Home | History | Annotate | Download | only in qemu
      1 /*
      2  * gdb server stub
      3  *
      4  * Copyright (c) 2003-2005 Fabrice Bellard
      5  *
      6  * This library is free software; you can redistribute it and/or
      7  * modify it under the terms of the GNU Lesser General Public
      8  * License as published by the Free Software Foundation; either
      9  * version 2 of the License, or (at your option) any later version.
     10  *
     11  * This library is distributed in the hope that it will be useful,
     12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
     13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     14  * Lesser General Public License for more details.
     15  *
     16  * You should have received a copy of the GNU Lesser General Public
     17  * License along with this library; if not, write to the Free Software
     18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA  02110-1301 USA
     19  */
     20 #include "config.h"
     21 #include "qemu-common.h"
     22 #ifdef CONFIG_USER_ONLY
     23 #include <stdlib.h>
     24 #include <stdio.h>
     25 #include <stdarg.h>
     26 #include <string.h>
     27 #include <errno.h>
     28 #include <unistd.h>
     29 #include <fcntl.h>
     30 
     31 #include "qemu.h"
     32 #else
     33 #include "monitor.h"
     34 #include "qemu-char.h"
     35 #include "sysemu.h"
     36 #include "gdbstub.h"
     37 #endif
     38 
     39 #define MAX_PACKET_LENGTH 4096
     40 
     41 #include "qemu_socket.h"
     42 #include "kvm.h"
     43 
     44 
     45 enum {
     46     GDB_SIGNAL_0 = 0,
     47     GDB_SIGNAL_INT = 2,
     48     GDB_SIGNAL_TRAP = 5,
     49     GDB_SIGNAL_UNKNOWN = 143
     50 };
     51 
     52 #ifdef CONFIG_USER_ONLY
     53 
     54 /* Map target signal numbers to GDB protocol signal numbers and vice
     55  * versa.  For user emulation's currently supported systems, we can
     56  * assume most signals are defined.
     57  */
     58 
     59 static int gdb_signal_table[] = {
     60     0,
     61     TARGET_SIGHUP,
     62     TARGET_SIGINT,
     63     TARGET_SIGQUIT,
     64     TARGET_SIGILL,
     65     TARGET_SIGTRAP,
     66     TARGET_SIGABRT,
     67     -1, /* SIGEMT */
     68     TARGET_SIGFPE,
     69     TARGET_SIGKILL,
     70     TARGET_SIGBUS,
     71     TARGET_SIGSEGV,
     72     TARGET_SIGSYS,
     73     TARGET_SIGPIPE,
     74     TARGET_SIGALRM,
     75     TARGET_SIGTERM,
     76     TARGET_SIGURG,
     77     TARGET_SIGSTOP,
     78     TARGET_SIGTSTP,
     79     TARGET_SIGCONT,
     80     TARGET_SIGCHLD,
     81     TARGET_SIGTTIN,
     82     TARGET_SIGTTOU,
     83     TARGET_SIGIO,
     84     TARGET_SIGXCPU,
     85     TARGET_SIGXFSZ,
     86     TARGET_SIGVTALRM,
     87     TARGET_SIGPROF,
     88     TARGET_SIGWINCH,
     89     -1, /* SIGLOST */
     90     TARGET_SIGUSR1,
     91     TARGET_SIGUSR2,
     92 #ifdef TARGET_SIGPWR
     93     TARGET_SIGPWR,
     94 #else
     95     -1,
     96 #endif
     97     -1, /* SIGPOLL */
     98     -1,
     99     -1,
    100     -1,
    101     -1,
    102     -1,
    103     -1,
    104     -1,
    105     -1,
    106     -1,
    107     -1,
    108     -1,
    109 #ifdef __SIGRTMIN
    110     __SIGRTMIN + 1,
    111     __SIGRTMIN + 2,
    112     __SIGRTMIN + 3,
    113     __SIGRTMIN + 4,
    114     __SIGRTMIN + 5,
    115     __SIGRTMIN + 6,
    116     __SIGRTMIN + 7,
    117     __SIGRTMIN + 8,
    118     __SIGRTMIN + 9,
    119     __SIGRTMIN + 10,
    120     __SIGRTMIN + 11,
    121     __SIGRTMIN + 12,
    122     __SIGRTMIN + 13,
    123     __SIGRTMIN + 14,
    124     __SIGRTMIN + 15,
    125     __SIGRTMIN + 16,
    126     __SIGRTMIN + 17,
    127     __SIGRTMIN + 18,
    128     __SIGRTMIN + 19,
    129     __SIGRTMIN + 20,
    130     __SIGRTMIN + 21,
    131     __SIGRTMIN + 22,
    132     __SIGRTMIN + 23,
    133     __SIGRTMIN + 24,
    134     __SIGRTMIN + 25,
    135     __SIGRTMIN + 26,
    136     __SIGRTMIN + 27,
    137     __SIGRTMIN + 28,
    138     __SIGRTMIN + 29,
    139     __SIGRTMIN + 30,
    140     __SIGRTMIN + 31,
    141     -1, /* SIGCANCEL */
    142     __SIGRTMIN,
    143     __SIGRTMIN + 32,
    144     __SIGRTMIN + 33,
    145     __SIGRTMIN + 34,
    146     __SIGRTMIN + 35,
    147     __SIGRTMIN + 36,
    148     __SIGRTMIN + 37,
    149     __SIGRTMIN + 38,
    150     __SIGRTMIN + 39,
    151     __SIGRTMIN + 40,
    152     __SIGRTMIN + 41,
    153     __SIGRTMIN + 42,
    154     __SIGRTMIN + 43,
    155     __SIGRTMIN + 44,
    156     __SIGRTMIN + 45,
    157     __SIGRTMIN + 46,
    158     __SIGRTMIN + 47,
    159     __SIGRTMIN + 48,
    160     __SIGRTMIN + 49,
    161     __SIGRTMIN + 50,
    162     __SIGRTMIN + 51,
    163     __SIGRTMIN + 52,
    164     __SIGRTMIN + 53,
    165     __SIGRTMIN + 54,
    166     __SIGRTMIN + 55,
    167     __SIGRTMIN + 56,
    168     __SIGRTMIN + 57,
    169     __SIGRTMIN + 58,
    170     __SIGRTMIN + 59,
    171     __SIGRTMIN + 60,
    172     __SIGRTMIN + 61,
    173     __SIGRTMIN + 62,
    174     __SIGRTMIN + 63,
    175     __SIGRTMIN + 64,
    176     __SIGRTMIN + 65,
    177     __SIGRTMIN + 66,
    178     __SIGRTMIN + 67,
    179     __SIGRTMIN + 68,
    180     __SIGRTMIN + 69,
    181     __SIGRTMIN + 70,
    182     __SIGRTMIN + 71,
    183     __SIGRTMIN + 72,
    184     __SIGRTMIN + 73,
    185     __SIGRTMIN + 74,
    186     __SIGRTMIN + 75,
    187     __SIGRTMIN + 76,
    188     __SIGRTMIN + 77,
    189     __SIGRTMIN + 78,
    190     __SIGRTMIN + 79,
    191     __SIGRTMIN + 80,
    192     __SIGRTMIN + 81,
    193     __SIGRTMIN + 82,
    194     __SIGRTMIN + 83,
    195     __SIGRTMIN + 84,
    196     __SIGRTMIN + 85,
    197     __SIGRTMIN + 86,
    198     __SIGRTMIN + 87,
    199     __SIGRTMIN + 88,
    200     __SIGRTMIN + 89,
    201     __SIGRTMIN + 90,
    202     __SIGRTMIN + 91,
    203     __SIGRTMIN + 92,
    204     __SIGRTMIN + 93,
    205     __SIGRTMIN + 94,
    206     __SIGRTMIN + 95,
    207     -1, /* SIGINFO */
    208     -1, /* UNKNOWN */
    209     -1, /* DEFAULT */
    210     -1,
    211     -1,
    212     -1,
    213     -1,
    214     -1,
    215     -1
    216 #endif
    217 };
    218 #else
    219 /* In system mode we only need SIGINT and SIGTRAP; other signals
    220    are not yet supported.  */
    221 
    222 enum {
    223     TARGET_SIGINT = 2,
    224     TARGET_SIGTRAP = 5
    225 };
    226 
    227 static int gdb_signal_table[] = {
    228     -1,
    229     -1,
    230     TARGET_SIGINT,
    231     -1,
    232     -1,
    233     TARGET_SIGTRAP
    234 };
    235 #endif
    236 
    237 #ifdef CONFIG_USER_ONLY
    238 static int target_signal_to_gdb (int sig)
    239 {
    240     int i;
    241     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
    242         if (gdb_signal_table[i] == sig)
    243             return i;
    244     return GDB_SIGNAL_UNKNOWN;
    245 }
    246 #endif
    247 
    248 static int gdb_signal_to_target (int sig)
    249 {
    250     if (sig < ARRAY_SIZE (gdb_signal_table))
    251         return gdb_signal_table[sig];
    252     else
    253         return -1;
    254 }
    255 
    256 //#define DEBUG_GDB
    257 
    258 typedef struct GDBRegisterState {
    259     int base_reg;
    260     int num_regs;
    261     gdb_reg_cb get_reg;
    262     gdb_reg_cb set_reg;
    263     const char *xml;
    264     struct GDBRegisterState *next;
    265 } GDBRegisterState;
    266 
    267 enum RSState {
    268     RS_INACTIVE,
    269     RS_IDLE,
    270     RS_GETLINE,
    271     RS_CHKSUM1,
    272     RS_CHKSUM2,
    273     RS_SYSCALL,
    274 };
    275 typedef struct GDBState {
    276     CPUState *c_cpu; /* current CPU for step/continue ops */
    277     CPUState *g_cpu; /* current CPU for other ops */
    278     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
    279     enum RSState state; /* parsing state */
    280     char line_buf[MAX_PACKET_LENGTH];
    281     int line_buf_index;
    282     int line_csum;
    283     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
    284     int last_packet_len;
    285     int signal;
    286 #ifdef CONFIG_USER_ONLY
    287     int fd;
    288     int running_state;
    289 #else
    290     CharDriverState *chr;
    291     CharDriverState *mon_chr;
    292 #endif
    293 } GDBState;
    294 
    295 /* By default use no IRQs and no timers while single stepping so as to
    296  * make single stepping like an ICE HW step.
    297  */
    298 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
    299 
    300 static GDBState *gdbserver_state;
    301 
    302 /* This is an ugly hack to cope with both new and old gdb.
    303    If gdb sends qXfer:features:read then assume we're talking to a newish
    304    gdb that understands target descriptions.  */
    305 static int gdb_has_xml;
    306 
    307 #ifdef CONFIG_USER_ONLY
    308 /* XXX: This is not thread safe.  Do we care?  */
    309 static int gdbserver_fd = -1;
    310 
    311 static int get_char(GDBState *s)
    312 {
    313     uint8_t ch;
    314     int ret;
    315 
    316     for(;;) {
    317         ret = recv(s->fd, &ch, 1, 0);
    318         if (ret < 0) {
    319             if (errno == ECONNRESET)
    320                 s->fd = -1;
    321             if (errno != EINTR && errno != EAGAIN)
    322                 return -1;
    323         } else if (ret == 0) {
    324             close(s->fd);
    325             s->fd = -1;
    326             return -1;
    327         } else {
    328             break;
    329         }
    330     }
    331     return ch;
    332 }
    333 #endif
    334 
    335 static gdb_syscall_complete_cb gdb_current_syscall_cb;
    336 
    337 static enum {
    338     GDB_SYS_UNKNOWN,
    339     GDB_SYS_ENABLED,
    340     GDB_SYS_DISABLED,
    341 } gdb_syscall_mode;
    342 
    343 /* If gdb is connected when the first semihosting syscall occurs then use
    344    remote gdb syscalls.  Otherwise use native file IO.  */
    345 int use_gdb_syscalls(void)
    346 {
    347     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
    348         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
    349                                             : GDB_SYS_DISABLED);
    350     }
    351     return gdb_syscall_mode == GDB_SYS_ENABLED;
    352 }
    353 
    354 /* Resume execution.  */
    355 static inline void gdb_continue(GDBState *s)
    356 {
    357 #ifdef CONFIG_USER_ONLY
    358     s->running_state = 1;
    359 #else
    360     vm_start();
    361 #endif
    362 }
    363 
    364 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
    365 {
    366 #ifdef CONFIG_USER_ONLY
    367     int ret;
    368 
    369     while (len > 0) {
    370         ret = send(s->fd, buf, len, 0);
    371         if (ret < 0) {
    372             if (errno != EINTR && errno != EAGAIN)
    373                 return;
    374         } else {
    375             buf += ret;
    376             len -= ret;
    377         }
    378     }
    379 #else
    380     qemu_chr_write(s->chr, buf, len);
    381 #endif
    382 }
    383 
    384 static inline int fromhex(int v)
    385 {
    386     if (v >= '0' && v <= '9')
    387         return v - '0';
    388     else if (v >= 'A' && v <= 'F')
    389         return v - 'A' + 10;
    390     else if (v >= 'a' && v <= 'f')
    391         return v - 'a' + 10;
    392     else
    393         return 0;
    394 }
    395 
    396 static inline int tohex(int v)
    397 {
    398     if (v < 10)
    399         return v + '0';
    400     else
    401         return v - 10 + 'a';
    402 }
    403 
    404 static void memtohex(char *buf, const uint8_t *mem, int len)
    405 {
    406     int i, c;
    407     char *q;
    408     q = buf;
    409     for(i = 0; i < len; i++) {
    410         c = mem[i];
    411         *q++ = tohex(c >> 4);
    412         *q++ = tohex(c & 0xf);
    413     }
    414     *q = '\0';
    415 }
    416 
    417 static void hextomem(uint8_t *mem, const char *buf, int len)
    418 {
    419     int i;
    420 
    421     for(i = 0; i < len; i++) {
    422         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
    423         buf += 2;
    424     }
    425 }
    426 
    427 /* return -1 if error, 0 if OK */
    428 static int put_packet_binary(GDBState *s, const char *buf, int len)
    429 {
    430     int csum, i;
    431     uint8_t *p;
    432 
    433     for(;;) {
    434         p = s->last_packet;
    435         *(p++) = '$';
    436         memcpy(p, buf, len);
    437         p += len;
    438         csum = 0;
    439         for(i = 0; i < len; i++) {
    440             csum += buf[i];
    441         }
    442         *(p++) = '#';
    443         *(p++) = tohex((csum >> 4) & 0xf);
    444         *(p++) = tohex((csum) & 0xf);
    445 
    446         s->last_packet_len = p - s->last_packet;
    447         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
    448 
    449 #ifdef CONFIG_USER_ONLY
    450         i = get_char(s);
    451         if (i < 0)
    452             return -1;
    453         if (i == '+')
    454             break;
    455 #else
    456         break;
    457 #endif
    458     }
    459     return 0;
    460 }
    461 
    462 /* return -1 if error, 0 if OK */
    463 static int put_packet(GDBState *s, const char *buf)
    464 {
    465 #ifdef DEBUG_GDB
    466     printf("reply='%s'\n", buf);
    467 #endif
    468 
    469     return put_packet_binary(s, buf, strlen(buf));
    470 }
    471 
    472 /* The GDB remote protocol transfers values in target byte order.  This means
    473    we can use the raw memory access routines to access the value buffer.
    474    Conveniently, these also handle the case where the buffer is mis-aligned.
    475  */
    476 #define GET_REG8(val) do { \
    477     stb_p(mem_buf, val); \
    478     return 1; \
    479     } while(0)
    480 #define GET_REG16(val) do { \
    481     stw_p(mem_buf, val); \
    482     return 2; \
    483     } while(0)
    484 #define GET_REG32(val) do { \
    485     stl_p(mem_buf, val); \
    486     return 4; \
    487     } while(0)
    488 #define GET_REG64(val) do { \
    489     stq_p(mem_buf, val); \
    490     return 8; \
    491     } while(0)
    492 
    493 #if TARGET_LONG_BITS == 64
    494 #define GET_REGL(val) GET_REG64(val)
    495 #define ldtul_p(addr) ldq_p(addr)
    496 #else
    497 #define GET_REGL(val) GET_REG32(val)
    498 #define ldtul_p(addr) ldl_p(addr)
    499 #endif
    500 
    501 #if defined(TARGET_I386)
    502 
    503 #ifdef TARGET_X86_64
    504 static const int gpr_map[16] = {
    505     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
    506     8, 9, 10, 11, 12, 13, 14, 15
    507 };
    508 #else
    509 static const int gpr_map[8] = {0, 1, 2, 3, 4, 5, 6, 7};
    510 #endif
    511 
    512 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
    513 
    514 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
    515 {
    516     if (n < CPU_NB_REGS) {
    517         GET_REGL(env->regs[gpr_map[n]]);
    518     } else if (n >= CPU_NB_REGS + 8 && n < CPU_NB_REGS + 16) {
    519         /* FIXME: byteswap float values.  */
    520 #ifdef USE_X86LDOUBLE
    521         memcpy(mem_buf, &env->fpregs[n - (CPU_NB_REGS + 8)], 10);
    522 #else
    523         memset(mem_buf, 0, 10);
    524 #endif
    525         return 10;
    526     } else if (n >= CPU_NB_REGS + 24) {
    527         n -= CPU_NB_REGS + 24;
    528         if (n < CPU_NB_REGS) {
    529             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
    530             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
    531             return 16;
    532         } else if (n == CPU_NB_REGS) {
    533             GET_REG32(env->mxcsr);
    534         }
    535     } else {
    536         n -= CPU_NB_REGS;
    537         switch (n) {
    538         case 0: GET_REGL(env->eip);
    539         case 1: GET_REG32(env->eflags);
    540         case 2: GET_REG32(env->segs[R_CS].selector);
    541         case 3: GET_REG32(env->segs[R_SS].selector);
    542         case 4: GET_REG32(env->segs[R_DS].selector);
    543         case 5: GET_REG32(env->segs[R_ES].selector);
    544         case 6: GET_REG32(env->segs[R_FS].selector);
    545         case 7: GET_REG32(env->segs[R_GS].selector);
    546         /* 8...15 x87 regs.  */
    547         case 16: GET_REG32(env->fpuc);
    548         case 17: GET_REG32((env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11);
    549         case 18: GET_REG32(0); /* ftag */
    550         case 19: GET_REG32(0); /* fiseg */
    551         case 20: GET_REG32(0); /* fioff */
    552         case 21: GET_REG32(0); /* foseg */
    553         case 22: GET_REG32(0); /* fooff */
    554         case 23: GET_REG32(0); /* fop */
    555         /* 24+ xmm regs.  */
    556         }
    557     }
    558     return 0;
    559 }
    560 
    561 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int i)
    562 {
    563     uint32_t tmp;
    564 
    565     if (i < CPU_NB_REGS) {
    566         env->regs[gpr_map[i]] = ldtul_p(mem_buf);
    567         return sizeof(target_ulong);
    568     } else if (i >= CPU_NB_REGS + 8 && i < CPU_NB_REGS + 16) {
    569         i -= CPU_NB_REGS + 8;
    570 #ifdef USE_X86LDOUBLE
    571         memcpy(&env->fpregs[i], mem_buf, 10);
    572 #endif
    573         return 10;
    574     } else if (i >= CPU_NB_REGS + 24) {
    575         i -= CPU_NB_REGS + 24;
    576         if (i < CPU_NB_REGS) {
    577             env->xmm_regs[i].XMM_Q(0) = ldq_p(mem_buf);
    578             env->xmm_regs[i].XMM_Q(1) = ldq_p(mem_buf + 8);
    579             return 16;
    580         } else if (i == CPU_NB_REGS) {
    581             env->mxcsr = ldl_p(mem_buf);
    582             return 4;
    583         }
    584     } else {
    585         i -= CPU_NB_REGS;
    586         switch (i) {
    587         case 0: env->eip = ldtul_p(mem_buf); return sizeof(target_ulong);
    588         case 1: env->eflags = ldl_p(mem_buf); return 4;
    589 #if defined(CONFIG_USER_ONLY)
    590 #define LOAD_SEG(index, sreg)\
    591             tmp = ldl_p(mem_buf);\
    592             if (tmp != env->segs[sreg].selector)\
    593                 cpu_x86_load_seg(env, sreg, tmp);
    594 #else
    595 /* FIXME: Honor segment registers.  Needs to avoid raising an exception
    596    when the selector is invalid.  */
    597 #define LOAD_SEG(index, sreg) do {} while(0)
    598 #endif
    599         case 2: LOAD_SEG(10, R_CS); return 4;
    600         case 3: LOAD_SEG(11, R_SS); return 4;
    601         case 4: LOAD_SEG(12, R_DS); return 4;
    602         case 5: LOAD_SEG(13, R_ES); return 4;
    603         case 6: LOAD_SEG(14, R_FS); return 4;
    604         case 7: LOAD_SEG(15, R_GS); return 4;
    605         /* 8...15 x87 regs.  */
    606         case 16: env->fpuc = ldl_p(mem_buf); return 4;
    607         case 17:
    608                  tmp = ldl_p(mem_buf);
    609                  env->fpstt = (tmp >> 11) & 7;
    610                  env->fpus = tmp & ~0x3800;
    611                  return 4;
    612         case 18: /* ftag */ return 4;
    613         case 19: /* fiseg */ return 4;
    614         case 20: /* fioff */ return 4;
    615         case 21: /* foseg */ return 4;
    616         case 22: /* fooff */ return 4;
    617         case 23: /* fop */ return 4;
    618         /* 24+ xmm regs.  */
    619         }
    620     }
    621     /* Unrecognised register.  */
    622     return 0;
    623 }
    624 
    625 #elif defined (TARGET_PPC)
    626 
    627 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
    628    expects whatever the target description contains.  Due to a
    629    historical mishap the FP registers appear in between core integer
    630    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
    631    FP regs zero size when talking to a newer gdb.  */
    632 #define NUM_CORE_REGS 71
    633 #if defined (TARGET_PPC64)
    634 #define GDB_CORE_XML "power64-core.xml"
    635 #else
    636 #define GDB_CORE_XML "power-core.xml"
    637 #endif
    638 
    639 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
    640 {
    641     if (n < 32) {
    642         /* gprs */
    643         GET_REGL(env->gpr[n]);
    644     } else if (n < 64) {
    645         /* fprs */
    646         if (gdb_has_xml)
    647             return 0;
    648         stfq_p(mem_buf, env->fpr[n-32]);
    649         return 8;
    650     } else {
    651         switch (n) {
    652         case 64: GET_REGL(env->nip);
    653         case 65: GET_REGL(env->msr);
    654         case 66:
    655             {
    656                 uint32_t cr = 0;
    657                 int i;
    658                 for (i = 0; i < 8; i++)
    659                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
    660                 GET_REG32(cr);
    661             }
    662         case 67: GET_REGL(env->lr);
    663         case 68: GET_REGL(env->ctr);
    664         case 69: GET_REGL(env->xer);
    665         case 70:
    666             {
    667                 if (gdb_has_xml)
    668                     return 0;
    669                 GET_REG32(0); /* fpscr */
    670             }
    671         }
    672     }
    673     return 0;
    674 }
    675 
    676 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
    677 {
    678     if (n < 32) {
    679         /* gprs */
    680         env->gpr[n] = ldtul_p(mem_buf);
    681         return sizeof(target_ulong);
    682     } else if (n < 64) {
    683         /* fprs */
    684         if (gdb_has_xml)
    685             return 0;
    686         env->fpr[n-32] = ldfq_p(mem_buf);
    687         return 8;
    688     } else {
    689         switch (n) {
    690         case 64:
    691             env->nip = ldtul_p(mem_buf);
    692             return sizeof(target_ulong);
    693         case 65:
    694             ppc_store_msr(env, ldtul_p(mem_buf));
    695             return sizeof(target_ulong);
    696         case 66:
    697             {
    698                 uint32_t cr = ldl_p(mem_buf);
    699                 int i;
    700                 for (i = 0; i < 8; i++)
    701                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
    702                 return 4;
    703             }
    704         case 67:
    705             env->lr = ldtul_p(mem_buf);
    706             return sizeof(target_ulong);
    707         case 68:
    708             env->ctr = ldtul_p(mem_buf);
    709             return sizeof(target_ulong);
    710         case 69:
    711             env->xer = ldtul_p(mem_buf);
    712             return sizeof(target_ulong);
    713         case 70:
    714             /* fpscr */
    715             if (gdb_has_xml)
    716                 return 0;
    717             return 4;
    718         }
    719     }
    720     return 0;
    721 }
    722 
    723 #elif defined (TARGET_SPARC)
    724 
    725 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
    726 #define NUM_CORE_REGS 86
    727 #else
    728 #define NUM_CORE_REGS 72
    729 #endif
    730 
    731 #ifdef TARGET_ABI32
    732 #define GET_REGA(val) GET_REG32(val)
    733 #else
    734 #define GET_REGA(val) GET_REGL(val)
    735 #endif
    736 
    737 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
    738 {
    739     if (n < 8) {
    740         /* g0..g7 */
    741         GET_REGA(env->gregs[n]);
    742     }
    743     if (n < 32) {
    744         /* register window */
    745         GET_REGA(env->regwptr[n - 8]);
    746     }
    747 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
    748     if (n < 64) {
    749         /* fprs */
    750         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
    751     }
    752     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
    753     switch (n) {
    754     case 64: GET_REGA(env->y);
    755     case 65: GET_REGA(GET_PSR(env));
    756     case 66: GET_REGA(env->wim);
    757     case 67: GET_REGA(env->tbr);
    758     case 68: GET_REGA(env->pc);
    759     case 69: GET_REGA(env->npc);
    760     case 70: GET_REGA(env->fsr);
    761     case 71: GET_REGA(0); /* csr */
    762     default: GET_REGA(0);
    763     }
    764 #else
    765     if (n < 64) {
    766         /* f0-f31 */
    767         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
    768     }
    769     if (n < 80) {
    770         /* f32-f62 (double width, even numbers only) */
    771         uint64_t val;
    772 
    773         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
    774         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
    775         GET_REG64(val);
    776     }
    777     switch (n) {
    778     case 80: GET_REGL(env->pc);
    779     case 81: GET_REGL(env->npc);
    780     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
    781                            ((env->asi & 0xff) << 24) |
    782                            ((env->pstate & 0xfff) << 8) |
    783                            GET_CWP64(env));
    784     case 83: GET_REGL(env->fsr);
    785     case 84: GET_REGL(env->fprs);
    786     case 85: GET_REGL(env->y);
    787     }
    788 #endif
    789     return 0;
    790 }
    791 
    792 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
    793 {
    794 #if defined(TARGET_ABI32)
    795     abi_ulong tmp;
    796 
    797     tmp = ldl_p(mem_buf);
    798 #else
    799     target_ulong tmp;
    800 
    801     tmp = ldtul_p(mem_buf);
    802 #endif
    803 
    804     if (n < 8) {
    805         /* g0..g7 */
    806         env->gregs[n] = tmp;
    807     } else if (n < 32) {
    808         /* register window */
    809         env->regwptr[n - 8] = tmp;
    810     }
    811 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
    812     else if (n < 64) {
    813         /* fprs */
    814         *((uint32_t *)&env->fpr[n - 32]) = tmp;
    815     } else {
    816         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
    817         switch (n) {
    818         case 64: env->y = tmp; break;
    819         case 65: PUT_PSR(env, tmp); break;
    820         case 66: env->wim = tmp; break;
    821         case 67: env->tbr = tmp; break;
    822         case 68: env->pc = tmp; break;
    823         case 69: env->npc = tmp; break;
    824         case 70: env->fsr = tmp; break;
    825         default: return 0;
    826         }
    827     }
    828     return 4;
    829 #else
    830     else if (n < 64) {
    831         /* f0-f31 */
    832         env->fpr[n] = ldfl_p(mem_buf);
    833         return 4;
    834     } else if (n < 80) {
    835         /* f32-f62 (double width, even numbers only) */
    836         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
    837         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
    838     } else {
    839         switch (n) {
    840         case 80: env->pc = tmp; break;
    841         case 81: env->npc = tmp; break;
    842         case 82:
    843 	    PUT_CCR(env, tmp >> 32);
    844 	    env->asi = (tmp >> 24) & 0xff;
    845 	    env->pstate = (tmp >> 8) & 0xfff;
    846 	    PUT_CWP64(env, tmp & 0xff);
    847 	    break;
    848         case 83: env->fsr = tmp; break;
    849         case 84: env->fprs = tmp; break;
    850         case 85: env->y = tmp; break;
    851         default: return 0;
    852         }
    853     }
    854     return 8;
    855 #endif
    856 }
    857 #elif defined (TARGET_ARM)
    858 
    859 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
    860    whatever the target description contains.  Due to a historical mishap
    861    the FPA registers appear in between core integer regs and the CPSR.
    862    We hack round this by giving the FPA regs zero size when talking to a
    863    newer gdb.  */
    864 #define NUM_CORE_REGS 26
    865 #define GDB_CORE_XML "arm-core.xml"
    866 
    867 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
    868 {
    869     if (n < 16) {
    870         /* Core integer register.  */
    871         GET_REG32(env->regs[n]);
    872     }
    873     if (n < 24) {
    874         /* FPA registers.  */
    875         if (gdb_has_xml)
    876             return 0;
    877         memset(mem_buf, 0, 12);
    878         return 12;
    879     }
    880     switch (n) {
    881     case 24:
    882         /* FPA status register.  */
    883         if (gdb_has_xml)
    884             return 0;
    885         GET_REG32(0);
    886     case 25:
    887         /* CPSR */
    888         GET_REG32(cpsr_read(env));
    889     }
    890     /* Unknown register.  */
    891     return 0;
    892 }
    893 
    894 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
    895 {
    896     uint32_t tmp;
    897 
    898     tmp = ldl_p(mem_buf);
    899 
    900     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
    901        cause problems if we ever implement the Jazelle DBX extensions.  */
    902     if (n == 15)
    903         tmp &= ~1;
    904 
    905     if (n < 16) {
    906         /* Core integer register.  */
    907         env->regs[n] = tmp;
    908         return 4;
    909     }
    910     if (n < 24) { /* 16-23 */
    911         /* FPA registers (ignored).  */
    912         if (gdb_has_xml)
    913             return 0;
    914         return 12;
    915     }
    916     switch (n) {
    917     case 24:
    918         /* FPA status register (ignored).  */
    919         if (gdb_has_xml)
    920             return 0;
    921         return 4;
    922     case 25:
    923         /* CPSR */
    924         cpsr_write (env, tmp, 0xffffffff);
    925         return 4;
    926     }
    927     /* Unknown register.  */
    928     return 0;
    929 }
    930 
    931 #elif defined (TARGET_M68K)
    932 
    933 #define NUM_CORE_REGS 18
    934 
    935 #define GDB_CORE_XML "cf-core.xml"
    936 
    937 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
    938 {
    939     if (n < 8) {
    940         /* D0-D7 */
    941         GET_REG32(env->dregs[n]);
    942     } else if (n < 16) {
    943         /* A0-A7 */
    944         GET_REG32(env->aregs[n - 8]);
    945     } else {
    946 	switch (n) {
    947         case 16: GET_REG32(env->sr);
    948         case 17: GET_REG32(env->pc);
    949         }
    950     }
    951     /* FP registers not included here because they vary between
    952        ColdFire and m68k.  Use XML bits for these.  */
    953     return 0;
    954 }
    955 
    956 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
    957 {
    958     uint32_t tmp;
    959 
    960     tmp = ldl_p(mem_buf);
    961 
    962     if (n < 8) {
    963         /* D0-D7 */
    964         env->dregs[n] = tmp;
    965     } else if (n < 8) {
    966         /* A0-A7 */
    967         env->aregs[n - 8] = tmp;
    968     } else {
    969         switch (n) {
    970         case 16: env->sr = tmp; break;
    971         case 17: env->pc = tmp; break;
    972         default: return 0;
    973         }
    974     }
    975     return 4;
    976 }
    977 #elif defined (TARGET_MIPS)
    978 
    979 #define NUM_CORE_REGS 73
    980 
    981 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
    982 {
    983     if (n < 32) {
    984         GET_REGL(env->active_tc.gpr[n]);
    985     }
    986     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
    987         if (n >= 38 && n < 70) {
    988             if (env->CP0_Status & (1 << CP0St_FR))
    989 		GET_REGL(env->active_fpu.fpr[n - 38].d);
    990             else
    991 		GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
    992         }
    993         switch (n) {
    994         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
    995         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
    996         }
    997     }
    998     switch (n) {
    999     case 32: GET_REGL((int32_t)env->CP0_Status);
   1000     case 33: GET_REGL(env->active_tc.LO[0]);
   1001     case 34: GET_REGL(env->active_tc.HI[0]);
   1002     case 35: GET_REGL(env->CP0_BadVAddr);
   1003     case 36: GET_REGL((int32_t)env->CP0_Cause);
   1004     case 37: GET_REGL(env->active_tc.PC);
   1005     case 72: GET_REGL(0); /* fp */
   1006     case 89: GET_REGL((int32_t)env->CP0_PRid);
   1007     }
   1008     if (n >= 73 && n <= 88) {
   1009 	/* 16 embedded regs.  */
   1010 	GET_REGL(0);
   1011     }
   1012 
   1013     return 0;
   1014 }
   1015 
   1016 /* convert MIPS rounding mode in FCR31 to IEEE library */
   1017 static unsigned int ieee_rm[] =
   1018   {
   1019     float_round_nearest_even,
   1020     float_round_to_zero,
   1021     float_round_up,
   1022     float_round_down
   1023   };
   1024 #define RESTORE_ROUNDING_MODE \
   1025     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
   1026 
   1027 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
   1028 {
   1029     target_ulong tmp;
   1030 
   1031     tmp = ldtul_p(mem_buf);
   1032 
   1033     if (n < 32) {
   1034         env->active_tc.gpr[n] = tmp;
   1035         return sizeof(target_ulong);
   1036     }
   1037     if (env->CP0_Config1 & (1 << CP0C1_FP)
   1038             && n >= 38 && n < 73) {
   1039         if (n < 70) {
   1040             if (env->CP0_Status & (1 << CP0St_FR))
   1041               env->active_fpu.fpr[n - 38].d = tmp;
   1042             else
   1043               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
   1044         }
   1045         switch (n) {
   1046         case 70:
   1047             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
   1048             /* set rounding mode */
   1049             RESTORE_ROUNDING_MODE;
   1050 #ifndef CONFIG_SOFTFLOAT
   1051             /* no floating point exception for native float */
   1052             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
   1053 #endif
   1054             break;
   1055         case 71: env->active_fpu.fcr0 = tmp; break;
   1056         }
   1057         return sizeof(target_ulong);
   1058     }
   1059     switch (n) {
   1060     case 32: env->CP0_Status = tmp; break;
   1061     case 33: env->active_tc.LO[0] = tmp; break;
   1062     case 34: env->active_tc.HI[0] = tmp; break;
   1063     case 35: env->CP0_BadVAddr = tmp; break;
   1064     case 36: env->CP0_Cause = tmp; break;
   1065     case 37: env->active_tc.PC = tmp; break;
   1066     case 72: /* fp, ignored */ break;
   1067     default:
   1068 	if (n > 89)
   1069 	    return 0;
   1070 	/* Other registers are readonly.  Ignore writes.  */
   1071 	break;
   1072     }
   1073 
   1074     return sizeof(target_ulong);
   1075 }
   1076 #elif defined (TARGET_SH4)
   1077 
   1078 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
   1079 /* FIXME: We should use XML for this.  */
   1080 
   1081 #define NUM_CORE_REGS 59
   1082 
   1083 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
   1084 {
   1085     if (n < 8) {
   1086         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
   1087             GET_REGL(env->gregs[n + 16]);
   1088         } else {
   1089             GET_REGL(env->gregs[n]);
   1090         }
   1091     } else if (n < 16) {
   1092         GET_REGL(env->gregs[n - 8]);
   1093     } else if (n >= 25 && n < 41) {
   1094 	GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
   1095     } else if (n >= 43 && n < 51) {
   1096 	GET_REGL(env->gregs[n - 43]);
   1097     } else if (n >= 51 && n < 59) {
   1098 	GET_REGL(env->gregs[n - (51 - 16)]);
   1099     }
   1100     switch (n) {
   1101     case 16: GET_REGL(env->pc);
   1102     case 17: GET_REGL(env->pr);
   1103     case 18: GET_REGL(env->gbr);
   1104     case 19: GET_REGL(env->vbr);
   1105     case 20: GET_REGL(env->mach);
   1106     case 21: GET_REGL(env->macl);
   1107     case 22: GET_REGL(env->sr);
   1108     case 23: GET_REGL(env->fpul);
   1109     case 24: GET_REGL(env->fpscr);
   1110     case 41: GET_REGL(env->ssr);
   1111     case 42: GET_REGL(env->spc);
   1112     }
   1113 
   1114     return 0;
   1115 }
   1116 
   1117 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
   1118 {
   1119     uint32_t tmp;
   1120 
   1121     tmp = ldl_p(mem_buf);
   1122 
   1123     if (n < 8) {
   1124         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
   1125             env->gregs[n + 16] = tmp;
   1126         } else {
   1127             env->gregs[n] = tmp;
   1128         }
   1129 	return 4;
   1130     } else if (n < 16) {
   1131         env->gregs[n - 8] = tmp;
   1132 	return 4;
   1133     } else if (n >= 25 && n < 41) {
   1134 	env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
   1135     } else if (n >= 43 && n < 51) {
   1136 	env->gregs[n - 43] = tmp;
   1137 	return 4;
   1138     } else if (n >= 51 && n < 59) {
   1139 	env->gregs[n - (51 - 16)] = tmp;
   1140 	return 4;
   1141     }
   1142     switch (n) {
   1143     case 16: env->pc = tmp;
   1144     case 17: env->pr = tmp;
   1145     case 18: env->gbr = tmp;
   1146     case 19: env->vbr = tmp;
   1147     case 20: env->mach = tmp;
   1148     case 21: env->macl = tmp;
   1149     case 22: env->sr = tmp;
   1150     case 23: env->fpul = tmp;
   1151     case 24: env->fpscr = tmp;
   1152     case 41: env->ssr = tmp;
   1153     case 42: env->spc = tmp;
   1154     default: return 0;
   1155     }
   1156 
   1157     return 4;
   1158 }
   1159 #elif defined (TARGET_MICROBLAZE)
   1160 
   1161 #define NUM_CORE_REGS (32 + 5)
   1162 
   1163 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
   1164 {
   1165     if (n < 32) {
   1166 	GET_REG32(env->regs[n]);
   1167     } else {
   1168 	GET_REG32(env->sregs[n - 32]);
   1169     }
   1170     return 0;
   1171 }
   1172 
   1173 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
   1174 {
   1175     uint32_t tmp;
   1176 
   1177     if (n > NUM_CORE_REGS)
   1178 	return 0;
   1179 
   1180     tmp = ldl_p(mem_buf);
   1181 
   1182     if (n < 32) {
   1183 	env->regs[n] = tmp;
   1184     } else {
   1185 	env->sregs[n - 32] = tmp;
   1186     }
   1187     return 4;
   1188 }
   1189 #elif defined (TARGET_CRIS)
   1190 
   1191 #define NUM_CORE_REGS 49
   1192 
   1193 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
   1194 {
   1195     uint8_t srs;
   1196 
   1197     srs = env->pregs[PR_SRS];
   1198     if (n < 16) {
   1199 	GET_REG32(env->regs[n]);
   1200     }
   1201 
   1202     if (n >= 21 && n < 32) {
   1203 	GET_REG32(env->pregs[n - 16]);
   1204     }
   1205     if (n >= 33 && n < 49) {
   1206 	GET_REG32(env->sregs[srs][n - 33]);
   1207     }
   1208     switch (n) {
   1209     case 16: GET_REG8(env->pregs[0]);
   1210     case 17: GET_REG8(env->pregs[1]);
   1211     case 18: GET_REG32(env->pregs[2]);
   1212     case 19: GET_REG8(srs);
   1213     case 20: GET_REG16(env->pregs[4]);
   1214     case 32: GET_REG32(env->pc);
   1215     }
   1216 
   1217     return 0;
   1218 }
   1219 
   1220 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
   1221 {
   1222     uint32_t tmp;
   1223 
   1224     if (n > 49)
   1225 	return 0;
   1226 
   1227     tmp = ldl_p(mem_buf);
   1228 
   1229     if (n < 16) {
   1230 	env->regs[n] = tmp;
   1231     }
   1232 
   1233     if (n >= 21 && n < 32) {
   1234 	env->pregs[n - 16] = tmp;
   1235     }
   1236 
   1237     /* FIXME: Should support function regs be writable?  */
   1238     switch (n) {
   1239     case 16: return 1;
   1240     case 17: return 1;
   1241     case 18: env->pregs[PR_PID] = tmp; break;
   1242     case 19: return 1;
   1243     case 20: return 2;
   1244     case 32: env->pc = tmp; break;
   1245     }
   1246 
   1247     return 4;
   1248 }
   1249 #elif defined (TARGET_ALPHA)
   1250 
   1251 #define NUM_CORE_REGS 65
   1252 
   1253 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
   1254 {
   1255     if (n < 31) {
   1256        GET_REGL(env->ir[n]);
   1257     }
   1258     else if (n == 31) {
   1259        GET_REGL(0);
   1260     }
   1261     else if (n<63) {
   1262        uint64_t val;
   1263 
   1264        val=*((uint64_t *)&env->fir[n-32]);
   1265        GET_REGL(val);
   1266     }
   1267     else if (n==63) {
   1268        GET_REGL(env->fpcr);
   1269     }
   1270     else if (n==64) {
   1271        GET_REGL(env->pc);
   1272     }
   1273     else {
   1274        GET_REGL(0);
   1275     }
   1276 
   1277     return 0;
   1278 }
   1279 
   1280 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
   1281 {
   1282     target_ulong tmp;
   1283     tmp = ldtul_p(mem_buf);
   1284 
   1285     if (n < 31) {
   1286         env->ir[n] = tmp;
   1287     }
   1288 
   1289     if (n > 31 && n < 63) {
   1290         env->fir[n - 32] = ldfl_p(mem_buf);
   1291     }
   1292 
   1293     if (n == 64 ) {
   1294        env->pc=tmp;
   1295     }
   1296 
   1297     return 8;
   1298 }
   1299 #else
   1300 
   1301 #define NUM_CORE_REGS 0
   1302 
   1303 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
   1304 {
   1305     return 0;
   1306 }
   1307 
   1308 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
   1309 {
   1310     return 0;
   1311 }
   1312 
   1313 #endif
   1314 
   1315 static int num_g_regs = NUM_CORE_REGS;
   1316 
   1317 #ifdef GDB_CORE_XML
   1318 /* Encode data using the encoding for 'x' packets.  */
   1319 static int memtox(char *buf, const char *mem, int len)
   1320 {
   1321     char *p = buf;
   1322     char c;
   1323 
   1324     while (len--) {
   1325         c = *(mem++);
   1326         switch (c) {
   1327         case '#': case '$': case '*': case '}':
   1328             *(p++) = '}';
   1329             *(p++) = c ^ 0x20;
   1330             break;
   1331         default:
   1332             *(p++) = c;
   1333             break;
   1334         }
   1335     }
   1336     return p - buf;
   1337 }
   1338 
   1339 static const char *get_feature_xml(const char *p, const char **newp)
   1340 {
   1341     extern const char *const xml_builtin[][2];
   1342     size_t len;
   1343     int i;
   1344     const char *name;
   1345     static char target_xml[1024];
   1346 
   1347     len = 0;
   1348     while (p[len] && p[len] != ':')
   1349         len++;
   1350     *newp = p + len;
   1351 
   1352     name = NULL;
   1353     if (strncmp(p, "target.xml", len) == 0) {
   1354         /* Generate the XML description for this CPU.  */
   1355         if (!target_xml[0]) {
   1356             GDBRegisterState *r;
   1357 
   1358             snprintf(target_xml, sizeof(target_xml),
   1359                      "<?xml version=\"1.0\"?>"
   1360                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
   1361                      "<target>"
   1362                      "<xi:include href=\"%s\"/>",
   1363                      GDB_CORE_XML);
   1364 
   1365             for (r = first_cpu->gdb_regs; r; r = r->next) {
   1366                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
   1367                 pstrcat(target_xml, sizeof(target_xml), r->xml);
   1368                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
   1369             }
   1370             pstrcat(target_xml, sizeof(target_xml), "</target>");
   1371         }
   1372         return target_xml;
   1373     }
   1374     for (i = 0; ; i++) {
   1375         name = xml_builtin[i][0];
   1376         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
   1377             break;
   1378     }
   1379     return name ? xml_builtin[i][1] : NULL;
   1380 }
   1381 #endif
   1382 
   1383 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
   1384 {
   1385     GDBRegisterState *r;
   1386 
   1387     if (reg < NUM_CORE_REGS)
   1388         return cpu_gdb_read_register(env, mem_buf, reg);
   1389 
   1390     for (r = env->gdb_regs; r; r = r->next) {
   1391         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
   1392             return r->get_reg(env, mem_buf, reg - r->base_reg);
   1393         }
   1394     }
   1395     return 0;
   1396 }
   1397 
   1398 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
   1399 {
   1400     GDBRegisterState *r;
   1401 
   1402     if (reg < NUM_CORE_REGS)
   1403         return cpu_gdb_write_register(env, mem_buf, reg);
   1404 
   1405     for (r = env->gdb_regs; r; r = r->next) {
   1406         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
   1407             return r->set_reg(env, mem_buf, reg - r->base_reg);
   1408         }
   1409     }
   1410     return 0;
   1411 }
   1412 
   1413 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
   1414    specifies the first register number and these registers are included in
   1415    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
   1416    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
   1417  */
   1418 
   1419 void gdb_register_coprocessor(CPUState * env,
   1420                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
   1421                              int num_regs, const char *xml, int g_pos)
   1422 {
   1423     GDBRegisterState *s;
   1424     GDBRegisterState **p;
   1425     static int last_reg = NUM_CORE_REGS;
   1426 
   1427     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
   1428     s->base_reg = last_reg;
   1429     s->num_regs = num_regs;
   1430     s->get_reg = get_reg;
   1431     s->set_reg = set_reg;
   1432     s->xml = xml;
   1433     p = &env->gdb_regs;
   1434     while (*p) {
   1435         /* Check for duplicates.  */
   1436         if (strcmp((*p)->xml, xml) == 0)
   1437             return;
   1438         p = &(*p)->next;
   1439     }
   1440     /* Add to end of list.  */
   1441     last_reg += num_regs;
   1442     *p = s;
   1443     if (g_pos) {
   1444         if (g_pos != s->base_reg) {
   1445             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
   1446                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
   1447         } else {
   1448             num_g_regs = last_reg;
   1449         }
   1450     }
   1451 }
   1452 
   1453 #ifndef CONFIG_USER_ONLY
   1454 static const int xlat_gdb_type[] = {
   1455     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
   1456     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
   1457     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
   1458 };
   1459 #endif
   1460 
   1461 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
   1462 {
   1463     CPUState *env;
   1464     int err = 0;
   1465 
   1466     if (kvm_enabled())
   1467         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
   1468 
   1469     switch (type) {
   1470     case GDB_BREAKPOINT_SW:
   1471     case GDB_BREAKPOINT_HW:
   1472         for (env = first_cpu; env != NULL; env = env->next_cpu) {
   1473             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
   1474             if (err)
   1475                 break;
   1476         }
   1477         return err;
   1478 #ifndef CONFIG_USER_ONLY
   1479     case GDB_WATCHPOINT_WRITE:
   1480     case GDB_WATCHPOINT_READ:
   1481     case GDB_WATCHPOINT_ACCESS:
   1482         for (env = first_cpu; env != NULL; env = env->next_cpu) {
   1483             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
   1484                                         NULL);
   1485             if (err)
   1486                 break;
   1487         }
   1488         return err;
   1489 #endif
   1490     default:
   1491         return -ENOSYS;
   1492     }
   1493 }
   1494 
   1495 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
   1496 {
   1497     CPUState *env;
   1498     int err = 0;
   1499 
   1500     if (kvm_enabled())
   1501         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
   1502 
   1503     switch (type) {
   1504     case GDB_BREAKPOINT_SW:
   1505     case GDB_BREAKPOINT_HW:
   1506         for (env = first_cpu; env != NULL; env = env->next_cpu) {
   1507             err = cpu_breakpoint_remove(env, addr, BP_GDB);
   1508             if (err)
   1509                 break;
   1510         }
   1511         return err;
   1512 #ifndef CONFIG_USER_ONLY
   1513     case GDB_WATCHPOINT_WRITE:
   1514     case GDB_WATCHPOINT_READ:
   1515     case GDB_WATCHPOINT_ACCESS:
   1516         for (env = first_cpu; env != NULL; env = env->next_cpu) {
   1517             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
   1518             if (err)
   1519                 break;
   1520         }
   1521         return err;
   1522 #endif
   1523     default:
   1524         return -ENOSYS;
   1525     }
   1526 }
   1527 
   1528 static void gdb_breakpoint_remove_all(void)
   1529 {
   1530     CPUState *env;
   1531 
   1532     if (kvm_enabled()) {
   1533         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
   1534         return;
   1535     }
   1536 
   1537     for (env = first_cpu; env != NULL; env = env->next_cpu) {
   1538         cpu_breakpoint_remove_all(env, BP_GDB);
   1539 #ifndef CONFIG_USER_ONLY
   1540         cpu_watchpoint_remove_all(env, BP_GDB);
   1541 #endif
   1542     }
   1543 }
   1544 
   1545 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
   1546 {
   1547 #if defined(TARGET_I386)
   1548     s->c_cpu->eip = pc;
   1549     cpu_synchronize_state(s->c_cpu, 1);
   1550 #elif defined (TARGET_PPC)
   1551     s->c_cpu->nip = pc;
   1552 #elif defined (TARGET_SPARC)
   1553     s->c_cpu->pc = pc;
   1554     s->c_cpu->npc = pc + 4;
   1555 #elif defined (TARGET_ARM)
   1556     s->c_cpu->regs[15] = pc;
   1557 #elif defined (TARGET_SH4)
   1558     s->c_cpu->pc = pc;
   1559 #elif defined (TARGET_MIPS)
   1560     s->c_cpu->active_tc.PC = pc;
   1561 #elif defined (TARGET_MICROBLAZE)
   1562     s->c_cpu->sregs[SR_PC] = pc;
   1563 #elif defined (TARGET_CRIS)
   1564     s->c_cpu->pc = pc;
   1565 #elif defined (TARGET_ALPHA)
   1566     s->c_cpu->pc = pc;
   1567 #endif
   1568 }
   1569 
   1570 static inline int gdb_id(CPUState *env)
   1571 {
   1572 #if defined(CONFIG_USER_ONLY) && defined(USE_NPTL)
   1573     return env->host_tid;
   1574 #else
   1575     return env->cpu_index + 1;
   1576 #endif
   1577 }
   1578 
   1579 static CPUState *find_cpu(uint32_t thread_id)
   1580 {
   1581     CPUState *env;
   1582 
   1583     for (env = first_cpu; env != NULL; env = env->next_cpu) {
   1584         if (gdb_id(env) == thread_id) {
   1585             return env;
   1586         }
   1587     }
   1588 
   1589     return NULL;
   1590 }
   1591 
   1592 static int gdb_handle_packet(GDBState *s, const char *line_buf)
   1593 {
   1594     CPUState *env;
   1595     const char *p;
   1596     uint32_t thread;
   1597     int ch, reg_size, type, res;
   1598     char buf[MAX_PACKET_LENGTH];
   1599     uint8_t mem_buf[MAX_PACKET_LENGTH];
   1600     uint8_t *registers;
   1601     target_ulong addr, len;
   1602 
   1603 #ifdef DEBUG_GDB
   1604     printf("command='%s'\n", line_buf);
   1605 #endif
   1606     p = line_buf;
   1607     ch = *p++;
   1608     switch(ch) {
   1609     case '?':
   1610         /* TODO: Make this return the correct value for user-mode.  */
   1611         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
   1612                  gdb_id(s->c_cpu));
   1613         put_packet(s, buf);
   1614         /* Remove all the breakpoints when this query is issued,
   1615          * because gdb is doing and initial connect and the state
   1616          * should be cleaned up.
   1617          */
   1618         gdb_breakpoint_remove_all();
   1619         break;
   1620     case 'c':
   1621         if (*p != '\0') {
   1622             addr = strtoull(p, (char **)&p, 16);
   1623             gdb_set_cpu_pc(s, addr);
   1624         }
   1625         s->signal = 0;
   1626         gdb_continue(s);
   1627 	return RS_IDLE;
   1628     case 'C':
   1629         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
   1630         if (s->signal == -1)
   1631             s->signal = 0;
   1632         gdb_continue(s);
   1633         return RS_IDLE;
   1634     case 'k':
   1635         /* Kill the target */
   1636         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
   1637         exit(0);
   1638     case 'D':
   1639         /* Detach packet */
   1640         gdb_breakpoint_remove_all();
   1641         gdb_continue(s);
   1642         put_packet(s, "OK");
   1643         break;
   1644     case 's':
   1645         if (*p != '\0') {
   1646             addr = strtoull(p, (char **)&p, 16);
   1647             gdb_set_cpu_pc(s, addr);
   1648         }
   1649         cpu_single_step(s->c_cpu, sstep_flags);
   1650         gdb_continue(s);
   1651 	return RS_IDLE;
   1652     case 'F':
   1653         {
   1654             target_ulong ret;
   1655             target_ulong err;
   1656 
   1657             ret = strtoull(p, (char **)&p, 16);
   1658             if (*p == ',') {
   1659                 p++;
   1660                 err = strtoull(p, (char **)&p, 16);
   1661             } else {
   1662                 err = 0;
   1663             }
   1664             if (*p == ',')
   1665                 p++;
   1666             type = *p;
   1667             if (gdb_current_syscall_cb)
   1668                 gdb_current_syscall_cb(s->c_cpu, ret, err);
   1669             if (type == 'C') {
   1670                 put_packet(s, "T02");
   1671             } else {
   1672                 gdb_continue(s);
   1673             }
   1674         }
   1675         break;
   1676     case 'g':
   1677         cpu_synchronize_state(s->g_cpu, 0);
   1678         len = 0;
   1679         for (addr = 0; addr < num_g_regs; addr++) {
   1680             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
   1681             len += reg_size;
   1682         }
   1683         memtohex(buf, mem_buf, len);
   1684         put_packet(s, buf);
   1685         break;
   1686     case 'G':
   1687         registers = mem_buf;
   1688         len = strlen(p) / 2;
   1689         hextomem((uint8_t *)registers, p, len);
   1690         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
   1691             reg_size = gdb_write_register(s->g_cpu, registers, addr);
   1692             len -= reg_size;
   1693             registers += reg_size;
   1694         }
   1695         cpu_synchronize_state(s->g_cpu, 1);
   1696         put_packet(s, "OK");
   1697         break;
   1698     case 'm':
   1699         addr = strtoull(p, (char **)&p, 16);
   1700         if (*p == ',')
   1701             p++;
   1702         len = strtoull(p, NULL, 16);
   1703         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
   1704             put_packet (s, "E14");
   1705         } else {
   1706             memtohex(buf, mem_buf, len);
   1707             put_packet(s, buf);
   1708         }
   1709         break;
   1710     case 'M':
   1711         addr = strtoull(p, (char **)&p, 16);
   1712         if (*p == ',')
   1713             p++;
   1714         len = strtoull(p, (char **)&p, 16);
   1715         if (*p == ':')
   1716             p++;
   1717         hextomem(mem_buf, p, len);
   1718         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
   1719             put_packet(s, "E14");
   1720         else
   1721             put_packet(s, "OK");
   1722         break;
   1723     case 'p':
   1724         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
   1725            This works, but can be very slow.  Anything new enough to
   1726            understand XML also knows how to use this properly.  */
   1727         if (!gdb_has_xml)
   1728             goto unknown_command;
   1729         addr = strtoull(p, (char **)&p, 16);
   1730         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
   1731         if (reg_size) {
   1732             memtohex(buf, mem_buf, reg_size);
   1733             put_packet(s, buf);
   1734         } else {
   1735             put_packet(s, "E14");
   1736         }
   1737         break;
   1738     case 'P':
   1739         if (!gdb_has_xml)
   1740             goto unknown_command;
   1741         addr = strtoull(p, (char **)&p, 16);
   1742         if (*p == '=')
   1743             p++;
   1744         reg_size = strlen(p) / 2;
   1745         hextomem(mem_buf, p, reg_size);
   1746         gdb_write_register(s->g_cpu, mem_buf, addr);
   1747         put_packet(s, "OK");
   1748         break;
   1749     case 'Z':
   1750     case 'z':
   1751         type = strtoul(p, (char **)&p, 16);
   1752         if (*p == ',')
   1753             p++;
   1754         addr = strtoull(p, (char **)&p, 16);
   1755         if (*p == ',')
   1756             p++;
   1757         len = strtoull(p, (char **)&p, 16);
   1758         if (ch == 'Z')
   1759             res = gdb_breakpoint_insert(addr, len, type);
   1760         else
   1761             res = gdb_breakpoint_remove(addr, len, type);
   1762         if (res >= 0)
   1763              put_packet(s, "OK");
   1764         else if (res == -ENOSYS)
   1765             put_packet(s, "");
   1766         else
   1767             put_packet(s, "E22");
   1768         break;
   1769     case 'H':
   1770         type = *p++;
   1771         thread = strtoull(p, (char **)&p, 16);
   1772         if (thread == -1 || thread == 0) {
   1773             put_packet(s, "OK");
   1774             break;
   1775         }
   1776         env = find_cpu(thread);
   1777         if (env == NULL) {
   1778             put_packet(s, "E22");
   1779             break;
   1780         }
   1781         switch (type) {
   1782         case 'c':
   1783             s->c_cpu = env;
   1784             put_packet(s, "OK");
   1785             break;
   1786         case 'g':
   1787             s->g_cpu = env;
   1788             put_packet(s, "OK");
   1789             break;
   1790         default:
   1791              put_packet(s, "E22");
   1792              break;
   1793         }
   1794         break;
   1795     case 'T':
   1796         thread = strtoull(p, (char **)&p, 16);
   1797         env = find_cpu(thread);
   1798 
   1799         if (env != NULL) {
   1800             put_packet(s, "OK");
   1801         } else {
   1802             put_packet(s, "E22");
   1803         }
   1804         break;
   1805     case 'q':
   1806     case 'Q':
   1807         /* parse any 'q' packets here */
   1808         if (!strcmp(p,"qemu.sstepbits")) {
   1809             /* Query Breakpoint bit definitions */
   1810             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
   1811                      SSTEP_ENABLE,
   1812                      SSTEP_NOIRQ,
   1813                      SSTEP_NOTIMER);
   1814             put_packet(s, buf);
   1815             break;
   1816         } else if (strncmp(p,"qemu.sstep",10) == 0) {
   1817             /* Display or change the sstep_flags */
   1818             p += 10;
   1819             if (*p != '=') {
   1820                 /* Display current setting */
   1821                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
   1822                 put_packet(s, buf);
   1823                 break;
   1824             }
   1825             p++;
   1826             type = strtoul(p, (char **)&p, 16);
   1827             sstep_flags = type;
   1828             put_packet(s, "OK");
   1829             break;
   1830         } else if (strcmp(p,"C") == 0) {
   1831             /* "Current thread" remains vague in the spec, so always return
   1832              *  the first CPU (gdb returns the first thread). */
   1833             put_packet(s, "QC1");
   1834             break;
   1835         } else if (strcmp(p,"fThreadInfo") == 0) {
   1836             s->query_cpu = first_cpu;
   1837             goto report_cpuinfo;
   1838         } else if (strcmp(p,"sThreadInfo") == 0) {
   1839         report_cpuinfo:
   1840             if (s->query_cpu) {
   1841                 snprintf(buf, sizeof(buf), "m%x", gdb_id(s->query_cpu));
   1842                 put_packet(s, buf);
   1843                 s->query_cpu = s->query_cpu->next_cpu;
   1844             } else
   1845                 put_packet(s, "l");
   1846             break;
   1847         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
   1848             thread = strtoull(p+16, (char **)&p, 16);
   1849             env = find_cpu(thread);
   1850             if (env != NULL) {
   1851                 cpu_synchronize_state(env, 0);
   1852                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
   1853                                "CPU#%d [%s]", env->cpu_index,
   1854                                env->halted ? "halted " : "running");
   1855                 memtohex(buf, mem_buf, len);
   1856                 put_packet(s, buf);
   1857             }
   1858             break;
   1859         }
   1860 #ifdef CONFIG_USER_ONLY
   1861         else if (strncmp(p, "Offsets", 7) == 0) {
   1862             TaskState *ts = s->c_cpu->opaque;
   1863 
   1864             snprintf(buf, sizeof(buf),
   1865                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
   1866                      ";Bss=" TARGET_ABI_FMT_lx,
   1867                      ts->info->code_offset,
   1868                      ts->info->data_offset,
   1869                      ts->info->data_offset);
   1870             put_packet(s, buf);
   1871             break;
   1872         }
   1873 #else /* !CONFIG_USER_ONLY */
   1874         else if (strncmp(p, "Rcmd,", 5) == 0) {
   1875             int len = strlen(p + 5);
   1876 
   1877             if ((len % 2) != 0) {
   1878                 put_packet(s, "E01");
   1879                 break;
   1880             }
   1881             hextomem(mem_buf, p + 5, len);
   1882             len = len / 2;
   1883             mem_buf[len++] = 0;
   1884             qemu_chr_read(s->mon_chr, mem_buf, len);
   1885             put_packet(s, "OK");
   1886             break;
   1887         }
   1888 #endif /* !CONFIG_USER_ONLY */
   1889         if (strncmp(p, "Supported", 9) == 0) {
   1890             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
   1891 #ifdef GDB_CORE_XML
   1892             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
   1893 #endif
   1894             put_packet(s, buf);
   1895             break;
   1896         }
   1897 #ifdef GDB_CORE_XML
   1898         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
   1899             const char *xml;
   1900             target_ulong total_len;
   1901 
   1902             gdb_has_xml = 1;
   1903             p += 19;
   1904             xml = get_feature_xml(p, &p);
   1905             if (!xml) {
   1906                 snprintf(buf, sizeof(buf), "E00");
   1907                 put_packet(s, buf);
   1908                 break;
   1909             }
   1910 
   1911             if (*p == ':')
   1912                 p++;
   1913             addr = strtoul(p, (char **)&p, 16);
   1914             if (*p == ',')
   1915                 p++;
   1916             len = strtoul(p, (char **)&p, 16);
   1917 
   1918             total_len = strlen(xml);
   1919             if (addr > total_len) {
   1920                 snprintf(buf, sizeof(buf), "E00");
   1921                 put_packet(s, buf);
   1922                 break;
   1923             }
   1924             if (len > (MAX_PACKET_LENGTH - 5) / 2)
   1925                 len = (MAX_PACKET_LENGTH - 5) / 2;
   1926             if (len < total_len - addr) {
   1927                 buf[0] = 'm';
   1928                 len = memtox(buf + 1, xml + addr, len);
   1929             } else {
   1930                 buf[0] = 'l';
   1931                 len = memtox(buf + 1, xml + addr, total_len - addr);
   1932             }
   1933             put_packet_binary(s, buf, len + 1);
   1934             break;
   1935         }
   1936 #endif
   1937         /* Unrecognised 'q' command.  */
   1938         goto unknown_command;
   1939 
   1940     default:
   1941     unknown_command:
   1942         /* put empty packet */
   1943         buf[0] = '\0';
   1944         put_packet(s, buf);
   1945         break;
   1946     }
   1947     return RS_IDLE;
   1948 }
   1949 
   1950 void gdb_set_stop_cpu(CPUState *env)
   1951 {
   1952     gdbserver_state->c_cpu = env;
   1953     gdbserver_state->g_cpu = env;
   1954 }
   1955 
   1956 #ifndef CONFIG_USER_ONLY
   1957 static void gdb_vm_state_change(void *opaque, int running, int reason)
   1958 {
   1959     GDBState *s = gdbserver_state;
   1960     CPUState *env = s->c_cpu;
   1961     char buf[256];
   1962     const char *type;
   1963     int ret;
   1964 
   1965     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
   1966         s->state == RS_INACTIVE || s->state == RS_SYSCALL)
   1967         return;
   1968 
   1969     /* disable single step if it was enable */
   1970     cpu_single_step(env, 0);
   1971 
   1972     if (reason == EXCP_DEBUG) {
   1973         if (env->watchpoint_hit) {
   1974             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
   1975             case BP_MEM_READ:
   1976                 type = "r";
   1977                 break;
   1978             case BP_MEM_ACCESS:
   1979                 type = "a";
   1980                 break;
   1981             default:
   1982                 type = "";
   1983                 break;
   1984             }
   1985             snprintf(buf, sizeof(buf),
   1986                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
   1987                      GDB_SIGNAL_TRAP, gdb_id(env), type,
   1988                      env->watchpoint_hit->vaddr);
   1989             put_packet(s, buf);
   1990             env->watchpoint_hit = NULL;
   1991             return;
   1992         }
   1993 	tb_flush(env);
   1994         ret = GDB_SIGNAL_TRAP;
   1995     } else {
   1996         ret = GDB_SIGNAL_INT;
   1997     }
   1998     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, gdb_id(env));
   1999     put_packet(s, buf);
   2000 }
   2001 #endif
   2002 
   2003 /* Send a gdb syscall request.
   2004    This accepts limited printf-style format specifiers, specifically:
   2005     %x  - target_ulong argument printed in hex.
   2006     %lx - 64-bit argument printed in hex.
   2007     %s  - string pointer (target_ulong) and length (int) pair.  */
   2008 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
   2009 {
   2010     va_list va;
   2011     char buf[256];
   2012     char *p;
   2013     target_ulong addr;
   2014     uint64_t i64;
   2015     GDBState *s;
   2016 
   2017     s = gdbserver_state;
   2018     if (!s)
   2019         return;
   2020     gdb_current_syscall_cb = cb;
   2021     s->state = RS_SYSCALL;
   2022 #ifndef CONFIG_USER_ONLY
   2023     vm_stop(EXCP_DEBUG);
   2024 #endif
   2025     s->state = RS_IDLE;
   2026     va_start(va, fmt);
   2027     p = buf;
   2028     *(p++) = 'F';
   2029     while (*fmt) {
   2030         if (*fmt == '%') {
   2031             fmt++;
   2032             switch (*fmt++) {
   2033             case 'x':
   2034                 addr = va_arg(va, target_ulong);
   2035                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
   2036                 break;
   2037             case 'l':
   2038                 if (*(fmt++) != 'x')
   2039                     goto bad_format;
   2040                 i64 = va_arg(va, uint64_t);
   2041                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
   2042                 break;
   2043             case 's':
   2044                 addr = va_arg(va, target_ulong);
   2045                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
   2046                               addr, va_arg(va, int));
   2047                 break;
   2048             default:
   2049             bad_format:
   2050                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
   2051                         fmt - 1);
   2052                 break;
   2053             }
   2054         } else {
   2055             *(p++) = *(fmt++);
   2056         }
   2057     }
   2058     *p = 0;
   2059     va_end(va);
   2060     put_packet(s, buf);
   2061 #ifdef CONFIG_USER_ONLY
   2062     gdb_handlesig(s->c_cpu, 0);
   2063 #else
   2064     cpu_exit(s->c_cpu);
   2065 #endif
   2066 }
   2067 
   2068 static void gdb_read_byte(GDBState *s, int ch)
   2069 {
   2070     int i, csum;
   2071     uint8_t reply;
   2072 
   2073 #ifndef CONFIG_USER_ONLY
   2074     if (s->last_packet_len) {
   2075         /* Waiting for a response to the last packet.  If we see the start
   2076            of a new command then abandon the previous response.  */
   2077         if (ch == '-') {
   2078 #ifdef DEBUG_GDB
   2079             printf("Got NACK, retransmitting\n");
   2080 #endif
   2081             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
   2082         }
   2083 #ifdef DEBUG_GDB
   2084         else if (ch == '+')
   2085             printf("Got ACK\n");
   2086         else
   2087             printf("Got '%c' when expecting ACK/NACK\n", ch);
   2088 #endif
   2089         if (ch == '+' || ch == '$')
   2090             s->last_packet_len = 0;
   2091         if (ch != '$')
   2092             return;
   2093     }
   2094     if (vm_running) {
   2095         /* when the CPU is running, we cannot do anything except stop
   2096            it when receiving a char */
   2097         vm_stop(EXCP_INTERRUPT);
   2098     } else
   2099 #endif
   2100     {
   2101         switch(s->state) {
   2102         case RS_IDLE:
   2103             if (ch == '$') {
   2104                 s->line_buf_index = 0;
   2105                 s->state = RS_GETLINE;
   2106             }
   2107             break;
   2108         case RS_GETLINE:
   2109             if (ch == '#') {
   2110             s->state = RS_CHKSUM1;
   2111             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
   2112                 s->state = RS_IDLE;
   2113             } else {
   2114             s->line_buf[s->line_buf_index++] = ch;
   2115             }
   2116             break;
   2117         case RS_CHKSUM1:
   2118             s->line_buf[s->line_buf_index] = '\0';
   2119             s->line_csum = fromhex(ch) << 4;
   2120             s->state = RS_CHKSUM2;
   2121             break;
   2122         case RS_CHKSUM2:
   2123             s->line_csum |= fromhex(ch);
   2124             csum = 0;
   2125             for(i = 0; i < s->line_buf_index; i++) {
   2126                 csum += s->line_buf[i];
   2127             }
   2128             if (s->line_csum != (csum & 0xff)) {
   2129                 reply = '-';
   2130                 put_buffer(s, &reply, 1);
   2131                 s->state = RS_IDLE;
   2132             } else {
   2133                 reply = '+';
   2134                 put_buffer(s, &reply, 1);
   2135                 s->state = gdb_handle_packet(s, s->line_buf);
   2136             }
   2137             break;
   2138         default:
   2139             abort();
   2140         }
   2141     }
   2142 }
   2143 
   2144 #ifdef CONFIG_USER_ONLY
   2145 int
   2146 gdb_queuesig (void)
   2147 {
   2148     GDBState *s;
   2149 
   2150     s = gdbserver_state;
   2151 
   2152     if (gdbserver_fd < 0 || s->fd < 0)
   2153         return 0;
   2154     else
   2155         return 1;
   2156 }
   2157 
   2158 int
   2159 gdb_handlesig (CPUState *env, int sig)
   2160 {
   2161   GDBState *s;
   2162   char buf[256];
   2163   int n;
   2164 
   2165   s = gdbserver_state;
   2166   if (gdbserver_fd < 0 || s->fd < 0)
   2167     return sig;
   2168 
   2169   /* disable single step if it was enabled */
   2170   cpu_single_step(env, 0);
   2171   tb_flush(env);
   2172 
   2173   if (sig != 0)
   2174     {
   2175       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
   2176       put_packet(s, buf);
   2177     }
   2178   /* put_packet() might have detected that the peer terminated the
   2179      connection.  */
   2180   if (s->fd < 0)
   2181       return sig;
   2182 
   2183   sig = 0;
   2184   s->state = RS_IDLE;
   2185   s->running_state = 0;
   2186   while (s->running_state == 0) {
   2187       n = read (s->fd, buf, 256);
   2188       if (n > 0)
   2189         {
   2190           int i;
   2191 
   2192           for (i = 0; i < n; i++)
   2193             gdb_read_byte (s, buf[i]);
   2194         }
   2195       else if (n == 0 || errno != EAGAIN)
   2196         {
   2197           /* XXX: Connection closed.  Should probably wait for annother
   2198              connection before continuing.  */
   2199           return sig;
   2200         }
   2201   }
   2202   sig = s->signal;
   2203   s->signal = 0;
   2204   return sig;
   2205 }
   2206 
   2207 /* Tell the remote gdb that the process has exited.  */
   2208 void gdb_exit(CPUState *env, int code)
   2209 {
   2210   GDBState *s;
   2211   char buf[4];
   2212 
   2213   s = gdbserver_state;
   2214   if (gdbserver_fd < 0 || s->fd < 0)
   2215     return;
   2216 
   2217   snprintf(buf, sizeof(buf), "W%02x", code);
   2218   put_packet(s, buf);
   2219 }
   2220 
   2221 /* Tell the remote gdb that the process has exited due to SIG.  */
   2222 void gdb_signalled(CPUState *env, int sig)
   2223 {
   2224   GDBState *s;
   2225   char buf[4];
   2226 
   2227   s = gdbserver_state;
   2228   if (gdbserver_fd < 0 || s->fd < 0)
   2229     return;
   2230 
   2231   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
   2232   put_packet(s, buf);
   2233 }
   2234 
   2235 static void gdb_accept(void)
   2236 {
   2237     GDBState *s;
   2238     struct sockaddr_in sockaddr;
   2239     socklen_t len;
   2240     int val, fd;
   2241 
   2242     for(;;) {
   2243         len = sizeof(sockaddr);
   2244         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
   2245         if (fd < 0 && errno != EINTR) {
   2246             perror("accept");
   2247             return;
   2248         } else if (fd >= 0) {
   2249             break;
   2250         }
   2251     }
   2252 
   2253     /* set short latency */
   2254     val = 1;
   2255     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
   2256 
   2257     s = qemu_mallocz(sizeof(GDBState));
   2258     s->c_cpu = first_cpu;
   2259     s->g_cpu = first_cpu;
   2260     s->fd = fd;
   2261     gdb_has_xml = 0;
   2262 
   2263     gdbserver_state = s;
   2264 
   2265     fcntl(fd, F_SETFL, O_NONBLOCK);
   2266 }
   2267 
   2268 static int gdbserver_open(int port)
   2269 {
   2270     struct sockaddr_in sockaddr;
   2271     int fd, val, ret;
   2272 
   2273     fd = socket(PF_INET, SOCK_STREAM, 0);
   2274     if (fd < 0) {
   2275         perror("socket");
   2276         return -1;
   2277     }
   2278 
   2279     /* allow fast reuse */
   2280     val = 1;
   2281     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
   2282 
   2283     sockaddr.sin_family = AF_INET;
   2284     sockaddr.sin_port = htons(port);
   2285     sockaddr.sin_addr.s_addr = 0;
   2286     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
   2287     if (ret < 0) {
   2288         perror("bind");
   2289         return -1;
   2290     }
   2291     ret = listen(fd, 0);
   2292     if (ret < 0) {
   2293         perror("listen");
   2294         return -1;
   2295     }
   2296     return fd;
   2297 }
   2298 
   2299 int gdbserver_start(int port)
   2300 {
   2301     gdbserver_fd = gdbserver_open(port);
   2302     if (gdbserver_fd < 0)
   2303         return -1;
   2304     /* accept connections */
   2305     gdb_accept();
   2306     return 0;
   2307 }
   2308 
   2309 /* Disable gdb stub for child processes.  */
   2310 void gdbserver_fork(CPUState *env)
   2311 {
   2312     GDBState *s = gdbserver_state;
   2313     if (gdbserver_fd < 0 || s->fd < 0)
   2314       return;
   2315     close(s->fd);
   2316     s->fd = -1;
   2317     cpu_breakpoint_remove_all(env, BP_GDB);
   2318     cpu_watchpoint_remove_all(env, BP_GDB);
   2319 }
   2320 #else
   2321 static int gdb_chr_can_receive(void *opaque)
   2322 {
   2323   /* We can handle an arbitrarily large amount of data.
   2324    Pick the maximum packet size, which is as good as anything.  */
   2325   return MAX_PACKET_LENGTH;
   2326 }
   2327 
   2328 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
   2329 {
   2330     int i;
   2331 
   2332     for (i = 0; i < size; i++) {
   2333         gdb_read_byte(gdbserver_state, buf[i]);
   2334     }
   2335 }
   2336 
   2337 static void gdb_chr_event(void *opaque, int event)
   2338 {
   2339     switch (event) {
   2340     case CHR_EVENT_RESET:
   2341         vm_stop(EXCP_INTERRUPT);
   2342         gdb_has_xml = 0;
   2343         break;
   2344     default:
   2345         break;
   2346     }
   2347 }
   2348 
   2349 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
   2350 {
   2351     char buf[MAX_PACKET_LENGTH];
   2352 
   2353     buf[0] = 'O';
   2354     if (len > (MAX_PACKET_LENGTH/2) - 1)
   2355         len = (MAX_PACKET_LENGTH/2) - 1;
   2356     memtohex(buf + 1, (uint8_t *)msg, len);
   2357     put_packet(s, buf);
   2358 }
   2359 
   2360 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
   2361 {
   2362     const char *p = (const char *)buf;
   2363     int max_sz;
   2364 
   2365     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
   2366     for (;;) {
   2367         if (len <= max_sz) {
   2368             gdb_monitor_output(gdbserver_state, p, len);
   2369             break;
   2370         }
   2371         gdb_monitor_output(gdbserver_state, p, max_sz);
   2372         p += max_sz;
   2373         len -= max_sz;
   2374     }
   2375     return len;
   2376 }
   2377 
   2378 #ifndef _WIN32
   2379 static void gdb_sigterm_handler(int signal)
   2380 {
   2381     if (vm_running)
   2382         vm_stop(EXCP_INTERRUPT);
   2383 }
   2384 #endif
   2385 
   2386 int gdbserver_start(const char *device)
   2387 {
   2388     GDBState *s;
   2389     char gdbstub_device_name[128];
   2390     CharDriverState *chr = NULL;
   2391     CharDriverState *mon_chr;
   2392 
   2393     if (!device)
   2394         return -1;
   2395     if (strcmp(device, "none") != 0) {
   2396         if (strstart(device, "tcp:", NULL)) {
   2397             /* enforce required TCP attributes */
   2398             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
   2399                      "%s,nowait,nodelay,server", device);
   2400             device = gdbstub_device_name;
   2401         }
   2402 #ifndef _WIN32
   2403         else if (strcmp(device, "stdio") == 0) {
   2404             struct sigaction act;
   2405 
   2406             memset(&act, 0, sizeof(act));
   2407             act.sa_handler = gdb_sigterm_handler;
   2408             sigaction(SIGINT, &act, NULL);
   2409         }
   2410 #endif
   2411         chr = qemu_chr_open("gdb", device, NULL);
   2412         if (!chr)
   2413             return -1;
   2414 
   2415         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
   2416                               gdb_chr_event, NULL);
   2417     }
   2418 
   2419     s = gdbserver_state;
   2420     if (!s) {
   2421         s = qemu_mallocz(sizeof(GDBState));
   2422         gdbserver_state = s;
   2423 
   2424         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
   2425 
   2426         /* Initialize a monitor terminal for gdb */
   2427         mon_chr = qemu_mallocz(sizeof(*mon_chr));
   2428         mon_chr->chr_write = gdb_monitor_write;
   2429         monitor_init(mon_chr, 0);
   2430     } else {
   2431         if (s->chr)
   2432             qemu_chr_close(s->chr);
   2433         mon_chr = s->mon_chr;
   2434         memset(s, 0, sizeof(GDBState));
   2435     }
   2436     s->c_cpu = first_cpu;
   2437     s->g_cpu = first_cpu;
   2438     s->chr = chr;
   2439     s->state = chr ? RS_IDLE : RS_INACTIVE;
   2440     s->mon_chr = mon_chr;
   2441 
   2442     return 0;
   2443 }
   2444 #endif
   2445