gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20 #include "config.h"
  21 #include "qemu-common.h"
  22 #ifdef CONFIG_USER_ONLY
  23 #include <stdlib.h>
  24 #include <stdio.h>
  25 #include <stdarg.h>
  26 #include <string.h>
  27 #include <errno.h>
  28 #include <unistd.h>
  29 #include <fcntl.h>
  30
  31 #include "qemu.h"
  32 #else
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #endif
  37
  38 #define MAX_PACKET_LENGTH 4096
  39
  40 #include "qemu_socket.h"
  41
  42
  43 enum {
  44     GDB_SIGNAL_0 = 0,
  45     GDB_SIGNAL_INT = 2,
  46     GDB_SIGNAL_TRAP = 5,
  47     GDB_SIGNAL_UNKNOWN = 143
  48 };
  49
  50 #ifdef CONFIG_USER_ONLY
  51
  52 /* Map target signal numbers to GDB protocol signal numbers and vice
  53  * versa.  For user emulation's currently supported systems, we can
  54  * assume most signals are defined.
  55  */
  56
  57 static int gdb_signal_table[] = {
  58     0,
  59     TARGET_SIGHUP,
  60     TARGET_SIGINT,
  61     TARGET_SIGQUIT,
  62     TARGET_SIGILL,
  63     TARGET_SIGTRAP,
  64     TARGET_SIGABRT,
  65     -1, /* SIGEMT */
  66     TARGET_SIGFPE,
  67     TARGET_SIGKILL,
  68     TARGET_SIGBUS,
  69     TARGET_SIGSEGV,
  70     TARGET_SIGSYS,
  71     TARGET_SIGPIPE,
  72     TARGET_SIGALRM,
  73     TARGET_SIGTERM,
  74     TARGET_SIGURG,
  75     TARGET_SIGSTOP,
  76     TARGET_SIGTSTP,
  77     TARGET_SIGCONT,
  78     TARGET_SIGCHLD,
  79     TARGET_SIGTTIN,
  80     TARGET_SIGTTOU,
  81     TARGET_SIGIO,
  82     TARGET_SIGXCPU,
  83     TARGET_SIGXFSZ,
  84     TARGET_SIGVTALRM,
  85     TARGET_SIGPROF,
  86     TARGET_SIGWINCH,
  87     -1, /* SIGLOST */
  88     TARGET_SIGUSR1,
  89     TARGET_SIGUSR2,
  90     TARGET_SIGPWR,
  91     -1, /* SIGPOLL */
  92     -1,
  93     -1,
  94     -1,
  95     -1,
  96     -1,
  97     -1,
  98     -1,
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     __SIGRTMIN + 1,
 104     __SIGRTMIN + 2,
 105     __SIGRTMIN + 3,
 106     __SIGRTMIN + 4,
 107     __SIGRTMIN + 5,
 108     __SIGRTMIN + 6,
 109     __SIGRTMIN + 7,
 110     __SIGRTMIN + 8,
 111     __SIGRTMIN + 9,
 112     __SIGRTMIN + 10,
 113     __SIGRTMIN + 11,
 114     __SIGRTMIN + 12,
 115     __SIGRTMIN + 13,
 116     __SIGRTMIN + 14,
 117     __SIGRTMIN + 15,
 118     __SIGRTMIN + 16,
 119     __SIGRTMIN + 17,
 120     __SIGRTMIN + 18,
 121     __SIGRTMIN + 19,
 122     __SIGRTMIN + 20,
 123     __SIGRTMIN + 21,
 124     __SIGRTMIN + 22,
 125     __SIGRTMIN + 23,
 126     __SIGRTMIN + 24,
 127     __SIGRTMIN + 25,
 128     __SIGRTMIN + 26,
 129     __SIGRTMIN + 27,
 130     __SIGRTMIN + 28,
 131     __SIGRTMIN + 29,
 132     __SIGRTMIN + 30,
 133     __SIGRTMIN + 31,
 134     -1, /* SIGCANCEL */
 135     __SIGRTMIN,
 136     __SIGRTMIN + 32,
 137     __SIGRTMIN + 33,
 138     __SIGRTMIN + 34,
 139     __SIGRTMIN + 35,
 140     __SIGRTMIN + 36,
 141     __SIGRTMIN + 37,
 142     __SIGRTMIN + 38,
 143     __SIGRTMIN + 39,
 144     __SIGRTMIN + 40,
 145     __SIGRTMIN + 41,
 146     __SIGRTMIN + 42,
 147     __SIGRTMIN + 43,
 148     __SIGRTMIN + 44,
 149     __SIGRTMIN + 45,
 150     __SIGRTMIN + 46,
 151     __SIGRTMIN + 47,
 152     __SIGRTMIN + 48,
 153     __SIGRTMIN + 49,
 154     __SIGRTMIN + 50,
 155     __SIGRTMIN + 51,
 156     __SIGRTMIN + 52,
 157     __SIGRTMIN + 53,
 158     __SIGRTMIN + 54,
 159     __SIGRTMIN + 55,
 160     __SIGRTMIN + 56,
 161     __SIGRTMIN + 57,
 162     __SIGRTMIN + 58,
 163     __SIGRTMIN + 59,
 164     __SIGRTMIN + 60,
 165     __SIGRTMIN + 61,
 166     __SIGRTMIN + 62,
 167     __SIGRTMIN + 63,
 168     __SIGRTMIN + 64,
 169     __SIGRTMIN + 65,
 170     __SIGRTMIN + 66,
 171     __SIGRTMIN + 67,
 172     __SIGRTMIN + 68,
 173     __SIGRTMIN + 69,
 174     __SIGRTMIN + 70,
 175     __SIGRTMIN + 71,
 176     __SIGRTMIN + 72,
 177     __SIGRTMIN + 73,
 178     __SIGRTMIN + 74,
 179     __SIGRTMIN + 75,
 180     __SIGRTMIN + 76,
 181     __SIGRTMIN + 77,
 182     __SIGRTMIN + 78,
 183     __SIGRTMIN + 79,
 184     __SIGRTMIN + 80,
 185     __SIGRTMIN + 81,
 186     __SIGRTMIN + 82,
 187     __SIGRTMIN + 83,
 188     __SIGRTMIN + 84,
 189     __SIGRTMIN + 85,
 190     __SIGRTMIN + 86,
 191     __SIGRTMIN + 87,
 192     __SIGRTMIN + 88,
 193     __SIGRTMIN + 89,
 194     __SIGRTMIN + 90,
 195     __SIGRTMIN + 91,
 196     __SIGRTMIN + 92,
 197     __SIGRTMIN + 93,
 198     __SIGRTMIN + 94,
 199     __SIGRTMIN + 95,
 200     -1, /* SIGINFO */
 201     -1, /* UNKNOWN */
 202     -1, /* DEFAULT */
 203     -1,
 204     -1,
 205     -1,
 206     -1,
 207     -1,
 208     -1
 209 };
 210 #else
 211 /* In system mode we only need SIGINT and SIGTRAP; other signals
 212    are not yet supported.  */
 213
 214 enum {
 215     TARGET_SIGINT = 2,
 216     TARGET_SIGTRAP = 5
 217 };
 218
 219 static int gdb_signal_table[] = {
 220     -1,
 221     -1,
 222     TARGET_SIGINT,
 223     -1,
 224     -1,
 225     TARGET_SIGTRAP
 226 };
 227 #endif
 228
 229 #ifdef CONFIG_USER_ONLY
 230 static int target_signal_to_gdb (int sig)
 231 {
 232     int i;
 233     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 234         if (gdb_signal_table[i] == sig)
 235             return i;
 236     return GDB_SIGNAL_UNKNOWN;
 237 }
 238 #endif
 239
 240 static int gdb_signal_to_target (int sig)
 241 {
 242     if (sig < ARRAY_SIZE (gdb_signal_table))
 243         return gdb_signal_table[sig];
 244     else
 245         return -1;
 246 }
 247
 248 //#define DEBUG_GDB
 249
 250 typedef struct GDBRegisterState {
 251     int base_reg;
 252     int num_regs;
 253     gdb_reg_cb get_reg;
 254     gdb_reg_cb set_reg;
 255     const char *xml;
 256     struct GDBRegisterState *next;
 257 } GDBRegisterState;
 258
 259 enum RSState {
 260     RS_IDLE,
 261     RS_GETLINE,
 262     RS_CHKSUM1,
 263     RS_CHKSUM2,
 264     RS_SYSCALL,
 265 };
 266 typedef struct GDBState {
 267     CPUState *c_cpu; /* current CPU for step/continue ops */
 268     CPUState *g_cpu; /* current CPU for other ops */
 269     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 270     enum RSState state; /* parsing state */
 271     char line_buf[MAX_PACKET_LENGTH];
 272     int line_buf_index;
 273     int line_csum;
 274     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 275     int last_packet_len;
 276     int signal;
 277 #ifdef CONFIG_USER_ONLY
 278     int fd;
 279     int running_state;
 280 #else
 281     CharDriverState *chr;
 282 #endif
 283 } GDBState;
 284
 285 /* By default use no IRQs and no timers while single stepping so as to
 286  * make single stepping like an ICE HW step.
 287  */
 288 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 289
 290 static GDBState *gdbserver_state;
 291
 292 /* This is an ugly hack to cope with both new and old gdb.
 293    If gdb sends qXfer:features:read then assume we're talking to a newish
 294    gdb that understands target descriptions.  */
 295 static int gdb_has_xml;
 296
 297 #ifdef CONFIG_USER_ONLY
 298 /* XXX: This is not thread safe.  Do we care?  */
 299 static int gdbserver_fd = -1;
 300
 301 static int get_char(GDBState *s)
 302 {
 303     uint8_t ch;
 304     int ret;
 305
 306     for(;;) {
 307         ret = recv(s->fd, &ch, 1, 0);
 308         if (ret < 0) {
 309             if (errno == ECONNRESET)
 310                 s->fd = -1;
 311             if (errno != EINTR && errno != EAGAIN)
 312                 return -1;
 313         } else if (ret == 0) {
 314             close(s->fd);
 315             s->fd = -1;
 316             return -1;
 317         } else {
 318             break;
 319         }
 320     }
 321     return ch;
 322 }
 323 #endif
 324
 325 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 326
 327 enum {
 328     GDB_SYS_UNKNOWN,
 329     GDB_SYS_ENABLED,
 330     GDB_SYS_DISABLED,
 331 } gdb_syscall_mode;
 332
 333 /* If gdb is connected when the first semihosting syscall occurs then use
 334    remote gdb syscalls.  Otherwise use native file IO.  */
 335 int use_gdb_syscalls(void)
 336 {
 337     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 338         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 339                                             : GDB_SYS_DISABLED);
 340     }
 341     return gdb_syscall_mode == GDB_SYS_ENABLED;
 342 }
 343
 344 /* Resume execution.  */
 345 static inline void gdb_continue(GDBState *s)
 346 {
 347 #ifdef CONFIG_USER_ONLY
 348     s->running_state = 1;
 349 #else
 350     vm_start();
 351 #endif
 352 }
 353
 354 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 355 {
 356 #ifdef CONFIG_USER_ONLY
 357     int ret;
 358
 359     while (len > 0) {
 360         ret = send(s->fd, buf, len, 0);
 361         if (ret < 0) {
 362             if (errno != EINTR && errno != EAGAIN)
 363                 return;
 364         } else {
 365             buf += ret;
 366             len -= ret;
 367         }
 368     }
 369 #else
 370     qemu_chr_write(s->chr, buf, len);
 371 #endif
 372 }
 373
 374 static inline int fromhex(int v)
 375 {
 376     if (v >= '0' && v <= '9')
 377         return v - '0';
 378     else if (v >= 'A' && v <= 'F')
 379         return v - 'A' + 10;
 380     else if (v >= 'a' && v <= 'f')
 381         return v - 'a' + 10;
 382     else
 383         return 0;
 384 }
 385
 386 static inline int tohex(int v)
 387 {
 388     if (v < 10)
 389         return v + '0';
 390     else
 391         return v - 10 + 'a';
 392 }
 393
 394 static void memtohex(char *buf, const uint8_t *mem, int len)
 395 {
 396     int i, c;
 397     char *q;
 398     q = buf;
 399     for(i = 0; i < len; i++) {
 400         c = mem[i];
 401         *q++ = tohex(c >> 4);
 402         *q++ = tohex(c & 0xf);
 403     }
 404     *q = '\0';
 405 }
 406
 407 static void hextomem(uint8_t *mem, const char *buf, int len)
 408 {
 409     int i;
 410
 411     for(i = 0; i < len; i++) {
 412         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 413         buf += 2;
 414     }
 415 }
 416
 417 /* return -1 if error, 0 if OK */
 418 static int put_packet_binary(GDBState *s, const char *buf, int len)
 419 {
 420     int csum, i;
 421     uint8_t *p;
 422
 423     for(;;) {
 424         p = s->last_packet;
 425         *(p++) = '$';
 426         memcpy(p, buf, len);
 427         p += len;
 428         csum = 0;
 429         for(i = 0; i < len; i++) {
 430             csum += buf[i];
 431         }
 432         *(p++) = '#';
 433         *(p++) = tohex((csum >> 4) & 0xf);
 434         *(p++) = tohex((csum) & 0xf);
 435
 436         s->last_packet_len = p - s->last_packet;
 437         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 438
 439 #ifdef CONFIG_USER_ONLY
 440         i = get_char(s);
 441         if (i < 0)
 442             return -1;
 443         if (i == '+')
 444             break;
 445 #else
 446         break;
 447 #endif
 448     }
 449     return 0;
 450 }
 451
 452 /* return -1 if error, 0 if OK */
 453 static int put_packet(GDBState *s, const char *buf)
 454 {
 455 #ifdef DEBUG_GDB
 456     printf("reply='%s'\n", buf);
 457 #endif
 458
 459     return put_packet_binary(s, buf, strlen(buf));
 460 }
 461
 462 /* The GDB remote protocol transfers values in target byte order.  This means
 463    we can use the raw memory access routines to access the value buffer.
 464    Conveniently, these also handle the case where the buffer is mis-aligned.
 465  */
 466 #define GET_REG8(val) do { \
 467     stb_p(mem_buf, val); \
 468     return 1; \
 469     } while(0)
 470 #define GET_REG16(val) do { \
 471     stw_p(mem_buf, val); \
 472     return 2; \
 473     } while(0)
 474 #define GET_REG32(val) do { \
 475     stl_p(mem_buf, val); \
 476     return 4; \
 477     } while(0)
 478 #define GET_REG64(val) do { \
 479     stq_p(mem_buf, val); \
 480     return 8; \
 481     } while(0)
 482
 483 #if TARGET_LONG_BITS == 64
 484 #define GET_REGL(val) GET_REG64(val)
 485 #define ldtul_p(addr) ldq_p(addr)
 486 #else
 487 #define GET_REGL(val) GET_REG32(val)
 488 #define ldtul_p(addr) ldl_p(addr)
 489 #endif
 490
 491 #if defined(TARGET_I386)
 492
 493 #ifdef TARGET_X86_64
 494 static const int gpr_map[16] = {
 495     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 496     8, 9, 10, 11, 12, 13, 14, 15
 497 };
 498 #else
 499 static const int gpr_map[8] = {0, 1, 2, 3, 4, 5, 6, 7};
 500 #endif
 501
 502 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 503
 504 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 505 {
 506     if (n < CPU_NB_REGS) {
 507         GET_REGL(env->regs[gpr_map[n]]);
 508     } else if (n >= CPU_NB_REGS + 8 && n < CPU_NB_REGS + 16) {
 509         /* FIXME: byteswap float values.  */
 510 #ifdef USE_X86LDOUBLE
 511         memcpy(mem_buf, &env->fpregs[n - (CPU_NB_REGS + 8)], 10);
 512 #else
 513         memset(mem_buf, 0, 10);
 514 #endif
 515         return 10;
 516     } else if (n >= CPU_NB_REGS + 24) {
 517         n -= CPU_NB_REGS + 24;
 518         if (n < CPU_NB_REGS) {
 519             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 520             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 521             return 16;
 522         } else if (n == CPU_NB_REGS) {
 523             GET_REG32(env->mxcsr);
 524         }
 525     } else {
 526         n -= CPU_NB_REGS;
 527         switch (n) {
 528         case 0: GET_REGL(env->eip);
 529         case 1: GET_REG32(env->eflags);
 530         case 2: GET_REG32(env->segs[R_CS].selector);
 531         case 3: GET_REG32(env->segs[R_SS].selector);
 532         case 4: GET_REG32(env->segs[R_DS].selector);
 533         case 5: GET_REG32(env->segs[R_ES].selector);
 534         case 6: GET_REG32(env->segs[R_FS].selector);
 535         case 7: GET_REG32(env->segs[R_GS].selector);
 536         /* 8...15 x87 regs.  */
 537         case 16: GET_REG32(env->fpuc);
 538         case 17: GET_REG32((env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11);
 539         case 18: GET_REG32(0); /* ftag */
 540         case 19: GET_REG32(0); /* fiseg */
 541         case 20: GET_REG32(0); /* fioff */
 542         case 21: GET_REG32(0); /* foseg */
 543         case 22: GET_REG32(0); /* fooff */
 544         case 23: GET_REG32(0); /* fop */
 545         /* 24+ xmm regs.  */
 546         }
 547     }
 548     return 0;
 549 }
 550
 551 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int i)
 552 {
 553     uint32_t tmp;
 554
 555     if (i < CPU_NB_REGS) {
 556         env->regs[gpr_map[i]] = ldtul_p(mem_buf);
 557         return sizeof(target_ulong);
 558     } else if (i >= CPU_NB_REGS + 8 && i < CPU_NB_REGS + 16) {
 559         i -= CPU_NB_REGS + 8;
 560 #ifdef USE_X86LDOUBLE
 561         memcpy(&env->fpregs[i], mem_buf, 10);
 562 #endif
 563         return 10;
 564     } else if (i >= CPU_NB_REGS + 24) {
 565         i -= CPU_NB_REGS + 24;
 566         if (i < CPU_NB_REGS) {
 567             env->xmm_regs[i].XMM_Q(0) = ldq_p(mem_buf);
 568             env->xmm_regs[i].XMM_Q(1) = ldq_p(mem_buf + 8);
 569             return 16;
 570         } else if (i == CPU_NB_REGS) {
 571             env->mxcsr = ldl_p(mem_buf);
 572             return 4;
 573         }
 574     } else {
 575         i -= CPU_NB_REGS;
 576         switch (i) {
 577         case 0: env->eip = ldtul_p(mem_buf); return sizeof(target_ulong);
 578         case 1: env->eflags = ldl_p(mem_buf); return 4;
 579 #if defined(CONFIG_USER_ONLY)
 580 #define LOAD_SEG(index, sreg)\
 581             tmp = ldl_p(mem_buf);\
 582             if (tmp != env->segs[sreg].selector)\
 583                 cpu_x86_load_seg(env, sreg, tmp);
 584 #else
 585 /* FIXME: Honor segment registers.  Needs to avoid raising an exception
 586    when the selector is invalid.  */
 587 #define LOAD_SEG(index, sreg) do {} while(0)
 588 #endif
 589         case 2: LOAD_SEG(10, R_CS); return 4;
 590         case 3: LOAD_SEG(11, R_SS); return 4;
 591         case 4: LOAD_SEG(12, R_DS); return 4;
 592         case 5: LOAD_SEG(13, R_ES); return 4;
 593         case 6: LOAD_SEG(14, R_FS); return 4;
 594         case 7: LOAD_SEG(15, R_GS); return 4;
 595         /* 8...15 x87 regs.  */
 596         case 16: env->fpuc = ldl_p(mem_buf); return 4;
 597         case 17:
 598                  tmp = ldl_p(mem_buf);
 599                  env->fpstt = (tmp >> 11) & 7;
 600                  env->fpus = tmp & ~0x3800;
 601                  return 4;
 602         case 18: /* ftag */ return 4;
 603         case 19: /* fiseg */ return 4;
 604         case 20: /* fioff */ return 4;
 605         case 21: /* foseg */ return 4;
 606         case 22: /* fooff */ return 4;
 607         case 23: /* fop */ return 4;
 608         /* 24+ xmm regs.  */
 609         }
 610     }
 611     /* Unrecognised register.  */
 612     return 0;
 613 }
 614
 615 #elif defined (TARGET_PPC)
 616
 617 #define NUM_CORE_REGS 71
 618
 619 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 620 {
 621     if (n < 32) {
 622         /* gprs */
 623         GET_REGL(env->gpr[n]);
 624     } else if (n < 64) {
 625         /* fprs */
 626         stfq_p(mem_buf, env->fpr[n-32]);
 627         return 8;
 628     } else {
 629         switch (n) {
 630         case 64: GET_REGL(env->nip);
 631         case 65: GET_REGL(env->msr);
 632         case 66:
 633             {
 634                 uint32_t cr = 0;
 635                 int i;
 636                 for (i = 0; i < 8; i++)
 637                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 638                 GET_REG32(cr);
 639             }
 640         case 67: GET_REGL(env->lr);
 641         case 68: GET_REGL(env->ctr);
 642         case 69: GET_REGL(env->xer);
 643         case 70: GET_REG32(0); /* fpscr */
 644         }
 645     }
 646     return 0;
 647 }
 648
 649 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 650 {
 651     if (n < 32) {
 652         /* gprs */
 653         env->gpr[n] = ldtul_p(mem_buf);
 654         return sizeof(target_ulong);
 655     } else if (n < 64) {
 656         /* fprs */
 657         env->fpr[n-32] = ldfq_p(mem_buf);
 658         return 8;
 659     } else {
 660         switch (n) {
 661         case 64:
 662             env->nip = ldtul_p(mem_buf);
 663             return sizeof(target_ulong);
 664         case 65:
 665             ppc_store_msr(env, ldtul_p(mem_buf));
 666             return sizeof(target_ulong);
 667         case 66:
 668             {
 669                 uint32_t cr = ldl_p(mem_buf);
 670                 int i;
 671                 for (i = 0; i < 8; i++)
 672                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 673                 return 4;
 674             }
 675         case 67:
 676             env->lr = ldtul_p(mem_buf);
 677             return sizeof(target_ulong);
 678         case 68:
 679             env->ctr = ldtul_p(mem_buf);
 680             return sizeof(target_ulong);
 681         case 69:
 682             env->xer = ldtul_p(mem_buf);
 683             return sizeof(target_ulong);
 684         case 70:
 685             /* fpscr */
 686             return 4;
 687         }
 688     }
 689     return 0;
 690 }
 691
 692 #elif defined (TARGET_SPARC)
 693
 694 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 695 #define NUM_CORE_REGS 86
 696 #else
 697 #define NUM_CORE_REGS 73
 698 #endif
 699
 700 #ifdef TARGET_ABI32
 701 #define GET_REGA(val) GET_REG32(val)
 702 #else
 703 #define GET_REGA(val) GET_REGL(val)
 704 #endif
 705
 706 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 707 {
 708     if (n < 8) {
 709         /* g0..g7 */
 710         GET_REGA(env->gregs[n]);
 711     }
 712     if (n < 32) {
 713         /* register window */
 714         GET_REGA(env->regwptr[n - 8]);
 715     }
 716 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 717     if (n < 64) {
 718         /* fprs */
 719         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 720     }
 721     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 722     switch (n) {
 723     case 64: GET_REGA(env->y);
 724     case 65: GET_REGA(GET_PSR(env));
 725     case 66: GET_REGA(env->wim);
 726     case 67: GET_REGA(env->tbr);
 727     case 68: GET_REGA(env->pc);
 728     case 69: GET_REGA(env->npc);
 729     case 70: GET_REGA(env->fsr);
 730     case 71: GET_REGA(0); /* csr */
 731     case 72: GET_REGA(0);
 732     }
 733 #else
 734     if (n < 64) {
 735         /* f0-f31 */
 736         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 737     }
 738     if (n < 80) {
 739         /* f32-f62 (double width, even numbers only) */
 740         uint64_t val;
 741
 742         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 743         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 744         GET_REG64(val);
 745     }
 746     switch (n) {
 747     case 80: GET_REGL(env->pc);
 748     case 81: GET_REGL(env->npc);
 749     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 750                            ((env->asi & 0xff) << 24) |
 751                            ((env->pstate & 0xfff) << 8) |
 752                            GET_CWP64(env));
 753     case 83: GET_REGL(env->fsr);
 754     case 84: GET_REGL(env->fprs);
 755     case 85: GET_REGL(env->y);
 756     }
 757 #endif
 758     return 0;
 759 }
 760
 761 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 762 {
 763 #if defined(TARGET_ABI32)
 764     abi_ulong tmp;
 765
 766     tmp = ldl_p(mem_buf);
 767 #else
 768     target_ulong tmp;
 769
 770     tmp = ldtul_p(mem_buf);
 771 #endif
 772
 773     if (n < 8) {
 774         /* g0..g7 */
 775         env->gregs[n] = tmp;
 776     } else if (n < 32) {
 777         /* register window */
 778         env->regwptr[n - 8] = tmp;
 779     }
 780 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 781     else if (n < 64) {
 782         /* fprs */
 783         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 784     } else {
 785         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 786         switch (n) {
 787         case 64: env->y = tmp; break;
 788         case 65: PUT_PSR(env, tmp); break;
 789         case 66: env->wim = tmp; break;
 790         case 67: env->tbr = tmp; break;
 791         case 68: env->pc = tmp; break;
 792         case 69: env->npc = tmp; break;
 793         case 70: env->fsr = tmp; break;
 794         default: return 0;
 795         }
 796     }
 797     return 4;
 798 #else
 799     else if (n < 64) {
 800         /* f0-f31 */
 801         env->fpr[n] = ldfl_p(mem_buf);
 802         return 4;
 803     } else if (n < 80) {
 804         /* f32-f62 (double width, even numbers only) */
 805         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 806         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 807     } else {
 808         switch (n) {
 809         case 80: env->pc = tmp; break;
 810         case 81: env->npc = tmp; break;
 811         case 82:
 812             PUT_CCR(env, tmp >> 32);
 813             env->asi = (tmp >> 24) & 0xff;
 814             env->pstate = (tmp >> 8) & 0xfff;
 815             PUT_CWP64(env, tmp & 0xff);
 816             break;
 817         case 83: env->fsr = tmp; break;
 818         case 84: env->fprs = tmp; break;
 819         case 85: env->y = tmp; break;
 820         default: return 0;
 821         }
 822     }
 823     return 8;
 824 #endif
 825 }
 826 #elif defined (TARGET_ARM)
 827
 828 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 829    whatever the target description contains.  Due to a historical mishap
 830    the FPA registers appear in between core integer regs and the CPSR.
 831    We hack round this by giving the FPA regs zero size when talking to a
 832    newer gdb.  */
 833 #define NUM_CORE_REGS 26
 834 #define GDB_CORE_XML "arm-core.xml"
 835
 836 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 837 {
 838     if (n < 16) {
 839         /* Core integer register.  */
 840         GET_REG32(env->regs[n]);
 841     }
 842     if (n < 24) {
 843         /* FPA registers.  */
 844         if (gdb_has_xml)
 845             return 0;
 846         memset(mem_buf, 0, 12);
 847         return 12;
 848     }
 849     switch (n) {
 850     case 24:
 851         /* FPA status register.  */
 852         if (gdb_has_xml)
 853             return 0;
 854         GET_REG32(0);
 855     case 25:
 856         /* CPSR */
 857         GET_REG32(cpsr_read(env));
 858     }
 859     /* Unknown register.  */
 860     return 0;
 861 }
 862
 863 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 864 {
 865     uint32_t tmp;
 866
 867     tmp = ldl_p(mem_buf);
 868
 869     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 870        cause problems if we ever implement the Jazelle DBX extensions.  */
 871     if (n == 15)
 872         tmp &= ~1;
 873
 874     if (n < 16) {
 875         /* Core integer register.  */
 876         env->regs[n] = tmp;
 877         return 4;
 878     }
 879     if (n < 24) { /* 16-23 */
 880         /* FPA registers (ignored).  */
 881         if (gdb_has_xml)
 882             return 0;
 883         return 12;
 884     }
 885     switch (n) {
 886     case 24:
 887         /* FPA status register (ignored).  */
 888         if (gdb_has_xml)
 889             return 0;
 890         return 4;
 891     case 25:
 892         /* CPSR */
 893         cpsr_write (env, tmp, 0xffffffff);
 894         return 4;
 895     }
 896     /* Unknown register.  */
 897     return 0;
 898 }
 899
 900 #elif defined (TARGET_M68K)
 901
 902 #define NUM_CORE_REGS 18
 903
 904 #define GDB_CORE_XML "cf-core.xml"
 905
 906 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 907 {
 908     if (n < 8) {
 909         /* D0-D7 */
 910         GET_REG32(env->dregs[n]);
 911     } else if (n < 16) {
 912         /* A0-A7 */
 913         GET_REG32(env->aregs[n - 8]);
 914     } else {
 915         switch (n) {
 916         case 16: GET_REG32(env->sr);
 917         case 17: GET_REG32(env->pc);
 918         }
 919     }
 920     /* FP registers not included here because they vary between
 921        ColdFire and m68k.  Use XML bits for these.  */
 922     return 0;
 923 }
 924
 925 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 926 {
 927     uint32_t tmp;
 928
 929     tmp = ldl_p(mem_buf);
 930
 931     if (n < 8) {
 932         /* D0-D7 */
 933         env->dregs[n] = tmp;
 934     } else if (n < 8) {
 935         /* A0-A7 */
 936         env->aregs[n - 8] = tmp;
 937     } else {
 938         switch (n) {
 939         case 16: env->sr = tmp; break;
 940         case 17: env->pc = tmp; break;
 941         default: return 0;
 942         }
 943     }
 944     return 4;
 945 }
 946 #elif defined (TARGET_MIPS)
 947
 948 #define NUM_CORE_REGS 73
 949
 950 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 951 {
 952     if (n < 32) {
 953         GET_REGL(env->active_tc.gpr[n]);
 954     }
 955     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
 956         if (n >= 38 && n < 70) {
 957             if (env->CP0_Status & (1 << CP0St_FR))
 958                 GET_REGL(env->active_fpu.fpr[n - 38].d);
 959             else
 960                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
 961         }
 962         switch (n) {
 963         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
 964         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
 965         }
 966     }
 967     switch (n) {
 968     case 32: GET_REGL((int32_t)env->CP0_Status);
 969     case 33: GET_REGL(env->active_tc.LO[0]);
 970     case 34: GET_REGL(env->active_tc.HI[0]);
 971     case 35: GET_REGL(env->CP0_BadVAddr);
 972     case 36: GET_REGL((int32_t)env->CP0_Cause);
 973     case 37: GET_REGL(env->active_tc.PC);
 974     case 72: GET_REGL(0); /* fp */
 975     case 89: GET_REGL((int32_t)env->CP0_PRid);
 976     }
 977     if (n >= 73 && n <= 88) {
 978         /* 16 embedded regs.  */
 979         GET_REGL(0);
 980     }
 981
 982     return 0;
 983 }
 984
 985 /* convert MIPS rounding mode in FCR31 to IEEE library */
 986 static unsigned int ieee_rm[] =
 987   {
 988     float_round_nearest_even,
 989     float_round_to_zero,
 990     float_round_up,
 991     float_round_down
 992   };
 993 #define RESTORE_ROUNDING_MODE \
 994     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
 995
 996 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 997 {
 998     target_ulong tmp;
 999
1000     tmp = ldtul_p(mem_buf);
1001
1002     if (n < 32) {
1003         env->active_tc.gpr[n] = tmp;
1004         return sizeof(target_ulong);
1005     }
1006     if (env->CP0_Config1 & (1 << CP0C1_FP)
1007             && n >= 38 && n < 73) {
1008         if (n < 70) {
1009             if (env->CP0_Status & (1 << CP0St_FR))
1010               env->active_fpu.fpr[n - 38].d = tmp;
1011             else
1012               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1013         }
1014         switch (n) {
1015         case 70:
1016             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1017             /* set rounding mode */
1018             RESTORE_ROUNDING_MODE;
1019 #ifndef CONFIG_SOFTFLOAT
1020             /* no floating point exception for native float */
1021             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1022 #endif
1023             break;
1024         case 71: env->active_fpu.fcr0 = tmp; break;
1025         }
1026         return sizeof(target_ulong);
1027     }
1028     switch (n) {
1029     case 32: env->CP0_Status = tmp; break;
1030     case 33: env->active_tc.LO[0] = tmp; break;
1031     case 34: env->active_tc.HI[0] = tmp; break;
1032     case 35: env->CP0_BadVAddr = tmp; break;
1033     case 36: env->CP0_Cause = tmp; break;
1034     case 37: env->active_tc.PC = tmp; break;
1035     case 72: /* fp, ignored */ break;
1036     default:
1037         if (n > 89)
1038             return 0;
1039         /* Other registers are readonly.  Ignore writes.  */
1040         break;
1041     }
1042
1043     return sizeof(target_ulong);
1044 }
1045 #elif defined (TARGET_SH4)
1046
1047 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1048 /* FIXME: We should use XML for this.  */
1049
1050 #define NUM_CORE_REGS 59
1051
1052 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1053 {
1054     if (n < 8) {
1055         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1056             GET_REGL(env->gregs[n + 16]);
1057         } else {
1058             GET_REGL(env->gregs[n]);
1059         }
1060     } else if (n < 16) {
1061         GET_REGL(env->gregs[n - 8]);
1062     } else if (n >= 25 && n < 41) {
1063         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1064     } else if (n >= 43 && n < 51) {
1065         GET_REGL(env->gregs[n - 43]);
1066     } else if (n >= 51 && n < 59) {
1067         GET_REGL(env->gregs[n - (51 - 16)]);
1068     }
1069     switch (n) {
1070     case 16: GET_REGL(env->pc);
1071     case 17: GET_REGL(env->pr);
1072     case 18: GET_REGL(env->gbr);
1073     case 19: GET_REGL(env->vbr);
1074     case 20: GET_REGL(env->mach);
1075     case 21: GET_REGL(env->macl);
1076     case 22: GET_REGL(env->sr);
1077     case 23: GET_REGL(env->fpul);
1078     case 24: GET_REGL(env->fpscr);
1079     case 41: GET_REGL(env->ssr);
1080     case 42: GET_REGL(env->spc);
1081     }
1082
1083     return 0;
1084 }
1085
1086 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1087 {
1088     uint32_t tmp;
1089
1090     tmp = ldl_p(mem_buf);
1091
1092     if (n < 8) {
1093         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1094             env->gregs[n + 16] = tmp;
1095         } else {
1096             env->gregs[n] = tmp;
1097         }
1098         return 4;
1099     } else if (n < 16) {
1100         env->gregs[n - 8] = tmp;
1101         return 4;
1102     } else if (n >= 25 && n < 41) {
1103         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1104     } else if (n >= 43 && n < 51) {
1105         env->gregs[n - 43] = tmp;
1106         return 4;
1107     } else if (n >= 51 && n < 59) {
1108         env->gregs[n - (51 - 16)] = tmp;
1109         return 4;
1110     }
1111     switch (n) {
1112     case 16: env->pc = tmp;
1113     case 17: env->pr = tmp;
1114     case 18: env->gbr = tmp;
1115     case 19: env->vbr = tmp;
1116     case 20: env->mach = tmp;
1117     case 21: env->macl = tmp;
1118     case 22: env->sr = tmp;
1119     case 23: env->fpul = tmp;
1120     case 24: env->fpscr = tmp;
1121     case 41: env->ssr = tmp;
1122     case 42: env->spc = tmp;
1123     default: return 0;
1124     }
1125
1126     return 4;
1127 }
1128 #elif defined (TARGET_CRIS)
1129
1130 #define NUM_CORE_REGS 49
1131
1132 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1133 {
1134     uint8_t srs;
1135
1136     srs = env->pregs[PR_SRS];
1137     if (n < 16) {
1138         GET_REG32(env->regs[n]);
1139     }
1140
1141     if (n >= 21 && n < 32) {
1142         GET_REG32(env->pregs[n - 16]);
1143     }
1144     if (n >= 33 && n < 49) {
1145         GET_REG32(env->sregs[srs][n - 33]);
1146     }
1147     switch (n) {
1148     case 16: GET_REG8(env->pregs[0]);
1149     case 17: GET_REG8(env->pregs[1]);
1150     case 18: GET_REG32(env->pregs[2]);
1151     case 19: GET_REG8(srs);
1152     case 20: GET_REG16(env->pregs[4]);
1153     case 32: GET_REG32(env->pc);
1154     }
1155
1156     return 0;
1157 }
1158
1159 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1160 {
1161     uint32_t tmp;
1162
1163     if (n > 49)
1164         return 0;
1165
1166     tmp = ldl_p(mem_buf);
1167
1168     if (n < 16) {
1169         env->regs[n] = tmp;
1170     }
1171
1172     if (n >= 21 && n < 32) {
1173         env->pregs[n - 16] = tmp;
1174     }
1175
1176     /* FIXME: Should support function regs be writable?  */
1177     switch (n) {
1178     case 16: return 1;
1179     case 17: return 1;
1180     case 18: env->pregs[PR_PID] = tmp; break;
1181     case 19: return 1;
1182     case 20: return 2;
1183     case 32: env->pc = tmp; break;
1184     }
1185
1186     return 4;
1187 }
1188 #elif defined (TARGET_ALPHA)
1189
1190 #define NUM_CORE_REGS 65
1191
1192 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1193 {
1194     if (n < 31) {
1195        GET_REGL(env->ir[n]);
1196     }
1197     else if (n == 31) {
1198        GET_REGL(0);
1199     }
1200     else if (n<63) {
1201        uint64_t val;
1202
1203        val=*((uint64_t *)&env->fir[n-32]);
1204        GET_REGL(val);
1205     }
1206     else if (n==63) {
1207        GET_REGL(env->fpcr);
1208     }
1209     else if (n==64) {
1210        GET_REGL(env->pc);
1211     }
1212     else {
1213        GET_REGL(0);
1214     }
1215
1216     return 0;
1217 }
1218
1219 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1220 {
1221     target_ulong tmp;
1222     tmp = ldtul_p(mem_buf);
1223
1224     if (n < 31) {
1225         env->ir[n] = tmp;
1226     }
1227
1228     if (n > 31 && n < 63) {
1229         env->fir[n - 32] = ldfl_p(mem_buf);
1230     }
1231
1232     if (n == 64 ) {
1233        env->pc=tmp;
1234     }
1235
1236     return 8;
1237 }
1238 #else
1239
1240 #define NUM_CORE_REGS 0
1241
1242 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1243 {
1244     return 0;
1245 }
1246
1247 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1248 {
1249     return 0;
1250 }
1251
1252 #endif
1253
1254 static int num_g_regs = NUM_CORE_REGS;
1255
1256 #ifdef GDB_CORE_XML
1257 /* Encode data using the encoding for 'x' packets.  */
1258 static int memtox(char *buf, const char *mem, int len)
1259 {
1260     char *p = buf;
1261     char c;
1262
1263     while (len--) {
1264         c = *(mem++);
1265         switch (c) {
1266         case '#': case '$': case '*': case '}':
1267             *(p++) = '}';
1268             *(p++) = c ^ 0x20;
1269             break;
1270         default:
1271             *(p++) = c;
1272             break;
1273         }
1274     }
1275     return p - buf;
1276 }
1277
1278 static const char *get_feature_xml(const char *p, const char **newp)
1279 {
1280     extern const char *const xml_builtin[][2];
1281     size_t len;
1282     int i;
1283     const char *name;
1284     static char target_xml[1024];
1285
1286     len = 0;
1287     while (p[len] && p[len] != ':')
1288         len++;
1289     *newp = p + len;
1290
1291     name = NULL;
1292     if (strncmp(p, "target.xml", len) == 0) {
1293         /* Generate the XML description for this CPU.  */
1294         if (!target_xml[0]) {
1295             GDBRegisterState *r;
1296
1297             snprintf(target_xml, sizeof(target_xml),
1298                      "<?xml version=\"1.0\"?>"
1299                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1300                      "<target>"
1301                      "<xi:include href=\"%s\"/>",
1302                      GDB_CORE_XML);
1303
1304             for (r = first_cpu->gdb_regs; r; r = r->next) {
1305                 strcat(target_xml, "<xi:include href=\"");
1306                 strcat(target_xml, r->xml);
1307                 strcat(target_xml, "\"/>");
1308             }
1309             strcat(target_xml, "</target>");
1310         }
1311         return target_xml;
1312     }
1313     for (i = 0; ; i++) {
1314         name = xml_builtin[i][0];
1315         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1316             break;
1317     }
1318     return name ? xml_builtin[i][1] : NULL;
1319 }
1320 #if 0
1321 /* #elif defined(TARGET_Z80) */
1322 /* Z80 FIXME Z80 TODO Z80 */
1323 /* GDB doesn't define this yet */
1324 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
1325 {
1326     uint32_t *registers = (uint32_t *)mem_buf;
1327     int i, fpus;
1328
1329     for(i = 0; i < 8; i++) {
1330         registers[i] = env->regs[i];
1331     }
1332     registers[8] = env->pc;
1333     registers[9] = env->imode;
1334
1335     return 10 * 4;
1336 }
1337
1338 static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
1339 {
1340     uint32_t *registers = (uint32_t *)mem_buf;
1341     int i;
1342
1343     for(i = 0; i < 8; i++) {
1344         env->regs[i] = tswapl(registers[i]);
1345     }
1346     env->pc = tswapl(registers[8]);
1347     env->imode = tswapl(registers[9]);
1348 }
1349 #endif
1350 #endif
1351
1352 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1353 {
1354     GDBRegisterState *r;
1355
1356     if (reg < NUM_CORE_REGS)
1357         return cpu_gdb_read_register(env, mem_buf, reg);
1358
1359     for (r = env->gdb_regs; r; r = r->next) {
1360         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1361             return r->get_reg(env, mem_buf, reg - r->base_reg);
1362         }
1363     }
1364     return 0;
1365 }
1366
1367 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1368 {
1369     GDBRegisterState *r;
1370
1371     if (reg < NUM_CORE_REGS)
1372         return cpu_gdb_write_register(env, mem_buf, reg);
1373
1374     for (r = env->gdb_regs; r; r = r->next) {
1375         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1376             return r->set_reg(env, mem_buf, reg - r->base_reg);
1377         }
1378     }
1379     return 0;
1380 }
1381
1382 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1383    specifies the first register number and these registers are included in
1384    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1385    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1386  */
1387
1388 void gdb_register_coprocessor(CPUState * env,
1389                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1390                              int num_regs, const char *xml, int g_pos)
1391 {
1392     GDBRegisterState *s;
1393     GDBRegisterState **p;
1394     static int last_reg = NUM_CORE_REGS;
1395
1396     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1397     s->base_reg = last_reg;
1398     s->num_regs = num_regs;
1399     s->get_reg = get_reg;
1400     s->set_reg = set_reg;
1401     s->xml = xml;
1402     p = &env->gdb_regs;
1403     while (*p) {
1404         /* Check for duplicates.  */
1405         if (strcmp((*p)->xml, xml) == 0)
1406             return;
1407         p = &(*p)->next;
1408     }
1409     /* Add to end of list.  */
1410     last_reg += num_regs;
1411     *p = s;
1412     if (g_pos) {
1413         if (g_pos != s->base_reg) {
1414             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1415                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1416         } else {
1417             num_g_regs = last_reg;
1418         }
1419     }
1420 }
1421
1422 /* GDB breakpoint/watchpoint types */
1423 #define GDB_BREAKPOINT_SW        0
1424 #define GDB_BREAKPOINT_HW        1
1425 #define GDB_WATCHPOINT_WRITE     2
1426 #define GDB_WATCHPOINT_READ      3
1427 #define GDB_WATCHPOINT_ACCESS    4
1428
1429 #ifndef CONFIG_USER_ONLY
1430 static const int xlat_gdb_type[] = {
1431     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1432     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1433     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1434 };
1435 #endif
1436
1437 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1438 {
1439     CPUState *env;
1440     int err = 0;
1441
1442     switch (type) {
1443     case GDB_BREAKPOINT_SW:
1444     case GDB_BREAKPOINT_HW:
1445         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1446             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1447             if (err)
1448                 break;
1449         }
1450         return err;
1451 #ifndef CONFIG_USER_ONLY
1452     case GDB_WATCHPOINT_WRITE:
1453     case GDB_WATCHPOINT_READ:
1454     case GDB_WATCHPOINT_ACCESS:
1455         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1456             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1457                                         NULL);
1458             if (err)
1459                 break;
1460         }
1461         return err;
1462 #endif
1463     default:
1464         return -ENOSYS;
1465     }
1466 }
1467
1468 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1469 {
1470     CPUState *env;
1471     int err = 0;
1472
1473     switch (type) {
1474     case GDB_BREAKPOINT_SW:
1475     case GDB_BREAKPOINT_HW:
1476         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1477             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1478             if (err)
1479                 break;
1480         }
1481         return err;
1482 #ifndef CONFIG_USER_ONLY
1483     case GDB_WATCHPOINT_WRITE:
1484     case GDB_WATCHPOINT_READ:
1485     case GDB_WATCHPOINT_ACCESS:
1486         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1487             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1488             if (err)
1489                 break;
1490         }
1491         return err;
1492 #endif
1493     default:
1494         return -ENOSYS;
1495     }
1496 }
1497
1498 static void gdb_breakpoint_remove_all(void)
1499 {
1500     CPUState *env;
1501
1502     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1503         cpu_breakpoint_remove_all(env, BP_GDB);
1504 #ifndef CONFIG_USER_ONLY
1505         cpu_watchpoint_remove_all(env, BP_GDB);
1506 #endif
1507     }
1508 }
1509
1510 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1511 {
1512     CPUState *env;
1513     const char *p;
1514     int ch, reg_size, type, res, thread;
1515     char buf[MAX_PACKET_LENGTH];
1516     uint8_t mem_buf[MAX_PACKET_LENGTH];
1517     uint8_t *registers;
1518     target_ulong addr, len;
1519
1520 #ifdef DEBUG_GDB
1521     printf("command='%s'\n", line_buf);
1522 #endif
1523     p = line_buf;
1524     ch = *p++;
1525     switch(ch) {
1526     case '?':
1527         /* TODO: Make this return the correct value for user-mode.  */
1528         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1529                  s->c_cpu->cpu_index+1);
1530         put_packet(s, buf);
1531         /* Remove all the breakpoints when this query is issued,
1532          * because gdb is doing and initial connect and the state
1533          * should be cleaned up.
1534          */
1535         gdb_breakpoint_remove_all();
1536         break;
1537     case 'c':
1538         if (*p != '\0') {
1539             addr = strtoull(p, (char **)&p, 16);
1540 #if defined(TARGET_I386)
1541             s->c_cpu->eip = addr;
1542 #elif defined (TARGET_PPC)
1543             s->c_cpu->nip = addr;
1544 #elif defined (TARGET_SPARC)
1545             s->c_cpu->pc = addr;
1546             s->c_cpu->npc = addr + 4;
1547 #elif defined (TARGET_ARM)
1548             s->c_cpu->regs[15] = addr;
1549 #elif defined (TARGET_SH4)
1550             s->c_cpu->pc = addr;
1551 #elif defined (TARGET_MIPS)
1552             s->c_cpu->active_tc.PC = addr;
1553 #elif defined (TARGET_CRIS)
1554             s->c_cpu->pc = addr;
1555 #elif defined (TARGET_ALPHA)
1556             s->c_cpu->pc = addr;
1557 #endif
1558         }
1559         s->signal = 0;
1560         gdb_continue(s);
1561         return RS_IDLE;
1562     case 'C':
1563         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1564         if (s->signal == -1)
1565             s->signal = 0;
1566         gdb_continue(s);
1567         return RS_IDLE;
1568     case 'k':
1569         /* Kill the target */
1570         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1571         exit(0);
1572     case 'D':
1573         /* Detach packet */
1574         gdb_breakpoint_remove_all();
1575         gdb_continue(s);
1576         put_packet(s, "OK");
1577         break;
1578     case 's':
1579         if (*p != '\0') {
1580             addr = strtoull(p, (char **)&p, 16);
1581 #if defined(TARGET_I386)
1582             s->c_cpu->eip = addr;
1583 #elif defined (TARGET_PPC)
1584             s->c_cpu->nip = addr;
1585 #elif defined (TARGET_SPARC)
1586             s->c_cpu->pc = addr;
1587             s->c_cpu->npc = addr + 4;
1588 #elif defined (TARGET_ARM)
1589             s->c_cpu->regs[15] = addr;
1590 #elif defined (TARGET_SH4)
1591             s->c_cpu->pc = addr;
1592 #elif defined (TARGET_MIPS)
1593             s->c_cpu->active_tc.PC = addr;
1594 #elif defined (TARGET_CRIS)
1595             s->c_cpu->pc = addr;
1596 #elif defined (TARGET_ALPHA)
1597             s->c_cpu->pc = addr;
1598 #endif
1599         }
1600         cpu_single_step(s->c_cpu, sstep_flags);
1601         gdb_continue(s);
1602         return RS_IDLE;
1603     case 'F':
1604         {
1605             target_ulong ret;
1606             target_ulong err;
1607
1608             ret = strtoull(p, (char **)&p, 16);
1609             if (*p == ',') {
1610                 p++;
1611                 err = strtoull(p, (char **)&p, 16);
1612             } else {
1613                 err = 0;
1614             }
1615             if (*p == ',')
1616                 p++;
1617             type = *p;
1618             if (gdb_current_syscall_cb)
1619                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1620             if (type == 'C') {
1621                 put_packet(s, "T02");
1622             } else {
1623                 gdb_continue(s);
1624             }
1625         }
1626         break;
1627     case 'g':
1628         len = 0;
1629         for (addr = 0; addr < num_g_regs; addr++) {
1630             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1631             len += reg_size;
1632         }
1633         memtohex(buf, mem_buf, len);
1634         put_packet(s, buf);
1635         break;
1636     case 'G':
1637         registers = mem_buf;
1638         len = strlen(p) / 2;
1639         hextomem((uint8_t *)registers, p, len);
1640         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1641             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1642             len -= reg_size;
1643             registers += reg_size;
1644         }
1645         put_packet(s, "OK");
1646         break;
1647     case 'm':
1648         addr = strtoull(p, (char **)&p, 16);
1649         if (*p == ',')
1650             p++;
1651         len = strtoull(p, NULL, 16);
1652         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1653             put_packet (s, "E14");
1654         } else {
1655             memtohex(buf, mem_buf, len);
1656             put_packet(s, buf);
1657         }
1658         break;
1659     case 'M':
1660         addr = strtoull(p, (char **)&p, 16);
1661         if (*p == ',')
1662             p++;
1663         len = strtoull(p, (char **)&p, 16);
1664         if (*p == ':')
1665             p++;
1666         hextomem(mem_buf, p, len);
1667         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1668             put_packet(s, "E14");
1669         else
1670             put_packet(s, "OK");
1671         break;
1672     case 'p':
1673         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1674            This works, but can be very slow.  Anything new enough to
1675            understand XML also knows how to use this properly.  */
1676         if (!gdb_has_xml)
1677             goto unknown_command;
1678         addr = strtoull(p, (char **)&p, 16);
1679         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1680         if (reg_size) {
1681             memtohex(buf, mem_buf, reg_size);
1682             put_packet(s, buf);
1683         } else {
1684             put_packet(s, "E14");
1685         }
1686         break;
1687     case 'P':
1688         if (!gdb_has_xml)
1689             goto unknown_command;
1690         addr = strtoull(p, (char **)&p, 16);
1691         if (*p == '=')
1692             p++;
1693         reg_size = strlen(p) / 2;
1694         hextomem(mem_buf, p, reg_size);
1695         gdb_write_register(s->g_cpu, mem_buf, addr);
1696         put_packet(s, "OK");
1697         break;
1698     case 'Z':
1699     case 'z':
1700         type = strtoul(p, (char **)&p, 16);
1701         if (*p == ',')
1702             p++;
1703         addr = strtoull(p, (char **)&p, 16);
1704         if (*p == ',')
1705             p++;
1706         len = strtoull(p, (char **)&p, 16);
1707         if (ch == 'Z')
1708             res = gdb_breakpoint_insert(addr, len, type);
1709         else
1710             res = gdb_breakpoint_remove(addr, len, type);
1711         if (res >= 0)
1712              put_packet(s, "OK");
1713         else if (res == -ENOSYS)
1714             put_packet(s, "");
1715         else
1716             put_packet(s, "E22");
1717         break;
1718     case 'H':
1719         type = *p++;
1720         thread = strtoull(p, (char **)&p, 16);
1721         if (thread == -1 || thread == 0) {
1722             put_packet(s, "OK");
1723             break;
1724         }
1725         for (env = first_cpu; env != NULL; env = env->next_cpu)
1726             if (env->cpu_index + 1 == thread)
1727                 break;
1728         if (env == NULL) {
1729             put_packet(s, "E22");
1730             break;
1731         }
1732         switch (type) {
1733         case 'c':
1734             s->c_cpu = env;
1735             put_packet(s, "OK");
1736             break;
1737         case 'g':
1738             s->g_cpu = env;
1739             put_packet(s, "OK");
1740             break;
1741         default:
1742              put_packet(s, "E22");
1743              break;
1744         }
1745         break;
1746     case 'T':
1747         thread = strtoull(p, (char **)&p, 16);
1748 #ifndef CONFIG_USER_ONLY
1749         if (thread > 0 && thread < smp_cpus + 1)
1750 #else
1751         if (thread == 1)
1752 #endif
1753              put_packet(s, "OK");
1754         else
1755             put_packet(s, "E22");
1756         break;
1757     case 'q':
1758     case 'Q':
1759         /* parse any 'q' packets here */
1760         if (!strcmp(p,"qemu.sstepbits")) {
1761             /* Query Breakpoint bit definitions */
1762             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1763                      SSTEP_ENABLE,
1764                      SSTEP_NOIRQ,
1765                      SSTEP_NOTIMER);
1766             put_packet(s, buf);
1767             break;
1768         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1769             /* Display or change the sstep_flags */
1770             p += 10;
1771             if (*p != '=') {
1772                 /* Display current setting */
1773                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1774                 put_packet(s, buf);
1775                 break;
1776             }
1777             p++;
1778             type = strtoul(p, (char **)&p, 16);
1779             sstep_flags = type;
1780             put_packet(s, "OK");
1781             break;
1782         } else if (strcmp(p,"C") == 0) {
1783             /* "Current thread" remains vague in the spec, so always return
1784              *  the first CPU (gdb returns the first thread). */
1785             put_packet(s, "QC1");
1786             break;
1787         } else if (strcmp(p,"fThreadInfo") == 0) {
1788             s->query_cpu = first_cpu;
1789             goto report_cpuinfo;
1790         } else if (strcmp(p,"sThreadInfo") == 0) {
1791         report_cpuinfo:
1792             if (s->query_cpu) {
1793                 snprintf(buf, sizeof(buf), "m%x", s->query_cpu->cpu_index+1);
1794                 put_packet(s, buf);
1795                 s->query_cpu = s->query_cpu->next_cpu;
1796             } else
1797                 put_packet(s, "l");
1798             break;
1799         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1800             thread = strtoull(p+16, (char **)&p, 16);
1801             for (env = first_cpu; env != NULL; env = env->next_cpu)
1802                 if (env->cpu_index + 1 == thread) {
1803                     len = snprintf((char *)mem_buf, sizeof(mem_buf),
1804                                    "CPU#%d [%s]", env->cpu_index,
1805                                    env->halted ? "halted " : "running");
1806                     memtohex(buf, mem_buf, len);
1807                     put_packet(s, buf);
1808                     break;
1809                 }
1810             break;
1811         }
1812 #ifdef CONFIG_LINUX_USER
1813         else if (strncmp(p, "Offsets", 7) == 0) {
1814             TaskState *ts = s->c_cpu->opaque;
1815
1816             snprintf(buf, sizeof(buf),
1817                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1818                      ";Bss=" TARGET_ABI_FMT_lx,
1819                      ts->info->code_offset,
1820                      ts->info->data_offset,
1821                      ts->info->data_offset);
1822             put_packet(s, buf);
1823             break;
1824         }
1825 #endif
1826         if (strncmp(p, "Supported", 9) == 0) {
1827             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1828 #ifdef GDB_CORE_XML
1829             strcat(buf, ";qXfer:features:read+");
1830 #endif
1831             put_packet(s, buf);
1832             break;
1833         }
1834 #ifdef GDB_CORE_XML
1835         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1836             const char *xml;
1837             target_ulong total_len;
1838
1839             gdb_has_xml = 1;
1840             p += 19;
1841             xml = get_feature_xml(p, &p);
1842             if (!xml) {
1843                 snprintf(buf, sizeof(buf), "E00");
1844                 put_packet(s, buf);
1845                 break;
1846             }
1847
1848             if (*p == ':')
1849                 p++;
1850             addr = strtoul(p, (char **)&p, 16);
1851             if (*p == ',')
1852                 p++;
1853             len = strtoul(p, (char **)&p, 16);
1854
1855             total_len = strlen(xml);
1856             if (addr > total_len) {
1857                 snprintf(buf, sizeof(buf), "E00");
1858                 put_packet(s, buf);
1859                 break;
1860             }
1861             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1862                 len = (MAX_PACKET_LENGTH - 5) / 2;
1863             if (len < total_len - addr) {
1864                 buf[0] = 'm';
1865                 len = memtox(buf + 1, xml + addr, len);
1866             } else {
1867                 buf[0] = 'l';
1868                 len = memtox(buf + 1, xml + addr, total_len - addr);
1869             }
1870             put_packet_binary(s, buf, len + 1);
1871             break;
1872         }
1873 #endif
1874         /* Unrecognised 'q' command.  */
1875         goto unknown_command;
1876
1877     default:
1878     unknown_command:
1879         /* put empty packet */
1880         buf[0] = '\0';
1881         put_packet(s, buf);
1882         break;
1883     }
1884     return RS_IDLE;
1885 }
1886
1887 void gdb_set_stop_cpu(CPUState *env)
1888 {
1889     gdbserver_state->c_cpu = env;
1890     gdbserver_state->g_cpu = env;
1891 }
1892
1893 #ifndef CONFIG_USER_ONLY
1894 static void gdb_vm_stopped(void *opaque, int reason)
1895 {
1896     GDBState *s = gdbserver_state;
1897     CPUState *env = s->c_cpu;
1898     char buf[256];
1899     const char *type;
1900     int ret;
1901
1902     if (s->state == RS_SYSCALL)
1903         return;
1904
1905     /* disable single step if it was enable */
1906     cpu_single_step(env, 0);
1907
1908     if (reason == EXCP_DEBUG) {
1909         if (env->watchpoint_hit) {
1910             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
1911             case BP_MEM_READ:
1912                 type = "r";
1913                 break;
1914             case BP_MEM_ACCESS:
1915                 type = "a";
1916                 break;
1917             default:
1918                 type = "";
1919                 break;
1920             }
1921             snprintf(buf, sizeof(buf),
1922                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1923                      GDB_SIGNAL_TRAP, env->cpu_index+1, type,
1924                      env->watchpoint_hit->vaddr);
1925             put_packet(s, buf);
1926             env->watchpoint_hit = NULL;
1927             return;
1928         }
1929         tb_flush(env);
1930         ret = GDB_SIGNAL_TRAP;
1931     } else if (reason == EXCP_INTERRUPT) {
1932         ret = GDB_SIGNAL_INT;
1933     } else {
1934         ret = 0;
1935     }
1936     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, env->cpu_index+1);
1937     put_packet(s, buf);
1938 }
1939 #endif
1940
1941 /* Send a gdb syscall request.
1942    This accepts limited printf-style format specifiers, specifically:
1943     %x  - target_ulong argument printed in hex.
1944     %lx - 64-bit argument printed in hex.
1945     %s  - string pointer (target_ulong) and length (int) pair.  */
1946 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1947 {
1948     va_list va;
1949     char buf[256];
1950     char *p;
1951     target_ulong addr;
1952     uint64_t i64;
1953     GDBState *s;
1954
1955     s = gdbserver_state;
1956     if (!s)
1957         return;
1958     gdb_current_syscall_cb = cb;
1959     s->state = RS_SYSCALL;
1960 #ifndef CONFIG_USER_ONLY
1961     vm_stop(EXCP_DEBUG);
1962 #endif
1963     s->state = RS_IDLE;
1964     va_start(va, fmt);
1965     p = buf;
1966     *(p++) = 'F';
1967     while (*fmt) {
1968         if (*fmt == '%') {
1969             fmt++;
1970             switch (*fmt++) {
1971             case 'x':
1972                 addr = va_arg(va, target_ulong);
1973                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
1974                 break;
1975             case 'l':
1976                 if (*(fmt++) != 'x')
1977                     goto bad_format;
1978                 i64 = va_arg(va, uint64_t);
1979                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
1980                 break;
1981             case 's':
1982                 addr = va_arg(va, target_ulong);
1983                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
1984                               addr, va_arg(va, int));
1985                 break;
1986             default:
1987             bad_format:
1988                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
1989                         fmt - 1);
1990                 break;
1991             }
1992         } else {
1993             *(p++) = *(fmt++);
1994         }
1995     }
1996     *p = 0;
1997     va_end(va);
1998     put_packet(s, buf);
1999 #ifdef CONFIG_USER_ONLY
2000     gdb_handlesig(s->c_cpu, 0);
2001 #else
2002     cpu_interrupt(s->c_cpu, CPU_INTERRUPT_EXIT);
2003 #endif
2004 }
2005
2006 static void gdb_read_byte(GDBState *s, int ch)
2007 {
2008     int i, csum;
2009     uint8_t reply;
2010
2011 #ifndef CONFIG_USER_ONLY
2012     if (s->last_packet_len) {
2013         /* Waiting for a response to the last packet.  If we see the start
2014            of a new command then abandon the previous response.  */
2015         if (ch == '-') {
2016 #ifdef DEBUG_GDB
2017             printf("Got NACK, retransmitting\n");
2018 #endif
2019             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2020         }
2021 #ifdef DEBUG_GDB
2022         else if (ch == '+')
2023             printf("Got ACK\n");
2024         else
2025             printf("Got '%c' when expecting ACK/NACK\n", ch);
2026 #endif
2027         if (ch == '+' || ch == '$')
2028             s->last_packet_len = 0;
2029         if (ch != '$')
2030             return;
2031     }
2032     if (vm_running) {
2033         /* when the CPU is running, we cannot do anything except stop
2034            it when receiving a char */
2035         vm_stop(EXCP_INTERRUPT);
2036     } else
2037 #endif
2038     {
2039         switch(s->state) {
2040         case RS_IDLE:
2041             if (ch == '$') {
2042                 s->line_buf_index = 0;
2043                 s->state = RS_GETLINE;
2044             }
2045             break;
2046         case RS_GETLINE:
2047             if (ch == '#') {
2048             s->state = RS_CHKSUM1;
2049             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2050                 s->state = RS_IDLE;
2051             } else {
2052             s->line_buf[s->line_buf_index++] = ch;
2053             }
2054             break;
2055         case RS_CHKSUM1:
2056             s->line_buf[s->line_buf_index] = '\0';
2057             s->line_csum = fromhex(ch) << 4;
2058             s->state = RS_CHKSUM2;
2059             break;
2060         case RS_CHKSUM2:
2061             s->line_csum |= fromhex(ch);
2062             csum = 0;
2063             for(i = 0; i < s->line_buf_index; i++) {
2064                 csum += s->line_buf[i];
2065             }
2066             if (s->line_csum != (csum & 0xff)) {
2067                 reply = '-';
2068                 put_buffer(s, &reply, 1);
2069                 s->state = RS_IDLE;
2070             } else {
2071                 reply = '+';
2072                 put_buffer(s, &reply, 1);
2073                 s->state = gdb_handle_packet(s, s->line_buf);
2074             }
2075             break;
2076         default:
2077             abort();
2078         }
2079     }
2080 }
2081
2082 #ifdef CONFIG_USER_ONLY
2083 int
2084 gdb_queuesig (void)
2085 {
2086     GDBState *s;
2087
2088     s = gdbserver_state;
2089
2090     if (gdbserver_fd < 0 || s->fd < 0)
2091         return 0;
2092     else
2093         return 1;
2094 }
2095
2096 int
2097 gdb_handlesig (CPUState *env, int sig)
2098 {
2099   GDBState *s;
2100   char buf[256];
2101   int n;
2102
2103   s = gdbserver_state;
2104   if (gdbserver_fd < 0 || s->fd < 0)
2105     return sig;
2106
2107   /* disable single step if it was enabled */
2108   cpu_single_step(env, 0);
2109   tb_flush(env);
2110
2111   if (sig != 0)
2112     {
2113       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2114       put_packet(s, buf);
2115     }
2116   /* put_packet() might have detected that the peer terminated the
2117      connection.  */
2118   if (s->fd < 0)
2119       return sig;
2120
2121   sig = 0;
2122   s->state = RS_IDLE;
2123   s->running_state = 0;
2124   while (s->running_state == 0) {
2125       n = read (s->fd, buf, 256);
2126       if (n > 0)
2127         {
2128           int i;
2129
2130           for (i = 0; i < n; i++)
2131             gdb_read_byte (s, buf[i]);
2132         }
2133       else if (n == 0 || errno != EAGAIN)
2134         {
2135           /* XXX: Connection closed.  Should probably wait for annother
2136              connection before continuing.  */
2137           return sig;
2138         }
2139   }
2140   sig = s->signal;
2141   s->signal = 0;
2142   return sig;
2143 }
2144
2145 /* Tell the remote gdb that the process has exited.  */
2146 void gdb_exit(CPUState *env, int code)
2147 {
2148   GDBState *s;
2149   char buf[4];
2150
2151   s = gdbserver_state;
2152   if (gdbserver_fd < 0 || s->fd < 0)
2153     return;
2154
2155   snprintf(buf, sizeof(buf), "W%02x", code);
2156   put_packet(s, buf);
2157 }
2158
2159 /* Tell the remote gdb that the process has exited due to SIG.  */
2160 void gdb_signalled(CPUState *env, int sig)
2161 {
2162   GDBState *s;
2163   char buf[4];
2164
2165   s = gdbserver_state;
2166   if (gdbserver_fd < 0 || s->fd < 0)
2167     return;
2168
2169   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2170   put_packet(s, buf);
2171 }
2172
2173 static void gdb_accept(void)
2174 {
2175     GDBState *s;
2176     struct sockaddr_in sockaddr;
2177     socklen_t len;
2178     int val, fd;
2179
2180     for(;;) {
2181         len = sizeof(sockaddr);
2182         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2183         if (fd < 0 && errno != EINTR) {
2184             perror("accept");
2185             return;
2186         } else if (fd >= 0) {
2187             break;
2188         }
2189     }
2190
2191     /* set short latency */
2192     val = 1;
2193     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2194
2195     s = qemu_mallocz(sizeof(GDBState));
2196     if (!s) {
2197         errno = ENOMEM;
2198         perror("accept");
2199         return;
2200     }
2201
2202     memset (s, 0, sizeof (GDBState));
2203     s->c_cpu = first_cpu;
2204     s->g_cpu = first_cpu;
2205     s->fd = fd;
2206     gdb_has_xml = 0;
2207
2208     gdbserver_state = s;
2209
2210     fcntl(fd, F_SETFL, O_NONBLOCK);
2211 }
2212
2213 static int gdbserver_open(int port)
2214 {
2215     struct sockaddr_in sockaddr;
2216     int fd, val, ret;
2217
2218     fd = socket(PF_INET, SOCK_STREAM, 0);
2219     if (fd < 0) {
2220         perror("socket");
2221         return -1;
2222     }
2223
2224     /* allow fast reuse */
2225     val = 1;
2226     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2227
2228     sockaddr.sin_family = AF_INET;
2229     sockaddr.sin_port = htons(port);
2230     sockaddr.sin_addr.s_addr = 0;
2231     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2232     if (ret < 0) {
2233         perror("bind");
2234         return -1;
2235     }
2236     ret = listen(fd, 0);
2237     if (ret < 0) {
2238         perror("listen");
2239         return -1;
2240     }
2241     return fd;
2242 }
2243
2244 int gdbserver_start(int port)
2245 {
2246     gdbserver_fd = gdbserver_open(port);
2247     if (gdbserver_fd < 0)
2248         return -1;
2249     /* accept connections */
2250     gdb_accept();
2251     return 0;
2252 }
2253
2254 /* Disable gdb stub for child processes.  */
2255 void gdbserver_fork(CPUState *env)
2256 {
2257     GDBState *s = gdbserver_state;
2258     if (s->fd < 0)
2259       return;
2260     close(s->fd);
2261     s->fd = -1;
2262     cpu_breakpoint_remove_all(env, BP_GDB);
2263     cpu_watchpoint_remove_all(env, BP_GDB);
2264 }
2265 #else
2266 static int gdb_chr_can_receive(void *opaque)
2267 {
2268   /* We can handle an arbitrarily large amount of data.
2269    Pick the maximum packet size, which is as good as anything.  */
2270   return MAX_PACKET_LENGTH;
2271 }
2272
2273 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2274 {
2275     int i;
2276
2277     for (i = 0; i < size; i++) {
2278         gdb_read_byte(gdbserver_state, buf[i]);
2279     }
2280 }
2281
2282 static void gdb_chr_event(void *opaque, int event)
2283 {
2284     switch (event) {
2285     case CHR_EVENT_RESET:
2286         vm_stop(EXCP_INTERRUPT);
2287         gdb_has_xml = 0;
2288         break;
2289     default:
2290         break;
2291     }
2292 }
2293
2294 int gdbserver_start(const char *port)
2295 {
2296     GDBState *s;
2297     char gdbstub_port_name[128];
2298     int port_num;
2299     char *p;
2300     CharDriverState *chr;
2301
2302     if (!port || !*port)
2303       return -1;
2304
2305     port_num = strtol(port, &p, 10);
2306     if (*p == 0) {
2307         /* A numeric value is interpreted as a port number.  */
2308         snprintf(gdbstub_port_name, sizeof(gdbstub_port_name),
2309                  "tcp::%d,nowait,nodelay,server", port_num);
2310         port = gdbstub_port_name;
2311     }
2312
2313     chr = qemu_chr_open("gdb", port);
2314     if (!chr)
2315         return -1;
2316
2317     s = qemu_mallocz(sizeof(GDBState));
2318     if (!s) {
2319         return -1;
2320     }
2321     s->c_cpu = first_cpu;
2322     s->g_cpu = first_cpu;
2323     s->chr = chr;
2324     gdbserver_state = s;
2325     qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2326                           gdb_chr_event, NULL);
2327     qemu_add_vm_stop_handler(gdb_vm_stopped, NULL);
2328     return 0;
2329 }
2330 #endif