1/* Remote debugging interface for MIPS remote debugging protocol.
2
3   Copyright 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001,
4   2002, 2003, 2004 Free Software Foundation, Inc.
5
6   Contributed by Cygnus Support.  Written by Ian Lance Taylor
7   <ian@cygnus.com>.
8
9   This file is part of GDB.
10
11   This program is free software; you can redistribute it and/or modify
12   it under the terms of the GNU General Public License as published by
13   the Free Software Foundation; either version 2 of the License, or
14   (at your option) any later version.
15
16   This program is distributed in the hope that it will be useful,
17   but WITHOUT ANY WARRANTY; without even the implied warranty of
18   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19   GNU General Public License for more details.
20
21   You should have received a copy of the GNU General Public License
22   along with this program; if not, write to the Free Software
23   Foundation, Inc., 59 Temple Place - Suite 330,
24   Boston, MA 02111-1307, USA.  */
25
26#include "defs.h"
27#include "inferior.h"
28#include "bfd.h"
29#include "symfile.h"
30#include "gdbcmd.h"
31#include "gdbcore.h"
32#include "serial.h"
33#include "target.h"
34#include "remote-utils.h"
35#include "gdb_string.h"
36#include "gdb_stat.h"
37#include "regcache.h"
38#include <ctype.h>
39#include "mips-tdep.h"
40
41
42/* Breakpoint types.  Values 0, 1, and 2 must agree with the watch
43   types passed by breakpoint.c to target_insert_watchpoint.
44   Value 3 is our own invention, and is used for ordinary instruction
45   breakpoints.  Value 4 is used to mark an unused watchpoint in tables.  */
46enum break_type
47  {
48    BREAK_WRITE,		/* 0 */
49    BREAK_READ,			/* 1 */
50    BREAK_ACCESS,		/* 2 */
51    BREAK_FETCH,		/* 3 */
52    BREAK_UNUSED		/* 4 */
53  };
54
55/* Prototypes for local functions.  */
56
57static int mips_readchar (int timeout);
58
59static int mips_receive_header (unsigned char *hdr, int *pgarbage,
60				int ch, int timeout);
61
62static int mips_receive_trailer (unsigned char *trlr, int *pgarbage,
63				 int *pch, int timeout);
64
65static int mips_cksum (const unsigned char *hdr,
66		       const unsigned char *data, int len);
67
68static void mips_send_packet (const char *s, int get_ack);
69
70static void mips_send_command (const char *cmd, int prompt);
71
72static int mips_receive_packet (char *buff, int throw_error, int timeout);
73
74static ULONGEST mips_request (int cmd, ULONGEST addr, ULONGEST data,
75			      int *perr, int timeout, char *buff);
76
77static void mips_initialize (void);
78
79static void mips_open (char *name, int from_tty);
80
81static void pmon_open (char *name, int from_tty);
82
83static void ddb_open (char *name, int from_tty);
84
85static void lsi_open (char *name, int from_tty);
86
87static void mips_close (int quitting);
88
89static void mips_detach (char *args, int from_tty);
90
91static void mips_resume (ptid_t ptid, int step,
92                         enum target_signal siggnal);
93
94static ptid_t mips_wait (ptid_t ptid,
95                               struct target_waitstatus *status);
96
97static int mips_map_regno (int regno);
98
99static void mips_fetch_registers (int regno);
100
101static void mips_prepare_to_store (void);
102
103static void mips_store_registers (int regno);
104
105static unsigned int mips_fetch_word (CORE_ADDR addr);
106
107static int mips_store_word (CORE_ADDR addr, unsigned int value,
108			    char *old_contents);
109
110static int mips_xfer_memory (CORE_ADDR memaddr, char *myaddr, int len,
111			     int write,
112			     struct mem_attrib *attrib,
113			     struct target_ops *target);
114
115static void mips_files_info (struct target_ops *ignore);
116
117static void mips_mourn_inferior (void);
118
119static int pmon_makeb64 (unsigned long v, char *p, int n, int *chksum);
120
121static int pmon_zeroset (int recsize, char **buff, int *amount,
122			 unsigned int *chksum);
123
124static int pmon_checkset (int recsize, char **buff, int *value);
125
126static void pmon_make_fastrec (char **outbuf, unsigned char *inbuf,
127			       int *inptr, int inamount, int *recsize,
128			       unsigned int *csum, unsigned int *zerofill);
129
130static int pmon_check_ack (char *mesg);
131
132static void pmon_start_download (void);
133
134static void pmon_end_download (int final, int bintotal);
135
136static void pmon_download (char *buffer, int length);
137
138static void pmon_load_fast (char *file);
139
140static void mips_load (char *file, int from_tty);
141
142static int mips_make_srec (char *buffer, int type, CORE_ADDR memaddr,
143			   unsigned char *myaddr, int len);
144
145static int set_breakpoint (CORE_ADDR addr, int len, enum break_type type);
146
147static int clear_breakpoint (CORE_ADDR addr, int len, enum break_type type);
148
149static int common_breakpoint (int set, CORE_ADDR addr, int len,
150			      enum break_type type);
151
152/* Forward declarations.  */
153extern struct target_ops mips_ops;
154extern struct target_ops pmon_ops;
155extern struct target_ops ddb_ops;
156/* *INDENT-OFF* */
157/* The MIPS remote debugging interface is built on top of a simple
158   packet protocol.  Each packet is organized as follows:
159
160   SYN  The first character is always a SYN (ASCII 026, or ^V).  SYN
161   may not appear anywhere else in the packet.  Any time a SYN is
162   seen, a new packet should be assumed to have begun.
163
164   TYPE_LEN
165   This byte contains the upper five bits of the logical length
166   of the data section, plus a single bit indicating whether this
167   is a data packet or an acknowledgement.  The documentation
168   indicates that this bit is 1 for a data packet, but the actual
169   board uses 1 for an acknowledgement.  The value of the byte is
170   0x40 + (ack ? 0x20 : 0) + (len >> 6)
171   (we always have 0 <= len < 1024).  Acknowledgement packets do
172   not carry data, and must have a data length of 0.
173
174   LEN1 This byte contains the lower six bits of the logical length of
175   the data section.  The value is
176   0x40 + (len & 0x3f)
177
178   SEQ  This byte contains the six bit sequence number of the packet.
179   The value is
180   0x40 + seq
181   An acknowlegment packet contains the sequence number of the
182   packet being acknowledged plus 1 modulo 64.  Data packets are
183   transmitted in sequence.  There may only be one outstanding
184   unacknowledged data packet at a time.  The sequence numbers
185   are independent in each direction.  If an acknowledgement for
186   the previous packet is received (i.e., an acknowledgement with
187   the sequence number of the packet just sent) the packet just
188   sent should be retransmitted.  If no acknowledgement is
189   received within a timeout period, the packet should be
190   retransmitted.  This has an unfortunate failure condition on a
191   high-latency line, as a delayed acknowledgement may lead to an
192   endless series of duplicate packets.
193
194   DATA The actual data bytes follow.  The following characters are
195   escaped inline with DLE (ASCII 020, or ^P):
196   SYN (026)    DLE S
197   DLE (020)    DLE D
198   ^C  (003)    DLE C
199   ^S  (023)    DLE s
200   ^Q  (021)    DLE q
201   The additional DLE characters are not counted in the logical
202   length stored in the TYPE_LEN and LEN1 bytes.
203
204   CSUM1
205   CSUM2
206   CSUM3
207   These bytes contain an 18 bit checksum of the complete
208   contents of the packet excluding the SEQ byte and the
209   CSUM[123] bytes.  The checksum is simply the twos complement
210   addition of all the bytes treated as unsigned characters.  The
211   values of the checksum bytes are:
212   CSUM1: 0x40 + ((cksum >> 12) & 0x3f)
213   CSUM2: 0x40 + ((cksum >> 6) & 0x3f)
214   CSUM3: 0x40 + (cksum & 0x3f)
215
216   It happens that the MIPS remote debugging protocol always
217   communicates with ASCII strings.  Because of this, this
218   implementation doesn't bother to handle the DLE quoting mechanism,
219   since it will never be required.  */
220/* *INDENT-ON* */
221
222
223/* The SYN character which starts each packet.  */
224#define SYN '\026'
225
226/* The 0x40 used to offset each packet (this value ensures that all of
227   the header and trailer bytes, other than SYN, are printable ASCII
228   characters).  */
229#define HDR_OFFSET 0x40
230
231/* The indices of the bytes in the packet header.  */
232#define HDR_INDX_SYN 0
233#define HDR_INDX_TYPE_LEN 1
234#define HDR_INDX_LEN1 2
235#define HDR_INDX_SEQ 3
236#define HDR_LENGTH 4
237
238/* The data/ack bit in the TYPE_LEN header byte.  */
239#define TYPE_LEN_DA_BIT 0x20
240#define TYPE_LEN_DATA 0
241#define TYPE_LEN_ACK TYPE_LEN_DA_BIT
242
243/* How to compute the header bytes.  */
244#define HDR_SET_SYN(data, len, seq) (SYN)
245#define HDR_SET_TYPE_LEN(data, len, seq) \
246  (HDR_OFFSET \
247   + ((data) ? TYPE_LEN_DATA : TYPE_LEN_ACK) \
248   + (((len) >> 6) & 0x1f))
249#define HDR_SET_LEN1(data, len, seq) (HDR_OFFSET + ((len) & 0x3f))
250#define HDR_SET_SEQ(data, len, seq) (HDR_OFFSET + (seq))
251
252/* Check that a header byte is reasonable.  */
253#define HDR_CHECK(ch) (((ch) & HDR_OFFSET) == HDR_OFFSET)
254
255/* Get data from the header.  These macros evaluate their argument
256   multiple times.  */
257#define HDR_IS_DATA(hdr) \
258  (((hdr)[HDR_INDX_TYPE_LEN] & TYPE_LEN_DA_BIT) == TYPE_LEN_DATA)
259#define HDR_GET_LEN(hdr) \
260  ((((hdr)[HDR_INDX_TYPE_LEN] & 0x1f) << 6) + (((hdr)[HDR_INDX_LEN1] & 0x3f)))
261#define HDR_GET_SEQ(hdr) ((unsigned int)(hdr)[HDR_INDX_SEQ] & 0x3f)
262
263/* The maximum data length.  */
264#define DATA_MAXLEN 1023
265
266/* The trailer offset.  */
267#define TRLR_OFFSET HDR_OFFSET
268
269/* The indices of the bytes in the packet trailer.  */
270#define TRLR_INDX_CSUM1 0
271#define TRLR_INDX_CSUM2 1
272#define TRLR_INDX_CSUM3 2
273#define TRLR_LENGTH 3
274
275/* How to compute the trailer bytes.  */
276#define TRLR_SET_CSUM1(cksum) (TRLR_OFFSET + (((cksum) >> 12) & 0x3f))
277#define TRLR_SET_CSUM2(cksum) (TRLR_OFFSET + (((cksum) >>  6) & 0x3f))
278#define TRLR_SET_CSUM3(cksum) (TRLR_OFFSET + (((cksum)      ) & 0x3f))
279
280/* Check that a trailer byte is reasonable.  */
281#define TRLR_CHECK(ch) (((ch) & TRLR_OFFSET) == TRLR_OFFSET)
282
283/* Get data from the trailer.  This evaluates its argument multiple
284   times.  */
285#define TRLR_GET_CKSUM(trlr) \
286  ((((trlr)[TRLR_INDX_CSUM1] & 0x3f) << 12) \
287   + (((trlr)[TRLR_INDX_CSUM2] & 0x3f) <<  6) \
288   + ((trlr)[TRLR_INDX_CSUM3] & 0x3f))
289
290/* The sequence number modulos.  */
291#define SEQ_MODULOS (64)
292
293/* PMON commands to load from the serial port or UDP socket.  */
294#define LOAD_CMD	"load -b -s tty0\r"
295#define LOAD_CMD_UDP	"load -b -s udp\r"
296
297/* The target vectors for the four different remote MIPS targets.
298   These are initialized with code in _initialize_remote_mips instead
299   of static initializers, to make it easier to extend the target_ops
300   vector later.  */
301struct target_ops mips_ops, pmon_ops, ddb_ops, lsi_ops;
302
303enum mips_monitor_type
304  {
305    /* IDT/SIM monitor being used: */
306    MON_IDT,
307    /* PMON monitor being used: */
308    MON_PMON,			/* 3.0.83 [COGENT,EB,FP,NET] Algorithmics Ltd. Nov  9 1995 17:19:50 */
309    MON_DDB,			/* 2.7.473 [DDBVR4300,EL,FP,NET] Risq Modular Systems,  Thu Jun 6 09:28:40 PDT 1996 */
310    MON_LSI,			/* 4.3.12 [EB,FP], LSI LOGIC Corp. Tue Feb 25 13:22:14 1997 */
311    /* Last and unused value, for sizing vectors, etc. */
312    MON_LAST
313  };
314static enum mips_monitor_type mips_monitor = MON_LAST;
315
316/* The monitor prompt text.  If the user sets the PMON prompt
317   to some new value, the GDB `set monitor-prompt' command must also
318   be used to inform GDB about the expected prompt.  Otherwise, GDB
319   will not be able to connect to PMON in mips_initialize().
320   If the `set monitor-prompt' command is not used, the expected
321   default prompt will be set according the target:
322   target               prompt
323   -----                -----
324   pmon         PMON>
325   ddb          NEC010>
326   lsi          PMON>
327 */
328static char *mips_monitor_prompt;
329
330/* Set to 1 if the target is open.  */
331static int mips_is_open;
332
333/* Currently active target description (if mips_is_open == 1) */
334static struct target_ops *current_ops;
335
336/* Set to 1 while the connection is being initialized.  */
337static int mips_initializing;
338
339/* Set to 1 while the connection is being brought down.  */
340static int mips_exiting;
341
342/* The next sequence number to send.  */
343static unsigned int mips_send_seq;
344
345/* The next sequence number we expect to receive.  */
346static unsigned int mips_receive_seq;
347
348/* The time to wait before retransmitting a packet, in seconds.  */
349static int mips_retransmit_wait = 3;
350
351/* The number of times to try retransmitting a packet before giving up.  */
352static int mips_send_retries = 10;
353
354/* The number of garbage characters to accept when looking for an
355   SYN for the next packet.  */
356static int mips_syn_garbage = 10;
357
358/* The time to wait for a packet, in seconds.  */
359static int mips_receive_wait = 5;
360
361/* Set if we have sent a packet to the board but have not yet received
362   a reply.  */
363static int mips_need_reply = 0;
364
365/* Handle used to access serial I/O stream.  */
366static struct serial *mips_desc;
367
368/* UDP handle used to download files to target.  */
369static struct serial *udp_desc;
370static int udp_in_use;
371
372/* TFTP filename used to download files to DDB board, in the form
373   host:filename.  */
374static char *tftp_name;		/* host:filename */
375static char *tftp_localname;	/* filename portion of above */
376static int tftp_in_use;
377static FILE *tftp_file;
378
379/* Counts the number of times the user tried to interrupt the target (usually
380   via ^C.  */
381static int interrupt_count;
382
383/* If non-zero, means that the target is running. */
384static int mips_wait_flag = 0;
385
386/* If non-zero, monitor supports breakpoint commands. */
387static int monitor_supports_breakpoints = 0;
388
389/* Data cache header.  */
390
391#if 0				/* not used (yet?) */
392static DCACHE *mips_dcache;
393#endif
394
395/* Non-zero means that we've just hit a read or write watchpoint */
396static int hit_watchpoint;
397
398/* Table of breakpoints/watchpoints (used only on LSI PMON target).
399   The table is indexed by a breakpoint number, which is an integer
400   from 0 to 255 returned by the LSI PMON when a breakpoint is set.
401 */
402#define MAX_LSI_BREAKPOINTS 256
403struct lsi_breakpoint_info
404  {
405    enum break_type type;	/* type of breakpoint */
406    CORE_ADDR addr;		/* address of breakpoint */
407    int len;			/* length of region being watched */
408    unsigned long value;	/* value to watch */
409  }
410lsi_breakpoints[MAX_LSI_BREAKPOINTS];
411
412/* Error/warning codes returned by LSI PMON for breakpoint commands.
413   Warning values may be ORed together; error values may not.  */
414#define W_WARN	0x100		/* This bit is set if the error code is a warning */
415#define W_MSK   0x101		/* warning: Range feature is supported via mask */
416#define W_VAL   0x102		/* warning: Value check is not supported in hardware */
417#define W_QAL   0x104		/* warning: Requested qualifiers are not supported in hardware */
418
419#define E_ERR	0x200		/* This bit is set if the error code is an error */
420#define E_BPT   0x200		/* error: No such breakpoint number */
421#define E_RGE   0x201		/* error: Range is not supported */
422#define E_QAL   0x202		/* error: The requested qualifiers can not be used */
423#define E_OUT   0x203		/* error: Out of hardware resources */
424#define E_NON   0x204		/* error: Hardware breakpoint not supported */
425
426struct lsi_error
427  {
428    int code;			/* error code */
429    char *string;		/* string associated with this code */
430  };
431
432struct lsi_error lsi_warning_table[] =
433{
434  {W_MSK, "Range feature is supported via mask"},
435  {W_VAL, "Value check is not supported in hardware"},
436  {W_QAL, "Requested qualifiers are not supported in hardware"},
437  {0, NULL}
438};
439
440struct lsi_error lsi_error_table[] =
441{
442  {E_BPT, "No such breakpoint number"},
443  {E_RGE, "Range is not supported"},
444  {E_QAL, "The requested qualifiers can not be used"},
445  {E_OUT, "Out of hardware resources"},
446  {E_NON, "Hardware breakpoint not supported"},
447  {0, NULL}
448};
449
450/* Set to 1 with the 'set monitor-warnings' command to enable printing
451   of warnings returned by PMON when hardware breakpoints are used.  */
452static int monitor_warnings;
453
454
455static void
456close_ports (void)
457{
458  mips_is_open = 0;
459  serial_close (mips_desc);
460
461  if (udp_in_use)
462    {
463      serial_close (udp_desc);
464      udp_in_use = 0;
465    }
466  tftp_in_use = 0;
467}
468
469/* Handle low-level error that we can't recover from.  Note that just
470   error()ing out from target_wait or some such low-level place will cause
471   all hell to break loose--the rest of GDB will tend to get left in an
472   inconsistent state.  */
473
474static NORETURN void
475mips_error (char *string,...)
476{
477  va_list args;
478
479  va_start (args, string);
480
481  target_terminal_ours ();
482  wrap_here ("");		/* Force out any buffered output */
483  gdb_flush (gdb_stdout);
484  if (error_pre_print)
485    fputs_filtered (error_pre_print, gdb_stderr);
486  vfprintf_filtered (gdb_stderr, string, args);
487  fprintf_filtered (gdb_stderr, "\n");
488  va_end (args);
489  gdb_flush (gdb_stderr);
490
491  /* Clean up in such a way that mips_close won't try to talk to the
492     board (it almost surely won't work since we weren't able to talk to
493     it).  */
494  close_ports ();
495
496  printf_unfiltered ("Ending remote MIPS debugging.\n");
497  target_mourn_inferior ();
498
499  throw_exception (RETURN_ERROR);
500}
501
502/* putc_readable - print a character, displaying non-printable chars in
503   ^x notation or in hex.  */
504
505static void
506fputc_readable (int ch, struct ui_file *file)
507{
508  if (ch == '\n')
509    fputc_unfiltered ('\n', file);
510  else if (ch == '\r')
511    fprintf_unfiltered (file, "\\r");
512  else if (ch < 0x20)		/* ASCII control character */
513    fprintf_unfiltered (file, "^%c", ch + '@');
514  else if (ch >= 0x7f)		/* non-ASCII characters (rubout or greater) */
515    fprintf_unfiltered (file, "[%02x]", ch & 0xff);
516  else
517    fputc_unfiltered (ch, file);
518}
519
520
521/* puts_readable - print a string, displaying non-printable chars in
522   ^x notation or in hex.  */
523
524static void
525fputs_readable (const char *string, struct ui_file *file)
526{
527  int c;
528
529  while ((c = *string++) != '\0')
530    fputc_readable (c, file);
531}
532
533
534/* Wait until STRING shows up in mips_desc.  Returns 1 if successful, else 0 if
535   timed out.  TIMEOUT specifies timeout value in seconds.
536 */
537
538static int
539mips_expect_timeout (const char *string, int timeout)
540{
541  const char *p = string;
542
543  if (remote_debug)
544    {
545      fprintf_unfiltered (gdb_stdlog, "Expected \"");
546      fputs_readable (string, gdb_stdlog);
547      fprintf_unfiltered (gdb_stdlog, "\", got \"");
548    }
549
550  immediate_quit++;
551  while (1)
552    {
553      int c;
554
555      /* Must use serial_readchar() here cuz mips_readchar would get
556	 confused if we were waiting for the mips_monitor_prompt... */
557
558      c = serial_readchar (mips_desc, timeout);
559
560      if (c == SERIAL_TIMEOUT)
561	{
562	  if (remote_debug)
563	    fprintf_unfiltered (gdb_stdlog, "\": FAIL\n");
564	  return 0;
565	}
566
567      if (remote_debug)
568	fputc_readable (c, gdb_stdlog);
569
570      if (c == *p++)
571	{
572	  if (*p == '\0')
573	    {
574	      immediate_quit--;
575	      if (remote_debug)
576		fprintf_unfiltered (gdb_stdlog, "\": OK\n");
577	      return 1;
578	    }
579	}
580      else
581	{
582	  p = string;
583	  if (c == *p)
584	    p++;
585	}
586    }
587}
588
589/* Wait until STRING shows up in mips_desc.  Returns 1 if successful, else 0 if
590   timed out.  The timeout value is hard-coded to 2 seconds.  Use
591   mips_expect_timeout if a different timeout value is needed.
592 */
593
594static int
595mips_expect (const char *string)
596{
597  return mips_expect_timeout (string, remote_timeout);
598}
599
600/* Read a character from the remote, aborting on error.  Returns
601   SERIAL_TIMEOUT on timeout (since that's what serial_readchar()
602   returns).  FIXME: If we see the string mips_monitor_prompt from the
603   board, then we are debugging on the main console port, and we have
604   somehow dropped out of remote debugging mode.  In this case, we
605   automatically go back in to remote debugging mode.  This is a hack,
606   put in because I can't find any way for a program running on the
607   remote board to terminate without also ending remote debugging
608   mode.  I assume users won't have any trouble with this; for one
609   thing, the IDT documentation generally assumes that the remote
610   debugging port is not the console port.  This is, however, very
611   convenient for DejaGnu when you only have one connected serial
612   port.  */
613
614static int
615mips_readchar (int timeout)
616{
617  int ch;
618  static int state = 0;
619  int mips_monitor_prompt_len = strlen (mips_monitor_prompt);
620
621  {
622    int i;
623
624    i = timeout;
625    if (i == -1 && watchdog > 0)
626      i = watchdog;
627  }
628
629  if (state == mips_monitor_prompt_len)
630    timeout = 1;
631  ch = serial_readchar (mips_desc, timeout);
632
633  if (ch == SERIAL_TIMEOUT && timeout == -1)	/* Watchdog went off */
634    {
635      target_mourn_inferior ();
636      error ("Watchdog has expired.  Target detached.\n");
637    }
638
639  if (ch == SERIAL_EOF)
640    mips_error ("End of file from remote");
641  if (ch == SERIAL_ERROR)
642    mips_error ("Error reading from remote: %s", safe_strerror (errno));
643  if (remote_debug > 1)
644    {
645      /* Don't use _filtered; we can't deal with a QUIT out of
646         target_wait, and I think this might be called from there.  */
647      if (ch != SERIAL_TIMEOUT)
648	fprintf_unfiltered (gdb_stdlog, "Read '%c' %d 0x%x\n", ch, ch, ch);
649      else
650	fprintf_unfiltered (gdb_stdlog, "Timed out in read\n");
651    }
652
653  /* If we have seen mips_monitor_prompt and we either time out, or
654     we see a @ (which was echoed from a packet we sent), reset the
655     board as described above.  The first character in a packet after
656     the SYN (which is not echoed) is always an @ unless the packet is
657     more than 64 characters long, which ours never are.  */
658  if ((ch == SERIAL_TIMEOUT || ch == '@')
659      && state == mips_monitor_prompt_len
660      && !mips_initializing
661      && !mips_exiting)
662    {
663      if (remote_debug > 0)
664	/* Don't use _filtered; we can't deal with a QUIT out of
665	   target_wait, and I think this might be called from there.  */
666	fprintf_unfiltered (gdb_stdlog, "Reinitializing MIPS debugging mode\n");
667
668      mips_need_reply = 0;
669      mips_initialize ();
670
671      state = 0;
672
673      /* At this point, about the only thing we can do is abort the command
674         in progress and get back to command level as quickly as possible. */
675
676      error ("Remote board reset, debug protocol re-initialized.");
677    }
678
679  if (ch == mips_monitor_prompt[state])
680    ++state;
681  else
682    state = 0;
683
684  return ch;
685}
686
687/* Get a packet header, putting the data in the supplied buffer.
688   PGARBAGE is a pointer to the number of garbage characters received
689   so far.  CH is the last character received.  Returns 0 for success,
690   or -1 for timeout.  */
691
692static int
693mips_receive_header (unsigned char *hdr, int *pgarbage, int ch, int timeout)
694{
695  int i;
696
697  while (1)
698    {
699      /* Wait for a SYN.  mips_syn_garbage is intended to prevent
700         sitting here indefinitely if the board sends us one garbage
701         character per second.  ch may already have a value from the
702         last time through the loop.  */
703      while (ch != SYN)
704	{
705	  ch = mips_readchar (timeout);
706	  if (ch == SERIAL_TIMEOUT)
707	    return -1;
708	  if (ch != SYN)
709	    {
710	      /* Printing the character here lets the user of gdb see
711	         what the program is outputting, if the debugging is
712	         being done on the console port.  Don't use _filtered:
713	         we can't deal with a QUIT out of target_wait and
714	         buffered target output confuses the user. */
715 	      if (!mips_initializing || remote_debug > 0)
716  		{
717		  if (isprint (ch) || isspace (ch))
718		    {
719		      fputc_unfiltered (ch, gdb_stdtarg);
720		    }
721		  else
722		    {
723		      fputc_readable (ch, gdb_stdtarg);
724		    }
725		  gdb_flush (gdb_stdtarg);
726  		}
727
728	      /* Only count unprintable characters. */
729	      if (! (isprint (ch) || isspace (ch)))
730		(*pgarbage) += 1;
731
732	      if (mips_syn_garbage > 0
733		  && *pgarbage > mips_syn_garbage)
734		mips_error ("Debug protocol failure:  more than %d characters before a sync.",
735			    mips_syn_garbage);
736	    }
737	}
738
739      /* Get the packet header following the SYN.  */
740      for (i = 1; i < HDR_LENGTH; i++)
741	{
742	  ch = mips_readchar (timeout);
743	  if (ch == SERIAL_TIMEOUT)
744	    return -1;
745	  /* Make sure this is a header byte.  */
746	  if (ch == SYN || !HDR_CHECK (ch))
747	    break;
748
749	  hdr[i] = ch;
750	}
751
752      /* If we got the complete header, we can return.  Otherwise we
753         loop around and keep looking for SYN.  */
754      if (i >= HDR_LENGTH)
755	return 0;
756    }
757}
758
759/* Get a packet header, putting the data in the supplied buffer.
760   PGARBAGE is a pointer to the number of garbage characters received
761   so far.  The last character read is returned in *PCH.  Returns 0
762   for success, -1 for timeout, -2 for error.  */
763
764static int
765mips_receive_trailer (unsigned char *trlr, int *pgarbage, int *pch, int timeout)
766{
767  int i;
768  int ch;
769
770  for (i = 0; i < TRLR_LENGTH; i++)
771    {
772      ch = mips_readchar (timeout);
773      *pch = ch;
774      if (ch == SERIAL_TIMEOUT)
775	return -1;
776      if (!TRLR_CHECK (ch))
777	return -2;
778      trlr[i] = ch;
779    }
780  return 0;
781}
782
783/* Get the checksum of a packet.  HDR points to the packet header.
784   DATA points to the packet data.  LEN is the length of DATA.  */
785
786static int
787mips_cksum (const unsigned char *hdr, const unsigned char *data, int len)
788{
789  const unsigned char *p;
790  int c;
791  int cksum;
792
793  cksum = 0;
794
795  /* The initial SYN is not included in the checksum.  */
796  c = HDR_LENGTH - 1;
797  p = hdr + 1;
798  while (c-- != 0)
799    cksum += *p++;
800
801  c = len;
802  p = data;
803  while (c-- != 0)
804    cksum += *p++;
805
806  return cksum;
807}
808
809/* Send a packet containing the given ASCII string.  */
810
811static void
812mips_send_packet (const char *s, int get_ack)
813{
814  /* unsigned */ int len;
815  unsigned char *packet;
816  int cksum;
817  int try;
818
819  len = strlen (s);
820  if (len > DATA_MAXLEN)
821    mips_error ("MIPS protocol data packet too long: %s", s);
822
823  packet = (unsigned char *) alloca (HDR_LENGTH + len + TRLR_LENGTH + 1);
824
825  packet[HDR_INDX_SYN] = HDR_SET_SYN (1, len, mips_send_seq);
826  packet[HDR_INDX_TYPE_LEN] = HDR_SET_TYPE_LEN (1, len, mips_send_seq);
827  packet[HDR_INDX_LEN1] = HDR_SET_LEN1 (1, len, mips_send_seq);
828  packet[HDR_INDX_SEQ] = HDR_SET_SEQ (1, len, mips_send_seq);
829
830  memcpy (packet + HDR_LENGTH, s, len);
831
832  cksum = mips_cksum (packet, packet + HDR_LENGTH, len);
833  packet[HDR_LENGTH + len + TRLR_INDX_CSUM1] = TRLR_SET_CSUM1 (cksum);
834  packet[HDR_LENGTH + len + TRLR_INDX_CSUM2] = TRLR_SET_CSUM2 (cksum);
835  packet[HDR_LENGTH + len + TRLR_INDX_CSUM3] = TRLR_SET_CSUM3 (cksum);
836
837  /* Increment the sequence number.  This will set mips_send_seq to
838     the sequence number we expect in the acknowledgement.  */
839  mips_send_seq = (mips_send_seq + 1) % SEQ_MODULOS;
840
841  /* We can only have one outstanding data packet, so we just wait for
842     the acknowledgement here.  Keep retransmitting the packet until
843     we get one, or until we've tried too many times.  */
844  for (try = 0; try < mips_send_retries; try++)
845    {
846      int garbage;
847      int ch;
848
849      if (remote_debug > 0)
850	{
851	  /* Don't use _filtered; we can't deal with a QUIT out of
852	     target_wait, and I think this might be called from there.  */
853	  packet[HDR_LENGTH + len + TRLR_LENGTH] = '\0';
854	  fprintf_unfiltered (gdb_stdlog, "Writing \"%s\"\n", packet + 1);
855	}
856
857      if (serial_write (mips_desc, packet,
858			HDR_LENGTH + len + TRLR_LENGTH) != 0)
859	mips_error ("write to target failed: %s", safe_strerror (errno));
860
861      if (!get_ack)
862	return;
863
864      garbage = 0;
865      ch = 0;
866      while (1)
867	{
868	  unsigned char hdr[HDR_LENGTH + 1];
869	  unsigned char trlr[TRLR_LENGTH + 1];
870	  int err;
871	  unsigned int seq;
872
873	  /* Get the packet header.  If we time out, resend the data
874	     packet.  */
875	  err = mips_receive_header (hdr, &garbage, ch, mips_retransmit_wait);
876	  if (err != 0)
877	    break;
878
879	  ch = 0;
880
881	  /* If we get a data packet, assume it is a duplicate and
882	     ignore it.  FIXME: If the acknowledgement is lost, this
883	     data packet may be the packet the remote sends after the
884	     acknowledgement.  */
885	  if (HDR_IS_DATA (hdr))
886	    {
887	      int i;
888
889	      /* Ignore any errors raised whilst attempting to ignore
890	         packet. */
891
892	      len = HDR_GET_LEN (hdr);
893
894	      for (i = 0; i < len; i++)
895		{
896		  int rch;
897
898		  rch = mips_readchar (remote_timeout);
899		  if (rch == SYN)
900		    {
901		      ch = SYN;
902		      break;
903		    }
904		  if (rch == SERIAL_TIMEOUT)
905		    break;
906		  /* ignore the character */
907		}
908
909	      if (i == len)
910		(void) mips_receive_trailer (trlr, &garbage, &ch,
911					     remote_timeout);
912
913	      /* We don't bother checking the checksum, or providing an
914	         ACK to the packet. */
915	      continue;
916	    }
917
918	  /* If the length is not 0, this is a garbled packet.  */
919	  if (HDR_GET_LEN (hdr) != 0)
920	    continue;
921
922	  /* Get the packet trailer.  */
923	  err = mips_receive_trailer (trlr, &garbage, &ch,
924				      mips_retransmit_wait);
925
926	  /* If we timed out, resend the data packet.  */
927	  if (err == -1)
928	    break;
929
930	  /* If we got a bad character, reread the header.  */
931	  if (err != 0)
932	    continue;
933
934	  /* If the checksum does not match the trailer checksum, this
935	     is a bad packet; ignore it.  */
936	  if (mips_cksum (hdr, (unsigned char *) NULL, 0)
937	      != TRLR_GET_CKSUM (trlr))
938	    continue;
939
940	  if (remote_debug > 0)
941	    {
942	      hdr[HDR_LENGTH] = '\0';
943	      trlr[TRLR_LENGTH] = '\0';
944	      /* Don't use _filtered; we can't deal with a QUIT out of
945	         target_wait, and I think this might be called from there.  */
946	      fprintf_unfiltered (gdb_stdlog, "Got ack %d \"%s%s\"\n",
947				  HDR_GET_SEQ (hdr), hdr + 1, trlr);
948	    }
949
950	  /* If this ack is for the current packet, we're done.  */
951	  seq = HDR_GET_SEQ (hdr);
952	  if (seq == mips_send_seq)
953	    return;
954
955	  /* If this ack is for the last packet, resend the current
956	     packet.  */
957	  if ((seq + 1) % SEQ_MODULOS == mips_send_seq)
958	    break;
959
960	  /* Otherwise this is a bad ack; ignore it.  Increment the
961	     garbage count to ensure that we do not stay in this loop
962	     forever.  */
963	  ++garbage;
964	}
965    }
966
967  mips_error ("Remote did not acknowledge packet");
968}
969
970/* Receive and acknowledge a packet, returning the data in BUFF (which
971   should be DATA_MAXLEN + 1 bytes).  The protocol documentation
972   implies that only the sender retransmits packets, so this code just
973   waits silently for a packet.  It returns the length of the received
974   packet.  If THROW_ERROR is nonzero, call error() on errors.  If not,
975   don't print an error message and return -1.  */
976
977static int
978mips_receive_packet (char *buff, int throw_error, int timeout)
979{
980  int ch;
981  int garbage;
982  int len;
983  unsigned char ack[HDR_LENGTH + TRLR_LENGTH + 1];
984  int cksum;
985
986  ch = 0;
987  garbage = 0;
988  while (1)
989    {
990      unsigned char hdr[HDR_LENGTH];
991      unsigned char trlr[TRLR_LENGTH];
992      int i;
993      int err;
994
995      if (mips_receive_header (hdr, &garbage, ch, timeout) != 0)
996	{
997	  if (throw_error)
998	    mips_error ("Timed out waiting for remote packet");
999	  else
1000	    return -1;
1001	}
1002
1003      ch = 0;
1004
1005      /* An acknowledgement is probably a duplicate; ignore it.  */
1006      if (!HDR_IS_DATA (hdr))
1007	{
1008	  len = HDR_GET_LEN (hdr);
1009	  /* Check if the length is valid for an ACK, we may aswell
1010	     try and read the remainder of the packet: */
1011	  if (len == 0)
1012	    {
1013	      /* Ignore the error condition, since we are going to
1014	         ignore the packet anyway. */
1015	      (void) mips_receive_trailer (trlr, &garbage, &ch, timeout);
1016	    }
1017	  /* Don't use _filtered; we can't deal with a QUIT out of
1018	     target_wait, and I think this might be called from there.  */
1019	  if (remote_debug > 0)
1020	    fprintf_unfiltered (gdb_stdlog, "Ignoring unexpected ACK\n");
1021	  continue;
1022	}
1023
1024      len = HDR_GET_LEN (hdr);
1025      for (i = 0; i < len; i++)
1026	{
1027	  int rch;
1028
1029	  rch = mips_readchar (timeout);
1030	  if (rch == SYN)
1031	    {
1032	      ch = SYN;
1033	      break;
1034	    }
1035	  if (rch == SERIAL_TIMEOUT)
1036	    {
1037	      if (throw_error)
1038		mips_error ("Timed out waiting for remote packet");
1039	      else
1040		return -1;
1041	    }
1042	  buff[i] = rch;
1043	}
1044
1045      if (i < len)
1046	{
1047	  /* Don't use _filtered; we can't deal with a QUIT out of
1048	     target_wait, and I think this might be called from there.  */
1049	  if (remote_debug > 0)
1050	    fprintf_unfiltered (gdb_stdlog,
1051				"Got new SYN after %d chars (wanted %d)\n",
1052				i, len);
1053	  continue;
1054	}
1055
1056      err = mips_receive_trailer (trlr, &garbage, &ch, timeout);
1057      if (err == -1)
1058	{
1059	  if (throw_error)
1060	    mips_error ("Timed out waiting for packet");
1061	  else
1062	    return -1;
1063	}
1064      if (err == -2)
1065	{
1066	  /* Don't use _filtered; we can't deal with a QUIT out of
1067	     target_wait, and I think this might be called from there.  */
1068	  if (remote_debug > 0)
1069	    fprintf_unfiltered (gdb_stdlog, "Got SYN when wanted trailer\n");
1070	  continue;
1071	}
1072
1073      /* If this is the wrong sequence number, ignore it.  */
1074      if (HDR_GET_SEQ (hdr) != mips_receive_seq)
1075	{
1076	  /* Don't use _filtered; we can't deal with a QUIT out of
1077	     target_wait, and I think this might be called from there.  */
1078	  if (remote_debug > 0)
1079	    fprintf_unfiltered (gdb_stdlog,
1080				"Ignoring sequence number %d (want %d)\n",
1081				HDR_GET_SEQ (hdr), mips_receive_seq);
1082	  continue;
1083	}
1084
1085      if (mips_cksum (hdr, buff, len) == TRLR_GET_CKSUM (trlr))
1086	break;
1087
1088      if (remote_debug > 0)
1089	/* Don't use _filtered; we can't deal with a QUIT out of
1090	   target_wait, and I think this might be called from there.  */
1091	printf_unfiltered ("Bad checksum; data %d, trailer %d\n",
1092			   mips_cksum (hdr, buff, len),
1093			   TRLR_GET_CKSUM (trlr));
1094
1095      /* The checksum failed.  Send an acknowledgement for the
1096         previous packet to tell the remote to resend the packet.  */
1097      ack[HDR_INDX_SYN] = HDR_SET_SYN (0, 0, mips_receive_seq);
1098      ack[HDR_INDX_TYPE_LEN] = HDR_SET_TYPE_LEN (0, 0, mips_receive_seq);
1099      ack[HDR_INDX_LEN1] = HDR_SET_LEN1 (0, 0, mips_receive_seq);
1100      ack[HDR_INDX_SEQ] = HDR_SET_SEQ (0, 0, mips_receive_seq);
1101
1102      cksum = mips_cksum (ack, (unsigned char *) NULL, 0);
1103
1104      ack[HDR_LENGTH + TRLR_INDX_CSUM1] = TRLR_SET_CSUM1 (cksum);
1105      ack[HDR_LENGTH + TRLR_INDX_CSUM2] = TRLR_SET_CSUM2 (cksum);
1106      ack[HDR_LENGTH + TRLR_INDX_CSUM3] = TRLR_SET_CSUM3 (cksum);
1107
1108      if (remote_debug > 0)
1109	{
1110	  ack[HDR_LENGTH + TRLR_LENGTH] = '\0';
1111	  /* Don't use _filtered; we can't deal with a QUIT out of
1112	     target_wait, and I think this might be called from there.  */
1113	  printf_unfiltered ("Writing ack %d \"%s\"\n", mips_receive_seq,
1114			     ack + 1);
1115	}
1116
1117      if (serial_write (mips_desc, ack, HDR_LENGTH + TRLR_LENGTH) != 0)
1118	{
1119	  if (throw_error)
1120	    mips_error ("write to target failed: %s", safe_strerror (errno));
1121	  else
1122	    return -1;
1123	}
1124    }
1125
1126  if (remote_debug > 0)
1127    {
1128      buff[len] = '\0';
1129      /* Don't use _filtered; we can't deal with a QUIT out of
1130         target_wait, and I think this might be called from there.  */
1131      printf_unfiltered ("Got packet \"%s\"\n", buff);
1132    }
1133
1134  /* We got the packet.  Send an acknowledgement.  */
1135  mips_receive_seq = (mips_receive_seq + 1) % SEQ_MODULOS;
1136
1137  ack[HDR_INDX_SYN] = HDR_SET_SYN (0, 0, mips_receive_seq);
1138  ack[HDR_INDX_TYPE_LEN] = HDR_SET_TYPE_LEN (0, 0, mips_receive_seq);
1139  ack[HDR_INDX_LEN1] = HDR_SET_LEN1 (0, 0, mips_receive_seq);
1140  ack[HDR_INDX_SEQ] = HDR_SET_SEQ (0, 0, mips_receive_seq);
1141
1142  cksum = mips_cksum (ack, (unsigned char *) NULL, 0);
1143
1144  ack[HDR_LENGTH + TRLR_INDX_CSUM1] = TRLR_SET_CSUM1 (cksum);
1145  ack[HDR_LENGTH + TRLR_INDX_CSUM2] = TRLR_SET_CSUM2 (cksum);
1146  ack[HDR_LENGTH + TRLR_INDX_CSUM3] = TRLR_SET_CSUM3 (cksum);
1147
1148  if (remote_debug > 0)
1149    {
1150      ack[HDR_LENGTH + TRLR_LENGTH] = '\0';
1151      /* Don't use _filtered; we can't deal with a QUIT out of
1152         target_wait, and I think this might be called from there.  */
1153      printf_unfiltered ("Writing ack %d \"%s\"\n", mips_receive_seq,
1154			 ack + 1);
1155    }
1156
1157  if (serial_write (mips_desc, ack, HDR_LENGTH + TRLR_LENGTH) != 0)
1158    {
1159      if (throw_error)
1160	mips_error ("write to target failed: %s", safe_strerror (errno));
1161      else
1162	return -1;
1163    }
1164
1165  return len;
1166}
1167
1168/* Optionally send a request to the remote system and optionally wait
1169   for the reply.  This implements the remote debugging protocol,
1170   which is built on top of the packet protocol defined above.  Each
1171   request has an ADDR argument and a DATA argument.  The following
1172   requests are defined:
1173
1174   \0   don't send a request; just wait for a reply
1175   i    read word from instruction space at ADDR
1176   d    read word from data space at ADDR
1177   I    write DATA to instruction space at ADDR
1178   D    write DATA to data space at ADDR
1179   r    read register number ADDR
1180   R    set register number ADDR to value DATA
1181   c    continue execution (if ADDR != 1, set pc to ADDR)
1182   s    single step (if ADDR != 1, set pc to ADDR)
1183
1184   The read requests return the value requested.  The write requests
1185   return the previous value in the changed location.  The execution
1186   requests return a UNIX wait value (the approximate signal which
1187   caused execution to stop is in the upper eight bits).
1188
1189   If PERR is not NULL, this function waits for a reply.  If an error
1190   occurs, it sets *PERR to 1 and sets errno according to what the
1191   target board reports.  */
1192
1193static ULONGEST
1194mips_request (int cmd,
1195	      ULONGEST addr,
1196	      ULONGEST data,
1197	      int *perr,
1198	      int timeout,
1199	      char *buff)
1200{
1201  char myBuff[DATA_MAXLEN + 1];
1202  int len;
1203  int rpid;
1204  char rcmd;
1205  int rerrflg;
1206  unsigned long rresponse;
1207
1208  if (buff == (char *) NULL)
1209    buff = myBuff;
1210
1211  if (cmd != '\0')
1212    {
1213      if (mips_need_reply)
1214	internal_error (__FILE__, __LINE__,
1215			"mips_request: Trying to send command before reply");
1216      sprintf (buff, "0x0 %c 0x%s 0x%s", cmd, paddr_nz (addr), paddr_nz (data));
1217      mips_send_packet (buff, 1);
1218      mips_need_reply = 1;
1219    }
1220
1221  if (perr == (int *) NULL)
1222    return 0;
1223
1224  if (!mips_need_reply)
1225    internal_error (__FILE__, __LINE__,
1226		    "mips_request: Trying to get reply before command");
1227
1228  mips_need_reply = 0;
1229
1230  len = mips_receive_packet (buff, 1, timeout);
1231  buff[len] = '\0';
1232
1233  if (sscanf (buff, "0x%x %c 0x%x 0x%lx",
1234	      &rpid, &rcmd, &rerrflg, &rresponse) != 4
1235      || (cmd != '\0' && rcmd != cmd))
1236    mips_error ("Bad response from remote board");
1237
1238  if (rerrflg != 0)
1239    {
1240      *perr = 1;
1241
1242      /* FIXME: This will returns MIPS errno numbers, which may or may
1243         not be the same as errno values used on other systems.  If
1244         they stick to common errno values, they will be the same, but
1245         if they don't, they must be translated.  */
1246      errno = rresponse;
1247
1248      return 0;
1249    }
1250
1251  *perr = 0;
1252  return rresponse;
1253}
1254
1255static void
1256mips_initialize_cleanups (void *arg)
1257{
1258  mips_initializing = 0;
1259}
1260
1261static void
1262mips_exit_cleanups (void *arg)
1263{
1264  mips_exiting = 0;
1265}
1266
1267static void
1268mips_send_command (const char *cmd, int prompt)
1269{
1270  serial_write (mips_desc, cmd, strlen (cmd));
1271  mips_expect (cmd);
1272  mips_expect ("\n");
1273  if (prompt)
1274    mips_expect (mips_monitor_prompt);
1275}
1276
1277/* Enter remote (dbx) debug mode: */
1278static void
1279mips_enter_debug (void)
1280{
1281  /* Reset the sequence numbers, ready for the new debug sequence: */
1282  mips_send_seq = 0;
1283  mips_receive_seq = 0;
1284
1285  if (mips_monitor != MON_IDT)
1286    mips_send_command ("debug\r", 0);
1287  else				/* assume IDT monitor by default */
1288    mips_send_command ("db tty0\r", 0);
1289
1290  sleep (1);
1291  serial_write (mips_desc, "\r", sizeof "\r" - 1);
1292
1293  /* We don't need to absorb any spurious characters here, since the
1294     mips_receive_header will eat up a reasonable number of characters
1295     whilst looking for the SYN, however this avoids the "garbage"
1296     being displayed to the user. */
1297  if (mips_monitor != MON_IDT)
1298    mips_expect ("\r");
1299
1300  {
1301    char buff[DATA_MAXLEN + 1];
1302    if (mips_receive_packet (buff, 1, 3) < 0)
1303      mips_error ("Failed to initialize (didn't receive packet).");
1304  }
1305}
1306
1307/* Exit remote (dbx) debug mode, returning to the monitor prompt: */
1308static int
1309mips_exit_debug (void)
1310{
1311  int err;
1312  struct cleanup *old_cleanups = make_cleanup (mips_exit_cleanups, NULL);
1313
1314  mips_exiting = 1;
1315
1316  if (mips_monitor != MON_IDT)
1317    {
1318      /* The DDB (NEC) and MiniRISC (LSI) versions of PMON exit immediately,
1319         so we do not get a reply to this command: */
1320      mips_request ('x', 0, 0, NULL, mips_receive_wait, NULL);
1321      mips_need_reply = 0;
1322      if (!mips_expect (" break!"))
1323	return -1;
1324    }
1325  else
1326    mips_request ('x', 0, 0, &err, mips_receive_wait, NULL);
1327
1328  if (!mips_expect (mips_monitor_prompt))
1329    return -1;
1330
1331  do_cleanups (old_cleanups);
1332
1333  return 0;
1334}
1335
1336/* Initialize a new connection to the MIPS board, and make sure we are
1337   really connected.  */
1338
1339static void
1340mips_initialize (void)
1341{
1342  int err;
1343  struct cleanup *old_cleanups = make_cleanup (mips_initialize_cleanups, NULL);
1344  int j;
1345
1346  /* What is this code doing here?  I don't see any way it can happen, and
1347     it might mean mips_initializing didn't get cleared properly.
1348     So I'll make it a warning.  */
1349
1350  if (mips_initializing)
1351    {
1352      warning ("internal error: mips_initialize called twice");
1353      return;
1354    }
1355
1356  mips_wait_flag = 0;
1357  mips_initializing = 1;
1358
1359  /* At this point, the packit protocol isn't responding.  We'll try getting
1360     into the monitor, and restarting the protocol.  */
1361
1362  /* Force the system into the monitor.  After this we *should* be at
1363     the mips_monitor_prompt.  */
1364  if (mips_monitor != MON_IDT)
1365    j = 0;			/* start by checking if we are already at the prompt */
1366  else
1367    j = 1;			/* start by sending a break */
1368  for (; j <= 4; j++)
1369    {
1370      switch (j)
1371	{
1372	case 0:		/* First, try sending a CR */
1373	  serial_flush_input (mips_desc);
1374	  serial_write (mips_desc, "\r", 1);
1375	  break;
1376	case 1:		/* First, try sending a break */
1377	  serial_send_break (mips_desc);
1378	  break;
1379	case 2:		/* Then, try a ^C */
1380	  serial_write (mips_desc, "\003", 1);
1381	  break;
1382	case 3:		/* Then, try escaping from download */
1383	  {
1384	    if (mips_monitor != MON_IDT)
1385	      {
1386		char tbuff[7];
1387
1388		/* We shouldn't need to send multiple termination
1389		   sequences, since the target performs line (or
1390		   block) reads, and then processes those
1391		   packets. In-case we were downloading a large packet
1392		   we flush the output buffer before inserting a
1393		   termination sequence. */
1394		serial_flush_output (mips_desc);
1395		sprintf (tbuff, "\r/E/E\r");
1396		serial_write (mips_desc, tbuff, 6);
1397	      }
1398	    else
1399	      {
1400		char srec[10];
1401		int i;
1402
1403		/* We are possibly in binary download mode, having
1404		   aborted in the middle of an S-record.  ^C won't
1405		   work because of binary mode.  The only reliable way
1406		   out is to send enough termination packets (8 bytes)
1407		   to fill up and then overflow the largest size
1408		   S-record (255 bytes in this case).  This amounts to
1409		   256/8 + 1 packets.
1410		 */
1411
1412		mips_make_srec (srec, '7', 0, NULL, 0);
1413
1414		for (i = 1; i <= 33; i++)
1415		  {
1416		    serial_write (mips_desc, srec, 8);
1417
1418		    if (serial_readchar (mips_desc, 0) >= 0)
1419		      break;	/* Break immediatly if we get something from
1420				   the board. */
1421		  }
1422	      }
1423	  }
1424	  break;
1425	case 4:
1426	  mips_error ("Failed to initialize.");
1427	}
1428
1429      if (mips_expect (mips_monitor_prompt))
1430	break;
1431    }
1432
1433  if (mips_monitor != MON_IDT)
1434    {
1435      /* Sometimes PMON ignores the first few characters in the first
1436         command sent after a load.  Sending a blank command gets
1437         around that.  */
1438      mips_send_command ("\r", -1);
1439
1440      /* Ensure the correct target state: */
1441      if (mips_monitor != MON_LSI)
1442	mips_send_command ("set regsize 64\r", -1);
1443      mips_send_command ("set hostport tty0\r", -1);
1444      mips_send_command ("set brkcmd \"\"\r", -1);
1445      /* Delete all the current breakpoints: */
1446      mips_send_command ("db *\r", -1);
1447      /* NOTE: PMON does not have breakpoint support through the
1448         "debug" mode, only at the monitor command-line. */
1449    }
1450
1451  mips_enter_debug ();
1452
1453  /* Clear all breakpoints: */
1454  if ((mips_monitor == MON_IDT
1455       && clear_breakpoint (-1, 0, BREAK_UNUSED) == 0)
1456      || mips_monitor == MON_LSI)
1457    monitor_supports_breakpoints = 1;
1458  else
1459    monitor_supports_breakpoints = 0;
1460
1461  do_cleanups (old_cleanups);
1462
1463  /* If this doesn't call error, we have connected; we don't care if
1464     the request itself succeeds or fails.  */
1465
1466  mips_request ('r', 0, 0, &err, mips_receive_wait, NULL);
1467}
1468
1469/* Open a connection to the remote board.  */
1470static void
1471common_open (struct target_ops *ops, char *name, int from_tty,
1472	     enum mips_monitor_type new_monitor,
1473	     const char *new_monitor_prompt)
1474{
1475  char *ptype;
1476  char *serial_port_name;
1477  char *remote_name = 0;
1478  char *local_name = 0;
1479  char **argv;
1480
1481  if (name == 0)
1482    error (
1483	    "To open a MIPS remote debugging connection, you need to specify what serial\n\
1484device is attached to the target board (e.g., /dev/ttya).\n"
1485	    "If you want to use TFTP to download to the board, specify the name of a\n"
1486	    "temporary file to be used by GDB for downloads as the second argument.\n"
1487	    "This filename must be in the form host:filename, where host is the name\n"
1488	    "of the host running the TFTP server, and the file must be readable by the\n"
1489	    "world.  If the local name of the temporary file differs from the name as\n"
1490	    "seen from the board via TFTP, specify that name as the third parameter.\n");
1491
1492  /* Parse the serial port name, the optional TFTP name, and the
1493     optional local TFTP name.  */
1494  if ((argv = buildargv (name)) == NULL)
1495    nomem (0);
1496  make_cleanup_freeargv (argv);
1497
1498  serial_port_name = xstrdup (argv[0]);
1499  if (argv[1])			/* remote TFTP name specified? */
1500    {
1501      remote_name = argv[1];
1502      if (argv[2])		/* local TFTP filename specified? */
1503	local_name = argv[2];
1504    }
1505
1506  target_preopen (from_tty);
1507
1508  if (mips_is_open)
1509    unpush_target (current_ops);
1510
1511  /* Open and initialize the serial port.  */
1512  mips_desc = serial_open (serial_port_name);
1513  if (mips_desc == NULL)
1514    perror_with_name (serial_port_name);
1515
1516  if (baud_rate != -1)
1517    {
1518      if (serial_setbaudrate (mips_desc, baud_rate))
1519	{
1520	  serial_close (mips_desc);
1521	  perror_with_name (serial_port_name);
1522	}
1523    }
1524
1525  serial_raw (mips_desc);
1526
1527  /* Open and initialize the optional download port.  If it is in the form
1528     hostname#portnumber, it's a UDP socket.  If it is in the form
1529     hostname:filename, assume it's the TFTP filename that must be
1530     passed to the DDB board to tell it where to get the load file.  */
1531  if (remote_name)
1532    {
1533      if (strchr (remote_name, '#'))
1534	{
1535	  udp_desc = serial_open (remote_name);
1536	  if (!udp_desc)
1537	    perror_with_name ("Unable to open UDP port");
1538	  udp_in_use = 1;
1539	}
1540      else
1541	{
1542	  /* Save the remote and local names of the TFTP temp file.  If
1543	     the user didn't specify a local name, assume it's the same
1544	     as the part of the remote name after the "host:".  */
1545	  if (tftp_name)
1546	    xfree (tftp_name);
1547	  if (tftp_localname)
1548	    xfree (tftp_localname);
1549	  if (local_name == NULL)
1550	    if ((local_name = strchr (remote_name, ':')) != NULL)
1551	      local_name++;	/* skip over the colon */
1552	  if (local_name == NULL)
1553	    local_name = remote_name;	/* local name same as remote name */
1554	  tftp_name = xstrdup (remote_name);
1555	  tftp_localname = xstrdup (local_name);
1556	  tftp_in_use = 1;
1557	}
1558    }
1559
1560  current_ops = ops;
1561  mips_is_open = 1;
1562
1563  /* Reset the expected monitor prompt if it's never been set before.  */
1564  if (mips_monitor_prompt == NULL)
1565    mips_monitor_prompt = xstrdup (new_monitor_prompt);
1566  mips_monitor = new_monitor;
1567
1568  mips_initialize ();
1569
1570  if (from_tty)
1571    printf_unfiltered ("Remote MIPS debugging using %s\n", serial_port_name);
1572
1573  /* Switch to using remote target now.  */
1574  push_target (ops);
1575
1576  /* FIXME: Should we call start_remote here?  */
1577
1578  /* Try to figure out the processor model if possible.  */
1579  deprecated_mips_set_processor_regs_hack ();
1580
1581  /* This is really the job of start_remote however, that makes an
1582     assumption that the target is about to print out a status message
1583     of some sort.  That doesn't happen here (in fact, it may not be
1584     possible to get the monitor to send the appropriate packet).  */
1585
1586  flush_cached_frames ();
1587  registers_changed ();
1588  stop_pc = read_pc ();
1589  print_stack_frame (get_selected_frame (), 0, SRC_AND_LOC);
1590  xfree (serial_port_name);
1591}
1592
1593static void
1594mips_open (char *name, int from_tty)
1595{
1596  const char *monitor_prompt = NULL;
1597  if (TARGET_ARCHITECTURE != NULL
1598      && TARGET_ARCHITECTURE->arch == bfd_arch_mips)
1599    {
1600    switch (TARGET_ARCHITECTURE->mach)
1601      {
1602      case bfd_mach_mips4100:
1603      case bfd_mach_mips4300:
1604      case bfd_mach_mips4600:
1605      case bfd_mach_mips4650:
1606      case bfd_mach_mips5000:
1607	monitor_prompt = "<RISQ> ";
1608	break;
1609      }
1610    }
1611  if (monitor_prompt == NULL)
1612    monitor_prompt = "<IDT>";
1613  common_open (&mips_ops, name, from_tty, MON_IDT, monitor_prompt);
1614}
1615
1616static void
1617pmon_open (char *name, int from_tty)
1618{
1619  common_open (&pmon_ops, name, from_tty, MON_PMON, "PMON> ");
1620}
1621
1622static void
1623ddb_open (char *name, int from_tty)
1624{
1625  common_open (&ddb_ops, name, from_tty, MON_DDB, "NEC010>");
1626}
1627
1628static void
1629lsi_open (char *name, int from_tty)
1630{
1631  int i;
1632
1633  /* Clear the LSI breakpoint table.  */
1634  for (i = 0; i < MAX_LSI_BREAKPOINTS; i++)
1635    lsi_breakpoints[i].type = BREAK_UNUSED;
1636
1637  common_open (&lsi_ops, name, from_tty, MON_LSI, "PMON> ");
1638}
1639
1640/* Close a connection to the remote board.  */
1641
1642static void
1643mips_close (int quitting)
1644{
1645  if (mips_is_open)
1646    {
1647      /* Get the board out of remote debugging mode.  */
1648      (void) mips_exit_debug ();
1649
1650      close_ports ();
1651    }
1652}
1653
1654/* Detach from the remote board.  */
1655
1656static void
1657mips_detach (char *args, int from_tty)
1658{
1659  if (args)
1660    error ("Argument given to \"detach\" when remotely debugging.");
1661
1662  pop_target ();
1663
1664  mips_close (1);
1665
1666  if (from_tty)
1667    printf_unfiltered ("Ending remote MIPS debugging.\n");
1668}
1669
1670/* Tell the target board to resume.  This does not wait for a reply
1671   from the board, except in the case of single-stepping on LSI boards,
1672   where PMON does return a reply.  */
1673
1674static void
1675mips_resume (ptid_t ptid, int step, enum target_signal siggnal)
1676{
1677  int err;
1678
1679  /* LSI PMON requires returns a reply packet "0x1 s 0x0 0x57f" after
1680     a single step, so we wait for that.  */
1681  mips_request (step ? 's' : 'c', 1, siggnal,
1682		mips_monitor == MON_LSI && step ? &err : (int *) NULL,
1683		mips_receive_wait, NULL);
1684}
1685
1686/* Return the signal corresponding to SIG, where SIG is the number which
1687   the MIPS protocol uses for the signal.  */
1688static enum target_signal
1689mips_signal_from_protocol (int sig)
1690{
1691  /* We allow a few more signals than the IDT board actually returns, on
1692     the theory that there is at least *some* hope that perhaps the numbering
1693     for these signals is widely agreed upon.  */
1694  if (sig <= 0
1695      || sig > 31)
1696    return TARGET_SIGNAL_UNKNOWN;
1697
1698  /* Don't want to use target_signal_from_host because we are converting
1699     from MIPS signal numbers, not host ones.  Our internal numbers
1700     match the MIPS numbers for the signals the board can return, which
1701     are: SIGINT, SIGSEGV, SIGBUS, SIGILL, SIGFPE, SIGTRAP.  */
1702  return (enum target_signal) sig;
1703}
1704
1705/* Wait until the remote stops, and return a wait status.  */
1706
1707static ptid_t
1708mips_wait (ptid_t ptid, struct target_waitstatus *status)
1709{
1710  int rstatus;
1711  int err;
1712  char buff[DATA_MAXLEN];
1713  int rpc, rfp, rsp;
1714  char flags[20];
1715  int nfields;
1716  int i;
1717
1718  interrupt_count = 0;
1719  hit_watchpoint = 0;
1720
1721  /* If we have not sent a single step or continue command, then the
1722     board is waiting for us to do something.  Return a status
1723     indicating that it is stopped.  */
1724  if (!mips_need_reply)
1725    {
1726      status->kind = TARGET_WAITKIND_STOPPED;
1727      status->value.sig = TARGET_SIGNAL_TRAP;
1728      return inferior_ptid;
1729    }
1730
1731  /* No timeout; we sit here as long as the program continues to execute.  */
1732  mips_wait_flag = 1;
1733  rstatus = mips_request ('\000', 0, 0, &err, -1, buff);
1734  mips_wait_flag = 0;
1735  if (err)
1736    mips_error ("Remote failure: %s", safe_strerror (errno));
1737
1738  /* On returning from a continue, the PMON monitor seems to start
1739     echoing back the messages we send prior to sending back the
1740     ACK. The code can cope with this, but to try and avoid the
1741     unnecessary serial traffic, and "spurious" characters displayed
1742     to the user, we cheat and reset the debug protocol. The problems
1743     seems to be caused by a check on the number of arguments, and the
1744     command length, within the monitor causing it to echo the command
1745     as a bad packet. */
1746  if (mips_monitor == MON_PMON)
1747    {
1748      mips_exit_debug ();
1749      mips_enter_debug ();
1750    }
1751
1752  /* See if we got back extended status.  If so, pick out the pc, fp, sp, etc... */
1753
1754  nfields = sscanf (buff, "0x%*x %*c 0x%*x 0x%*x 0x%x 0x%x 0x%x 0x%*x %s",
1755		    &rpc, &rfp, &rsp, flags);
1756  if (nfields >= 3)
1757    {
1758      char buf[MAX_REGISTER_SIZE];
1759
1760      store_unsigned_integer (buf, register_size (current_gdbarch, PC_REGNUM), rpc);
1761      regcache_raw_supply (current_regcache, PC_REGNUM, buf);
1762
1763      store_unsigned_integer (buf, register_size (current_gdbarch, PC_REGNUM), rfp);
1764      regcache_raw_supply (current_regcache, 30, buf);	/* This register they are avoiding and so it is unnamed */
1765
1766      store_unsigned_integer (buf, register_size (current_gdbarch, SP_REGNUM), rsp);
1767      regcache_raw_supply (current_regcache, SP_REGNUM, buf);
1768
1769      store_unsigned_integer (buf, register_size (current_gdbarch, DEPRECATED_FP_REGNUM), 0);
1770      regcache_raw_supply (current_regcache, DEPRECATED_FP_REGNUM, buf);
1771
1772      if (nfields == 9)
1773	{
1774	  int i;
1775
1776	  for (i = 0; i <= 2; i++)
1777	    if (flags[i] == 'r' || flags[i] == 'w')
1778	      hit_watchpoint = 1;
1779	    else if (flags[i] == '\000')
1780	      break;
1781	}
1782    }
1783
1784  if (strcmp (target_shortname, "lsi") == 0)
1785    {
1786#if 0
1787      /* If this is an LSI PMON target, see if we just hit a hardrdware watchpoint.
1788         Right now, PMON doesn't give us enough information to determine which
1789         breakpoint we hit.  So we have to look up the PC in our own table
1790         of breakpoints, and if found, assume it's just a normal instruction
1791         fetch breakpoint, not a data watchpoint.  FIXME when PMON
1792         provides some way to tell us what type of breakpoint it is.  */
1793      int i;
1794      CORE_ADDR pc = read_pc ();
1795
1796      hit_watchpoint = 1;
1797      for (i = 0; i < MAX_LSI_BREAKPOINTS; i++)
1798	{
1799	  if (lsi_breakpoints[i].addr == pc
1800	      && lsi_breakpoints[i].type == BREAK_FETCH)
1801	    {
1802	      hit_watchpoint = 0;
1803	      break;
1804	    }
1805	}
1806#else
1807      /* If a data breakpoint was hit, PMON returns the following packet:
1808         0x1 c 0x0 0x57f 0x1
1809         The return packet from an ordinary breakpoint doesn't have the
1810         extra 0x01 field tacked onto the end.  */
1811      if (nfields == 1 && rpc == 1)
1812	hit_watchpoint = 1;
1813#endif
1814    }
1815
1816  /* NOTE: The following (sig) numbers are defined by PMON:
1817     SPP_SIGTRAP     5       breakpoint
1818     SPP_SIGINT      2
1819     SPP_SIGSEGV     11
1820     SPP_SIGBUS      10
1821     SPP_SIGILL      4
1822     SPP_SIGFPE      8
1823     SPP_SIGTERM     15 */
1824
1825  /* Translate a MIPS waitstatus.  We use constants here rather than WTERMSIG
1826     and so on, because the constants we want here are determined by the
1827     MIPS protocol and have nothing to do with what host we are running on.  */
1828  if ((rstatus & 0xff) == 0)
1829    {
1830      status->kind = TARGET_WAITKIND_EXITED;
1831      status->value.integer = (((rstatus) >> 8) & 0xff);
1832    }
1833  else if ((rstatus & 0xff) == 0x7f)
1834    {
1835      status->kind = TARGET_WAITKIND_STOPPED;
1836      status->value.sig = mips_signal_from_protocol (((rstatus) >> 8) & 0xff);
1837
1838      /* If the stop PC is in the _exit function, assume
1839         we hit the 'break 0x3ff' instruction in _exit, so this
1840         is not a normal breakpoint.  */
1841      if (strcmp (target_shortname, "lsi") == 0)
1842	{
1843	  char *func_name;
1844	  CORE_ADDR func_start;
1845	  CORE_ADDR pc = read_pc ();
1846
1847	  find_pc_partial_function (pc, &func_name, &func_start, NULL);
1848	  if (func_name != NULL && strcmp (func_name, "_exit") == 0
1849	      && func_start == pc)
1850	    status->kind = TARGET_WAITKIND_EXITED;
1851	}
1852    }
1853  else
1854    {
1855      status->kind = TARGET_WAITKIND_SIGNALLED;
1856      status->value.sig = mips_signal_from_protocol (rstatus & 0x7f);
1857    }
1858
1859  return inferior_ptid;
1860}
1861
1862/* We have to map between the register numbers used by gdb and the
1863   register numbers used by the debugging protocol.  This function
1864   assumes that we are using tm-mips.h.  */
1865
1866#define REGNO_OFFSET 96
1867
1868static int
1869mips_map_regno (int regno)
1870{
1871  if (regno < 32)
1872    return regno;
1873  if (regno >= mips_regnum (current_gdbarch)->fp0
1874      && regno < mips_regnum (current_gdbarch)->fp0 + 32)
1875    return regno - mips_regnum (current_gdbarch)->fp0 + 32;
1876  else if (regno == mips_regnum (current_gdbarch)->pc)
1877    return REGNO_OFFSET + 0;
1878  else if (regno == mips_regnum (current_gdbarch)->cause)
1879    return REGNO_OFFSET + 1;
1880  else if (regno == mips_regnum (current_gdbarch)->hi)
1881    return REGNO_OFFSET + 2;
1882  else if (regno == mips_regnum (current_gdbarch)->lo)
1883    return REGNO_OFFSET + 3;
1884  else if (regno == mips_regnum (current_gdbarch)->fp_control_status)
1885    return REGNO_OFFSET + 4;
1886  else if (regno == mips_regnum (current_gdbarch)->fp_implementation_revision)
1887    return REGNO_OFFSET + 5;
1888  else
1889    /* FIXME: Is there a way to get the status register?  */
1890    return 0;
1891}
1892
1893/* Fetch the remote registers.  */
1894
1895static void
1896mips_fetch_registers (int regno)
1897{
1898  unsigned LONGEST val;
1899  int err;
1900
1901  if (regno == -1)
1902    {
1903      for (regno = 0; regno < NUM_REGS; regno++)
1904	mips_fetch_registers (regno);
1905      return;
1906    }
1907
1908  if (regno == DEPRECATED_FP_REGNUM || regno == ZERO_REGNUM)
1909    /* DEPRECATED_FP_REGNUM on the mips is a hack which is just
1910       supposed to read zero (see also mips-nat.c).  */
1911    val = 0;
1912  else
1913    {
1914      /* If PMON doesn't support this register, don't waste serial
1915         bandwidth trying to read it.  */
1916      int pmon_reg = mips_map_regno (regno);
1917      if (regno != 0 && pmon_reg == 0)
1918	val = 0;
1919      else
1920	{
1921	  /* Unfortunately the PMON version in the Vr4300 board has been
1922	     compiled without the 64bit register access commands. This
1923	     means we cannot get hold of the full register width. */
1924	  if (mips_monitor == MON_DDB)
1925	    val = (unsigned) mips_request ('t', pmon_reg, 0,
1926					   &err, mips_receive_wait, NULL);
1927	  else
1928	    val = mips_request ('r', pmon_reg, 0,
1929				&err, mips_receive_wait, NULL);
1930	  if (err)
1931	    mips_error ("Can't read register %d: %s", regno,
1932			safe_strerror (errno));
1933	}
1934    }
1935
1936  {
1937    char buf[MAX_REGISTER_SIZE];
1938
1939    /* We got the number the register holds, but gdb expects to see a
1940       value in the target byte ordering.  */
1941    store_unsigned_integer (buf, register_size (current_gdbarch, regno), val);
1942    regcache_raw_supply (current_regcache, regno, buf);
1943  }
1944}
1945
1946/* Prepare to store registers.  The MIPS protocol can store individual
1947   registers, so this function doesn't have to do anything.  */
1948
1949static void
1950mips_prepare_to_store (void)
1951{
1952}
1953
1954/* Store remote register(s).  */
1955
1956static void
1957mips_store_registers (int regno)
1958{
1959  int err;
1960
1961  if (regno == -1)
1962    {
1963      for (regno = 0; regno < NUM_REGS; regno++)
1964	mips_store_registers (regno);
1965      return;
1966    }
1967
1968  mips_request ('R', mips_map_regno (regno),
1969		read_register (regno),
1970		&err, mips_receive_wait, NULL);
1971  if (err)
1972    mips_error ("Can't write register %d: %s", regno, safe_strerror (errno));
1973}
1974
1975/* Fetch a word from the target board.  */
1976
1977static unsigned int
1978mips_fetch_word (CORE_ADDR addr)
1979{
1980  unsigned int val;
1981  int err;
1982
1983  val = mips_request ('d', addr, 0, &err, mips_receive_wait, NULL);
1984  if (err)
1985    {
1986      /* Data space failed; try instruction space.  */
1987      val = mips_request ('i', addr, 0, &err,
1988			  mips_receive_wait, NULL);
1989      if (err)
1990	mips_error ("Can't read address 0x%s: %s",
1991		    paddr_nz (addr), safe_strerror (errno));
1992    }
1993  return val;
1994}
1995
1996/* Store a word to the target board.  Returns errno code or zero for
1997   success.  If OLD_CONTENTS is non-NULL, put the old contents of that
1998   memory location there.  */
1999
2000/* FIXME! make sure only 32-bit quantities get stored! */
2001static int
2002mips_store_word (CORE_ADDR addr, unsigned int val, char *old_contents)
2003{
2004  int err;
2005  unsigned int oldcontents;
2006
2007  oldcontents = mips_request ('D', addr, val, &err,
2008			      mips_receive_wait, NULL);
2009  if (err)
2010    {
2011      /* Data space failed; try instruction space.  */
2012      oldcontents = mips_request ('I', addr, val, &err,
2013				  mips_receive_wait, NULL);
2014      if (err)
2015	return errno;
2016    }
2017  if (old_contents != NULL)
2018    store_unsigned_integer (old_contents, 4, oldcontents);
2019  return 0;
2020}
2021
2022/* Read or write LEN bytes from inferior memory at MEMADDR,
2023   transferring to or from debugger address MYADDR.  Write to inferior
2024   if SHOULD_WRITE is nonzero.  Returns length of data written or
2025   read; 0 for error.  Note that protocol gives us the correct value
2026   for a longword, since it transfers values in ASCII.  We want the
2027   byte values, so we have to swap the longword values.  */
2028
2029static int mask_address_p = 1;
2030
2031static int
2032mips_xfer_memory (CORE_ADDR memaddr, char *myaddr, int len, int write,
2033		  struct mem_attrib *attrib, struct target_ops *target)
2034{
2035  int i;
2036  CORE_ADDR addr;
2037  int count;
2038  char *buffer;
2039  int status;
2040
2041  /* PMON targets do not cope well with 64 bit addresses.  Mask the
2042     value down to 32 bits. */
2043  if (mask_address_p)
2044    memaddr &= (CORE_ADDR) 0xffffffff;
2045
2046  /* Round starting address down to longword boundary.  */
2047  addr = memaddr & ~3;
2048  /* Round ending address up; get number of longwords that makes.  */
2049  count = (((memaddr + len) - addr) + 3) / 4;
2050  /* Allocate buffer of that many longwords.  */
2051  buffer = alloca (count * 4);
2052
2053  if (write)
2054    {
2055      /* Fill start and end extra bytes of buffer with existing data.  */
2056      if (addr != memaddr || len < 4)
2057	{
2058	  /* Need part of initial word -- fetch it.  */
2059	  store_unsigned_integer (&buffer[0], 4, mips_fetch_word (addr));
2060	}
2061
2062      if (count > 1)
2063	{
2064	  /* Need part of last word -- fetch it.  FIXME: we do this even
2065	     if we don't need it.  */
2066	  store_unsigned_integer (&buffer[(count - 1) * 4], 4,
2067				  mips_fetch_word (addr + (count - 1) * 4));
2068	}
2069
2070      /* Copy data to be written over corresponding part of buffer */
2071
2072      memcpy ((char *) buffer + (memaddr & 3), myaddr, len);
2073
2074      /* Write the entire buffer.  */
2075
2076      for (i = 0; i < count; i++, addr += 4)
2077	{
2078	  status = mips_store_word (addr,
2079			       extract_unsigned_integer (&buffer[i * 4], 4),
2080				    NULL);
2081	  /* Report each kilobyte (we download 32-bit words at a time) */
2082	  if (i % 256 == 255)
2083	    {
2084	      printf_unfiltered ("*");
2085	      gdb_flush (gdb_stdout);
2086	    }
2087	  if (status)
2088	    {
2089	      errno = status;
2090	      return 0;
2091	    }
2092	  /* FIXME: Do we want a QUIT here?  */
2093	}
2094      if (count >= 256)
2095	printf_unfiltered ("\n");
2096    }
2097  else
2098    {
2099      /* Read all the longwords */
2100      for (i = 0; i < count; i++, addr += 4)
2101	{
2102	  store_unsigned_integer (&buffer[i * 4], 4, mips_fetch_word (addr));
2103	  QUIT;
2104	}
2105
2106      /* Copy appropriate bytes out of the buffer.  */
2107      memcpy (myaddr, buffer + (memaddr & 3), len);
2108    }
2109  return len;
2110}
2111
2112/* Print info on this target.  */
2113
2114static void
2115mips_files_info (struct target_ops *ignore)
2116{
2117  printf_unfiltered ("Debugging a MIPS board over a serial line.\n");
2118}
2119
2120/* Kill the process running on the board.  This will actually only
2121   work if we are doing remote debugging over the console input.  I
2122   think that if IDT/sim had the remote debug interrupt enabled on the
2123   right port, we could interrupt the process with a break signal.  */
2124
2125static void
2126mips_kill (void)
2127{
2128  if (!mips_wait_flag)
2129    return;
2130
2131  interrupt_count++;
2132
2133  if (interrupt_count >= 2)
2134    {
2135      interrupt_count = 0;
2136
2137      target_terminal_ours ();
2138
2139      if (query ("Interrupted while waiting for the program.\n\
2140Give up (and stop debugging it)? "))
2141	{
2142	  /* Clean up in such a way that mips_close won't try to talk to the
2143	     board (it almost surely won't work since we weren't able to talk to
2144	     it).  */
2145	  mips_wait_flag = 0;
2146	  close_ports ();
2147
2148	  printf_unfiltered ("Ending remote MIPS debugging.\n");
2149	  target_mourn_inferior ();
2150
2151	  throw_exception (RETURN_QUIT);
2152	}
2153
2154      target_terminal_inferior ();
2155    }
2156
2157  if (remote_debug > 0)
2158    printf_unfiltered ("Sending break\n");
2159
2160  serial_send_break (mips_desc);
2161
2162#if 0
2163  if (mips_is_open)
2164    {
2165      char cc;
2166
2167      /* Send a ^C.  */
2168      cc = '\003';
2169      serial_write (mips_desc, &cc, 1);
2170      sleep (1);
2171      target_mourn_inferior ();
2172    }
2173#endif
2174}
2175
2176/* Start running on the target board.  */
2177
2178static void
2179mips_create_inferior (char *execfile, char *args, char **env, int from_tty)
2180{
2181  CORE_ADDR entry_pt;
2182
2183  if (args && *args)
2184    {
2185      warning ("\
2186Can't pass arguments to remote MIPS board; arguments ignored.");
2187      /* And don't try to use them on the next "run" command.  */
2188      execute_command ("set args", 0);
2189    }
2190
2191  if (execfile == 0 || exec_bfd == 0)
2192    error ("No executable file specified");
2193
2194  entry_pt = (CORE_ADDR) bfd_get_start_address (exec_bfd);
2195
2196  init_wait_for_inferior ();
2197
2198  /* FIXME: Should we set inferior_ptid here?  */
2199
2200  proceed (entry_pt, TARGET_SIGNAL_DEFAULT, 0);
2201}
2202
2203/* Clean up after a process.  Actually nothing to do.  */
2204
2205static void
2206mips_mourn_inferior (void)
2207{
2208  if (current_ops != NULL)
2209    unpush_target (current_ops);
2210  generic_mourn_inferior ();
2211}
2212
2213/* We can write a breakpoint and read the shadow contents in one
2214   operation.  */
2215
2216/* Insert a breakpoint.  On targets that don't have built-in
2217   breakpoint support, we read the contents of the target location and
2218   stash it, then overwrite it with a breakpoint instruction.  ADDR is
2219   the target location in the target machine.  CONTENTS_CACHE is a
2220   pointer to memory allocated for saving the target contents.  It is
2221   guaranteed by the caller to be long enough to save the breakpoint
2222   length returned by BREAKPOINT_FROM_PC.  */
2223
2224static int
2225mips_insert_breakpoint (CORE_ADDR addr, char *contents_cache)
2226{
2227  if (monitor_supports_breakpoints)
2228    return set_breakpoint (addr, MIPS_INSTLEN, BREAK_FETCH);
2229  else
2230    return memory_insert_breakpoint (addr, contents_cache);
2231}
2232
2233static int
2234mips_remove_breakpoint (CORE_ADDR addr, char *contents_cache)
2235{
2236  if (monitor_supports_breakpoints)
2237    return clear_breakpoint (addr, MIPS_INSTLEN, BREAK_FETCH);
2238  else
2239    return memory_remove_breakpoint (addr, contents_cache);
2240}
2241
2242/* Tell whether this target can support a hardware breakpoint.  CNT
2243   is the number of hardware breakpoints already installed.  This
2244   implements the TARGET_CAN_USE_HARDWARE_WATCHPOINT macro.  */
2245
2246int
2247mips_can_use_watchpoint (int type, int cnt, int othertype)
2248{
2249  return cnt < MAX_LSI_BREAKPOINTS && strcmp (target_shortname, "lsi") == 0;
2250}
2251
2252
2253/* Compute a don't care mask for the region bounding ADDR and ADDR + LEN - 1.
2254   This is used for memory ref breakpoints.  */
2255
2256static unsigned long
2257calculate_mask (CORE_ADDR addr, int len)
2258{
2259  unsigned long mask;
2260  int i;
2261
2262  mask = addr ^ (addr + len - 1);
2263
2264  for (i = 32; i >= 0; i--)
2265    if (mask == 0)
2266      break;
2267    else
2268      mask >>= 1;
2269
2270  mask = (unsigned long) 0xffffffff >> i;
2271
2272  return mask;
2273}
2274
2275
2276/* Set a data watchpoint.  ADDR and LEN should be obvious.  TYPE is 0
2277   for a write watchpoint, 1 for a read watchpoint, or 2 for a read/write
2278   watchpoint. */
2279
2280int
2281mips_insert_watchpoint (CORE_ADDR addr, int len, int type)
2282{
2283  if (set_breakpoint (addr, len, type))
2284    return -1;
2285
2286  return 0;
2287}
2288
2289int
2290mips_remove_watchpoint (CORE_ADDR addr, int len, int type)
2291{
2292  if (clear_breakpoint (addr, len, type))
2293    return -1;
2294
2295  return 0;
2296}
2297
2298int
2299mips_stopped_by_watchpoint (void)
2300{
2301  return hit_watchpoint;
2302}
2303
2304
2305/* Insert a breakpoint.  */
2306
2307static int
2308set_breakpoint (CORE_ADDR addr, int len, enum break_type type)
2309{
2310  return common_breakpoint (1, addr, len, type);
2311}
2312
2313
2314/* Clear a breakpoint.  */
2315
2316static int
2317clear_breakpoint (CORE_ADDR addr, int len, enum break_type type)
2318{
2319  return common_breakpoint (0, addr, len, type);
2320}
2321
2322
2323/* Check the error code from the return packet for an LSI breakpoint
2324   command.  If there's no error, just return 0.  If it's a warning,
2325   print the warning text and return 0.  If it's an error, print
2326   the error text and return 1.  <ADDR> is the address of the breakpoint
2327   that was being set.  <RERRFLG> is the error code returned by PMON.
2328   This is a helper function for common_breakpoint.  */
2329
2330static int
2331check_lsi_error (CORE_ADDR addr, int rerrflg)
2332{
2333  struct lsi_error *err;
2334  char *saddr = paddr_nz (addr);	/* printable address string */
2335
2336  if (rerrflg == 0)		/* no error */
2337    return 0;
2338
2339  /* Warnings can be ORed together, so check them all.  */
2340  if (rerrflg & W_WARN)
2341    {
2342      if (monitor_warnings)
2343	{
2344	  int found = 0;
2345	  for (err = lsi_warning_table; err->code != 0; err++)
2346	    {
2347	      if ((err->code & rerrflg) == err->code)
2348		{
2349		  found = 1;
2350		  fprintf_unfiltered (gdb_stderr,
2351				  "common_breakpoint (0x%s): Warning: %s\n",
2352				      saddr,
2353				      err->string);
2354		}
2355	    }
2356	  if (!found)
2357	    fprintf_unfiltered (gdb_stderr,
2358			"common_breakpoint (0x%s): Unknown warning: 0x%x\n",
2359				saddr,
2360				rerrflg);
2361	}
2362      return 0;
2363    }
2364
2365  /* Errors are unique, i.e. can't be ORed together.  */
2366  for (err = lsi_error_table; err->code != 0; err++)
2367    {
2368      if ((err->code & rerrflg) == err->code)
2369	{
2370	  fprintf_unfiltered (gdb_stderr,
2371			      "common_breakpoint (0x%s): Error: %s\n",
2372			      saddr,
2373			      err->string);
2374	  return 1;
2375	}
2376    }
2377  fprintf_unfiltered (gdb_stderr,
2378		      "common_breakpoint (0x%s): Unknown error: 0x%x\n",
2379		      saddr,
2380		      rerrflg);
2381  return 1;
2382}
2383
2384
2385/* This routine sends a breakpoint command to the remote target.
2386
2387   <SET> is 1 if setting a breakpoint, or 0 if clearing a breakpoint.
2388   <ADDR> is the address of the breakpoint.
2389   <LEN> the length of the region to break on.
2390   <TYPE> is the type of breakpoint:
2391   0 = write                    (BREAK_WRITE)
2392   1 = read                     (BREAK_READ)
2393   2 = read/write               (BREAK_ACCESS)
2394   3 = instruction fetch        (BREAK_FETCH)
2395
2396   Return 0 if successful; otherwise 1.  */
2397
2398static int
2399common_breakpoint (int set, CORE_ADDR addr, int len, enum break_type type)
2400{
2401  char buf[DATA_MAXLEN + 1];
2402  char cmd, rcmd;
2403  int rpid, rerrflg, rresponse, rlen;
2404  int nfields;
2405
2406  addr = ADDR_BITS_REMOVE (addr);
2407
2408  if (mips_monitor == MON_LSI)
2409    {
2410      if (set == 0)		/* clear breakpoint */
2411	{
2412	  /* The LSI PMON "clear breakpoint" has this form:
2413	     <pid> 'b' <bptn> 0x0
2414	     reply:
2415	     <pid> 'b' 0x0 <code>
2416
2417	     <bptn> is a breakpoint number returned by an earlier 'B' command.
2418	     Possible return codes: OK, E_BPT.  */
2419
2420	  int i;
2421
2422	  /* Search for the breakpoint in the table.  */
2423	  for (i = 0; i < MAX_LSI_BREAKPOINTS; i++)
2424	    if (lsi_breakpoints[i].type == type
2425		&& lsi_breakpoints[i].addr == addr
2426		&& lsi_breakpoints[i].len == len)
2427	      break;
2428
2429	  /* Clear the table entry and tell PMON to clear the breakpoint.  */
2430	  if (i == MAX_LSI_BREAKPOINTS)
2431	    {
2432	      warning ("common_breakpoint: Attempt to clear bogus breakpoint at %s\n",
2433		       paddr_nz (addr));
2434	      return 1;
2435	    }
2436
2437	  lsi_breakpoints[i].type = BREAK_UNUSED;
2438	  sprintf (buf, "0x0 b 0x%x 0x0", i);
2439	  mips_send_packet (buf, 1);
2440
2441	  rlen = mips_receive_packet (buf, 1, mips_receive_wait);
2442	  buf[rlen] = '\0';
2443
2444	  nfields = sscanf (buf, "0x%x b 0x0 0x%x", &rpid, &rerrflg);
2445	  if (nfields != 2)
2446	    mips_error ("common_breakpoint: Bad response from remote board: %s", buf);
2447
2448	  return (check_lsi_error (addr, rerrflg));
2449	}
2450      else
2451	/* set a breakpoint */
2452	{
2453	  /* The LSI PMON "set breakpoint" command has this form:
2454	     <pid> 'B' <addr> 0x0
2455	     reply:
2456	     <pid> 'B' <bptn> <code>
2457
2458	     The "set data breakpoint" command has this form:
2459
2460	     <pid> 'A' <addr1> <type> [<addr2>  [<value>]]
2461
2462	     where: type= "0x1" = read
2463	     "0x2" = write
2464	     "0x3" = access (read or write)
2465
2466	     The reply returns two values:
2467	     bptn - a breakpoint number, which is a small integer with
2468	     possible values of zero through 255.
2469	     code - an error return code, a value of zero indicates a
2470	     succesful completion, other values indicate various
2471	     errors and warnings.
2472
2473	     Possible return codes: OK, W_QAL, E_QAL, E_OUT, E_NON.
2474
2475	   */
2476
2477	  if (type == BREAK_FETCH)	/* instruction breakpoint */
2478	    {
2479	      cmd = 'B';
2480	      sprintf (buf, "0x0 B 0x%s 0x0", paddr_nz (addr));
2481	    }
2482	  else
2483	    /* watchpoint */
2484	    {
2485	      cmd = 'A';
2486	      sprintf (buf, "0x0 A 0x%s 0x%x 0x%s", paddr_nz (addr),
2487		     type == BREAK_READ ? 1 : (type == BREAK_WRITE ? 2 : 3),
2488		       paddr_nz (addr + len - 1));
2489	    }
2490	  mips_send_packet (buf, 1);
2491
2492	  rlen = mips_receive_packet (buf, 1, mips_receive_wait);
2493	  buf[rlen] = '\0';
2494
2495	  nfields = sscanf (buf, "0x%x %c 0x%x 0x%x",
2496			    &rpid, &rcmd, &rresponse, &rerrflg);
2497	  if (nfields != 4 || rcmd != cmd || rresponse > 255)
2498	    mips_error ("common_breakpoint: Bad response from remote board: %s", buf);
2499
2500	  if (rerrflg != 0)
2501	    if (check_lsi_error (addr, rerrflg))
2502	      return 1;
2503
2504	  /* rresponse contains PMON's breakpoint number.  Record the
2505	     information for this breakpoint so we can clear it later.  */
2506	  lsi_breakpoints[rresponse].type = type;
2507	  lsi_breakpoints[rresponse].addr = addr;
2508	  lsi_breakpoints[rresponse].len = len;
2509
2510	  return 0;
2511	}
2512    }
2513  else
2514    {
2515      /* On non-LSI targets, the breakpoint command has this form:
2516         0x0 <CMD> <ADDR> <MASK> <FLAGS>
2517         <MASK> is a don't care mask for addresses.
2518         <FLAGS> is any combination of `r', `w', or `f' for read/write/fetch.
2519       */
2520      unsigned long mask;
2521
2522      mask = calculate_mask (addr, len);
2523      addr &= ~mask;
2524
2525      if (set)			/* set a breakpoint */
2526	{
2527	  char *flags;
2528	  switch (type)
2529	    {
2530	    case BREAK_WRITE:	/* write */
2531	      flags = "w";
2532	      break;
2533	    case BREAK_READ:	/* read */
2534	      flags = "r";
2535	      break;
2536	    case BREAK_ACCESS:	/* read/write */
2537	      flags = "rw";
2538	      break;
2539	    case BREAK_FETCH:	/* fetch */
2540	      flags = "f";
2541	      break;
2542	    default:
2543	      internal_error (__FILE__, __LINE__, "failed internal consistency check");
2544	    }
2545
2546	  cmd = 'B';
2547	  sprintf (buf, "0x0 B 0x%s 0x%s %s", paddr_nz (addr),
2548		   paddr_nz (mask), flags);
2549	}
2550      else
2551	{
2552	  cmd = 'b';
2553	  sprintf (buf, "0x0 b 0x%s", paddr_nz (addr));
2554	}
2555
2556      mips_send_packet (buf, 1);
2557
2558      rlen = mips_receive_packet (buf, 1, mips_receive_wait);
2559      buf[rlen] = '\0';
2560
2561      nfields = sscanf (buf, "0x%x %c 0x%x 0x%x",
2562			&rpid, &rcmd, &rerrflg, &rresponse);
2563
2564      if (nfields != 4 || rcmd != cmd)
2565	mips_error ("common_breakpoint: Bad response from remote board: %s",
2566		    buf);
2567
2568      if (rerrflg != 0)
2569	{
2570	  /* Ddb returns "0x0 b 0x16 0x0\000", whereas
2571	     Cogent returns "0x0 b 0xffffffff 0x16\000": */
2572	  if (mips_monitor == MON_DDB)
2573	    rresponse = rerrflg;
2574	  if (rresponse != 22)	/* invalid argument */
2575	    fprintf_unfiltered (gdb_stderr,
2576			     "common_breakpoint (0x%s):  Got error: 0x%x\n",
2577				paddr_nz (addr), rresponse);
2578	  return 1;
2579	}
2580    }
2581  return 0;
2582}
2583
2584static void
2585send_srec (char *srec, int len, CORE_ADDR addr)
2586{
2587  while (1)
2588    {
2589      int ch;
2590
2591      serial_write (mips_desc, srec, len);
2592
2593      ch = mips_readchar (remote_timeout);
2594
2595      switch (ch)
2596	{
2597	case SERIAL_TIMEOUT:
2598	  error ("Timeout during download.");
2599	  break;
2600	case 0x6:		/* ACK */
2601	  return;
2602	case 0x15:		/* NACK */
2603	  fprintf_unfiltered (gdb_stderr, "Download got a NACK at byte %s!  Retrying.\n", paddr_u (addr));
2604	  continue;
2605	default:
2606	  error ("Download got unexpected ack char: 0x%x, retrying.\n", ch);
2607	}
2608    }
2609}
2610
2611/*  Download a binary file by converting it to S records. */
2612
2613static void
2614mips_load_srec (char *args)
2615{
2616  bfd *abfd;
2617  asection *s;
2618  char *buffer, srec[1024];
2619  unsigned int i;
2620  unsigned int srec_frame = 200;
2621  int reclen;
2622  static int hashmark = 1;
2623
2624  buffer = alloca (srec_frame * 2 + 256);
2625
2626  abfd = bfd_openr (args, 0);
2627  if (!abfd)
2628    {
2629      printf_filtered ("Unable to open file %s\n", args);
2630      return;
2631    }
2632
2633  if (bfd_check_format (abfd, bfd_object) == 0)
2634    {
2635      printf_filtered ("File is not an object file\n");
2636      return;
2637    }
2638
2639/* This actually causes a download in the IDT binary format: */
2640  mips_send_command (LOAD_CMD, 0);
2641
2642  for (s = abfd->sections; s; s = s->next)
2643    {
2644      if (s->flags & SEC_LOAD)
2645	{
2646	  unsigned int numbytes;
2647
2648	  /* FIXME!  vma too small????? */
2649	  printf_filtered ("%s\t: 0x%4lx .. 0x%4lx  ", s->name,
2650			   (long) s->vma,
2651			   (long) (s->vma + bfd_get_section_size (s)));
2652	  gdb_flush (gdb_stdout);
2653
2654	  for (i = 0; i < bfd_get_section_size (s); i += numbytes)
2655	    {
2656	      numbytes = min (srec_frame, bfd_get_section_size (s) - i);
2657
2658	      bfd_get_section_contents (abfd, s, buffer, i, numbytes);
2659
2660	      reclen = mips_make_srec (srec, '3', s->vma + i, buffer, numbytes);
2661	      send_srec (srec, reclen, s->vma + i);
2662
2663	      if (deprecated_ui_load_progress_hook)
2664		deprecated_ui_load_progress_hook (s->name, i);
2665
2666	      if (hashmark)
2667		{
2668		  putchar_unfiltered ('#');
2669		  gdb_flush (gdb_stdout);
2670		}
2671
2672	    }			/* Per-packet (or S-record) loop */
2673
2674	  putchar_unfiltered ('\n');
2675	}			/* Loadable sections */
2676    }
2677  if (hashmark)
2678    putchar_unfiltered ('\n');
2679
2680  /* Write a type 7 terminator record. no data for a type 7, and there
2681     is no data, so len is 0.  */
2682
2683  reclen = mips_make_srec (srec, '7', abfd->start_address, NULL, 0);
2684
2685  send_srec (srec, reclen, abfd->start_address);
2686
2687  serial_flush_input (mips_desc);
2688}
2689
2690/*
2691 * mips_make_srec -- make an srecord. This writes each line, one at a
2692 *      time, each with it's own header and trailer line.
2693 *      An srecord looks like this:
2694 *
2695 * byte count-+     address
2696 * start ---+ |        |       data        +- checksum
2697 *          | |        |                   |
2698 *        S01000006F6B692D746573742E73726563E4
2699 *        S315000448600000000000000000FC00005900000000E9
2700 *        S31A0004000023C1400037DE00F023604000377B009020825000348D
2701 *        S30B0004485A0000000000004E
2702 *        S70500040000F6
2703 *
2704 *      S<type><length><address><data><checksum>
2705 *
2706 *      Where
2707 *      - length
2708 *        is the number of bytes following upto the checksum. Note that
2709 *        this is not the number of chars following, since it takes two
2710 *        chars to represent a byte.
2711 *      - type
2712 *        is one of:
2713 *        0) header record
2714 *        1) two byte address data record
2715 *        2) three byte address data record
2716 *        3) four byte address data record
2717 *        7) four byte address termination record
2718 *        8) three byte address termination record
2719 *        9) two byte address termination record
2720 *
2721 *      - address
2722 *        is the start address of the data following, or in the case of
2723 *        a termination record, the start address of the image
2724 *      - data
2725 *        is the data.
2726 *      - checksum
2727 *        is the sum of all the raw byte data in the record, from the length
2728 *        upwards, modulo 256 and subtracted from 255.
2729 *
2730 * This routine returns the length of the S-record.
2731 *
2732 */
2733
2734static int
2735mips_make_srec (char *buf, int type, CORE_ADDR memaddr, unsigned char *myaddr,
2736		int len)
2737{
2738  unsigned char checksum;
2739  int i;
2740
2741  /* Create the header for the srec. addr_size is the number of bytes in the address,
2742     and 1 is the number of bytes in the count.  */
2743
2744  /* FIXME!! bigger buf required for 64-bit! */
2745  buf[0] = 'S';
2746  buf[1] = type;
2747  buf[2] = len + 4 + 1;		/* len + 4 byte address + 1 byte checksum */
2748  /* This assumes S3 style downloads (4byte addresses). There should
2749     probably be a check, or the code changed to make it more
2750     explicit. */
2751  buf[3] = memaddr >> 24;
2752  buf[4] = memaddr >> 16;
2753  buf[5] = memaddr >> 8;
2754  buf[6] = memaddr;
2755  memcpy (&buf[7], myaddr, len);
2756
2757  /* Note that the checksum is calculated on the raw data, not the
2758     hexified data.  It includes the length, address and the data
2759     portions of the packet.  */
2760  checksum = 0;
2761  buf += 2;			/* Point at length byte */
2762  for (i = 0; i < len + 4 + 1; i++)
2763    checksum += *buf++;
2764
2765  *buf = ~checksum;
2766
2767  return len + 8;
2768}
2769
2770/* The following manifest controls whether we enable the simple flow
2771   control support provided by the monitor. If enabled the code will
2772   wait for an affirmative ACK between transmitting packets. */
2773#define DOETXACK (1)
2774
2775/* The PMON fast-download uses an encoded packet format constructed of
2776   3byte data packets (encoded as 4 printable ASCII characters), and
2777   escape sequences (preceded by a '/'):
2778
2779   'K'     clear checksum
2780   'C'     compare checksum (12bit value, not included in checksum calculation)
2781   'S'     define symbol name (for addr) terminated with "," and padded to 4char boundary
2782   'Z'     zero fill multiple of 3bytes
2783   'B'     byte (12bit encoded value, of 8bit data)
2784   'A'     address (36bit encoded value)
2785   'E'     define entry as original address, and exit load
2786
2787   The packets are processed in 4 character chunks, so the escape
2788   sequences that do not have any data (or variable length data)
2789   should be padded to a 4 character boundary.  The decoder will give
2790   an error if the complete message block size is not a multiple of
2791   4bytes (size of record).
2792
2793   The encoding of numbers is done in 6bit fields.  The 6bit value is
2794   used to index into this string to get the specific character
2795   encoding for the value: */
2796static char encoding[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789,.";
2797
2798/* Convert the number of bits required into an encoded number, 6bits
2799   at a time (range 0..63).  Keep a checksum if required (passed
2800   pointer non-NULL). The function returns the number of encoded
2801   characters written into the buffer. */
2802static int
2803pmon_makeb64 (unsigned long v, char *p, int n, int *chksum)
2804{
2805  int count = (n / 6);
2806
2807  if ((n % 12) != 0)
2808    {
2809      fprintf_unfiltered (gdb_stderr,
2810			  "Fast encoding bitcount must be a multiple of 12bits: %dbit%s\n", n, (n == 1) ? "" : "s");
2811      return (0);
2812    }
2813  if (n > 36)
2814    {
2815      fprintf_unfiltered (gdb_stderr,
2816			  "Fast encoding cannot process more than 36bits at the moment: %dbits\n", n);
2817      return (0);
2818    }
2819
2820  /* Deal with the checksum: */
2821  if (chksum != NULL)
2822    {
2823      switch (n)
2824	{
2825	case 36:
2826	  *chksum += ((v >> 24) & 0xFFF);
2827	case 24:
2828	  *chksum += ((v >> 12) & 0xFFF);
2829	case 12:
2830	  *chksum += ((v >> 0) & 0xFFF);
2831	}
2832    }
2833
2834  do
2835    {
2836      n -= 6;
2837      *p++ = encoding[(v >> n) & 0x3F];
2838    }
2839  while (n > 0);
2840
2841  return (count);
2842}
2843
2844/* Shorthand function (that could be in-lined) to output the zero-fill
2845   escape sequence into the data stream. */
2846static int
2847pmon_zeroset (int recsize, char **buff, int *amount, unsigned int *chksum)
2848{
2849  int count;
2850
2851  sprintf (*buff, "/Z");
2852  count = pmon_makeb64 (*amount, (*buff + 2), 12, chksum);
2853  *buff += (count + 2);
2854  *amount = 0;
2855  return (recsize + count + 2);
2856}
2857
2858static int
2859pmon_checkset (int recsize, char **buff, int *value)
2860{
2861  int count;
2862
2863  /* Add the checksum (without updating the value): */
2864  sprintf (*buff, "/C");
2865  count = pmon_makeb64 (*value, (*buff + 2), 12, NULL);
2866  *buff += (count + 2);
2867  sprintf (*buff, "\n");
2868  *buff += 2;			/* include zero terminator */
2869  /* Forcing a checksum validation clears the sum: */
2870  *value = 0;
2871  return (recsize + count + 3);
2872}
2873
2874/* Amount of padding we leave after at the end of the output buffer,
2875   for the checksum and line termination characters: */
2876#define CHECKSIZE (4 + 4 + 4 + 2)
2877/* zero-fill, checksum, transfer end and line termination space. */
2878
2879/* The amount of binary data loaded from the object file in a single
2880   operation: */
2881#define BINCHUNK (1024)
2882
2883/* Maximum line of data accepted by the monitor: */
2884#define MAXRECSIZE (550)
2885/* NOTE: This constant depends on the monitor being used. This value
2886   is for PMON 5.x on the Cogent Vr4300 board. */
2887
2888static void
2889pmon_make_fastrec (char **outbuf, unsigned char *inbuf, int *inptr,
2890		   int inamount, int *recsize, unsigned int *csum,
2891		   unsigned int *zerofill)
2892{
2893  int count = 0;
2894  char *p = *outbuf;
2895
2896  /* This is a simple check to ensure that our data will fit within
2897     the maximum allowable record size. Each record output is 4bytes
2898     in length. We must allow space for a pending zero fill command,
2899     the record, and a checksum record. */
2900  while ((*recsize < (MAXRECSIZE - CHECKSIZE)) && ((inamount - *inptr) > 0))
2901    {
2902      /* Process the binary data: */
2903      if ((inamount - *inptr) < 3)
2904	{
2905	  if (*zerofill != 0)
2906	    *recsize = pmon_zeroset (*recsize, &p, zerofill, csum);
2907	  sprintf (p, "/B");
2908	  count = pmon_makeb64 (inbuf[*inptr], &p[2], 12, csum);
2909	  p += (2 + count);
2910	  *recsize += (2 + count);
2911	  (*inptr)++;
2912	}
2913      else
2914	{
2915	  unsigned int value = ((inbuf[*inptr + 0] << 16) | (inbuf[*inptr + 1] << 8) | inbuf[*inptr + 2]);
2916	  /* Simple check for zero data. TODO: A better check would be
2917	     to check the last, and then the middle byte for being zero
2918	     (if the first byte is not). We could then check for
2919	     following runs of zeros, and if above a certain size it is
2920	     worth the 4 or 8 character hit of the byte insertions used
2921	     to pad to the start of the zeroes. NOTE: This also depends
2922	     on the alignment at the end of the zero run. */
2923	  if (value == 0x00000000)
2924	    {
2925	      (*zerofill)++;
2926	      if (*zerofill == 0xFFF)	/* 12bit counter */
2927		*recsize = pmon_zeroset (*recsize, &p, zerofill, csum);
2928	    }
2929	  else
2930	    {
2931	      if (*zerofill != 0)
2932		*recsize = pmon_zeroset (*recsize, &p, zerofill, csum);
2933	      count = pmon_makeb64 (value, p, 24, csum);
2934	      p += count;
2935	      *recsize += count;
2936	    }
2937	  *inptr += 3;
2938	}
2939    }
2940
2941  *outbuf = p;
2942  return;
2943}
2944
2945static int
2946pmon_check_ack (char *mesg)
2947{
2948#if defined(DOETXACK)
2949  int c;
2950
2951  if (!tftp_in_use)
2952    {
2953      c = serial_readchar (udp_in_use ? udp_desc : mips_desc,
2954			   remote_timeout);
2955      if ((c == SERIAL_TIMEOUT) || (c != 0x06))
2956	{
2957	  fprintf_unfiltered (gdb_stderr,
2958			      "Failed to receive valid ACK for %s\n", mesg);
2959	  return (-1);		/* terminate the download */
2960	}
2961    }
2962#endif /* DOETXACK */
2963  return (0);
2964}
2965
2966/* pmon_download - Send a sequence of characters to the PMON download port,
2967   which is either a serial port or a UDP socket.  */
2968
2969static void
2970pmon_start_download (void)
2971{
2972  if (tftp_in_use)
2973    {
2974      /* Create the temporary download file.  */
2975      if ((tftp_file = fopen (tftp_localname, "w")) == NULL)
2976	perror_with_name (tftp_localname);
2977    }
2978  else
2979    {
2980      mips_send_command (udp_in_use ? LOAD_CMD_UDP : LOAD_CMD, 0);
2981      mips_expect ("Downloading from ");
2982      mips_expect (udp_in_use ? "udp" : "tty0");
2983      mips_expect (", ^C to abort\r\n");
2984    }
2985}
2986
2987static int
2988mips_expect_download (char *string)
2989{
2990  if (!mips_expect (string))
2991    {
2992      fprintf_unfiltered (gdb_stderr, "Load did not complete successfully.\n");
2993      if (tftp_in_use)
2994	remove (tftp_localname);	/* Remove temporary file */
2995      return 0;
2996    }
2997  else
2998    return 1;
2999}
3000
3001static void
3002pmon_check_entry_address (char *entry_address, int final)
3003{
3004  char hexnumber[9];		/* includes '\0' space */
3005  mips_expect_timeout (entry_address, tftp_in_use ? 15 : remote_timeout);
3006  sprintf (hexnumber, "%x", final);
3007  mips_expect (hexnumber);
3008  mips_expect ("\r\n");
3009}
3010
3011static int
3012pmon_check_total (int bintotal)
3013{
3014  char hexnumber[9];		/* includes '\0' space */
3015  mips_expect ("\r\ntotal = 0x");
3016  sprintf (hexnumber, "%x", bintotal);
3017  mips_expect (hexnumber);
3018  return mips_expect_download (" bytes\r\n");
3019}
3020
3021static void
3022pmon_end_download (int final, int bintotal)
3023{
3024  char hexnumber[9];		/* includes '\0' space */
3025
3026  if (tftp_in_use)
3027    {
3028      static char *load_cmd_prefix = "load -b -s ";
3029      char *cmd;
3030      struct stat stbuf;
3031
3032      /* Close off the temporary file containing the load data.  */
3033      fclose (tftp_file);
3034      tftp_file = NULL;
3035
3036      /* Make the temporary file readable by the world.  */
3037      if (stat (tftp_localname, &stbuf) == 0)
3038	chmod (tftp_localname, stbuf.st_mode | S_IROTH);
3039
3040      /* Must reinitialize the board to prevent PMON from crashing.  */
3041      mips_send_command ("initEther\r", -1);
3042
3043      /* Send the load command.  */
3044      cmd = xmalloc (strlen (load_cmd_prefix) + strlen (tftp_name) + 2);
3045      strcpy (cmd, load_cmd_prefix);
3046      strcat (cmd, tftp_name);
3047      strcat (cmd, "\r");
3048      mips_send_command (cmd, 0);
3049      xfree (cmd);
3050      if (!mips_expect_download ("Downloading from "))
3051	return;
3052      if (!mips_expect_download (tftp_name))
3053	return;
3054      if (!mips_expect_download (", ^C to abort\r\n"))
3055	return;
3056    }
3057
3058  /* Wait for the stuff that PMON prints after the load has completed.
3059     The timeout value for use in the tftp case (15 seconds) was picked
3060     arbitrarily but might be too small for really large downloads. FIXME. */
3061  switch (mips_monitor)
3062    {
3063    case MON_LSI:
3064      pmon_check_ack ("termination");
3065      pmon_check_entry_address ("Entry address is ", final);
3066      if (!pmon_check_total (bintotal))
3067	return;
3068      break;
3069    default:
3070      pmon_check_entry_address ("Entry Address  = ", final);
3071      pmon_check_ack ("termination");
3072      if (!pmon_check_total (bintotal))
3073	return;
3074      break;
3075    }
3076
3077  if (tftp_in_use)
3078    remove (tftp_localname);	/* Remove temporary file */
3079}
3080
3081static void
3082pmon_download (char *buffer, int length)
3083{
3084  if (tftp_in_use)
3085    fwrite (buffer, 1, length, tftp_file);
3086  else
3087    serial_write (udp_in_use ? udp_desc : mips_desc, buffer, length);
3088}
3089
3090static void
3091pmon_load_fast (char *file)
3092{
3093  bfd *abfd;
3094  asection *s;
3095  unsigned char *binbuf;
3096  char *buffer;
3097  int reclen;
3098  unsigned int csum = 0;
3099  int hashmark = !tftp_in_use;
3100  int bintotal = 0;
3101  int final = 0;
3102  int finished = 0;
3103
3104  buffer = (char *) xmalloc (MAXRECSIZE + 1);
3105  binbuf = (unsigned char *) xmalloc (BINCHUNK);
3106
3107  abfd = bfd_openr (file, 0);
3108  if (!abfd)
3109    {
3110      printf_filtered ("Unable to open file %s\n", file);
3111      return;
3112    }
3113
3114  if (bfd_check_format (abfd, bfd_object) == 0)
3115    {
3116      printf_filtered ("File is not an object file\n");
3117      return;
3118    }
3119
3120  /* Setup the required download state: */
3121  mips_send_command ("set dlproto etxack\r", -1);
3122  mips_send_command ("set dlecho off\r", -1);
3123  /* NOTE: We get a "cannot set variable" message if the variable is
3124     already defined to have the argument we give. The code doesn't
3125     care, since it just scans to the next prompt anyway. */
3126  /* Start the download: */
3127  pmon_start_download ();
3128
3129  /* Zero the checksum */
3130  sprintf (buffer, "/Kxx\n");
3131  reclen = strlen (buffer);
3132  pmon_download (buffer, reclen);
3133  finished = pmon_check_ack ("/Kxx");
3134
3135  for (s = abfd->sections; s && !finished; s = s->next)
3136    if (s->flags & SEC_LOAD)	/* only deal with loadable sections */
3137      {
3138	bintotal += bfd_get_section_size (s);
3139	final = (s->vma + bfd_get_section_size (s));
3140
3141	printf_filtered ("%s\t: 0x%4x .. 0x%4x  ", s->name, (unsigned int) s->vma,
3142			 (unsigned int) (s->vma + bfd_get_section_size (s)));
3143	gdb_flush (gdb_stdout);
3144
3145	/* Output the starting address */
3146	sprintf (buffer, "/A");
3147	reclen = pmon_makeb64 (s->vma, &buffer[2], 36, &csum);
3148	buffer[2 + reclen] = '\n';
3149	buffer[3 + reclen] = '\0';
3150	reclen += 3;		/* for the initial escape code and carriage return */
3151	pmon_download (buffer, reclen);
3152	finished = pmon_check_ack ("/A");
3153
3154	if (!finished)
3155	  {
3156	    unsigned int binamount;
3157	    unsigned int zerofill = 0;
3158	    char *bp = buffer;
3159	    unsigned int i;
3160
3161	    reclen = 0;
3162
3163	    for (i = 0;
3164		 i < bfd_get_section_size (s) && !finished;
3165		 i += binamount)
3166	      {
3167		int binptr = 0;
3168
3169		binamount = min (BINCHUNK, bfd_get_section_size (s) - i);
3170
3171		bfd_get_section_contents (abfd, s, binbuf, i, binamount);
3172
3173		/* This keeps a rolling checksum, until we decide to output
3174		   the line: */
3175		for (; ((binamount - binptr) > 0);)
3176		  {
3177		    pmon_make_fastrec (&bp, binbuf, &binptr, binamount, &reclen, &csum, &zerofill);
3178		    if (reclen >= (MAXRECSIZE - CHECKSIZE))
3179		      {
3180			reclen = pmon_checkset (reclen, &bp, &csum);
3181			pmon_download (buffer, reclen);
3182			finished = pmon_check_ack ("data record");
3183			if (finished)
3184			  {
3185			    zerofill = 0;	/* do not transmit pending zerofills */
3186			    break;
3187			  }
3188
3189			if (deprecated_ui_load_progress_hook)
3190			  deprecated_ui_load_progress_hook (s->name, i);
3191
3192			if (hashmark)
3193			  {
3194			    putchar_unfiltered ('#');
3195			    gdb_flush (gdb_stdout);
3196			  }
3197
3198			bp = buffer;
3199			reclen = 0;	/* buffer processed */
3200		      }
3201		  }
3202	      }
3203
3204	    /* Ensure no out-standing zerofill requests: */
3205	    if (zerofill != 0)
3206	      reclen = pmon_zeroset (reclen, &bp, &zerofill, &csum);
3207
3208	    /* and then flush the line: */
3209	    if (reclen > 0)
3210	      {
3211		reclen = pmon_checkset (reclen, &bp, &csum);
3212		/* Currently pmon_checkset outputs the line terminator by
3213		   default, so we write out the buffer so far: */
3214		pmon_download (buffer, reclen);
3215		finished = pmon_check_ack ("record remnant");
3216	      }
3217	  }
3218
3219	putchar_unfiltered ('\n');
3220      }
3221
3222  /* Terminate the transfer. We know that we have an empty output
3223     buffer at this point. */
3224  sprintf (buffer, "/E/E\n");	/* include dummy padding characters */
3225  reclen = strlen (buffer);
3226  pmon_download (buffer, reclen);
3227
3228  if (finished)
3229    {				/* Ignore the termination message: */
3230      serial_flush_input (udp_in_use ? udp_desc : mips_desc);
3231    }
3232  else
3233    {				/* Deal with termination message: */
3234      pmon_end_download (final, bintotal);
3235    }
3236
3237  return;
3238}
3239
3240/* mips_load -- download a file. */
3241
3242static void
3243mips_load (char *file, int from_tty)
3244{
3245  /* Get the board out of remote debugging mode.  */
3246  if (mips_exit_debug ())
3247    error ("mips_load:  Couldn't get into monitor mode.");
3248
3249  if (mips_monitor != MON_IDT)
3250    pmon_load_fast (file);
3251  else
3252    mips_load_srec (file);
3253
3254  mips_initialize ();
3255
3256  /* Finally, make the PC point at the start address */
3257  if (mips_monitor != MON_IDT)
3258    {
3259      /* Work around problem where PMON monitor updates the PC after a load
3260         to a different value than GDB thinks it has. The following ensures
3261         that the write_pc() WILL update the PC value: */
3262      deprecated_register_valid[PC_REGNUM] = 0;
3263    }
3264  if (exec_bfd)
3265    write_pc (bfd_get_start_address (exec_bfd));
3266
3267  inferior_ptid = null_ptid;	/* No process now */
3268
3269/* This is necessary because many things were based on the PC at the time that
3270   we attached to the monitor, which is no longer valid now that we have loaded
3271   new code (and just changed the PC).  Another way to do this might be to call
3272   normal_stop, except that the stack may not be valid, and things would get
3273   horribly confused... */
3274
3275  clear_symtab_users ();
3276}
3277
3278
3279/* Pass the command argument as a packet to PMON verbatim.  */
3280
3281static void
3282pmon_command (char *args, int from_tty)
3283{
3284  char buf[DATA_MAXLEN + 1];
3285  int rlen;
3286
3287  sprintf (buf, "0x0 %s", args);
3288  mips_send_packet (buf, 1);
3289  printf_filtered ("Send packet: %s\n", buf);
3290
3291  rlen = mips_receive_packet (buf, 1, mips_receive_wait);
3292  buf[rlen] = '\0';
3293  printf_filtered ("Received packet: %s\n", buf);
3294}
3295
3296extern initialize_file_ftype _initialize_remote_mips; /* -Wmissing-prototypes */
3297
3298void
3299_initialize_remote_mips (void)
3300{
3301  /* Initialize the fields in mips_ops that are common to all four targets.  */
3302  mips_ops.to_longname = "Remote MIPS debugging over serial line";
3303  mips_ops.to_close = mips_close;
3304  mips_ops.to_detach = mips_detach;
3305  mips_ops.to_resume = mips_resume;
3306  mips_ops.to_fetch_registers = mips_fetch_registers;
3307  mips_ops.to_store_registers = mips_store_registers;
3308  mips_ops.to_prepare_to_store = mips_prepare_to_store;
3309  mips_ops.deprecated_xfer_memory = mips_xfer_memory;
3310  mips_ops.to_files_info = mips_files_info;
3311  mips_ops.to_insert_breakpoint = mips_insert_breakpoint;
3312  mips_ops.to_remove_breakpoint = mips_remove_breakpoint;
3313  mips_ops.to_insert_watchpoint = mips_insert_watchpoint;
3314  mips_ops.to_remove_watchpoint = mips_remove_watchpoint;
3315  mips_ops.to_stopped_by_watchpoint = mips_stopped_by_watchpoint;
3316  mips_ops.to_can_use_hw_breakpoint = mips_can_use_watchpoint;
3317  mips_ops.to_kill = mips_kill;
3318  mips_ops.to_load = mips_load;
3319  mips_ops.to_create_inferior = mips_create_inferior;
3320  mips_ops.to_mourn_inferior = mips_mourn_inferior;
3321  mips_ops.to_stratum = process_stratum;
3322  mips_ops.to_has_all_memory = 1;
3323  mips_ops.to_has_memory = 1;
3324  mips_ops.to_has_stack = 1;
3325  mips_ops.to_has_registers = 1;
3326  mips_ops.to_has_execution = 1;
3327  mips_ops.to_magic = OPS_MAGIC;
3328
3329  /* Copy the common fields to all four target vectors.  */
3330  pmon_ops = ddb_ops = lsi_ops = mips_ops;
3331
3332  /* Initialize target-specific fields in the target vectors.  */
3333  mips_ops.to_shortname = "mips";
3334  mips_ops.to_doc = "\
3335Debug a board using the MIPS remote debugging protocol over a serial line.\n\
3336The argument is the device it is connected to or, if it contains a colon,\n\
3337HOST:PORT to access a board over a network";
3338  mips_ops.to_open = mips_open;
3339  mips_ops.to_wait = mips_wait;
3340
3341  pmon_ops.to_shortname = "pmon";
3342  pmon_ops.to_doc = "\
3343Debug a board using the PMON MIPS remote debugging protocol over a serial\n\
3344line. The argument is the device it is connected to or, if it contains a\n\
3345colon, HOST:PORT to access a board over a network";
3346  pmon_ops.to_open = pmon_open;
3347  pmon_ops.to_wait = mips_wait;
3348
3349  ddb_ops.to_shortname = "ddb";
3350  ddb_ops.to_doc = "\
3351Debug a board using the PMON MIPS remote debugging protocol over a serial\n\
3352line. The first argument is the device it is connected to or, if it contains\n\
3353a colon, HOST:PORT to access a board over a network.  The optional second\n\
3354parameter is the temporary file in the form HOST:FILENAME to be used for\n\
3355TFTP downloads to the board.  The optional third parameter is the local name\n\
3356of the TFTP temporary file, if it differs from the filename seen by the board.";
3357  ddb_ops.to_open = ddb_open;
3358  ddb_ops.to_wait = mips_wait;
3359
3360  lsi_ops.to_shortname = "lsi";
3361  lsi_ops.to_doc = pmon_ops.to_doc;
3362  lsi_ops.to_open = lsi_open;
3363  lsi_ops.to_wait = mips_wait;
3364
3365  /* Add the targets.  */
3366  add_target (&mips_ops);
3367  add_target (&pmon_ops);
3368  add_target (&ddb_ops);
3369  add_target (&lsi_ops);
3370
3371  deprecated_add_show_from_set
3372    (add_set_cmd ("timeout", no_class, var_zinteger,
3373		  (char *) &mips_receive_wait,
3374		  "Set timeout in seconds for remote MIPS serial I/O.",
3375		  &setlist),
3376     &showlist);
3377
3378  deprecated_add_show_from_set
3379    (add_set_cmd ("retransmit-timeout", no_class, var_zinteger,
3380		  (char *) &mips_retransmit_wait, "\
3381Set retransmit timeout in seconds for remote MIPS serial I/O.\n\
3382This is the number of seconds to wait for an acknowledgement to a packet\n\
3383before resending the packet.", &setlist),
3384     &showlist);
3385
3386  deprecated_add_show_from_set
3387    (add_set_cmd ("syn-garbage-limit", no_class, var_zinteger,
3388		  (char *) &mips_syn_garbage, "\
3389Set the maximum number of characters to ignore when scanning for a SYN.\n\
3390This is the maximum number of characters GDB will ignore when trying to\n\
3391synchronize with the remote system.  A value of -1 means that there is no\n\
3392limit. (Note that these characters are printed out even though they are\n\
3393ignored.)",
3394		  &setlist),
3395     &showlist);
3396
3397  deprecated_add_show_from_set
3398    (add_set_cmd ("monitor-prompt", class_obscure, var_string,
3399		  (char *) &mips_monitor_prompt,
3400		  "Set the prompt that GDB expects from the monitor.",
3401		  &setlist),
3402     &showlist);
3403
3404  deprecated_add_show_from_set
3405    (add_set_cmd ("monitor-warnings", class_obscure, var_zinteger,
3406		  (char *) &monitor_warnings,
3407		  "Set printing of monitor warnings.\n"
3408		  "When enabled, monitor warnings about hardware breakpoints "
3409		  "will be displayed.",
3410		  &setlist),
3411     &showlist);
3412
3413  add_com ("pmon <command>", class_obscure, pmon_command,
3414	   "Send a packet to PMON (must be in debug mode).");
3415
3416  deprecated_add_show_from_set
3417    (add_set_cmd ("mask-address", no_class,
3418		  var_boolean, &mask_address_p, "\
3419Set zeroing of upper 32 bits of 64-bit addresses when talking to PMON targets.\n\
3420Use \"on\" to enable the masking and \"off\" to disable it.\n",
3421		  &setlist),
3422     &showlist);
3423}
3424