gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "qemu-common.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "monitor.h"
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #endif
  37
  38 #define MAX_PACKET_LENGTH 4096
  39
  40 #include "qemu_socket.h"
  41 #include "kvm.h"
  42
  43
  44 enum {
  45     GDB_SIGNAL_0 = 0,
  46     GDB_SIGNAL_INT = 2,
  47     GDB_SIGNAL_TRAP = 5,
  48     GDB_SIGNAL_UNKNOWN = 143
  49 };
  50
  51 #ifdef CONFIG_USER_ONLY
  52
  53 /* Map target signal numbers to GDB protocol signal numbers and vice
  54  * versa.  For user emulation's currently supported systems, we can
  55  * assume most signals are defined.
  56  */
  57
  58 static int gdb_signal_table[] = {
  59     0,
  60     TARGET_SIGHUP,
  61     TARGET_SIGINT,
  62     TARGET_SIGQUIT,
  63     TARGET_SIGILL,
  64     TARGET_SIGTRAP,
  65     TARGET_SIGABRT,
  66     -1, /* SIGEMT */
  67     TARGET_SIGFPE,
  68     TARGET_SIGKILL,
  69     TARGET_SIGBUS,
  70     TARGET_SIGSEGV,
  71     TARGET_SIGSYS,
  72     TARGET_SIGPIPE,
  73     TARGET_SIGALRM,
  74     TARGET_SIGTERM,
  75     TARGET_SIGURG,
  76     TARGET_SIGSTOP,
  77     TARGET_SIGTSTP,
  78     TARGET_SIGCONT,
  79     TARGET_SIGCHLD,
  80     TARGET_SIGTTIN,
  81     TARGET_SIGTTOU,
  82     TARGET_SIGIO,
  83     TARGET_SIGXCPU,
  84     TARGET_SIGXFSZ,
  85     TARGET_SIGVTALRM,
  86     TARGET_SIGPROF,
  87     TARGET_SIGWINCH,
  88     -1, /* SIGLOST */
  89     TARGET_SIGUSR1,
  90     TARGET_SIGUSR2,
  91 #ifdef TARGET_SIGPWR
  92     TARGET_SIGPWR,
  93 #else
  94     -1,
  95 #endif
  96     -1, /* SIGPOLL */
  97     -1,
  98     -1,
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108 #ifdef __SIGRTMIN
 109     __SIGRTMIN + 1,
 110     __SIGRTMIN + 2,
 111     __SIGRTMIN + 3,
 112     __SIGRTMIN + 4,
 113     __SIGRTMIN + 5,
 114     __SIGRTMIN + 6,
 115     __SIGRTMIN + 7,
 116     __SIGRTMIN + 8,
 117     __SIGRTMIN + 9,
 118     __SIGRTMIN + 10,
 119     __SIGRTMIN + 11,
 120     __SIGRTMIN + 12,
 121     __SIGRTMIN + 13,
 122     __SIGRTMIN + 14,
 123     __SIGRTMIN + 15,
 124     __SIGRTMIN + 16,
 125     __SIGRTMIN + 17,
 126     __SIGRTMIN + 18,
 127     __SIGRTMIN + 19,
 128     __SIGRTMIN + 20,
 129     __SIGRTMIN + 21,
 130     __SIGRTMIN + 22,
 131     __SIGRTMIN + 23,
 132     __SIGRTMIN + 24,
 133     __SIGRTMIN + 25,
 134     __SIGRTMIN + 26,
 135     __SIGRTMIN + 27,
 136     __SIGRTMIN + 28,
 137     __SIGRTMIN + 29,
 138     __SIGRTMIN + 30,
 139     __SIGRTMIN + 31,
 140     -1, /* SIGCANCEL */
 141     __SIGRTMIN,
 142     __SIGRTMIN + 32,
 143     __SIGRTMIN + 33,
 144     __SIGRTMIN + 34,
 145     __SIGRTMIN + 35,
 146     __SIGRTMIN + 36,
 147     __SIGRTMIN + 37,
 148     __SIGRTMIN + 38,
 149     __SIGRTMIN + 39,
 150     __SIGRTMIN + 40,
 151     __SIGRTMIN + 41,
 152     __SIGRTMIN + 42,
 153     __SIGRTMIN + 43,
 154     __SIGRTMIN + 44,
 155     __SIGRTMIN + 45,
 156     __SIGRTMIN + 46,
 157     __SIGRTMIN + 47,
 158     __SIGRTMIN + 48,
 159     __SIGRTMIN + 49,
 160     __SIGRTMIN + 50,
 161     __SIGRTMIN + 51,
 162     __SIGRTMIN + 52,
 163     __SIGRTMIN + 53,
 164     __SIGRTMIN + 54,
 165     __SIGRTMIN + 55,
 166     __SIGRTMIN + 56,
 167     __SIGRTMIN + 57,
 168     __SIGRTMIN + 58,
 169     __SIGRTMIN + 59,
 170     __SIGRTMIN + 60,
 171     __SIGRTMIN + 61,
 172     __SIGRTMIN + 62,
 173     __SIGRTMIN + 63,
 174     __SIGRTMIN + 64,
 175     __SIGRTMIN + 65,
 176     __SIGRTMIN + 66,
 177     __SIGRTMIN + 67,
 178     __SIGRTMIN + 68,
 179     __SIGRTMIN + 69,
 180     __SIGRTMIN + 70,
 181     __SIGRTMIN + 71,
 182     __SIGRTMIN + 72,
 183     __SIGRTMIN + 73,
 184     __SIGRTMIN + 74,
 185     __SIGRTMIN + 75,
 186     __SIGRTMIN + 76,
 187     __SIGRTMIN + 77,
 188     __SIGRTMIN + 78,
 189     __SIGRTMIN + 79,
 190     __SIGRTMIN + 80,
 191     __SIGRTMIN + 81,
 192     __SIGRTMIN + 82,
 193     __SIGRTMIN + 83,
 194     __SIGRTMIN + 84,
 195     __SIGRTMIN + 85,
 196     __SIGRTMIN + 86,
 197     __SIGRTMIN + 87,
 198     __SIGRTMIN + 88,
 199     __SIGRTMIN + 89,
 200     __SIGRTMIN + 90,
 201     __SIGRTMIN + 91,
 202     __SIGRTMIN + 92,
 203     __SIGRTMIN + 93,
 204     __SIGRTMIN + 94,
 205     __SIGRTMIN + 95,
 206     -1, /* SIGINFO */
 207     -1, /* UNKNOWN */
 208     -1, /* DEFAULT */
 209     -1,
 210     -1,
 211     -1,
 212     -1,
 213     -1,
 214     -1
 215 #endif
 216 };
 217 #else
 218 /* In system mode we only need SIGINT and SIGTRAP; other signals
 219    are not yet supported.  */
 220
 221 enum {
 222     TARGET_SIGINT = 2,
 223     TARGET_SIGTRAP = 5
 224 };
 225
 226 static int gdb_signal_table[] = {
 227     -1,
 228     -1,
 229     TARGET_SIGINT,
 230     -1,
 231     -1,
 232     TARGET_SIGTRAP
 233 };
 234 #endif
 235
 236 #ifdef CONFIG_USER_ONLY
 237 static int target_signal_to_gdb (int sig)
 238 {
 239     int i;
 240     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 241         if (gdb_signal_table[i] == sig)
 242             return i;
 243     return GDB_SIGNAL_UNKNOWN;
 244 }
 245 #endif
 246
 247 static int gdb_signal_to_target (int sig)
 248 {
 249     if (sig < ARRAY_SIZE (gdb_signal_table))
 250         return gdb_signal_table[sig];
 251     else
 252         return -1;
 253 }
 254
 255 //#define DEBUG_GDB
 256
 257 typedef struct GDBRegisterState {
 258     int base_reg;
 259     int num_regs;
 260     gdb_reg_cb get_reg;
 261     gdb_reg_cb set_reg;
 262     const char *xml;
 263     struct GDBRegisterState *next;
 264 } GDBRegisterState;
 265
 266 enum RSState {
 267     RS_INACTIVE,
 268     RS_IDLE,
 269     RS_GETLINE,
 270     RS_CHKSUM1,
 271     RS_CHKSUM2,
 272     RS_SYSCALL,
 273 };
 274 typedef struct GDBState {
 275     CPUState *c_cpu; /* current CPU for step/continue ops */
 276     CPUState *g_cpu; /* current CPU for other ops */
 277     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 278     enum RSState state; /* parsing state */
 279     char line_buf[MAX_PACKET_LENGTH];
 280     int line_buf_index;
 281     int line_csum;
 282     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 283     int last_packet_len;
 284     int signal;
 285 #ifdef CONFIG_USER_ONLY
 286     int fd;
 287     int running_state;
 288 #else
 289     CharDriverState *chr;
 290     CharDriverState *mon_chr;
 291 #endif
 292 } GDBState;
 293
 294 /* By default use no IRQs and no timers while single stepping so as to
 295  * make single stepping like an ICE HW step.
 296  */
 297 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 298
 299 static GDBState *gdbserver_state;
 300
 301 /* This is an ugly hack to cope with both new and old gdb.
 302    If gdb sends qXfer:features:read then assume we're talking to a newish
 303    gdb that understands target descriptions.  */
 304 static int gdb_has_xml;
 305
 306 #ifdef CONFIG_USER_ONLY
 307 /* XXX: This is not thread safe.  Do we care?  */
 308 static int gdbserver_fd = -1;
 309
 310 static int get_char(GDBState *s)
 311 {
 312     uint8_t ch;
 313     int ret;
 314
 315     for(;;) {
 316         ret = recv(s->fd, &ch, 1, 0);
 317         if (ret < 0) {
 318             if (errno == ECONNRESET)
 319                 s->fd = -1;
 320             if (errno != EINTR && errno != EAGAIN)
 321                 return -1;
 322         } else if (ret == 0) {
 323             close(s->fd);
 324             s->fd = -1;
 325             return -1;
 326         } else {
 327             break;
 328         }
 329     }
 330     return ch;
 331 }
 332 #endif
 333
 334 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 335
 336 static enum {
 337     GDB_SYS_UNKNOWN,
 338     GDB_SYS_ENABLED,
 339     GDB_SYS_DISABLED,
 340 } gdb_syscall_mode;
 341
 342 /* If gdb is connected when the first semihosting syscall occurs then use
 343    remote gdb syscalls.  Otherwise use native file IO.  */
 344 int use_gdb_syscalls(void)
 345 {
 346     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 347         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 348                                             : GDB_SYS_DISABLED);
 349     }
 350     return gdb_syscall_mode == GDB_SYS_ENABLED;
 351 }
 352
 353 /* Resume execution.  */
 354 static inline void gdb_continue(GDBState *s)
 355 {
 356 #ifdef CONFIG_USER_ONLY
 357     s->running_state = 1;
 358 #else
 359     vm_start();
 360 #endif
 361 }
 362
 363 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 364 {
 365 #ifdef CONFIG_USER_ONLY
 366     int ret;
 367
 368     while (len > 0) {
 369         ret = send(s->fd, buf, len, 0);
 370         if (ret < 0) {
 371             if (errno != EINTR && errno != EAGAIN)
 372                 return;
 373         } else {
 374             buf += ret;
 375             len -= ret;
 376         }
 377     }
 378 #else
 379     qemu_chr_write(s->chr, buf, len);
 380 #endif
 381 }
 382
 383 static inline int fromhex(int v)
 384 {
 385     if (v >= '0' && v <= '9')
 386         return v - '0';
 387     else if (v >= 'A' && v <= 'F')
 388         return v - 'A' + 10;
 389     else if (v >= 'a' && v <= 'f')
 390         return v - 'a' + 10;
 391     else
 392         return 0;
 393 }
 394
 395 static inline int tohex(int v)
 396 {
 397     if (v < 10)
 398         return v + '0';
 399     else
 400         return v - 10 + 'a';
 401 }
 402
 403 static void memtohex(char *buf, const uint8_t *mem, int len)
 404 {
 405     int i, c;
 406     char *q;
 407     q = buf;
 408     for(i = 0; i < len; i++) {
 409         c = mem[i];
 410         *q++ = tohex(c >> 4);
 411         *q++ = tohex(c & 0xf);
 412     }
 413     *q = '\0';
 414 }
 415
 416 static void hextomem(uint8_t *mem, const char *buf, int len)
 417 {
 418     int i;
 419
 420     for(i = 0; i < len; i++) {
 421         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 422         buf += 2;
 423     }
 424 }
 425
 426 /* return -1 if error, 0 if OK */
 427 static int put_packet_binary(GDBState *s, const char *buf, int len)
 428 {
 429     int csum, i;
 430     uint8_t *p;
 431
 432     for(;;) {
 433         p = s->last_packet;
 434         *(p++) = '$';
 435         memcpy(p, buf, len);
 436         p += len;
 437         csum = 0;
 438         for(i = 0; i < len; i++) {
 439             csum += buf[i];
 440         }
 441         *(p++) = '#';
 442         *(p++) = tohex((csum >> 4) & 0xf);
 443         *(p++) = tohex((csum) & 0xf);
 444
 445         s->last_packet_len = p - s->last_packet;
 446         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 447
 448 #ifdef CONFIG_USER_ONLY
 449         i = get_char(s);
 450         if (i < 0)
 451             return -1;
 452         if (i == '+')
 453             break;
 454 #else
 455         break;
 456 #endif
 457     }
 458     return 0;
 459 }
 460
 461 /* return -1 if error, 0 if OK */
 462 static int put_packet(GDBState *s, const char *buf)
 463 {
 464 #ifdef DEBUG_GDB
 465     printf("reply='%s'\n", buf);
 466 #endif
 467
 468     return put_packet_binary(s, buf, strlen(buf));
 469 }
 470
 471 /* The GDB remote protocol transfers values in target byte order.  This means
 472    we can use the raw memory access routines to access the value buffer.
 473    Conveniently, these also handle the case where the buffer is mis-aligned.
 474  */
 475 #define GET_REG8(val) do { \
 476     stb_p(mem_buf, val); \
 477     return 1; \
 478     } while(0)
 479 #define GET_REG16(val) do { \
 480     stw_p(mem_buf, val); \
 481     return 2; \
 482     } while(0)
 483 #define GET_REG32(val) do { \
 484     stl_p(mem_buf, val); \
 485     return 4; \
 486     } while(0)
 487 #define GET_REG64(val) do { \
 488     stq_p(mem_buf, val); \
 489     return 8; \
 490     } while(0)
 491
 492 #if TARGET_LONG_BITS == 64
 493 #define GET_REGL(val) GET_REG64(val)
 494 #define ldtul_p(addr) ldq_p(addr)
 495 #else
 496 #define GET_REGL(val) GET_REG32(val)
 497 #define ldtul_p(addr) ldl_p(addr)
 498 #endif
 499
 500 #if defined(TARGET_I386)
 501
 502 #ifdef TARGET_X86_64
 503 static const int gpr_map[16] = {
 504     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 505     8, 9, 10, 11, 12, 13, 14, 15
 506 };
 507 #else
 508 #define gpr_map gpr_map32
 509 #endif
 510 static const int gpr_map32[8] = { 0, 1, 2, 3, 4, 5, 6, 7 };
 511
 512 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 513
 514 #define IDX_IP_REG      CPU_NB_REGS
 515 #define IDX_FLAGS_REG   (IDX_IP_REG + 1)
 516 #define IDX_SEG_REGS    (IDX_FLAGS_REG + 1)
 517 #define IDX_FP_REGS     (IDX_SEG_REGS + 6)
 518 #define IDX_XMM_REGS    (IDX_FP_REGS + 16)
 519 #define IDX_MXCSR_REG   (IDX_XMM_REGS + CPU_NB_REGS)
 520
 521 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 522 {
 523     if (n < CPU_NB_REGS) {
 524         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 525             GET_REG64(env->regs[gpr_map[n]]);
 526         } else if (n < CPU_NB_REGS32) {
 527             GET_REG32(env->regs[gpr_map32[n]]);
 528         }
 529     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 530 #ifdef USE_X86LDOUBLE
 531         /* FIXME: byteswap float values - after fixing fpregs layout. */
 532         memcpy(mem_buf, &env->fpregs[n - IDX_FP_REGS], 10);
 533 #else
 534         memset(mem_buf, 0, 10);
 535 #endif
 536         return 10;
 537     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 538         n -= IDX_XMM_REGS;
 539         if (n < CPU_NB_REGS32 ||
 540             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 541             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 542             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 543             return 16;
 544         }
 545     } else {
 546         switch (n) {
 547         case IDX_IP_REG:
 548             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 549                 GET_REG64(env->eip);
 550             } else {
 551                 GET_REG32(env->eip);
 552             }
 553         case IDX_FLAGS_REG: GET_REG32(env->eflags);
 554
 555         case IDX_SEG_REGS:     GET_REG32(env->segs[R_CS].selector);
 556         case IDX_SEG_REGS + 1: GET_REG32(env->segs[R_SS].selector);
 557         case IDX_SEG_REGS + 2: GET_REG32(env->segs[R_DS].selector);
 558         case IDX_SEG_REGS + 3: GET_REG32(env->segs[R_ES].selector);
 559         case IDX_SEG_REGS + 4: GET_REG32(env->segs[R_FS].selector);
 560         case IDX_SEG_REGS + 5: GET_REG32(env->segs[R_GS].selector);
 561
 562         case IDX_FP_REGS + 8:  GET_REG32(env->fpuc);
 563         case IDX_FP_REGS + 9:  GET_REG32((env->fpus & ~0x3800) |
 564                                          (env->fpstt & 0x7) << 11);
 565         case IDX_FP_REGS + 10: GET_REG32(0); /* ftag */
 566         case IDX_FP_REGS + 11: GET_REG32(0); /* fiseg */
 567         case IDX_FP_REGS + 12: GET_REG32(0); /* fioff */
 568         case IDX_FP_REGS + 13: GET_REG32(0); /* foseg */
 569         case IDX_FP_REGS + 14: GET_REG32(0); /* fooff */
 570         case IDX_FP_REGS + 15: GET_REG32(0); /* fop */
 571
 572         case IDX_MXCSR_REG: GET_REG32(env->mxcsr);
 573         }
 574     }
 575     return 0;
 576 }
 577
 578 static int cpu_x86_gdb_load_seg(CPUState *env, int sreg, uint8_t *mem_buf)
 579 {
 580     uint16_t selector = ldl_p(mem_buf);
 581
 582     if (selector != env->segs[sreg].selector) {
 583 #if defined(CONFIG_USER_ONLY)
 584         cpu_x86_load_seg(env, sreg, selector);
 585 #else
 586         unsigned int limit, flags;
 587         target_ulong base;
 588
 589         if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK)) {
 590             base = selector << 4;
 591             limit = 0xffff;
 592             flags = 0;
 593         } else {
 594             if (!cpu_x86_get_descr_debug(env, selector, &base, &limit, &flags))
 595                 return 4;
 596         }
 597         cpu_x86_load_seg_cache(env, sreg, selector, base, limit, flags);
 598 #endif
 599     }
 600     return 4;
 601 }
 602
 603 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 604 {
 605     uint32_t tmp;
 606
 607     if (n < CPU_NB_REGS) {
 608         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 609             env->regs[gpr_map[n]] = ldtul_p(mem_buf);
 610             return sizeof(target_ulong);
 611         } else if (n < CPU_NB_REGS32) {
 612             n = gpr_map32[n];
 613             env->regs[n] &= ~0xffffffffUL;
 614             env->regs[n] |= (uint32_t)ldl_p(mem_buf);
 615             return 4;
 616         }
 617     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 618 #ifdef USE_X86LDOUBLE
 619         /* FIXME: byteswap float values - after fixing fpregs layout. */
 620         memcpy(&env->fpregs[n - IDX_FP_REGS], mem_buf, 10);
 621 #endif
 622         return 10;
 623     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 624         n -= IDX_XMM_REGS;
 625         if (n < CPU_NB_REGS32 ||
 626             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 627             env->xmm_regs[n].XMM_Q(0) = ldq_p(mem_buf);
 628             env->xmm_regs[n].XMM_Q(1) = ldq_p(mem_buf + 8);
 629             return 16;
 630         }
 631     } else {
 632         switch (n) {
 633         case IDX_IP_REG:
 634             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 635                 env->eip = ldq_p(mem_buf);
 636                 return 8;
 637             } else {
 638                 env->eip &= ~0xffffffffUL;
 639                 env->eip |= (uint32_t)ldl_p(mem_buf);
 640                 return 4;
 641             }
 642         case IDX_FLAGS_REG:
 643             env->eflags = ldl_p(mem_buf);
 644             return 4;
 645
 646         case IDX_SEG_REGS:     return cpu_x86_gdb_load_seg(env, R_CS, mem_buf);
 647         case IDX_SEG_REGS + 1: return cpu_x86_gdb_load_seg(env, R_SS, mem_buf);
 648         case IDX_SEG_REGS + 2: return cpu_x86_gdb_load_seg(env, R_DS, mem_buf);
 649         case IDX_SEG_REGS + 3: return cpu_x86_gdb_load_seg(env, R_ES, mem_buf);
 650         case IDX_SEG_REGS + 4: return cpu_x86_gdb_load_seg(env, R_FS, mem_buf);
 651         case IDX_SEG_REGS + 5: return cpu_x86_gdb_load_seg(env, R_GS, mem_buf);
 652
 653         case IDX_FP_REGS + 8:
 654             env->fpuc = ldl_p(mem_buf);
 655             return 4;
 656         case IDX_FP_REGS + 9:
 657             tmp = ldl_p(mem_buf);
 658             env->fpstt = (tmp >> 11) & 7;
 659             env->fpus = tmp & ~0x3800;
 660             return 4;
 661         case IDX_FP_REGS + 10: /* ftag */  return 4;
 662         case IDX_FP_REGS + 11: /* fiseg */ return 4;
 663         case IDX_FP_REGS + 12: /* fioff */ return 4;
 664         case IDX_FP_REGS + 13: /* foseg */ return 4;
 665         case IDX_FP_REGS + 14: /* fooff */ return 4;
 666         case IDX_FP_REGS + 15: /* fop */   return 4;
 667
 668         case IDX_MXCSR_REG:
 669             env->mxcsr = ldl_p(mem_buf);
 670             return 4;
 671         }
 672     }
 673     /* Unrecognised register.  */
 674     return 0;
 675 }
 676
 677 #elif defined (TARGET_PPC)
 678
 679 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 680    expects whatever the target description contains.  Due to a
 681    historical mishap the FP registers appear in between core integer
 682    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 683    FP regs zero size when talking to a newer gdb.  */
 684 #define NUM_CORE_REGS 71
 685 #if defined (TARGET_PPC64)
 686 #define GDB_CORE_XML "power64-core.xml"
 687 #else
 688 #define GDB_CORE_XML "power-core.xml"
 689 #endif
 690
 691 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 692 {
 693     if (n < 32) {
 694         /* gprs */
 695         GET_REGL(env->gpr[n]);
 696     } else if (n < 64) {
 697         /* fprs */
 698         if (gdb_has_xml)
 699             return 0;
 700         stfq_p(mem_buf, env->fpr[n-32]);
 701         return 8;
 702     } else {
 703         switch (n) {
 704         case 64: GET_REGL(env->nip);
 705         case 65: GET_REGL(env->msr);
 706         case 66:
 707             {
 708                 uint32_t cr = 0;
 709                 int i;
 710                 for (i = 0; i < 8; i++)
 711                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 712                 GET_REG32(cr);
 713             }
 714         case 67: GET_REGL(env->lr);
 715         case 68: GET_REGL(env->ctr);
 716         case 69: GET_REGL(env->xer);
 717         case 70:
 718             {
 719                 if (gdb_has_xml)
 720                     return 0;
 721                 GET_REG32(0); /* fpscr */
 722             }
 723         }
 724     }
 725     return 0;
 726 }
 727
 728 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 729 {
 730     if (n < 32) {
 731         /* gprs */
 732         env->gpr[n] = ldtul_p(mem_buf);
 733         return sizeof(target_ulong);
 734     } else if (n < 64) {
 735         /* fprs */
 736         if (gdb_has_xml)
 737             return 0;
 738         env->fpr[n-32] = ldfq_p(mem_buf);
 739         return 8;
 740     } else {
 741         switch (n) {
 742         case 64:
 743             env->nip = ldtul_p(mem_buf);
 744             return sizeof(target_ulong);
 745         case 65:
 746             ppc_store_msr(env, ldtul_p(mem_buf));
 747             return sizeof(target_ulong);
 748         case 66:
 749             {
 750                 uint32_t cr = ldl_p(mem_buf);
 751                 int i;
 752                 for (i = 0; i < 8; i++)
 753                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 754                 return 4;
 755             }
 756         case 67:
 757             env->lr = ldtul_p(mem_buf);
 758             return sizeof(target_ulong);
 759         case 68:
 760             env->ctr = ldtul_p(mem_buf);
 761             return sizeof(target_ulong);
 762         case 69:
 763             env->xer = ldtul_p(mem_buf);
 764             return sizeof(target_ulong);
 765         case 70:
 766             /* fpscr */
 767             if (gdb_has_xml)
 768                 return 0;
 769             return 4;
 770         }
 771     }
 772     return 0;
 773 }
 774
 775 #elif defined (TARGET_SPARC)
 776
 777 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 778 #define NUM_CORE_REGS 86
 779 #else
 780 #define NUM_CORE_REGS 72
 781 #endif
 782
 783 #ifdef TARGET_ABI32
 784 #define GET_REGA(val) GET_REG32(val)
 785 #else
 786 #define GET_REGA(val) GET_REGL(val)
 787 #endif
 788
 789 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 790 {
 791     if (n < 8) {
 792         /* g0..g7 */
 793         GET_REGA(env->gregs[n]);
 794     }
 795     if (n < 32) {
 796         /* register window */
 797         GET_REGA(env->regwptr[n - 8]);
 798     }
 799 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 800     if (n < 64) {
 801         /* fprs */
 802         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 803     }
 804     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 805     switch (n) {
 806     case 64: GET_REGA(env->y);
 807     case 65: GET_REGA(cpu_get_psr(env));
 808     case 66: GET_REGA(env->wim);
 809     case 67: GET_REGA(env->tbr);
 810     case 68: GET_REGA(env->pc);
 811     case 69: GET_REGA(env->npc);
 812     case 70: GET_REGA(env->fsr);
 813     case 71: GET_REGA(0); /* csr */
 814     default: GET_REGA(0);
 815     }
 816 #else
 817     if (n < 64) {
 818         /* f0-f31 */
 819         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 820     }
 821     if (n < 80) {
 822         /* f32-f62 (double width, even numbers only) */
 823         uint64_t val;
 824
 825         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 826         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 827         GET_REG64(val);
 828     }
 829     switch (n) {
 830     case 80: GET_REGL(env->pc);
 831     case 81: GET_REGL(env->npc);
 832     case 82: GET_REGL((cpu_get_ccr(env) << 32) |
 833                       ((env->asi & 0xff) << 24) |
 834                       ((env->pstate & 0xfff) << 8) |
 835                       cpu_get_cwp64(env));
 836     case 83: GET_REGL(env->fsr);
 837     case 84: GET_REGL(env->fprs);
 838     case 85: GET_REGL(env->y);
 839     }
 840 #endif
 841     return 0;
 842 }
 843
 844 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 845 {
 846 #if defined(TARGET_ABI32)
 847     abi_ulong tmp;
 848
 849     tmp = ldl_p(mem_buf);
 850 #else
 851     target_ulong tmp;
 852
 853     tmp = ldtul_p(mem_buf);
 854 #endif
 855
 856     if (n < 8) {
 857         /* g0..g7 */
 858         env->gregs[n] = tmp;
 859     } else if (n < 32) {
 860         /* register window */
 861         env->regwptr[n - 8] = tmp;
 862     }
 863 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 864     else if (n < 64) {
 865         /* fprs */
 866         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 867     } else {
 868         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 869         switch (n) {
 870         case 64: env->y = tmp; break;
 871         case 65: cpu_put_psr(env, tmp); break;
 872         case 66: env->wim = tmp; break;
 873         case 67: env->tbr = tmp; break;
 874         case 68: env->pc = tmp; break;
 875         case 69: env->npc = tmp; break;
 876         case 70: env->fsr = tmp; break;
 877         default: return 0;
 878         }
 879     }
 880     return 4;
 881 #else
 882     else if (n < 64) {
 883         /* f0-f31 */
 884         env->fpr[n] = ldfl_p(mem_buf);
 885         return 4;
 886     } else if (n < 80) {
 887         /* f32-f62 (double width, even numbers only) */
 888         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 889         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 890     } else {
 891         switch (n) {
 892         case 80: env->pc = tmp; break;
 893         case 81: env->npc = tmp; break;
 894         case 82:
 895             cpu_put_ccr(env, tmp >> 32);
 896             env->asi = (tmp >> 24) & 0xff;
 897             env->pstate = (tmp >> 8) & 0xfff;
 898             cpu_put_cwp64(env, tmp & 0xff);
 899             break;
 900         case 83: env->fsr = tmp; break;
 901         case 84: env->fprs = tmp; break;
 902         case 85: env->y = tmp; break;
 903         default: return 0;
 904         }
 905     }
 906     return 8;
 907 #endif
 908 }
 909 #elif defined (TARGET_ARM)
 910
 911 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 912    whatever the target description contains.  Due to a historical mishap
 913    the FPA registers appear in between core integer regs and the CPSR.
 914    We hack round this by giving the FPA regs zero size when talking to a
 915    newer gdb.  */
 916 #define NUM_CORE_REGS 26
 917 #define GDB_CORE_XML "arm-core.xml"
 918
 919 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 920 {
 921     if (n < 16) {
 922         /* Core integer register.  */
 923         GET_REG32(env->regs[n]);
 924     }
 925     if (n < 24) {
 926         /* FPA registers.  */
 927         if (gdb_has_xml)
 928             return 0;
 929         memset(mem_buf, 0, 12);
 930         return 12;
 931     }
 932     switch (n) {
 933     case 24:
 934         /* FPA status register.  */
 935         if (gdb_has_xml)
 936             return 0;
 937         GET_REG32(0);
 938     case 25:
 939         /* CPSR */
 940         GET_REG32(cpsr_read(env));
 941     }
 942     /* Unknown register.  */
 943     return 0;
 944 }
 945
 946 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 947 {
 948     uint32_t tmp;
 949
 950     tmp = ldl_p(mem_buf);
 951
 952     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 953        cause problems if we ever implement the Jazelle DBX extensions.  */
 954     if (n == 15)
 955         tmp &= ~1;
 956
 957     if (n < 16) {
 958         /* Core integer register.  */
 959         env->regs[n] = tmp;
 960         return 4;
 961     }
 962     if (n < 24) { /* 16-23 */
 963         /* FPA registers (ignored).  */
 964         if (gdb_has_xml)
 965             return 0;
 966         return 12;
 967     }
 968     switch (n) {
 969     case 24:
 970         /* FPA status register (ignored).  */
 971         if (gdb_has_xml)
 972             return 0;
 973         return 4;
 974     case 25:
 975         /* CPSR */
 976         cpsr_write (env, tmp, 0xffffffff);
 977         return 4;
 978     }
 979     /* Unknown register.  */
 980     return 0;
 981 }
 982
 983 #elif defined (TARGET_M68K)
 984
 985 #define NUM_CORE_REGS 18
 986
 987 #define GDB_CORE_XML "cf-core.xml"
 988
 989 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 990 {
 991     if (n < 8) {
 992         /* D0-D7 */
 993         GET_REG32(env->dregs[n]);
 994     } else if (n < 16) {
 995         /* A0-A7 */
 996         GET_REG32(env->aregs[n - 8]);
 997     } else {
 998         switch (n) {
 999         case 16: GET_REG32(env->sr);
1000         case 17: GET_REG32(env->pc);
1001         }
1002     }
1003     /* FP registers not included here because they vary between
1004        ColdFire and m68k.  Use XML bits for these.  */
1005     return 0;
1006 }
1007
1008 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1009 {
1010     uint32_t tmp;
1011
1012     tmp = ldl_p(mem_buf);
1013
1014     if (n < 8) {
1015         /* D0-D7 */
1016         env->dregs[n] = tmp;
1017     } else if (n < 16) {
1018         /* A0-A7 */
1019         env->aregs[n - 8] = tmp;
1020     } else {
1021         switch (n) {
1022         case 16: env->sr = tmp; break;
1023         case 17: env->pc = tmp; break;
1024         default: return 0;
1025         }
1026     }
1027     return 4;
1028 }
1029 #elif defined (TARGET_MIPS)
1030
1031 #define NUM_CORE_REGS 73
1032
1033 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1034 {
1035     if (n < 32) {
1036         GET_REGL(env->active_tc.gpr[n]);
1037     }
1038     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
1039         if (n >= 38 && n < 70) {
1040             if (env->CP0_Status & (1 << CP0St_FR))
1041                 GET_REGL(env->active_fpu.fpr[n - 38].d);
1042             else
1043                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
1044         }
1045         switch (n) {
1046         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
1047         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
1048         }
1049     }
1050     switch (n) {
1051     case 32: GET_REGL((int32_t)env->CP0_Status);
1052     case 33: GET_REGL(env->active_tc.LO[0]);
1053     case 34: GET_REGL(env->active_tc.HI[0]);
1054     case 35: GET_REGL(env->CP0_BadVAddr);
1055     case 36: GET_REGL((int32_t)env->CP0_Cause);
1056     case 37: GET_REGL(env->active_tc.PC | !!(env->hflags & MIPS_HFLAG_M16));
1057     case 72: GET_REGL(0); /* fp */
1058     case 89: GET_REGL((int32_t)env->CP0_PRid);
1059     }
1060     if (n >= 73 && n <= 88) {
1061         /* 16 embedded regs.  */
1062         GET_REGL(0);
1063     }
1064
1065     return 0;
1066 }
1067
1068 /* convert MIPS rounding mode in FCR31 to IEEE library */
1069 static unsigned int ieee_rm[] =
1070   {
1071     float_round_nearest_even,
1072     float_round_to_zero,
1073     float_round_up,
1074     float_round_down
1075   };
1076 #define RESTORE_ROUNDING_MODE \
1077     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1078
1079 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1080 {
1081     target_ulong tmp;
1082
1083     tmp = ldtul_p(mem_buf);
1084
1085     if (n < 32) {
1086         env->active_tc.gpr[n] = tmp;
1087         return sizeof(target_ulong);
1088     }
1089     if (env->CP0_Config1 & (1 << CP0C1_FP)
1090             && n >= 38 && n < 73) {
1091         if (n < 70) {
1092             if (env->CP0_Status & (1 << CP0St_FR))
1093               env->active_fpu.fpr[n - 38].d = tmp;
1094             else
1095               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1096         }
1097         switch (n) {
1098         case 70:
1099             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1100             /* set rounding mode */
1101             RESTORE_ROUNDING_MODE;
1102 #ifndef CONFIG_SOFTFLOAT
1103             /* no floating point exception for native float */
1104             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1105 #endif
1106             break;
1107         case 71: env->active_fpu.fcr0 = tmp; break;
1108         }
1109         return sizeof(target_ulong);
1110     }
1111     switch (n) {
1112     case 32: env->CP0_Status = tmp; break;
1113     case 33: env->active_tc.LO[0] = tmp; break;
1114     case 34: env->active_tc.HI[0] = tmp; break;
1115     case 35: env->CP0_BadVAddr = tmp; break;
1116     case 36: env->CP0_Cause = tmp; break;
1117     case 37:
1118         env->active_tc.PC = tmp & ~(target_ulong)1;
1119         if (tmp & 1) {
1120             env->hflags |= MIPS_HFLAG_M16;
1121         } else {
1122             env->hflags &= ~(MIPS_HFLAG_M16);
1123         }
1124         break;
1125     case 72: /* fp, ignored */ break;
1126     default:
1127         if (n > 89)
1128             return 0;
1129         /* Other registers are readonly.  Ignore writes.  */
1130         break;
1131     }
1132
1133     return sizeof(target_ulong);
1134 }
1135 #elif defined (TARGET_SH4)
1136
1137 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1138 /* FIXME: We should use XML for this.  */
1139
1140 #define NUM_CORE_REGS 59
1141
1142 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1143 {
1144     if (n < 8) {
1145         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1146             GET_REGL(env->gregs[n + 16]);
1147         } else {
1148             GET_REGL(env->gregs[n]);
1149         }
1150     } else if (n < 16) {
1151         GET_REGL(env->gregs[n]);
1152     } else if (n >= 25 && n < 41) {
1153         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1154     } else if (n >= 43 && n < 51) {
1155         GET_REGL(env->gregs[n - 43]);
1156     } else if (n >= 51 && n < 59) {
1157         GET_REGL(env->gregs[n - (51 - 16)]);
1158     }
1159     switch (n) {
1160     case 16: GET_REGL(env->pc);
1161     case 17: GET_REGL(env->pr);
1162     case 18: GET_REGL(env->gbr);
1163     case 19: GET_REGL(env->vbr);
1164     case 20: GET_REGL(env->mach);
1165     case 21: GET_REGL(env->macl);
1166     case 22: GET_REGL(env->sr);
1167     case 23: GET_REGL(env->fpul);
1168     case 24: GET_REGL(env->fpscr);
1169     case 41: GET_REGL(env->ssr);
1170     case 42: GET_REGL(env->spc);
1171     }
1172
1173     return 0;
1174 }
1175
1176 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1177 {
1178     uint32_t tmp;
1179
1180     tmp = ldl_p(mem_buf);
1181
1182     if (n < 8) {
1183         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1184             env->gregs[n + 16] = tmp;
1185         } else {
1186             env->gregs[n] = tmp;
1187         }
1188         return 4;
1189     } else if (n < 16) {
1190         env->gregs[n] = tmp;
1191         return 4;
1192     } else if (n >= 25 && n < 41) {
1193         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1194         return 4;
1195     } else if (n >= 43 && n < 51) {
1196         env->gregs[n - 43] = tmp;
1197         return 4;
1198     } else if (n >= 51 && n < 59) {
1199         env->gregs[n - (51 - 16)] = tmp;
1200         return 4;
1201     }
1202     switch (n) {
1203     case 16: env->pc = tmp; break;
1204     case 17: env->pr = tmp; break;
1205     case 18: env->gbr = tmp; break;
1206     case 19: env->vbr = tmp; break;
1207     case 20: env->mach = tmp; break;
1208     case 21: env->macl = tmp; break;
1209     case 22: env->sr = tmp; break;
1210     case 23: env->fpul = tmp; break;
1211     case 24: env->fpscr = tmp; break;
1212     case 41: env->ssr = tmp; break;
1213     case 42: env->spc = tmp; break;
1214     default: return 0;
1215     }
1216
1217     return 4;
1218 }
1219 #elif defined (TARGET_MICROBLAZE)
1220
1221 #define NUM_CORE_REGS (32 + 5)
1222
1223 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1224 {
1225     if (n < 32) {
1226         GET_REG32(env->regs[n]);
1227     } else {
1228         GET_REG32(env->sregs[n - 32]);
1229     }
1230     return 0;
1231 }
1232
1233 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1234 {
1235     uint32_t tmp;
1236
1237     if (n > NUM_CORE_REGS)
1238         return 0;
1239
1240     tmp = ldl_p(mem_buf);
1241
1242     if (n < 32) {
1243         env->regs[n] = tmp;
1244     } else {
1245         env->sregs[n - 32] = tmp;
1246     }
1247     return 4;
1248 }
1249 #elif defined (TARGET_CRIS)
1250
1251 #define NUM_CORE_REGS 49
1252
1253 static int
1254 read_register_crisv10(CPUState *env, uint8_t *mem_buf, int n)
1255 {
1256     if (n < 15) {
1257         GET_REG32(env->regs[n]);
1258     }
1259
1260     if (n == 15) {
1261         GET_REG32(env->pc);
1262     }
1263
1264     if (n < 32) {
1265         switch (n) {
1266         case 16:
1267             GET_REG8(env->pregs[n - 16]);
1268             break;
1269         case 17:
1270             GET_REG8(env->pregs[n - 16]);
1271             break;
1272         case 20:
1273         case 21:
1274             GET_REG16(env->pregs[n - 16]);
1275             break;
1276         default:
1277             if (n >= 23) {
1278                 GET_REG32(env->pregs[n - 16]);
1279             }
1280             break;
1281         }
1282     }
1283     return 0;
1284 }
1285
1286 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1287 {
1288     uint8_t srs;
1289
1290     if (env->pregs[PR_VR] < 32)
1291         return read_register_crisv10(env, mem_buf, n);
1292
1293     srs = env->pregs[PR_SRS];
1294     if (n < 16) {
1295         GET_REG32(env->regs[n]);
1296     }
1297
1298     if (n >= 21 && n < 32) {
1299         GET_REG32(env->pregs[n - 16]);
1300     }
1301     if (n >= 33 && n < 49) {
1302         GET_REG32(env->sregs[srs][n - 33]);
1303     }
1304     switch (n) {
1305     case 16: GET_REG8(env->pregs[0]);
1306     case 17: GET_REG8(env->pregs[1]);
1307     case 18: GET_REG32(env->pregs[2]);
1308     case 19: GET_REG8(srs);
1309     case 20: GET_REG16(env->pregs[4]);
1310     case 32: GET_REG32(env->pc);
1311     }
1312
1313     return 0;
1314 }
1315
1316 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1317 {
1318     uint32_t tmp;
1319
1320     if (n > 49)
1321         return 0;
1322
1323     tmp = ldl_p(mem_buf);
1324
1325     if (n < 16) {
1326         env->regs[n] = tmp;
1327     }
1328
1329     if (n >= 21 && n < 32) {
1330         env->pregs[n - 16] = tmp;
1331     }
1332
1333     /* FIXME: Should support function regs be writable?  */
1334     switch (n) {
1335     case 16: return 1;
1336     case 17: return 1;
1337     case 18: env->pregs[PR_PID] = tmp; break;
1338     case 19: return 1;
1339     case 20: return 2;
1340     case 32: env->pc = tmp; break;
1341     }
1342
1343     return 4;
1344 }
1345 #elif defined (TARGET_ALPHA)
1346
1347 #define NUM_CORE_REGS 67
1348
1349 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1350 {
1351     uint64_t val;
1352     CPU_DoubleU d;
1353
1354     switch (n) {
1355     case 0 ... 30:
1356         val = env->ir[n];
1357         break;
1358     case 32 ... 62:
1359         d.d = env->fir[n - 32];
1360         val = d.ll;
1361         break;
1362     case 63:
1363         val = cpu_alpha_load_fpcr(env);
1364         break;
1365     case 64:
1366         val = env->pc;
1367         break;
1368     case 66:
1369         val = env->unique;
1370         break;
1371     case 31:
1372     case 65:
1373         /* 31 really is the zero register; 65 is unassigned in the
1374            gdb protocol, but is still required to occupy 8 bytes. */
1375         val = 0;
1376         break;
1377     default:
1378         return 0;
1379     }
1380     GET_REGL(val);
1381 }
1382
1383 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1384 {
1385     target_ulong tmp = ldtul_p(mem_buf);
1386     CPU_DoubleU d;
1387
1388     switch (n) {
1389     case 0 ... 30:
1390         env->ir[n] = tmp;
1391         break;
1392     case 32 ... 62:
1393         d.ll = tmp;
1394         env->fir[n - 32] = d.d;
1395         break;
1396     case 63:
1397         cpu_alpha_store_fpcr(env, tmp);
1398         break;
1399     case 64:
1400         env->pc = tmp;
1401         break;
1402     case 66:
1403         env->unique = tmp;
1404         break;
1405     case 31:
1406     case 65:
1407         /* 31 really is the zero register; 65 is unassigned in the
1408            gdb protocol, but is still required to occupy 8 bytes. */
1409         break;
1410     default:
1411         return 0;
1412     }
1413     return 8;
1414 }
1415 #elif defined (TARGET_S390X)
1416
1417 #define NUM_CORE_REGS S390_NUM_TOTAL_REGS
1418
1419 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1420 {
1421     switch (n) {
1422         case S390_PSWM_REGNUM: GET_REGL(env->psw.mask); break;
1423         case S390_PSWA_REGNUM: GET_REGL(env->psw.addr); break;
1424         case S390_R0_REGNUM ... S390_R15_REGNUM:
1425             GET_REGL(env->regs[n-S390_R0_REGNUM]); break;
1426         case S390_A0_REGNUM ... S390_A15_REGNUM:
1427             GET_REG32(env->aregs[n-S390_A0_REGNUM]); break;
1428         case S390_FPC_REGNUM: GET_REG32(env->fpc); break;
1429         case S390_F0_REGNUM ... S390_F15_REGNUM:
1430             /* XXX */
1431             break;
1432         case S390_PC_REGNUM: GET_REGL(env->psw.addr); break;
1433         case S390_CC_REGNUM: GET_REG32(env->cc); break;
1434     }
1435
1436     return 0;
1437 }
1438
1439 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1440 {
1441     target_ulong tmpl;
1442     uint32_t tmp32;
1443     int r = 8;
1444     tmpl = ldtul_p(mem_buf);
1445     tmp32 = ldl_p(mem_buf);
1446
1447     switch (n) {
1448         case S390_PSWM_REGNUM: env->psw.mask = tmpl; break;
1449         case S390_PSWA_REGNUM: env->psw.addr = tmpl; break;
1450         case S390_R0_REGNUM ... S390_R15_REGNUM:
1451             env->regs[n-S390_R0_REGNUM] = tmpl; break;
1452         case S390_A0_REGNUM ... S390_A15_REGNUM:
1453             env->aregs[n-S390_A0_REGNUM] = tmp32; r=4; break;
1454         case S390_FPC_REGNUM: env->fpc = tmp32; r=4; break;
1455         case S390_F0_REGNUM ... S390_F15_REGNUM:
1456             /* XXX */
1457             break;
1458         case S390_PC_REGNUM: env->psw.addr = tmpl; break;
1459         case S390_CC_REGNUM: env->cc = tmp32; r=4; break;
1460     }
1461
1462     return r;
1463 }
1464 #else
1465
1466 #define NUM_CORE_REGS 0
1467
1468 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1469 {
1470     return 0;
1471 }
1472
1473 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1474 {
1475     return 0;
1476 }
1477
1478 #endif
1479
1480 static int num_g_regs = NUM_CORE_REGS;
1481
1482 #ifdef GDB_CORE_XML
1483 /* Encode data using the encoding for 'x' packets.  */
1484 static int memtox(char *buf, const char *mem, int len)
1485 {
1486     char *p = buf;
1487     char c;
1488
1489     while (len--) {
1490         c = *(mem++);
1491         switch (c) {
1492         case '#': case '$': case '*': case '}':
1493             *(p++) = '}';
1494             *(p++) = c ^ 0x20;
1495             break;
1496         default:
1497             *(p++) = c;
1498             break;
1499         }
1500     }
1501     return p - buf;
1502 }
1503
1504 static const char *get_feature_xml(const char *p, const char **newp)
1505 {
1506     extern const char *const xml_builtin[][2];
1507     size_t len;
1508     int i;
1509     const char *name;
1510     static char target_xml[1024];
1511
1512     len = 0;
1513     while (p[len] && p[len] != ':')
1514         len++;
1515     *newp = p + len;
1516
1517     name = NULL;
1518     if (strncmp(p, "target.xml", len) == 0) {
1519         /* Generate the XML description for this CPU.  */
1520         if (!target_xml[0]) {
1521             GDBRegisterState *r;
1522
1523             snprintf(target_xml, sizeof(target_xml),
1524                      "<?xml version=\"1.0\"?>"
1525                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1526                      "<target>"
1527                      "<xi:include href=\"%s\"/>",
1528                      GDB_CORE_XML);
1529
1530             for (r = first_cpu->gdb_regs; r; r = r->next) {
1531                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
1532                 pstrcat(target_xml, sizeof(target_xml), r->xml);
1533                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
1534             }
1535             pstrcat(target_xml, sizeof(target_xml), "</target>");
1536         }
1537         return target_xml;
1538     }
1539     for (i = 0; ; i++) {
1540         name = xml_builtin[i][0];
1541         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1542             break;
1543     }
1544     return name ? xml_builtin[i][1] : NULL;
1545 }
1546 #endif
1547
1548 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1549 {
1550     GDBRegisterState *r;
1551
1552     if (reg < NUM_CORE_REGS)
1553         return cpu_gdb_read_register(env, mem_buf, reg);
1554
1555     for (r = env->gdb_regs; r; r = r->next) {
1556         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1557             return r->get_reg(env, mem_buf, reg - r->base_reg);
1558         }
1559     }
1560     return 0;
1561 }
1562
1563 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1564 {
1565     GDBRegisterState *r;
1566
1567     if (reg < NUM_CORE_REGS)
1568         return cpu_gdb_write_register(env, mem_buf, reg);
1569
1570     for (r = env->gdb_regs; r; r = r->next) {
1571         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1572             return r->set_reg(env, mem_buf, reg - r->base_reg);
1573         }
1574     }
1575     return 0;
1576 }
1577
1578 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1579    specifies the first register number and these registers are included in
1580    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1581    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1582  */
1583
1584 void gdb_register_coprocessor(CPUState * env,
1585                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1586                              int num_regs, const char *xml, int g_pos)
1587 {
1588     GDBRegisterState *s;
1589     GDBRegisterState **p;
1590     static int last_reg = NUM_CORE_REGS;
1591
1592     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1593     s->base_reg = last_reg;
1594     s->num_regs = num_regs;
1595     s->get_reg = get_reg;
1596     s->set_reg = set_reg;
1597     s->xml = xml;
1598     p = &env->gdb_regs;
1599     while (*p) {
1600         /* Check for duplicates.  */
1601         if (strcmp((*p)->xml, xml) == 0)
1602             return;
1603         p = &(*p)->next;
1604     }
1605     /* Add to end of list.  */
1606     last_reg += num_regs;
1607     *p = s;
1608     if (g_pos) {
1609         if (g_pos != s->base_reg) {
1610             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1611                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1612         } else {
1613             num_g_regs = last_reg;
1614         }
1615     }
1616 }
1617
1618 #ifndef CONFIG_USER_ONLY
1619 static const int xlat_gdb_type[] = {
1620     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1621     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1622     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1623 };
1624 #endif
1625
1626 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1627 {
1628     CPUState *env;
1629     int err = 0;
1630
1631     if (kvm_enabled())
1632         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1633
1634     switch (type) {
1635     case GDB_BREAKPOINT_SW:
1636     case GDB_BREAKPOINT_HW:
1637         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1638             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1639             if (err)
1640                 break;
1641         }
1642         return err;
1643 #ifndef CONFIG_USER_ONLY
1644     case GDB_WATCHPOINT_WRITE:
1645     case GDB_WATCHPOINT_READ:
1646     case GDB_WATCHPOINT_ACCESS:
1647         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1648             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1649                                         NULL);
1650             if (err)
1651                 break;
1652         }
1653         return err;
1654 #endif
1655     default:
1656         return -ENOSYS;
1657     }
1658 }
1659
1660 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1661 {
1662     CPUState *env;
1663     int err = 0;
1664
1665     if (kvm_enabled())
1666         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1667
1668     switch (type) {
1669     case GDB_BREAKPOINT_SW:
1670     case GDB_BREAKPOINT_HW:
1671         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1672             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1673             if (err)
1674                 break;
1675         }
1676         return err;
1677 #ifndef CONFIG_USER_ONLY
1678     case GDB_WATCHPOINT_WRITE:
1679     case GDB_WATCHPOINT_READ:
1680     case GDB_WATCHPOINT_ACCESS:
1681         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1682             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1683             if (err)
1684                 break;
1685         }
1686         return err;
1687 #endif
1688     default:
1689         return -ENOSYS;
1690     }
1691 }
1692
1693 static void gdb_breakpoint_remove_all(void)
1694 {
1695     CPUState *env;
1696
1697     if (kvm_enabled()) {
1698         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1699         return;
1700     }
1701
1702     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1703         cpu_breakpoint_remove_all(env, BP_GDB);
1704 #ifndef CONFIG_USER_ONLY
1705         cpu_watchpoint_remove_all(env, BP_GDB);
1706 #endif
1707     }
1708 }
1709
1710 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1711 {
1712 #if defined(TARGET_I386)
1713     cpu_synchronize_state(s->c_cpu);
1714     s->c_cpu->eip = pc;
1715 #elif defined (TARGET_PPC)
1716     s->c_cpu->nip = pc;
1717 #elif defined (TARGET_SPARC)
1718     s->c_cpu->pc = pc;
1719     s->c_cpu->npc = pc + 4;
1720 #elif defined (TARGET_ARM)
1721     s->c_cpu->regs[15] = pc;
1722 #elif defined (TARGET_SH4)
1723     s->c_cpu->pc = pc;
1724 #elif defined (TARGET_MIPS)
1725     s->c_cpu->active_tc.PC = pc & ~(target_ulong)1;
1726     if (pc & 1) {
1727         s->c_cpu->hflags |= MIPS_HFLAG_M16;
1728     } else {
1729         s->c_cpu->hflags &= ~(MIPS_HFLAG_M16);
1730     }
1731 #elif defined (TARGET_MICROBLAZE)
1732     s->c_cpu->sregs[SR_PC] = pc;
1733 #elif defined (TARGET_CRIS)
1734     s->c_cpu->pc = pc;
1735 #elif defined (TARGET_ALPHA)
1736     s->c_cpu->pc = pc;
1737 #elif defined (TARGET_S390X)
1738     cpu_synchronize_state(s->c_cpu);
1739     s->c_cpu->psw.addr = pc;
1740 #endif
1741 }
1742
1743 static inline int gdb_id(CPUState *env)
1744 {
1745 #if defined(CONFIG_USER_ONLY) && defined(CONFIG_USE_NPTL)
1746     return env->host_tid;
1747 #else
1748     return env->cpu_index + 1;
1749 #endif
1750 }
1751
1752 static CPUState *find_cpu(uint32_t thread_id)
1753 {
1754     CPUState *env;
1755
1756     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1757         if (gdb_id(env) == thread_id) {
1758             return env;
1759         }
1760     }
1761
1762     return NULL;
1763 }
1764
1765 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1766 {
1767     CPUState *env;
1768     const char *p;
1769     uint32_t thread;
1770     int ch, reg_size, type, res;
1771     char buf[MAX_PACKET_LENGTH];
1772     uint8_t mem_buf[MAX_PACKET_LENGTH];
1773     uint8_t *registers;
1774     target_ulong addr, len;
1775
1776 #ifdef DEBUG_GDB
1777     printf("command='%s'\n", line_buf);
1778 #endif
1779     p = line_buf;
1780     ch = *p++;
1781     switch(ch) {
1782     case '?':
1783         /* TODO: Make this return the correct value for user-mode.  */
1784         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1785                  gdb_id(s->c_cpu));
1786         put_packet(s, buf);
1787         /* Remove all the breakpoints when this query is issued,
1788          * because gdb is doing and initial connect and the state
1789          * should be cleaned up.
1790          */
1791         gdb_breakpoint_remove_all();
1792         break;
1793     case 'c':
1794         if (*p != '\0') {
1795             addr = strtoull(p, (char **)&p, 16);
1796             gdb_set_cpu_pc(s, addr);
1797         }
1798         s->signal = 0;
1799         gdb_continue(s);
1800         return RS_IDLE;
1801     case 'C':
1802         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1803         if (s->signal == -1)
1804             s->signal = 0;
1805         gdb_continue(s);
1806         return RS_IDLE;
1807     case 'v':
1808         if (strncmp(p, "Cont", 4) == 0) {
1809             int res_signal, res_thread;
1810
1811             p += 4;
1812             if (*p == '?') {
1813                 put_packet(s, "vCont;c;C;s;S");
1814                 break;
1815             }
1816             res = 0;
1817             res_signal = 0;
1818             res_thread = 0;
1819             while (*p) {
1820                 int action, signal;
1821
1822                 if (*p++ != ';') {
1823                     res = 0;
1824                     break;
1825                 }
1826                 action = *p++;
1827                 signal = 0;
1828                 if (action == 'C' || action == 'S') {
1829                     signal = strtoul(p, (char **)&p, 16);
1830                 } else if (action != 'c' && action != 's') {
1831                     res = 0;
1832                     break;
1833                 }
1834                 thread = 0;
1835                 if (*p == ':') {
1836                     thread = strtoull(p+1, (char **)&p, 16);
1837                 }
1838                 action = tolower(action);
1839                 if (res == 0 || (res == 'c' && action == 's')) {
1840                     res = action;
1841                     res_signal = signal;
1842                     res_thread = thread;
1843                 }
1844             }
1845             if (res) {
1846                 if (res_thread != -1 && res_thread != 0) {
1847                     env = find_cpu(res_thread);
1848                     if (env == NULL) {
1849                         put_packet(s, "E22");
1850                         break;
1851                     }
1852                     s->c_cpu = env;
1853                 }
1854                 if (res == 's') {
1855                     cpu_single_step(s->c_cpu, sstep_flags);
1856                 }
1857                 s->signal = res_signal;
1858                 gdb_continue(s);
1859                 return RS_IDLE;
1860             }
1861             break;
1862         } else {
1863             goto unknown_command;
1864         }
1865     case 'k':
1866         /* Kill the target */
1867         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1868         exit(0);
1869     case 'D':
1870         /* Detach packet */
1871         gdb_breakpoint_remove_all();
1872         gdb_syscall_mode = GDB_SYS_DISABLED;
1873         gdb_continue(s);
1874         put_packet(s, "OK");
1875         break;
1876     case 's':
1877         if (*p != '\0') {
1878             addr = strtoull(p, (char **)&p, 16);
1879             gdb_set_cpu_pc(s, addr);
1880         }
1881         cpu_single_step(s->c_cpu, sstep_flags);
1882         gdb_continue(s);
1883         return RS_IDLE;
1884     case 'F':
1885         {
1886             target_ulong ret;
1887             target_ulong err;
1888
1889             ret = strtoull(p, (char **)&p, 16);
1890             if (*p == ',') {
1891                 p++;
1892                 err = strtoull(p, (char **)&p, 16);
1893             } else {
1894                 err = 0;
1895             }
1896             if (*p == ',')
1897                 p++;
1898             type = *p;
1899             if (gdb_current_syscall_cb)
1900                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1901             if (type == 'C') {
1902                 put_packet(s, "T02");
1903             } else {
1904                 gdb_continue(s);
1905             }
1906         }
1907         break;
1908     case 'g':
1909         cpu_synchronize_state(s->g_cpu);
1910         len = 0;
1911         for (addr = 0; addr < num_g_regs; addr++) {
1912             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1913             len += reg_size;
1914         }
1915         memtohex(buf, mem_buf, len);
1916         put_packet(s, buf);
1917         break;
1918     case 'G':
1919         cpu_synchronize_state(s->g_cpu);
1920         registers = mem_buf;
1921         len = strlen(p) / 2;
1922         hextomem((uint8_t *)registers, p, len);
1923         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1924             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1925             len -= reg_size;
1926             registers += reg_size;
1927         }
1928         put_packet(s, "OK");
1929         break;
1930     case 'm':
1931         addr = strtoull(p, (char **)&p, 16);
1932         if (*p == ',')
1933             p++;
1934         len = strtoull(p, NULL, 16);
1935         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1936             put_packet (s, "E14");
1937         } else {
1938             memtohex(buf, mem_buf, len);
1939             put_packet(s, buf);
1940         }
1941         break;
1942     case 'M':
1943         addr = strtoull(p, (char **)&p, 16);
1944         if (*p == ',')
1945             p++;
1946         len = strtoull(p, (char **)&p, 16);
1947         if (*p == ':')
1948             p++;
1949         hextomem(mem_buf, p, len);
1950         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1951             put_packet(s, "E14");
1952         else
1953             put_packet(s, "OK");
1954         break;
1955     case 'p':
1956         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1957            This works, but can be very slow.  Anything new enough to
1958            understand XML also knows how to use this properly.  */
1959         if (!gdb_has_xml)
1960             goto unknown_command;
1961         addr = strtoull(p, (char **)&p, 16);
1962         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1963         if (reg_size) {
1964             memtohex(buf, mem_buf, reg_size);
1965             put_packet(s, buf);
1966         } else {
1967             put_packet(s, "E14");
1968         }
1969         break;
1970     case 'P':
1971         if (!gdb_has_xml)
1972             goto unknown_command;
1973         addr = strtoull(p, (char **)&p, 16);
1974         if (*p == '=')
1975             p++;
1976         reg_size = strlen(p) / 2;
1977         hextomem(mem_buf, p, reg_size);
1978         gdb_write_register(s->g_cpu, mem_buf, addr);
1979         put_packet(s, "OK");
1980         break;
1981     case 'Z':
1982     case 'z':
1983         type = strtoul(p, (char **)&p, 16);
1984         if (*p == ',')
1985             p++;
1986         addr = strtoull(p, (char **)&p, 16);
1987         if (*p == ',')
1988             p++;
1989         len = strtoull(p, (char **)&p, 16);
1990         if (ch == 'Z')
1991             res = gdb_breakpoint_insert(addr, len, type);
1992         else
1993             res = gdb_breakpoint_remove(addr, len, type);
1994         if (res >= 0)
1995              put_packet(s, "OK");
1996         else if (res == -ENOSYS)
1997             put_packet(s, "");
1998         else
1999             put_packet(s, "E22");
2000         break;
2001     case 'H':
2002         type = *p++;
2003         thread = strtoull(p, (char **)&p, 16);
2004         if (thread == -1 || thread == 0) {
2005             put_packet(s, "OK");
2006             break;
2007         }
2008         env = find_cpu(thread);
2009         if (env == NULL) {
2010             put_packet(s, "E22");
2011             break;
2012         }
2013         switch (type) {
2014         case 'c':
2015             s->c_cpu = env;
2016             put_packet(s, "OK");
2017             break;
2018         case 'g':
2019             s->g_cpu = env;
2020             put_packet(s, "OK");
2021             break;
2022         default:
2023              put_packet(s, "E22");
2024              break;
2025         }
2026         break;
2027     case 'T':
2028         thread = strtoull(p, (char **)&p, 16);
2029         env = find_cpu(thread);
2030
2031         if (env != NULL) {
2032             put_packet(s, "OK");
2033         } else {
2034             put_packet(s, "E22");
2035         }
2036         break;
2037     case 'q':
2038     case 'Q':
2039         /* parse any 'q' packets here */
2040         if (!strcmp(p,"qemu.sstepbits")) {
2041             /* Query Breakpoint bit definitions */
2042             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
2043                      SSTEP_ENABLE,
2044                      SSTEP_NOIRQ,
2045                      SSTEP_NOTIMER);
2046             put_packet(s, buf);
2047             break;
2048         } else if (strncmp(p,"qemu.sstep",10) == 0) {
2049             /* Display or change the sstep_flags */
2050             p += 10;
2051             if (*p != '=') {
2052                 /* Display current setting */
2053                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
2054                 put_packet(s, buf);
2055                 break;
2056             }
2057             p++;
2058             type = strtoul(p, (char **)&p, 16);
2059             sstep_flags = type;
2060             put_packet(s, "OK");
2061             break;
2062         } else if (strcmp(p,"C") == 0) {
2063             /* "Current thread" remains vague in the spec, so always return
2064              *  the first CPU (gdb returns the first thread). */
2065             put_packet(s, "QC1");
2066             break;
2067         } else if (strcmp(p,"fThreadInfo") == 0) {
2068             s->query_cpu = first_cpu;
2069             goto report_cpuinfo;
2070         } else if (strcmp(p,"sThreadInfo") == 0) {
2071         report_cpuinfo:
2072             if (s->query_cpu) {
2073                 snprintf(buf, sizeof(buf), "m%x", gdb_id(s->query_cpu));
2074                 put_packet(s, buf);
2075                 s->query_cpu = s->query_cpu->next_cpu;
2076             } else
2077                 put_packet(s, "l");
2078             break;
2079         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
2080             thread = strtoull(p+16, (char **)&p, 16);
2081             env = find_cpu(thread);
2082             if (env != NULL) {
2083                 cpu_synchronize_state(env);
2084                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
2085                                "CPU#%d [%s]", env->cpu_index,
2086                                env->halted ? "halted " : "running");
2087                 memtohex(buf, mem_buf, len);
2088                 put_packet(s, buf);
2089             }
2090             break;
2091         }
2092 #ifdef CONFIG_USER_ONLY
2093         else if (strncmp(p, "Offsets", 7) == 0) {
2094             TaskState *ts = s->c_cpu->opaque;
2095
2096             snprintf(buf, sizeof(buf),
2097                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
2098                      ";Bss=" TARGET_ABI_FMT_lx,
2099                      ts->info->code_offset,
2100                      ts->info->data_offset,
2101                      ts->info->data_offset);
2102             put_packet(s, buf);
2103             break;
2104         }
2105 #else /* !CONFIG_USER_ONLY */
2106         else if (strncmp(p, "Rcmd,", 5) == 0) {
2107             int len = strlen(p + 5);
2108
2109             if ((len % 2) != 0) {
2110                 put_packet(s, "E01");
2111                 break;
2112             }
2113             hextomem(mem_buf, p + 5, len);
2114             len = len / 2;
2115             mem_buf[len++] = 0;
2116             qemu_chr_read(s->mon_chr, mem_buf, len);
2117             put_packet(s, "OK");
2118             break;
2119         }
2120 #endif /* !CONFIG_USER_ONLY */
2121         if (strncmp(p, "Supported", 9) == 0) {
2122             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
2123 #ifdef GDB_CORE_XML
2124             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
2125 #endif
2126             put_packet(s, buf);
2127             break;
2128         }
2129 #ifdef GDB_CORE_XML
2130         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
2131             const char *xml;
2132             target_ulong total_len;
2133
2134             gdb_has_xml = 1;
2135             p += 19;
2136             xml = get_feature_xml(p, &p);
2137             if (!xml) {
2138                 snprintf(buf, sizeof(buf), "E00");
2139                 put_packet(s, buf);
2140                 break;
2141             }
2142
2143             if (*p == ':')
2144                 p++;
2145             addr = strtoul(p, (char **)&p, 16);
2146             if (*p == ',')
2147                 p++;
2148             len = strtoul(p, (char **)&p, 16);
2149
2150             total_len = strlen(xml);
2151             if (addr > total_len) {
2152                 snprintf(buf, sizeof(buf), "E00");
2153                 put_packet(s, buf);
2154                 break;
2155             }
2156             if (len > (MAX_PACKET_LENGTH - 5) / 2)
2157                 len = (MAX_PACKET_LENGTH - 5) / 2;
2158             if (len < total_len - addr) {
2159                 buf[0] = 'm';
2160                 len = memtox(buf + 1, xml + addr, len);
2161             } else {
2162                 buf[0] = 'l';
2163                 len = memtox(buf + 1, xml + addr, total_len - addr);
2164             }
2165             put_packet_binary(s, buf, len + 1);
2166             break;
2167         }
2168 #endif
2169         /* Unrecognised 'q' command.  */
2170         goto unknown_command;
2171
2172     default:
2173     unknown_command:
2174         /* put empty packet */
2175         buf[0] = '\0';
2176         put_packet(s, buf);
2177         break;
2178     }
2179     return RS_IDLE;
2180 }
2181
2182 void gdb_set_stop_cpu(CPUState *env)
2183 {
2184     gdbserver_state->c_cpu = env;
2185     gdbserver_state->g_cpu = env;
2186 }
2187
2188 #ifndef CONFIG_USER_ONLY
2189 static void gdb_vm_state_change(void *opaque, int running, int reason)
2190 {
2191     GDBState *s = gdbserver_state;
2192     CPUState *env = s->c_cpu;
2193     char buf[256];
2194     const char *type;
2195     int ret;
2196
2197     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
2198         s->state == RS_INACTIVE || s->state == RS_SYSCALL)
2199         return;
2200
2201     /* disable single step if it was enable */
2202     cpu_single_step(env, 0);
2203
2204     if (reason == EXCP_DEBUG) {
2205         if (env->watchpoint_hit) {
2206             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
2207             case BP_MEM_READ:
2208                 type = "r";
2209                 break;
2210             case BP_MEM_ACCESS:
2211                 type = "a";
2212                 break;
2213             default:
2214                 type = "";
2215                 break;
2216             }
2217             snprintf(buf, sizeof(buf),
2218                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
2219                      GDB_SIGNAL_TRAP, gdb_id(env), type,
2220                      env->watchpoint_hit->vaddr);
2221             put_packet(s, buf);
2222             env->watchpoint_hit = NULL;
2223             return;
2224         }
2225         tb_flush(env);
2226         ret = GDB_SIGNAL_TRAP;
2227     } else {
2228         ret = GDB_SIGNAL_INT;
2229     }
2230     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, gdb_id(env));
2231     put_packet(s, buf);
2232 }
2233 #endif
2234
2235 /* Send a gdb syscall request.
2236    This accepts limited printf-style format specifiers, specifically:
2237     %x  - target_ulong argument printed in hex.
2238     %lx - 64-bit argument printed in hex.
2239     %s  - string pointer (target_ulong) and length (int) pair.  */
2240 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
2241 {
2242     va_list va;
2243     char buf[256];
2244     char *p;
2245     target_ulong addr;
2246     uint64_t i64;
2247     GDBState *s;
2248
2249     s = gdbserver_state;
2250     if (!s)
2251         return;
2252     gdb_current_syscall_cb = cb;
2253     s->state = RS_SYSCALL;
2254 #ifndef CONFIG_USER_ONLY
2255     vm_stop(EXCP_DEBUG);
2256 #endif
2257     s->state = RS_IDLE;
2258     va_start(va, fmt);
2259     p = buf;
2260     *(p++) = 'F';
2261     while (*fmt) {
2262         if (*fmt == '%') {
2263             fmt++;
2264             switch (*fmt++) {
2265             case 'x':
2266                 addr = va_arg(va, target_ulong);
2267                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
2268                 break;
2269             case 'l':
2270                 if (*(fmt++) != 'x')
2271                     goto bad_format;
2272                 i64 = va_arg(va, uint64_t);
2273                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
2274                 break;
2275             case 's':
2276                 addr = va_arg(va, target_ulong);
2277                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
2278                               addr, va_arg(va, int));
2279                 break;
2280             default:
2281             bad_format:
2282                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2283                         fmt - 1);
2284                 break;
2285             }
2286         } else {
2287             *(p++) = *(fmt++);
2288         }
2289     }
2290     *p = 0;
2291     va_end(va);
2292     put_packet(s, buf);
2293 #ifdef CONFIG_USER_ONLY
2294     gdb_handlesig(s->c_cpu, 0);
2295 #else
2296     cpu_exit(s->c_cpu);
2297 #endif
2298 }
2299
2300 static void gdb_read_byte(GDBState *s, int ch)
2301 {
2302     int i, csum;
2303     uint8_t reply;
2304
2305 #ifndef CONFIG_USER_ONLY
2306     if (s->last_packet_len) {
2307         /* Waiting for a response to the last packet.  If we see the start
2308            of a new command then abandon the previous response.  */
2309         if (ch == '-') {
2310 #ifdef DEBUG_GDB
2311             printf("Got NACK, retransmitting\n");
2312 #endif
2313             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2314         }
2315 #ifdef DEBUG_GDB
2316         else if (ch == '+')
2317             printf("Got ACK\n");
2318         else
2319             printf("Got '%c' when expecting ACK/NACK\n", ch);
2320 #endif
2321         if (ch == '+' || ch == '$')
2322             s->last_packet_len = 0;
2323         if (ch != '$')
2324             return;
2325     }
2326     if (vm_running) {
2327         /* when the CPU is running, we cannot do anything except stop
2328            it when receiving a char */
2329         vm_stop(EXCP_INTERRUPT);
2330     } else
2331 #endif
2332     {
2333         switch(s->state) {
2334         case RS_IDLE:
2335             if (ch == '$') {
2336                 s->line_buf_index = 0;
2337                 s->state = RS_GETLINE;
2338             }
2339             break;
2340         case RS_GETLINE:
2341             if (ch == '#') {
2342             s->state = RS_CHKSUM1;
2343             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2344                 s->state = RS_IDLE;
2345             } else {
2346             s->line_buf[s->line_buf_index++] = ch;
2347             }
2348             break;
2349         case RS_CHKSUM1:
2350             s->line_buf[s->line_buf_index] = '\0';
2351             s->line_csum = fromhex(ch) << 4;
2352             s->state = RS_CHKSUM2;
2353             break;
2354         case RS_CHKSUM2:
2355             s->line_csum |= fromhex(ch);
2356             csum = 0;
2357             for(i = 0; i < s->line_buf_index; i++) {
2358                 csum += s->line_buf[i];
2359             }
2360             if (s->line_csum != (csum & 0xff)) {
2361                 reply = '-';
2362                 put_buffer(s, &reply, 1);
2363                 s->state = RS_IDLE;
2364             } else {
2365                 reply = '+';
2366                 put_buffer(s, &reply, 1);
2367                 s->state = gdb_handle_packet(s, s->line_buf);
2368             }
2369             break;
2370         default:
2371             abort();
2372         }
2373     }
2374 }
2375
2376 /* Tell the remote gdb that the process has exited.  */
2377 void gdb_exit(CPUState *env, int code)
2378 {
2379   GDBState *s;
2380   char buf[4];
2381
2382   s = gdbserver_state;
2383   if (!s) {
2384       return;
2385   }
2386 #ifdef CONFIG_USER_ONLY
2387   if (gdbserver_fd < 0 || s->fd < 0) {
2388       return;
2389   }
2390 #endif
2391
2392   snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
2393   put_packet(s, buf);
2394 }
2395
2396 #ifdef CONFIG_USER_ONLY
2397 int
2398 gdb_queuesig (void)
2399 {
2400     GDBState *s;
2401
2402     s = gdbserver_state;
2403
2404     if (gdbserver_fd < 0 || s->fd < 0)
2405         return 0;
2406     else
2407         return 1;
2408 }
2409
2410 int
2411 gdb_handlesig (CPUState *env, int sig)
2412 {
2413   GDBState *s;
2414   char buf[256];
2415   int n;
2416
2417   s = gdbserver_state;
2418   if (gdbserver_fd < 0 || s->fd < 0)
2419     return sig;
2420
2421   /* disable single step if it was enabled */
2422   cpu_single_step(env, 0);
2423   tb_flush(env);
2424
2425   if (sig != 0)
2426     {
2427       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2428       put_packet(s, buf);
2429     }
2430   /* put_packet() might have detected that the peer terminated the
2431      connection.  */
2432   if (s->fd < 0)
2433       return sig;
2434
2435   sig = 0;
2436   s->state = RS_IDLE;
2437   s->running_state = 0;
2438   while (s->running_state == 0) {
2439       n = read (s->fd, buf, 256);
2440       if (n > 0)
2441         {
2442           int i;
2443
2444           for (i = 0; i < n; i++)
2445             gdb_read_byte (s, buf[i]);
2446         }
2447       else if (n == 0 || errno != EAGAIN)
2448         {
2449           /* XXX: Connection closed.  Should probably wait for annother
2450              connection before continuing.  */
2451           return sig;
2452         }
2453   }
2454   sig = s->signal;
2455   s->signal = 0;
2456   return sig;
2457 }
2458
2459 /* Tell the remote gdb that the process has exited due to SIG.  */
2460 void gdb_signalled(CPUState *env, int sig)
2461 {
2462   GDBState *s;
2463   char buf[4];
2464
2465   s = gdbserver_state;
2466   if (gdbserver_fd < 0 || s->fd < 0)
2467     return;
2468
2469   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2470   put_packet(s, buf);
2471 }
2472
2473 static void gdb_accept(void)
2474 {
2475     GDBState *s;
2476     struct sockaddr_in sockaddr;
2477     socklen_t len;
2478     int val, fd;
2479
2480     for(;;) {
2481         len = sizeof(sockaddr);
2482         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2483         if (fd < 0 && errno != EINTR) {
2484             perror("accept");
2485             return;
2486         } else if (fd >= 0) {
2487 #ifndef _WIN32
2488             fcntl(fd, F_SETFD, FD_CLOEXEC);
2489 #endif
2490             break;
2491         }
2492     }
2493
2494     /* set short latency */
2495     val = 1;
2496     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2497
2498     s = qemu_mallocz(sizeof(GDBState));
2499     s->c_cpu = first_cpu;
2500     s->g_cpu = first_cpu;
2501     s->fd = fd;
2502     gdb_has_xml = 0;
2503
2504     gdbserver_state = s;
2505
2506     fcntl(fd, F_SETFL, O_NONBLOCK);
2507 }
2508
2509 static int gdbserver_open(int port)
2510 {
2511     struct sockaddr_in sockaddr;
2512     int fd, val, ret;
2513
2514     fd = socket(PF_INET, SOCK_STREAM, 0);
2515     if (fd < 0) {
2516         perror("socket");
2517         return -1;
2518     }
2519 #ifndef _WIN32
2520     fcntl(fd, F_SETFD, FD_CLOEXEC);
2521 #endif
2522
2523     /* allow fast reuse */
2524     val = 1;
2525     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2526
2527     sockaddr.sin_family = AF_INET;
2528     sockaddr.sin_port = htons(port);
2529     sockaddr.sin_addr.s_addr = 0;
2530     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2531     if (ret < 0) {
2532         perror("bind");
2533         return -1;
2534     }
2535     ret = listen(fd, 0);
2536     if (ret < 0) {
2537         perror("listen");
2538         return -1;
2539     }
2540     return fd;
2541 }
2542
2543 int gdbserver_start(int port)
2544 {
2545     gdbserver_fd = gdbserver_open(port);
2546     if (gdbserver_fd < 0)
2547         return -1;
2548     /* accept connections */
2549     gdb_accept();
2550     return 0;
2551 }
2552
2553 /* Disable gdb stub for child processes.  */
2554 void gdbserver_fork(CPUState *env)
2555 {
2556     GDBState *s = gdbserver_state;
2557     if (gdbserver_fd < 0 || s->fd < 0)
2558       return;
2559     close(s->fd);
2560     s->fd = -1;
2561     cpu_breakpoint_remove_all(env, BP_GDB);
2562     cpu_watchpoint_remove_all(env, BP_GDB);
2563 }
2564 #else
2565 static int gdb_chr_can_receive(void *opaque)
2566 {
2567   /* We can handle an arbitrarily large amount of data.
2568    Pick the maximum packet size, which is as good as anything.  */
2569   return MAX_PACKET_LENGTH;
2570 }
2571
2572 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2573 {
2574     int i;
2575
2576     for (i = 0; i < size; i++) {
2577         gdb_read_byte(gdbserver_state, buf[i]);
2578     }
2579 }
2580
2581 static void gdb_chr_event(void *opaque, int event)
2582 {
2583     switch (event) {
2584     case CHR_EVENT_OPENED:
2585         vm_stop(EXCP_INTERRUPT);
2586         gdb_has_xml = 0;
2587         break;
2588     default:
2589         break;
2590     }
2591 }
2592
2593 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2594 {
2595     char buf[MAX_PACKET_LENGTH];
2596
2597     buf[0] = 'O';
2598     if (len > (MAX_PACKET_LENGTH/2) - 1)
2599         len = (MAX_PACKET_LENGTH/2) - 1;
2600     memtohex(buf + 1, (uint8_t *)msg, len);
2601     put_packet(s, buf);
2602 }
2603
2604 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2605 {
2606     const char *p = (const char *)buf;
2607     int max_sz;
2608
2609     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2610     for (;;) {
2611         if (len <= max_sz) {
2612             gdb_monitor_output(gdbserver_state, p, len);
2613             break;
2614         }
2615         gdb_monitor_output(gdbserver_state, p, max_sz);
2616         p += max_sz;
2617         len -= max_sz;
2618     }
2619     return len;
2620 }
2621
2622 #ifndef _WIN32
2623 static void gdb_sigterm_handler(int signal)
2624 {
2625     if (vm_running)
2626         vm_stop(EXCP_INTERRUPT);
2627 }
2628 #endif
2629
2630 int gdbserver_start(const char *device)
2631 {
2632     GDBState *s;
2633     char gdbstub_device_name[128];
2634     CharDriverState *chr = NULL;
2635     CharDriverState *mon_chr;
2636
2637     if (!device)
2638         return -1;
2639     if (strcmp(device, "none") != 0) {
2640         if (strstart(device, "tcp:", NULL)) {
2641             /* enforce required TCP attributes */
2642             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2643                      "%s,nowait,nodelay,server", device);
2644             device = gdbstub_device_name;
2645         }
2646 #ifndef _WIN32
2647         else if (strcmp(device, "stdio") == 0) {
2648             struct sigaction act;
2649
2650             memset(&act, 0, sizeof(act));
2651             act.sa_handler = gdb_sigterm_handler;
2652             sigaction(SIGINT, &act, NULL);
2653         }
2654 #endif
2655         chr = qemu_chr_open("gdb", device, NULL);
2656         if (!chr)
2657             return -1;
2658
2659         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2660                               gdb_chr_event, NULL);
2661     }
2662
2663     s = gdbserver_state;
2664     if (!s) {
2665         s = qemu_mallocz(sizeof(GDBState));
2666         gdbserver_state = s;
2667
2668         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2669
2670         /* Initialize a monitor terminal for gdb */
2671         mon_chr = qemu_mallocz(sizeof(*mon_chr));
2672         mon_chr->chr_write = gdb_monitor_write;
2673         monitor_init(mon_chr, 0);
2674     } else {
2675         if (s->chr)
2676             qemu_chr_close(s->chr);
2677         mon_chr = s->mon_chr;
2678         memset(s, 0, sizeof(GDBState));
2679     }
2680     s->c_cpu = first_cpu;
2681     s->g_cpu = first_cpu;
2682     s->chr = chr;
2683     s->state = chr ? RS_IDLE : RS_INACTIVE;
2684     s->mon_chr = mon_chr;
2685
2686     return 0;
2687 }
2688 #endif