@node Remote Protocol
@appendix @value{GDBN} Remote Serial Protocol

@menu
* Overview::
* Packets::
* Stop Reply Packets::
* General Query Packets::
* Register Packet Format::
* Examples::
@end menu

@node Overview
@section Overview

There may be occasions when you need to know something about the
protocol---for example, if there is only one serial port to your target
machine, you might want your program to do something special if it
recognizes a packet meant for @value{GDBN}.

In the examples below, @samp{<-} and @samp{->} are used to indicate
transmitted and received data respectfully.

@cindex protocol, @value{GDBN} remote serial
@cindex serial protocol, @value{GDBN} remote
@cindex remote serial protocol
All @value{GDBN} commands and responses (other than acknowledgments) are
sent as a @var{packet}.  A @var{packet} is introduced with the character
@samp{$}, the actual @var{packet-data}, and the terminating character
@samp{#} followed by a two-digit @var{checksum}:

@smallexample
@code{$}@var{packet-data}@code{#}@var{checksum}
@end smallexample
@noindent

@cindex checksum, for @value{GDBN} remote
@noindent
The two-digit @var{checksum} is computed as the modulo 256 sum of all
characters between the leading @samp{$} and the trailing @samp{#} (an
eight bit unsigned checksum).

Implementors should note that prior to @value{GDBN} 5.0 the protocol
specification also included an optional two-digit @var{sequence-id}:

@smallexample
@code{$}@var{sequence-id}@code{:}@var{packet-data}@code{#}@var{checksum}
@end smallexample

@cindex sequence-id, for @value{GDBN} remote
@noindent
That @var{sequence-id} was appended to the acknowledgment.  @value{GDBN}
has never output @var{sequence-id}s.  Stubs that handle packets added
since @value{GDBN} 5.0 must not accept @var{sequence-id}.

@cindex acknowledgment, for @value{GDBN} remote
When either the host or the target machine receives a packet, the first
response expected is an acknowledgment: either @samp{+} (to indicate
the package was received correctly) or @samp{-} (to request
retransmission):

@smallexample
<- @code{$}@var{packet-data}@code{#}@var{checksum}
-> @code{+}
@end smallexample
@noindent

The host (@value{GDBN}) sends @var{command}s, and the target (the
debugging stub incorporated in your program) sends a @var{response}.  In
the case of step and continue @var{command}s, the response is only sent
when the operation has completed (the target has again stopped).

@var{packet-data} consists of a sequence of characters with the
exception of @samp{#} and @samp{$} (see @samp{X} packet for additional
exceptions).

Fields within the packet should be separated using @samp{,} @samp{;} or
@samp{:}.  Except where otherwise noted all numbers are represented in
HEX with leading zeros suppressed.

Implementors should note that prior to @value{GDBN} 5.0, the character
@samp{:} could not appear as the third character in a packet (as it
would potentially conflict with the @var{sequence-id}).

Response @var{data} can be run-length encoded to save space.  A @samp{*}
means that the next character is an @sc{ascii} encoding giving a repeat count
which stands for that many repetitions of the character preceding the
@samp{*}.  The encoding is @code{n+29}, yielding a printable character
where @code{n >=3} (which is where rle starts to win).  The printable
characters @samp{$}, @samp{#}, @samp{+} and @samp{-} or with a numeric
value greater than 126 should not be used.

Some remote systems have used a different run-length encoding mechanism
loosely refered to as the cisco encoding.  Following the @samp{*}
character are two hex digits that indicate the size of the packet.

So:
@smallexample
"@code{0* }"
@end smallexample
@noindent
means the same as "0000".

The error response returned for some packets includes a two character
error number.  That number is not well defined.

For any @var{command} not supported by the stub, an empty response
(@samp{$#00}) should be returned.  That way it is possible to extend the
protocol.  A newer @value{GDBN} can tell if a packet is supported based
on that response.

A stub is required to support the @samp{g}, @samp{G}, @samp{m}, @samp{M}, 
@samp{c}, and @samp{s} @var{command}s.  All other @var{command}s are 
optional.

@node Packets
@section Packets

The following table provides a complete list of all currently defined
@var{command}s and their corresponding response @var{data}.

@table @r

@item @code{!} --- extended mode

Enable extended mode.  In extended mode, the remote server is made
persistent.  The @samp{R} packet is used to restart the program being
debugged.

Reply:
@table @samp
@item OK
The remote target both supports and has enabled extended mode.
@end table

@item @code{?} --- last signal

Indicate the reason the target halted.  The reply is the same as for
step and continue.

Reply:
@xref{Stop Reply Packets}.

@item @code{a} --- reserved

Reserved for future use

@item @code{A}@var{arglen}@code{,}@var{argnum}@code{,}@var{arg}@code{,@dots{}} ---  set program arguments @strong{(reserved)}

Initialized @samp{argv[]} array passed into program. @var{arglen}
specifies the number of bytes in the hex encoded byte stream @var{arg}.
See @file{gdbserver} for more details.

Reply:
@table @samp
@item OK
@item E@var{NN}
@end table

@item @code{b}@var{baud} --- set baud @strong{(deprecated)}

Change the serial line speed to @var{baud}.

JTC: @emph{When does the transport layer state change?  When it's
received, or after the ACK is transmitted.  In either case, there are
problems if the command or the acknowledgment packet is dropped.}

Stan: @emph{If people really wanted to add something like this, and get
it working for the first time, they ought to modify ser-unix.c to send
some kind of out-of-band message to a specially-setup stub and have the
switch happen "in between" packets, so that from remote protocol's point
of view, nothing actually happened.}

@item @code{B}@var{addr},@var{mode} --- set breakpoint @strong{(deprecated)}

Set (@var{mode} is @samp{S}) or clear (@var{mode} is @samp{C}) a
breakpoint at @var{addr}.  @emph{This has been replaced by the @samp{Z}
and @samp{z} packets.}

@item @code{c}@var{addr} --- continue

@var{addr} is address to resume. If @var{addr} is omitted, resume at
current address.

Reply: @xref{Stop Reply Packets}.

@item @code{C}@var{sig}@code{;}@var{addr} --- continue with signal

Continue with signal @var{sig} (hex signal number).  If
@code{;}@var{addr} is omitted, resume at same address.

Reply: @xref{Stop Reply Packets}.

@item @code{d} --- toggle debug @strong{(deprecated)}

Toggle debug flag.

@item @code{D} --- detach

Detach @value{GDBN} from the remote system.  Sent to the remote target
before @value{GDBN} disconnects.

Reply:
@table @samp
@item @emph{no response}
@value{GDBN} does not check for any response after sending this packet.
@end table

@item @code{e} --- reserved

Reserved for future use

@item @code{E} --- reserved

Reserved for future use

@item @code{f} --- reserved

Reserved for future use

@item @code{F} --- reserved

Reserved for future use

@item @code{g} --- read registers
@anchor{read registers packet}

Read general registers.

Reply:
@table @samp
@item @var{XX@dots{}}
Each byte of register data is described by two hex digits.  The bytes
with the register are transmitted in target byte order.  The size of
each register and their position within the @samp{g} @var{packet} are
determined by the @value{GDBN} internal macros @var{REGISTER_RAW_SIZE}
and @var{REGISTER_NAME} macros.  The specification of several standard
@code{g} packets is specified below.
@item E@var{NN}
for an error.
@end table

@item @code{G}@var{XX@dots{}} --- write regs

For a description of the @var{XX@dots{}} data, @xref{read registers
packet}.

Reply:
@table @samp
@item OK
for success
@item E@var{NN}
for an error
@end table

@item @code{h} --- reserved

Reserved for future use

@item @code{H}@var{c}@var{t@dots{}} --- set thread 

Set thread for subsequent operations (@samp{m}, @samp{M}, @samp{g},
@samp{G}, et.al.).  @var{c} = @samp{c} for thread used in step and
continue; @var{t@dots{}} can be -1 for all threads.  @var{c} = @samp{g} for
thread used in other operations.  If zero, pick a thread, any thread.

Reply:
@table @samp
@item OK
for success
@item E@var{NN}
for an error
@end table

@c FIXME: JTC:
@c   'H': How restrictive (or permissive) is the thread model.  If a
@c        thread is selected and stopped, are other threads allowed
@c        to continue to execute?  As I mentioned above, I think the
@c        semantics of each command when a thread is selected must be
@c        described.  For example:
@c
@c        'g':    If the stub supports threads and a specific thread is
@c                selected, returns the register block from that thread;
@c                otherwise returns current registers.
@c
@c        'G'     If the stub supports threads and a specific thread is
@c                selected, sets the registers of the register block of
@c                that thread; otherwise sets current registers.

@item @code{i}@var{addr}@code{,}@var{nnn} --- cycle step @strong{(draft)}
@anchor{cycle step packet}

Step the remote target by a single clock cycle.  If @code{,}@var{nnn} is
present, cycle step @var{nnn} cycles.  If @var{addr} is present, cycle
step starting at that address.

@item @code{I} --- signal then cycle step @strong{(reserved)}

@xref{step with signal packet}.  @xref{cycle step packet}.

@item @code{j} --- reserved

Reserved for future use

@item @code{J} --- reserved

Reserved for future use

@item @code{k} --- kill request

FIXME: @emph{There is no description of how to operate when a specific
thread context has been selected (i.e.@: does 'k' kill only that
thread?)}.

@item @code{l} --- reserved

Reserved for future use

@item @code{L} --- reserved

Reserved for future use

@item @code{m}@var{addr}@code{,}@var{length} --- read memory

Read @var{length} bytes of memory starting at address @var{addr}.
Neither @value{GDBN} nor the stub assume that sized memory transfers are
assumed using word alligned accesses. FIXME: @emph{A word aligned memory
transfer mechanism is needed.}

Reply:
@table @samp
@item @var{XX@dots{}}
@var{XX@dots{}} is mem contents. Can be fewer bytes than requested if able
to read only part of the data.  Neither @value{GDBN} nor the stub assume
that sized memory transfers are assumed using word alligned
accesses. FIXME: @emph{A word aligned memory transfer mechanism is
needed.}
@item E@var{NN}
@var{NN} is errno
@end table

@item @code{M}@var{addr},@var{length}@code{:}@var{XX@dots{}} --- write mem

Write @var{length} bytes of memory starting at address @var{addr}.
@var{XX@dots{}} is the data.

Reply:
@table @samp
@item OK
for success
@item E@var{NN}
for an error (this includes the case where only part of the data was
written).
@end table

@item @code{n} --- reserved

Reserved for future use

@item @code{N} --- reserved

Reserved for future use

@item @code{o} --- reserved

Reserved for future use

@item @code{O} --- reserved

Reserved for future use

@item @code{p}@var{n@dots{}} --- read reg @strong{(reserved)}

@xref{write register packet}.

Reply:
@table @samp
@item @var{r@dots{}.}
The hex encoded value of the register in target byte order.
@end table

@item @code{P}@var{n@dots{}}@code{=}@var{r@dots{}} --- write register
@anchor{write register packet}

Write register @var{n@dots{}} with value @var{r@dots{}}, which contains two hex
digits for each byte in the register (target byte order).

Reply:
@table @samp
@item OK
for success
@item E@var{NN}
for an error
@end table

@item @code{q}@var{query} --- general query
@anchor{general query packet}

Request info about @var{query}.  In general @value{GDBN} queries have a
leading upper case letter.  Custom vendor queries should use a company
prefix (in lower case) ex: @samp{qfsf.var}.  @var{query} may optionally
be followed by a @samp{,} or @samp{;} separated list.  Stubs must ensure
that they match the full @var{query} name.

Reply:
@table @samp
@item @var{XX@dots{}}
Hex encoded data from query.  The reply can not be empty.
@item E@var{NN}
error reply
@item
Indicating an unrecognized @var{query}.
@end table

@item @code{Q}@var{var}@code{=}@var{val} --- general set

Set value of @var{var} to @var{val}.

For a discussing of naming conventions, @xref{general query packet}.

@item @code{r} --- reset @strong{(deprecated)}

Reset the entire system.

@item @code{R}@var{XX} --- remote restart

Restart the program being debugged.  @var{XX}, while needed, is ignored.
This packet is only available in extended mode.

Reply:
@table @samp
@item @emph{no reply}
The @samp{R} packet has no reply.
@end table

@item @code{s}@var{addr} --- step

@var{addr} is address to resume.  If @var{addr} is omitted, resume at
same address.

Reply: @xref{Stop Reply Packets}.

@item @code{S}@var{sig}@code{;}@var{addr} --- step with signal
@anchor{step with signal packet}

Like @samp{C} but step not continue.

Reply: @xref{Stop Reply Packets}.

@item @code{t}@var{addr}@code{:}@var{PP}@code{,}@var{MM} --- search 

Search backwards starting at address @var{addr} for a match with pattern
@var{PP} and mask @var{MM}.  @var{PP} and @var{MM} are 4 bytes.
@var{addr} must be at least 3 digits.

@item @code{T}@var{XX} --- thread alive

Find out if the thread XX is alive.

Reply:
@table @samp
@item OK
thread is still alive
@item E@var{NN}
thread is dead
@end table

@item @code{u} --- reserved

Reserved for future use

@item @code{U} --- reserved

Reserved for future use

@item @code{v} --- reserved

Reserved for future use

@item @code{V} --- reserved

Reserved for future use

@item @code{w} --- reserved

Reserved for future use

@item @code{W} --- reserved

Reserved for future use

@item @code{x} --- reserved

Reserved for future use

@item @code{X}@var{addr}@code{,}@var{length}@var{:}@var{XX@dots{}} --- write mem (binary)

@var{addr} is address, @var{length} is number of bytes, @var{XX@dots{}}
is binary data.  The characters @code{$}, @code{#}, and @code{0x7d} are
escaped using @code{0x7d}.

Reply:
@table @samp
@item OK
for success
@item E@var{NN}
for an error
@end table

@item @code{y} --- reserved

Reserved for future use

@item @code{Y} reserved

Reserved for future use

@item @code{z}@var{t}@code{,}@var{addr}@code{,}@var{length} --- remove break or watchpoint @strong{(draft)}

@xref{insert breakpoint or watchpoint packet}.

@item @code{Z}@var{t}@code{,}@var{addr}@code{,}@var{length} --- insert break or watchpoint @strong{(draft)}
@anchor{insert breakpoint or watchpoint packet}

@var{t} is type: @samp{0} - software breakpoint, @samp{1} - hardware
breakpoint, @samp{2} - write watchpoint, @samp{3} - read watchpoint,
@samp{4} - access watchpoint; @var{addr} is address; @var{length} is in
bytes.  For a software breakpoint, @var{length} specifies the size of
the instruction to be patched.  For hardware breakpoints and watchpoints
@var{length} specifies the memory region to be monitored.  To avoid
potential problems with duplicate packets, the operations should be
implemented in an idempotent way.

Reply:
@table @samp
@item E@var{NN}
for an error
@item OK
for success
@item @samp{}
If not supported.
@end table

@end table

@node Stop Reply Packets
@section Stop Reply Packets

The @samp{C}, @samp{c}, @samp{S}, @samp{s} and @samp{?} packets can
receive any of the below as a reply.  In the case of the @samp{C},
@samp{c}, @samp{S} and @samp{s} packets, that reply is only returned
when the target halts.  In the below the exact meaning of @samp{signal
number} is poorly defined.  In general one of the UNIX signal numbering
conventions is used.

@table @samp

@item S@var{AA}
@var{AA} is the signal number

@item T@var{AA}@var{n@dots{}}:@var{r@dots{}};@var{n@dots{}}:@var{r@dots{}};@var{n@dots{}}:@var{r@dots{}};

@var{AA} = two hex digit signal number; @var{n@dots{}} = register number
(hex), @var{r@dots{}}  = target byte ordered register contents, size defined
by @code{REGISTER_RAW_SIZE}; @var{n@dots{}} = @samp{thread}, @var{r@dots{}} =
thread process ID, this is a hex integer; @var{n@dots{}} = other string not
starting with valid hex digit.  @value{GDBN} should ignore this
@var{n@dots{}}, @var{r@dots{}} pair and go on to the next.  This way we can
extend the protocol.

@item W@var{AA}

The process exited, and @var{AA} is the exit status.  This is only
applicable for certains sorts of targets.

@item X@var{AA}

The process terminated with signal @var{AA}.

@item N@var{AA};@var{t@dots{}};@var{d@dots{}};@var{b@dots{}} @strong{(obsolete)}

@var{AA} = signal number; @var{t@dots{}} = address of symbol "_start";
@var{d@dots{}} = base of data section; @var{b@dots{}} = base of bss section.
@emph{Note: only used by Cisco Systems targets.  The difference between
this reply and the "qOffsets" query is that the 'N' packet may arrive
spontaneously whereas the 'qOffsets' is a query initiated by the host
debugger.}

@item O@var{XX@dots{}}

@var{XX@dots{}} is hex encoding of @sc{ascii} data.  This can happen at any
time while the program is running and the debugger should continue to
wait for 'W', 'T', etc.

@end table

@node General Query Packets
@section General Query Packets

The following set and query packets have already been defined.

@table @r

@item @code{q}@code{C} --- current thread

Return the current thread id.

Reply:
@table @samp
@item @code{QC}@var{pid}
Where @var{pid} is a HEX encoded 16 bit process id.
@item *
Any other reply implies the old pid.
@end table

@item @code{q}@code{fThreadInfo} -- all thread ids

@code{q}@code{sThreadInfo}

Obtain a list of active thread ids from the target (OS).  Since there
may be too many active threads to fit into one reply packet, this query
works iteratively: it may require more than one query/reply sequence to
obtain the entire list of threads.  The first query of the sequence will
be the @code{qf}@code{ThreadInfo} query; subsequent queries in the
sequence will be the @code{qs}@code{ThreadInfo} query.

NOTE: replaces the @code{qL} query (see below).

Reply:
@table @samp
@item @code{m}@var{<id>}
A single thread id
@item @code{m}@var{<id>},@var{<id>@dots{}}
a comma-separated list of thread ids
@item @code{l}
(lower case 'el') denotes end of list.
@end table

In response to each query, the target will reply with a list of one or
more thread ids, in big-endian hex, separated by commas.  GDB will
respond to each reply with a request for more thread ids (using the
@code{qs} form of the query), until the target responds with @code{l}
(lower-case el, for @code{'last'}).

@item @code{q}@code{ThreadExtraInfo}@code{,}@var{id} --- extra thread info

Where @var{<id>} is a thread-id in big-endian hex.  Obtain a printable
string description of a thread's attributes from the target OS.  This
string may contain anything that the target OS thinks is interesting for
@value{GDBN} to tell the user about the thread.  The string is displayed
in @value{GDBN}'s @samp{info threads} display.  Some examples of
possible thread extra info strings are "Runnable", or "Blocked on
Mutex".

Reply:
@table @samp
@item @var{XX@dots{}}
Where @var{XX@dots{}} is a hex encoding of @sc{ascii} data, comprising
the printable string containing the extra information about the thread's
attributes.
@end table

@item @code{q}@code{L}@var{startflag}@var{threadcount}@var{nextthread} --- query @var{LIST} or @var{threadLIST} @strong{(deprecated)}

Obtain thread information from RTOS.  Where: @var{startflag} (one hex
digit) is one to indicate the first query and zero to indicate a
subsequent query; @var{threadcount} (two hex digits) is the maximum
number of threads the response packet can contain; and @var{nextthread}
(eight hex digits), for subsequent queries (@var{startflag} is zero), is
returned in the response as @var{argthread}.

NOTE: this query is replaced by the @code{q}@code{fThreadInfo} query
(see above).

Reply:
@table @samp
@item @code{q}@code{M}@var{count}@var{done}@var{argthread}@var{thread@dots{}}
Where: @var{count} (two hex digits) is the number of threads being
returned; @var{done} (one hex digit) is zero to indicate more threads
and one indicates no further threads; @var{argthreadid} (eight hex
digits) is @var{nextthread} from the request packet; @var{thread@dots{}}
is a sequence of thread IDs from the target.  @var{threadid} (eight hex
digits).  See @code{remote.c:parse_threadlist_response()}.
@end table

@item @code{q}@code{CRC:}@var{addr}@code{,}@var{length} --- compute CRC of memory block

Reply:
@table @samp
@item @code{E}@var{NN}
An error (such as memory fault)
@item @code{C}@var{CRC32}
A 32 bit cyclic redundancy check of the specified memory region.
@end table

@item @code{q}@code{Offsets} --- query sect offs

Get section offsets that the target used when re-locating the downloaded
image.  @emph{Note: while a @code{Bss} offset is included in the
response, @value{GDBN} ignores this and instead applies the @code{Data}
offset to the @code{Bss} section.}

Reply:
@table @samp
@item @code{Text=}@var{xxx}@code{;Data=}@var{yyy}@code{;Bss=}@var{zzz}
@end table

@item @code{q}@code{P}@var{mode}@var{threadid} --- thread info request

Returns information on @var{threadid}.  Where: @var{mode} is a hex
encoded 32 bit mode; @var{threadid} is a hex encoded 64 bit thread ID.

Reply:
@table @samp
@item *
@end table

See @code{remote.c:remote_unpack_thread_info_response()}.

@item @code{q}@code{Rcmd,}@var{COMMAND} --- remote command

@var{COMMAND} (hex encoded) is passed to the local interpreter for
execution.  Invalid commands should be reported using the output string.
Before the final result packet, the target may also respond with a
number of intermediate @code{O}@var{OUTPUT} console output packets.
@emph{Implementors should note that providing access to a stubs's
interpreter may have security implications}.

Reply:
@table @samp
@item OK
A command response with no output.
@item @var{OUTPUT}
A command response with the hex encoded output string @var{OUTPUT}.
@item @code{E}@var{NN}
Indicate a badly formed request.
@item @samp{}
When @samp{q}@samp{Rcmd} is not recognized.
@end table

@item @code{qSymbol::} --- symbol lookup

Notify the target that @value{GDBN} is prepared to serve symbol lookup
requests.  Accept requests from the target for the values of symbols.

Reply:
@table @samp
@item @code{OK}
The target does not need to look up any (more) symbols.
@item @code{qSymbol:}@var{sym_name}
The target requests the value of symbol @var{sym_name} (hex encoded).
@value{GDBN} may provide the value by using the
@code{qSymbol:}@var{sym_value}:@var{sym_name} message, described below.
@end table

@item @code{qSymbol:}@var{sym_value}:@var{sym_name} --- symbol value

Set the value of SYM_NAME to SYM_VALUE.

@var{sym_name} (hex encoded) is the name of a symbol whose value the
target has previously requested.

@var{sym_value} (hex) is the value for symbol @var{sym_name}.  If
@value{GDBN} cannot supply a value for @var{sym_name}, then this field
will be empty.

Reply:
@table @samp
@item @code{OK}
The target does not need to look up any (more) symbols.
@item @code{qSymbol:}@var{sym_name}
The target requests the value of a new symbol @var{sym_name} (hex
encoded).  @value{GDBN} will continue to supply the values of symbols
(if available), until the target ceases to request them.
@end table

@end table

@node Register Packet Format
@section Register Packet Format

The following @samp{g}/@samp{G} packets have previously been defined.
In the below, some thirty-two bit registers are transferred as
sixty-four bits.  Those registers should be zero/sign extended (which?)
to fill the space allocated.  Register bytes are transfered in target
byte order.  The two nibbles within a register byte are transfered
most-significant - least-significant.

@table @r

@item MIPS32

All registers are transfered as thirty-two bit quantities in the order:
32 general-purpose; sr; lo; hi; bad; cause; pc; 32 floating-point
registers; fsr; fir; fp.

@item MIPS64

All registers are transfered as sixty-four bit quantities (including
thirty-two bit registers such as @code{sr}).  The ordering is the same
as @code{MIPS32}.

@end table

@node Examples
@section Examples

Example sequence of a target being re-started.  Notice how the restart
does not get any direct output:

@smallexample
<- @code{R00}
-> @code{+}
@emph{target restarts}
<- @code{?}
-> @code{+}
-> @code{T001:1234123412341234}
<- @code{+}
@end smallexample

Example sequence of a target being stepped by a single instruction:

@smallexample
<- @code{G1445@dots{}}
-> @code{+}
<- @code{s}
-> @code{+}
@emph{time passes}
-> @code{T001:1234123412341234}
<- @code{+}
<- @code{g}
-> @code{+}
-> @code{1455@dots{}}
<- @code{+}
@end smallexample

