2 /* Simulator for the MIPS architecture.
4 This file is part of the MIPS sim
6 THIS SOFTWARE IS NOT COPYRIGHTED
8 Cygnus offers the following for use in the public domain. Cygnus
9 makes no warranty with regard to the software or it's performance
10 and the user accepts the software "AS IS" with all faults.
12 CYGNUS DISCLAIMS ANY WARRANTIES, EXPRESS OR IMPLIED, WITH REGARD TO
13 THIS SOFTWARE INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
14 MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22 We only need to take account of the target endianness when moving data
23 between the simulator and the host. We do not need to worry about the
24 endianness of the host, since this sim code and GDB are executing in
27 The IDT monitor (found on the VR4300 board), seems to lie about
28 register contents. It seems to treat the registers as sign-extended
29 32-bit values. This cause *REAL* problems when single-stepping 64-bit
34 /* The TRACE and PROFILE manifests enable the provision of extra
35 features. If they are not defined then a simpler (quicker)
36 simulator is constructed without the required run-time checks,
38 #if 1 /* 0 to allow user build selection, 1 to force inclusion */
52 #include "libiberty.h"
54 #include "remote-sim.h" /* GDB simulator interface */
55 #include "callback.h" /* GDB simulator callback interface */
57 #include "support.h" /* internal support manifests */
59 /* Get the simulator engine description, without including the code: */
64 /* The following reserved instruction value is used when a simulator
65 trap is required. NOTE: Care must be taken, since this value may be
66 used in later revisions of the MIPS ISA. */
67 #define RSVD_INSTRUCTION (0x7C000000)
68 #define RSVD_INSTRUCTION_AMASK (0x03FFFFFF)
70 /* NOTE: These numbers depend on the processor architecture being
73 #define TLBModification (1)
76 #define AddressLoad (4)
77 #define AddressStore (5)
78 #define InstructionFetch (6)
79 #define DataReference (7)
80 #define SystemCall (8)
81 #define BreakPoint (9)
82 #define ReservedInstruction (10)
83 #define CoProcessorUnusable (11)
84 #define IntegerOverflow (12) /* Arithmetic overflow (IDT monitor raises SIGFPE) */
89 /* The following exception code is actually private to the simulator
90 world. It is *NOT* a processor feature, and is used to signal
91 run-time errors in the simulator. */
92 #define SimulatorFault (0xFFFFFFFF)
94 /* The following are generic to all versions of the MIPS architecture
96 /* Memory Access Types (for CCA): */
98 #define CachedNoncoherent (1)
99 #define CachedCoherent (2)
102 #define isINSTRUCTION (1 == 0) /* FALSE */
103 #define isDATA (1 == 1) /* TRUE */
105 #define isLOAD (1 == 0) /* FALSE */
106 #define isSTORE (1 == 1) /* TRUE */
108 #define isREAL (1 == 0) /* FALSE */
109 #define isRAW (1 == 1) /* TRUE */
111 #define isTARGET (1 == 0) /* FALSE */
112 #define isHOST (1 == 1) /* TRUE */
114 /* The "AccessLength" specifications for Loads and Stores. NOTE: This
115 is the number of bytes minus 1. */
116 #define AccessLength_BYTE (0)
117 #define AccessLength_HALFWORD (1)
118 #define AccessLength_TRIPLEBYTE (2)
119 #define AccessLength_WORD (3)
120 #define AccessLength_QUINTIBYTE (4)
121 #define AccessLength_SEXTIBYTE (5)
122 #define AccessLength_SEPTIBYTE (6)
123 #define AccessLength_DOUBLEWORD (7)
126 /* FPU registers must be one of the following types. All other values
127 are reserved (and undefined). */
133 /* The following are well outside the normal acceptable format
134 range, and are used in the register status vector. */
135 fmt_unknown
= 0x10000000,
136 fmt_uninterpreted
= 0x20000000,
140 /* NOTE: We cannot avoid globals, since the GDB "sim_" interface does
141 not allow a private variable to be passed around. This means that
142 simulators under GDB can only be single-threaded. However, it would
143 be possible for the simulators to be multi-threaded if GDB allowed
144 for a private pointer to be maintained. i.e. a general "void **ptr"
145 variable that GDB passed around in the argument list to all of
146 sim_xxx() routines. It could be initialised to NULL by GDB, and
147 then updated by sim_open() and used by the other sim_xxx() support
148 functions. This would allow new features in the simulator world,
149 like storing a context - continuing execution to gather a result,
150 and then going back to the point where the context was saved and
151 changing some state before continuing. i.e. the ability to perform
152 UNDOs on simulations. It would also allow the simulation of
153 shared-memory multi-processor systems. */
155 static host_callback
*callback
= NULL
; /* handle onto the current callback structure */
157 /* The warning system should be improved, to allow more information to
158 be passed about the cause: */
159 #define WARNING(m) { callback->printf_filtered(callback,"SIM Warning: %s\n",(m)); }
161 /* This is nasty, since we have to rely on matching the register
162 numbers used by GDB. Unfortunately, depending on the MIPS target
163 GDB uses different register numbers. We cannot just include the
164 relevant "gdb/tm.h" link, since GDB may not be configured before
165 the sim world, and also the GDB header file requires too much other
167 /* TODO: Sort out a scheme for *KNOWING* the mapping between real
168 registers, and the numbers that GDB uses. At the moment due to the
169 order that the tools are built, we cannot rely on a configured GDB
170 world whilst constructing the simulator. This means we have to
171 assume the GDB register number mapping. */
172 #define LAST_EMBED_REGNUM (89)
174 /* To keep this default simulator simple, and fast, we use a direct
175 vector of registers. The internal simulator engine then uses
176 manifests to access the correct slot. */
177 ut_reg registers
[LAST_EMBED_REGNUM
+ 1];
178 int register_widths
[LAST_EMBED_REGNUM
+ 1];
180 #define GPR (®isters[0])
183 #define FGR (®isters[FGRIDX])
185 #define LO (registers[33])
186 #define HI (registers[34])
187 #define PC (registers[37])
188 #define CAUSE (registers[36])
190 #define SR (registers[SRIDX]) /* CPU status register */
192 #define FCR0 (registers[FCR0IDX]) /* really a 32bit register */
193 #define FCR31IDX (70)
194 #define FCR31 (registers[FCR31IDX]) /* really a 32bit register */
196 #define COCIDX (LAST_EMBED_REGNUM + 2) /* special case : outside the normal range */
198 /* The following are pseudonyms for standard registers */
199 #define ZERO (registers[0])
200 #define V0 (registers[2])
201 #define A0 (registers[4])
202 #define A1 (registers[5])
203 #define A2 (registers[6])
204 #define A3 (registers[7])
205 #define SP (registers[29])
206 #define RA (registers[31])
208 ut_reg EPC
= 0; /* Exception PC */
211 /* Keep the current format state for each register: */
212 FP_formats fpr_state
[32];
215 /* VR4300 CP0 configuration register: */
216 unsigned int CONFIG
= 0;
218 /* The following are internal simulator state variables: */
219 ut_reg IPC
= 0; /* internal Instruction PC */
220 ut_reg DSPC
= 0; /* delay-slot PC */
223 /* TODO : these should be the bitmasks for these bits within the
224 status register. At the moment the following are VR4300
226 #define status_KSU_mask (0x3) /* mask for KSU bits */
227 #define status_KSU_shift (3) /* shift for field */
228 #define ksu_kernel (0x0)
229 #define ksu_supervisor (0x1)
230 #define ksu_user (0x2)
231 #define ksu_unknown (0x3)
233 #define status_RE (1 << 25) /* Reverse Endian in user mode */
234 #define status_FR (1 << 26) /* enables MIPS III additional FP registers */
235 #define status_SR (1 << 20) /* soft reset or NMI */
236 #define status_BEV (1 << 22) /* Location of general exception vectors */
237 #define status_TS (1 << 21) /* TLB shutdown has occurred */
238 #define status_ERL (1 << 2) /* Error level */
239 #define status_RP (1 << 27) /* Reduced Power mode */
241 #define config_EP_mask (0xF)
242 #define config_EP_shift (27)
243 #define config_EP_D (0x0)
244 #define config_EP_DxxDxx (0x6)
246 #define config_BE (1 << 15)
248 #define cause_BD ((unsigned)1 << 31) /* Exception in branch delay slot */
251 /* Macro to update FPSR condition-code field. This is complicated by
252 the fact that there is a hole in the index range of the bits within
253 the FCSR register. Also, the number of bits visible depends on the
254 MIPS ISA version being supported. */
255 #define SETFCC(cc,v) {\
256 int bit = ((cc == 0) ? 23 : (24 + (cc)));\
257 FCSR = ((FCSR & ~(1 << bit)) | ((v) << bit));\
259 #define GETFCC(cc) (((((cc) == 0) ? (FCSR & (1 << 23)) : (FCSR & (1 << (24 + (cc))))) != 0) ? 1 : 0)
261 /* This should be the COC1 value at the start of the preceding
263 #define PREVCOC1() ((state & simPCOC1) ? 1 : 0)
266 /* Standard FCRS bits: */
267 #define IR (0) /* Inexact Result */
268 #define UF (1) /* UnderFlow */
269 #define OF (2) /* OverFlow */
270 #define DZ (3) /* Division by Zero */
271 #define IO (4) /* Invalid Operation */
272 #define UO (5) /* Unimplemented Operation */
274 /* Get masks for individual flags: */
275 #if 1 /* SAFE version */
276 #define FP_FLAGS(b) (((unsigned)(b) < 5) ? (1 << ((b) + 2)) : 0)
277 #define FP_ENABLE(b) (((unsigned)(b) < 5) ? (1 << ((b) + 7)) : 0)
278 #define FP_CAUSE(b) (((unsigned)(b) < 6) ? (1 << ((b) + 12)) : 0)
280 #define FP_FLAGS(b) (1 << ((b) + 2))
281 #define FP_ENABLE(b) (1 << ((b) + 7))
282 #define FP_CAUSE(b) (1 << ((b) + 12))
285 #define FP_FS (1 << 24) /* MIPS III onwards : Flush to Zero */
287 #define FP_MASK_RM (0x3)
289 #define FP_RM_NEAREST (0) /* Round to nearest (Round) */
290 #define FP_RM_TOZERO (1) /* Round to zero (Trunc) */
291 #define FP_RM_TOPINF (2) /* Round to Plus infinity (Ceil) */
292 #define FP_RM_TOMINF (3) /* Round to Minus infinity (Floor) */
293 #define GETRM() (int)((FCSR >> FP_SH_RM) & FP_MASK_RM)
295 /* Slots for delayed register updates. For the moment we just have a
296 fixed number of slots (rather than a more generic, dynamic
297 system). This keeps the simulator fast. However, we only allow for
298 the register update to be delayed for a single instruction
300 #define PSLOTS (5) /* Maximum number of instruction cycles */
304 int pending_slot_count
[PSLOTS
];
305 int pending_slot_reg
[PSLOTS
];
306 ut_reg pending_slot_value
[PSLOTS
];
308 /* The following are not used for MIPS IV onwards: */
309 #define PENDING_FILL(r,v) {\
310 printf("DBG: FILL BEFORE pending_in = %d, pending_out = %d, pending_total = %d\n",pending_in,pending_out,pending_total);\
311 if (pending_slot_reg[pending_in] != (LAST_EMBED_REGNUM + 1))\
312 callback->printf_filtered(callback,"SIM Warning: Attempt to over-write pending value\n");\
313 pending_slot_count[pending_in] = 2;\
314 pending_slot_reg[pending_in] = (r);\
315 pending_slot_value[pending_in] = (uword64)(v);\
316 printf("DBG: FILL reg %d value = 0x%08X%08X\n",(r),WORD64HI(v),WORD64LO(v));\
319 if (pending_in == PSLOTS)\
321 printf("DBG: FILL AFTER pending_in = %d, pending_out = %d, pending_total = %d\n",pending_in,pending_out,pending_total);\
325 /* LLBIT = Load-Linked bit. A bit of "virtual" state used by atomic
326 read-write instructions. It is set when a linked load occurs. It is
327 tested and cleared by the conditional store. It is cleared (during
328 other CPU operations) when a store to the location would no longer
329 be atomic. In particular, it is cleared by exception return
334 /* The HIACCESS and LOACCESS counts are used to ensure that
335 corruptions caused by using the HI or LO register to close to a
336 following operation are spotted. */
338 /* If either of the preceding two instructions have accessed the HI or
339 LO registers, then the values they see should be
340 undefined. However, to keep the simulator world simple, we just let
341 them use the value read and raise a warning to notify the user: */
342 #define CHECKHILO(s) {\
343 if ((HIACCESS != 0) || (LOACCESS != 0))\
344 callback->printf_filtered(callback,"SIM Warning: %s over-writing HI and LO registers values\n",(s));\
345 /* Set the access counts, since we are about\
346 to update the HI and LO registers: */\
347 HIACCESS = LOACCESS = 3; /* 3rd instruction will be safe */\
350 /* NOTE: We keep the following status flags as bit values (1 for true,
351 0 for false). This allows them to be used in binary boolean
352 operations without worrying about what exactly the non-zero true
356 #define UserMode ((((SR & status_KSU_mask) >> status_KSU_shift) == ksu_user) ? 1 : 0)
359 /* Hardware configuration. Affects endianness of LoadMemory and
360 StoreMemory and the endianness of Kernel and Supervisor mode
361 execution. The value is 0 for little-endian; 1 for big-endian. */
362 #define BigEndianMem ((CONFIG & config_BE) ? 1 : 0)
363 /* NOTE: Problems will occur if the simulator memory model does not
364 match the host program expectation. i.e. if the host is writing
365 big-endian values to a little-endian memory model. */
368 /* This mode is selected if in User mode with the RE bit being set in
369 SR (Status Register). It reverses the endianness of load and store
371 #define ReverseEndian (((SR & status_RE) && UserMode) ? 1 : 0)
374 /* The endianness for load and store instructions (0=little;1=big). In
375 User mode this endianness may be switched by setting the state_RE
376 bit in the SR register. Thus, BigEndianCPU may be computed as
377 (BigEndienMem EOR ReverseEndian). */
378 #define BigEndianCPU (BigEndianMem ^ ReverseEndian) /* Already bits */
380 #if !defined(FASTSIM) || defined(PROFILE)
381 /* At the moment these values will be the same, since we do not have
382 access to the pipeline cycle count information from the simulator
384 unsigned int instruction_fetches
= 0;
385 unsigned int pipeline_ticks
= 0;
388 /* Flags in the "state" variable: */
389 #define simSTOP (1 << 0) /* 0 = execute; 1 = stop simulation */
390 #define simSTEP (1 << 1) /* 0 = run; 1 = single-step */
391 #define simHALTEX (1 << 2) /* 0 = run; 1 = halt on exception */
392 #define simHALTIN (1 << 3) /* 0 = run; 1 = halt on interrupt */
393 #define simTRACE (1 << 8) /* 0 = do nothing; 1 = trace address activity */
394 #define simPROFILE (1 << 9) /* 0 = do nothing; 1 = gather profiling samples */
395 #define simHOSTBE (1 << 10) /* 0 = little-endian; 1 = big-endian (host endianness) */
396 /* Whilst simSTOP is not set, the simulator control loop should just
397 keep simulating instructions. The simSTEP flag is used to force
398 single-step execution. */
399 #define simBE (1 << 16) /* 0 = little-endian; 1 = big-endian (target endianness) */
400 #define simPCOC0 (1 << 17) /* COC[1] from current */
401 #define simPCOC1 (1 << 18) /* COC[1] from previous */
402 #define simDELAYSLOT (1 << 24) /* 0 = do nothing; 1 = delay slot entry exists */
403 #define simSKIPNEXT (1 << 25) /* 0 = do nothing; 1 = skip instruction */
404 #define simEXCEPTION (1 << 26) /* 0 = no exception; 1 = exception has occurred */
405 #define simEXIT (1 << 27) /* 0 = do nothing; 1 = run-time exit() processing */
407 unsigned int state
= (0 | simBE
); /* big-endian simulator by default */
408 unsigned int rcexit
= 0; /* _exit() reason code holder */
410 #define DELAYSLOT() {\
411 if (state & simDELAYSLOT) callback->printf_filtered(callback,"SIM Warning: Delay slot already activated (branch in delay slot?)\n");\
412 state |= simDELAYSLOT;\
416 state &= ~simDELAYSLOT;\
417 state |= simSKIPNEXT;\
420 /* Very simple memory model to start with: */
421 unsigned char *membank
= NULL
;
422 ut_reg membank_base
= 0xA0000000;
423 unsigned membank_size
= (1 << 20); /* (16 << 20); */ /* power-of-2 */
425 /* Simple run-time monitor support */
426 unsigned char *monitor
= NULL
;
427 ut_reg monitor_base
= 0xBFC00000;
428 unsigned monitor_size
= (1 << 11); /* power-of-2 */
431 char *tracefile
= "trace.din"; /* default filename for trace log */
432 FILE *tracefh
= NULL
;
436 unsigned profile_frequency
= 256;
437 unsigned profile_nsamples
= (128 << 10);
438 unsigned short *profile_hist
= NULL
;
439 ut_reg profile_minpc
;
440 ut_reg profile_maxpc
;
441 int profile_shift
= 0; /* address shift amount */
444 /*---------------------------------------------------------------------------*/
445 /*-- GDB simulator interface ------------------------------------------------*/
446 /*---------------------------------------------------------------------------*/
448 static void dotrace
PARAMS((FILE *tracefh
,int type
,unsigned int address
,int width
,char *comment
,...));
449 extern void sim_error
PARAMS((char *fmt
,...));
450 static void ColdReset
PARAMS((void));
451 static int AddressTranslation
PARAMS((uword64 vAddr
,int IorD
,int LorS
,uword64
*pAddr
,int *CCA
,int host
,int raw
));
452 static void StoreMemory
PARAMS((int CCA
,int AccessLength
,uword64 MemElem
,uword64 pAddr
,uword64 vAddr
,int raw
));
453 static uword64 LoadMemory
PARAMS((int CCA
,int AccessLength
,uword64 pAddr
,uword64 vAddr
,int IorD
,int raw
));
454 static void SignalException
PARAMS((int exception
,...));
455 static void simulate
PARAMS((void));
456 static long getnum(char *value
);
457 extern void sim_size(unsigned int newsize
);
458 extern void sim_set_profile(int frequency
);
459 static unsigned int power2(unsigned int value
);
465 if (callback
== NULL
) {
466 fprintf(stderr
,"SIM Error: sim_open() called without callbacks attached\n");
470 /* The following ensures that the standard file handles for stdin,
471 stdout and stderr are initialised: */
472 callback
->init(callback
);
476 if (state
& simEXCEPTION
) {
477 fprintf(stderr
,"This simulator is not suitable for this host configuration\n");
483 if (*((char *)&data
) != 0x12)
484 state
|= simHOSTBE
; /* big-endian host */
488 /* Check that the host FPU conforms to IEEE 754-1985 for the SINGLE
489 and DOUBLE binary formats. This is a bit nasty, requiring that we
490 trust the explicit manifests held in the source: */
495 if (((float)4.01102924346923828125 != *(float *)s
) || ((double)523.2939453125 != *(double *)s
)) {
496 fprintf(stderr
,"The host executing the simulator does not seem to have IEEE 754-1985 std FP\n");
497 fprintf(stderr
,"*(float *)s = %f (4.01102924346923828125)\n",*(float *)s
);
498 fprintf(stderr
,"*(double *)s = %f (523.2939453125)\n",*(double *)s
);
504 /* This is NASTY, in that we are assuming the size of specific
508 for (rn
= 0; (rn
< (LAST_EMBED_REGNUM
+ 1)); rn
++) {
510 register_widths
[rn
] = GPRLEN
;
511 else if ((rn
>= FGRIDX
) && (rn
< (FGRIDX
+ 32)))
512 register_widths
[rn
] = GPRLEN
;
513 else if ((rn
>= 33) && (rn
<= 37))
514 register_widths
[rn
] = GPRLEN
;
515 else if ((rn
== SRIDX
) || (rn
== FCR0IDX
) || (rn
== FCR31IDX
) || ((rn
>= 72) && (rn
<= 89)))
516 register_widths
[rn
] = 32;
518 register_widths
[rn
] = 0;
522 /* It would be good if we could select particular named MIPS
523 architecture simulators. However, having a pre-built, fixed
524 engine would mean including multiple engines. If the simulator is
525 changed to a run-time conditional version, then the ability to
526 select a particular architecture would be straightforward. */
532 static struct option cmdline
[] = {
535 {"profile", 0,0,'p'},
538 {"tracefile",1,0,'z'},
539 {"frequency",1,0,'y'},
540 {"samples", 1,0,'x'},
544 /* Unfortunately, getopt_long() is designed to be used with
545 vectors, where the first option is normally program name (and
546 ignored). We cheat by creating a dummy first argument, so that
547 we can use the standard argument processing. */
548 #define DUMMYARG "simulator "
549 cline
= (char *)malloc(strlen(args
) + strlen(DUMMYARG
) + 1);
551 fprintf(stderr
,"Failed to allocate memory for command line buffer\n");
554 sprintf(cline
,"%s%s",DUMMYARG
,args
);
555 argv
= buildargv(cline
);
556 for (argc
= 0; argv
[argc
]; argc
++);
558 /* Unfortunately, getopt_long() assumes that it is ignoring the
559 first argument (normally the program name). This means it
560 ignores the first option on our "args" line. */
561 optind
= 0; /* Force reset of argument processing */
563 int option_index
= 0;
565 c
= getopt_long(argc
,argv
,"hn:s:tp",cmdline
,&option_index
);
571 callback
->printf_filtered(callback
,"Usage:\n\t\
572 target sim [-h] [--name=<model>] [--size=<amount>]");
574 callback
->printf_filtered(callback
," [-t [--tracefile=<name>]]");
577 callback
->printf_filtered(callback
," [-p [--frequency=<count>] [--samples=<count>]]");
579 callback
->printf_filtered(callback
,"\n");
583 callback
->printf_filtered(callback
,"Explicit model selection not yet available (Ignoring \"%s\")\n",optarg
);
587 membank_size
= (unsigned)getnum(optarg
);
592 /* Eventually the simTRACE flag could be treated as a toggle, to
593 allow external control of the program points being traced
594 (i.e. only from main onwards, excluding the run-time setup,
599 Simulator constructed without tracing support (for performance).\n\
600 Re-compile simulator with \"-DTRACE\" to enable this option.\n");
606 if (optarg
!= NULL
) {
608 tmp
= (char *)malloc(strlen(optarg
) + 1);
610 callback
->printf_filtered(callback
,"Failed to allocate buffer for tracefile name \"%s\"\n",optarg
);
614 callback
->printf_filtered(callback
,"Placing trace information into file \"%s\"\n",tracefile
);
625 Simulator constructed without profiling support (for performance).\n\
626 Re-compile simulator with \"-DPROFILE\" to enable this option.\n");
627 #endif /* !PROFILE */
632 profile_nsamples
= (unsigned)getnum(optarg
);
638 sim_set_profile((int)getnum(optarg
));
643 callback
->printf_filtered(callback
,"Warning: Simulator getopt returned unrecognised code 0x%08X\n",c
);
650 callback
->printf_filtered(callback
,"Warning: Ignoring spurious non-option arguments ");
651 while (optind
< argc
)
652 callback
->printf_filtered(callback
,"\"%s\" ",argv
[optind
++]);
653 callback
->printf_filtered(callback
,"\n");
659 /* If the host has "mmap" available we could use it to provide a
660 very large virtual address space for the simulator, since memory
661 would only be allocated within the "mmap" space as it is
662 accessed. This can also be linked to the architecture specific
663 support, required to simulate the MMU. */
664 sim_size(membank_size
);
665 /* NOTE: The above will also have enabled any profiling state */
668 /* If we were providing a more complete I/O, co-processor or memory
669 simulation, we should perform any "device" initialisation at this
670 point. This can include pre-loading memory areas with particular
671 patterns (e.g. simulating ROM monitors). */
673 /* We can start writing to the memory, now that the processor has
675 monitor
= (unsigned char *)calloc(1,monitor_size
);
677 fprintf(stderr
,"Not enough VM for monitor simulation (%d bytes)\n",monitor_size
);
680 /* TODO: Provide support for PMON monitor */
681 /* Entry into the IDT monitor is via fixed address vectors, and
682 not using machine instructions. To avoid clashing with use of
683 the MIPS TRAP system, we place our own (simulator specific)
684 "undefined" instructions into the relevant vector slots. */
685 for (loop
= 0; (loop
< monitor_size
); loop
+= 4) {
686 uword64 vaddr
= (monitor_base
+ loop
);
689 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
))
690 StoreMemory(cca
,AccessLength_WORD
,(RSVD_INSTRUCTION
| ((loop
>> 2) & RSVD_INSTRUCTION_AMASK
)),paddr
,vaddr
,isRAW
);
695 if (state
& simTRACE
) {
696 tracefh
= fopen(tracefile
,"wb+");
697 if (tracefh
== NULL
) {
698 callback
->printf_filtered(callback
,"Failed to create file \"%s\", writing trace information to stderr.\n",tracefile
);
707 /* For the profile writing, we write the data in the host
708 endianness. This unfortunately means we are assuming that the
709 profile file we create is processed on the same host executing the
710 simulator. The gmon.out file format should either have an explicit
711 endianness, or a method of encoding the endianness in the file
721 if (state
& simHOSTBE
) {
722 buff
[3] = ((val
>> 0) & 0xFF);
723 buff
[2] = ((val
>> 8) & 0xFF);
724 buff
[1] = ((val
>> 16) & 0xFF);
725 buff
[0] = ((val
>> 24) & 0xFF);
727 buff
[0] = ((val
>> 0) & 0xFF);
728 buff
[1] = ((val
>> 8) & 0xFF);
729 buff
[2] = ((val
>> 16) & 0xFF);
730 buff
[3] = ((val
>> 24) & 0xFF);
732 if (fwrite(buff
,4,1,fh
) != 1) {
733 callback
->printf_filtered(callback
,"Failed to write 4bytes to the profile file\n");
746 if (state
& simHOSTBE
) {
747 buff
[1] = ((val
>> 0) & 0xFF);
748 buff
[0] = ((val
>> 8) & 0xFF);
750 buff
[0] = ((val
>> 0) & 0xFF);
751 buff
[1] = ((val
>> 8) & 0xFF);
753 if (fwrite(buff
,2,1,fh
) != 1) {
754 callback
->printf_filtered(callback
,"Failed to write 2bytes to the profile file\n");
765 printf("DBG: sim_close: entered (quitting = %d)\n",quitting
);
768 /* Cannot assume sim_kill() has been called */
769 /* "quitting" is non-zero if we cannot hang on errors */
771 /* Ensure that any resources allocated through the callback
772 mechanism are released: */
773 callback
->shutdown(callback
);
776 if ((state
& simPROFILE
) && (profile_hist
!= NULL
)) {
777 unsigned short *p
= profile_hist
;
778 FILE *pf
= fopen("gmon.out","wb");
782 callback
->printf_filtered(callback
,"Failed to open \"gmon.out\" profile file\n");
786 printf("DBG: minpc = 0x%08X\n",(unsigned int)profile_minpc
);
787 printf("DBG: maxpc = 0x%08X\n",(unsigned int)profile_maxpc
);
789 ok
= writeout32(pf
,(unsigned int)profile_minpc
);
791 ok
= writeout32(pf
,(unsigned int)profile_maxpc
);
793 ok
= writeout32(pf
,(profile_nsamples
* 2) + 12); /* size of sample buffer (+ header) */
795 printf("DBG: nsamples = %d (size = 0x%08X)\n",profile_nsamples
,((profile_nsamples
* 2) + 12));
797 for (loop
= 0; (ok
&& (loop
< profile_nsamples
)); loop
++) {
798 ok
= writeout16(pf
,profile_hist
[loop
]);
808 state
&= ~simPROFILE
;
813 if (tracefh
!= stderr
)
819 free(membank
); /* cfree not available on all hosts */
826 sim_resume (step
,signal
)
830 printf("DBG: sim_resume entered: step = %d, signal = %d (membank = 0x%08X)\n",step
,signal
,membank
);
834 state
|= simSTEP
; /* execute only a single instruction */
836 state
&= ~(simSTOP
| simSTEP
); /* execute until event */
838 state
|= (simHALTEX
| simHALTIN
); /* treat interrupt event as exception */
840 /* Start executing instructions from the current state (set
841 explicitly by register updates, or by sim_create_inferior): */
848 sim_write (addr
,buffer
,size
)
850 unsigned char *buffer
;
854 uword64 vaddr
= (uword64
)addr
;
856 /* Return the number of bytes written, or zero if error. */
858 callback
->printf_filtered(callback
,"sim_write(0x%08X%08X,buffer,%d);\n",WORD64HI(addr
),WORD64LO(addr
),size
);
861 /* We provide raw read and write routines, since we do not want to
862 count the GDB memory accesses in our statistics gathering. */
864 /* There is a lot of code duplication in the individual blocks
865 below, but the variables are declared locally to a block to give
866 the optimiser the best chance of improving the code. We have to
867 perform slow byte reads from the host memory, to ensure that we
868 get the data into the correct endianness for the (simulated)
869 target memory world. */
871 /* Mask count to get odd byte, odd halfword, and odd word out of the
872 way. We can then perform doubleword transfers to and from the
873 simulator memory for optimum performance. */
874 if (index
&& (index
& 1)) {
877 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
878 uword64 value
= ((uword64
)(*buffer
++));
879 StoreMemory(cca
,AccessLength_BYTE
,value
,paddr
,vaddr
,isRAW
);
882 index
&= ~1; /* logical operations usually quicker than arithmetic on RISC systems */
884 if (index
&& (index
& 2)) {
887 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
889 /* We need to perform the following magic to ensure that that
890 bytes are written into same byte positions in the target memory
891 world, regardless of the endianness of the host. */
893 value
= ((uword64
)(*buffer
++) << 8);
894 value
|= ((uword64
)(*buffer
++) << 0);
896 value
= ((uword64
)(*buffer
++) << 0);
897 value
|= ((uword64
)(*buffer
++) << 8);
899 StoreMemory(cca
,AccessLength_HALFWORD
,value
,paddr
,vaddr
,isRAW
);
904 if (index
&& (index
& 4)) {
907 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
910 value
= ((uword64
)(*buffer
++) << 24);
911 value
|= ((uword64
)(*buffer
++) << 16);
912 value
|= ((uword64
)(*buffer
++) << 8);
913 value
|= ((uword64
)(*buffer
++) << 0);
915 value
= ((uword64
)(*buffer
++) << 0);
916 value
|= ((uword64
)(*buffer
++) << 8);
917 value
|= ((uword64
)(*buffer
++) << 16);
918 value
|= ((uword64
)(*buffer
++) << 24);
920 StoreMemory(cca
,AccessLength_WORD
,value
,paddr
,vaddr
,isRAW
);
925 for (;index
; index
-= 8) {
928 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
931 value
= ((uword64
)(*buffer
++) << 56);
932 value
|= ((uword64
)(*buffer
++) << 48);
933 value
|= ((uword64
)(*buffer
++) << 40);
934 value
|= ((uword64
)(*buffer
++) << 32);
935 value
|= ((uword64
)(*buffer
++) << 24);
936 value
|= ((uword64
)(*buffer
++) << 16);
937 value
|= ((uword64
)(*buffer
++) << 8);
938 value
|= ((uword64
)(*buffer
++) << 0);
940 value
= ((uword64
)(*buffer
++) << 0);
941 value
|= ((uword64
)(*buffer
++) << 8);
942 value
|= ((uword64
)(*buffer
++) << 16);
943 value
|= ((uword64
)(*buffer
++) << 24);
944 value
|= ((uword64
)(*buffer
++) << 32);
945 value
|= ((uword64
)(*buffer
++) << 40);
946 value
|= ((uword64
)(*buffer
++) << 48);
947 value
|= ((uword64
)(*buffer
++) << 56);
949 StoreMemory(cca
,AccessLength_DOUBLEWORD
,value
,paddr
,vaddr
,isRAW
);
958 sim_read (addr
,buffer
,size
)
960 unsigned char *buffer
;
965 /* Return the number of bytes read, or zero if error. */
967 callback
->printf_filtered(callback
,"sim_read(0x%08X%08X,buffer,%d);\n",WORD64HI(addr
),WORD64LO(addr
),size
);
970 /* TODO: Perform same optimisation as the sim_write() code
971 above. NOTE: This will require a bit more work since we will need
972 to ensure that the source physical address is doubleword aligned
973 before, and then deal with trailing bytes. */
974 for (index
= 0; (index
< size
); index
++) {
975 uword64 vaddr
,paddr
,value
;
977 vaddr
= (uword64
)addr
+ index
;
978 if (AddressTranslation(vaddr
,isDATA
,isLOAD
,&paddr
,&cca
,isTARGET
,isRAW
)) {
979 value
= LoadMemory(cca
,AccessLength_BYTE
,paddr
,vaddr
,isDATA
,isRAW
);
980 buffer
[index
] = (unsigned char)(value
&0xFF);
989 sim_store_register (rn
,memory
)
991 unsigned char *memory
;
994 callback
->printf_filtered(callback
,"sim_store_register(%d,*memory=0x%08X%08X);\n",rn
,*((unsigned int *)memory
),*((unsigned int *)(memory
+ 4)));
997 /* Unfortunately this suffers from the same problem as the register
998 numbering one. We need to know what the width of each logical
999 register number is for the architecture being simulated. */
1000 if (register_widths
[rn
] == 0)
1001 callback
->printf_filtered(callback
,"Warning: Invalid register width for %d (register store ignored)\n",rn
);
1003 if (register_widths
[rn
] == 32)
1004 registers
[rn
] = *((unsigned int *)memory
);
1006 registers
[rn
] = *((uword64
*)memory
);
1013 sim_fetch_register (rn
,memory
)
1015 unsigned char *memory
;
1018 callback
->printf_filtered(callback
,"sim_fetch_register(%d=0x%08X%08X,mem) : place simulator registers into memory\n",rn
,WORD64HI(registers
[rn
]),WORD64LO(registers
[rn
]));
1021 if (register_widths
[rn
] == 0)
1022 callback
->printf_filtered(callback
,"Warning: Invalid register width for %d (register fetch ignored)\n",rn
);
1024 if (register_widths
[rn
] == 32)
1025 *((unsigned int *)memory
) = (registers
[rn
] & 0xFFFFFFFF);
1026 else /* 64bit register */
1027 *((uword64
*)memory
) = registers
[rn
];
1033 sim_stop_reason (reason
,sigrc
)
1034 enum sim_stop
*reason
;
1037 /* We can have "*reason = {sim_exited, sim_stopped, sim_signalled}", so
1038 sim_exited *sigrc = argument to exit()
1039 sim_stopped *sigrc = exception number
1040 sim_signalled *sigrc = signal number
1042 if (state
& simEXCEPTION
) {
1043 /* If "sim_signalled" is used, GDB expects normal SIGNAL numbers,
1044 and not the MIPS specific exception codes. */
1046 /* For some reason, sending GDB a sim_signalled reason cause it to
1048 *reason
= sim_stopped
;
1050 *reason
= sim_signalled
;
1052 switch ((CAUSE
>> 2) & 0x1F) {
1054 *sigrc
= SIGINT
; /* wrong type of interrupt, but it will do for the moment */
1057 case TLBModification
:
1062 case InstructionFetch
:
1067 case ReservedInstruction
:
1068 case CoProcessorUnusable
:
1072 case IntegerOverflow
:
1084 default : /* Unknown internal exception */
1088 } else if (state
& simEXIT
) {
1089 printf("DBG: simEXIT (%d)\n",rcexit
);
1090 *reason
= sim_exited
;
1092 } else { /* assume single-stepping */
1093 *reason
= sim_stopped
;
1096 state
&= ~(simEXCEPTION
| simEXIT
);
1104 /* Accessed from the GDB "info files" command: */
1106 callback
->printf_filtered(callback
,"MIPS %d-bit simulator\n",(PROCESSOR_64BIT
? 64 : 32));
1108 callback
->printf_filtered(callback
,"%s endian memory model\n",(BigEndianMem
? "Big" : "Little"));
1110 callback
->printf_filtered(callback
,"0x%08X bytes of memory at 0x%08X%08X\n",(unsigned int)membank_size
,WORD64HI(membank_base
),WORD64LO(membank_base
));
1112 #if !defined(FASTSIM)
1113 callback
->printf_filtered(callback
,"Instruction fetches = %d\n",instruction_fetches
);
1114 callback
->printf_filtered(callback
,"Pipeline ticks = %d\n",pipeline_ticks
);
1115 /* It would be a useful feature, if when performing multi-cycle
1116 simulations (rather than single-stepping) we keep the start and
1117 end times of the execution, so that we can give a performance
1118 figure for the simulator. */
1119 #endif /* !FASTSIM */
1121 /* print information pertaining to MIPS ISA and architecture being simulated */
1122 /* things that may be interesting */
1123 /* instructions executed - if available */
1124 /* cycles executed - if available */
1125 /* pipeline stalls - if available */
1126 /* virtual time taken */
1127 /* profiling size */
1128 /* profiling frequency */
1136 sim_load (prog
,from_tty
)
1140 /* Return non-zero if the caller should handle the load. Zero if
1141 we have loaded the image. */
1146 sim_create_inferior (start_address
,argv
,env
)
1147 SIM_ADDR start_address
;
1152 printf("DBG: sim_create_inferior entered: start_address = 0x%08X\n",start_address
);
1155 /* Prepare to execute the program to be simulated */
1156 /* argv and env are NULL terminated lists of pointers */
1159 PC
= (uword64
)start_address
;
1161 /* TODO: Sort this properly. SIM_ADDR may already be a 64bit value: */
1162 PC
= SIGNEXTEND(start_address
,32);
1164 /* NOTE: GDB normally sets the PC explicitly. However, this call is
1165 used by other clients of the simulator. */
1168 callback
->printf_filtered(callback
,"sim_create_inferior() : passed arguments ignored\n");
1169 #if 1 /* def DEBUG */
1172 for (cptr
= argv
; (cptr
&& *cptr
); cptr
++)
1173 printf("DBG: arg \"%s\"\n",*cptr
);
1176 /* We should really place the argv slot values into the argument
1177 registers, and onto the stack as required. However, this
1178 assumes that we have a stack defined, which is not necessarily
1179 true at the moment. */
1189 /* This routine should be for terminating any existing simulation
1190 thread. Since we are single-threaded only at the moment, this is
1191 not an issue. It should *NOT* be used to terminate the
1193 #else /* do *NOT* call sim_close */
1194 sim_close(1); /* Do not hang on errors */
1195 /* This would also be the point where any memory mapped areas used
1196 by the simulator should be released. */
1202 sim_get_quit_code ()
1204 /* The standard MIPS PCS (Procedure Calling Standard) uses V0(r2) as
1205 the function return value. However, it may be more correct for
1206 this to return the argument to the exit() function (if
1212 sim_set_callbacks (p
)
1219 typedef enum {e_terminate
,e_help
,e_setmemsize
,e_reset
} e_cmds
;
1221 static struct t_sim_command
{
1225 } sim_commands
[] = {
1226 {e_help
, "help", ": Show MIPS simulator private commands"},
1227 {e_setmemsize
,"set-memory-size","<n> : Specify amount of memory simulated"},
1228 {e_reset
, "reset-system", ": Reset the simulated processor"},
1233 sim_do_command (cmd
)
1236 struct t_sim_command
*cptr
;
1238 if (!(cmd
&& *cmd
!= '\0'))
1241 /* NOTE: Accessed from the GDB "sim" commmand: */
1242 for (cptr
= sim_commands
; cptr
&& cptr
->name
; cptr
++)
1243 if (strncmp(cmd
,cptr
->name
,strlen(cptr
->name
)) == 0) {
1244 cmd
+= strlen(cptr
->name
);
1246 case e_help
: /* no arguments */
1247 { /* no arguments */
1248 struct t_sim_command
*lptr
;
1249 callback
->printf_filtered(callback
,"List of MIPS simulator commands:\n");
1250 for (lptr
= sim_commands
; lptr
->name
; lptr
++)
1251 callback
->printf_filtered(callback
,"%s %s\n",lptr
->name
,lptr
->help
);
1255 case e_setmemsize
: /* memory size argument */
1257 unsigned int newsize
= (unsigned int)getnum(cmd
);
1262 case e_reset
: /* no arguments */
1264 /* NOTE: See the comments in sim_open() relating to device
1269 callback
->printf_filtered(callback
,"FATAL: Matched \"%s\", but failed to match command id %d.\n",cmd
,cptr
->id
);
1276 callback
->printf_filtered(callback
,"Error: \"%s\" is not a valid MIPS simulator command.\n",cmd
);
1281 /*---------------------------------------------------------------------------*/
1282 /* NOTE: The following routines do not seem to be used by GDB at the
1283 moment. However, they may be useful to the standalone simulator
1287 /* The profiling format is described in the "gmon_out.h" header file */
1292 #if defined(PROFILE)
1293 profile_frequency
= n
;
1294 state
|= simPROFILE
;
1295 #endif /* PROFILE */
1300 sim_set_profile_size (n
)
1303 #if defined(PROFILE)
1304 if (state
& simPROFILE
) {
1307 /* Since we KNOW that the memory banks are a power-of-2 in size: */
1308 profile_nsamples
= power2(n
);
1309 profile_minpc
= membank_base
;
1310 profile_maxpc
= (membank_base
+ membank_size
);
1312 /* Just in-case we are sampling every address: NOTE: The shift
1313 right of 2 is because we only have word-aligned PC addresses. */
1314 if (profile_nsamples
> (membank_size
>> 2))
1315 profile_nsamples
= (membank_size
>> 2);
1317 /* Since we are dealing with power-of-2 values: */
1318 profile_shift
= (((membank_size
>> 2) / profile_nsamples
) - 1);
1320 bsize
= (profile_nsamples
* sizeof(unsigned short));
1321 if (profile_hist
== NULL
)
1322 profile_hist
= (unsigned short *)calloc(64,(bsize
/ 64));
1324 profile_hist
= (unsigned short *)realloc(profile_hist
,bsize
);
1325 if (profile_hist
== NULL
) {
1326 callback
->printf_filtered(callback
,"Failed to allocate VM for profiling buffer (0x%08X bytes)\n",bsize
);
1327 state
&= ~simPROFILE
;
1330 #endif /* PROFILE */
1337 unsigned int newsize
;
1340 /* Used by "run", and internally, to set the simulated memory size */
1341 newsize
= power2(newsize
);
1342 if (membank
== NULL
)
1343 new = (char *)calloc(64,(membank_size
/ 64));
1345 new = (char *)realloc(membank
,newsize
);
1347 if (membank
== NULL
)
1348 callback
->printf_filtered(callback
,"Not enough VM for simulation memory of 0x%08X bytes\n",membank_size
);
1350 callback
->printf_filtered(callback
,"Failed to resize memory (still 0x%08X bytes)\n",membank_size
);
1352 membank_size
= (unsigned)newsize
;
1354 callback
->printf_filtered(callback
,"Memory size now 0x%08X bytes\n",membank_size
);
1355 #if defined(PROFILE)
1356 /* Ensure that we sample across the new memory range */
1357 sim_set_profile_size(profile_nsamples
);
1358 #endif /* PROFILE */
1367 /* This routine is called by the "run" program, when detailed
1368 execution information is required. Rather than executing a single
1369 instruction, and looping around externally... we just start
1370 simulating, returning TRUE when the simulator stops (for whatever
1374 /* Ensure tracing is enabled, if available */
1375 if (tracefh
!= NULL
)
1379 state
&= ~(simSTOP
| simSTEP
); /* execute until event */
1380 state
|= (simHALTEX
| simHALTIN
); /* treat interrupt event as exception */
1381 /* Start executing instructions from the current state (set
1382 explicitly by register updates, or by sim_create_inferior): */
1388 /*---------------------------------------------------------------------------*/
1389 /*-- Private simulator support interface ------------------------------------*/
1390 /*---------------------------------------------------------------------------*/
1392 /* Simple monitor interface (currently setup for the IDT monitor) */
1395 unsigned int reason
;
1397 /* The IDT monitor actually allows two instructions per vector
1398 slot. However, the simulator currently causes a trap on each
1399 individual instruction. We cheat, and lose the bottom bit. */
1402 /* The following callback functions are available, however the
1403 monitor we are simulating does not make use of them: get_errno,
1404 isatty, lseek, rename, system, time and unlink */
1406 case 6: /* int open(char *path,int flags) */
1411 if (AddressTranslation(A0
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
))
1412 V0
= callback
->open(callback
,(char *)((int)paddr
),(int)A1
);
1414 callback
->printf_filtered(callback
,"WARNING: Attempt to pass pointer that does not reference simulated memory\n");
1418 case 7: /* int read(int file,char *ptr,int len) */
1423 if (AddressTranslation(A1
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
))
1424 V0
= callback
->read(callback
,(int)A0
,(char *)((int)paddr
),(int)A2
);
1426 callback
->printf_filtered(callback
,"WARNING: Attempt to pass pointer that does not reference simulated memory\n");
1430 case 8: /* int write(int file,char *ptr,int len) */
1435 if (AddressTranslation(A1
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
))
1436 V0
= callback
->write(callback
,(int)A0
,(const char *)((int)paddr
),(int)A2
);
1438 callback
->printf_filtered(callback
,"WARNING: Attempt to pass pointer that does not reference simulated memory\n");
1442 case 10: /* int close(int file) */
1443 V0
= callback
->close(callback
,(int)A0
);
1446 case 11: /* char inbyte(void) */
1449 if (callback
->read_stdin(callback
,&tmp
,sizeof(char)) != sizeof(char)) {
1450 callback
->printf_filtered(callback
,"WARNING: Invalid return from character read\n");
1458 case 12: /* void outbyte(char chr) : write a byte to "stdout" */
1460 char tmp
= (char)(A0
& 0xFF);
1461 callback
->write_stdout(callback
,&tmp
,sizeof(char));
1465 case 17: /* void _exit() */
1466 callback
->printf_filtered(callback
,"sim_monitor(17): _exit(int reason) to be coded\n");
1467 state
|= (simSTOP
| simEXIT
); /* stop executing code */
1468 rcexit
= (unsigned int)(A0
& 0xFFFFFFFF);
1471 case 55: /* void get_mem_info(unsigned int *ptr) */
1472 /* in: A0 = pointer to three word memory location */
1473 /* out: [A0 + 0] = size */
1474 /* [A0 + 4] = instruction cache size */
1475 /* [A0 + 8] = data cache size */
1478 uword64 paddr
, value
;
1482 /* NOTE: We use RAW memory writes here, but since we are not
1483 gathering statistics for the monitor calls we are simulating,
1484 it is not an issue. */
1487 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isREAL
)) {
1488 value
= (uword64
)membank_size
;
1489 StoreMemory(cca
,AccessLength_WORD
,value
,paddr
,vaddr
,isRAW
);
1490 /* We re-do the address translations, in-case the block
1491 overlaps a memory boundary: */
1493 vaddr
+= (AccessLength_WORD
+ 1);
1494 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isREAL
)) {
1495 StoreMemory(cca
,AccessLength_WORD
,value
,paddr
,vaddr
,isRAW
);
1496 vaddr
+= (AccessLength_WORD
+ 1);
1497 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isREAL
))
1498 StoreMemory(cca
,AccessLength_WORD
,value
,paddr
,vaddr
,isRAW
);
1507 callback
->printf_filtered(callback
,"WARNING: Invalid pointer passed into monitor call\n");
1512 callback
->printf_filtered(callback
,"TODO: sim_monitor(%d) : PC = 0x%08X%08X\n",reason
,WORD64HI(IPC
),WORD64LO(IPC
));
1513 callback
->printf_filtered(callback
,"(Arguments : A0 = 0x%08X%08X : A1 = 0x%08X%08X : A2 = 0x%08X%08X : A3 = 0x%08X%08X)\n",WORD64HI(A0
),WORD64LO(A0
),WORD64HI(A1
),WORD64LO(A1
),WORD64HI(A2
),WORD64LO(A2
),WORD64HI(A3
),WORD64LO(A3
));
1525 callback
->printf_filtered(callback
,"SIM Error: ");
1526 callback
->printf_filtered(callback
,fmt
,ap
);
1528 SignalException(SimulatorFault
,"");
1538 /* Round *UP* to the nearest power-of-2 if not already one */
1539 if (value
!= (value
& ~(value
- 1))) {
1540 for (tmp
= value
, loop
= 0; (tmp
!= 0); loop
++)
1542 value
= (1 << loop
);
1555 num
= strtol(value
,&end
,10);
1557 callback
->printf_filtered(callback
,"Warning: Invalid number \"%s\" ignored, using zero\n",value
);
1559 if (*end
&& ((tolower(*end
) == 'k') || (tolower(*end
) == 'm'))) {
1560 if (tolower(*end
) == 'k')
1567 callback
->printf_filtered(callback
,"Warning: Spurious characters \"%s\" at end of number ignored\n",end
);
1573 /*-- trace support ----------------------------------------------------------*/
1575 /* The TRACE support is provided (if required) in the memory accessing
1576 routines. Since we are also providing the architecture specific
1577 features, the architecture simulation code can also deal with
1578 notifying the TRACE world of cache flushes, etc. Similarly we do
1579 not need to provide profiling support in the simulator engine,
1580 since we can sample in the instruction fetch control loop. By
1581 defining the TRACE manifest, we add tracing as a run-time
1585 /* Tracing by default produces "din" format (as required by
1586 dineroIII). Each line of such a trace file *MUST* have a din label
1587 and address field. The rest of the line is ignored, so comments can
1588 be included if desired. The first field is the label which must be
1589 one of the following values:
1594 3 escape record (treated as unknown access type)
1595 4 escape record (causes cache flush)
1597 The address field is a 32bit (lower-case) hexadecimal address
1598 value. The address should *NOT* be preceded by "0x".
1600 The size of the memory transfer is not important when dealing with
1601 cache lines (as long as no more than a cache line can be
1602 transferred in a single operation :-), however more information
1603 could be given following the dineroIII requirement to allow more
1604 complete memory and cache simulators to provide better
1605 results. i.e. the University of Pisa has a cache simulator that can
1606 also take bus size and speed as (variable) inputs to calculate
1607 complete system performance (a much more useful ability when trying
1608 to construct an end product, rather than a processor). They
1609 currently have an ARM version of their tool called ChARM. */
1612 void dotrace(tracefh
,type
,address
,width
,comment
)
1615 unsigned int address
;
1619 if (state
& simTRACE
) {
1621 fprintf(tracefh
,"%d %08x ; width %d ; ",type
,address
,width
);
1622 va_start(ap
,comment
);
1623 fprintf(tracefh
,comment
,ap
);
1625 fprintf(tracefh
,"\n");
1627 /* NOTE: Since the "din" format will only accept 32bit addresses, and
1628 we may be generating 64bit ones, we should put the hi-32bits of the
1629 address into the comment field. */
1631 /* TODO: Provide a buffer for the trace lines. We can then avoid
1632 performing writes until the buffer is filled, or the file is
1635 /* NOTE: We could consider adding a comment field to the "din" file
1636 produced using type 3 markers (unknown access). This would then
1637 allow information about the program that the "din" is for, and
1638 the MIPs world that was being simulated, to be placed into the
1645 /*---------------------------------------------------------------------------*/
1646 /*-- simulator engine -------------------------------------------------------*/
1647 /*---------------------------------------------------------------------------*/
1652 /* RESET: Fixed PC address: */
1653 PC
= (((uword64
)0xFFFFFFFF<<32) | 0xBFC00000);
1654 /* The reset vector address is in the unmapped, uncached memory space. */
1656 SR
&= ~(status_SR
| status_TS
| status_RP
);
1657 SR
|= (status_ERL
| status_BEV
);
1658 /* VR4300 starts in Big-Endian mode */
1659 CONFIG
&= ~(config_EP_mask
<< config_EP_shift
);
1660 CONFIG
|= ((config_EP_D
<< config_EP_shift
) | config_BE
);
1661 /* TODO: The VR4300 CONFIG register is not modelled fully at the moment */
1663 #if defined(HASFPU) && (GPRLEN == (64))
1664 /* Cheat and allow access to the complete register set immediately: */
1665 SR
|= status_FR
; /* 64bit registers */
1666 #endif /* HASFPU and 64bit FP registers */
1668 /* Ensure that any instructions with pending register updates are
1672 for (loop
= 0; (loop
< PSLOTS
); loop
++)
1673 pending_slot_reg
[loop
] = (LAST_EMBED_REGNUM
+ 1);
1674 pending_in
= pending_out
= pending_total
= 0;
1678 /* Initialise the FPU registers to the unknown state */
1681 for (rn
= 0; (rn
< 32); rn
++)
1682 fpr_state
[rn
] = fmt_uninterpreted
;
1689 /* Description from page A-22 of the "MIPS IV Instruction Set" manual (revision 3.1) */
1690 /* Translate a virtual address to a physical address and cache
1691 coherence algorithm describing the mechanism used to resolve the
1692 memory reference. Given the virtual address vAddr, and whether the
1693 reference is to Instructions ot Data (IorD), find the corresponding
1694 physical address (pAddr) and the cache coherence algorithm (CCA)
1695 used to resolve the reference. If the virtual address is in one of
1696 the unmapped address spaces the physical address and the CCA are
1697 determined directly by the virtual address. If the virtual address
1698 is in one of the mapped address spaces then the TLB is used to
1699 determine the physical address and access type; if the required
1700 translation is not present in the TLB or the desired access is not
1701 permitted the function fails and an exception is taken.
1703 NOTE: This function is extended to return an exception state. This,
1704 along with the exception generation is used to notify whether a
1705 valid address translation occured */
1708 AddressTranslation(vAddr
,IorD
,LorS
,pAddr
,CCA
,host
,raw
)
1717 int res
= -1; /* TRUE : Assume good return */
1720 callback
->printf_filtered(callback
,"AddressTranslation(0x%08X%08X,%s,%s,...);\n",WORD64HI(vAddr
),WORD64LO(vAddr
),(IorD
? "isDATA" : "isINSTRUCTION"),(LorS
? "iSTORE" : "isLOAD"));
1723 /* Check that the address is valid for this memory model */
1725 /* For a simple (flat) memory model, we simply pass virtual
1726 addressess through (mostly) unchanged. */
1727 vAddr
&= 0xFFFFFFFF;
1728 *pAddr
= vAddr
; /* default for isTARGET */
1729 *CCA
= Uncached
; /* not used for isHOST */
1731 /* NOTE: This is a duplicate of the code that appears in the
1732 LoadMemory and StoreMemory functions. They should be merged into
1733 a single function (that can be in-lined if required). */
1734 if ((vAddr
>= membank_base
) && (vAddr
< (membank_base
+ membank_size
))) {
1736 *pAddr
= (int)&membank
[((unsigned int)(vAddr
- membank_base
) & (membank_size
- 1))];
1737 } else if ((vAddr
>= monitor_base
) && (vAddr
< (monitor_base
+ monitor_size
))) {
1739 *pAddr
= (int)&monitor
[((unsigned int)(vAddr
- monitor_base
) & (monitor_size
- 1))];
1741 #if 1 /* def DEBUG */
1742 callback
->printf_filtered(callback
,"Failed: AddressTranslation(0x%08X%08X,%s,%s,...);\n",WORD64HI(vAddr
),WORD64LO(vAddr
),(IorD
? "isDATA" : "isINSTRUCTION"),(LorS
? "isSTORE" : "isLOAD"));
1744 res
= 0; /* AddressTranslation has failed */
1746 if (!raw
) /* only generate exceptions on real memory transfers */
1747 SignalException((LorS
== isSTORE
) ? AddressStore
: AddressLoad
);
1749 callback
->printf_filtered(callback
,"AddressTranslation for %s %s from 0x%08X%08X failed\n",(IorD
? "data" : "instruction"),(LorS
? "store" : "load"),WORD64HI(vAddr
),WORD64LO(vAddr
));
1755 /* Description from page A-23 of the "MIPS IV Instruction Set" manual (revision 3.1) */
1756 /* Prefetch data from memory. Prefetch is an advisory instruction for
1757 which an implementation specific action is taken. The action taken
1758 may increase performance, but must not change the meaning of the
1759 program, or alter architecturally-visible state. */
1761 Prefetch(CCA
,pAddr
,vAddr
,DATA
,hint
)
1769 callback
->printf_filtered(callback
,"Prefetch(%d,0x%08X%08X,0x%08X%08X,%d,%d);\n",CCA
,WORD64HI(pAddr
),WORD64LO(pAddr
),WORD64HI(vAddr
),WORD64LO(vAddr
),DATA
,hint
);
1772 /* For our simple memory model we do nothing */
1776 /* Description from page A-22 of the "MIPS IV Instruction Set" manual (revision 3.1) */
1777 /* Load a value from memory. Use the cache and main memory as
1778 specified in the Cache Coherence Algorithm (CCA) and the sort of
1779 access (IorD) to find the contents of AccessLength memory bytes
1780 starting at physical location pAddr. The data is returned in the
1781 fixed width naturally-aligned memory element (MemElem). The
1782 low-order two (or three) bits of the address and the AccessLength
1783 indicate which of the bytes within MemElem needs to be given to the
1784 processor. If the memory access type of the reference is uncached
1785 then only the referenced bytes are read from memory and valid
1786 within the memory element. If the access type is cached, and the
1787 data is not present in cache, an implementation specific size and
1788 alignment block of memory is read and loaded into the cache to
1789 satisfy a load reference. At a minimum, the block is the entire
1792 LoadMemory(CCA
,AccessLength
,pAddr
,vAddr
,IorD
,raw
)
1803 if (membank
== NULL
)
1804 callback
->printf_filtered(callback
,"DBG: LoadMemory(%d,%d,0x%08X%08X,0x%08X%08X,%s,%s)\n",CCA
,AccessLength
,WORD64HI(pAddr
),WORD64LO(pAddr
),WORD64HI(vAddr
),WORD64LO(vAddr
),(IorD
? "isDATA" : "isINSTRUCTION"),(raw
? "isRAW" : "isREAL"));
1807 #if defined(WARN_MEM)
1808 if (CCA
!= uncached
)
1809 callback
->printf_filtered(callback
,"SIM Warning: LoadMemory CCA (%d) is not uncached (currently all accesses treated as cached)\n",CCA
);
1811 if (((pAddr
& LOADDRMASK
) + AccessLength
) > LOADDRMASK
) {
1812 /* In reality this should be a Bus Error */
1813 sim_error("AccessLength of %d would extend over 64bit aligned boundary for physical address 0x%08X%08X\n",AccessLength
,WORD64HI(pAddr
),WORD64LO(pAddr
));
1815 #endif /* WARN_MEM */
1817 /* Decide which physical memory locations are being dealt with. At
1818 this point we should be able to split the pAddr bits into the
1819 relevant address map being simulated. If the "raw" variable is
1820 set, the memory read being performed should *NOT* update any I/O
1821 state or affect the CPU state. This also includes avoiding
1822 affecting statistics gathering. */
1824 /* If instruction fetch then we need to check that the two lo-order
1825 bits are zero, otherwise raise a InstructionFetch exception: */
1826 if ((IorD
== isINSTRUCTION
) && ((pAddr
& 0x3) != 0))
1827 SignalException(InstructionFetch
);
1830 unsigned char *mem
= NULL
;
1834 dotrace(tracefh
,((IorD
== isDATA
) ? 0 : 2),(unsigned int)(pAddr
&0xFFFFFFFF),(AccessLength
+ 1),"load%s",((IorD
== isDATA
) ? "" : " instruction"));
1837 /* NOTE: Quicker methods of decoding the address space can be used
1838 when a real memory map is being simulated (i.e. using hi-order
1839 address bits to select device). */
1840 if ((pAddr
>= membank_base
) && (pAddr
< (membank_base
+ membank_size
))) {
1841 index
= ((unsigned int)(pAddr
- membank_base
) & (membank_size
- 1));
1843 } else if ((pAddr
>= monitor_base
) && (pAddr
< (monitor_base
+ monitor_size
))) {
1844 index
= ((unsigned int)(pAddr
- monitor_base
) & (monitor_size
- 1));
1848 sim_error("Simulator memory not found for physical address 0x%08X%08X\n",WORD64HI(pAddr
),WORD64LO(pAddr
));
1850 /* If we obtained the endianness of the host, and it is the same
1851 as the target memory system we can optimise the memory
1852 accesses. However, without that information we must perform
1853 slow transfer, and hope that the compiler optimisation will
1854 merge successive loads. */
1855 value
= 0; /* no data loaded yet */
1857 /* In reality we should always be loading a doubleword value (or
1858 word value in 32bit memory worlds). The external code then
1859 extracts the required bytes. However, to keep performance
1860 high we only load the required bytes into the relevant
1863 switch (AccessLength
) { /* big-endian memory */
1864 case AccessLength_DOUBLEWORD
:
1865 value
|= ((uword64
)mem
[index
++] << 56);
1866 case AccessLength_SEPTIBYTE
:
1867 value
|= ((uword64
)mem
[index
++] << 48);
1868 case AccessLength_SEXTIBYTE
:
1869 value
|= ((uword64
)mem
[index
++] << 40);
1870 case AccessLength_QUINTIBYTE
:
1871 value
|= ((uword64
)mem
[index
++] << 32);
1872 case AccessLength_WORD
:
1873 value
|= ((unsigned int)mem
[index
++] << 24);
1874 case AccessLength_TRIPLEBYTE
:
1875 value
|= ((unsigned int)mem
[index
++] << 16);
1876 case AccessLength_HALFWORD
:
1877 value
|= ((unsigned int)mem
[index
++] << 8);
1878 case AccessLength_BYTE
:
1879 value
|= mem
[index
];
1883 index
+= (AccessLength
+ 1);
1884 switch (AccessLength
) { /* little-endian memory */
1885 case AccessLength_DOUBLEWORD
:
1886 value
|= ((uword64
)mem
[--index
] << 56);
1887 case AccessLength_SEPTIBYTE
:
1888 value
|= ((uword64
)mem
[--index
] << 48);
1889 case AccessLength_SEXTIBYTE
:
1890 value
|= ((uword64
)mem
[--index
] << 40);
1891 case AccessLength_QUINTIBYTE
:
1892 value
|= ((uword64
)mem
[--index
] << 32);
1893 case AccessLength_WORD
:
1894 value
|= ((uword64
)mem
[--index
] << 24);
1895 case AccessLength_TRIPLEBYTE
:
1896 value
|= ((uword64
)mem
[--index
] << 16);
1897 case AccessLength_HALFWORD
:
1898 value
|= ((uword64
)mem
[--index
] << 8);
1899 case AccessLength_BYTE
:
1900 value
|= ((uword64
)mem
[--index
] << 0);
1906 printf("DBG: LoadMemory() : (offset %d) : value = 0x%08X%08X\n",(int)(pAddr
& LOADDRMASK
),WORD64HI(value
),WORD64LO(value
));
1909 /* TODO: We could try and avoid the shifts when dealing with raw
1910 memory accesses. This would mean updating the LoadMemory and
1911 StoreMemory routines to avoid shifting the data before
1912 returning or using it. */
1913 if (!raw
) { /* do nothing for raw accessess */
1915 value
<<= (((7 - (pAddr
& LOADDRMASK
)) - AccessLength
) * 8);
1916 else /* little-endian only needs to be shifted up to the correct byte offset */
1917 value
<<= ((pAddr
& LOADDRMASK
) * 8);
1921 printf("DBG: LoadMemory() : shifted value = 0x%08X%08X\n",WORD64HI(value
),WORD64LO(value
));
1929 /* Description from page A-23 of the "MIPS IV Instruction Set" manual (revision 3.1) */
1930 /* Store a value to memory. The specified data is stored into the
1931 physical location pAddr using the memory hierarchy (data caches and
1932 main memory) as specified by the Cache Coherence Algorithm
1933 (CCA). The MemElem contains the data for an aligned, fixed-width
1934 memory element (word for 32-bit processors, doubleword for 64-bit
1935 processors), though only the bytes that will actually be stored to
1936 memory need to be valid. The low-order two (or three) bits of pAddr
1937 and the AccessLength field indicates which of the bytes within the
1938 MemElem data should actually be stored; only these bytes in memory
1941 StoreMemory(CCA
,AccessLength
,MemElem
,pAddr
,vAddr
,raw
)
1950 callback
->printf_filtered(callback
,"DBG: StoreMemory(%d,%d,0x%08X%08X,0x%08X%08X,0x%08X%08X,%s)\n",CCA
,AccessLength
,WORD64HI(MemElem
),WORD64LO(MemElem
),WORD64HI(pAddr
),WORD64LO(pAddr
),WORD64HI(vAddr
),WORD64LO(vAddr
),(raw
? "isRAW" : "isREAL"));
1953 #if defined(WARN_MEM)
1954 if (CCA
!= uncached
)
1955 callback
->printf_filtered(callback
,"SIM Warning: StoreMemory CCA (%d) is not uncached (currently all accesses treated as cached)\n",CCA
);
1957 if (((pAddr
& LOADDRMASK
) + AccessLength
) > LOADDRMASK
)
1958 sim_error("AccessLength of %d would extend over 64bit aligned boundary for physical address 0x%08X%08X\n",AccessLength
,WORD64HI(pAddr
),WORD64LO(pAddr
));
1959 #endif /* WARN_MEM */
1963 dotrace(tracefh
,1,(unsigned int)(pAddr
&0xFFFFFFFF),(AccessLength
+ 1),"store");
1966 /* See the comments in the LoadMemory routine about optimising
1967 memory accesses. Also if we wanted to make the simulator smaller,
1968 we could merge a lot of this code with the LoadMemory
1969 routine. However, this would slow the simulator down with
1970 run-time conditionals. */
1973 unsigned char *mem
= NULL
;
1975 if ((pAddr
>= membank_base
) && (pAddr
< (membank_base
+ membank_size
))) {
1976 index
= ((unsigned int)(pAddr
- membank_base
) & (membank_size
- 1));
1978 } else if ((pAddr
>= monitor_base
) && (pAddr
< (monitor_base
+ monitor_size
))) {
1979 index
= ((unsigned int)(pAddr
- monitor_base
) & (monitor_size
- 1));
1984 sim_error("Simulator memory not found for physical address 0x%08X%08X\n",WORD64HI(pAddr
),WORD64LO(pAddr
));
1989 printf("DBG: StoreMemory: offset = %d MemElem = 0x%08X%08X\n",(unsigned int)(pAddr
& LOADDRMASK
),WORD64HI(MemElem
),WORD64LO(MemElem
));
1994 shift
= ((7 - AccessLength
) * 8);
1995 else /* real memory access */
1996 shift
= ((pAddr
& LOADDRMASK
) * 8);
1999 /* no need to shift raw little-endian data */
2001 MemElem
>>= ((pAddr
& LOADDRMASK
) * 8);
2005 printf("DBG: StoreMemory: shift = %d MemElem = 0x%08X%08X\n",shift
,WORD64HI(MemElem
),WORD64LO(MemElem
));
2009 switch (AccessLength
) { /* big-endian memory */
2010 case AccessLength_DOUBLEWORD
:
2011 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2013 case AccessLength_SEPTIBYTE
:
2014 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2016 case AccessLength_SEXTIBYTE
:
2017 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2019 case AccessLength_QUINTIBYTE
:
2020 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2022 case AccessLength_WORD
:
2023 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2025 case AccessLength_TRIPLEBYTE
:
2026 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2028 case AccessLength_HALFWORD
:
2029 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2031 case AccessLength_BYTE
:
2032 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2036 index
+= (AccessLength
+ 1);
2037 switch (AccessLength
) { /* little-endian memory */
2038 case AccessLength_DOUBLEWORD
:
2039 mem
[--index
] = (unsigned char)(MemElem
>> 56);
2040 case AccessLength_SEPTIBYTE
:
2041 mem
[--index
] = (unsigned char)(MemElem
>> 48);
2042 case AccessLength_SEXTIBYTE
:
2043 mem
[--index
] = (unsigned char)(MemElem
>> 40);
2044 case AccessLength_QUINTIBYTE
:
2045 mem
[--index
] = (unsigned char)(MemElem
>> 32);
2046 case AccessLength_WORD
:
2047 mem
[--index
] = (unsigned char)(MemElem
>> 24);
2048 case AccessLength_TRIPLEBYTE
:
2049 mem
[--index
] = (unsigned char)(MemElem
>> 16);
2050 case AccessLength_HALFWORD
:
2051 mem
[--index
] = (unsigned char)(MemElem
>> 8);
2052 case AccessLength_BYTE
:
2053 mem
[--index
] = (unsigned char)(MemElem
>> 0);
2063 /* Description from page A-26 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2064 /* Order loads and stores to synchronise shared memory. Perform the
2065 action necessary to make the effects of groups of synchronizable
2066 loads and stores indicated by stype occur in the same order for all
2069 SyncOperation(stype
)
2073 callback
->printf_filtered(callback
,"SyncOperation(%d) : TODO\n",stype
);
2078 /* Description from page A-26 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2079 /* Signal an exception condition. This will result in an exception
2080 that aborts the instruction. The instruction operation pseudocode
2081 will never see a return from this function call. */
2083 SignalException(exception
)
2086 /* Ensure that any active atomic read/modify/write operation will fail: */
2089 switch (exception
) {
2090 /* TODO: For testing purposes I have been ignoring TRAPs. In
2091 reality we should either simulate them, or allow the user to
2092 ignore them at run-time. */
2094 callback
->printf_filtered(callback
,"Ignoring instruction TRAP (PC 0x%08X%08X)\n",WORD64HI(IPC
),WORD64LO(IPC
));
2097 case ReservedInstruction
:
2100 unsigned int instruction
;
2101 va_start(ap
,exception
);
2102 instruction
= va_arg(ap
,unsigned int);
2104 /* Provide simple monitor support using ReservedInstruction
2105 exceptions. The following code simulates the fixed vector
2106 entry points into the IDT monitor by causing a simulator
2107 trap, performing the monitor operation, and returning to
2108 the address held in the $ra register (standard PCS return
2109 address). This means we only need to pre-load the vector
2110 space with suitable instruction values. For systems were
2111 actual trap instructions are used, we would not need to
2112 perform this magic. */
2113 if ((instruction
& ~RSVD_INSTRUCTION_AMASK
) == RSVD_INSTRUCTION
) {
2114 sim_monitor(instruction
& RSVD_INSTRUCTION_AMASK
);
2115 PC
= RA
; /* simulate the return from the vector entry */
2116 /* NOTE: This assumes that a branch-and-link style
2117 instruction was used to enter the vector (which is the
2118 case with the current IDT monitor). */
2119 break; /* out of the switch statement */
2120 } /* else fall through to normal exception processing */
2121 callback
->printf_filtered(callback
,"DBG: ReservedInstruction 0x%08X at IPC = 0x%08X%08X\n",instruction
,WORD64HI(IPC
),WORD64LO(IPC
));
2125 #if 1 /* def DEBUG */
2126 callback
->printf_filtered(callback
,"DBG: SignalException(%d) IPC = 0x%08X%08X\n",exception
,WORD64HI(IPC
),WORD64LO(IPC
));
2128 /* Store exception code into current exception id variable (used
2131 /* TODO: If not simulating exceptions then stop the simulator
2132 execution. At the moment we always stop the simulation. */
2133 state
|= (simSTOP
| simEXCEPTION
);
2134 CAUSE
= (exception
<< 2);
2135 if (state
& simDELAYSLOT
) {
2137 EPC
= (IPC
- 4); /* reference the branch instruction */
2140 /* The following is so that the simulator will continue from the
2141 exception address on breakpoint operations. */
2145 case SimulatorFault
:
2149 va_start(ap
,exception
);
2150 msg
= va_arg(ap
,char *);
2151 fprintf(stderr
,"FATAL: Simulator error \"%s\"\n",msg
);
2160 #if defined(WARN_RESULT)
2161 /* Description from page A-26 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2162 /* This function indicates that the result of the operation is
2163 undefined. However, this should not affect the instruction
2164 stream. All that is meant to happen is that the destination
2165 register is set to an undefined result. To keep the simulator
2166 simple, we just don't bother updating the destination register, so
2167 the overall result will be undefined. If desired we can stop the
2168 simulator by raising a pseudo-exception. */
2172 callback
->printf_filtered(callback
,"UndefinedResult: IPC = 0x%08X%08X\n",WORD64HI(IPC
),WORD64LO(IPC
));
2173 #if 0 /* Disabled for the moment, since it actually happens a lot at the moment. */
2178 #endif /* WARN_RESULT */
2181 CacheOp(op
,pAddr
,vAddr
,instruction
)
2185 unsigned int instruction
;
2187 /* If CP0 is not useable (User or Supervisor mode) and the CP0
2188 enable bit in the Status Register is clear - a coprocessor
2189 unusable exception is taken. */
2190 callback
->printf_filtered(callback
,"TODO: Cache availability checking (PC = 0x%08X%08X)\n",WORD64HI(IPC
),WORD64LO(IPC
));
2193 case 0: /* instruction cache */
2195 case 0: /* Index Invalidate */
2196 case 1: /* Index Load Tag */
2197 case 2: /* Index Store Tag */
2198 case 4: /* Hit Invalidate */
2200 case 6: /* Hit Writeback */
2201 callback
->printf_filtered(callback
,"SIM Warning: Instruction CACHE operation %d to be coded\n",(op
>> 2));
2205 SignalException(ReservedInstruction
,instruction
);
2210 case 1: /* data cache */
2212 case 0: /* Index Writeback Invalidate */
2213 case 1: /* Index Load Tag */
2214 case 2: /* Index Store Tag */
2215 case 3: /* Create Dirty */
2216 case 4: /* Hit Invalidate */
2217 case 5: /* Hit Writeback Invalidate */
2218 case 6: /* Hit Writeback */
2219 callback
->printf_filtered(callback
,"SIM Warning: Data CACHE operation %d to be coded\n",(op
>> 2));
2223 SignalException(ReservedInstruction
,instruction
);
2228 default: /* unrecognised cache ID */
2229 SignalException(ReservedInstruction
,instruction
);
2236 /*-- FPU support routines ---------------------------------------------------*/
2238 #if defined(HASFPU) /* Only needed when building FPU aware simulators */
2241 #define SizeFGR() (GPRLEN)
2243 /* They depend on the CPU being simulated */
2244 #define SizeFGR() ((PROCESSOR_64BIT && ((SR & status_FR) == 1)) ? 64 : 32)
2247 /* Numbers are held in normalized form. The SINGLE and DOUBLE binary
2248 formats conform to ANSI/IEEE Std 754-1985. */
2249 /* SINGLE precision floating:
2250 * seeeeeeeefffffffffffffffffffffff
2252 * e = 8bits = exponent
2253 * f = 23bits = fraction
2255 /* SINGLE precision fixed:
2256 * siiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
2258 * i = 31bits = integer
2260 /* DOUBLE precision floating:
2261 * seeeeeeeeeeeffffffffffffffffffffffffffffffffffffffffffffffffffff
2263 * e = 11bits = exponent
2264 * f = 52bits = fraction
2266 /* DOUBLE precision fixed:
2267 * siiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
2269 * i = 63bits = integer
2272 /* Extract sign-bit: */
2273 #define FP_S_s(v) (((v) & ((unsigned)1 << 31)) ? 1 : 0)
2274 #define FP_D_s(v) (((v) & ((uword64)1 << 63)) ? 1 : 0)
2275 /* Extract biased exponent: */
2276 #define FP_S_be(v) (((v) >> 23) & 0xFF)
2277 #define FP_D_be(v) (((v) >> 52) & 0x7FF)
2278 /* Extract unbiased Exponent: */
2279 #define FP_S_e(v) (FP_S_be(v) - 0x7F)
2280 #define FP_D_e(v) (FP_D_be(v) - 0x3FF)
2281 /* Extract complete fraction field: */
2282 #define FP_S_f(v) ((v) & ~((unsigned)0x1FF << 23))
2283 #define FP_D_f(v) ((v) & ~((uword64)0xFFF << 52))
2284 /* Extract numbered fraction bit: */
2285 #define FP_S_fb(b,v) (((v) & (1 << (23 - (b)))) ? 1 : 0)
2286 #define FP_D_fb(b,v) (((v) & (1 << (52 - (b)))) ? 1 : 0)
2288 /* Explicit QNaN values used when value required: */
2289 #define FPQNaN_SINGLE (0x7FBFFFFF)
2290 #define FPQNaN_WORD (0x7FFFFFFF)
2291 #define FPQNaN_DOUBLE (((uword64)0x7FF7FFFF << 32) | 0xFFFFFFFF)
2292 #define FPQNaN_LONG (((uword64)0x7FFFFFFF << 32) | 0xFFFFFFFF)
2294 /* Explicit Infinity values used when required: */
2295 #define FPINF_SINGLE (0x7F800000)
2296 #define FPINF_DOUBLE (((uword64)0x7FF00000 << 32) | 0x00000000)
2298 #if 1 /* def DEBUG */
2299 #define RMMODE(v) (((v) == FP_RM_NEAREST) ? "Round" : (((v) == FP_RM_TOZERO) ? "Trunc" : (((v) == FP_RM_TOPINF) ? "Ceil" : "Floor")))
2300 #define DOFMT(v) (((v) == fmt_single) ? "single" : (((v) == fmt_double) ? "double" : (((v) == fmt_word) ? "word" : (((v) == fmt_long) ? "long" : (((v) == fmt_unknown) ? "<unknown>" : (((v) == fmt_uninterpreted) ? "<uninterpreted>" : "<format error>"))))))
2311 /* Treat unused register values, as fixed-point 64bit values: */
2312 if ((fmt
== fmt_uninterpreted
) || (fmt
== fmt_unknown
))
2314 /* If request to read data as "uninterpreted", then use the current
2316 fmt
= fpr_state
[fpr
];
2321 /* For values not yet accessed, set to the desired format: */
2322 if (fpr_state
[fpr
] == fmt_uninterpreted
) {
2323 fpr_state
[fpr
] = fmt
;
2325 printf("DBG: Register %d was fmt_uninterpreted. Now %s\n",fpr
,DOFMT(fmt
));
2328 if (fmt
!= fpr_state
[fpr
]) {
2329 callback
->printf_filtered(callback
,"Warning: FPR %d (format %s) being accessed with format %s - setting to unknown (PC = 0x%08X%08X)\n",fpr
,DOFMT(fpr_state
[fpr
]),DOFMT(fmt
),WORD64HI(IPC
),WORD64LO(IPC
));
2330 fpr_state
[fpr
] = fmt_unknown
;
2333 if (fpr_state
[fpr
] == fmt_unknown
) {
2334 /* Set QNaN value: */
2337 value
= FPQNaN_SINGLE
;
2341 value
= FPQNaN_DOUBLE
;
2345 value
= FPQNaN_WORD
;
2349 value
= FPQNaN_LONG
;
2356 } else if (SizeFGR() == 64) {
2360 value
= (FGR
[fpr
] & 0xFFFFFFFF);
2363 case fmt_uninterpreted
:
2373 } else if ((fpr
& 1) == 0) { /* even registers only */
2377 value
= (FGR
[fpr
] & 0xFFFFFFFF);
2380 case fmt_uninterpreted
:
2383 value
= ((FGR
[fpr
+1] << 32) | (FGR
[fpr
] & 0xFFFFFFFF));
2393 SignalException(SimulatorFault
,"Unrecognised FP format in ValueFPR()");
2396 printf("DBG: ValueFPR: fpr = %d, fmt = %s, value = 0x%08X%08X : PC = 0x%08X%08X : SizeFGR() = %d\n",fpr
,DOFMT(fmt
),WORD64HI(value
),WORD64LO(value
),WORD64HI(IPC
),WORD64LO(IPC
),SizeFGR());
2403 StoreFPR(fpr
,fmt
,value
)
2411 printf("DBG: StoreFPR: fpr = %d, fmt = %s, value = 0x%08X%08X : PC = 0x%08X%08X : SizeFGR() = %d\n",fpr
,DOFMT(fmt
),WORD64HI(value
),WORD64LO(value
),WORD64HI(IPC
),WORD64LO(IPC
),SizeFGR());
2414 if (SizeFGR() == 64) {
2418 FGR
[fpr
] = (((uword64
)0xDEADC0DE << 32) | (value
& 0xFFFFFFFF));
2419 fpr_state
[fpr
] = fmt
;
2422 case fmt_uninterpreted
:
2426 fpr_state
[fpr
] = fmt
;
2430 fpr_state
[fpr
] = fmt_unknown
;
2434 } else if ((fpr
& 1) == 0) { /* even register number only */
2438 FGR
[fpr
+1] = 0xDEADC0DE;
2439 FGR
[fpr
] = (value
& 0xFFFFFFFF);
2440 fpr_state
[fpr
+ 1] = fmt
;
2441 fpr_state
[fpr
] = fmt
;
2444 case fmt_uninterpreted
:
2447 FGR
[fpr
+1] = (value
>> 32);
2448 FGR
[fpr
] = (value
& 0xFFFFFFFF);
2449 fpr_state
[fpr
+ 1] = fmt
;
2450 fpr_state
[fpr
] = fmt
;
2454 fpr_state
[fpr
] = fmt_unknown
;
2459 #if defined(WARN_RESULT)
2462 #endif /* WARN_RESULT */
2465 SignalException(SimulatorFault
,"Unrecognised FP format in StoreFPR()");
2468 printf("DBG: StoreFPR: fpr[%d] = 0x%08X%08X (format %s)\n",fpr
,WORD64HI(FGR
[fpr
]),WORD64LO(FGR
[fpr
]),DOFMT(fmt
));
2481 /* Check if (((E - bias) == (E_max + 1)) && (fraction != 0)). We
2482 know that the exponent field is biased... we we cheat and avoid
2483 removing the bias value. */
2486 boolean
= ((FP_S_be(op
) == 0xFF) && (FP_S_f(op
) != 0));
2487 /* We could use "FP_S_fb(1,op)" to ascertain whether we are
2488 dealing with a SNaN or QNaN */
2491 boolean
= ((FP_D_be(op
) == 0x7FF) && (FP_D_f(op
) != 0));
2492 /* We could use "FP_S_fb(1,op)" to ascertain whether we are
2493 dealing with a SNaN or QNaN */
2496 boolean
= (op
== FPQNaN_WORD
);
2499 boolean
= (op
== FPQNaN_LONG
);
2504 printf("DBG: NaN: returning %d for 0x%08X%08X (format = %s)\n",boolean
,WORD64HI(op
),WORD64LO(op
),DOFMT(fmt
));
2518 printf("DBG: Infinity: format %s 0x%08X%08X (PC = 0x%08X%08X)\n",DOFMT(fmt
),WORD64HI(op
),WORD64LO(op
),WORD64HI(IPC
),WORD64LO(IPC
));
2521 /* Check if (((E - bias) == (E_max + 1)) && (fraction == 0)). We
2522 know that the exponent field is biased... we we cheat and avoid
2523 removing the bias value. */
2526 boolean
= ((FP_S_be(op
) == 0xFF) && (FP_S_f(op
) == 0));
2529 boolean
= ((FP_D_be(op
) == 0x7FF) && (FP_D_f(op
) == 0));
2532 printf("DBG: TODO: unrecognised format (%s) for Infinity check\n",DOFMT(fmt
));
2537 printf("DBG: Infinity: returning %d for 0x%08X%08X (format = %s)\n",boolean
,WORD64HI(op
),WORD64LO(op
),DOFMT(fmt
));
2551 /* Argument checking already performed by the FPCOMPARE code */
2554 printf("DBG: Less: %s: op1 = 0x%08X%08X : op2 = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op1
),WORD64LO(op1
),WORD64HI(op2
),WORD64LO(op2
));
2557 /* The format type should already have been checked: */
2561 unsigned int wop1
= (unsigned int)op1
;
2562 unsigned int wop2
= (unsigned int)op2
;
2563 boolean
= (*(float *)&wop1
< *(float *)&wop2
);
2567 boolean
= (*(double *)&op1
< *(double *)&op2
);
2572 printf("DBG: Less: returning %d (format = %s)\n",boolean
,DOFMT(fmt
));
2586 /* Argument checking already performed by the FPCOMPARE code */
2589 printf("DBG: Equal: %s: op1 = 0x%08X%08X : op2 = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op1
),WORD64LO(op1
),WORD64HI(op2
),WORD64LO(op2
));
2592 /* The format type should already have been checked: */
2595 boolean
= ((op1
& 0xFFFFFFFF) == (op2
& 0xFFFFFFFF));
2598 boolean
= (op1
== op2
);
2603 printf("DBG: Equal: returning %d (format = %s)\n",boolean
,DOFMT(fmt
));
2617 printf("DBG: Negate: %s: op = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op
),WORD64LO(op
));
2620 /* The format type should already have been checked: */
2624 unsigned int wop
= (unsigned int)op
;
2625 float tmp
= ((float)0.0 - *(float *)&wop
);
2626 result
= (uword64
)*(unsigned int *)&tmp
;
2631 double tmp
= ((double)0.0 - *(double *)&op
);
2632 result
= *(uword64
*)&tmp
;
2649 printf("DBG: Add: %s: op1 = 0x%08X%08X : op2 = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op1
),WORD64LO(op1
),WORD64HI(op2
),WORD64LO(op2
));
2652 /* The registers must specify FPRs valid for operands of type
2653 "fmt". If they are not valid, the result is undefined. */
2655 /* The format type should already have been checked: */
2659 unsigned int wop1
= (unsigned int)op1
;
2660 unsigned int wop2
= (unsigned int)op2
;
2661 float tmp
= (*(float *)&wop1
+ *(float *)&wop2
);
2662 result
= (uword64
)*(unsigned int *)&tmp
;
2667 double tmp
= (*(double *)&op1
+ *(double *)&op2
);
2668 result
= *(uword64
*)&tmp
;
2674 printf("DBG: Add: returning 0x%08X%08X (format = %s)\n",WORD64HI(result
),WORD64LO(result
),DOFMT(fmt
));
2689 printf("DBG: Sub: %s: op1 = 0x%08X%08X : op2 = 0x%08X%08X\n",DOFMT(fmt
),WORD64H(op1
),WORD64LO(op1
),WORD64HI(op2
),WORD64LO(op2
));
2692 /* The registers must specify FPRs valid for operands of type
2693 "fmt". If they are not valid, the result is undefined. */
2695 /* The format type should already have been checked: */
2699 unsigned int wop1
= (unsigned int)op1
;
2700 unsigned int wop2
= (unsigned int)op2
;
2701 float tmp
= (*(float *)&wop1
- *(float *)&wop2
);
2702 result
= (uword64
)*(unsigned int *)&tmp
;
2707 double tmp
= (*(double *)&op1
- *(double *)&op2
);
2708 result
= *(uword64
*)&tmp
;
2714 printf("DBG: Sub: returning 0x%08X%08X (format = %s)\n",WORD64HI(result
),WORD64LO(result
),DOFMT(fmt
));
2721 Multiply(op1
,op2
,fmt
)
2729 printf("DBG: Multiply: %s: op1 = 0x%08X%08X : op2 = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op1
),WORD64LO(op1
),WORD64HI(op2
),WORD64LO(op2
));
2732 /* The registers must specify FPRs valid for operands of type
2733 "fmt". If they are not valid, the result is undefined. */
2735 /* The format type should already have been checked: */
2739 unsigned int wop1
= (unsigned int)op1
;
2740 unsigned int wop2
= (unsigned int)op2
;
2741 float tmp
= (*(float *)&wop1
* *(float *)&wop2
);
2742 result
= (uword64
)*(unsigned int *)&tmp
;
2747 double tmp
= (*(double *)&op1
* *(double *)&op2
);
2748 result
= *(uword64
*)&tmp
;
2754 printf("DBG: Multiply: returning 0x%08X%08X (format = %s)\n",WORD64HI(result
),WORD64LO(result
),DOFMT(fmt
));
2769 printf("DBG: Divide: %s: op1 = 0x%08X%08X : op2 = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op1
),WORD64LO(op1
),WORD64HI(op2
),WORD64LO(op2
));
2772 /* The registers must specify FPRs valid for operands of type
2773 "fmt". If they are not valid, the result is undefined. */
2775 /* The format type should already have been checked: */
2779 unsigned int wop1
= (unsigned int)op1
;
2780 unsigned int wop2
= (unsigned int)op2
;
2781 float tmp
= (*(float *)&wop1
/ *(float *)&wop2
);
2782 result
= (uword64
)*(unsigned int *)&tmp
;
2787 double tmp
= (*(double *)&op1
/ *(double *)&op2
);
2788 result
= *(uword64
*)&tmp
;
2794 printf("DBG: Divide: returning 0x%08X%08X (format = %s)\n",WORD64HI(result
),WORD64LO(result
),DOFMT(fmt
));
2808 printf("DBG: Recip: %s: op = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op
),WORD64LO(op
));
2811 /* The registers must specify FPRs valid for operands of type
2812 "fmt". If they are not valid, the result is undefined. */
2814 /* The format type should already have been checked: */
2818 unsigned int wop
= (unsigned int)op
;
2819 float tmp
= ((float)1.0 / *(float *)&wop
);
2820 result
= (uword64
)*(unsigned int *)&tmp
;
2825 double tmp
= ((double)1.0 / *(double *)&op
);
2826 result
= *(uword64
*)&tmp
;
2832 printf("DBG: Recip: returning 0x%08X%08X (format = %s)\n",WORD64HI(result
),WORD64LO(result
),DOFMT(fmt
));
2846 printf("DBG: SquareRoot: %s: op = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op
),WORD64LO(op
));
2849 /* The registers must specify FPRs valid for operands of type
2850 "fmt". If they are not valid, the result is undefined. */
2852 /* The format type should already have been checked: */
2856 unsigned int wop
= (unsigned int)op
;
2857 float tmp
= ((float)sqrt((double)*(float *)&wop
));
2858 result
= (uword64
)*(unsigned int *)&tmp
;
2863 double tmp
= (sqrt(*(double *)&op
));
2864 result
= *(uword64
*)&tmp
;
2870 printf("DBG: SquareRoot: returning 0x%08X%08X (format = %s)\n",WORD64HI(result
),WORD64LO(result
),DOFMT(fmt
));
2877 Convert(rm
,op
,from
,to
)
2886 printf("DBG: Convert: mode %s : op 0x%08X%08X : from %s : to %s : (PC = 0x%08X%08X)\n",RMMODE(rm
),WORD64HI(op
),WORD64LO(op
),DOFMT(from
),DOFMT(to
),WORD64HI(IPC
),WORD64LO(IPC
));
2889 /* The value "op" is converted to the destination format, rounding
2890 using mode "rm". When the destination is a fixed-point format,
2891 then a source value of Infinity, NaN or one which would round to
2892 an integer outside the fixed point range then an IEEE Invalid
2893 Operation condition is raised. */
2900 tmp
= (float)(*(double *)&op
);
2904 tmp
= (float)((int)(op
& 0xFFFFFFFF));
2908 tmp
= (float)((int)op
);
2914 /* Round result to nearest representable value. When two
2915 representable values are equally near, round to the value
2916 that has a least significant bit of zero (i.e. is even). */
2918 tmp
= (float)anint((double)tmp
);
2920 /* TODO: Provide round-to-nearest */
2925 /* Round result to the value closest to, and not greater in
2926 magnitude than, the result. */
2928 tmp
= (float)aint((double)tmp
);
2930 /* TODO: Provide round-to-zero */
2935 /* Round result to the value closest to, and not less than,
2937 tmp
= (float)ceil((double)tmp
);
2941 /* Round result to the value closest to, and not greater than,
2943 tmp
= (float)floor((double)tmp
);
2946 result
= (uword64
)*(unsigned int *)&tmp
;
2957 unsigned int wop
= (unsigned int)op
;
2958 tmp
= (double)(*(float *)&wop
);
2963 tmp
= (double)((word64
)SIGNEXTEND((op
& 0xFFFFFFFF),32));
2967 tmp
= (double)((word64
)op
);
2974 tmp
= anint(*(double *)&tmp
);
2976 /* TODO: Provide round-to-nearest */
2982 tmp
= aint(*(double *)&tmp
);
2984 /* TODO: Provide round-to-zero */
2989 tmp
= ceil(*(double *)&tmp
);
2993 tmp
= floor(*(double *)&tmp
);
2996 result
= *(uword64
*)&tmp
;
3002 if (Infinity(op
,from
) || NaN(op
,from
) || (1 == 0/*TODO: check range */)) {
3003 printf("DBG: TODO: update FCSR\n");
3004 SignalException(FPE
);
3006 if (to
== fmt_word
) {
3011 unsigned int wop
= (unsigned int)op
;
3012 tmp
= (unsigned int)*((float *)&wop
);
3016 tmp
= (unsigned int)*((double *)&op
);
3018 printf("DBG: from double %.30f (0x%08X%08X) to word: 0x%08X\n",*((double *)&op
),WORD64HI(op
),WORD64LO(op
),tmp
);
3022 result
= (uword64
)tmp
;
3023 } else { /* fmt_long */
3027 unsigned int wop
= (unsigned int)op
;
3028 result
= (uword64
)*((float *)&wop
);
3032 result
= (uword64
)*((double *)&op
);
3041 printf("DBG: Convert: returning 0x%08X%08X (to format = %s)\n",WORD64HI(result
),WORD64LO(result
),DOFMT(to
));
3048 /*-- co-processor support routines ------------------------------------------*/
3051 CoProcPresent(coproc_number
)
3052 unsigned int coproc_number
;
3054 /* Return TRUE if simulator provides a model for the given co-processor number */
3059 COP_LW(coproc_num
,coproc_reg
,memword
)
3060 int coproc_num
, coproc_reg
;
3061 unsigned int memword
;
3063 switch (coproc_num
) {
3067 printf("DBG: COP_LW: memword = 0x%08X (uword64)memword = 0x%08X%08X\n",memword
,WORD64HI(memword
),WORD64LO(memword
));
3069 StoreFPR(coproc_reg
,fmt_uninterpreted
,(uword64
)memword
);
3074 callback
->printf_filtered(callback
,"COP_LW(%d,%d,0x%08X) at IPC = 0x%08X%08X : TODO (architecture specific)\n",coproc_num
,coproc_reg
,memword
,WORD64HI(IPC
),WORD64LO(IPC
));
3082 COP_LD(coproc_num
,coproc_reg
,memword
)
3083 int coproc_num
, coproc_reg
;
3086 switch (coproc_num
) {
3089 StoreFPR(coproc_reg
,fmt_uninterpreted
,memword
);
3094 callback
->printf_filtered(callback
,"COP_LD(%d,%d,0x%08X%08X) at IPC = 0x%08X%08X : TODO (architecture specific)\n",coproc_num
,coproc_reg
,WORD64HI(memword
),WORD64LO(memword
),WORD64HI(IPC
),WORD64LO(IPC
));
3102 COP_SW(coproc_num
,coproc_reg
)
3103 int coproc_num
, coproc_reg
;
3105 unsigned int value
= 0;
3106 switch (coproc_num
) {
3110 value
= (unsigned int)ValueFPR(coproc_reg
,fmt_uninterpreted
);
3113 value
= (unsigned int)ValueFPR(coproc_reg
,fpr_state
[coproc_reg
]);
3116 printf("DBG: COP_SW: reg in format %s (will be accessing as single)\n",DOFMT(fpr_state
[coproc_reg
]));
3118 value
= (unsigned int)ValueFPR(coproc_reg
,fmt_single
);
3125 callback
->printf_filtered(callback
,"COP_SW(%d,%d) at IPC = 0x%08X%08X : TODO (architecture specific)\n",coproc_num
,coproc_reg
,WORD64HI(IPC
),WORD64LO(IPC
));
3133 COP_SD(coproc_num
,coproc_reg
)
3134 int coproc_num
, coproc_reg
;
3137 switch (coproc_num
) {
3141 value
= ValueFPR(coproc_reg
,fmt_uninterpreted
);
3144 value
= ValueFPR(coproc_reg
,fpr_state
[coproc_reg
]);
3147 printf("DBG: COP_SD: reg in format %s (will be accessing as double)\n",DOFMT(fpr_state
[coproc_reg
]));
3149 value
= ValueFPR(coproc_reg
,fmt_double
);
3156 callback
->printf_filtered(callback
,"COP_SD(%d,%d) at IPC = 0x%08X%08X : TODO (architecture specific)\n",coproc_num
,coproc_reg
,WORD64HI(IPC
),WORD64LO(IPC
));
3164 decode_coproc(instruction
)
3165 unsigned int instruction
;
3167 int coprocnum
= ((instruction
>> 26) & 3);
3169 switch (coprocnum
) {
3170 case 0: /* standard CPU control and cache registers */
3173 Standard CP0 registers
3174 0 = Index R4000 VR4100 VR4300
3175 1 = Random R4000 VR4100 VR4300
3176 2 = EntryLo0 R4000 VR4100 VR4300
3177 3 = EntryLo1 R4000 VR4100 VR4300
3178 4 = Context R4000 VR4100 VR4300
3179 5 = PageMask R4000 VR4100 VR4300
3180 6 = Wired R4000 VR4100 VR4300
3181 8 = BadVAddr R4000 VR4100 VR4300
3182 9 = Count R4000 VR4100 VR4300
3183 10 = EntryHi R4000 VR4100 VR4300
3184 11 = Compare R4000 VR4100 VR4300
3185 12 = SR R4000 VR4100 VR4300
3186 13 = Cause R4000 VR4100 VR4300
3187 14 = EPC R4000 VR4100 VR4300
3188 15 = PRId R4000 VR4100 VR4300
3189 16 = Config R4000 VR4100 VR4300
3190 17 = LLAddr R4000 VR4100 VR4300
3191 18 = WatchLo R4000 VR4100 VR4300
3192 19 = WatchHi R4000 VR4100 VR4300
3193 20 = XContext R4000 VR4100 VR4300
3194 26 = PErr or ECC R4000 VR4100 VR4300
3195 27 = CacheErr R4000 VR4100
3196 28 = TagLo R4000 VR4100 VR4300
3197 29 = TagHi R4000 VR4100 VR4300
3198 30 = ErrorEPC R4000 VR4100 VR4300
3200 int code
= ((instruction
>> 21) & 0x1F);
3201 /* R4000 Users Manual (second edition) lists the following CP0
3203 DMFC0 Doubleword Move From CP0 (VR4100 = 01000000001tttttddddd00000000000)
3204 DMTC0 Doubleword Move To CP0 (VR4100 = 01000000101tttttddddd00000000000)
3205 MFC0 word Move From CP0 (VR4100 = 01000000000tttttddddd00000000000)
3206 MTC0 word Move To CP0 (VR4100 = 01000000100tttttddddd00000000000)
3207 TLBR Read Indexed TLB Entry (VR4100 = 01000010000000000000000000000001)
3208 TLBWI Write Indexed TLB Entry (VR4100 = 01000010000000000000000000000010)
3209 TLBWR Write Random TLB Entry (VR4100 = 01000010000000000000000000000110)
3210 TLBP Probe TLB for Matching Entry (VR4100 = 01000010000000000000000000001000)
3211 CACHE Cache operation (VR4100 = 101111bbbbbpppppiiiiiiiiiiiiiiii)
3212 ERET Exception return (VR4100 = 01000010000000000000000000011000)
3214 if (((code
== 0x00) || (code
== 0x04)) && ((instruction
& 0x7FF) == 0)) {
3215 int rt
= ((instruction
>> 16) & 0x1F);
3216 int rd
= ((instruction
>> 11) & 0x1F);
3217 if (code
== 0x00) { /* MF : move from */
3218 callback
->printf_filtered(callback
,"Warning: MFC0 %d,%d not handled yet (architecture specific)\n",rt
,rd
);
3219 GPR
[rt
] = 0xDEADC0DE; /* CPR[0,rd] */
3220 } else { /* MT : move to */
3221 /* CPR[0,rd] = GPR[rt]; */
3222 callback
->printf_filtered(callback
,"Warning: MTC0 %d,%d not handled yet (architecture specific)\n",rt
,rd
);
3225 callback
->printf_filtered(callback
,"Warning: Unrecognised COP0 instruction 0x%08X at IPC = 0x%08X%08X : No handler present\n",instruction
,WORD64HI(IPC
),WORD64LO(IPC
));
3226 /* TODO: When executing an ERET or RFE instruction we should
3227 clear LLBIT, to ensure that any out-standing atomic
3228 read/modify/write sequence fails. */
3232 case 2: /* undefined co-processor */
3233 callback
->printf_filtered(callback
,"Warning: COP2 instruction 0x%08X at IPC = 0x%08X%08X : No handler present\n",instruction
,WORD64HI(IPC
),WORD64LO(IPC
));
3236 case 1: /* should not occur (FPU co-processor) */
3237 case 3: /* should not occur (FPU co-processor) */
3238 SignalException(ReservedInstruction
,instruction
);
3245 /*-- instruction simulation -------------------------------------------------*/
3250 unsigned int pipeline_count
= 1;
3253 if (membank
== NULL
) {
3254 printf("DBG: simulate() entered with no memory\n");
3259 #if 0 /* Disabled to check that everything works OK */
3260 /* The VR4300 seems to sign-extend the PC on its first
3261 access. However, this may just be because it is currently
3262 configured in 32bit mode. However... */
3263 PC
= SIGNEXTEND(PC
,32);
3266 /* main controlling loop */
3268 /* Fetch the next instruction from the simulator memory: */
3269 uword64 vaddr
= (uword64
)PC
;
3272 unsigned int instruction
;
3273 int dsstate
= (state
& simDELAYSLOT
);
3277 printf("DBG: state = 0x%08X :",state
);
3278 if (state
& simSTOP
) printf(" simSTOP");
3279 if (state
& simSTEP
) printf(" simSTEP");
3280 if (state
& simHALTEX
) printf(" simHALTEX");
3281 if (state
& simHALTIN
) printf(" simHALTIN");
3282 if (state
& simBE
) printf(" simBE");
3288 callback
->printf_filtered(callback
,"DBG: DSPC = 0x%08X%08X\n",WORD64HI(DSPC
),WORD64LO(DSPC
));
3291 if (AddressTranslation(PC
,isINSTRUCTION
,isLOAD
,&paddr
,&cca
,isTARGET
,isREAL
)) { /* Copy the action of the LW instruction */
3292 unsigned int reverse
= (ReverseEndian
? 1 : 0);
3293 unsigned int bigend
= (BigEndianCPU
? 1 : 0);
3296 paddr
= ((paddr
& ~0x7) | ((paddr
& 0x7) ^ (reverse
<< 2)));
3297 value
= LoadMemory(cca
,AccessLength_WORD
,paddr
,vaddr
,isINSTRUCTION
,isREAL
);
3298 byte
= ((vaddr
& 0x7) ^ (bigend
<< 2));
3299 instruction
= ((value
>> (8 * byte
)) & 0xFFFFFFFF);
3301 fprintf(stderr
,"Cannot translate address for PC = 0x%08X%08X failed\n",WORD64HI(PC
),WORD64LO(PC
));
3306 callback
->printf_filtered(callback
,"DBG: fetched 0x%08X from PC = 0x%08X%08X\n",instruction
,WORD64HI(PC
),WORD64LO(PC
));
3309 #if !defined(FASTSIM) || defined(PROFILE)
3310 instruction_fetches
++;
3311 #if defined(PROFILE)
3312 if ((state
& simPROFILE
) && ((instruction_fetches
% profile_frequency
) == 0) && profile_hist
) {
3313 int n
= ((unsigned int)(PC
- profile_minpc
) >> (profile_shift
+ 2));
3314 if (n
< profile_nsamples
) {
3315 /* NOTE: The counts for the profiling bins are only 16bits wide */
3316 if (profile_hist
[n
] != USHRT_MAX
)
3317 (profile_hist
[n
])++;
3320 #endif /* PROFILE */
3321 #endif /* !FASTSIM && PROFILE */
3323 IPC
= PC
; /* copy PC for this instruction */
3324 /* This is required by exception processing, to ensure that we can
3325 cope with exceptions in the delay slots of branches that may
3326 already have changed the PC. */
3327 PC
+= 4; /* increment ready for the next fetch */
3328 /* NOTE: If we perform a delay slot change to the PC, this
3329 increment is not requuired. However, it would make the
3330 simulator more complicated to try and avoid this small hit. */
3332 /* Currently this code provides a simple model. For more
3333 complicated models we could perform exception status checks at
3334 this point, and set the simSTOP state as required. This could
3335 also include processing any hardware interrupts raised by any
3336 I/O model attached to the simulator context.
3338 Support for "asynchronous" I/O events within the simulated world
3339 could be providing by managing a counter, and calling a I/O
3340 specific handler when a particular threshold is reached. On most
3341 architectures a decrement and check for zero operation is
3342 usually quicker than an increment and compare. However, the
3343 process of managing a known value decrement to zero, is higher
3344 than the cost of using an explicit value UINT_MAX into the
3345 future. Which system is used will depend on how complicated the
3346 I/O model is, and how much it is likely to affect the simulator
3349 If events need to be scheduled further in the future than
3350 UINT_MAX event ticks, then the I/O model should just provide its
3351 own counter, triggered from the event system. */
3353 /* MIPS pipeline ticks. To allow for future support where the
3354 pipeline hit of individual instructions is known, this control
3355 loop manages a "pipeline_count" variable. It is initialised to
3356 1 (one), and will only be changed by the simulator engine when
3357 executing an instruction. If the engine does not have access to
3358 pipeline cycle count information then all instructions will be
3359 treated as using a single cycle. NOTE: A standard system is not
3360 provided by the default simulator because different MIPS
3361 architectures have different cycle counts for the same
3365 /* Set previous flag, depending on current: */
3366 if (state
& simPCOC0
)
3370 /* and update the current value: */
3377 /* NOTE: For multi-context simulation environments the "instruction"
3378 variable should be local to this routine. */
3380 /* Shorthand accesses for engine. Note: If we wanted to use global
3381 variables (and a single-threaded simulator engine), then we can
3382 create the actual variables with these names. */
3384 if (!(state
& simSKIPNEXT
)) {
3385 /* Include the simulator engine */
3387 #if ((GPRLEN == 64) && !defined(PROCESSOR_64BIT)) || ((GPRLEN == 32) && defined(PROCESSOR_64BIT))
3388 #error "Mismatch between run-time simulator code and simulation engine"
3391 #if defined(WARN_LOHI)
3392 /* Decrement the HI/LO validity ticks */
3397 #endif /* WARN_LOHI */
3399 #if defined(WARN_ZERO)
3400 /* For certain MIPS architectures, GPR[0] is hardwired to zero. We
3401 should check for it being changed. It is better doing it here,
3402 than within the simulator, since it will help keep the simulator
3405 callback
->printf_filtered(callback
,"SIM Warning: The ZERO register has been updated with 0x%08X%08X (PC = 0x%08X%08X)\nSIM Warning: Resetting back to zero\n",WORD64HI(ZERO
),WORD64LO(ZERO
),WORD64HI(IPC
),WORD64LO(IPC
));
3406 ZERO
= 0; /* reset back to zero before next instruction */
3408 #endif /* WARN_ZERO */
3409 } else /* simSKIPNEXT check */
3410 state
&= ~simSKIPNEXT
;
3412 /* If the delay slot was active before the instruction is
3413 executed, then update the PC to its new value: */
3416 printf("DBG: dsstate set before instruction execution - updating PC to 0x%08X%08X\n",WORD64HI(DSPC
),WORD64LO(DSPC
));
3419 state
&= ~simDELAYSLOT
;
3422 if (MIPSISA
< 4) { /* The following is only required on pre MIPS IV processors: */
3423 /* Deal with pending register updates: */
3425 printf("DBG: EMPTY BEFORE pending_in = %d, pending_out = %d, pending_total = %d\n",pending_in
,pending_out
,pending_total
);
3427 if (pending_out
!= pending_in
) {
3429 int index
= pending_out
;
3430 int total
= pending_total
;
3431 if (pending_total
== 0) {
3432 fprintf(stderr
,"FATAL: Mis-match on pending update pointers\n");
3435 for (loop
= 0; (loop
< total
); loop
++) {
3437 printf("DBG: BEFORE index = %d, loop = %d\n",index
,loop
);
3439 if (pending_slot_reg
[index
] != (LAST_EMBED_REGNUM
+ 1)) {
3441 printf("pending_slot_count[%d] = %d\n",index
,pending_slot_count
[index
]);
3443 if (--(pending_slot_count
[index
]) == 0) {
3445 printf("pending_slot_reg[%d] = %d\n",index
,pending_slot_reg
[index
]);
3446 printf("pending_slot_value[%d] = 0x%08X%08X\n",index
,WORD64HI(pending_slot_value
[index
]),WORD64LO(pending_slot_value
[index
]));
3448 if (pending_slot_reg
[index
] == COCIDX
) {
3449 SETFCC(0,((FCR31
& (1 << 23)) ? 1 : 0));
3451 registers
[pending_slot_reg
[index
]] = pending_slot_value
[index
];
3453 /* The only time we have PENDING updates to FPU
3454 registers, is when performing binary transfers. This
3455 means we should update the register type field. */
3456 if ((pending_slot_reg
[index
] >= FGRIDX
) && (pending_slot_reg
[index
] < (FGRIDX
+ 32)))
3457 fpr_state
[pending_slot_reg
[index
]] = fmt_uninterpreted
;
3461 printf("registers[%d] = 0x%08X%08X\n",pending_slot_reg
[index
],WORD64HI(registers
[pending_slot_reg
[index
]]),WORD64LO(registers
[pending_slot_reg
[index
]]));
3463 pending_slot_reg
[index
] = (LAST_EMBED_REGNUM
+ 1);
3465 if (pending_out
== PSLOTS
)
3471 printf("DBG: AFTER index = %d, loop = %d\n",index
,loop
);
3474 if (index
== PSLOTS
)
3479 printf("DBG: EMPTY AFTER pending_in = %d, pending_out = %d, pending_total = %d\n",pending_in
,pending_out
,pending_total
);
3483 #if !defined(FASTSIM)
3484 pipeline_ticks
+= pipeline_count
;
3485 #endif /* FASTSIM */
3487 if (state
& simSTEP
)
3489 } while (!(state
& simSTOP
));
3492 if (membank
== NULL
) {
3493 printf("DBG: simulate() LEAVING with no memory\n");
3501 /*---------------------------------------------------------------------------*/
3502 /*> EOF interp.c <*/