gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "qemu-common.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "monitor.h"
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #endif
  37
  38 #define MAX_PACKET_LENGTH 4096
  39
  40 #include "qemu_socket.h"
  41 #include "kvm.h"
  42
  43
  44 enum {
  45     GDB_SIGNAL_0 = 0,
  46     GDB_SIGNAL_INT = 2,
  47     GDB_SIGNAL_TRAP = 5,
  48     GDB_SIGNAL_UNKNOWN = 143
  49 };
  50
  51 #ifdef CONFIG_USER_ONLY
  52
  53 /* Map target signal numbers to GDB protocol signal numbers and vice
  54  * versa.  For user emulation's currently supported systems, we can
  55  * assume most signals are defined.
  56  */
  57
  58 static int gdb_signal_table[] = {
  59     0,
  60     TARGET_SIGHUP,
  61     TARGET_SIGINT,
  62     TARGET_SIGQUIT,
  63     TARGET_SIGILL,
  64     TARGET_SIGTRAP,
  65     TARGET_SIGABRT,
  66     -1, /* SIGEMT */
  67     TARGET_SIGFPE,
  68     TARGET_SIGKILL,
  69     TARGET_SIGBUS,
  70     TARGET_SIGSEGV,
  71     TARGET_SIGSYS,
  72     TARGET_SIGPIPE,
  73     TARGET_SIGALRM,
  74     TARGET_SIGTERM,
  75     TARGET_SIGURG,
  76     TARGET_SIGSTOP,
  77     TARGET_SIGTSTP,
  78     TARGET_SIGCONT,
  79     TARGET_SIGCHLD,
  80     TARGET_SIGTTIN,
  81     TARGET_SIGTTOU,
  82     TARGET_SIGIO,
  83     TARGET_SIGXCPU,
  84     TARGET_SIGXFSZ,
  85     TARGET_SIGVTALRM,
  86     TARGET_SIGPROF,
  87     TARGET_SIGWINCH,
  88     -1, /* SIGLOST */
  89     TARGET_SIGUSR1,
  90     TARGET_SIGUSR2,
  91 #ifdef TARGET_SIGPWR
  92     TARGET_SIGPWR,
  93 #else
  94     -1,
  95 #endif
  96     -1, /* SIGPOLL */
  97     -1,
  98     -1,
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108 #ifdef __SIGRTMIN
 109     __SIGRTMIN + 1,
 110     __SIGRTMIN + 2,
 111     __SIGRTMIN + 3,
 112     __SIGRTMIN + 4,
 113     __SIGRTMIN + 5,
 114     __SIGRTMIN + 6,
 115     __SIGRTMIN + 7,
 116     __SIGRTMIN + 8,
 117     __SIGRTMIN + 9,
 118     __SIGRTMIN + 10,
 119     __SIGRTMIN + 11,
 120     __SIGRTMIN + 12,
 121     __SIGRTMIN + 13,
 122     __SIGRTMIN + 14,
 123     __SIGRTMIN + 15,
 124     __SIGRTMIN + 16,
 125     __SIGRTMIN + 17,
 126     __SIGRTMIN + 18,
 127     __SIGRTMIN + 19,
 128     __SIGRTMIN + 20,
 129     __SIGRTMIN + 21,
 130     __SIGRTMIN + 22,
 131     __SIGRTMIN + 23,
 132     __SIGRTMIN + 24,
 133     __SIGRTMIN + 25,
 134     __SIGRTMIN + 26,
 135     __SIGRTMIN + 27,
 136     __SIGRTMIN + 28,
 137     __SIGRTMIN + 29,
 138     __SIGRTMIN + 30,
 139     __SIGRTMIN + 31,
 140     -1, /* SIGCANCEL */
 141     __SIGRTMIN,
 142     __SIGRTMIN + 32,
 143     __SIGRTMIN + 33,
 144     __SIGRTMIN + 34,
 145     __SIGRTMIN + 35,
 146     __SIGRTMIN + 36,
 147     __SIGRTMIN + 37,
 148     __SIGRTMIN + 38,
 149     __SIGRTMIN + 39,
 150     __SIGRTMIN + 40,
 151     __SIGRTMIN + 41,
 152     __SIGRTMIN + 42,
 153     __SIGRTMIN + 43,
 154     __SIGRTMIN + 44,
 155     __SIGRTMIN + 45,
 156     __SIGRTMIN + 46,
 157     __SIGRTMIN + 47,
 158     __SIGRTMIN + 48,
 159     __SIGRTMIN + 49,
 160     __SIGRTMIN + 50,
 161     __SIGRTMIN + 51,
 162     __SIGRTMIN + 52,
 163     __SIGRTMIN + 53,
 164     __SIGRTMIN + 54,
 165     __SIGRTMIN + 55,
 166     __SIGRTMIN + 56,
 167     __SIGRTMIN + 57,
 168     __SIGRTMIN + 58,
 169     __SIGRTMIN + 59,
 170     __SIGRTMIN + 60,
 171     __SIGRTMIN + 61,
 172     __SIGRTMIN + 62,
 173     __SIGRTMIN + 63,
 174     __SIGRTMIN + 64,
 175     __SIGRTMIN + 65,
 176     __SIGRTMIN + 66,
 177     __SIGRTMIN + 67,
 178     __SIGRTMIN + 68,
 179     __SIGRTMIN + 69,
 180     __SIGRTMIN + 70,
 181     __SIGRTMIN + 71,
 182     __SIGRTMIN + 72,
 183     __SIGRTMIN + 73,
 184     __SIGRTMIN + 74,
 185     __SIGRTMIN + 75,
 186     __SIGRTMIN + 76,
 187     __SIGRTMIN + 77,
 188     __SIGRTMIN + 78,
 189     __SIGRTMIN + 79,
 190     __SIGRTMIN + 80,
 191     __SIGRTMIN + 81,
 192     __SIGRTMIN + 82,
 193     __SIGRTMIN + 83,
 194     __SIGRTMIN + 84,
 195     __SIGRTMIN + 85,
 196     __SIGRTMIN + 86,
 197     __SIGRTMIN + 87,
 198     __SIGRTMIN + 88,
 199     __SIGRTMIN + 89,
 200     __SIGRTMIN + 90,
 201     __SIGRTMIN + 91,
 202     __SIGRTMIN + 92,
 203     __SIGRTMIN + 93,
 204     __SIGRTMIN + 94,
 205     __SIGRTMIN + 95,
 206     -1, /* SIGINFO */
 207     -1, /* UNKNOWN */
 208     -1, /* DEFAULT */
 209     -1,
 210     -1,
 211     -1,
 212     -1,
 213     -1,
 214     -1
 215 #endif
 216 };
 217 #else
 218 /* In system mode we only need SIGINT and SIGTRAP; other signals
 219    are not yet supported.  */
 220
 221 enum {
 222     TARGET_SIGINT = 2,
 223     TARGET_SIGTRAP = 5
 224 };
 225
 226 static int gdb_signal_table[] = {
 227     -1,
 228     -1,
 229     TARGET_SIGINT,
 230     -1,
 231     -1,
 232     TARGET_SIGTRAP
 233 };
 234 #endif
 235
 236 #ifdef CONFIG_USER_ONLY
 237 static int target_signal_to_gdb (int sig)
 238 {
 239     int i;
 240     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 241         if (gdb_signal_table[i] == sig)
 242             return i;
 243     return GDB_SIGNAL_UNKNOWN;
 244 }
 245 #endif
 246
 247 static int gdb_signal_to_target (int sig)
 248 {
 249     if (sig < ARRAY_SIZE (gdb_signal_table))
 250         return gdb_signal_table[sig];
 251     else
 252         return -1;
 253 }
 254
 255 //#define DEBUG_GDB
 256
 257 typedef struct GDBRegisterState {
 258     int base_reg;
 259     int num_regs;
 260     gdb_reg_cb get_reg;
 261     gdb_reg_cb set_reg;
 262     const char *xml;
 263     struct GDBRegisterState *next;
 264 } GDBRegisterState;
 265
 266 enum RSState {
 267     RS_INACTIVE,
 268     RS_IDLE,
 269     RS_GETLINE,
 270     RS_CHKSUM1,
 271     RS_CHKSUM2,
 272     RS_SYSCALL,
 273 };
 274 typedef struct GDBState {
 275     CPUState *c_cpu; /* current CPU for step/continue ops */
 276     CPUState *g_cpu; /* current CPU for other ops */
 277     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 278     enum RSState state; /* parsing state */
 279     char line_buf[MAX_PACKET_LENGTH];
 280     int line_buf_index;
 281     int line_csum;
 282     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 283     int last_packet_len;
 284     int signal;
 285 #ifdef CONFIG_USER_ONLY
 286     int fd;
 287     int running_state;
 288 #else
 289     CharDriverState *chr;
 290     CharDriverState *mon_chr;
 291 #endif
 292 } GDBState;
 293
 294 /* By default use no IRQs and no timers while single stepping so as to
 295  * make single stepping like an ICE HW step.
 296  */
 297 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 298
 299 static GDBState *gdbserver_state;
 300
 301 /* This is an ugly hack to cope with both new and old gdb.
 302    If gdb sends qXfer:features:read then assume we're talking to a newish
 303    gdb that understands target descriptions.  */
 304 static int gdb_has_xml;
 305
 306 #ifdef CONFIG_USER_ONLY
 307 /* XXX: This is not thread safe.  Do we care?  */
 308 static int gdbserver_fd = -1;
 309
 310 static int get_char(GDBState *s)
 311 {
 312     uint8_t ch;
 313     int ret;
 314
 315     for(;;) {
 316         ret = recv(s->fd, &ch, 1, 0);
 317         if (ret < 0) {
 318             if (errno == ECONNRESET)
 319                 s->fd = -1;
 320             if (errno != EINTR && errno != EAGAIN)
 321                 return -1;
 322         } else if (ret == 0) {
 323             close(s->fd);
 324             s->fd = -1;
 325             return -1;
 326         } else {
 327             break;
 328         }
 329     }
 330     return ch;
 331 }
 332 #endif
 333
 334 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 335
 336 static enum {
 337     GDB_SYS_UNKNOWN,
 338     GDB_SYS_ENABLED,
 339     GDB_SYS_DISABLED,
 340 } gdb_syscall_mode;
 341
 342 /* If gdb is connected when the first semihosting syscall occurs then use
 343    remote gdb syscalls.  Otherwise use native file IO.  */
 344 int use_gdb_syscalls(void)
 345 {
 346     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 347         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 348                                             : GDB_SYS_DISABLED);
 349     }
 350     return gdb_syscall_mode == GDB_SYS_ENABLED;
 351 }
 352
 353 /* Resume execution.  */
 354 static inline void gdb_continue(GDBState *s)
 355 {
 356 #ifdef CONFIG_USER_ONLY
 357     s->running_state = 1;
 358 #else
 359     vm_start();
 360 #endif
 361 }
 362
 363 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 364 {
 365 #ifdef CONFIG_USER_ONLY
 366     int ret;
 367
 368     while (len > 0) {
 369         ret = send(s->fd, buf, len, 0);
 370         if (ret < 0) {
 371             if (errno != EINTR && errno != EAGAIN)
 372                 return;
 373         } else {
 374             buf += ret;
 375             len -= ret;
 376         }
 377     }
 378 #else
 379     qemu_chr_write(s->chr, buf, len);
 380 #endif
 381 }
 382
 383 static inline int fromhex(int v)
 384 {
 385     if (v >= '0' && v <= '9')
 386         return v - '0';
 387     else if (v >= 'A' && v <= 'F')
 388         return v - 'A' + 10;
 389     else if (v >= 'a' && v <= 'f')
 390         return v - 'a' + 10;
 391     else
 392         return 0;
 393 }
 394
 395 static inline int tohex(int v)
 396 {
 397     if (v < 10)
 398         return v + '0';
 399     else
 400         return v - 10 + 'a';
 401 }
 402
 403 static void memtohex(char *buf, const uint8_t *mem, int len)
 404 {
 405     int i, c;
 406     char *q;
 407     q = buf;
 408     for(i = 0; i < len; i++) {
 409         c = mem[i];
 410         *q++ = tohex(c >> 4);
 411         *q++ = tohex(c & 0xf);
 412     }
 413     *q = '\0';
 414 }
 415
 416 static void hextomem(uint8_t *mem, const char *buf, int len)
 417 {
 418     int i;
 419
 420     for(i = 0; i < len; i++) {
 421         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 422         buf += 2;
 423     }
 424 }
 425
 426 /* return -1 if error, 0 if OK */
 427 static int put_packet_binary(GDBState *s, const char *buf, int len)
 428 {
 429     int csum, i;
 430     uint8_t *p;
 431
 432     for(;;) {
 433         p = s->last_packet;
 434         *(p++) = '$';
 435         memcpy(p, buf, len);
 436         p += len;
 437         csum = 0;
 438         for(i = 0; i < len; i++) {
 439             csum += buf[i];
 440         }
 441         *(p++) = '#';
 442         *(p++) = tohex((csum >> 4) & 0xf);
 443         *(p++) = tohex((csum) & 0xf);
 444
 445         s->last_packet_len = p - s->last_packet;
 446         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 447
 448 #ifdef CONFIG_USER_ONLY
 449         i = get_char(s);
 450         if (i < 0)
 451             return -1;
 452         if (i == '+')
 453             break;
 454 #else
 455         break;
 456 #endif
 457     }
 458     return 0;
 459 }
 460
 461 /* return -1 if error, 0 if OK */
 462 static int put_packet(GDBState *s, const char *buf)
 463 {
 464 #ifdef DEBUG_GDB
 465     printf("reply='%s'\n", buf);
 466 #endif
 467
 468     return put_packet_binary(s, buf, strlen(buf));
 469 }
 470
 471 /* The GDB remote protocol transfers values in target byte order.  This means
 472    we can use the raw memory access routines to access the value buffer.
 473    Conveniently, these also handle the case where the buffer is mis-aligned.
 474  */
 475 #define GET_REG8(val) do { \
 476     stb_p(mem_buf, val); \
 477     return 1; \
 478     } while(0)
 479 #define GET_REG16(val) do { \
 480     stw_p(mem_buf, val); \
 481     return 2; \
 482     } while(0)
 483 #define GET_REG32(val) do { \
 484     stl_p(mem_buf, val); \
 485     return 4; \
 486     } while(0)
 487 #define GET_REG64(val) do { \
 488     stq_p(mem_buf, val); \
 489     return 8; \
 490     } while(0)
 491
 492 #if TARGET_LONG_BITS == 64
 493 #define GET_REGL(val) GET_REG64(val)
 494 #define ldtul_p(addr) ldq_p(addr)
 495 #else
 496 #define GET_REGL(val) GET_REG32(val)
 497 #define ldtul_p(addr) ldl_p(addr)
 498 #endif
 499
 500 #if defined(TARGET_I386)
 501
 502 #ifdef TARGET_X86_64
 503 static const int gpr_map[16] = {
 504     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 505     8, 9, 10, 11, 12, 13, 14, 15
 506 };
 507 #else
 508 #define gpr_map gpr_map32
 509 #endif
 510 static const int gpr_map32[8] = { 0, 1, 2, 3, 4, 5, 6, 7 };
 511
 512 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 513
 514 #define IDX_IP_REG      CPU_NB_REGS
 515 #define IDX_FLAGS_REG   (IDX_IP_REG + 1)
 516 #define IDX_SEG_REGS    (IDX_FLAGS_REG + 1)
 517 #define IDX_FP_REGS     (IDX_SEG_REGS + 6)
 518 #define IDX_XMM_REGS    (IDX_FP_REGS + 16)
 519 #define IDX_MXCSR_REG   (IDX_XMM_REGS + CPU_NB_REGS)
 520
 521 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 522 {
 523     if (n < CPU_NB_REGS) {
 524         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 525             GET_REG64(env->regs[gpr_map[n]]);
 526         } else if (n < CPU_NB_REGS32) {
 527             GET_REG32(env->regs[gpr_map32[n]]);
 528         }
 529     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 530 #ifdef USE_X86LDOUBLE
 531         /* FIXME: byteswap float values - after fixing fpregs layout. */
 532         memcpy(mem_buf, &env->fpregs[n - IDX_FP_REGS], 10);
 533 #else
 534         memset(mem_buf, 0, 10);
 535 #endif
 536         return 10;
 537     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 538         n -= IDX_XMM_REGS;
 539         if (n < CPU_NB_REGS32 ||
 540             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 541             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 542             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 543             return 16;
 544         }
 545     } else {
 546         switch (n) {
 547         case IDX_IP_REG:
 548             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 549                 GET_REG64(env->eip);
 550             } else {
 551                 GET_REG32(env->eip);
 552             }
 553         case IDX_FLAGS_REG: GET_REG32(env->eflags);
 554
 555         case IDX_SEG_REGS:     GET_REG32(env->segs[R_CS].selector);
 556         case IDX_SEG_REGS + 1: GET_REG32(env->segs[R_SS].selector);
 557         case IDX_SEG_REGS + 2: GET_REG32(env->segs[R_DS].selector);
 558         case IDX_SEG_REGS + 3: GET_REG32(env->segs[R_ES].selector);
 559         case IDX_SEG_REGS + 4: GET_REG32(env->segs[R_FS].selector);
 560         case IDX_SEG_REGS + 5: GET_REG32(env->segs[R_GS].selector);
 561
 562         case IDX_FP_REGS + 8:  GET_REG32(env->fpuc);
 563         case IDX_FP_REGS + 9:  GET_REG32((env->fpus & ~0x3800) |
 564                                          (env->fpstt & 0x7) << 11);
 565         case IDX_FP_REGS + 10: GET_REG32(0); /* ftag */
 566         case IDX_FP_REGS + 11: GET_REG32(0); /* fiseg */
 567         case IDX_FP_REGS + 12: GET_REG32(0); /* fioff */
 568         case IDX_FP_REGS + 13: GET_REG32(0); /* foseg */
 569         case IDX_FP_REGS + 14: GET_REG32(0); /* fooff */
 570         case IDX_FP_REGS + 15: GET_REG32(0); /* fop */
 571
 572         case IDX_MXCSR_REG: GET_REG32(env->mxcsr);
 573         }
 574     }
 575     return 0;
 576 }
 577
 578 static int cpu_x86_gdb_load_seg(CPUState *env, int sreg, uint8_t *mem_buf)
 579 {
 580     uint16_t selector = ldl_p(mem_buf);
 581
 582     if (selector != env->segs[sreg].selector) {
 583 #if defined(CONFIG_USER_ONLY)
 584         cpu_x86_load_seg(env, sreg, selector);
 585 #else
 586         unsigned int limit, flags;
 587         target_ulong base;
 588
 589         if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK)) {
 590             base = selector << 4;
 591             limit = 0xffff;
 592             flags = 0;
 593         } else {
 594             if (!cpu_x86_get_descr_debug(env, selector, &base, &limit, &flags))
 595                 return 4;
 596         }
 597         cpu_x86_load_seg_cache(env, sreg, selector, base, limit, flags);
 598 #endif
 599     }
 600     return 4;
 601 }
 602
 603 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 604 {
 605     uint32_t tmp;
 606
 607     if (n < CPU_NB_REGS) {
 608         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 609             env->regs[gpr_map[n]] = ldtul_p(mem_buf);
 610             return sizeof(target_ulong);
 611         } else if (n < CPU_NB_REGS32) {
 612             n = gpr_map32[n];
 613             env->regs[n] &= ~0xffffffffUL;
 614             env->regs[n] |= (uint32_t)ldl_p(mem_buf);
 615             return 4;
 616         }
 617     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 618 #ifdef USE_X86LDOUBLE
 619         /* FIXME: byteswap float values - after fixing fpregs layout. */
 620         memcpy(&env->fpregs[n - IDX_FP_REGS], mem_buf, 10);
 621 #endif
 622         return 10;
 623     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 624         n -= IDX_XMM_REGS;
 625         if (n < CPU_NB_REGS32 ||
 626             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 627             env->xmm_regs[n].XMM_Q(0) = ldq_p(mem_buf);
 628             env->xmm_regs[n].XMM_Q(1) = ldq_p(mem_buf + 8);
 629             return 16;
 630         }
 631     } else {
 632         switch (n) {
 633         case IDX_IP_REG:
 634             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 635                 env->eip = ldq_p(mem_buf);
 636                 return 8;
 637             } else {
 638                 env->eip &= ~0xffffffffUL;
 639                 env->eip |= (uint32_t)ldl_p(mem_buf);
 640                 return 4;
 641             }
 642         case IDX_FLAGS_REG:
 643             env->eflags = ldl_p(mem_buf);
 644             return 4;
 645
 646         case IDX_SEG_REGS:     return cpu_x86_gdb_load_seg(env, R_CS, mem_buf);
 647         case IDX_SEG_REGS + 1: return cpu_x86_gdb_load_seg(env, R_SS, mem_buf);
 648         case IDX_SEG_REGS + 2: return cpu_x86_gdb_load_seg(env, R_DS, mem_buf);
 649         case IDX_SEG_REGS + 3: return cpu_x86_gdb_load_seg(env, R_ES, mem_buf);
 650         case IDX_SEG_REGS + 4: return cpu_x86_gdb_load_seg(env, R_FS, mem_buf);
 651         case IDX_SEG_REGS + 5: return cpu_x86_gdb_load_seg(env, R_GS, mem_buf);
 652
 653         case IDX_FP_REGS + 8:
 654             env->fpuc = ldl_p(mem_buf);
 655             return 4;
 656         case IDX_FP_REGS + 9:
 657             tmp = ldl_p(mem_buf);
 658             env->fpstt = (tmp >> 11) & 7;
 659             env->fpus = tmp & ~0x3800;
 660             return 4;
 661         case IDX_FP_REGS + 10: /* ftag */  return 4;
 662         case IDX_FP_REGS + 11: /* fiseg */ return 4;
 663         case IDX_FP_REGS + 12: /* fioff */ return 4;
 664         case IDX_FP_REGS + 13: /* foseg */ return 4;
 665         case IDX_FP_REGS + 14: /* fooff */ return 4;
 666         case IDX_FP_REGS + 15: /* fop */   return 4;
 667
 668         case IDX_MXCSR_REG:
 669             env->mxcsr = ldl_p(mem_buf);
 670             return 4;
 671         }
 672     }
 673     /* Unrecognised register.  */
 674     return 0;
 675 }
 676
 677 #elif defined (TARGET_PPC)
 678
 679 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 680    expects whatever the target description contains.  Due to a
 681    historical mishap the FP registers appear in between core integer
 682    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 683    FP regs zero size when talking to a newer gdb.  */
 684 #define NUM_CORE_REGS 71
 685 #if defined (TARGET_PPC64)
 686 #define GDB_CORE_XML "power64-core.xml"
 687 #else
 688 #define GDB_CORE_XML "power-core.xml"
 689 #endif
 690
 691 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 692 {
 693     if (n < 32) {
 694         /* gprs */
 695         GET_REGL(env->gpr[n]);
 696     } else if (n < 64) {
 697         /* fprs */
 698         if (gdb_has_xml)
 699             return 0;
 700         stfq_p(mem_buf, env->fpr[n-32]);
 701         return 8;
 702     } else {
 703         switch (n) {
 704         case 64: GET_REGL(env->nip);
 705         case 65: GET_REGL(env->msr);
 706         case 66:
 707             {
 708                 uint32_t cr = 0;
 709                 int i;
 710                 for (i = 0; i < 8; i++)
 711                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 712                 GET_REG32(cr);
 713             }
 714         case 67: GET_REGL(env->lr);
 715         case 68: GET_REGL(env->ctr);
 716         case 69: GET_REGL(env->xer);
 717         case 70:
 718             {
 719                 if (gdb_has_xml)
 720                     return 0;
 721                 GET_REG32(0); /* fpscr */
 722             }
 723         }
 724     }
 725     return 0;
 726 }
 727
 728 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 729 {
 730     if (n < 32) {
 731         /* gprs */
 732         env->gpr[n] = ldtul_p(mem_buf);
 733         return sizeof(target_ulong);
 734     } else if (n < 64) {
 735         /* fprs */
 736         if (gdb_has_xml)
 737             return 0;
 738         env->fpr[n-32] = ldfq_p(mem_buf);
 739         return 8;
 740     } else {
 741         switch (n) {
 742         case 64:
 743             env->nip = ldtul_p(mem_buf);
 744             return sizeof(target_ulong);
 745         case 65:
 746             ppc_store_msr(env, ldtul_p(mem_buf));
 747             return sizeof(target_ulong);
 748         case 66:
 749             {
 750                 uint32_t cr = ldl_p(mem_buf);
 751                 int i;
 752                 for (i = 0; i < 8; i++)
 753                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 754                 return 4;
 755             }
 756         case 67:
 757             env->lr = ldtul_p(mem_buf);
 758             return sizeof(target_ulong);
 759         case 68:
 760             env->ctr = ldtul_p(mem_buf);
 761             return sizeof(target_ulong);
 762         case 69:
 763             env->xer = ldtul_p(mem_buf);
 764             return sizeof(target_ulong);
 765         case 70:
 766             /* fpscr */
 767             if (gdb_has_xml)
 768                 return 0;
 769             return 4;
 770         }
 771     }
 772     return 0;
 773 }
 774
 775 #elif defined (TARGET_SPARC)
 776
 777 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 778 #define NUM_CORE_REGS 86
 779 #else
 780 #define NUM_CORE_REGS 72
 781 #endif
 782
 783 #ifdef TARGET_ABI32
 784 #define GET_REGA(val) GET_REG32(val)
 785 #else
 786 #define GET_REGA(val) GET_REGL(val)
 787 #endif
 788
 789 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 790 {
 791     if (n < 8) {
 792         /* g0..g7 */
 793         GET_REGA(env->gregs[n]);
 794     }
 795     if (n < 32) {
 796         /* register window */
 797         GET_REGA(env->regwptr[n - 8]);
 798     }
 799 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 800     if (n < 64) {
 801         /* fprs */
 802         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 803     }
 804     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 805     switch (n) {
 806     case 64: GET_REGA(env->y);
 807     case 65: GET_REGA(GET_PSR(env));
 808     case 66: GET_REGA(env->wim);
 809     case 67: GET_REGA(env->tbr);
 810     case 68: GET_REGA(env->pc);
 811     case 69: GET_REGA(env->npc);
 812     case 70: GET_REGA(env->fsr);
 813     case 71: GET_REGA(0); /* csr */
 814     default: GET_REGA(0);
 815     }
 816 #else
 817     if (n < 64) {
 818         /* f0-f31 */
 819         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 820     }
 821     if (n < 80) {
 822         /* f32-f62 (double width, even numbers only) */
 823         uint64_t val;
 824
 825         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 826         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 827         GET_REG64(val);
 828     }
 829     switch (n) {
 830     case 80: GET_REGL(env->pc);
 831     case 81: GET_REGL(env->npc);
 832     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 833                            ((env->asi & 0xff) << 24) |
 834                            ((env->pstate & 0xfff) << 8) |
 835                            GET_CWP64(env));
 836     case 83: GET_REGL(env->fsr);
 837     case 84: GET_REGL(env->fprs);
 838     case 85: GET_REGL(env->y);
 839     }
 840 #endif
 841     return 0;
 842 }
 843
 844 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 845 {
 846 #if defined(TARGET_ABI32)
 847     abi_ulong tmp;
 848
 849     tmp = ldl_p(mem_buf);
 850 #else
 851     target_ulong tmp;
 852
 853     tmp = ldtul_p(mem_buf);
 854 #endif
 855
 856     if (n < 8) {
 857         /* g0..g7 */
 858         env->gregs[n] = tmp;
 859     } else if (n < 32) {
 860         /* register window */
 861         env->regwptr[n - 8] = tmp;
 862     }
 863 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 864     else if (n < 64) {
 865         /* fprs */
 866         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 867     } else {
 868         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 869         switch (n) {
 870         case 64: env->y = tmp; break;
 871         case 65: PUT_PSR(env, tmp); break;
 872         case 66: env->wim = tmp; break;
 873         case 67: env->tbr = tmp; break;
 874         case 68: env->pc = tmp; break;
 875         case 69: env->npc = tmp; break;
 876         case 70: env->fsr = tmp; break;
 877         default: return 0;
 878         }
 879     }
 880     return 4;
 881 #else
 882     else if (n < 64) {
 883         /* f0-f31 */
 884         env->fpr[n] = ldfl_p(mem_buf);
 885         return 4;
 886     } else if (n < 80) {
 887         /* f32-f62 (double width, even numbers only) */
 888         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 889         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 890     } else {
 891         switch (n) {
 892         case 80: env->pc = tmp; break;
 893         case 81: env->npc = tmp; break;
 894         case 82:
 895             PUT_CCR(env, tmp >> 32);
 896             env->asi = (tmp >> 24) & 0xff;
 897             env->pstate = (tmp >> 8) & 0xfff;
 898             PUT_CWP64(env, tmp & 0xff);
 899             break;
 900         case 83: env->fsr = tmp; break;
 901         case 84: env->fprs = tmp; break;
 902         case 85: env->y = tmp; break;
 903         default: return 0;
 904         }
 905     }
 906     return 8;
 907 #endif
 908 }
 909 #elif defined (TARGET_ARM)
 910
 911 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 912    whatever the target description contains.  Due to a historical mishap
 913    the FPA registers appear in between core integer regs and the CPSR.
 914    We hack round this by giving the FPA regs zero size when talking to a
 915    newer gdb.  */
 916 #define NUM_CORE_REGS 26
 917 #define GDB_CORE_XML "arm-core.xml"
 918
 919 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 920 {
 921     if (n < 16) {
 922         /* Core integer register.  */
 923         GET_REG32(env->regs[n]);
 924     }
 925     if (n < 24) {
 926         /* FPA registers.  */
 927         if (gdb_has_xml)
 928             return 0;
 929         memset(mem_buf, 0, 12);
 930         return 12;
 931     }
 932     switch (n) {
 933     case 24:
 934         /* FPA status register.  */
 935         if (gdb_has_xml)
 936             return 0;
 937         GET_REG32(0);
 938     case 25:
 939         /* CPSR */
 940         GET_REG32(cpsr_read(env));
 941     }
 942     /* Unknown register.  */
 943     return 0;
 944 }
 945
 946 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 947 {
 948     uint32_t tmp;
 949
 950     tmp = ldl_p(mem_buf);
 951
 952     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 953        cause problems if we ever implement the Jazelle DBX extensions.  */
 954     if (n == 15)
 955         tmp &= ~1;
 956
 957     if (n < 16) {
 958         /* Core integer register.  */
 959         env->regs[n] = tmp;
 960         return 4;
 961     }
 962     if (n < 24) { /* 16-23 */
 963         /* FPA registers (ignored).  */
 964         if (gdb_has_xml)
 965             return 0;
 966         return 12;
 967     }
 968     switch (n) {
 969     case 24:
 970         /* FPA status register (ignored).  */
 971         if (gdb_has_xml)
 972             return 0;
 973         return 4;
 974     case 25:
 975         /* CPSR */
 976         cpsr_write (env, tmp, 0xffffffff);
 977         return 4;
 978     }
 979     /* Unknown register.  */
 980     return 0;
 981 }
 982
 983 #elif defined (TARGET_M68K)
 984
 985 #define NUM_CORE_REGS 18
 986
 987 #define GDB_CORE_XML "cf-core.xml"
 988
 989 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 990 {
 991     if (n < 8) {
 992         /* D0-D7 */
 993         GET_REG32(env->dregs[n]);
 994     } else if (n < 16) {
 995         /* A0-A7 */
 996         GET_REG32(env->aregs[n - 8]);
 997     } else {
 998         switch (n) {
 999         case 16: GET_REG32(env->sr);
1000         case 17: GET_REG32(env->pc);
1001         }
1002     }
1003     /* FP registers not included here because they vary between
1004        ColdFire and m68k.  Use XML bits for these.  */
1005     return 0;
1006 }
1007
1008 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1009 {
1010     uint32_t tmp;
1011
1012     tmp = ldl_p(mem_buf);
1013
1014     if (n < 8) {
1015         /* D0-D7 */
1016         env->dregs[n] = tmp;
1017     } else if (n < 16) {
1018         /* A0-A7 */
1019         env->aregs[n - 8] = tmp;
1020     } else {
1021         switch (n) {
1022         case 16: env->sr = tmp; break;
1023         case 17: env->pc = tmp; break;
1024         default: return 0;
1025         }
1026     }
1027     return 4;
1028 }
1029 #elif defined (TARGET_MIPS)
1030
1031 #define NUM_CORE_REGS 73
1032
1033 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1034 {
1035     if (n < 32) {
1036         GET_REGL(env->active_tc.gpr[n]);
1037     }
1038     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
1039         if (n >= 38 && n < 70) {
1040             if (env->CP0_Status & (1 << CP0St_FR))
1041                 GET_REGL(env->active_fpu.fpr[n - 38].d);
1042             else
1043                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
1044         }
1045         switch (n) {
1046         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
1047         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
1048         }
1049     }
1050     switch (n) {
1051     case 32: GET_REGL((int32_t)env->CP0_Status);
1052     case 33: GET_REGL(env->active_tc.LO[0]);
1053     case 34: GET_REGL(env->active_tc.HI[0]);
1054     case 35: GET_REGL(env->CP0_BadVAddr);
1055     case 36: GET_REGL((int32_t)env->CP0_Cause);
1056     case 37: GET_REGL(env->active_tc.PC | !!(env->hflags & MIPS_HFLAG_M16));
1057     case 72: GET_REGL(0); /* fp */
1058     case 89: GET_REGL((int32_t)env->CP0_PRid);
1059     }
1060     if (n >= 73 && n <= 88) {
1061         /* 16 embedded regs.  */
1062         GET_REGL(0);
1063     }
1064
1065     return 0;
1066 }
1067
1068 /* convert MIPS rounding mode in FCR31 to IEEE library */
1069 static unsigned int ieee_rm[] =
1070   {
1071     float_round_nearest_even,
1072     float_round_to_zero,
1073     float_round_up,
1074     float_round_down
1075   };
1076 #define RESTORE_ROUNDING_MODE \
1077     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1078
1079 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1080 {
1081     target_ulong tmp;
1082
1083     tmp = ldtul_p(mem_buf);
1084
1085     if (n < 32) {
1086         env->active_tc.gpr[n] = tmp;
1087         return sizeof(target_ulong);
1088     }
1089     if (env->CP0_Config1 & (1 << CP0C1_FP)
1090             && n >= 38 && n < 73) {
1091         if (n < 70) {
1092             if (env->CP0_Status & (1 << CP0St_FR))
1093               env->active_fpu.fpr[n - 38].d = tmp;
1094             else
1095               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1096         }
1097         switch (n) {
1098         case 70:
1099             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1100             /* set rounding mode */
1101             RESTORE_ROUNDING_MODE;
1102 #ifndef CONFIG_SOFTFLOAT
1103             /* no floating point exception for native float */
1104             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1105 #endif
1106             break;
1107         case 71: env->active_fpu.fcr0 = tmp; break;
1108         }
1109         return sizeof(target_ulong);
1110     }
1111     switch (n) {
1112     case 32: env->CP0_Status = tmp; break;
1113     case 33: env->active_tc.LO[0] = tmp; break;
1114     case 34: env->active_tc.HI[0] = tmp; break;
1115     case 35: env->CP0_BadVAddr = tmp; break;
1116     case 36: env->CP0_Cause = tmp; break;
1117     case 37:
1118         env->active_tc.PC = tmp & ~(target_ulong)1;
1119         if (tmp & 1) {
1120             env->hflags |= MIPS_HFLAG_M16;
1121         } else {
1122             env->hflags &= ~(MIPS_HFLAG_M16);
1123         }
1124         break;
1125     case 72: /* fp, ignored */ break;
1126     default:
1127         if (n > 89)
1128             return 0;
1129         /* Other registers are readonly.  Ignore writes.  */
1130         break;
1131     }
1132
1133     return sizeof(target_ulong);
1134 }
1135 #elif defined (TARGET_SH4)
1136
1137 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1138 /* FIXME: We should use XML for this.  */
1139
1140 #define NUM_CORE_REGS 59
1141
1142 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1143 {
1144     if (n < 8) {
1145         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1146             GET_REGL(env->gregs[n + 16]);
1147         } else {
1148             GET_REGL(env->gregs[n]);
1149         }
1150     } else if (n < 16) {
1151         GET_REGL(env->gregs[n - 8]);
1152     } else if (n >= 25 && n < 41) {
1153         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1154     } else if (n >= 43 && n < 51) {
1155         GET_REGL(env->gregs[n - 43]);
1156     } else if (n >= 51 && n < 59) {
1157         GET_REGL(env->gregs[n - (51 - 16)]);
1158     }
1159     switch (n) {
1160     case 16: GET_REGL(env->pc);
1161     case 17: GET_REGL(env->pr);
1162     case 18: GET_REGL(env->gbr);
1163     case 19: GET_REGL(env->vbr);
1164     case 20: GET_REGL(env->mach);
1165     case 21: GET_REGL(env->macl);
1166     case 22: GET_REGL(env->sr);
1167     case 23: GET_REGL(env->fpul);
1168     case 24: GET_REGL(env->fpscr);
1169     case 41: GET_REGL(env->ssr);
1170     case 42: GET_REGL(env->spc);
1171     }
1172
1173     return 0;
1174 }
1175
1176 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1177 {
1178     uint32_t tmp;
1179
1180     tmp = ldl_p(mem_buf);
1181
1182     if (n < 8) {
1183         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1184             env->gregs[n + 16] = tmp;
1185         } else {
1186             env->gregs[n] = tmp;
1187         }
1188         return 4;
1189     } else if (n < 16) {
1190         env->gregs[n - 8] = tmp;
1191         return 4;
1192     } else if (n >= 25 && n < 41) {
1193         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1194     } else if (n >= 43 && n < 51) {
1195         env->gregs[n - 43] = tmp;
1196         return 4;
1197     } else if (n >= 51 && n < 59) {
1198         env->gregs[n - (51 - 16)] = tmp;
1199         return 4;
1200     }
1201     switch (n) {
1202     case 16: env->pc = tmp;
1203     case 17: env->pr = tmp;
1204     case 18: env->gbr = tmp;
1205     case 19: env->vbr = tmp;
1206     case 20: env->mach = tmp;
1207     case 21: env->macl = tmp;
1208     case 22: env->sr = tmp;
1209     case 23: env->fpul = tmp;
1210     case 24: env->fpscr = tmp;
1211     case 41: env->ssr = tmp;
1212     case 42: env->spc = tmp;
1213     default: return 0;
1214     }
1215
1216     return 4;
1217 }
1218 #elif defined (TARGET_MICROBLAZE)
1219
1220 #define NUM_CORE_REGS (32 + 5)
1221
1222 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1223 {
1224     if (n < 32) {
1225         GET_REG32(env->regs[n]);
1226     } else {
1227         GET_REG32(env->sregs[n - 32]);
1228     }
1229     return 0;
1230 }
1231
1232 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1233 {
1234     uint32_t tmp;
1235
1236     if (n > NUM_CORE_REGS)
1237         return 0;
1238
1239     tmp = ldl_p(mem_buf);
1240
1241     if (n < 32) {
1242         env->regs[n] = tmp;
1243     } else {
1244         env->sregs[n - 32] = tmp;
1245     }
1246     return 4;
1247 }
1248 #elif defined (TARGET_CRIS)
1249
1250 #define NUM_CORE_REGS 49
1251
1252 static int
1253 read_register_crisv10(CPUState *env, uint8_t *mem_buf, int n)
1254 {
1255     if (n < 15) {
1256         GET_REG32(env->regs[n]);
1257     }
1258
1259     if (n == 15) {
1260         GET_REG32(env->pc);
1261     }
1262
1263     if (n < 32) {
1264         switch (n) {
1265         case 16:
1266             GET_REG8(env->pregs[n - 16]);
1267             break;
1268         case 17:
1269             GET_REG8(env->pregs[n - 16]);
1270             break;
1271         case 20:
1272         case 21:
1273             GET_REG16(env->pregs[n - 16]);
1274             break;
1275         default:
1276             if (n >= 23) {
1277                 GET_REG32(env->pregs[n - 16]);
1278             }
1279             break;
1280         }
1281     }
1282     return 0;
1283 }
1284
1285 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1286 {
1287     uint8_t srs;
1288
1289     if (env->pregs[PR_VR] < 32)
1290         return read_register_crisv10(env, mem_buf, n);
1291
1292     srs = env->pregs[PR_SRS];
1293     if (n < 16) {
1294         GET_REG32(env->regs[n]);
1295     }
1296
1297     if (n >= 21 && n < 32) {
1298         GET_REG32(env->pregs[n - 16]);
1299     }
1300     if (n >= 33 && n < 49) {
1301         GET_REG32(env->sregs[srs][n - 33]);
1302     }
1303     switch (n) {
1304     case 16: GET_REG8(env->pregs[0]);
1305     case 17: GET_REG8(env->pregs[1]);
1306     case 18: GET_REG32(env->pregs[2]);
1307     case 19: GET_REG8(srs);
1308     case 20: GET_REG16(env->pregs[4]);
1309     case 32: GET_REG32(env->pc);
1310     }
1311
1312     return 0;
1313 }
1314
1315 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1316 {
1317     uint32_t tmp;
1318
1319     if (n > 49)
1320         return 0;
1321
1322     tmp = ldl_p(mem_buf);
1323
1324     if (n < 16) {
1325         env->regs[n] = tmp;
1326     }
1327
1328     if (n >= 21 && n < 32) {
1329         env->pregs[n - 16] = tmp;
1330     }
1331
1332     /* FIXME: Should support function regs be writable?  */
1333     switch (n) {
1334     case 16: return 1;
1335     case 17: return 1;
1336     case 18: env->pregs[PR_PID] = tmp; break;
1337     case 19: return 1;
1338     case 20: return 2;
1339     case 32: env->pc = tmp; break;
1340     }
1341
1342     return 4;
1343 }
1344 #elif defined (TARGET_ALPHA)
1345
1346 #define NUM_CORE_REGS 67
1347
1348 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1349 {
1350     uint64_t val;
1351     CPU_DoubleU d;
1352
1353     switch (n) {
1354     case 0 ... 30:
1355         val = env->ir[n];
1356         break;
1357     case 32 ... 62:
1358         d.d = env->fir[n - 32];
1359         val = d.ll;
1360         break;
1361     case 63:
1362         val = cpu_alpha_load_fpcr(env);
1363         break;
1364     case 64:
1365         val = env->pc;
1366         break;
1367     case 66:
1368         val = env->unique;
1369         break;
1370     case 31:
1371     case 65:
1372         /* 31 really is the zero register; 65 is unassigned in the
1373            gdb protocol, but is still required to occupy 8 bytes. */
1374         val = 0;
1375         break;
1376     default:
1377         return 0;
1378     }
1379     GET_REGL(val);
1380 }
1381
1382 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1383 {
1384     target_ulong tmp = ldtul_p(mem_buf);
1385     CPU_DoubleU d;
1386
1387     switch (n) {
1388     case 0 ... 30:
1389         env->ir[n] = tmp;
1390         break;
1391     case 32 ... 62:
1392         d.ll = tmp;
1393         env->fir[n - 32] = d.d;
1394         break;
1395     case 63:
1396         cpu_alpha_store_fpcr(env, tmp);
1397         break;
1398     case 64:
1399         env->pc = tmp;
1400         break;
1401     case 66:
1402         env->unique = tmp;
1403         break;
1404     case 31:
1405     case 65:
1406         /* 31 really is the zero register; 65 is unassigned in the
1407            gdb protocol, but is still required to occupy 8 bytes. */
1408         break;
1409     default:
1410         return 0;
1411     }
1412     return 8;
1413 }
1414 #elif defined (TARGET_S390X)
1415
1416 #define NUM_CORE_REGS S390_NUM_TOTAL_REGS
1417
1418 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1419 {
1420     switch (n) {
1421         case S390_PSWM_REGNUM: GET_REGL(env->psw.mask); break;
1422         case S390_PSWA_REGNUM: GET_REGL(env->psw.addr); break;
1423         case S390_R0_REGNUM ... S390_R15_REGNUM:
1424             GET_REGL(env->regs[n-S390_R0_REGNUM]); break;
1425         case S390_A0_REGNUM ... S390_A15_REGNUM:
1426             GET_REG32(env->aregs[n-S390_A0_REGNUM]); break;
1427         case S390_FPC_REGNUM: GET_REG32(env->fpc); break;
1428         case S390_F0_REGNUM ... S390_F15_REGNUM:
1429             /* XXX */
1430             break;
1431         case S390_PC_REGNUM: GET_REGL(env->psw.addr); break;
1432         case S390_CC_REGNUM: GET_REG32(env->cc); break;
1433     }
1434
1435     return 0;
1436 }
1437
1438 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1439 {
1440     target_ulong tmpl;
1441     uint32_t tmp32;
1442     int r = 8;
1443     tmpl = ldtul_p(mem_buf);
1444     tmp32 = ldl_p(mem_buf);
1445
1446     switch (n) {
1447         case S390_PSWM_REGNUM: env->psw.mask = tmpl; break;
1448         case S390_PSWA_REGNUM: env->psw.addr = tmpl; break;
1449         case S390_R0_REGNUM ... S390_R15_REGNUM:
1450             env->regs[n-S390_R0_REGNUM] = tmpl; break;
1451         case S390_A0_REGNUM ... S390_A15_REGNUM:
1452             env->aregs[n-S390_A0_REGNUM] = tmp32; r=4; break;
1453         case S390_FPC_REGNUM: env->fpc = tmp32; r=4; break;
1454         case S390_F0_REGNUM ... S390_F15_REGNUM:
1455             /* XXX */
1456             break;
1457         case S390_PC_REGNUM: env->psw.addr = tmpl; break;
1458         case S390_CC_REGNUM: env->cc = tmp32; r=4; break;
1459     }
1460
1461     return r;
1462 }
1463 #else
1464
1465 #define NUM_CORE_REGS 0
1466
1467 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1468 {
1469     return 0;
1470 }
1471
1472 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1473 {
1474     return 0;
1475 }
1476
1477 #endif
1478
1479 static int num_g_regs = NUM_CORE_REGS;
1480
1481 #ifdef GDB_CORE_XML
1482 /* Encode data using the encoding for 'x' packets.  */
1483 static int memtox(char *buf, const char *mem, int len)
1484 {
1485     char *p = buf;
1486     char c;
1487
1488     while (len--) {
1489         c = *(mem++);
1490         switch (c) {
1491         case '#': case '$': case '*': case '}':
1492             *(p++) = '}';
1493             *(p++) = c ^ 0x20;
1494             break;
1495         default:
1496             *(p++) = c;
1497             break;
1498         }
1499     }
1500     return p - buf;
1501 }
1502
1503 static const char *get_feature_xml(const char *p, const char **newp)
1504 {
1505     extern const char *const xml_builtin[][2];
1506     size_t len;
1507     int i;
1508     const char *name;
1509     static char target_xml[1024];
1510
1511     len = 0;
1512     while (p[len] && p[len] != ':')
1513         len++;
1514     *newp = p + len;
1515
1516     name = NULL;
1517     if (strncmp(p, "target.xml", len) == 0) {
1518         /* Generate the XML description for this CPU.  */
1519         if (!target_xml[0]) {
1520             GDBRegisterState *r;
1521
1522             snprintf(target_xml, sizeof(target_xml),
1523                      "<?xml version=\"1.0\"?>"
1524                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1525                      "<target>"
1526                      "<xi:include href=\"%s\"/>",
1527                      GDB_CORE_XML);
1528
1529             for (r = first_cpu->gdb_regs; r; r = r->next) {
1530                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
1531                 pstrcat(target_xml, sizeof(target_xml), r->xml);
1532                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
1533             }
1534             pstrcat(target_xml, sizeof(target_xml), "</target>");
1535         }
1536         return target_xml;
1537     }
1538     for (i = 0; ; i++) {
1539         name = xml_builtin[i][0];
1540         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1541             break;
1542     }
1543     return name ? xml_builtin[i][1] : NULL;
1544 }
1545 #endif
1546
1547 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1548 {
1549     GDBRegisterState *r;
1550
1551     if (reg < NUM_CORE_REGS)
1552         return cpu_gdb_read_register(env, mem_buf, reg);
1553
1554     for (r = env->gdb_regs; r; r = r->next) {
1555         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1556             return r->get_reg(env, mem_buf, reg - r->base_reg);
1557         }
1558     }
1559     return 0;
1560 }
1561
1562 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1563 {
1564     GDBRegisterState *r;
1565
1566     if (reg < NUM_CORE_REGS)
1567         return cpu_gdb_write_register(env, mem_buf, reg);
1568
1569     for (r = env->gdb_regs; r; r = r->next) {
1570         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1571             return r->set_reg(env, mem_buf, reg - r->base_reg);
1572         }
1573     }
1574     return 0;
1575 }
1576
1577 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1578    specifies the first register number and these registers are included in
1579    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1580    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1581  */
1582
1583 void gdb_register_coprocessor(CPUState * env,
1584                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1585                              int num_regs, const char *xml, int g_pos)
1586 {
1587     GDBRegisterState *s;
1588     GDBRegisterState **p;
1589     static int last_reg = NUM_CORE_REGS;
1590
1591     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1592     s->base_reg = last_reg;
1593     s->num_regs = num_regs;
1594     s->get_reg = get_reg;
1595     s->set_reg = set_reg;
1596     s->xml = xml;
1597     p = &env->gdb_regs;
1598     while (*p) {
1599         /* Check for duplicates.  */
1600         if (strcmp((*p)->xml, xml) == 0)
1601             return;
1602         p = &(*p)->next;
1603     }
1604     /* Add to end of list.  */
1605     last_reg += num_regs;
1606     *p = s;
1607     if (g_pos) {
1608         if (g_pos != s->base_reg) {
1609             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1610                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1611         } else {
1612             num_g_regs = last_reg;
1613         }
1614     }
1615 }
1616
1617 #ifndef CONFIG_USER_ONLY
1618 static const int xlat_gdb_type[] = {
1619     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1620     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1621     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1622 };
1623 #endif
1624
1625 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1626 {
1627     CPUState *env;
1628     int err = 0;
1629
1630     if (kvm_enabled())
1631         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1632
1633     switch (type) {
1634     case GDB_BREAKPOINT_SW:
1635     case GDB_BREAKPOINT_HW:
1636         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1637             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1638             if (err)
1639                 break;
1640         }
1641         return err;
1642 #ifndef CONFIG_USER_ONLY
1643     case GDB_WATCHPOINT_WRITE:
1644     case GDB_WATCHPOINT_READ:
1645     case GDB_WATCHPOINT_ACCESS:
1646         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1647             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1648                                         NULL);
1649             if (err)
1650                 break;
1651         }
1652         return err;
1653 #endif
1654     default:
1655         return -ENOSYS;
1656     }
1657 }
1658
1659 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1660 {
1661     CPUState *env;
1662     int err = 0;
1663
1664     if (kvm_enabled())
1665         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1666
1667     switch (type) {
1668     case GDB_BREAKPOINT_SW:
1669     case GDB_BREAKPOINT_HW:
1670         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1671             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1672             if (err)
1673                 break;
1674         }
1675         return err;
1676 #ifndef CONFIG_USER_ONLY
1677     case GDB_WATCHPOINT_WRITE:
1678     case GDB_WATCHPOINT_READ:
1679     case GDB_WATCHPOINT_ACCESS:
1680         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1681             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1682             if (err)
1683                 break;
1684         }
1685         return err;
1686 #endif
1687     default:
1688         return -ENOSYS;
1689     }
1690 }
1691
1692 static void gdb_breakpoint_remove_all(void)
1693 {
1694     CPUState *env;
1695
1696     if (kvm_enabled()) {
1697         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1698         return;
1699     }
1700
1701     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1702         cpu_breakpoint_remove_all(env, BP_GDB);
1703 #ifndef CONFIG_USER_ONLY
1704         cpu_watchpoint_remove_all(env, BP_GDB);
1705 #endif
1706     }
1707 }
1708
1709 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1710 {
1711 #if defined(TARGET_I386)
1712     cpu_synchronize_state(s->c_cpu);
1713     s->c_cpu->eip = pc;
1714 #elif defined (TARGET_PPC)
1715     s->c_cpu->nip = pc;
1716 #elif defined (TARGET_SPARC)
1717     s->c_cpu->pc = pc;
1718     s->c_cpu->npc = pc + 4;
1719 #elif defined (TARGET_ARM)
1720     s->c_cpu->regs[15] = pc;
1721 #elif defined (TARGET_SH4)
1722     s->c_cpu->pc = pc;
1723 #elif defined (TARGET_MIPS)
1724     s->c_cpu->active_tc.PC = pc & ~(target_ulong)1;
1725     if (pc & 1) {
1726         s->c_cpu->hflags |= MIPS_HFLAG_M16;
1727     } else {
1728         s->c_cpu->hflags &= ~(MIPS_HFLAG_M16);
1729     }
1730 #elif defined (TARGET_MICROBLAZE)
1731     s->c_cpu->sregs[SR_PC] = pc;
1732 #elif defined (TARGET_CRIS)
1733     s->c_cpu->pc = pc;
1734 #elif defined (TARGET_ALPHA)
1735     s->c_cpu->pc = pc;
1736 #elif defined (TARGET_S390X)
1737     cpu_synchronize_state(s->c_cpu);
1738     s->c_cpu->psw.addr = pc;
1739 #endif
1740 }
1741
1742 static inline int gdb_id(CPUState *env)
1743 {
1744 #if defined(CONFIG_USER_ONLY) && defined(CONFIG_USE_NPTL)
1745     return env->host_tid;
1746 #else
1747     return env->cpu_index + 1;
1748 #endif
1749 }
1750
1751 static CPUState *find_cpu(uint32_t thread_id)
1752 {
1753     CPUState *env;
1754
1755     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1756         if (gdb_id(env) == thread_id) {
1757             return env;
1758         }
1759     }
1760
1761     return NULL;
1762 }
1763
1764 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1765 {
1766     CPUState *env;
1767     const char *p;
1768     uint32_t thread;
1769     int ch, reg_size, type, res;
1770     char buf[MAX_PACKET_LENGTH];
1771     uint8_t mem_buf[MAX_PACKET_LENGTH];
1772     uint8_t *registers;
1773     target_ulong addr, len;
1774
1775 #ifdef DEBUG_GDB
1776     printf("command='%s'\n", line_buf);
1777 #endif
1778     p = line_buf;
1779     ch = *p++;
1780     switch(ch) {
1781     case '?':
1782         /* TODO: Make this return the correct value for user-mode.  */
1783         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1784                  gdb_id(s->c_cpu));
1785         put_packet(s, buf);
1786         /* Remove all the breakpoints when this query is issued,
1787          * because gdb is doing and initial connect and the state
1788          * should be cleaned up.
1789          */
1790         gdb_breakpoint_remove_all();
1791         break;
1792     case 'c':
1793         if (*p != '\0') {
1794             addr = strtoull(p, (char **)&p, 16);
1795             gdb_set_cpu_pc(s, addr);
1796         }
1797         s->signal = 0;
1798         gdb_continue(s);
1799         return RS_IDLE;
1800     case 'C':
1801         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1802         if (s->signal == -1)
1803             s->signal = 0;
1804         gdb_continue(s);
1805         return RS_IDLE;
1806     case 'v':
1807         if (strncmp(p, "Cont", 4) == 0) {
1808             int res_signal, res_thread;
1809
1810             p += 4;
1811             if (*p == '?') {
1812                 put_packet(s, "vCont;c;C;s;S");
1813                 break;
1814             }
1815             res = 0;
1816             res_signal = 0;
1817             res_thread = 0;
1818             while (*p) {
1819                 int action, signal;
1820
1821                 if (*p++ != ';') {
1822                     res = 0;
1823                     break;
1824                 }
1825                 action = *p++;
1826                 signal = 0;
1827                 if (action == 'C' || action == 'S') {
1828                     signal = strtoul(p, (char **)&p, 16);
1829                 } else if (action != 'c' && action != 's') {
1830                     res = 0;
1831                     break;
1832                 }
1833                 thread = 0;
1834                 if (*p == ':') {
1835                     thread = strtoull(p+1, (char **)&p, 16);
1836                 }
1837                 action = tolower(action);
1838                 if (res == 0 || (res == 'c' && action == 's')) {
1839                     res = action;
1840                     res_signal = signal;
1841                     res_thread = thread;
1842                 }
1843             }
1844             if (res) {
1845                 if (res_thread != -1 && res_thread != 0) {
1846                     env = find_cpu(res_thread);
1847                     if (env == NULL) {
1848                         put_packet(s, "E22");
1849                         break;
1850                     }
1851                     s->c_cpu = env;
1852                 }
1853                 if (res == 's') {
1854                     cpu_single_step(s->c_cpu, sstep_flags);
1855                 }
1856                 s->signal = res_signal;
1857                 gdb_continue(s);
1858                 return RS_IDLE;
1859             }
1860             break;
1861         } else {
1862             goto unknown_command;
1863         }
1864     case 'k':
1865         /* Kill the target */
1866         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1867         exit(0);
1868     case 'D':
1869         /* Detach packet */
1870         gdb_breakpoint_remove_all();
1871         gdb_continue(s);
1872         put_packet(s, "OK");
1873         break;
1874     case 's':
1875         if (*p != '\0') {
1876             addr = strtoull(p, (char **)&p, 16);
1877             gdb_set_cpu_pc(s, addr);
1878         }
1879         cpu_single_step(s->c_cpu, sstep_flags);
1880         gdb_continue(s);
1881         return RS_IDLE;
1882     case 'F':
1883         {
1884             target_ulong ret;
1885             target_ulong err;
1886
1887             ret = strtoull(p, (char **)&p, 16);
1888             if (*p == ',') {
1889                 p++;
1890                 err = strtoull(p, (char **)&p, 16);
1891             } else {
1892                 err = 0;
1893             }
1894             if (*p == ',')
1895                 p++;
1896             type = *p;
1897             if (gdb_current_syscall_cb)
1898                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1899             if (type == 'C') {
1900                 put_packet(s, "T02");
1901             } else {
1902                 gdb_continue(s);
1903             }
1904         }
1905         break;
1906     case 'g':
1907         cpu_synchronize_state(s->g_cpu);
1908         len = 0;
1909         for (addr = 0; addr < num_g_regs; addr++) {
1910             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1911             len += reg_size;
1912         }
1913         memtohex(buf, mem_buf, len);
1914         put_packet(s, buf);
1915         break;
1916     case 'G':
1917         cpu_synchronize_state(s->g_cpu);
1918         registers = mem_buf;
1919         len = strlen(p) / 2;
1920         hextomem((uint8_t *)registers, p, len);
1921         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1922             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1923             len -= reg_size;
1924             registers += reg_size;
1925         }
1926         put_packet(s, "OK");
1927         break;
1928     case 'm':
1929         addr = strtoull(p, (char **)&p, 16);
1930         if (*p == ',')
1931             p++;
1932         len = strtoull(p, NULL, 16);
1933         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1934             put_packet (s, "E14");
1935         } else {
1936             memtohex(buf, mem_buf, len);
1937             put_packet(s, buf);
1938         }
1939         break;
1940     case 'M':
1941         addr = strtoull(p, (char **)&p, 16);
1942         if (*p == ',')
1943             p++;
1944         len = strtoull(p, (char **)&p, 16);
1945         if (*p == ':')
1946             p++;
1947         hextomem(mem_buf, p, len);
1948         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1949             put_packet(s, "E14");
1950         else
1951             put_packet(s, "OK");
1952         break;
1953     case 'p':
1954         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1955            This works, but can be very slow.  Anything new enough to
1956            understand XML also knows how to use this properly.  */
1957         if (!gdb_has_xml)
1958             goto unknown_command;
1959         addr = strtoull(p, (char **)&p, 16);
1960         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1961         if (reg_size) {
1962             memtohex(buf, mem_buf, reg_size);
1963             put_packet(s, buf);
1964         } else {
1965             put_packet(s, "E14");
1966         }
1967         break;
1968     case 'P':
1969         if (!gdb_has_xml)
1970             goto unknown_command;
1971         addr = strtoull(p, (char **)&p, 16);
1972         if (*p == '=')
1973             p++;
1974         reg_size = strlen(p) / 2;
1975         hextomem(mem_buf, p, reg_size);
1976         gdb_write_register(s->g_cpu, mem_buf, addr);
1977         put_packet(s, "OK");
1978         break;
1979     case 'Z':
1980     case 'z':
1981         type = strtoul(p, (char **)&p, 16);
1982         if (*p == ',')
1983             p++;
1984         addr = strtoull(p, (char **)&p, 16);
1985         if (*p == ',')
1986             p++;
1987         len = strtoull(p, (char **)&p, 16);
1988         if (ch == 'Z')
1989             res = gdb_breakpoint_insert(addr, len, type);
1990         else
1991             res = gdb_breakpoint_remove(addr, len, type);
1992         if (res >= 0)
1993              put_packet(s, "OK");
1994         else if (res == -ENOSYS)
1995             put_packet(s, "");
1996         else
1997             put_packet(s, "E22");
1998         break;
1999     case 'H':
2000         type = *p++;
2001         thread = strtoull(p, (char **)&p, 16);
2002         if (thread == -1 || thread == 0) {
2003             put_packet(s, "OK");
2004             break;
2005         }
2006         env = find_cpu(thread);
2007         if (env == NULL) {
2008             put_packet(s, "E22");
2009             break;
2010         }
2011         switch (type) {
2012         case 'c':
2013             s->c_cpu = env;
2014             put_packet(s, "OK");
2015             break;
2016         case 'g':
2017             s->g_cpu = env;
2018             put_packet(s, "OK");
2019             break;
2020         default:
2021              put_packet(s, "E22");
2022              break;
2023         }
2024         break;
2025     case 'T':
2026         thread = strtoull(p, (char **)&p, 16);
2027         env = find_cpu(thread);
2028
2029         if (env != NULL) {
2030             put_packet(s, "OK");
2031         } else {
2032             put_packet(s, "E22");
2033         }
2034         break;
2035     case 'q':
2036     case 'Q':
2037         /* parse any 'q' packets here */
2038         if (!strcmp(p,"qemu.sstepbits")) {
2039             /* Query Breakpoint bit definitions */
2040             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
2041                      SSTEP_ENABLE,
2042                      SSTEP_NOIRQ,
2043                      SSTEP_NOTIMER);
2044             put_packet(s, buf);
2045             break;
2046         } else if (strncmp(p,"qemu.sstep",10) == 0) {
2047             /* Display or change the sstep_flags */
2048             p += 10;
2049             if (*p != '=') {
2050                 /* Display current setting */
2051                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
2052                 put_packet(s, buf);
2053                 break;
2054             }
2055             p++;
2056             type = strtoul(p, (char **)&p, 16);
2057             sstep_flags = type;
2058             put_packet(s, "OK");
2059             break;
2060         } else if (strcmp(p,"C") == 0) {
2061             /* "Current thread" remains vague in the spec, so always return
2062              *  the first CPU (gdb returns the first thread). */
2063             put_packet(s, "QC1");
2064             break;
2065         } else if (strcmp(p,"fThreadInfo") == 0) {
2066             s->query_cpu = first_cpu;
2067             goto report_cpuinfo;
2068         } else if (strcmp(p,"sThreadInfo") == 0) {
2069         report_cpuinfo:
2070             if (s->query_cpu) {
2071                 snprintf(buf, sizeof(buf), "m%x", gdb_id(s->query_cpu));
2072                 put_packet(s, buf);
2073                 s->query_cpu = s->query_cpu->next_cpu;
2074             } else
2075                 put_packet(s, "l");
2076             break;
2077         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
2078             thread = strtoull(p+16, (char **)&p, 16);
2079             env = find_cpu(thread);
2080             if (env != NULL) {
2081                 cpu_synchronize_state(env);
2082                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
2083                                "CPU#%d [%s]", env->cpu_index,
2084                                env->halted ? "halted " : "running");
2085                 memtohex(buf, mem_buf, len);
2086                 put_packet(s, buf);
2087             }
2088             break;
2089         }
2090 #ifdef CONFIG_USER_ONLY
2091         else if (strncmp(p, "Offsets", 7) == 0) {
2092             TaskState *ts = s->c_cpu->opaque;
2093
2094             snprintf(buf, sizeof(buf),
2095                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
2096                      ";Bss=" TARGET_ABI_FMT_lx,
2097                      ts->info->code_offset,
2098                      ts->info->data_offset,
2099                      ts->info->data_offset);
2100             put_packet(s, buf);
2101             break;
2102         }
2103 #else /* !CONFIG_USER_ONLY */
2104         else if (strncmp(p, "Rcmd,", 5) == 0) {
2105             int len = strlen(p + 5);
2106
2107             if ((len % 2) != 0) {
2108                 put_packet(s, "E01");
2109                 break;
2110             }
2111             hextomem(mem_buf, p + 5, len);
2112             len = len / 2;
2113             mem_buf[len++] = 0;
2114             qemu_chr_read(s->mon_chr, mem_buf, len);
2115             put_packet(s, "OK");
2116             break;
2117         }
2118 #endif /* !CONFIG_USER_ONLY */
2119         if (strncmp(p, "Supported", 9) == 0) {
2120             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
2121 #ifdef GDB_CORE_XML
2122             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
2123 #endif
2124             put_packet(s, buf);
2125             break;
2126         }
2127 #ifdef GDB_CORE_XML
2128         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
2129             const char *xml;
2130             target_ulong total_len;
2131
2132             gdb_has_xml = 1;
2133             p += 19;
2134             xml = get_feature_xml(p, &p);
2135             if (!xml) {
2136                 snprintf(buf, sizeof(buf), "E00");
2137                 put_packet(s, buf);
2138                 break;
2139             }
2140
2141             if (*p == ':')
2142                 p++;
2143             addr = strtoul(p, (char **)&p, 16);
2144             if (*p == ',')
2145                 p++;
2146             len = strtoul(p, (char **)&p, 16);
2147
2148             total_len = strlen(xml);
2149             if (addr > total_len) {
2150                 snprintf(buf, sizeof(buf), "E00");
2151                 put_packet(s, buf);
2152                 break;
2153             }
2154             if (len > (MAX_PACKET_LENGTH - 5) / 2)
2155                 len = (MAX_PACKET_LENGTH - 5) / 2;
2156             if (len < total_len - addr) {
2157                 buf[0] = 'm';
2158                 len = memtox(buf + 1, xml + addr, len);
2159             } else {
2160                 buf[0] = 'l';
2161                 len = memtox(buf + 1, xml + addr, total_len - addr);
2162             }
2163             put_packet_binary(s, buf, len + 1);
2164             break;
2165         }
2166 #endif
2167         /* Unrecognised 'q' command.  */
2168         goto unknown_command;
2169
2170     default:
2171     unknown_command:
2172         /* put empty packet */
2173         buf[0] = '\0';
2174         put_packet(s, buf);
2175         break;
2176     }
2177     return RS_IDLE;
2178 }
2179
2180 void gdb_set_stop_cpu(CPUState *env)
2181 {
2182     gdbserver_state->c_cpu = env;
2183     gdbserver_state->g_cpu = env;
2184 }
2185
2186 #ifndef CONFIG_USER_ONLY
2187 static void gdb_vm_state_change(void *opaque, int running, int reason)
2188 {
2189     GDBState *s = gdbserver_state;
2190     CPUState *env = s->c_cpu;
2191     char buf[256];
2192     const char *type;
2193     int ret;
2194
2195     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
2196         s->state == RS_INACTIVE || s->state == RS_SYSCALL)
2197         return;
2198
2199     /* disable single step if it was enable */
2200     cpu_single_step(env, 0);
2201
2202     if (reason == EXCP_DEBUG) {
2203         if (env->watchpoint_hit) {
2204             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
2205             case BP_MEM_READ:
2206                 type = "r";
2207                 break;
2208             case BP_MEM_ACCESS:
2209                 type = "a";
2210                 break;
2211             default:
2212                 type = "";
2213                 break;
2214             }
2215             snprintf(buf, sizeof(buf),
2216                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
2217                      GDB_SIGNAL_TRAP, gdb_id(env), type,
2218                      env->watchpoint_hit->vaddr);
2219             put_packet(s, buf);
2220             env->watchpoint_hit = NULL;
2221             return;
2222         }
2223         tb_flush(env);
2224         ret = GDB_SIGNAL_TRAP;
2225     } else {
2226         ret = GDB_SIGNAL_INT;
2227     }
2228     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, gdb_id(env));
2229     put_packet(s, buf);
2230 }
2231 #endif
2232
2233 /* Send a gdb syscall request.
2234    This accepts limited printf-style format specifiers, specifically:
2235     %x  - target_ulong argument printed in hex.
2236     %lx - 64-bit argument printed in hex.
2237     %s  - string pointer (target_ulong) and length (int) pair.  */
2238 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
2239 {
2240     va_list va;
2241     char buf[256];
2242     char *p;
2243     target_ulong addr;
2244     uint64_t i64;
2245     GDBState *s;
2246
2247     s = gdbserver_state;
2248     if (!s)
2249         return;
2250     gdb_current_syscall_cb = cb;
2251     s->state = RS_SYSCALL;
2252 #ifndef CONFIG_USER_ONLY
2253     vm_stop(EXCP_DEBUG);
2254 #endif
2255     s->state = RS_IDLE;
2256     va_start(va, fmt);
2257     p = buf;
2258     *(p++) = 'F';
2259     while (*fmt) {
2260         if (*fmt == '%') {
2261             fmt++;
2262             switch (*fmt++) {
2263             case 'x':
2264                 addr = va_arg(va, target_ulong);
2265                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
2266                 break;
2267             case 'l':
2268                 if (*(fmt++) != 'x')
2269                     goto bad_format;
2270                 i64 = va_arg(va, uint64_t);
2271                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
2272                 break;
2273             case 's':
2274                 addr = va_arg(va, target_ulong);
2275                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
2276                               addr, va_arg(va, int));
2277                 break;
2278             default:
2279             bad_format:
2280                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2281                         fmt - 1);
2282                 break;
2283             }
2284         } else {
2285             *(p++) = *(fmt++);
2286         }
2287     }
2288     *p = 0;
2289     va_end(va);
2290     put_packet(s, buf);
2291 #ifdef CONFIG_USER_ONLY
2292     gdb_handlesig(s->c_cpu, 0);
2293 #else
2294     cpu_exit(s->c_cpu);
2295 #endif
2296 }
2297
2298 static void gdb_read_byte(GDBState *s, int ch)
2299 {
2300     int i, csum;
2301     uint8_t reply;
2302
2303 #ifndef CONFIG_USER_ONLY
2304     if (s->last_packet_len) {
2305         /* Waiting for a response to the last packet.  If we see the start
2306            of a new command then abandon the previous response.  */
2307         if (ch == '-') {
2308 #ifdef DEBUG_GDB
2309             printf("Got NACK, retransmitting\n");
2310 #endif
2311             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2312         }
2313 #ifdef DEBUG_GDB
2314         else if (ch == '+')
2315             printf("Got ACK\n");
2316         else
2317             printf("Got '%c' when expecting ACK/NACK\n", ch);
2318 #endif
2319         if (ch == '+' || ch == '$')
2320             s->last_packet_len = 0;
2321         if (ch != '$')
2322             return;
2323     }
2324     if (vm_running) {
2325         /* when the CPU is running, we cannot do anything except stop
2326            it when receiving a char */
2327         vm_stop(EXCP_INTERRUPT);
2328     } else
2329 #endif
2330     {
2331         switch(s->state) {
2332         case RS_IDLE:
2333             if (ch == '$') {
2334                 s->line_buf_index = 0;
2335                 s->state = RS_GETLINE;
2336             }
2337             break;
2338         case RS_GETLINE:
2339             if (ch == '#') {
2340             s->state = RS_CHKSUM1;
2341             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2342                 s->state = RS_IDLE;
2343             } else {
2344             s->line_buf[s->line_buf_index++] = ch;
2345             }
2346             break;
2347         case RS_CHKSUM1:
2348             s->line_buf[s->line_buf_index] = '\0';
2349             s->line_csum = fromhex(ch) << 4;
2350             s->state = RS_CHKSUM2;
2351             break;
2352         case RS_CHKSUM2:
2353             s->line_csum |= fromhex(ch);
2354             csum = 0;
2355             for(i = 0; i < s->line_buf_index; i++) {
2356                 csum += s->line_buf[i];
2357             }
2358             if (s->line_csum != (csum & 0xff)) {
2359                 reply = '-';
2360                 put_buffer(s, &reply, 1);
2361                 s->state = RS_IDLE;
2362             } else {
2363                 reply = '+';
2364                 put_buffer(s, &reply, 1);
2365                 s->state = gdb_handle_packet(s, s->line_buf);
2366             }
2367             break;
2368         default:
2369             abort();
2370         }
2371     }
2372 }
2373
2374 #ifdef CONFIG_USER_ONLY
2375 int
2376 gdb_queuesig (void)
2377 {
2378     GDBState *s;
2379
2380     s = gdbserver_state;
2381
2382     if (gdbserver_fd < 0 || s->fd < 0)
2383         return 0;
2384     else
2385         return 1;
2386 }
2387
2388 int
2389 gdb_handlesig (CPUState *env, int sig)
2390 {
2391   GDBState *s;
2392   char buf[256];
2393   int n;
2394
2395   s = gdbserver_state;
2396   if (gdbserver_fd < 0 || s->fd < 0)
2397     return sig;
2398
2399   /* disable single step if it was enabled */
2400   cpu_single_step(env, 0);
2401   tb_flush(env);
2402
2403   if (sig != 0)
2404     {
2405       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2406       put_packet(s, buf);
2407     }
2408   /* put_packet() might have detected that the peer terminated the
2409      connection.  */
2410   if (s->fd < 0)
2411       return sig;
2412
2413   sig = 0;
2414   s->state = RS_IDLE;
2415   s->running_state = 0;
2416   while (s->running_state == 0) {
2417       n = read (s->fd, buf, 256);
2418       if (n > 0)
2419         {
2420           int i;
2421
2422           for (i = 0; i < n; i++)
2423             gdb_read_byte (s, buf[i]);
2424         }
2425       else if (n == 0 || errno != EAGAIN)
2426         {
2427           /* XXX: Connection closed.  Should probably wait for annother
2428              connection before continuing.  */
2429           return sig;
2430         }
2431   }
2432   sig = s->signal;
2433   s->signal = 0;
2434   return sig;
2435 }
2436
2437 /* Tell the remote gdb that the process has exited.  */
2438 void gdb_exit(CPUState *env, int code)
2439 {
2440   GDBState *s;
2441   char buf[4];
2442
2443   s = gdbserver_state;
2444   if (gdbserver_fd < 0 || s->fd < 0)
2445     return;
2446
2447   snprintf(buf, sizeof(buf), "W%02x", code);
2448   put_packet(s, buf);
2449 }
2450
2451 /* Tell the remote gdb that the process has exited due to SIG.  */
2452 void gdb_signalled(CPUState *env, int sig)
2453 {
2454   GDBState *s;
2455   char buf[4];
2456
2457   s = gdbserver_state;
2458   if (gdbserver_fd < 0 || s->fd < 0)
2459     return;
2460
2461   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2462   put_packet(s, buf);
2463 }
2464
2465 static void gdb_accept(void)
2466 {
2467     GDBState *s;
2468     struct sockaddr_in sockaddr;
2469     socklen_t len;
2470     int val, fd;
2471
2472     for(;;) {
2473         len = sizeof(sockaddr);
2474         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2475         if (fd < 0 && errno != EINTR) {
2476             perror("accept");
2477             return;
2478         } else if (fd >= 0) {
2479 #ifndef _WIN32
2480             fcntl(fd, F_SETFD, FD_CLOEXEC);
2481 #endif
2482             break;
2483         }
2484     }
2485
2486     /* set short latency */
2487     val = 1;
2488     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2489
2490     s = qemu_mallocz(sizeof(GDBState));
2491     s->c_cpu = first_cpu;
2492     s->g_cpu = first_cpu;
2493     s->fd = fd;
2494     gdb_has_xml = 0;
2495
2496     gdbserver_state = s;
2497
2498     fcntl(fd, F_SETFL, O_NONBLOCK);
2499 }
2500
2501 static int gdbserver_open(int port)
2502 {
2503     struct sockaddr_in sockaddr;
2504     int fd, val, ret;
2505
2506     fd = socket(PF_INET, SOCK_STREAM, 0);
2507     if (fd < 0) {
2508         perror("socket");
2509         return -1;
2510     }
2511 #ifndef _WIN32
2512     fcntl(fd, F_SETFD, FD_CLOEXEC);
2513 #endif
2514
2515     /* allow fast reuse */
2516     val = 1;
2517     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2518
2519     sockaddr.sin_family = AF_INET;
2520     sockaddr.sin_port = htons(port);
2521     sockaddr.sin_addr.s_addr = 0;
2522     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2523     if (ret < 0) {
2524         perror("bind");
2525         return -1;
2526     }
2527     ret = listen(fd, 0);
2528     if (ret < 0) {
2529         perror("listen");
2530         return -1;
2531     }
2532     return fd;
2533 }
2534
2535 int gdbserver_start(int port)
2536 {
2537     gdbserver_fd = gdbserver_open(port);
2538     if (gdbserver_fd < 0)
2539         return -1;
2540     /* accept connections */
2541     gdb_accept();
2542     return 0;
2543 }
2544
2545 /* Disable gdb stub for child processes.  */
2546 void gdbserver_fork(CPUState *env)
2547 {
2548     GDBState *s = gdbserver_state;
2549     if (gdbserver_fd < 0 || s->fd < 0)
2550       return;
2551     close(s->fd);
2552     s->fd = -1;
2553     cpu_breakpoint_remove_all(env, BP_GDB);
2554     cpu_watchpoint_remove_all(env, BP_GDB);
2555 }
2556 #else
2557 static int gdb_chr_can_receive(void *opaque)
2558 {
2559   /* We can handle an arbitrarily large amount of data.
2560    Pick the maximum packet size, which is as good as anything.  */
2561   return MAX_PACKET_LENGTH;
2562 }
2563
2564 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2565 {
2566     int i;
2567
2568     for (i = 0; i < size; i++) {
2569         gdb_read_byte(gdbserver_state, buf[i]);
2570     }
2571 }
2572
2573 static void gdb_chr_event(void *opaque, int event)
2574 {
2575     switch (event) {
2576     case CHR_EVENT_OPENED:
2577         vm_stop(EXCP_INTERRUPT);
2578         gdb_has_xml = 0;
2579         break;
2580     default:
2581         break;
2582     }
2583 }
2584
2585 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2586 {
2587     char buf[MAX_PACKET_LENGTH];
2588
2589     buf[0] = 'O';
2590     if (len > (MAX_PACKET_LENGTH/2) - 1)
2591         len = (MAX_PACKET_LENGTH/2) - 1;
2592     memtohex(buf + 1, (uint8_t *)msg, len);
2593     put_packet(s, buf);
2594 }
2595
2596 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2597 {
2598     const char *p = (const char *)buf;
2599     int max_sz;
2600
2601     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2602     for (;;) {
2603         if (len <= max_sz) {
2604             gdb_monitor_output(gdbserver_state, p, len);
2605             break;
2606         }
2607         gdb_monitor_output(gdbserver_state, p, max_sz);
2608         p += max_sz;
2609         len -= max_sz;
2610     }
2611     return len;
2612 }
2613
2614 #ifndef _WIN32
2615 static void gdb_sigterm_handler(int signal)
2616 {
2617     if (vm_running)
2618         vm_stop(EXCP_INTERRUPT);
2619 }
2620 #endif
2621
2622 int gdbserver_start(const char *device)
2623 {
2624     GDBState *s;
2625     char gdbstub_device_name[128];
2626     CharDriverState *chr = NULL;
2627     CharDriverState *mon_chr;
2628
2629     if (!device)
2630         return -1;
2631     if (strcmp(device, "none") != 0) {
2632         if (strstart(device, "tcp:", NULL)) {
2633             /* enforce required TCP attributes */
2634             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2635                      "%s,nowait,nodelay,server", device);
2636             device = gdbstub_device_name;
2637         }
2638 #ifndef _WIN32
2639         else if (strcmp(device, "stdio") == 0) {
2640             struct sigaction act;
2641
2642             memset(&act, 0, sizeof(act));
2643             act.sa_handler = gdb_sigterm_handler;
2644             sigaction(SIGINT, &act, NULL);
2645         }
2646 #endif
2647         chr = qemu_chr_open("gdb", device, NULL);
2648         if (!chr)
2649             return -1;
2650
2651         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2652                               gdb_chr_event, NULL);
2653     }
2654
2655     s = gdbserver_state;
2656     if (!s) {
2657         s = qemu_mallocz(sizeof(GDBState));
2658         gdbserver_state = s;
2659
2660         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2661
2662         /* Initialize a monitor terminal for gdb */
2663         mon_chr = qemu_mallocz(sizeof(*mon_chr));
2664         mon_chr->chr_write = gdb_monitor_write;
2665         monitor_init(mon_chr, 0);
2666     } else {
2667         if (s->chr)
2668             qemu_chr_close(s->chr);
2669         mon_chr = s->mon_chr;
2670         memset(s, 0, sizeof(GDBState));
2671     }
2672     s->c_cpu = first_cpu;
2673     s->g_cpu = first_cpu;
2674     s->chr = chr;
2675     s->state = chr ? RS_IDLE : RS_INACTIVE;
2676     s->mon_chr = mon_chr;
2677
2678     return 0;
2679 }
2680 #endif