path: root/sis.texi

\input texinfo   @c -*-texinfo-*-
@setfilename sis.info
@comment $Id@w{$}
@comment %**start of header
@include version.texi
@settitle SIS - Simple Instruction Simulator @value{VERSION}
@syncodeindex pg cp
@comment %**end of header
@copying
This manual is for SIS (version @value{VERSION}, @value{UPDATED}).

Copyright @copyright{} 2019 Free Software Foundation, Inc.

@quotation
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.3 or
any later version published by the Free Software Foundation; with no
Invariant Sections, with no Front-Cover Texts, and with no Back-Cover
Texts.  A copy of the license is included in the section entitled
``GNU Free Documentation License''.
@end quotation
@end copying

@dircategory Texinfo documentation system
@direntry
* sis: (sis)Invoking sis.
@end direntry

@titlepage
@title SIS - Simple Instruction Simulator
@subtitle for version @value{VERSION}, @value{UPDATED}
@author Jiri Gaisler (@email{jiri@@gaisler.se})
@page
@vskip 0pt plus 1filll
@insertcopying
@end titlepage

@contents

@ifnottex
@node Top
@top SIS

This manual is for SIS (version @value{VERSION}, @value{UPDATED}).
@end ifnottex

@menu
* Introduction::
* Invoking sis::
* Commands ::
* Emulated Systems ::
* Multi-processing ::
* Interfacing to GDB ::
* Code coverage ::
* Building SIS ::
* GNU Free Documentation License::
* Index::
@end menu

@node Introduction
@chapter Introduction
@cindex Introduction

SIS is a SPARC V7/V8 and RISC-V RV32IMACFD architecture simulator.
It consist of three main parts: an event-based simulator core,
a cpu (SPARC/RISCV) emulation module and system-specific memory and
peripheral modules.

SIS can emulate four specific systems:


@table @code
@item ERC32
ERC32 SPARC V7 processor

@item LEON2
LEON2 SPARC V8 processor

@item LEON3
LEON3 SPARC V8 processor

@item RISC-V
RISC-V (RV32IMACFD) processor

@end table

The LEON3 and RISC-V emulation also supports SMP with up to four processor cores.

@node Invoking sis
@chapter Invoking sis

@pindex sis
@cindex invoking @command{sis}

The simulator is started as follows:
@smallexample
sis [options] [file] 
@end smallexample

The following options are recognized:

@table @code
@item -c @var{file}
Read sis commands from @var{file} at startup.

@item -cov
Enable code coverage and write a coverage file at exit.

@item -d @var{clocks}
Set the the number of @var{clocks} in each time-slice for multi-processor
simulation. Default is 50, set lower for higher accuracy.

@item -erc32
Emulate the SPARC V7 ERC32 processor

@item -freq @var{freq}
Set frequency of emulated cpu. This is used by the 'perf'
command to calculated the MIPS figure for a particular configuration.
The frequency must be an integer indicating the frequency in MHz.

@item -gdb
Start a gdb server, listening on port 1234. An alternative port can
be specified with @var{-port nn}.

@item -leon2
Emulate the SPARC V8 LEON2 processor

@item -leon3
Emulate the SPARC V8 LEON3 processor

@item -m @var{cores}
Enable the number of @var{cores} (2 - 4) in a leon3 or RISC-V multi-processor system.

@item -nfp
Disable the simulated FPU, so each FPU instruction will
generate a FPU disabled trap.

@item -port @var{port}
Use @var{port} for the gdb server. Default is port 1234.

@item -r
Start execution immediately without an interactive shell. This is useful
for automated testing.

@item -riscv
Emulate a RISC-V RV32IMACFD processor

@item -tlim @var{delay}
Used together with @var{-r} to limit the amount of simulated time that
the simulator runs for before exiting. The following units are recognized:
@var{us}, @var{ms} and @var{s}. To limit simulated time to 100 seconds,
use: @var{-tlim 100 s}.

@item -uart1 @var{device}
Connect UART1 (console) of the simulator to @var{device}. stdin/stout is default.
@item -v
Increase the debug level with 1, to provide more diagnostic messages. Can be added multiple times.


@item file
The executable file to be loaded must be an SPARC or RISCV ELF file.
On start-up, the file is loaded into the simulated memory.

@end table

@node Commands
@chapter Commands
@cindex Commands

Below is the description of commands that are recognized by the simulator.
The command-line is parsed using GNU readline. A command
history of 64 commands is maintained. Use the up/down arrows to recall
previous commands. For more details, see the readline documentation.

@table @code
@item batch @var{file}

Execute a batch file of SIS commands.

@item +bp @var{address}
@itemx break @var{address}

Set a breakpoint at @var{address}.

@item bp
Print all breakpoints.

@item delete @var{num}
Delete breakpoint @var{num}. Use @code{bp} or @code{break} to see which
number is assigned to the breakpoints.

@item csr
Show RISC-V CSR registers

@item cont [@var{count}]
Continue execution at present position, optionally for @var{count} 
instructions.

@item dis [@var{addr}] [@var{count}]
Disassemble [@var{count}] instructions at address [@var{addr}]. Default
values for @var{count} is 16 and @var{addr} is the present program counter.

@item echo @var{string}
Print @var{string} to the simulator window.

@item float
Print the FPU registers

@item gdb [@var{port}]
Start the gdb server interface. Default port is 1234, but can be overriden using
the @var{port} argument. @code{gdb} should be started with @code{target extended-remote localhost:1234}.

@item go @var{address} [@var{count}]
Set pc to @var{address} and resume execution. If @var{count} is given,
@code{sis} will stop after @var{count} instructions have been executed.

@item help
Print a small help menu for the SIS commands.

@item hist [@var{trace_length}]

Enable the instruction trace buffer. The @var{trace_length} last executed 
instructions will be placed in the trace buffer. A @code{hist} command without 
a @var{trace_length} will display the trace buffer. Specifying a zero trace 
length will disable the trace buffer.

@item load  @var{file_name}

Load an ELF file into simulator memory. 

@item mem [@var{addr}] [@var{count}]

Display memory at [@var{addr}] for [@var{count}] bytes. Same default values as for the @code{dis} command.

@item quit
Exits the simulator.

@item perf [reset]
The @code{perf} command will display various execution statistics.
A @code{perf reset} 
command will reset the statistics. This can be used if statistics shall 
be calculated only over a part of the program. The @code{run} and @code{reset} 
command also resets the statistic information.

@item reg [@var{reg_name}] [@var{value}]
Print or set the CPU registers. @code{reg} without parameters prints the CPU
registers. @code{reg} @var{reg_name value} sets the corresponding register to
@var{value}. Valid register names for SPARC are psr, tbr, wim, y, g1-g7, o0-o7
and l0-l7. Valid register names for RISCV-V are mtvec, mstatus, pc, 
ra, sp, gp, tp, t0-t6, s0-s11 and a0-a7. 

@item reset
Perform a power-on reset. This command is equal to @code{run 0}.

@item run [@var{count}]

Reset the simulator and start execution from the entry point of the loaded
ELF file. If an instruction count is given (@var{count}), the simulator will
stop after the specified number of instructions. The event queue is emptied
but any set breakpoints remain.

@item step

Execute one instruction and print it to the simulator console.
Equal to command @code{trace 1}

@item sym

List symbols and corresponding addresses in the loaded program.

@item trace [@var{count}]

Resume the simulator at the present position and print each execute
instruction executes. If an instruction count is given (@var{count}),
the simulator will stop after the specified number of instructions.

@item wmem @var{addr data}
Write @var{data} to memory at @var{addr}. Data is written as a 32-bit word.

@item wp
Print all watchpoints

@item +wpr @var{address}
Adds an read watchpoint at address <address>.

@item -wpr @var{num}
Delete read watchpoint @var{num}. Use @var{wp} to see which number is
assigned to the watchpoints.

@item +wpw @var{address}
@itemx watch @var{address}
Adds an write watchpoint at @var{address}.

@item -wpw @var{num}

Delete write watchpoint @var{num}. Use @code{wp} to see which number
is assigned to the watchpoints.

@end table

Typing a 'Ctrl-C' will interrupt a running simulator.

Short forms of the commands are allowed, e.g 'c' 'co' or 'con' are all
interpreted as 'cont'.

@node Emulated Systems
@chapter Emulated Systems
@cindex Emulated Systems

@code{sis} is capable of emulating four different processor systems:

@table @code
@item ERC32
ERC32 SPARC V7 processor

@item LEON2
LEON2 SPARC V8 processor

@item LEON3
LEON3 SPARC V8 processor

@item RISC-V
RISC-V (RV32IMACFD) processor

@end table

The following sections outline the emulation characteristics of the four supported systems.

@section ERC32 SPARC V7 processor

The radiation-hard ERC32 processor was developed by ESA in the mid-90's for critical space application. It was used in the control computer for the International Space Station (ISS) and also in the ATV re-supply ship for the ISS. The sub-sequent single-chip ERC32SC was used in a multitude of satellites, launchers and interplanetary probes, and is still being manufactured by Atmel. See the ESA ERC32 page (http://http://microelectronics.esa.int/erc32/index.html) for more technical documetation.

Sis emulates the original three-chip version of the ERC32 processor, consisting of the integer unit (IU), floating-point unit (FPU) and the memort controller (MEC). The IU is based on the Cypress CY601 SPARC V7 processor, while the FPU is based on the Meiko FPU. The MEC implements various peripheral functions and a memory controller. The single-chip verion of ERC32 (ERC32SC/TSC695F) is functionally identical to the original chip-set, but can operate at a higher frequency (25 MHz)

@noindent
The following functions of the ERC32 are emulated by sis:

@itemize @bullet
@item
IU & FPU with accurate timing
@item
UART A & B
@item
Real-time clock
@item
General purpose timer
@item
Interrupt controller
@item
Breakpoint register
@item
Watchpoint register
@item
16 Mbyte ROM
@item
16 Mbyte RAM
@end itemize

@subsection IU and FPU instruction timing.

The simulator provides cycle true simulation for ERC32. The following table
shows the emulated instruction timing for IU & FPU:

@multitable {other integer ops} {Cycles}
@headitem Instruction @tab Cycles
@item jmpl, rett @tab 2
@item load @tab 2
@item store @tab 3
@item load double @tab 3
@item store double @tab 4
@item other integer ops @tab 1
@item fabs @tab 2
@item fadds @tab 4
@item faddd @tab 4
@item fcmps @tab 4
@item fcmpd @tab 4
@item fdivs @tab 20
@item fdivd @tab 35
@item fmovs @tab 2
@item fmuls @tab 5
@item fmuld @tab 9
@item fnegs @tab 2
@item fsqrts @tab 37
@item fsqrtd @tab 65
@item fsubs @tab 4
@item fsubd @tab 4
@item fdtoi @tab 7
@item fdots @tab 3
@item fitos @tab 6
@item fitod @tab 6
@item fstoi @tab 6
@item fstod @tab 2
@end multitable

The parallel operation between the IU and FPU is modelled. This means
that a FPU instruction will execute in parallel with other instructions as
long as no data or resource dependency is detected. See the 90C602E data
sheet for the various types of dependencies. Tracing using the 'trace'
command will display the current simulator time in the left column. This
time indicates when the instruction is fetched. If a dependency is detected,
the following fetch will be delayed until the conflict is resolved.

The load dependency in the IU is also modelled - if the destination
register of a load instruction is used by the following instruction, an
idle cycle is inserted.

@subsection UART A and B
UART A is by default connected to the console, while UART B is disabled. Both UARTs can be connected to any file/device using the -uart1 and -uart2 options at start-up. The following registers are implemented:

@multitable {Very long text so that we avoid wrapping } {Address}
@headitem Register @tab Address
@item UART A RX and TX register	@tab 0x01f800e0
@item UART B RX and TX register	@tab 0x01f800e4
@item UART status register	@tab 0x01f800e8
@end multitable

The UARTs generate interrupt 4 and 5 after each received or transmitted
character.  The error interrupt is generated if overflow occurs - other
errors cannot occur.

@subsection Real-time clock and general purpose timer A

The following registers are implemented:

@multitable {Very long text so that we avoid wrapping } {Address}
@headitem Register @tab Address
@item Real-time clock timer @tab 0x01f80080
@item Real-time clock scaler program register @tab 0x01f80084
@item Real-time clock counter program register @tab 0x01f80080
@item General purpose timer @tab 0x01f80088
@item Real-time clock scaler program register @tab 0x01f8008c
@item General purpose timer counter register @tab 0x01f80088
@item Timer control register @tab 0x01f80098
@end multitable

@subsection Interrupt controller

The interrupt controller is implemented as in the MEC specification with
the exception of the interrupt shape register. Since external interrupts
are not possible, the interrupt shape register is not implemented. The
only internal interrupts that are generated are the real-time clock, 
the general purpose timer and UARTs. However, all 15 interrupts
can be tested via the interrupt force register.

The following registers are implemented:

@multitable {Very long text so that we avoid wrapping } {Address}
@headitem Register @tab Address
@item Interrupt pending register @tab 0x01f80048
@item Interrupt mask register @tab 0x01f8004c
@item Interrupt clear register @tab 0x01f80050
@item Interrupt force register @tab 0x01f80054
@end multitable

@subsection System fault status registers

The system fault status register and fist failing address register are implemented and updated accordingly. Implemented registers are:

@multitable {Very long text so that we avoid wrapping } {Address}
@headitem Register @tab Address
@item System fault status register @tab 0x01f800a0
@item First failing address register @tab 0x01f800a4
@end multitable

@subsection Memory interface

The following memory areas are valid for the ERC32 simulator:

@multitable {Very long text so that we avoid wrapping } {A long long Address}
@headitem Register @tab Address
@item 0x00000000 - 0x01000000 @tab ROM (16 Mbyte)
@item 0x02000000 - 0x03000000 @tab RAM (16 Mbyte)
@item 0x01f80000 - 0x01f800ff @tab MEC registers
@end multitable

Access to unimplemented MEC registers or non-existing memory will result
in a memory exception trap. 

The memory configuration register is used to define available memory
in the system. The fields RSIZ and PSIZ are used to set RAM and ROM
size, the remaining fields are not used.  NOTE: after reset, the MEC
is set to decode 4 Kbyte of ROM and 256 Kbyte of RAM. The memory
configuration register has to be updated to reflect the available memory.

The waitstate configuration register is used to generate waitstates.
This register must also be updated with the correct configuration after
reset.

The memory protection scheme is implemented - it is enabled through bit 3
in the MEC control register.

The following registers are implemented:

@multitable {Very long text so that we avoid wrapping } {A long Address}
@headitem Register @tab Address
@item MEC control register @tab 0x01f80000
@item Memory control register @tab 0x01f80010
@item Waitstate configuration register @tab 0x01f80018
@item Memory access register 0 @tab 0x01f80020
@item Memory access register 1 @tab 0x01f80024
@end multitable

@subsection Watchdog

The watchdog is implemented as in the specification. The input clock is
always the system clock regardless of WDCS bit in MEC configuration
register.

The following registers are implemented:
 
@multitable {Very long text so that we avoid wrapping } {A long Address}
@headitem Register @tab Address
@item Watchdog program/acknowledge register	@tab 0x01f80060
@item Watchdog trap door set register		@tab 0x01f80064
@end multitable

@subsection Software reset register

Implemented as in the specification (0x01f800004, write-only).

@subsection Power-down mode

The power-down register (0x01f800008) is implemented as in the specification.
During power-down, the simulator skips time until next event in the event queue.
Ctrl-C in the simulator window will exit the power-down mode.

@subsection MEC control register

The following bits are implemented in the MEC control register:

@multitable {Bits } {name} {The long name of the function}
@headitem Bit  @tab Name @tab Function
@item  0 @tab PRD @tab Power-down mode enable
@item  1 @tab SWR @tab Soft reset enable
@item  2 @tab APR @tab Access protection enable
@end multitable

@section LEON2 emulation

In LEON2 mode, SIS emulates a LEON2 system as defined in the LEON2 IP manual.
The emulated system includes the LEON2 standard peripherals, 16 Mbyte ROM
and 16 Mbyte RAM. The SPARC emulation supports an FPU but not the LEON2 MMU.

To start sis in LEON2 mode, use the -leon2 switch.

@subsection LEON2 peripherals

SIS emulates one LEON2 UART, the interrupt controller and the timer unit.
The interrupt controller is implemented as described in the
LEON2 IP manual, with the exception of the interrupt level register.
Secondary interrupts are not supported.
The timer unit is configured with two timers and separate interrupts (8 and 9).
The scaler is configured to 16 bits, while the counters are 32 bits.
The UART generates interrupt 3.


@subsection Memory interface

The following memory areas are valid for LEON2:

@multitable {Very long text so that we avoid wrapping } {A long long Address}
@headitem Address  @tab Type
@item 0x00000000 - 0x01000000 @tab ROM (16 Mbyte)
@item 0x40000000 - 0x41000000 @tab RAM (16 Mbyte)
@item 0x80000000 - 0x80000100 @tab APB bus
@end multitable

Access to non-existing memory will result in a memory exception trap.

@subsection Power-down mode

The LEON2 power-down register (0x80000018) is supported. When power-down is
entered, time is skipped forward until the next event in the event queue.
A Ctrl-C in the simulator window will exit the power-down mode.

@section LEON3 emulation

In LEON3 mode, SIS emulates a LEON3 system as defined in the GRLIP IP manual.
The emulated system includes the standard peripherals such as APBUART, GPTIMER, IRQMP and SRCTRL. The emulated system includes 16 Mbyte ROM
and 16 Mbyte RAM. The SPARC emulation supports an FPU but not the LEON3 MMU.

To start sis in LEON3 mode, use the -leon3 switch.

@subsection LEON3 peripherals

The following IP cores from GRLIB are emulated in LEON3 mode:

@multitable {The long name of the core} {Address_long} {Interrupt}
@headitem IP Core  @tab Address @tab Interrupt
@item  APBMAST @tab 0x80000000 @tab -
@item  APBUART @tab 0x80000100 @tab 3
@item  IRQMP @tab 0x80000200 @tab -
@item  GPTIMER @tab 0x80000300 @tab 8, 9
@end multitable

@subsection Memory interface

The following memory areas are valid for LEON3:

@multitable {Very long text so that we avoid wrapping } {A long long Address}
@headitem Address  @tab Type
@item 0x00000000 - 0x01000000 @tab ROM (16 Mbyte)
@item 0x40000000 - 0x41000000 @tab RAM (16 Mbyte)
@item 0x80000000 - 0x81000000 @tab APB bus
@item 0xFFFFF000 - 0xFFFFFFFF @tab AHB plug&play
@end multitable

Access to non-existing memory will result in a memory exception trap.

@subsection Power-down mode

The LEON3 power-down register (%ars19) is supported. When power-down is
entered, time is skipped forward until the next event in the event queue.
A Ctrl-C in the simulator window will exit the power-down mode.

@section RISC-V emulation

In RISC-V mode, SIS emulates a RV32IMACFD processor as defined in the 
RISC-V specification 1.9. The RISC-V procssor is attached to an identical GRLIB
sub-system as when LEON3 is emulated.

To start sis in RISC-V mode, use the -riscv switch.

@subsection Power-down mode

The RISC-V power-down feature (WFI) is supported. When power-down is
entered, time is skipped forward until the next event in the event queue.
Ctrl-C in the simulator window will exit the power-down mode.

@subsection Code coverage

Code coverage is currently only supported for 32-bit instructions, i.e.
the C-extension can not be used when code coverage is measured.

@subsection RISC-V 64-bit timer

The standard RISC-V 64-bit timer is provided and can be read through the 
time and timeh CSR. The timer does not generare any interrupt and the
timecmp register is not implemented.

@node Multi-processing
@chapter Multi-processing 
@cindex Multi-processing 

When emulating a LEON3 or RISC-V processor, SIS can emulate up to four cores
in the target system (SMP). The cores are simulated in a round-robin fashion
with a time-slice of 50 clocks. Shorter or longer time-slices can be selected
using -d <clocks>.

To start SIS with SMP, use the switch -m <n> when starting the simulator
where n can be 2 - 4.

@node Interfacing to GDB
@chapter Interfacing to GDB 
@cindex Interfacing to GDB 

SIS can be connected to gdb through a network socket using the gdb remote
interface. Either start SIS with -gdb, or issue the 'gdb' command inside SIS,
and connect gdb with 'target extended-remote localhost:1234'. The port can be changed using the -port option.

@node Code coverage
@chapter Code coverage 
@cindex Code coverage 

Code coverage data will be produce if sis is started with the -cov switch.
The coverage data will be stored in a file name same as the file used with 
the load command, appended with .cov. For instance, if sis is run with
hello.exe, the coverage data will be stored in hello.exe.cov. The coverage
file is created when the simulator is exited.

The coverage file data consists of a starting address, and a number of
coverage points indicating incremental 32-bit word addresses:

0x40000000  0 0 0 19 9 1 1 1 1 0 .....

The coverage points are in hexadecimal format. Bit 0 (lsb) indicates an
executed instruction. Bit 3 indicates taken branch and bit 4 indicates
an untaken branch. Bits 2 and 3 are currently not used.

For RISC-V, code coverage is only supported for 32-bit instructions, i.e.
the C-extension can not be used when code coverage is measured.

@node Building SIS
@chapter Building SIS 
@cindex Building SIS 

SIS uses the GNU autoconf system, and can simply be build using
@code{./configure} followed by @code{make}. To build a PDF version of the
manual, do @code{make sis.pdf}.

@node GNU Free Documentation License
@appendix GNU Free Documentation License

@include fdl.texi


@node Index
@unnumbered Index

@printindex cp

@bye