xref: /openbsd-src/gnu/usr.bin/binutils/gdb/remote-mips.c (revision b2ea75c1b17e1a9a339660e7ed45cd24946b230e)
1 /* Remote debugging interface for MIPS remote debugging protocol.
2    Copyright 1993, 1994, 1995 Free Software Foundation, Inc.
3    Contributed by Cygnus Support.  Written by Ian Lance Taylor
4    <ian@cygnus.com>.
5 
6 This file is part of GDB.
7 
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
12 
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16 GNU General Public License for more details.
17 
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */
21 
22 #include "defs.h"
23 #include "inferior.h"
24 #include "bfd.h"
25 #include "symfile.h"
26 #include "wait.h"
27 #include "gdbcmd.h"
28 #include "gdbcore.h"
29 #include "serial.h"
30 #include "target.h"
31 #include "remote-utils.h"
32 
33 #include <signal.h>
34 #ifdef ANSI_PROTOTYPES
35 #include <stdarg.h>
36 #else
37 #include <varargs.h>
38 #endif
39 
40 extern void mips_set_processor_type_command PARAMS ((char *, int));
41 
42 
43 /* Prototypes for local functions.  */
44 
45 static int mips_readchar PARAMS ((int timeout));
46 
47 static int mips_receive_header PARAMS ((unsigned char *hdr, int *pgarbage,
48 					int ch, int timeout));
49 
50 static int mips_receive_trailer PARAMS ((unsigned char *trlr, int *pgarbage,
51 					 int *pch, int timeout));
52 
53 static int mips_cksum PARAMS ((const unsigned char *hdr,
54 			       const unsigned char *data,
55 			       int len));
56 
57 static void mips_send_packet PARAMS ((const char *s, int get_ack));
58 
59 static void mips_send_command PARAMS ((const char *cmd, int prompt));
60 
61 static int mips_receive_packet PARAMS ((char *buff, int throw_error,
62 					int timeout));
63 
64 static CORE_ADDR mips_request PARAMS ((int cmd, CORE_ADDR addr,
65 				 CORE_ADDR data, int *perr, int timeout,
66 				 char *buff));
67 
68 static void mips_initialize PARAMS ((void));
69 
70 static void mips_open PARAMS ((char *name, int from_tty));
71 
72 static void pmon_open PARAMS ((char *name, int from_tty));
73 
74 static void ddb_open PARAMS ((char *name, int from_tty));
75 
76 static void mips_close PARAMS ((int quitting));
77 
78 static void mips_detach PARAMS ((char *args, int from_tty));
79 
80 static void mips_resume PARAMS ((int pid, int step,
81 				 enum target_signal siggnal));
82 
83 static int mips_wait PARAMS ((int pid, struct target_waitstatus *status));
84 
85 static int pmon_wait PARAMS ((int pid, struct target_waitstatus *status));
86 
87 static int mips_map_regno PARAMS ((int regno));
88 
89 static void mips_fetch_registers PARAMS ((int regno));
90 
91 static void mips_prepare_to_store PARAMS ((void));
92 
93 static void mips_store_registers PARAMS ((int regno));
94 
95 static unsigned int mips_fetch_word PARAMS ((CORE_ADDR addr));
96 
97 static int mips_store_word PARAMS ((CORE_ADDR addr, unsigned int value,
98 				    char *old_contents));
99 
100 static int mips_xfer_memory PARAMS ((CORE_ADDR memaddr, char *myaddr, int len,
101 				     int write, struct target_ops *ignore));
102 
103 static void mips_files_info PARAMS ((struct target_ops *ignore));
104 
105 static void mips_create_inferior PARAMS ((char *execfile, char *args,
106 					  char **env));
107 
108 static void mips_mourn_inferior PARAMS ((void));
109 
110 static int pmon_makeb64 PARAMS ((unsigned long v, char *p, int n, int *chksum));
111 
112 static int pmon_zeroset PARAMS ((int recsize, char **buff, int *amount,
113                                  unsigned int *chksum));
114 
115 static int pmon_checkset PARAMS ((int recsize, char **buff, int *value));
116 
117 static void pmon_make_fastrec PARAMS ((char **outbuf, unsigned char *inbuf,
118                                        int *inptr, int inamount, int *recsize,
119                                        unsigned int *csum, unsigned int *zerofill));
120 
121 static int pmon_check_ack PARAMS ((void));
122 
123 static void pmon_load_fast PARAMS ((char *file));
124 
125 static void mips_load PARAMS ((char *file, int from_tty));
126 
127 static int mips_make_srec PARAMS ((char *buffer, int type, CORE_ADDR memaddr,
128 				   unsigned char *myaddr, int len));
129 
130 static int common_breakpoint PARAMS ((int cmd, CORE_ADDR addr, CORE_ADDR mask,
131 				      char *flags));
132 
133 static void common_open PARAMS ((struct target_ops *ops, char *name,
134                                  int from_tty));
135 /* Forward declarations.  */
136 extern struct target_ops mips_ops;
137 extern struct target_ops pmon_ops;
138 extern struct target_ops ddb_ops;
139 
140 /* The MIPS remote debugging interface is built on top of a simple
141    packet protocol.  Each packet is organized as follows:
142 
143    SYN	The first character is always a SYN (ASCII 026, or ^V).  SYN
144 	may not appear anywhere else in the packet.  Any time a SYN is
145 	seen, a new packet should be assumed to have begun.
146 
147    TYPE_LEN
148 	This byte contains the upper five bits of the logical length
149 	of the data section, plus a single bit indicating whether this
150 	is a data packet or an acknowledgement.  The documentation
151 	indicates that this bit is 1 for a data packet, but the actual
152 	board uses 1 for an acknowledgement.  The value of the byte is
153 		0x40 + (ack ? 0x20 : 0) + (len >> 6)
154 	(we always have 0 <= len < 1024).  Acknowledgement packets do
155 	not carry data, and must have a data length of 0.
156 
157    LEN1 This byte contains the lower six bits of the logical length of
158 	the data section.  The value is
159 	 	0x40 + (len & 0x3f)
160 
161    SEQ	This byte contains the six bit sequence number of the packet.
162 	The value is
163 		0x40 + seq
164 	An acknowlegment packet contains the sequence number of the
165 	packet being acknowledged plus 1 modulo 64.  Data packets are
166 	transmitted in sequence.  There may only be one outstanding
167 	unacknowledged data packet at a time.  The sequence numbers
168 	are independent in each direction.  If an acknowledgement for
169 	the previous packet is received (i.e., an acknowledgement with
170 	the sequence number of the packet just sent) the packet just
171 	sent should be retransmitted.  If no acknowledgement is
172 	received within a timeout period, the packet should be
173 	retransmitted.  This has an unfortunate failure condition on a
174 	high-latency line, as a delayed acknowledgement may lead to an
175 	endless series of duplicate packets.
176 
177    DATA	The actual data bytes follow.  The following characters are
178 	escaped inline with DLE (ASCII 020, or ^P):
179 		SYN (026)	DLE S
180 		DLE (020)	DLE D
181 		^C  (003)	DLE C
182 		^S  (023)	DLE s
183 		^Q  (021)	DLE q
184 	The additional DLE characters are not counted in the logical
185 	length stored in the TYPE_LEN and LEN1 bytes.
186 
187    CSUM1
188    CSUM2
189    CSUM3
190 	These bytes contain an 18 bit checksum of the complete
191 	contents of the packet excluding the SEQ byte and the
192 	CSUM[123] bytes.  The checksum is simply the twos complement
193 	addition of all the bytes treated as unsigned characters.  The
194 	values of the checksum bytes are:
195 		CSUM1: 0x40 + ((cksum >> 12) & 0x3f)
196 		CSUM2: 0x40 + ((cksum >> 6) & 0x3f)
197 		CSUM3: 0x40 + (cksum & 0x3f)
198 
199    It happens that the MIPS remote debugging protocol always
200    communicates with ASCII strings.  Because of this, this
201    implementation doesn't bother to handle the DLE quoting mechanism,
202    since it will never be required.  */
203 
204 /* The SYN character which starts each packet.  */
205 #define SYN '\026'
206 
207 /* The 0x40 used to offset each packet (this value ensures that all of
208    the header and trailer bytes, other than SYN, are printable ASCII
209    characters).  */
210 #define HDR_OFFSET 0x40
211 
212 /* The indices of the bytes in the packet header.  */
213 #define HDR_INDX_SYN 0
214 #define HDR_INDX_TYPE_LEN 1
215 #define HDR_INDX_LEN1 2
216 #define HDR_INDX_SEQ 3
217 #define HDR_LENGTH 4
218 
219 /* The data/ack bit in the TYPE_LEN header byte.  */
220 #define TYPE_LEN_DA_BIT 0x20
221 #define TYPE_LEN_DATA 0
222 #define TYPE_LEN_ACK TYPE_LEN_DA_BIT
223 
224 /* How to compute the header bytes.  */
225 #define HDR_SET_SYN(data, len, seq) (SYN)
226 #define HDR_SET_TYPE_LEN(data, len, seq) \
227   (HDR_OFFSET \
228    + ((data) ? TYPE_LEN_DATA : TYPE_LEN_ACK) \
229    + (((len) >> 6) & 0x1f))
230 #define HDR_SET_LEN1(data, len, seq) (HDR_OFFSET + ((len) & 0x3f))
231 #define HDR_SET_SEQ(data, len, seq) (HDR_OFFSET + (seq))
232 
233 /* Check that a header byte is reasonable.  */
234 #define HDR_CHECK(ch) (((ch) & HDR_OFFSET) == HDR_OFFSET)
235 
236 /* Get data from the header.  These macros evaluate their argument
237    multiple times.  */
238 #define HDR_IS_DATA(hdr) \
239   (((hdr)[HDR_INDX_TYPE_LEN] & TYPE_LEN_DA_BIT) == TYPE_LEN_DATA)
240 #define HDR_GET_LEN(hdr) \
241   ((((hdr)[HDR_INDX_TYPE_LEN] & 0x1f) << 6) + (((hdr)[HDR_INDX_LEN1] & 0x3f)))
242 #define HDR_GET_SEQ(hdr) ((hdr)[HDR_INDX_SEQ] & 0x3f)
243 
244 /* The maximum data length.  */
245 #define DATA_MAXLEN 1023
246 
247 /* The trailer offset.  */
248 #define TRLR_OFFSET HDR_OFFSET
249 
250 /* The indices of the bytes in the packet trailer.  */
251 #define TRLR_INDX_CSUM1 0
252 #define TRLR_INDX_CSUM2 1
253 #define TRLR_INDX_CSUM3 2
254 #define TRLR_LENGTH 3
255 
256 /* How to compute the trailer bytes.  */
257 #define TRLR_SET_CSUM1(cksum) (TRLR_OFFSET + (((cksum) >> 12) & 0x3f))
258 #define TRLR_SET_CSUM2(cksum) (TRLR_OFFSET + (((cksum) >>  6) & 0x3f))
259 #define TRLR_SET_CSUM3(cksum) (TRLR_OFFSET + (((cksum)      ) & 0x3f))
260 
261 /* Check that a trailer byte is reasonable.  */
262 #define TRLR_CHECK(ch) (((ch) & TRLR_OFFSET) == TRLR_OFFSET)
263 
264 /* Get data from the trailer.  This evaluates its argument multiple
265    times.  */
266 #define TRLR_GET_CKSUM(trlr) \
267   ((((trlr)[TRLR_INDX_CSUM1] & 0x3f) << 12) \
268    + (((trlr)[TRLR_INDX_CSUM2] & 0x3f) <<  6) \
269    + ((trlr)[TRLR_INDX_CSUM3] & 0x3f))
270 
271 /* The sequence number modulos.  */
272 #define SEQ_MODULOS (64)
273 
274 enum mips_monitor_type {
275   /* IDT/SIM monitor being used: */
276   MON_IDT,
277   /* PMON monitor being used: */
278   MON_PMON,   /* 3.0.83 [COGENT,EB,FP,NET] Algorithmics Ltd. Nov  9 1995 17:19:50 */
279   MON_DDB,  /* 2.7.473 [DDBVR4300,EL,FP,NET] Risq Modular Systems,  Thu Jun 6 09:28:40 PDT 1996 */
280   /* Last and unused value, for sizing vectors, etc. */
281   MON_LAST
282 };
283 static enum mips_monitor_type mips_monitor = MON_LAST;
284 
285 /* The default monitor prompt text: */
286 static char *mips_monitor_prompt = TARGET_MONITOR_PROMPT;
287 /* For the Cogent PMON world this is still not ideal. The default
288    prompt is "PMON> ", unfortunately the user can change the prompt
289    and the new prompt will survive over a power-cycle (EEPROM). This
290    means that the code should really force the monitor prompt to a
291    known value as the very first action, and that the
292    "mips_monitor_prompt" support is not needed... since the prompt
293    could be explicitly set to TARGET_MONITOR_PROMPT (even though it
294    may be the prompt for a different monitor). However, this will
295    require changing the mips_initialize reset sequence. (TODO) */
296 
297 /* Set to 1 if the target is open.  */
298 static int mips_is_open;
299 
300 /* Currently active target description (if mips_is_open == 1) */
301 static struct target_ops *current_ops;
302 
303 /* Set to 1 while the connection is being initialized.  */
304 static int mips_initializing;
305 
306 /* The next sequence number to send.  */
307 static unsigned int mips_send_seq;
308 
309 /* The next sequence number we expect to receive.  */
310 static unsigned int mips_receive_seq;
311 
312 /* The time to wait before retransmitting a packet, in seconds.  */
313 static int mips_retransmit_wait = 3;
314 
315 /* The number of times to try retransmitting a packet before giving up.  */
316 static int mips_send_retries = 10;
317 
318 /* The number of garbage characters to accept when looking for an
319    SYN for the next packet.  */
320 static int mips_syn_garbage = 1050;
321 
322 /* The time to wait for a packet, in seconds.  */
323 static int mips_receive_wait = 5;
324 
325 /* Set if we have sent a packet to the board but have not yet received
326    a reply.  */
327 static int mips_need_reply = 0;
328 
329 /* Handle used to access serial I/O stream.  */
330 static serial_t mips_desc;
331 
332 /* Counts the number of times the user tried to interrupt the target (usually
333    via ^C.  */
334 static int interrupt_count;
335 
336 /* If non-zero, means that the target is running. */
337 static int mips_wait_flag = 0;
338 
339 /* If non-zero, monitor supports breakpoint commands. */
340 static monitor_supports_breakpoints = 0;
341 
342 /* Data cache header.  */
343 
344 static DCACHE *mips_dcache;
345 
346 /* Non-zero means that we've just hit a read or write watchpoint */
347 static int hit_watchpoint;
348 
349 /* Handle low-level error that we can't recover from.  Note that just
350    error()ing out from target_wait or some such low-level place will cause
351    all hell to break loose--the rest of GDB will tend to get left in an
352    inconsistent state.  */
353 
354 static NORETURN void
355 #ifdef ANSI_PROTOTYPES
356 mips_error (char *string, ...)
357 #else
358 mips_error (va_alist)
359      va_dcl
360 #endif
361 {
362   va_list args;
363 
364 #ifdef ANSI_PROTOTYPES
365   va_start (args, string);
366 #else
367   char *string;
368   va_start (args);
369   string = va_arg (args, char *);
370 #endif
371 
372   target_terminal_ours ();
373   wrap_here("");			/* Force out any buffered output */
374   gdb_flush (gdb_stdout);
375   if (error_pre_print)
376     fprintf_filtered (gdb_stderr, error_pre_print);
377   vfprintf_filtered (gdb_stderr, string, args);
378   fprintf_filtered (gdb_stderr, "\n");
379   va_end (args);
380   gdb_flush (gdb_stderr);
381 
382   /* Clean up in such a way that mips_close won't try to talk to the
383      board (it almost surely won't work since we weren't able to talk to
384      it).  */
385   mips_is_open = 0;
386   SERIAL_CLOSE (mips_desc);
387 
388   printf_unfiltered ("Ending remote MIPS debugging.\n");
389   target_mourn_inferior ();
390 
391   return_to_top_level (RETURN_ERROR);
392 }
393 
394 /* Wait until STRING shows up in mips_desc.  Returns 1 if successful, else 0 if
395    timed out.  */
396 
397 int
398 mips_expect (string)
399      char *string;
400 {
401   char *p = string;
402 
403   immediate_quit = 1;
404   while (1)
405     {
406       int c;
407 
408 /* Must use SERIAL_READCHAR here cuz mips_readchar would get confused if we
409    were waiting for the mips_monitor_prompt... */
410 
411       c = SERIAL_READCHAR (mips_desc, 2);
412 
413       if (c == SERIAL_TIMEOUT)
414 	return 0;
415 
416       if (c == *p++)
417 	{
418 	  if (*p == '\0')
419 	    {
420 	      immediate_quit = 0;
421 	      return 1;
422 	    }
423 	}
424       else
425 	{
426 	  p = string;
427 	  if (c == *p)
428 	    p++;
429 	}
430     }
431 }
432 
433 /* Read the required number of characters into the given buffer (which
434    is assumed to be large enough). The only failure is a timeout. */
435 int
436 mips_getstring (string, n)
437      char *string;
438      int n;
439 {
440   char *p = string;
441   int c;
442 
443   immediate_quit = 1;
444   while (n > 0)
445     {
446       c = SERIAL_READCHAR (mips_desc, 2);
447 
448       if (c == SERIAL_TIMEOUT) {
449         fprintf_unfiltered (stderr, "Failed to read %d characters from target (TIMEOUT)\n", n);
450 	return 0;
451       }
452 
453       *p++ = c;
454       n--;
455     }
456 
457   return 1;
458 }
459 
460 /* Read a character from the remote, aborting on error.  Returns
461    SERIAL_TIMEOUT on timeout (since that's what SERIAL_READCHAR
462    returns).  FIXME: If we see the string mips_monitor_prompt from
463    the board, then we are debugging on the main console port, and we
464    have somehow dropped out of remote debugging mode.  In this case,
465    we automatically go back in to remote debugging mode.  This is a
466    hack, put in because I can't find any way for a program running on
467    the remote board to terminate without also ending remote debugging
468    mode.  I assume users won't have any trouble with this; for one
469    thing, the IDT documentation generally assumes that the remote
470    debugging port is not the console port.  This is, however, very
471    convenient for DejaGnu when you only have one connected serial
472    port.  */
473 
474 static int
475 mips_readchar (timeout)
476      int timeout;
477 {
478   int ch;
479   static int state = 0;
480   static int mips_monitor_prompt_len = -1;
481 
482   /* NASTY, since we assume that the prompt does not change after the
483      first mips_readchar call: */
484   if (mips_monitor_prompt_len = -1)
485    mips_monitor_prompt_len = strlen(mips_monitor_prompt);
486 
487 #ifdef MAINTENANCE_CMDS
488   {
489     int i;
490 
491     i = timeout;
492     if (i == -1 && watchdog > 0)
493      i = watchdog;
494   }
495 #endif
496 
497   if (state == mips_monitor_prompt_len)
498     timeout = 1;
499   ch = SERIAL_READCHAR (mips_desc, timeout);
500 #ifdef MAINTENANCE_CMDS
501   if (ch == SERIAL_TIMEOUT && timeout == -1) /* Watchdog went off */
502     {
503       target_mourn_inferior ();
504       error ("Watchdog has expired.  Target detached.\n");
505     }
506 #endif
507   if (ch == SERIAL_EOF)
508     mips_error ("End of file from remote");
509   if (ch == SERIAL_ERROR)
510     mips_error ("Error reading from remote: %s", safe_strerror (errno));
511   if (remote_debug > 1)
512     {
513       /* Don't use _filtered; we can't deal with a QUIT out of
514 	 target_wait, and I think this might be called from there.  */
515       if (ch != SERIAL_TIMEOUT)
516 	printf_unfiltered ("Read '%c' %d 0x%x\n", ch, ch, ch);
517       else
518 	printf_unfiltered ("Timed out in read\n");
519     }
520 
521   /* If we have seen mips_monitor_prompt and we either time out, or
522      we see a @ (which was echoed from a packet we sent), reset the
523      board as described above.  The first character in a packet after
524      the SYN (which is not echoed) is always an @ unless the packet is
525      more than 64 characters long, which ours never are.  */
526   if ((ch == SERIAL_TIMEOUT || ch == '@')
527       && state == mips_monitor_prompt_len
528       && ! mips_initializing)
529     {
530       if (remote_debug > 0)
531 	/* Don't use _filtered; we can't deal with a QUIT out of
532 	   target_wait, and I think this might be called from there.  */
533 	printf_unfiltered ("Reinitializing MIPS debugging mode\n");
534 
535       mips_need_reply = 0;
536       mips_initialize ();
537 
538       state = 0;
539 
540       /* At this point, about the only thing we can do is abort the command
541 	 in progress and get back to command level as quickly as possible. */
542 
543       error ("Remote board reset, debug protocol re-initialized.");
544     }
545 
546   if (ch == mips_monitor_prompt[state])
547     ++state;
548   else
549     state = 0;
550 
551   return ch;
552 }
553 
554 /* Get a packet header, putting the data in the supplied buffer.
555    PGARBAGE is a pointer to the number of garbage characters received
556    so far.  CH is the last character received.  Returns 0 for success,
557    or -1 for timeout.  */
558 
559 static int
560 mips_receive_header (hdr, pgarbage, ch, timeout)
561      unsigned char *hdr;
562      int *pgarbage;
563      int ch;
564      int timeout;
565 {
566   int i;
567 
568   while (1)
569     {
570       /* Wait for a SYN.  mips_syn_garbage is intended to prevent
571 	 sitting here indefinitely if the board sends us one garbage
572 	 character per second.  ch may already have a value from the
573 	 last time through the loop.  */
574       while (ch != SYN)
575 	{
576 	  ch = mips_readchar (timeout);
577 	  if (ch == SERIAL_TIMEOUT)
578            return -1;
579 	  if (ch != SYN)
580 	    {
581 	      /* Printing the character here lets the user of gdb see
582 		 what the program is outputting, if the debugging is
583 		 being done on the console port.  Don't use _filtered;
584 		 we can't deal with a QUIT out of target_wait.  */
585 	      if (! mips_initializing || remote_debug > 0)
586 		{
587 		  /* Note that the host's idea of newline may not
588 		     correspond to the target's idea, so recognize
589 		     newline by its actual ASCII code, but write it
590 		     out using the \n notation.  */
591 		  if (ch < 0x20 && ch != '\012')
592 		    {
593 		      putchar_unfiltered ('^');
594 		      putchar_unfiltered (ch + 0x40);
595 		    }
596 		  else if (ch == '\012')
597 		    putchar_unfiltered ('\n');
598 		  else
599 		    putchar_unfiltered (ch);
600 		  gdb_flush (gdb_stdout);
601 		}
602 
603 	      ++*pgarbage;
604 	      if (mips_syn_garbage > 0
605 		  && *pgarbage > mips_syn_garbage)
606 		mips_error ("Debug protocol failure:  more than %d characters before a sync.",
607 			    mips_syn_garbage);
608 	    }
609 	}
610 
611       /* Get the packet header following the SYN.  */
612       for (i = 1; i < HDR_LENGTH; i++)
613 	{
614 	  ch = mips_readchar (timeout);
615 	  if (ch == SERIAL_TIMEOUT)
616             return -1;
617 	  /* Make sure this is a header byte.  */
618 	  if (ch == SYN || ! HDR_CHECK (ch))
619 	    break;
620 
621 	  hdr[i] = ch;
622 	}
623 
624       /* If we got the complete header, we can return.  Otherwise we
625 	 loop around and keep looking for SYN.  */
626       if (i >= HDR_LENGTH)
627         return 0;
628     }
629 }
630 
631 /* Get a packet header, putting the data in the supplied buffer.
632    PGARBAGE is a pointer to the number of garbage characters received
633    so far.  The last character read is returned in *PCH.  Returns 0
634    for success, -1 for timeout, -2 for error.  */
635 
636 static int
637 mips_receive_trailer (trlr, pgarbage, pch, timeout)
638      unsigned char *trlr;
639      int *pgarbage;
640      int *pch;
641      int timeout;
642 {
643   int i;
644   int ch;
645 
646   for (i = 0; i < TRLR_LENGTH; i++)
647     {
648       ch = mips_readchar (timeout);
649       *pch = ch;
650       if (ch == SERIAL_TIMEOUT)
651 	return -1;
652       if (! TRLR_CHECK (ch))
653 	return -2;
654       trlr[i] = ch;
655     }
656   return 0;
657 }
658 
659 /* Get the checksum of a packet.  HDR points to the packet header.
660    DATA points to the packet data.  LEN is the length of DATA.  */
661 
662 static int
663 mips_cksum (hdr, data, len)
664      const unsigned char *hdr;
665      const unsigned char *data;
666      int len;
667 {
668   register const unsigned char *p;
669   register int c;
670   register int cksum;
671 
672   cksum = 0;
673 
674   /* The initial SYN is not included in the checksum.  */
675   c = HDR_LENGTH - 1;
676   p = hdr + 1;
677   while (c-- != 0)
678     cksum += *p++;
679 
680   c = len;
681   p = data;
682   while (c-- != 0)
683     cksum += *p++;
684 
685   return cksum;
686 }
687 
688 /* Send a packet containing the given ASCII string.  */
689 
690 static void
691 mips_send_packet (s, get_ack)
692      const char *s;
693      int get_ack;
694 {
695   unsigned int len;
696   unsigned char *packet;
697   register int cksum;
698   int try;
699 
700   len = strlen (s);
701   if (len > DATA_MAXLEN)
702     mips_error ("MIPS protocol data packet too long: %s", s);
703 
704   packet = (unsigned char *) alloca (HDR_LENGTH + len + TRLR_LENGTH + 1);
705 
706   packet[HDR_INDX_SYN] = HDR_SET_SYN (1, len, mips_send_seq);
707   packet[HDR_INDX_TYPE_LEN] = HDR_SET_TYPE_LEN (1, len, mips_send_seq);
708   packet[HDR_INDX_LEN1] = HDR_SET_LEN1 (1, len, mips_send_seq);
709   packet[HDR_INDX_SEQ] = HDR_SET_SEQ (1, len, mips_send_seq);
710 
711   memcpy (packet + HDR_LENGTH, s, len);
712 
713   cksum = mips_cksum (packet, packet + HDR_LENGTH, len);
714   packet[HDR_LENGTH + len + TRLR_INDX_CSUM1] = TRLR_SET_CSUM1 (cksum);
715   packet[HDR_LENGTH + len + TRLR_INDX_CSUM2] = TRLR_SET_CSUM2 (cksum);
716   packet[HDR_LENGTH + len + TRLR_INDX_CSUM3] = TRLR_SET_CSUM3 (cksum);
717 
718   /* Increment the sequence number.  This will set mips_send_seq to
719      the sequence number we expect in the acknowledgement.  */
720   mips_send_seq = (mips_send_seq + 1) % SEQ_MODULOS;
721 
722   /* We can only have one outstanding data packet, so we just wait for
723      the acknowledgement here.  Keep retransmitting the packet until
724      we get one, or until we've tried too many times.  */
725   for (try = 0; try < mips_send_retries; try++)
726     {
727       int garbage;
728       int ch;
729 
730       if (remote_debug > 0)
731 	{
732 	  /* Don't use _filtered; we can't deal with a QUIT out of
733 	     target_wait, and I think this might be called from there.  */
734 	  packet[HDR_LENGTH + len + TRLR_LENGTH] = '\0';
735 	  printf_unfiltered ("Writing \"%s\"\n", packet + 1);
736 	}
737 
738       if (SERIAL_WRITE (mips_desc, packet,
739 			HDR_LENGTH + len + TRLR_LENGTH) != 0)
740 	mips_error ("write to target failed: %s", safe_strerror (errno));
741 
742       if (! get_ack)
743 	return;
744 
745       garbage = 0;
746       ch = 0;
747       while (1)
748 	{
749 	  unsigned char hdr[HDR_LENGTH + 1];
750 	  unsigned char trlr[TRLR_LENGTH + 1];
751 	  int err;
752 	  int seq;
753 
754 	  /* Get the packet header.  If we time out, resend the data
755 	     packet.  */
756 	  err = mips_receive_header (hdr, &garbage, ch, mips_retransmit_wait);
757 	  if (err != 0)
758 	    break;
759 
760 	  ch = 0;
761 
762 	  /* If we get a data packet, assume it is a duplicate and
763 	     ignore it.  FIXME: If the acknowledgement is lost, this
764 	     data packet may be the packet the remote sends after the
765 	     acknowledgement.  */
766 	  if (HDR_IS_DATA (hdr)) {
767             int i;
768 
769             /* Ignore any errors raised whilst attempting to ignore
770                packet. */
771 
772             len = HDR_GET_LEN (hdr);
773 
774             for (i = 0; i < len; i++)
775               {
776                 int rch;
777 
778                 rch = mips_readchar (2);
779                 if (rch == SYN)
780                   {
781                     ch = SYN;
782                     break;
783                   }
784                 if (rch == SERIAL_TIMEOUT)
785                   break;
786                 /* ignore the character */
787               }
788 
789             if (i == len)
790               (void) mips_receive_trailer (trlr, &garbage, &ch, 2);
791 
792             /* We don't bother checking the checksum, or providing an
793                ACK to the packet. */
794 	    continue;
795           }
796 
797 	  /* If the length is not 0, this is a garbled packet.  */
798 	  if (HDR_GET_LEN (hdr) != 0)
799 	    continue;
800 
801 	  /* Get the packet trailer.  */
802 	  err = mips_receive_trailer (trlr, &garbage, &ch,
803 				      mips_retransmit_wait);
804 
805 	  /* If we timed out, resend the data packet.  */
806 	  if (err == -1)
807 	    break;
808 
809 	  /* If we got a bad character, reread the header.  */
810 	  if (err != 0)
811 	    continue;
812 
813 	  /* If the checksum does not match the trailer checksum, this
814 	     is a bad packet; ignore it.  */
815 	  if (mips_cksum (hdr, (unsigned char *) NULL, 0)
816 	      != TRLR_GET_CKSUM (trlr))
817 	    continue;
818 
819 	  if (remote_debug > 0)
820 	    {
821 	      hdr[HDR_LENGTH] = '\0';
822 	      trlr[TRLR_LENGTH] = '\0';
823 	      /* Don't use _filtered; we can't deal with a QUIT out of
824 		 target_wait, and I think this might be called from there.  */
825 	      printf_unfiltered ("Got ack %d \"%s%s\"\n",
826 			       HDR_GET_SEQ (hdr), hdr + 1, trlr);
827 	    }
828 
829 	  /* If this ack is for the current packet, we're done.  */
830 	  seq = HDR_GET_SEQ (hdr);
831 	  if (seq == mips_send_seq)
832 	    return;
833 
834 	  /* If this ack is for the last packet, resend the current
835 	     packet.  */
836 	  if ((seq + 1) % SEQ_MODULOS == mips_send_seq)
837 	    break;
838 
839 	  /* Otherwise this is a bad ack; ignore it.  Increment the
840 	     garbage count to ensure that we do not stay in this loop
841 	     forever.  */
842 	  ++garbage;
843 	}
844     }
845 
846   mips_error ("Remote did not acknowledge packet");
847 }
848 
849 /* Receive and acknowledge a packet, returning the data in BUFF (which
850    should be DATA_MAXLEN + 1 bytes).  The protocol documentation
851    implies that only the sender retransmits packets, so this code just
852    waits silently for a packet.  It returns the length of the received
853    packet.  If THROW_ERROR is nonzero, call error() on errors.  If not,
854    don't print an error message and return -1.  */
855 
856 static int
857 mips_receive_packet (buff, throw_error, timeout)
858      char *buff;
859      int throw_error;
860      int timeout;
861 {
862   int ch;
863   int garbage;
864   int len;
865   unsigned char ack[HDR_LENGTH + TRLR_LENGTH + 1];
866   int cksum;
867 
868   ch = 0;
869   garbage = 0;
870   while (1)
871     {
872       unsigned char hdr[HDR_LENGTH];
873       unsigned char trlr[TRLR_LENGTH];
874       int i;
875       int err;
876 
877       if (mips_receive_header (hdr, &garbage, ch, timeout) != 0)
878 	{
879 	  if (throw_error)
880 	    mips_error ("Timed out waiting for remote packet");
881 	  else
882 	    return -1;
883 	}
884 
885       ch = 0;
886 
887       /* An acknowledgement is probably a duplicate; ignore it.  */
888       if (! HDR_IS_DATA (hdr))
889 	{
890           len = HDR_GET_LEN (hdr);
891           /* Check if the length is valid for an ACK, we may aswell
892              try and read the remainder of the packet: */
893           if (len == 0)
894             {
895               /* Ignore the error condition, since we are going to
896                  ignore the packet anyway. */
897               (void) mips_receive_trailer (trlr, &garbage, &ch, timeout);
898             }
899 	  /* Don't use _filtered; we can't deal with a QUIT out of
900 	     target_wait, and I think this might be called from there.  */
901 	  if (remote_debug > 0)
902 	    printf_unfiltered ("Ignoring unexpected ACK\n");
903 	  continue;
904 	}
905 
906       len = HDR_GET_LEN (hdr);
907       for (i = 0; i < len; i++)
908 	{
909 	  int rch;
910 
911 	  rch = mips_readchar (timeout);
912 	  if (rch == SYN)
913 	    {
914 	      ch = SYN;
915 	      break;
916 	    }
917 	  if (rch == SERIAL_TIMEOUT)
918 	    {
919 	      if (throw_error)
920 		mips_error ("Timed out waiting for remote packet");
921 	      else
922 		return -1;
923 	    }
924 	  buff[i] = rch;
925 	}
926 
927       if (i < len)
928 	{
929 	  /* Don't use _filtered; we can't deal with a QUIT out of
930 	     target_wait, and I think this might be called from there.  */
931 	  if (remote_debug > 0)
932 	    printf_unfiltered ("Got new SYN after %d chars (wanted %d)\n",
933 			     i, len);
934 	  continue;
935 	}
936 
937       err = mips_receive_trailer (trlr, &garbage, &ch, timeout);
938       if (err == -1)
939 	{
940 	  if (throw_error)
941 	    mips_error ("Timed out waiting for packet");
942 	  else
943 	    return -1;
944 	}
945       if (err == -2)
946 	{
947 	  /* Don't use _filtered; we can't deal with a QUIT out of
948 	     target_wait, and I think this might be called from there.  */
949 	  if (remote_debug > 0)
950 	    printf_unfiltered ("Got SYN when wanted trailer\n");
951 	  continue;
952 	}
953 
954       /* If this is the wrong sequence number, ignore it.  */
955       if (HDR_GET_SEQ (hdr) != mips_receive_seq)
956 	{
957 	  /* Don't use _filtered; we can't deal with a QUIT out of
958 	     target_wait, and I think this might be called from there.  */
959 	  if (remote_debug > 0)
960 	    printf_unfiltered ("Ignoring sequence number %d (want %d)\n",
961 			     HDR_GET_SEQ (hdr), mips_receive_seq);
962 	  continue;
963 	}
964 
965       if (mips_cksum (hdr, buff, len) == TRLR_GET_CKSUM (trlr))
966         break;
967 
968       if (remote_debug > 0)
969 	/* Don't use _filtered; we can't deal with a QUIT out of
970 	   target_wait, and I think this might be called from there.  */
971 	printf_unfiltered ("Bad checksum; data %d, trailer %d\n",
972 			 mips_cksum (hdr, buff, len),
973 			 TRLR_GET_CKSUM (trlr));
974 
975       /* The checksum failed.  Send an acknowledgement for the
976 	 previous packet to tell the remote to resend the packet.  */
977       ack[HDR_INDX_SYN] = HDR_SET_SYN (0, 0, mips_receive_seq);
978       ack[HDR_INDX_TYPE_LEN] = HDR_SET_TYPE_LEN (0, 0, mips_receive_seq);
979       ack[HDR_INDX_LEN1] = HDR_SET_LEN1 (0, 0, mips_receive_seq);
980       ack[HDR_INDX_SEQ] = HDR_SET_SEQ (0, 0, mips_receive_seq);
981 
982       cksum = mips_cksum (ack, (unsigned char *) NULL, 0);
983 
984       ack[HDR_LENGTH + TRLR_INDX_CSUM1] = TRLR_SET_CSUM1 (cksum);
985       ack[HDR_LENGTH + TRLR_INDX_CSUM2] = TRLR_SET_CSUM2 (cksum);
986       ack[HDR_LENGTH + TRLR_INDX_CSUM3] = TRLR_SET_CSUM3 (cksum);
987 
988       if (remote_debug > 0)
989 	{
990 	  ack[HDR_LENGTH + TRLR_LENGTH] = '\0';
991 	  /* Don't use _filtered; we can't deal with a QUIT out of
992 	     target_wait, and I think this might be called from there.  */
993 	  printf_unfiltered ("Writing ack %d \"%s\"\n", mips_receive_seq,
994 			   ack + 1);
995 	}
996 
997       if (SERIAL_WRITE (mips_desc, ack, HDR_LENGTH + TRLR_LENGTH) != 0)
998 	{
999 	  if (throw_error)
1000 	    mips_error ("write to target failed: %s", safe_strerror (errno));
1001 	  else
1002 	    return -1;
1003 	}
1004     }
1005 
1006   if (remote_debug > 0)
1007     {
1008       buff[len] = '\0';
1009       /* Don't use _filtered; we can't deal with a QUIT out of
1010 	 target_wait, and I think this might be called from there.  */
1011       printf_unfiltered ("Got packet \"%s\"\n", buff);
1012     }
1013 
1014   /* We got the packet.  Send an acknowledgement.  */
1015   mips_receive_seq = (mips_receive_seq + 1) % SEQ_MODULOS;
1016 
1017   ack[HDR_INDX_SYN] = HDR_SET_SYN (0, 0, mips_receive_seq);
1018   ack[HDR_INDX_TYPE_LEN] = HDR_SET_TYPE_LEN (0, 0, mips_receive_seq);
1019   ack[HDR_INDX_LEN1] = HDR_SET_LEN1 (0, 0, mips_receive_seq);
1020   ack[HDR_INDX_SEQ] = HDR_SET_SEQ (0, 0, mips_receive_seq);
1021 
1022   cksum = mips_cksum (ack, (unsigned char *) NULL, 0);
1023 
1024   ack[HDR_LENGTH + TRLR_INDX_CSUM1] = TRLR_SET_CSUM1 (cksum);
1025   ack[HDR_LENGTH + TRLR_INDX_CSUM2] = TRLR_SET_CSUM2 (cksum);
1026   ack[HDR_LENGTH + TRLR_INDX_CSUM3] = TRLR_SET_CSUM3 (cksum);
1027 
1028   if (remote_debug > 0)
1029     {
1030       ack[HDR_LENGTH + TRLR_LENGTH] = '\0';
1031       /* Don't use _filtered; we can't deal with a QUIT out of
1032 	 target_wait, and I think this might be called from there.  */
1033       printf_unfiltered ("Writing ack %d \"%s\"\n", mips_receive_seq,
1034 		       ack + 1);
1035     }
1036 
1037   if (SERIAL_WRITE (mips_desc, ack, HDR_LENGTH + TRLR_LENGTH) != 0)
1038     {
1039       if (throw_error)
1040 	mips_error ("write to target failed: %s", safe_strerror (errno));
1041       else
1042 	return -1;
1043     }
1044 
1045   return len;
1046 }
1047 
1048 /* Optionally send a request to the remote system and optionally wait
1049    for the reply.  This implements the remote debugging protocol,
1050    which is built on top of the packet protocol defined above.  Each
1051    request has an ADDR argument and a DATA argument.  The following
1052    requests are defined:
1053 
1054    \0	don't send a request; just wait for a reply
1055    i	read word from instruction space at ADDR
1056    d	read word from data space at ADDR
1057    I	write DATA to instruction space at ADDR
1058    D	write DATA to data space at ADDR
1059    r	read register number ADDR
1060    R	set register number ADDR to value DATA
1061    c	continue execution (if ADDR != 1, set pc to ADDR)
1062    s	single step (if ADDR != 1, set pc to ADDR)
1063 
1064    The read requests return the value requested.  The write requests
1065    return the previous value in the changed location.  The execution
1066    requests return a UNIX wait value (the approximate signal which
1067    caused execution to stop is in the upper eight bits).
1068 
1069    If PERR is not NULL, this function waits for a reply.  If an error
1070    occurs, it sets *PERR to 1 and sets errno according to what the
1071    target board reports.  */
1072 
1073 static CORE_ADDR
1074 mips_request (cmd, addr, data, perr, timeout, buff)
1075      int cmd;
1076      CORE_ADDR addr;
1077      CORE_ADDR data;
1078      int *perr;
1079      int timeout;
1080      char *buff;
1081 {
1082   char myBuff[DATA_MAXLEN + 1];
1083   int len;
1084   int rpid;
1085   char rcmd;
1086   int rerrflg;
1087   int rresponse;
1088 
1089   if (buff == (char *) NULL)
1090     buff = myBuff;
1091 
1092   if (cmd != '\0')
1093     {
1094       if (mips_need_reply)
1095 	fatal ("mips_request: Trying to send command before reply");
1096       sprintf (buff, "0x0 %c 0x%s 0x%s", cmd, paddr(addr), paddr(data));
1097       mips_send_packet (buff, 1);
1098       mips_need_reply = 1;
1099     }
1100 
1101   if (perr == (int *) NULL)
1102     return 0;
1103 
1104   if (! mips_need_reply)
1105     fatal ("mips_request: Trying to get reply before command");
1106 
1107   mips_need_reply = 0;
1108 
1109   len = mips_receive_packet (buff, 1, timeout);
1110   buff[len] = '\0';
1111 
1112   if (sscanf (buff, "0x%x %c 0x%x 0x%x",
1113 	      &rpid, &rcmd, &rerrflg, &rresponse) != 4
1114       || (cmd != '\0' && rcmd != cmd))
1115     mips_error ("Bad response from remote board");
1116 
1117   if (rerrflg != 0)
1118     {
1119       *perr = 1;
1120 
1121       /* FIXME: This will returns MIPS errno numbers, which may or may
1122 	 not be the same as errno values used on other systems.  If
1123 	 they stick to common errno values, they will be the same, but
1124 	 if they don't, they must be translated.  */
1125       errno = rresponse;
1126 
1127       return 0;
1128     }
1129 
1130   *perr = 0;
1131   return rresponse;
1132 }
1133 
1134 static void
1135 mips_initialize_cleanups (arg)
1136      PTR arg;
1137 {
1138   mips_initializing = 0;
1139 }
1140 
1141 static void
1142 mips_send_command (cmd, prompt)
1143      const char *cmd;
1144      int prompt;
1145 {
1146   SERIAL_WRITE (mips_desc, cmd, strlen(cmd));
1147   mips_expect (cmd);
1148   mips_expect ("\012");
1149   if (prompt)
1150     mips_expect (mips_monitor_prompt);
1151 }
1152 
1153 /* Enter remote (dbx) debug mode: */
1154 static void
1155 mips_enter_debug ()
1156 {
1157   /* Reset the sequence numbers, ready for the new debug sequence: */
1158   mips_send_seq = 0;
1159   mips_receive_seq = 0;
1160 
1161   if (mips_monitor == MON_PMON || mips_monitor == MON_DDB)
1162     mips_send_command ("debug\015", 0);
1163   else /* assume IDT monitor by default */
1164     mips_send_command ("db tty0\015", 0);
1165 
1166   SERIAL_WRITE (mips_desc, "\015", sizeof "\015" - 1);
1167 
1168   /* We don't need to absorb any spurious characters here, since the
1169      mips_receive_header will eat up a reasonable number of characters
1170      whilst looking for the SYN, however this avoids the "garbage"
1171      being displayed to the user. */
1172   if (mips_monitor == MON_PMON || mips_monitor == MON_DDB)
1173     mips_expect ("\015");
1174 
1175   {
1176     char buff[DATA_MAXLEN + 1];
1177     if (mips_receive_packet (buff, 1, 3) < 0)
1178       mips_error ("Failed to initialize (didn't receive packet).");
1179   }
1180 }
1181 
1182 /* Exit remote (dbx) debug mode, returning to the monitor prompt: */
1183 static int
1184 mips_exit_debug ()
1185 {
1186   int err;
1187 
1188   if (mips_monitor == MON_DDB)
1189     {
1190       /* The Ddb version of PMON exits immediately, so we do not get
1191          a reply to this command: */
1192       mips_request ('x', (unsigned int) 0, (unsigned int) 0, NULL,
1193 		mips_receive_wait, NULL);
1194       mips_need_reply = 0;
1195       if (!mips_expect (" break!"))
1196         return -1;
1197     }
1198   else
1199     mips_request ('x', (unsigned int) 0, (unsigned int) 0, &err,
1200                   mips_receive_wait, NULL);
1201 
1202   if (mips_monitor == MON_PMON && !mips_expect ("Exiting remote debug mode"))
1203     return -1;
1204 
1205   if (mips_monitor == MON_DDB)
1206     {
1207       if (!mips_expect ("\012"))
1208         return -1;
1209     }
1210   else
1211     if (!mips_expect ("\015\012"))
1212       return -1;
1213 
1214   if (!mips_expect (mips_monitor_prompt))
1215     return -1;
1216 
1217   return 0;
1218 }
1219 
1220 /* Initialize a new connection to the MIPS board, and make sure we are
1221    really connected.  */
1222 
1223 static void
1224 mips_initialize ()
1225 {
1226   int err;
1227   struct cleanup *old_cleanups = make_cleanup (mips_initialize_cleanups, NULL);
1228   int j;
1229 
1230   /* What is this code doing here?  I don't see any way it can happen, and
1231      it might mean mips_initializing didn't get cleared properly.
1232      So I'll make it a warning.  */
1233 
1234   if (mips_initializing)
1235     {
1236       warning ("internal error: mips_initialize called twice");
1237       return;
1238     }
1239 
1240   mips_wait_flag = 0;
1241   mips_initializing = 1;
1242 
1243   /* At this point, the packit protocol isn't responding.  We'll try getting
1244      into the monitor, and restarting the protocol.  */
1245 
1246   /* Force the system into the monitor.  After this we *should* be at
1247      the mips_monitor_prompt.  */
1248   if (mips_monitor == MON_PMON || mips_monitor == MON_DDB)
1249     j = 0; /* start by checking if we are already at the prompt */
1250   else
1251     j = 1; /* start by sending a break */
1252   for (; j <= 4; j++)
1253     {
1254       switch (j)
1255 	{
1256         case 0:                 /* First, try sending a CR */
1257           SERIAL_FLUSH_INPUT (mips_desc);
1258 	  SERIAL_WRITE (mips_desc, "\015", 1);
1259           break;
1260 	case 1:			/* First, try sending a break */
1261 	  SERIAL_SEND_BREAK (mips_desc);
1262 	  break;
1263 	case 2:			/* Then, try a ^C */
1264 	  SERIAL_WRITE (mips_desc, "\003", 1);
1265 	  break;
1266 	case 3:			/* Then, try escaping from download */
1267 	  {
1268             if (mips_monitor == MON_PMON || mips_monitor == MON_DDB)
1269               {
1270                 char tbuff[7];
1271 
1272                 /* We shouldn't need to send multiple termination
1273                    sequences, since the target performs line (or
1274                    block) reads, and then processes those
1275                    packets. In-case we were downloading a large packet
1276                    we flush the output buffer before inserting a
1277                    termination sequence. */
1278                 SERIAL_FLUSH_OUTPUT (mips_desc);
1279                 sprintf (tbuff, "\015/E/E\015");
1280                 SERIAL_WRITE (mips_desc, tbuff, 6);
1281               }
1282             else
1283               {
1284                 char srec[10];
1285                 int i;
1286 
1287                 /* We are possibly in binary download mode, having
1288                    aborted in the middle of an S-record.  ^C won't
1289                    work because of binary mode.  The only reliable way
1290                    out is to send enough termination packets (8 bytes)
1291                    to fill up and then overflow the largest size
1292                    S-record (255 bytes in this case).  This amounts to
1293                    256/8 + 1 packets.
1294                    */
1295 
1296                 mips_make_srec (srec, '7', 0, NULL, 0);
1297 
1298                 for (i = 1; i <= 33; i++)
1299                   {
1300                     SERIAL_WRITE (mips_desc, srec, 8);
1301 
1302                     if (SERIAL_READCHAR (mips_desc, 0) >= 0)
1303                       break;	/* Break immediatly if we get something from
1304 				   the board. */
1305                   }
1306               }
1307           }
1308 	  break;
1309 	case 4:
1310 	  mips_error ("Failed to initialize.");
1311 	}
1312 
1313       if (mips_expect (mips_monitor_prompt))
1314 	break;
1315     }
1316 
1317   if (mips_monitor == MON_PMON || mips_monitor == MON_DDB)
1318     {
1319       /* Ensure the correct target state: */
1320       mips_send_command ("set regsize 64\015", -1);
1321       mips_send_command ("set hostport tty0\015", -1);
1322       mips_send_command ("set brkcmd \"\"\015", -1);
1323       /* Delete all the current breakpoints: */
1324       mips_send_command ("db *\015", -1);
1325       /* NOTE: PMON does not have breakpoint support through the
1326          "debug" mode, only at the monitor command-line. */
1327     }
1328 
1329   mips_enter_debug ();
1330 
1331   /* Clear all breakpoints: */
1332   if (common_breakpoint ('b', -1, 0, NULL))
1333    monitor_supports_breakpoints = 0;
1334   else
1335    monitor_supports_breakpoints = 1;
1336 
1337   do_cleanups (old_cleanups);
1338 
1339   /* If this doesn't call error, we have connected; we don't care if
1340      the request itself succeeds or fails.  */
1341 
1342   mips_request ('r', (unsigned int) 0, (unsigned int) 0, &err,
1343 		mips_receive_wait, NULL);
1344   set_current_frame (create_new_frame (read_fp (), read_pc ()));
1345   select_frame (get_current_frame (), 0);
1346 }
1347 
1348 /* Open a connection to the remote board.  */
1349 static void
1350 common_open (ops, name, from_tty)
1351      struct target_ops *ops;
1352      char *name;
1353      int from_tty;
1354 {
1355   char *ptype;
1356 
1357   if (name == 0)
1358     error (
1359 "To open a MIPS remote debugging connection, you need to specify what serial\n\
1360 device is attached to the target board (e.g., /dev/ttya).");
1361 
1362   target_preopen (from_tty);
1363 
1364   if (mips_is_open)
1365     unpush_target (current_ops);
1366 
1367   mips_desc = SERIAL_OPEN (name);
1368   if (mips_desc == (serial_t) NULL)
1369     perror_with_name (name);
1370 
1371   if (baud_rate != -1)
1372     {
1373       if (SERIAL_SETBAUDRATE (mips_desc, baud_rate))
1374         {
1375           SERIAL_CLOSE (mips_desc);
1376           perror_with_name (name);
1377         }
1378     }
1379 
1380   SERIAL_RAW (mips_desc);
1381 
1382   current_ops = ops;
1383   mips_is_open = 1;
1384 
1385   mips_initialize ();
1386 
1387   if (from_tty)
1388     printf_unfiltered ("Remote MIPS debugging using %s\n", name);
1389 
1390   /* Switch to using remote target now.  */
1391   push_target (ops);
1392 
1393   /* FIXME: Should we call start_remote here?  */
1394 
1395   /* Try to figure out the processor model if possible.  */
1396   ptype = mips_read_processor_type ();
1397   if (ptype)
1398     mips_set_processor_type_command (strsave (ptype), 0);
1399 
1400 /* This is really the job of start_remote however, that makes an assumption
1401    that the target is about to print out a status message of some sort.  That
1402    doesn't happen here (in fact, it may not be possible to get the monitor to
1403    send the appropriate packet).  */
1404 
1405   flush_cached_frames ();
1406   registers_changed ();
1407   stop_pc = read_pc ();
1408   set_current_frame (create_new_frame (read_fp (), stop_pc));
1409   select_frame (get_current_frame (), 0);
1410   print_stack_frame (selected_frame, -1, 1);
1411 }
1412 
1413 static void
1414 mips_open (name, from_tty)
1415      char *name;
1416      int from_tty;
1417 {
1418   mips_monitor = MON_IDT;
1419   common_open (&mips_ops, name, from_tty);
1420 }
1421 
1422 static void
1423 pmon_open (name, from_tty)
1424      char *name;
1425      int from_tty;
1426 {
1427   /* The PMON monitor has a prompt different from the default
1428      "TARGET_MONITOR_PROMPT": */
1429   mips_monitor_prompt = "PMON> ";
1430   mips_monitor = MON_PMON;
1431   common_open (&pmon_ops, name, from_tty);
1432 }
1433 
1434 static void
1435 ddb_open (name, from_tty)
1436      char *name;
1437      int from_tty;
1438 {
1439   /* The PMON monitor has a prompt different from the default
1440      "TARGET_MONITOR_PROMPT": */
1441   mips_monitor_prompt = "NEC010>";
1442   mips_monitor = MON_DDB;
1443   common_open (&ddb_ops, name, from_tty);
1444 }
1445 
1446 /* Close a connection to the remote board.  */
1447 
1448 static void
1449 mips_close (quitting)
1450      int quitting;
1451 {
1452   if (mips_is_open)
1453     {
1454       int err;
1455 
1456       mips_is_open = 0;
1457 
1458       /* Get the board out of remote debugging mode.  */
1459       (void) mips_exit_debug ();
1460 
1461       SERIAL_CLOSE (mips_desc);
1462     }
1463 }
1464 
1465 /* Detach from the remote board.  */
1466 
1467 static void
1468 mips_detach (args, from_tty)
1469      char *args;
1470      int from_tty;
1471 {
1472   if (args)
1473     error ("Argument given to \"detach\" when remotely debugging.");
1474 
1475   pop_target ();
1476 
1477   mips_close (1);
1478 
1479   if (from_tty)
1480     printf_unfiltered ("Ending remote MIPS debugging.\n");
1481 }
1482 
1483 /* Tell the target board to resume.  This does not wait for a reply
1484    from the board.  */
1485 
1486 static void
1487 mips_resume (pid, step, siggnal)
1488      int pid, step;
1489      enum target_signal siggnal;
1490 {
1491 
1492 
1493   mips_request (step ? 's' : 'c',
1494 		(unsigned int) 1,
1495 		(unsigned int) siggnal,
1496 		(int *) NULL,
1497 		mips_receive_wait, NULL);
1498 }
1499 
1500 /* Return the signal corresponding to SIG, where SIG is the number which
1501    the MIPS protocol uses for the signal.  */
1502 enum target_signal
1503 mips_signal_from_protocol (sig)
1504      int sig;
1505 {
1506   /* We allow a few more signals than the IDT board actually returns, on
1507      the theory that there is at least *some* hope that perhaps the numbering
1508      for these signals is widely agreed upon.  */
1509   if (sig <= 0
1510       || sig > 31)
1511     return TARGET_SIGNAL_UNKNOWN;
1512 
1513   /* Don't want to use target_signal_from_host because we are converting
1514      from MIPS signal numbers, not host ones.  Our internal numbers
1515      match the MIPS numbers for the signals the board can return, which
1516      are: SIGINT, SIGSEGV, SIGBUS, SIGILL, SIGFPE, SIGTRAP.  */
1517   return (enum target_signal) sig;
1518 }
1519 
1520 /* Wait until the remote stops, and return a wait status.  */
1521 
1522 static int
1523 mips_wait (pid, status)
1524      int pid;
1525      struct target_waitstatus *status;
1526 {
1527   int rstatus;
1528   int err;
1529   char buff[DATA_MAXLEN];
1530   int rpc, rfp, rsp;
1531   char flags[20];
1532   int nfields;
1533 
1534   interrupt_count = 0;
1535   hit_watchpoint = 0;
1536 
1537   /* If we have not sent a single step or continue command, then the
1538      board is waiting for us to do something.  Return a status
1539      indicating that it is stopped.  */
1540   if (! mips_need_reply)
1541     {
1542       status->kind = TARGET_WAITKIND_STOPPED;
1543       status->value.sig = TARGET_SIGNAL_TRAP;
1544       return 0;
1545     }
1546 
1547   /* No timeout; we sit here as long as the program continues to execute.  */
1548   mips_wait_flag = 1;
1549   rstatus = mips_request ('\000', (unsigned int) 0, (unsigned int) 0, &err, -1,
1550 			  buff);
1551   mips_wait_flag = 0;
1552   if (err)
1553     mips_error ("Remote failure: %s", safe_strerror (errno));
1554 
1555   nfields = sscanf (buff, "0x%*x %*c 0x%*x 0x%*x 0x%x 0x%x 0x%x 0x%*x %s",
1556 		    &rpc, &rfp, &rsp, flags);
1557 
1558   /* See if we got back extended status.  If so, pick out the pc, fp, sp, etc... */
1559 
1560   if (nfields == 7 || nfields == 9)
1561     {
1562       char buf[MAX_REGISTER_RAW_SIZE];
1563 
1564       store_unsigned_integer (buf, REGISTER_RAW_SIZE (PC_REGNUM), rpc);
1565       supply_register (PC_REGNUM, buf);
1566 
1567       store_unsigned_integer (buf, REGISTER_RAW_SIZE (PC_REGNUM), rfp);
1568       supply_register (30, buf); /* This register they are avoiding and so it is unnamed */
1569 
1570       store_unsigned_integer (buf, REGISTER_RAW_SIZE (SP_REGNUM), rsp);
1571       supply_register (SP_REGNUM, buf);
1572 
1573       store_unsigned_integer (buf, REGISTER_RAW_SIZE (FP_REGNUM), 0);
1574       supply_register (FP_REGNUM, buf);
1575 
1576       if (nfields == 9)
1577 	{
1578 	  int i;
1579 
1580 	  for (i = 0; i <= 2; i++)
1581 	    if (flags[i] == 'r' || flags[i] == 'w')
1582 	      hit_watchpoint = 1;
1583 	    else if (flags[i] == '\000')
1584 	      break;
1585 	}
1586     }
1587 
1588   /* Translate a MIPS waitstatus.  We use constants here rather than WTERMSIG
1589      and so on, because the constants we want here are determined by the
1590      MIPS protocol and have nothing to do with what host we are running on.  */
1591   if ((rstatus & 0377) == 0)
1592     {
1593       status->kind = TARGET_WAITKIND_EXITED;
1594       status->value.integer = (((rstatus) >> 8) & 0377);
1595     }
1596   else if ((rstatus & 0377) == 0177)
1597     {
1598       status->kind = TARGET_WAITKIND_STOPPED;
1599       status->value.sig = mips_signal_from_protocol (((rstatus) >> 8) & 0377);
1600     }
1601   else
1602     {
1603       status->kind = TARGET_WAITKIND_SIGNALLED;
1604       status->value.sig = mips_signal_from_protocol (rstatus & 0177);
1605     }
1606 
1607   return 0;
1608 }
1609 
1610 static int
1611 pmon_wait (pid, status)
1612      int pid;
1613      struct target_waitstatus *status;
1614 {
1615   int rstatus;
1616   int err;
1617   char buff[DATA_MAXLEN];
1618 
1619   interrupt_count = 0;
1620   hit_watchpoint = 0;
1621 
1622   /* If we have not sent a single step or continue command, then the
1623      board is waiting for us to do something.  Return a status
1624      indicating that it is stopped.  */
1625   if (! mips_need_reply)
1626     {
1627       status->kind = TARGET_WAITKIND_STOPPED;
1628       status->value.sig = TARGET_SIGNAL_TRAP;
1629       return 0;
1630     }
1631 
1632   /* Sit, polling the serial until the target decides to talk to
1633      us. NOTE: the timeout value we use is used not just for the
1634      first character, but for all the characters. */
1635   mips_wait_flag = 1;
1636   rstatus = mips_request ('\000', (unsigned int) 0, (unsigned int) 0, &err, -1,
1637 			  buff);
1638   mips_wait_flag = 0;
1639   if (err)
1640     mips_error ("Remote failure: %s", safe_strerror (errno));
1641 
1642   /* NOTE: The following (sig) numbers are defined by PMON:
1643      	SPP_SIGTRAP     5       breakpoint
1644         SPP_SIGINT      2
1645         SPP_SIGSEGV     11
1646         SPP_SIGBUS      10
1647         SPP_SIGILL      4
1648         SPP_SIGFPE      8
1649         SPP_SIGTERM     15 */
1650 
1651   /* On returning from a continue, the PMON monitor seems to start
1652      echoing back the messages we send prior to sending back the
1653      ACK. The code can cope with this, but to try and avoid the
1654      unnecessary serial traffic, and "spurious" characters displayed
1655      to the user, we cheat and reset the debug protocol. The problems
1656      seems to be caused by a check on the number of arguments, and the
1657      command length, within the monitor causing it to echo the command
1658      as a bad packet. */
1659   if (mips_monitor != MON_DDB)
1660     {
1661       mips_exit_debug ();
1662       mips_enter_debug ();
1663     }
1664 
1665   /* Translate a MIPS waitstatus.  We use constants here rather than WTERMSIG
1666      and so on, because the constants we want here are determined by the
1667      MIPS protocol and have nothing to do with what host we are running on.  */
1668   if ((rstatus & 0377) == 0)
1669     {
1670       status->kind = TARGET_WAITKIND_EXITED;
1671       status->value.integer = (((rstatus) >> 8) & 0377);
1672     }
1673   else if ((rstatus & 0377) == 0177)
1674     {
1675       status->kind = TARGET_WAITKIND_STOPPED;
1676       status->value.sig = mips_signal_from_protocol (((rstatus) >> 8) & 0377);
1677     }
1678   else
1679     {
1680       status->kind = TARGET_WAITKIND_SIGNALLED;
1681       status->value.sig = mips_signal_from_protocol (rstatus & 0177);
1682     }
1683 
1684   return 0;
1685 }
1686 
1687 /* We have to map between the register numbers used by gdb and the
1688    register numbers used by the debugging protocol.  This function
1689    assumes that we are using tm-mips.h.  */
1690 
1691 #define REGNO_OFFSET 96
1692 
1693 static int
1694 mips_map_regno (regno)
1695      int regno;
1696 {
1697   if (regno < 32)
1698     return regno;
1699   if (regno >= FP0_REGNUM && regno < FP0_REGNUM + 32)
1700     return regno - FP0_REGNUM + 32;
1701   switch (regno)
1702     {
1703     case PC_REGNUM:
1704       return REGNO_OFFSET + 0;
1705     case CAUSE_REGNUM:
1706       return REGNO_OFFSET + 1;
1707     case HI_REGNUM:
1708       return REGNO_OFFSET + 2;
1709     case LO_REGNUM:
1710       return REGNO_OFFSET + 3;
1711     case FCRCS_REGNUM:
1712       return REGNO_OFFSET + 4;
1713     case FCRIR_REGNUM:
1714       return REGNO_OFFSET + 5;
1715     default:
1716       /* FIXME: Is there a way to get the status register?  */
1717       return 0;
1718     }
1719 }
1720 
1721 /* Fetch the remote registers.  */
1722 
1723 static void
1724 mips_fetch_registers (regno)
1725      int regno;
1726 {
1727   unsigned LONGEST val;
1728   int err;
1729 
1730   if (regno == -1)
1731     {
1732       for (regno = 0; regno < NUM_REGS; regno++)
1733 	mips_fetch_registers (regno);
1734       return;
1735     }
1736 
1737   if (regno == FP_REGNUM || regno == ZERO_REGNUM)
1738     /* FP_REGNUM on the mips is a hack which is just supposed to read
1739        zero (see also mips-nat.c).  */
1740     val = 0;
1741   else
1742     {
1743       /* Unfortunately the PMON version in the Vr4300 board has been
1744          compiled without the 64bit register access commands. This
1745          means we cannot get hold of the full register width. */
1746       if (mips_monitor == MON_DDB)
1747         val = (unsigned)mips_request ('t', (unsigned int) mips_map_regno (regno),
1748                             (unsigned int) 0, &err, mips_receive_wait, NULL);
1749       else
1750         val = mips_request ('r', (unsigned int) mips_map_regno (regno),
1751                             (unsigned int) 0, &err, mips_receive_wait, NULL);
1752       if (err)
1753 	mips_error ("Can't read register %d: %s", regno,
1754 		    safe_strerror (errno));
1755     }
1756 
1757   {
1758     char buf[MAX_REGISTER_RAW_SIZE];
1759 
1760     /* We got the number the register holds, but gdb expects to see a
1761        value in the target byte ordering.  */
1762     store_unsigned_integer (buf, REGISTER_RAW_SIZE (regno), val);
1763     supply_register (regno, buf);
1764   }
1765 }
1766 
1767 /* Prepare to store registers.  The MIPS protocol can store individual
1768    registers, so this function doesn't have to do anything.  */
1769 
1770 static void
1771 mips_prepare_to_store ()
1772 {
1773 }
1774 
1775 /* Store remote register(s).  */
1776 
1777 static void
1778 mips_store_registers (regno)
1779      int regno;
1780 {
1781   int err;
1782 
1783   if (regno == -1)
1784     {
1785       for (regno = 0; regno < NUM_REGS; regno++)
1786 	mips_store_registers (regno);
1787       return;
1788     }
1789 
1790   mips_request ('R', (unsigned int) mips_map_regno (regno),
1791 		read_register (regno),
1792 		&err, mips_receive_wait, NULL);
1793   if (err)
1794     mips_error ("Can't write register %d: %s", regno, safe_strerror (errno));
1795 }
1796 
1797 /* Fetch a word from the target board.  */
1798 
1799 static unsigned int
1800 mips_fetch_word (addr)
1801      CORE_ADDR addr;
1802 {
1803   unsigned int val;
1804   int err;
1805 
1806   /* FIXME! addr was cast to uint! */
1807   val = mips_request ('d', addr, (unsigned int) 0, &err,
1808 		      mips_receive_wait, NULL);
1809   if (err)
1810     {
1811       /* Data space failed; try instruction space.  */
1812       /* FIXME! addr was cast to uint! */
1813       val = mips_request ('i', addr, (unsigned int) 0, &err,
1814 			  mips_receive_wait, NULL);
1815       if (err)
1816         mips_error ("Can't read address 0x%s: %s",
1817 	      paddr(addr), safe_strerror (errno));
1818     }
1819   return val;
1820 }
1821 
1822 /* Store a word to the target board.  Returns errno code or zero for
1823    success.  If OLD_CONTENTS is non-NULL, put the old contents of that
1824    memory location there.  */
1825 
1826 /* FIXME! make sure only 32-bit quantities get stored! */
1827 static int
1828 mips_store_word (addr, val, old_contents)
1829      CORE_ADDR addr;
1830      unsigned int val;
1831      char *old_contents;
1832 {
1833   int err;
1834   unsigned int oldcontents;
1835 
1836   oldcontents = mips_request ('D', addr, (unsigned int) val,
1837 			      &err,
1838 			      mips_receive_wait, NULL);
1839   if (err)
1840     {
1841       /* Data space failed; try instruction space.  */
1842       oldcontents = mips_request ('I', addr,
1843 				  (unsigned int) val, &err,
1844 				  mips_receive_wait, NULL);
1845       if (err)
1846 	return errno;
1847     }
1848   if (old_contents != NULL)
1849     store_unsigned_integer (old_contents, 4, oldcontents);
1850   return 0;
1851 }
1852 
1853 /* Read or write LEN bytes from inferior memory at MEMADDR,
1854    transferring to or from debugger address MYADDR.  Write to inferior
1855    if SHOULD_WRITE is nonzero.  Returns length of data written or
1856    read; 0 for error.  Note that protocol gives us the correct value
1857    for a longword, since it transfers values in ASCII.  We want the
1858    byte values, so we have to swap the longword values.  */
1859 
1860 static int
1861 mips_xfer_memory (memaddr, myaddr, len, write, ignore)
1862      CORE_ADDR memaddr;
1863      char *myaddr;
1864      int len;
1865      int write;
1866      struct target_ops *ignore;
1867 {
1868   register int i;
1869   /* Round starting address down to longword boundary.  */
1870   register CORE_ADDR addr = memaddr &~ 3;
1871   /* Round ending address up; get number of longwords that makes.  */
1872   register int count = (((memaddr + len) - addr) + 3) / 4;
1873   /* Allocate buffer of that many longwords.  */
1874   register char *buffer = alloca (count * 4);
1875 
1876   int status;
1877 
1878   if (write)
1879     {
1880       /* Fill start and end extra bytes of buffer with existing data.  */
1881       if (addr != memaddr || len < 4)
1882 	{
1883 	  /* Need part of initial word -- fetch it.  */
1884 	  store_unsigned_integer (&buffer[0], 4, mips_fetch_word (addr));
1885 	}
1886 
1887       if (count > 1)
1888 	{
1889 	  /* Need part of last word -- fetch it.  FIXME: we do this even
1890 	     if we don't need it.  */
1891 	  store_unsigned_integer (&buffer[(count - 1) * 4], 4,
1892 				  mips_fetch_word (addr + (count - 1) * 4));
1893 	}
1894 
1895       /* Copy data to be written over corresponding part of buffer */
1896 
1897       memcpy ((char *) buffer + (memaddr & 3), myaddr, len);
1898 
1899       /* Write the entire buffer.  */
1900 
1901       for (i = 0; i < count; i++, addr += 4)
1902 	{
1903 	  status = mips_store_word (addr,
1904 				    extract_unsigned_integer (&buffer[i*4], 4),
1905 				    NULL);
1906 	  /* Report each kilobyte (we download 32-bit words at a time) */
1907 	  if (i % 256 == 255)
1908 	    {
1909 	      printf_unfiltered ("*");
1910 	      fflush (stdout);
1911 	    }
1912 	  if (status)
1913 	    {
1914 	      errno = status;
1915 	      return 0;
1916 	    }
1917 	  /* FIXME: Do we want a QUIT here?  */
1918 	}
1919       if (count >= 256)
1920 	printf_unfiltered ("\n");
1921     }
1922   else
1923     {
1924       /* Read all the longwords */
1925       for (i = 0; i < count; i++, addr += 4)
1926 	{
1927 	  store_unsigned_integer (&buffer[i*4], 4, mips_fetch_word (addr));
1928 	  QUIT;
1929 	}
1930 
1931       /* Copy appropriate bytes out of the buffer.  */
1932       memcpy (myaddr, buffer + (memaddr & 3), len);
1933     }
1934   return len;
1935 }
1936 
1937 /* Print info on this target.  */
1938 
1939 static void
1940 mips_files_info (ignore)
1941      struct target_ops *ignore;
1942 {
1943   printf_unfiltered ("Debugging a MIPS board over a serial line.\n");
1944 }
1945 
1946 /* Kill the process running on the board.  This will actually only
1947    work if we are doing remote debugging over the console input.  I
1948    think that if IDT/sim had the remote debug interrupt enabled on the
1949    right port, we could interrupt the process with a break signal.  */
1950 
1951 static void
1952 mips_kill ()
1953 {
1954   if (!mips_wait_flag)
1955     return;
1956 
1957   interrupt_count++;
1958 
1959   if (interrupt_count >= 2)
1960     {
1961       interrupt_count = 0;
1962 
1963       target_terminal_ours ();
1964 
1965       if (query ("Interrupted while waiting for the program.\n\
1966 Give up (and stop debugging it)? "))
1967 	{
1968 	  /* Clean up in such a way that mips_close won't try to talk to the
1969 	     board (it almost surely won't work since we weren't able to talk to
1970 	     it).  */
1971 	  mips_wait_flag = 0;
1972 	  mips_is_open = 0;
1973 	  SERIAL_CLOSE (mips_desc);
1974 
1975 	  printf_unfiltered ("Ending remote MIPS debugging.\n");
1976 	  target_mourn_inferior ();
1977 
1978 	  return_to_top_level (RETURN_QUIT);
1979 	}
1980 
1981       target_terminal_inferior ();
1982     }
1983 
1984   if (remote_debug > 0)
1985     printf_unfiltered ("Sending break\n");
1986 
1987   SERIAL_SEND_BREAK (mips_desc);
1988 
1989 #if 0
1990   if (mips_is_open)
1991     {
1992       char cc;
1993 
1994       /* Send a ^C.  */
1995       cc = '\003';
1996       SERIAL_WRITE (mips_desc, &cc, 1);
1997       sleep (1);
1998       target_mourn_inferior ();
1999     }
2000 #endif
2001 }
2002 
2003 /* Start running on the target board.  */
2004 
2005 static void
2006 mips_create_inferior (execfile, args, env)
2007      char *execfile;
2008      char *args;
2009      char **env;
2010 {
2011   CORE_ADDR entry_pt;
2012 
2013   if (args && *args)
2014     {
2015       warning ("\
2016 Can't pass arguments to remote MIPS board; arguments ignored.");
2017       /* And don't try to use them on the next "run" command.  */
2018       execute_command ("set args", 0);
2019     }
2020 
2021   if (execfile == 0 || exec_bfd == 0)
2022     error ("No executable file specified");
2023 
2024   entry_pt = (CORE_ADDR) bfd_get_start_address (exec_bfd);
2025 
2026   init_wait_for_inferior ();
2027 
2028   /* FIXME: Should we set inferior_pid here?  */
2029 
2030   proceed (entry_pt, TARGET_SIGNAL_DEFAULT, 0);
2031 }
2032 
2033 /* Clean up after a process.  Actually nothing to do.  */
2034 
2035 static void
2036 mips_mourn_inferior ()
2037 {
2038   if (current_ops != NULL)
2039     unpush_target (current_ops);
2040   generic_mourn_inferior ();
2041 }
2042 
2043 /* We can write a breakpoint and read the shadow contents in one
2044    operation.  */
2045 
2046 /* The IDT board uses an unusual breakpoint value, and sometimes gets
2047    confused when it sees the usual MIPS breakpoint instruction.  */
2048 
2049 #define BREAK_INSN (0x00000a0d)
2050 #define BREAK_INSN_SIZE (4)
2051 
2052 /* Insert a breakpoint on targets that don't have any better breakpoint
2053    support.  We read the contents of the target location and stash it,
2054    then overwrite it with a breakpoint instruction.  ADDR is the target
2055    location in the target machine.  CONTENTS_CACHE is a pointer to
2056    memory allocated for saving the target contents.  It is guaranteed
2057    by the caller to be long enough to save sizeof BREAKPOINT bytes (this
2058    is accomplished via BREAKPOINT_MAX).  */
2059 
2060 static int
2061 mips_insert_breakpoint (addr, contents_cache)
2062      CORE_ADDR addr;
2063      char *contents_cache;
2064 {
2065   int status;
2066 
2067   if (monitor_supports_breakpoints)
2068     return common_breakpoint ('B', addr, 0x3, "f");
2069 
2070   return mips_store_word (addr, BREAK_INSN, contents_cache);
2071 }
2072 
2073 static int
2074 mips_remove_breakpoint (addr, contents_cache)
2075      CORE_ADDR addr;
2076      char *contents_cache;
2077 {
2078   if (monitor_supports_breakpoints)
2079     return common_breakpoint ('b', addr, 0, NULL);
2080 
2081   return target_write_memory (addr, contents_cache, BREAK_INSN_SIZE);
2082 }
2083 
2084 #if 0 /* currently not used */
2085 /* PMON does not currently provide support for the debug mode 'b'
2086    commands to manipulate breakpoints. However, if we wanted to use
2087    the monitor breakpoints (rather than the GDB BREAK_INSN version)
2088    then this code performs the work needed to leave debug mode,
2089    set/clear the breakpoint, and then return to debug mode. */
2090 
2091 #define PMON_MAX_BP (33) /* 32 SW, 1 HW */
2092 static CORE_ADDR mips_pmon_bp_info[PMON_MAX_BP];
2093 /* NOTE: The code relies on this vector being zero-initialised by the system */
2094 
2095 static int
2096 pmon_insert_breakpoint (addr, contents_cache)
2097      CORE_ADDR addr;
2098      char *contents_cache;
2099 {
2100   int status;
2101 
2102   if (monitor_supports_breakpoints)
2103     {
2104       char tbuff[12]; /* space for breakpoint command */
2105       int bpnum;
2106       CORE_ADDR bpaddr;
2107 
2108       /* PMON does not support debug level breakpoint set/remove: */
2109       if (mips_exit_debug ())
2110         mips_error ("Failed to exit debug mode");
2111 
2112       sprintf (tbuff, "b %08x\015", addr);
2113       mips_send_command (tbuff, 0);
2114 
2115       mips_expect ("Bpt ");
2116 
2117       if (!mips_getstring (tbuff, 2))
2118         return 1;
2119       tbuff[2] = '\0'; /* terminate the string */
2120       if (sscanf (tbuff, "%d", &bpnum) != 1)
2121         {
2122           fprintf_unfiltered (stderr, "Invalid decimal breakpoint number from target: %s\n", tbuff);
2123           return 1;
2124         }
2125 
2126       mips_expect (" = ");
2127 
2128       /* Lead in the hex number we are expecting: */
2129       tbuff[0] = '0';
2130       tbuff[1] = 'x';
2131 
2132       /* FIXME!! only 8 bytes!  need to expand for Bfd64;
2133          which targets return 64-bit addresses?  PMON returns only 32! */
2134       if (!mips_getstring (&tbuff[2], 8))
2135         return 1;
2136       tbuff[10] = '\0'; /* terminate the string */
2137 
2138       if (sscanf (tbuff, "0x%08x", &bpaddr) != 1)
2139         {
2140           fprintf_unfiltered (stderr, "Invalid hex address from target: %s\n", tbuff);
2141           return 1;
2142         }
2143 
2144       if (bpnum >= PMON_MAX_BP)
2145         {
2146           fprintf_unfiltered (stderr, "Error: Returned breakpoint number %d outside acceptable range (0..%d)\n",
2147                               bpnum, PMON_MAX_BP - 1);
2148           return 1;
2149         }
2150 
2151       if (bpaddr != addr)
2152         fprintf_unfiltered (stderr, "Warning: Breakpoint addresses do not match: 0x%x != 0x%x\n", addr, bpaddr);
2153 
2154       mips_pmon_bp_info[bpnum] = bpaddr;
2155 
2156       mips_expect ("\015\012");
2157       mips_expect (mips_monitor_prompt);
2158 
2159       mips_enter_debug ();
2160 
2161       return 0;
2162     }
2163 
2164   return mips_store_word (addr, BREAK_INSN, contents_cache);
2165 }
2166 
2167 static int
2168 pmon_remove_breakpoint (addr, contents_cache)
2169      CORE_ADDR addr;
2170      char *contents_cache;
2171 {
2172   if (monitor_supports_breakpoints)
2173     {
2174       int bpnum;
2175       char tbuff[7]; /* enough for delete breakpoint command */
2176 
2177       for (bpnum = 0; bpnum < PMON_MAX_BP; bpnum++)
2178         if (mips_pmon_bp_info[bpnum] == addr)
2179           break;
2180 
2181       if (bpnum >= PMON_MAX_BP)
2182         {
2183           fprintf_unfiltered (stderr, "pmon_remove_breakpoint: Failed to find breakpoint at address 0x%s\n", paddr(addr));
2184           return 1;
2185         }
2186 
2187       if (mips_exit_debug ())
2188         mips_error ("Failed to exit debug mode");
2189 
2190       sprintf (tbuff, "db %02d\015", bpnum);
2191 
2192       mips_send_command (tbuff, -1);
2193       /* NOTE: If the breakpoint does not exist then a "Bpt <dd> not
2194          set" message will be returned. */
2195 
2196       mips_enter_debug ();
2197 
2198       return 0;
2199     }
2200 
2201   return target_write_memory (addr, contents_cache, BREAK_INSN_SIZE);
2202 }
2203 #endif
2204 
2205 /* Compute a don't care mask for the region bounding ADDR and ADDR + LEN - 1.
2206    This is used for memory ref breakpoints.  */
2207 
2208 static unsigned long
2209 calculate_mask (addr, len)
2210      CORE_ADDR addr;
2211      int len;
2212 {
2213   unsigned long mask;
2214   int i;
2215 
2216   mask = addr ^ (addr + len - 1);
2217 
2218   for (i = 32; i >= 0; i--)
2219     if (mask == 0)
2220       break;
2221     else
2222       mask >>= 1;
2223 
2224   mask = (unsigned long) 0xffffffff >> i;
2225 
2226   return mask;
2227 }
2228 
2229 /* Set a data watchpoint.  ADDR and LEN should be obvious.  TYPE is either 1
2230    for a read watchpoint, or 2 for a read/write watchpoint. */
2231 
2232 int
2233 remote_mips_set_watchpoint (addr, len, type)
2234      CORE_ADDR addr;
2235      int len;
2236      int type;
2237 {
2238   CORE_ADDR first_addr;
2239   unsigned long mask;
2240   char *flags;
2241 
2242   mask = calculate_mask (addr, len);
2243 
2244   first_addr = addr & ~mask;
2245 
2246   switch (type)
2247     {
2248     case 0:			/* write */
2249       flags = "w";
2250       break;
2251     case 1:			/* read */
2252       flags = "r";
2253       break;
2254     case 2:			/* read/write */
2255       flags = "rw";
2256       break;
2257     default:
2258       abort ();
2259     }
2260 
2261   if (common_breakpoint ('B', first_addr, mask, flags))
2262     return -1;
2263 
2264   return 0;
2265 }
2266 
2267 int
2268 remote_mips_remove_watchpoint (addr, len, type)
2269      CORE_ADDR addr;
2270      int len;
2271      int type;
2272 {
2273   CORE_ADDR first_addr;
2274   unsigned long mask;
2275 
2276   mask = calculate_mask (addr, len);
2277 
2278   first_addr = addr & ~mask;
2279 
2280   if (common_breakpoint ('b', first_addr, 0, NULL))
2281     return -1;
2282 
2283   return 0;
2284 }
2285 
2286 int
2287 remote_mips_stopped_by_watchpoint ()
2288 {
2289   return hit_watchpoint;
2290 }
2291 
2292 /* This routine generates the a breakpoint command of the form:
2293 
2294    0x0 <CMD> <ADDR> <MASK> <FLAGS>
2295 
2296    Where <CMD> is one of: `B' to set, or `b' to clear a breakpoint.  <ADDR> is
2297    the address of the breakpoint.  <MASK> is a don't care mask for addresses.
2298    <FLAGS> is any combination of `r', `w', or `f' for read/write/or fetch.  */
2299 
2300 static int
2301 common_breakpoint (cmd, addr, mask, flags)
2302      int cmd;
2303      CORE_ADDR addr;
2304      CORE_ADDR mask;
2305      char *flags;
2306 {
2307   int len;
2308   char buf[DATA_MAXLEN + 1];
2309   char rcmd;
2310   int rpid, rerrflg, rresponse;
2311   int nfields;
2312 
2313   if (flags)
2314     sprintf (buf, "0x0 %c 0x%x 0x%x %s", cmd, addr, mask, flags);
2315   else
2316     sprintf (buf, "0x0 %c 0x%x", cmd, addr);
2317 
2318   mips_send_packet (buf, 1);
2319 
2320   len = mips_receive_packet (buf, 1, mips_receive_wait);
2321   buf[len] = '\0';
2322 
2323   nfields = sscanf (buf, "0x%x %c 0x%x 0x%x", &rpid, &rcmd, &rerrflg, &rresponse);
2324 
2325   if (nfields != 4
2326       || rcmd != cmd)
2327     mips_error ("common_breakpoint: Bad response from remote board: %s", buf);
2328 
2329   if (rerrflg != 0)
2330     {
2331       /* Ddb returns "0x0 b 0x16 0x0\000", whereas
2332          Cogent returns "0x0 b 0xffffffff 0x16\000": */
2333       if (mips_monitor == MON_DDB)
2334         rresponse = rerrflg;
2335       if (rresponse != 22) /* invalid argument */
2336 	fprintf_unfiltered (stderr, "common_breakpoint (0x%s):  Got error: 0x%x\n",
2337 			    paddr(addr), rresponse);
2338       return 1;
2339     }
2340 
2341   return 0;
2342 }
2343 
2344 static void
2345 send_srec (srec, len, addr)
2346      char *srec;
2347      int len;
2348      CORE_ADDR addr;
2349 {
2350   while (1)
2351     {
2352       int ch;
2353 
2354       SERIAL_WRITE (mips_desc, srec, len);
2355 
2356       ch = mips_readchar (2);
2357 
2358       switch (ch)
2359 	{
2360 	case SERIAL_TIMEOUT:
2361 	  error ("Timeout during download.");
2362 	  break;
2363 	case 0x6:		/* ACK */
2364 	  return;
2365 	case 0x15:		/* NACK */
2366 	  fprintf_unfiltered (gdb_stderr, "Download got a NACK at byte %d!  Retrying.\n", addr);
2367 	  continue;
2368 	default:
2369 	  error ("Download got unexpected ack char: 0x%x, retrying.\n", ch);
2370 	}
2371     }
2372 }
2373 
2374 /*  Download a binary file by converting it to S records. */
2375 
2376 static void
2377 mips_load_srec (args)
2378      char *args;
2379 {
2380   bfd *abfd;
2381   asection *s;
2382   char *buffer, srec[1024];
2383   int i;
2384   int srec_frame = 200;
2385   int reclen;
2386   static int hashmark = 1;
2387 
2388   buffer = alloca (srec_frame * 2 + 256);
2389 
2390   abfd = bfd_openr (args, 0);
2391   if (!abfd)
2392     {
2393       printf_filtered ("Unable to open file %s\n", args);
2394       return;
2395     }
2396 
2397   if (bfd_check_format (abfd, bfd_object) == 0)
2398     {
2399       printf_filtered ("File is not an object file\n");
2400       return;
2401     }
2402 
2403 /* This actually causes a download in the IDT binary format: */
2404 #define LOAD_CMD "load -b -s tty0\015"
2405   mips_send_command (LOAD_CMD, 0);
2406 
2407   for (s = abfd->sections; s; s = s->next)
2408     {
2409       if (s->flags & SEC_LOAD)
2410 	{
2411 	  int numbytes;
2412 
2413 	  /* FIXME!  vma too small?? */
2414 	  printf_filtered ("%s\t: 0x%4x .. 0x%4x  ", s->name, s->vma,
2415 			   s->vma + s->_raw_size);
2416 	  gdb_flush (gdb_stdout);
2417 
2418 	  for (i = 0; i < s->_raw_size; i += numbytes)
2419 	    {
2420 	      numbytes = min (srec_frame, s->_raw_size - i);
2421 
2422 	      bfd_get_section_contents (abfd, s, buffer, i, numbytes);
2423 
2424 	      reclen = mips_make_srec (srec, '3', s->vma + i, buffer, numbytes);
2425 	      send_srec (srec, reclen, s->vma + i);
2426 
2427 	      if (hashmark)
2428 		{
2429 		  putchar_unfiltered ('#');
2430 		  gdb_flush (gdb_stdout);
2431 		}
2432 
2433 	    } /* Per-packet (or S-record) loop */
2434 
2435 	  putchar_unfiltered ('\n');
2436 	} /* Loadable sections */
2437     }
2438   if (hashmark)
2439     putchar_unfiltered ('\n');
2440 
2441   /* Write a type 7 terminator record. no data for a type 7, and there
2442      is no data, so len is 0.  */
2443 
2444   reclen = mips_make_srec (srec, '7', abfd->start_address, NULL, 0);
2445 
2446   send_srec (srec, reclen, abfd->start_address);
2447 
2448   SERIAL_FLUSH_INPUT (mips_desc);
2449 }
2450 
2451 /*
2452  * mips_make_srec -- make an srecord. This writes each line, one at a
2453  *	time, each with it's own header and trailer line.
2454  *	An srecord looks like this:
2455  *
2456  * byte count-+     address
2457  * start ---+ |        |       data        +- checksum
2458  *	    | |        |                   |
2459  *	  S01000006F6B692D746573742E73726563E4
2460  *	  S315000448600000000000000000FC00005900000000E9
2461  *	  S31A0004000023C1400037DE00F023604000377B009020825000348D
2462  *	  S30B0004485A0000000000004E
2463  *	  S70500040000F6
2464  *
2465  *	S<type><length><address><data><checksum>
2466  *
2467  *      Where
2468  *      - length
2469  *        is the number of bytes following upto the checksum. Note that
2470  *        this is not the number of chars following, since it takes two
2471  *        chars to represent a byte.
2472  *      - type
2473  *        is one of:
2474  *        0) header record
2475  *        1) two byte address data record
2476  *        2) three byte address data record
2477  *        3) four byte address data record
2478  *        7) four byte address termination record
2479  *        8) three byte address termination record
2480  *        9) two byte address termination record
2481  *
2482  *      - address
2483  *        is the start address of the data following, or in the case of
2484  *        a termination record, the start address of the image
2485  *      - data
2486  *        is the data.
2487  *      - checksum
2488  *	  is the sum of all the raw byte data in the record, from the length
2489  *        upwards, modulo 256 and subtracted from 255.
2490  *
2491  * This routine returns the length of the S-record.
2492  *
2493  */
2494 
2495 static int
2496 mips_make_srec (buf, type, memaddr, myaddr, len)
2497      char *buf;
2498      int type;
2499      CORE_ADDR memaddr;
2500      unsigned char *myaddr;
2501      int len;
2502 {
2503   unsigned char checksum;
2504   int i;
2505 
2506   /* Create the header for the srec. addr_size is the number of bytes in the address,
2507      and 1 is the number of bytes in the count.  */
2508 
2509   /* FIXME!! bigger buf required for 64-bit! */
2510   buf[0] = 'S';
2511   buf[1] = type;
2512   buf[2] = len + 4 + 1;		/* len + 4 byte address + 1 byte checksum */
2513   /* This assumes S3 style downloads (4byte addresses). There should
2514      probably be a check, or the code changed to make it more
2515      explicit. */
2516   buf[3] = memaddr >> 24;
2517   buf[4] = memaddr >> 16;
2518   buf[5] = memaddr >> 8;
2519   buf[6] = memaddr;
2520   memcpy (&buf[7], myaddr, len);
2521 
2522   /* Note that the checksum is calculated on the raw data, not the
2523      hexified data.  It includes the length, address and the data
2524      portions of the packet.  */
2525   checksum = 0;
2526   buf += 2;			/* Point at length byte */
2527   for (i = 0; i < len + 4 + 1; i++)
2528     checksum += *buf++;
2529 
2530   *buf = ~checksum;
2531 
2532   return len + 8;
2533 }
2534 
2535 /* The following manifest controls whether we enable the simple flow
2536    control support provided by the monitor. If enabled the code will
2537    wait for an affirmative ACK between transmitting packets. */
2538 #define DOETXACK (1)
2539 
2540 /* The PMON fast-download uses an encoded packet format constructed of
2541    3byte data packets (encoded as 4 printable ASCII characters), and
2542    escape sequences (preceded by a '/'):
2543 
2544 	'K'     clear checksum
2545 	'C'     compare checksum (12bit value, not included in checksum calculation)
2546 	'S'     define symbol name (for addr) terminated with "," and padded to 4char boundary
2547 	'Z'     zero fill multiple of 3bytes
2548 	'B'     byte (12bit encoded value, of 8bit data)
2549 	'A'     address (36bit encoded value)
2550 	'E'     define entry as original address, and exit load
2551 
2552    The packets are processed in 4 character chunks, so the escape
2553    sequences that do not have any data (or variable length data)
2554    should be padded to a 4 character boundary.  The decoder will give
2555    an error if the complete message block size is not a multiple of
2556    4bytes (size of record).
2557 
2558    The encoding of numbers is done in 6bit fields.  The 6bit value is
2559    used to index into this string to get the specific character
2560    encoding for the value: */
2561 static char encoding[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789,.";
2562 
2563 /* Convert the number of bits required into an encoded number, 6bits
2564    at a time (range 0..63).  Keep a checksum if required (passed
2565    pointer non-NULL). The function returns the number of encoded
2566    characters written into the buffer. */
2567 static int
2568 pmon_makeb64 (v, p, n, chksum)
2569      unsigned long v;
2570      char *p;
2571      int n;
2572      int *chksum;
2573 {
2574   int count = (n / 6);
2575 
2576   if ((n % 12) != 0) {
2577     fprintf_unfiltered(stderr,"Fast encoding bitcount must be a multiple of 12bits: %dbit%s\n",n,(n == 1)?"":"s");
2578     return(0);
2579   }
2580   if (n > 36) {
2581     fprintf_unfiltered(stderr,"Fast encoding cannot process more than 36bits at the moment: %dbits\n",n);
2582     return(0);
2583   }
2584 
2585   /* Deal with the checksum: */
2586   if (chksum != NULL) {
2587     switch (n) {
2588      case 36: *chksum += ((v >> 24) & 0xFFF);
2589      case 24: *chksum += ((v >> 12) & 0xFFF);
2590      case 12: *chksum += ((v >>  0) & 0xFFF);
2591     }
2592   }
2593 
2594   do {
2595     n -= 6;
2596     *p++ = encoding[(v >> n) & 0x3F];
2597   } while (n > 0);
2598 
2599   return(count);
2600 }
2601 
2602 /* Shorthand function (that could be in-lined) to output the zero-fill
2603    escape sequence into the data stream. */
2604 static int
2605 pmon_zeroset (recsize, buff, amount, chksum)
2606      int recsize;
2607      char **buff;
2608      int *amount;
2609      unsigned int *chksum;
2610 {
2611   int count;
2612 
2613   sprintf(*buff,"/Z");
2614   count = pmon_makeb64 (*amount, (*buff + 2), 12, chksum);
2615   *buff += (count + 2);
2616   *amount = 0;
2617   return(recsize + count + 2);
2618 }
2619 
2620 static int
2621 pmon_checkset (recsize, buff, value)
2622      int recsize;
2623      char **buff;
2624      int *value;
2625 {
2626   int count;
2627 
2628   /* Add the checksum (without updating the value): */
2629   sprintf (*buff, "/C");
2630   count = pmon_makeb64 (*value, (*buff + 2), 12, NULL);
2631   *buff += (count + 2);
2632   sprintf (*buff, "\015");
2633   *buff += 2; /* include zero terminator */
2634   /* Forcing a checksum validation clears the sum: */
2635   *value = 0;
2636   return(recsize + count + 3);
2637 }
2638 
2639 /* Amount of padding we leave after at the end of the output buffer,
2640    for the checksum and line termination characters: */
2641 #define CHECKSIZE (4 + 4 + 4 + 2)
2642 /* zero-fill, checksum, transfer end and line termination space. */
2643 
2644 /* The amount of binary data loaded from the object file in a single
2645    operation: */
2646 #define BINCHUNK (1024)
2647 
2648 /* Maximum line of data accepted by the monitor: */
2649 #define MAXRECSIZE (550)
2650 /* NOTE: This constant depends on the monitor being used. This value
2651    is for PMON 5.x on the Cogent Vr4300 board. */
2652 
2653 static void
2654 pmon_make_fastrec (outbuf, inbuf, inptr, inamount, recsize, csum, zerofill)
2655      char **outbuf;
2656      unsigned char *inbuf;
2657      int *inptr;
2658      int inamount;
2659      int *recsize;
2660      unsigned int *csum;
2661      unsigned int *zerofill;
2662 {
2663   int count = 0;
2664   char *p = *outbuf;
2665 
2666   /* This is a simple check to ensure that our data will fit within
2667      the maximum allowable record size. Each record output is 4bytes
2668      in length. We must allow space for a pending zero fill command,
2669      the record, and a checksum record. */
2670   while ((*recsize < (MAXRECSIZE - CHECKSIZE)) && ((inamount - *inptr) > 0)) {
2671     /* Process the binary data: */
2672     if ((inamount - *inptr) < 3) {
2673       if (*zerofill != 0)
2674        *recsize = pmon_zeroset (*recsize, &p, zerofill, csum);
2675       sprintf (p, "/B");
2676       count = pmon_makeb64 (inbuf[*inptr], &p[2], 12, csum);
2677       p += (2 + count);
2678       *recsize += (2 + count);
2679       (*inptr)++;
2680     } else {
2681       unsigned int value = ((inbuf[*inptr + 0] << 16) | (inbuf[*inptr + 1] << 8) | inbuf[*inptr + 2]);
2682       /* Simple check for zero data. TODO: A better check would be
2683          to check the last, and then the middle byte for being zero
2684          (if the first byte is not). We could then check for
2685          following runs of zeros, and if above a certain size it is
2686          worth the 4 or 8 character hit of the byte insertions used
2687          to pad to the start of the zeroes. NOTE: This also depends
2688          on the alignment at the end of the zero run. */
2689       if (value == 0x00000000) {
2690         (*zerofill)++;
2691         if (*zerofill == 0xFFF) /* 12bit counter */
2692          *recsize = pmon_zeroset (*recsize, &p, zerofill, csum);
2693       }else {
2694         if (*zerofill != 0)
2695          *recsize = pmon_zeroset (*recsize, &p, zerofill, csum);
2696         count = pmon_makeb64 (value, p, 24, csum);
2697         p += count;
2698         *recsize += count;
2699       }
2700       *inptr += 3;
2701     }
2702   }
2703 
2704   *outbuf = p;
2705   return;
2706 }
2707 
2708 #if defined(DOETXACK)
2709 static int
2710 pmon_check_ack()
2711 {
2712   int c = SERIAL_READCHAR (mips_desc, 2);
2713   if ((c == SERIAL_TIMEOUT) || (c != 0x06)) {
2714     fprintf_unfiltered (gdb_stderr, "Failed to receive valid ACK\n");
2715     return(-1); /* terminate the download */
2716   }
2717   return(0);
2718 }
2719 #endif /* DOETXACK */
2720 
2721 static void
2722 pmon_load_fast (file)
2723      char *file;
2724 {
2725   bfd *abfd;
2726   asection *s;
2727   unsigned char *binbuf;
2728   char *buffer;
2729   int reclen;
2730   unsigned int csum = 0;
2731   static int hashmark = 1;
2732   int bintotal = 0;
2733   int final;
2734   int finished = 0;
2735 
2736   buffer = (char *)xmalloc(MAXRECSIZE + 1);
2737   binbuf = (unsigned char *)xmalloc(BINCHUNK);
2738 
2739   abfd = bfd_openr(file,0);
2740   if (!abfd)
2741    {
2742      printf_filtered ("Unable to open file %s\n",file);
2743      return;
2744    }
2745 
2746   if (bfd_check_format(abfd,bfd_object) == 0)
2747    {
2748      printf_filtered("File is not an object file\n");
2749      return;
2750    }
2751 
2752   /* Setup the required download state: */
2753   mips_send_command ("set dlproto etxack\015", -1);
2754   mips_send_command ("set dlecho off\015", -1);
2755   /* NOTE: We get a "cannot set variable" message if the variable is
2756      already defined to have the argument we give. The code doesn't
2757      care, since it just scans to the next prompt anyway. */
2758   /* Start the download: */
2759   mips_send_command (LOAD_CMD, 0);
2760   mips_expect ("Downloading from tty0, ^C to abort\015\012");
2761 
2762   /* Zero the checksum */
2763   sprintf(buffer,"/Kxx\015");
2764   reclen = strlen(buffer);
2765   SERIAL_WRITE (mips_desc, buffer, reclen);
2766 
2767 #if defined(DOETXACK)
2768   finished = pmon_check_ack();
2769 #endif /* DOETXACK */
2770 
2771   for (s = abfd->sections; s && !finished; s = s->next)
2772    if (s->flags & SEC_LOAD) /* only deal with loadable sections */
2773     {
2774       bintotal += s->_raw_size;
2775       final = (s->vma + s->_raw_size);
2776 
2777       printf_filtered ("%s\t: 0x%4x .. 0x%4x  ", s->name, (unsigned int)s->vma,
2778                        (unsigned int)(s->vma + s->_raw_size));
2779       gdb_flush (gdb_stdout);
2780 
2781       /* Output the starting address */
2782       sprintf(buffer,"/A");
2783       reclen = pmon_makeb64(s->vma,&buffer[2],36,&csum);
2784       buffer[2 + reclen] = '\015';
2785       buffer[3 + reclen] = '\0';
2786       reclen += 3; /* for the initial escape code and carriage return */
2787       SERIAL_WRITE (mips_desc, buffer, reclen);
2788 #if defined(DOETXACK)
2789       finished = pmon_check_ack();
2790 #endif /* DOETXACK */
2791 
2792       if (!finished)
2793        {
2794          int binamount;
2795          unsigned int zerofill = 0;
2796          char *bp = buffer;
2797          int i;
2798 
2799          reclen = 0;
2800 
2801          for (i = 0; ((i < s->_raw_size) && !finished); i += binamount) {
2802            int binptr = 0;
2803 
2804            binamount = min (BINCHUNK, s->_raw_size - i);
2805 
2806            bfd_get_section_contents (abfd, s, binbuf, i, binamount);
2807 
2808            /* This keeps a rolling checksum, until we decide to output
2809               the line: */
2810            for (; ((binamount - binptr) > 0);) {
2811              pmon_make_fastrec (&bp, binbuf, &binptr, binamount, &reclen, &csum, &zerofill);
2812              if (reclen >= (MAXRECSIZE - CHECKSIZE)) {
2813                reclen = pmon_checkset (reclen, &bp, &csum);
2814                SERIAL_WRITE (mips_desc, buffer, reclen);
2815 #if defined(DOETXACK)
2816                finished = pmon_check_ack();
2817                if (finished) {
2818                  zerofill = 0; /* do not transmit pending zerofills */
2819                  break;
2820                }
2821 #endif /* DOETXACK */
2822 
2823                if (hashmark) {
2824                  putchar_unfiltered ('#');
2825                  gdb_flush (gdb_stdout);
2826                }
2827 
2828                bp = buffer;
2829                reclen = 0; /* buffer processed */
2830              }
2831            }
2832          }
2833 
2834          /* Ensure no out-standing zerofill requests: */
2835          if (zerofill != 0)
2836           reclen = pmon_zeroset (reclen, &bp, &zerofill, &csum);
2837 
2838          /* and then flush the line: */
2839          if (reclen > 0) {
2840            reclen = pmon_checkset (reclen, &bp, &csum);
2841            /* Currently pmon_checkset outputs the line terminator by
2842               default, so we write out the buffer so far: */
2843            SERIAL_WRITE (mips_desc, buffer, reclen);
2844 #if defined(DOETXACK)
2845            finished = pmon_check_ack();
2846 #endif /* DOETXACK */
2847          }
2848        }
2849 
2850       if (hashmark)
2851        putchar_unfiltered ('\n');
2852     }
2853 
2854   /* Terminate the transfer. We know that we have an empty output
2855      buffer at this point. */
2856   sprintf (buffer, "/E/E\015"); /* include dummy padding characters */
2857   reclen = strlen (buffer);
2858   SERIAL_WRITE (mips_desc, buffer, reclen);
2859 
2860   if (finished) { /* Ignore the termination message: */
2861     SERIAL_FLUSH_INPUT (mips_desc);
2862   } else { /* Deal with termination message: */
2863     char hexnumber[9]; /* includes '\0' space */
2864     mips_expect ("Entry Address  = ");
2865     sprintf(hexnumber,"%x",final);
2866     mips_expect (hexnumber);
2867 #if defined(DOETXACK)
2868     mips_expect ("\015\012\006\015\012total = 0x");
2869 #else /* normal termination */
2870     mips_expect ("\015\012\015\012total = 0x");
2871 #endif /* !DOETXACK */
2872     sprintf(hexnumber,"%x",bintotal);
2873     mips_expect (hexnumber);
2874     mips_expect (" bytes\015\012");
2875   }
2876 
2877   return;
2878 }
2879 
2880 /* mips_load -- download a file. */
2881 
2882 static void
2883 mips_load (file, from_tty)
2884     char *file;
2885     int  from_tty;
2886 {
2887   /* Get the board out of remote debugging mode.  */
2888   if (mips_exit_debug ())
2889     error ("mips_load:  Couldn't get into monitor mode.");
2890 
2891   if (mips_monitor == MON_PMON || mips_monitor == MON_DDB)
2892    pmon_load_fast (file);
2893   else
2894    mips_load_srec (file);
2895 
2896   mips_initialize ();
2897 
2898   /* Finally, make the PC point at the start address */
2899   if (mips_monitor == MON_DDB)
2900     {
2901       /* Work around problem where DDB monitor does not update the
2902          PC after a load. The following ensures that the write_pc()
2903          WILL update the PC value: */
2904       register_valid[PC_REGNUM] = 0;
2905     }
2906   if (exec_bfd)
2907     write_pc (bfd_get_start_address (exec_bfd));
2908 
2909   inferior_pid = 0;		/* No process now */
2910 
2911 /* This is necessary because many things were based on the PC at the time that
2912    we attached to the monitor, which is no longer valid now that we have loaded
2913    new code (and just changed the PC).  Another way to do this might be to call
2914    normal_stop, except that the stack may not be valid, and things would get
2915    horribly confused... */
2916 
2917   clear_symtab_users ();
2918 }
2919 
2920 /* The target vector.  */
2921 
2922 struct target_ops mips_ops =
2923 {
2924   "mips",			/* to_shortname */
2925   "Remote MIPS debugging over serial line",	/* to_longname */
2926   "\
2927 Debug a board using the MIPS remote debugging protocol over a serial line.\n\
2928 The argument is the device it is connected to or, if it contains a colon,\n\
2929 HOST:PORT to access a board over a network",  /* to_doc */
2930   mips_open,			/* to_open */
2931   mips_close,			/* to_close */
2932   NULL,				/* to_attach */
2933   mips_detach,			/* to_detach */
2934   mips_resume,			/* to_resume */
2935   mips_wait,			/* to_wait */
2936   mips_fetch_registers,		/* to_fetch_registers */
2937   mips_store_registers,		/* to_store_registers */
2938   mips_prepare_to_store,	/* to_prepare_to_store */
2939   mips_xfer_memory,		/* to_xfer_memory */
2940   mips_files_info,		/* to_files_info */
2941   mips_insert_breakpoint,	/* to_insert_breakpoint */
2942   mips_remove_breakpoint,	/* to_remove_breakpoint */
2943   NULL,				/* to_terminal_init */
2944   NULL,				/* to_terminal_inferior */
2945   NULL,				/* to_terminal_ours_for_output */
2946   NULL,				/* to_terminal_ours */
2947   NULL,				/* to_terminal_info */
2948   mips_kill,			/* to_kill */
2949   mips_load,			/* to_load */
2950   NULL,				/* to_lookup_symbol */
2951   mips_create_inferior,		/* to_create_inferior */
2952   mips_mourn_inferior,		/* to_mourn_inferior */
2953   NULL,				/* to_can_run */
2954   NULL,				/* to_notice_signals */
2955   0,				/* to_thread_alive */
2956   0,				/* to_stop */
2957   process_stratum,		/* to_stratum */
2958   NULL,				/* to_next */
2959   1,				/* to_has_all_memory */
2960   1,				/* to_has_memory */
2961   1,				/* to_has_stack */
2962   1,				/* to_has_registers */
2963   1,				/* to_has_execution */
2964   NULL,				/* sections */
2965   NULL,				/* sections_end */
2966   OPS_MAGIC			/* to_magic */
2967 };
2968 
2969 /* An alternative target vector: */
2970 struct target_ops pmon_ops =
2971 {
2972   "pmon",			/* to_shortname */
2973   "Remote MIPS debugging over serial line",	/* to_longname */
2974   "\
2975 Debug a board using the PMON MIPS remote debugging protocol over a serial\n\
2976 line. The argument is the device it is connected to or, if it contains a\n\
2977 colon, HOST:PORT to access a board over a network",  /* to_doc */
2978   pmon_open,			/* to_open */
2979   mips_close,			/* to_close */
2980   NULL,				/* to_attach */
2981   mips_detach,			/* to_detach */
2982   mips_resume,			/* to_resume */
2983   pmon_wait,			/* to_wait */
2984   mips_fetch_registers,		/* to_fetch_registers */
2985   mips_store_registers,		/* to_store_registers */
2986   mips_prepare_to_store,	/* to_prepare_to_store */
2987   mips_xfer_memory,		/* to_xfer_memory */
2988   mips_files_info,		/* to_files_info */
2989   mips_insert_breakpoint,	/* to_insert_breakpoint */
2990   mips_remove_breakpoint,	/* to_remove_breakpoint */
2991   NULL,				/* to_terminal_init */
2992   NULL,				/* to_terminal_inferior */
2993   NULL,				/* to_terminal_ours_for_output */
2994   NULL,				/* to_terminal_ours */
2995   NULL,				/* to_terminal_info */
2996   mips_kill,			/* to_kill */
2997   mips_load,			/* to_load */
2998   NULL,				/* to_lookup_symbol */
2999   mips_create_inferior,		/* to_create_inferior */
3000   mips_mourn_inferior,		/* to_mourn_inferior */
3001   NULL,				/* to_can_run */
3002   NULL,				/* to_notice_signals */
3003   0,				/* to_thread_alive */
3004   0,				/* to_stop */
3005   process_stratum,		/* to_stratum */
3006   NULL,				/* to_next */
3007   1,				/* to_has_all_memory */
3008   1,				/* to_has_memory */
3009   1,				/* to_has_stack */
3010   1,				/* to_has_registers */
3011   1,				/* to_has_execution */
3012   NULL,				/* sections */
3013   NULL,				/* sections_end */
3014   OPS_MAGIC			/* to_magic */
3015 };
3016 
3017 /* Another alternative target vector. This is a PMON system, but with
3018    a different monitor prompt, aswell as some other operational
3019    differences: */
3020 struct target_ops ddb_ops =
3021 {
3022   "ddb",			/* to_shortname */
3023   "Remote MIPS debugging over serial line",	/* to_longname */
3024   "\
3025 Debug a board using the PMON MIPS remote debugging protocol over a serial\n\
3026 line. The argument is the device it is connected to or, if it contains a\n\
3027 colon, HOST:PORT to access a board over a network",  /* to_doc */
3028   ddb_open,			/* to_open */
3029   mips_close,			/* to_close */
3030   NULL,				/* to_attach */
3031   mips_detach,			/* to_detach */
3032   mips_resume,			/* to_resume */
3033   pmon_wait,			/* to_wait */
3034   mips_fetch_registers,		/* to_fetch_registers */
3035   mips_store_registers,		/* to_store_registers */
3036   mips_prepare_to_store,	/* to_prepare_to_store */
3037   mips_xfer_memory,		/* to_xfer_memory */
3038   mips_files_info,		/* to_files_info */
3039   mips_insert_breakpoint,	/* to_insert_breakpoint */
3040   mips_remove_breakpoint,	/* to_remove_breakpoint */
3041   NULL,				/* to_terminal_init */
3042   NULL,				/* to_terminal_inferior */
3043   NULL,				/* to_terminal_ours_for_output */
3044   NULL,				/* to_terminal_ours */
3045   NULL,				/* to_terminal_info */
3046   mips_kill,			/* to_kill */
3047   mips_load,			/* to_load */
3048   NULL,				/* to_lookup_symbol */
3049   mips_create_inferior,		/* to_create_inferior */
3050   mips_mourn_inferior,		/* to_mourn_inferior */
3051   NULL,				/* to_can_run */
3052   NULL,				/* to_notice_signals */
3053   0,				/* to_thread_alive */
3054   0,				/* to_stop */
3055   process_stratum,		/* to_stratum */
3056   NULL,				/* to_next */
3057   1,				/* to_has_all_memory */
3058   1,				/* to_has_memory */
3059   1,				/* to_has_stack */
3060   1,				/* to_has_registers */
3061   1,				/* to_has_execution */
3062   NULL,				/* sections */
3063   NULL,				/* sections_end */
3064   OPS_MAGIC			/* to_magic */
3065 };
3066 
3067 void
3068 _initialize_remote_mips ()
3069 {
3070   add_target (&mips_ops);
3071   add_target (&pmon_ops);
3072   add_target (&ddb_ops);
3073 
3074   add_show_from_set (
3075     add_set_cmd ("timeout", no_class, var_zinteger,
3076 		 (char *) &mips_receive_wait,
3077 		 "Set timeout in seconds for remote MIPS serial I/O.",
3078 		 &setlist),
3079 	&showlist);
3080 
3081   add_show_from_set (
3082     add_set_cmd ("retransmit-timeout", no_class, var_zinteger,
3083 		 (char *) &mips_retransmit_wait,
3084 	 "Set retransmit timeout in seconds for remote MIPS serial I/O.\n\
3085 This is the number of seconds to wait for an acknowledgement to a packet\n\
3086 before resending the packet.", &setlist),
3087 	&showlist);
3088 
3089   add_show_from_set (
3090     add_set_cmd ("syn-garbage-limit", no_class, var_zinteger,
3091 		 (char *) &mips_syn_garbage,
3092 "Set the maximum number of characters to ignore when scanning for a SYN.\n\
3093 This is the maximum number of characters GDB will ignore when trying to\n\
3094 synchronize with the remote system.  A value of -1 means that there is no limit\n\
3095 (Note that these characters are printed out even though they are ignored.)",
3096 		 &setlist),
3097 		     &showlist);
3098 }
3099