gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "qemu-common.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "monitor.h"
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #endif
  37 #include "qemu-kvm.h"
  38
  39 #define MAX_PACKET_LENGTH 4096
  40
  41 #include "exec-all.h"
  42 #include "qemu_socket.h"
  43 #include "kvm.h"
  44
  45
  46 enum {
  47     GDB_SIGNAL_0 = 0,
  48     GDB_SIGNAL_INT = 2,
  49     GDB_SIGNAL_TRAP = 5,
  50     GDB_SIGNAL_UNKNOWN = 143
  51 };
  52
  53 #ifdef CONFIG_USER_ONLY
  54
  55 /* Map target signal numbers to GDB protocol signal numbers and vice
  56  * versa.  For user emulation's currently supported systems, we can
  57  * assume most signals are defined.
  58  */
  59
  60 static int gdb_signal_table[] = {
  61     0,
  62     TARGET_SIGHUP,
  63     TARGET_SIGINT,
  64     TARGET_SIGQUIT,
  65     TARGET_SIGILL,
  66     TARGET_SIGTRAP,
  67     TARGET_SIGABRT,
  68     -1, /* SIGEMT */
  69     TARGET_SIGFPE,
  70     TARGET_SIGKILL,
  71     TARGET_SIGBUS,
  72     TARGET_SIGSEGV,
  73     TARGET_SIGSYS,
  74     TARGET_SIGPIPE,
  75     TARGET_SIGALRM,
  76     TARGET_SIGTERM,
  77     TARGET_SIGURG,
  78     TARGET_SIGSTOP,
  79     TARGET_SIGTSTP,
  80     TARGET_SIGCONT,
  81     TARGET_SIGCHLD,
  82     TARGET_SIGTTIN,
  83     TARGET_SIGTTOU,
  84     TARGET_SIGIO,
  85     TARGET_SIGXCPU,
  86     TARGET_SIGXFSZ,
  87     TARGET_SIGVTALRM,
  88     TARGET_SIGPROF,
  89     TARGET_SIGWINCH,
  90     -1, /* SIGLOST */
  91     TARGET_SIGUSR1,
  92     TARGET_SIGUSR2,
  93 #ifdef TARGET_SIGPWR
  94     TARGET_SIGPWR,
  95 #else
  96     -1,
  97 #endif
  98     -1, /* SIGPOLL */
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108     -1,
 109     -1,
 110 #ifdef __SIGRTMIN
 111     __SIGRTMIN + 1,
 112     __SIGRTMIN + 2,
 113     __SIGRTMIN + 3,
 114     __SIGRTMIN + 4,
 115     __SIGRTMIN + 5,
 116     __SIGRTMIN + 6,
 117     __SIGRTMIN + 7,
 118     __SIGRTMIN + 8,
 119     __SIGRTMIN + 9,
 120     __SIGRTMIN + 10,
 121     __SIGRTMIN + 11,
 122     __SIGRTMIN + 12,
 123     __SIGRTMIN + 13,
 124     __SIGRTMIN + 14,
 125     __SIGRTMIN + 15,
 126     __SIGRTMIN + 16,
 127     __SIGRTMIN + 17,
 128     __SIGRTMIN + 18,
 129     __SIGRTMIN + 19,
 130     __SIGRTMIN + 20,
 131     __SIGRTMIN + 21,
 132     __SIGRTMIN + 22,
 133     __SIGRTMIN + 23,
 134     __SIGRTMIN + 24,
 135     __SIGRTMIN + 25,
 136     __SIGRTMIN + 26,
 137     __SIGRTMIN + 27,
 138     __SIGRTMIN + 28,
 139     __SIGRTMIN + 29,
 140     __SIGRTMIN + 30,
 141     __SIGRTMIN + 31,
 142     -1, /* SIGCANCEL */
 143     __SIGRTMIN,
 144     __SIGRTMIN + 32,
 145     __SIGRTMIN + 33,
 146     __SIGRTMIN + 34,
 147     __SIGRTMIN + 35,
 148     __SIGRTMIN + 36,
 149     __SIGRTMIN + 37,
 150     __SIGRTMIN + 38,
 151     __SIGRTMIN + 39,
 152     __SIGRTMIN + 40,
 153     __SIGRTMIN + 41,
 154     __SIGRTMIN + 42,
 155     __SIGRTMIN + 43,
 156     __SIGRTMIN + 44,
 157     __SIGRTMIN + 45,
 158     __SIGRTMIN + 46,
 159     __SIGRTMIN + 47,
 160     __SIGRTMIN + 48,
 161     __SIGRTMIN + 49,
 162     __SIGRTMIN + 50,
 163     __SIGRTMIN + 51,
 164     __SIGRTMIN + 52,
 165     __SIGRTMIN + 53,
 166     __SIGRTMIN + 54,
 167     __SIGRTMIN + 55,
 168     __SIGRTMIN + 56,
 169     __SIGRTMIN + 57,
 170     __SIGRTMIN + 58,
 171     __SIGRTMIN + 59,
 172     __SIGRTMIN + 60,
 173     __SIGRTMIN + 61,
 174     __SIGRTMIN + 62,
 175     __SIGRTMIN + 63,
 176     __SIGRTMIN + 64,
 177     __SIGRTMIN + 65,
 178     __SIGRTMIN + 66,
 179     __SIGRTMIN + 67,
 180     __SIGRTMIN + 68,
 181     __SIGRTMIN + 69,
 182     __SIGRTMIN + 70,
 183     __SIGRTMIN + 71,
 184     __SIGRTMIN + 72,
 185     __SIGRTMIN + 73,
 186     __SIGRTMIN + 74,
 187     __SIGRTMIN + 75,
 188     __SIGRTMIN + 76,
 189     __SIGRTMIN + 77,
 190     __SIGRTMIN + 78,
 191     __SIGRTMIN + 79,
 192     __SIGRTMIN + 80,
 193     __SIGRTMIN + 81,
 194     __SIGRTMIN + 82,
 195     __SIGRTMIN + 83,
 196     __SIGRTMIN + 84,
 197     __SIGRTMIN + 85,
 198     __SIGRTMIN + 86,
 199     __SIGRTMIN + 87,
 200     __SIGRTMIN + 88,
 201     __SIGRTMIN + 89,
 202     __SIGRTMIN + 90,
 203     __SIGRTMIN + 91,
 204     __SIGRTMIN + 92,
 205     __SIGRTMIN + 93,
 206     __SIGRTMIN + 94,
 207     __SIGRTMIN + 95,
 208     -1, /* SIGINFO */
 209     -1, /* UNKNOWN */
 210     -1, /* DEFAULT */
 211     -1,
 212     -1,
 213     -1,
 214     -1,
 215     -1,
 216     -1
 217 #endif
 218 };
 219 #else
 220 /* In system mode we only need SIGINT and SIGTRAP; other signals
 221    are not yet supported.  */
 222
 223 enum {
 224     TARGET_SIGINT = 2,
 225     TARGET_SIGTRAP = 5
 226 };
 227
 228 static int gdb_signal_table[] = {
 229     -1,
 230     -1,
 231     TARGET_SIGINT,
 232     -1,
 233     -1,
 234     TARGET_SIGTRAP
 235 };
 236 #endif
 237
 238 #ifdef CONFIG_USER_ONLY
 239 static int target_signal_to_gdb (int sig)
 240 {
 241     int i;
 242     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 243         if (gdb_signal_table[i] == sig)
 244             return i;
 245     return GDB_SIGNAL_UNKNOWN;
 246 }
 247 #endif
 248
 249 static int gdb_signal_to_target (int sig)
 250 {
 251     if (sig < ARRAY_SIZE (gdb_signal_table))
 252         return gdb_signal_table[sig];
 253     else
 254         return -1;
 255 }
 256
 257 //#define DEBUG_GDB
 258
 259 typedef struct GDBRegisterState {
 260     int base_reg;
 261     int num_regs;
 262     gdb_reg_cb get_reg;
 263     gdb_reg_cb set_reg;
 264     const char *xml;
 265     struct GDBRegisterState *next;
 266 } GDBRegisterState;
 267
 268 enum RSState {
 269     RS_INACTIVE,
 270     RS_IDLE,
 271     RS_GETLINE,
 272     RS_CHKSUM1,
 273     RS_CHKSUM2,
 274     RS_SYSCALL,
 275 };
 276 typedef struct GDBState {
 277     CPUState *c_cpu; /* current CPU for step/continue ops */
 278     CPUState *g_cpu; /* current CPU for other ops */
 279     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 280     enum RSState state; /* parsing state */
 281     char line_buf[MAX_PACKET_LENGTH];
 282     int line_buf_index;
 283     int line_csum;
 284     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 285     int last_packet_len;
 286     int signal;
 287 #ifdef CONFIG_USER_ONLY
 288     int fd;
 289     int running_state;
 290 #else
 291     CharDriverState *chr;
 292     CharDriverState *mon_chr;
 293 #endif
 294 } GDBState;
 295
 296 /* By default use no IRQs and no timers while single stepping so as to
 297  * make single stepping like an ICE HW step.
 298  */
 299 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 300
 301 static GDBState *gdbserver_state;
 302
 303 /* This is an ugly hack to cope with both new and old gdb.
 304    If gdb sends qXfer:features:read then assume we're talking to a newish
 305    gdb that understands target descriptions.  */
 306 static int gdb_has_xml;
 307
 308 #ifdef CONFIG_USER_ONLY
 309 /* XXX: This is not thread safe.  Do we care?  */
 310 static int gdbserver_fd = -1;
 311
 312 static int get_char(GDBState *s)
 313 {
 314     uint8_t ch;
 315     int ret;
 316
 317     for(;;) {
 318         ret = recv(s->fd, &ch, 1, 0);
 319         if (ret < 0) {
 320             if (errno == ECONNRESET)
 321                 s->fd = -1;
 322             if (errno != EINTR && errno != EAGAIN)
 323                 return -1;
 324         } else if (ret == 0) {
 325             close(s->fd);
 326             s->fd = -1;
 327             return -1;
 328         } else {
 329             break;
 330         }
 331     }
 332     return ch;
 333 }
 334 #endif
 335
 336 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 337
 338 static enum {
 339     GDB_SYS_UNKNOWN,
 340     GDB_SYS_ENABLED,
 341     GDB_SYS_DISABLED,
 342 } gdb_syscall_mode;
 343
 344 /* If gdb is connected when the first semihosting syscall occurs then use
 345    remote gdb syscalls.  Otherwise use native file IO.  */
 346 int use_gdb_syscalls(void)
 347 {
 348     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 349         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 350                                             : GDB_SYS_DISABLED);
 351     }
 352     return gdb_syscall_mode == GDB_SYS_ENABLED;
 353 }
 354
 355 /* Resume execution.  */
 356 static inline void gdb_continue(GDBState *s)
 357 {
 358 #ifdef CONFIG_USER_ONLY
 359     s->running_state = 1;
 360 #else
 361     vm_start();
 362 #endif
 363 }
 364
 365 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 366 {
 367 #ifdef CONFIG_USER_ONLY
 368     int ret;
 369
 370     while (len > 0) {
 371         ret = send(s->fd, buf, len, 0);
 372         if (ret < 0) {
 373             if (errno != EINTR && errno != EAGAIN)
 374                 return;
 375         } else {
 376             buf += ret;
 377             len -= ret;
 378         }
 379     }
 380 #else
 381     qemu_chr_write(s->chr, buf, len);
 382 #endif
 383 }
 384
 385 static inline int fromhex(int v)
 386 {
 387     if (v >= '0' && v <= '9')
 388         return v - '0';
 389     else if (v >= 'A' && v <= 'F')
 390         return v - 'A' + 10;
 391     else if (v >= 'a' && v <= 'f')
 392         return v - 'a' + 10;
 393     else
 394         return 0;
 395 }
 396
 397 static inline int tohex(int v)
 398 {
 399     if (v < 10)
 400         return v + '0';
 401     else
 402         return v - 10 + 'a';
 403 }
 404
 405 static void memtohex(char *buf, const uint8_t *mem, int len)
 406 {
 407     int i, c;
 408     char *q;
 409     q = buf;
 410     for(i = 0; i < len; i++) {
 411         c = mem[i];
 412         *q++ = tohex(c >> 4);
 413         *q++ = tohex(c & 0xf);
 414     }
 415     *q = '\0';
 416 }
 417
 418 static void hextomem(uint8_t *mem, const char *buf, int len)
 419 {
 420     int i;
 421
 422     for(i = 0; i < len; i++) {
 423         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 424         buf += 2;
 425     }
 426 }
 427
 428 /* return -1 if error, 0 if OK */
 429 static int put_packet_binary(GDBState *s, const char *buf, int len)
 430 {
 431     int csum, i;
 432     uint8_t *p;
 433
 434     for(;;) {
 435         p = s->last_packet;
 436         *(p++) = '$';
 437         memcpy(p, buf, len);
 438         p += len;
 439         csum = 0;
 440         for(i = 0; i < len; i++) {
 441             csum += buf[i];
 442         }
 443         *(p++) = '#';
 444         *(p++) = tohex((csum >> 4) & 0xf);
 445         *(p++) = tohex((csum) & 0xf);
 446
 447         s->last_packet_len = p - s->last_packet;
 448         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 449
 450 #ifdef CONFIG_USER_ONLY
 451         i = get_char(s);
 452         if (i < 0)
 453             return -1;
 454         if (i == '+')
 455             break;
 456 #else
 457         break;
 458 #endif
 459     }
 460     return 0;
 461 }
 462
 463 /* return -1 if error, 0 if OK */
 464 static int put_packet(GDBState *s, const char *buf)
 465 {
 466 #ifdef DEBUG_GDB
 467     printf("reply='%s'\n", buf);
 468 #endif
 469
 470     return put_packet_binary(s, buf, strlen(buf));
 471 }
 472
 473 /* The GDB remote protocol transfers values in target byte order.  This means
 474    we can use the raw memory access routines to access the value buffer.
 475    Conveniently, these also handle the case where the buffer is mis-aligned.
 476  */
 477 #define GET_REG8(val) do { \
 478     stb_p(mem_buf, val); \
 479     return 1; \
 480     } while(0)
 481 #define GET_REG16(val) do { \
 482     stw_p(mem_buf, val); \
 483     return 2; \
 484     } while(0)
 485 #define GET_REG32(val) do { \
 486     stl_p(mem_buf, val); \
 487     return 4; \
 488     } while(0)
 489 #define GET_REG64(val) do { \
 490     stq_p(mem_buf, val); \
 491     return 8; \
 492     } while(0)
 493
 494 #if TARGET_LONG_BITS == 64
 495 #define GET_REGL(val) GET_REG64(val)
 496 #define ldtul_p(addr) ldq_p(addr)
 497 #else
 498 #define GET_REGL(val) GET_REG32(val)
 499 #define ldtul_p(addr) ldl_p(addr)
 500 #endif
 501
 502 #if defined(TARGET_I386)
 503
 504 #ifdef TARGET_X86_64
 505 static const int gpr_map[16] = {
 506     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 507     8, 9, 10, 11, 12, 13, 14, 15
 508 };
 509 #else
 510 #define gpr_map gpr_map32
 511 #endif
 512 static const int gpr_map32[8] = { 0, 1, 2, 3, 4, 5, 6, 7 };
 513
 514 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 515
 516 #define IDX_IP_REG      CPU_NB_REGS
 517 #define IDX_FLAGS_REG   (IDX_IP_REG + 1)
 518 #define IDX_SEG_REGS    (IDX_FLAGS_REG + 1)
 519 #define IDX_FP_REGS     (IDX_SEG_REGS + 6)
 520 #define IDX_XMM_REGS    (IDX_FP_REGS + 16)
 521 #define IDX_MXCSR_REG   (IDX_XMM_REGS + CPU_NB_REGS)
 522
 523 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 524 {
 525     if (n < CPU_NB_REGS) {
 526         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 527             GET_REG64(env->regs[gpr_map[n]]);
 528         } else if (n < CPU_NB_REGS32) {
 529             GET_REG32(env->regs[gpr_map32[n]]);
 530         }
 531     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 532 #ifdef USE_X86LDOUBLE
 533         /* FIXME: byteswap float values - after fixing fpregs layout. */
 534         memcpy(mem_buf, &env->fpregs[n - IDX_FP_REGS], 10);
 535 #else
 536         memset(mem_buf, 0, 10);
 537 #endif
 538         return 10;
 539     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 540         n -= IDX_XMM_REGS;
 541         if (n < CPU_NB_REGS32 ||
 542             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 543             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 544             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 545             return 16;
 546         }
 547     } else {
 548         switch (n) {
 549         case IDX_IP_REG:
 550             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 551                 GET_REG64(env->eip);
 552             } else {
 553                 GET_REG32(env->eip);
 554             }
 555         case IDX_FLAGS_REG: GET_REG32(env->eflags);
 556
 557         case IDX_SEG_REGS:     GET_REG32(env->segs[R_CS].selector);
 558         case IDX_SEG_REGS + 1: GET_REG32(env->segs[R_SS].selector);
 559         case IDX_SEG_REGS + 2: GET_REG32(env->segs[R_DS].selector);
 560         case IDX_SEG_REGS + 3: GET_REG32(env->segs[R_ES].selector);
 561         case IDX_SEG_REGS + 4: GET_REG32(env->segs[R_FS].selector);
 562         case IDX_SEG_REGS + 5: GET_REG32(env->segs[R_GS].selector);
 563
 564         case IDX_FP_REGS + 8:  GET_REG32(env->fpuc);
 565         case IDX_FP_REGS + 9:  GET_REG32((env->fpus & ~0x3800) |
 566                                          (env->fpstt & 0x7) << 11);
 567         case IDX_FP_REGS + 10: GET_REG32(0); /* ftag */
 568         case IDX_FP_REGS + 11: GET_REG32(0); /* fiseg */
 569         case IDX_FP_REGS + 12: GET_REG32(0); /* fioff */
 570         case IDX_FP_REGS + 13: GET_REG32(0); /* foseg */
 571         case IDX_FP_REGS + 14: GET_REG32(0); /* fooff */
 572         case IDX_FP_REGS + 15: GET_REG32(0); /* fop */
 573
 574         case IDX_MXCSR_REG: GET_REG32(env->mxcsr);
 575         }
 576     }
 577     return 0;
 578 }
 579
 580 static int cpu_x86_gdb_load_seg(CPUState *env, int sreg, uint8_t *mem_buf)
 581 {
 582     uint16_t selector = ldl_p(mem_buf);
 583
 584     if (selector != env->segs[sreg].selector) {
 585 #if defined(CONFIG_USER_ONLY)
 586         cpu_x86_load_seg(env, sreg, selector);
 587 #else
 588         unsigned int limit, flags;
 589         target_ulong base;
 590
 591         if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK)) {
 592             base = selector << 4;
 593             limit = 0xffff;
 594             flags = 0;
 595         } else {
 596             if (!cpu_x86_get_descr_debug(env, selector, &base, &limit, &flags))
 597                 return 4;
 598         }
 599         cpu_x86_load_seg_cache(env, sreg, selector, base, limit, flags);
 600 #endif
 601     }
 602     return 4;
 603 }
 604
 605 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 606 {
 607     uint32_t tmp;
 608
 609     if (n < CPU_NB_REGS) {
 610         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 611             env->regs[gpr_map[n]] = ldtul_p(mem_buf);
 612             return sizeof(target_ulong);
 613         } else if (n < CPU_NB_REGS32) {
 614             n = gpr_map32[n];
 615             env->regs[n] &= ~0xffffffffUL;
 616             env->regs[n] |= (uint32_t)ldl_p(mem_buf);
 617             return 4;
 618         }
 619     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 620 #ifdef USE_X86LDOUBLE
 621         /* FIXME: byteswap float values - after fixing fpregs layout. */
 622         memcpy(&env->fpregs[n - IDX_FP_REGS], mem_buf, 10);
 623 #endif
 624         return 10;
 625     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 626         n -= IDX_XMM_REGS;
 627         if (n < CPU_NB_REGS32 ||
 628             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 629             env->xmm_regs[n].XMM_Q(0) = ldq_p(mem_buf);
 630             env->xmm_regs[n].XMM_Q(1) = ldq_p(mem_buf + 8);
 631             return 16;
 632         }
 633     } else {
 634         switch (n) {
 635         case IDX_IP_REG:
 636             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 637                 env->eip = ldq_p(mem_buf);
 638                 return 8;
 639             } else {
 640                 env->eip &= ~0xffffffffUL;
 641                 env->eip |= (uint32_t)ldl_p(mem_buf);
 642                 return 4;
 643             }
 644         case IDX_FLAGS_REG:
 645             env->eflags = ldl_p(mem_buf);
 646             return 4;
 647
 648         case IDX_SEG_REGS:     return cpu_x86_gdb_load_seg(env, R_CS, mem_buf);
 649         case IDX_SEG_REGS + 1: return cpu_x86_gdb_load_seg(env, R_SS, mem_buf);
 650         case IDX_SEG_REGS + 2: return cpu_x86_gdb_load_seg(env, R_DS, mem_buf);
 651         case IDX_SEG_REGS + 3: return cpu_x86_gdb_load_seg(env, R_ES, mem_buf);
 652         case IDX_SEG_REGS + 4: return cpu_x86_gdb_load_seg(env, R_FS, mem_buf);
 653         case IDX_SEG_REGS + 5: return cpu_x86_gdb_load_seg(env, R_GS, mem_buf);
 654
 655         case IDX_FP_REGS + 8:
 656             env->fpuc = ldl_p(mem_buf);
 657             return 4;
 658         case IDX_FP_REGS + 9:
 659             tmp = ldl_p(mem_buf);
 660             env->fpstt = (tmp >> 11) & 7;
 661             env->fpus = tmp & ~0x3800;
 662             return 4;
 663         case IDX_FP_REGS + 10: /* ftag */  return 4;
 664         case IDX_FP_REGS + 11: /* fiseg */ return 4;
 665         case IDX_FP_REGS + 12: /* fioff */ return 4;
 666         case IDX_FP_REGS + 13: /* foseg */ return 4;
 667         case IDX_FP_REGS + 14: /* fooff */ return 4;
 668         case IDX_FP_REGS + 15: /* fop */   return 4;
 669
 670         case IDX_MXCSR_REG:
 671             env->mxcsr = ldl_p(mem_buf);
 672             return 4;
 673         }
 674     }
 675     /* Unrecognised register.  */
 676     return 0;
 677 }
 678
 679 #elif defined (TARGET_PPC)
 680
 681 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 682    expects whatever the target description contains.  Due to a
 683    historical mishap the FP registers appear in between core integer
 684    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 685    FP regs zero size when talking to a newer gdb.  */
 686 #define NUM_CORE_REGS 71
 687 #if defined (TARGET_PPC64)
 688 #define GDB_CORE_XML "power64-core.xml"
 689 #else
 690 #define GDB_CORE_XML "power-core.xml"
 691 #endif
 692
 693 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 694 {
 695     if (n < 32) {
 696         /* gprs */
 697         GET_REGL(env->gpr[n]);
 698     } else if (n < 64) {
 699         /* fprs */
 700         if (gdb_has_xml)
 701             return 0;
 702         stfq_p(mem_buf, env->fpr[n-32]);
 703         return 8;
 704     } else {
 705         switch (n) {
 706         case 64: GET_REGL(env->nip);
 707         case 65: GET_REGL(env->msr);
 708         case 66:
 709             {
 710                 uint32_t cr = 0;
 711                 int i;
 712                 for (i = 0; i < 8; i++)
 713                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 714                 GET_REG32(cr);
 715             }
 716         case 67: GET_REGL(env->lr);
 717         case 68: GET_REGL(env->ctr);
 718         case 69: GET_REGL(env->xer);
 719         case 70:
 720             {
 721                 if (gdb_has_xml)
 722                     return 0;
 723                 GET_REG32(0); /* fpscr */
 724             }
 725         }
 726     }
 727     return 0;
 728 }
 729
 730 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 731 {
 732     if (n < 32) {
 733         /* gprs */
 734         env->gpr[n] = ldtul_p(mem_buf);
 735         return sizeof(target_ulong);
 736     } else if (n < 64) {
 737         /* fprs */
 738         if (gdb_has_xml)
 739             return 0;
 740         env->fpr[n-32] = ldfq_p(mem_buf);
 741         return 8;
 742     } else {
 743         switch (n) {
 744         case 64:
 745             env->nip = ldtul_p(mem_buf);
 746             return sizeof(target_ulong);
 747         case 65:
 748             ppc_store_msr(env, ldtul_p(mem_buf));
 749             return sizeof(target_ulong);
 750         case 66:
 751             {
 752                 uint32_t cr = ldl_p(mem_buf);
 753                 int i;
 754                 for (i = 0; i < 8; i++)
 755                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 756                 return 4;
 757             }
 758         case 67:
 759             env->lr = ldtul_p(mem_buf);
 760             return sizeof(target_ulong);
 761         case 68:
 762             env->ctr = ldtul_p(mem_buf);
 763             return sizeof(target_ulong);
 764         case 69:
 765             env->xer = ldtul_p(mem_buf);
 766             return sizeof(target_ulong);
 767         case 70:
 768             /* fpscr */
 769             if (gdb_has_xml)
 770                 return 0;
 771             return 4;
 772         }
 773     }
 774     return 0;
 775 }
 776
 777 #elif defined (TARGET_SPARC)
 778
 779 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 780 #define NUM_CORE_REGS 86
 781 #else
 782 #define NUM_CORE_REGS 72
 783 #endif
 784
 785 #ifdef TARGET_ABI32
 786 #define GET_REGA(val) GET_REG32(val)
 787 #else
 788 #define GET_REGA(val) GET_REGL(val)
 789 #endif
 790
 791 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 792 {
 793     if (n < 8) {
 794         /* g0..g7 */
 795         GET_REGA(env->gregs[n]);
 796     }
 797     if (n < 32) {
 798         /* register window */
 799         GET_REGA(env->regwptr[n - 8]);
 800     }
 801 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 802     if (n < 64) {
 803         /* fprs */
 804         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 805     }
 806     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 807     switch (n) {
 808     case 64: GET_REGA(env->y);
 809     case 65: GET_REGA(cpu_get_psr(env));
 810     case 66: GET_REGA(env->wim);
 811     case 67: GET_REGA(env->tbr);
 812     case 68: GET_REGA(env->pc);
 813     case 69: GET_REGA(env->npc);
 814     case 70: GET_REGA(env->fsr);
 815     case 71: GET_REGA(0); /* csr */
 816     default: GET_REGA(0);
 817     }
 818 #else
 819     if (n < 64) {
 820         /* f0-f31 */
 821         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 822     }
 823     if (n < 80) {
 824         /* f32-f62 (double width, even numbers only) */
 825         uint64_t val;
 826
 827         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 828         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 829         GET_REG64(val);
 830     }
 831     switch (n) {
 832     case 80: GET_REGL(env->pc);
 833     case 81: GET_REGL(env->npc);
 834     case 82: GET_REGL((cpu_get_ccr(env) << 32) |
 835                       ((env->asi & 0xff) << 24) |
 836                       ((env->pstate & 0xfff) << 8) |
 837                       cpu_get_cwp64(env));
 838     case 83: GET_REGL(env->fsr);
 839     case 84: GET_REGL(env->fprs);
 840     case 85: GET_REGL(env->y);
 841     }
 842 #endif
 843     return 0;
 844 }
 845
 846 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 847 {
 848 #if defined(TARGET_ABI32)
 849     abi_ulong tmp;
 850
 851     tmp = ldl_p(mem_buf);
 852 #else
 853     target_ulong tmp;
 854
 855     tmp = ldtul_p(mem_buf);
 856 #endif
 857
 858     if (n < 8) {
 859         /* g0..g7 */
 860         env->gregs[n] = tmp;
 861     } else if (n < 32) {
 862         /* register window */
 863         env->regwptr[n - 8] = tmp;
 864     }
 865 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 866     else if (n < 64) {
 867         /* fprs */
 868         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 869     } else {
 870         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 871         switch (n) {
 872         case 64: env->y = tmp; break;
 873         case 65: cpu_put_psr(env, tmp); break;
 874         case 66: env->wim = tmp; break;
 875         case 67: env->tbr = tmp; break;
 876         case 68: env->pc = tmp; break;
 877         case 69: env->npc = tmp; break;
 878         case 70: env->fsr = tmp; break;
 879         default: return 0;
 880         }
 881     }
 882     return 4;
 883 #else
 884     else if (n < 64) {
 885         /* f0-f31 */
 886         env->fpr[n] = ldfl_p(mem_buf);
 887         return 4;
 888     } else if (n < 80) {
 889         /* f32-f62 (double width, even numbers only) */
 890         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 891         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 892     } else {
 893         switch (n) {
 894         case 80: env->pc = tmp; break;
 895         case 81: env->npc = tmp; break;
 896         case 82:
 897             cpu_put_ccr(env, tmp >> 32);
 898             env->asi = (tmp >> 24) & 0xff;
 899             env->pstate = (tmp >> 8) & 0xfff;
 900             cpu_put_cwp64(env, tmp & 0xff);
 901             break;
 902         case 83: env->fsr = tmp; break;
 903         case 84: env->fprs = tmp; break;
 904         case 85: env->y = tmp; break;
 905         default: return 0;
 906         }
 907     }
 908     return 8;
 909 #endif
 910 }
 911 #elif defined (TARGET_ARM)
 912
 913 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 914    whatever the target description contains.  Due to a historical mishap
 915    the FPA registers appear in between core integer regs and the CPSR.
 916    We hack round this by giving the FPA regs zero size when talking to a
 917    newer gdb.  */
 918 #define NUM_CORE_REGS 26
 919 #define GDB_CORE_XML "arm-core.xml"
 920
 921 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 922 {
 923     if (n < 16) {
 924         /* Core integer register.  */
 925         GET_REG32(env->regs[n]);
 926     }
 927     if (n < 24) {
 928         /* FPA registers.  */
 929         if (gdb_has_xml)
 930             return 0;
 931         memset(mem_buf, 0, 12);
 932         return 12;
 933     }
 934     switch (n) {
 935     case 24:
 936         /* FPA status register.  */
 937         if (gdb_has_xml)
 938             return 0;
 939         GET_REG32(0);
 940     case 25:
 941         /* CPSR */
 942         GET_REG32(cpsr_read(env));
 943     }
 944     /* Unknown register.  */
 945     return 0;
 946 }
 947
 948 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 949 {
 950     uint32_t tmp;
 951
 952     tmp = ldl_p(mem_buf);
 953
 954     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 955        cause problems if we ever implement the Jazelle DBX extensions.  */
 956     if (n == 15)
 957         tmp &= ~1;
 958
 959     if (n < 16) {
 960         /* Core integer register.  */
 961         env->regs[n] = tmp;
 962         return 4;
 963     }
 964     if (n < 24) { /* 16-23 */
 965         /* FPA registers (ignored).  */
 966         if (gdb_has_xml)
 967             return 0;
 968         return 12;
 969     }
 970     switch (n) {
 971     case 24:
 972         /* FPA status register (ignored).  */
 973         if (gdb_has_xml)
 974             return 0;
 975         return 4;
 976     case 25:
 977         /* CPSR */
 978         cpsr_write (env, tmp, 0xffffffff);
 979         return 4;
 980     }
 981     /* Unknown register.  */
 982     return 0;
 983 }
 984
 985 #elif defined (TARGET_M68K)
 986
 987 #define NUM_CORE_REGS 18
 988
 989 #define GDB_CORE_XML "cf-core.xml"
 990
 991 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 992 {
 993     if (n < 8) {
 994         /* D0-D7 */
 995         GET_REG32(env->dregs[n]);
 996     } else if (n < 16) {
 997         /* A0-A7 */
 998         GET_REG32(env->aregs[n - 8]);
 999     } else {
1000         switch (n) {
1001         case 16: GET_REG32(env->sr);
1002         case 17: GET_REG32(env->pc);
1003         }
1004     }
1005     /* FP registers not included here because they vary between
1006        ColdFire and m68k.  Use XML bits for these.  */
1007     return 0;
1008 }
1009
1010 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1011 {
1012     uint32_t tmp;
1013
1014     tmp = ldl_p(mem_buf);
1015
1016     if (n < 8) {
1017         /* D0-D7 */
1018         env->dregs[n] = tmp;
1019     } else if (n < 16) {
1020         /* A0-A7 */
1021         env->aregs[n - 8] = tmp;
1022     } else {
1023         switch (n) {
1024         case 16: env->sr = tmp; break;
1025         case 17: env->pc = tmp; break;
1026         default: return 0;
1027         }
1028     }
1029     return 4;
1030 }
1031 #elif defined (TARGET_MIPS)
1032
1033 #define NUM_CORE_REGS 73
1034
1035 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1036 {
1037     if (n < 32) {
1038         GET_REGL(env->active_tc.gpr[n]);
1039     }
1040     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
1041         if (n >= 38 && n < 70) {
1042             if (env->CP0_Status & (1 << CP0St_FR))
1043                 GET_REGL(env->active_fpu.fpr[n - 38].d);
1044             else
1045                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
1046         }
1047         switch (n) {
1048         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
1049         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
1050         }
1051     }
1052     switch (n) {
1053     case 32: GET_REGL((int32_t)env->CP0_Status);
1054     case 33: GET_REGL(env->active_tc.LO[0]);
1055     case 34: GET_REGL(env->active_tc.HI[0]);
1056     case 35: GET_REGL(env->CP0_BadVAddr);
1057     case 36: GET_REGL((int32_t)env->CP0_Cause);
1058     case 37: GET_REGL(env->active_tc.PC | !!(env->hflags & MIPS_HFLAG_M16));
1059     case 72: GET_REGL(0); /* fp */
1060     case 89: GET_REGL((int32_t)env->CP0_PRid);
1061     }
1062     if (n >= 73 && n <= 88) {
1063         /* 16 embedded regs.  */
1064         GET_REGL(0);
1065     }
1066
1067     return 0;
1068 }
1069
1070 /* convert MIPS rounding mode in FCR31 to IEEE library */
1071 static unsigned int ieee_rm[] =
1072   {
1073     float_round_nearest_even,
1074     float_round_to_zero,
1075     float_round_up,
1076     float_round_down
1077   };
1078 #define RESTORE_ROUNDING_MODE \
1079     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1080
1081 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1082 {
1083     target_ulong tmp;
1084
1085     tmp = ldtul_p(mem_buf);
1086
1087     if (n < 32) {
1088         env->active_tc.gpr[n] = tmp;
1089         return sizeof(target_ulong);
1090     }
1091     if (env->CP0_Config1 & (1 << CP0C1_FP)
1092             && n >= 38 && n < 73) {
1093         if (n < 70) {
1094             if (env->CP0_Status & (1 << CP0St_FR))
1095               env->active_fpu.fpr[n - 38].d = tmp;
1096             else
1097               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1098         }
1099         switch (n) {
1100         case 70:
1101             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1102             /* set rounding mode */
1103             RESTORE_ROUNDING_MODE;
1104 #ifndef CONFIG_SOFTFLOAT
1105             /* no floating point exception for native float */
1106             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1107 #endif
1108             break;
1109         case 71: env->active_fpu.fcr0 = tmp; break;
1110         }
1111         return sizeof(target_ulong);
1112     }
1113     switch (n) {
1114     case 32: env->CP0_Status = tmp; break;
1115     case 33: env->active_tc.LO[0] = tmp; break;
1116     case 34: env->active_tc.HI[0] = tmp; break;
1117     case 35: env->CP0_BadVAddr = tmp; break;
1118     case 36: env->CP0_Cause = tmp; break;
1119     case 37:
1120         env->active_tc.PC = tmp & ~(target_ulong)1;
1121         if (tmp & 1) {
1122             env->hflags |= MIPS_HFLAG_M16;
1123         } else {
1124             env->hflags &= ~(MIPS_HFLAG_M16);
1125         }
1126         break;
1127     case 72: /* fp, ignored */ break;
1128     default:
1129         if (n > 89)
1130             return 0;
1131         /* Other registers are readonly.  Ignore writes.  */
1132         break;
1133     }
1134
1135     return sizeof(target_ulong);
1136 }
1137 #elif defined (TARGET_SH4)
1138
1139 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1140 /* FIXME: We should use XML for this.  */
1141
1142 #define NUM_CORE_REGS 59
1143
1144 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1145 {
1146     if (n < 8) {
1147         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1148             GET_REGL(env->gregs[n + 16]);
1149         } else {
1150             GET_REGL(env->gregs[n]);
1151         }
1152     } else if (n < 16) {
1153         GET_REGL(env->gregs[n]);
1154     } else if (n >= 25 && n < 41) {
1155         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1156     } else if (n >= 43 && n < 51) {
1157         GET_REGL(env->gregs[n - 43]);
1158     } else if (n >= 51 && n < 59) {
1159         GET_REGL(env->gregs[n - (51 - 16)]);
1160     }
1161     switch (n) {
1162     case 16: GET_REGL(env->pc);
1163     case 17: GET_REGL(env->pr);
1164     case 18: GET_REGL(env->gbr);
1165     case 19: GET_REGL(env->vbr);
1166     case 20: GET_REGL(env->mach);
1167     case 21: GET_REGL(env->macl);
1168     case 22: GET_REGL(env->sr);
1169     case 23: GET_REGL(env->fpul);
1170     case 24: GET_REGL(env->fpscr);
1171     case 41: GET_REGL(env->ssr);
1172     case 42: GET_REGL(env->spc);
1173     }
1174
1175     return 0;
1176 }
1177
1178 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1179 {
1180     uint32_t tmp;
1181
1182     tmp = ldl_p(mem_buf);
1183
1184     if (n < 8) {
1185         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1186             env->gregs[n + 16] = tmp;
1187         } else {
1188             env->gregs[n] = tmp;
1189         }
1190         return 4;
1191     } else if (n < 16) {
1192         env->gregs[n] = tmp;
1193         return 4;
1194     } else if (n >= 25 && n < 41) {
1195         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1196         return 4;
1197     } else if (n >= 43 && n < 51) {
1198         env->gregs[n - 43] = tmp;
1199         return 4;
1200     } else if (n >= 51 && n < 59) {
1201         env->gregs[n - (51 - 16)] = tmp;
1202         return 4;
1203     }
1204     switch (n) {
1205     case 16: env->pc = tmp; break;
1206     case 17: env->pr = tmp; break;
1207     case 18: env->gbr = tmp; break;
1208     case 19: env->vbr = tmp; break;
1209     case 20: env->mach = tmp; break;
1210     case 21: env->macl = tmp; break;
1211     case 22: env->sr = tmp; break;
1212     case 23: env->fpul = tmp; break;
1213     case 24: env->fpscr = tmp; break;
1214     case 41: env->ssr = tmp; break;
1215     case 42: env->spc = tmp; break;
1216     default: return 0;
1217     }
1218
1219     return 4;
1220 }
1221 #elif defined (TARGET_MICROBLAZE)
1222
1223 #define NUM_CORE_REGS (32 + 5)
1224
1225 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1226 {
1227     if (n < 32) {
1228         GET_REG32(env->regs[n]);
1229     } else {
1230         GET_REG32(env->sregs[n - 32]);
1231     }
1232     return 0;
1233 }
1234
1235 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1236 {
1237     uint32_t tmp;
1238
1239     if (n > NUM_CORE_REGS)
1240         return 0;
1241
1242     tmp = ldl_p(mem_buf);
1243
1244     if (n < 32) {
1245         env->regs[n] = tmp;
1246     } else {
1247         env->sregs[n - 32] = tmp;
1248     }
1249     return 4;
1250 }
1251 #elif defined (TARGET_CRIS)
1252
1253 #define NUM_CORE_REGS 49
1254
1255 static int
1256 read_register_crisv10(CPUState *env, uint8_t *mem_buf, int n)
1257 {
1258     if (n < 15) {
1259         GET_REG32(env->regs[n]);
1260     }
1261
1262     if (n == 15) {
1263         GET_REG32(env->pc);
1264     }
1265
1266     if (n < 32) {
1267         switch (n) {
1268         case 16:
1269             GET_REG8(env->pregs[n - 16]);
1270             break;
1271         case 17:
1272             GET_REG8(env->pregs[n - 16]);
1273             break;
1274         case 20:
1275         case 21:
1276             GET_REG16(env->pregs[n - 16]);
1277             break;
1278         default:
1279             if (n >= 23) {
1280                 GET_REG32(env->pregs[n - 16]);
1281             }
1282             break;
1283         }
1284     }
1285     return 0;
1286 }
1287
1288 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1289 {
1290     uint8_t srs;
1291
1292     if (env->pregs[PR_VR] < 32)
1293         return read_register_crisv10(env, mem_buf, n);
1294
1295     srs = env->pregs[PR_SRS];
1296     if (n < 16) {
1297         GET_REG32(env->regs[n]);
1298     }
1299
1300     if (n >= 21 && n < 32) {
1301         GET_REG32(env->pregs[n - 16]);
1302     }
1303     if (n >= 33 && n < 49) {
1304         GET_REG32(env->sregs[srs][n - 33]);
1305     }
1306     switch (n) {
1307     case 16: GET_REG8(env->pregs[0]);
1308     case 17: GET_REG8(env->pregs[1]);
1309     case 18: GET_REG32(env->pregs[2]);
1310     case 19: GET_REG8(srs);
1311     case 20: GET_REG16(env->pregs[4]);
1312     case 32: GET_REG32(env->pc);
1313     }
1314
1315     return 0;
1316 }
1317
1318 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1319 {
1320     uint32_t tmp;
1321
1322     if (n > 49)
1323         return 0;
1324
1325     tmp = ldl_p(mem_buf);
1326
1327     if (n < 16) {
1328         env->regs[n] = tmp;
1329     }
1330
1331     if (n >= 21 && n < 32) {
1332         env->pregs[n - 16] = tmp;
1333     }
1334
1335     /* FIXME: Should support function regs be writable?  */
1336     switch (n) {
1337     case 16: return 1;
1338     case 17: return 1;
1339     case 18: env->pregs[PR_PID] = tmp; break;
1340     case 19: return 1;
1341     case 20: return 2;
1342     case 32: env->pc = tmp; break;
1343     }
1344
1345     return 4;
1346 }
1347 #elif defined (TARGET_ALPHA)
1348
1349 #define NUM_CORE_REGS 67
1350
1351 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1352 {
1353     uint64_t val;
1354     CPU_DoubleU d;
1355
1356     switch (n) {
1357     case 0 ... 30:
1358         val = env->ir[n];
1359         break;
1360     case 32 ... 62:
1361         d.d = env->fir[n - 32];
1362         val = d.ll;
1363         break;
1364     case 63:
1365         val = cpu_alpha_load_fpcr(env);
1366         break;
1367     case 64:
1368         val = env->pc;
1369         break;
1370     case 66:
1371         val = env->unique;
1372         break;
1373     case 31:
1374     case 65:
1375         /* 31 really is the zero register; 65 is unassigned in the
1376            gdb protocol, but is still required to occupy 8 bytes. */
1377         val = 0;
1378         break;
1379     default:
1380         return 0;
1381     }
1382     GET_REGL(val);
1383 }
1384
1385 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1386 {
1387     target_ulong tmp = ldtul_p(mem_buf);
1388     CPU_DoubleU d;
1389
1390     switch (n) {
1391     case 0 ... 30:
1392         env->ir[n] = tmp;
1393         break;
1394     case 32 ... 62:
1395         d.ll = tmp;
1396         env->fir[n - 32] = d.d;
1397         break;
1398     case 63:
1399         cpu_alpha_store_fpcr(env, tmp);
1400         break;
1401     case 64:
1402         env->pc = tmp;
1403         break;
1404     case 66:
1405         env->unique = tmp;
1406         break;
1407     case 31:
1408     case 65:
1409         /* 31 really is the zero register; 65 is unassigned in the
1410            gdb protocol, but is still required to occupy 8 bytes. */
1411         break;
1412     default:
1413         return 0;
1414     }
1415     return 8;
1416 }
1417 #elif defined (TARGET_S390X)
1418
1419 #define NUM_CORE_REGS S390_NUM_TOTAL_REGS
1420
1421 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1422 {
1423     switch (n) {
1424         case S390_PSWM_REGNUM: GET_REGL(env->psw.mask); break;
1425         case S390_PSWA_REGNUM: GET_REGL(env->psw.addr); break;
1426         case S390_R0_REGNUM ... S390_R15_REGNUM:
1427             GET_REGL(env->regs[n-S390_R0_REGNUM]); break;
1428         case S390_A0_REGNUM ... S390_A15_REGNUM:
1429             GET_REG32(env->aregs[n-S390_A0_REGNUM]); break;
1430         case S390_FPC_REGNUM: GET_REG32(env->fpc); break;
1431         case S390_F0_REGNUM ... S390_F15_REGNUM:
1432             /* XXX */
1433             break;
1434         case S390_PC_REGNUM: GET_REGL(env->psw.addr); break;
1435         case S390_CC_REGNUM: GET_REG32(env->cc); break;
1436     }
1437
1438     return 0;
1439 }
1440
1441 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1442 {
1443     target_ulong tmpl;
1444     uint32_t tmp32;
1445     int r = 8;
1446     tmpl = ldtul_p(mem_buf);
1447     tmp32 = ldl_p(mem_buf);
1448
1449     switch (n) {
1450         case S390_PSWM_REGNUM: env->psw.mask = tmpl; break;
1451         case S390_PSWA_REGNUM: env->psw.addr = tmpl; break;
1452         case S390_R0_REGNUM ... S390_R15_REGNUM:
1453             env->regs[n-S390_R0_REGNUM] = tmpl; break;
1454         case S390_A0_REGNUM ... S390_A15_REGNUM:
1455             env->aregs[n-S390_A0_REGNUM] = tmp32; r=4; break;
1456         case S390_FPC_REGNUM: env->fpc = tmp32; r=4; break;
1457         case S390_F0_REGNUM ... S390_F15_REGNUM:
1458             /* XXX */
1459             break;
1460         case S390_PC_REGNUM: env->psw.addr = tmpl; break;
1461         case S390_CC_REGNUM: env->cc = tmp32; r=4; break;
1462     }
1463
1464     return r;
1465 }
1466 #else
1467
1468 #define NUM_CORE_REGS 0
1469
1470 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1471 {
1472     return 0;
1473 }
1474
1475 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1476 {
1477     return 0;
1478 }
1479
1480 #endif
1481
1482 static int num_g_regs = NUM_CORE_REGS;
1483
1484 #ifdef GDB_CORE_XML
1485 /* Encode data using the encoding for 'x' packets.  */
1486 static int memtox(char *buf, const char *mem, int len)
1487 {
1488     char *p = buf;
1489     char c;
1490
1491     while (len--) {
1492         c = *(mem++);
1493         switch (c) {
1494         case '#': case '$': case '*': case '}':
1495             *(p++) = '}';
1496             *(p++) = c ^ 0x20;
1497             break;
1498         default:
1499             *(p++) = c;
1500             break;
1501         }
1502     }
1503     return p - buf;
1504 }
1505
1506 static const char *get_feature_xml(const char *p, const char **newp)
1507 {
1508     size_t len;
1509     int i;
1510     const char *name;
1511     static char target_xml[1024];
1512
1513     len = 0;
1514     while (p[len] && p[len] != ':')
1515         len++;
1516     *newp = p + len;
1517
1518     name = NULL;
1519     if (strncmp(p, "target.xml", len) == 0) {
1520         /* Generate the XML description for this CPU.  */
1521         if (!target_xml[0]) {
1522             GDBRegisterState *r;
1523
1524             snprintf(target_xml, sizeof(target_xml),
1525                      "<?xml version=\"1.0\"?>"
1526                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1527                      "<target>"
1528                      "<xi:include href=\"%s\"/>",
1529                      GDB_CORE_XML);
1530
1531             for (r = first_cpu->gdb_regs; r; r = r->next) {
1532                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
1533                 pstrcat(target_xml, sizeof(target_xml), r->xml);
1534                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
1535             }
1536             pstrcat(target_xml, sizeof(target_xml), "</target>");
1537         }
1538         return target_xml;
1539     }
1540     for (i = 0; ; i++) {
1541         name = xml_builtin[i][0];
1542         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1543             break;
1544     }
1545     return name ? xml_builtin[i][1] : NULL;
1546 }
1547 #endif
1548
1549 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1550 {
1551     GDBRegisterState *r;
1552
1553     if (reg < NUM_CORE_REGS)
1554         return cpu_gdb_read_register(env, mem_buf, reg);
1555
1556     for (r = env->gdb_regs; r; r = r->next) {
1557         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1558             return r->get_reg(env, mem_buf, reg - r->base_reg);
1559         }
1560     }
1561     return 0;
1562 }
1563
1564 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1565 {
1566     GDBRegisterState *r;
1567
1568     if (reg < NUM_CORE_REGS)
1569         return cpu_gdb_write_register(env, mem_buf, reg);
1570
1571     for (r = env->gdb_regs; r; r = r->next) {
1572         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1573             return r->set_reg(env, mem_buf, reg - r->base_reg);
1574         }
1575     }
1576     return 0;
1577 }
1578
1579 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1580    specifies the first register number and these registers are included in
1581    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1582    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1583  */
1584
1585 void gdb_register_coprocessor(CPUState * env,
1586                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1587                              int num_regs, const char *xml, int g_pos)
1588 {
1589     GDBRegisterState *s;
1590     GDBRegisterState **p;
1591     static int last_reg = NUM_CORE_REGS;
1592
1593     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1594     s->base_reg = last_reg;
1595     s->num_regs = num_regs;
1596     s->get_reg = get_reg;
1597     s->set_reg = set_reg;
1598     s->xml = xml;
1599     p = &env->gdb_regs;
1600     while (*p) {
1601         /* Check for duplicates.  */
1602         if (strcmp((*p)->xml, xml) == 0)
1603             return;
1604         p = &(*p)->next;
1605     }
1606     /* Add to end of list.  */
1607     last_reg += num_regs;
1608     *p = s;
1609     if (g_pos) {
1610         if (g_pos != s->base_reg) {
1611             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1612                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1613         } else {
1614             num_g_regs = last_reg;
1615         }
1616     }
1617 }
1618
1619 #ifndef CONFIG_USER_ONLY
1620 static const int xlat_gdb_type[] = {
1621     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1622     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1623     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1624 };
1625 #endif
1626
1627 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1628 {
1629     CPUState *env;
1630     int err = 0;
1631
1632     if (kvm_enabled())
1633         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1634
1635     switch (type) {
1636     case GDB_BREAKPOINT_SW:
1637     case GDB_BREAKPOINT_HW:
1638         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1639             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1640             if (err)
1641                 break;
1642         }
1643         return err;
1644 #ifndef CONFIG_USER_ONLY
1645     case GDB_WATCHPOINT_WRITE:
1646     case GDB_WATCHPOINT_READ:
1647     case GDB_WATCHPOINT_ACCESS:
1648         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1649             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1650                                         NULL);
1651             if (err)
1652                 break;
1653         }
1654         return err;
1655 #endif
1656     default:
1657         return -ENOSYS;
1658     }
1659 }
1660
1661 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1662 {
1663     CPUState *env;
1664     int err = 0;
1665
1666     if (kvm_enabled())
1667         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1668
1669     switch (type) {
1670     case GDB_BREAKPOINT_SW:
1671     case GDB_BREAKPOINT_HW:
1672         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1673             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1674             if (err)
1675                 break;
1676         }
1677         return err;
1678 #ifndef CONFIG_USER_ONLY
1679     case GDB_WATCHPOINT_WRITE:
1680     case GDB_WATCHPOINT_READ:
1681     case GDB_WATCHPOINT_ACCESS:
1682         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1683             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1684             if (err)
1685                 break;
1686         }
1687         return err;
1688 #endif
1689     default:
1690         return -ENOSYS;
1691     }
1692 }
1693
1694 static void gdb_breakpoint_remove_all(void)
1695 {
1696     CPUState *env;
1697
1698     if (kvm_enabled()) {
1699         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1700         return;
1701     }
1702
1703     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1704         cpu_breakpoint_remove_all(env, BP_GDB);
1705 #ifndef CONFIG_USER_ONLY
1706         cpu_watchpoint_remove_all(env, BP_GDB);
1707 #endif
1708     }
1709 }
1710
1711 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1712 {
1713 #if defined(TARGET_I386)
1714     cpu_synchronize_state(s->c_cpu);
1715     s->c_cpu->eip = pc;
1716 #elif defined (TARGET_PPC)
1717     s->c_cpu->nip = pc;
1718 #elif defined (TARGET_SPARC)
1719     s->c_cpu->pc = pc;
1720     s->c_cpu->npc = pc + 4;
1721 #elif defined (TARGET_ARM)
1722     s->c_cpu->regs[15] = pc;
1723 #elif defined (TARGET_SH4)
1724     s->c_cpu->pc = pc;
1725 #elif defined (TARGET_MIPS)
1726     s->c_cpu->active_tc.PC = pc & ~(target_ulong)1;
1727     if (pc & 1) {
1728         s->c_cpu->hflags |= MIPS_HFLAG_M16;
1729     } else {
1730         s->c_cpu->hflags &= ~(MIPS_HFLAG_M16);
1731     }
1732 #elif defined (TARGET_MICROBLAZE)
1733     s->c_cpu->sregs[SR_PC] = pc;
1734 #elif defined (TARGET_CRIS)
1735     s->c_cpu->pc = pc;
1736 #elif defined (TARGET_ALPHA)
1737     s->c_cpu->pc = pc;
1738 #elif defined (TARGET_S390X)
1739     cpu_synchronize_state(s->c_cpu);
1740     s->c_cpu->psw.addr = pc;
1741 #endif
1742 }
1743
1744 static inline int gdb_id(CPUState *env)
1745 {
1746 #if defined(CONFIG_USER_ONLY) && defined(CONFIG_USE_NPTL)
1747     return env->host_tid;
1748 #else
1749     return env->cpu_index + 1;
1750 #endif
1751 }
1752
1753 static CPUState *find_cpu(uint32_t thread_id)
1754 {
1755     CPUState *env;
1756
1757     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1758         if (gdb_id(env) == thread_id) {
1759             return env;
1760         }
1761     }
1762
1763     return NULL;
1764 }
1765
1766 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1767 {
1768     CPUState *env;
1769     const char *p;
1770     uint32_t thread;
1771     int ch, reg_size, type, res;
1772     char buf[MAX_PACKET_LENGTH];
1773     uint8_t mem_buf[MAX_PACKET_LENGTH];
1774     uint8_t *registers;
1775     target_ulong addr, len;
1776
1777 #ifdef DEBUG_GDB
1778     printf("command='%s'\n", line_buf);
1779 #endif
1780     p = line_buf;
1781     ch = *p++;
1782     switch(ch) {
1783     case '?':
1784         /* TODO: Make this return the correct value for user-mode.  */
1785         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1786                  gdb_id(s->c_cpu));
1787         put_packet(s, buf);
1788         /* Remove all the breakpoints when this query is issued,
1789          * because gdb is doing and initial connect and the state
1790          * should be cleaned up.
1791          */
1792         gdb_breakpoint_remove_all();
1793         break;
1794     case 'c':
1795         if (*p != '\0') {
1796             addr = strtoull(p, (char **)&p, 16);
1797             gdb_set_cpu_pc(s, addr);
1798         }
1799         s->signal = 0;
1800         gdb_continue(s);
1801         return RS_IDLE;
1802     case 'C':
1803         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1804         if (s->signal == -1)
1805             s->signal = 0;
1806         gdb_continue(s);
1807         return RS_IDLE;
1808     case 'v':
1809         if (strncmp(p, "Cont", 4) == 0) {
1810             int res_signal, res_thread;
1811
1812             p += 4;
1813             if (*p == '?') {
1814                 put_packet(s, "vCont;c;C;s;S");
1815                 break;
1816             }
1817             res = 0;
1818             res_signal = 0;
1819             res_thread = 0;
1820             while (*p) {
1821                 int action, signal;
1822
1823                 if (*p++ != ';') {
1824                     res = 0;
1825                     break;
1826                 }
1827                 action = *p++;
1828                 signal = 0;
1829                 if (action == 'C' || action == 'S') {
1830                     signal = strtoul(p, (char **)&p, 16);
1831                 } else if (action != 'c' && action != 's') {
1832                     res = 0;
1833                     break;
1834                 }
1835                 thread = 0;
1836                 if (*p == ':') {
1837                     thread = strtoull(p+1, (char **)&p, 16);
1838                 }
1839                 action = tolower(action);
1840                 if (res == 0 || (res == 'c' && action == 's')) {
1841                     res = action;
1842                     res_signal = signal;
1843                     res_thread = thread;
1844                 }
1845             }
1846             if (res) {
1847                 if (res_thread != -1 && res_thread != 0) {
1848                     env = find_cpu(res_thread);
1849                     if (env == NULL) {
1850                         put_packet(s, "E22");
1851                         break;
1852                     }
1853                     s->c_cpu = env;
1854                 }
1855                 if (res == 's') {
1856                     cpu_single_step(s->c_cpu, sstep_flags);
1857                 }
1858                 s->signal = res_signal;
1859                 gdb_continue(s);
1860                 return RS_IDLE;
1861             }
1862             break;
1863         } else {
1864             goto unknown_command;
1865         }
1866     case 'k':
1867         /* Kill the target */
1868         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1869         exit(0);
1870     case 'D':
1871         /* Detach packet */
1872         gdb_breakpoint_remove_all();
1873         gdb_syscall_mode = GDB_SYS_DISABLED;
1874         gdb_continue(s);
1875         put_packet(s, "OK");
1876         break;
1877     case 's':
1878         if (*p != '\0') {
1879             addr = strtoull(p, (char **)&p, 16);
1880             gdb_set_cpu_pc(s, addr);
1881         }
1882         cpu_single_step(s->c_cpu, sstep_flags);
1883         gdb_continue(s);
1884         return RS_IDLE;
1885     case 'F':
1886         {
1887             target_ulong ret;
1888             target_ulong err;
1889
1890             ret = strtoull(p, (char **)&p, 16);
1891             if (*p == ',') {
1892                 p++;
1893                 err = strtoull(p, (char **)&p, 16);
1894             } else {
1895                 err = 0;
1896             }
1897             if (*p == ',')
1898                 p++;
1899             type = *p;
1900             if (gdb_current_syscall_cb)
1901                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1902             if (type == 'C') {
1903                 put_packet(s, "T02");
1904             } else {
1905                 gdb_continue(s);
1906             }
1907         }
1908         break;
1909     case 'g':
1910         cpu_synchronize_state(s->g_cpu);
1911         len = 0;
1912         for (addr = 0; addr < num_g_regs; addr++) {
1913             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1914             len += reg_size;
1915         }
1916         memtohex(buf, mem_buf, len);
1917         put_packet(s, buf);
1918         break;
1919     case 'G':
1920         cpu_synchronize_state(s->g_cpu);
1921         registers = mem_buf;
1922         len = strlen(p) / 2;
1923         hextomem((uint8_t *)registers, p, len);
1924         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1925             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1926             len -= reg_size;
1927             registers += reg_size;
1928         }
1929         put_packet(s, "OK");
1930         break;
1931     case 'm':
1932         addr = strtoull(p, (char **)&p, 16);
1933         if (*p == ',')
1934             p++;
1935         len = strtoull(p, NULL, 16);
1936         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1937             put_packet (s, "E14");
1938         } else {
1939             memtohex(buf, mem_buf, len);
1940             put_packet(s, buf);
1941         }
1942         break;
1943     case 'M':
1944         addr = strtoull(p, (char **)&p, 16);
1945         if (*p == ',')
1946             p++;
1947         len = strtoull(p, (char **)&p, 16);
1948         if (*p == ':')
1949             p++;
1950         hextomem(mem_buf, p, len);
1951         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1952             put_packet(s, "E14");
1953         else
1954             put_packet(s, "OK");
1955         break;
1956     case 'p':
1957         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1958            This works, but can be very slow.  Anything new enough to
1959            understand XML also knows how to use this properly.  */
1960         if (!gdb_has_xml)
1961             goto unknown_command;
1962         addr = strtoull(p, (char **)&p, 16);
1963         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1964         if (reg_size) {
1965             memtohex(buf, mem_buf, reg_size);
1966             put_packet(s, buf);
1967         } else {
1968             put_packet(s, "E14");
1969         }
1970         break;
1971     case 'P':
1972         if (!gdb_has_xml)
1973             goto unknown_command;
1974         addr = strtoull(p, (char **)&p, 16);
1975         if (*p == '=')
1976             p++;
1977         reg_size = strlen(p) / 2;
1978         hextomem(mem_buf, p, reg_size);
1979         gdb_write_register(s->g_cpu, mem_buf, addr);
1980         put_packet(s, "OK");
1981         break;
1982     case 'Z':
1983     case 'z':
1984         type = strtoul(p, (char **)&p, 16);
1985         if (*p == ',')
1986             p++;
1987         addr = strtoull(p, (char **)&p, 16);
1988         if (*p == ',')
1989             p++;
1990         len = strtoull(p, (char **)&p, 16);
1991         if (ch == 'Z')
1992             res = gdb_breakpoint_insert(addr, len, type);
1993         else
1994             res = gdb_breakpoint_remove(addr, len, type);
1995         if (res >= 0)
1996              put_packet(s, "OK");
1997         else if (res == -ENOSYS)
1998             put_packet(s, "");
1999         else
2000             put_packet(s, "E22");
2001         break;
2002     case 'H':
2003         type = *p++;
2004         thread = strtoull(p, (char **)&p, 16);
2005         if (thread == -1 || thread == 0) {
2006             put_packet(s, "OK");
2007             break;
2008         }
2009         env = find_cpu(thread);
2010         if (env == NULL) {
2011             put_packet(s, "E22");
2012             break;
2013         }
2014         switch (type) {
2015         case 'c':
2016             s->c_cpu = env;
2017             put_packet(s, "OK");
2018             break;
2019         case 'g':
2020             s->g_cpu = env;
2021             put_packet(s, "OK");
2022             break;
2023         default:
2024              put_packet(s, "E22");
2025              break;
2026         }
2027         break;
2028     case 'T':
2029         thread = strtoull(p, (char **)&p, 16);
2030         env = find_cpu(thread);
2031
2032         if (env != NULL) {
2033             put_packet(s, "OK");
2034         } else {
2035             put_packet(s, "E22");
2036         }
2037         break;
2038     case 'q':
2039     case 'Q':
2040         /* parse any 'q' packets here */
2041         if (!strcmp(p,"qemu.sstepbits")) {
2042             /* Query Breakpoint bit definitions */
2043             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
2044                      SSTEP_ENABLE,
2045                      SSTEP_NOIRQ,
2046                      SSTEP_NOTIMER);
2047             put_packet(s, buf);
2048             break;
2049         } else if (strncmp(p,"qemu.sstep",10) == 0) {
2050             /* Display or change the sstep_flags */
2051             p += 10;
2052             if (*p != '=') {
2053                 /* Display current setting */
2054                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
2055                 put_packet(s, buf);
2056                 break;
2057             }
2058             p++;
2059             type = strtoul(p, (char **)&p, 16);
2060             sstep_flags = type;
2061             put_packet(s, "OK");
2062             break;
2063         } else if (strcmp(p,"C") == 0) {
2064             /* "Current thread" remains vague in the spec, so always return
2065              *  the first CPU (gdb returns the first thread). */
2066             put_packet(s, "QC1");
2067             break;
2068         } else if (strcmp(p,"fThreadInfo") == 0) {
2069             s->query_cpu = first_cpu;
2070             goto report_cpuinfo;
2071         } else if (strcmp(p,"sThreadInfo") == 0) {
2072         report_cpuinfo:
2073             if (s->query_cpu) {
2074                 snprintf(buf, sizeof(buf), "m%x", gdb_id(s->query_cpu));
2075                 put_packet(s, buf);
2076                 s->query_cpu = s->query_cpu->next_cpu;
2077             } else
2078                 put_packet(s, "l");
2079             break;
2080         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
2081             thread = strtoull(p+16, (char **)&p, 16);
2082             env = find_cpu(thread);
2083             if (env != NULL) {
2084                 cpu_synchronize_state(env);
2085                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
2086                                "CPU#%d [%s]", env->cpu_index,
2087                                env->halted ? "halted " : "running");
2088                 memtohex(buf, mem_buf, len);
2089                 put_packet(s, buf);
2090             }
2091             break;
2092         }
2093 #ifdef CONFIG_USER_ONLY
2094         else if (strncmp(p, "Offsets", 7) == 0) {
2095             TaskState *ts = s->c_cpu->opaque;
2096
2097             snprintf(buf, sizeof(buf),
2098                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
2099                      ";Bss=" TARGET_ABI_FMT_lx,
2100                      ts->info->code_offset,
2101                      ts->info->data_offset,
2102                      ts->info->data_offset);
2103             put_packet(s, buf);
2104             break;
2105         }
2106 #else /* !CONFIG_USER_ONLY */
2107         else if (strncmp(p, "Rcmd,", 5) == 0) {
2108             int len = strlen(p + 5);
2109
2110             if ((len % 2) != 0) {
2111                 put_packet(s, "E01");
2112                 break;
2113             }
2114             hextomem(mem_buf, p + 5, len);
2115             len = len / 2;
2116             mem_buf[len++] = 0;
2117             qemu_chr_read(s->mon_chr, mem_buf, len);
2118             put_packet(s, "OK");
2119             break;
2120         }
2121 #endif /* !CONFIG_USER_ONLY */
2122         if (strncmp(p, "Supported", 9) == 0) {
2123             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
2124 #ifdef GDB_CORE_XML
2125             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
2126 #endif
2127             put_packet(s, buf);
2128             break;
2129         }
2130 #ifdef GDB_CORE_XML
2131         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
2132             const char *xml;
2133             target_ulong total_len;
2134
2135             gdb_has_xml = 1;
2136             p += 19;
2137             xml = get_feature_xml(p, &p);
2138             if (!xml) {
2139                 snprintf(buf, sizeof(buf), "E00");
2140                 put_packet(s, buf);
2141                 break;
2142             }
2143
2144             if (*p == ':')
2145                 p++;
2146             addr = strtoul(p, (char **)&p, 16);
2147             if (*p == ',')
2148                 p++;
2149             len = strtoul(p, (char **)&p, 16);
2150
2151             total_len = strlen(xml);
2152             if (addr > total_len) {
2153                 snprintf(buf, sizeof(buf), "E00");
2154                 put_packet(s, buf);
2155                 break;
2156             }
2157             if (len > (MAX_PACKET_LENGTH - 5) / 2)
2158                 len = (MAX_PACKET_LENGTH - 5) / 2;
2159             if (len < total_len - addr) {
2160                 buf[0] = 'm';
2161                 len = memtox(buf + 1, xml + addr, len);
2162             } else {
2163                 buf[0] = 'l';
2164                 len = memtox(buf + 1, xml + addr, total_len - addr);
2165             }
2166             put_packet_binary(s, buf, len + 1);
2167             break;
2168         }
2169 #endif
2170         /* Unrecognised 'q' command.  */
2171         goto unknown_command;
2172
2173     default:
2174     unknown_command:
2175         /* put empty packet */
2176         buf[0] = '\0';
2177         put_packet(s, buf);
2178         break;
2179     }
2180     return RS_IDLE;
2181 }
2182
2183 void gdb_set_stop_cpu(CPUState *env)
2184 {
2185     gdbserver_state->c_cpu = env;
2186     gdbserver_state->g_cpu = env;
2187 }
2188
2189 #ifndef CONFIG_USER_ONLY
2190 static void gdb_vm_state_change(void *opaque, int running, int reason)
2191 {
2192     GDBState *s = gdbserver_state;
2193     CPUState *env = s->c_cpu;
2194     char buf[256];
2195     const char *type;
2196     int ret;
2197
2198     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
2199         s->state == RS_INACTIVE || s->state == RS_SYSCALL)
2200         return;
2201
2202     /* disable single step if it was enable */
2203     cpu_single_step(env, 0);
2204
2205     if (reason == EXCP_DEBUG) {
2206         if (env->watchpoint_hit) {
2207             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
2208             case BP_MEM_READ:
2209                 type = "r";
2210                 break;
2211             case BP_MEM_ACCESS:
2212                 type = "a";
2213                 break;
2214             default:
2215                 type = "";
2216                 break;
2217             }
2218             snprintf(buf, sizeof(buf),
2219                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
2220                      GDB_SIGNAL_TRAP, gdb_id(env), type,
2221                      env->watchpoint_hit->vaddr);
2222             put_packet(s, buf);
2223             env->watchpoint_hit = NULL;
2224             return;
2225         }
2226         tb_flush(env);
2227         ret = GDB_SIGNAL_TRAP;
2228     } else {
2229         ret = GDB_SIGNAL_INT;
2230     }
2231     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, gdb_id(env));
2232     put_packet(s, buf);
2233 }
2234 #endif
2235
2236 /* Send a gdb syscall request.
2237    This accepts limited printf-style format specifiers, specifically:
2238     %x  - target_ulong argument printed in hex.
2239     %lx - 64-bit argument printed in hex.
2240     %s  - string pointer (target_ulong) and length (int) pair.  */
2241 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
2242 {
2243     va_list va;
2244     char buf[256];
2245     char *p;
2246     target_ulong addr;
2247     uint64_t i64;
2248     GDBState *s;
2249
2250     s = gdbserver_state;
2251     if (!s)
2252         return;
2253     gdb_current_syscall_cb = cb;
2254     s->state = RS_SYSCALL;
2255 #ifndef CONFIG_USER_ONLY
2256     vm_stop(EXCP_DEBUG);
2257 #endif
2258     s->state = RS_IDLE;
2259     va_start(va, fmt);
2260     p = buf;
2261     *(p++) = 'F';
2262     while (*fmt) {
2263         if (*fmt == '%') {
2264             fmt++;
2265             switch (*fmt++) {
2266             case 'x':
2267                 addr = va_arg(va, target_ulong);
2268                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
2269                 break;
2270             case 'l':
2271                 if (*(fmt++) != 'x')
2272                     goto bad_format;
2273                 i64 = va_arg(va, uint64_t);
2274                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
2275                 break;
2276             case 's':
2277                 addr = va_arg(va, target_ulong);
2278                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
2279                               addr, va_arg(va, int));
2280                 break;
2281             default:
2282             bad_format:
2283                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2284                         fmt - 1);
2285                 break;
2286             }
2287         } else {
2288             *(p++) = *(fmt++);
2289         }
2290     }
2291     *p = 0;
2292     va_end(va);
2293     put_packet(s, buf);
2294 #ifdef CONFIG_USER_ONLY
2295     gdb_handlesig(s->c_cpu, 0);
2296 #else
2297     cpu_exit(s->c_cpu);
2298 #endif
2299 }
2300
2301 static void gdb_read_byte(GDBState *s, int ch)
2302 {
2303     int i, csum;
2304     uint8_t reply;
2305
2306 #ifndef CONFIG_USER_ONLY
2307     if (s->last_packet_len) {
2308         /* Waiting for a response to the last packet.  If we see the start
2309            of a new command then abandon the previous response.  */
2310         if (ch == '-') {
2311 #ifdef DEBUG_GDB
2312             printf("Got NACK, retransmitting\n");
2313 #endif
2314             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2315         }
2316 #ifdef DEBUG_GDB
2317         else if (ch == '+')
2318             printf("Got ACK\n");
2319         else
2320             printf("Got '%c' when expecting ACK/NACK\n", ch);
2321 #endif
2322         if (ch == '+' || ch == '$')
2323             s->last_packet_len = 0;
2324         if (ch != '$')
2325             return;
2326     }
2327     if (vm_running) {
2328         /* when the CPU is running, we cannot do anything except stop
2329            it when receiving a char */
2330         vm_stop(EXCP_INTERRUPT);
2331     } else
2332 #endif
2333     {
2334         switch(s->state) {
2335         case RS_IDLE:
2336             if (ch == '$') {
2337                 s->line_buf_index = 0;
2338                 s->state = RS_GETLINE;
2339             }
2340             break;
2341         case RS_GETLINE:
2342             if (ch == '#') {
2343             s->state = RS_CHKSUM1;
2344             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2345                 s->state = RS_IDLE;
2346             } else {
2347             s->line_buf[s->line_buf_index++] = ch;
2348             }
2349             break;
2350         case RS_CHKSUM1:
2351             s->line_buf[s->line_buf_index] = '\0';
2352             s->line_csum = fromhex(ch) << 4;
2353             s->state = RS_CHKSUM2;
2354             break;
2355         case RS_CHKSUM2:
2356             s->line_csum |= fromhex(ch);
2357             csum = 0;
2358             for(i = 0; i < s->line_buf_index; i++) {
2359                 csum += s->line_buf[i];
2360             }
2361             if (s->line_csum != (csum & 0xff)) {
2362                 reply = '-';
2363                 put_buffer(s, &reply, 1);
2364                 s->state = RS_IDLE;
2365             } else {
2366                 reply = '+';
2367                 put_buffer(s, &reply, 1);
2368                 s->state = gdb_handle_packet(s, s->line_buf);
2369             }
2370             break;
2371         default:
2372             abort();
2373         }
2374     }
2375 }
2376
2377 /* Tell the remote gdb that the process has exited.  */
2378 void gdb_exit(CPUState *env, int code)
2379 {
2380   GDBState *s;
2381   char buf[4];
2382
2383   s = gdbserver_state;
2384   if (!s) {
2385       return;
2386   }
2387 #ifdef CONFIG_USER_ONLY
2388   if (gdbserver_fd < 0 || s->fd < 0) {
2389       return;
2390   }
2391 #endif
2392
2393   snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
2394   put_packet(s, buf);
2395
2396 #ifndef CONFIG_USER_ONLY
2397   if (s->chr) {
2398       qemu_chr_close(s->chr);
2399   }
2400 #endif
2401 }
2402
2403 #ifdef CONFIG_USER_ONLY
2404 int
2405 gdb_queuesig (void)
2406 {
2407     GDBState *s;
2408
2409     s = gdbserver_state;
2410
2411     if (gdbserver_fd < 0 || s->fd < 0)
2412         return 0;
2413     else
2414         return 1;
2415 }
2416
2417 int
2418 gdb_handlesig (CPUState *env, int sig)
2419 {
2420   GDBState *s;
2421   char buf[256];
2422   int n;
2423
2424   s = gdbserver_state;
2425   if (gdbserver_fd < 0 || s->fd < 0)
2426     return sig;
2427
2428   /* disable single step if it was enabled */
2429   cpu_single_step(env, 0);
2430   tb_flush(env);
2431
2432   if (sig != 0)
2433     {
2434       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2435       put_packet(s, buf);
2436     }
2437   /* put_packet() might have detected that the peer terminated the
2438      connection.  */
2439   if (s->fd < 0)
2440       return sig;
2441
2442   sig = 0;
2443   s->state = RS_IDLE;
2444   s->running_state = 0;
2445   while (s->running_state == 0) {
2446       n = read (s->fd, buf, 256);
2447       if (n > 0)
2448         {
2449           int i;
2450
2451           for (i = 0; i < n; i++)
2452             gdb_read_byte (s, buf[i]);
2453         }
2454       else if (n == 0 || errno != EAGAIN)
2455         {
2456           /* XXX: Connection closed.  Should probably wait for annother
2457              connection before continuing.  */
2458           return sig;
2459         }
2460   }
2461   sig = s->signal;
2462   s->signal = 0;
2463   return sig;
2464 }
2465
2466 /* Tell the remote gdb that the process has exited due to SIG.  */
2467 void gdb_signalled(CPUState *env, int sig)
2468 {
2469   GDBState *s;
2470   char buf[4];
2471
2472   s = gdbserver_state;
2473   if (gdbserver_fd < 0 || s->fd < 0)
2474     return;
2475
2476   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2477   put_packet(s, buf);
2478 }
2479
2480 static void gdb_accept(void)
2481 {
2482     GDBState *s;
2483     struct sockaddr_in sockaddr;
2484     socklen_t len;
2485     int val, fd;
2486
2487     for(;;) {
2488         len = sizeof(sockaddr);
2489         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2490         if (fd < 0 && errno != EINTR) {
2491             perror("accept");
2492             return;
2493         } else if (fd >= 0) {
2494 #ifndef _WIN32
2495             fcntl(fd, F_SETFD, FD_CLOEXEC);
2496 #endif
2497             break;
2498         }
2499     }
2500
2501     /* set short latency */
2502     val = 1;
2503     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2504
2505     s = qemu_mallocz(sizeof(GDBState));
2506     s->c_cpu = first_cpu;
2507     s->g_cpu = first_cpu;
2508     s->fd = fd;
2509     gdb_has_xml = 0;
2510
2511     gdbserver_state = s;
2512
2513     fcntl(fd, F_SETFL, O_NONBLOCK);
2514 }
2515
2516 static int gdbserver_open(int port)
2517 {
2518     struct sockaddr_in sockaddr;
2519     int fd, val, ret;
2520
2521     fd = socket(PF_INET, SOCK_STREAM, 0);
2522     if (fd < 0) {
2523         perror("socket");
2524         return -1;
2525     }
2526 #ifndef _WIN32
2527     fcntl(fd, F_SETFD, FD_CLOEXEC);
2528 #endif
2529
2530     /* allow fast reuse */
2531     val = 1;
2532     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2533
2534     sockaddr.sin_family = AF_INET;
2535     sockaddr.sin_port = htons(port);
2536     sockaddr.sin_addr.s_addr = 0;
2537     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2538     if (ret < 0) {
2539         perror("bind");
2540         return -1;
2541     }
2542     ret = listen(fd, 0);
2543     if (ret < 0) {
2544         perror("listen");
2545         return -1;
2546     }
2547     return fd;
2548 }
2549
2550 int gdbserver_start(int port)
2551 {
2552     gdbserver_fd = gdbserver_open(port);
2553     if (gdbserver_fd < 0)
2554         return -1;
2555     /* accept connections */
2556     gdb_accept();
2557     return 0;
2558 }
2559
2560 /* Disable gdb stub for child processes.  */
2561 void gdbserver_fork(CPUState *env)
2562 {
2563     GDBState *s = gdbserver_state;
2564     if (gdbserver_fd < 0 || s->fd < 0)
2565       return;
2566     close(s->fd);
2567     s->fd = -1;
2568     cpu_breakpoint_remove_all(env, BP_GDB);
2569     cpu_watchpoint_remove_all(env, BP_GDB);
2570 }
2571 #else
2572 static int gdb_chr_can_receive(void *opaque)
2573 {
2574   /* We can handle an arbitrarily large amount of data.
2575    Pick the maximum packet size, which is as good as anything.  */
2576   return MAX_PACKET_LENGTH;
2577 }
2578
2579 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2580 {
2581     int i;
2582
2583     for (i = 0; i < size; i++) {
2584         gdb_read_byte(gdbserver_state, buf[i]);
2585     }
2586 }
2587
2588 static void gdb_chr_event(void *opaque, int event)
2589 {
2590     switch (event) {
2591     case CHR_EVENT_OPENED:
2592         vm_stop(EXCP_INTERRUPT);
2593         gdb_has_xml = 0;
2594         break;
2595     default:
2596         break;
2597     }
2598 }
2599
2600 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2601 {
2602     char buf[MAX_PACKET_LENGTH];
2603
2604     buf[0] = 'O';
2605     if (len > (MAX_PACKET_LENGTH/2) - 1)
2606         len = (MAX_PACKET_LENGTH/2) - 1;
2607     memtohex(buf + 1, (uint8_t *)msg, len);
2608     put_packet(s, buf);
2609 }
2610
2611 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2612 {
2613     const char *p = (const char *)buf;
2614     int max_sz;
2615
2616     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2617     for (;;) {
2618         if (len <= max_sz) {
2619             gdb_monitor_output(gdbserver_state, p, len);
2620             break;
2621         }
2622         gdb_monitor_output(gdbserver_state, p, max_sz);
2623         p += max_sz;
2624         len -= max_sz;
2625     }
2626     return len;
2627 }
2628
2629 #ifndef _WIN32
2630 static void gdb_sigterm_handler(int signal)
2631 {
2632     if (vm_running)
2633         vm_stop(EXCP_INTERRUPT);
2634 }
2635 #endif
2636
2637 int gdbserver_start(const char *device)
2638 {
2639     GDBState *s;
2640     char gdbstub_device_name[128];
2641     CharDriverState *chr = NULL;
2642     CharDriverState *mon_chr;
2643
2644     if (!device)
2645         return -1;
2646     if (strcmp(device, "none") != 0) {
2647         if (strstart(device, "tcp:", NULL)) {
2648             /* enforce required TCP attributes */
2649             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2650                      "%s,nowait,nodelay,server", device);
2651             device = gdbstub_device_name;
2652         }
2653 #ifndef _WIN32
2654         else if (strcmp(device, "stdio") == 0) {
2655             struct sigaction act;
2656
2657             memset(&act, 0, sizeof(act));
2658             act.sa_handler = gdb_sigterm_handler;
2659             sigaction(SIGINT, &act, NULL);
2660         }
2661 #endif
2662         chr = qemu_chr_open("gdb", device, NULL);
2663         if (!chr)
2664             return -1;
2665
2666         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2667                               gdb_chr_event, NULL);
2668     }
2669
2670     s = gdbserver_state;
2671     if (!s) {
2672         s = qemu_mallocz(sizeof(GDBState));
2673         gdbserver_state = s;
2674
2675         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2676
2677         /* Initialize a monitor terminal for gdb */
2678         mon_chr = qemu_mallocz(sizeof(*mon_chr));
2679         mon_chr->chr_write = gdb_monitor_write;
2680         monitor_init(mon_chr, 0);
2681     } else {
2682         if (s->chr)
2683             qemu_chr_close(s->chr);
2684         mon_chr = s->mon_chr;
2685         memset(s, 0, sizeof(GDBState));
2686     }
2687     s->c_cpu = first_cpu;
2688     s->g_cpu = first_cpu;
2689     s->chr = chr;
2690     s->state = chr ? RS_IDLE : RS_INACTIVE;
2691     s->mon_chr = mon_chr;
2692
2693     return 0;
2694 }
2695 #endif