;
2079     }
2080     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, gdb_id(env));
2081     put_packet(s, buf);
2082 }
2083 #endif
2084
2085 /* Send a gdb syscall request.
2086    This accepts limited printf-style format specifiers, specifically:
2087     %x  - target_ulong argument printed in hex.
2088     %lx - 64-bit argument printed in hex.
2089     %s  - string pointer (target_ulong) and length (int) pair.  */
2090 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
2091 {
2092     va_list va;
2093     char buf[256];
2094     char *p;
2095     target_ulong addr;
2096     uint64_t i64;
2097     GDBState *s;
2098
2099     s = gdbserver_state;
2100     if (!s)
2101         return;
2102     gdb_current_syscall_cb = cb;
2103     s->state = RS_SYSCALL;
2104 #ifndef CONFIG_USER_ONLY
2105     vm_stop(EXCP_DEBUG);
2106 #endif
2107     s->state = RS_IDLE;
2108     va_start(va, fmt);
2109     p = buf;
2110     *(p++) = 'F';
2111     while (*fmt) {
2112         if (*fmt == '%') {
2113             fmt++;
2114             switch (*fmt++) {
2115             case 'x':
2116                 addr = va_arg(va, target_ulong);
2117                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
2118                 break;
2119             case 'l':
2120                 if (*(fmt++) != 'x')
2121                     goto bad_format;
2122                 i64 = va_arg(va, uint64_t);
2123                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
2124                 break;
2125             case 's':
2126                 addr = va_arg(va, target_ulong);
2127                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
2128                               addr, va_arg(va, int));
2129                 break;
2130             default:
2131             bad_format:
2132                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2133                         fmt - 1);
2134                 break;
2135             }
2136         } else {
2137             *(p++) = *(fmt++);
2138         }
2139     }
2140     *p = 0;
2141     va_end(va);
2142     put_packet(s, buf);
2143 #ifdef CONFIG_USER_ONLY
2144     gdb_handlesig(s->c_cpu, 0);
2145 #else
2146     cpu_exit(s->c_cpu);
2147 #endif
2148 }
2149
2150 static void gdb_read_byte(GDBState *s, int ch)
2151 {
2152     int i, csum;
2153     uint8_t reply;
2154
2155 #ifndef CONFIG_USER_ONLY
2156     if (s->last_packet_len) {
2157         /* Waiting for a response to the last packet.  If we see the start
2158            of a new command then abandon the previous response.  */
2159         if (ch == '-') {
2160 #ifdef DEBUG_GDB
2161             printf("Got NACK, retransmitting\n");
2162 #endif
2163             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2164         }
2165 #ifdef DEBUG_GDB
2166         else if (ch == '+')
2167             printf("Got ACK\n");
2168         else
2169             printf("Got '%c' when expecting ACK/NACK\n", ch);
2170 #endif
2171         if (ch == '+' || ch == '$')
2172             s->last_packet_len = 0;
2173         if (ch != '$')
2174             return;
2175     }
2176     if (vm_running) {
2177         /* when the CPU is running, we cannot do anything except stop
2178            it when receiving a char */
2179         vm_stop(EXCP_INTERRUPT);
2180     } else
2181 #endif
2182     {
2183         switch(s->state) {
2184         case RS_IDLE:
2185             if (ch == '$') {
2186                 s->line_buf_index = 0;
2187                 s->state = RS_GETLINE;
2188             }
2189             break;
2190         case RS_GETLINE:
2191             if (ch == '#') {
2192             s->state = RS_CHKSUM1;
2193             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2194                 s->state = RS_IDLE;
2195             } else {
2196             s->line_buf[s->line_buf_index++] = ch;
2197             }
2198             break;
2199         case RS_CHKSUM1:
2200             s->line_buf[s->line_buf_index] = '\0';
2201             s->line_csum = fromhex(ch) << 4;
2202             s->state = RS_CHKSUM2;
2203             break;
2204         case RS_CHKSUM2:
2205             s->line_csum |= fromhex(ch);
2206             csum = 0;
2207             for(i = 0; i < s->line_buf_index; i++) {
2208                 csum += s->line_buf[i];
2209             }
2210             if (s->line_csum != (csum & 0xff)) {
2211                 reply = '-';
2212                 put_buffer(s, &reply, 1);
2213                 s->state = RS_IDLE;
2214             } else {
2215                 reply = '+';
2216                 put_buffer(s, &reply, 1);
2217                 s->state = gdb_handle_packet(s, s->line_buf);
2218             }
2219             break;
2220         default:
2221             abort();
2222         }
2223     }
2224 }
2225
2226 #ifdef CONFIG_USER_ONLY
2227 int
2228 gdb_queuesig (void)
2229 {
2230     GDBState *s;
2231
2232     s = gdbserver_state;
2233
2234     if (gdbserver_fd < 0 || s->fd < 0)
2235         return 0;
2236     else
2237         return 1;
2238 }
2239
2240 int
2241 gdb_handlesig (CPUState *env, int sig)
2242 {
2243   GDBState *s;
2244   char buf[256];
2245   int n;
2246
2247   s = gdbserver_state;
2248   if (gdbserver_fd < 0 || s->fd < 0)
2249     return sig;
2250
2251   /* disable single step if it was enabled */
2252   cpu_single_step(env, 0);
2253   tb_flush(env);
2254
2255   if (sig != 0)
2256     {
2257       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2258       put_packet(s, buf);
2259     }
2260   /* put_packet() might have detected that the peer terminated the
2261      connection.  */
2262   if (s->fd < 0)
2263       return sig;
2264
2265   sig = 0;
2266   s->state = RS_IDLE;
2267   s->running_state = 0;
2268   while (s->running_state == 0) {
2269       n = read (s->fd, buf, 256);
2270       if (n > 0)
2271         {
2272           int i;
2273
2274           for (i = 0; i < n; i++)
2275             gdb_read_byte (s, buf[i]);
2276         }
2277       else if (n == 0 || errno != EAGAIN)
2278         {
2279           /* XXX: Connection closed.  Should probably wait for annother
2280              connection before continuing.  */
2281           return sig;
2282         }
2283   }
2284   sig = s->signal;
2285   s->signal = 0;
2286   return sig;
2287 }
2288
2289 /* Tell the remote gdb that the process has exited.  */
2290 void gdb_exit(CPUState *env, int code)
2291 {
2292   GDBState *s;
2293   char buf[4];
2294
2295   s = gdbserver_state;
2296   if (gdbserver_fd < 0 || s->fd < 0)
2297     return;
2298
2299   snprintf(buf, sizeof(buf), "W%02x", code);
2300   put_packet(s, buf);
2301 }
2302
2303 /* Tell the remote gdb that the process has exited due to SIG.  */
2304 void gdb_signalled(CPUState *env, int sig)
2305 {
2306   GDBState *s;
2307   char buf[4];
2308
2309   s = gdbserver_state;
2310   if (gdbserver_fd < 0 || s->fd < 0)
2311     return;
2312
2313   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2314   put_packet(s, buf);
2315 }
2316
2317 static void gdb_accept(void)
2318 {
2319     GDBState *s;
2320     struct sockaddr_in sockaddr;
2321     socklen_t len;
2322     int val, fd;
2323
2324     for(;;) {
2325         len = sizeof(sockaddr);
2326         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2327         if (fd < 0 && errno != EINTR) {
2328             perror("accept");
2329             return;
2330         } else if (fd >= 0) {
2331             break;
2332         }
2333     }
2334
2335     /* set short latency */
2336     val = 1;
2337     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2338
2339     s = qemu_mallocz(sizeof(GDBState));
2340     s->c_cpu = first_cpu;
2341     s->g_cpu = first_cpu;
2342     s->fd = fd;
2343     gdb_has_xml = 0;
2344
2345     gdbserver_state = s;
2346
2347     fcntl(fd, F_SETFL, O_NONBLOCK);
2348 }
2349
2350 static int gdbserver_open(int port)
2351 {
2352     struct sockaddr_in sockaddr;
2353     int fd, val, ret;
2354
2355     fd = socket(PF_INET, SOCK_STREAM, 0);
2356     if (fd < 0) {
2357         perror("socket");
2358         return -1;
2359     }
2360
2361     /* allow fast reuse */
2362     val = 1;
2363     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2364
2365     sockaddr.sin_family = AF_INET;
2366     sockaddr.sin_port = htons(port);
2367     sockaddr.sin_addr.s_addr = 0;
2368     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2369     if (ret < 0) {
2370         perror("bind");
2371         return -1;
2372     }
2373     ret = listen(fd, 0);
2374     if (ret < 0) {
2375         perror("listen");
2376         return -1;
2377     }
2378     return fd;
2379 }
2380
2381 int gdbserver_start(int port)
2382 {
2383     gdbserver_fd = gdbserver_open(port);
2384     if (gdbserver_fd < 0)
2385         return -1;
2386     /* accept connections */
2387     gdb_accept();
2388     return 0;
2389 }
2390
2391 /* Disable gdb stub for child processes.  */
2392 void gdbserver_fork(CPUState *env)
2393 {
2394     GDBState *s = gdbserver_state;
2395     if (gdbserver_fd < 0 || s->fd < 0)
2396       return;
2397     close(s->fd);
2398     s->fd = -1;
2399     cpu_breakpoint_remove_all(env, BP_GDB);
2400     cpu_watchpoint_remove_all(env, BP_GDB);
2401 }
2402 #else
2403 static int gdb_chr_can_receive(void *opaque)
2404 {
2405   /* We can handle an arbitrarily large amount of data.
2406    Pick the maximum packet size, which is as good as anything.  */
2407   return MAX_PACKET_LENGTH;
2408 }
2409
2410 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2411 {
2412     int i;
2413
2414     for (i = 0; i < size; i++) {
2415         gdb_read_byte(gdbserver_state, buf[i]);
2416     }
2417 }
2418
2419 static void gdb_chr_event(void *opaque, int event)
2420 {
2421     switch (event) {
2422     case CHR_EVENT_RESET:
2423         vm_stop(EXCP_INTERRUPT);
2424         gdb_has_xml = 0;
2425         break;
2426     default:
2427         break;
2428     }
2429 }
2430
2431 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2432 {
2433     char buf[MAX_PACKET_LENGTH];
2434
2435     buf[0] = 'O';
2436     if (len > (MAX_PACKET_LENGTH/2) - 1)
2437         len = (MAX_PACKET_LENGTH/2) - 1;
2438     memtohex(buf + 1, (uint8_t *)msg, len);
2439     put_packet(s, buf);
2440 }
2441
2442 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2443 {
2444     const char *p = (const char *)buf;
2445     int max_sz;
2446
2447     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2448     for (;;) {
2449         if (len <= max_sz) {
2450             gdb_monitor_output(gdbserver_state, p, len);
2451             break;
2452         }
2453         gdb_monitor_output(gdbserver_state, p, max_sz);
2454         p += max_sz;
2455         len -= max_sz;
2456     }
2457     return len;
2458 }
2459
2460 #ifndef _WIN32
2461 static void gdb_sigterm_handler(int signal)
2462 {
2463     if (vm_running)
2464         vm_stop(EXCP_INTERRUPT);
2465 }
2466 #endif
2467
2468 int gdbserver_start(const char *device)
2469 {
2470     GDBState *s;
2471     char gdbstub_device_name[128];
2472     CharDriverState *chr = NULL;
2473     CharDriverState *mon_chr;
2474
2475     if (!device)
2476         return -1;
2477     if (strcmp(device, "none") != 0) {
2478         if (strstart(device, "tcp:", NULL)) {
2479             /* enforce required TCP attributes */
2480             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2481                      "%s,nowait,nodelay,server", device);
2482             device = gdbstub_device_name;
2483         }
2484 #ifndef _WIN32
2485         else if (strcmp(device, "stdio") == 0) {
2486             struct sigaction act;
2487
2488             memset(&act, 0, sizeof(act));
2489             act.sa_handler = gdb_sigterm_handler;
2490             sigaction(SIGINT, &act, NULL);
2491         }
2492 #endif
2493         chr = qemu_chr_open("gdb", device, NULL);
2494         if (!chr)
2495             return -1;
2496
2497         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2498                               gdb_chr_event, NULL);
2499     }
2500
2501     s = gdbserver_state;
2502     if (!s) {
2503         s = qemu_mallocz(sizeof(GDBState));
2504         gdbserver_state = s;
2505
2506         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2507
2508         /* Initialize a monitor terminal for gdb */
2509         mon_chr = qemu_mallocz(sizeof(*mon_chr));
2510         mon_chr->chr_write = gdb_monitor_write;
2511         monitor_init(mon_chr, 0);
2512     } else {
2513         if (s->chr)
2514             qemu_chr_close(s->chr);
2515         mon_chr = s->mon_chr;
2516         memset(s, 0, sizeof(GDBState));
2517     }
2518     s->c_cpu = first_cpu;
2519     s->g_cpu = first_cpu;
2520     s->chr = chr;
2521     s->state = chr ? RS_IDLE : RS_INACTIVE;
2522     s->mon_chr = mon_chr;
2523
2524     return 0;
2525 }
2526 #endif