gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "qemu-common.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "monitor.h"
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #endif
  37 #include "qemu-kvm.h"
  38
  39 #define MAX_PACKET_LENGTH 4096
  40
  41 #include "exec-all.h"
  42 #include "qemu_socket.h"
  43 #include "kvm.h"
  44
  45
  46 enum {
  47     GDB_SIGNAL_0 = 0,
  48     GDB_SIGNAL_INT = 2,
  49     GDB_SIGNAL_TRAP = 5,
  50     GDB_SIGNAL_UNKNOWN = 143
  51 };
  52
  53 #ifdef CONFIG_USER_ONLY
  54
  55 /* Map target signal numbers to GDB protocol signal numbers and vice
  56  * versa.  For user emulation's currently supported systems, we can
  57  * assume most signals are defined.
  58  */
  59
  60 static int gdb_signal_table[] = {
  61     0,
  62     TARGET_SIGHUP,
  63     TARGET_SIGINT,
  64     TARGET_SIGQUIT,
  65     TARGET_SIGILL,
  66     TARGET_SIGTRAP,
  67     TARGET_SIGABRT,
  68     -1, /* SIGEMT */
  69     TARGET_SIGFPE,
  70     TARGET_SIGKILL,
  71     TARGET_SIGBUS,
  72     TARGET_SIGSEGV,
  73     TARGET_SIGSYS,
  74     TARGET_SIGPIPE,
  75     TARGET_SIGALRM,
  76     TARGET_SIGTERM,
  77     TARGET_SIGURG,
  78     TARGET_SIGSTOP,
  79     TARGET_SIGTSTP,
  80     TARGET_SIGCONT,
  81     TARGET_SIGCHLD,
  82     TARGET_SIGTTIN,
  83     TARGET_SIGTTOU,
  84     TARGET_SIGIO,
  85     TARGET_SIGXCPU,
  86     TARGET_SIGXFSZ,
  87     TARGET_SIGVTALRM,
  88     TARGET_SIGPROF,
  89     TARGET_SIGWINCH,
  90     -1, /* SIGLOST */
  91     TARGET_SIGUSR1,
  92     TARGET_SIGUSR2,
  93 #ifdef TARGET_SIGPWR
  94     TARGET_SIGPWR,
  95 #else
  96     -1,
  97 #endif
  98     -1, /* SIGPOLL */
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108     -1,
 109     -1,
 110 #ifdef __SIGRTMIN
 111     __SIGRTMIN + 1,
 112     __SIGRTMIN + 2,
 113     __SIGRTMIN + 3,
 114     __SIGRTMIN + 4,
 115     __SIGRTMIN + 5,
 116     __SIGRTMIN + 6,
 117     __SIGRTMIN + 7,
 118     __SIGRTMIN + 8,
 119     __SIGRTMIN + 9,
 120     __SIGRTMIN + 10,
 121     __SIGRTMIN + 11,
 122     __SIGRTMIN + 12,
 123     __SIGRTMIN + 13,
 124     __SIGRTMIN + 14,
 125     __SIGRTMIN + 15,
 126     __SIGRTMIN + 16,
 127     __SIGRTMIN + 17,
 128     __SIGRTMIN + 18,
 129     __SIGRTMIN + 19,
 130     __SIGRTMIN + 20,
 131     __SIGRTMIN + 21,
 132     __SIGRTMIN + 22,
 133     __SIGRTMIN + 23,
 134     __SIGRTMIN + 24,
 135     __SIGRTMIN + 25,
 136     __SIGRTMIN + 26,
 137     __SIGRTMIN + 27,
 138     __SIGRTMIN + 28,
 139     __SIGRTMIN + 29,
 140     __SIGRTMIN + 30,
 141     __SIGRTMIN + 31,
 142     -1, /* SIGCANCEL */
 143     __SIGRTMIN,
 144     __SIGRTMIN + 32,
 145     __SIGRTMIN + 33,
 146     __SIGRTMIN + 34,
 147     __SIGRTMIN + 35,
 148     __SIGRTMIN + 36,
 149     __SIGRTMIN + 37,
 150     __SIGRTMIN + 38,
 151     __SIGRTMIN + 39,
 152     __SIGRTMIN + 40,
 153     __SIGRTMIN + 41,
 154     __SIGRTMIN + 42,
 155     __SIGRTMIN + 43,
 156     __SIGRTMIN + 44,
 157     __SIGRTMIN + 45,
 158     __SIGRTMIN + 46,
 159     __SIGRTMIN + 47,
 160     __SIGRTMIN + 48,
 161     __SIGRTMIN + 49,
 162     __SIGRTMIN + 50,
 163     __SIGRTMIN + 51,
 164     __SIGRTMIN + 52,
 165     __SIGRTMIN + 53,
 166     __SIGRTMIN + 54,
 167     __SIGRTMIN + 55,
 168     __SIGRTMIN + 56,
 169     __SIGRTMIN + 57,
 170     __SIGRTMIN + 58,
 171     __SIGRTMIN + 59,
 172     __SIGRTMIN + 60,
 173     __SIGRTMIN + 61,
 174     __SIGRTMIN + 62,
 175     __SIGRTMIN + 63,
 176     __SIGRTMIN + 64,
 177     __SIGRTMIN + 65,
 178     __SIGRTMIN + 66,
 179     __SIGRTMIN + 67,
 180     __SIGRTMIN + 68,
 181     __SIGRTMIN + 69,
 182     __SIGRTMIN + 70,
 183     __SIGRTMIN + 71,
 184     __SIGRTMIN + 72,
 185     __SIGRTMIN + 73,
 186     __SIGRTMIN + 74,
 187     __SIGRTMIN + 75,
 188     __SIGRTMIN + 76,
 189     __SIGRTMIN + 77,
 190     __SIGRTMIN + 78,
 191     __SIGRTMIN + 79,
 192     __SIGRTMIN + 80,
 193     __SIGRTMIN + 81,
 194     __SIGRTMIN + 82,
 195     __SIGRTMIN + 83,
 196     __SIGRTMIN + 84,
 197     __SIGRTMIN + 85,
 198     __SIGRTMIN + 86,
 199     __SIGRTMIN + 87,
 200     __SIGRTMIN + 88,
 201     __SIGRTMIN + 89,
 202     __SIGRTMIN + 90,
 203     __SIGRTMIN + 91,
 204     __SIGRTMIN + 92,
 205     __SIGRTMIN + 93,
 206     __SIGRTMIN + 94,
 207     __SIGRTMIN + 95,
 208     -1, /* SIGINFO */
 209     -1, /* UNKNOWN */
 210     -1, /* DEFAULT */
 211     -1,
 212     -1,
 213     -1,
 214     -1,
 215     -1,
 216     -1
 217 #endif
 218 };
 219 #else
 220 /* In system mode we only need SIGINT and SIGTRAP; other signals
 221    are not yet supported.  */
 222
 223 enum {
 224     TARGET_SIGINT = 2,
 225     TARGET_SIGTRAP = 5
 226 };
 227
 228 static int gdb_signal_table[] = {
 229     -1,
 230     -1,
 231     TARGET_SIGINT,
 232     -1,
 233     -1,
 234     TARGET_SIGTRAP
 235 };
 236 #endif
 237
 238 #ifdef CONFIG_USER_ONLY
 239 static int target_signal_to_gdb (int sig)
 240 {
 241     int i;
 242     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 243         if (gdb_signal_table[i] == sig)
 244             return i;
 245     return GDB_SIGNAL_UNKNOWN;
 246 }
 247 #endif
 248
 249 static int gdb_signal_to_target (int sig)
 250 {
 251     if (sig < ARRAY_SIZE (gdb_signal_table))
 252         return gdb_signal_table[sig];
 253     else
 254         return -1;
 255 }
 256
 257 //#define DEBUG_GDB
 258
 259 typedef struct GDBRegisterState {
 260     int base_reg;
 261     int num_regs;
 262     gdb_reg_cb get_reg;
 263     gdb_reg_cb set_reg;
 264     const char *xml;
 265     struct GDBRegisterState *next;
 266 } GDBRegisterState;
 267
 268 enum RSState {
 269     RS_INACTIVE,
 270     RS_IDLE,
 271     RS_GETLINE,
 272     RS_CHKSUM1,
 273     RS_CHKSUM2,
 274     RS_SYSCALL,
 275 };
 276 typedef struct GDBState {
 277     CPUState *c_cpu; /* current CPU for step/continue ops */
 278     CPUState *g_cpu; /* current CPU for other ops */
 279     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 280     enum RSState state; /* parsing state */
 281     char line_buf[MAX_PACKET_LENGTH];
 282     int line_buf_index;
 283     int line_csum;
 284     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 285     int last_packet_len;
 286     int signal;
 287 #ifdef CONFIG_USER_ONLY
 288     int fd;
 289     int running_state;
 290 #else
 291     CharDriverState *chr;
 292     CharDriverState *mon_chr;
 293 #endif
 294 } GDBState;
 295
 296 /* By default use no IRQs and no timers while single stepping so as to
 297  * make single stepping like an ICE HW step.
 298  */
 299 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 300
 301 static GDBState *gdbserver_state;
 302
 303 /* This is an ugly hack to cope with both new and old gdb.
 304    If gdb sends qXfer:features:read then assume we're talking to a newish
 305    gdb that understands target descriptions.  */
 306 static int gdb_has_xml;
 307
 308 #ifdef CONFIG_USER_ONLY
 309 /* XXX: This is not thread safe.  Do we care?  */
 310 static int gdbserver_fd = -1;
 311
 312 static int get_char(GDBState *s)
 313 {
 314     uint8_t ch;
 315     int ret;
 316
 317     for(;;) {
 318         ret = recv(s->fd, &ch, 1, 0);
 319         if (ret < 0) {
 320             if (errno == ECONNRESET)
 321                 s->fd = -1;
 322             if (errno != EINTR && errno != EAGAIN)
 323                 return -1;
 324         } else if (ret == 0) {
 325             close(s->fd);
 326             s->fd = -1;
 327             return -1;
 328         } else {
 329             break;
 330         }
 331     }
 332     return ch;
 333 }
 334 #endif
 335
 336 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 337
 338 static enum {
 339     GDB_SYS_UNKNOWN,
 340     GDB_SYS_ENABLED,
 341     GDB_SYS_DISABLED,
 342 } gdb_syscall_mode;
 343
 344 /* If gdb is connected when the first semihosting syscall occurs then use
 345    remote gdb syscalls.  Otherwise use native file IO.  */
 346 int use_gdb_syscalls(void)
 347 {
 348     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 349         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 350                                             : GDB_SYS_DISABLED);
 351     }
 352     return gdb_syscall_mode == GDB_SYS_ENABLED;
 353 }
 354
 355 /* Resume execution.  */
 356 static inline void gdb_continue(GDBState *s)
 357 {
 358 #ifdef CONFIG_USER_ONLY
 359     s->running_state = 1;
 360 #else
 361     vm_start();
 362 #endif
 363 }
 364
 365 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 366 {
 367 #ifdef CONFIG_USER_ONLY
 368     int ret;
 369
 370     while (len > 0) {
 371         ret = send(s->fd, buf, len, 0);
 372         if (ret < 0) {
 373             if (errno != EINTR && errno != EAGAIN)
 374                 return;
 375         } else {
 376             buf += ret;
 377             len -= ret;
 378         }
 379     }
 380 #else
 381     qemu_chr_write(s->chr, buf, len);
 382 #endif
 383 }
 384
 385 static inline int fromhex(int v)
 386 {
 387     if (v >= '0' && v <= '9')
 388         return v - '0';
 389     else if (v >= 'A' && v <= 'F')
 390         return v - 'A' + 10;
 391     else if (v >= 'a' && v <= 'f')
 392         return v - 'a' + 10;
 393     else
 394         return 0;
 395 }
 396
 397 static inline int tohex(int v)
 398 {
 399     if (v < 10)
 400         return v + '0';
 401     else
 402         return v - 10 + 'a';
 403 }
 404
 405 static void memtohex(char *buf, const uint8_t *mem, int len)
 406 {
 407     int i, c;
 408     char *q;
 409     q = buf;
 410     for(i = 0; i < len; i++) {
 411         c = mem[i];
 412         *q++ = tohex(c >> 4);
 413         *q++ = tohex(c & 0xf);
 414     }
 415     *q = '\0';
 416 }
 417
 418 static void hextomem(uint8_t *mem, const char *buf, int len)
 419 {
 420     int i;
 421
 422     for(i = 0; i < len; i++) {
 423         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 424         buf += 2;
 425     }
 426 }
 427
 428 /* return -1 if error, 0 if OK */
 429 static int put_packet_binary(GDBState *s, const char *buf, int len)
 430 {
 431     int csum, i;
 432     uint8_t *p;
 433
 434     for(;;) {
 435         p = s->last_packet;
 436         *(p++) = '$';
 437         memcpy(p, buf, len);
 438         p += len;
 439         csum = 0;
 440         for(i = 0; i < len; i++) {
 441             csum += buf[i];
 442         }
 443         *(p++) = '#';
 444         *(p++) = tohex((csum >> 4) & 0xf);
 445         *(p++) = tohex((csum) & 0xf);
 446
 447         s->last_packet_len = p - s->last_packet;
 448         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 449
 450 #ifdef CONFIG_USER_ONLY
 451         i = get_char(s);
 452         if (i < 0)
 453             return -1;
 454         if (i == '+')
 455             break;
 456 #else
 457         break;
 458 #endif
 459     }
 460     return 0;
 461 }
 462
 463 /* return -1 if error, 0 if OK */
 464 static int put_packet(GDBState *s, const char *buf)
 465 {
 466 #ifdef DEBUG_GDB
 467     printf("reply='%s'\n", buf);
 468 #endif
 469
 470     return put_packet_binary(s, buf, strlen(buf));
 471 }
 472
 473 /* The GDB remote protocol transfers values in target byte order.  This means
 474    we can use the raw memory access routines to access the value buffer.
 475    Conveniently, these also handle the case where the buffer is mis-aligned.
 476  */
 477 #define GET_REG8(val) do { \
 478     stb_p(mem_buf, val); \
 479     return 1; \
 480     } while(0)
 481 #define GET_REG16(val) do { \
 482     stw_p(mem_buf, val); \
 483     return 2; \
 484     } while(0)
 485 #define GET_REG32(val) do { \
 486     stl_p(mem_buf, val); \
 487     return 4; \
 488     } while(0)
 489 #define GET_REG64(val) do { \
 490     stq_p(mem_buf, val); \
 491     return 8; \
 492     } while(0)
 493
 494 #if TARGET_LONG_BITS == 64
 495 #define GET_REGL(val) GET_REG64(val)
 496 #define ldtul_p(addr) ldq_p(addr)
 497 #else
 498 #define GET_REGL(val) GET_REG32(val)
 499 #define ldtul_p(addr) ldl_p(addr)
 500 #endif
 501
 502 #if defined(TARGET_I386)
 503
 504 #ifdef TARGET_X86_64
 505 static const int gpr_map[16] = {
 506     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 507     8, 9, 10, 11, 12, 13, 14, 15
 508 };
 509 #else
 510 #define gpr_map gpr_map32
 511 #endif
 512 static const int gpr_map32[8] = { 0, 1, 2, 3, 4, 5, 6, 7 };
 513
 514 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 515
 516 #define IDX_IP_REG      CPU_NB_REGS
 517 #define IDX_FLAGS_REG   (IDX_IP_REG + 1)
 518 #define IDX_SEG_REGS    (IDX_FLAGS_REG + 1)
 519 #define IDX_FP_REGS     (IDX_SEG_REGS + 6)
 520 #define IDX_XMM_REGS    (IDX_FP_REGS + 16)
 521 #define IDX_MXCSR_REG   (IDX_XMM_REGS + CPU_NB_REGS)
 522
 523 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 524 {
 525     if (n < CPU_NB_REGS) {
 526         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 527             GET_REG64(env->regs[gpr_map[n]]);
 528         } else if (n < CPU_NB_REGS32) {
 529             GET_REG32(env->regs[gpr_map32[n]]);
 530         }
 531     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 532 #ifdef USE_X86LDOUBLE
 533         /* FIXME: byteswap float values - after fixing fpregs layout. */
 534         memcpy(mem_buf, &env->fpregs[n - IDX_FP_REGS], 10);
 535 #else
 536         memset(mem_buf, 0, 10);
 537 #endif
 538         return 10;
 539     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 540         n -= IDX_XMM_REGS;
 541         if (n < CPU_NB_REGS32 ||
 542             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 543             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 544             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 545             return 16;
 546         }
 547     } else {
 548         switch (n) {
 549         case IDX_IP_REG:
 550             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 551                 GET_REG64(env->eip);
 552             } else {
 553                 GET_REG32(env->eip);
 554             }
 555         case IDX_FLAGS_REG: GET_REG32(env->eflags);
 556
 557         case IDX_SEG_REGS:     GET_REG32(env->segs[R_CS].selector);
 558         case IDX_SEG_REGS + 1: GET_REG32(env->segs[R_SS].selector);
 559         case IDX_SEG_REGS + 2: GET_REG32(env->segs[R_DS].selector);
 560         case IDX_SEG_REGS + 3: GET_REG32(env->segs[R_ES].selector);
 561         case IDX_SEG_REGS + 4: GET_REG32(env->segs[R_FS].selector);
 562         case IDX_SEG_REGS + 5: GET_REG32(env->segs[R_GS].selector);
 563
 564         case IDX_FP_REGS + 8:  GET_REG32(env->fpuc);
 565         case IDX_FP_REGS + 9:  GET_REG32((env->fpus & ~0x3800) |
 566                                          (env->fpstt & 0x7) << 11);
 567         case IDX_FP_REGS + 10: GET_REG32(0); /* ftag */
 568         case IDX_FP_REGS + 11: GET_REG32(0); /* fiseg */
 569         case IDX_FP_REGS + 12: GET_REG32(0); /* fioff */
 570         case IDX_FP_REGS + 13: GET_REG32(0); /* foseg */
 571         case IDX_FP_REGS + 14: GET_REG32(0); /* fooff */
 572         case IDX_FP_REGS + 15: GET_REG32(0); /* fop */
 573
 574         case IDX_MXCSR_REG: GET_REG32(env->mxcsr);
 575         }
 576     }
 577     return 0;
 578 }
 579
 580 static int cpu_x86_gdb_load_seg(CPUState *env, int sreg, uint8_t *mem_buf)
 581 {
 582     uint16_t selector = ldl_p(mem_buf);
 583
 584     if (selector != env->segs[sreg].selector) {
 585 #if defined(CONFIG_USER_ONLY)
 586         cpu_x86_load_seg(env, sreg, selector);
 587 #else
 588         unsigned int limit, flags;
 589         target_ulong base;
 590
 591         if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK)) {
 592             base = selector << 4;
 593             limit = 0xffff;
 594             flags = 0;
 595         } else {
 596             if (!cpu_x86_get_descr_debug(env, selector, &base, &limit, &flags))
 597                 return 4;
 598         }
 599         cpu_x86_load_seg_cache(env, sreg, selector, base, limit, flags);
 600 #endif
 601     }
 602     return 4;
 603 }
 604
 605 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 606 {
 607     uint32_t tmp;
 608
 609     if (n < CPU_NB_REGS) {
 610         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 611             env->regs[gpr_map[n]] = ldtul_p(mem_buf);
 612             return sizeof(target_ulong);
 613         } else if (n < CPU_NB_REGS32) {
 614             n = gpr_map32[n];
 615             env->regs[n] &= ~0xffffffffUL;
 616             env->regs[n] |= (uint32_t)ldl_p(mem_buf);
 617             return 4;
 618         }
 619     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 620 #ifdef USE_X86LDOUBLE
 621         /* FIXME: byteswap float values - after fixing fpregs layout. */
 622         memcpy(&env->fpregs[n - IDX_FP_REGS], mem_buf, 10);
 623 #endif
 624         return 10;
 625     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 626         n -= IDX_XMM_REGS;
 627         if (n < CPU_NB_REGS32 ||
 628             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 629             env->xmm_regs[n].XMM_Q(0) = ldq_p(mem_buf);
 630             env->xmm_regs[n].XMM_Q(1) = ldq_p(mem_buf + 8);
 631             return 16;
 632         }
 633     } else {
 634         switch (n) {
 635         case IDX_IP_REG:
 636             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 637                 env->eip = ldq_p(mem_buf);
 638                 return 8;
 639             } else {
 640                 env->eip &= ~0xffffffffUL;
 641                 env->eip |= (uint32_t)ldl_p(mem_buf);
 642                 return 4;
 643             }
 644         case IDX_FLAGS_REG:
 645             env->eflags = ldl_p(mem_buf);
 646             return 4;
 647
 648         case IDX_SEG_REGS:     return cpu_x86_gdb_load_seg(env, R_CS, mem_buf);
 649         case IDX_SEG_REGS + 1: return cpu_x86_gdb_load_seg(env, R_SS, mem_buf);
 650         case IDX_SEG_REGS + 2: return cpu_x86_gdb_load_seg(env, R_DS, mem_buf);
 651         case IDX_SEG_REGS + 3: return cpu_x86_gdb_load_seg(env, R_ES, mem_buf);
 652         case IDX_SEG_REGS + 4: return cpu_x86_gdb_load_seg(env, R_FS, mem_buf);
 653         case IDX_SEG_REGS + 5: return cpu_x86_gdb_load_seg(env, R_GS, mem_buf);
 654
 655         case IDX_FP_REGS + 8:
 656             env->fpuc = ldl_p(mem_buf);
 657             return 4;
 658         case IDX_FP_REGS + 9:
 659             tmp = ldl_p(mem_buf);
 660             env->fpstt = (tmp >> 11) & 7;
 661             env->fpus = tmp & ~0x3800;
 662             return 4;
 663         case IDX_FP_REGS + 10: /* ftag */  return 4;
 664         case IDX_FP_REGS + 11: /* fiseg */ return 4;
 665         case IDX_FP_REGS + 12: /* fioff */ return 4;
 666         case IDX_FP_REGS + 13: /* foseg */ return 4;
 667         case IDX_FP_REGS + 14: /* fooff */ return 4;
 668         case IDX_FP_REGS + 15: /* fop */   return 4;
 669
 670         case IDX_MXCSR_REG:
 671             env->mxcsr = ldl_p(mem_buf);
 672             return 4;
 673         }
 674     }
 675     /* Unrecognised register.  */
 676     return 0;
 677 }
 678
 679 #elif defined (TARGET_PPC)
 680
 681 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 682    expects whatever the target description contains.  Due to a
 683    historical mishap the FP registers appear in between core integer
 684    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 685    FP regs zero size when talking to a newer gdb.  */
 686 #define NUM_CORE_REGS 71
 687 #if defined (TARGET_PPC64)
 688 #define GDB_CORE_XML "power64-core.xml"
 689 #else
 690 #define GDB_CORE_XML "power-core.xml"
 691 #endif
 692
 693 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 694 {
 695     if (n < 32) {
 696         /* gprs */
 697         GET_REGL(env->gpr[n]);
 698     } else if (n < 64) {
 699         /* fprs */
 700         if (gdb_has_xml)
 701             return 0;
 702         stfq_p(mem_buf, env->fpr[n-32]);
 703         return 8;
 704     } else {
 705         switch (n) {
 706         case 64: GET_REGL(env->nip);
 707         case 65: GET_REGL(env->msr);
 708         case 66:
 709             {
 710                 uint32_t cr = 0;
 711                 int i;
 712                 for (i = 0; i < 8; i++)
 713                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 714                 GET_REG32(cr);
 715             }
 716         case 67: GET_REGL(env->lr);
 717         case 68: GET_REGL(env->ctr);
 718         case 69: GET_REGL(env->xer);
 719         case 70:
 720             {
 721                 if (gdb_has_xml)
 722                     return 0;
 723                 GET_REG32(0); /* fpscr */
 724             }
 725         }
 726     }
 727     return 0;
 728 }
 729
 730 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 731 {
 732     if (n < 32) {
 733         /* gprs */
 734         env->gpr[n] = ldtul_p(mem_buf);
 735         return sizeof(target_ulong);
 736     } else if (n < 64) {
 737         /* fprs */
 738         if (gdb_has_xml)
 739             return 0;
 740         env->fpr[n-32] = ldfq_p(mem_buf);
 741         return 8;
 742     } else {
 743         switch (n) {
 744         case 64:
 745             env->nip = ldtul_p(mem_buf);
 746             return sizeof(target_ulong);
 747         case 65:
 748             ppc_store_msr(env, ldtul_p(mem_buf));
 749             return sizeof(target_ulong);
 750         case 66:
 751             {
 752                 uint32_t cr = ldl_p(mem_buf);
 753                 int i;
 754                 for (i = 0; i < 8; i++)
 755                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 756                 return 4;
 757             }
 758         case 67:
 759             env->lr = ldtul_p(mem_buf);
 760             return sizeof(target_ulong);
 761         case 68:
 762             env->ctr = ldtul_p(mem_buf);
 763             return sizeof(target_ulong);
 764         case 69:
 765             env->xer = ldtul_p(mem_buf);
 766             return sizeof(target_ulong);
 767         case 70:
 768             /* fpscr */
 769             if (gdb_has_xml)
 770                 return 0;
 771             return 4;
 772         }
 773     }
 774     return 0;
 775 }
 776
 777 #elif defined (TARGET_SPARC)
 778
 779 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 780 #define NUM_CORE_REGS 86
 781 #else
 782 #define NUM_CORE_REGS 72
 783 #endif
 784
 785 #ifdef TARGET_ABI32
 786 #define GET_REGA(val) GET_REG32(val)
 787 #else
 788 #define GET_REGA(val) GET_REGL(val)
 789 #endif
 790
 791 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 792 {
 793     if (n < 8) {
 794         /* g0..g7 */
 795         GET_REGA(env->gregs[n]);
 796     }
 797     if (n < 32) {
 798         /* register window */
 799         GET_REGA(env->regwptr[n - 8]);
 800     }
 801 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 802     if (n < 64) {
 803         /* fprs */
 804         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 805     }
 806     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 807     switch (n) {
 808     case 64: GET_REGA(env->y);
 809     case 65: GET_REGA(cpu_get_psr(env));
 810     case 66: GET_REGA(env->wim);
 811     case 67: GET_REGA(env->tbr);
 812     case 68: GET_REGA(env->pc);
 813     case 69: GET_REGA(env->npc);
 814     case 70: GET_REGA(env->fsr);
 815     case 71: GET_REGA(0); /* csr */
 816     default: GET_REGA(0);
 817     }
 818 #else
 819     if (n < 64) {
 820         /* f0-f31 */
 821         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 822     }
 823     if (n < 80) {
 824         /* f32-f62 (double width, even numbers only) */
 825         uint64_t val;
 826
 827         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 828         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 829         GET_REG64(val);
 830     }
 831     switch (n) {
 832     case 80: GET_REGL(env->pc);
 833     case 81: GET_REGL(env->npc);
 834     case 82: GET_REGL((cpu_get_ccr(env) << 32) |
 835                       ((env->asi & 0xff) << 24) |
 836                       ((env->pstate & 0xfff) << 8) |
 837                       cpu_get_cwp64(env));
 838     case 83: GET_REGL(env->fsr);
 839     case 84: GET_REGL(env->fprs);
 840     case 85: GET_REGL(env->y);
 841     }
 842 #endif
 843     return 0;
 844 }
 845
 846 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 847 {
 848 #if defined(TARGET_ABI32)
 849     abi_ulong tmp;
 850
 851     tmp = ldl_p(mem_buf);
 852 #else
 853     target_ulong tmp;
 854
 855     tmp = ldtul_p(mem_buf);
 856 #endif
 857
 858     if (n < 8) {
 859         /* g0..g7 */
 860         env->gregs[n] = tmp;
 861     } else if (n < 32) {
 862         /* register window */
 863         env->regwptr[n - 8] = tmp;
 864     }
 865 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 866     else if (n < 64) {
 867         /* fprs */
 868         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 869     } else {
 870         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 871         switch (n) {
 872         case 64: env->y = tmp; break;
 873         case 65: cpu_put_psr(env, tmp); break;
 874         case 66: env->wim = tmp; break;
 875         case 67: env->tbr = tmp; break;
 876         case 68: env->pc = tmp; break;
 877         case 69: env->npc = tmp; break;
 878         case 70: env->fsr = tmp; break;
 879         default: return 0;
 880         }
 881     }
 882     return 4;
 883 #else
 884     else if (n < 64) {
 885         /* f0-f31 */
 886         env->fpr[n] = ldfl_p(mem_buf);
 887         return 4;
 888     } else if (n < 80) {
 889         /* f32-f62 (double width, even numbers only) */
 890         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 891         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 892     } else {
 893         switch (n) {
 894         case 80: env->pc = tmp; break;
 895         case 81: env->npc = tmp; break;
 896         case 82:
 897             cpu_put_ccr(env, tmp >> 32);
 898             env->asi = (tmp >> 24) & 0xff;
 899             env->pstate = (tmp >> 8) & 0xfff;
 900             cpu_put_cwp64(env, tmp & 0xff);
 901             break;
 902         case 83: env->fsr = tmp; break;
 903         case 84: env->fprs = tmp; break;
 904         case 85: env->y = tmp; break;
 905         default: return 0;
 906         }
 907     }
 908     return 8;
 909 #endif
 910 }
 911 #elif defined (TARGET_ARM)
 912
 913 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 914    whatever the target description contains.  Due to a historical mishap
 915    the FPA registers appear in between core integer regs and the CPSR.
 916    We hack round this by giving the FPA regs zero size when talking to a
 917    newer gdb.  */
 918 #define NUM_CORE_REGS 26
 919 #define GDB_CORE_XML "arm-core.xml"
 920
 921 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 922 {
 923     if (n < 16) {
 924         /* Core integer register.  */
 925         GET_REG32(env->regs[n]);
 926     }
 927     if (n < 24) {
 928         /* FPA registers.  */
 929         if (gdb_has_xml)
 930             return 0;
 931         memset(mem_buf, 0, 12);
 932         return 12;
 933     }
 934     switch (n) {
 935     case 24:
 936         /* FPA status register.  */
 937         if (gdb_has_xml)
 938             return 0;
 939         GET_REG32(0);
 940     case 25:
 941         /* CPSR */
 942         GET_REG32(cpsr_read(env));
 943     }
 944     /* Unknown register.  */
 945     return 0;
 946 }
 947
 948 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 949 {
 950     uint32_t tmp;
 951
 952     tmp = ldl_p(mem_buf);
 953
 954     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 955        cause problems if we ever implement the Jazelle DBX extensions.  */
 956     if (n == 15)
 957         tmp &= ~1;
 958
 959     if (n < 16) {
 960         /* Core integer register.  */
 961         env->regs[n] = tmp;
 962         return 4;
 963     }
 964     if (n < 24) { /* 16-23 */
 965         /* FPA registers (ignored).  */
 966         if (gdb_has_xml)
 967             return 0;
 968         return 12;
 969     }
 970     switch (n) {
 971     case 24:
 972         /* FPA status register (ignored).  */
 973         if (gdb_has_xml)
 974             return 0;
 975         return 4;
 976     case 25:
 977         /* CPSR */
 978         cpsr_write (env, tmp, 0xffffffff);
 979         return 4;
 980     }
 981     /* Unknown register.  */
 982     return 0;
 983 }
 984
 985 #elif defined (TARGET_M68K)
 986
 987 #define NUM_CORE_REGS 18
 988
 989 #define GDB_CORE_XML "cf-core.xml"
 990
 991 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 992 {
 993     if (n < 8) {
 994         /* D0-D7 */
 995         GET_REG32(env->dregs[n]);
 996     } else if (n < 16) {
 997         /* A0-A7 */
 998         GET_REG32(env->aregs[n - 8]);
 999     } else {
1000         switch (n) {
1001         case 16: GET_REG32(env->sr);
1002         case 17: GET_REG32(env->pc);
1003         }
1004     }
1005     /* FP registers not included here because they vary between
1006        ColdFire and m68k.  Use XML bits for these.  */
1007     return 0;
1008 }
1009
1010 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1011 {
1012     uint32_t tmp;
1013
1014     tmp = ldl_p(mem_buf);
1015
1016     if (n < 8) {
1017         /* D0-D7 */
1018         env->dregs[n] = tmp;
1019     } else if (n < 16) {
1020         /* A0-A7 */
1021         env->aregs[n - 8] = tmp;
1022     } else {
1023         switch (n) {
1024         case 16: env->sr = tmp; break;
1025         case 17: env->pc = tmp; break;
1026         default: return 0;
1027         }
1028     }
1029     return 4;
1030 }
1031 #elif defined (TARGET_MIPS)
1032
1033 #define NUM_CORE_REGS 73
1034
1035 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1036 {
1037     if (n < 32) {
1038         GET_REGL(env->active_tc.gpr[n]);
1039     }
1040     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
1041         if (n >= 38 && n < 70) {
1042             if (env->CP0_Status & (1 << CP0St_FR))
1043                 GET_REGL(env->active_fpu.fpr[n - 38].d);
1044             else
1045                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
1046         }
1047         switch (n) {
1048         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
1049         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
1050         }
1051     }
1052     switch (n) {
1053     case 32: GET_REGL((int32_t)env->CP0_Status);
1054     case 33: GET_REGL(env->active_tc.LO[0]);
1055     case 34: GET_REGL(env->active_tc.HI[0]);
1056     case 35: GET_REGL(env->CP0_BadVAddr);
1057     case 36: GET_REGL((int32_t)env->CP0_Cause);
1058     case 37: GET_REGL(env->active_tc.PC | !!(env->hflags & MIPS_HFLAG_M16));
1059     case 72: GET_REGL(0); /* fp */
1060     case 89: GET_REGL((int32_t)env->CP0_PRid);
1061     }
1062     if (n >= 73 && n <= 88) {
1063         /* 16 embedded regs.  */
1064         GET_REGL(0);
1065     }
1066
1067     return 0;
1068 }
1069
1070 /* convert MIPS rounding mode in FCR31 to IEEE library */
1071 static unsigned int ieee_rm[] =
1072   {
1073     float_round_nearest_even,
1074     float_round_to_zero,
1075     float_round_up,
1076     float_round_down
1077   };
1078 #define RESTORE_ROUNDING_MODE \
1079     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1080
1081 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1082 {
1083     target_ulong tmp;
1084
1085     tmp = ldtul_p(mem_buf);
1086
1087     if (n < 32) {
1088         env->active_tc.gpr[n] = tmp;
1089         return sizeof(target_ulong);
1090     }
1091     if (env->CP0_Config1 & (1 << CP0C1_FP)
1092             && n >= 38 && n < 73) {
1093         if (n < 70) {
1094             if (env->CP0_Status & (1 << CP0St_FR))
1095               env->active_fpu.fpr[n - 38].d = tmp;
1096             else
1097               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1098         }
1099         switch (n) {
1100         case 70:
1101             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1102             /* set rounding mode */
1103             RESTORE_ROUNDING_MODE;
1104 #ifndef CONFIG_SOFTFLOAT
1105             /* no floating point exception for native float */
1106             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1107 #endif
1108             break;
1109         case 71: env->active_fpu.fcr0 = tmp; break;
1110         }
1111         return sizeof(target_ulong);
1112     }
1113     switch (n) {
1114     case 32: env->CP0_Status = tmp; break;
1115     case 33: env->active_tc.LO[0] = tmp; break;
1116     case 34: env->active_tc.HI[0] = tmp; break;
1117     case 35: env->CP0_BadVAddr = tmp; break;
1118     case 36: env->CP0_Cause = tmp; break;
1119     case 37:
1120         env->active_tc.PC = tmp & ~(target_ulong)1;
1121         if (tmp & 1) {
1122             env->hflags |= MIPS_HFLAG_M16;
1123         } else {
1124             env->hflags &= ~(MIPS_HFLAG_M16);
1125         }
1126         break;
1127     case 72: /* fp, ignored */ break;
1128     default:
1129         if (n > 89)
1130             return 0;
1131         /* Other registers are readonly.  Ignore writes.  */
1132         break;
1133     }
1134
1135     return sizeof(target_ulong);
1136 }
1137 #elif defined (TARGET_SH4)
1138
1139 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1140 /* FIXME: We should use XML for this.  */
1141
1142 #define NUM_CORE_REGS 59
1143
1144 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1145 {
1146     if (n < 8) {
1147         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1148             GET_REGL(env->gregs[n + 16]);
1149         } else {
1150             GET_REGL(env->gregs[n]);
1151         }
1152     } else if (n < 16) {
1153         GET_REGL(env->gregs[n]);
1154     } else if (n >= 25 && n < 41) {
1155         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1156     } else if (n >= 43 && n < 51) {
1157         GET_REGL(env->gregs[n - 43]);
1158     } else if (n >= 51 && n < 59) {
1159         GET_REGL(env->gregs[n - (51 - 16)]);
1160     }
1161     switch (n) {
1162     case 16: GET_REGL(env->pc);
1163     case 17: GET_REGL(env->pr);
1164     case 18: GET_REGL(env->gbr);
1165     case 19: GET_REGL(env->vbr);
1166     case 20: GET_REGL(env->mach);
1167     case 21: GET_REGL(env->macl);
1168     case 22: GET_REGL(env->sr);
1169     case 23: GET_REGL(env->fpul);
1170     case 24: GET_REGL(env->fpscr);
1171     case 41: GET_REGL(env->ssr);
1172     case 42: GET_REGL(env->spc);
1173     }
1174
1175     return 0;
1176 }
1177
1178 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1179 {
1180     uint32_t tmp;
1181
1182     tmp = ldl_p(mem_buf);
1183
1184     if (n < 8) {
1185         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1186             env->gregs[n + 16] = tmp;
1187         } else {
1188             env->gregs[n] = tmp;
1189         }
1190         return 4;
1191     } else if (n < 16) {
1192         env->gregs[n] = tmp;
1193         return 4;
1194     } else if (n >= 25 && n < 41) {
1195         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1196         return 4;
1197     } else if (n >= 43 && n < 51) {
1198         env->gregs[n - 43] = tmp;
1199         return 4;
1200     } else if (n >= 51 && n < 59) {
1201         env->gregs[n - (51 - 16)] = tmp;
1202         return 4;
1203     }
1204     switch (n) {
1205     case 16: env->pc = tmp; break;
1206     case 17: env->pr = tmp; break;
1207     case 18: env->gbr = tmp; break;
1208     case 19: env->vbr = tmp; break;
1209     case 20: env->mach = tmp; break;
1210     case 21: env->macl = tmp; break;
1211     case 22: env->sr = tmp; break;
1212     case 23: env->fpul = tmp; break;
1213     case 24: env->fpscr = tmp; break;
1214     case 41: env->ssr = tmp; break;
1215     case 42: env->spc = tmp; break;
1216     default: return 0;
1217     }
1218
1219     return 4;
1220 }
1221 #elif defined (TARGET_MICROBLAZE)
1222
1223 #define NUM_CORE_REGS (32 + 5)
1224
1225 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1226 {
1227     if (n < 32) {
1228         GET_REG32(env->regs[n]);
1229     } else {
1230         GET_REG32(env->sregs[n - 32]);
1231     }
1232     return 0;
1233 }
1234
1235 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1236 {
1237     uint32_t tmp;
1238
1239     if (n > NUM_CORE_REGS)
1240         return 0;
1241
1242     tmp = ldl_p(mem_buf);
1243
1244     if (n < 32) {
1245         env->regs[n] = tmp;
1246     } else {
1247         env->sregs[n - 32] = tmp;
1248     }
1249     return 4;
1250 }
1251 #elif defined (TARGET_CRIS)
1252
1253 #define NUM_CORE_REGS 49
1254
1255 static int
1256 read_register_crisv10(CPUState *env, uint8_t *mem_buf, int n)
1257 {
1258     if (n < 15) {
1259         GET_REG32(env->regs[n]);
1260     }
1261
1262     if (n == 15) {
1263         GET_REG32(env->pc);
1264     }
1265
1266     if (n < 32) {
1267         switch (n) {
1268         case 16:
1269             GET_REG8(env->pregs[n - 16]);
1270             break;
1271         case 17:
1272             GET_REG8(env->pregs[n - 16]);
1273             break;
1274         case 20:
1275         case 21:
1276             GET_REG16(env->pregs[n - 16]);
1277             break;
1278         default:
1279             if (n >= 23) {
1280                 GET_REG32(env->pregs[n - 16]);
1281             }
1282             break;
1283         }
1284     }
1285     return 0;
1286 }
1287
1288 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1289 {
1290     uint8_t srs;
1291
1292     if (env->pregs[PR_VR] < 32)
1293         return read_register_crisv10(env, mem_buf, n);
1294
1295     srs = env->pregs[PR_SRS];
1296     if (n < 16) {
1297         GET_REG32(env->regs[n]);
1298     }
1299
1300     if (n >= 21 && n < 32) {
1301         GET_REG32(env->pregs[n - 16]);
1302     }
1303     if (n >= 33 && n < 49) {
1304         GET_REG32(env->sregs[srs][n - 33]);
1305     }
1306     switch (n) {
1307     case 16: GET_REG8(env->pregs[0]);
1308     case 17: GET_REG8(env->pregs[1]);
1309     case 18: GET_REG32(env->pregs[2]);
1310     case 19: GET_REG8(srs);
1311     case 20: GET_REG16(env->pregs[4]);
1312     case 32: GET_REG32(env->pc);
1313     }
1314
1315     return 0;
1316 }
1317
1318 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1319 {
1320     uint32_t tmp;
1321
1322     if (n > 49)
1323         return 0;
1324
1325     tmp = ldl_p(mem_buf);
1326
1327     if (n < 16) {
1328         env->regs[n] = tmp;
1329     }
1330
1331     if (n >= 21 && n < 32) {
1332         env->pregs[n - 16] = tmp;
1333     }
1334
1335     /* FIXME: Should support function regs be writable?  */
1336     switch (n) {
1337     case 16: return 1;
1338     case 17: return 1;
1339     case 18: env->pregs[PR_PID] = tmp; break;
1340     case 19: return 1;
1341     case 20: return 2;
1342     case 32: env->pc = tmp; break;
1343     }
1344
1345     return 4;
1346 }
1347 #elif defined (TARGET_ALPHA)
1348
1349 #define NUM_CORE_REGS 67
1350
1351 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1352 {
1353     uint64_t val;
1354     CPU_DoubleU d;
1355
1356     switch (n) {
1357     case 0 ... 30:
1358         val = env->ir[n];
1359         break;
1360     case 32 ... 62:
1361         d.d = env->fir[n - 32];
1362         val = d.ll;
1363         break;
1364     case 63:
1365         val = cpu_alpha_load_fpcr(env);
1366         break;
1367     case 64:
1368         val = env->pc;
1369         break;
1370     case 66:
1371         val = env->unique;
1372         break;
1373     case 31:
1374     case 65:
1375         /* 31 really is the zero register; 65 is unassigned in the
1376            gdb protocol, but is still required to occupy 8 bytes. */
1377         val = 0;
1378         break;
1379     default:
1380         return 0;
1381     }
1382     GET_REGL(val);
1383 }
1384
1385 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1386 {
1387     target_ulong tmp = ldtul_p(mem_buf);
1388     CPU_DoubleU d;
1389
1390     switch (n) {
1391     case 0 ... 30:
1392         env->ir[n] = tmp;
1393         break;
1394     case 32 ... 62:
1395         d.ll = tmp;
1396         env->fir[n - 32] = d.d;
1397         break;
1398     case 63:
1399         cpu_alpha_store_fpcr(env, tmp);
1400         break;
1401     case 64:
1402         env->pc = tmp;
1403         break;
1404     case 66:
1405         env->unique = tmp;
1406         break;
1407     case 31:
1408     case 65:
1409         /* 31 really is the zero register; 65 is unassigned in the
1410            gdb protocol, but is still required to occupy 8 bytes. */
1411         break;
1412     default:
1413         return 0;
1414     }
1415     return 8;
1416 }
1417 #elif defined (TARGET_S390X)
1418
1419 #define NUM_CORE_REGS S390_NUM_TOTAL_REGS
1420
1421 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1422 {
1423     switch (n) {
1424         case S390_PSWM_REGNUM: GET_REGL(env->psw.mask); break;
1425         case S390_PSWA_REGNUM: GET_REGL(env->psw.addr); break;
1426         case S390_R0_REGNUM ... S390_R15_REGNUM:
1427             GET_REGL(env->regs[n-S390_R0_REGNUM]); break;
1428         case S390_A0_REGNUM ... S390_A15_REGNUM:
1429             GET_REG32(env->aregs[n-S390_A0_REGNUM]); break;
1430         case S390_FPC_REGNUM: GET_REG32(env->fpc); break;
1431         case S390_F0_REGNUM ... S390_F15_REGNUM:
1432             /* XXX */
1433             break;
1434         case S390_PC_REGNUM: GET_REGL(env->psw.addr); break;
1435         case S390_CC_REGNUM: GET_REG32(env->cc); break;
1436     }
1437
1438     return 0;
1439 }
1440
1441 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1442 {
1443     target_ulong tmpl;
1444     uint32_t tmp32;
1445     int r = 8;
1446     tmpl = ldtul_p(mem_buf);
1447     tmp32 = ldl_p(mem_buf);
1448
1449     switch (n) {
1450         case S390_PSWM_REGNUM: env->psw.mask = tmpl; break;
1451         case S390_PSWA_REGNUM: env->psw.addr = tmpl; break;
1452         case S390_R0_REGNUM ... S390_R15_REGNUM:
1453             env->regs[n-S390_R0_REGNUM] = tmpl; break;
1454         case S390_A0_REGNUM ... S390_A15_REGNUM:
1455             env->aregs[n-S390_A0_REGNUM] = tmp32; r=4; break;
1456         case S390_FPC_REGNUM: env->fpc = tmp32; r=4; break;
1457         case S390_F0_REGNUM ... S390_F15_REGNUM:
1458             /* XXX */
1459             break;
1460         case S390_PC_REGNUM: env->psw.addr = tmpl; break;
1461         case S390_CC_REGNUM: env->cc = tmp32; r=4; break;
1462     }
1463
1464     return r;
1465 }
1466 #else
1467
1468 #define NUM_CORE_REGS 0
1469
1470 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1471 {
1472     return 0;
1473 }
1474
1475 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1476 {
1477     return 0;
1478 }
1479
1480 #endif
1481
1482 static int num_g_regs = NUM_CORE_REGS;
1483
1484 #ifdef GDB_CORE_XML
1485 /* Encode data using the encoding for 'x' packets.  */
1486 static int memtox(char *buf, const char *mem, int len)
1487 {
1488     char *p = buf;
1489     char c;
1490
1491     while (len--) {
1492         c = *(mem++);
1493         switch (c) {
1494         case '#': case '$': case '*': case '}':
1495             *(p++) = '}';
1496             *(p++) = c ^ 0x20;
1497             break;
1498         default:
1499             *(p++) = c;
1500             break;
1501         }
1502     }
1503     return p - buf;
1504 }
1505
1506 static const char *get_feature_xml(const char *p, const char **newp)
1507 {
1508     extern const char *const xml_builtin[][2];
1509     size_t len;
1510     int i;
1511     const char *name;
1512     static char target_xml[1024];
1513
1514     len = 0;
1515     while (p[len] && p[len] != ':')
1516         len++;
1517     *newp = p + len;
1518
1519     name = NULL;
1520     if (strncmp(p, "target.xml", len) == 0) {
1521         /* Generate the XML description for this CPU.  */
1522         if (!target_xml[0]) {
1523             GDBRegisterState *r;
1524
1525             snprintf(target_xml, sizeof(target_xml),
1526                      "<?xml version=\"1.0\"?>"
1527                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1528                      "<target>"
1529                      "<xi:include href=\"%s\"/>",
1530                      GDB_CORE_XML);
1531
1532             for (r = first_cpu->gdb_regs; r; r = r->next) {
1533                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
1534                 pstrcat(target_xml, sizeof(target_xml), r->xml);
1535                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
1536             }
1537             pstrcat(target_xml, sizeof(target_xml), "</target>");
1538         }
1539         return target_xml;
1540     }
1541     for (i = 0; ; i++) {
1542         name = xml_builtin[i][0];
1543         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1544             break;
1545     }
1546     return name ? xml_builtin[i][1] : NULL;
1547 }
1548 #endif
1549
1550 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1551 {
1552     GDBRegisterState *r;
1553
1554     if (reg < NUM_CORE_REGS)
1555         return cpu_gdb_read_register(env, mem_buf, reg);
1556
1557     for (r = env->gdb_regs; r; r = r->next) {
1558         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1559             return r->get_reg(env, mem_buf, reg - r->base_reg);
1560         }
1561     }
1562     return 0;
1563 }
1564
1565 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1566 {
1567     GDBRegisterState *r;
1568
1569     if (reg < NUM_CORE_REGS)
1570         return cpu_gdb_write_register(env, mem_buf, reg);
1571
1572     for (r = env->gdb_regs; r; r = r->next) {
1573         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1574             return r->set_reg(env, mem_buf, reg - r->base_reg);
1575         }
1576     }
1577     return 0;
1578 }
1579
1580 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1581    specifies the first register number and these registers are included in
1582    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1583    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1584  */
1585
1586 void gdb_register_coprocessor(CPUState * env,
1587                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1588                              int num_regs, const char *xml, int g_pos)
1589 {
1590     GDBRegisterState *s;
1591     GDBRegisterState **p;
1592     static int last_reg = NUM_CORE_REGS;
1593
1594     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1595     s->base_reg = last_reg;
1596     s->num_regs = num_regs;
1597     s->get_reg = get_reg;
1598     s->set_reg = set_reg;
1599     s->xml = xml;
1600     p = &env->gdb_regs;
1601     while (*p) {
1602         /* Check for duplicates.  */
1603         if (strcmp((*p)->xml, xml) == 0)
1604             return;
1605         p = &(*p)->next;
1606     }
1607     /* Add to end of list.  */
1608     last_reg += num_regs;
1609     *p = s;
1610     if (g_pos) {
1611         if (g_pos != s->base_reg) {
1612             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1613                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1614         } else {
1615             num_g_regs = last_reg;
1616         }
1617     }
1618 }
1619
1620 #ifndef CONFIG_USER_ONLY
1621 static const int xlat_gdb_type[] = {
1622     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1623     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1624     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1625 };
1626 #endif
1627
1628 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1629 {
1630     CPUState *env;
1631     int err = 0;
1632
1633     if (kvm_enabled())
1634         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1635
1636     switch (type) {
1637     case GDB_BREAKPOINT_SW:
1638     case GDB_BREAKPOINT_HW:
1639         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1640             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1641             if (err)
1642                 break;
1643         }
1644         return err;
1645 #ifndef CONFIG_USER_ONLY
1646     case GDB_WATCHPOINT_WRITE:
1647     case GDB_WATCHPOINT_READ:
1648     case GDB_WATCHPOINT_ACCESS:
1649         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1650             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1651                                         NULL);
1652             if (err)
1653                 break;
1654         }
1655         return err;
1656 #endif
1657     default:
1658         return -ENOSYS;
1659     }
1660 }
1661
1662 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1663 {
1664     CPUState *env;
1665     int err = 0;
1666
1667     if (kvm_enabled())
1668         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1669
1670     switch (type) {
1671     case GDB_BREAKPOINT_SW:
1672     case GDB_BREAKPOINT_HW:
1673         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1674             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1675             if (err)
1676                 break;
1677         }
1678         return err;
1679 #ifndef CONFIG_USER_ONLY
1680     case GDB_WATCHPOINT_WRITE:
1681     case GDB_WATCHPOINT_READ:
1682     case GDB_WATCHPOINT_ACCESS:
1683         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1684             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1685             if (err)
1686                 break;
1687         }
1688         return err;
1689 #endif
1690     default:
1691         return -ENOSYS;
1692     }
1693 }
1694
1695 static void gdb_breakpoint_remove_all(void)
1696 {
1697     CPUState *env;
1698
1699     if (kvm_enabled()) {
1700         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1701         return;
1702     }
1703
1704     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1705         cpu_breakpoint_remove_all(env, BP_GDB);
1706 #ifndef CONFIG_USER_ONLY
1707         cpu_watchpoint_remove_all(env, BP_GDB);
1708 #endif
1709     }
1710 }
1711
1712 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1713 {
1714 #if defined(TARGET_I386)
1715     cpu_synchronize_state(s->c_cpu);
1716     s->c_cpu->eip = pc;
1717 #elif defined (TARGET_PPC)
1718     s->c_cpu->nip = pc;
1719 #elif defined (TARGET_SPARC)
1720     s->c_cpu->pc = pc;
1721     s->c_cpu->npc = pc + 4;
1722 #elif defined (TARGET_ARM)
1723     s->c_cpu->regs[15] = pc;
1724 #elif defined (TARGET_SH4)
1725     s->c_cpu->pc = pc;
1726 #elif defined (TARGET_MIPS)
1727     s->c_cpu->active_tc.PC = pc & ~(target_ulong)1;
1728     if (pc & 1) {
1729         s->c_cpu->hflags |= MIPS_HFLAG_M16;
1730     } else {
1731         s->c_cpu->hflags &= ~(MIPS_HFLAG_M16);
1732     }
1733 #elif defined (TARGET_MICROBLAZE)
1734     s->c_cpu->sregs[SR_PC] = pc;
1735 #elif defined (TARGET_CRIS)
1736     s->c_cpu->pc = pc;
1737 #elif defined (TARGET_ALPHA)
1738     s->c_cpu->pc = pc;
1739 #elif defined (TARGET_S390X)
1740     cpu_synchronize_state(s->c_cpu);
1741     s->c_cpu->psw.addr = pc;
1742 #endif
1743 }
1744
1745 static inline int gdb_id(CPUState *env)
1746 {
1747 #if defined(CONFIG_USER_ONLY) && defined(CONFIG_USE_NPTL)
1748     return env->host_tid;
1749 #else
1750     return env->cpu_index + 1;
1751 #endif
1752 }
1753
1754 static CPUState *find_cpu(uint32_t thread_id)
1755 {
1756     CPUState *env;
1757
1758     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1759         if (gdb_id(env) == thread_id) {
1760             return env;
1761         }
1762     }
1763
1764     return NULL;
1765 }
1766
1767 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1768 {
1769     CPUState *env;
1770     const char *p;
1771     uint32_t thread;
1772     int ch, reg_size, type, res;
1773     char buf[MAX_PACKET_LENGTH];
1774     uint8_t mem_buf[MAX_PACKET_LENGTH];
1775     uint8_t *registers;
1776     target_ulong addr, len;
1777
1778 #ifdef DEBUG_GDB
1779     printf("command='%s'\n", line_buf);
1780 #endif
1781     p = line_buf;
1782     ch = *p++;
1783     switch(ch) {
1784     case '?':
1785         /* TODO: Make this return the correct value for user-mode.  */
1786         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1787                  gdb_id(s->c_cpu));
1788         put_packet(s, buf);
1789         /* Remove all the breakpoints when this query is issued,
1790          * because gdb is doing and initial connect and the state
1791          * should be cleaned up.
1792          */
1793         gdb_breakpoint_remove_all();
1794         break;
1795     case 'c':
1796         if (*p != '\0') {
1797             addr = strtoull(p, (char **)&p, 16);
1798             gdb_set_cpu_pc(s, addr);
1799         }
1800         s->signal = 0;
1801         gdb_continue(s);
1802         return RS_IDLE;
1803     case 'C':
1804         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1805         if (s->signal == -1)
1806             s->signal = 0;
1807         gdb_continue(s);
1808         return RS_IDLE;
1809     case 'v':
1810         if (strncmp(p, "Cont", 4) == 0) {
1811             int res_signal, res_thread;
1812
1813             p += 4;
1814             if (*p == '?') {
1815                 put_packet(s, "vCont;c;C;s;S");
1816                 break;
1817             }
1818             res = 0;
1819             res_signal = 0;
1820             res_thread = 0;
1821             while (*p) {
1822                 int action, signal;
1823
1824                 if (*p++ != ';') {
1825                     res = 0;
1826                     break;
1827                 }
1828                 action = *p++;
1829                 signal = 0;
1830                 if (action == 'C' || action == 'S') {
1831                     signal = strtoul(p, (char **)&p, 16);
1832                 } else if (action != 'c' && action != 's') {
1833                     res = 0;
1834                     break;
1835                 }
1836                 thread = 0;
1837                 if (*p == ':') {
1838                     thread = strtoull(p+1, (char **)&p, 16);
1839                 }
1840                 action = tolower(action);
1841                 if (res == 0 || (res == 'c' && action == 's')) {
1842                     res = action;
1843                     res_signal = signal;
1844                     res_thread = thread;
1845                 }
1846             }
1847             if (res) {
1848                 if (res_thread != -1 && res_thread != 0) {
1849                     env = find_cpu(res_thread);
1850                     if (env == NULL) {
1851                         put_packet(s, "E22");
1852                         break;
1853                     }
1854                     s->c_cpu = env;
1855                 }
1856                 if (res == 's') {
1857                     cpu_single_step(s->c_cpu, sstep_flags);
1858                 }
1859                 s->signal = res_signal;
1860                 gdb_continue(s);
1861                 return RS_IDLE;
1862             }
1863             break;
1864         } else {
1865             goto unknown_command;
1866         }
1867     case 'k':
1868         /* Kill the target */
1869         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1870         exit(0);
1871     case 'D':
1872         /* Detach packet */
1873         gdb_breakpoint_remove_all();
1874         gdb_syscall_mode = GDB_SYS_DISABLED;
1875         gdb_continue(s);
1876         put_packet(s, "OK");
1877         break;
1878     case 's':
1879         if (*p != '\0') {
1880             addr = strtoull(p, (char **)&p, 16);
1881             gdb_set_cpu_pc(s, addr);
1882         }
1883         cpu_single_step(s->c_cpu, sstep_flags);
1884         gdb_continue(s);
1885         return RS_IDLE;
1886     case 'F':
1887         {
1888             target_ulong ret;
1889             target_ulong err;
1890
1891             ret = strtoull(p, (char **)&p, 16);
1892             if (*p == ',') {
1893                 p++;
1894                 err = strtoull(p, (char **)&p, 16);
1895             } else {
1896                 err = 0;
1897             }
1898             if (*p == ',')
1899                 p++;
1900             type = *p;
1901             if (gdb_current_syscall_cb)
1902                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1903             if (type == 'C') {
1904                 put_packet(s, "T02");
1905             } else {
1906                 gdb_continue(s);
1907             }
1908         }
1909         break;
1910     case 'g':
1911         cpu_synchronize_state(s->g_cpu);
1912         len = 0;
1913         for (addr = 0; addr < num_g_regs; addr++) {
1914             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1915             len += reg_size;
1916         }
1917         memtohex(buf, mem_buf, len);
1918         put_packet(s, buf);
1919         break;
1920     case 'G':
1921         cpu_synchronize_state(s->g_cpu);
1922         registers = mem_buf;
1923         len = strlen(p) / 2;
1924         hextomem((uint8_t *)registers, p, len);
1925         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1926             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1927             len -= reg_size;
1928             registers += reg_size;
1929         }
1930         put_packet(s, "OK");
1931         break;
1932     case 'm':
1933         addr = strtoull(p, (char **)&p, 16);
1934         if (*p == ',')
1935             p++;
1936         len = strtoull(p, NULL, 16);
1937         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1938             put_packet (s, "E14");
1939         } else {
1940             memtohex(buf, mem_buf, len);
1941             put_packet(s, buf);
1942         }
1943         break;
1944     case 'M':
1945         addr = strtoull(p, (char **)&p, 16);
1946         if (*p == ',')
1947             p++;
1948         len = strtoull(p, (char **)&p, 16);
1949         if (*p == ':')
1950             p++;
1951         hextomem(mem_buf, p, len);
1952         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1953             put_packet(s, "E14");
1954         else
1955             put_packet(s, "OK");
1956         break;
1957     case 'p':
1958         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1959            This works, but can be very slow.  Anything new enough to
1960            understand XML also knows how to use this properly.  */
1961         if (!gdb_has_xml)
1962             goto unknown_command;
1963         addr = strtoull(p, (char **)&p, 16);
1964         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1965         if (reg_size) {
1966             memtohex(buf, mem_buf, reg_size);
1967             put_packet(s, buf);
1968         } else {
1969             put_packet(s, "E14");
1970         }
1971         break;
1972     case 'P':
1973         if (!gdb_has_xml)
1974             goto unknown_command;
1975         addr = strtoull(p, (char **)&p, 16);
1976         if (*p == '=')
1977             p++;
1978         reg_size = strlen(p) / 2;
1979         hextomem(mem_buf, p, reg_size);
1980         gdb_write_register(s->g_cpu, mem_buf, addr);
1981         put_packet(s, "OK");
1982         break;
1983     case 'Z':
1984     case 'z':
1985         type = strtoul(p, (char **)&p, 16);
1986         if (*p == ',')
1987             p++;
1988         addr = strtoull(p, (char **)&p, 16);
1989         if (*p == ',')
1990             p++;
1991         len = strtoull(p, (char **)&p, 16);
1992         if (ch == 'Z')
1993             res = gdb_breakpoint_insert(addr, len, type);
1994         else
1995             res = gdb_breakpoint_remove(addr, len, type);
1996         if (res >= 0)
1997              put_packet(s, "OK");
1998         else if (res == -ENOSYS)
1999             put_packet(s, "");
2000         else
2001             put_packet(s, "E22");
2002         break;
2003     case 'H':
2004         type = *p++;
2005         thread = strtoull(p, (char **)&p, 16);
2006         if (thread == -1 || thread == 0) {
2007             put_packet(s, "OK");
2008             break;
2009         }
2010         env = find_cpu(thread);
2011         if (env == NULL) {
2012             put_packet(s, "E22");
2013             break;
2014         }
2015         switch (type) {
2016         case 'c':
2017             s->c_cpu = env;
2018             put_packet(s, "OK");
2019             break;
2020         case 'g':
2021             s->g_cpu = env;
2022             put_packet(s, "OK");
2023             break;
2024         default:
2025              put_packet(s, "E22");
2026              break;
2027         }
2028         break;
2029     case 'T':
2030         thread = strtoull(p, (char **)&p, 16);
2031         env = find_cpu(thread);
2032
2033         if (env != NULL) {
2034             put_packet(s, "OK");
2035         } else {
2036             put_packet(s, "E22");
2037         }
2038         break;
2039     case 'q':
2040     case 'Q':
2041         /* parse any 'q' packets here */
2042         if (!strcmp(p,"qemu.sstepbits")) {
2043             /* Query Breakpoint bit definitions */
2044             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
2045                      SSTEP_ENABLE,
2046                      SSTEP_NOIRQ,
2047                      SSTEP_NOTIMER);
2048             put_packet(s, buf);
2049             break;
2050         } else if (strncmp(p,"qemu.sstep",10) == 0) {
2051             /* Display or change the sstep_flags */
2052             p += 10;
2053             if (*p != '=') {
2054                 /* Display current setting */
2055                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
2056                 put_packet(s, buf);
2057                 break;
2058             }
2059             p++;
2060             type = strtoul(p, (char **)&p, 16);
2061             sstep_flags = type;
2062             put_packet(s, "OK");
2063             break;
2064         } else if (strcmp(p,"C") == 0) {
2065             /* "Current thread" remains vague in the spec, so always return
2066              *  the first CPU (gdb returns the first thread). */
2067             put_packet(s, "QC1");
2068             break;
2069         } else if (strcmp(p,"fThreadInfo") == 0) {
2070             s->query_cpu = first_cpu;
2071             goto report_cpuinfo;
2072         } else if (strcmp(p,"sThreadInfo") == 0) {
2073         report_cpuinfo:
2074             if (s->query_cpu) {
2075                 snprintf(buf, sizeof(buf), "m%x", gdb_id(s->query_cpu));
2076                 put_packet(s, buf);
2077                 s->query_cpu = s->query_cpu->next_cpu;
2078             } else
2079                 put_packet(s, "l");
2080             break;
2081         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
2082             thread = strtoull(p+16, (char **)&p, 16);
2083             env = find_cpu(thread);
2084             if (env != NULL) {
2085                 cpu_synchronize_state(env);
2086                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
2087                                "CPU#%d [%s]", env->cpu_index,
2088                                env->halted ? "halted " : "running");
2089                 memtohex(buf, mem_buf, len);
2090                 put_packet(s, buf);
2091             }
2092             break;
2093         }
2094 #ifdef CONFIG_USER_ONLY
2095         else if (strncmp(p, "Offsets", 7) == 0) {
2096             TaskState *ts = s->c_cpu->opaque;
2097
2098             snprintf(buf, sizeof(buf),
2099                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
2100                      ";Bss=" TARGET_ABI_FMT_lx,
2101                      ts->info->code_offset,
2102                      ts->info->data_offset,
2103                      ts->info->data_offset);
2104             put_packet(s, buf);
2105             break;
2106         }
2107 #else /* !CONFIG_USER_ONLY */
2108         else if (strncmp(p, "Rcmd,", 5) == 0) {
2109             int len = strlen(p + 5);
2110
2111             if ((len % 2) != 0) {
2112                 put_packet(s, "E01");
2113                 break;
2114             }
2115             hextomem(mem_buf, p + 5, len);
2116             len = len / 2;
2117             mem_buf[len++] = 0;
2118             qemu_chr_read(s->mon_chr, mem_buf, len);
2119             put_packet(s, "OK");
2120             break;
2121         }
2122 #endif /* !CONFIG_USER_ONLY */
2123         if (strncmp(p, "Supported", 9) == 0) {
2124             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
2125 #ifdef GDB_CORE_XML
2126             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
2127 #endif
2128             put_packet(s, buf);
2129             break;
2130         }
2131 #ifdef GDB_CORE_XML
2132         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
2133             const char *xml;
2134             target_ulong total_len;
2135
2136             gdb_has_xml = 1;
2137             p += 19;
2138             xml = get_feature_xml(p, &p);
2139             if (!xml) {
2140                 snprintf(buf, sizeof(buf), "E00");
2141                 put_packet(s, buf);
2142                 break;
2143             }
2144
2145             if (*p == ':')
2146                 p++;
2147             addr = strtoul(p, (char **)&p, 16);
2148             if (*p == ',')
2149                 p++;
2150             len = strtoul(p, (char **)&p, 16);
2151
2152             total_len = strlen(xml);
2153             if (addr > total_len) {
2154                 snprintf(buf, sizeof(buf), "E00");
2155                 put_packet(s, buf);
2156                 break;
2157             }
2158             if (len > (MAX_PACKET_LENGTH - 5) / 2)
2159                 len = (MAX_PACKET_LENGTH - 5) / 2;
2160             if (len < total_len - addr) {
2161                 buf[0] = 'm';
2162                 len = memtox(buf + 1, xml + addr, len);
2163             } else {
2164                 buf[0] = 'l';
2165                 len = memtox(buf + 1, xml + addr, total_len - addr);
2166             }
2167             put_packet_binary(s, buf, len + 1);
2168             break;
2169         }
2170 #endif
2171         /* Unrecognised 'q' command.  */
2172         goto unknown_command;
2173
2174     default:
2175     unknown_command:
2176         /* put empty packet */
2177         buf[0] = '\0';
2178         put_packet(s, buf);
2179         break;
2180     }
2181     return RS_IDLE;
2182 }
2183
2184 void gdb_set_stop_cpu(CPUState *env)
2185 {
2186     gdbserver_state->c_cpu = env;
2187     gdbserver_state->g_cpu = env;
2188 }
2189
2190 #ifndef CONFIG_USER_ONLY
2191 static void gdb_vm_state_change(void *opaque, int running, int reason)
2192 {
2193     GDBState *s = gdbserver_state;
2194     CPUState *env = s->c_cpu;
2195     char buf[256];
2196     const char *type;
2197     int ret;
2198
2199     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
2200         s->state == RS_INACTIVE || s->state == RS_SYSCALL)
2201         return;
2202
2203     /* disable single step if it was enable */
2204     cpu_single_step(env, 0);
2205
2206     if (reason == EXCP_DEBUG) {
2207         if (env->watchpoint_hit) {
2208             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
2209             case BP_MEM_READ:
2210                 type = "r";
2211                 break;
2212             case BP_MEM_ACCESS:
2213                 type = "a";
2214                 break;
2215             default:
2216                 type = "";
2217                 break;
2218             }
2219             snprintf(buf, sizeof(buf),
2220                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
2221                      GDB_SIGNAL_TRAP, gdb_id(env), type,
2222                      env->watchpoint_hit->vaddr);
2223             put_packet(s, buf);
2224             env->watchpoint_hit = NULL;
2225             return;
2226         }
2227         tb_flush(env);
2228         ret = GDB_SIGNAL_TRAP;
2229     } else {
2230         ret = GDB_SIGNAL_INT;
2231     }
2232     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, gdb_id(env));
2233     put_packet(s, buf);
2234 }
2235 #endif
2236
2237 /* Send a gdb syscall request.
2238    This accepts limited printf-style format specifiers, specifically:
2239     %x  - target_ulong argument printed in hex.
2240     %lx - 64-bit argument printed in hex.
2241     %s  - string pointer (target_ulong) and length (int) pair.  */
2242 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
2243 {
2244     va_list va;
2245     char buf[256];
2246     char *p;
2247     target_ulong addr;
2248     uint64_t i64;
2249     GDBState *s;
2250
2251     s = gdbserver_state;
2252     if (!s)
2253         return;
2254     gdb_current_syscall_cb = cb;
2255     s->state = RS_SYSCALL;
2256 #ifndef CONFIG_USER_ONLY
2257     vm_stop(EXCP_DEBUG);
2258 #endif
2259     s->state = RS_IDLE;
2260     va_start(va, fmt);
2261     p = buf;
2262     *(p++) = 'F';
2263     while (*fmt) {
2264         if (*fmt == '%') {
2265             fmt++;
2266             switch (*fmt++) {
2267             case 'x':
2268                 addr = va_arg(va, target_ulong);
2269                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
2270                 break;
2271             case 'l':
2272                 if (*(fmt++) != 'x')
2273                     goto bad_format;
2274                 i64 = va_arg(va, uint64_t);
2275                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
2276                 break;
2277             case 's':
2278                 addr = va_arg(va, target_ulong);
2279                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
2280                               addr, va_arg(va, int));
2281                 break;
2282             default:
2283             bad_format:
2284                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2285                         fmt - 1);
2286                 break;
2287             }
2288         } else {
2289             *(p++) = *(fmt++);
2290         }
2291     }
2292     *p = 0;
2293     va_end(va);
2294     put_packet(s, buf);
2295 #ifdef CONFIG_USER_ONLY
2296     gdb_handlesig(s->c_cpu, 0);
2297 #else
2298     cpu_exit(s->c_cpu);
2299 #endif
2300 }
2301
2302 static void gdb_read_byte(GDBState *s, int ch)
2303 {
2304     int i, csum;
2305     uint8_t reply;
2306
2307 #ifndef CONFIG_USER_ONLY
2308     if (s->last_packet_len) {
2309         /* Waiting for a response to the last packet.  If we see the start
2310            of a new command then abandon the previous response.  */
2311         if (ch == '-') {
2312 #ifdef DEBUG_GDB
2313             printf("Got NACK, retransmitting\n");
2314 #endif
2315             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2316         }
2317 #ifdef DEBUG_GDB
2318         else if (ch == '+')
2319             printf("Got ACK\n");
2320         else
2321             printf("Got '%c' when expecting ACK/NACK\n", ch);
2322 #endif
2323         if (ch == '+' || ch == '$')
2324             s->last_packet_len = 0;
2325         if (ch != '$')
2326             return;
2327     }
2328     if (vm_running) {
2329         /* when the CPU is running, we cannot do anything except stop
2330            it when receiving a char */
2331         vm_stop(EXCP_INTERRUPT);
2332     } else
2333 #endif
2334     {
2335         switch(s->state) {
2336         case RS_IDLE:
2337             if (ch == '$') {
2338                 s->line_buf_index = 0;
2339                 s->state = RS_GETLINE;
2340             }
2341             break;
2342         case RS_GETLINE:
2343             if (ch == '#') {
2344             s->state = RS_CHKSUM1;
2345             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2346                 s->state = RS_IDLE;
2347             } else {
2348             s->line_buf[s->line_buf_index++] = ch;
2349             }
2350             break;
2351         case RS_CHKSUM1:
2352             s->line_buf[s->line_buf_index] = '\0';
2353             s->line_csum = fromhex(ch) << 4;
2354             s->state = RS_CHKSUM2;
2355             break;
2356         case RS_CHKSUM2:
2357             s->line_csum |= fromhex(ch);
2358             csum = 0;
2359             for(i = 0; i < s->line_buf_index; i++) {
2360                 csum += s->line_buf[i];
2361             }
2362             if (s->line_csum != (csum & 0xff)) {
2363                 reply = '-';
2364                 put_buffer(s, &reply, 1);
2365                 s->state = RS_IDLE;
2366             } else {
2367                 reply = '+';
2368                 put_buffer(s, &reply, 1);
2369                 s->state = gdb_handle_packet(s, s->line_buf);
2370             }
2371             break;
2372         default:
2373             abort();
2374         }
2375     }
2376 }
2377
2378 /* Tell the remote gdb that the process has exited.  */
2379 void gdb_exit(CPUState *env, int code)
2380 {
2381   GDBState *s;
2382   char buf[4];
2383
2384   s = gdbserver_state;
2385   if (!s) {
2386       return;
2387   }
2388 #ifdef CONFIG_USER_ONLY
2389   if (gdbserver_fd < 0 || s->fd < 0) {
2390       return;
2391   }
2392 #endif
2393
2394   snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
2395   put_packet(s, buf);
2396 }
2397
2398 #ifdef CONFIG_USER_ONLY
2399 int
2400 gdb_queuesig (void)
2401 {
2402     GDBState *s;
2403
2404     s = gdbserver_state;
2405
2406     if (gdbserver_fd < 0 || s->fd < 0)
2407         return 0;
2408     else
2409         return 1;
2410 }
2411
2412 int
2413 gdb_handlesig (CPUState *env, int sig)
2414 {
2415   GDBState *s;
2416   char buf[256];
2417   int n;
2418
2419   s = gdbserver_state;
2420   if (gdbserver_fd < 0 || s->fd < 0)
2421     return sig;
2422
2423   /* disable single step if it was enabled */
2424   cpu_single_step(env, 0);
2425   tb_flush(env);
2426
2427   if (sig != 0)
2428     {
2429       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2430       put_packet(s, buf);
2431     }
2432   /* put_packet() might have detected that the peer terminated the
2433      connection.  */
2434   if (s->fd < 0)
2435       return sig;
2436
2437   sig = 0;
2438   s->state = RS_IDLE;
2439   s->running_state = 0;
2440   while (s->running_state == 0) {
2441       n = read (s->fd, buf, 256);
2442       if (n > 0)
2443         {
2444           int i;
2445
2446           for (i = 0; i < n; i++)
2447             gdb_read_byte (s, buf[i]);
2448         }
2449       else if (n == 0 || errno != EAGAIN)
2450         {
2451           /* XXX: Connection closed.  Should probably wait for annother
2452              connection before continuing.  */
2453           return sig;
2454         }
2455   }
2456   sig = s->signal;
2457   s->signal = 0;
2458   return sig;
2459 }
2460
2461 /* Tell the remote gdb that the process has exited due to SIG.  */
2462 void gdb_signalled(CPUState *env, int sig)
2463 {
2464   GDBState *s;
2465   char buf[4];
2466
2467   s = gdbserver_state;
2468   if (gdbserver_fd < 0 || s->fd < 0)
2469     return;
2470
2471   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2472   put_packet(s, buf);
2473 }
2474
2475 static void gdb_accept(void)
2476 {
2477     GDBState *s;
2478     struct sockaddr_in sockaddr;
2479     socklen_t len;
2480     int val, fd;
2481
2482     for(;;) {
2483         len = sizeof(sockaddr);
2484         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2485         if (fd < 0 && errno != EINTR) {
2486             perror("accept");
2487             return;
2488         } else if (fd >= 0) {
2489 #ifndef _WIN32
2490             fcntl(fd, F_SETFD, FD_CLOEXEC);
2491 #endif
2492             break;
2493         }
2494     }
2495
2496     /* set short latency */
2497     val = 1;
2498     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2499
2500     s = qemu_mallocz(sizeof(GDBState));
2501     s->c_cpu = first_cpu;
2502     s->g_cpu = first_cpu;
2503     s->fd = fd;
2504     gdb_has_xml = 0;
2505
2506     gdbserver_state = s;
2507
2508     fcntl(fd, F_SETFL, O_NONBLOCK);
2509 }
2510
2511 static int gdbserver_open(int port)
2512 {
2513     struct sockaddr_in sockaddr;
2514     int fd, val, ret;
2515
2516     fd = socket(PF_INET, SOCK_STREAM, 0);
2517     if (fd < 0) {
2518         perror("socket");
2519         return -1;
2520     }
2521 #ifndef _WIN32
2522     fcntl(fd, F_SETFD, FD_CLOEXEC);
2523 #endif
2524
2525     /* allow fast reuse */
2526     val = 1;
2527     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2528
2529     sockaddr.sin_family = AF_INET;
2530     sockaddr.sin_port = htons(port);
2531     sockaddr.sin_addr.s_addr = 0;
2532     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2533     if (ret < 0) {
2534         perror("bind");
2535         return -1;
2536     }
2537     ret = listen(fd, 0);
2538     if (ret < 0) {
2539         perror("listen");
2540         return -1;
2541     }
2542     return fd;
2543 }
2544
2545 int gdbserver_start(int port)
2546 {
2547     gdbserver_fd = gdbserver_open(port);
2548     if (gdbserver_fd < 0)
2549         return -1;
2550     /* accept connections */
2551     gdb_accept();
2552     return 0;
2553 }
2554
2555 /* Disable gdb stub for child processes.  */
2556 void gdbserver_fork(CPUState *env)
2557 {
2558     GDBState *s = gdbserver_state;
2559     if (gdbserver_fd < 0 || s->fd < 0)
2560       return;
2561     close(s->fd);
2562     s->fd = -1;
2563     cpu_breakpoint_remove_all(env, BP_GDB);
2564     cpu_watchpoint_remove_all(env, BP_GDB);
2565 }
2566 #else
2567 static int gdb_chr_can_receive(void *opaque)
2568 {
2569   /* We can handle an arbitrarily large amount of data.
2570    Pick the maximum packet size, which is as good as anything.  */
2571   return MAX_PACKET_LENGTH;
2572 }
2573
2574 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2575 {
2576     int i;
2577
2578     for (i = 0; i < size; i++) {
2579         gdb_read_byte(gdbserver_state, buf[i]);
2580     }
2581 }
2582
2583 static void gdb_chr_event(void *opaque, int event)
2584 {
2585     switch (event) {
2586     case CHR_EVENT_OPENED:
2587         vm_stop(EXCP_INTERRUPT);
2588         gdb_has_xml = 0;
2589         break;
2590     default:
2591         break;
2592     }
2593 }
2594
2595 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2596 {
2597     char buf[MAX_PACKET_LENGTH];
2598
2599     buf[0] = 'O';
2600     if (len > (MAX_PACKET_LENGTH/2) - 1)
2601         len = (MAX_PACKET_LENGTH/2) - 1;
2602     memtohex(buf + 1, (uint8_t *)msg, len);
2603     put_packet(s, buf);
2604 }
2605
2606 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2607 {
2608     const char *p = (const char *)buf;
2609     int max_sz;
2610
2611     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2612     for (;;) {
2613         if (len <= max_sz) {
2614             gdb_monitor_output(gdbserver_state, p, len);
2615             break;
2616         }
2617         gdb_monitor_output(gdbserver_state, p, max_sz);
2618         p += max_sz;
2619         len -= max_sz;
2620     }
2621     return len;
2622 }
2623
2624 #ifndef _WIN32
2625 static void gdb_sigterm_handler(int signal)
2626 {
2627     if (vm_running)
2628         vm_stop(EXCP_INTERRUPT);
2629 }
2630 #endif
2631
2632 int gdbserver_start(const char *device)
2633 {
2634     GDBState *s;
2635     char gdbstub_device_name[128];
2636     CharDriverState *chr = NULL;
2637     CharDriverState *mon_chr;
2638
2639     if (!device)
2640         return -1;
2641     if (strcmp(device, "none") != 0) {
2642         if (strstart(device, "tcp:", NULL)) {
2643             /* enforce required TCP attributes */
2644             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2645                      "%s,nowait,nodelay,server", device);
2646             device = gdbstub_device_name;
2647         }
2648 #ifndef _WIN32
2649         else if (strcmp(device, "stdio") == 0) {
2650             struct sigaction act;
2651
2652             memset(&act, 0, sizeof(act));
2653             act.sa_handler = gdb_sigterm_handler;
2654             sigaction(SIGINT, &act, NULL);
2655         }
2656 #endif
2657         chr = qemu_chr_open("gdb", device, NULL);
2658         if (!chr)
2659             return -1;
2660
2661         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2662                               gdb_chr_event, NULL);
2663     }
2664
2665     s = gdbserver_state;
2666     if (!s) {
2667         s = qemu_mallocz(sizeof(GDBState));
2668         gdbserver_state = s;
2669
2670         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2671
2672         /* Initialize a monitor terminal for gdb */
2673         mon_chr = qemu_mallocz(sizeof(*mon_chr));
2674         mon_chr->chr_write = gdb_monitor_write;
2675         monitor_init(mon_chr, 0);
2676     } else {
2677         if (s->chr)
2678             qemu_chr_close(s->chr);
2679         mon_chr = s->mon_chr;
2680         memset(s, 0, sizeof(GDBState));
2681     }
2682     s->c_cpu = first_cpu;
2683     s->g_cpu = first_cpu;
2684     s->chr = chr;
2685     s->state = chr ? RS_IDLE : RS_INACTIVE;
2686     s->mon_chr = mon_chr;
2687
2688     return 0;
2689 }
2690 #endif