gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "qemu-common.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "monitor.h"
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #endif
  37
  38 #define MAX_PACKET_LENGTH 4096
  39
  40 #include "exec-all.h"
  41 #include "qemu_socket.h"
  42 #include "kvm.h"
  43
  44
  45 enum {
  46     GDB_SIGNAL_0 = 0,
  47     GDB_SIGNAL_INT = 2,
  48     GDB_SIGNAL_TRAP = 5,
  49     GDB_SIGNAL_UNKNOWN = 143
  50 };
  51
  52 #ifdef CONFIG_USER_ONLY
  53
  54 /* Map target signal numbers to GDB protocol signal numbers and vice
  55  * versa.  For user emulation's currently supported systems, we can
  56  * assume most signals are defined.
  57  */
  58
  59 static int gdb_signal_table[] = {
  60     0,
  61     TARGET_SIGHUP,
  62     TARGET_SIGINT,
  63     TARGET_SIGQUIT,
  64     TARGET_SIGILL,
  65     TARGET_SIGTRAP,
  66     TARGET_SIGABRT,
  67     -1, /* SIGEMT */
  68     TARGET_SIGFPE,
  69     TARGET_SIGKILL,
  70     TARGET_SIGBUS,
  71     TARGET_SIGSEGV,
  72     TARGET_SIGSYS,
  73     TARGET_SIGPIPE,
  74     TARGET_SIGALRM,
  75     TARGET_SIGTERM,
  76     TARGET_SIGURG,
  77     TARGET_SIGSTOP,
  78     TARGET_SIGTSTP,
  79     TARGET_SIGCONT,
  80     TARGET_SIGCHLD,
  81     TARGET_SIGTTIN,
  82     TARGET_SIGTTOU,
  83     TARGET_SIGIO,
  84     TARGET_SIGXCPU,
  85     TARGET_SIGXFSZ,
  86     TARGET_SIGVTALRM,
  87     TARGET_SIGPROF,
  88     TARGET_SIGWINCH,
  89     -1, /* SIGLOST */
  90     TARGET_SIGUSR1,
  91     TARGET_SIGUSR2,
  92 #ifdef TARGET_SIGPWR
  93     TARGET_SIGPWR,
  94 #else
  95     -1,
  96 #endif
  97     -1, /* SIGPOLL */
  98     -1,
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108     -1,
 109 #ifdef __SIGRTMIN
 110     __SIGRTMIN + 1,
 111     __SIGRTMIN + 2,
 112     __SIGRTMIN + 3,
 113     __SIGRTMIN + 4,
 114     __SIGRTMIN + 5,
 115     __SIGRTMIN + 6,
 116     __SIGRTMIN + 7,
 117     __SIGRTMIN + 8,
 118     __SIGRTMIN + 9,
 119     __SIGRTMIN + 10,
 120     __SIGRTMIN + 11,
 121     __SIGRTMIN + 12,
 122     __SIGRTMIN + 13,
 123     __SIGRTMIN + 14,
 124     __SIGRTMIN + 15,
 125     __SIGRTMIN + 16,
 126     __SIGRTMIN + 17,
 127     __SIGRTMIN + 18,
 128     __SIGRTMIN + 19,
 129     __SIGRTMIN + 20,
 130     __SIGRTMIN + 21,
 131     __SIGRTMIN + 22,
 132     __SIGRTMIN + 23,
 133     __SIGRTMIN + 24,
 134     __SIGRTMIN + 25,
 135     __SIGRTMIN + 26,
 136     __SIGRTMIN + 27,
 137     __SIGRTMIN + 28,
 138     __SIGRTMIN + 29,
 139     __SIGRTMIN + 30,
 140     __SIGRTMIN + 31,
 141     -1, /* SIGCANCEL */
 142     __SIGRTMIN,
 143     __SIGRTMIN + 32,
 144     __SIGRTMIN + 33,
 145     __SIGRTMIN + 34,
 146     __SIGRTMIN + 35,
 147     __SIGRTMIN + 36,
 148     __SIGRTMIN + 37,
 149     __SIGRTMIN + 38,
 150     __SIGRTMIN + 39,
 151     __SIGRTMIN + 40,
 152     __SIGRTMIN + 41,
 153     __SIGRTMIN + 42,
 154     __SIGRTMIN + 43,
 155     __SIGRTMIN + 44,
 156     __SIGRTMIN + 45,
 157     __SIGRTMIN + 46,
 158     __SIGRTMIN + 47,
 159     __SIGRTMIN + 48,
 160     __SIGRTMIN + 49,
 161     __SIGRTMIN + 50,
 162     __SIGRTMIN + 51,
 163     __SIGRTMIN + 52,
 164     __SIGRTMIN + 53,
 165     __SIGRTMIN + 54,
 166     __SIGRTMIN + 55,
 167     __SIGRTMIN + 56,
 168     __SIGRTMIN + 57,
 169     __SIGRTMIN + 58,
 170     __SIGRTMIN + 59,
 171     __SIGRTMIN + 60,
 172     __SIGRTMIN + 61,
 173     __SIGRTMIN + 62,
 174     __SIGRTMIN + 63,
 175     __SIGRTMIN + 64,
 176     __SIGRTMIN + 65,
 177     __SIGRTMIN + 66,
 178     __SIGRTMIN + 67,
 179     __SIGRTMIN + 68,
 180     __SIGRTMIN + 69,
 181     __SIGRTMIN + 70,
 182     __SIGRTMIN + 71,
 183     __SIGRTMIN + 72,
 184     __SIGRTMIN + 73,
 185     __SIGRTMIN + 74,
 186     __SIGRTMIN + 75,
 187     __SIGRTMIN + 76,
 188     __SIGRTMIN + 77,
 189     __SIGRTMIN + 78,
 190     __SIGRTMIN + 79,
 191     __SIGRTMIN + 80,
 192     __SIGRTMIN + 81,
 193     __SIGRTMIN + 82,
 194     __SIGRTMIN + 83,
 195     __SIGRTMIN + 84,
 196     __SIGRTMIN + 85,
 197     __SIGRTMIN + 86,
 198     __SIGRTMIN + 87,
 199     __SIGRTMIN + 88,
 200     __SIGRTMIN + 89,
 201     __SIGRTMIN + 90,
 202     __SIGRTMIN + 91,
 203     __SIGRTMIN + 92,
 204     __SIGRTMIN + 93,
 205     __SIGRTMIN + 94,
 206     __SIGRTMIN + 95,
 207     -1, /* SIGINFO */
 208     -1, /* UNKNOWN */
 209     -1, /* DEFAULT */
 210     -1,
 211     -1,
 212     -1,
 213     -1,
 214     -1,
 215     -1
 216 #endif
 217 };
 218 #else
 219 /* In system mode we only need SIGINT and SIGTRAP; other signals
 220    are not yet supported.  */
 221
 222 enum {
 223     TARGET_SIGINT = 2,
 224     TARGET_SIGTRAP = 5
 225 };
 226
 227 static int gdb_signal_table[] = {
 228     -1,
 229     -1,
 230     TARGET_SIGINT,
 231     -1,
 232     -1,
 233     TARGET_SIGTRAP
 234 };
 235 #endif
 236
 237 #ifdef CONFIG_USER_ONLY
 238 static int target_signal_to_gdb (int sig)
 239 {
 240     int i;
 241     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 242         if (gdb_signal_table[i] == sig)
 243             return i;
 244     return GDB_SIGNAL_UNKNOWN;
 245 }
 246 #endif
 247
 248 static int gdb_signal_to_target (int sig)
 249 {
 250     if (sig < ARRAY_SIZE (gdb_signal_table))
 251         return gdb_signal_table[sig];
 252     else
 253         return -1;
 254 }
 255
 256 //#define DEBUG_GDB
 257
 258 typedef struct GDBRegisterState {
 259     int base_reg;
 260     int num_regs;
 261     gdb_reg_cb get_reg;
 262     gdb_reg_cb set_reg;
 263     const char *xml;
 264     struct GDBRegisterState *next;
 265 } GDBRegisterState;
 266
 267 enum RSState {
 268     RS_INACTIVE,
 269     RS_IDLE,
 270     RS_GETLINE,
 271     RS_CHKSUM1,
 272     RS_CHKSUM2,
 273     RS_SYSCALL,
 274 };
 275 typedef struct GDBState {
 276     CPUState *c_cpu; /* current CPU for step/continue ops */
 277     CPUState *g_cpu; /* current CPU for other ops */
 278     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 279     enum RSState state; /* parsing state */
 280     char line_buf[MAX_PACKET_LENGTH];
 281     int line_buf_index;
 282     int line_csum;
 283     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 284     int last_packet_len;
 285     int signal;
 286 #ifdef CONFIG_USER_ONLY
 287     int fd;
 288     int running_state;
 289 #else
 290     CharDriverState *chr;
 291     CharDriverState *mon_chr;
 292 #endif
 293 } GDBState;
 294
 295 /* By default use no IRQs and no timers while single stepping so as to
 296  * make single stepping like an ICE HW step.
 297  */
 298 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 299
 300 static GDBState *gdbserver_state;
 301
 302 /* This is an ugly hack to cope with both new and old gdb.
 303    If gdb sends qXfer:features:read then assume we're talking to a newish
 304    gdb that understands target descriptions.  */
 305 static int gdb_has_xml;
 306
 307 #ifdef CONFIG_USER_ONLY
 308 /* XXX: This is not thread safe.  Do we care?  */
 309 static int gdbserver_fd = -1;
 310
 311 static int get_char(GDBState *s)
 312 {
 313     uint8_t ch;
 314     int ret;
 315
 316     for(;;) {
 317         ret = recv(s->fd, &ch, 1, 0);
 318         if (ret < 0) {
 319             if (errno == ECONNRESET)
 320                 s->fd = -1;
 321             if (errno != EINTR && errno != EAGAIN)
 322                 return -1;
 323         } else if (ret == 0) {
 324             close(s->fd);
 325             s->fd = -1;
 326             return -1;
 327         } else {
 328             break;
 329         }
 330     }
 331     return ch;
 332 }
 333 #endif
 334
 335 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 336
 337 static enum {
 338     GDB_SYS_UNKNOWN,
 339     GDB_SYS_ENABLED,
 340     GDB_SYS_DISABLED,
 341 } gdb_syscall_mode;
 342
 343 /* If gdb is connected when the first semihosting syscall occurs then use
 344    remote gdb syscalls.  Otherwise use native file IO.  */
 345 int use_gdb_syscalls(void)
 346 {
 347     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 348         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 349                                             : GDB_SYS_DISABLED);
 350     }
 351     return gdb_syscall_mode == GDB_SYS_ENABLED;
 352 }
 353
 354 /* Resume execution.  */
 355 static inline void gdb_continue(GDBState *s)
 356 {
 357 #ifdef CONFIG_USER_ONLY
 358     s->running_state = 1;
 359 #else
 360     vm_start();
 361 #endif
 362 }
 363
 364 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 365 {
 366 #ifdef CONFIG_USER_ONLY
 367     int ret;
 368
 369     while (len > 0) {
 370         ret = send(s->fd, buf, len, 0);
 371         if (ret < 0) {
 372             if (errno != EINTR && errno != EAGAIN)
 373                 return;
 374         } else {
 375             buf += ret;
 376             len -= ret;
 377         }
 378     }
 379 #else
 380     qemu_chr_write(s->chr, buf, len);
 381 #endif
 382 }
 383
 384 static inline int fromhex(int v)
 385 {
 386     if (v >= '0' && v <= '9')
 387         return v - '0';
 388     else if (v >= 'A' && v <= 'F')
 389         return v - 'A' + 10;
 390     else if (v >= 'a' && v <= 'f')
 391         return v - 'a' + 10;
 392     else
 393         return 0;
 394 }
 395
 396 static inline int tohex(int v)
 397 {
 398     if (v < 10)
 399         return v + '0';
 400     else
 401         return v - 10 + 'a';
 402 }
 403
 404 static void memtohex(char *buf, const uint8_t *mem, int len)
 405 {
 406     int i, c;
 407     char *q;
 408     q = buf;
 409     for(i = 0; i < len; i++) {
 410         c = mem[i];
 411         *q++ = tohex(c >> 4);
 412         *q++ = tohex(c & 0xf);
 413     }
 414     *q = '\0';
 415 }
 416
 417 static void hextomem(uint8_t *mem, const char *buf, int len)
 418 {
 419     int i;
 420
 421     for(i = 0; i < len; i++) {
 422         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 423         buf += 2;
 424     }
 425 }
 426
 427 /* return -1 if error, 0 if OK */
 428 static int put_packet_binary(GDBState *s, const char *buf, int len)
 429 {
 430     int csum, i;
 431     uint8_t *p;
 432
 433     for(;;) {
 434         p = s->last_packet;
 435         *(p++) = '$';
 436         memcpy(p, buf, len);
 437         p += len;
 438         csum = 0;
 439         for(i = 0; i < len; i++) {
 440             csum += buf[i];
 441         }
 442         *(p++) = '#';
 443         *(p++) = tohex((csum >> 4) & 0xf);
 444         *(p++) = tohex((csum) & 0xf);
 445
 446         s->last_packet_len = p - s->last_packet;
 447         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 448
 449 #ifdef CONFIG_USER_ONLY
 450         i = get_char(s);
 451         if (i < 0)
 452             return -1;
 453         if (i == '+')
 454             break;
 455 #else
 456         break;
 457 #endif
 458     }
 459     return 0;
 460 }
 461
 462 /* return -1 if error, 0 if OK */
 463 static int put_packet(GDBState *s, const char *buf)
 464 {
 465 #ifdef DEBUG_GDB
 466     printf("reply='%s'\n", buf);
 467 #endif
 468
 469     return put_packet_binary(s, buf, strlen(buf));
 470 }
 471
 472 /* The GDB remote protocol transfers values in target byte order.  This means
 473    we can use the raw memory access routines to access the value buffer.
 474    Conveniently, these also handle the case where the buffer is mis-aligned.
 475  */
 476 #define GET_REG8(val) do { \
 477     stb_p(mem_buf, val); \
 478     return 1; \
 479     } while(0)
 480 #define GET_REG16(val) do { \
 481     stw_p(mem_buf, val); \
 482     return 2; \
 483     } while(0)
 484 #define GET_REG32(val) do { \
 485     stl_p(mem_buf, val); \
 486     return 4; \
 487     } while(0)
 488 #define GET_REG64(val) do { \
 489     stq_p(mem_buf, val); \
 490     return 8; \
 491     } while(0)
 492
 493 #if TARGET_LONG_BITS == 64
 494 #define GET_REGL(val) GET_REG64(val)
 495 #define ldtul_p(addr) ldq_p(addr)
 496 #else
 497 #define GET_REGL(val) GET_REG32(val)
 498 #define ldtul_p(addr) ldl_p(addr)
 499 #endif
 500
 501 #if defined(TARGET_I386)
 502
 503 #ifdef TARGET_X86_64
 504 static const int gpr_map[16] = {
 505     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 506     8, 9, 10, 11, 12, 13, 14, 15
 507 };
 508 #else
 509 #define gpr_map gpr_map32
 510 #endif
 511 static const int gpr_map32[8] = { 0, 1, 2, 3, 4, 5, 6, 7 };
 512
 513 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 514
 515 #define IDX_IP_REG      CPU_NB_REGS
 516 #define IDX_FLAGS_REG   (IDX_IP_REG + 1)
 517 #define IDX_SEG_REGS    (IDX_FLAGS_REG + 1)
 518 #define IDX_FP_REGS     (IDX_SEG_REGS + 6)
 519 #define IDX_XMM_REGS    (IDX_FP_REGS + 16)
 520 #define IDX_MXCSR_REG   (IDX_XMM_REGS + CPU_NB_REGS)
 521
 522 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 523 {
 524     if (n < CPU_NB_REGS) {
 525         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 526             GET_REG64(env->regs[gpr_map[n]]);
 527         } else if (n < CPU_NB_REGS32) {
 528             GET_REG32(env->regs[gpr_map32[n]]);
 529         }
 530     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 531 #ifdef USE_X86LDOUBLE
 532         /* FIXME: byteswap float values - after fixing fpregs layout. */
 533         memcpy(mem_buf, &env->fpregs[n - IDX_FP_REGS], 10);
 534 #else
 535         memset(mem_buf, 0, 10);
 536 #endif
 537         return 10;
 538     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 539         n -= IDX_XMM_REGS;
 540         if (n < CPU_NB_REGS32 ||
 541             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 542             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 543             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 544             return 16;
 545         }
 546     } else {
 547         switch (n) {
 548         case IDX_IP_REG:
 549             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 550                 GET_REG64(env->eip);
 551             } else {
 552                 GET_REG32(env->eip);
 553             }
 554         case IDX_FLAGS_REG: GET_REG32(env->eflags);
 555
 556         case IDX_SEG_REGS:     GET_REG32(env->segs[R_CS].selector);
 557         case IDX_SEG_REGS + 1: GET_REG32(env->segs[R_SS].selector);
 558         case IDX_SEG_REGS + 2: GET_REG32(env->segs[R_DS].selector);
 559         case IDX_SEG_REGS + 3: GET_REG32(env->segs[R_ES].selector);
 560         case IDX_SEG_REGS + 4: GET_REG32(env->segs[R_FS].selector);
 561         case IDX_SEG_REGS + 5: GET_REG32(env->segs[R_GS].selector);
 562
 563         case IDX_FP_REGS + 8:  GET_REG32(env->fpuc);
 564         case IDX_FP_REGS + 9:  GET_REG32((env->fpus & ~0x3800) |
 565                                          (env->fpstt & 0x7) << 11);
 566         case IDX_FP_REGS + 10: GET_REG32(0); /* ftag */
 567         case IDX_FP_REGS + 11: GET_REG32(0); /* fiseg */
 568         case IDX_FP_REGS + 12: GET_REG32(0); /* fioff */
 569         case IDX_FP_REGS + 13: GET_REG32(0); /* foseg */
 570         case IDX_FP_REGS + 14: GET_REG32(0); /* fooff */
 571         case IDX_FP_REGS + 15: GET_REG32(0); /* fop */
 572
 573         case IDX_MXCSR_REG: GET_REG32(env->mxcsr);
 574         }
 575     }
 576     return 0;
 577 }
 578
 579 static int cpu_x86_gdb_load_seg(CPUState *env, int sreg, uint8_t *mem_buf)
 580 {
 581     uint16_t selector = ldl_p(mem_buf);
 582
 583     if (selector != env->segs[sreg].selector) {
 584 #if defined(CONFIG_USER_ONLY)
 585         cpu_x86_load_seg(env, sreg, selector);
 586 #else
 587         unsigned int limit, flags;
 588         target_ulong base;
 589
 590         if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK)) {
 591             base = selector << 4;
 592             limit = 0xffff;
 593             flags = 0;
 594         } else {
 595             if (!cpu_x86_get_descr_debug(env, selector, &base, &limit, &flags))
 596                 return 4;
 597         }
 598         cpu_x86_load_seg_cache(env, sreg, selector, base, limit, flags);
 599 #endif
 600     }
 601     return 4;
 602 }
 603
 604 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 605 {
 606     uint32_t tmp;
 607
 608     if (n < CPU_NB_REGS) {
 609         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 610             env->regs[gpr_map[n]] = ldtul_p(mem_buf);
 611             return sizeof(target_ulong);
 612         } else if (n < CPU_NB_REGS32) {
 613             n = gpr_map32[n];
 614             env->regs[n] &= ~0xffffffffUL;
 615             env->regs[n] |= (uint32_t)ldl_p(mem_buf);
 616             return 4;
 617         }
 618     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 619 #ifdef USE_X86LDOUBLE
 620         /* FIXME: byteswap float values - after fixing fpregs layout. */
 621         memcpy(&env->fpregs[n - IDX_FP_REGS], mem_buf, 10);
 622 #endif
 623         return 10;
 624     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 625         n -= IDX_XMM_REGS;
 626         if (n < CPU_NB_REGS32 ||
 627             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 628             env->xmm_regs[n].XMM_Q(0) = ldq_p(mem_buf);
 629             env->xmm_regs[n].XMM_Q(1) = ldq_p(mem_buf + 8);
 630             return 16;
 631         }
 632     } else {
 633         switch (n) {
 634         case IDX_IP_REG:
 635             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 636                 env->eip = ldq_p(mem_buf);
 637                 return 8;
 638             } else {
 639                 env->eip &= ~0xffffffffUL;
 640                 env->eip |= (uint32_t)ldl_p(mem_buf);
 641                 return 4;
 642             }
 643         case IDX_FLAGS_REG:
 644             env->eflags = ldl_p(mem_buf);
 645             return 4;
 646
 647         case IDX_SEG_REGS:     return cpu_x86_gdb_load_seg(env, R_CS, mem_buf);
 648         case IDX_SEG_REGS + 1: return cpu_x86_gdb_load_seg(env, R_SS, mem_buf);
 649         case IDX_SEG_REGS + 2: return cpu_x86_gdb_load_seg(env, R_DS, mem_buf);
 650         case IDX_SEG_REGS + 3: return cpu_x86_gdb_load_seg(env, R_ES, mem_buf);
 651         case IDX_SEG_REGS + 4: return cpu_x86_gdb_load_seg(env, R_FS, mem_buf);
 652         case IDX_SEG_REGS + 5: return cpu_x86_gdb_load_seg(env, R_GS, mem_buf);
 653
 654         case IDX_FP_REGS + 8:
 655             env->fpuc = ldl_p(mem_buf);
 656             return 4;
 657         case IDX_FP_REGS + 9:
 658             tmp = ldl_p(mem_buf);
 659             env->fpstt = (tmp >> 11) & 7;
 660             env->fpus = tmp & ~0x3800;
 661             return 4;
 662         case IDX_FP_REGS + 10: /* ftag */  return 4;
 663         case IDX_FP_REGS + 11: /* fiseg */ return 4;
 664         case IDX_FP_REGS + 12: /* fioff */ return 4;
 665         case IDX_FP_REGS + 13: /* foseg */ return 4;
 666         case IDX_FP_REGS + 14: /* fooff */ return 4;
 667         case IDX_FP_REGS + 15: /* fop */   return 4;
 668
 669         case IDX_MXCSR_REG:
 670             env->mxcsr = ldl_p(mem_buf);
 671             return 4;
 672         }
 673     }
 674     /* Unrecognised register.  */
 675     return 0;
 676 }
 677
 678 #elif defined (TARGET_PPC)
 679
 680 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 681    expects whatever the target description contains.  Due to a
 682    historical mishap the FP registers appear in between core integer
 683    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 684    FP regs zero size when talking to a newer gdb.  */
 685 #define NUM_CORE_REGS 71
 686 #if defined (TARGET_PPC64)
 687 #define GDB_CORE_XML "power64-core.xml"
 688 #else
 689 #define GDB_CORE_XML "power-core.xml"
 690 #endif
 691
 692 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 693 {
 694     if (n < 32) {
 695         /* gprs */
 696         GET_REGL(env->gpr[n]);
 697     } else if (n < 64) {
 698         /* fprs */
 699         if (gdb_has_xml)
 700             return 0;
 701         stfq_p(mem_buf, env->fpr[n-32]);
 702         return 8;
 703     } else {
 704         switch (n) {
 705         case 64: GET_REGL(env->nip);
 706         case 65: GET_REGL(env->msr);
 707         case 66:
 708             {
 709                 uint32_t cr = 0;
 710                 int i;
 711                 for (i = 0; i < 8; i++)
 712                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 713                 GET_REG32(cr);
 714             }
 715         case 67: GET_REGL(env->lr);
 716         case 68: GET_REGL(env->ctr);
 717         case 69: GET_REGL(env->xer);
 718         case 70:
 719             {
 720                 if (gdb_has_xml)
 721                     return 0;
 722                 GET_REG32(0); /* fpscr */
 723             }
 724         }
 725     }
 726     return 0;
 727 }
 728
 729 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 730 {
 731     if (n < 32) {
 732         /* gprs */
 733         env->gpr[n] = ldtul_p(mem_buf);
 734         return sizeof(target_ulong);
 735     } else if (n < 64) {
 736         /* fprs */
 737         if (gdb_has_xml)
 738             return 0;
 739         env->fpr[n-32] = ldfq_p(mem_buf);
 740         return 8;
 741     } else {
 742         switch (n) {
 743         case 64:
 744             env->nip = ldtul_p(mem_buf);
 745             return sizeof(target_ulong);
 746         case 65:
 747             ppc_store_msr(env, ldtul_p(mem_buf));
 748             return sizeof(target_ulong);
 749         case 66:
 750             {
 751                 uint32_t cr = ldl_p(mem_buf);
 752                 int i;
 753                 for (i = 0; i < 8; i++)
 754                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 755                 return 4;
 756             }
 757         case 67:
 758             env->lr = ldtul_p(mem_buf);
 759             return sizeof(target_ulong);
 760         case 68:
 761             env->ctr = ldtul_p(mem_buf);
 762             return sizeof(target_ulong);
 763         case 69:
 764             env->xer = ldtul_p(mem_buf);
 765             return sizeof(target_ulong);
 766         case 70:
 767             /* fpscr */
 768             if (gdb_has_xml)
 769                 return 0;
 770             return 4;
 771         }
 772     }
 773     return 0;
 774 }
 775
 776 #elif defined (TARGET_SPARC)
 777
 778 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 779 #define NUM_CORE_REGS 86
 780 #else
 781 #define NUM_CORE_REGS 72
 782 #endif
 783
 784 #ifdef TARGET_ABI32
 785 #define GET_REGA(val) GET_REG32(val)
 786 #else
 787 #define GET_REGA(val) GET_REGL(val)
 788 #endif
 789
 790 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 791 {
 792     if (n < 8) {
 793         /* g0..g7 */
 794         GET_REGA(env->gregs[n]);
 795     }
 796     if (n < 32) {
 797         /* register window */
 798         GET_REGA(env->regwptr[n - 8]);
 799     }
 800 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 801     if (n < 64) {
 802         /* fprs */
 803         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 804     }
 805     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 806     switch (n) {
 807     case 64: GET_REGA(env->y);
 808     case 65: GET_REGA(cpu_get_psr(env));
 809     case 66: GET_REGA(env->wim);
 810     case 67: GET_REGA(env->tbr);
 811     case 68: GET_REGA(env->pc);
 812     case 69: GET_REGA(env->npc);
 813     case 70: GET_REGA(env->fsr);
 814     case 71: GET_REGA(0); /* csr */
 815     default: GET_REGA(0);
 816     }
 817 #else
 818     if (n < 64) {
 819         /* f0-f31 */
 820         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 821     }
 822     if (n < 80) {
 823         /* f32-f62 (double width, even numbers only) */
 824         uint64_t val;
 825
 826         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 827         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 828         GET_REG64(val);
 829     }
 830     switch (n) {
 831     case 80: GET_REGL(env->pc);
 832     case 81: GET_REGL(env->npc);
 833     case 82: GET_REGL((cpu_get_ccr(env) << 32) |
 834                       ((env->asi & 0xff) << 24) |
 835                       ((env->pstate & 0xfff) << 8) |
 836                       cpu_get_cwp64(env));
 837     case 83: GET_REGL(env->fsr);
 838     case 84: GET_REGL(env->fprs);
 839     case 85: GET_REGL(env->y);
 840     }
 841 #endif
 842     return 0;
 843 }
 844
 845 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 846 {
 847 #if defined(TARGET_ABI32)
 848     abi_ulong tmp;
 849
 850     tmp = ldl_p(mem_buf);
 851 #else
 852     target_ulong tmp;
 853
 854     tmp = ldtul_p(mem_buf);
 855 #endif
 856
 857     if (n < 8) {
 858         /* g0..g7 */
 859         env->gregs[n] = tmp;
 860     } else if (n < 32) {
 861         /* register window */
 862         env->regwptr[n - 8] = tmp;
 863     }
 864 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 865     else if (n < 64) {
 866         /* fprs */
 867         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 868     } else {
 869         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 870         switch (n) {
 871         case 64: env->y = tmp; break;
 872         case 65: cpu_put_psr(env, tmp); break;
 873         case 66: env->wim = tmp; break;
 874         case 67: env->tbr = tmp; break;
 875         case 68: env->pc = tmp; break;
 876         case 69: env->npc = tmp; break;
 877         case 70: env->fsr = tmp; break;
 878         default: return 0;
 879         }
 880     }
 881     return 4;
 882 #else
 883     else if (n < 64) {
 884         /* f0-f31 */
 885         env->fpr[n] = ldfl_p(mem_buf);
 886         return 4;
 887     } else if (n < 80) {
 888         /* f32-f62 (double width, even numbers only) */
 889         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 890         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 891     } else {
 892         switch (n) {
 893         case 80: env->pc = tmp; break;
 894         case 81: env->npc = tmp; break;
 895         case 82:
 896             cpu_put_ccr(env, tmp >> 32);
 897             env->asi = (tmp >> 24) & 0xff;
 898             env->pstate = (tmp >> 8) & 0xfff;
 899             cpu_put_cwp64(env, tmp & 0xff);
 900             break;
 901         case 83: env->fsr = tmp; break;
 902         case 84: env->fprs = tmp; break;
 903         case 85: env->y = tmp; break;
 904         default: return 0;
 905         }
 906     }
 907     return 8;
 908 #endif
 909 }
 910 #elif defined (TARGET_ARM)
 911
 912 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 913    whatever the target description contains.  Due to a historical mishap
 914    the FPA registers appear in between core integer regs and the CPSR.
 915    We hack round this by giving the FPA regs zero size when talking to a
 916    newer gdb.  */
 917 #define NUM_CORE_REGS 26
 918 #define GDB_CORE_XML "arm-core.xml"
 919
 920 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 921 {
 922     if (n < 16) {
 923         /* Core integer register.  */
 924         GET_REG32(env->regs[n]);
 925     }
 926     if (n < 24) {
 927         /* FPA registers.  */
 928         if (gdb_has_xml)
 929             return 0;
 930         memset(mem_buf, 0, 12);
 931         return 12;
 932     }
 933     switch (n) {
 934     case 24:
 935         /* FPA status register.  */
 936         if (gdb_has_xml)
 937             return 0;
 938         GET_REG32(0);
 939     case 25:
 940         /* CPSR */
 941         GET_REG32(cpsr_read(env));
 942     }
 943     /* Unknown register.  */
 944     return 0;
 945 }
 946
 947 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 948 {
 949     uint32_t tmp;
 950
 951     tmp = ldl_p(mem_buf);
 952
 953     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 954        cause problems if we ever implement the Jazelle DBX extensions.  */
 955     if (n == 15)
 956         tmp &= ~1;
 957
 958     if (n < 16) {
 959         /* Core integer register.  */
 960         env->regs[n] = tmp;
 961         return 4;
 962     }
 963     if (n < 24) { /* 16-23 */
 964         /* FPA registers (ignored).  */
 965         if (gdb_has_xml)
 966             return 0;
 967         return 12;
 968     }
 969     switch (n) {
 970     case 24:
 971         /* FPA status register (ignored).  */
 972         if (gdb_has_xml)
 973             return 0;
 974         return 4;
 975     case 25:
 976         /* CPSR */
 977         cpsr_write (env, tmp, 0xffffffff);
 978         return 4;
 979     }
 980     /* Unknown register.  */
 981     return 0;
 982 }
 983
 984 #elif defined (TARGET_M68K)
 985
 986 #define NUM_CORE_REGS 18
 987
 988 #define GDB_CORE_XML "cf-core.xml"
 989
 990 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 991 {
 992     if (n < 8) {
 993         /* D0-D7 */
 994         GET_REG32(env->dregs[n]);
 995     } else if (n < 16) {
 996         /* A0-A7 */
 997         GET_REG32(env->aregs[n - 8]);
 998     } else {
 999         switch (n) {
1000         case 16: GET_REG32(env->sr);
1001         case 17: GET_REG32(env->pc);
1002         }
1003     }
1004     /* FP registers not included here because they vary between
1005        ColdFire and m68k.  Use XML bits for these.  */
1006     return 0;
1007 }
1008
1009 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1010 {
1011     uint32_t tmp;
1012
1013     tmp = ldl_p(mem_buf);
1014
1015     if (n < 8) {
1016         /* D0-D7 */
1017         env->dregs[n] = tmp;
1018     } else if (n < 16) {
1019         /* A0-A7 */
1020         env->aregs[n - 8] = tmp;
1021     } else {
1022         switch (n) {
1023         case 16: env->sr = tmp; break;
1024         case 17: env->pc = tmp; break;
1025         default: return 0;
1026         }
1027     }
1028     return 4;
1029 }
1030 #elif defined (TARGET_MIPS)
1031
1032 #define NUM_CORE_REGS 73
1033
1034 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1035 {
1036     if (n < 32) {
1037         GET_REGL(env->active_tc.gpr[n]);
1038     }
1039     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
1040         if (n >= 38 && n < 70) {
1041             if (env->CP0_Status & (1 << CP0St_FR))
1042                 GET_REGL(env->active_fpu.fpr[n - 38].d);
1043             else
1044                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
1045         }
1046         switch (n) {
1047         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
1048         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
1049         }
1050     }
1051     switch (n) {
1052     case 32: GET_REGL((int32_t)env->CP0_Status);
1053     case 33: GET_REGL(env->active_tc.LO[0]);
1054     case 34: GET_REGL(env->active_tc.HI[0]);
1055     case 35: GET_REGL(env->CP0_BadVAddr);
1056     case 36: GET_REGL((int32_t)env->CP0_Cause);
1057     case 37: GET_REGL(env->active_tc.PC | !!(env->hflags & MIPS_HFLAG_M16));
1058     case 72: GET_REGL(0); /* fp */
1059     case 89: GET_REGL((int32_t)env->CP0_PRid);
1060     }
1061     if (n >= 73 && n <= 88) {
1062         /* 16 embedded regs.  */
1063         GET_REGL(0);
1064     }
1065
1066     return 0;
1067 }
1068
1069 /* convert MIPS rounding mode in FCR31 to IEEE library */
1070 static unsigned int ieee_rm[] =
1071   {
1072     float_round_nearest_even,
1073     float_round_to_zero,
1074     float_round_up,
1075     float_round_down
1076   };
1077 #define RESTORE_ROUNDING_MODE \
1078     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1079
1080 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1081 {
1082     target_ulong tmp;
1083
1084     tmp = ldtul_p(mem_buf);
1085
1086     if (n < 32) {
1087         env->active_tc.gpr[n] = tmp;
1088         return sizeof(target_ulong);
1089     }
1090     if (env->CP0_Config1 & (1 << CP0C1_FP)
1091             && n >= 38 && n < 73) {
1092         if (n < 70) {
1093             if (env->CP0_Status & (1 << CP0St_FR))
1094               env->active_fpu.fpr[n - 38].d = tmp;
1095             else
1096               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1097         }
1098         switch (n) {
1099         case 70:
1100             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1101             /* set rounding mode */
1102             RESTORE_ROUNDING_MODE;
1103 #ifndef CONFIG_SOFTFLOAT
1104             /* no floating point exception for native float */
1105             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1106 #endif
1107             break;
1108         case 71: env->active_fpu.fcr0 = tmp; break;
1109         }
1110         return sizeof(target_ulong);
1111     }
1112     switch (n) {
1113     case 32: env->CP0_Status = tmp; break;
1114     case 33: env->active_tc.LO[0] = tmp; break;
1115     case 34: env->active_tc.HI[0] = tmp; break;
1116     case 35: env->CP0_BadVAddr = tmp; break;
1117     case 36: env->CP0_Cause = tmp; break;
1118     case 37:
1119         env->active_tc.PC = tmp & ~(target_ulong)1;
1120         if (tmp & 1) {
1121             env->hflags |= MIPS_HFLAG_M16;
1122         } else {
1123             env->hflags &= ~(MIPS_HFLAG_M16);
1124         }
1125         break;
1126     case 72: /* fp, ignored */ break;
1127     default:
1128         if (n > 89)
1129             return 0;
1130         /* Other registers are readonly.  Ignore writes.  */
1131         break;
1132     }
1133
1134     return sizeof(target_ulong);
1135 }
1136 #elif defined (TARGET_SH4)
1137
1138 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1139 /* FIXME: We should use XML for this.  */
1140
1141 #define NUM_CORE_REGS 59
1142
1143 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1144 {
1145     if (n < 8) {
1146         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1147             GET_REGL(env->gregs[n + 16]);
1148         } else {
1149             GET_REGL(env->gregs[n]);
1150         }
1151     } else if (n < 16) {
1152         GET_REGL(env->gregs[n]);
1153     } else if (n >= 25 && n < 41) {
1154         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1155     } else if (n >= 43 && n < 51) {
1156         GET_REGL(env->gregs[n - 43]);
1157     } else if (n >= 51 && n < 59) {
1158         GET_REGL(env->gregs[n - (51 - 16)]);
1159     }
1160     switch (n) {
1161     case 16: GET_REGL(env->pc);
1162     case 17: GET_REGL(env->pr);
1163     case 18: GET_REGL(env->gbr);
1164     case 19: GET_REGL(env->vbr);
1165     case 20: GET_REGL(env->mach);
1166     case 21: GET_REGL(env->macl);
1167     case 22: GET_REGL(env->sr);
1168     case 23: GET_REGL(env->fpul);
1169     case 24: GET_REGL(env->fpscr);
1170     case 41: GET_REGL(env->ssr);
1171     case 42: GET_REGL(env->spc);
1172     }
1173
1174     return 0;
1175 }
1176
1177 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1178 {
1179     uint32_t tmp;
1180
1181     tmp = ldl_p(mem_buf);
1182
1183     if (n < 8) {
1184         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1185             env->gregs[n + 16] = tmp;
1186         } else {
1187             env->gregs[n] = tmp;
1188         }
1189         return 4;
1190     } else if (n < 16) {
1191         env->gregs[n] = tmp;
1192         return 4;
1193     } else if (n >= 25 && n < 41) {
1194         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1195         return 4;
1196     } else if (n >= 43 && n < 51) {
1197         env->gregs[n - 43] = tmp;
1198         return 4;
1199     } else if (n >= 51 && n < 59) {
1200         env->gregs[n - (51 - 16)] = tmp;
1201         return 4;
1202     }
1203     switch (n) {
1204     case 16: env->pc = tmp; break;
1205     case 17: env->pr = tmp; break;
1206     case 18: env->gbr = tmp; break;
1207     case 19: env->vbr = tmp; break;
1208     case 20: env->mach = tmp; break;
1209     case 21: env->macl = tmp; break;
1210     case 22: env->sr = tmp; break;
1211     case 23: env->fpul = tmp; break;
1212     case 24: env->fpscr = tmp; break;
1213     case 41: env->ssr = tmp; break;
1214     case 42: env->spc = tmp; break;
1215     default: return 0;
1216     }
1217
1218     return 4;
1219 }
1220 #elif defined (TARGET_MICROBLAZE)
1221
1222 #define NUM_CORE_REGS (32 + 5)
1223
1224 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1225 {
1226     if (n < 32) {
1227         GET_REG32(env->regs[n]);
1228     } else {
1229         GET_REG32(env->sregs[n - 32]);
1230     }
1231     return 0;
1232 }
1233
1234 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1235 {
1236     uint32_t tmp;
1237
1238     if (n > NUM_CORE_REGS)
1239         return 0;
1240
1241     tmp = ldl_p(mem_buf);
1242
1243     if (n < 32) {
1244         env->regs[n] = tmp;
1245     } else {
1246         env->sregs[n - 32] = tmp;
1247     }
1248     return 4;
1249 }
1250 #elif defined (TARGET_CRIS)
1251
1252 #define NUM_CORE_REGS 49
1253
1254 static int
1255 read_register_crisv10(CPUState *env, uint8_t *mem_buf, int n)
1256 {
1257     if (n < 15) {
1258         GET_REG32(env->regs[n]);
1259     }
1260
1261     if (n == 15) {
1262         GET_REG32(env->pc);
1263     }
1264
1265     if (n < 32) {
1266         switch (n) {
1267         case 16:
1268             GET_REG8(env->pregs[n - 16]);
1269             break;
1270         case 17:
1271             GET_REG8(env->pregs[n - 16]);
1272             break;
1273         case 20:
1274         case 21:
1275             GET_REG16(env->pregs[n - 16]);
1276             break;
1277         default:
1278             if (n >= 23) {
1279                 GET_REG32(env->pregs[n - 16]);
1280             }
1281             break;
1282         }
1283     }
1284     return 0;
1285 }
1286
1287 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1288 {
1289     uint8_t srs;
1290
1291     if (env->pregs[PR_VR] < 32)
1292         return read_register_crisv10(env, mem_buf, n);
1293
1294     srs = env->pregs[PR_SRS];
1295     if (n < 16) {
1296         GET_REG32(env->regs[n]);
1297     }
1298
1299     if (n >= 21 && n < 32) {
1300         GET_REG32(env->pregs[n - 16]);
1301     }
1302     if (n >= 33 && n < 49) {
1303         GET_REG32(env->sregs[srs][n - 33]);
1304     }
1305     switch (n) {
1306     case 16: GET_REG8(env->pregs[0]);
1307     case 17: GET_REG8(env->pregs[1]);
1308     case 18: GET_REG32(env->pregs[2]);
1309     case 19: GET_REG8(srs);
1310     case 20: GET_REG16(env->pregs[4]);
1311     case 32: GET_REG32(env->pc);
1312     }
1313
1314     return 0;
1315 }
1316
1317 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1318 {
1319     uint32_t tmp;
1320
1321     if (n > 49)
1322         return 0;
1323
1324     tmp = ldl_p(mem_buf);
1325
1326     if (n < 16) {
1327         env->regs[n] = tmp;
1328     }
1329
1330     if (n >= 21 && n < 32) {
1331         env->pregs[n - 16] = tmp;
1332     }
1333
1334     /* FIXME: Should support function regs be writable?  */
1335     switch (n) {
1336     case 16: return 1;
1337     case 17: return 1;
1338     case 18: env->pregs[PR_PID] = tmp; break;
1339     case 19: return 1;
1340     case 20: return 2;
1341     case 32: env->pc = tmp; break;
1342     }
1343
1344     return 4;
1345 }
1346 #elif defined (TARGET_ALPHA)
1347
1348 #define NUM_CORE_REGS 67
1349
1350 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1351 {
1352     uint64_t val;
1353     CPU_DoubleU d;
1354
1355     switch (n) {
1356     case 0 ... 30:
1357         val = env->ir[n];
1358         break;
1359     case 32 ... 62:
1360         d.d = env->fir[n - 32];
1361         val = d.ll;
1362         break;
1363     case 63:
1364         val = cpu_alpha_load_fpcr(env);
1365         break;
1366     case 64:
1367         val = env->pc;
1368         break;
1369     case 66:
1370         val = env->unique;
1371         break;
1372     case 31:
1373     case 65:
1374         /* 31 really is the zero register; 65 is unassigned in the
1375            gdb protocol, but is still required to occupy 8 bytes. */
1376         val = 0;
1377         break;
1378     default:
1379         return 0;
1380     }
1381     GET_REGL(val);
1382 }
1383
1384 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1385 {
1386     target_ulong tmp = ldtul_p(mem_buf);
1387     CPU_DoubleU d;
1388
1389     switch (n) {
1390     case 0 ... 30:
1391         env->ir[n] = tmp;
1392         break;
1393     case 32 ... 62:
1394         d.ll = tmp;
1395         env->fir[n - 32] = d.d;
1396         break;
1397     case 63:
1398         cpu_alpha_store_fpcr(env, tmp);
1399         break;
1400     case 64:
1401         env->pc = tmp;
1402         break;
1403     case 66:
1404         env->unique = tmp;
1405         break;
1406     case 31:
1407     case 65:
1408         /* 31 really is the zero register; 65 is unassigned in the
1409            gdb protocol, but is still required to occupy 8 bytes. */
1410         break;
1411     default:
1412         return 0;
1413     }
1414     return 8;
1415 }
1416 #elif defined (TARGET_S390X)
1417
1418 #define NUM_CORE_REGS S390_NUM_TOTAL_REGS
1419
1420 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1421 {
1422     switch (n) {
1423         case S390_PSWM_REGNUM: GET_REGL(env->psw.mask); break;
1424         case S390_PSWA_REGNUM: GET_REGL(env->psw.addr); break;
1425         case S390_R0_REGNUM ... S390_R15_REGNUM:
1426             GET_REGL(env->regs[n-S390_R0_REGNUM]); break;
1427         case S390_A0_REGNUM ... S390_A15_REGNUM:
1428             GET_REG32(env->aregs[n-S390_A0_REGNUM]); break;
1429         case S390_FPC_REGNUM: GET_REG32(env->fpc); break;
1430         case S390_F0_REGNUM ... S390_F15_REGNUM:
1431             /* XXX */
1432             break;
1433         case S390_PC_REGNUM: GET_REGL(env->psw.addr); break;
1434         case S390_CC_REGNUM: GET_REG32(env->cc); break;
1435     }
1436
1437     return 0;
1438 }
1439
1440 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1441 {
1442     target_ulong tmpl;
1443     uint32_t tmp32;
1444     int r = 8;
1445     tmpl = ldtul_p(mem_buf);
1446     tmp32 = ldl_p(mem_buf);
1447
1448     switch (n) {
1449         case S390_PSWM_REGNUM: env->psw.mask = tmpl; break;
1450         case S390_PSWA_REGNUM: env->psw.addr = tmpl; break;
1451         case S390_R0_REGNUM ... S390_R15_REGNUM:
1452             env->regs[n-S390_R0_REGNUM] = tmpl; break;
1453         case S390_A0_REGNUM ... S390_A15_REGNUM:
1454             env->aregs[n-S390_A0_REGNUM] = tmp32; r=4; break;
1455         case S390_FPC_REGNUM: env->fpc = tmp32; r=4; break;
1456         case S390_F0_REGNUM ... S390_F15_REGNUM:
1457             /* XXX */
1458             break;
1459         case S390_PC_REGNUM: env->psw.addr = tmpl; break;
1460         case S390_CC_REGNUM: env->cc = tmp32; r=4; break;
1461     }
1462
1463     return r;
1464 }
1465 #elif defined (TARGET_LM32)
1466
1467 #include "hw/lm32_pic.h"
1468 #define NUM_CORE_REGS (32 + 7)
1469
1470 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1471 {
1472     if (n < 32) {
1473         GET_REG32(env->regs[n]);
1474     } else {
1475         switch (n) {
1476         case 32:
1477             GET_REG32(env->pc);
1478             break;
1479         /* FIXME: put in right exception ID */
1480         case 33:
1481             GET_REG32(0);
1482             break;
1483         case 34:
1484             GET_REG32(env->eba);
1485             break;
1486         case 35:
1487             GET_REG32(env->deba);
1488             break;
1489         case 36:
1490             GET_REG32(env->ie);
1491             break;
1492         case 37:
1493             GET_REG32(lm32_pic_get_im(env->pic_state));
1494             break;
1495         case 38:
1496             GET_REG32(lm32_pic_get_ip(env->pic_state));
1497             break;
1498         }
1499     }
1500     return 0;
1501 }
1502
1503 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1504 {
1505     uint32_t tmp;
1506
1507     if (n > NUM_CORE_REGS) {
1508         return 0;
1509     }
1510
1511     tmp = ldl_p(mem_buf);
1512
1513     if (n < 32) {
1514         env->regs[n] = tmp;
1515     } else {
1516         switch (n) {
1517         case 32:
1518             env->pc = tmp;
1519             break;
1520         case 34:
1521             env->eba = tmp;
1522             break;
1523         case 35:
1524             env->deba = tmp;
1525             break;
1526         case 36:
1527             env->ie = tmp;
1528             break;
1529         case 37:
1530             lm32_pic_set_im(env->pic_state, tmp);
1531             break;
1532         case 38:
1533             lm32_pic_set_ip(env->pic_state, tmp);
1534             break;
1535         }
1536     }
1537     return 4;
1538 }
1539 #else
1540
1541 #define NUM_CORE_REGS 0
1542
1543 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1544 {
1545     return 0;
1546 }
1547
1548 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1549 {
1550     return 0;
1551 }
1552
1553 #endif
1554
1555 static int num_g_regs = NUM_CORE_REGS;
1556
1557 #ifdef GDB_CORE_XML
1558 /* Encode data using the encoding for 'x' packets.  */
1559 static int memtox(char *buf, const char *mem, int len)
1560 {
1561     char *p = buf;
1562     char c;
1563
1564     while (len--) {
1565         c = *(mem++);
1566         switch (c) {
1567         case '#': case '$': case '*': case '}':
1568             *(p++) = '}';
1569             *(p++) = c ^ 0x20;
1570             break;
1571         default:
1572             *(p++) = c;
1573             break;
1574         }
1575     }
1576     return p - buf;
1577 }
1578
1579 static const char *get_feature_xml(const char *p, const char **newp)
1580 {
1581     size_t len;
1582     int i;
1583     const char *name;
1584     static char target_xml[1024];
1585
1586     len = 0;
1587     while (p[len] && p[len] != ':')
1588         len++;
1589     *newp = p + len;
1590
1591     name = NULL;
1592     if (strncmp(p, "target.xml", len) == 0) {
1593         /* Generate the XML description for this CPU.  */
1594         if (!target_xml[0]) {
1595             GDBRegisterState *r;
1596
1597             snprintf(target_xml, sizeof(target_xml),
1598                      "<?xml version=\"1.0\"?>"
1599                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1600                      "<target>"
1601                      "<xi:include href=\"%s\"/>",
1602                      GDB_CORE_XML);
1603
1604             for (r = first_cpu->gdb_regs; r; r = r->next) {
1605                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
1606                 pstrcat(target_xml, sizeof(target_xml), r->xml);
1607                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
1608             }
1609             pstrcat(target_xml, sizeof(target_xml), "</target>");
1610         }
1611         return target_xml;
1612     }
1613     for (i = 0; ; i++) {
1614         name = xml_builtin[i][0];
1615         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1616             break;
1617     }
1618     return name ? xml_builtin[i][1] : NULL;
1619 }
1620 #endif
1621
1622 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1623 {
1624     GDBRegisterState *r;
1625
1626     if (reg < NUM_CORE_REGS)
1627         return cpu_gdb_read_register(env, mem_buf, reg);
1628
1629     for (r = env->gdb_regs; r; r = r->next) {
1630         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1631             return r->get_reg(env, mem_buf, reg - r->base_reg);
1632         }
1633     }
1634     return 0;
1635 }
1636
1637 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1638 {
1639     GDBRegisterState *r;
1640
1641     if (reg < NUM_CORE_REGS)
1642         return cpu_gdb_write_register(env, mem_buf, reg);
1643
1644     for (r = env->gdb_regs; r; r = r->next) {
1645         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1646             return r->set_reg(env, mem_buf, reg - r->base_reg);
1647         }
1648     }
1649     return 0;
1650 }
1651
1652 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1653    specifies the first register number and these registers are included in
1654    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1655    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1656  */
1657
1658 void gdb_register_coprocessor(CPUState * env,
1659                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1660                              int num_regs, const char *xml, int g_pos)
1661 {
1662     GDBRegisterState *s;
1663     GDBRegisterState **p;
1664     static int last_reg = NUM_CORE_REGS;
1665
1666     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1667     s->base_reg = last_reg;
1668     s->num_regs = num_regs;
1669     s->get_reg = get_reg;
1670     s->set_reg = set_reg;
1671     s->xml = xml;
1672     p = &env->gdb_regs;
1673     while (*p) {
1674         /* Check for duplicates.  */
1675         if (strcmp((*p)->xml, xml) == 0)
1676             return;
1677         p = &(*p)->next;
1678     }
1679     /* Add to end of list.  */
1680     last_reg += num_regs;
1681     *p = s;
1682     if (g_pos) {
1683         if (g_pos != s->base_reg) {
1684             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1685                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1686         } else {
1687             num_g_regs = last_reg;
1688         }
1689     }
1690 }
1691
1692 #ifndef CONFIG_USER_ONLY
1693 static const int xlat_gdb_type[] = {
1694     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1695     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1696     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1697 };
1698 #endif
1699
1700 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1701 {
1702     CPUState *env;
1703     int err = 0;
1704
1705     if (kvm_enabled())
1706         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1707
1708     switch (type) {
1709     case GDB_BREAKPOINT_SW:
1710     case GDB_BREAKPOINT_HW:
1711         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1712             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1713             if (err)
1714                 break;
1715         }
1716         return err;
1717 #ifndef CONFIG_USER_ONLY
1718     case GDB_WATCHPOINT_WRITE:
1719     case GDB_WATCHPOINT_READ:
1720     case GDB_WATCHPOINT_ACCESS:
1721         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1722             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1723                                         NULL);
1724             if (err)
1725                 break;
1726         }
1727         return err;
1728 #endif
1729     default:
1730         return -ENOSYS;
1731     }
1732 }
1733
1734 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1735 {
1736     CPUState *env;
1737     int err = 0;
1738
1739     if (kvm_enabled())
1740         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1741
1742     switch (type) {
1743     case GDB_BREAKPOINT_SW:
1744     case GDB_BREAKPOINT_HW:
1745         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1746             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1747             if (err)
1748                 break;
1749         }
1750         return err;
1751 #ifndef CONFIG_USER_ONLY
1752     case GDB_WATCHPOINT_WRITE:
1753     case GDB_WATCHPOINT_READ:
1754     case GDB_WATCHPOINT_ACCESS:
1755         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1756             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1757             if (err)
1758                 break;
1759         }
1760         return err;
1761 #endif
1762     default:
1763         return -ENOSYS;
1764     }
1765 }
1766
1767 static void gdb_breakpoint_remove_all(void)
1768 {
1769     CPUState *env;
1770
1771     if (kvm_enabled()) {
1772         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1773         return;
1774     }
1775
1776     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1777         cpu_breakpoint_remove_all(env, BP_GDB);
1778 #ifndef CONFIG_USER_ONLY
1779         cpu_watchpoint_remove_all(env, BP_GDB);
1780 #endif
1781     }
1782 }
1783
1784 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1785 {
1786 #if defined(TARGET_I386)
1787     cpu_synchronize_state(s->c_cpu);
1788     s->c_cpu->eip = pc;
1789 #elif defined (TARGET_PPC)
1790     s->c_cpu->nip = pc;
1791 #elif defined (TARGET_SPARC)
1792     s->c_cpu->pc = pc;
1793     s->c_cpu->npc = pc + 4;
1794 #elif defined (TARGET_ARM)
1795     s->c_cpu->regs[15] = pc;
1796 #elif defined (TARGET_SH4)
1797     s->c_cpu->pc = pc;
1798 #elif defined (TARGET_MIPS)
1799     s->c_cpu->active_tc.PC = pc & ~(target_ulong)1;
1800     if (pc & 1) {
1801         s->c_cpu->hflags |= MIPS_HFLAG_M16;
1802     } else {
1803         s->c_cpu->hflags &= ~(MIPS_HFLAG_M16);
1804     }
1805 #elif defined (TARGET_MICROBLAZE)
1806     s->c_cpu->sregs[SR_PC] = pc;
1807 #elif defined (TARGET_CRIS)
1808     s->c_cpu->pc = pc;
1809 #elif defined (TARGET_ALPHA)
1810     s->c_cpu->pc = pc;
1811 #elif defined (TARGET_S390X)
1812     cpu_synchronize_state(s->c_cpu);
1813     s->c_cpu->psw.addr = pc;
1814 #elif defined (TARGET_LM32)
1815     s->c_cpu->pc = pc;
1816 #endif
1817 }
1818
1819 static inline int gdb_id(CPUState *env)
1820 {
1821 #if defined(CONFIG_USER_ONLY) && defined(CONFIG_USE_NPTL)
1822     return env->host_tid;
1823 #else
1824     return env->cpu_index + 1;
1825 #endif
1826 }
1827
1828 static CPUState *find_cpu(uint32_t thread_id)
1829 {
1830     CPUState *env;
1831
1832     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1833         if (gdb_id(env) == thread_id) {
1834             return env;
1835         }
1836     }
1837
1838     return NULL;
1839 }
1840
1841 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1842 {
1843     CPUState *env;
1844     const char *p;
1845     uint32_t thread;
1846     int ch, reg_size, type, res;
1847     char buf[MAX_PACKET_LENGTH];
1848     uint8_t mem_buf[MAX_PACKET_LENGTH];
1849     uint8_t *registers;
1850     target_ulong addr, len;
1851
1852 #ifdef DEBUG_GDB
1853     printf("command='%s'\n", line_buf);
1854 #endif
1855     p = line_buf;
1856     ch = *p++;
1857     switch(ch) {
1858     case '?':
1859         /* TODO: Make this return the correct value for user-mode.  */
1860         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1861                  gdb_id(s->c_cpu));
1862         put_packet(s, buf);
1863         /* Remove all the breakpoints when this query is issued,
1864          * because gdb is doing and initial connect and the state
1865          * should be cleaned up.
1866          */
1867         gdb_breakpoint_remove_all();
1868         break;
1869     case 'c':
1870         if (*p != '\0') {
1871             addr = strtoull(p, (char **)&p, 16);
1872             gdb_set_cpu_pc(s, addr);
1873         }
1874         s->signal = 0;
1875         gdb_continue(s);
1876         return RS_IDLE;
1877     case 'C':
1878         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1879         if (s->signal == -1)
1880             s->signal = 0;
1881         gdb_continue(s);
1882         return RS_IDLE;
1883     case 'v':
1884         if (strncmp(p, "Cont", 4) == 0) {
1885             int res_signal, res_thread;
1886
1887             p += 4;
1888             if (*p == '?') {
1889                 put_packet(s, "vCont;c;C;s;S");
1890                 break;
1891             }
1892             res = 0;
1893             res_signal = 0;
1894             res_thread = 0;
1895             while (*p) {
1896                 int action, signal;
1897
1898                 if (*p++ != ';') {
1899                     res = 0;
1900                     break;
1901                 }
1902                 action = *p++;
1903                 signal = 0;
1904                 if (action == 'C' || action == 'S') {
1905                     signal = strtoul(p, (char **)&p, 16);
1906                 } else if (action != 'c' && action != 's') {
1907                     res = 0;
1908                     break;
1909                 }
1910                 thread = 0;
1911                 if (*p == ':') {
1912                     thread = strtoull(p+1, (char **)&p, 16);
1913                 }
1914                 action = tolower(action);
1915                 if (res == 0 || (res == 'c' && action == 's')) {
1916                     res = action;
1917                     res_signal = signal;
1918                     res_thread = thread;
1919                 }
1920             }
1921             if (res) {
1922                 if (res_thread != -1 && res_thread != 0) {
1923                     env = find_cpu(res_thread);
1924                     if (env == NULL) {
1925                         put_packet(s, "E22");
1926                         break;
1927                     }
1928                     s->c_cpu = env;
1929                 }
1930                 if (res == 's') {
1931                     cpu_single_step(s->c_cpu, sstep_flags);
1932                 }
1933                 s->signal = res_signal;
1934                 gdb_continue(s);
1935                 return RS_IDLE;
1936             }
1937             break;
1938         } else {
1939             goto unknown_command;
1940         }
1941     case 'k':
1942         /* Kill the target */
1943         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1944         exit(0);
1945     case 'D':
1946         /* Detach packet */
1947         gdb_breakpoint_remove_all();
1948         gdb_syscall_mode = GDB_SYS_DISABLED;
1949         gdb_continue(s);
1950         put_packet(s, "OK");
1951         break;
1952     case 's':
1953         if (*p != '\0') {
1954             addr = strtoull(p, (char **)&p, 16);
1955             gdb_set_cpu_pc(s, addr);
1956         }
1957         cpu_single_step(s->c_cpu, sstep_flags);
1958         gdb_continue(s);
1959         return RS_IDLE;
1960     case 'F':
1961         {
1962             target_ulong ret;
1963             target_ulong err;
1964
1965             ret = strtoull(p, (char **)&p, 16);
1966             if (*p == ',') {
1967                 p++;
1968                 err = strtoull(p, (char **)&p, 16);
1969             } else {
1970                 err = 0;
1971             }
1972             if (*p == ',')
1973                 p++;
1974             type = *p;
1975             if (gdb_current_syscall_cb)
1976                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1977             if (type == 'C') {
1978                 put_packet(s, "T02");
1979             } else {
1980                 gdb_continue(s);
1981             }
1982         }
1983         break;
1984     case 'g':
1985         cpu_synchronize_state(s->g_cpu);
1986         len = 0;
1987         for (addr = 0; addr < num_g_regs; addr++) {
1988             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1989             len += reg_size;
1990         }
1991         memtohex(buf, mem_buf, len);
1992         put_packet(s, buf);
1993         break;
1994     case 'G':
1995         cpu_synchronize_state(s->g_cpu);
1996         registers = mem_buf;
1997         len = strlen(p) / 2;
1998         hextomem((uint8_t *)registers, p, len);
1999         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
2000             reg_size = gdb_write_register(s->g_cpu, registers, addr);
2001             len -= reg_size;
2002             registers += reg_size;
2003         }
2004         put_packet(s, "OK");
2005         break;
2006     case 'm':
2007         addr = strtoull(p, (char **)&p, 16);
2008         if (*p == ',')
2009             p++;
2010         len = strtoull(p, NULL, 16);
2011         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
2012             put_packet (s, "E14");
2013         } else {
2014             memtohex(buf, mem_buf, len);
2015             put_packet(s, buf);
2016         }
2017         break;
2018     case 'M':
2019         addr = strtoull(p, (char **)&p, 16);
2020         if (*p == ',')
2021             p++;
2022         len = strtoull(p, (char **)&p, 16);
2023         if (*p == ':')
2024             p++;
2025         hextomem(mem_buf, p, len);
2026         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
2027             put_packet(s, "E14");
2028         else
2029             put_packet(s, "OK");
2030         break;
2031     case 'p':
2032         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
2033            This works, but can be very slow.  Anything new enough to
2034            understand XML also knows how to use this properly.  */
2035         if (!gdb_has_xml)
2036             goto unknown_command;
2037         addr = strtoull(p, (char **)&p, 16);
2038         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
2039         if (reg_size) {
2040             memtohex(buf, mem_buf, reg_size);
2041             put_packet(s, buf);
2042         } else {
2043             put_packet(s, "E14");
2044         }
2045         break;
2046     case 'P':
2047         if (!gdb_has_xml)
2048             goto unknown_command;
2049         addr = strtoull(p, (char **)&p, 16);
2050         if (*p == '=')
2051             p++;
2052         reg_size = strlen(p) / 2;
2053         hextomem(mem_buf, p, reg_size);
2054         gdb_write_register(s->g_cpu, mem_buf, addr);
2055         put_packet(s, "OK");
2056         break;
2057     case 'Z':
2058     case 'z':
2059         type = strtoul(p, (char **)&p, 16);
2060         if (*p == ',')
2061             p++;
2062         addr = strtoull(p, (char **)&p, 16);
2063         if (*p == ',')
2064             p++;
2065         len = strtoull(p, (char **)&p, 16);
2066         if (ch == 'Z')
2067             res = gdb_breakpoint_insert(addr, len, type);
2068         else
2069             res = gdb_breakpoint_remove(addr, len, type);
2070         if (res >= 0)
2071              put_packet(s, "OK");
2072         else if (res == -ENOSYS)
2073             put_packet(s, "");
2074         else
2075             put_packet(s, "E22");
2076         break;
2077     case 'H':
2078         type = *p++;
2079         thread = strtoull(p, (char **)&p, 16);
2080         if (thread == -1 || thread == 0) {
2081             put_packet(s, "OK");
2082             break;
2083         }
2084         env = find_cpu(thread);
2085         if (env == NULL) {
2086             put_packet(s, "E22");
2087             break;
2088         }
2089         switch (type) {
2090         case 'c':
2091             s->c_cpu = env;
2092             put_packet(s, "OK");
2093             break;
2094         case 'g':
2095             s->g_cpu = env;
2096             put_packet(s, "OK");
2097             break;
2098         default:
2099              put_packet(s, "E22");
2100              break;
2101         }
2102         break;
2103     case 'T':
2104         thread = strtoull(p, (char **)&p, 16);
2105         env = find_cpu(thread);
2106
2107         if (env != NULL) {
2108             put_packet(s, "OK");
2109         } else {
2110             put_packet(s, "E22");
2111         }
2112         break;
2113     case 'q':
2114     case 'Q':
2115         /* parse any 'q' packets here */
2116         if (!strcmp(p,"qemu.sstepbits")) {
2117             /* Query Breakpoint bit definitions */
2118             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
2119                      SSTEP_ENABLE,
2120                      SSTEP_NOIRQ,
2121                      SSTEP_NOTIMER);
2122             put_packet(s, buf);
2123             break;
2124         } else if (strncmp(p,"qemu.sstep",10) == 0) {
2125             /* Display or change the sstep_flags */
2126             p += 10;
2127             if (*p != '=') {
2128                 /* Display current setting */
2129                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
2130                 put_packet(s, buf);
2131                 break;
2132             }
2133             p++;
2134             type = strtoul(p, (char **)&p, 16);
2135             sstep_flags = type;
2136             put_packet(s, "OK");
2137             break;
2138         } else if (strcmp(p,"C") == 0) {
2139             /* "Current thread" remains vague in the spec, so always return
2140              *  the first CPU (gdb returns the first thread). */
2141             put_packet(s, "QC1");
2142             break;
2143         } else if (strcmp(p,"fThreadInfo") == 0) {
2144             s->query_cpu = first_cpu;
2145             goto report_cpuinfo;
2146         } else if (strcmp(p,"sThreadInfo") == 0) {
2147         report_cpuinfo:
2148             if (s->query_cpu) {
2149                 snprintf(buf, sizeof(buf), "m%x", gdb_id(s->query_cpu));
2150                 put_packet(s, buf);
2151                 s->query_cpu = s->query_cpu->next_cpu;
2152             } else
2153                 put_packet(s, "l");
2154             break;
2155         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
2156             thread = strtoull(p+16, (char **)&p, 16);
2157             env = find_cpu(thread);
2158             if (env != NULL) {
2159                 cpu_synchronize_state(env);
2160                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
2161                                "CPU#%d [%s]", env->cpu_index,
2162                                env->halted ? "halted " : "running");
2163                 memtohex(buf, mem_buf, len);
2164                 put_packet(s, buf);
2165             }
2166             break;
2167         }
2168 #ifdef CONFIG_USER_ONLY
2169         else if (strncmp(p, "Offsets", 7) == 0) {
2170             TaskState *ts = s->c_cpu->opaque;
2171
2172             snprintf(buf, sizeof(buf),
2173                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
2174                      ";Bss=" TARGET_ABI_FMT_lx,
2175                      ts->info->code_offset,
2176                      ts->info->data_offset,
2177                      ts->info->data_offset);
2178             put_packet(s, buf);
2179             break;
2180         }
2181 #else /* !CONFIG_USER_ONLY */
2182         else if (strncmp(p, "Rcmd,", 5) == 0) {
2183             int len = strlen(p + 5);
2184
2185             if ((len % 2) != 0) {
2186                 put_packet(s, "E01");
2187                 break;
2188             }
2189             hextomem(mem_buf, p + 5, len);
2190             len = len / 2;
2191             mem_buf[len++] = 0;
2192             qemu_chr_read(s->mon_chr, mem_buf, len);
2193             put_packet(s, "OK");
2194             break;
2195         }
2196 #endif /* !CONFIG_USER_ONLY */
2197         if (strncmp(p, "Supported", 9) == 0) {
2198             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
2199 #ifdef GDB_CORE_XML
2200             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
2201 #endif
2202             put_packet(s, buf);
2203             break;
2204         }
2205 #ifdef GDB_CORE_XML
2206         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
2207             const char *xml;
2208             target_ulong total_len;
2209
2210             gdb_has_xml = 1;
2211             p += 19;
2212             xml = get_feature_xml(p, &p);
2213             if (!xml) {
2214                 snprintf(buf, sizeof(buf), "E00");
2215                 put_packet(s, buf);
2216                 break;
2217             }
2218
2219             if (*p == ':')
2220                 p++;
2221             addr = strtoul(p, (char **)&p, 16);
2222             if (*p == ',')
2223                 p++;
2224             len = strtoul(p, (char **)&p, 16);
2225
2226             total_len = strlen(xml);
2227             if (addr > total_len) {
2228                 snprintf(buf, sizeof(buf), "E00");
2229                 put_packet(s, buf);
2230                 break;
2231             }
2232             if (len > (MAX_PACKET_LENGTH - 5) / 2)
2233                 len = (MAX_PACKET_LENGTH - 5) / 2;
2234             if (len < total_len - addr) {
2235                 buf[0] = 'm';
2236                 len = memtox(buf + 1, xml + addr, len);
2237             } else {
2238                 buf[0] = 'l';
2239                 len = memtox(buf + 1, xml + addr, total_len - addr);
2240             }
2241             put_packet_binary(s, buf, len + 1);
2242             break;
2243         }
2244 #endif
2245         /* Unrecognised 'q' command.  */
2246         goto unknown_command;
2247
2248     default:
2249     unknown_command:
2250         /* put empty packet */
2251         buf[0] = '\0';
2252         put_packet(s, buf);
2253         break;
2254     }
2255     return RS_IDLE;
2256 }
2257
2258 void gdb_set_stop_cpu(CPUState *env)
2259 {
2260     gdbserver_state->c_cpu = env;
2261     gdbserver_state->g_cpu = env;
2262 }
2263
2264 #ifndef CONFIG_USER_ONLY
2265 static void gdb_vm_state_change(void *opaque, int running, int reason)
2266 {
2267     GDBState *s = gdbserver_state;
2268     CPUState *env = s->c_cpu;
2269     char buf[256];
2270     const char *type;
2271     int ret;
2272
2273     if (running || (reason != VMSTOP_DEBUG && reason != VMSTOP_USER) ||
2274         s->state == RS_INACTIVE || s->state == RS_SYSCALL) {
2275         return;
2276     }
2277     /* disable single step if it was enable */
2278     cpu_single_step(env, 0);
2279
2280     if (reason == VMSTOP_DEBUG) {
2281         if (env->watchpoint_hit) {
2282             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
2283             case BP_MEM_READ:
2284                 type = "r";
2285                 break;
2286             case BP_MEM_ACCESS:
2287                 type = "a";
2288                 break;
2289             default:
2290                 type = "";
2291                 break;
2292             }
2293             snprintf(buf, sizeof(buf),
2294                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
2295                      GDB_SIGNAL_TRAP, gdb_id(env), type,
2296                      env->watchpoint_hit->vaddr);
2297             put_packet(s, buf);
2298             env->watchpoint_hit = NULL;
2299             return;
2300         }
2301         tb_flush(env);
2302         ret = GDB_SIGNAL_TRAP;
2303     } else {
2304         ret = GDB_SIGNAL_INT;
2305     }
2306     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, gdb_id(env));
2307     put_packet(s, buf);
2308 }
2309 #endif
2310
2311 /* Send a gdb syscall request.
2312    This accepts limited printf-style format specifiers, specifically:
2313     %x  - target_ulong argument printed in hex.
2314     %lx - 64-bit argument printed in hex.
2315     %s  - string pointer (target_ulong) and length (int) pair.  */
2316 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
2317 {
2318     va_list va;
2319     char buf[256];
2320     char *p;
2321     target_ulong addr;
2322     uint64_t i64;
2323     GDBState *s;
2324
2325     s = gdbserver_state;
2326     if (!s)
2327         return;
2328     gdb_current_syscall_cb = cb;
2329     s->state = RS_SYSCALL;
2330 #ifndef CONFIG_USER_ONLY
2331     vm_stop(VMSTOP_DEBUG);
2332 #endif
2333     s->state = RS_IDLE;
2334     va_start(va, fmt);
2335     p = buf;
2336     *(p++) = 'F';
2337     while (*fmt) {
2338         if (*fmt == '%') {
2339             fmt++;
2340             switch (*fmt++) {
2341             case 'x':
2342                 addr = va_arg(va, target_ulong);
2343                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
2344                 break;
2345             case 'l':
2346                 if (*(fmt++) != 'x')
2347                     goto bad_format;
2348                 i64 = va_arg(va, uint64_t);
2349                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
2350                 break;
2351             case 's':
2352                 addr = va_arg(va, target_ulong);
2353                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
2354                               addr, va_arg(va, int));
2355                 break;
2356             default:
2357             bad_format:
2358                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2359                         fmt - 1);
2360                 break;
2361             }
2362         } else {
2363             *(p++) = *(fmt++);
2364         }
2365     }
2366     *p = 0;
2367     va_end(va);
2368     put_packet(s, buf);
2369 #ifdef CONFIG_USER_ONLY
2370     gdb_handlesig(s->c_cpu, 0);
2371 #else
2372     cpu_exit(s->c_cpu);
2373 #endif
2374 }
2375
2376 static void gdb_read_byte(GDBState *s, int ch)
2377 {
2378     int i, csum;
2379     uint8_t reply;
2380
2381 #ifndef CONFIG_USER_ONLY
2382     if (s->last_packet_len) {
2383         /* Waiting for a response to the last packet.  If we see the start
2384            of a new command then abandon the previous response.  */
2385         if (ch == '-') {
2386 #ifdef DEBUG_GDB
2387             printf("Got NACK, retransmitting\n");
2388 #endif
2389             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2390         }
2391 #ifdef DEBUG_GDB
2392         else if (ch == '+')
2393             printf("Got ACK\n");
2394         else
2395             printf("Got '%c' when expecting ACK/NACK\n", ch);
2396 #endif
2397         if (ch == '+' || ch == '$')
2398             s->last_packet_len = 0;
2399         if (ch != '$')
2400             return;
2401     }
2402     if (vm_running) {
2403         /* when the CPU is running, we cannot do anything except stop
2404            it when receiving a char */
2405         vm_stop(VMSTOP_USER);
2406     } else
2407 #endif
2408     {
2409         switch(s->state) {
2410         case RS_IDLE:
2411             if (ch == '$') {
2412                 s->line_buf_index = 0;
2413                 s->state = RS_GETLINE;
2414             }
2415             break;
2416         case RS_GETLINE:
2417             if (ch == '#') {
2418             s->state = RS_CHKSUM1;
2419             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2420                 s->state = RS_IDLE;
2421             } else {
2422             s->line_buf[s->line_buf_index++] = ch;
2423             }
2424             break;
2425         case RS_CHKSUM1:
2426             s->line_buf[s->line_buf_index] = '\0';
2427             s->line_csum = fromhex(ch) << 4;
2428             s->state = RS_CHKSUM2;
2429             break;
2430         case RS_CHKSUM2:
2431             s->line_csum |= fromhex(ch);
2432             csum = 0;
2433             for(i = 0; i < s->line_buf_index; i++) {
2434                 csum += s->line_buf[i];
2435             }
2436             if (s->line_csum != (csum & 0xff)) {
2437                 reply = '-';
2438                 put_buffer(s, &reply, 1);
2439                 s->state = RS_IDLE;
2440             } else {
2441                 reply = '+';
2442                 put_buffer(s, &reply, 1);
2443                 s->state = gdb_handle_packet(s, s->line_buf);
2444             }
2445             break;
2446         default:
2447             abort();
2448         }
2449     }
2450 }
2451
2452 /* Tell the remote gdb that the process has exited.  */
2453 void gdb_exit(CPUState *env, int code)
2454 {
2455   GDBState *s;
2456   char buf[4];
2457
2458   s = gdbserver_state;
2459   if (!s) {
2460       return;
2461   }
2462 #ifdef CONFIG_USER_ONLY
2463   if (gdbserver_fd < 0 || s->fd < 0) {
2464       return;
2465   }
2466 #endif
2467
2468   snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
2469   put_packet(s, buf);
2470
2471 #ifndef CONFIG_USER_ONLY
2472   if (s->chr) {
2473       qemu_chr_close(s->chr);
2474   }
2475 #endif
2476 }
2477
2478 #ifdef CONFIG_USER_ONLY
2479 int
2480 gdb_queuesig (void)
2481 {
2482     GDBState *s;
2483
2484     s = gdbserver_state;
2485
2486     if (gdbserver_fd < 0 || s->fd < 0)
2487         return 0;
2488     else
2489         return 1;
2490 }
2491
2492 int
2493 gdb_handlesig (CPUState *env, int sig)
2494 {
2495   GDBState *s;
2496   char buf[256];
2497   int n;
2498
2499   s = gdbserver_state;
2500   if (gdbserver_fd < 0 || s->fd < 0)
2501     return sig;
2502
2503   /* disable single step if it was enabled */
2504   cpu_single_step(env, 0);
2505   tb_flush(env);
2506
2507   if (sig != 0)
2508     {
2509       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2510       put_packet(s, buf);
2511     }
2512   /* put_packet() might have detected that the peer terminated the
2513      connection.  */
2514   if (s->fd < 0)
2515       return sig;
2516
2517   sig = 0;
2518   s->state = RS_IDLE;
2519   s->running_state = 0;
2520   while (s->running_state == 0) {
2521       n = read (s->fd, buf, 256);
2522       if (n > 0)
2523         {
2524           int i;
2525
2526           for (i = 0; i < n; i++)
2527             gdb_read_byte (s, buf[i]);
2528         }
2529       else if (n == 0 || errno != EAGAIN)
2530         {
2531           /* XXX: Connection closed.  Should probably wait for annother
2532              connection before continuing.  */
2533           return sig;
2534         }
2535   }
2536   sig = s->signal;
2537   s->signal = 0;
2538   return sig;
2539 }
2540
2541 /* Tell the remote gdb that the process has exited due to SIG.  */
2542 void gdb_signalled(CPUState *env, int sig)
2543 {
2544   GDBState *s;
2545   char buf[4];
2546
2547   s = gdbserver_state;
2548   if (gdbserver_fd < 0 || s->fd < 0)
2549     return;
2550
2551   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2552   put_packet(s, buf);
2553 }
2554
2555 static void gdb_accept(void)
2556 {
2557     GDBState *s;
2558     struct sockaddr_in sockaddr;
2559     socklen_t len;
2560     int val, fd;
2561
2562     for(;;) {
2563         len = sizeof(sockaddr);
2564         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2565         if (fd < 0 && errno != EINTR) {
2566             perror("accept");
2567             return;
2568         } else if (fd >= 0) {
2569 #ifndef _WIN32
2570             fcntl(fd, F_SETFD, FD_CLOEXEC);
2571 #endif
2572             break;
2573         }
2574     }
2575
2576     /* set short latency */
2577     val = 1;
2578     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2579
2580     s = qemu_mallocz(sizeof(GDBState));
2581     s->c_cpu = first_cpu;
2582     s->g_cpu = first_cpu;
2583     s->fd = fd;
2584     gdb_has_xml = 0;
2585
2586     gdbserver_state = s;
2587
2588     fcntl(fd, F_SETFL, O_NONBLOCK);
2589 }
2590
2591 static int gdbserver_open(int port)
2592 {
2593     struct sockaddr_in sockaddr;
2594     int fd, val, ret;
2595
2596     fd = socket(PF_INET, SOCK_STREAM, 0);
2597     if (fd < 0) {
2598         perror("socket");
2599         return -1;
2600     }
2601 #ifndef _WIN32
2602     fcntl(fd, F_SETFD, FD_CLOEXEC);
2603 #endif
2604
2605     /* allow fast reuse */
2606     val = 1;
2607     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2608
2609     sockaddr.sin_family = AF_INET;
2610     sockaddr.sin_port = htons(port);
2611     sockaddr.sin_addr.s_addr = 0;
2612     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2613     if (ret < 0) {
2614         perror("bind");
2615         return -1;
2616     }
2617     ret = listen(fd, 0);
2618     if (ret < 0) {
2619         perror("listen");
2620         return -1;
2621     }
2622     return fd;
2623 }
2624
2625 int gdbserver_start(int port)
2626 {
2627     gdbserver_fd = gdbserver_open(port);
2628     if (gdbserver_fd < 0)
2629         return -1;
2630     /* accept connections */
2631     gdb_accept();
2632     return 0;
2633 }
2634
2635 /* Disable gdb stub for child processes.  */
2636 void gdbserver_fork(CPUState *env)
2637 {
2638     GDBState *s = gdbserver_state;
2639     if (gdbserver_fd < 0 || s->fd < 0)
2640       return;
2641     close(s->fd);
2642     s->fd = -1;
2643     cpu_breakpoint_remove_all(env, BP_GDB);
2644     cpu_watchpoint_remove_all(env, BP_GDB);
2645 }
2646 #else
2647 static int gdb_chr_can_receive(void *opaque)
2648 {
2649   /* We can handle an arbitrarily large amount of data.
2650    Pick the maximum packet size, which is as good as anything.  */
2651   return MAX_PACKET_LENGTH;
2652 }
2653
2654 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2655 {
2656     int i;
2657
2658     for (i = 0; i < size; i++) {
2659         gdb_read_byte(gdbserver_state, buf[i]);
2660     }
2661 }
2662
2663 static void gdb_chr_event(void *opaque, int event)
2664 {
2665     switch (event) {
2666     case CHR_EVENT_OPENED:
2667         vm_stop(VMSTOP_USER);
2668         gdb_has_xml = 0;
2669         break;
2670     default:
2671         break;
2672     }
2673 }
2674
2675 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2676 {
2677     char buf[MAX_PACKET_LENGTH];
2678
2679     buf[0] = 'O';
2680     if (len > (MAX_PACKET_LENGTH/2) - 1)
2681         len = (MAX_PACKET_LENGTH/2) - 1;
2682     memtohex(buf + 1, (uint8_t *)msg, len);
2683     put_packet(s, buf);
2684 }
2685
2686 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2687 {
2688     const char *p = (const char *)buf;
2689     int max_sz;
2690
2691     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2692     for (;;) {
2693         if (len <= max_sz) {
2694             gdb_monitor_output(gdbserver_state, p, len);
2695             break;
2696         }
2697         gdb_monitor_output(gdbserver_state, p, max_sz);
2698         p += max_sz;
2699         len -= max_sz;
2700     }
2701     return len;
2702 }
2703
2704 #ifndef _WIN32
2705 static void gdb_sigterm_handler(int signal)
2706 {
2707     if (vm_running) {
2708         vm_stop(VMSTOP_USER);
2709     }
2710 }
2711 #endif
2712
2713 int gdbserver_start(const char *device)
2714 {
2715     GDBState *s;
2716     char gdbstub_device_name[128];
2717     CharDriverState *chr = NULL;
2718     CharDriverState *mon_chr;
2719
2720     if (!device)
2721         return -1;
2722     if (strcmp(device, "none") != 0) {
2723         if (strstart(device, "tcp:", NULL)) {
2724             /* enforce required TCP attributes */
2725             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2726                      "%s,nowait,nodelay,server", device);
2727             device = gdbstub_device_name;
2728         }
2729 #ifndef _WIN32
2730         else if (strcmp(device, "stdio") == 0) {
2731             struct sigaction act;
2732
2733             memset(&act, 0, sizeof(act));
2734             act.sa_handler = gdb_sigterm_handler;
2735             sigaction(SIGINT, &act, NULL);
2736         }
2737 #endif
2738         chr = qemu_chr_open("gdb", device, NULL);
2739         if (!chr)
2740             return -1;
2741
2742         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2743                               gdb_chr_event, NULL);
2744     }
2745
2746     s = gdbserver_state;
2747     if (!s) {
2748         s = qemu_mallocz(sizeof(GDBState));
2749         gdbserver_state = s;
2750
2751         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2752
2753         /* Initialize a monitor terminal for gdb */
2754         mon_chr = qemu_mallocz(sizeof(*mon_chr));
2755         mon_chr->chr_write = gdb_monitor_write;
2756         monitor_init(mon_chr, 0);
2757     } else {
2758         if (s->chr)
2759             qemu_chr_close(s->chr);
2760         mon_chr = s->mon_chr;
2761         memset(s, 0, sizeof(GDBState));
2762     }
2763     s->c_cpu = first_cpu;
2764     s->g_cpu = first_cpu;
2765     s->chr = chr;
2766     s->state = chr ? RS_IDLE : RS_INACTIVE;
2767     s->mon_chr = mon_chr;
2768
2769     return 0;
2770 }
2771 #endif