gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "qemu-common.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "monitor.h"
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #endif
  37
  38 #define MAX_PACKET_LENGTH 4096
  39
  40 #include "exec-all.h"
  41 #include "qemu_socket.h"
  42 #include "kvm.h"
  43
  44
  45 enum {
  46     GDB_SIGNAL_0 = 0,
  47     GDB_SIGNAL_INT = 2,
  48     GDB_SIGNAL_TRAP = 5,
  49     GDB_SIGNAL_UNKNOWN = 143
  50 };
  51
  52 #ifdef CONFIG_USER_ONLY
  53
  54 /* Map target signal numbers to GDB protocol signal numbers and vice
  55  * versa.  For user emulation's currently supported systems, we can
  56  * assume most signals are defined.
  57  */
  58
  59 static int gdb_signal_table[] = {
  60     0,
  61     TARGET_SIGHUP,
  62     TARGET_SIGINT,
  63     TARGET_SIGQUIT,
  64     TARGET_SIGILL,
  65     TARGET_SIGTRAP,
  66     TARGET_SIGABRT,
  67     -1, /* SIGEMT */
  68     TARGET_SIGFPE,
  69     TARGET_SIGKILL,
  70     TARGET_SIGBUS,
  71     TARGET_SIGSEGV,
  72     TARGET_SIGSYS,
  73     TARGET_SIGPIPE,
  74     TARGET_SIGALRM,
  75     TARGET_SIGTERM,
  76     TARGET_SIGURG,
  77     TARGET_SIGSTOP,
  78     TARGET_SIGTSTP,
  79     TARGET_SIGCONT,
  80     TARGET_SIGCHLD,
  81     TARGET_SIGTTIN,
  82     TARGET_SIGTTOU,
  83     TARGET_SIGIO,
  84     TARGET_SIGXCPU,
  85     TARGET_SIGXFSZ,
  86     TARGET_SIGVTALRM,
  87     TARGET_SIGPROF,
  88     TARGET_SIGWINCH,
  89     -1, /* SIGLOST */
  90     TARGET_SIGUSR1,
  91     TARGET_SIGUSR2,
  92 #ifdef TARGET_SIGPWR
  93     TARGET_SIGPWR,
  94 #else
  95     -1,
  96 #endif
  97     -1, /* SIGPOLL */
  98     -1,
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108     -1,
 109 #ifdef __SIGRTMIN
 110     __SIGRTMIN + 1,
 111     __SIGRTMIN + 2,
 112     __SIGRTMIN + 3,
 113     __SIGRTMIN + 4,
 114     __SIGRTMIN + 5,
 115     __SIGRTMIN + 6,
 116     __SIGRTMIN + 7,
 117     __SIGRTMIN + 8,
 118     __SIGRTMIN + 9,
 119     __SIGRTMIN + 10,
 120     __SIGRTMIN + 11,
 121     __SIGRTMIN + 12,
 122     __SIGRTMIN + 13,
 123     __SIGRTMIN + 14,
 124     __SIGRTMIN + 15,
 125     __SIGRTMIN + 16,
 126     __SIGRTMIN + 17,
 127     __SIGRTMIN + 18,
 128     __SIGRTMIN + 19,
 129     __SIGRTMIN + 20,
 130     __SIGRTMIN + 21,
 131     __SIGRTMIN + 22,
 132     __SIGRTMIN + 23,
 133     __SIGRTMIN + 24,
 134     __SIGRTMIN + 25,
 135     __SIGRTMIN + 26,
 136     __SIGRTMIN + 27,
 137     __SIGRTMIN + 28,
 138     __SIGRTMIN + 29,
 139     __SIGRTMIN + 30,
 140     __SIGRTMIN + 31,
 141     -1, /* SIGCANCEL */
 142     __SIGRTMIN,
 143     __SIGRTMIN + 32,
 144     __SIGRTMIN + 33,
 145     __SIGRTMIN + 34,
 146     __SIGRTMIN + 35,
 147     __SIGRTMIN + 36,
 148     __SIGRTMIN + 37,
 149     __SIGRTMIN + 38,
 150     __SIGRTMIN + 39,
 151     __SIGRTMIN + 40,
 152     __SIGRTMIN + 41,
 153     __SIGRTMIN + 42,
 154     __SIGRTMIN + 43,
 155     __SIGRTMIN + 44,
 156     __SIGRTMIN + 45,
 157     __SIGRTMIN + 46,
 158     __SIGRTMIN + 47,
 159     __SIGRTMIN + 48,
 160     __SIGRTMIN + 49,
 161     __SIGRTMIN + 50,
 162     __SIGRTMIN + 51,
 163     __SIGRTMIN + 52,
 164     __SIGRTMIN + 53,
 165     __SIGRTMIN + 54,
 166     __SIGRTMIN + 55,
 167     __SIGRTMIN + 56,
 168     __SIGRTMIN + 57,
 169     __SIGRTMIN + 58,
 170     __SIGRTMIN + 59,
 171     __SIGRTMIN + 60,
 172     __SIGRTMIN + 61,
 173     __SIGRTMIN + 62,
 174     __SIGRTMIN + 63,
 175     __SIGRTMIN + 64,
 176     __SIGRTMIN + 65,
 177     __SIGRTMIN + 66,
 178     __SIGRTMIN + 67,
 179     __SIGRTMIN + 68,
 180     __SIGRTMIN + 69,
 181     __SIGRTMIN + 70,
 182     __SIGRTMIN + 71,
 183     __SIGRTMIN + 72,
 184     __SIGRTMIN + 73,
 185     __SIGRTMIN + 74,
 186     __SIGRTMIN + 75,
 187     __SIGRTMIN + 76,
 188     __SIGRTMIN + 77,
 189     __SIGRTMIN + 78,
 190     __SIGRTMIN + 79,
 191     __SIGRTMIN + 80,
 192     __SIGRTMIN + 81,
 193     __SIGRTMIN + 82,
 194     __SIGRTMIN + 83,
 195     __SIGRTMIN + 84,
 196     __SIGRTMIN + 85,
 197     __SIGRTMIN + 86,
 198     __SIGRTMIN + 87,
 199     __SIGRTMIN + 88,
 200     __SIGRTMIN + 89,
 201     __SIGRTMIN + 90,
 202     __SIGRTMIN + 91,
 203     __SIGRTMIN + 92,
 204     __SIGRTMIN + 93,
 205     __SIGRTMIN + 94,
 206     __SIGRTMIN + 95,
 207     -1, /* SIGINFO */
 208     -1, /* UNKNOWN */
 209     -1, /* DEFAULT */
 210     -1,
 211     -1,
 212     -1,
 213     -1,
 214     -1,
 215     -1
 216 #endif
 217 };
 218 #else
 219 /* In system mode we only need SIGINT and SIGTRAP; other signals
 220    are not yet supported.  */
 221
 222 enum {
 223     TARGET_SIGINT = 2,
 224     TARGET_SIGTRAP = 5
 225 };
 226
 227 static int gdb_signal_table[] = {
 228     -1,
 229     -1,
 230     TARGET_SIGINT,
 231     -1,
 232     -1,
 233     TARGET_SIGTRAP
 234 };
 235 #endif
 236
 237 #ifdef CONFIG_USER_ONLY
 238 static int target_signal_to_gdb (int sig)
 239 {
 240     int i;
 241     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 242         if (gdb_signal_table[i] == sig)
 243             return i;
 244     return GDB_SIGNAL_UNKNOWN;
 245 }
 246 #endif
 247
 248 static int gdb_signal_to_target (int sig)
 249 {
 250     if (sig < ARRAY_SIZE (gdb_signal_table))
 251         return gdb_signal_table[sig];
 252     else
 253         return -1;
 254 }
 255
 256 //#define DEBUG_GDB
 257
 258 typedef struct GDBRegisterState {
 259     int base_reg;
 260     int num_regs;
 261     gdb_reg_cb get_reg;
 262     gdb_reg_cb set_reg;
 263     const char *xml;
 264     struct GDBRegisterState *next;
 265 } GDBRegisterState;
 266
 267 enum RSState {
 268     RS_INACTIVE,
 269     RS_IDLE,
 270     RS_GETLINE,
 271     RS_CHKSUM1,
 272     RS_CHKSUM2,
 273     RS_SYSCALL,
 274 };
 275 typedef struct GDBState {
 276     CPUState *c_cpu; /* current CPU for step/continue ops */
 277     CPUState *g_cpu; /* current CPU for other ops */
 278     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 279     enum RSState state; /* parsing state */
 280     char line_buf[MAX_PACKET_LENGTH];
 281     int line_buf_index;
 282     int line_csum;
 283     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 284     int last_packet_len;
 285     int signal;
 286 #ifdef CONFIG_USER_ONLY
 287     int fd;
 288     int running_state;
 289 #else
 290     CharDriverState *chr;
 291     CharDriverState *mon_chr;
 292 #endif
 293 } GDBState;
 294
 295 /* By default use no IRQs and no timers while single stepping so as to
 296  * make single stepping like an ICE HW step.
 297  */
 298 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 299
 300 static GDBState *gdbserver_state;
 301
 302 /* This is an ugly hack to cope with both new and old gdb.
 303    If gdb sends qXfer:features:read then assume we're talking to a newish
 304    gdb that understands target descriptions.  */
 305 static int gdb_has_xml;
 306
 307 #ifdef CONFIG_USER_ONLY
 308 /* XXX: This is not thread safe.  Do we care?  */
 309 static int gdbserver_fd = -1;
 310
 311 static int get_char(GDBState *s)
 312 {
 313     uint8_t ch;
 314     int ret;
 315
 316     for(;;) {
 317         ret = recv(s->fd, &ch, 1, 0);
 318         if (ret < 0) {
 319             if (errno == ECONNRESET)
 320                 s->fd = -1;
 321             if (errno != EINTR && errno != EAGAIN)
 322                 return -1;
 323         } else if (ret == 0) {
 324             close(s->fd);
 325             s->fd = -1;
 326             return -1;
 327         } else {
 328             break;
 329         }
 330     }
 331     return ch;
 332 }
 333 #endif
 334
 335 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 336
 337 static enum {
 338     GDB_SYS_UNKNOWN,
 339     GDB_SYS_ENABLED,
 340     GDB_SYS_DISABLED,
 341 } gdb_syscall_mode;
 342
 343 /* If gdb is connected when the first semihosting syscall occurs then use
 344    remote gdb syscalls.  Otherwise use native file IO.  */
 345 int use_gdb_syscalls(void)
 346 {
 347     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 348         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 349                                             : GDB_SYS_DISABLED);
 350     }
 351     return gdb_syscall_mode == GDB_SYS_ENABLED;
 352 }
 353
 354 /* Resume execution.  */
 355 static inline void gdb_continue(GDBState *s)
 356 {
 357 #ifdef CONFIG_USER_ONLY
 358     s->running_state = 1;
 359 #else
 360     vm_start();
 361 #endif
 362 }
 363
 364 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 365 {
 366 #ifdef CONFIG_USER_ONLY
 367     int ret;
 368
 369     while (len > 0) {
 370         ret = send(s->fd, buf, len, 0);
 371         if (ret < 0) {
 372             if (errno != EINTR && errno != EAGAIN)
 373                 return;
 374         } else {
 375             buf += ret;
 376             len -= ret;
 377         }
 378     }
 379 #else
 380     qemu_chr_write(s->chr, buf, len);
 381 #endif
 382 }
 383
 384 static inline int fromhex(int v)
 385 {
 386     if (v >= '0' && v <= '9')
 387         return v - '0';
 388     else if (v >= 'A' && v <= 'F')
 389         return v - 'A' + 10;
 390     else if (v >= 'a' && v <= 'f')
 391         return v - 'a' + 10;
 392     else
 393         return 0;
 394 }
 395
 396 static inline int tohex(int v)
 397 {
 398     if (v < 10)
 399         return v + '0';
 400     else
 401         return v - 10 + 'a';
 402 }
 403
 404 static void memtohex(char *buf, const uint8_t *mem, int len)
 405 {
 406     int i, c;
 407     char *q;
 408     q = buf;
 409     for(i = 0; i < len; i++) {
 410         c = mem[i];
 411         *q++ = tohex(c >> 4);
 412         *q++ = tohex(c & 0xf);
 413     }
 414     *q = '\0';
 415 }
 416
 417 static void hextomem(uint8_t *mem, const char *buf, int len)
 418 {
 419     int i;
 420
 421     for(i = 0; i < len; i++) {
 422         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 423         buf += 2;
 424     }
 425 }
 426
 427 /* return -1 if error, 0 if OK */
 428 static int put_packet_binary(GDBState *s, const char *buf, int len)
 429 {
 430     int csum, i;
 431     uint8_t *p;
 432
 433     for(;;) {
 434         p = s->last_packet;
 435         *(p++) = '$';
 436         memcpy(p, buf, len);
 437         p += len;
 438         csum = 0;
 439         for(i = 0; i < len; i++) {
 440             csum += buf[i];
 441         }
 442         *(p++) = '#';
 443         *(p++) = tohex((csum >> 4) & 0xf);
 444         *(p++) = tohex((csum) & 0xf);
 445
 446         s->last_packet_len = p - s->last_packet;
 447         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 448
 449 #ifdef CONFIG_USER_ONLY
 450         i = get_char(s);
 451         if (i < 0)
 452             return -1;
 453         if (i == '+')
 454             break;
 455 #else
 456         break;
 457 #endif
 458     }
 459     return 0;
 460 }
 461
 462 /* return -1 if error, 0 if OK */
 463 static int put_packet(GDBState *s, const char *buf)
 464 {
 465 #ifdef DEBUG_GDB
 466     printf("reply='%s'\n", buf);
 467 #endif
 468
 469     return put_packet_binary(s, buf, strlen(buf));
 470 }
 471
 472 /* The GDB remote protocol transfers values in target byte order.  This means
 473    we can use the raw memory access routines to access the value buffer.
 474    Conveniently, these also handle the case where the buffer is mis-aligned.
 475  */
 476 #define GET_REG8(val) do { \
 477     stb_p(mem_buf, val); \
 478     return 1; \
 479     } while(0)
 480 #define GET_REG16(val) do { \
 481     stw_p(mem_buf, val); \
 482     return 2; \
 483     } while(0)
 484 #define GET_REG32(val) do { \
 485     stl_p(mem_buf, val); \
 486     return 4; \
 487     } while(0)
 488 #define GET_REG64(val) do { \
 489     stq_p(mem_buf, val); \
 490     return 8; \
 491     } while(0)
 492
 493 #if TARGET_LONG_BITS == 64
 494 #define GET_REGL(val) GET_REG64(val)
 495 #define ldtul_p(addr) ldq_p(addr)
 496 #else
 497 #define GET_REGL(val) GET_REG32(val)
 498 #define ldtul_p(addr) ldl_p(addr)
 499 #endif
 500
 501 #if defined(TARGET_I386)
 502
 503 #ifdef TARGET_X86_64
 504 static const int gpr_map[16] = {
 505     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 506     8, 9, 10, 11, 12, 13, 14, 15
 507 };
 508 #else
 509 #define gpr_map gpr_map32
 510 #endif
 511 static const int gpr_map32[8] = { 0, 1, 2, 3, 4, 5, 6, 7 };
 512
 513 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 514
 515 #define IDX_IP_REG      CPU_NB_REGS
 516 #define IDX_FLAGS_REG   (IDX_IP_REG + 1)
 517 #define IDX_SEG_REGS    (IDX_FLAGS_REG + 1)
 518 #define IDX_FP_REGS     (IDX_SEG_REGS + 6)
 519 #define IDX_XMM_REGS    (IDX_FP_REGS + 16)
 520 #define IDX_MXCSR_REG   (IDX_XMM_REGS + CPU_NB_REGS)
 521
 522 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 523 {
 524     if (n < CPU_NB_REGS) {
 525         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 526             GET_REG64(env->regs[gpr_map[n]]);
 527         } else if (n < CPU_NB_REGS32) {
 528             GET_REG32(env->regs[gpr_map32[n]]);
 529         }
 530     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 531 #ifdef USE_X86LDOUBLE
 532         /* FIXME: byteswap float values - after fixing fpregs layout. */
 533         memcpy(mem_buf, &env->fpregs[n - IDX_FP_REGS], 10);
 534 #else
 535         memset(mem_buf, 0, 10);
 536 #endif
 537         return 10;
 538     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 539         n -= IDX_XMM_REGS;
 540         if (n < CPU_NB_REGS32 ||
 541             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 542             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 543             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 544             return 16;
 545         }
 546     } else {
 547         switch (n) {
 548         case IDX_IP_REG:
 549             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 550                 GET_REG64(env->eip);
 551             } else {
 552                 GET_REG32(env->eip);
 553             }
 554         case IDX_FLAGS_REG: GET_REG32(env->eflags);
 555
 556         case IDX_SEG_REGS:     GET_REG32(env->segs[R_CS].selector);
 557         case IDX_SEG_REGS + 1: GET_REG32(env->segs[R_SS].selector);
 558         case IDX_SEG_REGS + 2: GET_REG32(env->segs[R_DS].selector);
 559         case IDX_SEG_REGS + 3: GET_REG32(env->segs[R_ES].selector);
 560         case IDX_SEG_REGS + 4: GET_REG32(env->segs[R_FS].selector);
 561         case IDX_SEG_REGS + 5: GET_REG32(env->segs[R_GS].selector);
 562
 563         case IDX_FP_REGS + 8:  GET_REG32(env->fpuc);
 564         case IDX_FP_REGS + 9:  GET_REG32((env->fpus & ~0x3800) |
 565                                          (env->fpstt & 0x7) << 11);
 566         case IDX_FP_REGS + 10: GET_REG32(0); /* ftag */
 567         case IDX_FP_REGS + 11: GET_REG32(0); /* fiseg */
 568         case IDX_FP_REGS + 12: GET_REG32(0); /* fioff */
 569         case IDX_FP_REGS + 13: GET_REG32(0); /* foseg */
 570         case IDX_FP_REGS + 14: GET_REG32(0); /* fooff */
 571         case IDX_FP_REGS + 15: GET_REG32(0); /* fop */
 572
 573         case IDX_MXCSR_REG: GET_REG32(env->mxcsr);
 574         }
 575     }
 576     return 0;
 577 }
 578
 579 static int cpu_x86_gdb_load_seg(CPUState *env, int sreg, uint8_t *mem_buf)
 580 {
 581     uint16_t selector = ldl_p(mem_buf);
 582
 583     if (selector != env->segs[sreg].selector) {
 584 #if defined(CONFIG_USER_ONLY)
 585         cpu_x86_load_seg(env, sreg, selector);
 586 #else
 587         unsigned int limit, flags;
 588         target_ulong base;
 589
 590         if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK)) {
 591             base = selector << 4;
 592             limit = 0xffff;
 593             flags = 0;
 594         } else {
 595             if (!cpu_x86_get_descr_debug(env, selector, &base, &limit, &flags))
 596                 return 4;
 597         }
 598         cpu_x86_load_seg_cache(env, sreg, selector, base, limit, flags);
 599 #endif
 600     }
 601     return 4;
 602 }
 603
 604 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 605 {
 606     uint32_t tmp;
 607
 608     if (n < CPU_NB_REGS) {
 609         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 610             env->regs[gpr_map[n]] = ldtul_p(mem_buf);
 611             return sizeof(target_ulong);
 612         } else if (n < CPU_NB_REGS32) {
 613             n = gpr_map32[n];
 614             env->regs[n] &= ~0xffffffffUL;
 615             env->regs[n] |= (uint32_t)ldl_p(mem_buf);
 616             return 4;
 617         }
 618     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 619 #ifdef USE_X86LDOUBLE
 620         /* FIXME: byteswap float values - after fixing fpregs layout. */
 621         memcpy(&env->fpregs[n - IDX_FP_REGS], mem_buf, 10);
 622 #endif
 623         return 10;
 624     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 625         n -= IDX_XMM_REGS;
 626         if (n < CPU_NB_REGS32 ||
 627             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 628             env->xmm_regs[n].XMM_Q(0) = ldq_p(mem_buf);
 629             env->xmm_regs[n].XMM_Q(1) = ldq_p(mem_buf + 8);
 630             return 16;
 631         }
 632     } else {
 633         switch (n) {
 634         case IDX_IP_REG:
 635             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 636                 env->eip = ldq_p(mem_buf);
 637                 return 8;
 638             } else {
 639                 env->eip &= ~0xffffffffUL;
 640                 env->eip |= (uint32_t)ldl_p(mem_buf);
 641                 return 4;
 642             }
 643         case IDX_FLAGS_REG:
 644             env->eflags = ldl_p(mem_buf);
 645             return 4;
 646
 647         case IDX_SEG_REGS:     return cpu_x86_gdb_load_seg(env, R_CS, mem_buf);
 648         case IDX_SEG_REGS + 1: return cpu_x86_gdb_load_seg(env, R_SS, mem_buf);
 649         case IDX_SEG_REGS + 2: return cpu_x86_gdb_load_seg(env, R_DS, mem_buf);
 650         case IDX_SEG_REGS + 3: return cpu_x86_gdb_load_seg(env, R_ES, mem_buf);
 651         case IDX_SEG_REGS + 4: return cpu_x86_gdb_load_seg(env, R_FS, mem_buf);
 652         case IDX_SEG_REGS + 5: return cpu_x86_gdb_load_seg(env, R_GS, mem_buf);
 653
 654         case IDX_FP_REGS + 8:
 655             env->fpuc = ldl_p(mem_buf);
 656             return 4;
 657         case IDX_FP_REGS + 9:
 658             tmp = ldl_p(mem_buf);
 659             env->fpstt = (tmp >> 11) & 7;
 660             env->fpus = tmp & ~0x3800;
 661             return 4;
 662         case IDX_FP_REGS + 10: /* ftag */  return 4;
 663         case IDX_FP_REGS + 11: /* fiseg */ return 4;
 664         case IDX_FP_REGS + 12: /* fioff */ return 4;
 665         case IDX_FP_REGS + 13: /* foseg */ return 4;
 666         case IDX_FP_REGS + 14: /* fooff */ return 4;
 667         case IDX_FP_REGS + 15: /* fop */   return 4;
 668
 669         case IDX_MXCSR_REG:
 670             env->mxcsr = ldl_p(mem_buf);
 671             return 4;
 672         }
 673     }
 674     /* Unrecognised register.  */
 675     return 0;
 676 }
 677
 678 #elif defined (TARGET_PPC)
 679
 680 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 681    expects whatever the target description contains.  Due to a
 682    historical mishap the FP registers appear in between core integer
 683    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 684    FP regs zero size when talking to a newer gdb.  */
 685 #define NUM_CORE_REGS 71
 686 #if defined (TARGET_PPC64)
 687 #define GDB_CORE_XML "power64-core.xml"
 688 #else
 689 #define GDB_CORE_XML "power-core.xml"
 690 #endif
 691
 692 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 693 {
 694     if (n < 32) {
 695         /* gprs */
 696         GET_REGL(env->gpr[n]);
 697     } else if (n < 64) {
 698         /* fprs */
 699         if (gdb_has_xml)
 700             return 0;
 701         stfq_p(mem_buf, env->fpr[n-32]);
 702         return 8;
 703     } else {
 704         switch (n) {
 705         case 64: GET_REGL(env->nip);
 706         case 65: GET_REGL(env->msr);
 707         case 66:
 708             {
 709                 uint32_t cr = 0;
 710                 int i;
 711                 for (i = 0; i < 8; i++)
 712                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 713                 GET_REG32(cr);
 714             }
 715         case 67: GET_REGL(env->lr);
 716         case 68: GET_REGL(env->ctr);
 717         case 69: GET_REGL(env->xer);
 718         case 70:
 719             {
 720                 if (gdb_has_xml)
 721                     return 0;
 722                 GET_REG32(0); /* fpscr */
 723             }
 724         }
 725     }
 726     return 0;
 727 }
 728
 729 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 730 {
 731     if (n < 32) {
 732         /* gprs */
 733         env->gpr[n] = ldtul_p(mem_buf);
 734         return sizeof(target_ulong);
 735     } else if (n < 64) {
 736         /* fprs */
 737         if (gdb_has_xml)
 738             return 0;
 739         env->fpr[n-32] = ldfq_p(mem_buf);
 740         return 8;
 741     } else {
 742         switch (n) {
 743         case 64:
 744             env->nip = ldtul_p(mem_buf);
 745             return sizeof(target_ulong);
 746         case 65:
 747             ppc_store_msr(env, ldtul_p(mem_buf));
 748             return sizeof(target_ulong);
 749         case 66:
 750             {
 751                 uint32_t cr = ldl_p(mem_buf);
 752                 int i;
 753                 for (i = 0; i < 8; i++)
 754                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 755                 return 4;
 756             }
 757         case 67:
 758             env->lr = ldtul_p(mem_buf);
 759             return sizeof(target_ulong);
 760         case 68:
 761             env->ctr = ldtul_p(mem_buf);
 762             return sizeof(target_ulong);
 763         case 69:
 764             env->xer = ldtul_p(mem_buf);
 765             return sizeof(target_ulong);
 766         case 70:
 767             /* fpscr */
 768             if (gdb_has_xml)
 769                 return 0;
 770             return 4;
 771         }
 772     }
 773     return 0;
 774 }
 775
 776 #elif defined (TARGET_SPARC)
 777
 778 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 779 #define NUM_CORE_REGS 86
 780 #else
 781 #define NUM_CORE_REGS 72
 782 #endif
 783
 784 #ifdef TARGET_ABI32
 785 #define GET_REGA(val) GET_REG32(val)
 786 #else
 787 #define GET_REGA(val) GET_REGL(val)
 788 #endif
 789
 790 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 791 {
 792     if (n < 8) {
 793         /* g0..g7 */
 794         GET_REGA(env->gregs[n]);
 795     }
 796     if (n < 32) {
 797         /* register window */
 798         GET_REGA(env->regwptr[n - 8]);
 799     }
 800 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 801     if (n < 64) {
 802         /* fprs */
 803         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 804     }
 805     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 806     switch (n) {
 807     case 64: GET_REGA(env->y);
 808     case 65: GET_REGA(cpu_get_psr(env));
 809     case 66: GET_REGA(env->wim);
 810     case 67: GET_REGA(env->tbr);
 811     case 68: GET_REGA(env->pc);
 812     case 69: GET_REGA(env->npc);
 813     case 70: GET_REGA(env->fsr);
 814     case 71: GET_REGA(0); /* csr */
 815     default: GET_REGA(0);
 816     }
 817 #else
 818     if (n < 64) {
 819         /* f0-f31 */
 820         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 821     }
 822     if (n < 80) {
 823         /* f32-f62 (double width, even numbers only) */
 824         uint64_t val;
 825
 826         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 827         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 828         GET_REG64(val);
 829     }
 830     switch (n) {
 831     case 80: GET_REGL(env->pc);
 832     case 81: GET_REGL(env->npc);
 833     case 82: GET_REGL((cpu_get_ccr(env) << 32) |
 834                       ((env->asi & 0xff) << 24) |
 835                       ((env->pstate & 0xfff) << 8) |
 836                       cpu_get_cwp64(env));
 837     case 83: GET_REGL(env->fsr);
 838     case 84: GET_REGL(env->fprs);
 839     case 85: GET_REGL(env->y);
 840     }
 841 #endif
 842     return 0;
 843 }
 844
 845 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 846 {
 847 #if defined(TARGET_ABI32)
 848     abi_ulong tmp;
 849
 850     tmp = ldl_p(mem_buf);
 851 #else
 852     target_ulong tmp;
 853
 854     tmp = ldtul_p(mem_buf);
 855 #endif
 856
 857     if (n < 8) {
 858         /* g0..g7 */
 859         env->gregs[n] = tmp;
 860     } else if (n < 32) {
 861         /* register window */
 862         env->regwptr[n - 8] = tmp;
 863     }
 864 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 865     else if (n < 64) {
 866         /* fprs */
 867         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 868     } else {
 869         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 870         switch (n) {
 871         case 64: env->y = tmp; break;
 872         case 65: cpu_put_psr(env, tmp); break;
 873         case 66: env->wim = tmp; break;
 874         case 67: env->tbr = tmp; break;
 875         case 68: env->pc = tmp; break;
 876         case 69: env->npc = tmp; break;
 877         case 70: env->fsr = tmp; break;
 878         default: return 0;
 879         }
 880     }
 881     return 4;
 882 #else
 883     else if (n < 64) {
 884         /* f0-f31 */
 885         env->fpr[n] = ldfl_p(mem_buf);
 886         return 4;
 887     } else if (n < 80) {
 888         /* f32-f62 (double width, even numbers only) */
 889         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 890         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 891     } else {
 892         switch (n) {
 893         case 80: env->pc = tmp; break;
 894         case 81: env->npc = tmp; break;
 895         case 82:
 896             cpu_put_ccr(env, tmp >> 32);
 897             env->asi = (tmp >> 24) & 0xff;
 898             env->pstate = (tmp >> 8) & 0xfff;
 899             cpu_put_cwp64(env, tmp & 0xff);
 900             break;
 901         case 83: env->fsr = tmp; break;
 902         case 84: env->fprs = tmp; break;
 903         case 85: env->y = tmp; break;
 904         default: return 0;
 905         }
 906     }
 907     return 8;
 908 #endif
 909 }
 910 #elif defined (TARGET_ARM)
 911
 912 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 913    whatever the target description contains.  Due to a historical mishap
 914    the FPA registers appear in between core integer regs and the CPSR.
 915    We hack round this by giving the FPA regs zero size when talking to a
 916    newer gdb.  */
 917 #define NUM_CORE_REGS 26
 918 #define GDB_CORE_XML "arm-core.xml"
 919
 920 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 921 {
 922     if (n < 16) {
 923         /* Core integer register.  */
 924         GET_REG32(env->regs[n]);
 925     }
 926     if (n < 24) {
 927         /* FPA registers.  */
 928         if (gdb_has_xml)
 929             return 0;
 930         memset(mem_buf, 0, 12);
 931         return 12;
 932     }
 933     switch (n) {
 934     case 24:
 935         /* FPA status register.  */
 936         if (gdb_has_xml)
 937             return 0;
 938         GET_REG32(0);
 939     case 25:
 940         /* CPSR */
 941         GET_REG32(cpsr_read(env));
 942     }
 943     /* Unknown register.  */
 944     return 0;
 945 }
 946
 947 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 948 {
 949     uint32_t tmp;
 950
 951     tmp = ldl_p(mem_buf);
 952
 953     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 954        cause problems if we ever implement the Jazelle DBX extensions.  */
 955     if (n == 15)
 956         tmp &= ~1;
 957
 958     if (n < 16) {
 959         /* Core integer register.  */
 960         env->regs[n] = tmp;
 961         return 4;
 962     }
 963     if (n < 24) { /* 16-23 */
 964         /* FPA registers (ignored).  */
 965         if (gdb_has_xml)
 966             return 0;
 967         return 12;
 968     }
 969     switch (n) {
 970     case 24:
 971         /* FPA status register (ignored).  */
 972         if (gdb_has_xml)
 973             return 0;
 974         return 4;
 975     case 25:
 976         /* CPSR */
 977         cpsr_write (env, tmp, 0xffffffff);
 978         return 4;
 979     }
 980     /* Unknown register.  */
 981     return 0;
 982 }
 983
 984 #elif defined (TARGET_M68K)
 985
 986 #define NUM_CORE_REGS 18
 987
 988 #define GDB_CORE_XML "cf-core.xml"
 989
 990 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 991 {
 992     if (n < 8) {
 993         /* D0-D7 */
 994         GET_REG32(env->dregs[n]);
 995     } else if (n < 16) {
 996         /* A0-A7 */
 997         GET_REG32(env->aregs[n - 8]);
 998     } else {
 999         switch (n) {
1000         case 16: GET_REG32(env->sr);
1001         case 17: GET_REG32(env->pc);
1002         }
1003     }
1004     /* FP registers not included here because they vary between
1005        ColdFire and m68k.  Use XML bits for these.  */
1006     return 0;
1007 }
1008
1009 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1010 {
1011     uint32_t tmp;
1012
1013     tmp = ldl_p(mem_buf);
1014
1015     if (n < 8) {
1016         /* D0-D7 */
1017         env->dregs[n] = tmp;
1018     } else if (n < 16) {
1019         /* A0-A7 */
1020         env->aregs[n - 8] = tmp;
1021     } else {
1022         switch (n) {
1023         case 16: env->sr = tmp; break;
1024         case 17: env->pc = tmp; break;
1025         default: return 0;
1026         }
1027     }
1028     return 4;
1029 }
1030 #elif defined (TARGET_MIPS)
1031
1032 #define NUM_CORE_REGS 73
1033
1034 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1035 {
1036     if (n < 32) {
1037         GET_REGL(env->active_tc.gpr[n]);
1038     }
1039     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
1040         if (n >= 38 && n < 70) {
1041             if (env->CP0_Status & (1 << CP0St_FR))
1042                 GET_REGL(env->active_fpu.fpr[n - 38].d);
1043             else
1044                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
1045         }
1046         switch (n) {
1047         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
1048         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
1049         }
1050     }
1051     switch (n) {
1052     case 32: GET_REGL((int32_t)env->CP0_Status);
1053     case 33: GET_REGL(env->active_tc.LO[0]);
1054     case 34: GET_REGL(env->active_tc.HI[0]);
1055     case 35: GET_REGL(env->CP0_BadVAddr);
1056     case 36: GET_REGL((int32_t)env->CP0_Cause);
1057     case 37: GET_REGL(env->active_tc.PC | !!(env->hflags & MIPS_HFLAG_M16));
1058     case 72: GET_REGL(0); /* fp */
1059     case 89: GET_REGL((int32_t)env->CP0_PRid);
1060     }
1061     if (n >= 73 && n <= 88) {
1062         /* 16 embedded regs.  */
1063         GET_REGL(0);
1064     }
1065
1066     return 0;
1067 }
1068
1069 /* convert MIPS rounding mode in FCR31 to IEEE library */
1070 static unsigned int ieee_rm[] =
1071   {
1072     float_round_nearest_even,
1073     float_round_to_zero,
1074     float_round_up,
1075     float_round_down
1076   };
1077 #define RESTORE_ROUNDING_MODE \
1078     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1079
1080 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1081 {
1082     target_ulong tmp;
1083
1084     tmp = ldtul_p(mem_buf);
1085
1086     if (n < 32) {
1087         env->active_tc.gpr[n] = tmp;
1088         return sizeof(target_ulong);
1089     }
1090     if (env->CP0_Config1 & (1 << CP0C1_FP)
1091             && n >= 38 && n < 73) {
1092         if (n < 70) {
1093             if (env->CP0_Status & (1 << CP0St_FR))
1094               env->active_fpu.fpr[n - 38].d = tmp;
1095             else
1096               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1097         }
1098         switch (n) {
1099         case 70:
1100             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1101             /* set rounding mode */
1102             RESTORE_ROUNDING_MODE;
1103 #ifndef CONFIG_SOFTFLOAT
1104             /* no floating point exception for native float */
1105             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1106 #endif
1107             break;
1108         case 71: env->active_fpu.fcr0 = tmp; break;
1109         }
1110         return sizeof(target_ulong);
1111     }
1112     switch (n) {
1113     case 32: env->CP0_Status = tmp; break;
1114     case 33: env->active_tc.LO[0] = tmp; break;
1115     case 34: env->active_tc.HI[0] = tmp; break;
1116     case 35: env->CP0_BadVAddr = tmp; break;
1117     case 36: env->CP0_Cause = tmp; break;
1118     case 37:
1119         env->active_tc.PC = tmp & ~(target_ulong)1;
1120         if (tmp & 1) {
1121             env->hflags |= MIPS_HFLAG_M16;
1122         } else {
1123             env->hflags &= ~(MIPS_HFLAG_M16);
1124         }
1125         break;
1126     case 72: /* fp, ignored */ break;
1127     default:
1128         if (n > 89)
1129             return 0;
1130         /* Other registers are readonly.  Ignore writes.  */
1131         break;
1132     }
1133
1134     return sizeof(target_ulong);
1135 }
1136 #elif defined (TARGET_SH4)
1137
1138 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1139 /* FIXME: We should use XML for this.  */
1140
1141 #define NUM_CORE_REGS 59
1142
1143 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1144 {
1145     if (n < 8) {
1146         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1147             GET_REGL(env->gregs[n + 16]);
1148         } else {
1149             GET_REGL(env->gregs[n]);
1150         }
1151     } else if (n < 16) {
1152         GET_REGL(env->gregs[n]);
1153     } else if (n >= 25 && n < 41) {
1154         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1155     } else if (n >= 43 && n < 51) {
1156         GET_REGL(env->gregs[n - 43]);
1157     } else if (n >= 51 && n < 59) {
1158         GET_REGL(env->gregs[n - (51 - 16)]);
1159     }
1160     switch (n) {
1161     case 16: GET_REGL(env->pc);
1162     case 17: GET_REGL(env->pr);
1163     case 18: GET_REGL(env->gbr);
1164     case 19: GET_REGL(env->vbr);
1165     case 20: GET_REGL(env->mach);
1166     case 21: GET_REGL(env->macl);
1167     case 22: GET_REGL(env->sr);
1168     case 23: GET_REGL(env->fpul);
1169     case 24: GET_REGL(env->fpscr);
1170     case 41: GET_REGL(env->ssr);
1171     case 42: GET_REGL(env->spc);
1172     }
1173
1174     return 0;
1175 }
1176
1177 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1178 {
1179     uint32_t tmp;
1180
1181     tmp = ldl_p(mem_buf);
1182
1183     if (n < 8) {
1184         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1185             env->gregs[n + 16] = tmp;
1186         } else {
1187             env->gregs[n] = tmp;
1188         }
1189         return 4;
1190     } else if (n < 16) {
1191         env->gregs[n] = tmp;
1192         return 4;
1193     } else if (n >= 25 && n < 41) {
1194         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1195         return 4;
1196     } else if (n >= 43 && n < 51) {
1197         env->gregs[n - 43] = tmp;
1198         return 4;
1199     } else if (n >= 51 && n < 59) {
1200         env->gregs[n - (51 - 16)] = tmp;
1201         return 4;
1202     }
1203     switch (n) {
1204     case 16: env->pc = tmp; break;
1205     case 17: env->pr = tmp; break;
1206     case 18: env->gbr = tmp; break;
1207     case 19: env->vbr = tmp; break;
1208     case 20: env->mach = tmp; break;
1209     case 21: env->macl = tmp; break;
1210     case 22: env->sr = tmp; break;
1211     case 23: env->fpul = tmp; break;
1212     case 24: env->fpscr = tmp; break;
1213     case 41: env->ssr = tmp; break;
1214     case 42: env->spc = tmp; break;
1215     default: return 0;
1216     }
1217
1218     return 4;
1219 }
1220 #elif defined (TARGET_MICROBLAZE)
1221
1222 #define NUM_CORE_REGS (32 + 5)
1223
1224 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1225 {
1226     if (n < 32) {
1227         GET_REG32(env->regs[n]);
1228     } else {
1229         GET_REG32(env->sregs[n - 32]);
1230     }
1231     return 0;
1232 }
1233
1234 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1235 {
1236     uint32_t tmp;
1237
1238     if (n > NUM_CORE_REGS)
1239         return 0;
1240
1241     tmp = ldl_p(mem_buf);
1242
1243     if (n < 32) {
1244         env->regs[n] = tmp;
1245     } else {
1246         env->sregs[n - 32] = tmp;
1247     }
1248     return 4;
1249 }
1250 #elif defined (TARGET_CRIS)
1251
1252 #define NUM_CORE_REGS 49
1253
1254 static int
1255 read_register_crisv10(CPUState *env, uint8_t *mem_buf, int n)
1256 {
1257     if (n < 15) {
1258         GET_REG32(env->regs[n]);
1259     }
1260
1261     if (n == 15) {
1262         GET_REG32(env->pc);
1263     }
1264
1265     if (n < 32) {
1266         switch (n) {
1267         case 16:
1268             GET_REG8(env->pregs[n - 16]);
1269             break;
1270         case 17:
1271             GET_REG8(env->pregs[n - 16]);
1272             break;
1273         case 20:
1274         case 21:
1275             GET_REG16(env->pregs[n - 16]);
1276             break;
1277         default:
1278             if (n >= 23) {
1279                 GET_REG32(env->pregs[n - 16]);
1280             }
1281             break;
1282         }
1283     }
1284     return 0;
1285 }
1286
1287 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1288 {
1289     uint8_t srs;
1290
1291     if (env->pregs[PR_VR] < 32)
1292         return read_register_crisv10(env, mem_buf, n);
1293
1294     srs = env->pregs[PR_SRS];
1295     if (n < 16) {
1296         GET_REG32(env->regs[n]);
1297     }
1298
1299     if (n >= 21 && n < 32) {
1300         GET_REG32(env->pregs[n - 16]);
1301     }
1302     if (n >= 33 && n < 49) {
1303         GET_REG32(env->sregs[srs][n - 33]);
1304     }
1305     switch (n) {
1306     case 16: GET_REG8(env->pregs[0]);
1307     case 17: GET_REG8(env->pregs[1]);
1308     case 18: GET_REG32(env->pregs[2]);
1309     case 19: GET_REG8(srs);
1310     case 20: GET_REG16(env->pregs[4]);
1311     case 32: GET_REG32(env->pc);
1312     }
1313
1314     return 0;
1315 }
1316
1317 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1318 {
1319     uint32_t tmp;
1320
1321     if (n > 49)
1322         return 0;
1323
1324     tmp = ldl_p(mem_buf);
1325
1326     if (n < 16) {
1327         env->regs[n] = tmp;
1328     }
1329
1330     if (n >= 21 && n < 32) {
1331         env->pregs[n - 16] = tmp;
1332     }
1333
1334     /* FIXME: Should support function regs be writable?  */
1335     switch (n) {
1336     case 16: return 1;
1337     case 17: return 1;
1338     case 18: env->pregs[PR_PID] = tmp; break;
1339     case 19: return 1;
1340     case 20: return 2;
1341     case 32: env->pc = tmp; break;
1342     }
1343
1344     return 4;
1345 }
1346 #elif defined (TARGET_ALPHA)
1347
1348 #define NUM_CORE_REGS 67
1349
1350 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1351 {
1352     uint64_t val;
1353     CPU_DoubleU d;
1354
1355     switch (n) {
1356     case 0 ... 30:
1357         val = env->ir[n];
1358         break;
1359     case 32 ... 62:
1360         d.d = env->fir[n - 32];
1361         val = d.ll;
1362         break;
1363     case 63:
1364         val = cpu_alpha_load_fpcr(env);
1365         break;
1366     case 64:
1367         val = env->pc;
1368         break;
1369     case 66:
1370         val = env->unique;
1371         break;
1372     case 31:
1373     case 65:
1374         /* 31 really is the zero register; 65 is unassigned in the
1375            gdb protocol, but is still required to occupy 8 bytes. */
1376         val = 0;
1377         break;
1378     default:
1379         return 0;
1380     }
1381     GET_REGL(val);
1382 }
1383
1384 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1385 {
1386     target_ulong tmp = ldtul_p(mem_buf);
1387     CPU_DoubleU d;
1388
1389     switch (n) {
1390     case 0 ... 30:
1391         env->ir[n] = tmp;
1392         break;
1393     case 32 ... 62:
1394         d.ll = tmp;
1395         env->fir[n - 32] = d.d;
1396         break;
1397     case 63:
1398         cpu_alpha_store_fpcr(env, tmp);
1399         break;
1400     case 64:
1401         env->pc = tmp;
1402         break;
1403     case 66:
1404         env->unique = tmp;
1405         break;
1406     case 31:
1407     case 65:
1408         /* 31 really is the zero register; 65 is unassigned in the
1409            gdb protocol, but is still required to occupy 8 bytes. */
1410         break;
1411     default:
1412         return 0;
1413     }
1414     return 8;
1415 }
1416 #elif defined (TARGET_S390X)
1417
1418 #define NUM_CORE_REGS S390_NUM_TOTAL_REGS
1419
1420 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1421 {
1422     switch (n) {
1423         case S390_PSWM_REGNUM: GET_REGL(env->psw.mask); break;
1424         case S390_PSWA_REGNUM: GET_REGL(env->psw.addr); break;
1425         case S390_R0_REGNUM ... S390_R15_REGNUM:
1426             GET_REGL(env->regs[n-S390_R0_REGNUM]); break;
1427         case S390_A0_REGNUM ... S390_A15_REGNUM:
1428             GET_REG32(env->aregs[n-S390_A0_REGNUM]); break;
1429         case S390_FPC_REGNUM: GET_REG32(env->fpc); break;
1430         case S390_F0_REGNUM ... S390_F15_REGNUM:
1431             /* XXX */
1432             break;
1433         case S390_PC_REGNUM: GET_REGL(env->psw.addr); break;
1434         case S390_CC_REGNUM: GET_REG32(env->cc); break;
1435     }
1436
1437     return 0;
1438 }
1439
1440 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1441 {
1442     target_ulong tmpl;
1443     uint32_t tmp32;
1444     int r = 8;
1445     tmpl = ldtul_p(mem_buf);
1446     tmp32 = ldl_p(mem_buf);
1447
1448     switch (n) {
1449         case S390_PSWM_REGNUM: env->psw.mask = tmpl; break;
1450         case S390_PSWA_REGNUM: env->psw.addr = tmpl; break;
1451         case S390_R0_REGNUM ... S390_R15_REGNUM:
1452             env->regs[n-S390_R0_REGNUM] = tmpl; break;
1453         case S390_A0_REGNUM ... S390_A15_REGNUM:
1454             env->aregs[n-S390_A0_REGNUM] = tmp32; r=4; break;
1455         case S390_FPC_REGNUM: env->fpc = tmp32; r=4; break;
1456         case S390_F0_REGNUM ... S390_F15_REGNUM:
1457             /* XXX */
1458             break;
1459         case S390_PC_REGNUM: env->psw.addr = tmpl; break;
1460         case S390_CC_REGNUM: env->cc = tmp32; r=4; break;
1461     }
1462
1463     return r;
1464 }
1465 #else
1466
1467 #define NUM_CORE_REGS 0
1468
1469 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1470 {
1471     return 0;
1472 }
1473
1474 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1475 {
1476     return 0;
1477 }
1478
1479 #endif
1480
1481 static int num_g_regs = NUM_CORE_REGS;
1482
1483 #ifdef GDB_CORE_XML
1484 /* Encode data using the encoding for 'x' packets.  */
1485 static int memtox(char *buf, const char *mem, int len)
1486 {
1487     char *p = buf;
1488     char c;
1489
1490     while (len--) {
1491         c = *(mem++);
1492         switch (c) {
1493         case '#': case '$': case '*': case '}':
1494             *(p++) = '}';
1495             *(p++) = c ^ 0x20;
1496             break;
1497         default:
1498             *(p++) = c;
1499             break;
1500         }
1501     }
1502     return p - buf;
1503 }
1504
1505 static const char *get_feature_xml(const char *p, const char **newp)
1506 {
1507     size_t len;
1508     int i;
1509     const char *name;
1510     static char target_xml[1024];
1511
1512     len = 0;
1513     while (p[len] && p[len] != ':')
1514         len++;
1515     *newp = p + len;
1516
1517     name = NULL;
1518     if (strncmp(p, "target.xml", len) == 0) {
1519         /* Generate the XML description for this CPU.  */
1520         if (!target_xml[0]) {
1521             GDBRegisterState *r;
1522
1523             snprintf(target_xml, sizeof(target_xml),
1524                      "<?xml version=\"1.0\"?>"
1525                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1526                      "<target>"
1527                      "<xi:include href=\"%s\"/>",
1528                      GDB_CORE_XML);
1529
1530             for (r = first_cpu->gdb_regs; r; r = r->next) {
1531                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
1532                 pstrcat(target_xml, sizeof(target_xml), r->xml);
1533                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
1534             }
1535             pstrcat(target_xml, sizeof(target_xml), "</target>");
1536         }
1537         return target_xml;
1538     }
1539     for (i = 0; ; i++) {
1540         name = xml_builtin[i][0];
1541         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1542             break;
1543     }
1544     return name ? xml_builtin[i][1] : NULL;
1545 }
1546 #endif
1547
1548 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1549 {
1550     GDBRegisterState *r;
1551
1552     if (reg < NUM_CORE_REGS)
1553         return cpu_gdb_read_register(env, mem_buf, reg);
1554
1555     for (r = env->gdb_regs; r; r = r->next) {
1556         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1557             return r->get_reg(env, mem_buf, reg - r->base_reg);
1558         }
1559     }
1560     return 0;
1561 }
1562
1563 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1564 {
1565     GDBRegisterState *r;
1566
1567     if (reg < NUM_CORE_REGS)
1568         return cpu_gdb_write_register(env, mem_buf, reg);
1569
1570     for (r = env->gdb_regs; r; r = r->next) {
1571         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1572             return r->set_reg(env, mem_buf, reg - r->base_reg);
1573         }
1574     }
1575     return 0;
1576 }
1577
1578 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1579    specifies the first register number and these registers are included in
1580    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1581    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1582  */
1583
1584 void gdb_register_coprocessor(CPUState * env,
1585                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1586                              int num_regs, const char *xml, int g_pos)
1587 {
1588     GDBRegisterState *s;
1589     GDBRegisterState **p;
1590     static int last_reg = NUM_CORE_REGS;
1591
1592     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1593     s->base_reg = last_reg;
1594     s->num_regs = num_regs;
1595     s->get_reg = get_reg;
1596     s->set_reg = set_reg;
1597     s->xml = xml;
1598     p = &env->gdb_regs;
1599     while (*p) {
1600         /* Check for duplicates.  */
1601         if (strcmp((*p)->xml, xml) == 0)
1602             return;
1603         p = &(*p)->next;
1604     }
1605     /* Add to end of list.  */
1606     last_reg += num_regs;
1607     *p = s;
1608     if (g_pos) {
1609         if (g_pos != s->base_reg) {
1610             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1611                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1612         } else {
1613             num_g_regs = last_reg;
1614         }
1615     }
1616 }
1617
1618 #ifndef CONFIG_USER_ONLY
1619 static const int xlat_gdb_type[] = {
1620     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1621     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1622     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1623 };
1624 #endif
1625
1626 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1627 {
1628     CPUState *env;
1629     int err = 0;
1630
1631     if (kvm_enabled())
1632         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1633
1634     switch (type) {
1635     case GDB_BREAKPOINT_SW:
1636     case GDB_BREAKPOINT_HW:
1637         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1638             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1639             if (err)
1640                 break;
1641         }
1642         return err;
1643 #ifndef CONFIG_USER_ONLY
1644     case GDB_WATCHPOINT_WRITE:
1645     case GDB_WATCHPOINT_READ:
1646     case GDB_WATCHPOINT_ACCESS:
1647         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1648             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1649                                         NULL);
1650             if (err)
1651                 break;
1652         }
1653         return err;
1654 #endif
1655     default:
1656         return -ENOSYS;
1657     }
1658 }
1659
1660 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1661 {
1662     CPUState *env;
1663     int err = 0;
1664
1665     if (kvm_enabled())
1666         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1667
1668     switch (type) {
1669     case GDB_BREAKPOINT_SW:
1670     case GDB_BREAKPOINT_HW:
1671         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1672             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1673             if (err)
1674                 break;
1675         }
1676         return err;
1677 #ifndef CONFIG_USER_ONLY
1678     case GDB_WATCHPOINT_WRITE:
1679     case GDB_WATCHPOINT_READ:
1680     case GDB_WATCHPOINT_ACCESS:
1681         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1682             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1683             if (err)
1684                 break;
1685         }
1686         return err;
1687 #endif
1688     default:
1689         return -ENOSYS;
1690     }
1691 }
1692
1693 static void gdb_breakpoint_remove_all(void)
1694 {
1695     CPUState *env;
1696
1697     if (kvm_enabled()) {
1698         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1699         return;
1700     }
1701
1702     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1703         cpu_breakpoint_remove_all(env, BP_GDB);
1704 #ifndef CONFIG_USER_ONLY
1705         cpu_watchpoint_remove_all(env, BP_GDB);
1706 #endif
1707     }
1708 }
1709
1710 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1711 {
1712 #if defined(TARGET_I386)
1713     cpu_synchronize_state(s->c_cpu);
1714     s->c_cpu->eip = pc;
1715 #elif defined (TARGET_PPC)
1716     s->c_cpu->nip = pc;
1717 #elif defined (TARGET_SPARC)
1718     s->c_cpu->pc = pc;
1719     s->c_cpu->npc = pc + 4;
1720 #elif defined (TARGET_ARM)
1721     s->c_cpu->regs[15] = pc;
1722 #elif defined (TARGET_SH4)
1723     s->c_cpu->pc = pc;
1724 #elif defined (TARGET_MIPS)
1725     s->c_cpu->active_tc.PC = pc & ~(target_ulong)1;
1726     if (pc & 1) {
1727         s->c_cpu->hflags |= MIPS_HFLAG_M16;
1728     } else {
1729         s->c_cpu->hflags &= ~(MIPS_HFLAG_M16);
1730     }
1731 #elif defined (TARGET_MICROBLAZE)
1732     s->c_cpu->sregs[SR_PC] = pc;
1733 #elif defined (TARGET_CRIS)
1734     s->c_cpu->pc = pc;
1735 #elif defined (TARGET_ALPHA)
1736     s->c_cpu->pc = pc;
1737 #elif defined (TARGET_S390X)
1738     cpu_synchronize_state(s->c_cpu);
1739     s->c_cpu->psw.addr = pc;
1740 #endif
1741 }
1742
1743 static inline int gdb_id(CPUState *env)
1744 {
1745 #if defined(CONFIG_USER_ONLY) && defined(CONFIG_USE_NPTL)
1746     return env->host_tid;
1747 #else
1748     return env->cpu_index + 1;
1749 #endif
1750 }
1751
1752 static CPUState *find_cpu(uint32_t thread_id)
1753 {
1754     CPUState *env;
1755
1756     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1757         if (gdb_id(env) == thread_id) {
1758             return env;
1759         }
1760     }
1761
1762     return NULL;
1763 }
1764
1765 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1766 {
1767     CPUState *env;
1768     const char *p;
1769     uint32_t thread;
1770     int ch, reg_size, type, res;
1771     char buf[MAX_PACKET_LENGTH];
1772     uint8_t mem_buf[MAX_PACKET_LENGTH];
1773     uint8_t *registers;
1774     target_ulong addr, len;
1775
1776 #ifdef DEBUG_GDB
1777     printf("command='%s'\n", line_buf);
1778 #endif
1779     p = line_buf;
1780     ch = *p++;
1781     switch(ch) {
1782     case '?':
1783         /* TODO: Make this return the correct value for user-mode.  */
1784         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1785                  gdb_id(s->c_cpu));
1786         put_packet(s, buf);
1787         /* Remove all the breakpoints when this query is issued,
1788          * because gdb is doing and initial connect and the state
1789          * should be cleaned up.
1790          */
1791         gdb_breakpoint_remove_all();
1792         break;
1793     case 'c':
1794         if (*p != '\0') {
1795             addr = strtoull(p, (char **)&p, 16);
1796             gdb_set_cpu_pc(s, addr);
1797         }
1798         s->signal = 0;
1799         gdb_continue(s);
1800         return RS_IDLE;
1801     case 'C':
1802         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1803         if (s->signal == -1)
1804             s->signal = 0;
1805         gdb_continue(s);
1806         return RS_IDLE;
1807     case 'v':
1808         if (strncmp(p, "Cont", 4) == 0) {
1809             int res_signal, res_thread;
1810
1811             p += 4;
1812             if (*p == '?') {
1813                 put_packet(s, "vCont;c;C;s;S");
1814                 break;
1815             }
1816             res = 0;
1817             res_signal = 0;
1818             res_thread = 0;
1819             while (*p) {
1820                 int action, signal;
1821
1822                 if (*p++ != ';') {
1823                     res = 0;
1824                     break;
1825                 }
1826                 action = *p++;
1827                 signal = 0;
1828                 if (action == 'C' || action == 'S') {
1829                     signal = strtoul(p, (char **)&p, 16);
1830                 } else if (action != 'c' && action != 's') {
1831                     res = 0;
1832                     break;
1833                 }
1834                 thread = 0;
1835                 if (*p == ':') {
1836                     thread = strtoull(p+1, (char **)&p, 16);
1837                 }
1838                 action = tolower(action);
1839                 if (res == 0 || (res == 'c' && action == 's')) {
1840                     res = action;
1841                     res_signal = signal;
1842                     res_thread = thread;
1843                 }
1844             }
1845             if (res) {
1846                 if (res_thread != -1 && res_thread != 0) {
1847                     env = find_cpu(res_thread);
1848                     if (env == NULL) {
1849                         put_packet(s, "E22");
1850                         break;
1851                     }
1852                     s->c_cpu = env;
1853                 }
1854                 if (res == 's') {
1855                     cpu_single_step(s->c_cpu, sstep_flags);
1856                 }
1857                 s->signal = res_signal;
1858                 gdb_continue(s);
1859                 return RS_IDLE;
1860             }
1861             break;
1862         } else {
1863             goto unknown_command;
1864         }
1865     case 'k':
1866         /* Kill the target */
1867         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1868         exit(0);
1869     case 'D':
1870         /* Detach packet */
1871         gdb_breakpoint_remove_all();
1872         gdb_syscall_mode = GDB_SYS_DISABLED;
1873         gdb_continue(s);
1874         put_packet(s, "OK");
1875         break;
1876     case 's':
1877         if (*p != '\0') {
1878             addr = strtoull(p, (char **)&p, 16);
1879             gdb_set_cpu_pc(s, addr);
1880         }
1881         cpu_single_step(s->c_cpu, sstep_flags);
1882         gdb_continue(s);
1883         return RS_IDLE;
1884     case 'F':
1885         {
1886             target_ulong ret;
1887             target_ulong err;
1888
1889             ret = strtoull(p, (char **)&p, 16);
1890             if (*p == ',') {
1891                 p++;
1892                 err = strtoull(p, (char **)&p, 16);
1893             } else {
1894                 err = 0;
1895             }
1896             if (*p == ',')
1897                 p++;
1898             type = *p;
1899             if (gdb_current_syscall_cb)
1900                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1901             if (type == 'C') {
1902                 put_packet(s, "T02");
1903             } else {
1904                 gdb_continue(s);
1905             }
1906         }
1907         break;
1908     case 'g':
1909         cpu_synchronize_state(s->g_cpu);
1910         len = 0;
1911         for (addr = 0; addr < num_g_regs; addr++) {
1912             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1913             len += reg_size;
1914         }
1915         memtohex(buf, mem_buf, len);
1916         put_packet(s, buf);
1917         break;
1918     case 'G':
1919         cpu_synchronize_state(s->g_cpu);
1920         registers = mem_buf;
1921         len = strlen(p) / 2;
1922         hextomem((uint8_t *)registers, p, len);
1923         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1924             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1925             len -= reg_size;
1926             registers += reg_size;
1927         }
1928         put_packet(s, "OK");
1929         break;
1930     case 'm':
1931         addr = strtoull(p, (char **)&p, 16);
1932         if (*p == ',')
1933             p++;
1934         len = strtoull(p, NULL, 16);
1935         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1936             put_packet (s, "E14");
1937         } else {
1938             memtohex(buf, mem_buf, len);
1939             put_packet(s, buf);
1940         }
1941         break;
1942     case 'M':
1943         addr = strtoull(p, (char **)&p, 16);
1944         if (*p == ',')
1945             p++;
1946         len = strtoull(p, (char **)&p, 16);
1947         if (*p == ':')
1948             p++;
1949         hextomem(mem_buf, p, len);
1950         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1951             put_packet(s, "E14");
1952         else
1953             put_packet(s, "OK");
1954         break;
1955     case 'p':
1956         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1957            This works, but can be very slow.  Anything new enough to
1958            understand XML also knows how to use this properly.  */
1959         if (!gdb_has_xml)
1960             goto unknown_command;
1961         addr = strtoull(p, (char **)&p, 16);
1962         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1963         if (reg_size) {
1964             memtohex(buf, mem_buf, reg_size);
1965             put_packet(s, buf);
1966         } else {
1967             put_packet(s, "E14");
1968         }
1969         break;
1970     case 'P':
1971         if (!gdb_has_xml)
1972             goto unknown_command;
1973         addr = strtoull(p, (char **)&p, 16);
1974         if (*p == '=')
1975             p++;
1976         reg_size = strlen(p) / 2;
1977         hextomem(mem_buf, p, reg_size);
1978         gdb_write_register(s->g_cpu, mem_buf, addr);
1979         put_packet(s, "OK");
1980         break;
1981     case 'Z':
1982     case 'z':
1983         type = strtoul(p, (char **)&p, 16);
1984         if (*p == ',')
1985             p++;
1986         addr = strtoull(p, (char **)&p, 16);
1987         if (*p == ',')
1988             p++;
1989         len = strtoull(p, (char **)&p, 16);
1990         if (ch == 'Z')
1991             res = gdb_breakpoint_insert(addr, len, type);
1992         else
1993             res = gdb_breakpoint_remove(addr, len, type);
1994         if (res >= 0)
1995              put_packet(s, "OK");
1996         else if (res == -ENOSYS)
1997             put_packet(s, "");
1998         else
1999             put_packet(s, "E22");
2000         break;
2001     case 'H':
2002         type = *p++;
2003         thread = strtoull(p, (char **)&p, 16);
2004         if (thread == -1 || thread == 0) {
2005             put_packet(s, "OK");
2006             break;
2007         }
2008         env = find_cpu(thread);
2009         if (env == NULL) {
2010             put_packet(s, "E22");
2011             break;
2012         }
2013         switch (type) {
2014         case 'c':
2015             s->c_cpu = env;
2016             put_packet(s, "OK");
2017             break;
2018         case 'g':
2019             s->g_cpu = env;
2020             put_packet(s, "OK");
2021             break;
2022         default:
2023              put_packet(s, "E22");
2024              break;
2025         }
2026         break;
2027     case 'T':
2028         thread = strtoull(p, (char **)&p, 16);
2029         env = find_cpu(thread);
2030
2031         if (env != NULL) {
2032             put_packet(s, "OK");
2033         } else {
2034             put_packet(s, "E22");
2035         }
2036         break;
2037     case 'q':
2038     case 'Q':
2039         /* parse any 'q' packets here */
2040         if (!strcmp(p,"qemu.sstepbits")) {
2041             /* Query Breakpoint bit definitions */
2042             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
2043                      SSTEP_ENABLE,
2044                      SSTEP_NOIRQ,
2045                      SSTEP_NOTIMER);
2046             put_packet(s, buf);
2047             break;
2048         } else if (strncmp(p,"qemu.sstep",10) == 0) {
2049             /* Display or change the sstep_flags */
2050             p += 10;
2051             if (*p != '=') {
2052                 /* Display current setting */
2053                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
2054                 put_packet(s, buf);
2055                 break;
2056             }
2057             p++;
2058             type = strtoul(p, (char **)&p, 16);
2059             sstep_flags = type;
2060             put_packet(s, "OK");
2061             break;
2062         } else if (strcmp(p,"C") == 0) {
2063             /* "Current thread" remains vague in the spec, so always return
2064              *  the first CPU (gdb returns the first thread). */
2065             put_packet(s, "QC1");
2066             break;
2067         } else if (strcmp(p,"fThreadInfo") == 0) {
2068             s->query_cpu = first_cpu;
2069             goto report_cpuinfo;
2070         } else if (strcmp(p,"sThreadInfo") == 0) {
2071         report_cpuinfo:
2072             if (s->query_cpu) {
2073                 snprintf(buf, sizeof(buf), "m%x", gdb_id(s->query_cpu));
2074                 put_packet(s, buf);
2075                 s->query_cpu = s->query_cpu->next_cpu;
2076             } else
2077                 put_packet(s, "l");
2078             break;
2079         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
2080             thread = strtoull(p+16, (char **)&p, 16);
2081             env = find_cpu(thread);
2082             if (env != NULL) {
2083                 cpu_synchronize_state(env);
2084                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
2085                                "CPU#%d [%s]", env->cpu_index,
2086                                env->halted ? "halted " : "running");
2087                 memtohex(buf, mem_buf, len);
2088                 put_packet(s, buf);
2089             }
2090             break;
2091         }
2092 #ifdef CONFIG_USER_ONLY
2093         else if (strncmp(p, "Offsets", 7) == 0) {
2094             TaskState *ts = s->c_cpu->opaque;
2095
2096             snprintf(buf, sizeof(buf),
2097                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
2098                      ";Bss=" TARGET_ABI_FMT_lx,
2099                      ts->info->code_offset,
2100                      ts->info->data_offset,
2101                      ts->info->data_offset);
2102             put_packet(s, buf);
2103             break;
2104         }
2105 #else /* !CONFIG_USER_ONLY */
2106         else if (strncmp(p, "Rcmd,", 5) == 0) {
2107             int len = strlen(p + 5);
2108
2109             if ((len % 2) != 0) {
2110                 put_packet(s, "E01");
2111                 break;
2112             }
2113             hextomem(mem_buf, p + 5, len);
2114             len = len / 2;
2115             mem_buf[len++] = 0;
2116             qemu_chr_read(s->mon_chr, mem_buf, len);
2117             put_packet(s, "OK");
2118             break;
2119         }
2120 #endif /* !CONFIG_USER_ONLY */
2121         if (strncmp(p, "Supported", 9) == 0) {
2122             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
2123 #ifdef GDB_CORE_XML
2124             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
2125 #endif
2126             put_packet(s, buf);
2127             break;
2128         }
2129 #ifdef GDB_CORE_XML
2130         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
2131             const char *xml;
2132             target_ulong total_len;
2133
2134             gdb_has_xml = 1;
2135             p += 19;
2136             xml = get_feature_xml(p, &p);
2137             if (!xml) {
2138                 snprintf(buf, sizeof(buf), "E00");
2139                 put_packet(s, buf);
2140                 break;
2141             }
2142
2143             if (*p == ':')
2144                 p++;
2145             addr = strtoul(p, (char **)&p, 16);
2146             if (*p == ',')
2147                 p++;
2148             len = strtoul(p, (char **)&p, 16);
2149
2150             total_len = strlen(xml);
2151             if (addr > total_len) {
2152                 snprintf(buf, sizeof(buf), "E00");
2153                 put_packet(s, buf);
2154                 break;
2155             }
2156             if (len > (MAX_PACKET_LENGTH - 5) / 2)
2157                 len = (MAX_PACKET_LENGTH - 5) / 2;
2158             if (len < total_len - addr) {
2159                 buf[0] = 'm';
2160                 len = memtox(buf + 1, xml + addr, len);
2161             } else {
2162                 buf[0] = 'l';
2163                 len = memtox(buf + 1, xml + addr, total_len - addr);
2164             }
2165             put_packet_binary(s, buf, len + 1);
2166             break;
2167         }
2168 #endif
2169         /* Unrecognised 'q' command.  */
2170         goto unknown_command;
2171
2172     default:
2173     unknown_command:
2174         /* put empty packet */
2175         buf[0] = '\0';
2176         put_packet(s, buf);
2177         break;
2178     }
2179     return RS_IDLE;
2180 }
2181
2182 void gdb_set_stop_cpu(CPUState *env)
2183 {
2184     gdbserver_state->c_cpu = env;
2185     gdbserver_state->g_cpu = env;
2186 }
2187
2188 #ifndef CONFIG_USER_ONLY
2189 static void gdb_vm_state_change(void *opaque, int running, int reason)
2190 {
2191     GDBState *s = gdbserver_state;
2192     CPUState *env = s->c_cpu;
2193     char buf[256];
2194     const char *type;
2195     int ret;
2196
2197     if (running || (reason != VMSTOP_DEBUG && reason != VMSTOP_USER) ||
2198         s->state == RS_INACTIVE || s->state == RS_SYSCALL) {
2199         return;
2200     }
2201     /* disable single step if it was enable */
2202     cpu_single_step(env, 0);
2203
2204     if (reason == VMSTOP_DEBUG) {
2205         if (env->watchpoint_hit) {
2206             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
2207             case BP_MEM_READ:
2208                 type = "r";
2209                 break;
2210             case BP_MEM_ACCESS:
2211                 type = "a";
2212                 break;
2213             default:
2214                 type = "";
2215                 break;
2216             }
2217             snprintf(buf, sizeof(buf),
2218                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
2219                      GDB_SIGNAL_TRAP, gdb_id(env), type,
2220                      env->watchpoint_hit->vaddr);
2221             put_packet(s, buf);
2222             env->watchpoint_hit = NULL;
2223             return;
2224         }
2225         tb_flush(env);
2226         ret = GDB_SIGNAL_TRAP;
2227     } else {
2228         ret = GDB_SIGNAL_INT;
2229     }
2230     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, gdb_id(env));
2231     put_packet(s, buf);
2232 }
2233 #endif
2234
2235 /* Send a gdb syscall request.
2236    This accepts limited printf-style format specifiers, specifically:
2237     %x  - target_ulong argument printed in hex.
2238     %lx - 64-bit argument printed in hex.
2239     %s  - string pointer (target_ulong) and length (int) pair.  */
2240 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
2241 {
2242     va_list va;
2243     char buf[256];
2244     char *p;
2245     target_ulong addr;
2246     uint64_t i64;
2247     GDBState *s;
2248
2249     s = gdbserver_state;
2250     if (!s)
2251         return;
2252     gdb_current_syscall_cb = cb;
2253     s->state = RS_SYSCALL;
2254 #ifndef CONFIG_USER_ONLY
2255     vm_stop(VMSTOP_DEBUG);
2256 #endif
2257     s->state = RS_IDLE;
2258     va_start(va, fmt);
2259     p = buf;
2260     *(p++) = 'F';
2261     while (*fmt) {
2262         if (*fmt == '%') {
2263             fmt++;
2264             switch (*fmt++) {
2265             case 'x':
2266                 addr = va_arg(va, target_ulong);
2267                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
2268                 break;
2269             case 'l':
2270                 if (*(fmt++) != 'x')
2271                     goto bad_format;
2272                 i64 = va_arg(va, uint64_t);
2273                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
2274                 break;
2275             case 's':
2276                 addr = va_arg(va, target_ulong);
2277                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
2278                               addr, va_arg(va, int));
2279                 break;
2280             default:
2281             bad_format:
2282                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2283                         fmt - 1);
2284                 break;
2285             }
2286         } else {
2287             *(p++) = *(fmt++);
2288         }
2289     }
2290     *p = 0;
2291     va_end(va);
2292     put_packet(s, buf);
2293 #ifdef CONFIG_USER_ONLY
2294     gdb_handlesig(s->c_cpu, 0);
2295 #else
2296     cpu_exit(s->c_cpu);
2297 #endif
2298 }
2299
2300 static void gdb_read_byte(GDBState *s, int ch)
2301 {
2302     int i, csum;
2303     uint8_t reply;
2304
2305 #ifndef CONFIG_USER_ONLY
2306     if (s->last_packet_len) {
2307         /* Waiting for a response to the last packet.  If we see the start
2308            of a new command then abandon the previous response.  */
2309         if (ch == '-') {
2310 #ifdef DEBUG_GDB
2311             printf("Got NACK, retransmitting\n");
2312 #endif
2313             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2314         }
2315 #ifdef DEBUG_GDB
2316         else if (ch == '+')
2317             printf("Got ACK\n");
2318         else
2319             printf("Got '%c' when expecting ACK/NACK\n", ch);
2320 #endif
2321         if (ch == '+' || ch == '$')
2322             s->last_packet_len = 0;
2323         if (ch != '$')
2324             return;
2325     }
2326     if (vm_running) {
2327         /* when the CPU is running, we cannot do anything except stop
2328            it when receiving a char */
2329         vm_stop(VMSTOP_USER);
2330     } else
2331 #endif
2332     {
2333         switch(s->state) {
2334         case RS_IDLE:
2335             if (ch == '$') {
2336                 s->line_buf_index = 0;
2337                 s->state = RS_GETLINE;
2338             }
2339             break;
2340         case RS_GETLINE:
2341             if (ch == '#') {
2342             s->state = RS_CHKSUM1;
2343             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2344                 s->state = RS_IDLE;
2345             } else {
2346             s->line_buf[s->line_buf_index++] = ch;
2347             }
2348             break;
2349         case RS_CHKSUM1:
2350             s->line_buf[s->line_buf_index] = '\0';
2351             s->line_csum = fromhex(ch) << 4;
2352             s->state = RS_CHKSUM2;
2353             break;
2354         case RS_CHKSUM2:
2355             s->line_csum |= fromhex(ch);
2356             csum = 0;
2357             for(i = 0; i < s->line_buf_index; i++) {
2358                 csum += s->line_buf[i];
2359             }
2360             if (s->line_csum != (csum & 0xff)) {
2361                 reply = '-';
2362                 put_buffer(s, &reply, 1);
2363                 s->state = RS_IDLE;
2364             } else {
2365                 reply = '+';
2366                 put_buffer(s, &reply, 1);
2367                 s->state = gdb_handle_packet(s, s->line_buf);
2368             }
2369             break;
2370         default:
2371             abort();
2372         }
2373     }
2374 }
2375
2376 /* Tell the remote gdb that the process has exited.  */
2377 void gdb_exit(CPUState *env, int code)
2378 {
2379   GDBState *s;
2380   char buf[4];
2381
2382   s = gdbserver_state;
2383   if (!s) {
2384       return;
2385   }
2386 #ifdef CONFIG_USER_ONLY
2387   if (gdbserver_fd < 0 || s->fd < 0) {
2388       return;
2389   }
2390 #endif
2391
2392   snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
2393   put_packet(s, buf);
2394
2395 #ifndef CONFIG_USER_ONLY
2396   if (s->chr) {
2397       qemu_chr_close(s->chr);
2398   }
2399 #endif
2400 }
2401
2402 #ifdef CONFIG_USER_ONLY
2403 int
2404 gdb_queuesig (void)
2405 {
2406     GDBState *s;
2407
2408     s = gdbserver_state;
2409
2410     if (gdbserver_fd < 0 || s->fd < 0)
2411         return 0;
2412     else
2413         return 1;
2414 }
2415
2416 int
2417 gdb_handlesig (CPUState *env, int sig)
2418 {
2419   GDBState *s;
2420   char buf[256];
2421   int n;
2422
2423   s = gdbserver_state;
2424   if (gdbserver_fd < 0 || s->fd < 0)
2425     return sig;
2426
2427   /* disable single step if it was enabled */
2428   cpu_single_step(env, 0);
2429   tb_flush(env);
2430
2431   if (sig != 0)
2432     {
2433       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2434       put_packet(s, buf);
2435     }
2436   /* put_packet() might have detected that the peer terminated the
2437      connection.  */
2438   if (s->fd < 0)
2439       return sig;
2440
2441   sig = 0;
2442   s->state = RS_IDLE;
2443   s->running_state = 0;
2444   while (s->running_state == 0) {
2445       n = read (s->fd, buf, 256);
2446       if (n > 0)
2447         {
2448           int i;
2449
2450           for (i = 0; i < n; i++)
2451             gdb_read_byte (s, buf[i]);
2452         }
2453       else if (n == 0 || errno != EAGAIN)
2454         {
2455           /* XXX: Connection closed.  Should probably wait for annother
2456              connection before continuing.  */
2457           return sig;
2458         }
2459   }
2460   sig = s->signal;
2461   s->signal = 0;
2462   return sig;
2463 }
2464
2465 /* Tell the remote gdb that the process has exited due to SIG.  */
2466 void gdb_signalled(CPUState *env, int sig)
2467 {
2468   GDBState *s;
2469   char buf[4];
2470
2471   s = gdbserver_state;
2472   if (gdbserver_fd < 0 || s->fd < 0)
2473     return;
2474
2475   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2476   put_packet(s, buf);
2477 }
2478
2479 static void gdb_accept(void)
2480 {
2481     GDBState *s;
2482     struct sockaddr_in sockaddr;
2483     socklen_t len;
2484     int val, fd;
2485
2486     for(;;) {
2487         len = sizeof(sockaddr);
2488         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2489         if (fd < 0 && errno != EINTR) {
2490             perror("accept");
2491             return;
2492         } else if (fd >= 0) {
2493 #ifndef _WIN32
2494             fcntl(fd, F_SETFD, FD_CLOEXEC);
2495 #endif
2496             break;
2497         }
2498     }
2499
2500     /* set short latency */
2501     val = 1;
2502     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2503
2504     s = qemu_mallocz(sizeof(GDBState));
2505     s->c_cpu = first_cpu;
2506     s->g_cpu = first_cpu;
2507     s->fd = fd;
2508     gdb_has_xml = 0;
2509
2510     gdbserver_state = s;
2511
2512     fcntl(fd, F_SETFL, O_NONBLOCK);
2513 }
2514
2515 static int gdbserver_open(int port)
2516 {
2517     struct sockaddr_in sockaddr;
2518     int fd, val, ret;
2519
2520     fd = socket(PF_INET, SOCK_STREAM, 0);
2521     if (fd < 0) {
2522         perror("socket");
2523         return -1;
2524     }
2525 #ifndef _WIN32
2526     fcntl(fd, F_SETFD, FD_CLOEXEC);
2527 #endif
2528
2529     /* allow fast reuse */
2530     val = 1;
2531     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2532
2533     sockaddr.sin_family = AF_INET;
2534     sockaddr.sin_port = htons(port);
2535     sockaddr.sin_addr.s_addr = 0;
2536     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2537     if (ret < 0) {
2538         perror("bind");
2539         return -1;
2540     }
2541     ret = listen(fd, 0);
2542     if (ret < 0) {
2543         perror("listen");
2544         return -1;
2545     }
2546     return fd;
2547 }
2548
2549 int gdbserver_start(int port)
2550 {
2551     gdbserver_fd = gdbserver_open(port);
2552     if (gdbserver_fd < 0)
2553         return -1;
2554     /* accept connections */
2555     gdb_accept();
2556     return 0;
2557 }
2558
2559 /* Disable gdb stub for child processes.  */
2560 void gdbserver_fork(CPUState *env)
2561 {
2562     GDBState *s = gdbserver_state;
2563     if (gdbserver_fd < 0 || s->fd < 0)
2564       return;
2565     close(s->fd);
2566     s->fd = -1;
2567     cpu_breakpoint_remove_all(env, BP_GDB);
2568     cpu_watchpoint_remove_all(env, BP_GDB);
2569 }
2570 #else
2571 static int gdb_chr_can_receive(void *opaque)
2572 {
2573   /* We can handle an arbitrarily large amount of data.
2574    Pick the maximum packet size, which is as good as anything.  */
2575   return MAX_PACKET_LENGTH;
2576 }
2577
2578 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2579 {
2580     int i;
2581
2582     for (i = 0; i < size; i++) {
2583         gdb_read_byte(gdbserver_state, buf[i]);
2584     }
2585 }
2586
2587 static void gdb_chr_event(void *opaque, int event)
2588 {
2589     switch (event) {
2590     case CHR_EVENT_OPENED:
2591         vm_stop(VMSTOP_USER);
2592         gdb_has_xml = 0;
2593         break;
2594     default:
2595         break;
2596     }
2597 }
2598
2599 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2600 {
2601     char buf[MAX_PACKET_LENGTH];
2602
2603     buf[0] = 'O';
2604     if (len > (MAX_PACKET_LENGTH/2) - 1)
2605         len = (MAX_PACKET_LENGTH/2) - 1;
2606     memtohex(buf + 1, (uint8_t *)msg, len);
2607     put_packet(s, buf);
2608 }
2609
2610 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2611 {
2612     const char *p = (const char *)buf;
2613     int max_sz;
2614
2615     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2616     for (;;) {
2617         if (len <= max_sz) {
2618             gdb_monitor_output(gdbserver_state, p, len);
2619             break;
2620         }
2621         gdb_monitor_output(gdbserver_state, p, max_sz);
2622         p += max_sz;
2623         len -= max_sz;
2624     }
2625     return len;
2626 }
2627
2628 #ifndef _WIN32
2629 static void gdb_sigterm_handler(int signal)
2630 {
2631     if (vm_running) {
2632         vm_stop(VMSTOP_USER);
2633     }
2634 }
2635 #endif
2636
2637 int gdbserver_start(const char *device)
2638 {
2639     GDBState *s;
2640     char gdbstub_device_name[128];
2641     CharDriverState *chr = NULL;
2642     CharDriverState *mon_chr;
2643
2644     if (!device)
2645         return -1;
2646     if (strcmp(device, "none") != 0) {
2647         if (strstart(device, "tcp:", NULL)) {
2648             /* enforce required TCP attributes */
2649             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2650                      "%s,nowait,nodelay,server", device);
2651             device = gdbstub_device_name;
2652         }
2653 #ifndef _WIN32
2654         else if (strcmp(device, "stdio") == 0) {
2655             struct sigaction act;
2656
2657             memset(&act, 0, sizeof(act));
2658             act.sa_handler = gdb_sigterm_handler;
2659             sigaction(SIGINT, &act, NULL);
2660         }
2661 #endif
2662         chr = qemu_chr_open("gdb", device, NULL);
2663         if (!chr)
2664             return -1;
2665
2666         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2667                               gdb_chr_event, NULL);
2668     }
2669
2670     s = gdbserver_state;
2671     if (!s) {
2672         s = qemu_mallocz(sizeof(GDBState));
2673         gdbserver_state = s;
2674
2675         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2676
2677         /* Initialize a monitor terminal for gdb */
2678         mon_chr = qemu_mallocz(sizeof(*mon_chr));
2679         mon_chr->chr_write = gdb_monitor_write;
2680         monitor_init(mon_chr, 0);
2681     } else {
2682         if (s->chr)
2683             qemu_chr_close(s->chr);
2684         mon_chr = s->mon_chr;
2685         memset(s, 0, sizeof(GDBState));
2686     }
2687     s->c_cpu = first_cpu;
2688     s->g_cpu = first_cpu;
2689     s->chr = chr;
2690     s->state = chr ? RS_IDLE : RS_INACTIVE;
2691     s->mon_chr = mon_chr;
2692
2693     return 0;
2694 }
2695 #endif