2 /* Simulator for the MIPS architecture.
4 This file is part of the MIPS sim
6 THIS SOFTWARE IS NOT COPYRIGHTED
8 Cygnus offers the following for use in the public domain. Cygnus
9 makes no warranty with regard to the software or it's performance
10 and the user accepts the software "AS IS" with all faults.
12 CYGNUS DISCLAIMS ANY WARRANTIES, EXPRESS OR IMPLIED, WITH REGARD TO
13 THIS SOFTWARE INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
14 MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22 We only need to take account of the target endianness when moving data
23 between the simulator and the host. We do not need to worry about the
24 endianness of the host, since this sim code and GDB are executing in
27 The IDT monitor (found on the VR4300 board), seems to lie about
28 register contents. It seems to treat the registers as sign-extended
29 32-bit values. This cause *REAL* problems when single-stepping 64-bit
34 /* The TRACE and PROFILE manifests enable the provision of extra
35 features. If they are not defined then a simpler (quicker)
36 simulator is constructed without the required run-time checks,
38 #if 1 /* 0 to allow user build selection, 1 to force inclusion */
45 #include "sim-utils.h"
46 #include "sim-options.h"
47 #include "sim-assert.h"
70 #include "libiberty.h"
72 #include "callback.h" /* GDB simulator callback interface */
73 #include "remote-sim.h" /* GDB simulator interface */
75 #include "support.h" /* internal support manifests */
83 char* pr_addr
PARAMS ((SIM_ADDR addr
));
84 char* pr_uword64
PARAMS ((uword64 addr
));
87 #define SIGBUS SIGSEGV
90 /* Get the simulator engine description, without including the code: */
95 struct sim_state simulator
;
97 /* The following reserved instruction value is used when a simulator
98 trap is required. NOTE: Care must be taken, since this value may be
99 used in later revisions of the MIPS ISA. */
100 #define RSVD_INSTRUCTION (0x00000005)
101 #define RSVD_INSTRUCTION_MASK (0xFC00003F)
103 #define RSVD_INSTRUCTION_ARG_SHIFT 6
104 #define RSVD_INSTRUCTION_ARG_MASK 0xFFFFF
107 /* NOTE: These numbers depend on the processor architecture being
109 #define Interrupt (0)
110 #define TLBModification (1)
113 #define AddressLoad (4)
114 #define AddressStore (5)
115 #define InstructionFetch (6)
116 #define DataReference (7)
117 #define SystemCall (8)
118 #define BreakPoint (9)
119 #define ReservedInstruction (10)
120 #define CoProcessorUnusable (11)
121 #define IntegerOverflow (12) /* Arithmetic overflow (IDT monitor raises SIGFPE) */
126 /* The following exception code is actually private to the simulator
127 world. It is *NOT* a processor feature, and is used to signal
128 run-time errors in the simulator. */
129 #define SimulatorFault (0xFFFFFFFF)
131 /* The following are generic to all versions of the MIPS architecture
133 /* Memory Access Types (for CCA): */
135 #define CachedNoncoherent (1)
136 #define CachedCoherent (2)
139 #define isINSTRUCTION (1 == 0) /* FALSE */
140 #define isDATA (1 == 1) /* TRUE */
142 #define isLOAD (1 == 0) /* FALSE */
143 #define isSTORE (1 == 1) /* TRUE */
145 #define isREAL (1 == 0) /* FALSE */
146 #define isRAW (1 == 1) /* TRUE */
148 #define isTARGET (1 == 0) /* FALSE */
149 #define isHOST (1 == 1) /* TRUE */
151 /* The "AccessLength" specifications for Loads and Stores. NOTE: This
152 is the number of bytes minus 1. */
153 #define AccessLength_BYTE (0)
154 #define AccessLength_HALFWORD (1)
155 #define AccessLength_TRIPLEBYTE (2)
156 #define AccessLength_WORD (3)
157 #define AccessLength_QUINTIBYTE (4)
158 #define AccessLength_SEXTIBYTE (5)
159 #define AccessLength_SEPTIBYTE (6)
160 #define AccessLength_DOUBLEWORD (7)
161 #define AccessLength_QUADWORD (15)
164 /* FPU registers must be one of the following types. All other values
165 are reserved (and undefined). */
171 /* The following are well outside the normal acceptable format
172 range, and are used in the register status vector. */
173 fmt_unknown
= 0x10000000,
174 fmt_uninterpreted
= 0x20000000,
178 /* NOTE: We cannot avoid globals, since the GDB "sim_" interface does
179 not allow a private variable to be passed around. This means that
180 simulators under GDB can only be single-threaded. However, it would
181 be possible for the simulators to be multi-threaded if GDB allowed
182 for a private pointer to be maintained. i.e. a general "void **ptr"
183 variable that GDB passed around in the argument list to all of
184 sim_xxx() routines. It could be initialised to NULL by GDB, and
185 then updated by sim_open() and used by the other sim_xxx() support
186 functions. This would allow new features in the simulator world,
187 like storing a context - continuing execution to gather a result,
188 and then going back to the point where the context was saved and
189 changing some state before continuing. i.e. the ability to perform
190 UNDOs on simulations. It would also allow the simulation of
191 shared-memory multi-processor systems.
193 [NOTE: This is now partially implemented] */
195 static host_callback
*callback
= NULL
; /* handle onto the current callback structure */
197 /* This is nasty, since we have to rely on matching the register
198 numbers used by GDB. Unfortunately, depending on the MIPS target
199 GDB uses different register numbers. We cannot just include the
200 relevant "gdb/tm.h" link, since GDB may not be configured before
201 the sim world, and also the GDB header file requires too much other
203 /* TODO: Sort out a scheme for *KNOWING* the mapping between real
204 registers, and the numbers that GDB uses. At the moment due to the
205 order that the tools are built, we cannot rely on a configured GDB
206 world whilst constructing the simulator. This means we have to
207 assume the GDB register number mapping. */
209 #define LAST_EMBED_REGNUM (89)
212 /* To keep this default simulator simple, and fast, we use a direct
213 vector of registers. The internal simulator engine then uses
214 manifests to access the correct slot. */
215 static ut_reg registers
[LAST_EMBED_REGNUM
+ 1];
216 static int register_widths
[LAST_EMBED_REGNUM
+ 1];
218 #define GPR (®isters[0])
221 #define FGR (®isters[FGRIDX])
223 #define LO (registers[33])
224 #define HI (registers[34])
225 #define PC (registers[37])
226 #define CAUSE (registers[36])
228 #define SR (registers[SRIDX]) /* CPU status register */
230 #define FCR0 (registers[FCR0IDX]) /* really a 32bit register */
231 #define FCR31IDX (70)
232 #define FCR31 (registers[FCR31IDX]) /* really a 32bit register */
234 #define COCIDX (LAST_EMBED_REGNUM + 2) /* special case : outside the normal range */
236 /* The following are pseudonyms for standard registers */
237 #define ZERO (registers[0])
238 #define V0 (registers[2])
239 #define A0 (registers[4])
240 #define A1 (registers[5])
241 #define A2 (registers[6])
242 #define A3 (registers[7])
243 #define SP (registers[29])
244 #define RA (registers[31])
247 /* start-sanitize-r5900 */
249 The R5900 has 128 bit registers, but the hi 64 bits are only touched by
250 multimedia (MMI) instructions. The normal mips instructions just use the
251 lower 64 bits. To avoid changing the older parts of the simulator to
252 handle this weirdness, the high 64 bits of each register are kept in
253 a separate array (registers1). The high 64 bits of any register are by
254 convention refered by adding a '1' to the end of the normal register's
255 name. So LO still refers to the low 64 bits of the LO register, LO1
256 refers to the high 64 bits of that same register.
259 /* The high part of each register */
260 static ut_reg registers1
[LAST_EMBED_REGNUM
+ 1];
262 #define GPR1 (®isters1[0])
264 #define LO1 (registers1[33])
265 #define HI1 (registers1[34])
267 #define BYTES_IN_MMI_REGS (sizeof(registers[0])+sizeof(registers1[0]))
268 #define HALFWORDS_IN_MMI_REGS (BYTES_IN_MMI_REGS/2)
269 #define WORDS_IN_MMI_REGS (BYTES_IN_MMI_REGS/4)
270 #define DOUBLEWORDS_IN_MMI_REGS (BYTES_IN_MMI_REGS/8)
272 #define BYTES_IN_MIPS_REGS (sizeof(registers[0]))
273 #define HALFWORDS_IN_MIPS_REGS (BYTES_IN_MIPS_REGS/2)
274 #define WORDS_IN_MIPS_REGS (BYTES_IN_MIPS_REGS/4)
275 #define DOUBLEWORDS_IN_MIPS_REGS (BYTES_IN_MIPS_REGS/8)
279 SUB_REG_FETCH - return as lvalue some sub-part of a "register"
280 T - type of the sub part
281 TC - # of T's in the mips part of the "register"
282 I - index (from 0) of desired sub part
283 A - low part of "register"
284 A1 - high part of register
286 #define SUB_REG_FETCH(T,TC,A,A1,I) (*(((T*)(((I) < (TC)) ? (A) : (A1))) + ((I) % (TC))))
289 GPR_<type>(R,I) - return, as lvalue, the I'th <type> of general register R
290 where <type> has two letters:
291 1 is S=signed or U=unsigned
292 2 is B=byte H=halfword W=word D=doubleword
295 #define SUB_REG_SB(A,A1,I) SUB_REG_FETCH(signed char, BYTES_IN_MIPS_REGS, A, A1, I)
296 #define SUB_REG_SH(A,A1,I) SUB_REG_FETCH(signed short, HALFWORDS_IN_MIPS_REGS, A, A1, I)
297 #define SUB_REG_SW(A,A1,I) SUB_REG_FETCH(signed int, WORDS_IN_MIPS_REGS, A, A1, I)
298 #define SUB_REG_SD(A,A1,I) SUB_REG_FETCH(signed long long, DOUBLEWORDS_IN_MIPS_REGS, A, A1, I)
300 #define SUB_REG_UB(A,A1,I) SUB_REG_FETCH(unsigned char, BYTES_IN_MIPS_REGS, A, A1, I)
301 #define SUB_REG_UH(A,A1,I) SUB_REG_FETCH(unsigned short, HALFWORDS_IN_MIPS_REGS, A, A1, I)
302 #define SUB_REG_UW(A,A1,I) SUB_REG_FETCH(unsigned int, WORDS_IN_MIPS_REGS, A, A1, I)
303 #define SUB_REG_UD(A,A1,I) SUB_REG_FETCH(unsigned long long,DOUBLEWORDS_IN_MIPS_REGS, A, A1, I)
307 #define GPR_SB(R,I) SUB_REG_SB(®isters[R], ®isters1[R], I)
308 #define GPR_SH(R,I) SUB_REG_SH(®isters[R], ®isters1[R], I)
309 #define GPR_SW(R,I) SUB_REG_SW(®isters[R], ®isters1[R], I)
310 #define GPR_SD(R,I) SUB_REG_SD(®isters[R], ®isters1[R], I)
312 #define GPR_UB(R,I) SUB_REG_UB(®isters[R], ®isters1[R], I)
313 #define GPR_UH(R,I) SUB_REG_UH(®isters[R], ®isters1[R], I)
314 #define GPR_UW(R,I) SUB_REG_UW(®isters[R], ®isters1[R], I)
315 #define GPR_UD(R,I) SUB_REG_UD(®isters[R], ®isters1[R], I)
318 #define RS_SB(I) SUB_REG_SB(&rs_reg, &rs_reg1, I)
319 #define RS_SH(I) SUB_REG_SH(&rs_reg, &rs_reg1, I)
320 #define RS_SW(I) SUB_REG_SW(&rs_reg, &rs_reg1, I)
321 #define RS_SD(I) SUB_REG_SD(&rs_reg, &rs_reg1, I)
323 #define RS_UB(I) SUB_REG_UB(&rs_reg, &rs_reg1, I)
324 #define RS_UH(I) SUB_REG_UH(&rs_reg, &rs_reg1, I)
325 #define RS_UW(I) SUB_REG_UW(&rs_reg, &rs_reg1, I)
326 #define RS_UD(I) SUB_REG_UD(&rs_reg, &rs_reg1, I)
328 #define RT_SB(I) SUB_REG_SB(&rt_reg, &rt_reg1, I)
329 #define RT_SH(I) SUB_REG_SH(&rt_reg, &rt_reg1, I)
330 #define RT_SW(I) SUB_REG_SW(&rt_reg, &rt_reg1, I)
331 #define RT_SD(I) SUB_REG_SD(&rt_reg, &rt_reg1, I)
333 #define RT_UB(I) SUB_REG_UB(&rt_reg, &rt_reg1, I)
334 #define RT_UH(I) SUB_REG_UH(&rt_reg, &rt_reg1, I)
335 #define RT_UW(I) SUB_REG_UW(&rt_reg, &rt_reg1, I)
336 #define RT_UD(I) SUB_REG_UD(&rt_reg, &rt_reg1, I)
340 #define LO_SB(I) SUB_REG_SB(&LO, &LO1, I)
341 #define LO_SH(I) SUB_REG_SH(&LO, &LO1, I)
342 #define LO_SW(I) SUB_REG_SW(&LO, &LO1, I)
343 #define LO_SD(I) SUB_REG_SD(&LO, &LO1, I)
345 #define LO_UB(I) SUB_REG_UB(&LO, &LO1, I)
346 #define LO_UH(I) SUB_REG_UH(&LO, &LO1, I)
347 #define LO_UW(I) SUB_REG_UW(&LO, &LO1, I)
348 #define LO_UD(I) SUB_REG_UD(&LO, &LO1, I)
350 #define HI_SB(I) SUB_REG_SB(&HI, &HI1, I)
351 #define HI_SH(I) SUB_REG_SH(&HI, &HI1, I)
352 #define HI_SW(I) SUB_REG_SW(&HI, &HI1, I)
353 #define HI_SD(I) SUB_REG_SD(&HI, &HI1, I)
355 #define HI_UB(I) SUB_REG_UB(&HI, &HI1, I)
356 #define HI_UH(I) SUB_REG_UH(&HI, &HI1, I)
357 #define HI_UW(I) SUB_REG_UW(&HI, &HI1, I)
358 #define HI_UD(I) SUB_REG_UD(&HI, &HI1, I)
359 /* end-sanitize-r5900 */
362 /* start-sanitize-r5900 */
363 static ut_reg SA
; /* the shift amount register */
364 /* end-sanitize-r5900 */
366 static ut_reg EPC
= 0; /* Exception PC */
369 /* Keep the current format state for each register: */
370 static FP_formats fpr_state
[32];
373 /* The following are internal simulator state variables: */
374 static ut_reg IPC
= 0; /* internal Instruction PC */
375 static ut_reg DSPC
= 0; /* delay-slot PC */
378 /* TODO : these should be the bitmasks for these bits within the
379 status register. At the moment the following are VR4300
381 #define status_KSU_mask (0x3) /* mask for KSU bits */
382 #define status_KSU_shift (3) /* shift for field */
383 #define ksu_kernel (0x0)
384 #define ksu_supervisor (0x1)
385 #define ksu_user (0x2)
386 #define ksu_unknown (0x3)
388 #define status_RE (1 << 25) /* Reverse Endian in user mode */
389 #define status_FR (1 << 26) /* enables MIPS III additional FP registers */
390 #define status_SR (1 << 20) /* soft reset or NMI */
391 #define status_BEV (1 << 22) /* Location of general exception vectors */
392 #define status_TS (1 << 21) /* TLB shutdown has occurred */
393 #define status_ERL (1 << 2) /* Error level */
394 #define status_RP (1 << 27) /* Reduced Power mode */
396 #define cause_BD ((unsigned)1 << 31) /* Exception in branch delay slot */
399 /* Macro to update FPSR condition-code field. This is complicated by
400 the fact that there is a hole in the index range of the bits within
401 the FCSR register. Also, the number of bits visible depends on the
402 MIPS ISA version being supported. */
403 #define SETFCC(cc,v) {\
404 int bit = ((cc == 0) ? 23 : (24 + (cc)));\
405 FCSR = ((FCSR & ~(1 << bit)) | ((v) << bit));\
407 #define GETFCC(cc) (((((cc) == 0) ? (FCSR & (1 << 23)) : (FCSR & (1 << (24 + (cc))))) != 0) ? 1 : 0)
409 /* This should be the COC1 value at the start of the preceding
411 #define PREVCOC1() ((state & simPCOC1) ? 1 : 0)
414 /* Standard FCRS bits: */
415 #define IR (0) /* Inexact Result */
416 #define UF (1) /* UnderFlow */
417 #define OF (2) /* OverFlow */
418 #define DZ (3) /* Division by Zero */
419 #define IO (4) /* Invalid Operation */
420 #define UO (5) /* Unimplemented Operation */
422 /* Get masks for individual flags: */
423 #if 1 /* SAFE version */
424 #define FP_FLAGS(b) (((unsigned)(b) < 5) ? (1 << ((b) + 2)) : 0)
425 #define FP_ENABLE(b) (((unsigned)(b) < 5) ? (1 << ((b) + 7)) : 0)
426 #define FP_CAUSE(b) (((unsigned)(b) < 6) ? (1 << ((b) + 12)) : 0)
428 #define FP_FLAGS(b) (1 << ((b) + 2))
429 #define FP_ENABLE(b) (1 << ((b) + 7))
430 #define FP_CAUSE(b) (1 << ((b) + 12))
433 #define FP_FS (1 << 24) /* MIPS III onwards : Flush to Zero */
435 #define FP_MASK_RM (0x3)
437 #define FP_RM_NEAREST (0) /* Round to nearest (Round) */
438 #define FP_RM_TOZERO (1) /* Round to zero (Trunc) */
439 #define FP_RM_TOPINF (2) /* Round to Plus infinity (Ceil) */
440 #define FP_RM_TOMINF (3) /* Round to Minus infinity (Floor) */
441 #define GETRM() (int)((FCSR >> FP_SH_RM) & FP_MASK_RM)
443 /* Slots for delayed register updates. For the moment we just have a
444 fixed number of slots (rather than a more generic, dynamic
445 system). This keeps the simulator fast. However, we only allow for
446 the register update to be delayed for a single instruction
448 #define PSLOTS (5) /* Maximum number of instruction cycles */
449 static int pending_in
;
450 static int pending_out
;
451 static int pending_total
;
452 static int pending_slot_count
[PSLOTS
];
453 static int pending_slot_reg
[PSLOTS
];
454 static ut_reg pending_slot_value
[PSLOTS
];
456 /*---------------------------------------------------------------------------*/
457 /*-- GDB simulator interface ------------------------------------------------*/
458 /*---------------------------------------------------------------------------*/
460 static void dotrace
PARAMS((FILE *tracefh
,int type
,SIM_ADDR address
,int width
,char *comment
,...));
461 static void sim_warning
PARAMS((char *fmt
,...));
462 extern void sim_error
PARAMS((char *fmt
,...));
463 static void ColdReset
PARAMS((void));
464 static int AddressTranslation
PARAMS((uword64 vAddr
,int IorD
,int LorS
,uword64
*pAddr
,int *CCA
,int host
,int raw
));
465 static void StoreMemory
PARAMS((int CCA
,int AccessLength
,uword64 MemElem
,uword64 MemElem1
,uword64 pAddr
,uword64 vAddr
,int raw
));
466 static void LoadMemory
PARAMS((uword64
*memvalp
,uword64
*memval1p
,int CCA
,int AccessLength
,uword64 pAddr
,uword64 vAddr
,int IorD
,int raw
));
467 static void SignalException
PARAMS((int exception
,...));
468 static long getnum
PARAMS((char *value
));
469 extern void sim_set_profile
PARAMS((int frequency
));
470 static unsigned int power2
PARAMS((unsigned int value
));
472 /*---------------------------------------------------------------------------*/
474 /* The following are not used for MIPS IV onwards: */
475 #define PENDING_FILL(r,v) {\
476 /* printf("DBG: FILL BEFORE pending_in = %d, pending_out = %d, pending_total = %d\n",pending_in,pending_out,pending_total); */\
477 if (pending_slot_reg[pending_in] != (LAST_EMBED_REGNUM + 1))\
478 sim_warning("Attempt to over-write pending value");\
479 pending_slot_count[pending_in] = 2;\
480 pending_slot_reg[pending_in] = (r);\
481 pending_slot_value[pending_in] = (uword64)(v);\
482 /*printf("DBG: FILL reg %d value = 0x%s\n",(r),pr_addr(v));*/\
485 if (pending_in == PSLOTS)\
487 /*printf("DBG: FILL AFTER pending_in = %d, pending_out = %d, pending_total = %d\n",pending_in,pending_out,pending_total);*/\
490 static int LLBIT
= 0;
491 /* LLBIT = Load-Linked bit. A bit of "virtual" state used by atomic
492 read-write instructions. It is set when a linked load occurs. It is
493 tested and cleared by the conditional store. It is cleared (during
494 other CPU operations) when a store to the location would no longer
495 be atomic. In particular, it is cleared by exception return
498 static int HIACCESS
= 0;
499 static int LOACCESS
= 0;
500 static int HI1ACCESS
= 0;
501 static int LO1ACCESS
= 0;
503 /* ??? The 4300 and a few other processors have interlocks on hi/lo register
504 reads, and hence do not have this problem. To avoid spurious warnings,
505 we just disable this always. */
509 /* The HIACCESS and LOACCESS counts are used to ensure that
510 corruptions caused by using the HI or LO register to close to a
511 following operation are spotted. */
512 static ut_reg HLPC
= 0;
513 /* If either of the preceding two instructions have accessed the HI or
514 LO registers, then the values they see should be
515 undefined. However, to keep the simulator world simple, we just let
516 them use the value read and raise a warning to notify the user: */
517 #define CHECKHILO(s) {\
518 if ((HIACCESS != 0) || (LOACCESS != 0) || (HI1ACCESS != 0) || (LO1ACCESS != 0))\
519 sim_warning("%s over-writing HI and LO registers values (PC = 0x%s HLPC = 0x%s)\n",(s),pr_addr(PC),pr_addr(HLPC));\
523 /* NOTE: We keep the following status flags as bit values (1 for true,
524 0 for false). This allows them to be used in binary boolean
525 operations without worrying about what exactly the non-zero true
529 #define UserMode ((((SR & status_KSU_mask) >> status_KSU_shift) == ksu_user) ? 1 : 0)
532 /* Hardware configuration. Affects endianness of LoadMemory and
533 StoreMemory and the endianness of Kernel and Supervisor mode
534 execution. The value is 0 for little-endian; 1 for big-endian. */
535 #define BigEndianMem (CURRENT_TARGET_BYTE_ORDER == BIG_ENDIAN)
536 /*(state & simBE) ? 1 : 0)*/
539 /* This is true if the host and target have different endianness. */
540 #define ByteSwapMem (CURRENT_TARGET_BYTE_ORDER != CURRENT_HOST_BYTE_ORDER)
543 /* This mode is selected if in User mode with the RE bit being set in
544 SR (Status Register). It reverses the endianness of load and store
546 #define ReverseEndian (((SR & status_RE) && UserMode) ? 1 : 0)
549 /* The endianness for load and store instructions (0=little;1=big). In
550 User mode this endianness may be switched by setting the state_RE
551 bit in the SR register. Thus, BigEndianCPU may be computed as
552 (BigEndianMem EOR ReverseEndian). */
553 #define BigEndianCPU (BigEndianMem ^ ReverseEndian) /* Already bits */
555 #if !defined(FASTSIM) || defined(PROFILE)
556 /* At the moment these values will be the same, since we do not have
557 access to the pipeline cycle count information from the simulator
559 static unsigned int instruction_fetches
= 0;
560 static unsigned int instruction_fetch_overflow
= 0;
563 /* Flags in the "state" variable: */
564 #define simHALTEX (1 << 2) /* 0 = run; 1 = halt on exception */
565 #define simHALTIN (1 << 3) /* 0 = run; 1 = halt on interrupt */
566 #define simTRACE (1 << 8) /* 0 = do nothing; 1 = trace address activity */
567 #define simPROFILE (1 << 9) /* 0 = do nothing; 1 = gather profiling samples */
568 #define simPCOC0 (1 << 17) /* COC[1] from current */
569 #define simPCOC1 (1 << 18) /* COC[1] from previous */
570 #define simDELAYSLOT (1 << 24) /* 0 = do nothing; 1 = delay slot entry exists */
571 #define simSKIPNEXT (1 << 25) /* 0 = do nothing; 1 = skip instruction */
572 #define simSIGINT (1 << 28) /* 0 = do nothing; 1 = SIGINT has occured */
573 #define simJALDELAYSLOT (1 << 29) /* 1 = in jal delay slot */
575 static unsigned int state
= 0;
577 #define DELAYSLOT() {\
578 if (state & simDELAYSLOT)\
579 sim_warning("Delay slot already activated (branch in delay slot?)");\
580 state |= simDELAYSLOT;\
583 #define JALDELAYSLOT() {\
585 state |= simJALDELAYSLOT;\
589 state &= ~simDELAYSLOT;\
590 state |= simSKIPNEXT;\
593 #define INDELAYSLOT() ((state & simDELAYSLOT) != 0)
594 #define INJALDELAYSLOT() ((state & simJALDELAYSLOT) != 0)
596 #define K0BASE (0x80000000)
597 #define K0SIZE (0x20000000)
598 #define K1BASE (0xA0000000)
599 #define K1SIZE (0x20000000)
601 /* Simple run-time monitor support */
602 static unsigned char *monitor
= NULL
;
603 static ut_reg monitor_base
= 0xBFC00000;
604 static unsigned monitor_size
= (1 << 11); /* power-of-2 */
606 static char *logfile
= NULL
; /* logging disabled by default */
607 static FILE *logfh
= NULL
;
610 static char *tracefile
= "trace.din"; /* default filename for trace log */
611 static FILE *tracefh
= NULL
;
612 static void open_trace
PARAMS((void));
616 static unsigned profile_frequency
= 256;
617 static unsigned profile_nsamples
= (128 << 10);
618 static unsigned short *profile_hist
= NULL
;
619 static ut_reg profile_minpc
;
620 static ut_reg profile_maxpc
;
621 static int profile_shift
= 0; /* address shift amount */
626 mips_option_handler (sd
, opt
, arg
)
636 tmp
= (char *)malloc(strlen(arg
) + 1);
638 callback
->printf_filtered(callback
,"Failed to allocate buffer for logfile name \"%s\"\n",optarg
);
647 callback
->printf_filtered(callback
,"Explicit model selection not yet available (Ignoring \"%s\")\n",optarg
);
652 /* Eventually the simTRACE flag could be treated as a toggle, to
653 allow external control of the program points being traced
654 (i.e. only from main onwards, excluding the run-time setup,
658 else if (strcmp (arg
, "yes") == 0)
660 else if (strcmp (arg
, "no") == 0)
664 fprintf (stderr
, "Unreconized trace option `%s'\n", arg
);
670 Simulator constructed without tracing support (for performance).\n\
671 Re-compile simulator with \"-DTRACE\" to enable this option.\n");
677 if (optarg
!= NULL
) {
679 tmp
= (char *)malloc(strlen(optarg
) + 1);
682 callback
->printf_filtered(callback
,"Failed to allocate buffer for tracefile name \"%s\"\n",optarg
);
688 callback
->printf_filtered(callback
,"Placing trace information into file \"%s\"\n",tracefile
);
700 Simulator constructed without profiling support (for performance).\n\
701 Re-compile simulator with \"-DPROFILE\" to enable this option.\n");
703 #endif /* !PROFILE */
707 profile_nsamples
= (unsigned)getnum(optarg
);
713 sim_set_profile((int)getnum(optarg
));
722 static const OPTION mips_options
[] =
724 { {"log", required_argument
, NULL
,'l'},
725 'l', "FILE", "Log file",
726 mips_option_handler
},
727 { {"name", required_argument
, NULL
,'n'},
728 'n', "MODEL", "Select arch model",
729 mips_option_handler
},
730 { {"profile", optional_argument
, NULL
,'p'},
731 'p', "on|off", "Enable profiling",
732 mips_option_handler
},
733 { {"trace", optional_argument
, NULL
,'t'},
734 't', "on|off", "Enable tracing",
735 mips_option_handler
},
736 { {"tracefile",required_argument
, NULL
,'z'},
737 'z', "FILE", "Write trace to file",
738 mips_option_handler
},
739 { {"frequency",required_argument
, NULL
,'y'},
740 'y', "FREQ", "Profile frequency",
741 mips_option_handler
},
742 { {"samples", required_argument
, NULL
,'x'},
743 'y', "SIZE", "Profile sample size",
744 mips_option_handler
},
745 { {NULL
, no_argument
, NULL
, 0}, '\0', NULL
, NULL
, NULL
}
750 interrupt_event (SIM_DESC sd
, void *data
)
752 SignalException (Interrupt
);
757 /*---------------------------------------------------------------------------*/
758 /*-- GDB simulator interface ------------------------------------------------*/
759 /*---------------------------------------------------------------------------*/
762 sim_open (kind
,cb
,argv
)
767 SIM_DESC sd
= &simulator
;
769 STATE_OPEN_KIND (sd
) = kind
;
770 STATE_MAGIC (sd
) = SIM_MAGIC_NUMBER
;
771 STATE_CALLBACK (sd
) = cb
;
773 CPU_STATE (STATE_CPU (sd
, 0)) = sd
;
775 /* FIXME: watchpoints code shouldn't need this */
776 STATE_WATCHPOINTS (sd
)->pc
= &(PC
);
777 STATE_WATCHPOINTS (sd
)->sizeof_pc
= sizeof (PC
);
778 STATE_WATCHPOINTS (sd
)->interrupt_handler
= interrupt_event
;
780 /* memory defaults (unless sim_size was here first) */
781 if (STATE_MEM_SIZE (sd
) == 0)
782 STATE_MEM_SIZE (sd
) = (2 << 20);
783 STATE_MEM_BASE (sd
) = K1BASE
;
785 if (callback
== NULL
) {
786 fprintf(stderr
,"SIM Error: sim_open() called without callbacks attached\n");
792 if (sim_pre_argv_init (sd
, argv
[0]) != SIM_RC_OK
)
794 sim_add_option_table (sd
, mips_options
);
796 /* getopt will print the error message so we just have to exit if this fails.
797 FIXME: Hmmm... in the case of gdb we need getopt to call
799 if (sim_parse_args (sd
, argv
) != SIM_RC_OK
)
801 /* Uninstall the modules to avoid memory leaks,
802 file descriptor leaks, etc. */
803 sim_module_uninstall (sd
);
807 if (sim_post_argv_init (sd
) != SIM_RC_OK
)
809 /* Uninstall the modules to avoid memory leaks,
810 file descriptor leaks, etc. */
811 sim_module_uninstall (sd
);
815 /* verify assumptions the simulator made about the host type system.
816 This macro does not return if there is a problem */
820 /* Check that the host FPU conforms to IEEE 754-1985 for the SINGLE
821 and DOUBLE binary formats. This is a bit nasty, requiring that we
822 trust the explicit manifests held in the source: */
823 /* TODO: We need to cope with the simulated target and the host not
824 having the same endianness. This will require the high and low
825 words of a (double) to be swapped when converting between the
826 host and the simulated target. */
834 s
.d
= (double)523.2939453125;
836 if ((s
.i
[0] == 0 && (s
.f
[1] != (float)4.01102924346923828125
837 || s
.i
[1] != 0x40805A5A))
838 || (s
.i
[1] == 0 && (s
.f
[0] != (float)4.01102924346923828125
839 || s
.i
[0] != 0x40805A5A)))
841 fprintf(stderr
,"The host executing the simulator does not seem to have IEEE 754-1985 std FP\n");
847 /* This is NASTY, in that we are assuming the size of specific
851 for (rn
= 0; (rn
< (LAST_EMBED_REGNUM
+ 1)); rn
++) {
853 register_widths
[rn
] = GPRLEN
;
854 else if ((rn
>= FGRIDX
) && (rn
< (FGRIDX
+ 32)))
855 register_widths
[rn
] = GPRLEN
;
856 else if ((rn
>= 33) && (rn
<= 37))
857 register_widths
[rn
] = GPRLEN
;
858 else if ((rn
== SRIDX
) || (rn
== FCR0IDX
) || (rn
== FCR31IDX
) || ((rn
>= 72) && (rn
<= 89)))
859 register_widths
[rn
] = 32;
861 register_widths
[rn
] = 0;
866 if (logfile
!= NULL
) {
867 if (strcmp(logfile
,"-") == 0)
870 logfh
= fopen(logfile
,"wb+");
872 callback
->printf_filtered(callback
,"Failed to create file \"%s\", writing log information to stderr.\n",tracefile
);
878 /* FIXME: In the future both of these malloc's can be replaced by
879 calls to sim-core. */
881 /* If the host has "mmap" available we could use it to provide a
882 very large virtual address space for the simulator, since memory
883 would only be allocated within the "mmap" space as it is
884 accessed. This can also be linked to the architecture specific
885 support, required to simulate the MMU. */
886 sim_size(STATE_MEM_SIZE (sd
));
887 /* NOTE: The above will also have enabled any profiling state! */
889 /* Create the monitor address space as well */
890 monitor
= (unsigned char *)calloc(1,monitor_size
);
892 fprintf(stderr
,"Not enough VM for monitor simulation (%d bytes)\n",
896 if (state
& simTRACE
)
907 tracefh
= fopen(tracefile
,"wb+");
910 sim_warning("Failed to create file \"%s\", writing trace information to stderr.",tracefile
);
916 /* For the profile writing, we write the data in the host
917 endianness. This unfortunately means we are assuming that the
918 profile file we create is processed on the same host executing the
919 simulator. The gmon.out file format should either have an explicit
920 endianness, or a method of encoding the endianness in the file
930 if (CURRENT_HOST_BYTE_ORDER
== BIG_ENDIAN
) {
931 buff
[3] = ((val
>> 0) & 0xFF);
932 buff
[2] = ((val
>> 8) & 0xFF);
933 buff
[1] = ((val
>> 16) & 0xFF);
934 buff
[0] = ((val
>> 24) & 0xFF);
936 buff
[0] = ((val
>> 0) & 0xFF);
937 buff
[1] = ((val
>> 8) & 0xFF);
938 buff
[2] = ((val
>> 16) & 0xFF);
939 buff
[3] = ((val
>> 24) & 0xFF);
941 if (fwrite(buff
,4,1,fh
) != 1) {
942 sim_warning("Failed to write 4bytes to the profile file");
955 if (CURRENT_HOST_BYTE_ORDER
== BIG_ENDIAN
) {
956 buff
[1] = ((val
>> 0) & 0xFF);
957 buff
[0] = ((val
>> 8) & 0xFF);
959 buff
[0] = ((val
>> 0) & 0xFF);
960 buff
[1] = ((val
>> 8) & 0xFF);
962 if (fwrite(buff
,2,1,fh
) != 1) {
963 sim_warning("Failed to write 2bytes to the profile file");
970 sim_close (sd
, quitting
)
975 printf("DBG: sim_close: entered (quitting = %d)\n",quitting
);
978 /* Cannot assume sim_kill() has been called */
979 /* "quitting" is non-zero if we cannot hang on errors */
981 /* Ensure that any resources allocated through the callback
982 mechanism are released: */
983 callback
->shutdown(callback
);
986 if ((state
& simPROFILE
) && (profile_hist
!= NULL
)) {
987 FILE *pf
= fopen("gmon.out","wb");
991 sim_warning("Failed to open \"gmon.out\" profile file");
995 printf("DBG: minpc = 0x%s\n",pr_addr(profile_minpc
));
996 printf("DBG: maxpc = 0x%s\n",pr_addr(profile_maxpc
));
998 ok
= writeout32(pf
,(unsigned int)profile_minpc
);
1000 ok
= writeout32(pf
,(unsigned int)profile_maxpc
);
1002 ok
= writeout32(pf
,(profile_nsamples
* 2) + 12); /* size of sample buffer (+ header) */
1004 printf("DBG: nsamples = %d (size = 0x%08X)\n",profile_nsamples
,((profile_nsamples
* 2) + 12));
1006 for (loop
= 0; (ok
&& (loop
< profile_nsamples
)); loop
++) {
1007 ok
= writeout16(pf
,profile_hist
[loop
]);
1016 profile_hist
= NULL
;
1017 state
&= ~simPROFILE
;
1019 #endif /* PROFILE */
1022 if (tracefh
!= NULL
&& tracefh
!= stderr
)
1028 if (logfh
!= NULL
&& logfh
!= stdout
&& logfh
!= stderr
)
1032 if (STATE_MEMORY (sd
) != NULL
)
1033 free(STATE_MEMORY (sd
)); /* cfree not available on all hosts */
1034 STATE_MEMORY (sd
) = NULL
;
1041 sim_write (sd
,addr
,buffer
,size
)
1044 unsigned char *buffer
;
1048 uword64 vaddr
= (uword64
)addr
;
1050 /* Return the number of bytes written, or zero if error. */
1052 callback
->printf_filtered(callback
,"sim_write(0x%s,buffer,%d);\n",pr_addr(addr
),size
);
1055 /* We provide raw read and write routines, since we do not want to
1056 count the GDB memory accesses in our statistics gathering. */
1058 /* There is a lot of code duplication in the individual blocks
1059 below, but the variables are declared locally to a block to give
1060 the optimiser the best chance of improving the code. We have to
1061 perform slow byte reads from the host memory, to ensure that we
1062 get the data into the correct endianness for the (simulated)
1063 target memory world. */
1065 /* Mask count to get odd byte, odd halfword, and odd word out of the
1066 way. We can then perform doubleword transfers to and from the
1067 simulator memory for optimum performance. */
1068 if (index
&& (index
& 1)) {
1071 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
1072 uword64 value
= ((uword64
)(*buffer
++));
1073 StoreMemory(cca
,AccessLength_BYTE
,value
,0,paddr
,vaddr
,isRAW
);
1076 index
&= ~1; /* logical operations usually quicker than arithmetic on RISC systems */
1078 if (index
&& (index
& 2)) {
1081 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
1083 /* We need to perform the following magic to ensure that that
1084 bytes are written into same byte positions in the target memory
1085 world, regardless of the endianness of the host. */
1087 value
= ((uword64
)(*buffer
++) << 8);
1088 value
|= ((uword64
)(*buffer
++) << 0);
1090 value
= ((uword64
)(*buffer
++) << 0);
1091 value
|= ((uword64
)(*buffer
++) << 8);
1093 StoreMemory(cca
,AccessLength_HALFWORD
,value
,0,paddr
,vaddr
,isRAW
);
1098 if (index
&& (index
& 4)) {
1101 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
1104 value
= ((uword64
)(*buffer
++) << 24);
1105 value
|= ((uword64
)(*buffer
++) << 16);
1106 value
|= ((uword64
)(*buffer
++) << 8);
1107 value
|= ((uword64
)(*buffer
++) << 0);
1109 value
= ((uword64
)(*buffer
++) << 0);
1110 value
|= ((uword64
)(*buffer
++) << 8);
1111 value
|= ((uword64
)(*buffer
++) << 16);
1112 value
|= ((uword64
)(*buffer
++) << 24);
1114 StoreMemory(cca
,AccessLength_WORD
,value
,0,paddr
,vaddr
,isRAW
);
1119 for (;index
; index
-= 8) {
1122 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
1125 value
= ((uword64
)(*buffer
++) << 56);
1126 value
|= ((uword64
)(*buffer
++) << 48);
1127 value
|= ((uword64
)(*buffer
++) << 40);
1128 value
|= ((uword64
)(*buffer
++) << 32);
1129 value
|= ((uword64
)(*buffer
++) << 24);
1130 value
|= ((uword64
)(*buffer
++) << 16);
1131 value
|= ((uword64
)(*buffer
++) << 8);
1132 value
|= ((uword64
)(*buffer
++) << 0);
1134 value
= ((uword64
)(*buffer
++) << 0);
1135 value
|= ((uword64
)(*buffer
++) << 8);
1136 value
|= ((uword64
)(*buffer
++) << 16);
1137 value
|= ((uword64
)(*buffer
++) << 24);
1138 value
|= ((uword64
)(*buffer
++) << 32);
1139 value
|= ((uword64
)(*buffer
++) << 40);
1140 value
|= ((uword64
)(*buffer
++) << 48);
1141 value
|= ((uword64
)(*buffer
++) << 56);
1143 StoreMemory(cca
,AccessLength_DOUBLEWORD
,value
,0,paddr
,vaddr
,isRAW
);
1152 sim_read (sd
,addr
,buffer
,size
)
1155 unsigned char *buffer
;
1160 /* Return the number of bytes read, or zero if error. */
1162 callback
->printf_filtered(callback
,"sim_read(0x%s,buffer,%d);\n",pr_addr(addr
),size
);
1165 /* TODO: Perform same optimisation as the sim_write() code
1166 above. NOTE: This will require a bit more work since we will need
1167 to ensure that the source physical address is doubleword aligned
1168 before, and then deal with trailing bytes. */
1169 for (index
= 0; (index
< size
); index
++) {
1170 uword64 vaddr
,paddr
,value
;
1172 vaddr
= (uword64
)addr
+ index
;
1173 if (AddressTranslation(vaddr
,isDATA
,isLOAD
,&paddr
,&cca
,isTARGET
,isRAW
)) {
1174 LoadMemory(&value
,NULL
,cca
,AccessLength_BYTE
,paddr
,vaddr
,isDATA
,isRAW
);
1175 buffer
[index
] = (unsigned char)(value
&0xFF);
1184 sim_store_register (sd
,rn
,memory
)
1187 unsigned char *memory
;
1189 /* NOTE: gdb (the client) stores registers in target byte order
1190 while the simulator uses host byte order */
1192 callback
->printf_filtered(callback
,"sim_store_register(%d,*memory=0x%s);\n",rn
,pr_addr(*((SIM_ADDR
*)memory
)));
1195 /* Unfortunately this suffers from the same problem as the register
1196 numbering one. We need to know what the width of each logical
1197 register number is for the architecture being simulated. */
1199 if (register_widths
[rn
] == 0)
1200 sim_warning("Invalid register width for %d (register store ignored)",rn
);
1203 if (register_widths
[rn
] == 32)
1204 registers
[rn
] = T2H_4 (*(unsigned int*)memory
);
1206 registers
[rn
] = T2H_8 (*(uword64
*)memory
);
1213 sim_fetch_register (sd
,rn
,memory
)
1216 unsigned char *memory
;
1218 /* NOTE: gdb (the client) stores registers in target byte order
1219 while the simulator uses host byte order */
1221 callback
->printf_filtered(callback
,"sim_fetch_register(%d=0x%s,mem) : place simulator registers into memory\n",rn
,pr_addr(registers
[rn
]));
1224 if (register_widths
[rn
] == 0)
1225 sim_warning("Invalid register width for %d (register fetch ignored)",rn
);
1228 if (register_widths
[rn
] == 32)
1229 *((unsigned int *)memory
) = H2T_4 ((unsigned int)(registers
[rn
] & 0xFFFFFFFF));
1230 else /* 64bit register */
1231 *((uword64
*)memory
) = H2T_8 (registers
[rn
]);
1239 sim_info (sd
,verbose
)
1243 /* Accessed from the GDB "info files" command: */
1245 callback
->printf_filtered(callback
,"MIPS %d-bit simulator\n",(PROCESSOR_64BIT
? 64 : 32));
1247 callback
->printf_filtered(callback
,"%s endian memory model\n",
1248 (CURRENT_TARGET_BYTE_ORDER
== BIG_ENDIAN
1249 ? "Big" : "Little"));
1251 callback
->printf_filtered(callback
,"0x%08X bytes of memory at 0x%s\n",
1252 STATE_MEM_SIZE (sd
),
1253 pr_addr (STATE_MEM_BASE (sd
)));
1255 #if !defined(FASTSIM)
1256 if (instruction_fetch_overflow
!= 0)
1257 callback
->printf_filtered(callback
,"Instruction fetches = 0x%08X%08X\n",instruction_fetch_overflow
,instruction_fetches
);
1259 callback
->printf_filtered(callback
,"Instruction fetches = %d\n",instruction_fetches
);
1260 callback
->printf_filtered(callback
,"Pipeline ticks = %ld\n",
1261 (long) sim_events_time (sd
));
1262 /* It would be a useful feature, if when performing multi-cycle
1263 simulations (rather than single-stepping) we keep the start and
1264 end times of the execution, so that we can give a performance
1265 figure for the simulator. */
1266 #endif /* !FASTSIM */
1268 /* print information pertaining to MIPS ISA and architecture being simulated */
1269 /* things that may be interesting */
1270 /* instructions executed - if available */
1271 /* cycles executed - if available */
1272 /* pipeline stalls - if available */
1273 /* virtual time taken */
1274 /* profiling size */
1275 /* profiling frequency */
1283 sim_load (sd
,prog
,abfd
,from_tty
)
1291 prog_bfd
= sim_load_file (sd
,
1295 /* pass NULL for abfd, we always open our own */
1297 STATE_OPEN_KIND (sd
) == SIM_OPEN_DEBUG
);
1298 if (prog_bfd
== NULL
)
1300 sim_analyze_program (sd
, prog_bfd
);
1302 /* Configure/verify the target byte order and other runtime
1303 configuration options */
1304 sim_config (sd
, PREFERED_TARGET_BYTE_ORDER(prog_bfd
));
1306 /* (re) Write the monitor trap address handlers into the monitor
1307 (eeprom) address space. This can only be done once the target
1308 endianness has been determined. */
1311 /* Entry into the IDT monitor is via fixed address vectors, and
1312 not using machine instructions. To avoid clashing with use of
1313 the MIPS TRAP system, we place our own (simulator specific)
1314 "undefined" instructions into the relevant vector slots. */
1315 for (loop
= 0; (loop
< monitor_size
); loop
+= 4) {
1316 uword64 vaddr
= (monitor_base
+ loop
);
1319 if (AddressTranslation(vaddr
, isDATA
, isSTORE
, &paddr
, &cca
, isTARGET
, isRAW
))
1320 StoreMemory(cca
, AccessLength_WORD
,
1321 (RSVD_INSTRUCTION
| (((loop
>> 2) & RSVD_INSTRUCTION_ARG_MASK
) << RSVD_INSTRUCTION_ARG_SHIFT
)),
1322 0, paddr
, vaddr
, isRAW
);
1324 /* The PMON monitor uses the same address space, but rather than
1325 branching into it the address of a routine is loaded. We can
1326 cheat for the moment, and direct the PMON routine to IDT style
1327 instructions within the monitor space. This relies on the IDT
1328 monitor not using the locations from 0xBFC00500 onwards as its
1330 for (loop
= 0; (loop
< 24); loop
++)
1332 uword64 vaddr
= (monitor_base
+ 0x500 + (loop
* 4));
1335 unsigned int value
= ((0x500 - 8) / 8); /* default UNDEFINED reason code */
1354 case 5: /* printf */
1355 value
= ((0x500 - 16) / 8); /* not an IDT reason code */
1358 case 8: /* cliexit */
1362 case 11: /* flush_cache */
1366 /* FIXME - should monitor_base be SIM_ADDR?? */
1367 value
= ((unsigned int)monitor_base
+ (value
* 8));
1368 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
))
1369 StoreMemory(cca
,AccessLength_WORD
,value
,0,paddr
,vaddr
,isRAW
);
1371 sim_error("Failed to write to monitor space 0x%s",pr_addr(vaddr
));
1373 /* The LSI MiniRISC PMON has its vectors at 0x200, not 0x500. */
1375 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
))
1376 StoreMemory(cca
,AccessLength_WORD
,value
,0,paddr
,vaddr
,isRAW
);
1378 sim_error("Failed to write to monitor space 0x%s",pr_addr(vaddr
));
1386 sim_create_inferior (sd
, argv
,env
)
1393 printf("DBG: sim_create_inferior entered: start_address = 0x%s\n",
1398 /* If we were providing a more complete I/O, co-processor or memory
1399 simulation, we should perform any "device" initialisation at this
1400 point. This can include pre-loading memory areas with particular
1401 patterns (e.g. simulating ROM monitors). */
1404 PC
= (uword64
) STATE_START_ADDR(sd
);
1406 /* TODO: Sort this properly. SIM_ADDR may already be a 64bit value: */
1407 PC
= SIGNEXTEND(bfd_get_start_address(prog_bfd
),32);
1410 /* Prepare to execute the program to be simulated */
1411 /* argv and env are NULL terminated lists of pointers */
1414 #if 0 /* def DEBUG */
1415 callback
->printf_filtered(callback
,"sim_create_inferior() : passed arguments ignored\n");
1418 for (cptr
= argv
; (cptr
&& *cptr
); cptr
++)
1419 printf("DBG: arg \"%s\"\n",*cptr
);
1422 /* We should really place the argv slot values into the argument
1423 registers, and onto the stack as required. However, this
1424 assumes that we have a stack defined, which is not necessarily
1425 true at the moment. */
1436 /* This routine should be for terminating any existing simulation
1437 thread. Since we are single-threaded only at the moment, this is
1438 not an issue. It should *NOT* be used to terminate the
1440 #else /* do *NOT* call sim_close */
1441 sim_close(sd
, 1); /* Do not hang on errors */
1442 /* This would also be the point where any memory mapped areas used
1443 by the simulator should be released. */
1448 typedef enum {e_terminate
,e_help
,e_setmemsize
,e_reset
} e_cmds
;
1450 static struct t_sim_command
{
1454 } sim_commands
[] = {
1455 {e_help
, "help", ": Show MIPS simulator private commands"},
1456 {e_setmemsize
,"set-memory-size","<n> : Specify amount of memory simulated"},
1457 {e_reset
, "reset-system", ": Reset the simulated processor"},
1462 sim_do_command (sd
,cmd
)
1466 struct t_sim_command
*cptr
;
1468 if (callback
== NULL
) {
1469 fprintf(stderr
,"Simulator not enabled: \"target sim\" should be used to activate\n");
1473 if (!(cmd
&& *cmd
!= '\0'))
1476 /* NOTE: Accessed from the GDB "sim" commmand: */
1477 for (cptr
= sim_commands
; cptr
&& cptr
->name
; cptr
++)
1478 if (strncmp(cmd
,cptr
->name
,strlen(cptr
->name
)) == 0) {
1479 cmd
+= strlen(cptr
->name
);
1481 case e_help
: /* no arguments */
1482 { /* no arguments */
1483 struct t_sim_command
*lptr
;
1484 callback
->printf_filtered(callback
,"List of MIPS simulator commands:\n");
1485 for (lptr
= sim_commands
; lptr
->name
; lptr
++)
1486 callback
->printf_filtered(callback
,"%s %s\n",lptr
->name
,lptr
->help
);
1490 case e_setmemsize
: /* memory size argument */
1492 unsigned int newsize
= (unsigned int)getnum(cmd
);
1497 case e_reset
: /* no arguments */
1499 /* NOTE: See the comments in sim_open() relating to device
1504 callback
->printf_filtered(callback
,"FATAL: Matched \"%s\", but failed to match command id %d.\n",cmd
,cptr
->id
);
1511 callback
->printf_filtered(callback
,"Error: \"%s\" is not a valid MIPS simulator command.\n",cmd
);
1516 /*---------------------------------------------------------------------------*/
1517 /* NOTE: The following routines do not seem to be used by GDB at the
1518 moment. However, they may be useful to the standalone simulator
1522 /* The profiling format is described in the "gmon_out.h" header file */
1527 #if defined(PROFILE)
1528 profile_frequency
= n
;
1529 state
|= simPROFILE
;
1530 #endif /* PROFILE */
1535 sim_set_profile_size (n
)
1538 SIM_DESC sd
= &simulator
;
1539 #if defined(PROFILE)
1540 if (state
& simPROFILE
) {
1543 /* Since we KNOW that the memory banks are a power-of-2 in size: */
1544 profile_nsamples
= power2(n
);
1545 profile_minpc
= STATE_MEM_BASE (sd
);
1546 profile_maxpc
= (STATE_MEM_BASE (sd
) + STATE_MEM_SIZE (sd
));
1548 /* Just in-case we are sampling every address: NOTE: The shift
1549 right of 2 is because we only have word-aligned PC addresses. */
1550 if (profile_nsamples
> (STATE_MEM_SIZE (sd
) >> 2))
1551 profile_nsamples
= (STATE_MEM_SIZE (sd
) >> 2);
1553 /* Since we are dealing with power-of-2 values: */
1554 profile_shift
= (((STATE_MEM_SIZE (sd
) >> 2) / profile_nsamples
) - 1);
1556 bsize
= (profile_nsamples
* sizeof(unsigned short));
1557 if (profile_hist
== NULL
)
1558 profile_hist
= (unsigned short *)calloc(64,(bsize
/ 64));
1560 profile_hist
= (unsigned short *)realloc(profile_hist
,bsize
);
1561 if (profile_hist
== NULL
) {
1562 sim_warning("Failed to allocate VM for profiling buffer (0x%08X bytes)",bsize
);
1563 state
&= ~simPROFILE
;
1566 #endif /* PROFILE */
1575 SIM_DESC sd
= &simulator
;
1577 /* Used by "run", and internally, to set the simulated memory size */
1579 callback
->printf_filtered(callback
,"Zero not valid: Memory size still 0x%08X bytes\n",STATE_MEM_SIZE (sd
));
1582 newsize
= power2(newsize
);
1583 if (STATE_MEMORY (sd
) == NULL
)
1584 new = (char *)calloc(64,(STATE_MEM_SIZE (sd
) / 64));
1586 new = (char *)realloc(STATE_MEMORY (sd
),newsize
);
1588 if (STATE_MEMORY (sd
) == NULL
)
1589 sim_error("Not enough VM for simulation memory of 0x%08X bytes",STATE_MEM_SIZE (sd
));
1591 sim_warning("Failed to resize memory (still 0x%08X bytes)",STATE_MEM_SIZE (sd
));
1593 STATE_MEM_SIZE (sd
) = (unsigned)newsize
;
1594 STATE_MEMORY (sd
) = new;
1595 #if defined(PROFILE)
1596 /* Ensure that we sample across the new memory range */
1597 sim_set_profile_size(profile_nsamples
);
1598 #endif /* PROFILE */
1608 sim_io_eprintf (sd
, "Sim trace not supported");
1610 /* This routine is called by the "run" program, when detailed
1611 execution information is required. Rather than executing a single
1612 instruction, and looping around externally... we just start
1613 simulating, returning TRUE when the simulator stops (for whatever
1617 /* Ensure tracing is enabled, if available */
1618 if (tracefh
== NULL
)
1626 state
&= ~(simSTOP
| simSTEP
); /* execute until event */
1628 state
|= (simHALTEX
| simHALTIN
); /* treat interrupt event as exception */
1629 /* Start executing instructions from the current state (set
1630 explicitly by register updates, or by sim_create_inferior): */
1637 /*---------------------------------------------------------------------------*/
1638 /*-- Private simulator support interface ------------------------------------*/
1639 /*---------------------------------------------------------------------------*/
1641 /* Simple monitor interface (currently setup for the IDT and PMON monitors) */
1644 unsigned int reason
;
1646 SIM_DESC sd
= &simulator
;
1648 printf("DBG: sim_monitor: entered (reason = %d)\n",reason
);
1651 /* The IDT monitor actually allows two instructions per vector
1652 slot. However, the simulator currently causes a trap on each
1653 individual instruction. We cheat, and lose the bottom bit. */
1656 /* The following callback functions are available, however the
1657 monitor we are simulating does not make use of them: get_errno,
1658 isatty, lseek, rename, system, time and unlink */
1660 case 6: /* int open(char *path,int flags) */
1664 if (AddressTranslation(A0
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
))
1665 V0
= callback
->open(callback
,(char *)((int)paddr
),(int)A1
);
1667 sim_error("Attempt to pass pointer that does not reference simulated memory");
1671 case 7: /* int read(int file,char *ptr,int len) */
1675 if (AddressTranslation(A1
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
))
1676 V0
= callback
->read(callback
,(int)A0
,(char *)((int)paddr
),(int)A2
);
1678 sim_error("Attempt to pass pointer that does not reference simulated memory");
1682 case 8: /* int write(int file,char *ptr,int len) */
1686 if (AddressTranslation(A1
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
))
1687 V0
= callback
->write(callback
,(int)A0
,(const char *)((int)paddr
),(int)A2
);
1689 sim_error("Attempt to pass pointer that does not reference simulated memory");
1693 case 10: /* int close(int file) */
1694 V0
= callback
->close(callback
,(int)A0
);
1697 case 11: /* char inbyte(void) */
1700 if (callback
->read_stdin(callback
,&tmp
,sizeof(char)) != sizeof(char)) {
1701 sim_error("Invalid return from character read");
1709 case 12: /* void outbyte(char chr) : write a byte to "stdout" */
1711 char tmp
= (char)(A0
& 0xFF);
1712 callback
->write_stdout(callback
,&tmp
,sizeof(char));
1716 case 17: /* void _exit() */
1717 sim_warning("sim_monitor(17): _exit(int reason) to be coded");
1718 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
, sim_exited
,
1719 (unsigned int)(A0
& 0xFFFFFFFF));
1722 case 28 : /* PMON flush_cache */
1725 case 55: /* void get_mem_info(unsigned int *ptr) */
1726 /* in: A0 = pointer to three word memory location */
1727 /* out: [A0 + 0] = size */
1728 /* [A0 + 4] = instruction cache size */
1729 /* [A0 + 8] = data cache size */
1732 uword64 paddr
, value
;
1736 /* NOTE: We use RAW memory writes here, but since we are not
1737 gathering statistics for the monitor calls we are simulating,
1738 it is not an issue. */
1741 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isREAL
)) {
1742 value
= (uword64
)STATE_MEM_SIZE (sd
);
1743 StoreMemory(cca
,AccessLength_WORD
,value
,0,paddr
,vaddr
,isRAW
);
1744 /* We re-do the address translations, in-case the block
1745 overlaps a memory boundary: */
1747 vaddr
+= (AccessLength_WORD
+ 1);
1748 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isREAL
)) {
1749 StoreMemory(cca
,AccessLength_WORD
,0,value
,paddr
,vaddr
,isRAW
);
1750 vaddr
+= (AccessLength_WORD
+ 1);
1751 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isREAL
))
1752 StoreMemory(cca
,AccessLength_WORD
,value
,0,paddr
,vaddr
,isRAW
);
1761 sim_error("Invalid pointer passed into monitor call");
1765 case 158 : /* PMON printf */
1766 /* in: A0 = pointer to format string */
1767 /* A1 = optional argument 1 */
1768 /* A2 = optional argument 2 */
1769 /* A3 = optional argument 3 */
1771 /* The following is based on the PMON printf source */
1775 /* This isn't the quickest way, since we call the host print
1776 routine for every character almost. But it does avoid
1777 having to allocate and manage a temporary string buffer. */
1778 if (AddressTranslation(A0
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
)) {
1779 char *s
= (char *)((int)paddr
);
1780 ut_reg
*ap
= &A1
; /* 1st argument */
1781 /* TODO: Include check that we only use three arguments (A1, A2 and A3) */
1785 enum {FMT_RJUST
, FMT_LJUST
, FMT_RJUST0
, FMT_CENTER
} fmt
= FMT_RJUST
;
1786 int width
= 0, trunc
= 0, haddot
= 0, longlong
= 0;
1789 if (strchr ("dobxXulscefg%", *s
))
1797 else if (*s
== '*') {
1802 } else if (*s
>= '1' && *s
<= '9') {
1805 for (t
= s
; isdigit (*s
); s
++);
1806 strncpy (tmp
, t
, s
- t
);
1808 n
= (unsigned int)strtol(tmp
,NULL
,10);
1814 } else if (*s
== '.')
1818 callback
->printf_filtered(callback
,"%%");
1819 } else if (*s
== 's') {
1820 if ((int)*ap
!= 0) {
1821 if (AddressTranslation(*ap
++,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
)) {
1822 char *p
= (char *)((int)paddr
);;
1823 callback
->printf_filtered(callback
,p
);
1826 sim_error("Attempt to pass pointer that does not reference simulated memory");
1830 callback
->printf_filtered(callback
,"(null)");
1831 } else if (*s
== 'c') {
1833 callback
->printf_filtered(callback
,"%c",n
);
1841 if (strchr ("dobxXu", *s
)) {
1842 word64 lv
= (word64
) *ap
++;
1844 callback
->printf_filtered(callback
,"<binary not supported>");
1846 sprintf(tmp
,"%%%s%c",longlong
? "ll" : "",*s
);
1848 callback
->printf_filtered(callback
,tmp
,lv
);
1850 callback
->printf_filtered(callback
,tmp
,(int)lv
);
1852 } else if (strchr ("eEfgG", *s
)) {
1853 #ifdef _MSC_VER /* MSVC version 2.x can't convert from uword64 directly */
1854 double dbl
= (double)((word64
)*ap
++);
1856 double dbl
= (double)*ap
++;
1858 sprintf(tmp
,"%%%d.%d%c",width
,trunc
,*s
);
1859 callback
->printf_filtered(callback
,tmp
,dbl
);
1865 callback
->printf_filtered(callback
,"%c",*s
++);
1868 sim_error("Attempt to pass pointer that does not reference simulated memory");
1873 sim_warning("TODO: sim_monitor(%d) : PC = 0x%s",reason
,pr_addr(IPC
));
1874 sim_warning("(Arguments : A0 = 0x%s : A1 = 0x%s : A2 = 0x%s : A3 = 0x%s)",pr_addr(A0
),pr_addr(A1
),pr_addr(A2
),pr_addr(A3
));
1880 /* Store a word into memory. */
1883 store_word (vaddr
, val
)
1890 if ((vaddr
& 3) != 0)
1891 SignalException (AddressStore
);
1894 if (AddressTranslation (vaddr
, isDATA
, isSTORE
, &paddr
, &uncached
,
1897 const uword64 mask
= 7;
1901 paddr
= (paddr
& ~mask
) | ((paddr
& mask
) ^ (ReverseEndian
<< 2));
1902 byte
= (vaddr
& mask
) ^ (BigEndianCPU
<< 2);
1903 memval
= ((uword64
) val
) << (8 * byte
);
1904 StoreMemory (uncached
, AccessLength_WORD
, memval
, 0, paddr
, vaddr
,
1910 /* Load a word from memory. */
1916 if ((vaddr
& 3) != 0)
1917 SignalException (AddressLoad
);
1923 if (AddressTranslation (vaddr
, isDATA
, isLOAD
, &paddr
, &uncached
,
1926 const uword64 mask
= 0x7;
1927 const unsigned int reverse
= ReverseEndian
? 1 : 0;
1928 const unsigned int bigend
= BigEndianCPU
? 1 : 0;
1932 paddr
= (paddr
& ~mask
) | ((paddr
& mask
) ^ (reverse
<< 2));
1933 LoadMemory (&memval
,NULL
,uncached
, AccessLength_WORD
, paddr
, vaddr
,
1935 byte
= (vaddr
& mask
) ^ (bigend
<< 2);
1936 return SIGNEXTEND (((memval
>> (8 * byte
)) & 0xffffffff), 32);
1943 /* Simulate the mips16 entry and exit pseudo-instructions. These
1944 would normally be handled by the reserved instruction exception
1945 code, but for ease of simulation we just handle them directly. */
1951 int aregs
, sregs
, rreg
;
1954 printf("DBG: mips16_entry: entered (insn = 0x%08X)\n",insn
);
1957 aregs
= (insn
& 0x700) >> 8;
1958 sregs
= (insn
& 0x0c0) >> 6;
1959 rreg
= (insn
& 0x020) >> 5;
1961 /* This should be checked by the caller. */
1970 /* This is the entry pseudo-instruction. */
1972 for (i
= 0; i
< aregs
; i
++)
1973 store_word ((uword64
) (SP
+ 4 * i
), registers
[i
+ 4]);
1981 store_word ((uword64
) tsp
, RA
);
1984 for (i
= 0; i
< sregs
; i
++)
1987 store_word ((uword64
) tsp
, registers
[16 + i
]);
1995 /* This is the exit pseudo-instruction. */
2002 RA
= load_word ((uword64
) tsp
);
2005 for (i
= 0; i
< sregs
; i
++)
2008 registers
[i
+ 16] = load_word ((uword64
) tsp
);
2015 FGR
[0] = WORD64LO (GPR
[4]);
2016 fpr_state
[0] = fmt_uninterpreted
;
2018 else if (aregs
== 6)
2020 FGR
[0] = WORD64LO (GPR
[5]);
2021 FGR
[1] = WORD64LO (GPR
[4]);
2022 fpr_state
[0] = fmt_uninterpreted
;
2023 fpr_state
[1] = fmt_uninterpreted
;
2031 sim_warning(char *fmt
,...)
2037 vsprintf (buf
, fmt
, ap
);
2040 if (logfh
!= NULL
) {
2041 fprintf(logfh
,"SIM Warning: %s\n", buf
);
2043 callback
->printf_filtered(callback
,"SIM Warning: %s\n", buf
);
2045 /* This used to call SignalException with a SimulatorFault, but that causes
2046 the simulator to exit, and that is inappropriate for a warning. */
2051 sim_error(char *fmt
,...)
2057 vsprintf (buf
, fmt
, ap
);
2060 callback
->printf_filtered(callback
,"SIM Error: %s", buf
);
2061 SignalException (SimulatorFault
, buf
);
2071 /* Round *UP* to the nearest power-of-2 if not already one */
2072 if (value
!= (value
& ~(value
- 1))) {
2073 for (tmp
= value
, loop
= 0; (tmp
!= 0); loop
++)
2075 value
= (1 << loop
);
2088 num
= strtol(value
,&end
,10);
2090 callback
->printf_filtered(callback
,"Warning: Invalid number \"%s\" ignored, using zero\n",value
);
2092 if (*end
&& ((tolower(*end
) == 'k') || (tolower(*end
) == 'm'))) {
2093 if (tolower(*end
) == 'k')
2100 callback
->printf_filtered(callback
,"Warning: Spurious characters \"%s\" at end of number ignored\n",end
);
2106 /*-- trace support ----------------------------------------------------------*/
2108 /* The TRACE support is provided (if required) in the memory accessing
2109 routines. Since we are also providing the architecture specific
2110 features, the architecture simulation code can also deal with
2111 notifying the TRACE world of cache flushes, etc. Similarly we do
2112 not need to provide profiling support in the simulator engine,
2113 since we can sample in the instruction fetch control loop. By
2114 defining the TRACE manifest, we add tracing as a run-time
2118 /* Tracing by default produces "din" format (as required by
2119 dineroIII). Each line of such a trace file *MUST* have a din label
2120 and address field. The rest of the line is ignored, so comments can
2121 be included if desired. The first field is the label which must be
2122 one of the following values:
2127 3 escape record (treated as unknown access type)
2128 4 escape record (causes cache flush)
2130 The address field is a 32bit (lower-case) hexadecimal address
2131 value. The address should *NOT* be preceded by "0x".
2133 The size of the memory transfer is not important when dealing with
2134 cache lines (as long as no more than a cache line can be
2135 transferred in a single operation :-), however more information
2136 could be given following the dineroIII requirement to allow more
2137 complete memory and cache simulators to provide better
2138 results. i.e. the University of Pisa has a cache simulator that can
2139 also take bus size and speed as (variable) inputs to calculate
2140 complete system performance (a much more useful ability when trying
2141 to construct an end product, rather than a processor). They
2142 currently have an ARM version of their tool called ChARM. */
2146 void dotrace(FILE *tracefh
,int type
,SIM_ADDR address
,int width
,char *comment
,...)
2148 if (state
& simTRACE
) {
2150 fprintf(tracefh
,"%d %s ; width %d ; ",
2154 va_start(ap
,comment
);
2155 vfprintf(tracefh
,comment
,ap
);
2157 fprintf(tracefh
,"\n");
2159 /* NOTE: Since the "din" format will only accept 32bit addresses, and
2160 we may be generating 64bit ones, we should put the hi-32bits of the
2161 address into the comment field. */
2163 /* TODO: Provide a buffer for the trace lines. We can then avoid
2164 performing writes until the buffer is filled, or the file is
2167 /* NOTE: We could consider adding a comment field to the "din" file
2168 produced using type 3 markers (unknown access). This would then
2169 allow information about the program that the "din" is for, and
2170 the MIPs world that was being simulated, to be placed into the
2177 /*---------------------------------------------------------------------------*/
2178 /*-- simulator engine -------------------------------------------------------*/
2179 /*---------------------------------------------------------------------------*/
2184 /* RESET: Fixed PC address: */
2185 PC
= (((uword64
)0xFFFFFFFF<<32) | 0xBFC00000);
2186 /* The reset vector address is in the unmapped, uncached memory space. */
2188 SR
&= ~(status_SR
| status_TS
| status_RP
);
2189 SR
|= (status_ERL
| status_BEV
);
2191 #if defined(HASFPU) && (GPRLEN == (64))
2192 /* Cheat and allow access to the complete register set immediately: */
2193 SR
|= status_FR
; /* 64bit registers */
2194 #endif /* HASFPU and 64bit FP registers */
2196 /* Ensure that any instructions with pending register updates are
2200 for (loop
= 0; (loop
< PSLOTS
); loop
++)
2201 pending_slot_reg
[loop
] = (LAST_EMBED_REGNUM
+ 1);
2202 pending_in
= pending_out
= pending_total
= 0;
2206 /* Initialise the FPU registers to the unknown state */
2209 for (rn
= 0; (rn
< 32); rn
++)
2210 fpr_state
[rn
] = fmt_uninterpreted
;
2217 /* Description from page A-22 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2218 /* Translate a virtual address to a physical address and cache
2219 coherence algorithm describing the mechanism used to resolve the
2220 memory reference. Given the virtual address vAddr, and whether the
2221 reference is to Instructions ot Data (IorD), find the corresponding
2222 physical address (pAddr) and the cache coherence algorithm (CCA)
2223 used to resolve the reference. If the virtual address is in one of
2224 the unmapped address spaces the physical address and the CCA are
2225 determined directly by the virtual address. If the virtual address
2226 is in one of the mapped address spaces then the TLB is used to
2227 determine the physical address and access type; if the required
2228 translation is not present in the TLB or the desired access is not
2229 permitted the function fails and an exception is taken.
2231 NOTE: This function is extended to return an exception state. This,
2232 along with the exception generation is used to notify whether a
2233 valid address translation occured */
2236 AddressTranslation(vAddr
,IorD
,LorS
,pAddr
,CCA
,host
,raw
)
2245 SIM_DESC sd
= &simulator
;
2246 int res
= -1; /* TRUE : Assume good return */
2249 callback
->printf_filtered(callback
,"AddressTranslation(0x%s,%s,%s,...);\n",pr_addr(vAddr
),(IorD
? "isDATA" : "isINSTRUCTION"),(LorS
? "iSTORE" : "isLOAD"));
2252 /* Check that the address is valid for this memory model */
2254 /* For a simple (flat) memory model, we simply pass virtual
2255 addressess through (mostly) unchanged. */
2256 vAddr
&= 0xFFFFFFFF;
2258 /* Treat the kernel memory spaces identically for the moment: */
2259 if ((STATE_MEM_BASE (sd
) == K1BASE
) && (vAddr
>= K0BASE
) && (vAddr
< (K0BASE
+ K0SIZE
)))
2260 vAddr
+= (K1BASE
- K0BASE
);
2262 /* Also assume that the K1BASE memory wraps. This is required to
2263 allow the PMON run-time __sizemem() routine to function (without
2264 having to provide exception simulation). NOTE: A kludge to work
2265 around the fact that the monitor memory is currently held in the
2267 if (((vAddr
< monitor_base
) || (vAddr
>= (monitor_base
+ monitor_size
))) && (vAddr
>= K1BASE
&& vAddr
< (K1BASE
+ K1SIZE
)))
2268 vAddr
= (K1BASE
| (vAddr
& (STATE_MEM_SIZE (sd
) - 1)));
2270 *pAddr
= vAddr
; /* default for isTARGET */
2271 *CCA
= Uncached
; /* not used for isHOST */
2273 /* NOTE: This is a duplicate of the code that appears in the
2274 LoadMemory and StoreMemory functions. They should be merged into
2275 a single function (that can be in-lined if required). */
2276 if ((vAddr
>= STATE_MEM_BASE (sd
)) && (vAddr
< (STATE_MEM_BASE (sd
) + STATE_MEM_SIZE (sd
)))) {
2278 *pAddr
= (int)&STATE_MEMORY (sd
)[((unsigned int)(vAddr
- STATE_MEM_BASE (sd
)) & (STATE_MEM_SIZE (sd
) - 1))];
2279 } else if ((vAddr
>= monitor_base
) && (vAddr
< (monitor_base
+ monitor_size
))) {
2281 *pAddr
= (int)&monitor
[((unsigned int)(vAddr
- monitor_base
) & (monitor_size
- 1))];
2284 sim_warning("Failed: AddressTranslation(0x%s,%s,%s,...) IPC = 0x%s",pr_addr(vAddr
),(IorD
? "isDATA" : "isINSTRUCTION"),(LorS
? "isSTORE" : "isLOAD"),pr_addr(IPC
));
2286 res
= 0; /* AddressTranslation has failed */
2287 *pAddr
= (SIM_ADDR
)-1;
2288 if (!raw
) /* only generate exceptions on real memory transfers */
2289 SignalException((LorS
== isSTORE
) ? AddressStore
: AddressLoad
);
2292 /* This is a normal occurance during gdb operation, for instance trying
2293 to print parameters at function start before they have been setup,
2294 and hence we should not print a warning except when debugging the
2296 sim_warning("AddressTranslation for %s %s from 0x%s failed",(IorD
? "data" : "instruction"),(LorS
? "store" : "load"),pr_addr(vAddr
));
2303 /* Description from page A-23 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2304 /* Prefetch data from memory. Prefetch is an advisory instruction for
2305 which an implementation specific action is taken. The action taken
2306 may increase performance, but must not change the meaning of the
2307 program, or alter architecturally-visible state. */
2310 Prefetch(CCA
,pAddr
,vAddr
,DATA
,hint
)
2318 callback
->printf_filtered(callback
,"Prefetch(%d,0x%s,0x%s,%d,%d);\n",CCA
,pr_addr(pAddr
),pr_addr(vAddr
),DATA
,hint
);
2321 /* For our simple memory model we do nothing */
2325 /* Description from page A-22 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2326 /* Load a value from memory. Use the cache and main memory as
2327 specified in the Cache Coherence Algorithm (CCA) and the sort of
2328 access (IorD) to find the contents of AccessLength memory bytes
2329 starting at physical location pAddr. The data is returned in the
2330 fixed width naturally-aligned memory element (MemElem). The
2331 low-order two (or three) bits of the address and the AccessLength
2332 indicate which of the bytes within MemElem needs to be given to the
2333 processor. If the memory access type of the reference is uncached
2334 then only the referenced bytes are read from memory and valid
2335 within the memory element. If the access type is cached, and the
2336 data is not present in cache, an implementation specific size and
2337 alignment block of memory is read and loaded into the cache to
2338 satisfy a load reference. At a minimum, the block is the entire
2341 LoadMemory(memvalp
,memval1p
,CCA
,AccessLength
,pAddr
,vAddr
,IorD
,raw
)
2351 SIM_DESC sd
= &simulator
;
2356 if (STATE_MEMORY (sd
) == NULL
)
2357 callback
->printf_filtered(callback
,"DBG: LoadMemory(%p,%p,%d,%d,0x%s,0x%s,%s,%s)\n",memvalp
,memval1p
,CCA
,AccessLength
,pr_addr(pAddr
),pr_addr(vAddr
),(IorD
? "isDATA" : "isINSTRUCTION"),(raw
? "isRAW" : "isREAL"));
2360 #if defined(WARN_MEM)
2361 if (CCA
!= uncached
)
2362 sim_warning("LoadMemory CCA (%d) is not uncached (currently all accesses treated as cached)",CCA
);
2364 if (((pAddr
& LOADDRMASK
) + AccessLength
) > LOADDRMASK
) {
2365 /* In reality this should be a Bus Error */
2366 sim_error("AccessLength of %d would extend over %dbit aligned boundary for physical address 0x%s\n",AccessLength
,(LOADDRMASK
+ 1)<<2,pr_addr(pAddr
));
2368 #endif /* WARN_MEM */
2370 /* Decide which physical memory locations are being dealt with. At
2371 this point we should be able to split the pAddr bits into the
2372 relevant address map being simulated. If the "raw" variable is
2373 set, the memory read being performed should *NOT* update any I/O
2374 state or affect the CPU state. This also includes avoiding
2375 affecting statistics gathering. */
2377 /* If instruction fetch then we need to check that the two lo-order
2378 bits are zero, otherwise raise a InstructionFetch exception: */
2379 if ((IorD
== isINSTRUCTION
)
2380 && ((pAddr
& 0x3) != 0)
2381 && (((pAddr
& 0x1) != 0) || ((vAddr
& 0x1) == 0)))
2382 SignalException(InstructionFetch
);
2384 unsigned int index
= 0;
2385 unsigned char *mem
= NULL
;
2389 dotrace(tracefh
,((IorD
== isDATA
) ? 0 : 2),(unsigned int)(pAddr
&0xFFFFFFFF),(AccessLength
+ 1),"load%s",((IorD
== isDATA
) ? "" : " instruction"));
2392 /* NOTE: Quicker methods of decoding the address space can be used
2393 when a real memory map is being simulated (i.e. using hi-order
2394 address bits to select device). */
2395 if ((pAddr
>= STATE_MEM_BASE (sd
)) && (pAddr
< (STATE_MEM_BASE (sd
) + STATE_MEM_SIZE (sd
)))) {
2396 index
= ((unsigned int)(pAddr
- STATE_MEM_BASE (sd
)) & (STATE_MEM_SIZE (sd
) - 1));
2397 mem
= STATE_MEMORY (sd
);
2398 } else if ((pAddr
>= monitor_base
) && (pAddr
< (monitor_base
+ monitor_size
))) {
2399 index
= ((unsigned int)(pAddr
- monitor_base
) & (monitor_size
- 1));
2403 sim_error("Simulator memory not found for physical address 0x%s\n",pr_addr(pAddr
));
2405 /* If we obtained the endianness of the host, and it is the same
2406 as the target memory system we can optimise the memory
2407 accesses. However, without that information we must perform
2408 slow transfer, and hope that the compiler optimisation will
2409 merge successive loads. */
2411 /* In reality we should always be loading a doubleword value (or
2412 word value in 32bit memory worlds). The external code then
2413 extracts the required bytes. However, to keep performance
2414 high we only load the required bytes into the relevant
2417 switch (AccessLength
) { /* big-endian memory */
2418 case AccessLength_QUADWORD
:
2419 value1
|= ((uword64
)mem
[index
++] << 56);
2420 case 14: /* AccessLength is one less than datalen */
2421 value1
|= ((uword64
)mem
[index
++] << 48);
2423 value1
|= ((uword64
)mem
[index
++] << 40);
2425 value1
|= ((uword64
)mem
[index
++] << 32);
2427 value1
|= ((unsigned int)mem
[index
++] << 24);
2429 value1
|= ((unsigned int)mem
[index
++] << 16);
2431 value1
|= ((unsigned int)mem
[index
++] << 8);
2433 value1
|= mem
[index
];
2435 case AccessLength_DOUBLEWORD
:
2436 value
|= ((uword64
)mem
[index
++] << 56);
2437 case AccessLength_SEPTIBYTE
:
2438 value
|= ((uword64
)mem
[index
++] << 48);
2439 case AccessLength_SEXTIBYTE
:
2440 value
|= ((uword64
)mem
[index
++] << 40);
2441 case AccessLength_QUINTIBYTE
:
2442 value
|= ((uword64
)mem
[index
++] << 32);
2443 case AccessLength_WORD
:
2444 value
|= ((unsigned int)mem
[index
++] << 24);
2445 case AccessLength_TRIPLEBYTE
:
2446 value
|= ((unsigned int)mem
[index
++] << 16);
2447 case AccessLength_HALFWORD
:
2448 value
|= ((unsigned int)mem
[index
++] << 8);
2449 case AccessLength_BYTE
:
2450 value
|= mem
[index
];
2454 index
+= (AccessLength
+ 1);
2455 switch (AccessLength
) { /* little-endian memory */
2456 case AccessLength_QUADWORD
:
2457 value1
|= ((uword64
)mem
[--index
] << 56);
2458 case 14: /* AccessLength is one less than datalen */
2459 value1
|= ((uword64
)mem
[--index
] << 48);
2461 value1
|= ((uword64
)mem
[--index
] << 40);
2463 value1
|= ((uword64
)mem
[--index
] << 32);
2465 value1
|= ((uword64
)mem
[--index
] << 24);
2467 value1
|= ((uword64
)mem
[--index
] << 16);
2469 value1
|= ((uword64
)mem
[--index
] << 8);
2471 value1
|= ((uword64
)mem
[--index
] << 0);
2473 case AccessLength_DOUBLEWORD
:
2474 value
|= ((uword64
)mem
[--index
] << 56);
2475 case AccessLength_SEPTIBYTE
:
2476 value
|= ((uword64
)mem
[--index
] << 48);
2477 case AccessLength_SEXTIBYTE
:
2478 value
|= ((uword64
)mem
[--index
] << 40);
2479 case AccessLength_QUINTIBYTE
:
2480 value
|= ((uword64
)mem
[--index
] << 32);
2481 case AccessLength_WORD
:
2482 value
|= ((uword64
)mem
[--index
] << 24);
2483 case AccessLength_TRIPLEBYTE
:
2484 value
|= ((uword64
)mem
[--index
] << 16);
2485 case AccessLength_HALFWORD
:
2486 value
|= ((uword64
)mem
[--index
] << 8);
2487 case AccessLength_BYTE
:
2488 value
|= ((uword64
)mem
[--index
] << 0);
2494 printf("DBG: LoadMemory() : (offset %d) : value = 0x%s%s\n",
2495 (int)(pAddr
& LOADDRMASK
),pr_uword64(value1
),pr_uword64(value
));
2498 /* TODO: We could try and avoid the shifts when dealing with raw
2499 memory accesses. This would mean updating the LoadMemory and
2500 StoreMemory routines to avoid shifting the data before
2501 returning or using it. */
2502 if (AccessLength
<= AccessLength_DOUBLEWORD
) {
2503 if (!raw
) { /* do nothing for raw accessess */
2505 value
<<= (((7 - (pAddr
& LOADDRMASK
)) - AccessLength
) * 8);
2506 else /* little-endian only needs to be shifted up to the correct byte offset */
2507 value
<<= ((pAddr
& LOADDRMASK
) * 8);
2512 printf("DBG: LoadMemory() : shifted value = 0x%s%s\n",
2513 pr_uword64(value1
),pr_uword64(value
));
2519 if (memval1p
) *memval1p
= value1
;
2523 /* Description from page A-23 of the "MIPS IV Instruction Set" manual
2525 /* Store a value to memory. The specified data is stored into the
2526 physical location pAddr using the memory hierarchy (data caches and
2527 main memory) as specified by the Cache Coherence Algorithm
2528 (CCA). The MemElem contains the data for an aligned, fixed-width
2529 memory element (word for 32-bit processors, doubleword for 64-bit
2530 processors), though only the bytes that will actually be stored to
2531 memory need to be valid. The low-order two (or three) bits of pAddr
2532 and the AccessLength field indicates which of the bytes within the
2533 MemElem data should actually be stored; only these bytes in memory
2537 StoreMemory(CCA
,AccessLength
,MemElem
,MemElem1
,pAddr
,vAddr
,raw
)
2541 uword64 MemElem1
; /* High order 64 bits */
2546 SIM_DESC sd
= &simulator
;
2548 callback
->printf_filtered(callback
,"DBG: StoreMemory(%d,%d,0x%s,0x%s,0x%s,0x%s,%s)\n",CCA
,AccessLength
,pr_uword64(MemElem
),pr_uword64(MemElem1
),pr_addr(pAddr
),pr_addr(vAddr
),(raw
? "isRAW" : "isREAL"));
2551 #if defined(WARN_MEM)
2552 if (CCA
!= uncached
)
2553 sim_warning("StoreMemory CCA (%d) is not uncached (currently all accesses treated as cached)",CCA
);
2555 if (((pAddr
& LOADDRMASK
) + AccessLength
) > LOADDRMASK
)
2556 sim_error("AccessLength of %d would extend over %dbit aligned boundary for physical address 0x%s\n",AccessLength
,(LOADDRMASK
+ 1)<<2,pr_addr(pAddr
));
2557 #endif /* WARN_MEM */
2561 dotrace(tracefh
,1,(unsigned int)(pAddr
&0xFFFFFFFF),(AccessLength
+ 1),"store");
2564 /* See the comments in the LoadMemory routine about optimising
2565 memory accesses. Also if we wanted to make the simulator smaller,
2566 we could merge a lot of this code with the LoadMemory
2567 routine. However, this would slow the simulator down with
2568 run-time conditionals. */
2570 unsigned int index
= 0;
2571 unsigned char *mem
= NULL
;
2573 if ((pAddr
>= STATE_MEM_BASE (sd
)) && (pAddr
< (STATE_MEM_BASE (sd
) + STATE_MEM_SIZE (sd
)))) {
2574 index
= ((unsigned int)(pAddr
- STATE_MEM_BASE (sd
)) & (STATE_MEM_SIZE (sd
) - 1));
2575 mem
= STATE_MEMORY (sd
);
2576 } else if ((pAddr
>= monitor_base
) && (pAddr
< (monitor_base
+ monitor_size
))) {
2577 index
= ((unsigned int)(pAddr
- monitor_base
) & (monitor_size
- 1));
2582 sim_error("Simulator memory not found for physical address 0x%s\n",pr_addr(pAddr
));
2587 printf("DBG: StoreMemory: offset = %d MemElem = 0x%s%s\n",(unsigned int)(pAddr
& LOADDRMASK
),pr_uword64(MemElem1
),pr_uword64(MemElem
));
2590 if (AccessLength
<= AccessLength_DOUBLEWORD
) {
2593 shift
= ((7 - AccessLength
) * 8);
2594 else /* real memory access */
2595 shift
= ((pAddr
& LOADDRMASK
) * 8);
2598 /* no need to shift raw little-endian data */
2600 MemElem
>>= ((pAddr
& LOADDRMASK
) * 8);
2605 printf("DBG: StoreMemory: shift = %d MemElem = 0x%s%s\n",shift
,pr_uword64(MemElem1
),pr_uword64(MemElem
));
2609 switch (AccessLength
) { /* big-endian memory */
2610 case AccessLength_QUADWORD
:
2611 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
2614 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
2617 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
2620 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
2623 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
2626 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
2629 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
2632 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
2634 case AccessLength_DOUBLEWORD
:
2635 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2637 case AccessLength_SEPTIBYTE
:
2638 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2640 case AccessLength_SEXTIBYTE
:
2641 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2643 case AccessLength_QUINTIBYTE
:
2644 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2646 case AccessLength_WORD
:
2647 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2649 case AccessLength_TRIPLEBYTE
:
2650 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2652 case AccessLength_HALFWORD
:
2653 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2655 case AccessLength_BYTE
:
2656 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2660 index
+= (AccessLength
+ 1);
2661 switch (AccessLength
) { /* little-endian memory */
2662 case AccessLength_QUADWORD
:
2663 mem
[--index
] = (unsigned char)(MemElem1
>> 56);
2665 mem
[--index
] = (unsigned char)(MemElem1
>> 48);
2667 mem
[--index
] = (unsigned char)(MemElem1
>> 40);
2669 mem
[--index
] = (unsigned char)(MemElem1
>> 32);
2671 mem
[--index
] = (unsigned char)(MemElem1
>> 24);
2673 mem
[--index
] = (unsigned char)(MemElem1
>> 16);
2675 mem
[--index
] = (unsigned char)(MemElem1
>> 8);
2677 mem
[--index
] = (unsigned char)(MemElem1
>> 0);
2679 case AccessLength_DOUBLEWORD
:
2680 mem
[--index
] = (unsigned char)(MemElem
>> 56);
2681 case AccessLength_SEPTIBYTE
:
2682 mem
[--index
] = (unsigned char)(MemElem
>> 48);
2683 case AccessLength_SEXTIBYTE
:
2684 mem
[--index
] = (unsigned char)(MemElem
>> 40);
2685 case AccessLength_QUINTIBYTE
:
2686 mem
[--index
] = (unsigned char)(MemElem
>> 32);
2687 case AccessLength_WORD
:
2688 mem
[--index
] = (unsigned char)(MemElem
>> 24);
2689 case AccessLength_TRIPLEBYTE
:
2690 mem
[--index
] = (unsigned char)(MemElem
>> 16);
2691 case AccessLength_HALFWORD
:
2692 mem
[--index
] = (unsigned char)(MemElem
>> 8);
2693 case AccessLength_BYTE
:
2694 mem
[--index
] = (unsigned char)(MemElem
>> 0);
2705 /* Description from page A-26 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2706 /* Order loads and stores to synchronise shared memory. Perform the
2707 action necessary to make the effects of groups of synchronizable
2708 loads and stores indicated by stype occur in the same order for all
2711 SyncOperation(stype
)
2715 callback
->printf_filtered(callback
,"SyncOperation(%d) : TODO\n",stype
);
2720 /* Description from page A-26 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2721 /* Signal an exception condition. This will result in an exception
2722 that aborts the instruction. The instruction operation pseudocode
2723 will never see a return from this function call. */
2726 SignalException (int exception
,...)
2728 SIM_DESC sd
= &simulator
;
2729 /* Ensure that any active atomic read/modify/write operation will fail: */
2732 switch (exception
) {
2733 /* TODO: For testing purposes I have been ignoring TRAPs. In
2734 reality we should either simulate them, or allow the user to
2735 ignore them at run-time. */
2737 sim_warning("Ignoring instruction TRAP (PC 0x%s)",pr_addr(IPC
));
2740 case ReservedInstruction
:
2743 unsigned int instruction
;
2744 va_start(ap
,exception
);
2745 instruction
= va_arg(ap
,unsigned int);
2747 /* Provide simple monitor support using ReservedInstruction
2748 exceptions. The following code simulates the fixed vector
2749 entry points into the IDT monitor by causing a simulator
2750 trap, performing the monitor operation, and returning to
2751 the address held in the $ra register (standard PCS return
2752 address). This means we only need to pre-load the vector
2753 space with suitable instruction values. For systems were
2754 actual trap instructions are used, we would not need to
2755 perform this magic. */
2756 if ((instruction
& RSVD_INSTRUCTION_MASK
) == RSVD_INSTRUCTION
) {
2757 sim_monitor( ((instruction
>> RSVD_INSTRUCTION_ARG_SHIFT
) & RSVD_INSTRUCTION_ARG_MASK
) );
2758 PC
= RA
; /* simulate the return from the vector entry */
2759 /* NOTE: This assumes that a branch-and-link style
2760 instruction was used to enter the vector (which is the
2761 case with the current IDT monitor). */
2762 sim_engine_restart (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
);
2764 /* Look for the mips16 entry and exit instructions, and
2765 simulate a handler for them. */
2766 else if ((IPC
& 1) != 0
2767 && (instruction
& 0xf81f) == 0xe809
2768 && (instruction
& 0x0c0) != 0x0c0) {
2769 mips16_entry (instruction
);
2770 sim_engine_restart (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
);
2771 } /* else fall through to normal exception processing */
2772 sim_warning("ReservedInstruction 0x%08X at IPC = 0x%s",instruction
,pr_addr(IPC
));
2777 if (exception
!= BreakPoint
)
2778 callback
->printf_filtered(callback
,"DBG: SignalException(%d) IPC = 0x%s\n",exception
,pr_addr(IPC
));
2780 /* Store exception code into current exception id variable (used
2783 /* TODO: If not simulating exceptions then stop the simulator
2784 execution. At the moment we always stop the simulation. */
2785 /* state |= (simSTOP | simEXCEPTION); */
2787 /* Keep a copy of the current A0 in-case this is the program exit
2789 if (exception
== BreakPoint
) {
2791 unsigned int instruction
;
2792 va_start(ap
,exception
);
2793 instruction
= va_arg(ap
,unsigned int);
2795 /* Check for our special terminating BREAK: */
2796 if ((instruction
& 0x03FFFFC0) == 0x03ff0000) {
2797 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2798 sim_exited
, (unsigned int)(A0
& 0xFFFFFFFF));
2802 /* Store exception code into current exception id variable (used
2804 CAUSE
= (exception
<< 2);
2805 if (state
& simDELAYSLOT
) {
2807 EPC
= (IPC
- 4); /* reference the branch instruction */
2810 /* The following is so that the simulator will continue from the
2811 exception address on breakpoint operations. */
2813 switch ((CAUSE
>> 2) & 0x1F)
2816 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2817 sim_stopped
, SIGINT
);
2819 case TLBModification
:
2824 case InstructionFetch
:
2826 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2827 sim_stopped
, SIGBUS
);
2829 case ReservedInstruction
:
2830 case CoProcessorUnusable
:
2831 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2832 sim_stopped
, SIGILL
);
2834 case IntegerOverflow
:
2836 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2837 sim_stopped
, SIGFPE
);
2843 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2844 sim_stopped
, SIGTRAP
);
2846 default : /* Unknown internal exception */
2847 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2848 sim_stopped
, SIGQUIT
);
2852 case SimulatorFault
:
2856 va_start(ap
,exception
);
2857 msg
= va_arg(ap
,char *);
2859 sim_engine_abort (sd
, STATE_CPU (sd
, 0), NULL_CIA
,
2860 "FATAL: Simulator error \"%s\"\n",msg
);
2867 #if defined(WARN_RESULT)
2868 /* Description from page A-26 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2869 /* This function indicates that the result of the operation is
2870 undefined. However, this should not affect the instruction
2871 stream. All that is meant to happen is that the destination
2872 register is set to an undefined result. To keep the simulator
2873 simple, we just don't bother updating the destination register, so
2874 the overall result will be undefined. If desired we can stop the
2875 simulator by raising a pseudo-exception. */
2879 sim_warning("UndefinedResult: IPC = 0x%s",pr_addr(IPC
));
2880 #if 0 /* Disabled for the moment, since it actually happens a lot at the moment. */
2885 #endif /* WARN_RESULT */
2888 CacheOp(op
,pAddr
,vAddr
,instruction
)
2892 unsigned int instruction
;
2894 #if 1 /* stop warning message being displayed (we should really just remove the code) */
2895 static int icache_warning
= 1;
2896 static int dcache_warning
= 1;
2898 static int icache_warning
= 0;
2899 static int dcache_warning
= 0;
2902 /* If CP0 is not useable (User or Supervisor mode) and the CP0
2903 enable bit in the Status Register is clear - a coprocessor
2904 unusable exception is taken. */
2906 callback
->printf_filtered(callback
,"TODO: Cache availability checking (PC = 0x%s)\n",pr_addr(IPC
));
2910 case 0: /* instruction cache */
2912 case 0: /* Index Invalidate */
2913 case 1: /* Index Load Tag */
2914 case 2: /* Index Store Tag */
2915 case 4: /* Hit Invalidate */
2917 case 6: /* Hit Writeback */
2918 if (!icache_warning
)
2920 sim_warning("Instruction CACHE operation %d to be coded",(op
>> 2));
2926 SignalException(ReservedInstruction
,instruction
);
2931 case 1: /* data cache */
2933 case 0: /* Index Writeback Invalidate */
2934 case 1: /* Index Load Tag */
2935 case 2: /* Index Store Tag */
2936 case 3: /* Create Dirty */
2937 case 4: /* Hit Invalidate */
2938 case 5: /* Hit Writeback Invalidate */
2939 case 6: /* Hit Writeback */
2940 if (!dcache_warning
)
2942 sim_warning("Data CACHE operation %d to be coded",(op
>> 2));
2948 SignalException(ReservedInstruction
,instruction
);
2953 default: /* unrecognised cache ID */
2954 SignalException(ReservedInstruction
,instruction
);
2961 /*-- FPU support routines ---------------------------------------------------*/
2963 #if defined(HASFPU) /* Only needed when building FPU aware simulators */
2966 #define SizeFGR() (GPRLEN)
2968 /* They depend on the CPU being simulated */
2969 #define SizeFGR() ((PROCESSOR_64BIT && ((SR & status_FR) == 1)) ? 64 : 32)
2972 /* Numbers are held in normalized form. The SINGLE and DOUBLE binary
2973 formats conform to ANSI/IEEE Std 754-1985. */
2974 /* SINGLE precision floating:
2975 * seeeeeeeefffffffffffffffffffffff
2977 * e = 8bits = exponent
2978 * f = 23bits = fraction
2980 /* SINGLE precision fixed:
2981 * siiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
2983 * i = 31bits = integer
2985 /* DOUBLE precision floating:
2986 * seeeeeeeeeeeffffffffffffffffffffffffffffffffffffffffffffffffffff
2988 * e = 11bits = exponent
2989 * f = 52bits = fraction
2991 /* DOUBLE precision fixed:
2992 * siiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
2994 * i = 63bits = integer
2997 /* Extract sign-bit: */
2998 #define FP_S_s(v) (((v) & ((unsigned)1 << 31)) ? 1 : 0)
2999 #define FP_D_s(v) (((v) & ((uword64)1 << 63)) ? 1 : 0)
3000 /* Extract biased exponent: */
3001 #define FP_S_be(v) (((v) >> 23) & 0xFF)
3002 #define FP_D_be(v) (((v) >> 52) & 0x7FF)
3003 /* Extract unbiased Exponent: */
3004 #define FP_S_e(v) (FP_S_be(v) - 0x7F)
3005 #define FP_D_e(v) (FP_D_be(v) - 0x3FF)
3006 /* Extract complete fraction field: */
3007 #define FP_S_f(v) ((v) & ~((unsigned)0x1FF << 23))
3008 #define FP_D_f(v) ((v) & ~((uword64)0xFFF << 52))
3009 /* Extract numbered fraction bit: */
3010 #define FP_S_fb(b,v) (((v) & (1 << (23 - (b)))) ? 1 : 0)
3011 #define FP_D_fb(b,v) (((v) & (1 << (52 - (b)))) ? 1 : 0)
3013 /* Explicit QNaN values used when value required: */
3014 #define FPQNaN_SINGLE (0x7FBFFFFF)
3015 #define FPQNaN_WORD (0x7FFFFFFF)
3016 #define FPQNaN_DOUBLE (((uword64)0x7FF7FFFF << 32) | 0xFFFFFFFF)
3017 #define FPQNaN_LONG (((uword64)0x7FFFFFFF << 32) | 0xFFFFFFFF)
3019 /* Explicit Infinity values used when required: */
3020 #define FPINF_SINGLE (0x7F800000)
3021 #define FPINF_DOUBLE (((uword64)0x7FF00000 << 32) | 0x00000000)
3023 #if 1 /* def DEBUG */
3024 #define RMMODE(v) (((v) == FP_RM_NEAREST) ? "Round" : (((v) == FP_RM_TOZERO) ? "Trunc" : (((v) == FP_RM_TOPINF) ? "Ceil" : "Floor")))
3025 #define DOFMT(v) (((v) == fmt_single) ? "single" : (((v) == fmt_double) ? "double" : (((v) == fmt_word) ? "word" : (((v) == fmt_long) ? "long" : (((v) == fmt_unknown) ? "<unknown>" : (((v) == fmt_uninterpreted) ? "<uninterpreted>" : "<format error>"))))))
3036 /* Treat unused register values, as fixed-point 64bit values: */
3037 if ((fmt
== fmt_uninterpreted
) || (fmt
== fmt_unknown
))
3039 /* If request to read data as "uninterpreted", then use the current
3041 fmt
= fpr_state
[fpr
];
3046 /* For values not yet accessed, set to the desired format: */
3047 if (fpr_state
[fpr
] == fmt_uninterpreted
) {
3048 fpr_state
[fpr
] = fmt
;
3050 printf("DBG: Register %d was fmt_uninterpreted. Now %s\n",fpr
,DOFMT(fmt
));
3053 if (fmt
!= fpr_state
[fpr
]) {
3054 sim_warning("FPR %d (format %s) being accessed with format %s - setting to unknown (PC = 0x%s)",fpr
,DOFMT(fpr_state
[fpr
]),DOFMT(fmt
),pr_addr(IPC
));
3055 fpr_state
[fpr
] = fmt_unknown
;
3058 if (fpr_state
[fpr
] == fmt_unknown
) {
3059 /* Set QNaN value: */
3062 value
= FPQNaN_SINGLE
;
3066 value
= FPQNaN_DOUBLE
;
3070 value
= FPQNaN_WORD
;
3074 value
= FPQNaN_LONG
;
3081 } else if (SizeFGR() == 64) {
3085 value
= (FGR
[fpr
] & 0xFFFFFFFF);
3088 case fmt_uninterpreted
:
3102 value
= (FGR
[fpr
] & 0xFFFFFFFF);
3105 case fmt_uninterpreted
:
3108 if ((fpr
& 1) == 0) { /* even registers only */
3109 value
= ((((uword64
)FGR
[fpr
+1]) << 32) | (FGR
[fpr
] & 0xFFFFFFFF));
3111 SignalException (ReservedInstruction
, 0);
3122 SignalException(SimulatorFault
,"Unrecognised FP format in ValueFPR()");
3125 printf("DBG: ValueFPR: fpr = %d, fmt = %s, value = 0x%s : PC = 0x%s : SizeFGR() = %d\n",fpr
,DOFMT(fmt
),pr_addr(value
),pr_addr(IPC
),SizeFGR());
3132 StoreFPR(fpr
,fmt
,value
)
3140 printf("DBG: StoreFPR: fpr = %d, fmt = %s, value = 0x%s : PC = 0x%s : SizeFGR() = %d\n",fpr
,DOFMT(fmt
),pr_addr(value
),pr_addr(IPC
),SizeFGR());
3143 if (SizeFGR() == 64) {
3147 FGR
[fpr
] = (((uword64
)0xDEADC0DE << 32) | (value
& 0xFFFFFFFF));
3148 fpr_state
[fpr
] = fmt
;
3151 case fmt_uninterpreted
:
3155 fpr_state
[fpr
] = fmt
;
3159 fpr_state
[fpr
] = fmt_unknown
;
3167 FGR
[fpr
] = (value
& 0xFFFFFFFF);
3168 fpr_state
[fpr
] = fmt
;
3171 case fmt_uninterpreted
:
3174 if ((fpr
& 1) == 0) { /* even register number only */
3175 FGR
[fpr
+1] = (value
>> 32);
3176 FGR
[fpr
] = (value
& 0xFFFFFFFF);
3177 fpr_state
[fpr
+ 1] = fmt
;
3178 fpr_state
[fpr
] = fmt
;
3180 fpr_state
[fpr
] = fmt_unknown
;
3181 fpr_state
[fpr
+ 1] = fmt_unknown
;
3182 SignalException (ReservedInstruction
, 0);
3187 fpr_state
[fpr
] = fmt_unknown
;
3192 #if defined(WARN_RESULT)
3195 #endif /* WARN_RESULT */
3198 SignalException(SimulatorFault
,"Unrecognised FP format in StoreFPR()");
3201 printf("DBG: StoreFPR: fpr[%d] = 0x%s (format %s)\n",fpr
,pr_addr(FGR
[fpr
]),DOFMT(fmt
));
3214 /* Check if (((E - bias) == (E_max + 1)) && (fraction != 0)). We
3215 know that the exponent field is biased... we we cheat and avoid
3216 removing the bias value. */
3219 boolean
= ((FP_S_be(op
) == 0xFF) && (FP_S_f(op
) != 0));
3220 /* We could use "FP_S_fb(1,op)" to ascertain whether we are
3221 dealing with a SNaN or QNaN */
3224 boolean
= ((FP_D_be(op
) == 0x7FF) && (FP_D_f(op
) != 0));
3225 /* We could use "FP_S_fb(1,op)" to ascertain whether we are
3226 dealing with a SNaN or QNaN */
3229 boolean
= (op
== FPQNaN_WORD
);
3232 boolean
= (op
== FPQNaN_LONG
);
3235 fprintf (stderr
, "Bad switch\n");
3240 printf("DBG: NaN: returning %d for 0x%s (format = %s)\n",boolean
,pr_addr(op
),DOFMT(fmt
));
3254 printf("DBG: Infinity: format %s 0x%s (PC = 0x%s)\n",DOFMT(fmt
),pr_addr(op
),pr_addr(IPC
));
3257 /* Check if (((E - bias) == (E_max + 1)) && (fraction == 0)). We
3258 know that the exponent field is biased... we we cheat and avoid
3259 removing the bias value. */
3262 boolean
= ((FP_S_be(op
) == 0xFF) && (FP_S_f(op
) == 0));
3265 boolean
= ((FP_D_be(op
) == 0x7FF) && (FP_D_f(op
) == 0));
3268 printf("DBG: TODO: unrecognised format (%s) for Infinity check\n",DOFMT(fmt
));
3273 printf("DBG: Infinity: returning %d for 0x%s (format = %s)\n",boolean
,pr_addr(op
),DOFMT(fmt
));
3287 /* Argument checking already performed by the FPCOMPARE code */
3290 printf("DBG: Less: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
3293 /* The format type should already have been checked: */
3297 unsigned int wop1
= (unsigned int)op1
;
3298 unsigned int wop2
= (unsigned int)op2
;
3299 boolean
= (*(float *)&wop1
< *(float *)&wop2
);
3303 boolean
= (*(double *)&op1
< *(double *)&op2
);
3306 fprintf (stderr
, "Bad switch\n");
3311 printf("DBG: Less: returning %d (format = %s)\n",boolean
,DOFMT(fmt
));
3325 /* Argument checking already performed by the FPCOMPARE code */
3328 printf("DBG: Equal: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
3331 /* The format type should already have been checked: */
3334 boolean
= ((op1
& 0xFFFFFFFF) == (op2
& 0xFFFFFFFF));
3337 boolean
= (op1
== op2
);
3340 fprintf (stderr
, "Bad switch\n");
3345 printf("DBG: Equal: returning %d (format = %s)\n",boolean
,DOFMT(fmt
));
3352 AbsoluteValue(op
,fmt
)
3359 printf("DBG: AbsoluteValue: %s: op = 0x%s\n",DOFMT(fmt
),pr_addr(op
));
3362 /* The format type should already have been checked: */
3366 unsigned int wop
= (unsigned int)op
;
3367 float tmp
= ((float)fabs((double)*(float *)&wop
));
3368 result
= (uword64
)*(unsigned int *)&tmp
;
3373 double tmp
= (fabs(*(double *)&op
));
3374 result
= *(uword64
*)&tmp
;
3377 fprintf (stderr
, "Bad switch\n");
3392 printf("DBG: Negate: %s: op = 0x%s\n",DOFMT(fmt
),pr_addr(op
));
3395 /* The format type should already have been checked: */
3399 unsigned int wop
= (unsigned int)op
;
3400 float tmp
= ((float)0.0 - *(float *)&wop
);
3401 result
= (uword64
)*(unsigned int *)&tmp
;
3406 double tmp
= ((double)0.0 - *(double *)&op
);
3407 result
= *(uword64
*)&tmp
;
3411 fprintf (stderr
, "Bad switch\n");
3427 printf("DBG: Add: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
3430 /* The registers must specify FPRs valid for operands of type
3431 "fmt". If they are not valid, the result is undefined. */
3433 /* The format type should already have been checked: */
3437 unsigned int wop1
= (unsigned int)op1
;
3438 unsigned int wop2
= (unsigned int)op2
;
3439 float tmp
= (*(float *)&wop1
+ *(float *)&wop2
);
3440 result
= (uword64
)*(unsigned int *)&tmp
;
3445 double tmp
= (*(double *)&op1
+ *(double *)&op2
);
3446 result
= *(uword64
*)&tmp
;
3450 fprintf (stderr
, "Bad switch\n");
3455 printf("DBG: Add: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
3470 printf("DBG: Sub: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
3473 /* The registers must specify FPRs valid for operands of type
3474 "fmt". If they are not valid, the result is undefined. */
3476 /* The format type should already have been checked: */
3480 unsigned int wop1
= (unsigned int)op1
;
3481 unsigned int wop2
= (unsigned int)op2
;
3482 float tmp
= (*(float *)&wop1
- *(float *)&wop2
);
3483 result
= (uword64
)*(unsigned int *)&tmp
;
3488 double tmp
= (*(double *)&op1
- *(double *)&op2
);
3489 result
= *(uword64
*)&tmp
;
3493 fprintf (stderr
, "Bad switch\n");
3498 printf("DBG: Sub: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
3505 Multiply(op1
,op2
,fmt
)
3513 printf("DBG: Multiply: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
3516 /* The registers must specify FPRs valid for operands of type
3517 "fmt". If they are not valid, the result is undefined. */
3519 /* The format type should already have been checked: */
3523 unsigned int wop1
= (unsigned int)op1
;
3524 unsigned int wop2
= (unsigned int)op2
;
3525 float tmp
= (*(float *)&wop1
* *(float *)&wop2
);
3526 result
= (uword64
)*(unsigned int *)&tmp
;
3531 double tmp
= (*(double *)&op1
* *(double *)&op2
);
3532 result
= *(uword64
*)&tmp
;
3536 fprintf (stderr
, "Bad switch\n");
3541 printf("DBG: Multiply: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
3556 printf("DBG: Divide: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
3559 /* The registers must specify FPRs valid for operands of type
3560 "fmt". If they are not valid, the result is undefined. */
3562 /* The format type should already have been checked: */
3566 unsigned int wop1
= (unsigned int)op1
;
3567 unsigned int wop2
= (unsigned int)op2
;
3568 float tmp
= (*(float *)&wop1
/ *(float *)&wop2
);
3569 result
= (uword64
)*(unsigned int *)&tmp
;
3574 double tmp
= (*(double *)&op1
/ *(double *)&op2
);
3575 result
= *(uword64
*)&tmp
;
3579 fprintf (stderr
, "Bad switch\n");
3584 printf("DBG: Divide: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
3590 static uword64 UNUSED
3598 printf("DBG: Recip: %s: op = 0x%s\n",DOFMT(fmt
),pr_addr(op
));
3601 /* The registers must specify FPRs valid for operands of type
3602 "fmt". If they are not valid, the result is undefined. */
3604 /* The format type should already have been checked: */
3608 unsigned int wop
= (unsigned int)op
;
3609 float tmp
= ((float)1.0 / *(float *)&wop
);
3610 result
= (uword64
)*(unsigned int *)&tmp
;
3615 double tmp
= ((double)1.0 / *(double *)&op
);
3616 result
= *(uword64
*)&tmp
;
3620 fprintf (stderr
, "Bad switch\n");
3625 printf("DBG: Recip: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
3639 printf("DBG: SquareRoot: %s: op = 0x%s\n",DOFMT(fmt
),pr_addr(op
));
3642 /* The registers must specify FPRs valid for operands of type
3643 "fmt". If they are not valid, the result is undefined. */
3645 /* The format type should already have been checked: */
3649 unsigned int wop
= (unsigned int)op
;
3651 float tmp
= ((float)sqrt((double)*(float *)&wop
));
3652 result
= (uword64
)*(unsigned int *)&tmp
;
3654 /* TODO: Provide square-root */
3655 result
= (uword64
)0;
3662 double tmp
= (sqrt(*(double *)&op
));
3663 result
= *(uword64
*)&tmp
;
3665 /* TODO: Provide square-root */
3666 result
= (uword64
)0;
3671 fprintf (stderr
, "Bad switch\n");
3676 printf("DBG: SquareRoot: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
3683 Convert(rm
,op
,from
,to
)
3692 printf("DBG: Convert: mode %s : op 0x%s : from %s : to %s : (PC = 0x%s)\n",RMMODE(rm
),pr_addr(op
),DOFMT(from
),DOFMT(to
),pr_addr(IPC
));
3695 /* The value "op" is converted to the destination format, rounding
3696 using mode "rm". When the destination is a fixed-point format,
3697 then a source value of Infinity, NaN or one which would round to
3698 an integer outside the fixed point range then an IEEE Invalid
3699 Operation condition is raised. */
3706 tmp
= (float)(*(double *)&op
);
3710 tmp
= (float)((int)(op
& 0xFFFFFFFF));
3714 tmp
= (float)((word64
)op
);
3717 fprintf (stderr
, "Bad switch\n");
3722 /* FIXME: This code is incorrect. The rounding mode does not
3723 round to integral values; it rounds to the nearest
3724 representable value in the format. */
3728 /* Round result to nearest representable value. When two
3729 representable values are equally near, round to the value
3730 that has a least significant bit of zero (i.e. is even). */
3732 tmp
= (float)anint((double)tmp
);
3734 /* TODO: Provide round-to-nearest */
3739 /* Round result to the value closest to, and not greater in
3740 magnitude than, the result. */
3742 tmp
= (float)aint((double)tmp
);
3744 /* TODO: Provide round-to-zero */
3749 /* Round result to the value closest to, and not less than,
3751 tmp
= (float)ceil((double)tmp
);
3755 /* Round result to the value closest to, and not greater than,
3757 tmp
= (float)floor((double)tmp
);
3762 result
= (uword64
)*(unsigned int *)&tmp
;
3774 unsigned int wop
= (unsigned int)op
;
3775 tmp
= (double)(*(float *)&wop
);
3780 xxx
= SIGNEXTEND((op
& 0xFFFFFFFF),32);
3785 tmp
= (double)((word64
)op
);
3789 fprintf (stderr
, "Bad switch\n");
3794 /* FIXME: This code is incorrect. The rounding mode does not
3795 round to integral values; it rounds to the nearest
3796 representable value in the format. */
3801 tmp
= anint(*(double *)&tmp
);
3803 /* TODO: Provide round-to-nearest */
3809 tmp
= aint(*(double *)&tmp
);
3811 /* TODO: Provide round-to-zero */
3816 tmp
= ceil(*(double *)&tmp
);
3820 tmp
= floor(*(double *)&tmp
);
3825 result
= *(uword64
*)&tmp
;
3831 if (Infinity(op
,from
) || NaN(op
,from
) || (1 == 0/*TODO: check range */)) {
3832 printf("DBG: TODO: update FCSR\n");
3833 SignalException(FPE
);
3835 if (to
== fmt_word
) {
3840 unsigned int wop
= (unsigned int)op
;
3841 tmp
= (int)*((float *)&wop
);
3845 tmp
= (int)*((double *)&op
);
3847 printf("DBG: from double %.30f (0x%s) to word: 0x%08X\n",*((double *)&op
),pr_addr(op
),tmp
);
3851 fprintf (stderr
, "Bad switch\n");
3854 result
= (uword64
)tmp
;
3855 } else { /* fmt_long */
3860 unsigned int wop
= (unsigned int)op
;
3861 tmp
= (word64
)*((float *)&wop
);
3865 tmp
= (word64
)*((double *)&op
);
3868 fprintf (stderr
, "Bad switch\n");
3871 result
= (uword64
)tmp
;
3876 fprintf (stderr
, "Bad switch\n");
3881 printf("DBG: Convert: returning 0x%s (to format = %s)\n",pr_addr(result
),DOFMT(to
));
3888 /*-- co-processor support routines ------------------------------------------*/
3891 CoProcPresent(coproc_number
)
3892 unsigned int coproc_number
;
3894 /* Return TRUE if simulator provides a model for the given co-processor number */
3899 COP_LW(coproc_num
,coproc_reg
,memword
)
3900 int coproc_num
, coproc_reg
;
3901 unsigned int memword
;
3903 switch (coproc_num
) {
3907 printf("DBG: COP_LW: memword = 0x%08X (uword64)memword = 0x%s\n",memword
,pr_addr(memword
));
3909 StoreFPR(coproc_reg
,fmt_word
,(uword64
)memword
);
3910 fpr_state
[coproc_reg
] = fmt_uninterpreted
;
3915 #if 0 /* this should be controlled by a configuration option */
3916 callback
->printf_filtered(callback
,"COP_LW(%d,%d,0x%08X) at IPC = 0x%s : TODO (architecture specific)\n",coproc_num
,coproc_reg
,memword
,pr_addr(IPC
));
3925 COP_LD(coproc_num
,coproc_reg
,memword
)
3926 int coproc_num
, coproc_reg
;
3929 switch (coproc_num
) {
3932 StoreFPR(coproc_reg
,fmt_uninterpreted
,memword
);
3937 #if 0 /* this message should be controlled by a configuration option */
3938 callback
->printf_filtered(callback
,"COP_LD(%d,%d,0x%s) at IPC = 0x%s : TODO (architecture specific)\n",coproc_num
,coproc_reg
,pr_addr(memword
),pr_addr(IPC
));
3947 COP_SW(coproc_num
,coproc_reg
)
3948 int coproc_num
, coproc_reg
;
3950 unsigned int value
= 0;
3953 switch (coproc_num
) {
3957 hold
= fpr_state
[coproc_reg
];
3958 fpr_state
[coproc_reg
] = fmt_word
;
3959 value
= (unsigned int)ValueFPR(coproc_reg
,fmt_uninterpreted
);
3960 fpr_state
[coproc_reg
] = hold
;
3963 value
= (unsigned int)ValueFPR(coproc_reg
,fpr_state
[coproc_reg
]);
3966 printf("DBG: COP_SW: reg in format %s (will be accessing as single)\n",DOFMT(fpr_state
[coproc_reg
]));
3968 value
= (unsigned int)ValueFPR(coproc_reg
,fmt_single
);
3975 #if 0 /* should be controlled by configuration option */
3976 callback
->printf_filtered(callback
,"COP_SW(%d,%d) at IPC = 0x%s : TODO (architecture specific)\n",coproc_num
,coproc_reg
,pr_addr(IPC
));
3985 COP_SD(coproc_num
,coproc_reg
)
3986 int coproc_num
, coproc_reg
;
3989 switch (coproc_num
) {
3993 value
= ValueFPR(coproc_reg
,fmt_uninterpreted
);
3996 value
= ValueFPR(coproc_reg
,fpr_state
[coproc_reg
]);
3999 printf("DBG: COP_SD: reg in format %s (will be accessing as double)\n",DOFMT(fpr_state
[coproc_reg
]));
4001 value
= ValueFPR(coproc_reg
,fmt_double
);
4008 #if 0 /* should be controlled by configuration option */
4009 callback
->printf_filtered(callback
,"COP_SD(%d,%d) at IPC = 0x%s : TODO (architecture specific)\n",coproc_num
,coproc_reg
,pr_addr(IPC
));
4018 decode_coproc(instruction
)
4019 unsigned int instruction
;
4021 int coprocnum
= ((instruction
>> 26) & 3);
4023 switch (coprocnum
) {
4024 case 0: /* standard CPU control and cache registers */
4027 Standard CP0 registers
4028 0 = Index R4000 VR4100 VR4300
4029 1 = Random R4000 VR4100 VR4300
4030 2 = EntryLo0 R4000 VR4100 VR4300
4031 3 = EntryLo1 R4000 VR4100 VR4300
4032 4 = Context R4000 VR4100 VR4300
4033 5 = PageMask R4000 VR4100 VR4300
4034 6 = Wired R4000 VR4100 VR4300
4035 8 = BadVAddr R4000 VR4100 VR4300
4036 9 = Count R4000 VR4100 VR4300
4037 10 = EntryHi R4000 VR4100 VR4300
4038 11 = Compare R4000 VR4100 VR4300
4039 12 = SR R4000 VR4100 VR4300
4040 13 = Cause R4000 VR4100 VR4300
4041 14 = EPC R4000 VR4100 VR4300
4042 15 = PRId R4000 VR4100 VR4300
4043 16 = Config R4000 VR4100 VR4300
4044 17 = LLAddr R4000 VR4100 VR4300
4045 18 = WatchLo R4000 VR4100 VR4300
4046 19 = WatchHi R4000 VR4100 VR4300
4047 20 = XContext R4000 VR4100 VR4300
4048 26 = PErr or ECC R4000 VR4100 VR4300
4049 27 = CacheErr R4000 VR4100
4050 28 = TagLo R4000 VR4100 VR4300
4051 29 = TagHi R4000 VR4100 VR4300
4052 30 = ErrorEPC R4000 VR4100 VR4300
4054 int code
= ((instruction
>> 21) & 0x1F);
4055 /* R4000 Users Manual (second edition) lists the following CP0
4057 DMFC0 Doubleword Move From CP0 (VR4100 = 01000000001tttttddddd00000000000)
4058 DMTC0 Doubleword Move To CP0 (VR4100 = 01000000101tttttddddd00000000000)
4059 MFC0 word Move From CP0 (VR4100 = 01000000000tttttddddd00000000000)
4060 MTC0 word Move To CP0 (VR4100 = 01000000100tttttddddd00000000000)
4061 TLBR Read Indexed TLB Entry (VR4100 = 01000010000000000000000000000001)
4062 TLBWI Write Indexed TLB Entry (VR4100 = 01000010000000000000000000000010)
4063 TLBWR Write Random TLB Entry (VR4100 = 01000010000000000000000000000110)
4064 TLBP Probe TLB for Matching Entry (VR4100 = 01000010000000000000000000001000)
4065 CACHE Cache operation (VR4100 = 101111bbbbbpppppiiiiiiiiiiiiiiii)
4066 ERET Exception return (VR4100 = 01000010000000000000000000011000)
4068 if (((code
== 0x00) || (code
== 0x04)) && ((instruction
& 0x7FF) == 0)) {
4069 int rt
= ((instruction
>> 16) & 0x1F);
4071 int rd
= ((instruction
>> 11) & 0x1F);
4073 if (code
== 0x00) { /* MF : move from */
4074 #if 0 /* message should be controlled by configuration option */
4075 callback
->printf_filtered(callback
,"Warning: MFC0 %d,%d not handled yet (architecture specific)\n",rt
,rd
);
4077 GPR
[rt
] = 0xDEADC0DE; /* CPR[0,rd] */
4078 } else { /* MT : move to */
4079 /* CPR[0,rd] = GPR[rt]; */
4080 #if 0 /* should be controlled by configuration option */
4081 callback
->printf_filtered(callback
,"Warning: MTC0 %d,%d not handled yet (architecture specific)\n",rt
,rd
);
4085 sim_warning("Unrecognised COP0 instruction 0x%08X at IPC = 0x%s : No handler present",instruction
,pr_addr(IPC
));
4086 /* TODO: When executing an ERET or RFE instruction we should
4087 clear LLBIT, to ensure that any out-standing atomic
4088 read/modify/write sequence fails. */
4092 case 2: /* undefined co-processor */
4093 sim_warning("COP2 instruction 0x%08X at IPC = 0x%s : No handler present",instruction
,pr_addr(IPC
));
4096 case 1: /* should not occur (FPU co-processor) */
4097 case 3: /* should not occur (FPU co-processor) */
4098 SignalException(ReservedInstruction
,instruction
);
4105 /*-- instruction simulation -------------------------------------------------*/
4108 sim_engine_run (sd
, next_cpu_nr
, siggnal
)
4110 int next_cpu_nr
; /* ignore */
4111 int siggnal
; /* ignore */
4113 #if !defined(FASTSIM)
4114 unsigned int pipeline_count
= 1;
4118 if (STATE_MEMORY (sd
) == NULL
) {
4119 printf("DBG: simulate() entered with no memory\n");
4124 #if 0 /* Disabled to check that everything works OK */
4125 /* The VR4300 seems to sign-extend the PC on its first
4126 access. However, this may just be because it is currently
4127 configured in 32bit mode. However... */
4128 PC
= SIGNEXTEND(PC
,32);
4131 /* main controlling loop */
4133 /* Fetch the next instruction from the simulator memory: */
4134 uword64 vaddr
= (uword64
)PC
;
4137 unsigned int instruction
; /* uword64? what's this used for? FIXME! */
4138 int dsstate
= (state
& simDELAYSLOT
);
4142 printf("DBG: state = 0x%08X :",state
);
4144 if (state
& simSTOP
) printf(" simSTOP");
4145 if (state
& simSTEP
) printf(" simSTEP");
4147 if (state
& simHALTEX
) printf(" simHALTEX");
4148 if (state
& simHALTIN
) printf(" simHALTIN");
4150 if (state
& simBE
) printf(" simBE");
4158 callback
->printf_filtered(callback
,"DBG: DSPC = 0x%s\n",pr_addr(DSPC
));
4161 if (AddressTranslation(PC
,isINSTRUCTION
,isLOAD
,&paddr
,&cca
,isTARGET
,isREAL
)) {
4162 if ((vaddr
& 1) == 0) {
4163 /* Copy the action of the LW instruction */
4164 unsigned int reverse
= (ReverseEndian
? (LOADDRMASK
>> 2) : 0);
4165 unsigned int bigend
= (BigEndianCPU
? (LOADDRMASK
>> 2) : 0);
4168 paddr
= ((paddr
& ~LOADDRMASK
) | ((paddr
& LOADDRMASK
) ^ (reverse
<< 2)));
4169 LoadMemory(&value
,NULL
,cca
,AccessLength_WORD
,paddr
,vaddr
,isINSTRUCTION
,isREAL
);
4170 byte
= ((vaddr
& LOADDRMASK
) ^ (bigend
<< 2));
4171 instruction
= ((value
>> (8 * byte
)) & 0xFFFFFFFF);
4173 /* Copy the action of the LH instruction */
4174 unsigned int reverse
= (ReverseEndian
? (LOADDRMASK
>> 1) : 0);
4175 unsigned int bigend
= (BigEndianCPU
? (LOADDRMASK
>> 1) : 0);
4178 paddr
= (((paddr
& ~ (uword64
) 1) & ~LOADDRMASK
)
4179 | (((paddr
& ~ (uword64
) 1) & LOADDRMASK
) ^ (reverse
<< 1)));
4180 LoadMemory(&value
,NULL
,cca
, AccessLength_HALFWORD
,
4181 paddr
& ~ (uword64
) 1,
4182 vaddr
, isINSTRUCTION
, isREAL
);
4183 byte
= (((vaddr
&~ (uword64
) 1) & LOADDRMASK
) ^ (bigend
<< 1));
4184 instruction
= ((value
>> (8 * byte
)) & 0xFFFF);
4187 fprintf(stderr
,"Cannot translate address for PC = 0x%s failed\n",pr_addr(PC
));
4192 callback
->printf_filtered(callback
,"DBG: fetched 0x%08X from PC = 0x%s\n",instruction
,pr_addr(PC
));
4195 #if !defined(FASTSIM) || defined(PROFILE)
4196 instruction_fetches
++;
4197 /* Since we increment above, the value should only ever be zero if
4198 we have just overflowed: */
4199 if (instruction_fetches
== 0)
4200 instruction_fetch_overflow
++;
4201 #if defined(PROFILE)
4202 if ((state
& simPROFILE
) && ((instruction_fetches
% profile_frequency
) == 0) && profile_hist
) {
4203 unsigned n
= ((unsigned int)(PC
- profile_minpc
) >> (profile_shift
+ 2));
4204 if (n
< profile_nsamples
) {
4205 /* NOTE: The counts for the profiling bins are only 16bits wide */
4206 if (profile_hist
[n
] != USHRT_MAX
)
4207 (profile_hist
[n
])++;
4210 #endif /* PROFILE */
4211 #endif /* !FASTSIM && PROFILE */
4213 IPC
= PC
; /* copy PC for this instruction */
4214 /* This is required by exception processing, to ensure that we can
4215 cope with exceptions in the delay slots of branches that may
4216 already have changed the PC. */
4217 if ((vaddr
& 1) == 0)
4218 PC
+= 4; /* increment ready for the next fetch */
4221 /* NOTE: If we perform a delay slot change to the PC, this
4222 increment is not requuired. However, it would make the
4223 simulator more complicated to try and avoid this small hit. */
4225 /* Currently this code provides a simple model. For more
4226 complicated models we could perform exception status checks at
4227 this point, and set the simSTOP state as required. This could
4228 also include processing any hardware interrupts raised by any
4229 I/O model attached to the simulator context.
4231 Support for "asynchronous" I/O events within the simulated world
4232 could be providing by managing a counter, and calling a I/O
4233 specific handler when a particular threshold is reached. On most
4234 architectures a decrement and check for zero operation is
4235 usually quicker than an increment and compare. However, the
4236 process of managing a known value decrement to zero, is higher
4237 than the cost of using an explicit value UINT_MAX into the
4238 future. Which system is used will depend on how complicated the
4239 I/O model is, and how much it is likely to affect the simulator
4242 If events need to be scheduled further in the future than
4243 UINT_MAX event ticks, then the I/O model should just provide its
4244 own counter, triggered from the event system. */
4246 /* MIPS pipeline ticks. To allow for future support where the
4247 pipeline hit of individual instructions is known, this control
4248 loop manages a "pipeline_count" variable. It is initialised to
4249 1 (one), and will only be changed by the simulator engine when
4250 executing an instruction. If the engine does not have access to
4251 pipeline cycle count information then all instructions will be
4252 treated as using a single cycle. NOTE: A standard system is not
4253 provided by the default simulator because different MIPS
4254 architectures have different cycle counts for the same
4257 [NOTE: pipeline_count has been replaced the event queue] */
4260 /* Set previous flag, depending on current: */
4261 if (state
& simPCOC0
)
4265 /* and update the current value: */
4272 /* NOTE: For multi-context simulation environments the "instruction"
4273 variable should be local to this routine. */
4275 /* Shorthand accesses for engine. Note: If we wanted to use global
4276 variables (and a single-threaded simulator engine), then we can
4277 create the actual variables with these names. */
4279 if (!(state
& simSKIPNEXT
)) {
4280 /* Include the simulator engine */
4282 #if ((GPRLEN == 64) && !PROCESSOR_64BIT) || ((GPRLEN == 32) && PROCESSOR_64BIT)
4283 #error "Mismatch between run-time simulator code and simulation engine"
4286 #if defined(WARN_LOHI)
4287 /* Decrement the HI/LO validity ticks */
4296 #endif /* WARN_LOHI */
4298 #if defined(WARN_ZERO)
4299 /* For certain MIPS architectures, GPR[0] is hardwired to zero. We
4300 should check for it being changed. It is better doing it here,
4301 than within the simulator, since it will help keep the simulator
4304 sim_warning("The ZERO register has been updated with 0x%s (PC = 0x%s) (reset back to zero)",pr_addr(ZERO
),pr_addr(IPC
));
4305 ZERO
= 0; /* reset back to zero before next instruction */
4307 #endif /* WARN_ZERO */
4308 } else /* simSKIPNEXT check */
4309 state
&= ~simSKIPNEXT
;
4311 /* If the delay slot was active before the instruction is
4312 executed, then update the PC to its new value: */
4315 printf("DBG: dsstate set before instruction execution - updating PC to 0x%s\n",pr_addr(DSPC
));
4318 state
&= ~(simDELAYSLOT
| simJALDELAYSLOT
);
4321 if (MIPSISA
< 4) { /* The following is only required on pre MIPS IV processors: */
4322 /* Deal with pending register updates: */
4324 printf("DBG: EMPTY BEFORE pending_in = %d, pending_out = %d, pending_total = %d\n",pending_in
,pending_out
,pending_total
);
4326 if (pending_out
!= pending_in
) {
4328 int index
= pending_out
;
4329 int total
= pending_total
;
4330 if (pending_total
== 0) {
4331 fprintf(stderr
,"FATAL: Mis-match on pending update pointers\n");
4334 for (loop
= 0; (loop
< total
); loop
++) {
4336 printf("DBG: BEFORE index = %d, loop = %d\n",index
,loop
);
4338 if (pending_slot_reg
[index
] != (LAST_EMBED_REGNUM
+ 1)) {
4340 printf("pending_slot_count[%d] = %d\n",index
,pending_slot_count
[index
]);
4342 if (--(pending_slot_count
[index
]) == 0) {
4344 printf("pending_slot_reg[%d] = %d\n",index
,pending_slot_reg
[index
]);
4345 printf("pending_slot_value[%d] = 0x%s\n",index
,pr_addr(pending_slot_value
[index
]));
4347 if (pending_slot_reg
[index
] == COCIDX
) {
4348 SETFCC(0,((FCR31
& (1 << 23)) ? 1 : 0));
4350 registers
[pending_slot_reg
[index
]] = pending_slot_value
[index
];
4352 /* The only time we have PENDING updates to FPU
4353 registers, is when performing binary transfers. This
4354 means we should update the register type field. */
4355 if ((pending_slot_reg
[index
] >= FGRIDX
) && (pending_slot_reg
[index
] < (FGRIDX
+ 32)))
4356 fpr_state
[pending_slot_reg
[index
] - FGRIDX
] = fmt_uninterpreted
;
4360 printf("registers[%d] = 0x%s\n",pending_slot_reg
[index
],pr_addr(registers
[pending_slot_reg
[index
]]));
4362 pending_slot_reg
[index
] = (LAST_EMBED_REGNUM
+ 1);
4364 if (pending_out
== PSLOTS
)
4370 printf("DBG: AFTER index = %d, loop = %d\n",index
,loop
);
4373 if (index
== PSLOTS
)
4378 printf("DBG: EMPTY AFTER pending_in = %d, pending_out = %d, pending_total = %d\n",pending_in
,pending_out
,pending_total
);
4382 #if !defined(FASTSIM)
4383 if (sim_events_tickn (sd
, pipeline_count
))
4385 /* cpu->cia = cia; */
4386 sim_events_process (sd
);
4389 if (sim_events_tick (sd
))
4391 /* cpu->cia = cia; */
4392 sim_events_process (sd
);
4394 #endif /* FASTSIM */
4398 /* This code copied from gdb's utils.c. Would like to share this code,
4399 but don't know of a common place where both could get to it. */
4401 /* Temporary storage using circular buffer */
4407 static char buf
[NUMCELLS
][CELLSIZE
];
4409 if (++cell
>=NUMCELLS
) cell
=0;
4413 /* Print routines to handle variable size regs, etc */
4415 /* Eliminate warning from compiler on 32-bit systems */
4416 static int thirty_two
= 32;
4422 char *paddr_str
=get_cell();
4423 switch (sizeof(addr
))
4426 sprintf(paddr_str
,"%08lx%08lx",
4427 (unsigned long)(addr
>>thirty_two
),(unsigned long)(addr
&0xffffffff));
4430 sprintf(paddr_str
,"%08lx",(unsigned long)addr
);
4433 sprintf(paddr_str
,"%04x",(unsigned short)(addr
&0xffff));
4436 sprintf(paddr_str
,"%x",addr
);
4445 char *paddr_str
=get_cell();
4446 sprintf(paddr_str
,"%08lx%08lx",
4447 (unsigned long)(addr
>>thirty_two
),(unsigned long)(addr
&0xffffffff));
4452 /*---------------------------------------------------------------------------*/
4453 /*> EOF interp.c <*/