1 /* $NetBSD: fpu_emulate.c,v 1.52 2026/11/01 12:40:48 thorpej Exp $ */ 2 3 /* 4 * Copyright (c) 1995 Gordon W. Ross 5 * some portion Copyright (c) 1995 Ken Nakata 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of the author may not be used to endorse or promote products 17 * derived from this software without specific prior written permission. 18 * 4. All advertising materials mentioning features or use of this software 19 * must display the following acknowledgement: 20 * This product includes software developed by Gordon Ross 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 23 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 24 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 25 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 26 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 27 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 28 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 29 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 30 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 31 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 32 */ 33 34 /* 35 * mc68881 emulator 36 * XXX - Just a start at it for now... 37 */ 38 39 #include <sys/cdefs.h> 40 __KERNEL_RCSID(0, "$NetBSD: fpu_emulate.c,v 1.52 2026/11/01 12:40:48 thorpej Exp $"); 41 42 #include <sys/param.h> 43 #include <sys/types.h> 44 #include <sys/signal.h> 45 #include <sys/systm.h> 46 #include <machine/frame.h> 47 48 #if defined(DDB) && defined(DEBUG_FPE) 49 # include <m68k/db_machdep.h> 50 #endif 51 52 #include "fpu_emulate.h" 53 54 #define fpe_abort(tfp, ksi, signo, code) \ 55 do { \ 56 (ksi)->ksi_signo = (signo); \ 57 (ksi)->ksi_code = (code); \ 58 (ksi)->ksi_addr = (void *)(frame)->f_pc; \ 59 return -1; \ 60 } while (/* CONSTCOND */ 0) 61 62 static int fpu_emul_fmovmcr(struct fpemu *, struct instruction *); 63 static int fpu_emul_fmovm(struct fpemu *, struct instruction *); 64 static int fpu_emul_arith(struct fpemu *, struct instruction *); 65 static int fpu_emul_type1(struct fpemu *, struct instruction *); 66 static int fpu_emul_brcc(struct fpemu *, struct instruction *); 67 static int test_cc(struct fpemu *, int); 68 69 #ifdef DEBUG_FPE 70 #define DUMP_INSN(insn) \ 71 printf("%s: insn={adv=%d,siz=%d,op=%04x,w1=%04x}\n", \ 72 __func__, \ 73 (insn)->is_advance, (insn)->is_datasize, \ 74 (insn)->is_opcode, (insn)->is_word1) 75 #define DPRINTF(x) printf x 76 #else 77 #define DUMP_INSN(insn) do {} while (/* CONSTCOND */ 0) 78 #define DPRINTF(x) do {} while (/* CONSTCOND */ 0) 79 #endif 80 81 /* 82 * Emulate a floating-point instruction. 83 * Return zero for success, else signal number. 84 * (Typically: zero, SIGFPE, SIGILL, SIGSEGV) 85 */ 86 int 87 fpu_emulate(struct frame *frame, struct fpframe *fpf, ksiginfo_t *ksi) 88 { 89 /* 90 * Allocate state for the FPU emulator on the kernel stack. 91 * Normally we wouldn't want to allocate this much on the 92 * stack, but the emulator is only for user-space code, so 93 * the kernel stack will have been idle when the F-line trap 94 * occurred; the only things on the stack at this point are 95 * the trap frame and the small number of call frames required 96 * to get us here. 97 * 98 * This prevents concurrent FPU emuations from colliding 99 * with each other. This is something that could happen 100 * when e.g. two FP-using programs are running concurrently 101 * on a system under memory pressure and one of them blocks 102 * during an emulation to service a page fault. 103 * 104 * The alternatives are less than ideal: we either have to 105 * dynamically allocate memory or wrap the emulator in a 106 * mutex. 107 */ 108 struct instruction insn = { 109 .is_pc = frame->f_pc, 110 .is_datasize = -1, 111 }; 112 struct fpemu fe = { 113 .fe_frame = frame, 114 .fe_fpframe = fpf, 115 .fe_fpsr = fpf->fpf_fpsr, 116 .fe_fpcr = fpf->fpf_fpcr, 117 }; 118 int optype, sig; 119 unsigned short sval; 120 121 DPRINTF(("%s: ENTERING: FPSR=%08x, FPCR=%08x\n", 122 __func__, fe.fe_fpsr, fe.fe_fpcr)); 123 124 if (frame->f_format == 4) { 125 /* 126 * A format 4 is generated by the 68{EC,LC}040. The PC is 127 * already set to the instruction following the faulting 128 * instruction. We need to calculate that, anyway. The 129 * fslw is the PC of the faulted instruction, which is what 130 * we expect to be in f_pc. 131 * 132 * XXX - This is a hack; it assumes we at least know the 133 * sizes of all instructions we run across. 134 * XXX TODO: This may not be true, so we might want to save 135 * the PC in order to restore it later. 136 */ 137 #if 0 138 insn.is_nextpc = frame->f_pc; 139 #endif 140 insn.is_pc = frame->f_fmt4.f_fslw; 141 frame->f_pc = insn.is_pc; 142 } 143 144 if (ufetch_short((void *)(insn.is_pc), &sval)) { 145 DPRINTF(("%s: fault reading opcode\n", __func__)); 146 fpe_abort(frame, ksi, SIGSEGV, SEGV_ACCERR); 147 } 148 149 if ((sval & 0xf000) != 0xf000) { 150 DPRINTF(("%s: not coproc. insn.: opcode=0x%x\n", 151 __func__, sval)); 152 fpe_abort(frame, ksi, SIGILL, ILL_ILLOPC); 153 } 154 155 if ((sval & 0x0E00) != 0x0200) { 156 DPRINTF(("%s: bad coproc. id: opcode=0x%x\n", __func__, sval)); 157 fpe_abort(frame, ksi, SIGILL, ILL_ILLOPC); 158 } 159 160 insn.is_opcode = sval; 161 optype = (sval & 0x01C0); 162 163 if (ufetch_short((void *)(insn.is_pc + 2), &sval)) { 164 DPRINTF(("%s: fault reading word1\n", __func__)); 165 fpe_abort(frame, ksi, SIGSEGV, SEGV_ACCERR); 166 } 167 168 /* 169 * At this point, we know we're going to execute some sort of 170 * FP instruction. Set the FP frame state to mimic 68881 171 * idle state so that other logic elsewhere can interact with 172 * the FP state in the PCB in natural way. 173 * 174 * If a program never executes an (emulated) FP instruction, then 175 * the version field will remain 0, and e.g. cpu_getmcontext() 176 * won't bother to save it. 177 */ 178 fpf->fpf_version = 0x1f; 179 fpf->fpf_fsize = 0x18; 180 181 insn.is_word1 = sval; 182 /* all FPU instructions are at least 4-byte long */ 183 insn.is_advance = 4; 184 185 DUMP_INSN(&insn); 186 187 /* 188 * Which family (or type) of opcode is it? 189 * Tests ordered by likelihood (hopefully). 190 * Certainly, type 0 is the most common. 191 */ 192 if (optype == 0x0000) { 193 /* type=0: generic */ 194 if ((sval & 0x8000)) { 195 if ((sval & 0x4000)) { 196 DPRINTF(("%s: fmovm FPr\n", __func__)); 197 sig = fpu_emul_fmovm(&fe, &insn); 198 } else { 199 DPRINTF(("%s: fmovm FPcr\n", __func__)); 200 sig = fpu_emul_fmovmcr(&fe, &insn); 201 } 202 } else { 203 if ((sval & 0xe000) == 0x6000) { 204 /* fstore = fmove FPn,mem */ 205 DPRINTF(("%s: fmove to mem\n", __func__)); 206 sig = fpu_emul_fstore(&fe, &insn); 207 } else if ((sval & 0xfc00) == 0x5c00) { 208 /* fmovecr */ 209 DPRINTF(("%s: fmovecr\n", __func__)); 210 sig = fpu_emul_fmovecr(&fe, &insn); 211 } else if ((sval & 0xa07f) == 0x26) { 212 /* fscale */ 213 DPRINTF(("%s: fscale\n", __func__)); 214 sig = fpu_emul_fscale(&fe, &insn); 215 } else { 216 DPRINTF(("%s: other type0\n", __func__)); 217 /* all other type0 insns are arithmetic */ 218 sig = fpu_emul_arith(&fe, &insn); 219 } 220 if (sig == 0) { 221 DPRINTF(("%s: type 0 returned 0\n", __func__)); 222 sig = fpu_upd_excp(&fe); 223 } 224 } 225 } else if (optype == 0x0080 || optype == 0x00C0) { 226 /* type=2 or 3: fbcc, short or long disp. */ 227 DPRINTF(("%s: fbcc %s\n", __func__, 228 (optype & 0x40) ? "long" : "short")); 229 sig = fpu_emul_brcc(&fe, &insn); 230 } else if (optype == 0x0040) { 231 /* type=1: fdbcc, fscc, ftrapcc */ 232 DPRINTF(("%s: type1\n", __func__)); 233 sig = fpu_emul_type1(&fe, &insn); 234 /* real FTRAPcc raises T_TRAPVINST if the condition is met. */ 235 if (sig == SIGFPE) { 236 ksi->ksi_trap = T_TRAPVINST; 237 } 238 } else { 239 /* type=4: fsave (privileged) */ 240 /* type=5: frestore (privileged) */ 241 /* type=6: reserved */ 242 /* type=7: reserved */ 243 DPRINTF(("%s: bad opcode type: opcode=0x%x\n", __func__, 244 insn.is_opcode)); 245 sig = SIGILL; 246 } 247 248 DUMP_INSN(&insn); 249 250 /* 251 * XXX it is not clear to me, if we should progress the PC always, 252 * for SIGFPE || 0, or only for 0; however, without SIGFPE, we 253 * don't pass the signalling regression tests. -is 254 */ 255 if ((sig == 0) || (sig == SIGFPE)) 256 frame->f_pc += insn.is_advance; 257 #if defined(DDB) && defined(DEBUG_FPE) 258 else { 259 printf("%s: sig=%d, opcode=%x, word1=%x\n", __func__, 260 sig, insn.is_opcode, insn.is_word1); 261 kdb_trap(-1, (db_regs_t *)&frame); 262 } 263 #endif 264 #if 0 /* XXX something is wrong */ 265 if (frame->f_format == 4) { 266 /* XXX Restore PC -- 68{EC,LC}040 only */ 267 if (insn.is_nextpc) 268 frame->f_pc = insn.is_nextpc; 269 } 270 #endif 271 272 DPRINTF(("%s: EXITING: w/FPSR=%08x, FPCR=%08x\n", __func__, 273 fe.fe_fpsr, fe.fe_fpcr)); 274 275 if (sig) 276 fpe_abort(frame, ksi, sig, 0); 277 return sig; 278 } 279 280 /* update accrued exception bits and see if there's an FP exception */ 281 int 282 fpu_upd_excp(struct fpemu *fe) 283 { 284 uint32_t fpsr; 285 uint32_t fpcr; 286 287 fpsr = fe->fe_fpsr; 288 fpcr = fe->fe_fpcr; 289 /* 290 * update fpsr accrued exception bits; each insn doesn't have to 291 * update this 292 */ 293 if (fpsr & (FPSR_BSUN | FPSR_SNAN | FPSR_OPERR)) { 294 fpsr |= FPSR_AIOP; 295 } 296 if (fpsr & FPSR_OVFL) { 297 fpsr |= FPSR_AOVFL; 298 } 299 if ((fpsr & FPSR_UNFL) && (fpsr & FPSR_INEX2)) { 300 fpsr |= FPSR_AUNFL; 301 } 302 if (fpsr & FPSR_DZ) { 303 fpsr |= FPSR_ADZ; 304 } 305 if (fpsr & (FPSR_INEX1 | FPSR_INEX2 | FPSR_OVFL)) { 306 fpsr |= FPSR_AINEX; 307 } 308 309 fe->fe_fpframe->fpf_fpsr = fe->fe_fpsr = fpsr; 310 311 return (fpsr & fpcr & FPSR_EXCP) ? SIGFPE : 0; 312 } 313 314 /* update fpsr according to fp (= result of an fp op) */ 315 uint32_t 316 fpu_upd_fpsr(struct fpemu *fe, struct fpn *fp) 317 { 318 uint32_t fpsr; 319 320 DPRINTF(("%s: previous fpsr=%08x\n", __func__, fe->fe_fpsr)); 321 /* clear all condition code */ 322 fpsr = fe->fe_fpsr & ~FPSR_CCB; 323 324 DPRINTF(("%s: result is a ", __func__)); 325 if (fp->fp_sign) { 326 DPRINTF(("negative ")); 327 fpsr |= FPSR_NEG; 328 } else { 329 DPRINTF(("positive ")); 330 } 331 332 switch (fp->fp_class) { 333 case FPC_SNAN: 334 DPRINTF(("signaling NAN\n")); 335 fpsr |= (FPSR_NAN | FPSR_SNAN); 336 break; 337 case FPC_QNAN: 338 DPRINTF(("quiet NAN\n")); 339 fpsr |= FPSR_NAN; 340 break; 341 case FPC_ZERO: 342 DPRINTF(("Zero\n")); 343 fpsr |= FPSR_ZERO; 344 break; 345 case FPC_INF: 346 DPRINTF(("Inf\n")); 347 fpsr |= FPSR_INF; 348 break; 349 default: 350 DPRINTF(("Number\n")); 351 /* anything else is treated as if it is a number */ 352 break; 353 } 354 355 fe->fe_fpsr = fe->fe_fpframe->fpf_fpsr = fpsr; 356 357 DPRINTF(("%s: new fpsr=%08x\n", __func__, fe->fe_fpframe->fpf_fpsr)); 358 359 return fpsr; 360 } 361 362 static int 363 fpu_emul_fmovmcr(struct fpemu *fe, struct instruction *insn) 364 { 365 struct frame *frame = fe->fe_frame; 366 struct fpframe *fpf = fe->fe_fpframe; 367 int sig; 368 int reglist; 369 int regcount; 370 int fpu_to_mem; 371 int modreg; 372 uint32_t tmp[3]; 373 374 /* move to/from control registers */ 375 reglist = (insn->is_word1 & 0x1c00) >> 10; 376 /* Bit 13 selects direction (FPU to/from Mem) */ 377 fpu_to_mem = insn->is_word1 & 0x2000; 378 379 /* Check an illegal mod/reg. */ 380 modreg = insn->is_opcode & 077; 381 if (fpu_to_mem) { 382 /* PCrel, #imm are illegal. */ 383 if (modreg >= 072) { 384 return SIGILL; 385 } 386 } else { 387 /* All mod/reg can be specified. */ 388 if (modreg >= 075) { 389 return SIGILL; 390 } 391 } 392 393 /* 394 * If reglist is 0b000, treat it as FPIAR. This is not specification 395 * but the behavior described in the 6888x user's manual. 396 */ 397 if (reglist == 0) 398 reglist = 1; 399 400 if (reglist == 7) { 401 regcount = 3; 402 } else if (reglist == 3 || reglist == 5 || reglist == 6) { 403 regcount = 2; 404 } else { 405 regcount = 1; 406 } 407 insn->is_datasize = regcount * 4; 408 sig = fpu_decode_ea(frame, insn, &insn->is_ea, modreg); 409 if (sig) 410 return sig; 411 412 /* 413 * For data register, only single register can be transferred. 414 * For addr register, only FPIAR can be transferred. 415 */ 416 if ((insn->is_ea.ea_flags & EA_DIRECT)) { 417 if (insn->is_ea.ea_regnum < 8) { 418 if (regcount != 1) { 419 return SIGILL; 420 } 421 } else { 422 if (reglist != 1) { 423 return SIGILL; 424 } 425 } 426 } 427 428 if (fpu_to_mem) { 429 uint32_t *s = &tmp[0]; 430 431 if ((reglist & 4)) { 432 *s++ = fpf->fpf_fpcr; 433 } 434 if ((reglist & 2)) { 435 *s++ = fpf->fpf_fpsr; 436 } 437 if ((reglist & 1)) { 438 *s++ = fpf->fpf_fpiar; 439 } 440 441 sig = fpu_store_ea(frame, insn, &insn->is_ea, (char *)tmp); 442 } else { 443 const uint32_t *d = &tmp[0]; 444 445 sig = fpu_load_ea(frame, insn, &insn->is_ea, (char *)tmp); 446 if (sig) 447 return sig; 448 449 if ((reglist & 4)) { 450 fpf->fpf_fpcr = *d++; 451 fpf->fpf_fpcr &= 0x0000fff0; 452 } 453 if ((reglist & 2)) { 454 fpf->fpf_fpsr = *d++; 455 fpf->fpf_fpsr &= 0x0ffffff8; 456 } 457 if ((reglist & 1)) { 458 fpf->fpf_fpiar = *d++; 459 } 460 } 461 return sig; 462 } 463 464 /* 465 * type 0: fmovem 466 * Separated out of fpu_emul_type0 for efficiency. 467 * In this function, we know: 468 * (opcode & 0x01C0) == 0 469 * (word1 & 0x8000) == 0x8000 470 * 471 * No conversion or rounding is done by this instruction, 472 * and the FPSR is not affected. 473 */ 474 static int 475 fpu_emul_fmovm(struct fpemu *fe, struct instruction *insn) 476 { 477 struct frame *frame = fe->fe_frame; 478 struct fpframe *fpf = fe->fe_fpframe; 479 int word1, sig; 480 int reglist, regmask, regnum; 481 int modreg; 482 int fpu_to_mem, order; 483 /* int w1_post_incr; */ 484 int *fpregs; 485 486 insn->is_datasize = 12; 487 word1 = insn->is_word1; 488 489 /* Bit 13 selects direction (FPU to/from Mem) */ 490 fpu_to_mem = word1 & 0x2000; 491 492 /* 493 * Bits 12,11 select register list mode: 494 * 0,0: Static reg list, pre-decr. 495 * 0,1: Dynamic reg list, pre-decr. 496 * 1,0: Static reg list, post-incr. 497 * 1,1: Dynamic reg list, post-incr 498 */ 499 /* w1_post_incr = word1 & 0x1000; */ 500 if (word1 & 0x0800) { 501 /* dynamic reg list */ 502 reglist = frame->f_regs[(word1 & 0x70) >> 4]; 503 } else { 504 reglist = word1; 505 } 506 reglist &= 0xFF; 507 508 /* Check an illegal mod/reg. */ 509 modreg = insn->is_opcode & 077; 510 if (fpu_to_mem) { 511 /* Dn, An, (An)+, PCrel, #imm are illegal. */ 512 if (modreg < 020 || (modreg >> 3) == 3 || modreg >= 072) { 513 return SIGILL; 514 } 515 } else { 516 /* Dn, An, -(An), #imm are illegal. */ 517 if (modreg < 020 || (modreg >> 3) == 4 || modreg >= 074) { 518 return SIGILL; 519 } 520 } 521 522 /* Get effective address. */ 523 sig = fpu_decode_ea(frame, insn, &insn->is_ea, modreg); 524 if (sig) 525 return sig; 526 527 /* Get address of soft coprocessor regs. */ 528 fpregs = &fpf->fpf_regs[0]; 529 530 if (insn->is_ea.ea_flags & EA_PREDECR) { 531 regnum = 7; 532 order = -1; 533 } else { 534 regnum = 0; 535 order = 1; 536 } 537 538 regmask = 0x80; 539 while ((0 <= regnum) && (regnum < 8)) { 540 if (regmask & reglist) { 541 if (fpu_to_mem) { 542 sig = fpu_store_ea(frame, insn, &insn->is_ea, 543 (char *)&fpregs[regnum * 3]); 544 DPRINTF(("%s: FP%d (%08x,%08x,%08x) saved\n", 545 __func__, regnum, 546 fpregs[regnum * 3], 547 fpregs[regnum * 3 + 1], 548 fpregs[regnum * 3 + 2])); 549 } else { /* mem to fpu */ 550 sig = fpu_load_ea(frame, insn, &insn->is_ea, 551 (char *)&fpregs[regnum * 3]); 552 DPRINTF(("%s: FP%d (%08x,%08x,%08x) loaded\n", 553 __func__, regnum, 554 fpregs[regnum * 3], 555 fpregs[regnum * 3 + 1], 556 fpregs[regnum * 3 + 2])); 557 } 558 if (sig) 559 break; 560 } 561 regnum += order; 562 regmask >>= 1; 563 } 564 565 return sig; 566 } 567 568 struct fpn * 569 fpu_cmp(struct fpemu *fe) 570 { 571 struct fpn *x = &fe->fe_f1, *y = &fe->fe_f2; 572 573 /* take care of special cases */ 574 if (x->fp_class < 0 || y->fp_class < 0) { 575 /* if either of two is a SNAN, result is SNAN */ 576 x->fp_class = 577 (y->fp_class < x->fp_class) ? y->fp_class : x->fp_class; 578 } else if (x->fp_class == FPC_INF) { 579 if (y->fp_class == FPC_INF) { 580 /* both infinities */ 581 if (x->fp_sign == y->fp_sign) { 582 /* return a signed zero */ 583 x->fp_class = FPC_ZERO; 584 } else { 585 /* return a faked number w/x's sign */ 586 x->fp_class = FPC_NUM; 587 x->fp_exp = 16383; 588 x->fp_mant[0] = FP_1; 589 } 590 } else { 591 /* y is a number */ 592 /* return a forged number w/x's sign */ 593 x->fp_class = FPC_NUM; 594 x->fp_exp = 16383; 595 x->fp_mant[0] = FP_1; 596 } 597 } else if (y->fp_class == FPC_INF) { 598 /* x is a Num but y is an Inf */ 599 /* return a forged number w/y's sign inverted */ 600 x->fp_class = FPC_NUM; 601 x->fp_sign = !y->fp_sign; 602 x->fp_exp = 16383; 603 x->fp_mant[0] = FP_1; 604 } else { 605 /* 606 * x and y are both numbers or zeros, 607 * or pair of a number and a zero 608 */ 609 y->fp_sign = !y->fp_sign; 610 x = fpu_add(fe); /* (x - y) */ 611 /* 612 * FCMP does not set Inf bit in CC, so return a forged number 613 * (value doesn't matter) if Inf is the result of fsub. 614 */ 615 if (x->fp_class == FPC_INF) { 616 x->fp_class = FPC_NUM; 617 x->fp_exp = 16383; 618 x->fp_mant[0] = FP_1; 619 } 620 } 621 return x; 622 } 623 624 /* 625 * arithmetic operations 626 */ 627 static int 628 fpu_emul_arith(struct fpemu *fe, struct instruction *insn) 629 { 630 struct frame *frame = fe->fe_frame; 631 uint32_t *fpregs = &(fe->fe_fpframe->fpf_regs[0]); 632 struct fpn *res; 633 int word1, sig = 0; 634 int regnum, format; 635 int modreg; 636 int discard_result = 0; 637 uint32_t buf[3]; 638 #ifdef DEBUG_FPE 639 int flags; 640 char regname; 641 #endif 642 643 fe->fe_fpsr &= ~FPSR_EXCP; 644 645 DUMP_INSN(insn); 646 647 DPRINTF(("%s: FPSR = %08x, FPCR = %08x\n", __func__, 648 fe->fe_fpsr, fe->fe_fpcr)); 649 650 word1 = insn->is_word1; 651 format = (word1 >> 10) & 7; 652 regnum = (word1 >> 7) & 7; 653 654 /* fetch a source operand : may not be used */ 655 DPRINTF(("%s: dst/src FP%d=%08x,%08x,%08x\n", __func__, 656 regnum, fpregs[regnum * 3], fpregs[regnum * 3 + 1], 657 fpregs[regnum * 3 + 2])); 658 659 fpu_explode(fe, &fe->fe_f1, FTYPE_EXT, &fpregs[regnum * 3]); 660 661 DUMP_INSN(insn); 662 663 /* get the other operand which is always the source */ 664 if ((word1 & 0x4000) == 0) { 665 DPRINTF(("%s: FP%d op FP%d => FP%d\n", __func__, 666 format, regnum, regnum)); 667 DPRINTF(("%s: src opr FP%d=%08x,%08x,%08x\n", __func__, 668 format, fpregs[format * 3], fpregs[format * 3 + 1], 669 fpregs[format * 3 + 2])); 670 fpu_explode(fe, &fe->fe_f2, FTYPE_EXT, &fpregs[format * 3]); 671 } else { 672 /* the operand is in memory */ 673 if (format == FTYPE_DBL) { 674 insn->is_datasize = 8; 675 } else if (format == FTYPE_SNG || format == FTYPE_LNG) { 676 insn->is_datasize = 4; 677 } else if (format == FTYPE_WRD) { 678 insn->is_datasize = 2; 679 } else if (format == FTYPE_BYT) { 680 insn->is_datasize = 1; 681 } else if (format == FTYPE_EXT) { 682 insn->is_datasize = 12; 683 } else { 684 /* invalid or unsupported operand format */ 685 sig = SIGFPE; 686 return sig; 687 } 688 689 /* Check an illegal mod/reg. */ 690 modreg = insn->is_opcode & 077; 691 if ((modreg >> 3) == 1/*An*/ || modreg >= 075) { 692 return SIGILL; 693 } 694 695 /* Get effective address. */ 696 sig = fpu_decode_ea(frame, insn, &insn->is_ea, modreg); 697 if (sig) { 698 DPRINTF(("%s: error in fpu_decode_ea\n", __func__)); 699 return sig; 700 } 701 702 if (insn->is_ea.ea_flags == EA_DIRECT && 703 insn->is_datasize > 4) { 704 DPRINTF(("%s: attempted to fetch dbl/ext from reg\n", 705 __func__)); 706 return SIGILL; 707 } 708 709 DUMP_INSN(insn); 710 711 #ifdef DEBUG_FPE 712 printf("%s: addr mode = ", __func__); 713 flags = insn->is_ea.ea_flags; 714 regname = (insn->is_ea.ea_regnum & 8) ? 'a' : 'd'; 715 716 if (flags & EA_DIRECT) { 717 printf("%c%d\n", regname, insn->is_ea.ea_regnum & 7); 718 } else if (flags & EA_PC_REL) { 719 if (flags & EA_OFFSET) { 720 printf("pc@(%d)\n", insn->is_ea.ea_offset); 721 } else if (flags & EA_INDEXED) { 722 printf("pc@(...)\n"); 723 } 724 } else if (flags & EA_PREDECR) { 725 printf("%c%d@-\n", regname, insn->is_ea.ea_regnum & 7); 726 } else if (flags & EA_POSTINCR) { 727 printf("%c%d@+\n", regname, insn->is_ea.ea_regnum & 7); 728 } else if (flags & EA_OFFSET) { 729 printf("%c%d@(%d)\n", regname, 730 insn->is_ea.ea_regnum & 7, 731 insn->is_ea.ea_offset); 732 } else if (flags & EA_INDEXED) { 733 printf("%c%d@(...)\n", regname, 734 insn->is_ea.ea_regnum & 7); 735 } else if (flags & EA_ABS) { 736 printf("0x%08x\n", insn->is_ea.ea_absaddr); 737 } else if (flags & EA_IMMED) { 738 printf("#0x%08x,%08x,%08x\n", 739 insn->is_ea.ea_immed[0], 740 insn->is_ea.ea_immed[1], 741 insn->is_ea.ea_immed[2]); 742 } else { 743 printf("%c%d@\n", regname, insn->is_ea.ea_regnum & 7); 744 } 745 #endif /* DEBUG_FPE */ 746 747 sig = fpu_load_ea(frame, insn, &insn->is_ea, (char*)buf); 748 if (sig) { 749 DPRINTF(("%s: error in fpu_load_ea\n", __func__)); 750 return sig; 751 } 752 if (format == FTYPE_WRD) { 753 /* sign-extend */ 754 buf[0] &= 0xffff; 755 if (buf[0] & 0x8000) 756 buf[0] |= 0xffff0000; 757 format = FTYPE_LNG; 758 } else if (format == FTYPE_BYT) { 759 /* sign-extend */ 760 buf[0] &= 0xff; 761 if (buf[0] & 0x80) 762 buf[0] |= 0xffffff00; 763 format = FTYPE_LNG; 764 } 765 DPRINTF(("%s: src = %08x %08x %08x, siz = %d\n", __func__, 766 buf[0], buf[1], buf[2], insn->is_datasize)); 767 fpu_explode(fe, &fe->fe_f2, format, buf); 768 } 769 770 DUMP_INSN(insn); 771 772 /* 773 * An arithmetic instruction emulate function has a prototype of 774 * struct fpn *fpu_op(struct fpemu *); 775 * 776 * 1) If the instruction is monadic, then fpu_op() must use 777 * fe->fe_f2 as its operand, and return a pointer to the 778 * result. 779 * 780 * 2) If the instruction is diadic, then fpu_op() must use 781 * fe->fe_f1 and fe->fe_f2 as its two operands, and return a 782 * pointer to the result. 783 * 784 */ 785 res = NULL; 786 switch (word1 & 0x7f) { 787 case 0x00: /* fmove */ 788 res = &fe->fe_f2; 789 break; 790 791 case 0x01: /* fint */ 792 res = fpu_int(fe); 793 break; 794 795 case 0x02: /* fsinh */ 796 res = fpu_sinh(fe); 797 break; 798 799 case 0x03: /* fintrz */ 800 res = fpu_intrz(fe); 801 break; 802 803 case 0x04: /* fsqrt */ 804 res = fpu_sqrt(fe); 805 break; 806 807 case 0x06: /* flognp1 */ 808 res = fpu_lognp1(fe); 809 break; 810 811 case 0x08: /* fetoxm1 */ 812 res = fpu_etoxm1(fe); 813 break; 814 815 case 0x09: /* ftanh */ 816 res = fpu_tanh(fe); 817 break; 818 819 case 0x0A: /* fatan */ 820 res = fpu_atan(fe); 821 break; 822 823 case 0x0C: /* fasin */ 824 res = fpu_asin(fe); 825 break; 826 827 case 0x0D: /* fatanh */ 828 res = fpu_atanh(fe); 829 break; 830 831 case 0x0E: /* fsin */ 832 res = fpu_sin(fe); 833 break; 834 835 case 0x0F: /* ftan */ 836 res = fpu_tan(fe); 837 break; 838 839 case 0x10: /* fetox */ 840 res = fpu_etox(fe); 841 break; 842 843 case 0x11: /* ftwotox */ 844 res = fpu_twotox(fe); 845 break; 846 847 case 0x12: /* ftentox */ 848 res = fpu_tentox(fe); 849 break; 850 851 case 0x14: /* flogn */ 852 res = fpu_logn(fe); 853 break; 854 855 case 0x15: /* flog10 */ 856 res = fpu_log10(fe); 857 break; 858 859 case 0x16: /* flog2 */ 860 res = fpu_log2(fe); 861 break; 862 863 case 0x18: /* fabs */ 864 fe->fe_f2.fp_sign = 0; 865 res = &fe->fe_f2; 866 break; 867 868 case 0x19: /* fcosh */ 869 res = fpu_cosh(fe); 870 break; 871 872 case 0x1A: /* fneg */ 873 fe->fe_f2.fp_sign = !fe->fe_f2.fp_sign; 874 res = &fe->fe_f2; 875 break; 876 877 case 0x1C: /* facos */ 878 res = fpu_acos(fe); 879 break; 880 881 case 0x1D: /* fcos */ 882 res = fpu_cos(fe); 883 break; 884 885 case 0x1E: /* fgetexp */ 886 res = fpu_getexp(fe); 887 break; 888 889 case 0x1F: /* fgetman */ 890 res = fpu_getman(fe); 891 break; 892 893 case 0x20: /* fdiv */ 894 case 0x24: /* fsgldiv: cheating - better than nothing */ 895 res = fpu_div(fe); 896 break; 897 898 case 0x21: /* fmod */ 899 res = fpu_mod(fe); 900 break; 901 902 case 0x28: /* fsub */ 903 fe->fe_f2.fp_sign = !fe->fe_f2.fp_sign; /* f2 = -f2 */ 904 /* FALLTHROUGH */ 905 case 0x22: /* fadd */ 906 res = fpu_add(fe); 907 break; 908 909 case 0x23: /* fmul */ 910 case 0x27: /* fsglmul: cheating - better than nothing */ 911 res = fpu_mul(fe); 912 break; 913 914 case 0x25: /* frem */ 915 res = fpu_rem(fe); 916 break; 917 918 case 0x26: 919 /* fscale is handled by a separate function */ 920 break; 921 922 case 0x30: 923 case 0x31: 924 case 0x32: 925 case 0x33: 926 case 0x34: 927 case 0x35: 928 case 0x36: 929 case 0x37: /* fsincos */ 930 res = fpu_sincos(fe, word1 & 7); 931 break; 932 933 case 0x38: /* fcmp */ 934 res = fpu_cmp(fe); 935 discard_result = 1; 936 break; 937 938 case 0x3A: /* ftst */ 939 res = &fe->fe_f2; 940 discard_result = 1; 941 break; 942 943 default: /* possibly 040/060 instructions */ 944 DPRINTF(("%s: bad opcode=0x%x, word1=0x%x\n", __func__, 945 insn->is_opcode, insn->is_word1)); 946 sig = SIGILL; 947 } 948 949 /* for sanity */ 950 if (res == NULL) 951 sig = SIGILL; 952 953 if (sig == 0) { 954 if (!discard_result) 955 fpu_implode(fe, res, FTYPE_EXT, &fpregs[regnum * 3]); 956 957 /* update fpsr according to the result of operation */ 958 fpu_upd_fpsr(fe, res); 959 #ifdef DEBUG_FPE 960 if (!discard_result) { 961 printf("%s: %08x,%08x,%08x stored in FP%d\n", __func__, 962 fpregs[regnum * 3], 963 fpregs[regnum * 3 + 1], 964 fpregs[regnum * 3 + 2], 965 regnum); 966 } else { 967 static const char *class_name[] = 968 { "SNAN", "QNAN", "ZERO", "NUM", "INF" }; 969 printf("%s: result(%s,%c,%d,%08x,%08x,%08x) " 970 "discarded\n", __func__, 971 class_name[res->fp_class + 2], 972 res->fp_sign ? '-' : '+', res->fp_exp, 973 res->fp_mant[0], res->fp_mant[1], 974 res->fp_mant[2]); 975 } 976 #endif 977 } else { 978 DPRINTF(("%s: received signal %d\n", __func__, sig)); 979 } 980 981 DPRINTF(("%s: FPSR = %08x, FPCR = %08x\n", __func__, 982 fe->fe_fpsr, fe->fe_fpcr)); 983 984 DUMP_INSN(insn); 985 986 return sig; 987 } 988 989 /* 990 * test condition code according to the predicate in the opcode. 991 * returns -1 when the predicate evaluates to true, 0 when false. 992 * signal numbers are returned when an error is detected. 993 */ 994 static int 995 test_cc(struct fpemu *fe, int pred) 996 { 997 int result, sig_bsun; 998 int fpsr; 999 1000 fpsr = fe->fe_fpsr; 1001 DPRINTF(("%s: fpsr=0x%08x\n", __func__, fpsr)); 1002 pred &= 0x3f; /* lowest 6 bits */ 1003 1004 DPRINTF(("%s: ", __func__)); 1005 1006 if (pred >= 0x20) { 1007 DPRINTF(("Illegal condition code\n")); 1008 return SIGILL; 1009 } else if (pred & 0x10) { 1010 /* IEEE nonaware tests */ 1011 sig_bsun = 1; 1012 pred &= 0x0f; /* lower 4 bits */ 1013 } else { 1014 /* IEEE aware tests */ 1015 DPRINTF(("IEEE ")); 1016 sig_bsun = 0; 1017 } 1018 1019 /* 1020 * condition real 68882 1021 * mnemonic in manual condition 1022 * -------- ---------- ---------- 1023 * 0000 F 0 <- = ~NAN & 0 & ~Z | 0 1024 * 0001 EQ Z <- = ~NAN & 0 | Z | 0 1025 * 0010 OGT ~(NAN|Z|N) <- = ~NAN & ~N & ~Z | 0 1026 * 0011 OGE Z|~(NAN|N) <- = ~NAN & ~N | Z | 0 1027 * 0100 OLT N&~(NAN|Z) <- = ~NAN & N & ~Z | 0 1028 * 0101 OLE Z|(N&~NAN) <- = ~NAN & N | Z | 0 1029 * 0110 OGL ~(NAN|Z) <- = ~NAN & 1 & ~Z | 0 1030 * 0111 OR ~NAN Z|~NAN = ~NAN & 1 | Z | 0 1031 * 1032 * 1000 UN NAN <- = 1 & 0 & ~Z | NAN 1033 * 1001 UEQ NAN|Z <- = 1 & 0 | Z | NAN 1034 * 1010 UGT NAN|~(N|Z) <- = 1 & ~N & ~Z | NAN 1035 * 1011 UGE NAN|(Z|~N) <- = 1 & ~N | Z | NAN 1036 * 1100 ULT NAN|(N&~Z) <- = 1 & N & ~Z | NAN 1037 * 1101 ULE NAN|(Z|N) <- = 1 & N | Z | NAN 1038 * 1110 NE ~Z NAN|(~Z) = 1 & 1 & ~Z | NAN 1039 * 1111 T 1 <- = 1 & 1 | Z | NAN 1040 */ 1041 if ((pred & 0x08) == 0) { 1042 result = ((fpsr & FPSR_NAN) == 0); 1043 } else { 1044 result = 1; 1045 } 1046 switch (pred & 0x06) { 1047 case 0x00: /* AND 0 */ 1048 result &= 0; 1049 break; 1050 case 0x02: /* AND ~N */ 1051 result &= ((fpsr & FPSR_NEG) == 0); 1052 break; 1053 case 0x04: /* AND N */ 1054 result &= ((fpsr & FPSR_NEG) != 0); 1055 break; 1056 case 0x06: /* AND 1 */ 1057 result &= 1; 1058 break; 1059 } 1060 if ((pred & 0x01) == 0) { 1061 result &= ((fpsr & FPSR_ZERO) == 0); 1062 } else { 1063 result |= ((fpsr & FPSR_ZERO) != 0); 1064 } 1065 if ((pred & 0x08) != 0) { 1066 result |= ((fpsr & FPSR_NAN) != 0); 1067 } 1068 1069 DPRINTF(("=> %s (%d)\n", result ? "true" : "false", result)); 1070 /* if it's an IEEE unaware test and NAN is set, BSUN is set */ 1071 if (sig_bsun && (fpsr & FPSR_NAN)) { 1072 fpsr |= FPSR_BSUN; 1073 } 1074 /* if BSUN is set, IOP is set too */ 1075 if ((fpsr & FPSR_BSUN)) { 1076 fpsr |= FPSR_AIOP; 1077 } 1078 1079 /* put fpsr back */ 1080 fe->fe_fpframe->fpf_fpsr = fe->fe_fpsr = fpsr; 1081 1082 return -result; 1083 } 1084 1085 /* 1086 * type 1: fdbcc, fscc, ftrapcc 1087 * In this function, we know: 1088 * (opcode & 0x01C0) == 0x0040 1089 * return SIGILL for an illegal instruction. 1090 * return SIGFPE if FTRAPcc's condition is met. 1091 */ 1092 static int 1093 fpu_emul_type1(struct fpemu *fe, struct instruction *insn) 1094 { 1095 struct frame *frame = fe->fe_frame; 1096 int advance, sig, branch, displ; 1097 unsigned short sval; 1098 1099 branch = test_cc(fe, insn->is_word1); 1100 if (branch > 0) 1101 return branch; 1102 fe->fe_fpframe->fpf_fpsr = fe->fe_fpsr; 1103 1104 sig = 0; 1105 switch (insn->is_opcode & 070) { 1106 case 010: /* fdbcc */ 1107 if (branch) { 1108 /* advance */ 1109 insn->is_advance = 6; 1110 } else { 1111 /* decrement Dn and if (Dn != -1) branch */ 1112 uint16_t count = frame->f_regs[insn->is_opcode & 7]; 1113 1114 if (count-- != 0) { 1115 if (ufetch_short((void *)(insn->is_pc + 1116 insn->is_advance), 1117 &sval)) { 1118 DPRINTF(("%s: fault reading " 1119 "displacement\n", __func__)); 1120 return SIGSEGV; 1121 } 1122 displ = sval; 1123 /* sign-extend the displacement */ 1124 displ &= 0xffff; 1125 if (displ & 0x8000) { 1126 displ |= 0xffff0000; 1127 } 1128 insn->is_advance += displ; 1129 #if 0 /* XXX */ 1130 insn->is_nextpc = insn->is_pc + 1131 insn->is_advance; 1132 #endif 1133 } else { 1134 insn->is_advance = 6; 1135 } 1136 /* write it back */ 1137 frame->f_regs[insn->is_opcode & 7] &= 0xffff0000; 1138 frame->f_regs[insn->is_opcode & 7] |= (uint32_t)count; 1139 } 1140 break; 1141 1142 case 070: /* ftrapcc or fscc */ 1143 advance = 4; 1144 if ((insn->is_opcode & 07) >= 2) { 1145 switch (insn->is_opcode & 07) { 1146 case 3: /* long opr */ 1147 advance += 2; 1148 case 2: /* word opr */ 1149 advance += 2; 1150 case 4: /* no opr */ 1151 break; 1152 default: 1153 return SIGILL; 1154 break; 1155 } 1156 insn->is_advance = advance; 1157 1158 if (branch) { 1159 /* trap */ 1160 sig = SIGFPE; 1161 } 1162 break; 1163 } 1164 1165 /* FALLTHROUGH */ 1166 default: /* fscc */ 1167 insn->is_datasize = 1; /* always byte */ 1168 sig = fpu_decode_ea(frame, insn, &insn->is_ea, insn->is_opcode); 1169 if (sig) { 1170 break; 1171 } 1172 /* set result */ 1173 sig = fpu_store_ea(frame, insn, &insn->is_ea, (char *)&branch); 1174 break; 1175 } 1176 return sig; 1177 } 1178 1179 /* 1180 * Type 2 or 3: fbcc (also fnop) 1181 * In this function, we know: 1182 * (opcode & 0x0180) == 0x0080 1183 */ 1184 static int 1185 fpu_emul_brcc(struct fpemu *fe, struct instruction *insn) 1186 { 1187 int displ, word2; 1188 int sig; 1189 unsigned short sval; 1190 1191 /* 1192 * Get branch displacement. 1193 */ 1194 displ = insn->is_word1; 1195 1196 if (insn->is_opcode & 0x40) { 1197 if (ufetch_short((void *)(insn->is_pc + insn->is_advance), 1198 &sval)) { 1199 DPRINTF(("%s: fault reading word2\n", __func__)); 1200 return SIGSEGV; 1201 } 1202 word2 = sval; 1203 displ <<= 16; 1204 displ |= word2; 1205 insn->is_advance += 2; 1206 } else { 1207 /* displacement is word sized */ 1208 if (displ & 0x8000) 1209 displ |= 0xFFFF0000; 1210 } 1211 1212 /* XXX: If CC, insn->is_pc += displ */ 1213 sig = test_cc(fe, insn->is_opcode); 1214 fe->fe_fpframe->fpf_fpsr = fe->fe_fpsr; 1215 1216 if (fe->fe_fpsr & fe->fe_fpcr & FPSR_EXCP) { 1217 return SIGFPE; /* caught an exception */ 1218 } 1219 if (sig == -1) { 1220 /* 1221 * branch does take place; 2 is the offset to the 1st disp word 1222 */ 1223 insn->is_advance = displ + 2; 1224 #if 0 /* XXX */ 1225 insn->is_nextpc = insn->is_pc + insn->is_advance; 1226 #endif 1227 } else if (sig) 1228 return SIGILL; /* got a signal */ 1229 DPRINTF(("%s: %s insn @ %x (%x+%x) (disp=%x)\n", __func__, 1230 (sig == -1) ? "BRANCH to" : "NEXT", 1231 insn->is_pc + insn->is_advance, insn->is_pc, insn->is_advance, 1232 displ)); 1233 return 0; 1234 } 1235
Indexes created Sat Nov 07 00:25:46 UTC 2026