gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA  02110-1301 USA
  19  */
  20 #include "config.h"
  21 #include "qemu-common.h"
  22 #ifdef CONFIG_USER_ONLY
  23 #include <stdlib.h>
  24 #include <stdio.h>
  25 #include <stdarg.h>
  26 #include <string.h>
  27 #include <errno.h>
  28 #include <unistd.h>
  29 #include <fcntl.h>
  30
  31 #include "qemu.h"
  32 #else
  33 #include "monitor.h"
  34 #include "qemu-char.h"
  35 #include "sysemu.h"
  36 #include "gdbstub.h"
  37 #endif
  38
  39 #define MAX_PACKET_LENGTH 4096
  40
  41 #include "qemu_socket.h"
  42 #include "kvm.h"
  43
  44
  45 enum {
  46     GDB_SIGNAL_0 = 0,
  47     GDB_SIGNAL_INT = 2,
  48     GDB_SIGNAL_TRAP = 5,
  49     GDB_SIGNAL_UNKNOWN = 143
  50 };
  51
  52 #ifdef CONFIG_USER_ONLY
  53
  54 /* Map target signal numbers to GDB protocol signal numbers and vice
  55  * versa.  For user emulation's currently supported systems, we can
  56  * assume most signals are defined.
  57  */
  58
  59 static int gdb_signal_table[] = {
  60     0,
  61     TARGET_SIGHUP,
  62     TARGET_SIGINT,
  63     TARGET_SIGQUIT,
  64     TARGET_SIGILL,
  65     TARGET_SIGTRAP,
  66     TARGET_SIGABRT,
  67     -1, /* SIGEMT */
  68     TARGET_SIGFPE,
  69     TARGET_SIGKILL,
  70     TARGET_SIGBUS,
  71     TARGET_SIGSEGV,
  72     TARGET_SIGSYS,
  73     TARGET_SIGPIPE,
  74     TARGET_SIGALRM,
  75     TARGET_SIGTERM,
  76     TARGET_SIGURG,
  77     TARGET_SIGSTOP,
  78     TARGET_SIGTSTP,
  79     TARGET_SIGCONT,
  80     TARGET_SIGCHLD,
  81     TARGET_SIGTTIN,
  82     TARGET_SIGTTOU,
  83     TARGET_SIGIO,
  84     TARGET_SIGXCPU,
  85     TARGET_SIGXFSZ,
  86     TARGET_SIGVTALRM,
  87     TARGET_SIGPROF,
  88     TARGET_SIGWINCH,
  89     -1, /* SIGLOST */
  90     TARGET_SIGUSR1,
  91     TARGET_SIGUSR2,
  92 #ifdef TARGET_SIGPWR
  93     TARGET_SIGPWR,
  94 #else
  95     -1,
  96 #endif
  97     -1, /* SIGPOLL */
  98     -1,
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108     -1,
 109 #ifdef __SIGRTMIN
 110     __SIGRTMIN + 1,
 111     __SIGRTMIN + 2,
 112     __SIGRTMIN + 3,
 113     __SIGRTMIN + 4,
 114     __SIGRTMIN + 5,
 115     __SIGRTMIN + 6,
 116     __SIGRTMIN + 7,
 117     __SIGRTMIN + 8,
 118     __SIGRTMIN + 9,
 119     __SIGRTMIN + 10,
 120     __SIGRTMIN + 11,
 121     __SIGRTMIN + 12,
 122     __SIGRTMIN + 13,
 123     __SIGRTMIN + 14,
 124     __SIGRTMIN + 15,
 125     __SIGRTMIN + 16,
 126     __SIGRTMIN + 17,
 127     __SIGRTMIN + 18,
 128     __SIGRTMIN + 19,
 129     __SIGRTMIN + 20,
 130     __SIGRTMIN + 21,
 131     __SIGRTMIN + 22,
 132     __SIGRTMIN + 23,
 133     __SIGRTMIN + 24,
 134     __SIGRTMIN + 25,
 135     __SIGRTMIN + 26,
 136     __SIGRTMIN + 27,
 137     __SIGRTMIN + 28,
 138     __SIGRTMIN + 29,
 139     __SIGRTMIN + 30,
 140     __SIGRTMIN + 31,
 141     -1, /* SIGCANCEL */
 142     __SIGRTMIN,
 143     __SIGRTMIN + 32,
 144     __SIGRTMIN + 33,
 145     __SIGRTMIN + 34,
 146     __SIGRTMIN + 35,
 147     __SIGRTMIN + 36,
 148     __SIGRTMIN + 37,
 149     __SIGRTMIN + 38,
 150     __SIGRTMIN + 39,
 151     __SIGRTMIN + 40,
 152     __SIGRTMIN + 41,
 153     __SIGRTMIN + 42,
 154     __SIGRTMIN + 43,
 155     __SIGRTMIN + 44,
 156     __SIGRTMIN + 45,
 157     __SIGRTMIN + 46,
 158     __SIGRTMIN + 47,
 159     __SIGRTMIN + 48,
 160     __SIGRTMIN + 49,
 161     __SIGRTMIN + 50,
 162     __SIGRTMIN + 51,
 163     __SIGRTMIN + 52,
 164     __SIGRTMIN + 53,
 165     __SIGRTMIN + 54,
 166     __SIGRTMIN + 55,
 167     __SIGRTMIN + 56,
 168     __SIGRTMIN + 57,
 169     __SIGRTMIN + 58,
 170     __SIGRTMIN + 59,
 171     __SIGRTMIN + 60,
 172     __SIGRTMIN + 61,
 173     __SIGRTMIN + 62,
 174     __SIGRTMIN + 63,
 175     __SIGRTMIN + 64,
 176     __SIGRTMIN + 65,
 177     __SIGRTMIN + 66,
 178     __SIGRTMIN + 67,
 179     __SIGRTMIN + 68,
 180     __SIGRTMIN + 69,
 181     __SIGRTMIN + 70,
 182     __SIGRTMIN + 71,
 183     __SIGRTMIN + 72,
 184     __SIGRTMIN + 73,
 185     __SIGRTMIN + 74,
 186     __SIGRTMIN + 75,
 187     __SIGRTMIN + 76,
 188     __SIGRTMIN + 77,
 189     __SIGRTMIN + 78,
 190     __SIGRTMIN + 79,
 191     __SIGRTMIN + 80,
 192     __SIGRTMIN + 81,
 193     __SIGRTMIN + 82,
 194     __SIGRTMIN + 83,
 195     __SIGRTMIN + 84,
 196     __SIGRTMIN + 85,
 197     __SIGRTMIN + 86,
 198     __SIGRTMIN + 87,
 199     __SIGRTMIN + 88,
 200     __SIGRTMIN + 89,
 201     __SIGRTMIN + 90,
 202     __SIGRTMIN + 91,
 203     __SIGRTMIN + 92,
 204     __SIGRTMIN + 93,
 205     __SIGRTMIN + 94,
 206     __SIGRTMIN + 95,
 207     -1, /* SIGINFO */
 208     -1, /* UNKNOWN */
 209     -1, /* DEFAULT */
 210     -1,
 211     -1,
 212     -1,
 213     -1,
 214     -1,
 215     -1
 216 #endif
 217 };
 218 #else
 219 /* In system mode we only need SIGINT and SIGTRAP; other signals
 220    are not yet supported.  */
 221
 222 enum {
 223     TARGET_SIGINT = 2,
 224     TARGET_SIGTRAP = 5
 225 };
 226
 227 static int gdb_signal_table[] = {
 228     -1,
 229     -1,
 230     TARGET_SIGINT,
 231     -1,
 232     -1,
 233     TARGET_SIGTRAP
 234 };
 235 #endif
 236
 237 #ifdef CONFIG_USER_ONLY
 238 static int target_signal_to_gdb (int sig)
 239 {
 240     int i;
 241     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 242         if (gdb_signal_table[i] == sig)
 243             return i;
 244     return GDB_SIGNAL_UNKNOWN;
 245 }
 246 #endif
 247
 248 static int gdb_signal_to_target (int sig)
 249 {
 250     if (sig < ARRAY_SIZE (gdb_signal_table))
 251         return gdb_signal_table[sig];
 252     else
 253         return -1;
 254 }
 255
 256 //#define DEBUG_GDB
 257
 258 typedef struct GDBRegisterState {
 259     int base_reg;
 260     int num_regs;
 261     gdb_reg_cb get_reg;
 262     gdb_reg_cb set_reg;
 263     const char *xml;
 264     struct GDBRegisterState *next;
 265 } GDBRegisterState;
 266
 267 enum RSState {
 268     RS_IDLE,
 269     RS_GETLINE,
 270     RS_CHKSUM1,
 271     RS_CHKSUM2,
 272     RS_SYSCALL,
 273 };
 274 typedef struct GDBState {
 275     CPUState *c_cpu; /* current CPU for step/continue ops */
 276     CPUState *g_cpu; /* current CPU for other ops */
 277     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 278     enum RSState state; /* parsing state */
 279     char line_buf[MAX_PACKET_LENGTH];
 280     int line_buf_index;
 281     int line_csum;
 282     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 283     int last_packet_len;
 284     int signal;
 285 #ifdef CONFIG_USER_ONLY
 286     int fd;
 287     int running_state;
 288 #else
 289     CharDriverState *chr;
 290     CharDriverState *mon_chr;
 291 #endif
 292 } GDBState;
 293
 294 /* By default use no IRQs and no timers while single stepping so as to
 295  * make single stepping like an ICE HW step.
 296  */
 297 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 298
 299 static GDBState *gdbserver_state;
 300
 301 /* This is an ugly hack to cope with both new and old gdb.
 302    If gdb sends qXfer:features:read then assume we're talking to a newish
 303    gdb that understands target descriptions.  */
 304 static int gdb_has_xml;
 305
 306 #ifdef CONFIG_USER_ONLY
 307 /* XXX: This is not thread safe.  Do we care?  */
 308 static int gdbserver_fd = -1;
 309
 310 static int get_char(GDBState *s)
 311 {
 312     uint8_t ch;
 313     int ret;
 314
 315     for(;;) {
 316         ret = recv(s->fd, &ch, 1, 0);
 317         if (ret < 0) {
 318             if (errno == ECONNRESET)
 319                 s->fd = -1;
 320             if (errno != EINTR && errno != EAGAIN)
 321                 return -1;
 322         } else if (ret == 0) {
 323             close(s->fd);
 324             s->fd = -1;
 325             return -1;
 326         } else {
 327             break;
 328         }
 329     }
 330     return ch;
 331 }
 332 #endif
 333
 334 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 335
 336 enum {
 337     GDB_SYS_UNKNOWN,
 338     GDB_SYS_ENABLED,
 339     GDB_SYS_DISABLED,
 340 } gdb_syscall_mode;
 341
 342 /* If gdb is connected when the first semihosting syscall occurs then use
 343    remote gdb syscalls.  Otherwise use native file IO.  */
 344 int use_gdb_syscalls(void)
 345 {
 346     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 347         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 348                                             : GDB_SYS_DISABLED);
 349     }
 350     return gdb_syscall_mode == GDB_SYS_ENABLED;
 351 }
 352
 353 /* Resume execution.  */
 354 static inline void gdb_continue(GDBState *s)
 355 {
 356 #ifdef CONFIG_USER_ONLY
 357     s->running_state = 1;
 358 #else
 359     vm_start();
 360 #endif
 361 }
 362
 363 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 364 {
 365 #ifdef CONFIG_USER_ONLY
 366     int ret;
 367
 368     while (len > 0) {
 369         ret = send(s->fd, buf, len, 0);
 370         if (ret < 0) {
 371             if (errno != EINTR && errno != EAGAIN)
 372                 return;
 373         } else {
 374             buf += ret;
 375             len -= ret;
 376         }
 377     }
 378 #else
 379     qemu_chr_write(s->chr, buf, len);
 380 #endif
 381 }
 382
 383 static inline int fromhex(int v)
 384 {
 385     if (v >= '0' && v <= '9')
 386         return v - '0';
 387     else if (v >= 'A' && v <= 'F')
 388         return v - 'A' + 10;
 389     else if (v >= 'a' && v <= 'f')
 390         return v - 'a' + 10;
 391     else
 392         return 0;
 393 }
 394
 395 static inline int tohex(int v)
 396 {
 397     if (v < 10)
 398         return v + '0';
 399     else
 400         return v - 10 + 'a';
 401 }
 402
 403 static void memtohex(char *buf, const uint8_t *mem, int len)
 404 {
 405     int i, c;
 406     char *q;
 407     q = buf;
 408     for(i = 0; i < len; i++) {
 409         c = mem[i];
 410         *q++ = tohex(c >> 4);
 411         *q++ = tohex(c & 0xf);
 412     }
 413     *q = '\0';
 414 }
 415
 416 static void hextomem(uint8_t *mem, const char *buf, int len)
 417 {
 418     int i;
 419
 420     for(i = 0; i < len; i++) {
 421         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 422         buf += 2;
 423     }
 424 }
 425
 426 /* return -1 if error, 0 if OK */
 427 static int put_packet_binary(GDBState *s, const char *buf, int len)
 428 {
 429     int csum, i;
 430     uint8_t *p;
 431
 432     for(;;) {
 433         p = s->last_packet;
 434         *(p++) = '$';
 435         memcpy(p, buf, len);
 436         p += len;
 437         csum = 0;
 438         for(i = 0; i < len; i++) {
 439             csum += buf[i];
 440         }
 441         *(p++) = '#';
 442         *(p++) = tohex((csum >> 4) & 0xf);
 443         *(p++) = tohex((csum) & 0xf);
 444
 445         s->last_packet_len = p - s->last_packet;
 446         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 447
 448 #ifdef CONFIG_USER_ONLY
 449         i = get_char(s);
 450         if (i < 0)
 451             return -1;
 452         if (i == '+')
 453             break;
 454 #else
 455         break;
 456 #endif
 457     }
 458     return 0;
 459 }
 460
 461 /* return -1 if error, 0 if OK */
 462 static int put_packet(GDBState *s, const char *buf)
 463 {
 464 #ifdef DEBUG_GDB
 465     printf("reply='%s'\n", buf);
 466 #endif
 467
 468     return put_packet_binary(s, buf, strlen(buf));
 469 }
 470
 471 /* The GDB remote protocol transfers values in target byte order.  This means
 472    we can use the raw memory access routines to access the value buffer.
 473    Conveniently, these also handle the case where the buffer is mis-aligned.
 474  */
 475 #define GET_REG8(val) do { \
 476     stb_p(mem_buf, val); \
 477     return 1; \
 478     } while(0)
 479 #define GET_REG16(val) do { \
 480     stw_p(mem_buf, val); \
 481     return 2; \
 482     } while(0)
 483 #define GET_REG32(val) do { \
 484     stl_p(mem_buf, val); \
 485     return 4; \
 486     } while(0)
 487 #define GET_REG64(val) do { \
 488     stq_p(mem_buf, val); \
 489     return 8; \
 490     } while(0)
 491
 492 #if TARGET_LONG_BITS == 64
 493 #define GET_REGL(val) GET_REG64(val)
 494 #define ldtul_p(addr) ldq_p(addr)
 495 #else
 496 #define GET_REGL(val) GET_REG32(val)
 497 #define ldtul_p(addr) ldl_p(addr)
 498 #endif
 499
 500 #if defined(TARGET_I386)
 501
 502 #ifdef TARGET_X86_64
 503 static const int gpr_map[16] = {
 504     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 505     8, 9, 10, 11, 12, 13, 14, 15
 506 };
 507 #else
 508 static const int gpr_map[8] = {0, 1, 2, 3, 4, 5, 6, 7};
 509 #endif
 510
 511 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 512
 513 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 514 {
 515     if (n < CPU_NB_REGS) {
 516         GET_REGL(env->regs[gpr_map[n]]);
 517     } else if (n >= CPU_NB_REGS + 8 && n < CPU_NB_REGS + 16) {
 518         /* FIXME: byteswap float values.  */
 519 #ifdef USE_X86LDOUBLE
 520         memcpy(mem_buf, &env->fpregs[n - (CPU_NB_REGS + 8)], 10);
 521 #else
 522         memset(mem_buf, 0, 10);
 523 #endif
 524         return 10;
 525     } else if (n >= CPU_NB_REGS + 24) {
 526         n -= CPU_NB_REGS + 24;
 527         if (n < CPU_NB_REGS) {
 528             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 529             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 530             return 16;
 531         } else if (n == CPU_NB_REGS) {
 532             GET_REG32(env->mxcsr);
 533         }
 534     } else {
 535         n -= CPU_NB_REGS;
 536         switch (n) {
 537         case 0: GET_REGL(env->eip);
 538         case 1: GET_REG32(env->eflags);
 539         case 2: GET_REG32(env->segs[R_CS].selector);
 540         case 3: GET_REG32(env->segs[R_SS].selector);
 541         case 4: GET_REG32(env->segs[R_DS].selector);
 542         case 5: GET_REG32(env->segs[R_ES].selector);
 543         case 6: GET_REG32(env->segs[R_FS].selector);
 544         case 7: GET_REG32(env->segs[R_GS].selector);
 545         /* 8...15 x87 regs.  */
 546         case 16: GET_REG32(env->fpuc);
 547         case 17: GET_REG32((env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11);
 548         case 18: GET_REG32(0); /* ftag */
 549         case 19: GET_REG32(0); /* fiseg */
 550         case 20: GET_REG32(0); /* fioff */
 551         case 21: GET_REG32(0); /* foseg */
 552         case 22: GET_REG32(0); /* fooff */
 553         case 23: GET_REG32(0); /* fop */
 554         /* 24+ xmm regs.  */
 555         }
 556     }
 557     return 0;
 558 }
 559
 560 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int i)
 561 {
 562     uint32_t tmp;
 563
 564     if (i < CPU_NB_REGS) {
 565         env->regs[gpr_map[i]] = ldtul_p(mem_buf);
 566         return sizeof(target_ulong);
 567     } else if (i >= CPU_NB_REGS + 8 && i < CPU_NB_REGS + 16) {
 568         i -= CPU_NB_REGS + 8;
 569 #ifdef USE_X86LDOUBLE
 570         memcpy(&env->fpregs[i], mem_buf, 10);
 571 #endif
 572         return 10;
 573     } else if (i >= CPU_NB_REGS + 24) {
 574         i -= CPU_NB_REGS + 24;
 575         if (i < CPU_NB_REGS) {
 576             env->xmm_regs[i].XMM_Q(0) = ldq_p(mem_buf);
 577             env->xmm_regs[i].XMM_Q(1) = ldq_p(mem_buf + 8);
 578             return 16;
 579         } else if (i == CPU_NB_REGS) {
 580             env->mxcsr = ldl_p(mem_buf);
 581             return 4;
 582         }
 583     } else {
 584         i -= CPU_NB_REGS;
 585         switch (i) {
 586         case 0: env->eip = ldtul_p(mem_buf); return sizeof(target_ulong);
 587         case 1: env->eflags = ldl_p(mem_buf); return 4;
 588 #if defined(CONFIG_USER_ONLY)
 589 #define LOAD_SEG(index, sreg)\
 590             tmp = ldl_p(mem_buf);\
 591             if (tmp != env->segs[sreg].selector)\
 592                 cpu_x86_load_seg(env, sreg, tmp);
 593 #else
 594 /* FIXME: Honor segment registers.  Needs to avoid raising an exception
 595    when the selector is invalid.  */
 596 #define LOAD_SEG(index, sreg) do {} while(0)
 597 #endif
 598         case 2: LOAD_SEG(10, R_CS); return 4;
 599         case 3: LOAD_SEG(11, R_SS); return 4;
 600         case 4: LOAD_SEG(12, R_DS); return 4;
 601         case 5: LOAD_SEG(13, R_ES); return 4;
 602         case 6: LOAD_SEG(14, R_FS); return 4;
 603         case 7: LOAD_SEG(15, R_GS); return 4;
 604         /* 8...15 x87 regs.  */
 605         case 16: env->fpuc = ldl_p(mem_buf); return 4;
 606         case 17:
 607                  tmp = ldl_p(mem_buf);
 608                  env->fpstt = (tmp >> 11) & 7;
 609                  env->fpus = tmp & ~0x3800;
 610                  return 4;
 611         case 18: /* ftag */ return 4;
 612         case 19: /* fiseg */ return 4;
 613         case 20: /* fioff */ return 4;
 614         case 21: /* foseg */ return 4;
 615         case 22: /* fooff */ return 4;
 616         case 23: /* fop */ return 4;
 617         /* 24+ xmm regs.  */
 618         }
 619     }
 620     /* Unrecognised register.  */
 621     return 0;
 622 }
 623
 624 #elif defined (TARGET_PPC)
 625
 626 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 627    expects whatever the target description contains.  Due to a
 628    historical mishap the FP registers appear in between core integer
 629    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 630    FP regs zero size when talking to a newer gdb.  */
 631 #define NUM_CORE_REGS 71
 632 #if defined (TARGET_PPC64)
 633 #define GDB_CORE_XML "power64-core.xml"
 634 #else
 635 #define GDB_CORE_XML "power-core.xml"
 636 #endif
 637
 638 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 639 {
 640     if (n < 32) {
 641         /* gprs */
 642         GET_REGL(env->gpr[n]);
 643     } else if (n < 64) {
 644         /* fprs */
 645         if (gdb_has_xml)
 646             return 0;
 647         stfq_p(mem_buf, env->fpr[n-32]);
 648         return 8;
 649     } else {
 650         switch (n) {
 651         case 64: GET_REGL(env->nip);
 652         case 65: GET_REGL(env->msr);
 653         case 66:
 654             {
 655                 uint32_t cr = 0;
 656                 int i;
 657                 for (i = 0; i < 8; i++)
 658                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 659                 GET_REG32(cr);
 660             }
 661         case 67: GET_REGL(env->lr);
 662         case 68: GET_REGL(env->ctr);
 663         case 69: GET_REGL(env->xer);
 664         case 70:
 665             {
 666                 if (gdb_has_xml)
 667                     return 0;
 668                 GET_REG32(0); /* fpscr */
 669             }
 670         }
 671     }
 672     return 0;
 673 }
 674
 675 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 676 {
 677     if (n < 32) {
 678         /* gprs */
 679         env->gpr[n] = ldtul_p(mem_buf);
 680         return sizeof(target_ulong);
 681     } else if (n < 64) {
 682         /* fprs */
 683         if (gdb_has_xml)
 684             return 0;
 685         env->fpr[n-32] = ldfq_p(mem_buf);
 686         return 8;
 687     } else {
 688         switch (n) {
 689         case 64:
 690             env->nip = ldtul_p(mem_buf);
 691             return sizeof(target_ulong);
 692         case 65:
 693             ppc_store_msr(env, ldtul_p(mem_buf));
 694             return sizeof(target_ulong);
 695         case 66:
 696             {
 697                 uint32_t cr = ldl_p(mem_buf);
 698                 int i;
 699                 for (i = 0; i < 8; i++)
 700                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 701                 return 4;
 702             }
 703         case 67:
 704             env->lr = ldtul_p(mem_buf);
 705             return sizeof(target_ulong);
 706         case 68:
 707             env->ctr = ldtul_p(mem_buf);
 708             return sizeof(target_ulong);
 709         case 69:
 710             env->xer = ldtul_p(mem_buf);
 711             return sizeof(target_ulong);
 712         case 70:
 713             /* fpscr */
 714             if (gdb_has_xml)
 715                 return 0;
 716             return 4;
 717         }
 718     }
 719     return 0;
 720 }
 721
 722 #elif defined (TARGET_SPARC)
 723
 724 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 725 #define NUM_CORE_REGS 86
 726 #else
 727 #define NUM_CORE_REGS 72
 728 #endif
 729
 730 #ifdef TARGET_ABI32
 731 #define GET_REGA(val) GET_REG32(val)
 732 #else
 733 #define GET_REGA(val) GET_REGL(val)
 734 #endif
 735
 736 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 737 {
 738     if (n < 8) {
 739         /* g0..g7 */
 740         GET_REGA(env->gregs[n]);
 741     }
 742     if (n < 32) {
 743         /* register window */
 744         GET_REGA(env->regwptr[n - 8]);
 745     }
 746 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 747     if (n < 64) {
 748         /* fprs */
 749         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 750     }
 751     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 752     switch (n) {
 753     case 64: GET_REGA(env->y);
 754     case 65: GET_REGA(GET_PSR(env));
 755     case 66: GET_REGA(env->wim);
 756     case 67: GET_REGA(env->tbr);
 757     case 68: GET_REGA(env->pc);
 758     case 69: GET_REGA(env->npc);
 759     case 70: GET_REGA(env->fsr);
 760     case 71: GET_REGA(0); /* csr */
 761     default: GET_REGA(0);
 762     }
 763 #else
 764     if (n < 64) {
 765         /* f0-f31 */
 766         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 767     }
 768     if (n < 80) {
 769         /* f32-f62 (double width, even numbers only) */
 770         uint64_t val;
 771
 772         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 773         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 774         GET_REG64(val);
 775     }
 776     switch (n) {
 777     case 80: GET_REGL(env->pc);
 778     case 81: GET_REGL(env->npc);
 779     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 780                            ((env->asi & 0xff) << 24) |
 781                            ((env->pstate & 0xfff) << 8) |
 782                            GET_CWP64(env));
 783     case 83: GET_REGL(env->fsr);
 784     case 84: GET_REGL(env->fprs);
 785     case 85: GET_REGL(env->y);
 786     }
 787 #endif
 788     return 0;
 789 }
 790
 791 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 792 {
 793 #if defined(TARGET_ABI32)
 794     abi_ulong tmp;
 795
 796     tmp = ldl_p(mem_buf);
 797 #else
 798     target_ulong tmp;
 799
 800     tmp = ldtul_p(mem_buf);
 801 #endif
 802
 803     if (n < 8) {
 804         /* g0..g7 */
 805         env->gregs[n] = tmp;
 806     } else if (n < 32) {
 807         /* register window */
 808         env->regwptr[n - 8] = tmp;
 809     }
 810 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 811     else if (n < 64) {
 812         /* fprs */
 813         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 814     } else {
 815         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 816         switch (n) {
 817         case 64: env->y = tmp; break;
 818         case 65: PUT_PSR(env, tmp); break;
 819         case 66: env->wim = tmp; break;
 820         case 67: env->tbr = tmp; break;
 821         case 68: env->pc = tmp; break;
 822         case 69: env->npc = tmp; break;
 823         case 70: env->fsr = tmp; break;
 824         default: return 0;
 825         }
 826     }
 827     return 4;
 828 #else
 829     else if (n < 64) {
 830         /* f0-f31 */
 831         env->fpr[n] = ldfl_p(mem_buf);
 832         return 4;
 833     } else if (n < 80) {
 834         /* f32-f62 (double width, even numbers only) */
 835         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 836         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 837     } else {
 838         switch (n) {
 839         case 80: env->pc = tmp; break;
 840         case 81: env->npc = tmp; break;
 841         case 82:
 842             PUT_CCR(env, tmp >> 32);
 843             env->asi = (tmp >> 24) & 0xff;
 844             env->pstate = (tmp >> 8) & 0xfff;
 845             PUT_CWP64(env, tmp & 0xff);
 846             break;
 847         case 83: env->fsr = tmp; break;
 848         case 84: env->fprs = tmp; break;
 849         case 85: env->y = tmp; break;
 850         default: return 0;
 851         }
 852     }
 853     return 8;
 854 #endif
 855 }
 856 #elif defined (TARGET_ARM)
 857
 858 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 859    whatever the target description contains.  Due to a historical mishap
 860    the FPA registers appear in between core integer regs and the CPSR.
 861    We hack round this by giving the FPA regs zero size when talking to a
 862    newer gdb.  */
 863 #define NUM_CORE_REGS 26
 864 #define GDB_CORE_XML "arm-core.xml"
 865
 866 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 867 {
 868     if (n < 16) {
 869         /* Core integer register.  */
 870         GET_REG32(env->regs[n]);
 871     }
 872     if (n < 24) {
 873         /* FPA registers.  */
 874         if (gdb_has_xml)
 875             return 0;
 876         memset(mem_buf, 0, 12);
 877         return 12;
 878     }
 879     switch (n) {
 880     case 24:
 881         /* FPA status register.  */
 882         if (gdb_has_xml)
 883             return 0;
 884         GET_REG32(0);
 885     case 25:
 886         /* CPSR */
 887         GET_REG32(cpsr_read(env));
 888     }
 889     /* Unknown register.  */
 890     return 0;
 891 }
 892
 893 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 894 {
 895     uint32_t tmp;
 896
 897     tmp = ldl_p(mem_buf);
 898
 899     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 900        cause problems if we ever implement the Jazelle DBX extensions.  */
 901     if (n == 15)
 902         tmp &= ~1;
 903
 904     if (n < 16) {
 905         /* Core integer register.  */
 906         env->regs[n] = tmp;
 907         return 4;
 908     }
 909     if (n < 24) { /* 16-23 */
 910         /* FPA registers (ignored).  */
 911         if (gdb_has_xml)
 912             return 0;
 913         return 12;
 914     }
 915     switch (n) {
 916     case 24:
 917         /* FPA status register (ignored).  */
 918         if (gdb_has_xml)
 919             return 0;
 920         return 4;
 921     case 25:
 922         /* CPSR */
 923         cpsr_write (env, tmp, 0xffffffff);
 924         return 4;
 925     }
 926     /* Unknown register.  */
 927     return 0;
 928 }
 929
 930 #elif defined (TARGET_M68K)
 931
 932 #define NUM_CORE_REGS 18
 933
 934 #define GDB_CORE_XML "cf-core.xml"
 935
 936 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 937 {
 938     if (n < 8) {
 939         /* D0-D7 */
 940         GET_REG32(env->dregs[n]);
 941     } else if (n < 16) {
 942         /* A0-A7 */
 943         GET_REG32(env->aregs[n - 8]);
 944     } else {
 945         switch (n) {
 946         case 16: GET_REG32(env->sr);
 947         case 17: GET_REG32(env->pc);
 948         }
 949     }
 950     /* FP registers not included here because they vary between
 951        ColdFire and m68k.  Use XML bits for these.  */
 952     return 0;
 953 }
 954
 955 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 956 {
 957     uint32_t tmp;
 958
 959     tmp = ldl_p(mem_buf);
 960
 961     if (n < 8) {
 962         /* D0-D7 */
 963         env->dregs[n] = tmp;
 964     } else if (n < 8) {
 965         /* A0-A7 */
 966         env->aregs[n - 8] = tmp;
 967     } else {
 968         switch (n) {
 969         case 16: env->sr = tmp; break;
 970         case 17: env->pc = tmp; break;
 971         default: return 0;
 972         }
 973     }
 974     return 4;
 975 }
 976 #elif defined (TARGET_MIPS)
 977
 978 #define NUM_CORE_REGS 73
 979
 980 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 981 {
 982     if (n < 32) {
 983         GET_REGL(env->active_tc.gpr[n]);
 984     }
 985     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
 986         if (n >= 38 && n < 70) {
 987             if (env->CP0_Status & (1 << CP0St_FR))
 988                 GET_REGL(env->active_fpu.fpr[n - 38].d);
 989             else
 990                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
 991         }
 992         switch (n) {
 993         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
 994         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
 995         }
 996     }
 997     switch (n) {
 998     case 32: GET_REGL((int32_t)env->CP0_Status);
 999     case 33: GET_REGL(env->active_tc.LO[0]);
1000     case 34: GET_REGL(env->active_tc.HI[0]);
1001     case 35: GET_REGL(env->CP0_BadVAddr);
1002     case 36: GET_REGL((int32_t)env->CP0_Cause);
1003     case 37: GET_REGL(env->active_tc.PC);
1004     case 72: GET_REGL(0); /* fp */
1005     case 89: GET_REGL((int32_t)env->CP0_PRid);
1006     }
1007     if (n >= 73 && n <= 88) {
1008         /* 16 embedded regs.  */
1009         GET_REGL(0);
1010     }
1011
1012     return 0;
1013 }
1014
1015 /* convert MIPS rounding mode in FCR31 to IEEE library */
1016 static unsigned int ieee_rm[] =
1017   {
1018     float_round_nearest_even,
1019     float_round_to_zero,
1020     float_round_up,
1021     float_round_down
1022   };
1023 #define RESTORE_ROUNDING_MODE \
1024     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1025
1026 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1027 {
1028     target_ulong tmp;
1029
1030     tmp = ldtul_p(mem_buf);
1031
1032     if (n < 32) {
1033         env->active_tc.gpr[n] = tmp;
1034         return sizeof(target_ulong);
1035     }
1036     if (env->CP0_Config1 & (1 << CP0C1_FP)
1037             && n >= 38 && n < 73) {
1038         if (n < 70) {
1039             if (env->CP0_Status & (1 << CP0St_FR))
1040               env->active_fpu.fpr[n - 38].d = tmp;
1041             else
1042               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1043         }
1044         switch (n) {
1045         case 70:
1046             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1047             /* set rounding mode */
1048             RESTORE_ROUNDING_MODE;
1049 #ifndef CONFIG_SOFTFLOAT
1050             /* no floating point exception for native float */
1051             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1052 #endif
1053             break;
1054         case 71: env->active_fpu.fcr0 = tmp; break;
1055         }
1056         return sizeof(target_ulong);
1057     }
1058     switch (n) {
1059     case 32: env->CP0_Status = tmp; break;
1060     case 33: env->active_tc.LO[0] = tmp; break;
1061     case 34: env->active_tc.HI[0] = tmp; break;
1062     case 35: env->CP0_BadVAddr = tmp; break;
1063     case 36: env->CP0_Cause = tmp; break;
1064     case 37: env->active_tc.PC = tmp; break;
1065     case 72: /* fp, ignored */ break;
1066     default:
1067         if (n > 89)
1068             return 0;
1069         /* Other registers are readonly.  Ignore writes.  */
1070         break;
1071     }
1072
1073     return sizeof(target_ulong);
1074 }
1075 #elif defined (TARGET_SH4)
1076
1077 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1078 /* FIXME: We should use XML for this.  */
1079
1080 #define NUM_CORE_REGS 59
1081
1082 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1083 {
1084     if (n < 8) {
1085         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1086             GET_REGL(env->gregs[n + 16]);
1087         } else {
1088             GET_REGL(env->gregs[n]);
1089         }
1090     } else if (n < 16) {
1091         GET_REGL(env->gregs[n - 8]);
1092     } else if (n >= 25 && n < 41) {
1093         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1094     } else if (n >= 43 && n < 51) {
1095         GET_REGL(env->gregs[n - 43]);
1096     } else if (n >= 51 && n < 59) {
1097         GET_REGL(env->gregs[n - (51 - 16)]);
1098     }
1099     switch (n) {
1100     case 16: GET_REGL(env->pc);
1101     case 17: GET_REGL(env->pr);
1102     case 18: GET_REGL(env->gbr);
1103     case 19: GET_REGL(env->vbr);
1104     case 20: GET_REGL(env->mach);
1105     case 21: GET_REGL(env->macl);
1106     case 22: GET_REGL(env->sr);
1107     case 23: GET_REGL(env->fpul);
1108     case 24: GET_REGL(env->fpscr);
1109     case 41: GET_REGL(env->ssr);
1110     case 42: GET_REGL(env->spc);
1111     }
1112
1113     return 0;
1114 }
1115
1116 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1117 {
1118     uint32_t tmp;
1119
1120     tmp = ldl_p(mem_buf);
1121
1122     if (n < 8) {
1123         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1124             env->gregs[n + 16] = tmp;
1125         } else {
1126             env->gregs[n] = tmp;
1127         }
1128         return 4;
1129     } else if (n < 16) {
1130         env->gregs[n - 8] = tmp;
1131         return 4;
1132     } else if (n >= 25 && n < 41) {
1133         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1134     } else if (n >= 43 && n < 51) {
1135         env->gregs[n - 43] = tmp;
1136         return 4;
1137     } else if (n >= 51 && n < 59) {
1138         env->gregs[n - (51 - 16)] = tmp;
1139         return 4;
1140     }
1141     switch (n) {
1142     case 16: env->pc = tmp;
1143     case 17: env->pr = tmp;
1144     case 18: env->gbr = tmp;
1145     case 19: env->vbr = tmp;
1146     case 20: env->mach = tmp;
1147     case 21: env->macl = tmp;
1148     case 22: env->sr = tmp;
1149     case 23: env->fpul = tmp;
1150     case 24: env->fpscr = tmp;
1151     case 41: env->ssr = tmp;
1152     case 42: env->spc = tmp;
1153     default: return 0;
1154     }
1155
1156     return 4;
1157 }
1158 #elif defined (TARGET_CRIS)
1159
1160 #define NUM_CORE_REGS 49
1161
1162 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1163 {
1164     uint8_t srs;
1165
1166     srs = env->pregs[PR_SRS];
1167     if (n < 16) {
1168         GET_REG32(env->regs[n]);
1169     }
1170
1171     if (n >= 21 && n < 32) {
1172         GET_REG32(env->pregs[n - 16]);
1173     }
1174     if (n >= 33 && n < 49) {
1175         GET_REG32(env->sregs[srs][n - 33]);
1176     }
1177     switch (n) {
1178     case 16: GET_REG8(env->pregs[0]);
1179     case 17: GET_REG8(env->pregs[1]);
1180     case 18: GET_REG32(env->pregs[2]);
1181     case 19: GET_REG8(srs);
1182     case 20: GET_REG16(env->pregs[4]);
1183     case 32: GET_REG32(env->pc);
1184     }
1185
1186     return 0;
1187 }
1188
1189 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1190 {
1191     uint32_t tmp;
1192
1193     if (n > 49)
1194         return 0;
1195
1196     tmp = ldl_p(mem_buf);
1197
1198     if (n < 16) {
1199         env->regs[n] = tmp;
1200     }
1201
1202     if (n >= 21 && n < 32) {
1203         env->pregs[n - 16] = tmp;
1204     }
1205
1206     /* FIXME: Should support function regs be writable?  */
1207     switch (n) {
1208     case 16: return 1;
1209     case 17: return 1;
1210     case 18: env->pregs[PR_PID] = tmp; break;
1211     case 19: return 1;
1212     case 20: return 2;
1213     case 32: env->pc = tmp; break;
1214     }
1215
1216     return 4;
1217 }
1218 #elif defined (TARGET_ALPHA)
1219
1220 #define NUM_CORE_REGS 65
1221
1222 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1223 {
1224     if (n < 31) {
1225        GET_REGL(env->ir[n]);
1226     }
1227     else if (n == 31) {
1228        GET_REGL(0);
1229     }
1230     else if (n<63) {
1231        uint64_t val;
1232
1233        val=*((uint64_t *)&env->fir[n-32]);
1234        GET_REGL(val);
1235     }
1236     else if (n==63) {
1237        GET_REGL(env->fpcr);
1238     }
1239     else if (n==64) {
1240        GET_REGL(env->pc);
1241     }
1242     else {
1243        GET_REGL(0);
1244     }
1245
1246     return 0;
1247 }
1248
1249 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1250 {
1251     target_ulong tmp;
1252     tmp = ldtul_p(mem_buf);
1253
1254     if (n < 31) {
1255         env->ir[n] = tmp;
1256     }
1257
1258     if (n > 31 && n < 63) {
1259         env->fir[n - 32] = ldfl_p(mem_buf);
1260     }
1261
1262     if (n == 64 ) {
1263        env->pc=tmp;
1264     }
1265
1266     return 8;
1267 }
1268 #elif defined (TARGET_HPPA)
1269
1270 #ifdef TARGET_HPPA64
1271 #define NUM_CORE_REGS 96
1272 #else
1273 #define NUM_CORE_REGS 128
1274 #endif
1275
1276 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1277 {
1278     if (n == 0) {
1279         GET_REGL(env->psw);
1280     } else if (n < 32) {
1281         /* gr0 is hardwired to zero */
1282         /* gr1..gr32 */
1283         GET_REGL(env->gr[n]);
1284     } else if (n == 32) {
1285         GET_REGL(0); /* FIXME: sar */
1286     } else if (n == 33) {
1287         GET_REGL(env->iaoq[0]);
1288     } else if (n == 34) {
1289         GET_REG32(env->iasq[0]);
1290     } else if (n == 35) {
1291         GET_REGL(env->iaoq[1]);
1292     } else if (n == 36) {
1293         GET_REG32(env->iasq[1]);
1294     } else {
1295         /* FIXME: floating point */
1296         GET_REGL(0);
1297     }
1298
1299     return 0;
1300 }
1301
1302 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1303 {
1304     target_ulong tmp;
1305
1306     tmp = ldtul_p(mem_buf);
1307
1308     if (n == 0) {
1309         env->psw = tmp;
1310     } else if (n < 32) {
1311         /* gr0 is hardwired to zero */
1312         /* gr1..gr32 */
1313         env->gr[n] = tmp;
1314     } else if (n == 32) {
1315         /* FIXME: sar */
1316     } else if (n == 33) {
1317         env->iaoq[0] = tmp;
1318     } else if (n == 34) {
1319         env->iasq[0] = ldl_p(mem_buf);
1320         return 4;
1321     } else if (n == 35) {
1322         env->iaoq[1] = tmp;
1323     } else if (n == 36) {
1324         env->iasq[1] = ldl_p(mem_buf);
1325         return 4;
1326     } else {
1327         /* FIXME: floating point */
1328     }
1329
1330     return sizeof(target_ulong);
1331 }
1332
1333 #else
1334
1335 #define NUM_CORE_REGS 0
1336
1337 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1338 {
1339     return 0;
1340 }
1341
1342 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1343 {
1344     return 0;
1345 }
1346
1347 #endif
1348
1349 static int num_g_regs = NUM_CORE_REGS;
1350
1351 #ifdef GDB_CORE_XML
1352 /* Encode data using the encoding for 'x' packets.  */
1353 static int memtox(char *buf, const char *mem, int len)
1354 {
1355     char *p = buf;
1356     char c;
1357
1358     while (len--) {
1359         c = *(mem++);
1360         switch (c) {
1361         case '#': case '$': case '*': case '}':
1362             *(p++) = '}';
1363             *(p++) = c ^ 0x20;
1364             break;
1365         default:
1366             *(p++) = c;
1367             break;
1368         }
1369     }
1370     return p - buf;
1371 }
1372
1373 static const char *get_feature_xml(const char *p, const char **newp)
1374 {
1375     extern const char *const xml_builtin[][2];
1376     size_t len;
1377     int i;
1378     const char *name;
1379     static char target_xml[1024];
1380
1381     len = 0;
1382     while (p[len] && p[len] != ':')
1383         len++;
1384     *newp = p + len;
1385
1386     name = NULL;
1387     if (strncmp(p, "target.xml", len) == 0) {
1388         /* Generate the XML description for this CPU.  */
1389         if (!target_xml[0]) {
1390             GDBRegisterState *r;
1391
1392             snprintf(target_xml, sizeof(target_xml),
1393                      "<?xml version=\"1.0\"?>"
1394                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1395                      "<target>"
1396                      "<xi:include href=\"%s\"/>",
1397                      GDB_CORE_XML);
1398
1399             for (r = first_cpu->gdb_regs; r; r = r->next) {
1400                 strcat(target_xml, "<xi:include href=\"");
1401                 strcat(target_xml, r->xml);
1402                 strcat(target_xml, "\"/>");
1403             }
1404             strcat(target_xml, "</target>");
1405         }
1406         return target_xml;
1407     }
1408     for (i = 0; ; i++) {
1409         name = xml_builtin[i][0];
1410         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1411             break;
1412     }
1413     return name ? xml_builtin[i][1] : NULL;
1414 }
1415 #endif
1416
1417 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1418 {
1419     GDBRegisterState *r;
1420
1421     if (reg < NUM_CORE_REGS)
1422         return cpu_gdb_read_register(env, mem_buf, reg);
1423
1424     for (r = env->gdb_regs; r; r = r->next) {
1425         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1426             return r->get_reg(env, mem_buf, reg - r->base_reg);
1427         }
1428     }
1429     return 0;
1430 }
1431
1432 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1433 {
1434     GDBRegisterState *r;
1435
1436     if (reg < NUM_CORE_REGS)
1437         return cpu_gdb_write_register(env, mem_buf, reg);
1438
1439     for (r = env->gdb_regs; r; r = r->next) {
1440         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1441             return r->set_reg(env, mem_buf, reg - r->base_reg);
1442         }
1443     }
1444     return 0;
1445 }
1446
1447 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1448    specifies the first register number and these registers are included in
1449    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1450    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1451  */
1452
1453 void gdb_register_coprocessor(CPUState * env,
1454                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1455                              int num_regs, const char *xml, int g_pos)
1456 {
1457     GDBRegisterState *s;
1458     GDBRegisterState **p;
1459     static int last_reg = NUM_CORE_REGS;
1460
1461     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1462     s->base_reg = last_reg;
1463     s->num_regs = num_regs;
1464     s->get_reg = get_reg;
1465     s->set_reg = set_reg;
1466     s->xml = xml;
1467     p = &env->gdb_regs;
1468     while (*p) {
1469         /* Check for duplicates.  */
1470         if (strcmp((*p)->xml, xml) == 0)
1471             return;
1472         p = &(*p)->next;
1473     }
1474     /* Add to end of list.  */
1475     last_reg += num_regs;
1476     *p = s;
1477     if (g_pos) {
1478         if (g_pos != s->base_reg) {
1479             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1480                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1481         } else {
1482             num_g_regs = last_reg;
1483         }
1484     }
1485 }
1486
1487 #ifndef CONFIG_USER_ONLY
1488 static const int xlat_gdb_type[] = {
1489     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1490     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1491     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1492 };
1493 #endif
1494
1495 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1496 {
1497     CPUState *env;
1498     int err = 0;
1499
1500     if (kvm_enabled())
1501         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1502
1503     switch (type) {
1504     case GDB_BREAKPOINT_SW:
1505     case GDB_BREAKPOINT_HW:
1506         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1507             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1508             if (err)
1509                 break;
1510         }
1511         return err;
1512 #ifndef CONFIG_USER_ONLY
1513     case GDB_WATCHPOINT_WRITE:
1514     case GDB_WATCHPOINT_READ:
1515     case GDB_WATCHPOINT_ACCESS:
1516         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1517             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1518                                         NULL);
1519             if (err)
1520                 break;
1521         }
1522         return err;
1523 #endif
1524     default:
1525         return -ENOSYS;
1526     }
1527 }
1528
1529 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1530 {
1531     CPUState *env;
1532     int err = 0;
1533
1534     if (kvm_enabled())
1535         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1536
1537     switch (type) {
1538     case GDB_BREAKPOINT_SW:
1539     case GDB_BREAKPOINT_HW:
1540         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1541             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1542             if (err)
1543                 break;
1544         }
1545         return err;
1546 #ifndef CONFIG_USER_ONLY
1547     case GDB_WATCHPOINT_WRITE:
1548     case GDB_WATCHPOINT_READ:
1549     case GDB_WATCHPOINT_ACCESS:
1550         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1551             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1552             if (err)
1553                 break;
1554         }
1555         return err;
1556 #endif
1557     default:
1558         return -ENOSYS;
1559     }
1560 }
1561
1562 static void gdb_breakpoint_remove_all(void)
1563 {
1564     CPUState *env;
1565
1566     if (kvm_enabled()) {
1567         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1568         return;
1569     }
1570
1571     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1572         cpu_breakpoint_remove_all(env, BP_GDB);
1573 #ifndef CONFIG_USER_ONLY
1574         cpu_watchpoint_remove_all(env, BP_GDB);
1575 #endif
1576     }
1577 }
1578
1579 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1580 {
1581     CPUState *env;
1582     const char *p;
1583     int ch, reg_size, type, res, thread;
1584     char buf[MAX_PACKET_LENGTH];
1585     uint8_t mem_buf[MAX_PACKET_LENGTH];
1586     uint8_t *registers;
1587     target_ulong addr, len;
1588
1589 #ifdef DEBUG_GDB
1590     printf("command='%s'\n", line_buf);
1591 #endif
1592     p = line_buf;
1593     ch = *p++;
1594     switch(ch) {
1595     case '?':
1596         /* TODO: Make this return the correct value for user-mode.  */
1597         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1598                  s->c_cpu->cpu_index+1);
1599         put_packet(s, buf);
1600         /* Remove all the breakpoints when this query is issued,
1601          * because gdb is doing and initial connect and the state
1602          * should be cleaned up.
1603          */
1604         gdb_breakpoint_remove_all();
1605         break;
1606     case 'c':
1607         if (*p != '\0') {
1608             addr = strtoull(p, (char **)&p, 16);
1609 #if defined(TARGET_I386)
1610             s->c_cpu->eip = addr;
1611             cpu_synchronize_state(s->c_cpu, 1);
1612 #elif defined (TARGET_PPC)
1613             s->c_cpu->nip = addr;
1614 #elif defined (TARGET_SPARC)
1615             s->c_cpu->pc = addr;
1616             s->c_cpu->npc = addr + 4;
1617 #elif defined (TARGET_ARM)
1618             s->c_cpu->regs[15] = addr;
1619 #elif defined (TARGET_SH4)
1620             s->c_cpu->pc = addr;
1621 #elif defined (TARGET_MIPS)
1622             s->c_cpu->active_tc.PC = addr;
1623 #elif defined (TARGET_CRIS)
1624             s->c_cpu->pc = addr;
1625 #elif defined (TARGET_ALPHA)
1626             s->c_cpu->pc = addr;
1627 #elif defined (TARGET_HPPA)
1628             s->c_cpu->iaoq[0] = addr;
1629             s->c_cpu->iaoq[1] = addr + 4;
1630 #endif
1631         }
1632         s->signal = 0;
1633         gdb_continue(s);
1634         return RS_IDLE;
1635     case 'C':
1636         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1637         if (s->signal == -1)
1638             s->signal = 0;
1639         gdb_continue(s);
1640         return RS_IDLE;
1641     case 'k':
1642         /* Kill the target */
1643         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1644         exit(0);
1645     case 'D':
1646         /* Detach packet */
1647         gdb_breakpoint_remove_all();
1648         gdb_continue(s);
1649         put_packet(s, "OK");
1650         break;
1651     case 's':
1652         if (*p != '\0') {
1653             addr = strtoull(p, (char **)&p, 16);
1654 #if defined(TARGET_I386)
1655             s->c_cpu->eip = addr;
1656             cpu_synchronize_state(s->c_cpu, 1);
1657 #elif defined (TARGET_PPC)
1658             s->c_cpu->nip = addr;
1659 #elif defined (TARGET_SPARC)
1660             s->c_cpu->pc = addr;
1661             s->c_cpu->npc = addr + 4;
1662 #elif defined (TARGET_ARM)
1663             s->c_cpu->regs[15] = addr;
1664 #elif defined (TARGET_SH4)
1665             s->c_cpu->pc = addr;
1666 #elif defined (TARGET_MIPS)
1667             s->c_cpu->active_tc.PC = addr;
1668 #elif defined (TARGET_CRIS)
1669             s->c_cpu->pc = addr;
1670 #elif defined (TARGET_ALPHA)
1671             s->c_cpu->pc = addr;
1672 #elif defined (TARGET_HPPA)
1673             s->c_cpu->iaoq[0] = addr;
1674             s->c_cpu->iaoq[1] = addr + 4;
1675 #endif
1676         }
1677         cpu_single_step(s->c_cpu, sstep_flags);
1678         gdb_continue(s);
1679         return RS_IDLE;
1680     case 'F':
1681         {
1682             target_ulong ret;
1683             target_ulong err;
1684
1685             ret = strtoull(p, (char **)&p, 16);
1686             if (*p == ',') {
1687                 p++;
1688                 err = strtoull(p, (char **)&p, 16);
1689             } else {
1690                 err = 0;
1691             }
1692             if (*p == ',')
1693                 p++;
1694             type = *p;
1695             if (gdb_current_syscall_cb)
1696                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1697             if (type == 'C') {
1698                 put_packet(s, "T02");
1699             } else {
1700                 gdb_continue(s);
1701             }
1702         }
1703         break;
1704     case 'g':
1705         cpu_synchronize_state(s->g_cpu, 0);
1706         len = 0;
1707         for (addr = 0; addr < num_g_regs; addr++) {
1708             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1709             len += reg_size;
1710         }
1711         memtohex(buf, mem_buf, len);
1712         put_packet(s, buf);
1713         break;
1714     case 'G':
1715         registers = mem_buf;
1716         len = strlen(p) / 2;
1717         hextomem((uint8_t *)registers, p, len);
1718         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1719             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1720             len -= reg_size;
1721             registers += reg_size;
1722         }
1723         cpu_synchronize_state(s->g_cpu, 1);
1724         put_packet(s, "OK");
1725         break;
1726     case 'm':
1727         addr = strtoull(p, (char **)&p, 16);
1728         if (*p == ',')
1729             p++;
1730         len = strtoull(p, NULL, 16);
1731         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1732             put_packet (s, "E14");
1733         } else {
1734             memtohex(buf, mem_buf, len);
1735             put_packet(s, buf);
1736         }
1737         break;
1738     case 'M':
1739         addr = strtoull(p, (char **)&p, 16);
1740         if (*p == ',')
1741             p++;
1742         len = strtoull(p, (char **)&p, 16);
1743         if (*p == ':')
1744             p++;
1745         hextomem(mem_buf, p, len);
1746         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1747             put_packet(s, "E14");
1748         else
1749             put_packet(s, "OK");
1750         break;
1751     case 'p':
1752         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1753            This works, but can be very slow.  Anything new enough to
1754            understand XML also knows how to use this properly.  */
1755         if (!gdb_has_xml)
1756             goto unknown_command;
1757         addr = strtoull(p, (char **)&p, 16);
1758         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1759         if (reg_size) {
1760             memtohex(buf, mem_buf, reg_size);
1761             put_packet(s, buf);
1762         } else {
1763             put_packet(s, "E14");
1764         }
1765         break;
1766     case 'P':
1767         if (!gdb_has_xml)
1768             goto unknown_command;
1769         addr = strtoull(p, (char **)&p, 16);
1770         if (*p == '=')
1771             p++;
1772         reg_size = strlen(p) / 2;
1773         hextomem(mem_buf, p, reg_size);
1774         gdb_write_register(s->g_cpu, mem_buf, addr);
1775         put_packet(s, "OK");
1776         break;
1777     case 'Z':
1778     case 'z':
1779         type = strtoul(p, (char **)&p, 16);
1780         if (*p == ',')
1781             p++;
1782         addr = strtoull(p, (char **)&p, 16);
1783         if (*p == ',')
1784             p++;
1785         len = strtoull(p, (char **)&p, 16);
1786         if (ch == 'Z')
1787             res = gdb_breakpoint_insert(addr, len, type);
1788         else
1789             res = gdb_breakpoint_remove(addr, len, type);
1790         if (res >= 0)
1791              put_packet(s, "OK");
1792         else if (res == -ENOSYS)
1793             put_packet(s, "");
1794         else
1795             put_packet(s, "E22");
1796         break;
1797     case 'H':
1798         type = *p++;
1799         thread = strtoull(p, (char **)&p, 16);
1800         if (thread == -1 || thread == 0) {
1801             put_packet(s, "OK");
1802             break;
1803         }
1804         for (env = first_cpu; env != NULL; env = env->next_cpu)
1805             if (env->cpu_index + 1 == thread)
1806                 break;
1807         if (env == NULL) {
1808             put_packet(s, "E22");
1809             break;
1810         }
1811         switch (type) {
1812         case 'c':
1813             s->c_cpu = env;
1814             put_packet(s, "OK");
1815             break;
1816         case 'g':
1817             s->g_cpu = env;
1818             put_packet(s, "OK");
1819             break;
1820         default:
1821              put_packet(s, "E22");
1822              break;
1823         }
1824         break;
1825     case 'T':
1826         thread = strtoull(p, (char **)&p, 16);
1827 #ifndef CONFIG_USER_ONLY
1828         if (thread > 0 && thread < smp_cpus + 1)
1829 #else
1830         if (thread == 1)
1831 #endif
1832              put_packet(s, "OK");
1833         else
1834             put_packet(s, "E22");
1835         break;
1836     case 'q':
1837     case 'Q':
1838         /* parse any 'q' packets here */
1839         if (!strcmp(p,"qemu.sstepbits")) {
1840             /* Query Breakpoint bit definitions */
1841             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1842                      SSTEP_ENABLE,
1843                      SSTEP_NOIRQ,
1844                      SSTEP_NOTIMER);
1845             put_packet(s, buf);
1846             break;
1847         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1848             /* Display or change the sstep_flags */
1849             p += 10;
1850             if (*p != '=') {
1851                 /* Display current setting */
1852                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1853                 put_packet(s, buf);
1854                 break;
1855             }
1856             p++;
1857             type = strtoul(p, (char **)&p, 16);
1858             sstep_flags = type;
1859             put_packet(s, "OK");
1860             break;
1861         } else if (strcmp(p,"C") == 0) {
1862             /* "Current thread" remains vague in the spec, so always return
1863              *  the first CPU (gdb returns the first thread). */
1864             put_packet(s, "QC1");
1865             break;
1866         } else if (strcmp(p,"fThreadInfo") == 0) {
1867             s->query_cpu = first_cpu;
1868             goto report_cpuinfo;
1869         } else if (strcmp(p,"sThreadInfo") == 0) {
1870         report_cpuinfo:
1871             if (s->query_cpu) {
1872                 snprintf(buf, sizeof(buf), "m%x", s->query_cpu->cpu_index+1);
1873                 put_packet(s, buf);
1874                 s->query_cpu = s->query_cpu->next_cpu;
1875             } else
1876                 put_packet(s, "l");
1877             break;
1878         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1879             thread = strtoull(p+16, (char **)&p, 16);
1880             for (env = first_cpu; env != NULL; env = env->next_cpu)
1881                 if (env->cpu_index + 1 == thread) {
1882                     cpu_synchronize_state(env, 0);
1883                     len = snprintf((char *)mem_buf, sizeof(mem_buf),
1884                                    "CPU#%d [%s]", env->cpu_index,
1885                                    env->halted ? "halted " : "running");
1886                     memtohex(buf, mem_buf, len);
1887                     put_packet(s, buf);
1888                     break;
1889                 }
1890             break;
1891         }
1892 #ifdef CONFIG_USER_ONLY
1893         else if (strncmp(p, "Offsets", 7) == 0) {
1894             TaskState *ts = s->c_cpu->opaque;
1895
1896             snprintf(buf, sizeof(buf),
1897                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1898                      ";Bss=" TARGET_ABI_FMT_lx,
1899                      ts->info->code_offset,
1900                      ts->info->data_offset,
1901                      ts->info->data_offset);
1902             put_packet(s, buf);
1903             break;
1904         }
1905 #else /* !CONFIG_USER_ONLY */
1906         else if (strncmp(p, "Rcmd,", 5) == 0) {
1907             int len = strlen(p + 5);
1908
1909             if ((len % 2) != 0) {
1910                 put_packet(s, "E01");
1911                 break;
1912             }
1913             hextomem(mem_buf, p + 5, len);
1914             len = len / 2;
1915             mem_buf[len++] = 0;
1916             qemu_chr_read(s->mon_chr, mem_buf, len);
1917             put_packet(s, "OK");
1918             break;
1919         }
1920 #endif /* !CONFIG_USER_ONLY */
1921         if (strncmp(p, "Supported", 9) == 0) {
1922             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1923 #ifdef GDB_CORE_XML
1924             strcat(buf, ";qXfer:features:read+");
1925 #endif
1926             put_packet(s, buf);
1927             break;
1928         }
1929 #ifdef GDB_CORE_XML
1930         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1931             const char *xml;
1932             target_ulong total_len;
1933
1934             gdb_has_xml = 1;
1935             p += 19;
1936             xml = get_feature_xml(p, &p);
1937             if (!xml) {
1938                 snprintf(buf, sizeof(buf), "E00");
1939                 put_packet(s, buf);
1940                 break;
1941             }
1942
1943             if (*p == ':')
1944                 p++;
1945             addr = strtoul(p, (char **)&p, 16);
1946             if (*p == ',')
1947                 p++;
1948             len = strtoul(p, (char **)&p, 16);
1949
1950             total_len = strlen(xml);
1951             if (addr > total_len) {
1952                 snprintf(buf, sizeof(buf), "E00");
1953                 put_packet(s, buf);
1954                 break;
1955             }
1956             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1957                 len = (MAX_PACKET_LENGTH - 5) / 2;
1958             if (len < total_len - addr) {
1959                 buf[0] = 'm';
1960                 len = memtox(buf + 1, xml + addr, len);
1961             } else {
1962                 buf[0] = 'l';
1963                 len = memtox(buf + 1, xml + addr, total_len - addr);
1964             }
1965             put_packet_binary(s, buf, len + 1);
1966             break;
1967         }
1968 #endif
1969         /* Unrecognised 'q' command.  */
1970         goto unknown_command;
1971
1972     default:
1973     unknown_command:
1974         /* put empty packet */
1975         buf[0] = '\0';
1976         put_packet(s, buf);
1977         break;
1978     }
1979     return RS_IDLE;
1980 }
1981
1982 void gdb_set_stop_cpu(CPUState *env)
1983 {
1984     gdbserver_state->c_cpu = env;
1985     gdbserver_state->g_cpu = env;
1986 }
1987
1988 #ifndef CONFIG_USER_ONLY
1989 static void gdb_vm_state_change(void *opaque, int running, int reason)
1990 {
1991     GDBState *s = gdbserver_state;
1992     CPUState *env = s->c_cpu;
1993     char buf[256];
1994     const char *type;
1995     int ret;
1996
1997     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
1998         s->state == RS_SYSCALL)
1999         return;
2000
2001     /* disable single step if it was enable */
2002     cpu_single_step(env, 0);
2003
2004     if (reason == EXCP_DEBUG) {
2005         if (env->watchpoint_hit) {
2006             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
2007             case BP_MEM_READ:
2008                 type = "r";
2009                 break;
2010             case BP_MEM_ACCESS:
2011                 type = "a";
2012                 break;
2013             default:
2014                 type = "";
2015                 break;
2016             }
2017             snprintf(buf, sizeof(buf),
2018                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
2019                      GDB_SIGNAL_TRAP, env->cpu_index+1, type,
2020                      env->watchpoint_hit->vaddr);
2021             put_packet(s, buf);
2022             env->watchpoint_hit = NULL;
2023             return;
2024         }
2025         tb_flush(env);
2026         ret = GDB_SIGNAL_TRAP;
2027     } else {
2028         ret = GDB_SIGNAL_INT;
2029     }
2030     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, env->cpu_index+1);
2031     put_packet(s, buf);
2032 }
2033 #endif
2034
2035 /* Send a gdb syscall request.
2036    This accepts limited printf-style format specifiers, specifically:
2037     %x  - target_ulong argument printed in hex.
2038     %lx - 64-bit argument printed in hex.
2039     %s  - string pointer (target_ulong) and length (int) pair.  */
2040 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
2041 {
2042     va_list va;
2043     char buf[256];
2044     char *p;
2045     target_ulong addr;
2046     uint64_t i64;
2047     GDBState *s;
2048
2049     s = gdbserver_state;
2050     if (!s)
2051         return;
2052     gdb_current_syscall_cb = cb;
2053     s->state = RS_SYSCALL;
2054 #ifndef CONFIG_USER_ONLY
2055     vm_stop(EXCP_DEBUG);
2056 #endif
2057     s->state = RS_IDLE;
2058     va_start(va, fmt);
2059     p = buf;
2060     *(p++) = 'F';
2061     while (*fmt) {
2062         if (*fmt == '%') {
2063             fmt++;
2064             switch (*fmt++) {
2065             case 'x':
2066                 addr = va_arg(va, target_ulong);
2067                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
2068                 break;
2069             case 'l':
2070                 if (*(fmt++) != 'x')
2071                     goto bad_format;
2072                 i64 = va_arg(va, uint64_t);
2073                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
2074                 break;
2075             case 's':
2076                 addr = va_arg(va, target_ulong);
2077                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
2078                               addr, va_arg(va, int));
2079                 break;
2080             default:
2081             bad_format:
2082                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2083                         fmt - 1);
2084                 break;
2085             }
2086         } else {
2087             *(p++) = *(fmt++);
2088         }
2089     }
2090     *p = 0;
2091     va_end(va);
2092     put_packet(s, buf);
2093 #ifdef CONFIG_USER_ONLY
2094     gdb_handlesig(s->c_cpu, 0);
2095 #else
2096     cpu_exit(s->c_cpu);
2097 #endif
2098 }
2099
2100 static void gdb_read_byte(GDBState *s, int ch)
2101 {
2102     int i, csum;
2103     uint8_t reply;
2104
2105 #ifndef CONFIG_USER_ONLY
2106     if (s->last_packet_len) {
2107         /* Waiting for a response to the last packet.  If we see the start
2108            of a new command then abandon the previous response.  */
2109         if (ch == '-') {
2110 #ifdef DEBUG_GDB
2111             printf("Got NACK, retransmitting\n");
2112 #endif
2113             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2114         }
2115 #ifdef DEBUG_GDB
2116         else if (ch == '+')
2117             printf("Got ACK\n");
2118         else
2119             printf("Got '%c' when expecting ACK/NACK\n", ch);
2120 #endif
2121         if (ch == '+' || ch == '$')
2122             s->last_packet_len = 0;
2123         if (ch != '$')
2124             return;
2125     }
2126     if (vm_running) {
2127         /* when the CPU is running, we cannot do anything except stop
2128            it when receiving a char */
2129         vm_stop(EXCP_INTERRUPT);
2130     } else
2131 #endif
2132     {
2133         switch(s->state) {
2134         case RS_IDLE:
2135             if (ch == '$') {
2136                 s->line_buf_index = 0;
2137                 s->state = RS_GETLINE;
2138             }
2139             break;
2140         case RS_GETLINE:
2141             if (ch == '#') {
2142             s->state = RS_CHKSUM1;
2143             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2144                 s->state = RS_IDLE;
2145             } else {
2146             s->line_buf[s->line_buf_index++] = ch;
2147             }
2148             break;
2149         case RS_CHKSUM1:
2150             s->line_buf[s->line_buf_index] = '\0';
2151             s->line_csum = fromhex(ch) << 4;
2152             s->state = RS_CHKSUM2;
2153             break;
2154         case RS_CHKSUM2:
2155             s->line_csum |= fromhex(ch);
2156             csum = 0;
2157             for(i = 0; i < s->line_buf_index; i++) {
2158                 csum += s->line_buf[i];
2159             }
2160             if (s->line_csum != (csum & 0xff)) {
2161                 reply = '-';
2162                 put_buffer(s, &reply, 1);
2163                 s->state = RS_IDLE;
2164             } else {
2165                 reply = '+';
2166                 put_buffer(s, &reply, 1);
2167                 s->state = gdb_handle_packet(s, s->line_buf);
2168             }
2169             break;
2170         default:
2171             abort();
2172         }
2173     }
2174 }
2175
2176 #ifdef CONFIG_USER_ONLY
2177 int
2178 gdb_queuesig (void)
2179 {
2180     GDBState *s;
2181
2182     s = gdbserver_state;
2183
2184     if (gdbserver_fd < 0 || s->fd < 0)
2185         return 0;
2186     else
2187         return 1;
2188 }
2189
2190 int
2191 gdb_handlesig (CPUState *env, int sig)
2192 {
2193   GDBState *s;
2194   char buf[256];
2195   int n;
2196
2197   s = gdbserver_state;
2198   if (gdbserver_fd < 0 || s->fd < 0)
2199     return sig;
2200
2201   /* disable single step if it was enabled */
2202   cpu_single_step(env, 0);
2203   tb_flush(env);
2204
2205   if (sig != 0)
2206     {
2207       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2208       put_packet(s, buf);
2209     }
2210   /* put_packet() might have detected that the peer terminated the
2211      connection.  */
2212   if (s->fd < 0)
2213       return sig;
2214
2215   sig = 0;
2216   s->state = RS_IDLE;
2217   s->running_state = 0;
2218   while (s->running_state == 0) {
2219       n = read (s->fd, buf, 256);
2220       if (n > 0)
2221         {
2222           int i;
2223
2224           for (i = 0; i < n; i++)
2225             gdb_read_byte (s, buf[i]);
2226         }
2227       else if (n == 0 || errno != EAGAIN)
2228         {
2229           /* XXX: Connection closed.  Should probably wait for annother
2230              connection before continuing.  */
2231           return sig;
2232         }
2233   }
2234   sig = s->signal;
2235   s->signal = 0;
2236   return sig;
2237 }
2238
2239 /* Tell the remote gdb that the process has exited.  */
2240 void gdb_exit(CPUState *env, int code)
2241 {
2242   GDBState *s;
2243   char buf[4];
2244
2245   s = gdbserver_state;
2246   if (gdbserver_fd < 0 || s->fd < 0)
2247     return;
2248
2249   snprintf(buf, sizeof(buf), "W%02x", code);
2250   put_packet(s, buf);
2251 }
2252
2253 /* Tell the remote gdb that the process has exited due to SIG.  */
2254 void gdb_signalled(CPUState *env, int sig)
2255 {
2256   GDBState *s;
2257   char buf[4];
2258
2259   s = gdbserver_state;
2260   if (gdbserver_fd < 0 || s->fd < 0)
2261     return;
2262
2263   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2264   put_packet(s, buf);
2265 }
2266
2267 static void gdb_accept(void)
2268 {
2269     GDBState *s;
2270     struct sockaddr_in sockaddr;
2271     socklen_t len;
2272     int val, fd;
2273
2274     for(;;) {
2275         len = sizeof(sockaddr);
2276         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2277         if (fd < 0 && errno != EINTR) {
2278             perror("accept");
2279             return;
2280         } else if (fd >= 0) {
2281             break;
2282         }
2283     }
2284
2285     /* set short latency */
2286     val = 1;
2287     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2288
2289     s = qemu_mallocz(sizeof(GDBState));
2290
2291     memset (s, 0, sizeof (GDBState));
2292     s->c_cpu = first_cpu;
2293     s->g_cpu = first_cpu;
2294     s->fd = fd;
2295     gdb_has_xml = 0;
2296
2297     gdbserver_state = s;
2298
2299     fcntl(fd, F_SETFL, O_NONBLOCK);
2300 }
2301
2302 static int gdbserver_open(int port)
2303 {
2304     struct sockaddr_in sockaddr;
2305     int fd, val, ret;
2306
2307     fd = socket(PF_INET, SOCK_STREAM, 0);
2308     if (fd < 0) {
2309         perror("socket");
2310         return -1;
2311     }
2312
2313     /* allow fast reuse */
2314     val = 1;
2315     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2316
2317     sockaddr.sin_family = AF_INET;
2318     sockaddr.sin_port = htons(port);
2319     sockaddr.sin_addr.s_addr = 0;
2320     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2321     if (ret < 0) {
2322         perror("bind");
2323         return -1;
2324     }
2325     ret = listen(fd, 0);
2326     if (ret < 0) {
2327         perror("listen");
2328         return -1;
2329     }
2330     return fd;
2331 }
2332
2333 int gdbserver_start(int port)
2334 {
2335     gdbserver_fd = gdbserver_open(port);
2336     if (gdbserver_fd < 0)
2337         return -1;
2338     /* accept connections */
2339     gdb_accept();
2340     return 0;
2341 }
2342
2343 /* Disable gdb stub for child processes.  */
2344 void gdbserver_fork(CPUState *env)
2345 {
2346     GDBState *s = gdbserver_state;
2347     if (gdbserver_fd < 0 || s->fd < 0)
2348       return;
2349     close(s->fd);
2350     s->fd = -1;
2351     cpu_breakpoint_remove_all(env, BP_GDB);
2352     cpu_watchpoint_remove_all(env, BP_GDB);
2353 }
2354 #else
2355 static int gdb_chr_can_receive(void *opaque)
2356 {
2357   /* We can handle an arbitrarily large amount of data.
2358    Pick the maximum packet size, which is as good as anything.  */
2359   return MAX_PACKET_LENGTH;
2360 }
2361
2362 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2363 {
2364     int i;
2365
2366     for (i = 0; i < size; i++) {
2367         gdb_read_byte(gdbserver_state, buf[i]);
2368     }
2369 }
2370
2371 static void gdb_chr_event(void *opaque, int event)
2372 {
2373     switch (event) {
2374     case CHR_EVENT_RESET:
2375         vm_stop(EXCP_INTERRUPT);
2376         gdb_has_xml = 0;
2377         break;
2378     default:
2379         break;
2380     }
2381 }
2382
2383 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2384 {
2385     char buf[MAX_PACKET_LENGTH];
2386
2387     buf[0] = 'O';
2388     if (len > (MAX_PACKET_LENGTH/2) - 1)
2389         len = (MAX_PACKET_LENGTH/2) - 1;
2390     memtohex(buf + 1, (uint8_t *)msg, len);
2391     put_packet(s, buf);
2392 }
2393
2394 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2395 {
2396     const char *p = (const char *)buf;
2397     int max_sz;
2398
2399     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2400     for (;;) {
2401         if (len <= max_sz) {
2402             gdb_monitor_output(gdbserver_state, p, len);
2403             break;
2404         }
2405         gdb_monitor_output(gdbserver_state, p, max_sz);
2406         p += max_sz;
2407         len -= max_sz;
2408     }
2409     return len;
2410 }
2411
2412 int gdbserver_start(const char *port)
2413 {
2414     GDBState *s;
2415     char gdbstub_port_name[128];
2416     int port_num;
2417     char *p;
2418     CharDriverState *chr;
2419
2420     if (!port || !*port)
2421       return -1;
2422
2423     port_num = strtol(port, &p, 10);
2424     if (*p == 0) {
2425         /* A numeric value is interpreted as a port number.  */
2426         snprintf(gdbstub_port_name, sizeof(gdbstub_port_name),
2427                  "tcp::%d,nowait,nodelay,server", port_num);
2428         port = gdbstub_port_name;
2429     }
2430
2431     chr = qemu_chr_open("gdb", port, NULL);
2432     if (!chr)
2433         return -1;
2434
2435     s = qemu_mallocz(sizeof(GDBState));
2436     s->c_cpu = first_cpu;
2437     s->g_cpu = first_cpu;
2438     s->chr = chr;
2439     gdbserver_state = s;
2440     qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2441                           gdb_chr_event, NULL);
2442     qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2443
2444     /* Initialize a monitor terminal for gdb */
2445     s->mon_chr = qemu_mallocz(sizeof(*s->mon_chr));
2446     s->mon_chr->chr_write = gdb_monitor_write;
2447     monitor_init(s->mon_chr, 0);
2448
2449     return 0;
2450 }
2451 #endif