xref: /titanic_44/usr/src/uts/sparc/v9/os/simulator.c (revision d291d9f21e8c0417aec99de243dd48bc400002d0)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 /* common code with bug fixes from original version in trap.c */
30 
31 #include <sys/param.h>
32 #include <sys/types.h>
33 #include <sys/systm.h>
34 #include <sys/archsystm.h>
35 #include <sys/vmsystm.h>
36 #include <sys/fpu/fpusystm.h>
37 #include <sys/fpu/fpu_simulator.h>
38 #include <sys/inline.h>
39 #include <sys/debug.h>
40 #include <sys/privregs.h>
41 #include <sys/machpcb.h>
42 #include <sys/simulate.h>
43 #include <sys/proc.h>
44 #include <sys/cmn_err.h>
45 #include <sys/stack.h>
46 #include <sys/watchpoint.h>
47 #include <sys/trap.h>
48 #include <sys/machtrap.h>
49 #include <sys/mman.h>
50 #include <sys/asi.h>
51 #include <sys/copyops.h>
52 #include <vm/as.h>
53 #include <vm/page.h>
54 #include <sys/model.h>
55 #include <vm/seg_vn.h>
56 #include <sys/byteorder.h>
57 
58 #define	IS_IBIT_SET(x)	(x & 0x2000)
59 #define	IS_VIS1(op, op3)(op == 2 && op3 == 0x36)
60 #define	IS_PARTIAL_OR_SHORT_FLOAT_LD_ST(op, op3, asi)		\
61 		(op == 3 && (op3 == IOP_V8_LDDFA ||		\
62 		op3 == IOP_V8_STDFA) &&	asi > ASI_SNFL)
63 
64 static int aligndebug = 0;
65 
66 /*
67  * For the sake of those who must be compatible with unaligned
68  * architectures, users can link their programs to use a
69  * corrective trap handler that will fix unaligned references
70  * a special trap #6 (T_FIX_ALIGN) enables this 'feature'.
71  * Returns 1 for success, 0 for failure.
72  */
73 
74 int
75 do_unaligned(struct regs *rp, caddr_t *badaddr)
76 {
77 	uint_t	inst, op3, asi = 0;
78 	uint_t	rd, rs1, rs2;
79 	int	sz, nf = 0, ltlend = 0;
80 	int	floatflg;
81 	int	fsrflg;
82 	int	immflg;
83 	int	lddstdflg;
84 	caddr_t	addr;
85 	uint64_t val;
86 	union {
87 		uint64_t	l[2];
88 		uint32_t	i[4];
89 		uint16_t	s[8];
90 		uint8_t		c[16];
91 	} data;
92 
93 	ASSERT(USERMODE(rp->r_tstate));
94 	inst = fetch_user_instr((caddr_t)rp->r_pc);
95 
96 	op3 = (inst >> 19) & 0x3f;
97 	rd = (inst >> 25) & 0x1f;
98 	rs1 = (inst >> 14) & 0x1f;
99 	rs2 = inst & 0x1f;
100 	floatflg = (inst >> 24) & 1;
101 	immflg = (inst >> 13) & 1;
102 	lddstdflg = fsrflg = 0;
103 
104 	/* if not load or store do nothing */
105 	if ((inst >> 30) != 3)
106 		return (0);
107 
108 	/* if ldstub or swap, do nothing */
109 	if ((inst & 0xc1680000) == 0xc0680000)
110 		return (0);
111 
112 	/* if cas/casx, do nothing */
113 	if ((inst & 0xc1e00000) == 0xc1e00000)
114 		return (0);
115 
116 	if (floatflg) {
117 		switch ((inst >> 19) & 3) {	/* map size bits to a number */
118 		case 0: sz = 4;
119 			break;			/* ldf{a}/stf{a} */
120 		case 1: fsrflg = 1;
121 			if (rd == 0)
122 				sz = 4;		/* ldfsr/stfsr */
123 			else  if (rd == 1)
124 				sz = 8;		/* ldxfsr/stxfsr */
125 			else
126 				return (SIMU_ILLEGAL);
127 			break;
128 		case 2: sz = 16;
129 			break;		/* ldqf{a}/stqf{a} */
130 		case 3: sz = 8;
131 			break;		/* lddf{a}/stdf{a} */
132 		}
133 		/*
134 		 * Fix to access extra double register encoding plus
135 		 * compensate to access the correct fpu_dreg.
136 		 */
137 		if ((sz > 4) && (fsrflg == 0)) {
138 			if ((rd & 1) == 1)
139 				rd = (rd & 0x1e) | 0x20;
140 			rd = rd >> 1;
141 			if ((sz == 16) && ((rd & 0x1) != 0))
142 				return (SIMU_ILLEGAL);
143 		}
144 	} else {
145 		int sz_bits = (inst >> 19) & 0xf;
146 		switch (sz_bits) {		/* map size bits to a number */
147 		case 0:				/* lduw{a} */
148 		case 4:				/* stw{a} */
149 		case 8:				/* ldsw{a} */
150 		case 0xf:			/* swap */
151 			sz = 4; break;
152 		case 1:				/* ldub{a} */
153 		case 5:				/* stb{a} */
154 		case 9:				/* ldsb{a} */
155 		case 0xd:			/* ldstub */
156 			sz = 1; break;
157 		case 2:				/* lduh{a} */
158 		case 6:				/* sth{a} */
159 		case 0xa:			/* ldsh{a} */
160 			sz = 2; break;
161 		case 3:				/* ldd{a} */
162 		case 7:				/* std{a} */
163 			lddstdflg = 1;
164 			sz = 8; break;
165 		case 0xb:			/* ldx{a} */
166 		case 0xe:			/* stx{a} */
167 			sz = 8; break;
168 		}
169 	}
170 
171 
172 	/* only support primary and secondary asi's */
173 	if ((op3 >> 4) & 1) {
174 		if (immflg) {
175 			asi = (uint_t)(rp->r_tstate >> TSTATE_ASI_SHIFT) &
176 					TSTATE_ASI_MASK;
177 		} else {
178 			asi = (inst >> 5) & 0xff;
179 		}
180 		switch (asi) {
181 		case ASI_P:
182 		case ASI_S:
183 			break;
184 		case ASI_PNF:
185 		case ASI_SNF:
186 			nf = 1;
187 			break;
188 		case ASI_PL:
189 		case ASI_SL:
190 			ltlend = 1;
191 			break;
192 		case ASI_PNFL:
193 		case ASI_SNFL:
194 			ltlend = 1;
195 			nf = 1;
196 			break;
197 		default:
198 			return (0);
199 		}
200 		/*
201 		 * Non-faulting stores generate a data_access_exception trap,
202 		 * according to the Spitfire manual, which should be signaled
203 		 * as an illegal instruction trap, because it can't be fixed.
204 		 */
205 		if ((nf) && ((op3 == IOP_V8_STQFA) || (op3 == IOP_V8_STDFA)))
206 			return (SIMU_ILLEGAL);
207 	}
208 
209 	if (aligndebug) {
210 		printf("unaligned access at %p, instruction: 0x%x\n",
211 		    (void *)rp->r_pc, inst);
212 		printf("type %s", (((inst >> 21) & 1) ? "st" : "ld"));
213 		if (((inst >> 21) & 1) == 0)
214 		    printf(" %s", (((inst >> 22) & 1) ? "signed" : "unsigned"));
215 		printf(" asi 0x%x size %d immflg %d\n", asi, sz, immflg);
216 		printf("rd = %d, op3 = 0x%x, rs1 = %d, rs2 = %d, imm13=0x%x\n",
217 			rd, op3, rs1, rs2, (inst & 0x1fff));
218 	}
219 
220 	(void) flush_user_windows_to_stack(NULL);
221 	if (getreg(rp, rs1, &val, badaddr))
222 		return (SIMU_FAULT);
223 	addr = (caddr_t)val;		/* convert to 32/64 bit address */
224 	if (aligndebug)
225 		printf("addr 1 = %p\n", (void *)addr);
226 
227 	/* check immediate bit and use immediate field or reg (rs2) */
228 	if (immflg) {
229 		int imm;
230 		imm  = inst & 0x1fff;		/* mask out immediate field */
231 		imm <<= 19;			/* sign extend it */
232 		imm >>= 19;
233 		addr += imm;			/* compute address */
234 	} else {
235 		if (getreg(rp, rs2, &val, badaddr))
236 			return (SIMU_FAULT);
237 		addr += val;
238 	}
239 
240 	/*
241 	 * If this is a 32-bit program, chop the address accordingly.
242 	 */
243 	if (curproc->p_model == DATAMODEL_ILP32)
244 		addr = (caddr_t)(caddr32_t)addr;
245 
246 	if (aligndebug)
247 		printf("addr 2 = %p\n", (void *)addr);
248 
249 	if (addr >= curproc->p_as->a_userlimit) {
250 		*badaddr = addr;
251 		goto badret;
252 	}
253 
254 	/* a single bit differentiates ld and st */
255 	if ((inst >> 21) & 1) {			/* store */
256 		if (floatflg) {
257 			klwp_id_t lwp = ttolwp(curthread);
258 			kfpu_t *fp = lwptofpu(lwp);
259 			/* Ensure fp has been enabled */
260 			if (fpu_exists) {
261 				if (!(_fp_read_fprs() & FPRS_FEF))
262 					fp_enable();
263 			} else {
264 				if (!fp->fpu_en)
265 					fp_enable();
266 			}
267 			/* if fpu_exists read fpu reg */
268 			if (fpu_exists) {
269 				if (fsrflg) {
270 					_fp_read_pfsr(&data.l[0]);
271 				} else {
272 					if (sz == 4) {
273 						data.i[0] = 0;
274 						_fp_read_pfreg(
275 						    (unsigned *)&data.i[1], rd);
276 					}
277 					if (sz >= 8)
278 						_fp_read_pdreg(
279 							&data.l[0], rd);
280 					if (sz == 16)
281 						_fp_read_pdreg(
282 							&data.l[1], rd+1);
283 				}
284 			} else {
285 				if (fsrflg) {
286 					/* Clear reserved bits, set version=7 */
287 					fp->fpu_fsr &= ~0x30301000;
288 					fp->fpu_fsr |= 0xE0000;
289 					data.l[0] = fp->fpu_fsr;
290 				} else {
291 					if (sz == 4) {
292 						data.i[0] = 0;
293 						data.i[1] =
294 					    (unsigned)fp->fpu_fr.fpu_regs[rd];
295 					}
296 					if (sz >= 8)
297 						data.l[0] =
298 						    fp->fpu_fr.fpu_dregs[rd];
299 					if (sz == 16)
300 						data.l[1] =
301 						    fp->fpu_fr.fpu_dregs[rd+1];
302 				}
303 			}
304 		} else {
305 			if (lddstdflg) {		/* combine the data */
306 				if (getreg(rp, rd, &data.l[0], badaddr))
307 					return (SIMU_FAULT);
308 				if (getreg(rp, rd+1, &data.l[1], badaddr))
309 					return (SIMU_FAULT);
310 				if (ltlend) {
311 					/*
312 					 * For STD, each 32-bit word is byte-
313 					 * swapped individually.  For
314 					 * simplicity we don't want to do that
315 					 * below, so we swap the words now to
316 					 * get the desired result in the end.
317 					 */
318 					data.i[0] = data.i[3];
319 				} else {
320 					data.i[0] = data.i[1];
321 					data.i[1] = data.i[3];
322 				}
323 			} else {
324 				if (getreg(rp, rd, &data.l[0], badaddr))
325 					return (SIMU_FAULT);
326 			}
327 		}
328 
329 		if (aligndebug) {
330 			if (sz == 16) {
331 				printf("data %x %x %x %x\n",
332 				    data.i[0], data.i[1], data.i[2], data.c[3]);
333 			} else {
334 				printf("data %x %x %x %x %x %x %x %x\n",
335 				    data.c[0], data.c[1], data.c[2], data.c[3],
336 				    data.c[4], data.c[5], data.c[6], data.c[7]);
337 			}
338 		}
339 
340 		if (ltlend) {
341 			if (sz == 1) {
342 				if (xcopyout_little(&data.c[7], addr,
343 				    (size_t)sz) != 0)
344 					goto badret;
345 			} else if (sz == 2) {
346 				if (xcopyout_little(&data.s[3], addr,
347 				    (size_t)sz) != 0)
348 					goto badret;
349 			} else if (sz == 4) {
350 				if (xcopyout_little(&data.i[1], addr,
351 				    (size_t)sz) != 0)
352 					goto badret;
353 			} else {
354 				if (xcopyout_little(&data.l[0], addr,
355 				    (size_t)sz) != 0)
356 					goto badret;
357 			}
358 		} else {
359 			if (sz == 1) {
360 				if (copyout(&data.c[7], addr, (size_t)sz) == -1)
361 					goto badret;
362 			} else if (sz == 2) {
363 				if (copyout(&data.s[3], addr, (size_t)sz) == -1)
364 					goto badret;
365 			} else if (sz == 4) {
366 				if (copyout(&data.i[1], addr, (size_t)sz) == -1)
367 					goto badret;
368 			} else {
369 				if (copyout(&data.l[0], addr, (size_t)sz) == -1)
370 					goto badret;
371 			}
372 		}
373 	} else {				/* load */
374 		if (sz == 1) {
375 			if (ltlend) {
376 				if (xcopyin_little(addr, &data.c[7],
377 				    (size_t)sz) != 0) {
378 					if (nf)
379 						data.c[7] = 0;
380 					else
381 						goto badret;
382 				}
383 			} else {
384 				if (copyin(addr, &data.c[7],
385 				    (size_t)sz) == -1) {
386 					if (nf)
387 						data.c[7] = 0;
388 					else
389 						goto badret;
390 				}
391 			}
392 			/* if signed and the sign bit is set extend it */
393 			if (((inst >> 22) & 1) && ((data.c[7] >> 7) & 1)) {
394 				data.i[0] = (uint_t)-1;	/* extend sign bit */
395 				data.s[2] = (ushort_t)-1;
396 				data.c[6] = (uchar_t)-1;
397 			} else {
398 				data.i[0] = 0;	/* clear upper 32+24 bits */
399 				data.s[2] = 0;
400 				data.c[6] = 0;
401 			}
402 		} else if (sz == 2) {
403 			if (ltlend) {
404 				if (xcopyin_little(addr, &data.s[3],
405 				    (size_t)sz) != 0) {
406 					if (nf)
407 						data.s[3] = 0;
408 					else
409 						goto badret;
410 				}
411 			} else {
412 				if (copyin(addr, &data.s[3],
413 				    (size_t)sz) == -1) {
414 					if (nf)
415 						data.s[3] = 0;
416 					else
417 						goto badret;
418 				}
419 			}
420 			/* if signed and the sign bit is set extend it */
421 			if (((inst >> 22) & 1) && ((data.s[3] >> 15) & 1)) {
422 				data.i[0] = (uint_t)-1;	/* extend sign bit */
423 				data.s[2] = (ushort_t)-1;
424 			} else {
425 				data.i[0] = 0;	/* clear upper 32+16 bits */
426 				data.s[2] = 0;
427 			}
428 		} else if (sz == 4) {
429 			if (ltlend) {
430 				if (xcopyin_little(addr, &data.i[1],
431 				    (size_t)sz) != 0) {
432 					if (!nf)
433 						goto badret;
434 					data.i[1] = 0;
435 				}
436 			} else {
437 				if (copyin(addr, &data.i[1],
438 				    (size_t)sz) == -1) {
439 					if (!nf)
440 						goto badret;
441 					data.i[1] = 0;
442 				}
443 			}
444 			/* if signed and the sign bit is set extend it */
445 			if (((inst >> 22) & 1) && ((data.i[1] >> 31) & 1)) {
446 				data.i[0] = (uint_t)-1;	/* extend sign bit */
447 			} else {
448 				data.i[0] = 0;	/* clear upper 32 bits */
449 			}
450 		} else {
451 			if (ltlend) {
452 				if (xcopyin_little(addr, &data.l[0],
453 				    (size_t)sz) != 0) {
454 					if (!nf)
455 						goto badret;
456 					data.l[0] = 0;
457 				}
458 			} else {
459 				if (copyin(addr, &data.l[0],
460 				    (size_t)sz) == -1) {
461 					if (!nf)
462 						goto badret;
463 					data.l[0] = 0;
464 				}
465 			}
466 		}
467 
468 		if (aligndebug) {
469 			if (sz == 16) {
470 				printf("data %x %x %x %x\n",
471 				    data.i[0], data.i[1], data.i[2], data.c[3]);
472 			} else {
473 				printf("data %x %x %x %x %x %x %x %x\n",
474 				    data.c[0], data.c[1], data.c[2], data.c[3],
475 				    data.c[4], data.c[5], data.c[6], data.c[7]);
476 			}
477 		}
478 
479 		if (floatflg) {		/* if fpu_exists write fpu reg */
480 			klwp_id_t lwp = ttolwp(curthread);
481 			kfpu_t *fp = lwptofpu(lwp);
482 			/* Ensure fp has been enabled */
483 			if (fpu_exists) {
484 				if (!(_fp_read_fprs() & FPRS_FEF))
485 					fp_enable();
486 			} else {
487 				if (!fp->fpu_en)
488 					fp_enable();
489 			}
490 			/* if fpu_exists read fpu reg */
491 			if (fpu_exists) {
492 				if (fsrflg) {
493 					_fp_write_pfsr(&data.l[0]);
494 				} else {
495 					if (sz == 4)
496 						_fp_write_pfreg(
497 						    (unsigned *)&data.i[1], rd);
498 					if (sz >= 8)
499 						_fp_write_pdreg(
500 							&data.l[0], rd);
501 					if (sz == 16)
502 						_fp_write_pdreg(
503 							&data.l[1], rd+1);
504 				}
505 			} else {
506 				if (fsrflg) {
507 					fp->fpu_fsr = data.l[0];
508 				} else {
509 					if (sz == 4)
510 						fp->fpu_fr.fpu_regs[rd] =
511 							(unsigned)data.i[1];
512 					if (sz >= 8)
513 						fp->fpu_fr.fpu_dregs[rd] =
514 							data.l[0];
515 					if (sz == 16)
516 						fp->fpu_fr.fpu_dregs[rd+1] =
517 							data.l[1];
518 				}
519 			}
520 		} else {
521 			if (lddstdflg) {		/* split the data */
522 				if (ltlend) {
523 					/*
524 					 * For LDD, each 32-bit word is byte-
525 					 * swapped individually.  We didn't
526 					 * do that above, but this will give
527 					 * us the desired result.
528 					 */
529 					data.i[3] = data.i[0];
530 				} else {
531 					data.i[3] = data.i[1];
532 					data.i[1] = data.i[0];
533 				}
534 				data.i[0] = 0;
535 				data.i[2] = 0;
536 				if (putreg(&data.l[0], rp, rd, badaddr) == -1)
537 					goto badret;
538 				if (putreg(&data.l[1], rp, rd+1, badaddr) == -1)
539 					goto badret;
540 			} else {
541 				if (putreg(&data.l[0], rp, rd, badaddr) == -1)
542 					goto badret;
543 			}
544 		}
545 	}
546 	return (SIMU_SUCCESS);
547 badret:
548 	return (SIMU_FAULT);
549 }
550 
551 
552 int
553 simulate_lddstd(struct regs *rp, caddr_t *badaddr)
554 {
555 	uint_t	inst, op3, asi = 0;
556 	uint_t	rd, rs1, rs2;
557 	int	nf = 0, ltlend = 0, usermode;
558 	int	immflg;
559 	uint64_t reven;
560 	uint64_t rodd;
561 	caddr_t	addr;
562 	uint64_t val;
563 	uint64_t data;
564 
565 	usermode = USERMODE(rp->r_tstate);
566 
567 	if (usermode)
568 		inst = fetch_user_instr((caddr_t)rp->r_pc);
569 	else
570 		inst = *(uint_t *)rp->r_pc;
571 
572 	op3 = (inst >> 19) & 0x3f;
573 	rd = (inst >> 25) & 0x1f;
574 	rs1 = (inst >> 14) & 0x1f;
575 	rs2 = inst & 0x1f;
576 	immflg = (inst >> 13) & 1;
577 
578 	if (USERMODE(rp->r_tstate))
579 		(void) flush_user_windows_to_stack(NULL);
580 	else
581 		flush_windows();
582 
583 	if ((op3 >> 4) & 1) {		/* is this LDDA/STDA? */
584 		if (immflg) {
585 			asi = (uint_t)(rp->r_tstate >> TSTATE_ASI_SHIFT) &
586 					TSTATE_ASI_MASK;
587 		} else {
588 			asi = (inst >> 5) & 0xff;
589 		}
590 		switch (asi) {
591 		case ASI_P:
592 		case ASI_S:
593 			break;
594 		case ASI_PNF:
595 		case ASI_SNF:
596 			nf = 1;
597 			break;
598 		case ASI_PL:
599 		case ASI_SL:
600 			ltlend = 1;
601 			break;
602 		case ASI_PNFL:
603 		case ASI_SNFL:
604 			ltlend = 1;
605 			nf = 1;
606 			break;
607 		case ASI_AIUP:
608 		case ASI_AIUS:
609 			usermode = 1;
610 			break;
611 		case ASI_AIUPL:
612 		case ASI_AIUSL:
613 			usermode = 1;
614 			ltlend = 1;
615 			break;
616 		default:
617 			return (SIMU_ILLEGAL);
618 		}
619 	}
620 
621 	if (getreg(rp, rs1, &val, badaddr))
622 		return (SIMU_FAULT);
623 	addr = (caddr_t)val;		/* convert to 32/64 bit address */
624 
625 	/* check immediate bit and use immediate field or reg (rs2) */
626 	if (immflg) {
627 		int imm;
628 		imm  = inst & 0x1fff;		/* mask out immediate field */
629 		imm <<= 19;			/* sign extend it */
630 		imm >>= 19;
631 		addr += imm;			/* compute address */
632 	} else {
633 		if (getreg(rp, rs2, &val, badaddr))
634 			return (SIMU_FAULT);
635 		addr += val;
636 	}
637 
638 	/*
639 	 * T_UNIMP_LDD and T_UNIMP_STD are higher priority than
640 	 * T_ALIGNMENT.  So we have to make sure that the address is
641 	 * kosher before trying to use it, because the hardware hasn't
642 	 * checked it for us yet.
643 	 */
644 	if (((uintptr_t)addr & 0x7) != 0) {
645 		if (curproc->p_fixalignment)
646 			return (do_unaligned(rp, badaddr));
647 		else
648 			return (SIMU_UNALIGN);
649 	}
650 
651 	/*
652 	 * If this is a 32-bit program, chop the address accordingly.
653 	 */
654 	if (curproc->p_model == DATAMODEL_ILP32 && usermode)
655 		addr = (caddr_t)(caddr32_t)addr;
656 
657 	if ((inst >> 21) & 1) {			/* store */
658 		if (getreg(rp, rd, &reven, badaddr))
659 			return (SIMU_FAULT);
660 		if (getreg(rp, rd+1, &rodd, badaddr))
661 			return (SIMU_FAULT);
662 		if (ltlend) {
663 			reven = BSWAP_32(reven);
664 			rodd  = BSWAP_32(rodd);
665 		}
666 		data = (reven << 32) | rodd;
667 		if (usermode) {
668 			if (suword64_nowatch(addr, data) == -1)
669 				return (SIMU_FAULT);
670 		} else {
671 			*(uint64_t *)addr = data;
672 		}
673 	} else {				/* load */
674 		if (usermode) {
675 			if (fuword64_nowatch(addr, &data)) {
676 				if (nf)
677 					data = 0;
678 				else
679 					return (SIMU_FAULT);
680 			}
681 		} else
682 			data = *(uint64_t *)addr;
683 
684 		reven = (data >> 32);
685 		rodd  = (uint64_t)(uint32_t)data;
686 		if (ltlend) {
687 			reven = BSWAP_32(reven);
688 			rodd  = BSWAP_32(rodd);
689 		}
690 
691 		if (putreg(&reven, rp, rd, badaddr) == -1)
692 			return (SIMU_FAULT);
693 		if (putreg(&rodd, rp, rd+1, badaddr) == -1)
694 			return (SIMU_FAULT);
695 	}
696 	return (SIMU_SUCCESS);
697 }
698 
699 
700 /*
701  * simulate popc
702  */
703 static int
704 simulate_popc(struct regs *rp, caddr_t *badaddr, uint_t inst)
705 {
706 	uint_t	rd, rs2, rs1;
707 	uint_t	immflg;
708 	uint64_t val, cnt = 0;
709 
710 	rd = (inst >> 25) & 0x1f;
711 	rs1 = (inst >> 14) & 0x1f;
712 	rs2 = inst & 0x1f;
713 	immflg = (inst >> 13) & 1;
714 
715 	if (rs1 > 0)
716 		return (SIMU_ILLEGAL);
717 
718 	(void) flush_user_windows_to_stack(NULL);
719 
720 	/* check immediate bit and use immediate field or reg (rs2) */
721 	if (immflg) {
722 		int64_t imm;
723 		imm  = inst & 0x1fff;		/* mask out immediate field */
724 		imm <<= 51;			/* sign extend it */
725 		imm >>= 51;
726 		if (imm != 0) {
727 			for (cnt = 0; imm != 0; imm &= imm-1)
728 				cnt++;
729 		}
730 	} else {
731 		if (getreg(rp, rs2, &val, badaddr))
732 			return (SIMU_FAULT);
733 		if (val != 0) {
734 			for (cnt = 0; val != 0; val &= val-1)
735 				cnt++;
736 		}
737 	}
738 
739 	if (putreg(&cnt, rp, rd, badaddr) == -1)
740 		return (SIMU_FAULT);
741 
742 	return (SIMU_SUCCESS);
743 }
744 
745 /*
746  * simulate unimplemented instructions (popc, ldqf{a}, stqf{a})
747  */
748 int
749 simulate_unimp(struct regs *rp, caddr_t *badaddr)
750 {
751 	uint_t	inst, optype, op3, asi;
752 	uint_t	rs1, rd;
753 	uint_t	ignor, i;
754 	machpcb_t *mpcb = lwptompcb(ttolwp(curthread));
755 	int	nomatch = 0;
756 	caddr_t	addr = (caddr_t)rp->r_pc;
757 	struct as *as;
758 	caddr_t	ka;
759 	pfn_t	pfnum;
760 	page_t *pp;
761 	proc_t *p = ttoproc(curthread);
762 	struct seg *mapseg;
763 	struct segvn_data *svd;
764 
765 	ASSERT(USERMODE(rp->r_tstate));
766 	inst = fetch_user_instr(addr);
767 	if (inst == (uint_t)-1) {
768 		mpcb->mpcb_illexcaddr = addr;
769 		mpcb->mpcb_illexcinsn = (uint32_t)-1;
770 		return (SIMU_ILLEGAL);
771 	}
772 
773 	/*
774 	 * When fixing dirty v8 instructions there's a race if two processors
775 	 * are executing the dirty executable at the same time.  If one
776 	 * cleans the instruction as the other is executing it the second
777 	 * processor will see a clean instruction when it comes through this
778 	 * code and will return SIMU_ILLEGAL.  To work around the race
779 	 * this code will keep track of the last illegal instruction seen
780 	 * by each lwp and will only take action if the illegal instruction
781 	 * is repeatable.
782 	 */
783 	if (addr != mpcb->mpcb_illexcaddr ||
784 	    inst != mpcb->mpcb_illexcinsn)
785 		nomatch = 1;
786 	mpcb->mpcb_illexcaddr = addr;
787 	mpcb->mpcb_illexcinsn = inst;
788 
789 	/* instruction fields */
790 	i = (inst >> 13) & 0x1;
791 	rd = (inst >> 25) & 0x1f;
792 	optype = (inst >> 30) & 0x3;
793 	op3 = (inst >> 19) & 0x3f;
794 	ignor = (inst >> 5) & 0xff;
795 	if (IS_IBIT_SET(inst)) {
796 		asi = (uint32_t)((rp->r_tstate >> TSTATE_ASI_SHIFT) &
797 		    TSTATE_ASI_MASK);
798 	} else {
799 		asi = ignor;
800 	}
801 
802 	if (IS_VIS1(optype, op3) ||
803 	    IS_PARTIAL_OR_SHORT_FLOAT_LD_ST(optype, op3, asi)) {
804 		klwp_t *lwp = ttolwp(curthread);
805 		kfpu_t *fp = lwptofpu(lwp);
806 		if (fpu_exists) {
807 			if (!(_fp_read_fprs() & FPRS_FEF))
808 				fp_enable();
809 			_fp_read_pfsr(&fp->fpu_fsr);
810 		} else {
811 			if (!fp->fpu_en)
812 				fp_enable();
813 		}
814 		fp_precise(rp);
815 		return (SIMU_RETRY);
816 	}
817 
818 	if (optype == 2 && op3 == IOP_V8_POPC) {
819 		return (simulate_popc(rp, badaddr, inst));
820 	} else if (optype == 3 && op3 == IOP_V8_POPC) {
821 		return (SIMU_ILLEGAL);
822 	}
823 
824 	if (optype == OP_V8_LDSTR) {
825 		if (op3 == IOP_V8_LDQF || op3 == IOP_V8_LDQFA ||
826 		    op3 == IOP_V8_STQF || op3 == IOP_V8_STQFA)
827 			return (do_unaligned(rp, badaddr));
828 	}
829 
830 	if (nomatch)
831 		return (SIMU_RETRY);
832 
833 	/*
834 	 * The rest of the code handles v8 binaries with instructions
835 	 * that have dirty (non-zero) bits in reserved or 'ignored'
836 	 * fields; these will cause core dumps on v9 machines.
837 	 *
838 	 * We only clean dirty instructions in 32-bit programs (ie, v8)
839 	 * running on SPARCv9 processors.  True v9 programs are forced
840 	 * to use the instruction set as intended.
841 	 */
842 	if (lwp_getdatamodel(curthread->t_lwp) != DATAMODEL_ILP32)
843 		return (SIMU_ILLEGAL);
844 	switch (optype) {
845 	case OP_V8_BRANCH:
846 	case OP_V8_CALL:
847 		return (SIMU_ILLEGAL);	/* these don't have ignored fields */
848 		/*NOTREACHED*/
849 	case OP_V8_ARITH:
850 		switch (op3) {
851 		case IOP_V8_RETT:
852 			if (rd == 0 && !(i == 0 && ignor))
853 				return (SIMU_ILLEGAL);
854 			if (rd)
855 				inst &= ~(0x1f << 25);
856 			if (i == 0 && ignor)
857 				inst &= ~(0xff << 5);
858 			break;
859 		case IOP_V8_TCC:
860 			if (i == 0 && ignor != 0) {
861 				inst &= ~(0xff << 5);
862 			} else if (i == 1 && (((inst >> 7) & 0x3f) != 0)) {
863 				inst &= ~(0x3f << 7);
864 			} else {
865 				return (SIMU_ILLEGAL);
866 			}
867 			break;
868 		case IOP_V8_JMPL:
869 		case IOP_V8_RESTORE:
870 		case IOP_V8_SAVE:
871 			if ((op3 == IOP_V8_RETT && rd) ||
872 			    (i == 0 && ignor)) {
873 				inst &= ~(0xff << 5);
874 			} else {
875 				return (SIMU_ILLEGAL);
876 			}
877 			break;
878 		case IOP_V8_FCMP:
879 			if (rd == 0)
880 				return (SIMU_ILLEGAL);
881 			inst &= ~(0x1f << 25);
882 			break;
883 		case IOP_V8_RDASR:
884 			rs1 = ((inst >> 14) & 0x1f);
885 			if (rs1 == 1 || (rs1 >= 7 && rs1 <= 14)) {
886 				/*
887 				 * The instruction specifies an invalid
888 				 * state register - better bail out than
889 				 * "fix" it when we're not sure what was
890 				 * intended.
891 				 */
892 				return (SIMU_ILLEGAL);
893 			}
894 				/*
895 				 * Note: this case includes the 'stbar'
896 				 * instruction (rs1 == 15 && i == 0).
897 				 */
898 				if ((ignor = (inst & 0x3fff)) != 0)
899 					inst &= ~(0x3fff);
900 			break;
901 		case IOP_V8_SRA:
902 		case IOP_V8_SRL:
903 		case IOP_V8_SLL:
904 			if (ignor == 0)
905 				return (SIMU_ILLEGAL);
906 			inst &= ~(0xff << 5);
907 			break;
908 		case IOP_V8_ADD:
909 		case IOP_V8_AND:
910 		case IOP_V8_OR:
911 		case IOP_V8_XOR:
912 		case IOP_V8_SUB:
913 		case IOP_V8_ANDN:
914 		case IOP_V8_ORN:
915 		case IOP_V8_XNOR:
916 		case IOP_V8_ADDC:
917 		case IOP_V8_UMUL:
918 		case IOP_V8_SMUL:
919 		case IOP_V8_SUBC:
920 		case IOP_V8_UDIV:
921 		case IOP_V8_SDIV:
922 		case IOP_V8_ADDcc:
923 		case IOP_V8_ANDcc:
924 		case IOP_V8_ORcc:
925 		case IOP_V8_XORcc:
926 		case IOP_V8_SUBcc:
927 		case IOP_V8_ANDNcc:
928 		case IOP_V8_ORNcc:
929 		case IOP_V8_XNORcc:
930 		case IOP_V8_ADDCcc:
931 		case IOP_V8_UMULcc:
932 		case IOP_V8_SMULcc:
933 		case IOP_V8_SUBCcc:
934 		case IOP_V8_UDIVcc:
935 		case IOP_V8_SDIVcc:
936 		case IOP_V8_TADDcc:
937 		case IOP_V8_TSUBcc:
938 		case IOP_V8_TADDccTV:
939 		case IOP_V8_TSUBccTV:
940 		case IOP_V8_MULScc:
941 		case IOP_V8_WRASR:
942 		case IOP_V8_FLUSH:
943 			if (i != 0 || ignor == 0)
944 				return (SIMU_ILLEGAL);
945 			inst &= ~(0xff << 5);
946 			break;
947 		default:
948 			return (SIMU_ILLEGAL);
949 		}
950 		break;
951 	case OP_V8_LDSTR:
952 		switch (op3) {
953 		case IOP_V8_STFSR:
954 		case IOP_V8_LDFSR:
955 			if (rd == 0 && !(i == 0 && ignor))
956 				return (SIMU_ILLEGAL);
957 			if (rd)
958 				inst &= ~(0x1f << 25);
959 			if (i == 0 && ignor)
960 				inst &= ~(0xff << 5);
961 			break;
962 		default:
963 			if (optype == OP_V8_LDSTR && !IS_LDST_ALT(op3) &&
964 			    i == 0 && ignor)
965 				inst &= ~(0xff << 5);
966 			else
967 				return (SIMU_ILLEGAL);
968 			break;
969 		}
970 		break;
971 	default:
972 		return (SIMU_ILLEGAL);
973 	}
974 
975 	as = p->p_as;
976 
977 	AS_LOCK_ENTER(as, &as->a_lock, RW_READER);
978 	mapseg = as_findseg(as, (caddr_t)rp->r_pc, 0);
979 	ASSERT(mapseg != NULL);
980 	svd = (struct segvn_data *)mapseg->s_data;
981 
982 	/*
983 	 * We only create COW page for MAP_PRIVATE mappings.
984 	 */
985 	SEGVN_LOCK_ENTER(as, &svd->lock, RW_READER);
986 	if ((svd->type & MAP_TYPE) & MAP_SHARED) {
987 		SEGVN_LOCK_EXIT(as, &svd->lock);
988 		AS_LOCK_EXIT(as, &as->a_lock);
989 		return (SIMU_ILLEGAL);
990 	}
991 	SEGVN_LOCK_EXIT(as, &svd->lock);
992 	AS_LOCK_EXIT(as, &as->a_lock);
993 
994 	/*
995 	 * A "flush" instruction using the user PC's vaddr will not work
996 	 * here, at least on Spitfire. Instead we create a temporary kernel
997 	 * mapping to the user's text page, then modify and flush that.
998 	 * Break COW by locking user page.
999 	 */
1000 	if (as_fault(as->a_hat, as, (caddr_t)(rp->r_pc & PAGEMASK), PAGESIZE,
1001 	    F_SOFTLOCK, S_READ))
1002 		return (SIMU_FAULT);
1003 
1004 	AS_LOCK_ENTER(as, &as->a_lock, RW_READER);
1005 	pfnum = hat_getpfnum(as->a_hat, (caddr_t)rp->r_pc);
1006 	AS_LOCK_EXIT(as, &as->a_lock);
1007 	if (pf_is_memory(pfnum)) {
1008 		pp = page_numtopp_nolock(pfnum);
1009 		ASSERT(pp == NULL || PAGE_LOCKED(pp));
1010 	} else {
1011 		(void) as_fault(as->a_hat, as, (caddr_t)(rp->r_pc & PAGEMASK),
1012 		    PAGESIZE, F_SOFTUNLOCK, S_READ);
1013 		return (SIMU_FAULT);
1014 	}
1015 
1016 	AS_LOCK_ENTER(as, &as->a_lock, RW_READER);
1017 	ka = ppmapin(pp, PROT_READ|PROT_WRITE, (caddr_t)rp->r_pc);
1018 	*(uint_t *)(ka + (uintptr_t)(rp->r_pc % PAGESIZE)) = inst;
1019 	doflush(ka + (uintptr_t)(rp->r_pc % PAGESIZE));
1020 	ppmapout(ka);
1021 	AS_LOCK_EXIT(as, &as->a_lock);
1022 
1023 	(void) as_fault(as->a_hat, as, (caddr_t)(rp->r_pc & PAGEMASK),
1024 	    PAGESIZE, F_SOFTUNLOCK, S_READ);
1025 	return (SIMU_RETRY);
1026 }
1027 
1028 /*
1029  * Get the value of a register for instruction simulation
1030  * by using the regs or window structure pointers.
1031  * Return 0 for success, and -1 for failure.  If there is a failure,
1032  * save the faulting address using badaddr pointer.
1033  * We have 64 bit globals and outs, and 32 or 64 bit ins and locals.
1034  * Don't truncate globals/outs for 32 bit programs, for v8+ support.
1035  */
1036 int
1037 getreg(struct regs *rp, uint_t reg, uint64_t *val, caddr_t *badaddr)
1038 {
1039 	uint64_t *rgs, *sp;
1040 	int rv = 0;
1041 
1042 	rgs = (uint64_t *)&rp->r_ps;		/* globals and outs */
1043 	sp = (uint64_t *)rp->r_sp;		/* ins and locals */
1044 	if (reg == 0) {
1045 		*val = 0;
1046 	} else if (reg < 16) {
1047 		*val = rgs[reg];
1048 	} else if (IS_V9STACK(sp)) {
1049 		uint64_t *rw = (uint64_t *)((uintptr_t)sp + V9BIAS64);
1050 		uint64_t *addr = (uint64_t *)&rw[reg - 16];
1051 		uint64_t res;
1052 
1053 		if (USERMODE(rp->r_tstate)) {
1054 			if (fuword64_nowatch(addr, &res) == -1) {
1055 				*badaddr = (caddr_t)addr;
1056 				rv = -1;
1057 			}
1058 		} else {
1059 			res = *addr;
1060 		}
1061 		*val = res;
1062 	} else {
1063 		uint32_t *rw = (uint32_t *)(caddr32_t)sp;
1064 		uint32_t *addr = (uint32_t *)&rw[reg - 16];
1065 		uint32_t res;
1066 
1067 		if (USERMODE(rp->r_tstate)) {
1068 			if (fuword32_nowatch(addr, &res) == -1) {
1069 				*badaddr = (caddr_t)addr;
1070 				rv = -1;
1071 			}
1072 		} else {
1073 			res = *addr;
1074 		}
1075 		*val = (uint64_t)res;
1076 	}
1077 	return (rv);
1078 }
1079 
1080 /*
1081  * Set the value of a register after instruction simulation
1082  * by using the regs or window structure pointers.
1083  * Return 0 for succes -1 failure.
1084  * save the faulting address using badaddr pointer.
1085  * We have 64 bit globals and outs, and 32 or 64 bit ins and locals.
1086  * Don't truncate globals/outs for 32 bit programs, for v8+ support.
1087  */
1088 int
1089 putreg(uint64_t	*data, struct regs *rp, uint_t reg, caddr_t *badaddr)
1090 {
1091 	uint64_t *rgs, *sp;
1092 	int rv = 0;
1093 
1094 	rgs = (uint64_t *)&rp->r_ps;		/* globals and outs */
1095 	sp = (uint64_t *)rp->r_sp;		/* ins and locals */
1096 	if (reg == 0) {
1097 		return (0);
1098 	} else if (reg < 16) {
1099 		rgs[reg] = *data;
1100 	} else if (IS_V9STACK(sp)) {
1101 		uint64_t *rw = (uint64_t *)((uintptr_t)sp + V9BIAS64);
1102 		uint64_t *addr = (uint64_t *)&rw[reg - 16];
1103 		uint64_t res;
1104 
1105 		if (USERMODE(rp->r_tstate)) {
1106 			struct machpcb *mpcb = lwptompcb(curthread->t_lwp);
1107 
1108 			res = *data;
1109 			if (suword64_nowatch(addr, res) != 0) {
1110 				*badaddr = (caddr_t)addr;
1111 				rv = -1;
1112 			}
1113 			/*
1114 			 * We have changed a local or in register;
1115 			 * nuke the watchpoint return windows.
1116 			 */
1117 			mpcb->mpcb_rsp[0] = NULL;
1118 			mpcb->mpcb_rsp[1] = NULL;
1119 		} else {
1120 			res = *data;
1121 			*addr = res;
1122 		}
1123 	} else {
1124 		uint32_t *rw = (uint32_t *)(caddr32_t)sp;
1125 		uint32_t *addr = (uint32_t *)&rw[reg - 16];
1126 		uint32_t res;
1127 
1128 		if (USERMODE(rp->r_tstate)) {
1129 			struct machpcb *mpcb = lwptompcb(curthread->t_lwp);
1130 
1131 			res = (uint_t)*data;
1132 			if (suword32_nowatch(addr, res) != 0) {
1133 				*badaddr = (caddr_t)addr;
1134 				rv = -1;
1135 			}
1136 			/*
1137 			 * We have changed a local or in register;
1138 			 * nuke the watchpoint return windows.
1139 			 */
1140 			mpcb->mpcb_rsp[0] = NULL;
1141 			mpcb->mpcb_rsp[1] = NULL;
1142 
1143 		} else {
1144 			res = (uint_t)*data;
1145 			*addr = res;
1146 		}
1147 	}
1148 	return (rv);
1149 }
1150 
1151 /*
1152  * Calculate a memory reference address from instruction
1153  * operands, used to return the address of a fault, instead
1154  * of the instruction when an error occurs.  This is code that is
1155  * common with most of the routines that simulate instructions.
1156  */
1157 int
1158 calc_memaddr(struct regs *rp, caddr_t *badaddr)
1159 {
1160 	uint_t	inst;
1161 	uint_t	rd, rs1, rs2;
1162 	int	sz;
1163 	int	immflg;
1164 	int	floatflg;
1165 	caddr_t  addr;
1166 	uint64_t val;
1167 
1168 	if (USERMODE(rp->r_tstate))
1169 		inst = fetch_user_instr((caddr_t)rp->r_pc);
1170 	else
1171 		inst = *(uint_t *)rp->r_pc;
1172 
1173 	rd = (inst >> 25) & 0x1f;
1174 	rs1 = (inst >> 14) & 0x1f;
1175 	rs2 = inst & 0x1f;
1176 	floatflg = (inst >> 24) & 1;
1177 	immflg = (inst >> 13) & 1;
1178 
1179 	if (floatflg) {
1180 		switch ((inst >> 19) & 3) {	/* map size bits to a number */
1181 		case 0: sz = 4; break;		/* ldf/stf */
1182 		case 1: return (0);		/* ld[x]fsr/st[x]fsr */
1183 		case 2: sz = 16; break;		/* ldqf/stqf */
1184 		case 3: sz = 8; break;		/* lddf/stdf */
1185 		}
1186 		/*
1187 		 * Fix to access extra double register encoding plus
1188 		 * compensate to access the correct fpu_dreg.
1189 		 */
1190 		if (sz > 4) {
1191 			if ((rd & 1) == 1)
1192 				rd = (rd & 0x1e) | 0x20;
1193 			rd = rd >> 1;
1194 		}
1195 	} else {
1196 		switch ((inst >> 19) & 0xf) {	/* map size bits to a number */
1197 		case 0:				/* lduw */
1198 		case 4:				/* stw */
1199 		case 8:				/* ldsw */
1200 		case 0xf:			/* swap */
1201 			sz = 4; break;
1202 		case 1:				/* ldub */
1203 		case 5:				/* stb */
1204 		case 9:				/* ldsb */
1205 		case 0xd:			/* ldstub */
1206 			sz = 1; break;
1207 		case 2:				/* lduh */
1208 		case 6:				/* sth */
1209 		case 0xa:			/* ldsh */
1210 			sz = 2; break;
1211 		case 3:				/* ldd */
1212 		case 7:				/* std */
1213 		case 0xb:			/* ldx */
1214 		case 0xe:			/* stx */
1215 			sz = 8; break;
1216 		}
1217 	}
1218 
1219 	if (USERMODE(rp->r_tstate))
1220 		(void) flush_user_windows_to_stack(NULL);
1221 	else
1222 		flush_windows();
1223 
1224 	if (getreg(rp, rs1, &val, badaddr))
1225 		return (SIMU_FAULT);
1226 	addr = (caddr_t)val;
1227 
1228 	/* check immediate bit and use immediate field or reg (rs2) */
1229 	if (immflg) {
1230 		int imm;
1231 		imm = inst & 0x1fff;		/* mask out immediate field */
1232 		imm <<= 19;			/* sign extend it */
1233 		imm >>= 19;
1234 		addr += imm;			/* compute address */
1235 	} else {
1236 		if (getreg(rp, rs2, &val, badaddr))
1237 			return (SIMU_FAULT);
1238 		addr += val;
1239 	}
1240 
1241 	/*
1242 	 * If this is a 32-bit program, chop the address accordingly.
1243 	 */
1244 	if (curproc->p_model == DATAMODEL_ILP32 &&
1245 	    USERMODE(rp->r_tstate))
1246 		addr = (caddr_t)(caddr32_t)addr;
1247 
1248 	*badaddr = addr;
1249 	return ((uintptr_t)addr & (sz - 1) ? SIMU_UNALIGN : SIMU_SUCCESS);
1250 }
1251 
1252 /*
1253  * Return the size of a load or store instruction (1, 2, 4, 8, 16, 64).
1254  * Also compute the precise address by instruction disassembly.
1255  * (v9 page faults only provide the page address via the hardware.)
1256  * Return 0 on failure (not a load or store instruction).
1257  */
1258 int
1259 instr_size(struct regs *rp, caddr_t *addrp, enum seg_rw rdwr)
1260 {
1261 	uint_t	inst, op3, asi;
1262 	uint_t	rd, rs1, rs2;
1263 	int	sz = 0;
1264 	int	immflg;
1265 	int	floatflg;
1266 	caddr_t	addr;
1267 	caddr_t badaddr;
1268 	uint64_t val;
1269 
1270 	if (rdwr == S_EXEC) {
1271 		*addrp = (caddr_t)rp->r_pc;
1272 		return (4);
1273 	}
1274 
1275 	/*
1276 	 * Fetch the instruction from user-level.
1277 	 * We would like to assert this:
1278 	 *   ASSERT(USERMODE(rp->r_tstate));
1279 	 * but we can't because we can reach this point from a
1280 	 * register window underflow/overflow and the v9 wbuf
1281 	 * traps call trap() with T_USER even though r_tstate
1282 	 * indicates a system trap, not a user trap.
1283 	 */
1284 	inst = fetch_user_instr((caddr_t)rp->r_pc);
1285 
1286 	op3 = (inst >> 19) & 0x3f;
1287 	rd = (inst >> 25) & 0x1f;
1288 	rs1 = (inst >> 14) & 0x1f;
1289 	rs2 = inst & 0x1f;
1290 	floatflg = (inst >> 24) & 1;
1291 	immflg = (inst >> 13) & 1;
1292 
1293 	/* if not load or store do nothing.  can't happen? */
1294 	if ((inst >> 30) != 3)
1295 		return (0);
1296 
1297 	if (immflg)
1298 		asi = (uint_t)((rp->r_tstate >> TSTATE_ASI_SHIFT) &
1299 				TSTATE_ASI_MASK);
1300 	else
1301 		asi = (inst >> 5) & 0xff;
1302 
1303 	if (floatflg) {
1304 		/* check for ld/st alternate and highest defined V9 asi */
1305 		if ((op3 & 0x30) == 0x30 && asi > ASI_SNFL) {
1306 			sz = extended_asi_size(asi);
1307 		} else {
1308 			switch (op3 & 3) {
1309 			case 0:
1310 				sz = 4;			/* ldf/stf/cas */
1311 				break;
1312 			case 1:
1313 				if (rd == 0)
1314 					sz = 4;		/* ldfsr/stfsr */
1315 				else
1316 					sz = 8;		/* ldxfsr/stxfsr */
1317 				break;
1318 			case 2:
1319 				if (op3 == 0x3e)
1320 					sz = 8;		/* casx */
1321 				else
1322 					sz = 16;	/* ldqf/stqf */
1323 				break;
1324 			case 3:
1325 				sz = 8;			/* lddf/stdf */
1326 				break;
1327 			}
1328 		}
1329 	} else {
1330 		switch (op3 & 0xf) {		/* map size bits to a number */
1331 		case 0:				/* lduw */
1332 		case 4:				/* stw */
1333 		case 8:				/* ldsw */
1334 		case 0xf:			/* swap */
1335 			sz = 4; break;
1336 		case 1:				/* ldub */
1337 		case 5:				/* stb */
1338 		case 9:				/* ldsb */
1339 		case 0xd:			/* ldstub */
1340 			sz = 1; break;
1341 		case 2:				/* lduh */
1342 		case 6:				/* sth */
1343 		case 0xa:			/* ldsh */
1344 			sz = 2; break;
1345 		case 3:				/* ldd */
1346 		case 7:				/* std */
1347 		case 0xb:			/* ldx */
1348 		case 0xe:			/* stx */
1349 			sz = 8; break;
1350 		}
1351 	}
1352 
1353 	if (sz == 0)	/* can't happen? */
1354 		return (0);
1355 	(void) flush_user_windows_to_stack(NULL);
1356 
1357 	if (getreg(rp, rs1, &val, &badaddr))
1358 		return (0);
1359 	addr = (caddr_t)val;
1360 
1361 	/* cas/casx don't use rs2 / simm13 to compute the address */
1362 	if ((op3 & 0x3d) != 0x3c) {
1363 		/* check immediate bit and use immediate field or reg (rs2) */
1364 		if (immflg) {
1365 			int imm;
1366 			imm  = inst & 0x1fff;	/* mask out immediate field */
1367 			imm <<= 19;		/* sign extend it */
1368 			imm >>= 19;
1369 			addr += imm;		/* compute address */
1370 		} else {
1371 			/*
1372 			 * asi's in the 0xCx range are partial store
1373 			 * instructions.  For these, rs2 is a mask, not part of
1374 			 * the address.
1375 			 */
1376 			if (!(floatflg && (asi & 0xf0) == 0xc0)) {
1377 				if (getreg(rp, rs2, &val, &badaddr))
1378 					return (0);
1379 				addr += val;
1380 			}
1381 		}
1382 	}
1383 
1384 	/*
1385 	 * If this is a 32-bit program, chop the address accordingly.
1386 	 */
1387 	if (curproc->p_model == DATAMODEL_ILP32)
1388 		addr = (caddr_t)(caddr32_t)addr;
1389 
1390 	*addrp = addr;
1391 	ASSERT(sz != 0);
1392 	return (sz);
1393 }
1394 
1395 /*
1396  * Fetch an instruction from user-level.
1397  * Deal with watchpoints, if they are in effect.
1398  */
1399 int32_t
1400 fetch_user_instr(caddr_t vaddr)
1401 {
1402 	proc_t *p = curproc;
1403 	int32_t instr;
1404 
1405 	/*
1406 	 * If this is a 32-bit program, chop the address accordingly.
1407 	 */
1408 	if (p->p_model == DATAMODEL_ILP32)
1409 		vaddr = (caddr_t)(caddr32_t)vaddr;
1410 
1411 	if (fuword32_nowatch(vaddr, (uint32_t *)&instr) == -1)
1412 		instr = -1;
1413 
1414 	return (instr);
1415 }
1416