1. MEC and ERC32 emulation

The file 'erc32.c' contains a model of the MEC, 512 K rom and 4 M ram.

The following paragraphs outline the implemented MEC functions.

1.1 UARTs

The UARTs are connected to two pseudo-devices, /dev/ttypc and /dev/ttypd.
The following registers are implemeted:

- UART A RX and TX register	(0x01f800e0)
- UART B RX and TX register	(0x01f800e4)
- UART status register		(0x01f800e8)

To speed up simulation, the UARTs operate at approximately 115200 baud. 
The UARTs generate interrupt 4 and 5 after each received or transmitted 
character.  The error interrupt is generated if overflow occurs - other
errors cannot occure.

1.2 Real-time clock and general pupose timer A

The following registers are implemeted:

- Real-time clock timer				(0x01f80080, read-only)
- Real-time clock scaler program register 	(0x01f80084, write-only)
- Real-time clock counter program register 	(0x01f80080, write-only)

- Genearl pupose timer 				(0x01f80088, read-only)
- Real-time clock scaler program register 	(0x01f8008c, write-only)
- General purpose timer counter prog. register 	(0x01f80088, write-only)

- Timer control register			(0x01f80098, write-only)

1.3 Interrupt controller

The interrupt controller is implemented as in the MEC specification with
the exception of the interrupt shape register. Since external interrupts
are not possible, the interrupt shape register is not implemented. The
only internal interrupts that are generated are the real-time clock, 
the general purpose timer and UARTs. However, all 15 interrupts
can be tested via the interrupt force register.

The following registers are implemeted:

- Interrupt pending register		       (0x01f80048, read-only)
- Interrupt mask register		       (0x01f8004c, read-write)
- Interrupt clear register		       (0x01f80050, write-only)
- Interrupt force register		       (0x01f80054, read-write)

1.4 Breakpoint and watchpoint register

The breakpoint and watchpoint functions are implemented as in the MEC
specification. Traps are correctly generated, and the system fault status
register is updated accordingly. Implemeted registers are:

- Debug control register			(0x01f800c0, read-write)
- Breakpoint register				(0x01f800c4, write-only)
- Watchpoint register				(0x01f800c8, write-only)
- System fault status register			(0x01f800a0, read-write)
- Firts failing address register		(0x01f800a4, read-write)


1.5 Memory interface

The following memory areas are valid for the ERC32 simulator:

0x00000000 - 0x00080000		ROM (512 Kbyte, loaded at start-up)
0x02000000 - 0x02400000		RAM (4 Mbyte, initialised to 0x0)
0x01f80000 - 0x01f800ff		MEC registers

Access to unimplemented MEC registers or non-existing memory will result
in a memory exception trap. However, access to unimplemented MEC registers
in the area 0x01f80000 - 0x01f80100 will not cause a memory exception trap.
The written value will be stored in a register and can be read back. It
does however not affect the function in any way. 

The memory configuartion register is used to define available memory
in the system. The fields RSIZ and PSIZ are used to set RAM and ROM
size, the remaining fields are not used.  NOTE: after reset, the MEC 
is set to decode 4 Kbyte of ROM and 256 Kbyte of RAM. The memory 
configuration register has to be updated to reflect the available memory. 

The waitstate configuration register is used to generate waitstates. 
This register must also be updated with the correct configuration after 
reset.

The memory protection scheme is implemented - it is enabled through bit 3
in the MEC control register.

The following registers are implemeted:

- MEC control register (bit 3 only)		(0x01f80000, read-write)
- Memory control register			(0x01f80010, read-write)
- Waitstate configuration register		(0x01f80018, read-write)
- Memory access register 0			(0x01f80020, read-write)
- Memory access register 1			(0x01f80024, read-write)

1.6 Watchdog

The watchdog is implemented as in the specification. The input clock is
always the system clock regardsless of WDCS bit in mec configuration 
register.

The following registers are implemeted:
 
- Watchdog program and acknowledge register	(0x01f80060, write-only)
- Watchdog trap door set register		(0x01f80064, write-only)

1.7 Software reset register

Implemented as in the specification (0x01f800004, write-only).

1.8 Power-down mode

The power-down register (0x01f800008) is implemented as in the specification.
However, if the simulator event queue is empty, power-down mode is not
entered since no interrupt would be generated to exit from the mode. A
Ctrl-C in the simulator window will exit the power-down mode.

1.9 MEC control register

The following bits are implemented in the MEC control register:

Bit	Name	Function
0	PRD	Power-down mode enable
1	SWR	Soft reset enable
3	APR	Access protection enable

How to use SIS with GDB
-----------------------

1. Building GDB with SIS

To build GDB with the SIS/ERC32 simulator, configure with option
'--target sparc-erc32-aout' and build as usual.

2. Attaching the simulator

To attach GDB to the simulator, use:

target sim [options] [files]

The following options are supported:

 -nfp		Disable FPU. FPops will cause an FPU disabled trap.

 -freq <f>	Set the simulated "system clock" to <f> MHz.

 -v		Verbose mode.

 -nogdb		Disable GDB breakpoint handling (see below)

The listed [files] are expected to be in aout format and will be
loaded in the simulator memory prior. This could be used to load
a boot block at address 0x0 if the application is linked to run
from RAM (0x2000000).

To start debugging a program type 'load <program>' and debug as
usual. 

The native simulator commands can be reached using the GDB 'sim'
command:

sim <sis_command>

Direct simulator commands during a GDB session must be issued
with care not to disturb GDB's operation ... 

For info on supported ERC32 functionality, see README.sis.


3. Loading aout files

The GDB load command loads an aout file into the simulator
memory with the data section starting directly after the text
section regardless of wich start address was specified for the data
at link time! This means that your applications either has to include
a routine that initialise the data segment at the proper address or
link with the data placed directly after the text section.

A copying routine is fairly simple, just copy all data between
_etext and _data to a memory loaction starting at _environ. This
should be done at the same time as the bss is cleared (in srt0.s).


4. GDB breakpoint handling

GDB inserts breakpoint in the form of the 'ta 1' instruction. The
GDB-integrated simulator will therefore recognize the breakpoint
instruction and return control to GDB. If the application uses
'ta 1', the breakpoint detection can be disabled with the -nogdb
switch. In this case however, GDB breakpoints will not work.


Report problems to Jiri Gaisler ESA/ESTEC (jgais@wd.estec.esa.nl)

SIS - Sparc Instruction Simulator README file  (v2.0, 05-02-1996)
-------------------------------------------------------------------

1. Introduction

The SIS is a SPARC V7 architecture simulator. It consist of two parts,
the simulator core and a user defined memory module. The simulator
core executes the instructions while the memory module emulates memory
and peripherals. 

2. Usage

The simulator is started as follows: 

sis [-uart1 uart_device1] [-uart2 uart_device2] 
    [-nfp] [-freq frequency] [-c batch_file] [files] 

The default uart devices for SIS are /dev/ptypc and /dev/ptypd. The
-uart[1,2] switch can be used to connect the uarts to other devices.
Use 'tip /dev/ttypc'  to connect a terminal emulator to the uarts.
The '-nfp' will disable the simulated FPU, so each FPU instruction will
generate a FPU disabled trap. The '-freq' switch can be used to define
which "frequency" the simulator runs at. This is used by the 'perf'
command to calculated the MIPS figure for a particular configuration.
The give frequency must be an integer indicating the frequency in MHz.

The -c option indicates that sis commands should be read from 'batch_file' 
at startup.

Files to be loaded must be in one of the supported formats (see INSTALLATION),
and will be loaded into the simulated memory. The file formats are
automatically recognised.

The script 'startsim' will start the simulator in one xterm window and
open a terminal emulator (tip) connected to the UART A in a second
xterm window. Below is description of commands  that are recognized by 
the simulator. The command-line is parsed using GNU readline. A command
history of 64 commands is maintained. Use the up/down arrows to recall
previous commands. For more details, see the readline documentation.

batch <file>

Execute a batch file of SIS commands.

+bp <address>

Adds an breakpoint at address <address>.

bp

Prints all breakpoints

-bp <num>

Deletes breakpoint <num>. Use 'bp' to see which number is assigned to the 
breakpoints.

cont [inst_count]

Continue execution at present position, optionally for [inst_count] 
instructions.

dis [addr] [count]

Disassemble [count] instructions at address [addr]. Default values for
count is 16 and addr is the present address.

echo <string>

Print <string> to the simulator window.

float

Prints the FPU registers

go <address> [inst_count]

The go command will set pc to <address> and npc to <address> + 4, and start
execution. No other initialisation will be done. If inst_count is given, 
execution will stop after the specified number of instructions.

help

Print a small help menu for the SIS commands.

hist [trace_length]

Enable the instruction trace buffer. The 'trace_length' last executed 
instructions will be placed in the trace buffer. A 'hist' command without 
a trace_length will display the trace buffer. Specifying a zero trace 
length will disable the trace buffer.

load  <file_name>

Loads a file into simulator memory. 

mem [addr] [count]

Display memory at [addr] for [count] bytes. Same default values as above.

quit

Exits the simulator.

perf [reset]

The 'perf' command will display various execution statistics. A 'perf reset' 
command will reset the statistics. This can be used if statistics shall 
be calculated only over a part of the program. The 'run' and 'reset' 
command also resets the statistic information.

reg [reg_name] [value]

Prints and sets the IU regiters. 'reg' without parameters prints the IU
registers. 'reg [reg_name] [value]' sets the corresponding register to
[value]. Valid register names are psr, tbr, wim, y, g1-g7, o0-o7 and
l0-l7.

reset

Performs a power-on reset. This command is equal to 'run 0'.

run [inst_count]

Resets the simulator and starts execution from address 0. If an instruction
count is given (inst_count), the simulator will stop after the specified 
number of instructions. The event queue is emptied but any set breakpoints
remain.

step

Equal to 'trace 1'

tra [inst_count]

Starts the simulator at the present position and prints each instruction
it executes. If an instruction count is given (inst_count), the simulator 
will stop after the specified number of instructions.

Typing a 'Ctrl-C' will interrupt a running simulator. 

Short forms of the commands are allowed, e.g 'c' 'co' or 'con' are all
interpreted as 'cont'. 


3. Simulator core

The SIS emulates the behavior of the 90C601E and 90C602E sparc IU and
FPU from Matra MHS. These are roughly equivalent to the Cypress C601
and C602.  The simulator is cycle true, i.e a simulator time is
maintained and inremented according the IU and FPU instruction timing.
The parallel execution between the IU and FPU is modelled, as well as
stalls due to operand dependencies (FPU). The core interacts with the
user-defined memory modules through a number of functions. The memory
module must provide the following functions:

int memory_read(asi,addr,data,ws)
int asi;
unsigned int addr;
unsigned int *data;
int *ws;

int memory_write(asi,addr,data,sz,ws)
int asi;
unsigned int addr;
unsigned int *data;
int sz;
int *ws;

int sis_memory_read(addr, data, length)
unsigned int addr;
char   *data;
unsigned int length;

int sis_memory_write(addr, data, length)
unsigned int addr;
char    *data;
unsigned int length;

int init_sim()

int reset()

int error_mode(pc)
unsigned int pc;

memory_read() is used by the simulator to fetch instructions and
operands.  The address space identifier (asi) and address is passed as
parameters. The read data should be assigned to the data pointer
(*data) and the number of waitstate to *ws. 'memory_read' should return
0 on success and 1 on failure. A failure will cause a data or
instruction fetch trap. memory_read() always reads one 32-bit word.

sis_memory_read() is used by the simulator to display and disassemble
memory contants. The function should copy 'length' bytes of the simulated
memory starting at 'addr' to '*data'.
The sis_memory_read() should return 1 on success and 0 on failure.
Failure should only be indicated if access to unimplemented memory is attempted.

memory_write() is used to write to memory. In addition to the asi
and address parameters, the size of the written data is given by 'sz'.
The pointer *data points to the data to be written. The 'sz' is coded
as follows:

  sz	access type
  0	  byte
  1	  halfword
  2	  word
  3	  double-word

If a double word is written, the most significant word is in data[0] and
the least significant in data[1].

sis_memory_write() is used by the simulator during loading of programs.
The function should copy 'length' bytes from *data to the simulated
memory starting at 'addr'. sis_memory_write() should return 1 on 
success and 0 on failure. Failure should only be indicated if access 
to unimplemented memory is attempted. See erc32.c for more details 
on how to define the memory emulation functions.

The 'init_sim' is called once when the simulator is started. This function
should be used to perform initialisations of user defined memory or 
peripherals that only have to be done once, such as opening files etc.

The 'reset' is called every time the simulator is reset, i.e. when a
'run' command is given. This function should be used to simulate a power
on reset of memory and peripherals.

error_mode() is called by the simulator when the IU goes into error mode,
typically if a trap is caused when traps are disabled. The memory module
can then take actions, such as issue a reset.

sys_reset() can be called by the memory module to reset the simulator. A
reset will empty the event queue and perform a power-on reset.

4. Events and interrupts

The simulator supports an event queue and the generation of processor
interrupts. The following functions are available to the user-defined
memory module:

event(cfunc,arg,delta)
void (*cfunc)(int32_t);
int32_t arg;
unsigned int delta;

set_int(level,callback,arg)
int32_t level;
void (*callback)(int32_t);
int32_t arg;

clear_int(level)
int level;

sim_stop()

The 'event' functions will schedule the execution of the function 'cfunc'
at time 'now + delta' clock cycles. The parameter 'arg' is passed as a 
parameter to 'cfunc'.

The 'set_int' function set the processor interrupt 'level'. When the interrupt
is taken, the function 'callback' is called with the argument 'arg'. This
will also clear the interrupt. An interrupt can be cleared before it is
taken by calling 'clear_int' with the appropriate interrupt level.

The sim_stop function is called each time the simulator stops execution.
It can be used to flush buffered devices to get a clean state during
single stepping etc.

See 'erc32.c' for examples on how to use events and interrupts.

5. Memory module

The supplied memory module (erc32.c) emulates the functions of memory and
the MEC asic developed for the 90C601/2. It includes the following functions:

* UART A & B
* Real-time clock
* General purpose timer
* Interrupt controller
* Breakpoint register
* Watchpoint register
* 512 Kbyte ROM
* 4 Mbyte RAM

See README.erc32 on how the MEC functions are emulated.  For a detailed MEC
specification, look at the ERC32 home page at URL:

http://www.estec.esa.nl/wsmwww/erc32

6. Compile and linking programs

The directory 'examples' contain some code fragments for SIS.
The script gccx indicates how the native sunos gcc and linker can be used
to produce executables for the simulator. To compile and link the provided
'hello.c', type 'gccx hello.c'. This will build the executable 'hello'.
Start the simulator by running 'startsim hello', and issue the command 'run.
After the program is terminated, the IU will be force to error mode through
a software trap and halt. 

The programs are linked with a start-up file, srt0.S. This file includes
the traptable and window underflow/overflow trap routines.

7. IU and FPU instruction timing.

The simulator provides cycle true simulation. The following table shows
the emulated instruction timing for 90C601E & 90C602E:

Instructions	      Cycles

jmpl, rett		2
load			2
store			3
load double		3
store double		4
other integer ops	1
fabs			2
fadds			4
faddd			4
fcmps			4
fcmpd			4
fdivs			20
fdivd			35
fmovs			2
fmuls			5
fmuld			9
fnegs			2
fsqrts			37
fsqrtd			65
fsubs			4
fsubd			4
fdtoi			7
fdots			3
fitos			6
fitod			6
fstoi			6
fstod			2

The parallel operation between the IU and FPU is modelled. This means
that a FPU instruction will execute in parallel with other instructions as
long as no data or resource dependency is detected. See the 90C602E data
sheet for the various types of dependencies. Tracing using the 'trace'
command will display the current simulator time in the left column. This
time indicates when the instruction is fetched. If a dependency is detetected,
the following fetch will be delayed until the conflict is resolved.

The load dependency in the 90C601E is also modelled - if the destination 
register of a load instruction is used by the following instruction, an 
idle cycle is inserted.

8. FPU implementation

The simulator maps floating-point operations on the hosts floating point
capabilities. This means that accuracy and generation of IEEE exceptions is 
host dependent.

Indexes created Sat Jun 08 03:50:41 MDT 2024