gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA  02110-1301 USA
  19  */
  20 #include "config.h"
  21 #include "qemu-common.h"
  22 #ifdef CONFIG_USER_ONLY
  23 #include <stdlib.h>
  24 #include <stdio.h>
  25 #include <stdarg.h>
  26 #include <string.h>
  27 #include <errno.h>
  28 #include <unistd.h>
  29 #include <fcntl.h>
  30
  31 #include "qemu.h"
  32 #else
  33 #include "monitor.h"
  34 #include "qemu-char.h"
  35 #include "sysemu.h"
  36 #include "gdbstub.h"
  37 #endif
  38 #include "qemu-kvm.h"
  39
  40 #define MAX_PACKET_LENGTH 4096
  41
  42 #include "qemu_socket.h"
  43 #include "kvm.h"
  44
  45
  46 enum {
  47     GDB_SIGNAL_0 = 0,
  48     GDB_SIGNAL_INT = 2,
  49     GDB_SIGNAL_TRAP = 5,
  50     GDB_SIGNAL_UNKNOWN = 143
  51 };
  52
  53 #ifdef CONFIG_USER_ONLY
  54
  55 /* Map target signal numbers to GDB protocol signal numbers and vice
  56  * versa.  For user emulation's currently supported systems, we can
  57  * assume most signals are defined.
  58  */
  59
  60 static int gdb_signal_table[] = {
  61     0,
  62     TARGET_SIGHUP,
  63     TARGET_SIGINT,
  64     TARGET_SIGQUIT,
  65     TARGET_SIGILL,
  66     TARGET_SIGTRAP,
  67     TARGET_SIGABRT,
  68     -1, /* SIGEMT */
  69     TARGET_SIGFPE,
  70     TARGET_SIGKILL,
  71     TARGET_SIGBUS,
  72     TARGET_SIGSEGV,
  73     TARGET_SIGSYS,
  74     TARGET_SIGPIPE,
  75     TARGET_SIGALRM,
  76     TARGET_SIGTERM,
  77     TARGET_SIGURG,
  78     TARGET_SIGSTOP,
  79     TARGET_SIGTSTP,
  80     TARGET_SIGCONT,
  81     TARGET_SIGCHLD,
  82     TARGET_SIGTTIN,
  83     TARGET_SIGTTOU,
  84     TARGET_SIGIO,
  85     TARGET_SIGXCPU,
  86     TARGET_SIGXFSZ,
  87     TARGET_SIGVTALRM,
  88     TARGET_SIGPROF,
  89     TARGET_SIGWINCH,
  90     -1, /* SIGLOST */
  91     TARGET_SIGUSR1,
  92     TARGET_SIGUSR2,
  93 #ifdef TARGET_SIGPWR
  94     TARGET_SIGPWR,
  95 #else
  96     -1,
  97 #endif
  98     -1, /* SIGPOLL */
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108     -1,
 109     -1,
 110 #ifdef __SIGRTMIN
 111     __SIGRTMIN + 1,
 112     __SIGRTMIN + 2,
 113     __SIGRTMIN + 3,
 114     __SIGRTMIN + 4,
 115     __SIGRTMIN + 5,
 116     __SIGRTMIN + 6,
 117     __SIGRTMIN + 7,
 118     __SIGRTMIN + 8,
 119     __SIGRTMIN + 9,
 120     __SIGRTMIN + 10,
 121     __SIGRTMIN + 11,
 122     __SIGRTMIN + 12,
 123     __SIGRTMIN + 13,
 124     __SIGRTMIN + 14,
 125     __SIGRTMIN + 15,
 126     __SIGRTMIN + 16,
 127     __SIGRTMIN + 17,
 128     __SIGRTMIN + 18,
 129     __SIGRTMIN + 19,
 130     __SIGRTMIN + 20,
 131     __SIGRTMIN + 21,
 132     __SIGRTMIN + 22,
 133     __SIGRTMIN + 23,
 134     __SIGRTMIN + 24,
 135     __SIGRTMIN + 25,
 136     __SIGRTMIN + 26,
 137     __SIGRTMIN + 27,
 138     __SIGRTMIN + 28,
 139     __SIGRTMIN + 29,
 140     __SIGRTMIN + 30,
 141     __SIGRTMIN + 31,
 142     -1, /* SIGCANCEL */
 143     __SIGRTMIN,
 144     __SIGRTMIN + 32,
 145     __SIGRTMIN + 33,
 146     __SIGRTMIN + 34,
 147     __SIGRTMIN + 35,
 148     __SIGRTMIN + 36,
 149     __SIGRTMIN + 37,
 150     __SIGRTMIN + 38,
 151     __SIGRTMIN + 39,
 152     __SIGRTMIN + 40,
 153     __SIGRTMIN + 41,
 154     __SIGRTMIN + 42,
 155     __SIGRTMIN + 43,
 156     __SIGRTMIN + 44,
 157     __SIGRTMIN + 45,
 158     __SIGRTMIN + 46,
 159     __SIGRTMIN + 47,
 160     __SIGRTMIN + 48,
 161     __SIGRTMIN + 49,
 162     __SIGRTMIN + 50,
 163     __SIGRTMIN + 51,
 164     __SIGRTMIN + 52,
 165     __SIGRTMIN + 53,
 166     __SIGRTMIN + 54,
 167     __SIGRTMIN + 55,
 168     __SIGRTMIN + 56,
 169     __SIGRTMIN + 57,
 170     __SIGRTMIN + 58,
 171     __SIGRTMIN + 59,
 172     __SIGRTMIN + 60,
 173     __SIGRTMIN + 61,
 174     __SIGRTMIN + 62,
 175     __SIGRTMIN + 63,
 176     __SIGRTMIN + 64,
 177     __SIGRTMIN + 65,
 178     __SIGRTMIN + 66,
 179     __SIGRTMIN + 67,
 180     __SIGRTMIN + 68,
 181     __SIGRTMIN + 69,
 182     __SIGRTMIN + 70,
 183     __SIGRTMIN + 71,
 184     __SIGRTMIN + 72,
 185     __SIGRTMIN + 73,
 186     __SIGRTMIN + 74,
 187     __SIGRTMIN + 75,
 188     __SIGRTMIN + 76,
 189     __SIGRTMIN + 77,
 190     __SIGRTMIN + 78,
 191     __SIGRTMIN + 79,
 192     __SIGRTMIN + 80,
 193     __SIGRTMIN + 81,
 194     __SIGRTMIN + 82,
 195     __SIGRTMIN + 83,
 196     __SIGRTMIN + 84,
 197     __SIGRTMIN + 85,
 198     __SIGRTMIN + 86,
 199     __SIGRTMIN + 87,
 200     __SIGRTMIN + 88,
 201     __SIGRTMIN + 89,
 202     __SIGRTMIN + 90,
 203     __SIGRTMIN + 91,
 204     __SIGRTMIN + 92,
 205     __SIGRTMIN + 93,
 206     __SIGRTMIN + 94,
 207     __SIGRTMIN + 95,
 208     -1, /* SIGINFO */
 209     -1, /* UNKNOWN */
 210     -1, /* DEFAULT */
 211     -1,
 212     -1,
 213     -1,
 214     -1,
 215     -1,
 216     -1
 217 #endif
 218 };
 219 #else
 220 /* In system mode we only need SIGINT and SIGTRAP; other signals
 221    are not yet supported.  */
 222
 223 enum {
 224     TARGET_SIGINT = 2,
 225     TARGET_SIGTRAP = 5
 226 };
 227
 228 static int gdb_signal_table[] = {
 229     -1,
 230     -1,
 231     TARGET_SIGINT,
 232     -1,
 233     -1,
 234     TARGET_SIGTRAP
 235 };
 236 #endif
 237
 238 #ifdef CONFIG_USER_ONLY
 239 static int target_signal_to_gdb (int sig)
 240 {
 241     int i;
 242     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 243         if (gdb_signal_table[i] == sig)
 244             return i;
 245     return GDB_SIGNAL_UNKNOWN;
 246 }
 247 #endif
 248
 249 static int gdb_signal_to_target (int sig)
 250 {
 251     if (sig < ARRAY_SIZE (gdb_signal_table))
 252         return gdb_signal_table[sig];
 253     else
 254         return -1;
 255 }
 256
 257 //#define DEBUG_GDB
 258
 259 typedef struct GDBRegisterState {
 260     int base_reg;
 261     int num_regs;
 262     gdb_reg_cb get_reg;
 263     gdb_reg_cb set_reg;
 264     const char *xml;
 265     struct GDBRegisterState *next;
 266 } GDBRegisterState;
 267
 268 enum RSState {
 269     RS_INACTIVE,
 270     RS_IDLE,
 271     RS_GETLINE,
 272     RS_CHKSUM1,
 273     RS_CHKSUM2,
 274     RS_SYSCALL,
 275 };
 276 typedef struct GDBState {
 277     CPUState *c_cpu; /* current CPU for step/continue ops */
 278     CPUState *g_cpu; /* current CPU for other ops */
 279     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 280     enum RSState state; /* parsing state */
 281     char line_buf[MAX_PACKET_LENGTH];
 282     int line_buf_index;
 283     int line_csum;
 284     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 285     int last_packet_len;
 286     int signal;
 287 #ifdef CONFIG_USER_ONLY
 288     int fd;
 289     int running_state;
 290 #else
 291     CharDriverState *chr;
 292     CharDriverState *mon_chr;
 293 #endif
 294 } GDBState;
 295
 296 /* By default use no IRQs and no timers while single stepping so as to
 297  * make single stepping like an ICE HW step.
 298  */
 299 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 300
 301 static GDBState *gdbserver_state;
 302
 303 /* This is an ugly hack to cope with both new and old gdb.
 304    If gdb sends qXfer:features:read then assume we're talking to a newish
 305    gdb that understands target descriptions.  */
 306 static int gdb_has_xml;
 307
 308 #ifdef CONFIG_USER_ONLY
 309 /* XXX: This is not thread safe.  Do we care?  */
 310 static int gdbserver_fd = -1;
 311
 312 static int get_char(GDBState *s)
 313 {
 314     uint8_t ch;
 315     int ret;
 316
 317     for(;;) {
 318         ret = recv(s->fd, &ch, 1, 0);
 319         if (ret < 0) {
 320             if (errno == ECONNRESET)
 321                 s->fd = -1;
 322             if (errno != EINTR && errno != EAGAIN)
 323                 return -1;
 324         } else if (ret == 0) {
 325             close(s->fd);
 326             s->fd = -1;
 327             return -1;
 328         } else {
 329             break;
 330         }
 331     }
 332     return ch;
 333 }
 334 #endif
 335
 336 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 337
 338 static enum {
 339     GDB_SYS_UNKNOWN,
 340     GDB_SYS_ENABLED,
 341     GDB_SYS_DISABLED,
 342 } gdb_syscall_mode;
 343
 344 /* If gdb is connected when the first semihosting syscall occurs then use
 345    remote gdb syscalls.  Otherwise use native file IO.  */
 346 int use_gdb_syscalls(void)
 347 {
 348     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 349         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 350                                             : GDB_SYS_DISABLED);
 351     }
 352     return gdb_syscall_mode == GDB_SYS_ENABLED;
 353 }
 354
 355 /* Resume execution.  */
 356 static inline void gdb_continue(GDBState *s)
 357 {
 358 #ifdef CONFIG_USER_ONLY
 359     s->running_state = 1;
 360 #else
 361     vm_start();
 362 #endif
 363 }
 364
 365 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 366 {
 367 #ifdef CONFIG_USER_ONLY
 368     int ret;
 369
 370     while (len > 0) {
 371         ret = send(s->fd, buf, len, 0);
 372         if (ret < 0) {
 373             if (errno != EINTR && errno != EAGAIN)
 374                 return;
 375         } else {
 376             buf += ret;
 377             len -= ret;
 378         }
 379     }
 380 #else
 381     qemu_chr_write(s->chr, buf, len);
 382 #endif
 383 }
 384
 385 static inline int fromhex(int v)
 386 {
 387     if (v >= '0' && v <= '9')
 388         return v - '0';
 389     else if (v >= 'A' && v <= 'F')
 390         return v - 'A' + 10;
 391     else if (v >= 'a' && v <= 'f')
 392         return v - 'a' + 10;
 393     else
 394         return 0;
 395 }
 396
 397 static inline int tohex(int v)
 398 {
 399     if (v < 10)
 400         return v + '0';
 401     else
 402         return v - 10 + 'a';
 403 }
 404
 405 static void memtohex(char *buf, const uint8_t *mem, int len)
 406 {
 407     int i, c;
 408     char *q;
 409     q = buf;
 410     for(i = 0; i < len; i++) {
 411         c = mem[i];
 412         *q++ = tohex(c >> 4);
 413         *q++ = tohex(c & 0xf);
 414     }
 415     *q = '\0';
 416 }
 417
 418 static void hextomem(uint8_t *mem, const char *buf, int len)
 419 {
 420     int i;
 421
 422     for(i = 0; i < len; i++) {
 423         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 424         buf += 2;
 425     }
 426 }
 427
 428 /* return -1 if error, 0 if OK */
 429 static int put_packet_binary(GDBState *s, const char *buf, int len)
 430 {
 431     int csum, i;
 432     uint8_t *p;
 433
 434     for(;;) {
 435         p = s->last_packet;
 436         *(p++) = '$';
 437         memcpy(p, buf, len);
 438         p += len;
 439         csum = 0;
 440         for(i = 0; i < len; i++) {
 441             csum += buf[i];
 442         }
 443         *(p++) = '#';
 444         *(p++) = tohex((csum >> 4) & 0xf);
 445         *(p++) = tohex((csum) & 0xf);
 446
 447         s->last_packet_len = p - s->last_packet;
 448         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 449
 450 #ifdef CONFIG_USER_ONLY
 451         i = get_char(s);
 452         if (i < 0)
 453             return -1;
 454         if (i == '+')
 455             break;
 456 #else
 457         break;
 458 #endif
 459     }
 460     return 0;
 461 }
 462
 463 /* return -1 if error, 0 if OK */
 464 static int put_packet(GDBState *s, const char *buf)
 465 {
 466 #ifdef DEBUG_GDB
 467     printf("reply='%s'\n", buf);
 468 #endif
 469
 470     return put_packet_binary(s, buf, strlen(buf));
 471 }
 472
 473 /* The GDB remote protocol transfers values in target byte order.  This means
 474    we can use the raw memory access routines to access the value buffer.
 475    Conveniently, these also handle the case where the buffer is mis-aligned.
 476  */
 477 #define GET_REG8(val) do { \
 478     stb_p(mem_buf, val); \
 479     return 1; \
 480     } while(0)
 481 #define GET_REG16(val) do { \
 482     stw_p(mem_buf, val); \
 483     return 2; \
 484     } while(0)
 485 #define GET_REG32(val) do { \
 486     stl_p(mem_buf, val); \
 487     return 4; \
 488     } while(0)
 489 #define GET_REG64(val) do { \
 490     stq_p(mem_buf, val); \
 491     return 8; \
 492     } while(0)
 493
 494 #if TARGET_LONG_BITS == 64
 495 #define GET_REGL(val) GET_REG64(val)
 496 #define ldtul_p(addr) ldq_p(addr)
 497 #else
 498 #define GET_REGL(val) GET_REG32(val)
 499 #define ldtul_p(addr) ldl_p(addr)
 500 #endif
 501
 502 #if defined(TARGET_I386)
 503
 504 #ifdef TARGET_X86_64
 505 static const int gpr_map[16] = {
 506     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 507     8, 9, 10, 11, 12, 13, 14, 15
 508 };
 509 #else
 510 static const int gpr_map[8] = {0, 1, 2, 3, 4, 5, 6, 7};
 511 #endif
 512
 513 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 514
 515 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 516 {
 517     if (n < CPU_NB_REGS) {
 518         GET_REGL(env->regs[gpr_map[n]]);
 519     } else if (n >= CPU_NB_REGS + 8 && n < CPU_NB_REGS + 16) {
 520         /* FIXME: byteswap float values.  */
 521 #ifdef USE_X86LDOUBLE
 522         memcpy(mem_buf, &env->fpregs[n - (CPU_NB_REGS + 8)], 10);
 523 #else
 524         memset(mem_buf, 0, 10);
 525 #endif
 526         return 10;
 527     } else if (n >= CPU_NB_REGS + 24) {
 528         n -= CPU_NB_REGS + 24;
 529         if (n < CPU_NB_REGS) {
 530             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 531             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 532             return 16;
 533         } else if (n == CPU_NB_REGS) {
 534             GET_REG32(env->mxcsr);
 535         }
 536     } else {
 537         n -= CPU_NB_REGS;
 538         switch (n) {
 539         case 0: GET_REGL(env->eip);
 540         case 1: GET_REG32(env->eflags);
 541         case 2: GET_REG32(env->segs[R_CS].selector);
 542         case 3: GET_REG32(env->segs[R_SS].selector);
 543         case 4: GET_REG32(env->segs[R_DS].selector);
 544         case 5: GET_REG32(env->segs[R_ES].selector);
 545         case 6: GET_REG32(env->segs[R_FS].selector);
 546         case 7: GET_REG32(env->segs[R_GS].selector);
 547         /* 8...15 x87 regs.  */
 548         case 16: GET_REG32(env->fpuc);
 549         case 17: GET_REG32((env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11);
 550         case 18: GET_REG32(0); /* ftag */
 551         case 19: GET_REG32(0); /* fiseg */
 552         case 20: GET_REG32(0); /* fioff */
 553         case 21: GET_REG32(0); /* foseg */
 554         case 22: GET_REG32(0); /* fooff */
 555         case 23: GET_REG32(0); /* fop */
 556         /* 24+ xmm regs.  */
 557         }
 558     }
 559     return 0;
 560 }
 561
 562 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int i)
 563 {
 564     uint32_t tmp;
 565
 566     if (i < CPU_NB_REGS) {
 567         env->regs[gpr_map[i]] = ldtul_p(mem_buf);
 568         return sizeof(target_ulong);
 569     } else if (i >= CPU_NB_REGS + 8 && i < CPU_NB_REGS + 16) {
 570         i -= CPU_NB_REGS + 8;
 571 #ifdef USE_X86LDOUBLE
 572         memcpy(&env->fpregs[i], mem_buf, 10);
 573 #endif
 574         return 10;
 575     } else if (i >= CPU_NB_REGS + 24) {
 576         i -= CPU_NB_REGS + 24;
 577         if (i < CPU_NB_REGS) {
 578             env->xmm_regs[i].XMM_Q(0) = ldq_p(mem_buf);
 579             env->xmm_regs[i].XMM_Q(1) = ldq_p(mem_buf + 8);
 580             return 16;
 581         } else if (i == CPU_NB_REGS) {
 582             env->mxcsr = ldl_p(mem_buf);
 583             return 4;
 584         }
 585     } else {
 586         i -= CPU_NB_REGS;
 587         switch (i) {
 588         case 0: env->eip = ldtul_p(mem_buf); return sizeof(target_ulong);
 589         case 1: env->eflags = ldl_p(mem_buf); return 4;
 590 #if defined(CONFIG_USER_ONLY)
 591 #define LOAD_SEG(index, sreg)\
 592             tmp = ldl_p(mem_buf);\
 593             if (tmp != env->segs[sreg].selector)\
 594                 cpu_x86_load_seg(env, sreg, tmp);
 595 #else
 596 /* FIXME: Honor segment registers.  Needs to avoid raising an exception
 597    when the selector is invalid.  */
 598 #define LOAD_SEG(index, sreg) do {} while(0)
 599 #endif
 600         case 2: LOAD_SEG(10, R_CS); return 4;
 601         case 3: LOAD_SEG(11, R_SS); return 4;
 602         case 4: LOAD_SEG(12, R_DS); return 4;
 603         case 5: LOAD_SEG(13, R_ES); return 4;
 604         case 6: LOAD_SEG(14, R_FS); return 4;
 605         case 7: LOAD_SEG(15, R_GS); return 4;
 606         /* 8...15 x87 regs.  */
 607         case 16: env->fpuc = ldl_p(mem_buf); return 4;
 608         case 17:
 609                  tmp = ldl_p(mem_buf);
 610                  env->fpstt = (tmp >> 11) & 7;
 611                  env->fpus = tmp & ~0x3800;
 612                  return 4;
 613         case 18: /* ftag */ return 4;
 614         case 19: /* fiseg */ return 4;
 615         case 20: /* fioff */ return 4;
 616         case 21: /* foseg */ return 4;
 617         case 22: /* fooff */ return 4;
 618         case 23: /* fop */ return 4;
 619         /* 24+ xmm regs.  */
 620         }
 621     }
 622     /* Unrecognised register.  */
 623     return 0;
 624 }
 625
 626 #elif defined (TARGET_PPC)
 627
 628 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 629    expects whatever the target description contains.  Due to a
 630    historical mishap the FP registers appear in between core integer
 631    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 632    FP regs zero size when talking to a newer gdb.  */
 633 #define NUM_CORE_REGS 71
 634 #if defined (TARGET_PPC64)
 635 #define GDB_CORE_XML "power64-core.xml"
 636 #else
 637 #define GDB_CORE_XML "power-core.xml"
 638 #endif
 639
 640 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 641 {
 642     if (n < 32) {
 643         /* gprs */
 644         GET_REGL(env->gpr[n]);
 645     } else if (n < 64) {
 646         /* fprs */
 647         if (gdb_has_xml)
 648             return 0;
 649         stfq_p(mem_buf, env->fpr[n-32]);
 650         return 8;
 651     } else {
 652         switch (n) {
 653         case 64: GET_REGL(env->nip);
 654         case 65: GET_REGL(env->msr);
 655         case 66:
 656             {
 657                 uint32_t cr = 0;
 658                 int i;
 659                 for (i = 0; i < 8; i++)
 660                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 661                 GET_REG32(cr);
 662             }
 663         case 67: GET_REGL(env->lr);
 664         case 68: GET_REGL(env->ctr);
 665         case 69: GET_REGL(env->xer);
 666         case 70:
 667             {
 668                 if (gdb_has_xml)
 669                     return 0;
 670                 GET_REG32(0); /* fpscr */
 671             }
 672         }
 673     }
 674     return 0;
 675 }
 676
 677 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 678 {
 679     if (n < 32) {
 680         /* gprs */
 681         env->gpr[n] = ldtul_p(mem_buf);
 682         return sizeof(target_ulong);
 683     } else if (n < 64) {
 684         /* fprs */
 685         if (gdb_has_xml)
 686             return 0;
 687         env->fpr[n-32] = ldfq_p(mem_buf);
 688         return 8;
 689     } else {
 690         switch (n) {
 691         case 64:
 692             env->nip = ldtul_p(mem_buf);
 693             return sizeof(target_ulong);
 694         case 65:
 695             ppc_store_msr(env, ldtul_p(mem_buf));
 696             return sizeof(target_ulong);
 697         case 66:
 698             {
 699                 uint32_t cr = ldl_p(mem_buf);
 700                 int i;
 701                 for (i = 0; i < 8; i++)
 702                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 703                 return 4;
 704             }
 705         case 67:
 706             env->lr = ldtul_p(mem_buf);
 707             return sizeof(target_ulong);
 708         case 68:
 709             env->ctr = ldtul_p(mem_buf);
 710             return sizeof(target_ulong);
 711         case 69:
 712             env->xer = ldtul_p(mem_buf);
 713             return sizeof(target_ulong);
 714         case 70:
 715             /* fpscr */
 716             if (gdb_has_xml)
 717                 return 0;
 718             return 4;
 719         }
 720     }
 721     return 0;
 722 }
 723
 724 #elif defined (TARGET_SPARC)
 725
 726 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 727 #define NUM_CORE_REGS 86
 728 #else
 729 #define NUM_CORE_REGS 72
 730 #endif
 731
 732 #ifdef TARGET_ABI32
 733 #define GET_REGA(val) GET_REG32(val)
 734 #else
 735 #define GET_REGA(val) GET_REGL(val)
 736 #endif
 737
 738 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 739 {
 740     if (n < 8) {
 741         /* g0..g7 */
 742         GET_REGA(env->gregs[n]);
 743     }
 744     if (n < 32) {
 745         /* register window */
 746         GET_REGA(env->regwptr[n - 8]);
 747     }
 748 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 749     if (n < 64) {
 750         /* fprs */
 751         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 752     }
 753     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 754     switch (n) {
 755     case 64: GET_REGA(env->y);
 756     case 65: GET_REGA(GET_PSR(env));
 757     case 66: GET_REGA(env->wim);
 758     case 67: GET_REGA(env->tbr);
 759     case 68: GET_REGA(env->pc);
 760     case 69: GET_REGA(env->npc);
 761     case 70: GET_REGA(env->fsr);
 762     case 71: GET_REGA(0); /* csr */
 763     default: GET_REGA(0);
 764     }
 765 #else
 766     if (n < 64) {
 767         /* f0-f31 */
 768         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 769     }
 770     if (n < 80) {
 771         /* f32-f62 (double width, even numbers only) */
 772         uint64_t val;
 773
 774         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 775         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 776         GET_REG64(val);
 777     }
 778     switch (n) {
 779     case 80: GET_REGL(env->pc);
 780     case 81: GET_REGL(env->npc);
 781     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 782                            ((env->asi & 0xff) << 24) |
 783                            ((env->pstate & 0xfff) << 8) |
 784                            GET_CWP64(env));
 785     case 83: GET_REGL(env->fsr);
 786     case 84: GET_REGL(env->fprs);
 787     case 85: GET_REGL(env->y);
 788     }
 789 #endif
 790     return 0;
 791 }
 792
 793 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 794 {
 795 #if defined(TARGET_ABI32)
 796     abi_ulong tmp;
 797
 798     tmp = ldl_p(mem_buf);
 799 #else
 800     target_ulong tmp;
 801
 802     tmp = ldtul_p(mem_buf);
 803 #endif
 804
 805     if (n < 8) {
 806         /* g0..g7 */
 807         env->gregs[n] = tmp;
 808     } else if (n < 32) {
 809         /* register window */
 810         env->regwptr[n - 8] = tmp;
 811     }
 812 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 813     else if (n < 64) {
 814         /* fprs */
 815         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 816     } else {
 817         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 818         switch (n) {
 819         case 64: env->y = tmp; break;
 820         case 65: PUT_PSR(env, tmp); break;
 821         case 66: env->wim = tmp; break;
 822         case 67: env->tbr = tmp; break;
 823         case 68: env->pc = tmp; break;
 824         case 69: env->npc = tmp; break;
 825         case 70: env->fsr = tmp; break;
 826         default: return 0;
 827         }
 828     }
 829     return 4;
 830 #else
 831     else if (n < 64) {
 832         /* f0-f31 */
 833         env->fpr[n] = ldfl_p(mem_buf);
 834         return 4;
 835     } else if (n < 80) {
 836         /* f32-f62 (double width, even numbers only) */
 837         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 838         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 839     } else {
 840         switch (n) {
 841         case 80: env->pc = tmp; break;
 842         case 81: env->npc = tmp; break;
 843         case 82:
 844             PUT_CCR(env, tmp >> 32);
 845             env->asi = (tmp >> 24) & 0xff;
 846             env->pstate = (tmp >> 8) & 0xfff;
 847             PUT_CWP64(env, tmp & 0xff);
 848             break;
 849         case 83: env->fsr = tmp; break;
 850         case 84: env->fprs = tmp; break;
 851         case 85: env->y = tmp; break;
 852         default: return 0;
 853         }
 854     }
 855     return 8;
 856 #endif
 857 }
 858 #elif defined (TARGET_ARM)
 859
 860 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 861    whatever the target description contains.  Due to a historical mishap
 862    the FPA registers appear in between core integer regs and the CPSR.
 863    We hack round this by giving the FPA regs zero size when talking to a
 864    newer gdb.  */
 865 #define NUM_CORE_REGS 26
 866 #define GDB_CORE_XML "arm-core.xml"
 867
 868 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 869 {
 870     if (n < 16) {
 871         /* Core integer register.  */
 872         GET_REG32(env->regs[n]);
 873     }
 874     if (n < 24) {
 875         /* FPA registers.  */
 876         if (gdb_has_xml)
 877             return 0;
 878         memset(mem_buf, 0, 12);
 879         return 12;
 880     }
 881     switch (n) {
 882     case 24:
 883         /* FPA status register.  */
 884         if (gdb_has_xml)
 885             return 0;
 886         GET_REG32(0);
 887     case 25:
 888         /* CPSR */
 889         GET_REG32(cpsr_read(env));
 890     }
 891     /* Unknown register.  */
 892     return 0;
 893 }
 894
 895 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 896 {
 897     uint32_t tmp;
 898
 899     tmp = ldl_p(mem_buf);
 900
 901     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 902        cause problems if we ever implement the Jazelle DBX extensions.  */
 903     if (n == 15)
 904         tmp &= ~1;
 905
 906     if (n < 16) {
 907         /* Core integer register.  */
 908         env->regs[n] = tmp;
 909         return 4;
 910     }
 911     if (n < 24) { /* 16-23 */
 912         /* FPA registers (ignored).  */
 913         if (gdb_has_xml)
 914             return 0;
 915         return 12;
 916     }
 917     switch (n) {
 918     case 24:
 919         /* FPA status register (ignored).  */
 920         if (gdb_has_xml)
 921             return 0;
 922         return 4;
 923     case 25:
 924         /* CPSR */
 925         cpsr_write (env, tmp, 0xffffffff);
 926         return 4;
 927     }
 928     /* Unknown register.  */
 929     return 0;
 930 }
 931
 932 #elif defined (TARGET_M68K)
 933
 934 #define NUM_CORE_REGS 18
 935
 936 #define GDB_CORE_XML "cf-core.xml"
 937
 938 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 939 {
 940     if (n < 8) {
 941         /* D0-D7 */
 942         GET_REG32(env->dregs[n]);
 943     } else if (n < 16) {
 944         /* A0-A7 */
 945         GET_REG32(env->aregs[n - 8]);
 946     } else {
 947         switch (n) {
 948         case 16: GET_REG32(env->sr);
 949         case 17: GET_REG32(env->pc);
 950         }
 951     }
 952     /* FP registers not included here because they vary between
 953        ColdFire and m68k.  Use XML bits for these.  */
 954     return 0;
 955 }
 956
 957 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 958 {
 959     uint32_t tmp;
 960
 961     tmp = ldl_p(mem_buf);
 962
 963     if (n < 8) {
 964         /* D0-D7 */
 965         env->dregs[n] = tmp;
 966     } else if (n < 8) {
 967         /* A0-A7 */
 968         env->aregs[n - 8] = tmp;
 969     } else {
 970         switch (n) {
 971         case 16: env->sr = tmp; break;
 972         case 17: env->pc = tmp; break;
 973         default: return 0;
 974         }
 975     }
 976     return 4;
 977 }
 978 #elif defined (TARGET_MIPS)
 979
 980 #define NUM_CORE_REGS 73
 981
 982 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 983 {
 984     if (n < 32) {
 985         GET_REGL(env->active_tc.gpr[n]);
 986     }
 987     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
 988         if (n >= 38 && n < 70) {
 989             if (env->CP0_Status & (1 << CP0St_FR))
 990                 GET_REGL(env->active_fpu.fpr[n - 38].d);
 991             else
 992                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
 993         }
 994         switch (n) {
 995         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
 996         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
 997         }
 998     }
 999     switch (n) {
1000     case 32: GET_REGL((int32_t)env->CP0_Status);
1001     case 33: GET_REGL(env->active_tc.LO[0]);
1002     case 34: GET_REGL(env->active_tc.HI[0]);
1003     case 35: GET_REGL(env->CP0_BadVAddr);
1004     case 36: GET_REGL((int32_t)env->CP0_Cause);
1005     case 37: GET_REGL(env->active_tc.PC);
1006     case 72: GET_REGL(0); /* fp */
1007     case 89: GET_REGL((int32_t)env->CP0_PRid);
1008     }
1009     if (n >= 73 && n <= 88) {
1010         /* 16 embedded regs.  */
1011         GET_REGL(0);
1012     }
1013
1014     return 0;
1015 }
1016
1017 /* convert MIPS rounding mode in FCR31 to IEEE library */
1018 static unsigned int ieee_rm[] =
1019   {
1020     float_round_nearest_even,
1021     float_round_to_zero,
1022     float_round_up,
1023     float_round_down
1024   };
1025 #define RESTORE_ROUNDING_MODE \
1026     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1027
1028 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1029 {
1030     target_ulong tmp;
1031
1032     tmp = ldtul_p(mem_buf);
1033
1034     if (n < 32) {
1035         env->active_tc.gpr[n] = tmp;
1036         return sizeof(target_ulong);
1037     }
1038     if (env->CP0_Config1 & (1 << CP0C1_FP)
1039             && n >= 38 && n < 73) {
1040         if (n < 70) {
1041             if (env->CP0_Status & (1 << CP0St_FR))
1042               env->active_fpu.fpr[n - 38].d = tmp;
1043             else
1044               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1045         }
1046         switch (n) {
1047         case 70:
1048             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1049             /* set rounding mode */
1050             RESTORE_ROUNDING_MODE;
1051 #ifndef CONFIG_SOFTFLOAT
1052             /* no floating point exception for native float */
1053             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1054 #endif
1055             break;
1056         case 71: env->active_fpu.fcr0 = tmp; break;
1057         }
1058         return sizeof(target_ulong);
1059     }
1060     switch (n) {
1061     case 32: env->CP0_Status = tmp; break;
1062     case 33: env->active_tc.LO[0] = tmp; break;
1063     case 34: env->active_tc.HI[0] = tmp; break;
1064     case 35: env->CP0_BadVAddr = tmp; break;
1065     case 36: env->CP0_Cause = tmp; break;
1066     case 37: env->active_tc.PC = tmp; break;
1067     case 72: /* fp, ignored */ break;
1068     default:
1069         if (n > 89)
1070             return 0;
1071         /* Other registers are readonly.  Ignore writes.  */
1072         break;
1073     }
1074
1075     return sizeof(target_ulong);
1076 }
1077 #elif defined (TARGET_SH4)
1078
1079 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1080 /* FIXME: We should use XML for this.  */
1081
1082 #define NUM_CORE_REGS 59
1083
1084 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1085 {
1086     if (n < 8) {
1087         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1088             GET_REGL(env->gregs[n + 16]);
1089         } else {
1090             GET_REGL(env->gregs[n]);
1091         }
1092     } else if (n < 16) {
1093         GET_REGL(env->gregs[n - 8]);
1094     } else if (n >= 25 && n < 41) {
1095         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1096     } else if (n >= 43 && n < 51) {
1097         GET_REGL(env->gregs[n - 43]);
1098     } else if (n >= 51 && n < 59) {
1099         GET_REGL(env->gregs[n - (51 - 16)]);
1100     }
1101     switch (n) {
1102     case 16: GET_REGL(env->pc);
1103     case 17: GET_REGL(env->pr);
1104     case 18: GET_REGL(env->gbr);
1105     case 19: GET_REGL(env->vbr);
1106     case 20: GET_REGL(env->mach);
1107     case 21: GET_REGL(env->macl);
1108     case 22: GET_REGL(env->sr);
1109     case 23: GET_REGL(env->fpul);
1110     case 24: GET_REGL(env->fpscr);
1111     case 41: GET_REGL(env->ssr);
1112     case 42: GET_REGL(env->spc);
1113     }
1114
1115     return 0;
1116 }
1117
1118 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1119 {
1120     uint32_t tmp;
1121
1122     tmp = ldl_p(mem_buf);
1123
1124     if (n < 8) {
1125         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1126             env->gregs[n + 16] = tmp;
1127         } else {
1128             env->gregs[n] = tmp;
1129         }
1130         return 4;
1131     } else if (n < 16) {
1132         env->gregs[n - 8] = tmp;
1133         return 4;
1134     } else if (n >= 25 && n < 41) {
1135         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1136     } else if (n >= 43 && n < 51) {
1137         env->gregs[n - 43] = tmp;
1138         return 4;
1139     } else if (n >= 51 && n < 59) {
1140         env->gregs[n - (51 - 16)] = tmp;
1141         return 4;
1142     }
1143     switch (n) {
1144     case 16: env->pc = tmp;
1145     case 17: env->pr = tmp;
1146     case 18: env->gbr = tmp;
1147     case 19: env->vbr = tmp;
1148     case 20: env->mach = tmp;
1149     case 21: env->macl = tmp;
1150     case 22: env->sr = tmp;
1151     case 23: env->fpul = tmp;
1152     case 24: env->fpscr = tmp;
1153     case 41: env->ssr = tmp;
1154     case 42: env->spc = tmp;
1155     default: return 0;
1156     }
1157
1158     return 4;
1159 }
1160 #elif defined (TARGET_CRIS)
1161
1162 #define NUM_CORE_REGS 49
1163
1164 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1165 {
1166     uint8_t srs;
1167
1168     srs = env->pregs[PR_SRS];
1169     if (n < 16) {
1170         GET_REG32(env->regs[n]);
1171     }
1172
1173     if (n >= 21 && n < 32) {
1174         GET_REG32(env->pregs[n - 16]);
1175     }
1176     if (n >= 33 && n < 49) {
1177         GET_REG32(env->sregs[srs][n - 33]);
1178     }
1179     switch (n) {
1180     case 16: GET_REG8(env->pregs[0]);
1181     case 17: GET_REG8(env->pregs[1]);
1182     case 18: GET_REG32(env->pregs[2]);
1183     case 19: GET_REG8(srs);
1184     case 20: GET_REG16(env->pregs[4]);
1185     case 32: GET_REG32(env->pc);
1186     }
1187
1188     return 0;
1189 }
1190
1191 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1192 {
1193     uint32_t tmp;
1194
1195     if (n > 49)
1196         return 0;
1197
1198     tmp = ldl_p(mem_buf);
1199
1200     if (n < 16) {
1201         env->regs[n] = tmp;
1202     }
1203
1204     if (n >= 21 && n < 32) {
1205         env->pregs[n - 16] = tmp;
1206     }
1207
1208     /* FIXME: Should support function regs be writable?  */
1209     switch (n) {
1210     case 16: return 1;
1211     case 17: return 1;
1212     case 18: env->pregs[PR_PID] = tmp; break;
1213     case 19: return 1;
1214     case 20: return 2;
1215     case 32: env->pc = tmp; break;
1216     }
1217
1218     return 4;
1219 }
1220 #elif defined (TARGET_ALPHA)
1221
1222 #define NUM_CORE_REGS 65
1223
1224 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1225 {
1226     if (n < 31) {
1227        GET_REGL(env->ir[n]);
1228     }
1229     else if (n == 31) {
1230        GET_REGL(0);
1231     }
1232     else if (n<63) {
1233        uint64_t val;
1234
1235        val=*((uint64_t *)&env->fir[n-32]);
1236        GET_REGL(val);
1237     }
1238     else if (n==63) {
1239        GET_REGL(env->fpcr);
1240     }
1241     else if (n==64) {
1242        GET_REGL(env->pc);
1243     }
1244     else {
1245        GET_REGL(0);
1246     }
1247
1248     return 0;
1249 }
1250
1251 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1252 {
1253     target_ulong tmp;
1254     tmp = ldtul_p(mem_buf);
1255
1256     if (n < 31) {
1257         env->ir[n] = tmp;
1258     }
1259
1260     if (n > 31 && n < 63) {
1261         env->fir[n - 32] = ldfl_p(mem_buf);
1262     }
1263
1264     if (n == 64 ) {
1265        env->pc=tmp;
1266     }
1267
1268     return 8;
1269 }
1270 #else
1271
1272 #define NUM_CORE_REGS 0
1273
1274 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1275 {
1276     return 0;
1277 }
1278
1279 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1280 {
1281     return 0;
1282 }
1283
1284 #endif
1285
1286 static int num_g_regs = NUM_CORE_REGS;
1287
1288 #ifdef GDB_CORE_XML
1289 /* Encode data using the encoding for 'x' packets.  */
1290 static int memtox(char *buf, const char *mem, int len)
1291 {
1292     char *p = buf;
1293     char c;
1294
1295     while (len--) {
1296         c = *(mem++);
1297         switch (c) {
1298         case '#': case '$': case '*': case '}':
1299             *(p++) = '}';
1300             *(p++) = c ^ 0x20;
1301             break;
1302         default:
1303             *(p++) = c;
1304             break;
1305         }
1306     }
1307     return p - buf;
1308 }
1309
1310 static const char *get_feature_xml(const char *p, const char **newp)
1311 {
1312     extern const char *const xml_builtin[][2];
1313     size_t len;
1314     int i;
1315     const char *name;
1316     static char target_xml[1024];
1317
1318     len = 0;
1319     while (p[len] && p[len] != ':')
1320         len++;
1321     *newp = p + len;
1322
1323     name = NULL;
1324     if (strncmp(p, "target.xml", len) == 0) {
1325         /* Generate the XML description for this CPU.  */
1326         if (!target_xml[0]) {
1327             GDBRegisterState *r;
1328
1329             snprintf(target_xml, sizeof(target_xml),
1330                      "<?xml version=\"1.0\"?>"
1331                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1332                      "<target>"
1333                      "<xi:include href=\"%s\"/>",
1334                      GDB_CORE_XML);
1335
1336             for (r = first_cpu->gdb_regs; r; r = r->next) {
1337                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
1338                 pstrcat(target_xml, sizeof(target_xml), r->xml);
1339                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
1340             }
1341             pstrcat(target_xml, sizeof(target_xml), "</target>");
1342         }
1343         return target_xml;
1344     }
1345     for (i = 0; ; i++) {
1346         name = xml_builtin[i][0];
1347         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1348             break;
1349     }
1350     return name ? xml_builtin[i][1] : NULL;
1351 }
1352 #endif
1353
1354 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1355 {
1356     GDBRegisterState *r;
1357
1358     if (reg < NUM_CORE_REGS)
1359         return cpu_gdb_read_register(env, mem_buf, reg);
1360
1361     for (r = env->gdb_regs; r; r = r->next) {
1362         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1363             return r->get_reg(env, mem_buf, reg - r->base_reg);
1364         }
1365     }
1366     return 0;
1367 }
1368
1369 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1370 {
1371     GDBRegisterState *r;
1372
1373     if (reg < NUM_CORE_REGS)
1374         return cpu_gdb_write_register(env, mem_buf, reg);
1375
1376     for (r = env->gdb_regs; r; r = r->next) {
1377         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1378             return r->set_reg(env, mem_buf, reg - r->base_reg);
1379         }
1380     }
1381     return 0;
1382 }
1383
1384 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1385    specifies the first register number and these registers are included in
1386    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1387    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1388  */
1389
1390 void gdb_register_coprocessor(CPUState * env,
1391                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1392                              int num_regs, const char *xml, int g_pos)
1393 {
1394     GDBRegisterState *s;
1395     GDBRegisterState **p;
1396     static int last_reg = NUM_CORE_REGS;
1397
1398     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1399     s->base_reg = last_reg;
1400     s->num_regs = num_regs;
1401     s->get_reg = get_reg;
1402     s->set_reg = set_reg;
1403     s->xml = xml;
1404     p = &env->gdb_regs;
1405     while (*p) {
1406         /* Check for duplicates.  */
1407         if (strcmp((*p)->xml, xml) == 0)
1408             return;
1409         p = &(*p)->next;
1410     }
1411     /* Add to end of list.  */
1412     last_reg += num_regs;
1413     *p = s;
1414     if (g_pos) {
1415         if (g_pos != s->base_reg) {
1416             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1417                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1418         } else {
1419             num_g_regs = last_reg;
1420         }
1421     }
1422 }
1423
1424 #ifndef CONFIG_USER_ONLY
1425 static const int xlat_gdb_type[] = {
1426     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1427     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1428     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1429 };
1430 #endif
1431
1432 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1433 {
1434     CPUState *env;
1435     int err = 0;
1436
1437     if (kvm_enabled())
1438         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1439
1440     switch (type) {
1441     case GDB_BREAKPOINT_SW:
1442     case GDB_BREAKPOINT_HW:
1443         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1444             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1445             if (err)
1446                 break;
1447         }
1448         return err;
1449 #ifndef CONFIG_USER_ONLY
1450     case GDB_WATCHPOINT_WRITE:
1451     case GDB_WATCHPOINT_READ:
1452     case GDB_WATCHPOINT_ACCESS:
1453         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1454             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1455                                         NULL);
1456             if (err)
1457                 break;
1458         }
1459         return err;
1460 #endif
1461     default:
1462         return -ENOSYS;
1463     }
1464 }
1465
1466 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1467 {
1468     CPUState *env;
1469     int err = 0;
1470
1471     if (kvm_enabled())
1472         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1473
1474     switch (type) {
1475     case GDB_BREAKPOINT_SW:
1476     case GDB_BREAKPOINT_HW:
1477         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1478             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1479             if (err)
1480                 break;
1481         }
1482         return err;
1483 #ifndef CONFIG_USER_ONLY
1484     case GDB_WATCHPOINT_WRITE:
1485     case GDB_WATCHPOINT_READ:
1486     case GDB_WATCHPOINT_ACCESS:
1487         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1488             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1489             if (err)
1490                 break;
1491         }
1492         return err;
1493 #endif
1494     default:
1495         return -ENOSYS;
1496     }
1497 }
1498
1499 static void gdb_breakpoint_remove_all(void)
1500 {
1501     CPUState *env;
1502
1503     if (kvm_enabled()) {
1504         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1505         return;
1506     }
1507
1508     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1509         cpu_breakpoint_remove_all(env, BP_GDB);
1510 #ifndef CONFIG_USER_ONLY
1511         cpu_watchpoint_remove_all(env, BP_GDB);
1512 #endif
1513     }
1514 }
1515
1516 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1517 {
1518 #if defined(TARGET_I386)
1519     s->c_cpu->eip = pc;
1520     cpu_synchronize_state(s->c_cpu, 1);
1521 #elif defined (TARGET_PPC)
1522     s->c_cpu->nip = pc;
1523 #elif defined (TARGET_SPARC)
1524     s->c_cpu->pc = pc;
1525     s->c_cpu->npc = pc + 4;
1526 #elif defined (TARGET_ARM)
1527     s->c_cpu->regs[15] = pc;
1528 #elif defined (TARGET_SH4)
1529     s->c_cpu->pc = pc;
1530 #elif defined (TARGET_MIPS)
1531     s->c_cpu->active_tc.PC = pc;
1532 #elif defined (TARGET_CRIS)
1533     s->c_cpu->pc = pc;
1534 #elif defined (TARGET_ALPHA)
1535     s->c_cpu->pc = pc;
1536 #endif
1537 }
1538
1539 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1540 {
1541     CPUState *env;
1542     const char *p;
1543     int ch, reg_size, type, res, thread;
1544     char buf[MAX_PACKET_LENGTH];
1545     uint8_t mem_buf[MAX_PACKET_LENGTH];
1546     uint8_t *registers;
1547     target_ulong addr, len;
1548
1549 #ifdef DEBUG_GDB
1550     printf("command='%s'\n", line_buf);
1551 #endif
1552     p = line_buf;
1553     ch = *p++;
1554     switch(ch) {
1555     case '?':
1556         /* TODO: Make this return the correct value for user-mode.  */
1557         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1558                  s->c_cpu->cpu_index+1);
1559         put_packet(s, buf);
1560         /* Remove all the breakpoints when this query is issued,
1561          * because gdb is doing and initial connect and the state
1562          * should be cleaned up.
1563          */
1564         gdb_breakpoint_remove_all();
1565         break;
1566     case 'c':
1567         if (*p != '\0') {
1568             addr = strtoull(p, (char **)&p, 16);
1569             gdb_set_cpu_pc(s, addr);
1570         }
1571         s->signal = 0;
1572         gdb_continue(s);
1573         return RS_IDLE;
1574     case 'C':
1575         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1576         if (s->signal == -1)
1577             s->signal = 0;
1578         gdb_continue(s);
1579         return RS_IDLE;
1580     case 'k':
1581         /* Kill the target */
1582         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1583         exit(0);
1584     case 'D':
1585         /* Detach packet */
1586         gdb_breakpoint_remove_all();
1587         gdb_continue(s);
1588         put_packet(s, "OK");
1589         break;
1590     case 's':
1591         if (*p != '\0') {
1592             addr = strtoull(p, (char **)&p, 16);
1593             gdb_set_cpu_pc(s, addr);
1594         }
1595         cpu_single_step(s->c_cpu, sstep_flags);
1596         gdb_continue(s);
1597         return RS_IDLE;
1598     case 'F':
1599         {
1600             target_ulong ret;
1601             target_ulong err;
1602
1603             ret = strtoull(p, (char **)&p, 16);
1604             if (*p == ',') {
1605                 p++;
1606                 err = strtoull(p, (char **)&p, 16);
1607             } else {
1608                 err = 0;
1609             }
1610             if (*p == ',')
1611                 p++;
1612             type = *p;
1613             if (gdb_current_syscall_cb)
1614                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1615             if (type == 'C') {
1616                 put_packet(s, "T02");
1617             } else {
1618                 gdb_continue(s);
1619             }
1620         }
1621         break;
1622     case 'g':
1623         cpu_synchronize_state(s->g_cpu, 0);
1624         len = 0;
1625         for (addr = 0; addr < num_g_regs; addr++) {
1626             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1627             len += reg_size;
1628         }
1629         memtohex(buf, mem_buf, len);
1630         put_packet(s, buf);
1631         break;
1632     case 'G':
1633         registers = mem_buf;
1634         len = strlen(p) / 2;
1635         hextomem((uint8_t *)registers, p, len);
1636         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1637             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1638             len -= reg_size;
1639             registers += reg_size;
1640         }
1641         cpu_synchronize_state(s->g_cpu, 1);
1642         put_packet(s, "OK");
1643         break;
1644     case 'm':
1645         addr = strtoull(p, (char **)&p, 16);
1646         if (*p == ',')
1647             p++;
1648         len = strtoull(p, NULL, 16);
1649         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1650             put_packet (s, "E14");
1651         } else {
1652             memtohex(buf, mem_buf, len);
1653             put_packet(s, buf);
1654         }
1655         break;
1656     case 'M':
1657         addr = strtoull(p, (char **)&p, 16);
1658         if (*p == ',')
1659             p++;
1660         len = strtoull(p, (char **)&p, 16);
1661         if (*p == ':')
1662             p++;
1663         hextomem(mem_buf, p, len);
1664         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1665             put_packet(s, "E14");
1666         else
1667             put_packet(s, "OK");
1668         break;
1669     case 'p':
1670         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1671            This works, but can be very slow.  Anything new enough to
1672            understand XML also knows how to use this properly.  */
1673         if (!gdb_has_xml)
1674             goto unknown_command;
1675         addr = strtoull(p, (char **)&p, 16);
1676         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1677         if (reg_size) {
1678             memtohex(buf, mem_buf, reg_size);
1679             put_packet(s, buf);
1680         } else {
1681             put_packet(s, "E14");
1682         }
1683         break;
1684     case 'P':
1685         if (!gdb_has_xml)
1686             goto unknown_command;
1687         addr = strtoull(p, (char **)&p, 16);
1688         if (*p == '=')
1689             p++;
1690         reg_size = strlen(p) / 2;
1691         hextomem(mem_buf, p, reg_size);
1692         gdb_write_register(s->g_cpu, mem_buf, addr);
1693         put_packet(s, "OK");
1694         break;
1695     case 'Z':
1696     case 'z':
1697         type = strtoul(p, (char **)&p, 16);
1698         if (*p == ',')
1699             p++;
1700         addr = strtoull(p, (char **)&p, 16);
1701         if (*p == ',')
1702             p++;
1703         len = strtoull(p, (char **)&p, 16);
1704         if (ch == 'Z')
1705             res = gdb_breakpoint_insert(addr, len, type);
1706         else
1707             res = gdb_breakpoint_remove(addr, len, type);
1708         if (res >= 0)
1709              put_packet(s, "OK");
1710         else if (res == -ENOSYS)
1711             put_packet(s, "");
1712         else
1713             put_packet(s, "E22");
1714         break;
1715     case 'H':
1716         type = *p++;
1717         thread = strtoull(p, (char **)&p, 16);
1718         if (thread == -1 || thread == 0) {
1719             put_packet(s, "OK");
1720             break;
1721         }
1722         for (env = first_cpu; env != NULL; env = env->next_cpu)
1723             if (env->cpu_index + 1 == thread)
1724                 break;
1725         if (env == NULL) {
1726             put_packet(s, "E22");
1727             break;
1728         }
1729         switch (type) {
1730         case 'c':
1731             s->c_cpu = env;
1732             put_packet(s, "OK");
1733             break;
1734         case 'g':
1735             s->g_cpu = env;
1736             put_packet(s, "OK");
1737             break;
1738         default:
1739              put_packet(s, "E22");
1740              break;
1741         }
1742         break;
1743     case 'T':
1744         thread = strtoull(p, (char **)&p, 16);
1745 #ifndef CONFIG_USER_ONLY
1746         if (thread > 0 && thread < smp_cpus + 1)
1747 #else
1748         if (thread == 1)
1749 #endif
1750              put_packet(s, "OK");
1751         else
1752             put_packet(s, "E22");
1753         break;
1754     case 'q':
1755     case 'Q':
1756         /* parse any 'q' packets here */
1757         if (!strcmp(p,"qemu.sstepbits")) {
1758             /* Query Breakpoint bit definitions */
1759             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1760                      SSTEP_ENABLE,
1761                      SSTEP_NOIRQ,
1762                      SSTEP_NOTIMER);
1763             put_packet(s, buf);
1764             break;
1765         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1766             /* Display or change the sstep_flags */
1767             p += 10;
1768             if (*p != '=') {
1769                 /* Display current setting */
1770                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1771                 put_packet(s, buf);
1772                 break;
1773             }
1774             p++;
1775             type = strtoul(p, (char **)&p, 16);
1776             sstep_flags = type;
1777             put_packet(s, "OK");
1778             break;
1779         } else if (strcmp(p,"C") == 0) {
1780             /* "Current thread" remains vague in the spec, so always return
1781              *  the first CPU (gdb returns the first thread). */
1782             put_packet(s, "QC1");
1783             break;
1784         } else if (strcmp(p,"fThreadInfo") == 0) {
1785             s->query_cpu = first_cpu;
1786             goto report_cpuinfo;
1787         } else if (strcmp(p,"sThreadInfo") == 0) {
1788         report_cpuinfo:
1789             if (s->query_cpu) {
1790                 snprintf(buf, sizeof(buf), "m%x", s->query_cpu->cpu_index+1);
1791                 put_packet(s, buf);
1792                 s->query_cpu = s->query_cpu->next_cpu;
1793             } else
1794                 put_packet(s, "l");
1795             break;
1796         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1797             thread = strtoull(p+16, (char **)&p, 16);
1798             for (env = first_cpu; env != NULL; env = env->next_cpu)
1799                 if (env->cpu_index + 1 == thread) {
1800                     cpu_synchronize_state(env, 0);
1801                     len = snprintf((char *)mem_buf, sizeof(mem_buf),
1802                                    "CPU#%d [%s]", env->cpu_index,
1803                                    env->halted ? "halted " : "running");
1804                     memtohex(buf, mem_buf, len);
1805                     put_packet(s, buf);
1806                     break;
1807                 }
1808             break;
1809         }
1810 #ifdef CONFIG_USER_ONLY
1811         else if (strncmp(p, "Offsets", 7) == 0) {
1812             TaskState *ts = s->c_cpu->opaque;
1813
1814             snprintf(buf, sizeof(buf),
1815                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1816                      ";Bss=" TARGET_ABI_FMT_lx,
1817                      ts->info->code_offset,
1818                      ts->info->data_offset,
1819                      ts->info->data_offset);
1820             put_packet(s, buf);
1821             break;
1822         }
1823 #else /* !CONFIG_USER_ONLY */
1824         else if (strncmp(p, "Rcmd,", 5) == 0) {
1825             int len = strlen(p + 5);
1826
1827             if ((len % 2) != 0) {
1828                 put_packet(s, "E01");
1829                 break;
1830             }
1831             hextomem(mem_buf, p + 5, len);
1832             len = len / 2;
1833             mem_buf[len++] = 0;
1834             qemu_chr_read(s->mon_chr, mem_buf, len);
1835             put_packet(s, "OK");
1836             break;
1837         }
1838 #endif /* !CONFIG_USER_ONLY */
1839         if (strncmp(p, "Supported", 9) == 0) {
1840             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1841 #ifdef GDB_CORE_XML
1842             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
1843 #endif
1844             put_packet(s, buf);
1845             break;
1846         }
1847 #ifdef GDB_CORE_XML
1848         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1849             const char *xml;
1850             target_ulong total_len;
1851
1852             gdb_has_xml = 1;
1853             p += 19;
1854             xml = get_feature_xml(p, &p);
1855             if (!xml) {
1856                 snprintf(buf, sizeof(buf), "E00");
1857                 put_packet(s, buf);
1858                 break;
1859             }
1860
1861             if (*p == ':')
1862                 p++;
1863             addr = strtoul(p, (char **)&p, 16);
1864             if (*p == ',')
1865                 p++;
1866             len = strtoul(p, (char **)&p, 16);
1867
1868             total_len = strlen(xml);
1869             if (addr > total_len) {
1870                 snprintf(buf, sizeof(buf), "E00");
1871                 put_packet(s, buf);
1872                 break;
1873             }
1874             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1875                 len = (MAX_PACKET_LENGTH - 5) / 2;
1876             if (len < total_len - addr) {
1877                 buf[0] = 'm';
1878                 len = memtox(buf + 1, xml + addr, len);
1879             } else {
1880                 buf[0] = 'l';
1881                 len = memtox(buf + 1, xml + addr, total_len - addr);
1882             }
1883             put_packet_binary(s, buf, len + 1);
1884             break;
1885         }
1886 #endif
1887         /* Unrecognised 'q' command.  */
1888         goto unknown_command;
1889
1890     default:
1891     unknown_command:
1892         /* put empty packet */
1893         buf[0] = '\0';
1894         put_packet(s, buf);
1895         break;
1896     }
1897     return RS_IDLE;
1898 }
1899
1900 void gdb_set_stop_cpu(CPUState *env)
1901 {
1902     gdbserver_state->c_cpu = env;
1903     gdbserver_state->g_cpu = env;
1904 }
1905
1906 #ifndef CONFIG_USER_ONLY
1907 static void gdb_vm_state_change(void *opaque, int running, int reason)
1908 {
1909     GDBState *s = gdbserver_state;
1910     CPUState *env = s->c_cpu;
1911     char buf[256];
1912     const char *type;
1913     int ret;
1914
1915     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
1916         s->state == RS_INACTIVE || s->state == RS_SYSCALL)
1917         return;
1918
1919     /* disable single step if it was enable */
1920     cpu_single_step(env, 0);
1921
1922     if (reason == EXCP_DEBUG) {
1923         if (env->watchpoint_hit) {
1924             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
1925             case BP_MEM_READ:
1926                 type = "r";
1927                 break;
1928             case BP_MEM_ACCESS:
1929                 type = "a";
1930                 break;
1931             default:
1932                 type = "";
1933                 break;
1934             }
1935             snprintf(buf, sizeof(buf),
1936                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1937                      GDB_SIGNAL_TRAP, env->cpu_index+1, type,
1938                      env->watchpoint_hit->vaddr);
1939             put_packet(s, buf);
1940             env->watchpoint_hit = NULL;
1941             return;
1942         }
1943         tb_flush(env);
1944         ret = GDB_SIGNAL_TRAP;
1945     } else {
1946         ret = GDB_SIGNAL_INT;
1947     }
1948     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, env->cpu_index+1);
1949     put_packet(s, buf);
1950 }
1951 #endif
1952
1953 /* Send a gdb syscall request.
1954    This accepts limited printf-style format specifiers, specifically:
1955     %x  - target_ulong argument printed in hex.
1956     %lx - 64-bit argument printed in hex.
1957     %s  - string pointer (target_ulong) and length (int) pair.  */
1958 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1959 {
1960     va_list va;
1961     char buf[256];
1962     char *p;
1963     target_ulong addr;
1964     uint64_t i64;
1965     GDBState *s;
1966
1967     s = gdbserver_state;
1968     if (!s)
1969         return;
1970     gdb_current_syscall_cb = cb;
1971     s->state = RS_SYSCALL;
1972 #ifndef CONFIG_USER_ONLY
1973     vm_stop(EXCP_DEBUG);
1974 #endif
1975     s->state = RS_IDLE;
1976     va_start(va, fmt);
1977     p = buf;
1978     *(p++) = 'F';
1979     while (*fmt) {
1980         if (*fmt == '%') {
1981             fmt++;
1982             switch (*fmt++) {
1983             case 'x':
1984                 addr = va_arg(va, target_ulong);
1985                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
1986                 break;
1987             case 'l':
1988                 if (*(fmt++) != 'x')
1989                     goto bad_format;
1990                 i64 = va_arg(va, uint64_t);
1991                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
1992                 break;
1993             case 's':
1994                 addr = va_arg(va, target_ulong);
1995                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
1996                               addr, va_arg(va, int));
1997                 break;
1998             default:
1999             bad_format:
2000                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2001                         fmt - 1);
2002                 break;
2003             }
2004         } else {
2005             *(p++) = *(fmt++);
2006         }
2007     }
2008     *p = 0;
2009     va_end(va);
2010     put_packet(s, buf);
2011 #ifdef CONFIG_USER_ONLY
2012     gdb_handlesig(s->c_cpu, 0);
2013 #else
2014     cpu_exit(s->c_cpu);
2015 #endif
2016 }
2017
2018 static void gdb_read_byte(GDBState *s, int ch)
2019 {
2020     int i, csum;
2021     uint8_t reply;
2022
2023 #ifndef CONFIG_USER_ONLY
2024     if (s->last_packet_len) {
2025         /* Waiting for a response to the last packet.  If we see the start
2026            of a new command then abandon the previous response.  */
2027         if (ch == '-') {
2028 #ifdef DEBUG_GDB
2029             printf("Got NACK, retransmitting\n");
2030 #endif
2031             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2032         }
2033 #ifdef DEBUG_GDB
2034         else if (ch == '+')
2035             printf("Got ACK\n");
2036         else
2037             printf("Got '%c' when expecting ACK/NACK\n", ch);
2038 #endif
2039         if (ch == '+' || ch == '$')
2040             s->last_packet_len = 0;
2041         if (ch != '$')
2042             return;
2043     }
2044     if (vm_running) {
2045         /* when the CPU is running, we cannot do anything except stop
2046            it when receiving a char */
2047         vm_stop(EXCP_INTERRUPT);
2048     } else
2049 #endif
2050     {
2051         switch(s->state) {
2052         case RS_IDLE:
2053             if (ch == '$') {
2054                 s->line_buf_index = 0;
2055                 s->state = RS_GETLINE;
2056             }
2057             break;
2058         case RS_GETLINE:
2059             if (ch == '#') {
2060             s->state = RS_CHKSUM1;
2061             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2062                 s->state = RS_IDLE;
2063             } else {
2064             s->line_buf[s->line_buf_index++] = ch;
2065             }
2066             break;
2067         case RS_CHKSUM1:
2068             s->line_buf[s->line_buf_index] = '\0';
2069             s->line_csum = fromhex(ch) << 4;
2070             s->state = RS_CHKSUM2;
2071             break;
2072         case RS_CHKSUM2:
2073             s->line_csum |= fromhex(ch);
2074             csum = 0;
2075             for(i = 0; i < s->line_buf_index; i++) {
2076                 csum += s->line_buf[i];
2077             }
2078             if (s->line_csum != (csum & 0xff)) {
2079                 reply = '-';
2080                 put_buffer(s, &reply, 1);
2081                 s->state = RS_IDLE;
2082             } else {
2083                 reply = '+';
2084                 put_buffer(s, &reply, 1);
2085                 s->state = gdb_handle_packet(s, s->line_buf);
2086             }
2087             break;
2088         default:
2089             abort();
2090         }
2091     }
2092 }
2093
2094 #ifdef CONFIG_USER_ONLY
2095 int
2096 gdb_queuesig (void)
2097 {
2098     GDBState *s;
2099
2100     s = gdbserver_state;
2101
2102     if (gdbserver_fd < 0 || s->fd < 0)
2103         return 0;
2104     else
2105         return 1;
2106 }
2107
2108 int
2109 gdb_handlesig (CPUState *env, int sig)
2110 {
2111   GDBState *s;
2112   char buf[256];
2113   int n;
2114
2115   s = gdbserver_state;
2116   if (gdbserver_fd < 0 || s->fd < 0)
2117     return sig;
2118
2119   /* disable single step if it was enabled */
2120   cpu_single_step(env, 0);
2121   tb_flush(env);
2122
2123   if (sig != 0)
2124     {
2125       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2126       put_packet(s, buf);
2127     }
2128   /* put_packet() might have detected that the peer terminated the
2129      connection.  */
2130   if (s->fd < 0)
2131       return sig;
2132
2133   sig = 0;
2134   s->state = RS_IDLE;
2135   s->running_state = 0;
2136   while (s->running_state == 0) {
2137       n = read (s->fd, buf, 256);
2138       if (n > 0)
2139         {
2140           int i;
2141
2142           for (i = 0; i < n; i++)
2143             gdb_read_byte (s, buf[i]);
2144         }
2145       else if (n == 0 || errno != EAGAIN)
2146         {
2147           /* XXX: Connection closed.  Should probably wait for annother
2148              connection before continuing.  */
2149           return sig;
2150         }
2151   }
2152   sig = s->signal;
2153   s->signal = 0;
2154   return sig;
2155 }
2156
2157 /* Tell the remote gdb that the process has exited.  */
2158 void gdb_exit(CPUState *env, int code)
2159 {
2160   GDBState *s;
2161   char buf[4];
2162
2163   s = gdbserver_state;
2164   if (gdbserver_fd < 0 || s->fd < 0)
2165     return;
2166
2167   snprintf(buf, sizeof(buf), "W%02x", code);
2168   put_packet(s, buf);
2169 }
2170
2171 /* Tell the remote gdb that the process has exited due to SIG.  */
2172 void gdb_signalled(CPUState *env, int sig)
2173 {
2174   GDBState *s;
2175   char buf[4];
2176
2177   s = gdbserver_state;
2178   if (gdbserver_fd < 0 || s->fd < 0)
2179     return;
2180
2181   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2182   put_packet(s, buf);
2183 }
2184
2185 static void gdb_accept(void)
2186 {
2187     GDBState *s;
2188     struct sockaddr_in sockaddr;
2189     socklen_t len;
2190     int val, fd;
2191
2192     for(;;) {
2193         len = sizeof(sockaddr);
2194         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2195         if (fd < 0 && errno != EINTR) {
2196             perror("accept");
2197             return;
2198         } else if (fd >= 0) {
2199             break;
2200         }
2201     }
2202
2203     /* set short latency */
2204     val = 1;
2205     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2206
2207     s = qemu_mallocz(sizeof(GDBState));
2208     s->c_cpu = first_cpu;
2209     s->g_cpu = first_cpu;
2210     s->fd = fd;
2211     gdb_has_xml = 0;
2212
2213     gdbserver_state = s;
2214
2215     fcntl(fd, F_SETFL, O_NONBLOCK);
2216 }
2217
2218 static int gdbserver_open(int port)
2219 {
2220     struct sockaddr_in sockaddr;
2221     int fd, val, ret;
2222
2223     fd = socket(PF_INET, SOCK_STREAM, 0);
2224     if (fd < 0) {
2225         perror("socket");
2226         return -1;
2227     }
2228
2229     /* allow fast reuse */
2230     val = 1;
2231     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2232
2233     sockaddr.sin_family = AF_INET;
2234     sockaddr.sin_port = htons(port);
2235     sockaddr.sin_addr.s_addr = 0;
2236     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2237     if (ret < 0) {
2238         perror("bind");
2239         return -1;
2240     }
2241     ret = listen(fd, 0);
2242     if (ret < 0) {
2243         perror("listen");
2244         return -1;
2245     }
2246     return fd;
2247 }
2248
2249 int gdbserver_start(int port)
2250 {
2251     gdbserver_fd = gdbserver_open(port);
2252     if (gdbserver_fd < 0)
2253         return -1;
2254     /* accept connections */
2255     gdb_accept();
2256     return 0;
2257 }
2258
2259 /* Disable gdb stub for child processes.  */
2260 void gdbserver_fork(CPUState *env)
2261 {
2262     GDBState *s = gdbserver_state;
2263     if (gdbserver_fd < 0 || s->fd < 0)
2264       return;
2265     close(s->fd);
2266     s->fd = -1;
2267     cpu_breakpoint_remove_all(env, BP_GDB);
2268     cpu_watchpoint_remove_all(env, BP_GDB);
2269 }
2270 #else
2271 static int gdb_chr_can_receive(void *opaque)
2272 {
2273   /* We can handle an arbitrarily large amount of data.
2274    Pick the maximum packet size, which is as good as anything.  */
2275   return MAX_PACKET_LENGTH;
2276 }
2277
2278 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2279 {
2280     int i;
2281
2282     for (i = 0; i < size; i++) {
2283         gdb_read_byte(gdbserver_state, buf[i]);
2284     }
2285 }
2286
2287 static void gdb_chr_event(void *opaque, int event)
2288 {
2289     switch (event) {
2290     case CHR_EVENT_RESET:
2291         vm_stop(EXCP_INTERRUPT);
2292         gdb_has_xml = 0;
2293         break;
2294     default:
2295         break;
2296     }
2297 }
2298
2299 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2300 {
2301     char buf[MAX_PACKET_LENGTH];
2302
2303     buf[0] = 'O';
2304     if (len > (MAX_PACKET_LENGTH/2) - 1)
2305         len = (MAX_PACKET_LENGTH/2) - 1;
2306     memtohex(buf + 1, (uint8_t *)msg, len);
2307     put_packet(s, buf);
2308 }
2309
2310 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2311 {
2312     const char *p = (const char *)buf;
2313     int max_sz;
2314
2315     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2316     for (;;) {
2317         if (len <= max_sz) {
2318             gdb_monitor_output(gdbserver_state, p, len);
2319             break;
2320         }
2321         gdb_monitor_output(gdbserver_state, p, max_sz);
2322         p += max_sz;
2323         len -= max_sz;
2324     }
2325     return len;
2326 }
2327
2328 #ifndef _WIN32
2329 static void gdb_sigterm_handler(int signal)
2330 {
2331     if (vm_running)
2332         vm_stop(EXCP_INTERRUPT);
2333 }
2334 #endif
2335
2336 int gdbserver_start(const char *device)
2337 {
2338     GDBState *s;
2339     char gdbstub_device_name[128];
2340     CharDriverState *chr = NULL;
2341     CharDriverState *mon_chr;
2342
2343     if (!device)
2344         return -1;
2345     if (strcmp(device, "none") != 0) {
2346         if (strstart(device, "tcp:", NULL)) {
2347             /* enforce required TCP attributes */
2348             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2349                      "%s,nowait,nodelay,server", device);
2350             device = gdbstub_device_name;
2351         }
2352 #ifndef _WIN32
2353         else if (strcmp(device, "stdio") == 0) {
2354             struct sigaction act;
2355
2356             memset(&act, 0, sizeof(act));
2357             act.sa_handler = gdb_sigterm_handler;
2358             sigaction(SIGINT, &act, NULL);
2359         }
2360 #endif
2361         chr = qemu_chr_open("gdb", device, NULL);
2362         if (!chr)
2363             return -1;
2364
2365         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2366                               gdb_chr_event, NULL);
2367     }
2368
2369     s = gdbserver_state;
2370     if (!s) {
2371         s = qemu_mallocz(sizeof(GDBState));
2372         gdbserver_state = s;
2373
2374         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2375
2376         /* Initialize a monitor terminal for gdb */
2377         mon_chr = qemu_mallocz(sizeof(*mon_chr));
2378         mon_chr->chr_write = gdb_monitor_write;
2379         monitor_init(mon_chr, 0);
2380     } else {
2381         if (s->chr)
2382             qemu_chr_close(s->chr);
2383         mon_chr = s->mon_chr;
2384         memset(s, 0, sizeof(GDBState));
2385     }
2386     s->c_cpu = first_cpu;
2387     s->g_cpu = first_cpu;
2388     s->chr = chr;
2389     s->state = chr ? RS_IDLE : RS_INACTIVE;
2390     s->mon_chr = mon_chr;
2391
2392     return 0;
2393 }
2394 #endif