gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "qemu-common.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "monitor.h"
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #endif
  37
  38 #define MAX_PACKET_LENGTH 4096
  39
  40 #include "qemu_socket.h"
  41 #include "kvm.h"
  42
  43
  44 enum {
  45     GDB_SIGNAL_0 = 0,
  46     GDB_SIGNAL_INT = 2,
  47     GDB_SIGNAL_TRAP = 5,
  48     GDB_SIGNAL_UNKNOWN = 143
  49 };
  50
  51 #ifdef CONFIG_USER_ONLY
  52
  53 /* Map target signal numbers to GDB protocol signal numbers and vice
  54  * versa.  For user emulation's currently supported systems, we can
  55  * assume most signals are defined.
  56  */
  57
  58 static int gdb_signal_table[] = {
  59     0,
  60     TARGET_SIGHUP,
  61     TARGET_SIGINT,
  62     TARGET_SIGQUIT,
  63     TARGET_SIGILL,
  64     TARGET_SIGTRAP,
  65     TARGET_SIGABRT,
  66     -1, /* SIGEMT */
  67     TARGET_SIGFPE,
  68     TARGET_SIGKILL,
  69     TARGET_SIGBUS,
  70     TARGET_SIGSEGV,
  71     TARGET_SIGSYS,
  72     TARGET_SIGPIPE,
  73     TARGET_SIGALRM,
  74     TARGET_SIGTERM,
  75     TARGET_SIGURG,
  76     TARGET_SIGSTOP,
  77     TARGET_SIGTSTP,
  78     TARGET_SIGCONT,
  79     TARGET_SIGCHLD,
  80     TARGET_SIGTTIN,
  81     TARGET_SIGTTOU,
  82     TARGET_SIGIO,
  83     TARGET_SIGXCPU,
  84     TARGET_SIGXFSZ,
  85     TARGET_SIGVTALRM,
  86     TARGET_SIGPROF,
  87     TARGET_SIGWINCH,
  88     -1, /* SIGLOST */
  89     TARGET_SIGUSR1,
  90     TARGET_SIGUSR2,
  91 #ifdef TARGET_SIGPWR
  92     TARGET_SIGPWR,
  93 #else
  94     -1,
  95 #endif
  96     -1, /* SIGPOLL */
  97     -1,
  98     -1,
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108 #ifdef __SIGRTMIN
 109     __SIGRTMIN + 1,
 110     __SIGRTMIN + 2,
 111     __SIGRTMIN + 3,
 112     __SIGRTMIN + 4,
 113     __SIGRTMIN + 5,
 114     __SIGRTMIN + 6,
 115     __SIGRTMIN + 7,
 116     __SIGRTMIN + 8,
 117     __SIGRTMIN + 9,
 118     __SIGRTMIN + 10,
 119     __SIGRTMIN + 11,
 120     __SIGRTMIN + 12,
 121     __SIGRTMIN + 13,
 122     __SIGRTMIN + 14,
 123     __SIGRTMIN + 15,
 124     __SIGRTMIN + 16,
 125     __SIGRTMIN + 17,
 126     __SIGRTMIN + 18,
 127     __SIGRTMIN + 19,
 128     __SIGRTMIN + 20,
 129     __SIGRTMIN + 21,
 130     __SIGRTMIN + 22,
 131     __SIGRTMIN + 23,
 132     __SIGRTMIN + 24,
 133     __SIGRTMIN + 25,
 134     __SIGRTMIN + 26,
 135     __SIGRTMIN + 27,
 136     __SIGRTMIN + 28,
 137     __SIGRTMIN + 29,
 138     __SIGRTMIN + 30,
 139     __SIGRTMIN + 31,
 140     -1, /* SIGCANCEL */
 141     __SIGRTMIN,
 142     __SIGRTMIN + 32,
 143     __SIGRTMIN + 33,
 144     __SIGRTMIN + 34,
 145     __SIGRTMIN + 35,
 146     __SIGRTMIN + 36,
 147     __SIGRTMIN + 37,
 148     __SIGRTMIN + 38,
 149     __SIGRTMIN + 39,
 150     __SIGRTMIN + 40,
 151     __SIGRTMIN + 41,
 152     __SIGRTMIN + 42,
 153     __SIGRTMIN + 43,
 154     __SIGRTMIN + 44,
 155     __SIGRTMIN + 45,
 156     __SIGRTMIN + 46,
 157     __SIGRTMIN + 47,
 158     __SIGRTMIN + 48,
 159     __SIGRTMIN + 49,
 160     __SIGRTMIN + 50,
 161     __SIGRTMIN + 51,
 162     __SIGRTMIN + 52,
 163     __SIGRTMIN + 53,
 164     __SIGRTMIN + 54,
 165     __SIGRTMIN + 55,
 166     __SIGRTMIN + 56,
 167     __SIGRTMIN + 57,
 168     __SIGRTMIN + 58,
 169     __SIGRTMIN + 59,
 170     __SIGRTMIN + 60,
 171     __SIGRTMIN + 61,
 172     __SIGRTMIN + 62,
 173     __SIGRTMIN + 63,
 174     __SIGRTMIN + 64,
 175     __SIGRTMIN + 65,
 176     __SIGRTMIN + 66,
 177     __SIGRTMIN + 67,
 178     __SIGRTMIN + 68,
 179     __SIGRTMIN + 69,
 180     __SIGRTMIN + 70,
 181     __SIGRTMIN + 71,
 182     __SIGRTMIN + 72,
 183     __SIGRTMIN + 73,
 184     __SIGRTMIN + 74,
 185     __SIGRTMIN + 75,
 186     __SIGRTMIN + 76,
 187     __SIGRTMIN + 77,
 188     __SIGRTMIN + 78,
 189     __SIGRTMIN + 79,
 190     __SIGRTMIN + 80,
 191     __SIGRTMIN + 81,
 192     __SIGRTMIN + 82,
 193     __SIGRTMIN + 83,
 194     __SIGRTMIN + 84,
 195     __SIGRTMIN + 85,
 196     __SIGRTMIN + 86,
 197     __SIGRTMIN + 87,
 198     __SIGRTMIN + 88,
 199     __SIGRTMIN + 89,
 200     __SIGRTMIN + 90,
 201     __SIGRTMIN + 91,
 202     __SIGRTMIN + 92,
 203     __SIGRTMIN + 93,
 204     __SIGRTMIN + 94,
 205     __SIGRTMIN + 95,
 206     -1, /* SIGINFO */
 207     -1, /* UNKNOWN */
 208     -1, /* DEFAULT */
 209     -1,
 210     -1,
 211     -1,
 212     -1,
 213     -1,
 214     -1
 215 #endif
 216 };
 217 #else
 218 /* In system mode we only need SIGINT and SIGTRAP; other signals
 219    are not yet supported.  */
 220
 221 enum {
 222     TARGET_SIGINT = 2,
 223     TARGET_SIGTRAP = 5
 224 };
 225
 226 static int gdb_signal_table[] = {
 227     -1,
 228     -1,
 229     TARGET_SIGINT,
 230     -1,
 231     -1,
 232     TARGET_SIGTRAP
 233 };
 234 #endif
 235
 236 #ifdef CONFIG_USER_ONLY
 237 static int target_signal_to_gdb (int sig)
 238 {
 239     int i;
 240     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 241         if (gdb_signal_table[i] == sig)
 242             return i;
 243     return GDB_SIGNAL_UNKNOWN;
 244 }
 245 #endif
 246
 247 static int gdb_signal_to_target (int sig)
 248 {
 249     if (sig < ARRAY_SIZE (gdb_signal_table))
 250         return gdb_signal_table[sig];
 251     else
 252         return -1;
 253 }
 254
 255 //#define DEBUG_GDB
 256
 257 typedef struct GDBRegisterState {
 258     int base_reg;
 259     int num_regs;
 260     gdb_reg_cb get_reg;
 261     gdb_reg_cb set_reg;
 262     const char *xml;
 263     struct GDBRegisterState *next;
 264 } GDBRegisterState;
 265
 266 enum RSState {
 267     RS_INACTIVE,
 268     RS_IDLE,
 269     RS_GETLINE,
 270     RS_CHKSUM1,
 271     RS_CHKSUM2,
 272     RS_SYSCALL,
 273 };
 274 typedef struct GDBState {
 275     CPUState *c_cpu; /* current CPU for step/continue ops */
 276     CPUState *g_cpu; /* current CPU for other ops */
 277     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 278     enum RSState state; /* parsing state */
 279     char line_buf[MAX_PACKET_LENGTH];
 280     int line_buf_index;
 281     int line_csum;
 282     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 283     int last_packet_len;
 284     int signal;
 285 #ifdef CONFIG_USER_ONLY
 286     int fd;
 287     int running_state;
 288 #else
 289     CharDriverState *chr;
 290     CharDriverState *mon_chr;
 291 #endif
 292 } GDBState;
 293
 294 /* By default use no IRQs and no timers while single stepping so as to
 295  * make single stepping like an ICE HW step.
 296  */
 297 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 298
 299 static GDBState *gdbserver_state;
 300
 301 /* This is an ugly hack to cope with both new and old gdb.
 302    If gdb sends qXfer:features:read then assume we're talking to a newish
 303    gdb that understands target descriptions.  */
 304 static int gdb_has_xml;
 305
 306 #ifdef CONFIG_USER_ONLY
 307 /* XXX: This is not thread safe.  Do we care?  */
 308 static int gdbserver_fd = -1;
 309
 310 static int get_char(GDBState *s)
 311 {
 312     uint8_t ch;
 313     int ret;
 314
 315     for(;;) {
 316         ret = recv(s->fd, &ch, 1, 0);
 317         if (ret < 0) {
 318             if (errno == ECONNRESET)
 319                 s->fd = -1;
 320             if (errno != EINTR && errno != EAGAIN)
 321                 return -1;
 322         } else if (ret == 0) {
 323             close(s->fd);
 324             s->fd = -1;
 325             return -1;
 326         } else {
 327             break;
 328         }
 329     }
 330     return ch;
 331 }
 332 #endif
 333
 334 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 335
 336 static enum {
 337     GDB_SYS_UNKNOWN,
 338     GDB_SYS_ENABLED,
 339     GDB_SYS_DISABLED,
 340 } gdb_syscall_mode;
 341
 342 /* If gdb is connected when the first semihosting syscall occurs then use
 343    remote gdb syscalls.  Otherwise use native file IO.  */
 344 int use_gdb_syscalls(void)
 345 {
 346     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 347         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 348                                             : GDB_SYS_DISABLED);
 349     }
 350     return gdb_syscall_mode == GDB_SYS_ENABLED;
 351 }
 352
 353 /* Resume execution.  */
 354 static inline void gdb_continue(GDBState *s)
 355 {
 356 #ifdef CONFIG_USER_ONLY
 357     s->running_state = 1;
 358 #else
 359     vm_start();
 360 #endif
 361 }
 362
 363 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 364 {
 365 #ifdef CONFIG_USER_ONLY
 366     int ret;
 367
 368     while (len > 0) {
 369         ret = send(s->fd, buf, len, 0);
 370         if (ret < 0) {
 371             if (errno != EINTR && errno != EAGAIN)
 372                 return;
 373         } else {
 374             buf += ret;
 375             len -= ret;
 376         }
 377     }
 378 #else
 379     qemu_chr_write(s->chr, buf, len);
 380 #endif
 381 }
 382
 383 static inline int fromhex(int v)
 384 {
 385     if (v >= '0' && v <= '9')
 386         return v - '0';
 387     else if (v >= 'A' && v <= 'F')
 388         return v - 'A' + 10;
 389     else if (v >= 'a' && v <= 'f')
 390         return v - 'a' + 10;
 391     else
 392         return 0;
 393 }
 394
 395 static inline int tohex(int v)
 396 {
 397     if (v < 10)
 398         return v + '0';
 399     else
 400         return v - 10 + 'a';
 401 }
 402
 403 static void memtohex(char *buf, const uint8_t *mem, int len)
 404 {
 405     int i, c;
 406     char *q;
 407     q = buf;
 408     for(i = 0; i < len; i++) {
 409         c = mem[i];
 410         *q++ = tohex(c >> 4);
 411         *q++ = tohex(c & 0xf);
 412     }
 413     *q = '\0';
 414 }
 415
 416 static void hextomem(uint8_t *mem, const char *buf, int len)
 417 {
 418     int i;
 419
 420     for(i = 0; i < len; i++) {
 421         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 422         buf += 2;
 423     }
 424 }
 425
 426 /* return -1 if error, 0 if OK */
 427 static int put_packet_binary(GDBState *s, const char *buf, int len)
 428 {
 429     int csum, i;
 430     uint8_t *p;
 431
 432     for(;;) {
 433         p = s->last_packet;
 434         *(p++) = '$';
 435         memcpy(p, buf, len);
 436         p += len;
 437         csum = 0;
 438         for(i = 0; i < len; i++) {
 439             csum += buf[i];
 440         }
 441         *(p++) = '#';
 442         *(p++) = tohex((csum >> 4) & 0xf);
 443         *(p++) = tohex((csum) & 0xf);
 444
 445         s->last_packet_len = p - s->last_packet;
 446         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 447
 448 #ifdef CONFIG_USER_ONLY
 449         i = get_char(s);
 450         if (i < 0)
 451             return -1;
 452         if (i == '+')
 453             break;
 454 #else
 455         break;
 456 #endif
 457     }
 458     return 0;
 459 }
 460
 461 /* return -1 if error, 0 if OK */
 462 static int put_packet(GDBState *s, const char *buf)
 463 {
 464 #ifdef DEBUG_GDB
 465     printf("reply='%s'\n", buf);
 466 #endif
 467
 468     return put_packet_binary(s, buf, strlen(buf));
 469 }
 470
 471 /* The GDB remote protocol transfers values in target byte order.  This means
 472    we can use the raw memory access routines to access the value buffer.
 473    Conveniently, these also handle the case where the buffer is mis-aligned.
 474  */
 475 #define GET_REG8(val) do { \
 476     stb_p(mem_buf, val); \
 477     return 1; \
 478     } while(0)
 479 #define GET_REG16(val) do { \
 480     stw_p(mem_buf, val); \
 481     return 2; \
 482     } while(0)
 483 #define GET_REG32(val) do { \
 484     stl_p(mem_buf, val); \
 485     return 4; \
 486     } while(0)
 487 #define GET_REG64(val) do { \
 488     stq_p(mem_buf, val); \
 489     return 8; \
 490     } while(0)
 491
 492 #if TARGET_LONG_BITS == 64
 493 #define GET_REGL(val) GET_REG64(val)
 494 #define ldtul_p(addr) ldq_p(addr)
 495 #else
 496 #define GET_REGL(val) GET_REG32(val)
 497 #define ldtul_p(addr) ldl_p(addr)
 498 #endif
 499
 500 #if defined(TARGET_I386)
 501
 502 #ifdef TARGET_X86_64
 503 static const int gpr_map[16] = {
 504     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 505     8, 9, 10, 11, 12, 13, 14, 15
 506 };
 507 #else
 508 #define gpr_map gpr_map32
 509 #endif
 510 static const int gpr_map32[8] = { 0, 1, 2, 3, 4, 5, 6, 7 };
 511
 512 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 513
 514 #define IDX_IP_REG      CPU_NB_REGS
 515 #define IDX_FLAGS_REG   (IDX_IP_REG + 1)
 516 #define IDX_SEG_REGS    (IDX_FLAGS_REG + 1)
 517 #define IDX_FP_REGS     (IDX_SEG_REGS + 6)
 518 #define IDX_XMM_REGS    (IDX_FP_REGS + 16)
 519 #define IDX_MXCSR_REG   (IDX_XMM_REGS + CPU_NB_REGS)
 520
 521 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 522 {
 523     if (n < CPU_NB_REGS) {
 524         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 525             GET_REG64(env->regs[gpr_map[n]]);
 526         } else if (n < CPU_NB_REGS32) {
 527             GET_REG32(env->regs[gpr_map32[n]]);
 528         }
 529     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 530 #ifdef USE_X86LDOUBLE
 531         /* FIXME: byteswap float values - after fixing fpregs layout. */
 532         memcpy(mem_buf, &env->fpregs[n - IDX_FP_REGS], 10);
 533 #else
 534         memset(mem_buf, 0, 10);
 535 #endif
 536         return 10;
 537     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 538         n -= IDX_XMM_REGS;
 539         if (n < CPU_NB_REGS32 ||
 540             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 541             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 542             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 543             return 16;
 544         }
 545     } else {
 546         switch (n) {
 547         case IDX_IP_REG:
 548             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 549                 GET_REG64(env->eip);
 550             } else {
 551                 GET_REG32(env->eip);
 552             }
 553         case IDX_FLAGS_REG: GET_REG32(env->eflags);
 554
 555         case IDX_SEG_REGS:     GET_REG32(env->segs[R_CS].selector);
 556         case IDX_SEG_REGS + 1: GET_REG32(env->segs[R_SS].selector);
 557         case IDX_SEG_REGS + 2: GET_REG32(env->segs[R_DS].selector);
 558         case IDX_SEG_REGS + 3: GET_REG32(env->segs[R_ES].selector);
 559         case IDX_SEG_REGS + 4: GET_REG32(env->segs[R_FS].selector);
 560         case IDX_SEG_REGS + 5: GET_REG32(env->segs[R_GS].selector);
 561
 562         case IDX_FP_REGS + 8:  GET_REG32(env->fpuc);
 563         case IDX_FP_REGS + 9:  GET_REG32((env->fpus & ~0x3800) |
 564                                          (env->fpstt & 0x7) << 11);
 565         case IDX_FP_REGS + 10: GET_REG32(0); /* ftag */
 566         case IDX_FP_REGS + 11: GET_REG32(0); /* fiseg */
 567         case IDX_FP_REGS + 12: GET_REG32(0); /* fioff */
 568         case IDX_FP_REGS + 13: GET_REG32(0); /* foseg */
 569         case IDX_FP_REGS + 14: GET_REG32(0); /* fooff */
 570         case IDX_FP_REGS + 15: GET_REG32(0); /* fop */
 571
 572         case IDX_MXCSR_REG: GET_REG32(env->mxcsr);
 573         }
 574     }
 575     return 0;
 576 }
 577
 578 static int cpu_x86_gdb_load_seg(CPUState *env, int sreg, uint8_t *mem_buf)
 579 {
 580     uint16_t selector = ldl_p(mem_buf);
 581
 582     if (selector != env->segs[sreg].selector) {
 583 #if defined(CONFIG_USER_ONLY)
 584         cpu_x86_load_seg(env, sreg, selector);
 585 #else
 586         unsigned int limit, flags;
 587         target_ulong base;
 588
 589         if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK)) {
 590             base = selector << 4;
 591             limit = 0xffff;
 592             flags = 0;
 593         } else {
 594             if (!cpu_x86_get_descr_debug(env, selector, &base, &limit, &flags))
 595                 return 4;
 596         }
 597         cpu_x86_load_seg_cache(env, sreg, selector, base, limit, flags);
 598 #endif
 599     }
 600     return 4;
 601 }
 602
 603 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 604 {
 605     uint32_t tmp;
 606
 607     if (n < CPU_NB_REGS) {
 608         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 609             env->regs[gpr_map[n]] = ldtul_p(mem_buf);
 610             return sizeof(target_ulong);
 611         } else if (n < CPU_NB_REGS32) {
 612             n = gpr_map32[n];
 613             env->regs[n] &= ~0xffffffffUL;
 614             env->regs[n] |= (uint32_t)ldl_p(mem_buf);
 615             return 4;
 616         }
 617     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 618 #ifdef USE_X86LDOUBLE
 619         /* FIXME: byteswap float values - after fixing fpregs layout. */
 620         memcpy(&env->fpregs[n - IDX_FP_REGS], mem_buf, 10);
 621 #endif
 622         return 10;
 623     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 624         n -= IDX_XMM_REGS;
 625         if (n < CPU_NB_REGS32 ||
 626             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 627             env->xmm_regs[n].XMM_Q(0) = ldq_p(mem_buf);
 628             env->xmm_regs[n].XMM_Q(1) = ldq_p(mem_buf + 8);
 629             return 16;
 630         }
 631     } else {
 632         switch (n) {
 633         case IDX_IP_REG:
 634             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 635                 env->eip = ldq_p(mem_buf);
 636                 return 8;
 637             } else {
 638                 env->eip &= ~0xffffffffUL;
 639                 env->eip |= (uint32_t)ldl_p(mem_buf);
 640                 return 4;
 641             }
 642         case IDX_FLAGS_REG:
 643             env->eflags = ldl_p(mem_buf);
 644             return 4;
 645
 646         case IDX_SEG_REGS:     return cpu_x86_gdb_load_seg(env, R_CS, mem_buf);
 647         case IDX_SEG_REGS + 1: return cpu_x86_gdb_load_seg(env, R_SS, mem_buf);
 648         case IDX_SEG_REGS + 2: return cpu_x86_gdb_load_seg(env, R_DS, mem_buf);
 649         case IDX_SEG_REGS + 3: return cpu_x86_gdb_load_seg(env, R_ES, mem_buf);
 650         case IDX_SEG_REGS + 4: return cpu_x86_gdb_load_seg(env, R_FS, mem_buf);
 651         case IDX_SEG_REGS + 5: return cpu_x86_gdb_load_seg(env, R_GS, mem_buf);
 652
 653         case IDX_FP_REGS + 8:
 654             env->fpuc = ldl_p(mem_buf);
 655             return 4;
 656         case IDX_FP_REGS + 9:
 657             tmp = ldl_p(mem_buf);
 658             env->fpstt = (tmp >> 11) & 7;
 659             env->fpus = tmp & ~0x3800;
 660             return 4;
 661         case IDX_FP_REGS + 10: /* ftag */  return 4;
 662         case IDX_FP_REGS + 11: /* fiseg */ return 4;
 663         case IDX_FP_REGS + 12: /* fioff */ return 4;
 664         case IDX_FP_REGS + 13: /* foseg */ return 4;
 665         case IDX_FP_REGS + 14: /* fooff */ return 4;
 666         case IDX_FP_REGS + 15: /* fop */   return 4;
 667
 668         case IDX_MXCSR_REG:
 669             env->mxcsr = ldl_p(mem_buf);
 670             return 4;
 671         }
 672     }
 673     /* Unrecognised register.  */
 674     return 0;
 675 }
 676
 677 #elif defined (TARGET_PPC)
 678
 679 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 680    expects whatever the target description contains.  Due to a
 681    historical mishap the FP registers appear in between core integer
 682    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 683    FP regs zero size when talking to a newer gdb.  */
 684 #define NUM_CORE_REGS 71
 685 #if defined (TARGET_PPC64)
 686 #define GDB_CORE_XML "power64-core.xml"
 687 #else
 688 #define GDB_CORE_XML "power-core.xml"
 689 #endif
 690
 691 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 692 {
 693     if (n < 32) {
 694         /* gprs */
 695         GET_REGL(env->gpr[n]);
 696     } else if (n < 64) {
 697         /* fprs */
 698         if (gdb_has_xml)
 699             return 0;
 700         stfq_p(mem_buf, env->fpr[n-32]);
 701         return 8;
 702     } else {
 703         switch (n) {
 704         case 64: GET_REGL(env->nip);
 705         case 65: GET_REGL(env->msr);
 706         case 66:
 707             {
 708                 uint32_t cr = 0;
 709                 int i;
 710                 for (i = 0; i < 8; i++)
 711                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 712                 GET_REG32(cr);
 713             }
 714         case 67: GET_REGL(env->lr);
 715         case 68: GET_REGL(env->ctr);
 716         case 69: GET_REGL(env->xer);
 717         case 70:
 718             {
 719                 if (gdb_has_xml)
 720                     return 0;
 721                 GET_REG32(0); /* fpscr */
 722             }
 723         }
 724     }
 725     return 0;
 726 }
 727
 728 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 729 {
 730     if (n < 32) {
 731         /* gprs */
 732         env->gpr[n] = ldtul_p(mem_buf);
 733         return sizeof(target_ulong);
 734     } else if (n < 64) {
 735         /* fprs */
 736         if (gdb_has_xml)
 737             return 0;
 738         env->fpr[n-32] = ldfq_p(mem_buf);
 739         return 8;
 740     } else {
 741         switch (n) {
 742         case 64:
 743             env->nip = ldtul_p(mem_buf);
 744             return sizeof(target_ulong);
 745         case 65:
 746             ppc_store_msr(env, ldtul_p(mem_buf));
 747             return sizeof(target_ulong);
 748         case 66:
 749             {
 750                 uint32_t cr = ldl_p(mem_buf);
 751                 int i;
 752                 for (i = 0; i < 8; i++)
 753                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 754                 return 4;
 755             }
 756         case 67:
 757             env->lr = ldtul_p(mem_buf);
 758             return sizeof(target_ulong);
 759         case 68:
 760             env->ctr = ldtul_p(mem_buf);
 761             return sizeof(target_ulong);
 762         case 69:
 763             env->xer = ldtul_p(mem_buf);
 764             return sizeof(target_ulong);
 765         case 70:
 766             /* fpscr */
 767             if (gdb_has_xml)
 768                 return 0;
 769             return 4;
 770         }
 771     }
 772     return 0;
 773 }
 774
 775 #elif defined (TARGET_SPARC)
 776
 777 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 778 #define NUM_CORE_REGS 86
 779 #else
 780 #define NUM_CORE_REGS 72
 781 #endif
 782
 783 #ifdef TARGET_ABI32
 784 #define GET_REGA(val) GET_REG32(val)
 785 #else
 786 #define GET_REGA(val) GET_REGL(val)
 787 #endif
 788
 789 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 790 {
 791     if (n < 8) {
 792         /* g0..g7 */
 793         GET_REGA(env->gregs[n]);
 794     }
 795     if (n < 32) {
 796         /* register window */
 797         GET_REGA(env->regwptr[n - 8]);
 798     }
 799 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 800     if (n < 64) {
 801         /* fprs */
 802         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 803     }
 804     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 805     switch (n) {
 806     case 64: GET_REGA(env->y);
 807     case 65: GET_REGA(GET_PSR(env));
 808     case 66: GET_REGA(env->wim);
 809     case 67: GET_REGA(env->tbr);
 810     case 68: GET_REGA(env->pc);
 811     case 69: GET_REGA(env->npc);
 812     case 70: GET_REGA(env->fsr);
 813     case 71: GET_REGA(0); /* csr */
 814     default: GET_REGA(0);
 815     }
 816 #else
 817     if (n < 64) {
 818         /* f0-f31 */
 819         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 820     }
 821     if (n < 80) {
 822         /* f32-f62 (double width, even numbers only) */
 823         uint64_t val;
 824
 825         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 826         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 827         GET_REG64(val);
 828     }
 829     switch (n) {
 830     case 80: GET_REGL(env->pc);
 831     case 81: GET_REGL(env->npc);
 832     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 833                            ((env->asi & 0xff) << 24) |
 834                            ((env->pstate & 0xfff) << 8) |
 835                            GET_CWP64(env));
 836     case 83: GET_REGL(env->fsr);
 837     case 84: GET_REGL(env->fprs);
 838     case 85: GET_REGL(env->y);
 839     }
 840 #endif
 841     return 0;
 842 }
 843
 844 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 845 {
 846 #if defined(TARGET_ABI32)
 847     abi_ulong tmp;
 848
 849     tmp = ldl_p(mem_buf);
 850 #else
 851     target_ulong tmp;
 852
 853     tmp = ldtul_p(mem_buf);
 854 #endif
 855
 856     if (n < 8) {
 857         /* g0..g7 */
 858         env->gregs[n] = tmp;
 859     } else if (n < 32) {
 860         /* register window */
 861         env->regwptr[n - 8] = tmp;
 862     }
 863 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 864     else if (n < 64) {
 865         /* fprs */
 866         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 867     } else {
 868         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 869         switch (n) {
 870         case 64: env->y = tmp; break;
 871         case 65: PUT_PSR(env, tmp); break;
 872         case 66: env->wim = tmp; break;
 873         case 67: env->tbr = tmp; break;
 874         case 68: env->pc = tmp; break;
 875         case 69: env->npc = tmp; break;
 876         case 70: env->fsr = tmp; break;
 877         default: return 0;
 878         }
 879     }
 880     return 4;
 881 #else
 882     else if (n < 64) {
 883         /* f0-f31 */
 884         env->fpr[n] = ldfl_p(mem_buf);
 885         return 4;
 886     } else if (n < 80) {
 887         /* f32-f62 (double width, even numbers only) */
 888         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 889         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 890     } else {
 891         switch (n) {
 892         case 80: env->pc = tmp; break;
 893         case 81: env->npc = tmp; break;
 894         case 82:
 895             PUT_CCR(env, tmp >> 32);
 896             env->asi = (tmp >> 24) & 0xff;
 897             env->pstate = (tmp >> 8) & 0xfff;
 898             PUT_CWP64(env, tmp & 0xff);
 899             break;
 900         case 83: env->fsr = tmp; break;
 901         case 84: env->fprs = tmp; break;
 902         case 85: env->y = tmp; break;
 903         default: return 0;
 904         }
 905     }
 906     return 8;
 907 #endif
 908 }
 909 #elif defined (TARGET_ARM)
 910
 911 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 912    whatever the target description contains.  Due to a historical mishap
 913    the FPA registers appear in between core integer regs and the CPSR.
 914    We hack round this by giving the FPA regs zero size when talking to a
 915    newer gdb.  */
 916 #define NUM_CORE_REGS 26
 917 #define GDB_CORE_XML "arm-core.xml"
 918
 919 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 920 {
 921     if (n < 16) {
 922         /* Core integer register.  */
 923         GET_REG32(env->regs[n]);
 924     }
 925     if (n < 24) {
 926         /* FPA registers.  */
 927         if (gdb_has_xml)
 928             return 0;
 929         memset(mem_buf, 0, 12);
 930         return 12;
 931     }
 932     switch (n) {
 933     case 24:
 934         /* FPA status register.  */
 935         if (gdb_has_xml)
 936             return 0;
 937         GET_REG32(0);
 938     case 25:
 939         /* CPSR */
 940         GET_REG32(cpsr_read(env));
 941     }
 942     /* Unknown register.  */
 943     return 0;
 944 }
 945
 946 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 947 {
 948     uint32_t tmp;
 949
 950     tmp = ldl_p(mem_buf);
 951
 952     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 953        cause problems if we ever implement the Jazelle DBX extensions.  */
 954     if (n == 15)
 955         tmp &= ~1;
 956
 957     if (n < 16) {
 958         /* Core integer register.  */
 959         env->regs[n] = tmp;
 960         return 4;
 961     }
 962     if (n < 24) { /* 16-23 */
 963         /* FPA registers (ignored).  */
 964         if (gdb_has_xml)
 965             return 0;
 966         return 12;
 967     }
 968     switch (n) {
 969     case 24:
 970         /* FPA status register (ignored).  */
 971         if (gdb_has_xml)
 972             return 0;
 973         return 4;
 974     case 25:
 975         /* CPSR */
 976         cpsr_write (env, tmp, 0xffffffff);
 977         return 4;
 978     }
 979     /* Unknown register.  */
 980     return 0;
 981 }
 982
 983 #elif defined (TARGET_M68K)
 984
 985 #define NUM_CORE_REGS 18
 986
 987 #define GDB_CORE_XML "cf-core.xml"
 988
 989 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 990 {
 991     if (n < 8) {
 992         /* D0-D7 */
 993         GET_REG32(env->dregs[n]);
 994     } else if (n < 16) {
 995         /* A0-A7 */
 996         GET_REG32(env->aregs[n - 8]);
 997     } else {
 998         switch (n) {
 999         case 16: GET_REG32(env->sr);
1000         case 17: GET_REG32(env->pc);
1001         }
1002     }
1003     /* FP registers not included here because they vary between
1004        ColdFire and m68k.  Use XML bits for these.  */
1005     return 0;
1006 }
1007
1008 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1009 {
1010     uint32_t tmp;
1011
1012     tmp = ldl_p(mem_buf);
1013
1014     if (n < 8) {
1015         /* D0-D7 */
1016         env->dregs[n] = tmp;
1017     } else if (n < 8) {
1018         /* A0-A7 */
1019         env->aregs[n - 8] = tmp;
1020     } else {
1021         switch (n) {
1022         case 16: env->sr = tmp; break;
1023         case 17: env->pc = tmp; break;
1024         default: return 0;
1025         }
1026     }
1027     return 4;
1028 }
1029 #elif defined (TARGET_MIPS)
1030
1031 #define NUM_CORE_REGS 73
1032
1033 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1034 {
1035     if (n < 32) {
1036         GET_REGL(env->active_tc.gpr[n]);
1037     }
1038     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
1039         if (n >= 38 && n < 70) {
1040             if (env->CP0_Status & (1 << CP0St_FR))
1041                 GET_REGL(env->active_fpu.fpr[n - 38].d);
1042             else
1043                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
1044         }
1045         switch (n) {
1046         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
1047         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
1048         }
1049     }
1050     switch (n) {
1051     case 32: GET_REGL((int32_t)env->CP0_Status);
1052     case 33: GET_REGL(env->active_tc.LO[0]);
1053     case 34: GET_REGL(env->active_tc.HI[0]);
1054     case 35: GET_REGL(env->CP0_BadVAddr);
1055     case 36: GET_REGL((int32_t)env->CP0_Cause);
1056     case 37: GET_REGL(env->active_tc.PC | !!(env->hflags & MIPS_HFLAG_M16));
1057     case 72: GET_REGL(0); /* fp */
1058     case 89: GET_REGL((int32_t)env->CP0_PRid);
1059     }
1060     if (n >= 73 && n <= 88) {
1061         /* 16 embedded regs.  */
1062         GET_REGL(0);
1063     }
1064
1065     return 0;
1066 }
1067
1068 /* convert MIPS rounding mode in FCR31 to IEEE library */
1069 static unsigned int ieee_rm[] =
1070   {
1071     float_round_nearest_even,
1072     float_round_to_zero,
1073     float_round_up,
1074     float_round_down
1075   };
1076 #define RESTORE_ROUNDING_MODE \
1077     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1078
1079 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1080 {
1081     target_ulong tmp;
1082
1083     tmp = ldtul_p(mem_buf);
1084
1085     if (n < 32) {
1086         env->active_tc.gpr[n] = tmp;
1087         return sizeof(target_ulong);
1088     }
1089     if (env->CP0_Config1 & (1 << CP0C1_FP)
1090             && n >= 38 && n < 73) {
1091         if (n < 70) {
1092             if (env->CP0_Status & (1 << CP0St_FR))
1093               env->active_fpu.fpr[n - 38].d = tmp;
1094             else
1095               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1096         }
1097         switch (n) {
1098         case 70:
1099             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1100             /* set rounding mode */
1101             RESTORE_ROUNDING_MODE;
1102 #ifndef CONFIG_SOFTFLOAT
1103             /* no floating point exception for native float */
1104             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1105 #endif
1106             break;
1107         case 71: env->active_fpu.fcr0 = tmp; break;
1108         }
1109         return sizeof(target_ulong);
1110     }
1111     switch (n) {
1112     case 32: env->CP0_Status = tmp; break;
1113     case 33: env->active_tc.LO[0] = tmp; break;
1114     case 34: env->active_tc.HI[0] = tmp; break;
1115     case 35: env->CP0_BadVAddr = tmp; break;
1116     case 36: env->CP0_Cause = tmp; break;
1117     case 37:
1118         env->active_tc.PC = tmp & ~(target_ulong)1;
1119         if (tmp & 1) {
1120             env->hflags |= MIPS_HFLAG_M16;
1121         } else {
1122             env->hflags &= ~(MIPS_HFLAG_M16);
1123         }
1124         break;
1125     case 72: /* fp, ignored */ break;
1126     default:
1127         if (n > 89)
1128             return 0;
1129         /* Other registers are readonly.  Ignore writes.  */
1130         break;
1131     }
1132
1133     return sizeof(target_ulong);
1134 }
1135 #elif defined (TARGET_SH4)
1136
1137 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1138 /* FIXME: We should use XML for this.  */
1139
1140 #define NUM_CORE_REGS 59
1141
1142 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1143 {
1144     if (n < 8) {
1145         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1146             GET_REGL(env->gregs[n + 16]);
1147         } else {
1148             GET_REGL(env->gregs[n]);
1149         }
1150     } else if (n < 16) {
1151         GET_REGL(env->gregs[n - 8]);
1152     } else if (n >= 25 && n < 41) {
1153         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1154     } else if (n >= 43 && n < 51) {
1155         GET_REGL(env->gregs[n - 43]);
1156     } else if (n >= 51 && n < 59) {
1157         GET_REGL(env->gregs[n - (51 - 16)]);
1158     }
1159     switch (n) {
1160     case 16: GET_REGL(env->pc);
1161     case 17: GET_REGL(env->pr);
1162     case 18: GET_REGL(env->gbr);
1163     case 19: GET_REGL(env->vbr);
1164     case 20: GET_REGL(env->mach);
1165     case 21: GET_REGL(env->macl);
1166     case 22: GET_REGL(env->sr);
1167     case 23: GET_REGL(env->fpul);
1168     case 24: GET_REGL(env->fpscr);
1169     case 41: GET_REGL(env->ssr);
1170     case 42: GET_REGL(env->spc);
1171     }
1172
1173     return 0;
1174 }
1175
1176 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1177 {
1178     uint32_t tmp;
1179
1180     tmp = ldl_p(mem_buf);
1181
1182     if (n < 8) {
1183         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1184             env->gregs[n + 16] = tmp;
1185         } else {
1186             env->gregs[n] = tmp;
1187         }
1188         return 4;
1189     } else if (n < 16) {
1190         env->gregs[n - 8] = tmp;
1191         return 4;
1192     } else if (n >= 25 && n < 41) {
1193         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1194     } else if (n >= 43 && n < 51) {
1195         env->gregs[n - 43] = tmp;
1196         return 4;
1197     } else if (n >= 51 && n < 59) {
1198         env->gregs[n - (51 - 16)] = tmp;
1199         return 4;
1200     }
1201     switch (n) {
1202     case 16: env->pc = tmp;
1203     case 17: env->pr = tmp;
1204     case 18: env->gbr = tmp;
1205     case 19: env->vbr = tmp;
1206     case 20: env->mach = tmp;
1207     case 21: env->macl = tmp;
1208     case 22: env->sr = tmp;
1209     case 23: env->fpul = tmp;
1210     case 24: env->fpscr = tmp;
1211     case 41: env->ssr = tmp;
1212     case 42: env->spc = tmp;
1213     default: return 0;
1214     }
1215
1216     return 4;
1217 }
1218 #elif defined (TARGET_MICROBLAZE)
1219
1220 #define NUM_CORE_REGS (32 + 5)
1221
1222 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1223 {
1224     if (n < 32) {
1225         GET_REG32(env->regs[n]);
1226     } else {
1227         GET_REG32(env->sregs[n - 32]);
1228     }
1229     return 0;
1230 }
1231
1232 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1233 {
1234     uint32_t tmp;
1235
1236     if (n > NUM_CORE_REGS)
1237         return 0;
1238
1239     tmp = ldl_p(mem_buf);
1240
1241     if (n < 32) {
1242         env->regs[n] = tmp;
1243     } else {
1244         env->sregs[n - 32] = tmp;
1245     }
1246     return 4;
1247 }
1248 #elif defined (TARGET_CRIS)
1249
1250 #define NUM_CORE_REGS 49
1251
1252 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1253 {
1254     uint8_t srs;
1255
1256     srs = env->pregs[PR_SRS];
1257     if (n < 16) {
1258         GET_REG32(env->regs[n]);
1259     }
1260
1261     if (n >= 21 && n < 32) {
1262         GET_REG32(env->pregs[n - 16]);
1263     }
1264     if (n >= 33 && n < 49) {
1265         GET_REG32(env->sregs[srs][n - 33]);
1266     }
1267     switch (n) {
1268     case 16: GET_REG8(env->pregs[0]);
1269     case 17: GET_REG8(env->pregs[1]);
1270     case 18: GET_REG32(env->pregs[2]);
1271     case 19: GET_REG8(srs);
1272     case 20: GET_REG16(env->pregs[4]);
1273     case 32: GET_REG32(env->pc);
1274     }
1275
1276     return 0;
1277 }
1278
1279 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1280 {
1281     uint32_t tmp;
1282
1283     if (n > 49)
1284         return 0;
1285
1286     tmp = ldl_p(mem_buf);
1287
1288     if (n < 16) {
1289         env->regs[n] = tmp;
1290     }
1291
1292     if (n >= 21 && n < 32) {
1293         env->pregs[n - 16] = tmp;
1294     }
1295
1296     /* FIXME: Should support function regs be writable?  */
1297     switch (n) {
1298     case 16: return 1;
1299     case 17: return 1;
1300     case 18: env->pregs[PR_PID] = tmp; break;
1301     case 19: return 1;
1302     case 20: return 2;
1303     case 32: env->pc = tmp; break;
1304     }
1305
1306     return 4;
1307 }
1308 #elif defined (TARGET_ALPHA)
1309
1310 #define NUM_CORE_REGS 65
1311
1312 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1313 {
1314     if (n < 31) {
1315        GET_REGL(env->ir[n]);
1316     }
1317     else if (n == 31) {
1318        GET_REGL(0);
1319     }
1320     else if (n<63) {
1321        uint64_t val;
1322
1323        val = *((uint64_t *)&env->fir[n-32]);
1324        GET_REGL(val);
1325     }
1326     else if (n==63) {
1327        GET_REGL(env->fpcr);
1328     }
1329     else if (n==64) {
1330        GET_REGL(env->pc);
1331     }
1332     else {
1333        GET_REGL(0);
1334     }
1335
1336     return 0;
1337 }
1338
1339 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1340 {
1341     target_ulong tmp;
1342     tmp = ldtul_p(mem_buf);
1343
1344     if (n < 31) {
1345         env->ir[n] = tmp;
1346     }
1347
1348     if (n > 31 && n < 63) {
1349         env->fir[n - 32] = ldfl_p(mem_buf);
1350     }
1351
1352     if (n == 64 ) {
1353        env->pc=tmp;
1354     }
1355
1356     return 8;
1357 }
1358 #elif defined (TARGET_S390X)
1359
1360 #define NUM_CORE_REGS S390_NUM_TOTAL_REGS
1361
1362 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1363 {
1364     switch (n) {
1365         case S390_PSWM_REGNUM: GET_REGL(env->psw.mask); break;
1366         case S390_PSWA_REGNUM: GET_REGL(env->psw.addr); break;
1367         case S390_R0_REGNUM ... S390_R15_REGNUM:
1368             GET_REGL(env->regs[n-S390_R0_REGNUM]); break;
1369         case S390_A0_REGNUM ... S390_A15_REGNUM:
1370             GET_REG32(env->aregs[n-S390_A0_REGNUM]); break;
1371         case S390_FPC_REGNUM: GET_REG32(env->fpc); break;
1372         case S390_F0_REGNUM ... S390_F15_REGNUM:
1373             /* XXX */
1374             break;
1375         case S390_PC_REGNUM: GET_REGL(env->psw.addr); break;
1376         case S390_CC_REGNUM: GET_REG32(env->cc); break;
1377     }
1378
1379     return 0;
1380 }
1381
1382 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1383 {
1384     target_ulong tmpl;
1385     uint32_t tmp32;
1386     int r = 8;
1387     tmpl = ldtul_p(mem_buf);
1388     tmp32 = ldl_p(mem_buf);
1389
1390     switch (n) {
1391         case S390_PSWM_REGNUM: env->psw.mask = tmpl; break;
1392         case S390_PSWA_REGNUM: env->psw.addr = tmpl; break;
1393         case S390_R0_REGNUM ... S390_R15_REGNUM:
1394             env->regs[n-S390_R0_REGNUM] = tmpl; break;
1395         case S390_A0_REGNUM ... S390_A15_REGNUM:
1396             env->aregs[n-S390_A0_REGNUM] = tmp32; r=4; break;
1397         case S390_FPC_REGNUM: env->fpc = tmp32; r=4; break;
1398         case S390_F0_REGNUM ... S390_F15_REGNUM:
1399             /* XXX */
1400             break;
1401         case S390_PC_REGNUM: env->psw.addr = tmpl; break;
1402         case S390_CC_REGNUM: env->cc = tmp32; r=4; break;
1403     }
1404
1405     return r;
1406 }
1407 #else
1408
1409 #define NUM_CORE_REGS 0
1410
1411 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1412 {
1413     return 0;
1414 }
1415
1416 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1417 {
1418     return 0;
1419 }
1420
1421 #endif
1422
1423 static int num_g_regs = NUM_CORE_REGS;
1424
1425 #ifdef GDB_CORE_XML
1426 /* Encode data using the encoding for 'x' packets.  */
1427 static int memtox(char *buf, const char *mem, int len)
1428 {
1429     char *p = buf;
1430     char c;
1431
1432     while (len--) {
1433         c = *(mem++);
1434         switch (c) {
1435         case '#': case '$': case '*': case '}':
1436             *(p++) = '}';
1437             *(p++) = c ^ 0x20;
1438             break;
1439         default:
1440             *(p++) = c;
1441             break;
1442         }
1443     }
1444     return p - buf;
1445 }
1446
1447 static const char *get_feature_xml(const char *p, const char **newp)
1448 {
1449     extern const char *const xml_builtin[][2];
1450     size_t len;
1451     int i;
1452     const char *name;
1453     static char target_xml[1024];
1454
1455     len = 0;
1456     while (p[len] && p[len] != ':')
1457         len++;
1458     *newp = p + len;
1459
1460     name = NULL;
1461     if (strncmp(p, "target.xml", len) == 0) {
1462         /* Generate the XML description for this CPU.  */
1463         if (!target_xml[0]) {
1464             GDBRegisterState *r;
1465
1466             snprintf(target_xml, sizeof(target_xml),
1467                      "<?xml version=\"1.0\"?>"
1468                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1469                      "<target>"
1470                      "<xi:include href=\"%s\"/>",
1471                      GDB_CORE_XML);
1472
1473             for (r = first_cpu->gdb_regs; r; r = r->next) {
1474                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
1475                 pstrcat(target_xml, sizeof(target_xml), r->xml);
1476                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
1477             }
1478             pstrcat(target_xml, sizeof(target_xml), "</target>");
1479         }
1480         return target_xml;
1481     }
1482     for (i = 0; ; i++) {
1483         name = xml_builtin[i][0];
1484         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1485             break;
1486     }
1487     return name ? xml_builtin[i][1] : NULL;
1488 }
1489 #endif
1490
1491 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1492 {
1493     GDBRegisterState *r;
1494
1495     if (reg < NUM_CORE_REGS)
1496         return cpu_gdb_read_register(env, mem_buf, reg);
1497
1498     for (r = env->gdb_regs; r; r = r->next) {
1499         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1500             return r->get_reg(env, mem_buf, reg - r->base_reg);
1501         }
1502     }
1503     return 0;
1504 }
1505
1506 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1507 {
1508     GDBRegisterState *r;
1509
1510     if (reg < NUM_CORE_REGS)
1511         return cpu_gdb_write_register(env, mem_buf, reg);
1512
1513     for (r = env->gdb_regs; r; r = r->next) {
1514         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1515             return r->set_reg(env, mem_buf, reg - r->base_reg);
1516         }
1517     }
1518     return 0;
1519 }
1520
1521 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1522    specifies the first register number and these registers are included in
1523    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1524    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1525  */
1526
1527 void gdb_register_coprocessor(CPUState * env,
1528                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1529                              int num_regs, const char *xml, int g_pos)
1530 {
1531     GDBRegisterState *s;
1532     GDBRegisterState **p;
1533     static int last_reg = NUM_CORE_REGS;
1534
1535     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1536     s->base_reg = last_reg;
1537     s->num_regs = num_regs;
1538     s->get_reg = get_reg;
1539     s->set_reg = set_reg;
1540     s->xml = xml;
1541     p = &env->gdb_regs;
1542     while (*p) {
1543         /* Check for duplicates.  */
1544         if (strcmp((*p)->xml, xml) == 0)
1545             return;
1546         p = &(*p)->next;
1547     }
1548     /* Add to end of list.  */
1549     last_reg += num_regs;
1550     *p = s;
1551     if (g_pos) {
1552         if (g_pos != s->base_reg) {
1553             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1554                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1555         } else {
1556             num_g_regs = last_reg;
1557         }
1558     }
1559 }
1560
1561 #ifndef CONFIG_USER_ONLY
1562 static const int xlat_gdb_type[] = {
1563     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1564     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1565     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1566 };
1567 #endif
1568
1569 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1570 {
1571     CPUState *env;
1572     int err = 0;
1573
1574     if (kvm_enabled())
1575         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1576
1577     switch (type) {
1578     case GDB_BREAKPOINT_SW:
1579     case GDB_BREAKPOINT_HW:
1580         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1581             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1582             if (err)
1583                 break;
1584         }
1585         return err;
1586 #ifndef CONFIG_USER_ONLY
1587     case GDB_WATCHPOINT_WRITE:
1588     case GDB_WATCHPOINT_READ:
1589     case GDB_WATCHPOINT_ACCESS:
1590         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1591             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1592                                         NULL);
1593             if (err)
1594                 break;
1595         }
1596         return err;
1597 #endif
1598     default:
1599         return -ENOSYS;
1600     }
1601 }
1602
1603 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1604 {
1605     CPUState *env;
1606     int err = 0;
1607
1608     if (kvm_enabled())
1609         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1610
1611     switch (type) {
1612     case GDB_BREAKPOINT_SW:
1613     case GDB_BREAKPOINT_HW:
1614         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1615             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1616             if (err)
1617                 break;
1618         }
1619         return err;
1620 #ifndef CONFIG_USER_ONLY
1621     case GDB_WATCHPOINT_WRITE:
1622     case GDB_WATCHPOINT_READ:
1623     case GDB_WATCHPOINT_ACCESS:
1624         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1625             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1626             if (err)
1627                 break;
1628         }
1629         return err;
1630 #endif
1631     default:
1632         return -ENOSYS;
1633     }
1634 }
1635
1636 static void gdb_breakpoint_remove_all(void)
1637 {
1638     CPUState *env;
1639
1640     if (kvm_enabled()) {
1641         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1642         return;
1643     }
1644
1645     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1646         cpu_breakpoint_remove_all(env, BP_GDB);
1647 #ifndef CONFIG_USER_ONLY
1648         cpu_watchpoint_remove_all(env, BP_GDB);
1649 #endif
1650     }
1651 }
1652
1653 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1654 {
1655 #if defined(TARGET_I386)
1656     cpu_synchronize_state(s->c_cpu);
1657     s->c_cpu->eip = pc;
1658 #elif defined (TARGET_PPC)
1659     s->c_cpu->nip = pc;
1660 #elif defined (TARGET_SPARC)
1661     s->c_cpu->pc = pc;
1662     s->c_cpu->npc = pc + 4;
1663 #elif defined (TARGET_ARM)
1664     s->c_cpu->regs[15] = pc;
1665 #elif defined (TARGET_SH4)
1666     s->c_cpu->pc = pc;
1667 #elif defined (TARGET_MIPS)
1668     s->c_cpu->active_tc.PC = pc & ~(target_ulong)1;
1669     if (pc & 1) {
1670         s->c_cpu->hflags |= MIPS_HFLAG_M16;
1671     } else {
1672         s->c_cpu->hflags &= ~(MIPS_HFLAG_M16);
1673     }
1674 #elif defined (TARGET_MICROBLAZE)
1675     s->c_cpu->sregs[SR_PC] = pc;
1676 #elif defined (TARGET_CRIS)
1677     s->c_cpu->pc = pc;
1678 #elif defined (TARGET_ALPHA)
1679     s->c_cpu->pc = pc;
1680 #elif defined (TARGET_S390X)
1681     cpu_synchronize_state(s->c_cpu);
1682     s->c_cpu->psw.addr = pc;
1683 #endif
1684 }
1685
1686 static inline int gdb_id(CPUState *env)
1687 {
1688 #if defined(CONFIG_USER_ONLY) && defined(CONFIG_USE_NPTL)
1689     return env->host_tid;
1690 #else
1691     return env->cpu_index + 1;
1692 #endif
1693 }
1694
1695 static CPUState *find_cpu(uint32_t thread_id)
1696 {
1697     CPUState *env;
1698
1699     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1700         if (gdb_id(env) == thread_id) {
1701             return env;
1702         }
1703     }
1704
1705     return NULL;
1706 }
1707
1708 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1709 {
1710     CPUState *env;
1711     const char *p;
1712     uint32_t thread;
1713     int ch, reg_size, type, res;
1714     char buf[MAX_PACKET_LENGTH];
1715     uint8_t mem_buf[MAX_PACKET_LENGTH];
1716     uint8_t *registers;
1717     target_ulong addr, len;
1718
1719 #ifdef DEBUG_GDB
1720     printf("command='%s'\n", line_buf);
1721 #endif
1722     p = line_buf;
1723     ch = *p++;
1724     switch(ch) {
1725     case '?':
1726         /* TODO: Make this return the correct value for user-mode.  */
1727         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1728                  gdb_id(s->c_cpu));
1729         put_packet(s, buf);
1730         /* Remove all the breakpoints when this query is issued,
1731          * because gdb is doing and initial connect and the state
1732          * should be cleaned up.
1733          */
1734         gdb_breakpoint_remove_all();
1735         break;
1736     case 'c':
1737         if (*p != '\0') {
1738             addr = strtoull(p, (char **)&p, 16);
1739             gdb_set_cpu_pc(s, addr);
1740         }
1741         s->signal = 0;
1742         gdb_continue(s);
1743         return RS_IDLE;
1744     case 'C':
1745         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1746         if (s->signal == -1)
1747             s->signal = 0;
1748         gdb_continue(s);
1749         return RS_IDLE;
1750     case 'v':
1751         if (strncmp(p, "Cont", 4) == 0) {
1752             int res_signal, res_thread;
1753
1754             p += 4;
1755             if (*p == '?') {
1756                 put_packet(s, "vCont;c;C;s;S");
1757                 break;
1758             }
1759             res = 0;
1760             res_signal = 0;
1761             res_thread = 0;
1762             while (*p) {
1763                 int action, signal;
1764
1765                 if (*p++ != ';') {
1766                     res = 0;
1767                     break;
1768                 }
1769                 action = *p++;
1770                 signal = 0;
1771                 if (action == 'C' || action == 'S') {
1772                     signal = strtoul(p, (char **)&p, 16);
1773                 } else if (action != 'c' && action != 's') {
1774                     res = 0;
1775                     break;
1776                 }
1777                 thread = 0;
1778                 if (*p == ':') {
1779                     thread = strtoull(p+1, (char **)&p, 16);
1780                 }
1781                 action = tolower(action);
1782                 if (res == 0 || (res == 'c' && action == 's')) {
1783                     res = action;
1784                     res_signal = signal;
1785                     res_thread = thread;
1786                 }
1787             }
1788             if (res) {
1789                 if (res_thread != -1 && res_thread != 0) {
1790                     env = find_cpu(res_thread);
1791                     if (env == NULL) {
1792                         put_packet(s, "E22");
1793                         break;
1794                     }
1795                     s->c_cpu = env;
1796                 }
1797                 if (res == 's') {
1798                     cpu_single_step(s->c_cpu, sstep_flags);
1799                 }
1800                 s->signal = res_signal;
1801                 gdb_continue(s);
1802                 return RS_IDLE;
1803             }
1804             break;
1805         } else {
1806             goto unknown_command;
1807         }
1808     case 'k':
1809         /* Kill the target */
1810         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1811         exit(0);
1812     case 'D':
1813         /* Detach packet */
1814         gdb_breakpoint_remove_all();
1815         gdb_continue(s);
1816         put_packet(s, "OK");
1817         break;
1818     case 's':
1819         if (*p != '\0') {
1820             addr = strtoull(p, (char **)&p, 16);
1821             gdb_set_cpu_pc(s, addr);
1822         }
1823         cpu_single_step(s->c_cpu, sstep_flags);
1824         gdb_continue(s);
1825         return RS_IDLE;
1826     case 'F':
1827         {
1828             target_ulong ret;
1829             target_ulong err;
1830
1831             ret = strtoull(p, (char **)&p, 16);
1832             if (*p == ',') {
1833                 p++;
1834                 err = strtoull(p, (char **)&p, 16);
1835             } else {
1836                 err = 0;
1837             }
1838             if (*p == ',')
1839                 p++;
1840             type = *p;
1841             if (gdb_current_syscall_cb)
1842                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1843             if (type == 'C') {
1844                 put_packet(s, "T02");
1845             } else {
1846                 gdb_continue(s);
1847             }
1848         }
1849         break;
1850     case 'g':
1851         cpu_synchronize_state(s->g_cpu);
1852         len = 0;
1853         for (addr = 0; addr < num_g_regs; addr++) {
1854             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1855             len += reg_size;
1856         }
1857         memtohex(buf, mem_buf, len);
1858         put_packet(s, buf);
1859         break;
1860     case 'G':
1861         cpu_synchronize_state(s->g_cpu);
1862         registers = mem_buf;
1863         len = strlen(p) / 2;
1864         hextomem((uint8_t *)registers, p, len);
1865         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1866             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1867             len -= reg_size;
1868             registers += reg_size;
1869         }
1870         put_packet(s, "OK");
1871         break;
1872     case 'm':
1873         addr = strtoull(p, (char **)&p, 16);
1874         if (*p == ',')
1875             p++;
1876         len = strtoull(p, NULL, 16);
1877         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1878             put_packet (s, "E14");
1879         } else {
1880             memtohex(buf, mem_buf, len);
1881             put_packet(s, buf);
1882         }
1883         break;
1884     case 'M':
1885         addr = strtoull(p, (char **)&p, 16);
1886         if (*p == ',')
1887             p++;
1888         len = strtoull(p, (char **)&p, 16);
1889         if (*p == ':')
1890             p++;
1891         hextomem(mem_buf, p, len);
1892         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1893             put_packet(s, "E14");
1894         else
1895             put_packet(s, "OK");
1896         break;
1897     case 'p':
1898         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1899            This works, but can be very slow.  Anything new enough to
1900            understand XML also knows how to use this properly.  */
1901         if (!gdb_has_xml)
1902             goto unknown_command;
1903         addr = strtoull(p, (char **)&p, 16);
1904         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1905         if (reg_size) {
1906             memtohex(buf, mem_buf, reg_size);
1907             put_packet(s, buf);
1908         } else {
1909             put_packet(s, "E14");
1910         }
1911         break;
1912     case 'P':
1913         if (!gdb_has_xml)
1914             goto unknown_command;
1915         addr = strtoull(p, (char **)&p, 16);
1916         if (*p == '=')
1917             p++;
1918         reg_size = strlen(p) / 2;
1919         hextomem(mem_buf, p, reg_size);
1920         gdb_write_register(s->g_cpu, mem_buf, addr);
1921         put_packet(s, "OK");
1922         break;
1923     case 'Z':
1924     case 'z':
1925         type = strtoul(p, (char **)&p, 16);
1926         if (*p == ',')
1927             p++;
1928         addr = strtoull(p, (char **)&p, 16);
1929         if (*p == ',')
1930             p++;
1931         len = strtoull(p, (char **)&p, 16);
1932         if (ch == 'Z')
1933             res = gdb_breakpoint_insert(addr, len, type);
1934         else
1935             res = gdb_breakpoint_remove(addr, len, type);
1936         if (res >= 0)
1937              put_packet(s, "OK");
1938         else if (res == -ENOSYS)
1939             put_packet(s, "");
1940         else
1941             put_packet(s, "E22");
1942         break;
1943     case 'H':
1944         type = *p++;
1945         thread = strtoull(p, (char **)&p, 16);
1946         if (thread == -1 || thread == 0) {
1947             put_packet(s, "OK");
1948             break;
1949         }
1950         env = find_cpu(thread);
1951         if (env == NULL) {
1952             put_packet(s, "E22");
1953             break;
1954         }
1955         switch (type) {
1956         case 'c':
1957             s->c_cpu = env;
1958             put_packet(s, "OK");
1959             break;
1960         case 'g':
1961             s->g_cpu = env;
1962             put_packet(s, "OK");
1963             break;
1964         default:
1965              put_packet(s, "E22");
1966              break;
1967         }
1968         break;
1969     case 'T':
1970         thread = strtoull(p, (char **)&p, 16);
1971         env = find_cpu(thread);
1972
1973         if (env != NULL) {
1974             put_packet(s, "OK");
1975         } else {
1976             put_packet(s, "E22");
1977         }
1978         break;
1979     case 'q':
1980     case 'Q':
1981         /* parse any 'q' packets here */
1982         if (!strcmp(p,"qemu.sstepbits")) {
1983             /* Query Breakpoint bit definitions */
1984             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
1985                      SSTEP_ENABLE,
1986                      SSTEP_NOIRQ,
1987                      SSTEP_NOTIMER);
1988             put_packet(s, buf);
1989             break;
1990         } else if (strncmp(p,"qemu.sstep",10) == 0) {
1991             /* Display or change the sstep_flags */
1992             p += 10;
1993             if (*p != '=') {
1994                 /* Display current setting */
1995                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
1996                 put_packet(s, buf);
1997                 break;
1998             }
1999             p++;
2000             type = strtoul(p, (char **)&p, 16);
2001             sstep_flags = type;
2002             put_packet(s, "OK");
2003             break;
2004         } else if (strcmp(p,"C") == 0) {
2005             /* "Current thread" remains vague in the spec, so always return
2006              *  the first CPU (gdb returns the first thread). */
2007             put_packet(s, "QC1");
2008             break;
2009         } else if (strcmp(p,"fThreadInfo") == 0) {
2010             s->query_cpu = first_cpu;
2011             goto report_cpuinfo;
2012         } else if (strcmp(p,"sThreadInfo") == 0) {
2013         report_cpuinfo:
2014             if (s->query_cpu) {
2015                 snprintf(buf, sizeof(buf), "m%x", gdb_id(s->query_cpu));
2016                 put_packet(s, buf);
2017                 s->query_cpu = s->query_cpu->next_cpu;
2018             } else
2019                 put_packet(s, "l");
2020             break;
2021         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
2022             thread = strtoull(p+16, (char **)&p, 16);
2023             env = find_cpu(thread);
2024             if (env != NULL) {
2025                 cpu_synchronize_state(env);
2026                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
2027                                "CPU#%d [%s]", env->cpu_index,
2028                                env->halted ? "halted " : "running");
2029                 memtohex(buf, mem_buf, len);
2030                 put_packet(s, buf);
2031             }
2032             break;
2033         }
2034 #ifdef CONFIG_USER_ONLY
2035         else if (strncmp(p, "Offsets", 7) == 0) {
2036             TaskState *ts = s->c_cpu->opaque;
2037
2038             snprintf(buf, sizeof(buf),
2039                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
2040                      ";Bss=" TARGET_ABI_FMT_lx,
2041                      ts->info->code_offset,
2042                      ts->info->data_offset,
2043                      ts->info->data_offset);
2044             put_packet(s, buf);
2045             break;
2046         }
2047 #else /* !CONFIG_USER_ONLY */
2048         else if (strncmp(p, "Rcmd,", 5) == 0) {
2049             int len = strlen(p + 5);
2050
2051             if ((len % 2) != 0) {
2052                 put_packet(s, "E01");
2053                 break;
2054             }
2055             hextomem(mem_buf, p + 5, len);
2056             len = len / 2;
2057             mem_buf[len++] = 0;
2058             qemu_chr_read(s->mon_chr, mem_buf, len);
2059             put_packet(s, "OK");
2060             break;
2061         }
2062 #endif /* !CONFIG_USER_ONLY */
2063         if (strncmp(p, "Supported", 9) == 0) {
2064             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
2065 #ifdef GDB_CORE_XML
2066             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
2067 #endif
2068             put_packet(s, buf);
2069             break;
2070         }
2071 #ifdef GDB_CORE_XML
2072         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
2073             const char *xml;
2074             target_ulong total_len;
2075
2076             gdb_has_xml = 1;
2077             p += 19;
2078             xml = get_feature_xml(p, &p);
2079             if (!xml) {
2080                 snprintf(buf, sizeof(buf), "E00");
2081                 put_packet(s, buf);
2082                 break;
2083             }
2084
2085             if (*p == ':')
2086                 p++;
2087             addr = strtoul(p, (char **)&p, 16);
2088             if (*p == ',')
2089                 p++;
2090             len = strtoul(p, (char **)&p, 16);
2091
2092             total_len = strlen(xml);
2093             if (addr > total_len) {
2094                 snprintf(buf, sizeof(buf), "E00");
2095                 put_packet(s, buf);
2096                 break;
2097             }
2098             if (len > (MAX_PACKET_LENGTH - 5) / 2)
2099                 len = (MAX_PACKET_LENGTH - 5) / 2;
2100             if (len < total_len - addr) {
2101                 buf[0] = 'm';
2102                 len = memtox(buf + 1, xml + addr, len);
2103             } else {
2104                 buf[0] = 'l';
2105                 len = memtox(buf + 1, xml + addr, total_len - addr);
2106             }
2107             put_packet_binary(s, buf, len + 1);
2108             break;
2109         }
2110 #endif
2111         /* Unrecognised 'q' command.  */
2112         goto unknown_command;
2113
2114     default:
2115     unknown_command:
2116         /* put empty packet */
2117         buf[0] = '\0';
2118         put_packet(s, buf);
2119         break;
2120     }
2121     return RS_IDLE;
2122 }
2123
2124 void gdb_set_stop_cpu(CPUState *env)
2125 {
2126     gdbserver_state->c_cpu = env;
2127     gdbserver_state->g_cpu = env;
2128 }
2129
2130 #ifndef CONFIG_USER_ONLY
2131 static void gdb_vm_state_change(void *opaque, int running, int reason)
2132 {
2133     GDBState *s = gdbserver_state;
2134     CPUState *env = s->c_cpu;
2135     char buf[256];
2136     const char *type;
2137     int ret;
2138
2139     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
2140         s->state == RS_INACTIVE || s->state == RS_SYSCALL)
2141         return;
2142
2143     /* disable single step if it was enable */
2144     cpu_single_step(env, 0);
2145
2146     if (reason == EXCP_DEBUG) {
2147         if (env->watchpoint_hit) {
2148             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
2149             case BP_MEM_READ:
2150                 type = "r";
2151                 break;
2152             case BP_MEM_ACCESS:
2153                 type = "a";
2154                 break;
2155             default:
2156                 type = "";
2157                 break;
2158             }
2159             snprintf(buf, sizeof(buf),
2160                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
2161                      GDB_SIGNAL_TRAP, gdb_id(env), type,
2162                      env->watchpoint_hit->vaddr);
2163             put_packet(s, buf);
2164             env->watchpoint_hit = NULL;
2165             return;
2166         }
2167         tb_flush(env);
2168         ret = GDB_SIGNAL_TRAP;
2169     } else {
2170         ret = GDB_SIGNAL_INT;
2171     }
2172     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, gdb_id(env));
2173     put_packet(s, buf);
2174 }
2175 #endif
2176
2177 /* Send a gdb syscall request.
2178    This accepts limited printf-style format specifiers, specifically:
2179     %x  - target_ulong argument printed in hex.
2180     %lx - 64-bit argument printed in hex.
2181     %s  - string pointer (target_ulong) and length (int) pair.  */
2182 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
2183 {
2184     va_list va;
2185     char buf[256];
2186     char *p;
2187     target_ulong addr;
2188     uint64_t i64;
2189     GDBState *s;
2190
2191     s = gdbserver_state;
2192     if (!s)
2193         return;
2194     gdb_current_syscall_cb = cb;
2195     s->state = RS_SYSCALL;
2196 #ifndef CONFIG_USER_ONLY
2197     vm_stop(EXCP_DEBUG);
2198 #endif
2199     s->state = RS_IDLE;
2200     va_start(va, fmt);
2201     p = buf;
2202     *(p++) = 'F';
2203     while (*fmt) {
2204         if (*fmt == '%') {
2205             fmt++;
2206             switch (*fmt++) {
2207             case 'x':
2208                 addr = va_arg(va, target_ulong);
2209                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
2210                 break;
2211             case 'l':
2212                 if (*(fmt++) != 'x')
2213                     goto bad_format;
2214                 i64 = va_arg(va, uint64_t);
2215                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
2216                 break;
2217             case 's':
2218                 addr = va_arg(va, target_ulong);
2219                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
2220                               addr, va_arg(va, int));
2221                 break;
2222             default:
2223             bad_format:
2224                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2225                         fmt - 1);
2226                 break;
2227             }
2228         } else {
2229             *(p++) = *(fmt++);
2230         }
2231     }
2232     *p = 0;
2233     va_end(va);
2234     put_packet(s, buf);
2235 #ifdef CONFIG_USER_ONLY
2236     gdb_handlesig(s->c_cpu, 0);
2237 #else
2238     cpu_exit(s->c_cpu);
2239 #endif
2240 }
2241
2242 static void gdb_read_byte(GDBState *s, int ch)
2243 {
2244     int i, csum;
2245     uint8_t reply;
2246
2247 #ifndef CONFIG_USER_ONLY
2248     if (s->last_packet_len) {
2249         /* Waiting for a response to the last packet.  If we see the start
2250            of a new command then abandon the previous response.  */
2251         if (ch == '-') {
2252 #ifdef DEBUG_GDB
2253             printf("Got NACK, retransmitting\n");
2254 #endif
2255             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2256         }
2257 #ifdef DEBUG_GDB
2258         else if (ch == '+')
2259             printf("Got ACK\n");
2260         else
2261             printf("Got '%c' when expecting ACK/NACK\n", ch);
2262 #endif
2263         if (ch == '+' || ch == '$')
2264             s->last_packet_len = 0;
2265         if (ch != '$')
2266             return;
2267     }
2268     if (vm_running) {
2269         /* when the CPU is running, we cannot do anything except stop
2270            it when receiving a char */
2271         vm_stop(EXCP_INTERRUPT);
2272     } else
2273 #endif
2274     {
2275         switch(s->state) {
2276         case RS_IDLE:
2277             if (ch == '$') {
2278                 s->line_buf_index = 0;
2279                 s->state = RS_GETLINE;
2280             }
2281             break;
2282         case RS_GETLINE:
2283             if (ch == '#') {
2284             s->state = RS_CHKSUM1;
2285             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2286                 s->state = RS_IDLE;
2287             } else {
2288             s->line_buf[s->line_buf_index++] = ch;
2289             }
2290             break;
2291         case RS_CHKSUM1:
2292             s->line_buf[s->line_buf_index] = '\0';
2293             s->line_csum = fromhex(ch) << 4;
2294             s->state = RS_CHKSUM2;
2295             break;
2296         case RS_CHKSUM2:
2297             s->line_csum |= fromhex(ch);
2298             csum = 0;
2299             for(i = 0; i < s->line_buf_index; i++) {
2300                 csum += s->line_buf[i];
2301             }
2302             if (s->line_csum != (csum & 0xff)) {
2303                 reply = '-';
2304                 put_buffer(s, &reply, 1);
2305                 s->state = RS_IDLE;
2306             } else {
2307                 reply = '+';
2308                 put_buffer(s, &reply, 1);
2309                 s->state = gdb_handle_packet(s, s->line_buf);
2310             }
2311             break;
2312         default:
2313             abort();
2314         }
2315     }
2316 }
2317
2318 #ifdef CONFIG_USER_ONLY
2319 int
2320 gdb_queuesig (void)
2321 {
2322     GDBState *s;
2323
2324     s = gdbserver_state;
2325
2326     if (gdbserver_fd < 0 || s->fd < 0)
2327         return 0;
2328     else
2329         return 1;
2330 }
2331
2332 int
2333 gdb_handlesig (CPUState *env, int sig)
2334 {
2335   GDBState *s;
2336   char buf[256];
2337   int n;
2338
2339   s = gdbserver_state;
2340   if (gdbserver_fd < 0 || s->fd < 0)
2341     return sig;
2342
2343   /* disable single step if it was enabled */
2344   cpu_single_step(env, 0);
2345   tb_flush(env);
2346
2347   if (sig != 0)
2348     {
2349       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2350       put_packet(s, buf);
2351     }
2352   /* put_packet() might have detected that the peer terminated the
2353      connection.  */
2354   if (s->fd < 0)
2355       return sig;
2356
2357   sig = 0;
2358   s->state = RS_IDLE;
2359   s->running_state = 0;
2360   while (s->running_state == 0) {
2361       n = read (s->fd, buf, 256);
2362       if (n > 0)
2363         {
2364           int i;
2365
2366           for (i = 0; i < n; i++)
2367             gdb_read_byte (s, buf[i]);
2368         }
2369       else if (n == 0 || errno != EAGAIN)
2370         {
2371           /* XXX: Connection closed.  Should probably wait for annother
2372              connection before continuing.  */
2373           return sig;
2374         }
2375   }
2376   sig = s->signal;
2377   s->signal = 0;
2378   return sig;
2379 }
2380
2381 /* Tell the remote gdb that the process has exited.  */
2382 void gdb_exit(CPUState *env, int code)
2383 {
2384   GDBState *s;
2385   char buf[4];
2386
2387   s = gdbserver_state;
2388   if (gdbserver_fd < 0 || s->fd < 0)
2389     return;
2390
2391   snprintf(buf, sizeof(buf), "W%02x", code);
2392   put_packet(s, buf);
2393 }
2394
2395 /* Tell the remote gdb that the process has exited due to SIG.  */
2396 void gdb_signalled(CPUState *env, int sig)
2397 {
2398   GDBState *s;
2399   char buf[4];
2400
2401   s = gdbserver_state;
2402   if (gdbserver_fd < 0 || s->fd < 0)
2403     return;
2404
2405   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2406   put_packet(s, buf);
2407 }
2408
2409 static void gdb_accept(void)
2410 {
2411     GDBState *s;
2412     struct sockaddr_in sockaddr;
2413     socklen_t len;
2414     int val, fd;
2415
2416     for(;;) {
2417         len = sizeof(sockaddr);
2418         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2419         if (fd < 0 && errno != EINTR) {
2420             perror("accept");
2421             return;
2422         } else if (fd >= 0) {
2423 #ifndef _WIN32
2424             fcntl(fd, F_SETFD, FD_CLOEXEC);
2425 #endif
2426             break;
2427         }
2428     }
2429
2430     /* set short latency */
2431     val = 1;
2432     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2433
2434     s = qemu_mallocz(sizeof(GDBState));
2435     s->c_cpu = first_cpu;
2436     s->g_cpu = first_cpu;
2437     s->fd = fd;
2438     gdb_has_xml = 0;
2439
2440     gdbserver_state = s;
2441
2442     fcntl(fd, F_SETFL, O_NONBLOCK);
2443 }
2444
2445 static int gdbserver_open(int port)
2446 {
2447     struct sockaddr_in sockaddr;
2448     int fd, val, ret;
2449
2450     fd = socket(PF_INET, SOCK_STREAM, 0);
2451     if (fd < 0) {
2452         perror("socket");
2453         return -1;
2454     }
2455 #ifndef _WIN32
2456     fcntl(fd, F_SETFD, FD_CLOEXEC);
2457 #endif
2458
2459     /* allow fast reuse */
2460     val = 1;
2461     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2462
2463     sockaddr.sin_family = AF_INET;
2464     sockaddr.sin_port = htons(port);
2465     sockaddr.sin_addr.s_addr = 0;
2466     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2467     if (ret < 0) {
2468         perror("bind");
2469         return -1;
2470     }
2471     ret = listen(fd, 0);
2472     if (ret < 0) {
2473         perror("listen");
2474         return -1;
2475     }
2476     return fd;
2477 }
2478
2479 int gdbserver_start(int port)
2480 {
2481     gdbserver_fd = gdbserver_open(port);
2482     if (gdbserver_fd < 0)
2483         return -1;
2484     /* accept connections */
2485     gdb_accept();
2486     return 0;
2487 }
2488
2489 /* Disable gdb stub for child processes.  */
2490 void gdbserver_fork(CPUState *env)
2491 {
2492     GDBState *s = gdbserver_state;
2493     if (gdbserver_fd < 0 || s->fd < 0)
2494       return;
2495     close(s->fd);
2496     s->fd = -1;
2497     cpu_breakpoint_remove_all(env, BP_GDB);
2498     cpu_watchpoint_remove_all(env, BP_GDB);
2499 }
2500 #else
2501 static int gdb_chr_can_receive(void *opaque)
2502 {
2503   /* We can handle an arbitrarily large amount of data.
2504    Pick the maximum packet size, which is as good as anything.  */
2505   return MAX_PACKET_LENGTH;
2506 }
2507
2508 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2509 {
2510     int i;
2511
2512     for (i = 0; i < size; i++) {
2513         gdb_read_byte(gdbserver_state, buf[i]);
2514     }
2515 }
2516
2517 static void gdb_chr_event(void *opaque, int event)
2518 {
2519     switch (event) {
2520     case CHR_EVENT_OPENED:
2521         vm_stop(EXCP_INTERRUPT);
2522         gdb_has_xml = 0;
2523         break;
2524     default:
2525         break;
2526     }
2527 }
2528
2529 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2530 {
2531     char buf[MAX_PACKET_LENGTH];
2532
2533     buf[0] = 'O';
2534     if (len > (MAX_PACKET_LENGTH/2) - 1)
2535         len = (MAX_PACKET_LENGTH/2) - 1;
2536     memtohex(buf + 1, (uint8_t *)msg, len);
2537     put_packet(s, buf);
2538 }
2539
2540 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2541 {
2542     const char *p = (const char *)buf;
2543     int max_sz;
2544
2545     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2546     for (;;) {
2547         if (len <= max_sz) {
2548             gdb_monitor_output(gdbserver_state, p, len);
2549             break;
2550         }
2551         gdb_monitor_output(gdbserver_state, p, max_sz);
2552         p += max_sz;
2553         len -= max_sz;
2554     }
2555     return len;
2556 }
2557
2558 #ifndef _WIN32
2559 static void gdb_sigterm_handler(int signal)
2560 {
2561     if (vm_running)
2562         vm_stop(EXCP_INTERRUPT);
2563 }
2564 #endif
2565
2566 int gdbserver_start(const char *device)
2567 {
2568     GDBState *s;
2569     char gdbstub_device_name[128];
2570     CharDriverState *chr = NULL;
2571     CharDriverState *mon_chr;
2572
2573     if (!device)
2574         return -1;
2575     if (strcmp(device, "none") != 0) {
2576         if (strstart(device, "tcp:", NULL)) {
2577             /* enforce required TCP attributes */
2578             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2579                      "%s,nowait,nodelay,server", device);
2580             device = gdbstub_device_name;
2581         }
2582 #ifndef _WIN32
2583         else if (strcmp(device, "stdio") == 0) {
2584             struct sigaction act;
2585
2586             memset(&act, 0, sizeof(act));
2587             act.sa_handler = gdb_sigterm_handler;
2588             sigaction(SIGINT, &act, NULL);
2589         }
2590 #endif
2591         chr = qemu_chr_open("gdb", device, NULL);
2592         if (!chr)
2593             return -1;
2594
2595         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2596                               gdb_chr_event, NULL);
2597     }
2598
2599     s = gdbserver_state;
2600     if (!s) {
2601         s = qemu_mallocz(sizeof(GDBState));
2602         gdbserver_state = s;
2603
2604         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2605
2606         /* Initialize a monitor terminal for gdb */
2607         mon_chr = qemu_mallocz(sizeof(*mon_chr));
2608         mon_chr->chr_write = gdb_monitor_write;
2609         monitor_init(mon_chr, 0);
2610     } else {
2611         if (s->chr)
2612             qemu_chr_close(s->chr);
2613         mon_chr = s->mon_chr;
2614         memset(s, 0, sizeof(GDBState));
2615     }
2616     s->c_cpu = first_cpu;
2617     s->g_cpu = first_cpu;
2618     s->chr = chr;
2619     s->state = chr ? RS_IDLE : RS_INACTIVE;
2620     s->mon_chr = mon_chr;
2621
2622     return 0;
2623 }
2624 #endif