[apple/xnu.git] / osfmk / ppc / Emulate64.s

/*
 * Copyright (c) 2002 Apple Computer, Inc. All rights reserved.
 *
 * @APPLE_LICENSE_OSREFERENCE_HEADER_START@
 * 
 * This file contains Original Code and/or Modifications of Original Code 
 * as defined in and that are subject to the Apple Public Source License 
 * Version 2.0 (the 'License'). You may not use this file except in 
 * compliance with the License.  The rights granted to you under the 
 * License may not be used to create, or enable the creation or 
 * redistribution of, unlawful or unlicensed copies of an Apple operating 
 * system, or to circumvent, violate, or enable the circumvention or 
 * violation of, any terms of an Apple operating system software license 
 * agreement.
 *
 * Please obtain a copy of the License at 
 * http://www.opensource.apple.com/apsl/ and read it before using this 
 * file.
 *
 * The Original Code and all software distributed under the License are 
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 
 * Please see the License for the specific language governing rights and 
 * limitations under the License.
 *
 * @APPLE_LICENSE_OSREFERENCE_HEADER_END@
 */ 																							

/* Emulate64.s
 *
 * Software emulation of instructions not handled in hw, on 64-bit machines.
 */
 
#include <sys/appleapiopts.h>
#include <ppc/asm.h>
#include <ppc/proc_reg.h>
#include <ppc/exception.h>
#include <mach/machine/vm_param.h>
#include <ppc/cpu_capabilities.h>
#include <assym.s>

// CR bit set if the instruction is an "update" form (LFDU, STWU, etc):
#define	kUpdate	25

// CR bit set if interrupt occured in trace mode (ie, MSR_SE_BIT):
#define kTrace	8

// CR bit set if notification on alignment interrupts is requested (notifyUnalignbit in spcFlags):
#define	kNotify	9

// CR bit distinguishes between alignment and program exceptions:
#define	kAlignment	10


// *************************************
// * P R O G R A M   I N T E R R U P T *
// *************************************
//
// These are floating pt exceptions, illegal instructions, privileged mode violations,
// and traps.  All we're interested in at this low level is illegal instructions.
// The ones we "emulate" are:
//		DCBA,  which is not implemented in the IBM 970.  The emulation is to ignore it,
//			   as it is just a hint.
//		MCRXR, which is not implemented on the IBM 970, but is in the PPC ISA.
//
// Additionally, to facilitate debugging the alignment handler, we recognize a special
// diagnostic mode that is used to simulate alignment exceptions.  When in this mode,
// if the instruction has opcode==0 and the extended opcode is one of the X-form
// instructions that can take an alignment interrupt, then we change the opcode to
// 31 and pretend it got an alignment interrupt.  This exercises paths that
// are hard to drive or perhaps never driven on this particular CPU.

        .text
        .globl	EXT(Emulate64)
        .align	5
LEXT(Emulate64)
        crclr	kAlignment						// not an alignment exception
        b		a64AlignAssistJoin				// join alignment handler
        
        
// Return from alignment handler with all the regs loaded for opcode emulation.
        
a64HandleProgramInt:
        rlwinm.	r0,r29,0,SRR1_PRG_ILL_INS_BIT,SRR1_PRG_ILL_INS_BIT	// illegal opcode?
        beq		a64PassAlong					// No, must have been trap or priv violation etc
        rlwinm	r3,r20,6,26,31					// right justify opcode field (bits 0-5)
        rlwinm	r4,r20,31,22,31					// right justify extended opcode field (bits 21-30)
        cmpwi	cr0,r3,31						// X-form?
        cmpwi	cr1,r4,758						// DCBA?
        cmpwi	cr4,r4,512						// MCRXR?
        crand	cr1_eq,cr0_eq,cr1_eq			// merge the two tests for DCBA
        crand	cr4_eq,cr0_eq,cr4_eq			// and for MCRXR
        beq++	cr1_eq,a64ExitEm				// was DCBA, so ignore
        bne--	cr4_eq,a64NotEmulated			// skip if not MCRXR
        
// Was MCRXR, so emulate.

        ld		r3,savexer(r13)					// get the XER
        lwz		r4,savecr(r13)					// and the CR
        rlwinm	r5,r20,11,27,29					// get (CR# * 4) from instruction
        rlwinm	r6,r3,0,4,31					// zero XER[32-35] (also XER[0-31])
        sld		r4,r4,r5						// move target CR field to bits 32-35
        rlwimi	r4,r3,0,0,3						// move XER[32-35] into CR field
        stw		r6,savexer+4(r13)				// update XER
        srd		r4,r4,r5						// re-position CR
        stw		r4,savecr(r13)					// update CR
        b		a64ExitEm						// done

// Not an opcode we normally emulate.  If in special diagnostic mode and opcode=0,
// emulate as an alignment exception.  This special case is for test software.

a64NotEmulated:
        lwz		r30,dgFlags(0)					// Get the flags
        rlwinm.	r0,r30,0,enaDiagEMb,enaDiagEMb	// Do we want to try to emulate something?
        beq++	a64PassAlong					// No emulation allowed
        cmpwi	r3,0							// opcode==0 ?
        bne		a64PassAlong					// not the special case
        oris	r20,r20,0x7C00					// change opcode to 31
        crset	kAlignment						// say we took alignment exception
        rlwinm	r5,r4,0,26+1,26-1				// mask Update bit (32) out of extended opcode
        rlwinm	r5,r5,0,0,31					// Clean out leftover junk from rlwinm

        cmpwi	r4,1014							// dcbz/dcbz128 ?
        crmove	cr1_eq,cr0_eq
        cmpwi	r5,21							// ldx/ldux ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r5,599							// lfdx/lfdux ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r5,535							// lfsx/lfsux ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r5,343							// lhax/lhaux ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r4,790							// lhbrx ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r5,279							// lhzx/lhzux ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r4,597							// lswi ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r4,533							// lswx ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r5,341							// lwax/lwaux ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r4,534							// lwbrx ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r5,23							// lwz/lwzx ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r5,149							// stdx/stdux ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r5,727							// stfdx/stfdux ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r4,983							// stfiwx ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r5,663							// stfsx/stfsux ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r4,918							// sthbrx ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r5,407							// sthx/sthux ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r4,725							// stswi ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r4,661							// stswx ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r4,662							// stwbrx ?
        cror	cr1_eq,cr0_eq,cr1_eq
        cmpwi	r5,151							// stwx/stwux ?
        cror	cr1_eq,cr0_eq,cr1_eq
        
        beq++	cr1,a64GotInstruction			// it was one of the X-forms we handle
        crclr	kAlignment						// revert to program interrupt
        b		a64PassAlong					// not recognized extended opcode
        

// *****************************************
// * A L I G N M E N T   I N T E R R U P T *
// *****************************************
//
// We get here in exception context, ie with interrupts disabled, translation off, and
// in 64-bit mode, with:
//		r13 = save-area pointer, with general context already saved in it
//		cr6 = feature flags
// We preserve r13 and cr6.  Other GPRs and CRs, the LR and CTR are used.
//
// Current 64-bit processors (GPUL) handle almost all misaligned operations in hardware,
// so this routine usually isn't called very often.  Only floating pt ops that cross a page
// boundary and are not word aligned, and LMW/STMW can take exceptions to cacheable memory.
// However, in contrast to G3 and G4, any misaligned load/store will get an alignment
// interrupt on uncached memory.
//
// We always emulate scalar ops with a series of byte load/stores.  Doing so is no slower
// than LWZ/STW in cases where a scalar op gets an alignment exception.
//
// This routine supports all legal permutations of alignment interrupts occuring in user or
// supervisor mode, 32 or 64-bit addressing, and translation on or off.  We do not emulate
// instructions that go past the end of an address space, such as "LHZ -1(0)"; we just pass
// along the alignment exception rather than wrap around to byte 0.
//
// First, check for a few special cases such as virtual machines, etc.

        .globl	EXT(AlignAssist64)
        .align	5
LEXT(AlignAssist64)
        crset	kAlignment								// mark as alignment interrupt

a64AlignAssistJoin:										// join here from program interrupt handler
      	li		r0,0									// Get a 0
        mfsprg	r31,0									// get the per_proc data ptr
        mcrf	cr3,cr6									// save feature flags here...
        lwz		r21,spcFlags(r31)						// grab the special flags
        ld		r29,savesrr1(r13)						// get the MSR etc at the fault
        ld		r28,savesrr0(r13)						// get the EA of faulting instruction
       	stw		r0,savemisc3(r13)						// Assume we will handle this ok
        mfmsr	r26										// save MSR at entry
        rlwinm.	r0,r21,0,runningVMbit,runningVMbit		// Are we running a VM?
        lwz		r19,dgFlags(0)							// Get the diagnostics flags
        bne--	a64PassAlong							// yes, let the virtual machine monitor handle


// Set up the MSR shadow regs.  We turn on FP in this routine, and usually set DR and RI
// when accessing user space (the SLB is still set up with all the user space translations.)
// However, if the interrupt occured in the kernel with DR off, we keep it off while
// accessing the "target" address space.  If we set DR to access the target space, we also
// set RI.  The RI bit tells the exception handlers to clear cr0 beq and return if we get an
// exception accessing the user address space.  We are careful to test cr0 beq after every such
// access.  We keep the following "shadows" of the MSR in global regs across this code:
//		r25 = MSR at entry, plus FP and probably DR and RI (used to access target space)
//		r26 = MSR at entry
//		r27 = free
//		r29 = SRR1 (ie, MSR at interrupt)
// Note that EE and IR are always off, and SF is always on in this code.

		rlwinm	r3,r29,0,MSR_DR_BIT,MSR_DR_BIT			// was translation on at fault?
        rlwimi	r3,r3,32-MSR_RI_BIT+MSR_DR_BIT,MSR_RI_BIT,MSR_RI_BIT	// if DR was set, set RI too
        or		r25,r26,r3								// assemble MSR to use accessing target space
        

// Because the DSISR and DAR are either not set or are not to be trusted on some 64-bit
// processors on an alignment interrupt, we must fetch the faulting instruction ourselves,
// then decode/hash the opcode and reconstruct the EA manually.

        mtmsr	r25					// turn on FP and (if it was on at fault) DR and RI
        isync						// wait for it to happen
		cmpw	r0,r0				// turn on beq so we can check for DSIs
        lwz		r20,0(r28)			// fetch faulting instruction, probably with DR on
        bne--	a64RedriveAsISI		// got a DSI trying to fetch it, pretend it was an ISI
        mtmsr	r26					// turn DR back off
        isync						// wait for it to happen


// Set a few flags while we wait for the faulting instruction to arrive from cache.

        rlwinm.	r0,r29,0,MSR_SE_BIT,MSR_SE_BIT				// Were we single stepping?
		stw		r20,savemisc2(r13)	// Save the instruction image in case we notify
        crnot	kTrace,cr0_eq
        rlwinm.	r0,r19,0,enaNotifyEMb,enaNotifyEMb			// Should we notify?
        crnot	kNotify,cr0_eq        


// Hash the intruction into a 5-bit value "AAAAB" used to index the branch table, and a
// 1-bit kUpdate flag, as follows:
Commit	Line	Data
55e303ae A	1	/*
	2	* Copyright (c) 2002 Apple Computer, Inc. All rights reserved.
	3	*
8ad349bb	4	* @APPLE_LICENSE_OSREFERENCE_HEADER_START@
55e303ae	5	*
8ad349bb A	6	* This file contains Original Code and/or Modifications of Original Code
	7	* as defined in and that are subject to the Apple Public Source License
	8	* Version 2.0 (the 'License'). You may not use this file except in
	9	* compliance with the License. The rights granted to you under the
	10	* License may not be used to create, or enable the creation or
	11	* redistribution of, unlawful or unlicensed copies of an Apple operating
	12	* system, or to circumvent, violate, or enable the circumvention or
	13	* violation of, any terms of an Apple operating system software license
	14	* agreement.
	15	*
	16	* Please obtain a copy of the License at
	17	* http://www.opensource.apple.com/apsl/ and read it before using this
	18	* file.
	19	*
	20	* The Original Code and all software distributed under the License are
	21	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
	22	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
	23	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
	24	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
	25	* Please see the License for the specific language governing rights and
	26	* limitations under the License.
	27	*
	28	* @APPLE_LICENSE_OSREFERENCE_HEADER_END@
55e303ae A	29	*/
	30
	31	/* Emulate64.s
	32	*
	33	* Software emulation of instructions not handled in hw, on 64-bit machines.
	34	*/
	35
	36	#include <sys/appleapiopts.h>
55e303ae A	37	#include <ppc/asm.h>
	38	#include <ppc/proc_reg.h>
	39	#include <ppc/exception.h>
	40	#include <mach/machine/vm_param.h>
	41	#include <ppc/cpu_capabilities.h>
	42	#include <assym.s>
	43
	44	// CR bit set if the instruction is an "update" form (LFDU, STWU, etc):
	45	#define kUpdate 25
	46
	47	// CR bit set if interrupt occured in trace mode (ie, MSR_SE_BIT):
	48	#define kTrace 8
	49
	50	// CR bit set if notification on alignment interrupts is requested (notifyUnalignbit in spcFlags):
	51	#define kNotify 9
	52
	53	// CR bit distinguishes between alignment and program exceptions:
	54	#define kAlignment 10
	55
	56
	57
	58	// *************************************
	59	// * P R O G R A M I N T E R R U P T *
	60	// *************************************
	61	//
	62	// These are floating pt exceptions, illegal instructions, privileged mode violations,
	63	// and traps. All we're interested in at this low level is illegal instructions.
	64	// The ones we "emulate" are:
	65	// DCBA, which is not implemented in the IBM 970. The emulation is to ignore it,
	66	// as it is just a hint.
	67	// MCRXR, which is not implemented on the IBM 970, but is in the PPC ISA.
	68	//
	69	// Additionally, to facilitate debugging the alignment handler, we recognize a special
	70	// diagnostic mode that is used to simulate alignment exceptions. When in this mode,
	71	// if the instruction has opcode==0 and the extended opcode is one of the X-form
	72	// instructions that can take an alignment interrupt, then we change the opcode to
	73	// 31 and pretend it got an alignment interrupt. This exercises paths that
	74	// are hard to drive or perhaps never driven on this particular CPU.
	75
	76	.text
	77	.globl EXT(Emulate64)
	78	.align 5
	79	LEXT(Emulate64)
	80	crclr kAlignment // not an alignment exception
	81	b a64AlignAssistJoin // join alignment handler
	82
	83
	84	// Return from alignment handler with all the regs loaded for opcode emulation.
	85
	86	a64HandleProgramInt:
	87	rlwinm. r0,r29,0,SRR1_PRG_ILL_INS_BIT,SRR1_PRG_ILL_INS_BIT // illegal opcode?
	88	beq a64PassAlong // No, must have been trap or priv violation etc
	89	rlwinm r3,r20,6,26,31 // right justify opcode field (bits 0-5)
	90	rlwinm r4,r20,31,22,31 // right justify extended opcode field (bits 21-30)
	91	cmpwi cr0,r3,31 // X-form?
	92	cmpwi cr1,r4,758 // DCBA?
	93	cmpwi cr4,r4,512 // MCRXR?
	94	crand cr1_eq,cr0_eq,cr1_eq // merge the two tests for DCBA
	95	crand cr4_eq,cr0_eq,cr4_eq // and for MCRXR
	96	beq++ cr1_eq,a64ExitEm // was DCBA, so ignore
	97	bne-- cr4_eq,a64NotEmulated // skip if not MCRXR
	98
	99	// Was MCRXR, so emulate.
	100
101	ld r3,savexer(r13) // get the XER
102	lwz r4,savecr(r13) // and the CR
103	rlwinm r5,r20,11,27,29 // get (CR# * 4) from instruction
104	rlwinm r6,r3,0,4,31 // zero XER[32-35] (also XER[0-31])
105	sld r4,r4,r5 // move target CR field to bits 32-35
106	rlwimi r4,r3,0,0,3 // move XER[32-35] into CR field
107	stw r6,savexer+4(r13) // update XER
108	srd r4,r4,r5 // re-position CR
109	stw r4,savecr(r13) // update CR
110	b a64ExitEm // done
111
112	// Not an opcode we normally emulate. If in special diagnostic mode and opcode=0,
113	// emulate as an alignment exception. This special case is for test software.
114
115	a64NotEmulated:
116	lwz r30,dgFlags(0) // Get the flags
117	rlwinm. r0,r30,0,enaDiagEMb,enaDiagEMb // Do we want to try to emulate something?
118	beq++ a64PassAlong // No emulation allowed
119	cmpwi r3,0 // opcode==0 ?
120	bne a64PassAlong // not the special case
121	oris r20,r20,0x7C00 // change opcode to 31
122	crset kAlignment // say we took alignment exception
123	rlwinm r5,r4,0,26+1,26-1 // mask Update bit (32) out of extended opcode
124	rlwinm r5,r5,0,0,31 // Clean out leftover junk from rlwinm
125
126	cmpwi r4,1014 // dcbz/dcbz128 ?
127	crmove cr1_eq,cr0_eq
128	cmpwi r5,21 // ldx/ldux ?
129	cror cr1_eq,cr0_eq,cr1_eq
130	cmpwi r5,599 // lfdx/lfdux ?
131	cror cr1_eq,cr0_eq,cr1_eq
132	cmpwi r5,535 // lfsx/lfsux ?
133	cror cr1_eq,cr0_eq,cr1_eq
134	cmpwi r5,343 // lhax/lhaux ?
135	cror cr1_eq,cr0_eq,cr1_eq
136	cmpwi r4,790 // lhbrx ?
137	cror cr1_eq,cr0_eq,cr1_eq
138	cmpwi r5,279 // lhzx/lhzux ?
139	cror cr1_eq,cr0_eq,cr1_eq
140	cmpwi r4,597 // lswi ?
141	cror cr1_eq,cr0_eq,cr1_eq
142	cmpwi r4,533 // lswx ?
143	cror cr1_eq,cr0_eq,cr1_eq
144	cmpwi r5,341 // lwax/lwaux ?
145	cror cr1_eq,cr0_eq,cr1_eq
146	cmpwi r4,534 // lwbrx ?
147	cror cr1_eq,cr0_eq,cr1_eq
148	cmpwi r5,23 // lwz/lwzx ?
149	cror cr1_eq,cr0_eq,cr1_eq
150	cmpwi r5,149 // stdx/stdux ?
151	cror cr1_eq,cr0_eq,cr1_eq
152	cmpwi r5,727 // stfdx/stfdux ?
153	cror cr1_eq,cr0_eq,cr1_eq
154	cmpwi r4,983 // stfiwx ?
155	cror cr1_eq,cr0_eq,cr1_eq
156	cmpwi r5,663 // stfsx/stfsux ?
157	cror cr1_eq,cr0_eq,cr1_eq
158	cmpwi r4,918 // sthbrx ?
159	cror cr1_eq,cr0_eq,cr1_eq
160	cmpwi r5,407 // sthx/sthux ?
161	cror cr1_eq,cr0_eq,cr1_eq
162	cmpwi r4,725 // stswi ?
163	cror cr1_eq,cr0_eq,cr1_eq
164	cmpwi r4,661 // stswx ?
165	cror cr1_eq,cr0_eq,cr1_eq
166	cmpwi r4,662 // stwbrx ?
167	cror cr1_eq,cr0_eq,cr1_eq
168	cmpwi r5,151 // stwx/stwux ?
169	cror cr1_eq,cr0_eq,cr1_eq
170
171	beq++ cr1,a64GotInstruction // it was one of the X-forms we handle
172	crclr kAlignment // revert to program interrupt
173	b a64PassAlong // not recognized extended opcode
174
175
176	// *****************************************
177	// * A L I G N M E N T I N T E R R U P T *
178	// *****************************************
179	//
180	// We get here in exception context, ie with interrupts disabled, translation off, and
181	// in 64-bit mode, with:
182	// r13 = save-area pointer, with general context already saved in it
183	// cr6 = feature flags
184	// We preserve r13 and cr6. Other GPRs and CRs, the LR and CTR are used.
185	//
186	// Current 64-bit processors (GPUL) handle almost all misaligned operations in hardware,
187	// so this routine usually isn't called very often. Only floating pt ops that cross a page
188	// boundary and are not word aligned, and LMW/STMW can take exceptions to cacheable memory.
189	// However, in contrast to G3 and G4, any misaligned load/store will get an alignment
190	// interrupt on uncached memory.
191	//
192	// We always emulate scalar ops with a series of byte load/stores. Doing so is no slower
193	// than LWZ/STW in cases where a scalar op gets an alignment exception.
194	//
195	// This routine supports all legal permutations of alignment interrupts occuring in user or
196	// supervisor mode, 32 or 64-bit addressing, and translation on or off. We do not emulate
197	// instructions that go past the end of an address space, such as "LHZ -1(0)"; we just pass
91447636	198	// along the alignment exception rather than wrap around to byte 0.
55e303ae A	199	//
	200	// First, check for a few special cases such as virtual machines, etc.
	201
	202	.globl EXT(AlignAssist64)
	203	.align 5
	204	LEXT(AlignAssist64)
	205	crset kAlignment // mark as alignment interrupt
	206
	207	a64AlignAssistJoin: // join here from program interrupt handler
91447636	208	li r0,0 // Get a 0
55e303ae A	209	mfsprg r31,0 // get the per_proc data ptr
	210	mcrf cr3,cr6 // save feature flags here...
	211	lwz r21,spcFlags(r31) // grab the special flags
	212	ld r29,savesrr1(r13) // get the MSR etc at the fault
	213	ld r28,savesrr0(r13) // get the EA of faulting instruction
91447636	214	stw r0,savemisc3(r13) // Assume we will handle this ok
55e303ae A	215	mfmsr r26 // save MSR at entry
	216	rlwinm. r0,r21,0,runningVMbit,runningVMbit // Are we running a VM?
	217	lwz r19,dgFlags(0) // Get the diagnostics flags
	218	bne-- a64PassAlong // yes, let the virtual machine monitor handle
	219
	220
	221	// Set up the MSR shadow regs. We turn on FP in this routine, and usually set DR and RI
	222	// when accessing user space (the SLB is still set up with all the user space translations.)
	223	// However, if the interrupt occured in the kernel with DR off, we keep it off while
	224	// accessing the "target" address space. If we set DR to access the target space, we also
	225	// set RI. The RI bit tells the exception handlers to clear cr0 beq and return if we get an
	226	// exception accessing the user address space. We are careful to test cr0 beq after every such
	227	// access. We keep the following "shadows" of the MSR in global regs across this code:
	228	// r25 = MSR at entry, plus FP and probably DR and RI (used to access target space)
	229	// r26 = MSR at entry
	230	// r27 = free
	231	// r29 = SRR1 (ie, MSR at interrupt)
	232	// Note that EE and IR are always off, and SF is always on in this code.
	233
	234	rlwinm r3,r29,0,MSR_DR_BIT,MSR_DR_BIT // was translation on at fault?
	235	rlwimi r3,r3,32-MSR_RI_BIT+MSR_DR_BIT,MSR_RI_BIT,MSR_RI_BIT // if DR was set, set RI too
	236	or r25,r26,r3 // assemble MSR to use accessing target space
	237
	238
	239	// Because the DSISR and DAR are either not set or are not to be trusted on some 64-bit
	240	// processors on an alignment interrupt, we must fetch the faulting instruction ourselves,
	241	// then decode/hash the opcode and reconstruct the EA manually.
	242
	243	mtmsr r25 // turn on FP and (if it was on at fault) DR and RI
	244	isync // wait for it to happen
	245	cmpw r0,r0 // turn on beq so we can check for DSIs
	246	lwz r20,0(r28) // fetch faulting instruction, probably with DR on
	247	bne-- a64RedriveAsISI // got a DSI trying to fetch it, pretend it was an ISI
	248	mtmsr r26 // turn DR back off
	249	isync // wait for it to happen
	250
	251
	252	// Set a few flags while we wait for the faulting instruction to arrive from cache.
	253
	254	rlwinm. r0,r29,0,MSR_SE_BIT,MSR_SE_BIT // Were we single stepping?
	255	stw r20,savemisc2(r13) // Save the instruction image in case we notify
	256	crnot kTrace,cr0_eq
	257	rlwinm. r0,r19,0,enaNotifyEMb,enaNotifyEMb // Should we notify?
	258	crnot kNotify,cr0_eq
	259
	260
	261	// Hash the intruction into a 5-bit value "AAAAB" used to index the branch table, and a
	262	// 1-bit kUpdate flag, as follows:
	263