gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA  02110-1301 USA
  19  */
  20 #include "config.h"
  21 #include "qemu-common.h"
  22 #ifdef CONFIG_USER_ONLY
  23 #include <stdlib.h>
  24 #include <stdio.h>
  25 #include <stdarg.h>
  26 #include <string.h>
  27 #include <errno.h>
  28 #include <unistd.h>
  29 #include <fcntl.h>
  30
  31 #include "qemu.h"
  32 #else
  33 #include "monitor.h"
  34 #include "qemu-char.h"
  35 #include "sysemu.h"
  36 #include "gdbstub.h"
  37 #endif
  38
  39 #define MAX_PACKET_LENGTH 4096
  40
  41 #include "qemu_socket.h"
  42
  43
  44 enum {
  45     GDB_SIGNAL_0 = 0,
  46     GDB_SIGNAL_INT = 2,
  47     GDB_SIGNAL_TRAP = 5,
  48     GDB_SIGNAL_UNKNOWN = 143
  49 };
  50
  51 #ifdef CONFIG_USER_ONLY
  52
  53 /* Map target signal numbers to GDB protocol signal numbers and vice
  54  * versa.  For user emulation's currently supported systems, we can
  55  * assume most signals are defined.
  56  */
  57
  58 static int gdb_signal_table[] = {
  59     0,
  60     TARGET_SIGHUP,
  61     TARGET_SIGINT,
  62     TARGET_SIGQUIT,
  63     TARGET_SIGILL,
  64     TARGET_SIGTRAP,
  65     TARGET_SIGABRT,
  66     -1, /* SIGEMT */
  67     TARGET_SIGFPE,
  68     TARGET_SIGKILL,
  69     TARGET_SIGBUS,
  70     TARGET_SIGSEGV,
  71     TARGET_SIGSYS,
  72     TARGET_SIGPIPE,
  73     TARGET_SIGALRM,
  74     TARGET_SIGTERM,
  75     TARGET_SIGURG,
  76     TARGET_SIGSTOP,
  77     TARGET_SIGTSTP,
  78     TARGET_SIGCONT,
  79     TARGET_SIGCHLD,
  80     TARGET_SIGTTIN,
  81     TARGET_SIGTTOU,
  82     TARGET_SIGIO,
  83     TARGET_SIGXCPU,
  84     TARGET_SIGXFSZ,
  85     TARGET_SIGVTALRM,
  86     TARGET_SIGPROF,
  87     TARGET_SIGWINCH,
  88     -1, /* SIGLOST */
  89     TARGET_SIGUSR1,
  90     TARGET_SIGUSR2,
  91 #ifdef TARGET_SIGPWR
  92     TARGET_SIGPWR,
  93 #else
  94     -1,
  95 #endif
  96     -1, /* SIGPOLL */
  97     -1,
  98     -1,
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108 #ifdef __SIGRTMIN
 109     __SIGRTMIN + 1,
 110     __SIGRTMIN + 2,
 111     __SIGRTMIN + 3,
 112     __SIGRTMIN + 4,
 113     __SIGRTMIN + 5,
 114     __SIGRTMIN + 6,
 115     __SIGRTMIN + 7,
 116     __SIGRTMIN + 8,
 117     __SIGRTMIN + 9,
 118     __SIGRTMIN + 10,
 119     __SIGRTMIN + 11,
 120     __SIGRTMIN + 12,
 121     __SIGRTMIN + 13,
 122     __SIGRTMIN + 14,
 123     __SIGRTMIN + 15,
 124     __SIGRTMIN + 16,
 125     __SIGRTMIN + 17,
 126     __SIGRTMIN + 18,
 127     __SIGRTMIN + 19,
 128     __SIGRTMIN + 20,
 129     __SIGRTMIN + 21,
 130     __SIGRTMIN + 22,
 131     __SIGRTMIN + 23,
 132     __SIGRTMIN + 24,
 133     __SIGRTMIN + 25,
 134     __SIGRTMIN + 26,
 135     __SIGRTMIN + 27,
 136     __SIGRTMIN + 28,
 137     __SIGRTMIN + 29,
 138     __SIGRTMIN + 30,
 139     __SIGRTMIN + 31,
 140     -1, /* SIGCANCEL */
 141     __SIGRTMIN,
 142     __SIGRTMIN + 32,
 143     __SIGRTMIN + 33,
 144     __SIGRTMIN + 34,
 145     __SIGRTMIN + 35,
 146     __SIGRTMIN + 36,
 147     __SIGRTMIN + 37,
 148     __SIGRTMIN + 38,
 149     __SIGRTMIN + 39,
 150     __SIGRTMIN + 40,
 151     __SIGRTMIN + 41,
 152     __SIGRTMIN + 42,
 153     __SIGRTMIN + 43,
 154     __SIGRTMIN + 44,
 155     __SIGRTMIN + 45,
 156     __SIGRTMIN + 46,
 157     __SIGRTMIN + 47,
 158     __SIGRTMIN + 48,
 159     __SIGRTMIN + 49,
 160     __SIGRTMIN + 50,
 161     __SIGRTMIN + 51,
 162     __SIGRTMIN + 52,
 163     __SIGRTMIN + 53,
 164     __SIGRTMIN + 54,
 165     __SIGRTMIN + 55,
 166     __SIGRTMIN + 56,
 167     __SIGRTMIN + 57,
 168     __SIGRTMIN + 58,
 169     __SIGRTMIN + 59,
 170     __SIGRTMIN + 60,
 171     __SIGRTMIN + 61,
 172     __SIGRTMIN + 62,
 173     __SIGRTMIN + 63,
 174     __SIGRTMIN + 64,
 175     __SIGRTMIN + 65,
 176     __SIGRTMIN + 66,
 177     __SIGRTMIN + 67,
 178     __SIGRTMIN + 68,
 179     __SIGRTMIN + 69,
 180     __SIGRTMIN + 70,
 181     __SIGRTMIN + 71,
 182     __SIGRTMIN + 72,
 183     __SIGRTMIN + 73,
 184     __SIGRTMIN + 74,
 185     __SIGRTMIN + 75,
 186     __SIGRTMIN + 76,
 187     __SIGRTMIN + 77,
 188     __SIGRTMIN + 78,
 189     __SIGRTMIN + 79,
 190     __SIGRTMIN + 80,
 191     __SIGRTMIN + 81,
 192     __SIGRTMIN + 82,
 193     __SIGRTMIN + 83,
 194     __SIGRTMIN + 84,
 195     __SIGRTMIN + 85,
 196     __SIGRTMIN + 86,
 197     __SIGRTMIN + 87,
 198     __SIGRTMIN + 88,
 199     __SIGRTMIN + 89,
 200     __SIGRTMIN + 90,
 201     __SIGRTMIN + 91,
 202     __SIGRTMIN + 92,
 203     __SIGRTMIN + 93,
 204     __SIGRTMIN + 94,
 205     __SIGRTMIN + 95,
 206     -1, /* SIGINFO */
 207     -1, /* UNKNOWN */
 208     -1, /* DEFAULT */
 209     -1,
 210     -1,
 211     -1,
 212     -1,
 213     -1,
 214     -1
 215 #endif
 216 };
 217 #else
 218 /* In system mode we only need SIGINT and SIGTRAP; other signals
 219    are not yet supported.  */
 220
 221 enum {
 222     TARGET_SIGINT = 2,
 223     TARGET_SIGTRAP = 5
 224 };
 225
 226 static int gdb_signal_table[] = {
 227     -1,
 228     -1,
 229     TARGET_SIGINT,
 230     -1,
 231     -1,
 232     TARGET_SIGTRAP
 233 };
 234 #endif
 235
 236 #ifdef CONFIG_USER_ONLY
 237 static int target_signal_to_gdb (int sig)
 238 {
 239     int i;
 240     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 241         if (gdb_signal_table[i] == sig)
 242             return i;
 243     return GDB_SIGNAL_UNKNOWN;
 244 }
 245 #endif
 246
 247 static int gdb_signal_to_target (int sig)
 248 {
 249     if (sig < ARRAY_SIZE (gdb_signal_table))
 250         return gdb_signal_table[sig];
 251     else
 252         return -1;
 253 }
 254
 255 //#define DEBUG_GDB
 256
 257 typedef struct GDBRegisterState {
 258     int base_reg;
 259     int num_regs;
 260     gdb_reg_cb get_reg;
 261     gdb_reg_cb set_reg;
 262     const char *xml;
 263     struct GDBRegisterState *next;
 264 } GDBRegisterState;
 265
 266 enum RSState {
 267     RS_IDLE,
 268     RS_GETLINE,
 269     RS_CHKSUM1,
 270     RS_CHKSUM2,
 271     RS_SYSCALL,
 272 };
 273 typedef struct GDBState {
 274     CPUState *c_cpu; /* current CPU for step/continue ops */
 275     CPUState *g_cpu; /* current CPU for other ops */
 276     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 277     enum RSState state; /* parsing state */
 278     char line_buf[MAX_PACKET_LENGTH];
 279     int line_buf_index;
 280     int line_csum;
 281     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 282     int last_packet_len;
 283     int signal;
 284 #ifdef CONFIG_USER_ONLY
 285     int fd;
 286     int running_state;
 287 #else
 288     CharDriverState *chr;
 289     CharDriverState *mon_chr;
 290 #endif
 291 } GDBState;
 292
 293 /* By default use no IRQs and no timers while single stepping so as to
 294  * make single stepping like an ICE HW step.
 295  */
 296 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 297
 298 static GDBState *gdbserver_state;
 299
 300 /* This is an ugly hack to cope with both new and old gdb.
 301    If gdb sends qXfer:features:read then assume we're talking to a newish
 302    gdb that understands target descriptions.  */
 303 static int gdb_has_xml;
 304
 305 #ifdef CONFIG_USER_ONLY
 306 /* XXX: This is not thread safe.  Do we care?  */
 307 static int gdbserver_fd = -1;
 308
 309 static int get_char(GDBState *s)
 310 {
 311     uint8_t ch;
 312     int ret;
 313
 314     for(;;) {
 315         ret = recv(s->fd, &ch, 1, 0);
 316         if (ret < 0) {
 317             if (errno == ECONNRESET)
 318                 s->fd = -1;
 319             if (errno != EINTR && errno != EAGAIN)
 320                 return -1;
 321         } else if (ret == 0) {
 322             close(s->fd);
 323             s->fd = -1;
 324             return -1;
 325         } else {
 326             break;
 327         }
 328     }
 329     return ch;
 330 }
 331 #endif
 332
 333 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 334
 335 enum {
 336     GDB_SYS_UNKNOWN,
 337     GDB_SYS_ENABLED,
 338     GDB_SYS_DISABLED,
 339 } gdb_syscall_mode;
 340
 341 /* If gdb is connected when the first semihosting syscall occurs then use
 342    remote gdb syscalls.  Otherwise use native file IO.  */
 343 int use_gdb_syscalls(void)
 344 {
 345     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 346         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 347                                             : GDB_SYS_DISABLED);
 348     }
 349     return gdb_syscall_mode == GDB_SYS_ENABLED;
 350 }
 351
 352 /* Resume execution.  */
 353 static inline void gdb_continue(GDBState *s)
 354 {
 355 #ifdef CONFIG_USER_ONLY
 356     s->running_state = 1;
 357 #else
 358     vm_start();
 359 #endif
 360 }
 361
 362 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 363 {
 364 #ifdef CONFIG_USER_ONLY
 365     int ret;
 366
 367     while (len > 0) {
 368         ret = send(s->fd, buf, len, 0);
 369         if (ret < 0) {
 370             if (errno != EINTR && errno != EAGAIN)
 371                 return;
 372         } else {
 373             buf += ret;
 374             len -= ret;
 375         }
 376     }
 377 #else
 378     qemu_chr_write(s->chr, buf, len);
 379 #endif
 380 }
 381
 382 static inline int fromhex(int v)
 383 {
 384     if (v >= '0' && v <= '9')
 385         return v - '0';
 386     else if (v >= 'A' && v <= 'F')
 387         return v - 'A' + 10;
 388     else if (v >= 'a' && v <= 'f')
 389         return v - 'a' + 10;
 390     else
 391         return 0;
 392 }
 393
 394 static inline int tohex(int v)
 395 {
 396     if (v < 10)
 397         return v + '0';
 398     else
 399         return v - 10 + 'a';
 400 }
 401
 402 static void memtohex(char *buf, const uint8_t *mem, int len)
 403 {
 404     int i, c;
 405     char *q;
 406     q = buf;
 407     for(i = 0; i < len; i++) {
 408         c = mem[i];
 409         *q++ = tohex(c >> 4);
 410         *q++ = tohex(c & 0xf);
 411     }
 412     *q = '\0';
 413 }
 414
 415 static void hextomem(uint8_t *mem, const char *buf, int len)
 416 {
 417     int i;
 418
 419     for(i = 0; i < len; i++) {
 420         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 421         buf += 2;
 422     }
 423 }
 424
 425 /* return -1 if error, 0 if OK */
 426 static int put_packet_binary(GDBState *s, const char *buf, int len)
 427 {
 428     int csum, i;
 429     uint8_t *p;
 430
 431     for(;;) {
 432         p = s->last_packet;
 433         *(p++) = '$';
 434         memcpy(p, buf, len);
 435         p += len;
 436         csum = 0;
 437         for(i = 0; i < len; i++) {
 438             csum += buf[i];
 439         }
 440         *(p++) = '#';
 441         *(p++) = tohex((csum >> 4) & 0xf);
 442         *(p++) = tohex((csum) & 0xf);
 443
 444         s->last_packet_len = p - s->last_packet;
 445         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 446
 447 #ifdef CONFIG_USER_ONLY
 448         i = get_char(s);
 449         if (i < 0)
 450             return -1;
 451         if (i == '+')
 452             break;
 453 #else
 454         break;
 455 #endif
 456     }
 457     return 0;
 458 }
 459
 460 /* return -1 if error, 0 if OK */
 461 static int put_packet(GDBState *s, const char *buf)
 462 {
 463 #ifdef DEBUG_GDB
 464     printf("reply='%s'\n", buf);
 465 #endif
 466
 467     return put_packet_binary(s, buf, strlen(buf));
 468 }
 469
 470 /* The GDB remote protocol transfers values in target byte order.  This means
 471    we can use the raw memory access routines to access the value buffer.
 472    Conveniently, these also handle the case where the buffer is mis-aligned.
 473  */
 474 #define GET_REG8(val) do { \
 475     stb_p(mem_buf, val); \
 476     return 1; \
 477     } while(0)
 478 #define GET_REG16(val) do { \
 479     stw_p(mem_buf, val); \
 480     return 2; \
 481     } while(0)
 482 #define GET_REG32(val) do { \
 483     stl_p(mem_buf, val); \
 484     return 4; \
 485     } while(0)
 486 #define GET_REG64(val) do { \
 487     stq_p(mem_buf, val); \
 488     return 8; \
 489     } while(0)
 490
 491 #if TARGET_LONG_BITS == 64
 492 #define GET_REGL(val) GET_REG64(val)
 493 #define ldtul_p(addr) ldq_p(addr)
 494 #else
 495 #define GET_REGL(val) GET_REG32(val)
 496 #define ldtul_p(addr) ldl_p(addr)
 497 #endif
 498
 499 #if defined(TARGET_I386)
 500
 501 #ifdef TARGET_X86_64
 502 static const int gpr_map[16] = {
 503     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 504     8, 9, 10, 11, 12, 13, 14, 15
 505 };
 506 #else
 507 static const int gpr_map[8] = {0, 1, 2, 3, 4, 5, 6, 7};
 508 #endif
 509
 510 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 511
 512 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 513 {
 514     if (n < CPU_NB_REGS) {
 515         GET_REGL(env->regs[gpr_map[n]]);
 516     } else if (n >= CPU_NB_REGS + 8 && n < CPU_NB_REGS + 16) {
 517         /* FIXME: byteswap float values.  */
 518 #ifdef USE_X86LDOUBLE
 519         memcpy(mem_buf, &env->fpregs[n - (CPU_NB_REGS + 8)], 10);
 520 #else
 521         memset(mem_buf, 0, 10);
 522 #endif
 523         return 10;
 524     } else if (n >= CPU_NB_REGS + 24) {
 525         n -= CPU_NB_REGS + 24;
 526         if (n < CPU_NB_REGS) {
 527             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 528             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 529             return 16;
 530         } else if (n == CPU_NB_REGS) {
 531             GET_REG32(env->mxcsr);
 532         }
 533     } else {
 534         n -= CPU_NB_REGS;
 535         switch (n) {
 536         case 0: GET_REGL(env->eip);
 537         case 1: GET_REG32(env->eflags);
 538         case 2: GET_REG32(env->segs[R_CS].selector);
 539         case 3: GET_REG32(env->segs[R_SS].selector);
 540         case 4: GET_REG32(env->segs[R_DS].selector);
 541         case 5: GET_REG32(env->segs[R_ES].selector);
 542         case 6: GET_REG32(env->segs[R_FS].selector);
 543         case 7: GET_REG32(env->segs[R_GS].selector);
 544         /* 8...15 x87 regs.  */
 545         case 16: GET_REG32(env->fpuc);
 546         case 17: GET_REG32((env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11);
 547         case 18: GET_REG32(0); /* ftag */
 548         case 19: GET_REG32(0); /* fiseg */
 549         case 20: GET_REG32(0); /* fioff */
 550         case 21: GET_REG32(0); /* foseg */
 551         case 22: GET_REG32(0); /* fooff */
 552         case 23: GET_REG32(0); /* fop */
 553         /* 24+ xmm regs.  */
 554         }
 555     }
 556     return 0;
 557 }
 558
 559 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int i)
 560 {
 561     uint32_t tmp;
 562
 563     if (i < CPU_NB_REGS) {
 564         env->regs[gpr_map[i]] = ldtul_p(mem_buf);
 565         return sizeof(target_ulong);
 566     } else if (i >= CPU_NB_REGS + 8 && i < CPU_NB_REGS + 16) {
 567         i -= CPU_NB_REGS + 8;
 568 #ifdef USE_X86LDOUBLE
 569         memcpy(&env->fpregs[i], mem_buf, 10);
 570 #endif
 571         return 10;
 572     } else if (i >= CPU_NB_REGS + 24) {
 573         i -= CPU_NB_REGS + 24;
 574         if (i < CPU_NB_REGS) {
 575             env->xmm_regs[i].XMM_Q(0) = ldq_p(mem_buf);
 576             env->xmm_regs[i].XMM_Q(1) = ldq_p(mem_buf + 8);
 577             return 16;
 578         } else if (i == CPU_NB_REGS) {
 579             env->mxcsr = ldl_p(mem_buf);
 580             return 4;
 581         }
 582     } else {
 583         i -= CPU_NB_REGS;
 584         switch (i) {
 585         case 0: env->eip = ldtul_p(mem_buf); return sizeof(target_ulong);
 586         case 1: env->eflags = ldl_p(mem_buf); return 4;
 587 #if defined(CONFIG_USER_ONLY)
 588 #define LOAD_SEG(index, sreg)\
 589             tmp = ldl_p(mem_buf);\
 590             if (tmp != env->segs[sreg].selector)\
 591                 cpu_x86_load_seg(env, sreg, tmp);
 592 #else
 593 /* FIXME: Honor segment registers.  Needs to avoid raising an exception
 594    when the selector is invalid.  */
 595 #define LOAD_SEG(index, sreg) do {} while(0)
 596 #endif
 597         case 2: LOAD_SEG(10, R_CS); return 4;
 598         case 3: LOAD_SEG(11, R_SS); return 4;
 599         case 4: LOAD_SEG(12, R_DS); return 4;
 600         case 5: LOAD_SEG(13, R_ES); return 4;
 601         case 6: LOAD_SEG(14, R_FS); return 4;
 602         case 7: LOAD_SEG(15, R_GS); return 4;
 603         /* 8...15 x87 regs.  */
 604         case 16: env->fpuc = ldl_p(mem_buf); return 4;
 605         case 17:
 606                  tmp = ldl_p(mem_buf);
 607                  env->fpstt = (tmp >> 11) & 7;
 608                  env->fpus = tmp & ~0x3800;
 609                  return 4;
 610         case 18: /* ftag */ return 4;
 611         case 19: /* fiseg */ return 4;
 612         case 20: /* fioff */ return 4;
 613         case 21: /* foseg */ return 4;
 614         case 22: /* fooff */ return 4;
 615         case 23: /* fop */ return 4;
 616         /* 24+ xmm regs.  */
 617         }
 618     }
 619     /* Unrecognised register.  */
 620     return 0;
 621 }
 622
 623 #elif defined (TARGET_PPC)
 624
 625 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 626    expects whatever the target description contains.  Due to a
 627    historical mishap the FP registers appear in between core integer
 628    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 629    FP regs zero size when talking to a newer gdb.  */
 630 #define NUM_CORE_REGS 71
 631 #if defined (TARGET_PPC64)
 632 #define GDB_CORE_XML "power64-core.xml"
 633 #else
 634 #define GDB_CORE_XML "power-core.xml"
 635 #endif
 636
 637 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 638 {
 639     if (n < 32) {
 640         /* gprs */
 641         GET_REGL(env->gpr[n]);
 642     } else if (n < 64) {
 643         /* fprs */
 644         if (gdb_has_xml)
 645             return 0;
 646         stfq_p(mem_buf, env->fpr[n-32]);
 647         return 8;
 648     } else {
 649         switch (n) {
 650         case 64: GET_REGL(env->nip);
 651         case 65: GET_REGL(env->msr);
 652         case 66:
 653             {
 654                 uint32_t cr = 0;
 655                 int i;
 656                 for (i = 0; i < 8; i++)
 657                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 658                 GET_REG32(cr);
 659             }
 660         case 67: GET_REGL(env->lr);
 661         case 68: GET_REGL(env->ctr);
 662         case 69: GET_REGL(env->xer);
 663         case 70:
 664             {
 665                 if (gdb_has_xml)
 666                     return 0;
 667                 GET_REG32(0); /* fpscr */
 668             }
 669         }
 670     }
 671     return 0;
 672 }
 673
 674 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 675 {
 676     if (n < 32) {
 677         /* gprs */
 678         env->gpr[n] = ldtul_p(mem_buf);
 679         return sizeof(target_ulong);
 680     } else if (n < 64) {
 681         /* fprs */
 682         if (gdb_has_xml)
 683             return 0;
 684         env->fpr[n-32] = ldfq_p(mem_buf);
 685         return 8;
 686     } else {
 687         switch (n) {
 688         case 64:
 689             env->nip = ldtul_p(mem_buf);
 690             return sizeof(target_ulong);
 691         case 65:
 692             ppc_store_msr(env, ldtul_p(mem_buf));
 693             return sizeof(target_ulong);
 694         case 66:
 695             {
 696                 uint32_t cr = ldl_p(mem_buf);
 697                 int i;
 698                 for (i = 0; i < 8; i++)
 699                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 700                 return 4;
 701             }
 702         case 67:
 703             env->lr = ldtul_p(mem_buf);
 704             return sizeof(target_ulong);
 705         case 68:
 706             env->ctr = ldtul_p(mem_buf);
 707             return sizeof(target_ulong);
 708         case 69:
 709             env->xer = ldtul_p(mem_buf);
 710             return sizeof(target_ulong);
 711         case 70:
 712             /* fpscr */
 713             if (gdb_has_xml)
 714                 return 0;
 715             return 4;
 716         }
 717     }
 718     return 0;
 719 }
 720
 721 #elif defined (TARGET_SPARC)
 722
 723 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 724 #define NUM_CORE_REGS 86
 725 #else
 726 #define NUM_CORE_REGS 72
 727 #endif
 728
 729 #ifdef TARGET_ABI32
 730 #define GET_REGA(val) GET_REG32(val)
 731 #else
 732 #define GET_REGA(val) GET_REGL(val)
 733 #endif
 734
 735 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 736 {
 737     if (n < 8) {
 738         /* g0..g7 */
 739         GET_REGA(env->gregs[n]);
 740     }
 741     if (n < 32) {
 742         /* register window */
 743         GET_REGA(env->regwptr[n - 8]);
 744     }
 745 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 746     if (n < 64) {
 747         /* fprs */
 748         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 749     }
 750     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 751     switch (n) {
 752     case 64: GET_REGA(env->y);
 753     case 65: GET_REGA(GET_PSR(env));
 754     case 66: GET_REGA(env->wim);
 755     case 67: GET_REGA(env->tbr);
 756     case 68: GET_REGA(env->pc);
 757     case 69: GET_REGA(env->npc);
 758     case 70: GET_REGA(env->fsr);
 759     case 71: GET_REGA(0); /* csr */
 760     default: GET_REGA(0);
 761     }
 762 #else
 763     if (n < 64) {
 764         /* f0-f31 */
 765         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 766     }
 767     if (n < 80) {
 768         /* f32-f62 (double width, even numbers only) */
 769         uint64_t val;
 770
 771         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 772         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 773         GET_REG64(val);
 774     }
 775     switch (n) {
 776     case 80: GET_REGL(env->pc);
 777     case 81: GET_REGL(env->npc);
 778     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 779                            ((env->asi & 0xff) << 24) |
 780                            ((env->pstate & 0xfff) << 8) |
 781                            GET_CWP64(env));
 782     case 83: GET_REGL(env->fsr);
 783     case 84: GET_REGL(env->fprs);
 784     case 85: GET_REGL(env->y);
 785     }
 786 #endif
 787     return 0;
 788 }
 789
 790 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 791 {
 792 #if defined(TARGET_ABI32)
 793     abi_ulong tmp;
 794
 795     tmp = ldl_p(mem_buf);
 796 #else
 797     target_ulong tmp;
 798
 799     tmp = ldtul_p(mem_buf);
 800 #endif
 801
 802     if (n < 8) {
 803         /* g0..g7 */
 804         env->gregs[n] = tmp;
 805     } else if (n < 32) {
 806         /* register window */
 807         env->regwptr[n - 8] = tmp;
 808     }
 809 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 810     else if (n < 64) {
 811         /* fprs */
 812         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 813     } else {
 814         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 815         switch (n) {
 816         case 64: env->y = tmp; break;
 817         case 65: PUT_PSR(env, tmp); break;
 818         case 66: env->wim = tmp; break;
 819         case 67: env->tbr = tmp; break;
 820         case 68: env->pc = tmp; break;
 821         case 69: env->npc = tmp; break;
 822         case 70: env->fsr = tmp; break;
 823         default: return 0;
 824         }
 825     }
 826     return 4;
 827 #else
 828     else if (n < 64) {
 829         /* f0-f31 */
 830         env->fpr[n] = ldfl_p(mem_buf);
 831         return 4;
 832     } else if (n < 80) {
 833         /* f32-f62 (double width, even numbers only) */
 834         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 835         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 836     } else {
 837         switch (n) {
 838         case 80: env->pc = tmp; break;
 839         case 81: env->npc = tmp; break;
 840         case 82:
 841             PUT_CCR(env, tmp >> 32);
 842             env->asi = (tmp >> 24) & 0xff;
 843             env->pstate = (tmp >> 8) & 0xfff;
 844             PUT_CWP64(env, tmp & 0xff);
 845             break;
 846         case 83: env->fsr = tmp; break;
 847         case 84: env->fprs = tmp; break;
 848         case 85: env->y = tmp; break;
 849         default: return 0;
 850         }
 851     }
 852     return 8;
 853 #endif
 854 }
 855 #elif defined (TARGET_ARM)
 856
 857 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 858    whatever the target description contains.  Due to a historical mishap
 859    the FPA registers appear in between core integer regs and the CPSR.
 860    We hack round this by giving the FPA regs zero size when talking to a
 861    newer gdb.  */
 862 #define NUM_CORE_REGS 26
 863 #define GDB_CORE_XML "arm-core.xml"
 864
 865 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 866 {
 867     if (n < 16) {
 868         /* Core integer register.  */
 869         GET_REG32(env->regs[n]);
 870     }
 871     if (n < 24) {
 872         /* FPA registers.  */
 873         if (gdb_has_xml)
 874             return 0;
 875         memset(mem_buf, 0, 12);
 876         return 12;
 877     }
 878     switch (n) {
 879     case 24:
 880         /* FPA status register.  */
 881         if (gdb_has_xml)
 882             return 0;
 883         GET_REG32(0);
 884     case 25:
 885         /* CPSR */
 886         GET_REG32(cpsr_read(env));
 887     }
 888     /* Unknown register.  */
 889     return 0;
 890 }
 891
 892 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 893 {
 894     uint32_t tmp;
 895
 896     tmp = ldl_p(mem_buf);
 897
 898     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 899        cause problems if we ever implement the Jazelle DBX extensions.  */
 900     if (n == 15)
 901         tmp &= ~1;
 902
 903     if (n < 16) {
 904         /* Core integer register.  */
 905         env->regs[n] = tmp;
 906         return 4;
 907     }
 908     if (n < 24) { /* 16-23 */
 909         /* FPA registers (ignored).  */
 910         if (gdb_has_xml)
 911             return 0;
 912         return 12;
 913     }
 914     switch (n) {
 915     case 24:
 916         /* FPA status register (ignored).  */
 917         if (gdb_has_xml)
 918             return 0;
 919         return 4;
 920     case 25:
 921         /* CPSR */
 922         cpsr_write (env, tmp, 0xffffffff);
 923         return 4;
 924     }
 925     /* Unknown register.  */
 926     return 0;
 927 }
 928
 929 #elif defined (TARGET_M68K)
 930
 931 #define NUM_CORE_REGS 18
 932
 933 #define GDB_CORE_XML "cf-core.xml"
 934
 935 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 936 {
 937     if (n < 8) {
 938         /* D0-D7 */
 939         GET_REG32(env->dregs[n]);
 940     } else if (n < 16) {
 941         /* A0-A7 */
 942         GET_REG32(env->aregs[n - 8]);
 943     } else {
 944         switch (n) {
 945         case 16: GET_REG32(env->sr);
 946         case 17: GET_REG32(env->pc);
 947         }
 948     }
 949     /* FP registers not included here because they vary between
 950        ColdFire and m68k.  Use XML bits for these.  */
 951     return 0;
 952 }
 953
 954 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 955 {
 956     uint32_t tmp;
 957
 958     tmp = ldl_p(mem_buf);
 959
 960     if (n < 8) {
 961         /* D0-D7 */
 962         env->dregs[n] = tmp;
 963     } else if (n < 8) {
 964         /* A0-A7 */
 965         env->aregs[n - 8] = tmp;
 966     } else {
 967         switch (n) {
 968         case 16: env->sr = tmp; break;
 969         case 17: env->pc = tmp; break;
 970         default: return 0;
 971         }
 972     }
 973     return 4;
 974 }
 975 #elif defined (TARGET_MIPS)
 976
 977 #define NUM_CORE_REGS 73
 978
 979 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 980 {
 981     if (n < 32) {
 982         GET_REGL(env->active_tc.gpr[n]);
 983     }
 984     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
 985         if (n >= 38 && n < 70) {
 986             if (env->CP0_Status & (1 << CP0St_FR))
 987                 GET_REGL(env->active_fpu.fpr[n - 38].d);
 988             else
 989                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
 990         }
 991         switch (n) {
 992         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
 993         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
 994         }
 995     }
 996     switch (n) {
 997     case 32: GET_REGL((int32_t)env->CP0_Status);
 998     case 33: GET_REGL(env->active_tc.LO[0]);
 999     case 34: GET_REGL(env->active_tc.HI[0]);
1000     case 35: GET_REGL(env->CP0_BadVAddr);
1001     case 36: GET_REGL((int32_t)env->CP0_Cause);
1002     case 37: GET_REGL(env->active_tc.PC);
1003     case 72: GET_REGL(0); /* fp */
1004     case 89: GET_REGL((int32_t)env->CP0_PRid);
1005     }
1006     if (n >= 73 && n <= 88) {
1007         /* 16 embedded regs.  */
1008         GET_REGL(0);
1009     }
1010
1011     return 0;
1012 }
1013
1014 /* convert MIPS rounding mode in FCR31 to IEEE library */
1015 static unsigned int ieee_rm[] =
1016   {
1017     float_round_nearest_even,
1018     float_round_to_zero,
1019     float_round_up,
1020     float_round_down
1021   };
1022 #define RESTORE_ROUNDING_MODE \
1023     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1024
1025 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1026 {
1027     target_ulong tmp;
1028
1029     tmp = ldtul_p(mem_buf);
1030
1031     if (n < 32) {
1032         env->active_tc.gpr[n] = tmp;
1033         return sizeof(target_ulong);
1034     }
1035     if (env->CP0_Config1 & (1 << CP0C1_FP)
1036             && n >= 38 && n < 73) {
1037         if (n < 70) {
1038             if (env->CP0_Status & (1 << CP0St_FR))
1039               env->active_fpu.fpr[n - 38].d = tmp;
1040             else
1041               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1042         }
1043         switch (n) {
1044         case 70:
1045             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1046             /* set rounding mode */
1047             RESTORE_ROUNDING_MODE;
1048 #ifndef CONFIG_SOFTFLOAT
1049             /* no floating point exception for native float */
1050             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1051 #endif
1052             break;
1053         case 71: env->active_fpu.fcr0 = tmp; break;
1054         }
1055         return sizeof(target_ulong);
1056     }
1057     switch (n) {
1058     case 32: env->CP0_Status = tmp; break;
1059     case 33: env->active_tc.LO[0] = tmp; break;
1060     case 34: env->active_tc.HI[0] = tmp; break;
1061     case 35: env->CP0_BadVAddr = tmp; break;
1062     case 36: env->CP0_Cause = tmp; break;
1063     case 37: env->active_tc.PC = tmp; break;
1064     case 72: /* fp, ignored */ break;
1065     default:
1066         if (n > 89)
1067             return 0;
1068         /* Other registers are readonly.  Ignore writes.  */
1069         break;
1070     }
1071
1072     return sizeof(target_ulong);
1073 }
1074 #elif defined (TARGET_SH4)
1075
1076 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1077 /* FIXME: We should use XML for this.  */
1078
1079 #define NUM_CORE_REGS 59
1080
1081 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1082 {
1083     if (n < 8) {
1084         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1085             GET_REGL(env->gregs[n + 16]);
1086         } else {
1087             GET_REGL(env->gregs[n]);
1088         }
1089     } else if (n < 16) {
1090         GET_REGL(env->gregs[n - 8]);
1091     } else if (n >= 25 && n < 41) {
1092         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1093     } else if (n >= 43 && n < 51) {
1094         GET_REGL(env->gregs[n - 43]);
1095     } else if (n >= 51 && n < 59) {
1096         GET_REGL(env->gregs[n - (51 - 16)]);
1097     }
1098     switch (n) {
1099     case 16: GET_REGL(env->pc);
1100     case 17: GET_REGL(env->pr);
1101     case 18: GET_REGL(env->gbr);
1102     case 19: GET_REGL(env->vbr);
1103     case 20: GET_REGL(env->mach);
1104     case 21: GET_REGL(env->macl);
1105     case 22: GET_REGL(env->sr);
1106     case 23: GET_REGL(env->fpul);
1107     case 24: GET_REGL(env->fpscr);
1108     case 41: GET_REGL(env->ssr);
1109     case 42: GET_REGL(env->spc);
1110     }
1111
1112     return 0;
1113 }
1114
1115 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1116 {
1117     uint32_t tmp;
1118
1119     tmp = ldl_p(mem_buf);
1120
1121     if (n < 8) {
1122         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1123             env->gregs[n + 16] = tmp;
1124         } else {
1125             env->gregs[n] = tmp;
1126         }
1127         return 4;
1128     } else if (n < 16) {
1129         env->gregs[n - 8] = tmp;
1130         return 4;
1131     } else if (n >= 25 && n < 41) {
1132         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1133     } else if (n >= 43 && n < 51) {
1134         env->gregs[n - 43] = tmp;
1135         return 4;
1136     } else if (n >= 51 && n < 59) {
1137         env->gregs[n - (51 - 16)] = tmp;
1138         return 4;
1139     }
1140     switch (n) {
1141     case 16: env->pc = tmp;
1142     case 17: env->pr = tmp;
1143     case 18: env->gbr = tmp;
1144     case 19: env->vbr = tmp;
1145     case 20: env->mach = tmp;
1146     case 21: env->macl = tmp;
1147     case 22: env->sr = tmp;
1148     case 23: env->fpul = tmp;
1149     case 24: env->fpscr = tmp;
1150     case 41: env->ssr = tmp;
1151     case 42: env->spc = tmp;
1152     default: return 0;
1153     }
1154
1155     return 4;
1156 }
1157 #elif defined (TARGET_CRIS)
1158
1159 #define NUM_CORE_REGS 49
1160
1161 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1162 {
1163     uint8_t srs;
1164
1165     srs = env->pregs[PR_SRS];
1166     if (n < 16) {
1167         GET_REG32(env->regs[n]);
1168     }
1169
1170     if (n >= 21 && n < 32) {
1171         GET_REG32(env->pregs[n - 16]);
1172     }
1173     if (n >= 33 && n < 49) {
1174         GET_REG32(env->sregs[srs][n - 33]);
1175     }
1176     switch (n) {
1177     case 16: GET_REG8(env->pregs[0]);
1178     case 17: GET_REG8(env->pregs[1]);
1179     case 18: GET_REG32(env->pregs[2]);
1180     case 19: GET_REG8(srs);
1181     case 20: GET_REG16(env->pregs[4]);
1182     case 32: GET_REG32(env->pc);
1183     }
1184
1185     return 0;
1186 }
1187
1188 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1189 {
1190     uint32_t tmp;
1191
1192     if (n > 49)
1193         return 0;
1194
1195     tmp = ldl_p(mem_buf);
1196
1197     if (n < 16) {
1198         env->regs[n] = tmp;
1199     }
1200
1201     if (n >= 21 && n < 32) {
1202         env->pregs[n - 16] = tmp;
1203     }
1204
1205     /* FIXME: Should support function regs be writable?  */
1206     switch (n) {
1207     case 16: return 1;
1208     case 17: return 1;
1209     case 18: env->pregs[PR_PID] = tmp; break;
1210     case 19: return 1;
1211     case 20: return 2;
1212     case 32: env->pc = tmp; break;
1213     }
1214
1215     return 4;
1216 }
1217 #elif defined (TARGET_ALPHA)
1218
1219 #define NUM_CORE_REGS 65
1220
1221 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1222 {
1223     if (n < 31) {
1224        GET_REGL(env->ir[n]);
1225     }
1226     else if (n == 31) {
1227        GET_REGL(0);
1228     }
1229     else if (n<63) {
1230        uint64_t val;
1231
1232        val=*((uint64_t *)&env->fir[n-32]);
1233        GET_REGL(val);
1234     }
1235     else if (n==63) {
1236        GET_REGL(env->fpcr);
1237     }
1238     else if (n==64) {
1239        GET_REGL(env->pc);
1240     }
1241     else {
1242        GET_REGL(0);
1243     }
1244
1245     return 0;
1246 }
1247
1248 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1249 {
1250     target_ulong tmp;
1251     tmp = ldtul_p(mem_buf);
1252
1253     if (n < 31) {
1254         env->ir[n] = tmp;
1255     }
1256
1257     if (n > 31 && n < 63) {
1258         env->fir[n - 32] = ldfl_p(mem_buf);
1259     }
1260
1261     if (n == 64 ) {
1262        env->pc=tmp;
1263     }
1264
1265     return 8;
1266 }
1267 #else
1268
1269 #define NUM_CORE_REGS 0
1270
1271 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1272 {
1273     return 0;
1274 }
1275
1276 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1277 {
1278     return 0;
1279 }
1280
1281 #endif
1282
1283 static int num_g_regs = NUM_CORE_REGS;
1284
1285 #ifdef GDB_CORE_XML
1286 /* Encode data using the encoding for 'x' packets.  */
1287 static int memtox(char *buf, const char *mem, int len)
1288 {
1289     char *p = buf;
1290     char c;
1291
1292     while (len--) {
1293         c = *(mem++);
1294         switch (c) {
1295         case '#': case '$': case '*': case '}':
1296             *(p++) = '}';
1297             *(p++) = c ^ 0x20;
1298             break;
1299         default:
1300             *(p++) = c;
1301             break;
1302         }
1303     }
1304     return p - buf;
1305 }
1306
1307 static const char *get_feature_xml(const char *p, const char **newp)
1308 {
1309     extern const char *const xml_builtin[][2];
1310     size_t len;
1311     int i;
1312     const char *name;
1313     static char target_xml[1024];
1314
1315     len = 0;
1316     while (p[len] && p[len] != ':')
1317         len++;
1318     *newp = p + len;
1319
1320     name = NULL;
1321     if (strncmp(p, "target.xml", len) == 0) {
1322         /* Generate the XML description for this CPU.  */
1323         if (!target_xml[0]) {
1324             GDBRegisterState *r;
1325
1326             snprintf(target_xml, sizeof(target_xml),
1327                      "<?xml version=\"1.0\"?>"
1328                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1329                      "<target>"
1330                      "<xi:include href=\"%s\"/>",
1331                      GDB_CORE_XML);
1332
1333             for (r = first_cpu->gdb_regs; r; r = r->next) {
1334                 strcat(target_xml, "<xi:include href=\"");
1335                 strcat(target_xml, r->xml);
1336                 strcat(target_xml, "\"/>");
1337             }
1338             strcat(target_xml, "</target>");
1339         }
1340         return target_xml;
1341     }
1342     for (i = 0; ; i++) {
1343         name = xml_builtin[i][0];
1344         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1345             break;
1346     }
1347     return name ? xml_builtin[i][1] : NULL;
1348 }
1349 #endif
1350
1351 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1352 {
1353     GDBRegisterState *r;
1354
1355     if (reg < NUM_CORE_REGS)
1356         return cpu_gdb_read_register(env, mem_buf, reg);
1357
1358     for (r = env->gdb_regs; r; r = r->next) {
1359         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1360             return r->get_reg(env, mem_buf, reg - r->base_reg);
1361         }
1362     }
1363     return 0;
1364 }
1365
1366 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1367 {
1368     GDBRegisterState *r;
1369
1370     if (reg < NUM_CORE_REGS)
1371         return cpu_gdb_write_register(env, mem_buf, reg);
1372
1373     for (r = env->gdb_regs; r; r = r->next) {
1374         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1375             return r->set_reg(env, mem_buf, reg - r->base_reg);
1376         }
1377     }
1378     return 0;
1379 }
1380
1381 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1382    specifies the first register number and these registers are included in
1383    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1384    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1385  */
1386
1387 void gdb_register_coprocessor(CPUState * env,
1388                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1389                              int num_regs, const char *xml, int g_pos)
1390 {
1391     GDBRegisterState *s;
1392     GDBRegisterState **p;
1393     static int last_reg = NUM_CORE_REGS;
1394
1395     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1396     s->base_reg = last_reg;
1397     s->num_regs = num_regs;
1398     s->get_reg = get_reg;
1399     s->set_reg = set_reg;
1400     s->xml = xml;
1401     p = &env->gdb_regs;
1402     while (*p) {
1403         /* Check for duplicates.  */
1404         if (strcmp((*p)->xml, xml) == 0)
1405             return;
1406         p = &(*p)->next;
1407     }
1408     /* Add to end of list.  */
1409     last_reg += num_regs;
1410     *p = s;
1411     if (g_pos) {
1412         if (g_pos != s->base_reg) {
1413             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1414                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1415         } else {
1416             num_g_regs = last_reg;
1417         }
1418     }
1419 }
1420
1421 /* GDB breakpoint/watchpoint types */
1422 #define GDB_BREAKPOINT_SW        0
1423 #define GDB_BREAKPOINT_HW        1
1424 #define GDB_WATCHPOINT_WRITE     2
1425 #define GDB_WATCHPOINT_READ      3
1426 #define GDB_WATCHPOINT_ACCESS    4
1427
1428 #ifndef CONFIG_USER_ONLY
1429 static const int xlat_gdb_type[] = {
1430     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1431     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1432     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1433 };
1434 #endif
1435
1436 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1437 {
1438     CPUState *env;
1439     int err = 0;
1440
1441     switch (type) {
1442     case GDB_BREAKPOINT_SW:
1443     case GDB_BREAKPOINT_HW:
1444         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1445             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1446             if (err)
1447                 break;
1448         }
1449         return err;
1450 #ifndef CONFIG_USER_ONLY
1451     case GDB_WATCHPOINT_WRITE:
1452     case GDB_WATCHPOINT_READ:
1453     case GDB_WATCHPOINT_ACCESS:
1454         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1455             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1456                                         NULL);
1457             if (err)
1458                 break;
1459         }
1460         return err;
1461 #endif
1462     default:
1463         return -ENOSYS;
1464     }
1465 }
1466
1467 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1468 {
1469     CPUState *env;
1470     int err = 0;
1471
1472     switch (type) {
1473     case GDB_BREAKPOINT_SW:
1474     case GDB_BREAKPOINT_HW:
1475         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1476             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1477             if (err)
1478                 break;
1479         }
1480         return err;
1481 #ifndef CONFIG_USER_ONLY
1482     case GDB_WATCHPOINT_WRITE:
1483     case GDB_WATCHPOINT_READ:
1484     case GDB_WATCHPOINT_ACCESS:
1485         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1486             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1487             if (err)
1488                 break;
1489         }
1490         return err;
1491 #endif
1492     default:
1493         return -ENOSYS;
1494     }
1495 }
1496
1497 static void gdb_breakpoint_remove_all(void)
1498 {
1499     CPUState *env;
1500
1501     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1502         cpu_breakpoint_remove_all(env, BP_GDB);
1503 #ifndef CONFIG_USER_ONLY
1504         cpu_watchpoint_remove_all(env, BP_GDB);
1505 #endif
1506     }
1507 }
1508
1509 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1510 {
1511     CPUState *env;
1512     const char *p;
1513     int ch, reg_size, type, res, thread;
1514     char buf[MAX_PACKET_LENGTH];
1515     uint8_t mem_buf[MAX_PACKET_LENGTH];
1516     uint8_t *registers;
1517     target_ulong addr, len;
1518
1519 #ifdef DEBUG_GDB
1520     printf("command='%s'\n", line_buf);
1521 #endif
1522     p = line_buf;
1523     ch = *p++;
1524     switch(ch) {
1525     case '?':
1526         /* TODO: Make this return the correct value for user-mode.  */
1527         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1528                  s->c_cpu->cpu_index+1);
1529         put_packet(s, buf);
1530         /* Remove all the breakpoints when this query is issued,
1531          * because gdb is doing and initial connect and the state
1532          * should be cleaned up.
1533          */
1534         gdb_breakpoint_remove_all();
1535         break;
1536     case 'c':
1537         if (*p != '\0') {
1538             addr = strtoull(p, (char **)&p, 16);
1539 #if defined(TARGET_I386)
1540             s->c_cpu->eip = addr;
1541 #elif defined (TARGET_PPC)
1542             s->c_cpu->nip = addr;
1543 #elif defined (TARGET_SPARC)
1544             s->c_cpu->pc = addr;
1545             s->c_cpu->npc = addr + 4;
1546 #elif defined (TARGET_ARM)
1547             s->c_cpu->regs[15] = addr;
1548 #elif defined (TARGET_SH4)
1549             s->c_cpu->pc = addr;
1550 #elif defined (TARGET_MIPS)
1551             s->c_cpu->active_tc.PC = addr;
1552 #elif defined (TARGET_CRIS)
1553             s->c_cpu->pc = addr;
1554 #elif defined (TARGET_ALPHA)
1555             s->c_cpu->pc = addr;
1556 #endif
1557         }
1558         s->signal = 0;
1559         gdb_continue(s);
1560         return RS_IDLE;
1561     case 'C':
1562         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1563         if (s->signal == -1)
1564             s->signal = 0;
1565         gdb_continue(s);
1566         return RS_IDLE;
1567     case 'k':
1568         /* Kill the target */
1569         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1570         exit(0);
1571     case 'D':
1572         /* Detach packet */
1573         gdb_breakpoint_remove_all();
1574         gdb_continue(s);
1575         put_packet(s, "OK");
1576         break;
1577     case 's':
1578         if (*p != '\0') {
1579             addr = strtoull(p, (char **)&p, 16);
1580 #if defined(TARGET_I386)
1581             s->c_cpu->eip = addr;
1582 #elif defined (TARGET_PPC)
1583             s->c_cpu->nip = addr;
1584 #elif defined (TARGET_SPARC)
1585             s->c_cpu->pc = addr;
1586             s->c_cpu->npc = addr + 4;
1587 #elif defined (TARGET_ARM)
1588             s->c_cpu->regs[15] = addr;
1589 #elif defined (TARGET_SH4)
1590             s->c_cpu->pc = addr;
1591 #elif defined (TARGET_MIPS)
1592             s->c_cpu->active_tc.PC = addr;
1593 #elif defined (TARGET_CRIS)
1594             s->c_cpu->pc = addr;
1595 #elif defined (TARGET_ALPHA)
1596             s->c_cpu->pc = addr;
1597 #endif
1598         }
1599         cpu_single_step(s->c_cpu, sstep_flags);
1600         gdb_continue(s);
1601         return RS_IDLE;
1602     case 'F':
1603         {
1604             target_ulong ret;
1605             target_ulong err;
1606
1607             ret = strtoull(p, (char **)&p, 16);
1608             if (*p == ',') {
1609                 p++;
1610                 err = strtoull(p, (char **)&p, 16);
1611             } else {
1612                 err = 0;
1613             }
1614             if (*p == ',')
1615                 p++;
1616             type = *p;
1617             if (gdb_current_syscall_cb)
1618                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1619             if (type == 'C') {
1620                 put_packet(s, "T02");
1621             } else {
1622                 gdb_continue(s);
1623             }
1624         }
1625         break;
1626     case 'g':
1627         len = 0;
1628         for (addr = 0; addr < num_g_regs; addr++) {
1629             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1630             len += reg_size;
1631         }
1632         memtohex(buf, mem_buf, len);
1633         put_packet(s, buf);
1634         break;
1635     case 'G':
1636         registers = mem_buf;
1637         len = strlen(p) / 2;
1638         hextomem((uint8_t *)registers, p, len);
1639         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1640             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1641             len -= reg_size;
1642             registers += reg_size;
1643         }
1644         put_packet(s, "OK");
1645         break;
1646     case 'm':
1647         addr = strtoull(p, (char **)&p, 16);
1648         if (*p == ',')
1649             p++;
1650         len = strtoull(p, NULL, 16);
1651         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1652             put_packet (s, "E14");
1653         } else {
1654             memtohex(buf, mem_buf, len);
1655             put_packet(s, buf);
1656         }
1657         break;
1658     case 'M':
1659         addr = strtoull(p, (char **)&p, 16);
1660         if (*p == ',')
1661             p++;
1662         len = strtoull(p, (char **)&p, 16);
1663         if (*p == ':')
1664             p++;
1665         hextomem(mem_buf, p, len);
1666         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1667             put_packet(s, "E14");
1668         else
1669             put_packet(s, "OK");
1670         break;
1671     case 'p':
1672         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1673            This works, but can be very slow.  Anything new enough to
1674            understand XML also knows how to use this properly.  */
1675         if (!gdb_has_xml)
1676             goto unknown_command;
1677         addr = strtoull(p, (char **)&p, 16);
1678         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1679         if (reg_size) {
1680             memtohex(buf, mem_buf, reg_size);
1681             put_packet(s, buf);
1682         } else {
1683             put_packet(s, "E14");
1684         }
1685         break;
1686     case 'P':
1687         if (!gdb_has_xml)
1688             goto unknown_command;
1689         addr = strtoull(p, (char **)&p, 16);
1690         if (*p == '=')
1691             p++;
1692         reg_size = strlen(p) / 2;
1693         hextomem(mem_buf, p, reg_size);
1694         gdb_write_register(s->g_cpu, mem_buf, addr);
1695         put_packet(s, "OK");
1696         break;
1697     case 'Z':
1698     case 'z':
1699         type = strtoul(p, (char **)&p, 16);
1700         if (*p == ',')
1701             p++;
1702         addr = strtoull(p, (char **)&p, 16);
1703         if (*p == ',')
1704             p++;
1705         len = strtoull(p, (char **)&p, 16);
1706         if (ch == 'Z')
1707             res = gdb_breakpoint_insert(addr, len, type);
1708         else
1709             res = gdb_breakpoint_remove(addr, len, type);
1710         if (res >= 0)
1711              put_packet(s, "OK");
1712         else if (res == -ENOSYS)
1713             put_packet(s, "");
1714         else
1715             put_packet(s, "E22");
1716         break;
1717     case 'H':
1718         type = *p++;
1719         thread = strtoull(p, (char **)&p, 16);
1720         if (thread == -1 || thread == 0) {
1721             put_packet(s, "OK");
1722             break;
1723         }
1724         for (env = first_cpu; env != NULL; env = env->next_cpu)
1725             if (env->cpu_index + 1 == thread)
1726                 break;
1727         if (env == NULL) {
1728             put_packet(s, "E22");
1729             break;
1730         }
1731         switch (type) {
1732         case 'c':
1733             s->c_cpu = env;
1734             put_packet(s, "OK");
1735             break;
1736         case 'g':
1737             s->g_cpu = env;
1738             put_packet(s, "OK");
1739             break;
1740         default:
1741              put_packet(s, "E22");
1742              break;
1743         }
1744         break;
1745     case 'T':
1746         thread = strtoull(p, (char **)&p, 16);
1747 #ifndef CONFIG_USER_ONLY
1748         if (thread > 0 && thread < smp_cpus + 1)
1749 #else
1750         if (thread == 1)
1751 #endif
1752              put_packet(s, "OK");
1753         else
1754             put_packet(s, "E22");
1755         break;
1756     case 'q':
1757     case 'Q':
1758         /* parse any 'q' packets here */
1759         if (!strcmp(p,"qemu.sstepbits")) {
1760             /* Query Breakpoint bit definitions */
1761             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1762                      SSTEP_ENABLE,
1763                      SSTEP_NOIRQ,
1764                      SSTEP_NOTIMER);
1765             put_packet(s, buf);
1766             break;
1767         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1768             /* Display or change the sstep_flags */
1769             p += 10;
1770             if (*p != '=') {
1771                 /* Display current setting */
1772                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1773                 put_packet(s, buf);
1774                 break;
1775             }
1776             p++;
1777             type = strtoul(p, (char **)&p, 16);
1778             sstep_flags = type;
1779             put_packet(s, "OK");
1780             break;
1781         } else if (strcmp(p,"C") == 0) {
1782             /* "Current thread" remains vague in the spec, so always return
1783              *  the first CPU (gdb returns the first thread). */
1784             put_packet(s, "QC1");
1785             break;
1786         } else if (strcmp(p,"fThreadInfo") == 0) {
1787             s->query_cpu = first_cpu;
1788             goto report_cpuinfo;
1789         } else if (strcmp(p,"sThreadInfo") == 0) {
1790         report_cpuinfo:
1791             if (s->query_cpu) {
1792                 snprintf(buf, sizeof(buf), "m%x", s->query_cpu->cpu_index+1);
1793                 put_packet(s, buf);
1794                 s->query_cpu = s->query_cpu->next_cpu;
1795             } else
1796                 put_packet(s, "l");
1797             break;
1798         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1799             thread = strtoull(p+16, (char **)&p, 16);
1800             for (env = first_cpu; env != NULL; env = env->next_cpu)
1801                 if (env->cpu_index + 1 == thread) {
1802                     len = snprintf((char *)mem_buf, sizeof(mem_buf),
1803                                    "CPU#%d [%s]", env->cpu_index,
1804                                    env->halted ? "halted " : "running");
1805                     memtohex(buf, mem_buf, len);
1806                     put_packet(s, buf);
1807                     break;
1808                 }
1809             break;
1810         }
1811 #ifdef CONFIG_USER_ONLY
1812         else if (strncmp(p, "Offsets", 7) == 0) {
1813             TaskState *ts = s->c_cpu->opaque;
1814
1815             snprintf(buf, sizeof(buf),
1816                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1817                      ";Bss=" TARGET_ABI_FMT_lx,
1818                      ts->info->code_offset,
1819                      ts->info->data_offset,
1820                      ts->info->data_offset);
1821             put_packet(s, buf);
1822             break;
1823         }
1824 #else /* !CONFIG_USER_ONLY */
1825         else if (strncmp(p, "Rcmd,", 5) == 0) {
1826             int len = strlen(p + 5);
1827
1828             if ((len % 2) != 0) {
1829                 put_packet(s, "E01");
1830                 break;
1831             }
1832             hextomem(mem_buf, p + 5, len);
1833             len = len / 2;
1834             mem_buf[len++] = 0;
1835             qemu_chr_read(s->mon_chr, mem_buf, len);
1836             put_packet(s, "OK");
1837             break;
1838         }
1839 #endif /* !CONFIG_USER_ONLY */
1840         if (strncmp(p, "Supported", 9) == 0) {
1841             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1842 #ifdef GDB_CORE_XML
1843             strcat(buf, ";qXfer:features:read+");
1844 #endif
1845             put_packet(s, buf);
1846             break;
1847         }
1848 #ifdef GDB_CORE_XML
1849         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1850             const char *xml;
1851             target_ulong total_len;
1852
1853             gdb_has_xml = 1;
1854             p += 19;
1855             xml = get_feature_xml(p, &p);
1856             if (!xml) {
1857                 snprintf(buf, sizeof(buf), "E00");
1858                 put_packet(s, buf);
1859                 break;
1860             }
1861
1862             if (*p == ':')
1863                 p++;
1864             addr = strtoul(p, (char **)&p, 16);
1865             if (*p == ',')
1866                 p++;
1867             len = strtoul(p, (char **)&p, 16);
1868
1869             total_len = strlen(xml);
1870             if (addr > total_len) {
1871                 snprintf(buf, sizeof(buf), "E00");
1872                 put_packet(s, buf);
1873                 break;
1874             }
1875             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1876                 len = (MAX_PACKET_LENGTH - 5) / 2;
1877             if (len < total_len - addr) {
1878                 buf[0] = 'm';
1879                 len = memtox(buf + 1, xml + addr, len);
1880             } else {
1881                 buf[0] = 'l';
1882                 len = memtox(buf + 1, xml + addr, total_len - addr);
1883             }
1884             put_packet_binary(s, buf, len + 1);
1885             break;
1886         }
1887 #endif
1888         /* Unrecognised 'q' command.  */
1889         goto unknown_command;
1890
1891     default:
1892     unknown_command:
1893         /* put empty packet */
1894         buf[0] = '\0';
1895         put_packet(s, buf);
1896         break;
1897     }
1898     return RS_IDLE;
1899 }
1900
1901 void gdb_set_stop_cpu(CPUState *env)
1902 {
1903     gdbserver_state->c_cpu = env;
1904     gdbserver_state->g_cpu = env;
1905 }
1906
1907 #ifndef CONFIG_USER_ONLY
1908 static void gdb_vm_state_change(void *opaque, int running, int reason)
1909 {
1910     GDBState *s = gdbserver_state;
1911     CPUState *env = s->c_cpu;
1912     char buf[256];
1913     const char *type;
1914     int ret;
1915
1916     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
1917         s->state == RS_SYSCALL)
1918         return;
1919
1920     /* disable single step if it was enable */
1921     cpu_single_step(env, 0);
1922
1923     if (reason == EXCP_DEBUG) {
1924         if (env->watchpoint_hit) {
1925             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
1926             case BP_MEM_READ:
1927                 type = "r";
1928                 break;
1929             case BP_MEM_ACCESS:
1930                 type = "a";
1931                 break;
1932             default:
1933                 type = "";
1934                 break;
1935             }
1936             snprintf(buf, sizeof(buf),
1937                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1938                      GDB_SIGNAL_TRAP, env->cpu_index+1, type,
1939                      env->watchpoint_hit->vaddr);
1940             put_packet(s, buf);
1941             env->watchpoint_hit = NULL;
1942             return;
1943         }
1944         tb_flush(env);
1945         ret = GDB_SIGNAL_TRAP;
1946     } else {
1947         ret = GDB_SIGNAL_INT;
1948     }
1949     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, env->cpu_index+1);
1950     put_packet(s, buf);
1951 }
1952 #endif
1953
1954 /* Send a gdb syscall request.
1955    This accepts limited printf-style format specifiers, specifically:
1956     %x  - target_ulong argument printed in hex.
1957     %lx - 64-bit argument printed in hex.
1958     %s  - string pointer (target_ulong) and length (int) pair.  */
1959 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1960 {
1961     va_list va;
1962     char buf[256];
1963     char *p;
1964     target_ulong addr;
1965     uint64_t i64;
1966     GDBState *s;
1967
1968     s = gdbserver_state;
1969     if (!s)
1970         return;
1971     gdb_current_syscall_cb = cb;
1972     s->state = RS_SYSCALL;
1973 #ifndef CONFIG_USER_ONLY
1974     vm_stop(EXCP_DEBUG);
1975 #endif
1976     s->state = RS_IDLE;
1977     va_start(va, fmt);
1978     p = buf;
1979     *(p++) = 'F';
1980     while (*fmt) {
1981         if (*fmt == '%') {
1982             fmt++;
1983             switch (*fmt++) {
1984             case 'x':
1985                 addr = va_arg(va, target_ulong);
1986                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
1987                 break;
1988             case 'l':
1989                 if (*(fmt++) != 'x')
1990                     goto bad_format;
1991                 i64 = va_arg(va, uint64_t);
1992                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
1993                 break;
1994             case 's':
1995                 addr = va_arg(va, target_ulong);
1996                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
1997                               addr, va_arg(va, int));
1998                 break;
1999             default:
2000             bad_format:
2001                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2002                         fmt - 1);
2003                 break;
2004             }
2005         } else {
2006             *(p++) = *(fmt++);
2007         }
2008     }
2009     *p = 0;
2010     va_end(va);
2011     put_packet(s, buf);
2012 #ifdef CONFIG_USER_ONLY
2013     gdb_handlesig(s->c_cpu, 0);
2014 #else
2015     cpu_exit(s->c_cpu);
2016 #endif
2017 }
2018
2019 static void gdb_read_byte(GDBState *s, int ch)
2020 {
2021     int i, csum;
2022     uint8_t reply;
2023
2024 #ifndef CONFIG_USER_ONLY
2025     if (s->last_packet_len) {
2026         /* Waiting for a response to the last packet.  If we see the start
2027            of a new command then abandon the previous response.  */
2028         if (ch == '-') {
2029 #ifdef DEBUG_GDB
2030             printf("Got NACK, retransmitting\n");
2031 #endif
2032             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2033         }
2034 #ifdef DEBUG_GDB
2035         else if (ch == '+')
2036             printf("Got ACK\n");
2037         else
2038             printf("Got '%c' when expecting ACK/NACK\n", ch);
2039 #endif
2040         if (ch == '+' || ch == '$')
2041             s->last_packet_len = 0;
2042         if (ch != '$')
2043             return;
2044     }
2045     if (vm_running) {
2046         /* when the CPU is running, we cannot do anything except stop
2047            it when receiving a char */
2048         vm_stop(EXCP_INTERRUPT);
2049     } else
2050 #endif
2051     {
2052         switch(s->state) {
2053         case RS_IDLE:
2054             if (ch == '$') {
2055                 s->line_buf_index = 0;
2056                 s->state = RS_GETLINE;
2057             }
2058             break;
2059         case RS_GETLINE:
2060             if (ch == '#') {
2061             s->state = RS_CHKSUM1;
2062             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2063                 s->state = RS_IDLE;
2064             } else {
2065             s->line_buf[s->line_buf_index++] = ch;
2066             }
2067             break;
2068         case RS_CHKSUM1:
2069             s->line_buf[s->line_buf_index] = '\0';
2070             s->line_csum = fromhex(ch) << 4;
2071             s->state = RS_CHKSUM2;
2072             break;
2073         case RS_CHKSUM2:
2074             s->line_csum |= fromhex(ch);
2075             csum = 0;
2076             for(i = 0; i < s->line_buf_index; i++) {
2077                 csum += s->line_buf[i];
2078             }
2079             if (s->line_csum != (csum & 0xff)) {
2080                 reply = '-';
2081                 put_buffer(s, &reply, 1);
2082                 s->state = RS_IDLE;
2083             } else {
2084                 reply = '+';
2085                 put_buffer(s, &reply, 1);
2086                 s->state = gdb_handle_packet(s, s->line_buf);
2087             }
2088             break;
2089         default:
2090             abort();
2091         }
2092     }
2093 }
2094
2095 #ifdef CONFIG_USER_ONLY
2096 int
2097 gdb_queuesig (void)
2098 {
2099     GDBState *s;
2100
2101     s = gdbserver_state;
2102
2103     if (gdbserver_fd < 0 || s->fd < 0)
2104         return 0;
2105     else
2106         return 1;
2107 }
2108
2109 int
2110 gdb_handlesig (CPUState *env, int sig)
2111 {
2112   GDBState *s;
2113   char buf[256];
2114   int n;
2115
2116   s = gdbserver_state;
2117   if (gdbserver_fd < 0 || s->fd < 0)
2118     return sig;
2119
2120   /* disable single step if it was enabled */
2121   cpu_single_step(env, 0);
2122   tb_flush(env);
2123
2124   if (sig != 0)
2125     {
2126       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2127       put_packet(s, buf);
2128     }
2129   /* put_packet() might have detected that the peer terminated the
2130      connection.  */
2131   if (s->fd < 0)
2132       return sig;
2133
2134   sig = 0;
2135   s->state = RS_IDLE;
2136   s->running_state = 0;
2137   while (s->running_state == 0) {
2138       n = read (s->fd, buf, 256);
2139       if (n > 0)
2140         {
2141           int i;
2142
2143           for (i = 0; i < n; i++)
2144             gdb_read_byte (s, buf[i]);
2145         }
2146       else if (n == 0 || errno != EAGAIN)
2147         {
2148           /* XXX: Connection closed.  Should probably wait for annother
2149              connection before continuing.  */
2150           return sig;
2151         }
2152   }
2153   sig = s->signal;
2154   s->signal = 0;
2155   return sig;
2156 }
2157
2158 /* Tell the remote gdb that the process has exited.  */
2159 void gdb_exit(CPUState *env, int code)
2160 {
2161   GDBState *s;
2162   char buf[4];
2163
2164   s = gdbserver_state;
2165   if (gdbserver_fd < 0 || s->fd < 0)
2166     return;
2167
2168   snprintf(buf, sizeof(buf), "W%02x", code);
2169   put_packet(s, buf);
2170 }
2171
2172 /* Tell the remote gdb that the process has exited due to SIG.  */
2173 void gdb_signalled(CPUState *env, int sig)
2174 {
2175   GDBState *s;
2176   char buf[4];
2177
2178   s = gdbserver_state;
2179   if (gdbserver_fd < 0 || s->fd < 0)
2180     return;
2181
2182   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2183   put_packet(s, buf);
2184 }
2185
2186 static void gdb_accept(void)
2187 {
2188     GDBState *s;
2189     struct sockaddr_in sockaddr;
2190     socklen_t len;
2191     int val, fd;
2192
2193     for(;;) {
2194         len = sizeof(sockaddr);
2195         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2196         if (fd < 0 && errno != EINTR) {
2197             perror("accept");
2198             return;
2199         } else if (fd >= 0) {
2200             break;
2201         }
2202     }
2203
2204     /* set short latency */
2205     val = 1;
2206     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2207
2208     s = qemu_mallocz(sizeof(GDBState));
2209
2210     memset (s, 0, sizeof (GDBState));
2211     s->c_cpu = first_cpu;
2212     s->g_cpu = first_cpu;
2213     s->fd = fd;
2214     gdb_has_xml = 0;
2215
2216     gdbserver_state = s;
2217
2218     fcntl(fd, F_SETFL, O_NONBLOCK);
2219 }
2220
2221 static int gdbserver_open(int port)
2222 {
2223     struct sockaddr_in sockaddr;
2224     int fd, val, ret;
2225
2226     fd = socket(PF_INET, SOCK_STREAM, 0);
2227     if (fd < 0) {
2228         perror("socket");
2229         return -1;
2230     }
2231
2232     /* allow fast reuse */
2233     val = 1;
2234     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2235
2236     sockaddr.sin_family = AF_INET;
2237     sockaddr.sin_port = htons(port);
2238     sockaddr.sin_addr.s_addr = 0;
2239     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2240     if (ret < 0) {
2241         perror("bind");
2242         return -1;
2243     }
2244     ret = listen(fd, 0);
2245     if (ret < 0) {
2246         perror("listen");
2247         return -1;
2248     }
2249     return fd;
2250 }
2251
2252 int gdbserver_start(int port)
2253 {
2254     gdbserver_fd = gdbserver_open(port);
2255     if (gdbserver_fd < 0)
2256         return -1;
2257     /* accept connections */
2258     gdb_accept();
2259     return 0;
2260 }
2261
2262 /* Disable gdb stub for child processes.  */
2263 void gdbserver_fork(CPUState *env)
2264 {
2265     GDBState *s = gdbserver_state;
2266     if (gdbserver_fd < 0 || s->fd < 0)
2267       return;
2268     close(s->fd);
2269     s->fd = -1;
2270     cpu_breakpoint_remove_all(env, BP_GDB);
2271     cpu_watchpoint_remove_all(env, BP_GDB);
2272 }
2273 #else
2274 static int gdb_chr_can_receive(void *opaque)
2275 {
2276   /* We can handle an arbitrarily large amount of data.
2277    Pick the maximum packet size, which is as good as anything.  */
2278   return MAX_PACKET_LENGTH;
2279 }
2280
2281 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2282 {
2283     int i;
2284
2285     for (i = 0; i < size; i++) {
2286         gdb_read_byte(gdbserver_state, buf[i]);
2287     }
2288 }
2289
2290 static void gdb_chr_event(void *opaque, int event)
2291 {
2292     switch (event) {
2293     case CHR_EVENT_RESET:
2294         vm_stop(EXCP_INTERRUPT);
2295         gdb_has_xml = 0;
2296         break;
2297     default:
2298         break;
2299     }
2300 }
2301
2302 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2303 {
2304     char buf[MAX_PACKET_LENGTH];
2305
2306     buf[0] = 'O';
2307     if (len > (MAX_PACKET_LENGTH/2) - 1)
2308         len = (MAX_PACKET_LENGTH/2) - 1;
2309     memtohex(buf + 1, (uint8_t *)msg, len);
2310     put_packet(s, buf);
2311 }
2312
2313 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2314 {
2315     const char *p = (const char *)buf;
2316     int max_sz;
2317
2318     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2319     for (;;) {
2320         if (len <= max_sz) {
2321             gdb_monitor_output(gdbserver_state, p, len);
2322             break;
2323         }
2324         gdb_monitor_output(gdbserver_state, p, max_sz);
2325         p += max_sz;
2326         len -= max_sz;
2327     }
2328     return len;
2329 }
2330
2331 int gdbserver_start(const char *port)
2332 {
2333     GDBState *s;
2334     char gdbstub_port_name[128];
2335     int port_num;
2336     char *p;
2337     CharDriverState *chr;
2338
2339     if (!port || !*port)
2340       return -1;
2341
2342     port_num = strtol(port, &p, 10);
2343     if (*p == 0) {
2344         /* A numeric value is interpreted as a port number.  */
2345         snprintf(gdbstub_port_name, sizeof(gdbstub_port_name),
2346                  "tcp::%d,nowait,nodelay,server", port_num);
2347         port = gdbstub_port_name;
2348     }
2349
2350     chr = qemu_chr_open("gdb", port, NULL);
2351     if (!chr)
2352         return -1;
2353
2354     s = qemu_mallocz(sizeof(GDBState));
2355     s->c_cpu = first_cpu;
2356     s->g_cpu = first_cpu;
2357     s->chr = chr;
2358     gdbserver_state = s;
2359     qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2360                           gdb_chr_event, NULL);
2361     qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2362
2363     /* Initialize a monitor terminal for gdb */
2364     s->mon_chr = qemu_mallocz(sizeof(*s->mon_chr));
2365     s->mon_chr->chr_write = gdb_monitor_write;
2366     monitor_init(s->mon_chr, 0);
2367
2368     return 0;
2369 }
2370 #endif