Index: kernel/fiasco/src/kern/mips/exception.S
===================================================================
--- kernel/fiasco/src/kern/mips/exception.S	(revision 72)
+++ kernel/fiasco/src/kern/mips/exception.S	(working copy)
@@ -357,40 +357,65 @@
 
 ENTRY reserved_insn
 	# NOTE. currently does not work for guest reserved insn redirect
-	# Handle emulation of rdhwr instruction for TLS (ULR)
+	# Handle emulation of rdhwr instruction for TLS (ULR) and SYNCI_Step
 	ASM_MFC0	k0, CP0_EPC
-	lw	k1, 0(k0) # load instruction
-	li	k0,  0x7c00e83b
-	li	$at, 0xffe0ffff
-	and	$at, $at, k1   # check for rdhwr .., $29
-	bne	$at, k0, 1f    # do normal slowtrap entry if not rdhwr .., $29
-	  ext	k0, k1, 16, 5  # extract target register number
+	lw	k1, 0(k0)       # load instruction
 
+	# Test for rdhwr .., $29 (ULR)
+
+	#                         SPECIAL3_____........29_____RDHWR.
+	li	k0,  0x7c00e83b #   01111100000000001110100000111011
+	li	$at, 0xffe0ffff # mask for rdhwr test
+	and	$at, $at, k1    # check for rdhwr .., $29
+	bne	$at, k0, 5f     # test for rdhwr .., $1 if not rdhwr .., $29
+	  ext	k0, k1, 16, 5   # extract target register number
+
+	# Handle TLS (ULR) access
+
 	move	$at, sp
 	ins	$at, zero, 0, THREAD_BLOCK_SHIFT # TCB addr in $at
+	ASM_L	$at, OFS__THREAD__ULR($at)
+	b	6f
+	  nop
+
+	# Test for rdhwr .., $1 (SYNCI_Step)
+5:
+	#                         SPECIAL3_____.........1_____RDHWR.
+	li	k0,  0x7c00083b #   01111100000000000000100000111011
+	li	$at, 0xffe0ffff # mask for rdhwr test
+	and	$at, $at, k1    # check for rdhwr .., $1
+	bne	$at, k0, 1f     # do normal slowtrap entry if not rdhwr .., $1
+	  ext	k0, k1, 16, 5   # extract target register number
+
+	# Handle SYNCI_Step access
+
+	ASM_MFC0	k1, CP0_CONFIG, 1
+	ext	k1, k1, 19, 3  # CONFIG1<21:19> = IL<2:0> = (log2(line size) - 1) or 0
+	beqz	k1, 6f         # exit with zero value if line size is zero
+	  li	$at, 0
+	li	$at, 2
+	sllv	$at, $at, k1   # 2 << (log2(line size) - 1) == line size
+
+	# Jump to the register loading instruction
+6:
 	sll	k0, k0, 3      # 32 insn bundles (2 insns) one for each target
 	ASM_LA	k1, 2f         # register at 2f
 	ASM_ADDU	k0, k1, k0     # calculate the address of the target register load
-	lw	k1, TS_STATUS(CALL_FRAME_SIZE)(sp)
-	mtc0	k1, CP0_STATUS # restore CP0 Status as the entry code modified it
-	ASM_MFC0	k1, CP0_EPC    # skip the rdhwr insn
-	ASM_ADDIU	k1, k1, 4
-	ASM_MTC0	k1, CP0_EPC
 	jr	k0             # jump to the register loading code
 	  ehb                  # prepare for eret
 
-	# Load the target register with the ULR value
+	# Load the target register with the required value from $at
 	# we have 32 instruction bundles that load the
-	# target register and brnach to the exit code
+	# target register and branch to the exit code
 2:
 	b	3f
 	  nop
 	b	4f
-	  ASM_L	$at, OFS__THREAD__ULR($at)
+	  nop
 	.irp reg, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, \
 	          16, 17, 18,  19, 20, 21, 22, 23, 24, 25
 		b	3f
-		  ASM_L	$\reg, OFS__THREAD__ULR($at)
+		  move	$\reg, $at
 	.endr
 	b	3f
 	  nop
@@ -397,18 +422,25 @@
 	b	3f
 	  nop
 	b	3f
-	  ASM_L	$28, OFS__THREAD__ULR($at)
+	  move	$28, $at
 	b	3f    # ignore store to sp (r29)
 	  nop
 	b	3f
-	  ASM_L	$30, OFS__THREAD__ULR($at)
+	  move	$30, $at
 	nop
-	ASM_L	$31, OFS__THREAD__ULR($at)
+	move	$31, $at
 
-3:	load_reg	 1, 29
-4:	load_reg	29, 29
+3:	load_reg	1, 29
+4:
 	/* no need to restore k0, k1 here as this must never happen
 	 * from guest mit with VZ */
+	lw	k1, TS_STATUS(CALL_FRAME_SIZE)(sp)
+	mtc0	k1, CP0_STATUS # restore CP0 Status as the entry code modified it
+	ASM_MFC0	k1, CP0_EPC    # skip the rdhwr insn
+	ASM_ADDIU	k1, k1, 4
+	ASM_MTC0	k1, CP0_EPC
+
+	load_reg	29, 29
 	eret
 
 1: # do normal slowtrap entry