gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "qemu-common.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "monitor.h"
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #endif
  37 #include "qemu-kvm.h"
  38
  39 #define MAX_PACKET_LENGTH 4096
  40
  41 #include "qemu_socket.h"
  42 #include "kvm.h"
  43
  44
  45 enum {
  46     GDB_SIGNAL_0 = 0,
  47     GDB_SIGNAL_INT = 2,
  48     GDB_SIGNAL_TRAP = 5,
  49     GDB_SIGNAL_UNKNOWN = 143
  50 };
  51
  52 #ifdef CONFIG_USER_ONLY
  53
  54 /* Map target signal numbers to GDB protocol signal numbers and vice
  55  * versa.  For user emulation's currently supported systems, we can
  56  * assume most signals are defined.
  57  */
  58
  59 static int gdb_signal_table[] = {
  60     0,
  61     TARGET_SIGHUP,
  62     TARGET_SIGINT,
  63     TARGET_SIGQUIT,
  64     TARGET_SIGILL,
  65     TARGET_SIGTRAP,
  66     TARGET_SIGABRT,
  67     -1, /* SIGEMT */
  68     TARGET_SIGFPE,
  69     TARGET_SIGKILL,
  70     TARGET_SIGBUS,
  71     TARGET_SIGSEGV,
  72     TARGET_SIGSYS,
  73     TARGET_SIGPIPE,
  74     TARGET_SIGALRM,
  75     TARGET_SIGTERM,
  76     TARGET_SIGURG,
  77     TARGET_SIGSTOP,
  78     TARGET_SIGTSTP,
  79     TARGET_SIGCONT,
  80     TARGET_SIGCHLD,
  81     TARGET_SIGTTIN,
  82     TARGET_SIGTTOU,
  83     TARGET_SIGIO,
  84     TARGET_SIGXCPU,
  85     TARGET_SIGXFSZ,
  86     TARGET_SIGVTALRM,
  87     TARGET_SIGPROF,
  88     TARGET_SIGWINCH,
  89     -1, /* SIGLOST */
  90     TARGET_SIGUSR1,
  91     TARGET_SIGUSR2,
  92 #ifdef TARGET_SIGPWR
  93     TARGET_SIGPWR,
  94 #else
  95     -1,
  96 #endif
  97     -1, /* SIGPOLL */
  98     -1,
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108     -1,
 109 #ifdef __SIGRTMIN
 110     __SIGRTMIN + 1,
 111     __SIGRTMIN + 2,
 112     __SIGRTMIN + 3,
 113     __SIGRTMIN + 4,
 114     __SIGRTMIN + 5,
 115     __SIGRTMIN + 6,
 116     __SIGRTMIN + 7,
 117     __SIGRTMIN + 8,
 118     __SIGRTMIN + 9,
 119     __SIGRTMIN + 10,
 120     __SIGRTMIN + 11,
 121     __SIGRTMIN + 12,
 122     __SIGRTMIN + 13,
 123     __SIGRTMIN + 14,
 124     __SIGRTMIN + 15,
 125     __SIGRTMIN + 16,
 126     __SIGRTMIN + 17,
 127     __SIGRTMIN + 18,
 128     __SIGRTMIN + 19,
 129     __SIGRTMIN + 20,
 130     __SIGRTMIN + 21,
 131     __SIGRTMIN + 22,
 132     __SIGRTMIN + 23,
 133     __SIGRTMIN + 24,
 134     __SIGRTMIN + 25,
 135     __SIGRTMIN + 26,
 136     __SIGRTMIN + 27,
 137     __SIGRTMIN + 28,
 138     __SIGRTMIN + 29,
 139     __SIGRTMIN + 30,
 140     __SIGRTMIN + 31,
 141     -1, /* SIGCANCEL */
 142     __SIGRTMIN,
 143     __SIGRTMIN + 32,
 144     __SIGRTMIN + 33,
 145     __SIGRTMIN + 34,
 146     __SIGRTMIN + 35,
 147     __SIGRTMIN + 36,
 148     __SIGRTMIN + 37,
 149     __SIGRTMIN + 38,
 150     __SIGRTMIN + 39,
 151     __SIGRTMIN + 40,
 152     __SIGRTMIN + 41,
 153     __SIGRTMIN + 42,
 154     __SIGRTMIN + 43,
 155     __SIGRTMIN + 44,
 156     __SIGRTMIN + 45,
 157     __SIGRTMIN + 46,
 158     __SIGRTMIN + 47,
 159     __SIGRTMIN + 48,
 160     __SIGRTMIN + 49,
 161     __SIGRTMIN + 50,
 162     __SIGRTMIN + 51,
 163     __SIGRTMIN + 52,
 164     __SIGRTMIN + 53,
 165     __SIGRTMIN + 54,
 166     __SIGRTMIN + 55,
 167     __SIGRTMIN + 56,
 168     __SIGRTMIN + 57,
 169     __SIGRTMIN + 58,
 170     __SIGRTMIN + 59,
 171     __SIGRTMIN + 60,
 172     __SIGRTMIN + 61,
 173     __SIGRTMIN + 62,
 174     __SIGRTMIN + 63,
 175     __SIGRTMIN + 64,
 176     __SIGRTMIN + 65,
 177     __SIGRTMIN + 66,
 178     __SIGRTMIN + 67,
 179     __SIGRTMIN + 68,
 180     __SIGRTMIN + 69,
 181     __SIGRTMIN + 70,
 182     __SIGRTMIN + 71,
 183     __SIGRTMIN + 72,
 184     __SIGRTMIN + 73,
 185     __SIGRTMIN + 74,
 186     __SIGRTMIN + 75,
 187     __SIGRTMIN + 76,
 188     __SIGRTMIN + 77,
 189     __SIGRTMIN + 78,
 190     __SIGRTMIN + 79,
 191     __SIGRTMIN + 80,
 192     __SIGRTMIN + 81,
 193     __SIGRTMIN + 82,
 194     __SIGRTMIN + 83,
 195     __SIGRTMIN + 84,
 196     __SIGRTMIN + 85,
 197     __SIGRTMIN + 86,
 198     __SIGRTMIN + 87,
 199     __SIGRTMIN + 88,
 200     __SIGRTMIN + 89,
 201     __SIGRTMIN + 90,
 202     __SIGRTMIN + 91,
 203     __SIGRTMIN + 92,
 204     __SIGRTMIN + 93,
 205     __SIGRTMIN + 94,
 206     __SIGRTMIN + 95,
 207     -1, /* SIGINFO */
 208     -1, /* UNKNOWN */
 209     -1, /* DEFAULT */
 210     -1,
 211     -1,
 212     -1,
 213     -1,
 214     -1,
 215     -1
 216 #endif
 217 };
 218 #else
 219 /* In system mode we only need SIGINT and SIGTRAP; other signals
 220    are not yet supported.  */
 221
 222 enum {
 223     TARGET_SIGINT = 2,
 224     TARGET_SIGTRAP = 5
 225 };
 226
 227 static int gdb_signal_table[] = {
 228     -1,
 229     -1,
 230     TARGET_SIGINT,
 231     -1,
 232     -1,
 233     TARGET_SIGTRAP
 234 };
 235 #endif
 236
 237 #ifdef CONFIG_USER_ONLY
 238 static int target_signal_to_gdb (int sig)
 239 {
 240     int i;
 241     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 242         if (gdb_signal_table[i] == sig)
 243             return i;
 244     return GDB_SIGNAL_UNKNOWN;
 245 }
 246 #endif
 247
 248 static int gdb_signal_to_target (int sig)
 249 {
 250     if (sig < ARRAY_SIZE (gdb_signal_table))
 251         return gdb_signal_table[sig];
 252     else
 253         return -1;
 254 }
 255
 256 //#define DEBUG_GDB
 257
 258 typedef struct GDBRegisterState {
 259     int base_reg;
 260     int num_regs;
 261     gdb_reg_cb get_reg;
 262     gdb_reg_cb set_reg;
 263     const char *xml;
 264     struct GDBRegisterState *next;
 265 } GDBRegisterState;
 266
 267 enum RSState {
 268     RS_INACTIVE,
 269     RS_IDLE,
 270     RS_GETLINE,
 271     RS_CHKSUM1,
 272     RS_CHKSUM2,
 273     RS_SYSCALL,
 274 };
 275 typedef struct GDBState {
 276     CPUState *c_cpu; /* current CPU for step/continue ops */
 277     CPUState *g_cpu; /* current CPU for other ops */
 278     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 279     enum RSState state; /* parsing state */
 280     char line_buf[MAX_PACKET_LENGTH];
 281     int line_buf_index;
 282     int line_csum;
 283     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 284     int last_packet_len;
 285     int signal;
 286 #ifdef CONFIG_USER_ONLY
 287     int fd;
 288     int running_state;
 289 #else
 290     CharDriverState *chr;
 291     CharDriverState *mon_chr;
 292 #endif
 293 } GDBState;
 294
 295 /* By default use no IRQs and no timers while single stepping so as to
 296  * make single stepping like an ICE HW step.
 297  */
 298 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 299
 300 static GDBState *gdbserver_state;
 301
 302 /* This is an ugly hack to cope with both new and old gdb.
 303    If gdb sends qXfer:features:read then assume we're talking to a newish
 304    gdb that understands target descriptions.  */
 305 static int gdb_has_xml;
 306
 307 #ifdef CONFIG_USER_ONLY
 308 /* XXX: This is not thread safe.  Do we care?  */
 309 static int gdbserver_fd = -1;
 310
 311 static int get_char(GDBState *s)
 312 {
 313     uint8_t ch;
 314     int ret;
 315
 316     for(;;) {
 317         ret = recv(s->fd, &ch, 1, 0);
 318         if (ret < 0) {
 319             if (errno == ECONNRESET)
 320                 s->fd = -1;
 321             if (errno != EINTR && errno != EAGAIN)
 322                 return -1;
 323         } else if (ret == 0) {
 324             close(s->fd);
 325             s->fd = -1;
 326             return -1;
 327         } else {
 328             break;
 329         }
 330     }
 331     return ch;
 332 }
 333 #endif
 334
 335 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 336
 337 static enum {
 338     GDB_SYS_UNKNOWN,
 339     GDB_SYS_ENABLED,
 340     GDB_SYS_DISABLED,
 341 } gdb_syscall_mode;
 342
 343 /* If gdb is connected when the first semihosting syscall occurs then use
 344    remote gdb syscalls.  Otherwise use native file IO.  */
 345 int use_gdb_syscalls(void)
 346 {
 347     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 348         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 349                                             : GDB_SYS_DISABLED);
 350     }
 351     return gdb_syscall_mode == GDB_SYS_ENABLED;
 352 }
 353
 354 /* Resume execution.  */
 355 static inline void gdb_continue(GDBState *s)
 356 {
 357 #ifdef CONFIG_USER_ONLY
 358     s->running_state = 1;
 359 #else
 360     vm_start();
 361 #endif
 362 }
 363
 364 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 365 {
 366 #ifdef CONFIG_USER_ONLY
 367     int ret;
 368
 369     while (len > 0) {
 370         ret = send(s->fd, buf, len, 0);
 371         if (ret < 0) {
 372             if (errno != EINTR && errno != EAGAIN)
 373                 return;
 374         } else {
 375             buf += ret;
 376             len -= ret;
 377         }
 378     }
 379 #else
 380     qemu_chr_write(s->chr, buf, len);
 381 #endif
 382 }
 383
 384 static inline int fromhex(int v)
 385 {
 386     if (v >= '0' && v <= '9')
 387         return v - '0';
 388     else if (v >= 'A' && v <= 'F')
 389         return v - 'A' + 10;
 390     else if (v >= 'a' && v <= 'f')
 391         return v - 'a' + 10;
 392     else
 393         return 0;
 394 }
 395
 396 static inline int tohex(int v)
 397 {
 398     if (v < 10)
 399         return v + '0';
 400     else
 401         return v - 10 + 'a';
 402 }
 403
 404 static void memtohex(char *buf, const uint8_t *mem, int len)
 405 {
 406     int i, c;
 407     char *q;
 408     q = buf;
 409     for(i = 0; i < len; i++) {
 410         c = mem[i];
 411         *q++ = tohex(c >> 4);
 412         *q++ = tohex(c & 0xf);
 413     }
 414     *q = '\0';
 415 }
 416
 417 static void hextomem(uint8_t *mem, const char *buf, int len)
 418 {
 419     int i;
 420
 421     for(i = 0; i < len; i++) {
 422         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 423         buf += 2;
 424     }
 425 }
 426
 427 /* return -1 if error, 0 if OK */
 428 static int put_packet_binary(GDBState *s, const char *buf, int len)
 429 {
 430     int csum, i;
 431     uint8_t *p;
 432
 433     for(;;) {
 434         p = s->last_packet;
 435         *(p++) = '$';
 436         memcpy(p, buf, len);
 437         p += len;
 438         csum = 0;
 439         for(i = 0; i < len; i++) {
 440             csum += buf[i];
 441         }
 442         *(p++) = '#';
 443         *(p++) = tohex((csum >> 4) & 0xf);
 444         *(p++) = tohex((csum) & 0xf);
 445
 446         s->last_packet_len = p - s->last_packet;
 447         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 448
 449 #ifdef CONFIG_USER_ONLY
 450         i = get_char(s);
 451         if (i < 0)
 452             return -1;
 453         if (i == '+')
 454             break;
 455 #else
 456         break;
 457 #endif
 458     }
 459     return 0;
 460 }
 461
 462 /* return -1 if error, 0 if OK */
 463 static int put_packet(GDBState *s, const char *buf)
 464 {
 465 #ifdef DEBUG_GDB
 466     printf("reply='%s'\n", buf);
 467 #endif
 468
 469     return put_packet_binary(s, buf, strlen(buf));
 470 }
 471
 472 /* The GDB remote protocol transfers values in target byte order.  This means
 473    we can use the raw memory access routines to access the value buffer.
 474    Conveniently, these also handle the case where the buffer is mis-aligned.
 475  */
 476 #define GET_REG8(val) do { \
 477     stb_p(mem_buf, val); \
 478     return 1; \
 479     } while(0)
 480 #define GET_REG16(val) do { \
 481     stw_p(mem_buf, val); \
 482     return 2; \
 483     } while(0)
 484 #define GET_REG32(val) do { \
 485     stl_p(mem_buf, val); \
 486     return 4; \
 487     } while(0)
 488 #define GET_REG64(val) do { \
 489     stq_p(mem_buf, val); \
 490     return 8; \
 491     } while(0)
 492
 493 #if TARGET_LONG_BITS == 64
 494 #define GET_REGL(val) GET_REG64(val)
 495 #define ldtul_p(addr) ldq_p(addr)
 496 #else
 497 #define GET_REGL(val) GET_REG32(val)
 498 #define ldtul_p(addr) ldl_p(addr)
 499 #endif
 500
 501 #if defined(TARGET_I386)
 502
 503 #ifdef TARGET_X86_64
 504 static const int gpr_map[16] = {
 505     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 506     8, 9, 10, 11, 12, 13, 14, 15
 507 };
 508 #else
 509 #define gpr_map gpr_map32
 510 #endif
 511 static const int gpr_map32[8] = { 0, 1, 2, 3, 4, 5, 6, 7 };
 512
 513 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 514
 515 #define IDX_IP_REG      CPU_NB_REGS
 516 #define IDX_FLAGS_REG   (IDX_IP_REG + 1)
 517 #define IDX_SEG_REGS    (IDX_FLAGS_REG + 1)
 518 #define IDX_FP_REGS     (IDX_SEG_REGS + 6)
 519 #define IDX_XMM_REGS    (IDX_FP_REGS + 16)
 520 #define IDX_MXCSR_REG   (IDX_XMM_REGS + CPU_NB_REGS)
 521
 522 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 523 {
 524     if (n < CPU_NB_REGS) {
 525         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 526             GET_REG64(env->regs[gpr_map[n]]);
 527         } else if (n < CPU_NB_REGS32) {
 528             GET_REG32(env->regs[gpr_map32[n]]);
 529         }
 530     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 531 #ifdef USE_X86LDOUBLE
 532         /* FIXME: byteswap float values - after fixing fpregs layout. */
 533         memcpy(mem_buf, &env->fpregs[n - IDX_FP_REGS], 10);
 534 #else
 535         memset(mem_buf, 0, 10);
 536 #endif
 537         return 10;
 538     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 539         n -= IDX_XMM_REGS;
 540         if (n < CPU_NB_REGS32 ||
 541             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 542             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 543             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 544             return 16;
 545         }
 546     } else {
 547         switch (n) {
 548         case IDX_IP_REG:
 549             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 550                 GET_REG64(env->eip);
 551             } else {
 552                 GET_REG32(env->eip);
 553             }
 554         case IDX_FLAGS_REG: GET_REG32(env->eflags);
 555
 556         case IDX_SEG_REGS:     GET_REG32(env->segs[R_CS].selector);
 557         case IDX_SEG_REGS + 1: GET_REG32(env->segs[R_SS].selector);
 558         case IDX_SEG_REGS + 2: GET_REG32(env->segs[R_DS].selector);
 559         case IDX_SEG_REGS + 3: GET_REG32(env->segs[R_ES].selector);
 560         case IDX_SEG_REGS + 4: GET_REG32(env->segs[R_FS].selector);
 561         case IDX_SEG_REGS + 5: GET_REG32(env->segs[R_GS].selector);
 562
 563         case IDX_FP_REGS + 8:  GET_REG32(env->fpuc);
 564         case IDX_FP_REGS + 9:  GET_REG32((env->fpus & ~0x3800) |
 565                                          (env->fpstt & 0x7) << 11);
 566         case IDX_FP_REGS + 10: GET_REG32(0); /* ftag */
 567         case IDX_FP_REGS + 11: GET_REG32(0); /* fiseg */
 568         case IDX_FP_REGS + 12: GET_REG32(0); /* fioff */
 569         case IDX_FP_REGS + 13: GET_REG32(0); /* foseg */
 570         case IDX_FP_REGS + 14: GET_REG32(0); /* fooff */
 571         case IDX_FP_REGS + 15: GET_REG32(0); /* fop */
 572
 573         case IDX_MXCSR_REG: GET_REG32(env->mxcsr);
 574         }
 575     }
 576     return 0;
 577 }
 578
 579 static int cpu_x86_gdb_load_seg(CPUState *env, int sreg, uint8_t *mem_buf)
 580 {
 581     uint16_t selector = ldl_p(mem_buf);
 582
 583     if (selector != env->segs[sreg].selector) {
 584 #if defined(CONFIG_USER_ONLY)
 585         cpu_x86_load_seg(env, sreg, selector);
 586 #else
 587         unsigned int limit, flags;
 588         target_ulong base;
 589
 590         if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK)) {
 591             base = selector << 4;
 592             limit = 0xffff;
 593             flags = 0;
 594         } else {
 595             if (!cpu_x86_get_descr_debug(env, selector, &base, &limit, &flags))
 596                 return 4;
 597         }
 598         cpu_x86_load_seg_cache(env, sreg, selector, base, limit, flags);
 599 #endif
 600     }
 601     return 4;
 602 }
 603
 604 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 605 {
 606     uint32_t tmp;
 607
 608     if (n < CPU_NB_REGS) {
 609         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 610             env->regs[gpr_map[n]] = ldtul_p(mem_buf);
 611             return sizeof(target_ulong);
 612         } else if (n < CPU_NB_REGS32) {
 613             n = gpr_map32[n];
 614             env->regs[n] &= ~0xffffffffUL;
 615             env->regs[n] |= (uint32_t)ldl_p(mem_buf);
 616             return 4;
 617         }
 618     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 619 #ifdef USE_X86LDOUBLE
 620         /* FIXME: byteswap float values - after fixing fpregs layout. */
 621         memcpy(&env->fpregs[n - IDX_FP_REGS], mem_buf, 10);
 622 #endif
 623         return 10;
 624     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 625         n -= IDX_XMM_REGS;
 626         if (n < CPU_NB_REGS32 ||
 627             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 628             env->xmm_regs[n].XMM_Q(0) = ldq_p(mem_buf);
 629             env->xmm_regs[n].XMM_Q(1) = ldq_p(mem_buf + 8);
 630             return 16;
 631         }
 632     } else {
 633         switch (n) {
 634         case IDX_IP_REG:
 635             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 636                 env->eip = ldq_p(mem_buf);
 637                 return 8;
 638             } else {
 639                 env->eip &= ~0xffffffffUL;
 640                 env->eip |= (uint32_t)ldl_p(mem_buf);
 641                 return 4;
 642             }
 643         case IDX_FLAGS_REG:
 644             env->eflags = ldl_p(mem_buf);
 645             return 4;
 646
 647         case IDX_SEG_REGS:     return cpu_x86_gdb_load_seg(env, R_CS, mem_buf);
 648         case IDX_SEG_REGS + 1: return cpu_x86_gdb_load_seg(env, R_SS, mem_buf);
 649         case IDX_SEG_REGS + 2: return cpu_x86_gdb_load_seg(env, R_DS, mem_buf);
 650         case IDX_SEG_REGS + 3: return cpu_x86_gdb_load_seg(env, R_ES, mem_buf);
 651         case IDX_SEG_REGS + 4: return cpu_x86_gdb_load_seg(env, R_FS, mem_buf);
 652         case IDX_SEG_REGS + 5: return cpu_x86_gdb_load_seg(env, R_GS, mem_buf);
 653
 654         case IDX_FP_REGS + 8:
 655             env->fpuc = ldl_p(mem_buf);
 656             return 4;
 657         case IDX_FP_REGS + 9:
 658             tmp = ldl_p(mem_buf);
 659             env->fpstt = (tmp >> 11) & 7;
 660             env->fpus = tmp & ~0x3800;
 661             return 4;
 662         case IDX_FP_REGS + 10: /* ftag */  return 4;
 663         case IDX_FP_REGS + 11: /* fiseg */ return 4;
 664         case IDX_FP_REGS + 12: /* fioff */ return 4;
 665         case IDX_FP_REGS + 13: /* foseg */ return 4;
 666         case IDX_FP_REGS + 14: /* fooff */ return 4;
 667         case IDX_FP_REGS + 15: /* fop */   return 4;
 668
 669         case IDX_MXCSR_REG:
 670             env->mxcsr = ldl_p(mem_buf);
 671             return 4;
 672         }
 673     }
 674     /* Unrecognised register.  */
 675     return 0;
 676 }
 677
 678 #elif defined (TARGET_PPC)
 679
 680 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 681    expects whatever the target description contains.  Due to a
 682    historical mishap the FP registers appear in between core integer
 683    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 684    FP regs zero size when talking to a newer gdb.  */
 685 #define NUM_CORE_REGS 71
 686 #if defined (TARGET_PPC64)
 687 #define GDB_CORE_XML "power64-core.xml"
 688 #else
 689 #define GDB_CORE_XML "power-core.xml"
 690 #endif
 691
 692 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 693 {
 694     if (n < 32) {
 695         /* gprs */
 696         GET_REGL(env->gpr[n]);
 697     } else if (n < 64) {
 698         /* fprs */
 699         if (gdb_has_xml)
 700             return 0;
 701         stfq_p(mem_buf, env->fpr[n-32]);
 702         return 8;
 703     } else {
 704         switch (n) {
 705         case 64: GET_REGL(env->nip);
 706         case 65: GET_REGL(env->msr);
 707         case 66:
 708             {
 709                 uint32_t cr = 0;
 710                 int i;
 711                 for (i = 0; i < 8; i++)
 712                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 713                 GET_REG32(cr);
 714             }
 715         case 67: GET_REGL(env->lr);
 716         case 68: GET_REGL(env->ctr);
 717         case 69: GET_REGL(env->xer);
 718         case 70:
 719             {
 720                 if (gdb_has_xml)
 721                     return 0;
 722                 GET_REG32(0); /* fpscr */
 723             }
 724         }
 725     }
 726     return 0;
 727 }
 728
 729 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 730 {
 731     if (n < 32) {
 732         /* gprs */
 733         env->gpr[n] = ldtul_p(mem_buf);
 734         return sizeof(target_ulong);
 735     } else if (n < 64) {
 736         /* fprs */
 737         if (gdb_has_xml)
 738             return 0;
 739         env->fpr[n-32] = ldfq_p(mem_buf);
 740         return 8;
 741     } else {
 742         switch (n) {
 743         case 64:
 744             env->nip = ldtul_p(mem_buf);
 745             return sizeof(target_ulong);
 746         case 65:
 747             ppc_store_msr(env, ldtul_p(mem_buf));
 748             return sizeof(target_ulong);
 749         case 66:
 750             {
 751                 uint32_t cr = ldl_p(mem_buf);
 752                 int i;
 753                 for (i = 0; i < 8; i++)
 754                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 755                 return 4;
 756             }
 757         case 67:
 758             env->lr = ldtul_p(mem_buf);
 759             return sizeof(target_ulong);
 760         case 68:
 761             env->ctr = ldtul_p(mem_buf);
 762             return sizeof(target_ulong);
 763         case 69:
 764             env->xer = ldtul_p(mem_buf);
 765             return sizeof(target_ulong);
 766         case 70:
 767             /* fpscr */
 768             if (gdb_has_xml)
 769                 return 0;
 770             return 4;
 771         }
 772     }
 773     return 0;
 774 }
 775
 776 #elif defined (TARGET_SPARC)
 777
 778 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 779 #define NUM_CORE_REGS 86
 780 #else
 781 #define NUM_CORE_REGS 72
 782 #endif
 783
 784 #ifdef TARGET_ABI32
 785 #define GET_REGA(val) GET_REG32(val)
 786 #else
 787 #define GET_REGA(val) GET_REGL(val)
 788 #endif
 789
 790 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 791 {
 792     if (n < 8) {
 793         /* g0..g7 */
 794         GET_REGA(env->gregs[n]);
 795     }
 796     if (n < 32) {
 797         /* register window */
 798         GET_REGA(env->regwptr[n - 8]);
 799     }
 800 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 801     if (n < 64) {
 802         /* fprs */
 803         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 804     }
 805     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 806     switch (n) {
 807     case 64: GET_REGA(env->y);
 808     case 65: GET_REGA(GET_PSR(env));
 809     case 66: GET_REGA(env->wim);
 810     case 67: GET_REGA(env->tbr);
 811     case 68: GET_REGA(env->pc);
 812     case 69: GET_REGA(env->npc);
 813     case 70: GET_REGA(env->fsr);
 814     case 71: GET_REGA(0); /* csr */
 815     default: GET_REGA(0);
 816     }
 817 #else
 818     if (n < 64) {
 819         /* f0-f31 */
 820         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 821     }
 822     if (n < 80) {
 823         /* f32-f62 (double width, even numbers only) */
 824         uint64_t val;
 825
 826         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 827         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 828         GET_REG64(val);
 829     }
 830     switch (n) {
 831     case 80: GET_REGL(env->pc);
 832     case 81: GET_REGL(env->npc);
 833     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 834                            ((env->asi & 0xff) << 24) |
 835                            ((env->pstate & 0xfff) << 8) |
 836                            GET_CWP64(env));
 837     case 83: GET_REGL(env->fsr);
 838     case 84: GET_REGL(env->fprs);
 839     case 85: GET_REGL(env->y);
 840     }
 841 #endif
 842     return 0;
 843 }
 844
 845 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 846 {
 847 #if defined(TARGET_ABI32)
 848     abi_ulong tmp;
 849
 850     tmp = ldl_p(mem_buf);
 851 #else
 852     target_ulong tmp;
 853
 854     tmp = ldtul_p(mem_buf);
 855 #endif
 856
 857     if (n < 8) {
 858         /* g0..g7 */
 859         env->gregs[n] = tmp;
 860     } else if (n < 32) {
 861         /* register window */
 862         env->regwptr[n - 8] = tmp;
 863     }
 864 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 865     else if (n < 64) {
 866         /* fprs */
 867         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 868     } else {
 869         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 870         switch (n) {
 871         case 64: env->y = tmp; break;
 872         case 65: PUT_PSR(env, tmp); break;
 873         case 66: env->wim = tmp; break;
 874         case 67: env->tbr = tmp; break;
 875         case 68: env->pc = tmp; break;
 876         case 69: env->npc = tmp; break;
 877         case 70: env->fsr = tmp; break;
 878         default: return 0;
 879         }
 880     }
 881     return 4;
 882 #else
 883     else if (n < 64) {
 884         /* f0-f31 */
 885         env->fpr[n] = ldfl_p(mem_buf);
 886         return 4;
 887     } else if (n < 80) {
 888         /* f32-f62 (double width, even numbers only) */
 889         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 890         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 891     } else {
 892         switch (n) {
 893         case 80: env->pc = tmp; break;
 894         case 81: env->npc = tmp; break;
 895         case 82:
 896             PUT_CCR(env, tmp >> 32);
 897             env->asi = (tmp >> 24) & 0xff;
 898             env->pstate = (tmp >> 8) & 0xfff;
 899             PUT_CWP64(env, tmp & 0xff);
 900             break;
 901         case 83: env->fsr = tmp; break;
 902         case 84: env->fprs = tmp; break;
 903         case 85: env->y = tmp; break;
 904         default: return 0;
 905         }
 906     }
 907     return 8;
 908 #endif
 909 }
 910 #elif defined (TARGET_ARM)
 911
 912 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 913    whatever the target description contains.  Due to a historical mishap
 914    the FPA registers appear in between core integer regs and the CPSR.
 915    We hack round this by giving the FPA regs zero size when talking to a
 916    newer gdb.  */
 917 #define NUM_CORE_REGS 26
 918 #define GDB_CORE_XML "arm-core.xml"
 919
 920 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 921 {
 922     if (n < 16) {
 923         /* Core integer register.  */
 924         GET_REG32(env->regs[n]);
 925     }
 926     if (n < 24) {
 927         /* FPA registers.  */
 928         if (gdb_has_xml)
 929             return 0;
 930         memset(mem_buf, 0, 12);
 931         return 12;
 932     }
 933     switch (n) {
 934     case 24:
 935         /* FPA status register.  */
 936         if (gdb_has_xml)
 937             return 0;
 938         GET_REG32(0);
 939     case 25:
 940         /* CPSR */
 941         GET_REG32(cpsr_read(env));
 942     }
 943     /* Unknown register.  */
 944     return 0;
 945 }
 946
 947 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 948 {
 949     uint32_t tmp;
 950
 951     tmp = ldl_p(mem_buf);
 952
 953     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 954        cause problems if we ever implement the Jazelle DBX extensions.  */
 955     if (n == 15)
 956         tmp &= ~1;
 957
 958     if (n < 16) {
 959         /* Core integer register.  */
 960         env->regs[n] = tmp;
 961         return 4;
 962     }
 963     if (n < 24) { /* 16-23 */
 964         /* FPA registers (ignored).  */
 965         if (gdb_has_xml)
 966             return 0;
 967         return 12;
 968     }
 969     switch (n) {
 970     case 24:
 971         /* FPA status register (ignored).  */
 972         if (gdb_has_xml)
 973             return 0;
 974         return 4;
 975     case 25:
 976         /* CPSR */
 977         cpsr_write (env, tmp, 0xffffffff);
 978         return 4;
 979     }
 980     /* Unknown register.  */
 981     return 0;
 982 }
 983
 984 #elif defined (TARGET_M68K)
 985
 986 #define NUM_CORE_REGS 18
 987
 988 #define GDB_CORE_XML "cf-core.xml"
 989
 990 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 991 {
 992     if (n < 8) {
 993         /* D0-D7 */
 994         GET_REG32(env->dregs[n]);
 995     } else if (n < 16) {
 996         /* A0-A7 */
 997         GET_REG32(env->aregs[n - 8]);
 998     } else {
 999         switch (n) {
1000         case 16: GET_REG32(env->sr);
1001         case 17: GET_REG32(env->pc);
1002         }
1003     }
1004     /* FP registers not included here because they vary between
1005        ColdFire and m68k.  Use XML bits for these.  */
1006     return 0;
1007 }
1008
1009 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1010 {
1011     uint32_t tmp;
1012
1013     tmp = ldl_p(mem_buf);
1014
1015     if (n < 8) {
1016         /* D0-D7 */
1017         env->dregs[n] = tmp;
1018     } else if (n < 16) {
1019         /* A0-A7 */
1020         env->aregs[n - 8] = tmp;
1021     } else {
1022         switch (n) {
1023         case 16: env->sr = tmp; break;
1024         case 17: env->pc = tmp; break;
1025         default: return 0;
1026         }
1027     }
1028     return 4;
1029 }
1030 #elif defined (TARGET_MIPS)
1031
1032 #define NUM_CORE_REGS 73
1033
1034 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1035 {
1036     if (n < 32) {
1037         GET_REGL(env->active_tc.gpr[n]);
1038     }
1039     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
1040         if (n >= 38 && n < 70) {
1041             if (env->CP0_Status & (1 << CP0St_FR))
1042                 GET_REGL(env->active_fpu.fpr[n - 38].d);
1043             else
1044                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
1045         }
1046         switch (n) {
1047         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
1048         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
1049         }
1050     }
1051     switch (n) {
1052     case 32: GET_REGL((int32_t)env->CP0_Status);
1053     case 33: GET_REGL(env->active_tc.LO[0]);
1054     case 34: GET_REGL(env->active_tc.HI[0]);
1055     case 35: GET_REGL(env->CP0_BadVAddr);
1056     case 36: GET_REGL((int32_t)env->CP0_Cause);
1057     case 37: GET_REGL(env->active_tc.PC | !!(env->hflags & MIPS_HFLAG_M16));
1058     case 72: GET_REGL(0); /* fp */
1059     case 89: GET_REGL((int32_t)env->CP0_PRid);
1060     }
1061     if (n >= 73 && n <= 88) {
1062         /* 16 embedded regs.  */
1063         GET_REGL(0);
1064     }
1065
1066     return 0;
1067 }
1068
1069 /* convert MIPS rounding mode in FCR31 to IEEE library */
1070 static unsigned int ieee_rm[] =
1071   {
1072     float_round_nearest_even,
1073     float_round_to_zero,
1074     float_round_up,
1075     float_round_down
1076   };
1077 #define RESTORE_ROUNDING_MODE \
1078     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1079
1080 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1081 {
1082     target_ulong tmp;
1083
1084     tmp = ldtul_p(mem_buf);
1085
1086     if (n < 32) {
1087         env->active_tc.gpr[n] = tmp;
1088         return sizeof(target_ulong);
1089     }
1090     if (env->CP0_Config1 & (1 << CP0C1_FP)
1091             && n >= 38 && n < 73) {
1092         if (n < 70) {
1093             if (env->CP0_Status & (1 << CP0St_FR))
1094               env->active_fpu.fpr[n - 38].d = tmp;
1095             else
1096               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1097         }
1098         switch (n) {
1099         case 70:
1100             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1101             /* set rounding mode */
1102             RESTORE_ROUNDING_MODE;
1103 #ifndef CONFIG_SOFTFLOAT
1104             /* no floating point exception for native float */
1105             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1106 #endif
1107             break;
1108         case 71: env->active_fpu.fcr0 = tmp; break;
1109         }
1110         return sizeof(target_ulong);
1111     }
1112     switch (n) {
1113     case 32: env->CP0_Status = tmp; break;
1114     case 33: env->active_tc.LO[0] = tmp; break;
1115     case 34: env->active_tc.HI[0] = tmp; break;
1116     case 35: env->CP0_BadVAddr = tmp; break;
1117     case 36: env->CP0_Cause = tmp; break;
1118     case 37:
1119         env->active_tc.PC = tmp & ~(target_ulong)1;
1120         if (tmp & 1) {
1121             env->hflags |= MIPS_HFLAG_M16;
1122         } else {
1123             env->hflags &= ~(MIPS_HFLAG_M16);
1124         }
1125         break;
1126     case 72: /* fp, ignored */ break;
1127     default:
1128         if (n > 89)
1129             return 0;
1130         /* Other registers are readonly.  Ignore writes.  */
1131         break;
1132     }
1133
1134     return sizeof(target_ulong);
1135 }
1136 #elif defined (TARGET_SH4)
1137
1138 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1139 /* FIXME: We should use XML for this.  */
1140
1141 #define NUM_CORE_REGS 59
1142
1143 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1144 {
1145     if (n < 8) {
1146         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1147             GET_REGL(env->gregs[n + 16]);
1148         } else {
1149             GET_REGL(env->gregs[n]);
1150         }
1151     } else if (n < 16) {
1152         GET_REGL(env->gregs[n - 8]);
1153     } else if (n >= 25 && n < 41) {
1154         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1155     } else if (n >= 43 && n < 51) {
1156         GET_REGL(env->gregs[n - 43]);
1157     } else if (n >= 51 && n < 59) {
1158         GET_REGL(env->gregs[n - (51 - 16)]);
1159     }
1160     switch (n) {
1161     case 16: GET_REGL(env->pc);
1162     case 17: GET_REGL(env->pr);
1163     case 18: GET_REGL(env->gbr);
1164     case 19: GET_REGL(env->vbr);
1165     case 20: GET_REGL(env->mach);
1166     case 21: GET_REGL(env->macl);
1167     case 22: GET_REGL(env->sr);
1168     case 23: GET_REGL(env->fpul);
1169     case 24: GET_REGL(env->fpscr);
1170     case 41: GET_REGL(env->ssr);
1171     case 42: GET_REGL(env->spc);
1172     }
1173
1174     return 0;
1175 }
1176
1177 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1178 {
1179     uint32_t tmp;
1180
1181     tmp = ldl_p(mem_buf);
1182
1183     if (n < 8) {
1184         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1185             env->gregs[n + 16] = tmp;
1186         } else {
1187             env->gregs[n] = tmp;
1188         }
1189         return 4;
1190     } else if (n < 16) {
1191         env->gregs[n - 8] = tmp;
1192         return 4;
1193     } else if (n >= 25 && n < 41) {
1194         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1195     } else if (n >= 43 && n < 51) {
1196         env->gregs[n - 43] = tmp;
1197         return 4;
1198     } else if (n >= 51 && n < 59) {
1199         env->gregs[n - (51 - 16)] = tmp;
1200         return 4;
1201     }
1202     switch (n) {
1203     case 16: env->pc = tmp;
1204     case 17: env->pr = tmp;
1205     case 18: env->gbr = tmp;
1206     case 19: env->vbr = tmp;
1207     case 20: env->mach = tmp;
1208     case 21: env->macl = tmp;
1209     case 22: env->sr = tmp;
1210     case 23: env->fpul = tmp;
1211     case 24: env->fpscr = tmp;
1212     case 41: env->ssr = tmp;
1213     case 42: env->spc = tmp;
1214     default: return 0;
1215     }
1216
1217     return 4;
1218 }
1219 #elif defined (TARGET_MICROBLAZE)
1220
1221 #define NUM_CORE_REGS (32 + 5)
1222
1223 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1224 {
1225     if (n < 32) {
1226         GET_REG32(env->regs[n]);
1227     } else {
1228         GET_REG32(env->sregs[n - 32]);
1229     }
1230     return 0;
1231 }
1232
1233 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1234 {
1235     uint32_t tmp;
1236
1237     if (n > NUM_CORE_REGS)
1238         return 0;
1239
1240     tmp = ldl_p(mem_buf);
1241
1242     if (n < 32) {
1243         env->regs[n] = tmp;
1244     } else {
1245         env->sregs[n - 32] = tmp;
1246     }
1247     return 4;
1248 }
1249 #elif defined (TARGET_CRIS)
1250
1251 #define NUM_CORE_REGS 49
1252
1253 static int
1254 read_register_crisv10(CPUState *env, uint8_t *mem_buf, int n)
1255 {
1256     if (n < 15) {
1257         GET_REG32(env->regs[n]);
1258     }
1259
1260     if (n == 15) {
1261         GET_REG32(env->pc);
1262     }
1263
1264     if (n < 32) {
1265         switch (n) {
1266         case 16:
1267             GET_REG8(env->pregs[n - 16]);
1268             break;
1269         case 17:
1270             GET_REG8(env->pregs[n - 16]);
1271             break;
1272         case 20:
1273         case 21:
1274             GET_REG16(env->pregs[n - 16]);
1275             break;
1276         default:
1277             if (n >= 23) {
1278                 GET_REG32(env->pregs[n - 16]);
1279             }
1280             break;
1281         }
1282     }
1283     return 0;
1284 }
1285
1286 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1287 {
1288     uint8_t srs;
1289
1290     if (env->pregs[PR_VR] < 32)
1291         return read_register_crisv10(env, mem_buf, n);
1292
1293     srs = env->pregs[PR_SRS];
1294     if (n < 16) {
1295         GET_REG32(env->regs[n]);
1296     }
1297
1298     if (n >= 21 && n < 32) {
1299         GET_REG32(env->pregs[n - 16]);
1300     }
1301     if (n >= 33 && n < 49) {
1302         GET_REG32(env->sregs[srs][n - 33]);
1303     }
1304     switch (n) {
1305     case 16: GET_REG8(env->pregs[0]);
1306     case 17: GET_REG8(env->pregs[1]);
1307     case 18: GET_REG32(env->pregs[2]);
1308     case 19: GET_REG8(srs);
1309     case 20: GET_REG16(env->pregs[4]);
1310     case 32: GET_REG32(env->pc);
1311     }
1312
1313     return 0;
1314 }
1315
1316 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1317 {
1318     uint32_t tmp;
1319
1320     if (n > 49)
1321         return 0;
1322
1323     tmp = ldl_p(mem_buf);
1324
1325     if (n < 16) {
1326         env->regs[n] = tmp;
1327     }
1328
1329     if (n >= 21 && n < 32) {
1330         env->pregs[n - 16] = tmp;
1331     }
1332
1333     /* FIXME: Should support function regs be writable?  */
1334     switch (n) {
1335     case 16: return 1;
1336     case 17: return 1;
1337     case 18: env->pregs[PR_PID] = tmp; break;
1338     case 19: return 1;
1339     case 20: return 2;
1340     case 32: env->pc = tmp; break;
1341     }
1342
1343     return 4;
1344 }
1345 #elif defined (TARGET_ALPHA)
1346
1347 #define NUM_CORE_REGS 65
1348
1349 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1350 {
1351     if (n < 31) {
1352        GET_REGL(env->ir[n]);
1353     }
1354     else if (n == 31) {
1355        GET_REGL(0);
1356     }
1357     else if (n<63) {
1358        uint64_t val;
1359
1360        val = *((uint64_t *)&env->fir[n-32]);
1361        GET_REGL(val);
1362     }
1363     else if (n==63) {
1364        GET_REGL(env->fpcr);
1365     }
1366     else if (n==64) {
1367        GET_REGL(env->pc);
1368     }
1369     else {
1370        GET_REGL(0);
1371     }
1372
1373     return 0;
1374 }
1375
1376 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1377 {
1378     target_ulong tmp;
1379     tmp = ldtul_p(mem_buf);
1380
1381     if (n < 31) {
1382         env->ir[n] = tmp;
1383     }
1384
1385     if (n > 31 && n < 63) {
1386         env->fir[n - 32] = ldfl_p(mem_buf);
1387     }
1388
1389     if (n == 64 ) {
1390        env->pc=tmp;
1391     }
1392
1393     return 8;
1394 }
1395 #elif defined (TARGET_S390X)
1396
1397 #define NUM_CORE_REGS S390_NUM_TOTAL_REGS
1398
1399 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1400 {
1401     switch (n) {
1402         case S390_PSWM_REGNUM: GET_REGL(env->psw.mask); break;
1403         case S390_PSWA_REGNUM: GET_REGL(env->psw.addr); break;
1404         case S390_R0_REGNUM ... S390_R15_REGNUM:
1405             GET_REGL(env->regs[n-S390_R0_REGNUM]); break;
1406         case S390_A0_REGNUM ... S390_A15_REGNUM:
1407             GET_REG32(env->aregs[n-S390_A0_REGNUM]); break;
1408         case S390_FPC_REGNUM: GET_REG32(env->fpc); break;
1409         case S390_F0_REGNUM ... S390_F15_REGNUM:
1410             /* XXX */
1411             break;
1412         case S390_PC_REGNUM: GET_REGL(env->psw.addr); break;
1413         case S390_CC_REGNUM: GET_REG32(env->cc); break;
1414     }
1415
1416     return 0;
1417 }
1418
1419 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1420 {
1421     target_ulong tmpl;
1422     uint32_t tmp32;
1423     int r = 8;
1424     tmpl = ldtul_p(mem_buf);
1425     tmp32 = ldl_p(mem_buf);
1426
1427     switch (n) {
1428         case S390_PSWM_REGNUM: env->psw.mask = tmpl; break;
1429         case S390_PSWA_REGNUM: env->psw.addr = tmpl; break;
1430         case S390_R0_REGNUM ... S390_R15_REGNUM:
1431             env->regs[n-S390_R0_REGNUM] = tmpl; break;
1432         case S390_A0_REGNUM ... S390_A15_REGNUM:
1433             env->aregs[n-S390_A0_REGNUM] = tmp32; r=4; break;
1434         case S390_FPC_REGNUM: env->fpc = tmp32; r=4; break;
1435         case S390_F0_REGNUM ... S390_F15_REGNUM:
1436             /* XXX */
1437             break;
1438         case S390_PC_REGNUM: env->psw.addr = tmpl; break;
1439         case S390_CC_REGNUM: env->cc = tmp32; r=4; break;
1440     }
1441
1442     return r;
1443 }
1444 #else
1445
1446 #define NUM_CORE_REGS 0
1447
1448 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1449 {
1450     return 0;
1451 }
1452
1453 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1454 {
1455     return 0;
1456 }
1457
1458 #endif
1459
1460 static int num_g_regs = NUM_CORE_REGS;
1461
1462 #ifdef GDB_CORE_XML
1463 /* Encode data using the encoding for 'x' packets.  */
1464 static int memtox(char *buf, const char *mem, int len)
1465 {
1466     char *p = buf;
1467     char c;
1468
1469     while (len--) {
1470         c = *(mem++);
1471         switch (c) {
1472         case '#': case '$': case '*': case '}':
1473             *(p++) = '}';
1474             *(p++) = c ^ 0x20;
1475             break;
1476         default:
1477             *(p++) = c;
1478             break;
1479         }
1480     }
1481     return p - buf;
1482 }
1483
1484 static const char *get_feature_xml(const char *p, const char **newp)
1485 {
1486     extern const char *const xml_builtin[][2];
1487     size_t len;
1488     int i;
1489     const char *name;
1490     static char target_xml[1024];
1491
1492     len = 0;
1493     while (p[len] && p[len] != ':')
1494         len++;
1495     *newp = p + len;
1496
1497     name = NULL;
1498     if (strncmp(p, "target.xml", len) == 0) {
1499         /* Generate the XML description for this CPU.  */
1500         if (!target_xml[0]) {
1501             GDBRegisterState *r;
1502
1503             snprintf(target_xml, sizeof(target_xml),
1504                      "<?xml version=\"1.0\"?>"
1505                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1506                      "<target>"
1507                      "<xi:include href=\"%s\"/>",
1508                      GDB_CORE_XML);
1509
1510             for (r = first_cpu->gdb_regs; r; r = r->next) {
1511                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
1512                 pstrcat(target_xml, sizeof(target_xml), r->xml);
1513                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
1514             }
1515             pstrcat(target_xml, sizeof(target_xml), "</target>");
1516         }
1517         return target_xml;
1518     }
1519     for (i = 0; ; i++) {
1520         name = xml_builtin[i][0];
1521         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1522             break;
1523     }
1524     return name ? xml_builtin[i][1] : NULL;
1525 }
1526 #endif
1527
1528 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1529 {
1530     GDBRegisterState *r;
1531
1532     if (reg < NUM_CORE_REGS)
1533         return cpu_gdb_read_register(env, mem_buf, reg);
1534
1535     for (r = env->gdb_regs; r; r = r->next) {
1536         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1537             return r->get_reg(env, mem_buf, reg - r->base_reg);
1538         }
1539     }
1540     return 0;
1541 }
1542
1543 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1544 {
1545     GDBRegisterState *r;
1546
1547     if (reg < NUM_CORE_REGS)
1548         return cpu_gdb_write_register(env, mem_buf, reg);
1549
1550     for (r = env->gdb_regs; r; r = r->next) {
1551         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1552             return r->set_reg(env, mem_buf, reg - r->base_reg);
1553         }
1554     }
1555     return 0;
1556 }
1557
1558 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1559    specifies the first register number and these registers are included in
1560    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1561    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1562  */
1563
1564 void gdb_register_coprocessor(CPUState * env,
1565                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1566                              int num_regs, const char *xml, int g_pos)
1567 {
1568     GDBRegisterState *s;
1569     GDBRegisterState **p;
1570     static int last_reg = NUM_CORE_REGS;
1571
1572     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1573     s->base_reg = last_reg;
1574     s->num_regs = num_regs;
1575     s->get_reg = get_reg;
1576     s->set_reg = set_reg;
1577     s->xml = xml;
1578     p = &env->gdb_regs;
1579     while (*p) {
1580         /* Check for duplicates.  */
1581         if (strcmp((*p)->xml, xml) == 0)
1582             return;
1583         p = &(*p)->next;
1584     }
1585     /* Add to end of list.  */
1586     last_reg += num_regs;
1587     *p = s;
1588     if (g_pos) {
1589         if (g_pos != s->base_reg) {
1590             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1591                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1592         } else {
1593             num_g_regs = last_reg;
1594         }
1595     }
1596 }
1597
1598 #ifndef CONFIG_USER_ONLY
1599 static const int xlat_gdb_type[] = {
1600     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1601     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1602     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1603 };
1604 #endif
1605
1606 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1607 {
1608     CPUState *env;
1609     int err = 0;
1610
1611     if (kvm_enabled())
1612         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1613
1614     switch (type) {
1615     case GDB_BREAKPOINT_SW:
1616     case GDB_BREAKPOINT_HW:
1617         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1618             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1619             if (err)
1620                 break;
1621         }
1622         return err;
1623 #ifndef CONFIG_USER_ONLY
1624     case GDB_WATCHPOINT_WRITE:
1625     case GDB_WATCHPOINT_READ:
1626     case GDB_WATCHPOINT_ACCESS:
1627         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1628             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1629                                         NULL);
1630             if (err)
1631                 break;
1632         }
1633         return err;
1634 #endif
1635     default:
1636         return -ENOSYS;
1637     }
1638 }
1639
1640 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1641 {
1642     CPUState *env;
1643     int err = 0;
1644
1645     if (kvm_enabled())
1646         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1647
1648     switch (type) {
1649     case GDB_BREAKPOINT_SW:
1650     case GDB_BREAKPOINT_HW:
1651         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1652             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1653             if (err)
1654                 break;
1655         }
1656         return err;
1657 #ifndef CONFIG_USER_ONLY
1658     case GDB_WATCHPOINT_WRITE:
1659     case GDB_WATCHPOINT_READ:
1660     case GDB_WATCHPOINT_ACCESS:
1661         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1662             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1663             if (err)
1664                 break;
1665         }
1666         return err;
1667 #endif
1668     default:
1669         return -ENOSYS;
1670     }
1671 }
1672
1673 static void gdb_breakpoint_remove_all(void)
1674 {
1675     CPUState *env;
1676
1677     if (kvm_enabled()) {
1678         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1679         return;
1680     }
1681
1682     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1683         cpu_breakpoint_remove_all(env, BP_GDB);
1684 #ifndef CONFIG_USER_ONLY
1685         cpu_watchpoint_remove_all(env, BP_GDB);
1686 #endif
1687     }
1688 }
1689
1690 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1691 {
1692 #if defined(TARGET_I386)
1693     cpu_synchronize_state(s->c_cpu);
1694     s->c_cpu->eip = pc;
1695 #elif defined (TARGET_PPC)
1696     s->c_cpu->nip = pc;
1697 #elif defined (TARGET_SPARC)
1698     s->c_cpu->pc = pc;
1699     s->c_cpu->npc = pc + 4;
1700 #elif defined (TARGET_ARM)
1701     s->c_cpu->regs[15] = pc;
1702 #elif defined (TARGET_SH4)
1703     s->c_cpu->pc = pc;
1704 #elif defined (TARGET_MIPS)
1705     s->c_cpu->active_tc.PC = pc & ~(target_ulong)1;
1706     if (pc & 1) {
1707         s->c_cpu->hflags |= MIPS_HFLAG_M16;
1708     } else {
1709         s->c_cpu->hflags &= ~(MIPS_HFLAG_M16);
1710     }
1711 #elif defined (TARGET_MICROBLAZE)
1712     s->c_cpu->sregs[SR_PC] = pc;
1713 #elif defined (TARGET_CRIS)
1714     s->c_cpu->pc = pc;
1715 #elif defined (TARGET_ALPHA)
1716     s->c_cpu->pc = pc;
1717 #elif defined (TARGET_S390X)
1718     cpu_synchronize_state(s->c_cpu);
1719     s->c_cpu->psw.addr = pc;
1720 #endif
1721 }
1722
1723 static inline int gdb_id(CPUState *env)
1724 {
1725 #if defined(CONFIG_USER_ONLY) && defined(CONFIG_USE_NPTL)
1726     return env->host_tid;
1727 #else
1728     return env->cpu_index + 1;
1729 #endif
1730 }
1731
1732 static CPUState *find_cpu(uint32_t thread_id)
1733 {
1734     CPUState *env;
1735
1736     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1737         if (gdb_id(env) == thread_id) {
1738             return env;
1739         }
1740     }
1741
1742     return NULL;
1743 }
1744
1745 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1746 {
1747     CPUState *env;
1748     const char *p;
1749     uint32_t thread;
1750     int ch, reg_size, type, res;
1751     char buf[MAX_PACKET_LENGTH];
1752     uint8_t mem_buf[MAX_PACKET_LENGTH];
1753     uint8_t *registers;
1754     target_ulong addr, len;
1755
1756 #ifdef DEBUG_GDB
1757     printf("command='%s'\n", line_buf);
1758 #endif
1759     p = line_buf;
1760     ch = *p++;
1761     switch(ch) {
1762     case '?':
1763         /* TODO: Make this return the correct value for user-mode.  */
1764         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1765                  gdb_id(s->c_cpu));
1766         put_packet(s, buf);
1767         /* Remove all the breakpoints when this query is issued,
1768          * because gdb is doing and initial connect and the state
1769          * should be cleaned up.
1770          */
1771         gdb_breakpoint_remove_all();
1772         break;
1773     case 'c':
1774         if (*p != '\0') {
1775             addr = strtoull(p, (char **)&p, 16);
1776             gdb_set_cpu_pc(s, addr);
1777         }
1778         s->signal = 0;
1779         gdb_continue(s);
1780         return RS_IDLE;
1781     case 'C':
1782         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1783         if (s->signal == -1)
1784             s->signal = 0;
1785         gdb_continue(s);
1786         return RS_IDLE;
1787     case 'v':
1788         if (strncmp(p, "Cont", 4) == 0) {
1789             int res_signal, res_thread;
1790
1791             p += 4;
1792             if (*p == '?') {
1793                 put_packet(s, "vCont;c;C;s;S");
1794                 break;
1795             }
1796             res = 0;
1797             res_signal = 0;
1798             res_thread = 0;
1799             while (*p) {
1800                 int action, signal;
1801
1802                 if (*p++ != ';') {
1803                     res = 0;
1804                     break;
1805                 }
1806                 action = *p++;
1807                 signal = 0;
1808                 if (action == 'C' || action == 'S') {
1809                     signal = strtoul(p, (char **)&p, 16);
1810                 } else if (action != 'c' && action != 's') {
1811                     res = 0;
1812                     break;
1813                 }
1814                 thread = 0;
1815                 if (*p == ':') {
1816                     thread = strtoull(p+1, (char **)&p, 16);
1817                 }
1818                 action = tolower(action);
1819                 if (res == 0 || (res == 'c' && action == 's')) {
1820                     res = action;
1821                     res_signal = signal;
1822                     res_thread = thread;
1823                 }
1824             }
1825             if (res) {
1826                 if (res_thread != -1 && res_thread != 0) {
1827                     env = find_cpu(res_thread);
1828                     if (env == NULL) {
1829                         put_packet(s, "E22");
1830                         break;
1831                     }
1832                     s->c_cpu = env;
1833                 }
1834                 if (res == 's') {
1835                     cpu_single_step(s->c_cpu, sstep_flags);
1836                 }
1837                 s->signal = res_signal;
1838                 gdb_continue(s);
1839                 return RS_IDLE;
1840             }
1841             break;
1842         } else {
1843             goto unknown_command;
1844         }
1845     case 'k':
1846         /* Kill the target */
1847         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1848         exit(0);
1849     case 'D':
1850         /* Detach packet */
1851         gdb_breakpoint_remove_all();
1852         gdb_continue(s);
1853         put_packet(s, "OK");
1854         break;
1855     case 's':
1856         if (*p != '\0') {
1857             addr = strtoull(p, (char **)&p, 16);
1858             gdb_set_cpu_pc(s, addr);
1859         }
1860         cpu_single_step(s->c_cpu, sstep_flags);
1861         gdb_continue(s);
1862         return RS_IDLE;
1863     case 'F':
1864         {
1865             target_ulong ret;
1866             target_ulong err;
1867
1868             ret = strtoull(p, (char **)&p, 16);
1869             if (*p == ',') {
1870                 p++;
1871                 err = strtoull(p, (char **)&p, 16);
1872             } else {
1873                 err = 0;
1874             }
1875             if (*p == ',')
1876                 p++;
1877             type = *p;
1878             if (gdb_current_syscall_cb)
1879                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1880             if (type == 'C') {
1881                 put_packet(s, "T02");
1882             } else {
1883                 gdb_continue(s);
1884             }
1885         }
1886         break;
1887     case 'g':
1888         cpu_synchronize_state(s->g_cpu);
1889         len = 0;
1890         for (addr = 0; addr < num_g_regs; addr++) {
1891             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1892             len += reg_size;
1893         }
1894         memtohex(buf, mem_buf, len);
1895         put_packet(s, buf);
1896         break;
1897     case 'G':
1898         cpu_synchronize_state(s->g_cpu);
1899         registers = mem_buf;
1900         len = strlen(p) / 2;
1901         hextomem((uint8_t *)registers, p, len);
1902         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1903             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1904             len -= reg_size;
1905             registers += reg_size;
1906         }
1907         put_packet(s, "OK");
1908         break;
1909     case 'm':
1910         addr = strtoull(p, (char **)&p, 16);
1911         if (*p == ',')
1912             p++;
1913         len = strtoull(p, NULL, 16);
1914         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1915             put_packet (s, "E14");
1916         } else {
1917             memtohex(buf, mem_buf, len);
1918             put_packet(s, buf);
1919         }
1920         break;
1921     case 'M':
1922         addr = strtoull(p, (char **)&p, 16);
1923         if (*p == ',')
1924             p++;
1925         len = strtoull(p, (char **)&p, 16);
1926         if (*p == ':')
1927             p++;
1928         hextomem(mem_buf, p, len);
1929         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1930             put_packet(s, "E14");
1931         else
1932             put_packet(s, "OK");
1933         break;
1934     case 'p':
1935         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1936            This works, but can be very slow.  Anything new enough to
1937            understand XML also knows how to use this properly.  */
1938         if (!gdb_has_xml)
1939             goto unknown_command;
1940         addr = strtoull(p, (char **)&p, 16);
1941         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1942         if (reg_size) {
1943             memtohex(buf, mem_buf, reg_size);
1944             put_packet(s, buf);
1945         } else {
1946             put_packet(s, "E14");
1947         }
1948         break;
1949     case 'P':
1950         if (!gdb_has_xml)
1951             goto unknown_command;
1952         addr = strtoull(p, (char **)&p, 16);
1953         if (*p == '=')
1954             p++;
1955         reg_size = strlen(p) / 2;
1956         hextomem(mem_buf, p, reg_size);
1957         gdb_write_register(s->g_cpu, mem_buf, addr);
1958         put_packet(s, "OK");
1959         break;
1960     case 'Z':
1961     case 'z':
1962         type = strtoul(p, (char **)&p, 16);
1963         if (*p == ',')
1964             p++;
1965         addr = strtoull(p, (char **)&p, 16);
1966         if (*p == ',')
1967             p++;
1968         len = strtoull(p, (char **)&p, 16);
1969         if (ch == 'Z')
1970             res = gdb_breakpoint_insert(addr, len, type);
1971         else
1972             res = gdb_breakpoint_remove(addr, len, type);
1973         if (res >= 0)
1974              put_packet(s, "OK");
1975         else if (res == -ENOSYS)
1976             put_packet(s, "");
1977         else
1978             put_packet(s, "E22");
1979         break;
1980     case 'H':
1981         type = *p++;
1982         thread = strtoull(p, (char **)&p, 16);
1983         if (thread == -1 || thread == 0) {
1984             put_packet(s, "OK");
1985             break;
1986         }
1987         env = find_cpu(thread);
1988         if (env == NULL) {
1989             put_packet(s, "E22");
1990             break;
1991         }
1992         switch (type) {
1993         case 'c':
1994             s->c_cpu = env;
1995             put_packet(s, "OK");
1996             break;
1997         case 'g':
1998             s->g_cpu = env;
1999             put_packet(s, "OK");
2000             break;
2001         default:
2002              put_packet(s, "E22");
2003              break;
2004         }
2005         break;
2006     case 'T':
2007         thread = strtoull(p, (char **)&p, 16);
2008         env = find_cpu(thread);
2009
2010         if (env != NULL) {
2011             put_packet(s, "OK");
2012         } else {
2013             put_packet(s, "E22");
2014         }
2015         break;
2016     case 'q':
2017     case 'Q':
2018         /* parse any 'q' packets here */
2019         if (!strcmp(p,"qemu.sstepbits")) {
2020             /* Query Breakpoint bit definitions */
2021             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
2022                      SSTEP_ENABLE,
2023                      SSTEP_NOIRQ,
2024                      SSTEP_NOTIMER);
2025             put_packet(s, buf);
2026             break;
2027         } else if (strncmp(p,"qemu.sstep",10) == 0) {
2028             /* Display or change the sstep_flags */
2029             p += 10;
2030             if (*p != '=') {
2031                 /* Display current setting */
2032                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
2033                 put_packet(s, buf);
2034                 break;
2035             }
2036             p++;
2037             type = strtoul(p, (char **)&p, 16);
2038             sstep_flags = type;
2039             put_packet(s, "OK");
2040             break;
2041         } else if (strcmp(p,"C") == 0) {
2042             /* "Current thread" remains vague in the spec, so always return
2043              *  the first CPU (gdb returns the first thread). */
2044             put_packet(s, "QC1");
2045             break;
2046         } else if (strcmp(p,"fThreadInfo") == 0) {
2047             s->query_cpu = first_cpu;
2048             goto report_cpuinfo;
2049         } else if (strcmp(p,"sThreadInfo") == 0) {
2050         report_cpuinfo:
2051             if (s->query_cpu) {
2052                 snprintf(buf, sizeof(buf), "m%x", gdb_id(s->query_cpu));
2053                 put_packet(s, buf);
2054                 s->query_cpu = s->query_cpu->next_cpu;
2055             } else
2056                 put_packet(s, "l");
2057             break;
2058         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
2059             thread = strtoull(p+16, (char **)&p, 16);
2060             env = find_cpu(thread);
2061             if (env != NULL) {
2062                 cpu_synchronize_state(env);
2063                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
2064                                "CPU#%d [%s]", env->cpu_index,
2065                                env->halted ? "halted " : "running");
2066                 memtohex(buf, mem_buf, len);
2067                 put_packet(s, buf);
2068             }
2069             break;
2070         }
2071 #ifdef CONFIG_USER_ONLY
2072         else if (strncmp(p, "Offsets", 7) == 0) {
2073             TaskState *ts = s->c_cpu->opaque;
2074
2075             snprintf(buf, sizeof(buf),
2076                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
2077                      ";Bss=" TARGET_ABI_FMT_lx,
2078                      ts->info->code_offset,
2079                      ts->info->data_offset,
2080                      ts->info->data_offset);
2081             put_packet(s, buf);
2082             break;
2083         }
2084 #else /* !CONFIG_USER_ONLY */
2085         else if (strncmp(p, "Rcmd,", 5) == 0) {
2086             int len = strlen(p + 5);
2087
2088             if ((len % 2) != 0) {
2089                 put_packet(s, "E01");
2090                 break;
2091             }
2092             hextomem(mem_buf, p + 5, len);
2093             len = len / 2;
2094             mem_buf[len++] = 0;
2095             qemu_chr_read(s->mon_chr, mem_buf, len);
2096             put_packet(s, "OK");
2097             break;
2098         }
2099 #endif /* !CONFIG_USER_ONLY */
2100         if (strncmp(p, "Supported", 9) == 0) {
2101             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
2102 #ifdef GDB_CORE_XML
2103             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
2104 #endif
2105             put_packet(s, buf);
2106             break;
2107         }
2108 #ifdef GDB_CORE_XML
2109         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
2110             const char *xml;
2111             target_ulong total_len;
2112
2113             gdb_has_xml = 1;
2114             p += 19;
2115             xml = get_feature_xml(p, &p);
2116             if (!xml) {
2117                 snprintf(buf, sizeof(buf), "E00");
2118                 put_packet(s, buf);
2119                 break;
2120             }
2121
2122             if (*p == ':')
2123                 p++;
2124             addr = strtoul(p, (char **)&p, 16);
2125             if (*p == ',')
2126                 p++;
2127             len = strtoul(p, (char **)&p, 16);
2128
2129             total_len = strlen(xml);
2130             if (addr > total_len) {
2131                 snprintf(buf, sizeof(buf), "E00");
2132                 put_packet(s, buf);
2133                 break;
2134             }
2135             if (len > (MAX_PACKET_LENGTH - 5) / 2)
2136                 len = (MAX_PACKET_LENGTH - 5) / 2;
2137             if (len < total_len - addr) {
2138                 buf[0] = 'm';
2139                 len = memtox(buf + 1, xml + addr, len);
2140             } else {
2141                 buf[0] = 'l';
2142                 len = memtox(buf + 1, xml + addr, total_len - addr);
2143             }
2144             put_packet_binary(s, buf, len + 1);
2145             break;
2146         }
2147 #endif
2148         /* Unrecognised 'q' command.  */
2149         goto unknown_command;
2150
2151     default:
2152     unknown_command:
2153         /* put empty packet */
2154         buf[0] = '\0';
2155         put_packet(s, buf);
2156         break;
2157     }
2158     return RS_IDLE;
2159 }
2160
2161 void gdb_set_stop_cpu(CPUState *env)
2162 {
2163     gdbserver_state->c_cpu = env;
2164     gdbserver_state->g_cpu = env;
2165 }
2166
2167 #ifndef CONFIG_USER_ONLY
2168 static void gdb_vm_state_change(void *opaque, int running, int reason)
2169 {
2170     GDBState *s = gdbserver_state;
2171     CPUState *env = s->c_cpu;
2172     char buf[256];
2173     const char *type;
2174     int ret;
2175
2176     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
2177         s->state == RS_INACTIVE || s->state == RS_SYSCALL)
2178         return;
2179
2180     /* disable single step if it was enable */
2181     cpu_single_step(env, 0);
2182
2183     if (reason == EXCP_DEBUG) {
2184         if (env->watchpoint_hit) {
2185             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
2186             case BP_MEM_READ:
2187                 type = "r";
2188                 break;
2189             case BP_MEM_ACCESS:
2190                 type = "a";
2191                 break;
2192             default:
2193                 type = "";
2194                 break;
2195             }
2196             snprintf(buf, sizeof(buf),
2197                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
2198                      GDB_SIGNAL_TRAP, gdb_id(env), type,
2199                      env->watchpoint_hit->vaddr);
2200             put_packet(s, buf);
2201             env->watchpoint_hit = NULL;
2202             return;
2203         }
2204         tb_flush(env);
2205         ret = GDB_SIGNAL_TRAP;
2206     } else {
2207         ret = GDB_SIGNAL_INT;
2208     }
2209     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, gdb_id(env));
2210     put_packet(s, buf);
2211 }
2212 #endif
2213
2214 /* Send a gdb syscall request.
2215    This accepts limited printf-style format specifiers, specifically:
2216     %x  - target_ulong argument printed in hex.
2217     %lx - 64-bit argument printed in hex.
2218     %s  - string pointer (target_ulong) and length (int) pair.  */
2219 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
2220 {
2221     va_list va;
2222     char buf[256];
2223     char *p;
2224     target_ulong addr;
2225     uint64_t i64;
2226     GDBState *s;
2227
2228     s = gdbserver_state;
2229     if (!s)
2230         return;
2231     gdb_current_syscall_cb = cb;
2232     s->state = RS_SYSCALL;
2233 #ifndef CONFIG_USER_ONLY
2234     vm_stop(EXCP_DEBUG);
2235 #endif
2236     s->state = RS_IDLE;
2237     va_start(va, fmt);
2238     p = buf;
2239     *(p++) = 'F';
2240     while (*fmt) {
2241         if (*fmt == '%') {
2242             fmt++;
2243             switch (*fmt++) {
2244             case 'x':
2245                 addr = va_arg(va, target_ulong);
2246                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
2247                 break;
2248             case 'l':
2249                 if (*(fmt++) != 'x')
2250                     goto bad_format;
2251                 i64 = va_arg(va, uint64_t);
2252                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
2253                 break;
2254             case 's':
2255                 addr = va_arg(va, target_ulong);
2256                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
2257                               addr, va_arg(va, int));
2258                 break;
2259             default:
2260             bad_format:
2261                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2262                         fmt - 1);
2263                 break;
2264             }
2265         } else {
2266             *(p++) = *(fmt++);
2267         }
2268     }
2269     *p = 0;
2270     va_end(va);
2271     put_packet(s, buf);
2272 #ifdef CONFIG_USER_ONLY
2273     gdb_handlesig(s->c_cpu, 0);
2274 #else
2275     cpu_exit(s->c_cpu);
2276 #endif
2277 }
2278
2279 static void gdb_read_byte(GDBState *s, int ch)
2280 {
2281     int i, csum;
2282     uint8_t reply;
2283
2284 #ifndef CONFIG_USER_ONLY
2285     if (s->last_packet_len) {
2286         /* Waiting for a response to the last packet.  If we see the start
2287            of a new command then abandon the previous response.  */
2288         if (ch == '-') {
2289 #ifdef DEBUG_GDB
2290             printf("Got NACK, retransmitting\n");
2291 #endif
2292             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2293         }
2294 #ifdef DEBUG_GDB
2295         else if (ch == '+')
2296             printf("Got ACK\n");
2297         else
2298             printf("Got '%c' when expecting ACK/NACK\n", ch);
2299 #endif
2300         if (ch == '+' || ch == '$')
2301             s->last_packet_len = 0;
2302         if (ch != '$')
2303             return;
2304     }
2305     if (vm_running) {
2306         /* when the CPU is running, we cannot do anything except stop
2307            it when receiving a char */
2308         vm_stop(EXCP_INTERRUPT);
2309     } else
2310 #endif
2311     {
2312         switch(s->state) {
2313         case RS_IDLE:
2314             if (ch == '$') {
2315                 s->line_buf_index = 0;
2316                 s->state = RS_GETLINE;
2317             }
2318             break;
2319         case RS_GETLINE:
2320             if (ch == '#') {
2321             s->state = RS_CHKSUM1;
2322             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2323                 s->state = RS_IDLE;
2324             } else {
2325             s->line_buf[s->line_buf_index++] = ch;
2326             }
2327             break;
2328         case RS_CHKSUM1:
2329             s->line_buf[s->line_buf_index] = '\0';
2330             s->line_csum = fromhex(ch) << 4;
2331             s->state = RS_CHKSUM2;
2332             break;
2333         case RS_CHKSUM2:
2334             s->line_csum |= fromhex(ch);
2335             csum = 0;
2336             for(i = 0; i < s->line_buf_index; i++) {
2337                 csum += s->line_buf[i];
2338             }
2339             if (s->line_csum != (csum & 0xff)) {
2340                 reply = '-';
2341                 put_buffer(s, &reply, 1);
2342                 s->state = RS_IDLE;
2343             } else {
2344                 reply = '+';
2345                 put_buffer(s, &reply, 1);
2346                 s->state = gdb_handle_packet(s, s->line_buf);
2347             }
2348             break;
2349         default:
2350             abort();
2351         }
2352     }
2353 }
2354
2355 #ifdef CONFIG_USER_ONLY
2356 int
2357 gdb_queuesig (void)
2358 {
2359     GDBState *s;
2360
2361     s = gdbserver_state;
2362
2363     if (gdbserver_fd < 0 || s->fd < 0)
2364         return 0;
2365     else
2366         return 1;
2367 }
2368
2369 int
2370 gdb_handlesig (CPUState *env, int sig)
2371 {
2372   GDBState *s;
2373   char buf[256];
2374   int n;
2375
2376   s = gdbserver_state;
2377   if (gdbserver_fd < 0 || s->fd < 0)
2378     return sig;
2379
2380   /* disable single step if it was enabled */
2381   cpu_single_step(env, 0);
2382   tb_flush(env);
2383
2384   if (sig != 0)
2385     {
2386       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2387       put_packet(s, buf);
2388     }
2389   /* put_packet() might have detected that the peer terminated the
2390      connection.  */
2391   if (s->fd < 0)
2392       return sig;
2393
2394   sig = 0;
2395   s->state = RS_IDLE;
2396   s->running_state = 0;
2397   while (s->running_state == 0) {
2398       n = read (s->fd, buf, 256);
2399       if (n > 0)
2400         {
2401           int i;
2402
2403           for (i = 0; i < n; i++)
2404             gdb_read_byte (s, buf[i]);
2405         }
2406       else if (n == 0 || errno != EAGAIN)
2407         {
2408           /* XXX: Connection closed.  Should probably wait for annother
2409              connection before continuing.  */
2410           return sig;
2411         }
2412   }
2413   sig = s->signal;
2414   s->signal = 0;
2415   return sig;
2416 }
2417
2418 /* Tell the remote gdb that the process has exited.  */
2419 void gdb_exit(CPUState *env, int code)
2420 {
2421   GDBState *s;
2422   char buf[4];
2423
2424   s = gdbserver_state;
2425   if (gdbserver_fd < 0 || s->fd < 0)
2426     return;
2427
2428   snprintf(buf, sizeof(buf), "W%02x", code);
2429   put_packet(s, buf);
2430 }
2431
2432 /* Tell the remote gdb that the process has exited due to SIG.  */
2433 void gdb_signalled(CPUState *env, int sig)
2434 {
2435   GDBState *s;
2436   char buf[4];
2437
2438   s = gdbserver_state;
2439   if (gdbserver_fd < 0 || s->fd < 0)
2440     return;
2441
2442   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2443   put_packet(s, buf);
2444 }
2445
2446 static void gdb_accept(void)
2447 {
2448     GDBState *s;
2449     struct sockaddr_in sockaddr;
2450     socklen_t len;
2451     int val, fd;
2452
2453     for(;;) {
2454         len = sizeof(sockaddr);
2455         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2456         if (fd < 0 && errno != EINTR) {
2457             perror("accept");
2458             return;
2459         } else if (fd >= 0) {
2460 #ifndef _WIN32
2461             fcntl(fd, F_SETFD, FD_CLOEXEC);
2462 #endif
2463             break;
2464         }
2465     }
2466
2467     /* set short latency */
2468     val = 1;
2469     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2470
2471     s = qemu_mallocz(sizeof(GDBState));
2472     s->c_cpu = first_cpu;
2473     s->g_cpu = first_cpu;
2474     s->fd = fd;
2475     gdb_has_xml = 0;
2476
2477     gdbserver_state = s;
2478
2479     fcntl(fd, F_SETFL, O_NONBLOCK);
2480 }
2481
2482 static int gdbserver_open(int port)
2483 {
2484     struct sockaddr_in sockaddr;
2485     int fd, val, ret;
2486
2487     fd = socket(PF_INET, SOCK_STREAM, 0);
2488     if (fd < 0) {
2489         perror("socket");
2490         return -1;
2491     }
2492 #ifndef _WIN32
2493     fcntl(fd, F_SETFD, FD_CLOEXEC);
2494 #endif
2495
2496     /* allow fast reuse */
2497     val = 1;
2498     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2499
2500     sockaddr.sin_family = AF_INET;
2501     sockaddr.sin_port = htons(port);
2502     sockaddr.sin_addr.s_addr = 0;
2503     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2504     if (ret < 0) {
2505         perror("bind");
2506         return -1;
2507     }
2508     ret = listen(fd, 0);
2509     if (ret < 0) {
2510         perror("listen");
2511         return -1;
2512     }
2513     return fd;
2514 }
2515
2516 int gdbserver_start(int port)
2517 {
2518     gdbserver_fd = gdbserver_open(port);
2519     if (gdbserver_fd < 0)
2520         return -1;
2521     /* accept connections */
2522     gdb_accept();
2523     return 0;
2524 }
2525
2526 /* Disable gdb stub for child processes.  */
2527 void gdbserver_fork(CPUState *env)
2528 {
2529     GDBState *s = gdbserver_state;
2530     if (gdbserver_fd < 0 || s->fd < 0)
2531       return;
2532     close(s->fd);
2533     s->fd = -1;
2534     cpu_breakpoint_remove_all(env, BP_GDB);
2535     cpu_watchpoint_remove_all(env, BP_GDB);
2536 }
2537 #else
2538 static int gdb_chr_can_receive(void *opaque)
2539 {
2540   /* We can handle an arbitrarily large amount of data.
2541    Pick the maximum packet size, which is as good as anything.  */
2542   return MAX_PACKET_LENGTH;
2543 }
2544
2545 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2546 {
2547     int i;
2548
2549     for (i = 0; i < size; i++) {
2550         gdb_read_byte(gdbserver_state, buf[i]);
2551     }
2552 }
2553
2554 static void gdb_chr_event(void *opaque, int event)
2555 {
2556     switch (event) {
2557     case CHR_EVENT_OPENED:
2558         vm_stop(EXCP_INTERRUPT);
2559         gdb_has_xml = 0;
2560         break;
2561     default:
2562         break;
2563     }
2564 }
2565
2566 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2567 {
2568     char buf[MAX_PACKET_LENGTH];
2569
2570     buf[0] = 'O';
2571     if (len > (MAX_PACKET_LENGTH/2) - 1)
2572         len = (MAX_PACKET_LENGTH/2) - 1;
2573     memtohex(buf + 1, (uint8_t *)msg, len);
2574     put_packet(s, buf);
2575 }
2576
2577 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2578 {
2579     const char *p = (const char *)buf;
2580     int max_sz;
2581
2582     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2583     for (;;) {
2584         if (len <= max_sz) {
2585             gdb_monitor_output(gdbserver_state, p, len);
2586             break;
2587         }
2588         gdb_monitor_output(gdbserver_state, p, max_sz);
2589         p += max_sz;
2590         len -= max_sz;
2591     }
2592     return len;
2593 }
2594
2595 #ifndef _WIN32
2596 static void gdb_sigterm_handler(int signal)
2597 {
2598     if (vm_running)
2599         vm_stop(EXCP_INTERRUPT);
2600 }
2601 #endif
2602
2603 int gdbserver_start(const char *device)
2604 {
2605     GDBState *s;
2606     char gdbstub_device_name[128];
2607     CharDriverState *chr = NULL;
2608     CharDriverState *mon_chr;
2609
2610     if (!device)
2611         return -1;
2612     if (strcmp(device, "none") != 0) {
2613         if (strstart(device, "tcp:", NULL)) {
2614             /* enforce required TCP attributes */
2615             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2616                      "%s,nowait,nodelay,server", device);
2617             device = gdbstub_device_name;
2618         }
2619 #ifndef _WIN32
2620         else if (strcmp(device, "stdio") == 0) {
2621             struct sigaction act;
2622
2623             memset(&act, 0, sizeof(act));
2624             act.sa_handler = gdb_sigterm_handler;
2625             sigaction(SIGINT, &act, NULL);
2626         }
2627 #endif
2628         chr = qemu_chr_open("gdb", device, NULL);
2629         if (!chr)
2630             return -1;
2631
2632         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2633                               gdb_chr_event, NULL);
2634     }
2635
2636     s = gdbserver_state;
2637     if (!s) {
2638         s = qemu_mallocz(sizeof(GDBState));
2639         gdbserver_state = s;
2640
2641         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2642
2643         /* Initialize a monitor terminal for gdb */
2644         mon_chr = qemu_mallocz(sizeof(*mon_chr));
2645         mon_chr->chr_write = gdb_monitor_write;
2646         monitor_init(mon_chr, 0);
2647     } else {
2648         if (s->chr)
2649             qemu_chr_close(s->chr);
2650         mon_chr = s->mon_chr;
2651         memset(s, 0, sizeof(GDBState));
2652     }
2653     s->c_cpu = first_cpu;
2654     s->g_cpu = first_cpu;
2655     s->chr = chr;
2656     s->state = chr ? RS_IDLE : RS_INACTIVE;
2657     s->mon_chr = mon_chr;
2658
2659     return 0;
2660 }
2661 #endif