2 /* Simulator for the MIPS architecture.
4 This file is part of the MIPS sim
6 THIS SOFTWARE IS NOT COPYRIGHTED
8 Cygnus offers the following for use in the public domain. Cygnus
9 makes no warranty with regard to the software or it's performance
10 and the user accepts the software "AS IS" with all faults.
12 CYGNUS DISCLAIMS ANY WARRANTIES, EXPRESS OR IMPLIED, WITH REGARD TO
13 THIS SOFTWARE INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
14 MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22 We only need to take account of the target endianness when moving data
23 between the simulator and the host. We do not need to worry about the
24 endianness of the host, since this sim code and GDB are executing in
27 The IDT monitor (found on the VR4300 board), seems to lie about
28 register contents. It seems to treat the registers as sign-extended
29 32-bit values. This cause *REAL* problems when single-stepping 64-bit
34 /* The TRACE and PROFILE manifests enable the provision of extra
35 features. If they are not defined then a simpler (quicker)
36 simulator is constructed without the required run-time checks,
38 #if 1 /* 0 to allow user build selection, 1 to force inclusion */
64 #include "libiberty.h"
66 #include "callback.h" /* GDB simulator callback interface */
67 #include "remote-sim.h" /* GDB simulator interface */
69 #include "support.h" /* internal support manifests */
74 #define SIGBUS SIGSEGV
77 /* Get the simulator engine description, without including the code: */
82 /* This variable holds the GDB view of the target endianness: */
83 extern int target_byte_order
;
85 /* The following reserved instruction value is used when a simulator
86 trap is required. NOTE: Care must be taken, since this value may be
87 used in later revisions of the MIPS ISA. */
88 #define RSVD_INSTRUCTION (0x7C000000)
89 #define RSVD_INSTRUCTION_AMASK (0x03FFFFFF)
91 /* NOTE: These numbers depend on the processor architecture being
94 #define TLBModification (1)
97 #define AddressLoad (4)
98 #define AddressStore (5)
99 #define InstructionFetch (6)
100 #define DataReference (7)
101 #define SystemCall (8)
102 #define BreakPoint (9)
103 #define ReservedInstruction (10)
104 #define CoProcessorUnusable (11)
105 #define IntegerOverflow (12) /* Arithmetic overflow (IDT monitor raises SIGFPE) */
110 /* The following exception code is actually private to the simulator
111 world. It is *NOT* a processor feature, and is used to signal
112 run-time errors in the simulator. */
113 #define SimulatorFault (0xFFFFFFFF)
115 /* The following are generic to all versions of the MIPS architecture
117 /* Memory Access Types (for CCA): */
119 #define CachedNoncoherent (1)
120 #define CachedCoherent (2)
123 #define isINSTRUCTION (1 == 0) /* FALSE */
124 #define isDATA (1 == 1) /* TRUE */
126 #define isLOAD (1 == 0) /* FALSE */
127 #define isSTORE (1 == 1) /* TRUE */
129 #define isREAL (1 == 0) /* FALSE */
130 #define isRAW (1 == 1) /* TRUE */
132 #define isTARGET (1 == 0) /* FALSE */
133 #define isHOST (1 == 1) /* TRUE */
135 /* The "AccessLength" specifications for Loads and Stores. NOTE: This
136 is the number of bytes minus 1. */
137 #define AccessLength_BYTE (0)
138 #define AccessLength_HALFWORD (1)
139 #define AccessLength_TRIPLEBYTE (2)
140 #define AccessLength_WORD (3)
141 #define AccessLength_QUINTIBYTE (4)
142 #define AccessLength_SEXTIBYTE (5)
143 #define AccessLength_SEPTIBYTE (6)
144 #define AccessLength_DOUBLEWORD (7)
147 /* FPU registers must be one of the following types. All other values
148 are reserved (and undefined). */
154 /* The following are well outside the normal acceptable format
155 range, and are used in the register status vector. */
156 fmt_unknown
= 0x10000000,
157 fmt_uninterpreted
= 0x20000000,
161 /* NOTE: We cannot avoid globals, since the GDB "sim_" interface does
162 not allow a private variable to be passed around. This means that
163 simulators under GDB can only be single-threaded. However, it would
164 be possible for the simulators to be multi-threaded if GDB allowed
165 for a private pointer to be maintained. i.e. a general "void **ptr"
166 variable that GDB passed around in the argument list to all of
167 sim_xxx() routines. It could be initialised to NULL by GDB, and
168 then updated by sim_open() and used by the other sim_xxx() support
169 functions. This would allow new features in the simulator world,
170 like storing a context - continuing execution to gather a result,
171 and then going back to the point where the context was saved and
172 changing some state before continuing. i.e. the ability to perform
173 UNDOs on simulations. It would also allow the simulation of
174 shared-memory multi-processor systems. */
176 static host_callback
*callback
= NULL
; /* handle onto the current callback structure */
178 /* This is nasty, since we have to rely on matching the register
179 numbers used by GDB. Unfortunately, depending on the MIPS target
180 GDB uses different register numbers. We cannot just include the
181 relevant "gdb/tm.h" link, since GDB may not be configured before
182 the sim world, and also the GDB header file requires too much other
184 /* TODO: Sort out a scheme for *KNOWING* the mapping between real
185 registers, and the numbers that GDB uses. At the moment due to the
186 order that the tools are built, we cannot rely on a configured GDB
187 world whilst constructing the simulator. This means we have to
188 assume the GDB register number mapping. */
190 #define LAST_EMBED_REGNUM (89)
193 /* To keep this default simulator simple, and fast, we use a direct
194 vector of registers. The internal simulator engine then uses
195 manifests to access the correct slot. */
196 static ut_reg registers
[LAST_EMBED_REGNUM
+ 1];
197 static int register_widths
[LAST_EMBED_REGNUM
+ 1];
199 #define GPR (®isters[0])
202 #define FGR (®isters[FGRIDX])
204 #define LO (registers[33])
205 #define HI (registers[34])
206 #define PC (registers[37])
207 #define CAUSE (registers[36])
209 #define SR (registers[SRIDX]) /* CPU status register */
211 #define FCR0 (registers[FCR0IDX]) /* really a 32bit register */
212 #define FCR31IDX (70)
213 #define FCR31 (registers[FCR31IDX]) /* really a 32bit register */
215 #define COCIDX (LAST_EMBED_REGNUM + 2) /* special case : outside the normal range */
217 /* The following are pseudonyms for standard registers */
218 #define ZERO (registers[0])
219 #define V0 (registers[2])
220 #define A0 (registers[4])
221 #define A1 (registers[5])
222 #define A2 (registers[6])
223 #define A3 (registers[7])
224 #define SP (registers[29])
225 #define RA (registers[31])
227 static ut_reg EPC
= 0; /* Exception PC */
230 /* Keep the current format state for each register: */
231 static FP_formats fpr_state
[32];
234 /* The following are internal simulator state variables: */
235 static ut_reg IPC
= 0; /* internal Instruction PC */
236 static ut_reg DSPC
= 0; /* delay-slot PC */
239 /* TODO : these should be the bitmasks for these bits within the
240 status register. At the moment the following are VR4300
242 #define status_KSU_mask (0x3) /* mask for KSU bits */
243 #define status_KSU_shift (3) /* shift for field */
244 #define ksu_kernel (0x0)
245 #define ksu_supervisor (0x1)
246 #define ksu_user (0x2)
247 #define ksu_unknown (0x3)
249 #define status_RE (1 << 25) /* Reverse Endian in user mode */
250 #define status_FR (1 << 26) /* enables MIPS III additional FP registers */
251 #define status_SR (1 << 20) /* soft reset or NMI */
252 #define status_BEV (1 << 22) /* Location of general exception vectors */
253 #define status_TS (1 << 21) /* TLB shutdown has occurred */
254 #define status_ERL (1 << 2) /* Error level */
255 #define status_RP (1 << 27) /* Reduced Power mode */
257 #define cause_BD ((unsigned)1 << 31) /* Exception in branch delay slot */
260 /* Macro to update FPSR condition-code field. This is complicated by
261 the fact that there is a hole in the index range of the bits within
262 the FCSR register. Also, the number of bits visible depends on the
263 MIPS ISA version being supported. */
264 #define SETFCC(cc,v) {\
265 int bit = ((cc == 0) ? 23 : (24 + (cc)));\
266 FCSR = ((FCSR & ~(1 << bit)) | ((v) << bit));\
268 #define GETFCC(cc) (((((cc) == 0) ? (FCSR & (1 << 23)) : (FCSR & (1 << (24 + (cc))))) != 0) ? 1 : 0)
270 /* This should be the COC1 value at the start of the preceding
272 #define PREVCOC1() ((state & simPCOC1) ? 1 : 0)
275 /* Standard FCRS bits: */
276 #define IR (0) /* Inexact Result */
277 #define UF (1) /* UnderFlow */
278 #define OF (2) /* OverFlow */
279 #define DZ (3) /* Division by Zero */
280 #define IO (4) /* Invalid Operation */
281 #define UO (5) /* Unimplemented Operation */
283 /* Get masks for individual flags: */
284 #if 1 /* SAFE version */
285 #define FP_FLAGS(b) (((unsigned)(b) < 5) ? (1 << ((b) + 2)) : 0)
286 #define FP_ENABLE(b) (((unsigned)(b) < 5) ? (1 << ((b) + 7)) : 0)
287 #define FP_CAUSE(b) (((unsigned)(b) < 6) ? (1 << ((b) + 12)) : 0)
289 #define FP_FLAGS(b) (1 << ((b) + 2))
290 #define FP_ENABLE(b) (1 << ((b) + 7))
291 #define FP_CAUSE(b) (1 << ((b) + 12))
294 #define FP_FS (1 << 24) /* MIPS III onwards : Flush to Zero */
296 #define FP_MASK_RM (0x3)
298 #define FP_RM_NEAREST (0) /* Round to nearest (Round) */
299 #define FP_RM_TOZERO (1) /* Round to zero (Trunc) */
300 #define FP_RM_TOPINF (2) /* Round to Plus infinity (Ceil) */
301 #define FP_RM_TOMINF (3) /* Round to Minus infinity (Floor) */
302 #define GETRM() (int)((FCSR >> FP_SH_RM) & FP_MASK_RM)
304 /* Slots for delayed register updates. For the moment we just have a
305 fixed number of slots (rather than a more generic, dynamic
306 system). This keeps the simulator fast. However, we only allow for
307 the register update to be delayed for a single instruction
309 #define PSLOTS (5) /* Maximum number of instruction cycles */
310 static int pending_in
;
311 static int pending_out
;
312 static int pending_total
;
313 static int pending_slot_count
[PSLOTS
];
314 static int pending_slot_reg
[PSLOTS
];
315 static ut_reg pending_slot_value
[PSLOTS
];
317 /*---------------------------------------------------------------------------*/
318 /*-- GDB simulator interface ------------------------------------------------*/
319 /*---------------------------------------------------------------------------*/
321 static void dotrace
PARAMS((FILE *tracefh
,int type
,SIM_ADDR address
,int width
,char *comment
,...));
322 static void sim_warning
PARAMS((char *fmt
,...));
323 extern void sim_error
PARAMS((char *fmt
,...));
324 static void set_endianness
PARAMS((void));
325 static void ColdReset
PARAMS((void));
326 static int AddressTranslation
PARAMS((uword64 vAddr
,int IorD
,int LorS
,uword64
*pAddr
,int *CCA
,int host
,int raw
));
327 static void StoreMemory
PARAMS((int CCA
,int AccessLength
,uword64 MemElem
,uword64 pAddr
,uword64 vAddr
,int raw
));
328 static uword64 LoadMemory
PARAMS((int CCA
,int AccessLength
,uword64 pAddr
,uword64 vAddr
,int IorD
,int raw
));
329 static void SignalException
PARAMS((int exception
,...));
330 static void simulate
PARAMS((void));
331 static long getnum
PARAMS((char *value
));
332 extern void sim_size
PARAMS((unsigned int newsize
));
333 extern void sim_set_profile
PARAMS((int frequency
));
334 static unsigned int power2
PARAMS((unsigned int value
));
336 /*---------------------------------------------------------------------------*/
338 /* The following are not used for MIPS IV onwards: */
339 #define PENDING_FILL(r,v) {\
340 /* printf("DBG: FILL BEFORE pending_in = %d, pending_out = %d, pending_total = %d\n",pending_in,pending_out,pending_total); */\
341 if (pending_slot_reg[pending_in] != (LAST_EMBED_REGNUM + 1))\
342 sim_warning("Attempt to over-write pending value");\
343 pending_slot_count[pending_in] = 2;\
344 pending_slot_reg[pending_in] = (r);\
345 pending_slot_value[pending_in] = (uword64)(v);\
346 /*printf("DBG: FILL reg %d value = 0x%08X%08X\n",(r),WORD64HI(v),WORD64LO(v));*/\
349 if (pending_in == PSLOTS)\
351 /*printf("DBG: FILL AFTER pending_in = %d, pending_out = %d, pending_total = %d\n",pending_in,pending_out,pending_total);*/\
354 static int LLBIT
= 0;
355 /* LLBIT = Load-Linked bit. A bit of "virtual" state used by atomic
356 read-write instructions. It is set when a linked load occurs. It is
357 tested and cleared by the conditional store. It is cleared (during
358 other CPU operations) when a store to the location would no longer
359 be atomic. In particular, it is cleared by exception return
362 static int HIACCESS
= 0;
363 static int LOACCESS
= 0;
364 /* The HIACCESS and LOACCESS counts are used to ensure that
365 corruptions caused by using the HI or LO register to close to a
366 following operation are spotted. */
367 static ut_reg HLPC
= 0;
369 /* ??? The 4300 and a few other processors have interlocks on hi/lo register
370 reads, and hence do not have this problem. To avoid spurious warnings,
371 we just disable this always. */
375 /* If either of the preceding two instructions have accessed the HI or
376 LO registers, then the values they see should be
377 undefined. However, to keep the simulator world simple, we just let
378 them use the value read and raise a warning to notify the user: */
379 #define CHECKHILO(s) {\
380 if ((HIACCESS != 0) || (LOACCESS != 0))\
381 sim_warning("%s over-writing HI and LO registers values (PC = 0x%08X%08X HLPC = 0x%08X%08X)\n",(s),(unsigned int)(PC>>32),(unsigned int)(PC&0xFFFFFFFF),(unsigned int)(HLPC>>32),(unsigned int)(HLPC&0xFFFFFFFF));\
385 /* NOTE: We keep the following status flags as bit values (1 for true,
386 0 for false). This allows them to be used in binary boolean
387 operations without worrying about what exactly the non-zero true
391 #define UserMode ((((SR & status_KSU_mask) >> status_KSU_shift) == ksu_user) ? 1 : 0)
394 /* Hardware configuration. Affects endianness of LoadMemory and
395 StoreMemory and the endianness of Kernel and Supervisor mode
396 execution. The value is 0 for little-endian; 1 for big-endian. */
397 #define BigEndianMem ((state & simBE) ? 1 : 0)
400 /* This is true if the host and target have different endianness. */
401 #define ByteSwapMem (!(state & simHOSTBE) != !(state & simBE))
404 /* This mode is selected if in User mode with the RE bit being set in
405 SR (Status Register). It reverses the endianness of load and store
407 #define ReverseEndian (((SR & status_RE) && UserMode) ? 1 : 0)
410 /* The endianness for load and store instructions (0=little;1=big). In
411 User mode this endianness may be switched by setting the state_RE
412 bit in the SR register. Thus, BigEndianCPU may be computed as
413 (BigEndianMem EOR ReverseEndian). */
414 #define BigEndianCPU (BigEndianMem ^ ReverseEndian) /* Already bits */
416 #if !defined(FASTSIM) || defined(PROFILE)
417 /* At the moment these values will be the same, since we do not have
418 access to the pipeline cycle count information from the simulator
420 static unsigned int instruction_fetches
= 0;
421 static unsigned int instruction_fetch_overflow
= 0;
422 static unsigned int pipeline_ticks
= 0;
425 /* Flags in the "state" variable: */
426 #define simSTOP (1 << 0) /* 0 = execute; 1 = stop simulation */
427 #define simSTEP (1 << 1) /* 0 = run; 1 = single-step */
428 #define simHALTEX (1 << 2) /* 0 = run; 1 = halt on exception */
429 #define simHALTIN (1 << 3) /* 0 = run; 1 = halt on interrupt */
430 #define simTRACE (1 << 8) /* 0 = do nothing; 1 = trace address activity */
431 #define simPROFILE (1 << 9) /* 0 = do nothing; 1 = gather profiling samples */
432 #define simHOSTBE (1 << 10) /* 0 = little-endian; 1 = big-endian (host endianness) */
433 /* Whilst simSTOP is not set, the simulator control loop should just
434 keep simulating instructions. The simSTEP flag is used to force
435 single-step execution. */
436 #define simBE (1 << 16) /* 0 = little-endian; 1 = big-endian (target endianness) */
437 #define simPCOC0 (1 << 17) /* COC[1] from current */
438 #define simPCOC1 (1 << 18) /* COC[1] from previous */
439 #define simDELAYSLOT (1 << 24) /* 0 = do nothing; 1 = delay slot entry exists */
440 #define simSKIPNEXT (1 << 25) /* 0 = do nothing; 1 = skip instruction */
441 #define simEXCEPTION (1 << 26) /* 0 = no exception; 1 = exception has occurred */
442 #define simEXIT (1 << 27) /* 0 = do nothing; 1 = run-time exit() processing */
443 #define simSIGINT (1 << 28) /* 0 = do nothing; 1 = SIGINT has occured */
444 #define simJALDELAYSLOT (1 << 29) /* 1 = in jal delay slot */
446 static unsigned int state
= 0;
447 static unsigned int rcexit
= 0; /* _exit() reason code holder */
449 #define DELAYSLOT() {\
450 if (state & simDELAYSLOT)\
451 sim_warning("Delay slot already activated (branch in delay slot?)");\
452 state |= simDELAYSLOT;\
455 #define JALDELAYSLOT() {\
457 state |= simJALDELAYSLOT;\
461 state &= ~simDELAYSLOT;\
462 state |= simSKIPNEXT;\
465 #define INDELAYSLOT() ((state & simDELAYSLOT) != 0)
466 #define INJALDELAYSLOT() ((state & simJALDELAYSLOT) != 0)
468 #define K0BASE (0x80000000)
469 #define K0SIZE (0x20000000)
470 #define K1BASE (0xA0000000)
471 #define K1SIZE (0x20000000)
473 /* Very simple memory model to start with: */
474 static unsigned char *membank
= NULL
;
475 static ut_reg membank_base
= K1BASE
;
476 /* The ddb.ld linker script loads text at K1BASE+1MB, and the idt.ld linker
477 script loads text at K1BASE+128KB. We allocate 2MB, so that we have a
478 minimum of 1 MB available for the user process. We must have memory
479 above _end in order for sbrk to work. */
480 static unsigned membank_size
= (2 << 20);
482 /* Simple run-time monitor support */
483 static unsigned char *monitor
= NULL
;
484 static ut_reg monitor_base
= 0xBFC00000;
485 static unsigned monitor_size
= (1 << 11); /* power-of-2 */
487 static char *logfile
= NULL
; /* logging disabled by default */
488 static FILE *logfh
= NULL
;
491 static char *tracefile
= "trace.din"; /* default filename for trace log */
492 static FILE *tracefh
= NULL
;
493 static void open_trace
PARAMS((void));
497 static unsigned profile_frequency
= 256;
498 static unsigned profile_nsamples
= (128 << 10);
499 static unsigned short *profile_hist
= NULL
;
500 static ut_reg profile_minpc
;
501 static ut_reg profile_maxpc
;
502 static int profile_shift
= 0; /* address shift amount */
505 /* The following are used to provide shortcuts to the required version
506 of host<->target copying. This avoids run-time conditionals, which
507 would slow the simulator throughput. */
508 typedef unsigned int (*fnptr_read_word
) PARAMS((unsigned char *memory
));
509 typedef unsigned int (*fnptr_swap_word
) PARAMS((unsigned int data
));
510 typedef uword64 (*fnptr_read_long
) PARAMS((unsigned char *memory
));
511 typedef uword64 (*fnptr_swap_long
) PARAMS((uword64 data
));
513 static fnptr_read_word host_read_word
;
514 static fnptr_read_long host_read_long
;
515 static fnptr_swap_word host_swap_word
;
516 static fnptr_swap_long host_swap_long
;
518 /*---------------------------------------------------------------------------*/
519 /*-- GDB simulator interface ------------------------------------------------*/
520 /*---------------------------------------------------------------------------*/
526 if (callback
== NULL
) {
527 fprintf(stderr
,"SIM Error: sim_open() called without callbacks attached\n");
531 /* The following ensures that the standard file handles for stdin,
532 stdout and stderr are initialised: */
533 callback
->init(callback
);
537 if (state
& simEXCEPTION
) {
538 fprintf(stderr
,"This simulator is not suitable for this host configuration\n");
544 if (*((char *)&data
) != 0x12)
545 state
|= simHOSTBE
; /* big-endian host */
551 /* Check that the host FPU conforms to IEEE 754-1985 for the SINGLE
552 and DOUBLE binary formats. This is a bit nasty, requiring that we
553 trust the explicit manifests held in the source: */
556 s
[state
& simHOSTBE
? 0 : 1] = 0x40805A5A;
557 s
[state
& simHOSTBE
? 1 : 0] = 0x00000000;
559 /* TODO: We need to cope with the simulated target and the host
560 not having the same endianness. This will require the high and
561 low words of a (double) to be swapped when converting between
562 the host and the simulated target. */
564 if (((float)4.01102924346923828125 != *(float *)(s
+ ((state
& simHOSTBE
) ? 0 : 1))) || ((double)523.2939453125 != *(double *)s
)) {
565 fprintf(stderr
,"The host executing the simulator does not seem to have IEEE 754-1985 std FP\n");
566 fprintf(stderr
,"*(float *)s = %.20f (4.01102924346923828125)\n",*(float *)s
);
567 fprintf(stderr
,"*(double *)s = %.20f (523.2939453125)\n",*(double *)s
);
573 /* This is NASTY, in that we are assuming the size of specific
577 for (rn
= 0; (rn
< (LAST_EMBED_REGNUM
+ 1)); rn
++) {
579 register_widths
[rn
] = GPRLEN
;
580 else if ((rn
>= FGRIDX
) && (rn
< (FGRIDX
+ 32)))
581 register_widths
[rn
] = GPRLEN
;
582 else if ((rn
>= 33) && (rn
<= 37))
583 register_widths
[rn
] = GPRLEN
;
584 else if ((rn
== SRIDX
) || (rn
== FCR0IDX
) || (rn
== FCR31IDX
) || ((rn
>= 72) && (rn
<= 89)))
585 register_widths
[rn
] = 32;
587 register_widths
[rn
] = 0;
591 /* It would be good if we could select particular named MIPS
592 architecture simulators. However, having a pre-built, fixed
593 engine would mean including multiple engines. If the simulator is
594 changed to a run-time conditional version, then the ability to
595 select a particular architecture would be straightforward. */
601 static struct option cmdline
[] = {
605 {"profile", 0,0,'p'},
608 {"tracefile",1,0,'z'},
609 {"frequency",1,0,'y'},
610 {"samples", 1,0,'x'},
614 /* Unfortunately, getopt_long() is designed to be used with
615 vectors, where the first option is normally program name (and
616 ignored). We cheat by creating a dummy first argument, so that
617 we can use the standard argument processing. */
618 #define DUMMYARG "simulator "
619 cline
= (char *)malloc(strlen(args
) + strlen(DUMMYARG
) + 1);
621 fprintf(stderr
,"Failed to allocate memory for command line buffer\n");
624 sprintf(cline
,"%s%s",DUMMYARG
,args
);
625 argv
= buildargv(cline
);
626 for (argc
= 0; argv
[argc
]; argc
++);
628 /* Unfortunately, getopt_long() assumes that it is ignoring the
629 first argument (normally the program name). This means it
630 ignores the first option on our "args" line. */
631 optind
= 0; /* Force reset of argument processing */
633 int option_index
= 0;
635 c
= getopt_long(argc
,argv
,"hn:s:tp",cmdline
,&option_index
);
641 callback
->printf_filtered(callback
,"Usage:\n\t\
642 target sim [-h] [--log=<file>] [--name=<model>] [--size=<amount>]");
644 callback
->printf_filtered(callback
," [-t [--tracefile=<name>]]");
647 callback
->printf_filtered(callback
," [-p [--frequency=<count>] [--samples=<count>]]");
649 callback
->printf_filtered(callback
,"\n");
653 if (optarg
!= NULL
) {
655 tmp
= (char *)malloc(strlen(optarg
) + 1);
657 callback
->printf_filtered(callback
,"Failed to allocate buffer for logfile name \"%s\"\n",optarg
);
666 callback
->printf_filtered(callback
,"Explicit model selection not yet available (Ignoring \"%s\")\n",optarg
);
670 membank_size
= (unsigned)getnum(optarg
);
675 /* Eventually the simTRACE flag could be treated as a toggle, to
676 allow external control of the program points being traced
677 (i.e. only from main onwards, excluding the run-time setup,
682 Simulator constructed without tracing support (for performance).\n\
683 Re-compile simulator with \"-DTRACE\" to enable this option.\n");
689 if (optarg
!= NULL
) {
691 tmp
= (char *)malloc(strlen(optarg
) + 1);
693 callback
->printf_filtered(callback
,"Failed to allocate buffer for tracefile name \"%s\"\n",optarg
);
697 callback
->printf_filtered(callback
,"Placing trace information into file \"%s\"\n",tracefile
);
708 Simulator constructed without profiling support (for performance).\n\
709 Re-compile simulator with \"-DPROFILE\" to enable this option.\n");
710 #endif /* !PROFILE */
715 profile_nsamples
= (unsigned)getnum(optarg
);
721 sim_set_profile((int)getnum(optarg
));
726 callback
->printf_filtered(callback
,"Warning: Simulator getopt returned unrecognised code 0x%08X\n",c
);
734 callback
->printf_filtered(callback
,"Warning: Ignoring spurious non-option arguments ");
735 while (optind
< argc
)
736 callback
->printf_filtered(callback
,"\"%s\" ",argv
[optind
++]);
737 callback
->printf_filtered(callback
,"\n");
744 if (logfile
!= NULL
) {
745 if (strcmp(logfile
,"-") == 0)
748 logfh
= fopen(logfile
,"wb+");
750 callback
->printf_filtered(callback
,"Failed to create file \"%s\", writing log information to stderr.\n",tracefile
);
756 /* If the host has "mmap" available we could use it to provide a
757 very large virtual address space for the simulator, since memory
758 would only be allocated within the "mmap" space as it is
759 accessed. This can also be linked to the architecture specific
760 support, required to simulate the MMU. */
761 sim_size(membank_size
);
762 /* NOTE: The above will also have enabled any profiling state */
765 /* If we were providing a more complete I/O, co-processor or memory
766 simulation, we should perform any "device" initialisation at this
767 point. This can include pre-loading memory areas with particular
768 patterns (e.g. simulating ROM monitors). */
770 /* We can start writing to the memory, now that the processor has
772 monitor
= (unsigned char *)calloc(1,monitor_size
);
774 fprintf(stderr
,"Not enough VM for monitor simulation (%d bytes)\n",monitor_size
);
777 /* Entry into the IDT monitor is via fixed address vectors, and
778 not using machine instructions. To avoid clashing with use of
779 the MIPS TRAP system, we place our own (simulator specific)
780 "undefined" instructions into the relevant vector slots. */
781 for (loop
= 0; (loop
< monitor_size
); loop
+= 4) {
782 uword64 vaddr
= (monitor_base
+ loop
);
785 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
))
786 StoreMemory(cca
,AccessLength_WORD
,(RSVD_INSTRUCTION
| ((loop
>> 2) & RSVD_INSTRUCTION_AMASK
)),paddr
,vaddr
,isRAW
);
788 /* The PMON monitor uses the same address space, but rather than
789 branching into it the address of a routine is loaded. We can
790 cheat for the moment, and direct the PMON routine to IDT style
791 instructions within the monitor space. This relies on the IDT
792 monitor not using the locations from 0xBFC00500 onwards as its
794 for (loop
= 0; (loop
< 24); loop
++)
796 uword64 vaddr
= (monitor_base
+ 0x500 + (loop
* 4));
799 unsigned int value
= ((0x500 - 8) / 8); /* default UNDEFINED reason code */
819 value
= ((0x500 - 16) / 8); /* not an IDT reason code */
822 case 8: /* cliexit */
826 case 11: /* flush_cache */
830 /* FIXME - should monitor_base be SIM_ADDR?? */
831 value
= ((unsigned int)monitor_base
+ (value
* 8));
832 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
))
833 StoreMemory(cca
,AccessLength_WORD
,value
,paddr
,vaddr
,isRAW
);
835 sim_error("Failed to write to monitor space 0x%08X%08X",WORD64HI(vaddr
),WORD64LO(vaddr
));
840 if (state
& simTRACE
)
851 tracefh
= fopen(tracefile
,"wb+");
854 sim_warning("Failed to create file \"%s\", writing trace information to stderr.",tracefile
);
860 /* For the profile writing, we write the data in the host
861 endianness. This unfortunately means we are assuming that the
862 profile file we create is processed on the same host executing the
863 simulator. The gmon.out file format should either have an explicit
864 endianness, or a method of encoding the endianness in the file
874 if (state
& simHOSTBE
) {
875 buff
[3] = ((val
>> 0) & 0xFF);
876 buff
[2] = ((val
>> 8) & 0xFF);
877 buff
[1] = ((val
>> 16) & 0xFF);
878 buff
[0] = ((val
>> 24) & 0xFF);
880 buff
[0] = ((val
>> 0) & 0xFF);
881 buff
[1] = ((val
>> 8) & 0xFF);
882 buff
[2] = ((val
>> 16) & 0xFF);
883 buff
[3] = ((val
>> 24) & 0xFF);
885 if (fwrite(buff
,4,1,fh
) != 1) {
886 sim_warning("Failed to write 4bytes to the profile file");
899 if (state
& simHOSTBE
) {
900 buff
[1] = ((val
>> 0) & 0xFF);
901 buff
[0] = ((val
>> 8) & 0xFF);
903 buff
[0] = ((val
>> 0) & 0xFF);
904 buff
[1] = ((val
>> 8) & 0xFF);
906 if (fwrite(buff
,2,1,fh
) != 1) {
907 sim_warning("Failed to write 2bytes to the profile file");
918 printf("DBG: sim_close: entered (quitting = %d)\n",quitting
);
921 /* Cannot assume sim_kill() has been called */
922 /* "quitting" is non-zero if we cannot hang on errors */
924 /* Ensure that any resources allocated through the callback
925 mechanism are released: */
926 callback
->shutdown(callback
);
929 if ((state
& simPROFILE
) && (profile_hist
!= NULL
)) {
930 unsigned short *p
= profile_hist
;
931 FILE *pf
= fopen("gmon.out","wb");
935 sim_warning("Failed to open \"gmon.out\" profile file");
939 printf("DBG: minpc = 0x%08X\n",(unsigned int)profile_minpc
);
940 printf("DBG: maxpc = 0x%08X\n",(unsigned int)profile_maxpc
);
942 ok
= writeout32(pf
,(unsigned int)profile_minpc
);
944 ok
= writeout32(pf
,(unsigned int)profile_maxpc
);
946 ok
= writeout32(pf
,(profile_nsamples
* 2) + 12); /* size of sample buffer (+ header) */
948 printf("DBG: nsamples = %d (size = 0x%08X)\n",profile_nsamples
,((profile_nsamples
* 2) + 12));
950 for (loop
= 0; (ok
&& (loop
< profile_nsamples
)); loop
++) {
951 ok
= writeout16(pf
,profile_hist
[loop
]);
961 state
&= ~simPROFILE
;
966 if (tracefh
!= NULL
&& tracefh
!= stderr
)
972 if (logfh
!= NULL
&& logfh
!= stdout
&& logfh
!= stderr
)
977 free(membank
); /* cfree not available on all hosts */
984 control_c (sig
, code
, scp
, addr
)
990 state
|= (simSTOP
| simSIGINT
);
994 sim_resume (step
,signal_number
)
995 int step
, signal_number
;
1000 printf("DBG: sim_resume entered: step = %d, signal = %d (membank = 0x%08X)\n",step
,signal_number
,membank
);
1004 state
|= simSTEP
; /* execute only a single instruction */
1006 state
&= ~(simSTOP
| simSTEP
); /* execute until event */
1008 state
|= (simHALTEX
| simHALTIN
); /* treat interrupt event as exception */
1010 /* Start executing instructions from the current state (set
1011 explicitly by register updates, or by sim_create_inferior): */
1013 prev
= signal (SIGINT
, control_c
);
1017 signal (SIGINT
, prev
);
1023 sim_write (addr
,buffer
,size
)
1025 unsigned char *buffer
;
1029 uword64 vaddr
= (uword64
)addr
;
1031 /* Return the number of bytes written, or zero if error. */
1033 callback
->printf_filtered(callback
,"sim_write(0x%08X%08X,buffer,%d);\n",WORD64HI(addr
),WORD64LO(addr
),size
);
1036 /* We provide raw read and write routines, since we do not want to
1037 count the GDB memory accesses in our statistics gathering. */
1039 /* There is a lot of code duplication in the individual blocks
1040 below, but the variables are declared locally to a block to give
1041 the optimiser the best chance of improving the code. We have to
1042 perform slow byte reads from the host memory, to ensure that we
1043 get the data into the correct endianness for the (simulated)
1044 target memory world. */
1046 /* Mask count to get odd byte, odd halfword, and odd word out of the
1047 way. We can then perform doubleword transfers to and from the
1048 simulator memory for optimum performance. */
1049 if (index
&& (index
& 1)) {
1052 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
1053 uword64 value
= ((uword64
)(*buffer
++));
1054 StoreMemory(cca
,AccessLength_BYTE
,value
,paddr
,vaddr
,isRAW
);
1057 index
&= ~1; /* logical operations usually quicker than arithmetic on RISC systems */
1059 if (index
&& (index
& 2)) {
1062 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
1064 /* We need to perform the following magic to ensure that that
1065 bytes are written into same byte positions in the target memory
1066 world, regardless of the endianness of the host. */
1068 value
= ((uword64
)(*buffer
++) << 8);
1069 value
|= ((uword64
)(*buffer
++) << 0);
1071 value
= ((uword64
)(*buffer
++) << 0);
1072 value
|= ((uword64
)(*buffer
++) << 8);
1074 StoreMemory(cca
,AccessLength_HALFWORD
,value
,paddr
,vaddr
,isRAW
);
1079 if (index
&& (index
& 4)) {
1082 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
1085 value
= ((uword64
)(*buffer
++) << 24);
1086 value
|= ((uword64
)(*buffer
++) << 16);
1087 value
|= ((uword64
)(*buffer
++) << 8);
1088 value
|= ((uword64
)(*buffer
++) << 0);
1090 value
= ((uword64
)(*buffer
++) << 0);
1091 value
|= ((uword64
)(*buffer
++) << 8);
1092 value
|= ((uword64
)(*buffer
++) << 16);
1093 value
|= ((uword64
)(*buffer
++) << 24);
1095 StoreMemory(cca
,AccessLength_WORD
,value
,paddr
,vaddr
,isRAW
);
1100 for (;index
; index
-= 8) {
1103 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
1106 value
= ((uword64
)(*buffer
++) << 56);
1107 value
|= ((uword64
)(*buffer
++) << 48);
1108 value
|= ((uword64
)(*buffer
++) << 40);
1109 value
|= ((uword64
)(*buffer
++) << 32);
1110 value
|= ((uword64
)(*buffer
++) << 24);
1111 value
|= ((uword64
)(*buffer
++) << 16);
1112 value
|= ((uword64
)(*buffer
++) << 8);
1113 value
|= ((uword64
)(*buffer
++) << 0);
1115 value
= ((uword64
)(*buffer
++) << 0);
1116 value
|= ((uword64
)(*buffer
++) << 8);
1117 value
|= ((uword64
)(*buffer
++) << 16);
1118 value
|= ((uword64
)(*buffer
++) << 24);
1119 value
|= ((uword64
)(*buffer
++) << 32);
1120 value
|= ((uword64
)(*buffer
++) << 40);
1121 value
|= ((uword64
)(*buffer
++) << 48);
1122 value
|= ((uword64
)(*buffer
++) << 56);
1124 StoreMemory(cca
,AccessLength_DOUBLEWORD
,value
,paddr
,vaddr
,isRAW
);
1133 sim_read (addr
,buffer
,size
)
1135 unsigned char *buffer
;
1140 /* Return the number of bytes read, or zero if error. */
1142 callback
->printf_filtered(callback
,"sim_read(0x%08X%08X,buffer,%d);\n",WORD64HI(addr
),WORD64LO(addr
),size
);
1145 /* TODO: Perform same optimisation as the sim_write() code
1146 above. NOTE: This will require a bit more work since we will need
1147 to ensure that the source physical address is doubleword aligned
1148 before, and then deal with trailing bytes. */
1149 for (index
= 0; (index
< size
); index
++) {
1150 uword64 vaddr
,paddr
,value
;
1152 vaddr
= (uword64
)addr
+ index
;
1153 if (AddressTranslation(vaddr
,isDATA
,isLOAD
,&paddr
,&cca
,isTARGET
,isRAW
)) {
1154 value
= LoadMemory(cca
,AccessLength_BYTE
,paddr
,vaddr
,isDATA
,isRAW
);
1155 buffer
[index
] = (unsigned char)(value
&0xFF);
1164 sim_store_register (rn
,memory
)
1166 unsigned char *memory
;
1169 callback
->printf_filtered(callback
,"sim_store_register(%d,*memory=0x%08X%08X);\n",rn
,*((unsigned int *)memory
),*((unsigned int *)(memory
+ 4)));
1172 /* Unfortunately this suffers from the same problem as the register
1173 numbering one. We need to know what the width of each logical
1174 register number is for the architecture being simulated. */
1175 if (register_widths
[rn
] == 0)
1176 sim_warning("Invalid register width for %d (register store ignored)",rn
);
1178 if (register_widths
[rn
] == 32)
1179 registers
[rn
] = host_read_word(memory
);
1181 registers
[rn
] = host_read_long(memory
);
1188 sim_fetch_register (rn
,memory
)
1190 unsigned char *memory
;
1193 callback
->printf_filtered(callback
,"sim_fetch_register(%d=0x%08X%08X,mem) : place simulator registers into memory\n",rn
,WORD64HI(registers
[rn
]),WORD64LO(registers
[rn
]));
1196 if (register_widths
[rn
] == 0)
1197 sim_warning("Invalid register width for %d (register fetch ignored)",rn
);
1199 if (register_widths
[rn
] == 32)
1200 *((unsigned int *)memory
) = host_swap_word((unsigned int)(registers
[rn
] & 0xFFFFFFFF));
1201 else /* 64bit register */
1202 *((uword64
*)memory
) = host_swap_long(registers
[rn
]);
1208 sim_stop_reason (reason
,sigrc
)
1209 enum sim_stop
*reason
;
1212 /* We can have "*reason = {sim_exited, sim_stopped, sim_signalled}", so
1213 sim_exited *sigrc = argument to exit()
1214 sim_stopped *sigrc = exception number
1215 sim_signalled *sigrc = signal number
1217 if (state
& simEXCEPTION
) {
1218 /* If "sim_signalled" is used, GDB expects normal SIGNAL numbers,
1219 and not the MIPS specific exception codes. */
1221 /* For some reason, sending GDB a sim_signalled reason cause it to
1223 *reason
= sim_stopped
;
1225 *reason
= sim_signalled
;
1227 switch ((CAUSE
>> 2) & 0x1F) {
1229 *sigrc
= SIGINT
; /* wrong type of interrupt, but it will do for the moment */
1232 case TLBModification
:
1237 case InstructionFetch
:
1242 case ReservedInstruction
:
1243 case CoProcessorUnusable
:
1247 case IntegerOverflow
:
1259 default : /* Unknown internal exception */
1263 } else if (state
& simEXIT
) {
1265 printf("DBG: simEXIT (%d)\n",rcexit
);
1267 *reason
= sim_exited
;
1269 } else if (state
& simSIGINT
) {
1270 *reason
= sim_stopped
;
1272 } else { /* assume single-stepping */
1273 *reason
= sim_stopped
;
1276 state
&= ~(simEXCEPTION
| simEXIT
| simSIGINT
);
1284 /* Accessed from the GDB "info files" command: */
1286 callback
->printf_filtered(callback
,"MIPS %d-bit simulator\n",(PROCESSOR_64BIT
? 64 : 32));
1288 callback
->printf_filtered(callback
,"%s endian memory model\n",(state
& simBE
? "Big" : "Little"));
1290 callback
->printf_filtered(callback
,"0x%08X bytes of memory at 0x%08X%08X\n",(unsigned int)membank_size
,WORD64HI(membank_base
),WORD64LO(membank_base
));
1292 #if !defined(FASTSIM)
1293 if (instruction_fetch_overflow
!= 0)
1294 callback
->printf_filtered(callback
,"Instruction fetches = 0x%08X%08X\n",instruction_fetch_overflow
,instruction_fetches
);
1296 callback
->printf_filtered(callback
,"Instruction fetches = %d\n",instruction_fetches
);
1297 callback
->printf_filtered(callback
,"Pipeline ticks = %d\n",pipeline_ticks
);
1298 /* It would be a useful feature, if when performing multi-cycle
1299 simulations (rather than single-stepping) we keep the start and
1300 end times of the execution, so that we can give a performance
1301 figure for the simulator. */
1302 #endif /* !FASTSIM */
1304 /* print information pertaining to MIPS ISA and architecture being simulated */
1305 /* things that may be interesting */
1306 /* instructions executed - if available */
1307 /* cycles executed - if available */
1308 /* pipeline stalls - if available */
1309 /* virtual time taken */
1310 /* profiling size */
1311 /* profiling frequency */
1319 sim_load (prog
,from_tty
)
1323 /* Return non-zero if the caller should handle the load. Zero if
1324 we have loaded the image. */
1329 sim_create_inferior (start_address
,argv
,env
)
1330 SIM_ADDR start_address
;
1335 printf("DBG: sim_create_inferior entered: start_address = 0x%08X\n",start_address
);
1338 /* Prepare to execute the program to be simulated */
1339 /* argv and env are NULL terminated lists of pointers */
1342 PC
= (uword64
)start_address
;
1344 /* TODO: Sort this properly. SIM_ADDR may already be a 64bit value: */
1345 PC
= SIGNEXTEND(start_address
,32);
1347 /* NOTE: GDB normally sets the PC explicitly. However, this call is
1348 used by other clients of the simulator. */
1351 #if 0 /* def DEBUG */
1352 callback
->printf_filtered(callback
,"sim_create_inferior() : passed arguments ignored\n");
1355 for (cptr
= argv
; (cptr
&& *cptr
); cptr
++)
1356 printf("DBG: arg \"%s\"\n",*cptr
);
1359 /* We should really place the argv slot values into the argument
1360 registers, and onto the stack as required. However, this
1361 assumes that we have a stack defined, which is not necessarily
1362 true at the moment. */
1372 /* This routine should be for terminating any existing simulation
1373 thread. Since we are single-threaded only at the moment, this is
1374 not an issue. It should *NOT* be used to terminate the
1376 #else /* do *NOT* call sim_close */
1377 sim_close(1); /* Do not hang on errors */
1378 /* This would also be the point where any memory mapped areas used
1379 by the simulator should be released. */
1385 sim_get_quit_code ()
1387 /* The standard MIPS PCS (Procedure Calling Standard) uses V0(r2) as
1388 the function return value. However, it may be more correct for
1389 this to return the argument to the exit() function (if
1395 sim_set_callbacks (p
)
1402 typedef enum {e_terminate
,e_help
,e_setmemsize
,e_reset
} e_cmds
;
1404 static struct t_sim_command
{
1408 } sim_commands
[] = {
1409 {e_help
, "help", ": Show MIPS simulator private commands"},
1410 {e_setmemsize
,"set-memory-size","<n> : Specify amount of memory simulated"},
1411 {e_reset
, "reset-system", ": Reset the simulated processor"},
1416 sim_do_command (cmd
)
1419 struct t_sim_command
*cptr
;
1421 if (callback
== NULL
) {
1422 fprintf(stderr
,"Simulator not enabled: \"target sim\" should be used to activate\n");
1426 if (!(cmd
&& *cmd
!= '\0'))
1429 /* NOTE: Accessed from the GDB "sim" commmand: */
1430 for (cptr
= sim_commands
; cptr
&& cptr
->name
; cptr
++)
1431 if (strncmp(cmd
,cptr
->name
,strlen(cptr
->name
)) == 0) {
1432 cmd
+= strlen(cptr
->name
);
1434 case e_help
: /* no arguments */
1435 { /* no arguments */
1436 struct t_sim_command
*lptr
;
1437 callback
->printf_filtered(callback
,"List of MIPS simulator commands:\n");
1438 for (lptr
= sim_commands
; lptr
->name
; lptr
++)
1439 callback
->printf_filtered(callback
,"%s %s\n",lptr
->name
,lptr
->help
);
1443 case e_setmemsize
: /* memory size argument */
1445 unsigned int newsize
= (unsigned int)getnum(cmd
);
1450 case e_reset
: /* no arguments */
1452 /* NOTE: See the comments in sim_open() relating to device
1457 callback
->printf_filtered(callback
,"FATAL: Matched \"%s\", but failed to match command id %d.\n",cmd
,cptr
->id
);
1464 callback
->printf_filtered(callback
,"Error: \"%s\" is not a valid MIPS simulator command.\n",cmd
);
1469 /*---------------------------------------------------------------------------*/
1470 /* NOTE: The following routines do not seem to be used by GDB at the
1471 moment. However, they may be useful to the standalone simulator
1475 /* The profiling format is described in the "gmon_out.h" header file */
1480 #if defined(PROFILE)
1481 profile_frequency
= n
;
1482 state
|= simPROFILE
;
1483 #endif /* PROFILE */
1488 sim_set_profile_size (n
)
1491 #if defined(PROFILE)
1492 if (state
& simPROFILE
) {
1495 /* Since we KNOW that the memory banks are a power-of-2 in size: */
1496 profile_nsamples
= power2(n
);
1497 profile_minpc
= membank_base
;
1498 profile_maxpc
= (membank_base
+ membank_size
);
1500 /* Just in-case we are sampling every address: NOTE: The shift
1501 right of 2 is because we only have word-aligned PC addresses. */
1502 if (profile_nsamples
> (membank_size
>> 2))
1503 profile_nsamples
= (membank_size
>> 2);
1505 /* Since we are dealing with power-of-2 values: */
1506 profile_shift
= (((membank_size
>> 2) / profile_nsamples
) - 1);
1508 bsize
= (profile_nsamples
* sizeof(unsigned short));
1509 if (profile_hist
== NULL
)
1510 profile_hist
= (unsigned short *)calloc(64,(bsize
/ 64));
1512 profile_hist
= (unsigned short *)realloc(profile_hist
,bsize
);
1513 if (profile_hist
== NULL
) {
1514 sim_warning("Failed to allocate VM for profiling buffer (0x%08X bytes)",bsize
);
1515 state
&= ~simPROFILE
;
1518 #endif /* PROFILE */
1525 unsigned int newsize
;
1528 /* Used by "run", and internally, to set the simulated memory size */
1530 callback
->printf_filtered(callback
,"Zero not valid: Memory size still 0x%08X bytes\n",membank_size
);
1533 newsize
= power2(newsize
);
1534 if (membank
== NULL
)
1535 new = (char *)calloc(64,(membank_size
/ 64));
1537 new = (char *)realloc(membank
,newsize
);
1539 if (membank
== NULL
)
1540 sim_error("Not enough VM for simulation memory of 0x%08X bytes",membank_size
);
1542 sim_warning("Failed to resize memory (still 0x%08X bytes)",membank_size
);
1544 membank_size
= (unsigned)newsize
;
1546 #if defined(PROFILE)
1547 /* Ensure that we sample across the new memory range */
1548 sim_set_profile_size(profile_nsamples
);
1549 #endif /* PROFILE */
1558 /* This routine is called by the "run" program, when detailed
1559 execution information is required. Rather than executing a single
1560 instruction, and looping around externally... we just start
1561 simulating, returning TRUE when the simulator stops (for whatever
1565 /* Ensure tracing is enabled, if available */
1566 if (tracefh
== NULL
)
1573 state
&= ~(simSTOP
| simSTEP
); /* execute until event */
1574 state
|= (simHALTEX
| simHALTIN
); /* treat interrupt event as exception */
1575 /* Start executing instructions from the current state (set
1576 explicitly by register updates, or by sim_create_inferior): */
1582 /*---------------------------------------------------------------------------*/
1583 /*-- Private simulator support interface ------------------------------------*/
1584 /*---------------------------------------------------------------------------*/
1586 /* Simple monitor interface (currently setup for the IDT and PMON monitors) */
1589 unsigned int reason
;
1591 /* The IDT monitor actually allows two instructions per vector
1592 slot. However, the simulator currently causes a trap on each
1593 individual instruction. We cheat, and lose the bottom bit. */
1596 /* The following callback functions are available, however the
1597 monitor we are simulating does not make use of them: get_errno,
1598 isatty, lseek, rename, system, time and unlink */
1600 case 6: /* int open(char *path,int flags) */
1604 if (AddressTranslation(A0
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
))
1605 V0
= callback
->open(callback
,(char *)((int)paddr
),(int)A1
);
1607 sim_error("Attempt to pass pointer that does not reference simulated memory");
1611 case 7: /* int read(int file,char *ptr,int len) */
1615 if (AddressTranslation(A1
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
))
1616 V0
= callback
->read(callback
,(int)A0
,(char *)((int)paddr
),(int)A2
);
1618 sim_error("Attempt to pass pointer that does not reference simulated memory");
1622 case 8: /* int write(int file,char *ptr,int len) */
1626 if (AddressTranslation(A1
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
))
1629 V0
= callback
->write_stdout(callback
,(const char *)((int)paddr
),
1632 V0
= callback
->write(callback
,(int)A0
,(const char *)((int)paddr
),
1636 sim_error("Attempt to pass pointer that does not reference simulated memory");
1640 case 10: /* int close(int file) */
1641 V0
= callback
->close(callback
,(int)A0
);
1644 case 11: /* char inbyte(void) */
1647 if (callback
->read_stdin(callback
,&tmp
,sizeof(char)) != sizeof(char)) {
1648 sim_error("Invalid return from character read");
1656 case 12: /* void outbyte(char chr) : write a byte to "stdout" */
1658 char tmp
= (char)(A0
& 0xFF);
1659 callback
->write_stdout(callback
,&tmp
,sizeof(char));
1663 case 17: /* void _exit() */
1664 sim_warning("sim_monitor(17): _exit(int reason) to be coded");
1665 state
|= (simSTOP
| simEXIT
); /* stop executing code */
1666 rcexit
= (unsigned int)(A0
& 0xFFFFFFFF);
1669 case 28 : /* PMON flush_cache */
1672 case 55: /* void get_mem_info(unsigned int *ptr) */
1673 /* in: A0 = pointer to three word memory location */
1674 /* out: [A0 + 0] = size */
1675 /* [A0 + 4] = instruction cache size */
1676 /* [A0 + 8] = data cache size */
1679 uword64 paddr
, value
;
1683 /* NOTE: We use RAW memory writes here, but since we are not
1684 gathering statistics for the monitor calls we are simulating,
1685 it is not an issue. */
1688 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isREAL
)) {
1689 value
= (uword64
)membank_size
;
1690 StoreMemory(cca
,AccessLength_WORD
,value
,paddr
,vaddr
,isRAW
);
1691 /* We re-do the address translations, in-case the block
1692 overlaps a memory boundary: */
1694 vaddr
+= (AccessLength_WORD
+ 1);
1695 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isREAL
)) {
1696 StoreMemory(cca
,AccessLength_WORD
,value
,paddr
,vaddr
,isRAW
);
1697 vaddr
+= (AccessLength_WORD
+ 1);
1698 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isREAL
))
1699 StoreMemory(cca
,AccessLength_WORD
,value
,paddr
,vaddr
,isRAW
);
1708 sim_error("Invalid pointer passed into monitor call");
1712 case 158 : /* PMON printf */
1713 /* in: A0 = pointer to format string */
1714 /* A1 = optional argument 1 */
1715 /* A2 = optional argument 2 */
1716 /* A3 = optional argument 3 */
1718 /* The following is based on the PMON printf source */
1722 /* This isn't the quickest way, since we call the host print
1723 routine for every character almost. But it does avoid
1724 having to allocate and manage a temporary string buffer. */
1725 if (AddressTranslation(A0
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
)) {
1726 char *s
= (char *)((int)paddr
);
1727 ut_reg
*ap
= &A1
; /* 1st argument */
1728 /* TODO: Include check that we only use three arguments (A1, A2 and A3) */
1732 enum {FMT_RJUST
, FMT_LJUST
, FMT_RJUST0
, FMT_CENTER
} fmt
= FMT_RJUST
;
1733 int width
= 0, trunc
= 0, haddot
= 0, longlong
= 0;
1737 if (strchr ("dobxXulscefg%", *s
))
1745 else if (*s
== '*') {
1750 } else if (*s
>= '1' && *s
<= '9') {
1753 for (t
= s
; isdigit (*s
); s
++);
1754 strncpy (tmp
, t
, s
- t
);
1756 n
= (unsigned int)strtol(tmp
,NULL
,10);
1762 } else if (*s
== '.')
1766 callback
->printf_filtered(callback
,"%%");
1767 } else if (*s
== 's') {
1768 if ((int)*ap
!= 0) {
1769 if (AddressTranslation(*ap
++,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
)) {
1770 char *p
= (char *)((int)paddr
);;
1771 callback
->printf_filtered(callback
,p
);
1774 sim_error("Attempt to pass pointer that does not reference simulated memory");
1778 callback
->printf_filtered(callback
,"(null)");
1779 } else if (*s
== 'c') {
1781 callback
->printf_filtered(callback
,"%c",n
);
1789 if (strchr ("dobxXu", *s
)) {
1790 word64 lv
= (word64
) *ap
++;
1792 callback
->printf_filtered(callback
,"<binary not supported>");
1794 sprintf(tmp
,"%%%s%c",longlong
? "ll" : "",*s
);
1796 callback
->printf_filtered(callback
,tmp
,lv
);
1798 callback
->printf_filtered(callback
,tmp
,(int)lv
);
1800 } else if (strchr ("eEfgG", *s
)) {
1801 #ifdef _MSC_VER /* MSVC version 2.x can't convert from uword64 directly */
1802 double dbl
= (double)((word64
)*ap
++);
1804 double dbl
= (double)*ap
++;
1806 sprintf(tmp
,"%%%d.%d%c",width
,trunc
,*s
);
1807 callback
->printf_filtered(callback
,tmp
,dbl
);
1813 callback
->printf_filtered(callback
,"%c",*s
++);
1816 sim_error("Attempt to pass pointer that does not reference simulated memory");
1821 sim_warning("TODO: sim_monitor(%d) : PC = 0x%08X%08X",reason
,WORD64HI(IPC
),WORD64LO(IPC
));
1822 sim_warning("(Arguments : A0 = 0x%08X%08X : A1 = 0x%08X%08X : A2 = 0x%08X%08X : A3 = 0x%08X%08X)",WORD64HI(A0
),WORD64LO(A0
),WORD64HI(A1
),WORD64LO(A1
),WORD64HI(A2
),WORD64LO(A2
),WORD64HI(A3
),WORD64LO(A3
));
1828 /* Store a word into memory. */
1831 store_word (vaddr
, val
)
1838 if ((vaddr
& 3) != 0)
1839 SignalException (AddressStore
);
1842 if (AddressTranslation (vaddr
, isDATA
, isSTORE
, &paddr
, &uncached
,
1845 const uword64 mask
= 7;
1849 paddr
= (paddr
& ~mask
) | ((paddr
& mask
) ^ (ReverseEndian
<< 2));
1850 byte
= (vaddr
& mask
) ^ (BigEndianCPU
<< 2);
1851 memval
= ((uword64
) val
) << (8 * byte
);
1852 StoreMemory (uncached
, AccessLength_WORD
, memval
, paddr
, vaddr
,
1858 /* Load a word from memory. */
1864 if ((vaddr
& 3) != 0)
1865 SignalException (AddressLoad
);
1871 if (AddressTranslation (vaddr
, isDATA
, isLOAD
, &paddr
, &uncached
,
1874 const uword64 mask
= 0x7;
1875 const unsigned int reverse
= ReverseEndian
? 1 : 0;
1876 const unsigned int bigend
= BigEndianCPU
? 1 : 0;
1880 paddr
= (paddr
& ~mask
) | ((paddr
& mask
) ^ (reverse
<< 2));
1881 memval
= LoadMemory (uncached
, AccessLength_WORD
, paddr
, vaddr
,
1883 byte
= (vaddr
& mask
) ^ (bigend
<< 2);
1884 return SIGNEXTEND (((memval
>> (8 * byte
)) & 0xffffffff), 32);
1891 /* Simulate the mips16 entry and exit pseudo-instructions. These
1892 would normally be handled by the reserved instruction exception
1893 code, but for ease of simulation we just handle them directly. */
1899 int aregs
, sregs
, rreg
;
1901 aregs
= (insn
& 0x700) >> 8;
1902 sregs
= (insn
& 0x0c0) >> 6;
1903 rreg
= (insn
& 0x020) >> 5;
1905 /* This should be checked by the caller. */
1914 /* This is the entry pseudo-instruction. */
1916 for (i
= 0; i
< aregs
; i
++)
1917 store_word ((uword64
) (SP
+ 4 * i
), registers
[i
+ 4]);
1925 store_word ((uword64
) tsp
, RA
);
1928 for (i
= 0; i
< sregs
; i
++)
1931 store_word ((uword64
) tsp
, registers
[16 + i
]);
1939 /* This is the exit pseudo-instruction. */
1946 RA
= load_word ((uword64
) tsp
);
1949 for (i
= 0; i
< sregs
; i
++)
1952 registers
[i
+ 16] = load_word ((uword64
) tsp
);
1959 FGR
[0] = WORD64LO (GPR
[4]);
1960 fpr_state
[0] = fmt_uninterpreted
;
1962 else if (aregs
== 6)
1964 FGR
[0] = WORD64LO (GPR
[5]);
1965 FGR
[1] = WORD64LO (GPR
[4]);
1966 fpr_state
[0] = fmt_uninterpreted
;
1967 fpr_state
[1] = fmt_uninterpreted
;
1975 sim_warning(char *fmt
,...)
1981 vsprintf (buf
, fmt
, ap
);
1984 if (logfh
!= NULL
) {
1985 fprintf(logfh
,"SIM Warning: %s\n", buf
);
1987 callback
->printf_filtered(callback
,"SIM Warning: %s\n", buf
);
1989 /* This used to call SignalException with a SimulatorFault, but that causes
1990 the simulator to exit, and that is inappropriate for a warning. */
1995 sim_error(char *fmt
,...)
2001 vsprintf (buf
, fmt
, ap
);
2004 callback
->printf_filtered(callback
,"SIM Error: %s", buf
);
2005 SignalException (SimulatorFault
, buf
);
2015 /* Round *UP* to the nearest power-of-2 if not already one */
2016 if (value
!= (value
& ~(value
- 1))) {
2017 for (tmp
= value
, loop
= 0; (tmp
!= 0); loop
++)
2019 value
= (1 << loop
);
2032 num
= strtol(value
,&end
,10);
2034 callback
->printf_filtered(callback
,"Warning: Invalid number \"%s\" ignored, using zero\n",value
);
2036 if (*end
&& ((tolower(*end
) == 'k') || (tolower(*end
) == 'm'))) {
2037 if (tolower(*end
) == 'k')
2044 callback
->printf_filtered(callback
,"Warning: Spurious characters \"%s\" at end of number ignored\n",end
);
2050 /*-- trace support ----------------------------------------------------------*/
2052 /* The TRACE support is provided (if required) in the memory accessing
2053 routines. Since we are also providing the architecture specific
2054 features, the architecture simulation code can also deal with
2055 notifying the TRACE world of cache flushes, etc. Similarly we do
2056 not need to provide profiling support in the simulator engine,
2057 since we can sample in the instruction fetch control loop. By
2058 defining the TRACE manifest, we add tracing as a run-time
2062 /* Tracing by default produces "din" format (as required by
2063 dineroIII). Each line of such a trace file *MUST* have a din label
2064 and address field. The rest of the line is ignored, so comments can
2065 be included if desired. The first field is the label which must be
2066 one of the following values:
2071 3 escape record (treated as unknown access type)
2072 4 escape record (causes cache flush)
2074 The address field is a 32bit (lower-case) hexadecimal address
2075 value. The address should *NOT* be preceded by "0x".
2077 The size of the memory transfer is not important when dealing with
2078 cache lines (as long as no more than a cache line can be
2079 transferred in a single operation :-), however more information
2080 could be given following the dineroIII requirement to allow more
2081 complete memory and cache simulators to provide better
2082 results. i.e. the University of Pisa has a cache simulator that can
2083 also take bus size and speed as (variable) inputs to calculate
2084 complete system performance (a much more useful ability when trying
2085 to construct an end product, rather than a processor). They
2086 currently have an ARM version of their tool called ChARM. */
2090 void dotrace(FILE *tracefh
,int type
,SIM_ADDR address
,int width
,char *comment
,...)
2092 if (state
& simTRACE
) {
2094 fprintf(tracefh
,"%d %08x%08x ; width %d ; ",
2096 sizeof (address
) > 4 ? (unsigned long)(address
>>32) : 0,
2097 (unsigned long)(address
&0xffffffff),width
);
2098 va_start(ap
,comment
);
2099 vfprintf(tracefh
,comment
,ap
);
2101 fprintf(tracefh
,"\n");
2103 /* NOTE: Since the "din" format will only accept 32bit addresses, and
2104 we may be generating 64bit ones, we should put the hi-32bits of the
2105 address into the comment field. */
2107 /* TODO: Provide a buffer for the trace lines. We can then avoid
2108 performing writes until the buffer is filled, or the file is
2111 /* NOTE: We could consider adding a comment field to the "din" file
2112 produced using type 3 markers (unknown access). This would then
2113 allow information about the program that the "din" is for, and
2114 the MIPs world that was being simulated, to be placed into the
2121 /*---------------------------------------------------------------------------*/
2122 /*-- host<->target transfers ------------------------------------------------*/
2123 /*---------------------------------------------------------------------------*/
2124 /* The following routines allow conditionals to be avoided during the
2125 simulation, at the cost of increasing the image and source size. */
2128 xfer_direct_word(unsigned char *memory
)
2130 return *((unsigned int *)memory
);
2134 xfer_direct_long(unsigned char *memory
)
2136 return *((uword64
*)memory
);
2140 swap_direct_word(unsigned int data
)
2146 swap_direct_long(uword64 data
)
2152 xfer_big_word(unsigned char *memory
)
2154 return ((memory
[0] << 24) | (memory
[1] << 16) | (memory
[2] << 8) | memory
[3]);
2158 xfer_big_long(unsigned char *memory
)
2160 return (((uword64
)memory
[0] << 56) | ((uword64
)memory
[1] << 48)
2161 | ((uword64
)memory
[2] << 40) | ((uword64
)memory
[3] << 32)
2162 | ((uword64
)memory
[4] << 24) | ((uword64
)memory
[5] << 16)
2163 | ((uword64
)memory
[6] << 8) | ((uword64
)memory
[7]));
2167 xfer_little_word(unsigned char *memory
)
2169 return ((memory
[3] << 24) | (memory
[2] << 16) | (memory
[1] << 8) | memory
[0]);
2173 xfer_little_long(unsigned char *memory
)
2175 return (((uword64
)memory
[7] << 56) | ((uword64
)memory
[6] << 48)
2176 | ((uword64
)memory
[5] << 40) | ((uword64
)memory
[4] << 32)
2177 | ((uword64
)memory
[3] << 24) | ((uword64
)memory
[2] << 16)
2178 | ((uword64
)memory
[1] << 8) | (uword64
)memory
[0]);
2182 swap_word(unsigned int data
)
2184 unsigned int result
;
2185 result
= (((data
& 0xff) << 24) | ((data
& 0xff00) << 8)
2186 | ((data
>> 8) & 0xff00) | ((data
>> 24) & 0xff));
2191 swap_long(uword64 data
)
2193 unsigned int tmphi
= WORD64HI(data
);
2194 unsigned int tmplo
= WORD64LO(data
);
2195 tmphi
= swap_word(tmphi
);
2196 tmplo
= swap_word(tmplo
);
2197 /* Now swap the HI and LO parts */
2198 return SET64LO(tmphi
) | SET64HI(tmplo
);
2201 /*---------------------------------------------------------------------------*/
2202 /*-- simulator engine -------------------------------------------------------*/
2203 /*---------------------------------------------------------------------------*/
2208 /* In reality this check should be performed at various points
2209 within the simulation, since it is possible to change the
2210 endianness of user programs. However, we perform the check here
2211 to ensure that the start-of-day values agree. */
2212 if (target_byte_order
== 4321)
2215 /* ??? This is a lot more code than is necessary to solve the problem.
2216 It would be simpler to handle this like the SH simulator. */
2218 host_read_word
= xfer_direct_word
;
2219 host_read_long
= xfer_direct_long
;
2220 host_swap_word
= swap_direct_word
;
2221 host_swap_long
= swap_direct_long
;
2222 } else if (state
& simHOSTBE
) {
2223 host_read_word
= xfer_little_word
;
2224 host_read_long
= xfer_little_long
;
2225 host_swap_word
= swap_word
;
2226 host_swap_long
= swap_long
;
2227 } else { /* HOST little-endian */
2228 host_read_word
= xfer_big_word
;
2229 host_read_long
= xfer_big_long
;
2230 host_swap_word
= swap_word
;
2231 host_swap_long
= swap_long
;
2238 /* RESET: Fixed PC address: */
2239 PC
= (((uword64
)0xFFFFFFFF<<32) | 0xBFC00000);
2240 /* The reset vector address is in the unmapped, uncached memory space. */
2242 SR
&= ~(status_SR
| status_TS
| status_RP
);
2243 SR
|= (status_ERL
| status_BEV
);
2245 #if defined(HASFPU) && (GPRLEN == (64))
2246 /* Cheat and allow access to the complete register set immediately: */
2247 SR
|= status_FR
; /* 64bit registers */
2248 #endif /* HASFPU and 64bit FP registers */
2250 /* Ensure that any instructions with pending register updates are
2254 for (loop
= 0; (loop
< PSLOTS
); loop
++)
2255 pending_slot_reg
[loop
] = (LAST_EMBED_REGNUM
+ 1);
2256 pending_in
= pending_out
= pending_total
= 0;
2260 /* Initialise the FPU registers to the unknown state */
2263 for (rn
= 0; (rn
< 32); rn
++)
2264 fpr_state
[rn
] = fmt_uninterpreted
;
2271 /* Description from page A-22 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2272 /* Translate a virtual address to a physical address and cache
2273 coherence algorithm describing the mechanism used to resolve the
2274 memory reference. Given the virtual address vAddr, and whether the
2275 reference is to Instructions ot Data (IorD), find the corresponding
2276 physical address (pAddr) and the cache coherence algorithm (CCA)
2277 used to resolve the reference. If the virtual address is in one of
2278 the unmapped address spaces the physical address and the CCA are
2279 determined directly by the virtual address. If the virtual address
2280 is in one of the mapped address spaces then the TLB is used to
2281 determine the physical address and access type; if the required
2282 translation is not present in the TLB or the desired access is not
2283 permitted the function fails and an exception is taken.
2285 NOTE: This function is extended to return an exception state. This,
2286 along with the exception generation is used to notify whether a
2287 valid address translation occured */
2290 AddressTranslation(vAddr
,IorD
,LorS
,pAddr
,CCA
,host
,raw
)
2299 int res
= -1; /* TRUE : Assume good return */
2302 callback
->printf_filtered(callback
,"AddressTranslation(0x%08X%08X,%s,%s,...);\n",WORD64HI(vAddr
),WORD64LO(vAddr
),(IorD
? "isDATA" : "isINSTRUCTION"),(LorS
? "iSTORE" : "isLOAD"));
2305 /* Check that the address is valid for this memory model */
2307 /* For a simple (flat) memory model, we simply pass virtual
2308 addressess through (mostly) unchanged. */
2309 vAddr
&= 0xFFFFFFFF;
2311 /* Treat the kernel memory spaces identically for the moment: */
2312 if ((membank_base
== K1BASE
) && (vAddr
>= K0BASE
) && (vAddr
< (K0BASE
+ K0SIZE
)))
2313 vAddr
+= (K1BASE
- K0BASE
);
2315 /* Also assume that the K1BASE memory wraps. This is required to
2316 allow the PMON run-time __sizemem() routine to function (without
2317 having to provide exception simulation). NOTE: A kludge to work
2318 around the fact that the monitor memory is currently held in the
2320 if (((vAddr
< monitor_base
) || (vAddr
>= (monitor_base
+ monitor_size
))) && (vAddr
>= K1BASE
&& vAddr
< (K1BASE
+ K1SIZE
)))
2321 vAddr
= (K1BASE
| (vAddr
& (membank_size
- 1)));
2323 *pAddr
= vAddr
; /* default for isTARGET */
2324 *CCA
= Uncached
; /* not used for isHOST */
2326 /* NOTE: This is a duplicate of the code that appears in the
2327 LoadMemory and StoreMemory functions. They should be merged into
2328 a single function (that can be in-lined if required). */
2329 if ((vAddr
>= membank_base
) && (vAddr
< (membank_base
+ membank_size
))) {
2331 *pAddr
= (int)&membank
[((unsigned int)(vAddr
- membank_base
) & (membank_size
- 1))];
2332 } else if ((vAddr
>= monitor_base
) && (vAddr
< (monitor_base
+ monitor_size
))) {
2334 *pAddr
= (int)&monitor
[((unsigned int)(vAddr
- monitor_base
) & (monitor_size
- 1))];
2337 sim_warning("Failed: AddressTranslation(0x%08X%08X,%s,%s,...) IPC = 0x%08X%08X",WORD64HI(vAddr
),WORD64LO(vAddr
),(IorD
? "isDATA" : "isINSTRUCTION"),(LorS
? "isSTORE" : "isLOAD"),WORD64HI(IPC
),WORD64LO(IPC
));
2339 res
= 0; /* AddressTranslation has failed */
2340 *pAddr
= (SIM_ADDR
)-1;
2341 if (!raw
) /* only generate exceptions on real memory transfers */
2342 SignalException((LorS
== isSTORE
) ? AddressStore
: AddressLoad
);
2345 /* This is a normal occurance during gdb operation, for instance trying
2346 to print parameters at function start before they have been setup,
2347 and hence we should not print a warning except when debugging the
2349 sim_warning("AddressTranslation for %s %s from 0x%08X%08X failed",(IorD
? "data" : "instruction"),(LorS
? "store" : "load"),WORD64HI(vAddr
),WORD64LO(vAddr
));
2356 /* Description from page A-23 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2357 /* Prefetch data from memory. Prefetch is an advisory instruction for
2358 which an implementation specific action is taken. The action taken
2359 may increase performance, but must not change the meaning of the
2360 program, or alter architecturally-visible state. */
2362 Prefetch(CCA
,pAddr
,vAddr
,DATA
,hint
)
2370 callback
->printf_filtered(callback
,"Prefetch(%d,0x%08X%08X,0x%08X%08X,%d,%d);\n",CCA
,WORD64HI(pAddr
),WORD64LO(pAddr
),WORD64HI(vAddr
),WORD64LO(vAddr
),DATA
,hint
);
2373 /* For our simple memory model we do nothing */
2377 /* Description from page A-22 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2378 /* Load a value from memory. Use the cache and main memory as
2379 specified in the Cache Coherence Algorithm (CCA) and the sort of
2380 access (IorD) to find the contents of AccessLength memory bytes
2381 starting at physical location pAddr. The data is returned in the
2382 fixed width naturally-aligned memory element (MemElem). The
2383 low-order two (or three) bits of the address and the AccessLength
2384 indicate which of the bytes within MemElem needs to be given to the
2385 processor. If the memory access type of the reference is uncached
2386 then only the referenced bytes are read from memory and valid
2387 within the memory element. If the access type is cached, and the
2388 data is not present in cache, an implementation specific size and
2389 alignment block of memory is read and loaded into the cache to
2390 satisfy a load reference. At a minimum, the block is the entire
2393 LoadMemory(CCA
,AccessLength
,pAddr
,vAddr
,IorD
,raw
)
2404 if (membank
== NULL
)
2405 callback
->printf_filtered(callback
,"DBG: LoadMemory(%d,%d,0x%08X%08X,0x%08X%08X,%s,%s)\n",CCA
,AccessLength
,WORD64HI(pAddr
),WORD64LO(pAddr
),WORD64HI(vAddr
),WORD64LO(vAddr
),(IorD
? "isDATA" : "isINSTRUCTION"),(raw
? "isRAW" : "isREAL"));
2408 #if defined(WARN_MEM)
2409 if (CCA
!= uncached
)
2410 sim_warning("LoadMemory CCA (%d) is not uncached (currently all accesses treated as cached)",CCA
);
2412 if (((pAddr
& LOADDRMASK
) + AccessLength
) > LOADDRMASK
) {
2413 /* In reality this should be a Bus Error */
2414 sim_error("AccessLength of %d would extend over %dbit aligned boundary for physical address 0x%08X%08X\n",AccessLength
,(LOADDRMASK
+ 1)<<2,WORD64HI(pAddr
),WORD64LO(pAddr
));
2416 #endif /* WARN_MEM */
2418 /* Decide which physical memory locations are being dealt with. At
2419 this point we should be able to split the pAddr bits into the
2420 relevant address map being simulated. If the "raw" variable is
2421 set, the memory read being performed should *NOT* update any I/O
2422 state or affect the CPU state. This also includes avoiding
2423 affecting statistics gathering. */
2425 /* If instruction fetch then we need to check that the two lo-order
2426 bits are zero, otherwise raise a InstructionFetch exception: */
2427 if ((IorD
== isINSTRUCTION
)
2428 && ((pAddr
& 0x3) != 0)
2429 && (((pAddr
& 0x1) != 0) || ((vAddr
& 0x1) == 0)))
2430 SignalException(InstructionFetch
);
2433 unsigned char *mem
= NULL
;
2437 dotrace(tracefh
,((IorD
== isDATA
) ? 0 : 2),(unsigned int)(pAddr
&0xFFFFFFFF),(AccessLength
+ 1),"load%s",((IorD
== isDATA
) ? "" : " instruction"));
2440 /* NOTE: Quicker methods of decoding the address space can be used
2441 when a real memory map is being simulated (i.e. using hi-order
2442 address bits to select device). */
2443 if ((pAddr
>= membank_base
) && (pAddr
< (membank_base
+ membank_size
))) {
2444 index
= ((unsigned int)(pAddr
- membank_base
) & (membank_size
- 1));
2446 } else if ((pAddr
>= monitor_base
) && (pAddr
< (monitor_base
+ monitor_size
))) {
2447 index
= ((unsigned int)(pAddr
- monitor_base
) & (monitor_size
- 1));
2451 sim_error("Simulator memory not found for physical address 0x%08X%08X\n",WORD64HI(pAddr
),WORD64LO(pAddr
));
2453 /* If we obtained the endianness of the host, and it is the same
2454 as the target memory system we can optimise the memory
2455 accesses. However, without that information we must perform
2456 slow transfer, and hope that the compiler optimisation will
2457 merge successive loads. */
2458 value
= 0; /* no data loaded yet */
2460 /* In reality we should always be loading a doubleword value (or
2461 word value in 32bit memory worlds). The external code then
2462 extracts the required bytes. However, to keep performance
2463 high we only load the required bytes into the relevant
2466 switch (AccessLength
) { /* big-endian memory */
2467 case AccessLength_DOUBLEWORD
:
2468 value
|= ((uword64
)mem
[index
++] << 56);
2469 case AccessLength_SEPTIBYTE
:
2470 value
|= ((uword64
)mem
[index
++] << 48);
2471 case AccessLength_SEXTIBYTE
:
2472 value
|= ((uword64
)mem
[index
++] << 40);
2473 case AccessLength_QUINTIBYTE
:
2474 value
|= ((uword64
)mem
[index
++] << 32);
2475 case AccessLength_WORD
:
2476 value
|= ((unsigned int)mem
[index
++] << 24);
2477 case AccessLength_TRIPLEBYTE
:
2478 value
|= ((unsigned int)mem
[index
++] << 16);
2479 case AccessLength_HALFWORD
:
2480 value
|= ((unsigned int)mem
[index
++] << 8);
2481 case AccessLength_BYTE
:
2482 value
|= mem
[index
];
2486 index
+= (AccessLength
+ 1);
2487 switch (AccessLength
) { /* little-endian memory */
2488 case AccessLength_DOUBLEWORD
:
2489 value
|= ((uword64
)mem
[--index
] << 56);
2490 case AccessLength_SEPTIBYTE
:
2491 value
|= ((uword64
)mem
[--index
] << 48);
2492 case AccessLength_SEXTIBYTE
:
2493 value
|= ((uword64
)mem
[--index
] << 40);
2494 case AccessLength_QUINTIBYTE
:
2495 value
|= ((uword64
)mem
[--index
] << 32);
2496 case AccessLength_WORD
:
2497 value
|= ((uword64
)mem
[--index
] << 24);
2498 case AccessLength_TRIPLEBYTE
:
2499 value
|= ((uword64
)mem
[--index
] << 16);
2500 case AccessLength_HALFWORD
:
2501 value
|= ((uword64
)mem
[--index
] << 8);
2502 case AccessLength_BYTE
:
2503 value
|= ((uword64
)mem
[--index
] << 0);
2509 printf("DBG: LoadMemory() : (offset %d) : value = 0x%08X%08X\n",(int)(pAddr
& LOADDRMASK
),WORD64HI(value
),WORD64LO(value
));
2512 /* TODO: We could try and avoid the shifts when dealing with raw
2513 memory accesses. This would mean updating the LoadMemory and
2514 StoreMemory routines to avoid shifting the data before
2515 returning or using it. */
2516 if (!raw
) { /* do nothing for raw accessess */
2518 value
<<= (((7 - (pAddr
& LOADDRMASK
)) - AccessLength
) * 8);
2519 else /* little-endian only needs to be shifted up to the correct byte offset */
2520 value
<<= ((pAddr
& LOADDRMASK
) * 8);
2524 printf("DBG: LoadMemory() : shifted value = 0x%08X%08X\n",WORD64HI(value
),WORD64LO(value
));
2532 /* Description from page A-23 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2533 /* Store a value to memory. The specified data is stored into the
2534 physical location pAddr using the memory hierarchy (data caches and
2535 main memory) as specified by the Cache Coherence Algorithm
2536 (CCA). The MemElem contains the data for an aligned, fixed-width
2537 memory element (word for 32-bit processors, doubleword for 64-bit
2538 processors), though only the bytes that will actually be stored to
2539 memory need to be valid. The low-order two (or three) bits of pAddr
2540 and the AccessLength field indicates which of the bytes within the
2541 MemElem data should actually be stored; only these bytes in memory
2544 StoreMemory(CCA
,AccessLength
,MemElem
,pAddr
,vAddr
,raw
)
2553 callback
->printf_filtered(callback
,"DBG: StoreMemory(%d,%d,0x%08X%08X,0x%08X%08X,0x%08X%08X,%s)\n",CCA
,AccessLength
,WORD64HI(MemElem
),WORD64LO(MemElem
),WORD64HI(pAddr
),WORD64LO(pAddr
),WORD64HI(vAddr
),WORD64LO(vAddr
),(raw
? "isRAW" : "isREAL"));
2556 #if defined(WARN_MEM)
2557 if (CCA
!= uncached
)
2558 sim_warning("StoreMemory CCA (%d) is not uncached (currently all accesses treated as cached)",CCA
);
2560 if (((pAddr
& LOADDRMASK
) + AccessLength
) > LOADDRMASK
)
2561 sim_error("AccessLength of %d would extend over %dbit aligned boundary for physical address 0x%08X%08X\n",AccessLength
,(LOADDRMASK
+ 1)<<2,WORD64HI(pAddr
),WORD64LO(pAddr
));
2562 #endif /* WARN_MEM */
2566 dotrace(tracefh
,1,(unsigned int)(pAddr
&0xFFFFFFFF),(AccessLength
+ 1),"store");
2569 /* See the comments in the LoadMemory routine about optimising
2570 memory accesses. Also if we wanted to make the simulator smaller,
2571 we could merge a lot of this code with the LoadMemory
2572 routine. However, this would slow the simulator down with
2573 run-time conditionals. */
2576 unsigned char *mem
= NULL
;
2578 if ((pAddr
>= membank_base
) && (pAddr
< (membank_base
+ membank_size
))) {
2579 index
= ((unsigned int)(pAddr
- membank_base
) & (membank_size
- 1));
2581 } else if ((pAddr
>= monitor_base
) && (pAddr
< (monitor_base
+ monitor_size
))) {
2582 index
= ((unsigned int)(pAddr
- monitor_base
) & (monitor_size
- 1));
2587 sim_error("Simulator memory not found for physical address 0x%08X%08X\n",WORD64HI(pAddr
),WORD64LO(pAddr
));
2592 printf("DBG: StoreMemory: offset = %d MemElem = 0x%08X%08X\n",(unsigned int)(pAddr
& LOADDRMASK
),WORD64HI(MemElem
),WORD64LO(MemElem
));
2597 shift
= ((7 - AccessLength
) * 8);
2598 else /* real memory access */
2599 shift
= ((pAddr
& LOADDRMASK
) * 8);
2602 /* no need to shift raw little-endian data */
2604 MemElem
>>= ((pAddr
& LOADDRMASK
) * 8);
2608 printf("DBG: StoreMemory: shift = %d MemElem = 0x%08X%08X\n",shift
,WORD64HI(MemElem
),WORD64LO(MemElem
));
2612 switch (AccessLength
) { /* big-endian memory */
2613 case AccessLength_DOUBLEWORD
:
2614 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2616 case AccessLength_SEPTIBYTE
:
2617 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2619 case AccessLength_SEXTIBYTE
:
2620 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2622 case AccessLength_QUINTIBYTE
:
2623 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2625 case AccessLength_WORD
:
2626 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2628 case AccessLength_TRIPLEBYTE
:
2629 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2631 case AccessLength_HALFWORD
:
2632 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2634 case AccessLength_BYTE
:
2635 mem
[index
++] = (unsigned char)(MemElem
>> 56);
2639 index
+= (AccessLength
+ 1);
2640 switch (AccessLength
) { /* little-endian memory */
2641 case AccessLength_DOUBLEWORD
:
2642 mem
[--index
] = (unsigned char)(MemElem
>> 56);
2643 case AccessLength_SEPTIBYTE
:
2644 mem
[--index
] = (unsigned char)(MemElem
>> 48);
2645 case AccessLength_SEXTIBYTE
:
2646 mem
[--index
] = (unsigned char)(MemElem
>> 40);
2647 case AccessLength_QUINTIBYTE
:
2648 mem
[--index
] = (unsigned char)(MemElem
>> 32);
2649 case AccessLength_WORD
:
2650 mem
[--index
] = (unsigned char)(MemElem
>> 24);
2651 case AccessLength_TRIPLEBYTE
:
2652 mem
[--index
] = (unsigned char)(MemElem
>> 16);
2653 case AccessLength_HALFWORD
:
2654 mem
[--index
] = (unsigned char)(MemElem
>> 8);
2655 case AccessLength_BYTE
:
2656 mem
[--index
] = (unsigned char)(MemElem
>> 0);
2666 /* Description from page A-26 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2667 /* Order loads and stores to synchronise shared memory. Perform the
2668 action necessary to make the effects of groups of synchronizable
2669 loads and stores indicated by stype occur in the same order for all
2672 SyncOperation(stype
)
2676 callback
->printf_filtered(callback
,"SyncOperation(%d) : TODO\n",stype
);
2681 /* Description from page A-26 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2682 /* Signal an exception condition. This will result in an exception
2683 that aborts the instruction. The instruction operation pseudocode
2684 will never see a return from this function call. */
2686 SignalException (int exception
,...)
2688 /* Ensure that any active atomic read/modify/write operation will fail: */
2691 switch (exception
) {
2692 /* TODO: For testing purposes I have been ignoring TRAPs. In
2693 reality we should either simulate them, or allow the user to
2694 ignore them at run-time. */
2696 sim_warning("Ignoring instruction TRAP (PC 0x%08X%08X)",WORD64HI(IPC
),WORD64LO(IPC
));
2699 case ReservedInstruction
:
2702 unsigned int instruction
;
2703 va_start(ap
,exception
);
2704 instruction
= va_arg(ap
,unsigned int);
2706 /* Provide simple monitor support using ReservedInstruction
2707 exceptions. The following code simulates the fixed vector
2708 entry points into the IDT monitor by causing a simulator
2709 trap, performing the monitor operation, and returning to
2710 the address held in the $ra register (standard PCS return
2711 address). This means we only need to pre-load the vector
2712 space with suitable instruction values. For systems were
2713 actual trap instructions are used, we would not need to
2714 perform this magic. */
2715 if ((instruction
& ~RSVD_INSTRUCTION_AMASK
) == RSVD_INSTRUCTION
) {
2716 sim_monitor(instruction
& RSVD_INSTRUCTION_AMASK
);
2717 PC
= RA
; /* simulate the return from the vector entry */
2718 /* NOTE: This assumes that a branch-and-link style
2719 instruction was used to enter the vector (which is the
2720 case with the current IDT monitor). */
2721 break; /* out of the switch statement */
2723 /* Look for the mips16 entry and exit instructions, and
2724 simulate a handler for them. */
2725 else if ((IPC
& 1) != 0
2726 && (instruction
& 0xf81f) == 0xe809
2727 && (instruction
& 0x0c0) != 0x0c0) {
2728 mips16_entry (instruction
);
2730 } /* else fall through to normal exception processing */
2731 sim_warning("ReservedInstruction 0x%08X at IPC = 0x%08X%08X",instruction
,WORD64HI(IPC
),WORD64LO(IPC
));
2736 if (exception
!= BreakPoint
)
2737 callback
->printf_filtered(callback
,"DBG: SignalException(%d) IPC = 0x%08X%08X\n",exception
,WORD64HI(IPC
),WORD64LO(IPC
));
2739 /* Store exception code into current exception id variable (used
2742 /* TODO: If not simulating exceptions then stop the simulator
2743 execution. At the moment we always stop the simulation. */
2744 state
|= (simSTOP
| simEXCEPTION
);
2746 /* Keep a copy of the current A0 in-case this is the program exit
2748 if (exception
== BreakPoint
) {
2750 unsigned int instruction
;
2751 va_start(ap
,exception
);
2752 instruction
= va_arg(ap
,unsigned int);
2754 /* Check for our special terminating BREAK: */
2755 if ((instruction
& 0x03FFFFC0) == 0x03ff0000) {
2756 rcexit
= (unsigned int)(A0
& 0xFFFFFFFF);
2757 state
&= ~simEXCEPTION
;
2762 /* Store exception code into current exception id variable (used
2764 CAUSE
= (exception
<< 2);
2765 if (state
& simDELAYSLOT
) {
2767 EPC
= (IPC
- 4); /* reference the branch instruction */
2770 /* The following is so that the simulator will continue from the
2771 exception address on breakpoint operations. */
2775 case SimulatorFault
:
2779 va_start(ap
,exception
);
2780 msg
= va_arg(ap
,char *);
2781 fprintf(stderr
,"FATAL: Simulator error \"%s\"\n",msg
);
2790 #if defined(WARN_RESULT)
2791 /* Description from page A-26 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2792 /* This function indicates that the result of the operation is
2793 undefined. However, this should not affect the instruction
2794 stream. All that is meant to happen is that the destination
2795 register is set to an undefined result. To keep the simulator
2796 simple, we just don't bother updating the destination register, so
2797 the overall result will be undefined. If desired we can stop the
2798 simulator by raising a pseudo-exception. */
2802 sim_warning("UndefinedResult: IPC = 0x%08X%08X",WORD64HI(IPC
),WORD64LO(IPC
));
2803 #if 0 /* Disabled for the moment, since it actually happens a lot at the moment. */
2808 #endif /* WARN_RESULT */
2811 CacheOp(op
,pAddr
,vAddr
,instruction
)
2815 unsigned int instruction
;
2817 #if 1 /* stop warning message being displayed (we should really just remove the code) */
2818 static int icache_warning
= 1;
2819 static int dcache_warning
= 1;
2821 static int icache_warning
= 0;
2822 static int dcache_warning
= 0;
2825 /* If CP0 is not useable (User or Supervisor mode) and the CP0
2826 enable bit in the Status Register is clear - a coprocessor
2827 unusable exception is taken. */
2829 callback
->printf_filtered(callback
,"TODO: Cache availability checking (PC = 0x%08X%08X)\n",WORD64HI(IPC
),WORD64LO(IPC
));
2833 case 0: /* instruction cache */
2835 case 0: /* Index Invalidate */
2836 case 1: /* Index Load Tag */
2837 case 2: /* Index Store Tag */
2838 case 4: /* Hit Invalidate */
2840 case 6: /* Hit Writeback */
2841 if (!icache_warning
)
2843 sim_warning("Instruction CACHE operation %d to be coded",(op
>> 2));
2849 SignalException(ReservedInstruction
,instruction
);
2854 case 1: /* data cache */
2856 case 0: /* Index Writeback Invalidate */
2857 case 1: /* Index Load Tag */
2858 case 2: /* Index Store Tag */
2859 case 3: /* Create Dirty */
2860 case 4: /* Hit Invalidate */
2861 case 5: /* Hit Writeback Invalidate */
2862 case 6: /* Hit Writeback */
2863 if (!dcache_warning
)
2865 sim_warning("Data CACHE operation %d to be coded",(op
>> 2));
2871 SignalException(ReservedInstruction
,instruction
);
2876 default: /* unrecognised cache ID */
2877 SignalException(ReservedInstruction
,instruction
);
2884 /*-- FPU support routines ---------------------------------------------------*/
2886 #if defined(HASFPU) /* Only needed when building FPU aware simulators */
2889 #define SizeFGR() (GPRLEN)
2891 /* They depend on the CPU being simulated */
2892 #define SizeFGR() ((PROCESSOR_64BIT && ((SR & status_FR) == 1)) ? 64 : 32)
2895 /* Numbers are held in normalized form. The SINGLE and DOUBLE binary
2896 formats conform to ANSI/IEEE Std 754-1985. */
2897 /* SINGLE precision floating:
2898 * seeeeeeeefffffffffffffffffffffff
2900 * e = 8bits = exponent
2901 * f = 23bits = fraction
2903 /* SINGLE precision fixed:
2904 * siiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
2906 * i = 31bits = integer
2908 /* DOUBLE precision floating:
2909 * seeeeeeeeeeeffffffffffffffffffffffffffffffffffffffffffffffffffff
2911 * e = 11bits = exponent
2912 * f = 52bits = fraction
2914 /* DOUBLE precision fixed:
2915 * siiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
2917 * i = 63bits = integer
2920 /* Extract sign-bit: */
2921 #define FP_S_s(v) (((v) & ((unsigned)1 << 31)) ? 1 : 0)
2922 #define FP_D_s(v) (((v) & ((uword64)1 << 63)) ? 1 : 0)
2923 /* Extract biased exponent: */
2924 #define FP_S_be(v) (((v) >> 23) & 0xFF)
2925 #define FP_D_be(v) (((v) >> 52) & 0x7FF)
2926 /* Extract unbiased Exponent: */
2927 #define FP_S_e(v) (FP_S_be(v) - 0x7F)
2928 #define FP_D_e(v) (FP_D_be(v) - 0x3FF)
2929 /* Extract complete fraction field: */
2930 #define FP_S_f(v) ((v) & ~((unsigned)0x1FF << 23))
2931 #define FP_D_f(v) ((v) & ~((uword64)0xFFF << 52))
2932 /* Extract numbered fraction bit: */
2933 #define FP_S_fb(b,v) (((v) & (1 << (23 - (b)))) ? 1 : 0)
2934 #define FP_D_fb(b,v) (((v) & (1 << (52 - (b)))) ? 1 : 0)
2936 /* Explicit QNaN values used when value required: */
2937 #define FPQNaN_SINGLE (0x7FBFFFFF)
2938 #define FPQNaN_WORD (0x7FFFFFFF)
2939 #define FPQNaN_DOUBLE (((uword64)0x7FF7FFFF << 32) | 0xFFFFFFFF)
2940 #define FPQNaN_LONG (((uword64)0x7FFFFFFF << 32) | 0xFFFFFFFF)
2942 /* Explicit Infinity values used when required: */
2943 #define FPINF_SINGLE (0x7F800000)
2944 #define FPINF_DOUBLE (((uword64)0x7FF00000 << 32) | 0x00000000)
2946 #if 1 /* def DEBUG */
2947 #define RMMODE(v) (((v) == FP_RM_NEAREST) ? "Round" : (((v) == FP_RM_TOZERO) ? "Trunc" : (((v) == FP_RM_TOPINF) ? "Ceil" : "Floor")))
2948 #define DOFMT(v) (((v) == fmt_single) ? "single" : (((v) == fmt_double) ? "double" : (((v) == fmt_word) ? "word" : (((v) == fmt_long) ? "long" : (((v) == fmt_unknown) ? "<unknown>" : (((v) == fmt_uninterpreted) ? "<uninterpreted>" : "<format error>"))))))
2959 /* Treat unused register values, as fixed-point 64bit values: */
2960 if ((fmt
== fmt_uninterpreted
) || (fmt
== fmt_unknown
))
2962 /* If request to read data as "uninterpreted", then use the current
2964 fmt
= fpr_state
[fpr
];
2969 /* For values not yet accessed, set to the desired format: */
2970 if (fpr_state
[fpr
] == fmt_uninterpreted
) {
2971 fpr_state
[fpr
] = fmt
;
2973 printf("DBG: Register %d was fmt_uninterpreted. Now %s\n",fpr
,DOFMT(fmt
));
2976 if (fmt
!= fpr_state
[fpr
]) {
2977 sim_warning("FPR %d (format %s) being accessed with format %s - setting to unknown (PC = 0x%08X%08X)",fpr
,DOFMT(fpr_state
[fpr
]),DOFMT(fmt
),WORD64HI(IPC
),WORD64LO(IPC
));
2978 fpr_state
[fpr
] = fmt_unknown
;
2981 if (fpr_state
[fpr
] == fmt_unknown
) {
2982 /* Set QNaN value: */
2985 value
= FPQNaN_SINGLE
;
2989 value
= FPQNaN_DOUBLE
;
2993 value
= FPQNaN_WORD
;
2997 value
= FPQNaN_LONG
;
3004 } else if (SizeFGR() == 64) {
3008 value
= (FGR
[fpr
] & 0xFFFFFFFF);
3011 case fmt_uninterpreted
:
3025 value
= (FGR
[fpr
] & 0xFFFFFFFF);
3028 case fmt_uninterpreted
:
3031 if ((fpr
& 1) == 0) { /* even registers only */
3032 value
= ((((uword64
)FGR
[fpr
+1]) << 32) | (FGR
[fpr
] & 0xFFFFFFFF));
3034 SignalException (ReservedInstruction
, 0);
3045 SignalException(SimulatorFault
,"Unrecognised FP format in ValueFPR()");
3048 printf("DBG: ValueFPR: fpr = %d, fmt = %s, value = 0x%08X%08X : PC = 0x%08X%08X : SizeFGR() = %d\n",fpr
,DOFMT(fmt
),WORD64HI(value
),WORD64LO(value
),WORD64HI(IPC
),WORD64LO(IPC
),SizeFGR());
3055 StoreFPR(fpr
,fmt
,value
)
3063 printf("DBG: StoreFPR: fpr = %d, fmt = %s, value = 0x%08X%08X : PC = 0x%08X%08X : SizeFGR() = %d\n",fpr
,DOFMT(fmt
),WORD64HI(value
),WORD64LO(value
),WORD64HI(IPC
),WORD64LO(IPC
),SizeFGR());
3066 if (SizeFGR() == 64) {
3070 FGR
[fpr
] = (((uword64
)0xDEADC0DE << 32) | (value
& 0xFFFFFFFF));
3071 fpr_state
[fpr
] = fmt
;
3074 case fmt_uninterpreted
:
3078 fpr_state
[fpr
] = fmt
;
3082 fpr_state
[fpr
] = fmt_unknown
;
3090 FGR
[fpr
] = (value
& 0xFFFFFFFF);
3091 fpr_state
[fpr
] = fmt
;
3094 case fmt_uninterpreted
:
3097 if ((fpr
& 1) == 0) { /* even register number only */
3098 FGR
[fpr
+1] = (value
>> 32);
3099 FGR
[fpr
] = (value
& 0xFFFFFFFF);
3100 fpr_state
[fpr
+ 1] = fmt
;
3101 fpr_state
[fpr
] = fmt
;
3103 fpr_state
[fpr
] = fmt_unknown
;
3104 fpr_state
[fpr
+ 1] = fmt_unknown
;
3105 SignalException (ReservedInstruction
, 0);
3110 fpr_state
[fpr
] = fmt_unknown
;
3115 #if defined(WARN_RESULT)
3118 #endif /* WARN_RESULT */
3121 SignalException(SimulatorFault
,"Unrecognised FP format in StoreFPR()");
3124 printf("DBG: StoreFPR: fpr[%d] = 0x%08X%08X (format %s)\n",fpr
,WORD64HI(FGR
[fpr
]),WORD64LO(FGR
[fpr
]),DOFMT(fmt
));
3137 /* Check if (((E - bias) == (E_max + 1)) && (fraction != 0)). We
3138 know that the exponent field is biased... we we cheat and avoid
3139 removing the bias value. */
3142 boolean
= ((FP_S_be(op
) == 0xFF) && (FP_S_f(op
) != 0));
3143 /* We could use "FP_S_fb(1,op)" to ascertain whether we are
3144 dealing with a SNaN or QNaN */
3147 boolean
= ((FP_D_be(op
) == 0x7FF) && (FP_D_f(op
) != 0));
3148 /* We could use "FP_S_fb(1,op)" to ascertain whether we are
3149 dealing with a SNaN or QNaN */
3152 boolean
= (op
== FPQNaN_WORD
);
3155 boolean
= (op
== FPQNaN_LONG
);
3160 printf("DBG: NaN: returning %d for 0x%08X%08X (format = %s)\n",boolean
,WORD64HI(op
),WORD64LO(op
),DOFMT(fmt
));
3174 printf("DBG: Infinity: format %s 0x%08X%08X (PC = 0x%08X%08X)\n",DOFMT(fmt
),WORD64HI(op
),WORD64LO(op
),WORD64HI(IPC
),WORD64LO(IPC
));
3177 /* Check if (((E - bias) == (E_max + 1)) && (fraction == 0)). We
3178 know that the exponent field is biased... we we cheat and avoid
3179 removing the bias value. */
3182 boolean
= ((FP_S_be(op
) == 0xFF) && (FP_S_f(op
) == 0));
3185 boolean
= ((FP_D_be(op
) == 0x7FF) && (FP_D_f(op
) == 0));
3188 printf("DBG: TODO: unrecognised format (%s) for Infinity check\n",DOFMT(fmt
));
3193 printf("DBG: Infinity: returning %d for 0x%08X%08X (format = %s)\n",boolean
,WORD64HI(op
),WORD64LO(op
),DOFMT(fmt
));
3207 /* Argument checking already performed by the FPCOMPARE code */
3210 printf("DBG: Less: %s: op1 = 0x%08X%08X : op2 = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op1
),WORD64LO(op1
),WORD64HI(op2
),WORD64LO(op2
));
3213 /* The format type should already have been checked: */
3217 unsigned int wop1
= (unsigned int)op1
;
3218 unsigned int wop2
= (unsigned int)op2
;
3219 boolean
= (*(float *)&wop1
< *(float *)&wop2
);
3223 boolean
= (*(double *)&op1
< *(double *)&op2
);
3228 printf("DBG: Less: returning %d (format = %s)\n",boolean
,DOFMT(fmt
));
3242 /* Argument checking already performed by the FPCOMPARE code */
3245 printf("DBG: Equal: %s: op1 = 0x%08X%08X : op2 = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op1
),WORD64LO(op1
),WORD64HI(op2
),WORD64LO(op2
));
3248 /* The format type should already have been checked: */
3251 boolean
= ((op1
& 0xFFFFFFFF) == (op2
& 0xFFFFFFFF));
3254 boolean
= (op1
== op2
);
3259 printf("DBG: Equal: returning %d (format = %s)\n",boolean
,DOFMT(fmt
));
3266 AbsoluteValue(op
,fmt
)
3273 printf("DBG: AbsoluteValue: %s: op = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op
),WORD64LO(op
));
3276 /* The format type should already have been checked: */
3280 unsigned int wop
= (unsigned int)op
;
3281 float tmp
= ((float)fabs((double)*(float *)&wop
));
3282 result
= (uword64
)*(unsigned int *)&tmp
;
3287 double tmp
= (fabs(*(double *)&op
));
3288 result
= *(uword64
*)&tmp
;
3303 printf("DBG: Negate: %s: op = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op
),WORD64LO(op
));
3306 /* The format type should already have been checked: */
3310 unsigned int wop
= (unsigned int)op
;
3311 float tmp
= ((float)0.0 - *(float *)&wop
);
3312 result
= (uword64
)*(unsigned int *)&tmp
;
3317 double tmp
= ((double)0.0 - *(double *)&op
);
3318 result
= *(uword64
*)&tmp
;
3335 printf("DBG: Add: %s: op1 = 0x%08X%08X : op2 = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op1
),WORD64LO(op1
),WORD64HI(op2
),WORD64LO(op2
));
3338 /* The registers must specify FPRs valid for operands of type
3339 "fmt". If they are not valid, the result is undefined. */
3341 /* The format type should already have been checked: */
3345 unsigned int wop1
= (unsigned int)op1
;
3346 unsigned int wop2
= (unsigned int)op2
;
3347 float tmp
= (*(float *)&wop1
+ *(float *)&wop2
);
3348 result
= (uword64
)*(unsigned int *)&tmp
;
3353 double tmp
= (*(double *)&op1
+ *(double *)&op2
);
3354 result
= *(uword64
*)&tmp
;
3360 printf("DBG: Add: returning 0x%08X%08X (format = %s)\n",WORD64HI(result
),WORD64LO(result
),DOFMT(fmt
));
3375 printf("DBG: Sub: %s: op1 = 0x%08X%08X : op2 = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op1
),WORD64LO(op1
),WORD64HI(op2
),WORD64LO(op2
));
3378 /* The registers must specify FPRs valid for operands of type
3379 "fmt". If they are not valid, the result is undefined. */
3381 /* The format type should already have been checked: */
3385 unsigned int wop1
= (unsigned int)op1
;
3386 unsigned int wop2
= (unsigned int)op2
;
3387 float tmp
= (*(float *)&wop1
- *(float *)&wop2
);
3388 result
= (uword64
)*(unsigned int *)&tmp
;
3393 double tmp
= (*(double *)&op1
- *(double *)&op2
);
3394 result
= *(uword64
*)&tmp
;
3400 printf("DBG: Sub: returning 0x%08X%08X (format = %s)\n",WORD64HI(result
),WORD64LO(result
),DOFMT(fmt
));
3407 Multiply(op1
,op2
,fmt
)
3415 printf("DBG: Multiply: %s: op1 = 0x%08X%08X : op2 = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op1
),WORD64LO(op1
),WORD64HI(op2
),WORD64LO(op2
));
3418 /* The registers must specify FPRs valid for operands of type
3419 "fmt". If they are not valid, the result is undefined. */
3421 /* The format type should already have been checked: */
3425 unsigned int wop1
= (unsigned int)op1
;
3426 unsigned int wop2
= (unsigned int)op2
;
3427 float tmp
= (*(float *)&wop1
* *(float *)&wop2
);
3428 result
= (uword64
)*(unsigned int *)&tmp
;
3433 double tmp
= (*(double *)&op1
* *(double *)&op2
);
3434 result
= *(uword64
*)&tmp
;
3440 printf("DBG: Multiply: returning 0x%08X%08X (format = %s)\n",WORD64HI(result
),WORD64LO(result
),DOFMT(fmt
));
3455 printf("DBG: Divide: %s: op1 = 0x%08X%08X : op2 = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op1
),WORD64LO(op1
),WORD64HI(op2
),WORD64LO(op2
));
3458 /* The registers must specify FPRs valid for operands of type
3459 "fmt". If they are not valid, the result is undefined. */
3461 /* The format type should already have been checked: */
3465 unsigned int wop1
= (unsigned int)op1
;
3466 unsigned int wop2
= (unsigned int)op2
;
3467 float tmp
= (*(float *)&wop1
/ *(float *)&wop2
);
3468 result
= (uword64
)*(unsigned int *)&tmp
;
3473 double tmp
= (*(double *)&op1
/ *(double *)&op2
);
3474 result
= *(uword64
*)&tmp
;
3480 printf("DBG: Divide: returning 0x%08X%08X (format = %s)\n",WORD64HI(result
),WORD64LO(result
),DOFMT(fmt
));
3494 printf("DBG: Recip: %s: op = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op
),WORD64LO(op
));
3497 /* The registers must specify FPRs valid for operands of type
3498 "fmt". If they are not valid, the result is undefined. */
3500 /* The format type should already have been checked: */
3504 unsigned int wop
= (unsigned int)op
;
3505 float tmp
= ((float)1.0 / *(float *)&wop
);
3506 result
= (uword64
)*(unsigned int *)&tmp
;
3511 double tmp
= ((double)1.0 / *(double *)&op
);
3512 result
= *(uword64
*)&tmp
;
3518 printf("DBG: Recip: returning 0x%08X%08X (format = %s)\n",WORD64HI(result
),WORD64LO(result
),DOFMT(fmt
));
3532 printf("DBG: SquareRoot: %s: op = 0x%08X%08X\n",DOFMT(fmt
),WORD64HI(op
),WORD64LO(op
));
3535 /* The registers must specify FPRs valid for operands of type
3536 "fmt". If they are not valid, the result is undefined. */
3538 /* The format type should already have been checked: */
3542 unsigned int wop
= (unsigned int)op
;
3544 float tmp
= ((float)sqrt((double)*(float *)&wop
));
3545 result
= (uword64
)*(unsigned int *)&tmp
;
3547 /* TODO: Provide square-root */
3548 result
= (uword64
)0;
3555 double tmp
= (sqrt(*(double *)&op
));
3556 result
= *(uword64
*)&tmp
;
3558 /* TODO: Provide square-root */
3559 result
= (uword64
)0;
3566 printf("DBG: SquareRoot: returning 0x%08X%08X (format = %s)\n",WORD64HI(result
),WORD64LO(result
),DOFMT(fmt
));
3573 Convert(rm
,op
,from
,to
)
3582 printf("DBG: Convert: mode %s : op 0x%08X%08X : from %s : to %s : (PC = 0x%08X%08X)\n",RMMODE(rm
),WORD64HI(op
),WORD64LO(op
),DOFMT(from
),DOFMT(to
),WORD64HI(IPC
),WORD64LO(IPC
));
3585 /* The value "op" is converted to the destination format, rounding
3586 using mode "rm". When the destination is a fixed-point format,
3587 then a source value of Infinity, NaN or one which would round to
3588 an integer outside the fixed point range then an IEEE Invalid
3589 Operation condition is raised. */
3596 tmp
= (float)(*(double *)&op
);
3600 tmp
= (float)((int)(op
& 0xFFFFFFFF));
3604 tmp
= (float)((word64
)op
);
3609 /* FIXME: This code is incorrect. The rounding mode does not
3610 round to integral values; it rounds to the nearest
3611 representable value in the format. */
3615 /* Round result to nearest representable value. When two
3616 representable values are equally near, round to the value
3617 that has a least significant bit of zero (i.e. is even). */
3619 tmp
= (float)anint((double)tmp
);
3621 /* TODO: Provide round-to-nearest */
3626 /* Round result to the value closest to, and not greater in
3627 magnitude than, the result. */
3629 tmp
= (float)aint((double)tmp
);
3631 /* TODO: Provide round-to-zero */
3636 /* Round result to the value closest to, and not less than,
3638 tmp
= (float)ceil((double)tmp
);
3642 /* Round result to the value closest to, and not greater than,
3644 tmp
= (float)floor((double)tmp
);
3649 result
= (uword64
)*(unsigned int *)&tmp
;
3661 unsigned int wop
= (unsigned int)op
;
3662 tmp
= (double)(*(float *)&wop
);
3667 xxx
= SIGNEXTEND((op
& 0xFFFFFFFF),32);
3672 tmp
= (double)((word64
)op
);
3677 /* FIXME: This code is incorrect. The rounding mode does not
3678 round to integral values; it rounds to the nearest
3679 representable value in the format. */
3684 tmp
= anint(*(double *)&tmp
);
3686 /* TODO: Provide round-to-nearest */
3692 tmp
= aint(*(double *)&tmp
);
3694 /* TODO: Provide round-to-zero */
3699 tmp
= ceil(*(double *)&tmp
);
3703 tmp
= floor(*(double *)&tmp
);
3708 result
= *(uword64
*)&tmp
;
3714 if (Infinity(op
,from
) || NaN(op
,from
) || (1 == 0/*TODO: check range */)) {
3715 printf("DBG: TODO: update FCSR\n");
3716 SignalException(FPE
);
3718 if (to
== fmt_word
) {
3723 unsigned int wop
= (unsigned int)op
;
3724 tmp
= (int)*((float *)&wop
);
3728 tmp
= (int)*((double *)&op
);
3730 printf("DBG: from double %.30f (0x%08X%08X) to word: 0x%08X\n",*((double *)&op
),WORD64HI(op
),WORD64LO(op
),tmp
);
3734 result
= (uword64
)tmp
;
3735 } else { /* fmt_long */
3740 unsigned int wop
= (unsigned int)op
;
3741 tmp
= (word64
)*((float *)&wop
);
3745 tmp
= (word64
)*((double *)&op
);
3748 result
= (uword64
)tmp
;
3755 printf("DBG: Convert: returning 0x%08X%08X (to format = %s)\n",WORD64HI(result
),WORD64LO(result
),DOFMT(to
));
3762 /*-- co-processor support routines ------------------------------------------*/
3765 CoProcPresent(coproc_number
)
3766 unsigned int coproc_number
;
3768 /* Return TRUE if simulator provides a model for the given co-processor number */
3773 COP_LW(coproc_num
,coproc_reg
,memword
)
3774 int coproc_num
, coproc_reg
;
3775 unsigned int memword
;
3777 switch (coproc_num
) {
3781 printf("DBG: COP_LW: memword = 0x%08X (uword64)memword = 0x%08X%08X\n",memword
,WORD64HI(memword
),WORD64LO(memword
));
3783 StoreFPR(coproc_reg
,fmt_word
,(uword64
)memword
);
3784 fpr_state
[coproc_reg
] = fmt_uninterpreted
;
3789 #if 0 /* this should be controlled by a configuration option */
3790 callback
->printf_filtered(callback
,"COP_LW(%d,%d,0x%08X) at IPC = 0x%08X%08X : TODO (architecture specific)\n",coproc_num
,coproc_reg
,memword
,WORD64HI(IPC
),WORD64LO(IPC
));
3799 COP_LD(coproc_num
,coproc_reg
,memword
)
3800 int coproc_num
, coproc_reg
;
3803 switch (coproc_num
) {
3806 StoreFPR(coproc_reg
,fmt_uninterpreted
,memword
);
3811 #if 0 /* this message should be controlled by a configuration option */
3812 callback
->printf_filtered(callback
,"COP_LD(%d,%d,0x%08X%08X) at IPC = 0x%08X%08X : TODO (architecture specific)\n",coproc_num
,coproc_reg
,WORD64HI(memword
),WORD64LO(memword
),WORD64HI(IPC
),WORD64LO(IPC
));
3821 COP_SW(coproc_num
,coproc_reg
)
3822 int coproc_num
, coproc_reg
;
3824 unsigned int value
= 0;
3827 switch (coproc_num
) {
3831 hold
= fpr_state
[coproc_reg
];
3832 fpr_state
[coproc_reg
] = fmt_word
;
3833 value
= (unsigned int)ValueFPR(coproc_reg
,fmt_uninterpreted
);
3834 fpr_state
[coproc_reg
] = hold
;
3837 value
= (unsigned int)ValueFPR(coproc_reg
,fpr_state
[coproc_reg
]);
3840 printf("DBG: COP_SW: reg in format %s (will be accessing as single)\n",DOFMT(fpr_state
[coproc_reg
]));
3842 value
= (unsigned int)ValueFPR(coproc_reg
,fmt_single
);
3849 #if 0 /* should be controlled by configuration option */
3850 callback
->printf_filtered(callback
,"COP_SW(%d,%d) at IPC = 0x%08X%08X : TODO (architecture specific)\n",coproc_num
,coproc_reg
,WORD64HI(IPC
),WORD64LO(IPC
));
3859 COP_SD(coproc_num
,coproc_reg
)
3860 int coproc_num
, coproc_reg
;
3863 switch (coproc_num
) {
3867 value
= ValueFPR(coproc_reg
,fmt_uninterpreted
);
3870 value
= ValueFPR(coproc_reg
,fpr_state
[coproc_reg
]);
3873 printf("DBG: COP_SD: reg in format %s (will be accessing as double)\n",DOFMT(fpr_state
[coproc_reg
]));
3875 value
= ValueFPR(coproc_reg
,fmt_double
);
3882 #if 0 /* should be controlled by configuration option */
3883 callback
->printf_filtered(callback
,"COP_SD(%d,%d) at IPC = 0x%08X%08X : TODO (architecture specific)\n",coproc_num
,coproc_reg
,WORD64HI(IPC
),WORD64LO(IPC
));
3892 decode_coproc(instruction
)
3893 unsigned int instruction
;
3895 int coprocnum
= ((instruction
>> 26) & 3);
3897 switch (coprocnum
) {
3898 case 0: /* standard CPU control and cache registers */
3901 Standard CP0 registers
3902 0 = Index R4000 VR4100 VR4300
3903 1 = Random R4000 VR4100 VR4300
3904 2 = EntryLo0 R4000 VR4100 VR4300
3905 3 = EntryLo1 R4000 VR4100 VR4300
3906 4 = Context R4000 VR4100 VR4300
3907 5 = PageMask R4000 VR4100 VR4300
3908 6 = Wired R4000 VR4100 VR4300
3909 8 = BadVAddr R4000 VR4100 VR4300
3910 9 = Count R4000 VR4100 VR4300
3911 10 = EntryHi R4000 VR4100 VR4300
3912 11 = Compare R4000 VR4100 VR4300
3913 12 = SR R4000 VR4100 VR4300
3914 13 = Cause R4000 VR4100 VR4300
3915 14 = EPC R4000 VR4100 VR4300
3916 15 = PRId R4000 VR4100 VR4300
3917 16 = Config R4000 VR4100 VR4300
3918 17 = LLAddr R4000 VR4100 VR4300
3919 18 = WatchLo R4000 VR4100 VR4300
3920 19 = WatchHi R4000 VR4100 VR4300
3921 20 = XContext R4000 VR4100 VR4300
3922 26 = PErr or ECC R4000 VR4100 VR4300
3923 27 = CacheErr R4000 VR4100
3924 28 = TagLo R4000 VR4100 VR4300
3925 29 = TagHi R4000 VR4100 VR4300
3926 30 = ErrorEPC R4000 VR4100 VR4300
3928 int code
= ((instruction
>> 21) & 0x1F);
3929 /* R4000 Users Manual (second edition) lists the following CP0
3931 DMFC0 Doubleword Move From CP0 (VR4100 = 01000000001tttttddddd00000000000)
3932 DMTC0 Doubleword Move To CP0 (VR4100 = 01000000101tttttddddd00000000000)
3933 MFC0 word Move From CP0 (VR4100 = 01000000000tttttddddd00000000000)
3934 MTC0 word Move To CP0 (VR4100 = 01000000100tttttddddd00000000000)
3935 TLBR Read Indexed TLB Entry (VR4100 = 01000010000000000000000000000001)
3936 TLBWI Write Indexed TLB Entry (VR4100 = 01000010000000000000000000000010)
3937 TLBWR Write Random TLB Entry (VR4100 = 01000010000000000000000000000110)
3938 TLBP Probe TLB for Matching Entry (VR4100 = 01000010000000000000000000001000)
3939 CACHE Cache operation (VR4100 = 101111bbbbbpppppiiiiiiiiiiiiiiii)
3940 ERET Exception return (VR4100 = 01000010000000000000000000011000)
3942 if (((code
== 0x00) || (code
== 0x04)) && ((instruction
& 0x7FF) == 0)) {
3943 int rt
= ((instruction
>> 16) & 0x1F);
3944 int rd
= ((instruction
>> 11) & 0x1F);
3945 if (code
== 0x00) { /* MF : move from */
3946 #if 0 /* message should be controlled by configuration option */
3947 callback
->printf_filtered(callback
,"Warning: MFC0 %d,%d not handled yet (architecture specific)\n",rt
,rd
);
3949 GPR
[rt
] = 0xDEADC0DE; /* CPR[0,rd] */
3950 } else { /* MT : move to */
3951 /* CPR[0,rd] = GPR[rt]; */
3952 #if 0 /* should be controlled by configuration option */
3953 callback
->printf_filtered(callback
,"Warning: MTC0 %d,%d not handled yet (architecture specific)\n",rt
,rd
);
3957 sim_warning("Unrecognised COP0 instruction 0x%08X at IPC = 0x%08X%08X : No handler present",instruction
,WORD64HI(IPC
),WORD64LO(IPC
));
3958 /* TODO: When executing an ERET or RFE instruction we should
3959 clear LLBIT, to ensure that any out-standing atomic
3960 read/modify/write sequence fails. */
3964 case 2: /* undefined co-processor */
3965 sim_warning("COP2 instruction 0x%08X at IPC = 0x%08X%08X : No handler present",instruction
,WORD64HI(IPC
),WORD64LO(IPC
));
3968 case 1: /* should not occur (FPU co-processor) */
3969 case 3: /* should not occur (FPU co-processor) */
3970 SignalException(ReservedInstruction
,instruction
);
3977 /*-- instruction simulation -------------------------------------------------*/
3982 unsigned int pipeline_count
= 1;
3985 if (membank
== NULL
) {
3986 printf("DBG: simulate() entered with no memory\n");
3991 #if 0 /* Disabled to check that everything works OK */
3992 /* The VR4300 seems to sign-extend the PC on its first
3993 access. However, this may just be because it is currently
3994 configured in 32bit mode. However... */
3995 PC
= SIGNEXTEND(PC
,32);
3998 /* main controlling loop */
4000 /* Fetch the next instruction from the simulator memory: */
4001 uword64 vaddr
= (uword64
)PC
;
4004 unsigned int instruction
;
4005 int dsstate
= (state
& simDELAYSLOT
);
4009 printf("DBG: state = 0x%08X :",state
);
4010 if (state
& simSTOP
) printf(" simSTOP");
4011 if (state
& simSTEP
) printf(" simSTEP");
4012 if (state
& simHALTEX
) printf(" simHALTEX");
4013 if (state
& simHALTIN
) printf(" simHALTIN");
4014 if (state
& simBE
) printf(" simBE");
4020 callback
->printf_filtered(callback
,"DBG: DSPC = 0x%08X%08X\n",WORD64HI(DSPC
),WORD64LO(DSPC
));
4023 if (AddressTranslation(PC
,isINSTRUCTION
,isLOAD
,&paddr
,&cca
,isTARGET
,isREAL
)) {
4024 if ((vaddr
& 1) == 0) {
4025 /* Copy the action of the LW instruction */
4026 unsigned int reverse
= (ReverseEndian
? (LOADDRMASK
>> 2) : 0);
4027 unsigned int bigend
= (BigEndianCPU
? (LOADDRMASK
>> 2) : 0);
4030 paddr
= ((paddr
& ~LOADDRMASK
) | ((paddr
& LOADDRMASK
) ^ (reverse
<< 2)));
4031 value
= LoadMemory(cca
,AccessLength_WORD
,paddr
,vaddr
,isINSTRUCTION
,isREAL
);
4032 byte
= ((vaddr
& LOADDRMASK
) ^ (bigend
<< 2));
4033 instruction
= ((value
>> (8 * byte
)) & 0xFFFFFFFF);
4035 /* Copy the action of the LH instruction */
4036 unsigned int reverse
= (ReverseEndian
? (LOADDRMASK
>> 1) : 0);
4037 unsigned int bigend
= (BigEndianCPU
? (LOADDRMASK
>> 1) : 0);
4040 paddr
= (((paddr
& ~ (uword64
) 1) & ~LOADDRMASK
)
4041 | (((paddr
& ~ (uword64
) 1) & LOADDRMASK
) ^ (reverse
<< 1)));
4042 value
= LoadMemory(cca
, AccessLength_HALFWORD
,
4043 paddr
& ~ (uword64
) 1,
4044 vaddr
, isINSTRUCTION
, isREAL
);
4045 byte
= (((vaddr
&~ (uword64
) 1) & LOADDRMASK
) ^ (bigend
<< 1));
4046 instruction
= ((value
>> (8 * byte
)) & 0xFFFF);
4049 fprintf(stderr
,"Cannot translate address for PC = 0x%08X%08X failed\n",WORD64HI(PC
),WORD64LO(PC
));
4054 callback
->printf_filtered(callback
,"DBG: fetched 0x%08X from PC = 0x%08X%08X\n",instruction
,WORD64HI(PC
),WORD64LO(PC
));
4057 #if !defined(FASTSIM) || defined(PROFILE)
4058 instruction_fetches
++;
4059 /* Since we increment above, the value should only ever be zero if
4060 we have just overflowed: */
4061 if (instruction_fetches
== 0)
4062 instruction_fetch_overflow
++;
4063 #if defined(PROFILE)
4064 if ((state
& simPROFILE
) && ((instruction_fetches
% profile_frequency
) == 0) && profile_hist
) {
4065 unsigned n
= ((unsigned int)(PC
- profile_minpc
) >> (profile_shift
+ 2));
4066 if (n
< profile_nsamples
) {
4067 /* NOTE: The counts for the profiling bins are only 16bits wide */
4068 if (profile_hist
[n
] != USHRT_MAX
)
4069 (profile_hist
[n
])++;
4072 #endif /* PROFILE */
4073 #endif /* !FASTSIM && PROFILE */
4075 IPC
= PC
; /* copy PC for this instruction */
4076 /* This is required by exception processing, to ensure that we can
4077 cope with exceptions in the delay slots of branches that may
4078 already have changed the PC. */
4079 if ((vaddr
& 1) == 0)
4080 PC
+= 4; /* increment ready for the next fetch */
4083 /* NOTE: If we perform a delay slot change to the PC, this
4084 increment is not requuired. However, it would make the
4085 simulator more complicated to try and avoid this small hit. */
4087 /* Currently this code provides a simple model. For more
4088 complicated models we could perform exception status checks at
4089 this point, and set the simSTOP state as required. This could
4090 also include processing any hardware interrupts raised by any
4091 I/O model attached to the simulator context.
4093 Support for "asynchronous" I/O events within the simulated world
4094 could be providing by managing a counter, and calling a I/O
4095 specific handler when a particular threshold is reached. On most
4096 architectures a decrement and check for zero operation is
4097 usually quicker than an increment and compare. However, the
4098 process of managing a known value decrement to zero, is higher
4099 than the cost of using an explicit value UINT_MAX into the
4100 future. Which system is used will depend on how complicated the
4101 I/O model is, and how much it is likely to affect the simulator
4104 If events need to be scheduled further in the future than
4105 UINT_MAX event ticks, then the I/O model should just provide its
4106 own counter, triggered from the event system. */
4108 /* MIPS pipeline ticks. To allow for future support where the
4109 pipeline hit of individual instructions is known, this control
4110 loop manages a "pipeline_count" variable. It is initialised to
4111 1 (one), and will only be changed by the simulator engine when
4112 executing an instruction. If the engine does not have access to
4113 pipeline cycle count information then all instructions will be
4114 treated as using a single cycle. NOTE: A standard system is not
4115 provided by the default simulator because different MIPS
4116 architectures have different cycle counts for the same
4120 /* Set previous flag, depending on current: */
4121 if (state
& simPCOC0
)
4125 /* and update the current value: */
4132 /* NOTE: For multi-context simulation environments the "instruction"
4133 variable should be local to this routine. */
4135 /* Shorthand accesses for engine. Note: If we wanted to use global
4136 variables (and a single-threaded simulator engine), then we can
4137 create the actual variables with these names. */
4139 if (!(state
& simSKIPNEXT
)) {
4140 /* Include the simulator engine */
4142 #if ((GPRLEN == 64) && !PROCESSOR_64BIT) || ((GPRLEN == 32) && PROCESSOR_64BIT)
4143 #error "Mismatch between run-time simulator code and simulation engine"
4146 #if defined(WARN_LOHI)
4147 /* Decrement the HI/LO validity ticks */
4152 #endif /* WARN_LOHI */
4154 #if defined(WARN_ZERO)
4155 /* For certain MIPS architectures, GPR[0] is hardwired to zero. We
4156 should check for it being changed. It is better doing it here,
4157 than within the simulator, since it will help keep the simulator
4160 sim_warning("The ZERO register has been updated with 0x%08X%08X (PC = 0x%08X%08X) (reset back to zero)",WORD64HI(ZERO
),WORD64LO(ZERO
),WORD64HI(IPC
),WORD64LO(IPC
));
4161 ZERO
= 0; /* reset back to zero before next instruction */
4163 #endif /* WARN_ZERO */
4164 } else /* simSKIPNEXT check */
4165 state
&= ~simSKIPNEXT
;
4167 /* If the delay slot was active before the instruction is
4168 executed, then update the PC to its new value: */
4171 printf("DBG: dsstate set before instruction execution - updating PC to 0x%08X%08X\n",WORD64HI(DSPC
),WORD64LO(DSPC
));
4174 state
&= ~(simDELAYSLOT
| simJALDELAYSLOT
);
4177 if (MIPSISA
< 4) { /* The following is only required on pre MIPS IV processors: */
4178 /* Deal with pending register updates: */
4180 printf("DBG: EMPTY BEFORE pending_in = %d, pending_out = %d, pending_total = %d\n",pending_in
,pending_out
,pending_total
);
4182 if (pending_out
!= pending_in
) {
4184 int index
= pending_out
;
4185 int total
= pending_total
;
4186 if (pending_total
== 0) {
4187 fprintf(stderr
,"FATAL: Mis-match on pending update pointers\n");
4190 for (loop
= 0; (loop
< total
); loop
++) {
4192 printf("DBG: BEFORE index = %d, loop = %d\n",index
,loop
);
4194 if (pending_slot_reg
[index
] != (LAST_EMBED_REGNUM
+ 1)) {
4196 printf("pending_slot_count[%d] = %d\n",index
,pending_slot_count
[index
]);
4198 if (--(pending_slot_count
[index
]) == 0) {
4200 printf("pending_slot_reg[%d] = %d\n",index
,pending_slot_reg
[index
]);
4201 printf("pending_slot_value[%d] = 0x%08X%08X\n",index
,WORD64HI(pending_slot_value
[index
]),WORD64LO(pending_slot_value
[index
]));
4203 if (pending_slot_reg
[index
] == COCIDX
) {
4204 SETFCC(0,((FCR31
& (1 << 23)) ? 1 : 0));
4206 registers
[pending_slot_reg
[index
]] = pending_slot_value
[index
];
4208 /* The only time we have PENDING updates to FPU
4209 registers, is when performing binary transfers. This
4210 means we should update the register type field. */
4211 if ((pending_slot_reg
[index
] >= FGRIDX
) && (pending_slot_reg
[index
] < (FGRIDX
+ 32)))
4212 fpr_state
[pending_slot_reg
[index
] - FGRIDX
] = fmt_uninterpreted
;
4216 printf("registers[%d] = 0x%08X%08X\n",pending_slot_reg
[index
],WORD64HI(registers
[pending_slot_reg
[index
]]),WORD64LO(registers
[pending_slot_reg
[index
]]));
4218 pending_slot_reg
[index
] = (LAST_EMBED_REGNUM
+ 1);
4220 if (pending_out
== PSLOTS
)
4226 printf("DBG: AFTER index = %d, loop = %d\n",index
,loop
);
4229 if (index
== PSLOTS
)
4234 printf("DBG: EMPTY AFTER pending_in = %d, pending_out = %d, pending_total = %d\n",pending_in
,pending_out
,pending_total
);
4238 #if !defined(FASTSIM)
4239 pipeline_ticks
+= pipeline_count
;
4240 #endif /* FASTSIM */
4242 if (state
& simSTEP
)
4244 } while (!(state
& simSTOP
));
4247 if (membank
== NULL
) {
4248 printf("DBG: simulate() LEAVING with no memory\n");
4256 /*---------------------------------------------------------------------------*/
4257 /*> EOF interp.c <*/