2 /* Simulator for the MIPS architecture.
4 This file is part of the MIPS sim
6 THIS SOFTWARE IS NOT COPYRIGHTED
8 Cygnus offers the following for use in the public domain. Cygnus
9 makes no warranty with regard to the software or it's performance
10 and the user accepts the software "AS IS" with all faults.
12 CYGNUS DISCLAIMS ANY WARRANTIES, EXPRESS OR IMPLIED, WITH REGARD TO
13 THIS SOFTWARE INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
14 MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22 We only need to take account of the target endianness when moving data
23 between the simulator and the host. We do not need to worry about the
24 endianness of the host, since this sim code and GDB are executing in
27 The IDT monitor (found on the VR4300 board), seems to lie about
28 register contents. It seems to treat the registers as sign-extended
29 32-bit values. This cause *REAL* problems when single-stepping 64-bit
34 /* The TRACE manifests enable the provision of extra features. If they
35 are not defined then a simpler (quicker) simulator is constructed
36 without the required run-time checks, etc. */
37 #if 1 /* 0 to allow user build selection, 1 to force inclusion */
43 #include "sim-utils.h"
44 #include "sim-options.h"
45 #include "sim-assert.h"
67 #include "libiberty.h"
69 #include "callback.h" /* GDB simulator callback interface */
70 #include "remote-sim.h" /* GDB simulator interface */
78 char* pr_addr
PARAMS ((SIM_ADDR addr
));
79 char* pr_uword64
PARAMS ((uword64 addr
));
82 /* Get the simulator engine description, without including the code: */
88 /* The following reserved instruction value is used when a simulator
89 trap is required. NOTE: Care must be taken, since this value may be
90 used in later revisions of the MIPS ISA. */
91 #define RSVD_INSTRUCTION (0x00000005)
92 #define RSVD_INSTRUCTION_MASK (0xFC00003F)
94 #define RSVD_INSTRUCTION_ARG_SHIFT 6
95 #define RSVD_INSTRUCTION_ARG_MASK 0xFFFFF
98 /* Bits in the Debug register */
99 #define Debug_DBD 0x80000000 /* Debug Branch Delay */
100 #define Debug_DM 0x40000000 /* Debug Mode */
101 #define Debug_DBp 0x00000002 /* Debug Breakpoint indicator */
107 /*---------------------------------------------------------------------------*/
108 /*-- GDB simulator interface ------------------------------------------------*/
109 /*---------------------------------------------------------------------------*/
111 static void dotrace
PARAMS((SIM_DESC sd
,FILE *tracefh
,int type
,SIM_ADDR address
,int width
,char *comment
,...));
112 static void ColdReset
PARAMS((SIM_DESC sd
));
113 static long getnum
PARAMS((SIM_DESC sd
, char *value
));
114 static unsigned int power2
PARAMS((unsigned int value
));
115 static void mips_size
PARAMS((SIM_DESC sd
, int n
));
117 /*---------------------------------------------------------------------------*/
121 #define DELAYSLOT() {\
122 if (STATE & simDELAYSLOT)\
123 sim_io_eprintf(sd,"Delay slot already activated (branch in delay slot?)\n");\
124 STATE |= simDELAYSLOT;\
127 #define JALDELAYSLOT() {\
129 STATE |= simJALDELAYSLOT;\
133 STATE &= ~simDELAYSLOT;\
134 STATE |= simSKIPNEXT;\
137 #define CANCELDELAYSLOT() {\
139 STATE &= ~(simDELAYSLOT | simJALDELAYSLOT);\
142 #define INDELAYSLOT() ((STATE & simDELAYSLOT) != 0)
143 #define INJALDELAYSLOT() ((STATE & simJALDELAYSLOT) != 0)
145 #define K0BASE (0x80000000)
146 #define K0SIZE (0x20000000)
147 #define K1BASE (0xA0000000)
148 #define K1SIZE (0x20000000)
150 /* Simple run-time monitor support */
151 static unsigned char *monitor
= NULL
;
152 static ut_reg monitor_base
= 0xBFC00000;
153 static unsigned monitor_size
= (1 << 11); /* power-of-2 */
155 static char *logfile
= NULL
; /* logging disabled by default */
156 static FILE *logfh
= NULL
;
159 static char *tracefile
= "trace.din"; /* default filename for trace log */
160 static FILE *tracefh
= NULL
;
161 static void open_trace
PARAMS((SIM_DESC sd
));
165 mips_option_handler (sd
, opt
, arg
)
175 tmp
= (char *)malloc(strlen(arg
) + 1);
177 sim_io_printf(sd
,"Failed to allocate buffer for logfile name \"%s\"\n",optarg
);
186 sim_io_printf(sd
,"Explicit model selection not yet available (Ignoring \"%s\")\n",optarg
);
191 /* Eventually the simTRACE flag could be treated as a toggle, to
192 allow external control of the program points being traced
193 (i.e. only from main onwards, excluding the run-time setup,
197 else if (strcmp (arg
, "yes") == 0)
199 else if (strcmp (arg
, "no") == 0)
203 fprintf (stderr
, "Unreconized trace option `%s'\n", arg
);
209 Simulator constructed without tracing support (for performance).\n\
210 Re-compile simulator with \"-DTRACE\" to enable this option.\n");
216 if (optarg
!= NULL
) {
218 tmp
= (char *)malloc(strlen(optarg
) + 1);
221 sim_io_printf(sd
,"Failed to allocate buffer for tracefile name \"%s\"\n",optarg
);
227 sim_io_printf(sd
,"Placing trace information into file \"%s\"\n",tracefile
);
238 static const OPTION mips_options
[] =
240 { {"log", required_argument
, NULL
,'l'},
241 'l', "FILE", "Log file",
242 mips_option_handler
},
243 { {"name", required_argument
, NULL
,'n'},
244 'n', "MODEL", "Select arch model",
245 mips_option_handler
},
246 { {"trace", optional_argument
, NULL
,'t'},
247 't', "on|off", "Enable tracing",
248 mips_option_handler
},
249 { {"tracefile",required_argument
, NULL
,'z'},
250 'z', "FILE", "Write trace to file",
251 mips_option_handler
},
252 { {NULL
, no_argument
, NULL
, 0}, '\0', NULL
, NULL
, NULL
}
256 int interrupt_pending
;
259 interrupt_event (SIM_DESC sd
, void *data
)
263 interrupt_pending
= 0;
264 SignalExceptionInterrupt ();
266 else if (!interrupt_pending
)
267 sim_events_schedule (sd
, 1, interrupt_event
, data
);
272 /*---------------------------------------------------------------------------*/
273 /*-- GDB simulator interface ------------------------------------------------*/
274 /*---------------------------------------------------------------------------*/
277 sim_open (kind
, cb
, abfd
, argv
)
283 SIM_DESC sd
= sim_state_alloc (kind
, cb
);
284 sim_cpu
*cpu
= STATE_CPU (sd
, 0);
286 /* FIXME: watchpoints code shouldn't need this */
287 STATE_WATCHPOINTS (sd
)->pc
= &(PC
);
288 STATE_WATCHPOINTS (sd
)->sizeof_pc
= sizeof (PC
);
289 STATE_WATCHPOINTS (sd
)->interrupt_handler
= interrupt_event
;
291 /* memory defaults (unless sim_size was here first) */
292 if (STATE_MEM_SIZE (sd
) == 0)
293 STATE_MEM_SIZE (sd
) = (2 << 20);
294 STATE_MEM_BASE (sd
) = K1BASE
;
298 if (sim_pre_argv_init (sd
, argv
[0]) != SIM_RC_OK
)
300 sim_add_option_table (sd
, mips_options
);
302 /* getopt will print the error message so we just have to exit if this fails.
303 FIXME: Hmmm... in the case of gdb we need getopt to call
305 if (sim_parse_args (sd
, argv
) != SIM_RC_OK
)
307 /* Uninstall the modules to avoid memory leaks,
308 file descriptor leaks, etc. */
309 sim_module_uninstall (sd
);
313 /* check for/establish the a reference program image */
314 if (sim_analyze_program (sd
,
315 (STATE_PROG_ARGV (sd
) != NULL
316 ? *STATE_PROG_ARGV (sd
)
320 sim_module_uninstall (sd
);
324 /* Configure/verify the target byte order and other runtime
325 configuration options */
326 if (sim_config (sd
) != SIM_RC_OK
)
328 sim_module_uninstall (sd
);
332 if (sim_post_argv_init (sd
) != SIM_RC_OK
)
334 /* Uninstall the modules to avoid memory leaks,
335 file descriptor leaks, etc. */
336 sim_module_uninstall (sd
);
340 /* verify assumptions the simulator made about the host type system.
341 This macro does not return if there is a problem */
342 if (sizeof(int) != (4 * sizeof(char)))
343 SignalExceptionSimulatorFault ("sizeof(int) != 4");
344 if (sizeof(word64
) != (8 * sizeof(char)))
345 SignalExceptionSimulatorFault ("sizeof(word64) != 8");
348 /* Check that the host FPU conforms to IEEE 754-1985 for the SINGLE
349 and DOUBLE binary formats. This is a bit nasty, requiring that we
350 trust the explicit manifests held in the source: */
351 /* TODO: We need to cope with the simulated target and the host not
352 having the same endianness. This will require the high and low
353 words of a (double) to be swapped when converting between the
354 host and the simulated target. */
362 s
.d
= (double)523.2939453125;
364 if ((s
.i
[0] == 0 && (s
.f
[1] != (float)4.01102924346923828125
365 || s
.i
[1] != 0x40805A5A))
366 || (s
.i
[1] == 0 && (s
.f
[0] != (float)4.01102924346923828125
367 || s
.i
[0] != 0x40805A5A)))
369 fprintf(stderr
,"The host executing the simulator does not seem to have IEEE 754-1985 std FP\n");
375 /* This is NASTY, in that we are assuming the size of specific
379 for (rn
= 0; (rn
< (LAST_EMBED_REGNUM
+ 1)); rn
++) {
381 cpu
->register_widths
[rn
] = GPRLEN
;
382 else if ((rn
>= FGRIDX
) && (rn
< (FGRIDX
+ 32)))
383 cpu
->register_widths
[rn
] = GPRLEN
;
384 else if ((rn
>= 33) && (rn
<= 37))
385 cpu
->register_widths
[rn
] = GPRLEN
;
386 else if ((rn
== SRIDX
) || (rn
== FCR0IDX
) || (rn
== FCR31IDX
) || ((rn
>= 72) && (rn
<= 89)))
387 cpu
->register_widths
[rn
] = 32;
389 cpu
->register_widths
[rn
] = 0;
391 /* start-sanitize-r5900 */
393 /* set the 5900 "upper" registers to 64 bits */
394 for( rn
= LAST_EMBED_REGNUM
+1; rn
< NUM_REGS
; rn
++)
395 cpu
->register_widths
[rn
] = 64;
396 /* end-sanitize-r5900 */
400 if (logfile
!= NULL
) {
401 if (strcmp(logfile
,"-") == 0)
404 logfh
= fopen(logfile
,"wb+");
406 sim_io_printf(sd
,"Failed to create file \"%s\", writing log information to stderr.\n",tracefile
);
412 /* FIXME: In the future both of these malloc's can be replaced by
413 calls to sim-core. */
415 /* If the host has "mmap" available we could use it to provide a
416 very large virtual address space for the simulator, since memory
417 would only be allocated within the "mmap" space as it is
418 accessed. This can also be linked to the architecture specific
419 support, required to simulate the MMU. */
420 mips_size(sd
, STATE_MEM_SIZE (sd
));
421 /* NOTE: The above will also have enabled any profiling state! */
423 /* Create the monitor address space as well */
424 monitor
= (unsigned char *)calloc(1,monitor_size
);
426 fprintf(stderr
,"Not enough VM for monitor simulation (%d bytes)\n",
430 if (STATE
& simTRACE
)
434 /* Write the monitor trap address handlers into the monitor (eeprom)
435 address space. This can only be done once the target endianness
436 has been determined. */
439 /* Entry into the IDT monitor is via fixed address vectors, and
440 not using machine instructions. To avoid clashing with use of
441 the MIPS TRAP system, we place our own (simulator specific)
442 "undefined" instructions into the relevant vector slots. */
443 for (loop
= 0; (loop
< monitor_size
); loop
+= 4) {
444 uword64 vaddr
= (monitor_base
+ loop
);
447 if (AddressTranslation(vaddr
, isDATA
, isSTORE
, &paddr
, &cca
, isTARGET
, isRAW
))
448 StoreMemory(cca
, AccessLength_WORD
,
449 (RSVD_INSTRUCTION
| (((loop
>> 2) & RSVD_INSTRUCTION_ARG_MASK
) << RSVD_INSTRUCTION_ARG_SHIFT
)),
450 0, paddr
, vaddr
, isRAW
);
452 /* The PMON monitor uses the same address space, but rather than
453 branching into it the address of a routine is loaded. We can
454 cheat for the moment, and direct the PMON routine to IDT style
455 instructions within the monitor space. This relies on the IDT
456 monitor not using the locations from 0xBFC00500 onwards as its
458 for (loop
= 0; (loop
< 24); loop
++)
460 uword64 vaddr
= (monitor_base
+ 0x500 + (loop
* 4));
463 unsigned int value
= ((0x500 - 8) / 8); /* default UNDEFINED reason code */
483 value
= ((0x500 - 16) / 8); /* not an IDT reason code */
486 case 8: /* cliexit */
490 case 11: /* flush_cache */
494 /* FIXME - should monitor_base be SIM_ADDR?? */
495 value
= ((unsigned int)monitor_base
+ (value
* 8));
496 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
))
497 StoreMemory(cca
,AccessLength_WORD
,value
,0,paddr
,vaddr
,isRAW
);
499 sim_io_error(sd
,"Failed to write to monitor space 0x%s",pr_addr(vaddr
));
501 /* The LSI MiniRISC PMON has its vectors at 0x200, not 0x500. */
503 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
))
504 StoreMemory(cca
,AccessLength_WORD
,value
,0,paddr
,vaddr
,isRAW
);
506 sim_io_error(sd
,"Failed to write to monitor space 0x%s",pr_addr(vaddr
));
518 tracefh
= fopen(tracefile
,"wb+");
521 sim_io_eprintf(sd
,"Failed to create file \"%s\", writing trace information to stderr.\n",tracefile
);
528 sim_close (sd
, quitting
)
533 printf("DBG: sim_close: entered (quitting = %d)\n",quitting
);
536 /* "quitting" is non-zero if we cannot hang on errors */
538 /* Ensure that any resources allocated through the callback
539 mechanism are released: */
540 sim_io_shutdown (sd
);
543 if (tracefh
!= NULL
&& tracefh
!= stderr
)
549 if (logfh
!= NULL
&& logfh
!= stdout
&& logfh
!= stderr
)
553 if (STATE_MEMORY (sd
) != NULL
)
554 free(STATE_MEMORY (sd
)); /* cfree not available on all hosts */
555 STATE_MEMORY (sd
) = NULL
;
562 sim_write (sd
,addr
,buffer
,size
)
565 unsigned char *buffer
;
569 uword64 vaddr
= (uword64
)addr
;
571 /* Return the number of bytes written, or zero if error. */
573 sim_io_printf(sd
,"sim_write(0x%s,buffer,%d);\n",pr_addr(addr
),size
);
576 /* We provide raw read and write routines, since we do not want to
577 count the GDB memory accesses in our statistics gathering. */
579 /* There is a lot of code duplication in the individual blocks
580 below, but the variables are declared locally to a block to give
581 the optimiser the best chance of improving the code. We have to
582 perform slow byte reads from the host memory, to ensure that we
583 get the data into the correct endianness for the (simulated)
584 target memory world. */
586 /* Mask count to get odd byte, odd halfword, and odd word out of the
587 way. We can then perform doubleword transfers to and from the
588 simulator memory for optimum performance. */
589 if (index
&& (index
& 1)) {
592 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
593 uword64 value
= ((uword64
)(*buffer
++));
594 StoreMemory(cca
,AccessLength_BYTE
,value
,0,paddr
,vaddr
,isRAW
);
597 index
&= ~1; /* logical operations usually quicker than arithmetic on RISC systems */
599 if (index
&& (index
& 2)) {
602 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
604 /* We need to perform the following magic to ensure that that
605 bytes are written into same byte positions in the target memory
606 world, regardless of the endianness of the host. */
608 value
= ((uword64
)(*buffer
++) << 8);
609 value
|= ((uword64
)(*buffer
++) << 0);
611 value
= ((uword64
)(*buffer
++) << 0);
612 value
|= ((uword64
)(*buffer
++) << 8);
614 StoreMemory(cca
,AccessLength_HALFWORD
,value
,0,paddr
,vaddr
,isRAW
);
619 if (index
&& (index
& 4)) {
622 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
625 value
= ((uword64
)(*buffer
++) << 24);
626 value
|= ((uword64
)(*buffer
++) << 16);
627 value
|= ((uword64
)(*buffer
++) << 8);
628 value
|= ((uword64
)(*buffer
++) << 0);
630 value
= ((uword64
)(*buffer
++) << 0);
631 value
|= ((uword64
)(*buffer
++) << 8);
632 value
|= ((uword64
)(*buffer
++) << 16);
633 value
|= ((uword64
)(*buffer
++) << 24);
635 StoreMemory(cca
,AccessLength_WORD
,value
,0,paddr
,vaddr
,isRAW
);
640 for (;index
; index
-= 8) {
643 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isRAW
)) {
646 value
= ((uword64
)(*buffer
++) << 56);
647 value
|= ((uword64
)(*buffer
++) << 48);
648 value
|= ((uword64
)(*buffer
++) << 40);
649 value
|= ((uword64
)(*buffer
++) << 32);
650 value
|= ((uword64
)(*buffer
++) << 24);
651 value
|= ((uword64
)(*buffer
++) << 16);
652 value
|= ((uword64
)(*buffer
++) << 8);
653 value
|= ((uword64
)(*buffer
++) << 0);
655 value
= ((uword64
)(*buffer
++) << 0);
656 value
|= ((uword64
)(*buffer
++) << 8);
657 value
|= ((uword64
)(*buffer
++) << 16);
658 value
|= ((uword64
)(*buffer
++) << 24);
659 value
|= ((uword64
)(*buffer
++) << 32);
660 value
|= ((uword64
)(*buffer
++) << 40);
661 value
|= ((uword64
)(*buffer
++) << 48);
662 value
|= ((uword64
)(*buffer
++) << 56);
664 StoreMemory(cca
,AccessLength_DOUBLEWORD
,value
,0,paddr
,vaddr
,isRAW
);
673 sim_read (sd
,addr
,buffer
,size
)
676 unsigned char *buffer
;
681 /* Return the number of bytes read, or zero if error. */
683 sim_io_printf(sd
,"sim_read(0x%s,buffer,%d);\n",pr_addr(addr
),size
);
686 /* TODO: Perform same optimisation as the sim_write() code
687 above. NOTE: This will require a bit more work since we will need
688 to ensure that the source physical address is doubleword aligned
689 before, and then deal with trailing bytes. */
690 for (index
= 0; (index
< size
); index
++) {
691 uword64 vaddr
,paddr
,value
;
693 vaddr
= (uword64
)addr
+ index
;
694 if (AddressTranslation(vaddr
,isDATA
,isLOAD
,&paddr
,&cca
,isTARGET
,isRAW
)) {
695 LoadMemory(&value
,NULL
,cca
,AccessLength_BYTE
,paddr
,vaddr
,isDATA
,isRAW
);
696 buffer
[index
] = (unsigned char)(value
&0xFF);
705 sim_store_register (sd
,rn
,memory
)
708 unsigned char *memory
;
710 sim_cpu
*cpu
= STATE_CPU (sd
, 0);
711 /* NOTE: gdb (the client) stores registers in target byte order
712 while the simulator uses host byte order */
714 sim_io_printf(sd
,"sim_store_register(%d,*memory=0x%s);\n",rn
,pr_addr(*((SIM_ADDR
*)memory
)));
717 /* Unfortunately this suffers from the same problem as the register
718 numbering one. We need to know what the width of each logical
719 register number is for the architecture being simulated. */
721 if (cpu
->register_widths
[rn
] == 0)
722 sim_io_eprintf(sd
,"Invalid register width for %d (register store ignored)\n",rn
);
723 /* start-sanitize-r5900 */
724 else if (rn
== REGISTER_SA
)
725 SA
= T2H_8(*(uword64
*)memory
);
726 else if (rn
> LAST_EMBED_REGNUM
)
727 cpu
->registers1
[rn
- LAST_EMBED_REGNUM
- 1] = T2H_8(*(uword64
*)memory
);
728 /* end-sanitize-r5900 */
729 else if (cpu
->register_widths
[rn
] == 32)
730 cpu
->registers
[rn
] = T2H_4 (*(unsigned int*)memory
);
732 cpu
->registers
[rn
] = T2H_8 (*(uword64
*)memory
);
738 sim_fetch_register (sd
,rn
,memory
)
741 unsigned char *memory
;
743 sim_cpu
*cpu
= STATE_CPU (sd
, 0);
744 /* NOTE: gdb (the client) stores registers in target byte order
745 while the simulator uses host byte order */
747 sim_io_printf(sd
,"sim_fetch_register(%d=0x%s,mem) : place simulator registers into memory\n",rn
,pr_addr(registers
[rn
]));
750 if (cpu
->register_widths
[rn
] == 0)
751 sim_io_eprintf(sd
,"Invalid register width for %d (register fetch ignored)\n",rn
);
752 /* start-sanitize-r5900 */
753 else if (rn
== REGISTER_SA
)
754 *((uword64
*)memory
) = H2T_8(SA
);
755 else if (rn
> LAST_EMBED_REGNUM
)
756 *((uword64
*)memory
) = H2T_8(cpu
->registers1
[rn
- LAST_EMBED_REGNUM
- 1]);
757 /* end-sanitize-r5900 */
758 else if (cpu
->register_widths
[rn
] == 32)
759 *((unsigned int *)memory
) = H2T_4 ((unsigned int)(cpu
->registers
[rn
] & 0xFFFFFFFF));
760 else /* 64bit register */
761 *((uword64
*)memory
) = H2T_8 (cpu
->registers
[rn
]);
768 sim_info (sd
,verbose
)
772 /* Accessed from the GDB "info files" command: */
773 if (STATE_VERBOSE_P (sd
) || verbose
)
776 sim_io_printf (sd
, "MIPS %d-bit %s endian simulator\n",
777 (PROCESSOR_64BIT
? 64 : 32),
778 (CURRENT_TARGET_BYTE_ORDER
== BIG_ENDIAN
? "Big" : "Little"));
780 sim_io_printf (sd
, "0x%08X bytes of memory at 0x%s\n",
782 pr_addr (STATE_MEM_BASE (sd
)));
784 #if !defined(FASTSIM)
786 /* at present this simulator executes one instruction per
787 simulator cycle. Consequently this data never changes */
788 if (instruction_fetch_overflow
!= 0)
789 sim_io_printf (sd
, "Instruction fetches = 0x%08X%08X\n",
790 instruction_fetch_overflow
, instruction_fetches
);
792 sim_io_printf (sd
, "Instruction fetches = %d\n", instruction_fetches
);
794 /* It would be a useful feature, if when performing multi-cycle
795 simulations (rather than single-stepping) we keep the start and
796 end times of the execution, so that we can give a performance
797 figure for the simulator. */
798 #endif /* !FASTSIM */
799 sim_io_printf (sd
, "Number of execution cycles = %ld\n",
800 (long) sim_events_time (sd
));
802 /* print information pertaining to MIPS ISA and architecture being simulated */
803 /* things that may be interesting */
804 /* instructions executed - if available */
805 /* cycles executed - if available */
806 /* pipeline stalls - if available */
807 /* virtual time taken */
809 /* profiling frequency */
817 sim_create_inferior (sd
, abfd
, argv
,env
)
825 printf("DBG: sim_create_inferior entered: start_address = 0x%s\n",
830 /* If we were providing a more complete I/O, co-processor or memory
831 simulation, we should perform any "device" initialisation at this
832 point. This can include pre-loading memory areas with particular
833 patterns (e.g. simulating ROM monitors). */
837 PC
= (unsigned64
) bfd_get_start_address(abfd
);
841 /* TODO: Sort this properly. SIM_ADDR may already be a 64bit value: */
842 PC
= SIGNEXTEND(bfd_get_start_address(abfd
),32);
845 /* Prepare to execute the program to be simulated */
846 /* argv and env are NULL terminated lists of pointers */
849 #if 0 /* def DEBUG */
850 sim_io_printf(sd
,"sim_create_inferior() : passed arguments ignored\n");
853 for (cptr
= argv
; (cptr
&& *cptr
); cptr
++)
854 printf("DBG: arg \"%s\"\n",*cptr
);
857 /* We should really place the argv slot values into the argument
858 registers, and onto the stack as required. However, this
859 assumes that we have a stack defined, which is not necessarily
860 true at the moment. */
866 typedef enum {e_terminate
,e_help
,e_setmemsize
,e_reset
} e_cmds
;
868 static struct t_sim_command
{
873 {e_help
, "help", ": Show MIPS simulator private commands"},
874 {e_setmemsize
,"set-memory-size","<n> : Specify amount of memory simulated"},
875 {e_reset
, "reset-system", ": Reset the simulated processor"},
880 sim_do_command (sd
,cmd
)
884 struct t_sim_command
*cptr
;
886 if (!(cmd
&& *cmd
!= '\0'))
889 /* NOTE: Accessed from the GDB "sim" commmand: */
890 for (cptr
= sim_commands
; cptr
&& cptr
->name
; cptr
++)
891 if (strncmp (cmd
, cptr
->name
, strlen(cptr
->name
)) == 0)
893 cmd
+= strlen(cptr
->name
);
895 case e_help
: /* no arguments */
897 struct t_sim_command
*lptr
;
898 sim_io_printf(sd
,"List of MIPS simulator commands:\n");
899 for (lptr
= sim_commands
; lptr
->name
; lptr
++)
900 sim_io_printf(sd
,"%s %s\n",lptr
->name
,lptr
->help
);
901 sim_args_command (sd
, "help");
905 case e_setmemsize
: /* memory size argument */
907 unsigned int newsize
= (unsigned int)getnum(sd
, cmd
);
908 mips_size(sd
, newsize
);
912 case e_reset
: /* no arguments */
914 /* NOTE: See the comments in sim_open() relating to device
919 sim_io_printf(sd
,"FATAL: Matched \"%s\", but failed to match command id %d.\n",cmd
,cptr
->id
);
927 /* try for a common command when the sim specific lookup fails */
928 if (sim_args_command (sd
, cmd
) != SIM_RC_OK
)
929 sim_io_printf(sd
,"Error: \"%s\" is not a valid MIPS simulator command.\n",cmd
);
935 /*---------------------------------------------------------------------------*/
936 /* NOTE: The following routines do not seem to be used by GDB at the
937 moment. However, they may be useful to the standalone simulator
942 mips_size(sd
, newsize
)
947 /* Used by "run", and internally, to set the simulated memory size */
949 sim_io_printf(sd
,"Zero not valid: Memory size still 0x%08X bytes\n",STATE_MEM_SIZE (sd
));
952 newsize
= power2(newsize
);
953 if (STATE_MEMORY (sd
) == NULL
)
954 new = (char *)calloc(64,(STATE_MEM_SIZE (sd
) / 64));
956 new = (char *)realloc(STATE_MEMORY (sd
),newsize
);
958 if (STATE_MEMORY (sd
) == NULL
)
959 sim_io_error(sd
,"Not enough VM for simulation memory of 0x%08X bytes",STATE_MEM_SIZE (sd
));
961 sim_io_eprintf(sd
,"Failed to resize memory (still 0x%08X bytes)\n",STATE_MEM_SIZE (sd
));
963 STATE_MEM_SIZE (sd
) = (unsigned)newsize
;
964 STATE_MEMORY (sd
) = new;
970 /*---------------------------------------------------------------------------*/
971 /*-- Private simulator support interface ------------------------------------*/
972 /*---------------------------------------------------------------------------*/
974 /* Simple monitor interface (currently setup for the IDT and PMON monitors) */
976 sim_monitor(sd
,reason
)
981 printf("DBG: sim_monitor: entered (reason = %d)\n",reason
);
984 /* The IDT monitor actually allows two instructions per vector
985 slot. However, the simulator currently causes a trap on each
986 individual instruction. We cheat, and lose the bottom bit. */
989 /* The following callback functions are available, however the
990 monitor we are simulating does not make use of them: get_errno,
991 isatty, lseek, rename, system, time and unlink */
993 case 6: /* int open(char *path,int flags) */
997 if (AddressTranslation(A0
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
))
998 V0
= sim_io_open(sd
,(char *)((int)paddr
),(int)A1
);
1000 sim_io_error(sd
,"Attempt to pass pointer that does not reference simulated memory");
1004 case 7: /* int read(int file,char *ptr,int len) */
1008 if (AddressTranslation(A1
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
))
1009 V0
= sim_io_read(sd
,(int)A0
,(char *)((int)paddr
),(int)A2
);
1011 sim_io_error(sd
,"Attempt to pass pointer that does not reference simulated memory");
1015 case 8: /* int write(int file,char *ptr,int len) */
1019 if (AddressTranslation(A1
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
))
1020 V0
= sim_io_write(sd
,(int)A0
,(const char *)((int)paddr
),(int)A2
);
1022 sim_io_error(sd
,"Attempt to pass pointer that does not reference simulated memory");
1026 case 10: /* int close(int file) */
1027 V0
= sim_io_close(sd
,(int)A0
);
1030 case 11: /* char inbyte(void) */
1033 if (sim_io_read_stdin(sd
,&tmp
,sizeof(char)) != sizeof(char)) {
1034 sim_io_error(sd
,"Invalid return from character read");
1042 case 12: /* void outbyte(char chr) : write a byte to "stdout" */
1044 char tmp
= (char)(A0
& 0xFF);
1045 sim_io_write_stdout(sd
,&tmp
,sizeof(char));
1049 case 17: /* void _exit() */
1050 sim_io_eprintf(sd
,"sim_monitor(17): _exit(int reason) to be coded\n");
1051 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
, sim_exited
,
1052 (unsigned int)(A0
& 0xFFFFFFFF));
1055 case 28 : /* PMON flush_cache */
1058 case 55: /* void get_mem_info(unsigned int *ptr) */
1059 /* in: A0 = pointer to three word memory location */
1060 /* out: [A0 + 0] = size */
1061 /* [A0 + 4] = instruction cache size */
1062 /* [A0 + 8] = data cache size */
1065 uword64 paddr
, value
;
1069 /* NOTE: We use RAW memory writes here, but since we are not
1070 gathering statistics for the monitor calls we are simulating,
1071 it is not an issue. */
1074 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isREAL
)) {
1075 value
= (uword64
)STATE_MEM_SIZE (sd
);
1076 StoreMemory(cca
,AccessLength_WORD
,value
,0,paddr
,vaddr
,isRAW
);
1077 /* We re-do the address translations, in-case the block
1078 overlaps a memory boundary: */
1080 vaddr
+= (AccessLength_WORD
+ 1);
1081 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isREAL
)) {
1082 StoreMemory(cca
,AccessLength_WORD
,0,value
,paddr
,vaddr
,isRAW
);
1083 vaddr
+= (AccessLength_WORD
+ 1);
1084 if (AddressTranslation(vaddr
,isDATA
,isSTORE
,&paddr
,&cca
,isTARGET
,isREAL
))
1085 StoreMemory(cca
,AccessLength_WORD
,value
,0,paddr
,vaddr
,isRAW
);
1094 sim_io_error(sd
,"Invalid pointer passed into monitor call");
1098 case 158 : /* PMON printf */
1099 /* in: A0 = pointer to format string */
1100 /* A1 = optional argument 1 */
1101 /* A2 = optional argument 2 */
1102 /* A3 = optional argument 3 */
1104 /* The following is based on the PMON printf source */
1108 /* This isn't the quickest way, since we call the host print
1109 routine for every character almost. But it does avoid
1110 having to allocate and manage a temporary string buffer. */
1111 if (AddressTranslation(A0
,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
)) {
1112 char *s
= (char *)((int)paddr
);
1113 signed_word
*ap
= &A1
; /* 1st argument */
1114 /* TODO: Include check that we only use three arguments (A1, A2 and A3) */
1118 enum {FMT_RJUST
, FMT_LJUST
, FMT_RJUST0
, FMT_CENTER
} fmt
= FMT_RJUST
;
1119 int width
= 0, trunc
= 0, haddot
= 0, longlong
= 0;
1122 if (strchr ("dobxXulscefg%", *s
))
1130 else if (*s
== '*') {
1135 } else if (*s
>= '1' && *s
<= '9') {
1138 for (t
= s
; isdigit (*s
); s
++);
1139 strncpy (tmp
, t
, s
- t
);
1141 n
= (unsigned int)strtol(tmp
,NULL
,10);
1147 } else if (*s
== '.')
1151 sim_io_printf(sd
,"%%");
1152 } else if (*s
== 's') {
1153 if ((int)*ap
!= 0) {
1154 if (AddressTranslation(*ap
++,isDATA
,isLOAD
,&paddr
,&cca
,isHOST
,isREAL
)) {
1155 char *p
= (char *)((int)paddr
);;
1156 sim_io_printf(sd
,p
);
1159 sim_io_error(sd
,"Attempt to pass pointer that does not reference simulated memory");
1163 sim_io_printf(sd
,"(null)");
1164 } else if (*s
== 'c') {
1166 sim_io_printf(sd
,"%c",n
);
1174 if (strchr ("dobxXu", *s
)) {
1175 word64 lv
= (word64
) *ap
++;
1177 sim_io_printf(sd
,"<binary not supported>");
1179 sprintf(tmp
,"%%%s%c",longlong
? "ll" : "",*s
);
1181 sim_io_printf(sd
,tmp
,lv
);
1183 sim_io_printf(sd
,tmp
,(int)lv
);
1185 } else if (strchr ("eEfgG", *s
)) {
1186 #ifdef _MSC_VER /* MSVC version 2.x can't convert from uword64 directly */
1187 double dbl
= (double)((word64
)*ap
++);
1189 double dbl
= (double)*ap
++;
1191 sprintf(tmp
,"%%%d.%d%c",width
,trunc
,*s
);
1192 sim_io_printf(sd
,tmp
,dbl
);
1198 sim_io_printf(sd
,"%c",*s
++);
1201 sim_io_error(sd
,"Attempt to pass pointer that does not reference simulated memory");
1206 sim_io_eprintf(sd
,"TODO: sim_monitor(%d) : PC = 0x%s\n",reason
,pr_addr(IPC
));
1207 sim_io_eprintf(sd
,"(Arguments : A0 = 0x%s : A1 = 0x%s : A2 = 0x%s : A3 = 0x%s)\n",pr_addr(A0
),pr_addr(A1
),pr_addr(A2
),pr_addr(A3
));
1213 /* Store a word into memory. */
1216 store_word (sd
, vaddr
, val
)
1224 if ((vaddr
& 3) != 0)
1225 SignalExceptionAddressStore ();
1228 if (AddressTranslation (vaddr
, isDATA
, isSTORE
, &paddr
, &uncached
,
1231 const uword64 mask
= 7;
1235 paddr
= (paddr
& ~mask
) | ((paddr
& mask
) ^ (ReverseEndian
<< 2));
1236 byte
= (vaddr
& mask
) ^ (BigEndianCPU
<< 2);
1237 memval
= ((uword64
) val
) << (8 * byte
);
1238 StoreMemory (uncached
, AccessLength_WORD
, memval
, 0, paddr
, vaddr
,
1244 /* Load a word from memory. */
1247 load_word (sd
, vaddr
)
1251 if ((vaddr
& 3) != 0)
1252 SignalExceptionAddressLoad ();
1258 if (AddressTranslation (vaddr
, isDATA
, isLOAD
, &paddr
, &uncached
,
1261 const uword64 mask
= 0x7;
1262 const unsigned int reverse
= ReverseEndian
? 1 : 0;
1263 const unsigned int bigend
= BigEndianCPU
? 1 : 0;
1267 paddr
= (paddr
& ~mask
) | ((paddr
& mask
) ^ (reverse
<< 2));
1268 LoadMemory (&memval
,NULL
,uncached
, AccessLength_WORD
, paddr
, vaddr
,
1270 byte
= (vaddr
& mask
) ^ (bigend
<< 2);
1271 return SIGNEXTEND (((memval
>> (8 * byte
)) & 0xffffffff), 32);
1278 /* Simulate the mips16 entry and exit pseudo-instructions. These
1279 would normally be handled by the reserved instruction exception
1280 code, but for ease of simulation we just handle them directly. */
1283 mips16_entry (sd
,insn
)
1287 int aregs
, sregs
, rreg
;
1290 printf("DBG: mips16_entry: entered (insn = 0x%08X)\n",insn
);
1293 aregs
= (insn
& 0x700) >> 8;
1294 sregs
= (insn
& 0x0c0) >> 6;
1295 rreg
= (insn
& 0x020) >> 5;
1297 /* This should be checked by the caller. */
1306 /* This is the entry pseudo-instruction. */
1308 for (i
= 0; i
< aregs
; i
++)
1309 store_word ((uword64
) (SP
+ 4 * i
), GPR
[i
+ 4]);
1317 store_word ((uword64
) tsp
, RA
);
1320 for (i
= 0; i
< sregs
; i
++)
1323 store_word ((uword64
) tsp
, GPR
[16 + i
]);
1331 /* This is the exit pseudo-instruction. */
1338 RA
= load_word ((uword64
) tsp
);
1341 for (i
= 0; i
< sregs
; i
++)
1344 GPR
[i
+ 16] = load_word ((uword64
) tsp
);
1352 FGR
[0] = WORD64LO (GPR
[4]);
1353 FPR_STATE
[0] = fmt_uninterpreted
;
1355 else if (aregs
== 6)
1357 FGR
[0] = WORD64LO (GPR
[5]);
1358 FGR
[1] = WORD64LO (GPR
[4]);
1359 FPR_STATE
[0] = fmt_uninterpreted
;
1360 FPR_STATE
[1] = fmt_uninterpreted
;
1362 #endif /* defined(HASFPU) */
1374 /* Round *UP* to the nearest power-of-2 if not already one */
1375 if (value
!= (value
& ~(value
- 1))) {
1376 for (tmp
= value
, loop
= 0; (tmp
!= 0); loop
++)
1378 value
= (1 << loop
);
1392 num
= strtol(value
,&end
,10);
1394 sim_io_printf(sd
,"Warning: Invalid number \"%s\" ignored, using zero\n",value
);
1396 if (*end
&& ((tolower(*end
) == 'k') || (tolower(*end
) == 'm'))) {
1397 if (tolower(*end
) == 'k')
1404 sim_io_printf(sd
,"Warning: Spurious characters \"%s\" at end of number ignored\n",end
);
1410 /*-- trace support ----------------------------------------------------------*/
1412 /* The TRACE support is provided (if required) in the memory accessing
1413 routines. Since we are also providing the architecture specific
1414 features, the architecture simulation code can also deal with
1415 notifying the TRACE world of cache flushes, etc. Similarly we do
1416 not need to provide profiling support in the simulator engine,
1417 since we can sample in the instruction fetch control loop. By
1418 defining the TRACE manifest, we add tracing as a run-time
1422 /* Tracing by default produces "din" format (as required by
1423 dineroIII). Each line of such a trace file *MUST* have a din label
1424 and address field. The rest of the line is ignored, so comments can
1425 be included if desired. The first field is the label which must be
1426 one of the following values:
1431 3 escape record (treated as unknown access type)
1432 4 escape record (causes cache flush)
1434 The address field is a 32bit (lower-case) hexadecimal address
1435 value. The address should *NOT* be preceded by "0x".
1437 The size of the memory transfer is not important when dealing with
1438 cache lines (as long as no more than a cache line can be
1439 transferred in a single operation :-), however more information
1440 could be given following the dineroIII requirement to allow more
1441 complete memory and cache simulators to provide better
1442 results. i.e. the University of Pisa has a cache simulator that can
1443 also take bus size and speed as (variable) inputs to calculate
1444 complete system performance (a much more useful ability when trying
1445 to construct an end product, rather than a processor). They
1446 currently have an ARM version of their tool called ChARM. */
1450 void dotrace(SIM_DESC sd
,FILE *tracefh
,int type
,SIM_ADDR address
,int width
,char *comment
,...)
1452 if (STATE
& simTRACE
) {
1454 fprintf(tracefh
,"%d %s ; width %d ; ",
1458 va_start(ap
,comment
);
1459 vfprintf(tracefh
,comment
,ap
);
1461 fprintf(tracefh
,"\n");
1463 /* NOTE: Since the "din" format will only accept 32bit addresses, and
1464 we may be generating 64bit ones, we should put the hi-32bits of the
1465 address into the comment field. */
1467 /* TODO: Provide a buffer for the trace lines. We can then avoid
1468 performing writes until the buffer is filled, or the file is
1471 /* NOTE: We could consider adding a comment field to the "din" file
1472 produced using type 3 markers (unknown access). This would then
1473 allow information about the program that the "din" is for, and
1474 the MIPs world that was being simulated, to be placed into the
1481 /*---------------------------------------------------------------------------*/
1482 /*-- simulator engine -------------------------------------------------------*/
1483 /*---------------------------------------------------------------------------*/
1489 /* RESET: Fixed PC address: */
1490 PC
= (((uword64
)0xFFFFFFFF<<32) | 0xBFC00000);
1491 /* The reset vector address is in the unmapped, uncached memory space. */
1493 SR
&= ~(status_SR
| status_TS
| status_RP
);
1494 SR
|= (status_ERL
| status_BEV
);
1496 #if defined(HASFPU) && (GPRLEN == (64))
1497 /* Cheat and allow access to the complete register set immediately: */
1498 SR
|= status_FR
; /* 64bit registers */
1499 #endif /* HASFPU and 64bit FP registers */
1501 /* Ensure that any instructions with pending register updates are
1505 for (loop
= 0; (loop
< PSLOTS
); loop
++)
1506 PENDING_SLOT_REG
[loop
] = (LAST_EMBED_REGNUM
+ 1);
1507 PENDING_IN
= PENDING_OUT
= PENDING_TOTAL
= 0;
1511 /* Initialise the FPU registers to the unknown state */
1514 for (rn
= 0; (rn
< 32); rn
++)
1515 FPR_STATE
[rn
] = fmt_uninterpreted
;
1522 /* Description from page A-22 of the "MIPS IV Instruction Set" manual (revision 3.1) */
1523 /* Translate a virtual address to a physical address and cache
1524 coherence algorithm describing the mechanism used to resolve the
1525 memory reference. Given the virtual address vAddr, and whether the
1526 reference is to Instructions ot Data (IorD), find the corresponding
1527 physical address (pAddr) and the cache coherence algorithm (CCA)
1528 used to resolve the reference. If the virtual address is in one of
1529 the unmapped address spaces the physical address and the CCA are
1530 determined directly by the virtual address. If the virtual address
1531 is in one of the mapped address spaces then the TLB is used to
1532 determine the physical address and access type; if the required
1533 translation is not present in the TLB or the desired access is not
1534 permitted the function fails and an exception is taken.
1536 NOTE: This function is extended to return an exception state. This,
1537 along with the exception generation is used to notify whether a
1538 valid address translation occured */
1541 address_translation(sd
,vAddr
,IorD
,LorS
,pAddr
,CCA
,host
,raw
)
1551 int res
= -1; /* TRUE : Assume good return */
1554 sim_io_printf(sd
,"AddressTranslation(0x%s,%s,%s,...);\n",pr_addr(vAddr
),(IorD
? "isDATA" : "isINSTRUCTION"),(LorS
? "iSTORE" : "isLOAD"));
1557 /* Check that the address is valid for this memory model */
1559 /* For a simple (flat) memory model, we simply pass virtual
1560 addressess through (mostly) unchanged. */
1561 vAddr
&= 0xFFFFFFFF;
1563 /* Treat the kernel memory spaces identically for the moment: */
1564 if ((STATE_MEM_BASE (sd
) == K1BASE
) && (vAddr
>= K0BASE
) && (vAddr
< (K0BASE
+ K0SIZE
)))
1565 vAddr
+= (K1BASE
- K0BASE
);
1567 /* Also assume that the K1BASE memory wraps. This is required to
1568 allow the PMON run-time __sizemem() routine to function (without
1569 having to provide exception simulation). NOTE: A kludge to work
1570 around the fact that the monitor memory is currently held in the
1572 if (((vAddr
< monitor_base
) || (vAddr
>= (monitor_base
+ monitor_size
))) && (vAddr
>= K1BASE
&& vAddr
< (K1BASE
+ K1SIZE
)))
1573 vAddr
= (K1BASE
| (vAddr
& (STATE_MEM_SIZE (sd
) - 1)));
1575 *pAddr
= vAddr
; /* default for isTARGET */
1576 *CCA
= Uncached
; /* not used for isHOST */
1578 /* NOTE: This is a duplicate of the code that appears in the
1579 LoadMemory and StoreMemory functions. They should be merged into
1580 a single function (that can be in-lined if required). */
1581 if ((vAddr
>= STATE_MEM_BASE (sd
)) && (vAddr
< (STATE_MEM_BASE (sd
) + STATE_MEM_SIZE (sd
)))) {
1583 *pAddr
= (int)&STATE_MEMORY (sd
)[((unsigned int)(vAddr
- STATE_MEM_BASE (sd
)) & (STATE_MEM_SIZE (sd
) - 1))];
1584 } else if ((vAddr
>= monitor_base
) && (vAddr
< (monitor_base
+ monitor_size
))) {
1586 *pAddr
= (int)&monitor
[((unsigned int)(vAddr
- monitor_base
) & (monitor_size
- 1))];
1589 sim_io_eprintf(sd
,"Failed: AddressTranslation(0x%s,%s,%s,...) IPC = 0x%s\n",pr_addr(vAddr
),(IorD
? "isDATA" : "isINSTRUCTION"),(LorS
? "isSTORE" : "isLOAD"),pr_addr(IPC
));
1591 res
= 0; /* AddressTranslation has failed */
1592 *pAddr
= (SIM_ADDR
)-1;
1593 if (!raw
) /* only generate exceptions on real memory transfers */
1594 if (LorS
== isSTORE
)
1595 SignalExceptionAddressStore ();
1597 SignalExceptionAddressLoad ();
1600 /* This is a normal occurance during gdb operation, for instance trying
1601 to print parameters at function start before they have been setup,
1602 and hence we should not print a warning except when debugging the
1604 sim_io_eprintf(sd
,"AddressTranslation for %s %s from 0x%s failed\n",(IorD
? "data" : "instruction"),(LorS
? "store" : "load"),pr_addr(vAddr
));
1611 /* Description from page A-23 of the "MIPS IV Instruction Set" manual (revision 3.1) */
1612 /* Prefetch data from memory. Prefetch is an advisory instruction for
1613 which an implementation specific action is taken. The action taken
1614 may increase performance, but must not change the meaning of the
1615 program, or alter architecturally-visible state. */
1618 prefetch(sd
,CCA
,pAddr
,vAddr
,DATA
,hint
)
1627 sim_io_printf(sd
,"Prefetch(%d,0x%s,0x%s,%d,%d);\n",CCA
,pr_addr(pAddr
),pr_addr(vAddr
),DATA
,hint
);
1630 /* For our simple memory model we do nothing */
1634 /* Description from page A-22 of the "MIPS IV Instruction Set" manual (revision 3.1) */
1635 /* Load a value from memory. Use the cache and main memory as
1636 specified in the Cache Coherence Algorithm (CCA) and the sort of
1637 access (IorD) to find the contents of AccessLength memory bytes
1638 starting at physical location pAddr. The data is returned in the
1639 fixed width naturally-aligned memory element (MemElem). The
1640 low-order two (or three) bits of the address and the AccessLength
1641 indicate which of the bytes within MemElem needs to be given to the
1642 processor. If the memory access type of the reference is uncached
1643 then only the referenced bytes are read from memory and valid
1644 within the memory element. If the access type is cached, and the
1645 data is not present in cache, an implementation specific size and
1646 alignment block of memory is read and loaded into the cache to
1647 satisfy a load reference. At a minimum, the block is the entire
1650 load_memory(sd
,memvalp
,memval1p
,CCA
,AccessLength
,pAddr
,vAddr
,IorD
,raw
)
1665 if (STATE_MEMORY (sd
) == NULL
)
1666 sim_io_printf(sd
,"DBG: LoadMemory(%p,%p,%d,%d,0x%s,0x%s,%s,%s)\n",memvalp
,memval1p
,CCA
,AccessLength
,pr_addr(pAddr
),pr_addr(vAddr
),(IorD
? "isDATA" : "isINSTRUCTION"),(raw
? "isRAW" : "isREAL"));
1669 #if defined(WARN_MEM)
1670 if (CCA
!= uncached
)
1671 sim_io_eprintf(sd
,"LoadMemory CCA (%d) is not uncached (currently all accesses treated as cached)\n",CCA
);
1673 if (((pAddr
& LOADDRMASK
) + AccessLength
) > LOADDRMASK
) {
1674 /* In reality this should be a Bus Error */
1675 sim_io_error(sd
,"AccessLength of %d would extend over %dbit aligned boundary for physical address 0x%s\n",AccessLength
,(LOADDRMASK
+ 1)<<2,pr_addr(pAddr
));
1677 #endif /* WARN_MEM */
1679 /* Decide which physical memory locations are being dealt with. At
1680 this point we should be able to split the pAddr bits into the
1681 relevant address map being simulated. If the "raw" variable is
1682 set, the memory read being performed should *NOT* update any I/O
1683 state or affect the CPU state. This also includes avoiding
1684 affecting statistics gathering. */
1686 /* If instruction fetch then we need to check that the two lo-order
1687 bits are zero, otherwise raise a InstructionFetch exception: */
1688 if ((IorD
== isINSTRUCTION
)
1689 && ((pAddr
& 0x3) != 0)
1690 && (((pAddr
& 0x1) != 0) || ((vAddr
& 0x1) == 0)))
1691 SignalExceptionInstructionFetch ();
1693 unsigned int index
= 0;
1694 unsigned char *mem
= NULL
;
1698 dotrace(sd
,tracefh
,((IorD
== isDATA
) ? 0 : 2),(unsigned int)(pAddr
&0xFFFFFFFF),(AccessLength
+ 1),"load%s",((IorD
== isDATA
) ? "" : " instruction"));
1701 /* NOTE: Quicker methods of decoding the address space can be used
1702 when a real memory map is being simulated (i.e. using hi-order
1703 address bits to select device). */
1704 if ((pAddr
>= STATE_MEM_BASE (sd
)) && (pAddr
< (STATE_MEM_BASE (sd
) + STATE_MEM_SIZE (sd
)))) {
1705 index
= ((unsigned int)(pAddr
- STATE_MEM_BASE (sd
)) & (STATE_MEM_SIZE (sd
) - 1));
1706 mem
= STATE_MEMORY (sd
);
1707 } else if ((pAddr
>= monitor_base
) && (pAddr
< (monitor_base
+ monitor_size
))) {
1708 index
= ((unsigned int)(pAddr
- monitor_base
) & (monitor_size
- 1));
1712 sim_io_error(sd
,"Simulator memory not found for physical address 0x%s\n",pr_addr(pAddr
));
1714 /* If we obtained the endianness of the host, and it is the same
1715 as the target memory system we can optimise the memory
1716 accesses. However, without that information we must perform
1717 slow transfer, and hope that the compiler optimisation will
1718 merge successive loads. */
1720 /* In reality we should always be loading a doubleword value (or
1721 word value in 32bit memory worlds). The external code then
1722 extracts the required bytes. However, to keep performance
1723 high we only load the required bytes into the relevant
1726 switch (AccessLength
) { /* big-endian memory */
1727 case AccessLength_QUADWORD
:
1728 value1
|= ((uword64
)mem
[index
++] << 56);
1729 case 14: /* AccessLength is one less than datalen */
1730 value1
|= ((uword64
)mem
[index
++] << 48);
1732 value1
|= ((uword64
)mem
[index
++] << 40);
1734 value1
|= ((uword64
)mem
[index
++] << 32);
1736 value1
|= ((unsigned int)mem
[index
++] << 24);
1738 value1
|= ((unsigned int)mem
[index
++] << 16);
1740 value1
|= ((unsigned int)mem
[index
++] << 8);
1742 value1
|= mem
[index
];
1744 case AccessLength_DOUBLEWORD
:
1745 value
|= ((uword64
)mem
[index
++] << 56);
1746 case AccessLength_SEPTIBYTE
:
1747 value
|= ((uword64
)mem
[index
++] << 48);
1748 case AccessLength_SEXTIBYTE
:
1749 value
|= ((uword64
)mem
[index
++] << 40);
1750 case AccessLength_QUINTIBYTE
:
1751 value
|= ((uword64
)mem
[index
++] << 32);
1752 case AccessLength_WORD
:
1753 value
|= ((unsigned int)mem
[index
++] << 24);
1754 case AccessLength_TRIPLEBYTE
:
1755 value
|= ((unsigned int)mem
[index
++] << 16);
1756 case AccessLength_HALFWORD
:
1757 value
|= ((unsigned int)mem
[index
++] << 8);
1758 case AccessLength_BYTE
:
1759 value
|= mem
[index
];
1763 index
+= (AccessLength
+ 1);
1764 switch (AccessLength
) { /* little-endian memory */
1765 case AccessLength_QUADWORD
:
1766 value1
|= ((uword64
)mem
[--index
] << 56);
1767 case 14: /* AccessLength is one less than datalen */
1768 value1
|= ((uword64
)mem
[--index
] << 48);
1770 value1
|= ((uword64
)mem
[--index
] << 40);
1772 value1
|= ((uword64
)mem
[--index
] << 32);
1774 value1
|= ((uword64
)mem
[--index
] << 24);
1776 value1
|= ((uword64
)mem
[--index
] << 16);
1778 value1
|= ((uword64
)mem
[--index
] << 8);
1780 value1
|= ((uword64
)mem
[--index
] << 0);
1782 case AccessLength_DOUBLEWORD
:
1783 value
|= ((uword64
)mem
[--index
] << 56);
1784 case AccessLength_SEPTIBYTE
:
1785 value
|= ((uword64
)mem
[--index
] << 48);
1786 case AccessLength_SEXTIBYTE
:
1787 value
|= ((uword64
)mem
[--index
] << 40);
1788 case AccessLength_QUINTIBYTE
:
1789 value
|= ((uword64
)mem
[--index
] << 32);
1790 case AccessLength_WORD
:
1791 value
|= ((uword64
)mem
[--index
] << 24);
1792 case AccessLength_TRIPLEBYTE
:
1793 value
|= ((uword64
)mem
[--index
] << 16);
1794 case AccessLength_HALFWORD
:
1795 value
|= ((uword64
)mem
[--index
] << 8);
1796 case AccessLength_BYTE
:
1797 value
|= ((uword64
)mem
[--index
] << 0);
1803 printf("DBG: LoadMemory() : (offset %d) : value = 0x%s%s\n",
1804 (int)(pAddr
& LOADDRMASK
),pr_uword64(value1
),pr_uword64(value
));
1807 /* TODO: We could try and avoid the shifts when dealing with raw
1808 memory accesses. This would mean updating the LoadMemory and
1809 StoreMemory routines to avoid shifting the data before
1810 returning or using it. */
1811 if (AccessLength
<= AccessLength_DOUBLEWORD
) {
1812 if (!raw
) { /* do nothing for raw accessess */
1814 value
<<= (((7 - (pAddr
& LOADDRMASK
)) - AccessLength
) * 8);
1815 else /* little-endian only needs to be shifted up to the correct byte offset */
1816 value
<<= ((pAddr
& LOADDRMASK
) * 8);
1821 printf("DBG: LoadMemory() : shifted value = 0x%s%s\n",
1822 pr_uword64(value1
),pr_uword64(value
));
1828 if (memval1p
) *memval1p
= value1
;
1832 /* Description from page A-23 of the "MIPS IV Instruction Set" manual
1834 /* Store a value to memory. The specified data is stored into the
1835 physical location pAddr using the memory hierarchy (data caches and
1836 main memory) as specified by the Cache Coherence Algorithm
1837 (CCA). The MemElem contains the data for an aligned, fixed-width
1838 memory element (word for 32-bit processors, doubleword for 64-bit
1839 processors), though only the bytes that will actually be stored to
1840 memory need to be valid. The low-order two (or three) bits of pAddr
1841 and the AccessLength field indicates which of the bytes within the
1842 MemElem data should actually be stored; only these bytes in memory
1846 store_memory(sd
,CCA
,AccessLength
,MemElem
,MemElem1
,pAddr
,vAddr
,raw
)
1851 uword64 MemElem1
; /* High order 64 bits */
1857 sim_io_printf(sd
,"DBG: StoreMemory(%d,%d,0x%s,0x%s,0x%s,0x%s,%s)\n",CCA
,AccessLength
,pr_uword64(MemElem
),pr_uword64(MemElem1
),pr_addr(pAddr
),pr_addr(vAddr
),(raw
? "isRAW" : "isREAL"));
1860 #if defined(WARN_MEM)
1861 if (CCA
!= uncached
)
1862 sim_io_eprintf(sd
,"StoreMemory CCA (%d) is not uncached (currently all accesses treated as cached)\n",CCA
);
1864 if (((pAddr
& LOADDRMASK
) + AccessLength
) > LOADDRMASK
)
1865 sim_io_error(sd
,"AccessLength of %d would extend over %dbit aligned boundary for physical address 0x%s\n",AccessLength
,(LOADDRMASK
+ 1)<<2,pr_addr(pAddr
));
1866 #endif /* WARN_MEM */
1870 dotrace(sd
,tracefh
,1,(unsigned int)(pAddr
&0xFFFFFFFF),(AccessLength
+ 1),"store");
1873 /* See the comments in the LoadMemory routine about optimising
1874 memory accesses. Also if we wanted to make the simulator smaller,
1875 we could merge a lot of this code with the LoadMemory
1876 routine. However, this would slow the simulator down with
1877 run-time conditionals. */
1879 unsigned int index
= 0;
1880 unsigned char *mem
= NULL
;
1882 if ((pAddr
>= STATE_MEM_BASE (sd
)) && (pAddr
< (STATE_MEM_BASE (sd
) + STATE_MEM_SIZE (sd
)))) {
1883 index
= ((unsigned int)(pAddr
- STATE_MEM_BASE (sd
)) & (STATE_MEM_SIZE (sd
) - 1));
1884 mem
= STATE_MEMORY (sd
);
1885 } else if ((pAddr
>= monitor_base
) && (pAddr
< (monitor_base
+ monitor_size
))) {
1886 index
= ((unsigned int)(pAddr
- monitor_base
) & (monitor_size
- 1));
1891 sim_io_error(sd
,"Simulator memory not found for physical address 0x%s\n",pr_addr(pAddr
));
1896 printf("DBG: StoreMemory: offset = %d MemElem = 0x%s%s\n",(unsigned int)(pAddr
& LOADDRMASK
),pr_uword64(MemElem1
),pr_uword64(MemElem
));
1899 if (AccessLength
<= AccessLength_DOUBLEWORD
) {
1902 shift
= ((7 - AccessLength
) * 8);
1903 else /* real memory access */
1904 shift
= ((pAddr
& LOADDRMASK
) * 8);
1907 /* no need to shift raw little-endian data */
1909 MemElem
>>= ((pAddr
& LOADDRMASK
) * 8);
1914 printf("DBG: StoreMemory: shift = %d MemElem = 0x%s%s\n",shift
,pr_uword64(MemElem1
),pr_uword64(MemElem
));
1918 switch (AccessLength
) { /* big-endian memory */
1919 case AccessLength_QUADWORD
:
1920 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
1923 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
1926 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
1929 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
1932 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
1935 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
1938 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
1941 mem
[index
++] = (unsigned char)(MemElem1
>> 56);
1943 case AccessLength_DOUBLEWORD
:
1944 mem
[index
++] = (unsigned char)(MemElem
>> 56);
1946 case AccessLength_SEPTIBYTE
:
1947 mem
[index
++] = (unsigned char)(MemElem
>> 56);
1949 case AccessLength_SEXTIBYTE
:
1950 mem
[index
++] = (unsigned char)(MemElem
>> 56);
1952 case AccessLength_QUINTIBYTE
:
1953 mem
[index
++] = (unsigned char)(MemElem
>> 56);
1955 case AccessLength_WORD
:
1956 mem
[index
++] = (unsigned char)(MemElem
>> 56);
1958 case AccessLength_TRIPLEBYTE
:
1959 mem
[index
++] = (unsigned char)(MemElem
>> 56);
1961 case AccessLength_HALFWORD
:
1962 mem
[index
++] = (unsigned char)(MemElem
>> 56);
1964 case AccessLength_BYTE
:
1965 mem
[index
++] = (unsigned char)(MemElem
>> 56);
1969 index
+= (AccessLength
+ 1);
1970 switch (AccessLength
) { /* little-endian memory */
1971 case AccessLength_QUADWORD
:
1972 mem
[--index
] = (unsigned char)(MemElem1
>> 56);
1974 mem
[--index
] = (unsigned char)(MemElem1
>> 48);
1976 mem
[--index
] = (unsigned char)(MemElem1
>> 40);
1978 mem
[--index
] = (unsigned char)(MemElem1
>> 32);
1980 mem
[--index
] = (unsigned char)(MemElem1
>> 24);
1982 mem
[--index
] = (unsigned char)(MemElem1
>> 16);
1984 mem
[--index
] = (unsigned char)(MemElem1
>> 8);
1986 mem
[--index
] = (unsigned char)(MemElem1
>> 0);
1988 case AccessLength_DOUBLEWORD
:
1989 mem
[--index
] = (unsigned char)(MemElem
>> 56);
1990 case AccessLength_SEPTIBYTE
:
1991 mem
[--index
] = (unsigned char)(MemElem
>> 48);
1992 case AccessLength_SEXTIBYTE
:
1993 mem
[--index
] = (unsigned char)(MemElem
>> 40);
1994 case AccessLength_QUINTIBYTE
:
1995 mem
[--index
] = (unsigned char)(MemElem
>> 32);
1996 case AccessLength_WORD
:
1997 mem
[--index
] = (unsigned char)(MemElem
>> 24);
1998 case AccessLength_TRIPLEBYTE
:
1999 mem
[--index
] = (unsigned char)(MemElem
>> 16);
2000 case AccessLength_HALFWORD
:
2001 mem
[--index
] = (unsigned char)(MemElem
>> 8);
2002 case AccessLength_BYTE
:
2003 mem
[--index
] = (unsigned char)(MemElem
>> 0);
2014 /* Description from page A-26 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2015 /* Order loads and stores to synchronise shared memory. Perform the
2016 action necessary to make the effects of groups of synchronizable
2017 loads and stores indicated by stype occur in the same order for all
2020 sync_operation(sd
,stype
)
2025 sim_io_printf(sd
,"SyncOperation(%d) : TODO\n",stype
);
2030 /* Description from page A-26 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2031 /* Signal an exception condition. This will result in an exception
2032 that aborts the instruction. The instruction operation pseudocode
2033 will never see a return from this function call. */
2036 signal_exception (SIM_DESC sd
, int exception
,...)
2041 sim_io_printf(sd
,"DBG: SignalException(%d) IPC = 0x%s\n",exception
,pr_addr(IPC
));
2044 /* Ensure that any active atomic read/modify/write operation will fail: */
2047 switch (exception
) {
2048 /* TODO: For testing purposes I have been ignoring TRAPs. In
2049 reality we should either simulate them, or allow the user to
2050 ignore them at run-time.
2053 sim_io_eprintf(sd
,"Ignoring instruction TRAP (PC 0x%s)\n",pr_addr(IPC
));
2059 unsigned int instruction
;
2062 va_start(ap
,exception
);
2063 instruction
= va_arg(ap
,unsigned int);
2066 code
= (instruction
>> 6) & 0xFFFFF;
2068 sim_io_eprintf(sd
,"Ignoring instruction `syscall %d' (PC 0x%s)\n",
2069 code
, pr_addr(IPC
));
2073 case DebugBreakPoint
:
2074 if (! (Debug
& Debug_DM
))
2080 Debug
|= Debug_DBD
; /* signaled from within in delay slot */
2081 DEPC
= IPC
- 4; /* reference the branch instruction */
2085 Debug
&= ~Debug_DBD
; /* not signaled from within a delay slot */
2089 Debug
|= Debug_DM
; /* in debugging mode */
2090 Debug
|= Debug_DBp
; /* raising a DBp exception */
2092 sim_engine_restart (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
);
2096 case ReservedInstruction
:
2099 unsigned int instruction
;
2100 va_start(ap
,exception
);
2101 instruction
= va_arg(ap
,unsigned int);
2103 /* Provide simple monitor support using ReservedInstruction
2104 exceptions. The following code simulates the fixed vector
2105 entry points into the IDT monitor by causing a simulator
2106 trap, performing the monitor operation, and returning to
2107 the address held in the $ra register (standard PCS return
2108 address). This means we only need to pre-load the vector
2109 space with suitable instruction values. For systems were
2110 actual trap instructions are used, we would not need to
2111 perform this magic. */
2112 if ((instruction
& RSVD_INSTRUCTION_MASK
) == RSVD_INSTRUCTION
) {
2113 sim_monitor(sd
, ((instruction
>> RSVD_INSTRUCTION_ARG_SHIFT
) & RSVD_INSTRUCTION_ARG_MASK
) );
2114 PC
= RA
; /* simulate the return from the vector entry */
2115 /* NOTE: This assumes that a branch-and-link style
2116 instruction was used to enter the vector (which is the
2117 case with the current IDT monitor). */
2118 sim_engine_restart (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
);
2120 /* Look for the mips16 entry and exit instructions, and
2121 simulate a handler for them. */
2122 else if ((IPC
& 1) != 0
2123 && (instruction
& 0xf81f) == 0xe809
2124 && (instruction
& 0x0c0) != 0x0c0) {
2125 mips16_entry (instruction
);
2126 sim_engine_restart (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
);
2127 } /* else fall through to normal exception processing */
2128 sim_io_eprintf(sd
,"ReservedInstruction 0x%08X at IPC = 0x%s\n",instruction
,pr_addr(IPC
));
2133 sim_io_printf(sd
,"DBG: SignalException(%d) IPC = 0x%s\n",exception
,pr_addr(IPC
));
2135 /* Keep a copy of the current A0 in-case this is the program exit
2139 unsigned int instruction
;
2140 va_start(ap
,exception
);
2141 instruction
= va_arg(ap
,unsigned int);
2143 /* Check for our special terminating BREAK: */
2144 if ((instruction
& 0x03FFFFC0) == 0x03ff0000) {
2145 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2146 sim_exited
, (unsigned int)(A0
& 0xFFFFFFFF));
2149 if (STATE
& simDELAYSLOT
)
2150 PC
= IPC
- 4; /* reference the branch instruction */
2153 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2154 sim_stopped
, SIGTRAP
);
2157 /* Store exception code into current exception id variable (used
2160 /* TODO: If not simulating exceptions then stop the simulator
2161 execution. At the moment we always stop the simulation. */
2163 /* See figure 5-17 for an outline of the code below */
2164 if (! (SR
& status_EXL
))
2166 CAUSE
= (exception
<< 2);
2167 if (STATE
& simDELAYSLOT
)
2169 STATE
&= ~simDELAYSLOT
;
2171 EPC
= (IPC
- 4); /* reference the branch instruction */
2175 /* FIXME: TLB et.al. */
2180 CAUSE
= (exception
<< 2);
2184 /* Store exception code into current exception id variable (used
2186 if (SR
& status_BEV
)
2187 PC
= (signed)0xBFC00200 + 0x180;
2189 PC
= (signed)0x80000000 + 0x180;
2191 switch ((CAUSE
>> 2) & 0x1F)
2194 /* Interrupts arrive during event processing, no need to
2198 case TLBModification
:
2203 case InstructionFetch
:
2205 /* The following is so that the simulator will continue from the
2206 exception address on breakpoint operations. */
2208 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2209 sim_stopped
, SIGBUS
);
2211 case ReservedInstruction
:
2212 case CoProcessorUnusable
:
2214 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2215 sim_stopped
, SIGILL
);
2217 case IntegerOverflow
:
2219 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2220 sim_stopped
, SIGFPE
);
2226 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2227 sim_stopped
, SIGTRAP
);
2231 sim_engine_abort (sd
, STATE_CPU (sd
, 0), NULL_CIA
,
2232 "FATAL: Should not encounter a breakpoint\n");
2234 default : /* Unknown internal exception */
2236 sim_engine_halt (sd
, STATE_CPU (sd
, 0), NULL
, NULL_CIA
,
2237 sim_stopped
, SIGQUIT
);
2241 case SimulatorFault
:
2245 va_start(ap
,exception
);
2246 msg
= va_arg(ap
,char *);
2248 sim_engine_abort (sd
, STATE_CPU (sd
, 0), NULL_CIA
,
2249 "FATAL: Simulator error \"%s\"\n",msg
);
2256 #if defined(WARN_RESULT)
2257 /* Description from page A-26 of the "MIPS IV Instruction Set" manual (revision 3.1) */
2258 /* This function indicates that the result of the operation is
2259 undefined. However, this should not affect the instruction
2260 stream. All that is meant to happen is that the destination
2261 register is set to an undefined result. To keep the simulator
2262 simple, we just don't bother updating the destination register, so
2263 the overall result will be undefined. If desired we can stop the
2264 simulator by raising a pseudo-exception. */
2268 sim_io_eprintf(sd
,"UndefinedResult: IPC = 0x%s\n",pr_addr(IPC
));
2269 #if 0 /* Disabled for the moment, since it actually happens a lot at the moment. */
2274 #endif /* WARN_RESULT */
2277 cache_op(sd
,op
,pAddr
,vAddr
,instruction
)
2282 unsigned int instruction
;
2284 #if 1 /* stop warning message being displayed (we should really just remove the code) */
2285 static int icache_warning
= 1;
2286 static int dcache_warning
= 1;
2288 static int icache_warning
= 0;
2289 static int dcache_warning
= 0;
2292 /* If CP0 is not useable (User or Supervisor mode) and the CP0
2293 enable bit in the Status Register is clear - a coprocessor
2294 unusable exception is taken. */
2296 sim_io_printf(sd
,"TODO: Cache availability checking (PC = 0x%s)\n",pr_addr(IPC
));
2300 case 0: /* instruction cache */
2302 case 0: /* Index Invalidate */
2303 case 1: /* Index Load Tag */
2304 case 2: /* Index Store Tag */
2305 case 4: /* Hit Invalidate */
2307 case 6: /* Hit Writeback */
2308 if (!icache_warning
)
2310 sim_io_eprintf(sd
,"Instruction CACHE operation %d to be coded\n",(op
>> 2));
2316 SignalException(ReservedInstruction
,instruction
);
2321 case 1: /* data cache */
2323 case 0: /* Index Writeback Invalidate */
2324 case 1: /* Index Load Tag */
2325 case 2: /* Index Store Tag */
2326 case 3: /* Create Dirty */
2327 case 4: /* Hit Invalidate */
2328 case 5: /* Hit Writeback Invalidate */
2329 case 6: /* Hit Writeback */
2330 if (!dcache_warning
)
2332 sim_io_eprintf(sd
,"Data CACHE operation %d to be coded\n",(op
>> 2));
2338 SignalException(ReservedInstruction
,instruction
);
2343 default: /* unrecognised cache ID */
2344 SignalException(ReservedInstruction
,instruction
);
2351 /*-- FPU support routines ---------------------------------------------------*/
2353 #if defined(HASFPU) /* Only needed when building FPU aware simulators */
2355 /* Numbers are held in normalized form. The SINGLE and DOUBLE binary
2356 formats conform to ANSI/IEEE Std 754-1985. */
2357 /* SINGLE precision floating:
2358 * seeeeeeeefffffffffffffffffffffff
2360 * e = 8bits = exponent
2361 * f = 23bits = fraction
2363 /* SINGLE precision fixed:
2364 * siiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
2366 * i = 31bits = integer
2368 /* DOUBLE precision floating:
2369 * seeeeeeeeeeeffffffffffffffffffffffffffffffffffffffffffffffffffff
2371 * e = 11bits = exponent
2372 * f = 52bits = fraction
2374 /* DOUBLE precision fixed:
2375 * siiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
2377 * i = 63bits = integer
2380 /* Extract sign-bit: */
2381 #define FP_S_s(v) (((v) & ((unsigned)1 << 31)) ? 1 : 0)
2382 #define FP_D_s(v) (((v) & ((uword64)1 << 63)) ? 1 : 0)
2383 /* Extract biased exponent: */
2384 #define FP_S_be(v) (((v) >> 23) & 0xFF)
2385 #define FP_D_be(v) (((v) >> 52) & 0x7FF)
2386 /* Extract unbiased Exponent: */
2387 #define FP_S_e(v) (FP_S_be(v) - 0x7F)
2388 #define FP_D_e(v) (FP_D_be(v) - 0x3FF)
2389 /* Extract complete fraction field: */
2390 #define FP_S_f(v) ((v) & ~((unsigned)0x1FF << 23))
2391 #define FP_D_f(v) ((v) & ~((uword64)0xFFF << 52))
2392 /* Extract numbered fraction bit: */
2393 #define FP_S_fb(b,v) (((v) & (1 << (23 - (b)))) ? 1 : 0)
2394 #define FP_D_fb(b,v) (((v) & (1 << (52 - (b)))) ? 1 : 0)
2396 /* Explicit QNaN values used when value required: */
2397 #define FPQNaN_SINGLE (0x7FBFFFFF)
2398 #define FPQNaN_WORD (0x7FFFFFFF)
2399 #define FPQNaN_DOUBLE (((uword64)0x7FF7FFFF << 32) | 0xFFFFFFFF)
2400 #define FPQNaN_LONG (((uword64)0x7FFFFFFF << 32) | 0xFFFFFFFF)
2402 /* Explicit Infinity values used when required: */
2403 #define FPINF_SINGLE (0x7F800000)
2404 #define FPINF_DOUBLE (((uword64)0x7FF00000 << 32) | 0x00000000)
2406 #if 1 /* def DEBUG */
2407 #define RMMODE(v) (((v) == FP_RM_NEAREST) ? "Round" : (((v) == FP_RM_TOZERO) ? "Trunc" : (((v) == FP_RM_TOPINF) ? "Ceil" : "Floor")))
2408 #define DOFMT(v) (((v) == fmt_single) ? "single" : (((v) == fmt_double) ? "double" : (((v) == fmt_word) ? "word" : (((v) == fmt_long) ? "long" : (((v) == fmt_unknown) ? "<unknown>" : (((v) == fmt_uninterpreted) ? "<uninterpreted>" : "<format error>"))))))
2412 value_fpr(sd
,fpr
,fmt
)
2420 /* Treat unused register values, as fixed-point 64bit values: */
2421 if ((fmt
== fmt_uninterpreted
) || (fmt
== fmt_unknown
))
2423 /* If request to read data as "uninterpreted", then use the current
2425 fmt
= FPR_STATE
[fpr
];
2430 /* For values not yet accessed, set to the desired format: */
2431 if (FPR_STATE
[fpr
] == fmt_uninterpreted
) {
2432 FPR_STATE
[fpr
] = fmt
;
2434 printf("DBG: Register %d was fmt_uninterpreted. Now %s\n",fpr
,DOFMT(fmt
));
2437 if (fmt
!= FPR_STATE
[fpr
]) {
2438 sim_io_eprintf(sd
,"FPR %d (format %s) being accessed with format %s - setting to unknown (PC = 0x%s)\n",fpr
,DOFMT(FPR_STATE
[fpr
]),DOFMT(fmt
),pr_addr(IPC
));
2439 FPR_STATE
[fpr
] = fmt_unknown
;
2442 if (FPR_STATE
[fpr
] == fmt_unknown
) {
2443 /* Set QNaN value: */
2446 value
= FPQNaN_SINGLE
;
2450 value
= FPQNaN_DOUBLE
;
2454 value
= FPQNaN_WORD
;
2458 value
= FPQNaN_LONG
;
2465 } else if (SizeFGR() == 64) {
2469 value
= (FGR
[fpr
] & 0xFFFFFFFF);
2472 case fmt_uninterpreted
:
2486 value
= (FGR
[fpr
] & 0xFFFFFFFF);
2489 case fmt_uninterpreted
:
2492 if ((fpr
& 1) == 0) { /* even registers only */
2493 value
= ((((uword64
)FGR
[fpr
+1]) << 32) | (FGR
[fpr
] & 0xFFFFFFFF));
2495 SignalException(ReservedInstruction
,0);
2506 SignalExceptionSimulatorFault ("Unrecognised FP format in ValueFPR()");
2509 printf("DBG: ValueFPR: fpr = %d, fmt = %s, value = 0x%s : PC = 0x%s : SizeFGR() = %d\n",fpr
,DOFMT(fmt
),pr_addr(value
),pr_addr(IPC
),SizeFGR());
2516 store_fpr(sd
,fpr
,fmt
,value
)
2525 printf("DBG: StoreFPR: fpr = %d, fmt = %s, value = 0x%s : PC = 0x%s : SizeFGR() = %d\n",fpr
,DOFMT(fmt
),pr_addr(value
),pr_addr(IPC
),SizeFGR());
2528 if (SizeFGR() == 64) {
2532 FGR
[fpr
] = (((uword64
)0xDEADC0DE << 32) | (value
& 0xFFFFFFFF));
2533 FPR_STATE
[fpr
] = fmt
;
2536 case fmt_uninterpreted
:
2540 FPR_STATE
[fpr
] = fmt
;
2544 FPR_STATE
[fpr
] = fmt_unknown
;
2552 FGR
[fpr
] = (value
& 0xFFFFFFFF);
2553 FPR_STATE
[fpr
] = fmt
;
2556 case fmt_uninterpreted
:
2559 if ((fpr
& 1) == 0) { /* even register number only */
2560 FGR
[fpr
+1] = (value
>> 32);
2561 FGR
[fpr
] = (value
& 0xFFFFFFFF);
2562 FPR_STATE
[fpr
+ 1] = fmt
;
2563 FPR_STATE
[fpr
] = fmt
;
2565 FPR_STATE
[fpr
] = fmt_unknown
;
2566 FPR_STATE
[fpr
+ 1] = fmt_unknown
;
2567 SignalException(ReservedInstruction
,0);
2572 FPR_STATE
[fpr
] = fmt_unknown
;
2577 #if defined(WARN_RESULT)
2580 #endif /* WARN_RESULT */
2583 SignalExceptionSimulatorFault ("Unrecognised FP format in StoreFPR()");
2586 printf("DBG: StoreFPR: fpr[%d] = 0x%s (format %s)\n",fpr
,pr_addr(FGR
[fpr
]),DOFMT(fmt
));
2599 /* Check if (((E - bias) == (E_max + 1)) && (fraction != 0)). We
2600 know that the exponent field is biased... we we cheat and avoid
2601 removing the bias value. */
2604 boolean
= ((FP_S_be(op
) == 0xFF) && (FP_S_f(op
) != 0));
2605 /* We could use "FP_S_fb(1,op)" to ascertain whether we are
2606 dealing with a SNaN or QNaN */
2609 boolean
= ((FP_D_be(op
) == 0x7FF) && (FP_D_f(op
) != 0));
2610 /* We could use "FP_S_fb(1,op)" to ascertain whether we are
2611 dealing with a SNaN or QNaN */
2614 boolean
= (op
== FPQNaN_WORD
);
2617 boolean
= (op
== FPQNaN_LONG
);
2620 fprintf (stderr
, "Bad switch\n");
2625 printf("DBG: NaN: returning %d for 0x%s (format = %s)\n",boolean
,pr_addr(op
),DOFMT(fmt
));
2639 printf("DBG: Infinity: format %s 0x%s (PC = 0x%s)\n",DOFMT(fmt
),pr_addr(op
),pr_addr(IPC
));
2642 /* Check if (((E - bias) == (E_max + 1)) && (fraction == 0)). We
2643 know that the exponent field is biased... we we cheat and avoid
2644 removing the bias value. */
2647 boolean
= ((FP_S_be(op
) == 0xFF) && (FP_S_f(op
) == 0));
2650 boolean
= ((FP_D_be(op
) == 0x7FF) && (FP_D_f(op
) == 0));
2653 printf("DBG: TODO: unrecognised format (%s) for Infinity check\n",DOFMT(fmt
));
2658 printf("DBG: Infinity: returning %d for 0x%s (format = %s)\n",boolean
,pr_addr(op
),DOFMT(fmt
));
2672 /* Argument checking already performed by the FPCOMPARE code */
2675 printf("DBG: Less: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
2678 /* The format type should already have been checked: */
2682 unsigned int wop1
= (unsigned int)op1
;
2683 unsigned int wop2
= (unsigned int)op2
;
2684 boolean
= (*(float *)&wop1
< *(float *)&wop2
);
2688 boolean
= (*(double *)&op1
< *(double *)&op2
);
2691 fprintf (stderr
, "Bad switch\n");
2696 printf("DBG: Less: returning %d (format = %s)\n",boolean
,DOFMT(fmt
));
2710 /* Argument checking already performed by the FPCOMPARE code */
2713 printf("DBG: Equal: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
2716 /* The format type should already have been checked: */
2719 boolean
= ((op1
& 0xFFFFFFFF) == (op2
& 0xFFFFFFFF));
2722 boolean
= (op1
== op2
);
2725 fprintf (stderr
, "Bad switch\n");
2730 printf("DBG: Equal: returning %d (format = %s)\n",boolean
,DOFMT(fmt
));
2737 AbsoluteValue(op
,fmt
)
2744 printf("DBG: AbsoluteValue: %s: op = 0x%s\n",DOFMT(fmt
),pr_addr(op
));
2747 /* The format type should already have been checked: */
2751 unsigned int wop
= (unsigned int)op
;
2752 float tmp
= ((float)fabs((double)*(float *)&wop
));
2753 result
= (uword64
)*(unsigned int *)&tmp
;
2758 double tmp
= (fabs(*(double *)&op
));
2759 result
= *(uword64
*)&tmp
;
2762 fprintf (stderr
, "Bad switch\n");
2777 printf("DBG: Negate: %s: op = 0x%s\n",DOFMT(fmt
),pr_addr(op
));
2780 /* The format type should already have been checked: */
2784 unsigned int wop
= (unsigned int)op
;
2785 float tmp
= ((float)0.0 - *(float *)&wop
);
2786 result
= (uword64
)*(unsigned int *)&tmp
;
2791 double tmp
= ((double)0.0 - *(double *)&op
);
2792 result
= *(uword64
*)&tmp
;
2796 fprintf (stderr
, "Bad switch\n");
2812 printf("DBG: Add: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
2815 /* The registers must specify FPRs valid for operands of type
2816 "fmt". If they are not valid, the result is undefined. */
2818 /* The format type should already have been checked: */
2822 unsigned int wop1
= (unsigned int)op1
;
2823 unsigned int wop2
= (unsigned int)op2
;
2824 float tmp
= (*(float *)&wop1
+ *(float *)&wop2
);
2825 result
= (uword64
)*(unsigned int *)&tmp
;
2830 double tmp
= (*(double *)&op1
+ *(double *)&op2
);
2831 result
= *(uword64
*)&tmp
;
2835 fprintf (stderr
, "Bad switch\n");
2840 printf("DBG: Add: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
2855 printf("DBG: Sub: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
2858 /* The registers must specify FPRs valid for operands of type
2859 "fmt". If they are not valid, the result is undefined. */
2861 /* The format type should already have been checked: */
2865 unsigned int wop1
= (unsigned int)op1
;
2866 unsigned int wop2
= (unsigned int)op2
;
2867 float tmp
= (*(float *)&wop1
- *(float *)&wop2
);
2868 result
= (uword64
)*(unsigned int *)&tmp
;
2873 double tmp
= (*(double *)&op1
- *(double *)&op2
);
2874 result
= *(uword64
*)&tmp
;
2878 fprintf (stderr
, "Bad switch\n");
2883 printf("DBG: Sub: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
2890 Multiply(op1
,op2
,fmt
)
2898 printf("DBG: Multiply: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
2901 /* The registers must specify FPRs valid for operands of type
2902 "fmt". If they are not valid, the result is undefined. */
2904 /* The format type should already have been checked: */
2908 unsigned int wop1
= (unsigned int)op1
;
2909 unsigned int wop2
= (unsigned int)op2
;
2910 float tmp
= (*(float *)&wop1
* *(float *)&wop2
);
2911 result
= (uword64
)*(unsigned int *)&tmp
;
2916 double tmp
= (*(double *)&op1
* *(double *)&op2
);
2917 result
= *(uword64
*)&tmp
;
2921 fprintf (stderr
, "Bad switch\n");
2926 printf("DBG: Multiply: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
2941 printf("DBG: Divide: %s: op1 = 0x%s : op2 = 0x%s\n",DOFMT(fmt
),pr_addr(op1
),pr_addr(op2
));
2944 /* The registers must specify FPRs valid for operands of type
2945 "fmt". If they are not valid, the result is undefined. */
2947 /* The format type should already have been checked: */
2951 unsigned int wop1
= (unsigned int)op1
;
2952 unsigned int wop2
= (unsigned int)op2
;
2953 float tmp
= (*(float *)&wop1
/ *(float *)&wop2
);
2954 result
= (uword64
)*(unsigned int *)&tmp
;
2959 double tmp
= (*(double *)&op1
/ *(double *)&op2
);
2960 result
= *(uword64
*)&tmp
;
2964 fprintf (stderr
, "Bad switch\n");
2969 printf("DBG: Divide: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
2983 printf("DBG: Recip: %s: op = 0x%s\n",DOFMT(fmt
),pr_addr(op
));
2986 /* The registers must specify FPRs valid for operands of type
2987 "fmt". If they are not valid, the result is undefined. */
2989 /* The format type should already have been checked: */
2993 unsigned int wop
= (unsigned int)op
;
2994 float tmp
= ((float)1.0 / *(float *)&wop
);
2995 result
= (uword64
)*(unsigned int *)&tmp
;
3000 double tmp
= ((double)1.0 / *(double *)&op
);
3001 result
= *(uword64
*)&tmp
;
3005 fprintf (stderr
, "Bad switch\n");
3010 printf("DBG: Recip: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
3024 printf("DBG: SquareRoot: %s: op = 0x%s\n",DOFMT(fmt
),pr_addr(op
));
3027 /* The registers must specify FPRs valid for operands of type
3028 "fmt". If they are not valid, the result is undefined. */
3030 /* The format type should already have been checked: */
3034 unsigned int wop
= (unsigned int)op
;
3036 float tmp
= ((float)sqrt((double)*(float *)&wop
));
3037 result
= (uword64
)*(unsigned int *)&tmp
;
3039 /* TODO: Provide square-root */
3040 result
= (uword64
)0;
3047 double tmp
= (sqrt(*(double *)&op
));
3048 result
= *(uword64
*)&tmp
;
3050 /* TODO: Provide square-root */
3051 result
= (uword64
)0;
3056 fprintf (stderr
, "Bad switch\n");
3061 printf("DBG: SquareRoot: returning 0x%s (format = %s)\n",pr_addr(result
),DOFMT(fmt
));
3068 convert(sd
,rm
,op
,from
,to
)
3078 printf("DBG: Convert: mode %s : op 0x%s : from %s : to %s : (PC = 0x%s)\n",RMMODE(rm
),pr_addr(op
),DOFMT(from
),DOFMT(to
),pr_addr(IPC
));
3081 /* The value "op" is converted to the destination format, rounding
3082 using mode "rm". When the destination is a fixed-point format,
3083 then a source value of Infinity, NaN or one which would round to
3084 an integer outside the fixed point range then an IEEE Invalid
3085 Operation condition is raised. */
3092 tmp
= (float)(*(double *)&op
);
3096 tmp
= (float)((int)(op
& 0xFFFFFFFF));
3100 tmp
= (float)((word64
)op
);
3103 fprintf (stderr
, "Bad switch\n");
3108 /* FIXME: This code is incorrect. The rounding mode does not
3109 round to integral values; it rounds to the nearest
3110 representable value in the format. */
3114 /* Round result to nearest representable value. When two
3115 representable values are equally near, round to the value
3116 that has a least significant bit of zero (i.e. is even). */
3118 tmp
= (float)anint((double)tmp
);
3120 /* TODO: Provide round-to-nearest */
3125 /* Round result to the value closest to, and not greater in
3126 magnitude than, the result. */
3128 tmp
= (float)aint((double)tmp
);
3130 /* TODO: Provide round-to-zero */
3135 /* Round result to the value closest to, and not less than,
3137 tmp
= (float)ceil((double)tmp
);
3141 /* Round result to the value closest to, and not greater than,
3143 tmp
= (float)floor((double)tmp
);
3148 result
= (uword64
)*(unsigned int *)&tmp
;
3160 unsigned int wop
= (unsigned int)op
;
3161 tmp
= (double)(*(float *)&wop
);
3166 xxx
= SIGNEXTEND((op
& 0xFFFFFFFF),32);
3171 tmp
= (double)((word64
)op
);
3175 fprintf (stderr
, "Bad switch\n");
3180 /* FIXME: This code is incorrect. The rounding mode does not
3181 round to integral values; it rounds to the nearest
3182 representable value in the format. */
3187 tmp
= anint(*(double *)&tmp
);
3189 /* TODO: Provide round-to-nearest */
3195 tmp
= aint(*(double *)&tmp
);
3197 /* TODO: Provide round-to-zero */
3202 tmp
= ceil(*(double *)&tmp
);
3206 tmp
= floor(*(double *)&tmp
);
3211 result
= *(uword64
*)&tmp
;
3217 if (Infinity(op
,from
) || NaN(op
,from
) || (1 == 0/*TODO: check range */)) {
3218 printf("DBG: TODO: update FCSR\n");
3219 SignalExceptionFPE ();
3221 if (to
== fmt_word
) {
3226 unsigned int wop
= (unsigned int)op
;
3227 tmp
= (int)*((float *)&wop
);
3231 tmp
= (int)*((double *)&op
);
3233 printf("DBG: from double %.30f (0x%s) to word: 0x%08X\n",*((double *)&op
),pr_addr(op
),tmp
);
3237 fprintf (stderr
, "Bad switch\n");
3240 result
= (uword64
)tmp
;
3241 } else { /* fmt_long */
3246 unsigned int wop
= (unsigned int)op
;
3247 tmp
= (word64
)*((float *)&wop
);
3251 tmp
= (word64
)*((double *)&op
);
3254 fprintf (stderr
, "Bad switch\n");
3257 result
= (uword64
)tmp
;
3262 fprintf (stderr
, "Bad switch\n");
3267 printf("DBG: Convert: returning 0x%s (to format = %s)\n",pr_addr(result
),DOFMT(to
));
3274 /*-- co-processor support routines ------------------------------------------*/
3277 CoProcPresent(coproc_number
)
3278 unsigned int coproc_number
;
3280 /* Return TRUE if simulator provides a model for the given co-processor number */
3285 cop_lw(sd
,coproc_num
,coproc_reg
,memword
)
3287 int coproc_num
, coproc_reg
;
3288 unsigned int memword
;
3290 switch (coproc_num
) {
3294 printf("DBG: COP_LW: memword = 0x%08X (uword64)memword = 0x%s\n",memword
,pr_addr(memword
));
3296 StoreFPR(coproc_reg
,fmt_word
,(uword64
)memword
);
3297 FPR_STATE
[coproc_reg
] = fmt_uninterpreted
;
3302 #if 0 /* this should be controlled by a configuration option */
3303 sim_io_printf(sd
,"COP_LW(%d,%d,0x%08X) at IPC = 0x%s : TODO (architecture specific)\n",coproc_num
,coproc_reg
,memword
,pr_addr(IPC
));
3312 cop_ld(sd
,coproc_num
,coproc_reg
,memword
)
3314 int coproc_num
, coproc_reg
;
3317 switch (coproc_num
) {
3320 StoreFPR(coproc_reg
,fmt_uninterpreted
,memword
);
3325 #if 0 /* this message should be controlled by a configuration option */
3326 sim_io_printf(sd
,"COP_LD(%d,%d,0x%s) at IPC = 0x%s : TODO (architecture specific)\n",coproc_num
,coproc_reg
,pr_addr(memword
),pr_addr(IPC
));
3335 cop_sw(sd
,coproc_num
,coproc_reg
)
3337 int coproc_num
, coproc_reg
;
3339 unsigned int value
= 0;
3341 switch (coproc_num
) {
3347 hold
= FPR_STATE
[coproc_reg
];
3348 FPR_STATE
[coproc_reg
] = fmt_word
;
3349 value
= (unsigned int)ValueFPR(coproc_reg
,fmt_uninterpreted
);
3350 FPR_STATE
[coproc_reg
] = hold
;
3354 value
= (unsigned int)ValueFPR(coproc_reg
,FPR_STATE
[coproc_reg
]);
3357 printf("DBG: COP_SW: reg in format %s (will be accessing as single)\n",DOFMT(FPR_STATE
[coproc_reg
]));
3359 value
= (unsigned int)ValueFPR(coproc_reg
,fmt_single
);
3366 #if 0 /* should be controlled by configuration option */
3367 sim_io_printf(sd
,"COP_SW(%d,%d) at IPC = 0x%s : TODO (architecture specific)\n",coproc_num
,coproc_reg
,pr_addr(IPC
));
3376 cop_sd(sd
,coproc_num
,coproc_reg
)
3378 int coproc_num
, coproc_reg
;
3381 switch (coproc_num
) {
3385 value
= ValueFPR(coproc_reg
,fmt_uninterpreted
);
3388 value
= ValueFPR(coproc_reg
,FPR_STATE
[coproc_reg
]);
3391 printf("DBG: COP_SD: reg in format %s (will be accessing as double)\n",DOFMT(FPR_STATE
[coproc_reg
]));
3393 value
= ValueFPR(coproc_reg
,fmt_double
);
3400 #if 0 /* should be controlled by configuration option */
3401 sim_io_printf(sd
,"COP_SD(%d,%d) at IPC = 0x%s : TODO (architecture specific)\n",coproc_num
,coproc_reg
,pr_addr(IPC
));
3410 decode_coproc(sd
,instruction
)
3412 unsigned int instruction
;
3414 int coprocnum
= ((instruction
>> 26) & 3);
3418 case 0: /* standard CPU control and cache registers */
3420 int code
= ((instruction
>> 21) & 0x1F);
3421 /* R4000 Users Manual (second edition) lists the following CP0
3423 DMFC0 Doubleword Move From CP0 (VR4100 = 01000000001tttttddddd00000000000)
3424 DMTC0 Doubleword Move To CP0 (VR4100 = 01000000101tttttddddd00000000000)
3425 MFC0 word Move From CP0 (VR4100 = 01000000000tttttddddd00000000000)
3426 MTC0 word Move To CP0 (VR4100 = 01000000100tttttddddd00000000000)
3427 TLBR Read Indexed TLB Entry (VR4100 = 01000010000000000000000000000001)
3428 TLBWI Write Indexed TLB Entry (VR4100 = 01000010000000000000000000000010)
3429 TLBWR Write Random TLB Entry (VR4100 = 01000010000000000000000000000110)
3430 TLBP Probe TLB for Matching Entry (VR4100 = 01000010000000000000000000001000)
3431 CACHE Cache operation (VR4100 = 101111bbbbbpppppiiiiiiiiiiiiiiii)
3432 ERET Exception return (VR4100 = 01000010000000000000000000011000)
3434 if (((code
== 0x00) || (code
== 0x04)) && ((instruction
& 0x7FF) == 0))
3436 int rt
= ((instruction
>> 16) & 0x1F);
3437 int rd
= ((instruction
>> 11) & 0x1F);
3439 switch (rd
) /* NOTEs: Standard CP0 registers */
3441 /* 0 = Index R4000 VR4100 VR4300 */
3442 /* 1 = Random R4000 VR4100 VR4300 */
3443 /* 2 = EntryLo0 R4000 VR4100 VR4300 */
3444 /* 3 = EntryLo1 R4000 VR4100 VR4300 */
3445 /* 4 = Context R4000 VR4100 VR4300 */
3446 /* 5 = PageMask R4000 VR4100 VR4300 */
3447 /* 6 = Wired R4000 VR4100 VR4300 */
3448 /* 8 = BadVAddr R4000 VR4100 VR4300 */
3449 /* 9 = Count R4000 VR4100 VR4300 */
3450 /* 10 = EntryHi R4000 VR4100 VR4300 */
3451 /* 11 = Compare R4000 VR4100 VR4300 */
3452 /* 12 = SR R4000 VR4100 VR4300 */
3459 /* 13 = Cause R4000 VR4100 VR4300 */
3466 /* 14 = EPC R4000 VR4100 VR4300 */
3467 /* 15 = PRId R4000 VR4100 VR4300 */
3468 #ifdef SUBTARGET_R3900
3477 /* 16 = Config R4000 VR4100 VR4300 */
3479 #ifdef SUBTARGET_R3900
3488 /* 17 = LLAddr R4000 VR4100 VR4300 */
3490 /* 18 = WatchLo R4000 VR4100 VR4300 */
3491 /* 19 = WatchHi R4000 VR4100 VR4300 */
3492 /* 20 = XContext R4000 VR4100 VR4300 */
3493 /* 26 = PErr or ECC R4000 VR4100 VR4300 */
3494 /* 27 = CacheErr R4000 VR4100 */
3495 /* 28 = TagLo R4000 VR4100 VR4300 */
3496 /* 29 = TagHi R4000 VR4100 VR4300 */
3497 /* 30 = ErrorEPC R4000 VR4100 VR4300 */
3498 GPR
[rt
] = 0xDEADC0DE; /* CPR[0,rd] */
3499 /* CPR[0,rd] = GPR[rt]; */
3502 sim_io_printf(sd
,"Warning: MFC0 %d,%d ignored (architecture specific)\n",rt
,rd
);
3504 sim_io_printf(sd
,"Warning: MTC0 %d,%d ignored (architecture specific)\n",rt
,rd
);
3507 else if (code
== 0x10 && (instruction
& 0x3f) == 0x18)
3510 if (SR
& status_ERL
)
3512 /* Oops, not yet available */
3513 sim_io_printf(sd
,"Warning: ERET when SR[ERL] set not handled yet");
3523 else if (code
== 0x10 && (instruction
& 0x3f) == 0x10)
3527 else if (code
== 0x10 && (instruction
& 0x3f) == 0x1F)
3535 sim_io_eprintf(sd
,"Unrecognised COP0 instruction 0x%08X at IPC = 0x%s : No handler present\n",instruction
,pr_addr(IPC
));
3536 /* TODO: When executing an ERET or RFE instruction we should
3537 clear LLBIT, to ensure that any out-standing atomic
3538 read/modify/write sequence fails. */
3542 case 2: /* undefined co-processor */
3543 sim_io_eprintf(sd
,"COP2 instruction 0x%08X at IPC = 0x%s : No handler present\n",instruction
,pr_addr(IPC
));
3546 case 1: /* should not occur (FPU co-processor) */
3547 case 3: /* should not occur (FPU co-processor) */
3548 SignalException(ReservedInstruction
,instruction
);
3555 /*-- instruction simulation -------------------------------------------------*/
3558 sim_engine_run (sd
, next_cpu_nr
, siggnal
)
3560 int next_cpu_nr
; /* ignore */
3561 int siggnal
; /* ignore */
3563 #if !defined(FASTSIM)
3564 unsigned int pipeline_count
= 1;
3568 if (STATE_MEMORY (sd
) == NULL
) {
3569 printf("DBG: simulate() entered with no memory\n");
3574 #if 0 /* Disabled to check that everything works OK */
3575 /* The VR4300 seems to sign-extend the PC on its first
3576 access. However, this may just be because it is currently
3577 configured in 32bit mode. However... */
3578 PC
= SIGNEXTEND(PC
,32);
3581 /* main controlling loop */
3583 /* Fetch the next instruction from the simulator memory: */
3584 uword64 vaddr
= (uword64
)PC
;
3587 unsigned int instruction
; /* uword64? what's this used for? FIXME! */
3591 printf("DBG: state = 0x%08X :",state
);
3593 if (state
& simSTOP
) printf(" simSTOP");
3594 if (state
& simSTEP
) printf(" simSTEP");
3596 if (state
& simHALTEX
) printf(" simHALTEX");
3597 if (state
& simHALTIN
) printf(" simHALTIN");
3599 if (state
& simBE
) printf(" simBE");
3605 DSSTATE
= (STATE
& simDELAYSLOT
);
3608 sim_io_printf(sd
,"DBG: DSPC = 0x%s\n",pr_addr(DSPC
));
3611 if (AddressTranslation(PC
,isINSTRUCTION
,isLOAD
,&paddr
,&cca
,isTARGET
,isREAL
)) {
3612 if ((vaddr
& 1) == 0) {
3613 /* Copy the action of the LW instruction */
3614 unsigned int reverse
= (ReverseEndian
? (LOADDRMASK
>> 2) : 0);
3615 unsigned int bigend
= (BigEndianCPU
? (LOADDRMASK
>> 2) : 0);
3618 paddr
= ((paddr
& ~LOADDRMASK
) | ((paddr
& LOADDRMASK
) ^ (reverse
<< 2)));
3619 LoadMemory(&value
,NULL
,cca
,AccessLength_WORD
,paddr
,vaddr
,isINSTRUCTION
,isREAL
);
3620 byte
= ((vaddr
& LOADDRMASK
) ^ (bigend
<< 2));
3621 instruction
= ((value
>> (8 * byte
)) & 0xFFFFFFFF);
3623 /* Copy the action of the LH instruction */
3624 unsigned int reverse
= (ReverseEndian
? (LOADDRMASK
>> 1) : 0);
3625 unsigned int bigend
= (BigEndianCPU
? (LOADDRMASK
>> 1) : 0);
3628 paddr
= (((paddr
& ~ (uword64
) 1) & ~LOADDRMASK
)
3629 | (((paddr
& ~ (uword64
) 1) & LOADDRMASK
) ^ (reverse
<< 1)));
3630 LoadMemory(&value
,NULL
,cca
, AccessLength_HALFWORD
,
3631 paddr
& ~ (uword64
) 1,
3632 vaddr
, isINSTRUCTION
, isREAL
);
3633 byte
= (((vaddr
&~ (uword64
) 1) & LOADDRMASK
) ^ (bigend
<< 1));
3634 instruction
= ((value
>> (8 * byte
)) & 0xFFFF);
3637 fprintf(stderr
,"Cannot translate address for PC = 0x%s failed\n",pr_addr(PC
));
3642 sim_io_printf(sd
,"DBG: fetched 0x%08X from PC = 0x%s\n",instruction
,pr_addr(PC
));
3645 IPC
= PC
; /* copy PC for this instruction */
3646 /* This is required by exception processing, to ensure that we can
3647 cope with exceptions in the delay slots of branches that may
3648 already have changed the PC. */
3649 if ((vaddr
& 1) == 0)
3650 PC
+= 4; /* increment ready for the next fetch */
3653 /* NOTE: If we perform a delay slot change to the PC, this
3654 increment is not requuired. However, it would make the
3655 simulator more complicated to try and avoid this small hit. */
3657 /* Currently this code provides a simple model. For more
3658 complicated models we could perform exception status checks at
3659 this point, and set the simSTOP state as required. This could
3660 also include processing any hardware interrupts raised by any
3661 I/O model attached to the simulator context.
3663 Support for "asynchronous" I/O events within the simulated world
3664 could be providing by managing a counter, and calling a I/O
3665 specific handler when a particular threshold is reached. On most
3666 architectures a decrement and check for zero operation is
3667 usually quicker than an increment and compare. However, the
3668 process of managing a known value decrement to zero, is higher
3669 than the cost of using an explicit value UINT_MAX into the
3670 future. Which system is used will depend on how complicated the
3671 I/O model is, and how much it is likely to affect the simulator
3674 If events need to be scheduled further in the future than
3675 UINT_MAX event ticks, then the I/O model should just provide its
3676 own counter, triggered from the event system. */
3678 /* MIPS pipeline ticks. To allow for future support where the
3679 pipeline hit of individual instructions is known, this control
3680 loop manages a "pipeline_count" variable. It is initialised to
3681 1 (one), and will only be changed by the simulator engine when
3682 executing an instruction. If the engine does not have access to
3683 pipeline cycle count information then all instructions will be
3684 treated as using a single cycle. NOTE: A standard system is not
3685 provided by the default simulator because different MIPS
3686 architectures have different cycle counts for the same
3689 [NOTE: pipeline_count has been replaced the event queue] */
3692 /* Set previous flag, depending on current: */
3693 if (STATE
& simPCOC0
)
3697 /* and update the current value: */
3704 /* NOTE: For multi-context simulation environments the "instruction"
3705 variable should be local to this routine. */
3707 /* Shorthand accesses for engine. Note: If we wanted to use global
3708 variables (and a single-threaded simulator engine), then we can
3709 create the actual variables with these names. */
3711 if (!(STATE
& simSKIPNEXT
)) {
3712 /* Include the simulator engine */
3713 #include "oengine.c"
3714 #if ((GPRLEN == 64) && !PROCESSOR_64BIT) || ((GPRLEN == 32) && PROCESSOR_64BIT)
3715 #error "Mismatch between run-time simulator code and simulation engine"
3717 #if (WITH_TARGET_WORD_BITSIZE != GPRLEN)
3718 #error "Mismatch between configure WITH_TARGET_WORD_BITSIZE and gencode GPRLEN"
3720 #if (WITH_FLOATING_POINT == HARD_FLOATING_POINT != defined (HASFPU))
3721 #error "Mismatch between configure WITH_FLOATING_POINT and gencode HASFPU"
3724 #if defined(WARN_LOHI)
3725 /* Decrement the HI/LO validity ticks */
3734 #endif /* WARN_LOHI */
3736 /* For certain MIPS architectures, GPR[0] is hardwired to zero. We
3737 should check for it being changed. It is better doing it here,
3738 than within the simulator, since it will help keep the simulator
3741 #if defined(WARN_ZERO)
3742 sim_io_eprintf(sd
,"The ZERO register has been updated with 0x%s (PC = 0x%s) (reset back to zero)\n",pr_addr(ZERO
),pr_addr(IPC
));
3743 #endif /* WARN_ZERO */
3744 ZERO
= 0; /* reset back to zero before next instruction */
3746 } else /* simSKIPNEXT check */
3747 STATE
&= ~simSKIPNEXT
;
3749 /* If the delay slot was active before the instruction is
3750 executed, then update the PC to its new value: */
3753 printf("DBG: dsstate set before instruction execution - updating PC to 0x%s\n",pr_addr(DSPC
));
3759 if (MIPSISA
< 4) { /* The following is only required on pre MIPS IV processors: */
3760 /* Deal with pending register updates: */
3762 printf("DBG: EMPTY BEFORE pending_in = %d, pending_out = %d, pending_total = %d\n",pending_in
,pending_out
,pending_total
);
3764 if (PENDING_OUT
!= PENDING_IN
) {
3766 int index
= PENDING_OUT
;
3767 int total
= PENDING_TOTAL
;
3768 if (PENDING_TOTAL
== 0) {
3769 fprintf(stderr
,"FATAL: Mis-match on pending update pointers\n");
3772 for (loop
= 0; (loop
< total
); loop
++) {
3774 printf("DBG: BEFORE index = %d, loop = %d\n",index
,loop
);
3776 if (PENDING_SLOT_REG
[index
] != (LAST_EMBED_REGNUM
+ 1)) {
3778 printf("pending_slot_count[%d] = %d\n",index
,PENDING_SLOT_COUNT
[index
]);
3780 if (--(PENDING_SLOT_COUNT
[index
]) == 0) {
3782 printf("pending_slot_reg[%d] = %d\n",index
,PENDING_SLOT_REG
[index
]);
3783 printf("pending_slot_value[%d] = 0x%s\n",index
,pr_addr(PENDING_SLOT_VALUE
[index
]));
3785 if (PENDING_SLOT_REG
[index
] == COCIDX
) {
3787 SETFCC(0,((FCR31
& (1 << 23)) ? 1 : 0));
3792 REGISTERS
[PENDING_SLOT_REG
[index
]] = PENDING_SLOT_VALUE
[index
];
3794 /* The only time we have PENDING updates to FPU
3795 registers, is when performing binary transfers. This
3796 means we should update the register type field. */
3797 if ((PENDING_SLOT_REG
[index
] >= FGRIDX
) && (PENDING_SLOT_REG
[index
] < (FGRIDX
+ 32)))
3798 FPR_STATE
[PENDING_SLOT_REG
[index
] - FGRIDX
] = fmt_uninterpreted
;
3802 printf("registers[%d] = 0x%s\n",PENDING_SLOT_REG
[index
],pr_addr(REGISTERS
[PENDING_SLOT_REG
[index
]]));
3804 PENDING_SLOT_REG
[index
] = (LAST_EMBED_REGNUM
+ 1);
3806 if (PENDING_OUT
== PSLOTS
)
3812 printf("DBG: AFTER index = %d, loop = %d\n",index
,loop
);
3815 if (index
== PSLOTS
)
3820 printf("DBG: EMPTY AFTER pending_in = %d, pending_out = %d, pending_total = %d\n",PENDING_IN
,PENDING_OUT
,PENDING_TOTAL
);
3824 #if !defined(FASTSIM)
3825 if (sim_events_tickn (sd
, pipeline_count
))
3827 /* cpu->cia = cia; */
3828 sim_events_process (sd
);
3831 if (sim_events_tick (sd
))
3833 /* cpu->cia = cia; */
3834 sim_events_process (sd
);
3836 #endif /* FASTSIM */
3840 /* This code copied from gdb's utils.c. Would like to share this code,
3841 but don't know of a common place where both could get to it. */
3843 /* Temporary storage using circular buffer */
3849 static char buf
[NUMCELLS
][CELLSIZE
];
3851 if (++cell
>=NUMCELLS
) cell
=0;
3855 /* Print routines to handle variable size regs, etc */
3857 /* Eliminate warning from compiler on 32-bit systems */
3858 static int thirty_two
= 32;
3864 char *paddr_str
=get_cell();
3865 switch (sizeof(addr
))
3868 sprintf(paddr_str
,"%08lx%08lx",
3869 (unsigned long)(addr
>>thirty_two
),(unsigned long)(addr
&0xffffffff));
3872 sprintf(paddr_str
,"%08lx",(unsigned long)addr
);
3875 sprintf(paddr_str
,"%04x",(unsigned short)(addr
&0xffff));
3878 sprintf(paddr_str
,"%x",addr
);
3887 char *paddr_str
=get_cell();
3888 sprintf(paddr_str
,"%08lx%08lx",
3889 (unsigned long)(addr
>>thirty_two
),(unsigned long)(addr
&0xffffffff));
3894 /*---------------------------------------------------------------------------*/
3895 /*> EOF interp.c <*/