gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "qemu-common.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "monitor.h"
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #endif
  37
  38 #define MAX_PACKET_LENGTH 4096
  39
  40 #include "qemu_socket.h"
  41 #include "kvm.h"
  42
  43
  44 enum {
  45     GDB_SIGNAL_0 = 0,
  46     GDB_SIGNAL_INT = 2,
  47     GDB_SIGNAL_TRAP = 5,
  48     GDB_SIGNAL_UNKNOWN = 143
  49 };
  50
  51 #ifdef CONFIG_USER_ONLY
  52
  53 /* Map target signal numbers to GDB protocol signal numbers and vice
  54  * versa.  For user emulation's currently supported systems, we can
  55  * assume most signals are defined.
  56  */
  57
  58 static int gdb_signal_table[] = {
  59     0,
  60     TARGET_SIGHUP,
  61     TARGET_SIGINT,
  62     TARGET_SIGQUIT,
  63     TARGET_SIGILL,
  64     TARGET_SIGTRAP,
  65     TARGET_SIGABRT,
  66     -1, /* SIGEMT */
  67     TARGET_SIGFPE,
  68     TARGET_SIGKILL,
  69     TARGET_SIGBUS,
  70     TARGET_SIGSEGV,
  71     TARGET_SIGSYS,
  72     TARGET_SIGPIPE,
  73     TARGET_SIGALRM,
  74     TARGET_SIGTERM,
  75     TARGET_SIGURG,
  76     TARGET_SIGSTOP,
  77     TARGET_SIGTSTP,
  78     TARGET_SIGCONT,
  79     TARGET_SIGCHLD,
  80     TARGET_SIGTTIN,
  81     TARGET_SIGTTOU,
  82     TARGET_SIGIO,
  83     TARGET_SIGXCPU,
  84     TARGET_SIGXFSZ,
  85     TARGET_SIGVTALRM,
  86     TARGET_SIGPROF,
  87     TARGET_SIGWINCH,
  88     -1, /* SIGLOST */
  89     TARGET_SIGUSR1,
  90     TARGET_SIGUSR2,
  91 #ifdef TARGET_SIGPWR
  92     TARGET_SIGPWR,
  93 #else
  94     -1,
  95 #endif
  96     -1, /* SIGPOLL */
  97     -1,
  98     -1,
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108 #ifdef __SIGRTMIN
 109     __SIGRTMIN + 1,
 110     __SIGRTMIN + 2,
 111     __SIGRTMIN + 3,
 112     __SIGRTMIN + 4,
 113     __SIGRTMIN + 5,
 114     __SIGRTMIN + 6,
 115     __SIGRTMIN + 7,
 116     __SIGRTMIN + 8,
 117     __SIGRTMIN + 9,
 118     __SIGRTMIN + 10,
 119     __SIGRTMIN + 11,
 120     __SIGRTMIN + 12,
 121     __SIGRTMIN + 13,
 122     __SIGRTMIN + 14,
 123     __SIGRTMIN + 15,
 124     __SIGRTMIN + 16,
 125     __SIGRTMIN + 17,
 126     __SIGRTMIN + 18,
 127     __SIGRTMIN + 19,
 128     __SIGRTMIN + 20,
 129     __SIGRTMIN + 21,
 130     __SIGRTMIN + 22,
 131     __SIGRTMIN + 23,
 132     __SIGRTMIN + 24,
 133     __SIGRTMIN + 25,
 134     __SIGRTMIN + 26,
 135     __SIGRTMIN + 27,
 136     __SIGRTMIN + 28,
 137     __SIGRTMIN + 29,
 138     __SIGRTMIN + 30,
 139     __SIGRTMIN + 31,
 140     -1, /* SIGCANCEL */
 141     __SIGRTMIN,
 142     __SIGRTMIN + 32,
 143     __SIGRTMIN + 33,
 144     __SIGRTMIN + 34,
 145     __SIGRTMIN + 35,
 146     __SIGRTMIN + 36,
 147     __SIGRTMIN + 37,
 148     __SIGRTMIN + 38,
 149     __SIGRTMIN + 39,
 150     __SIGRTMIN + 40,
 151     __SIGRTMIN + 41,
 152     __SIGRTMIN + 42,
 153     __SIGRTMIN + 43,
 154     __SIGRTMIN + 44,
 155     __SIGRTMIN + 45,
 156     __SIGRTMIN + 46,
 157     __SIGRTMIN + 47,
 158     __SIGRTMIN + 48,
 159     __SIGRTMIN + 49,
 160     __SIGRTMIN + 50,
 161     __SIGRTMIN + 51,
 162     __SIGRTMIN + 52,
 163     __SIGRTMIN + 53,
 164     __SIGRTMIN + 54,
 165     __SIGRTMIN + 55,
 166     __SIGRTMIN + 56,
 167     __SIGRTMIN + 57,
 168     __SIGRTMIN + 58,
 169     __SIGRTMIN + 59,
 170     __SIGRTMIN + 60,
 171     __SIGRTMIN + 61,
 172     __SIGRTMIN + 62,
 173     __SIGRTMIN + 63,
 174     __SIGRTMIN + 64,
 175     __SIGRTMIN + 65,
 176     __SIGRTMIN + 66,
 177     __SIGRTMIN + 67,
 178     __SIGRTMIN + 68,
 179     __SIGRTMIN + 69,
 180     __SIGRTMIN + 70,
 181     __SIGRTMIN + 71,
 182     __SIGRTMIN + 72,
 183     __SIGRTMIN + 73,
 184     __SIGRTMIN + 74,
 185     __SIGRTMIN + 75,
 186     __SIGRTMIN + 76,
 187     __SIGRTMIN + 77,
 188     __SIGRTMIN + 78,
 189     __SIGRTMIN + 79,
 190     __SIGRTMIN + 80,
 191     __SIGRTMIN + 81,
 192     __SIGRTMIN + 82,
 193     __SIGRTMIN + 83,
 194     __SIGRTMIN + 84,
 195     __SIGRTMIN + 85,
 196     __SIGRTMIN + 86,
 197     __SIGRTMIN + 87,
 198     __SIGRTMIN + 88,
 199     __SIGRTMIN + 89,
 200     __SIGRTMIN + 90,
 201     __SIGRTMIN + 91,
 202     __SIGRTMIN + 92,
 203     __SIGRTMIN + 93,
 204     __SIGRTMIN + 94,
 205     __SIGRTMIN + 95,
 206     -1, /* SIGINFO */
 207     -1, /* UNKNOWN */
 208     -1, /* DEFAULT */
 209     -1,
 210     -1,
 211     -1,
 212     -1,
 213     -1,
 214     -1
 215 #endif
 216 };
 217 #else
 218 /* In system mode we only need SIGINT and SIGTRAP; other signals
 219    are not yet supported.  */
 220
 221 enum {
 222     TARGET_SIGINT = 2,
 223     TARGET_SIGTRAP = 5
 224 };
 225
 226 static int gdb_signal_table[] = {
 227     -1,
 228     -1,
 229     TARGET_SIGINT,
 230     -1,
 231     -1,
 232     TARGET_SIGTRAP
 233 };
 234 #endif
 235
 236 #ifdef CONFIG_USER_ONLY
 237 static int target_signal_to_gdb (int sig)
 238 {
 239     int i;
 240     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 241         if (gdb_signal_table[i] == sig)
 242             return i;
 243     return GDB_SIGNAL_UNKNOWN;
 244 }
 245 #endif
 246
 247 static int gdb_signal_to_target (int sig)
 248 {
 249     if (sig < ARRAY_SIZE (gdb_signal_table))
 250         return gdb_signal_table[sig];
 251     else
 252         return -1;
 253 }
 254
 255 //#define DEBUG_GDB
 256
 257 typedef struct GDBRegisterState {
 258     int base_reg;
 259     int num_regs;
 260     gdb_reg_cb get_reg;
 261     gdb_reg_cb set_reg;
 262     const char *xml;
 263     struct GDBRegisterState *next;
 264 } GDBRegisterState;
 265
 266 enum RSState {
 267     RS_INACTIVE,
 268     RS_IDLE,
 269     RS_GETLINE,
 270     RS_CHKSUM1,
 271     RS_CHKSUM2,
 272     RS_SYSCALL,
 273 };
 274 typedef struct GDBState {
 275     CPUState *c_cpu; /* current CPU for step/continue ops */
 276     CPUState *g_cpu; /* current CPU for other ops */
 277     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 278     enum RSState state; /* parsing state */
 279     char line_buf[MAX_PACKET_LENGTH];
 280     int line_buf_index;
 281     int line_csum;
 282     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 283     int last_packet_len;
 284     int signal;
 285 #ifdef CONFIG_USER_ONLY
 286     int fd;
 287     int running_state;
 288 #else
 289     CharDriverState *chr;
 290     CharDriverState *mon_chr;
 291 #endif
 292 } GDBState;
 293
 294 /* By default use no IRQs and no timers while single stepping so as to
 295  * make single stepping like an ICE HW step.
 296  */
 297 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 298
 299 static GDBState *gdbserver_state;
 300
 301 /* This is an ugly hack to cope with both new and old gdb.
 302    If gdb sends qXfer:features:read then assume we're talking to a newish
 303    gdb that understands target descriptions.  */
 304 static int gdb_has_xml;
 305
 306 #ifdef CONFIG_USER_ONLY
 307 /* XXX: This is not thread safe.  Do we care?  */
 308 static int gdbserver_fd = -1;
 309
 310 static int get_char(GDBState *s)
 311 {
 312     uint8_t ch;
 313     int ret;
 314
 315     for(;;) {
 316         ret = recv(s->fd, &ch, 1, 0);
 317         if (ret < 0) {
 318             if (errno == ECONNRESET)
 319                 s->fd = -1;
 320             if (errno != EINTR && errno != EAGAIN)
 321                 return -1;
 322         } else if (ret == 0) {
 323             close(s->fd);
 324             s->fd = -1;
 325             return -1;
 326         } else {
 327             break;
 328         }
 329     }
 330     return ch;
 331 }
 332 #endif
 333
 334 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 335
 336 static enum {
 337     GDB_SYS_UNKNOWN,
 338     GDB_SYS_ENABLED,
 339     GDB_SYS_DISABLED,
 340 } gdb_syscall_mode;
 341
 342 /* If gdb is connected when the first semihosting syscall occurs then use
 343    remote gdb syscalls.  Otherwise use native file IO.  */
 344 int use_gdb_syscalls(void)
 345 {
 346     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 347         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 348                                             : GDB_SYS_DISABLED);
 349     }
 350     return gdb_syscall_mode == GDB_SYS_ENABLED;
 351 }
 352
 353 /* Resume execution.  */
 354 static inline void gdb_continue(GDBState *s)
 355 {
 356 #ifdef CONFIG_USER_ONLY
 357     s->running_state = 1;
 358 #else
 359     vm_start();
 360 #endif
 361 }
 362
 363 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 364 {
 365 #ifdef CONFIG_USER_ONLY
 366     int ret;
 367
 368     while (len > 0) {
 369         ret = send(s->fd, buf, len, 0);
 370         if (ret < 0) {
 371             if (errno != EINTR && errno != EAGAIN)
 372                 return;
 373         } else {
 374             buf += ret;
 375             len -= ret;
 376         }
 377     }
 378 #else
 379     qemu_chr_write(s->chr, buf, len);
 380 #endif
 381 }
 382
 383 static inline int fromhex(int v)
 384 {
 385     if (v >= '0' && v <= '9')
 386         return v - '0';
 387     else if (v >= 'A' && v <= 'F')
 388         return v - 'A' + 10;
 389     else if (v >= 'a' && v <= 'f')
 390         return v - 'a' + 10;
 391     else
 392         return 0;
 393 }
 394
 395 static inline int tohex(int v)
 396 {
 397     if (v < 10)
 398         return v + '0';
 399     else
 400         return v - 10 + 'a';
 401 }
 402
 403 static void memtohex(char *buf, const uint8_t *mem, int len)
 404 {
 405     int i, c;
 406     char *q;
 407     q = buf;
 408     for(i = 0; i < len; i++) {
 409         c = mem[i];
 410         *q++ = tohex(c >> 4);
 411         *q++ = tohex(c & 0xf);
 412     }
 413     *q = '\0';
 414 }
 415
 416 static void hextomem(uint8_t *mem, const char *buf, int len)
 417 {
 418     int i;
 419
 420     for(i = 0; i < len; i++) {
 421         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 422         buf += 2;
 423     }
 424 }
 425
 426 /* return -1 if error, 0 if OK */
 427 static int put_packet_binary(GDBState *s, const char *buf, int len)
 428 {
 429     int csum, i;
 430     uint8_t *p;
 431
 432     for(;;) {
 433         p = s->last_packet;
 434         *(p++) = '$';
 435         memcpy(p, buf, len);
 436         p += len;
 437         csum = 0;
 438         for(i = 0; i < len; i++) {
 439             csum += buf[i];
 440         }
 441         *(p++) = '#';
 442         *(p++) = tohex((csum >> 4) & 0xf);
 443         *(p++) = tohex((csum) & 0xf);
 444
 445         s->last_packet_len = p - s->last_packet;
 446         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 447
 448 #ifdef CONFIG_USER_ONLY
 449         i = get_char(s);
 450         if (i < 0)
 451             return -1;
 452         if (i == '+')
 453             break;
 454 #else
 455         break;
 456 #endif
 457     }
 458     return 0;
 459 }
 460
 461 /* return -1 if error, 0 if OK */
 462 static int put_packet(GDBState *s, const char *buf)
 463 {
 464 #ifdef DEBUG_GDB
 465     printf("reply='%s'\n", buf);
 466 #endif
 467
 468     return put_packet_binary(s, buf, strlen(buf));
 469 }
 470
 471 /* The GDB remote protocol transfers values in target byte order.  This means
 472    we can use the raw memory access routines to access the value buffer.
 473    Conveniently, these also handle the case where the buffer is mis-aligned.
 474  */
 475 #define GET_REG8(val) do { \
 476     stb_p(mem_buf, val); \
 477     return 1; \
 478     } while(0)
 479 #define GET_REG16(val) do { \
 480     stw_p(mem_buf, val); \
 481     return 2; \
 482     } while(0)
 483 #define GET_REG32(val) do { \
 484     stl_p(mem_buf, val); \
 485     return 4; \
 486     } while(0)
 487 #define GET_REG64(val) do { \
 488     stq_p(mem_buf, val); \
 489     return 8; \
 490     } while(0)
 491
 492 #if TARGET_LONG_BITS == 64
 493 #define GET_REGL(val) GET_REG64(val)
 494 #define ldtul_p(addr) ldq_p(addr)
 495 #else
 496 #define GET_REGL(val) GET_REG32(val)
 497 #define ldtul_p(addr) ldl_p(addr)
 498 #endif
 499
 500 #if defined(TARGET_I386)
 501
 502 #ifdef TARGET_X86_64
 503 static const int gpr_map[16] = {
 504     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 505     8, 9, 10, 11, 12, 13, 14, 15
 506 };
 507 #else
 508 #define gpr_map gpr_map32
 509 #endif
 510 static const int gpr_map32[8] = { 0, 1, 2, 3, 4, 5, 6, 7 };
 511
 512 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 513
 514 #define IDX_IP_REG      CPU_NB_REGS
 515 #define IDX_FLAGS_REG   (IDX_IP_REG + 1)
 516 #define IDX_SEG_REGS    (IDX_FLAGS_REG + 1)
 517 #define IDX_FP_REGS     (IDX_SEG_REGS + 6)
 518 #define IDX_XMM_REGS    (IDX_FP_REGS + 16)
 519 #define IDX_MXCSR_REG   (IDX_XMM_REGS + CPU_NB_REGS)
 520
 521 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 522 {
 523     if (n < CPU_NB_REGS) {
 524         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 525             GET_REG64(env->regs[gpr_map[n]]);
 526         } else if (n < CPU_NB_REGS32) {
 527             GET_REG32(env->regs[gpr_map32[n]]);
 528         }
 529     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 530 #ifdef USE_X86LDOUBLE
 531         /* FIXME: byteswap float values - after fixing fpregs layout. */
 532         memcpy(mem_buf, &env->fpregs[n - IDX_FP_REGS], 10);
 533 #else
 534         memset(mem_buf, 0, 10);
 535 #endif
 536         return 10;
 537     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 538         n -= IDX_XMM_REGS;
 539         if (n < CPU_NB_REGS32 ||
 540             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 541             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 542             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 543             return 16;
 544         }
 545     } else {
 546         switch (n) {
 547         case IDX_IP_REG:
 548             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 549                 GET_REG64(env->eip);
 550             } else {
 551                 GET_REG32(env->eip);
 552             }
 553         case IDX_FLAGS_REG: GET_REG32(env->eflags);
 554
 555         case IDX_SEG_REGS:     GET_REG32(env->segs[R_CS].selector);
 556         case IDX_SEG_REGS + 1: GET_REG32(env->segs[R_SS].selector);
 557         case IDX_SEG_REGS + 2: GET_REG32(env->segs[R_DS].selector);
 558         case IDX_SEG_REGS + 3: GET_REG32(env->segs[R_ES].selector);
 559         case IDX_SEG_REGS + 4: GET_REG32(env->segs[R_FS].selector);
 560         case IDX_SEG_REGS + 5: GET_REG32(env->segs[R_GS].selector);
 561
 562         case IDX_FP_REGS + 8:  GET_REG32(env->fpuc);
 563         case IDX_FP_REGS + 9:  GET_REG32((env->fpus & ~0x3800) |
 564                                          (env->fpstt & 0x7) << 11);
 565         case IDX_FP_REGS + 10: GET_REG32(0); /* ftag */
 566         case IDX_FP_REGS + 11: GET_REG32(0); /* fiseg */
 567         case IDX_FP_REGS + 12: GET_REG32(0); /* fioff */
 568         case IDX_FP_REGS + 13: GET_REG32(0); /* foseg */
 569         case IDX_FP_REGS + 14: GET_REG32(0); /* fooff */
 570         case IDX_FP_REGS + 15: GET_REG32(0); /* fop */
 571
 572         case IDX_MXCSR_REG: GET_REG32(env->mxcsr);
 573         }
 574     }
 575     return 0;
 576 }
 577
 578 static int cpu_x86_gdb_load_seg(CPUState *env, int sreg, uint8_t *mem_buf)
 579 {
 580     uint16_t selector = ldl_p(mem_buf);
 581
 582     if (selector != env->segs[sreg].selector) {
 583 #if defined(CONFIG_USER_ONLY)
 584         cpu_x86_load_seg(env, sreg, selector);
 585 #else
 586         unsigned int limit, flags;
 587         target_ulong base;
 588
 589         if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK)) {
 590             base = selector << 4;
 591             limit = 0xffff;
 592             flags = 0;
 593         } else {
 594             if (!cpu_x86_get_descr_debug(env, selector, &base, &limit, &flags))
 595                 return 4;
 596         }
 597         cpu_x86_load_seg_cache(env, sreg, selector, base, limit, flags);
 598 #endif
 599     }
 600     return 4;
 601 }
 602
 603 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 604 {
 605     uint32_t tmp;
 606
 607     if (n < CPU_NB_REGS) {
 608         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 609             env->regs[gpr_map[n]] = ldtul_p(mem_buf);
 610             return sizeof(target_ulong);
 611         } else if (n < CPU_NB_REGS32) {
 612             n = gpr_map32[n];
 613             env->regs[n] &= ~0xffffffffUL;
 614             env->regs[n] |= (uint32_t)ldl_p(mem_buf);
 615             return 4;
 616         }
 617     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 618 #ifdef USE_X86LDOUBLE
 619         /* FIXME: byteswap float values - after fixing fpregs layout. */
 620         memcpy(&env->fpregs[n - IDX_FP_REGS], mem_buf, 10);
 621 #endif
 622         return 10;
 623     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 624         n -= IDX_XMM_REGS;
 625         if (n < CPU_NB_REGS32 ||
 626             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 627             env->xmm_regs[n].XMM_Q(0) = ldq_p(mem_buf);
 628             env->xmm_regs[n].XMM_Q(1) = ldq_p(mem_buf + 8);
 629             return 16;
 630         }
 631     } else {
 632         switch (n) {
 633         case IDX_IP_REG:
 634             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 635                 env->eip = ldq_p(mem_buf);
 636                 return 8;
 637             } else {
 638                 env->eip &= ~0xffffffffUL;
 639                 env->eip |= (uint32_t)ldl_p(mem_buf);
 640                 return 4;
 641             }
 642         case IDX_FLAGS_REG:
 643             env->eflags = ldl_p(mem_buf);
 644             return 4;
 645
 646         case IDX_SEG_REGS:     return cpu_x86_gdb_load_seg(env, R_CS, mem_buf);
 647         case IDX_SEG_REGS + 1: return cpu_x86_gdb_load_seg(env, R_SS, mem_buf);
 648         case IDX_SEG_REGS + 2: return cpu_x86_gdb_load_seg(env, R_DS, mem_buf);
 649         case IDX_SEG_REGS + 3: return cpu_x86_gdb_load_seg(env, R_ES, mem_buf);
 650         case IDX_SEG_REGS + 4: return cpu_x86_gdb_load_seg(env, R_FS, mem_buf);
 651         case IDX_SEG_REGS + 5: return cpu_x86_gdb_load_seg(env, R_GS, mem_buf);
 652
 653         case IDX_FP_REGS + 8:
 654             env->fpuc = ldl_p(mem_buf);
 655             return 4;
 656         case IDX_FP_REGS + 9:
 657             tmp = ldl_p(mem_buf);
 658             env->fpstt = (tmp >> 11) & 7;
 659             env->fpus = tmp & ~0x3800;
 660             return 4;
 661         case IDX_FP_REGS + 10: /* ftag */  return 4;
 662         case IDX_FP_REGS + 11: /* fiseg */ return 4;
 663         case IDX_FP_REGS + 12: /* fioff */ return 4;
 664         case IDX_FP_REGS + 13: /* foseg */ return 4;
 665         case IDX_FP_REGS + 14: /* fooff */ return 4;
 666         case IDX_FP_REGS + 15: /* fop */   return 4;
 667
 668         case IDX_MXCSR_REG:
 669             env->mxcsr = ldl_p(mem_buf);
 670             return 4;
 671         }
 672     }
 673     /* Unrecognised register.  */
 674     return 0;
 675 }
 676
 677 #elif defined (TARGET_PPC)
 678
 679 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 680    expects whatever the target description contains.  Due to a
 681    historical mishap the FP registers appear in between core integer
 682    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 683    FP regs zero size when talking to a newer gdb.  */
 684 #define NUM_CORE_REGS 71
 685 #if defined (TARGET_PPC64)
 686 #define GDB_CORE_XML "power64-core.xml"
 687 #else
 688 #define GDB_CORE_XML "power-core.xml"
 689 #endif
 690
 691 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 692 {
 693     if (n < 32) {
 694         /* gprs */
 695         GET_REGL(env->gpr[n]);
 696     } else if (n < 64) {
 697         /* fprs */
 698         if (gdb_has_xml)
 699             return 0;
 700         stfq_p(mem_buf, env->fpr[n-32]);
 701         return 8;
 702     } else {
 703         switch (n) {
 704         case 64: GET_REGL(env->nip);
 705         case 65: GET_REGL(env->msr);
 706         case 66:
 707             {
 708                 uint32_t cr = 0;
 709                 int i;
 710                 for (i = 0; i < 8; i++)
 711                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 712                 GET_REG32(cr);
 713             }
 714         case 67: GET_REGL(env->lr);
 715         case 68: GET_REGL(env->ctr);
 716         case 69: GET_REGL(env->xer);
 717         case 70:
 718             {
 719                 if (gdb_has_xml)
 720                     return 0;
 721                 GET_REG32(0); /* fpscr */
 722             }
 723         }
 724     }
 725     return 0;
 726 }
 727
 728 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 729 {
 730     if (n < 32) {
 731         /* gprs */
 732         env->gpr[n] = ldtul_p(mem_buf);
 733         return sizeof(target_ulong);
 734     } else if (n < 64) {
 735         /* fprs */
 736         if (gdb_has_xml)
 737             return 0;
 738         env->fpr[n-32] = ldfq_p(mem_buf);
 739         return 8;
 740     } else {
 741         switch (n) {
 742         case 64:
 743             env->nip = ldtul_p(mem_buf);
 744             return sizeof(target_ulong);
 745         case 65:
 746             ppc_store_msr(env, ldtul_p(mem_buf));
 747             return sizeof(target_ulong);
 748         case 66:
 749             {
 750                 uint32_t cr = ldl_p(mem_buf);
 751                 int i;
 752                 for (i = 0; i < 8; i++)
 753                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 754                 return 4;
 755             }
 756         case 67:
 757             env->lr = ldtul_p(mem_buf);
 758             return sizeof(target_ulong);
 759         case 68:
 760             env->ctr = ldtul_p(mem_buf);
 761             return sizeof(target_ulong);
 762         case 69:
 763             env->xer = ldtul_p(mem_buf);
 764             return sizeof(target_ulong);
 765         case 70:
 766             /* fpscr */
 767             if (gdb_has_xml)
 768                 return 0;
 769             return 4;
 770         }
 771     }
 772     return 0;
 773 }
 774
 775 #elif defined (TARGET_SPARC)
 776
 777 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 778 #define NUM_CORE_REGS 86
 779 #else
 780 #define NUM_CORE_REGS 72
 781 #endif
 782
 783 #ifdef TARGET_ABI32
 784 #define GET_REGA(val) GET_REG32(val)
 785 #else
 786 #define GET_REGA(val) GET_REGL(val)
 787 #endif
 788
 789 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 790 {
 791     if (n < 8) {
 792         /* g0..g7 */
 793         GET_REGA(env->gregs[n]);
 794     }
 795     if (n < 32) {
 796         /* register window */
 797         GET_REGA(env->regwptr[n - 8]);
 798     }
 799 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 800     if (n < 64) {
 801         /* fprs */
 802         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 803     }
 804     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 805     switch (n) {
 806     case 64: GET_REGA(env->y);
 807     case 65: GET_REGA(GET_PSR(env));
 808     case 66: GET_REGA(env->wim);
 809     case 67: GET_REGA(env->tbr);
 810     case 68: GET_REGA(env->pc);
 811     case 69: GET_REGA(env->npc);
 812     case 70: GET_REGA(env->fsr);
 813     case 71: GET_REGA(0); /* csr */
 814     default: GET_REGA(0);
 815     }
 816 #else
 817     if (n < 64) {
 818         /* f0-f31 */
 819         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 820     }
 821     if (n < 80) {
 822         /* f32-f62 (double width, even numbers only) */
 823         uint64_t val;
 824
 825         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 826         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 827         GET_REG64(val);
 828     }
 829     switch (n) {
 830     case 80: GET_REGL(env->pc);
 831     case 81: GET_REGL(env->npc);
 832     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 833                            ((env->asi & 0xff) << 24) |
 834                            ((env->pstate & 0xfff) << 8) |
 835                            GET_CWP64(env));
 836     case 83: GET_REGL(env->fsr);
 837     case 84: GET_REGL(env->fprs);
 838     case 85: GET_REGL(env->y);
 839     }
 840 #endif
 841     return 0;
 842 }
 843
 844 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 845 {
 846 #if defined(TARGET_ABI32)
 847     abi_ulong tmp;
 848
 849     tmp = ldl_p(mem_buf);
 850 #else
 851     target_ulong tmp;
 852
 853     tmp = ldtul_p(mem_buf);
 854 #endif
 855
 856     if (n < 8) {
 857         /* g0..g7 */
 858         env->gregs[n] = tmp;
 859     } else if (n < 32) {
 860         /* register window */
 861         env->regwptr[n - 8] = tmp;
 862     }
 863 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 864     else if (n < 64) {
 865         /* fprs */
 866         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 867     } else {
 868         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 869         switch (n) {
 870         case 64: env->y = tmp; break;
 871         case 65: PUT_PSR(env, tmp); break;
 872         case 66: env->wim = tmp; break;
 873         case 67: env->tbr = tmp; break;
 874         case 68: env->pc = tmp; break;
 875         case 69: env->npc = tmp; break;
 876         case 70: env->fsr = tmp; break;
 877         default: return 0;
 878         }
 879     }
 880     return 4;
 881 #else
 882     else if (n < 64) {
 883         /* f0-f31 */
 884         env->fpr[n] = ldfl_p(mem_buf);
 885         return 4;
 886     } else if (n < 80) {
 887         /* f32-f62 (double width, even numbers only) */
 888         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 889         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 890     } else {
 891         switch (n) {
 892         case 80: env->pc = tmp; break;
 893         case 81: env->npc = tmp; break;
 894         case 82:
 895             PUT_CCR(env, tmp >> 32);
 896             env->asi = (tmp >> 24) & 0xff;
 897             env->pstate = (tmp >> 8) & 0xfff;
 898             PUT_CWP64(env, tmp & 0xff);
 899             break;
 900         case 83: env->fsr = tmp; break;
 901         case 84: env->fprs = tmp; break;
 902         case 85: env->y = tmp; break;
 903         default: return 0;
 904         }
 905     }
 906     return 8;
 907 #endif
 908 }
 909 #elif defined (TARGET_ARM)
 910
 911 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 912    whatever the target description contains.  Due to a historical mishap
 913    the FPA registers appear in between core integer regs and the CPSR.
 914    We hack round this by giving the FPA regs zero size when talking to a
 915    newer gdb.  */
 916 #define NUM_CORE_REGS 26
 917 #define GDB_CORE_XML "arm-core.xml"
 918
 919 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 920 {
 921     if (n < 16) {
 922         /* Core integer register.  */
 923         GET_REG32(env->regs[n]);
 924     }
 925     if (n < 24) {
 926         /* FPA registers.  */
 927         if (gdb_has_xml)
 928             return 0;
 929         memset(mem_buf, 0, 12);
 930         return 12;
 931     }
 932     switch (n) {
 933     case 24:
 934         /* FPA status register.  */
 935         if (gdb_has_xml)
 936             return 0;
 937         GET_REG32(0);
 938     case 25:
 939         /* CPSR */
 940         GET_REG32(cpsr_read(env));
 941     }
 942     /* Unknown register.  */
 943     return 0;
 944 }
 945
 946 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 947 {
 948     uint32_t tmp;
 949
 950     tmp = ldl_p(mem_buf);
 951
 952     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 953        cause problems if we ever implement the Jazelle DBX extensions.  */
 954     if (n == 15)
 955         tmp &= ~1;
 956
 957     if (n < 16) {
 958         /* Core integer register.  */
 959         env->regs[n] = tmp;
 960         return 4;
 961     }
 962     if (n < 24) { /* 16-23 */
 963         /* FPA registers (ignored).  */
 964         if (gdb_has_xml)
 965             return 0;
 966         return 12;
 967     }
 968     switch (n) {
 969     case 24:
 970         /* FPA status register (ignored).  */
 971         if (gdb_has_xml)
 972             return 0;
 973         return 4;
 974     case 25:
 975         /* CPSR */
 976         cpsr_write (env, tmp, 0xffffffff);
 977         return 4;
 978     }
 979     /* Unknown register.  */
 980     return 0;
 981 }
 982
 983 #elif defined (TARGET_M68K)
 984
 985 #define NUM_CORE_REGS 18
 986
 987 #define GDB_CORE_XML "cf-core.xml"
 988
 989 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 990 {
 991     if (n < 8) {
 992         /* D0-D7 */
 993         GET_REG32(env->dregs[n]);
 994     } else if (n < 16) {
 995         /* A0-A7 */
 996         GET_REG32(env->aregs[n - 8]);
 997     } else {
 998         switch (n) {
 999         case 16: GET_REG32(env->sr);
1000         case 17: GET_REG32(env->pc);
1001         }
1002     }
1003     /* FP registers not included here because they vary between
1004        ColdFire and m68k.  Use XML bits for these.  */
1005     return 0;
1006 }
1007
1008 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1009 {
1010     uint32_t tmp;
1011
1012     tmp = ldl_p(mem_buf);
1013
1014     if (n < 8) {
1015         /* D0-D7 */
1016         env->dregs[n] = tmp;
1017     } else if (n < 16) {
1018         /* A0-A7 */
1019         env->aregs[n - 8] = tmp;
1020     } else {
1021         switch (n) {
1022         case 16: env->sr = tmp; break;
1023         case 17: env->pc = tmp; break;
1024         default: return 0;
1025         }
1026     }
1027     return 4;
1028 }
1029 #elif defined (TARGET_MIPS)
1030
1031 #define NUM_CORE_REGS 73
1032
1033 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1034 {
1035     if (n < 32) {
1036         GET_REGL(env->active_tc.gpr[n]);
1037     }
1038     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
1039         if (n >= 38 && n < 70) {
1040             if (env->CP0_Status & (1 << CP0St_FR))
1041                 GET_REGL(env->active_fpu.fpr[n - 38].d);
1042             else
1043                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
1044         }
1045         switch (n) {
1046         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
1047         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
1048         }
1049     }
1050     switch (n) {
1051     case 32: GET_REGL((int32_t)env->CP0_Status);
1052     case 33: GET_REGL(env->active_tc.LO[0]);
1053     case 34: GET_REGL(env->active_tc.HI[0]);
1054     case 35: GET_REGL(env->CP0_BadVAddr);
1055     case 36: GET_REGL((int32_t)env->CP0_Cause);
1056     case 37: GET_REGL(env->active_tc.PC | !!(env->hflags & MIPS_HFLAG_M16));
1057     case 72: GET_REGL(0); /* fp */
1058     case 89: GET_REGL((int32_t)env->CP0_PRid);
1059     }
1060     if (n >= 73 && n <= 88) {
1061         /* 16 embedded regs.  */
1062         GET_REGL(0);
1063     }
1064
1065     return 0;
1066 }
1067
1068 /* convert MIPS rounding mode in FCR31 to IEEE library */
1069 static unsigned int ieee_rm[] =
1070   {
1071     float_round_nearest_even,
1072     float_round_to_zero,
1073     float_round_up,
1074     float_round_down
1075   };
1076 #define RESTORE_ROUNDING_MODE \
1077     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1078
1079 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1080 {
1081     target_ulong tmp;
1082
1083     tmp = ldtul_p(mem_buf);
1084
1085     if (n < 32) {
1086         env->active_tc.gpr[n] = tmp;
1087         return sizeof(target_ulong);
1088     }
1089     if (env->CP0_Config1 & (1 << CP0C1_FP)
1090             && n >= 38 && n < 73) {
1091         if (n < 70) {
1092             if (env->CP0_Status & (1 << CP0St_FR))
1093               env->active_fpu.fpr[n - 38].d = tmp;
1094             else
1095               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1096         }
1097         switch (n) {
1098         case 70:
1099             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1100             /* set rounding mode */
1101             RESTORE_ROUNDING_MODE;
1102 #ifndef CONFIG_SOFTFLOAT
1103             /* no floating point exception for native float */
1104             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1105 #endif
1106             break;
1107         case 71: env->active_fpu.fcr0 = tmp; break;
1108         }
1109         return sizeof(target_ulong);
1110     }
1111     switch (n) {
1112     case 32: env->CP0_Status = tmp; break;
1113     case 33: env->active_tc.LO[0] = tmp; break;
1114     case 34: env->active_tc.HI[0] = tmp; break;
1115     case 35: env->CP0_BadVAddr = tmp; break;
1116     case 36: env->CP0_Cause = tmp; break;
1117     case 37:
1118         env->active_tc.PC = tmp & ~(target_ulong)1;
1119         if (tmp & 1) {
1120             env->hflags |= MIPS_HFLAG_M16;
1121         } else {
1122             env->hflags &= ~(MIPS_HFLAG_M16);
1123         }
1124         break;
1125     case 72: /* fp, ignored */ break;
1126     default:
1127         if (n > 89)
1128             return 0;
1129         /* Other registers are readonly.  Ignore writes.  */
1130         break;
1131     }
1132
1133     return sizeof(target_ulong);
1134 }
1135 #elif defined (TARGET_SH4)
1136
1137 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1138 /* FIXME: We should use XML for this.  */
1139
1140 #define NUM_CORE_REGS 59
1141
1142 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1143 {
1144     if (n < 8) {
1145         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1146             GET_REGL(env->gregs[n + 16]);
1147         } else {
1148             GET_REGL(env->gregs[n]);
1149         }
1150     } else if (n < 16) {
1151         GET_REGL(env->gregs[n - 8]);
1152     } else if (n >= 25 && n < 41) {
1153         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1154     } else if (n >= 43 && n < 51) {
1155         GET_REGL(env->gregs[n - 43]);
1156     } else if (n >= 51 && n < 59) {
1157         GET_REGL(env->gregs[n - (51 - 16)]);
1158     }
1159     switch (n) {
1160     case 16: GET_REGL(env->pc);
1161     case 17: GET_REGL(env->pr);
1162     case 18: GET_REGL(env->gbr);
1163     case 19: GET_REGL(env->vbr);
1164     case 20: GET_REGL(env->mach);
1165     case 21: GET_REGL(env->macl);
1166     case 22: GET_REGL(env->sr);
1167     case 23: GET_REGL(env->fpul);
1168     case 24: GET_REGL(env->fpscr);
1169     case 41: GET_REGL(env->ssr);
1170     case 42: GET_REGL(env->spc);
1171     }
1172
1173     return 0;
1174 }
1175
1176 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1177 {
1178     uint32_t tmp;
1179
1180     tmp = ldl_p(mem_buf);
1181
1182     if (n < 8) {
1183         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1184             env->gregs[n + 16] = tmp;
1185         } else {
1186             env->gregs[n] = tmp;
1187         }
1188         return 4;
1189     } else if (n < 16) {
1190         env->gregs[n - 8] = tmp;
1191         return 4;
1192     } else if (n >= 25 && n < 41) {
1193         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1194     } else if (n >= 43 && n < 51) {
1195         env->gregs[n - 43] = tmp;
1196         return 4;
1197     } else if (n >= 51 && n < 59) {
1198         env->gregs[n - (51 - 16)] = tmp;
1199         return 4;
1200     }
1201     switch (n) {
1202     case 16: env->pc = tmp;
1203     case 17: env->pr = tmp;
1204     case 18: env->gbr = tmp;
1205     case 19: env->vbr = tmp;
1206     case 20: env->mach = tmp;
1207     case 21: env->macl = tmp;
1208     case 22: env->sr = tmp;
1209     case 23: env->fpul = tmp;
1210     case 24: env->fpscr = tmp;
1211     case 41: env->ssr = tmp;
1212     case 42: env->spc = tmp;
1213     default: return 0;
1214     }
1215
1216     return 4;
1217 }
1218 #elif defined (TARGET_MICROBLAZE)
1219
1220 #define NUM_CORE_REGS (32 + 5)
1221
1222 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1223 {
1224     if (n < 32) {
1225         GET_REG32(env->regs[n]);
1226     } else {
1227         GET_REG32(env->sregs[n - 32]);
1228     }
1229     return 0;
1230 }
1231
1232 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1233 {
1234     uint32_t tmp;
1235
1236     if (n > NUM_CORE_REGS)
1237         return 0;
1238
1239     tmp = ldl_p(mem_buf);
1240
1241     if (n < 32) {
1242         env->regs[n] = tmp;
1243     } else {
1244         env->sregs[n - 32] = tmp;
1245     }
1246     return 4;
1247 }
1248 #elif defined (TARGET_CRIS)
1249
1250 #define NUM_CORE_REGS 49
1251
1252 static int
1253 read_register_crisv10(CPUState *env, uint8_t *mem_buf, int n)
1254 {
1255     if (n < 15) {
1256         GET_REG32(env->regs[n]);
1257     }
1258
1259     if (n == 15) {
1260         GET_REG32(env->pc);
1261     }
1262
1263     if (n < 32) {
1264         switch (n) {
1265         case 16:
1266             GET_REG8(env->pregs[n - 16]);
1267             break;
1268         case 17:
1269             GET_REG8(env->pregs[n - 16]);
1270             break;
1271         case 20:
1272         case 21:
1273             GET_REG16(env->pregs[n - 16]);
1274             break;
1275         default:
1276             if (n >= 23) {
1277                 GET_REG32(env->pregs[n - 16]);
1278             }
1279             break;
1280         }
1281     }
1282     return 0;
1283 }
1284
1285 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1286 {
1287     uint8_t srs;
1288
1289     if (env->pregs[PR_VR] < 32)
1290         return read_register_crisv10(env, mem_buf, n);
1291
1292     srs = env->pregs[PR_SRS];
1293     if (n < 16) {
1294         GET_REG32(env->regs[n]);
1295     }
1296
1297     if (n >= 21 && n < 32) {
1298         GET_REG32(env->pregs[n - 16]);
1299     }
1300     if (n >= 33 && n < 49) {
1301         GET_REG32(env->sregs[srs][n - 33]);
1302     }
1303     switch (n) {
1304     case 16: GET_REG8(env->pregs[0]);
1305     case 17: GET_REG8(env->pregs[1]);
1306     case 18: GET_REG32(env->pregs[2]);
1307     case 19: GET_REG8(srs);
1308     case 20: GET_REG16(env->pregs[4]);
1309     case 32: GET_REG32(env->pc);
1310     }
1311
1312     return 0;
1313 }
1314
1315 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1316 {
1317     uint32_t tmp;
1318
1319     if (n > 49)
1320         return 0;
1321
1322     tmp = ldl_p(mem_buf);
1323
1324     if (n < 16) {
1325         env->regs[n] = tmp;
1326     }
1327
1328     if (n >= 21 && n < 32) {
1329         env->pregs[n - 16] = tmp;
1330     }
1331
1332     /* FIXME: Should support function regs be writable?  */
1333     switch (n) {
1334     case 16: return 1;
1335     case 17: return 1;
1336     case 18: env->pregs[PR_PID] = tmp; break;
1337     case 19: return 1;
1338     case 20: return 2;
1339     case 32: env->pc = tmp; break;
1340     }
1341
1342     return 4;
1343 }
1344 #elif defined (TARGET_ALPHA)
1345
1346 #define NUM_CORE_REGS 65
1347
1348 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1349 {
1350     if (n < 31) {
1351        GET_REGL(env->ir[n]);
1352     }
1353     else if (n == 31) {
1354        GET_REGL(0);
1355     }
1356     else if (n<63) {
1357        uint64_t val;
1358
1359        val = *((uint64_t *)&env->fir[n-32]);
1360        GET_REGL(val);
1361     }
1362     else if (n==63) {
1363        GET_REGL(env->fpcr);
1364     }
1365     else if (n==64) {
1366        GET_REGL(env->pc);
1367     }
1368     else {
1369        GET_REGL(0);
1370     }
1371
1372     return 0;
1373 }
1374
1375 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1376 {
1377     target_ulong tmp;
1378     tmp = ldtul_p(mem_buf);
1379
1380     if (n < 31) {
1381         env->ir[n] = tmp;
1382     }
1383
1384     if (n > 31 && n < 63) {
1385         env->fir[n - 32] = ldfl_p(mem_buf);
1386     }
1387
1388     if (n == 64 ) {
1389        env->pc=tmp;
1390     }
1391
1392     return 8;
1393 }
1394 #elif defined (TARGET_S390X)
1395
1396 #define NUM_CORE_REGS S390_NUM_TOTAL_REGS
1397
1398 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1399 {
1400     switch (n) {
1401         case S390_PSWM_REGNUM: GET_REGL(env->psw.mask); break;
1402         case S390_PSWA_REGNUM: GET_REGL(env->psw.addr); break;
1403         case S390_R0_REGNUM ... S390_R15_REGNUM:
1404             GET_REGL(env->regs[n-S390_R0_REGNUM]); break;
1405         case S390_A0_REGNUM ... S390_A15_REGNUM:
1406             GET_REG32(env->aregs[n-S390_A0_REGNUM]); break;
1407         case S390_FPC_REGNUM: GET_REG32(env->fpc); break;
1408         case S390_F0_REGNUM ... S390_F15_REGNUM:
1409             /* XXX */
1410             break;
1411         case S390_PC_REGNUM: GET_REGL(env->psw.addr); break;
1412         case S390_CC_REGNUM: GET_REG32(env->cc); break;
1413     }
1414
1415     return 0;
1416 }
1417
1418 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1419 {
1420     target_ulong tmpl;
1421     uint32_t tmp32;
1422     int r = 8;
1423     tmpl = ldtul_p(mem_buf);
1424     tmp32 = ldl_p(mem_buf);
1425
1426     switch (n) {
1427         case S390_PSWM_REGNUM: env->psw.mask = tmpl; break;
1428         case S390_PSWA_REGNUM: env->psw.addr = tmpl; break;
1429         case S390_R0_REGNUM ... S390_R15_REGNUM:
1430             env->regs[n-S390_R0_REGNUM] = tmpl; break;
1431         case S390_A0_REGNUM ... S390_A15_REGNUM:
1432             env->aregs[n-S390_A0_REGNUM] = tmp32; r=4; break;
1433         case S390_FPC_REGNUM: env->fpc = tmp32; r=4; break;
1434         case S390_F0_REGNUM ... S390_F15_REGNUM:
1435             /* XXX */
1436             break;
1437         case S390_PC_REGNUM: env->psw.addr = tmpl; break;
1438         case S390_CC_REGNUM: env->cc = tmp32; r=4; break;
1439     }
1440
1441     return r;
1442 }
1443 #else
1444
1445 #define NUM_CORE_REGS 0
1446
1447 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1448 {
1449     return 0;
1450 }
1451
1452 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1453 {
1454     return 0;
1455 }
1456
1457 #endif
1458
1459 static int num_g_regs = NUM_CORE_REGS;
1460
1461 #ifdef GDB_CORE_XML
1462 /* Encode data using the encoding for 'x' packets.  */
1463 static int memtox(char *buf, const char *mem, int len)
1464 {
1465     char *p = buf;
1466     char c;
1467
1468     while (len--) {
1469         c = *(mem++);
1470         switch (c) {
1471         case '#': case '$': case '*': case '}':
1472             *(p++) = '}';
1473             *(p++) = c ^ 0x20;
1474             break;
1475         default:
1476             *(p++) = c;
1477             break;
1478         }
1479     }
1480     return p - buf;
1481 }
1482
1483 static const char *get_feature_xml(const char *p, const char **newp)
1484 {
1485     extern const char *const xml_builtin[][2];
1486     size_t len;
1487     int i;
1488     const char *name;
1489     static char target_xml[1024];
1490
1491     len = 0;
1492     while (p[len] && p[len] != ':')
1493         len++;
1494     *newp = p + len;
1495
1496     name = NULL;
1497     if (strncmp(p, "target.xml", len) == 0) {
1498         /* Generate the XML description for this CPU.  */
1499         if (!target_xml[0]) {
1500             GDBRegisterState *r;
1501
1502             snprintf(target_xml, sizeof(target_xml),
1503                      "<?xml version=\"1.0\"?>"
1504                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1505                      "<target>"
1506                      "<xi:include href=\"%s\"/>",
1507                      GDB_CORE_XML);
1508
1509             for (r = first_cpu->gdb_regs; r; r = r->next) {
1510                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
1511                 pstrcat(target_xml, sizeof(target_xml), r->xml);
1512                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
1513             }
1514             pstrcat(target_xml, sizeof(target_xml), "</target>");
1515         }
1516         return target_xml;
1517     }
1518     for (i = 0; ; i++) {
1519         name = xml_builtin[i][0];
1520         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1521             break;
1522     }
1523     return name ? xml_builtin[i][1] : NULL;
1524 }
1525 #endif
1526
1527 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1528 {
1529     GDBRegisterState *r;
1530
1531     if (reg < NUM_CORE_REGS)
1532         return cpu_gdb_read_register(env, mem_buf, reg);
1533
1534     for (r = env->gdb_regs; r; r = r->next) {
1535         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1536             return r->get_reg(env, mem_buf, reg - r->base_reg);
1537         }
1538     }
1539     return 0;
1540 }
1541
1542 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1543 {
1544     GDBRegisterState *r;
1545
1546     if (reg < NUM_CORE_REGS)
1547         return cpu_gdb_write_register(env, mem_buf, reg);
1548
1549     for (r = env->gdb_regs; r; r = r->next) {
1550         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1551             return r->set_reg(env, mem_buf, reg - r->base_reg);
1552         }
1553     }
1554     return 0;
1555 }
1556
1557 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1558    specifies the first register number and these registers are included in
1559    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1560    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1561  */
1562
1563 void gdb_register_coprocessor(CPUState * env,
1564                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1565                              int num_regs, const char *xml, int g_pos)
1566 {
1567     GDBRegisterState *s;
1568     GDBRegisterState **p;
1569     static int last_reg = NUM_CORE_REGS;
1570
1571     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1572     s->base_reg = last_reg;
1573     s->num_regs = num_regs;
1574     s->get_reg = get_reg;
1575     s->set_reg = set_reg;
1576     s->xml = xml;
1577     p = &env->gdb_regs;
1578     while (*p) {
1579         /* Check for duplicates.  */
1580         if (strcmp((*p)->xml, xml) == 0)
1581             return;
1582         p = &(*p)->next;
1583     }
1584     /* Add to end of list.  */
1585     last_reg += num_regs;
1586     *p = s;
1587     if (g_pos) {
1588         if (g_pos != s->base_reg) {
1589             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1590                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1591         } else {
1592             num_g_regs = last_reg;
1593         }
1594     }
1595 }
1596
1597 #ifndef CONFIG_USER_ONLY
1598 static const int xlat_gdb_type[] = {
1599     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1600     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1601     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1602 };
1603 #endif
1604
1605 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1606 {
1607     CPUState *env;
1608     int err = 0;
1609
1610     if (kvm_enabled())
1611         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1612
1613     switch (type) {
1614     case GDB_BREAKPOINT_SW:
1615     case GDB_BREAKPOINT_HW:
1616         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1617             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1618             if (err)
1619                 break;
1620         }
1621         return err;
1622 #ifndef CONFIG_USER_ONLY
1623     case GDB_WATCHPOINT_WRITE:
1624     case GDB_WATCHPOINT_READ:
1625     case GDB_WATCHPOINT_ACCESS:
1626         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1627             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1628                                         NULL);
1629             if (err)
1630                 break;
1631         }
1632         return err;
1633 #endif
1634     default:
1635         return -ENOSYS;
1636     }
1637 }
1638
1639 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1640 {
1641     CPUState *env;
1642     int err = 0;
1643
1644     if (kvm_enabled())
1645         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1646
1647     switch (type) {
1648     case GDB_BREAKPOINT_SW:
1649     case GDB_BREAKPOINT_HW:
1650         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1651             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1652             if (err)
1653                 break;
1654         }
1655         return err;
1656 #ifndef CONFIG_USER_ONLY
1657     case GDB_WATCHPOINT_WRITE:
1658     case GDB_WATCHPOINT_READ:
1659     case GDB_WATCHPOINT_ACCESS:
1660         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1661             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1662             if (err)
1663                 break;
1664         }
1665         return err;
1666 #endif
1667     default:
1668         return -ENOSYS;
1669     }
1670 }
1671
1672 static void gdb_breakpoint_remove_all(void)
1673 {
1674     CPUState *env;
1675
1676     if (kvm_enabled()) {
1677         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1678         return;
1679     }
1680
1681     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1682         cpu_breakpoint_remove_all(env, BP_GDB);
1683 #ifndef CONFIG_USER_ONLY
1684         cpu_watchpoint_remove_all(env, BP_GDB);
1685 #endif
1686     }
1687 }
1688
1689 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1690 {
1691 #if defined(TARGET_I386)
1692     cpu_synchronize_state(s->c_cpu);
1693     s->c_cpu->eip = pc;
1694 #elif defined (TARGET_PPC)
1695     s->c_cpu->nip = pc;
1696 #elif defined (TARGET_SPARC)
1697     s->c_cpu->pc = pc;
1698     s->c_cpu->npc = pc + 4;
1699 #elif defined (TARGET_ARM)
1700     s->c_cpu->regs[15] = pc;
1701 #elif defined (TARGET_SH4)
1702     s->c_cpu->pc = pc;
1703 #elif defined (TARGET_MIPS)
1704     s->c_cpu->active_tc.PC = pc & ~(target_ulong)1;
1705     if (pc & 1) {
1706         s->c_cpu->hflags |= MIPS_HFLAG_M16;
1707     } else {
1708         s->c_cpu->hflags &= ~(MIPS_HFLAG_M16);
1709     }
1710 #elif defined (TARGET_MICROBLAZE)
1711     s->c_cpu->sregs[SR_PC] = pc;
1712 #elif defined (TARGET_CRIS)
1713     s->c_cpu->pc = pc;
1714 #elif defined (TARGET_ALPHA)
1715     s->c_cpu->pc = pc;
1716 #elif defined (TARGET_S390X)
1717     cpu_synchronize_state(s->c_cpu);
1718     s->c_cpu->psw.addr = pc;
1719 #endif
1720 }
1721
1722 static inline int gdb_id(CPUState *env)
1723 {
1724 #if defined(CONFIG_USER_ONLY) && defined(CONFIG_USE_NPTL)
1725     return env->host_tid;
1726 #else
1727     return env->cpu_index + 1;
1728 #endif
1729 }
1730
1731 static CPUState *find_cpu(uint32_t thread_id)
1732 {
1733     CPUState *env;
1734
1735     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1736         if (gdb_id(env) == thread_id) {
1737             return env;
1738         }
1739     }
1740
1741     return NULL;
1742 }
1743
1744 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1745 {
1746     CPUState *env;
1747     const char *p;
1748     uint32_t thread;
1749     int ch, reg_size, type, res;
1750     char buf[MAX_PACKET_LENGTH];
1751     uint8_t mem_buf[MAX_PACKET_LENGTH];
1752     uint8_t *registers;
1753     target_ulong addr, len;
1754
1755 #ifdef DEBUG_GDB
1756     printf("command='%s'\n", line_buf);
1757 #endif
1758     p = line_buf;
1759     ch = *p++;
1760     switch(ch) {
1761     case '?':
1762         /* TODO: Make this return the correct value for user-mode.  */
1763         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1764                  gdb_id(s->c_cpu));
1765         put_packet(s, buf);
1766         /* Remove all the breakpoints when this query is issued,
1767          * because gdb is doing and initial connect and the state
1768          * should be cleaned up.
1769          */
1770         gdb_breakpoint_remove_all();
1771         break;
1772     case 'c':
1773         if (*p != '\0') {
1774             addr = strtoull(p, (char **)&p, 16);
1775             gdb_set_cpu_pc(s, addr);
1776         }
1777         s->signal = 0;
1778         gdb_continue(s);
1779         return RS_IDLE;
1780     case 'C':
1781         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1782         if (s->signal == -1)
1783             s->signal = 0;
1784         gdb_continue(s);
1785         return RS_IDLE;
1786     case 'v':
1787         if (strncmp(p, "Cont", 4) == 0) {
1788             int res_signal, res_thread;
1789
1790             p += 4;
1791             if (*p == '?') {
1792                 put_packet(s, "vCont;c;C;s;S");
1793                 break;
1794             }
1795             res = 0;
1796             res_signal = 0;
1797             res_thread = 0;
1798             while (*p) {
1799                 int action, signal;
1800
1801                 if (*p++ != ';') {
1802                     res = 0;
1803                     break;
1804                 }
1805                 action = *p++;
1806                 signal = 0;
1807                 if (action == 'C' || action == 'S') {
1808                     signal = strtoul(p, (char **)&p, 16);
1809                 } else if (action != 'c' && action != 's') {
1810                     res = 0;
1811                     break;
1812                 }
1813                 thread = 0;
1814                 if (*p == ':') {
1815                     thread = strtoull(p+1, (char **)&p, 16);
1816                 }
1817                 action = tolower(action);
1818                 if (res == 0 || (res == 'c' && action == 's')) {
1819                     res = action;
1820                     res_signal = signal;
1821                     res_thread = thread;
1822                 }
1823             }
1824             if (res) {
1825                 if (res_thread != -1 && res_thread != 0) {
1826                     env = find_cpu(res_thread);
1827                     if (env == NULL) {
1828                         put_packet(s, "E22");
1829                         break;
1830                     }
1831                     s->c_cpu = env;
1832                 }
1833                 if (res == 's') {
1834                     cpu_single_step(s->c_cpu, sstep_flags);
1835                 }
1836                 s->signal = res_signal;
1837                 gdb_continue(s);
1838                 return RS_IDLE;
1839             }
1840             break;
1841         } else {
1842             goto unknown_command;
1843         }
1844     case 'k':
1845         /* Kill the target */
1846         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1847         exit(0);
1848     case 'D':
1849         /* Detach packet */
1850         gdb_breakpoint_remove_all();
1851         gdb_continue(s);
1852         put_packet(s, "OK");
1853         break;
1854     case 's':
1855         if (*p != '\0') {
1856             addr = strtoull(p, (char **)&p, 16);
1857             gdb_set_cpu_pc(s, addr);
1858         }
1859         cpu_single_step(s->c_cpu, sstep_flags);
1860         gdb_continue(s);
1861         return RS_IDLE;
1862     case 'F':
1863         {
1864             target_ulong ret;
1865             target_ulong err;
1866
1867             ret = strtoull(p, (char **)&p, 16);
1868             if (*p == ',') {
1869                 p++;
1870                 err = strtoull(p, (char **)&p, 16);
1871             } else {
1872                 err = 0;
1873             }
1874             if (*p == ',')
1875                 p++;
1876             type = *p;
1877             if (gdb_current_syscall_cb)
1878                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1879             if (type == 'C') {
1880                 put_packet(s, "T02");
1881             } else {
1882                 gdb_continue(s);
1883             }
1884         }
1885         break;
1886     case 'g':
1887         cpu_synchronize_state(s->g_cpu);
1888         len = 0;
1889         for (addr = 0; addr < num_g_regs; addr++) {
1890             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1891             len += reg_size;
1892         }
1893         memtohex(buf, mem_buf, len);
1894         put_packet(s, buf);
1895         break;
1896     case 'G':
1897         cpu_synchronize_state(s->g_cpu);
1898         registers = mem_buf;
1899         len = strlen(p) / 2;
1900         hextomem((uint8_t *)registers, p, len);
1901         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1902             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1903             len -= reg_size;
1904             registers += reg_size;
1905         }
1906         put_packet(s, "OK");
1907         break;
1908     case 'm':
1909         addr = strtoull(p, (char **)&p, 16);
1910         if (*p == ',')
1911             p++;
1912         len = strtoull(p, NULL, 16);
1913         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1914             put_packet (s, "E14");
1915         } else {
1916             memtohex(buf, mem_buf, len);
1917             put_packet(s, buf);
1918         }
1919         break;
1920     case 'M':
1921         addr = strtoull(p, (char **)&p, 16);
1922         if (*p == ',')
1923             p++;
1924         len = strtoull(p, (char **)&p, 16);
1925         if (*p == ':')
1926             p++;
1927         hextomem(mem_buf, p, len);
1928         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1929             put_packet(s, "E14");
1930         else
1931             put_packet(s, "OK");
1932         break;
1933     case 'p':
1934         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1935            This works, but can be very slow.  Anything new enough to
1936            understand XML also knows how to use this properly.  */
1937         if (!gdb_has_xml)
1938             goto unknown_command;
1939         addr = strtoull(p, (char **)&p, 16);
1940         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1941         if (reg_size) {
1942             memtohex(buf, mem_buf, reg_size);
1943             put_packet(s, buf);
1944         } else {
1945             put_packet(s, "E14");
1946         }
1947         break;
1948     case 'P':
1949         if (!gdb_has_xml)
1950             goto unknown_command;
1951         addr = strtoull(p, (char **)&p, 16);
1952         if (*p == '=')
1953             p++;
1954         reg_size = strlen(p) / 2;
1955         hextomem(mem_buf, p, reg_size);
1956         gdb_write_register(s->g_cpu, mem_buf, addr);
1957         put_packet(s, "OK");
1958         break;
1959     case 'Z':
1960     case 'z':
1961         type = strtoul(p, (char **)&p, 16);
1962         if (*p == ',')
1963             p++;
1964         addr = strtoull(p, (char **)&p, 16);
1965         if (*p == ',')
1966             p++;
1967         len = strtoull(p, (char **)&p, 16);
1968         if (ch == 'Z')
1969             res = gdb_breakpoint_insert(addr, len, type);
1970         else
1971             res = gdb_breakpoint_remove(addr, len, type);
1972         if (res >= 0)
1973              put_packet(s, "OK");
1974         else if (res == -ENOSYS)
1975             put_packet(s, "");
1976         else
1977             put_packet(s, "E22");
1978         break;
1979     case 'H':
1980         type = *p++;
1981         thread = strtoull(p, (char **)&p, 16);
1982         if (thread == -1 || thread == 0) {
1983             put_packet(s, "OK");
1984             break;
1985         }
1986         env = find_cpu(thread);
1987         if (env == NULL) {
1988             put_packet(s, "E22");
1989             break;
1990         }
1991         switch (type) {
1992         case 'c':
1993             s->c_cpu = env;
1994             put_packet(s, "OK");
1995             break;
1996         case 'g':
1997             s->g_cpu = env;
1998             put_packet(s, "OK");
1999             break;
2000         default:
2001              put_packet(s, "E22");
2002              break;
2003         }
2004         break;
2005     case 'T':
2006         thread = strtoull(p, (char **)&p, 16);
2007         env = find_cpu(thread);
2008
2009         if (env != NULL) {
2010             put_packet(s, "OK");
2011         } else {
2012             put_packet(s, "E22");
2013         }
2014         break;
2015     case 'q':
2016     case 'Q':
2017         /* parse any 'q' packets here */
2018         if (!strcmp(p,"qemu.sstepbits")) {
2019             /* Query Breakpoint bit definitions */
2020             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
2021                      SSTEP_ENABLE,
2022                      SSTEP_NOIRQ,
2023                      SSTEP_NOTIMER);
2024             put_packet(s, buf);
2025             break;
2026         } else if (strncmp(p,"qemu.sstep",10) == 0) {
2027             /* Display or change the sstep_flags */
2028             p += 10;
2029             if (*p != '=') {
2030                 /* Display current setting */
2031                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
2032                 put_packet(s, buf);
2033                 break;
2034             }
2035             p++;
2036             type = strtoul(p, (char **)&p, 16);
2037             sstep_flags = type;
2038             put_packet(s, "OK");
2039             break;
2040         } else if (strcmp(p,"C") == 0) {
2041             /* "Current thread" remains vague in the spec, so always return
2042              *  the first CPU (gdb returns the first thread). */
2043             put_packet(s, "QC1");
2044             break;
2045         } else if (strcmp(p,"fThreadInfo") == 0) {
2046             s->query_cpu = first_cpu;
2047             goto report_cpuinfo;
2048         } else if (strcmp(p,"sThreadInfo") == 0) {
2049         report_cpuinfo:
2050             if (s->query_cpu) {
2051                 snprintf(buf, sizeof(buf), "m%x", gdb_id(s->query_cpu));
2052                 put_packet(s, buf);
2053                 s->query_cpu = s->query_cpu->next_cpu;
2054             } else
2055                 put_packet(s, "l");
2056             break;
2057         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
2058             thread = strtoull(p+16, (char **)&p, 16);
2059             env = find_cpu(thread);
2060             if (env != NULL) {
2061                 cpu_synchronize_state(env);
2062                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
2063                                "CPU#%d [%s]", env->cpu_index,
2064                                env->halted ? "halted " : "running");
2065                 memtohex(buf, mem_buf, len);
2066                 put_packet(s, buf);
2067             }
2068             break;
2069         }
2070 #ifdef CONFIG_USER_ONLY
2071         else if (strncmp(p, "Offsets", 7) == 0) {
2072             TaskState *ts = s->c_cpu->opaque;
2073
2074             snprintf(buf, sizeof(buf),
2075                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
2076                      ";Bss=" TARGET_ABI_FMT_lx,
2077                      ts->info->code_offset,
2078                      ts->info->data_offset,
2079                      ts->info->data_offset);
2080             put_packet(s, buf);
2081             break;
2082         }
2083 #else /* !CONFIG_USER_ONLY */
2084         else if (strncmp(p, "Rcmd,", 5) == 0) {
2085             int len = strlen(p + 5);
2086
2087             if ((len % 2) != 0) {
2088                 put_packet(s, "E01");
2089                 break;
2090             }
2091             hextomem(mem_buf, p + 5, len);
2092             len = len / 2;
2093             mem_buf[len++] = 0;
2094             qemu_chr_read(s->mon_chr, mem_buf, len);
2095             put_packet(s, "OK");
2096             break;
2097         }
2098 #endif /* !CONFIG_USER_ONLY */
2099         if (strncmp(p, "Supported", 9) == 0) {
2100             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
2101 #ifdef GDB_CORE_XML
2102             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
2103 #endif
2104             put_packet(s, buf);
2105             break;
2106         }
2107 #ifdef GDB_CORE_XML
2108         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
2109             const char *xml;
2110             target_ulong total_len;
2111
2112             gdb_has_xml = 1;
2113             p += 19;
2114             xml = get_feature_xml(p, &p);
2115             if (!xml) {
2116                 snprintf(buf, sizeof(buf), "E00");
2117                 put_packet(s, buf);
2118                 break;
2119             }
2120
2121             if (*p == ':')
2122                 p++;
2123             addr = strtoul(p, (char **)&p, 16);
2124             if (*p == ',')
2125                 p++;
2126             len = strtoul(p, (char **)&p, 16);
2127
2128             total_len = strlen(xml);
2129             if (addr > total_len) {
2130                 snprintf(buf, sizeof(buf), "E00");
2131                 put_packet(s, buf);
2132                 break;
2133             }
2134             if (len > (MAX_PACKET_LENGTH - 5) / 2)
2135                 len = (MAX_PACKET_LENGTH - 5) / 2;
2136             if (len < total_len - addr) {
2137                 buf[0] = 'm';
2138                 len = memtox(buf + 1, xml + addr, len);
2139             } else {
2140                 buf[0] = 'l';
2141                 len = memtox(buf + 1, xml + addr, total_len - addr);
2142             }
2143             put_packet_binary(s, buf, len + 1);
2144             break;
2145         }
2146 #endif
2147         /* Unrecognised 'q' command.  */
2148         goto unknown_command;
2149
2150     default:
2151     unknown_command:
2152         /* put empty packet */
2153         buf[0] = '\0';
2154         put_packet(s, buf);
2155         break;
2156     }
2157     return RS_IDLE;
2158 }
2159
2160 void gdb_set_stop_cpu(CPUState *env)
2161 {
2162     gdbserver_state->c_cpu = env;
2163     gdbserver_state->g_cpu = env;
2164 }
2165
2166 #ifndef CONFIG_USER_ONLY
2167 static void gdb_vm_state_change(void *opaque, int running, int reason)
2168 {
2169     GDBState *s = gdbserver_state;
2170     CPUState *env = s->c_cpu;
2171     char buf[256];
2172     const char *type;
2173     int ret;
2174
2175     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
2176         s->state == RS_INACTIVE || s->state == RS_SYSCALL)
2177         return;
2178
2179     /* disable single step if it was enable */
2180     cpu_single_step(env, 0);
2181
2182     if (reason == EXCP_DEBUG) {
2183         if (env->watchpoint_hit) {
2184             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
2185             case BP_MEM_READ:
2186                 type = "r";
2187                 break;
2188             case BP_MEM_ACCESS:
2189                 type = "a";
2190                 break;
2191             default:
2192                 type = "";
2193                 break;
2194             }
2195             snprintf(buf, sizeof(buf),
2196                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
2197                      GDB_SIGNAL_TRAP, gdb_id(env), type,
2198                      env->watchpoint_hit->vaddr);
2199             put_packet(s, buf);
2200             env->watchpoint_hit = NULL;
2201             return;
2202         }
2203         tb_flush(env);
2204         ret = GDB_SIGNAL_TRAP;
2205     } else {
2206         ret = GDB_SIGNAL_INT;
2207     }
2208     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, gdb_id(env));
2209     put_packet(s, buf);
2210 }
2211 #endif
2212
2213 /* Send a gdb syscall request.
2214    This accepts limited printf-style format specifiers, specifically:
2215     %x  - target_ulong argument printed in hex.
2216     %lx - 64-bit argument printed in hex.
2217     %s  - string pointer (target_ulong) and length (int) pair.  */
2218 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
2219 {
2220     va_list va;
2221     char buf[256];
2222     char *p;
2223     target_ulong addr;
2224     uint64_t i64;
2225     GDBState *s;
2226
2227     s = gdbserver_state;
2228     if (!s)
2229         return;
2230     gdb_current_syscall_cb = cb;
2231     s->state = RS_SYSCALL;
2232 #ifndef CONFIG_USER_ONLY
2233     vm_stop(EXCP_DEBUG);
2234 #endif
2235     s->state = RS_IDLE;
2236     va_start(va, fmt);
2237     p = buf;
2238     *(p++) = 'F';
2239     while (*fmt) {
2240         if (*fmt == '%') {
2241             fmt++;
2242             switch (*fmt++) {
2243             case 'x':
2244                 addr = va_arg(va, target_ulong);
2245                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
2246                 break;
2247             case 'l':
2248                 if (*(fmt++) != 'x')
2249                     goto bad_format;
2250                 i64 = va_arg(va, uint64_t);
2251                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
2252                 break;
2253             case 's':
2254                 addr = va_arg(va, target_ulong);
2255                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
2256                               addr, va_arg(va, int));
2257                 break;
2258             default:
2259             bad_format:
2260                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2261                         fmt - 1);
2262                 break;
2263             }
2264         } else {
2265             *(p++) = *(fmt++);
2266         }
2267     }
2268     *p = 0;
2269     va_end(va);
2270     put_packet(s, buf);
2271 #ifdef CONFIG_USER_ONLY
2272     gdb_handlesig(s->c_cpu, 0);
2273 #else
2274     cpu_exit(s->c_cpu);
2275 #endif
2276 }
2277
2278 static void gdb_read_byte(GDBState *s, int ch)
2279 {
2280     int i, csum;
2281     uint8_t reply;
2282
2283 #ifndef CONFIG_USER_ONLY
2284     if (s->last_packet_len) {
2285         /* Waiting for a response to the last packet.  If we see the start
2286            of a new command then abandon the previous response.  */
2287         if (ch == '-') {
2288 #ifdef DEBUG_GDB
2289             printf("Got NACK, retransmitting\n");
2290 #endif
2291             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2292         }
2293 #ifdef DEBUG_GDB
2294         else if (ch == '+')
2295             printf("Got ACK\n");
2296         else
2297             printf("Got '%c' when expecting ACK/NACK\n", ch);
2298 #endif
2299         if (ch == '+' || ch == '$')
2300             s->last_packet_len = 0;
2301         if (ch != '$')
2302             return;
2303     }
2304     if (vm_running) {
2305         /* when the CPU is running, we cannot do anything except stop
2306            it when receiving a char */
2307         vm_stop(EXCP_INTERRUPT);
2308     } else
2309 #endif
2310     {
2311         switch(s->state) {
2312         case RS_IDLE:
2313             if (ch == '$') {
2314                 s->line_buf_index = 0;
2315                 s->state = RS_GETLINE;
2316             }
2317             break;
2318         case RS_GETLINE:
2319             if (ch == '#') {
2320             s->state = RS_CHKSUM1;
2321             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2322                 s->state = RS_IDLE;
2323             } else {
2324             s->line_buf[s->line_buf_index++] = ch;
2325             }
2326             break;
2327         case RS_CHKSUM1:
2328             s->line_buf[s->line_buf_index] = '\0';
2329             s->line_csum = fromhex(ch) << 4;
2330             s->state = RS_CHKSUM2;
2331             break;
2332         case RS_CHKSUM2:
2333             s->line_csum |= fromhex(ch);
2334             csum = 0;
2335             for(i = 0; i < s->line_buf_index; i++) {
2336                 csum += s->line_buf[i];
2337             }
2338             if (s->line_csum != (csum & 0xff)) {
2339                 reply = '-';
2340                 put_buffer(s, &reply, 1);
2341                 s->state = RS_IDLE;
2342             } else {
2343                 reply = '+';
2344                 put_buffer(s, &reply, 1);
2345                 s->state = gdb_handle_packet(s, s->line_buf);
2346             }
2347             break;
2348         default:
2349             abort();
2350         }
2351     }
2352 }
2353
2354 #ifdef CONFIG_USER_ONLY
2355 int
2356 gdb_queuesig (void)
2357 {
2358     GDBState *s;
2359
2360     s = gdbserver_state;
2361
2362     if (gdbserver_fd < 0 || s->fd < 0)
2363         return 0;
2364     else
2365         return 1;
2366 }
2367
2368 int
2369 gdb_handlesig (CPUState *env, int sig)
2370 {
2371   GDBState *s;
2372   char buf[256];
2373   int n;
2374
2375   s = gdbserver_state;
2376   if (gdbserver_fd < 0 || s->fd < 0)
2377     return sig;
2378
2379   /* disable single step if it was enabled */
2380   cpu_single_step(env, 0);
2381   tb_flush(env);
2382
2383   if (sig != 0)
2384     {
2385       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2386       put_packet(s, buf);
2387     }
2388   /* put_packet() might have detected that the peer terminated the
2389      connection.  */
2390   if (s->fd < 0)
2391       return sig;
2392
2393   sig = 0;
2394   s->state = RS_IDLE;
2395   s->running_state = 0;
2396   while (s->running_state == 0) {
2397       n = read (s->fd, buf, 256);
2398       if (n > 0)
2399         {
2400           int i;
2401
2402           for (i = 0; i < n; i++)
2403             gdb_read_byte (s, buf[i]);
2404         }
2405       else if (n == 0 || errno != EAGAIN)
2406         {
2407           /* XXX: Connection closed.  Should probably wait for annother
2408              connection before continuing.  */
2409           return sig;
2410         }
2411   }
2412   sig = s->signal;
2413   s->signal = 0;
2414   return sig;
2415 }
2416
2417 /* Tell the remote gdb that the process has exited.  */
2418 void gdb_exit(CPUState *env, int code)
2419 {
2420   GDBState *s;
2421   char buf[4];
2422
2423   s = gdbserver_state;
2424   if (gdbserver_fd < 0 || s->fd < 0)
2425     return;
2426
2427   snprintf(buf, sizeof(buf), "W%02x", code);
2428   put_packet(s, buf);
2429 }
2430
2431 /* Tell the remote gdb that the process has exited due to SIG.  */
2432 void gdb_signalled(CPUState *env, int sig)
2433 {
2434   GDBState *s;
2435   char buf[4];
2436
2437   s = gdbserver_state;
2438   if (gdbserver_fd < 0 || s->fd < 0)
2439     return;
2440
2441   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2442   put_packet(s, buf);
2443 }
2444
2445 static void gdb_accept(void)
2446 {
2447     GDBState *s;
2448     struct sockaddr_in sockaddr;
2449     socklen_t len;
2450     int val, fd;
2451
2452     for(;;) {
2453         len = sizeof(sockaddr);
2454         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2455         if (fd < 0 && errno != EINTR) {
2456             perror("accept");
2457             return;
2458         } else if (fd >= 0) {
2459 #ifndef _WIN32
2460             fcntl(fd, F_SETFD, FD_CLOEXEC);
2461 #endif
2462             break;
2463         }
2464     }
2465
2466     /* set short latency */
2467     val = 1;
2468     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2469
2470     s = qemu_mallocz(sizeof(GDBState));
2471     s->c_cpu = first_cpu;
2472     s->g_cpu = first_cpu;
2473     s->fd = fd;
2474     gdb_has_xml = 0;
2475
2476     gdbserver_state = s;
2477
2478     fcntl(fd, F_SETFL, O_NONBLOCK);
2479 }
2480
2481 static int gdbserver_open(int port)
2482 {
2483     struct sockaddr_in sockaddr;
2484     int fd, val, ret;
2485
2486     fd = socket(PF_INET, SOCK_STREAM, 0);
2487     if (fd < 0) {
2488         perror("socket");
2489         return -1;
2490     }
2491 #ifndef _WIN32
2492     fcntl(fd, F_SETFD, FD_CLOEXEC);
2493 #endif
2494
2495     /* allow fast reuse */
2496     val = 1;
2497     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2498
2499     sockaddr.sin_family = AF_INET;
2500     sockaddr.sin_port = htons(port);
2501     sockaddr.sin_addr.s_addr = 0;
2502     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2503     if (ret < 0) {
2504         perror("bind");
2505         return -1;
2506     }
2507     ret = listen(fd, 0);
2508     if (ret < 0) {
2509         perror("listen");
2510         return -1;
2511     }
2512     return fd;
2513 }
2514
2515 int gdbserver_start(int port)
2516 {
2517     gdbserver_fd = gdbserver_open(port);
2518     if (gdbserver_fd < 0)
2519         return -1;
2520     /* accept connections */
2521     gdb_accept();
2522     return 0;
2523 }
2524
2525 /* Disable gdb stub for child processes.  */
2526 void gdbserver_fork(CPUState *env)
2527 {
2528     GDBState *s = gdbserver_state;
2529     if (gdbserver_fd < 0 || s->fd < 0)
2530       return;
2531     close(s->fd);
2532     s->fd = -1;
2533     cpu_breakpoint_remove_all(env, BP_GDB);
2534     cpu_watchpoint_remove_all(env, BP_GDB);
2535 }
2536 #else
2537 static int gdb_chr_can_receive(void *opaque)
2538 {
2539   /* We can handle an arbitrarily large amount of data.
2540    Pick the maximum packet size, which is as good as anything.  */
2541   return MAX_PACKET_LENGTH;
2542 }
2543
2544 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2545 {
2546     int i;
2547
2548     for (i = 0; i < size; i++) {
2549         gdb_read_byte(gdbserver_state, buf[i]);
2550     }
2551 }
2552
2553 static void gdb_chr_event(void *opaque, int event)
2554 {
2555     switch (event) {
2556     case CHR_EVENT_OPENED:
2557         vm_stop(EXCP_INTERRUPT);
2558         gdb_has_xml = 0;
2559         break;
2560     default:
2561         break;
2562     }
2563 }
2564
2565 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2566 {
2567     char buf[MAX_PACKET_LENGTH];
2568
2569     buf[0] = 'O';
2570     if (len > (MAX_PACKET_LENGTH/2) - 1)
2571         len = (MAX_PACKET_LENGTH/2) - 1;
2572     memtohex(buf + 1, (uint8_t *)msg, len);
2573     put_packet(s, buf);
2574 }
2575
2576 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2577 {
2578     const char *p = (const char *)buf;
2579     int max_sz;
2580
2581     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2582     for (;;) {
2583         if (len <= max_sz) {
2584             gdb_monitor_output(gdbserver_state, p, len);
2585             break;
2586         }
2587         gdb_monitor_output(gdbserver_state, p, max_sz);
2588         p += max_sz;
2589         len -= max_sz;
2590     }
2591     return len;
2592 }
2593
2594 #ifndef _WIN32
2595 static void gdb_sigterm_handler(int signal)
2596 {
2597     if (vm_running)
2598         vm_stop(EXCP_INTERRUPT);
2599 }
2600 #endif
2601
2602 int gdbserver_start(const char *device)
2603 {
2604     GDBState *s;
2605     char gdbstub_device_name[128];
2606     CharDriverState *chr = NULL;
2607     CharDriverState *mon_chr;
2608
2609     if (!device)
2610         return -1;
2611     if (strcmp(device, "none") != 0) {
2612         if (strstart(device, "tcp:", NULL)) {
2613             /* enforce required TCP attributes */
2614             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2615                      "%s,nowait,nodelay,server", device);
2616             device = gdbstub_device_name;
2617         }
2618 #ifndef _WIN32
2619         else if (strcmp(device, "stdio") == 0) {
2620             struct sigaction act;
2621
2622             memset(&act, 0, sizeof(act));
2623             act.sa_handler = gdb_sigterm_handler;
2624             sigaction(SIGINT, &act, NULL);
2625         }
2626 #endif
2627         chr = qemu_chr_open("gdb", device, NULL);
2628         if (!chr)
2629             return -1;
2630
2631         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2632                               gdb_chr_event, NULL);
2633     }
2634
2635     s = gdbserver_state;
2636     if (!s) {
2637         s = qemu_mallocz(sizeof(GDBState));
2638         gdbserver_state = s;
2639
2640         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2641
2642         /* Initialize a monitor terminal for gdb */
2643         mon_chr = qemu_mallocz(sizeof(*mon_chr));
2644         mon_chr->chr_write = gdb_monitor_write;
2645         monitor_init(mon_chr, 0);
2646     } else {
2647         if (s->chr)
2648             qemu_chr_close(s->chr);
2649         mon_chr = s->mon_chr;
2650         memset(s, 0, sizeof(GDBState));
2651     }
2652     s->c_cpu = first_cpu;
2653     s->g_cpu = first_cpu;
2654     s->chr = chr;
2655     s->state = chr ? RS_IDLE : RS_INACTIVE;
2656     s->mon_chr = mon_chr;
2657
2658     return 0;
2659 }
2660 #endif