gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA  02110-1301 USA
  19  */
  20 #include "config.h"
  21 #include "qemu-common.h"
  22 #ifdef CONFIG_USER_ONLY
  23 #include <stdlib.h>
  24 #include <stdio.h>
  25 #include <stdarg.h>
  26 #include <string.h>
  27 #include <errno.h>
  28 #include <unistd.h>
  29 #include <fcntl.h>
  30
  31 #include "qemu.h"
  32 #else
  33 #include "monitor.h"
  34 #include "qemu-char.h"
  35 #include "sysemu.h"
  36 #include "gdbstub.h"
  37 #endif
  38 #include "qemu-kvm.h"
  39
  40 #define MAX_PACKET_LENGTH 4096
  41
  42 #include "qemu_socket.h"
  43 #include "kvm.h"
  44
  45
  46 enum {
  47     GDB_SIGNAL_0 = 0,
  48     GDB_SIGNAL_INT = 2,
  49     GDB_SIGNAL_TRAP = 5,
  50     GDB_SIGNAL_UNKNOWN = 143
  51 };
  52
  53 #ifdef CONFIG_USER_ONLY
  54
  55 /* Map target signal numbers to GDB protocol signal numbers and vice
  56  * versa.  For user emulation's currently supported systems, we can
  57  * assume most signals are defined.
  58  */
  59
  60 static int gdb_signal_table[] = {
  61     0,
  62     TARGET_SIGHUP,
  63     TARGET_SIGINT,
  64     TARGET_SIGQUIT,
  65     TARGET_SIGILL,
  66     TARGET_SIGTRAP,
  67     TARGET_SIGABRT,
  68     -1, /* SIGEMT */
  69     TARGET_SIGFPE,
  70     TARGET_SIGKILL,
  71     TARGET_SIGBUS,
  72     TARGET_SIGSEGV,
  73     TARGET_SIGSYS,
  74     TARGET_SIGPIPE,
  75     TARGET_SIGALRM,
  76     TARGET_SIGTERM,
  77     TARGET_SIGURG,
  78     TARGET_SIGSTOP,
  79     TARGET_SIGTSTP,
  80     TARGET_SIGCONT,
  81     TARGET_SIGCHLD,
  82     TARGET_SIGTTIN,
  83     TARGET_SIGTTOU,
  84     TARGET_SIGIO,
  85     TARGET_SIGXCPU,
  86     TARGET_SIGXFSZ,
  87     TARGET_SIGVTALRM,
  88     TARGET_SIGPROF,
  89     TARGET_SIGWINCH,
  90     -1, /* SIGLOST */
  91     TARGET_SIGUSR1,
  92     TARGET_SIGUSR2,
  93 #ifdef TARGET_SIGPWR
  94     TARGET_SIGPWR,
  95 #else
  96     -1,
  97 #endif
  98     -1, /* SIGPOLL */
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108     -1,
 109     -1,
 110 #ifdef __SIGRTMIN
 111     __SIGRTMIN + 1,
 112     __SIGRTMIN + 2,
 113     __SIGRTMIN + 3,
 114     __SIGRTMIN + 4,
 115     __SIGRTMIN + 5,
 116     __SIGRTMIN + 6,
 117     __SIGRTMIN + 7,
 118     __SIGRTMIN + 8,
 119     __SIGRTMIN + 9,
 120     __SIGRTMIN + 10,
 121     __SIGRTMIN + 11,
 122     __SIGRTMIN + 12,
 123     __SIGRTMIN + 13,
 124     __SIGRTMIN + 14,
 125     __SIGRTMIN + 15,
 126     __SIGRTMIN + 16,
 127     __SIGRTMIN + 17,
 128     __SIGRTMIN + 18,
 129     __SIGRTMIN + 19,
 130     __SIGRTMIN + 20,
 131     __SIGRTMIN + 21,
 132     __SIGRTMIN + 22,
 133     __SIGRTMIN + 23,
 134     __SIGRTMIN + 24,
 135     __SIGRTMIN + 25,
 136     __SIGRTMIN + 26,
 137     __SIGRTMIN + 27,
 138     __SIGRTMIN + 28,
 139     __SIGRTMIN + 29,
 140     __SIGRTMIN + 30,
 141     __SIGRTMIN + 31,
 142     -1, /* SIGCANCEL */
 143     __SIGRTMIN,
 144     __SIGRTMIN + 32,
 145     __SIGRTMIN + 33,
 146     __SIGRTMIN + 34,
 147     __SIGRTMIN + 35,
 148     __SIGRTMIN + 36,
 149     __SIGRTMIN + 37,
 150     __SIGRTMIN + 38,
 151     __SIGRTMIN + 39,
 152     __SIGRTMIN + 40,
 153     __SIGRTMIN + 41,
 154     __SIGRTMIN + 42,
 155     __SIGRTMIN + 43,
 156     __SIGRTMIN + 44,
 157     __SIGRTMIN + 45,
 158     __SIGRTMIN + 46,
 159     __SIGRTMIN + 47,
 160     __SIGRTMIN + 48,
 161     __SIGRTMIN + 49,
 162     __SIGRTMIN + 50,
 163     __SIGRTMIN + 51,
 164     __SIGRTMIN + 52,
 165     __SIGRTMIN + 53,
 166     __SIGRTMIN + 54,
 167     __SIGRTMIN + 55,
 168     __SIGRTMIN + 56,
 169     __SIGRTMIN + 57,
 170     __SIGRTMIN + 58,
 171     __SIGRTMIN + 59,
 172     __SIGRTMIN + 60,
 173     __SIGRTMIN + 61,
 174     __SIGRTMIN + 62,
 175     __SIGRTMIN + 63,
 176     __SIGRTMIN + 64,
 177     __SIGRTMIN + 65,
 178     __SIGRTMIN + 66,
 179     __SIGRTMIN + 67,
 180     __SIGRTMIN + 68,
 181     __SIGRTMIN + 69,
 182     __SIGRTMIN + 70,
 183     __SIGRTMIN + 71,
 184     __SIGRTMIN + 72,
 185     __SIGRTMIN + 73,
 186     __SIGRTMIN + 74,
 187     __SIGRTMIN + 75,
 188     __SIGRTMIN + 76,
 189     __SIGRTMIN + 77,
 190     __SIGRTMIN + 78,
 191     __SIGRTMIN + 79,
 192     __SIGRTMIN + 80,
 193     __SIGRTMIN + 81,
 194     __SIGRTMIN + 82,
 195     __SIGRTMIN + 83,
 196     __SIGRTMIN + 84,
 197     __SIGRTMIN + 85,
 198     __SIGRTMIN + 86,
 199     __SIGRTMIN + 87,
 200     __SIGRTMIN + 88,
 201     __SIGRTMIN + 89,
 202     __SIGRTMIN + 90,
 203     __SIGRTMIN + 91,
 204     __SIGRTMIN + 92,
 205     __SIGRTMIN + 93,
 206     __SIGRTMIN + 94,
 207     __SIGRTMIN + 95,
 208     -1, /* SIGINFO */
 209     -1, /* UNKNOWN */
 210     -1, /* DEFAULT */
 211     -1,
 212     -1,
 213     -1,
 214     -1,
 215     -1,
 216     -1
 217 #endif
 218 };
 219 #else
 220 /* In system mode we only need SIGINT and SIGTRAP; other signals
 221    are not yet supported.  */
 222
 223 enum {
 224     TARGET_SIGINT = 2,
 225     TARGET_SIGTRAP = 5
 226 };
 227
 228 static int gdb_signal_table[] = {
 229     -1,
 230     -1,
 231     TARGET_SIGINT,
 232     -1,
 233     -1,
 234     TARGET_SIGTRAP
 235 };
 236 #endif
 237
 238 #ifdef CONFIG_USER_ONLY
 239 static int target_signal_to_gdb (int sig)
 240 {
 241     int i;
 242     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 243         if (gdb_signal_table[i] == sig)
 244             return i;
 245     return GDB_SIGNAL_UNKNOWN;
 246 }
 247 #endif
 248
 249 static int gdb_signal_to_target (int sig)
 250 {
 251     if (sig < ARRAY_SIZE (gdb_signal_table))
 252         return gdb_signal_table[sig];
 253     else
 254         return -1;
 255 }
 256
 257 //#define DEBUG_GDB
 258
 259 typedef struct GDBRegisterState {
 260     int base_reg;
 261     int num_regs;
 262     gdb_reg_cb get_reg;
 263     gdb_reg_cb set_reg;
 264     const char *xml;
 265     struct GDBRegisterState *next;
 266 } GDBRegisterState;
 267
 268 enum RSState {
 269     RS_INACTIVE,
 270     RS_IDLE,
 271     RS_GETLINE,
 272     RS_CHKSUM1,
 273     RS_CHKSUM2,
 274     RS_SYSCALL,
 275 };
 276 typedef struct GDBState {
 277     CPUState *c_cpu; /* current CPU for step/continue ops */
 278     CPUState *g_cpu; /* current CPU for other ops */
 279     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 280     enum RSState state; /* parsing state */
 281     char line_buf[MAX_PACKET_LENGTH];
 282     int line_buf_index;
 283     int line_csum;
 284     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 285     int last_packet_len;
 286     int signal;
 287 #ifdef CONFIG_USER_ONLY
 288     int fd;
 289     int running_state;
 290 #else
 291     CharDriverState *chr;
 292     CharDriverState *mon_chr;
 293 #endif
 294 } GDBState;
 295
 296 /* By default use no IRQs and no timers while single stepping so as to
 297  * make single stepping like an ICE HW step.
 298  */
 299 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 300
 301 static GDBState *gdbserver_state;
 302
 303 /* This is an ugly hack to cope with both new and old gdb.
 304    If gdb sends qXfer:features:read then assume we're talking to a newish
 305    gdb that understands target descriptions.  */
 306 static int gdb_has_xml;
 307
 308 #ifdef CONFIG_USER_ONLY
 309 /* XXX: This is not thread safe.  Do we care?  */
 310 static int gdbserver_fd = -1;
 311
 312 static int get_char(GDBState *s)
 313 {
 314     uint8_t ch;
 315     int ret;
 316
 317     for(;;) {
 318         ret = recv(s->fd, &ch, 1, 0);
 319         if (ret < 0) {
 320             if (errno == ECONNRESET)
 321                 s->fd = -1;
 322             if (errno != EINTR && errno != EAGAIN)
 323                 return -1;
 324         } else if (ret == 0) {
 325             close(s->fd);
 326             s->fd = -1;
 327             return -1;
 328         } else {
 329             break;
 330         }
 331     }
 332     return ch;
 333 }
 334 #endif
 335
 336 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 337
 338 static enum {
 339     GDB_SYS_UNKNOWN,
 340     GDB_SYS_ENABLED,
 341     GDB_SYS_DISABLED,
 342 } gdb_syscall_mode;
 343
 344 /* If gdb is connected when the first semihosting syscall occurs then use
 345    remote gdb syscalls.  Otherwise use native file IO.  */
 346 int use_gdb_syscalls(void)
 347 {
 348     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 349         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 350                                             : GDB_SYS_DISABLED);
 351     }
 352     return gdb_syscall_mode == GDB_SYS_ENABLED;
 353 }
 354
 355 /* Resume execution.  */
 356 static inline void gdb_continue(GDBState *s)
 357 {
 358 #ifdef CONFIG_USER_ONLY
 359     s->running_state = 1;
 360 #else
 361     vm_start();
 362 #endif
 363 }
 364
 365 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 366 {
 367 #ifdef CONFIG_USER_ONLY
 368     int ret;
 369
 370     while (len > 0) {
 371         ret = send(s->fd, buf, len, 0);
 372         if (ret < 0) {
 373             if (errno != EINTR && errno != EAGAIN)
 374                 return;
 375         } else {
 376             buf += ret;
 377             len -= ret;
 378         }
 379     }
 380 #else
 381     qemu_chr_write(s->chr, buf, len);
 382 #endif
 383 }
 384
 385 static inline int fromhex(int v)
 386 {
 387     if (v >= '0' && v <= '9')
 388         return v - '0';
 389     else if (v >= 'A' && v <= 'F')
 390         return v - 'A' + 10;
 391     else if (v >= 'a' && v <= 'f')
 392         return v - 'a' + 10;
 393     else
 394         return 0;
 395 }
 396
 397 static inline int tohex(int v)
 398 {
 399     if (v < 10)
 400         return v + '0';
 401     else
 402         return v - 10 + 'a';
 403 }
 404
 405 static void memtohex(char *buf, const uint8_t *mem, int len)
 406 {
 407     int i, c;
 408     char *q;
 409     q = buf;
 410     for(i = 0; i < len; i++) {
 411         c = mem[i];
 412         *q++ = tohex(c >> 4);
 413         *q++ = tohex(c & 0xf);
 414     }
 415     *q = '\0';
 416 }
 417
 418 static void hextomem(uint8_t *mem, const char *buf, int len)
 419 {
 420     int i;
 421
 422     for(i = 0; i < len; i++) {
 423         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 424         buf += 2;
 425     }
 426 }
 427
 428 /* return -1 if error, 0 if OK */
 429 static int put_packet_binary(GDBState *s, const char *buf, int len)
 430 {
 431     int csum, i;
 432     uint8_t *p;
 433
 434     for(;;) {
 435         p = s->last_packet;
 436         *(p++) = '$';
 437         memcpy(p, buf, len);
 438         p += len;
 439         csum = 0;
 440         for(i = 0; i < len; i++) {
 441             csum += buf[i];
 442         }
 443         *(p++) = '#';
 444         *(p++) = tohex((csum >> 4) & 0xf);
 445         *(p++) = tohex((csum) & 0xf);
 446
 447         s->last_packet_len = p - s->last_packet;
 448         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 449
 450 #ifdef CONFIG_USER_ONLY
 451         i = get_char(s);
 452         if (i < 0)
 453             return -1;
 454         if (i == '+')
 455             break;
 456 #else
 457         break;
 458 #endif
 459     }
 460     return 0;
 461 }
 462
 463 /* return -1 if error, 0 if OK */
 464 static int put_packet(GDBState *s, const char *buf)
 465 {
 466 #ifdef DEBUG_GDB
 467     printf("reply='%s'\n", buf);
 468 #endif
 469
 470     return put_packet_binary(s, buf, strlen(buf));
 471 }
 472
 473 /* The GDB remote protocol transfers values in target byte order.  This means
 474    we can use the raw memory access routines to access the value buffer.
 475    Conveniently, these also handle the case where the buffer is mis-aligned.
 476  */
 477 #define GET_REG8(val) do { \
 478     stb_p(mem_buf, val); \
 479     return 1; \
 480     } while(0)
 481 #define GET_REG16(val) do { \
 482     stw_p(mem_buf, val); \
 483     return 2; \
 484     } while(0)
 485 #define GET_REG32(val) do { \
 486     stl_p(mem_buf, val); \
 487     return 4; \
 488     } while(0)
 489 #define GET_REG64(val) do { \
 490     stq_p(mem_buf, val); \
 491     return 8; \
 492     } while(0)
 493
 494 #if TARGET_LONG_BITS == 64
 495 #define GET_REGL(val) GET_REG64(val)
 496 #define ldtul_p(addr) ldq_p(addr)
 497 #else
 498 #define GET_REGL(val) GET_REG32(val)
 499 #define ldtul_p(addr) ldl_p(addr)
 500 #endif
 501
 502 #if defined(TARGET_I386)
 503
 504 #ifdef TARGET_X86_64
 505 static const int gpr_map[16] = {
 506     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 507     8, 9, 10, 11, 12, 13, 14, 15
 508 };
 509 #else
 510 static const int gpr_map[8] = {0, 1, 2, 3, 4, 5, 6, 7};
 511 #endif
 512
 513 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 514
 515 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 516 {
 517     if (n < CPU_NB_REGS) {
 518         GET_REGL(env->regs[gpr_map[n]]);
 519     } else if (n >= CPU_NB_REGS + 8 && n < CPU_NB_REGS + 16) {
 520         /* FIXME: byteswap float values.  */
 521 #ifdef USE_X86LDOUBLE
 522         memcpy(mem_buf, &env->fpregs[n - (CPU_NB_REGS + 8)], 10);
 523 #else
 524         memset(mem_buf, 0, 10);
 525 #endif
 526         return 10;
 527     } else if (n >= CPU_NB_REGS + 24) {
 528         n -= CPU_NB_REGS + 24;
 529         if (n < CPU_NB_REGS) {
 530             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 531             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 532             return 16;
 533         } else if (n == CPU_NB_REGS) {
 534             GET_REG32(env->mxcsr);
 535         }
 536     } else {
 537         n -= CPU_NB_REGS;
 538         switch (n) {
 539         case 0: GET_REGL(env->eip);
 540         case 1: GET_REG32(env->eflags);
 541         case 2: GET_REG32(env->segs[R_CS].selector);
 542         case 3: GET_REG32(env->segs[R_SS].selector);
 543         case 4: GET_REG32(env->segs[R_DS].selector);
 544         case 5: GET_REG32(env->segs[R_ES].selector);
 545         case 6: GET_REG32(env->segs[R_FS].selector);
 546         case 7: GET_REG32(env->segs[R_GS].selector);
 547         /* 8...15 x87 regs.  */
 548         case 16: GET_REG32(env->fpuc);
 549         case 17: GET_REG32((env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11);
 550         case 18: GET_REG32(0); /* ftag */
 551         case 19: GET_REG32(0); /* fiseg */
 552         case 20: GET_REG32(0); /* fioff */
 553         case 21: GET_REG32(0); /* foseg */
 554         case 22: GET_REG32(0); /* fooff */
 555         case 23: GET_REG32(0); /* fop */
 556         /* 24+ xmm regs.  */
 557         }
 558     }
 559     return 0;
 560 }
 561
 562 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int i)
 563 {
 564     uint32_t tmp;
 565
 566     if (i < CPU_NB_REGS) {
 567         env->regs[gpr_map[i]] = ldtul_p(mem_buf);
 568         return sizeof(target_ulong);
 569     } else if (i >= CPU_NB_REGS + 8 && i < CPU_NB_REGS + 16) {
 570         i -= CPU_NB_REGS + 8;
 571 #ifdef USE_X86LDOUBLE
 572         memcpy(&env->fpregs[i], mem_buf, 10);
 573 #endif
 574         return 10;
 575     } else if (i >= CPU_NB_REGS + 24) {
 576         i -= CPU_NB_REGS + 24;
 577         if (i < CPU_NB_REGS) {
 578             env->xmm_regs[i].XMM_Q(0) = ldq_p(mem_buf);
 579             env->xmm_regs[i].XMM_Q(1) = ldq_p(mem_buf + 8);
 580             return 16;
 581         } else if (i == CPU_NB_REGS) {
 582             env->mxcsr = ldl_p(mem_buf);
 583             return 4;
 584         }
 585     } else {
 586         i -= CPU_NB_REGS;
 587         switch (i) {
 588         case 0: env->eip = ldtul_p(mem_buf); return sizeof(target_ulong);
 589         case 1: env->eflags = ldl_p(mem_buf); return 4;
 590 #if defined(CONFIG_USER_ONLY)
 591 #define LOAD_SEG(index, sreg)\
 592             tmp = ldl_p(mem_buf);\
 593             if (tmp != env->segs[sreg].selector)\
 594                 cpu_x86_load_seg(env, sreg, tmp);
 595 #else
 596 /* FIXME: Honor segment registers.  Needs to avoid raising an exception
 597    when the selector is invalid.  */
 598 #define LOAD_SEG(index, sreg) do {} while(0)
 599 #endif
 600         case 2: LOAD_SEG(10, R_CS); return 4;
 601         case 3: LOAD_SEG(11, R_SS); return 4;
 602         case 4: LOAD_SEG(12, R_DS); return 4;
 603         case 5: LOAD_SEG(13, R_ES); return 4;
 604         case 6: LOAD_SEG(14, R_FS); return 4;
 605         case 7: LOAD_SEG(15, R_GS); return 4;
 606         /* 8...15 x87 regs.  */
 607         case 16: env->fpuc = ldl_p(mem_buf); return 4;
 608         case 17:
 609                  tmp = ldl_p(mem_buf);
 610                  env->fpstt = (tmp >> 11) & 7;
 611                  env->fpus = tmp & ~0x3800;
 612                  return 4;
 613         case 18: /* ftag */ return 4;
 614         case 19: /* fiseg */ return 4;
 615         case 20: /* fioff */ return 4;
 616         case 21: /* foseg */ return 4;
 617         case 22: /* fooff */ return 4;
 618         case 23: /* fop */ return 4;
 619         /* 24+ xmm regs.  */
 620         }
 621     }
 622     /* Unrecognised register.  */
 623     return 0;
 624 }
 625
 626 #elif defined (TARGET_PPC)
 627
 628 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 629    expects whatever the target description contains.  Due to a
 630    historical mishap the FP registers appear in between core integer
 631    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 632    FP regs zero size when talking to a newer gdb.  */
 633 #define NUM_CORE_REGS 71
 634 #if defined (TARGET_PPC64)
 635 #define GDB_CORE_XML "power64-core.xml"
 636 #else
 637 #define GDB_CORE_XML "power-core.xml"
 638 #endif
 639
 640 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 641 {
 642     if (n < 32) {
 643         /* gprs */
 644         GET_REGL(env->gpr[n]);
 645     } else if (n < 64) {
 646         /* fprs */
 647         if (gdb_has_xml)
 648             return 0;
 649         stfq_p(mem_buf, env->fpr[n-32]);
 650         return 8;
 651     } else {
 652         switch (n) {
 653         case 64: GET_REGL(env->nip);
 654         case 65: GET_REGL(env->msr);
 655         case 66:
 656             {
 657                 uint32_t cr = 0;
 658                 int i;
 659                 for (i = 0; i < 8; i++)
 660                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 661                 GET_REG32(cr);
 662             }
 663         case 67: GET_REGL(env->lr);
 664         case 68: GET_REGL(env->ctr);
 665         case 69: GET_REGL(env->xer);
 666         case 70:
 667             {
 668                 if (gdb_has_xml)
 669                     return 0;
 670                 GET_REG32(0); /* fpscr */
 671             }
 672         }
 673     }
 674     return 0;
 675 }
 676
 677 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 678 {
 679     if (n < 32) {
 680         /* gprs */
 681         env->gpr[n] = ldtul_p(mem_buf);
 682         return sizeof(target_ulong);
 683     } else if (n < 64) {
 684         /* fprs */
 685         if (gdb_has_xml)
 686             return 0;
 687         env->fpr[n-32] = ldfq_p(mem_buf);
 688         return 8;
 689     } else {
 690         switch (n) {
 691         case 64:
 692             env->nip = ldtul_p(mem_buf);
 693             return sizeof(target_ulong);
 694         case 65:
 695             ppc_store_msr(env, ldtul_p(mem_buf));
 696             return sizeof(target_ulong);
 697         case 66:
 698             {
 699                 uint32_t cr = ldl_p(mem_buf);
 700                 int i;
 701                 for (i = 0; i < 8; i++)
 702                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 703                 return 4;
 704             }
 705         case 67:
 706             env->lr = ldtul_p(mem_buf);
 707             return sizeof(target_ulong);
 708         case 68:
 709             env->ctr = ldtul_p(mem_buf);
 710             return sizeof(target_ulong);
 711         case 69:
 712             env->xer = ldtul_p(mem_buf);
 713             return sizeof(target_ulong);
 714         case 70:
 715             /* fpscr */
 716             if (gdb_has_xml)
 717                 return 0;
 718             return 4;
 719         }
 720     }
 721     return 0;
 722 }
 723
 724 #elif defined (TARGET_SPARC)
 725
 726 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 727 #define NUM_CORE_REGS 86
 728 #else
 729 #define NUM_CORE_REGS 72
 730 #endif
 731
 732 #ifdef TARGET_ABI32
 733 #define GET_REGA(val) GET_REG32(val)
 734 #else
 735 #define GET_REGA(val) GET_REGL(val)
 736 #endif
 737
 738 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 739 {
 740     if (n < 8) {
 741         /* g0..g7 */
 742         GET_REGA(env->gregs[n]);
 743     }
 744     if (n < 32) {
 745         /* register window */
 746         GET_REGA(env->regwptr[n - 8]);
 747     }
 748 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 749     if (n < 64) {
 750         /* fprs */
 751         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 752     }
 753     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 754     switch (n) {
 755     case 64: GET_REGA(env->y);
 756     case 65: GET_REGA(GET_PSR(env));
 757     case 66: GET_REGA(env->wim);
 758     case 67: GET_REGA(env->tbr);
 759     case 68: GET_REGA(env->pc);
 760     case 69: GET_REGA(env->npc);
 761     case 70: GET_REGA(env->fsr);
 762     case 71: GET_REGA(0); /* csr */
 763     default: GET_REGA(0);
 764     }
 765 #else
 766     if (n < 64) {
 767         /* f0-f31 */
 768         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 769     }
 770     if (n < 80) {
 771         /* f32-f62 (double width, even numbers only) */
 772         uint64_t val;
 773
 774         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 775         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 776         GET_REG64(val);
 777     }
 778     switch (n) {
 779     case 80: GET_REGL(env->pc);
 780     case 81: GET_REGL(env->npc);
 781     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 782                            ((env->asi & 0xff) << 24) |
 783                            ((env->pstate & 0xfff) << 8) |
 784                            GET_CWP64(env));
 785     case 83: GET_REGL(env->fsr);
 786     case 84: GET_REGL(env->fprs);
 787     case 85: GET_REGL(env->y);
 788     }
 789 #endif
 790     return 0;
 791 }
 792
 793 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 794 {
 795 #if defined(TARGET_ABI32)
 796     abi_ulong tmp;
 797
 798     tmp = ldl_p(mem_buf);
 799 #else
 800     target_ulong tmp;
 801
 802     tmp = ldtul_p(mem_buf);
 803 #endif
 804
 805     if (n < 8) {
 806         /* g0..g7 */
 807         env->gregs[n] = tmp;
 808     } else if (n < 32) {
 809         /* register window */
 810         env->regwptr[n - 8] = tmp;
 811     }
 812 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 813     else if (n < 64) {
 814         /* fprs */
 815         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 816     } else {
 817         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 818         switch (n) {
 819         case 64: env->y = tmp; break;
 820         case 65: PUT_PSR(env, tmp); break;
 821         case 66: env->wim = tmp; break;
 822         case 67: env->tbr = tmp; break;
 823         case 68: env->pc = tmp; break;
 824         case 69: env->npc = tmp; break;
 825         case 70: env->fsr = tmp; break;
 826         default: return 0;
 827         }
 828     }
 829     return 4;
 830 #else
 831     else if (n < 64) {
 832         /* f0-f31 */
 833         env->fpr[n] = ldfl_p(mem_buf);
 834         return 4;
 835     } else if (n < 80) {
 836         /* f32-f62 (double width, even numbers only) */
 837         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 838         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 839     } else {
 840         switch (n) {
 841         case 80: env->pc = tmp; break;
 842         case 81: env->npc = tmp; break;
 843         case 82:
 844             PUT_CCR(env, tmp >> 32);
 845             env->asi = (tmp >> 24) & 0xff;
 846             env->pstate = (tmp >> 8) & 0xfff;
 847             PUT_CWP64(env, tmp & 0xff);
 848             break;
 849         case 83: env->fsr = tmp; break;
 850         case 84: env->fprs = tmp; break;
 851         case 85: env->y = tmp; break;
 852         default: return 0;
 853         }
 854     }
 855     return 8;
 856 #endif
 857 }
 858 #elif defined (TARGET_ARM)
 859
 860 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 861    whatever the target description contains.  Due to a historical mishap
 862    the FPA registers appear in between core integer regs and the CPSR.
 863    We hack round this by giving the FPA regs zero size when talking to a
 864    newer gdb.  */
 865 #define NUM_CORE_REGS 26
 866 #define GDB_CORE_XML "arm-core.xml"
 867
 868 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 869 {
 870     if (n < 16) {
 871         /* Core integer register.  */
 872         GET_REG32(env->regs[n]);
 873     }
 874     if (n < 24) {
 875         /* FPA registers.  */
 876         if (gdb_has_xml)
 877             return 0;
 878         memset(mem_buf, 0, 12);
 879         return 12;
 880     }
 881     switch (n) {
 882     case 24:
 883         /* FPA status register.  */
 884         if (gdb_has_xml)
 885             return 0;
 886         GET_REG32(0);
 887     case 25:
 888         /* CPSR */
 889         GET_REG32(cpsr_read(env));
 890     }
 891     /* Unknown register.  */
 892     return 0;
 893 }
 894
 895 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 896 {
 897     uint32_t tmp;
 898
 899     tmp = ldl_p(mem_buf);
 900
 901     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 902        cause problems if we ever implement the Jazelle DBX extensions.  */
 903     if (n == 15)
 904         tmp &= ~1;
 905
 906     if (n < 16) {
 907         /* Core integer register.  */
 908         env->regs[n] = tmp;
 909         return 4;
 910     }
 911     if (n < 24) { /* 16-23 */
 912         /* FPA registers (ignored).  */
 913         if (gdb_has_xml)
 914             return 0;
 915         return 12;
 916     }
 917     switch (n) {
 918     case 24:
 919         /* FPA status register (ignored).  */
 920         if (gdb_has_xml)
 921             return 0;
 922         return 4;
 923     case 25:
 924         /* CPSR */
 925         cpsr_write (env, tmp, 0xffffffff);
 926         return 4;
 927     }
 928     /* Unknown register.  */
 929     return 0;
 930 }
 931
 932 #elif defined (TARGET_M68K)
 933
 934 #define NUM_CORE_REGS 18
 935
 936 #define GDB_CORE_XML "cf-core.xml"
 937
 938 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 939 {
 940     if (n < 8) {
 941         /* D0-D7 */
 942         GET_REG32(env->dregs[n]);
 943     } else if (n < 16) {
 944         /* A0-A7 */
 945         GET_REG32(env->aregs[n - 8]);
 946     } else {
 947         switch (n) {
 948         case 16: GET_REG32(env->sr);
 949         case 17: GET_REG32(env->pc);
 950         }
 951     }
 952     /* FP registers not included here because they vary between
 953        ColdFire and m68k.  Use XML bits for these.  */
 954     return 0;
 955 }
 956
 957 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 958 {
 959     uint32_t tmp;
 960
 961     tmp = ldl_p(mem_buf);
 962
 963     if (n < 8) {
 964         /* D0-D7 */
 965         env->dregs[n] = tmp;
 966     } else if (n < 8) {
 967         /* A0-A7 */
 968         env->aregs[n - 8] = tmp;
 969     } else {
 970         switch (n) {
 971         case 16: env->sr = tmp; break;
 972         case 17: env->pc = tmp; break;
 973         default: return 0;
 974         }
 975     }
 976     return 4;
 977 }
 978 #elif defined (TARGET_MIPS)
 979
 980 #define NUM_CORE_REGS 73
 981
 982 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 983 {
 984     if (n < 32) {
 985         GET_REGL(env->active_tc.gpr[n]);
 986     }
 987     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
 988         if (n >= 38 && n < 70) {
 989             if (env->CP0_Status & (1 << CP0St_FR))
 990                 GET_REGL(env->active_fpu.fpr[n - 38].d);
 991             else
 992                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
 993         }
 994         switch (n) {
 995         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
 996         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
 997         }
 998     }
 999     switch (n) {
1000     case 32: GET_REGL((int32_t)env->CP0_Status);
1001     case 33: GET_REGL(env->active_tc.LO[0]);
1002     case 34: GET_REGL(env->active_tc.HI[0]);
1003     case 35: GET_REGL(env->CP0_BadVAddr);
1004     case 36: GET_REGL((int32_t)env->CP0_Cause);
1005     case 37: GET_REGL(env->active_tc.PC);
1006     case 72: GET_REGL(0); /* fp */
1007     case 89: GET_REGL((int32_t)env->CP0_PRid);
1008     }
1009     if (n >= 73 && n <= 88) {
1010         /* 16 embedded regs.  */
1011         GET_REGL(0);
1012     }
1013
1014     return 0;
1015 }
1016
1017 /* convert MIPS rounding mode in FCR31 to IEEE library */
1018 static unsigned int ieee_rm[] =
1019   {
1020     float_round_nearest_even,
1021     float_round_to_zero,
1022     float_round_up,
1023     float_round_down
1024   };
1025 #define RESTORE_ROUNDING_MODE \
1026     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1027
1028 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1029 {
1030     target_ulong tmp;
1031
1032     tmp = ldtul_p(mem_buf);
1033
1034     if (n < 32) {
1035         env->active_tc.gpr[n] = tmp;
1036         return sizeof(target_ulong);
1037     }
1038     if (env->CP0_Config1 & (1 << CP0C1_FP)
1039             && n >= 38 && n < 73) {
1040         if (n < 70) {
1041             if (env->CP0_Status & (1 << CP0St_FR))
1042               env->active_fpu.fpr[n - 38].d = tmp;
1043             else
1044               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1045         }
1046         switch (n) {
1047         case 70:
1048             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1049             /* set rounding mode */
1050             RESTORE_ROUNDING_MODE;
1051 #ifndef CONFIG_SOFTFLOAT
1052             /* no floating point exception for native float */
1053             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1054 #endif
1055             break;
1056         case 71: env->active_fpu.fcr0 = tmp; break;
1057         }
1058         return sizeof(target_ulong);
1059     }
1060     switch (n) {
1061     case 32: env->CP0_Status = tmp; break;
1062     case 33: env->active_tc.LO[0] = tmp; break;
1063     case 34: env->active_tc.HI[0] = tmp; break;
1064     case 35: env->CP0_BadVAddr = tmp; break;
1065     case 36: env->CP0_Cause = tmp; break;
1066     case 37: env->active_tc.PC = tmp; break;
1067     case 72: /* fp, ignored */ break;
1068     default:
1069         if (n > 89)
1070             return 0;
1071         /* Other registers are readonly.  Ignore writes.  */
1072         break;
1073     }
1074
1075     return sizeof(target_ulong);
1076 }
1077 #elif defined (TARGET_SH4)
1078
1079 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1080 /* FIXME: We should use XML for this.  */
1081
1082 #define NUM_CORE_REGS 59
1083
1084 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1085 {
1086     if (n < 8) {
1087         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1088             GET_REGL(env->gregs[n + 16]);
1089         } else {
1090             GET_REGL(env->gregs[n]);
1091         }
1092     } else if (n < 16) {
1093         GET_REGL(env->gregs[n - 8]);
1094     } else if (n >= 25 && n < 41) {
1095         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1096     } else if (n >= 43 && n < 51) {
1097         GET_REGL(env->gregs[n - 43]);
1098     } else if (n >= 51 && n < 59) {
1099         GET_REGL(env->gregs[n - (51 - 16)]);
1100     }
1101     switch (n) {
1102     case 16: GET_REGL(env->pc);
1103     case 17: GET_REGL(env->pr);
1104     case 18: GET_REGL(env->gbr);
1105     case 19: GET_REGL(env->vbr);
1106     case 20: GET_REGL(env->mach);
1107     case 21: GET_REGL(env->macl);
1108     case 22: GET_REGL(env->sr);
1109     case 23: GET_REGL(env->fpul);
1110     case 24: GET_REGL(env->fpscr);
1111     case 41: GET_REGL(env->ssr);
1112     case 42: GET_REGL(env->spc);
1113     }
1114
1115     return 0;
1116 }
1117
1118 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1119 {
1120     uint32_t tmp;
1121
1122     tmp = ldl_p(mem_buf);
1123
1124     if (n < 8) {
1125         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1126             env->gregs[n + 16] = tmp;
1127         } else {
1128             env->gregs[n] = tmp;
1129         }
1130         return 4;
1131     } else if (n < 16) {
1132         env->gregs[n - 8] = tmp;
1133         return 4;
1134     } else if (n >= 25 && n < 41) {
1135         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1136     } else if (n >= 43 && n < 51) {
1137         env->gregs[n - 43] = tmp;
1138         return 4;
1139     } else if (n >= 51 && n < 59) {
1140         env->gregs[n - (51 - 16)] = tmp;
1141         return 4;
1142     }
1143     switch (n) {
1144     case 16: env->pc = tmp;
1145     case 17: env->pr = tmp;
1146     case 18: env->gbr = tmp;
1147     case 19: env->vbr = tmp;
1148     case 20: env->mach = tmp;
1149     case 21: env->macl = tmp;
1150     case 22: env->sr = tmp;
1151     case 23: env->fpul = tmp;
1152     case 24: env->fpscr = tmp;
1153     case 41: env->ssr = tmp;
1154     case 42: env->spc = tmp;
1155     default: return 0;
1156     }
1157
1158     return 4;
1159 }
1160 #elif defined (TARGET_MICROBLAZE)
1161
1162 #define NUM_CORE_REGS (32 + 5)
1163
1164 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1165 {
1166     if (n < 32) {
1167         GET_REG32(env->regs[n]);
1168     } else {
1169         GET_REG32(env->sregs[n - 32]);
1170     }
1171     return 0;
1172 }
1173
1174 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1175 {
1176     uint32_t tmp;
1177
1178     if (n > NUM_CORE_REGS)
1179         return 0;
1180
1181     tmp = ldl_p(mem_buf);
1182
1183     if (n < 32) {
1184         env->regs[n] = tmp;
1185     } else {
1186         env->sregs[n - 32] = tmp;
1187     }
1188     return 4;
1189 }
1190 #elif defined (TARGET_CRIS)
1191
1192 #define NUM_CORE_REGS 49
1193
1194 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1195 {
1196     uint8_t srs;
1197
1198     srs = env->pregs[PR_SRS];
1199     if (n < 16) {
1200         GET_REG32(env->regs[n]);
1201     }
1202
1203     if (n >= 21 && n < 32) {
1204         GET_REG32(env->pregs[n - 16]);
1205     }
1206     if (n >= 33 && n < 49) {
1207         GET_REG32(env->sregs[srs][n - 33]);
1208     }
1209     switch (n) {
1210     case 16: GET_REG8(env->pregs[0]);
1211     case 17: GET_REG8(env->pregs[1]);
1212     case 18: GET_REG32(env->pregs[2]);
1213     case 19: GET_REG8(srs);
1214     case 20: GET_REG16(env->pregs[4]);
1215     case 32: GET_REG32(env->pc);
1216     }
1217
1218     return 0;
1219 }
1220
1221 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1222 {
1223     uint32_t tmp;
1224
1225     if (n > 49)
1226         return 0;
1227
1228     tmp = ldl_p(mem_buf);
1229
1230     if (n < 16) {
1231         env->regs[n] = tmp;
1232     }
1233
1234     if (n >= 21 && n < 32) {
1235         env->pregs[n - 16] = tmp;
1236     }
1237
1238     /* FIXME: Should support function regs be writable?  */
1239     switch (n) {
1240     case 16: return 1;
1241     case 17: return 1;
1242     case 18: env->pregs[PR_PID] = tmp; break;
1243     case 19: return 1;
1244     case 20: return 2;
1245     case 32: env->pc = tmp; break;
1246     }
1247
1248     return 4;
1249 }
1250 #elif defined (TARGET_ALPHA)
1251
1252 #define NUM_CORE_REGS 65
1253
1254 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1255 {
1256     if (n < 31) {
1257        GET_REGL(env->ir[n]);
1258     }
1259     else if (n == 31) {
1260        GET_REGL(0);
1261     }
1262     else if (n<63) {
1263        uint64_t val;
1264
1265        val=*((uint64_t *)&env->fir[n-32]);
1266        GET_REGL(val);
1267     }
1268     else if (n==63) {
1269        GET_REGL(env->fpcr);
1270     }
1271     else if (n==64) {
1272        GET_REGL(env->pc);
1273     }
1274     else {
1275        GET_REGL(0);
1276     }
1277
1278     return 0;
1279 }
1280
1281 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1282 {
1283     target_ulong tmp;
1284     tmp = ldtul_p(mem_buf);
1285
1286     if (n < 31) {
1287         env->ir[n] = tmp;
1288     }
1289
1290     if (n > 31 && n < 63) {
1291         env->fir[n - 32] = ldfl_p(mem_buf);
1292     }
1293
1294     if (n == 64 ) {
1295        env->pc=tmp;
1296     }
1297
1298     return 8;
1299 }
1300 #else
1301
1302 #define NUM_CORE_REGS 0
1303
1304 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1305 {
1306     return 0;
1307 }
1308
1309 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1310 {
1311     return 0;
1312 }
1313
1314 #endif
1315
1316 static int num_g_regs = NUM_CORE_REGS;
1317
1318 #ifdef GDB_CORE_XML
1319 /* Encode data using the encoding for 'x' packets.  */
1320 static int memtox(char *buf, const char *mem, int len)
1321 {
1322     char *p = buf;
1323     char c;
1324
1325     while (len--) {
1326         c = *(mem++);
1327         switch (c) {
1328         case '#': case '$': case '*': case '}':
1329             *(p++) = '}';
1330             *(p++) = c ^ 0x20;
1331             break;
1332         default:
1333             *(p++) = c;
1334             break;
1335         }
1336     }
1337     return p - buf;
1338 }
1339
1340 static const char *get_feature_xml(const char *p, const char **newp)
1341 {
1342     extern const char *const xml_builtin[][2];
1343     size_t len;
1344     int i;
1345     const char *name;
1346     static char target_xml[1024];
1347
1348     len = 0;
1349     while (p[len] && p[len] != ':')
1350         len++;
1351     *newp = p + len;
1352
1353     name = NULL;
1354     if (strncmp(p, "target.xml", len) == 0) {
1355         /* Generate the XML description for this CPU.  */
1356         if (!target_xml[0]) {
1357             GDBRegisterState *r;
1358
1359             snprintf(target_xml, sizeof(target_xml),
1360                      "<?xml version=\"1.0\"?>"
1361                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1362                      "<target>"
1363                      "<xi:include href=\"%s\"/>",
1364                      GDB_CORE_XML);
1365
1366             for (r = first_cpu->gdb_regs; r; r = r->next) {
1367                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
1368                 pstrcat(target_xml, sizeof(target_xml), r->xml);
1369                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
1370             }
1371             pstrcat(target_xml, sizeof(target_xml), "</target>");
1372         }
1373         return target_xml;
1374     }
1375     for (i = 0; ; i++) {
1376         name = xml_builtin[i][0];
1377         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1378             break;
1379     }
1380     return name ? xml_builtin[i][1] : NULL;
1381 }
1382 #endif
1383
1384 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1385 {
1386     GDBRegisterState *r;
1387
1388     if (reg < NUM_CORE_REGS)
1389         return cpu_gdb_read_register(env, mem_buf, reg);
1390
1391     for (r = env->gdb_regs; r; r = r->next) {
1392         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1393             return r->get_reg(env, mem_buf, reg - r->base_reg);
1394         }
1395     }
1396     return 0;
1397 }
1398
1399 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1400 {
1401     GDBRegisterState *r;
1402
1403     if (reg < NUM_CORE_REGS)
1404         return cpu_gdb_write_register(env, mem_buf, reg);
1405
1406     for (r = env->gdb_regs; r; r = r->next) {
1407         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1408             return r->set_reg(env, mem_buf, reg - r->base_reg);
1409         }
1410     }
1411     return 0;
1412 }
1413
1414 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1415    specifies the first register number and these registers are included in
1416    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1417    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1418  */
1419
1420 void gdb_register_coprocessor(CPUState * env,
1421                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1422                              int num_regs, const char *xml, int g_pos)
1423 {
1424     GDBRegisterState *s;
1425     GDBRegisterState **p;
1426     static int last_reg = NUM_CORE_REGS;
1427
1428     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1429     s->base_reg = last_reg;
1430     s->num_regs = num_regs;
1431     s->get_reg = get_reg;
1432     s->set_reg = set_reg;
1433     s->xml = xml;
1434     p = &env->gdb_regs;
1435     while (*p) {
1436         /* Check for duplicates.  */
1437         if (strcmp((*p)->xml, xml) == 0)
1438             return;
1439         p = &(*p)->next;
1440     }
1441     /* Add to end of list.  */
1442     last_reg += num_regs;
1443     *p = s;
1444     if (g_pos) {
1445         if (g_pos != s->base_reg) {
1446             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1447                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1448         } else {
1449             num_g_regs = last_reg;
1450         }
1451     }
1452 }
1453
1454 #ifndef CONFIG_USER_ONLY
1455 static const int xlat_gdb_type[] = {
1456     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1457     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1458     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1459 };
1460 #endif
1461
1462 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1463 {
1464     CPUState *env;
1465     int err = 0;
1466
1467     if (kvm_enabled())
1468         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1469
1470     switch (type) {
1471     case GDB_BREAKPOINT_SW:
1472     case GDB_BREAKPOINT_HW:
1473         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1474             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1475             if (err)
1476                 break;
1477         }
1478         return err;
1479 #ifndef CONFIG_USER_ONLY
1480     case GDB_WATCHPOINT_WRITE:
1481     case GDB_WATCHPOINT_READ:
1482     case GDB_WATCHPOINT_ACCESS:
1483         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1484             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1485                                         NULL);
1486             if (err)
1487                 break;
1488         }
1489         return err;
1490 #endif
1491     default:
1492         return -ENOSYS;
1493     }
1494 }
1495
1496 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1497 {
1498     CPUState *env;
1499     int err = 0;
1500
1501     if (kvm_enabled())
1502         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1503
1504     switch (type) {
1505     case GDB_BREAKPOINT_SW:
1506     case GDB_BREAKPOINT_HW:
1507         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1508             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1509             if (err)
1510                 break;
1511         }
1512         return err;
1513 #ifndef CONFIG_USER_ONLY
1514     case GDB_WATCHPOINT_WRITE:
1515     case GDB_WATCHPOINT_READ:
1516     case GDB_WATCHPOINT_ACCESS:
1517         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1518             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1519             if (err)
1520                 break;
1521         }
1522         return err;
1523 #endif
1524     default:
1525         return -ENOSYS;
1526     }
1527 }
1528
1529 static void gdb_breakpoint_remove_all(void)
1530 {
1531     CPUState *env;
1532
1533     if (kvm_enabled()) {
1534         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1535         return;
1536     }
1537
1538     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1539         cpu_breakpoint_remove_all(env, BP_GDB);
1540 #ifndef CONFIG_USER_ONLY
1541         cpu_watchpoint_remove_all(env, BP_GDB);
1542 #endif
1543     }
1544 }
1545
1546 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1547 {
1548 #if defined(TARGET_I386)
1549     s->c_cpu->eip = pc;
1550     cpu_synchronize_state(s->c_cpu, 1);
1551 #elif defined (TARGET_PPC)
1552     s->c_cpu->nip = pc;
1553 #elif defined (TARGET_SPARC)
1554     s->c_cpu->pc = pc;
1555     s->c_cpu->npc = pc + 4;
1556 #elif defined (TARGET_ARM)
1557     s->c_cpu->regs[15] = pc;
1558 #elif defined (TARGET_SH4)
1559     s->c_cpu->pc = pc;
1560 #elif defined (TARGET_MIPS)
1561     s->c_cpu->active_tc.PC = pc;
1562 #elif defined (TARGET_MICROBLAZE)
1563     s->c_cpu->sregs[SR_PC] = pc;
1564 #elif defined (TARGET_CRIS)
1565     s->c_cpu->pc = pc;
1566 #elif defined (TARGET_ALPHA)
1567     s->c_cpu->pc = pc;
1568 #endif
1569 }
1570
1571 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1572 {
1573     CPUState *env;
1574     const char *p;
1575     int ch, reg_size, type, res, thread;
1576     char buf[MAX_PACKET_LENGTH];
1577     uint8_t mem_buf[MAX_PACKET_LENGTH];
1578     uint8_t *registers;
1579     target_ulong addr, len;
1580
1581 #ifdef DEBUG_GDB
1582     printf("command='%s'\n", line_buf);
1583 #endif
1584     p = line_buf;
1585     ch = *p++;
1586     switch(ch) {
1587     case '?':
1588         /* TODO: Make this return the correct value for user-mode.  */
1589         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1590                  s->c_cpu->cpu_index+1);
1591         put_packet(s, buf);
1592         /* Remove all the breakpoints when this query is issued,
1593          * because gdb is doing and initial connect and the state
1594          * should be cleaned up.
1595          */
1596         gdb_breakpoint_remove_all();
1597         break;
1598     case 'c':
1599         if (*p != '\0') {
1600             addr = strtoull(p, (char **)&p, 16);
1601             gdb_set_cpu_pc(s, addr);
1602         }
1603         s->signal = 0;
1604         gdb_continue(s);
1605         return RS_IDLE;
1606     case 'C':
1607         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1608         if (s->signal == -1)
1609             s->signal = 0;
1610         gdb_continue(s);
1611         return RS_IDLE;
1612     case 'k':
1613         /* Kill the target */
1614         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1615         exit(0);
1616     case 'D':
1617         /* Detach packet */
1618         gdb_breakpoint_remove_all();
1619         gdb_continue(s);
1620         put_packet(s, "OK");
1621         break;
1622     case 's':
1623         if (*p != '\0') {
1624             addr = strtoull(p, (char **)&p, 16);
1625             gdb_set_cpu_pc(s, addr);
1626         }
1627         cpu_single_step(s->c_cpu, sstep_flags);
1628         gdb_continue(s);
1629         return RS_IDLE;
1630     case 'F':
1631         {
1632             target_ulong ret;
1633             target_ulong err;
1634
1635             ret = strtoull(p, (char **)&p, 16);
1636             if (*p == ',') {
1637                 p++;
1638                 err = strtoull(p, (char **)&p, 16);
1639             } else {
1640                 err = 0;
1641             }
1642             if (*p == ',')
1643                 p++;
1644             type = *p;
1645             if (gdb_current_syscall_cb)
1646                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1647             if (type == 'C') {
1648                 put_packet(s, "T02");
1649             } else {
1650                 gdb_continue(s);
1651             }
1652         }
1653         break;
1654     case 'g':
1655         cpu_synchronize_state(s->g_cpu, 0);
1656         len = 0;
1657         for (addr = 0; addr < num_g_regs; addr++) {
1658             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1659             len += reg_size;
1660         }
1661         memtohex(buf, mem_buf, len);
1662         put_packet(s, buf);
1663         break;
1664     case 'G':
1665         registers = mem_buf;
1666         len = strlen(p) / 2;
1667         hextomem((uint8_t *)registers, p, len);
1668         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1669             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1670             len -= reg_size;
1671             registers += reg_size;
1672         }
1673         cpu_synchronize_state(s->g_cpu, 1);
1674         put_packet(s, "OK");
1675         break;
1676     case 'm':
1677         addr = strtoull(p, (char **)&p, 16);
1678         if (*p == ',')
1679             p++;
1680         len = strtoull(p, NULL, 16);
1681         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1682             put_packet (s, "E14");
1683         } else {
1684             memtohex(buf, mem_buf, len);
1685             put_packet(s, buf);
1686         }
1687         break;
1688     case 'M':
1689         addr = strtoull(p, (char **)&p, 16);
1690         if (*p == ',')
1691             p++;
1692         len = strtoull(p, (char **)&p, 16);
1693         if (*p == ':')
1694             p++;
1695         hextomem(mem_buf, p, len);
1696         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1697             put_packet(s, "E14");
1698         else
1699             put_packet(s, "OK");
1700         break;
1701     case 'p':
1702         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1703            This works, but can be very slow.  Anything new enough to
1704            understand XML also knows how to use this properly.  */
1705         if (!gdb_has_xml)
1706             goto unknown_command;
1707         addr = strtoull(p, (char **)&p, 16);
1708         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1709         if (reg_size) {
1710             memtohex(buf, mem_buf, reg_size);
1711             put_packet(s, buf);
1712         } else {
1713             put_packet(s, "E14");
1714         }
1715         break;
1716     case 'P':
1717         if (!gdb_has_xml)
1718             goto unknown_command;
1719         addr = strtoull(p, (char **)&p, 16);
1720         if (*p == '=')
1721             p++;
1722         reg_size = strlen(p) / 2;
1723         hextomem(mem_buf, p, reg_size);
1724         gdb_write_register(s->g_cpu, mem_buf, addr);
1725         put_packet(s, "OK");
1726         break;
1727     case 'Z':
1728     case 'z':
1729         type = strtoul(p, (char **)&p, 16);
1730         if (*p == ',')
1731             p++;
1732         addr = strtoull(p, (char **)&p, 16);
1733         if (*p == ',')
1734             p++;
1735         len = strtoull(p, (char **)&p, 16);
1736         if (ch == 'Z')
1737             res = gdb_breakpoint_insert(addr, len, type);
1738         else
1739             res = gdb_breakpoint_remove(addr, len, type);
1740         if (res >= 0)
1741              put_packet(s, "OK");
1742         else if (res == -ENOSYS)
1743             put_packet(s, "");
1744         else
1745             put_packet(s, "E22");
1746         break;
1747     case 'H':
1748         type = *p++;
1749         thread = strtoull(p, (char **)&p, 16);
1750         if (thread == -1 || thread == 0) {
1751             put_packet(s, "OK");
1752             break;
1753         }
1754         for (env = first_cpu; env != NULL; env = env->next_cpu)
1755             if (env->cpu_index + 1 == thread)
1756                 break;
1757         if (env == NULL) {
1758             put_packet(s, "E22");
1759             break;
1760         }
1761         switch (type) {
1762         case 'c':
1763             s->c_cpu = env;
1764             put_packet(s, "OK");
1765             break;
1766         case 'g':
1767             s->g_cpu = env;
1768             put_packet(s, "OK");
1769             break;
1770         default:
1771              put_packet(s, "E22");
1772              break;
1773         }
1774         break;
1775     case 'T':
1776         thread = strtoull(p, (char **)&p, 16);
1777 #ifndef CONFIG_USER_ONLY
1778         if (thread > 0 && thread < smp_cpus + 1)
1779 #else
1780         if (thread == 1)
1781 #endif
1782              put_packet(s, "OK");
1783         else
1784             put_packet(s, "E22");
1785         break;
1786     case 'q':
1787     case 'Q':
1788         /* parse any 'q' packets here */
1789         if (!strcmp(p,"qemu.sstepbits")) {
1790             /* Query Breakpoint bit definitions */
1791             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1792                      SSTEP_ENABLE,
1793                      SSTEP_NOIRQ,
1794                      SSTEP_NOTIMER);
1795             put_packet(s, buf);
1796             break;
1797         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1798             /* Display or change the sstep_flags */
1799             p += 10;
1800             if (*p != '=') {
1801                 /* Display current setting */
1802                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1803                 put_packet(s, buf);
1804                 break;
1805             }
1806             p++;
1807             type = strtoul(p, (char **)&p, 16);
1808             sstep_flags = type;
1809             put_packet(s, "OK");
1810             break;
1811         } else if (strcmp(p,"C") == 0) {
1812             /* "Current thread" remains vague in the spec, so always return
1813              *  the first CPU (gdb returns the first thread). */
1814             put_packet(s, "QC1");
1815             break;
1816         } else if (strcmp(p,"fThreadInfo") == 0) {
1817             s->query_cpu = first_cpu;
1818             goto report_cpuinfo;
1819         } else if (strcmp(p,"sThreadInfo") == 0) {
1820         report_cpuinfo:
1821             if (s->query_cpu) {
1822                 snprintf(buf, sizeof(buf), "m%x", s->query_cpu->cpu_index+1);
1823                 put_packet(s, buf);
1824                 s->query_cpu = s->query_cpu->next_cpu;
1825             } else
1826                 put_packet(s, "l");
1827             break;
1828         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1829             thread = strtoull(p+16, (char **)&p, 16);
1830             for (env = first_cpu; env != NULL; env = env->next_cpu)
1831                 if (env->cpu_index + 1 == thread) {
1832                     cpu_synchronize_state(env, 0);
1833                     len = snprintf((char *)mem_buf, sizeof(mem_buf),
1834                                    "CPU#%d [%s]", env->cpu_index,
1835                                    env->halted ? "halted " : "running");
1836                     memtohex(buf, mem_buf, len);
1837                     put_packet(s, buf);
1838                     break;
1839                 }
1840             break;
1841         }
1842 #ifdef CONFIG_USER_ONLY
1843         else if (strncmp(p, "Offsets", 7) == 0) {
1844             TaskState *ts = s->c_cpu->opaque;
1845
1846             snprintf(buf, sizeof(buf),
1847                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1848                      ";Bss=" TARGET_ABI_FMT_lx,
1849                      ts->info->code_offset,
1850                      ts->info->data_offset,
1851                      ts->info->data_offset);
1852             put_packet(s, buf);
1853             break;
1854         }
1855 #else /* !CONFIG_USER_ONLY */
1856         else if (strncmp(p, "Rcmd,", 5) == 0) {
1857             int len = strlen(p + 5);
1858
1859             if ((len % 2) != 0) {
1860                 put_packet(s, "E01");
1861                 break;
1862             }
1863             hextomem(mem_buf, p + 5, len);
1864             len = len / 2;
1865             mem_buf[len++] = 0;
1866             qemu_chr_read(s->mon_chr, mem_buf, len);
1867             put_packet(s, "OK");
1868             break;
1869         }
1870 #endif /* !CONFIG_USER_ONLY */
1871         if (strncmp(p, "Supported", 9) == 0) {
1872             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1873 #ifdef GDB_CORE_XML
1874             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1875 #endif
1876             put_packet(s, buf);
1877             break;
1878         }
1879 #ifdef GDB_CORE_XML
1880         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1881             const char *xml;
1882             target_ulong total_len;
1883
1884             gdb_has_xml = 1;
1885             p += 19;
1886             xml = get_feature_xml(p, &p);
1887             if (!xml) {
1888                 snprintf(buf, sizeof(buf), "E00");
1889                 put_packet(s, buf);
1890                 break;
1891             }
1892
1893             if (*p == ':')
1894                 p++;
1895             addr = strtoul(p, (char **)&p, 16);
1896             if (*p == ',')
1897                 p++;
1898             len = strtoul(p, (char **)&p, 16);
1899
1900             total_len = strlen(xml);
1901             if (addr > total_len) {
1902                 snprintf(buf, sizeof(buf), "E00");
1903                 put_packet(s, buf);
1904                 break;
1905             }
1906             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1907                 len = (MAX_PACKET_LENGTH - 5) / 2;
1908             if (len < total_len - addr) {
1909                 buf[0] = 'm';
1910                 len = memtox(buf + 1, xml + addr, len);
1911             } else {
1912                 buf[0] = 'l';
1913                 len = memtox(buf + 1, xml + addr, total_len - addr);
1914             }
1915             put_packet_binary(s, buf, len + 1);
1916             break;
1917         }
1918 #endif
1919         /* Unrecognised 'q' command.  */
1920         goto unknown_command;
1921
1922     default:
1923     unknown_command:
1924         /* put empty packet */
1925         buf[0] = '\0';
1926         put_packet(s, buf);
1927         break;
1928     }
1929     return RS_IDLE;
1930 }
1931
1932 void gdb_set_stop_cpu(CPUState *env)
1933 {
1934     gdbserver_state->c_cpu = env;
1935     gdbserver_state->g_cpu = env;
1936 }
1937
1938 #ifndef CONFIG_USER_ONLY
1939 static void gdb_vm_state_change(void *opaque, int running, int reason)
1940 {
1941     GDBState *s = gdbserver_state;
1942     CPUState *env = s->c_cpu;
1943     char buf[256];
1944     const char *type;
1945     int ret;
1946
1947     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
1948         s->state == RS_INACTIVE || s->state == RS_SYSCALL)
1949         return;
1950
1951     /* disable single step if it was enable */
1952     cpu_single_step(env, 0);
1953
1954     if (reason == EXCP_DEBUG) {
1955         if (env->watchpoint_hit) {
1956             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
1957             case BP_MEM_READ:
1958                 type = "r";
1959                 break;
1960             case BP_MEM_ACCESS:
1961                 type = "a";
1962                 break;
1963             default:
1964                 type = "";
1965                 break;
1966             }
1967             snprintf(buf, sizeof(buf),
1968                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1969                      GDB_SIGNAL_TRAP, env->cpu_index+1, type,
1970                      env->watchpoint_hit->vaddr);
1971             put_packet(s, buf);
1972             env->watchpoint_hit = NULL;
1973             return;
1974         }
1975         tb_flush(env);
1976         ret = GDB_SIGNAL_TRAP;
1977     } else {
1978         ret = GDB_SIGNAL_INT;
1979     }
1980     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, env->cpu_index+1);
1981     put_packet(s, buf);
1982 }
1983 #endif
1984
1985 /* Send a gdb syscall request.
1986    This accepts limited printf-style format specifiers, specifically:
1987     %x  - target_ulong argument printed in hex.
1988     %lx - 64-bit argument printed in hex.
1989     %s  - string pointer (target_ulong) and length (int) pair.  */
1990 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1991 {
1992     va_list va;
1993     char buf[256];
1994     char *p;
1995     target_ulong addr;
1996     uint64_t i64;
1997     GDBState *s;
1998
1999     s = gdbserver_state;
2000     if (!s)
2001         return;
2002     gdb_current_syscall_cb = cb;
2003     s->state = RS_SYSCALL;
2004 #ifndef CONFIG_USER_ONLY
2005     vm_stop(EXCP_DEBUG);
2006 #endif
2007     s->state = RS_IDLE;
2008     va_start(va, fmt);
2009     p = buf;
2010     *(p++) = 'F';
2011     while (*fmt) {
2012         if (*fmt == '%') {
2013             fmt++;
2014             switch (*fmt++) {
2015             case 'x':
2016                 addr = va_arg(va, target_ulong);
2017                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
2018                 break;
2019             case 'l':
2020                 if (*(fmt++) != 'x')
2021                     goto bad_format;
2022                 i64 = va_arg(va, uint64_t);
2023                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
2024                 break;
2025             case 's':
2026                 addr = va_arg(va, target_ulong);
2027                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
2028                               addr, va_arg(va, int));
2029                 break;
2030             default:
2031             bad_format:
2032                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2033                         fmt - 1);
2034                 break;
2035             }
2036         } else {
2037             *(p++) = *(fmt++);
2038         }
2039     }
2040     *p = 0;
2041     va_end(va);
2042     put_packet(s, buf);
2043 #ifdef CONFIG_USER_ONLY
2044     gdb_handlesig(s->c_cpu, 0);
2045 #else
2046     cpu_exit(s->c_cpu);
2047 #endif
2048 }
2049
2050 static void gdb_read_byte(GDBState *s, int ch)
2051 {
2052     int i, csum;
2053     uint8_t reply;
2054
2055 #ifndef CONFIG_USER_ONLY
2056     if (s->last_packet_len) {
2057         /* Waiting for a response to the last packet.  If we see the start
2058            of a new command then abandon the previous response.  */
2059         if (ch == '-') {
2060 #ifdef DEBUG_GDB
2061             printf("Got NACK, retransmitting\n");
2062 #endif
2063             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2064         }
2065 #ifdef DEBUG_GDB
2066         else if (ch == '+')
2067             printf("Got ACK\n");
2068         else
2069             printf("Got '%c' when expecting ACK/NACK\n", ch);
2070 #endif
2071         if (ch == '+' || ch == '$')
2072             s->last_packet_len = 0;
2073         if (ch != '$')
2074             return;
2075     }
2076     if (vm_running) {
2077         /* when the CPU is running, we cannot do anything except stop
2078            it when receiving a char */
2079         vm_stop(EXCP_INTERRUPT);
2080     } else
2081 #endif
2082     {
2083         switch(s->state) {
2084         case RS_IDLE:
2085             if (ch == '$') {
2086                 s->line_buf_index = 0;
2087                 s->state = RS_GETLINE;
2088             }
2089             break;
2090         case RS_GETLINE:
2091             if (ch == '#') {
2092             s->state = RS_CHKSUM1;
2093             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2094                 s->state = RS_IDLE;
2095             } else {
2096             s->line_buf[s->line_buf_index++] = ch;
2097             }
2098             break;
2099         case RS_CHKSUM1:
2100             s->line_buf[s->line_buf_index] = '\0';
2101             s->line_csum = fromhex(ch) << 4;
2102             s->state = RS_CHKSUM2;
2103             break;
2104         case RS_CHKSUM2:
2105             s->line_csum |= fromhex(ch);
2106             csum = 0;
2107             for(i = 0; i < s->line_buf_index; i++) {
2108                 csum += s->line_buf[i];
2109             }
2110             if (s->line_csum != (csum & 0xff)) {
2111                 reply = '-';
2112                 put_buffer(s, &reply, 1);
2113                 s->state = RS_IDLE;
2114             } else {
2115                 reply = '+';
2116                 put_buffer(s, &reply, 1);
2117                 s->state = gdb_handle_packet(s, s->line_buf);
2118             }
2119             break;
2120         default:
2121             abort();
2122         }
2123     }
2124 }
2125
2126 #ifdef CONFIG_USER_ONLY
2127 int
2128 gdb_queuesig (void)
2129 {
2130     GDBState *s;
2131
2132     s = gdbserver_state;
2133
2134     if (gdbserver_fd < 0 || s->fd < 0)
2135         return 0;
2136     else
2137         return 1;
2138 }
2139
2140 int
2141 gdb_handlesig (CPUState *env, int sig)
2142 {
2143   GDBState *s;
2144   char buf[256];
2145   int n;
2146
2147   s = gdbserver_state;
2148   if (gdbserver_fd < 0 || s->fd < 0)
2149     return sig;
2150
2151   /* disable single step if it was enabled */
2152   cpu_single_step(env, 0);
2153   tb_flush(env);
2154
2155   if (sig != 0)
2156     {
2157       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2158       put_packet(s, buf);
2159     }
2160   /* put_packet() might have detected that the peer terminated the
2161      connection.  */
2162   if (s->fd < 0)
2163       return sig;
2164
2165   sig = 0;
2166   s->state = RS_IDLE;
2167   s->running_state = 0;
2168   while (s->running_state == 0) {
2169       n = read (s->fd, buf, 256);
2170       if (n > 0)
2171         {
2172           int i;
2173
2174           for (i = 0; i < n; i++)
2175             gdb_read_byte (s, buf[i]);
2176         }
2177       else if (n == 0 || errno != EAGAIN)
2178         {
2179           /* XXX: Connection closed.  Should probably wait for annother
2180              connection before continuing.  */
2181           return sig;
2182         }
2183   }
2184   sig = s->signal;
2185   s->signal = 0;
2186   return sig;
2187 }
2188
2189 /* Tell the remote gdb that the process has exited.  */
2190 void gdb_exit(CPUState *env, int code)
2191 {
2192   GDBState *s;
2193   char buf[4];
2194
2195   s = gdbserver_state;
2196   if (gdbserver_fd < 0 || s->fd < 0)
2197     return;
2198
2199   snprintf(buf, sizeof(buf), "W%02x", code);
2200   put_packet(s, buf);
2201 }
2202
2203 /* Tell the remote gdb that the process has exited due to SIG.  */
2204 void gdb_signalled(CPUState *env, int sig)
2205 {
2206   GDBState *s;
2207   char buf[4];
2208
2209   s = gdbserver_state;
2210   if (gdbserver_fd < 0 || s->fd < 0)
2211     return;
2212
2213   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2214   put_packet(s, buf);
2215 }
2216
2217 static void gdb_accept(void)
2218 {
2219     GDBState *s;
2220     struct sockaddr_in sockaddr;
2221     socklen_t len;
2222     int val, fd;
2223
2224     for(;;) {
2225         len = sizeof(sockaddr);
2226         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2227         if (fd < 0 && errno != EINTR) {
2228             perror("accept");
2229             return;
2230         } else if (fd >= 0) {
2231             break;
2232         }
2233     }
2234
2235     /* set short latency */
2236     val = 1;
2237     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2238
2239     s = qemu_mallocz(sizeof(GDBState));
2240     s->c_cpu = first_cpu;
2241     s->g_cpu = first_cpu;
2242     s->fd = fd;
2243     gdb_has_xml = 0;
2244
2245     gdbserver_state = s;
2246
2247     fcntl(fd, F_SETFL, O_NONBLOCK);
2248 }
2249
2250 static int gdbserver_open(int port)
2251 {
2252     struct sockaddr_in sockaddr;
2253     int fd, val, ret;
2254
2255     fd = socket(PF_INET, SOCK_STREAM, 0);
2256     if (fd < 0) {
2257         perror("socket");
2258         return -1;
2259     }
2260
2261     /* allow fast reuse */
2262     val = 1;
2263     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2264
2265     sockaddr.sin_family = AF_INET;
2266     sockaddr.sin_port = htons(port);
2267     sockaddr.sin_addr.s_addr = 0;
2268     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2269     if (ret < 0) {
2270         perror("bind");
2271         return -1;
2272     }
2273     ret = listen(fd, 0);
2274     if (ret < 0) {
2275         perror("listen");
2276         return -1;
2277     }
2278     return fd;
2279 }
2280
2281 int gdbserver_start(int port)
2282 {
2283     gdbserver_fd = gdbserver_open(port);
2284     if (gdbserver_fd < 0)
2285         return -1;
2286     /* accept connections */
2287     gdb_accept();
2288     return 0;
2289 }
2290
2291 /* Disable gdb stub for child processes.  */
2292 void gdbserver_fork(CPUState *env)
2293 {
2294     GDBState *s = gdbserver_state;
2295     if (gdbserver_fd < 0 || s->fd < 0)
2296       return;
2297     close(s->fd);
2298     s->fd = -1;
2299     cpu_breakpoint_remove_all(env, BP_GDB);
2300     cpu_watchpoint_remove_all(env, BP_GDB);
2301 }
2302 #else
2303 static int gdb_chr_can_receive(void *opaque)
2304 {
2305   /* We can handle an arbitrarily large amount of data.
2306    Pick the maximum packet size, which is as good as anything.  */
2307   return MAX_PACKET_LENGTH;
2308 }
2309
2310 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2311 {
2312     int i;
2313
2314     for (i = 0; i < size; i++) {
2315         gdb_read_byte(gdbserver_state, buf[i]);
2316     }
2317 }
2318
2319 static void gdb_chr_event(void *opaque, int event)
2320 {
2321     switch (event) {
2322     case CHR_EVENT_RESET:
2323         vm_stop(EXCP_INTERRUPT);
2324         gdb_has_xml = 0;
2325         break;
2326     default:
2327         break;
2328     }
2329 }
2330
2331 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2332 {
2333     char buf[MAX_PACKET_LENGTH];
2334
2335     buf[0] = 'O';
2336     if (len > (MAX_PACKET_LENGTH/2) - 1)
2337         len = (MAX_PACKET_LENGTH/2) - 1;
2338     memtohex(buf + 1, (uint8_t *)msg, len);
2339     put_packet(s, buf);
2340 }
2341
2342 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2343 {
2344     const char *p = (const char *)buf;
2345     int max_sz;
2346
2347     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2348     for (;;) {
2349         if (len <= max_sz) {
2350             gdb_monitor_output(gdbserver_state, p, len);
2351             break;
2352         }
2353         gdb_monitor_output(gdbserver_state, p, max_sz);
2354         p += max_sz;
2355         len -= max_sz;
2356     }
2357     return len;
2358 }
2359
2360 #ifndef _WIN32
2361 static void gdb_sigterm_handler(int signal)
2362 {
2363     if (vm_running)
2364         vm_stop(EXCP_INTERRUPT);
2365 }
2366 #endif
2367
2368 int gdbserver_start(const char *device)
2369 {
2370     GDBState *s;
2371     char gdbstub_device_name[128];
2372     CharDriverState *chr = NULL;
2373     CharDriverState *mon_chr;
2374
2375     if (!device)
2376         return -1;
2377     if (strcmp(device, "none") != 0) {
2378         if (strstart(device, "tcp:", NULL)) {
2379             /* enforce required TCP attributes */
2380             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2381                      "%s,nowait,nodelay,server", device);
2382             device = gdbstub_device_name;
2383         }
2384 #ifndef _WIN32
2385         else if (strcmp(device, "stdio") == 0) {
2386             struct sigaction act;
2387
2388             memset(&act, 0, sizeof(act));
2389             act.sa_handler = gdb_sigterm_handler;
2390             sigaction(SIGINT, &act, NULL);
2391         }
2392 #endif
2393         chr = qemu_chr_open("gdb", device, NULL);
2394         if (!chr)
2395             return -1;
2396
2397         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2398                               gdb_chr_event, NULL);
2399     }
2400
2401     s = gdbserver_state;
2402     if (!s) {
2403         s = qemu_mallocz(sizeof(GDBState));
2404         gdbserver_state = s;
2405
2406         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2407
2408         /* Initialize a monitor terminal for gdb */
2409         mon_chr = qemu_mallocz(sizeof(*mon_chr));
2410         mon_chr->chr_write = gdb_monitor_write;
2411         monitor_init(mon_chr, 0);
2412     } else {
2413         if (s->chr)
2414             qemu_chr_close(s->chr);
2415         mon_chr = s->mon_chr;
2416         memset(s, 0, sizeof(GDBState));
2417     }
2418     s->c_cpu = first_cpu;
2419     s->g_cpu = first_cpu;
2420     s->chr = chr;
2421     s->state = chr ? RS_IDLE : RS_INACTIVE;
2422     s->mon_chr = mon_chr;
2423
2424     return 0;
2425 }
2426 #endif