gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "qemu-common.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "monitor/monitor.h"
  33 #include "sysemu/char.h"
  34 #include "sysemu/sysemu.h"
  35 #include "exec/gdbstub.h"
  36 #endif
  37
  38 #define MAX_PACKET_LENGTH 4096
  39
  40 #include "cpu.h"
  41 #include "qemu/sockets.h"
  42 #include "sysemu/kvm.h"
  43 #include "qemu/bitops.h"
  44
  45 static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
  46                                          uint8_t *buf, int len, bool is_write)
  47 {
  48     CPUClass *cc = CPU_GET_CLASS(cpu);
  49
  50     if (cc->memory_rw_debug) {
  51         return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
  52     }
  53     return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
  54 }
  55
  56 enum {
  57     GDB_SIGNAL_0 = 0,
  58     GDB_SIGNAL_INT = 2,
  59     GDB_SIGNAL_QUIT = 3,
  60     GDB_SIGNAL_TRAP = 5,
  61     GDB_SIGNAL_ABRT = 6,
  62     GDB_SIGNAL_ALRM = 14,
  63     GDB_SIGNAL_IO = 23,
  64     GDB_SIGNAL_XCPU = 24,
  65     GDB_SIGNAL_UNKNOWN = 143
  66 };
  67
  68 #ifdef CONFIG_USER_ONLY
  69
  70 /* Map target signal numbers to GDB protocol signal numbers and vice
  71  * versa.  For user emulation's currently supported systems, we can
  72  * assume most signals are defined.
  73  */
  74
  75 static int gdb_signal_table[] = {
  76     0,
  77     TARGET_SIGHUP,
  78     TARGET_SIGINT,
  79     TARGET_SIGQUIT,
  80     TARGET_SIGILL,
  81     TARGET_SIGTRAP,
  82     TARGET_SIGABRT,
  83     -1, /* SIGEMT */
  84     TARGET_SIGFPE,
  85     TARGET_SIGKILL,
  86     TARGET_SIGBUS,
  87     TARGET_SIGSEGV,
  88     TARGET_SIGSYS,
  89     TARGET_SIGPIPE,
  90     TARGET_SIGALRM,
  91     TARGET_SIGTERM,
  92     TARGET_SIGURG,
  93     TARGET_SIGSTOP,
  94     TARGET_SIGTSTP,
  95     TARGET_SIGCONT,
  96     TARGET_SIGCHLD,
  97     TARGET_SIGTTIN,
  98     TARGET_SIGTTOU,
  99     TARGET_SIGIO,
 100     TARGET_SIGXCPU,
 101     TARGET_SIGXFSZ,
 102     TARGET_SIGVTALRM,
 103     TARGET_SIGPROF,
 104     TARGET_SIGWINCH,
 105     -1, /* SIGLOST */
 106     TARGET_SIGUSR1,
 107     TARGET_SIGUSR2,
 108 #ifdef TARGET_SIGPWR
 109     TARGET_SIGPWR,
 110 #else
 111     -1,
 112 #endif
 113     -1, /* SIGPOLL */
 114     -1,
 115     -1,
 116     -1,
 117     -1,
 118     -1,
 119     -1,
 120     -1,
 121     -1,
 122     -1,
 123     -1,
 124     -1,
 125 #ifdef __SIGRTMIN
 126     __SIGRTMIN + 1,
 127     __SIGRTMIN + 2,
 128     __SIGRTMIN + 3,
 129     __SIGRTMIN + 4,
 130     __SIGRTMIN + 5,
 131     __SIGRTMIN + 6,
 132     __SIGRTMIN + 7,
 133     __SIGRTMIN + 8,
 134     __SIGRTMIN + 9,
 135     __SIGRTMIN + 10,
 136     __SIGRTMIN + 11,
 137     __SIGRTMIN + 12,
 138     __SIGRTMIN + 13,
 139     __SIGRTMIN + 14,
 140     __SIGRTMIN + 15,
 141     __SIGRTMIN + 16,
 142     __SIGRTMIN + 17,
 143     __SIGRTMIN + 18,
 144     __SIGRTMIN + 19,
 145     __SIGRTMIN + 20,
 146     __SIGRTMIN + 21,
 147     __SIGRTMIN + 22,
 148     __SIGRTMIN + 23,
 149     __SIGRTMIN + 24,
 150     __SIGRTMIN + 25,
 151     __SIGRTMIN + 26,
 152     __SIGRTMIN + 27,
 153     __SIGRTMIN + 28,
 154     __SIGRTMIN + 29,
 155     __SIGRTMIN + 30,
 156     __SIGRTMIN + 31,
 157     -1, /* SIGCANCEL */
 158     __SIGRTMIN,
 159     __SIGRTMIN + 32,
 160     __SIGRTMIN + 33,
 161     __SIGRTMIN + 34,
 162     __SIGRTMIN + 35,
 163     __SIGRTMIN + 36,
 164     __SIGRTMIN + 37,
 165     __SIGRTMIN + 38,
 166     __SIGRTMIN + 39,
 167     __SIGRTMIN + 40,
 168     __SIGRTMIN + 41,
 169     __SIGRTMIN + 42,
 170     __SIGRTMIN + 43,
 171     __SIGRTMIN + 44,
 172     __SIGRTMIN + 45,
 173     __SIGRTMIN + 46,
 174     __SIGRTMIN + 47,
 175     __SIGRTMIN + 48,
 176     __SIGRTMIN + 49,
 177     __SIGRTMIN + 50,
 178     __SIGRTMIN + 51,
 179     __SIGRTMIN + 52,
 180     __SIGRTMIN + 53,
 181     __SIGRTMIN + 54,
 182     __SIGRTMIN + 55,
 183     __SIGRTMIN + 56,
 184     __SIGRTMIN + 57,
 185     __SIGRTMIN + 58,
 186     __SIGRTMIN + 59,
 187     __SIGRTMIN + 60,
 188     __SIGRTMIN + 61,
 189     __SIGRTMIN + 62,
 190     __SIGRTMIN + 63,
 191     __SIGRTMIN + 64,
 192     __SIGRTMIN + 65,
 193     __SIGRTMIN + 66,
 194     __SIGRTMIN + 67,
 195     __SIGRTMIN + 68,
 196     __SIGRTMIN + 69,
 197     __SIGRTMIN + 70,
 198     __SIGRTMIN + 71,
 199     __SIGRTMIN + 72,
 200     __SIGRTMIN + 73,
 201     __SIGRTMIN + 74,
 202     __SIGRTMIN + 75,
 203     __SIGRTMIN + 76,
 204     __SIGRTMIN + 77,
 205     __SIGRTMIN + 78,
 206     __SIGRTMIN + 79,
 207     __SIGRTMIN + 80,
 208     __SIGRTMIN + 81,
 209     __SIGRTMIN + 82,
 210     __SIGRTMIN + 83,
 211     __SIGRTMIN + 84,
 212     __SIGRTMIN + 85,
 213     __SIGRTMIN + 86,
 214     __SIGRTMIN + 87,
 215     __SIGRTMIN + 88,
 216     __SIGRTMIN + 89,
 217     __SIGRTMIN + 90,
 218     __SIGRTMIN + 91,
 219     __SIGRTMIN + 92,
 220     __SIGRTMIN + 93,
 221     __SIGRTMIN + 94,
 222     __SIGRTMIN + 95,
 223     -1, /* SIGINFO */
 224     -1, /* UNKNOWN */
 225     -1, /* DEFAULT */
 226     -1,
 227     -1,
 228     -1,
 229     -1,
 230     -1,
 231     -1
 232 #endif
 233 };
 234 #else
 235 /* In system mode we only need SIGINT and SIGTRAP; other signals
 236    are not yet supported.  */
 237
 238 enum {
 239     TARGET_SIGINT = 2,
 240     TARGET_SIGTRAP = 5
 241 };
 242
 243 static int gdb_signal_table[] = {
 244     -1,
 245     -1,
 246     TARGET_SIGINT,
 247     -1,
 248     -1,
 249     TARGET_SIGTRAP
 250 };
 251 #endif
 252
 253 #ifdef CONFIG_USER_ONLY
 254 static int target_signal_to_gdb (int sig)
 255 {
 256     int i;
 257     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 258         if (gdb_signal_table[i] == sig)
 259             return i;
 260     return GDB_SIGNAL_UNKNOWN;
 261 }
 262 #endif
 263
 264 static int gdb_signal_to_target (int sig)
 265 {
 266     if (sig < ARRAY_SIZE (gdb_signal_table))
 267         return gdb_signal_table[sig];
 268     else
 269         return -1;
 270 }
 271
 272 //#define DEBUG_GDB
 273
 274 typedef struct GDBRegisterState {
 275     int base_reg;
 276     int num_regs;
 277     gdb_reg_cb get_reg;
 278     gdb_reg_cb set_reg;
 279     const char *xml;
 280     struct GDBRegisterState *next;
 281 } GDBRegisterState;
 282
 283 enum RSState {
 284     RS_INACTIVE,
 285     RS_IDLE,
 286     RS_GETLINE,
 287     RS_CHKSUM1,
 288     RS_CHKSUM2,
 289 };
 290 typedef struct GDBState {
 291     CPUState *c_cpu; /* current CPU for step/continue ops */
 292     CPUState *g_cpu; /* current CPU for other ops */
 293     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 294     enum RSState state; /* parsing state */
 295     char line_buf[MAX_PACKET_LENGTH];
 296     int line_buf_index;
 297     int line_csum;
 298     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 299     int last_packet_len;
 300     int signal;
 301 #ifdef CONFIG_USER_ONLY
 302     int fd;
 303     int running_state;
 304 #else
 305     CharDriverState *chr;
 306     CharDriverState *mon_chr;
 307 #endif
 308     char syscall_buf[256];
 309     gdb_syscall_complete_cb current_syscall_cb;
 310 } GDBState;
 311
 312 /* By default use no IRQs and no timers while single stepping so as to
 313  * make single stepping like an ICE HW step.
 314  */
 315 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 316
 317 static GDBState *gdbserver_state;
 318
 319 /* This is an ugly hack to cope with both new and old gdb.
 320    If gdb sends qXfer:features:read then assume we're talking to a newish
 321    gdb that understands target descriptions.  */
 322 static int gdb_has_xml;
 323
 324 #ifdef CONFIG_USER_ONLY
 325 /* XXX: This is not thread safe.  Do we care?  */
 326 static int gdbserver_fd = -1;
 327
 328 static int get_char(GDBState *s)
 329 {
 330     uint8_t ch;
 331     int ret;
 332
 333     for(;;) {
 334         ret = qemu_recv(s->fd, &ch, 1, 0);
 335         if (ret < 0) {
 336             if (errno == ECONNRESET)
 337                 s->fd = -1;
 338             if (errno != EINTR && errno != EAGAIN)
 339                 return -1;
 340         } else if (ret == 0) {
 341             close(s->fd);
 342             s->fd = -1;
 343             return -1;
 344         } else {
 345             break;
 346         }
 347     }
 348     return ch;
 349 }
 350 #endif
 351
 352 static enum {
 353     GDB_SYS_UNKNOWN,
 354     GDB_SYS_ENABLED,
 355     GDB_SYS_DISABLED,
 356 } gdb_syscall_mode;
 357
 358 /* If gdb is connected when the first semihosting syscall occurs then use
 359    remote gdb syscalls.  Otherwise use native file IO.  */
 360 int use_gdb_syscalls(void)
 361 {
 362     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 363         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 364                                             : GDB_SYS_DISABLED);
 365     }
 366     return gdb_syscall_mode == GDB_SYS_ENABLED;
 367 }
 368
 369 /* Resume execution.  */
 370 static inline void gdb_continue(GDBState *s)
 371 {
 372 #ifdef CONFIG_USER_ONLY
 373     s->running_state = 1;
 374 #else
 375     if (runstate_check(RUN_STATE_GUEST_PANICKED)) {
 376         runstate_set(RUN_STATE_DEBUG);
 377     }
 378     if (!runstate_needs_reset()) {
 379         vm_start();
 380     }
 381 #endif
 382 }
 383
 384 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 385 {
 386 #ifdef CONFIG_USER_ONLY
 387     int ret;
 388
 389     while (len > 0) {
 390         ret = send(s->fd, buf, len, 0);
 391         if (ret < 0) {
 392             if (errno != EINTR && errno != EAGAIN)
 393                 return;
 394         } else {
 395             buf += ret;
 396             len -= ret;
 397         }
 398     }
 399 #else
 400     qemu_chr_fe_write(s->chr, buf, len);
 401 #endif
 402 }
 403
 404 static inline int fromhex(int v)
 405 {
 406     if (v >= '0' && v <= '9')
 407         return v - '0';
 408     else if (v >= 'A' && v <= 'F')
 409         return v - 'A' + 10;
 410     else if (v >= 'a' && v <= 'f')
 411         return v - 'a' + 10;
 412     else
 413         return 0;
 414 }
 415
 416 static inline int tohex(int v)
 417 {
 418     if (v < 10)
 419         return v + '0';
 420     else
 421         return v - 10 + 'a';
 422 }
 423
 424 static void memtohex(char *buf, const uint8_t *mem, int len)
 425 {
 426     int i, c;
 427     char *q;
 428     q = buf;
 429     for(i = 0; i < len; i++) {
 430         c = mem[i];
 431         *q++ = tohex(c >> 4);
 432         *q++ = tohex(c & 0xf);
 433     }
 434     *q = '\0';
 435 }
 436
 437 static void hextomem(uint8_t *mem, const char *buf, int len)
 438 {
 439     int i;
 440
 441     for(i = 0; i < len; i++) {
 442         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 443         buf += 2;
 444     }
 445 }
 446
 447 /* return -1 if error, 0 if OK */
 448 static int put_packet_binary(GDBState *s, const char *buf, int len)
 449 {
 450     int csum, i;
 451     uint8_t *p;
 452
 453     for(;;) {
 454         p = s->last_packet;
 455         *(p++) = '$';
 456         memcpy(p, buf, len);
 457         p += len;
 458         csum = 0;
 459         for(i = 0; i < len; i++) {
 460             csum += buf[i];
 461         }
 462         *(p++) = '#';
 463         *(p++) = tohex((csum >> 4) & 0xf);
 464         *(p++) = tohex((csum) & 0xf);
 465
 466         s->last_packet_len = p - s->last_packet;
 467         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 468
 469 #ifdef CONFIG_USER_ONLY
 470         i = get_char(s);
 471         if (i < 0)
 472             return -1;
 473         if (i == '+')
 474             break;
 475 #else
 476         break;
 477 #endif
 478     }
 479     return 0;
 480 }
 481
 482 /* return -1 if error, 0 if OK */
 483 static int put_packet(GDBState *s, const char *buf)
 484 {
 485 #ifdef DEBUG_GDB
 486     printf("reply='%s'\n", buf);
 487 #endif
 488
 489     return put_packet_binary(s, buf, strlen(buf));
 490 }
 491
 492 /* The GDB remote protocol transfers values in target byte order.  This means
 493    we can use the raw memory access routines to access the value buffer.
 494    Conveniently, these also handle the case where the buffer is mis-aligned.
 495  */
 496 #define GET_REG8(val) do { \
 497     stb_p(mem_buf, val); \
 498     return 1; \
 499     } while(0)
 500 #define GET_REG16(val) do { \
 501     stw_p(mem_buf, val); \
 502     return 2; \
 503     } while(0)
 504 #define GET_REG32(val) do { \
 505     stl_p(mem_buf, val); \
 506     return 4; \
 507     } while(0)
 508 #define GET_REG64(val) do { \
 509     stq_p(mem_buf, val); \
 510     return 8; \
 511     } while(0)
 512
 513 #if TARGET_LONG_BITS == 64
 514 #define GET_REGL(val) GET_REG64(val)
 515 #define ldtul_p(addr) ldq_p(addr)
 516 #else
 517 #define GET_REGL(val) GET_REG32(val)
 518 #define ldtul_p(addr) ldl_p(addr)
 519 #endif
 520
 521 #if defined(TARGET_I386)
 522
 523 #include "target-i386/gdbstub.c"
 524
 525 #elif defined (TARGET_PPC)
 526
 527 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 528    expects whatever the target description contains.  Due to a
 529    historical mishap the FP registers appear in between core integer
 530    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 531    FP regs zero size when talking to a newer gdb.  */
 532 #if defined (TARGET_PPC64)
 533 #define GDB_CORE_XML "power64-core.xml"
 534 #else
 535 #define GDB_CORE_XML "power-core.xml"
 536 #endif
 537
 538 static int cpu_gdb_read_register(CPUPPCState *env, uint8_t *mem_buf, int n)
 539 {
 540     if (n < 32) {
 541         /* gprs */
 542         GET_REGL(env->gpr[n]);
 543     } else if (n < 64) {
 544         /* fprs */
 545         if (gdb_has_xml) {
 546             return 0;
 547         }
 548         stfq_p(mem_buf, env->fpr[n-32]);
 549         return 8;
 550     } else {
 551         switch (n) {
 552         case 64:
 553             GET_REGL(env->nip);
 554         case 65:
 555             GET_REGL(env->msr);
 556         case 66:
 557             {
 558                 uint32_t cr = 0;
 559                 int i;
 560                 for (i = 0; i < 8; i++) {
 561                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 562                 }
 563                 GET_REG32(cr);
 564             }
 565         case 67:
 566             GET_REGL(env->lr);
 567         case 68:
 568             GET_REGL(env->ctr);
 569         case 69:
 570             GET_REGL(env->xer);
 571         case 70:
 572             {
 573                 if (gdb_has_xml) {
 574                     return 0;
 575                 }
 576                 GET_REG32(env->fpscr);
 577             }
 578         }
 579     }
 580     return 0;
 581 }
 582
 583 static int cpu_gdb_write_register(CPUPPCState *env, uint8_t *mem_buf, int n)
 584 {
 585     if (n < 32) {
 586         /* gprs */
 587         env->gpr[n] = ldtul_p(mem_buf);
 588         return sizeof(target_ulong);
 589     } else if (n < 64) {
 590         /* fprs */
 591         if (gdb_has_xml) {
 592             return 0;
 593         }
 594         env->fpr[n-32] = ldfq_p(mem_buf);
 595         return 8;
 596     } else {
 597         switch (n) {
 598         case 64:
 599             env->nip = ldtul_p(mem_buf);
 600             return sizeof(target_ulong);
 601         case 65:
 602             ppc_store_msr(env, ldtul_p(mem_buf));
 603             return sizeof(target_ulong);
 604         case 66:
 605             {
 606                 uint32_t cr = ldl_p(mem_buf);
 607                 int i;
 608                 for (i = 0; i < 8; i++) {
 609                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 610                 }
 611                 return 4;
 612             }
 613         case 67:
 614             env->lr = ldtul_p(mem_buf);
 615             return sizeof(target_ulong);
 616         case 68:
 617             env->ctr = ldtul_p(mem_buf);
 618             return sizeof(target_ulong);
 619         case 69:
 620             env->xer = ldtul_p(mem_buf);
 621             return sizeof(target_ulong);
 622         case 70:
 623             /* fpscr */
 624             if (gdb_has_xml) {
 625                 return 0;
 626             }
 627             store_fpscr(env, ldtul_p(mem_buf), 0xffffffff);
 628             return sizeof(target_ulong);
 629         }
 630     }
 631     return 0;
 632 }
 633
 634 #elif defined (TARGET_SPARC)
 635
 636 #ifdef TARGET_ABI32
 637 #define GET_REGA(val) GET_REG32(val)
 638 #else
 639 #define GET_REGA(val) GET_REGL(val)
 640 #endif
 641
 642 static int cpu_gdb_read_register(CPUSPARCState *env, uint8_t *mem_buf, int n)
 643 {
 644     if (n < 8) {
 645         /* g0..g7 */
 646         GET_REGA(env->gregs[n]);
 647     }
 648     if (n < 32) {
 649         /* register window */
 650         GET_REGA(env->regwptr[n - 8]);
 651     }
 652 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 653     if (n < 64) {
 654         /* fprs */
 655         if (n & 1) {
 656             GET_REG32(env->fpr[(n - 32) / 2].l.lower);
 657         } else {
 658             GET_REG32(env->fpr[(n - 32) / 2].l.upper);
 659         }
 660     }
 661     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 662     switch (n) {
 663     case 64:
 664         GET_REGA(env->y);
 665     case 65:
 666         GET_REGA(cpu_get_psr(env));
 667     case 66:
 668         GET_REGA(env->wim);
 669     case 67:
 670         GET_REGA(env->tbr);
 671     case 68:
 672         GET_REGA(env->pc);
 673     case 69:
 674         GET_REGA(env->npc);
 675     case 70:
 676         GET_REGA(env->fsr);
 677     case 71:
 678         GET_REGA(0); /* csr */
 679     default:
 680         GET_REGA(0);
 681     }
 682 #else
 683     if (n < 64) {
 684         /* f0-f31 */
 685         if (n & 1) {
 686             GET_REG32(env->fpr[(n - 32) / 2].l.lower);
 687         } else {
 688             GET_REG32(env->fpr[(n - 32) / 2].l.upper);
 689         }
 690     }
 691     if (n < 80) {
 692         /* f32-f62 (double width, even numbers only) */
 693         GET_REG64(env->fpr[(n - 32) / 2].ll);
 694     }
 695     switch (n) {
 696     case 80:
 697         GET_REGL(env->pc);
 698     case 81:
 699         GET_REGL(env->npc);
 700     case 82:
 701         GET_REGL((cpu_get_ccr(env) << 32) |
 702                  ((env->asi & 0xff) << 24) |
 703                  ((env->pstate & 0xfff) << 8) |
 704                  cpu_get_cwp64(env));
 705     case 83:
 706         GET_REGL(env->fsr);
 707     case 84:
 708         GET_REGL(env->fprs);
 709     case 85:
 710         GET_REGL(env->y);
 711     }
 712 #endif
 713     return 0;
 714 }
 715
 716 static int cpu_gdb_write_register(CPUSPARCState *env, uint8_t *mem_buf, int n)
 717 {
 718 #if defined(TARGET_ABI32)
 719     abi_ulong tmp;
 720
 721     tmp = ldl_p(mem_buf);
 722 #else
 723     target_ulong tmp;
 724
 725     tmp = ldtul_p(mem_buf);
 726 #endif
 727
 728     if (n < 8) {
 729         /* g0..g7 */
 730         env->gregs[n] = tmp;
 731     } else if (n < 32) {
 732         /* register window */
 733         env->regwptr[n - 8] = tmp;
 734     }
 735 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 736     else if (n < 64) {
 737         /* fprs */
 738         /* f0-f31 */
 739         if (n & 1) {
 740             env->fpr[(n - 32) / 2].l.lower = tmp;
 741         } else {
 742             env->fpr[(n - 32) / 2].l.upper = tmp;
 743         }
 744     } else {
 745         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 746         switch (n) {
 747         case 64:
 748             env->y = tmp;
 749             break;
 750         case 65:
 751             cpu_put_psr(env, tmp);
 752             break;
 753         case 66:
 754             env->wim = tmp;
 755             break;
 756         case 67:
 757             env->tbr = tmp;
 758             break;
 759         case 68:
 760             env->pc = tmp;
 761             break;
 762         case 69:
 763             env->npc = tmp;
 764             break;
 765         case 70:
 766             env->fsr = tmp;
 767             break;
 768         default:
 769             return 0;
 770         }
 771     }
 772     return 4;
 773 #else
 774     else if (n < 64) {
 775         /* f0-f31 */
 776         tmp = ldl_p(mem_buf);
 777         if (n & 1) {
 778             env->fpr[(n - 32) / 2].l.lower = tmp;
 779         } else {
 780             env->fpr[(n - 32) / 2].l.upper = tmp;
 781         }
 782         return 4;
 783     } else if (n < 80) {
 784         /* f32-f62 (double width, even numbers only) */
 785         env->fpr[(n - 32) / 2].ll = tmp;
 786     } else {
 787         switch (n) {
 788         case 80:
 789             env->pc = tmp;
 790             break;
 791         case 81:
 792             env->npc = tmp;
 793             break;
 794         case 82:
 795             cpu_put_ccr(env, tmp >> 32);
 796             env->asi = (tmp >> 24) & 0xff;
 797             env->pstate = (tmp >> 8) & 0xfff;
 798             cpu_put_cwp64(env, tmp & 0xff);
 799             break;
 800         case 83:
 801             env->fsr = tmp;
 802             break;
 803         case 84:
 804             env->fprs = tmp;
 805             break;
 806         case 85:
 807             env->y = tmp;
 808             break;
 809         default:
 810             return 0;
 811         }
 812     }
 813     return 8;
 814 #endif
 815 }
 816 #elif defined (TARGET_ARM)
 817
 818 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 819    whatever the target description contains.  Due to a historical mishap
 820    the FPA registers appear in between core integer regs and the CPSR.
 821    We hack round this by giving the FPA regs zero size when talking to a
 822    newer gdb.  */
 823 #define GDB_CORE_XML "arm-core.xml"
 824
 825 static int cpu_gdb_read_register(CPUARMState *env, uint8_t *mem_buf, int n)
 826 {
 827     if (n < 16) {
 828         /* Core integer register.  */
 829         GET_REG32(env->regs[n]);
 830     }
 831     if (n < 24) {
 832         /* FPA registers.  */
 833         if (gdb_has_xml) {
 834             return 0;
 835         }
 836         memset(mem_buf, 0, 12);
 837         return 12;
 838     }
 839     switch (n) {
 840     case 24:
 841         /* FPA status register.  */
 842         if (gdb_has_xml) {
 843             return 0;
 844         }
 845         GET_REG32(0);
 846     case 25:
 847         /* CPSR */
 848         GET_REG32(cpsr_read(env));
 849     }
 850     /* Unknown register.  */
 851     return 0;
 852 }
 853
 854 static int cpu_gdb_write_register(CPUARMState *env, uint8_t *mem_buf, int n)
 855 {
 856     uint32_t tmp;
 857
 858     tmp = ldl_p(mem_buf);
 859
 860     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 861        cause problems if we ever implement the Jazelle DBX extensions.  */
 862     if (n == 15) {
 863         tmp &= ~1;
 864     }
 865
 866     if (n < 16) {
 867         /* Core integer register.  */
 868         env->regs[n] = tmp;
 869         return 4;
 870     }
 871     if (n < 24) { /* 16-23 */
 872         /* FPA registers (ignored).  */
 873         if (gdb_has_xml) {
 874             return 0;
 875         }
 876         return 12;
 877     }
 878     switch (n) {
 879     case 24:
 880         /* FPA status register (ignored).  */
 881         if (gdb_has_xml) {
 882             return 0;
 883         }
 884         return 4;
 885     case 25:
 886         /* CPSR */
 887         cpsr_write(env, tmp, 0xffffffff);
 888         return 4;
 889     }
 890     /* Unknown register.  */
 891     return 0;
 892 }
 893
 894 #elif defined (TARGET_M68K)
 895
 896 #define GDB_CORE_XML "cf-core.xml"
 897
 898 static int cpu_gdb_read_register(CPUM68KState *env, uint8_t *mem_buf, int n)
 899 {
 900     if (n < 8) {
 901         /* D0-D7 */
 902         GET_REG32(env->dregs[n]);
 903     } else if (n < 16) {
 904         /* A0-A7 */
 905         GET_REG32(env->aregs[n - 8]);
 906     } else {
 907         switch (n) {
 908         case 16:
 909             GET_REG32(env->sr);
 910         case 17:
 911             GET_REG32(env->pc);
 912         }
 913     }
 914     /* FP registers not included here because they vary between
 915        ColdFire and m68k.  Use XML bits for these.  */
 916     return 0;
 917 }
 918
 919 static int cpu_gdb_write_register(CPUM68KState *env, uint8_t *mem_buf, int n)
 920 {
 921     uint32_t tmp;
 922
 923     tmp = ldl_p(mem_buf);
 924
 925     if (n < 8) {
 926         /* D0-D7 */
 927         env->dregs[n] = tmp;
 928     } else if (n < 16) {
 929         /* A0-A7 */
 930         env->aregs[n - 8] = tmp;
 931     } else {
 932         switch (n) {
 933         case 16:
 934             env->sr = tmp;
 935             break;
 936         case 17:
 937             env->pc = tmp;
 938             break;
 939         default:
 940             return 0;
 941         }
 942     }
 943     return 4;
 944 }
 945 #elif defined (TARGET_MIPS)
 946
 947 static int cpu_gdb_read_register(CPUMIPSState *env, uint8_t *mem_buf, int n)
 948 {
 949     if (n < 32) {
 950         GET_REGL(env->active_tc.gpr[n]);
 951     }
 952     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
 953         if (n >= 38 && n < 70) {
 954             if (env->CP0_Status & (1 << CP0St_FR)) {
 955                 GET_REGL(env->active_fpu.fpr[n - 38].d);
 956             } else {
 957                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
 958             }
 959         }
 960         switch (n) {
 961         case 70:
 962             GET_REGL((int32_t)env->active_fpu.fcr31);
 963         case 71:
 964             GET_REGL((int32_t)env->active_fpu.fcr0);
 965         }
 966     }
 967     switch (n) {
 968     case 32:
 969         GET_REGL((int32_t)env->CP0_Status);
 970     case 33:
 971         GET_REGL(env->active_tc.LO[0]);
 972     case 34:
 973         GET_REGL(env->active_tc.HI[0]);
 974     case 35:
 975         GET_REGL(env->CP0_BadVAddr);
 976     case 36:
 977         GET_REGL((int32_t)env->CP0_Cause);
 978     case 37:
 979         GET_REGL(env->active_tc.PC | !!(env->hflags & MIPS_HFLAG_M16));
 980     case 72:
 981         GET_REGL(0); /* fp */
 982     case 89:
 983         GET_REGL((int32_t)env->CP0_PRid);
 984     }
 985     if (n >= 73 && n <= 88) {
 986         /* 16 embedded regs.  */
 987         GET_REGL(0);
 988     }
 989
 990     return 0;
 991 }
 992
 993 /* convert MIPS rounding mode in FCR31 to IEEE library */
 994 static unsigned int ieee_rm[] = {
 995     float_round_nearest_even,
 996     float_round_to_zero,
 997     float_round_up,
 998     float_round_down
 999 };
1000 #define RESTORE_ROUNDING_MODE \
1001     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], \
1002                             &env->active_fpu.fp_status)
1003
1004 static int cpu_gdb_write_register(CPUMIPSState *env, uint8_t *mem_buf, int n)
1005 {
1006     target_ulong tmp;
1007
1008     tmp = ldtul_p(mem_buf);
1009
1010     if (n < 32) {
1011         env->active_tc.gpr[n] = tmp;
1012         return sizeof(target_ulong);
1013     }
1014     if (env->CP0_Config1 & (1 << CP0C1_FP)
1015             && n >= 38 && n < 73) {
1016         if (n < 70) {
1017             if (env->CP0_Status & (1 << CP0St_FR)) {
1018                 env->active_fpu.fpr[n - 38].d = tmp;
1019             } else {
1020                 env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1021             }
1022         }
1023         switch (n) {
1024         case 70:
1025             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1026             /* set rounding mode */
1027             RESTORE_ROUNDING_MODE;
1028             break;
1029         case 71:
1030             env->active_fpu.fcr0 = tmp;
1031             break;
1032         }
1033         return sizeof(target_ulong);
1034     }
1035     switch (n) {
1036     case 32:
1037         env->CP0_Status = tmp;
1038         break;
1039     case 33:
1040         env->active_tc.LO[0] = tmp;
1041         break;
1042     case 34:
1043         env->active_tc.HI[0] = tmp;
1044         break;
1045     case 35:
1046         env->CP0_BadVAddr = tmp;
1047         break;
1048     case 36:
1049         env->CP0_Cause = tmp;
1050         break;
1051     case 37:
1052         env->active_tc.PC = tmp & ~(target_ulong)1;
1053         if (tmp & 1) {
1054             env->hflags |= MIPS_HFLAG_M16;
1055         } else {
1056             env->hflags &= ~(MIPS_HFLAG_M16);
1057         }
1058         break;
1059     case 72: /* fp, ignored */
1060         break;
1061     default:
1062         if (n > 89) {
1063             return 0;
1064         }
1065         /* Other registers are readonly.  Ignore writes.  */
1066         break;
1067     }
1068
1069     return sizeof(target_ulong);
1070 }
1071 #elif defined(TARGET_OPENRISC)
1072
1073 static int cpu_gdb_read_register(CPUOpenRISCState *env, uint8_t *mem_buf, int n)
1074 {
1075     if (n < 32) {
1076         GET_REG32(env->gpr[n]);
1077     } else {
1078         switch (n) {
1079         case 32:    /* PPC */
1080             GET_REG32(env->ppc);
1081
1082         case 33:    /* NPC */
1083             GET_REG32(env->npc);
1084
1085         case 34:    /* SR */
1086             GET_REG32(env->sr);
1087
1088         default:
1089             break;
1090         }
1091     }
1092     return 0;
1093 }
1094
1095 static int cpu_gdb_write_register(CPUOpenRISCState *env,
1096                                   uint8_t *mem_buf, int n)
1097 {
1098     OpenRISCCPU *cpu = openrisc_env_get_cpu(env);
1099     CPUClass *cc = CPU_GET_CLASS(cpu);
1100     uint32_t tmp;
1101
1102     if (n > cc->gdb_num_core_regs) {
1103         return 0;
1104     }
1105
1106     tmp = ldl_p(mem_buf);
1107
1108     if (n < 32) {
1109         env->gpr[n] = tmp;
1110     } else {
1111         switch (n) {
1112         case 32: /* PPC */
1113             env->ppc = tmp;
1114             break;
1115
1116         case 33: /* NPC */
1117             env->npc = tmp;
1118             break;
1119
1120         case 34: /* SR */
1121             env->sr = tmp;
1122             break;
1123
1124         default:
1125             break;
1126         }
1127     }
1128     return 4;
1129 }
1130 #elif defined (TARGET_SH4)
1131
1132 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1133 /* FIXME: We should use XML for this.  */
1134
1135 static int cpu_gdb_read_register(CPUSH4State *env, uint8_t *mem_buf, int n)
1136 {
1137     switch (n) {
1138     case 0 ... 7:
1139         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1140             GET_REGL(env->gregs[n + 16]);
1141         } else {
1142             GET_REGL(env->gregs[n]);
1143         }
1144     case 8 ... 15:
1145         GET_REGL(env->gregs[n]);
1146     case 16:
1147         GET_REGL(env->pc);
1148     case 17:
1149         GET_REGL(env->pr);
1150     case 18:
1151         GET_REGL(env->gbr);
1152     case 19:
1153         GET_REGL(env->vbr);
1154     case 20:
1155         GET_REGL(env->mach);
1156     case 21:
1157         GET_REGL(env->macl);
1158     case 22:
1159         GET_REGL(env->sr);
1160     case 23:
1161         GET_REGL(env->fpul);
1162     case 24:
1163         GET_REGL(env->fpscr);
1164     case 25 ... 40:
1165         if (env->fpscr & FPSCR_FR) {
1166             stfl_p(mem_buf, env->fregs[n - 9]);
1167         } else {
1168             stfl_p(mem_buf, env->fregs[n - 25]);
1169         }
1170         return 4;
1171     case 41:
1172         GET_REGL(env->ssr);
1173     case 42:
1174         GET_REGL(env->spc);
1175     case 43 ... 50:
1176         GET_REGL(env->gregs[n - 43]);
1177     case 51 ... 58:
1178         GET_REGL(env->gregs[n - (51 - 16)]);
1179     }
1180
1181     return 0;
1182 }
1183
1184 static int cpu_gdb_write_register(CPUSH4State *env, uint8_t *mem_buf, int n)
1185 {
1186     switch (n) {
1187     case 0 ... 7:
1188         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1189             env->gregs[n + 16] = ldl_p(mem_buf);
1190         } else {
1191             env->gregs[n] = ldl_p(mem_buf);
1192         }
1193         break;
1194     case 8 ... 15:
1195         env->gregs[n] = ldl_p(mem_buf);
1196         break;
1197     case 16:
1198         env->pc = ldl_p(mem_buf);
1199         break;
1200     case 17:
1201         env->pr = ldl_p(mem_buf);
1202         break;
1203     case 18:
1204         env->gbr = ldl_p(mem_buf);
1205         break;
1206     case 19:
1207         env->vbr = ldl_p(mem_buf);
1208         break;
1209     case 20:
1210         env->mach = ldl_p(mem_buf);
1211         break;
1212     case 21:
1213         env->macl = ldl_p(mem_buf);
1214         break;
1215     case 22:
1216         env->sr = ldl_p(mem_buf);
1217         break;
1218     case 23:
1219         env->fpul = ldl_p(mem_buf);
1220         break;
1221     case 24:
1222         env->fpscr = ldl_p(mem_buf);
1223         break;
1224     case 25 ... 40:
1225         if (env->fpscr & FPSCR_FR) {
1226             env->fregs[n - 9] = ldfl_p(mem_buf);
1227         } else {
1228             env->fregs[n - 25] = ldfl_p(mem_buf);
1229         }
1230         break;
1231     case 41:
1232         env->ssr = ldl_p(mem_buf);
1233         break;
1234     case 42:
1235         env->spc = ldl_p(mem_buf);
1236         break;
1237     case 43 ... 50:
1238         env->gregs[n - 43] = ldl_p(mem_buf);
1239         break;
1240     case 51 ... 58:
1241         env->gregs[n - (51 - 16)] = ldl_p(mem_buf);
1242         break;
1243     default:
1244         return 0;
1245     }
1246
1247     return 4;
1248 }
1249 #elif defined (TARGET_MICROBLAZE)
1250
1251 static int cpu_gdb_read_register(CPUMBState *env, uint8_t *mem_buf, int n)
1252 {
1253     if (n < 32) {
1254         GET_REG32(env->regs[n]);
1255     } else {
1256         GET_REG32(env->sregs[n - 32]);
1257     }
1258     return 0;
1259 }
1260
1261 static int cpu_gdb_write_register(CPUMBState *env, uint8_t *mem_buf, int n)
1262 {
1263     MicroBlazeCPU *cpu = mb_env_get_cpu(env);
1264     CPUClass *cc = CPU_GET_CLASS(cpu);
1265     uint32_t tmp;
1266
1267     if (n > cc->gdb_num_core_regs) {
1268         return 0;
1269     }
1270
1271     tmp = ldl_p(mem_buf);
1272
1273     if (n < 32) {
1274         env->regs[n] = tmp;
1275     } else {
1276         env->sregs[n - 32] = tmp;
1277     }
1278     return 4;
1279 }
1280 #elif defined (TARGET_CRIS)
1281
1282 static int
1283 read_register_crisv10(CPUCRISState *env, uint8_t *mem_buf, int n)
1284 {
1285     if (n < 15) {
1286         GET_REG32(env->regs[n]);
1287     }
1288
1289     if (n == 15) {
1290         GET_REG32(env->pc);
1291     }
1292
1293     if (n < 32) {
1294         switch (n) {
1295         case 16:
1296             GET_REG8(env->pregs[n - 16]);
1297         case 17:
1298             GET_REG8(env->pregs[n - 16]);
1299         case 20:
1300         case 21:
1301             GET_REG16(env->pregs[n - 16]);
1302         default:
1303             if (n >= 23) {
1304                 GET_REG32(env->pregs[n - 16]);
1305             }
1306             break;
1307         }
1308     }
1309     return 0;
1310 }
1311
1312 static int cpu_gdb_read_register(CPUCRISState *env, uint8_t *mem_buf, int n)
1313 {
1314     uint8_t srs;
1315
1316     if (env->pregs[PR_VR] < 32) {
1317         return read_register_crisv10(env, mem_buf, n);
1318     }
1319
1320     srs = env->pregs[PR_SRS];
1321     if (n < 16) {
1322         GET_REG32(env->regs[n]);
1323     }
1324
1325     if (n >= 21 && n < 32) {
1326         GET_REG32(env->pregs[n - 16]);
1327     }
1328     if (n >= 33 && n < 49) {
1329         GET_REG32(env->sregs[srs][n - 33]);
1330     }
1331     switch (n) {
1332     case 16:
1333         GET_REG8(env->pregs[0]);
1334     case 17:
1335         GET_REG8(env->pregs[1]);
1336     case 18:
1337         GET_REG32(env->pregs[2]);
1338     case 19:
1339         GET_REG8(srs);
1340     case 20:
1341         GET_REG16(env->pregs[4]);
1342     case 32:
1343         GET_REG32(env->pc);
1344     }
1345
1346     return 0;
1347 }
1348
1349 static int cpu_gdb_write_register(CPUCRISState *env, uint8_t *mem_buf, int n)
1350 {
1351     uint32_t tmp;
1352
1353     if (n > 49) {
1354         return 0;
1355     }
1356
1357     tmp = ldl_p(mem_buf);
1358
1359     if (n < 16) {
1360         env->regs[n] = tmp;
1361     }
1362
1363     if (n >= 21 && n < 32) {
1364         env->pregs[n - 16] = tmp;
1365     }
1366
1367     /* FIXME: Should support function regs be writable?  */
1368     switch (n) {
1369     case 16:
1370         return 1;
1371     case 17:
1372         return 1;
1373     case 18:
1374         env->pregs[PR_PID] = tmp;
1375         break;
1376     case 19:
1377         return 1;
1378     case 20:
1379         return 2;
1380     case 32:
1381         env->pc = tmp;
1382         break;
1383     }
1384
1385     return 4;
1386 }
1387 #elif defined (TARGET_ALPHA)
1388
1389 static int cpu_gdb_read_register(CPUAlphaState *env, uint8_t *mem_buf, int n)
1390 {
1391     uint64_t val;
1392     CPU_DoubleU d;
1393
1394     switch (n) {
1395     case 0 ... 30:
1396         val = env->ir[n];
1397         break;
1398     case 32 ... 62:
1399         d.d = env->fir[n - 32];
1400         val = d.ll;
1401         break;
1402     case 63:
1403         val = cpu_alpha_load_fpcr(env);
1404         break;
1405     case 64:
1406         val = env->pc;
1407         break;
1408     case 66:
1409         val = env->unique;
1410         break;
1411     case 31:
1412     case 65:
1413         /* 31 really is the zero register; 65 is unassigned in the
1414            gdb protocol, but is still required to occupy 8 bytes. */
1415         val = 0;
1416         break;
1417     default:
1418         return 0;
1419     }
1420     GET_REGL(val);
1421 }
1422
1423 static int cpu_gdb_write_register(CPUAlphaState *env, uint8_t *mem_buf, int n)
1424 {
1425     target_ulong tmp = ldtul_p(mem_buf);
1426     CPU_DoubleU d;
1427
1428     switch (n) {
1429     case 0 ... 30:
1430         env->ir[n] = tmp;
1431         break;
1432     case 32 ... 62:
1433         d.ll = tmp;
1434         env->fir[n - 32] = d.d;
1435         break;
1436     case 63:
1437         cpu_alpha_store_fpcr(env, tmp);
1438         break;
1439     case 64:
1440         env->pc = tmp;
1441         break;
1442     case 66:
1443         env->unique = tmp;
1444         break;
1445     case 31:
1446     case 65:
1447         /* 31 really is the zero register; 65 is unassigned in the
1448            gdb protocol, but is still required to occupy 8 bytes. */
1449         break;
1450     default:
1451         return 0;
1452     }
1453     return 8;
1454 }
1455 #elif defined (TARGET_S390X)
1456
1457 static int cpu_gdb_read_register(CPUS390XState *env, uint8_t *mem_buf, int n)
1458 {
1459     uint64_t val;
1460     int cc_op;
1461
1462     switch (n) {
1463     case S390_PSWM_REGNUM:
1464         cc_op = calc_cc(env, env->cc_op, env->cc_src, env->cc_dst, env->cc_vr);
1465         val = deposit64(env->psw.mask, 44, 2, cc_op);
1466         GET_REGL(val);
1467     case S390_PSWA_REGNUM:
1468         GET_REGL(env->psw.addr);
1469     case S390_R0_REGNUM ... S390_R15_REGNUM:
1470         GET_REGL(env->regs[n-S390_R0_REGNUM]);
1471     case S390_A0_REGNUM ... S390_A15_REGNUM:
1472         GET_REG32(env->aregs[n-S390_A0_REGNUM]);
1473     case S390_FPC_REGNUM:
1474         GET_REG32(env->fpc);
1475     case S390_F0_REGNUM ... S390_F15_REGNUM:
1476         GET_REG64(env->fregs[n-S390_F0_REGNUM].ll);
1477     }
1478
1479     return 0;
1480 }
1481
1482 static int cpu_gdb_write_register(CPUS390XState *env, uint8_t *mem_buf, int n)
1483 {
1484     target_ulong tmpl;
1485     uint32_t tmp32;
1486     int r = 8;
1487     tmpl = ldtul_p(mem_buf);
1488     tmp32 = ldl_p(mem_buf);
1489
1490     switch (n) {
1491     case S390_PSWM_REGNUM:
1492         env->psw.mask = tmpl;
1493         env->cc_op = extract64(tmpl, 44, 2);
1494         break;
1495     case S390_PSWA_REGNUM:
1496         env->psw.addr = tmpl;
1497         break;
1498     case S390_R0_REGNUM ... S390_R15_REGNUM:
1499         env->regs[n-S390_R0_REGNUM] = tmpl;
1500         break;
1501     case S390_A0_REGNUM ... S390_A15_REGNUM:
1502         env->aregs[n-S390_A0_REGNUM] = tmp32;
1503         r = 4;
1504         break;
1505     case S390_FPC_REGNUM:
1506         env->fpc = tmp32;
1507         r = 4;
1508         break;
1509     case S390_F0_REGNUM ... S390_F15_REGNUM:
1510         env->fregs[n-S390_F0_REGNUM].ll = tmpl;
1511         break;
1512     default:
1513         return 0;
1514     }
1515     return r;
1516 }
1517 #elif defined (TARGET_LM32)
1518
1519 #include "hw/lm32/lm32_pic.h"
1520
1521 static int cpu_gdb_read_register(CPULM32State *env, uint8_t *mem_buf, int n)
1522 {
1523     if (n < 32) {
1524         GET_REG32(env->regs[n]);
1525     } else {
1526         switch (n) {
1527         case 32:
1528             GET_REG32(env->pc);
1529         /* FIXME: put in right exception ID */
1530         case 33:
1531             GET_REG32(0);
1532         case 34:
1533             GET_REG32(env->eba);
1534         case 35:
1535             GET_REG32(env->deba);
1536         case 36:
1537             GET_REG32(env->ie);
1538         case 37:
1539             GET_REG32(lm32_pic_get_im(env->pic_state));
1540         case 38:
1541             GET_REG32(lm32_pic_get_ip(env->pic_state));
1542         }
1543     }
1544     return 0;
1545 }
1546
1547 static int cpu_gdb_write_register(CPULM32State *env, uint8_t *mem_buf, int n)
1548 {
1549     LM32CPU *cpu = lm32_env_get_cpu(env);
1550     CPUClass *cc = CPU_GET_CLASS(cpu);
1551     uint32_t tmp;
1552
1553     if (n > cc->gdb_num_core_regs) {
1554         return 0;
1555     }
1556
1557     tmp = ldl_p(mem_buf);
1558
1559     if (n < 32) {
1560         env->regs[n] = tmp;
1561     } else {
1562         switch (n) {
1563         case 32:
1564             env->pc = tmp;
1565             break;
1566         case 34:
1567             env->eba = tmp;
1568             break;
1569         case 35:
1570             env->deba = tmp;
1571             break;
1572         case 36:
1573             env->ie = tmp;
1574             break;
1575         case 37:
1576             lm32_pic_set_im(env->pic_state, tmp);
1577             break;
1578         case 38:
1579             lm32_pic_set_ip(env->pic_state, tmp);
1580             break;
1581         }
1582     }
1583     return 4;
1584 }
1585 #elif defined(TARGET_XTENSA)
1586
1587 static int cpu_gdb_read_register(CPUXtensaState *env, uint8_t *mem_buf, int n)
1588 {
1589     const XtensaGdbReg *reg = env->config->gdb_regmap.reg + n;
1590
1591     if (n < 0 || n >= env->config->gdb_regmap.num_regs) {
1592         return 0;
1593     }
1594
1595     switch (reg->type) {
1596     case 9: /*pc*/
1597         GET_REG32(env->pc);
1598
1599     case 1: /*ar*/
1600         xtensa_sync_phys_from_window(env);
1601         GET_REG32(env->phys_regs[(reg->targno & 0xff) % env->config->nareg]);
1602
1603     case 2: /*SR*/
1604         GET_REG32(env->sregs[reg->targno & 0xff]);
1605
1606     case 3: /*UR*/
1607         GET_REG32(env->uregs[reg->targno & 0xff]);
1608
1609     case 4: /*f*/
1610         GET_REG32(float32_val(env->fregs[reg->targno & 0x0f]));
1611
1612     case 8: /*a*/
1613         GET_REG32(env->regs[reg->targno & 0x0f]);
1614
1615     default:
1616         qemu_log("%s from reg %d of unsupported type %d\n",
1617                  __func__, n, reg->type);
1618         return 0;
1619     }
1620 }
1621
1622 static int cpu_gdb_write_register(CPUXtensaState *env, uint8_t *mem_buf, int n)
1623 {
1624     uint32_t tmp;
1625     const XtensaGdbReg *reg = env->config->gdb_regmap.reg + n;
1626
1627     if (n < 0 || n >= env->config->gdb_regmap.num_regs) {
1628         return 0;
1629     }
1630
1631     tmp = ldl_p(mem_buf);
1632
1633     switch (reg->type) {
1634     case 9: /*pc*/
1635         env->pc = tmp;
1636         break;
1637
1638     case 1: /*ar*/
1639         env->phys_regs[(reg->targno & 0xff) % env->config->nareg] = tmp;
1640         xtensa_sync_window_from_phys(env);
1641         break;
1642
1643     case 2: /*SR*/
1644         env->sregs[reg->targno & 0xff] = tmp;
1645         break;
1646
1647     case 3: /*UR*/
1648         env->uregs[reg->targno & 0xff] = tmp;
1649         break;
1650
1651     case 4: /*f*/
1652         env->fregs[reg->targno & 0x0f] = make_float32(tmp);
1653         break;
1654
1655     case 8: /*a*/
1656         env->regs[reg->targno & 0x0f] = tmp;
1657         break;
1658
1659     default:
1660         qemu_log("%s to reg %d of unsupported type %d\n",
1661                  __func__, n, reg->type);
1662         return 0;
1663     }
1664
1665     return 4;
1666 }
1667 #else
1668
1669 static int cpu_gdb_read_register(CPUArchState *env, uint8_t *mem_buf, int n)
1670 {
1671     return 0;
1672 }
1673
1674 static int cpu_gdb_write_register(CPUArchState *env, uint8_t *mem_buf, int n)
1675 {
1676     return 0;
1677 }
1678
1679 #endif
1680
1681 #ifdef GDB_CORE_XML
1682 /* Encode data using the encoding for 'x' packets.  */
1683 static int memtox(char *buf, const char *mem, int len)
1684 {
1685     char *p = buf;
1686     char c;
1687
1688     while (len--) {
1689         c = *(mem++);
1690         switch (c) {
1691         case '#': case '$': case '*': case '}':
1692             *(p++) = '}';
1693             *(p++) = c ^ 0x20;
1694             break;
1695         default:
1696             *(p++) = c;
1697             break;
1698         }
1699     }
1700     return p - buf;
1701 }
1702
1703 static const char *get_feature_xml(const char *p, const char **newp)
1704 {
1705     size_t len;
1706     int i;
1707     const char *name;
1708     static char target_xml[1024];
1709
1710     len = 0;
1711     while (p[len] && p[len] != ':')
1712         len++;
1713     *newp = p + len;
1714
1715     name = NULL;
1716     if (strncmp(p, "target.xml", len) == 0) {
1717         /* Generate the XML description for this CPU.  */
1718         if (!target_xml[0]) {
1719             GDBRegisterState *r;
1720             CPUState *cpu = first_cpu;
1721
1722             snprintf(target_xml, sizeof(target_xml),
1723                      "<?xml version=\"1.0\"?>"
1724                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1725                      "<target>"
1726                      "<xi:include href=\"%s\"/>",
1727                      GDB_CORE_XML);
1728
1729             for (r = cpu->gdb_regs; r; r = r->next) {
1730                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
1731                 pstrcat(target_xml, sizeof(target_xml), r->xml);
1732                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
1733             }
1734             pstrcat(target_xml, sizeof(target_xml), "</target>");
1735         }
1736         return target_xml;
1737     }
1738     for (i = 0; ; i++) {
1739         name = xml_builtin[i][0];
1740         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1741             break;
1742     }
1743     return name ? xml_builtin[i][1] : NULL;
1744 }
1745 #endif
1746
1747 static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
1748 {
1749     CPUClass *cc = CPU_GET_CLASS(cpu);
1750     CPUArchState *env = cpu->env_ptr;
1751     GDBRegisterState *r;
1752
1753     if (reg < cc->gdb_num_core_regs) {
1754         return cpu_gdb_read_register(env, mem_buf, reg);
1755     }
1756
1757     for (r = cpu->gdb_regs; r; r = r->next) {
1758         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1759             return r->get_reg(env, mem_buf, reg - r->base_reg);
1760         }
1761     }
1762     return 0;
1763 }
1764
1765 static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
1766 {
1767     CPUClass *cc = CPU_GET_CLASS(cpu);
1768     CPUArchState *env = cpu->env_ptr;
1769     GDBRegisterState *r;
1770
1771     if (reg < cc->gdb_num_core_regs) {
1772         return cpu_gdb_write_register(env, mem_buf, reg);
1773     }
1774
1775     for (r = cpu->gdb_regs; r; r = r->next) {
1776         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1777             return r->set_reg(env, mem_buf, reg - r->base_reg);
1778         }
1779     }
1780     return 0;
1781 }
1782
1783 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1784    specifies the first register number and these registers are included in
1785    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1786    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1787  */
1788
1789 void gdb_register_coprocessor(CPUState *cpu,
1790                               gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1791                               int num_regs, const char *xml, int g_pos)
1792 {
1793     GDBRegisterState *s;
1794     GDBRegisterState **p;
1795
1796     p = &cpu->gdb_regs;
1797     while (*p) {
1798         /* Check for duplicates.  */
1799         if (strcmp((*p)->xml, xml) == 0)
1800             return;
1801         p = &(*p)->next;
1802     }
1803
1804     s = g_new0(GDBRegisterState, 1);
1805     s->base_reg = cpu->gdb_num_regs;
1806     s->num_regs = num_regs;
1807     s->get_reg = get_reg;
1808     s->set_reg = set_reg;
1809     s->xml = xml;
1810
1811     /* Add to end of list.  */
1812     cpu->gdb_num_regs += num_regs;
1813     *p = s;
1814     if (g_pos) {
1815         if (g_pos != s->base_reg) {
1816             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1817                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1818         }
1819     }
1820 }
1821
1822 #ifndef CONFIG_USER_ONLY
1823 static const int xlat_gdb_type[] = {
1824     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1825     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1826     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1827 };
1828 #endif
1829
1830 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1831 {
1832     CPUState *cpu;
1833     CPUArchState *env;
1834     int err = 0;
1835
1836     if (kvm_enabled()) {
1837         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1838     }
1839
1840     switch (type) {
1841     case GDB_BREAKPOINT_SW:
1842     case GDB_BREAKPOINT_HW:
1843         for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
1844             env = cpu->env_ptr;
1845             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1846             if (err)
1847                 break;
1848         }
1849         return err;
1850 #ifndef CONFIG_USER_ONLY
1851     case GDB_WATCHPOINT_WRITE:
1852     case GDB_WATCHPOINT_READ:
1853     case GDB_WATCHPOINT_ACCESS:
1854         for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
1855             env = cpu->env_ptr;
1856             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1857                                         NULL);
1858             if (err)
1859                 break;
1860         }
1861         return err;
1862 #endif
1863     default:
1864         return -ENOSYS;
1865     }
1866 }
1867
1868 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1869 {
1870     CPUState *cpu;
1871     CPUArchState *env;
1872     int err = 0;
1873
1874     if (kvm_enabled()) {
1875         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1876     }
1877
1878     switch (type) {
1879     case GDB_BREAKPOINT_SW:
1880     case GDB_BREAKPOINT_HW:
1881         for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
1882             env = cpu->env_ptr;
1883             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1884             if (err)
1885                 break;
1886         }
1887         return err;
1888 #ifndef CONFIG_USER_ONLY
1889     case GDB_WATCHPOINT_WRITE:
1890     case GDB_WATCHPOINT_READ:
1891     case GDB_WATCHPOINT_ACCESS:
1892         for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
1893             env = cpu->env_ptr;
1894             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1895             if (err)
1896                 break;
1897         }
1898         return err;
1899 #endif
1900     default:
1901         return -ENOSYS;
1902     }
1903 }
1904
1905 static void gdb_breakpoint_remove_all(void)
1906 {
1907     CPUState *cpu;
1908     CPUArchState *env;
1909
1910     if (kvm_enabled()) {
1911         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1912         return;
1913     }
1914
1915     for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
1916         env = cpu->env_ptr;
1917         cpu_breakpoint_remove_all(env, BP_GDB);
1918 #ifndef CONFIG_USER_ONLY
1919         cpu_watchpoint_remove_all(env, BP_GDB);
1920 #endif
1921     }
1922 }
1923
1924 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1925 {
1926     CPUState *cpu = s->c_cpu;
1927     CPUClass *cc = CPU_GET_CLASS(cpu);
1928
1929     cpu_synchronize_state(cpu);
1930     if (cc->set_pc) {
1931         cc->set_pc(cpu, pc);
1932     }
1933 }
1934
1935 static CPUState *find_cpu(uint32_t thread_id)
1936 {
1937     CPUState *cpu;
1938
1939     for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
1940         if (cpu_index(cpu) == thread_id) {
1941             return cpu;
1942         }
1943     }
1944
1945     return NULL;
1946 }
1947
1948 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1949 {
1950     CPUState *cpu;
1951     const char *p;
1952     uint32_t thread;
1953     int ch, reg_size, type, res;
1954     char buf[MAX_PACKET_LENGTH];
1955     uint8_t mem_buf[MAX_PACKET_LENGTH];
1956     uint8_t *registers;
1957     target_ulong addr, len;
1958
1959 #ifdef DEBUG_GDB
1960     printf("command='%s'\n", line_buf);
1961 #endif
1962     p = line_buf;
1963     ch = *p++;
1964     switch(ch) {
1965     case '?':
1966         /* TODO: Make this return the correct value for user-mode.  */
1967         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1968                  cpu_index(s->c_cpu));
1969         put_packet(s, buf);
1970         /* Remove all the breakpoints when this query is issued,
1971          * because gdb is doing and initial connect and the state
1972          * should be cleaned up.
1973          */
1974         gdb_breakpoint_remove_all();
1975         break;
1976     case 'c':
1977         if (*p != '\0') {
1978             addr = strtoull(p, (char **)&p, 16);
1979             gdb_set_cpu_pc(s, addr);
1980         }
1981         s->signal = 0;
1982         gdb_continue(s);
1983         return RS_IDLE;
1984     case 'C':
1985         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1986         if (s->signal == -1)
1987             s->signal = 0;
1988         gdb_continue(s);
1989         return RS_IDLE;
1990     case 'v':
1991         if (strncmp(p, "Cont", 4) == 0) {
1992             int res_signal, res_thread;
1993
1994             p += 4;
1995             if (*p == '?') {
1996                 put_packet(s, "vCont;c;C;s;S");
1997                 break;
1998             }
1999             res = 0;
2000             res_signal = 0;
2001             res_thread = 0;
2002             while (*p) {
2003                 int action, signal;
2004
2005                 if (*p++ != ';') {
2006                     res = 0;
2007                     break;
2008                 }
2009                 action = *p++;
2010                 signal = 0;
2011                 if (action == 'C' || action == 'S') {
2012                     signal = strtoul(p, (char **)&p, 16);
2013                 } else if (action != 'c' && action != 's') {
2014                     res = 0;
2015                     break;
2016                 }
2017                 thread = 0;
2018                 if (*p == ':') {
2019                     thread = strtoull(p+1, (char **)&p, 16);
2020                 }
2021                 action = tolower(action);
2022                 if (res == 0 || (res == 'c' && action == 's')) {
2023                     res = action;
2024                     res_signal = signal;
2025                     res_thread = thread;
2026                 }
2027             }
2028             if (res) {
2029                 if (res_thread != -1 && res_thread != 0) {
2030                     cpu = find_cpu(res_thread);
2031                     if (cpu == NULL) {
2032                         put_packet(s, "E22");
2033                         break;
2034                     }
2035                     s->c_cpu = cpu;
2036                 }
2037                 if (res == 's') {
2038                     cpu_single_step(s->c_cpu, sstep_flags);
2039                 }
2040                 s->signal = res_signal;
2041                 gdb_continue(s);
2042                 return RS_IDLE;
2043             }
2044             break;
2045         } else {
2046             goto unknown_command;
2047         }
2048     case 'k':
2049 #ifdef CONFIG_USER_ONLY
2050         /* Kill the target */
2051         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
2052         exit(0);
2053 #endif
2054     case 'D':
2055         /* Detach packet */
2056         gdb_breakpoint_remove_all();
2057         gdb_syscall_mode = GDB_SYS_DISABLED;
2058         gdb_continue(s);
2059         put_packet(s, "OK");
2060         break;
2061     case 's':
2062         if (*p != '\0') {
2063             addr = strtoull(p, (char **)&p, 16);
2064             gdb_set_cpu_pc(s, addr);
2065         }
2066         cpu_single_step(s->c_cpu, sstep_flags);
2067         gdb_continue(s);
2068         return RS_IDLE;
2069     case 'F':
2070         {
2071             target_ulong ret;
2072             target_ulong err;
2073
2074             ret = strtoull(p, (char **)&p, 16);
2075             if (*p == ',') {
2076                 p++;
2077                 err = strtoull(p, (char **)&p, 16);
2078             } else {
2079                 err = 0;
2080             }
2081             if (*p == ',')
2082                 p++;
2083             type = *p;
2084             if (s->current_syscall_cb) {
2085                 s->current_syscall_cb(s->c_cpu, ret, err);
2086                 s->current_syscall_cb = NULL;
2087             }
2088             if (type == 'C') {
2089                 put_packet(s, "T02");
2090             } else {
2091                 gdb_continue(s);
2092             }
2093         }
2094         break;
2095     case 'g':
2096         cpu_synchronize_state(s->g_cpu);
2097         len = 0;
2098         for (addr = 0; addr < s->g_cpu->gdb_num_regs; addr++) {
2099             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
2100             len += reg_size;
2101         }
2102         memtohex(buf, mem_buf, len);
2103         put_packet(s, buf);
2104         break;
2105     case 'G':
2106         cpu_synchronize_state(s->g_cpu);
2107         registers = mem_buf;
2108         len = strlen(p) / 2;
2109         hextomem((uint8_t *)registers, p, len);
2110         for (addr = 0; addr < s->g_cpu->gdb_num_regs && len > 0; addr++) {
2111             reg_size = gdb_write_register(s->g_cpu, registers, addr);
2112             len -= reg_size;
2113             registers += reg_size;
2114         }
2115         put_packet(s, "OK");
2116         break;
2117     case 'm':
2118         addr = strtoull(p, (char **)&p, 16);
2119         if (*p == ',')
2120             p++;
2121         len = strtoull(p, NULL, 16);
2122         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
2123             put_packet (s, "E14");
2124         } else {
2125             memtohex(buf, mem_buf, len);
2126             put_packet(s, buf);
2127         }
2128         break;
2129     case 'M':
2130         addr = strtoull(p, (char **)&p, 16);
2131         if (*p == ',')
2132             p++;
2133         len = strtoull(p, (char **)&p, 16);
2134         if (*p == ':')
2135             p++;
2136         hextomem(mem_buf, p, len);
2137         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
2138                                    true) != 0) {
2139             put_packet(s, "E14");
2140         } else {
2141             put_packet(s, "OK");
2142         }
2143         break;
2144     case 'p':
2145         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
2146            This works, but can be very slow.  Anything new enough to
2147            understand XML also knows how to use this properly.  */
2148         if (!gdb_has_xml)
2149             goto unknown_command;
2150         addr = strtoull(p, (char **)&p, 16);
2151         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
2152         if (reg_size) {
2153             memtohex(buf, mem_buf, reg_size);
2154             put_packet(s, buf);
2155         } else {
2156             put_packet(s, "E14");
2157         }
2158         break;
2159     case 'P':
2160         if (!gdb_has_xml)
2161             goto unknown_command;
2162         addr = strtoull(p, (char **)&p, 16);
2163         if (*p == '=')
2164             p++;
2165         reg_size = strlen(p) / 2;
2166         hextomem(mem_buf, p, reg_size);
2167         gdb_write_register(s->g_cpu, mem_buf, addr);
2168         put_packet(s, "OK");
2169         break;
2170     case 'Z':
2171     case 'z':
2172         type = strtoul(p, (char **)&p, 16);
2173         if (*p == ',')
2174             p++;
2175         addr = strtoull(p, (char **)&p, 16);
2176         if (*p == ',')
2177             p++;
2178         len = strtoull(p, (char **)&p, 16);
2179         if (ch == 'Z')
2180             res = gdb_breakpoint_insert(addr, len, type);
2181         else
2182             res = gdb_breakpoint_remove(addr, len, type);
2183         if (res >= 0)
2184              put_packet(s, "OK");
2185         else if (res == -ENOSYS)
2186             put_packet(s, "");
2187         else
2188             put_packet(s, "E22");
2189         break;
2190     case 'H':
2191         type = *p++;
2192         thread = strtoull(p, (char **)&p, 16);
2193         if (thread == -1 || thread == 0) {
2194             put_packet(s, "OK");
2195             break;
2196         }
2197         cpu = find_cpu(thread);
2198         if (cpu == NULL) {
2199             put_packet(s, "E22");
2200             break;
2201         }
2202         switch (type) {
2203         case 'c':
2204             s->c_cpu = cpu;
2205             put_packet(s, "OK");
2206             break;
2207         case 'g':
2208             s->g_cpu = cpu;
2209             put_packet(s, "OK");
2210             break;
2211         default:
2212              put_packet(s, "E22");
2213              break;
2214         }
2215         break;
2216     case 'T':
2217         thread = strtoull(p, (char **)&p, 16);
2218         cpu = find_cpu(thread);
2219
2220         if (cpu != NULL) {
2221             put_packet(s, "OK");
2222         } else {
2223             put_packet(s, "E22");
2224         }
2225         break;
2226     case 'q':
2227     case 'Q':
2228         /* parse any 'q' packets here */
2229         if (!strcmp(p,"qemu.sstepbits")) {
2230             /* Query Breakpoint bit definitions */
2231             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
2232                      SSTEP_ENABLE,
2233                      SSTEP_NOIRQ,
2234                      SSTEP_NOTIMER);
2235             put_packet(s, buf);
2236             break;
2237         } else if (strncmp(p,"qemu.sstep",10) == 0) {
2238             /* Display or change the sstep_flags */
2239             p += 10;
2240             if (*p != '=') {
2241                 /* Display current setting */
2242                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
2243                 put_packet(s, buf);
2244                 break;
2245             }
2246             p++;
2247             type = strtoul(p, (char **)&p, 16);
2248             sstep_flags = type;
2249             put_packet(s, "OK");
2250             break;
2251         } else if (strcmp(p,"C") == 0) {
2252             /* "Current thread" remains vague in the spec, so always return
2253              *  the first CPU (gdb returns the first thread). */
2254             put_packet(s, "QC1");
2255             break;
2256         } else if (strcmp(p,"fThreadInfo") == 0) {
2257             s->query_cpu = first_cpu;
2258             goto report_cpuinfo;
2259         } else if (strcmp(p,"sThreadInfo") == 0) {
2260         report_cpuinfo:
2261             if (s->query_cpu) {
2262                 snprintf(buf, sizeof(buf), "m%x", cpu_index(s->query_cpu));
2263                 put_packet(s, buf);
2264                 s->query_cpu = s->query_cpu->next_cpu;
2265             } else
2266                 put_packet(s, "l");
2267             break;
2268         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
2269             thread = strtoull(p+16, (char **)&p, 16);
2270             cpu = find_cpu(thread);
2271             if (cpu != NULL) {
2272                 cpu_synchronize_state(cpu);
2273                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
2274                                "CPU#%d [%s]", cpu->cpu_index,
2275                                cpu->halted ? "halted " : "running");
2276                 memtohex(buf, mem_buf, len);
2277                 put_packet(s, buf);
2278             }
2279             break;
2280         }
2281 #ifdef CONFIG_USER_ONLY
2282         else if (strncmp(p, "Offsets", 7) == 0) {
2283             CPUArchState *env = s->c_cpu->env_ptr;
2284             TaskState *ts = env->opaque;
2285
2286             snprintf(buf, sizeof(buf),
2287                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
2288                      ";Bss=" TARGET_ABI_FMT_lx,
2289                      ts->info->code_offset,
2290                      ts->info->data_offset,
2291                      ts->info->data_offset);
2292             put_packet(s, buf);
2293             break;
2294         }
2295 #else /* !CONFIG_USER_ONLY */
2296         else if (strncmp(p, "Rcmd,", 5) == 0) {
2297             int len = strlen(p + 5);
2298
2299             if ((len % 2) != 0) {
2300                 put_packet(s, "E01");
2301                 break;
2302             }
2303             hextomem(mem_buf, p + 5, len);
2304             len = len / 2;
2305             mem_buf[len++] = 0;
2306             qemu_chr_be_write(s->mon_chr, mem_buf, len);
2307             put_packet(s, "OK");
2308             break;
2309         }
2310 #endif /* !CONFIG_USER_ONLY */
2311         if (strncmp(p, "Supported", 9) == 0) {
2312             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
2313 #ifdef GDB_CORE_XML
2314             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
2315 #endif
2316             put_packet(s, buf);
2317             break;
2318         }
2319 #ifdef GDB_CORE_XML
2320         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
2321             const char *xml;
2322             target_ulong total_len;
2323
2324             gdb_has_xml = 1;
2325             p += 19;
2326             xml = get_feature_xml(p, &p);
2327             if (!xml) {
2328                 snprintf(buf, sizeof(buf), "E00");
2329                 put_packet(s, buf);
2330                 break;
2331             }
2332
2333             if (*p == ':')
2334                 p++;
2335             addr = strtoul(p, (char **)&p, 16);
2336             if (*p == ',')
2337                 p++;
2338             len = strtoul(p, (char **)&p, 16);
2339
2340             total_len = strlen(xml);
2341             if (addr > total_len) {
2342                 snprintf(buf, sizeof(buf), "E00");
2343                 put_packet(s, buf);
2344                 break;
2345             }
2346             if (len > (MAX_PACKET_LENGTH - 5) / 2)
2347                 len = (MAX_PACKET_LENGTH - 5) / 2;
2348             if (len < total_len - addr) {
2349                 buf[0] = 'm';
2350                 len = memtox(buf + 1, xml + addr, len);
2351             } else {
2352                 buf[0] = 'l';
2353                 len = memtox(buf + 1, xml + addr, total_len - addr);
2354             }
2355             put_packet_binary(s, buf, len + 1);
2356             break;
2357         }
2358 #endif
2359         /* Unrecognised 'q' command.  */
2360         goto unknown_command;
2361
2362     default:
2363     unknown_command:
2364         /* put empty packet */
2365         buf[0] = '\0';
2366         put_packet(s, buf);
2367         break;
2368     }
2369     return RS_IDLE;
2370 }
2371
2372 void gdb_set_stop_cpu(CPUState *cpu)
2373 {
2374     gdbserver_state->c_cpu = cpu;
2375     gdbserver_state->g_cpu = cpu;
2376 }
2377
2378 #ifndef CONFIG_USER_ONLY
2379 static void gdb_vm_state_change(void *opaque, int running, RunState state)
2380 {
2381     GDBState *s = gdbserver_state;
2382     CPUArchState *env = s->c_cpu->env_ptr;
2383     CPUState *cpu = s->c_cpu;
2384     char buf[256];
2385     const char *type;
2386     int ret;
2387
2388     if (running || s->state == RS_INACTIVE) {
2389         return;
2390     }
2391     /* Is there a GDB syscall waiting to be sent?  */
2392     if (s->current_syscall_cb) {
2393         put_packet(s, s->syscall_buf);
2394         return;
2395     }
2396     switch (state) {
2397     case RUN_STATE_DEBUG:
2398         if (env->watchpoint_hit) {
2399             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
2400             case BP_MEM_READ:
2401                 type = "r";
2402                 break;
2403             case BP_MEM_ACCESS:
2404                 type = "a";
2405                 break;
2406             default:
2407                 type = "";
2408                 break;
2409             }
2410             snprintf(buf, sizeof(buf),
2411                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
2412                      GDB_SIGNAL_TRAP, cpu_index(cpu), type,
2413                      env->watchpoint_hit->vaddr);
2414             env->watchpoint_hit = NULL;
2415             goto send_packet;
2416         }
2417         tb_flush(env);
2418         ret = GDB_SIGNAL_TRAP;
2419         break;
2420     case RUN_STATE_PAUSED:
2421         ret = GDB_SIGNAL_INT;
2422         break;
2423     case RUN_STATE_SHUTDOWN:
2424         ret = GDB_SIGNAL_QUIT;
2425         break;
2426     case RUN_STATE_IO_ERROR:
2427         ret = GDB_SIGNAL_IO;
2428         break;
2429     case RUN_STATE_WATCHDOG:
2430         ret = GDB_SIGNAL_ALRM;
2431         break;
2432     case RUN_STATE_INTERNAL_ERROR:
2433         ret = GDB_SIGNAL_ABRT;
2434         break;
2435     case RUN_STATE_SAVE_VM:
2436     case RUN_STATE_RESTORE_VM:
2437         return;
2438     case RUN_STATE_FINISH_MIGRATE:
2439         ret = GDB_SIGNAL_XCPU;
2440         break;
2441     default:
2442         ret = GDB_SIGNAL_UNKNOWN;
2443         break;
2444     }
2445     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, cpu_index(cpu));
2446
2447 send_packet:
2448     put_packet(s, buf);
2449
2450     /* disable single step if it was enabled */
2451     cpu_single_step(cpu, 0);
2452 }
2453 #endif
2454
2455 /* Send a gdb syscall request.
2456    This accepts limited printf-style format specifiers, specifically:
2457     %x  - target_ulong argument printed in hex.
2458     %lx - 64-bit argument printed in hex.
2459     %s  - string pointer (target_ulong) and length (int) pair.  */
2460 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
2461 {
2462     va_list va;
2463     char *p;
2464     char *p_end;
2465     target_ulong addr;
2466     uint64_t i64;
2467     GDBState *s;
2468
2469     s = gdbserver_state;
2470     if (!s)
2471         return;
2472     s->current_syscall_cb = cb;
2473 #ifndef CONFIG_USER_ONLY
2474     vm_stop(RUN_STATE_DEBUG);
2475 #endif
2476     va_start(va, fmt);
2477     p = s->syscall_buf;
2478     p_end = &s->syscall_buf[sizeof(s->syscall_buf)];
2479     *(p++) = 'F';
2480     while (*fmt) {
2481         if (*fmt == '%') {
2482             fmt++;
2483             switch (*fmt++) {
2484             case 'x':
2485                 addr = va_arg(va, target_ulong);
2486                 p += snprintf(p, p_end - p, TARGET_FMT_lx, addr);
2487                 break;
2488             case 'l':
2489                 if (*(fmt++) != 'x')
2490                     goto bad_format;
2491                 i64 = va_arg(va, uint64_t);
2492                 p += snprintf(p, p_end - p, "%" PRIx64, i64);
2493                 break;
2494             case 's':
2495                 addr = va_arg(va, target_ulong);
2496                 p += snprintf(p, p_end - p, TARGET_FMT_lx "/%x",
2497                               addr, va_arg(va, int));
2498                 break;
2499             default:
2500             bad_format:
2501                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2502                         fmt - 1);
2503                 break;
2504             }
2505         } else {
2506             *(p++) = *(fmt++);
2507         }
2508     }
2509     *p = 0;
2510     va_end(va);
2511 #ifdef CONFIG_USER_ONLY
2512     put_packet(s, s->syscall_buf);
2513     gdb_handlesig(s->c_cpu, 0);
2514 #else
2515     /* In this case wait to send the syscall packet until notification that
2516        the CPU has stopped.  This must be done because if the packet is sent
2517        now the reply from the syscall request could be received while the CPU
2518        is still in the running state, which can cause packets to be dropped
2519        and state transition 'T' packets to be sent while the syscall is still
2520        being processed.  */
2521     cpu_exit(s->c_cpu);
2522 #endif
2523 }
2524
2525 static void gdb_read_byte(GDBState *s, int ch)
2526 {
2527     int i, csum;
2528     uint8_t reply;
2529
2530 #ifndef CONFIG_USER_ONLY
2531     if (s->last_packet_len) {
2532         /* Waiting for a response to the last packet.  If we see the start
2533            of a new command then abandon the previous response.  */
2534         if (ch == '-') {
2535 #ifdef DEBUG_GDB
2536             printf("Got NACK, retransmitting\n");
2537 #endif
2538             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2539         }
2540 #ifdef DEBUG_GDB
2541         else if (ch == '+')
2542             printf("Got ACK\n");
2543         else
2544             printf("Got '%c' when expecting ACK/NACK\n", ch);
2545 #endif
2546         if (ch == '+' || ch == '$')
2547             s->last_packet_len = 0;
2548         if (ch != '$')
2549             return;
2550     }
2551     if (runstate_is_running()) {
2552         /* when the CPU is running, we cannot do anything except stop
2553            it when receiving a char */
2554         vm_stop(RUN_STATE_PAUSED);
2555     } else
2556 #endif
2557     {
2558         switch(s->state) {
2559         case RS_IDLE:
2560             if (ch == '$') {
2561                 s->line_buf_index = 0;
2562                 s->state = RS_GETLINE;
2563             }
2564             break;
2565         case RS_GETLINE:
2566             if (ch == '#') {
2567             s->state = RS_CHKSUM1;
2568             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2569                 s->state = RS_IDLE;
2570             } else {
2571             s->line_buf[s->line_buf_index++] = ch;
2572             }
2573             break;
2574         case RS_CHKSUM1:
2575             s->line_buf[s->line_buf_index] = '\0';
2576             s->line_csum = fromhex(ch) << 4;
2577             s->state = RS_CHKSUM2;
2578             break;
2579         case RS_CHKSUM2:
2580             s->line_csum |= fromhex(ch);
2581             csum = 0;
2582             for(i = 0; i < s->line_buf_index; i++) {
2583                 csum += s->line_buf[i];
2584             }
2585             if (s->line_csum != (csum & 0xff)) {
2586                 reply = '-';
2587                 put_buffer(s, &reply, 1);
2588                 s->state = RS_IDLE;
2589             } else {
2590                 reply = '+';
2591                 put_buffer(s, &reply, 1);
2592                 s->state = gdb_handle_packet(s, s->line_buf);
2593             }
2594             break;
2595         default:
2596             abort();
2597         }
2598     }
2599 }
2600
2601 /* Tell the remote gdb that the process has exited.  */
2602 void gdb_exit(CPUArchState *env, int code)
2603 {
2604   GDBState *s;
2605   char buf[4];
2606
2607   s = gdbserver_state;
2608   if (!s) {
2609       return;
2610   }
2611 #ifdef CONFIG_USER_ONLY
2612   if (gdbserver_fd < 0 || s->fd < 0) {
2613       return;
2614   }
2615 #endif
2616
2617   snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
2618   put_packet(s, buf);
2619
2620 #ifndef CONFIG_USER_ONLY
2621   if (s->chr) {
2622       qemu_chr_delete(s->chr);
2623   }
2624 #endif
2625 }
2626
2627 #ifdef CONFIG_USER_ONLY
2628 int
2629 gdb_queuesig (void)
2630 {
2631     GDBState *s;
2632
2633     s = gdbserver_state;
2634
2635     if (gdbserver_fd < 0 || s->fd < 0)
2636         return 0;
2637     else
2638         return 1;
2639 }
2640
2641 int
2642 gdb_handlesig(CPUState *cpu, int sig)
2643 {
2644     CPUArchState *env = cpu->env_ptr;
2645     GDBState *s;
2646     char buf[256];
2647     int n;
2648
2649     s = gdbserver_state;
2650     if (gdbserver_fd < 0 || s->fd < 0) {
2651         return sig;
2652     }
2653
2654     /* disable single step if it was enabled */
2655     cpu_single_step(cpu, 0);
2656     tb_flush(env);
2657
2658     if (sig != 0) {
2659         snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));
2660         put_packet(s, buf);
2661     }
2662     /* put_packet() might have detected that the peer terminated the
2663        connection.  */
2664     if (s->fd < 0) {
2665         return sig;
2666     }
2667
2668     sig = 0;
2669     s->state = RS_IDLE;
2670     s->running_state = 0;
2671     while (s->running_state == 0) {
2672         n = read(s->fd, buf, 256);
2673         if (n > 0) {
2674             int i;
2675
2676             for (i = 0; i < n; i++) {
2677                 gdb_read_byte(s, buf[i]);
2678             }
2679         } else if (n == 0 || errno != EAGAIN) {
2680             /* XXX: Connection closed.  Should probably wait for another
2681                connection before continuing.  */
2682             return sig;
2683         }
2684     }
2685     sig = s->signal;
2686     s->signal = 0;
2687     return sig;
2688 }
2689
2690 /* Tell the remote gdb that the process has exited due to SIG.  */
2691 void gdb_signalled(CPUArchState *env, int sig)
2692 {
2693     GDBState *s;
2694     char buf[4];
2695
2696     s = gdbserver_state;
2697     if (gdbserver_fd < 0 || s->fd < 0) {
2698         return;
2699     }
2700
2701     snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb(sig));
2702     put_packet(s, buf);
2703 }
2704
2705 static void gdb_accept(void)
2706 {
2707     GDBState *s;
2708     struct sockaddr_in sockaddr;
2709     socklen_t len;
2710     int fd;
2711
2712     for(;;) {
2713         len = sizeof(sockaddr);
2714         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2715         if (fd < 0 && errno != EINTR) {
2716             perror("accept");
2717             return;
2718         } else if (fd >= 0) {
2719 #ifndef _WIN32
2720             fcntl(fd, F_SETFD, FD_CLOEXEC);
2721 #endif
2722             break;
2723         }
2724     }
2725
2726     /* set short latency */
2727     socket_set_nodelay(fd);
2728
2729     s = g_malloc0(sizeof(GDBState));
2730     s->c_cpu = first_cpu;
2731     s->g_cpu = first_cpu;
2732     s->fd = fd;
2733     gdb_has_xml = 0;
2734
2735     gdbserver_state = s;
2736
2737     fcntl(fd, F_SETFL, O_NONBLOCK);
2738 }
2739
2740 static int gdbserver_open(int port)
2741 {
2742     struct sockaddr_in sockaddr;
2743     int fd, val, ret;
2744
2745     fd = socket(PF_INET, SOCK_STREAM, 0);
2746     if (fd < 0) {
2747         perror("socket");
2748         return -1;
2749     }
2750 #ifndef _WIN32
2751     fcntl(fd, F_SETFD, FD_CLOEXEC);
2752 #endif
2753
2754     /* allow fast reuse */
2755     val = 1;
2756     qemu_setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &val, sizeof(val));
2757
2758     sockaddr.sin_family = AF_INET;
2759     sockaddr.sin_port = htons(port);
2760     sockaddr.sin_addr.s_addr = 0;
2761     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2762     if (ret < 0) {
2763         perror("bind");
2764         close(fd);
2765         return -1;
2766     }
2767     ret = listen(fd, 0);
2768     if (ret < 0) {
2769         perror("listen");
2770         close(fd);
2771         return -1;
2772     }
2773     return fd;
2774 }
2775
2776 int gdbserver_start(int port)
2777 {
2778     gdbserver_fd = gdbserver_open(port);
2779     if (gdbserver_fd < 0)
2780         return -1;
2781     /* accept connections */
2782     gdb_accept();
2783     return 0;
2784 }
2785
2786 /* Disable gdb stub for child processes.  */
2787 void gdbserver_fork(CPUArchState *env)
2788 {
2789     GDBState *s = gdbserver_state;
2790     if (gdbserver_fd < 0 || s->fd < 0)
2791       return;
2792     close(s->fd);
2793     s->fd = -1;
2794     cpu_breakpoint_remove_all(env, BP_GDB);
2795     cpu_watchpoint_remove_all(env, BP_GDB);
2796 }
2797 #else
2798 static int gdb_chr_can_receive(void *opaque)
2799 {
2800   /* We can handle an arbitrarily large amount of data.
2801    Pick the maximum packet size, which is as good as anything.  */
2802   return MAX_PACKET_LENGTH;
2803 }
2804
2805 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2806 {
2807     int i;
2808
2809     for (i = 0; i < size; i++) {
2810         gdb_read_byte(gdbserver_state, buf[i]);
2811     }
2812 }
2813
2814 static void gdb_chr_event(void *opaque, int event)
2815 {
2816     switch (event) {
2817     case CHR_EVENT_OPENED:
2818         vm_stop(RUN_STATE_PAUSED);
2819         gdb_has_xml = 0;
2820         break;
2821     default:
2822         break;
2823     }
2824 }
2825
2826 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2827 {
2828     char buf[MAX_PACKET_LENGTH];
2829
2830     buf[0] = 'O';
2831     if (len > (MAX_PACKET_LENGTH/2) - 1)
2832         len = (MAX_PACKET_LENGTH/2) - 1;
2833     memtohex(buf + 1, (uint8_t *)msg, len);
2834     put_packet(s, buf);
2835 }
2836
2837 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2838 {
2839     const char *p = (const char *)buf;
2840     int max_sz;
2841
2842     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2843     for (;;) {
2844         if (len <= max_sz) {
2845             gdb_monitor_output(gdbserver_state, p, len);
2846             break;
2847         }
2848         gdb_monitor_output(gdbserver_state, p, max_sz);
2849         p += max_sz;
2850         len -= max_sz;
2851     }
2852     return len;
2853 }
2854
2855 #ifndef _WIN32
2856 static void gdb_sigterm_handler(int signal)
2857 {
2858     if (runstate_is_running()) {
2859         vm_stop(RUN_STATE_PAUSED);
2860     }
2861 }
2862 #endif
2863
2864 int gdbserver_start(const char *device)
2865 {
2866     GDBState *s;
2867     char gdbstub_device_name[128];
2868     CharDriverState *chr = NULL;
2869     CharDriverState *mon_chr;
2870
2871     if (!device)
2872         return -1;
2873     if (strcmp(device, "none") != 0) {
2874         if (strstart(device, "tcp:", NULL)) {
2875             /* enforce required TCP attributes */
2876             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2877                      "%s,nowait,nodelay,server", device);
2878             device = gdbstub_device_name;
2879         }
2880 #ifndef _WIN32
2881         else if (strcmp(device, "stdio") == 0) {
2882             struct sigaction act;
2883
2884             memset(&act, 0, sizeof(act));
2885             act.sa_handler = gdb_sigterm_handler;
2886             sigaction(SIGINT, &act, NULL);
2887         }
2888 #endif
2889         chr = qemu_chr_new("gdb", device, NULL);
2890         if (!chr)
2891             return -1;
2892
2893         qemu_chr_fe_claim_no_fail(chr);
2894         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2895                               gdb_chr_event, NULL);
2896     }
2897
2898     s = gdbserver_state;
2899     if (!s) {
2900         s = g_malloc0(sizeof(GDBState));
2901         gdbserver_state = s;
2902
2903         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2904
2905         /* Initialize a monitor terminal for gdb */
2906         mon_chr = g_malloc0(sizeof(*mon_chr));
2907         mon_chr->chr_write = gdb_monitor_write;
2908         monitor_init(mon_chr, 0);
2909     } else {
2910         if (s->chr)
2911             qemu_chr_delete(s->chr);
2912         mon_chr = s->mon_chr;
2913         memset(s, 0, sizeof(GDBState));
2914     }
2915     s->c_cpu = first_cpu;
2916     s->g_cpu = first_cpu;
2917     s->chr = chr;
2918     s->state = chr ? RS_IDLE : RS_INACTIVE;
2919     s->mon_chr = mon_chr;
2920     s->current_syscall_cb = NULL;
2921
2922     return 0;
2923 }
2924 #endif