| 1 |
$Id: TODO,v 1.166 2005/08/16 05:44:33 debug Exp $ |
$Id: TODO,v 1.536 2007/06/15 22:30:17 debug Exp $ |
| 2 |
|
|
| 3 |
=============================================================================== |
Some things, in no specific order, that I'd like to fix: |
| 4 |
|
(Some items in this list are perhaps already fixed.) |
| 5 |
|
|
| 6 |
High priority stuff: |
M88K: |
| 7 |
|
o) Neither NIP nor FIP valid in rte? |
| 8 |
|
o) FIP != NIP + 4, in rte! (Simulate delayed branch stuff.) |
| 9 |
|
o) cpu_dyntrans.c: MEMORY_USER_ACCESS implementation for M88K! |
| 10 |
|
o) xmem: Set transaction registers! |
| 11 |
|
o) CMMUs: |
| 12 |
|
o) Translation invalidations, could be optimized. |
| 13 |
|
o) Move initialization from dev_mvme187 to somewhere |
| 14 |
|
more reasonable? |
| 15 |
|
o) Instruction trace by using bits of ??IP control regs. |
| 16 |
|
o) Interrupts (these are machine dependent, though). |
| 17 |
|
o) Implement devices etc. for one or more machine modes, |
| 18 |
|
to get some guest OS running. OpenBSD/mvme88k on MVME187 |
| 19 |
|
seems to be the smartest path to follow for now. |
| 20 |
|
o) VME bus device |
| 21 |
|
o) PCC2 |
| 22 |
|
o) Cirrus Logic serial port controller |
| 23 |
|
o) Instruction disassembly, and implementation: |
| 24 |
|
o) See http://www.panggih.staff.ugm.ac.id/download/GCC/info/gcc.i5 |
| 25 |
|
for some strange cases of when "div" can fail (?) |
| 26 |
|
o) Floating point stuff |
| 27 |
|
o) "Graphics" instructions (M88110-specific) |
| 28 |
|
|
| 29 |
|
MIPS: |
| 30 |
|
o) Nicer MIPS status bits in register dumps. |
| 31 |
|
o) Floating point exception correctness. |
| 32 |
|
o) Fix this? Triggered by NetBSD/sgimips? Hm: |
| 33 |
|
to_be_translated(): TODO: unimplemented instruction: |
| 34 |
|
000000000065102c: 00200800 (d) rot_00 at,zr,0 |
| 35 |
|
o) Some more work on opcodes. |
| 36 |
|
x) MIPS64 revision 2. |
| 37 |
|
o) Find out which actual CPUs implement the rev2 ISA! |
| 38 |
|
o) DINS, DINSM, DINSU etc |
| 39 |
|
o) DROTR32 and similar MIPS64 rev 2 instructions, |
| 40 |
|
which have a rotation bit which differs from |
| 41 |
|
previous ISAs. |
| 42 |
|
x) _MAYBE_ TX79 and R5900 actually differ in their |
| 43 |
|
opcodes? Check this carefully! |
| 44 |
|
o) Dyntrans: Count register updates are probably not 100% correct yet. |
| 45 |
|
o) Refactor code for performance and readability/maintainability. |
| 46 |
|
o) (Re)implement 128-bit loads/stores for R5900. |
| 47 |
|
o) Coprocessor 1x (i.e. 3) should cause cp1 exceptions, not 3? |
| 48 |
|
(See http://lists.gnu.org/archive/html/qemu-devel/2007-05/msg00005.html) |
| 49 |
|
o) R4000 and others: |
| 50 |
|
x) watchhi/watchlo exceptions, and other exception |
| 51 |
|
handling details |
| 52 |
|
o) MIPS 5K* have 42 physical address bits, not 40/44? |
| 53 |
|
o) R10000 and others: (R12000, R14000 ?) |
| 54 |
|
x) The code before the line |
| 55 |
|
/* reg[COP0_PAGEMASK] = cpu->cd.mips.coproc[0]->tlbs[0].mask & PAGEMASK_MASK; */ |
| 56 |
|
in cpu_mips.c is not correct for R10000 according to |
| 57 |
|
Lemote's Godson patches for GXemul. TODO: Go through all |
| 58 |
|
register definitions according to http://techpubs.sgi.com/library/tpl/cgi-bin/getdoc.cgi/hdwr/bks/SGI_Developer/books/R10K_UM/sgi_html/t5.Ver.2.0.book_263.html#HEADING334 |
| 59 |
|
and make sure everything works with R10000. |
| 60 |
|
Then test with OpenBSD/sgi? |
| 61 |
|
x) Entry LO mask (as above). |
| 62 |
|
x) memory space, exceptions, ... |
| 63 |
|
x) use cop0 framemask for tlb lookups |
| 64 |
|
(http://techpubs.sgi.com/library/tpl/cgi-bin/getdoc.cgi/hdwr/bks/SGI_Developer/books/R10K_UM/sgi_html/t5.Ver.2.0.book_284.html) |
| 65 |
|
|
| 66 |
|
SuperH: |
| 67 |
|
x) Auto-generation of loads/stores! This should get rid of at least |
| 68 |
|
the endianness check in each load/store. |
| 69 |
|
x) Experiment with whether or not correct ITLB emulation is |
| 70 |
|
actually needed. (20070522: I'm turning it off today.) |
| 71 |
|
x) SH4 interrupt controller: |
| 72 |
|
x) MASKING should be possible! |
| 73 |
|
x) SH4 DMA (0xffa00000) |
| 74 |
|
x) SH4 UBC (0xff200000) |
| 75 |
|
x) Store queues can copy 32 bytes at a time, there's no need to |
| 76 |
|
copy individual 32-bit words. (Performance improvement.) |
| 77 |
|
x) SH4 BSC (Bus State Controller) |
| 78 |
|
x) Instruction tracing should include symbols for branch targets, |
| 79 |
|
and so on, to make the output more human readable. |
| 80 |
|
x) SH3-specific devices: Pretty much everything! |
| 81 |
|
x) NetBSD/evbsh3, hpcsh! Linux? |
| 82 |
|
x) Floating point speed! |
| 83 |
|
x) Floating point exception correctness. |
| 84 |
|
x) NetBSD HEAD (as of April 2007) hangs during bootup, because it |
| 85 |
|
turns on/off interrupts in an unfortunately synchronized way |
| 86 |
|
with dyntrans. This needs to be fixed. |
| 87 |
|
x) Exceptions for unaligned load/stores. OpenBSD/landisk uses |
| 88 |
|
this mechanism for its reboot code (machine_reset). |
| 89 |
|
x) Think carefully about how to implement SH5/SH64 (for evbsh5). |
| 90 |
|
|
| 91 |
|
Landisk SH4: |
| 92 |
|
x) When NetBSD/landisk 4.0 has been released, make sure it works |
| 93 |
|
in the emulator. (Update documentation, etc.) |
| 94 |
|
|
| 95 |
|
Dreamcast: |
| 96 |
|
x) G2 DMA |
| 97 |
|
x) LAN adapter (dev_mb8696x.c). NetBSD root-on-nfs. |
| 98 |
|
x) PVR: Lots of stuff. See dev_pvr.c. |
| 99 |
|
x) Better GDROM support |
| 100 |
|
x) Modem |
| 101 |
|
x) PCI bridge/bus? |
| 102 |
|
x) Maple bus: |
| 103 |
|
x) Correct controller input |
| 104 |
|
x) Mouse input |
| 105 |
|
x) Software emulation of BIOS calls: |
| 106 |
|
x) GD-ROM emulation: Use the GDROM device. |
| 107 |
|
x) Use the VGA font as a fake ROM font. (Better than |
| 108 |
|
nothing.) |
| 109 |
|
x) Make as many as possible of the KOS examples run! |
| 110 |
|
x) More homebrew demos/games. |
| 111 |
|
x) SPU: Sound emulation (ARM cpu). |
| 112 |
|
x) VME processor emulation? "(Sanyo LC8670 "Potato")" according to |
| 113 |
|
Wikipedia, LC86K87 according to Comstedt's page. See |
| 114 |
|
http://www.maushammer.com/vmu.html for a good description of |
| 115 |
|
the differences between LC86104C and the one used in the VME. |
| 116 |
|
|
| 117 |
|
Alpha: |
| 118 |
|
x) OSF1 PALcode, Virtual memory support. |
| 119 |
|
x) PALcode replacement! PAL1E etc opcodes...? |
| 120 |
|
x) Interrupt/exception/trap handling. |
| 121 |
|
x) Floating point exception correctness. |
| 122 |
|
x) More work on bootup memory and register contents. |
| 123 |
|
x) More Alpha machine types, so it could work with |
| 124 |
|
OpenBSD, FreeBSD, and Linux too? |
| 125 |
|
|
| 126 |
|
SPARC (both the ISA and the machines): |
| 127 |
|
o) Implement Adress space identifiers; load/stores etc. |
| 128 |
|
o) Exception/trap/interrupt handling. |
| 129 |
|
o) Save/restore register windows etc! Both v9 and pre-v9! |
| 130 |
|
o) Finish the subcc and addcc flag computation code. |
| 131 |
|
o) Add more registers (floating point, control regs etc) |
| 132 |
|
o) Disassemly of some more instructions? |
| 133 |
|
o) Are sll etc 32-bit sign-extending or zero-extending? |
| 134 |
|
o) Floating point exception correctness. |
| 135 |
|
o) SPARC v8, v7 etc? |
| 136 |
|
o) More machine modes and devices. |
| 137 |
|
|
| 138 |
|
POWER/PowerPC: |
| 139 |
|
x) Fix DECR timer speed, so it matches the host. |
| 140 |
|
x) NetBSD/prep 3.x triggers a possible bug in the emulator: |
| 141 |
|
<wdc_exec_command(0xd005e514,0xd60cdd30,0,8,..)> |
| 142 |
|
<ata_get_xfer(0,0xd60cdd30,0,8,..)> |
| 143 |
|
<0x26c550(&ata_xfer_pool,2,0,8,..)> |
| 144 |
|
<0x35c71c(0x3f27000,0,52,8,..)> |
| 145 |
|
<ata_exec_xfer(0xd005e4c8,0x3f27000,0,13,..)> |
| 146 |
|
<atastart(0xd005e4c8,0x3f27000,0,13,..)> |
| 147 |
|
<__wdccommand_start(0xd005e4c8,0x3f27000,0,13,..)> |
| 148 |
|
<bsw1(&prep_isa_io_space_tag,0x800001f6,0,176,..)> |
| 149 |
|
[ wdc: write to SDH: 0xb0 (sectorsize 2, lba=1, drive 1, head 0) ] |
| 150 |
|
<wdcwait(0xd005e4c8,72,64,0xbb8,..)> |
| 151 |
|
<0x198120(0xd005e4c8,72,64,0xbb8,..)> |
| 152 |
|
<bsr1(&prep_isa_io_space_tag,0,0,0xbb8,..)> |
| 153 |
|
<delay(100,0,0,0xbb8,..)> |
| 154 |
|
Note: <bsr1(&prep_isa_io_space_tag,0,0,0xbb8,..)> |
| 155 |
|
x) PPC optimizations; instr combs |
| 156 |
|
x) 64-bit stuff: either Linux on G5, or perhaps some hobbyist |
| 157 |
|
version of AIX? (if there exists such a thing) |
| 158 |
|
x) macppc: adb controller; keyboard (for framebuffer mode) |
| 159 |
|
x) make OpenBSD/macppc work (PCI controller stuff) |
| 160 |
|
x) Floating point exception correctness. |
| 161 |
|
x) Alignment exceptions. |
| 162 |
|
|
| 163 |
|
PReP: |
| 164 |
|
x) Clock time! ("Bad battery blah blah") |
| 165 |
|
|
| 166 |
|
Algor: |
| 167 |
|
o) Other models than the P5064? |
| 168 |
|
o) PCI interrupts... needed for stuff like the tlp NIC? |
| 169 |
|
|
| 170 |
|
BeBox: |
| 171 |
|
o) Interrupts. There seems to be a problem with WDC interrupts |
| 172 |
|
"after a short while", although a few interrupts get through? |
| 173 |
|
o) Perhaps find a copy of BeOS and try it? |
| 174 |
|
|
| 175 |
|
HPCmips: |
| 176 |
|
x) Mouse/pad support! :) |
| 177 |
|
x) A NIC? (As a PCMCIA device?) |
| 178 |
|
|
| 179 |
|
ARM: |
| 180 |
|
o) See netwinder_reset() in NetBSD; the current "an internal error |
| 181 |
|
occured" message after reboot/halt is too ugly. |
| 182 |
|
o) Generic ARM "wait"-like instruction? |
| 183 |
|
o) try to get netbsd/evbarm 3.x or 4.x running (iq80321) |
| 184 |
|
o) make the xscale counter registers (ccnt) work |
| 185 |
|
o) make the ata controller usable for FreeBSD! |
| 186 |
|
o) Debian/cats crashes because of unimplemented coproc stuff. |
| 187 |
|
fix this? |
| 188 |
|
|
| 189 |
|
Test machines: |
| 190 |
|
o) dev_fb block fill and copy |
| 191 |
|
o) dev_fb draw characters (from the built-in font)? |
| 192 |
|
o) dev_fb input device? mouse pointer coordinates and buttons |
| 193 |
|
(allow changes in these to cause interrupts as well?) |
| 194 |
|
o) Redefine the halt() function so that it stops "sometimes |
| 195 |
|
soon", i.e. usage in demo code should be: |
| 196 |
|
for (;;) { |
| 197 |
|
halt(); |
| 198 |
|
} |
| 199 |
|
|
| 200 |
|
Debugger: |
| 201 |
|
o) How does SMP debugging work? Does it simply use "threads"? |
| 202 |
|
What if the guest OS (running on an emulated SMP machine) |
| 203 |
|
has a usertask running, with userland threads? |
| 204 |
|
o) Try to make the debugger more modular and, if possible, reentrant! |
| 205 |
|
o) Remove the emul command? (But show network info if showing |
| 206 |
|
machines?) |
| 207 |
|
o) Memory dumps should be able to dump both physical and |
| 208 |
|
virtual emulated memory. |
| 209 |
|
o) Evaluate expressions within []? That would allow stuff like |
| 210 |
|
cpu[x] where x is an expression. |
| 211 |
|
o) "pc = pc + 4" doesn't work! Bug. Should work. ("pc=pc+4" works.) |
| 212 |
|
o) Settings: |
| 213 |
|
x) Special handlers for Write! |
| 214 |
|
+) MIPS coproc regs |
| 215 |
|
+) Alpha/MIPS/SPARC zero registers |
| 216 |
|
+) x86 64/32/16-bit registers |
| 217 |
|
x) Value formatter for resulting output. |
| 218 |
|
o) Call stack display (back-trace) of emulated programs. |
| 219 |
|
o) Nicer looking output of register dumps, floating point registers, |
| 220 |
|
etc. Warn about weird/invalid register contents. |
| 221 |
|
o) Ctrl-C doesn't enter the debugger on some OSes (HP-UX?)... |
| 222 |
|
|
| 223 |
|
Dyntrans: |
| 224 |
|
x) For 32-bit emulation modes, that have emulated TLBs: tlbindex |
| 225 |
|
arrays of mapped pages? Things to think about: |
| 226 |
|
x) Only 32-bit mode! (64-bit => too much code) |
| 227 |
|
x) One array for global pages, and one array _PER ASID_, |
| 228 |
|
for those archs that support that. On M88K, there should |
| 229 |
|
be one array for userspace, and one for supervisor, etc. |
| 230 |
|
x) Larger-than-4K-pages must fill several bits in the array. |
| 231 |
|
x) No TLB search will be necessary. |
| 232 |
|
x) Total host space used, for 4 KB pages: 1 MB per table, |
| 233 |
|
i.e. 65 MB for 32-bit MIPS, 2 MB for M88K, if one byte |
| 234 |
|
is used as the tlb index. |
| 235 |
|
x) (The index is actually +1, so that 0 means no hit.) |
| 236 |
|
x) "Merge" the cur_physpage and cur_ic_page variables/pointers to |
| 237 |
|
one? I.e. change cur_ic_page to cur_physpage.ic_page or something. |
| 238 |
|
x) Instruction combination collisions? How to avoid easily... |
| 239 |
|
x) Think about how to do both SHmedia and SHcompact in a reasonable |
| 240 |
|
way! (Or AMD64 long/protected/real, for that matter.) |
| 241 |
|
x) 68K emulation; think about how to do variable instruction |
| 242 |
|
lengths across page boundaries. |
| 243 |
|
x) Dyntrans with valgrind-inspired memory checker. (In memory_rw, |
| 244 |
|
it would be reasonably simple to add; in each individual fast |
| 245 |
|
load/store routine = a lot more work, and it would become |
| 246 |
|
kludgy very fast.) |
| 247 |
|
x) Dyntrans with SMP... lots of work to be done here. |
| 248 |
|
x) Dyntrans with cache emulation... lots of work here as well. |
| 249 |
|
x) Remove the concept of base RAM completely; it would be more |
| 250 |
|
generic to allow RAM devices to be used "anywhere". |
| 251 |
|
o) dev_mp doesn't work well with dyntrans yet |
| 252 |
|
o) In general, IPIs, CAS, LL/SC etc must be made to work with dyntrans |
| 253 |
|
x) Redesign/rethink the delay slot mechanism used for e.g. MIPS, |
| 254 |
|
so that it caches a translation (that is, an instruction |
| 255 |
|
word and the instr_call it was translated to the last |
| 256 |
|
time), so that it doesn't need to do slow |
| 257 |
|
to_be_translated for each end of page? |
| 258 |
|
x) Program Counter statistics: |
| 259 |
|
Per machine? What about SMP? All data to the same file? |
| 260 |
|
A debugger command should be possible to use to enable/ |
| 261 |
|
disable statistics gathering. |
| 262 |
|
Configuration file option! |
| 263 |
|
x) Breakpoints: |
| 264 |
|
o) Physical vs virtual addresses! |
| 265 |
|
o) 32-bit vs 64-bit sign extension for MIPS, and others? |
| 266 |
|
x) INVALIDATION should cause translations in _all_ cpus to be |
| 267 |
|
invalidated, e.g. on a write to a write-protected page |
| 268 |
|
(containing code) |
| 269 |
|
x) 16-bit encodings? (MIPS16, ARM Thumb, 32-bit SH on SH64) |
| 270 |
|
x) Lots of other stuff: see src/cpus/README_DYNTRANS |
| 271 |
|
x) Native code generation backends: |
| 272 |
|
o) calculate at runtime whether or not chunks of emulated |
| 273 |
|
(physical) memory are worth translating to native code |
| 274 |
|
(it is assumed that it has high overhead) |
| 275 |
|
o) experiment with calling the host's cc and ld externally; |
| 276 |
|
extremely high overhead, but could be interesting none- |
| 277 |
|
theless. |
| 278 |
|
o) experiment with using LLVM, or GNU Lightning? |
| 279 |
|
o) Important cases to think about: |
| 280 |
|
x) loads/stores |
| 281 |
|
x) delay branches |
| 282 |
|
x) other kinds of calls, branches |
| 283 |
|
o) branches to already translated code blocks can |
| 284 |
|
link the blocks together (block-chaining), although |
| 285 |
|
I'll probably want to wait with this until other |
| 286 |
|
things work. |
| 287 |
|
o) The first tests should be done with "testm88k", because |
| 288 |
|
that does not affect other modes. |
| 289 |
|
|
| 290 |
|
------------------------------------------------------------------------------- |
| 291 |
|
|
| 292 |
|
Performance comparison when emulating the QEMU_MIPS machine (QEMU's default |
| 293 |
|
MIPS machine mode): |
| 294 |
|
|
| 295 |
|
mips-test-0.2: |
| 296 |
|
-------------- |
| 297 |
|
|
| 298 |
|
1. while true; do ls -l > /dev/null; echo -n .; done, 80x36 dots |
| 299 |
|
2. while true; do /usr/bin/md5sum /usr/bin/* > /dev/null; echo -n .; done, 80 dots |
| 300 |
|
3. while true; do grep hej lib/libc.so.6 > /dev/null; echo -n .; done, 80 dots |
| 301 |
|
|
| 302 |
|
Test 1 Test 2 Test 3 |
| 303 |
|
------ ------ ------ |
| 304 |
|
QEMU 0.9.0: 2 min 20 sec 45 sec 4 min 41 seconds |
| 305 |
|
GXemul-20070608: 1 min 59 sec 3 min 18 sec 18 min 10 seconds [A] |
| 306 |
|
|
| 307 |
|
|
| 308 |
|
[A] = Normal portable dyntrans, no native code generation. |
| 309 |
|
|
| 310 |
|
------------------------------------------------------------------------------- |
| 311 |
|
|
| 312 |
|
|
| 313 |
|
Simple Valgrind-like checks? |
| 314 |
|
o) Mark every address with bits which tell whether or not the address |
| 315 |
|
has been written to. |
| 316 |
|
o) What should happen when programs are loaded? Text/data, bss (zero |
| 317 |
|
filled). But stack space and heap is uninitialized. |
| 318 |
|
o) Uninitialized local variables: |
| 319 |
|
A load from a place on the stack which has not previously |
| 320 |
|
been stored to => warning. Increasing the stack pointer using |
| 321 |
|
any available means should reset the memory to uninitialized. |
| 322 |
|
o) If calls to malloc() and free() can be intercepted: |
| 323 |
|
o) Access to a memory area after free() => warning. |
| 324 |
|
o) Memory returned by malloc() is marked as not-initialized. |
| 325 |
|
o) Non-passive, but good to have: Change the argument |
| 326 |
|
given to malloc, to return a slightly larger memory |
| 327 |
|
area, i.e. margin_before + size + margin_after, |
| 328 |
|
and return the pointer + margin_before. |
| 329 |
|
Any access to the margin_before or _after space results |
| 330 |
|
in warnings. (free() must be modified to free the |
| 331 |
|
actually allocated address.) |
| 332 |
|
|
| 333 |
|
Better CD Image file support: |
| 334 |
|
x) Support CD formats that contain more than 1 track, e.g. |
| 335 |
|
CDI files (?). These can then contain a mixture of e.g. sound |
| 336 |
|
and data tracks, and booting from an ISO filesystem path |
| 337 |
|
would boot from [by default] the first data track. |
| 338 |
|
(This would make sense for e.g. Dreamcast CD images, or |
| 339 |
|
possibly other live-CD formats.) |
| 340 |
|
|
| 341 |
|
Networking: |
| 342 |
|
x) Redesign of the networking subsystem, at least the NAT translation |
| 343 |
|
part. The current way of allowing raw ethernet frames to be |
| 344 |
|
transfered to/from the emulator via UDP should probably be |
| 345 |
|
extended to allow the frames to be transmitted other ways as |
| 346 |
|
well. |
| 347 |
|
x) Also adding support for connecting ttys (either to xterms, or to |
| 348 |
|
pipes/sockets etc, or even to PPP->NAT or SLIP->NAT :-). |
| 349 |
|
x) Documentation updates (!) are very important, making it easier to |
| 350 |
|
use the (already existing) network emulation features. |
| 351 |
|
x) Fix performance problems caused by only allowing a |
| 352 |
|
single TCP packet to be unacked. |
| 353 |
|
x) Don't hardcode offsets into packets! |
| 354 |
|
x) Test with lower than 100 max tcp/udp connections, |
| 355 |
|
to make sure that reuse works! |
| 356 |
|
x) Make OpenBSD work better as a guest OS! |
| 357 |
|
x) DHCP? Debian doesn't actually send DHCP packets, even |
| 358 |
|
though it claims to? So it is hard to test. |
| 359 |
|
x) Multiple networks per emulation, and let different |
| 360 |
|
NICs in machines connect to different networks. |
| 361 |
|
x) Support VDE (vde.sf.net)? Easiest/cleanest (before a |
| 362 |
|
redesign of the network framework has been done) is |
| 363 |
|
probably to connect it using the current (udp) solution. |
| 364 |
|
x) Allow SLIP connections, possibly PPP, in addition to |
| 365 |
|
ethernet? |
| 366 |
|
|
| 367 |
|
Cache simulation: |
| 368 |
|
o) Command line flags for: |
| 369 |
|
o) CPU endianness? |
| 370 |
|
o) Cache sizes? (multiple levels) |
| 371 |
|
o) Separate from the CPU concept, so that multi-core CPUs sharing |
| 372 |
|
e.g. a L2 cache can be simulated (?) |
| 373 |
|
o) Instruction cache emulation is easiest (if separate from the |
| 374 |
|
data cache); similar hack as the S;I; hack in cpu_dyntrans.c. |
| 375 |
|
NOTE: if the architecture has a delay slot, then an instruction |
| 376 |
|
slot can actually be executed as 2 instructions. |
| 377 |
|
o) Data cache emulation = harder; each arch's load/store routines |
| 378 |
|
must include support? running one instruction at a time and |
| 379 |
|
having a cpu-dependant lookup function for each instruction |
| 380 |
|
is another option (easier to implement, but very very slow). |
| 381 |
|
|
| 382 |
|
Documentation: |
| 383 |
|
x) Update the documentation regarding the testmachine interrupts. |
| 384 |
|
x) Note about sandboxing/security: |
| 385 |
|
Not all emulated instructions fail in the way they would |
| 386 |
|
do on real hardware (e.g. a userspace program writing to |
| 387 |
|
a system register might work in GXemul, but it would |
| 388 |
|
fail on real hardware). Sandbox = contain from the |
| 389 |
|
host OS. But the emulated programs will run "less |
| 390 |
|
securely". |
| 391 |
|
x) Try NetBSD/arc 4.x! (It seems to work with disk images!) |
| 392 |
|
x) NetBSD/pmax 4 install instructions: xterm instead of vt100! |
| 393 |
|
x) BETTER DEVICE EXAMPLES! |
| 394 |
|
o) Move away from technical.html to somewhere new. |
| 395 |
|
o) DEVICE_TICK |
| 396 |
|
o) Implement example devices using interrupts, dyntrans |
| 397 |
|
memory access, etc.? |
| 398 |
|
x) Document the dyntrans core? |
| 399 |
|
x) Rewrite the section about experimental devices, after the |
| 400 |
|
framebuffer acceleration has been implemented, and demos |
| 401 |
|
written. (Symbolic names instead of numbers; example |
| 402 |
|
use cases, etc. Mention demo files that use the various |
| 403 |
|
features?) |
| 404 |
|
x) "a very simple linear framebuffer device (for graphics output)" |
| 405 |
|
under "which machines does gxemul emulate" ==> better |
| 406 |
|
description? |
| 407 |
|
x) Better description on how to set up a cross compiler? |
| 408 |
|
Example for MIPS64. |
| 409 |
|
o) Automagic documentation generation? |
| 410 |
|
x) machines, cpus, devices. |
| 411 |
|
x) REMEMBER that several machines/devices can be in |
| 412 |
|
the same source file! |
| 413 |
|
o) Try to rewrite the install instructions for those machines |
| 414 |
|
that use 3MAX into using CATS or hpcmips? (To remove the need |
| 415 |
|
to use a raw ffs partition, using up all of the disk image.) |
| 416 |
|
|
| 417 |
|
The Device subsystem: |
| 418 |
|
x) allow devices to be moved and/or changed in size (down to a |
| 419 |
|
minimum size, etc, or up to a max size); if there is a collision, |
| 420 |
|
return false. It is up to the caller to handle this situation! |
| 421 |
|
x) NOTE: Translations must be invalidated, both for |
| 422 |
|
registering new devices, and for moving existing ones. |
| 423 |
|
cpu->invalidate translation caches, for all CPUs that |
| 424 |
|
are connected to a specific memory. |
| 425 |
|
x) keep track of interrupts and busses? actually, allowing any device |
| 426 |
|
to be a bus might be a nice idea. |
| 427 |
|
x) turn interrupt controllers into devices? :-) |
| 428 |
|
x) refactor various clocks/nvram/cmos into one device? |
| 429 |
|
|
| 430 |
|
PCI: |
| 431 |
|
x) Pretty much everything related to runtime configuration, device |
| 432 |
|
slots, interrupts, etc must be redesigned/cleaned up. The current |
| 433 |
|
code is very hardcoded and ugly. |
| 434 |
|
o) Allow cards to be added/removed during runtime more easily. |
| 435 |
|
o) Allow cards to be enabled/disabled (i/o ports, etc, like |
| 436 |
|
NetBSD needs for disk controller detection). |
| 437 |
|
o) Allow devices to be moved in memory during runtime. |
| 438 |
|
o) Interrupts per PCI slot, etc. (A-D). |
| 439 |
|
o) PCI interrupt controller logic... very hard to get right, |
| 440 |
|
because these differ a lot from one machine to the next. |
| 441 |
|
x) last write was ffffffff ==> fix this, it should be used |
| 442 |
|
together with a mask to get the correct bits. also, not ALL |
| 443 |
|
bits are size bits! (lowest 4 vs lowest 2?) |
| 444 |
|
x) add support for address fixups |
| 445 |
|
x) generalize the interrupt routing stuff (lines etc) |
| 446 |
|
|
| 447 |
|
Clocks and timers: |
| 448 |
|
x) Fix the PowerPC DECR interrupt speed! (MacPPC and PReP speed, etc.) |
| 449 |
|
x) DON'T HARDCODE 100 HZ IN cpu_mips_coproc.c! |
| 450 |
|
x) NetWinder timeofday is incorrect! Huh? grep -R for ta_rtc_read in |
| 451 |
|
NetBSD sources; it doesn't seem to be initialized _AT ALL_?! |
| 452 |
|
x) Cobalt TOD is incorrect! |
| 453 |
|
x) Go through all other machines, one by one, and fix them. |
| 454 |
|
|
| 455 |
|
Config file parser: |
| 456 |
|
o) Rewrite it from scratch! |
| 457 |
|
o) Usage of any expression available through the debugger |
| 458 |
|
o) Allow interrupt controllers to be added! and interrupts |
| 459 |
|
to be used in more ways than before |
| 460 |
|
o) Support for running debugger commands (like the -c |
| 461 |
|
command line option) |
| 462 |
|
|
| 463 |
|
Floating point layer: |
| 464 |
|
o) make it common enough to be used by _all_ emulation modes |
| 465 |
|
o) implement correct error/exception handling and rounding modes |
| 466 |
|
o) implement more helper functions (i.e. add, sub, mul...) |
| 467 |
|
o) non-IEEE modes (i.e. x86)? |
| 468 |
|
|
| 469 |
|
Userland emulation: |
| 470 |
|
x) Try to prefix "/emul/mips/" or similar to all filenames, |
| 471 |
|
and only if that fails, try the given filename. |
| 472 |
|
Read this setting from an environment variable, and only |
| 473 |
|
if there is none, fall back to hardcoded string. |
| 474 |
|
x) File descriptor (0,1,2) assumptions? Find and fix these? |
| 475 |
|
x) Dynamic linking! |
| 476 |
|
x) Lots of stuff; freebsd, netbsd, linux, ... syscalls. |
| 477 |
|
x) Initial register/stack contents (environment, command line args). |
| 478 |
|
x) Return value (from main). |
| 479 |
|
x) mmap emulation layer |
| 480 |
|
x) errno emulation layer |
| 481 |
|
x) struct conversions for many syscalls |
| 482 |
|
|
| 483 |
|
Sound: |
| 484 |
|
x) generic sound framework |
| 485 |
|
x) add one or more sound cards as devices; add a testmachine |
| 486 |
|
sound card first? |
| 487 |
|
x) Dreamcast sound? Generic PCI sound cards? |
| 488 |
|
|
| 489 |
|
ASC SCSI controller: |
| 490 |
|
x) NetBSD/arc 2.0 uses the ASC controller in a way which GXemul |
| 491 |
|
cannot yet handle. (NetBSD 1.6.2 works ok.) (Possibly a problem |
| 492 |
|
in NetBSD itself, http://mail-index.netbsd.org/source-changes/ |
| 493 |
|
2005/11/06/0024.html suggests that.) |
| 494 |
|
NetBSD 4.x seems to work? :) |
| 495 |
|
|
| 496 |
|
Caches / memory hierarchies: (this is mostly MIPS-specific) |
| 497 |
|
o) src/memory*.c: Implement correct cache emulation for |
| 498 |
|
all CPU types. (currently only R2000/R3000 is implemented) |
| 499 |
|
(per CPU, multiple levels should be possible, associativity etc!) |
| 500 |
|
o) R2000/R3000 isn't _100%_ correct, just almost correct :) |
| 501 |
|
o) Move the -S (fill mem with random) functionality into the |
| 502 |
|
memory.c subsystem, not machine.c or wherever it is now |
| 503 |
|
o) ECC stuff, simulation of memory errors? (Machine dependent) |
| 504 |
|
o) More than 4GB of emulated RAM, when run on a 32-bit host? |
| 505 |
|
(using manual swap-out of blocks to disk, ugly) |
| 506 |
|
o) A global command line option should be used to turn |
| 507 |
|
cache emulation on or off. When off, caches should be |
| 508 |
|
faked like they are right now. When on, caches and |
| 509 |
|
memory latencies should be emulated as correctly as |
| 510 |
|
possible. |
| 511 |
|
|
| 512 |
|
File/disk/symbol handling: |
| 513 |
|
o) Make sure that disks can be added/removed during runtime! |
| 514 |
|
(Perhaps this needs a reasonably large re-write.) |
| 515 |
|
o) Remove some of the complexity in file format guessing, for |
| 516 |
|
Ultrix kernels that are actually disk images? |
| 517 |
|
o) Better handling of tape files |
| 518 |
|
o) Read function argument count and types from binaries? (ELF?) |
| 519 |
|
o) Better demangling of C++ names. Note: GNU's C++ differs from e.g. |
| 520 |
|
Microsoft's C++, so multiple schemes must be possible. See |
| 521 |
|
URL at top of src/symbol_demangle.c for more info. |
| 522 |
|
|
| 523 |
|
Userland ABI emulation: |
| 524 |
|
o) see src/useremul.c |
| 525 |
|
|
| 526 |
|
Better framebuffer and X-windows functionality: |
| 527 |
|
o) Generalize the update_x1y1x2y2 stuff to an extend-region() |
| 528 |
|
function... |
| 529 |
|
o) -Yx sometimes causes crashes. |
| 530 |
|
o) Simple device access to framebuffer_blockcopyfill() etc, |
| 531 |
|
and text output (using the built-in fonts), for dev_fb. |
| 532 |
|
o) CLEAN UP the ugly event code |
| 533 |
|
o) Mouse clicks can be "missed" in the current system; this is |
| 534 |
|
not good. They should be put on a stack of some kind. |
| 535 |
|
o) More 2D and 3D framebuffer acceleration. |
| 536 |
|
o) Non-resizable windows? Or choose scaledown depending |
| 537 |
|
on size (and center the image, with a black border). |
| 538 |
|
o) Different scaledown on different windows? |
| 539 |
|
o) Non-integral scale-up? (E.g. 640x480 -> 1024x768) |
| 540 |
|
o) Switch scaledown during runtime? (Ala CTRL-ALT-plus/minus) |
| 541 |
|
o) Bug reported by Elijah Rutschman on MacOS with weird |
| 542 |
|
keys (F5 = cursor down?). |
| 543 |
|
o) Keyboard and mouse events: |
| 544 |
|
x) Do this for more machines than just DECstation |
| 545 |
|
x) more X11 cursor keycodes |
| 546 |
|
x) Keys like CTRL, ALT, SHIFT do not get through |
| 547 |
|
by themselves (these are necessary for example |
| 548 |
|
to change the font of an xterm in X in the |
| 549 |
|
emulator) |
| 550 |
|
o) Generalize the framebuffer stuff by moving _ALL_ X11 |
| 551 |
|
specific code to src/x11.c! |
| 552 |
|
|
| 553 |
|
------------------------------------------------------------------------------- |
|
MIPS bintrans: |
|
|
x) call/return address cache? |
|
|
|
|
|
dyntrans: |
|
|
x) memory write protection for ARM, but NOT for Alpha (because |
|
|
it has the IMB instruction... hm) |
|
|
|
|
|
x) call/return address cache |
|
|
|
|
|
x) instr_call sequence analysis support? (Useful for |
|
|
handtuning combinations.) |
|
|
|
|
|
x) opcode statistics support? |
|
|
TODO: is instr_call statistics enough? |
|
|
|
|
|
x) support for archs that allow transparent unaligned load/stores |
|
|
|
|
|
x) SMP: detect when an instruction such as ll/sc or cas is used, |
|
|
and "synchronize" approximately the number of executed instructions |
|
|
(or cycles) across all CPUs. |
|
|
|
|
|
x) support for variable-length instructions (x86, m68k, ...) |
|
|
Perhaps: don't increase the next_ic between every |
|
|
instruction, but let each instruction's handler do |
|
|
that for itself. |
|
|
Problem: what about instructions crossing a (virtual) |
|
|
page boundary? They cannot be translated once |
|
|
and for all :( and must be interpreted slowly! |
|
|
|
|
|
x) support for THUMB or MIPS16 (arm, mips) |
|
|
|
|
|
x) support for Delay slots! (mips, sparc, hppa) |
|
|
|
|
|
x) Alpha: hahaha, zapnot and inserts/extracts don't |
|
|
compile into very nice code :-| fix this |
|
|
|
|
|
x) 64-bit virtual memory translation tables (PPC, etc) |
|
|
|
|
|
x) x86: convert to dyntrans. LOTS of stuff to consider. |
|
|
|
|
|
|
|
|
=============================================================================== |
|
|
|
|
|
Lower priority, but still important: |
|
|
|
|
|
Redesign the entire "mainbus" concept: |
|
|
o) Easily configurable interrupt routing in SMP systems. |
|
|
o) Specific clock/bus speeds, cpu speeds etc. |
|
|
o) Synchronization over network? |
|
|
|
|
|
Caches / memory hierarchies: (this is mostly MIPS-specific) |
|
|
o) MIPS coproc.c: bits in config registers should reflect |
|
|
correct cache sizes for _all_ CPU types. (currently only |
|
|
implemented for R4000, R1x000, and a few others) |
|
|
o) src/memory*.c: Implement correct cache emulation for |
|
|
all CPU types. (currently only R2000/R3000 is implemented) |
|
|
(per CPU, multiple levels should be possible, |
|
|
associativity etc!) |
|
|
o) R2000/R3000 isn't _100%_ correct, just almost correct :) |
|
|
o) Move the -S (fill mem with random) functionality into the |
|
|
memory.c subsystem, not machine.c or wherever it is now |
|
|
o) ECC stuff, simulation of memory errors? (Machine dependant) |
|
|
o) More than 4GB of emulated RAM, when run on a 32-bit host? |
|
|
(using manual swap-out of blocks to disk, ugly) |
|
|
o) A global command line option should be used to turn |
|
|
cache emulation on or off. When off, caches should be |
|
|
faked like they are right now. When on, caches and |
|
|
memory latencies should be emulated as correctly as |
|
|
possible. |
|
|
|
|
|
Network layer: |
|
|
o) Multiple networks per emulation, and let different |
|
|
NICs in machines connect to different networks. |
|
|
o) many other issues: see src/net.c |
|
|
|
|
|
MIPS CPU emulation: |
|
|
o) i386 bintrans backend: movn etc, slt[u] for |
|
|
64-bit mode, 64-bit shifts etc |
|
|
o) Instructions: |
|
|
o) All ISAs: |
|
|
o) Floating point exception handling, and |
|
|
add more instructions. |
|
|
o) Finish the MIPS16 translator, and test it! |
|
|
o) MIPS ISA I, II, III, IV |
|
|
o) MIPS V (SIMD vector stuff?) |
|
|
o) MDMX (MIPS Digital Media Extension) |
|
|
o) MIPS 3D |
|
|
o) MIPS MT (Multi-thread stuff) (What's this?) |
|
|
o) Warn about mis-used bit fields (ie bits that |
|
|
should be all zeroes, warn about if they are not)! |
|
|
Both for coprocessor registers and for instruction |
|
|
opcodes. |
|
|
o) the special2 stuff is a mess right now |
|
|
o) warn and/or cause exceptions for unimplemented |
|
|
instructions (depending on CPU type) |
|
|
o) R2000/R3000: |
|
|
x) R3000 "tri-byte stores". (What's this?) |
|
|
o) R4000 and others: |
|
|
x) watchhi/watchlo exceptions, and other exception |
|
|
handling details |
|
|
o) R10000 and others: (R12000, R14000 ?) |
|
|
x) memory space, exceptions, ... |
|
|
x) use cop0 framemask for tlb lookups |
|
|
(http://techpubs.sgi.com/library/tpl/cgi-bin/getdoc.cgi/hdwr/bks/SGI_Developer/books/R10K_UM/sgi_html/t5.Ver.2.0.book_284.html) |
|
|
o) Implement load delays? Warnings on interlocks. |
|
|
o) Implement all coprocessor 0 bits / functions. |
|
|
x) coproc 0 selectors! (R4000 ?) |
|
|
o) R4300 (nintendo64, no mmu?), R5900 (playstation2, weird |
|
|
TLB/cache? 128-bit GPRs, new instructions), |
|
|
4K (note: NOT R4000), 5K (note: NOT R5000), |
|
|
R6000 (ISA II), R8000 |
|
|
o) Multi-cpu stuff: |
|
|
+) Interrupt routing (ie devices vs mainbus, or |
|
|
connect each device to a fixed cpu) |
|
|
+) SGI's NUMA architecture. Study |
|
|
x) Linux sources |
|
|
x) SGI's specs on NUMA address space |
|
|
+) Ultrix? NetBSD doesn't do SMP on MIPS yet :-( |
|
|
+) Own experiments with ycx2. |
|
|
|
|
|
File/disk handling: |
|
|
o) Better handling of tape files |
|
|
|
|
|
Debugger: |
|
|
o) Read function argument count and types from binaries? (ELF?) |
|
|
o) Demangle C++ names. |
|
|
|
|
|
Userland ABI emulation: |
|
|
o) see src/useremul.c |
|
|
|
|
|
Terminal based interactive debugger: |
|
|
o) see src/debugger.c |
|
|
|
|
|
Terminal/console stuff: |
|
|
o) allow emulated serial ports to be connected to the outside |
|
|
world in a more generic way, or even to other emulated |
|
|
machines(!) |
|
|
|
|
|
Regression tests. (Needs to be totally rewritten, the old framework |
|
|
was removed because it was useless.) |
|
|
|
|
|
Save state of the whole emulated machine, to be able to load it back |
|
|
in later? (Memory, all device's states, all registers and |
|
|
so on. Like taking a snapshot. (SimOS seems to do this, |
|
|
according to its website.)) |
|
|
|
|
|
Better X-windows functionality: |
|
|
o) CLEAN UP the ugly event code |
|
|
o) Mouse clicks can be "missed" in the current system; this is |
|
|
not good. They should be put on a stack of some kind. |
|
|
o) More 2D and 3D framebuffer acceleration. |
|
|
o) Non-resizable windows? Or choose scaledown depending |
|
|
on size (and center the image, with a black border). |
|
|
o) Different scaledown on different windows? |
|
|
o) Switch scaledown during runtime? (Ala CTRL-ALT-plus/minus) |
|
|
o) Keyboard and mouse events: |
|
|
x) Do this for more machines than just DECstation |
|
|
x) more X11 cursor keycodes |
|
|
x) Keys like CTRL, ALT, SHIFT do not get through |
|
|
by themselves (these are necessary for example |
|
|
to change the font of an xterm in X in the |
|
|
emulator) |
|
|
o) Generalize the framebuffer stuff by moving _ALL_ X11 |
|
|
specific code to src/x11.c! |
|
|
|
|
|
Statistics: (this could be interesting) |
|
|
o) Save to file and show graphics. It should be possible to |
|
|
run gxemul after a simulation to just show the graphics, |
|
|
or convert to a .ppm or .tga or similar. |
|
|
o) memory accesses (to measure cache efficiency and |
|
|
page coloring efficiency) |
|
|
o) nr of simultaneous ASIDs in use in the TLB, for MIPS |
|
|
o) percentage of time spent in different "states", such as |
|
|
running userland code, kernel code, or idling (for CPUs |
|
|
that have such an instruction, or whenever the PC is |
|
|
inside a specific idle-function (address range)). |
|
|
Possible additional state (for example on R3000): caches |
|
|
disabled. |
|
|
o) position of read/write on (SCSI) disks |
|
| 554 |
|
|
Parent Directory
| 
Revision Log
| 
Patch