gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA  02110-1301 USA
  19  */
  20 #include "config.h"
  21 #include "qemu-common.h"
  22 #ifdef CONFIG_USER_ONLY
  23 #include <stdlib.h>
  24 #include <stdio.h>
  25 #include <stdarg.h>
  26 #include <string.h>
  27 #include <errno.h>
  28 #include <unistd.h>
  29 #include <fcntl.h>
  30
  31 #include "qemu.h"
  32 #else
  33 #include "monitor.h"
  34 #include "qemu-char.h"
  35 #include "sysemu.h"
  36 #include "gdbstub.h"
  37 #endif
  38
  39 #define MAX_PACKET_LENGTH 4096
  40
  41 #include "qemu_socket.h"
  42 #include "kvm.h"
  43
  44
  45 enum {
  46     GDB_SIGNAL_0 = 0,
  47     GDB_SIGNAL_INT = 2,
  48     GDB_SIGNAL_TRAP = 5,
  49     GDB_SIGNAL_UNKNOWN = 143
  50 };
  51
  52 #ifdef CONFIG_USER_ONLY
  53
  54 /* Map target signal numbers to GDB protocol signal numbers and vice
  55  * versa.  For user emulation's currently supported systems, we can
  56  * assume most signals are defined.
  57  */
  58
  59 static int gdb_signal_table[] = {
  60     0,
  61     TARGET_SIGHUP,
  62     TARGET_SIGINT,
  63     TARGET_SIGQUIT,
  64     TARGET_SIGILL,
  65     TARGET_SIGTRAP,
  66     TARGET_SIGABRT,
  67     -1, /* SIGEMT */
  68     TARGET_SIGFPE,
  69     TARGET_SIGKILL,
  70     TARGET_SIGBUS,
  71     TARGET_SIGSEGV,
  72     TARGET_SIGSYS,
  73     TARGET_SIGPIPE,
  74     TARGET_SIGALRM,
  75     TARGET_SIGTERM,
  76     TARGET_SIGURG,
  77     TARGET_SIGSTOP,
  78     TARGET_SIGTSTP,
  79     TARGET_SIGCONT,
  80     TARGET_SIGCHLD,
  81     TARGET_SIGTTIN,
  82     TARGET_SIGTTOU,
  83     TARGET_SIGIO,
  84     TARGET_SIGXCPU,
  85     TARGET_SIGXFSZ,
  86     TARGET_SIGVTALRM,
  87     TARGET_SIGPROF,
  88     TARGET_SIGWINCH,
  89     -1, /* SIGLOST */
  90     TARGET_SIGUSR1,
  91     TARGET_SIGUSR2,
  92 #ifdef TARGET_SIGPWR
  93     TARGET_SIGPWR,
  94 #else
  95     -1,
  96 #endif
  97     -1, /* SIGPOLL */
  98     -1,
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108     -1,
 109 #ifdef __SIGRTMIN
 110     __SIGRTMIN + 1,
 111     __SIGRTMIN + 2,
 112     __SIGRTMIN + 3,
 113     __SIGRTMIN + 4,
 114     __SIGRTMIN + 5,
 115     __SIGRTMIN + 6,
 116     __SIGRTMIN + 7,
 117     __SIGRTMIN + 8,
 118     __SIGRTMIN + 9,
 119     __SIGRTMIN + 10,
 120     __SIGRTMIN + 11,
 121     __SIGRTMIN + 12,
 122     __SIGRTMIN + 13,
 123     __SIGRTMIN + 14,
 124     __SIGRTMIN + 15,
 125     __SIGRTMIN + 16,
 126     __SIGRTMIN + 17,
 127     __SIGRTMIN + 18,
 128     __SIGRTMIN + 19,
 129     __SIGRTMIN + 20,
 130     __SIGRTMIN + 21,
 131     __SIGRTMIN + 22,
 132     __SIGRTMIN + 23,
 133     __SIGRTMIN + 24,
 134     __SIGRTMIN + 25,
 135     __SIGRTMIN + 26,
 136     __SIGRTMIN + 27,
 137     __SIGRTMIN + 28,
 138     __SIGRTMIN + 29,
 139     __SIGRTMIN + 30,
 140     __SIGRTMIN + 31,
 141     -1, /* SIGCANCEL */
 142     __SIGRTMIN,
 143     __SIGRTMIN + 32,
 144     __SIGRTMIN + 33,
 145     __SIGRTMIN + 34,
 146     __SIGRTMIN + 35,
 147     __SIGRTMIN + 36,
 148     __SIGRTMIN + 37,
 149     __SIGRTMIN + 38,
 150     __SIGRTMIN + 39,
 151     __SIGRTMIN + 40,
 152     __SIGRTMIN + 41,
 153     __SIGRTMIN + 42,
 154     __SIGRTMIN + 43,
 155     __SIGRTMIN + 44,
 156     __SIGRTMIN + 45,
 157     __SIGRTMIN + 46,
 158     __SIGRTMIN + 47,
 159     __SIGRTMIN + 48,
 160     __SIGRTMIN + 49,
 161     __SIGRTMIN + 50,
 162     __SIGRTMIN + 51,
 163     __SIGRTMIN + 52,
 164     __SIGRTMIN + 53,
 165     __SIGRTMIN + 54,
 166     __SIGRTMIN + 55,
 167     __SIGRTMIN + 56,
 168     __SIGRTMIN + 57,
 169     __SIGRTMIN + 58,
 170     __SIGRTMIN + 59,
 171     __SIGRTMIN + 60,
 172     __SIGRTMIN + 61,
 173     __SIGRTMIN + 62,
 174     __SIGRTMIN + 63,
 175     __SIGRTMIN + 64,
 176     __SIGRTMIN + 65,
 177     __SIGRTMIN + 66,
 178     __SIGRTMIN + 67,
 179     __SIGRTMIN + 68,
 180     __SIGRTMIN + 69,
 181     __SIGRTMIN + 70,
 182     __SIGRTMIN + 71,
 183     __SIGRTMIN + 72,
 184     __SIGRTMIN + 73,
 185     __SIGRTMIN + 74,
 186     __SIGRTMIN + 75,
 187     __SIGRTMIN + 76,
 188     __SIGRTMIN + 77,
 189     __SIGRTMIN + 78,
 190     __SIGRTMIN + 79,
 191     __SIGRTMIN + 80,
 192     __SIGRTMIN + 81,
 193     __SIGRTMIN + 82,
 194     __SIGRTMIN + 83,
 195     __SIGRTMIN + 84,
 196     __SIGRTMIN + 85,
 197     __SIGRTMIN + 86,
 198     __SIGRTMIN + 87,
 199     __SIGRTMIN + 88,
 200     __SIGRTMIN + 89,
 201     __SIGRTMIN + 90,
 202     __SIGRTMIN + 91,
 203     __SIGRTMIN + 92,
 204     __SIGRTMIN + 93,
 205     __SIGRTMIN + 94,
 206     __SIGRTMIN + 95,
 207     -1, /* SIGINFO */
 208     -1, /* UNKNOWN */
 209     -1, /* DEFAULT */
 210     -1,
 211     -1,
 212     -1,
 213     -1,
 214     -1,
 215     -1
 216 #endif
 217 };
 218 #else
 219 /* In system mode we only need SIGINT and SIGTRAP; other signals
 220    are not yet supported.  */
 221
 222 enum {
 223     TARGET_SIGINT = 2,
 224     TARGET_SIGTRAP = 5
 225 };
 226
 227 static int gdb_signal_table[] = {
 228     -1,
 229     -1,
 230     TARGET_SIGINT,
 231     -1,
 232     -1,
 233     TARGET_SIGTRAP
 234 };
 235 #endif
 236
 237 #ifdef CONFIG_USER_ONLY
 238 static int target_signal_to_gdb (int sig)
 239 {
 240     int i;
 241     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 242         if (gdb_signal_table[i] == sig)
 243             return i;
 244     return GDB_SIGNAL_UNKNOWN;
 245 }
 246 #endif
 247
 248 static int gdb_signal_to_target (int sig)
 249 {
 250     if (sig < ARRAY_SIZE (gdb_signal_table))
 251         return gdb_signal_table[sig];
 252     else
 253         return -1;
 254 }
 255
 256 //#define DEBUG_GDB
 257
 258 typedef struct GDBRegisterState {
 259     int base_reg;
 260     int num_regs;
 261     gdb_reg_cb get_reg;
 262     gdb_reg_cb set_reg;
 263     const char *xml;
 264     struct GDBRegisterState *next;
 265 } GDBRegisterState;
 266
 267 enum RSState {
 268     RS_IDLE,
 269     RS_GETLINE,
 270     RS_CHKSUM1,
 271     RS_CHKSUM2,
 272     RS_SYSCALL,
 273 };
 274 typedef struct GDBState {
 275     CPUState *c_cpu; /* current CPU for step/continue ops */
 276     CPUState *g_cpu; /* current CPU for other ops */
 277     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 278     enum RSState state; /* parsing state */
 279     char line_buf[MAX_PACKET_LENGTH];
 280     int line_buf_index;
 281     int line_csum;
 282     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 283     int last_packet_len;
 284     int signal;
 285 #ifdef CONFIG_USER_ONLY
 286     int fd;
 287     int running_state;
 288 #else
 289     CharDriverState *chr;
 290     CharDriverState *mon_chr;
 291 #endif
 292 } GDBState;
 293
 294 /* By default use no IRQs and no timers while single stepping so as to
 295  * make single stepping like an ICE HW step.
 296  */
 297 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 298
 299 static GDBState *gdbserver_state;
 300
 301 /* This is an ugly hack to cope with both new and old gdb.
 302    If gdb sends qXfer:features:read then assume we're talking to a newish
 303    gdb that understands target descriptions.  */
 304 static int gdb_has_xml;
 305
 306 #ifdef CONFIG_USER_ONLY
 307 /* XXX: This is not thread safe.  Do we care?  */
 308 static int gdbserver_fd = -1;
 309
 310 static int get_char(GDBState *s)
 311 {
 312     uint8_t ch;
 313     int ret;
 314
 315     for(;;) {
 316         ret = recv(s->fd, &ch, 1, 0);
 317         if (ret < 0) {
 318             if (errno == ECONNRESET)
 319                 s->fd = -1;
 320             if (errno != EINTR && errno != EAGAIN)
 321                 return -1;
 322         } else if (ret == 0) {
 323             close(s->fd);
 324             s->fd = -1;
 325             return -1;
 326         } else {
 327             break;
 328         }
 329     }
 330     return ch;
 331 }
 332 #endif
 333
 334 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 335
 336 enum {
 337     GDB_SYS_UNKNOWN,
 338     GDB_SYS_ENABLED,
 339     GDB_SYS_DISABLED,
 340 } gdb_syscall_mode;
 341
 342 /* If gdb is connected when the first semihosting syscall occurs then use
 343    remote gdb syscalls.  Otherwise use native file IO.  */
 344 int use_gdb_syscalls(void)
 345 {
 346     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 347         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 348                                             : GDB_SYS_DISABLED);
 349     }
 350     return gdb_syscall_mode == GDB_SYS_ENABLED;
 351 }
 352
 353 /* Resume execution.  */
 354 static inline void gdb_continue(GDBState *s)
 355 {
 356 #ifdef CONFIG_USER_ONLY
 357     s->running_state = 1;
 358 #else
 359     vm_start();
 360 #endif
 361 }
 362
 363 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 364 {
 365 #ifdef CONFIG_USER_ONLY
 366     int ret;
 367
 368     while (len > 0) {
 369         ret = send(s->fd, buf, len, 0);
 370         if (ret < 0) {
 371             if (errno != EINTR && errno != EAGAIN)
 372                 return;
 373         } else {
 374             buf += ret;
 375             len -= ret;
 376         }
 377     }
 378 #else
 379     qemu_chr_write(s->chr, buf, len);
 380 #endif
 381 }
 382
 383 static inline int fromhex(int v)
 384 {
 385     if (v >= '0' && v <= '9')
 386         return v - '0';
 387     else if (v >= 'A' && v <= 'F')
 388         return v - 'A' + 10;
 389     else if (v >= 'a' && v <= 'f')
 390         return v - 'a' + 10;
 391     else
 392         return 0;
 393 }
 394
 395 static inline int tohex(int v)
 396 {
 397     if (v < 10)
 398         return v + '0';
 399     else
 400         return v - 10 + 'a';
 401 }
 402
 403 static void memtohex(char *buf, const uint8_t *mem, int len)
 404 {
 405     int i, c;
 406     char *q;
 407     q = buf;
 408     for(i = 0; i < len; i++) {
 409         c = mem[i];
 410         *q++ = tohex(c >> 4);
 411         *q++ = tohex(c & 0xf);
 412     }
 413     *q = '\0';
 414 }
 415
 416 static void hextomem(uint8_t *mem, const char *buf, int len)
 417 {
 418     int i;
 419
 420     for(i = 0; i < len; i++) {
 421         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 422         buf += 2;
 423     }
 424 }
 425
 426 /* return -1 if error, 0 if OK */
 427 static int put_packet_binary(GDBState *s, const char *buf, int len)
 428 {
 429     int csum, i;
 430     uint8_t *p;
 431
 432     for(;;) {
 433         p = s->last_packet;
 434         *(p++) = '$';
 435         memcpy(p, buf, len);
 436         p += len;
 437         csum = 0;
 438         for(i = 0; i < len; i++) {
 439             csum += buf[i];
 440         }
 441         *(p++) = '#';
 442         *(p++) = tohex((csum >> 4) & 0xf);
 443         *(p++) = tohex((csum) & 0xf);
 444
 445         s->last_packet_len = p - s->last_packet;
 446         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 447
 448 #ifdef CONFIG_USER_ONLY
 449         i = get_char(s);
 450         if (i < 0)
 451             return -1;
 452         if (i == '+')
 453             break;
 454 #else
 455         break;
 456 #endif
 457     }
 458     return 0;
 459 }
 460
 461 /* return -1 if error, 0 if OK */
 462 static int put_packet(GDBState *s, const char *buf)
 463 {
 464 #ifdef DEBUG_GDB
 465     printf("reply='%s'\n", buf);
 466 #endif
 467
 468     return put_packet_binary(s, buf, strlen(buf));
 469 }
 470
 471 /* The GDB remote protocol transfers values in target byte order.  This means
 472    we can use the raw memory access routines to access the value buffer.
 473    Conveniently, these also handle the case where the buffer is mis-aligned.
 474  */
 475 #define GET_REG8(val) do { \
 476     stb_p(mem_buf, val); \
 477     return 1; \
 478     } while(0)
 479 #define GET_REG16(val) do { \
 480     stw_p(mem_buf, val); \
 481     return 2; \
 482     } while(0)
 483 #define GET_REG32(val) do { \
 484     stl_p(mem_buf, val); \
 485     return 4; \
 486     } while(0)
 487 #define GET_REG64(val) do { \
 488     stq_p(mem_buf, val); \
 489     return 8; \
 490     } while(0)
 491
 492 #if TARGET_LONG_BITS == 64
 493 #define GET_REGL(val) GET_REG64(val)
 494 #define ldtul_p(addr) ldq_p(addr)
 495 #else
 496 #define GET_REGL(val) GET_REG32(val)
 497 #define ldtul_p(addr) ldl_p(addr)
 498 #endif
 499
 500 #if defined(TARGET_I386)
 501
 502 #ifdef TARGET_X86_64
 503 static const int gpr_map[16] = {
 504     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 505     8, 9, 10, 11, 12, 13, 14, 15
 506 };
 507 #else
 508 static const int gpr_map[8] = {0, 1, 2, 3, 4, 5, 6, 7};
 509 #endif
 510
 511 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 512
 513 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 514 {
 515     if (n < CPU_NB_REGS) {
 516         GET_REGL(env->regs[gpr_map[n]]);
 517     } else if (n >= CPU_NB_REGS + 8 && n < CPU_NB_REGS + 16) {
 518         /* FIXME: byteswap float values.  */
 519 #ifdef USE_X86LDOUBLE
 520         memcpy(mem_buf, &env->fpregs[n - (CPU_NB_REGS + 8)], 10);
 521 #else
 522         memset(mem_buf, 0, 10);
 523 #endif
 524         return 10;
 525     } else if (n >= CPU_NB_REGS + 24) {
 526         n -= CPU_NB_REGS + 24;
 527         if (n < CPU_NB_REGS) {
 528             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 529             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 530             return 16;
 531         } else if (n == CPU_NB_REGS) {
 532             GET_REG32(env->mxcsr);
 533         }
 534     } else {
 535         n -= CPU_NB_REGS;
 536         switch (n) {
 537         case 0: GET_REGL(env->eip);
 538         case 1: GET_REG32(env->eflags);
 539         case 2: GET_REG32(env->segs[R_CS].selector);
 540         case 3: GET_REG32(env->segs[R_SS].selector);
 541         case 4: GET_REG32(env->segs[R_DS].selector);
 542         case 5: GET_REG32(env->segs[R_ES].selector);
 543         case 6: GET_REG32(env->segs[R_FS].selector);
 544         case 7: GET_REG32(env->segs[R_GS].selector);
 545         /* 8...15 x87 regs.  */
 546         case 16: GET_REG32(env->fpuc);
 547         case 17: GET_REG32((env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11);
 548         case 18: GET_REG32(0); /* ftag */
 549         case 19: GET_REG32(0); /* fiseg */
 550         case 20: GET_REG32(0); /* fioff */
 551         case 21: GET_REG32(0); /* foseg */
 552         case 22: GET_REG32(0); /* fooff */
 553         case 23: GET_REG32(0); /* fop */
 554         /* 24+ xmm regs.  */
 555         }
 556     }
 557     return 0;
 558 }
 559
 560 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int i)
 561 {
 562     uint32_t tmp;
 563
 564     if (i < CPU_NB_REGS) {
 565         env->regs[gpr_map[i]] = ldtul_p(mem_buf);
 566         return sizeof(target_ulong);
 567     } else if (i >= CPU_NB_REGS + 8 && i < CPU_NB_REGS + 16) {
 568         i -= CPU_NB_REGS + 8;
 569 #ifdef USE_X86LDOUBLE
 570         memcpy(&env->fpregs[i], mem_buf, 10);
 571 #endif
 572         return 10;
 573     } else if (i >= CPU_NB_REGS + 24) {
 574         i -= CPU_NB_REGS + 24;
 575         if (i < CPU_NB_REGS) {
 576             env->xmm_regs[i].XMM_Q(0) = ldq_p(mem_buf);
 577             env->xmm_regs[i].XMM_Q(1) = ldq_p(mem_buf + 8);
 578             return 16;
 579         } else if (i == CPU_NB_REGS) {
 580             env->mxcsr = ldl_p(mem_buf);
 581             return 4;
 582         }
 583     } else {
 584         i -= CPU_NB_REGS;
 585         switch (i) {
 586         case 0: env->eip = ldtul_p(mem_buf); return sizeof(target_ulong);
 587         case 1: env->eflags = ldl_p(mem_buf); return 4;
 588 #if defined(CONFIG_USER_ONLY)
 589 #define LOAD_SEG(index, sreg)\
 590             tmp = ldl_p(mem_buf);\
 591             if (tmp != env->segs[sreg].selector)\
 592                 cpu_x86_load_seg(env, sreg, tmp);
 593 #else
 594 /* FIXME: Honor segment registers.  Needs to avoid raising an exception
 595    when the selector is invalid.  */
 596 #define LOAD_SEG(index, sreg) do {} while(0)
 597 #endif
 598         case 2: LOAD_SEG(10, R_CS); return 4;
 599         case 3: LOAD_SEG(11, R_SS); return 4;
 600         case 4: LOAD_SEG(12, R_DS); return 4;
 601         case 5: LOAD_SEG(13, R_ES); return 4;
 602         case 6: LOAD_SEG(14, R_FS); return 4;
 603         case 7: LOAD_SEG(15, R_GS); return 4;
 604         /* 8...15 x87 regs.  */
 605         case 16: env->fpuc = ldl_p(mem_buf); return 4;
 606         case 17:
 607                  tmp = ldl_p(mem_buf);
 608                  env->fpstt = (tmp >> 11) & 7;
 609                  env->fpus = tmp & ~0x3800;
 610                  return 4;
 611         case 18: /* ftag */ return 4;
 612         case 19: /* fiseg */ return 4;
 613         case 20: /* fioff */ return 4;
 614         case 21: /* foseg */ return 4;
 615         case 22: /* fooff */ return 4;
 616         case 23: /* fop */ return 4;
 617         /* 24+ xmm regs.  */
 618         }
 619     }
 620     /* Unrecognised register.  */
 621     return 0;
 622 }
 623
 624 #elif defined (TARGET_PPC)
 625
 626 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 627    expects whatever the target description contains.  Due to a
 628    historical mishap the FP registers appear in between core integer
 629    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 630    FP regs zero size when talking to a newer gdb.  */
 631 #define NUM_CORE_REGS 71
 632 #if defined (TARGET_PPC64)
 633 #define GDB_CORE_XML "power64-core.xml"
 634 #else
 635 #define GDB_CORE_XML "power-core.xml"
 636 #endif
 637
 638 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 639 {
 640     if (n < 32) {
 641         /* gprs */
 642         GET_REGL(env->gpr[n]);
 643     } else if (n < 64) {
 644         /* fprs */
 645         if (gdb_has_xml)
 646             return 0;
 647         stfq_p(mem_buf, env->fpr[n-32]);
 648         return 8;
 649     } else {
 650         switch (n) {
 651         case 64: GET_REGL(env->nip);
 652         case 65: GET_REGL(env->msr);
 653         case 66:
 654             {
 655                 uint32_t cr = 0;
 656                 int i;
 657                 for (i = 0; i < 8; i++)
 658                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 659                 GET_REG32(cr);
 660             }
 661         case 67: GET_REGL(env->lr);
 662         case 68: GET_REGL(env->ctr);
 663         case 69: GET_REGL(env->xer);
 664         case 70:
 665             {
 666                 if (gdb_has_xml)
 667                     return 0;
 668                 GET_REG32(0); /* fpscr */
 669             }
 670         }
 671     }
 672     return 0;
 673 }
 674
 675 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 676 {
 677     if (n < 32) {
 678         /* gprs */
 679         env->gpr[n] = ldtul_p(mem_buf);
 680         return sizeof(target_ulong);
 681     } else if (n < 64) {
 682         /* fprs */
 683         if (gdb_has_xml)
 684             return 0;
 685         env->fpr[n-32] = ldfq_p(mem_buf);
 686         return 8;
 687     } else {
 688         switch (n) {
 689         case 64:
 690             env->nip = ldtul_p(mem_buf);
 691             return sizeof(target_ulong);
 692         case 65:
 693             ppc_store_msr(env, ldtul_p(mem_buf));
 694             return sizeof(target_ulong);
 695         case 66:
 696             {
 697                 uint32_t cr = ldl_p(mem_buf);
 698                 int i;
 699                 for (i = 0; i < 8; i++)
 700                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 701                 return 4;
 702             }
 703         case 67:
 704             env->lr = ldtul_p(mem_buf);
 705             return sizeof(target_ulong);
 706         case 68:
 707             env->ctr = ldtul_p(mem_buf);
 708             return sizeof(target_ulong);
 709         case 69:
 710             env->xer = ldtul_p(mem_buf);
 711             return sizeof(target_ulong);
 712         case 70:
 713             /* fpscr */
 714             if (gdb_has_xml)
 715                 return 0;
 716             return 4;
 717         }
 718     }
 719     return 0;
 720 }
 721
 722 #elif defined (TARGET_SPARC)
 723
 724 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 725 #define NUM_CORE_REGS 86
 726 #else
 727 #define NUM_CORE_REGS 72
 728 #endif
 729
 730 #ifdef TARGET_ABI32
 731 #define GET_REGA(val) GET_REG32(val)
 732 #else
 733 #define GET_REGA(val) GET_REGL(val)
 734 #endif
 735
 736 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 737 {
 738     if (n < 8) {
 739         /* g0..g7 */
 740         GET_REGA(env->gregs[n]);
 741     }
 742     if (n < 32) {
 743         /* register window */
 744         GET_REGA(env->regwptr[n - 8]);
 745     }
 746 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 747     if (n < 64) {
 748         /* fprs */
 749         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 750     }
 751     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 752     switch (n) {
 753     case 64: GET_REGA(env->y);
 754     case 65: GET_REGA(GET_PSR(env));
 755     case 66: GET_REGA(env->wim);
 756     case 67: GET_REGA(env->tbr);
 757     case 68: GET_REGA(env->pc);
 758     case 69: GET_REGA(env->npc);
 759     case 70: GET_REGA(env->fsr);
 760     case 71: GET_REGA(0); /* csr */
 761     default: GET_REGA(0);
 762     }
 763 #else
 764     if (n < 64) {
 765         /* f0-f31 */
 766         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 767     }
 768     if (n < 80) {
 769         /* f32-f62 (double width, even numbers only) */
 770         uint64_t val;
 771
 772         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 773         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 774         GET_REG64(val);
 775     }
 776     switch (n) {
 777     case 80: GET_REGL(env->pc);
 778     case 81: GET_REGL(env->npc);
 779     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 780                            ((env->asi & 0xff) << 24) |
 781                            ((env->pstate & 0xfff) << 8) |
 782                            GET_CWP64(env));
 783     case 83: GET_REGL(env->fsr);
 784     case 84: GET_REGL(env->fprs);
 785     case 85: GET_REGL(env->y);
 786     }
 787 #endif
 788     return 0;
 789 }
 790
 791 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 792 {
 793 #if defined(TARGET_ABI32)
 794     abi_ulong tmp;
 795
 796     tmp = ldl_p(mem_buf);
 797 #else
 798     target_ulong tmp;
 799
 800     tmp = ldtul_p(mem_buf);
 801 #endif
 802
 803     if (n < 8) {
 804         /* g0..g7 */
 805         env->gregs[n] = tmp;
 806     } else if (n < 32) {
 807         /* register window */
 808         env->regwptr[n - 8] = tmp;
 809     }
 810 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 811     else if (n < 64) {
 812         /* fprs */
 813         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 814     } else {
 815         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 816         switch (n) {
 817         case 64: env->y = tmp; break;
 818         case 65: PUT_PSR(env, tmp); break;
 819         case 66: env->wim = tmp; break;
 820         case 67: env->tbr = tmp; break;
 821         case 68: env->pc = tmp; break;
 822         case 69: env->npc = tmp; break;
 823         case 70: env->fsr = tmp; break;
 824         default: return 0;
 825         }
 826     }
 827     return 4;
 828 #else
 829     else if (n < 64) {
 830         /* f0-f31 */
 831         env->fpr[n] = ldfl_p(mem_buf);
 832         return 4;
 833     } else if (n < 80) {
 834         /* f32-f62 (double width, even numbers only) */
 835         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 836         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 837     } else {
 838         switch (n) {
 839         case 80: env->pc = tmp; break;
 840         case 81: env->npc = tmp; break;
 841         case 82:
 842             PUT_CCR(env, tmp >> 32);
 843             env->asi = (tmp >> 24) & 0xff;
 844             env->pstate = (tmp >> 8) & 0xfff;
 845             PUT_CWP64(env, tmp & 0xff);
 846             break;
 847         case 83: env->fsr = tmp; break;
 848         case 84: env->fprs = tmp; break;
 849         case 85: env->y = tmp; break;
 850         default: return 0;
 851         }
 852     }
 853     return 8;
 854 #endif
 855 }
 856 #elif defined (TARGET_ARM)
 857
 858 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 859    whatever the target description contains.  Due to a historical mishap
 860    the FPA registers appear in between core integer regs and the CPSR.
 861    We hack round this by giving the FPA regs zero size when talking to a
 862    newer gdb.  */
 863 #define NUM_CORE_REGS 26
 864 #define GDB_CORE_XML "arm-core.xml"
 865
 866 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 867 {
 868     if (n < 16) {
 869         /* Core integer register.  */
 870         GET_REG32(env->regs[n]);
 871     }
 872     if (n < 24) {
 873         /* FPA registers.  */
 874         if (gdb_has_xml)
 875             return 0;
 876         memset(mem_buf, 0, 12);
 877         return 12;
 878     }
 879     switch (n) {
 880     case 24:
 881         /* FPA status register.  */
 882         if (gdb_has_xml)
 883             return 0;
 884         GET_REG32(0);
 885     case 25:
 886         /* CPSR */
 887         GET_REG32(cpsr_read(env));
 888     }
 889     /* Unknown register.  */
 890     return 0;
 891 }
 892
 893 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 894 {
 895     uint32_t tmp;
 896
 897     tmp = ldl_p(mem_buf);
 898
 899     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 900        cause problems if we ever implement the Jazelle DBX extensions.  */
 901     if (n == 15)
 902         tmp &= ~1;
 903
 904     if (n < 16) {
 905         /* Core integer register.  */
 906         env->regs[n] = tmp;
 907         return 4;
 908     }
 909     if (n < 24) { /* 16-23 */
 910         /* FPA registers (ignored).  */
 911         if (gdb_has_xml)
 912             return 0;
 913         return 12;
 914     }
 915     switch (n) {
 916     case 24:
 917         /* FPA status register (ignored).  */
 918         if (gdb_has_xml)
 919             return 0;
 920         return 4;
 921     case 25:
 922         /* CPSR */
 923         cpsr_write (env, tmp, 0xffffffff);
 924         return 4;
 925     }
 926     /* Unknown register.  */
 927     return 0;
 928 }
 929
 930 #elif defined (TARGET_M68K)
 931
 932 #define NUM_CORE_REGS 18
 933
 934 #define GDB_CORE_XML "cf-core.xml"
 935
 936 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 937 {
 938     if (n < 8) {
 939         /* D0-D7 */
 940         GET_REG32(env->dregs[n]);
 941     } else if (n < 16) {
 942         /* A0-A7 */
 943         GET_REG32(env->aregs[n - 8]);
 944     } else {
 945         switch (n) {
 946         case 16: GET_REG32(env->sr);
 947         case 17: GET_REG32(env->pc);
 948         }
 949     }
 950     /* FP registers not included here because they vary between
 951        ColdFire and m68k.  Use XML bits for these.  */
 952     return 0;
 953 }
 954
 955 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 956 {
 957     uint32_t tmp;
 958
 959     tmp = ldl_p(mem_buf);
 960
 961     if (n < 8) {
 962         /* D0-D7 */
 963         env->dregs[n] = tmp;
 964     } else if (n < 8) {
 965         /* A0-A7 */
 966         env->aregs[n - 8] = tmp;
 967     } else {
 968         switch (n) {
 969         case 16: env->sr = tmp; break;
 970         case 17: env->pc = tmp; break;
 971         default: return 0;
 972         }
 973     }
 974     return 4;
 975 }
 976 #elif defined (TARGET_MIPS)
 977
 978 #define NUM_CORE_REGS 73
 979
 980 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 981 {
 982     if (n < 32) {
 983         GET_REGL(env->active_tc.gpr[n]);
 984     }
 985     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
 986         if (n >= 38 && n < 70) {
 987             if (env->CP0_Status & (1 << CP0St_FR))
 988                 GET_REGL(env->active_fpu.fpr[n - 38].d);
 989             else
 990                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
 991         }
 992         switch (n) {
 993         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
 994         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
 995         }
 996     }
 997     switch (n) {
 998     case 32: GET_REGL((int32_t)env->CP0_Status);
 999     case 33: GET_REGL(env->active_tc.LO[0]);
1000     case 34: GET_REGL(env->active_tc.HI[0]);
1001     case 35: GET_REGL(env->CP0_BadVAddr);
1002     case 36: GET_REGL((int32_t)env->CP0_Cause);
1003     case 37: GET_REGL(env->active_tc.PC);
1004     case 72: GET_REGL(0); /* fp */
1005     case 89: GET_REGL((int32_t)env->CP0_PRid);
1006     }
1007     if (n >= 73 && n <= 88) {
1008         /* 16 embedded regs.  */
1009         GET_REGL(0);
1010     }
1011
1012     return 0;
1013 }
1014
1015 /* convert MIPS rounding mode in FCR31 to IEEE library */
1016 static unsigned int ieee_rm[] =
1017   {
1018     float_round_nearest_even,
1019     float_round_to_zero,
1020     float_round_up,
1021     float_round_down
1022   };
1023 #define RESTORE_ROUNDING_MODE \
1024     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1025
1026 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1027 {
1028     target_ulong tmp;
1029
1030     tmp = ldtul_p(mem_buf);
1031
1032     if (n < 32) {
1033         env->active_tc.gpr[n] = tmp;
1034         return sizeof(target_ulong);
1035     }
1036     if (env->CP0_Config1 & (1 << CP0C1_FP)
1037             && n >= 38 && n < 73) {
1038         if (n < 70) {
1039             if (env->CP0_Status & (1 << CP0St_FR))
1040               env->active_fpu.fpr[n - 38].d = tmp;
1041             else
1042               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1043         }
1044         switch (n) {
1045         case 70:
1046             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1047             /* set rounding mode */
1048             RESTORE_ROUNDING_MODE;
1049 #ifndef CONFIG_SOFTFLOAT
1050             /* no floating point exception for native float */
1051             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1052 #endif
1053             break;
1054         case 71: env->active_fpu.fcr0 = tmp; break;
1055         }
1056         return sizeof(target_ulong);
1057     }
1058     switch (n) {
1059     case 32: env->CP0_Status = tmp; break;
1060     case 33: env->active_tc.LO[0] = tmp; break;
1061     case 34: env->active_tc.HI[0] = tmp; break;
1062     case 35: env->CP0_BadVAddr = tmp; break;
1063     case 36: env->CP0_Cause = tmp; break;
1064     case 37: env->active_tc.PC = tmp; break;
1065     case 72: /* fp, ignored */ break;
1066     default:
1067         if (n > 89)
1068             return 0;
1069         /* Other registers are readonly.  Ignore writes.  */
1070         break;
1071     }
1072
1073     return sizeof(target_ulong);
1074 }
1075 #elif defined (TARGET_SH4)
1076
1077 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1078 /* FIXME: We should use XML for this.  */
1079
1080 #define NUM_CORE_REGS 59
1081
1082 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1083 {
1084     if (n < 8) {
1085         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1086             GET_REGL(env->gregs[n + 16]);
1087         } else {
1088             GET_REGL(env->gregs[n]);
1089         }
1090     } else if (n < 16) {
1091         GET_REGL(env->gregs[n - 8]);
1092     } else if (n >= 25 && n < 41) {
1093         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1094     } else if (n >= 43 && n < 51) {
1095         GET_REGL(env->gregs[n - 43]);
1096     } else if (n >= 51 && n < 59) {
1097         GET_REGL(env->gregs[n - (51 - 16)]);
1098     }
1099     switch (n) {
1100     case 16: GET_REGL(env->pc);
1101     case 17: GET_REGL(env->pr);
1102     case 18: GET_REGL(env->gbr);
1103     case 19: GET_REGL(env->vbr);
1104     case 20: GET_REGL(env->mach);
1105     case 21: GET_REGL(env->macl);
1106     case 22: GET_REGL(env->sr);
1107     case 23: GET_REGL(env->fpul);
1108     case 24: GET_REGL(env->fpscr);
1109     case 41: GET_REGL(env->ssr);
1110     case 42: GET_REGL(env->spc);
1111     }
1112
1113     return 0;
1114 }
1115
1116 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1117 {
1118     uint32_t tmp;
1119
1120     tmp = ldl_p(mem_buf);
1121
1122     if (n < 8) {
1123         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1124             env->gregs[n + 16] = tmp;
1125         } else {
1126             env->gregs[n] = tmp;
1127         }
1128         return 4;
1129     } else if (n < 16) {
1130         env->gregs[n - 8] = tmp;
1131         return 4;
1132     } else if (n >= 25 && n < 41) {
1133         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1134     } else if (n >= 43 && n < 51) {
1135         env->gregs[n - 43] = tmp;
1136         return 4;
1137     } else if (n >= 51 && n < 59) {
1138         env->gregs[n - (51 - 16)] = tmp;
1139         return 4;
1140     }
1141     switch (n) {
1142     case 16: env->pc = tmp;
1143     case 17: env->pr = tmp;
1144     case 18: env->gbr = tmp;
1145     case 19: env->vbr = tmp;
1146     case 20: env->mach = tmp;
1147     case 21: env->macl = tmp;
1148     case 22: env->sr = tmp;
1149     case 23: env->fpul = tmp;
1150     case 24: env->fpscr = tmp;
1151     case 41: env->ssr = tmp;
1152     case 42: env->spc = tmp;
1153     default: return 0;
1154     }
1155
1156     return 4;
1157 }
1158 #elif defined (TARGET_CRIS)
1159
1160 #define NUM_CORE_REGS 49
1161
1162 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1163 {
1164     uint8_t srs;
1165
1166     srs = env->pregs[PR_SRS];
1167     if (n < 16) {
1168         GET_REG32(env->regs[n]);
1169     }
1170
1171     if (n >= 21 && n < 32) {
1172         GET_REG32(env->pregs[n - 16]);
1173     }
1174     if (n >= 33 && n < 49) {
1175         GET_REG32(env->sregs[srs][n - 33]);
1176     }
1177     switch (n) {
1178     case 16: GET_REG8(env->pregs[0]);
1179     case 17: GET_REG8(env->pregs[1]);
1180     case 18: GET_REG32(env->pregs[2]);
1181     case 19: GET_REG8(srs);
1182     case 20: GET_REG16(env->pregs[4]);
1183     case 32: GET_REG32(env->pc);
1184     }
1185
1186     return 0;
1187 }
1188
1189 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1190 {
1191     uint32_t tmp;
1192
1193     if (n > 49)
1194         return 0;
1195
1196     tmp = ldl_p(mem_buf);
1197
1198     if (n < 16) {
1199         env->regs[n] = tmp;
1200     }
1201
1202     if (n >= 21 && n < 32) {
1203         env->pregs[n - 16] = tmp;
1204     }
1205
1206     /* FIXME: Should support function regs be writable?  */
1207     switch (n) {
1208     case 16: return 1;
1209     case 17: return 1;
1210     case 18: env->pregs[PR_PID] = tmp; break;
1211     case 19: return 1;
1212     case 20: return 2;
1213     case 32: env->pc = tmp; break;
1214     }
1215
1216     return 4;
1217 }
1218 #elif defined (TARGET_ALPHA)
1219
1220 #define NUM_CORE_REGS 65
1221
1222 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1223 {
1224     if (n < 31) {
1225        GET_REGL(env->ir[n]);
1226     }
1227     else if (n == 31) {
1228        GET_REGL(0);
1229     }
1230     else if (n<63) {
1231        uint64_t val;
1232
1233        val=*((uint64_t *)&env->fir[n-32]);
1234        GET_REGL(val);
1235     }
1236     else if (n==63) {
1237        GET_REGL(env->fpcr);
1238     }
1239     else if (n==64) {
1240        GET_REGL(env->pc);
1241     }
1242     else {
1243        GET_REGL(0);
1244     }
1245
1246     return 0;
1247 }
1248
1249 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1250 {
1251     target_ulong tmp;
1252     tmp = ldtul_p(mem_buf);
1253
1254     if (n < 31) {
1255         env->ir[n] = tmp;
1256     }
1257
1258     if (n > 31 && n < 63) {
1259         env->fir[n - 32] = ldfl_p(mem_buf);
1260     }
1261
1262     if (n == 64 ) {
1263        env->pc=tmp;
1264     }
1265
1266     return 8;
1267 }
1268 #else
1269
1270 #define NUM_CORE_REGS 0
1271
1272 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1273 {
1274     return 0;
1275 }
1276
1277 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1278 {
1279     return 0;
1280 }
1281
1282 #endif
1283
1284 static int num_g_regs = NUM_CORE_REGS;
1285
1286 #ifdef GDB_CORE_XML
1287 /* Encode data using the encoding for 'x' packets.  */
1288 static int memtox(char *buf, const char *mem, int len)
1289 {
1290     char *p = buf;
1291     char c;
1292
1293     while (len--) {
1294         c = *(mem++);
1295         switch (c) {
1296         case '#': case '$': case '*': case '}':
1297             *(p++) = '}';
1298             *(p++) = c ^ 0x20;
1299             break;
1300         default:
1301             *(p++) = c;
1302             break;
1303         }
1304     }
1305     return p - buf;
1306 }
1307
1308 static const char *get_feature_xml(const char *p, const char **newp)
1309 {
1310     extern const char *const xml_builtin[][2];
1311     size_t len;
1312     int i;
1313     const char *name;
1314     static char target_xml[1024];
1315
1316     len = 0;
1317     while (p[len] && p[len] != ':')
1318         len++;
1319     *newp = p + len;
1320
1321     name = NULL;
1322     if (strncmp(p, "target.xml", len) == 0) {
1323         /* Generate the XML description for this CPU.  */
1324         if (!target_xml[0]) {
1325             GDBRegisterState *r;
1326
1327             snprintf(target_xml, sizeof(target_xml),
1328                      "<?xml version=\"1.0\"?>"
1329                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1330                      "<target>"
1331                      "<xi:include href=\"%s\"/>",
1332                      GDB_CORE_XML);
1333
1334             for (r = first_cpu->gdb_regs; r; r = r->next) {
1335                 strcat(target_xml, "<xi:include href=\"");
1336                 strcat(target_xml, r->xml);
1337                 strcat(target_xml, "\"/>");
1338             }
1339             strcat(target_xml, "</target>");
1340         }
1341         return target_xml;
1342     }
1343     for (i = 0; ; i++) {
1344         name = xml_builtin[i][0];
1345         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1346             break;
1347     }
1348     return name ? xml_builtin[i][1] : NULL;
1349 }
1350 #endif
1351
1352 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1353 {
1354     GDBRegisterState *r;
1355
1356     if (reg < NUM_CORE_REGS)
1357         return cpu_gdb_read_register(env, mem_buf, reg);
1358
1359     for (r = env->gdb_regs; r; r = r->next) {
1360         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1361             return r->get_reg(env, mem_buf, reg - r->base_reg);
1362         }
1363     }
1364     return 0;
1365 }
1366
1367 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1368 {
1369     GDBRegisterState *r;
1370
1371     if (reg < NUM_CORE_REGS)
1372         return cpu_gdb_write_register(env, mem_buf, reg);
1373
1374     for (r = env->gdb_regs; r; r = r->next) {
1375         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1376             return r->set_reg(env, mem_buf, reg - r->base_reg);
1377         }
1378     }
1379     return 0;
1380 }
1381
1382 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1383    specifies the first register number and these registers are included in
1384    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1385    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1386  */
1387
1388 void gdb_register_coprocessor(CPUState * env,
1389                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1390                              int num_regs, const char *xml, int g_pos)
1391 {
1392     GDBRegisterState *s;
1393     GDBRegisterState **p;
1394     static int last_reg = NUM_CORE_REGS;
1395
1396     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1397     s->base_reg = last_reg;
1398     s->num_regs = num_regs;
1399     s->get_reg = get_reg;
1400     s->set_reg = set_reg;
1401     s->xml = xml;
1402     p = &env->gdb_regs;
1403     while (*p) {
1404         /* Check for duplicates.  */
1405         if (strcmp((*p)->xml, xml) == 0)
1406             return;
1407         p = &(*p)->next;
1408     }
1409     /* Add to end of list.  */
1410     last_reg += num_regs;
1411     *p = s;
1412     if (g_pos) {
1413         if (g_pos != s->base_reg) {
1414             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1415                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1416         } else {
1417             num_g_regs = last_reg;
1418         }
1419     }
1420 }
1421
1422 #ifndef CONFIG_USER_ONLY
1423 static const int xlat_gdb_type[] = {
1424     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1425     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1426     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1427 };
1428 #endif
1429
1430 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1431 {
1432     CPUState *env;
1433     int err = 0;
1434
1435     if (kvm_enabled())
1436         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1437
1438     switch (type) {
1439     case GDB_BREAKPOINT_SW:
1440     case GDB_BREAKPOINT_HW:
1441         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1442             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1443             if (err)
1444                 break;
1445         }
1446         return err;
1447 #ifndef CONFIG_USER_ONLY
1448     case GDB_WATCHPOINT_WRITE:
1449     case GDB_WATCHPOINT_READ:
1450     case GDB_WATCHPOINT_ACCESS:
1451         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1452             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1453                                         NULL);
1454             if (err)
1455                 break;
1456         }
1457         return err;
1458 #endif
1459     default:
1460         return -ENOSYS;
1461     }
1462 }
1463
1464 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1465 {
1466     CPUState *env;
1467     int err = 0;
1468
1469     if (kvm_enabled())
1470         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1471
1472     switch (type) {
1473     case GDB_BREAKPOINT_SW:
1474     case GDB_BREAKPOINT_HW:
1475         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1476             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1477             if (err)
1478                 break;
1479         }
1480         return err;
1481 #ifndef CONFIG_USER_ONLY
1482     case GDB_WATCHPOINT_WRITE:
1483     case GDB_WATCHPOINT_READ:
1484     case GDB_WATCHPOINT_ACCESS:
1485         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1486             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1487             if (err)
1488                 break;
1489         }
1490         return err;
1491 #endif
1492     default:
1493         return -ENOSYS;
1494     }
1495 }
1496
1497 static void gdb_breakpoint_remove_all(void)
1498 {
1499     CPUState *env;
1500
1501     if (kvm_enabled()) {
1502         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1503         return;
1504     }
1505
1506     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1507         cpu_breakpoint_remove_all(env, BP_GDB);
1508 #ifndef CONFIG_USER_ONLY
1509         cpu_watchpoint_remove_all(env, BP_GDB);
1510 #endif
1511     }
1512 }
1513
1514 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1515 {
1516     CPUState *env;
1517     const char *p;
1518     int ch, reg_size, type, res, thread;
1519     char buf[MAX_PACKET_LENGTH];
1520     uint8_t mem_buf[MAX_PACKET_LENGTH];
1521     uint8_t *registers;
1522     target_ulong addr, len;
1523
1524 #ifdef DEBUG_GDB
1525     printf("command='%s'\n", line_buf);
1526 #endif
1527     p = line_buf;
1528     ch = *p++;
1529     switch(ch) {
1530     case '?':
1531         /* TODO: Make this return the correct value for user-mode.  */
1532         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1533                  s->c_cpu->cpu_index+1);
1534         put_packet(s, buf);
1535         /* Remove all the breakpoints when this query is issued,
1536          * because gdb is doing and initial connect and the state
1537          * should be cleaned up.
1538          */
1539         gdb_breakpoint_remove_all();
1540         break;
1541     case 'c':
1542         if (*p != '\0') {
1543             addr = strtoull(p, (char **)&p, 16);
1544 #if defined(TARGET_I386)
1545             s->c_cpu->eip = addr;
1546             cpu_synchronize_state(s->c_cpu, 1);
1547 #elif defined (TARGET_PPC)
1548             s->c_cpu->nip = addr;
1549 #elif defined (TARGET_SPARC)
1550             s->c_cpu->pc = addr;
1551             s->c_cpu->npc = addr + 4;
1552 #elif defined (TARGET_ARM)
1553             s->c_cpu->regs[15] = addr;
1554 #elif defined (TARGET_SH4)
1555             s->c_cpu->pc = addr;
1556 #elif defined (TARGET_MIPS)
1557             s->c_cpu->active_tc.PC = addr;
1558 #elif defined (TARGET_CRIS)
1559             s->c_cpu->pc = addr;
1560 #elif defined (TARGET_ALPHA)
1561             s->c_cpu->pc = addr;
1562 #endif
1563         }
1564         s->signal = 0;
1565         gdb_continue(s);
1566         return RS_IDLE;
1567     case 'C':
1568         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1569         if (s->signal == -1)
1570             s->signal = 0;
1571         gdb_continue(s);
1572         return RS_IDLE;
1573     case 'k':
1574         /* Kill the target */
1575         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1576         exit(0);
1577     case 'D':
1578         /* Detach packet */
1579         gdb_breakpoint_remove_all();
1580         gdb_continue(s);
1581         put_packet(s, "OK");
1582         break;
1583     case 's':
1584         if (*p != '\0') {
1585             addr = strtoull(p, (char **)&p, 16);
1586 #if defined(TARGET_I386)
1587             s->c_cpu->eip = addr;
1588             cpu_synchronize_state(s->c_cpu, 1);
1589 #elif defined (TARGET_PPC)
1590             s->c_cpu->nip = addr;
1591 #elif defined (TARGET_SPARC)
1592             s->c_cpu->pc = addr;
1593             s->c_cpu->npc = addr + 4;
1594 #elif defined (TARGET_ARM)
1595             s->c_cpu->regs[15] = addr;
1596 #elif defined (TARGET_SH4)
1597             s->c_cpu->pc = addr;
1598 #elif defined (TARGET_MIPS)
1599             s->c_cpu->active_tc.PC = addr;
1600 #elif defined (TARGET_CRIS)
1601             s->c_cpu->pc = addr;
1602 #elif defined (TARGET_ALPHA)
1603             s->c_cpu->pc = addr;
1604 #endif
1605         }
1606         cpu_single_step(s->c_cpu, sstep_flags);
1607         gdb_continue(s);
1608         return RS_IDLE;
1609     case 'F':
1610         {
1611             target_ulong ret;
1612             target_ulong err;
1613
1614             ret = strtoull(p, (char **)&p, 16);
1615             if (*p == ',') {
1616                 p++;
1617                 err = strtoull(p, (char **)&p, 16);
1618             } else {
1619                 err = 0;
1620             }
1621             if (*p == ',')
1622                 p++;
1623             type = *p;
1624             if (gdb_current_syscall_cb)
1625                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1626             if (type == 'C') {
1627                 put_packet(s, "T02");
1628             } else {
1629                 gdb_continue(s);
1630             }
1631         }
1632         break;
1633     case 'g':
1634         cpu_synchronize_state(s->g_cpu, 0);
1635         len = 0;
1636         for (addr = 0; addr < num_g_regs; addr++) {
1637             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1638             len += reg_size;
1639         }
1640         memtohex(buf, mem_buf, len);
1641         put_packet(s, buf);
1642         break;
1643     case 'G':
1644         registers = mem_buf;
1645         len = strlen(p) / 2;
1646         hextomem((uint8_t *)registers, p, len);
1647         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1648             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1649             len -= reg_size;
1650             registers += reg_size;
1651         }
1652         cpu_synchronize_state(s->g_cpu, 1);
1653         put_packet(s, "OK");
1654         break;
1655     case 'm':
1656         addr = strtoull(p, (char **)&p, 16);
1657         if (*p == ',')
1658             p++;
1659         len = strtoull(p, NULL, 16);
1660         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1661             put_packet (s, "E14");
1662         } else {
1663             memtohex(buf, mem_buf, len);
1664             put_packet(s, buf);
1665         }
1666         break;
1667     case 'M':
1668         addr = strtoull(p, (char **)&p, 16);
1669         if (*p == ',')
1670             p++;
1671         len = strtoull(p, (char **)&p, 16);
1672         if (*p == ':')
1673             p++;
1674         hextomem(mem_buf, p, len);
1675         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1676             put_packet(s, "E14");
1677         else
1678             put_packet(s, "OK");
1679         break;
1680     case 'p':
1681         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1682            This works, but can be very slow.  Anything new enough to
1683            understand XML also knows how to use this properly.  */
1684         if (!gdb_has_xml)
1685             goto unknown_command;
1686         addr = strtoull(p, (char **)&p, 16);
1687         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1688         if (reg_size) {
1689             memtohex(buf, mem_buf, reg_size);
1690             put_packet(s, buf);
1691         } else {
1692             put_packet(s, "E14");
1693         }
1694         break;
1695     case 'P':
1696         if (!gdb_has_xml)
1697             goto unknown_command;
1698         addr = strtoull(p, (char **)&p, 16);
1699         if (*p == '=')
1700             p++;
1701         reg_size = strlen(p) / 2;
1702         hextomem(mem_buf, p, reg_size);
1703         gdb_write_register(s->g_cpu, mem_buf, addr);
1704         put_packet(s, "OK");
1705         break;
1706     case 'Z':
1707     case 'z':
1708         type = strtoul(p, (char **)&p, 16);
1709         if (*p == ',')
1710             p++;
1711         addr = strtoull(p, (char **)&p, 16);
1712         if (*p == ',')
1713             p++;
1714         len = strtoull(p, (char **)&p, 16);
1715         if (ch == 'Z')
1716             res = gdb_breakpoint_insert(addr, len, type);
1717         else
1718             res = gdb_breakpoint_remove(addr, len, type);
1719         if (res >= 0)
1720              put_packet(s, "OK");
1721         else if (res == -ENOSYS)
1722             put_packet(s, "");
1723         else
1724             put_packet(s, "E22");
1725         break;
1726     case 'H':
1727         type = *p++;
1728         thread = strtoull(p, (char **)&p, 16);
1729         if (thread == -1 || thread == 0) {
1730             put_packet(s, "OK");
1731             break;
1732         }
1733         for (env = first_cpu; env != NULL; env = env->next_cpu)
1734             if (env->cpu_index + 1 == thread)
1735                 break;
1736         if (env == NULL) {
1737             put_packet(s, "E22");
1738             break;
1739         }
1740         switch (type) {
1741         case 'c':
1742             s->c_cpu = env;
1743             put_packet(s, "OK");
1744             break;
1745         case 'g':
1746             s->g_cpu = env;
1747             put_packet(s, "OK");
1748             break;
1749         default:
1750              put_packet(s, "E22");
1751              break;
1752         }
1753         break;
1754     case 'T':
1755         thread = strtoull(p, (char **)&p, 16);
1756 #ifndef CONFIG_USER_ONLY
1757         if (thread > 0 && thread < smp_cpus + 1)
1758 #else
1759         if (thread == 1)
1760 #endif
1761              put_packet(s, "OK");
1762         else
1763             put_packet(s, "E22");
1764         break;
1765     case 'q':
1766     case 'Q':
1767         /* parse any 'q' packets here */
1768         if (!strcmp(p,"qemu.sstepbits")) {
1769             /* Query Breakpoint bit definitions */
1770             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1771                      SSTEP_ENABLE,
1772                      SSTEP_NOIRQ,
1773                      SSTEP_NOTIMER);
1774             put_packet(s, buf);
1775             break;
1776         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1777             /* Display or change the sstep_flags */
1778             p += 10;
1779             if (*p != '=') {
1780                 /* Display current setting */
1781                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1782                 put_packet(s, buf);
1783                 break;
1784             }
1785             p++;
1786             type = strtoul(p, (char **)&p, 16);
1787             sstep_flags = type;
1788             put_packet(s, "OK");
1789             break;
1790         } else if (strcmp(p,"C") == 0) {
1791             /* "Current thread" remains vague in the spec, so always return
1792              *  the first CPU (gdb returns the first thread). */
1793             put_packet(s, "QC1");
1794             break;
1795         } else if (strcmp(p,"fThreadInfo") == 0) {
1796             s->query_cpu = first_cpu;
1797             goto report_cpuinfo;
1798         } else if (strcmp(p,"sThreadInfo") == 0) {
1799         report_cpuinfo:
1800             if (s->query_cpu) {
1801                 snprintf(buf, sizeof(buf), "m%x", s->query_cpu->cpu_index+1);
1802                 put_packet(s, buf);
1803                 s->query_cpu = s->query_cpu->next_cpu;
1804             } else
1805                 put_packet(s, "l");
1806             break;
1807         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1808             thread = strtoull(p+16, (char **)&p, 16);
1809             for (env = first_cpu; env != NULL; env = env->next_cpu)
1810                 if (env->cpu_index + 1 == thread) {
1811                     cpu_synchronize_state(env, 0);
1812                     len = snprintf((char *)mem_buf, sizeof(mem_buf),
1813                                    "CPU#%d [%s]", env->cpu_index,
1814                                    env->halted ? "halted " : "running");
1815                     memtohex(buf, mem_buf, len);
1816                     put_packet(s, buf);
1817                     break;
1818                 }
1819             break;
1820         }
1821 #ifdef CONFIG_USER_ONLY
1822         else if (strncmp(p, "Offsets", 7) == 0) {
1823             TaskState *ts = s->c_cpu->opaque;
1824
1825             snprintf(buf, sizeof(buf),
1826                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1827                      ";Bss=" TARGET_ABI_FMT_lx,
1828                      ts->info->code_offset,
1829                      ts->info->data_offset,
1830                      ts->info->data_offset);
1831             put_packet(s, buf);
1832             break;
1833         }
1834 #else /* !CONFIG_USER_ONLY */
1835         else if (strncmp(p, "Rcmd,", 5) == 0) {
1836             int len = strlen(p + 5);
1837
1838             if ((len % 2) != 0) {
1839                 put_packet(s, "E01");
1840                 break;
1841             }
1842             hextomem(mem_buf, p + 5, len);
1843             len = len / 2;
1844             mem_buf[len++] = 0;
1845             qemu_chr_read(s->mon_chr, mem_buf, len);
1846             put_packet(s, "OK");
1847             break;
1848         }
1849 #endif /* !CONFIG_USER_ONLY */
1850         if (strncmp(p, "Supported", 9) == 0) {
1851             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1852 #ifdef GDB_CORE_XML
1853             strcat(buf, ";qXfer:features:read+");
1854 #endif
1855             put_packet(s, buf);
1856             break;
1857         }
1858 #ifdef GDB_CORE_XML
1859         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1860             const char *xml;
1861             target_ulong total_len;
1862
1863             gdb_has_xml = 1;
1864             p += 19;
1865             xml = get_feature_xml(p, &p);
1866             if (!xml) {
1867                 snprintf(buf, sizeof(buf), "E00");
1868                 put_packet(s, buf);
1869                 break;
1870             }
1871
1872             if (*p == ':')
1873                 p++;
1874             addr = strtoul(p, (char **)&p, 16);
1875             if (*p == ',')
1876                 p++;
1877             len = strtoul(p, (char **)&p, 16);
1878
1879             total_len = strlen(xml);
1880             if (addr > total_len) {
1881                 snprintf(buf, sizeof(buf), "E00");
1882                 put_packet(s, buf);
1883                 break;
1884             }
1885             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1886                 len = (MAX_PACKET_LENGTH - 5) / 2;
1887             if (len < total_len - addr) {
1888                 buf[0] = 'm';
1889                 len = memtox(buf + 1, xml + addr, len);
1890             } else {
1891                 buf[0] = 'l';
1892                 len = memtox(buf + 1, xml + addr, total_len - addr);
1893             }
1894             put_packet_binary(s, buf, len + 1);
1895             break;
1896         }
1897 #endif
1898         /* Unrecognised 'q' command.  */
1899         goto unknown_command;
1900
1901     default:
1902     unknown_command:
1903         /* put empty packet */
1904         buf[0] = '\0';
1905         put_packet(s, buf);
1906         break;
1907     }
1908     return RS_IDLE;
1909 }
1910
1911 void gdb_set_stop_cpu(CPUState *env)
1912 {
1913     gdbserver_state->c_cpu = env;
1914     gdbserver_state->g_cpu = env;
1915 }
1916
1917 #ifndef CONFIG_USER_ONLY
1918 static void gdb_vm_state_change(void *opaque, int running, int reason)
1919 {
1920     GDBState *s = gdbserver_state;
1921     CPUState *env = s->c_cpu;
1922     char buf[256];
1923     const char *type;
1924     int ret;
1925
1926     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
1927         s->state == RS_SYSCALL)
1928         return;
1929
1930     /* disable single step if it was enable */
1931     cpu_single_step(env, 0);
1932
1933     if (reason == EXCP_DEBUG) {
1934         if (env->watchpoint_hit) {
1935             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
1936             case BP_MEM_READ:
1937                 type = "r";
1938                 break;
1939             case BP_MEM_ACCESS:
1940                 type = "a";
1941                 break;
1942             default:
1943                 type = "";
1944                 break;
1945             }
1946             snprintf(buf, sizeof(buf),
1947                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1948                      GDB_SIGNAL_TRAP, env->cpu_index+1, type,
1949                      env->watchpoint_hit->vaddr);
1950             put_packet(s, buf);
1951             env->watchpoint_hit = NULL;
1952             return;
1953         }
1954         tb_flush(env);
1955         ret = GDB_SIGNAL_TRAP;
1956     } else {
1957         ret = GDB_SIGNAL_INT;
1958     }
1959     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, env->cpu_index+1);
1960     put_packet(s, buf);
1961 }
1962 #endif
1963
1964 /* Send a gdb syscall request.
1965    This accepts limited printf-style format specifiers, specifically:
1966     %x  - target_ulong argument printed in hex.
1967     %lx - 64-bit argument printed in hex.
1968     %s  - string pointer (target_ulong) and length (int) pair.  */
1969 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1970 {
1971     va_list va;
1972     char buf[256];
1973     char *p;
1974     target_ulong addr;
1975     uint64_t i64;
1976     GDBState *s;
1977
1978     s = gdbserver_state;
1979     if (!s)
1980         return;
1981     gdb_current_syscall_cb = cb;
1982     s->state = RS_SYSCALL;
1983 #ifndef CONFIG_USER_ONLY
1984     vm_stop(EXCP_DEBUG);
1985 #endif
1986     s->state = RS_IDLE;
1987     va_start(va, fmt);
1988     p = buf;
1989     *(p++) = 'F';
1990     while (*fmt) {
1991         if (*fmt == '%') {
1992             fmt++;
1993             switch (*fmt++) {
1994             case 'x':
1995                 addr = va_arg(va, target_ulong);
1996                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
1997                 break;
1998             case 'l':
1999                 if (*(fmt++) != 'x')
2000                     goto bad_format;
2001                 i64 = va_arg(va, uint64_t);
2002                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
2003                 break;
2004             case 's':
2005                 addr = va_arg(va, target_ulong);
2006                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
2007                               addr, va_arg(va, int));
2008                 break;
2009             default:
2010             bad_format:
2011                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2012                         fmt - 1);
2013                 break;
2014             }
2015         } else {
2016             *(p++) = *(fmt++);
2017         }
2018     }
2019     *p = 0;
2020     va_end(va);
2021     put_packet(s, buf);
2022 #ifdef CONFIG_USER_ONLY
2023     gdb_handlesig(s->c_cpu, 0);
2024 #else
2025     cpu_exit(s->c_cpu);
2026 #endif
2027 }
2028
2029 static void gdb_read_byte(GDBState *s, int ch)
2030 {
2031     int i, csum;
2032     uint8_t reply;
2033
2034 #ifndef CONFIG_USER_ONLY
2035     if (s->last_packet_len) {
2036         /* Waiting for a response to the last packet.  If we see the start
2037            of a new command then abandon the previous response.  */
2038         if (ch == '-') {
2039 #ifdef DEBUG_GDB
2040             printf("Got NACK, retransmitting\n");
2041 #endif
2042             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2043         }
2044 #ifdef DEBUG_GDB
2045         else if (ch == '+')
2046             printf("Got ACK\n");
2047         else
2048             printf("Got '%c' when expecting ACK/NACK\n", ch);
2049 #endif
2050         if (ch == '+' || ch == '$')
2051             s->last_packet_len = 0;
2052         if (ch != '$')
2053             return;
2054     }
2055     if (vm_running) {
2056         /* when the CPU is running, we cannot do anything except stop
2057            it when receiving a char */
2058         vm_stop(EXCP_INTERRUPT);
2059     } else
2060 #endif
2061     {
2062         switch(s->state) {
2063         case RS_IDLE:
2064             if (ch == '$') {
2065                 s->line_buf_index = 0;
2066                 s->state = RS_GETLINE;
2067             }
2068             break;
2069         case RS_GETLINE:
2070             if (ch == '#') {
2071             s->state = RS_CHKSUM1;
2072             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2073                 s->state = RS_IDLE;
2074             } else {
2075             s->line_buf[s->line_buf_index++] = ch;
2076             }
2077             break;
2078         case RS_CHKSUM1:
2079             s->line_buf[s->line_buf_index] = '\0';
2080             s->line_csum = fromhex(ch) << 4;
2081             s->state = RS_CHKSUM2;
2082             break;
2083         case RS_CHKSUM2:
2084             s->line_csum |= fromhex(ch);
2085             csum = 0;
2086             for(i = 0; i < s->line_buf_index; i++) {
2087                 csum += s->line_buf[i];
2088             }
2089             if (s->line_csum != (csum & 0xff)) {
2090                 reply = '-';
2091                 put_buffer(s, &reply, 1);
2092                 s->state = RS_IDLE;
2093             } else {
2094                 reply = '+';
2095                 put_buffer(s, &reply, 1);
2096                 s->state = gdb_handle_packet(s, s->line_buf);
2097             }
2098             break;
2099         default:
2100             abort();
2101         }
2102     }
2103 }
2104
2105 #ifdef CONFIG_USER_ONLY
2106 int
2107 gdb_queuesig (void)
2108 {
2109     GDBState *s;
2110
2111     s = gdbserver_state;
2112
2113     if (gdbserver_fd < 0 || s->fd < 0)
2114         return 0;
2115     else
2116         return 1;
2117 }
2118
2119 int
2120 gdb_handlesig (CPUState *env, int sig)
2121 {
2122   GDBState *s;
2123   char buf[256];
2124   int n;
2125
2126   s = gdbserver_state;
2127   if (gdbserver_fd < 0 || s->fd < 0)
2128     return sig;
2129
2130   /* disable single step if it was enabled */
2131   cpu_single_step(env, 0);
2132   tb_flush(env);
2133
2134   if (sig != 0)
2135     {
2136       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2137       put_packet(s, buf);
2138     }
2139   /* put_packet() might have detected that the peer terminated the
2140      connection.  */
2141   if (s->fd < 0)
2142       return sig;
2143
2144   sig = 0;
2145   s->state = RS_IDLE;
2146   s->running_state = 0;
2147   while (s->running_state == 0) {
2148       n = read (s->fd, buf, 256);
2149       if (n > 0)
2150         {
2151           int i;
2152
2153           for (i = 0; i < n; i++)
2154             gdb_read_byte (s, buf[i]);
2155         }
2156       else if (n == 0 || errno != EAGAIN)
2157         {
2158           /* XXX: Connection closed.  Should probably wait for annother
2159              connection before continuing.  */
2160           return sig;
2161         }
2162   }
2163   sig = s->signal;
2164   s->signal = 0;
2165   return sig;
2166 }
2167
2168 /* Tell the remote gdb that the process has exited.  */
2169 void gdb_exit(CPUState *env, int code)
2170 {
2171   GDBState *s;
2172   char buf[4];
2173
2174   s = gdbserver_state;
2175   if (gdbserver_fd < 0 || s->fd < 0)
2176     return;
2177
2178   snprintf(buf, sizeof(buf), "W%02x", code);
2179   put_packet(s, buf);
2180 }
2181
2182 /* Tell the remote gdb that the process has exited due to SIG.  */
2183 void gdb_signalled(CPUState *env, int sig)
2184 {
2185   GDBState *s;
2186   char buf[4];
2187
2188   s = gdbserver_state;
2189   if (gdbserver_fd < 0 || s->fd < 0)
2190     return;
2191
2192   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2193   put_packet(s, buf);
2194 }
2195
2196 static void gdb_accept(void)
2197 {
2198     GDBState *s;
2199     struct sockaddr_in sockaddr;
2200     socklen_t len;
2201     int val, fd;
2202
2203     for(;;) {
2204         len = sizeof(sockaddr);
2205         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2206         if (fd < 0 && errno != EINTR) {
2207             perror("accept");
2208             return;
2209         } else if (fd >= 0) {
2210             break;
2211         }
2212     }
2213
2214     /* set short latency */
2215     val = 1;
2216     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2217
2218     s = qemu_mallocz(sizeof(GDBState));
2219     s->c_cpu = first_cpu;
2220     s->g_cpu = first_cpu;
2221     s->fd = fd;
2222     gdb_has_xml = 0;
2223
2224     gdbserver_state = s;
2225
2226     fcntl(fd, F_SETFL, O_NONBLOCK);
2227 }
2228
2229 static int gdbserver_open(int port)
2230 {
2231     struct sockaddr_in sockaddr;
2232     int fd, val, ret;
2233
2234     fd = socket(PF_INET, SOCK_STREAM, 0);
2235     if (fd < 0) {
2236         perror("socket");
2237         return -1;
2238     }
2239
2240     /* allow fast reuse */
2241     val = 1;
2242     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2243
2244     sockaddr.sin_family = AF_INET;
2245     sockaddr.sin_port = htons(port);
2246     sockaddr.sin_addr.s_addr = 0;
2247     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2248     if (ret < 0) {
2249         perror("bind");
2250         return -1;
2251     }
2252     ret = listen(fd, 0);
2253     if (ret < 0) {
2254         perror("listen");
2255         return -1;
2256     }
2257     return fd;
2258 }
2259
2260 int gdbserver_start(int port)
2261 {
2262     gdbserver_fd = gdbserver_open(port);
2263     if (gdbserver_fd < 0)
2264         return -1;
2265     /* accept connections */
2266     gdb_accept();
2267     return 0;
2268 }
2269
2270 /* Disable gdb stub for child processes.  */
2271 void gdbserver_fork(CPUState *env)
2272 {
2273     GDBState *s = gdbserver_state;
2274     if (gdbserver_fd < 0 || s->fd < 0)
2275       return;
2276     close(s->fd);
2277     s->fd = -1;
2278     cpu_breakpoint_remove_all(env, BP_GDB);
2279     cpu_watchpoint_remove_all(env, BP_GDB);
2280 }
2281 #else
2282 static int gdb_chr_can_receive(void *opaque)
2283 {
2284   /* We can handle an arbitrarily large amount of data.
2285    Pick the maximum packet size, which is as good as anything.  */
2286   return MAX_PACKET_LENGTH;
2287 }
2288
2289 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2290 {
2291     int i;
2292
2293     for (i = 0; i < size; i++) {
2294         gdb_read_byte(gdbserver_state, buf[i]);
2295     }
2296 }
2297
2298 static void gdb_chr_event(void *opaque, int event)
2299 {
2300     switch (event) {
2301     case CHR_EVENT_RESET:
2302         vm_stop(EXCP_INTERRUPT);
2303         gdb_has_xml = 0;
2304         break;
2305     default:
2306         break;
2307     }
2308 }
2309
2310 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2311 {
2312     char buf[MAX_PACKET_LENGTH];
2313
2314     buf[0] = 'O';
2315     if (len > (MAX_PACKET_LENGTH/2) - 1)
2316         len = (MAX_PACKET_LENGTH/2) - 1;
2317     memtohex(buf + 1, (uint8_t *)msg, len);
2318     put_packet(s, buf);
2319 }
2320
2321 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2322 {
2323     const char *p = (const char *)buf;
2324     int max_sz;
2325
2326     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2327     for (;;) {
2328         if (len <= max_sz) {
2329             gdb_monitor_output(gdbserver_state, p, len);
2330             break;
2331         }
2332         gdb_monitor_output(gdbserver_state, p, max_sz);
2333         p += max_sz;
2334         len -= max_sz;
2335     }
2336     return len;
2337 }
2338
2339 int gdbserver_start(const char *port)
2340 {
2341     GDBState *s;
2342     char gdbstub_port_name[128];
2343     int port_num;
2344     char *p;
2345     CharDriverState *chr;
2346
2347     if (!port || !*port)
2348       return -1;
2349
2350     port_num = strtol(port, &p, 10);
2351     if (*p == 0) {
2352         /* A numeric value is interpreted as a port number.  */
2353         snprintf(gdbstub_port_name, sizeof(gdbstub_port_name),
2354                  "tcp::%d,nowait,nodelay,server", port_num);
2355         port = gdbstub_port_name;
2356     }
2357
2358     chr = qemu_chr_open("gdb", port, NULL);
2359     if (!chr)
2360         return -1;
2361
2362     s = qemu_mallocz(sizeof(GDBState));
2363     s->c_cpu = first_cpu;
2364     s->g_cpu = first_cpu;
2365     s->chr = chr;
2366     gdbserver_state = s;
2367     qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2368                           gdb_chr_event, NULL);
2369     qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2370
2371     /* Initialize a monitor terminal for gdb */
2372     s->mon_chr = qemu_mallocz(sizeof(*s->mon_chr));
2373     s->mon_chr->chr_write = gdb_monitor_write;
2374     monitor_init(s->mon_chr, 0);
2375
2376     return 0;
2377 }
2378 #endif