1 /* $NetBSD: fpu_emulate.c,v 1.49 2025/01/06 07:34:24 isaki Exp $ */
2
3 /*
4 * Copyright (c) 1995 Gordon W. Ross
5 * some portion Copyright (c) 1995 Ken Nakata
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. The name of the author may not be used to endorse or promote products
17 * derived from this software without specific prior written permission.
18 * 4. All advertising materials mentioning features or use of this software
19 * must display the following acknowledgement:
20 * This product includes software developed by Gordon Ross
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
24 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
25 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
26 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
27 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32 */
33
34 /*
35 * mc68881 emulator
36 * XXX - Just a start at it for now...
37 */
38
39 #include <sys/cdefs.h>
40 __KERNEL_RCSID(0, "$NetBSD: fpu_emulate.c,v 1.49 2025/01/06 07:34:24 isaki Exp $");
41
42 #include <sys/param.h>
43 #include <sys/types.h>
44 #include <sys/signal.h>
45 #include <sys/systm.h>
46 #include <machine/frame.h>
47
48 #if defined(DDB) && defined(DEBUG_FPE)
49 # include <m68k/db_machdep.h>
50 #endif
51
52 #include "fpu_emulate.h"
53
54 #define fpe_abort(tfp, ksi, signo, code) \
55 do { \
56 (ksi)->ksi_signo = (signo); \
57 (ksi)->ksi_code = (code); \
58 (ksi)->ksi_addr = (void *)(frame)->f_pc; \
59 return -1; \
60 } while (/* CONSTCOND */ 0)
61
62 static int fpu_emul_fmovmcr(struct fpemu *, struct instruction *);
63 static int fpu_emul_fmovm(struct fpemu *, struct instruction *);
64 static int fpu_emul_arith(struct fpemu *, struct instruction *);
65 static int fpu_emul_type1(struct fpemu *, struct instruction *);
66 static int fpu_emul_brcc(struct fpemu *, struct instruction *);
67 static int test_cc(struct fpemu *, int);
68
69 #ifdef DEBUG_FPE
70 #define DUMP_INSN(insn) \
71 printf("%s: insn={adv=%d,siz=%d,op=%04x,w1=%04x}\n", \
72 __func__, \
73 (insn)->is_advance, (insn)->is_datasize, \
74 (insn)->is_opcode, (insn)->is_word1)
75 #define DPRINTF(x) printf x
76 #else
77 #define DUMP_INSN(insn) do {} while (/* CONSTCOND */ 0)
78 #define DPRINTF(x) do {} while (/* CONSTCOND */ 0)
79 #endif
80
81 /*
82 * Emulate a floating-point instruction.
83 * Return zero for success, else signal number.
84 * (Typically: zero, SIGFPE, SIGILL, SIGSEGV)
85 */
86 int
fpu_emulate(struct frame * frame,struct fpframe * fpf,ksiginfo_t * ksi)87 fpu_emulate(struct frame *frame, struct fpframe *fpf, ksiginfo_t *ksi)
88 {
89 static struct instruction insn;
90 static struct fpemu fe;
91 int optype, sig;
92 unsigned short sval;
93
94 /* initialize insn.is_datasize to tell it is *not* initialized */
95 insn.is_datasize = -1;
96
97 fe.fe_frame = frame;
98 fe.fe_fpframe = fpf;
99 fe.fe_fpsr = fpf->fpf_fpsr;
100 fe.fe_fpcr = fpf->fpf_fpcr;
101
102 DPRINTF(("%s: ENTERING: FPSR=%08x, FPCR=%08x\n",
103 __func__, fe.fe_fpsr, fe.fe_fpcr));
104
105 /* always set this (to avoid a warning) */
106 insn.is_pc = frame->f_pc;
107 insn.is_nextpc = 0;
108 if (frame->f_format == 4) {
109 /*
110 * A format 4 is generated by the 68{EC,LC}040. The PC is
111 * already set to the instruction following the faulting
112 * instruction. We need to calculate that, anyway. The
113 * fslw is the PC of the faulted instruction, which is what
114 * we expect to be in f_pc.
115 *
116 * XXX - This is a hack; it assumes we at least know the
117 * sizes of all instructions we run across.
118 * XXX TODO: This may not be true, so we might want to save
119 * the PC in order to restore it later.
120 */
121 #if 0
122 insn.is_nextpc = frame->f_pc;
123 #endif
124 insn.is_pc = frame->f_fmt4.f_fslw;
125 frame->f_pc = insn.is_pc;
126 }
127
128 if (ufetch_short((void *)(insn.is_pc), &sval)) {
129 DPRINTF(("%s: fault reading opcode\n", __func__));
130 fpe_abort(frame, ksi, SIGSEGV, SEGV_ACCERR);
131 }
132
133 if ((sval & 0xf000) != 0xf000) {
134 DPRINTF(("%s: not coproc. insn.: opcode=0x%x\n",
135 __func__, sval));
136 fpe_abort(frame, ksi, SIGILL, ILL_ILLOPC);
137 }
138
139 if ((sval & 0x0E00) != 0x0200) {
140 DPRINTF(("%s: bad coproc. id: opcode=0x%x\n", __func__, sval));
141 fpe_abort(frame, ksi, SIGILL, ILL_ILLOPC);
142 }
143
144 insn.is_opcode = sval;
145 optype = (sval & 0x01C0);
146
147 if (ufetch_short((void *)(insn.is_pc + 2), &sval)) {
148 DPRINTF(("%s: fault reading word1\n", __func__));
149 fpe_abort(frame, ksi, SIGSEGV, SEGV_ACCERR);
150 }
151 insn.is_word1 = sval;
152 /* all FPU instructions are at least 4-byte long */
153 insn.is_advance = 4;
154
155 DUMP_INSN(&insn);
156
157 /*
158 * Which family (or type) of opcode is it?
159 * Tests ordered by likelihood (hopefully).
160 * Certainly, type 0 is the most common.
161 */
162 if (optype == 0x0000) {
163 /* type=0: generic */
164 if ((sval & 0x8000)) {
165 if ((sval & 0x4000)) {
166 DPRINTF(("%s: fmovm FPr\n", __func__));
167 sig = fpu_emul_fmovm(&fe, &insn);
168 } else {
169 DPRINTF(("%s: fmovm FPcr\n", __func__));
170 sig = fpu_emul_fmovmcr(&fe, &insn);
171 }
172 } else {
173 if ((sval & 0xe000) == 0x6000) {
174 /* fstore = fmove FPn,mem */
175 DPRINTF(("%s: fmove to mem\n", __func__));
176 sig = fpu_emul_fstore(&fe, &insn);
177 } else if ((sval & 0xfc00) == 0x5c00) {
178 /* fmovecr */
179 DPRINTF(("%s: fmovecr\n", __func__));
180 sig = fpu_emul_fmovecr(&fe, &insn);
181 } else if ((sval & 0xa07f) == 0x26) {
182 /* fscale */
183 DPRINTF(("%s: fscale\n", __func__));
184 sig = fpu_emul_fscale(&fe, &insn);
185 } else {
186 DPRINTF(("%s: other type0\n", __func__));
187 /* all other type0 insns are arithmetic */
188 sig = fpu_emul_arith(&fe, &insn);
189 }
190 if (sig == 0) {
191 DPRINTF(("%s: type 0 returned 0\n", __func__));
192 sig = fpu_upd_excp(&fe);
193 }
194 }
195 } else if (optype == 0x0080 || optype == 0x00C0) {
196 /* type=2 or 3: fbcc, short or long disp. */
197 DPRINTF(("%s: fbcc %s\n", __func__,
198 (optype & 0x40) ? "long" : "short"));
199 sig = fpu_emul_brcc(&fe, &insn);
200 } else if (optype == 0x0040) {
201 /* type=1: fdbcc, fscc, ftrapcc */
202 DPRINTF(("%s: type1\n", __func__));
203 sig = fpu_emul_type1(&fe, &insn);
204 /* real FTRAPcc raises T_TRAPVINST if the condition is met. */
205 if (sig == SIGFPE) {
206 ksi->ksi_trap = T_TRAPVINST;
207 }
208 } else {
209 /* type=4: fsave (privileged) */
210 /* type=5: frestore (privileged) */
211 /* type=6: reserved */
212 /* type=7: reserved */
213 DPRINTF(("%s: bad opcode type: opcode=0x%x\n", __func__,
214 insn.is_opcode));
215 sig = SIGILL;
216 }
217
218 DUMP_INSN(&insn);
219
220 /*
221 * XXX it is not clear to me, if we should progress the PC always,
222 * for SIGFPE || 0, or only for 0; however, without SIGFPE, we
223 * don't pass the signalling regression tests. -is
224 */
225 if ((sig == 0) || (sig == SIGFPE))
226 frame->f_pc += insn.is_advance;
227 #if defined(DDB) && defined(DEBUG_FPE)
228 else {
229 printf("%s: sig=%d, opcode=%x, word1=%x\n", __func__,
230 sig, insn.is_opcode, insn.is_word1);
231 kdb_trap(-1, (db_regs_t *)&frame);
232 }
233 #endif
234 #if 0 /* XXX something is wrong */
235 if (frame->f_format == 4) {
236 /* XXX Restore PC -- 68{EC,LC}040 only */
237 if (insn.is_nextpc)
238 frame->f_pc = insn.is_nextpc;
239 }
240 #endif
241
242 DPRINTF(("%s: EXITING: w/FPSR=%08x, FPCR=%08x\n", __func__,
243 fe.fe_fpsr, fe.fe_fpcr));
244
245 if (sig)
246 fpe_abort(frame, ksi, sig, 0);
247 return sig;
248 }
249
250 /* update accrued exception bits and see if there's an FP exception */
251 int
fpu_upd_excp(struct fpemu * fe)252 fpu_upd_excp(struct fpemu *fe)
253 {
254 uint32_t fpsr;
255 uint32_t fpcr;
256
257 fpsr = fe->fe_fpsr;
258 fpcr = fe->fe_fpcr;
259 /*
260 * update fpsr accrued exception bits; each insn doesn't have to
261 * update this
262 */
263 if (fpsr & (FPSR_BSUN | FPSR_SNAN | FPSR_OPERR)) {
264 fpsr |= FPSR_AIOP;
265 }
266 if (fpsr & FPSR_OVFL) {
267 fpsr |= FPSR_AOVFL;
268 }
269 if ((fpsr & FPSR_UNFL) && (fpsr & FPSR_INEX2)) {
270 fpsr |= FPSR_AUNFL;
271 }
272 if (fpsr & FPSR_DZ) {
273 fpsr |= FPSR_ADZ;
274 }
275 if (fpsr & (FPSR_INEX1 | FPSR_INEX2 | FPSR_OVFL)) {
276 fpsr |= FPSR_AINEX;
277 }
278
279 fe->fe_fpframe->fpf_fpsr = fe->fe_fpsr = fpsr;
280
281 return (fpsr & fpcr & FPSR_EXCP) ? SIGFPE : 0;
282 }
283
284 /* update fpsr according to fp (= result of an fp op) */
285 uint32_t
fpu_upd_fpsr(struct fpemu * fe,struct fpn * fp)286 fpu_upd_fpsr(struct fpemu *fe, struct fpn *fp)
287 {
288 uint32_t fpsr;
289
290 DPRINTF(("%s: previous fpsr=%08x\n", __func__, fe->fe_fpsr));
291 /* clear all condition code */
292 fpsr = fe->fe_fpsr & ~FPSR_CCB;
293
294 DPRINTF(("%s: result is a ", __func__));
295 if (fp->fp_sign) {
296 DPRINTF(("negative "));
297 fpsr |= FPSR_NEG;
298 } else {
299 DPRINTF(("positive "));
300 }
301
302 switch (fp->fp_class) {
303 case FPC_SNAN:
304 DPRINTF(("signaling NAN\n"));
305 fpsr |= (FPSR_NAN | FPSR_SNAN);
306 break;
307 case FPC_QNAN:
308 DPRINTF(("quiet NAN\n"));
309 fpsr |= FPSR_NAN;
310 break;
311 case FPC_ZERO:
312 DPRINTF(("Zero\n"));
313 fpsr |= FPSR_ZERO;
314 break;
315 case FPC_INF:
316 DPRINTF(("Inf\n"));
317 fpsr |= FPSR_INF;
318 break;
319 default:
320 DPRINTF(("Number\n"));
321 /* anything else is treated as if it is a number */
322 break;
323 }
324
325 fe->fe_fpsr = fe->fe_fpframe->fpf_fpsr = fpsr;
326
327 DPRINTF(("%s: new fpsr=%08x\n", __func__, fe->fe_fpframe->fpf_fpsr));
328
329 return fpsr;
330 }
331
332 static int
fpu_emul_fmovmcr(struct fpemu * fe,struct instruction * insn)333 fpu_emul_fmovmcr(struct fpemu *fe, struct instruction *insn)
334 {
335 struct frame *frame = fe->fe_frame;
336 struct fpframe *fpf = fe->fe_fpframe;
337 int sig;
338 int reglist;
339 int regcount;
340 int fpu_to_mem;
341 int modreg;
342 uint32_t tmp[3];
343
344 /* move to/from control registers */
345 reglist = (insn->is_word1 & 0x1c00) >> 10;
346 /* Bit 13 selects direction (FPU to/from Mem) */
347 fpu_to_mem = insn->is_word1 & 0x2000;
348
349 /* Check an illegal mod/reg. */
350 modreg = insn->is_opcode & 077;
351 if (fpu_to_mem) {
352 /* PCrel, #imm are illegal. */
353 if (modreg >= 072) {
354 return SIGILL;
355 }
356 } else {
357 /* All mod/reg can be specified. */
358 if (modreg >= 075) {
359 return SIGILL;
360 }
361 }
362
363 /*
364 * If reglist is 0b000, treat it as FPIAR. This is not specification
365 * but the behavior described in the 6888x user's manual.
366 */
367 if (reglist == 0)
368 reglist = 1;
369
370 if (reglist == 7) {
371 regcount = 3;
372 } else if (reglist == 3 || reglist == 5 || reglist == 6) {
373 regcount = 2;
374 } else {
375 regcount = 1;
376 }
377 insn->is_datasize = regcount * 4;
378 sig = fpu_decode_ea(frame, insn, &insn->is_ea, modreg);
379 if (sig)
380 return sig;
381
382 /*
383 * For data register, only single register can be transferred.
384 * For addr register, only FPIAR can be transferred.
385 */
386 if ((insn->is_ea.ea_flags & EA_DIRECT)) {
387 if (insn->is_ea.ea_regnum < 8) {
388 if (regcount != 1) {
389 return SIGILL;
390 }
391 } else {
392 if (reglist != 1) {
393 return SIGILL;
394 }
395 }
396 }
397
398 if (fpu_to_mem) {
399 uint32_t *s = &tmp[0];
400
401 if ((reglist & 4)) {
402 *s++ = fpf->fpf_fpcr;
403 }
404 if ((reglist & 2)) {
405 *s++ = fpf->fpf_fpsr;
406 }
407 if ((reglist & 1)) {
408 *s++ = fpf->fpf_fpiar;
409 }
410
411 sig = fpu_store_ea(frame, insn, &insn->is_ea, (char *)tmp);
412 } else {
413 const uint32_t *d = &tmp[0];
414
415 sig = fpu_load_ea(frame, insn, &insn->is_ea, (char *)tmp);
416 if (sig)
417 return sig;
418
419 if ((reglist & 4)) {
420 fpf->fpf_fpcr = *d++;
421 fpf->fpf_fpcr &= 0x0000fff0;
422 }
423 if ((reglist & 2)) {
424 fpf->fpf_fpsr = *d++;
425 fpf->fpf_fpsr &= 0x0ffffff8;
426 }
427 if ((reglist & 1)) {
428 fpf->fpf_fpiar = *d++;
429 }
430 }
431 return sig;
432 }
433
434 /*
435 * type 0: fmovem
436 * Separated out of fpu_emul_type0 for efficiency.
437 * In this function, we know:
438 * (opcode & 0x01C0) == 0
439 * (word1 & 0x8000) == 0x8000
440 *
441 * No conversion or rounding is done by this instruction,
442 * and the FPSR is not affected.
443 */
444 static int
fpu_emul_fmovm(struct fpemu * fe,struct instruction * insn)445 fpu_emul_fmovm(struct fpemu *fe, struct instruction *insn)
446 {
447 struct frame *frame = fe->fe_frame;
448 struct fpframe *fpf = fe->fe_fpframe;
449 int word1, sig;
450 int reglist, regmask, regnum;
451 int modreg;
452 int fpu_to_mem, order;
453 /* int w1_post_incr; */
454 int *fpregs;
455
456 insn->is_datasize = 12;
457 word1 = insn->is_word1;
458
459 /* Bit 13 selects direction (FPU to/from Mem) */
460 fpu_to_mem = word1 & 0x2000;
461
462 /*
463 * Bits 12,11 select register list mode:
464 * 0,0: Static reg list, pre-decr.
465 * 0,1: Dynamic reg list, pre-decr.
466 * 1,0: Static reg list, post-incr.
467 * 1,1: Dynamic reg list, post-incr
468 */
469 /* w1_post_incr = word1 & 0x1000; */
470 if (word1 & 0x0800) {
471 /* dynamic reg list */
472 reglist = frame->f_regs[(word1 & 0x70) >> 4];
473 } else {
474 reglist = word1;
475 }
476 reglist &= 0xFF;
477
478 /* Check an illegal mod/reg. */
479 modreg = insn->is_opcode & 077;
480 if (fpu_to_mem) {
481 /* Dn, An, (An)+, PCrel, #imm are illegal. */
482 if (modreg < 020 || (modreg >> 3) == 3 || modreg >= 072) {
483 return SIGILL;
484 }
485 } else {
486 /* Dn, An, -(An), #imm are illegal. */
487 if (modreg < 020 || (modreg >> 3) == 4 || modreg >= 074) {
488 return SIGILL;
489 }
490 }
491
492 /* Get effective address. */
493 sig = fpu_decode_ea(frame, insn, &insn->is_ea, modreg);
494 if (sig)
495 return sig;
496
497 /* Get address of soft coprocessor regs. */
498 fpregs = &fpf->fpf_regs[0];
499
500 if (insn->is_ea.ea_flags & EA_PREDECR) {
501 regnum = 7;
502 order = -1;
503 } else {
504 regnum = 0;
505 order = 1;
506 }
507
508 regmask = 0x80;
509 while ((0 <= regnum) && (regnum < 8)) {
510 if (regmask & reglist) {
511 if (fpu_to_mem) {
512 sig = fpu_store_ea(frame, insn, &insn->is_ea,
513 (char *)&fpregs[regnum * 3]);
514 DPRINTF(("%s: FP%d (%08x,%08x,%08x) saved\n",
515 __func__, regnum,
516 fpregs[regnum * 3],
517 fpregs[regnum * 3 + 1],
518 fpregs[regnum * 3 + 2]));
519 } else { /* mem to fpu */
520 sig = fpu_load_ea(frame, insn, &insn->is_ea,
521 (char *)&fpregs[regnum * 3]);
522 DPRINTF(("%s: FP%d (%08x,%08x,%08x) loaded\n",
523 __func__, regnum,
524 fpregs[regnum * 3],
525 fpregs[regnum * 3 + 1],
526 fpregs[regnum * 3 + 2]));
527 }
528 if (sig)
529 break;
530 }
531 regnum += order;
532 regmask >>= 1;
533 }
534
535 return sig;
536 }
537
538 struct fpn *
fpu_cmp(struct fpemu * fe)539 fpu_cmp(struct fpemu *fe)
540 {
541 struct fpn *x = &fe->fe_f1, *y = &fe->fe_f2;
542
543 /* take care of special cases */
544 if (x->fp_class < 0 || y->fp_class < 0) {
545 /* if either of two is a SNAN, result is SNAN */
546 x->fp_class =
547 (y->fp_class < x->fp_class) ? y->fp_class : x->fp_class;
548 } else if (x->fp_class == FPC_INF) {
549 if (y->fp_class == FPC_INF) {
550 /* both infinities */
551 if (x->fp_sign == y->fp_sign) {
552 /* return a signed zero */
553 x->fp_class = FPC_ZERO;
554 } else {
555 /* return a faked number w/x's sign */
556 x->fp_class = FPC_NUM;
557 x->fp_exp = 16383;
558 x->fp_mant[0] = FP_1;
559 }
560 } else {
561 /* y is a number */
562 /* return a forged number w/x's sign */
563 x->fp_class = FPC_NUM;
564 x->fp_exp = 16383;
565 x->fp_mant[0] = FP_1;
566 }
567 } else if (y->fp_class == FPC_INF) {
568 /* x is a Num but y is an Inf */
569 /* return a forged number w/y's sign inverted */
570 x->fp_class = FPC_NUM;
571 x->fp_sign = !y->fp_sign;
572 x->fp_exp = 16383;
573 x->fp_mant[0] = FP_1;
574 } else {
575 /*
576 * x and y are both numbers or zeros,
577 * or pair of a number and a zero
578 */
579 y->fp_sign = !y->fp_sign;
580 x = fpu_add(fe); /* (x - y) */
581 /*
582 * FCMP does not set Inf bit in CC, so return a forged number
583 * (value doesn't matter) if Inf is the result of fsub.
584 */
585 if (x->fp_class == FPC_INF) {
586 x->fp_class = FPC_NUM;
587 x->fp_exp = 16383;
588 x->fp_mant[0] = FP_1;
589 }
590 }
591 return x;
592 }
593
594 /*
595 * arithmetic operations
596 */
597 static int
fpu_emul_arith(struct fpemu * fe,struct instruction * insn)598 fpu_emul_arith(struct fpemu *fe, struct instruction *insn)
599 {
600 struct frame *frame = fe->fe_frame;
601 uint32_t *fpregs = &(fe->fe_fpframe->fpf_regs[0]);
602 struct fpn *res;
603 int word1, sig = 0;
604 int regnum, format;
605 int modreg;
606 int discard_result = 0;
607 uint32_t buf[3];
608 #ifdef DEBUG_FPE
609 int flags;
610 char regname;
611 #endif
612
613 fe->fe_fpsr &= ~FPSR_EXCP;
614
615 DUMP_INSN(insn);
616
617 DPRINTF(("%s: FPSR = %08x, FPCR = %08x\n", __func__,
618 fe->fe_fpsr, fe->fe_fpcr));
619
620 word1 = insn->is_word1;
621 format = (word1 >> 10) & 7;
622 regnum = (word1 >> 7) & 7;
623
624 /* fetch a source operand : may not be used */
625 DPRINTF(("%s: dst/src FP%d=%08x,%08x,%08x\n", __func__,
626 regnum, fpregs[regnum * 3], fpregs[regnum * 3 + 1],
627 fpregs[regnum * 3 + 2]));
628
629 fpu_explode(fe, &fe->fe_f1, FTYPE_EXT, &fpregs[regnum * 3]);
630
631 DUMP_INSN(insn);
632
633 /* get the other operand which is always the source */
634 if ((word1 & 0x4000) == 0) {
635 DPRINTF(("%s: FP%d op FP%d => FP%d\n", __func__,
636 format, regnum, regnum));
637 DPRINTF(("%s: src opr FP%d=%08x,%08x,%08x\n", __func__,
638 format, fpregs[format * 3], fpregs[format * 3 + 1],
639 fpregs[format * 3 + 2]));
640 fpu_explode(fe, &fe->fe_f2, FTYPE_EXT, &fpregs[format * 3]);
641 } else {
642 /* the operand is in memory */
643 if (format == FTYPE_DBL) {
644 insn->is_datasize = 8;
645 } else if (format == FTYPE_SNG || format == FTYPE_LNG) {
646 insn->is_datasize = 4;
647 } else if (format == FTYPE_WRD) {
648 insn->is_datasize = 2;
649 } else if (format == FTYPE_BYT) {
650 insn->is_datasize = 1;
651 } else if (format == FTYPE_EXT) {
652 insn->is_datasize = 12;
653 } else {
654 /* invalid or unsupported operand format */
655 sig = SIGFPE;
656 return sig;
657 }
658
659 /* Check an illegal mod/reg. */
660 modreg = insn->is_opcode & 077;
661 if ((modreg >> 3) == 1/*An*/ || modreg >= 075) {
662 return SIGILL;
663 }
664
665 /* Get effective address. */
666 sig = fpu_decode_ea(frame, insn, &insn->is_ea, modreg);
667 if (sig) {
668 DPRINTF(("%s: error in fpu_decode_ea\n", __func__));
669 return sig;
670 }
671
672 if (insn->is_ea.ea_flags == EA_DIRECT &&
673 insn->is_datasize > 4) {
674 DPRINTF(("%s: attempted to fetch dbl/ext from reg\n",
675 __func__));
676 return SIGILL;
677 }
678
679 DUMP_INSN(insn);
680
681 #ifdef DEBUG_FPE
682 printf("%s: addr mode = ", __func__);
683 flags = insn->is_ea.ea_flags;
684 regname = (insn->is_ea.ea_regnum & 8) ? 'a' : 'd';
685
686 if (flags & EA_DIRECT) {
687 printf("%c%d\n", regname, insn->is_ea.ea_regnum & 7);
688 } else if (flags & EA_PC_REL) {
689 if (flags & EA_OFFSET) {
690 printf("pc@(%d)\n", insn->is_ea.ea_offset);
691 } else if (flags & EA_INDEXED) {
692 printf("pc@(...)\n");
693 }
694 } else if (flags & EA_PREDECR) {
695 printf("%c%d@-\n", regname, insn->is_ea.ea_regnum & 7);
696 } else if (flags & EA_POSTINCR) {
697 printf("%c%d@+\n", regname, insn->is_ea.ea_regnum & 7);
698 } else if (flags & EA_OFFSET) {
699 printf("%c%d@(%d)\n", regname,
700 insn->is_ea.ea_regnum & 7,
701 insn->is_ea.ea_offset);
702 } else if (flags & EA_INDEXED) {
703 printf("%c%d@(...)\n", regname,
704 insn->is_ea.ea_regnum & 7);
705 } else if (flags & EA_ABS) {
706 printf("0x%08x\n", insn->is_ea.ea_absaddr);
707 } else if (flags & EA_IMMED) {
708 printf("#0x%08x,%08x,%08x\n",
709 insn->is_ea.ea_immed[0],
710 insn->is_ea.ea_immed[1],
711 insn->is_ea.ea_immed[2]);
712 } else {
713 printf("%c%d@\n", regname, insn->is_ea.ea_regnum & 7);
714 }
715 #endif /* DEBUG_FPE */
716
717 fpu_load_ea(frame, insn, &insn->is_ea, (char*)buf);
718 if (format == FTYPE_WRD) {
719 /* sign-extend */
720 buf[0] &= 0xffff;
721 if (buf[0] & 0x8000)
722 buf[0] |= 0xffff0000;
723 format = FTYPE_LNG;
724 } else if (format == FTYPE_BYT) {
725 /* sign-extend */
726 buf[0] &= 0xff;
727 if (buf[0] & 0x80)
728 buf[0] |= 0xffffff00;
729 format = FTYPE_LNG;
730 }
731 DPRINTF(("%s: src = %08x %08x %08x, siz = %d\n", __func__,
732 buf[0], buf[1], buf[2], insn->is_datasize));
733 fpu_explode(fe, &fe->fe_f2, format, buf);
734 }
735
736 DUMP_INSN(insn);
737
738 /*
739 * An arithmetic instruction emulate function has a prototype of
740 * struct fpn *fpu_op(struct fpemu *);
741 *
742 * 1) If the instruction is monadic, then fpu_op() must use
743 * fe->fe_f2 as its operand, and return a pointer to the
744 * result.
745 *
746 * 2) If the instruction is diadic, then fpu_op() must use
747 * fe->fe_f1 and fe->fe_f2 as its two operands, and return a
748 * pointer to the result.
749 *
750 */
751 res = NULL;
752 switch (word1 & 0x7f) {
753 case 0x00: /* fmove */
754 res = &fe->fe_f2;
755 break;
756
757 case 0x01: /* fint */
758 res = fpu_int(fe);
759 break;
760
761 case 0x02: /* fsinh */
762 res = fpu_sinh(fe);
763 break;
764
765 case 0x03: /* fintrz */
766 res = fpu_intrz(fe);
767 break;
768
769 case 0x04: /* fsqrt */
770 res = fpu_sqrt(fe);
771 break;
772
773 case 0x06: /* flognp1 */
774 res = fpu_lognp1(fe);
775 break;
776
777 case 0x08: /* fetoxm1 */
778 res = fpu_etoxm1(fe);
779 break;
780
781 case 0x09: /* ftanh */
782 res = fpu_tanh(fe);
783 break;
784
785 case 0x0A: /* fatan */
786 res = fpu_atan(fe);
787 break;
788
789 case 0x0C: /* fasin */
790 res = fpu_asin(fe);
791 break;
792
793 case 0x0D: /* fatanh */
794 res = fpu_atanh(fe);
795 break;
796
797 case 0x0E: /* fsin */
798 res = fpu_sin(fe);
799 break;
800
801 case 0x0F: /* ftan */
802 res = fpu_tan(fe);
803 break;
804
805 case 0x10: /* fetox */
806 res = fpu_etox(fe);
807 break;
808
809 case 0x11: /* ftwotox */
810 res = fpu_twotox(fe);
811 break;
812
813 case 0x12: /* ftentox */
814 res = fpu_tentox(fe);
815 break;
816
817 case 0x14: /* flogn */
818 res = fpu_logn(fe);
819 break;
820
821 case 0x15: /* flog10 */
822 res = fpu_log10(fe);
823 break;
824
825 case 0x16: /* flog2 */
826 res = fpu_log2(fe);
827 break;
828
829 case 0x18: /* fabs */
830 fe->fe_f2.fp_sign = 0;
831 res = &fe->fe_f2;
832 break;
833
834 case 0x19: /* fcosh */
835 res = fpu_cosh(fe);
836 break;
837
838 case 0x1A: /* fneg */
839 fe->fe_f2.fp_sign = !fe->fe_f2.fp_sign;
840 res = &fe->fe_f2;
841 break;
842
843 case 0x1C: /* facos */
844 res = fpu_acos(fe);
845 break;
846
847 case 0x1D: /* fcos */
848 res = fpu_cos(fe);
849 break;
850
851 case 0x1E: /* fgetexp */
852 res = fpu_getexp(fe);
853 break;
854
855 case 0x1F: /* fgetman */
856 res = fpu_getman(fe);
857 break;
858
859 case 0x20: /* fdiv */
860 case 0x24: /* fsgldiv: cheating - better than nothing */
861 res = fpu_div(fe);
862 break;
863
864 case 0x21: /* fmod */
865 res = fpu_mod(fe);
866 break;
867
868 case 0x28: /* fsub */
869 fe->fe_f2.fp_sign = !fe->fe_f2.fp_sign; /* f2 = -f2 */
870 /* FALLTHROUGH */
871 case 0x22: /* fadd */
872 res = fpu_add(fe);
873 break;
874
875 case 0x23: /* fmul */
876 case 0x27: /* fsglmul: cheating - better than nothing */
877 res = fpu_mul(fe);
878 break;
879
880 case 0x25: /* frem */
881 res = fpu_rem(fe);
882 break;
883
884 case 0x26:
885 /* fscale is handled by a separate function */
886 break;
887
888 case 0x30:
889 case 0x31:
890 case 0x32:
891 case 0x33:
892 case 0x34:
893 case 0x35:
894 case 0x36:
895 case 0x37: /* fsincos */
896 res = fpu_sincos(fe, word1 & 7);
897 break;
898
899 case 0x38: /* fcmp */
900 res = fpu_cmp(fe);
901 discard_result = 1;
902 break;
903
904 case 0x3A: /* ftst */
905 res = &fe->fe_f2;
906 discard_result = 1;
907 break;
908
909 default: /* possibly 040/060 instructions */
910 DPRINTF(("%s: bad opcode=0x%x, word1=0x%x\n", __func__,
911 insn->is_opcode, insn->is_word1));
912 sig = SIGILL;
913 }
914
915 /* for sanity */
916 if (res == NULL)
917 sig = SIGILL;
918
919 if (sig == 0) {
920 if (!discard_result)
921 fpu_implode(fe, res, FTYPE_EXT, &fpregs[regnum * 3]);
922
923 /* update fpsr according to the result of operation */
924 fpu_upd_fpsr(fe, res);
925 #ifdef DEBUG_FPE
926 if (!discard_result) {
927 printf("%s: %08x,%08x,%08x stored in FP%d\n", __func__,
928 fpregs[regnum * 3],
929 fpregs[regnum * 3 + 1],
930 fpregs[regnum * 3 + 2],
931 regnum);
932 } else {
933 static const char *class_name[] =
934 { "SNAN", "QNAN", "ZERO", "NUM", "INF" };
935 printf("%s: result(%s,%c,%d,%08x,%08x,%08x) "
936 "discarded\n", __func__,
937 class_name[res->fp_class + 2],
938 res->fp_sign ? '-' : '+', res->fp_exp,
939 res->fp_mant[0], res->fp_mant[1],
940 res->fp_mant[2]);
941 }
942 #endif
943 } else {
944 DPRINTF(("%s: received signal %d\n", __func__, sig));
945 }
946
947 DPRINTF(("%s: FPSR = %08x, FPCR = %08x\n", __func__,
948 fe->fe_fpsr, fe->fe_fpcr));
949
950 DUMP_INSN(insn);
951
952 return sig;
953 }
954
955 /*
956 * test condition code according to the predicate in the opcode.
957 * returns -1 when the predicate evaluates to true, 0 when false.
958 * signal numbers are returned when an error is detected.
959 */
960 static int
test_cc(struct fpemu * fe,int pred)961 test_cc(struct fpemu *fe, int pred)
962 {
963 int result, sig_bsun;
964 int fpsr;
965
966 fpsr = fe->fe_fpsr;
967 DPRINTF(("%s: fpsr=0x%08x\n", __func__, fpsr));
968 pred &= 0x3f; /* lowest 6 bits */
969
970 DPRINTF(("%s: ", __func__));
971
972 if (pred >= 0x20) {
973 DPRINTF(("Illegal condition code\n"));
974 return SIGILL;
975 } else if (pred & 0x10) {
976 /* IEEE nonaware tests */
977 sig_bsun = 1;
978 pred &= 0x0f; /* lower 4 bits */
979 } else {
980 /* IEEE aware tests */
981 DPRINTF(("IEEE "));
982 sig_bsun = 0;
983 }
984
985 /*
986 * condition real 68882
987 * mnemonic in manual condition
988 * -------- ---------- ----------
989 * 0000 F 0 <- = ~NAN & 0 & ~Z | 0
990 * 0001 EQ Z <- = ~NAN & 0 | Z | 0
991 * 0010 OGT ~(NAN|Z|N) <- = ~NAN & ~N & ~Z | 0
992 * 0011 OGE Z|~(NAN|N) <- = ~NAN & ~N | Z | 0
993 * 0100 OLT N&~(NAN|Z) <- = ~NAN & N & ~Z | 0
994 * 0101 OLE Z|(N&~NAN) <- = ~NAN & N | Z | 0
995 * 0110 OGL ~(NAN|Z) <- = ~NAN & 1 & ~Z | 0
996 * 0111 OR ~NAN Z|~NAN = ~NAN & 1 | Z | 0
997 *
998 * 1000 UN NAN <- = 1 & 0 & ~Z | NAN
999 * 1001 UEQ NAN|Z <- = 1 & 0 | Z | NAN
1000 * 1010 UGT NAN|~(N|Z) <- = 1 & ~N & ~Z | NAN
1001 * 1011 UGE NAN|(Z|~N) <- = 1 & ~N | Z | NAN
1002 * 1100 ULT NAN|(N&~Z) <- = 1 & N & ~Z | NAN
1003 * 1101 ULE NAN|(Z|N) <- = 1 & N | Z | NAN
1004 * 1110 NE ~Z NAN|(~Z) = 1 & 1 & ~Z | NAN
1005 * 1111 T 1 <- = 1 & 1 | Z | NAN
1006 */
1007 if ((pred & 0x08) == 0) {
1008 result = ((fpsr & FPSR_NAN) == 0);
1009 } else {
1010 result = 1;
1011 }
1012 switch (pred & 0x06) {
1013 case 0x00: /* AND 0 */
1014 result &= 0;
1015 break;
1016 case 0x02: /* AND ~N */
1017 result &= ((fpsr & FPSR_NEG) == 0);
1018 break;
1019 case 0x04: /* AND N */
1020 result &= ((fpsr & FPSR_NEG) != 0);
1021 break;
1022 case 0x06: /* AND 1 */
1023 result &= 1;
1024 break;
1025 }
1026 if ((pred & 0x01) == 0) {
1027 result &= ((fpsr & FPSR_ZERO) == 0);
1028 } else {
1029 result |= ((fpsr & FPSR_ZERO) != 0);
1030 }
1031 if ((pred & 0x08) != 0) {
1032 result |= ((fpsr & FPSR_NAN) != 0);
1033 }
1034
1035 DPRINTF(("=> %s (%d)\n", result ? "true" : "false", result));
1036 /* if it's an IEEE unaware test and NAN is set, BSUN is set */
1037 if (sig_bsun && (fpsr & FPSR_NAN)) {
1038 fpsr |= FPSR_BSUN;
1039 }
1040 /* if BSUN is set, IOP is set too */
1041 if ((fpsr & FPSR_BSUN)) {
1042 fpsr |= FPSR_AIOP;
1043 }
1044
1045 /* put fpsr back */
1046 fe->fe_fpframe->fpf_fpsr = fe->fe_fpsr = fpsr;
1047
1048 return -result;
1049 }
1050
1051 /*
1052 * type 1: fdbcc, fscc, ftrapcc
1053 * In this function, we know:
1054 * (opcode & 0x01C0) == 0x0040
1055 * return SIGILL for an illegal instruction.
1056 * return SIGFPE if FTRAPcc's condition is met.
1057 */
1058 static int
fpu_emul_type1(struct fpemu * fe,struct instruction * insn)1059 fpu_emul_type1(struct fpemu *fe, struct instruction *insn)
1060 {
1061 struct frame *frame = fe->fe_frame;
1062 int advance, sig, branch, displ;
1063 unsigned short sval;
1064
1065 branch = test_cc(fe, insn->is_word1);
1066 if (branch > 0)
1067 return branch;
1068 fe->fe_fpframe->fpf_fpsr = fe->fe_fpsr;
1069
1070 sig = 0;
1071 switch (insn->is_opcode & 070) {
1072 case 010: /* fdbcc */
1073 if (branch) {
1074 /* advance */
1075 insn->is_advance = 6;
1076 } else {
1077 /* decrement Dn and if (Dn != -1) branch */
1078 uint16_t count = frame->f_regs[insn->is_opcode & 7];
1079
1080 if (count-- != 0) {
1081 if (ufetch_short((void *)(insn->is_pc +
1082 insn->is_advance),
1083 &sval)) {
1084 DPRINTF(("%s: fault reading "
1085 "displacement\n", __func__));
1086 return SIGSEGV;
1087 }
1088 displ = sval;
1089 /* sign-extend the displacement */
1090 displ &= 0xffff;
1091 if (displ & 0x8000) {
1092 displ |= 0xffff0000;
1093 }
1094 insn->is_advance += displ;
1095 #if 0 /* XXX */
1096 insn->is_nextpc = insn->is_pc +
1097 insn->is_advance;
1098 #endif
1099 } else {
1100 insn->is_advance = 6;
1101 }
1102 /* write it back */
1103 frame->f_regs[insn->is_opcode & 7] &= 0xffff0000;
1104 frame->f_regs[insn->is_opcode & 7] |= (uint32_t)count;
1105 }
1106 break;
1107
1108 case 070: /* ftrapcc or fscc */
1109 advance = 4;
1110 if ((insn->is_opcode & 07) >= 2) {
1111 switch (insn->is_opcode & 07) {
1112 case 3: /* long opr */
1113 advance += 2;
1114 case 2: /* word opr */
1115 advance += 2;
1116 case 4: /* no opr */
1117 break;
1118 default:
1119 return SIGILL;
1120 break;
1121 }
1122 insn->is_advance = advance;
1123
1124 if (branch) {
1125 /* trap */
1126 sig = SIGFPE;
1127 }
1128 break;
1129 }
1130
1131 /* FALLTHROUGH */
1132 default: /* fscc */
1133 insn->is_datasize = 1; /* always byte */
1134 sig = fpu_decode_ea(frame, insn, &insn->is_ea, insn->is_opcode);
1135 if (sig) {
1136 break;
1137 }
1138 /* set result */
1139 sig = fpu_store_ea(frame, insn, &insn->is_ea, (char *)&branch);
1140 break;
1141 }
1142 return sig;
1143 }
1144
1145 /*
1146 * Type 2 or 3: fbcc (also fnop)
1147 * In this function, we know:
1148 * (opcode & 0x0180) == 0x0080
1149 */
1150 static int
fpu_emul_brcc(struct fpemu * fe,struct instruction * insn)1151 fpu_emul_brcc(struct fpemu *fe, struct instruction *insn)
1152 {
1153 int displ, word2;
1154 int sig;
1155 unsigned short sval;
1156
1157 /*
1158 * Get branch displacement.
1159 */
1160 displ = insn->is_word1;
1161
1162 if (insn->is_opcode & 0x40) {
1163 if (ufetch_short((void *)(insn->is_pc + insn->is_advance),
1164 &sval)) {
1165 DPRINTF(("%s: fault reading word2\n", __func__));
1166 return SIGSEGV;
1167 }
1168 word2 = sval;
1169 displ <<= 16;
1170 displ |= word2;
1171 insn->is_advance += 2;
1172 } else {
1173 /* displacement is word sized */
1174 if (displ & 0x8000)
1175 displ |= 0xFFFF0000;
1176 }
1177
1178 /* XXX: If CC, insn->is_pc += displ */
1179 sig = test_cc(fe, insn->is_opcode);
1180 fe->fe_fpframe->fpf_fpsr = fe->fe_fpsr;
1181
1182 if (fe->fe_fpsr & fe->fe_fpcr & FPSR_EXCP) {
1183 return SIGFPE; /* caught an exception */
1184 }
1185 if (sig == -1) {
1186 /*
1187 * branch does take place; 2 is the offset to the 1st disp word
1188 */
1189 insn->is_advance = displ + 2;
1190 #if 0 /* XXX */
1191 insn->is_nextpc = insn->is_pc + insn->is_advance;
1192 #endif
1193 } else if (sig)
1194 return SIGILL; /* got a signal */
1195 DPRINTF(("%s: %s insn @ %x (%x+%x) (disp=%x)\n", __func__,
1196 (sig == -1) ? "BRANCH to" : "NEXT",
1197 insn->is_pc + insn->is_advance, insn->is_pc, insn->is_advance,
1198 displ));
1199 return 0;
1200 }
1201