gdbstub.c

   1 /*
   2  * gdb server stub
   3  *
   4  * Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "qemu-common.h"
  21 #ifdef CONFIG_USER_ONLY
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <stdarg.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <fcntl.h>
  29
  30 #include "qemu.h"
  31 #else
  32 #include "monitor.h"
  33 #include "qemu-char.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #endif
  37
  38 #define MAX_PACKET_LENGTH 4096
  39
  40 #include "qemu_socket.h"
  41 #include "kvm.h"
  42
  43
  44 enum {
  45     GDB_SIGNAL_0 = 0,
  46     GDB_SIGNAL_INT = 2,
  47     GDB_SIGNAL_TRAP = 5,
  48     GDB_SIGNAL_UNKNOWN = 143
  49 };
  50
  51 #ifdef CONFIG_USER_ONLY
  52
  53 /* Map target signal numbers to GDB protocol signal numbers and vice
  54  * versa.  For user emulation's currently supported systems, we can
  55  * assume most signals are defined.
  56  */
  57
  58 static int gdb_signal_table[] = {
  59     0,
  60     TARGET_SIGHUP,
  61     TARGET_SIGINT,
  62     TARGET_SIGQUIT,
  63     TARGET_SIGILL,
  64     TARGET_SIGTRAP,
  65     TARGET_SIGABRT,
  66     -1, /* SIGEMT */
  67     TARGET_SIGFPE,
  68     TARGET_SIGKILL,
  69     TARGET_SIGBUS,
  70     TARGET_SIGSEGV,
  71     TARGET_SIGSYS,
  72     TARGET_SIGPIPE,
  73     TARGET_SIGALRM,
  74     TARGET_SIGTERM,
  75     TARGET_SIGURG,
  76     TARGET_SIGSTOP,
  77     TARGET_SIGTSTP,
  78     TARGET_SIGCONT,
  79     TARGET_SIGCHLD,
  80     TARGET_SIGTTIN,
  81     TARGET_SIGTTOU,
  82     TARGET_SIGIO,
  83     TARGET_SIGXCPU,
  84     TARGET_SIGXFSZ,
  85     TARGET_SIGVTALRM,
  86     TARGET_SIGPROF,
  87     TARGET_SIGWINCH,
  88     -1, /* SIGLOST */
  89     TARGET_SIGUSR1,
  90     TARGET_SIGUSR2,
  91 #ifdef TARGET_SIGPWR
  92     TARGET_SIGPWR,
  93 #else
  94     -1,
  95 #endif
  96     -1, /* SIGPOLL */
  97     -1,
  98     -1,
  99     -1,
 100     -1,
 101     -1,
 102     -1,
 103     -1,
 104     -1,
 105     -1,
 106     -1,
 107     -1,
 108 #ifdef __SIGRTMIN
 109     __SIGRTMIN + 1,
 110     __SIGRTMIN + 2,
 111     __SIGRTMIN + 3,
 112     __SIGRTMIN + 4,
 113     __SIGRTMIN + 5,
 114     __SIGRTMIN + 6,
 115     __SIGRTMIN + 7,
 116     __SIGRTMIN + 8,
 117     __SIGRTMIN + 9,
 118     __SIGRTMIN + 10,
 119     __SIGRTMIN + 11,
 120     __SIGRTMIN + 12,
 121     __SIGRTMIN + 13,
 122     __SIGRTMIN + 14,
 123     __SIGRTMIN + 15,
 124     __SIGRTMIN + 16,
 125     __SIGRTMIN + 17,
 126     __SIGRTMIN + 18,
 127     __SIGRTMIN + 19,
 128     __SIGRTMIN + 20,
 129     __SIGRTMIN + 21,
 130     __SIGRTMIN + 22,
 131     __SIGRTMIN + 23,
 132     __SIGRTMIN + 24,
 133     __SIGRTMIN + 25,
 134     __SIGRTMIN + 26,
 135     __SIGRTMIN + 27,
 136     __SIGRTMIN + 28,
 137     __SIGRTMIN + 29,
 138     __SIGRTMIN + 30,
 139     __SIGRTMIN + 31,
 140     -1, /* SIGCANCEL */
 141     __SIGRTMIN,
 142     __SIGRTMIN + 32,
 143     __SIGRTMIN + 33,
 144     __SIGRTMIN + 34,
 145     __SIGRTMIN + 35,
 146     __SIGRTMIN + 36,
 147     __SIGRTMIN + 37,
 148     __SIGRTMIN + 38,
 149     __SIGRTMIN + 39,
 150     __SIGRTMIN + 40,
 151     __SIGRTMIN + 41,
 152     __SIGRTMIN + 42,
 153     __SIGRTMIN + 43,
 154     __SIGRTMIN + 44,
 155     __SIGRTMIN + 45,
 156     __SIGRTMIN + 46,
 157     __SIGRTMIN + 47,
 158     __SIGRTMIN + 48,
 159     __SIGRTMIN + 49,
 160     __SIGRTMIN + 50,
 161     __SIGRTMIN + 51,
 162     __SIGRTMIN + 52,
 163     __SIGRTMIN + 53,
 164     __SIGRTMIN + 54,
 165     __SIGRTMIN + 55,
 166     __SIGRTMIN + 56,
 167     __SIGRTMIN + 57,
 168     __SIGRTMIN + 58,
 169     __SIGRTMIN + 59,
 170     __SIGRTMIN + 60,
 171     __SIGRTMIN + 61,
 172     __SIGRTMIN + 62,
 173     __SIGRTMIN + 63,
 174     __SIGRTMIN + 64,
 175     __SIGRTMIN + 65,
 176     __SIGRTMIN + 66,
 177     __SIGRTMIN + 67,
 178     __SIGRTMIN + 68,
 179     __SIGRTMIN + 69,
 180     __SIGRTMIN + 70,
 181     __SIGRTMIN + 71,
 182     __SIGRTMIN + 72,
 183     __SIGRTMIN + 73,
 184     __SIGRTMIN + 74,
 185     __SIGRTMIN + 75,
 186     __SIGRTMIN + 76,
 187     __SIGRTMIN + 77,
 188     __SIGRTMIN + 78,
 189     __SIGRTMIN + 79,
 190     __SIGRTMIN + 80,
 191     __SIGRTMIN + 81,
 192     __SIGRTMIN + 82,
 193     __SIGRTMIN + 83,
 194     __SIGRTMIN + 84,
 195     __SIGRTMIN + 85,
 196     __SIGRTMIN + 86,
 197     __SIGRTMIN + 87,
 198     __SIGRTMIN + 88,
 199     __SIGRTMIN + 89,
 200     __SIGRTMIN + 90,
 201     __SIGRTMIN + 91,
 202     __SIGRTMIN + 92,
 203     __SIGRTMIN + 93,
 204     __SIGRTMIN + 94,
 205     __SIGRTMIN + 95,
 206     -1, /* SIGINFO */
 207     -1, /* UNKNOWN */
 208     -1, /* DEFAULT */
 209     -1,
 210     -1,
 211     -1,
 212     -1,
 213     -1,
 214     -1
 215 #endif
 216 };
 217 #else
 218 /* In system mode we only need SIGINT and SIGTRAP; other signals
 219    are not yet supported.  */
 220
 221 enum {
 222     TARGET_SIGINT = 2,
 223     TARGET_SIGTRAP = 5
 224 };
 225
 226 static int gdb_signal_table[] = {
 227     -1,
 228     -1,
 229     TARGET_SIGINT,
 230     -1,
 231     -1,
 232     TARGET_SIGTRAP
 233 };
 234 #endif
 235
 236 #ifdef CONFIG_USER_ONLY
 237 static int target_signal_to_gdb (int sig)
 238 {
 239     int i;
 240     for (i = 0; i < ARRAY_SIZE (gdb_signal_table); i++)
 241         if (gdb_signal_table[i] == sig)
 242             return i;
 243     return GDB_SIGNAL_UNKNOWN;
 244 }
 245 #endif
 246
 247 static int gdb_signal_to_target (int sig)
 248 {
 249     if (sig < ARRAY_SIZE (gdb_signal_table))
 250         return gdb_signal_table[sig];
 251     else
 252         return -1;
 253 }
 254
 255 //#define DEBUG_GDB
 256
 257 typedef struct GDBRegisterState {
 258     int base_reg;
 259     int num_regs;
 260     gdb_reg_cb get_reg;
 261     gdb_reg_cb set_reg;
 262     const char *xml;
 263     struct GDBRegisterState *next;
 264 } GDBRegisterState;
 265
 266 enum RSState {
 267     RS_INACTIVE,
 268     RS_IDLE,
 269     RS_GETLINE,
 270     RS_CHKSUM1,
 271     RS_CHKSUM2,
 272     RS_SYSCALL,
 273 };
 274 typedef struct GDBState {
 275     CPUState *c_cpu; /* current CPU for step/continue ops */
 276     CPUState *g_cpu; /* current CPU for other ops */
 277     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
 278     enum RSState state; /* parsing state */
 279     char line_buf[MAX_PACKET_LENGTH];
 280     int line_buf_index;
 281     int line_csum;
 282     uint8_t last_packet[MAX_PACKET_LENGTH + 4];
 283     int last_packet_len;
 284     int signal;
 285 #ifdef CONFIG_USER_ONLY
 286     int fd;
 287     int running_state;
 288 #else
 289     CharDriverState *chr;
 290     CharDriverState *mon_chr;
 291 #endif
 292 } GDBState;
 293
 294 /* By default use no IRQs and no timers while single stepping so as to
 295  * make single stepping like an ICE HW step.
 296  */
 297 static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 298
 299 static GDBState *gdbserver_state;
 300
 301 /* This is an ugly hack to cope with both new and old gdb.
 302    If gdb sends qXfer:features:read then assume we're talking to a newish
 303    gdb that understands target descriptions.  */
 304 static int gdb_has_xml;
 305
 306 #ifdef CONFIG_USER_ONLY
 307 /* XXX: This is not thread safe.  Do we care?  */
 308 static int gdbserver_fd = -1;
 309
 310 static int get_char(GDBState *s)
 311 {
 312     uint8_t ch;
 313     int ret;
 314
 315     for(;;) {
 316         ret = recv(s->fd, &ch, 1, 0);
 317         if (ret < 0) {
 318             if (errno == ECONNRESET)
 319                 s->fd = -1;
 320             if (errno != EINTR && errno != EAGAIN)
 321                 return -1;
 322         } else if (ret == 0) {
 323             close(s->fd);
 324             s->fd = -1;
 325             return -1;
 326         } else {
 327             break;
 328         }
 329     }
 330     return ch;
 331 }
 332 #endif
 333
 334 static gdb_syscall_complete_cb gdb_current_syscall_cb;
 335
 336 static enum {
 337     GDB_SYS_UNKNOWN,
 338     GDB_SYS_ENABLED,
 339     GDB_SYS_DISABLED,
 340 } gdb_syscall_mode;
 341
 342 /* If gdb is connected when the first semihosting syscall occurs then use
 343    remote gdb syscalls.  Otherwise use native file IO.  */
 344 int use_gdb_syscalls(void)
 345 {
 346     if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
 347         gdb_syscall_mode = (gdbserver_state ? GDB_SYS_ENABLED
 348                                             : GDB_SYS_DISABLED);
 349     }
 350     return gdb_syscall_mode == GDB_SYS_ENABLED;
 351 }
 352
 353 /* Resume execution.  */
 354 static inline void gdb_continue(GDBState *s)
 355 {
 356 #ifdef CONFIG_USER_ONLY
 357     s->running_state = 1;
 358 #else
 359     vm_start();
 360 #endif
 361 }
 362
 363 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 364 {
 365 #ifdef CONFIG_USER_ONLY
 366     int ret;
 367
 368     while (len > 0) {
 369         ret = send(s->fd, buf, len, 0);
 370         if (ret < 0) {
 371             if (errno != EINTR && errno != EAGAIN)
 372                 return;
 373         } else {
 374             buf += ret;
 375             len -= ret;
 376         }
 377     }
 378 #else
 379     qemu_chr_write(s->chr, buf, len);
 380 #endif
 381 }
 382
 383 static inline int fromhex(int v)
 384 {
 385     if (v >= '0' && v <= '9')
 386         return v - '0';
 387     else if (v >= 'A' && v <= 'F')
 388         return v - 'A' + 10;
 389     else if (v >= 'a' && v <= 'f')
 390         return v - 'a' + 10;
 391     else
 392         return 0;
 393 }
 394
 395 static inline int tohex(int v)
 396 {
 397     if (v < 10)
 398         return v + '0';
 399     else
 400         return v - 10 + 'a';
 401 }
 402
 403 static void memtohex(char *buf, const uint8_t *mem, int len)
 404 {
 405     int i, c;
 406     char *q;
 407     q = buf;
 408     for(i = 0; i < len; i++) {
 409         c = mem[i];
 410         *q++ = tohex(c >> 4);
 411         *q++ = tohex(c & 0xf);
 412     }
 413     *q = '\0';
 414 }
 415
 416 static void hextomem(uint8_t *mem, const char *buf, int len)
 417 {
 418     int i;
 419
 420     for(i = 0; i < len; i++) {
 421         mem[i] = (fromhex(buf[0]) << 4) | fromhex(buf[1]);
 422         buf += 2;
 423     }
 424 }
 425
 426 /* return -1 if error, 0 if OK */
 427 static int put_packet_binary(GDBState *s, const char *buf, int len)
 428 {
 429     int csum, i;
 430     uint8_t *p;
 431
 432     for(;;) {
 433         p = s->last_packet;
 434         *(p++) = '$';
 435         memcpy(p, buf, len);
 436         p += len;
 437         csum = 0;
 438         for(i = 0; i < len; i++) {
 439             csum += buf[i];
 440         }
 441         *(p++) = '#';
 442         *(p++) = tohex((csum >> 4) & 0xf);
 443         *(p++) = tohex((csum) & 0xf);
 444
 445         s->last_packet_len = p - s->last_packet;
 446         put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 447
 448 #ifdef CONFIG_USER_ONLY
 449         i = get_char(s);
 450         if (i < 0)
 451             return -1;
 452         if (i == '+')
 453             break;
 454 #else
 455         break;
 456 #endif
 457     }
 458     return 0;
 459 }
 460
 461 /* return -1 if error, 0 if OK */
 462 static int put_packet(GDBState *s, const char *buf)
 463 {
 464 #ifdef DEBUG_GDB
 465     printf("reply='%s'\n", buf);
 466 #endif
 467
 468     return put_packet_binary(s, buf, strlen(buf));
 469 }
 470
 471 /* The GDB remote protocol transfers values in target byte order.  This means
 472    we can use the raw memory access routines to access the value buffer.
 473    Conveniently, these also handle the case where the buffer is mis-aligned.
 474  */
 475 #define GET_REG8(val) do { \
 476     stb_p(mem_buf, val); \
 477     return 1; \
 478     } while(0)
 479 #define GET_REG16(val) do { \
 480     stw_p(mem_buf, val); \
 481     return 2; \
 482     } while(0)
 483 #define GET_REG32(val) do { \
 484     stl_p(mem_buf, val); \
 485     return 4; \
 486     } while(0)
 487 #define GET_REG64(val) do { \
 488     stq_p(mem_buf, val); \
 489     return 8; \
 490     } while(0)
 491
 492 #if TARGET_LONG_BITS == 64
 493 #define GET_REGL(val) GET_REG64(val)
 494 #define ldtul_p(addr) ldq_p(addr)
 495 #else
 496 #define GET_REGL(val) GET_REG32(val)
 497 #define ldtul_p(addr) ldl_p(addr)
 498 #endif
 499
 500 #if defined(TARGET_I386)
 501
 502 #ifdef TARGET_X86_64
 503 static const int gpr_map[16] = {
 504     R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
 505     8, 9, 10, 11, 12, 13, 14, 15
 506 };
 507 #else
 508 #define gpr_map gpr_map32
 509 #endif
 510 static const int gpr_map32[8] = { 0, 1, 2, 3, 4, 5, 6, 7 };
 511
 512 #define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
 513
 514 #define IDX_IP_REG      CPU_NB_REGS
 515 #define IDX_FLAGS_REG   (IDX_IP_REG + 1)
 516 #define IDX_SEG_REGS    (IDX_FLAGS_REG + 1)
 517 #define IDX_FP_REGS     (IDX_SEG_REGS + 6)
 518 #define IDX_XMM_REGS    (IDX_FP_REGS + 16)
 519 #define IDX_MXCSR_REG   (IDX_XMM_REGS + CPU_NB_REGS)
 520
 521 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 522 {
 523     if (n < CPU_NB_REGS) {
 524         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 525             GET_REG64(env->regs[gpr_map[n]]);
 526         } else if (n < CPU_NB_REGS32) {
 527             GET_REG32(env->regs[gpr_map32[n]]);
 528         }
 529     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 530 #ifdef USE_X86LDOUBLE
 531         /* FIXME: byteswap float values - after fixing fpregs layout. */
 532         memcpy(mem_buf, &env->fpregs[n - IDX_FP_REGS], 10);
 533 #else
 534         memset(mem_buf, 0, 10);
 535 #endif
 536         return 10;
 537     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 538         n -= IDX_XMM_REGS;
 539         if (n < CPU_NB_REGS32 ||
 540             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 541             stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
 542             stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
 543             return 16;
 544         }
 545     } else {
 546         switch (n) {
 547         case IDX_IP_REG:
 548             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 549                 GET_REG64(env->eip);
 550             } else {
 551                 GET_REG32(env->eip);
 552             }
 553         case IDX_FLAGS_REG: GET_REG32(env->eflags);
 554
 555         case IDX_SEG_REGS:     GET_REG32(env->segs[R_CS].selector);
 556         case IDX_SEG_REGS + 1: GET_REG32(env->segs[R_SS].selector);
 557         case IDX_SEG_REGS + 2: GET_REG32(env->segs[R_DS].selector);
 558         case IDX_SEG_REGS + 3: GET_REG32(env->segs[R_ES].selector);
 559         case IDX_SEG_REGS + 4: GET_REG32(env->segs[R_FS].selector);
 560         case IDX_SEG_REGS + 5: GET_REG32(env->segs[R_GS].selector);
 561
 562         case IDX_FP_REGS + 8:  GET_REG32(env->fpuc);
 563         case IDX_FP_REGS + 9:  GET_REG32((env->fpus & ~0x3800) |
 564                                          (env->fpstt & 0x7) << 11);
 565         case IDX_FP_REGS + 10: GET_REG32(0); /* ftag */
 566         case IDX_FP_REGS + 11: GET_REG32(0); /* fiseg */
 567         case IDX_FP_REGS + 12: GET_REG32(0); /* fioff */
 568         case IDX_FP_REGS + 13: GET_REG32(0); /* foseg */
 569         case IDX_FP_REGS + 14: GET_REG32(0); /* fooff */
 570         case IDX_FP_REGS + 15: GET_REG32(0); /* fop */
 571
 572         case IDX_MXCSR_REG: GET_REG32(env->mxcsr);
 573         }
 574     }
 575     return 0;
 576 }
 577
 578 static int cpu_x86_gdb_load_seg(CPUState *env, int sreg, uint8_t *mem_buf)
 579 {
 580     uint16_t selector = ldl_p(mem_buf);
 581
 582     if (selector != env->segs[sreg].selector) {
 583 #if defined(CONFIG_USER_ONLY)
 584         cpu_x86_load_seg(env, sreg, selector);
 585 #else
 586         unsigned int limit, flags;
 587         target_ulong base;
 588
 589         if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK)) {
 590             base = selector << 4;
 591             limit = 0xffff;
 592             flags = 0;
 593         } else {
 594             if (!cpu_x86_get_descr_debug(env, selector, &base, &limit, &flags))
 595                 return 4;
 596         }
 597         cpu_x86_load_seg_cache(env, sreg, selector, base, limit, flags);
 598 #endif
 599     }
 600     return 4;
 601 }
 602
 603 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 604 {
 605     uint32_t tmp;
 606
 607     if (n < CPU_NB_REGS) {
 608         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 609             env->regs[gpr_map[n]] = ldtul_p(mem_buf);
 610             return sizeof(target_ulong);
 611         } else if (n < CPU_NB_REGS32) {
 612             n = gpr_map32[n];
 613             env->regs[n] &= ~0xffffffffUL;
 614             env->regs[n] |= (uint32_t)ldl_p(mem_buf);
 615             return 4;
 616         }
 617     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 618 #ifdef USE_X86LDOUBLE
 619         /* FIXME: byteswap float values - after fixing fpregs layout. */
 620         memcpy(&env->fpregs[n - IDX_FP_REGS], mem_buf, 10);
 621 #endif
 622         return 10;
 623     } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
 624         n -= IDX_XMM_REGS;
 625         if (n < CPU_NB_REGS32 ||
 626             (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
 627             env->xmm_regs[n].XMM_Q(0) = ldq_p(mem_buf);
 628             env->xmm_regs[n].XMM_Q(1) = ldq_p(mem_buf + 8);
 629             return 16;
 630         }
 631     } else {
 632         switch (n) {
 633         case IDX_IP_REG:
 634             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
 635                 env->eip = ldq_p(mem_buf);
 636                 return 8;
 637             } else {
 638                 env->eip &= ~0xffffffffUL;
 639                 env->eip |= (uint32_t)ldl_p(mem_buf);
 640                 return 4;
 641             }
 642         case IDX_FLAGS_REG:
 643             env->eflags = ldl_p(mem_buf);
 644             return 4;
 645
 646         case IDX_SEG_REGS:     return cpu_x86_gdb_load_seg(env, R_CS, mem_buf);
 647         case IDX_SEG_REGS + 1: return cpu_x86_gdb_load_seg(env, R_SS, mem_buf);
 648         case IDX_SEG_REGS + 2: return cpu_x86_gdb_load_seg(env, R_DS, mem_buf);
 649         case IDX_SEG_REGS + 3: return cpu_x86_gdb_load_seg(env, R_ES, mem_buf);
 650         case IDX_SEG_REGS + 4: return cpu_x86_gdb_load_seg(env, R_FS, mem_buf);
 651         case IDX_SEG_REGS + 5: return cpu_x86_gdb_load_seg(env, R_GS, mem_buf);
 652
 653         case IDX_FP_REGS + 8:
 654             env->fpuc = ldl_p(mem_buf);
 655             return 4;
 656         case IDX_FP_REGS + 9:
 657             tmp = ldl_p(mem_buf);
 658             env->fpstt = (tmp >> 11) & 7;
 659             env->fpus = tmp & ~0x3800;
 660             return 4;
 661         case IDX_FP_REGS + 10: /* ftag */  return 4;
 662         case IDX_FP_REGS + 11: /* fiseg */ return 4;
 663         case IDX_FP_REGS + 12: /* fioff */ return 4;
 664         case IDX_FP_REGS + 13: /* foseg */ return 4;
 665         case IDX_FP_REGS + 14: /* fooff */ return 4;
 666         case IDX_FP_REGS + 15: /* fop */   return 4;
 667
 668         case IDX_MXCSR_REG:
 669             env->mxcsr = ldl_p(mem_buf);
 670             return 4;
 671         }
 672     }
 673     /* Unrecognised register.  */
 674     return 0;
 675 }
 676
 677 #elif defined (TARGET_PPC)
 678
 679 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
 680    expects whatever the target description contains.  Due to a
 681    historical mishap the FP registers appear in between core integer
 682    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
 683    FP regs zero size when talking to a newer gdb.  */
 684 #define NUM_CORE_REGS 71
 685 #if defined (TARGET_PPC64)
 686 #define GDB_CORE_XML "power64-core.xml"
 687 #else
 688 #define GDB_CORE_XML "power-core.xml"
 689 #endif
 690
 691 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 692 {
 693     if (n < 32) {
 694         /* gprs */
 695         GET_REGL(env->gpr[n]);
 696     } else if (n < 64) {
 697         /* fprs */
 698         if (gdb_has_xml)
 699             return 0;
 700         stfq_p(mem_buf, env->fpr[n-32]);
 701         return 8;
 702     } else {
 703         switch (n) {
 704         case 64: GET_REGL(env->nip);
 705         case 65: GET_REGL(env->msr);
 706         case 66:
 707             {
 708                 uint32_t cr = 0;
 709                 int i;
 710                 for (i = 0; i < 8; i++)
 711                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
 712                 GET_REG32(cr);
 713             }
 714         case 67: GET_REGL(env->lr);
 715         case 68: GET_REGL(env->ctr);
 716         case 69: GET_REGL(env->xer);
 717         case 70:
 718             {
 719                 if (gdb_has_xml)
 720                     return 0;
 721                 GET_REG32(0); /* fpscr */
 722             }
 723         }
 724     }
 725     return 0;
 726 }
 727
 728 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 729 {
 730     if (n < 32) {
 731         /* gprs */
 732         env->gpr[n] = ldtul_p(mem_buf);
 733         return sizeof(target_ulong);
 734     } else if (n < 64) {
 735         /* fprs */
 736         if (gdb_has_xml)
 737             return 0;
 738         env->fpr[n-32] = ldfq_p(mem_buf);
 739         return 8;
 740     } else {
 741         switch (n) {
 742         case 64:
 743             env->nip = ldtul_p(mem_buf);
 744             return sizeof(target_ulong);
 745         case 65:
 746             ppc_store_msr(env, ldtul_p(mem_buf));
 747             return sizeof(target_ulong);
 748         case 66:
 749             {
 750                 uint32_t cr = ldl_p(mem_buf);
 751                 int i;
 752                 for (i = 0; i < 8; i++)
 753                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
 754                 return 4;
 755             }
 756         case 67:
 757             env->lr = ldtul_p(mem_buf);
 758             return sizeof(target_ulong);
 759         case 68:
 760             env->ctr = ldtul_p(mem_buf);
 761             return sizeof(target_ulong);
 762         case 69:
 763             env->xer = ldtul_p(mem_buf);
 764             return sizeof(target_ulong);
 765         case 70:
 766             /* fpscr */
 767             if (gdb_has_xml)
 768                 return 0;
 769             return 4;
 770         }
 771     }
 772     return 0;
 773 }
 774
 775 #elif defined (TARGET_SPARC)
 776
 777 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 778 #define NUM_CORE_REGS 86
 779 #else
 780 #define NUM_CORE_REGS 72
 781 #endif
 782
 783 #ifdef TARGET_ABI32
 784 #define GET_REGA(val) GET_REG32(val)
 785 #else
 786 #define GET_REGA(val) GET_REGL(val)
 787 #endif
 788
 789 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 790 {
 791     if (n < 8) {
 792         /* g0..g7 */
 793         GET_REGA(env->gregs[n]);
 794     }
 795     if (n < 32) {
 796         /* register window */
 797         GET_REGA(env->regwptr[n - 8]);
 798     }
 799 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 800     if (n < 64) {
 801         /* fprs */
 802         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 803     }
 804     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 805     switch (n) {
 806     case 64: GET_REGA(env->y);
 807     case 65: GET_REGA(GET_PSR(env));
 808     case 66: GET_REGA(env->wim);
 809     case 67: GET_REGA(env->tbr);
 810     case 68: GET_REGA(env->pc);
 811     case 69: GET_REGA(env->npc);
 812     case 70: GET_REGA(env->fsr);
 813     case 71: GET_REGA(0); /* csr */
 814     default: GET_REGA(0);
 815     }
 816 #else
 817     if (n < 64) {
 818         /* f0-f31 */
 819         GET_REG32(*((uint32_t *)&env->fpr[n - 32]));
 820     }
 821     if (n < 80) {
 822         /* f32-f62 (double width, even numbers only) */
 823         uint64_t val;
 824
 825         val = (uint64_t)*((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) << 32;
 826         val |= *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]);
 827         GET_REG64(val);
 828     }
 829     switch (n) {
 830     case 80: GET_REGL(env->pc);
 831     case 81: GET_REGL(env->npc);
 832     case 82: GET_REGL(((uint64_t)GET_CCR(env) << 32) |
 833                            ((env->asi & 0xff) << 24) |
 834                            ((env->pstate & 0xfff) << 8) |
 835                            GET_CWP64(env));
 836     case 83: GET_REGL(env->fsr);
 837     case 84: GET_REGL(env->fprs);
 838     case 85: GET_REGL(env->y);
 839     }
 840 #endif
 841     return 0;
 842 }
 843
 844 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 845 {
 846 #if defined(TARGET_ABI32)
 847     abi_ulong tmp;
 848
 849     tmp = ldl_p(mem_buf);
 850 #else
 851     target_ulong tmp;
 852
 853     tmp = ldtul_p(mem_buf);
 854 #endif
 855
 856     if (n < 8) {
 857         /* g0..g7 */
 858         env->gregs[n] = tmp;
 859     } else if (n < 32) {
 860         /* register window */
 861         env->regwptr[n - 8] = tmp;
 862     }
 863 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
 864     else if (n < 64) {
 865         /* fprs */
 866         *((uint32_t *)&env->fpr[n - 32]) = tmp;
 867     } else {
 868         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
 869         switch (n) {
 870         case 64: env->y = tmp; break;
 871         case 65: PUT_PSR(env, tmp); break;
 872         case 66: env->wim = tmp; break;
 873         case 67: env->tbr = tmp; break;
 874         case 68: env->pc = tmp; break;
 875         case 69: env->npc = tmp; break;
 876         case 70: env->fsr = tmp; break;
 877         default: return 0;
 878         }
 879     }
 880     return 4;
 881 #else
 882     else if (n < 64) {
 883         /* f0-f31 */
 884         env->fpr[n] = ldfl_p(mem_buf);
 885         return 4;
 886     } else if (n < 80) {
 887         /* f32-f62 (double width, even numbers only) */
 888         *((uint32_t *)&env->fpr[(n - 64) * 2 + 32]) = tmp >> 32;
 889         *((uint32_t *)&env->fpr[(n - 64) * 2 + 33]) = tmp;
 890     } else {
 891         switch (n) {
 892         case 80: env->pc = tmp; break;
 893         case 81: env->npc = tmp; break;
 894         case 82:
 895             PUT_CCR(env, tmp >> 32);
 896             env->asi = (tmp >> 24) & 0xff;
 897             env->pstate = (tmp >> 8) & 0xfff;
 898             PUT_CWP64(env, tmp & 0xff);
 899             break;
 900         case 83: env->fsr = tmp; break;
 901         case 84: env->fprs = tmp; break;
 902         case 85: env->y = tmp; break;
 903         default: return 0;
 904         }
 905     }
 906     return 8;
 907 #endif
 908 }
 909 #elif defined (TARGET_ARM)
 910
 911 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
 912    whatever the target description contains.  Due to a historical mishap
 913    the FPA registers appear in between core integer regs and the CPSR.
 914    We hack round this by giving the FPA regs zero size when talking to a
 915    newer gdb.  */
 916 #define NUM_CORE_REGS 26
 917 #define GDB_CORE_XML "arm-core.xml"
 918
 919 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 920 {
 921     if (n < 16) {
 922         /* Core integer register.  */
 923         GET_REG32(env->regs[n]);
 924     }
 925     if (n < 24) {
 926         /* FPA registers.  */
 927         if (gdb_has_xml)
 928             return 0;
 929         memset(mem_buf, 0, 12);
 930         return 12;
 931     }
 932     switch (n) {
 933     case 24:
 934         /* FPA status register.  */
 935         if (gdb_has_xml)
 936             return 0;
 937         GET_REG32(0);
 938     case 25:
 939         /* CPSR */
 940         GET_REG32(cpsr_read(env));
 941     }
 942     /* Unknown register.  */
 943     return 0;
 944 }
 945
 946 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
 947 {
 948     uint32_t tmp;
 949
 950     tmp = ldl_p(mem_buf);
 951
 952     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
 953        cause problems if we ever implement the Jazelle DBX extensions.  */
 954     if (n == 15)
 955         tmp &= ~1;
 956
 957     if (n < 16) {
 958         /* Core integer register.  */
 959         env->regs[n] = tmp;
 960         return 4;
 961     }
 962     if (n < 24) { /* 16-23 */
 963         /* FPA registers (ignored).  */
 964         if (gdb_has_xml)
 965             return 0;
 966         return 12;
 967     }
 968     switch (n) {
 969     case 24:
 970         /* FPA status register (ignored).  */
 971         if (gdb_has_xml)
 972             return 0;
 973         return 4;
 974     case 25:
 975         /* CPSR */
 976         cpsr_write (env, tmp, 0xffffffff);
 977         return 4;
 978     }
 979     /* Unknown register.  */
 980     return 0;
 981 }
 982
 983 #elif defined (TARGET_M68K)
 984
 985 #define NUM_CORE_REGS 18
 986
 987 #define GDB_CORE_XML "cf-core.xml"
 988
 989 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
 990 {
 991     if (n < 8) {
 992         /* D0-D7 */
 993         GET_REG32(env->dregs[n]);
 994     } else if (n < 16) {
 995         /* A0-A7 */
 996         GET_REG32(env->aregs[n - 8]);
 997     } else {
 998         switch (n) {
 999         case 16: GET_REG32(env->sr);
1000         case 17: GET_REG32(env->pc);
1001         }
1002     }
1003     /* FP registers not included here because they vary between
1004        ColdFire and m68k.  Use XML bits for these.  */
1005     return 0;
1006 }
1007
1008 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1009 {
1010     uint32_t tmp;
1011
1012     tmp = ldl_p(mem_buf);
1013
1014     if (n < 8) {
1015         /* D0-D7 */
1016         env->dregs[n] = tmp;
1017     } else if (n < 16) {
1018         /* A0-A7 */
1019         env->aregs[n - 8] = tmp;
1020     } else {
1021         switch (n) {
1022         case 16: env->sr = tmp; break;
1023         case 17: env->pc = tmp; break;
1024         default: return 0;
1025         }
1026     }
1027     return 4;
1028 }
1029 #elif defined (TARGET_MIPS)
1030
1031 #define NUM_CORE_REGS 73
1032
1033 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1034 {
1035     if (n < 32) {
1036         GET_REGL(env->active_tc.gpr[n]);
1037     }
1038     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
1039         if (n >= 38 && n < 70) {
1040             if (env->CP0_Status & (1 << CP0St_FR))
1041                 GET_REGL(env->active_fpu.fpr[n - 38].d);
1042             else
1043                 GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
1044         }
1045         switch (n) {
1046         case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
1047         case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
1048         }
1049     }
1050     switch (n) {
1051     case 32: GET_REGL((int32_t)env->CP0_Status);
1052     case 33: GET_REGL(env->active_tc.LO[0]);
1053     case 34: GET_REGL(env->active_tc.HI[0]);
1054     case 35: GET_REGL(env->CP0_BadVAddr);
1055     case 36: GET_REGL((int32_t)env->CP0_Cause);
1056     case 37: GET_REGL(env->active_tc.PC | !!(env->hflags & MIPS_HFLAG_M16));
1057     case 72: GET_REGL(0); /* fp */
1058     case 89: GET_REGL((int32_t)env->CP0_PRid);
1059     }
1060     if (n >= 73 && n <= 88) {
1061         /* 16 embedded regs.  */
1062         GET_REGL(0);
1063     }
1064
1065     return 0;
1066 }
1067
1068 /* convert MIPS rounding mode in FCR31 to IEEE library */
1069 static unsigned int ieee_rm[] =
1070   {
1071     float_round_nearest_even,
1072     float_round_to_zero,
1073     float_round_up,
1074     float_round_down
1075   };
1076 #define RESTORE_ROUNDING_MODE \
1077     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
1078
1079 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1080 {
1081     target_ulong tmp;
1082
1083     tmp = ldtul_p(mem_buf);
1084
1085     if (n < 32) {
1086         env->active_tc.gpr[n] = tmp;
1087         return sizeof(target_ulong);
1088     }
1089     if (env->CP0_Config1 & (1 << CP0C1_FP)
1090             && n >= 38 && n < 73) {
1091         if (n < 70) {
1092             if (env->CP0_Status & (1 << CP0St_FR))
1093               env->active_fpu.fpr[n - 38].d = tmp;
1094             else
1095               env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
1096         }
1097         switch (n) {
1098         case 70:
1099             env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
1100             /* set rounding mode */
1101             RESTORE_ROUNDING_MODE;
1102 #ifndef CONFIG_SOFTFLOAT
1103             /* no floating point exception for native float */
1104             SET_FP_ENABLE(env->active_fpu.fcr31, 0);
1105 #endif
1106             break;
1107         case 71: env->active_fpu.fcr0 = tmp; break;
1108         }
1109         return sizeof(target_ulong);
1110     }
1111     switch (n) {
1112     case 32: env->CP0_Status = tmp; break;
1113     case 33: env->active_tc.LO[0] = tmp; break;
1114     case 34: env->active_tc.HI[0] = tmp; break;
1115     case 35: env->CP0_BadVAddr = tmp; break;
1116     case 36: env->CP0_Cause = tmp; break;
1117     case 37:
1118         env->active_tc.PC = tmp & ~(target_ulong)1;
1119         if (tmp & 1) {
1120             env->hflags |= MIPS_HFLAG_M16;
1121         } else {
1122             env->hflags &= ~(MIPS_HFLAG_M16);
1123         }
1124         break;
1125     case 72: /* fp, ignored */ break;
1126     default:
1127         if (n > 89)
1128             return 0;
1129         /* Other registers are readonly.  Ignore writes.  */
1130         break;
1131     }
1132
1133     return sizeof(target_ulong);
1134 }
1135 #elif defined (TARGET_SH4)
1136
1137 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
1138 /* FIXME: We should use XML for this.  */
1139
1140 #define NUM_CORE_REGS 59
1141
1142 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1143 {
1144     if (n < 8) {
1145         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1146             GET_REGL(env->gregs[n + 16]);
1147         } else {
1148             GET_REGL(env->gregs[n]);
1149         }
1150     } else if (n < 16) {
1151         GET_REGL(env->gregs[n - 8]);
1152     } else if (n >= 25 && n < 41) {
1153         GET_REGL(env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
1154     } else if (n >= 43 && n < 51) {
1155         GET_REGL(env->gregs[n - 43]);
1156     } else if (n >= 51 && n < 59) {
1157         GET_REGL(env->gregs[n - (51 - 16)]);
1158     }
1159     switch (n) {
1160     case 16: GET_REGL(env->pc);
1161     case 17: GET_REGL(env->pr);
1162     case 18: GET_REGL(env->gbr);
1163     case 19: GET_REGL(env->vbr);
1164     case 20: GET_REGL(env->mach);
1165     case 21: GET_REGL(env->macl);
1166     case 22: GET_REGL(env->sr);
1167     case 23: GET_REGL(env->fpul);
1168     case 24: GET_REGL(env->fpscr);
1169     case 41: GET_REGL(env->ssr);
1170     case 42: GET_REGL(env->spc);
1171     }
1172
1173     return 0;
1174 }
1175
1176 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1177 {
1178     uint32_t tmp;
1179
1180     tmp = ldl_p(mem_buf);
1181
1182     if (n < 8) {
1183         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
1184             env->gregs[n + 16] = tmp;
1185         } else {
1186             env->gregs[n] = tmp;
1187         }
1188         return 4;
1189     } else if (n < 16) {
1190         env->gregs[n - 8] = tmp;
1191         return 4;
1192     } else if (n >= 25 && n < 41) {
1193         env->fregs[(n - 25) + ((env->fpscr & FPSCR_FR) ? 16 : 0)] = tmp;
1194     } else if (n >= 43 && n < 51) {
1195         env->gregs[n - 43] = tmp;
1196         return 4;
1197     } else if (n >= 51 && n < 59) {
1198         env->gregs[n - (51 - 16)] = tmp;
1199         return 4;
1200     }
1201     switch (n) {
1202     case 16: env->pc = tmp;
1203     case 17: env->pr = tmp;
1204     case 18: env->gbr = tmp;
1205     case 19: env->vbr = tmp;
1206     case 20: env->mach = tmp;
1207     case 21: env->macl = tmp;
1208     case 22: env->sr = tmp;
1209     case 23: env->fpul = tmp;
1210     case 24: env->fpscr = tmp;
1211     case 41: env->ssr = tmp;
1212     case 42: env->spc = tmp;
1213     default: return 0;
1214     }
1215
1216     return 4;
1217 }
1218 #elif defined (TARGET_MICROBLAZE)
1219
1220 #define NUM_CORE_REGS (32 + 5)
1221
1222 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1223 {
1224     if (n < 32) {
1225         GET_REG32(env->regs[n]);
1226     } else {
1227         GET_REG32(env->sregs[n - 32]);
1228     }
1229     return 0;
1230 }
1231
1232 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1233 {
1234     uint32_t tmp;
1235
1236     if (n > NUM_CORE_REGS)
1237         return 0;
1238
1239     tmp = ldl_p(mem_buf);
1240
1241     if (n < 32) {
1242         env->regs[n] = tmp;
1243     } else {
1244         env->sregs[n - 32] = tmp;
1245     }
1246     return 4;
1247 }
1248 #elif defined (TARGET_CRIS)
1249
1250 #define NUM_CORE_REGS 49
1251
1252 static int
1253 read_register_crisv10(CPUState *env, uint8_t *mem_buf, int n)
1254 {
1255     if (n < 15) {
1256         GET_REG32(env->regs[n]);
1257     }
1258
1259     if (n == 15) {
1260         GET_REG32(env->pc);
1261     }
1262
1263     if (n < 32) {
1264         switch (n) {
1265         case 16:
1266             GET_REG8(env->pregs[n - 16]);
1267             break;
1268         case 17:
1269             GET_REG8(env->pregs[n - 16]);
1270             break;
1271         case 20:
1272         case 21:
1273             GET_REG16(env->pregs[n - 16]);
1274             break;
1275         default:
1276             if (n >= 23) {
1277                 GET_REG32(env->pregs[n - 16]);
1278             }
1279             break;
1280         }
1281     }
1282     return 0;
1283 }
1284
1285 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1286 {
1287     uint8_t srs;
1288
1289     if (env->pregs[PR_VR] < 32)
1290         return read_register_crisv10(env, mem_buf, n);
1291
1292     srs = env->pregs[PR_SRS];
1293     if (n < 16) {
1294         GET_REG32(env->regs[n]);
1295     }
1296
1297     if (n >= 21 && n < 32) {
1298         GET_REG32(env->pregs[n - 16]);
1299     }
1300     if (n >= 33 && n < 49) {
1301         GET_REG32(env->sregs[srs][n - 33]);
1302     }
1303     switch (n) {
1304     case 16: GET_REG8(env->pregs[0]);
1305     case 17: GET_REG8(env->pregs[1]);
1306     case 18: GET_REG32(env->pregs[2]);
1307     case 19: GET_REG8(srs);
1308     case 20: GET_REG16(env->pregs[4]);
1309     case 32: GET_REG32(env->pc);
1310     }
1311
1312     return 0;
1313 }
1314
1315 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1316 {
1317     uint32_t tmp;
1318
1319     if (n > 49)
1320         return 0;
1321
1322     tmp = ldl_p(mem_buf);
1323
1324     if (n < 16) {
1325         env->regs[n] = tmp;
1326     }
1327
1328     if (n >= 21 && n < 32) {
1329         env->pregs[n - 16] = tmp;
1330     }
1331
1332     /* FIXME: Should support function regs be writable?  */
1333     switch (n) {
1334     case 16: return 1;
1335     case 17: return 1;
1336     case 18: env->pregs[PR_PID] = tmp; break;
1337     case 19: return 1;
1338     case 20: return 2;
1339     case 32: env->pc = tmp; break;
1340     }
1341
1342     return 4;
1343 }
1344 #elif defined (TARGET_ALPHA)
1345
1346 #define NUM_CORE_REGS 67
1347
1348 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1349 {
1350     uint64_t val;
1351     CPU_DoubleU d;
1352
1353     switch (n) {
1354     case 0 ... 30:
1355         val = env->ir[n];
1356         break;
1357     case 32 ... 62:
1358         d.d = env->fir[n - 32];
1359         val = d.ll;
1360         break;
1361     case 63:
1362         val = cpu_alpha_load_fpcr(env);
1363         break;
1364     case 64:
1365         val = env->pc;
1366         break;
1367     case 66:
1368         val = env->unique;
1369         break;
1370     case 31:
1371     case 65:
1372         /* 31 really is the zero register; 65 is unassigned in the
1373            gdb protocol, but is still required to occupy 8 bytes. */
1374         val = 0;
1375         break;
1376     default:
1377         return 0;
1378     }
1379     GET_REGL(val);
1380 }
1381
1382 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1383 {
1384     target_ulong tmp = ldtul_p(mem_buf);
1385     CPU_DoubleU d;
1386
1387     switch (n) {
1388     case 0 ... 30:
1389         env->ir[n] = tmp;
1390         break;
1391     case 32 ... 62:
1392         d.ll = tmp;
1393         env->fir[n - 32] = d.d;
1394         break;
1395     case 63:
1396         cpu_alpha_store_fpcr(env, tmp);
1397         break;
1398     case 64:
1399         env->pc = tmp;
1400         break;
1401     case 66:
1402         env->unique = tmp;
1403         break;
1404     case 31:
1405     case 65:
1406         /* 31 really is the zero register; 65 is unassigned in the
1407            gdb protocol, but is still required to occupy 8 bytes. */
1408         break;
1409     default:
1410         return 0;
1411     }
1412     return 8;
1413 }
1414 #elif defined (TARGET_S390X)
1415
1416 #define NUM_CORE_REGS S390_NUM_TOTAL_REGS
1417
1418 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1419 {
1420     switch (n) {
1421         case S390_PSWM_REGNUM: GET_REGL(env->psw.mask); break;
1422         case S390_PSWA_REGNUM: GET_REGL(env->psw.addr); break;
1423         case S390_R0_REGNUM ... S390_R15_REGNUM:
1424             GET_REGL(env->regs[n-S390_R0_REGNUM]); break;
1425         case S390_A0_REGNUM ... S390_A15_REGNUM:
1426             GET_REG32(env->aregs[n-S390_A0_REGNUM]); break;
1427         case S390_FPC_REGNUM: GET_REG32(env->fpc); break;
1428         case S390_F0_REGNUM ... S390_F15_REGNUM:
1429             /* XXX */
1430             break;
1431         case S390_PC_REGNUM: GET_REGL(env->psw.addr); break;
1432         case S390_CC_REGNUM: GET_REG32(env->cc); break;
1433     }
1434
1435     return 0;
1436 }
1437
1438 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1439 {
1440     target_ulong tmpl;
1441     uint32_t tmp32;
1442     int r = 8;
1443     tmpl = ldtul_p(mem_buf);
1444     tmp32 = ldl_p(mem_buf);
1445
1446     switch (n) {
1447         case S390_PSWM_REGNUM: env->psw.mask = tmpl; break;
1448         case S390_PSWA_REGNUM: env->psw.addr = tmpl; break;
1449         case S390_R0_REGNUM ... S390_R15_REGNUM:
1450             env->regs[n-S390_R0_REGNUM] = tmpl; break;
1451         case S390_A0_REGNUM ... S390_A15_REGNUM:
1452             env->aregs[n-S390_A0_REGNUM] = tmp32; r=4; break;
1453         case S390_FPC_REGNUM: env->fpc = tmp32; r=4; break;
1454         case S390_F0_REGNUM ... S390_F15_REGNUM:
1455             /* XXX */
1456             break;
1457         case S390_PC_REGNUM: env->psw.addr = tmpl; break;
1458         case S390_CC_REGNUM: env->cc = tmp32; r=4; break;
1459     }
1460
1461     return r;
1462 }
1463 #else
1464
1465 #define NUM_CORE_REGS 0
1466
1467 static int cpu_gdb_read_register(CPUState *env, uint8_t *mem_buf, int n)
1468 {
1469     return 0;
1470 }
1471
1472 static int cpu_gdb_write_register(CPUState *env, uint8_t *mem_buf, int n)
1473 {
1474     return 0;
1475 }
1476
1477 #endif
1478
1479 static int num_g_regs = NUM_CORE_REGS;
1480
1481 #ifdef GDB_CORE_XML
1482 /* Encode data using the encoding for 'x' packets.  */
1483 static int memtox(char *buf, const char *mem, int len)
1484 {
1485     char *p = buf;
1486     char c;
1487
1488     while (len--) {
1489         c = *(mem++);
1490         switch (c) {
1491         case '#': case '$': case '*': case '}':
1492             *(p++) = '}';
1493             *(p++) = c ^ 0x20;
1494             break;
1495         default:
1496             *(p++) = c;
1497             break;
1498         }
1499     }
1500     return p - buf;
1501 }
1502
1503 static const char *get_feature_xml(const char *p, const char **newp)
1504 {
1505     extern const char *const xml_builtin[][2];
1506     size_t len;
1507     int i;
1508     const char *name;
1509     static char target_xml[1024];
1510
1511     len = 0;
1512     while (p[len] && p[len] != ':')
1513         len++;
1514     *newp = p + len;
1515
1516     name = NULL;
1517     if (strncmp(p, "target.xml", len) == 0) {
1518         /* Generate the XML description for this CPU.  */
1519         if (!target_xml[0]) {
1520             GDBRegisterState *r;
1521
1522             snprintf(target_xml, sizeof(target_xml),
1523                      "<?xml version=\"1.0\"?>"
1524                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
1525                      "<target>"
1526                      "<xi:include href=\"%s\"/>",
1527                      GDB_CORE_XML);
1528
1529             for (r = first_cpu->gdb_regs; r; r = r->next) {
1530                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
1531                 pstrcat(target_xml, sizeof(target_xml), r->xml);
1532                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
1533             }
1534             pstrcat(target_xml, sizeof(target_xml), "</target>");
1535         }
1536         return target_xml;
1537     }
1538     for (i = 0; ; i++) {
1539         name = xml_builtin[i][0];
1540         if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
1541             break;
1542     }
1543     return name ? xml_builtin[i][1] : NULL;
1544 }
1545 #endif
1546
1547 static int gdb_read_register(CPUState *env, uint8_t *mem_buf, int reg)
1548 {
1549     GDBRegisterState *r;
1550
1551     if (reg < NUM_CORE_REGS)
1552         return cpu_gdb_read_register(env, mem_buf, reg);
1553
1554     for (r = env->gdb_regs; r; r = r->next) {
1555         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1556             return r->get_reg(env, mem_buf, reg - r->base_reg);
1557         }
1558     }
1559     return 0;
1560 }
1561
1562 static int gdb_write_register(CPUState *env, uint8_t *mem_buf, int reg)
1563 {
1564     GDBRegisterState *r;
1565
1566     if (reg < NUM_CORE_REGS)
1567         return cpu_gdb_write_register(env, mem_buf, reg);
1568
1569     for (r = env->gdb_regs; r; r = r->next) {
1570         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
1571             return r->set_reg(env, mem_buf, reg - r->base_reg);
1572         }
1573     }
1574     return 0;
1575 }
1576
1577 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
1578    specifies the first register number and these registers are included in
1579    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
1580    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
1581  */
1582
1583 void gdb_register_coprocessor(CPUState * env,
1584                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
1585                              int num_regs, const char *xml, int g_pos)
1586 {
1587     GDBRegisterState *s;
1588     GDBRegisterState **p;
1589     static int last_reg = NUM_CORE_REGS;
1590
1591     s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
1592     s->base_reg = last_reg;
1593     s->num_regs = num_regs;
1594     s->get_reg = get_reg;
1595     s->set_reg = set_reg;
1596     s->xml = xml;
1597     p = &env->gdb_regs;
1598     while (*p) {
1599         /* Check for duplicates.  */
1600         if (strcmp((*p)->xml, xml) == 0)
1601             return;
1602         p = &(*p)->next;
1603     }
1604     /* Add to end of list.  */
1605     last_reg += num_regs;
1606     *p = s;
1607     if (g_pos) {
1608         if (g_pos != s->base_reg) {
1609             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
1610                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
1611         } else {
1612             num_g_regs = last_reg;
1613         }
1614     }
1615 }
1616
1617 #ifndef CONFIG_USER_ONLY
1618 static const int xlat_gdb_type[] = {
1619     [GDB_WATCHPOINT_WRITE]  = BP_GDB | BP_MEM_WRITE,
1620     [GDB_WATCHPOINT_READ]   = BP_GDB | BP_MEM_READ,
1621     [GDB_WATCHPOINT_ACCESS] = BP_GDB | BP_MEM_ACCESS,
1622 };
1623 #endif
1624
1625 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
1626 {
1627     CPUState *env;
1628     int err = 0;
1629
1630     if (kvm_enabled())
1631         return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1632
1633     switch (type) {
1634     case GDB_BREAKPOINT_SW:
1635     case GDB_BREAKPOINT_HW:
1636         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1637             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
1638             if (err)
1639                 break;
1640         }
1641         return err;
1642 #ifndef CONFIG_USER_ONLY
1643     case GDB_WATCHPOINT_WRITE:
1644     case GDB_WATCHPOINT_READ:
1645     case GDB_WATCHPOINT_ACCESS:
1646         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1647             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
1648                                         NULL);
1649             if (err)
1650                 break;
1651         }
1652         return err;
1653 #endif
1654     default:
1655         return -ENOSYS;
1656     }
1657 }
1658
1659 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
1660 {
1661     CPUState *env;
1662     int err = 0;
1663
1664     if (kvm_enabled())
1665         return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
1666
1667     switch (type) {
1668     case GDB_BREAKPOINT_SW:
1669     case GDB_BREAKPOINT_HW:
1670         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1671             err = cpu_breakpoint_remove(env, addr, BP_GDB);
1672             if (err)
1673                 break;
1674         }
1675         return err;
1676 #ifndef CONFIG_USER_ONLY
1677     case GDB_WATCHPOINT_WRITE:
1678     case GDB_WATCHPOINT_READ:
1679     case GDB_WATCHPOINT_ACCESS:
1680         for (env = first_cpu; env != NULL; env = env->next_cpu) {
1681             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
1682             if (err)
1683                 break;
1684         }
1685         return err;
1686 #endif
1687     default:
1688         return -ENOSYS;
1689     }
1690 }
1691
1692 static void gdb_breakpoint_remove_all(void)
1693 {
1694     CPUState *env;
1695
1696     if (kvm_enabled()) {
1697         kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
1698         return;
1699     }
1700
1701     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1702         cpu_breakpoint_remove_all(env, BP_GDB);
1703 #ifndef CONFIG_USER_ONLY
1704         cpu_watchpoint_remove_all(env, BP_GDB);
1705 #endif
1706     }
1707 }
1708
1709 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
1710 {
1711 #if defined(TARGET_I386)
1712     cpu_synchronize_state(s->c_cpu);
1713     s->c_cpu->eip = pc;
1714 #elif defined (TARGET_PPC)
1715     s->c_cpu->nip = pc;
1716 #elif defined (TARGET_SPARC)
1717     s->c_cpu->pc = pc;
1718     s->c_cpu->npc = pc + 4;
1719 #elif defined (TARGET_ARM)
1720     s->c_cpu->regs[15] = pc;
1721 #elif defined (TARGET_SH4)
1722     s->c_cpu->pc = pc;
1723 #elif defined (TARGET_MIPS)
1724     s->c_cpu->active_tc.PC = pc & ~(target_ulong)1;
1725     if (pc & 1) {
1726         s->c_cpu->hflags |= MIPS_HFLAG_M16;
1727     } else {
1728         s->c_cpu->hflags &= ~(MIPS_HFLAG_M16);
1729     }
1730 #elif defined (TARGET_MICROBLAZE)
1731     s->c_cpu->sregs[SR_PC] = pc;
1732 #elif defined (TARGET_CRIS)
1733     s->c_cpu->pc = pc;
1734 #elif defined (TARGET_ALPHA)
1735     s->c_cpu->pc = pc;
1736 #elif defined (TARGET_S390X)
1737     cpu_synchronize_state(s->c_cpu);
1738     s->c_cpu->psw.addr = pc;
1739 #endif
1740 }
1741
1742 static inline int gdb_id(CPUState *env)
1743 {
1744 #if defined(CONFIG_USER_ONLY) && defined(CONFIG_USE_NPTL)
1745     return env->host_tid;
1746 #else
1747     return env->cpu_index + 1;
1748 #endif
1749 }
1750
1751 static CPUState *find_cpu(uint32_t thread_id)
1752 {
1753     CPUState *env;
1754
1755     for (env = first_cpu; env != NULL; env = env->next_cpu) {
1756         if (gdb_id(env) == thread_id) {
1757             return env;
1758         }
1759     }
1760
1761     return NULL;
1762 }
1763
1764 static int gdb_handle_packet(GDBState *s, const char *line_buf)
1765 {
1766     CPUState *env;
1767     const char *p;
1768     uint32_t thread;
1769     int ch, reg_size, type, res;
1770     char buf[MAX_PACKET_LENGTH];
1771     uint8_t mem_buf[MAX_PACKET_LENGTH];
1772     uint8_t *registers;
1773     target_ulong addr, len;
1774
1775 #ifdef DEBUG_GDB
1776     printf("command='%s'\n", line_buf);
1777 #endif
1778     p = line_buf;
1779     ch = *p++;
1780     switch(ch) {
1781     case '?':
1782         /* TODO: Make this return the correct value for user-mode.  */
1783         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
1784                  gdb_id(s->c_cpu));
1785         put_packet(s, buf);
1786         /* Remove all the breakpoints when this query is issued,
1787          * because gdb is doing and initial connect and the state
1788          * should be cleaned up.
1789          */
1790         gdb_breakpoint_remove_all();
1791         break;
1792     case 'c':
1793         if (*p != '\0') {
1794             addr = strtoull(p, (char **)&p, 16);
1795             gdb_set_cpu_pc(s, addr);
1796         }
1797         s->signal = 0;
1798         gdb_continue(s);
1799         return RS_IDLE;
1800     case 'C':
1801         s->signal = gdb_signal_to_target (strtoul(p, (char **)&p, 16));
1802         if (s->signal == -1)
1803             s->signal = 0;
1804         gdb_continue(s);
1805         return RS_IDLE;
1806     case 'v':
1807         if (strncmp(p, "Cont", 4) == 0) {
1808             int res_signal, res_thread;
1809
1810             p += 4;
1811             if (*p == '?') {
1812                 put_packet(s, "vCont;c;C;s;S");
1813                 break;
1814             }
1815             res = 0;
1816             res_signal = 0;
1817             res_thread = 0;
1818             while (*p) {
1819                 int action, signal;
1820
1821                 if (*p++ != ';') {
1822                     res = 0;
1823                     break;
1824                 }
1825                 action = *p++;
1826                 signal = 0;
1827                 if (action == 'C' || action == 'S') {
1828                     signal = strtoul(p, (char **)&p, 16);
1829                 } else if (action != 'c' && action != 's') {
1830                     res = 0;
1831                     break;
1832                 }
1833                 thread = 0;
1834                 if (*p == ':') {
1835                     thread = strtoull(p+1, (char **)&p, 16);
1836                 }
1837                 action = tolower(action);
1838                 if (res == 0 || (res == 'c' && action == 's')) {
1839                     res = action;
1840                     res_signal = signal;
1841                     res_thread = thread;
1842                 }
1843             }
1844             if (res) {
1845                 if (res_thread != -1 && res_thread != 0) {
1846                     env = find_cpu(res_thread);
1847                     if (env == NULL) {
1848                         put_packet(s, "E22");
1849                         break;
1850                     }
1851                     s->c_cpu = env;
1852                 }
1853                 if (res == 's') {
1854                     cpu_single_step(s->c_cpu, sstep_flags);
1855                 }
1856                 s->signal = res_signal;
1857                 gdb_continue(s);
1858                 return RS_IDLE;
1859             }
1860             break;
1861         } else {
1862             goto unknown_command;
1863         }
1864     case 'k':
1865         /* Kill the target */
1866         fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
1867         exit(0);
1868     case 'D':
1869         /* Detach packet */
1870         gdb_breakpoint_remove_all();
1871         gdb_syscall_mode = GDB_SYS_DISABLED;
1872         gdb_continue(s);
1873         put_packet(s, "OK");
1874         break;
1875     case 's':
1876         if (*p != '\0') {
1877             addr = strtoull(p, (char **)&p, 16);
1878             gdb_set_cpu_pc(s, addr);
1879         }
1880         cpu_single_step(s->c_cpu, sstep_flags);
1881         gdb_continue(s);
1882         return RS_IDLE;
1883     case 'F':
1884         {
1885             target_ulong ret;
1886             target_ulong err;
1887
1888             ret = strtoull(p, (char **)&p, 16);
1889             if (*p == ',') {
1890                 p++;
1891                 err = strtoull(p, (char **)&p, 16);
1892             } else {
1893                 err = 0;
1894             }
1895             if (*p == ',')
1896                 p++;
1897             type = *p;
1898             if (gdb_current_syscall_cb)
1899                 gdb_current_syscall_cb(s->c_cpu, ret, err);
1900             if (type == 'C') {
1901                 put_packet(s, "T02");
1902             } else {
1903                 gdb_continue(s);
1904             }
1905         }
1906         break;
1907     case 'g':
1908         cpu_synchronize_state(s->g_cpu);
1909         len = 0;
1910         for (addr = 0; addr < num_g_regs; addr++) {
1911             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
1912             len += reg_size;
1913         }
1914         memtohex(buf, mem_buf, len);
1915         put_packet(s, buf);
1916         break;
1917     case 'G':
1918         cpu_synchronize_state(s->g_cpu);
1919         registers = mem_buf;
1920         len = strlen(p) / 2;
1921         hextomem((uint8_t *)registers, p, len);
1922         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
1923             reg_size = gdb_write_register(s->g_cpu, registers, addr);
1924             len -= reg_size;
1925             registers += reg_size;
1926         }
1927         put_packet(s, "OK");
1928         break;
1929     case 'm':
1930         addr = strtoull(p, (char **)&p, 16);
1931         if (*p == ',')
1932             p++;
1933         len = strtoull(p, NULL, 16);
1934         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
1935             put_packet (s, "E14");
1936         } else {
1937             memtohex(buf, mem_buf, len);
1938             put_packet(s, buf);
1939         }
1940         break;
1941     case 'M':
1942         addr = strtoull(p, (char **)&p, 16);
1943         if (*p == ',')
1944             p++;
1945         len = strtoull(p, (char **)&p, 16);
1946         if (*p == ':')
1947             p++;
1948         hextomem(mem_buf, p, len);
1949         if (cpu_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0)
1950             put_packet(s, "E14");
1951         else
1952             put_packet(s, "OK");
1953         break;
1954     case 'p':
1955         /* Older gdb are really dumb, and don't use 'g' if 'p' is avaialable.
1956            This works, but can be very slow.  Anything new enough to
1957            understand XML also knows how to use this properly.  */
1958         if (!gdb_has_xml)
1959             goto unknown_command;
1960         addr = strtoull(p, (char **)&p, 16);
1961         reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
1962         if (reg_size) {
1963             memtohex(buf, mem_buf, reg_size);
1964             put_packet(s, buf);
1965         } else {
1966             put_packet(s, "E14");
1967         }
1968         break;
1969     case 'P':
1970         if (!gdb_has_xml)
1971             goto unknown_command;
1972         addr = strtoull(p, (char **)&p, 16);
1973         if (*p == '=')
1974             p++;
1975         reg_size = strlen(p) / 2;
1976         hextomem(mem_buf, p, reg_size);
1977         gdb_write_register(s->g_cpu, mem_buf, addr);
1978         put_packet(s, "OK");
1979         break;
1980     case 'Z':
1981     case 'z':
1982         type = strtoul(p, (char **)&p, 16);
1983         if (*p == ',')
1984             p++;
1985         addr = strtoull(p, (char **)&p, 16);
1986         if (*p == ',')
1987             p++;
1988         len = strtoull(p, (char **)&p, 16);
1989         if (ch == 'Z')
1990             res = gdb_breakpoint_insert(addr, len, type);
1991         else
1992             res = gdb_breakpoint_remove(addr, len, type);
1993         if (res >= 0)
1994              put_packet(s, "OK");
1995         else if (res == -ENOSYS)
1996             put_packet(s, "");
1997         else
1998             put_packet(s, "E22");
1999         break;
2000     case 'H':
2001         type = *p++;
2002         thread = strtoull(p, (char **)&p, 16);
2003         if (thread == -1 || thread == 0) {
2004             put_packet(s, "OK");
2005             break;
2006         }
2007         env = find_cpu(thread);
2008         if (env == NULL) {
2009             put_packet(s, "E22");
2010             break;
2011         }
2012         switch (type) {
2013         case 'c':
2014             s->c_cpu = env;
2015             put_packet(s, "OK");
2016             break;
2017         case 'g':
2018             s->g_cpu = env;
2019             put_packet(s, "OK");
2020             break;
2021         default:
2022              put_packet(s, "E22");
2023              break;
2024         }
2025         break;
2026     case 'T':
2027         thread = strtoull(p, (char **)&p, 16);
2028         env = find_cpu(thread);
2029
2030         if (env != NULL) {
2031             put_packet(s, "OK");
2032         } else {
2033             put_packet(s, "E22");
2034         }
2035         break;
2036     case 'q':
2037     case 'Q':
2038         /* parse any 'q' packets here */
2039         if (!strcmp(p,"qemu.sstepbits")) {
2040             /* Query Breakpoint bit definitions */
2041             snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
2042                      SSTEP_ENABLE,
2043                      SSTEP_NOIRQ,
2044                      SSTEP_NOTIMER);
2045             put_packet(s, buf);
2046             break;
2047         } else if (strncmp(p,"qemu.sstep",10) == 0) {
2048             /* Display or change the sstep_flags */
2049             p += 10;
2050             if (*p != '=') {
2051                 /* Display current setting */
2052                 snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
2053                 put_packet(s, buf);
2054                 break;
2055             }
2056             p++;
2057             type = strtoul(p, (char **)&p, 16);
2058             sstep_flags = type;
2059             put_packet(s, "OK");
2060             break;
2061         } else if (strcmp(p,"C") == 0) {
2062             /* "Current thread" remains vague in the spec, so always return
2063              *  the first CPU (gdb returns the first thread). */
2064             put_packet(s, "QC1");
2065             break;
2066         } else if (strcmp(p,"fThreadInfo") == 0) {
2067             s->query_cpu = first_cpu;
2068             goto report_cpuinfo;
2069         } else if (strcmp(p,"sThreadInfo") == 0) {
2070         report_cpuinfo:
2071             if (s->query_cpu) {
2072                 snprintf(buf, sizeof(buf), "m%x", gdb_id(s->query_cpu));
2073                 put_packet(s, buf);
2074                 s->query_cpu = s->query_cpu->next_cpu;
2075             } else
2076                 put_packet(s, "l");
2077             break;
2078         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
2079             thread = strtoull(p+16, (char **)&p, 16);
2080             env = find_cpu(thread);
2081             if (env != NULL) {
2082                 cpu_synchronize_state(env);
2083                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
2084                                "CPU#%d [%s]", env->cpu_index,
2085                                env->halted ? "halted " : "running");
2086                 memtohex(buf, mem_buf, len);
2087                 put_packet(s, buf);
2088             }
2089             break;
2090         }
2091 #ifdef CONFIG_USER_ONLY
2092         else if (strncmp(p, "Offsets", 7) == 0) {
2093             TaskState *ts = s->c_cpu->opaque;
2094
2095             snprintf(buf, sizeof(buf),
2096                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
2097                      ";Bss=" TARGET_ABI_FMT_lx,
2098                      ts->info->code_offset,
2099                      ts->info->data_offset,
2100                      ts->info->data_offset);
2101             put_packet(s, buf);
2102             break;
2103         }
2104 #else /* !CONFIG_USER_ONLY */
2105         else if (strncmp(p, "Rcmd,", 5) == 0) {
2106             int len = strlen(p + 5);
2107
2108             if ((len % 2) != 0) {
2109                 put_packet(s, "E01");
2110                 break;
2111             }
2112             hextomem(mem_buf, p + 5, len);
2113             len = len / 2;
2114             mem_buf[len++] = 0;
2115             qemu_chr_read(s->mon_chr, mem_buf, len);
2116             put_packet(s, "OK");
2117             break;
2118         }
2119 #endif /* !CONFIG_USER_ONLY */
2120         if (strncmp(p, "Supported", 9) == 0) {
2121             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
2122 #ifdef GDB_CORE_XML
2123             pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
2124 #endif
2125             put_packet(s, buf);
2126             break;
2127         }
2128 #ifdef GDB_CORE_XML
2129         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
2130             const char *xml;
2131             target_ulong total_len;
2132
2133             gdb_has_xml = 1;
2134             p += 19;
2135             xml = get_feature_xml(p, &p);
2136             if (!xml) {
2137                 snprintf(buf, sizeof(buf), "E00");
2138                 put_packet(s, buf);
2139                 break;
2140             }
2141
2142             if (*p == ':')
2143                 p++;
2144             addr = strtoul(p, (char **)&p, 16);
2145             if (*p == ',')
2146                 p++;
2147             len = strtoul(p, (char **)&p, 16);
2148
2149             total_len = strlen(xml);
2150             if (addr > total_len) {
2151                 snprintf(buf, sizeof(buf), "E00");
2152                 put_packet(s, buf);
2153                 break;
2154             }
2155             if (len > (MAX_PACKET_LENGTH - 5) / 2)
2156                 len = (MAX_PACKET_LENGTH - 5) / 2;
2157             if (len < total_len - addr) {
2158                 buf[0] = 'm';
2159                 len = memtox(buf + 1, xml + addr, len);
2160             } else {
2161                 buf[0] = 'l';
2162                 len = memtox(buf + 1, xml + addr, total_len - addr);
2163             }
2164             put_packet_binary(s, buf, len + 1);
2165             break;
2166         }
2167 #endif
2168         /* Unrecognised 'q' command.  */
2169         goto unknown_command;
2170
2171     default:
2172     unknown_command:
2173         /* put empty packet */
2174         buf[0] = '\0';
2175         put_packet(s, buf);
2176         break;
2177     }
2178     return RS_IDLE;
2179 }
2180
2181 void gdb_set_stop_cpu(CPUState *env)
2182 {
2183     gdbserver_state->c_cpu = env;
2184     gdbserver_state->g_cpu = env;
2185 }
2186
2187 #ifndef CONFIG_USER_ONLY
2188 static void gdb_vm_state_change(void *opaque, int running, int reason)
2189 {
2190     GDBState *s = gdbserver_state;
2191     CPUState *env = s->c_cpu;
2192     char buf[256];
2193     const char *type;
2194     int ret;
2195
2196     if (running || (reason != EXCP_DEBUG && reason != EXCP_INTERRUPT) ||
2197         s->state == RS_INACTIVE || s->state == RS_SYSCALL)
2198         return;
2199
2200     /* disable single step if it was enable */
2201     cpu_single_step(env, 0);
2202
2203     if (reason == EXCP_DEBUG) {
2204         if (env->watchpoint_hit) {
2205             switch (env->watchpoint_hit->flags & BP_MEM_ACCESS) {
2206             case BP_MEM_READ:
2207                 type = "r";
2208                 break;
2209             case BP_MEM_ACCESS:
2210                 type = "a";
2211                 break;
2212             default:
2213                 type = "";
2214                 break;
2215             }
2216             snprintf(buf, sizeof(buf),
2217                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
2218                      GDB_SIGNAL_TRAP, gdb_id(env), type,
2219                      env->watchpoint_hit->vaddr);
2220             put_packet(s, buf);
2221             env->watchpoint_hit = NULL;
2222             return;
2223         }
2224         tb_flush(env);
2225         ret = GDB_SIGNAL_TRAP;
2226     } else {
2227         ret = GDB_SIGNAL_INT;
2228     }
2229     snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, gdb_id(env));
2230     put_packet(s, buf);
2231 }
2232 #endif
2233
2234 /* Send a gdb syscall request.
2235    This accepts limited printf-style format specifiers, specifically:
2236     %x  - target_ulong argument printed in hex.
2237     %lx - 64-bit argument printed in hex.
2238     %s  - string pointer (target_ulong) and length (int) pair.  */
2239 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
2240 {
2241     va_list va;
2242     char buf[256];
2243     char *p;
2244     target_ulong addr;
2245     uint64_t i64;
2246     GDBState *s;
2247
2248     s = gdbserver_state;
2249     if (!s)
2250         return;
2251     gdb_current_syscall_cb = cb;
2252     s->state = RS_SYSCALL;
2253 #ifndef CONFIG_USER_ONLY
2254     vm_stop(EXCP_DEBUG);
2255 #endif
2256     s->state = RS_IDLE;
2257     va_start(va, fmt);
2258     p = buf;
2259     *(p++) = 'F';
2260     while (*fmt) {
2261         if (*fmt == '%') {
2262             fmt++;
2263             switch (*fmt++) {
2264             case 'x':
2265                 addr = va_arg(va, target_ulong);
2266                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
2267                 break;
2268             case 'l':
2269                 if (*(fmt++) != 'x')
2270                     goto bad_format;
2271                 i64 = va_arg(va, uint64_t);
2272                 p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
2273                 break;
2274             case 's':
2275                 addr = va_arg(va, target_ulong);
2276                 p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
2277                               addr, va_arg(va, int));
2278                 break;
2279             default:
2280             bad_format:
2281                 fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
2282                         fmt - 1);
2283                 break;
2284             }
2285         } else {
2286             *(p++) = *(fmt++);
2287         }
2288     }
2289     *p = 0;
2290     va_end(va);
2291     put_packet(s, buf);
2292 #ifdef CONFIG_USER_ONLY
2293     gdb_handlesig(s->c_cpu, 0);
2294 #else
2295     cpu_exit(s->c_cpu);
2296 #endif
2297 }
2298
2299 static void gdb_read_byte(GDBState *s, int ch)
2300 {
2301     int i, csum;
2302     uint8_t reply;
2303
2304 #ifndef CONFIG_USER_ONLY
2305     if (s->last_packet_len) {
2306         /* Waiting for a response to the last packet.  If we see the start
2307            of a new command then abandon the previous response.  */
2308         if (ch == '-') {
2309 #ifdef DEBUG_GDB
2310             printf("Got NACK, retransmitting\n");
2311 #endif
2312             put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
2313         }
2314 #ifdef DEBUG_GDB
2315         else if (ch == '+')
2316             printf("Got ACK\n");
2317         else
2318             printf("Got '%c' when expecting ACK/NACK\n", ch);
2319 #endif
2320         if (ch == '+' || ch == '$')
2321             s->last_packet_len = 0;
2322         if (ch != '$')
2323             return;
2324     }
2325     if (vm_running) {
2326         /* when the CPU is running, we cannot do anything except stop
2327            it when receiving a char */
2328         vm_stop(EXCP_INTERRUPT);
2329     } else
2330 #endif
2331     {
2332         switch(s->state) {
2333         case RS_IDLE:
2334             if (ch == '$') {
2335                 s->line_buf_index = 0;
2336                 s->state = RS_GETLINE;
2337             }
2338             break;
2339         case RS_GETLINE:
2340             if (ch == '#') {
2341             s->state = RS_CHKSUM1;
2342             } else if (s->line_buf_index >= sizeof(s->line_buf) - 1) {
2343                 s->state = RS_IDLE;
2344             } else {
2345             s->line_buf[s->line_buf_index++] = ch;
2346             }
2347             break;
2348         case RS_CHKSUM1:
2349             s->line_buf[s->line_buf_index] = '\0';
2350             s->line_csum = fromhex(ch) << 4;
2351             s->state = RS_CHKSUM2;
2352             break;
2353         case RS_CHKSUM2:
2354             s->line_csum |= fromhex(ch);
2355             csum = 0;
2356             for(i = 0; i < s->line_buf_index; i++) {
2357                 csum += s->line_buf[i];
2358             }
2359             if (s->line_csum != (csum & 0xff)) {
2360                 reply = '-';
2361                 put_buffer(s, &reply, 1);
2362                 s->state = RS_IDLE;
2363             } else {
2364                 reply = '+';
2365                 put_buffer(s, &reply, 1);
2366                 s->state = gdb_handle_packet(s, s->line_buf);
2367             }
2368             break;
2369         default:
2370             abort();
2371         }
2372     }
2373 }
2374
2375 #ifdef CONFIG_USER_ONLY
2376 int
2377 gdb_queuesig (void)
2378 {
2379     GDBState *s;
2380
2381     s = gdbserver_state;
2382
2383     if (gdbserver_fd < 0 || s->fd < 0)
2384         return 0;
2385     else
2386         return 1;
2387 }
2388
2389 int
2390 gdb_handlesig (CPUState *env, int sig)
2391 {
2392   GDBState *s;
2393   char buf[256];
2394   int n;
2395
2396   s = gdbserver_state;
2397   if (gdbserver_fd < 0 || s->fd < 0)
2398     return sig;
2399
2400   /* disable single step if it was enabled */
2401   cpu_single_step(env, 0);
2402   tb_flush(env);
2403
2404   if (sig != 0)
2405     {
2406       snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
2407       put_packet(s, buf);
2408     }
2409   /* put_packet() might have detected that the peer terminated the
2410      connection.  */
2411   if (s->fd < 0)
2412       return sig;
2413
2414   sig = 0;
2415   s->state = RS_IDLE;
2416   s->running_state = 0;
2417   while (s->running_state == 0) {
2418       n = read (s->fd, buf, 256);
2419       if (n > 0)
2420         {
2421           int i;
2422
2423           for (i = 0; i < n; i++)
2424             gdb_read_byte (s, buf[i]);
2425         }
2426       else if (n == 0 || errno != EAGAIN)
2427         {
2428           /* XXX: Connection closed.  Should probably wait for annother
2429              connection before continuing.  */
2430           return sig;
2431         }
2432   }
2433   sig = s->signal;
2434   s->signal = 0;
2435   return sig;
2436 }
2437
2438 /* Tell the remote gdb that the process has exited.  */
2439 void gdb_exit(CPUState *env, int code)
2440 {
2441   GDBState *s;
2442   char buf[4];
2443
2444   s = gdbserver_state;
2445   if (gdbserver_fd < 0 || s->fd < 0)
2446     return;
2447
2448   snprintf(buf, sizeof(buf), "W%02x", code);
2449   put_packet(s, buf);
2450 }
2451
2452 /* Tell the remote gdb that the process has exited due to SIG.  */
2453 void gdb_signalled(CPUState *env, int sig)
2454 {
2455   GDBState *s;
2456   char buf[4];
2457
2458   s = gdbserver_state;
2459   if (gdbserver_fd < 0 || s->fd < 0)
2460     return;
2461
2462   snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
2463   put_packet(s, buf);
2464 }
2465
2466 static void gdb_accept(void)
2467 {
2468     GDBState *s;
2469     struct sockaddr_in sockaddr;
2470     socklen_t len;
2471     int val, fd;
2472
2473     for(;;) {
2474         len = sizeof(sockaddr);
2475         fd = accept(gdbserver_fd, (struct sockaddr *)&sockaddr, &len);
2476         if (fd < 0 && errno != EINTR) {
2477             perror("accept");
2478             return;
2479         } else if (fd >= 0) {
2480 #ifndef _WIN32
2481             fcntl(fd, F_SETFD, FD_CLOEXEC);
2482 #endif
2483             break;
2484         }
2485     }
2486
2487     /* set short latency */
2488     val = 1;
2489     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
2490
2491     s = qemu_mallocz(sizeof(GDBState));
2492     s->c_cpu = first_cpu;
2493     s->g_cpu = first_cpu;
2494     s->fd = fd;
2495     gdb_has_xml = 0;
2496
2497     gdbserver_state = s;
2498
2499     fcntl(fd, F_SETFL, O_NONBLOCK);
2500 }
2501
2502 static int gdbserver_open(int port)
2503 {
2504     struct sockaddr_in sockaddr;
2505     int fd, val, ret;
2506
2507     fd = socket(PF_INET, SOCK_STREAM, 0);
2508     if (fd < 0) {
2509         perror("socket");
2510         return -1;
2511     }
2512 #ifndef _WIN32
2513     fcntl(fd, F_SETFD, FD_CLOEXEC);
2514 #endif
2515
2516     /* allow fast reuse */
2517     val = 1;
2518     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)&val, sizeof(val));
2519
2520     sockaddr.sin_family = AF_INET;
2521     sockaddr.sin_port = htons(port);
2522     sockaddr.sin_addr.s_addr = 0;
2523     ret = bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr));
2524     if (ret < 0) {
2525         perror("bind");
2526         return -1;
2527     }
2528     ret = listen(fd, 0);
2529     if (ret < 0) {
2530         perror("listen");
2531         return -1;
2532     }
2533     return fd;
2534 }
2535
2536 int gdbserver_start(int port)
2537 {
2538     gdbserver_fd = gdbserver_open(port);
2539     if (gdbserver_fd < 0)
2540         return -1;
2541     /* accept connections */
2542     gdb_accept();
2543     return 0;
2544 }
2545
2546 /* Disable gdb stub for child processes.  */
2547 void gdbserver_fork(CPUState *env)
2548 {
2549     GDBState *s = gdbserver_state;
2550     if (gdbserver_fd < 0 || s->fd < 0)
2551       return;
2552     close(s->fd);
2553     s->fd = -1;
2554     cpu_breakpoint_remove_all(env, BP_GDB);
2555     cpu_watchpoint_remove_all(env, BP_GDB);
2556 }
2557 #else
2558 static int gdb_chr_can_receive(void *opaque)
2559 {
2560   /* We can handle an arbitrarily large amount of data.
2561    Pick the maximum packet size, which is as good as anything.  */
2562   return MAX_PACKET_LENGTH;
2563 }
2564
2565 static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
2566 {
2567     int i;
2568
2569     for (i = 0; i < size; i++) {
2570         gdb_read_byte(gdbserver_state, buf[i]);
2571     }
2572 }
2573
2574 static void gdb_chr_event(void *opaque, int event)
2575 {
2576     switch (event) {
2577     case CHR_EVENT_OPENED:
2578         vm_stop(EXCP_INTERRUPT);
2579         gdb_has_xml = 0;
2580         break;
2581     default:
2582         break;
2583     }
2584 }
2585
2586 static void gdb_monitor_output(GDBState *s, const char *msg, int len)
2587 {
2588     char buf[MAX_PACKET_LENGTH];
2589
2590     buf[0] = 'O';
2591     if (len > (MAX_PACKET_LENGTH/2) - 1)
2592         len = (MAX_PACKET_LENGTH/2) - 1;
2593     memtohex(buf + 1, (uint8_t *)msg, len);
2594     put_packet(s, buf);
2595 }
2596
2597 static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
2598 {
2599     const char *p = (const char *)buf;
2600     int max_sz;
2601
2602     max_sz = (sizeof(gdbserver_state->last_packet) - 2) / 2;
2603     for (;;) {
2604         if (len <= max_sz) {
2605             gdb_monitor_output(gdbserver_state, p, len);
2606             break;
2607         }
2608         gdb_monitor_output(gdbserver_state, p, max_sz);
2609         p += max_sz;
2610         len -= max_sz;
2611     }
2612     return len;
2613 }
2614
2615 #ifndef _WIN32
2616 static void gdb_sigterm_handler(int signal)
2617 {
2618     if (vm_running)
2619         vm_stop(EXCP_INTERRUPT);
2620 }
2621 #endif
2622
2623 int gdbserver_start(const char *device)
2624 {
2625     GDBState *s;
2626     char gdbstub_device_name[128];
2627     CharDriverState *chr = NULL;
2628     CharDriverState *mon_chr;
2629
2630     if (!device)
2631         return -1;
2632     if (strcmp(device, "none") != 0) {
2633         if (strstart(device, "tcp:", NULL)) {
2634             /* enforce required TCP attributes */
2635             snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
2636                      "%s,nowait,nodelay,server", device);
2637             device = gdbstub_device_name;
2638         }
2639 #ifndef _WIN32
2640         else if (strcmp(device, "stdio") == 0) {
2641             struct sigaction act;
2642
2643             memset(&act, 0, sizeof(act));
2644             act.sa_handler = gdb_sigterm_handler;
2645             sigaction(SIGINT, &act, NULL);
2646         }
2647 #endif
2648         chr = qemu_chr_open("gdb", device, NULL);
2649         if (!chr)
2650             return -1;
2651
2652         qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
2653                               gdb_chr_event, NULL);
2654     }
2655
2656     s = gdbserver_state;
2657     if (!s) {
2658         s = qemu_mallocz(sizeof(GDBState));
2659         gdbserver_state = s;
2660
2661         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
2662
2663         /* Initialize a monitor terminal for gdb */
2664         mon_chr = qemu_mallocz(sizeof(*mon_chr));
2665         mon_chr->chr_write = gdb_monitor_write;
2666         monitor_init(mon_chr, 0);
2667     } else {
2668         if (s->chr)
2669             qemu_chr_close(s->chr);
2670         mon_chr = s->mon_chr;
2671         memset(s, 0, sizeof(GDBState));
2672     }
2673     s->c_cpu = first_cpu;
2674     s->g_cpu = first_cpu;
2675     s->chr = chr;
2676     s->state = chr ? RS_IDLE : RS_INACTIVE;
2677     s->mon_chr = mon_chr;
2678
2679     return 0;
2680 }
2681 #endif