gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA  02110-1301 USA
  19  */
  20 #include "config.h"
  21 #include "qemu-common.h"
  22 #ifdef CONFIG_USER_ONLY
  23 #include <stdlib.h>
  24 #include <stdio.h>
  25 #include <stdarg.h>
  26 #include <string.h>
  27 #include <errno.h>
  28 #include <unistd.h>
  29 #include <fcntl.h>
  30
  31 #include "qemu.h"
  32 #else
  33 #include "monitor.h"
  34 #include "qemu-char.h"
  35 #include "sysemu.h"
  36 #include "gdbstub.h"
  37 #endif
  38
  39 #define MAX_PACKET_LENGTH 4096
  40
  41 #include "qemu_socket.h"
  42 #include "kvm.h"
  43
  44
  45 enum {
  46     GDB_SIGNAL_0 = 0,
  47     GDB_SIGNAL_INT = 2,
  48     GDB_SIGNAL_TRAP = 5,
  49     GDB_SIGNAL_UNKNOWN = 143
  50 };
  51
  52 #ifdef CONFIG_USER_ONLY
  53
  54 /* Map target signal numbers to GDB protocol signal numbers and vice
  55  * versa.  For user emulation's currently supported systems, we can
  56  * assume most signals are defined.
  57  */
  58
  59 static int gdb_signal_table[] = {
  60     0,
  61     TARGET_SIGHUP,
  62     TARGET_SIGINT,
  63     TARGET_SIGQUIT,
  64     TARGET_SIGILL,
  65     TARGET_SIGTRAP,
  66     TARGET_SIGABRT,
  67     -1, /* SIGEMT */
  68     TARGET_SIGFPE,
  69     TARGET_SIGKILL,
  70     TARGET_SIGBUS,
  71     TARGET_SIGSEGV,
  72     TARGET_SIGSYS,
  73     TARGET_SIGPIPE,
  74     TARGET_SIGALRM,
  75     TARGET_SIGTERM,
  76     TARGET_SIGURG,
  77     TARGET_SIGSTOP,
  78     TARGET_SIGTSTP,
  79     TARGET_SIGCONT,
  80     TARGET_SIGCHLD,
  81     TARGET_SIGTTIN,
  82     TARGET_SIGTTOU,
  83     TARGET_SIGIO,
  84     TARGET_SIGXCPU,
  85     TARGET_SIGXFSZ,
  86     TARGET_SIGVTALRM,
  87     TARGET_SIGPROF,
  88     TARGET_SIGWINCH,
  89     -1, /* SIGLOST */
  90     TARGET_SIGUSR1,
  91     TARGET_SIGUSR2,
  92 #ifdef TARGET_SIGPWR
  93     TARGET_SIGPWR,
  94 #else
  95     -1,
  96 #endif
  97     -1, /* SIGPOLL */
  98     -1,
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108     -1,
 109 #ifdef __SIGRTMIN
 110     __SIGRTMIN + 1,
 111     __SIGRTMIN + 2,
 112     __SIGRTMIN + 3,
 113     __SIGRTMIN + 4,
 114     __SIGRTMIN + 5,
 115     __SIGRTMIN + 6,
 116     __SIGRTMIN + 7,
 117     __SIGRTMIN + 8,
 118     __SIGRTMIN + 9,
 119     __SIGRTMIN + 10,
 120     __SIGRTMIN + 11,
 121     __SIGRTMIN + 12,
 122     __SIGRTMIN + 13,
 123     __SIGRTMIN + 14,
 124     __SIGRTMIN + 15,
 125     __SIGRTMIN + 16,
 126     __SIGRTMIN + 17,
 127     __SIGRTMIN + 18,
 128     __SIGRTMIN + 19,
 129     __SIGRTMIN + 20,
 130     __SIGRTMIN + 21,
 131     __SIGRTMIN + 22,
 132     __SIGRTMIN + 23,
 133     __SIGRTMIN + 24,
 134     __SIGRTMIN + 25,
 135     __SIGRTMIN + 26,
 136     __SIGRTMIN + 27,
 137     __SIGRTMIN + 28,
 138     __SIGRTMIN + 29,
 139     __SIGRTMIN + 30,
 140     __SIGRTMIN + 31,
 141     -1, /* SIGCANCEL */
 142     __SIGRTMIN,
 143     __SIGRTMIN + 32,
 144     __SIGRTMIN + 33,
 145     __SIGRTMIN + 34,
 146     __SIGRTMIN + 35,
 147     __SIGRTMIN + 36,
 148     __SIGRTMIN + 37,
 149     __SIGRTMIN + 38,
 150     __SIGRTMIN + 39,
 151     __SIGRTMIN + 40,
 152     __SIGRTMIN + 41,
 153     __SIGRTMIN + 42,
 154     __SIGRTMIN + 43,
 155     __SIGRTMIN + 44,
 156     __SIGRTMIN + 45,
 157     __SIGRTMIN + 46,
 158     __SIGRTMIN + 47,
 159     __SIGRTMIN + 48,
 160     __SIGRTMIN + 49,
 161     __SIGRTMIN + 50,
 162     __SIGRTMIN + 51,
 163     __SIGRTMIN + 52,
 164     __SIGRTMIN + 53,
 165     __SIGRTMIN + 54,
 166     __SIGRTMIN + 55,
 167     __SIGRTMIN + 56,
 168     __SIGRTMIN + 57,
 169     __SIGRTMIN + 58,
 170     __SIGRTMIN + 59,
 171     __SIGRTMIN + 60,
 172     __SIGRTMIN + 61,
 173     __SIGRTMIN + 62,
 174     __SIGRTMIN + 63,
 175     __SIGRTMIN + 64,
 176     __SIGRTMIN + 65,
 177     __SIGRTMIN + 66,
 178     __SIGRTMIN + 67,
 179     __SIGRTMIN + 68,
 180     __SIGRTMIN + 69,
 181     __SIGRTMIN + 70,
 182     __SIGRTMIN + 71,
 183     __SIGRTMIN + 72,
 184     __SIGRTMIN + 73,
 185     __SIGRTMIN + 74,
 186     __SIGRTMIN + 75,
 187     __SIGRTMIN + 76,
 188     __SIGRTMIN + 77,
 189     __SIGRTMIN + 78,
 190     __SIGRTMIN + 79,
 191     __SIGRTMIN + 80,
 192     __SIGRTMIN + 81,
 193     __SIGRTMIN + 82,
 194     __SIGRTMIN + 83,
 195     __SIGRTMIN + 84,
 196     __SIGRTMIN + 85,
 197     __SIGRTMIN + 86,
 198     __SIGRTMIN + 87,
 199     __SIGRTMIN + 88,
 200     __SIGRTMIN + 89,
 201     __SIGRTMIN + 90,
 202     __SIGRTMIN + 91,
 203     __SIGRTMIN + 92,
 204     __SIGRTMIN + 93,
 205     __SIGRTMIN + 94,
 206     __SIGRTMIN + 95,
 207     -1, /* SIGINFO */
 208     -1, /* UNKNOWN */
 209     -1, /* DEFAULT */
 210     -1,
 211     -1,
 212     -1,
 213     -1,
 214     -1,
 215     -1
 216 #endif
 217 };
 218 #else
 219 /* In system mode we only need SIGINT and SIGTRAP; other signals
 220    are not yet supported.  */
 221
 222 enum {
 223     TARGET_SIGINT = 2,
 224     TARGET_SIGTRAP = 5
 225 };
 226
 227 static int gdb_signal_table[] = {
 228     -1,
 229     -1,
 230     TARGET_SIGINT,
 231     -1,
 232     -1,
 233     TARGET_SIGTRAP
 234 };
 235 #endif
 236
 237 #ifdef CONFIG_USER_ONLY
 238 static int target_signal_to_gdb (int sig)
 239 {
 240     int i;
 241     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 242         if (gdb_signal_table[i] == sig)
 243             return i;
 244     return GDB_SIGNAL_UNKNOWN;
 245 }
 246 #endif
 247
 248 static int gdb_signal_to_target (int sig)
 249 {
 250     if (sig < ARRAY_SIZE (gdb_signal_table))
 251         return gdb_signal_table[sig];
 252     else
 253         return -1;
 254 }
 255
 256 //#define DEBUG_GDB
 257
 258 typedef struct GDBRegisterState {
 259     int base_reg;
 260     int num_regs;
 261     gdb_reg_cb get_reg;
 262     gdb_reg_cb set_reg;
 263     const char *xml;
 264     struct GDBRegisterState *next;
 265 } GDBRegisterState;
 266
 267 enum RSState {
 268     RS_INACTIVE,
 269     RS_IDLE,
 270     RS_GETLINE,
 271     RS_CHKSUM1,
 272     RS_CHKSUM2,
 273     RS_SYSCALL,
 274 };
 275 typedef struct GDBState {
 276     CPUState *c_cpu; /* current CPU for step/continue ops */
 277     CPUState *g_cpu; /* current CPU for other ops */
 278     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 279     enum RSState state; /* parsing state */
 280     char line_buf[MAX_PACKET_LENGTH];
 281     int line_buf_index;
 282     int line_csum;
 283     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 284     int last_packet_len;
 285     int signal;
 286 #ifdef CONFIG_USER_ONLY
 287     int fd;
 288     int running_state;
 289 #else
 290     CharDriverState *chr;
 291     CharDriverState *mon_chr;
 292 #endif
 293 } GDBState;
 294
 295 /* By default use no IRQs and no timers while single stepping so as to
 296  * make single stepping like an ICE HW step.
 297  */
 298 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 299
 300 static GDBState *gdbserver_state;
 301
 302 /* This is an ugly hack to cope with both new and old gdb.
 303    If gdb sends qXfer:features:read then assume we're talking to a newish
 304    gdb that understands target descriptions.  */
 305 static int gdb_has_xml;
 306
 307 #ifdef CONFIG_USER_ONLY
 308 /* XXX: This is not thread safe.  Do we care?  */
 309 static int gdbserver_fd = -1;
 310
 311 static int get_char(GDBState *s)
 312 {
 313     uint8_t ch;
 314     int ret;
 315
 316     for(;;) {
 317         ret = recv(s->fd, &ch, 1, 0);
 318         if (ret < 0) {
 319             if (errno == ECONNRESET)
 320                 s->fd = -1;
 321             if (errno != EINTR && errno != EAGAIN)
 322                 return -1;
 323         } else if (ret == 0) {
 324             close(s->fd);
 325             s->fd = -1;
 326             return -1;
 327         } else {
 328             break;
 329         }
 330     }
 331     return ch;
 332 }
 333 #endif
 334
 335 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 336
 337 static enum {
 338     GDB_SYS_UNKNOWN,
 339     GDB_SYS_ENABLED,
 340     GDB_SYS_DISABLED,
 341 } gdb_syscall_mode;
 342
 343 /* If gdb is connected when the first semihosting syscall occurs then use
 344    remote gdb syscalls.  Otherwise use native file IO.  */
 345 int use_gdb_syscalls(void)
 346 {
 347     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 348         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 349                                             : GDB_SYS_DISABLED);
 350     }
 351     return gdb_syscall_mode == GDB_SYS_ENABLED;
 352 }
 353
 354 /* Resume execution.  */
 355 static inline void gdb_continue(GDBState *s)
 356 {
 357 #ifdef CONFIG_USER_ONLY
 358     s->running_state = 1;
 359 #else
 360     vm_start();
 361 #endif
 362 }
 363
 364 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 365 {
 366 #ifdef CONFIG_USER_ONLY
 367     int ret;
 368
 369     while (len > 0) {
 370         ret = send(s->fd, buf, len, 0);
 371         if (ret < 0) {
 372             if (errno != EINTR && errno != EAGAIN)
 373                 return;
 374         } else {
 375             buf += ret;
 376             len -= ret;
 377         }
 378     }
 379 #else
 380     qemu_chr_write(s->chr, buf, len);
 381 #endif
 382 }
 383
 384 static inline int fromhex(int v)
 385 {
 386     if (v >= '0' && v <= '9')
 387         return v - '0';
 388     else if (v >= 'A' && v <= 'F')
 389         return v - 'A' + 10;
 390     else if (v >= 'a' && v <= 'f')
 391         return v - 'a' + 10;
 392     else
 393         return 0;
 394 }
 395
 396 static inline int tohex(int v)
 397 {
 398     if (v < 10)
 399         return v + '0';
 400     else
 401         return v - 10 + 'a';
 402 }
 403
 404 static void memtohex(char *buf, const uint8_t *mem, int len)
 405 {
 406     int i, c;
 407     char *q;
 408     q = buf;
 409     for(i = 0; i < len; i++) {
 410         c = mem[i];
 411         *q++ = tohex(c >> 4);
 412         *q++ = tohex(c & 0xf);
 413     }
 414     *q = '\0';
 415 }
 416
 417 static void hextomem(uint8_t *mem, const char *buf, int len)
 418 {
 419     int i;
 420
 421     for(i = 0; i < len; i++) {
 422         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 423         buf += 2;
 424     }
 425 }
 426
 427 /* return -1 if error, 0 if OK */
 428 static int put_packet_binary(GDBState *s, const char *buf, int len)
 429 {
 430     int csum, i;
 431     uint8_t *p;
 432
 433     for(;;) {
 434         p = s->last_packet;
 435         *(p++) = '$';
 436         memcpy(p, buf, len);
 437         p += len;
 438         csum = 0;
 439         for(i = 0; i < len; i++) {
 440             csum += buf[i];
 441         }
 442         *(p++) = '#';
 443         *(p++) = tohex((csum >> 4) & 0xf);
 444         *(p++) = tohex((csum) & 0xf);
 445
 446         s->last_packet_len = p - s->last_packet;
 447         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 448
 449 #ifdef CONFIG_USER_ONLY
 450         i = get_char(s);
 451         if (i < 0)
 452             return -1;
 453         if (i == '+')
 454             break;
 455 #else
 456         break;
 457 #endif
 458     }
 459     return 0;
 460 }
 461
 462 /* return -1 if error, 0 if OK */
 463 static int put_packet(GDBState *s, const char *buf)
 464 {
 465 #ifdef DEBUG_GDB
 466     printf("reply='%s'\n", buf);
 467 #endif
 468
 469     return put_packet_binary(s, buf, strlen(buf));
 470 }
 471
 472 /* The GDB remote protocol transfers values in target byte order.  This means
 473    we can use the raw memory access routines to access the value buffer.
 474    Conveniently, these also handle the case where the buffer is mis-aligned.
 475  */
 476 #define GET_REG8(val) do { \
 477     stb_p(mem_buf, val); \
 478     return 1; \
 479     } while(0)
 480 #define GET_REG16(val) do { \
 481     stw_p(mem_buf, val); \
 482     return 2; \
 483     } while(0)
 484 #define GET_REG32(val) do { \
 485     stl_p(mem_buf, val); \
 486     return 4; \
 487     } while(0)
 488 #define GET_REG64(val) do { \
 489     stq_p(mem_buf, val); \
 490     return 8; \
 491     } while(0)
 492
 493 #if TARGET_LONG_BITS == 64
 494 #define GET_REGL(val) GET_REG64(val)
 495 #define ldtul_p(addr) ldq_p(addr)
 496 #else
 497 #define GET_REGL(val) GET_REG32(val)
 498 #define ldtul_p(addr) ldl_p(addr)
 499 #endif
 500
 501 #if defined(TARGET_I386)
 502
 503 #ifdef TARGET_X86_64
 504 static const int gpr_map[16] = {
 505     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 506     8, 9, 10, 11, 12, 13, 14, 15
 507 };
 508 #else
 509 static const int gpr_map[8] = {0, 1, 2, 3, 4, 5, 6, 7};
 510 #endif
 511
 512 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 513
 514 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 515 {
 516     if (n < CPU_NB_REGS) {
 517         GET_REGL(env->regs[gpr_map[n]]);
 518     } else if (n >= CPU_NB_REGS + 8 && n < CPU_NB_REGS + 16) {
 519         /* FIXME: byteswap float values.  */
 520 #ifdef USE_X86LDOUBLE
 521         memcpy(mem_buf, &env->fpregs[n - (CPU_NB_REGS + 8)], 10);
 522 #else
 523         memset(mem_buf, 0, 10);
 524 #endif
 525         return 10;
 526     } else if (n >= CPU_NB_REGS + 24) {
 527         n -= CPU_NB_REGS + 24;
 528         if (n < CPU_NB_REGS) {
 529             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 530             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 531             return 16;
 532         } else if (n == CPU_NB_REGS) {
 533             GET_REG32(env->mxcsr);
 534         }
 535     } else {
 536         n -= CPU_NB_REGS;
 537         switch (n) {
 538         case 0: GET_REGL(env->eip);
 539         case 1: GET_REG32(env->eflags);
 540         case 2: GET_REG32(env->segs[R_CS].selector);
 541         case 3: GET_REG32(env->segs[R_SS].selector);
 542         case 4: GET_REG32(env->segs[R_DS].selector);
 543         case 5: GET_REG32(env->segs[R_ES].selector);
 544         case 6: GET_REG32(env->segs[R_FS].selector);
 545         case 7: GET_REG32(env->segs[R_GS].selector);
 546         /* 8...15 x87 regs.  */
 547         case 16: GET_REG32(env->fpuc);
 548         case 17: GET_REG32((env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11);
 549         case 18: GET_REG32(0); /* ftag */
 550         case 19: GET_REG32(0); /* fiseg */
 551         case 20: GET_REG32(0); /* fioff */
 552         case 21: GET_REG32(0); /* foseg */
 553         case 22: GET_REG32(0); /* fooff */
 554         case 23: GET_REG32(0); /* fop */
 555         /* 24+ xmm regs.  */
 556         }
 557     }
 558     return 0;
 559 }
 560
 561 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int i)
 562 {
 563     uint32_t tmp;
 564
 565     if (i < CPU_NB_REGS) {
 566         env->regs[gpr_map[i]] = ldtul_p(mem_buf);
 567         return sizeof(target_ulong);
 568     } else if (i >= CPU_NB_REGS + 8 && i < CPU_NB_REGS + 16) {
 569         i -= CPU_NB_REGS + 8;
 570 #ifdef USE_X86LDOUBLE
 571         memcpy(&env->fpregs[i], mem_buf, 10);
 572 #endif
 573         return 10;
 574     } else if (i >= CPU_NB_REGS + 24) {
 575         i -= CPU_NB_REGS + 24;
 576         if (i < CPU_NB_REGS) {
 577             env->xmm_regs[i].XMM_Q(0) = ldq_p(mem_buf);
 578             env->xmm_regs[i].XMM_Q(1) = ldq_p(mem_buf + 8);
 579             return 16;
 580         } else if (i == CPU_NB_REGS) {
 581             env->mxcsr = ldl_p(mem_buf);
 582             return 4;
 583         }
 584     } else {
 585         i -= CPU_NB_REGS;
 586         switch (i) {
 587         case 0: env->eip = ldtul_p(mem_buf); return sizeof(target_ulong);
 588         case 1: env->eflags = ldl_p(mem_buf); return 4;
 589 #if defined(CONFIG_USER_ONLY)
 590 #define LOAD_SEG(index, sreg)\
 591             tmp = ldl_p(mem_buf);\
 592             if (tmp != env->segs[sreg].selector)\
 593                 cpu_x86_load_seg(env, sreg, tmp);
 594 #else
 595 /* FIXME: Honor segment registers.  Needs to avoid raising an exception
 596    when the selector is invalid.  */
 597 #define LOAD_SEG(index, sreg) do {} while(0)
 598 #endif
 599         case 2: LOAD_SEG(10, R_CS); return 4;
 600         case 3: LOAD_SEG(11, R_SS); return 4;
 601         case 4: LOAD_SEG(12, R_DS); return 4;
 602         case 5: LOAD_SEG(13, R_ES); return 4;
 603         case 6: LOAD_SEG(14, R_FS); return 4;
 604         case 7: LOAD_SEG(15, R_GS); return 4;
 605         /* 8...15 x87 regs.  */
 606         case 16: env->fpuc = ldl_p(mem_buf); return 4;
 607         case 17:
 608                  tmp = ldl_p(mem_buf);
 609                  env->fpstt = (tmp >> 11) & 7;
 610                  env->fpus = tmp & ~0x3800;
 611                  return 4;
 612         case 18: /* ftag */ return 4;
 613         case 19: /* fiseg */ return 4;
 614         case 20: /* fioff */ return 4;
 615         case 21: /* foseg */ return 4;
 616         case 22: /* fooff */ return 4;
 617         case 23: /* fop */ return 4;
 618         /* 24+ xmm regs.  */
 619         }
 620     }
 621     /* Unrecognised register.  */
 622     return 0;
 623 }
 624
 625 #elif defined (TARGET_PPC)
 626
 627 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 628    expects whatever the target description contains.  Due to a
 629    historical mishap the FP registers appear in between core integer
 630    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 631    FP regs zero size when talking to a newer gdb.  */
 632 #define NUM_CORE_REGS 71
 633 #if defined (TARGET_PPC64)
 634 #define GDB_CORE_XML "power64-core.xml"
 635 #else
 636 #define GDB_CORE_XML "power-core.xml"
 637 #endif
 638
 639 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 640 {
 641     if (n < 32) {
 642         /* gprs */
 643         GET_REGL(env->gpr[n]);
 644     } else if (n < 64) {
 645         /* fprs */
 646         if (gdb_has_xml)
 647             return 0;
 648         stfq_p(mem_buf, env->fpr[n-32]);
 649         return 8;
 650     } else {
 651         switch (n) {
 652         case 64: GET_REGL(env->nip);
 653         case 65: GET_REGL(env->msr);
 654         case 66:
 655             {
 656                 uint32_t cr = 0;
 657                 int i;
 658                 for (i = 0; i < 8; i++)
 659                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 660                 GET_REG32(cr);
 661             }
 662         case 67: GET_REGL(env->lr);
 663         case 68: GET_REGL(env->ctr);
 664         case 69: GET_REGL(env->xer);
 665         case 70:
 666             {
 667                 if (gdb_has_xml)
 668                     return 0;
 669                 GET_REG32(0); /* fpscr */
 670             }
 671         }
 672     }
 673     return 0;
 674 }
 675
 676 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 677 {
 678     if (n < 32) {
 679         /* gprs */
 680         env->gpr[n] = ldtul_p(mem_buf);
 681         return sizeof(target_ulong);
 682     } else if (n < 64) {
 683         /* fprs */
 684         if (gdb_has_xml)
 685             return 0;
 686         env->fpr[n-32] = ldfq_p(mem_buf);
 687         return 8;
 688     } else {
 689         switch (n) {
 690         case 64:
 691             env->nip = ldtul_p(mem_buf);
 692             return sizeof(target_ulong);
 693         case 65:
 694             ppc_store_msr(env, ldtul_p(mem_buf));
 695             return sizeof(target_ulong);
 696         case 66:
 697             {
 698                 uint32_t cr = ldl_p(mem_buf);
 699                 int i;
 700                 for (i = 0; i < 8; i++)
 701                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 702                 return 4;
 703             }
 704         case 67:
 705             env->lr = ldtul_p(mem_buf);
 706             return sizeof(target_ulong);
 707         case 68:
 708             env->ctr = ldtul_p(mem_buf);
 709             return sizeof(target_ulong);
 710         case 69:
 711             env->xer = ldtul_p(mem_buf);
 712             return sizeof(target_ulong);
 713         case 70:
 714             /* fpscr */
 715             if (gdb_has_xml)
 716                 return 0;
 717             return 4;
 718         }
 719     }
 720     return 0;
 721 }
 722
 723 #elif defined (TARGET_SPARC)
 724
 725 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 726 #define NUM_CORE_REGS 86
 727 #else
 728 #define NUM_CORE_REGS 72
 729 #endif
 730
 731 #ifdef TARGET_ABI32
 732 #define GET_REGA(val) GET_REG32(val)
 733 #else
 734 #define GET_REGA(val) GET_REGL(val)
 735 #endif
 736
 737 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 738 {
 739     if (n < 8) {
 740         /* g0..g7 */
 741         GET_REGA(env->gregs[n]);
 742     }
 743     if (n < 32) {
 744         /* register window */
 745         GET_REGA(env->regwptr[n - 8]);
 746     }
 747 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 748     if (n < 64) {
 749         /* fprs */
 750         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 751     }
 752     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 753     switch (n) {
 754     case 64: GET_REGA(env->y);
 755     case 65: GET_REGA(GET_PSR(env));
 756     case 66: GET_REGA(env->wim);
 757     case 67: GET_REGA(env->tbr);
 758     case 68: GET_REGA(env->pc);
 759     case 69: GET_REGA(env->npc);
 760     case 70: GET_REGA(env->fsr);
 761     case 71: GET_REGA(0); /* csr */
 762     default: GET_REGA(0);
 763     }
 764 #else
 765     if (n < 64) {
 766         /* f0-f31 */
 767         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 768     }
 769     if (n < 80) {
 770         /* f32-f62 (double width, even numbers only) */
 771         uint64_t val;
 772
 773         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 774         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 775         GET_REG64(val);
 776     }
 777     switch (n) {
 778     case 80: GET_REGL(env->pc);
 779     case 81: GET_REGL(env->npc);
 780     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 781                            ((env->asi & 0xff) << 24) |
 782                            ((env->pstate & 0xfff) << 8) |
 783                            GET_CWP64(env));
 784     case 83: GET_REGL(env->fsr);
 785     case 84: GET_REGL(env->fprs);
 786     case 85: GET_REGL(env->y);
 787     }
 788 #endif
 789     return 0;
 790 }
 791
 792 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 793 {
 794 #if defined(TARGET_ABI32)
 795     abi_ulong tmp;
 796
 797     tmp = ldl_p(mem_buf);
 798 #else
 799     target_ulong tmp;
 800
 801     tmp = ldtul_p(mem_buf);
 802 #endif
 803
 804     if (n < 8) {
 805         /* g0..g7 */
 806         env->gregs[n] = tmp;
 807     } else if (n < 32) {
 808         /* register window */
 809         env->regwptr[n - 8] = tmp;
 810     }
 811 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 812     else if (n < 64) {
 813         /* fprs */
 814         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 815     } else {
 816         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 817         switch (n) {
 818         case 64: env->y = tmp; break;
 819         case 65: PUT_PSR(env, tmp); break;
 820         case 66: env->wim = tmp; break;
 821         case 67: env->tbr = tmp; break;
 822         case 68: env->pc = tmp; break;
 823         case 69: env->npc = tmp; break;
 824         case 70: env->fsr = tmp; break;
 825         default: return 0;
 826         }
 827     }
 828     return 4;
 829 #else
 830     else if (n < 64) {
 831         /* f0-f31 */
 832         env->fpr[n] = ldfl_p(mem_buf);
 833         return 4;
 834     } else if (n < 80) {
 835         /* f32-f62 (double width, even numbers only) */
 836         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 837         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 838     } else {
 839         switch (n) {
 840         case 80: env->pc = tmp; break;
 841         case 81: env->npc = tmp; break;
 842         case 82:
 843             PUT_CCR(env, tmp >> 32);
 844             env->asi = (tmp >> 24) & 0xff;
 845             env->pstate = (tmp >> 8) & 0xfff;
 846             PUT_CWP64(env, tmp & 0xff);
 847             break;
 848         case 83: env->fsr = tmp; break;
 849         case 84: env->fprs = tmp; break;
 850         case 85: env->y = tmp; break;
 851         default: return 0;
 852         }
 853     }
 854     return 8;
 855 #endif
 856 }
 857 #elif defined (TARGET_ARM)
 858
 859 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 860    whatever the target description contains.  Due to a historical mishap
 861    the FPA registers appear in between core integer regs and the CPSR.
 862    We hack round this by giving the FPA regs zero size when talking to a
 863    newer gdb.  */
 864 #define NUM_CORE_REGS 26
 865 #define GDB_CORE_XML "arm-core.xml"
 866
 867 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 868 {
 869     if (n < 16) {
 870         /* Core integer register.  */
 871         GET_REG32(env->regs[n]);
 872     }
 873     if (n < 24) {
 874         /* FPA registers.  */
 875         if (gdb_has_xml)
 876             return 0;
 877         memset(mem_buf, 0, 12);
 878         return 12;
 879     }
 880     switch (n) {
 881     case 24:
 882         /* FPA status register.  */
 883         if (gdb_has_xml)
 884             return 0;
 885         GET_REG32(0);
 886     case 25:
 887         /* CPSR */
 888         GET_REG32(cpsr_read(env));
 889     }
 890     /* Unknown register.  */
 891     return 0;
 892 }
 893
 894 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 895 {
 896     uint32_t tmp;
 897
 898     tmp = ldl_p(mem_buf);
 899
 900     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 901        cause problems if we ever implement the Jazelle DBX extensions.  */
 902     if (n == 15)
 903         tmp &= ~1;
 904
 905     if (n < 16) {
 906         /* Core integer register.  */
 907         env->regs[n] = tmp;
 908         return 4;
 909     }
 910     if (n < 24) { /* 16-23 */
 911         /* FPA registers (ignored).  */
 912         if (gdb_has_xml)
 913             return 0;
 914         return 12;
 915     }
 916     switch (n) {
 917     case 24:
 918         /* FPA status register (ignored).  */
 919         if (gdb_has_xml)
 920             return 0;
 921         return 4;
 922     case 25:
 923         /* CPSR */
 924         cpsr_write (env, tmp, 0xffffffff);
 925         return 4;
 926     }
 927     /* Unknown register.  */
 928     return 0;
 929 }
 930
 931 #elif defined (TARGET_M68K)
 932
 933 #define NUM_CORE_REGS 18
 934
 935 #define GDB_CORE_XML "cf-core.xml"
 936
 937 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 938 {
 939     if (n < 8) {
 940         /* D0-D7 */
 941         GET_REG32(env->dregs[n]);
 942     } else if (n < 16) {
 943         /* A0-A7 */
 944         GET_REG32(env->aregs[n - 8]);
 945     } else {
 946         switch (n) {
 947         case 16: GET_REG32(env->sr);
 948         case 17: GET_REG32(env->pc);
 949         }
 950     }
 951     /* FP registers not included here because they vary between
 952        ColdFire and m68k.  Use XML bits for these.  */
 953     return 0;
 954 }
 955
 956 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 957 {
 958     uint32_t tmp;
 959
 960     tmp = ldl_p(mem_buf);
 961
 962     if (n < 8) {
 963         /* D0-D7 */
 964         env->dregs[n] = tmp;
 965     } else if (n < 8) {
 966         /* A0-A7 */
 967         env->aregs[n - 8] = tmp;
 968     } else {
 969         switch (n) {
 970         case 16: env->sr = tmp; break;
 971         case 17: env->pc = tmp; break;
 972         default: return 0;
 973         }
 974     }
 975     return 4;
 976 }
 977 #elif defined (TARGET_MIPS)
 978
 979 #define NUM_CORE_REGS 73
 980
 981 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 982 {
 983     if (n < 32) {
 984         GET_REGL(env->active_tc.gpr[n]);
 985     }
 986     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
 987         if (n >= 38 && n < 70) {
 988             if (env->CP0_Status & (1 << CP0St_FR))
 989                 GET_REGL(env->active_fpu.fpr[n - 38].d);
 990             else
 991                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
 992         }
 993         switch (n) {
 994         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
 995         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
 996         }
 997     }
 998     switch (n) {
 999     case 32: GET_REGL((int32_t)env->CP0_Status);
1000     case 33: GET_REGL(env->active_tc.LO[0]);
1001     case 34: GET_REGL(env->active_tc.HI[0]);
1002     case 35: GET_REGL(env->CP0_BadVAddr);
1003     case 36: GET_REGL((int32_t)env->CP0_Cause);
1004     case 37: GET_REGL(env->active_tc.PC);
1005     case 72: GET_REGL(0); /* fp */
1006     case 89: GET_REGL((int32_t)env->CP0_PRid);
1007     }
1008     if (n >= 73 && n <= 88) {
1009         /* 16 embedded regs.  */
1010         GET_REGL(0);
1011     }
1012
1013     return 0;
1014 }
1015
1016 /* convert MIPS rounding mode in FCR31 to IEEE library */
1017 static unsigned int ieee_rm[] =
1018   {
1019     float_round_nearest_even,
1020     float_round_to_zero,
1021     float_round_up,
1022     float_round_down
1023   };
1024 #define RESTORE_ROUNDING_MODE \
1025     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1026
1027 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1028 {
1029     target_ulong tmp;
1030
1031     tmp = ldtul_p(mem_buf);
1032
1033     if (n < 32) {
1034         env->active_tc.gpr[n] = tmp;
1035         return sizeof(target_ulong);
1036     }
1037     if (env->CP0_Config1 & (1 << CP0C1_FP)
1038             && n >= 38 && n < 73) {
1039         if (n < 70) {
1040             if (env->CP0_Status & (1 << CP0St_FR))
1041               env->active_fpu.fpr[n - 38].d = tmp;
1042             else
1043               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1044         }
1045         switch (n) {
1046         case 70:
1047             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1048             /* set rounding mode */
1049             RESTORE_ROUNDING_MODE;
1050 #ifndef CONFIG_SOFTFLOAT
1051             /* no floating point exception for native float */
1052             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1053 #endif
1054             break;
1055         case 71: env->active_fpu.fcr0 = tmp; break;
1056         }
1057         return sizeof(target_ulong);
1058     }
1059     switch (n) {
1060     case 32: env->CP0_Status = tmp; break;
1061     case 33: env->active_tc.LO[0] = tmp; break;
1062     case 34: env->active_tc.HI[0] = tmp; break;
1063     case 35: env->CP0_BadVAddr = tmp; break;
1064     case 36: env->CP0_Cause = tmp; break;
1065     case 37: env->active_tc.PC = tmp; break;
1066     case 72: /* fp, ignored */ break;
1067     default:
1068         if (n > 89)
1069             return 0;
1070         /* Other registers are readonly.  Ignore writes.  */
1071         break;
1072     }
1073
1074     return sizeof(target_ulong);
1075 }
1076 #elif defined (TARGET_SH4)
1077
1078 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1079 /* FIXME: We should use XML for this.  */
1080
1081 #define NUM_CORE_REGS 59
1082
1083 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1084 {
1085     if (n < 8) {
1086         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1087             GET_REGL(env->gregs[n + 16]);
1088         } else {
1089             GET_REGL(env->gregs[n]);
1090         }
1091     } else if (n < 16) {
1092         GET_REGL(env->gregs[n - 8]);
1093     } else if (n >= 25 && n < 41) {
1094         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1095     } else if (n >= 43 && n < 51) {
1096         GET_REGL(env->gregs[n - 43]);
1097     } else if (n >= 51 && n < 59) {
1098         GET_REGL(env->gregs[n - (51 - 16)]);
1099     }
1100     switch (n) {
1101     case 16: GET_REGL(env->pc);
1102     case 17: GET_REGL(env->pr);
1103     case 18: GET_REGL(env->gbr);
1104     case 19: GET_REGL(env->vbr);
1105     case 20: GET_REGL(env->mach);
1106     case 21: GET_REGL(env->macl);
1107     case 22: GET_REGL(env->sr);
1108     case 23: GET_REGL(env->fpul);
1109     case 24: GET_REGL(env->fpscr);
1110     case 41: GET_REGL(env->ssr);
1111     case 42: GET_REGL(env->spc);
1112     }
1113
1114     return 0;
1115 }
1116
1117 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1118 {
1119     uint32_t tmp;
1120
1121     tmp = ldl_p(mem_buf);
1122
1123     if (n < 8) {
1124         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1125             env->gregs[n + 16] = tmp;
1126         } else {
1127             env->gregs[n] = tmp;
1128         }
1129         return 4;
1130     } else if (n < 16) {
1131         env->gregs[n - 8] = tmp;
1132         return 4;
1133     } else if (n >= 25 && n < 41) {
1134         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1135     } else if (n >= 43 && n < 51) {
1136         env->gregs[n - 43] = tmp;
1137         return 4;
1138     } else if (n >= 51 && n < 59) {
1139         env->gregs[n - (51 - 16)] = tmp;
1140         return 4;
1141     }
1142     switch (n) {
1143     case 16: env->pc = tmp;
1144     case 17: env->pr = tmp;
1145     case 18: env->gbr = tmp;
1146     case 19: env->vbr = tmp;
1147     case 20: env->mach = tmp;
1148     case 21: env->macl = tmp;
1149     case 22: env->sr = tmp;
1150     case 23: env->fpul = tmp;
1151     case 24: env->fpscr = tmp;
1152     case 41: env->ssr = tmp;
1153     case 42: env->spc = tmp;
1154     default: return 0;
1155     }
1156
1157     return 4;
1158 }
1159 #elif defined (TARGET_CRIS)
1160
1161 #define NUM_CORE_REGS 49
1162
1163 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1164 {
1165     uint8_t srs;
1166
1167     srs = env->pregs[PR_SRS];
1168     if (n < 16) {
1169         GET_REG32(env->regs[n]);
1170     }
1171
1172     if (n >= 21 && n < 32) {
1173         GET_REG32(env->pregs[n - 16]);
1174     }
1175     if (n >= 33 && n < 49) {
1176         GET_REG32(env->sregs[srs][n - 33]);
1177     }
1178     switch (n) {
1179     case 16: GET_REG8(env->pregs[0]);
1180     case 17: GET_REG8(env->pregs[1]);
1181     case 18: GET_REG32(env->pregs[2]);
1182     case 19: GET_REG8(srs);
1183     case 20: GET_REG16(env->pregs[4]);
1184     case 32: GET_REG32(env->pc);
1185     }
1186
1187     return 0;
1188 }
1189
1190 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1191 {
1192     uint32_t tmp;
1193
1194     if (n > 49)
1195         return 0;
1196
1197     tmp = ldl_p(mem_buf);
1198
1199     if (n < 16) {
1200         env->regs[n] = tmp;
1201     }
1202
1203     if (n >= 21 && n < 32) {
1204         env->pregs[n - 16] = tmp;
1205     }
1206
1207     /* FIXME: Should support function regs be writable?  */
1208     switch (n) {
1209     case 16: return 1;
1210     case 17: return 1;
1211     case 18: env->pregs[PR_PID] = tmp; break;
1212     case 19: return 1;
1213     case 20: return 2;
1214     case 32: env->pc = tmp; break;
1215     }
1216
1217     return 4;
1218 }
1219 #elif defined (TARGET_ALPHA)
1220
1221 #define NUM_CORE_REGS 65
1222
1223 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1224 {
1225     if (n < 31) {
1226        GET_REGL(env->ir[n]);
1227     }
1228     else if (n == 31) {
1229        GET_REGL(0);
1230     }
1231     else if (n<63) {
1232        uint64_t val;
1233
1234        val=*((uint64_t *)&env->fir[n-32]);
1235        GET_REGL(val);
1236     }
1237     else if (n==63) {
1238        GET_REGL(env->fpcr);
1239     }
1240     else if (n==64) {
1241        GET_REGL(env->pc);
1242     }
1243     else {
1244        GET_REGL(0);
1245     }
1246
1247     return 0;
1248 }
1249
1250 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1251 {
1252     target_ulong tmp;
1253     tmp = ldtul_p(mem_buf);
1254
1255     if (n < 31) {
1256         env->ir[n] = tmp;
1257     }
1258
1259     if (n > 31 && n < 63) {
1260         env->fir[n - 32] = ldfl_p(mem_buf);
1261     }
1262
1263     if (n == 64 ) {
1264        env->pc=tmp;
1265     }
1266
1267     return 8;
1268 }
1269 #elif defined (TARGET_HPPA)
1270
1271 #ifdef TARGET_HPPA64
1272 #define NUM_CORE_REGS 96
1273 #else
1274 #define NUM_CORE_REGS 128
1275 #endif
1276
1277 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1278 {
1279     if (n == 0) {
1280         GET_REGL(env->psw);
1281     } else if (n < 32) {
1282         /* gr0 is hardwired to zero */
1283         /* gr1..gr32 */
1284         GET_REGL(env->gr[n]);
1285     } else if (n == 32) {
1286         GET_REGL(0); /* FIXME: sar */
1287     } else if (n == 33) {
1288         GET_REGL(env->iaoq[0]);
1289     } else if (n == 34) {
1290         GET_REG32(env->iasq[0]);
1291     } else if (n == 35) {
1292         GET_REGL(env->iaoq[1]);
1293     } else if (n == 36) {
1294         GET_REG32(env->iasq[1]);
1295     } else {
1296         /* FIXME: floating point */
1297         GET_REGL(0);
1298     }
1299
1300     return 0;
1301 }
1302
1303 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1304 {
1305     target_ulong tmp;
1306
1307     tmp = ldtul_p(mem_buf);
1308
1309     if (n == 0) {
1310         env->psw = tmp;
1311     } else if (n < 32) {
1312         /* gr0 is hardwired to zero */
1313         /* gr1..gr32 */
1314         env->gr[n] = tmp;
1315     } else if (n == 32) {
1316         /* FIXME: sar */
1317     } else if (n == 33) {
1318         env->iaoq[0] = tmp;
1319     } else if (n == 34) {
1320         env->iasq[0] = ldl_p(mem_buf);
1321         return 4;
1322     } else if (n == 35) {
1323         env->iaoq[1] = tmp;
1324     } else if (n == 36) {
1325         env->iasq[1] = ldl_p(mem_buf);
1326         return 4;
1327     } else {
1328         /* FIXME: floating point */
1329     }
1330
1331     return sizeof(target_ulong);
1332 }
1333
1334 #else
1335
1336 #define NUM_CORE_REGS 0
1337
1338 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1339 {
1340     return 0;
1341 }
1342
1343 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1344 {
1345     return 0;
1346 }
1347
1348 #endif
1349
1350 static int num_g_regs = NUM_CORE_REGS;
1351
1352 #ifdef GDB_CORE_XML
1353 /* Encode data using the encoding for 'x' packets.  */
1354 static int memtox(char *buf, const char *mem, int len)
1355 {
1356     char *p = buf;
1357     char c;
1358
1359     while (len--) {
1360         c = *(mem++);
1361         switch (c) {
1362         case '#': case '$': case '*': case '}':
1363             *(p++) = '}';
1364             *(p++) = c ^ 0x20;
1365             break;
1366         default:
1367             *(p++) = c;
1368             break;
1369         }
1370     }
1371     return p - buf;
1372 }
1373
1374 static const char *get_feature_xml(const char *p, const char **newp)
1375 {
1376     extern const char *const xml_builtin[][2];
1377     size_t len;
1378     int i;
1379     const char *name;
1380     static char target_xml[1024];
1381
1382     len = 0;
1383     while (p[len] && p[len] != ':')
1384         len++;
1385     *newp = p + len;
1386
1387     name = NULL;
1388     if (strncmp(p, "target.xml", len) == 0) {
1389         /* Generate the XML description for this CPU.  */
1390         if (!target_xml[0]) {
1391             GDBRegisterState *r;
1392
1393             snprintf(target_xml, sizeof(target_xml),
1394                      "<?xml version=\"1.0\"?>"
1395                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1396                      "<target>"
1397                      "<xi:include href=\"%s\"/>",
1398                      GDB_CORE_XML);
1399
1400             for (r = first_cpu->gdb_regs; r; r = r->next) {
1401                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
1402                 pstrcat(target_xml, sizeof(target_xml), r->xml);
1403                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
1404             }
1405             pstrcat(target_xml, sizeof(target_xml), "</target>");
1406         }
1407         return target_xml;
1408     }
1409     for (i = 0; ; i++) {
1410         name = xml_builtin[i][0];
1411         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1412             break;
1413     }
1414     return name ? xml_builtin[i][1] : NULL;
1415 }
1416 #endif
1417
1418 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1419 {
1420     GDBRegisterState *r;
1421
1422     if (reg < NUM_CORE_REGS)
1423         return cpu_gdb_read_register(env, mem_buf, reg);
1424
1425     for (r = env->gdb_regs; r; r = r->next) {
1426         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1427             return r->get_reg(env, mem_buf, reg - r->base_reg);
1428         }
1429     }
1430     return 0;
1431 }
1432
1433 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1434 {
1435     GDBRegisterState *r;
1436
1437     if (reg < NUM_CORE_REGS)
1438         return cpu_gdb_write_register(env, mem_buf, reg);
1439
1440     for (r = env->gdb_regs; r; r = r->next) {
1441         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1442             return r->set_reg(env, mem_buf, reg - r->base_reg);
1443         }
1444     }
1445     return 0;
1446 }
1447
1448 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1449    specifies the first register number and these registers are included in
1450    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1451    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1452  */
1453
1454 void gdb_register_coprocessor(CPUState * env,
1455                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1456                              int num_regs, const char *xml, int g_pos)
1457 {
1458     GDBRegisterState *s;
1459     GDBRegisterState **p;
1460     static int last_reg = NUM_CORE_REGS;
1461
1462     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1463     s->base_reg = last_reg;
1464     s->num_regs = num_regs;
1465     s->get_reg = get_reg;
1466     s->set_reg = set_reg;
1467     s->xml = xml;
1468     p = &env->gdb_regs;
1469     while (*p) {
1470         /* Check for duplicates.  */
1471         if (strcmp((*p)->xml, xml) == 0)
1472             return;
1473         p = &(*p)->next;
1474     }
1475     /* Add to end of list.  */
1476     last_reg += num_regs;
1477     *p = s;
1478     if (g_pos) {
1479         if (g_pos != s->base_reg) {
1480             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1481                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1482         } else {
1483             num_g_regs = last_reg;
1484         }
1485     }
1486 }
1487
1488 #ifndef CONFIG_USER_ONLY
1489 static const int xlat_gdb_type[] = {
1490     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1491     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1492     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1493 };
1494 #endif
1495
1496 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1497 {
1498     CPUState *env;
1499     int err = 0;
1500
1501     if (kvm_enabled())
1502         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1503
1504     switch (type) {
1505     case GDB_BREAKPOINT_SW:
1506     case GDB_BREAKPOINT_HW:
1507         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1508             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1509             if (err)
1510                 break;
1511         }
1512         return err;
1513 #ifndef CONFIG_USER_ONLY
1514     case GDB_WATCHPOINT_WRITE:
1515     case GDB_WATCHPOINT_READ:
1516     case GDB_WATCHPOINT_ACCESS:
1517         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1518             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1519                                         NULL);
1520             if (err)
1521                 break;
1522         }
1523         return err;
1524 #endif
1525     default:
1526         return -ENOSYS;
1527     }
1528 }
1529
1530 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1531 {
1532     CPUState *env;
1533     int err = 0;
1534
1535     if (kvm_enabled())
1536         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1537
1538     switch (type) {
1539     case GDB_BREAKPOINT_SW:
1540     case GDB_BREAKPOINT_HW:
1541         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1542             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1543             if (err)
1544                 break;
1545         }
1546         return err;
1547 #ifndef CONFIG_USER_ONLY
1548     case GDB_WATCHPOINT_WRITE:
1549     case GDB_WATCHPOINT_READ:
1550     case GDB_WATCHPOINT_ACCESS:
1551         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1552             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1553             if (err)
1554                 break;
1555         }
1556         return err;
1557 #endif
1558     default:
1559         return -ENOSYS;
1560     }
1561 }
1562
1563 static void gdb_breakpoint_remove_all(void)
1564 {
1565     CPUState *env;
1566
1567     if (kvm_enabled()) {
1568         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1569         return;
1570     }
1571
1572     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1573         cpu_breakpoint_remove_all(env, BP_GDB);
1574 #ifndef CONFIG_USER_ONLY
1575         cpu_watchpoint_remove_all(env, BP_GDB);
1576 #endif
1577     }
1578 }
1579
1580 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1581 {
1582 #if defined(TARGET_I386)
1583     s->c_cpu->eip = pc;
1584     cpu_synchronize_state(s->c_cpu, 1);
1585 #elif defined (TARGET_PPC)
1586     s->c_cpu->nip = pc;
1587 #elif defined (TARGET_SPARC)
1588     s->c_cpu->pc = pc;
1589     s->c_cpu->npc = pc + 4;
1590 #elif defined (TARGET_ARM)
1591     s->c_cpu->regs[15] = pc;
1592 #elif defined (TARGET_SH4)
1593     s->c_cpu->pc = pc;
1594 #elif defined (TARGET_MIPS)
1595     s->c_cpu->active_tc.PC = pc;
1596 #elif defined (TARGET_CRIS)
1597     s->c_cpu->pc = pc;
1598 #elif defined (TARGET_ALPHA)
1599     s->c_cpu->pc = pc;
1600 #elif defined (TARGET_HPPA)
1601     s->c_cpu->iaoq[0] = pc;
1602     s->c_cpu->iaoq[1] = pc + 4;
1603 #endif
1604 }
1605
1606 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1607 {
1608     CPUState *env;
1609     const char *p;
1610     int ch, reg_size, type, res, thread;
1611     char buf[MAX_PACKET_LENGTH];
1612     uint8_t mem_buf[MAX_PACKET_LENGTH];
1613     uint8_t *registers;
1614     target_ulong addr, len;
1615
1616 #ifdef DEBUG_GDB
1617     printf("command='%s'\n", line_buf);
1618 #endif
1619     p = line_buf;
1620     ch = *p++;
1621     switch(ch) {
1622     case '?':
1623         /* TODO: Make this return the correct value for user-mode.  */
1624         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1625                  s->c_cpu->cpu_index+1);
1626         put_packet(s, buf);
1627         /* Remove all the breakpoints when this query is issued,
1628          * because gdb is doing and initial connect and the state
1629          * should be cleaned up.
1630          */
1631         gdb_breakpoint_remove_all();
1632         break;
1633     case 'c':
1634         if (*p != '\0') {
1635             addr = strtoull(p, (char **)&p, 16);
1636             gdb_set_cpu_pc(s, addr);
1637         }
1638         s->signal = 0;
1639         gdb_continue(s);
1640         return RS_IDLE;
1641     case 'C':
1642         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1643         if (s->signal == -1)
1644             s->signal = 0;
1645         gdb_continue(s);
1646         return RS_IDLE;
1647     case 'k':
1648         /* Kill the target */
1649         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1650         exit(0);
1651     case 'D':
1652         /* Detach packet */
1653         gdb_breakpoint_remove_all();
1654         gdb_continue(s);
1655         put_packet(s, "OK");
1656         break;
1657     case 's':
1658         if (*p != '\0') {
1659             addr = strtoull(p, (char **)&p, 16);
1660             gdb_set_cpu_pc(s, addr);
1661         }
1662         cpu_single_step(s->c_cpu, sstep_flags);
1663         gdb_continue(s);
1664         return RS_IDLE;
1665     case 'F':
1666         {
1667             target_ulong ret;
1668             target_ulong err;
1669
1670             ret = strtoull(p, (char **)&p, 16);
1671             if (*p == ',') {
1672                 p++;
1673                 err = strtoull(p, (char **)&p, 16);
1674             } else {
1675                 err = 0;
1676             }
1677             if (*p == ',')
1678                 p++;
1679             type = *p;
1680             if (gdb_current_syscall_cb)
1681                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1682             if (type == 'C') {
1683                 put_packet(s, "T02");
1684             } else {
1685                 gdb_continue(s);
1686             }
1687         }
1688         break;
1689     case 'g':
1690         cpu_synchronize_state(s->g_cpu, 0);
1691         len = 0;
1692         for (addr = 0; addr < num_g_regs; addr++) {
1693             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1694             len += reg_size;
1695         }
1696         memtohex(buf, mem_buf, len);
1697         put_packet(s, buf);
1698         break;
1699     case 'G':
1700         registers = mem_buf;
1701         len = strlen(p) / 2;
1702         hextomem((uint8_t *)registers, p, len);
1703         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1704             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1705             len -= reg_size;
1706             registers += reg_size;
1707         }
1708         cpu_synchronize_state(s->g_cpu, 1);
1709         put_packet(s, "OK");
1710         break;
1711     case 'm':
1712         addr = strtoull(p, (char **)&p, 16);
1713         if (*p == ',')
1714             p++;
1715         len = strtoull(p, NULL, 16);
1716         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1717             put_packet (s, "E14");
1718         } else {
1719             memtohex(buf, mem_buf, len);
1720             put_packet(s, buf);
1721         }
1722         break;
1723     case 'M':
1724         addr = strtoull(p, (char **)&p, 16);
1725         if (*p == ',')
1726             p++;
1727         len = strtoull(p, (char **)&p, 16);
1728         if (*p == ':')
1729             p++;
1730         hextomem(mem_buf, p, len);
1731         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1732             put_packet(s, "E14");
1733         else
1734             put_packet(s, "OK");
1735         break;
1736     case 'p':
1737         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1738            This works, but can be very slow.  Anything new enough to
1739            understand XML also knows how to use this properly.  */
1740         if (!gdb_has_xml)
1741             goto unknown_command;
1742         addr = strtoull(p, (char **)&p, 16);
1743         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1744         if (reg_size) {
1745             memtohex(buf, mem_buf, reg_size);
1746             put_packet(s, buf);
1747         } else {
1748             put_packet(s, "E14");
1749         }
1750         break;
1751     case 'P':
1752         if (!gdb_has_xml)
1753             goto unknown_command;
1754         addr = strtoull(p, (char **)&p, 16);
1755         if (*p == '=')
1756             p++;
1757         reg_size = strlen(p) / 2;
1758         hextomem(mem_buf, p, reg_size);
1759         gdb_write_register(s->g_cpu, mem_buf, addr);
1760         put_packet(s, "OK");
1761         break;
1762     case 'Z':
1763     case 'z':
1764         type = strtoul(p, (char **)&p, 16);
1765         if (*p == ',')
1766             p++;
1767         addr = strtoull(p, (char **)&p, 16);
1768         if (*p == ',')
1769             p++;
1770         len = strtoull(p, (char **)&p, 16);
1771         if (ch == 'Z')
1772             res = gdb_breakpoint_insert(addr, len, type);
1773         else
1774             res = gdb_breakpoint_remove(addr, len, type);
1775         if (res >= 0)
1776              put_packet(s, "OK");
1777         else if (res == -ENOSYS)
1778             put_packet(s, "");
1779         else
1780             put_packet(s, "E22");
1781         break;
1782     case 'H':
1783         type = *p++;
1784         thread = strtoull(p, (char **)&p, 16);
1785         if (thread == -1 || thread == 0) {
1786             put_packet(s, "OK");
1787             break;
1788         }
1789         for (env = first_cpu; env != NULL; env = env->next_cpu)
1790             if (env->cpu_index + 1 == thread)
1791                 break;
1792         if (env == NULL) {
1793             put_packet(s, "E22");
1794             break;
1795         }
1796         switch (type) {
1797         case 'c':
1798             s->c_cpu = env;
1799             put_packet(s, "OK");
1800             break;
1801         case 'g':
1802             s->g_cpu = env;
1803             put_packet(s, "OK");
1804             break;
1805         default:
1806              put_packet(s, "E22");
1807              break;
1808         }
1809         break;
1810     case 'T':
1811         thread = strtoull(p, (char **)&p, 16);
1812 #ifndef CONFIG_USER_ONLY
1813         if (thread > 0 && thread < smp_cpus + 1)
1814 #else
1815         if (thread == 1)
1816 #endif
1817              put_packet(s, "OK");
1818         else
1819             put_packet(s, "E22");
1820         break;
1821     case 'q':
1822     case 'Q':
1823         /* parse any 'q' packets here */
1824         if (!strcmp(p,"qemu.sstepbits")) {
1825             /* Query Breakpoint bit definitions */
1826             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1827                      SSTEP_ENABLE,
1828                      SSTEP_NOIRQ,
1829                      SSTEP_NOTIMER);
1830             put_packet(s, buf);
1831             break;
1832         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1833             /* Display or change the sstep_flags */
1834             p += 10;
1835             if (*p != '=') {
1836                 /* Display current setting */
1837                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1838                 put_packet(s, buf);
1839                 break;
1840             }
1841             p++;
1842             type = strtoul(p, (char **)&p, 16);
1843             sstep_flags = type;
1844             put_packet(s, "OK");
1845             break;
1846         } else if (strcmp(p,"C") == 0) {
1847             /* "Current thread" remains vague in the spec, so always return
1848              *  the first CPU (gdb returns the first thread). */
1849             put_packet(s, "QC1");
1850             break;
1851         } else if (strcmp(p,"fThreadInfo") == 0) {
1852             s->query_cpu = first_cpu;
1853             goto report_cpuinfo;
1854         } else if (strcmp(p,"sThreadInfo") == 0) {
1855         report_cpuinfo:
1856             if (s->query_cpu) {
1857                 snprintf(buf, sizeof(buf), "m%x", s->query_cpu->cpu_index+1);
1858                 put_packet(s, buf);
1859                 s->query_cpu = s->query_cpu->next_cpu;
1860             } else
1861                 put_packet(s, "l");
1862             break;
1863         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1864             thread = strtoull(p+16, (char **)&p, 16);
1865             for (env = first_cpu; env != NULL; env = env->next_cpu)
1866                 if (env->cpu_index + 1 == thread) {
1867                     cpu_synchronize_state(env, 0);
1868                     len = snprintf((char *)mem_buf, sizeof(mem_buf),
1869                                    "CPU#%d [%s]", env->cpu_index,
1870                                    env->halted ? "halted " : "running");
1871                     memtohex(buf, mem_buf, len);
1872                     put_packet(s, buf);
1873                     break;
1874                 }
1875             break;
1876         }
1877 #ifdef CONFIG_USER_ONLY
1878         else if (strncmp(p, "Offsets", 7) == 0) {
1879             TaskState *ts = s->c_cpu->opaque;
1880
1881             snprintf(buf, sizeof(buf),
1882                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1883                      ";Bss=" TARGET_ABI_FMT_lx,
1884                      ts->info->code_offset,
1885                      ts->info->data_offset,
1886                      ts->info->data_offset);
1887             put_packet(s, buf);
1888             break;
1889         }
1890 #else /* !CONFIG_USER_ONLY */
1891         else if (strncmp(p, "Rcmd,", 5) == 0) {
1892             int len = strlen(p + 5);
1893
1894             if ((len % 2) != 0) {
1895                 put_packet(s, "E01");
1896                 break;
1897             }
1898             hextomem(mem_buf, p + 5, len);
1899             len = len / 2;
1900             mem_buf[len++] = 0;
1901             qemu_chr_read(s->mon_chr, mem_buf, len);
1902             put_packet(s, "OK");
1903             break;
1904         }
1905 #endif /* !CONFIG_USER_ONLY */
1906         if (strncmp(p, "Supported", 9) == 0) {
1907             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1908 #ifdef GDB_CORE_XML
1909             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1910 #endif
1911             put_packet(s, buf);
1912             break;
1913         }
1914 #ifdef GDB_CORE_XML
1915         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1916             const char *xml;
1917             target_ulong total_len;
1918
1919             gdb_has_xml = 1;
1920             p += 19;
1921             xml = get_feature_xml(p, &p);
1922             if (!xml) {
1923                 snprintf(buf, sizeof(buf), "E00");
1924                 put_packet(s, buf);
1925                 break;
1926             }
1927
1928             if (*p == ':')
1929                 p++;
1930             addr = strtoul(p, (char **)&p, 16);
1931             if (*p == ',')
1932                 p++;
1933             len = strtoul(p, (char **)&p, 16);
1934
1935             total_len = strlen(xml);
1936             if (addr > total_len) {
1937                 snprintf(buf, sizeof(buf), "E00");
1938                 put_packet(s, buf);
1939                 break;
1940             }
1941             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1942                 len = (MAX_PACKET_LENGTH - 5) / 2;
1943             if (len < total_len - addr) {
1944                 buf[0] = 'm';
1945                 len = memtox(buf + 1, xml + addr, len);
1946             } else {
1947                 buf[0] = 'l';
1948                 len = memtox(buf + 1, xml + addr, total_len - addr);
1949             }
1950             put_packet_binary(s, buf, len + 1);
1951             break;
1952         }
1953 #endif
1954         /* Unrecognised 'q' command.  */
1955         goto unknown_command;
1956
1957     default:
1958     unknown_command:
1959         /* put empty packet */
1960         buf[0] = '\0';
1961         put_packet(s, buf);
1962         break;
1963     }
1964     return RS_IDLE;
1965 }
1966
1967 void gdb_set_stop_cpu(CPUState *env)
1968 {
1969     gdbserver_state->c_cpu = env;
1970     gdbserver_state->g_cpu = env;
1971 }
1972
1973 #ifndef CONFIG_USER_ONLY
1974 static void gdb_vm_state_change(void *opaque, int running, int reason)
1975 {
1976     GDBState *s = gdbserver_state;
1977     CPUState *env = s->c_cpu;
1978     char buf[256];
1979     const char *type;
1980     int ret;
1981
1982     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
1983         s->state == RS_INACTIVE || s->state == RS_SYSCALL)
1984         return;
1985
1986     /* disable single step if it was enable */
1987     cpu_single_step(env, 0);
1988
1989     if (reason == EXCP_DEBUG) {
1990         if (env->watchpoint_hit) {
1991             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
1992             case BP_MEM_READ:
1993                 type = "r";
1994                 break;
1995             case BP_MEM_ACCESS:
1996                 type = "a";
1997                 break;
1998             default:
1999                 type = "";
2000                 break;
2001             }
2002             snprintf(buf, sizeof(buf),
2003                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
2004                      GDB_SIGNAL_TRAP, env->cpu_index+1, type,
2005                      env->watchpoint_hit->vaddr);
2006             put_packet(s, buf);
2007             env->watchpoint_hit = NULL;
2008             return;
2009         }
2010         tb_flush(env);
2011         ret = GDB_SIGNAL_TRAP;
2012     } else {
2013         ret = GDB_SIGNAL_INT;
2014     }
2015     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, env->cpu_index+1);
2016     put_packet(s, buf);
2017 }
2018 #endif
2019
2020 /* Send a gdb syscall request.
2021    This accepts limited printf-style format specifiers, specifically:
2022     %x  - target_ulong argument printed in hex.
2023     %lx - 64-bit argument printed in hex.
2024     %s  - string pointer (target_ulong) and length (int) pair.  */
2025 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
2026 {
2027     va_list va;
2028     char buf[256];
2029     char *p;
2030     target_ulong addr;
2031     uint64_t i64;
2032     GDBState *s;
2033
2034     s = gdbserver_state;
2035     if (!s)
2036         return;
2037     gdb_current_syscall_cb = cb;
2038     s->state = RS_SYSCALL;
2039 #ifndef CONFIG_USER_ONLY
2040     vm_stop(EXCP_DEBUG);
2041 #endif
2042     s->state = RS_IDLE;
2043     va_start(va, fmt);
2044     p = buf;
2045     *(p++) = 'F';
2046     while (*fmt) {
2047         if (*fmt == '%') {
2048             fmt++;
2049             switch (*fmt++) {
2050             case 'x':
2051                 addr = va_arg(va, target_ulong);
2052                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
2053                 break;
2054             case 'l':
2055                 if (*(fmt++) != 'x')
2056                     goto bad_format;
2057                 i64 = va_arg(va, uint64_t);
2058                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
2059                 break;
2060             case 's':
2061                 addr = va_arg(va, target_ulong);
2062                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
2063                               addr, va_arg(va, int));
2064                 break;
2065             default:
2066             bad_format:
2067                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2068                         fmt - 1);
2069                 break;
2070             }
2071         } else {
2072             *(p++) = *(fmt++);
2073         }
2074     }
2075     *p = 0;
2076     va_end(va);
2077     put_packet(s, buf);
2078 #ifdef CONFIG_USER_ONLY
2079     gdb_handlesig(s->c_cpu, 0);
2080 #else
2081     cpu_exit(s->c_cpu);
2082 #endif
2083 }
2084
2085 static void gdb_read_byte(GDBState *s, int ch)
2086 {
2087     int i, csum;
2088     uint8_t reply;
2089
2090 #ifndef CONFIG_USER_ONLY
2091     if (s->last_packet_len) {
2092         /* Waiting for a response to the last packet.  If we see the start
2093            of a new command then abandon the previous response.  */
2094         if (ch == '-') {
2095 #ifdef DEBUG_GDB
2096             printf("Got NACK, retransmitting\n");
2097 #endif
2098             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2099         }
2100 #ifdef DEBUG_GDB
2101         else if (ch == '+')
2102             printf("Got ACK\n");
2103         else
2104             printf("Got '%c' when expecting ACK/NACK\n", ch);
2105 #endif
2106         if (ch == '+' || ch == '$')
2107             s->last_packet_len = 0;
2108         if (ch != '$')
2109             return;
2110     }
2111     if (vm_running) {
2112         /* when the CPU is running, we cannot do anything except stop
2113            it when receiving a char */
2114         vm_stop(EXCP_INTERRUPT);
2115     } else
2116 #endif
2117     {
2118         switch(s->state) {
2119         case RS_IDLE:
2120             if (ch == '$') {
2121                 s->line_buf_index = 0;
2122                 s->state = RS_GETLINE;
2123             }
2124             break;
2125         case RS_GETLINE:
2126             if (ch == '#') {
2127             s->state = RS_CHKSUM1;
2128             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2129                 s->state = RS_IDLE;
2130             } else {
2131             s->line_buf[s->line_buf_index++] = ch;
2132             }
2133             break;
2134         case RS_CHKSUM1:
2135             s->line_buf[s->line_buf_index] = '\0';
2136             s->line_csum = fromhex(ch) << 4;
2137             s->state = RS_CHKSUM2;
2138             break;
2139         case RS_CHKSUM2:
2140             s->line_csum |= fromhex(ch);
2141             csum = 0;
2142             for(i = 0; i < s->line_buf_index; i++) {
2143                 csum += s->line_buf[i];
2144             }
2145             if (s->line_csum != (csum & 0xff)) {
2146                 reply = '-';
2147                 put_buffer(s, &reply, 1);
2148                 s->state = RS_IDLE;
2149             } else {
2150                 reply = '+';
2151                 put_buffer(s, &reply, 1);
2152                 s->state = gdb_handle_packet(s, s->line_buf);
2153             }
2154             break;
2155         default:
2156             abort();
2157         }
2158     }
2159 }
2160
2161 #ifdef CONFIG_USER_ONLY
2162 int
2163 gdb_queuesig (void)
2164 {
2165     GDBState *s;
2166
2167     s = gdbserver_state;
2168
2169     if (gdbserver_fd < 0 || s->fd < 0)
2170         return 0;
2171     else
2172         return 1;
2173 }
2174
2175 int
2176 gdb_handlesig (CPUState *env, int sig)
2177 {
2178   GDBState *s;
2179   char buf[256];
2180   int n;
2181
2182   s = gdbserver_state;
2183   if (gdbserver_fd < 0 || s->fd < 0)
2184     return sig;
2185
2186   /* disable single step if it was enabled */
2187   cpu_single_step(env, 0);
2188   tb_flush(env);
2189
2190   if (sig != 0)
2191     {
2192       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2193       put_packet(s, buf);
2194     }
2195   /* put_packet() might have detected that the peer terminated the
2196      connection.  */
2197   if (s->fd < 0)
2198       return sig;
2199
2200   sig = 0;
2201   s->state = RS_IDLE;
2202   s->running_state = 0;
2203   while (s->running_state == 0) {
2204       n = read (s->fd, buf, 256);
2205       if (n > 0)
2206         {
2207           int i;
2208
2209           for (i = 0; i < n; i++)
2210             gdb_read_byte (s, buf[i]);
2211         }
2212       else if (n == 0 || errno != EAGAIN)
2213         {
2214           /* XXX: Connection closed.  Should probably wait for annother
2215              connection before continuing.  */
2216           return sig;
2217         }
2218   }
2219   sig = s->signal;
2220   s->signal = 0;
2221   return sig;
2222 }
2223
2224 /* Tell the remote gdb that the process has exited.  */
2225 void gdb_exit(CPUState *env, int code)
2226 {
2227   GDBState *s;
2228   char buf[4];
2229
2230   s = gdbserver_state;
2231   if (gdbserver_fd < 0 || s->fd < 0)
2232     return;
2233
2234   snprintf(buf, sizeof(buf), "W%02x", code);
2235   put_packet(s, buf);
2236 }
2237
2238 /* Tell the remote gdb that the process has exited due to SIG.  */
2239 void gdb_signalled(CPUState *env, int sig)
2240 {
2241   GDBState *s;
2242   char buf[4];
2243
2244   s = gdbserver_state;
2245   if (gdbserver_fd < 0 || s->fd < 0)
2246     return;
2247
2248   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2249   put_packet(s, buf);
2250 }
2251
2252 static void gdb_accept(void)
2253 {
2254     GDBState *s;
2255     struct sockaddr_in sockaddr;
2256     socklen_t len;
2257     int val, fd;
2258
2259     for(;;) {
2260         len = sizeof(sockaddr);
2261         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2262         if (fd < 0 && errno != EINTR) {
2263             perror("accept");
2264             return;
2265         } else if (fd >= 0) {
2266             break;
2267         }
2268     }
2269
2270     /* set short latency */
2271     val = 1;
2272     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2273
2274     s = qemu_mallocz(sizeof(GDBState));
2275     s->c_cpu = first_cpu;
2276     s->g_cpu = first_cpu;
2277     s->fd = fd;
2278     gdb_has_xml = 0;
2279
2280     gdbserver_state = s;
2281
2282     fcntl(fd, F_SETFL, O_NONBLOCK);
2283 }
2284
2285 static int gdbserver_open(int port)
2286 {
2287     struct sockaddr_in sockaddr;
2288     int fd, val, ret;
2289
2290     fd = socket(PF_INET, SOCK_STREAM, 0);
2291     if (fd < 0) {
2292         perror("socket");
2293         return -1;
2294     }
2295
2296     /* allow fast reuse */
2297     val = 1;
2298     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2299
2300     sockaddr.sin_family = AF_INET;
2301     sockaddr.sin_port = htons(port);
2302     sockaddr.sin_addr.s_addr = 0;
2303     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2304     if (ret < 0) {
2305         perror("bind");
2306         return -1;
2307     }
2308     ret = listen(fd, 0);
2309     if (ret < 0) {
2310         perror("listen");
2311         return -1;
2312     }
2313     return fd;
2314 }
2315
2316 int gdbserver_start(int port)
2317 {
2318     gdbserver_fd = gdbserver_open(port);
2319     if (gdbserver_fd < 0)
2320         return -1;
2321     /* accept connections */
2322     gdb_accept();
2323     return 0;
2324 }
2325
2326 /* Disable gdb stub for child processes.  */
2327 void gdbserver_fork(CPUState *env)
2328 {
2329     GDBState *s = gdbserver_state;
2330     if (gdbserver_fd < 0 || s->fd < 0)
2331       return;
2332     close(s->fd);
2333     s->fd = -1;
2334     cpu_breakpoint_remove_all(env, BP_GDB);
2335     cpu_watchpoint_remove_all(env, BP_GDB);
2336 }
2337 #else
2338 static int gdb_chr_can_receive(void *opaque)
2339 {
2340   /* We can handle an arbitrarily large amount of data.
2341    Pick the maximum packet size, which is as good as anything.  */
2342   return MAX_PACKET_LENGTH;
2343 }
2344
2345 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2346 {
2347     int i;
2348
2349     for (i = 0; i < size; i++) {
2350         gdb_read_byte(gdbserver_state, buf[i]);
2351     }
2352 }
2353
2354 static void gdb_chr_event(void *opaque, int event)
2355 {
2356     switch (event) {
2357     case CHR_EVENT_RESET:
2358         vm_stop(EXCP_INTERRUPT);
2359         gdb_has_xml = 0;
2360         break;
2361     default:
2362         break;
2363     }
2364 }
2365
2366 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2367 {
2368     char buf[MAX_PACKET_LENGTH];
2369
2370     buf[0] = 'O';
2371     if (len > (MAX_PACKET_LENGTH/2) - 1)
2372         len = (MAX_PACKET_LENGTH/2) - 1;
2373     memtohex(buf + 1, (uint8_t *)msg, len);
2374     put_packet(s, buf);
2375 }
2376
2377 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2378 {
2379     const char *p = (const char *)buf;
2380     int max_sz;
2381
2382     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2383     for (;;) {
2384         if (len <= max_sz) {
2385             gdb_monitor_output(gdbserver_state, p, len);
2386             break;
2387         }
2388         gdb_monitor_output(gdbserver_state, p, max_sz);
2389         p += max_sz;
2390         len -= max_sz;
2391     }
2392     return len;
2393 }
2394
2395 #ifndef _WIN32
2396 static void gdb_sigterm_handler(int signal)
2397 {
2398     if (vm_running)
2399         vm_stop(EXCP_INTERRUPT);
2400 }
2401 #endif
2402
2403 int gdbserver_start(const char *device)
2404 {
2405     GDBState *s;
2406     char gdbstub_device_name[128];
2407     CharDriverState *chr = NULL;
2408     CharDriverState *mon_chr;
2409
2410     if (!device)
2411         return -1;
2412     if (strcmp(device, "none") != 0) {
2413         if (strstart(device, "tcp:", NULL)) {
2414             /* enforce required TCP attributes */
2415             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2416                      "%s,nowait,nodelay,server", device);
2417             device = gdbstub_device_name;
2418         }
2419 #ifndef _WIN32
2420         else if (strcmp(device, "stdio") == 0) {
2421             struct sigaction act;
2422
2423             memset(&act, 0, sizeof(act));
2424             act.sa_handler = gdb_sigterm_handler;
2425             sigaction(SIGINT, &act, NULL);
2426         }
2427 #endif
2428         chr = qemu_chr_open("gdb", device, NULL);
2429         if (!chr)
2430             return -1;
2431
2432         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2433                               gdb_chr_event, NULL);
2434     }
2435
2436     s = gdbserver_state;
2437     if (!s) {
2438         s = qemu_mallocz(sizeof(GDBState));
2439         gdbserver_state = s;
2440
2441         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2442
2443         /* Initialize a monitor terminal for gdb */
2444         mon_chr = qemu_mallocz(sizeof(*mon_chr));
2445         mon_chr->chr_write = gdb_monitor_write;
2446         monitor_init(mon_chr, 0);
2447     } else {
2448         if (s->chr)
2449             qemu_chr_close(s->chr);
2450         mon_chr = s->mon_chr;
2451         memset(s, 0, sizeof(GDBState));
2452     }
2453     s->c_cpu = first_cpu;
2454     s->g_cpu = first_cpu;
2455     s->chr = chr;
2456     s->state = chr ? RS_IDLE : RS_INACTIVE;
2457     s->mon_chr = mon_chr;
2458
2459     return 0;
2460 }
2461 #endif