gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA  02110-1301 USA
  19  */
  20 #include "config.h"
  21 #include "qemu-common.h"
  22 #ifdef CONFIG_USER_ONLY
  23 #include <stdlib.h>
  24 #include <stdio.h>
  25 #include <stdarg.h>
  26 #include <string.h>
  27 #include <errno.h>
  28 #include <unistd.h>
  29 #include <fcntl.h>
  30
  31 #include "qemu.h"
  32 #else
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #endif
  37 #include "qemu-kvm.h"
  38
  39 #define MAX_PACKET_LENGTH 4096
  40
  41 #include "qemu_socket.h"
  42
  43
  44 enum {
  45     GDB_SIGNAL_0 = 0,
  46     GDB_SIGNAL_INT = 2,
  47     GDB_SIGNAL_TRAP = 5,
  48     GDB_SIGNAL_UNKNOWN = 143
  49 };
  50
  51 #ifdef CONFIG_USER_ONLY
  52
  53 /* Map target signal numbers to GDB protocol signal numbers and vice
  54  * versa.  For user emulation's currently supported systems, we can
  55  * assume most signals are defined.
  56  */
  57
  58 static int gdb_signal_table[] = {
  59     0,
  60     TARGET_SIGHUP,
  61     TARGET_SIGINT,
  62     TARGET_SIGQUIT,
  63     TARGET_SIGILL,
  64     TARGET_SIGTRAP,
  65     TARGET_SIGABRT,
  66     -1, /* SIGEMT */
  67     TARGET_SIGFPE,
  68     TARGET_SIGKILL,
  69     TARGET_SIGBUS,
  70     TARGET_SIGSEGV,
  71     TARGET_SIGSYS,
  72     TARGET_SIGPIPE,
  73     TARGET_SIGALRM,
  74     TARGET_SIGTERM,
  75     TARGET_SIGURG,
  76     TARGET_SIGSTOP,
  77     TARGET_SIGTSTP,
  78     TARGET_SIGCONT,
  79     TARGET_SIGCHLD,
  80     TARGET_SIGTTIN,
  81     TARGET_SIGTTOU,
  82     TARGET_SIGIO,
  83     TARGET_SIGXCPU,
  84     TARGET_SIGXFSZ,
  85     TARGET_SIGVTALRM,
  86     TARGET_SIGPROF,
  87     TARGET_SIGWINCH,
  88     -1, /* SIGLOST */
  89     TARGET_SIGUSR1,
  90     TARGET_SIGUSR2,
  91 #ifdef TARGET_SIGPWR
  92     TARGET_SIGPWR,
  93 #else
  94     -1,
  95 #endif
  96     -1, /* SIGPOLL */
  97     -1,
  98     -1,
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108 #ifdef __SIGRTMIN
 109     __SIGRTMIN + 1,
 110     __SIGRTMIN + 2,
 111     __SIGRTMIN + 3,
 112     __SIGRTMIN + 4,
 113     __SIGRTMIN + 5,
 114     __SIGRTMIN + 6,
 115     __SIGRTMIN + 7,
 116     __SIGRTMIN + 8,
 117     __SIGRTMIN + 9,
 118     __SIGRTMIN + 10,
 119     __SIGRTMIN + 11,
 120     __SIGRTMIN + 12,
 121     __SIGRTMIN + 13,
 122     __SIGRTMIN + 14,
 123     __SIGRTMIN + 15,
 124     __SIGRTMIN + 16,
 125     __SIGRTMIN + 17,
 126     __SIGRTMIN + 18,
 127     __SIGRTMIN + 19,
 128     __SIGRTMIN + 20,
 129     __SIGRTMIN + 21,
 130     __SIGRTMIN + 22,
 131     __SIGRTMIN + 23,
 132     __SIGRTMIN + 24,
 133     __SIGRTMIN + 25,
 134     __SIGRTMIN + 26,
 135     __SIGRTMIN + 27,
 136     __SIGRTMIN + 28,
 137     __SIGRTMIN + 29,
 138     __SIGRTMIN + 30,
 139     __SIGRTMIN + 31,
 140     -1, /* SIGCANCEL */
 141     __SIGRTMIN,
 142     __SIGRTMIN + 32,
 143     __SIGRTMIN + 33,
 144     __SIGRTMIN + 34,
 145     __SIGRTMIN + 35,
 146     __SIGRTMIN + 36,
 147     __SIGRTMIN + 37,
 148     __SIGRTMIN + 38,
 149     __SIGRTMIN + 39,
 150     __SIGRTMIN + 40,
 151     __SIGRTMIN + 41,
 152     __SIGRTMIN + 42,
 153     __SIGRTMIN + 43,
 154     __SIGRTMIN + 44,
 155     __SIGRTMIN + 45,
 156     __SIGRTMIN + 46,
 157     __SIGRTMIN + 47,
 158     __SIGRTMIN + 48,
 159     __SIGRTMIN + 49,
 160     __SIGRTMIN + 50,
 161     __SIGRTMIN + 51,
 162     __SIGRTMIN + 52,
 163     __SIGRTMIN + 53,
 164     __SIGRTMIN + 54,
 165     __SIGRTMIN + 55,
 166     __SIGRTMIN + 56,
 167     __SIGRTMIN + 57,
 168     __SIGRTMIN + 58,
 169     __SIGRTMIN + 59,
 170     __SIGRTMIN + 60,
 171     __SIGRTMIN + 61,
 172     __SIGRTMIN + 62,
 173     __SIGRTMIN + 63,
 174     __SIGRTMIN + 64,
 175     __SIGRTMIN + 65,
 176     __SIGRTMIN + 66,
 177     __SIGRTMIN + 67,
 178     __SIGRTMIN + 68,
 179     __SIGRTMIN + 69,
 180     __SIGRTMIN + 70,
 181     __SIGRTMIN + 71,
 182     __SIGRTMIN + 72,
 183     __SIGRTMIN + 73,
 184     __SIGRTMIN + 74,
 185     __SIGRTMIN + 75,
 186     __SIGRTMIN + 76,
 187     __SIGRTMIN + 77,
 188     __SIGRTMIN + 78,
 189     __SIGRTMIN + 79,
 190     __SIGRTMIN + 80,
 191     __SIGRTMIN + 81,
 192     __SIGRTMIN + 82,
 193     __SIGRTMIN + 83,
 194     __SIGRTMIN + 84,
 195     __SIGRTMIN + 85,
 196     __SIGRTMIN + 86,
 197     __SIGRTMIN + 87,
 198     __SIGRTMIN + 88,
 199     __SIGRTMIN + 89,
 200     __SIGRTMIN + 90,
 201     __SIGRTMIN + 91,
 202     __SIGRTMIN + 92,
 203     __SIGRTMIN + 93,
 204     __SIGRTMIN + 94,
 205     __SIGRTMIN + 95,
 206     -1, /* SIGINFO */
 207     -1, /* UNKNOWN */
 208     -1, /* DEFAULT */
 209     -1,
 210     -1,
 211     -1,
 212     -1,
 213     -1,
 214     -1
 215 #endif
 216 };
 217 #else
 218 /* In system mode we only need SIGINT and SIGTRAP; other signals
 219    are not yet supported.  */
 220
 221 enum {
 222     TARGET_SIGINT = 2,
 223     TARGET_SIGTRAP = 5
 224 };
 225
 226 static int gdb_signal_table[] = {
 227     -1,
 228     -1,
 229     TARGET_SIGINT,
 230     -1,
 231     -1,
 232     TARGET_SIGTRAP
 233 };
 234 #endif
 235
 236 #ifdef CONFIG_USER_ONLY
 237 static int target_signal_to_gdb (int sig)
 238 {
 239     int i;
 240     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 241         if (gdb_signal_table[i] == sig)
 242             return i;
 243     return GDB_SIGNAL_UNKNOWN;
 244 }
 245 #endif
 246
 247 static int gdb_signal_to_target (int sig)
 248 {
 249     if (sig < ARRAY_SIZE (gdb_signal_table))
 250         return gdb_signal_table[sig];
 251     else
 252         return -1;
 253 }
 254
 255 //#define DEBUG_GDB
 256
 257 typedef struct GDBRegisterState {
 258     int base_reg;
 259     int num_regs;
 260     gdb_reg_cb get_reg;
 261     gdb_reg_cb set_reg;
 262     const char *xml;
 263     struct GDBRegisterState *next;
 264 } GDBRegisterState;
 265
 266 enum RSState {
 267     RS_IDLE,
 268     RS_GETLINE,
 269     RS_CHKSUM1,
 270     RS_CHKSUM2,
 271     RS_SYSCALL,
 272 };
 273 typedef struct GDBState {
 274     CPUState *c_cpu; /* current CPU for step/continue ops */
 275     CPUState *g_cpu; /* current CPU for other ops */
 276     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 277     enum RSState state; /* parsing state */
 278     char line_buf[MAX_PACKET_LENGTH];
 279     int line_buf_index;
 280     int line_csum;
 281     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 282     int last_packet_len;
 283     int signal;
 284 #ifdef CONFIG_USER_ONLY
 285     int fd;
 286     int running_state;
 287 #else
 288     CharDriverState *chr;
 289 #endif
 290 } GDBState;
 291
 292 /* By default use no IRQs and no timers while single stepping so as to
 293  * make single stepping like an ICE HW step.
 294  */
 295 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 296
 297 static GDBState *gdbserver_state;
 298
 299 /* This is an ugly hack to cope with both new and old gdb.
 300    If gdb sends qXfer:features:read then assume we're talking to a newish
 301    gdb that understands target descriptions.  */
 302 static int gdb_has_xml;
 303
 304 #ifdef CONFIG_USER_ONLY
 305 /* XXX: This is not thread safe.  Do we care?  */
 306 static int gdbserver_fd = -1;
 307
 308 static int get_char(GDBState *s)
 309 {
 310     uint8_t ch;
 311     int ret;
 312
 313     for(;;) {
 314         ret = recv(s->fd, &ch, 1, 0);
 315         if (ret < 0) {
 316             if (errno == ECONNRESET)
 317                 s->fd = -1;
 318             if (errno != EINTR && errno != EAGAIN)
 319                 return -1;
 320         } else if (ret == 0) {
 321             close(s->fd);
 322             s->fd = -1;
 323             return -1;
 324         } else {
 325             break;
 326         }
 327     }
 328     return ch;
 329 }
 330 #endif
 331
 332 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 333
 334 enum {
 335     GDB_SYS_UNKNOWN,
 336     GDB_SYS_ENABLED,
 337     GDB_SYS_DISABLED,
 338 } gdb_syscall_mode;
 339
 340 /* If gdb is connected when the first semihosting syscall occurs then use
 341    remote gdb syscalls.  Otherwise use native file IO.  */
 342 int use_gdb_syscalls(void)
 343 {
 344     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 345         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 346                                             : GDB_SYS_DISABLED);
 347     }
 348     return gdb_syscall_mode == GDB_SYS_ENABLED;
 349 }
 350
 351 /* Resume execution.  */
 352 static inline void gdb_continue(GDBState *s)
 353 {
 354 #ifdef CONFIG_USER_ONLY
 355     s->running_state = 1;
 356 #else
 357     vm_start();
 358 #endif
 359 }
 360
 361 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 362 {
 363 #ifdef CONFIG_USER_ONLY
 364     int ret;
 365
 366     while (len > 0) {
 367         ret = send(s->fd, buf, len, 0);
 368         if (ret < 0) {
 369             if (errno != EINTR && errno != EAGAIN)
 370                 return;
 371         } else {
 372             buf += ret;
 373             len -= ret;
 374         }
 375     }
 376 #else
 377     qemu_chr_write(s->chr, buf, len);
 378 #endif
 379 }
 380
 381 static inline int fromhex(int v)
 382 {
 383     if (v >= '0' && v <= '9')
 384         return v - '0';
 385     else if (v >= 'A' && v <= 'F')
 386         return v - 'A' + 10;
 387     else if (v >= 'a' && v <= 'f')
 388         return v - 'a' + 10;
 389     else
 390         return 0;
 391 }
 392
 393 static inline int tohex(int v)
 394 {
 395     if (v < 10)
 396         return v + '0';
 397     else
 398         return v - 10 + 'a';
 399 }
 400
 401 static void memtohex(char *buf, const uint8_t *mem, int len)
 402 {
 403     int i, c;
 404     char *q;
 405     q = buf;
 406     for(i = 0; i < len; i++) {
 407         c = mem[i];
 408         *q++ = tohex(c >> 4);
 409         *q++ = tohex(c & 0xf);
 410     }
 411     *q = '\0';
 412 }
 413
 414 static void hextomem(uint8_t *mem, const char *buf, int len)
 415 {
 416     int i;
 417
 418     for(i = 0; i < len; i++) {
 419         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 420         buf += 2;
 421     }
 422 }
 423
 424 /* return -1 if error, 0 if OK */
 425 static int put_packet_binary(GDBState *s, const char *buf, int len)
 426 {
 427     int csum, i;
 428     uint8_t *p;
 429
 430     for(;;) {
 431         p = s->last_packet;
 432         *(p++) = '$';
 433         memcpy(p, buf, len);
 434         p += len;
 435         csum = 0;
 436         for(i = 0; i < len; i++) {
 437             csum += buf[i];
 438         }
 439         *(p++) = '#';
 440         *(p++) = tohex((csum >> 4) & 0xf);
 441         *(p++) = tohex((csum) & 0xf);
 442
 443         s->last_packet_len = p - s->last_packet;
 444         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 445
 446 #ifdef CONFIG_USER_ONLY
 447         i = get_char(s);
 448         if (i < 0)
 449             return -1;
 450         if (i == '+')
 451             break;
 452 #else
 453         break;
 454 #endif
 455     }
 456     return 0;
 457 }
 458
 459 /* return -1 if error, 0 if OK */
 460 static int put_packet(GDBState *s, const char *buf)
 461 {
 462 #ifdef DEBUG_GDB
 463     printf("reply='%s'\n", buf);
 464 #endif
 465
 466     return put_packet_binary(s, buf, strlen(buf));
 467 }
 468
 469 /* The GDB remote protocol transfers values in target byte order.  This means
 470    we can use the raw memory access routines to access the value buffer.
 471    Conveniently, these also handle the case where the buffer is mis-aligned.
 472  */
 473 #define GET_REG8(val) do { \
 474     stb_p(mem_buf, val); \
 475     return 1; \
 476     } while(0)
 477 #define GET_REG16(val) do { \
 478     stw_p(mem_buf, val); \
 479     return 2; \
 480     } while(0)
 481 #define GET_REG32(val) do { \
 482     stl_p(mem_buf, val); \
 483     return 4; \
 484     } while(0)
 485 #define GET_REG64(val) do { \
 486     stq_p(mem_buf, val); \
 487     return 8; \
 488     } while(0)
 489
 490 #if TARGET_LONG_BITS == 64
 491 #define GET_REGL(val) GET_REG64(val)
 492 #define ldtul_p(addr) ldq_p(addr)
 493 #else
 494 #define GET_REGL(val) GET_REG32(val)
 495 #define ldtul_p(addr) ldl_p(addr)
 496 #endif
 497
 498 #if defined(TARGET_I386)
 499
 500 #ifdef TARGET_X86_64
 501 static const int gpr_map[16] = {
 502     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 503     8, 9, 10, 11, 12, 13, 14, 15
 504 };
 505 #else
 506 static const int gpr_map[8] = {0, 1, 2, 3, 4, 5, 6, 7};
 507 #endif
 508
 509 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 510
 511 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 512 {
 513     if (n < CPU_NB_REGS) {
 514         GET_REGL(env->regs[gpr_map[n]]);
 515     } else if (n >= CPU_NB_REGS + 8 && n < CPU_NB_REGS + 16) {
 516         /* FIXME: byteswap float values.  */
 517 #ifdef USE_X86LDOUBLE
 518         memcpy(mem_buf, &env->fpregs[n - (CPU_NB_REGS + 8)], 10);
 519 #else
 520         memset(mem_buf, 0, 10);
 521 #endif
 522         return 10;
 523     } else if (n >= CPU_NB_REGS + 24) {
 524         n -= CPU_NB_REGS + 24;
 525         if (n < CPU_NB_REGS) {
 526             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 527             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 528             return 16;
 529         } else if (n == CPU_NB_REGS) {
 530             GET_REG32(env->mxcsr);
 531         }
 532     } else {
 533         n -= CPU_NB_REGS;
 534         switch (n) {
 535         case 0: GET_REGL(env->eip);
 536         case 1: GET_REG32(env->eflags);
 537         case 2: GET_REG32(env->segs[R_CS].selector);
 538         case 3: GET_REG32(env->segs[R_SS].selector);
 539         case 4: GET_REG32(env->segs[R_DS].selector);
 540         case 5: GET_REG32(env->segs[R_ES].selector);
 541         case 6: GET_REG32(env->segs[R_FS].selector);
 542         case 7: GET_REG32(env->segs[R_GS].selector);
 543         /* 8...15 x87 regs.  */
 544         case 16: GET_REG32(env->fpuc);
 545         case 17: GET_REG32((env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11);
 546         case 18: GET_REG32(0); /* ftag */
 547         case 19: GET_REG32(0); /* fiseg */
 548         case 20: GET_REG32(0); /* fioff */
 549         case 21: GET_REG32(0); /* foseg */
 550         case 22: GET_REG32(0); /* fooff */
 551         case 23: GET_REG32(0); /* fop */
 552         /* 24+ xmm regs.  */
 553         }
 554     }
 555     return 0;
 556 }
 557
 558 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int i)
 559 {
 560     uint32_t tmp;
 561
 562     if (i < CPU_NB_REGS) {
 563         env->regs[gpr_map[i]] = ldtul_p(mem_buf);
 564         return sizeof(target_ulong);
 565     } else if (i >= CPU_NB_REGS + 8 && i < CPU_NB_REGS + 16) {
 566         i -= CPU_NB_REGS + 8;
 567 #ifdef USE_X86LDOUBLE
 568         memcpy(&env->fpregs[i], mem_buf, 10);
 569 #endif
 570         return 10;
 571     } else if (i >= CPU_NB_REGS + 24) {
 572         i -= CPU_NB_REGS + 24;
 573         if (i < CPU_NB_REGS) {
 574             env->xmm_regs[i].XMM_Q(0) = ldq_p(mem_buf);
 575             env->xmm_regs[i].XMM_Q(1) = ldq_p(mem_buf + 8);
 576             return 16;
 577         } else if (i == CPU_NB_REGS) {
 578             env->mxcsr = ldl_p(mem_buf);
 579             return 4;
 580         }
 581     } else {
 582         i -= CPU_NB_REGS;
 583         switch (i) {
 584         case 0: env->eip = ldtul_p(mem_buf); return sizeof(target_ulong);
 585         case 1: env->eflags = ldl_p(mem_buf); return 4;
 586 #if defined(CONFIG_USER_ONLY)
 587 #define LOAD_SEG(index, sreg)\
 588             tmp = ldl_p(mem_buf);\
 589             if (tmp != env->segs[sreg].selector)\
 590                 cpu_x86_load_seg(env, sreg, tmp);
 591 #else
 592 /* FIXME: Honor segment registers.  Needs to avoid raising an exception
 593    when the selector is invalid.  */
 594 #define LOAD_SEG(index, sreg) do {} while(0)
 595 #endif
 596         case 2: LOAD_SEG(10, R_CS); return 4;
 597         case 3: LOAD_SEG(11, R_SS); return 4;
 598         case 4: LOAD_SEG(12, R_DS); return 4;
 599         case 5: LOAD_SEG(13, R_ES); return 4;
 600         case 6: LOAD_SEG(14, R_FS); return 4;
 601         case 7: LOAD_SEG(15, R_GS); return 4;
 602         /* 8...15 x87 regs.  */
 603         case 16: env->fpuc = ldl_p(mem_buf); return 4;
 604         case 17:
 605                  tmp = ldl_p(mem_buf);
 606                  env->fpstt = (tmp >> 11) & 7;
 607                  env->fpus = tmp & ~0x3800;
 608                  return 4;
 609         case 18: /* ftag */ return 4;
 610         case 19: /* fiseg */ return 4;
 611         case 20: /* fioff */ return 4;
 612         case 21: /* foseg */ return 4;
 613         case 22: /* fooff */ return 4;
 614         case 23: /* fop */ return 4;
 615         /* 24+ xmm regs.  */
 616         }
 617     }
 618     /* Unrecognised register.  */
 619     return 0;
 620 }
 621
 622 #elif defined (TARGET_PPC)
 623
 624 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 625    expects whatever the target description contains.  Due to a
 626    historical mishap the FP registers appear in between core integer
 627    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 628    FP regs zero size when talking to a newer gdb.  */
 629 #define NUM_CORE_REGS 71
 630 #if defined (TARGET_PPC64)
 631 #define GDB_CORE_XML "power64-core.xml"
 632 #else
 633 #define GDB_CORE_XML "power-core.xml"
 634 #endif
 635
 636 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 637 {
 638     if (n < 32) {
 639         /* gprs */
 640         GET_REGL(env->gpr[n]);
 641     } else if (n < 64) {
 642         /* fprs */
 643         if (gdb_has_xml)
 644             return 0;
 645         stfq_p(mem_buf, env->fpr[n-32]);
 646         return 8;
 647     } else {
 648         switch (n) {
 649         case 64: GET_REGL(env->nip);
 650         case 65: GET_REGL(env->msr);
 651         case 66:
 652             {
 653                 uint32_t cr = 0;
 654                 int i;
 655                 for (i = 0; i < 8; i++)
 656                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 657                 GET_REG32(cr);
 658             }
 659         case 67: GET_REGL(env->lr);
 660         case 68: GET_REGL(env->ctr);
 661         case 69: GET_REGL(env->xer);
 662         case 70:
 663             {
 664                 if (gdb_has_xml)
 665                     return 0;
 666                 GET_REG32(0); /* fpscr */
 667             }
 668         }
 669     }
 670     return 0;
 671 }
 672
 673 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 674 {
 675     if (n < 32) {
 676         /* gprs */
 677         env->gpr[n] = ldtul_p(mem_buf);
 678         return sizeof(target_ulong);
 679     } else if (n < 64) {
 680         /* fprs */
 681         if (gdb_has_xml)
 682             return 0;
 683         env->fpr[n-32] = ldfq_p(mem_buf);
 684         return 8;
 685     } else {
 686         switch (n) {
 687         case 64:
 688             env->nip = ldtul_p(mem_buf);
 689             return sizeof(target_ulong);
 690         case 65:
 691             ppc_store_msr(env, ldtul_p(mem_buf));
 692             return sizeof(target_ulong);
 693         case 66:
 694             {
 695                 uint32_t cr = ldl_p(mem_buf);
 696                 int i;
 697                 for (i = 0; i < 8; i++)
 698                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 699                 return 4;
 700             }
 701         case 67:
 702             env->lr = ldtul_p(mem_buf);
 703             return sizeof(target_ulong);
 704         case 68:
 705             env->ctr = ldtul_p(mem_buf);
 706             return sizeof(target_ulong);
 707         case 69:
 708             env->xer = ldtul_p(mem_buf);
 709             return sizeof(target_ulong);
 710         case 70:
 711             /* fpscr */
 712             if (gdb_has_xml)
 713                 return 0;
 714             return 4;
 715         }
 716     }
 717     return 0;
 718 }
 719
 720 #elif defined (TARGET_SPARC)
 721
 722 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 723 #define NUM_CORE_REGS 86
 724 #else
 725 #define NUM_CORE_REGS 72
 726 #endif
 727
 728 #ifdef TARGET_ABI32
 729 #define GET_REGA(val) GET_REG32(val)
 730 #else
 731 #define GET_REGA(val) GET_REGL(val)
 732 #endif
 733
 734 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 735 {
 736     if (n < 8) {
 737         /* g0..g7 */
 738         GET_REGA(env->gregs[n]);
 739     }
 740     if (n < 32) {
 741         /* register window */
 742         GET_REGA(env->regwptr[n - 8]);
 743     }
 744 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 745     if (n < 64) {
 746         /* fprs */
 747         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 748     }
 749     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 750     switch (n) {
 751     case 64: GET_REGA(env->y);
 752     case 65: GET_REGA(GET_PSR(env));
 753     case 66: GET_REGA(env->wim);
 754     case 67: GET_REGA(env->tbr);
 755     case 68: GET_REGA(env->pc);
 756     case 69: GET_REGA(env->npc);
 757     case 70: GET_REGA(env->fsr);
 758     case 71: GET_REGA(0); /* csr */
 759     default: GET_REGA(0);
 760     }
 761 #else
 762     if (n < 64) {
 763         /* f0-f31 */
 764         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 765     }
 766     if (n < 80) {
 767         /* f32-f62 (double width, even numbers only) */
 768         uint64_t val;
 769
 770         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 771         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 772         GET_REG64(val);
 773     }
 774     switch (n) {
 775     case 80: GET_REGL(env->pc);
 776     case 81: GET_REGL(env->npc);
 777     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 778                            ((env->asi & 0xff) << 24) |
 779                            ((env->pstate & 0xfff) << 8) |
 780                            GET_CWP64(env));
 781     case 83: GET_REGL(env->fsr);
 782     case 84: GET_REGL(env->fprs);
 783     case 85: GET_REGL(env->y);
 784     }
 785 #endif
 786     return 0;
 787 }
 788
 789 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 790 {
 791 #if defined(TARGET_ABI32)
 792     abi_ulong tmp;
 793
 794     tmp = ldl_p(mem_buf);
 795 #else
 796     target_ulong tmp;
 797
 798     tmp = ldtul_p(mem_buf);
 799 #endif
 800
 801     if (n < 8) {
 802         /* g0..g7 */
 803         env->gregs[n] = tmp;
 804     } else if (n < 32) {
 805         /* register window */
 806         env->regwptr[n - 8] = tmp;
 807     }
 808 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 809     else if (n < 64) {
 810         /* fprs */
 811         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 812     } else {
 813         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 814         switch (n) {
 815         case 64: env->y = tmp; break;
 816         case 65: PUT_PSR(env, tmp); break;
 817         case 66: env->wim = tmp; break;
 818         case 67: env->tbr = tmp; break;
 819         case 68: env->pc = tmp; break;
 820         case 69: env->npc = tmp; break;
 821         case 70: env->fsr = tmp; break;
 822         default: return 0;
 823         }
 824     }
 825     return 4;
 826 #else
 827     else if (n < 64) {
 828         /* f0-f31 */
 829         env->fpr[n] = ldfl_p(mem_buf);
 830         return 4;
 831     } else if (n < 80) {
 832         /* f32-f62 (double width, even numbers only) */
 833         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 834         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 835     } else {
 836         switch (n) {
 837         case 80: env->pc = tmp; break;
 838         case 81: env->npc = tmp; break;
 839         case 82:
 840             PUT_CCR(env, tmp >> 32);
 841             env->asi = (tmp >> 24) & 0xff;
 842             env->pstate = (tmp >> 8) & 0xfff;
 843             PUT_CWP64(env, tmp & 0xff);
 844             break;
 845         case 83: env->fsr = tmp; break;
 846         case 84: env->fprs = tmp; break;
 847         case 85: env->y = tmp; break;
 848         default: return 0;
 849         }
 850     }
 851     return 8;
 852 #endif
 853 }
 854 #elif defined (TARGET_ARM)
 855
 856 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 857    whatever the target description contains.  Due to a historical mishap
 858    the FPA registers appear in between core integer regs and the CPSR.
 859    We hack round this by giving the FPA regs zero size when talking to a
 860    newer gdb.  */
 861 #define NUM_CORE_REGS 26
 862 #define GDB_CORE_XML "arm-core.xml"
 863
 864 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 865 {
 866     if (n < 16) {
 867         /* Core integer register.  */
 868         GET_REG32(env->regs[n]);
 869     }
 870     if (n < 24) {
 871         /* FPA registers.  */
 872         if (gdb_has_xml)
 873             return 0;
 874         memset(mem_buf, 0, 12);
 875         return 12;
 876     }
 877     switch (n) {
 878     case 24:
 879         /* FPA status register.  */
 880         if (gdb_has_xml)
 881             return 0;
 882         GET_REG32(0);
 883     case 25:
 884         /* CPSR */
 885         GET_REG32(cpsr_read(env));
 886     }
 887     /* Unknown register.  */
 888     return 0;
 889 }
 890
 891 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 892 {
 893     uint32_t tmp;
 894
 895     tmp = ldl_p(mem_buf);
 896
 897     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 898        cause problems if we ever implement the Jazelle DBX extensions.  */
 899     if (n == 15)
 900         tmp &= ~1;
 901
 902     if (n < 16) {
 903         /* Core integer register.  */
 904         env->regs[n] = tmp;
 905         return 4;
 906     }
 907     if (n < 24) { /* 16-23 */
 908         /* FPA registers (ignored).  */
 909         if (gdb_has_xml)
 910             return 0;
 911         return 12;
 912     }
 913     switch (n) {
 914     case 24:
 915         /* FPA status register (ignored).  */
 916         if (gdb_has_xml)
 917             return 0;
 918         return 4;
 919     case 25:
 920         /* CPSR */
 921         cpsr_write (env, tmp, 0xffffffff);
 922         return 4;
 923     }
 924     /* Unknown register.  */
 925     return 0;
 926 }
 927
 928 #elif defined (TARGET_M68K)
 929
 930 #define NUM_CORE_REGS 18
 931
 932 #define GDB_CORE_XML "cf-core.xml"
 933
 934 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 935 {
 936     if (n < 8) {
 937         /* D0-D7 */
 938         GET_REG32(env->dregs[n]);
 939     } else if (n < 16) {
 940         /* A0-A7 */
 941         GET_REG32(env->aregs[n - 8]);
 942     } else {
 943         switch (n) {
 944         case 16: GET_REG32(env->sr);
 945         case 17: GET_REG32(env->pc);
 946         }
 947     }
 948     /* FP registers not included here because they vary between
 949        ColdFire and m68k.  Use XML bits for these.  */
 950     return 0;
 951 }
 952
 953 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 954 {
 955     uint32_t tmp;
 956
 957     tmp = ldl_p(mem_buf);
 958
 959     if (n < 8) {
 960         /* D0-D7 */
 961         env->dregs[n] = tmp;
 962     } else if (n < 8) {
 963         /* A0-A7 */
 964         env->aregs[n - 8] = tmp;
 965     } else {
 966         switch (n) {
 967         case 16: env->sr = tmp; break;
 968         case 17: env->pc = tmp; break;
 969         default: return 0;
 970         }
 971     }
 972     return 4;
 973 }
 974 #elif defined (TARGET_MIPS)
 975
 976 #define NUM_CORE_REGS 73
 977
 978 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 979 {
 980     if (n < 32) {
 981         GET_REGL(env->active_tc.gpr[n]);
 982     }
 983     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
 984         if (n >= 38 && n < 70) {
 985             if (env->CP0_Status & (1 << CP0St_FR))
 986                 GET_REGL(env->active_fpu.fpr[n - 38].d);
 987             else
 988                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
 989         }
 990         switch (n) {
 991         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
 992         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
 993         }
 994     }
 995     switch (n) {
 996     case 32: GET_REGL((int32_t)env->CP0_Status);
 997     case 33: GET_REGL(env->active_tc.LO[0]);
 998     case 34: GET_REGL(env->active_tc.HI[0]);
 999     case 35: GET_REGL(env->CP0_BadVAddr);
1000     case 36: GET_REGL((int32_t)env->CP0_Cause);
1001     case 37: GET_REGL(env->active_tc.PC);
1002     case 72: GET_REGL(0); /* fp */
1003     case 89: GET_REGL((int32_t)env->CP0_PRid);
1004     }
1005     if (n >= 73 && n <= 88) {
1006         /* 16 embedded regs.  */
1007         GET_REGL(0);
1008     }
1009
1010     return 0;
1011 }
1012
1013 /* convert MIPS rounding mode in FCR31 to IEEE library */
1014 static unsigned int ieee_rm[] =
1015   {
1016     float_round_nearest_even,
1017     float_round_to_zero,
1018     float_round_up,
1019     float_round_down
1020   };
1021 #define RESTORE_ROUNDING_MODE \
1022     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1023
1024 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1025 {
1026     target_ulong tmp;
1027
1028     tmp = ldtul_p(mem_buf);
1029
1030     if (n < 32) {
1031         env->active_tc.gpr[n] = tmp;
1032         return sizeof(target_ulong);
1033     }
1034     if (env->CP0_Config1 & (1 << CP0C1_FP)
1035             && n >= 38 && n < 73) {
1036         if (n < 70) {
1037             if (env->CP0_Status & (1 << CP0St_FR))
1038               env->active_fpu.fpr[n - 38].d = tmp;
1039             else
1040               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1041         }
1042         switch (n) {
1043         case 70:
1044             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1045             /* set rounding mode */
1046             RESTORE_ROUNDING_MODE;
1047 #ifndef CONFIG_SOFTFLOAT
1048             /* no floating point exception for native float */
1049             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1050 #endif
1051             break;
1052         case 71: env->active_fpu.fcr0 = tmp; break;
1053         }
1054         return sizeof(target_ulong);
1055     }
1056     switch (n) {
1057     case 32: env->CP0_Status = tmp; break;
1058     case 33: env->active_tc.LO[0] = tmp; break;
1059     case 34: env->active_tc.HI[0] = tmp; break;
1060     case 35: env->CP0_BadVAddr = tmp; break;
1061     case 36: env->CP0_Cause = tmp; break;
1062     case 37: env->active_tc.PC = tmp; break;
1063     case 72: /* fp, ignored */ break;
1064     default:
1065         if (n > 89)
1066             return 0;
1067         /* Other registers are readonly.  Ignore writes.  */
1068         break;
1069     }
1070
1071     return sizeof(target_ulong);
1072 }
1073 #elif defined (TARGET_SH4)
1074
1075 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1076 /* FIXME: We should use XML for this.  */
1077
1078 #define NUM_CORE_REGS 59
1079
1080 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1081 {
1082     if (n < 8) {
1083         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1084             GET_REGL(env->gregs[n + 16]);
1085         } else {
1086             GET_REGL(env->gregs[n]);
1087         }
1088     } else if (n < 16) {
1089         GET_REGL(env->gregs[n - 8]);
1090     } else if (n >= 25 && n < 41) {
1091         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1092     } else if (n >= 43 && n < 51) {
1093         GET_REGL(env->gregs[n - 43]);
1094     } else if (n >= 51 && n < 59) {
1095         GET_REGL(env->gregs[n - (51 - 16)]);
1096     }
1097     switch (n) {
1098     case 16: GET_REGL(env->pc);
1099     case 17: GET_REGL(env->pr);
1100     case 18: GET_REGL(env->gbr);
1101     case 19: GET_REGL(env->vbr);
1102     case 20: GET_REGL(env->mach);
1103     case 21: GET_REGL(env->macl);
1104     case 22: GET_REGL(env->sr);
1105     case 23: GET_REGL(env->fpul);
1106     case 24: GET_REGL(env->fpscr);
1107     case 41: GET_REGL(env->ssr);
1108     case 42: GET_REGL(env->spc);
1109     }
1110
1111     return 0;
1112 }
1113
1114 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1115 {
1116     uint32_t tmp;
1117
1118     tmp = ldl_p(mem_buf);
1119
1120     if (n < 8) {
1121         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1122             env->gregs[n + 16] = tmp;
1123         } else {
1124             env->gregs[n] = tmp;
1125         }
1126         return 4;
1127     } else if (n < 16) {
1128         env->gregs[n - 8] = tmp;
1129         return 4;
1130     } else if (n >= 25 && n < 41) {
1131         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1132     } else if (n >= 43 && n < 51) {
1133         env->gregs[n - 43] = tmp;
1134         return 4;
1135     } else if (n >= 51 && n < 59) {
1136         env->gregs[n - (51 - 16)] = tmp;
1137         return 4;
1138     }
1139     switch (n) {
1140     case 16: env->pc = tmp;
1141     case 17: env->pr = tmp;
1142     case 18: env->gbr = tmp;
1143     case 19: env->vbr = tmp;
1144     case 20: env->mach = tmp;
1145     case 21: env->macl = tmp;
1146     case 22: env->sr = tmp;
1147     case 23: env->fpul = tmp;
1148     case 24: env->fpscr = tmp;
1149     case 41: env->ssr = tmp;
1150     case 42: env->spc = tmp;
1151     default: return 0;
1152     }
1153
1154     return 4;
1155 }
1156 #elif defined (TARGET_CRIS)
1157
1158 #define NUM_CORE_REGS 49
1159
1160 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1161 {
1162     uint8_t srs;
1163
1164     srs = env->pregs[PR_SRS];
1165     if (n < 16) {
1166         GET_REG32(env->regs[n]);
1167     }
1168
1169     if (n >= 21 && n < 32) {
1170         GET_REG32(env->pregs[n - 16]);
1171     }
1172     if (n >= 33 && n < 49) {
1173         GET_REG32(env->sregs[srs][n - 33]);
1174     }
1175     switch (n) {
1176     case 16: GET_REG8(env->pregs[0]);
1177     case 17: GET_REG8(env->pregs[1]);
1178     case 18: GET_REG32(env->pregs[2]);
1179     case 19: GET_REG8(srs);
1180     case 20: GET_REG16(env->pregs[4]);
1181     case 32: GET_REG32(env->pc);
1182     }
1183
1184     return 0;
1185 }
1186
1187 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1188 {
1189     uint32_t tmp;
1190
1191     if (n > 49)
1192         return 0;
1193
1194     tmp = ldl_p(mem_buf);
1195
1196     if (n < 16) {
1197         env->regs[n] = tmp;
1198     }
1199
1200     if (n >= 21 && n < 32) {
1201         env->pregs[n - 16] = tmp;
1202     }
1203
1204     /* FIXME: Should support function regs be writable?  */
1205     switch (n) {
1206     case 16: return 1;
1207     case 17: return 1;
1208     case 18: env->pregs[PR_PID] = tmp; break;
1209     case 19: return 1;
1210     case 20: return 2;
1211     case 32: env->pc = tmp; break;
1212     }
1213
1214     return 4;
1215 }
1216 #elif defined (TARGET_ALPHA)
1217
1218 #define NUM_CORE_REGS 65
1219
1220 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1221 {
1222     if (n < 31) {
1223        GET_REGL(env->ir[n]);
1224     }
1225     else if (n == 31) {
1226        GET_REGL(0);
1227     }
1228     else if (n<63) {
1229        uint64_t val;
1230
1231        val=*((uint64_t *)&env->fir[n-32]);
1232        GET_REGL(val);
1233     }
1234     else if (n==63) {
1235        GET_REGL(env->fpcr);
1236     }
1237     else if (n==64) {
1238        GET_REGL(env->pc);
1239     }
1240     else {
1241        GET_REGL(0);
1242     }
1243
1244     return 0;
1245 }
1246
1247 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1248 {
1249     target_ulong tmp;
1250     tmp = ldtul_p(mem_buf);
1251
1252     if (n < 31) {
1253         env->ir[n] = tmp;
1254     }
1255
1256     if (n > 31 && n < 63) {
1257         env->fir[n - 32] = ldfl_p(mem_buf);
1258     }
1259
1260     if (n == 64 ) {
1261        env->pc=tmp;
1262     }
1263
1264     return 8;
1265 }
1266 #else
1267
1268 #define NUM_CORE_REGS 0
1269
1270 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1271 {
1272     return 0;
1273 }
1274
1275 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1276 {
1277     return 0;
1278 }
1279
1280 #endif
1281
1282 static int num_g_regs = NUM_CORE_REGS;
1283
1284 #ifdef GDB_CORE_XML
1285 /* Encode data using the encoding for 'x' packets.  */
1286 static int memtox(char *buf, const char *mem, int len)
1287 {
1288     char *p = buf;
1289     char c;
1290
1291     while (len--) {
1292         c = *(mem++);
1293         switch (c) {
1294         case '#': case '$': case '*': case '}':
1295             *(p++) = '}';
1296             *(p++) = c ^ 0x20;
1297             break;
1298         default:
1299             *(p++) = c;
1300             break;
1301         }
1302     }
1303     return p - buf;
1304 }
1305
1306 static const char *get_feature_xml(const char *p, const char **newp)
1307 {
1308     extern const char *const xml_builtin[][2];
1309     size_t len;
1310     int i;
1311     const char *name;
1312     static char target_xml[1024];
1313
1314     len = 0;
1315     while (p[len] && p[len] != ':')
1316         len++;
1317     *newp = p + len;
1318
1319     name = NULL;
1320     if (strncmp(p, "target.xml", len) == 0) {
1321         /* Generate the XML description for this CPU.  */
1322         if (!target_xml[0]) {
1323             GDBRegisterState *r;
1324
1325             snprintf(target_xml, sizeof(target_xml),
1326                      "<?xml version=\"1.0\"?>"
1327                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1328                      "<target>"
1329                      "<xi:include href=\"%s\"/>",
1330                      GDB_CORE_XML);
1331
1332             for (r = first_cpu->gdb_regs; r; r = r->next) {
1333                 strcat(target_xml, "<xi:include href=\"");
1334                 strcat(target_xml, r->xml);
1335                 strcat(target_xml, "\"/>");
1336             }
1337             strcat(target_xml, "</target>");
1338         }
1339         return target_xml;
1340     }
1341     for (i = 0; ; i++) {
1342         name = xml_builtin[i][0];
1343         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1344             break;
1345     }
1346     return name ? xml_builtin[i][1] : NULL;
1347 }
1348 #endif
1349
1350 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1351 {
1352     GDBRegisterState *r;
1353
1354     if (reg < NUM_CORE_REGS)
1355         return cpu_gdb_read_register(env, mem_buf, reg);
1356
1357     for (r = env->gdb_regs; r; r = r->next) {
1358         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1359             return r->get_reg(env, mem_buf, reg - r->base_reg);
1360         }
1361     }
1362     return 0;
1363 }
1364
1365 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1366 {
1367     GDBRegisterState *r;
1368
1369     if (reg < NUM_CORE_REGS)
1370         return cpu_gdb_write_register(env, mem_buf, reg);
1371
1372     for (r = env->gdb_regs; r; r = r->next) {
1373         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1374             return r->set_reg(env, mem_buf, reg - r->base_reg);
1375         }
1376     }
1377     return 0;
1378 }
1379
1380 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1381    specifies the first register number and these registers are included in
1382    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1383    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1384  */
1385
1386 void gdb_register_coprocessor(CPUState * env,
1387                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1388                              int num_regs, const char *xml, int g_pos)
1389 {
1390     GDBRegisterState *s;
1391     GDBRegisterState **p;
1392     static int last_reg = NUM_CORE_REGS;
1393
1394     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1395     s->base_reg = last_reg;
1396     s->num_regs = num_regs;
1397     s->get_reg = get_reg;
1398     s->set_reg = set_reg;
1399     s->xml = xml;
1400     p = &env->gdb_regs;
1401     while (*p) {
1402         /* Check for duplicates.  */
1403         if (strcmp((*p)->xml, xml) == 0)
1404             return;
1405         p = &(*p)->next;
1406     }
1407     /* Add to end of list.  */
1408     last_reg += num_regs;
1409     *p = s;
1410     if (g_pos) {
1411         if (g_pos != s->base_reg) {
1412             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1413                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1414         } else {
1415             num_g_regs = last_reg;
1416         }
1417     }
1418 }
1419
1420 #ifndef CONFIG_USER_ONLY
1421 static const int xlat_gdb_type[] = {
1422     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1423     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1424     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1425 };
1426 #endif
1427
1428 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1429 {
1430     CPUState *env;
1431     int err = 0;
1432
1433     if (kvm_enabled())
1434         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1435
1436     switch (type) {
1437     case GDB_BREAKPOINT_SW:
1438     case GDB_BREAKPOINT_HW:
1439         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1440             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1441             if (err)
1442                 break;
1443         }
1444         return err;
1445 #ifndef CONFIG_USER_ONLY
1446     case GDB_WATCHPOINT_WRITE:
1447     case GDB_WATCHPOINT_READ:
1448     case GDB_WATCHPOINT_ACCESS:
1449         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1450             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1451                                         NULL);
1452             if (err)
1453                 break;
1454         }
1455         return err;
1456 #endif
1457     default:
1458         return -ENOSYS;
1459     }
1460 }
1461
1462 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1463 {
1464     CPUState *env;
1465     int err = 0;
1466
1467     if (kvm_enabled())
1468         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1469
1470     switch (type) {
1471     case GDB_BREAKPOINT_SW:
1472     case GDB_BREAKPOINT_HW:
1473         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1474             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1475             if (err)
1476                 break;
1477         }
1478         return err;
1479 #ifndef CONFIG_USER_ONLY
1480     case GDB_WATCHPOINT_WRITE:
1481     case GDB_WATCHPOINT_READ:
1482     case GDB_WATCHPOINT_ACCESS:
1483         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1484             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1485             if (err)
1486                 break;
1487         }
1488         return err;
1489 #endif
1490     default:
1491         return -ENOSYS;
1492     }
1493 }
1494
1495 static void gdb_breakpoint_remove_all(void)
1496 {
1497     CPUState *env;
1498
1499     if (kvm_enabled()) {
1500         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1501         return;
1502     }
1503
1504     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1505         cpu_breakpoint_remove_all(env, BP_GDB);
1506 #ifndef CONFIG_USER_ONLY
1507         cpu_watchpoint_remove_all(env, BP_GDB);
1508 #endif
1509     }
1510 }
1511
1512 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1513 {
1514     CPUState *env;
1515     const char *p;
1516     int ch, reg_size, type, res, thread;
1517     char buf[MAX_PACKET_LENGTH];
1518     uint8_t mem_buf[MAX_PACKET_LENGTH];
1519     uint8_t *registers;
1520     target_ulong addr, len;
1521
1522 #ifdef DEBUG_GDB
1523     printf("command='%s'\n", line_buf);
1524 #endif
1525     p = line_buf;
1526     ch = *p++;
1527     switch(ch) {
1528     case '?':
1529         /* TODO: Make this return the correct value for user-mode.  */
1530         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1531                  s->c_cpu->cpu_index+1);
1532         put_packet(s, buf);
1533         /* Remove all the breakpoints when this query is issued,
1534          * because gdb is doing and initial connect and the state
1535          * should be cleaned up.
1536          */
1537         gdb_breakpoint_remove_all();
1538         break;
1539     case 'c':
1540         if (*p != '\0') {
1541             addr = strtoull(p, (char **)&p, 16);
1542 #if defined(TARGET_I386)
1543             s->c_cpu->eip = addr;
1544             kvm_load_registers(s->c_cpu);
1545 #elif defined (TARGET_PPC)
1546             s->c_cpu->nip = addr;
1547             kvm_load_registers(s->c_cpu);
1548 #elif defined (TARGET_SPARC)
1549             s->c_cpu->pc = addr;
1550             s->c_cpu->npc = addr + 4;
1551 #elif defined (TARGET_ARM)
1552             s->c_cpu->regs[15] = addr;
1553 #elif defined (TARGET_SH4)
1554             s->c_cpu->pc = addr;
1555 #elif defined (TARGET_MIPS)
1556             s->c_cpu->active_tc.PC = addr;
1557 #elif defined (TARGET_CRIS)
1558             s->c_cpu->pc = addr;
1559 #elif defined (TARGET_ALPHA)
1560             s->c_cpu->pc = addr;
1561 #endif
1562         }
1563         s->signal = 0;
1564         gdb_continue(s);
1565         return RS_IDLE;
1566     case 'C':
1567         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1568         if (s->signal == -1)
1569             s->signal = 0;
1570         gdb_continue(s);
1571         return RS_IDLE;
1572     case 'k':
1573         /* Kill the target */
1574         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1575         exit(0);
1576     case 'D':
1577         /* Detach packet */
1578         gdb_breakpoint_remove_all();
1579         gdb_continue(s);
1580         put_packet(s, "OK");
1581         break;
1582     case 's':
1583         if (*p != '\0') {
1584             addr = strtoull(p, (char **)&p, 16);
1585 #if defined(TARGET_I386)
1586             s->c_cpu->eip = addr;
1587             kvm_load_registers(s->c_cpu);
1588 #elif defined (TARGET_PPC)
1589             s->c_cpu->nip = addr;
1590             kvm_load_registers(s->c_cpu);
1591 #elif defined (TARGET_SPARC)
1592             s->c_cpu->pc = addr;
1593             s->c_cpu->npc = addr + 4;
1594 #elif defined (TARGET_ARM)
1595             s->c_cpu->regs[15] = addr;
1596 #elif defined (TARGET_SH4)
1597             s->c_cpu->pc = addr;
1598 #elif defined (TARGET_MIPS)
1599             s->c_cpu->active_tc.PC = addr;
1600 #elif defined (TARGET_CRIS)
1601             s->c_cpu->pc = addr;
1602 #elif defined (TARGET_ALPHA)
1603             s->c_cpu->pc = addr;
1604 #endif
1605         }
1606         cpu_single_step(s->c_cpu, sstep_flags);
1607         gdb_continue(s);
1608         return RS_IDLE;
1609     case 'F':
1610         {
1611             target_ulong ret;
1612             target_ulong err;
1613
1614             ret = strtoull(p, (char **)&p, 16);
1615             if (*p == ',') {
1616                 p++;
1617                 err = strtoull(p, (char **)&p, 16);
1618             } else {
1619                 err = 0;
1620             }
1621             if (*p == ',')
1622                 p++;
1623             type = *p;
1624             if (gdb_current_syscall_cb)
1625                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1626             if (type == 'C') {
1627                 put_packet(s, "T02");
1628             } else {
1629                 gdb_continue(s);
1630             }
1631         }
1632         break;
1633     case 'g':
1634         kvm_save_registers(s->g_cpu);
1635         len = 0;
1636         for (addr = 0; addr < num_g_regs; addr++) {
1637             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1638             len += reg_size;
1639         }
1640         memtohex(buf, mem_buf, len);
1641         put_packet(s, buf);
1642         break;
1643     case 'G':
1644         registers = mem_buf;
1645         len = strlen(p) / 2;
1646         hextomem((uint8_t *)registers, p, len);
1647         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1648             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1649             len -= reg_size;
1650             registers += reg_size;
1651         }
1652         kvm_load_registers(s->g_cpu);
1653         put_packet(s, "OK");
1654         break;
1655     case 'm':
1656         addr = strtoull(p, (char **)&p, 16);
1657         if (*p == ',')
1658             p++;
1659         len = strtoull(p, NULL, 16);
1660         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1661             put_packet (s, "E14");
1662         } else {
1663             memtohex(buf, mem_buf, len);
1664             put_packet(s, buf);
1665         }
1666         break;
1667     case 'M':
1668         addr = strtoull(p, (char **)&p, 16);
1669         if (*p == ',')
1670             p++;
1671         len = strtoull(p, (char **)&p, 16);
1672         if (*p == ':')
1673             p++;
1674         hextomem(mem_buf, p, len);
1675         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1676             put_packet(s, "E14");
1677         else
1678             put_packet(s, "OK");
1679         break;
1680     case 'p':
1681         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1682            This works, but can be very slow.  Anything new enough to
1683            understand XML also knows how to use this properly.  */
1684         if (!gdb_has_xml)
1685             goto unknown_command;
1686         addr = strtoull(p, (char **)&p, 16);
1687         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1688         if (reg_size) {
1689             memtohex(buf, mem_buf, reg_size);
1690             put_packet(s, buf);
1691         } else {
1692             put_packet(s, "E14");
1693         }
1694         break;
1695     case 'P':
1696         if (!gdb_has_xml)
1697             goto unknown_command;
1698         addr = strtoull(p, (char **)&p, 16);
1699         if (*p == '=')
1700             p++;
1701         reg_size = strlen(p) / 2;
1702         hextomem(mem_buf, p, reg_size);
1703         gdb_write_register(s->g_cpu, mem_buf, addr);
1704         put_packet(s, "OK");
1705         break;
1706     case 'Z':
1707     case 'z':
1708         type = strtoul(p, (char **)&p, 16);
1709         if (*p == ',')
1710             p++;
1711         addr = strtoull(p, (char **)&p, 16);
1712         if (*p == ',')
1713             p++;
1714         len = strtoull(p, (char **)&p, 16);
1715         if (ch == 'Z')
1716             res = gdb_breakpoint_insert(addr, len, type);
1717         else
1718             res = gdb_breakpoint_remove(addr, len, type);
1719         if (res >= 0)
1720              put_packet(s, "OK");
1721         else if (res == -ENOSYS)
1722             put_packet(s, "");
1723         else
1724             put_packet(s, "E22");
1725         break;
1726     case 'H':
1727         type = *p++;
1728         thread = strtoull(p, (char **)&p, 16);
1729         if (thread == -1 || thread == 0) {
1730             put_packet(s, "OK");
1731             break;
1732         }
1733         for (env = first_cpu; env != NULL; env = env->next_cpu)
1734             if (env->cpu_index + 1 == thread)
1735                 break;
1736         if (env == NULL) {
1737             put_packet(s, "E22");
1738             break;
1739         }
1740         switch (type) {
1741         case 'c':
1742             s->c_cpu = env;
1743             put_packet(s, "OK");
1744             break;
1745         case 'g':
1746             s->g_cpu = env;
1747             put_packet(s, "OK");
1748             break;
1749         default:
1750              put_packet(s, "E22");
1751              break;
1752         }
1753         break;
1754     case 'T':
1755         thread = strtoull(p, (char **)&p, 16);
1756 #ifndef CONFIG_USER_ONLY
1757         if (thread > 0 && thread < smp_cpus + 1)
1758 #else
1759         if (thread == 1)
1760 #endif
1761              put_packet(s, "OK");
1762         else
1763             put_packet(s, "E22");
1764         break;
1765     case 'q':
1766     case 'Q':
1767         /* parse any 'q' packets here */
1768         if (!strcmp(p,"qemu.sstepbits")) {
1769             /* Query Breakpoint bit definitions */
1770             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1771                      SSTEP_ENABLE,
1772                      SSTEP_NOIRQ,
1773                      SSTEP_NOTIMER);
1774             put_packet(s, buf);
1775             break;
1776         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1777             /* Display or change the sstep_flags */
1778             p += 10;
1779             if (*p != '=') {
1780                 /* Display current setting */
1781                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1782                 put_packet(s, buf);
1783                 break;
1784             }
1785             p++;
1786             type = strtoul(p, (char **)&p, 16);
1787             sstep_flags = type;
1788             put_packet(s, "OK");
1789             break;
1790         } else if (strcmp(p,"C") == 0) {
1791             /* "Current thread" remains vague in the spec, so always return
1792              *  the first CPU (gdb returns the first thread). */
1793             put_packet(s, "QC1");
1794             break;
1795         } else if (strcmp(p,"fThreadInfo") == 0) {
1796             s->query_cpu = first_cpu;
1797             goto report_cpuinfo;
1798         } else if (strcmp(p,"sThreadInfo") == 0) {
1799         report_cpuinfo:
1800             if (s->query_cpu) {
1801                 snprintf(buf, sizeof(buf), "m%x", s->query_cpu->cpu_index+1);
1802                 put_packet(s, buf);
1803                 s->query_cpu = s->query_cpu->next_cpu;
1804             } else
1805                 put_packet(s, "l");
1806             break;
1807         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
1808             thread = strtoull(p+16, (char **)&p, 16);
1809             for (env = first_cpu; env != NULL; env = env->next_cpu)
1810                 if (env->cpu_index + 1 == thread) {
1811                     kvm_save_registers(env);
1812                     len = snprintf((char *)mem_buf, sizeof(mem_buf),
1813                                    "CPU#%d [%s]", env->cpu_index,
1814                                    env->halted ? "halted " : "running");
1815                     memtohex(buf, mem_buf, len);
1816                     put_packet(s, buf);
1817                     break;
1818                 }
1819             break;
1820         }
1821 #ifdef CONFIG_LINUX_USER
1822         else if (strncmp(p, "Offsets", 7) == 0) {
1823             TaskState *ts = s->c_cpu->opaque;
1824
1825             snprintf(buf, sizeof(buf),
1826                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
1827                      ";Bss=" TARGET_ABI_FMT_lx,
1828                      ts->info->code_offset,
1829                      ts->info->data_offset,
1830                      ts->info->data_offset);
1831             put_packet(s, buf);
1832             break;
1833         }
1834 #endif
1835         if (strncmp(p, "Supported", 9) == 0) {
1836             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
1837 #ifdef GDB_CORE_XML
1838             strcat(buf, ";qXfer:features:read+");
1839 #endif
1840             put_packet(s, buf);
1841             break;
1842         }
1843 #ifdef GDB_CORE_XML
1844         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
1845             const char *xml;
1846             target_ulong total_len;
1847
1848             gdb_has_xml = 1;
1849             p += 19;
1850             xml = get_feature_xml(p, &p);
1851             if (!xml) {
1852                 snprintf(buf, sizeof(buf), "E00");
1853                 put_packet(s, buf);
1854                 break;
1855             }
1856
1857             if (*p == ':')
1858                 p++;
1859             addr = strtoul(p, (char **)&p, 16);
1860             if (*p == ',')
1861                 p++;
1862             len = strtoul(p, (char **)&p, 16);
1863
1864             total_len = strlen(xml);
1865             if (addr > total_len) {
1866                 snprintf(buf, sizeof(buf), "E00");
1867                 put_packet(s, buf);
1868                 break;
1869             }
1870             if (len > (MAX_PACKET_LENGTH - 5) / 2)
1871                 len = (MAX_PACKET_LENGTH - 5) / 2;
1872             if (len < total_len - addr) {
1873                 buf[0] = 'm';
1874                 len = memtox(buf + 1, xml + addr, len);
1875             } else {
1876                 buf[0] = 'l';
1877                 len = memtox(buf + 1, xml + addr, total_len - addr);
1878             }
1879             put_packet_binary(s, buf, len + 1);
1880             break;
1881         }
1882 #endif
1883         /* Unrecognised 'q' command.  */
1884         goto unknown_command;
1885
1886     default:
1887     unknown_command:
1888         /* put empty packet */
1889         buf[0] = '\0';
1890         put_packet(s, buf);
1891         break;
1892     }
1893     return RS_IDLE;
1894 }
1895
1896 void gdb_set_stop_cpu(CPUState *env)
1897 {
1898     gdbserver_state->c_cpu = env;
1899     gdbserver_state->g_cpu = env;
1900 }
1901
1902 #ifndef CONFIG_USER_ONLY
1903 static void gdb_vm_state_change(void *opaque, int running, int reason)
1904 {
1905     GDBState *s = gdbserver_state;
1906     CPUState *env = s->c_cpu;
1907     char buf[256];
1908     const char *type;
1909     int ret;
1910
1911     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
1912         s->state == RS_SYSCALL)
1913         return;
1914
1915     /* disable single step if it was enable */
1916     cpu_single_step(env, 0);
1917
1918     if (reason == EXCP_DEBUG) {
1919         if (env->watchpoint_hit) {
1920             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
1921             case BP_MEM_READ:
1922                 type = "r";
1923                 break;
1924             case BP_MEM_ACCESS:
1925                 type = "a";
1926                 break;
1927             default:
1928                 type = "";
1929                 break;
1930             }
1931             snprintf(buf, sizeof(buf),
1932                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
1933                      GDB_SIGNAL_TRAP, env->cpu_index+1, type,
1934                      env->watchpoint_hit->vaddr);
1935             put_packet(s, buf);
1936             env->watchpoint_hit = NULL;
1937             return;
1938         }
1939         tb_flush(env);
1940         ret = GDB_SIGNAL_TRAP;
1941     } else {
1942         ret = GDB_SIGNAL_INT;
1943     }
1944     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, env->cpu_index+1);
1945     put_packet(s, buf);
1946 }
1947 #endif
1948
1949 /* Send a gdb syscall request.
1950    This accepts limited printf-style format specifiers, specifically:
1951     %x  - target_ulong argument printed in hex.
1952     %lx - 64-bit argument printed in hex.
1953     %s  - string pointer (target_ulong) and length (int) pair.  */
1954 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
1955 {
1956     va_list va;
1957     char buf[256];
1958     char *p;
1959     target_ulong addr;
1960     uint64_t i64;
1961     GDBState *s;
1962
1963     s = gdbserver_state;
1964     if (!s)
1965         return;
1966     gdb_current_syscall_cb = cb;
1967     s->state = RS_SYSCALL;
1968 #ifndef CONFIG_USER_ONLY
1969     vm_stop(EXCP_DEBUG);
1970 #endif
1971     s->state = RS_IDLE;
1972     va_start(va, fmt);
1973     p = buf;
1974     *(p++) = 'F';
1975     while (*fmt) {
1976         if (*fmt == '%') {
1977             fmt++;
1978             switch (*fmt++) {
1979             case 'x':
1980                 addr = va_arg(va, target_ulong);
1981                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
1982                 break;
1983             case 'l':
1984                 if (*(fmt++) != 'x')
1985                     goto bad_format;
1986                 i64 = va_arg(va, uint64_t);
1987                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
1988                 break;
1989             case 's':
1990                 addr = va_arg(va, target_ulong);
1991                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
1992                               addr, va_arg(va, int));
1993                 break;
1994             default:
1995             bad_format:
1996                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
1997                         fmt - 1);
1998                 break;
1999             }
2000         } else {
2001             *(p++) = *(fmt++);
2002         }
2003     }
2004     *p = 0;
2005     va_end(va);
2006     put_packet(s, buf);
2007 #ifdef CONFIG_USER_ONLY
2008     gdb_handlesig(s->c_cpu, 0);
2009 #else
2010     cpu_interrupt(s->c_cpu, CPU_INTERRUPT_EXIT);
2011 #endif
2012 }
2013
2014 static void gdb_read_byte(GDBState *s, int ch)
2015 {
2016     int i, csum;
2017     uint8_t reply;
2018
2019 #ifndef CONFIG_USER_ONLY
2020     if (s->last_packet_len) {
2021         /* Waiting for a response to the last packet.  If we see the start
2022            of a new command then abandon the previous response.  */
2023         if (ch == '-') {
2024 #ifdef DEBUG_GDB
2025             printf("Got NACK, retransmitting\n");
2026 #endif
2027             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2028         }
2029 #ifdef DEBUG_GDB
2030         else if (ch == '+')
2031             printf("Got ACK\n");
2032         else
2033             printf("Got '%c' when expecting ACK/NACK\n", ch);
2034 #endif
2035         if (ch == '+' || ch == '$')
2036             s->last_packet_len = 0;
2037         if (ch != '$')
2038             return;
2039     }
2040     if (vm_running) {
2041         /* when the CPU is running, we cannot do anything except stop
2042            it when receiving a char */
2043         vm_stop(EXCP_INTERRUPT);
2044     } else
2045 #endif
2046     {
2047         switch(s->state) {
2048         case RS_IDLE:
2049             if (ch == '$') {
2050                 s->line_buf_index = 0;
2051                 s->state = RS_GETLINE;
2052             }
2053             break;
2054         case RS_GETLINE:
2055             if (ch == '#') {
2056             s->state = RS_CHKSUM1;
2057             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2058                 s->state = RS_IDLE;
2059             } else {
2060             s->line_buf[s->line_buf_index++] = ch;
2061             }
2062             break;
2063         case RS_CHKSUM1:
2064             s->line_buf[s->line_buf_index] = '\0';
2065             s->line_csum = fromhex(ch) << 4;
2066             s->state = RS_CHKSUM2;
2067             break;
2068         case RS_CHKSUM2:
2069             s->line_csum |= fromhex(ch);
2070             csum = 0;
2071             for(i = 0; i < s->line_buf_index; i++) {
2072                 csum += s->line_buf[i];
2073             }
2074             if (s->line_csum != (csum & 0xff)) {
2075                 reply = '-';
2076                 put_buffer(s, &reply, 1);
2077                 s->state = RS_IDLE;
2078             } else {
2079                 reply = '+';
2080                 put_buffer(s, &reply, 1);
2081                 s->state = gdb_handle_packet(s, s->line_buf);
2082             }
2083             break;
2084         default:
2085             abort();
2086         }
2087     }
2088 }
2089
2090 #ifdef CONFIG_USER_ONLY
2091 int
2092 gdb_queuesig (void)
2093 {
2094     GDBState *s;
2095
2096     s = gdbserver_state;
2097
2098     if (gdbserver_fd < 0 || s->fd < 0)
2099         return 0;
2100     else
2101         return 1;
2102 }
2103
2104 int
2105 gdb_handlesig (CPUState *env, int sig)
2106 {
2107   GDBState *s;
2108   char buf[256];
2109   int n;
2110
2111   s = gdbserver_state;
2112   if (gdbserver_fd < 0 || s->fd < 0)
2113     return sig;
2114
2115   /* disable single step if it was enabled */
2116   cpu_single_step(env, 0);
2117   tb_flush(env);
2118
2119   if (sig != 0)
2120     {
2121       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2122       put_packet(s, buf);
2123     }
2124   /* put_packet() might have detected that the peer terminated the
2125      connection.  */
2126   if (s->fd < 0)
2127       return sig;
2128
2129   sig = 0;
2130   s->state = RS_IDLE;
2131   s->running_state = 0;
2132   while (s->running_state == 0) {
2133       n = read (s->fd, buf, 256);
2134       if (n > 0)
2135         {
2136           int i;
2137
2138           for (i = 0; i < n; i++)
2139             gdb_read_byte (s, buf[i]);
2140         }
2141       else if (n == 0 || errno != EAGAIN)
2142         {
2143           /* XXX: Connection closed.  Should probably wait for annother
2144              connection before continuing.  */
2145           return sig;
2146         }
2147   }
2148   sig = s->signal;
2149   s->signal = 0;
2150   return sig;
2151 }
2152
2153 /* Tell the remote gdb that the process has exited.  */
2154 void gdb_exit(CPUState *env, int code)
2155 {
2156   GDBState *s;
2157   char buf[4];
2158
2159   s = gdbserver_state;
2160   if (gdbserver_fd < 0 || s->fd < 0)
2161     return;
2162
2163   snprintf(buf, sizeof(buf), "W%02x", code);
2164   put_packet(s, buf);
2165 }
2166
2167 /* Tell the remote gdb that the process has exited due to SIG.  */
2168 void gdb_signalled(CPUState *env, int sig)
2169 {
2170   GDBState *s;
2171   char buf[4];
2172
2173   s = gdbserver_state;
2174   if (gdbserver_fd < 0 || s->fd < 0)
2175     return;
2176
2177   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2178   put_packet(s, buf);
2179 }
2180
2181 static void gdb_accept(void)
2182 {
2183     GDBState *s;
2184     struct sockaddr_in sockaddr;
2185     socklen_t len;
2186     int val, fd;
2187
2188     for(;;) {
2189         len = sizeof(sockaddr);
2190         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2191         if (fd < 0 && errno != EINTR) {
2192             perror("accept");
2193             return;
2194         } else if (fd >= 0) {
2195             break;
2196         }
2197     }
2198
2199     /* set short latency */
2200     val = 1;
2201     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2202
2203     s = qemu_mallocz(sizeof(GDBState));
2204
2205     memset (s, 0, sizeof (GDBState));
2206     s->c_cpu = first_cpu;
2207     s->g_cpu = first_cpu;
2208     s->fd = fd;
2209     gdb_has_xml = 0;
2210
2211     gdbserver_state = s;
2212
2213     fcntl(fd, F_SETFL, O_NONBLOCK);
2214 }
2215
2216 static int gdbserver_open(int port)
2217 {
2218     struct sockaddr_in sockaddr;
2219     int fd, val, ret;
2220
2221     fd = socket(PF_INET, SOCK_STREAM, 0);
2222     if (fd < 0) {
2223         perror("socket");
2224         return -1;
2225     }
2226
2227     /* allow fast reuse */
2228     val = 1;
2229     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2230
2231     sockaddr.sin_family = AF_INET;
2232     sockaddr.sin_port = htons(port);
2233     sockaddr.sin_addr.s_addr = 0;
2234     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2235     if (ret < 0) {
2236         perror("bind");
2237         return -1;
2238     }
2239     ret = listen(fd, 0);
2240     if (ret < 0) {
2241         perror("listen");
2242         return -1;
2243     }
2244     return fd;
2245 }
2246
2247 int gdbserver_start(int port)
2248 {
2249     gdbserver_fd = gdbserver_open(port);
2250     if (gdbserver_fd < 0)
2251         return -1;
2252     /* accept connections */
2253     gdb_accept();
2254     return 0;
2255 }
2256
2257 /* Disable gdb stub for child processes.  */
2258 void gdbserver_fork(CPUState *env)
2259 {
2260     GDBState *s = gdbserver_state;
2261     if (gdbserver_fd < 0 || s->fd < 0)
2262       return;
2263     close(s->fd);
2264     s->fd = -1;
2265     cpu_breakpoint_remove_all(env, BP_GDB);
2266     cpu_watchpoint_remove_all(env, BP_GDB);
2267 }
2268 #else
2269 static int gdb_chr_can_receive(void *opaque)
2270 {
2271   /* We can handle an arbitrarily large amount of data.
2272    Pick the maximum packet size, which is as good as anything.  */
2273   return MAX_PACKET_LENGTH;
2274 }
2275
2276 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2277 {
2278     int i;
2279
2280     for (i = 0; i < size; i++) {
2281         gdb_read_byte(gdbserver_state, buf[i]);
2282     }
2283 }
2284
2285 static void gdb_chr_event(void *opaque, int event)
2286 {
2287     switch (event) {
2288     case CHR_EVENT_RESET:
2289         vm_stop(EXCP_INTERRUPT);
2290         gdb_has_xml = 0;
2291         break;
2292     default:
2293         break;
2294     }
2295 }
2296
2297 int gdbserver_start(const char *port)
2298 {
2299     GDBState *s;
2300     char gdbstub_port_name[128];
2301     int port_num;
2302     char *p;
2303     CharDriverState *chr;
2304
2305     if (!port || !*port)
2306       return -1;
2307
2308     port_num = strtol(port, &p, 10);
2309     if (*p == 0) {
2310         /* A numeric value is interpreted as a port number.  */
2311         snprintf(gdbstub_port_name, sizeof(gdbstub_port_name),
2312                  "tcp::%d,nowait,nodelay,server", port_num);
2313         port = gdbstub_port_name;
2314     }
2315
2316     chr = qemu_chr_open("gdb", port, NULL);
2317     if (!chr)
2318         return -1;
2319
2320     s = qemu_mallocz(sizeof(GDBState));
2321     s->c_cpu = first_cpu;
2322     s->g_cpu = first_cpu;
2323     s->chr = chr;
2324     gdbserver_state = s;
2325     qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2326                           gdb_chr_event, NULL);
2327     qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2328     return 0;
2329 }
2330 #endif