Archipelago » qemu

/*

 *  qemu user main

 *

 *  Copyright (c) 2003-2008 Fabrice Bellard

 *

 *  This program is free software; you can redistribute it and/or modify

 *  it under the terms of the GNU General Public License as published by

 *  the Free Software Foundation; either version 2 of the License, or

 *  (at your option) any later version.

 *

 *  This program is distributed in the hope that it will be useful,

 *  but WITHOUT ANY WARRANTY; without even the implied warranty of

 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 *  GNU General Public License for more details.

 *

 *  You should have received a copy of the GNU General Public License

 *  along with this program; if not, write to the Free Software

 *  Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston,

 *  MA 02110-1301, USA.

 */

#include <stdlib.h>

#include <stdio.h>

#include <stdarg.h>

#include <string.h>

#include <errno.h>

#include <unistd.h>

#include <sys/mman.h>

#include "qemu.h"

#include "qemu-common.h"

#include "cache-utils.h"

/* For tb_lock */

#include "exec-all.h"

#include "envlist.h"

#define DEBUG_LOGFILE "/tmp/qemu.log"

char *exec_path;

int singlestep;

static const char *interp_prefix = CONFIG_QEMU_PREFIX;

const char *qemu_uname_release = CONFIG_UNAME_RELEASE;

#if defined(__i386__) && !defined(CONFIG_STATIC)

/* Force usage of an ELF interpreter even if it is an ELF shared

   object ! */

const char interp[] __attribute__((section(".interp"))) = "/lib/ld-linux.so.2";

#endif

/* for recent libc, we add these dummy symbols which are not declared

   when generating a linked object (bug in ld ?) */

#if (__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 3)) && !defined(CONFIG_STATIC)

asm(".globl __preinit_array_start\n"

    ".globl __preinit_array_end\n"

    ".globl __init_array_start\n"

    ".globl __init_array_end\n"

    ".globl __fini_array_start\n"

    ".globl __fini_array_end\n"

    ".section \".rodata\"\n"

    "__preinit_array_start:\n"

    "__preinit_array_end:\n"

    "__init_array_start:\n"

    "__init_array_end:\n"

    "__fini_array_start:\n"

    "__fini_array_end:\n"

    ".long 0\n"

    ".previous\n");

#endif

/* XXX: on x86 MAP_GROWSDOWN only works if ESP <= address + 32, so

   we allocate a bigger stack. Need a better solution, for example

   by remapping the process stack directly at the right place */

unsigned long x86_stack_size = 512 * 1024;

void gemu_log(const char *fmt, ...)

{

    va_list ap;

    va_start(ap, fmt);

    vfprintf(stderr, fmt, ap);

    va_end(ap);

}

void cpu_outb(CPUState *env, int addr, int val)

{

    fprintf(stderr, "outb: port=0x%04x, data=%02x\n", addr, val);

}

void cpu_outw(CPUState *env, int addr, int val)

{

    fprintf(stderr, "outw: port=0x%04x, data=%04x\n", addr, val);

}

void cpu_outl(CPUState *env, int addr, int val)

{

    fprintf(stderr, "outl: port=0x%04x, data=%08x\n", addr, val);

}

int cpu_inb(CPUState *env, int addr)

{

    fprintf(stderr, "inb: port=0x%04x\n", addr);

    return 0;

}

int cpu_inw(CPUState *env, int addr)

{

    fprintf(stderr, "inw: port=0x%04x\n", addr);

    return 0;

}

int cpu_inl(CPUState *env, int addr)

{

    fprintf(stderr, "inl: port=0x%04x\n", addr);

    return 0;

}

#if defined(TARGET_I386)

int cpu_get_pic_interrupt(CPUState *env)

{

    return -1;

}

#endif

/* timers for rdtsc */

#if 0

static uint64_t emu_time;

int64_t cpu_get_real_ticks(void)

{

    return emu_time++;

}

#endif

#if defined(USE_NPTL)

/***********************************************************/

/* Helper routines for implementing atomic operations.  */

/* To implement exclusive operations we force all cpus to syncronise.

   We don't require a full sync, only that no cpus are executing guest code.

   The alternative is to map target atomic ops onto host equivalents,

   which requires quite a lot of per host/target work.  */

static pthread_mutex_t cpu_list_mutex = PTHREAD_MUTEX_INITIALIZER;

static pthread_mutex_t exclusive_lock = PTHREAD_MUTEX_INITIALIZER;

static pthread_cond_t exclusive_cond = PTHREAD_COND_INITIALIZER;

static pthread_cond_t exclusive_resume = PTHREAD_COND_INITIALIZER;

static int pending_cpus;

/* Make sure everything is in a consistent state for calling fork().  */

void fork_start(void)

{

    mmap_fork_start();

    pthread_mutex_lock(&tb_lock);

    pthread_mutex_lock(&exclusive_lock);

}

void fork_end(int child)

{

    if (child) {

        /* Child processes created by fork() only have a single thread.

           Discard information about the parent threads.  */

        first_cpu = thread_env;

        thread_env->next_cpu = NULL;

        pending_cpus = 0;

        pthread_mutex_init(&exclusive_lock, NULL);

        pthread_mutex_init(&cpu_list_mutex, NULL);

        pthread_cond_init(&exclusive_cond, NULL);

        pthread_cond_init(&exclusive_resume, NULL);

        pthread_mutex_init(&tb_lock, NULL);

        gdbserver_fork(thread_env);

    } else {

        pthread_mutex_unlock(&exclusive_lock);

        pthread_mutex_unlock(&tb_lock);

    }

    mmap_fork_end(child);

}

/* Wait for pending exclusive operations to complete.  The exclusive lock

   must be held.  */

static inline void exclusive_idle(void)

{

    while (pending_cpus) {

        pthread_cond_wait(&exclusive_resume, &exclusive_lock);

    }

}

/* Start an exclusive operation.

   Must only be called from outside cpu_arm_exec.   */

static inline void start_exclusive(void)

{

    CPUState *other;

    pthread_mutex_lock(&exclusive_lock);

    exclusive_idle();

    pending_cpus = 1;

    /* Make all other cpus stop executing.  */

    for (other = first_cpu; other; other = other->next_cpu) {

        if (other->running) {

            pending_cpus++;

            cpu_exit(other);

        }

    }

    if (pending_cpus > 1) {

        pthread_cond_wait(&exclusive_cond, &exclusive_lock);

    }

}

/* Finish an exclusive operation.  */

static inline void end_exclusive(void)

{

    pending_cpus = 0;

    pthread_cond_broadcast(&exclusive_resume);

    pthread_mutex_unlock(&exclusive_lock);

}

/* Wait for exclusive ops to finish, and begin cpu execution.  */

static inline void cpu_exec_start(CPUState *env)

{

    pthread_mutex_lock(&exclusive_lock);

    exclusive_idle();

    env->running = 1;

    pthread_mutex_unlock(&exclusive_lock);

}

/* Mark cpu as not executing, and release pending exclusive ops.  */

static inline void cpu_exec_end(CPUState *env)

{

    pthread_mutex_lock(&exclusive_lock);

    env->running = 0;

    if (pending_cpus > 1) {

        pending_cpus--;

        if (pending_cpus == 1) {

            pthread_cond_signal(&exclusive_cond);

        }

    }

    exclusive_idle();

    pthread_mutex_unlock(&exclusive_lock);

}

void cpu_list_lock(void)

{

    pthread_mutex_lock(&cpu_list_mutex);

}

void cpu_list_unlock(void)

{

    pthread_mutex_unlock(&cpu_list_mutex);

}

#else /* if !USE_NPTL */

/* These are no-ops because we are not threadsafe.  */

static inline void cpu_exec_start(CPUState *env)

{

}

static inline void cpu_exec_end(CPUState *env)

{

}

static inline void start_exclusive(void)

{

}

static inline void end_exclusive(void)

{

}

void fork_start(void)

{

}

void fork_end(int child)

{

    if (child) {

        gdbserver_fork(thread_env);

    }

}

void cpu_list_lock(void)

{

}

void cpu_list_unlock(void)

{

}

#endif

#ifdef TARGET_I386

/***********************************************************/

/* CPUX86 core interface */

void cpu_smm_update(CPUState *env)

{

}

uint64_t cpu_get_tsc(CPUX86State *env)

{

    return cpu_get_real_ticks();

}

static void write_dt(void *ptr, unsigned long addr, unsigned long limit,

                     int flags)

{

    unsigned int e1, e2;

    uint32_t *p;

    e1 = (addr << 16) | (limit & 0xffff);

    e2 = ((addr >> 16) & 0xff) | (addr & 0xff000000) | (limit & 0x000f0000);

    e2 |= flags;

    p = ptr;

    p[0] = tswap32(e1);

    p[1] = tswap32(e2);

}

static uint64_t *idt_table;

#ifdef TARGET_X86_64

static void set_gate64(void *ptr, unsigned int type, unsigned int dpl,

                       uint64_t addr, unsigned int sel)

{

    uint32_t *p, e1, e2;

    e1 = (addr & 0xffff) | (sel << 16);

    e2 = (addr & 0xffff0000) | 0x8000 | (dpl << 13) | (type << 8);

    p = ptr;

    p[0] = tswap32(e1);

    p[1] = tswap32(e2);

    p[2] = tswap32(addr >> 32);

    p[3] = 0;

}

/* only dpl matters as we do only user space emulation */

static void set_idt(int n, unsigned int dpl)

{

    set_gate64(idt_table + n * 2, 0, dpl, 0, 0);

}

#else

static void set_gate(void *ptr, unsigned int type, unsigned int dpl,

                     uint32_t addr, unsigned int sel)

{

    uint32_t *p, e1, e2;

    e1 = (addr & 0xffff) | (sel << 16);

    e2 = (addr & 0xffff0000) | 0x8000 | (dpl << 13) | (type << 8);

    p = ptr;

    p[0] = tswap32(e1);

    p[1] = tswap32(e2);

}

/* only dpl matters as we do only user space emulation */

static void set_idt(int n, unsigned int dpl)

{

    set_gate(idt_table + n, 0, dpl, 0, 0);

}

#endif

void cpu_loop(CPUX86State *env)

{

    int trapnr;

    abi_ulong pc;

    target_siginfo_t info;

    for(;;) {

        trapnr = cpu_x86_exec(env);

        switch(trapnr) {

        case 0x80:

            /* linux syscall from int $0x80 */

            env->regs[R_EAX] = do_syscall(env,

                                          env->regs[R_EAX],

                                          env->regs[R_EBX],

                                          env->regs[R_ECX],

                                          env->regs[R_EDX],

                                          env->regs[R_ESI],

                                          env->regs[R_EDI],

                                          env->regs[R_EBP]);

            break;

#ifndef TARGET_ABI32

        case EXCP_SYSCALL:

            /* linux syscall from syscall intruction */

            env->regs[R_EAX] = do_syscall(env,

                                          env->regs[R_EAX],

                                          env->regs[R_EDI],

                                          env->regs[R_ESI],

                                          env->regs[R_EDX],

                                          env->regs[10],

                                          env->regs[8],

                                          env->regs[9]);

            env->eip = env->exception_next_eip;

            break;

#endif

        case EXCP0B_NOSEG:

        case EXCP0C_STACK:

            info.si_signo = SIGBUS;

            info.si_errno = 0;

            info.si_code = TARGET_SI_KERNEL;

            info._sifields._sigfault._addr = 0;

            queue_signal(env, info.si_signo, &info);

            break;

        case EXCP0D_GPF:

            /* XXX: potential problem if ABI32 */

#ifndef TARGET_X86_64

            if (env->eflags & VM_MASK) {

                handle_vm86_fault(env);

            } else

#endif

            {

                info.si_signo = SIGSEGV;

                info.si_errno = 0;

                info.si_code = TARGET_SI_KERNEL;

                info._sifields._sigfault._addr = 0;

                queue_signal(env, info.si_signo, &info);

            }

            break;

        case EXCP0E_PAGE:

            info.si_signo = SIGSEGV;

            info.si_errno = 0;

            if (!(env->error_code & 1))

                info.si_code = TARGET_SEGV_MAPERR;

            else

                info.si_code = TARGET_SEGV_ACCERR;

            info._sifields._sigfault._addr = env->cr[2];

            queue_signal(env, info.si_signo, &info);

            break;

        case EXCP00_DIVZ:

#ifndef TARGET_X86_64

            if (env->eflags & VM_MASK) {

                handle_vm86_trap(env, trapnr);

            } else

#endif

            {

                /* division by zero */

                info.si_signo = SIGFPE;

                info.si_errno = 0;

                info.si_code = TARGET_FPE_INTDIV;

                info._sifields._sigfault._addr = env->eip;

                queue_signal(env, info.si_signo, &info);

            }

            break;

        case EXCP01_DB:

        case EXCP03_INT3:

#ifndef TARGET_X86_64

            if (env->eflags & VM_MASK) {

                handle_vm86_trap(env, trapnr);

            } else

#endif

            {

                info.si_signo = SIGTRAP;

                info.si_errno = 0;

                if (trapnr == EXCP01_DB) {

                    info.si_code = TARGET_TRAP_BRKPT;

                    info._sifields._sigfault._addr = env->eip;

                } else {

                    info.si_code = TARGET_SI_KERNEL;

                    info._sifields._sigfault._addr = 0;

                }

                queue_signal(env, info.si_signo, &info);

            }

            break;

        case EXCP04_INTO:

        case EXCP05_BOUND:

#ifndef TARGET_X86_64

            if (env->eflags & VM_MASK) {

                handle_vm86_trap(env, trapnr);

            } else

#endif

            {

                info.si_signo = SIGSEGV;

                info.si_errno = 0;

                info.si_code = TARGET_SI_KERNEL;

                info._sifields._sigfault._addr = 0;

                queue_signal(env, info.si_signo, &info);

            }

            break;

        case EXCP06_ILLOP:

            info.si_signo = SIGILL;

            info.si_errno = 0;

            info.si_code = TARGET_ILL_ILLOPN;

            info._sifields._sigfault._addr = env->eip;

            queue_signal(env, info.si_signo, &info);

            break;

        case EXCP_INTERRUPT:

            /* just indicate that signals should be handled asap */

            break;

        case EXCP_DEBUG:

            {

                int sig;

                sig = gdb_handlesig (env, TARGET_SIGTRAP);

                if (sig)

                  {

                    info.si_signo = sig;

                    info.si_errno = 0;

                    info.si_code = TARGET_TRAP_BRKPT;

                    queue_signal(env, info.si_signo, &info);

                  }

            }

            break;

        default:

            pc = env->segs[R_CS].base + env->eip;

            fprintf(stderr, "qemu: 0x%08lx: unhandled CPU exception 0x%x - aborting\n",

                    (long)pc, trapnr);

            abort();

        }

        process_pending_signals(env);

    }

}

#endif

#ifdef TARGET_ARM

static void arm_cache_flush(abi_ulong start, abi_ulong last)

{

    abi_ulong addr, last1;

    if (last < start)

        return;

    addr = start;

    for(;;) {

        last1 = ((addr + TARGET_PAGE_SIZE) & TARGET_PAGE_MASK) - 1;

        if (last1 > last)

            last1 = last;

        tb_invalidate_page_range(addr, last1 + 1);

        if (last1 == last)

            break;

        addr = last1 + 1;

    }

}

/* Handle a jump to the kernel code page.  */

static int

do_kernel_trap(CPUARMState *env)

{

    uint32_t addr;

    uint32_t cpsr;

    uint32_t val;

    switch (env->regs[15]) {

    case 0xffff0fa0: /* __kernel_memory_barrier */

        /* ??? No-op. Will need to do better for SMP.  */

        break;

    case 0xffff0fc0: /* __kernel_cmpxchg */

         /* XXX: This only works between threads, not between processes.

            It's probably possible to implement this with native host

            operations. However things like ldrex/strex are much harder so

            there's not much point trying.  */

        start_exclusive();

        cpsr = cpsr_read(env);

        addr = env->regs[2];

        /* FIXME: This should SEGV if the access fails.  */

        if (get_user_u32(val, addr))

            val = ~env->regs[0];

        if (val == env->regs[0]) {

            val = env->regs[1];

            /* FIXME: Check for segfaults.  */

            put_user_u32(val, addr);

            env->regs[0] = 0;

            cpsr |= CPSR_C;

        } else {

            env->regs[0] = -1;

            cpsr &= ~CPSR_C;

        }

        cpsr_write(env, cpsr, CPSR_C);

        end_exclusive();

        break;

    case 0xffff0fe0: /* __kernel_get_tls */

        env->regs[0] = env->cp15.c13_tls2;

        break;

    default:

        return 1;

    }

    /* Jump back to the caller.  */

    addr = env->regs[14];

    if (addr & 1) {

        env->thumb = 1;

        addr &= ~1;

    }

    env->regs[15] = addr;

    return 0;

}

void cpu_loop(CPUARMState *env)

{

    int trapnr;

    unsigned int n, insn;

    target_siginfo_t info;

    uint32_t addr;

    for(;;) {

        cpu_exec_start(env);

        trapnr = cpu_arm_exec(env);

        cpu_exec_end(env);

        switch(trapnr) {

        case EXCP_UDEF:

            {

                TaskState *ts = env->opaque;

                uint32_t opcode;

                int rc;

                /* we handle the FPU emulation here, as Linux */

                /* we get the opcode */

                /* FIXME - what to do if get_user() fails? */

                get_user_u32(opcode, env->regs[15]);

                rc = EmulateAll(opcode, &ts->fpa, env);

                if (rc == 0) { /* illegal instruction */

                    info.si_signo = SIGILL;

                    info.si_errno = 0;

                    info.si_code = TARGET_ILL_ILLOPN;

                    info._sifields._sigfault._addr = env->regs[15];

                    queue_signal(env, info.si_signo, &info);

                } else if (rc < 0) { /* FP exception */

                    int arm_fpe=0;

                    /* translate softfloat flags to FPSR flags */

                    if (-rc & float_flag_invalid)

                      arm_fpe |= BIT_IOC;

                    if (-rc & float_flag_divbyzero)

                      arm_fpe |= BIT_DZC;

                    if (-rc & float_flag_overflow)

                      arm_fpe |= BIT_OFC;

                    if (-rc & float_flag_underflow)

                      arm_fpe |= BIT_UFC;

                    if (-rc & float_flag_inexact)

                      arm_fpe |= BIT_IXC;

                    FPSR fpsr = ts->fpa.fpsr;

                    //printf("fpsr 0x%x, arm_fpe 0x%x\n",fpsr,arm_fpe);

                    if (fpsr & (arm_fpe << 16)) { /* exception enabled? */

                      info.si_signo = SIGFPE;

                      info.si_errno = 0;

                      /* ordered by priority, least first */

                      if (arm_fpe & BIT_IXC) info.si_code = TARGET_FPE_FLTRES;

                      if (arm_fpe & BIT_UFC) info.si_code = TARGET_FPE_FLTUND;

                      if (arm_fpe & BIT_OFC) info.si_code = TARGET_FPE_FLTOVF;

                      if (arm_fpe & BIT_DZC) info.si_code = TARGET_FPE_FLTDIV;

                      if (arm_fpe & BIT_IOC) info.si_code = TARGET_FPE_FLTINV;

                      info._sifields._sigfault._addr = env->regs[15];

                      queue_signal(env, info.si_signo, &info);

                    } else {

                      env->regs[15] += 4;

                    }

                    /* accumulate unenabled exceptions */

                    if ((!(fpsr & BIT_IXE)) && (arm_fpe & BIT_IXC))

                      fpsr |= BIT_IXC;

                    if ((!(fpsr & BIT_UFE)) && (arm_fpe & BIT_UFC))

                      fpsr |= BIT_UFC;

                    if ((!(fpsr & BIT_OFE)) && (arm_fpe & BIT_OFC))

                      fpsr |= BIT_OFC;

                    if ((!(fpsr & BIT_DZE)) && (arm_fpe & BIT_DZC))

                      fpsr |= BIT_DZC;

                    if ((!(fpsr & BIT_IOE)) && (arm_fpe & BIT_IOC))

                      fpsr |= BIT_IOC;

                    ts->fpa.fpsr=fpsr;

                } else { /* everything OK */

                    /* increment PC */

                    env->regs[15] += 4;

                }

            }

            break;

        case EXCP_SWI:

        case EXCP_BKPT:

            {

                env->eabi = 1;

                /* system call */

                if (trapnr == EXCP_BKPT) {

                    if (env->thumb) {

                        /* FIXME - what to do if get_user() fails? */

                        get_user_u16(insn, env->regs[15]);

                        n = insn & 0xff;

                        env->regs[15] += 2;

                    } else {

                        /* FIXME - what to do if get_user() fails? */

                        get_user_u32(insn, env->regs[15]);

                        n = (insn & 0xf) | ((insn >> 4) & 0xff0);

                        env->regs[15] += 4;

                    }

                } else {

                    if (env->thumb) {

                        /* FIXME - what to do if get_user() fails? */

                        get_user_u16(insn, env->regs[15] - 2);

                        n = insn & 0xff;

                    } else {

                        /* FIXME - what to do if get_user() fails? */

                        get_user_u32(insn, env->regs[15] - 4);

                        n = insn & 0xffffff;

                    }

                }

                if (n == ARM_NR_cacheflush) {

                    arm_cache_flush(env->regs[0], env->regs[1]);

                } else if (n == ARM_NR_semihosting

                           || n == ARM_NR_thumb_semihosting) {

                    env->regs[0] = do_arm_semihosting (env);

                } else if (n == 0 || n >= ARM_SYSCALL_BASE

                           || (env->thumb && n == ARM_THUMB_SYSCALL)) {

                    /* linux syscall */

                    if (env->thumb || n == 0) {

                        n = env->regs[7];

                    } else {

                        n -= ARM_SYSCALL_BASE;

                        env->eabi = 0;

                    }

                    if ( n > ARM_NR_BASE) {

                        switch (n) {

                        case ARM_NR_cacheflush:

                            arm_cache_flush(env->regs[0], env->regs[1]);

                            break;

                        case ARM_NR_set_tls:

                            cpu_set_tls(env, env->regs[0]);

                            env->regs[0] = 0;

                            break;

                        default:

                            gemu_log("qemu: Unsupported ARM syscall: 0x%x\n",

                                     n);

                            env->regs[0] = -TARGET_ENOSYS;

                            break;

                        }

                    } else {

                        env->regs[0] = do_syscall(env,

                                                  n,

                                                  env->regs[0],

                                                  env->regs[1],

                                                  env->regs[2],

                                                  env->regs[3],

                                                  env->regs[4],

                                                  env->regs[5]);

                    }

                } else {

                    goto error;

                }

            }

            break;

        case EXCP_INTERRUPT:

            /* just indicate that signals should be handled asap */

            break;

        case EXCP_PREFETCH_ABORT:

            addr = env->cp15.c6_insn;

            goto do_segv;

        case EXCP_DATA_ABORT:

            addr = env->cp15.c6_data;

            goto do_segv;

        do_segv:

            {

                info.si_signo = SIGSEGV;

                info.si_errno = 0;

                /* XXX: check env->error_code */

                info.si_code = TARGET_SEGV_MAPERR;

                info._sifields._sigfault._addr = addr;

                queue_signal(env, info.si_signo, &info);

            }

            break;

        case EXCP_DEBUG:

            {

                int sig;

                sig = gdb_handlesig (env, TARGET_SIGTRAP);

                if (sig)

                  {

                    info.si_signo = sig;

                    info.si_errno = 0;

                    info.si_code = TARGET_TRAP_BRKPT;

                    queue_signal(env, info.si_signo, &info);

                  }

            }

            break;

        case EXCP_KERNEL_TRAP:

            if (do_kernel_trap(env))

              goto error;

            break;

        default:

        error:

            fprintf(stderr, "qemu: unhandled CPU exception 0x%x - aborting\n",

                    trapnr);

            cpu_dump_state(env, stderr, fprintf, 0);

            abort();

        }

        process_pending_signals(env);

    }

}

#endif

#ifdef TARGET_SPARC

#define SPARC64_STACK_BIAS 2047

//#define DEBUG_WIN

/* WARNING: dealing with register windows _is_ complicated. More info

   can be found at http://www.sics.se/~psm/sparcstack.html */

static inline int get_reg_index(CPUSPARCState *env, int cwp, int index)

{

    index = (index + cwp * 16) % (16 * env->nwindows);

    /* wrap handling : if cwp is on the last window, then we use the

       registers 'after' the end */

    if (index < 8 && env->cwp == env->nwindows - 1)

        index += 16 * env->nwindows;

    return index;

}

/* save the register window 'cwp1' */

static inline void save_window_offset(CPUSPARCState *env, int cwp1)

{

    unsigned int i;

    abi_ulong sp_ptr;

    sp_ptr = env->regbase[get_reg_index(env, cwp1, 6)];

#ifdef TARGET_SPARC64

    if (sp_ptr & 3)

        sp_ptr += SPARC64_STACK_BIAS;

#endif

#if defined(DEBUG_WIN)

    printf("win_overflow: sp_ptr=0x" TARGET_ABI_FMT_lx " save_cwp=%d\n",

           sp_ptr, cwp1);

#endif

    for(i = 0; i < 16; i++) {

        /* FIXME - what to do if put_user() fails? */

        put_user_ual(env->regbase[get_reg_index(env, cwp1, 8 + i)], sp_ptr);

        sp_ptr += sizeof(abi_ulong);

    }

}

static void save_window(CPUSPARCState *env)

{

#ifndef TARGET_SPARC64

    unsigned int new_wim;

    new_wim = ((env->wim >> 1) | (env->wim << (env->nwindows - 1))) &

        ((1LL << env->nwindows) - 1);

    save_window_offset(env, cpu_cwp_dec(env, env->cwp - 2));

    env->wim = new_wim;

#else

    save_window_offset(env, cpu_cwp_dec(env, env->cwp - 2));

    env->cansave++;

    env->canrestore--;

#endif

}

static void restore_window(CPUSPARCState *env)

{

#ifndef TARGET_SPARC64

    unsigned int new_wim;

#endif

    unsigned int i, cwp1;

    abi_ulong sp_ptr;

#ifndef TARGET_SPARC64

    new_wim = ((env->wim << 1) | (env->wim >> (env->nwindows - 1))) &

        ((1LL << env->nwindows) - 1);

#endif

    /* restore the invalid window */

    cwp1 = cpu_cwp_inc(env, env->cwp + 1);

    sp_ptr = env->regbase[get_reg_index(env, cwp1, 6)];

#ifdef TARGET_SPARC64

    if (sp_ptr & 3)

        sp_ptr += SPARC64_STACK_BIAS;

#endif

#if defined(DEBUG_WIN)

    printf("win_underflow: sp_ptr=0x" TARGET_ABI_FMT_lx " load_cwp=%d\n",

           sp_ptr, cwp1);

#endif

    for(i = 0; i < 16; i++) {

        /* FIXME - what to do if get_user() fails? */

        get_user_ual(env->regbase[get_reg_index(env, cwp1, 8 + i)], sp_ptr);

        sp_ptr += sizeof(abi_ulong);

    }

#ifdef TARGET_SPARC64

    env->canrestore++;

    if (env->cleanwin < env->nwindows - 1)

        env->cleanwin++;

    env->cansave--;

#else

    env->wim = new_wim;

#endif

}

static void flush_windows(CPUSPARCState *env)

{

    int offset, cwp1;

    offset = 1;

    for(;;) {

        /* if restore would invoke restore_window(), then we can stop */