2 /* Simulator for the MIPS architecture.
4 This file is part of the MIPS sim
6 THIS SOFTWARE IS NOT COPYRIGHTED
8 Cygnus offers the following for use in the public domain. Cygnus
9 makes no warranty with regard to the software or it's performance
10 and the user accepts the software "AS IS" with all faults.
12 CYGNUS DISCLAIMS ANY WARRANTIES, EXPRESS OR IMPLIED, WITH REGARD TO
13 THIS SOFTWARE INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
14 MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22 We only need to take account of the target endianness when moving data
23 between the simulator and the host. We do not need to worry about the
24 endianness of the host, since this sim code and GDB are executing in
27 The IDT monitor (found on the VR4300 board), seems to lie about
28 register contents. It seems to treat the registers as sign-extended
29 32-bit values. This cause *REAL* problems when single-stepping 64-bit
34 /* The TRACE and PROFILE manifests enable the provision of extra
35 features. If they are not defined then a simpler (quicker)
36 simulator is constructed without the required run-time checks,
38 #if 1 /* 0 to allow user build selection, 1 to force inclusion */
45 #include "sim-utils.h"
46 #include "sim-options.h"
47 #include "sim-assert.h"
70 #include "libiberty.h"
72 #include "callback.h" /* GDB simulator callback interface */
73 #include "remote-sim.h" /* GDB simulator interface */
75 #include "support.h" /* internal support manifests */
83 char* pr_addr
PARAMS ((SIM_ADDR addr
));
84 char* pr_uword64
PARAMS ((uword64 addr
));
87 #define SIGBUS SIGSEGV
90 /* Get the simulator engine description, without including the code: */
95 struct sim_state simulator
;
97 /* The following reserved instruction value is used when a simulator
98 trap is required. NOTE: Care must be taken, since this value may be
99 used in later revisions of the MIPS ISA. */
100 #define RSVD_INSTRUCTION (0x00000005)
101 #define RSVD_INSTRUCTION_MASK (0xFC00003F)
103 #define RSVD_INSTRUCTION_ARG_SHIFT 6
104 #define RSVD_INSTRUCTION_ARG_MASK 0xFFFFF
107 /* NOTE: These numbers depend on the processor architecture being
109 #define Interrupt (0)
110 #define TLBModification (1)
113 #define AddressLoad (4)
114 #define AddressStore (5)
115 #define InstructionFetch (6)
116 #define DataReference (7)
117 #define SystemCall (8)
118 #define BreakPoint (9)
119 #define ReservedInstruction (10)
120 #define CoProcessorUnusable (11)
121 #define IntegerOverflow (12) /* Arithmetic overflow (IDT monitor raises SIGFPE) */
126 /* The following exception code is actually private to the simulator
127 world. It is *NOT* a processor feature, and is used to signal
128 run-time errors in the simulator. */
129 #define SimulatorFault (0xFFFFFFFF)
131 /* The following are generic to all versions of the MIPS architecture
133 /* Memory Access Types (for CCA): */
135 #define CachedNoncoherent (1)
136 #define CachedCoherent (2)
139 #define isINSTRUCTION (1 == 0) /* FALSE */
140 #define isDATA (1 == 1) /* TRUE */
142 #define isLOAD (1 == 0) /* FALSE */
143 #define isSTORE (1 == 1) /* TRUE */
145 #define isREAL (1 == 0) /* FALSE */
146 #define isRAW (1 == 1) /* TRUE */
148 #define isTARGET (1 == 0) /* FALSE */
149 #define isHOST (1 == 1) /* TRUE */
151 /* The "AccessLength" specifications for Loads and Stores. NOTE: This
152 is the number of bytes minus 1. */
153 #define AccessLength_BYTE (0)
154 #define AccessLength_HALFWORD (1)
155 #define AccessLength_TRIPLEBYTE (2)
156 #define AccessLength_WORD (3)
157 #define AccessLength_QUINTIBYTE (4)
158 #define AccessLength_SEXTIBYTE (5)
159 #define AccessLength_SEPTIBYTE (6)
160 #define AccessLength_DOUBLEWORD (7)
161 #define AccessLength_QUADWORD (15)
164 /* FPU registers must be one of the following types. All other values
165 are reserved (and undefined). */
171 /* The following are well outside the normal acceptable format
172 range, and are used in the register status vector. */
173 fmt_unknown
= 0x10000000,
174 fmt_uninterpreted
= 0x20000000,
178 /* NOTE: We cannot avoid globals, since the GDB "sim_" interface does
179 not allow a private variable to be passed around. This means that
180 simulators under GDB can only be single-threaded. However, it would
181 be possible for the simulators to be multi-threaded if GDB allowed
182 for a private pointer to be maintained. i.e. a general "void **ptr"
183 variable that GDB passed around in the argument list to all of
184 sim_xxx() routines. It could be initialised to NULL by GDB, and
185 then updated by sim_open() and used by the other sim_xxx() support
186 functions. This would allow new features in the simulator world,
187 like storing a context - continuing execution to gather a result,
188 and then going back to the point where the context was saved and
189 changing some state before continuing. i.e. the ability to perform
190 UNDOs on simulations. It would also allow the simulation of
191 shared-memory multi-processor systems.
193 [NOTE: This is now partially implemented] */
195 static host_callback
*callback
= NULL
; /* handle onto the current callback structure */
197 /* This is nasty, since we have to rely on matching the register
198 numbers used by GDB. Unfortunately, depending on the MIPS target
199 GDB uses different register numbers. We cannot just include the
200 relevant "gdb/tm.h" link, since GDB may not be configured before
201 the sim world, and also the GDB header file requires too much other
203 /* TODO: Sort out a scheme for *KNOWING* the mapping between real
204 registers, and the numbers that GDB uses. At the moment due to the
205 order that the tools are built, we cannot rely on a configured GDB
206 world whilst constructing the simulator. This means we have to
207 assume the GDB register number mapping. */
209 #define LAST_EMBED_REGNUM (89)
212 /* To keep this default simulator simple, and fast, we use a direct
213 vector of registers. The internal simulator engine then uses
214 manifests to access the correct slot. */
215 static ut_reg registers
[LAST_EMBED_REGNUM
+ 1];
216 static int register_widths
[LAST_EMBED_REGNUM
+ 1];
218 #define GPR (®isters[0])
221 #define FGR (®isters[FGRIDX])
223 #define LO (registers[33])
224 #define HI (registers[34])
225 #define PC (registers[37])
226 #define CAUSE (registers[36])
228 #define SR (registers[SRIDX]) /* CPU status register */
230 #define FCR0 (registers[FCR0IDX]) /* really a 32bit register */
231 #define FCR31IDX (70)
232 #define FCR31 (registers[FCR31IDX]) /* really a 32bit register */
234 #define COCIDX (LAST_EMBED_REGNUM + 2) /* special case : outside the normal range */
236 /* The following are pseudonyms for standard registers */
237 #define ZERO (registers[0])
238 #define V0 (registers[2])
239 #define A0 (registers[4])
240 #define A1 (registers[5])
241 #define A2 (registers[6])
242 #define A3 (registers[7])
243 #define SP (registers[29])
244 #define RA (registers[31])
247 /* start-sanitize-r5900 */
249 The R5900 has 128 bit registers, but the hi 64 bits are only touched by
250 multimedia (MMI) instructions. The normal mips instructions just use the
251 lower 64 bits. To avoid changing the older parts of the simulator to
252 handle this weirdness, the high 64 bits of each register are kept in
253 a separate array (registers1). The high 64 bits of any register are by
254 convention refered by adding a '1' to the end of the normal register's
255 name. So LO still refers to the low 64 bits of the LO register, LO1
256 refers to the high 64 bits of that same register.
259 /* The high part of each register */
260 static ut_reg registers1
[LAST_EMBED_REGNUM
+ 1];
262 #define GPR1 (®isters1[0])
264 #define LO1 (registers1[33])
265 #define HI1 (registers1[34])
267 #define BYTES_IN_MMI_REGS (sizeof(registers[0])+sizeof(registers1[0]))
268 #define HALFWORDS_IN_MMI_REGS (BYTES_IN_MMI_REGS/2)
269 #define WORDS_IN_MMI_REGS (BYTES_IN_MMI_REGS/4)
270 #define DOUBLEWORDS_IN_MMI_REGS (BYTES_IN_MMI_REGS/8)
272 #define BYTES_IN_MIPS_REGS (sizeof(registers[0]))
273 #define HALFWORDS_IN_MIPS_REGS (BYTES_IN_MIPS_REGS/2)
274 #define WORDS_IN_MIPS_REGS (BYTES_IN_MIPS_REGS/4)
275 #define DOUBLEWORDS_IN_MIPS_REGS (BYTES_IN_MIPS_REGS/8)
279 SUB_REG_FETCH - return as lvalue some sub-part of a "register"
280 T - type of the sub part
281 TC - # of T's in the mips part of the "register"
282 I - index (from 0) of desired sub part
283 A - low part of "register"
284 A1 - high part of register
286 #define SUB_REG_FETCH(T,TC,A,A1,I) \
287 (*(((I) < (TC) ? (T*)(A) : (T*)(A1)) \
288 + (CURRENT_HOST_BYTE_ORDER == BIG_ENDIAN \
289 ? ((TC) - 1 - (I) % (TC)) \
296 GPR_<type>(R,I) - return, as lvalue, the I'th <type> of general register R
297 where <type> has two letters:
298 1 is S=signed or U=unsigned
299 2 is B=byte H=halfword W=word D=doubleword
302 #define SUB_REG_SB(A,A1,I) SUB_REG_FETCH(signed8, BYTES_IN_MIPS_REGS, A, A1, I)
303 #define SUB_REG_SH(A,A1,I) SUB_REG_FETCH(signed16, HALFWORDS_IN_MIPS_REGS, A, A1, I)
304 #define SUB_REG_SW(A,A1,I) SUB_REG_FETCH(signed32, WORDS_IN_MIPS_REGS, A, A1, I)
305 #define SUB_REG_SD(A,A1,I) SUB_REG_FETCH(signed64, DOUBLEWORDS_IN_MIPS_REGS, A, A1, I)
307 #define SUB_REG_UB(A,A1,I) SUB_REG_FETCH(unsigned8, BYTES_IN_MIPS_REGS, A, A1, I)
308 #define SUB_REG_UH(A,A1,I) SUB_REG_FETCH(unsigned16, HALFWORDS_IN_MIPS_REGS, A, A1, I)
309 #define SUB_REG_UW(A,A1,I) SUB_REG_FETCH(unsigned32, WORDS_IN_MIPS_REGS, A, A1, I)
310 #define SUB_REG_UD(A,A1,I) SUB_REG_FETCH(unsigned64, DOUBLEWORDS_IN_MIPS_REGS, A, A1, I)
312 #define GPR_SB(R,I) SUB_REG_SB(®isters[R], ®isters1[R], I)
313 #define GPR_SH(R,I) SUB_REG_SH(®isters[R], ®isters1[R], I)
314 #define GPR_SW(R,I) SUB_REG_SW(®isters[R], ®isters1[R], I)
315 #define GPR_SD(R,I) SUB_REG_SD(®isters[R], ®isters1[R], I)
317 #define GPR_UB(R,I) SUB_REG_UB(®isters[R], ®isters1[R], I)
318 #define GPR_UH(R,I) SUB_REG_UH(®isters[R], ®isters1[R], I)
319 #define GPR_UW(R,I) SUB_REG_UW(®isters[R], ®isters1[R], I)
320 #define GPR_UD(R,I) SUB_REG_UD(®isters[R], ®isters1[R], I)
323 #define RS_SB(I) SUB_REG_SB(&rs_reg, &rs_reg1, I)
324 #define RS_SH(I) SUB_REG_SH(&rs_reg, &rs_reg1, I)
325 #define RS_SW(I) SUB_REG_SW(&rs_reg, &rs_reg1, I)
326 #define RS_SD(I) SUB_REG_SD(&rs_reg, &rs_reg1, I)
328 #define RS_UB(I) SUB_REG_UB(&rs_reg, &rs_reg1, I)
329 #define RS_UH(I) SUB_REG_UH(&rs_reg, &rs_reg1, I)
330 #define RS_UW(I) SUB_REG_UW(&rs_reg, &rs_reg1, I)
331 #define RS_UD(I) SUB_REG_UD(&rs_reg, &rs_reg1, I)
333 #define RT_SB(I) SUB_REG_SB(&rt_reg, &rt_reg1, I)
334 #define RT_SH(I) SUB_REG_SH(&rt_reg, &rt_reg1, I)
335 #define RT_SW(I) SUB_REG_SW(&rt_reg, &rt_reg1, I)
336 #define RT_SD(I) SUB_REG_SD(&rt_reg, &rt_reg1, I)
338 #define RT_UB(I) SUB_REG_UB(&rt_reg, &rt_reg1, I)
339 #define RT_UH(I) SUB_REG_UH(&rt_reg, &rt_reg1, I)
340 #define RT_UW(I) SUB_REG_UW(&rt_reg, &rt_reg1, I)
341 #define RT_UD(I) SUB_REG_UD(&rt_reg, &rt_reg1, I)
345 #define LO_SB(I) SUB_REG_SB(&LO, &LO1, I)
346 #define LO_SH(I) SUB_REG_SH(&LO, &LO1, I)
347 #define LO_SW(I) SUB_REG_SW(&LO, &LO1, I)
348 #define LO_SD(I) SUB_REG_SD(&LO, &LO1, I)
350 #define LO_UB(I) SUB_REG_UB(&LO, &LO1, I)
351 #define LO_UH(I) SUB_REG_UH(&LO, &LO1, I)
352 #define LO_UW(I) SUB_REG_UW(&LO, &LO1, I)
353 #define LO_UD(I) SUB_REG_UD(&LO, &LO1, I)
355 #define HI_SB(I) SUB_REG_SB(&HI, &HI1, I)
356 #define HI_SH(I) SUB_REG_SH(&HI, &HI1, I)
357 #define HI_SW(I) SUB_REG_SW(&HI, &HI1, I)
358 #define HI_SD(I) SUB_REG_SD(&HI, &HI1, I)
360 #define HI_UB(I) SUB_REG_UB(&HI, &HI1, I)
361 #define HI_UH(I) SUB_REG_UH(&HI, &HI1, I)
362 #define HI_UW(I) SUB_REG_UW(&HI, &HI1, I)
363 #define HI_UD(I) SUB_REG_UD(&HI, &HI1, I)
364 /* end-sanitize-r5900 */
367 /* start-sanitize-r5900 */
368 static ut_reg SA
; /* the shift amount register */
369 /* end-sanitize-r5900 */
371 static ut_reg EPC
= 0; /* Exception PC */
374 /* Keep the current format state for each register: */
375 static FP_formats fpr_state
[32];
378 /* The following are internal simulator state variables: */
379 static ut_reg IPC
= 0; /* internal Instruction PC */
380 static ut_reg DSPC
= 0; /* delay-slot PC */
383 /* TODO : these should be the bitmasks for these bits within the
384 status register. At the moment the following are VR4300
386 #define status_KSU_mask (0x3) /* mask for KSU bits */
387 #define status_KSU_shift (3) /* shift for field */
388 #define ksu_kernel (0x0)
389 #define ksu_supervisor (0x1)
390 #define ksu_user (0x2)
391 #define ksu_unknown (0x3)
393 #define status_IE (1 << 0) /* Interrupt enable */
394 #define status_EXL (1 << 1) /* Exception level */
395 #define status_RE (1 << 25) /* Reverse Endian in user mode */
396 #define status_FR (1 << 26) /* enables MIPS III additional FP registers */
397 #define status_SR (1 << 20) /* soft reset or NMI */
398 #define status_BEV (1 << 22) /* Location of general exception vectors */
399 #define status_TS (1 << 21) /* TLB shutdown has occurred */
400 #define status_ERL (1 << 2) /* Error level */
401 #define status_RP (1 << 27) /* Reduced Power mode */
403 #define cause_BD ((unsigned)1 << 31) /* Exception in branch delay slot */
406 /* Macro to update FPSR condition-code field. This is complicated by
407 the fact that there is a hole in the index range of the bits within
408 the FCSR register. Also, the number of bits visible depends on the
409 MIPS ISA version being supported. */
410 #define SETFCC(cc,v) {\
411 int bit = ((cc == 0) ? 23 : (24 + (cc)));\
412 FCSR = ((FCSR & ~(1 << bit)) | ((v) << bit));\
414 #define GETFCC(cc) (((((cc) == 0) ? (FCSR & (1 << 23)) : (FCSR & (1 << (24 + (cc))))) != 0) ? 1 : 0)
416 /* This should be the COC1 value at the start of the preceding
418 #define PREVCOC1() ((state & simPCOC1) ? 1 : 0)
421 /* Standard FCRS bits: */
422 #define IR (0) /* Inexact Result */
423 #define UF (1) /* UnderFlow */
424 #define OF (2) /* OverFlow */
425 #define DZ (3) /* Division by Zero */
426 #define IO (4) /* Invalid Operation */
427 #define UO (5) /* Unimplemented Operation */
429 /* Get masks for individual flags: */
430 #if 1 /* SAFE version */
431 #define FP_FLAGS(b) (((unsigned)(b) < 5) ? (1 << ((b) + 2)) : 0)
432 #define FP_ENABLE(b) (((unsigned)(b) < 5) ? (1 << ((b) + 7)) : 0)
433 #define FP_CAUSE(b) (((unsigned)(b) < 6) ? (1 << ((b) + 12)) : 0)
435 #define FP_FLAGS(b) (1 << ((b) + 2))
436 #define FP_ENABLE(b) (1 << ((b) + 7))
437 #define FP_CAUSE(b) (1 << ((b) + 12))
440 #define FP_FS (1 << 24) /* MIPS III onwards : Flush to Zero */
442 #define FP_MASK_RM (0x3)
444 #define FP_RM_NEAREST (0) /* Round to nearest (Round) */
445 #define FP_RM_TOZERO (1) /* Round to zero (Trunc) */
446 #define FP_RM_TOPINF (2) /* Round to Plus infinity (Ceil) */
447 #define FP_RM_TOMINF (3) /* Round to Minus infinity (Floor) */
448 #define GETRM() (int)((FCSR >> FP_SH_RM) & FP_MASK_RM)
450 /* Slots for delayed register updates. For the moment we just have a
451 fixed number of slots (rather than a more generic, dynamic
452 system). This keeps the simulator fast. However, we only allow for
453 the register update to be delayed for a single instruction
455 #define PSLOTS (5) /* Maximum number of instruction cycles */
456 static int pending_in
;
457 static int pending_out
;
458 static int pending_total
;
459 static int pending_slot_count
[PSLOTS
];
460 static int pending_slot_reg
[PSLOTS
];
461 static ut_reg pending_slot_value
[PSLOTS
];
463 /*---------------------------------------------------------------------------*/
464 /*-- GDB simulator interface ------------------------------------------------*/
465 /*---------------------------------------------------------------------------*/
467 static void dotrace
PARAMS((FILE *tracefh
,int type
,SIM_ADDR address
,int width
,char *comment
,...));
468 static void sim_warning
PARAMS((char *fmt
,...));
469 extern void sim_error
PARAMS((char *fmt
,...));
470 static void ColdReset
PARAMS((void));
471 static int AddressTranslation
PARAMS((uword64 vAddr
,int IorD
,int LorS
,uword64
*pAddr
,int *CCA
,int host
,int raw
));
472 static void StoreMemory
PARAMS((int CCA
,int AccessLength
,uword64 MemElem
,uword64 MemElem1
,uword64 pAddr
,uword64 vAddr
,int raw
));
473 static void LoadMemory
PARAMS((uword64
*memvalp
,uword64
*memval1p
,int CCA
,int AccessLength
,uword64 pAddr
,uword64 vAddr
,int IorD
,int raw
));
474 static void SignalException
PARAMS((int exception
,...));
475 static long getnum
PARAMS((char *value
));
476 extern void sim_set_profile
PARAMS((int frequency
));
477 static unsigned int power2
PARAMS((unsigned int value
));
479 /*---------------------------------------------------------------------------*/
481 /* The following are not used for MIPS IV onwards: */
482 #define PENDING_FILL(r,v) {\
483 /* printf("DBG: FILL BEFORE pending_in = %d, pending_out = %d, pending_total = %d\n",pending_in,pending_out,pending_total); */\
484 if (pending_slot_reg[pending_in] != (LAST_EMBED_REGNUM + 1))\
485 sim_warning("Attempt to over-write pending value");\
486 pending_slot_count[pending_in] = 2;\
487 pending_slot_reg[pending_in] = (r);\
488 pending_slot_value[pending_in] = (uword64)(v);\
489 /*printf("DBG: FILL reg %d value = 0x%s\n",(r),pr_addr(v));*/\
492 if (pending_in == PSLOTS)\
494 /*printf("DBG: FILL AFTER pending_in = %d, pending_out = %d, pending_total = %d\n",pending_in,pending_out,pending_total);*/\
497 static int LLBIT
= 0;
498 /* LLBIT = Load-Linked bit. A bit of "virtual" state used by atomic
499 read-write instructions. It is set when a linked load occurs. It is
500 tested and cleared by the conditional store. It is cleared (during
501 other CPU operations) when a store to the location would no longer
502 be atomic. In particular, it is cleared by exception return
505 static int HIACCESS
= 0;
506 static int LOACCESS
= 0;
507 static int HI1ACCESS
= 0;
508 static int LO1ACCESS
= 0;
510 /* ??? The 4300 and a few other processors have interlocks on hi/lo register
511 reads, and hence do not have this problem. To avoid spurious warnings,
512 we just disable this always. */
516 /* The HIACCESS and LOACCESS counts are used to ensure that
517 corruptions caused by using the HI or LO register to close to a
518 following operation are spotted. */
519 static ut_reg HLPC
= 0;
520 /* If either of the preceding two instructions have accessed the HI or
521 LO registers, then the values they see should be
522 undefined. However, to keep the simulator world simple, we just let
523 them use the value read and raise a warning to notify the user: */
524 #define CHECKHILO(s) {\
525 if ((HIACCESS != 0) || (LOACCESS != 0) || (HI1ACCESS != 0) || (LO1ACCESS != 0))\
526 sim_warning("%s over-writing HI and LO registers values (PC = 0x%s HLPC = 0x%s)\n",(s),pr_addr(PC),pr_addr(HLPC));\
530 /* NOTE: We keep the following status flags as bit values (1 for true,
531 0 for false). This allows them to be used in binary boolean
532 operations without worrying about what exactly the non-zero true
536 #define UserMode ((((SR & status_KSU_mask) >> status_KSU_shift) == ksu_user) ? 1 : 0)
539 /* Hardware configuration. Affects endianness of LoadMemory and
540 StoreMemory and the endianness of Kernel and Supervisor mode
541 execution. The value is 0 for little-endian; 1 for big-endian. */
542 #define BigEndianMem (CURRENT_TARGET_BYTE_ORDER == BIG_ENDIAN)
543 /*(state & simBE) ? 1 : 0)*/
546 /* This is true if the host and target have different endianness. */
547 #define ByteSwapMem (CURRENT_TARGET_BYTE_ORDER != CURRENT_HOST_BYTE_ORDER)
550 /* This mode is selected if in User mode with the RE bit being set in
551 SR (Status Register). It reverses the endianness of load and store
553 #define ReverseEndian (((SR & status_RE) && UserMode) ? 1 : 0)
556 /* The endianness for load and store instructions (0=little;1=big). In
557 User mode this endianness may be switched by setting the state_RE
558 bit in the SR register. Thus, BigEndianCPU may be computed as
559 (BigEndianMem EOR ReverseEndian). */
560 #define BigEndianCPU (BigEndianMem ^ ReverseEndian) /* Already bits */
562 #if !defined(FASTSIM) || defined(PROFILE)
563 /* At the moment these values will be the same, since we do not have
564 access to the pipeline cycle count information from the simulator
566 static unsigned int instruction_fetches
= 0;
567 static unsigned int instruction_fetch_overflow
= 0;
570 /* Flags in the "state" variable: */
571 #define simHALTEX (1 << 2) /* 0 = run; 1 = halt on exception */
572 #define simHALTIN (1 << 3) /* 0 = run; 1 = halt on interrupt */
573 #define simTRACE (1 << 8) /* 0 = do nothing; 1 = trace address activity */
574 #define simPROFILE (1 << 9) /* 0 = do nothing; 1 = gather profiling samples */
575 #define simPCOC0 (1 << 17) /* COC[1] from current */
576 #define simPCOC1 (1 << 18) /* COC[1] from previous */
577 #define simDELAYSLOT (1 << 24) /* 0 = do nothing; 1 = delay slot entry exists */
578 #define simSKIPNEXT (1 << 25) /* 0 = do nothing; 1 = skip instruction */
579 #define simSIGINT (1 << 28) /* 0 = do nothing; 1 = SIGINT has occured */
580 #define simJALDELAYSLOT (1 << 29) /* 1 = in jal delay slot */
582 static unsigned int state
= 0;
584 #define DELAYSLOT() {\
585 if (state & simDELAYSLOT)\
586 sim_warning("Delay slot already activated (branch in delay slot?)");\
587 state |= simDELAYSLOT;\
590 #define JALDELAYSLOT() {\
592 state |= simJALDELAYSLOT;\
596 state &= ~simDELAYSLOT;\
597 state |= simSKIPNEXT;\
600 #define INDELAYSLOT() ((state & simDELAYSLOT) != 0)
601 #define INJALDELAYSLOT() ((state & simJALDELAYSLOT) != 0)
603 #define K0BASE (0x80000000)
604 #define K0SIZE (0x20000000)
605 #define K1BASE (0xA0000000)
606 #define K1SIZE (0x20000000)
608 /* Simple run-time monitor support */
609 static unsigned char *monitor
= NULL
;
610 static ut_reg monitor_base
= 0xBFC00000;
611 static unsigned monitor_size
= (1 << 11); /* power-of-2 */
613 static char *logfile
= NULL
; /* logging disabled by default */
614 static FILE *logfh
= NULL
;
617 static char *tracefile
= "trace.din"; /* default filename for trace log */
618 static FILE *tracefh
= NULL
;
619 static void open_trace
PARAMS((void));
623 static unsigned profile_frequency
= 256;
624 static unsigned profile_nsamples
= (128 << 10);
625 static unsigned short *profile_hist
= NULL
;
626 static ut_reg profile_minpc
;
627 static ut_reg profile_maxpc
;
628 static int profile_shift
= 0; /* address shift amount */
633 mips_option_handler (sd
, opt
, arg
)
643 tmp
= (char *)malloc(strlen(arg
) + 1);
645 callback
->printf_filtered(callback
,"Failed to allocate buffer for logfile name \"%s\"\n",optarg
);
654 callback
->printf_filtered(callback
,"Explicit model selection not yet available (Ignoring \"%s\")\n",optarg
);
659 /* Eventually the simTRACE flag could be treated as a toggle, to
660 allow external control of the program points being traced
661 (i.e. only from main onwards, excluding the run-time setup,
665 else if (strcmp (arg
, "yes") == 0)
667 else if (strcmp (arg
, "no") == 0)
671 fprintf (stderr
, "Unreconized trace option `%s'\n", arg
);
677 Simulator constructed without tracing support (for performance).\n\
678 Re-compile simulator with \"-DTRACE\" to enable this option.\n");
684 if (optarg
!= NULL
) {
686 tmp
= (char *)malloc(strlen(optarg
) + 1);
689 callback
->printf_filtered(callback
,"Failed to allocate buffer for tracefile name \"%s\"\n",optarg
);
695 callback
->printf_filtered(callback
,"Placing trace information into file \"%s\"\n",tracefile
);
707 Simulator constructed without profiling support (for performance).\n\
708 Re-compile simulator with \"-DPROFILE\" to enable this option.\n");
710 #endif /* !PROFILE */
714 profile_nsamples
= (unsigned)getnum(optarg
);
720 sim_set_profile((int)getnum(optarg
));
729 static const OPTION mips_options
[] =
731 { {"log", required_argument
, NULL
,'l'},
732 'l', "FILE", "Log file",
733 mips_option_handler
},
734 { {"name", required_argument
, NULL
,'n'},
735 'n', "MODEL", "Select arch model",
736 mips_option_handler
},
737 { {"profile", optional_argument
, NULL
,'p'},
738 'p', "on|off", "Enable profiling",
739 mips_option_handler
},
740 { {"trace", optional_argument
, NULL
,'t'},
741 't', "on|off", "Enable tracing",
742 mips_option_handler
},
743 { {"tracefile",required_argument
, NULL
,'z'},
744 'z', "FILE", "Write trace to file",
745 mips_option_handler
},
746 { {"frequency",required_argument
, NULL
,'y'},
747 'y', "FREQ", "Profile frequency",
748 mips_option_handler
},
749 { {"samples", required_argument
, NULL
,'x'},
750 'y', "SIZE", "Profile sample size",
751 mips_option_handler
},
752 { {NULL
, no_argument
, NULL
, 0}, '\0', NULL
, NULL
, NULL
}
756 int interrupt_pending
;
759 interrupt_event (SIM_DESC sd
, void *data
)
763 interrupt_pending
= 0;
764 SignalException (Interrupt
);
766 else if (!interrupt_pending
)
767 sim_events_schedule (sd
, 1, interrupt_event
, data
);
772 /*---------------------------------------------------------------------------*/
773 /*-- GDB simulator interface ------------------------------------------------*/
774 /*---------------------------------------------------------------------------*/
777 sim_open (kind
, cb
, abfd
, argv
)
783 SIM_DESC sd
= &simulator
;
785 STATE_OPEN_KIND (sd
) = kind
;
786 STATE_MAGIC (sd
) = SIM_MAGIC_NUMBER
;
787 STATE_CALLBACK (sd
) = cb
;
789 CPU_STATE (STATE_CPU (sd
, 0)) = sd
;
791 /* FIXME: watchpoints code shouldn't need this */
792 STATE_WATCHPOINTS (sd
)->pc
= &(PC
);
793 STATE_WATCHPOINTS (sd
)->sizeof_pc
= sizeof (PC
);
794 STATE_WATCHPOINTS (sd
)->interrupt_handler
= interrupt_event
;
796 /* memory defaults (unless sim_size was here first) */
797 if (STATE_MEM_SIZE (sd
) == 0)
798 STATE_MEM_SIZE (sd
) = (2 << 20);
799 STATE_MEM_BASE (sd
) = K1BASE
;
801 if (callback
== NULL
) {
802 fprintf(stderr
,"SIM Error: sim_open() called without callbacks attached\n");
808 if (sim_pre_argv_init (sd
, argv
[0]) != SIM_RC_OK
)
810 sim_add_option_table (sd
, mips_options
);
812 /* getopt will print the error message so we just have to exit if this fails.
813 FIXME: Hmmm... in the case of gdb we need getopt to call
815 if (sim_parse_args (sd
, argv
) != SIM_RC_OK
)
817 /* Uninstall the modules to avoid memory leaks,
818 file descriptor leaks, etc. */
819 sim_module_uninstall (sd
);
823 /* check for/establish the a reference program image */
824 if (sim_analyze_program (sd
,
825 (STATE_PROG_ARGV (sd
) != NULL
826 ? *STATE_PROG_ARGV (sd
)
830 sim_module_uninstall (sd
);
834 /* Configure/verify the target byte order and other runtime
835 configuration options */
836 if (sim_config (sd
) != SIM_RC_OK
)
838 sim_module_uninstall (sd
);
842 if (sim_post_argv_init (sd
) != SIM_RC_OK
)
844 /* Uninstall the modules to avoid memory leaks,
845 file descriptor leaks, etc. */
846 sim_module_uninstall (sd
);
850 /* verify assumptions the simulator made about the host type system.
851 This macro does not return if there is a problem */
855 /* Check that the host FPU conforms to IEEE 754-1985 for the SINGLE
856 and DOUBLE binary formats. This is a bit nasty, requiring that we
857 trust the explicit manifests held in the source: */
858 /* TODO: We need to cope with the simulated target and the host not
859 having the same endianness. This will require the high and low
860 words of a (double) to be swapped when converting between the
861 host and the simulated target. */
869 s
.d
= (double)523.2939453125;
871 if ((s
.i
[0] == 0 && (s
.f
[1] != (float)4.01102924346923828125
872 || s
.i
[1] != 0x40805A5A))
873 || (s
.i
[1] == 0 && (s
.f
[0] != (float)4.01102924346923828125
874 || s
.i
[0] != 0x40805A5A)))
876 fprintf(stderr
,"The host executing the simulator does not seem to have IEEE 754-1985 std FP\n");
882 /* This is NASTY, in that we are assuming the size of specific
886 for (rn
= 0; (rn
< (LAST_EMBED_REGNUM
+ 1)); rn
++) {
888 register_widths
[rn
] = GPRLEN
;
889 else if ((rn
>= FGRIDX
) && (rn
< (FGRIDX
+ 32)))
890 register_widths
[rn
] = GPRLEN
;
891 else if ((rn
>= 33) && (rn
<= 37))
892 register_widths
[rn
] = GPRLEN
;
893 else if ((rn
== SRIDX
) || (rn
== FCR0IDX
) || (rn
== FCR31IDX
) || ((rn
>= 72) && (rn
<= 89)))
894 register_widths
[rn
] = 32;
896 register_widths
[rn
] = 0;
901 if (logfile
!= NULL
) {
902 if (strcmp(logfile
,"-") == 0)
905 logfh
= fopen(logfile
,"wb+");
907 callback
->printf_filtered(callback
,"Failed to create file \"%s\", writing log information to stderr.\n",tracefile
);
913 /* FIXME: In the future both of these malloc's can be replaced by
914 calls to sim-core. */
916 /* If the host has "mmap" available we could use it to provide a
917 very large virtual address space for the simulator, since memory
918 would only be allocated within the "mmap" space as it is
919 accessed. This can also be linked to the architecture specific
920 support, required to simulate the MMU. */
921 sim_size(STATE_MEM_SIZE (sd
));
922 /* NOTE: The above will also have enabled any profiling state! */
924 /* Create the monitor address space as well */
925 monitor
= (unsigned char *)calloc(1,monitor_size
);
927 fprintf(stderr
,"Not enough VM for monitor simulation (%d bytes)\n",
931 if (state
& simTRACE
)
935 /* Write the monitor trap address handlers into the monitor (eeprom)
936 address space. This can only be done once the target endianness
937 has been determined. */
940 /* Entry into the IDT monitor is via fixed address vectors, and
941 not using machine instructions. To avoid clashing with use of
942 the MIPS TRAP system, we place our own (simulator specific)
943 "undefined" instructions into the relevant vector slots. */
944 for (loop
= 0; (loop
< monitor_size
); loop
+= 4) {
945 uword64 vaddr
= (monitor_base
+ loop
);
948 if (AddressTranslation(vaddr
, isDATA
, isSTORE
, &paddr
, &cca
, isTARGET
, isRAW
))
949 StoreMemory(cca
, AccessLength_WORD
,
950 (RSVD_INSTRUCTION
| (((loop
>> 2) & RSVD_INSTRUCTION_ARG_MASK
) << RSVD_INSTRUCTION_ARG_SHIFT
)),
951 0, paddr
, vaddr
, isRAW
);
953 /* The PMON monitor uses the same address space, but rather than
954 branching into it the address of a routine is loaded. We can
955 cheat for the moment, and direct the PMON routine to IDT style
956 instructions within the monitor space. This relies on the IDT
957 monitor not using the locations from 0xBFC00500 onwards as its
959 for (loop
= 0; (loop
< 24); loop
++)
961 uword64 vaddr
= (monitor_base
+ 0x500 + (loop
* 4));
964 unsigned int value
= ((0x500 - 8) / 8); /* default UNDEFINED reason code */
984 value
= ((0x500 - 16) / 8); /* not an IDT reason code */
987 case 8: /* cliexit */
991 case 11: /* flush_cache */
995 /* FIXME - should monitor_base be SIM_ADDR?? */
996 value
= ((unsigned int)monitor_base
+ (value
* 8));
997 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
))
998 StoreMemory(cca
,AccessLength_WORD
,value
,0,paddr
,vaddr
,isRAW
);
1000 sim_error("Failed to write to monitor space 0x%s",pr_addr(vaddr
));
1002 /* The LSI MiniRISC PMON has its vectors at 0x200, not 0x500. */
1004 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
))
1005 StoreMemory(cca
,AccessLength_WORD
,value
,0,paddr
,vaddr
,isRAW
);
1007 sim_error("Failed to write to monitor space 0x%s",pr_addr(vaddr
));
1018 tracefh
= fopen(tracefile
,"wb+");
1019 if (tracefh
== NULL
)
1021 sim_warning("Failed to create file \"%s\", writing trace information to stderr.",tracefile
);
1027 /* For the profile writing, we write the data in the host
1028 endianness. This unfortunately means we are assuming that the
1029 profile file we create is processed on the same host executing the
1030 simulator. The gmon.out file format should either have an explicit
1031 endianness, or a method of encoding the endianness in the file
1041 if (CURRENT_HOST_BYTE_ORDER
== BIG_ENDIAN
) {
1042 buff
[3] = ((val
>> 0) & 0xFF);
1043 buff
[2] = ((val
>> 8) & 0xFF);
1044 buff
[1] = ((val
>> 16) & 0xFF);
1045 buff
[0] = ((val
>> 24) & 0xFF);
1047 buff
[0] = ((val
>> 0) & 0xFF);
1048 buff
[1] = ((val
>> 8) & 0xFF);
1049 buff
[2] = ((val
>> 16) & 0xFF);
1050 buff
[3] = ((val
>> 24) & 0xFF);
1052 if (fwrite(buff
,4,1,fh
) != 1) {
1053 sim_warning("Failed to write 4bytes to the profile file");
1066 if (CURRENT_HOST_BYTE_ORDER
== BIG_ENDIAN
) {
1067 buff
[1] = ((val
>> 0) & 0xFF);
1068 buff
[0] = ((val
>> 8) & 0xFF);
1070 buff
[0] = ((val
>> 0) & 0xFF);
1071 buff
[1] = ((val
>> 8) & 0xFF);
1073 if (fwrite(buff
,2,1,fh
) != 1) {
1074 sim_warning("Failed to write 2bytes to the profile file");
1081 sim_close (sd
, quitting
)
1086 printf("DBG: sim_close: entered (quitting = %d)\n",quitting
);
1089 /* "quitting" is non-zero if we cannot hang on errors */
1091 /* Ensure that any resources allocated through the callback
1092 mechanism are released: */
1093 callback
->shutdown(callback
);
1095 #if defined(PROFILE)
1096 if ((state
& simPROFILE
) && (profile_hist
!= NULL
)) {
1097 FILE *pf
= fopen("gmon.out","wb");
1101 sim_warning("Failed to open \"gmon.out\" profile file");
1105 printf("DBG: minpc = 0x%s\n",pr_addr(profile_minpc
));
1106 printf("DBG: maxpc = 0x%s\n",pr_addr(profile_maxpc
));
1108 ok
= writeout32(pf
,(unsigned int)profile_minpc
);
1110 ok
= writeout32(pf
,(unsigned int)profile_maxpc
);
1112 ok
= writeout32(pf
,(profile_nsamples
* 2) + 12); /* size of sample buffer (+ header) */
1114 printf("DBG: nsamples = %d (size = 0x%08X)\n",profile_nsamples
,((profile_nsamples
* 2) + 12));
1116 for (loop
= 0; (ok
&& (loop
< profile_nsamples
)); loop
++) {
1117 ok
= writeout16(pf
,profile_hist
[loop
]);
1126 profile_hist
= NULL
;
1127 state
&= ~simPROFILE
;
1129 #endif /* PROFILE */
1132 if (tracefh
!= NULL
&& tracefh
!= stderr
)
1138 if (logfh
!= NULL
&& logfh
!= stdout
&& logfh
!= stderr
)
1142 if (STATE_MEMORY (sd
) != NULL
)
1143 free(STATE_MEMORY (sd
)); /* cfree not available on all hosts */
1144 STATE_MEMORY (sd
) = NULL
;
1151 sim_write (sd
,addr
,buffer
,size
)
1154 unsigned char *buffer
;
1158 uword64 vaddr
= (uword64
)addr
;
1160 /* Return the number of bytes written, or zero if error. */
1162 callback
->printf_filtered(callback
,"sim_write(0x%s,buffer,%d);\n",pr_addr(addr
),size
);
1165 /* We provide raw read and write routines, since we do not want to
1166 count the GDB memory accesses in our statistics gathering. */
1168 /* There is a lot of code duplication in the individual blocks
1169 below, but the variables are declared locally to a block to give
1170 the optimiser the best chance of improving the code. We have to
1171 perform slow byte reads from the host memory, to ensure that we
1172 get the data into the correct endianness for the (simulated)
1173 target memory world. */
1175 /* Mask count to get odd byte, odd halfword, and odd word out of the
1176 way. We can then perform doubleword transfers to and from the
1177 simulator memory for optimum performance. */
1178 if (index
&& (index
& 1)) {
1181 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
1182 uword64 value
= ((uword64
)(*buffer
++));
1183 StoreMemory(cca
,AccessLength_BYTE
,value
,0,paddr
,vaddr
,isRAW
);
1186 index
&= ~1; /* logical operations usually quicker than arithmetic on RISC systems */
1188 if (index
&& (index
& 2)) {
1191 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
1193 /* We need to perform the following magic to ensure that that
1194 bytes are written into same byte positions in the target memory
1195 world, regardless of the endianness of the host. */
1197 value
= ((uword64
)(*buffer
++) << 8);
1198 value
|= ((uword64
)(*buffer
++) << 0);
1200 value
= ((uword64
)(*buffer
++) << 0);
1201 value
|= ((uword64
)(*buffer
++) << 8);
1203 StoreMemory(cca
,AccessLength_HALFWORD
,value
,0,paddr
,vaddr
,isRAW
);
1208 if (index
&& (index
& 4)) {
1211 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
1214 value
= ((uword64
)(*buffer
++) << 24);
1215 value
|= ((uword64
)(*buffer
++) << 16);
1216 value
|= ((uword64
)(*buffer
++) << 8);
1217 value
|= ((uword64
)(*buffer
++) << 0);
1219 value
= ((uword64
)(*buffer
++) << 0);
1220 value
|= ((uword64
)(*buffer
++) << 8);
1221 value
|= ((uword64
)(*buffer
++) << 16);
1222 value
|= ((uword64
)(*buffer
++) << 24);
1224 StoreMemory(cca
,AccessLength_WORD
,value
,0,paddr
,vaddr
,isRAW
);
1229 for (;index
; index
-= 8) {
1232 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
1235 value
= ((uword64
)(*buffer
++) << 56);
1236 value
|= ((uword64
)(*buffer
++) << 48);
1237 value
|= ((uword64
)(*buffer
++) << 40);
1238 value
|= ((uword64
)(*buffer
++) << 32);
1239 value
|= ((uword64
)(*buffer
++) << 24);
1240 value
|= ((uword64
)(*buffer
++) << 16);
1241 value
|= ((uword64
)(*buffer
++) << 8);
1242 value
|= ((uword64
)(*buffer
++) << 0);
1244 value
= ((uword64
)(*buffer
++) << 0);
1245 value
|= ((uword64
)(*buffer
++) << 8);
1246 value
|= ((uword64
)(*buffer
++) << 16);
1247 value
|= ((uword64
)(*buffer
++) << 24);
1248 value
|= ((uword64
)(*buffer
++) << 32);
1249 value
|= ((uword64
)(*buffer
++) << 40);
1250 value
|= ((uword64
)(*buffer
++) << 48);
1251 value
|= ((uword64
)(*buffer
++) << 56);
1253 StoreMemory(cca
,AccessLength_DOUBLEWORD
,value
,0,paddr
,vaddr
,isRAW
);
1262 sim_read (sd
,addr
,buffer
,size
)
1265 unsigned char *buffer
;
1270 /* Return the number of bytes read, or zero if error. */
1272 callback
->printf_filtered(callback
,"sim_read(0x%s,buffer,%d);\n",pr_addr(addr
),size
);
1275 /* TODO: Perform same optimisation as the sim_write() code
1276 above. NOTE: This will require a bit more work since we will need
1277 to ensure that the source physical address is doubleword aligned
1278 before, and then deal with trailing bytes. */
1279 for (index
= 0; (index
< size
); index
++) {
1280 uword64 vaddr
,paddr
,value
;
1282 vaddr
= (uword64
)addr
+ index
;
1283 if (AddressTranslation(vaddr
,isDATA
,isLOAD
,&paddr
,&cca
,isTARGET
,isRAW
)) {
1284 LoadMemory(&value
,NULL
,cca
,AccessLength_BYTE
,paddr
,vaddr
,isDATA
,isRAW
);
1285 buffer
[index
] = (unsigned char)(value
&0xFF);
1294 sim_store_register (sd
,rn
,memory
)
1297 unsigned char *memory
;
1299 /* NOTE: gdb (the client) stores registers in target byte order
1300 while the simulator uses host byte order */
1302 callback
->printf_filtered(callback
,"sim_store_register(%d,*memory=0x%s);\n",rn
,pr_addr(*((SIM_ADDR
*)memory
)));
1305 /* Unfortunately this suffers from the same problem as the register
1306 numbering one. We need to know what the width of each logical
1307 register number is for the architecture being simulated. */
1309 if (register_widths
[rn
] == 0)
1310 sim_warning("Invalid register width for %d (register store ignored)",rn
);
1313 if (register_widths
[rn
] == 32)
1314 registers
[rn
] = T2H_4 (*(unsigned int*)memory
);
1316 registers
[rn
] = T2H_8 (*(uword64
*)memory
);
1323 sim_fetch_register (sd
,rn
,memory
)
1326 unsigned char *memory
;
1328 /* NOTE: gdb (the client) stores registers in target byte order
1329 while the simulator uses host byte order */
1331 callback
->printf_filtered(callback
,"sim_fetch_register(%d=0x%s,mem) : place simulator registers into memory\n",rn
,pr_addr(registers
[rn
]));
1334 if (register_widths
[rn
] == 0)
1335 sim_warning("Invalid register width for %d (register fetch ignored)",rn
);
1338 if (register_widths
[rn
] == 32)
1339 *((unsigned int *)memory
) = H2T_4 ((unsigned int)(registers
[rn
] & 0xFFFFFFFF));
1340 else /* 64bit register */
1341 *((uword64
*)memory
) = H2T_8 (registers
[rn
]);
1349 sim_info (sd
,verbose
)
1353 /* Accessed from the GDB "info files" command: */
1354 if (STATE_VERBOSE_P (sd
) || verbose
)
1357 sim_io_printf (sd
, "MIPS %d-bit %s endian simulator\n",
1358 (PROCESSOR_64BIT
? 64 : 32),
1359 (CURRENT_TARGET_BYTE_ORDER
== BIG_ENDIAN
? "Big" : "Little"));
1361 sim_io_printf (sd
, "0x%08X bytes of memory at 0x%s\n",
1362 STATE_MEM_SIZE (sd
),
1363 pr_addr (STATE_MEM_BASE (sd
)));
1365 #if !defined(FASTSIM)
1367 /* at present this simulator executes one instruction per
1368 simulator cycle. Consequently this data never changes */
1369 if (instruction_fetch_overflow
!= 0)
1370 sim_io_printf (sd
, "Instruction fetches = 0x%08X%08X\n",
1371 instruction_fetch_overflow
, instruction_fetches
);
1373 sim_io_printf (sd
, "Instruction fetches = %d\n", instruction_fetches
);
1375 /* It would be a useful feature, if when performing multi-cycle
1376 simulations (rather than single-stepping) we keep the start and
1377 end times of the execution, so that we can give a performance
1378 figure for the simulator. */
1379 #endif /* !FASTSIM */
1380 sim_io_printf (sd
, "Number of execution cycles = %ld\n",
1381 (long) sim_events_time (sd
));
1383 /* print information pertaining to MIPS ISA and architecture being simulated */
1384 /* things that may be interesting */
1385 /* instructions executed - if available */
1386 /* cycles executed - if available */
1387 /* pipeline stalls - if available */
1388 /* virtual time taken */
1389 /* profiling size */
1390 /* profiling frequency */
1398 sim_create_inferior (sd
, abfd
, argv
,env
)
1406 printf("DBG: sim_create_inferior entered: start_address = 0x%s\n",
1411 /* If we were providing a more complete I/O, co-processor or memory
1412 simulation, we should perform any "device" initialisation at this
1413 point. This can include pre-loading memory areas with particular
1414 patterns (e.g. simulating ROM monitors). */
1418 PC
= (unsigned64
) bfd_get_start_address(abfd
);
1422 /* TODO: Sort this properly. SIM_ADDR may already be a 64bit value: */
1423 PC
= SIGNEXTEND(bfd_get_start_address(abfd
),32);
1426 /* Prepare to execute the program to be simulated */
1427 /* argv and env are NULL terminated lists of pointers */
1430 #if 0 /* def DEBUG */
1431 callback
->printf_filtered(callback
,"sim_create_inferior() : passed arguments ignored\n");
1434 for (cptr
= argv
; (cptr
&& *cptr
); cptr
++)
1435 printf("DBG: arg \"%s\"\n",*cptr
);
1438 /* We should really place the argv slot values into the argument
1439 registers, and onto the stack as required. However, this
1440 assumes that we have a stack defined, which is not necessarily
1441 true at the moment. */
1447 typedef enum {e_terminate
,e_help
,e_setmemsize
,e_reset
} e_cmds
;
1449 static struct t_sim_command
{
1453 } sim_commands
[] = {
1454 {e_help
, "help", ": Show MIPS simulator private commands"},
1455 {e_setmemsize
,"set-memory-size","<n> : Specify amount of memory simulated"},
1456 {e_reset
, "reset-system", ": Reset the simulated processor"},
1461 sim_do_command (sd
,cmd
)
1465 struct t_sim_command
*cptr
;
1467 if (callback
== NULL
) {
1468 fprintf(stderr
,"Simulator not enabled: \"target sim\" should be used to activate\n");
1472 if (!(cmd
&& *cmd
!= '\0'))
1475 /* NOTE: Accessed from the GDB "sim" commmand: */
1476 for (cptr
= sim_commands
; cptr
&& cptr
->name
; cptr
++)
1477 if (strncmp (cmd
, cptr
->name
, strlen(cptr
->name
)) == 0)
1479 cmd
+= strlen(cptr
->name
);
1481 case e_help
: /* no arguments */
1482 { /* no arguments */
1483 struct t_sim_command
*lptr
;
1484 callback
->printf_filtered(callback
,"List of MIPS simulator commands:\n");
1485 for (lptr
= sim_commands
; lptr
->name
; lptr
++)
1486 callback
->printf_filtered(callback
,"%s %s\n",lptr
->name
,lptr
->help
);
1487 sim_args_command (sd
, "help");
1491 case e_setmemsize
: /* memory size argument */
1493 unsigned int newsize
= (unsigned int)getnum(cmd
);
1498 case e_reset
: /* no arguments */
1500 /* NOTE: See the comments in sim_open() relating to device
1505 callback
->printf_filtered(callback
,"FATAL: Matched \"%s\", but failed to match command id %d.\n",cmd
,cptr
->id
);
1513 /* try for a common command when the sim specific lookup fails */
1514 if (sim_args_command (sd
, cmd
) != SIM_RC_OK
)
1515 callback
->printf_filtered(callback
,"Error: \"%s\" is not a valid MIPS simulator command.\n",cmd
);
1521 /*---------------------------------------------------------------------------*/
1522 /* NOTE: The following routines do not seem to be used by GDB at the
1523 moment. However, they may be useful to the standalone simulator
1527 /* The profiling format is described in the "gmon_out.h" header file */
1532 #if defined(PROFILE)
1533 profile_frequency
= n
;
1534 state
|= simPROFILE
;
1535 #endif /* PROFILE */
1540 sim_set_profile_size (n
)
1543 SIM_DESC sd
= &simulator
;
1544 #if defined(PROFILE)
1545 if (state
& simPROFILE
) {
1548 /* Since we KNOW that the memory banks are a power-of-2 in size: */
1549 profile_nsamples
= power2(n
);
1550 profile_minpc
= STATE_MEM_BASE (sd
);
1551 profile_maxpc
= (STATE_MEM_BASE (sd
) + STATE_MEM_SIZE (sd
));
1553 /* Just in-case we are sampling every address: NOTE: The shift
1554 right of 2 is because we only have word-aligned PC addresses. */
1555 if (profile_nsamples
> (STATE_MEM_SIZE (sd
) >> 2))
1556 profile_nsamples
= (STATE_MEM_SIZE (sd
) >> 2);
1558 /* Since we are dealing with power-of-2 values: */
1559 profile_shift
= (((STATE_MEM_SIZE (sd
) >> 2) / profile_nsamples
) - 1);
1561 bsize
= (profile_nsamples
* sizeof(unsigned short));
1562 if (profile_hist
== NULL
)
1563 profile_hist
= (unsigned short *)calloc(64,(bsize
/ 64));
1565 profile_hist
= (unsigned short *)realloc(profile_hist
,bsize
);
1566 if (profile_hist
== NULL
) {
1567 sim_warning("Failed to allocate VM for profiling buffer (0x%08X bytes)",bsize
);
1568 state
&= ~simPROFILE
;
1571 #endif /* PROFILE */
1580 SIM_DESC sd
= &simulator
;
1582 /* Used by "run", and internally, to set the simulated memory size */
1584 callback
->printf_filtered(callback
,"Zero not valid: Memory size still 0x%08X bytes\n",STATE_MEM_SIZE (sd
));
1587 newsize
= power2(newsize
);
1588 if (STATE_MEMORY (sd
) == NULL
)
1589 new = (char *)calloc(64,(STATE_MEM_SIZE (sd
) / 64));
1591 new = (char *)realloc(STATE_MEMORY (sd
),newsize
);
1593 if (STATE_MEMORY (sd
) == NULL
)
1594 sim_error("Not enough VM for simulation memory of 0x%08X bytes",STATE_MEM_SIZE (sd
));
1596 sim_warning("Failed to resize memory (still 0x%08X bytes)",STATE_MEM_SIZE (sd
));
1598 STATE_MEM_SIZE (sd
) = (unsigned)newsize
;
1599 STATE_MEMORY (sd
) = new;
1600 #if defined(PROFILE)
1601 /* Ensure that we sample across the new memory range */
1602 sim_set_profile_size(profile_nsamples
);
1603 #endif /* PROFILE */
1613 sim_io_eprintf (sd
, "Sim trace not supported");
1615 /* This routine is called by the "run" program, when detailed
1616 execution information is required. Rather than executing a single
1617 instruction, and looping around externally... we just start
1618 simulating, returning TRUE when the simulator stops (for whatever
1622 /* Ensure tracing is enabled, if available */
1623 if (tracefh
== NULL
)
1631 state
&= ~(simSTOP
| simSTEP
); /* execute until event */
1633 state
|= (simHALTEX
| simHALTIN
); /* treat interrupt event as exception */
1634 /* Start executing instructions from the current state (set
1635 explicitly by register updates, or by sim_create_inferior): */
1642 /*---------------------------------------------------------------------------*/
1643 /*-- Private simulator support interface ------------------------------------*/
1644 /*---------------------------------------------------------------------------*/
1646 /* Simple monitor interface (currently setup for the IDT and PMON monitors) */
1649 unsigned int reason
;
1651 SIM_DESC sd
= &simulator
;
1653 printf("DBG: sim_monitor: entered (reason = %d)\n",reason
);
1656 /* The IDT monitor actually allows two instructions per vector
1657 slot. However, the simulator currently causes a trap on each
1658 individual instruction. We cheat, and lose the bottom bit. */
1661 /* The following callback functions are available, however the
1662 monitor we are simulating does not make use of them: get_errno,
1663 isatty, lseek, rename, system, time and unlink */
1665 case 6: /* int open(char *path,int flags) */
1669 if (AddressTranslation(A0
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
))
1670 V0
= callback
->open(callback
,(char *)((int)paddr
),(int)A1
);
1672 sim_error("Attempt to pass pointer that does not reference simulated memory");
1676 case 7: /* int read(int file,char *ptr,int len) */
1680 if (AddressTranslation(A1
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
))
1681 V0
= callback
->read(callback
,(int)A0
,(char *)((int)paddr
),(int)A2
);
1683 sim_error("Attempt to pass pointer that does not reference simulated memory");
1687 case 8: /* int write(int file,char *ptr,int len) */
1691 if (AddressTranslation(A1
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
))
1692 V0
= callback
->write(callback
,(int)A0
,(const char *)((int)paddr
),(int)A2
);
1694 sim_error("Attempt to pass pointer that does not reference simulated memory");
1698 case 10: /* int close(int file) */
1699 V0
= callback
->close(callback
,(int)A0
);
1702 case 11: /* char inbyte(void) */
1705 if (callback
->read_stdin(callback
,&tmp
,sizeof(char)) != sizeof(char)) {
1706 sim_error("Invalid return from character read");
1714 case 12: /* void outbyte(char chr) : write a byte to "stdout" */
1716 char tmp
= (char)(A0
& 0xFF);
1717 callback
->write_stdout(callback
,&tmp
,sizeof(char));
1721 case 17: /* void _exit() */
1722 sim_warning("sim_monitor(17): _exit(int reason) to be coded");
1723 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
, sim_exited
,
1724 (unsigned int)(A0
& 0xFFFFFFFF));
1727 case 28 : /* PMON flush_cache */
1730 case 55: /* void get_mem_info(unsigned int *ptr) */
1731 /* in: A0 = pointer to three word memory location */
1732 /* out: [A0 + 0] = size */
1733 /* [A0 + 4] = instruction cache size */
1734 /* [A0 + 8] = data cache size */
1737 uword64 paddr
, value
;
1741 /* NOTE: We use RAW memory writes here, but since we are not
1742 gathering statistics for the monitor calls we are simulating,
1743 it is not an issue. */
1746 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isREAL
)) {
1747 value
= (uword64
)STATE_MEM_SIZE (sd
);
1748 StoreMemory(cca
,AccessLength_WORD
,value
,0,paddr
,vaddr
,isRAW
);
1749 /* We re-do the address translations, in-case the block
1750 overlaps a memory boundary: */
1752 vaddr
+= (AccessLength_WORD
+ 1);
1753 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isREAL
)) {
1754 StoreMemory(cca
,AccessLength_WORD
,0,value
,paddr
,vaddr
,isRAW
);
1755 vaddr
+= (AccessLength_WORD
+ 1);
1756 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isREAL
))
1757 StoreMemory(cca
,AccessLength_WORD
,value
,0,paddr
,vaddr
,isRAW
);
1766 sim_error("Invalid pointer passed into monitor call");
1770 case 158 : /* PMON printf */
1771 /* in: A0 = pointer to format string */
1772 /* A1 = optional argument 1 */
1773 /* A2 = optional argument 2 */
1774 /* A3 = optional argument 3 */
1776 /* The following is based on the PMON printf source */
1780 /* This isn't the quickest way, since we call the host print
1781 routine for every character almost. But it does avoid
1782 having to allocate and manage a temporary string buffer. */
1783 if (AddressTranslation(A0
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
)) {
1784 char *s
= (char *)((int)paddr
);
1785 ut_reg
*ap
= &A1
; /* 1st argument */
1786 /* TODO: Include check that we only use three arguments (A1, A2 and A3) */
1790 enum {FMT_RJUST
, FMT_LJUST
, FMT_RJUST0
, FMT_CENTER
} fmt
= FMT_RJUST
;
1791 int width
= 0, trunc
= 0, haddot
= 0, longlong
= 0;
1794 if (strchr ("dobxXulscefg%", *s
))
1802 else if (*s
== '*') {
1807 } else if (*s
>= '1' && *s
<= '9') {
1810 for (t
= s
; isdigit (*s
); s
++);
1811 strncpy (tmp
, t
, s
- t
);
1813 n
= (unsigned int)strtol(tmp
,NULL
,10);
1819 } else if (*s
== '.')
1823 callback
->printf_filtered(callback
,"%%");
1824 } else if (*s
== 's') {
1825 if ((int)*ap
!= 0) {
1826 if (AddressTranslation(*ap
++,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
)) {
1827 char *p
= (char *)((int)paddr
);;
1828 callback
->printf_filtered(callback
,p
);
1831 sim_error("Attempt to pass pointer that does not reference simulated memory");
1835 callback
->printf_filtered(callback
,"(null)");
1836 } else if (*s
== 'c') {
1838 callback
->printf_filtered(callback
,"%c",n
);
1846 if (strchr ("dobxXu", *s
)) {
1847 word64 lv
= (word64
) *ap
++;
1849 callback
->printf_filtered(callback
,"<binary not supported>");
1851 sprintf(tmp
,"%%%s%c",longlong
? "ll" : "",*s
);
1853 callback
->printf_filtered(callback
,tmp
,lv
);
1855 callback
->printf_filtered(callback
,tmp
,(int)lv
);
1857 } else if (strchr ("eEfgG", *s
)) {
1858 #ifdef _MSC_VER /* MSVC version 2.x can't convert from uword64 directly */
1859 double dbl
= (double)((word64
)*ap
++);
1861 double dbl
= (double)*ap
++;
1863 sprintf(tmp
,"%%%d.%d%c",width
,trunc
,*s
);
1864 callback
->printf_filtered(callback
,tmp
,dbl
);
1870 callback
->printf_filtered(callback
,"%c",*s
++);
1873 sim_error("Attempt to pass pointer that does not reference simulated memory");
1878 sim_warning("TODO: sim_monitor(%d) : PC = 0x%s",reason
,pr_addr(IPC
));
1879 sim_warning("(Arguments : A0 = 0x%s : A1 = 0x%s : A2 = 0x%s : A3 = 0x%s)",pr_addr(A0
),pr_addr(A1
),pr_addr(A2
),pr_addr(A3
));
1885 /* Store a word into memory. */
1888 store_word (vaddr
, val
)
1895 if ((vaddr
& 3) != 0)
1896 SignalException (AddressStore
);
1899 if (AddressTranslation (vaddr
, isDATA
, isSTORE
, &paddr
, &uncached
,
1902 const uword64 mask
= 7;
1906 paddr
= (paddr
& ~mask
) | ((paddr
& mask
) ^ (ReverseEndian
<< 2));
1907 byte
= (vaddr
& mask
) ^ (BigEndianCPU
<< 2);
1908 memval
= ((uword64
) val
) << (8 * byte
);
1909 StoreMemory (uncached
, AccessLength_WORD
, memval
, 0, paddr
, vaddr
,
1915 /* Load a word from memory. */
1921 if ((vaddr
& 3) != 0)
1922 SignalException (AddressLoad
);
1928 if (AddressTranslation (vaddr
, isDATA
, isLOAD
, &paddr
, &uncached
,
1931 const uword64 mask
= 0x7;
1932 const unsigned int reverse
= ReverseEndian
? 1 : 0;
1933 const unsigned int bigend
= BigEndianCPU
? 1 : 0;
1937 paddr
= (paddr
& ~mask
) | ((paddr
& mask
) ^ (reverse
<< 2));
1938 LoadMemory (&memval
,NULL
,uncached
, AccessLength_WORD
, paddr
, vaddr
,
1940 byte
= (vaddr
& mask
) ^ (bigend
<< 2);
1941 return SIGNEXTEND (((memval
>> (8 * byte
)) & 0xffffffff), 32);
1948 /* Simulate the mips16 entry and exit pseudo-instructions. These
1949 would normally be handled by the reserved instruction exception
1950 code, but for ease of simulation we just handle them directly. */
1956 int aregs
, sregs
, rreg
;
1959 printf("DBG: mips16_entry: entered (insn = 0x%08X)\n",insn
);
1962 aregs
= (insn
& 0x700) >> 8;
1963 sregs
= (insn
& 0x0c0) >> 6;
1964 rreg
= (insn
& 0x020) >> 5;
1966 /* This should be checked by the caller. */
1975 /* This is the entry pseudo-instruction. */
1977 for (i
= 0; i
< aregs
; i
++)
1978 store_word ((uword64
) (SP
+ 4 * i
), registers
[i
+ 4]);
1986 store_word ((uword64
) tsp
, RA
);
1989 for (i
= 0; i
< sregs
; i
++)
1992 store_word ((uword64
) tsp
, registers
[16 + i
]);
2000 /* This is the exit pseudo-instruction. */
2007 RA
= load_word ((uword64
) tsp
);
2010 for (i
= 0; i
< sregs
; i
++)
2013 registers
[i
+ 16] = load_word ((uword64
) tsp
);
2020 FGR
[0] = WORD64LO (GPR
[4]);
2021 fpr_state
[0] = fmt_uninterpreted
;
2023 else if (aregs
== 6)
2025 FGR
[0] = WORD64LO (GPR
[5]);
2026 FGR
[1] = WORD64LO (GPR
[4]);
2027 fpr_state
[0] = fmt_uninterpreted
;
2028 fpr_state
[1] = fmt_uninterpreted
;
2036 sim_warning(char *fmt
,...)
2042 vsprintf (buf
, fmt
, ap
);
2045 if (logfh
!= NULL
) {
2046 fprintf(logfh
,"SIM Warning: %s\n", buf
);
2048 callback
->printf_filtered(callback
,"SIM Warning: %s\n", buf
);
2050 /* This used to call SignalException with a SimulatorFault, but that causes
2051 the simulator to exit, and that is inappropriate for a warning. */
2056 sim_error(char *fmt
,...)
2062 vsprintf (buf
, fmt
, ap
);
2065 callback
->printf_filtered(callback
,"SIM Error: %s", buf
);
2066 SignalException (SimulatorFault
, buf
);
2076 /* Round *UP* to the nearest power-of-2 if not already one */
2077 if (value
!= (value
& ~(value
- 1))) {
2078 for (tmp
= value
, loop
= 0; (tmp
!= 0); loop
++)
2080 value
= (1 << loop
);
2093 num
= strtol(value
,&end
,10);
2095 callback
->printf_filtered(callback
,"Warning: Invalid number \"%s\" ignored, using zero\n",value
);
2097 if (*end
&& ((tolower(*end
) == 'k') || (tolower(*end
) == 'm'))) {
2098 if (tolower(*end
) == 'k')
2105 callback
->printf_filtered(callback
,"Warning: Spurious characters \"%s\" at end of number ignored\n",end
);
2111 /*-- trace support ----------------------------------------------------------*/
2113 /* The TRACE support is provided (if required) in the memory accessing
2114 routines. Since we are also providing the architecture specific
2115 features, the architecture simulation code can also deal with
2116 notifying the TRACE world of cache flushes, etc. Similarly we do
2117 not need to provide profiling support in the simulator engine,
2118 since we can sample in the instruction fetch control loop. By
2119 defining the TRACE manifest, we add tracing as a run-time
2123 /* Tracing by default produces "din" format (as required by
2124 dineroIII). Each line of such a trace file *MUST* have a din label
2125 and address field. The rest of the line is ignored, so comments can
2126 be included if desired. The first field is the label which must be
2127 one of the following values:
2132 3 escape record (treated as unknown access type)
2133 4 escape record (causes cache flush)
2135 The address field is a 32bit (lower-case) hexadecimal address
2136 value. The address should *NOT* be preceded by "0x".
2138 The size of the memory transfer is not important when dealing with
2139 cache lines (as long as no more than a cache line can be
2140 transferred in a single operation :-), however more information
2141 could be given following the dineroIII requirement to allow more
2142 complete memory and cache simulators to provide better
2143 results. i.e. the University of Pisa has a cache simulator that can
2144 also take bus size and speed as (variable) inputs to calculate
2145 complete system performance (a much more useful ability when trying
2146 to construct an end product, rather than a processor). They
2147 currently have an ARM version of their tool called ChARM. */
2151 void dotrace(FILE *tracefh
,int type
,SIM_ADDR address
,int width
,char *comment
,...)
2153 if (state
& simTRACE
) {
2155 fprintf(tracefh
,"%d %s ; width %d ; ",
2159 va_start(ap
,comment
);
2160 vfprintf(tracefh
,comment
,ap
);
2162 fprintf(tracefh
,"\n");
2164 /* NOTE: Since the "din" format will only accept 32bit addresses, and
2165 we may be generating 64bit ones, we should put the hi-32bits of the
2166 address into the comment field. */
2168 /* TODO: Provide a buffer for the trace lines. We can then avoid
2169 performing writes until the buffer is filled, or the file is
2172 /* NOTE: We could consider adding a comment field to the "din" file
2173 produced using type 3 markers (unknown access). This would then
2174 allow information about the program that the "din" is for, and
2175 the MIPs world that was being simulated, to be placed into the
2182 /*---------------------------------------------------------------------------*/
2183 /*-- simulator engine -------------------------------------------------------*/
2184 /*---------------------------------------------------------------------------*/
2189 /* RESET: Fixed PC address: */
2190 PC
= (((uword64
)0xFFFFFFFF<<32) | 0xBFC00000);
2191 /* The reset vector address is in the unmapped, uncached memory space. */
2193 SR
&= ~(status_SR
| status_TS
| status_RP
);
2194 SR
|= (status_ERL
| status_BEV
);
2196 #if defined(HASFPU) && (GPRLEN == (64))
2197 /* Cheat and allow access to the complete register set immediately: */
2198 SR
|= status_FR
; /* 64bit registers */
2199 #endif /* HASFPU and 64bit FP registers */
2201 /* Ensure that any instructions with pending register updates are
2205 for (loop
= 0; (loop
< PSLOTS
); loop
++)
2206 pending_slot_reg
[loop
] = (LAST_EMBED_REGNUM
+ 1);
2207 pending_in
= pending_out
= pending_total
= 0;
2211 /* Initialise the FPU registers to the unknown state */
2214 for (rn
= 0; (rn
< 32); rn
++)
2215 fpr_state
[rn
] = fmt_uninterpreted
;
2222 /* Description from page A-22 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2223 /* Translate a virtual address to a physical address and cache
2224 coherence algorithm describing the mechanism used to resolve the
2225 memory reference. Given the virtual address vAddr, and whether the
2226 reference is to Instructions ot Data (IorD), find the corresponding
2227 physical address (pAddr) and the cache coherence algorithm (CCA)
2228 used to resolve the reference. If the virtual address is in one of
2229 the unmapped address spaces the physical address and the CCA are
2230 determined directly by the virtual address. If the virtual address
2231 is in one of the mapped address spaces then the TLB is used to
2232 determine the physical address and access type; if the required
2233 translation is not present in the TLB or the desired access is not
2234 permitted the function fails and an exception is taken.
2236 NOTE: This function is extended to return an exception state. This,
2237 along with the exception generation is used to notify whether a
2238 valid address translation occured */
2241 AddressTranslation(vAddr
,IorD
,LorS
,pAddr
,CCA
,host
,raw
)
2250 SIM_DESC sd
= &simulator
;
2251 int res
= -1; /* TRUE : Assume good return */
2254 callback
->printf_filtered(callback
,"AddressTranslation(0x%s,%s,%s,...);\n",pr_addr(vAddr
),(IorD
? "isDATA" : "isINSTRUCTION"),(LorS
? "iSTORE" : "isLOAD"));
2257 /* Check that the address is valid for this memory model */
2259 /* For a simple (flat) memory model, we simply pass virtual
2260 addressess through (mostly) unchanged. */
2261 vAddr
&= 0xFFFFFFFF;
2263 /* Treat the kernel memory spaces identically for the moment: */
2264 if ((STATE_MEM_BASE (sd
) == K1BASE
) && (vAddr
>= K0BASE
) && (vAddr
< (K0BASE
+ K0SIZE
)))
2265 vAddr
+= (K1BASE
- K0BASE
);
2267 /* Also assume that the K1BASE memory wraps. This is required to
2268 allow the PMON run-time __sizemem() routine to function (without
2269 having to provide exception simulation). NOTE: A kludge to work
2270 around the fact that the monitor memory is currently held in the
2272 if (((vAddr
< monitor_base
) || (vAddr
>= (monitor_base
+ monitor_size
))) && (vAddr
>= K1BASE
&& vAddr
< (K1BASE
+ K1SIZE
)))
2273 vAddr
= (K1BASE
| (vAddr
& (STATE_MEM_SIZE (sd
) - 1)));
2275 *pAddr
= vAddr
; /* default for isTARGET */
2276 *CCA
= Uncached
; /* not used for isHOST */
2278 /* NOTE: This is a duplicate of the code that appears in the
2279 LoadMemory and StoreMemory functions. They should be merged into
2280 a single function (that can be in-lined if required). */
2281 if ((vAddr
>= STATE_MEM_BASE (sd
)) && (vAddr
< (STATE_MEM_BASE (sd
) + STATE_MEM_SIZE (sd
)))) {
2283 *pAddr
= (int)&STATE_MEMORY (sd
)[((unsigned int)(vAddr
- STATE_MEM_BASE (sd
)) & (STATE_MEM_SIZE (sd
) - 1))];
2284 } else if ((vAddr
>= monitor_base
) && (vAddr
< (monitor_base
+ monitor_size
))) {
2286 *pAddr
= (int)&monitor
[((unsigned int)(vAddr
- monitor_base
) & (monitor_size
- 1))];
2289 sim_warning("Failed: AddressTranslation(0x%s,%s,%s,...) IPC = 0x%s",pr_addr(vAddr
),(IorD
? "isDATA" : "isINSTRUCTION"),(LorS
? "isSTORE" : "isLOAD"),pr_addr(IPC
));
2291 res
= 0; /* AddressTranslation has failed */
2292 *pAddr
= (SIM_ADDR
)-1;
2293 if (!raw
) /* only generate exceptions on real memory transfers */
2294 SignalException((LorS
== isSTORE
) ? AddressStore
: AddressLoad
);
2297 /* This is a normal occurance during gdb operation, for instance trying
2298 to print parameters at function start before they have been setup,
2299 and hence we should not print a warning except when debugging the
2301 sim_warning("AddressTranslation for %s %s from 0x%s failed",(IorD
? "data" : "instruction"),(LorS
? "store" : "load"),pr_addr(vAddr
));
2308 /* Description from page A-23 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2309 /* Prefetch data from memory. Prefetch is an advisory instruction for
2310 which an implementation specific action is taken. The action taken
2311 may increase performance, but must not change the meaning of the
2312 program, or alter architecturally-visible state. */
2315 Prefetch(CCA
,pAddr
,vAddr
,DATA
,hint
)
2323 callback
->printf_filtered(callback
,"Prefetch(%d,0x%s,0x%s,%d,%d);\n",CCA
,pr_addr(pAddr
),pr_addr(vAddr
),DATA
,hint
);
2326 /* For our simple memory model we do nothing */
2330 /* Description from page A-22 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2331 /* Load a value from memory. Use the cache and main memory as
2332 specified in the Cache Coherence Algorithm (CCA) and the sort of
2333 access (IorD) to find the contents of AccessLength memory bytes
2334 starting at physical location pAddr. The data is returned in the
2335 fixed width naturally-aligned memory element (MemElem). The
2336 low-order two (or three) bits of the address and the AccessLength
2337 indicate which of the bytes within MemElem needs to be given to the
2338 processor. If the memory access type of the reference is uncached
2339 then only the referenced bytes are read from memory and valid
2340 within the memory element. If the access type is cached, and the
2341 data is not present in cache, an implementation specific size and
2342 alignment block of memory is read and loaded into the cache to
2343 satisfy a load reference. At a minimum, the block is the entire
2346 LoadMemory(memvalp
,memval1p
,CCA
,AccessLength
,pAddr
,vAddr
,IorD
,raw
)
2356 SIM_DESC sd
= &simulator
;
2361 if (STATE_MEMORY (sd
) == NULL
)
2362 callback
->printf_filtered(callback
,"DBG: LoadMemory(%p,%p,%d,%d,0x%s,0x%s,%s,%s)\n",memvalp
,memval1p
,CCA
,AccessLength
,pr_addr(pAddr
),pr_addr(vAddr
),(IorD
? "isDATA" : "isINSTRUCTION"),(raw
? "isRAW" : "isREAL"));
2365 #if defined(WARN_MEM)
2366 if (CCA
!= uncached
)
2367 sim_warning("LoadMemory CCA (%d) is not uncached (currently all accesses treated as cached)",CCA
);
2369 if (((pAddr
& LOADDRMASK
) + AccessLength
) > LOADDRMASK
) {
2370 /* In reality this should be a Bus Error */
2371 sim_error("AccessLength of %d would extend over %dbit aligned boundary for physical address 0x%s\n",AccessLength
,(LOADDRMASK
+ 1)<<2,pr_addr(pAddr
));
2373 #endif /* WARN_MEM */
2375 /* Decide which physical memory locations are being dealt with. At
2376 this point we should be able to split the pAddr bits into the
2377 relevant address map being simulated. If the "raw" variable is
2378 set, the memory read being performed should *NOT* update any I/O
2379 state or affect the CPU state. This also includes avoiding
2380 affecting statistics gathering. */
2382 /* If instruction fetch then we need to check that the two lo-order
2383 bits are zero, otherwise raise a InstructionFetch exception: */
2384 if ((IorD
== isINSTRUCTION
)
2385 && ((pAddr
& 0x3) != 0)
2386 && (((pAddr
& 0x1) != 0) || ((vAddr
& 0x1) == 0)))
2387 SignalException(InstructionFetch
);
2389 unsigned int index
= 0;
2390 unsigned char *mem
= NULL
;
2394 dotrace(tracefh
,((IorD
== isDATA
) ? 0 : 2),(unsigned int)(pAddr
&0xFFFFFFFF),(AccessLength
+ 1),"load%s",((IorD
== isDATA
) ? "" : " instruction"));
2397 /* NOTE: Quicker methods of decoding the address space can be used
2398 when a real memory map is being simulated (i.e. using hi-order
2399 address bits to select device). */
2400 if ((pAddr
>= STATE_MEM_BASE (sd
)) && (pAddr
< (STATE_MEM_BASE (sd
) + STATE_MEM_SIZE (sd
)))) {
2401 index
= ((unsigned int)(pAddr
- STATE_MEM_BASE (sd
)) & (STATE_MEM_SIZE (sd
) - 1));
2402 mem
= STATE_MEMORY (sd
);
2403 } else if ((pAddr
>= monitor_base
) && (pAddr
< (monitor_base
+ monitor_size
))) {
2404 index
= ((unsigned int)(pAddr
- monitor_base
) & (monitor_size
- 1));
2408 sim_error("Simulator memory not found for physical address 0x%s\n",pr_addr(pAddr
));
2410 /* If we obtained the endianness of the host, and it is the same
2411 as the target memory system we can optimise the memory
2412 accesses. However, without that information we must perform
2413 slow transfer, and hope that the compiler optimisation will
2414 merge successive loads. */
2416 /* In reality we should always be loading a doubleword value (or
2417 word value in 32bit memory worlds). The external code then
2418 extracts the required bytes. However, to keep performance
2419 high we only load the required bytes into the relevant
2422 switch (AccessLength
) { /* big-endian memory */
2423 case AccessLength_QUADWORD
:
2424 value1
|= ((uword64
)mem
[index
++] << 56);
2425 case 14: /* AccessLength is one less than datalen */
2426 value1
|= ((uword64
)mem
[index
++] << 48);
2428 value1
|= ((uword64
)mem
[index
++] << 40);
2430 value1
|= ((uword64
)mem
[index
++] << 32);
2432 value1
|= ((unsigned int)mem
[index
++] << 24);
2434 value1
|= ((unsigned int)mem
[index
++] << 16);
2436 value1
|= ((unsigned int)mem
[index
++] << 8);
2438 value1
|= mem
[index
];
2440 case AccessLength_DOUBLEWORD
:
2441 value
|= ((uword64
)mem
[index
++] << 56);
2442 case AccessLength_SEPTIBYTE
:
2443 value
|= ((uword64
)mem
[index
++] << 48);
2444 case AccessLength_SEXTIBYTE
:
2445 value
|= ((uword64
)mem
[index
++] << 40);
2446 case AccessLength_QUINTIBYTE
:
2447 value
|= ((uword64
)mem
[index
++] << 32);
2448 case AccessLength_WORD
:
2449 value
|= ((unsigned int)mem
[index
++] << 24);
2450 case AccessLength_TRIPLEBYTE
:
2451 value
|= ((unsigned int)mem
[index
++] << 16);
2452 case AccessLength_HALFWORD
:
2453 value
|= ((unsigned int)mem
[index
++] << 8);
2454 case AccessLength_BYTE
:
2455 value
|= mem
[index
];
2459 index
+= (AccessLength
+ 1);
2460 switch (AccessLength
) { /* little-endian memory */
2461 case AccessLength_QUADWORD
:
2462 value1
|= ((uword64
)mem
[--index
] << 56);
2463 case 14: /* AccessLength is one less than datalen */
2464 value1
|= ((uword64
)mem
[--index
] << 48);
2466 value1
|= ((uword64
)mem
[--index
] << 40);
2468 value1
|= ((uword64
)mem
[--index
] << 32);
2470 value1
|= ((uword64
)mem
[--index
] << 24);
2472 value1
|= ((uword64
)mem
[--index
] << 16);
2474 value1
|= ((uword64
)mem
[--index
] << 8);
2476 value1
|= ((uword64
)mem
[--index
] << 0);
2478 case AccessLength_DOUBLEWORD
:
2479 value
|= ((uword64
)mem
[--index
] << 56);
2480 case AccessLength_SEPTIBYTE
:
2481 value
|= ((uword64
)mem
[--index
] << 48);
2482 case AccessLength_SEXTIBYTE
:
2483 value
|= ((uword64
)mem
[--index
] << 40);
2484 case AccessLength_QUINTIBYTE
:
2485 value
|= ((uword64
)mem
[--index
] << 32);
2486 case AccessLength_WORD
:
2487 value
|= ((uword64
)mem
[--index
] << 24);
2488 case AccessLength_TRIPLEBYTE
:
2489 value
|= ((uword64
)mem
[--index
] << 16);
2490 case AccessLength_HALFWORD
:
2491 value
|= ((uword64
)mem
[--index
] << 8);
2492 case AccessLength_BYTE
:
2493 value
|= ((uword64
)mem
[--index
] << 0);
2499 printf("DBG: LoadMemory() : (offset %d) : value = 0x%s%s\n",
2500 (int)(pAddr
& LOADDRMASK
),pr_uword64(value1
),pr_uword64(value
));
2503 /* TODO: We could try and avoid the shifts when dealing with raw
2504 memory accesses. This would mean updating the LoadMemory and
2505 StoreMemory routines to avoid shifting the data before
2506 returning or using it. */
2507 if (AccessLength
<= AccessLength_DOUBLEWORD
) {
2508 if (!raw
) { /* do nothing for raw accessess */
2510 value
<<= (((7 - (pAddr
& LOADDRMASK
)) - AccessLength
) * 8);
2511 else /* little-endian only needs to be shifted up to the correct byte offset */
2512 value
<<= ((pAddr
& LOADDRMASK
) * 8);
2517 printf("DBG: LoadMemory() : shifted value = 0x%s%s\n",
2518 pr_uword64(value1
),pr_uword64(value
));
2524 if (memval1p
) *memval1p
= value1
;
2528 /* Description from page A-23 of the "MIPS IV Instruction Set" manual
2530 /* Store a value to memory. The specified data is stored into the
2531 physical location pAddr using the memory hierarchy (data caches and
2532 main memory) as specified by the Cache Coherence Algorithm
2533 (CCA). The MemElem contains the data for an aligned, fixed-width
2534 memory element (word for 32-bit processors, doubleword for 64-bit
2535 processors), though only the bytes that will actually be stored to
2536 memory need to be valid. The low-order two (or three) bits of pAddr
2537 and the AccessLength field indicates which of the bytes within the
2538 MemElem data should actually be stored; only these bytes in memory
2542 StoreMemory(CCA
,AccessLength
,MemElem
,MemElem1
,pAddr
,vAddr
,raw
)
2546 uword64 MemElem1
; /* High order 64 bits */
2551 SIM_DESC sd
= &simulator
;
2553 callback
->printf_filtered(callback
,"DBG: StoreMemory(%d,%d,0x%s,0x%s,0x%s,0x%s,%s)\n",CCA
,AccessLength
,pr_uword64(MemElem
),pr_uword64(MemElem1
),pr_addr(pAddr
),pr_addr(vAddr
),(raw
? "isRAW" : "isREAL"));
2556 #if defined(WARN_MEM)
2557 if (CCA
!= uncached
)
2558 sim_warning("StoreMemory CCA (%d) is not uncached (currently all accesses treated as cached)",CCA
);
2560 if (((pAddr
& LOADDRMASK
) + AccessLength
) > LOADDRMASK
)
2561 sim_error("AccessLength of %d would extend over %dbit aligned boundary for physical address 0x%s\n",AccessLength
,(LOADDRMASK
+ 1)<<2,pr_addr(pAddr
));
2562 #endif /* WARN_MEM */
2566 dotrace(tracefh
,1,(unsigned int)(pAddr
&0xFFFFFFFF),(AccessLength
+ 1),"store");
2569 /* See the comments in the LoadMemory routine about optimising
2570 memory accesses. Also if we wanted to make the simulator smaller,
2571 we could merge a lot of this code with the LoadMemory
2572 routine. However, this would slow the simulator down with
2573 run-time conditionals. */
2575 unsigned int index
= 0;
2576 unsigned char *mem
= NULL
;
2578 if ((pAddr
>= STATE_MEM_BASE (sd
)) && (pAddr
< (STATE_MEM_BASE (sd
) + STATE_MEM_SIZE (sd
)))) {
2579 index
= ((unsigned int)(pAddr
- STATE_MEM_BASE (sd
)) & (STATE_MEM_SIZE (sd
) - 1));
2580 mem
= STATE_MEMORY (sd
);
2581 } else if ((pAddr
>= monitor_base
) && (pAddr
< (monitor_base
+ monitor_size
))) {
2582 index
= ((unsigned int)(pAddr
- monitor_base
) & (monitor_size
- 1));
2587 sim_error("Simulator memory not found for physical address 0x%s\n",pr_addr(pAddr
));
2592 printf("DBG: StoreMemory: offset = %d MemElem = 0x%s%s\n",(unsigned int)(pAddr
& LOADDRMASK
),pr_uword64(MemElem1
),pr_uword64(MemElem
));
2595 if (AccessLength
<= AccessLength_DOUBLEWORD
) {
2598 shift
= ((7 - AccessLength
) * 8);
2599 else /* real memory access */
2600 shift
= ((pAddr
& LOADDRMASK
) * 8);
2603 /* no need to shift raw little-endian data */
2605 MemElem
>>= ((pAddr
& LOADDRMASK
) * 8);
2610 printf("DBG: StoreMemory: shift = %d MemElem = 0x%s%s\n",shift
,pr_uword64(MemElem1
),pr_uword64(MemElem
));
2614 switch (AccessLength
) { /* big-endian memory */
2615 case AccessLength_QUADWORD
:
2616 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
2619 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
2622 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
2625 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
2628 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
2631 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
2634 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
2637 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
2639 case AccessLength_DOUBLEWORD
:
2640 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2642 case AccessLength_SEPTIBYTE
:
2643 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2645 case AccessLength_SEXTIBYTE
:
2646 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2648 case AccessLength_QUINTIBYTE
:
2649 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2651 case AccessLength_WORD
:
2652 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2654 case AccessLength_TRIPLEBYTE
:
2655 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2657 case AccessLength_HALFWORD
:
2658 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2660 case AccessLength_BYTE
:
2661 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2665 index
+= (AccessLength
+ 1);
2666 switch (AccessLength
) { /* little-endian memory */
2667 case AccessLength_QUADWORD
:
2668 mem
[--index
] = (unsigned char)(MemElem1
>> 56);
2670 mem
[--index
] = (unsigned char)(MemElem1
>> 48);
2672 mem
[--index
] = (unsigned char)(MemElem1
>> 40);
2674 mem
[--index
] = (unsigned char)(MemElem1
>> 32);
2676 mem
[--index
] = (unsigned char)(MemElem1
>> 24);
2678 mem
[--index
] = (unsigned char)(MemElem1
>> 16);
2680 mem
[--index
] = (unsigned char)(MemElem1
>> 8);
2682 mem
[--index
] = (unsigned char)(MemElem1
>> 0);
2684 case AccessLength_DOUBLEWORD
:
2685 mem
[--index
] = (unsigned char)(MemElem
>> 56);
2686 case AccessLength_SEPTIBYTE
:
2687 mem
[--index
] = (unsigned char)(MemElem
>> 48);
2688 case AccessLength_SEXTIBYTE
:
2689 mem
[--index
] = (unsigned char)(MemElem
>> 40);
2690 case AccessLength_QUINTIBYTE
:
2691 mem
[--index
] = (unsigned char)(MemElem
>> 32);
2692 case AccessLength_WORD
:
2693 mem
[--index
] = (unsigned char)(MemElem
>> 24);
2694 case AccessLength_TRIPLEBYTE
:
2695 mem
[--index
] = (unsigned char)(MemElem
>> 16);
2696 case AccessLength_HALFWORD
:
2697 mem
[--index
] = (unsigned char)(MemElem
>> 8);
2698 case AccessLength_BYTE
:
2699 mem
[--index
] = (unsigned char)(MemElem
>> 0);
2710 /* Description from page A-26 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2711 /* Order loads and stores to synchronise shared memory. Perform the
2712 action necessary to make the effects of groups of synchronizable
2713 loads and stores indicated by stype occur in the same order for all
2716 SyncOperation(stype
)
2720 callback
->printf_filtered(callback
,"SyncOperation(%d) : TODO\n",stype
);
2725 /* Description from page A-26 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2726 /* Signal an exception condition. This will result in an exception
2727 that aborts the instruction. The instruction operation pseudocode
2728 will never see a return from this function call. */
2731 SignalException (int exception
,...)
2734 SIM_DESC sd
= &simulator
;
2735 /* Ensure that any active atomic read/modify/write operation will fail: */
2738 switch (exception
) {
2739 /* TODO: For testing purposes I have been ignoring TRAPs. In
2740 reality we should either simulate them, or allow the user to
2741 ignore them at run-time. */
2743 sim_warning("Ignoring instruction TRAP (PC 0x%s)",pr_addr(IPC
));
2746 case ReservedInstruction
:
2749 unsigned int instruction
;
2750 va_start(ap
,exception
);
2751 instruction
= va_arg(ap
,unsigned int);
2753 /* Provide simple monitor support using ReservedInstruction
2754 exceptions. The following code simulates the fixed vector
2755 entry points into the IDT monitor by causing a simulator
2756 trap, performing the monitor operation, and returning to
2757 the address held in the $ra register (standard PCS return
2758 address). This means we only need to pre-load the vector
2759 space with suitable instruction values. For systems were
2760 actual trap instructions are used, we would not need to
2761 perform this magic. */
2762 if ((instruction
& RSVD_INSTRUCTION_MASK
) == RSVD_INSTRUCTION
) {
2763 sim_monitor( ((instruction
>> RSVD_INSTRUCTION_ARG_SHIFT
) & RSVD_INSTRUCTION_ARG_MASK
) );
2764 PC
= RA
; /* simulate the return from the vector entry */
2765 /* NOTE: This assumes that a branch-and-link style
2766 instruction was used to enter the vector (which is the
2767 case with the current IDT monitor). */
2768 sim_engine_restart (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
);
2770 /* Look for the mips16 entry and exit instructions, and
2771 simulate a handler for them. */
2772 else if ((IPC
& 1) != 0
2773 && (instruction
& 0xf81f) == 0xe809
2774 && (instruction
& 0x0c0) != 0x0c0) {
2775 mips16_entry (instruction
);
2776 sim_engine_restart (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
);
2777 } /* else fall through to normal exception processing */
2778 sim_warning("ReservedInstruction 0x%08X at IPC = 0x%s",instruction
,pr_addr(IPC
));
2783 callback
->printf_filtered(callback
,"DBG: SignalException(%d) IPC = 0x%s\n",exception
,pr_addr(IPC
));
2785 /* Keep a copy of the current A0 in-case this is the program exit
2789 unsigned int instruction
;
2790 va_start(ap
,exception
);
2791 instruction
= va_arg(ap
,unsigned int);
2793 /* Check for our special terminating BREAK: */
2794 if ((instruction
& 0x03FFFFC0) == 0x03ff0000) {
2795 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2796 sim_exited
, (unsigned int)(A0
& 0xFFFFFFFF));
2799 if (state
& simDELAYSLOT
)
2800 PC
= IPC
- 4; /* reference the branch instruction */
2803 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2804 sim_stopped
, SIGTRAP
);
2807 /* Store exception code into current exception id variable (used
2810 /* TODO: If not simulating exceptions then stop the simulator
2811 execution. At the moment we always stop the simulation. */
2813 /* See figure 5-17 for an outline of the code below */
2814 if (! (SR
& status_EXL
))
2816 CAUSE
= (exception
<< 2);
2817 if (state
& simDELAYSLOT
)
2819 state
&= ~simDELAYSLOT
;
2821 EPC
= (IPC
- 4); /* reference the branch instruction */
2825 /* FIXME: TLB et.al. */
2830 CAUSE
= (exception
<< 2);
2834 /* Store exception code into current exception id variable (used
2836 if (SR
& status_BEV
)
2837 PC
= (signed)0xBFC00200 + 0x180;
2839 PC
= (signed)0x80000000 + 0x180;
2841 switch ((CAUSE
>> 2) & 0x1F)
2844 /* Interrupts arrive during event processing, no need to
2848 case TLBModification
:
2853 case InstructionFetch
:
2855 /* The following is so that the simulator will continue from the
2856 exception address on breakpoint operations. */
2858 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2859 sim_stopped
, SIGBUS
);
2861 case ReservedInstruction
:
2862 case CoProcessorUnusable
:
2864 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2865 sim_stopped
, SIGILL
);
2867 case IntegerOverflow
:
2869 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2870 sim_stopped
, SIGFPE
);
2876 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2877 sim_stopped
, SIGTRAP
);
2881 sim_engine_abort (sd
, STATE_CPU (sd
, 0), NULL_CIA
,
2882 "FATAL: Should not encounter a breakpoint\n");
2884 default : /* Unknown internal exception */
2886 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2887 sim_stopped
, SIGQUIT
);
2891 case SimulatorFault
:
2895 va_start(ap
,exception
);
2896 msg
= va_arg(ap
,char *);
2898 sim_engine_abort (sd
, STATE_CPU (sd
, 0), NULL_CIA
,
2899 "FATAL: Simulator error \"%s\"\n",msg
);
2906 #if defined(WARN_RESULT)
2907 /* Description from page A-26 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2908 /* This function indicates that the result of the operation is
2909 undefined. However, this should not affect the instruction
2910 stream. All that is meant to happen is that the destination
2911 register is set to an undefined result. To keep the simulator
2912 simple, we just don't bother updating the destination register, so
2913 the overall result will be undefined. If desired we can stop the
2914 simulator by raising a pseudo-exception. */
2918 sim_warning("UndefinedResult: IPC = 0x%s",pr_addr(IPC
));
2919 #if 0 /* Disabled for the moment, since it actually happens a lot at the moment. */
2924 #endif /* WARN_RESULT */
2927 CacheOp(op
,pAddr
,vAddr
,instruction
)
2931 unsigned int instruction
;
2933 #if 1 /* stop warning message being displayed (we should really just remove the code) */
2934 static int icache_warning
= 1;
2935 static int dcache_warning
= 1;
2937 static int icache_warning
= 0;
2938 static int dcache_warning
= 0;
2941 /* If CP0 is not useable (User or Supervisor mode) and the CP0
2942 enable bit in the Status Register is clear - a coprocessor
2943 unusable exception is taken. */
2945 callback
->printf_filtered(callback
,"TODO: Cache availability checking (PC = 0x%s)\n",pr_addr(IPC
));
2949 case 0: /* instruction cache */
2951 case 0: /* Index Invalidate */
2952 case 1: /* Index Load Tag */
2953 case 2: /* Index Store Tag */
2954 case 4: /* Hit Invalidate */
2956 case 6: /* Hit Writeback */
2957 if (!icache_warning
)
2959 sim_warning("Instruction CACHE operation %d to be coded",(op
>> 2));
2965 SignalException(ReservedInstruction
,instruction
);
2970 case 1: /* data cache */
2972 case 0: /* Index Writeback Invalidate */
2973 case 1: /* Index Load Tag */
2974 case 2: /* Index Store Tag */
2975 case 3: /* Create Dirty */
2976 case 4: /* Hit Invalidate */
2977 case 5: /* Hit Writeback Invalidate */
2978 case 6: /* Hit Writeback */
2979 if (!dcache_warning
)
2981 sim_warning("Data CACHE operation %d to be coded",(op
>> 2));
2987 SignalException(ReservedInstruction
,instruction
);
2992 default: /* unrecognised cache ID */
2993 SignalException(ReservedInstruction
,instruction
);
3000 /*-- FPU support routines ---------------------------------------------------*/
3002 #if defined(HASFPU) /* Only needed when building FPU aware simulators */
3005 #define SizeFGR() (GPRLEN)
3007 /* They depend on the CPU being simulated */
3008 #define SizeFGR() ((PROCESSOR_64BIT && ((SR & status_FR) == 1)) ? 64 : 32)
3011 /* Numbers are held in normalized form. The SINGLE and DOUBLE binary
3012 formats conform to ANSI/IEEE Std 754-1985. */
3013 /* SINGLE precision floating:
3014 * seeeeeeeefffffffffffffffffffffff
3016 * e = 8bits = exponent
3017 * f = 23bits = fraction
3019 /* SINGLE precision fixed:
3020 * siiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
3022 * i = 31bits = integer
3024 /* DOUBLE precision floating:
3025 * seeeeeeeeeeeffffffffffffffffffffffffffffffffffffffffffffffffffff
3027 * e = 11bits = exponent
3028 * f = 52bits = fraction
3030 /* DOUBLE precision fixed:
3031 * siiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
3033 * i = 63bits = integer
3036 /* Extract sign-bit: */
3037 #define FP_S_s(v) (((v) & ((unsigned)1 << 31)) ? 1 : 0)
3038 #define FP_D_s(v) (((v) & ((uword64)1 << 63)) ? 1 : 0)
3039 /* Extract biased exponent: */
3040 #define FP_S_be(v) (((v) >> 23) & 0xFF)
3041 #define FP_D_be(v) (((v) >> 52) & 0x7FF)
3042 /* Extract unbiased Exponent: */
3043 #define FP_S_e(v) (FP_S_be(v) - 0x7F)
3044 #define FP_D_e(v) (FP_D_be(v) - 0x3FF)
3045 /* Extract complete fraction field: */
3046 #define FP_S_f(v) ((v) & ~((unsigned)0x1FF << 23))
3047 #define FP_D_f(v) ((v) & ~((uword64)0xFFF << 52))
3048 /* Extract numbered fraction bit: */
3049 #define FP_S_fb(b,v) (((v) & (1 << (23 - (b)))) ? 1 : 0)
3050 #define FP_D_fb(b,v) (((v) & (1 << (52 - (b)))) ? 1 : 0)
3052 /* Explicit QNaN values used when value required: */
3053 #define FPQNaN_SINGLE (0x7FBFFFFF)
3054 #define FPQNaN_WORD (0x7FFFFFFF)
3055 #define FPQNaN_DOUBLE (((uword64)0x7FF7FFFF << 32) | 0xFFFFFFFF)
3056 #define FPQNaN_LONG (((uword64)0x7FFFFFFF << 32) | 0xFFFFFFFF)
3058 /* Explicit Infinity values used when required: */
3059 #define FPINF_SINGLE (0x7F800000)
3060 #define FPINF_DOUBLE (((uword64)0x7FF00000 << 32) | 0x00000000)
3062 #if 1 /* def DEBUG */
3063 #define RMMODE(v) (((v) == FP_RM_NEAREST) ? "Round" : (((v) == FP_RM_TOZERO) ? "Trunc" : (((v) == FP_RM_TOPINF) ? "Ceil" : "Floor")))
3064 #define DOFMT(v) (((v) == fmt_single) ? "single" : (((v) == fmt_double) ? "double" : (((v) == fmt_word) ? "word" : (((v) == fmt_long) ? "long" : (((v) == fmt_unknown) ? "<unknown>" : (((v) == fmt_uninterpreted) ? "<uninterpreted>" : "<format error>"))))))
3075 /* Treat unused register values, as fixed-point 64bit values: */
3076 if ((fmt
== fmt_uninterpreted
) || (fmt
== fmt_unknown
))
3078 /* If request to read data as "uninterpreted", then use the current
3080 fmt
= fpr_state
[fpr
];
3085 /* For values not yet accessed, set to the desired format: */
3086 if (fpr_state
[fpr
] == fmt_uninterpreted
) {
3087 fpr_state
[fpr
] = fmt
;
3089 printf("DBG: Register %d was fmt_uninterpreted. Now %s\n",fpr
,DOFMT(fmt
));
3092 if (fmt
!= fpr_state
[fpr
]) {
3093 sim_warning("FPR %d (format %s) being accessed with format %s - setting to unknown (PC = 0x%s)",fpr
,DOFMT(fpr_state
[fpr
]),DOFMT(fmt
),pr_addr(IPC
));
3094 fpr_state
[fpr
] = fmt_unknown
;
3097 if (fpr_state
[fpr
] == fmt_unknown
) {
3098 /* Set QNaN value: */
3101 value
= FPQNaN_SINGLE
;
3105 value
= FPQNaN_DOUBLE
;
3109 value
= FPQNaN_WORD
;
3113 value
= FPQNaN_LONG
;
3120 } else if (SizeFGR() == 64) {
3124 value
= (FGR
[fpr
] & 0xFFFFFFFF);
3127 case fmt_uninterpreted
:
3141 value
= (FGR
[fpr
] & 0xFFFFFFFF);
3144 case fmt_uninterpreted
:
3147 if ((fpr
& 1) == 0) { /* even registers only */
3148 value
= ((((uword64
)FGR
[fpr
+1]) << 32) | (FGR
[fpr
] & 0xFFFFFFFF));
3150 SignalException (ReservedInstruction
, 0);
3161 SignalException(SimulatorFault
,"Unrecognised FP format in ValueFPR()");
3164 printf("DBG: ValueFPR: fpr = %d, fmt = %s, value = 0x%s : PC = 0x%s : SizeFGR() = %d\n",fpr
,DOFMT(fmt
),pr_addr(value
),pr_addr(IPC
),SizeFGR());
3171 StoreFPR(fpr
,fmt
,value
)
3179 printf("DBG: StoreFPR: fpr = %d, fmt = %s, value = 0x%s : PC = 0x%s : SizeFGR() = %d\n",fpr
,DOFMT(fmt
),pr_addr(value
),pr_addr(IPC
),SizeFGR());
3182 if (SizeFGR() == 64) {
3186 FGR
[fpr
] = (((uword64
)0xDEADC0DE << 32) | (value
& 0xFFFFFFFF));
3187 fpr_state
[fpr
] = fmt
;
3190 case fmt_uninterpreted
:
3194 fpr_state
[fpr
] = fmt
;
3198 fpr_state
[fpr
] = fmt_unknown
;
3206 FGR
[fpr
] = (value
& 0xFFFFFFFF);
3207 fpr_state
[fpr
] = fmt
;
3210 case fmt_uninterpreted
:
3213 if ((fpr
& 1) == 0) { /* even register number only */
3214 FGR
[fpr
+1] = (value
>> 32);
3215 FGR
[fpr
] = (value
& 0xFFFFFFFF);
3216 fpr_state
[fpr
+ 1] = fmt
;
3217 fpr_state
[fpr
] = fmt
;
3219 fpr_state
[fpr
] = fmt_unknown
;
3220 fpr_state
[fpr
+ 1] = fmt_unknown
;
3221 SignalException (ReservedInstruction
, 0);
3226 fpr_state
[fpr
] = fmt_unknown
;
3231 #if defined(WARN_RESULT)
3234 #endif /* WARN_RESULT */
3237 SignalException(SimulatorFault
,"Unrecognised FP format in StoreFPR()");
3240 printf("DBG: StoreFPR: fpr[%d] = 0x%s (format %s)\n",fpr
,pr_addr(FGR
[fpr
]),DOFMT(fmt
));
3253 /* Check if (((E - bias) == (E_max + 1)) && (fraction != 0)). We
3254 know that the exponent field is biased... we we cheat and avoid
3255 removing the bias value. */
3258 boolean
= ((FP_S_be(op
) == 0xFF) && (FP_S_f(op
) != 0));
3259 /* We could use "FP_S_fb(1,op)" to ascertain whether we are
3260 dealing with a SNaN or QNaN */
3263 boolean
= ((FP_D_be(op
) == 0x7FF) && (FP_D_f(op
) != 0));
3264 /* We could use "FP_S_fb(1,op)" to ascertain whether we are
3265 dealing with a SNaN or QNaN */
3268 boolean
= (op
== FPQNaN_WORD
);
3271 boolean
= (op
== FPQNaN_LONG
);
3274 fprintf (stderr
, "Bad switch\n");
3279 printf("DBG: NaN: returning %d for 0x%s (format = %s)\n",boolean
,pr_addr(op
),DOFMT(fmt
));
3293 printf("DBG: Infinity: format %s 0x%s (PC = 0x%s)\n",DOFMT(fmt
),pr_addr(op
),pr_addr(IPC
));
3296 /* Check if (((E - bias) == (E_max + 1)) && (fraction == 0)). We
3297 know that the exponent field is biased... we we cheat and avoid
3298 removing the bias value. */
3301 boolean
= ((FP_S_be(op
) == 0xFF) && (FP_S_f(op
) == 0));
3304 boolean
= ((FP_D_be(op
) == 0x7FF) && (FP_D_f(op
) == 0));
3307 printf("DBG: TODO: unrecognised format (%s) for Infinity check\n",DOFMT(fmt
));
3312 printf("DBG: Infinity: returning %d for 0x%s (format = %s)\n",boolean
,pr_addr(op
),DOFMT(fmt
));
3326 /* Argument checking already performed by the FPCOMPARE code */
3329 printf("DBG: Less: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
3332 /* The format type should already have been checked: */
3336 unsigned int wop1
= (unsigned int)op1
;
3337 unsigned int wop2
= (unsigned int)op2
;
3338 boolean
= (*(float *)&wop1
< *(float *)&wop2
);
3342 boolean
= (*(double *)&op1
< *(double *)&op2
);
3345 fprintf (stderr
, "Bad switch\n");
3350 printf("DBG: Less: returning %d (format = %s)\n",boolean
,DOFMT(fmt
));
3364 /* Argument checking already performed by the FPCOMPARE code */
3367 printf("DBG: Equal: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
3370 /* The format type should already have been checked: */
3373 boolean
= ((op1
& 0xFFFFFFFF) == (op2
& 0xFFFFFFFF));
3376 boolean
= (op1
== op2
);
3379 fprintf (stderr
, "Bad switch\n");
3384 printf("DBG: Equal: returning %d (format = %s)\n",boolean
,DOFMT(fmt
));
3391 AbsoluteValue(op
,fmt
)
3398 printf("DBG: AbsoluteValue: %s: op = 0x%s\n",DOFMT(fmt
),pr_addr(op
));
3401 /* The format type should already have been checked: */
3405 unsigned int wop
= (unsigned int)op
;
3406 float tmp
= ((float)fabs((double)*(float *)&wop
));
3407 result
= (uword64
)*(unsigned int *)&tmp
;
3412 double tmp
= (fabs(*(double *)&op
));
3413 result
= *(uword64
*)&tmp
;
3416 fprintf (stderr
, "Bad switch\n");
3431 printf("DBG: Negate: %s: op = 0x%s\n",DOFMT(fmt
),pr_addr(op
));
3434 /* The format type should already have been checked: */
3438 unsigned int wop
= (unsigned int)op
;
3439 float tmp
= ((float)0.0 - *(float *)&wop
);
3440 result
= (uword64
)*(unsigned int *)&tmp
;
3445 double tmp
= ((double)0.0 - *(double *)&op
);
3446 result
= *(uword64
*)&tmp
;
3450 fprintf (stderr
, "Bad switch\n");
3466 printf("DBG: Add: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
3469 /* The registers must specify FPRs valid for operands of type
3470 "fmt". If they are not valid, the result is undefined. */
3472 /* The format type should already have been checked: */
3476 unsigned int wop1
= (unsigned int)op1
;
3477 unsigned int wop2
= (unsigned int)op2
;
3478 float tmp
= (*(float *)&wop1
+ *(float *)&wop2
);
3479 result
= (uword64
)*(unsigned int *)&tmp
;
3484 double tmp
= (*(double *)&op1
+ *(double *)&op2
);
3485 result
= *(uword64
*)&tmp
;
3489 fprintf (stderr
, "Bad switch\n");
3494 printf("DBG: Add: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
3509 printf("DBG: Sub: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
3512 /* The registers must specify FPRs valid for operands of type
3513 "fmt". If they are not valid, the result is undefined. */
3515 /* The format type should already have been checked: */
3519 unsigned int wop1
= (unsigned int)op1
;
3520 unsigned int wop2
= (unsigned int)op2
;
3521 float tmp
= (*(float *)&wop1
- *(float *)&wop2
);
3522 result
= (uword64
)*(unsigned int *)&tmp
;
3527 double tmp
= (*(double *)&op1
- *(double *)&op2
);
3528 result
= *(uword64
*)&tmp
;
3532 fprintf (stderr
, "Bad switch\n");
3537 printf("DBG: Sub: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
3544 Multiply(op1
,op2
,fmt
)
3552 printf("DBG: Multiply: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
3555 /* The registers must specify FPRs valid for operands of type
3556 "fmt". If they are not valid, the result is undefined. */
3558 /* The format type should already have been checked: */
3562 unsigned int wop1
= (unsigned int)op1
;
3563 unsigned int wop2
= (unsigned int)op2
;
3564 float tmp
= (*(float *)&wop1
* *(float *)&wop2
);
3565 result
= (uword64
)*(unsigned int *)&tmp
;
3570 double tmp
= (*(double *)&op1
* *(double *)&op2
);
3571 result
= *(uword64
*)&tmp
;
3575 fprintf (stderr
, "Bad switch\n");
3580 printf("DBG: Multiply: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
3595 printf("DBG: Divide: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
3598 /* The registers must specify FPRs valid for operands of type
3599 "fmt". If they are not valid, the result is undefined. */
3601 /* The format type should already have been checked: */
3605 unsigned int wop1
= (unsigned int)op1
;
3606 unsigned int wop2
= (unsigned int)op2
;
3607 float tmp
= (*(float *)&wop1
/ *(float *)&wop2
);
3608 result
= (uword64
)*(unsigned int *)&tmp
;
3613 double tmp
= (*(double *)&op1
/ *(double *)&op2
);
3614 result
= *(uword64
*)&tmp
;
3618 fprintf (stderr
, "Bad switch\n");
3623 printf("DBG: Divide: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
3629 static uword64 UNUSED
3637 printf("DBG: Recip: %s: op = 0x%s\n",DOFMT(fmt
),pr_addr(op
));
3640 /* The registers must specify FPRs valid for operands of type
3641 "fmt". If they are not valid, the result is undefined. */
3643 /* The format type should already have been checked: */
3647 unsigned int wop
= (unsigned int)op
;
3648 float tmp
= ((float)1.0 / *(float *)&wop
);
3649 result
= (uword64
)*(unsigned int *)&tmp
;
3654 double tmp
= ((double)1.0 / *(double *)&op
);
3655 result
= *(uword64
*)&tmp
;
3659 fprintf (stderr
, "Bad switch\n");
3664 printf("DBG: Recip: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
3678 printf("DBG: SquareRoot: %s: op = 0x%s\n",DOFMT(fmt
),pr_addr(op
));
3681 /* The registers must specify FPRs valid for operands of type
3682 "fmt". If they are not valid, the result is undefined. */
3684 /* The format type should already have been checked: */
3688 unsigned int wop
= (unsigned int)op
;
3690 float tmp
= ((float)sqrt((double)*(float *)&wop
));
3691 result
= (uword64
)*(unsigned int *)&tmp
;
3693 /* TODO: Provide square-root */
3694 result
= (uword64
)0;
3701 double tmp
= (sqrt(*(double *)&op
));
3702 result
= *(uword64
*)&tmp
;
3704 /* TODO: Provide square-root */
3705 result
= (uword64
)0;
3710 fprintf (stderr
, "Bad switch\n");
3715 printf("DBG: SquareRoot: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
3722 Convert(rm
,op
,from
,to
)
3731 printf("DBG: Convert: mode %s : op 0x%s : from %s : to %s : (PC = 0x%s)\n",RMMODE(rm
),pr_addr(op
),DOFMT(from
),DOFMT(to
),pr_addr(IPC
));
3734 /* The value "op" is converted to the destination format, rounding
3735 using mode "rm". When the destination is a fixed-point format,
3736 then a source value of Infinity, NaN or one which would round to
3737 an integer outside the fixed point range then an IEEE Invalid
3738 Operation condition is raised. */
3745 tmp
= (float)(*(double *)&op
);
3749 tmp
= (float)((int)(op
& 0xFFFFFFFF));
3753 tmp
= (float)((word64
)op
);
3756 fprintf (stderr
, "Bad switch\n");
3761 /* FIXME: This code is incorrect. The rounding mode does not
3762 round to integral values; it rounds to the nearest
3763 representable value in the format. */
3767 /* Round result to nearest representable value. When two
3768 representable values are equally near, round to the value
3769 that has a least significant bit of zero (i.e. is even). */
3771 tmp
= (float)anint((double)tmp
);
3773 /* TODO: Provide round-to-nearest */
3778 /* Round result to the value closest to, and not greater in
3779 magnitude than, the result. */
3781 tmp
= (float)aint((double)tmp
);
3783 /* TODO: Provide round-to-zero */
3788 /* Round result to the value closest to, and not less than,
3790 tmp
= (float)ceil((double)tmp
);
3794 /* Round result to the value closest to, and not greater than,
3796 tmp
= (float)floor((double)tmp
);
3801 result
= (uword64
)*(unsigned int *)&tmp
;
3813 unsigned int wop
= (unsigned int)op
;
3814 tmp
= (double)(*(float *)&wop
);
3819 xxx
= SIGNEXTEND((op
& 0xFFFFFFFF),32);
3824 tmp
= (double)((word64
)op
);
3828 fprintf (stderr
, "Bad switch\n");
3833 /* FIXME: This code is incorrect. The rounding mode does not
3834 round to integral values; it rounds to the nearest
3835 representable value in the format. */
3840 tmp
= anint(*(double *)&tmp
);
3842 /* TODO: Provide round-to-nearest */
3848 tmp
= aint(*(double *)&tmp
);
3850 /* TODO: Provide round-to-zero */
3855 tmp
= ceil(*(double *)&tmp
);
3859 tmp
= floor(*(double *)&tmp
);
3864 result
= *(uword64
*)&tmp
;
3870 if (Infinity(op
,from
) || NaN(op
,from
) || (1 == 0/*TODO: check range */)) {
3871 printf("DBG: TODO: update FCSR\n");
3872 SignalException(FPE
);
3874 if (to
== fmt_word
) {
3879 unsigned int wop
= (unsigned int)op
;
3880 tmp
= (int)*((float *)&wop
);
3884 tmp
= (int)*((double *)&op
);
3886 printf("DBG: from double %.30f (0x%s) to word: 0x%08X\n",*((double *)&op
),pr_addr(op
),tmp
);
3890 fprintf (stderr
, "Bad switch\n");
3893 result
= (uword64
)tmp
;
3894 } else { /* fmt_long */
3899 unsigned int wop
= (unsigned int)op
;
3900 tmp
= (word64
)*((float *)&wop
);
3904 tmp
= (word64
)*((double *)&op
);
3907 fprintf (stderr
, "Bad switch\n");
3910 result
= (uword64
)tmp
;
3915 fprintf (stderr
, "Bad switch\n");
3920 printf("DBG: Convert: returning 0x%s (to format = %s)\n",pr_addr(result
),DOFMT(to
));
3927 /*-- co-processor support routines ------------------------------------------*/
3930 CoProcPresent(coproc_number
)
3931 unsigned int coproc_number
;
3933 /* Return TRUE if simulator provides a model for the given co-processor number */
3938 COP_LW(coproc_num
,coproc_reg
,memword
)
3939 int coproc_num
, coproc_reg
;
3940 unsigned int memword
;
3942 switch (coproc_num
) {
3946 printf("DBG: COP_LW: memword = 0x%08X (uword64)memword = 0x%s\n",memword
,pr_addr(memword
));
3948 StoreFPR(coproc_reg
,fmt_word
,(uword64
)memword
);
3949 fpr_state
[coproc_reg
] = fmt_uninterpreted
;
3954 #if 0 /* this should be controlled by a configuration option */
3955 callback
->printf_filtered(callback
,"COP_LW(%d,%d,0x%08X) at IPC = 0x%s : TODO (architecture specific)\n",coproc_num
,coproc_reg
,memword
,pr_addr(IPC
));
3964 COP_LD(coproc_num
,coproc_reg
,memword
)
3965 int coproc_num
, coproc_reg
;
3968 switch (coproc_num
) {
3971 StoreFPR(coproc_reg
,fmt_uninterpreted
,memword
);
3976 #if 0 /* this message should be controlled by a configuration option */
3977 callback
->printf_filtered(callback
,"COP_LD(%d,%d,0x%s) at IPC = 0x%s : TODO (architecture specific)\n",coproc_num
,coproc_reg
,pr_addr(memword
),pr_addr(IPC
));
3986 COP_SW(coproc_num
,coproc_reg
)
3987 int coproc_num
, coproc_reg
;
3989 unsigned int value
= 0;
3992 switch (coproc_num
) {
3996 hold
= fpr_state
[coproc_reg
];
3997 fpr_state
[coproc_reg
] = fmt_word
;
3998 value
= (unsigned int)ValueFPR(coproc_reg
,fmt_uninterpreted
);
3999 fpr_state
[coproc_reg
] = hold
;
4002 value
= (unsigned int)ValueFPR(coproc_reg
,fpr_state
[coproc_reg
]);
4005 printf("DBG: COP_SW: reg in format %s (will be accessing as single)\n",DOFMT(fpr_state
[coproc_reg
]));
4007 value
= (unsigned int)ValueFPR(coproc_reg
,fmt_single
);
4014 #if 0 /* should be controlled by configuration option */
4015 callback
->printf_filtered(callback
,"COP_SW(%d,%d) at IPC = 0x%s : TODO (architecture specific)\n",coproc_num
,coproc_reg
,pr_addr(IPC
));
4024 COP_SD(coproc_num
,coproc_reg
)
4025 int coproc_num
, coproc_reg
;
4028 switch (coproc_num
) {
4032 value
= ValueFPR(coproc_reg
,fmt_uninterpreted
);
4035 value
= ValueFPR(coproc_reg
,fpr_state
[coproc_reg
]);
4038 printf("DBG: COP_SD: reg in format %s (will be accessing as double)\n",DOFMT(fpr_state
[coproc_reg
]));
4040 value
= ValueFPR(coproc_reg
,fmt_double
);
4047 #if 0 /* should be controlled by configuration option */
4048 callback
->printf_filtered(callback
,"COP_SD(%d,%d) at IPC = 0x%s : TODO (architecture specific)\n",coproc_num
,coproc_reg
,pr_addr(IPC
));
4057 decode_coproc(instruction
)
4058 unsigned int instruction
;
4060 int coprocnum
= ((instruction
>> 26) & 3);
4064 case 0: /* standard CPU control and cache registers */
4066 int code
= ((instruction
>> 21) & 0x1F);
4067 /* R4000 Users Manual (second edition) lists the following CP0
4069 DMFC0 Doubleword Move From CP0 (VR4100 = 01000000001tttttddddd00000000000)
4070 DMTC0 Doubleword Move To CP0 (VR4100 = 01000000101tttttddddd00000000000)
4071 MFC0 word Move From CP0 (VR4100 = 01000000000tttttddddd00000000000)
4072 MTC0 word Move To CP0 (VR4100 = 01000000100tttttddddd00000000000)
4073 TLBR Read Indexed TLB Entry (VR4100 = 01000010000000000000000000000001)
4074 TLBWI Write Indexed TLB Entry (VR4100 = 01000010000000000000000000000010)
4075 TLBWR Write Random TLB Entry (VR4100 = 01000010000000000000000000000110)
4076 TLBP Probe TLB for Matching Entry (VR4100 = 01000010000000000000000000001000)
4077 CACHE Cache operation (VR4100 = 101111bbbbbpppppiiiiiiiiiiiiiiii)
4078 ERET Exception return (VR4100 = 01000010000000000000000000011000)
4080 if (((code
== 0x00) || (code
== 0x04)) && ((instruction
& 0x7FF) == 0))
4082 int rt
= ((instruction
>> 16) & 0x1F);
4083 int rd
= ((instruction
>> 11) & 0x1F);
4085 switch (rd
) /* NOTEs: Standard CP0 registers */
4087 /* 0 = Index R4000 VR4100 VR4300 */
4088 /* 1 = Random R4000 VR4100 VR4300 */
4089 /* 2 = EntryLo0 R4000 VR4100 VR4300 */
4090 /* 3 = EntryLo1 R4000 VR4100 VR4300 */
4091 /* 4 = Context R4000 VR4100 VR4300 */
4092 /* 5 = PageMask R4000 VR4100 VR4300 */
4093 /* 6 = Wired R4000 VR4100 VR4300 */
4094 /* 8 = BadVAddr R4000 VR4100 VR4300 */
4095 /* 9 = Count R4000 VR4100 VR4300 */
4096 /* 10 = EntryHi R4000 VR4100 VR4300 */
4097 /* 11 = Compare R4000 VR4100 VR4300 */
4098 /* 12 = SR R4000 VR4100 VR4300 */
4105 /* 13 = Cause R4000 VR4100 VR4300 */
4112 /* 14 = EPC R4000 VR4100 VR4300 */
4113 /* 15 = PRId R4000 VR4100 VR4300 */
4114 /* 16 = Config R4000 VR4100 VR4300 */
4115 /* 17 = LLAddr R4000 VR4100 VR4300 */
4116 /* 18 = WatchLo R4000 VR4100 VR4300 */
4117 /* 19 = WatchHi R4000 VR4100 VR4300 */
4118 /* 20 = XContext R4000 VR4100 VR4300 */
4119 /* 26 = PErr or ECC R4000 VR4100 VR4300 */
4120 /* 27 = CacheErr R4000 VR4100 */
4121 /* 28 = TagLo R4000 VR4100 VR4300 */
4122 /* 29 = TagHi R4000 VR4100 VR4300 */
4123 /* 30 = ErrorEPC R4000 VR4100 VR4300 */
4124 GPR
[rt
] = 0xDEADC0DE; /* CPR[0,rd] */
4125 /* CPR[0,rd] = GPR[rt]; */
4128 callback
->printf_filtered(callback
,"Warning: MFC0 %d,%d ignored (architecture specific)\n",rt
,rd
);
4130 callback
->printf_filtered(callback
,"Warning: MTC0 %d,%d ignored (architecture specific)\n",rt
,rd
);
4133 else if (code
== 0x10 && (instruction
& 0x3f) == 0x18)
4136 if (SR
& status_ERL
)
4138 /* Oops, not yet available */
4139 callback
->printf_filtered(callback
,"Warning: ERET when SR[ERL] set not handled yet");
4150 sim_warning("Unrecognised COP0 instruction 0x%08X at IPC = 0x%s : No handler present",instruction
,pr_addr(IPC
));
4151 /* TODO: When executing an ERET or RFE instruction we should
4152 clear LLBIT, to ensure that any out-standing atomic
4153 read/modify/write sequence fails. */
4157 case 2: /* undefined co-processor */
4158 sim_warning("COP2 instruction 0x%08X at IPC = 0x%s : No handler present",instruction
,pr_addr(IPC
));
4161 case 1: /* should not occur (FPU co-processor) */
4162 case 3: /* should not occur (FPU co-processor) */
4163 SignalException(ReservedInstruction
,instruction
);
4170 /*-- instruction simulation -------------------------------------------------*/
4173 sim_engine_run (sd
, next_cpu_nr
, siggnal
)
4175 int next_cpu_nr
; /* ignore */
4176 int siggnal
; /* ignore */
4178 #if !defined(FASTSIM)
4179 unsigned int pipeline_count
= 1;
4183 if (STATE_MEMORY (sd
) == NULL
) {
4184 printf("DBG: simulate() entered with no memory\n");
4189 #if 0 /* Disabled to check that everything works OK */
4190 /* The VR4300 seems to sign-extend the PC on its first
4191 access. However, this may just be because it is currently
4192 configured in 32bit mode. However... */
4193 PC
= SIGNEXTEND(PC
,32);
4196 /* main controlling loop */
4198 /* Fetch the next instruction from the simulator memory: */
4199 uword64 vaddr
= (uword64
)PC
;
4202 unsigned int instruction
; /* uword64? what's this used for? FIXME! */
4203 int dsstate
= (state
& simDELAYSLOT
);
4207 printf("DBG: state = 0x%08X :",state
);
4209 if (state
& simSTOP
) printf(" simSTOP");
4210 if (state
& simSTEP
) printf(" simSTEP");
4212 if (state
& simHALTEX
) printf(" simHALTEX");
4213 if (state
& simHALTIN
) printf(" simHALTIN");
4215 if (state
& simBE
) printf(" simBE");
4223 callback
->printf_filtered(callback
,"DBG: DSPC = 0x%s\n",pr_addr(DSPC
));
4226 if (AddressTranslation(PC
,isINSTRUCTION
,isLOAD
,&paddr
,&cca
,isTARGET
,isREAL
)) {
4227 if ((vaddr
& 1) == 0) {
4228 /* Copy the action of the LW instruction */
4229 unsigned int reverse
= (ReverseEndian
? (LOADDRMASK
>> 2) : 0);
4230 unsigned int bigend
= (BigEndianCPU
? (LOADDRMASK
>> 2) : 0);
4233 paddr
= ((paddr
& ~LOADDRMASK
) | ((paddr
& LOADDRMASK
) ^ (reverse
<< 2)));
4234 LoadMemory(&value
,NULL
,cca
,AccessLength_WORD
,paddr
,vaddr
,isINSTRUCTION
,isREAL
);
4235 byte
= ((vaddr
& LOADDRMASK
) ^ (bigend
<< 2));
4236 instruction
= ((value
>> (8 * byte
)) & 0xFFFFFFFF);
4238 /* Copy the action of the LH instruction */
4239 unsigned int reverse
= (ReverseEndian
? (LOADDRMASK
>> 1) : 0);
4240 unsigned int bigend
= (BigEndianCPU
? (LOADDRMASK
>> 1) : 0);
4243 paddr
= (((paddr
& ~ (uword64
) 1) & ~LOADDRMASK
)
4244 | (((paddr
& ~ (uword64
) 1) & LOADDRMASK
) ^ (reverse
<< 1)));
4245 LoadMemory(&value
,NULL
,cca
, AccessLength_HALFWORD
,
4246 paddr
& ~ (uword64
) 1,
4247 vaddr
, isINSTRUCTION
, isREAL
);
4248 byte
= (((vaddr
&~ (uword64
) 1) & LOADDRMASK
) ^ (bigend
<< 1));
4249 instruction
= ((value
>> (8 * byte
)) & 0xFFFF);
4252 fprintf(stderr
,"Cannot translate address for PC = 0x%s failed\n",pr_addr(PC
));
4257 callback
->printf_filtered(callback
,"DBG: fetched 0x%08X from PC = 0x%s\n",instruction
,pr_addr(PC
));
4260 #if !defined(FASTSIM) || defined(PROFILE)
4261 instruction_fetches
++;
4262 /* Since we increment above, the value should only ever be zero if
4263 we have just overflowed: */
4264 if (instruction_fetches
== 0)
4265 instruction_fetch_overflow
++;
4266 #if defined(PROFILE)
4267 if ((state
& simPROFILE
) && ((instruction_fetches
% profile_frequency
) == 0) && profile_hist
) {
4268 unsigned n
= ((unsigned int)(PC
- profile_minpc
) >> (profile_shift
+ 2));
4269 if (n
< profile_nsamples
) {
4270 /* NOTE: The counts for the profiling bins are only 16bits wide */
4271 if (profile_hist
[n
] != USHRT_MAX
)
4272 (profile_hist
[n
])++;
4275 #endif /* PROFILE */
4276 #endif /* !FASTSIM && PROFILE */
4278 IPC
= PC
; /* copy PC for this instruction */
4279 /* This is required by exception processing, to ensure that we can
4280 cope with exceptions in the delay slots of branches that may
4281 already have changed the PC. */
4282 if ((vaddr
& 1) == 0)
4283 PC
+= 4; /* increment ready for the next fetch */
4286 /* NOTE: If we perform a delay slot change to the PC, this
4287 increment is not requuired. However, it would make the
4288 simulator more complicated to try and avoid this small hit. */
4290 /* Currently this code provides a simple model. For more
4291 complicated models we could perform exception status checks at
4292 this point, and set the simSTOP state as required. This could
4293 also include processing any hardware interrupts raised by any
4294 I/O model attached to the simulator context.
4296 Support for "asynchronous" I/O events within the simulated world
4297 could be providing by managing a counter, and calling a I/O
4298 specific handler when a particular threshold is reached. On most
4299 architectures a decrement and check for zero operation is
4300 usually quicker than an increment and compare. However, the
4301 process of managing a known value decrement to zero, is higher
4302 than the cost of using an explicit value UINT_MAX into the
4303 future. Which system is used will depend on how complicated the
4304 I/O model is, and how much it is likely to affect the simulator
4307 If events need to be scheduled further in the future than
4308 UINT_MAX event ticks, then the I/O model should just provide its
4309 own counter, triggered from the event system. */
4311 /* MIPS pipeline ticks. To allow for future support where the
4312 pipeline hit of individual instructions is known, this control
4313 loop manages a "pipeline_count" variable. It is initialised to
4314 1 (one), and will only be changed by the simulator engine when
4315 executing an instruction. If the engine does not have access to
4316 pipeline cycle count information then all instructions will be
4317 treated as using a single cycle. NOTE: A standard system is not
4318 provided by the default simulator because different MIPS
4319 architectures have different cycle counts for the same
4322 [NOTE: pipeline_count has been replaced the event queue] */
4325 /* Set previous flag, depending on current: */
4326 if (state
& simPCOC0
)
4330 /* and update the current value: */
4337 /* NOTE: For multi-context simulation environments the "instruction"
4338 variable should be local to this routine. */
4340 /* Shorthand accesses for engine. Note: If we wanted to use global
4341 variables (and a single-threaded simulator engine), then we can
4342 create the actual variables with these names. */
4344 if (!(state
& simSKIPNEXT
)) {
4345 /* Include the simulator engine */
4347 #if ((GPRLEN == 64) && !PROCESSOR_64BIT) || ((GPRLEN == 32) && PROCESSOR_64BIT)
4348 #error "Mismatch between run-time simulator code and simulation engine"
4351 #if defined(WARN_LOHI)
4352 /* Decrement the HI/LO validity ticks */
4361 #endif /* WARN_LOHI */
4363 /* For certain MIPS architectures, GPR[0] is hardwired to zero. We
4364 should check for it being changed. It is better doing it here,
4365 than within the simulator, since it will help keep the simulator
4368 #if defined(WARN_ZERO)
4369 sim_warning("The ZERO register has been updated with 0x%s (PC = 0x%s) (reset back to zero)",pr_addr(ZERO
),pr_addr(IPC
));
4370 #endif /* WARN_ZERO */
4371 ZERO
= 0; /* reset back to zero before next instruction */
4373 } else /* simSKIPNEXT check */
4374 state
&= ~simSKIPNEXT
;
4376 /* If the delay slot was active before the instruction is
4377 executed, then update the PC to its new value: */
4380 printf("DBG: dsstate set before instruction execution - updating PC to 0x%s\n",pr_addr(DSPC
));
4383 state
&= ~(simDELAYSLOT
| simJALDELAYSLOT
);
4386 if (MIPSISA
< 4) { /* The following is only required on pre MIPS IV processors: */
4387 /* Deal with pending register updates: */
4389 printf("DBG: EMPTY BEFORE pending_in = %d, pending_out = %d, pending_total = %d\n",pending_in
,pending_out
,pending_total
);
4391 if (pending_out
!= pending_in
) {
4393 int index
= pending_out
;
4394 int total
= pending_total
;
4395 if (pending_total
== 0) {
4396 fprintf(stderr
,"FATAL: Mis-match on pending update pointers\n");
4399 for (loop
= 0; (loop
< total
); loop
++) {
4401 printf("DBG: BEFORE index = %d, loop = %d\n",index
,loop
);
4403 if (pending_slot_reg
[index
] != (LAST_EMBED_REGNUM
+ 1)) {
4405 printf("pending_slot_count[%d] = %d\n",index
,pending_slot_count
[index
]);
4407 if (--(pending_slot_count
[index
]) == 0) {
4409 printf("pending_slot_reg[%d] = %d\n",index
,pending_slot_reg
[index
]);
4410 printf("pending_slot_value[%d] = 0x%s\n",index
,pr_addr(pending_slot_value
[index
]));
4412 if (pending_slot_reg
[index
] == COCIDX
) {
4413 SETFCC(0,((FCR31
& (1 << 23)) ? 1 : 0));
4415 registers
[pending_slot_reg
[index
]] = pending_slot_value
[index
];
4417 /* The only time we have PENDING updates to FPU
4418 registers, is when performing binary transfers. This
4419 means we should update the register type field. */
4420 if ((pending_slot_reg
[index
] >= FGRIDX
) && (pending_slot_reg
[index
] < (FGRIDX
+ 32)))
4421 fpr_state
[pending_slot_reg
[index
] - FGRIDX
] = fmt_uninterpreted
;
4425 printf("registers[%d] = 0x%s\n",pending_slot_reg
[index
],pr_addr(registers
[pending_slot_reg
[index
]]));
4427 pending_slot_reg
[index
] = (LAST_EMBED_REGNUM
+ 1);
4429 if (pending_out
== PSLOTS
)
4435 printf("DBG: AFTER index = %d, loop = %d\n",index
,loop
);
4438 if (index
== PSLOTS
)
4443 printf("DBG: EMPTY AFTER pending_in = %d, pending_out = %d, pending_total = %d\n",pending_in
,pending_out
,pending_total
);
4447 #if !defined(FASTSIM)
4448 if (sim_events_tickn (sd
, pipeline_count
))
4450 /* cpu->cia = cia; */
4451 sim_events_process (sd
);
4454 if (sim_events_tick (sd
))
4456 /* cpu->cia = cia; */
4457 sim_events_process (sd
);
4459 #endif /* FASTSIM */
4463 /* This code copied from gdb's utils.c. Would like to share this code,
4464 but don't know of a common place where both could get to it. */
4466 /* Temporary storage using circular buffer */
4472 static char buf
[NUMCELLS
][CELLSIZE
];
4474 if (++cell
>=NUMCELLS
) cell
=0;
4478 /* Print routines to handle variable size regs, etc */
4480 /* Eliminate warning from compiler on 32-bit systems */
4481 static int thirty_two
= 32;
4487 char *paddr_str
=get_cell();
4488 switch (sizeof(addr
))
4491 sprintf(paddr_str
,"%08lx%08lx",
4492 (unsigned long)(addr
>>thirty_two
),(unsigned long)(addr
&0xffffffff));
4495 sprintf(paddr_str
,"%08lx",(unsigned long)addr
);
4498 sprintf(paddr_str
,"%04x",(unsigned short)(addr
&0xffff));
4501 sprintf(paddr_str
,"%x",addr
);
4510 char *paddr_str
=get_cell();
4511 sprintf(paddr_str
,"%08lx%08lx",
4512 (unsigned long)(addr
>>thirty_two
),(unsigned long)(addr
&0xffffffff));
4517 /*---------------------------------------------------------------------------*/
4518 /*> EOF interp.c <*/