/*      $NetBSD: fpu_emulate.c,v 1.49 2025/01/06 07:34:24 isaki Exp $   */

/*
 * Copyright (c) 1995 Gordon W. Ross
 * some portion Copyright (c) 1995 Ken Nakata
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. The name of the author may not be used to endorse or promote products
 *    derived from this software without specific prior written permission.
 * 4. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *      This product includes software developed by Gordon Ross
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

/*
 * mc68881 emulator
 * XXX - Just a start at it for now...
 */

#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: fpu_emulate.c,v 1.49 2025/01/06 07:34:24 isaki Exp $");

#include <sys/param.h>
#include <sys/types.h>
#include <sys/signal.h>
#include <sys/systm.h>
#include <machine/frame.h>

#if defined(DDB) && defined(DEBUG_FPE)
# include <m68k/db_machdep.h>
#endif

#include "fpu_emulate.h"

#define fpe_abort(tfp, ksi, signo, code)                        \
        do {                                                    \
                (ksi)->ksi_signo = (signo);                     \
                (ksi)->ksi_code = (code);                       \
                (ksi)->ksi_addr = (void *)(frame)->f_pc;        \
                return -1;                                      \
        } while (/* CONSTCOND */ 0)

static int fpu_emul_fmovmcr(struct fpemu *, struct instruction *);
static int fpu_emul_fmovm(struct fpemu *, struct instruction *);
static int fpu_emul_arith(struct fpemu *, struct instruction *);
static int fpu_emul_type1(struct fpemu *, struct instruction *);
static int fpu_emul_brcc(struct fpemu *, struct instruction *);
static int test_cc(struct fpemu *, int);

#ifdef DEBUG_FPE
#define DUMP_INSN(insn)                                                 \
        printf("%s: insn={adv=%d,siz=%d,op=%04x,w1=%04x}\n",            \
            __func__,                                                   \
            (insn)->is_advance, (insn)->is_datasize,                    \
            (insn)->is_opcode, (insn)->is_word1)
#define DPRINTF(x)      printf x
#else
#define DUMP_INSN(insn) do {} while (/* CONSTCOND */ 0)
#define DPRINTF(x)      do {} while (/* CONSTCOND */ 0)
#endif

/*
 * Emulate a floating-point instruction.
 * Return zero for success, else signal number.
 * (Typically: zero, SIGFPE, SIGILL, SIGSEGV)
 */
int
fpu_emulate(struct frame *frame, struct fpframe *fpf, ksiginfo_t *ksi)
{
        static struct instruction insn;
        static struct fpemu fe;
        int optype, sig;
        unsigned short sval;

        /* initialize insn.is_datasize to tell it is *not* initialized */
        insn.is_datasize = -1;

        fe.fe_frame = frame;
        fe.fe_fpframe = fpf;
        fe.fe_fpsr = fpf->fpf_fpsr;
        fe.fe_fpcr = fpf->fpf_fpcr;

        DPRINTF(("%s: ENTERING: FPSR=%08x, FPCR=%08x\n",
            __func__, fe.fe_fpsr, fe.fe_fpcr));

        /* always set this (to avoid a warning) */
        insn.is_pc = frame->f_pc;
        insn.is_nextpc = 0;
        if (frame->f_format == 4) {
                /*
                 * A format 4 is generated by the 68{EC,LC}040.  The PC is
                 * already set to the instruction following the faulting
                 * instruction.  We need to calculate that, anyway.  The
                 * fslw is the PC of the faulted instruction, which is what
                 * we expect to be in f_pc.
                 *
                 * XXX - This is a hack; it assumes we at least know the
                 * sizes of all instructions we run across.
                 * XXX TODO: This may not be true, so we might want to save
                 * the PC in order to restore it later.
                 */
#if 0
                insn.is_nextpc = frame->f_pc;
#endif
                insn.is_pc = frame->f_fmt4.f_fslw;
                frame->f_pc = insn.is_pc;
        }

        if (ufetch_short((void *)(insn.is_pc), &sval)) {
                DPRINTF(("%s: fault reading opcode\n", __func__));
                fpe_abort(frame, ksi, SIGSEGV, SEGV_ACCERR);
        }

        if ((sval & 0xf000) != 0xf000) {
                DPRINTF(("%s: not coproc. insn.: opcode=0x%x\n",
                    __func__, sval));
                fpe_abort(frame, ksi, SIGILL, ILL_ILLOPC);
        }

        if ((sval & 0x0E00) != 0x0200) {
                DPRINTF(("%s: bad coproc. id: opcode=0x%x\n", __func__, sval));
                fpe_abort(frame, ksi, SIGILL, ILL_ILLOPC);
        }

        insn.is_opcode = sval;
        optype = (sval & 0x01C0);

        if (ufetch_short((void *)(insn.is_pc + 2), &sval)) {
                DPRINTF(("%s: fault reading word1\n", __func__));
                fpe_abort(frame, ksi, SIGSEGV, SEGV_ACCERR);
        }
        insn.is_word1 = sval;
        /* all FPU instructions are at least 4-byte long */
        insn.is_advance = 4;

        DUMP_INSN(&insn);

        /*
         * Which family (or type) of opcode is it?
         * Tests ordered by likelihood (hopefully).
         * Certainly, type 0 is the most common.
         */
        if (optype == 0x0000) {
                /* type=0: generic */
                if ((sval & 0x8000)) {
                        if ((sval & 0x4000)) {
                                DPRINTF(("%s: fmovm FPr\n", __func__));
                                sig = fpu_emul_fmovm(&fe, &insn);
                        } else {
                                DPRINTF(("%s: fmovm FPcr\n", __func__));
                                sig = fpu_emul_fmovmcr(&fe, &insn);
                        }
                } else {
                        if ((sval & 0xe000) == 0x6000) {
                                /* fstore = fmove FPn,mem */
                                DPRINTF(("%s: fmove to mem\n", __func__));
                                sig = fpu_emul_fstore(&fe, &insn);
                        } else if ((sval & 0xfc00) == 0x5c00) {
                                /* fmovecr */
                                DPRINTF(("%s: fmovecr\n", __func__));
                                sig = fpu_emul_fmovecr(&fe, &insn);
                        } else if ((sval & 0xa07f) == 0x26) {
                                /* fscale */
                                DPRINTF(("%s: fscale\n", __func__));
                                sig = fpu_emul_fscale(&fe, &insn);
                        } else {
                                DPRINTF(("%s: other type0\n", __func__));
                                /* all other type0 insns are arithmetic */
                                sig = fpu_emul_arith(&fe, &insn);
                        }
                        if (sig == 0) {
                                DPRINTF(("%s: type 0 returned 0\n", __func__));
                                sig = fpu_upd_excp(&fe);
                        }
                }
        } else if (optype == 0x0080 || optype == 0x00C0) {
                /* type=2 or 3: fbcc, short or long disp. */
                DPRINTF(("%s: fbcc %s\n", __func__,
                    (optype & 0x40) ? "long" : "short"));
                sig = fpu_emul_brcc(&fe, &insn);
        } else if (optype == 0x0040) {
                /* type=1: fdbcc, fscc, ftrapcc */
                DPRINTF(("%s: type1\n", __func__));
                sig = fpu_emul_type1(&fe, &insn);
                /* real FTRAPcc raises T_TRAPVINST if the condition is met. */
                if (sig == SIGFPE) {
                        ksi->ksi_trap = T_TRAPVINST;
                }
        } else {
                /* type=4: fsave    (privileged) */
                /* type=5: frestore (privileged) */
                /* type=6: reserved */
                /* type=7: reserved */
                DPRINTF(("%s: bad opcode type: opcode=0x%x\n", __func__,
                    insn.is_opcode));
                sig = SIGILL;
        }

        DUMP_INSN(&insn);

        /*
         * XXX it is not clear to me, if we should progress the PC always,
         * for SIGFPE || 0, or only for 0; however, without SIGFPE, we
         * don't pass the signalling regression  tests. -is
         */
        if ((sig == 0) || (sig == SIGFPE))
                frame->f_pc += insn.is_advance;
#if defined(DDB) && defined(DEBUG_FPE)
        else {
                printf("%s: sig=%d, opcode=%x, word1=%x\n", __func__,
                    sig, insn.is_opcode, insn.is_word1);
                kdb_trap(-1, (db_regs_t *)&frame);
        }
#endif
#if 0 /* XXX something is wrong */
        if (frame->f_format == 4) {
                /* XXX Restore PC -- 68{EC,LC}040 only */
                if (insn.is_nextpc)
                        frame->f_pc = insn.is_nextpc;
        }
#endif

        DPRINTF(("%s: EXITING: w/FPSR=%08x, FPCR=%08x\n", __func__,
            fe.fe_fpsr, fe.fe_fpcr));

        if (sig)
                fpe_abort(frame, ksi, sig, 0);
        return sig;
}

/* update accrued exception bits and see if there's an FP exception */
int
fpu_upd_excp(struct fpemu *fe)
{
        uint32_t fpsr;
        uint32_t fpcr;

        fpsr = fe->fe_fpsr;
        fpcr = fe->fe_fpcr;
        /*
         * update fpsr accrued exception bits; each insn doesn't have to
         * update this
         */
        if (fpsr & (FPSR_BSUN | FPSR_SNAN | FPSR_OPERR)) {
                fpsr |= FPSR_AIOP;
        }
        if (fpsr & FPSR_OVFL) {
                fpsr |= FPSR_AOVFL;
        }
        if ((fpsr & FPSR_UNFL) && (fpsr & FPSR_INEX2)) {
                fpsr |= FPSR_AUNFL;
        }
        if (fpsr & FPSR_DZ) {
                fpsr |= FPSR_ADZ;
        }
        if (fpsr & (FPSR_INEX1 | FPSR_INEX2 | FPSR_OVFL)) {
                fpsr |= FPSR_AINEX;
        }

        fe->fe_fpframe->fpf_fpsr = fe->fe_fpsr = fpsr;

        return (fpsr & fpcr & FPSR_EXCP) ? SIGFPE : 0;
}

/* update fpsr according to fp (= result of an fp op) */
uint32_t
fpu_upd_fpsr(struct fpemu *fe, struct fpn *fp)
{
        uint32_t fpsr;

        DPRINTF(("%s: previous fpsr=%08x\n", __func__, fe->fe_fpsr));
        /* clear all condition code */
        fpsr = fe->fe_fpsr & ~FPSR_CCB;

        DPRINTF(("%s: result is a ", __func__));
        if (fp->fp_sign) {
                DPRINTF(("negative "));
                fpsr |= FPSR_NEG;
        } else {
                DPRINTF(("positive "));
        }

        switch (fp->fp_class) {
        case FPC_SNAN:
                DPRINTF(("signaling NAN\n"));
                fpsr |= (FPSR_NAN | FPSR_SNAN);
                break;
        case FPC_QNAN:
                DPRINTF(("quiet NAN\n"));
                fpsr |= FPSR_NAN;
                break;
        case FPC_ZERO:
                DPRINTF(("Zero\n"));
                fpsr |= FPSR_ZERO;
                break;
        case FPC_INF:
                DPRINTF(("Inf\n"));
                fpsr |= FPSR_INF;
                break;
        default:
                DPRINTF(("Number\n"));
                /* anything else is treated as if it is a number */
                break;
        }

        fe->fe_fpsr = fe->fe_fpframe->fpf_fpsr = fpsr;

        DPRINTF(("%s: new fpsr=%08x\n", __func__, fe->fe_fpframe->fpf_fpsr));

        return fpsr;
}

static int
fpu_emul_fmovmcr(struct fpemu *fe, struct instruction *insn)
{
        struct frame *frame = fe->fe_frame;
        struct fpframe *fpf = fe->fe_fpframe;
        int sig;
        int reglist;
        int regcount;
        int fpu_to_mem;
        int modreg;
        uint32_t tmp[3];

        /* move to/from control registers */
        reglist = (insn->is_word1 & 0x1c00) >> 10;
        /* Bit 13 selects direction (FPU to/from Mem) */
        fpu_to_mem = insn->is_word1 & 0x2000;

        /* Check an illegal mod/reg. */
        modreg = insn->is_opcode & 077;
        if (fpu_to_mem) {
                /* PCrel, #imm are illegal. */
                if (modreg >= 072) {
                        return SIGILL;
                }
        } else {
                /* All mod/reg can be specified. */
                if (modreg >= 075) {
                        return SIGILL;
                }
        }

        /*
         * If reglist is 0b000, treat it as FPIAR.  This is not specification
         * but the behavior described in the 6888x user's manual.
         */
        if (reglist == 0)
                reglist = 1;

        if (reglist == 7) {
                regcount = 3;
        } else if (reglist == 3 || reglist == 5 || reglist == 6) {
                regcount = 2;
        } else {
                regcount = 1;
        }
        insn->is_datasize = regcount * 4;
        sig = fpu_decode_ea(frame, insn, &insn->is_ea, modreg);
        if (sig)
                return sig;

        /*
         * For data register, only single register can be transferred.
         * For addr register, only FPIAR can be transferred.
         */
        if ((insn->is_ea.ea_flags & EA_DIRECT)) {
                if (insn->is_ea.ea_regnum < 8) {
                        if (regcount != 1) {
                                return SIGILL;
                        }
                } else {
                        if (reglist != 1) {
                                return SIGILL;
                        }
                }
        }

        if (fpu_to_mem) {
                uint32_t *s = &tmp[0];

                if ((reglist & 4)) {
                        *s++ = fpf->fpf_fpcr;
                }
                if ((reglist & 2)) {
                        *s++ = fpf->fpf_fpsr;
                }
                if ((reglist & 1)) {
                        *s++ = fpf->fpf_fpiar;
                }

                sig = fpu_store_ea(frame, insn, &insn->is_ea, (char *)tmp);
        } else {
                const uint32_t *d = &tmp[0];

                sig = fpu_load_ea(frame, insn, &insn->is_ea, (char *)tmp);
                if (sig)
                        return sig;

                if ((reglist & 4)) {
                        fpf->fpf_fpcr = *d++;
                        fpf->fpf_fpcr &= 0x0000fff0;
                }
                if ((reglist & 2)) {
                        fpf->fpf_fpsr = *d++;
                        fpf->fpf_fpsr &= 0x0ffffff8;
                }
                if ((reglist & 1)) {
                        fpf->fpf_fpiar = *d++;
                }
        }
        return sig;
}

/*
 * type 0: fmovem
 * Separated out of fpu_emul_type0 for efficiency.
 * In this function, we know:
 *   (opcode & 0x01C0) == 0
 *   (word1 & 0x8000) == 0x8000
 *
 * No conversion or rounding is done by this instruction,
 * and the FPSR is not affected.
 */
static int
fpu_emul_fmovm(struct fpemu *fe, struct instruction *insn)
{
        struct frame *frame = fe->fe_frame;
        struct fpframe *fpf = fe->fe_fpframe;
        int word1, sig;
        int reglist, regmask, regnum;
        int modreg;
        int fpu_to_mem, order;
        /* int w1_post_incr; */
        int *fpregs;

        insn->is_datasize = 12;
        word1 = insn->is_word1;

        /* Bit 13 selects direction (FPU to/from Mem) */
        fpu_to_mem = word1 & 0x2000;

        /*
         * Bits 12,11 select register list mode:
         * 0,0: Static  reg list, pre-decr.
         * 0,1: Dynamic reg list, pre-decr.
         * 1,0: Static  reg list, post-incr.
         * 1,1: Dynamic reg list, post-incr
         */
        /* w1_post_incr = word1 & 0x1000; */
        if (word1 & 0x0800) {
                /* dynamic reg list */
                reglist = frame->f_regs[(word1 & 0x70) >> 4];
        } else {
                reglist = word1;
        }
        reglist &= 0xFF;

        /* Check an illegal mod/reg. */
        modreg = insn->is_opcode & 077;
        if (fpu_to_mem) {
                /* Dn, An, (An)+, PCrel, #imm are illegal. */
                if (modreg < 020 || (modreg >> 3) == 3 || modreg >= 072) {
                        return SIGILL;
                }
        } else {
                /* Dn, An, -(An), #imm are illegal. */
                if (modreg < 020 || (modreg >> 3) == 4 || modreg >= 074) {
                        return SIGILL;
                }
        }

        /* Get effective address. */
        sig = fpu_decode_ea(frame, insn, &insn->is_ea, modreg);
        if (sig)
                return sig;

        /* Get address of soft coprocessor regs. */
        fpregs = &fpf->fpf_regs[0];

        if (insn->is_ea.ea_flags & EA_PREDECR) {
                regnum = 7;
                order = -1;
        } else {
                regnum = 0;
                order = 1;
        }

        regmask = 0x80;
        while ((0 <= regnum) && (regnum < 8)) {
                if (regmask & reglist) {
                        if (fpu_to_mem) {
                                sig = fpu_store_ea(frame, insn, &insn->is_ea,
                                    (char *)&fpregs[regnum * 3]);
                                DPRINTF(("%s: FP%d (%08x,%08x,%08x) saved\n",
                                    __func__, regnum,
                                    fpregs[regnum * 3],
                                    fpregs[regnum * 3 + 1],
                                    fpregs[regnum * 3 + 2]));
                        } else {                /* mem to fpu */
                                sig = fpu_load_ea(frame, insn, &insn->is_ea,
                                    (char *)&fpregs[regnum * 3]);
                                DPRINTF(("%s: FP%d (%08x,%08x,%08x) loaded\n",
                                    __func__, regnum,
                                    fpregs[regnum * 3],
                                    fpregs[regnum * 3 + 1],
                                    fpregs[regnum * 3 + 2]));
                        }
                        if (sig)
                                break;
                }
                regnum += order;
                regmask >>= 1;
        }

        return sig;
}

struct fpn *
fpu_cmp(struct fpemu *fe)
{
        struct fpn *x = &fe->fe_f1, *y = &fe->fe_f2;

        /* take care of special cases */
        if (x->fp_class < 0 || y->fp_class < 0) {
                /* if either of two is a SNAN, result is SNAN */
                x->fp_class =
                    (y->fp_class < x->fp_class) ? y->fp_class : x->fp_class;
        } else if (x->fp_class == FPC_INF) {
                if (y->fp_class == FPC_INF) {
                        /* both infinities */
                        if (x->fp_sign == y->fp_sign) {
                                /* return a signed zero */
                                x->fp_class = FPC_ZERO;
                        } else {
                                /* return a faked number w/x's sign */
                                x->fp_class = FPC_NUM;
                                x->fp_exp = 16383;
                                x->fp_mant[0] = FP_1;
                        }
                } else {
                        /* y is a number */
                        /* return a forged number w/x's sign */
                        x->fp_class = FPC_NUM;
                        x->fp_exp = 16383;
                        x->fp_mant[0] = FP_1;
                }
        } else if (y->fp_class == FPC_INF) {
                /* x is a Num but y is an Inf */
                /* return a forged number w/y's sign inverted */
                x->fp_class = FPC_NUM;
                x->fp_sign = !y->fp_sign;
                x->fp_exp = 16383;
                x->fp_mant[0] = FP_1;
        } else {
                /*
                 * x and y are both numbers or zeros,
                 * or pair of a number and a zero
                 */
                y->fp_sign = !y->fp_sign;
                x = fpu_add(fe);        /* (x - y) */
                /*
                 * FCMP does not set Inf bit in CC, so return a forged number
                 * (value doesn't matter) if Inf is the result of fsub.
                 */
                if (x->fp_class == FPC_INF) {
                        x->fp_class = FPC_NUM;
                        x->fp_exp = 16383;
                        x->fp_mant[0] = FP_1;
                }
        }
        return x;
}

/*
 * arithmetic operations
 */
static int
fpu_emul_arith(struct fpemu *fe, struct instruction *insn)
{
        struct frame *frame = fe->fe_frame;
        uint32_t *fpregs = &(fe->fe_fpframe->fpf_regs[0]);
        struct fpn *res;
        int word1, sig = 0;
        int regnum, format;
        int modreg;
        int discard_result = 0;
        uint32_t buf[3];
#ifdef DEBUG_FPE
        int flags;
        char regname;
#endif

        fe->fe_fpsr &= ~FPSR_EXCP;

        DUMP_INSN(insn);

        DPRINTF(("%s: FPSR = %08x, FPCR = %08x\n", __func__,
            fe->fe_fpsr, fe->fe_fpcr));

        word1 = insn->is_word1;
        format = (word1 >> 10) & 7;
        regnum = (word1 >> 7) & 7;

        /* fetch a source operand : may not be used */
        DPRINTF(("%s: dst/src FP%d=%08x,%08x,%08x\n", __func__,
            regnum, fpregs[regnum * 3], fpregs[regnum * 3 + 1],
            fpregs[regnum * 3 + 2]));

        fpu_explode(fe, &fe->fe_f1, FTYPE_EXT, &fpregs[regnum * 3]);

        DUMP_INSN(insn);

        /* get the other operand which is always the source */
        if ((word1 & 0x4000) == 0) {
                DPRINTF(("%s: FP%d op FP%d => FP%d\n", __func__,
                    format, regnum, regnum));
                DPRINTF(("%s: src opr FP%d=%08x,%08x,%08x\n", __func__,
                    format, fpregs[format * 3], fpregs[format * 3 + 1],
                    fpregs[format * 3 + 2]));
                fpu_explode(fe, &fe->fe_f2, FTYPE_EXT, &fpregs[format * 3]);
        } else {
                /* the operand is in memory */
                if (format == FTYPE_DBL) {
                        insn->is_datasize = 8;
                } else if (format == FTYPE_SNG || format == FTYPE_LNG) {
                        insn->is_datasize = 4;
                } else if (format == FTYPE_WRD) {
                        insn->is_datasize = 2;
                } else if (format == FTYPE_BYT) {
                        insn->is_datasize = 1;
                } else if (format == FTYPE_EXT) {
                        insn->is_datasize = 12;
                } else {
                        /* invalid or unsupported operand format */
                        sig = SIGFPE;
                        return sig;
                }

                /* Check an illegal mod/reg. */
                modreg = insn->is_opcode & 077;
                if ((modreg >> 3) == 1/*An*/ || modreg >= 075) {
                        return SIGILL;
                }

                /* Get effective address. */
                sig = fpu_decode_ea(frame, insn, &insn->is_ea, modreg);
                if (sig) {
                        DPRINTF(("%s: error in fpu_decode_ea\n", __func__));
                        return sig;
                }

                if (insn->is_ea.ea_flags == EA_DIRECT &&
                    insn->is_datasize > 4) {
                        DPRINTF(("%s: attempted to fetch dbl/ext from reg\n",
                            __func__));
                        return SIGILL;
                }

                DUMP_INSN(insn);

#ifdef DEBUG_FPE
                printf("%s: addr mode = ", __func__);
                flags = insn->is_ea.ea_flags;
                regname = (insn->is_ea.ea_regnum & 8) ? 'a' : 'd';

                if (flags & EA_DIRECT) {
                        printf("%c%d\n", regname, insn->is_ea.ea_regnum & 7);
                } else if (flags & EA_PC_REL) {
                        if (flags & EA_OFFSET) {
                                printf("pc@(%d)\n", insn->is_ea.ea_offset);
                        } else if (flags & EA_INDEXED) {
                                printf("pc@(...)\n");
                        }
                } else if (flags & EA_PREDECR) {
                        printf("%c%d@-\n", regname, insn->is_ea.ea_regnum & 7);
                } else if (flags & EA_POSTINCR) {
                        printf("%c%d@+\n", regname, insn->is_ea.ea_regnum & 7);
                } else if (flags & EA_OFFSET) {
                        printf("%c%d@(%d)\n", regname,
                            insn->is_ea.ea_regnum & 7,
                            insn->is_ea.ea_offset);
                } else if (flags & EA_INDEXED) {
                        printf("%c%d@(...)\n", regname,
                            insn->is_ea.ea_regnum & 7);
                } else if (flags & EA_ABS) {
                        printf("0x%08x\n", insn->is_ea.ea_absaddr);
                } else if (flags & EA_IMMED) {
                        printf("#0x%08x,%08x,%08x\n",
                            insn->is_ea.ea_immed[0],
                            insn->is_ea.ea_immed[1],
                            insn->is_ea.ea_immed[2]);
                } else {
                        printf("%c%d@\n", regname, insn->is_ea.ea_regnum & 7);
                }
#endif /* DEBUG_FPE */

                fpu_load_ea(frame, insn, &insn->is_ea, (char*)buf);
                if (format == FTYPE_WRD) {
                        /* sign-extend */
                        buf[0] &= 0xffff;
                        if (buf[0] & 0x8000)
                                buf[0] |= 0xffff0000;
                        format = FTYPE_LNG;
                } else if (format == FTYPE_BYT) {
                        /* sign-extend */
                        buf[0] &= 0xff;
                        if (buf[0] & 0x80)
                                buf[0] |= 0xffffff00;
                        format = FTYPE_LNG;
                }
                DPRINTF(("%s: src = %08x %08x %08x, siz = %d\n", __func__,
                    buf[0], buf[1], buf[2], insn->is_datasize));
                fpu_explode(fe, &fe->fe_f2, format, buf);
        }

        DUMP_INSN(insn);

        /*
         * An arithmetic instruction emulate function has a prototype of
         * struct fpn *fpu_op(struct fpemu *);
         *
         * 1) If the instruction is monadic, then fpu_op() must use
         *    fe->fe_f2 as its operand, and return a pointer to the
         *    result.
         *
         * 2) If the instruction is diadic, then fpu_op() must use
         *    fe->fe_f1 and fe->fe_f2 as its two operands, and return a
         *    pointer to the result.
         *
         */
        res = NULL;
        switch (word1 & 0x7f) {
        case 0x00:              /* fmove */
                res = &fe->fe_f2;
                break;

        case 0x01:              /* fint */
                res = fpu_int(fe);
                break;

        case 0x02:              /* fsinh */
                res = fpu_sinh(fe);
                break;

        case 0x03:              /* fintrz */
                res = fpu_intrz(fe);
                break;

        case 0x04:              /* fsqrt */
                res = fpu_sqrt(fe);
                break;

        case 0x06:              /* flognp1 */
                res = fpu_lognp1(fe);
                break;

        case 0x08:              /* fetoxm1 */
                res = fpu_etoxm1(fe);
                break;

        case 0x09:              /* ftanh */
                res = fpu_tanh(fe);
                break;

        case 0x0A:              /* fatan */
                res = fpu_atan(fe);
                break;

        case 0x0C:              /* fasin */
                res = fpu_asin(fe);
                break;

        case 0x0D:              /* fatanh */
                res = fpu_atanh(fe);
                break;

        case 0x0E:              /* fsin */
                res = fpu_sin(fe);
                break;

        case 0x0F:              /* ftan */
                res = fpu_tan(fe);
                break;

        case 0x10:              /* fetox */
                res = fpu_etox(fe);
                break;

        case 0x11:              /* ftwotox */
                res = fpu_twotox(fe);
                break;

        case 0x12:              /* ftentox */
                res = fpu_tentox(fe);
                break;

        case 0x14:              /* flogn */
                res = fpu_logn(fe);
                break;

        case 0x15:              /* flog10 */
                res = fpu_log10(fe);
                break;

        case 0x16:              /* flog2 */
                res = fpu_log2(fe);
                break;

        case 0x18:              /* fabs */
                fe->fe_f2.fp_sign = 0;
                res = &fe->fe_f2;
                break;

        case 0x19:              /* fcosh */
                res = fpu_cosh(fe);
                break;

        case 0x1A:              /* fneg */
                fe->fe_f2.fp_sign = !fe->fe_f2.fp_sign;
                res = &fe->fe_f2;
                break;

        case 0x1C:              /* facos */
                res = fpu_acos(fe);
                break;

        case 0x1D:              /* fcos */
                res = fpu_cos(fe);
                break;

        case 0x1E:              /* fgetexp */
                res = fpu_getexp(fe);
                break;

        case 0x1F:              /* fgetman */
                res = fpu_getman(fe);
                break;

        case 0x20:              /* fdiv */
        case 0x24:              /* fsgldiv: cheating - better than nothing */
                res = fpu_div(fe);
                break;

        case 0x21:              /* fmod */
                res = fpu_mod(fe);
                break;

        case 0x28:              /* fsub */
                fe->fe_f2.fp_sign = !fe->fe_f2.fp_sign; /* f2 = -f2 */
                /* FALLTHROUGH */
        case 0x22:              /* fadd */
                res = fpu_add(fe);
                break;

        case 0x23:              /* fmul */
        case 0x27:              /* fsglmul: cheating - better than nothing */
                res = fpu_mul(fe);
                break;

        case 0x25:              /* frem */
                res = fpu_rem(fe);
                break;

        case 0x26:
                /* fscale is handled by a separate function */
                break;

        case 0x30:
        case 0x31:
        case 0x32:
        case 0x33:
        case 0x34:
        case 0x35:
        case 0x36:
        case 0x37:              /* fsincos */
                res = fpu_sincos(fe, word1 & 7);
                break;

        case 0x38:              /* fcmp */
                res = fpu_cmp(fe);
                discard_result = 1;
                break;

        case 0x3A:              /* ftst */
                res = &fe->fe_f2;
                discard_result = 1;
                break;

        default:                /* possibly 040/060 instructions */
                DPRINTF(("%s: bad opcode=0x%x, word1=0x%x\n", __func__,
                    insn->is_opcode, insn->is_word1));
                sig = SIGILL;
        }

        /* for sanity */
        if (res == NULL)
                sig = SIGILL;

        if (sig == 0) {
                if (!discard_result)
                        fpu_implode(fe, res, FTYPE_EXT, &fpregs[regnum * 3]);

                /* update fpsr according to the result of operation */
                fpu_upd_fpsr(fe, res);
#ifdef DEBUG_FPE
                if (!discard_result) {
                        printf("%s: %08x,%08x,%08x stored in FP%d\n", __func__,
                            fpregs[regnum * 3],
                            fpregs[regnum * 3 + 1],
                            fpregs[regnum * 3 + 2],
                            regnum);
                } else {
                        static const char *class_name[] =
                            { "SNAN", "QNAN", "ZERO", "NUM", "INF" };
                        printf("%s: result(%s,%c,%d,%08x,%08x,%08x) "
                            "discarded\n", __func__,
                            class_name[res->fp_class + 2],
                            res->fp_sign ? '-' : '+', res->fp_exp,
                            res->fp_mant[0], res->fp_mant[1],
                            res->fp_mant[2]);
                }
#endif
        } else {
                DPRINTF(("%s: received signal %d\n", __func__, sig));
        }

        DPRINTF(("%s: FPSR = %08x, FPCR = %08x\n", __func__,
            fe->fe_fpsr, fe->fe_fpcr));

        DUMP_INSN(insn);

        return sig;
}

/*
 * test condition code according to the predicate in the opcode.
 * returns -1 when the predicate evaluates to true, 0 when false.
 * signal numbers are returned when an error is detected.
 */
static int
test_cc(struct fpemu *fe, int pred)
{
        int result, sig_bsun;
        int fpsr;

        fpsr = fe->fe_fpsr;
        DPRINTF(("%s: fpsr=0x%08x\n", __func__, fpsr));
        pred &= 0x3f;           /* lowest 6 bits */

        DPRINTF(("%s: ", __func__));

        if (pred >= 0x20) {
                DPRINTF(("Illegal condition code\n"));
                return SIGILL;
        } else if (pred & 0x10) {
                /* IEEE nonaware tests */
                sig_bsun = 1;
                pred &= 0x0f;           /* lower 4 bits */
        } else {
                /* IEEE aware tests */
                DPRINTF(("IEEE "));
                sig_bsun = 0;
        }

        /*
         *           condition   real 68882
         * mnemonic  in manual   condition
         * --------  ----------  ----------
         * 0000 F    0           <-         = ~NAN &  0 & ~Z | 0
         * 0001 EQ   Z           <-         = ~NAN &  0 |  Z | 0
         * 0010 OGT  ~(NAN|Z|N)  <-         = ~NAN & ~N & ~Z | 0
         * 0011 OGE  Z|~(NAN|N)  <-         = ~NAN & ~N |  Z | 0
         * 0100 OLT  N&~(NAN|Z)  <-         = ~NAN &  N & ~Z | 0
         * 0101 OLE  Z|(N&~NAN)  <-         = ~NAN &  N |  Z | 0
         * 0110 OGL  ~(NAN|Z)    <-         = ~NAN &  1 & ~Z | 0
         * 0111 OR   ~NAN        Z|~NAN     = ~NAN &  1 |  Z | 0
         *
         * 1000 UN   NAN         <-         =  1   &  0 & ~Z | NAN
         * 1001 UEQ  NAN|Z       <-         =  1   &  0 |  Z | NAN
         * 1010 UGT  NAN|~(N|Z)  <-         =  1   & ~N & ~Z | NAN
         * 1011 UGE  NAN|(Z|~N)  <-         =  1   & ~N |  Z | NAN
         * 1100 ULT  NAN|(N&~Z)  <-         =  1   &  N & ~Z | NAN
         * 1101 ULE  NAN|(Z|N)   <-         =  1   &  N |  Z | NAN
         * 1110 NE   ~Z          NAN|(~Z)   =  1   &  1 & ~Z | NAN
         * 1111 T    1           <-         =  1   &  1 |  Z | NAN
         */
        if ((pred & 0x08) == 0) {
                result = ((fpsr & FPSR_NAN) == 0);
        } else {
                result = 1;
        }
        switch (pred & 0x06) {
        case 0x00:      /* AND 0 */
                result &= 0;
                break;
        case 0x02:      /* AND ~N */
                result &= ((fpsr & FPSR_NEG) == 0);
                break;
        case 0x04:      /* AND N */
                result &= ((fpsr & FPSR_NEG) != 0);
                break;
        case 0x06:      /* AND 1 */
                result &= 1;
                break;
        }
        if ((pred & 0x01) == 0) {
                result &= ((fpsr & FPSR_ZERO) == 0);
        } else {
                result |= ((fpsr & FPSR_ZERO) != 0);
        }
        if ((pred & 0x08) != 0) {
                result |= ((fpsr & FPSR_NAN) != 0);
        }

        DPRINTF(("=> %s (%d)\n", result ? "true" : "false", result));
        /* if it's an IEEE unaware test and NAN is set, BSUN is set */
        if (sig_bsun && (fpsr & FPSR_NAN)) {
                fpsr |= FPSR_BSUN;
        }
        /* if BSUN is set, IOP is set too */
        if ((fpsr & FPSR_BSUN)) {
                fpsr |= FPSR_AIOP;
        }

        /* put fpsr back */
        fe->fe_fpframe->fpf_fpsr = fe->fe_fpsr = fpsr;

        return -result;
}

/*
 * type 1: fdbcc, fscc, ftrapcc
 * In this function, we know:
 *   (opcode & 0x01C0) == 0x0040
 * return SIGILL for an illegal instruction.
 * return SIGFPE if FTRAPcc's condition is met.
 */
static int
fpu_emul_type1(struct fpemu *fe, struct instruction *insn)
{
        struct frame *frame = fe->fe_frame;
        int advance, sig, branch, displ;
        unsigned short sval;

        branch = test_cc(fe, insn->is_word1);
        if (branch > 0)
                return branch;
        fe->fe_fpframe->fpf_fpsr = fe->fe_fpsr;

        sig = 0;
        switch (insn->is_opcode & 070) {
        case 010:                       /* fdbcc */
                if (branch) {
                        /* advance */
                        insn->is_advance = 6;
                } else {
                        /* decrement Dn and if (Dn != -1) branch */
                        uint16_t count = frame->f_regs[insn->is_opcode & 7];

                        if (count-- != 0) {
                                if (ufetch_short((void *)(insn->is_pc +
                                                           insn->is_advance),
                                                  &sval)) {
                                        DPRINTF(("%s: fault reading "
                                            "displacement\n", __func__));
                                        return SIGSEGV;
                                }
                                displ = sval;
                                /* sign-extend the displacement */
                                displ &= 0xffff;
                                if (displ & 0x8000) {
                                        displ |= 0xffff0000;
                                }
                                insn->is_advance += displ;
#if 0                           /* XXX */
                                insn->is_nextpc = insn->is_pc +
                                    insn->is_advance;
#endif
                        } else {
                                insn->is_advance = 6;
                        }
                        /* write it back */
                        frame->f_regs[insn->is_opcode & 7] &= 0xffff0000;
                        frame->f_regs[insn->is_opcode & 7] |= (uint32_t)count;
                }
                break;

        case 070:                       /* ftrapcc or fscc */
                advance = 4;
                if ((insn->is_opcode & 07) >= 2) {
                        switch (insn->is_opcode & 07) {
                        case 3:         /* long opr */
                                advance += 2;
                        case 2:         /* word opr */
                                advance += 2;
                        case 4:         /* no opr */
                                break;
                        default:
                                return SIGILL;
                                break;
                        }
                        insn->is_advance = advance;

                        if (branch) {
                                /* trap */
                                sig = SIGFPE;
                        }
                        break;
                }

                /* FALLTHROUGH */
        default:                        /* fscc */
                insn->is_datasize = 1;  /* always byte */
                sig = fpu_decode_ea(frame, insn, &insn->is_ea, insn->is_opcode);
                if (sig) {
                        break;
                }
                /* set result */
                sig = fpu_store_ea(frame, insn, &insn->is_ea, (char *)&branch);
                break;
        }
        return sig;
}

/*
 * Type 2 or 3: fbcc (also fnop)
 * In this function, we know:
 *   (opcode & 0x0180) == 0x0080
 */
static int
fpu_emul_brcc(struct fpemu *fe, struct instruction *insn)
{
        int displ, word2;
        int sig;
        unsigned short sval;

        /*
         * Get branch displacement.
         */
        displ = insn->is_word1;

        if (insn->is_opcode & 0x40) {
                if (ufetch_short((void *)(insn->is_pc + insn->is_advance),
                                  &sval)) {
                        DPRINTF(("%s: fault reading word2\n", __func__));
                        return SIGSEGV;
                }
                word2 = sval;
                displ <<= 16;
                displ |= word2;
                insn->is_advance += 2;
        } else {
                /* displacement is word sized */
                if (displ & 0x8000)
                        displ |= 0xFFFF0000;
        }

        /* XXX: If CC, insn->is_pc += displ */
        sig = test_cc(fe, insn->is_opcode);
        fe->fe_fpframe->fpf_fpsr = fe->fe_fpsr;

        if (fe->fe_fpsr & fe->fe_fpcr & FPSR_EXCP) {
                return SIGFPE;          /* caught an exception */
        }
        if (sig == -1) {
                /*
                 * branch does take place; 2 is the offset to the 1st disp word
                 */
                insn->is_advance = displ + 2;
#if 0           /* XXX */
                insn->is_nextpc = insn->is_pc + insn->is_advance;
#endif
        } else if (sig)
                return SIGILL;          /* got a signal */
        DPRINTF(("%s: %s insn @ %x (%x+%x) (disp=%x)\n", __func__,
            (sig == -1) ? "BRANCH to" : "NEXT",
            insn->is_pc + insn->is_advance, insn->is_pc, insn->is_advance,
            displ));
        return 0;
}