gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20 #include "config.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "qemu-common.h"
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #include "qemu-kvm.h"
  37 #endif
  38
  39 #include "qemu_socket.h"
  40 #ifdef _WIN32
  41 /* XXX: these constants may be independent of the host ones even for Unix */
  42 #ifndef SIGTRAP
  43 #define SIGTRAP 5
  44 #endif
  45 #ifndef SIGINT
  46 #define SIGINT 2
  47 #endif
  48 #else
  49 #include <signal.h>
  50 #endif
  51
  52 //#define DEBUG_GDB
  53
  54 enum RSState {
  55     RS_IDLE,
  56     RS_GETLINE,
  57     RS_CHKSUM1,
  58     RS_CHKSUM2,
  59     RS_SYSCALL,
  60 };
  61 typedef struct GDBState {
  62     CPUState *env; /* current CPU */
  63     enum RSState state; /* parsing state */
  64     char line_buf[4096];
  65     int line_buf_index;
  66     int line_csum;
  67     uint8_t last_packet[4100];
  68     int last_packet_len;
  69     int signal;
  70 #ifdef CONFIG_USER_ONLY
  71     int fd;
  72     int running_state;
  73 #else
  74     CharDriverState *chr;
  75 #endif
  76 } GDBState;
  77
  78 /* By default use no IRQs and no timers while single stepping so as to
  79  * make single stepping like an ICE HW step.
  80  */
  81 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
  82
  83 #ifdef CONFIG_USER_ONLY
  84 /* XXX: This is not thread safe.  Do we care?  */
  85 static int gdbserver_fd = -1;
  86
  87 /* XXX: remove this hack.  */
  88 static GDBState gdbserver_state;
  89
  90 static int get_char(GDBState *s)
  91 {
  92     uint8_t ch;
  93     int ret;
  94
  95     for(;;) {
  96         ret = recv(s->fd, &ch, 1, 0);
  97         if (ret < 0) {
  98             if (errno == ECONNRESET)
  99                 s->fd = -1;
 100             if (errno != EINTR && errno != EAGAIN)
 101                 return -1;
 102         } else if (ret == 0) {
 103             close(s->fd);
 104             s->fd = -1;
 105             return -1;
 106         } else {
 107             break;
 108         }
 109     }
 110     return ch;
 111 }
 112 #endif
 113
 114 /* GDB stub state for use by semihosting syscalls.  */
 115 static GDBState *gdb_syscall_state;
 116 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 117
 118 enum {
 119     GDB_SYS_UNKNOWN,
 120     GDB_SYS_ENABLED,
 121     GDB_SYS_DISABLED,
 122 } gdb_syscall_mode;
 123
 124 /* If gdb is connected when the first semihosting syscall occurs then use
 125    remote gdb syscalls.  Otherwise use native file IO.  */
 126 int use_gdb_syscalls(void)
 127 {
 128     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 129         gdb_syscall_mode = (gdb_syscall_state ? GDB_SYS_ENABLED
 130                                               : GDB_SYS_DISABLED);
 131     }
 132     return gdb_syscall_mode == GDB_SYS_ENABLED;
 133 }
 134
 135 /* Resume execution.  */
 136 static inline void gdb_continue(GDBState *s)
 137 {
 138 #ifdef CONFIG_USER_ONLY
 139     s->running_state = 1;
 140 #else
 141     vm_start();
 142 #endif
 143 }
 144
 145 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 146 {
 147 #ifdef CONFIG_USER_ONLY
 148     int ret;
 149
 150     while (len > 0) {
 151         ret = send(s->fd, buf, len, 0);
 152         if (ret < 0) {
 153             if (errno != EINTR && errno != EAGAIN)
 154                 return;
 155         } else {
 156             buf += ret;
 157             len -= ret;
 158         }
 159     }
 160 #else
 161     qemu_chr_write(s->chr, buf, len);
 162 #endif
 163 }
 164
 165 static inline int fromhex(int v)
 166 {
 167     if (v >= '0' && v <= '9')
 168         return v - '0';
 169     else if (v >= 'A' && v <= 'F')
 170         return v - 'A' + 10;
 171     else if (v >= 'a' && v <= 'f')
 172         return v - 'a' + 10;
 173     else
 174         return 0;
 175 }
 176
 177 static inline int tohex(int v)
 178 {
 179     if (v < 10)
 180         return v + '0';
 181     else
 182         return v - 10 + 'a';
 183 }
 184
 185 static void memtohex(char *buf, const uint8_t *mem, int len)
 186 {
 187     int i, c;
 188     char *q;
 189     q = buf;
 190     for(i = 0; i < len; i++) {
 191         c = mem[i];
 192         *q++ = tohex(c >> 4);
 193         *q++ = tohex(c & 0xf);
 194     }
 195     *q = '\0';
 196 }
 197
 198 static void hextomem(uint8_t *mem, const char *buf, int len)
 199 {
 200     int i;
 201
 202     for(i = 0; i < len; i++) {
 203         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 204         buf += 2;
 205     }
 206 }
 207
 208 /* return -1 if error, 0 if OK */
 209 static int put_packet(GDBState *s, char *buf)
 210 {
 211     int len, csum, i;
 212     uint8_t *p;
 213
 214 #ifdef DEBUG_GDB
 215     printf("reply='%s'\n", buf);
 216 #endif
 217
 218     for(;;) {
 219         p = s->last_packet;
 220         *(p++) = '$';
 221         len = strlen(buf);
 222         memcpy(p, buf, len);
 223         p += len;
 224         csum = 0;
 225         for(i = 0; i < len; i++) {
 226             csum += buf[i];
 227         }
 228         *(p++) = '#';
 229         *(p++) = tohex((csum >> 4) & 0xf);
 230         *(p++) = tohex((csum) & 0xf);
 231
 232         s->last_packet_len = p - s->last_packet;
 233         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 234
 235 #ifdef CONFIG_USER_ONLY
 236         i = get_char(s);
 237         if (i < 0)
 238             return -1;
 239         if (i == '+')
 240             break;
 241 #else
 242         break;
 243 #endif
 244     }
 245     return 0;
 246 }
 247
 248 #if defined(TARGET_I386)
 249
 250 #ifdef TARGET_X86_64
 251 static const uint8_t gdb_x86_64_regs[16] = {
 252     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 253     8, 9, 10, 11, 12, 13, 14, 15,
 254 };
 255 #endif
 256
 257 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
 258 {
 259     int i, fpus, nb_regs;
 260     uint8_t *p;
 261
 262     p = mem_buf;
 263 #ifdef TARGET_X86_64
 264     if (env->hflags & HF_CS64_MASK) {
 265         nb_regs = 16;
 266         for(i = 0; i < 16; i++) {
 267             *(uint64_t *)p = tswap64(env->regs[gdb_x86_64_regs[i]]);
 268             p += 8;
 269         }
 270         *(uint64_t *)p = tswap64(env->eip);
 271         p += 8;
 272     } else
 273 #endif
 274     {
 275         nb_regs = 8;
 276         for(i = 0; i < 8; i++) {
 277             *(uint32_t *)p = tswap32(env->regs[i]);
 278             p += 4;
 279         }
 280         *(uint32_t *)p = tswap32(env->eip);
 281         p += 4;
 282     }
 283
 284     *(uint32_t *)p = tswap32(env->eflags);
 285     p += 4;
 286     *(uint32_t *)p = tswap32(env->segs[R_CS].selector);
 287     p += 4;
 288     *(uint32_t *)p = tswap32(env->segs[R_SS].selector);
 289     p += 4;
 290     *(uint32_t *)p = tswap32(env->segs[R_DS].selector);
 291     p += 4;
 292     *(uint32_t *)p = tswap32(env->segs[R_ES].selector);
 293     p += 4;
 294     *(uint32_t *)p = tswap32(env->segs[R_FS].selector);
 295     p += 4;
 296     *(uint32_t *)p = tswap32(env->segs[R_GS].selector);
 297     p += 4;
 298     for(i = 0; i < 8; i++) {
 299         /* XXX: convert floats */
 300 #ifdef USE_X86LDOUBLE
 301         memcpy(p, &env->fpregs[i], 10);
 302 #else
 303         memset(p, 0, 10);
 304 #endif
 305         p += 10;
 306     }
 307     *(uint32_t *)p = tswap32(env->fpuc); /* fctrl */
 308     p += 4;
 309     fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
 310     *(uint32_t *)p = tswap32(fpus); /* fstat */
 311     p += 4;
 312     *(uint32_t *)p = 0; /* ftag */
 313     p += 4;
 314     *(uint32_t *)p = 0; /* fiseg */
 315     p += 4;
 316     *(uint32_t *)p = 0; /* fioff */
 317     p += 4;
 318     *(uint32_t *)p = 0; /* foseg */
 319     p += 4;
 320     *(uint32_t *)p = 0; /* fooff */
 321     p += 4;
 322     *(uint32_t *)p = 0; /* fop */
 323     p += 4;
 324     for(i = 0; i < nb_regs; i++) {
 325         *(uint64_t *)p = tswap64(env->xmm_regs[i].XMM_Q(0));
 326         p += 8;
 327         *(uint64_t *)p = tswap64(env->xmm_regs[i].XMM_Q(1));
 328         p += 8;
 329     }
 330     *(uint32_t *)p = tswap32(env->mxcsr);
 331     p += 4;
 332     return p - mem_buf;
 333 }
 334
 335 static inline void cpu_gdb_load_seg(CPUState *env, const uint8_t **pp,
 336                                     int sreg)
 337 {
 338     const uint8_t *p;
 339     uint32_t sel;
 340     p = *pp;
 341     sel = tswap32(*(uint32_t *)p);
 342     p += 4;
 343     if (sel != env->segs[sreg].selector) {
 344 #if defined(CONFIG_USER_ONLY)
 345         cpu_x86_load_seg(env, sreg, sel);
 346 #else
 347         /* XXX: do it with a debug function which does not raise an
 348            exception */
 349 #endif
 350     }
 351     *pp = p;
 352 }
 353
 354 static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
 355 {
 356     const uint8_t *p = mem_buf;
 357     int i, nb_regs;
 358     uint16_t fpus;
 359
 360 #ifdef TARGET_X86_64
 361     if (env->hflags & HF_CS64_MASK) {
 362         nb_regs = 16;
 363         for(i = 0; i < 16; i++) {
 364             env->regs[gdb_x86_64_regs[i]] = tswap64(*(uint64_t *)p);
 365             p += 8;
 366         }
 367         env->eip = tswap64(*(uint64_t *)p);
 368         p += 8;
 369     } else
 370 #endif
 371     {
 372         nb_regs = 8;
 373         for(i = 0; i < 8; i++) {
 374             env->regs[i] = tswap32(*(uint32_t *)p);
 375             p += 4;
 376         }
 377         env->eip = tswap32(*(uint32_t *)p);
 378         p += 4;
 379     }
 380     env->eflags = tswap32(*(uint32_t *)p);
 381     p += 4;
 382     cpu_gdb_load_seg(env, &p, R_CS);
 383     cpu_gdb_load_seg(env, &p, R_SS);
 384     cpu_gdb_load_seg(env, &p, R_DS);
 385     cpu_gdb_load_seg(env, &p, R_ES);
 386     cpu_gdb_load_seg(env, &p, R_FS);
 387     cpu_gdb_load_seg(env, &p, R_GS);
 388
 389     /* FPU state */
 390     for(i = 0; i < 8; i++) {
 391         /* XXX: convert floats */
 392 #ifdef USE_X86LDOUBLE
 393         memcpy(&env->fpregs[i], p, 10);
 394 #endif
 395         p += 10;
 396     }
 397     env->fpuc = tswap32(*(uint32_t *)p); /* fctrl */
 398     p += 4;
 399     fpus = tswap32(*(uint32_t *)p);
 400     p += 4;
 401     env->fpstt = (fpus >> 11) & 7;
 402     env->fpus = fpus & ~0x3800;
 403     p += 4 * 6;
 404
 405     if (size >= ((p - mem_buf) + 16 * nb_regs + 4)) {
 406         /* SSE state */
 407         for(i = 0; i < nb_regs; i++) {
 408             env->xmm_regs[i].XMM_Q(0) = tswap64(*(uint64_t *)p);
 409             p += 8;
 410             env->xmm_regs[i].XMM_Q(1) = tswap64(*(uint64_t *)p);
 411             p += 8;
 412         }
 413         env->mxcsr = tswap32(*(uint32_t *)p);
 414         p += 4;
 415     }
 416 }
 417
 418 #elif defined (TARGET_PPC)
 419 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
 420 {
 421     uint32_t *registers = (uint32_t *)mem_buf, tmp;
 422     int i;
 423
 424     /* fill in gprs */
 425     for(i = 0; i < 32; i++) {
 426         registers[i] = tswapl(env->gpr[i]);
 427     }
 428     /* fill in fprs */
 429     for (i = 0; i < 32; i++) {
 430         registers[(i * 2) + 32] = tswapl(*((uint32_t *)&env->fpr[i]));
 431         registers[(i * 2) + 33] = tswapl(*((uint32_t *)&env->fpr[i] + 1));
 432     }
 433     /* nip, msr, ccr, lnk, ctr, xer, mq */
 434     registers[96] = tswapl(env->nip);
 435     registers[97] = tswapl(env->msr);
 436     tmp = 0;
 437     for (i = 0; i < 8; i++)
 438         tmp |= env->crf[i] << (32 - ((i + 1) * 4));
 439     registers[98] = tswapl(tmp);
 440     registers[99] = tswapl(env->lr);
 441     registers[100] = tswapl(env->ctr);
 442     registers[101] = tswapl(ppc_load_xer(env));
 443     registers[102] = 0;
 444
 445     return 103 * 4;
 446 }
 447
 448 static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
 449 {
 450     uint32_t *registers = (uint32_t *)mem_buf;
 451     int i;
 452
 453     /* fill in gprs */
 454     for (i = 0; i < 32; i++) {
 455         env->gpr[i] = tswapl(registers[i]);
 456     }
 457     /* fill in fprs */
 458     for (i = 0; i < 32; i++) {
 459         *((uint32_t *)&env->fpr[i]) = tswapl(registers[(i * 2) + 32]);
 460         *((uint32_t *)&env->fpr[i] + 1) = tswapl(registers[(i * 2) + 33]);
 461     }
 462     /* nip, msr, ccr, lnk, ctr, xer, mq */
 463     env->nip = tswapl(registers[96]);
 464     ppc_store_msr(env, tswapl(registers[97]));
 465     registers[98] = tswapl(registers[98]);
 466     for (i = 0; i < 8; i++)
 467         env->crf[i] = (registers[98] >> (32 - ((i + 1) * 4))) & 0xF;
 468     env->lr = tswapl(registers[99]);
 469     env->ctr = tswapl(registers[100]);
 470     ppc_store_xer(env, tswapl(registers[101]));
 471 }
 472 #elif defined (TARGET_SPARC)
 473 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
 474 {
 475     target_ulong *registers = (target_ulong *)mem_buf;
 476     int i;
 477
 478     /* fill in g0..g7 */
 479     for(i = 0; i < 8; i++) {
 480         registers[i] = tswapl(env->gregs[i]);
 481     }
 482     /* fill in register window */
 483     for(i = 0; i < 24; i++) {
 484         registers[i + 8] = tswapl(env->regwptr[i]);
 485     }
 486 #ifndef TARGET_SPARC64
 487     /* fill in fprs */
 488     for (i = 0; i < 32; i++) {
 489         registers[i + 32] = tswapl(*((uint32_t *)&env->fpr[i]));
 490     }
 491     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 492     registers[64] = tswapl(env->y);
 493     {
 494         target_ulong tmp;
 495
 496         tmp = GET_PSR(env);
 497         registers[65] = tswapl(tmp);
 498     }
 499     registers[66] = tswapl(env->wim);
 500     registers[67] = tswapl(env->tbr);
 501     registers[68] = tswapl(env->pc);
 502     registers[69] = tswapl(env->npc);
 503     registers[70] = tswapl(env->fsr);
 504     registers[71] = 0; /* csr */
 505     registers[72] = 0;
 506     return 73 * sizeof(target_ulong);
 507 #else
 508     /* fill in fprs */
 509     for (i = 0; i < 64; i += 2) {
 510         uint64_t tmp;
 511
 512         tmp = ((uint64_t)*(uint32_t *)&env->fpr[i]) << 32;
 513         tmp |= *(uint32_t *)&env->fpr[i + 1];
 514         registers[i / 2 + 32] = tswap64(tmp);
 515     }
 516     registers[64] = tswapl(env->pc);
 517     registers[65] = tswapl(env->npc);
 518     registers[66] = tswapl(((uint64_t)GET_CCR(env) << 32) |
 519                            ((env->asi & 0xff) << 24) |
 520                            ((env->pstate & 0xfff) << 8) |
 521                            GET_CWP64(env));
 522     registers[67] = tswapl(env->fsr);
 523     registers[68] = tswapl(env->fprs);
 524     registers[69] = tswapl(env->y);
 525     return 70 * sizeof(target_ulong);
 526 #endif
 527 }
 528
 529 static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
 530 {
 531     target_ulong *registers = (target_ulong *)mem_buf;
 532     int i;
 533
 534     /* fill in g0..g7 */
 535     for(i = 0; i < 7; i++) {
 536         env->gregs[i] = tswapl(registers[i]);
 537     }
 538     /* fill in register window */
 539     for(i = 0; i < 24; i++) {
 540         env->regwptr[i] = tswapl(registers[i + 8]);
 541     }
 542 #ifndef TARGET_SPARC64
 543     /* fill in fprs */
 544     for (i = 0; i < 32; i++) {
 545         *((uint32_t *)&env->fpr[i]) = tswapl(registers[i + 32]);
 546     }
 547     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 548     env->y = tswapl(registers[64]);
 549     PUT_PSR(env, tswapl(registers[65]));
 550     env->wim = tswapl(registers[66]);
 551     env->tbr = tswapl(registers[67]);
 552     env->pc = tswapl(registers[68]);
 553     env->npc = tswapl(registers[69]);
 554     env->fsr = tswapl(registers[70]);
 555 #else
 556     for (i = 0; i < 64; i += 2) {
 557         uint64_t tmp;
 558
 559         tmp = tswap64(registers[i / 2 + 32]);
 560         *((uint32_t *)&env->fpr[i]) = tmp >> 32;
 561         *((uint32_t *)&env->fpr[i + 1]) = tmp & 0xffffffff;
 562     }
 563     env->pc = tswapl(registers[64]);
 564     env->npc = tswapl(registers[65]);
 565     {
 566         uint64_t tmp = tswapl(registers[66]);
 567
 568         PUT_CCR(env, tmp >> 32);
 569         env->asi = (tmp >> 24) & 0xff;
 570         env->pstate = (tmp >> 8) & 0xfff;
 571         PUT_CWP64(env, tmp & 0xff);
 572     }
 573     env->fsr = tswapl(registers[67]);
 574     env->fprs = tswapl(registers[68]);
 575     env->y = tswapl(registers[69]);
 576 #endif
 577 }
 578 #elif defined (TARGET_ARM)
 579 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
 580 {
 581     int i;
 582     uint8_t *ptr;
 583
 584     ptr = mem_buf;
 585     /* 16 core integer registers (4 bytes each).  */
 586     for (i = 0; i < 16; i++)
 587       {
 588         *(uint32_t *)ptr = tswapl(env->regs[i]);
 589         ptr += 4;
 590       }
 591     /* 8 FPA registers (12 bytes each), FPS (4 bytes).
 592        Not yet implemented.  */
 593     memset (ptr, 0, 8 * 12 + 4);
 594     ptr += 8 * 12 + 4;
 595     /* CPSR (4 bytes).  */
 596     *(uint32_t *)ptr = tswapl (cpsr_read(env));
 597     ptr += 4;
 598
 599     return ptr - mem_buf;
 600 }
 601
 602 static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
 603 {
 604     int i;
 605     uint8_t *ptr;
 606
 607     ptr = mem_buf;
 608     /* Core integer registers.  */
 609     for (i = 0; i < 16; i++)
 610       {
 611         env->regs[i] = tswapl(*(uint32_t *)ptr);
 612         ptr += 4;
 613       }
 614     /* Ignore FPA regs and scr.  */
 615     ptr += 8 * 12 + 4;
 616     cpsr_write (env, tswapl(*(uint32_t *)ptr), 0xffffffff);
 617 }
 618 #elif defined (TARGET_M68K)
 619 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
 620 {
 621     int i;
 622     uint8_t *ptr;
 623     CPU_DoubleU u;
 624
 625     ptr = mem_buf;
 626     /* D0-D7 */
 627     for (i = 0; i < 8; i++) {
 628         *(uint32_t *)ptr = tswapl(env->dregs[i]);
 629         ptr += 4;
 630     }
 631     /* A0-A7 */
 632     for (i = 0; i < 8; i++) {
 633         *(uint32_t *)ptr = tswapl(env->aregs[i]);
 634         ptr += 4;
 635     }
 636     *(uint32_t *)ptr = tswapl(env->sr);
 637     ptr += 4;
 638     *(uint32_t *)ptr = tswapl(env->pc);
 639     ptr += 4;
 640     /* F0-F7.  The 68881/68040 have 12-bit extended precision registers.
 641        ColdFire has 8-bit double precision registers.  */
 642     for (i = 0; i < 8; i++) {
 643         u.d = env->fregs[i];
 644         *(uint32_t *)ptr = tswap32(u.l.upper);
 645         *(uint32_t *)ptr = tswap32(u.l.lower);
 646     }
 647     /* FP control regs (not implemented).  */
 648     memset (ptr, 0, 3 * 4);
 649     ptr += 3 * 4;
 650
 651     return ptr - mem_buf;
 652 }
 653
 654 static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
 655 {
 656     int i;
 657     uint8_t *ptr;
 658     CPU_DoubleU u;
 659
 660     ptr = mem_buf;
 661     /* D0-D7 */
 662     for (i = 0; i < 8; i++) {
 663         env->dregs[i] = tswapl(*(uint32_t *)ptr);
 664         ptr += 4;
 665     }
 666     /* A0-A7 */
 667     for (i = 0; i < 8; i++) {
 668         env->aregs[i] = tswapl(*(uint32_t *)ptr);
 669         ptr += 4;
 670     }
 671     env->sr = tswapl(*(uint32_t *)ptr);
 672     ptr += 4;
 673     env->pc = tswapl(*(uint32_t *)ptr);
 674     ptr += 4;
 675     /* F0-F7.  The 68881/68040 have 12-bit extended precision registers.
 676        ColdFire has 8-bit double precision registers.  */
 677     for (i = 0; i < 8; i++) {
 678         u.l.upper = tswap32(*(uint32_t *)ptr);
 679         u.l.lower = tswap32(*(uint32_t *)ptr);
 680         env->fregs[i] = u.d;
 681     }
 682     /* FP control regs (not implemented).  */
 683     ptr += 3 * 4;
 684 }
 685 #elif defined (TARGET_MIPS)
 686 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
 687 {
 688     int i;
 689     uint8_t *ptr;
 690
 691     ptr = mem_buf;
 692     for (i = 0; i < 32; i++)
 693       {
 694         *(target_ulong *)ptr = tswapl(env->gpr[env->current_tc][i]);
 695         ptr += sizeof(target_ulong);
 696       }
 697
 698     *(target_ulong *)ptr = (int32_t)tswap32(env->CP0_Status);
 699     ptr += sizeof(target_ulong);
 700
 701     *(target_ulong *)ptr = tswapl(env->LO[env->current_tc][0]);
 702     ptr += sizeof(target_ulong);
 703
 704     *(target_ulong *)ptr = tswapl(env->HI[env->current_tc][0]);
 705     ptr += sizeof(target_ulong);
 706
 707     *(target_ulong *)ptr = tswapl(env->CP0_BadVAddr);
 708     ptr += sizeof(target_ulong);
 709
 710     *(target_ulong *)ptr = (int32_t)tswap32(env->CP0_Cause);
 711     ptr += sizeof(target_ulong);
 712
 713     *(target_ulong *)ptr = tswapl(env->PC[env->current_tc]);
 714     ptr += sizeof(target_ulong);
 715
 716     if (env->CP0_Config1 & (1 << CP0C1_FP))
 717       {
 718         for (i = 0; i < 32; i++)
 719           {
 720             if (env->CP0_Status & (1 << CP0St_FR))
 721               *(target_ulong *)ptr = tswapl(env->fpu->fpr[i].d);
 722             else
 723               *(target_ulong *)ptr = tswap32(env->fpu->fpr[i].w[FP_ENDIAN_IDX]);
 724             ptr += sizeof(target_ulong);
 725           }
 726
 727         *(target_ulong *)ptr = (int32_t)tswap32(env->fpu->fcr31);
 728         ptr += sizeof(target_ulong);
 729
 730         *(target_ulong *)ptr = (int32_t)tswap32(env->fpu->fcr0);
 731         ptr += sizeof(target_ulong);
 732       }
 733
 734     /* "fp", pseudo frame pointer. Not yet implemented in gdb. */
 735     *(target_ulong *)ptr = 0;
 736     ptr += sizeof(target_ulong);
 737
 738     /* Registers for embedded use, we just pad them. */
 739     for (i = 0; i < 16; i++)
 740       {
 741         *(target_ulong *)ptr = 0;
 742         ptr += sizeof(target_ulong);
 743       }
 744
 745     /* Processor ID. */
 746     *(target_ulong *)ptr = (int32_t)tswap32(env->CP0_PRid);
 747     ptr += sizeof(target_ulong);
 748
 749     return ptr - mem_buf;
 750 }
 751
 752 /* convert MIPS rounding mode in FCR31 to IEEE library */
 753 static unsigned int ieee_rm[] =
 754   {
 755     float_round_nearest_even,
 756     float_round_to_zero,
 757     float_round_up,
 758     float_round_down
 759   };
 760 #define RESTORE_ROUNDING_MODE \
 761     set_float_rounding_mode(ieee_rm[env->fpu->fcr31 & 3], &env->fpu->fp_status)
 762
 763 static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
 764 {
 765     int i;
 766     uint8_t *ptr;
 767
 768     ptr = mem_buf;
 769     for (i = 0; i < 32; i++)
 770       {
 771         env->gpr[env->current_tc][i] = tswapl(*(target_ulong *)ptr);
 772         ptr += sizeof(target_ulong);
 773       }
 774
 775     env->CP0_Status = tswapl(*(target_ulong *)ptr);
 776     ptr += sizeof(target_ulong);
 777
 778     env->LO[env->current_tc][0] = tswapl(*(target_ulong *)ptr);
 779     ptr += sizeof(target_ulong);
 780
 781     env->HI[env->current_tc][0] = tswapl(*(target_ulong *)ptr);
 782     ptr += sizeof(target_ulong);
 783
 784     env->CP0_BadVAddr = tswapl(*(target_ulong *)ptr);
 785     ptr += sizeof(target_ulong);
 786
 787     env->CP0_Cause = tswapl(*(target_ulong *)ptr);
 788     ptr += sizeof(target_ulong);
 789
 790     env->PC[env->current_tc] = tswapl(*(target_ulong *)ptr);
 791     ptr += sizeof(target_ulong);
 792
 793     if (env->CP0_Config1 & (1 << CP0C1_FP))
 794       {
 795         for (i = 0; i < 32; i++)
 796           {
 797             if (env->CP0_Status & (1 << CP0St_FR))
 798               env->fpu->fpr[i].d = tswapl(*(target_ulong *)ptr);
 799             else
 800               env->fpu->fpr[i].w[FP_ENDIAN_IDX] = tswapl(*(target_ulong *)ptr);
 801             ptr += sizeof(target_ulong);
 802           }
 803
 804         env->fpu->fcr31 = tswapl(*(target_ulong *)ptr) & 0xFF83FFFF;
 805         ptr += sizeof(target_ulong);
 806
 807         /* The remaining registers are assumed to be read-only. */
 808
 809         /* set rounding mode */
 810         RESTORE_ROUNDING_MODE;
 811
 812 #ifndef CONFIG_SOFTFLOAT
 813         /* no floating point exception for native float */
 814         SET_FP_ENABLE(env->fcr31, 0);
 815 #endif
 816       }
 817 }
 818 #elif defined (TARGET_SH4)
 819
 820 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
 821
 822 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
 823 {
 824   uint32_t *ptr = (uint32_t *)mem_buf;
 825   int i;
 826
 827 #define SAVE(x) *ptr++=tswapl(x)
 828   if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
 829       for (i = 0; i < 8; i++) SAVE(env->gregs[i + 16]);
 830   } else {
 831       for (i = 0; i < 8; i++) SAVE(env->gregs[i]);
 832   }
 833   for (i = 8; i < 16; i++) SAVE(env->gregs[i]);
 834   SAVE (env->pc);
 835   SAVE (env->pr);
 836   SAVE (env->gbr);
 837   SAVE (env->vbr);
 838   SAVE (env->mach);
 839   SAVE (env->macl);
 840   SAVE (env->sr);
 841   SAVE (env->fpul);
 842   SAVE (env->fpscr);
 843   for (i = 0; i < 16; i++)
 844       SAVE(env->fregs[i + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
 845   SAVE (env->ssr);
 846   SAVE (env->spc);
 847   for (i = 0; i < 8; i++) SAVE(env->gregs[i]);
 848   for (i = 0; i < 8; i++) SAVE(env->gregs[i + 16]);
 849   return ((uint8_t *)ptr - mem_buf);
 850 }
 851
 852 static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
 853 {
 854   uint32_t *ptr = (uint32_t *)mem_buf;
 855   int i;
 856
 857 #define LOAD(x) (x)=*ptr++;
 858   if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
 859       for (i = 0; i < 8; i++) LOAD(env->gregs[i + 16]);
 860   } else {
 861       for (i = 0; i < 8; i++) LOAD(env->gregs[i]);
 862   }
 863   for (i = 8; i < 16; i++) LOAD(env->gregs[i]);
 864   LOAD (env->pc);
 865   LOAD (env->pr);
 866   LOAD (env->gbr);
 867   LOAD (env->vbr);
 868   LOAD (env->mach);
 869   LOAD (env->macl);
 870   LOAD (env->sr);
 871   LOAD (env->fpul);
 872   LOAD (env->fpscr);
 873   for (i = 0; i < 16; i++)
 874       LOAD(env->fregs[i + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
 875   LOAD (env->ssr);
 876   LOAD (env->spc);
 877   for (i = 0; i < 8; i++) LOAD(env->gregs[i]);
 878   for (i = 0; i < 8; i++) LOAD(env->gregs[i + 16]);
 879 }
 880 #elif defined (TARGET_CRIS)
 881
 882 static int cris_save_32 (unsigned char *d, uint32_t value)
 883 {
 884         *d++ = (value);
 885         *d++ = (value >>= 8);
 886         *d++ = (value >>= 8);
 887         *d++ = (value >>= 8);
 888         return 4;
 889 }
 890 static int cris_save_16 (unsigned char *d, uint32_t value)
 891 {
 892         *d++ = (value);
 893         *d++ = (value >>= 8);
 894         return 2;
 895 }
 896 static int cris_save_8 (unsigned char *d, uint32_t value)
 897 {
 898         *d++ = (value);
 899         return 1;
 900 }
 901
 902 /* FIXME: this will bug on archs not supporting unaligned word accesses.  */
 903 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
 904 {
 905   uint8_t *ptr = mem_buf;
 906   uint8_t srs;
 907   int i;
 908
 909   for (i = 0; i < 16; i++)
 910           ptr += cris_save_32 (ptr, env->regs[i]);
 911
 912   srs = env->pregs[PR_SRS];
 913
 914   ptr += cris_save_8 (ptr, env->pregs[0]);
 915   ptr += cris_save_8 (ptr, env->pregs[1]);
 916   ptr += cris_save_32 (ptr, env->pregs[2]);
 917   ptr += cris_save_8 (ptr, srs);
 918   ptr += cris_save_16 (ptr, env->pregs[4]);
 919
 920   for (i = 5; i < 16; i++)
 921           ptr += cris_save_32 (ptr, env->pregs[i]);
 922
 923   ptr += cris_save_32 (ptr, env->pc);
 924
 925   for (i = 0; i < 16; i++)
 926           ptr += cris_save_32 (ptr, env->sregs[srs][i]);
 927
 928   return ((uint8_t *)ptr - mem_buf);
 929 }
 930
 931 static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
 932 {
 933   uint32_t *ptr = (uint32_t *)mem_buf;
 934   int i;
 935
 936 #define LOAD(x) (x)=*ptr++;
 937   for (i = 0; i < 16; i++) LOAD(env->regs[i]);
 938   LOAD (env->pc);
 939 }
 940 #else
 941 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
 942 {
 943     return 0;
 944 }
 945
 946 static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
 947 {
 948 }
 949
 950 #endif
 951
 952 static int gdb_handle_packet(GDBState *s, CPUState *env, const char *line_buf)
 953 {
 954     const char *p;
 955     int ch, reg_size, type;
 956     char buf[4096];
 957     uint8_t mem_buf[4096];
 958     uint32_t *registers;
 959     target_ulong addr, len;
 960
 961 #ifdef DEBUG_GDB
 962     printf("command='%s'\n", line_buf);
 963 #endif
 964     p = line_buf;
 965     ch = *p++;
 966     switch(ch) {
 967     case '?':
 968         /* TODO: Make this return the correct value for user-mode.  */
 969         snprintf(buf, sizeof(buf), "S%02x", SIGTRAP);
 970         put_packet(s, buf);
 971         /* Remove all the breakpoints when this query is issued,
 972          * because gdb is doing and initial connect and the state
 973          * should be cleaned up.
 974          */
 975         cpu_breakpoint_remove_all(env);
 976         cpu_watchpoint_remove_all(env);
 977         break;
 978     case 'c':
 979         if (*p != '\0') {
 980             addr = strtoull(p, (char **)&p, 16);
 981 #if defined(TARGET_I386)
 982             env->eip = addr;
 983             kvm_load_registers(env);
 984 #elif defined (TARGET_PPC)
 985             env->nip = addr;
 986 #elif defined (TARGET_SPARC)
 987             env->pc = addr;
 988             env->npc = addr + 4;
 989 #elif defined (TARGET_ARM)
 990             env->regs[15] = addr;
 991 #elif defined (TARGET_SH4)
 992             env->pc = addr;
 993 #elif defined (TARGET_MIPS)
 994             env->PC[env->current_tc] = addr;
 995 #elif defined (TARGET_CRIS)
 996             env->pc = addr;
 997 #endif
 998         }
 999         gdb_continue(s);
1000         return RS_IDLE;
1001     case 'C':
1002         s->signal = strtoul(p, (char **)&p, 16);
1003         gdb_continue(s);
1004         return RS_IDLE;
1005     case 'k':
1006         /* Kill the target */
1007         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1008         exit(0);
1009     case 'D':
1010         /* Detach packet */
1011         cpu_breakpoint_remove_all(env);
1012         cpu_watchpoint_remove_all(env);
1013         gdb_continue(s);
1014         put_packet(s, "OK");
1015         break;
1016     case 's':
1017         if (*p != '\0') {
1018             addr = strtoull(p, (char **)&p, 16);
1019 #if defined(TARGET_I386)
1020             env->eip = addr;
1021             kvm_load_registers(env);
1022 #elif defined (TARGET_PPC)
1023             env->nip = addr;
1024 #elif defined (TARGET_SPARC)
1025             env->pc = addr;
1026             env->npc = addr + 4;
1027 #elif defined (TARGET_ARM)
1028             env->regs[15] = addr;
1029 #elif defined (TARGET_SH4)
1030             env->pc = addr;
1031 #elif defined (TARGET_MIPS)
1032             env->PC[env->current_tc] = addr;
1033 #elif defined (TARGET_CRIS)
1034             env->pc = addr;
1035 #endif
1036         }
1037         cpu_single_step(env, sstep_flags);
1038         gdb_continue(s);
1039         return RS_IDLE;
1040     case 'F':
1041         {
1042             target_ulong ret;
1043             target_ulong err;
1044
1045             ret = strtoull(p, (char **)&p, 16);
1046             if (*p == ',') {
1047                 p++;
1048                 err = strtoull(p, (char **)&p, 16);
1049             } else {
1050                 err = 0;
1051             }
1052             if (*p == ',')
1053                 p++;
1054             type = *p;
1055             if (gdb_current_syscall_cb)
1056                 gdb_current_syscall_cb(s->env, ret, err);
1057             if (type == 'C') {
1058                 put_packet(s, "T02");
1059             } else {
1060                 gdb_continue(s);
1061             }
1062         }
1063         break;
1064     case 'g':
1065         kvm_save_registers(env);
1066         reg_size = cpu_gdb_read_registers(env, mem_buf);
1067         memtohex(buf, mem_buf, reg_size);
1068         put_packet(s, buf);
1069         break;
1070     case 'G':
1071         registers = (void *)mem_buf;
1072         len = strlen(p) / 2;
1073         hextomem((uint8_t *)registers, p, len);
1074         cpu_gdb_write_registers(env, mem_buf, len);
1075         kvm_load_registers(env);
1076         put_packet(s, "OK");
1077         break;
1078     case 'm':
1079         addr = strtoull(p, (char **)&p, 16);
1080         if (*p == ',')
1081             p++;
1082         len = strtoull(p, NULL, 16);
1083         if (cpu_memory_rw_debug(env, addr, mem_buf, len, 0) != 0) {
1084             put_packet (s, "E14");
1085         } else {
1086             memtohex(buf, mem_buf, len);
1087             put_packet(s, buf);
1088         }
1089         break;
1090     case 'M':
1091         addr = strtoull(p, (char **)&p, 16);
1092         if (*p == ',')
1093             p++;
1094         len = strtoull(p, (char **)&p, 16);
1095         if (*p == ':')
1096             p++;
1097         hextomem(mem_buf, p, len);
1098         if (cpu_memory_rw_debug(env, addr, mem_buf, len, 1) != 0)
1099             put_packet(s, "E14");
1100         else
1101             put_packet(s, "OK");
1102         break;
1103     case 'Z':
1104         type = strtoul(p, (char **)&p, 16);
1105         if (*p == ',')
1106             p++;
1107         addr = strtoull(p, (char **)&p, 16);
1108         if (*p == ',')
1109             p++;
1110         len = strtoull(p, (char **)&p, 16);
1111         if (type == 0 || type == 1) {
1112             if (cpu_breakpoint_insert(env, addr) < 0)
1113                 goto breakpoint_error;
1114             put_packet(s, "OK");
1115 #ifndef CONFIG_USER_ONLY
1116         } else if (type == 2) {
1117             if (cpu_watchpoint_insert(env, addr) < 0)
1118                 goto breakpoint_error;
1119             put_packet(s, "OK");
1120 #endif
1121         } else {
1122         breakpoint_error:
1123             put_packet(s, "E22");
1124         }
1125         break;
1126     case 'z':
1127         type = strtoul(p, (char **)&p, 16);
1128         if (*p == ',')
1129             p++;
1130         addr = strtoull(p, (char **)&p, 16);
1131         if (*p == ',')
1132             p++;
1133         len = strtoull(p, (char **)&p, 16);
1134         if (type == 0 || type == 1) {
1135             cpu_breakpoint_remove(env, addr);
1136             put_packet(s, "OK");
1137 #ifndef CONFIG_USER_ONLY
1138         } else if (type == 2) {
1139             cpu_watchpoint_remove(env, addr);
1140             put_packet(s, "OK");
1141 #endif
1142         } else {
1143             goto breakpoint_error;
1144         }
1145         break;
1146     case 'q':
1147     case 'Q':
1148         /* parse any 'q' packets here */
1149         if (!strcmp(p,"qemu.sstepbits")) {
1150             /* Query Breakpoint bit definitions */
1151             sprintf(buf,"ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1152                     SSTEP_ENABLE,
1153                     SSTEP_NOIRQ,
1154                     SSTEP_NOTIMER);
1155             put_packet(s, buf);
1156             break;
1157         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1158             /* Display or change the sstep_flags */
1159             p += 10;
1160             if (*p != '=') {
1161                 /* Display current setting */
1162                 sprintf(buf,"0x%x", sstep_flags);
1163                 put_packet(s, buf);
1164                 break;
1165             }
1166             p++;
1167             type = strtoul(p, (char **)&p, 16);
1168             sstep_flags = type;
1169             put_packet(s, "OK");
1170             break;
1171         }
1172 #ifdef CONFIG_LINUX_USER
1173         else if (strncmp(p, "Offsets", 7) == 0) {
1174             TaskState *ts = env->opaque;
1175
1176             sprintf(buf,
1177                     "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1178                     ";Bss=" TARGET_ABI_FMT_lx,
1179                     ts->info->code_offset,
1180                     ts->info->data_offset,
1181                     ts->info->data_offset);
1182             put_packet(s, buf);
1183             break;
1184         }
1185 #endif
1186         /* Fall through.  */
1187     default:
1188         /* put empty packet */
1189         buf[0] = '\0';
1190         put_packet(s, buf);
1191         break;
1192     }
1193     return RS_IDLE;
1194 }
1195
1196 extern void tb_flush(CPUState *env);
1197
1198 #ifndef CONFIG_USER_ONLY
1199 static void gdb_vm_stopped(void *opaque, int reason)
1200 {
1201     GDBState *s = opaque;
1202     char buf[256];
1203     int ret;
1204
1205     if (s->state == RS_SYSCALL)
1206         return;
1207
1208     /* disable single step if it was enable */
1209     cpu_single_step(s->env, 0);
1210
1211     if (reason == EXCP_DEBUG) {
1212         if (s->env->watchpoint_hit) {
1213             snprintf(buf, sizeof(buf), "T%02xwatch:" TARGET_FMT_lx ";",
1214                      SIGTRAP,
1215                      s->env->watchpoint[s->env->watchpoint_hit - 1].vaddr);
1216             put_packet(s, buf);
1217             s->env->watchpoint_hit = 0;
1218             return;
1219         }
1220         tb_flush(s->env);
1221         ret = SIGTRAP;
1222     } else if (reason == EXCP_INTERRUPT) {
1223         ret = SIGINT;
1224     } else {
1225         ret = 0;
1226     }
1227     snprintf(buf, sizeof(buf), "S%02x", ret);
1228     put_packet(s, buf);
1229 }
1230 #endif
1231
1232 /* Send a gdb syscall request.
1233    This accepts limited printf-style format specifiers, specifically:
1234     %x  - target_ulong argument printed in hex.
1235     %lx - 64-bit argument printed in hex.
1236     %s  - string pointer (target_ulong) and length (int) pair.  */
1237 void gdb_do_syscall(gdb_syscall_complete_cb cb, char *fmt, ...)
1238 {
1239     va_list va;
1240     char buf[256];
1241     char *p;
1242     target_ulong addr;
1243     uint64_t i64;
1244     GDBState *s;
1245
1246     s = gdb_syscall_state;
1247     if (!s)
1248         return;
1249     gdb_current_syscall_cb = cb;
1250     s->state = RS_SYSCALL;
1251 #ifndef CONFIG_USER_ONLY
1252     vm_stop(EXCP_DEBUG);
1253 #endif
1254     s->state = RS_IDLE;
1255     va_start(va, fmt);
1256     p = buf;
1257     *(p++) = 'F';
1258     while (*fmt) {
1259         if (*fmt == '%') {
1260             fmt++;
1261             switch (*fmt++) {
1262             case 'x':
1263                 addr = va_arg(va, target_ulong);
1264                 p += sprintf(p, TARGET_FMT_lx, addr);
1265                 break;
1266             case 'l':
1267                 if (*(fmt++) != 'x')
1268                     goto bad_format;
1269                 i64 = va_arg(va, uint64_t);
1270                 p += sprintf(p, "%" PRIx64, i64);
1271                 break;
1272             case 's':
1273                 addr = va_arg(va, target_ulong);
1274                 p += sprintf(p, TARGET_FMT_lx "/%x", addr, va_arg(va, int));
1275                 break;
1276             default:
1277             bad_format:
1278                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
1279                         fmt - 1);
1280                 break;
1281             }
1282         } else {
1283             *(p++) = *(fmt++);
1284         }
1285     }
1286     *p = 0;
1287     va_end(va);
1288     put_packet(s, buf);
1289 #ifdef CONFIG_USER_ONLY
1290     gdb_handlesig(s->env, 0);
1291 #else
1292     cpu_interrupt(s->env, CPU_INTERRUPT_EXIT);
1293 #endif
1294 }
1295
1296 static void gdb_read_byte(GDBState *s, int ch)
1297 {
1298     CPUState *env = s->env;
1299     int i, csum;
1300     uint8_t reply;
1301
1302 #ifndef CONFIG_USER_ONLY
1303     if (s->last_packet_len) {
1304         /* Waiting for a response to the last packet.  If we see the start
1305            of a new command then abandon the previous response.  */
1306         if (ch == '-') {
1307 #ifdef DEBUG_GDB
1308             printf("Got NACK, retransmitting\n");
1309 #endif
1310             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
1311         }
1312 #ifdef DEBUG_GDB
1313         else if (ch == '+')
1314             printf("Got ACK\n");
1315         else
1316             printf("Got '%c' when expecting ACK/NACK\n", ch);
1317 #endif
1318         if (ch == '+' || ch == '$')
1319             s->last_packet_len = 0;
1320         if (ch != '$')
1321             return;
1322     }
1323     if (vm_running) {
1324         /* when the CPU is running, we cannot do anything except stop
1325            it when receiving a char */
1326         vm_stop(EXCP_INTERRUPT);
1327     } else
1328 #endif
1329     {
1330         switch(s->state) {
1331         case RS_IDLE:
1332             if (ch == '$') {
1333                 s->line_buf_index = 0;
1334                 s->state = RS_GETLINE;
1335             }
1336             break;
1337         case RS_GETLINE:
1338             if (ch == '#') {
1339             s->state = RS_CHKSUM1;
1340             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
1341                 s->state = RS_IDLE;
1342             } else {
1343             s->line_buf[s->line_buf_index++] = ch;
1344             }
1345             break;
1346         case RS_CHKSUM1:
1347             s->line_buf[s->line_buf_index] = '\0';
1348             s->line_csum = fromhex(ch) << 4;
1349             s->state = RS_CHKSUM2;
1350             break;
1351         case RS_CHKSUM2:
1352             s->line_csum |= fromhex(ch);
1353             csum = 0;
1354             for(i = 0; i < s->line_buf_index; i++) {
1355                 csum += s->line_buf[i];
1356             }
1357             if (s->line_csum != (csum & 0xff)) {
1358                 reply = '-';
1359                 put_buffer(s, &reply, 1);
1360                 s->state = RS_IDLE;
1361             } else {
1362                 reply = '+';
1363                 put_buffer(s, &reply, 1);
1364                 s->state = gdb_handle_packet(s, env, s->line_buf);
1365             }
1366             break;
1367         default:
1368             abort();
1369         }
1370     }
1371 }
1372
1373 #ifdef CONFIG_USER_ONLY
1374 int
1375 gdb_handlesig (CPUState *env, int sig)
1376 {
1377   GDBState *s;
1378   char buf[256];
1379   int n;
1380
1381   s = &gdbserver_state;
1382   if (gdbserver_fd < 0 || s->fd < 0)
1383     return sig;
1384
1385   /* disable single step if it was enabled */
1386   cpu_single_step(env, 0);
1387   tb_flush(env);
1388
1389   if (sig != 0)
1390     {
1391       snprintf(buf, sizeof(buf), "S%02x", sig);
1392       put_packet(s, buf);
1393     }
1394   /* put_packet() might have detected that the peer terminated the
1395      connection.  */
1396   if (s->fd < 0)
1397       return sig;
1398
1399   sig = 0;
1400   s->state = RS_IDLE;
1401   s->running_state = 0;
1402   while (s->running_state == 0) {
1403       n = read (s->fd, buf, 256);
1404       if (n > 0)
1405         {
1406           int i;
1407
1408           for (i = 0; i < n; i++)
1409             gdb_read_byte (s, buf[i]);
1410         }
1411       else if (n == 0 || errno != EAGAIN)
1412         {
1413           /* XXX: Connection closed.  Should probably wait for annother
1414              connection before continuing.  */
1415           return sig;
1416         }
1417   }
1418   sig = s->signal;
1419   s->signal = 0;
1420   return sig;
1421 }
1422
1423 /* Tell the remote gdb that the process has exited.  */
1424 void gdb_exit(CPUState *env, int code)
1425 {
1426   GDBState *s;
1427   char buf[4];
1428
1429   s = &gdbserver_state;
1430   if (gdbserver_fd < 0 || s->fd < 0)
1431     return;
1432
1433   snprintf(buf, sizeof(buf), "W%02x", code);
1434   put_packet(s, buf);
1435 }
1436
1437
1438 static void gdb_accept(void *opaque)
1439 {
1440     GDBState *s;
1441     struct sockaddr_in sockaddr;
1442     socklen_t len;
1443     int val, fd;
1444
1445     for(;;) {
1446         len = sizeof(sockaddr);
1447         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
1448         if (fd < 0 && errno != EINTR) {
1449             perror("accept");
1450             return;
1451         } else if (fd >= 0) {
1452             break;
1453         }
1454     }
1455
1456     /* set short latency */
1457     val = 1;
1458     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
1459
1460     s = &gdbserver_state;
1461     memset (s, 0, sizeof (GDBState));
1462     s->env = first_cpu; /* XXX: allow to change CPU */
1463     s->fd = fd;
1464
1465     gdb_syscall_state = s;
1466
1467     fcntl(fd, F_SETFL, O_NONBLOCK);
1468 }
1469
1470 static int gdbserver_open(int port)
1471 {
1472     struct sockaddr_in sockaddr;
1473     int fd, val, ret;
1474
1475     fd = socket(PF_INET, SOCK_STREAM, 0);
1476     if (fd < 0) {
1477         perror("socket");
1478         return -1;
1479     }
1480
1481     /* allow fast reuse */
1482     val = 1;
1483     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
1484
1485     sockaddr.sin_family = AF_INET;
1486     sockaddr.sin_port = htons(port);
1487     sockaddr.sin_addr.s_addr = 0;
1488     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
1489     if (ret < 0) {
1490         perror("bind");
1491         return -1;
1492     }
1493     ret = listen(fd, 0);
1494     if (ret < 0) {
1495         perror("listen");
1496         return -1;
1497     }
1498     return fd;
1499 }
1500
1501 int gdbserver_start(int port)
1502 {
1503     gdbserver_fd = gdbserver_open(port);
1504     if (gdbserver_fd < 0)
1505         return -1;
1506     /* accept connections */
1507     gdb_accept (NULL);
1508     return 0;
1509 }
1510 #else
1511 static int gdb_chr_can_receive(void *opaque)
1512 {
1513   return 1;
1514 }
1515
1516 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
1517 {
1518     GDBState *s = opaque;
1519     int i;
1520
1521     for (i = 0; i < size; i++) {
1522         gdb_read_byte(s, buf[i]);
1523     }
1524 }
1525
1526 static void gdb_chr_event(void *opaque, int event)
1527 {
1528     switch (event) {
1529     case CHR_EVENT_RESET:
1530         vm_stop(EXCP_INTERRUPT);
1531         gdb_syscall_state = opaque;
1532         break;
1533     default:
1534         break;
1535     }
1536 }
1537
1538 int gdbserver_start(const char *port)
1539 {
1540     GDBState *s;
1541     char gdbstub_port_name[128];
1542     int port_num;
1543     char *p;
1544     CharDriverState *chr;
1545
1546     if (!port || !*port)
1547       return -1;
1548
1549     port_num = strtol(port, &p, 10);
1550     if (*p == 0) {
1551         /* A numeric value is interpreted as a port number.  */
1552         snprintf(gdbstub_port_name, sizeof(gdbstub_port_name),
1553                  "tcp::%d,nowait,nodelay,server", port_num);
1554         port = gdbstub_port_name;
1555     }
1556
1557     chr = qemu_chr_open(port);
1558     if (!chr)
1559         return -1;
1560
1561     s = qemu_mallocz(sizeof(GDBState));
1562     if (!s) {
1563         return -1;
1564     }
1565     s->env = first_cpu; /* XXX: allow to change CPU */
1566     s->chr = chr;
1567     qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
1568                           gdb_chr_event, s);
1569     qemu_add_vm_stop_handler(gdb_vm_stopped, s);
1570     return 0;
1571 }
1572 #endif