target-arm/translate.c

   1 /*
   2  *  ARM translation
   3  *
   4  *  Copyright (c) 2003 Fabrice Bellard
   5  *  Copyright (c) 2005-2007 CodeSourcery
   6  *  Copyright (c) 2007 OpenedHand, Ltd.
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21 #include <stdarg.h>
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <string.h>
  25 #include <inttypes.h>
  26
  27 #include "cpu.h"
  28 #include "internals.h"
  29 #include "disas/disas.h"
  30 #include "tcg-op.h"
  31 #include "qemu/log.h"
  32 #include "qemu/bitops.h"
  33
  34 #include "exec/helper-proto.h"
  35 #include "exec/helper-gen.h"
  36
  37 #define ENABLE_ARCH_4T    arm_feature(env, ARM_FEATURE_V4T)
  38 #define ENABLE_ARCH_5     arm_feature(env, ARM_FEATURE_V5)
  39 /* currently all emulated v5 cores are also v5TE, so don't bother */
  40 #define ENABLE_ARCH_5TE   arm_feature(env, ARM_FEATURE_V5)
  41 #define ENABLE_ARCH_5J    0
  42 #define ENABLE_ARCH_6     arm_feature(env, ARM_FEATURE_V6)
  43 #define ENABLE_ARCH_6K   arm_feature(env, ARM_FEATURE_V6K)
  44 #define ENABLE_ARCH_6T2   arm_feature(env, ARM_FEATURE_THUMB2)
  45 #define ENABLE_ARCH_7     arm_feature(env, ARM_FEATURE_V7)
  46 #define ENABLE_ARCH_8     arm_feature(env, ARM_FEATURE_V8)
  47
  48 #define ARCH(x) do { if (!ENABLE_ARCH_##x) goto illegal_op; } while(0)
  49
  50 #include "translate.h"
  51 static uint32_t gen_opc_condexec_bits[OPC_BUF_SIZE];
  52
  53 #if defined(CONFIG_USER_ONLY)
  54 #define IS_USER(s) 1
  55 #else
  56 #define IS_USER(s) (s->user)
  57 #endif
  58
  59 TCGv_ptr cpu_env;
  60 /* We reuse the same 64-bit temporaries for efficiency.  */
  61 static TCGv_i64 cpu_V0, cpu_V1, cpu_M0;
  62 static TCGv_i32 cpu_R[16];
  63 static TCGv_i32 cpu_CF, cpu_NF, cpu_VF, cpu_ZF;
  64 static TCGv_i64 cpu_exclusive_addr;
  65 static TCGv_i64 cpu_exclusive_val;
  66 #ifdef CONFIG_USER_ONLY
  67 static TCGv_i64 cpu_exclusive_test;
  68 static TCGv_i32 cpu_exclusive_info;
  69 #endif
  70
  71 /* FIXME:  These should be removed.  */
  72 static TCGv_i32 cpu_F0s, cpu_F1s;
  73 static TCGv_i64 cpu_F0d, cpu_F1d;
  74
  75 #include "exec/gen-icount.h"
  76
  77 static const char *regnames[] =
  78     { "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
  79       "r8", "r9", "r10", "r11", "r12", "r13", "r14", "pc" };
  80
  81 /* initialize TCG globals.  */
  82 void arm_translate_init(void)
  83 {
  84     int i;
  85
  86     cpu_env = tcg_global_reg_new_ptr(TCG_AREG0, "env");
  87
  88     for (i = 0; i < 16; i++) {
  89         cpu_R[i] = tcg_global_mem_new_i32(TCG_AREG0,
  90                                           offsetof(CPUARMState, regs[i]),
  91                                           regnames[i]);
  92     }
  93     cpu_CF = tcg_global_mem_new_i32(TCG_AREG0, offsetof(CPUARMState, CF), "CF");
  94     cpu_NF = tcg_global_mem_new_i32(TCG_AREG0, offsetof(CPUARMState, NF), "NF");
  95     cpu_VF = tcg_global_mem_new_i32(TCG_AREG0, offsetof(CPUARMState, VF), "VF");
  96     cpu_ZF = tcg_global_mem_new_i32(TCG_AREG0, offsetof(CPUARMState, ZF), "ZF");
  97
  98     cpu_exclusive_addr = tcg_global_mem_new_i64(TCG_AREG0,
  99         offsetof(CPUARMState, exclusive_addr), "exclusive_addr");
 100     cpu_exclusive_val = tcg_global_mem_new_i64(TCG_AREG0,
 101         offsetof(CPUARMState, exclusive_val), "exclusive_val");
 102 #ifdef CONFIG_USER_ONLY
 103     cpu_exclusive_test = tcg_global_mem_new_i64(TCG_AREG0,
 104         offsetof(CPUARMState, exclusive_test), "exclusive_test");
 105     cpu_exclusive_info = tcg_global_mem_new_i32(TCG_AREG0,
 106         offsetof(CPUARMState, exclusive_info), "exclusive_info");
 107 #endif
 108
 109     a64_translate_init();
 110 }
 111
 112 static inline TCGv_i32 load_cpu_offset(int offset)
 113 {
 114     TCGv_i32 tmp = tcg_temp_new_i32();
 115     tcg_gen_ld_i32(tmp, cpu_env, offset);
 116     return tmp;
 117 }
 118
 119 #define load_cpu_field(name) load_cpu_offset(offsetof(CPUARMState, name))
 120
 121 static inline void store_cpu_offset(TCGv_i32 var, int offset)
 122 {
 123     tcg_gen_st_i32(var, cpu_env, offset);
 124     tcg_temp_free_i32(var);
 125 }
 126
 127 #define store_cpu_field(var, name) \
 128     store_cpu_offset(var, offsetof(CPUARMState, name))
 129
 130 /* Set a variable to the value of a CPU register.  */
 131 static void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
 132 {
 133     if (reg == 15) {
 134         uint32_t addr;
 135         /* normally, since we updated PC, we need only to add one insn */
 136         if (s->thumb)
 137             addr = (long)s->pc + 2;
 138         else
 139             addr = (long)s->pc + 4;
 140         tcg_gen_movi_i32(var, addr);
 141     } else {
 142         tcg_gen_mov_i32(var, cpu_R[reg]);
 143     }
 144 }
 145
 146 /* Create a new temporary and set it to the value of a CPU register.  */
 147 static inline TCGv_i32 load_reg(DisasContext *s, int reg)
 148 {
 149     TCGv_i32 tmp = tcg_temp_new_i32();
 150     load_reg_var(s, tmp, reg);
 151     return tmp;
 152 }
 153
 154 /* Set a CPU register.  The source must be a temporary and will be
 155    marked as dead.  */
 156 static void store_reg(DisasContext *s, int reg, TCGv_i32 var)
 157 {
 158     if (reg == 15) {
 159         tcg_gen_andi_i32(var, var, ~1);
 160         s->is_jmp = DISAS_JUMP;
 161     }
 162     tcg_gen_mov_i32(cpu_R[reg], var);
 163     tcg_temp_free_i32(var);
 164 }
 165
 166 /* Value extensions.  */
 167 #define gen_uxtb(var) tcg_gen_ext8u_i32(var, var)
 168 #define gen_uxth(var) tcg_gen_ext16u_i32(var, var)
 169 #define gen_sxtb(var) tcg_gen_ext8s_i32(var, var)
 170 #define gen_sxth(var) tcg_gen_ext16s_i32(var, var)
 171
 172 #define gen_sxtb16(var) gen_helper_sxtb16(var, var)
 173 #define gen_uxtb16(var) gen_helper_uxtb16(var, var)
 174
 175
 176 static inline void gen_set_cpsr(TCGv_i32 var, uint32_t mask)
 177 {
 178     TCGv_i32 tmp_mask = tcg_const_i32(mask);
 179     gen_helper_cpsr_write(cpu_env, var, tmp_mask);
 180     tcg_temp_free_i32(tmp_mask);
 181 }
 182 /* Set NZCV flags from the high 4 bits of var.  */
 183 #define gen_set_nzcv(var) gen_set_cpsr(var, CPSR_NZCV)
 184
 185 static void gen_exception_internal(int excp)
 186 {
 187     TCGv_i32 tcg_excp = tcg_const_i32(excp);
 188
 189     assert(excp_is_internal(excp));
 190     gen_helper_exception_internal(cpu_env, tcg_excp);
 191     tcg_temp_free_i32(tcg_excp);
 192 }
 193
 194 static void gen_exception(int excp, uint32_t syndrome)
 195 {
 196     TCGv_i32 tcg_excp = tcg_const_i32(excp);
 197     TCGv_i32 tcg_syn = tcg_const_i32(syndrome);
 198
 199     gen_helper_exception_with_syndrome(cpu_env, tcg_excp, tcg_syn);
 200     tcg_temp_free_i32(tcg_syn);
 201     tcg_temp_free_i32(tcg_excp);
 202 }
 203
 204 static void gen_smul_dual(TCGv_i32 a, TCGv_i32 b)
 205 {
 206     TCGv_i32 tmp1 = tcg_temp_new_i32();
 207     TCGv_i32 tmp2 = tcg_temp_new_i32();
 208     tcg_gen_ext16s_i32(tmp1, a);
 209     tcg_gen_ext16s_i32(tmp2, b);
 210     tcg_gen_mul_i32(tmp1, tmp1, tmp2);
 211     tcg_temp_free_i32(tmp2);
 212     tcg_gen_sari_i32(a, a, 16);
 213     tcg_gen_sari_i32(b, b, 16);
 214     tcg_gen_mul_i32(b, b, a);
 215     tcg_gen_mov_i32(a, tmp1);
 216     tcg_temp_free_i32(tmp1);
 217 }
 218
 219 /* Byteswap each halfword.  */
 220 static void gen_rev16(TCGv_i32 var)
 221 {
 222     TCGv_i32 tmp = tcg_temp_new_i32();
 223     tcg_gen_shri_i32(tmp, var, 8);
 224     tcg_gen_andi_i32(tmp, tmp, 0x00ff00ff);
 225     tcg_gen_shli_i32(var, var, 8);
 226     tcg_gen_andi_i32(var, var, 0xff00ff00);
 227     tcg_gen_or_i32(var, var, tmp);
 228     tcg_temp_free_i32(tmp);
 229 }
 230
 231 /* Byteswap low halfword and sign extend.  */
 232 static void gen_revsh(TCGv_i32 var)
 233 {
 234     tcg_gen_ext16u_i32(var, var);
 235     tcg_gen_bswap16_i32(var, var);
 236     tcg_gen_ext16s_i32(var, var);
 237 }
 238
 239 /* Unsigned bitfield extract.  */
 240 static void gen_ubfx(TCGv_i32 var, int shift, uint32_t mask)
 241 {
 242     if (shift)
 243         tcg_gen_shri_i32(var, var, shift);
 244     tcg_gen_andi_i32(var, var, mask);
 245 }
 246
 247 /* Signed bitfield extract.  */
 248 static void gen_sbfx(TCGv_i32 var, int shift, int width)
 249 {
 250     uint32_t signbit;
 251
 252     if (shift)
 253         tcg_gen_sari_i32(var, var, shift);
 254     if (shift + width < 32) {
 255         signbit = 1u << (width - 1);
 256         tcg_gen_andi_i32(var, var, (1u << width) - 1);
 257         tcg_gen_xori_i32(var, var, signbit);
 258         tcg_gen_subi_i32(var, var, signbit);
 259     }
 260 }
 261
 262 /* Return (b << 32) + a. Mark inputs as dead */
 263 static TCGv_i64 gen_addq_msw(TCGv_i64 a, TCGv_i32 b)
 264 {
 265     TCGv_i64 tmp64 = tcg_temp_new_i64();
 266
 267     tcg_gen_extu_i32_i64(tmp64, b);
 268     tcg_temp_free_i32(b);
 269     tcg_gen_shli_i64(tmp64, tmp64, 32);
 270     tcg_gen_add_i64(a, tmp64, a);
 271
 272     tcg_temp_free_i64(tmp64);
 273     return a;
 274 }
 275
 276 /* Return (b << 32) - a. Mark inputs as dead. */
 277 static TCGv_i64 gen_subq_msw(TCGv_i64 a, TCGv_i32 b)
 278 {
 279     TCGv_i64 tmp64 = tcg_temp_new_i64();
 280
 281     tcg_gen_extu_i32_i64(tmp64, b);
 282     tcg_temp_free_i32(b);
 283     tcg_gen_shli_i64(tmp64, tmp64, 32);
 284     tcg_gen_sub_i64(a, tmp64, a);
 285
 286     tcg_temp_free_i64(tmp64);
 287     return a;
 288 }
 289
 290 /* 32x32->64 multiply.  Marks inputs as dead.  */
 291 static TCGv_i64 gen_mulu_i64_i32(TCGv_i32 a, TCGv_i32 b)
 292 {
 293     TCGv_i32 lo = tcg_temp_new_i32();
 294     TCGv_i32 hi = tcg_temp_new_i32();
 295     TCGv_i64 ret;
 296
 297     tcg_gen_mulu2_i32(lo, hi, a, b);
 298     tcg_temp_free_i32(a);
 299     tcg_temp_free_i32(b);
 300
 301     ret = tcg_temp_new_i64();
 302     tcg_gen_concat_i32_i64(ret, lo, hi);
 303     tcg_temp_free_i32(lo);
 304     tcg_temp_free_i32(hi);
 305
 306     return ret;
 307 }
 308
 309 static TCGv_i64 gen_muls_i64_i32(TCGv_i32 a, TCGv_i32 b)
 310 {
 311     TCGv_i32 lo = tcg_temp_new_i32();
 312     TCGv_i32 hi = tcg_temp_new_i32();
 313     TCGv_i64 ret;
 314
 315     tcg_gen_muls2_i32(lo, hi, a, b);
 316     tcg_temp_free_i32(a);
 317     tcg_temp_free_i32(b);
 318
 319     ret = tcg_temp_new_i64();
 320     tcg_gen_concat_i32_i64(ret, lo, hi);
 321     tcg_temp_free_i32(lo);
 322     tcg_temp_free_i32(hi);
 323
 324     return ret;
 325 }
 326
 327 /* Swap low and high halfwords.  */
 328 static void gen_swap_half(TCGv_i32 var)
 329 {
 330     TCGv_i32 tmp = tcg_temp_new_i32();
 331     tcg_gen_shri_i32(tmp, var, 16);
 332     tcg_gen_shli_i32(var, var, 16);
 333     tcg_gen_or_i32(var, var, tmp);
 334     tcg_temp_free_i32(tmp);
 335 }
 336
 337 /* Dual 16-bit add.  Result placed in t0 and t1 is marked as dead.
 338     tmp = (t0 ^ t1) & 0x8000;
 339     t0 &= ~0x8000;
 340     t1 &= ~0x8000;
 341     t0 = (t0 + t1) ^ tmp;
 342  */
 343
 344 static void gen_add16(TCGv_i32 t0, TCGv_i32 t1)
 345 {
 346     TCGv_i32 tmp = tcg_temp_new_i32();
 347     tcg_gen_xor_i32(tmp, t0, t1);
 348     tcg_gen_andi_i32(tmp, tmp, 0x8000);
 349     tcg_gen_andi_i32(t0, t0, ~0x8000);
 350     tcg_gen_andi_i32(t1, t1, ~0x8000);
 351     tcg_gen_add_i32(t0, t0, t1);
 352     tcg_gen_xor_i32(t0, t0, tmp);
 353     tcg_temp_free_i32(tmp);
 354     tcg_temp_free_i32(t1);
 355 }
 356
 357 /* Set CF to the top bit of var.  */
 358 static void gen_set_CF_bit31(TCGv_i32 var)
 359 {
 360     tcg_gen_shri_i32(cpu_CF, var, 31);
 361 }
 362
 363 /* Set N and Z flags from var.  */
 364 static inline void gen_logic_CC(TCGv_i32 var)
 365 {
 366     tcg_gen_mov_i32(cpu_NF, var);
 367     tcg_gen_mov_i32(cpu_ZF, var);
 368 }
 369
 370 /* T0 += T1 + CF.  */
 371 static void gen_adc(TCGv_i32 t0, TCGv_i32 t1)
 372 {
 373     tcg_gen_add_i32(t0, t0, t1);
 374     tcg_gen_add_i32(t0, t0, cpu_CF);
 375 }
 376
 377 /* dest = T0 + T1 + CF. */
 378 static void gen_add_carry(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 379 {
 380     tcg_gen_add_i32(dest, t0, t1);
 381     tcg_gen_add_i32(dest, dest, cpu_CF);
 382 }
 383
 384 /* dest = T0 - T1 + CF - 1.  */
 385 static void gen_sub_carry(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 386 {
 387     tcg_gen_sub_i32(dest, t0, t1);
 388     tcg_gen_add_i32(dest, dest, cpu_CF);
 389     tcg_gen_subi_i32(dest, dest, 1);
 390 }
 391
 392 /* dest = T0 + T1. Compute C, N, V and Z flags */
 393 static void gen_add_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 394 {
 395     TCGv_i32 tmp = tcg_temp_new_i32();
 396     tcg_gen_movi_i32(tmp, 0);
 397     tcg_gen_add2_i32(cpu_NF, cpu_CF, t0, tmp, t1, tmp);
 398     tcg_gen_mov_i32(cpu_ZF, cpu_NF);
 399     tcg_gen_xor_i32(cpu_VF, cpu_NF, t0);
 400     tcg_gen_xor_i32(tmp, t0, t1);
 401     tcg_gen_andc_i32(cpu_VF, cpu_VF, tmp);
 402     tcg_temp_free_i32(tmp);
 403     tcg_gen_mov_i32(dest, cpu_NF);
 404 }
 405
 406 /* dest = T0 + T1 + CF.  Compute C, N, V and Z flags */
 407 static void gen_adc_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 408 {
 409     TCGv_i32 tmp = tcg_temp_new_i32();
 410     if (TCG_TARGET_HAS_add2_i32) {
 411         tcg_gen_movi_i32(tmp, 0);
 412         tcg_gen_add2_i32(cpu_NF, cpu_CF, t0, tmp, cpu_CF, tmp);
 413         tcg_gen_add2_i32(cpu_NF, cpu_CF, cpu_NF, cpu_CF, t1, tmp);
 414     } else {
 415         TCGv_i64 q0 = tcg_temp_new_i64();
 416         TCGv_i64 q1 = tcg_temp_new_i64();
 417         tcg_gen_extu_i32_i64(q0, t0);
 418         tcg_gen_extu_i32_i64(q1, t1);
 419         tcg_gen_add_i64(q0, q0, q1);
 420         tcg_gen_extu_i32_i64(q1, cpu_CF);
 421         tcg_gen_add_i64(q0, q0, q1);
 422         tcg_gen_extr_i64_i32(cpu_NF, cpu_CF, q0);
 423         tcg_temp_free_i64(q0);
 424         tcg_temp_free_i64(q1);
 425     }
 426     tcg_gen_mov_i32(cpu_ZF, cpu_NF);
 427     tcg_gen_xor_i32(cpu_VF, cpu_NF, t0);
 428     tcg_gen_xor_i32(tmp, t0, t1);
 429     tcg_gen_andc_i32(cpu_VF, cpu_VF, tmp);
 430     tcg_temp_free_i32(tmp);
 431     tcg_gen_mov_i32(dest, cpu_NF);
 432 }
 433
 434 /* dest = T0 - T1. Compute C, N, V and Z flags */
 435 static void gen_sub_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 436 {
 437     TCGv_i32 tmp;
 438     tcg_gen_sub_i32(cpu_NF, t0, t1);
 439     tcg_gen_mov_i32(cpu_ZF, cpu_NF);
 440     tcg_gen_setcond_i32(TCG_COND_GEU, cpu_CF, t0, t1);
 441     tcg_gen_xor_i32(cpu_VF, cpu_NF, t0);
 442     tmp = tcg_temp_new_i32();
 443     tcg_gen_xor_i32(tmp, t0, t1);
 444     tcg_gen_and_i32(cpu_VF, cpu_VF, tmp);
 445     tcg_temp_free_i32(tmp);
 446     tcg_gen_mov_i32(dest, cpu_NF);
 447 }
 448
 449 /* dest = T0 + ~T1 + CF.  Compute C, N, V and Z flags */
 450 static void gen_sbc_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 451 {
 452     TCGv_i32 tmp = tcg_temp_new_i32();
 453     tcg_gen_not_i32(tmp, t1);
 454     gen_adc_CC(dest, t0, tmp);
 455     tcg_temp_free_i32(tmp);
 456 }
 457
 458 #define GEN_SHIFT(name)                                               \
 459 static void gen_##name(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)       \
 460 {                                                                     \
 461     TCGv_i32 tmp1, tmp2, tmp3;                                        \
 462     tmp1 = tcg_temp_new_i32();                                        \
 463     tcg_gen_andi_i32(tmp1, t1, 0xff);                                 \
 464     tmp2 = tcg_const_i32(0);                                          \
 465     tmp3 = tcg_const_i32(0x1f);                                       \
 466     tcg_gen_movcond_i32(TCG_COND_GTU, tmp2, tmp1, tmp3, tmp2, t0);    \
 467     tcg_temp_free_i32(tmp3);                                          \
 468     tcg_gen_andi_i32(tmp1, tmp1, 0x1f);                               \
 469     tcg_gen_##name##_i32(dest, tmp2, tmp1);                           \
 470     tcg_temp_free_i32(tmp2);                                          \
 471     tcg_temp_free_i32(tmp1);                                          \
 472 }
 473 GEN_SHIFT(shl)
 474 GEN_SHIFT(shr)
 475 #undef GEN_SHIFT
 476
 477 static void gen_sar(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 478 {
 479     TCGv_i32 tmp1, tmp2;
 480     tmp1 = tcg_temp_new_i32();
 481     tcg_gen_andi_i32(tmp1, t1, 0xff);
 482     tmp2 = tcg_const_i32(0x1f);
 483     tcg_gen_movcond_i32(TCG_COND_GTU, tmp1, tmp1, tmp2, tmp2, tmp1);
 484     tcg_temp_free_i32(tmp2);
 485     tcg_gen_sar_i32(dest, t0, tmp1);
 486     tcg_temp_free_i32(tmp1);
 487 }
 488
 489 static void tcg_gen_abs_i32(TCGv_i32 dest, TCGv_i32 src)
 490 {
 491     TCGv_i32 c0 = tcg_const_i32(0);
 492     TCGv_i32 tmp = tcg_temp_new_i32();
 493     tcg_gen_neg_i32(tmp, src);
 494     tcg_gen_movcond_i32(TCG_COND_GT, dest, src, c0, src, tmp);
 495     tcg_temp_free_i32(c0);
 496     tcg_temp_free_i32(tmp);
 497 }
 498
 499 static void shifter_out_im(TCGv_i32 var, int shift)
 500 {
 501     if (shift == 0) {
 502         tcg_gen_andi_i32(cpu_CF, var, 1);
 503     } else {
 504         tcg_gen_shri_i32(cpu_CF, var, shift);
 505         if (shift != 31) {
 506             tcg_gen_andi_i32(cpu_CF, cpu_CF, 1);
 507         }
 508     }
 509 }
 510
 511 /* Shift by immediate.  Includes special handling for shift == 0.  */
 512 static inline void gen_arm_shift_im(TCGv_i32 var, int shiftop,
 513                                     int shift, int flags)
 514 {
 515     switch (shiftop) {
 516     case 0: /* LSL */
 517         if (shift != 0) {
 518             if (flags)
 519                 shifter_out_im(var, 32 - shift);
 520             tcg_gen_shli_i32(var, var, shift);
 521         }
 522         break;
 523     case 1: /* LSR */
 524         if (shift == 0) {
 525             if (flags) {
 526                 tcg_gen_shri_i32(cpu_CF, var, 31);
 527             }
 528             tcg_gen_movi_i32(var, 0);
 529         } else {
 530             if (flags)
 531                 shifter_out_im(var, shift - 1);
 532             tcg_gen_shri_i32(var, var, shift);
 533         }
 534         break;
 535     case 2: /* ASR */
 536         if (shift == 0)
 537             shift = 32;
 538         if (flags)
 539             shifter_out_im(var, shift - 1);
 540         if (shift == 32)
 541           shift = 31;
 542         tcg_gen_sari_i32(var, var, shift);
 543         break;
 544     case 3: /* ROR/RRX */
 545         if (shift != 0) {
 546             if (flags)
 547                 shifter_out_im(var, shift - 1);
 548             tcg_gen_rotri_i32(var, var, shift); break;
 549         } else {
 550             TCGv_i32 tmp = tcg_temp_new_i32();
 551             tcg_gen_shli_i32(tmp, cpu_CF, 31);
 552             if (flags)
 553                 shifter_out_im(var, 0);
 554             tcg_gen_shri_i32(var, var, 1);
 555             tcg_gen_or_i32(var, var, tmp);
 556             tcg_temp_free_i32(tmp);
 557         }
 558     }
 559 };
 560
 561 static inline void gen_arm_shift_reg(TCGv_i32 var, int shiftop,
 562                                      TCGv_i32 shift, int flags)
 563 {
 564     if (flags) {
 565         switch (shiftop) {
 566         case 0: gen_helper_shl_cc(var, cpu_env, var, shift); break;
 567         case 1: gen_helper_shr_cc(var, cpu_env, var, shift); break;
 568         case 2: gen_helper_sar_cc(var, cpu_env, var, shift); break;
 569         case 3: gen_helper_ror_cc(var, cpu_env, var, shift); break;
 570         }
 571     } else {
 572         switch (shiftop) {
 573         case 0:
 574             gen_shl(var, var, shift);
 575             break;
 576         case 1:
 577             gen_shr(var, var, shift);
 578             break;
 579         case 2:
 580             gen_sar(var, var, shift);
 581             break;
 582         case 3: tcg_gen_andi_i32(shift, shift, 0x1f);
 583                 tcg_gen_rotr_i32(var, var, shift); break;
 584         }
 585     }
 586     tcg_temp_free_i32(shift);
 587 }
 588
 589 #define PAS_OP(pfx) \
 590     switch (op2) {  \
 591     case 0: gen_pas_helper(glue(pfx,add16)); break; \
 592     case 1: gen_pas_helper(glue(pfx,addsubx)); break; \
 593     case 2: gen_pas_helper(glue(pfx,subaddx)); break; \
 594     case 3: gen_pas_helper(glue(pfx,sub16)); break; \
 595     case 4: gen_pas_helper(glue(pfx,add8)); break; \
 596     case 7: gen_pas_helper(glue(pfx,sub8)); break; \
 597     }
 598 static void gen_arm_parallel_addsub(int op1, int op2, TCGv_i32 a, TCGv_i32 b)
 599 {
 600     TCGv_ptr tmp;
 601
 602     switch (op1) {
 603 #define gen_pas_helper(name) glue(gen_helper_,name)(a, a, b, tmp)
 604     case 1:
 605         tmp = tcg_temp_new_ptr();
 606         tcg_gen_addi_ptr(tmp, cpu_env, offsetof(CPUARMState, GE));
 607         PAS_OP(s)
 608         tcg_temp_free_ptr(tmp);
 609         break;
 610     case 5:
 611         tmp = tcg_temp_new_ptr();
 612         tcg_gen_addi_ptr(tmp, cpu_env, offsetof(CPUARMState, GE));
 613         PAS_OP(u)
 614         tcg_temp_free_ptr(tmp);
 615         break;
 616 #undef gen_pas_helper
 617 #define gen_pas_helper(name) glue(gen_helper_,name)(a, a, b)
 618     case 2:
 619         PAS_OP(q);
 620         break;
 621     case 3:
 622         PAS_OP(sh);
 623         break;
 624     case 6:
 625         PAS_OP(uq);
 626         break;
 627     case 7:
 628         PAS_OP(uh);
 629         break;
 630 #undef gen_pas_helper
 631     }
 632 }
 633 #undef PAS_OP
 634
 635 /* For unknown reasons Arm and Thumb-2 use arbitrarily different encodings.  */
 636 #define PAS_OP(pfx) \
 637     switch (op1) {  \
 638     case 0: gen_pas_helper(glue(pfx,add8)); break; \
 639     case 1: gen_pas_helper(glue(pfx,add16)); break; \
 640     case 2: gen_pas_helper(glue(pfx,addsubx)); break; \
 641     case 4: gen_pas_helper(glue(pfx,sub8)); break; \
 642     case 5: gen_pas_helper(glue(pfx,sub16)); break; \
 643     case 6: gen_pas_helper(glue(pfx,subaddx)); break; \
 644     }
 645 static void gen_thumb2_parallel_addsub(int op1, int op2, TCGv_i32 a, TCGv_i32 b)
 646 {
 647     TCGv_ptr tmp;
 648
 649     switch (op2) {
 650 #define gen_pas_helper(name) glue(gen_helper_,name)(a, a, b, tmp)
 651     case 0:
 652         tmp = tcg_temp_new_ptr();
 653         tcg_gen_addi_ptr(tmp, cpu_env, offsetof(CPUARMState, GE));
 654         PAS_OP(s)
 655         tcg_temp_free_ptr(tmp);
 656         break;
 657     case 4:
 658         tmp = tcg_temp_new_ptr();
 659         tcg_gen_addi_ptr(tmp, cpu_env, offsetof(CPUARMState, GE));
 660         PAS_OP(u)
 661         tcg_temp_free_ptr(tmp);
 662         break;
 663 #undef gen_pas_helper
 664 #define gen_pas_helper(name) glue(gen_helper_,name)(a, a, b)
 665     case 1:
 666         PAS_OP(q);
 667         break;
 668     case 2:
 669         PAS_OP(sh);
 670         break;
 671     case 5:
 672         PAS_OP(uq);
 673         break;
 674     case 6:
 675         PAS_OP(uh);
 676         break;
 677 #undef gen_pas_helper
 678     }
 679 }
 680 #undef PAS_OP
 681
 682 /*
 683  * generate a conditional branch based on ARM condition code cc.
 684  * This is common between ARM and Aarch64 targets.
 685  */
 686 void arm_gen_test_cc(int cc, int label)
 687 {
 688     TCGv_i32 tmp;
 689     int inv;
 690
 691     switch (cc) {
 692     case 0: /* eq: Z */
 693         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_ZF, 0, label);
 694         break;
 695     case 1: /* ne: !Z */
 696         tcg_gen_brcondi_i32(TCG_COND_NE, cpu_ZF, 0, label);
 697         break;
 698     case 2: /* cs: C */
 699         tcg_gen_brcondi_i32(TCG_COND_NE, cpu_CF, 0, label);
 700         break;
 701     case 3: /* cc: !C */
 702         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_CF, 0, label);
 703         break;
 704     case 4: /* mi: N */
 705         tcg_gen_brcondi_i32(TCG_COND_LT, cpu_NF, 0, label);
 706         break;
 707     case 5: /* pl: !N */
 708         tcg_gen_brcondi_i32(TCG_COND_GE, cpu_NF, 0, label);
 709         break;
 710     case 6: /* vs: V */
 711         tcg_gen_brcondi_i32(TCG_COND_LT, cpu_VF, 0, label);
 712         break;
 713     case 7: /* vc: !V */
 714         tcg_gen_brcondi_i32(TCG_COND_GE, cpu_VF, 0, label);
 715         break;
 716     case 8: /* hi: C && !Z */
 717         inv = gen_new_label();
 718         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_CF, 0, inv);
 719         tcg_gen_brcondi_i32(TCG_COND_NE, cpu_ZF, 0, label);
 720         gen_set_label(inv);
 721         break;
 722     case 9: /* ls: !C || Z */
 723         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_CF, 0, label);
 724         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_ZF, 0, label);
 725         break;
 726     case 10: /* ge: N == V -> N ^ V == 0 */
 727         tmp = tcg_temp_new_i32();
 728         tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
 729         tcg_gen_brcondi_i32(TCG_COND_GE, tmp, 0, label);
 730         tcg_temp_free_i32(tmp);
 731         break;
 732     case 11: /* lt: N != V -> N ^ V != 0 */
 733         tmp = tcg_temp_new_i32();
 734         tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
 735         tcg_gen_brcondi_i32(TCG_COND_LT, tmp, 0, label);
 736         tcg_temp_free_i32(tmp);
 737         break;
 738     case 12: /* gt: !Z && N == V */
 739         inv = gen_new_label();
 740         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_ZF, 0, inv);
 741         tmp = tcg_temp_new_i32();
 742         tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
 743         tcg_gen_brcondi_i32(TCG_COND_GE, tmp, 0, label);
 744         tcg_temp_free_i32(tmp);
 745         gen_set_label(inv);
 746         break;
 747     case 13: /* le: Z || N != V */
 748         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_ZF, 0, label);
 749         tmp = tcg_temp_new_i32();
 750         tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
 751         tcg_gen_brcondi_i32(TCG_COND_LT, tmp, 0, label);
 752         tcg_temp_free_i32(tmp);
 753         break;
 754     default:
 755         fprintf(stderr, "Bad condition code 0x%x\n", cc);
 756         abort();
 757     }
 758 }
 759
 760 static const uint8_t table_logic_cc[16] = {
 761     1, /* and */
 762     1, /* xor */
 763     0, /* sub */
 764     0, /* rsb */
 765     0, /* add */
 766     0, /* adc */
 767     0, /* sbc */
 768     0, /* rsc */
 769     1, /* andl */
 770     1, /* xorl */
 771     0, /* cmp */
 772     0, /* cmn */
 773     1, /* orr */
 774     1, /* mov */
 775     1, /* bic */
 776     1, /* mvn */
 777 };
 778
 779 /* Set PC and Thumb state from an immediate address.  */
 780 static inline void gen_bx_im(DisasContext *s, uint32_t addr)
 781 {
 782     TCGv_i32 tmp;
 783
 784     s->is_jmp = DISAS_UPDATE;
 785     if (s->thumb != (addr & 1)) {
 786         tmp = tcg_temp_new_i32();
 787         tcg_gen_movi_i32(tmp, addr & 1);
 788         tcg_gen_st_i32(tmp, cpu_env, offsetof(CPUARMState, thumb));
 789         tcg_temp_free_i32(tmp);
 790     }
 791     tcg_gen_movi_i32(cpu_R[15], addr & ~1);
 792 }
 793
 794 /* Set PC and Thumb state from var.  var is marked as dead.  */
 795 static inline void gen_bx(DisasContext *s, TCGv_i32 var)
 796 {
 797     s->is_jmp = DISAS_UPDATE;
 798     tcg_gen_andi_i32(cpu_R[15], var, ~1);
 799     tcg_gen_andi_i32(var, var, 1);
 800     store_cpu_field(var, thumb);
 801 }
 802
 803 /* Variant of store_reg which uses branch&exchange logic when storing
 804    to r15 in ARM architecture v7 and above. The source must be a temporary
 805    and will be marked as dead. */
 806 static inline void store_reg_bx(CPUARMState *env, DisasContext *s,
 807                                 int reg, TCGv_i32 var)
 808 {
 809     if (reg == 15 && ENABLE_ARCH_7) {
 810         gen_bx(s, var);
 811     } else {
 812         store_reg(s, reg, var);
 813     }
 814 }
 815
 816 /* Variant of store_reg which uses branch&exchange logic when storing
 817  * to r15 in ARM architecture v5T and above. This is used for storing
 818  * the results of a LDR/LDM/POP into r15, and corresponds to the cases
 819  * in the ARM ARM which use the LoadWritePC() pseudocode function. */
 820 static inline void store_reg_from_load(CPUARMState *env, DisasContext *s,
 821                                        int reg, TCGv_i32 var)
 822 {
 823     if (reg == 15 && ENABLE_ARCH_5) {
 824         gen_bx(s, var);
 825     } else {
 826         store_reg(s, reg, var);
 827     }
 828 }
 829
 830 /* Abstractions of "generate code to do a guest load/store for
 831  * AArch32", where a vaddr is always 32 bits (and is zero
 832  * extended if we're a 64 bit core) and  data is also
 833  * 32 bits unless specifically doing a 64 bit access.
 834  * These functions work like tcg_gen_qemu_{ld,st}* except
 835  * that the address argument is TCGv_i32 rather than TCGv.
 836  */
 837 #if TARGET_LONG_BITS == 32
 838
 839 #define DO_GEN_LD(SUFF, OPC)                                             \
 840 static inline void gen_aa32_ld##SUFF(TCGv_i32 val, TCGv_i32 addr, int index) \
 841 {                                                                        \
 842     tcg_gen_qemu_ld_i32(val, addr, index, OPC);                          \
 843 }
 844
 845 #define DO_GEN_ST(SUFF, OPC)                                             \
 846 static inline void gen_aa32_st##SUFF(TCGv_i32 val, TCGv_i32 addr, int index) \
 847 {                                                                        \
 848     tcg_gen_qemu_st_i32(val, addr, index, OPC);                          \
 849 }
 850
 851 static inline void gen_aa32_ld64(TCGv_i64 val, TCGv_i32 addr, int index)
 852 {
 853     tcg_gen_qemu_ld_i64(val, addr, index, MO_TEQ);
 854 }
 855
 856 static inline void gen_aa32_st64(TCGv_i64 val, TCGv_i32 addr, int index)
 857 {
 858     tcg_gen_qemu_st_i64(val, addr, index, MO_TEQ);
 859 }
 860
 861 #else
 862
 863 #define DO_GEN_LD(SUFF, OPC)                                             \
 864 static inline void gen_aa32_ld##SUFF(TCGv_i32 val, TCGv_i32 addr, int index) \
 865 {                                                                        \
 866     TCGv addr64 = tcg_temp_new();                                        \
 867     tcg_gen_extu_i32_i64(addr64, addr);                                  \
 868     tcg_gen_qemu_ld_i32(val, addr64, index, OPC);                        \
 869     tcg_temp_free(addr64);                                               \
 870 }
 871
 872 #define DO_GEN_ST(SUFF, OPC)                                             \
 873 static inline void gen_aa32_st##SUFF(TCGv_i32 val, TCGv_i32 addr, int index) \
 874 {                                                                        \
 875     TCGv addr64 = tcg_temp_new();                                        \
 876     tcg_gen_extu_i32_i64(addr64, addr);                                  \
 877     tcg_gen_qemu_st_i32(val, addr64, index, OPC);                        \
 878     tcg_temp_free(addr64);                                               \
 879 }
 880
 881 static inline void gen_aa32_ld64(TCGv_i64 val, TCGv_i32 addr, int index)
 882 {
 883     TCGv addr64 = tcg_temp_new();
 884     tcg_gen_extu_i32_i64(addr64, addr);
 885     tcg_gen_qemu_ld_i64(val, addr64, index, MO_TEQ);
 886     tcg_temp_free(addr64);
 887 }
 888
 889 static inline void gen_aa32_st64(TCGv_i64 val, TCGv_i32 addr, int index)
 890 {
 891     TCGv addr64 = tcg_temp_new();
 892     tcg_gen_extu_i32_i64(addr64, addr);
 893     tcg_gen_qemu_st_i64(val, addr64, index, MO_TEQ);
 894     tcg_temp_free(addr64);
 895 }
 896
 897 #endif
 898
 899 DO_GEN_LD(8s, MO_SB)
 900 DO_GEN_LD(8u, MO_UB)
 901 DO_GEN_LD(16s, MO_TESW)
 902 DO_GEN_LD(16u, MO_TEUW)
 903 DO_GEN_LD(32u, MO_TEUL)
 904 DO_GEN_ST(8, MO_UB)
 905 DO_GEN_ST(16, MO_TEUW)
 906 DO_GEN_ST(32, MO_TEUL)
 907
 908 static inline void gen_set_pc_im(DisasContext *s, target_ulong val)
 909 {
 910     tcg_gen_movi_i32(cpu_R[15], val);
 911 }
 912
 913 static inline void
 914 gen_set_condexec (DisasContext *s)
 915 {
 916     if (s->condexec_mask) {
 917         uint32_t val = (s->condexec_cond << 4) | (s->condexec_mask >> 1);
 918         TCGv_i32 tmp = tcg_temp_new_i32();
 919         tcg_gen_movi_i32(tmp, val);
 920         store_cpu_field(tmp, condexec_bits);
 921     }
 922 }
 923
 924 static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
 925 {
 926     gen_set_condexec(s);
 927     gen_set_pc_im(s, s->pc - offset);
 928     gen_exception_internal(excp);
 929     s->is_jmp = DISAS_JUMP;
 930 }
 931
 932 static void gen_exception_insn(DisasContext *s, int offset, int excp, int syn)
 933 {
 934     gen_set_condexec(s);
 935     gen_set_pc_im(s, s->pc - offset);
 936     gen_exception(excp, syn);
 937     s->is_jmp = DISAS_JUMP;
 938 }
 939
 940 /* Force a TB lookup after an instruction that changes the CPU state.  */
 941 static inline void gen_lookup_tb(DisasContext *s)
 942 {
 943     tcg_gen_movi_i32(cpu_R[15], s->pc & ~1);
 944     s->is_jmp = DISAS_UPDATE;
 945 }
 946
 947 static inline void gen_add_data_offset(DisasContext *s, unsigned int insn,
 948                                        TCGv_i32 var)
 949 {
 950     int val, rm, shift, shiftop;
 951     TCGv_i32 offset;
 952
 953     if (!(insn & (1 << 25))) {
 954         /* immediate */
 955         val = insn & 0xfff;
 956         if (!(insn & (1 << 23)))
 957             val = -val;
 958         if (val != 0)
 959             tcg_gen_addi_i32(var, var, val);
 960     } else {
 961         /* shift/register */
 962         rm = (insn) & 0xf;
 963         shift = (insn >> 7) & 0x1f;
 964         shiftop = (insn >> 5) & 3;
 965         offset = load_reg(s, rm);
 966         gen_arm_shift_im(offset, shiftop, shift, 0);
 967         if (!(insn & (1 << 23)))
 968             tcg_gen_sub_i32(var, var, offset);
 969         else
 970             tcg_gen_add_i32(var, var, offset);
 971         tcg_temp_free_i32(offset);
 972     }
 973 }
 974
 975 static inline void gen_add_datah_offset(DisasContext *s, unsigned int insn,
 976                                         int extra, TCGv_i32 var)
 977 {
 978     int val, rm;
 979     TCGv_i32 offset;
 980
 981     if (insn & (1 << 22)) {
 982         /* immediate */
 983         val = (insn & 0xf) | ((insn >> 4) & 0xf0);
 984         if (!(insn & (1 << 23)))
 985             val = -val;
 986         val += extra;
 987         if (val != 0)
 988             tcg_gen_addi_i32(var, var, val);
 989     } else {
 990         /* register */
 991         if (extra)
 992             tcg_gen_addi_i32(var, var, extra);
 993         rm = (insn) & 0xf;
 994         offset = load_reg(s, rm);
 995         if (!(insn & (1 << 23)))
 996             tcg_gen_sub_i32(var, var, offset);
 997         else
 998             tcg_gen_add_i32(var, var, offset);
 999         tcg_temp_free_i32(offset);
1000     }
1001 }
1002
1003 static TCGv_ptr get_fpstatus_ptr(int neon)
1004 {
1005     TCGv_ptr statusptr = tcg_temp_new_ptr();
1006     int offset;
1007     if (neon) {
1008         offset = offsetof(CPUARMState, vfp.standard_fp_status);
1009     } else {
1010         offset = offsetof(CPUARMState, vfp.fp_status);
1011     }
1012     tcg_gen_addi_ptr(statusptr, cpu_env, offset);
1013     return statusptr;
1014 }
1015
1016 #define VFP_OP2(name)                                                 \
1017 static inline void gen_vfp_##name(int dp)                             \
1018 {                                                                     \
1019     TCGv_ptr fpst = get_fpstatus_ptr(0);                              \
1020     if (dp) {                                                         \
1021         gen_helper_vfp_##name##d(cpu_F0d, cpu_F0d, cpu_F1d, fpst);    \
1022     } else {                                                          \
1023         gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, cpu_F1s, fpst);    \
1024     }                                                                 \
1025     tcg_temp_free_ptr(fpst);                                          \
1026 }
1027
1028 VFP_OP2(add)
1029 VFP_OP2(sub)
1030 VFP_OP2(mul)
1031 VFP_OP2(div)
1032
1033 #undef VFP_OP2
1034
1035 static inline void gen_vfp_F1_mul(int dp)
1036 {
1037     /* Like gen_vfp_mul() but put result in F1 */
1038     TCGv_ptr fpst = get_fpstatus_ptr(0);
1039     if (dp) {
1040         gen_helper_vfp_muld(cpu_F1d, cpu_F0d, cpu_F1d, fpst);
1041     } else {
1042         gen_helper_vfp_muls(cpu_F1s, cpu_F0s, cpu_F1s, fpst);
1043     }
1044     tcg_temp_free_ptr(fpst);
1045 }
1046
1047 static inline void gen_vfp_F1_neg(int dp)
1048 {
1049     /* Like gen_vfp_neg() but put result in F1 */
1050     if (dp) {
1051         gen_helper_vfp_negd(cpu_F1d, cpu_F0d);
1052     } else {
1053         gen_helper_vfp_negs(cpu_F1s, cpu_F0s);
1054     }
1055 }
1056
1057 static inline void gen_vfp_abs(int dp)
1058 {
1059     if (dp)
1060         gen_helper_vfp_absd(cpu_F0d, cpu_F0d);
1061     else
1062         gen_helper_vfp_abss(cpu_F0s, cpu_F0s);
1063 }
1064
1065 static inline void gen_vfp_neg(int dp)
1066 {
1067     if (dp)
1068         gen_helper_vfp_negd(cpu_F0d, cpu_F0d);
1069     else
1070         gen_helper_vfp_negs(cpu_F0s, cpu_F0s);
1071 }
1072
1073 static inline void gen_vfp_sqrt(int dp)
1074 {
1075     if (dp)
1076         gen_helper_vfp_sqrtd(cpu_F0d, cpu_F0d, cpu_env);
1077     else
1078         gen_helper_vfp_sqrts(cpu_F0s, cpu_F0s, cpu_env);
1079 }
1080
1081 static inline void gen_vfp_cmp(int dp)
1082 {
1083     if (dp)
1084         gen_helper_vfp_cmpd(cpu_F0d, cpu_F1d, cpu_env);
1085     else
1086         gen_helper_vfp_cmps(cpu_F0s, cpu_F1s, cpu_env);
1087 }
1088
1089 static inline void gen_vfp_cmpe(int dp)
1090 {
1091     if (dp)
1092         gen_helper_vfp_cmped(cpu_F0d, cpu_F1d, cpu_env);
1093     else
1094         gen_helper_vfp_cmpes(cpu_F0s, cpu_F1s, cpu_env);
1095 }
1096
1097 static inline void gen_vfp_F1_ld0(int dp)
1098 {
1099     if (dp)
1100         tcg_gen_movi_i64(cpu_F1d, 0);
1101     else
1102         tcg_gen_movi_i32(cpu_F1s, 0);
1103 }
1104
1105 #define VFP_GEN_ITOF(name) \
1106 static inline void gen_vfp_##name(int dp, int neon) \
1107 { \
1108     TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
1109     if (dp) { \
1110         gen_helper_vfp_##name##d(cpu_F0d, cpu_F0s, statusptr); \
1111     } else { \
1112         gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
1113     } \
1114     tcg_temp_free_ptr(statusptr); \
1115 }
1116
1117 VFP_GEN_ITOF(uito)
1118 VFP_GEN_ITOF(sito)
1119 #undef VFP_GEN_ITOF
1120
1121 #define VFP_GEN_FTOI(name) \
1122 static inline void gen_vfp_##name(int dp, int neon) \
1123 { \
1124     TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
1125     if (dp) { \
1126         gen_helper_vfp_##name##d(cpu_F0s, cpu_F0d, statusptr); \
1127     } else { \
1128         gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
1129     } \
1130     tcg_temp_free_ptr(statusptr); \
1131 }
1132
1133 VFP_GEN_FTOI(toui)
1134 VFP_GEN_FTOI(touiz)
1135 VFP_GEN_FTOI(tosi)
1136 VFP_GEN_FTOI(tosiz)
1137 #undef VFP_GEN_FTOI
1138
1139 #define VFP_GEN_FIX(name, round) \
1140 static inline void gen_vfp_##name(int dp, int shift, int neon) \
1141 { \
1142     TCGv_i32 tmp_shift = tcg_const_i32(shift); \
1143     TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
1144     if (dp) { \
1145         gen_helper_vfp_##name##d##round(cpu_F0d, cpu_F0d, tmp_shift, \
1146                                         statusptr); \
1147     } else { \
1148         gen_helper_vfp_##name##s##round(cpu_F0s, cpu_F0s, tmp_shift, \
1149                                         statusptr); \
1150     } \
1151     tcg_temp_free_i32(tmp_shift); \
1152     tcg_temp_free_ptr(statusptr); \
1153 }
1154 VFP_GEN_FIX(tosh, _round_to_zero)
1155 VFP_GEN_FIX(tosl, _round_to_zero)
1156 VFP_GEN_FIX(touh, _round_to_zero)
1157 VFP_GEN_FIX(toul, _round_to_zero)
1158 VFP_GEN_FIX(shto, )
1159 VFP_GEN_FIX(slto, )
1160 VFP_GEN_FIX(uhto, )
1161 VFP_GEN_FIX(ulto, )
1162 #undef VFP_GEN_FIX
1163
1164 static inline void gen_vfp_ld(DisasContext *s, int dp, TCGv_i32 addr)
1165 {
1166     if (dp) {
1167         gen_aa32_ld64(cpu_F0d, addr, get_mem_index(s));
1168     } else {
1169         gen_aa32_ld32u(cpu_F0s, addr, get_mem_index(s));
1170     }
1171 }
1172
1173 static inline void gen_vfp_st(DisasContext *s, int dp, TCGv_i32 addr)
1174 {
1175     if (dp) {
1176         gen_aa32_st64(cpu_F0d, addr, get_mem_index(s));
1177     } else {
1178         gen_aa32_st32(cpu_F0s, addr, get_mem_index(s));
1179     }
1180 }
1181
1182 static inline long
1183 vfp_reg_offset (int dp, int reg)
1184 {
1185     if (dp)
1186         return offsetof(CPUARMState, vfp.regs[reg]);
1187     else if (reg & 1) {
1188         return offsetof(CPUARMState, vfp.regs[reg >> 1])
1189           + offsetof(CPU_DoubleU, l.upper);
1190     } else {
1191         return offsetof(CPUARMState, vfp.regs[reg >> 1])
1192           + offsetof(CPU_DoubleU, l.lower);
1193     }
1194 }
1195
1196 /* Return the offset of a 32-bit piece of a NEON register.
1197    zero is the least significant end of the register.  */
1198 static inline long
1199 neon_reg_offset (int reg, int n)
1200 {
1201     int sreg;
1202     sreg = reg * 2 + n;
1203     return vfp_reg_offset(0, sreg);
1204 }
1205
1206 static TCGv_i32 neon_load_reg(int reg, int pass)
1207 {
1208     TCGv_i32 tmp = tcg_temp_new_i32();
1209     tcg_gen_ld_i32(tmp, cpu_env, neon_reg_offset(reg, pass));
1210     return tmp;
1211 }
1212
1213 static void neon_store_reg(int reg, int pass, TCGv_i32 var)
1214 {
1215     tcg_gen_st_i32(var, cpu_env, neon_reg_offset(reg, pass));
1216     tcg_temp_free_i32(var);
1217 }
1218
1219 static inline void neon_load_reg64(TCGv_i64 var, int reg)
1220 {
1221     tcg_gen_ld_i64(var, cpu_env, vfp_reg_offset(1, reg));
1222 }
1223
1224 static inline void neon_store_reg64(TCGv_i64 var, int reg)
1225 {
1226     tcg_gen_st_i64(var, cpu_env, vfp_reg_offset(1, reg));
1227 }
1228
1229 #define tcg_gen_ld_f32 tcg_gen_ld_i32
1230 #define tcg_gen_ld_f64 tcg_gen_ld_i64
1231 #define tcg_gen_st_f32 tcg_gen_st_i32
1232 #define tcg_gen_st_f64 tcg_gen_st_i64
1233
1234 static inline void gen_mov_F0_vreg(int dp, int reg)
1235 {
1236     if (dp)
1237         tcg_gen_ld_f64(cpu_F0d, cpu_env, vfp_reg_offset(dp, reg));
1238     else
1239         tcg_gen_ld_f32(cpu_F0s, cpu_env, vfp_reg_offset(dp, reg));
1240 }
1241
1242 static inline void gen_mov_F1_vreg(int dp, int reg)
1243 {
1244     if (dp)
1245         tcg_gen_ld_f64(cpu_F1d, cpu_env, vfp_reg_offset(dp, reg));
1246     else
1247         tcg_gen_ld_f32(cpu_F1s, cpu_env, vfp_reg_offset(dp, reg));
1248 }
1249
1250 static inline void gen_mov_vreg_F0(int dp, int reg)
1251 {
1252     if (dp)
1253         tcg_gen_st_f64(cpu_F0d, cpu_env, vfp_reg_offset(dp, reg));
1254     else
1255         tcg_gen_st_f32(cpu_F0s, cpu_env, vfp_reg_offset(dp, reg));
1256 }
1257
1258 #define ARM_CP_RW_BIT   (1 << 20)
1259
1260 static inline void iwmmxt_load_reg(TCGv_i64 var, int reg)
1261 {
1262     tcg_gen_ld_i64(var, cpu_env, offsetof(CPUARMState, iwmmxt.regs[reg]));
1263 }
1264
1265 static inline void iwmmxt_store_reg(TCGv_i64 var, int reg)
1266 {
1267     tcg_gen_st_i64(var, cpu_env, offsetof(CPUARMState, iwmmxt.regs[reg]));
1268 }
1269
1270 static inline TCGv_i32 iwmmxt_load_creg(int reg)
1271 {
1272     TCGv_i32 var = tcg_temp_new_i32();
1273     tcg_gen_ld_i32(var, cpu_env, offsetof(CPUARMState, iwmmxt.cregs[reg]));
1274     return var;
1275 }
1276
1277 static inline void iwmmxt_store_creg(int reg, TCGv_i32 var)
1278 {
1279     tcg_gen_st_i32(var, cpu_env, offsetof(CPUARMState, iwmmxt.cregs[reg]));
1280     tcg_temp_free_i32(var);
1281 }
1282
1283 static inline void gen_op_iwmmxt_movq_wRn_M0(int rn)
1284 {
1285     iwmmxt_store_reg(cpu_M0, rn);
1286 }
1287
1288 static inline void gen_op_iwmmxt_movq_M0_wRn(int rn)
1289 {
1290     iwmmxt_load_reg(cpu_M0, rn);
1291 }
1292
1293 static inline void gen_op_iwmmxt_orq_M0_wRn(int rn)
1294 {
1295     iwmmxt_load_reg(cpu_V1, rn);
1296     tcg_gen_or_i64(cpu_M0, cpu_M0, cpu_V1);
1297 }
1298
1299 static inline void gen_op_iwmmxt_andq_M0_wRn(int rn)
1300 {
1301     iwmmxt_load_reg(cpu_V1, rn);
1302     tcg_gen_and_i64(cpu_M0, cpu_M0, cpu_V1);
1303 }
1304
1305 static inline void gen_op_iwmmxt_xorq_M0_wRn(int rn)
1306 {
1307     iwmmxt_load_reg(cpu_V1, rn);
1308     tcg_gen_xor_i64(cpu_M0, cpu_M0, cpu_V1);
1309 }
1310
1311 #define IWMMXT_OP(name) \
1312 static inline void gen_op_iwmmxt_##name##_M0_wRn(int rn) \
1313 { \
1314     iwmmxt_load_reg(cpu_V1, rn); \
1315     gen_helper_iwmmxt_##name(cpu_M0, cpu_M0, cpu_V1); \
1316 }
1317
1318 #define IWMMXT_OP_ENV(name) \
1319 static inline void gen_op_iwmmxt_##name##_M0_wRn(int rn) \
1320 { \
1321     iwmmxt_load_reg(cpu_V1, rn); \
1322     gen_helper_iwmmxt_##name(cpu_M0, cpu_env, cpu_M0, cpu_V1); \
1323 }
1324
1325 #define IWMMXT_OP_ENV_SIZE(name) \
1326 IWMMXT_OP_ENV(name##b) \
1327 IWMMXT_OP_ENV(name##w) \
1328 IWMMXT_OP_ENV(name##l)
1329
1330 #define IWMMXT_OP_ENV1(name) \
1331 static inline void gen_op_iwmmxt_##name##_M0(void) \
1332 { \
1333     gen_helper_iwmmxt_##name(cpu_M0, cpu_env, cpu_M0); \
1334 }
1335
1336 IWMMXT_OP(maddsq)
1337 IWMMXT_OP(madduq)
1338 IWMMXT_OP(sadb)
1339 IWMMXT_OP(sadw)
1340 IWMMXT_OP(mulslw)
1341 IWMMXT_OP(mulshw)
1342 IWMMXT_OP(mululw)
1343 IWMMXT_OP(muluhw)
1344 IWMMXT_OP(macsw)
1345 IWMMXT_OP(macuw)
1346
1347 IWMMXT_OP_ENV_SIZE(unpackl)
1348 IWMMXT_OP_ENV_SIZE(unpackh)
1349
1350 IWMMXT_OP_ENV1(unpacklub)
1351 IWMMXT_OP_ENV1(unpackluw)
1352 IWMMXT_OP_ENV1(unpacklul)
1353 IWMMXT_OP_ENV1(unpackhub)
1354 IWMMXT_OP_ENV1(unpackhuw)
1355 IWMMXT_OP_ENV1(unpackhul)
1356 IWMMXT_OP_ENV1(unpacklsb)
1357 IWMMXT_OP_ENV1(unpacklsw)
1358 IWMMXT_OP_ENV1(unpacklsl)
1359 IWMMXT_OP_ENV1(unpackhsb)
1360 IWMMXT_OP_ENV1(unpackhsw)
1361 IWMMXT_OP_ENV1(unpackhsl)
1362
1363 IWMMXT_OP_ENV_SIZE(cmpeq)
1364 IWMMXT_OP_ENV_SIZE(cmpgtu)
1365 IWMMXT_OP_ENV_SIZE(cmpgts)
1366
1367 IWMMXT_OP_ENV_SIZE(mins)
1368 IWMMXT_OP_ENV_SIZE(minu)
1369 IWMMXT_OP_ENV_SIZE(maxs)
1370 IWMMXT_OP_ENV_SIZE(maxu)
1371
1372 IWMMXT_OP_ENV_SIZE(subn)
1373 IWMMXT_OP_ENV_SIZE(addn)
1374 IWMMXT_OP_ENV_SIZE(subu)
1375 IWMMXT_OP_ENV_SIZE(addu)
1376 IWMMXT_OP_ENV_SIZE(subs)
1377 IWMMXT_OP_ENV_SIZE(adds)
1378
1379 IWMMXT_OP_ENV(avgb0)
1380 IWMMXT_OP_ENV(avgb1)
1381 IWMMXT_OP_ENV(avgw0)
1382 IWMMXT_OP_ENV(avgw1)
1383
1384 IWMMXT_OP(msadb)
1385
1386 IWMMXT_OP_ENV(packuw)
1387 IWMMXT_OP_ENV(packul)
1388 IWMMXT_OP_ENV(packuq)
1389 IWMMXT_OP_ENV(packsw)
1390 IWMMXT_OP_ENV(packsl)
1391 IWMMXT_OP_ENV(packsq)
1392
1393 static void gen_op_iwmmxt_set_mup(void)
1394 {
1395     TCGv_i32 tmp;
1396     tmp = load_cpu_field(iwmmxt.cregs[ARM_IWMMXT_wCon]);
1397     tcg_gen_ori_i32(tmp, tmp, 2);
1398     store_cpu_field(tmp, iwmmxt.cregs[ARM_IWMMXT_wCon]);
1399 }
1400
1401 static void gen_op_iwmmxt_set_cup(void)
1402 {
1403     TCGv_i32 tmp;
1404     tmp = load_cpu_field(iwmmxt.cregs[ARM_IWMMXT_wCon]);
1405     tcg_gen_ori_i32(tmp, tmp, 1);
1406     store_cpu_field(tmp, iwmmxt.cregs[ARM_IWMMXT_wCon]);
1407 }
1408
1409 static void gen_op_iwmmxt_setpsr_nz(void)
1410 {
1411     TCGv_i32 tmp = tcg_temp_new_i32();
1412     gen_helper_iwmmxt_setpsr_nz(tmp, cpu_M0);
1413     store_cpu_field(tmp, iwmmxt.cregs[ARM_IWMMXT_wCASF]);
1414 }
1415
1416 static inline void gen_op_iwmmxt_addl_M0_wRn(int rn)
1417 {
1418     iwmmxt_load_reg(cpu_V1, rn);
1419     tcg_gen_ext32u_i64(cpu_V1, cpu_V1);
1420     tcg_gen_add_i64(cpu_M0, cpu_M0, cpu_V1);
1421 }
1422
1423 static inline int gen_iwmmxt_address(DisasContext *s, uint32_t insn,
1424                                      TCGv_i32 dest)
1425 {
1426     int rd;
1427     uint32_t offset;
1428     TCGv_i32 tmp;
1429
1430     rd = (insn >> 16) & 0xf;
1431     tmp = load_reg(s, rd);
1432
1433     offset = (insn & 0xff) << ((insn >> 7) & 2);
1434     if (insn & (1 << 24)) {
1435         /* Pre indexed */
1436         if (insn & (1 << 23))
1437             tcg_gen_addi_i32(tmp, tmp, offset);
1438         else
1439             tcg_gen_addi_i32(tmp, tmp, -offset);
1440         tcg_gen_mov_i32(dest, tmp);
1441         if (insn & (1 << 21))
1442             store_reg(s, rd, tmp);
1443         else
1444             tcg_temp_free_i32(tmp);
1445     } else if (insn & (1 << 21)) {
1446         /* Post indexed */
1447         tcg_gen_mov_i32(dest, tmp);
1448         if (insn & (1 << 23))
1449             tcg_gen_addi_i32(tmp, tmp, offset);
1450         else
1451             tcg_gen_addi_i32(tmp, tmp, -offset);
1452         store_reg(s, rd, tmp);
1453     } else if (!(insn & (1 << 23)))
1454         return 1;
1455     return 0;
1456 }
1457
1458 static inline int gen_iwmmxt_shift(uint32_t insn, uint32_t mask, TCGv_i32 dest)
1459 {
1460     int rd = (insn >> 0) & 0xf;
1461     TCGv_i32 tmp;
1462
1463     if (insn & (1 << 8)) {
1464         if (rd < ARM_IWMMXT_wCGR0 || rd > ARM_IWMMXT_wCGR3) {
1465             return 1;
1466         } else {
1467             tmp = iwmmxt_load_creg(rd);
1468         }
1469     } else {
1470         tmp = tcg_temp_new_i32();
1471         iwmmxt_load_reg(cpu_V0, rd);
1472         tcg_gen_trunc_i64_i32(tmp, cpu_V0);
1473     }
1474     tcg_gen_andi_i32(tmp, tmp, mask);
1475     tcg_gen_mov_i32(dest, tmp);
1476     tcg_temp_free_i32(tmp);
1477     return 0;
1478 }
1479
1480 /* Disassemble an iwMMXt instruction.  Returns nonzero if an error occurred
1481    (ie. an undefined instruction).  */
1482 static int disas_iwmmxt_insn(CPUARMState *env, DisasContext *s, uint32_t insn)
1483 {
1484     int rd, wrd;
1485     int rdhi, rdlo, rd0, rd1, i;
1486     TCGv_i32 addr;
1487     TCGv_i32 tmp, tmp2, tmp3;
1488
1489     if ((insn & 0x0e000e00) == 0x0c000000) {
1490         if ((insn & 0x0fe00ff0) == 0x0c400000) {
1491             wrd = insn & 0xf;
1492             rdlo = (insn >> 12) & 0xf;
1493             rdhi = (insn >> 16) & 0xf;
1494             if (insn & ARM_CP_RW_BIT) {                 /* TMRRC */
1495                 iwmmxt_load_reg(cpu_V0, wrd);
1496                 tcg_gen_trunc_i64_i32(cpu_R[rdlo], cpu_V0);
1497                 tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
1498                 tcg_gen_trunc_i64_i32(cpu_R[rdhi], cpu_V0);
1499             } else {                                    /* TMCRR */
1500                 tcg_gen_concat_i32_i64(cpu_V0, cpu_R[rdlo], cpu_R[rdhi]);
1501                 iwmmxt_store_reg(cpu_V0, wrd);
1502                 gen_op_iwmmxt_set_mup();
1503             }
1504             return 0;
1505         }
1506
1507         wrd = (insn >> 12) & 0xf;
1508         addr = tcg_temp_new_i32();
1509         if (gen_iwmmxt_address(s, insn, addr)) {
1510             tcg_temp_free_i32(addr);
1511             return 1;
1512         }
1513         if (insn & ARM_CP_RW_BIT) {
1514             if ((insn >> 28) == 0xf) {                  /* WLDRW wCx */
1515                 tmp = tcg_temp_new_i32();
1516                 gen_aa32_ld32u(tmp, addr, get_mem_index(s));
1517                 iwmmxt_store_creg(wrd, tmp);
1518             } else {
1519                 i = 1;
1520                 if (insn & (1 << 8)) {
1521                     if (insn & (1 << 22)) {             /* WLDRD */
1522                         gen_aa32_ld64(cpu_M0, addr, get_mem_index(s));
1523                         i = 0;
1524                     } else {                            /* WLDRW wRd */
1525                         tmp = tcg_temp_new_i32();
1526                         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
1527                     }
1528                 } else {
1529                     tmp = tcg_temp_new_i32();
1530                     if (insn & (1 << 22)) {             /* WLDRH */
1531                         gen_aa32_ld16u(tmp, addr, get_mem_index(s));
1532                     } else {                            /* WLDRB */
1533                         gen_aa32_ld8u(tmp, addr, get_mem_index(s));
1534                     }
1535                 }
1536                 if (i) {
1537                     tcg_gen_extu_i32_i64(cpu_M0, tmp);
1538                     tcg_temp_free_i32(tmp);
1539                 }
1540                 gen_op_iwmmxt_movq_wRn_M0(wrd);
1541             }
1542         } else {
1543             if ((insn >> 28) == 0xf) {                  /* WSTRW wCx */
1544                 tmp = iwmmxt_load_creg(wrd);
1545                 gen_aa32_st32(tmp, addr, get_mem_index(s));
1546             } else {
1547                 gen_op_iwmmxt_movq_M0_wRn(wrd);
1548                 tmp = tcg_temp_new_i32();
1549                 if (insn & (1 << 8)) {
1550                     if (insn & (1 << 22)) {             /* WSTRD */
1551                         gen_aa32_st64(cpu_M0, addr, get_mem_index(s));
1552                     } else {                            /* WSTRW wRd */
1553                         tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1554                         gen_aa32_st32(tmp, addr, get_mem_index(s));
1555                     }
1556                 } else {
1557                     if (insn & (1 << 22)) {             /* WSTRH */
1558                         tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1559                         gen_aa32_st16(tmp, addr, get_mem_index(s));
1560                     } else {                            /* WSTRB */
1561                         tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1562                         gen_aa32_st8(tmp, addr, get_mem_index(s));
1563                     }
1564                 }
1565             }
1566             tcg_temp_free_i32(tmp);
1567         }
1568         tcg_temp_free_i32(addr);
1569         return 0;
1570     }
1571
1572     if ((insn & 0x0f000000) != 0x0e000000)
1573         return 1;
1574
1575     switch (((insn >> 12) & 0xf00) | ((insn >> 4) & 0xff)) {
1576     case 0x000:                                         /* WOR */
1577         wrd = (insn >> 12) & 0xf;
1578         rd0 = (insn >> 0) & 0xf;
1579         rd1 = (insn >> 16) & 0xf;
1580         gen_op_iwmmxt_movq_M0_wRn(rd0);
1581         gen_op_iwmmxt_orq_M0_wRn(rd1);
1582         gen_op_iwmmxt_setpsr_nz();
1583         gen_op_iwmmxt_movq_wRn_M0(wrd);
1584         gen_op_iwmmxt_set_mup();
1585         gen_op_iwmmxt_set_cup();
1586         break;
1587     case 0x011:                                         /* TMCR */
1588         if (insn & 0xf)
1589             return 1;
1590         rd = (insn >> 12) & 0xf;
1591         wrd = (insn >> 16) & 0xf;
1592         switch (wrd) {
1593         case ARM_IWMMXT_wCID:
1594         case ARM_IWMMXT_wCASF:
1595             break;
1596         case ARM_IWMMXT_wCon:
1597             gen_op_iwmmxt_set_cup();
1598             /* Fall through.  */
1599         case ARM_IWMMXT_wCSSF:
1600             tmp = iwmmxt_load_creg(wrd);
1601             tmp2 = load_reg(s, rd);
1602             tcg_gen_andc_i32(tmp, tmp, tmp2);
1603             tcg_temp_free_i32(tmp2);
1604             iwmmxt_store_creg(wrd, tmp);
1605             break;
1606         case ARM_IWMMXT_wCGR0:
1607         case ARM_IWMMXT_wCGR1:
1608         case ARM_IWMMXT_wCGR2:
1609         case ARM_IWMMXT_wCGR3:
1610             gen_op_iwmmxt_set_cup();
1611             tmp = load_reg(s, rd);
1612             iwmmxt_store_creg(wrd, tmp);
1613             break;
1614         default:
1615             return 1;
1616         }
1617         break;
1618     case 0x100:                                         /* WXOR */
1619         wrd = (insn >> 12) & 0xf;
1620         rd0 = (insn >> 0) & 0xf;
1621         rd1 = (insn >> 16) & 0xf;
1622         gen_op_iwmmxt_movq_M0_wRn(rd0);
1623         gen_op_iwmmxt_xorq_M0_wRn(rd1);
1624         gen_op_iwmmxt_setpsr_nz();
1625         gen_op_iwmmxt_movq_wRn_M0(wrd);
1626         gen_op_iwmmxt_set_mup();
1627         gen_op_iwmmxt_set_cup();
1628         break;
1629     case 0x111:                                         /* TMRC */
1630         if (insn & 0xf)
1631             return 1;
1632         rd = (insn >> 12) & 0xf;
1633         wrd = (insn >> 16) & 0xf;
1634         tmp = iwmmxt_load_creg(wrd);
1635         store_reg(s, rd, tmp);
1636         break;
1637     case 0x300:                                         /* WANDN */
1638         wrd = (insn >> 12) & 0xf;
1639         rd0 = (insn >> 0) & 0xf;
1640         rd1 = (insn >> 16) & 0xf;
1641         gen_op_iwmmxt_movq_M0_wRn(rd0);
1642         tcg_gen_neg_i64(cpu_M0, cpu_M0);
1643         gen_op_iwmmxt_andq_M0_wRn(rd1);
1644         gen_op_iwmmxt_setpsr_nz();
1645         gen_op_iwmmxt_movq_wRn_M0(wrd);
1646         gen_op_iwmmxt_set_mup();
1647         gen_op_iwmmxt_set_cup();
1648         break;
1649     case 0x200:                                         /* WAND */
1650         wrd = (insn >> 12) & 0xf;
1651         rd0 = (insn >> 0) & 0xf;
1652         rd1 = (insn >> 16) & 0xf;
1653         gen_op_iwmmxt_movq_M0_wRn(rd0);
1654         gen_op_iwmmxt_andq_M0_wRn(rd1);
1655         gen_op_iwmmxt_setpsr_nz();
1656         gen_op_iwmmxt_movq_wRn_M0(wrd);
1657         gen_op_iwmmxt_set_mup();
1658         gen_op_iwmmxt_set_cup();
1659         break;
1660     case 0x810: case 0xa10:                             /* WMADD */
1661         wrd = (insn >> 12) & 0xf;
1662         rd0 = (insn >> 0) & 0xf;
1663         rd1 = (insn >> 16) & 0xf;
1664         gen_op_iwmmxt_movq_M0_wRn(rd0);
1665         if (insn & (1 << 21))
1666             gen_op_iwmmxt_maddsq_M0_wRn(rd1);
1667         else
1668             gen_op_iwmmxt_madduq_M0_wRn(rd1);
1669         gen_op_iwmmxt_movq_wRn_M0(wrd);
1670         gen_op_iwmmxt_set_mup();
1671         break;
1672     case 0x10e: case 0x50e: case 0x90e: case 0xd0e:     /* WUNPCKIL */
1673         wrd = (insn >> 12) & 0xf;
1674         rd0 = (insn >> 16) & 0xf;
1675         rd1 = (insn >> 0) & 0xf;
1676         gen_op_iwmmxt_movq_M0_wRn(rd0);
1677         switch ((insn >> 22) & 3) {
1678         case 0:
1679             gen_op_iwmmxt_unpacklb_M0_wRn(rd1);
1680             break;
1681         case 1:
1682             gen_op_iwmmxt_unpacklw_M0_wRn(rd1);
1683             break;
1684         case 2:
1685             gen_op_iwmmxt_unpackll_M0_wRn(rd1);
1686             break;
1687         case 3:
1688             return 1;
1689         }
1690         gen_op_iwmmxt_movq_wRn_M0(wrd);
1691         gen_op_iwmmxt_set_mup();
1692         gen_op_iwmmxt_set_cup();
1693         break;
1694     case 0x10c: case 0x50c: case 0x90c: case 0xd0c:     /* WUNPCKIH */
1695         wrd = (insn >> 12) & 0xf;
1696         rd0 = (insn >> 16) & 0xf;
1697         rd1 = (insn >> 0) & 0xf;
1698         gen_op_iwmmxt_movq_M0_wRn(rd0);
1699         switch ((insn >> 22) & 3) {
1700         case 0:
1701             gen_op_iwmmxt_unpackhb_M0_wRn(rd1);
1702             break;
1703         case 1:
1704             gen_op_iwmmxt_unpackhw_M0_wRn(rd1);
1705             break;
1706         case 2:
1707             gen_op_iwmmxt_unpackhl_M0_wRn(rd1);
1708             break;
1709         case 3:
1710             return 1;
1711         }
1712         gen_op_iwmmxt_movq_wRn_M0(wrd);
1713         gen_op_iwmmxt_set_mup();
1714         gen_op_iwmmxt_set_cup();
1715         break;
1716     case 0x012: case 0x112: case 0x412: case 0x512:     /* WSAD */
1717         wrd = (insn >> 12) & 0xf;
1718         rd0 = (insn >> 16) & 0xf;
1719         rd1 = (insn >> 0) & 0xf;
1720         gen_op_iwmmxt_movq_M0_wRn(rd0);
1721         if (insn & (1 << 22))
1722             gen_op_iwmmxt_sadw_M0_wRn(rd1);
1723         else
1724             gen_op_iwmmxt_sadb_M0_wRn(rd1);
1725         if (!(insn & (1 << 20)))
1726             gen_op_iwmmxt_addl_M0_wRn(wrd);
1727         gen_op_iwmmxt_movq_wRn_M0(wrd);
1728         gen_op_iwmmxt_set_mup();
1729         break;
1730     case 0x010: case 0x110: case 0x210: case 0x310:     /* WMUL */
1731         wrd = (insn >> 12) & 0xf;
1732         rd0 = (insn >> 16) & 0xf;
1733         rd1 = (insn >> 0) & 0xf;
1734         gen_op_iwmmxt_movq_M0_wRn(rd0);
1735         if (insn & (1 << 21)) {
1736             if (insn & (1 << 20))
1737                 gen_op_iwmmxt_mulshw_M0_wRn(rd1);
1738             else
1739                 gen_op_iwmmxt_mulslw_M0_wRn(rd1);
1740         } else {
1741             if (insn & (1 << 20))
1742                 gen_op_iwmmxt_muluhw_M0_wRn(rd1);
1743             else
1744                 gen_op_iwmmxt_mululw_M0_wRn(rd1);
1745         }
1746         gen_op_iwmmxt_movq_wRn_M0(wrd);
1747         gen_op_iwmmxt_set_mup();
1748         break;
1749     case 0x410: case 0x510: case 0x610: case 0x710:     /* WMAC */
1750         wrd = (insn >> 12) & 0xf;
1751         rd0 = (insn >> 16) & 0xf;
1752         rd1 = (insn >> 0) & 0xf;
1753         gen_op_iwmmxt_movq_M0_wRn(rd0);
1754         if (insn & (1 << 21))
1755             gen_op_iwmmxt_macsw_M0_wRn(rd1);
1756         else
1757             gen_op_iwmmxt_macuw_M0_wRn(rd1);
1758         if (!(insn & (1 << 20))) {
1759             iwmmxt_load_reg(cpu_V1, wrd);
1760             tcg_gen_add_i64(cpu_M0, cpu_M0, cpu_V1);
1761         }
1762         gen_op_iwmmxt_movq_wRn_M0(wrd);
1763         gen_op_iwmmxt_set_mup();
1764         break;
1765     case 0x006: case 0x406: case 0x806: case 0xc06:     /* WCMPEQ */
1766         wrd = (insn >> 12) & 0xf;
1767         rd0 = (insn >> 16) & 0xf;
1768         rd1 = (insn >> 0) & 0xf;
1769         gen_op_iwmmxt_movq_M0_wRn(rd0);
1770         switch ((insn >> 22) & 3) {
1771         case 0:
1772             gen_op_iwmmxt_cmpeqb_M0_wRn(rd1);
1773             break;
1774         case 1:
1775             gen_op_iwmmxt_cmpeqw_M0_wRn(rd1);
1776             break;
1777         case 2:
1778             gen_op_iwmmxt_cmpeql_M0_wRn(rd1);
1779             break;
1780         case 3:
1781             return 1;
1782         }
1783         gen_op_iwmmxt_movq_wRn_M0(wrd);
1784         gen_op_iwmmxt_set_mup();
1785         gen_op_iwmmxt_set_cup();
1786         break;
1787     case 0x800: case 0x900: case 0xc00: case 0xd00:     /* WAVG2 */
1788         wrd = (insn >> 12) & 0xf;
1789         rd0 = (insn >> 16) & 0xf;
1790         rd1 = (insn >> 0) & 0xf;
1791         gen_op_iwmmxt_movq_M0_wRn(rd0);
1792         if (insn & (1 << 22)) {
1793             if (insn & (1 << 20))
1794                 gen_op_iwmmxt_avgw1_M0_wRn(rd1);
1795             else
1796                 gen_op_iwmmxt_avgw0_M0_wRn(rd1);
1797         } else {
1798             if (insn & (1 << 20))
1799                 gen_op_iwmmxt_avgb1_M0_wRn(rd1);
1800             else
1801                 gen_op_iwmmxt_avgb0_M0_wRn(rd1);
1802         }
1803         gen_op_iwmmxt_movq_wRn_M0(wrd);
1804         gen_op_iwmmxt_set_mup();
1805         gen_op_iwmmxt_set_cup();
1806         break;
1807     case 0x802: case 0x902: case 0xa02: case 0xb02:     /* WALIGNR */
1808         wrd = (insn >> 12) & 0xf;
1809         rd0 = (insn >> 16) & 0xf;
1810         rd1 = (insn >> 0) & 0xf;
1811         gen_op_iwmmxt_movq_M0_wRn(rd0);
1812         tmp = iwmmxt_load_creg(ARM_IWMMXT_wCGR0 + ((insn >> 20) & 3));
1813         tcg_gen_andi_i32(tmp, tmp, 7);
1814         iwmmxt_load_reg(cpu_V1, rd1);
1815         gen_helper_iwmmxt_align(cpu_M0, cpu_M0, cpu_V1, tmp);
1816         tcg_temp_free_i32(tmp);
1817         gen_op_iwmmxt_movq_wRn_M0(wrd);
1818         gen_op_iwmmxt_set_mup();
1819         break;
1820     case 0x601: case 0x605: case 0x609: case 0x60d:     /* TINSR */
1821         if (((insn >> 6) & 3) == 3)
1822             return 1;
1823         rd = (insn >> 12) & 0xf;
1824         wrd = (insn >> 16) & 0xf;
1825         tmp = load_reg(s, rd);
1826         gen_op_iwmmxt_movq_M0_wRn(wrd);
1827         switch ((insn >> 6) & 3) {
1828         case 0:
1829             tmp2 = tcg_const_i32(0xff);
1830             tmp3 = tcg_const_i32((insn & 7) << 3);
1831             break;
1832         case 1:
1833             tmp2 = tcg_const_i32(0xffff);
1834             tmp3 = tcg_const_i32((insn & 3) << 4);
1835             break;
1836         case 2:
1837             tmp2 = tcg_const_i32(0xffffffff);
1838             tmp3 = tcg_const_i32((insn & 1) << 5);
1839             break;
1840         default:
1841             TCGV_UNUSED_I32(tmp2);
1842             TCGV_UNUSED_I32(tmp3);
1843         }
1844         gen_helper_iwmmxt_insr(cpu_M0, cpu_M0, tmp, tmp2, tmp3);
1845         tcg_temp_free_i32(tmp3);
1846         tcg_temp_free_i32(tmp2);
1847         tcg_temp_free_i32(tmp);
1848         gen_op_iwmmxt_movq_wRn_M0(wrd);
1849         gen_op_iwmmxt_set_mup();
1850         break;
1851     case 0x107: case 0x507: case 0x907: case 0xd07:     /* TEXTRM */
1852         rd = (insn >> 12) & 0xf;
1853         wrd = (insn >> 16) & 0xf;
1854         if (rd == 15 || ((insn >> 22) & 3) == 3)
1855             return 1;
1856         gen_op_iwmmxt_movq_M0_wRn(wrd);
1857         tmp = tcg_temp_new_i32();
1858         switch ((insn >> 22) & 3) {
1859         case 0:
1860             tcg_gen_shri_i64(cpu_M0, cpu_M0, (insn & 7) << 3);
1861             tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1862             if (insn & 8) {
1863                 tcg_gen_ext8s_i32(tmp, tmp);
1864             } else {
1865                 tcg_gen_andi_i32(tmp, tmp, 0xff);
1866             }
1867             break;
1868         case 1:
1869             tcg_gen_shri_i64(cpu_M0, cpu_M0, (insn & 3) << 4);
1870             tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1871             if (insn & 8) {
1872                 tcg_gen_ext16s_i32(tmp, tmp);
1873             } else {
1874                 tcg_gen_andi_i32(tmp, tmp, 0xffff);
1875             }
1876             break;
1877         case 2:
1878             tcg_gen_shri_i64(cpu_M0, cpu_M0, (insn & 1) << 5);
1879             tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1880             break;
1881         }
1882         store_reg(s, rd, tmp);
1883         break;
1884     case 0x117: case 0x517: case 0x917: case 0xd17:     /* TEXTRC */
1885         if ((insn & 0x000ff008) != 0x0003f000 || ((insn >> 22) & 3) == 3)
1886             return 1;
1887         tmp = iwmmxt_load_creg(ARM_IWMMXT_wCASF);
1888         switch ((insn >> 22) & 3) {
1889         case 0:
1890             tcg_gen_shri_i32(tmp, tmp, ((insn & 7) << 2) + 0);
1891             break;
1892         case 1:
1893             tcg_gen_shri_i32(tmp, tmp, ((insn & 3) << 3) + 4);
1894             break;
1895         case 2:
1896             tcg_gen_shri_i32(tmp, tmp, ((insn & 1) << 4) + 12);
1897             break;
1898         }
1899         tcg_gen_shli_i32(tmp, tmp, 28);
1900         gen_set_nzcv(tmp);
1901         tcg_temp_free_i32(tmp);
1902         break;
1903     case 0x401: case 0x405: case 0x409: case 0x40d:     /* TBCST */
1904         if (((insn >> 6) & 3) == 3)
1905             return 1;
1906         rd = (insn >> 12) & 0xf;
1907         wrd = (insn >> 16) & 0xf;
1908         tmp = load_reg(s, rd);
1909         switch ((insn >> 6) & 3) {
1910         case 0:
1911             gen_helper_iwmmxt_bcstb(cpu_M0, tmp);
1912             break;
1913         case 1:
1914             gen_helper_iwmmxt_bcstw(cpu_M0, tmp);
1915             break;
1916         case 2:
1917             gen_helper_iwmmxt_bcstl(cpu_M0, tmp);
1918             break;
1919         }
1920         tcg_temp_free_i32(tmp);
1921         gen_op_iwmmxt_movq_wRn_M0(wrd);
1922         gen_op_iwmmxt_set_mup();
1923         break;
1924     case 0x113: case 0x513: case 0x913: case 0xd13:     /* TANDC */
1925         if ((insn & 0x000ff00f) != 0x0003f000 || ((insn >> 22) & 3) == 3)
1926             return 1;
1927         tmp = iwmmxt_load_creg(ARM_IWMMXT_wCASF);
1928         tmp2 = tcg_temp_new_i32();
1929         tcg_gen_mov_i32(tmp2, tmp);
1930         switch ((insn >> 22) & 3) {
1931         case 0:
1932             for (i = 0; i < 7; i ++) {
1933                 tcg_gen_shli_i32(tmp2, tmp2, 4);
1934                 tcg_gen_and_i32(tmp, tmp, tmp2);
1935             }
1936             break;
1937         case 1:
1938             for (i = 0; i < 3; i ++) {
1939                 tcg_gen_shli_i32(tmp2, tmp2, 8);
1940                 tcg_gen_and_i32(tmp, tmp, tmp2);
1941             }
1942             break;
1943         case 2:
1944             tcg_gen_shli_i32(tmp2, tmp2, 16);
1945             tcg_gen_and_i32(tmp, tmp, tmp2);
1946             break;
1947         }
1948         gen_set_nzcv(tmp);
1949         tcg_temp_free_i32(tmp2);
1950         tcg_temp_free_i32(tmp);
1951         break;
1952     case 0x01c: case 0x41c: case 0x81c: case 0xc1c:     /* WACC */
1953         wrd = (insn >> 12) & 0xf;
1954         rd0 = (insn >> 16) & 0xf;
1955         gen_op_iwmmxt_movq_M0_wRn(rd0);
1956         switch ((insn >> 22) & 3) {
1957         case 0:
1958             gen_helper_iwmmxt_addcb(cpu_M0, cpu_M0);
1959             break;
1960         case 1:
1961             gen_helper_iwmmxt_addcw(cpu_M0, cpu_M0);
1962             break;
1963         case 2:
1964             gen_helper_iwmmxt_addcl(cpu_M0, cpu_M0);
1965             break;
1966         case 3:
1967             return 1;
1968         }
1969         gen_op_iwmmxt_movq_wRn_M0(wrd);
1970         gen_op_iwmmxt_set_mup();
1971         break;
1972     case 0x115: case 0x515: case 0x915: case 0xd15:     /* TORC */
1973         if ((insn & 0x000ff00f) != 0x0003f000 || ((insn >> 22) & 3) == 3)
1974             return 1;
1975         tmp = iwmmxt_load_creg(ARM_IWMMXT_wCASF);
1976         tmp2 = tcg_temp_new_i32();
1977         tcg_gen_mov_i32(tmp2, tmp);
1978         switch ((insn >> 22) & 3) {
1979         case 0:
1980             for (i = 0; i < 7; i ++) {
1981                 tcg_gen_shli_i32(tmp2, tmp2, 4);
1982                 tcg_gen_or_i32(tmp, tmp, tmp2);
1983             }
1984             break;
1985         case 1:
1986             for (i = 0; i < 3; i ++) {
1987                 tcg_gen_shli_i32(tmp2, tmp2, 8);
1988                 tcg_gen_or_i32(tmp, tmp, tmp2);
1989             }
1990             break;
1991         case 2:
1992             tcg_gen_shli_i32(tmp2, tmp2, 16);
1993             tcg_gen_or_i32(tmp, tmp, tmp2);
1994             break;
1995         }
1996         gen_set_nzcv(tmp);
1997         tcg_temp_free_i32(tmp2);
1998         tcg_temp_free_i32(tmp);
1999         break;
2000     case 0x103: case 0x503: case 0x903: case 0xd03:     /* TMOVMSK */
2001         rd = (insn >> 12) & 0xf;
2002         rd0 = (insn >> 16) & 0xf;
2003         if ((insn & 0xf) != 0 || ((insn >> 22) & 3) == 3)
2004             return 1;
2005         gen_op_iwmmxt_movq_M0_wRn(rd0);
2006         tmp = tcg_temp_new_i32();
2007         switch ((insn >> 22) & 3) {
2008         case 0:
2009             gen_helper_iwmmxt_msbb(tmp, cpu_M0);
2010             break;
2011         case 1:
2012             gen_helper_iwmmxt_msbw(tmp, cpu_M0);
2013             break;
2014         case 2:
2015             gen_helper_iwmmxt_msbl(tmp, cpu_M0);
2016             break;
2017         }
2018         store_reg(s, rd, tmp);
2019         break;
2020     case 0x106: case 0x306: case 0x506: case 0x706:     /* WCMPGT */
2021     case 0x906: case 0xb06: case 0xd06: case 0xf06:
2022         wrd = (insn >> 12) & 0xf;
2023         rd0 = (insn >> 16) & 0xf;
2024         rd1 = (insn >> 0) & 0xf;
2025         gen_op_iwmmxt_movq_M0_wRn(rd0);
2026         switch ((insn >> 22) & 3) {
2027         case 0:
2028             if (insn & (1 << 21))
2029                 gen_op_iwmmxt_cmpgtsb_M0_wRn(rd1);
2030             else
2031                 gen_op_iwmmxt_cmpgtub_M0_wRn(rd1);
2032             break;
2033         case 1:
2034             if (insn & (1 << 21))
2035                 gen_op_iwmmxt_cmpgtsw_M0_wRn(rd1);
2036             else
2037                 gen_op_iwmmxt_cmpgtuw_M0_wRn(rd1);
2038             break;
2039         case 2:
2040             if (insn & (1 << 21))
2041                 gen_op_iwmmxt_cmpgtsl_M0_wRn(rd1);
2042             else
2043                 gen_op_iwmmxt_cmpgtul_M0_wRn(rd1);
2044             break;
2045         case 3:
2046             return 1;
2047         }
2048         gen_op_iwmmxt_movq_wRn_M0(wrd);
2049         gen_op_iwmmxt_set_mup();
2050         gen_op_iwmmxt_set_cup();
2051         break;
2052     case 0x00e: case 0x20e: case 0x40e: case 0x60e:     /* WUNPCKEL */
2053     case 0x80e: case 0xa0e: case 0xc0e: case 0xe0e:
2054         wrd = (insn >> 12) & 0xf;
2055         rd0 = (insn >> 16) & 0xf;
2056         gen_op_iwmmxt_movq_M0_wRn(rd0);
2057         switch ((insn >> 22) & 3) {
2058         case 0:
2059             if (insn & (1 << 21))
2060                 gen_op_iwmmxt_unpacklsb_M0();
2061             else
2062                 gen_op_iwmmxt_unpacklub_M0();
2063             break;
2064         case 1:
2065             if (insn & (1 << 21))
2066                 gen_op_iwmmxt_unpacklsw_M0();
2067             else
2068                 gen_op_iwmmxt_unpackluw_M0();
2069             break;
2070         case 2:
2071             if (insn & (1 << 21))
2072                 gen_op_iwmmxt_unpacklsl_M0();
2073             else
2074                 gen_op_iwmmxt_unpacklul_M0();
2075             break;
2076         case 3:
2077             return 1;
2078         }
2079         gen_op_iwmmxt_movq_wRn_M0(wrd);
2080         gen_op_iwmmxt_set_mup();
2081         gen_op_iwmmxt_set_cup();
2082         break;
2083     case 0x00c: case 0x20c: case 0x40c: case 0x60c:     /* WUNPCKEH */
2084     case 0x80c: case 0xa0c: case 0xc0c: case 0xe0c:
2085         wrd = (insn >> 12) & 0xf;
2086         rd0 = (insn >> 16) & 0xf;
2087         gen_op_iwmmxt_movq_M0_wRn(rd0);
2088         switch ((insn >> 22) & 3) {
2089         case 0:
2090             if (insn & (1 << 21))
2091                 gen_op_iwmmxt_unpackhsb_M0();
2092             else
2093                 gen_op_iwmmxt_unpackhub_M0();
2094             break;
2095         case 1:
2096             if (insn & (1 << 21))
2097                 gen_op_iwmmxt_unpackhsw_M0();
2098             else
2099                 gen_op_iwmmxt_unpackhuw_M0();
2100             break;
2101         case 2:
2102             if (insn & (1 << 21))
2103                 gen_op_iwmmxt_unpackhsl_M0();
2104             else
2105                 gen_op_iwmmxt_unpackhul_M0();
2106             break;
2107         case 3:
2108             return 1;
2109         }
2110         gen_op_iwmmxt_movq_wRn_M0(wrd);
2111         gen_op_iwmmxt_set_mup();
2112         gen_op_iwmmxt_set_cup();
2113         break;
2114     case 0x204: case 0x604: case 0xa04: case 0xe04:     /* WSRL */
2115     case 0x214: case 0x614: case 0xa14: case 0xe14:
2116         if (((insn >> 22) & 3) == 0)
2117             return 1;
2118         wrd = (insn >> 12) & 0xf;
2119         rd0 = (insn >> 16) & 0xf;
2120         gen_op_iwmmxt_movq_M0_wRn(rd0);
2121         tmp = tcg_temp_new_i32();
2122         if (gen_iwmmxt_shift(insn, 0xff, tmp)) {
2123             tcg_temp_free_i32(tmp);
2124             return 1;
2125         }
2126         switch ((insn >> 22) & 3) {
2127         case 1:
2128             gen_helper_iwmmxt_srlw(cpu_M0, cpu_env, cpu_M0, tmp);
2129             break;
2130         case 2:
2131             gen_helper_iwmmxt_srll(cpu_M0, cpu_env, cpu_M0, tmp);
2132             break;
2133         case 3:
2134             gen_helper_iwmmxt_srlq(cpu_M0, cpu_env, cpu_M0, tmp);
2135             break;
2136         }
2137         tcg_temp_free_i32(tmp);
2138         gen_op_iwmmxt_movq_wRn_M0(wrd);
2139         gen_op_iwmmxt_set_mup();
2140         gen_op_iwmmxt_set_cup();
2141         break;
2142     case 0x004: case 0x404: case 0x804: case 0xc04:     /* WSRA */
2143     case 0x014: case 0x414: case 0x814: case 0xc14:
2144         if (((insn >> 22) & 3) == 0)
2145             return 1;
2146         wrd = (insn >> 12) & 0xf;
2147         rd0 = (insn >> 16) & 0xf;
2148         gen_op_iwmmxt_movq_M0_wRn(rd0);
2149         tmp = tcg_temp_new_i32();
2150         if (gen_iwmmxt_shift(insn, 0xff, tmp)) {
2151             tcg_temp_free_i32(tmp);
2152             return 1;
2153         }
2154         switch ((insn >> 22) & 3) {
2155         case 1:
2156             gen_helper_iwmmxt_sraw(cpu_M0, cpu_env, cpu_M0, tmp);
2157             break;
2158         case 2:
2159             gen_helper_iwmmxt_sral(cpu_M0, cpu_env, cpu_M0, tmp);
2160             break;
2161         case 3:
2162             gen_helper_iwmmxt_sraq(cpu_M0, cpu_env, cpu_M0, tmp);
2163             break;
2164         }
2165         tcg_temp_free_i32(tmp);
2166         gen_op_iwmmxt_movq_wRn_M0(wrd);
2167         gen_op_iwmmxt_set_mup();
2168         gen_op_iwmmxt_set_cup();
2169         break;
2170     case 0x104: case 0x504: case 0x904: case 0xd04:     /* WSLL */
2171     case 0x114: case 0x514: case 0x914: case 0xd14:
2172         if (((insn >> 22) & 3) == 0)
2173             return 1;
2174         wrd = (insn >> 12) & 0xf;
2175         rd0 = (insn >> 16) & 0xf;
2176         gen_op_iwmmxt_movq_M0_wRn(rd0);
2177         tmp = tcg_temp_new_i32();
2178         if (gen_iwmmxt_shift(insn, 0xff, tmp)) {
2179             tcg_temp_free_i32(tmp);
2180             return 1;
2181         }
2182         switch ((insn >> 22) & 3) {
2183         case 1:
2184             gen_helper_iwmmxt_sllw(cpu_M0, cpu_env, cpu_M0, tmp);
2185             break;
2186         case 2:
2187             gen_helper_iwmmxt_slll(cpu_M0, cpu_env, cpu_M0, tmp);
2188             break;
2189         case 3:
2190             gen_helper_iwmmxt_sllq(cpu_M0, cpu_env, cpu_M0, tmp);
2191             break;
2192         }
2193         tcg_temp_free_i32(tmp);
2194         gen_op_iwmmxt_movq_wRn_M0(wrd);
2195         gen_op_iwmmxt_set_mup();
2196         gen_op_iwmmxt_set_cup();
2197         break;
2198     case 0x304: case 0x704: case 0xb04: case 0xf04:     /* WROR */
2199     case 0x314: case 0x714: case 0xb14: case 0xf14:
2200         if (((insn >> 22) & 3) == 0)
2201             return 1;
2202         wrd = (insn >> 12) & 0xf;
2203         rd0 = (insn >> 16) & 0xf;
2204         gen_op_iwmmxt_movq_M0_wRn(rd0);
2205         tmp = tcg_temp_new_i32();
2206         switch ((insn >> 22) & 3) {
2207         case 1:
2208             if (gen_iwmmxt_shift(insn, 0xf, tmp)) {
2209                 tcg_temp_free_i32(tmp);
2210                 return 1;
2211             }
2212             gen_helper_iwmmxt_rorw(cpu_M0, cpu_env, cpu_M0, tmp);
2213             break;
2214         case 2:
2215             if (gen_iwmmxt_shift(insn, 0x1f, tmp)) {
2216                 tcg_temp_free_i32(tmp);
2217                 return 1;
2218             }
2219             gen_helper_iwmmxt_rorl(cpu_M0, cpu_env, cpu_M0, tmp);
2220             break;
2221         case 3:
2222             if (gen_iwmmxt_shift(insn, 0x3f, tmp)) {
2223                 tcg_temp_free_i32(tmp);
2224                 return 1;
2225             }
2226             gen_helper_iwmmxt_rorq(cpu_M0, cpu_env, cpu_M0, tmp);
2227             break;
2228         }
2229         tcg_temp_free_i32(tmp);
2230         gen_op_iwmmxt_movq_wRn_M0(wrd);
2231         gen_op_iwmmxt_set_mup();
2232         gen_op_iwmmxt_set_cup();
2233         break;
2234     case 0x116: case 0x316: case 0x516: case 0x716:     /* WMIN */
2235     case 0x916: case 0xb16: case 0xd16: case 0xf16:
2236         wrd = (insn >> 12) & 0xf;
2237         rd0 = (insn >> 16) & 0xf;
2238         rd1 = (insn >> 0) & 0xf;
2239         gen_op_iwmmxt_movq_M0_wRn(rd0);
2240         switch ((insn >> 22) & 3) {
2241         case 0:
2242             if (insn & (1 << 21))
2243                 gen_op_iwmmxt_minsb_M0_wRn(rd1);
2244             else
2245                 gen_op_iwmmxt_minub_M0_wRn(rd1);
2246             break;
2247         case 1:
2248             if (insn & (1 << 21))
2249                 gen_op_iwmmxt_minsw_M0_wRn(rd1);
2250             else
2251                 gen_op_iwmmxt_minuw_M0_wRn(rd1);
2252             break;
2253         case 2:
2254             if (insn & (1 << 21))
2255                 gen_op_iwmmxt_minsl_M0_wRn(rd1);
2256             else
2257                 gen_op_iwmmxt_minul_M0_wRn(rd1);
2258             break;
2259         case 3:
2260             return 1;
2261         }
2262         gen_op_iwmmxt_movq_wRn_M0(wrd);
2263         gen_op_iwmmxt_set_mup();
2264         break;
2265     case 0x016: case 0x216: case 0x416: case 0x616:     /* WMAX */
2266     case 0x816: case 0xa16: case 0xc16: case 0xe16:
2267         wrd = (insn >> 12) & 0xf;
2268         rd0 = (insn >> 16) & 0xf;
2269         rd1 = (insn >> 0) & 0xf;
2270         gen_op_iwmmxt_movq_M0_wRn(rd0);
2271         switch ((insn >> 22) & 3) {
2272         case 0:
2273             if (insn & (1 << 21))
2274                 gen_op_iwmmxt_maxsb_M0_wRn(rd1);
2275             else
2276                 gen_op_iwmmxt_maxub_M0_wRn(rd1);
2277             break;
2278         case 1:
2279             if (insn & (1 << 21))
2280                 gen_op_iwmmxt_maxsw_M0_wRn(rd1);
2281             else
2282                 gen_op_iwmmxt_maxuw_M0_wRn(rd1);
2283             break;
2284         case 2:
2285             if (insn & (1 << 21))
2286                 gen_op_iwmmxt_maxsl_M0_wRn(rd1);
2287             else
2288                 gen_op_iwmmxt_maxul_M0_wRn(rd1);
2289             break;
2290         case 3:
2291             return 1;
2292         }
2293         gen_op_iwmmxt_movq_wRn_M0(wrd);
2294         gen_op_iwmmxt_set_mup();
2295         break;
2296     case 0x002: case 0x102: case 0x202: case 0x302:     /* WALIGNI */
2297     case 0x402: case 0x502: case 0x602: case 0x702:
2298         wrd = (insn >> 12) & 0xf;
2299         rd0 = (insn >> 16) & 0xf;
2300         rd1 = (insn >> 0) & 0xf;
2301         gen_op_iwmmxt_movq_M0_wRn(rd0);
2302         tmp = tcg_const_i32((insn >> 20) & 3);
2303         iwmmxt_load_reg(cpu_V1, rd1);
2304         gen_helper_iwmmxt_align(cpu_M0, cpu_M0, cpu_V1, tmp);
2305         tcg_temp_free_i32(tmp);
2306         gen_op_iwmmxt_movq_wRn_M0(wrd);
2307         gen_op_iwmmxt_set_mup();
2308         break;
2309     case 0x01a: case 0x11a: case 0x21a: case 0x31a:     /* WSUB */
2310     case 0x41a: case 0x51a: case 0x61a: case 0x71a:
2311     case 0x81a: case 0x91a: case 0xa1a: case 0xb1a:
2312     case 0xc1a: case 0xd1a: case 0xe1a: case 0xf1a:
2313         wrd = (insn >> 12) & 0xf;
2314         rd0 = (insn >> 16) & 0xf;
2315         rd1 = (insn >> 0) & 0xf;
2316         gen_op_iwmmxt_movq_M0_wRn(rd0);
2317         switch ((insn >> 20) & 0xf) {
2318         case 0x0:
2319             gen_op_iwmmxt_subnb_M0_wRn(rd1);
2320             break;
2321         case 0x1:
2322             gen_op_iwmmxt_subub_M0_wRn(rd1);
2323             break;
2324         case 0x3:
2325             gen_op_iwmmxt_subsb_M0_wRn(rd1);
2326             break;
2327         case 0x4:
2328             gen_op_iwmmxt_subnw_M0_wRn(rd1);
2329             break;
2330         case 0x5:
2331             gen_op_iwmmxt_subuw_M0_wRn(rd1);
2332             break;
2333         case 0x7:
2334             gen_op_iwmmxt_subsw_M0_wRn(rd1);
2335             break;
2336         case 0x8:
2337             gen_op_iwmmxt_subnl_M0_wRn(rd1);
2338             break;
2339         case 0x9:
2340             gen_op_iwmmxt_subul_M0_wRn(rd1);
2341             break;
2342         case 0xb:
2343             gen_op_iwmmxt_subsl_M0_wRn(rd1);
2344             break;
2345         default:
2346             return 1;
2347         }
2348         gen_op_iwmmxt_movq_wRn_M0(wrd);
2349         gen_op_iwmmxt_set_mup();
2350         gen_op_iwmmxt_set_cup();
2351         break;
2352     case 0x01e: case 0x11e: case 0x21e: case 0x31e:     /* WSHUFH */
2353     case 0x41e: case 0x51e: case 0x61e: case 0x71e:
2354     case 0x81e: case 0x91e: case 0xa1e: case 0xb1e:
2355     case 0xc1e: case 0xd1e: case 0xe1e: case 0xf1e:
2356         wrd = (insn >> 12) & 0xf;
2357         rd0 = (insn >> 16) & 0xf;
2358         gen_op_iwmmxt_movq_M0_wRn(rd0);
2359         tmp = tcg_const_i32(((insn >> 16) & 0xf0) | (insn & 0x0f));
2360         gen_helper_iwmmxt_shufh(cpu_M0, cpu_env, cpu_M0, tmp);
2361         tcg_temp_free_i32(tmp);
2362         gen_op_iwmmxt_movq_wRn_M0(wrd);
2363         gen_op_iwmmxt_set_mup();
2364         gen_op_iwmmxt_set_cup();
2365         break;
2366     case 0x018: case 0x118: case 0x218: case 0x318:     /* WADD */
2367     case 0x418: case 0x518: case 0x618: case 0x718:
2368     case 0x818: case 0x918: case 0xa18: case 0xb18:
2369     case 0xc18: case 0xd18: case 0xe18: case 0xf18:
2370         wrd = (insn >> 12) & 0xf;
2371         rd0 = (insn >> 16) & 0xf;
2372         rd1 = (insn >> 0) & 0xf;
2373         gen_op_iwmmxt_movq_M0_wRn(rd0);
2374         switch ((insn >> 20) & 0xf) {
2375         case 0x0:
2376             gen_op_iwmmxt_addnb_M0_wRn(rd1);
2377             break;
2378         case 0x1:
2379             gen_op_iwmmxt_addub_M0_wRn(rd1);
2380             break;
2381         case 0x3:
2382             gen_op_iwmmxt_addsb_M0_wRn(rd1);
2383             break;
2384         case 0x4:
2385             gen_op_iwmmxt_addnw_M0_wRn(rd1);
2386             break;
2387         case 0x5:
2388             gen_op_iwmmxt_adduw_M0_wRn(rd1);
2389             break;
2390         case 0x7:
2391             gen_op_iwmmxt_addsw_M0_wRn(rd1);
2392             break;
2393         case 0x8:
2394             gen_op_iwmmxt_addnl_M0_wRn(rd1);
2395             break;
2396         case 0x9:
2397             gen_op_iwmmxt_addul_M0_wRn(rd1);
2398             break;
2399         case 0xb:
2400             gen_op_iwmmxt_addsl_M0_wRn(rd1);
2401             break;
2402         default:
2403             return 1;
2404         }
2405         gen_op_iwmmxt_movq_wRn_M0(wrd);
2406         gen_op_iwmmxt_set_mup();
2407         gen_op_iwmmxt_set_cup();
2408         break;
2409     case 0x008: case 0x108: case 0x208: case 0x308:     /* WPACK */
2410     case 0x408: case 0x508: case 0x608: case 0x708:
2411     case 0x808: case 0x908: case 0xa08: case 0xb08:
2412     case 0xc08: case 0xd08: case 0xe08: case 0xf08:
2413         if (!(insn & (1 << 20)) || ((insn >> 22) & 3) == 0)
2414             return 1;
2415         wrd = (insn >> 12) & 0xf;
2416         rd0 = (insn >> 16) & 0xf;
2417         rd1 = (insn >> 0) & 0xf;
2418         gen_op_iwmmxt_movq_M0_wRn(rd0);
2419         switch ((insn >> 22) & 3) {
2420         case 1:
2421             if (insn & (1 << 21))
2422                 gen_op_iwmmxt_packsw_M0_wRn(rd1);
2423             else
2424                 gen_op_iwmmxt_packuw_M0_wRn(rd1);
2425             break;
2426         case 2:
2427             if (insn & (1 << 21))
2428                 gen_op_iwmmxt_packsl_M0_wRn(rd1);
2429             else
2430                 gen_op_iwmmxt_packul_M0_wRn(rd1);
2431             break;
2432         case 3:
2433             if (insn & (1 << 21))
2434                 gen_op_iwmmxt_packsq_M0_wRn(rd1);
2435             else
2436                 gen_op_iwmmxt_packuq_M0_wRn(rd1);
2437             break;
2438         }
2439         gen_op_iwmmxt_movq_wRn_M0(wrd);
2440         gen_op_iwmmxt_set_mup();
2441         gen_op_iwmmxt_set_cup();
2442         break;
2443     case 0x201: case 0x203: case 0x205: case 0x207:
2444     case 0x209: case 0x20b: case 0x20d: case 0x20f:
2445     case 0x211: case 0x213: case 0x215: case 0x217:
2446     case 0x219: case 0x21b: case 0x21d: case 0x21f:
2447         wrd = (insn >> 5) & 0xf;
2448         rd0 = (insn >> 12) & 0xf;
2449         rd1 = (insn >> 0) & 0xf;
2450         if (rd0 == 0xf || rd1 == 0xf)
2451             return 1;
2452         gen_op_iwmmxt_movq_M0_wRn(wrd);
2453         tmp = load_reg(s, rd0);
2454         tmp2 = load_reg(s, rd1);
2455         switch ((insn >> 16) & 0xf) {
2456         case 0x0:                                       /* TMIA */
2457             gen_helper_iwmmxt_muladdsl(cpu_M0, cpu_M0, tmp, tmp2);
2458             break;
2459         case 0x8:                                       /* TMIAPH */
2460             gen_helper_iwmmxt_muladdsw(cpu_M0, cpu_M0, tmp, tmp2);
2461             break;
2462         case 0xc: case 0xd: case 0xe: case 0xf:         /* TMIAxy */
2463             if (insn & (1 << 16))
2464                 tcg_gen_shri_i32(tmp, tmp, 16);
2465             if (insn & (1 << 17))
2466                 tcg_gen_shri_i32(tmp2, tmp2, 16);
2467             gen_helper_iwmmxt_muladdswl(cpu_M0, cpu_M0, tmp, tmp2);
2468             break;
2469         default:
2470             tcg_temp_free_i32(tmp2);
2471             tcg_temp_free_i32(tmp);
2472             return 1;
2473         }
2474         tcg_temp_free_i32(tmp2);
2475         tcg_temp_free_i32(tmp);
2476         gen_op_iwmmxt_movq_wRn_M0(wrd);
2477         gen_op_iwmmxt_set_mup();
2478         break;
2479     default:
2480         return 1;
2481     }
2482
2483     return 0;
2484 }
2485
2486 /* Disassemble an XScale DSP instruction.  Returns nonzero if an error occurred
2487    (ie. an undefined instruction).  */
2488 static int disas_dsp_insn(CPUARMState *env, DisasContext *s, uint32_t insn)
2489 {
2490     int acc, rd0, rd1, rdhi, rdlo;
2491     TCGv_i32 tmp, tmp2;
2492
2493     if ((insn & 0x0ff00f10) == 0x0e200010) {
2494         /* Multiply with Internal Accumulate Format */
2495         rd0 = (insn >> 12) & 0xf;
2496         rd1 = insn & 0xf;
2497         acc = (insn >> 5) & 7;
2498
2499         if (acc != 0)
2500             return 1;
2501
2502         tmp = load_reg(s, rd0);
2503         tmp2 = load_reg(s, rd1);
2504         switch ((insn >> 16) & 0xf) {
2505         case 0x0:                                       /* MIA */
2506             gen_helper_iwmmxt_muladdsl(cpu_M0, cpu_M0, tmp, tmp2);
2507             break;
2508         case 0x8:                                       /* MIAPH */
2509             gen_helper_iwmmxt_muladdsw(cpu_M0, cpu_M0, tmp, tmp2);
2510             break;
2511         case 0xc:                                       /* MIABB */
2512         case 0xd:                                       /* MIABT */
2513         case 0xe:                                       /* MIATB */
2514         case 0xf:                                       /* MIATT */
2515             if (insn & (1 << 16))
2516                 tcg_gen_shri_i32(tmp, tmp, 16);
2517             if (insn & (1 << 17))
2518                 tcg_gen_shri_i32(tmp2, tmp2, 16);
2519             gen_helper_iwmmxt_muladdswl(cpu_M0, cpu_M0, tmp, tmp2);
2520             break;
2521         default:
2522             return 1;
2523         }
2524         tcg_temp_free_i32(tmp2);
2525         tcg_temp_free_i32(tmp);
2526
2527         gen_op_iwmmxt_movq_wRn_M0(acc);
2528         return 0;
2529     }
2530
2531     if ((insn & 0x0fe00ff8) == 0x0c400000) {
2532         /* Internal Accumulator Access Format */
2533         rdhi = (insn >> 16) & 0xf;
2534         rdlo = (insn >> 12) & 0xf;
2535         acc = insn & 7;
2536
2537         if (acc != 0)
2538             return 1;
2539
2540         if (insn & ARM_CP_RW_BIT) {                     /* MRA */
2541             iwmmxt_load_reg(cpu_V0, acc);
2542             tcg_gen_trunc_i64_i32(cpu_R[rdlo], cpu_V0);
2543             tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
2544             tcg_gen_trunc_i64_i32(cpu_R[rdhi], cpu_V0);
2545             tcg_gen_andi_i32(cpu_R[rdhi], cpu_R[rdhi], (1 << (40 - 32)) - 1);
2546         } else {                                        /* MAR */
2547             tcg_gen_concat_i32_i64(cpu_V0, cpu_R[rdlo], cpu_R[rdhi]);
2548             iwmmxt_store_reg(cpu_V0, acc);
2549         }
2550         return 0;
2551     }
2552
2553     return 1;
2554 }
2555
2556 #define VFP_REG_SHR(x, n) (((n) > 0) ? (x) >> (n) : (x) << -(n))
2557 #define VFP_SREG(insn, bigbit, smallbit) \
2558   ((VFP_REG_SHR(insn, bigbit - 1) & 0x1e) | (((insn) >> (smallbit)) & 1))
2559 #define VFP_DREG(reg, insn, bigbit, smallbit) do { \
2560     if (arm_feature(env, ARM_FEATURE_VFP3)) { \
2561         reg = (((insn) >> (bigbit)) & 0x0f) \
2562               | (((insn) >> ((smallbit) - 4)) & 0x10); \
2563     } else { \
2564         if (insn & (1 << (smallbit))) \
2565             return 1; \
2566         reg = ((insn) >> (bigbit)) & 0x0f; \
2567     }} while (0)
2568
2569 #define VFP_SREG_D(insn) VFP_SREG(insn, 12, 22)
2570 #define VFP_DREG_D(reg, insn) VFP_DREG(reg, insn, 12, 22)
2571 #define VFP_SREG_N(insn) VFP_SREG(insn, 16,  7)
2572 #define VFP_DREG_N(reg, insn) VFP_DREG(reg, insn, 16,  7)
2573 #define VFP_SREG_M(insn) VFP_SREG(insn,  0,  5)
2574 #define VFP_DREG_M(reg, insn) VFP_DREG(reg, insn,  0,  5)
2575
2576 /* Move between integer and VFP cores.  */
2577 static TCGv_i32 gen_vfp_mrs(void)
2578 {
2579     TCGv_i32 tmp = tcg_temp_new_i32();
2580     tcg_gen_mov_i32(tmp, cpu_F0s);
2581     return tmp;
2582 }
2583
2584 static void gen_vfp_msr(TCGv_i32 tmp)
2585 {
2586     tcg_gen_mov_i32(cpu_F0s, tmp);
2587     tcg_temp_free_i32(tmp);
2588 }
2589
2590 static void gen_neon_dup_u8(TCGv_i32 var, int shift)
2591 {
2592     TCGv_i32 tmp = tcg_temp_new_i32();
2593     if (shift)
2594         tcg_gen_shri_i32(var, var, shift);
2595     tcg_gen_ext8u_i32(var, var);
2596     tcg_gen_shli_i32(tmp, var, 8);
2597     tcg_gen_or_i32(var, var, tmp);
2598     tcg_gen_shli_i32(tmp, var, 16);
2599     tcg_gen_or_i32(var, var, tmp);
2600     tcg_temp_free_i32(tmp);
2601 }
2602
2603 static void gen_neon_dup_low16(TCGv_i32 var)
2604 {
2605     TCGv_i32 tmp = tcg_temp_new_i32();
2606     tcg_gen_ext16u_i32(var, var);
2607     tcg_gen_shli_i32(tmp, var, 16);
2608     tcg_gen_or_i32(var, var, tmp);
2609     tcg_temp_free_i32(tmp);
2610 }
2611
2612 static void gen_neon_dup_high16(TCGv_i32 var)
2613 {
2614     TCGv_i32 tmp = tcg_temp_new_i32();
2615     tcg_gen_andi_i32(var, var, 0xffff0000);
2616     tcg_gen_shri_i32(tmp, var, 16);
2617     tcg_gen_or_i32(var, var, tmp);
2618     tcg_temp_free_i32(tmp);
2619 }
2620
2621 static TCGv_i32 gen_load_and_replicate(DisasContext *s, TCGv_i32 addr, int size)
2622 {
2623     /* Load a single Neon element and replicate into a 32 bit TCG reg */
2624     TCGv_i32 tmp = tcg_temp_new_i32();
2625     switch (size) {
2626     case 0:
2627         gen_aa32_ld8u(tmp, addr, get_mem_index(s));
2628         gen_neon_dup_u8(tmp, 0);
2629         break;
2630     case 1:
2631         gen_aa32_ld16u(tmp, addr, get_mem_index(s));
2632         gen_neon_dup_low16(tmp);
2633         break;
2634     case 2:
2635         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
2636         break;
2637     default: /* Avoid compiler warnings.  */
2638         abort();
2639     }
2640     return tmp;
2641 }
2642
2643 static int handle_vsel(uint32_t insn, uint32_t rd, uint32_t rn, uint32_t rm,
2644                        uint32_t dp)
2645 {
2646     uint32_t cc = extract32(insn, 20, 2);
2647
2648     if (dp) {
2649         TCGv_i64 frn, frm, dest;
2650         TCGv_i64 tmp, zero, zf, nf, vf;
2651
2652         zero = tcg_const_i64(0);
2653
2654         frn = tcg_temp_new_i64();
2655         frm = tcg_temp_new_i64();
2656         dest = tcg_temp_new_i64();
2657
2658         zf = tcg_temp_new_i64();
2659         nf = tcg_temp_new_i64();
2660         vf = tcg_temp_new_i64();
2661
2662         tcg_gen_extu_i32_i64(zf, cpu_ZF);
2663         tcg_gen_ext_i32_i64(nf, cpu_NF);
2664         tcg_gen_ext_i32_i64(vf, cpu_VF);
2665
2666         tcg_gen_ld_f64(frn, cpu_env, vfp_reg_offset(dp, rn));
2667         tcg_gen_ld_f64(frm, cpu_env, vfp_reg_offset(dp, rm));
2668         switch (cc) {
2669         case 0: /* eq: Z */
2670             tcg_gen_movcond_i64(TCG_COND_EQ, dest, zf, zero,
2671                                 frn, frm);
2672             break;
2673         case 1: /* vs: V */
2674             tcg_gen_movcond_i64(TCG_COND_LT, dest, vf, zero,
2675                                 frn, frm);
2676             break;
2677         case 2: /* ge: N == V -> N ^ V == 0 */
2678             tmp = tcg_temp_new_i64();
2679             tcg_gen_xor_i64(tmp, vf, nf);
2680             tcg_gen_movcond_i64(TCG_COND_GE, dest, tmp, zero,
2681                                 frn, frm);
2682             tcg_temp_free_i64(tmp);
2683             break;
2684         case 3: /* gt: !Z && N == V */
2685             tcg_gen_movcond_i64(TCG_COND_NE, dest, zf, zero,
2686                                 frn, frm);
2687             tmp = tcg_temp_new_i64();
2688             tcg_gen_xor_i64(tmp, vf, nf);
2689             tcg_gen_movcond_i64(TCG_COND_GE, dest, tmp, zero,
2690                                 dest, frm);
2691             tcg_temp_free_i64(tmp);
2692             break;
2693         }
2694         tcg_gen_st_f64(dest, cpu_env, vfp_reg_offset(dp, rd));
2695         tcg_temp_free_i64(frn);
2696         tcg_temp_free_i64(frm);
2697         tcg_temp_free_i64(dest);
2698
2699         tcg_temp_free_i64(zf);
2700         tcg_temp_free_i64(nf);
2701         tcg_temp_free_i64(vf);
2702
2703         tcg_temp_free_i64(zero);
2704     } else {
2705         TCGv_i32 frn, frm, dest;
2706         TCGv_i32 tmp, zero;
2707
2708         zero = tcg_const_i32(0);
2709
2710         frn = tcg_temp_new_i32();
2711         frm = tcg_temp_new_i32();
2712         dest = tcg_temp_new_i32();
2713         tcg_gen_ld_f32(frn, cpu_env, vfp_reg_offset(dp, rn));
2714         tcg_gen_ld_f32(frm, cpu_env, vfp_reg_offset(dp, rm));
2715         switch (cc) {
2716         case 0: /* eq: Z */
2717             tcg_gen_movcond_i32(TCG_COND_EQ, dest, cpu_ZF, zero,
2718                                 frn, frm);
2719             break;
2720         case 1: /* vs: V */
2721             tcg_gen_movcond_i32(TCG_COND_LT, dest, cpu_VF, zero,
2722                                 frn, frm);
2723             break;
2724         case 2: /* ge: N == V -> N ^ V == 0 */
2725             tmp = tcg_temp_new_i32();
2726             tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
2727             tcg_gen_movcond_i32(TCG_COND_GE, dest, tmp, zero,
2728                                 frn, frm);
2729             tcg_temp_free_i32(tmp);
2730             break;
2731         case 3: /* gt: !Z && N == V */
2732             tcg_gen_movcond_i32(TCG_COND_NE, dest, cpu_ZF, zero,
2733                                 frn, frm);
2734             tmp = tcg_temp_new_i32();
2735             tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
2736             tcg_gen_movcond_i32(TCG_COND_GE, dest, tmp, zero,
2737                                 dest, frm);
2738             tcg_temp_free_i32(tmp);
2739             break;
2740         }
2741         tcg_gen_st_f32(dest, cpu_env, vfp_reg_offset(dp, rd));
2742         tcg_temp_free_i32(frn);
2743         tcg_temp_free_i32(frm);
2744         tcg_temp_free_i32(dest);
2745
2746         tcg_temp_free_i32(zero);
2747     }
2748
2749     return 0;
2750 }
2751
2752 static int handle_vminmaxnm(uint32_t insn, uint32_t rd, uint32_t rn,
2753                             uint32_t rm, uint32_t dp)
2754 {
2755     uint32_t vmin = extract32(insn, 6, 1);
2756     TCGv_ptr fpst = get_fpstatus_ptr(0);
2757
2758     if (dp) {
2759         TCGv_i64 frn, frm, dest;
2760
2761         frn = tcg_temp_new_i64();
2762         frm = tcg_temp_new_i64();
2763         dest = tcg_temp_new_i64();
2764
2765         tcg_gen_ld_f64(frn, cpu_env, vfp_reg_offset(dp, rn));
2766         tcg_gen_ld_f64(frm, cpu_env, vfp_reg_offset(dp, rm));
2767         if (vmin) {
2768             gen_helper_vfp_minnumd(dest, frn, frm, fpst);
2769         } else {
2770             gen_helper_vfp_maxnumd(dest, frn, frm, fpst);
2771         }
2772         tcg_gen_st_f64(dest, cpu_env, vfp_reg_offset(dp, rd));
2773         tcg_temp_free_i64(frn);
2774         tcg_temp_free_i64(frm);
2775         tcg_temp_free_i64(dest);
2776     } else {
2777         TCGv_i32 frn, frm, dest;
2778
2779         frn = tcg_temp_new_i32();
2780         frm = tcg_temp_new_i32();
2781         dest = tcg_temp_new_i32();
2782
2783         tcg_gen_ld_f32(frn, cpu_env, vfp_reg_offset(dp, rn));
2784         tcg_gen_ld_f32(frm, cpu_env, vfp_reg_offset(dp, rm));
2785         if (vmin) {
2786             gen_helper_vfp_minnums(dest, frn, frm, fpst);
2787         } else {
2788             gen_helper_vfp_maxnums(dest, frn, frm, fpst);
2789         }
2790         tcg_gen_st_f32(dest, cpu_env, vfp_reg_offset(dp, rd));
2791         tcg_temp_free_i32(frn);
2792         tcg_temp_free_i32(frm);
2793         tcg_temp_free_i32(dest);
2794     }
2795
2796     tcg_temp_free_ptr(fpst);
2797     return 0;
2798 }
2799
2800 static int handle_vrint(uint32_t insn, uint32_t rd, uint32_t rm, uint32_t dp,
2801                         int rounding)
2802 {
2803     TCGv_ptr fpst = get_fpstatus_ptr(0);
2804     TCGv_i32 tcg_rmode;
2805
2806     tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rounding));
2807     gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
2808
2809     if (dp) {
2810         TCGv_i64 tcg_op;
2811         TCGv_i64 tcg_res;
2812         tcg_op = tcg_temp_new_i64();
2813         tcg_res = tcg_temp_new_i64();
2814         tcg_gen_ld_f64(tcg_op, cpu_env, vfp_reg_offset(dp, rm));
2815         gen_helper_rintd(tcg_res, tcg_op, fpst);
2816         tcg_gen_st_f64(tcg_res, cpu_env, vfp_reg_offset(dp, rd));
2817         tcg_temp_free_i64(tcg_op);
2818         tcg_temp_free_i64(tcg_res);
2819     } else {
2820         TCGv_i32 tcg_op;
2821         TCGv_i32 tcg_res;
2822         tcg_op = tcg_temp_new_i32();
2823         tcg_res = tcg_temp_new_i32();
2824         tcg_gen_ld_f32(tcg_op, cpu_env, vfp_reg_offset(dp, rm));
2825         gen_helper_rints(tcg_res, tcg_op, fpst);
2826         tcg_gen_st_f32(tcg_res, cpu_env, vfp_reg_offset(dp, rd));
2827         tcg_temp_free_i32(tcg_op);
2828         tcg_temp_free_i32(tcg_res);
2829     }
2830
2831     gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
2832     tcg_temp_free_i32(tcg_rmode);
2833
2834     tcg_temp_free_ptr(fpst);
2835     return 0;
2836 }
2837
2838 static int handle_vcvt(uint32_t insn, uint32_t rd, uint32_t rm, uint32_t dp,
2839                        int rounding)
2840 {
2841     bool is_signed = extract32(insn, 7, 1);
2842     TCGv_ptr fpst = get_fpstatus_ptr(0);
2843     TCGv_i32 tcg_rmode, tcg_shift;
2844
2845     tcg_shift = tcg_const_i32(0);
2846
2847     tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rounding));
2848     gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
2849
2850     if (dp) {
2851         TCGv_i64 tcg_double, tcg_res;
2852         TCGv_i32 tcg_tmp;
2853         /* Rd is encoded as a single precision register even when the source
2854          * is double precision.
2855          */
2856         rd = ((rd << 1) & 0x1e) | ((rd >> 4) & 0x1);
2857         tcg_double = tcg_temp_new_i64();
2858         tcg_res = tcg_temp_new_i64();
2859         tcg_tmp = tcg_temp_new_i32();
2860         tcg_gen_ld_f64(tcg_double, cpu_env, vfp_reg_offset(1, rm));
2861         if (is_signed) {
2862             gen_helper_vfp_tosld(tcg_res, tcg_double, tcg_shift, fpst);
2863         } else {
2864             gen_helper_vfp_tould(tcg_res, tcg_double, tcg_shift, fpst);
2865         }
2866         tcg_gen_trunc_i64_i32(tcg_tmp, tcg_res);
2867         tcg_gen_st_f32(tcg_tmp, cpu_env, vfp_reg_offset(0, rd));
2868         tcg_temp_free_i32(tcg_tmp);
2869         tcg_temp_free_i64(tcg_res);
2870         tcg_temp_free_i64(tcg_double);
2871     } else {
2872         TCGv_i32 tcg_single, tcg_res;
2873         tcg_single = tcg_temp_new_i32();
2874         tcg_res = tcg_temp_new_i32();
2875         tcg_gen_ld_f32(tcg_single, cpu_env, vfp_reg_offset(0, rm));
2876         if (is_signed) {
2877             gen_helper_vfp_tosls(tcg_res, tcg_single, tcg_shift, fpst);
2878         } else {
2879             gen_helper_vfp_touls(tcg_res, tcg_single, tcg_shift, fpst);
2880         }
2881         tcg_gen_st_f32(tcg_res, cpu_env, vfp_reg_offset(0, rd));
2882         tcg_temp_free_i32(tcg_res);
2883         tcg_temp_free_i32(tcg_single);
2884     }
2885
2886     gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
2887     tcg_temp_free_i32(tcg_rmode);
2888
2889     tcg_temp_free_i32(tcg_shift);
2890
2891     tcg_temp_free_ptr(fpst);
2892
2893     return 0;
2894 }
2895
2896 /* Table for converting the most common AArch32 encoding of
2897  * rounding mode to arm_fprounding order (which matches the
2898  * common AArch64 order); see ARM ARM pseudocode FPDecodeRM().
2899  */
2900 static const uint8_t fp_decode_rm[] = {
2901     FPROUNDING_TIEAWAY,
2902     FPROUNDING_TIEEVEN,
2903     FPROUNDING_POSINF,
2904     FPROUNDING_NEGINF,
2905 };
2906
2907 static int disas_vfp_v8_insn(CPUARMState *env, DisasContext *s, uint32_t insn)
2908 {
2909     uint32_t rd, rn, rm, dp = extract32(insn, 8, 1);
2910
2911     if (!arm_feature(env, ARM_FEATURE_V8)) {
2912         return 1;
2913     }
2914
2915     if (dp) {
2916         VFP_DREG_D(rd, insn);
2917         VFP_DREG_N(rn, insn);
2918         VFP_DREG_M(rm, insn);
2919     } else {
2920         rd = VFP_SREG_D(insn);
2921         rn = VFP_SREG_N(insn);
2922         rm = VFP_SREG_M(insn);
2923     }
2924
2925     if ((insn & 0x0f800e50) == 0x0e000a00) {
2926         return handle_vsel(insn, rd, rn, rm, dp);
2927     } else if ((insn & 0x0fb00e10) == 0x0e800a00) {
2928         return handle_vminmaxnm(insn, rd, rn, rm, dp);
2929     } else if ((insn & 0x0fbc0ed0) == 0x0eb80a40) {
2930         /* VRINTA, VRINTN, VRINTP, VRINTM */
2931         int rounding = fp_decode_rm[extract32(insn, 16, 2)];
2932         return handle_vrint(insn, rd, rm, dp, rounding);
2933     } else if ((insn & 0x0fbc0e50) == 0x0ebc0a40) {
2934         /* VCVTA, VCVTN, VCVTP, VCVTM */
2935         int rounding = fp_decode_rm[extract32(insn, 16, 2)];
2936         return handle_vcvt(insn, rd, rm, dp, rounding);
2937     }
2938     return 1;
2939 }
2940
2941 /* Disassemble a VFP instruction.  Returns nonzero if an error occurred
2942    (ie. an undefined instruction).  */
2943 static int disas_vfp_insn(CPUARMState * env, DisasContext *s, uint32_t insn)
2944 {
2945     uint32_t rd, rn, rm, op, i, n, offset, delta_d, delta_m, bank_mask;
2946     int dp, veclen;
2947     TCGv_i32 addr;
2948     TCGv_i32 tmp;
2949     TCGv_i32 tmp2;
2950
2951     if (!arm_feature(env, ARM_FEATURE_VFP))
2952         return 1;
2953
2954     /* FIXME: this access check should not take precedence over UNDEF
2955      * for invalid encodings; we will generate incorrect syndrome information
2956      * for attempts to execute invalid vfp/neon encodings with FP disabled.
2957      */
2958     if (!s->cpacr_fpen) {
2959         gen_exception_insn(s, 4, EXCP_UDEF,
2960                            syn_fp_access_trap(1, 0xe, s->thumb));
2961         return 0;
2962     }
2963
2964     if (!s->vfp_enabled) {
2965         /* VFP disabled.  Only allow fmxr/fmrx to/from some control regs.  */
2966         if ((insn & 0x0fe00fff) != 0x0ee00a10)
2967             return 1;
2968         rn = (insn >> 16) & 0xf;
2969         if (rn != ARM_VFP_FPSID && rn != ARM_VFP_FPEXC && rn != ARM_VFP_MVFR2
2970             && rn != ARM_VFP_MVFR1 && rn != ARM_VFP_MVFR0) {
2971             return 1;
2972         }
2973     }
2974
2975     if (extract32(insn, 28, 4) == 0xf) {
2976         /* Encodings with T=1 (Thumb) or unconditional (ARM):
2977          * only used in v8 and above.
2978          */
2979         return disas_vfp_v8_insn(env, s, insn);
2980     }
2981
2982     dp = ((insn & 0xf00) == 0xb00);
2983     switch ((insn >> 24) & 0xf) {
2984     case 0xe:
2985         if (insn & (1 << 4)) {
2986             /* single register transfer */
2987             rd = (insn >> 12) & 0xf;
2988             if (dp) {
2989                 int size;
2990                 int pass;
2991
2992                 VFP_DREG_N(rn, insn);
2993                 if (insn & 0xf)
2994                     return 1;
2995                 if (insn & 0x00c00060
2996                     && !arm_feature(env, ARM_FEATURE_NEON))
2997                     return 1;
2998
2999                 pass = (insn >> 21) & 1;
3000                 if (insn & (1 << 22)) {
3001                     size = 0;
3002                     offset = ((insn >> 5) & 3) * 8;
3003                 } else if (insn & (1 << 5)) {
3004                     size = 1;
3005                     offset = (insn & (1 << 6)) ? 16 : 0;
3006                 } else {
3007                     size = 2;
3008                     offset = 0;
3009                 }
3010                 if (insn & ARM_CP_RW_BIT) {
3011                     /* vfp->arm */
3012                     tmp = neon_load_reg(rn, pass);
3013                     switch (size) {
3014                     case 0:
3015                         if (offset)
3016                             tcg_gen_shri_i32(tmp, tmp, offset);
3017                         if (insn & (1 << 23))
3018                             gen_uxtb(tmp);
3019                         else
3020                             gen_sxtb(tmp);
3021                         break;
3022                     case 1:
3023                         if (insn & (1 << 23)) {
3024                             if (offset) {
3025                                 tcg_gen_shri_i32(tmp, tmp, 16);
3026                             } else {
3027                                 gen_uxth(tmp);
3028                             }
3029                         } else {
3030                             if (offset) {
3031                                 tcg_gen_sari_i32(tmp, tmp, 16);
3032                             } else {
3033                                 gen_sxth(tmp);
3034                             }
3035                         }
3036                         break;
3037                     case 2:
3038                         break;
3039                     }
3040                     store_reg(s, rd, tmp);
3041                 } else {
3042                     /* arm->vfp */
3043                     tmp = load_reg(s, rd);
3044                     if (insn & (1 << 23)) {
3045                         /* VDUP */
3046                         if (size == 0) {
3047                             gen_neon_dup_u8(tmp, 0);
3048                         } else if (size == 1) {
3049                             gen_neon_dup_low16(tmp);
3050                         }
3051                         for (n = 0; n <= pass * 2; n++) {
3052                             tmp2 = tcg_temp_new_i32();
3053                             tcg_gen_mov_i32(tmp2, tmp);
3054                             neon_store_reg(rn, n, tmp2);
3055                         }
3056                         neon_store_reg(rn, n, tmp);
3057                     } else {
3058                         /* VMOV */
3059                         switch (size) {
3060                         case 0:
3061                             tmp2 = neon_load_reg(rn, pass);
3062                             tcg_gen_deposit_i32(tmp, tmp2, tmp, offset, 8);
3063                             tcg_temp_free_i32(tmp2);
3064                             break;
3065                         case 1:
3066                             tmp2 = neon_load_reg(rn, pass);
3067                             tcg_gen_deposit_i32(tmp, tmp2, tmp, offset, 16);
3068                             tcg_temp_free_i32(tmp2);
3069                             break;
3070                         case 2:
3071                             break;
3072                         }
3073                         neon_store_reg(rn, pass, tmp);
3074                     }
3075                 }
3076             } else { /* !dp */
3077                 if ((insn & 0x6f) != 0x00)
3078                     return 1;
3079                 rn = VFP_SREG_N(insn);
3080                 if (insn & ARM_CP_RW_BIT) {
3081                     /* vfp->arm */
3082                     if (insn & (1 << 21)) {
3083                         /* system register */
3084                         rn >>= 1;
3085
3086                         switch (rn) {
3087                         case ARM_VFP_FPSID:
3088                             /* VFP2 allows access to FSID from userspace.
3089                                VFP3 restricts all id registers to privileged
3090                                accesses.  */
3091                             if (IS_USER(s)
3092                                 && arm_feature(env, ARM_FEATURE_VFP3))
3093                                 return 1;
3094                             tmp = load_cpu_field(vfp.xregs[rn]);
3095                             break;
3096                         case ARM_VFP_FPEXC:
3097                             if (IS_USER(s))
3098                                 return 1;
3099                             tmp = load_cpu_field(vfp.xregs[rn]);
3100                             break;
3101                         case ARM_VFP_FPINST:
3102                         case ARM_VFP_FPINST2:
3103                             /* Not present in VFP3.  */
3104                             if (IS_USER(s)
3105                                 || arm_feature(env, ARM_FEATURE_VFP3))
3106                                 return 1;
3107                             tmp = load_cpu_field(vfp.xregs[rn]);
3108                             break;
3109                         case ARM_VFP_FPSCR:
3110                             if (rd == 15) {
3111                                 tmp = load_cpu_field(vfp.xregs[ARM_VFP_FPSCR]);
3112                                 tcg_gen_andi_i32(tmp, tmp, 0xf0000000);
3113                             } else {
3114                                 tmp = tcg_temp_new_i32();
3115                                 gen_helper_vfp_get_fpscr(tmp, cpu_env);
3116                             }
3117                             break;
3118                         case ARM_VFP_MVFR2:
3119                             if (!arm_feature(env, ARM_FEATURE_V8)) {
3120                                 return 1;
3121                             }
3122                             /* fall through */
3123                         case ARM_VFP_MVFR0:
3124                         case ARM_VFP_MVFR1:
3125                             if (IS_USER(s)
3126                                 || !arm_feature(env, ARM_FEATURE_MVFR))
3127                                 return 1;
3128                             tmp = load_cpu_field(vfp.xregs[rn]);
3129                             break;
3130                         default:
3131                             return 1;
3132                         }
3133                     } else {
3134                         gen_mov_F0_vreg(0, rn);
3135                         tmp = gen_vfp_mrs();
3136                     }
3137                     if (rd == 15) {
3138                         /* Set the 4 flag bits in the CPSR.  */
3139                         gen_set_nzcv(tmp);
3140                         tcg_temp_free_i32(tmp);
3141                     } else {
3142                         store_reg(s, rd, tmp);
3143                     }
3144                 } else {
3145                     /* arm->vfp */
3146                     if (insn & (1 << 21)) {
3147                         rn >>= 1;
3148                         /* system register */
3149                         switch (rn) {
3150                         case ARM_VFP_FPSID:
3151                         case ARM_VFP_MVFR0:
3152                         case ARM_VFP_MVFR1:
3153                             /* Writes are ignored.  */
3154                             break;
3155                         case ARM_VFP_FPSCR:
3156                             tmp = load_reg(s, rd);
3157                             gen_helper_vfp_set_fpscr(cpu_env, tmp);
3158                             tcg_temp_free_i32(tmp);
3159                             gen_lookup_tb(s);
3160                             break;
3161                         case ARM_VFP_FPEXC:
3162                             if (IS_USER(s))
3163                                 return 1;
3164                             /* TODO: VFP subarchitecture support.
3165                              * For now, keep the EN bit only */
3166                             tmp = load_reg(s, rd);
3167                             tcg_gen_andi_i32(tmp, tmp, 1 << 30);
3168                             store_cpu_field(tmp, vfp.xregs[rn]);
3169                             gen_lookup_tb(s);
3170                             break;
3171                         case ARM_VFP_FPINST:
3172                         case ARM_VFP_FPINST2:
3173                             tmp = load_reg(s, rd);
3174                             store_cpu_field(tmp, vfp.xregs[rn]);
3175                             break;
3176                         default:
3177                             return 1;
3178                         }
3179                     } else {
3180                         tmp = load_reg(s, rd);
3181                         gen_vfp_msr(tmp);
3182                         gen_mov_vreg_F0(0, rn);
3183                     }
3184                 }
3185             }
3186         } else {
3187             /* data processing */
3188             /* The opcode is in bits 23, 21, 20 and 6.  */
3189             op = ((insn >> 20) & 8) | ((insn >> 19) & 6) | ((insn >> 6) & 1);
3190             if (dp) {
3191                 if (op == 15) {
3192                     /* rn is opcode */
3193                     rn = ((insn >> 15) & 0x1e) | ((insn >> 7) & 1);
3194                 } else {
3195                     /* rn is register number */
3196                     VFP_DREG_N(rn, insn);
3197                 }
3198
3199                 if (op == 15 && (rn == 15 || ((rn & 0x1c) == 0x18) ||
3200                                  ((rn & 0x1e) == 0x6))) {
3201                     /* Integer or single/half precision destination.  */
3202                     rd = VFP_SREG_D(insn);
3203                 } else {
3204                     VFP_DREG_D(rd, insn);
3205                 }
3206                 if (op == 15 &&
3207                     (((rn & 0x1c) == 0x10) || ((rn & 0x14) == 0x14) ||
3208                      ((rn & 0x1e) == 0x4))) {
3209                     /* VCVT from int or half precision is always from S reg
3210                      * regardless of dp bit. VCVT with immediate frac_bits
3211                      * has same format as SREG_M.
3212                      */
3213                     rm = VFP_SREG_M(insn);
3214                 } else {
3215                     VFP_DREG_M(rm, insn);
3216                 }
3217             } else {
3218                 rn = VFP_SREG_N(insn);
3219                 if (op == 15 && rn == 15) {
3220                     /* Double precision destination.  */
3221                     VFP_DREG_D(rd, insn);
3222                 } else {
3223                     rd = VFP_SREG_D(insn);
3224                 }
3225                 /* NB that we implicitly rely on the encoding for the frac_bits
3226                  * in VCVT of fixed to float being the same as that of an SREG_M
3227                  */
3228                 rm = VFP_SREG_M(insn);
3229             }
3230
3231             veclen = s->vec_len;
3232             if (op == 15 && rn > 3)
3233                 veclen = 0;
3234
3235             /* Shut up compiler warnings.  */
3236             delta_m = 0;
3237             delta_d = 0;
3238             bank_mask = 0;
3239
3240             if (veclen > 0) {
3241                 if (dp)
3242                     bank_mask = 0xc;
3243                 else
3244                     bank_mask = 0x18;
3245
3246                 /* Figure out what type of vector operation this is.  */
3247                 if ((rd & bank_mask) == 0) {
3248                     /* scalar */
3249                     veclen = 0;
3250                 } else {
3251                     if (dp)
3252                         delta_d = (s->vec_stride >> 1) + 1;
3253                     else
3254                         delta_d = s->vec_stride + 1;
3255
3256                     if ((rm & bank_mask) == 0) {
3257                         /* mixed scalar/vector */
3258                         delta_m = 0;
3259                     } else {
3260                         /* vector */
3261                         delta_m = delta_d;
3262                     }
3263                 }
3264             }
3265
3266             /* Load the initial operands.  */
3267             if (op == 15) {
3268                 switch (rn) {
3269                 case 16:
3270                 case 17:
3271                     /* Integer source */
3272                     gen_mov_F0_vreg(0, rm);
3273                     break;
3274                 case 8:
3275                 case 9:
3276                     /* Compare */
3277                     gen_mov_F0_vreg(dp, rd);
3278                     gen_mov_F1_vreg(dp, rm);
3279                     break;
3280                 case 10:
3281                 case 11:
3282                     /* Compare with zero */
3283                     gen_mov_F0_vreg(dp, rd);
3284                     gen_vfp_F1_ld0(dp);
3285                     break;
3286                 case 20:
3287                 case 21:
3288                 case 22:
3289                 case 23:
3290                 case 28:
3291                 case 29:
3292                 case 30:
3293                 case 31:
3294                     /* Source and destination the same.  */
3295                     gen_mov_F0_vreg(dp, rd);
3296                     break;
3297                 case 4:
3298                 case 5:
3299                 case 6:
3300                 case 7:
3301                     /* VCVTB, VCVTT: only present with the halfprec extension
3302                      * UNPREDICTABLE if bit 8 is set prior to ARMv8
3303                      * (we choose to UNDEF)
3304                      */
3305                     if ((dp && !arm_feature(env, ARM_FEATURE_V8)) ||
3306                         !arm_feature(env, ARM_FEATURE_VFP_FP16)) {
3307                         return 1;
3308                     }
3309                     if (!extract32(rn, 1, 1)) {
3310                         /* Half precision source.  */
3311                         gen_mov_F0_vreg(0, rm);
3312                         break;
3313                     }
3314                     /* Otherwise fall through */
3315                 default:
3316                     /* One source operand.  */
3317                     gen_mov_F0_vreg(dp, rm);
3318                     break;
3319                 }
3320             } else {
3321                 /* Two source operands.  */
3322                 gen_mov_F0_vreg(dp, rn);
3323                 gen_mov_F1_vreg(dp, rm);
3324             }
3325
3326             for (;;) {
3327                 /* Perform the calculation.  */
3328                 switch (op) {
3329                 case 0: /* VMLA: fd + (fn * fm) */
3330                     /* Note that order of inputs to the add matters for NaNs */
3331                     gen_vfp_F1_mul(dp);
3332                     gen_mov_F0_vreg(dp, rd);
3333                     gen_vfp_add(dp);
3334                     break;
3335                 case 1: /* VMLS: fd + -(fn * fm) */
3336                     gen_vfp_mul(dp);
3337                     gen_vfp_F1_neg(dp);
3338                     gen_mov_F0_vreg(dp, rd);
3339                     gen_vfp_add(dp);
3340                     break;
3341                 case 2: /* VNMLS: -fd + (fn * fm) */
3342                     /* Note that it isn't valid to replace (-A + B) with (B - A)
3343                      * or similar plausible looking simplifications
3344                      * because this will give wrong results for NaNs.
3345                      */
3346                     gen_vfp_F1_mul(dp);
3347                     gen_mov_F0_vreg(dp, rd);
3348                     gen_vfp_neg(dp);
3349                     gen_vfp_add(dp);
3350                     break;
3351                 case 3: /* VNMLA: -fd + -(fn * fm) */
3352                     gen_vfp_mul(dp);
3353                     gen_vfp_F1_neg(dp);
3354                     gen_mov_F0_vreg(dp, rd);
3355                     gen_vfp_neg(dp);
3356                     gen_vfp_add(dp);
3357                     break;
3358                 case 4: /* mul: fn * fm */
3359                     gen_vfp_mul(dp);
3360                     break;
3361                 case 5: /* nmul: -(fn * fm) */
3362                     gen_vfp_mul(dp);
3363                     gen_vfp_neg(dp);
3364                     break;
3365                 case 6: /* add: fn + fm */
3366                     gen_vfp_add(dp);
3367                     break;
3368                 case 7: /* sub: fn - fm */
3369                     gen_vfp_sub(dp);
3370                     break;
3371                 case 8: /* div: fn / fm */
3372                     gen_vfp_div(dp);
3373                     break;
3374                 case 10: /* VFNMA : fd = muladd(-fd,  fn, fm) */
3375                 case 11: /* VFNMS : fd = muladd(-fd, -fn, fm) */
3376                 case 12: /* VFMA  : fd = muladd( fd,  fn, fm) */
3377                 case 13: /* VFMS  : fd = muladd( fd, -fn, fm) */
3378                     /* These are fused multiply-add, and must be done as one
3379                      * floating point operation with no rounding between the
3380                      * multiplication and addition steps.
3381                      * NB that doing the negations here as separate steps is
3382                      * correct : an input NaN should come out with its sign bit
3383                      * flipped if it is a negated-input.
3384                      */
3385                     if (!arm_feature(env, ARM_FEATURE_VFP4)) {
3386                         return 1;
3387                     }
3388                     if (dp) {
3389                         TCGv_ptr fpst;
3390                         TCGv_i64 frd;
3391                         if (op & 1) {
3392                             /* VFNMS, VFMS */
3393                             gen_helper_vfp_negd(cpu_F0d, cpu_F0d);
3394                         }
3395                         frd = tcg_temp_new_i64();
3396                         tcg_gen_ld_f64(frd, cpu_env, vfp_reg_offset(dp, rd));
3397                         if (op & 2) {
3398                             /* VFNMA, VFNMS */
3399                             gen_helper_vfp_negd(frd, frd);
3400                         }
3401                         fpst = get_fpstatus_ptr(0);
3402                         gen_helper_vfp_muladdd(cpu_F0d, cpu_F0d,
3403                                                cpu_F1d, frd, fpst);
3404                         tcg_temp_free_ptr(fpst);
3405                         tcg_temp_free_i64(frd);
3406                     } else {
3407                         TCGv_ptr fpst;
3408                         TCGv_i32 frd;
3409                         if (op & 1) {
3410                             /* VFNMS, VFMS */
3411                             gen_helper_vfp_negs(cpu_F0s, cpu_F0s);
3412                         }
3413                         frd = tcg_temp_new_i32();
3414                         tcg_gen_ld_f32(frd, cpu_env, vfp_reg_offset(dp, rd));
3415                         if (op & 2) {
3416                             gen_helper_vfp_negs(frd, frd);
3417                         }
3418                         fpst = get_fpstatus_ptr(0);
3419                         gen_helper_vfp_muladds(cpu_F0s, cpu_F0s,
3420                                                cpu_F1s, frd, fpst);
3421                         tcg_temp_free_ptr(fpst);
3422                         tcg_temp_free_i32(frd);
3423                     }
3424                     break;
3425                 case 14: /* fconst */
3426                     if (!arm_feature(env, ARM_FEATURE_VFP3))
3427                       return 1;
3428
3429                     n = (insn << 12) & 0x80000000;
3430                     i = ((insn >> 12) & 0x70) | (insn & 0xf);
3431                     if (dp) {
3432                         if (i & 0x40)
3433                             i |= 0x3f80;
3434                         else
3435                             i |= 0x4000;
3436                         n |= i << 16;
3437                         tcg_gen_movi_i64(cpu_F0d, ((uint64_t)n) << 32);
3438                     } else {
3439                         if (i & 0x40)
3440                             i |= 0x780;
3441                         else
3442                             i |= 0x800;
3443                         n |= i << 19;
3444                         tcg_gen_movi_i32(cpu_F0s, n);
3445                     }
3446                     break;
3447                 case 15: /* extension space */
3448                     switch (rn) {
3449                     case 0: /* cpy */
3450                         /* no-op */
3451                         break;
3452                     case 1: /* abs */
3453                         gen_vfp_abs(dp);
3454                         break;
3455                     case 2: /* neg */
3456                         gen_vfp_neg(dp);
3457                         break;
3458                     case 3: /* sqrt */
3459                         gen_vfp_sqrt(dp);
3460                         break;
3461                     case 4: /* vcvtb.f32.f16, vcvtb.f64.f16 */
3462                         tmp = gen_vfp_mrs();
3463                         tcg_gen_ext16u_i32(tmp, tmp);
3464                         if (dp) {
3465                             gen_helper_vfp_fcvt_f16_to_f64(cpu_F0d, tmp,
3466                                                            cpu_env);
3467                         } else {
3468                             gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp,
3469                                                            cpu_env);
3470                         }
3471                         tcg_temp_free_i32(tmp);
3472                         break;
3473                     case 5: /* vcvtt.f32.f16, vcvtt.f64.f16 */
3474                         tmp = gen_vfp_mrs();
3475                         tcg_gen_shri_i32(tmp, tmp, 16);
3476                         if (dp) {
3477                             gen_helper_vfp_fcvt_f16_to_f64(cpu_F0d, tmp,
3478                                                            cpu_env);
3479                         } else {
3480                             gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp,
3481                                                            cpu_env);
3482                         }
3483                         tcg_temp_free_i32(tmp);
3484                         break;
3485                     case 6: /* vcvtb.f16.f32, vcvtb.f16.f64 */
3486                         tmp = tcg_temp_new_i32();
3487                         if (dp) {
3488                             gen_helper_vfp_fcvt_f64_to_f16(tmp, cpu_F0d,
3489                                                            cpu_env);
3490                         } else {
3491                             gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s,
3492                                                            cpu_env);
3493                         }
3494                         gen_mov_F0_vreg(0, rd);
3495                         tmp2 = gen_vfp_mrs();
3496                         tcg_gen_andi_i32(tmp2, tmp2, 0xffff0000);
3497                         tcg_gen_or_i32(tmp, tmp, tmp2);
3498                         tcg_temp_free_i32(tmp2);
3499                         gen_vfp_msr(tmp);
3500                         break;
3501                     case 7: /* vcvtt.f16.f32, vcvtt.f16.f64 */
3502                         tmp = tcg_temp_new_i32();
3503                         if (dp) {
3504                             gen_helper_vfp_fcvt_f64_to_f16(tmp, cpu_F0d,
3505                                                            cpu_env);
3506                         } else {
3507                             gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s,
3508                                                            cpu_env);
3509                         }
3510                         tcg_gen_shli_i32(tmp, tmp, 16);
3511                         gen_mov_F0_vreg(0, rd);
3512                         tmp2 = gen_vfp_mrs();
3513                         tcg_gen_ext16u_i32(tmp2, tmp2);
3514                         tcg_gen_or_i32(tmp, tmp, tmp2);
3515                         tcg_temp_free_i32(tmp2);
3516                         gen_vfp_msr(tmp);
3517                         break;
3518                     case 8: /* cmp */
3519                         gen_vfp_cmp(dp);
3520                         break;
3521                     case 9: /* cmpe */
3522                         gen_vfp_cmpe(dp);
3523                         break;
3524                     case 10: /* cmpz */
3525                         gen_vfp_cmp(dp);
3526                         break;
3527                     case 11: /* cmpez */
3528                         gen_vfp_F1_ld0(dp);
3529                         gen_vfp_cmpe(dp);
3530                         break;
3531                     case 12: /* vrintr */
3532                     {
3533                         TCGv_ptr fpst = get_fpstatus_ptr(0);
3534                         if (dp) {
3535                             gen_helper_rintd(cpu_F0d, cpu_F0d, fpst);
3536                         } else {
3537                             gen_helper_rints(cpu_F0s, cpu_F0s, fpst);
3538                         }
3539                         tcg_temp_free_ptr(fpst);
3540                         break;
3541                     }
3542                     case 13: /* vrintz */
3543                     {
3544                         TCGv_ptr fpst = get_fpstatus_ptr(0);
3545                         TCGv_i32 tcg_rmode;
3546                         tcg_rmode = tcg_const_i32(float_round_to_zero);
3547                         gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
3548                         if (dp) {
3549                             gen_helper_rintd(cpu_F0d, cpu_F0d, fpst);
3550                         } else {
3551                             gen_helper_rints(cpu_F0s, cpu_F0s, fpst);
3552                         }
3553                         gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
3554                         tcg_temp_free_i32(tcg_rmode);
3555                         tcg_temp_free_ptr(fpst);
3556                         break;
3557                     }
3558                     case 14: /* vrintx */
3559                     {
3560                         TCGv_ptr fpst = get_fpstatus_ptr(0);
3561                         if (dp) {
3562                             gen_helper_rintd_exact(cpu_F0d, cpu_F0d, fpst);
3563                         } else {
3564                             gen_helper_rints_exact(cpu_F0s, cpu_F0s, fpst);
3565                         }
3566                         tcg_temp_free_ptr(fpst);
3567                         break;
3568                     }
3569                     case 15: /* single<->double conversion */
3570                         if (dp)
3571                             gen_helper_vfp_fcvtsd(cpu_F0s, cpu_F0d, cpu_env);
3572                         else
3573                             gen_helper_vfp_fcvtds(cpu_F0d, cpu_F0s, cpu_env);
3574                         break;
3575                     case 16: /* fuito */
3576                         gen_vfp_uito(dp, 0);
3577                         break;
3578                     case 17: /* fsito */
3579                         gen_vfp_sito(dp, 0);
3580                         break;
3581                     case 20: /* fshto */
3582                         if (!arm_feature(env, ARM_FEATURE_VFP3))
3583                           return 1;
3584                         gen_vfp_shto(dp, 16 - rm, 0);
3585                         break;
3586                     case 21: /* fslto */
3587                         if (!arm_feature(env, ARM_FEATURE_VFP3))
3588                           return 1;
3589                         gen_vfp_slto(dp, 32 - rm, 0);
3590                         break;
3591                     case 22: /* fuhto */
3592                         if (!arm_feature(env, ARM_FEATURE_VFP3))
3593                           return 1;
3594                         gen_vfp_uhto(dp, 16 - rm, 0);
3595                         break;
3596                     case 23: /* fulto */
3597                         if (!arm_feature(env, ARM_FEATURE_VFP3))
3598                           return 1;
3599                         gen_vfp_ulto(dp, 32 - rm, 0);
3600                         break;
3601                     case 24: /* ftoui */
3602                         gen_vfp_toui(dp, 0);
3603                         break;
3604                     case 25: /* ftouiz */
3605                         gen_vfp_touiz(dp, 0);
3606                         break;
3607                     case 26: /* ftosi */
3608                         gen_vfp_tosi(dp, 0);
3609                         break;
3610                     case 27: /* ftosiz */
3611                         gen_vfp_tosiz(dp, 0);
3612                         break;
3613                     case 28: /* ftosh */
3614                         if (!arm_feature(env, ARM_FEATURE_VFP3))
3615                           return 1;
3616                         gen_vfp_tosh(dp, 16 - rm, 0);
3617                         break;
3618                     case 29: /* ftosl */
3619                         if (!arm_feature(env, ARM_FEATURE_VFP3))
3620                           return 1;
3621                         gen_vfp_tosl(dp, 32 - rm, 0);
3622                         break;
3623                     case 30: /* ftouh */
3624                         if (!arm_feature(env, ARM_FEATURE_VFP3))
3625                           return 1;
3626                         gen_vfp_touh(dp, 16 - rm, 0);
3627                         break;
3628                     case 31: /* ftoul */
3629                         if (!arm_feature(env, ARM_FEATURE_VFP3))
3630                           return 1;
3631                         gen_vfp_toul(dp, 32 - rm, 0);
3632                         break;
3633                     default: /* undefined */
3634                         return 1;
3635                     }
3636                     break;
3637                 default: /* undefined */
3638                     return 1;
3639                 }
3640
3641                 /* Write back the result.  */
3642                 if (op == 15 && (rn >= 8 && rn <= 11)) {
3643                     /* Comparison, do nothing.  */
3644                 } else if (op == 15 && dp && ((rn & 0x1c) == 0x18 ||
3645                                               (rn & 0x1e) == 0x6)) {
3646                     /* VCVT double to int: always integer result.
3647                      * VCVT double to half precision is always a single
3648                      * precision result.
3649                      */
3650                     gen_mov_vreg_F0(0, rd);
3651                 } else if (op == 15 && rn == 15) {
3652                     /* conversion */
3653                     gen_mov_vreg_F0(!dp, rd);
3654                 } else {
3655                     gen_mov_vreg_F0(dp, rd);
3656                 }
3657
3658                 /* break out of the loop if we have finished  */
3659                 if (veclen == 0)
3660                     break;
3661
3662                 if (op == 15 && delta_m == 0) {
3663                     /* single source one-many */
3664                     while (veclen--) {
3665                         rd = ((rd + delta_d) & (bank_mask - 1))
3666                              | (rd & bank_mask);
3667                         gen_mov_vreg_F0(dp, rd);
3668                     }
3669                     break;
3670                 }
3671                 /* Setup the next operands.  */
3672                 veclen--;
3673                 rd = ((rd + delta_d) & (bank_mask - 1))
3674                      | (rd & bank_mask);
3675
3676                 if (op == 15) {
3677                     /* One source operand.  */
3678                     rm = ((rm + delta_m) & (bank_mask - 1))
3679                          | (rm & bank_mask);
3680                     gen_mov_F0_vreg(dp, rm);
3681                 } else {
3682                     /* Two source operands.  */
3683                     rn = ((rn + delta_d) & (bank_mask - 1))
3684                          | (rn & bank_mask);
3685                     gen_mov_F0_vreg(dp, rn);
3686                     if (delta_m) {
3687                         rm = ((rm + delta_m) & (bank_mask - 1))
3688                              | (rm & bank_mask);
3689                         gen_mov_F1_vreg(dp, rm);
3690                     }
3691                 }
3692             }
3693         }
3694         break;
3695     case 0xc:
3696     case 0xd:
3697         if ((insn & 0x03e00000) == 0x00400000) {
3698             /* two-register transfer */
3699             rn = (insn >> 16) & 0xf;
3700             rd = (insn >> 12) & 0xf;
3701             if (dp) {
3702                 VFP_DREG_M(rm, insn);
3703             } else {
3704                 rm = VFP_SREG_M(insn);
3705             }
3706
3707             if (insn & ARM_CP_RW_BIT) {
3708                 /* vfp->arm */
3709                 if (dp) {
3710                     gen_mov_F0_vreg(0, rm * 2);
3711                     tmp = gen_vfp_mrs();
3712                     store_reg(s, rd, tmp);
3713                     gen_mov_F0_vreg(0, rm * 2 + 1);
3714                     tmp = gen_vfp_mrs();
3715                     store_reg(s, rn, tmp);
3716                 } else {
3717                     gen_mov_F0_vreg(0, rm);
3718                     tmp = gen_vfp_mrs();
3719                     store_reg(s, rd, tmp);
3720                     gen_mov_F0_vreg(0, rm + 1);
3721                     tmp = gen_vfp_mrs();
3722                     store_reg(s, rn, tmp);
3723                 }
3724             } else {
3725                 /* arm->vfp */
3726                 if (dp) {
3727                     tmp = load_reg(s, rd);
3728                     gen_vfp_msr(tmp);
3729                     gen_mov_vreg_F0(0, rm * 2);
3730                     tmp = load_reg(s, rn);
3731                     gen_vfp_msr(tmp);
3732                     gen_mov_vreg_F0(0, rm * 2 + 1);
3733                 } else {
3734                     tmp = load_reg(s, rd);
3735                     gen_vfp_msr(tmp);
3736                     gen_mov_vreg_F0(0, rm);
3737                     tmp = load_reg(s, rn);
3738                     gen_vfp_msr(tmp);
3739                     gen_mov_vreg_F0(0, rm + 1);
3740                 }
3741             }
3742         } else {
3743             /* Load/store */
3744             rn = (insn >> 16) & 0xf;
3745             if (dp)
3746                 VFP_DREG_D(rd, insn);
3747             else
3748                 rd = VFP_SREG_D(insn);
3749             if ((insn & 0x01200000) == 0x01000000) {
3750                 /* Single load/store */
3751                 offset = (insn & 0xff) << 2;
3752                 if ((insn & (1 << 23)) == 0)
3753                     offset = -offset;
3754                 if (s->thumb && rn == 15) {
3755                     /* This is actually UNPREDICTABLE */
3756                     addr = tcg_temp_new_i32();
3757                     tcg_gen_movi_i32(addr, s->pc & ~2);
3758                 } else {
3759                     addr = load_reg(s, rn);
3760                 }
3761                 tcg_gen_addi_i32(addr, addr, offset);
3762                 if (insn & (1 << 20)) {
3763                     gen_vfp_ld(s, dp, addr);
3764                     gen_mov_vreg_F0(dp, rd);
3765                 } else {
3766                     gen_mov_F0_vreg(dp, rd);
3767                     gen_vfp_st(s, dp, addr);
3768                 }
3769                 tcg_temp_free_i32(addr);
3770             } else {
3771                 /* load/store multiple */
3772                 int w = insn & (1 << 21);
3773                 if (dp)
3774                     n = (insn >> 1) & 0x7f;
3775                 else
3776                     n = insn & 0xff;
3777
3778                 if (w && !(((insn >> 23) ^ (insn >> 24)) & 1)) {
3779                     /* P == U , W == 1  => UNDEF */
3780                     return 1;
3781                 }
3782                 if (n == 0 || (rd + n) > 32 || (dp && n > 16)) {
3783                     /* UNPREDICTABLE cases for bad immediates: we choose to
3784                      * UNDEF to avoid generating huge numbers of TCG ops
3785                      */
3786                     return 1;
3787                 }
3788                 if (rn == 15 && w) {
3789                     /* writeback to PC is UNPREDICTABLE, we choose to UNDEF */
3790                     return 1;
3791                 }
3792
3793                 if (s->thumb && rn == 15) {
3794                     /* This is actually UNPREDICTABLE */
3795                     addr = tcg_temp_new_i32();
3796                     tcg_gen_movi_i32(addr, s->pc & ~2);
3797                 } else {
3798                     addr = load_reg(s, rn);
3799                 }
3800                 if (insn & (1 << 24)) /* pre-decrement */
3801                     tcg_gen_addi_i32(addr, addr, -((insn & 0xff) << 2));
3802
3803                 if (dp)
3804                     offset = 8;
3805                 else
3806                     offset = 4;
3807                 for (i = 0; i < n; i++) {
3808                     if (insn & ARM_CP_RW_BIT) {
3809                         /* load */
3810                         gen_vfp_ld(s, dp, addr);
3811                         gen_mov_vreg_F0(dp, rd + i);
3812                     } else {
3813                         /* store */
3814                         gen_mov_F0_vreg(dp, rd + i);
3815                         gen_vfp_st(s, dp, addr);
3816                     }
3817                     tcg_gen_addi_i32(addr, addr, offset);
3818                 }
3819                 if (w) {
3820                     /* writeback */
3821                     if (insn & (1 << 24))
3822                         offset = -offset * n;
3823                     else if (dp && (insn & 1))
3824                         offset = 4;
3825                     else
3826                         offset = 0;
3827
3828                     if (offset != 0)
3829                         tcg_gen_addi_i32(addr, addr, offset);
3830                     store_reg(s, rn, addr);
3831                 } else {
3832                     tcg_temp_free_i32(addr);
3833                 }
3834             }
3835         }
3836         break;
3837     default:
3838         /* Should never happen.  */
3839         return 1;
3840     }
3841     return 0;
3842 }
3843
3844 static inline void gen_goto_tb(DisasContext *s, int n, target_ulong dest)
3845 {
3846     TranslationBlock *tb;
3847
3848     tb = s->tb;
3849     if ((tb->pc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK)) {
3850         tcg_gen_goto_tb(n);
3851         gen_set_pc_im(s, dest);
3852         tcg_gen_exit_tb((uintptr_t)tb + n);
3853     } else {
3854         gen_set_pc_im(s, dest);
3855         tcg_gen_exit_tb(0);
3856     }
3857 }
3858
3859 static inline void gen_jmp (DisasContext *s, uint32_t dest)
3860 {
3861     if (unlikely(s->singlestep_enabled)) {
3862         /* An indirect jump so that we still trigger the debug exception.  */
3863         if (s->thumb)
3864             dest |= 1;
3865         gen_bx_im(s, dest);
3866     } else {
3867         gen_goto_tb(s, 0, dest);
3868         s->is_jmp = DISAS_TB_JUMP;
3869     }
3870 }
3871
3872 static inline void gen_mulxy(TCGv_i32 t0, TCGv_i32 t1, int x, int y)
3873 {
3874     if (x)
3875         tcg_gen_sari_i32(t0, t0, 16);
3876     else
3877         gen_sxth(t0);
3878     if (y)
3879         tcg_gen_sari_i32(t1, t1, 16);
3880     else
3881         gen_sxth(t1);
3882     tcg_gen_mul_i32(t0, t0, t1);
3883 }
3884
3885 /* Return the mask of PSR bits set by a MSR instruction.  */
3886 static uint32_t msr_mask(CPUARMState *env, DisasContext *s, int flags, int spsr) {
3887     uint32_t mask;
3888
3889     mask = 0;
3890     if (flags & (1 << 0))
3891         mask |= 0xff;
3892     if (flags & (1 << 1))
3893         mask |= 0xff00;
3894     if (flags & (1 << 2))
3895         mask |= 0xff0000;
3896     if (flags & (1 << 3))
3897         mask |= 0xff000000;
3898
3899     /* Mask out undefined bits.  */
3900     mask &= ~CPSR_RESERVED;
3901     if (!arm_feature(env, ARM_FEATURE_V4T))
3902         mask &= ~CPSR_T;
3903     if (!arm_feature(env, ARM_FEATURE_V5))
3904         mask &= ~CPSR_Q; /* V5TE in reality*/
3905     if (!arm_feature(env, ARM_FEATURE_V6))
3906         mask &= ~(CPSR_E | CPSR_GE);
3907     if (!arm_feature(env, ARM_FEATURE_THUMB2))
3908         mask &= ~CPSR_IT;
3909     /* Mask out execution state bits.  */
3910     if (!spsr)
3911         mask &= ~CPSR_EXEC;
3912     /* Mask out privileged bits.  */
3913     if (IS_USER(s))
3914         mask &= CPSR_USER;
3915     return mask;
3916 }
3917
3918 /* Returns nonzero if access to the PSR is not permitted. Marks t0 as dead. */
3919 static int gen_set_psr(DisasContext *s, uint32_t mask, int spsr, TCGv_i32 t0)
3920 {
3921     TCGv_i32 tmp;
3922     if (spsr) {
3923         /* ??? This is also undefined in system mode.  */
3924         if (IS_USER(s))
3925             return 1;
3926
3927         tmp = load_cpu_field(spsr);
3928         tcg_gen_andi_i32(tmp, tmp, ~mask);
3929         tcg_gen_andi_i32(t0, t0, mask);
3930         tcg_gen_or_i32(tmp, tmp, t0);
3931         store_cpu_field(tmp, spsr);
3932     } else {
3933         gen_set_cpsr(t0, mask);
3934     }
3935     tcg_temp_free_i32(t0);
3936     gen_lookup_tb(s);
3937     return 0;
3938 }
3939
3940 /* Returns nonzero if access to the PSR is not permitted.  */
3941 static int gen_set_psr_im(DisasContext *s, uint32_t mask, int spsr, uint32_t val)
3942 {
3943     TCGv_i32 tmp;
3944     tmp = tcg_temp_new_i32();
3945     tcg_gen_movi_i32(tmp, val);
3946     return gen_set_psr(s, mask, spsr, tmp);
3947 }
3948
3949 /* Generate an old-style exception return. Marks pc as dead. */
3950 static void gen_exception_return(DisasContext *s, TCGv_i32 pc)
3951 {
3952     TCGv_i32 tmp;
3953     store_reg(s, 15, pc);
3954     tmp = load_cpu_field(spsr);
3955     gen_set_cpsr(tmp, 0xffffffff);
3956     tcg_temp_free_i32(tmp);
3957     s->is_jmp = DISAS_UPDATE;
3958 }
3959
3960 /* Generate a v6 exception return.  Marks both values as dead.  */
3961 static void gen_rfe(DisasContext *s, TCGv_i32 pc, TCGv_i32 cpsr)
3962 {
3963     gen_set_cpsr(cpsr, 0xffffffff);
3964     tcg_temp_free_i32(cpsr);
3965     store_reg(s, 15, pc);
3966     s->is_jmp = DISAS_UPDATE;
3967 }
3968
3969 static void gen_nop_hint(DisasContext *s, int val)
3970 {
3971     switch (val) {
3972     case 3: /* wfi */
3973         gen_set_pc_im(s, s->pc);
3974         s->is_jmp = DISAS_WFI;
3975         break;
3976     case 2: /* wfe */
3977         gen_set_pc_im(s, s->pc);
3978         s->is_jmp = DISAS_WFE;
3979         break;
3980     case 4: /* sev */
3981     case 5: /* sevl */
3982         /* TODO: Implement SEV, SEVL and WFE.  May help SMP performance.  */
3983     default: /* nop */
3984         break;
3985     }
3986 }
3987
3988 #define CPU_V001 cpu_V0, cpu_V0, cpu_V1
3989
3990 static inline void gen_neon_add(int size, TCGv_i32 t0, TCGv_i32 t1)
3991 {
3992     switch (size) {
3993     case 0: gen_helper_neon_add_u8(t0, t0, t1); break;
3994     case 1: gen_helper_neon_add_u16(t0, t0, t1); break;
3995     case 2: tcg_gen_add_i32(t0, t0, t1); break;
3996     default: abort();
3997     }
3998 }
3999
4000 static inline void gen_neon_rsb(int size, TCGv_i32 t0, TCGv_i32 t1)
4001 {
4002     switch (size) {
4003     case 0: gen_helper_neon_sub_u8(t0, t1, t0); break;
4004     case 1: gen_helper_neon_sub_u16(t0, t1, t0); break;
4005     case 2: tcg_gen_sub_i32(t0, t1, t0); break;
4006     default: return;
4007     }
4008 }
4009
4010 /* 32-bit pairwise ops end up the same as the elementwise versions.  */
4011 #define gen_helper_neon_pmax_s32  gen_helper_neon_max_s32
4012 #define gen_helper_neon_pmax_u32  gen_helper_neon_max_u32
4013 #define gen_helper_neon_pmin_s32  gen_helper_neon_min_s32
4014 #define gen_helper_neon_pmin_u32  gen_helper_neon_min_u32
4015
4016 #define GEN_NEON_INTEGER_OP_ENV(name) do { \
4017     switch ((size << 1) | u) { \
4018     case 0: \
4019         gen_helper_neon_##name##_s8(tmp, cpu_env, tmp, tmp2); \
4020         break; \
4021     case 1: \
4022         gen_helper_neon_##name##_u8(tmp, cpu_env, tmp, tmp2); \
4023         break; \
4024     case 2: \
4025         gen_helper_neon_##name##_s16(tmp, cpu_env, tmp, tmp2); \
4026         break; \
4027     case 3: \
4028         gen_helper_neon_##name##_u16(tmp, cpu_env, tmp, tmp2); \
4029         break; \
4030     case 4: \
4031         gen_helper_neon_##name##_s32(tmp, cpu_env, tmp, tmp2); \
4032         break; \
4033     case 5: \
4034         gen_helper_neon_##name##_u32(tmp, cpu_env, tmp, tmp2); \
4035         break; \
4036     default: return 1; \
4037     }} while (0)
4038
4039 #define GEN_NEON_INTEGER_OP(name) do { \
4040     switch ((size << 1) | u) { \
4041     case 0: \
4042         gen_helper_neon_##name##_s8(tmp, tmp, tmp2); \
4043         break; \
4044     case 1: \
4045         gen_helper_neon_##name##_u8(tmp, tmp, tmp2); \
4046         break; \
4047     case 2: \
4048         gen_helper_neon_##name##_s16(tmp, tmp, tmp2); \
4049         break; \
4050     case 3: \
4051         gen_helper_neon_##name##_u16(tmp, tmp, tmp2); \
4052         break; \
4053     case 4: \
4054         gen_helper_neon_##name##_s32(tmp, tmp, tmp2); \
4055         break; \
4056     case 5: \
4057         gen_helper_neon_##name##_u32(tmp, tmp, tmp2); \
4058         break; \
4059     default: return 1; \
4060     }} while (0)
4061
4062 static TCGv_i32 neon_load_scratch(int scratch)
4063 {
4064     TCGv_i32 tmp = tcg_temp_new_i32();
4065     tcg_gen_ld_i32(tmp, cpu_env, offsetof(CPUARMState, vfp.scratch[scratch]));
4066     return tmp;
4067 }
4068
4069 static void neon_store_scratch(int scratch, TCGv_i32 var)
4070 {
4071     tcg_gen_st_i32(var, cpu_env, offsetof(CPUARMState, vfp.scratch[scratch]));
4072     tcg_temp_free_i32(var);
4073 }
4074
4075 static inline TCGv_i32 neon_get_scalar(int size, int reg)
4076 {
4077     TCGv_i32 tmp;
4078     if (size == 1) {
4079         tmp = neon_load_reg(reg & 7, reg >> 4);
4080         if (reg & 8) {
4081             gen_neon_dup_high16(tmp);
4082         } else {
4083             gen_neon_dup_low16(tmp);
4084         }
4085     } else {
4086         tmp = neon_load_reg(reg & 15, reg >> 4);
4087     }
4088     return tmp;
4089 }
4090
4091 static int gen_neon_unzip(int rd, int rm, int size, int q)
4092 {
4093     TCGv_i32 tmp, tmp2;
4094     if (!q && size == 2) {
4095         return 1;
4096     }
4097     tmp = tcg_const_i32(rd);
4098     tmp2 = tcg_const_i32(rm);
4099     if (q) {
4100         switch (size) {
4101         case 0:
4102             gen_helper_neon_qunzip8(cpu_env, tmp, tmp2);
4103             break;
4104         case 1:
4105             gen_helper_neon_qunzip16(cpu_env, tmp, tmp2);
4106             break;
4107         case 2:
4108             gen_helper_neon_qunzip32(cpu_env, tmp, tmp2);
4109             break;
4110         default:
4111             abort();
4112         }
4113     } else {
4114         switch (size) {
4115         case 0:
4116             gen_helper_neon_unzip8(cpu_env, tmp, tmp2);
4117             break;
4118         case 1:
4119             gen_helper_neon_unzip16(cpu_env, tmp, tmp2);
4120             break;
4121         default:
4122             abort();
4123         }
4124     }
4125     tcg_temp_free_i32(tmp);
4126     tcg_temp_free_i32(tmp2);
4127     return 0;
4128 }
4129
4130 static int gen_neon_zip(int rd, int rm, int size, int q)
4131 {
4132     TCGv_i32 tmp, tmp2;
4133     if (!q && size == 2) {
4134         return 1;
4135     }
4136     tmp = tcg_const_i32(rd);
4137     tmp2 = tcg_const_i32(rm);
4138     if (q) {
4139         switch (size) {
4140         case 0:
4141             gen_helper_neon_qzip8(cpu_env, tmp, tmp2);
4142             break;
4143         case 1:
4144             gen_helper_neon_qzip16(cpu_env, tmp, tmp2);
4145             break;
4146         case 2:
4147             gen_helper_neon_qzip32(cpu_env, tmp, tmp2);
4148             break;
4149         default:
4150             abort();
4151         }
4152     } else {
4153         switch (size) {
4154         case 0:
4155             gen_helper_neon_zip8(cpu_env, tmp, tmp2);
4156             break;
4157         case 1:
4158             gen_helper_neon_zip16(cpu_env, tmp, tmp2);
4159             break;
4160         default:
4161             abort();
4162         }
4163     }
4164     tcg_temp_free_i32(tmp);
4165     tcg_temp_free_i32(tmp2);
4166     return 0;
4167 }
4168
4169 static void gen_neon_trn_u8(TCGv_i32 t0, TCGv_i32 t1)
4170 {
4171     TCGv_i32 rd, tmp;
4172
4173     rd = tcg_temp_new_i32();
4174     tmp = tcg_temp_new_i32();
4175
4176     tcg_gen_shli_i32(rd, t0, 8);
4177     tcg_gen_andi_i32(rd, rd, 0xff00ff00);
4178     tcg_gen_andi_i32(tmp, t1, 0x00ff00ff);
4179     tcg_gen_or_i32(rd, rd, tmp);
4180
4181     tcg_gen_shri_i32(t1, t1, 8);
4182     tcg_gen_andi_i32(t1, t1, 0x00ff00ff);
4183     tcg_gen_andi_i32(tmp, t0, 0xff00ff00);
4184     tcg_gen_or_i32(t1, t1, tmp);
4185     tcg_gen_mov_i32(t0, rd);
4186
4187     tcg_temp_free_i32(tmp);
4188     tcg_temp_free_i32(rd);
4189 }
4190
4191 static void gen_neon_trn_u16(TCGv_i32 t0, TCGv_i32 t1)
4192 {
4193     TCGv_i32 rd, tmp;
4194
4195     rd = tcg_temp_new_i32();
4196     tmp = tcg_temp_new_i32();
4197
4198     tcg_gen_shli_i32(rd, t0, 16);
4199     tcg_gen_andi_i32(tmp, t1, 0xffff);
4200     tcg_gen_or_i32(rd, rd, tmp);
4201     tcg_gen_shri_i32(t1, t1, 16);
4202     tcg_gen_andi_i32(tmp, t0, 0xffff0000);
4203     tcg_gen_or_i32(t1, t1, tmp);
4204     tcg_gen_mov_i32(t0, rd);
4205
4206     tcg_temp_free_i32(tmp);
4207     tcg_temp_free_i32(rd);
4208 }
4209
4210
4211 static struct {
4212     int nregs;
4213     int interleave;
4214     int spacing;
4215 } neon_ls_element_type[11] = {
4216     {4, 4, 1},
4217     {4, 4, 2},
4218     {4, 1, 1},
4219     {4, 2, 1},
4220     {3, 3, 1},
4221     {3, 3, 2},
4222     {3, 1, 1},
4223     {1, 1, 1},
4224     {2, 2, 1},
4225     {2, 2, 2},
4226     {2, 1, 1}
4227 };
4228
4229 /* Translate a NEON load/store element instruction.  Return nonzero if the
4230    instruction is invalid.  */
4231 static int disas_neon_ls_insn(CPUARMState * env, DisasContext *s, uint32_t insn)
4232 {
4233     int rd, rn, rm;
4234     int op;
4235     int nregs;
4236     int interleave;
4237     int spacing;
4238     int stride;
4239     int size;
4240     int reg;
4241     int pass;
4242     int load;
4243     int shift;
4244     int n;
4245     TCGv_i32 addr;
4246     TCGv_i32 tmp;
4247     TCGv_i32 tmp2;
4248     TCGv_i64 tmp64;
4249
4250     /* FIXME: this access check should not take precedence over UNDEF
4251      * for invalid encodings; we will generate incorrect syndrome information
4252      * for attempts to execute invalid vfp/neon encodings with FP disabled.
4253      */
4254     if (!s->cpacr_fpen) {
4255         gen_exception_insn(s, 4, EXCP_UDEF,
4256                            syn_fp_access_trap(1, 0xe, s->thumb));
4257         return 0;
4258     }
4259
4260     if (!s->vfp_enabled)
4261       return 1;
4262     VFP_DREG_D(rd, insn);
4263     rn = (insn >> 16) & 0xf;
4264     rm = insn & 0xf;
4265     load = (insn & (1 << 21)) != 0;
4266     if ((insn & (1 << 23)) == 0) {
4267         /* Load store all elements.  */
4268         op = (insn >> 8) & 0xf;
4269         size = (insn >> 6) & 3;
4270         if (op > 10)
4271             return 1;
4272         /* Catch UNDEF cases for bad values of align field */
4273         switch (op & 0xc) {
4274         case 4:
4275             if (((insn >> 5) & 1) == 1) {
4276                 return 1;
4277             }
4278             break;
4279         case 8:
4280             if (((insn >> 4) & 3) == 3) {
4281                 return 1;
4282             }
4283             break;
4284         default:
4285             break;
4286         }
4287         nregs = neon_ls_element_type[op].nregs;
4288         interleave = neon_ls_element_type[op].interleave;
4289         spacing = neon_ls_element_type[op].spacing;
4290         if (size == 3 && (interleave | spacing) != 1)
4291             return 1;
4292         addr = tcg_temp_new_i32();
4293         load_reg_var(s, addr, rn);
4294         stride = (1 << size) * interleave;
4295         for (reg = 0; reg < nregs; reg++) {
4296             if (interleave > 2 || (interleave == 2 && nregs == 2)) {
4297                 load_reg_var(s, addr, rn);
4298                 tcg_gen_addi_i32(addr, addr, (1 << size) * reg);
4299             } else if (interleave == 2 && nregs == 4 && reg == 2) {
4300                 load_reg_var(s, addr, rn);
4301                 tcg_gen_addi_i32(addr, addr, 1 << size);
4302             }
4303             if (size == 3) {
4304                 tmp64 = tcg_temp_new_i64();
4305                 if (load) {
4306                     gen_aa32_ld64(tmp64, addr, get_mem_index(s));
4307                     neon_store_reg64(tmp64, rd);
4308                 } else {
4309                     neon_load_reg64(tmp64, rd);
4310                     gen_aa32_st64(tmp64, addr, get_mem_index(s));
4311                 }
4312                 tcg_temp_free_i64(tmp64);
4313                 tcg_gen_addi_i32(addr, addr, stride);
4314             } else {
4315                 for (pass = 0; pass < 2; pass++) {
4316                     if (size == 2) {
4317                         if (load) {
4318                             tmp = tcg_temp_new_i32();
4319                             gen_aa32_ld32u(tmp, addr, get_mem_index(s));
4320                             neon_store_reg(rd, pass, tmp);
4321                         } else {
4322                             tmp = neon_load_reg(rd, pass);
4323                             gen_aa32_st32(tmp, addr, get_mem_index(s));
4324                             tcg_temp_free_i32(tmp);
4325                         }
4326                         tcg_gen_addi_i32(addr, addr, stride);
4327                     } else if (size == 1) {
4328                         if (load) {
4329                             tmp = tcg_temp_new_i32();
4330                             gen_aa32_ld16u(tmp, addr, get_mem_index(s));
4331                             tcg_gen_addi_i32(addr, addr, stride);
4332                             tmp2 = tcg_temp_new_i32();
4333                             gen_aa32_ld16u(tmp2, addr, get_mem_index(s));
4334                             tcg_gen_addi_i32(addr, addr, stride);
4335                             tcg_gen_shli_i32(tmp2, tmp2, 16);
4336                             tcg_gen_or_i32(tmp, tmp, tmp2);
4337                             tcg_temp_free_i32(tmp2);
4338                             neon_store_reg(rd, pass, tmp);
4339                         } else {
4340                             tmp = neon_load_reg(rd, pass);
4341                             tmp2 = tcg_temp_new_i32();
4342                             tcg_gen_shri_i32(tmp2, tmp, 16);
4343                             gen_aa32_st16(tmp, addr, get_mem_index(s));
4344                             tcg_temp_free_i32(tmp);
4345                             tcg_gen_addi_i32(addr, addr, stride);
4346                             gen_aa32_st16(tmp2, addr, get_mem_index(s));
4347                             tcg_temp_free_i32(tmp2);
4348                             tcg_gen_addi_i32(addr, addr, stride);
4349                         }
4350                     } else /* size == 0 */ {
4351                         if (load) {
4352                             TCGV_UNUSED_I32(tmp2);
4353                             for (n = 0; n < 4; n++) {
4354                                 tmp = tcg_temp_new_i32();
4355                                 gen_aa32_ld8u(tmp, addr, get_mem_index(s));
4356                                 tcg_gen_addi_i32(addr, addr, stride);
4357                                 if (n == 0) {
4358                                     tmp2 = tmp;
4359                                 } else {
4360                                     tcg_gen_shli_i32(tmp, tmp, n * 8);
4361                                     tcg_gen_or_i32(tmp2, tmp2, tmp);
4362                                     tcg_temp_free_i32(tmp);
4363                                 }
4364                             }
4365                             neon_store_reg(rd, pass, tmp2);
4366                         } else {
4367                             tmp2 = neon_load_reg(rd, pass);
4368                             for (n = 0; n < 4; n++) {
4369                                 tmp = tcg_temp_new_i32();
4370                                 if (n == 0) {
4371                                     tcg_gen_mov_i32(tmp, tmp2);
4372                                 } else {
4373                                     tcg_gen_shri_i32(tmp, tmp2, n * 8);
4374                                 }
4375                                 gen_aa32_st8(tmp, addr, get_mem_index(s));
4376                                 tcg_temp_free_i32(tmp);
4377                                 tcg_gen_addi_i32(addr, addr, stride);
4378                             }
4379                             tcg_temp_free_i32(tmp2);
4380                         }
4381                     }
4382                 }
4383             }
4384             rd += spacing;
4385         }
4386         tcg_temp_free_i32(addr);
4387         stride = nregs * 8;
4388     } else {
4389         size = (insn >> 10) & 3;
4390         if (size == 3) {
4391             /* Load single element to all lanes.  */
4392             int a = (insn >> 4) & 1;
4393             if (!load) {
4394                 return 1;
4395             }
4396             size = (insn >> 6) & 3;
4397             nregs = ((insn >> 8) & 3) + 1;
4398
4399             if (size == 3) {
4400                 if (nregs != 4 || a == 0) {
4401                     return 1;
4402                 }
4403                 /* For VLD4 size==3 a == 1 means 32 bits at 16 byte alignment */
4404                 size = 2;
4405             }
4406             if (nregs == 1 && a == 1 && size == 0) {
4407                 return 1;
4408             }
4409             if (nregs == 3 && a == 1) {
4410                 return 1;
4411             }
4412             addr = tcg_temp_new_i32();
4413             load_reg_var(s, addr, rn);
4414             if (nregs == 1) {
4415                 /* VLD1 to all lanes: bit 5 indicates how many Dregs to write */
4416                 tmp = gen_load_and_replicate(s, addr, size);
4417                 tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd, 0));
4418                 tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd, 1));
4419                 if (insn & (1 << 5)) {
4420                     tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd + 1, 0));
4421                     tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd + 1, 1));
4422                 }
4423                 tcg_temp_free_i32(tmp);
4424             } else {
4425                 /* VLD2/3/4 to all lanes: bit 5 indicates register stride */
4426                 stride = (insn & (1 << 5)) ? 2 : 1;
4427                 for (reg = 0; reg < nregs; reg++) {
4428                     tmp = gen_load_and_replicate(s, addr, size);
4429                     tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd, 0));
4430                     tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd, 1));
4431                     tcg_temp_free_i32(tmp);
4432                     tcg_gen_addi_i32(addr, addr, 1 << size);
4433                     rd += stride;
4434                 }
4435             }
4436             tcg_temp_free_i32(addr);
4437             stride = (1 << size) * nregs;
4438         } else {
4439             /* Single element.  */
4440             int idx = (insn >> 4) & 0xf;
4441             pass = (insn >> 7) & 1;
4442             switch (size) {
4443             case 0:
4444                 shift = ((insn >> 5) & 3) * 8;
4445                 stride = 1;
4446                 break;
4447             case 1:
4448                 shift = ((insn >> 6) & 1) * 16;
4449                 stride = (insn & (1 << 5)) ? 2 : 1;
4450                 break;
4451             case 2:
4452                 shift = 0;
4453                 stride = (insn & (1 << 6)) ? 2 : 1;
4454                 break;
4455             default:
4456                 abort();
4457             }
4458             nregs = ((insn >> 8) & 3) + 1;
4459             /* Catch the UNDEF cases. This is unavoidably a bit messy. */
4460             switch (nregs) {
4461             case 1:
4462                 if (((idx & (1 << size)) != 0) ||
4463                     (size == 2 && ((idx & 3) == 1 || (idx & 3) == 2))) {
4464                     return 1;
4465                 }
4466                 break;
4467             case 3:
4468                 if ((idx & 1) != 0) {
4469                     return 1;
4470                 }
4471                 /* fall through */
4472             case 2:
4473                 if (size == 2 && (idx & 2) != 0) {
4474                     return 1;
4475                 }
4476                 break;
4477             case 4:
4478                 if ((size == 2) && ((idx & 3) == 3)) {
4479                     return 1;
4480                 }
4481                 break;
4482             default:
4483                 abort();
4484             }
4485             if ((rd + stride * (nregs - 1)) > 31) {
4486                 /* Attempts to write off the end of the register file
4487                  * are UNPREDICTABLE; we choose to UNDEF because otherwise
4488                  * the neon_load_reg() would write off the end of the array.
4489                  */
4490                 return 1;
4491             }
4492             addr = tcg_temp_new_i32();
4493             load_reg_var(s, addr, rn);
4494             for (reg = 0; reg < nregs; reg++) {
4495                 if (load) {
4496                     tmp = tcg_temp_new_i32();
4497                     switch (size) {
4498                     case 0:
4499                         gen_aa32_ld8u(tmp, addr, get_mem_index(s));
4500                         break;
4501                     case 1:
4502                         gen_aa32_ld16u(tmp, addr, get_mem_index(s));
4503                         break;
4504                     case 2:
4505                         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
4506                         break;
4507                     default: /* Avoid compiler warnings.  */
4508                         abort();
4509                     }
4510                     if (size != 2) {
4511                         tmp2 = neon_load_reg(rd, pass);
4512                         tcg_gen_deposit_i32(tmp, tmp2, tmp,
4513                                             shift, size ? 16 : 8);
4514                         tcg_temp_free_i32(tmp2);
4515                     }
4516                     neon_store_reg(rd, pass, tmp);
4517                 } else { /* Store */
4518                     tmp = neon_load_reg(rd, pass);
4519                     if (shift)
4520                         tcg_gen_shri_i32(tmp, tmp, shift);
4521                     switch (size) {
4522                     case 0:
4523                         gen_aa32_st8(tmp, addr, get_mem_index(s));
4524                         break;
4525                     case 1:
4526                         gen_aa32_st16(tmp, addr, get_mem_index(s));
4527                         break;
4528                     case 2:
4529                         gen_aa32_st32(tmp, addr, get_mem_index(s));
4530                         break;
4531                     }
4532                     tcg_temp_free_i32(tmp);
4533                 }
4534                 rd += stride;
4535                 tcg_gen_addi_i32(addr, addr, 1 << size);
4536             }
4537             tcg_temp_free_i32(addr);
4538             stride = nregs * (1 << size);
4539         }
4540     }
4541     if (rm != 15) {
4542         TCGv_i32 base;
4543
4544         base = load_reg(s, rn);
4545         if (rm == 13) {
4546             tcg_gen_addi_i32(base, base, stride);
4547         } else {
4548             TCGv_i32 index;
4549             index = load_reg(s, rm);
4550             tcg_gen_add_i32(base, base, index);
4551             tcg_temp_free_i32(index);
4552         }
4553         store_reg(s, rn, base);
4554     }
4555     return 0;
4556 }
4557
4558 /* Bitwise select.  dest = c ? t : f.  Clobbers T and F.  */
4559 static void gen_neon_bsl(TCGv_i32 dest, TCGv_i32 t, TCGv_i32 f, TCGv_i32 c)
4560 {
4561     tcg_gen_and_i32(t, t, c);
4562     tcg_gen_andc_i32(f, f, c);
4563     tcg_gen_or_i32(dest, t, f);
4564 }
4565
4566 static inline void gen_neon_narrow(int size, TCGv_i32 dest, TCGv_i64 src)
4567 {
4568     switch (size) {
4569     case 0: gen_helper_neon_narrow_u8(dest, src); break;
4570     case 1: gen_helper_neon_narrow_u16(dest, src); break;
4571     case 2: tcg_gen_trunc_i64_i32(dest, src); break;
4572     default: abort();
4573     }
4574 }
4575
4576 static inline void gen_neon_narrow_sats(int size, TCGv_i32 dest, TCGv_i64 src)
4577 {
4578     switch (size) {
4579     case 0: gen_helper_neon_narrow_sat_s8(dest, cpu_env, src); break;
4580     case 1: gen_helper_neon_narrow_sat_s16(dest, cpu_env, src); break;
4581     case 2: gen_helper_neon_narrow_sat_s32(dest, cpu_env, src); break;
4582     default: abort();
4583     }
4584 }
4585
4586 static inline void gen_neon_narrow_satu(int size, TCGv_i32 dest, TCGv_i64 src)
4587 {
4588     switch (size) {
4589     case 0: gen_helper_neon_narrow_sat_u8(dest, cpu_env, src); break;
4590     case 1: gen_helper_neon_narrow_sat_u16(dest, cpu_env, src); break;
4591     case 2: gen_helper_neon_narrow_sat_u32(dest, cpu_env, src); break;
4592     default: abort();
4593     }
4594 }
4595
4596 static inline void gen_neon_unarrow_sats(int size, TCGv_i32 dest, TCGv_i64 src)
4597 {
4598     switch (size) {
4599     case 0: gen_helper_neon_unarrow_sat8(dest, cpu_env, src); break;
4600     case 1: gen_helper_neon_unarrow_sat16(dest, cpu_env, src); break;
4601     case 2: gen_helper_neon_unarrow_sat32(dest, cpu_env, src); break;
4602     default: abort();
4603     }
4604 }
4605
4606 static inline void gen_neon_shift_narrow(int size, TCGv_i32 var, TCGv_i32 shift,
4607                                          int q, int u)
4608 {
4609     if (q) {
4610         if (u) {
4611             switch (size) {
4612             case 1: gen_helper_neon_rshl_u16(var, var, shift); break;
4613             case 2: gen_helper_neon_rshl_u32(var, var, shift); break;
4614             default: abort();
4615             }
4616         } else {
4617             switch (size) {
4618             case 1: gen_helper_neon_rshl_s16(var, var, shift); break;
4619             case 2: gen_helper_neon_rshl_s32(var, var, shift); break;
4620             default: abort();
4621             }
4622         }
4623     } else {
4624         if (u) {
4625             switch (size) {
4626             case 1: gen_helper_neon_shl_u16(var, var, shift); break;
4627             case 2: gen_helper_neon_shl_u32(var, var, shift); break;
4628             default: abort();
4629             }
4630         } else {
4631             switch (size) {
4632             case 1: gen_helper_neon_shl_s16(var, var, shift); break;
4633             case 2: gen_helper_neon_shl_s32(var, var, shift); break;
4634             default: abort();
4635             }
4636         }
4637     }
4638 }
4639
4640 static inline void gen_neon_widen(TCGv_i64 dest, TCGv_i32 src, int size, int u)
4641 {
4642     if (u) {
4643         switch (size) {
4644         case 0: gen_helper_neon_widen_u8(dest, src); break;
4645         case 1: gen_helper_neon_widen_u16(dest, src); break;
4646         case 2: tcg_gen_extu_i32_i64(dest, src); break;
4647         default: abort();
4648         }
4649     } else {
4650         switch (size) {
4651         case 0: gen_helper_neon_widen_s8(dest, src); break;
4652         case 1: gen_helper_neon_widen_s16(dest, src); break;
4653         case 2: tcg_gen_ext_i32_i64(dest, src); break;
4654         default: abort();
4655         }
4656     }
4657     tcg_temp_free_i32(src);
4658 }
4659
4660 static inline void gen_neon_addl(int size)
4661 {
4662     switch (size) {
4663     case 0: gen_helper_neon_addl_u16(CPU_V001); break;
4664     case 1: gen_helper_neon_addl_u32(CPU_V001); break;
4665     case 2: tcg_gen_add_i64(CPU_V001); break;
4666     default: abort();
4667     }
4668 }
4669
4670 static inline void gen_neon_subl(int size)
4671 {
4672     switch (size) {
4673     case 0: gen_helper_neon_subl_u16(CPU_V001); break;
4674     case 1: gen_helper_neon_subl_u32(CPU_V001); break;
4675     case 2: tcg_gen_sub_i64(CPU_V001); break;
4676     default: abort();
4677     }
4678 }
4679
4680 static inline void gen_neon_negl(TCGv_i64 var, int size)
4681 {
4682     switch (size) {
4683     case 0: gen_helper_neon_negl_u16(var, var); break;
4684     case 1: gen_helper_neon_negl_u32(var, var); break;
4685     case 2:
4686         tcg_gen_neg_i64(var, var);
4687         break;
4688     default: abort();
4689     }
4690 }
4691
4692 static inline void gen_neon_addl_saturate(TCGv_i64 op0, TCGv_i64 op1, int size)
4693 {
4694     switch (size) {
4695     case 1: gen_helper_neon_addl_saturate_s32(op0, cpu_env, op0, op1); break;
4696     case 2: gen_helper_neon_addl_saturate_s64(op0, cpu_env, op0, op1); break;
4697     default: abort();
4698     }
4699 }
4700
4701 static inline void gen_neon_mull(TCGv_i64 dest, TCGv_i32 a, TCGv_i32 b,
4702                                  int size, int u)
4703 {
4704     TCGv_i64 tmp;
4705
4706     switch ((size << 1) | u) {
4707     case 0: gen_helper_neon_mull_s8(dest, a, b); break;
4708     case 1: gen_helper_neon_mull_u8(dest, a, b); break;
4709     case 2: gen_helper_neon_mull_s16(dest, a, b); break;
4710     case 3: gen_helper_neon_mull_u16(dest, a, b); break;
4711     case 4:
4712         tmp = gen_muls_i64_i32(a, b);
4713         tcg_gen_mov_i64(dest, tmp);
4714         tcg_temp_free_i64(tmp);
4715         break;
4716     case 5:
4717         tmp = gen_mulu_i64_i32(a, b);
4718         tcg_gen_mov_i64(dest, tmp);
4719         tcg_temp_free_i64(tmp);
4720         break;
4721     default: abort();
4722     }
4723
4724     /* gen_helper_neon_mull_[su]{8|16} do not free their parameters.
4725        Don't forget to clean them now.  */
4726     if (size < 2) {
4727         tcg_temp_free_i32(a);
4728         tcg_temp_free_i32(b);
4729     }
4730 }
4731
4732 static void gen_neon_narrow_op(int op, int u, int size,
4733                                TCGv_i32 dest, TCGv_i64 src)
4734 {
4735     if (op) {
4736         if (u) {
4737             gen_neon_unarrow_sats(size, dest, src);
4738         } else {
4739             gen_neon_narrow(size, dest, src);
4740         }
4741     } else {
4742         if (u) {
4743             gen_neon_narrow_satu(size, dest, src);
4744         } else {
4745             gen_neon_narrow_sats(size, dest, src);
4746         }
4747     }
4748 }
4749
4750 /* Symbolic constants for op fields for Neon 3-register same-length.
4751  * The values correspond to bits [11:8,4]; see the ARM ARM DDI0406B
4752  * table A7-9.
4753  */
4754 #define NEON_3R_VHADD 0
4755 #define NEON_3R_VQADD 1
4756 #define NEON_3R_VRHADD 2
4757 #define NEON_3R_LOGIC 3 /* VAND,VBIC,VORR,VMOV,VORN,VEOR,VBIF,VBIT,VBSL */
4758 #define NEON_3R_VHSUB 4
4759 #define NEON_3R_VQSUB 5
4760 #define NEON_3R_VCGT 6
4761 #define NEON_3R_VCGE 7
4762 #define NEON_3R_VSHL 8
4763 #define NEON_3R_VQSHL 9
4764 #define NEON_3R_VRSHL 10
4765 #define NEON_3R_VQRSHL 11
4766 #define NEON_3R_VMAX 12
4767 #define NEON_3R_VMIN 13
4768 #define NEON_3R_VABD 14
4769 #define NEON_3R_VABA 15
4770 #define NEON_3R_VADD_VSUB 16
4771 #define NEON_3R_VTST_VCEQ 17
4772 #define NEON_3R_VML 18 /* VMLA, VMLAL, VMLS, VMLSL */
4773 #define NEON_3R_VMUL 19
4774 #define NEON_3R_VPMAX 20
4775 #define NEON_3R_VPMIN 21
4776 #define NEON_3R_VQDMULH_VQRDMULH 22
4777 #define NEON_3R_VPADD 23
4778 #define NEON_3R_VFM 25 /* VFMA, VFMS : float fused multiply-add */
4779 #define NEON_3R_FLOAT_ARITH 26 /* float VADD, VSUB, VPADD, VABD */
4780 #define NEON_3R_FLOAT_MULTIPLY 27 /* float VMLA, VMLS, VMUL */
4781 #define NEON_3R_FLOAT_CMP 28 /* float VCEQ, VCGE, VCGT */
4782 #define NEON_3R_FLOAT_ACMP 29 /* float VACGE, VACGT, VACLE, VACLT */
4783 #define NEON_3R_FLOAT_MINMAX 30 /* float VMIN, VMAX */
4784 #define NEON_3R_FLOAT_MISC 31 /* float VRECPS, VRSQRTS, VMAXNM/MINNM */
4785
4786 static const uint8_t neon_3r_sizes[] = {
4787     [NEON_3R_VHADD] = 0x7,
4788     [NEON_3R_VQADD] = 0xf,
4789     [NEON_3R_VRHADD] = 0x7,
4790     [NEON_3R_LOGIC] = 0xf, /* size field encodes op type */
4791     [NEON_3R_VHSUB] = 0x7,
4792     [NEON_3R_VQSUB] = 0xf,
4793     [NEON_3R_VCGT] = 0x7,
4794     [NEON_3R_VCGE] = 0x7,
4795     [NEON_3R_VSHL] = 0xf,
4796     [NEON_3R_VQSHL] = 0xf,
4797     [NEON_3R_VRSHL] = 0xf,
4798     [NEON_3R_VQRSHL] = 0xf,
4799     [NEON_3R_VMAX] = 0x7,
4800     [NEON_3R_VMIN] = 0x7,
4801     [NEON_3R_VABD] = 0x7,
4802     [NEON_3R_VABA] = 0x7,
4803     [NEON_3R_VADD_VSUB] = 0xf,
4804     [NEON_3R_VTST_VCEQ] = 0x7,
4805     [NEON_3R_VML] = 0x7,
4806     [NEON_3R_VMUL] = 0x7,
4807     [NEON_3R_VPMAX] = 0x7,
4808     [NEON_3R_VPMIN] = 0x7,
4809     [NEON_3R_VQDMULH_VQRDMULH] = 0x6,
4810     [NEON_3R_VPADD] = 0x7,
4811     [NEON_3R_VFM] = 0x5, /* size bit 1 encodes op */
4812     [NEON_3R_FLOAT_ARITH] = 0x5, /* size bit 1 encodes op */
4813     [NEON_3R_FLOAT_MULTIPLY] = 0x5, /* size bit 1 encodes op */
4814     [NEON_3R_FLOAT_CMP] = 0x5, /* size bit 1 encodes op */
4815     [NEON_3R_FLOAT_ACMP] = 0x5, /* size bit 1 encodes op */
4816     [NEON_3R_FLOAT_MINMAX] = 0x5, /* size bit 1 encodes op */
4817     [NEON_3R_FLOAT_MISC] = 0x5, /* size bit 1 encodes op */
4818 };
4819
4820 /* Symbolic constants for op fields for Neon 2-register miscellaneous.
4821  * The values correspond to bits [17:16,10:7]; see the ARM ARM DDI0406B
4822  * table A7-13.
4823  */
4824 #define NEON_2RM_VREV64 0
4825 #define NEON_2RM_VREV32 1
4826 #define NEON_2RM_VREV16 2
4827 #define NEON_2RM_VPADDL 4
4828 #define NEON_2RM_VPADDL_U 5
4829 #define NEON_2RM_AESE 6 /* Includes AESD */
4830 #define NEON_2RM_AESMC 7 /* Includes AESIMC */
4831 #define NEON_2RM_VCLS 8
4832 #define NEON_2RM_VCLZ 9
4833 #define NEON_2RM_VCNT 10
4834 #define NEON_2RM_VMVN 11
4835 #define NEON_2RM_VPADAL 12
4836 #define NEON_2RM_VPADAL_U 13
4837 #define NEON_2RM_VQABS 14
4838 #define NEON_2RM_VQNEG 15
4839 #define NEON_2RM_VCGT0 16
4840 #define NEON_2RM_VCGE0 17
4841 #define NEON_2RM_VCEQ0 18
4842 #define NEON_2RM_VCLE0 19
4843 #define NEON_2RM_VCLT0 20
4844 #define NEON_2RM_VABS 22
4845 #define NEON_2RM_VNEG 23
4846 #define NEON_2RM_VCGT0_F 24
4847 #define NEON_2RM_VCGE0_F 25
4848 #define NEON_2RM_VCEQ0_F 26
4849 #define NEON_2RM_VCLE0_F 27
4850 #define NEON_2RM_VCLT0_F 28
4851 #define NEON_2RM_VABS_F 30
4852 #define NEON_2RM_VNEG_F 31
4853 #define NEON_2RM_VSWP 32
4854 #define NEON_2RM_VTRN 33
4855 #define NEON_2RM_VUZP 34
4856 #define NEON_2RM_VZIP 35
4857 #define NEON_2RM_VMOVN 36 /* Includes VQMOVN, VQMOVUN */
4858 #define NEON_2RM_VQMOVN 37 /* Includes VQMOVUN */
4859 #define NEON_2RM_VSHLL 38
4860 #define NEON_2RM_VRINTN 40
4861 #define NEON_2RM_VRINTX 41
4862 #define NEON_2RM_VRINTA 42
4863 #define NEON_2RM_VRINTZ 43
4864 #define NEON_2RM_VCVT_F16_F32 44
4865 #define NEON_2RM_VRINTM 45
4866 #define NEON_2RM_VCVT_F32_F16 46
4867 #define NEON_2RM_VRINTP 47
4868 #define NEON_2RM_VCVTAU 48
4869 #define NEON_2RM_VCVTAS 49
4870 #define NEON_2RM_VCVTNU 50
4871 #define NEON_2RM_VCVTNS 51
4872 #define NEON_2RM_VCVTPU 52
4873 #define NEON_2RM_VCVTPS 53
4874 #define NEON_2RM_VCVTMU 54
4875 #define NEON_2RM_VCVTMS 55
4876 #define NEON_2RM_VRECPE 56
4877 #define NEON_2RM_VRSQRTE 57
4878 #define NEON_2RM_VRECPE_F 58
4879 #define NEON_2RM_VRSQRTE_F 59
4880 #define NEON_2RM_VCVT_FS 60
4881 #define NEON_2RM_VCVT_FU 61
4882 #define NEON_2RM_VCVT_SF 62
4883 #define NEON_2RM_VCVT_UF 63
4884
4885 static int neon_2rm_is_float_op(int op)
4886 {
4887     /* Return true if this neon 2reg-misc op is float-to-float */
4888     return (op == NEON_2RM_VABS_F || op == NEON_2RM_VNEG_F ||
4889             (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
4890             op == NEON_2RM_VRINTM ||
4891             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
4892             op >= NEON_2RM_VRECPE_F);
4893 }
4894
4895 /* Each entry in this array has bit n set if the insn allows
4896  * size value n (otherwise it will UNDEF). Since unallocated
4897  * op values will have no bits set they always UNDEF.
4898  */
4899 static const uint8_t neon_2rm_sizes[] = {
4900     [NEON_2RM_VREV64] = 0x7,
4901     [NEON_2RM_VREV32] = 0x3,
4902     [NEON_2RM_VREV16] = 0x1,
4903     [NEON_2RM_VPADDL] = 0x7,
4904     [NEON_2RM_VPADDL_U] = 0x7,
4905     [NEON_2RM_AESE] = 0x1,
4906     [NEON_2RM_AESMC] = 0x1,
4907     [NEON_2RM_VCLS] = 0x7,
4908     [NEON_2RM_VCLZ] = 0x7,
4909     [NEON_2RM_VCNT] = 0x1,
4910     [NEON_2RM_VMVN] = 0x1,
4911     [NEON_2RM_VPADAL] = 0x7,
4912     [NEON_2RM_VPADAL_U] = 0x7,
4913     [NEON_2RM_VQABS] = 0x7,
4914     [NEON_2RM_VQNEG] = 0x7,
4915     [NEON_2RM_VCGT0] = 0x7,
4916     [NEON_2RM_VCGE0] = 0x7,
4917     [NEON_2RM_VCEQ0] = 0x7,
4918     [NEON_2RM_VCLE0] = 0x7,
4919     [NEON_2RM_VCLT0] = 0x7,
4920     [NEON_2RM_VABS] = 0x7,
4921     [NEON_2RM_VNEG] = 0x7,
4922     [NEON_2RM_VCGT0_F] = 0x4,
4923     [NEON_2RM_VCGE0_F] = 0x4,
4924     [NEON_2RM_VCEQ0_F] = 0x4,
4925     [NEON_2RM_VCLE0_F] = 0x4,
4926     [NEON_2RM_VCLT0_F] = 0x4,
4927     [NEON_2RM_VABS_F] = 0x4,
4928     [NEON_2RM_VNEG_F] = 0x4,
4929     [NEON_2RM_VSWP] = 0x1,
4930     [NEON_2RM_VTRN] = 0x7,
4931     [NEON_2RM_VUZP] = 0x7,
4932     [NEON_2RM_VZIP] = 0x7,
4933     [NEON_2RM_VMOVN] = 0x7,
4934     [NEON_2RM_VQMOVN] = 0x7,
4935     [NEON_2RM_VSHLL] = 0x7,
4936     [NEON_2RM_VRINTN] = 0x4,
4937     [NEON_2RM_VRINTX] = 0x4,
4938     [NEON_2RM_VRINTA] = 0x4,
4939     [NEON_2RM_VRINTZ] = 0x4,
4940     [NEON_2RM_VCVT_F16_F32] = 0x2,
4941     [NEON_2RM_VRINTM] = 0x4,
4942     [NEON_2RM_VCVT_F32_F16] = 0x2,
4943     [NEON_2RM_VRINTP] = 0x4,
4944     [NEON_2RM_VCVTAU] = 0x4,
4945     [NEON_2RM_VCVTAS] = 0x4,
4946     [NEON_2RM_VCVTNU] = 0x4,
4947     [NEON_2RM_VCVTNS] = 0x4,
4948     [NEON_2RM_VCVTPU] = 0x4,
4949     [NEON_2RM_VCVTPS] = 0x4,
4950     [NEON_2RM_VCVTMU] = 0x4,
4951     [NEON_2RM_VCVTMS] = 0x4,
4952     [NEON_2RM_VRECPE] = 0x4,
4953     [NEON_2RM_VRSQRTE] = 0x4,
4954     [NEON_2RM_VRECPE_F] = 0x4,
4955     [NEON_2RM_VRSQRTE_F] = 0x4,
4956     [NEON_2RM_VCVT_FS] = 0x4,
4957     [NEON_2RM_VCVT_FU] = 0x4,
4958     [NEON_2RM_VCVT_SF] = 0x4,
4959     [NEON_2RM_VCVT_UF] = 0x4,
4960 };
4961
4962 /* Translate a NEON data processing instruction.  Return nonzero if the
4963    instruction is invalid.
4964    We process data in a mixture of 32-bit and 64-bit chunks.
4965    Mostly we use 32-bit chunks so we can use normal scalar instructions.  */
4966
4967 static int disas_neon_data_insn(CPUARMState * env, DisasContext *s, uint32_t insn)
4968 {
4969     int op;
4970     int q;
4971     int rd, rn, rm;
4972     int size;
4973     int shift;
4974     int pass;
4975     int count;
4976     int pairwise;
4977     int u;
4978     uint32_t imm, mask;
4979     TCGv_i32 tmp, tmp2, tmp3, tmp4, tmp5;
4980     TCGv_i64 tmp64;
4981
4982     /* FIXME: this access check should not take precedence over UNDEF
4983      * for invalid encodings; we will generate incorrect syndrome information
4984      * for attempts to execute invalid vfp/neon encodings with FP disabled.
4985      */
4986     if (!s->cpacr_fpen) {
4987         gen_exception_insn(s, 4, EXCP_UDEF,
4988                            syn_fp_access_trap(1, 0xe, s->thumb));
4989         return 0;
4990     }
4991
4992     if (!s->vfp_enabled)
4993       return 1;
4994     q = (insn & (1 << 6)) != 0;
4995     u = (insn >> 24) & 1;
4996     VFP_DREG_D(rd, insn);
4997     VFP_DREG_N(rn, insn);
4998     VFP_DREG_M(rm, insn);
4999     size = (insn >> 20) & 3;
5000     if ((insn & (1 << 23)) == 0) {
5001         /* Three register same length.  */
5002         op = ((insn >> 7) & 0x1e) | ((insn >> 4) & 1);
5003         /* Catch invalid op and bad size combinations: UNDEF */
5004         if ((neon_3r_sizes[op] & (1 << size)) == 0) {
5005             return 1;
5006         }
5007         /* All insns of this form UNDEF for either this condition or the
5008          * superset of cases "Q==1"; we catch the latter later.
5009          */
5010         if (q && ((rd | rn | rm) & 1)) {
5011             return 1;
5012         }
5013         if (size == 3 && op != NEON_3R_LOGIC) {
5014             /* 64-bit element instructions. */
5015             for (pass = 0; pass < (q ? 2 : 1); pass++) {
5016                 neon_load_reg64(cpu_V0, rn + pass);
5017                 neon_load_reg64(cpu_V1, rm + pass);
5018                 switch (op) {
5019                 case NEON_3R_VQADD:
5020                     if (u) {
5021                         gen_helper_neon_qadd_u64(cpu_V0, cpu_env,
5022                                                  cpu_V0, cpu_V1);
5023                     } else {
5024                         gen_helper_neon_qadd_s64(cpu_V0, cpu_env,
5025                                                  cpu_V0, cpu_V1);
5026                     }
5027                     break;
5028                 case NEON_3R_VQSUB:
5029                     if (u) {
5030                         gen_helper_neon_qsub_u64(cpu_V0, cpu_env,
5031                                                  cpu_V0, cpu_V1);
5032                     } else {
5033                         gen_helper_neon_qsub_s64(cpu_V0, cpu_env,
5034                                                  cpu_V0, cpu_V1);
5035                     }
5036                     break;
5037                 case NEON_3R_VSHL:
5038                     if (u) {
5039                         gen_helper_neon_shl_u64(cpu_V0, cpu_V1, cpu_V0);
5040                     } else {
5041                         gen_helper_neon_shl_s64(cpu_V0, cpu_V1, cpu_V0);
5042                     }
5043                     break;
5044                 case NEON_3R_VQSHL:
5045                     if (u) {
5046                         gen_helper_neon_qshl_u64(cpu_V0, cpu_env,
5047                                                  cpu_V1, cpu_V0);
5048                     } else {
5049                         gen_helper_neon_qshl_s64(cpu_V0, cpu_env,
5050                                                  cpu_V1, cpu_V0);
5051                     }
5052                     break;
5053                 case NEON_3R_VRSHL:
5054                     if (u) {
5055                         gen_helper_neon_rshl_u64(cpu_V0, cpu_V1, cpu_V0);
5056                     } else {
5057                         gen_helper_neon_rshl_s64(cpu_V0, cpu_V1, cpu_V0);
5058                     }
5059                     break;
5060                 case NEON_3R_VQRSHL:
5061                     if (u) {
5062                         gen_helper_neon_qrshl_u64(cpu_V0, cpu_env,
5063                                                   cpu_V1, cpu_V0);
5064                     } else {
5065                         gen_helper_neon_qrshl_s64(cpu_V0, cpu_env,
5066                                                   cpu_V1, cpu_V0);
5067                     }
5068                     break;
5069                 case NEON_3R_VADD_VSUB:
5070                     if (u) {
5071                         tcg_gen_sub_i64(CPU_V001);
5072                     } else {
5073                         tcg_gen_add_i64(CPU_V001);
5074                     }
5075                     break;
5076                 default:
5077                     abort();
5078                 }
5079                 neon_store_reg64(cpu_V0, rd + pass);
5080             }
5081             return 0;
5082         }
5083         pairwise = 0;
5084         switch (op) {
5085         case NEON_3R_VSHL:
5086         case NEON_3R_VQSHL:
5087         case NEON_3R_VRSHL:
5088         case NEON_3R_VQRSHL:
5089             {
5090                 int rtmp;
5091                 /* Shift instruction operands are reversed.  */
5092                 rtmp = rn;
5093                 rn = rm;
5094                 rm = rtmp;
5095             }
5096             break;
5097         case NEON_3R_VPADD:
5098             if (u) {
5099                 return 1;
5100             }
5101             /* Fall through */
5102         case NEON_3R_VPMAX:
5103         case NEON_3R_VPMIN:
5104             pairwise = 1;
5105             break;
5106         case NEON_3R_FLOAT_ARITH:
5107             pairwise = (u && size < 2); /* if VPADD (float) */
5108             break;
5109         case NEON_3R_FLOAT_MINMAX:
5110             pairwise = u; /* if VPMIN/VPMAX (float) */
5111             break;
5112         case NEON_3R_FLOAT_CMP:
5113             if (!u && size) {
5114                 /* no encoding for U=0 C=1x */
5115                 return 1;
5116             }
5117             break;
5118         case NEON_3R_FLOAT_ACMP:
5119             if (!u) {
5120                 return 1;
5121             }
5122             break;
5123         case NEON_3R_FLOAT_MISC:
5124             /* VMAXNM/VMINNM in ARMv8 */
5125             if (u && !arm_feature(env, ARM_FEATURE_V8)) {
5126                 return 1;
5127             }
5128             break;
5129         case NEON_3R_VMUL:
5130             if (u && (size != 0)) {
5131                 /* UNDEF on invalid size for polynomial subcase */
5132                 return 1;
5133             }
5134             break;
5135         case NEON_3R_VFM:
5136             if (!arm_feature(env, ARM_FEATURE_VFP4) || u) {
5137                 return 1;
5138             }
5139             break;
5140         default:
5141             break;
5142         }
5143
5144         if (pairwise && q) {
5145             /* All the pairwise insns UNDEF if Q is set */
5146             return 1;
5147         }
5148
5149         for (pass = 0; pass < (q ? 4 : 2); pass++) {
5150
5151         if (pairwise) {
5152             /* Pairwise.  */
5153             if (pass < 1) {
5154                 tmp = neon_load_reg(rn, 0);
5155                 tmp2 = neon_load_reg(rn, 1);
5156             } else {
5157                 tmp = neon_load_reg(rm, 0);
5158                 tmp2 = neon_load_reg(rm, 1);
5159             }
5160         } else {
5161             /* Elementwise.  */
5162             tmp = neon_load_reg(rn, pass);
5163             tmp2 = neon_load_reg(rm, pass);
5164         }
5165         switch (op) {
5166         case NEON_3R_VHADD:
5167             GEN_NEON_INTEGER_OP(hadd);
5168             break;
5169         case NEON_3R_VQADD:
5170             GEN_NEON_INTEGER_OP_ENV(qadd);
5171             break;
5172         case NEON_3R_VRHADD:
5173             GEN_NEON_INTEGER_OP(rhadd);
5174             break;
5175         case NEON_3R_LOGIC: /* Logic ops.  */
5176             switch ((u << 2) | size) {
5177             case 0: /* VAND */
5178                 tcg_gen_and_i32(tmp, tmp, tmp2);
5179                 break;
5180             case 1: /* BIC */
5181                 tcg_gen_andc_i32(tmp, tmp, tmp2);
5182                 break;
5183             case 2: /* VORR */
5184                 tcg_gen_or_i32(tmp, tmp, tmp2);
5185                 break;
5186             case 3: /* VORN */
5187                 tcg_gen_orc_i32(tmp, tmp, tmp2);
5188                 break;
5189             case 4: /* VEOR */
5190                 tcg_gen_xor_i32(tmp, tmp, tmp2);
5191                 break;
5192             case 5: /* VBSL */
5193                 tmp3 = neon_load_reg(rd, pass);
5194                 gen_neon_bsl(tmp, tmp, tmp2, tmp3);
5195                 tcg_temp_free_i32(tmp3);
5196                 break;
5197             case 6: /* VBIT */
5198                 tmp3 = neon_load_reg(rd, pass);
5199                 gen_neon_bsl(tmp, tmp, tmp3, tmp2);
5200                 tcg_temp_free_i32(tmp3);
5201                 break;
5202             case 7: /* VBIF */
5203                 tmp3 = neon_load_reg(rd, pass);
5204                 gen_neon_bsl(tmp, tmp3, tmp, tmp2);
5205                 tcg_temp_free_i32(tmp3);
5206                 break;
5207             }
5208             break;
5209         case NEON_3R_VHSUB:
5210             GEN_NEON_INTEGER_OP(hsub);
5211             break;
5212         case NEON_3R_VQSUB:
5213             GEN_NEON_INTEGER_OP_ENV(qsub);
5214             break;
5215         case NEON_3R_VCGT:
5216             GEN_NEON_INTEGER_OP(cgt);
5217             break;
5218         case NEON_3R_VCGE:
5219             GEN_NEON_INTEGER_OP(cge);
5220             break;
5221         case NEON_3R_VSHL:
5222             GEN_NEON_INTEGER_OP(shl);
5223             break;
5224         case NEON_3R_VQSHL:
5225             GEN_NEON_INTEGER_OP_ENV(qshl);
5226             break;
5227         case NEON_3R_VRSHL:
5228             GEN_NEON_INTEGER_OP(rshl);
5229             break;
5230         case NEON_3R_VQRSHL:
5231             GEN_NEON_INTEGER_OP_ENV(qrshl);
5232             break;
5233         case NEON_3R_VMAX:
5234             GEN_NEON_INTEGER_OP(max);
5235             break;
5236         case NEON_3R_VMIN:
5237             GEN_NEON_INTEGER_OP(min);
5238             break;
5239         case NEON_3R_VABD:
5240             GEN_NEON_INTEGER_OP(abd);
5241             break;
5242         case NEON_3R_VABA:
5243             GEN_NEON_INTEGER_OP(abd);
5244             tcg_temp_free_i32(tmp2);
5245             tmp2 = neon_load_reg(rd, pass);
5246             gen_neon_add(size, tmp, tmp2);
5247             break;
5248         case NEON_3R_VADD_VSUB:
5249             if (!u) { /* VADD */
5250                 gen_neon_add(size, tmp, tmp2);
5251             } else { /* VSUB */
5252                 switch (size) {
5253                 case 0: gen_helper_neon_sub_u8(tmp, tmp, tmp2); break;
5254                 case 1: gen_helper_neon_sub_u16(tmp, tmp, tmp2); break;
5255                 case 2: tcg_gen_sub_i32(tmp, tmp, tmp2); break;
5256                 default: abort();
5257                 }
5258             }
5259             break;
5260         case NEON_3R_VTST_VCEQ:
5261             if (!u) { /* VTST */
5262                 switch (size) {
5263                 case 0: gen_helper_neon_tst_u8(tmp, tmp, tmp2); break;
5264                 case 1: gen_helper_neon_tst_u16(tmp, tmp, tmp2); break;
5265                 case 2: gen_helper_neon_tst_u32(tmp, tmp, tmp2); break;
5266                 default: abort();
5267                 }
5268             } else { /* VCEQ */
5269                 switch (size) {
5270                 case 0: gen_helper_neon_ceq_u8(tmp, tmp, tmp2); break;
5271                 case 1: gen_helper_neon_ceq_u16(tmp, tmp, tmp2); break;
5272                 case 2: gen_helper_neon_ceq_u32(tmp, tmp, tmp2); break;
5273                 default: abort();
5274                 }
5275             }
5276             break;
5277         case NEON_3R_VML: /* VMLA, VMLAL, VMLS,VMLSL */
5278             switch (size) {
5279             case 0: gen_helper_neon_mul_u8(tmp, tmp, tmp2); break;
5280             case 1: gen_helper_neon_mul_u16(tmp, tmp, tmp2); break;
5281             case 2: tcg_gen_mul_i32(tmp, tmp, tmp2); break;
5282             default: abort();
5283             }
5284             tcg_temp_free_i32(tmp2);
5285             tmp2 = neon_load_reg(rd, pass);
5286             if (u) { /* VMLS */
5287                 gen_neon_rsb(size, tmp, tmp2);
5288             } else { /* VMLA */
5289                 gen_neon_add(size, tmp, tmp2);
5290             }
5291             break;
5292         case NEON_3R_VMUL:
5293             if (u) { /* polynomial */
5294                 gen_helper_neon_mul_p8(tmp, tmp, tmp2);
5295             } else { /* Integer */
5296                 switch (size) {
5297                 case 0: gen_helper_neon_mul_u8(tmp, tmp, tmp2); break;
5298                 case 1: gen_helper_neon_mul_u16(tmp, tmp, tmp2); break;
5299                 case 2: tcg_gen_mul_i32(tmp, tmp, tmp2); break;
5300                 default: abort();
5301                 }
5302             }
5303             break;
5304         case NEON_3R_VPMAX:
5305             GEN_NEON_INTEGER_OP(pmax);
5306             break;
5307         case NEON_3R_VPMIN:
5308             GEN_NEON_INTEGER_OP(pmin);
5309             break;
5310         case NEON_3R_VQDMULH_VQRDMULH: /* Multiply high.  */
5311             if (!u) { /* VQDMULH */
5312                 switch (size) {
5313                 case 1:
5314                     gen_helper_neon_qdmulh_s16(tmp, cpu_env, tmp, tmp2);
5315                     break;
5316                 case 2:
5317                     gen_helper_neon_qdmulh_s32(tmp, cpu_env, tmp, tmp2);
5318                     break;
5319                 default: abort();
5320                 }
5321             } else { /* VQRDMULH */
5322                 switch (size) {
5323                 case 1:
5324                     gen_helper_neon_qrdmulh_s16(tmp, cpu_env, tmp, tmp2);
5325                     break;
5326                 case 2:
5327                     gen_helper_neon_qrdmulh_s32(tmp, cpu_env, tmp, tmp2);
5328                     break;
5329                 default: abort();
5330                 }
5331             }
5332             break;
5333         case NEON_3R_VPADD:
5334             switch (size) {
5335             case 0: gen_helper_neon_padd_u8(tmp, tmp, tmp2); break;
5336             case 1: gen_helper_neon_padd_u16(tmp, tmp, tmp2); break;
5337             case 2: tcg_gen_add_i32(tmp, tmp, tmp2); break;
5338             default: abort();
5339             }
5340             break;
5341         case NEON_3R_FLOAT_ARITH: /* Floating point arithmetic. */
5342         {
5343             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5344             switch ((u << 2) | size) {
5345             case 0: /* VADD */
5346             case 4: /* VPADD */
5347                 gen_helper_vfp_adds(tmp, tmp, tmp2, fpstatus);
5348                 break;
5349             case 2: /* VSUB */
5350                 gen_helper_vfp_subs(tmp, tmp, tmp2, fpstatus);
5351                 break;
5352             case 6: /* VABD */
5353                 gen_helper_neon_abd_f32(tmp, tmp, tmp2, fpstatus);
5354                 break;
5355             default:
5356                 abort();
5357             }
5358             tcg_temp_free_ptr(fpstatus);
5359             break;
5360         }
5361         case NEON_3R_FLOAT_MULTIPLY:
5362         {
5363             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5364             gen_helper_vfp_muls(tmp, tmp, tmp2, fpstatus);
5365             if (!u) {
5366                 tcg_temp_free_i32(tmp2);
5367                 tmp2 = neon_load_reg(rd, pass);
5368                 if (size == 0) {
5369                     gen_helper_vfp_adds(tmp, tmp, tmp2, fpstatus);
5370                 } else {
5371                     gen_helper_vfp_subs(tmp, tmp2, tmp, fpstatus);
5372                 }
5373             }
5374             tcg_temp_free_ptr(fpstatus);
5375             break;
5376         }
5377         case NEON_3R_FLOAT_CMP:
5378         {
5379             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5380             if (!u) {
5381                 gen_helper_neon_ceq_f32(tmp, tmp, tmp2, fpstatus);
5382             } else {
5383                 if (size == 0) {
5384                     gen_helper_neon_cge_f32(tmp, tmp, tmp2, fpstatus);
5385                 } else {
5386                     gen_helper_neon_cgt_f32(tmp, tmp, tmp2, fpstatus);
5387                 }
5388             }
5389             tcg_temp_free_ptr(fpstatus);
5390             break;
5391         }
5392         case NEON_3R_FLOAT_ACMP:
5393         {
5394             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5395             if (size == 0) {
5396                 gen_helper_neon_acge_f32(tmp, tmp, tmp2, fpstatus);
5397             } else {
5398                 gen_helper_neon_acgt_f32(tmp, tmp, tmp2, fpstatus);
5399             }
5400             tcg_temp_free_ptr(fpstatus);
5401             break;
5402         }
5403         case NEON_3R_FLOAT_MINMAX:
5404         {
5405             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5406             if (size == 0) {
5407                 gen_helper_vfp_maxs(tmp, tmp, tmp2, fpstatus);
5408             } else {
5409                 gen_helper_vfp_mins(tmp, tmp, tmp2, fpstatus);
5410             }
5411             tcg_temp_free_ptr(fpstatus);
5412             break;
5413         }
5414         case NEON_3R_FLOAT_MISC:
5415             if (u) {
5416                 /* VMAXNM/VMINNM */
5417                 TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5418                 if (size == 0) {
5419                     gen_helper_vfp_maxnums(tmp, tmp, tmp2, fpstatus);
5420                 } else {
5421                     gen_helper_vfp_minnums(tmp, tmp, tmp2, fpstatus);
5422                 }
5423                 tcg_temp_free_ptr(fpstatus);
5424             } else {
5425                 if (size == 0) {
5426                     gen_helper_recps_f32(tmp, tmp, tmp2, cpu_env);
5427                 } else {
5428                     gen_helper_rsqrts_f32(tmp, tmp, tmp2, cpu_env);
5429               }
5430             }
5431             break;
5432         case NEON_3R_VFM:
5433         {
5434             /* VFMA, VFMS: fused multiply-add */
5435             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5436             TCGv_i32 tmp3 = neon_load_reg(rd, pass);
5437             if (size) {
5438                 /* VFMS */
5439                 gen_helper_vfp_negs(tmp, tmp);
5440             }
5441             gen_helper_vfp_muladds(tmp, tmp, tmp2, tmp3, fpstatus);
5442             tcg_temp_free_i32(tmp3);
5443             tcg_temp_free_ptr(fpstatus);
5444             break;
5445         }
5446         default:
5447             abort();
5448         }
5449         tcg_temp_free_i32(tmp2);
5450
5451         /* Save the result.  For elementwise operations we can put it
5452            straight into the destination register.  For pairwise operations
5453            we have to be careful to avoid clobbering the source operands.  */
5454         if (pairwise && rd == rm) {
5455             neon_store_scratch(pass, tmp);
5456         } else {
5457             neon_store_reg(rd, pass, tmp);
5458         }
5459
5460         } /* for pass */
5461         if (pairwise && rd == rm) {
5462             for (pass = 0; pass < (q ? 4 : 2); pass++) {
5463                 tmp = neon_load_scratch(pass);
5464                 neon_store_reg(rd, pass, tmp);
5465             }
5466         }
5467         /* End of 3 register same size operations.  */
5468     } else if (insn & (1 << 4)) {
5469         if ((insn & 0x00380080) != 0) {
5470             /* Two registers and shift.  */
5471             op = (insn >> 8) & 0xf;
5472             if (insn & (1 << 7)) {
5473                 /* 64-bit shift. */
5474                 if (op > 7) {
5475                     return 1;
5476                 }
5477                 size = 3;
5478             } else {
5479                 size = 2;
5480                 while ((insn & (1 << (size + 19))) == 0)
5481                     size--;
5482             }
5483             shift = (insn >> 16) & ((1 << (3 + size)) - 1);
5484             /* To avoid excessive duplication of ops we implement shift
5485                by immediate using the variable shift operations.  */
5486             if (op < 8) {
5487                 /* Shift by immediate:
5488                    VSHR, VSRA, VRSHR, VRSRA, VSRI, VSHL, VQSHL, VQSHLU.  */
5489                 if (q && ((rd | rm) & 1)) {
5490                     return 1;
5491                 }
5492                 if (!u && (op == 4 || op == 6)) {
5493                     return 1;
5494                 }
5495                 /* Right shifts are encoded as N - shift, where N is the
5496                    element size in bits.  */
5497                 if (op <= 4)
5498                     shift = shift - (1 << (size + 3));
5499                 if (size == 3) {
5500                     count = q + 1;
5501                 } else {
5502                     count = q ? 4: 2;
5503                 }
5504                 switch (size) {
5505                 case 0:
5506                     imm = (uint8_t) shift;
5507                     imm |= imm << 8;
5508                     imm |= imm << 16;
5509                     break;
5510                 case 1:
5511                     imm = (uint16_t) shift;
5512                     imm |= imm << 16;
5513                     break;
5514                 case 2:
5515                 case 3:
5516                     imm = shift;
5517                     break;
5518                 default:
5519                     abort();
5520                 }
5521
5522                 for (pass = 0; pass < count; pass++) {
5523                     if (size == 3) {
5524                         neon_load_reg64(cpu_V0, rm + pass);
5525                         tcg_gen_movi_i64(cpu_V1, imm);
5526                         switch (op) {
5527                         case 0:  /* VSHR */
5528                         case 1:  /* VSRA */
5529                             if (u)
5530                                 gen_helper_neon_shl_u64(cpu_V0, cpu_V0, cpu_V1);
5531                             else
5532                                 gen_helper_neon_shl_s64(cpu_V0, cpu_V0, cpu_V1);
5533                             break;
5534                         case 2: /* VRSHR */
5535                         case 3: /* VRSRA */
5536                             if (u)
5537                                 gen_helper_neon_rshl_u64(cpu_V0, cpu_V0, cpu_V1);
5538                             else
5539                                 gen_helper_neon_rshl_s64(cpu_V0, cpu_V0, cpu_V1);
5540                             break;
5541                         case 4: /* VSRI */
5542                         case 5: /* VSHL, VSLI */
5543                             gen_helper_neon_shl_u64(cpu_V0, cpu_V0, cpu_V1);
5544                             break;
5545                         case 6: /* VQSHLU */
5546                             gen_helper_neon_qshlu_s64(cpu_V0, cpu_env,
5547                                                       cpu_V0, cpu_V1);
5548                             break;
5549                         case 7: /* VQSHL */
5550                             if (u) {
5551                                 gen_helper_neon_qshl_u64(cpu_V0, cpu_env,
5552                                                          cpu_V0, cpu_V1);
5553                             } else {
5554                                 gen_helper_neon_qshl_s64(cpu_V0, cpu_env,
5555                                                          cpu_V0, cpu_V1);
5556                             }
5557                             break;
5558                         }
5559                         if (op == 1 || op == 3) {
5560                             /* Accumulate.  */
5561                             neon_load_reg64(cpu_V1, rd + pass);
5562                             tcg_gen_add_i64(cpu_V0, cpu_V0, cpu_V1);
5563                         } else if (op == 4 || (op == 5 && u)) {
5564                             /* Insert */
5565                             neon_load_reg64(cpu_V1, rd + pass);
5566                             uint64_t mask;
5567                             if (shift < -63 || shift > 63) {
5568                                 mask = 0;
5569                             } else {
5570                                 if (op == 4) {
5571                                     mask = 0xffffffffffffffffull >> -shift;
5572                                 } else {
5573                                     mask = 0xffffffffffffffffull << shift;
5574                                 }
5575                             }
5576                             tcg_gen_andi_i64(cpu_V1, cpu_V1, ~mask);
5577                             tcg_gen_or_i64(cpu_V0, cpu_V0, cpu_V1);
5578                         }
5579                         neon_store_reg64(cpu_V0, rd + pass);
5580                     } else { /* size < 3 */
5581                         /* Operands in T0 and T1.  */
5582                         tmp = neon_load_reg(rm, pass);
5583                         tmp2 = tcg_temp_new_i32();
5584                         tcg_gen_movi_i32(tmp2, imm);
5585                         switch (op) {
5586                         case 0:  /* VSHR */
5587                         case 1:  /* VSRA */
5588                             GEN_NEON_INTEGER_OP(shl);
5589                             break;
5590                         case 2: /* VRSHR */
5591                         case 3: /* VRSRA */
5592                             GEN_NEON_INTEGER_OP(rshl);
5593                             break;
5594                         case 4: /* VSRI */
5595                         case 5: /* VSHL, VSLI */
5596                             switch (size) {
5597                             case 0: gen_helper_neon_shl_u8(tmp, tmp, tmp2); break;
5598                             case 1: gen_helper_neon_shl_u16(tmp, tmp, tmp2); break;
5599                             case 2: gen_helper_neon_shl_u32(tmp, tmp, tmp2); break;
5600                             default: abort();
5601                             }
5602                             break;
5603                         case 6: /* VQSHLU */
5604                             switch (size) {
5605                             case 0:
5606                                 gen_helper_neon_qshlu_s8(tmp, cpu_env,
5607                                                          tmp, tmp2);
5608                                 break;
5609                             case 1:
5610                                 gen_helper_neon_qshlu_s16(tmp, cpu_env,
5611                                                           tmp, tmp2);
5612                                 break;
5613                             case 2:
5614                                 gen_helper_neon_qshlu_s32(tmp, cpu_env,
5615                                                           tmp, tmp2);
5616                                 break;
5617                             default:
5618                                 abort();
5619                             }
5620                             break;
5621                         case 7: /* VQSHL */
5622                             GEN_NEON_INTEGER_OP_ENV(qshl);
5623                             break;
5624                         }
5625                         tcg_temp_free_i32(tmp2);
5626
5627                         if (op == 1 || op == 3) {
5628                             /* Accumulate.  */
5629                             tmp2 = neon_load_reg(rd, pass);
5630                             gen_neon_add(size, tmp, tmp2);
5631                             tcg_temp_free_i32(tmp2);
5632                         } else if (op == 4 || (op == 5 && u)) {
5633                             /* Insert */
5634                             switch (size) {
5635                             case 0:
5636                                 if (op == 4)
5637                                     mask = 0xff >> -shift;
5638                                 else
5639                                     mask = (uint8_t)(0xff << shift);
5640                                 mask |= mask << 8;
5641                                 mask |= mask << 16;
5642                                 break;
5643                             case 1:
5644                                 if (op == 4)
5645                                     mask = 0xffff >> -shift;
5646                                 else
5647                                     mask = (uint16_t)(0xffff << shift);
5648                                 mask |= mask << 16;
5649                                 break;
5650                             case 2:
5651                                 if (shift < -31 || shift > 31) {
5652                                     mask = 0;
5653                                 } else {
5654                                     if (op == 4)
5655                                         mask = 0xffffffffu >> -shift;
5656                                     else
5657                                         mask = 0xffffffffu << shift;
5658                                 }
5659                                 break;
5660                             default:
5661                                 abort();
5662                             }
5663                             tmp2 = neon_load_reg(rd, pass);
5664                             tcg_gen_andi_i32(tmp, tmp, mask);
5665                             tcg_gen_andi_i32(tmp2, tmp2, ~mask);
5666                             tcg_gen_or_i32(tmp, tmp, tmp2);
5667                             tcg_temp_free_i32(tmp2);
5668                         }
5669                         neon_store_reg(rd, pass, tmp);
5670                     }
5671                 } /* for pass */
5672             } else if (op < 10) {
5673                 /* Shift by immediate and narrow:
5674                    VSHRN, VRSHRN, VQSHRN, VQRSHRN.  */
5675                 int input_unsigned = (op == 8) ? !u : u;
5676                 if (rm & 1) {
5677                     return 1;
5678                 }
5679                 shift = shift - (1 << (size + 3));
5680                 size++;
5681                 if (size == 3) {
5682                     tmp64 = tcg_const_i64(shift);
5683                     neon_load_reg64(cpu_V0, rm);
5684                     neon_load_reg64(cpu_V1, rm + 1);
5685                     for (pass = 0; pass < 2; pass++) {
5686                         TCGv_i64 in;
5687                         if (pass == 0) {
5688                             in = cpu_V0;
5689                         } else {
5690                             in = cpu_V1;
5691                         }
5692                         if (q) {
5693                             if (input_unsigned) {
5694                                 gen_helper_neon_rshl_u64(cpu_V0, in, tmp64);
5695                             } else {
5696                                 gen_helper_neon_rshl_s64(cpu_V0, in, tmp64);
5697                             }
5698                         } else {
5699                             if (input_unsigned) {
5700                                 gen_helper_neon_shl_u64(cpu_V0, in, tmp64);
5701                             } else {
5702                                 gen_helper_neon_shl_s64(cpu_V0, in, tmp64);
5703                             }
5704                         }
5705                         tmp = tcg_temp_new_i32();
5706                         gen_neon_narrow_op(op == 8, u, size - 1, tmp, cpu_V0);
5707                         neon_store_reg(rd, pass, tmp);
5708                     } /* for pass */
5709                     tcg_temp_free_i64(tmp64);
5710                 } else {
5711                     if (size == 1) {
5712                         imm = (uint16_t)shift;
5713                         imm |= imm << 16;
5714                     } else {
5715                         /* size == 2 */
5716                         imm = (uint32_t)shift;
5717                     }
5718                     tmp2 = tcg_const_i32(imm);
5719                     tmp4 = neon_load_reg(rm + 1, 0);
5720                     tmp5 = neon_load_reg(rm + 1, 1);
5721                     for (pass = 0; pass < 2; pass++) {
5722                         if (pass == 0) {
5723                             tmp = neon_load_reg(rm, 0);
5724                         } else {
5725                             tmp = tmp4;
5726                         }
5727                         gen_neon_shift_narrow(size, tmp, tmp2, q,
5728                                               input_unsigned);
5729                         if (pass == 0) {
5730                             tmp3 = neon_load_reg(rm, 1);
5731                         } else {
5732                             tmp3 = tmp5;
5733                         }
5734                         gen_neon_shift_narrow(size, tmp3, tmp2, q,
5735                                               input_unsigned);
5736                         tcg_gen_concat_i32_i64(cpu_V0, tmp, tmp3);
5737                         tcg_temp_free_i32(tmp);
5738                         tcg_temp_free_i32(tmp3);
5739                         tmp = tcg_temp_new_i32();
5740                         gen_neon_narrow_op(op == 8, u, size - 1, tmp, cpu_V0);
5741                         neon_store_reg(rd, pass, tmp);
5742                     } /* for pass */
5743                     tcg_temp_free_i32(tmp2);
5744                 }
5745             } else if (op == 10) {
5746                 /* VSHLL, VMOVL */
5747                 if (q || (rd & 1)) {
5748                     return 1;
5749                 }
5750                 tmp = neon_load_reg(rm, 0);
5751                 tmp2 = neon_load_reg(rm, 1);
5752                 for (pass = 0; pass < 2; pass++) {
5753                     if (pass == 1)
5754                         tmp = tmp2;
5755
5756                     gen_neon_widen(cpu_V0, tmp, size, u);
5757
5758                     if (shift != 0) {
5759                         /* The shift is less than the width of the source
5760                            type, so we can just shift the whole register.  */
5761                         tcg_gen_shli_i64(cpu_V0, cpu_V0, shift);
5762                         /* Widen the result of shift: we need to clear
5763                          * the potential overflow bits resulting from
5764                          * left bits of the narrow input appearing as
5765                          * right bits of left the neighbour narrow
5766                          * input.  */
5767                         if (size < 2 || !u) {
5768                             uint64_t imm64;
5769                             if (size == 0) {
5770                                 imm = (0xffu >> (8 - shift));
5771                                 imm |= imm << 16;
5772                             } else if (size == 1) {
5773                                 imm = 0xffff >> (16 - shift);
5774                             } else {
5775                                 /* size == 2 */
5776                                 imm = 0xffffffff >> (32 - shift);
5777                             }
5778                             if (size < 2) {
5779                                 imm64 = imm | (((uint64_t)imm) << 32);
5780                             } else {
5781                                 imm64 = imm;
5782                             }
5783                             tcg_gen_andi_i64(cpu_V0, cpu_V0, ~imm64);
5784                         }
5785                     }
5786                     neon_store_reg64(cpu_V0, rd + pass);
5787                 }
5788             } else if (op >= 14) {
5789                 /* VCVT fixed-point.  */
5790                 if (!(insn & (1 << 21)) || (q && ((rd | rm) & 1))) {
5791                     return 1;
5792                 }
5793                 /* We have already masked out the must-be-1 top bit of imm6,
5794                  * hence this 32-shift where the ARM ARM has 64-imm6.
5795                  */
5796                 shift = 32 - shift;
5797                 for (pass = 0; pass < (q ? 4 : 2); pass++) {
5798                     tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, pass));
5799                     if (!(op & 1)) {
5800                         if (u)
5801                             gen_vfp_ulto(0, shift, 1);
5802                         else
5803                             gen_vfp_slto(0, shift, 1);
5804                     } else {
5805                         if (u)
5806                             gen_vfp_toul(0, shift, 1);
5807                         else
5808                             gen_vfp_tosl(0, shift, 1);
5809                     }
5810                     tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, pass));
5811                 }
5812             } else {
5813                 return 1;
5814             }
5815         } else { /* (insn & 0x00380080) == 0 */
5816             int invert;
5817             if (q && (rd & 1)) {
5818                 return 1;
5819             }
5820
5821             op = (insn >> 8) & 0xf;
5822             /* One register and immediate.  */
5823             imm = (u << 7) | ((insn >> 12) & 0x70) | (insn & 0xf);
5824             invert = (insn & (1 << 5)) != 0;
5825             /* Note that op = 2,3,4,5,6,7,10,11,12,13 imm=0 is UNPREDICTABLE.
5826              * We choose to not special-case this and will behave as if a
5827              * valid constant encoding of 0 had been given.
5828              */
5829             switch (op) {
5830             case 0: case 1:
5831                 /* no-op */
5832                 break;
5833             case 2: case 3:
5834                 imm <<= 8;
5835                 break;
5836             case 4: case 5:
5837                 imm <<= 16;
5838                 break;
5839             case 6: case 7:
5840                 imm <<= 24;
5841                 break;
5842             case 8: case 9:
5843                 imm |= imm << 16;
5844                 break;
5845             case 10: case 11:
5846                 imm = (imm << 8) | (imm << 24);
5847                 break;
5848             case 12:
5849                 imm = (imm << 8) | 0xff;
5850                 break;
5851             case 13:
5852                 imm = (imm << 16) | 0xffff;
5853                 break;
5854             case 14:
5855                 imm |= (imm << 8) | (imm << 16) | (imm << 24);
5856                 if (invert)
5857                     imm = ~imm;
5858                 break;
5859             case 15:
5860                 if (invert) {
5861                     return 1;
5862                 }
5863                 imm = ((imm & 0x80) << 24) | ((imm & 0x3f) << 19)
5864                       | ((imm & 0x40) ? (0x1f << 25) : (1 << 30));
5865                 break;
5866             }
5867             if (invert)
5868                 imm = ~imm;
5869
5870             for (pass = 0; pass < (q ? 4 : 2); pass++) {
5871                 if (op & 1 && op < 12) {
5872                     tmp = neon_load_reg(rd, pass);
5873                     if (invert) {
5874                         /* The immediate value has already been inverted, so
5875                            BIC becomes AND.  */
5876                         tcg_gen_andi_i32(tmp, tmp, imm);
5877                     } else {
5878                         tcg_gen_ori_i32(tmp, tmp, imm);
5879                     }
5880                 } else {
5881                     /* VMOV, VMVN.  */
5882                     tmp = tcg_temp_new_i32();
5883                     if (op == 14 && invert) {
5884                         int n;
5885                         uint32_t val;
5886                         val = 0;
5887                         for (n = 0; n < 4; n++) {
5888                             if (imm & (1 << (n + (pass & 1) * 4)))
5889                                 val |= 0xff << (n * 8);
5890                         }
5891                         tcg_gen_movi_i32(tmp, val);
5892                     } else {
5893                         tcg_gen_movi_i32(tmp, imm);
5894                     }
5895                 }
5896                 neon_store_reg(rd, pass, tmp);
5897             }
5898         }
5899     } else { /* (insn & 0x00800010 == 0x00800000) */
5900         if (size != 3) {
5901             op = (insn >> 8) & 0xf;
5902             if ((insn & (1 << 6)) == 0) {
5903                 /* Three registers of different lengths.  */
5904                 int src1_wide;
5905                 int src2_wide;
5906                 int prewiden;
5907                 /* undefreq: bit 0 : UNDEF if size != 0
5908                  *           bit 1 : UNDEF if size == 0
5909                  *           bit 2 : UNDEF if U == 1
5910                  * Note that [1:0] set implies 'always UNDEF'
5911                  */
5912                 int undefreq;
5913                 /* prewiden, src1_wide, src2_wide, undefreq */
5914                 static const int neon_3reg_wide[16][4] = {
5915                     {1, 0, 0, 0}, /* VADDL */
5916                     {1, 1, 0, 0}, /* VADDW */
5917                     {1, 0, 0, 0}, /* VSUBL */
5918                     {1, 1, 0, 0}, /* VSUBW */
5919                     {0, 1, 1, 0}, /* VADDHN */
5920                     {0, 0, 0, 0}, /* VABAL */
5921                     {0, 1, 1, 0}, /* VSUBHN */
5922                     {0, 0, 0, 0}, /* VABDL */
5923                     {0, 0, 0, 0}, /* VMLAL */
5924                     {0, 0, 0, 6}, /* VQDMLAL */
5925                     {0, 0, 0, 0}, /* VMLSL */
5926                     {0, 0, 0, 6}, /* VQDMLSL */
5927                     {0, 0, 0, 0}, /* Integer VMULL */
5928                     {0, 0, 0, 2}, /* VQDMULL */
5929                     {0, 0, 0, 5}, /* Polynomial VMULL */
5930                     {0, 0, 0, 3}, /* Reserved: always UNDEF */
5931                 };
5932
5933                 prewiden = neon_3reg_wide[op][0];
5934                 src1_wide = neon_3reg_wide[op][1];
5935                 src2_wide = neon_3reg_wide[op][2];
5936                 undefreq = neon_3reg_wide[op][3];
5937
5938                 if (((undefreq & 1) && (size != 0)) ||
5939                     ((undefreq & 2) && (size == 0)) ||
5940                     ((undefreq & 4) && u)) {
5941                     return 1;
5942                 }
5943                 if ((src1_wide && (rn & 1)) ||
5944                     (src2_wide && (rm & 1)) ||
5945                     (!src2_wide && (rd & 1))) {
5946                     return 1;
5947                 }
5948
5949                 /* Avoid overlapping operands.  Wide source operands are
5950                    always aligned so will never overlap with wide
5951                    destinations in problematic ways.  */
5952                 if (rd == rm && !src2_wide) {
5953                     tmp = neon_load_reg(rm, 1);
5954                     neon_store_scratch(2, tmp);
5955                 } else if (rd == rn && !src1_wide) {
5956                     tmp = neon_load_reg(rn, 1);
5957                     neon_store_scratch(2, tmp);
5958                 }
5959                 TCGV_UNUSED_I32(tmp3);
5960                 for (pass = 0; pass < 2; pass++) {
5961                     if (src1_wide) {
5962                         neon_load_reg64(cpu_V0, rn + pass);
5963                         TCGV_UNUSED_I32(tmp);
5964                     } else {
5965                         if (pass == 1 && rd == rn) {
5966                             tmp = neon_load_scratch(2);
5967                         } else {
5968                             tmp = neon_load_reg(rn, pass);
5969                         }
5970                         if (prewiden) {
5971                             gen_neon_widen(cpu_V0, tmp, size, u);
5972                         }
5973                     }
5974                     if (src2_wide) {
5975                         neon_load_reg64(cpu_V1, rm + pass);
5976                         TCGV_UNUSED_I32(tmp2);
5977                     } else {
5978                         if (pass == 1 && rd == rm) {
5979                             tmp2 = neon_load_scratch(2);
5980                         } else {
5981                             tmp2 = neon_load_reg(rm, pass);
5982                         }
5983                         if (prewiden) {
5984                             gen_neon_widen(cpu_V1, tmp2, size, u);
5985                         }
5986                     }
5987                     switch (op) {
5988                     case 0: case 1: case 4: /* VADDL, VADDW, VADDHN, VRADDHN */
5989                         gen_neon_addl(size);
5990                         break;
5991                     case 2: case 3: case 6: /* VSUBL, VSUBW, VSUBHN, VRSUBHN */
5992                         gen_neon_subl(size);
5993                         break;
5994                     case 5: case 7: /* VABAL, VABDL */
5995                         switch ((size << 1) | u) {
5996                         case 0:
5997                             gen_helper_neon_abdl_s16(cpu_V0, tmp, tmp2);
5998                             break;
5999                         case 1:
6000                             gen_helper_neon_abdl_u16(cpu_V0, tmp, tmp2);
6001                             break;
6002                         case 2:
6003                             gen_helper_neon_abdl_s32(cpu_V0, tmp, tmp2);
6004                             break;
6005                         case 3:
6006                             gen_helper_neon_abdl_u32(cpu_V0, tmp, tmp2);
6007                             break;
6008                         case 4:
6009                             gen_helper_neon_abdl_s64(cpu_V0, tmp, tmp2);
6010                             break;
6011                         case 5:
6012                             gen_helper_neon_abdl_u64(cpu_V0, tmp, tmp2);
6013                             break;
6014                         default: abort();
6015                         }
6016                         tcg_temp_free_i32(tmp2);
6017                         tcg_temp_free_i32(tmp);
6018                         break;
6019                     case 8: case 9: case 10: case 11: case 12: case 13:
6020                         /* VMLAL, VQDMLAL, VMLSL, VQDMLSL, VMULL, VQDMULL */
6021                         gen_neon_mull(cpu_V0, tmp, tmp2, size, u);
6022                         break;
6023                     case 14: /* Polynomial VMULL */
6024                         gen_helper_neon_mull_p8(cpu_V0, tmp, tmp2);
6025                         tcg_temp_free_i32(tmp2);
6026                         tcg_temp_free_i32(tmp);
6027                         break;
6028                     default: /* 15 is RESERVED: caught earlier  */
6029                         abort();
6030                     }
6031                     if (op == 13) {
6032                         /* VQDMULL */
6033                         gen_neon_addl_saturate(cpu_V0, cpu_V0, size);
6034                         neon_store_reg64(cpu_V0, rd + pass);
6035                     } else if (op == 5 || (op >= 8 && op <= 11)) {
6036                         /* Accumulate.  */
6037                         neon_load_reg64(cpu_V1, rd + pass);
6038                         switch (op) {
6039                         case 10: /* VMLSL */
6040                             gen_neon_negl(cpu_V0, size);
6041                             /* Fall through */
6042                         case 5: case 8: /* VABAL, VMLAL */
6043                             gen_neon_addl(size);
6044                             break;
6045                         case 9: case 11: /* VQDMLAL, VQDMLSL */
6046                             gen_neon_addl_saturate(cpu_V0, cpu_V0, size);
6047                             if (op == 11) {
6048                                 gen_neon_negl(cpu_V0, size);
6049                             }
6050                             gen_neon_addl_saturate(cpu_V0, cpu_V1, size);
6051                             break;
6052                         default:
6053                             abort();
6054                         }
6055                         neon_store_reg64(cpu_V0, rd + pass);
6056                     } else if (op == 4 || op == 6) {
6057                         /* Narrowing operation.  */
6058                         tmp = tcg_temp_new_i32();
6059                         if (!u) {
6060                             switch (size) {
6061                             case 0:
6062                                 gen_helper_neon_narrow_high_u8(tmp, cpu_V0);
6063                                 break;
6064                             case 1:
6065                                 gen_helper_neon_narrow_high_u16(tmp, cpu_V0);
6066                                 break;
6067                             case 2:
6068                                 tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
6069                                 tcg_gen_trunc_i64_i32(tmp, cpu_V0);
6070                                 break;
6071                             default: abort();
6072                             }
6073                         } else {
6074                             switch (size) {
6075                             case 0:
6076                                 gen_helper_neon_narrow_round_high_u8(tmp, cpu_V0);
6077                                 break;
6078                             case 1:
6079                                 gen_helper_neon_narrow_round_high_u16(tmp, cpu_V0);
6080                                 break;
6081                             case 2:
6082                                 tcg_gen_addi_i64(cpu_V0, cpu_V0, 1u << 31);
6083                                 tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
6084                                 tcg_gen_trunc_i64_i32(tmp, cpu_V0);
6085                                 break;
6086                             default: abort();
6087                             }
6088                         }
6089                         if (pass == 0) {
6090                             tmp3 = tmp;
6091                         } else {
6092                             neon_store_reg(rd, 0, tmp3);
6093                             neon_store_reg(rd, 1, tmp);
6094                         }
6095                     } else {
6096                         /* Write back the result.  */
6097                         neon_store_reg64(cpu_V0, rd + pass);
6098                     }
6099                 }
6100             } else {
6101                 /* Two registers and a scalar. NB that for ops of this form
6102                  * the ARM ARM labels bit 24 as Q, but it is in our variable
6103                  * 'u', not 'q'.
6104                  */
6105                 if (size == 0) {
6106                     return 1;
6107                 }
6108                 switch (op) {
6109                 case 1: /* Float VMLA scalar */
6110                 case 5: /* Floating point VMLS scalar */
6111                 case 9: /* Floating point VMUL scalar */
6112                     if (size == 1) {
6113                         return 1;
6114                     }
6115                     /* fall through */
6116                 case 0: /* Integer VMLA scalar */
6117                 case 4: /* Integer VMLS scalar */
6118                 case 8: /* Integer VMUL scalar */
6119                 case 12: /* VQDMULH scalar */
6120                 case 13: /* VQRDMULH scalar */
6121                     if (u && ((rd | rn) & 1)) {
6122                         return 1;
6123                     }
6124                     tmp = neon_get_scalar(size, rm);
6125                     neon_store_scratch(0, tmp);
6126                     for (pass = 0; pass < (u ? 4 : 2); pass++) {
6127                         tmp = neon_load_scratch(0);
6128                         tmp2 = neon_load_reg(rn, pass);
6129                         if (op == 12) {
6130                             if (size == 1) {
6131                                 gen_helper_neon_qdmulh_s16(tmp, cpu_env, tmp, tmp2);
6132                             } else {
6133                                 gen_helper_neon_qdmulh_s32(tmp, cpu_env, tmp, tmp2);
6134                             }
6135                         } else if (op == 13) {
6136                             if (size == 1) {
6137                                 gen_helper_neon_qrdmulh_s16(tmp, cpu_env, tmp, tmp2);
6138                             } else {
6139                                 gen_helper_neon_qrdmulh_s32(tmp, cpu_env, tmp, tmp2);
6140                             }
6141                         } else if (op & 1) {
6142                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6143                             gen_helper_vfp_muls(tmp, tmp, tmp2, fpstatus);
6144                             tcg_temp_free_ptr(fpstatus);
6145                         } else {
6146                             switch (size) {
6147                             case 0: gen_helper_neon_mul_u8(tmp, tmp, tmp2); break;
6148                             case 1: gen_helper_neon_mul_u16(tmp, tmp, tmp2); break;
6149                             case 2: tcg_gen_mul_i32(tmp, tmp, tmp2); break;
6150                             default: abort();
6151                             }
6152                         }
6153                         tcg_temp_free_i32(tmp2);
6154                         if (op < 8) {
6155                             /* Accumulate.  */
6156                             tmp2 = neon_load_reg(rd, pass);
6157                             switch (op) {
6158                             case 0:
6159                                 gen_neon_add(size, tmp, tmp2);
6160                                 break;
6161                             case 1:
6162                             {
6163                                 TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6164                                 gen_helper_vfp_adds(tmp, tmp, tmp2, fpstatus);
6165                                 tcg_temp_free_ptr(fpstatus);
6166                                 break;
6167                             }
6168                             case 4:
6169                                 gen_neon_rsb(size, tmp, tmp2);
6170                                 break;
6171                             case 5:
6172                             {
6173                                 TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6174                                 gen_helper_vfp_subs(tmp, tmp2, tmp, fpstatus);
6175                                 tcg_temp_free_ptr(fpstatus);
6176                                 break;
6177                             }
6178                             default:
6179                                 abort();
6180                             }
6181                             tcg_temp_free_i32(tmp2);
6182                         }
6183                         neon_store_reg(rd, pass, tmp);
6184                     }
6185                     break;
6186                 case 3: /* VQDMLAL scalar */
6187                 case 7: /* VQDMLSL scalar */
6188                 case 11: /* VQDMULL scalar */
6189                     if (u == 1) {
6190                         return 1;
6191                     }
6192                     /* fall through */
6193                 case 2: /* VMLAL sclar */
6194                 case 6: /* VMLSL scalar */
6195                 case 10: /* VMULL scalar */
6196                     if (rd & 1) {
6197                         return 1;
6198                     }
6199                     tmp2 = neon_get_scalar(size, rm);
6200                     /* We need a copy of tmp2 because gen_neon_mull
6201                      * deletes it during pass 0.  */
6202                     tmp4 = tcg_temp_new_i32();
6203                     tcg_gen_mov_i32(tmp4, tmp2);
6204                     tmp3 = neon_load_reg(rn, 1);
6205
6206                     for (pass = 0; pass < 2; pass++) {
6207                         if (pass == 0) {
6208                             tmp = neon_load_reg(rn, 0);
6209                         } else {
6210                             tmp = tmp3;
6211                             tmp2 = tmp4;
6212                         }
6213                         gen_neon_mull(cpu_V0, tmp, tmp2, size, u);
6214                         if (op != 11) {
6215                             neon_load_reg64(cpu_V1, rd + pass);
6216                         }
6217                         switch (op) {
6218                         case 6:
6219                             gen_neon_negl(cpu_V0, size);
6220                             /* Fall through */
6221                         case 2:
6222                             gen_neon_addl(size);
6223                             break;
6224                         case 3: case 7:
6225                             gen_neon_addl_saturate(cpu_V0, cpu_V0, size);
6226                             if (op == 7) {
6227                                 gen_neon_negl(cpu_V0, size);
6228                             }
6229                             gen_neon_addl_saturate(cpu_V0, cpu_V1, size);
6230                             break;
6231                         case 10:
6232                             /* no-op */
6233                             break;
6234                         case 11:
6235                             gen_neon_addl_saturate(cpu_V0, cpu_V0, size);
6236                             break;
6237                         default:
6238                             abort();
6239                         }
6240                         neon_store_reg64(cpu_V0, rd + pass);
6241                     }
6242
6243
6244                     break;
6245                 default: /* 14 and 15 are RESERVED */
6246                     return 1;
6247                 }
6248             }
6249         } else { /* size == 3 */
6250             if (!u) {
6251                 /* Extract.  */
6252                 imm = (insn >> 8) & 0xf;
6253
6254                 if (imm > 7 && !q)
6255                     return 1;
6256
6257                 if (q && ((rd | rn | rm) & 1)) {
6258                     return 1;
6259                 }
6260
6261                 if (imm == 0) {
6262                     neon_load_reg64(cpu_V0, rn);
6263                     if (q) {
6264                         neon_load_reg64(cpu_V1, rn + 1);
6265                     }
6266                 } else if (imm == 8) {
6267                     neon_load_reg64(cpu_V0, rn + 1);
6268                     if (q) {
6269                         neon_load_reg64(cpu_V1, rm);
6270                     }
6271                 } else if (q) {
6272                     tmp64 = tcg_temp_new_i64();
6273                     if (imm < 8) {
6274                         neon_load_reg64(cpu_V0, rn);
6275                         neon_load_reg64(tmp64, rn + 1);
6276                     } else {
6277                         neon_load_reg64(cpu_V0, rn + 1);
6278                         neon_load_reg64(tmp64, rm);
6279                     }
6280                     tcg_gen_shri_i64(cpu_V0, cpu_V0, (imm & 7) * 8);
6281                     tcg_gen_shli_i64(cpu_V1, tmp64, 64 - ((imm & 7) * 8));
6282                     tcg_gen_or_i64(cpu_V0, cpu_V0, cpu_V1);
6283                     if (imm < 8) {
6284                         neon_load_reg64(cpu_V1, rm);
6285                     } else {
6286                         neon_load_reg64(cpu_V1, rm + 1);
6287                         imm -= 8;
6288                     }
6289                     tcg_gen_shli_i64(cpu_V1, cpu_V1, 64 - (imm * 8));
6290                     tcg_gen_shri_i64(tmp64, tmp64, imm * 8);
6291                     tcg_gen_or_i64(cpu_V1, cpu_V1, tmp64);
6292                     tcg_temp_free_i64(tmp64);
6293                 } else {
6294                     /* BUGFIX */
6295                     neon_load_reg64(cpu_V0, rn);
6296                     tcg_gen_shri_i64(cpu_V0, cpu_V0, imm * 8);
6297                     neon_load_reg64(cpu_V1, rm);
6298                     tcg_gen_shli_i64(cpu_V1, cpu_V1, 64 - (imm * 8));
6299                     tcg_gen_or_i64(cpu_V0, cpu_V0, cpu_V1);
6300                 }
6301                 neon_store_reg64(cpu_V0, rd);
6302                 if (q) {
6303                     neon_store_reg64(cpu_V1, rd + 1);
6304                 }
6305             } else if ((insn & (1 << 11)) == 0) {
6306                 /* Two register misc.  */
6307                 op = ((insn >> 12) & 0x30) | ((insn >> 7) & 0xf);
6308                 size = (insn >> 18) & 3;
6309                 /* UNDEF for unknown op values and bad op-size combinations */
6310                 if ((neon_2rm_sizes[op] & (1 << size)) == 0) {
6311                     return 1;
6312                 }
6313                 if ((op != NEON_2RM_VMOVN && op != NEON_2RM_VQMOVN) &&
6314                     q && ((rm | rd) & 1)) {
6315                     return 1;
6316                 }
6317                 switch (op) {
6318                 case NEON_2RM_VREV64:
6319                     for (pass = 0; pass < (q ? 2 : 1); pass++) {
6320                         tmp = neon_load_reg(rm, pass * 2);
6321                         tmp2 = neon_load_reg(rm, pass * 2 + 1);
6322                         switch (size) {
6323                         case 0: tcg_gen_bswap32_i32(tmp, tmp); break;
6324                         case 1: gen_swap_half(tmp); break;
6325                         case 2: /* no-op */ break;
6326                         default: abort();
6327                         }
6328                         neon_store_reg(rd, pass * 2 + 1, tmp);
6329                         if (size == 2) {
6330                             neon_store_reg(rd, pass * 2, tmp2);
6331                         } else {
6332                             switch (size) {
6333                             case 0: tcg_gen_bswap32_i32(tmp2, tmp2); break;
6334                             case 1: gen_swap_half(tmp2); break;
6335                             default: abort();
6336                             }
6337                             neon_store_reg(rd, pass * 2, tmp2);
6338                         }
6339                     }
6340                     break;
6341                 case NEON_2RM_VPADDL: case NEON_2RM_VPADDL_U:
6342                 case NEON_2RM_VPADAL: case NEON_2RM_VPADAL_U:
6343                     for (pass = 0; pass < q + 1; pass++) {
6344                         tmp = neon_load_reg(rm, pass * 2);
6345                         gen_neon_widen(cpu_V0, tmp, size, op & 1);
6346                         tmp = neon_load_reg(rm, pass * 2 + 1);
6347                         gen_neon_widen(cpu_V1, tmp, size, op & 1);
6348                         switch (size) {
6349                         case 0: gen_helper_neon_paddl_u16(CPU_V001); break;
6350                         case 1: gen_helper_neon_paddl_u32(CPU_V001); break;
6351                         case 2: tcg_gen_add_i64(CPU_V001); break;
6352                         default: abort();
6353                         }
6354                         if (op >= NEON_2RM_VPADAL) {
6355                             /* Accumulate.  */
6356                             neon_load_reg64(cpu_V1, rd + pass);
6357                             gen_neon_addl(size);
6358                         }
6359                         neon_store_reg64(cpu_V0, rd + pass);
6360                     }
6361                     break;
6362                 case NEON_2RM_VTRN:
6363                     if (size == 2) {
6364                         int n;
6365                         for (n = 0; n < (q ? 4 : 2); n += 2) {
6366                             tmp = neon_load_reg(rm, n);
6367                             tmp2 = neon_load_reg(rd, n + 1);
6368                             neon_store_reg(rm, n, tmp2);
6369                             neon_store_reg(rd, n + 1, tmp);
6370                         }
6371                     } else {
6372                         goto elementwise;
6373                     }
6374                     break;
6375                 case NEON_2RM_VUZP:
6376                     if (gen_neon_unzip(rd, rm, size, q)) {
6377                         return 1;
6378                     }
6379                     break;
6380                 case NEON_2RM_VZIP:
6381                     if (gen_neon_zip(rd, rm, size, q)) {
6382                         return 1;
6383                     }
6384                     break;
6385                 case NEON_2RM_VMOVN: case NEON_2RM_VQMOVN:
6386                     /* also VQMOVUN; op field and mnemonics don't line up */
6387                     if (rm & 1) {
6388                         return 1;
6389                     }
6390                     TCGV_UNUSED_I32(tmp2);
6391                     for (pass = 0; pass < 2; pass++) {
6392                         neon_load_reg64(cpu_V0, rm + pass);
6393                         tmp = tcg_temp_new_i32();
6394                         gen_neon_narrow_op(op == NEON_2RM_VMOVN, q, size,
6395                                            tmp, cpu_V0);
6396                         if (pass == 0) {
6397                             tmp2 = tmp;
6398                         } else {
6399                             neon_store_reg(rd, 0, tmp2);
6400                             neon_store_reg(rd, 1, tmp);
6401                         }
6402                     }
6403                     break;
6404                 case NEON_2RM_VSHLL:
6405                     if (q || (rd & 1)) {
6406                         return 1;
6407                     }
6408                     tmp = neon_load_reg(rm, 0);
6409                     tmp2 = neon_load_reg(rm, 1);
6410                     for (pass = 0; pass < 2; pass++) {
6411                         if (pass == 1)
6412                             tmp = tmp2;
6413                         gen_neon_widen(cpu_V0, tmp, size, 1);
6414                         tcg_gen_shli_i64(cpu_V0, cpu_V0, 8 << size);
6415                         neon_store_reg64(cpu_V0, rd + pass);
6416                     }
6417                     break;
6418                 case NEON_2RM_VCVT_F16_F32:
6419                     if (!arm_feature(env, ARM_FEATURE_VFP_FP16) ||
6420                         q || (rm & 1)) {
6421                         return 1;
6422                     }
6423                     tmp = tcg_temp_new_i32();
6424                     tmp2 = tcg_temp_new_i32();
6425                     tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 0));
6426                     gen_helper_neon_fcvt_f32_to_f16(tmp, cpu_F0s, cpu_env);
6427                     tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 1));
6428                     gen_helper_neon_fcvt_f32_to_f16(tmp2, cpu_F0s, cpu_env);
6429                     tcg_gen_shli_i32(tmp2, tmp2, 16);
6430                     tcg_gen_or_i32(tmp2, tmp2, tmp);
6431                     tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 2));
6432                     gen_helper_neon_fcvt_f32_to_f16(tmp, cpu_F0s, cpu_env);
6433                     tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 3));
6434                     neon_store_reg(rd, 0, tmp2);
6435                     tmp2 = tcg_temp_new_i32();
6436                     gen_helper_neon_fcvt_f32_to_f16(tmp2, cpu_F0s, cpu_env);
6437                     tcg_gen_shli_i32(tmp2, tmp2, 16);
6438                     tcg_gen_or_i32(tmp2, tmp2, tmp);
6439                     neon_store_reg(rd, 1, tmp2);
6440                     tcg_temp_free_i32(tmp);
6441                     break;
6442                 case NEON_2RM_VCVT_F32_F16:
6443                     if (!arm_feature(env, ARM_FEATURE_VFP_FP16) ||
6444                         q || (rd & 1)) {
6445                         return 1;
6446                     }
6447                     tmp3 = tcg_temp_new_i32();
6448                     tmp = neon_load_reg(rm, 0);
6449                     tmp2 = neon_load_reg(rm, 1);
6450                     tcg_gen_ext16u_i32(tmp3, tmp);
6451                     gen_helper_neon_fcvt_f16_to_f32(cpu_F0s, tmp3, cpu_env);
6452                     tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 0));
6453                     tcg_gen_shri_i32(tmp3, tmp, 16);
6454                     gen_helper_neon_fcvt_f16_to_f32(cpu_F0s, tmp3, cpu_env);
6455                     tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 1));
6456                     tcg_temp_free_i32(tmp);
6457                     tcg_gen_ext16u_i32(tmp3, tmp2);
6458                     gen_helper_neon_fcvt_f16_to_f32(cpu_F0s, tmp3, cpu_env);
6459                     tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 2));
6460                     tcg_gen_shri_i32(tmp3, tmp2, 16);
6461                     gen_helper_neon_fcvt_f16_to_f32(cpu_F0s, tmp3, cpu_env);
6462                     tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 3));
6463                     tcg_temp_free_i32(tmp2);
6464                     tcg_temp_free_i32(tmp3);
6465                     break;
6466                 case NEON_2RM_AESE: case NEON_2RM_AESMC:
6467                     if (!arm_feature(env, ARM_FEATURE_V8_AES)
6468                         || ((rm | rd) & 1)) {
6469                         return 1;
6470                     }
6471                     tmp = tcg_const_i32(rd);
6472                     tmp2 = tcg_const_i32(rm);
6473
6474                      /* Bit 6 is the lowest opcode bit; it distinguishes between
6475                       * encryption (AESE/AESMC) and decryption (AESD/AESIMC)
6476                       */
6477                     tmp3 = tcg_const_i32(extract32(insn, 6, 1));
6478
6479                     if (op == NEON_2RM_AESE) {
6480                         gen_helper_crypto_aese(cpu_env, tmp, tmp2, tmp3);
6481                     } else {
6482                         gen_helper_crypto_aesmc(cpu_env, tmp, tmp2, tmp3);
6483                     }
6484                     tcg_temp_free_i32(tmp);
6485                     tcg_temp_free_i32(tmp2);
6486                     tcg_temp_free_i32(tmp3);
6487                     break;
6488                 default:
6489                 elementwise:
6490                     for (pass = 0; pass < (q ? 4 : 2); pass++) {
6491                         if (neon_2rm_is_float_op(op)) {
6492                             tcg_gen_ld_f32(cpu_F0s, cpu_env,
6493                                            neon_reg_offset(rm, pass));
6494                             TCGV_UNUSED_I32(tmp);
6495                         } else {
6496                             tmp = neon_load_reg(rm, pass);
6497                         }
6498                         switch (op) {
6499                         case NEON_2RM_VREV32:
6500                             switch (size) {
6501                             case 0: tcg_gen_bswap32_i32(tmp, tmp); break;
6502                             case 1: gen_swap_half(tmp); break;
6503                             default: abort();
6504                             }
6505                             break;
6506                         case NEON_2RM_VREV16:
6507                             gen_rev16(tmp);
6508                             break;
6509                         case NEON_2RM_VCLS:
6510                             switch (size) {
6511                             case 0: gen_helper_neon_cls_s8(tmp, tmp); break;
6512                             case 1: gen_helper_neon_cls_s16(tmp, tmp); break;
6513                             case 2: gen_helper_neon_cls_s32(tmp, tmp); break;
6514                             default: abort();
6515                             }
6516                             break;
6517                         case NEON_2RM_VCLZ:
6518                             switch (size) {
6519                             case 0: gen_helper_neon_clz_u8(tmp, tmp); break;
6520                             case 1: gen_helper_neon_clz_u16(tmp, tmp); break;
6521                             case 2: gen_helper_clz(tmp, tmp); break;
6522                             default: abort();
6523                             }
6524                             break;
6525                         case NEON_2RM_VCNT:
6526                             gen_helper_neon_cnt_u8(tmp, tmp);
6527                             break;
6528                         case NEON_2RM_VMVN:
6529                             tcg_gen_not_i32(tmp, tmp);
6530                             break;
6531                         case NEON_2RM_VQABS:
6532                             switch (size) {
6533                             case 0:
6534                                 gen_helper_neon_qabs_s8(tmp, cpu_env, tmp);
6535                                 break;
6536                             case 1:
6537                                 gen_helper_neon_qabs_s16(tmp, cpu_env, tmp);
6538                                 break;
6539                             case 2:
6540                                 gen_helper_neon_qabs_s32(tmp, cpu_env, tmp);
6541                                 break;
6542                             default: abort();
6543                             }
6544                             break;
6545                         case NEON_2RM_VQNEG:
6546                             switch (size) {
6547                             case 0:
6548                                 gen_helper_neon_qneg_s8(tmp, cpu_env, tmp);
6549                                 break;
6550                             case 1:
6551                                 gen_helper_neon_qneg_s16(tmp, cpu_env, tmp);
6552                                 break;
6553                             case 2:
6554                                 gen_helper_neon_qneg_s32(tmp, cpu_env, tmp);
6555                                 break;
6556                             default: abort();
6557                             }
6558                             break;
6559                         case NEON_2RM_VCGT0: case NEON_2RM_VCLE0:
6560                             tmp2 = tcg_const_i32(0);
6561                             switch(size) {
6562                             case 0: gen_helper_neon_cgt_s8(tmp, tmp, tmp2); break;
6563                             case 1: gen_helper_neon_cgt_s16(tmp, tmp, tmp2); break;
6564                             case 2: gen_helper_neon_cgt_s32(tmp, tmp, tmp2); break;
6565                             default: abort();
6566                             }
6567                             tcg_temp_free_i32(tmp2);
6568                             if (op == NEON_2RM_VCLE0) {
6569                                 tcg_gen_not_i32(tmp, tmp);
6570                             }
6571                             break;
6572                         case NEON_2RM_VCGE0: case NEON_2RM_VCLT0:
6573                             tmp2 = tcg_const_i32(0);
6574                             switch(size) {
6575                             case 0: gen_helper_neon_cge_s8(tmp, tmp, tmp2); break;
6576                             case 1: gen_helper_neon_cge_s16(tmp, tmp, tmp2); break;
6577                             case 2: gen_helper_neon_cge_s32(tmp, tmp, tmp2); break;
6578                             default: abort();
6579                             }
6580                             tcg_temp_free_i32(tmp2);
6581                             if (op == NEON_2RM_VCLT0) {
6582                                 tcg_gen_not_i32(tmp, tmp);
6583                             }
6584                             break;
6585                         case NEON_2RM_VCEQ0:
6586                             tmp2 = tcg_const_i32(0);
6587                             switch(size) {
6588                             case 0: gen_helper_neon_ceq_u8(tmp, tmp, tmp2); break;
6589                             case 1: gen_helper_neon_ceq_u16(tmp, tmp, tmp2); break;
6590                             case 2: gen_helper_neon_ceq_u32(tmp, tmp, tmp2); break;
6591                             default: abort();
6592                             }
6593                             tcg_temp_free_i32(tmp2);
6594                             break;
6595                         case NEON_2RM_VABS:
6596                             switch(size) {
6597                             case 0: gen_helper_neon_abs_s8(tmp, tmp); break;
6598                             case 1: gen_helper_neon_abs_s16(tmp, tmp); break;
6599                             case 2: tcg_gen_abs_i32(tmp, tmp); break;
6600                             default: abort();
6601                             }
6602                             break;
6603                         case NEON_2RM_VNEG:
6604                             tmp2 = tcg_const_i32(0);
6605                             gen_neon_rsb(size, tmp, tmp2);
6606                             tcg_temp_free_i32(tmp2);
6607                             break;
6608                         case NEON_2RM_VCGT0_F:
6609                         {
6610                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6611                             tmp2 = tcg_const_i32(0);
6612                             gen_helper_neon_cgt_f32(tmp, tmp, tmp2, fpstatus);
6613                             tcg_temp_free_i32(tmp2);
6614                             tcg_temp_free_ptr(fpstatus);
6615                             break;
6616                         }
6617                         case NEON_2RM_VCGE0_F:
6618                         {
6619                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6620                             tmp2 = tcg_const_i32(0);
6621                             gen_helper_neon_cge_f32(tmp, tmp, tmp2, fpstatus);
6622                             tcg_temp_free_i32(tmp2);
6623                             tcg_temp_free_ptr(fpstatus);
6624                             break;
6625                         }
6626                         case NEON_2RM_VCEQ0_F:
6627                         {
6628                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6629                             tmp2 = tcg_const_i32(0);
6630                             gen_helper_neon_ceq_f32(tmp, tmp, tmp2, fpstatus);
6631                             tcg_temp_free_i32(tmp2);
6632                             tcg_temp_free_ptr(fpstatus);
6633                             break;
6634                         }
6635                         case NEON_2RM_VCLE0_F:
6636                         {
6637                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6638                             tmp2 = tcg_const_i32(0);
6639                             gen_helper_neon_cge_f32(tmp, tmp2, tmp, fpstatus);
6640                             tcg_temp_free_i32(tmp2);
6641                             tcg_temp_free_ptr(fpstatus);
6642                             break;
6643                         }
6644                         case NEON_2RM_VCLT0_F:
6645                         {
6646                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6647                             tmp2 = tcg_const_i32(0);
6648                             gen_helper_neon_cgt_f32(tmp, tmp2, tmp, fpstatus);
6649                             tcg_temp_free_i32(tmp2);
6650                             tcg_temp_free_ptr(fpstatus);
6651                             break;
6652                         }
6653                         case NEON_2RM_VABS_F:
6654                             gen_vfp_abs(0);
6655                             break;
6656                         case NEON_2RM_VNEG_F:
6657                             gen_vfp_neg(0);
6658                             break;
6659                         case NEON_2RM_VSWP:
6660                             tmp2 = neon_load_reg(rd, pass);
6661                             neon_store_reg(rm, pass, tmp2);
6662                             break;
6663                         case NEON_2RM_VTRN:
6664                             tmp2 = neon_load_reg(rd, pass);
6665                             switch (size) {
6666                             case 0: gen_neon_trn_u8(tmp, tmp2); break;
6667                             case 1: gen_neon_trn_u16(tmp, tmp2); break;
6668                             default: abort();
6669                             }
6670                             neon_store_reg(rm, pass, tmp2);
6671                             break;
6672                         case NEON_2RM_VRINTN:
6673                         case NEON_2RM_VRINTA:
6674                         case NEON_2RM_VRINTM:
6675                         case NEON_2RM_VRINTP:
6676                         case NEON_2RM_VRINTZ:
6677                         {
6678                             TCGv_i32 tcg_rmode;
6679                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6680                             int rmode;
6681
6682                             if (op == NEON_2RM_VRINTZ) {
6683                                 rmode = FPROUNDING_ZERO;
6684                             } else {
6685                                 rmode = fp_decode_rm[((op & 0x6) >> 1) ^ 1];
6686                             }
6687
6688                             tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rmode));
6689                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
6690                                                       cpu_env);
6691                             gen_helper_rints(cpu_F0s, cpu_F0s, fpstatus);
6692                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
6693                                                       cpu_env);
6694                             tcg_temp_free_ptr(fpstatus);
6695                             tcg_temp_free_i32(tcg_rmode);
6696                             break;
6697                         }
6698                         case NEON_2RM_VRINTX:
6699                         {
6700                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6701                             gen_helper_rints_exact(cpu_F0s, cpu_F0s, fpstatus);
6702                             tcg_temp_free_ptr(fpstatus);
6703                             break;
6704                         }
6705                         case NEON_2RM_VCVTAU:
6706                         case NEON_2RM_VCVTAS:
6707                         case NEON_2RM_VCVTNU:
6708                         case NEON_2RM_VCVTNS:
6709                         case NEON_2RM_VCVTPU:
6710                         case NEON_2RM_VCVTPS:
6711                         case NEON_2RM_VCVTMU:
6712                         case NEON_2RM_VCVTMS:
6713                         {
6714                             bool is_signed = !extract32(insn, 7, 1);
6715                             TCGv_ptr fpst = get_fpstatus_ptr(1);
6716                             TCGv_i32 tcg_rmode, tcg_shift;
6717                             int rmode = fp_decode_rm[extract32(insn, 8, 2)];
6718
6719                             tcg_shift = tcg_const_i32(0);
6720                             tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rmode));
6721                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
6722                                                       cpu_env);
6723
6724                             if (is_signed) {
6725                                 gen_helper_vfp_tosls(cpu_F0s, cpu_F0s,
6726                                                      tcg_shift, fpst);
6727                             } else {
6728                                 gen_helper_vfp_touls(cpu_F0s, cpu_F0s,
6729                                                      tcg_shift, fpst);
6730                             }
6731
6732                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
6733                                                       cpu_env);
6734                             tcg_temp_free_i32(tcg_rmode);
6735                             tcg_temp_free_i32(tcg_shift);
6736                             tcg_temp_free_ptr(fpst);
6737                             break;
6738                         }
6739                         case NEON_2RM_VRECPE:
6740                         {
6741                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6742                             gen_helper_recpe_u32(tmp, tmp, fpstatus);
6743                             tcg_temp_free_ptr(fpstatus);
6744                             break;
6745                         }
6746                         case NEON_2RM_VRSQRTE:
6747                         {
6748                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6749                             gen_helper_rsqrte_u32(tmp, tmp, fpstatus);
6750                             tcg_temp_free_ptr(fpstatus);
6751                             break;
6752                         }
6753                         case NEON_2RM_VRECPE_F:
6754                         {
6755                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6756                             gen_helper_recpe_f32(cpu_F0s, cpu_F0s, fpstatus);
6757                             tcg_temp_free_ptr(fpstatus);
6758                             break;
6759                         }
6760                         case NEON_2RM_VRSQRTE_F:
6761                         {
6762                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6763                             gen_helper_rsqrte_f32(cpu_F0s, cpu_F0s, fpstatus);
6764                             tcg_temp_free_ptr(fpstatus);
6765                             break;
6766                         }
6767                         case NEON_2RM_VCVT_FS: /* VCVT.F32.S32 */
6768                             gen_vfp_sito(0, 1);
6769                             break;
6770                         case NEON_2RM_VCVT_FU: /* VCVT.F32.U32 */
6771                             gen_vfp_uito(0, 1);
6772                             break;
6773                         case NEON_2RM_VCVT_SF: /* VCVT.S32.F32 */
6774                             gen_vfp_tosiz(0, 1);
6775                             break;
6776                         case NEON_2RM_VCVT_UF: /* VCVT.U32.F32 */
6777                             gen_vfp_touiz(0, 1);
6778                             break;
6779                         default:
6780                             /* Reserved op values were caught by the
6781                              * neon_2rm_sizes[] check earlier.
6782                              */
6783                             abort();
6784                         }
6785                         if (neon_2rm_is_float_op(op)) {
6786                             tcg_gen_st_f32(cpu_F0s, cpu_env,
6787                                            neon_reg_offset(rd, pass));
6788                         } else {
6789                             neon_store_reg(rd, pass, tmp);
6790                         }
6791                     }
6792                     break;
6793                 }
6794             } else if ((insn & (1 << 10)) == 0) {
6795                 /* VTBL, VTBX.  */
6796                 int n = ((insn >> 8) & 3) + 1;
6797                 if ((rn + n) > 32) {
6798                     /* This is UNPREDICTABLE; we choose to UNDEF to avoid the
6799                      * helper function running off the end of the register file.
6800                      */
6801                     return 1;
6802                 }
6803                 n <<= 3;
6804                 if (insn & (1 << 6)) {
6805                     tmp = neon_load_reg(rd, 0);
6806                 } else {
6807                     tmp = tcg_temp_new_i32();
6808                     tcg_gen_movi_i32(tmp, 0);
6809                 }
6810                 tmp2 = neon_load_reg(rm, 0);
6811                 tmp4 = tcg_const_i32(rn);
6812                 tmp5 = tcg_const_i32(n);
6813                 gen_helper_neon_tbl(tmp2, cpu_env, tmp2, tmp, tmp4, tmp5);
6814                 tcg_temp_free_i32(tmp);
6815                 if (insn & (1 << 6)) {
6816                     tmp = neon_load_reg(rd, 1);
6817                 } else {
6818                     tmp = tcg_temp_new_i32();
6819                     tcg_gen_movi_i32(tmp, 0);
6820                 }
6821                 tmp3 = neon_load_reg(rm, 1);
6822                 gen_helper_neon_tbl(tmp3, cpu_env, tmp3, tmp, tmp4, tmp5);
6823                 tcg_temp_free_i32(tmp5);
6824                 tcg_temp_free_i32(tmp4);
6825                 neon_store_reg(rd, 0, tmp2);
6826                 neon_store_reg(rd, 1, tmp3);
6827                 tcg_temp_free_i32(tmp);
6828             } else if ((insn & 0x380) == 0) {
6829                 /* VDUP */
6830                 if ((insn & (7 << 16)) == 0 || (q && (rd & 1))) {
6831                     return 1;
6832                 }
6833                 if (insn & (1 << 19)) {
6834                     tmp = neon_load_reg(rm, 1);
6835                 } else {
6836                     tmp = neon_load_reg(rm, 0);
6837                 }
6838                 if (insn & (1 << 16)) {
6839                     gen_neon_dup_u8(tmp, ((insn >> 17) & 3) * 8);
6840                 } else if (insn & (1 << 17)) {
6841                     if ((insn >> 18) & 1)
6842                         gen_neon_dup_high16(tmp);
6843                     else
6844                         gen_neon_dup_low16(tmp);
6845                 }
6846                 for (pass = 0; pass < (q ? 4 : 2); pass++) {
6847                     tmp2 = tcg_temp_new_i32();
6848                     tcg_gen_mov_i32(tmp2, tmp);
6849                     neon_store_reg(rd, pass, tmp2);
6850                 }
6851                 tcg_temp_free_i32(tmp);
6852             } else {
6853                 return 1;
6854             }
6855         }
6856     }
6857     return 0;
6858 }
6859
6860 static int disas_coproc_insn(CPUARMState * env, DisasContext *s, uint32_t insn)
6861 {
6862     int cpnum, is64, crn, crm, opc1, opc2, isread, rt, rt2;
6863     const ARMCPRegInfo *ri;
6864
6865     cpnum = (insn >> 8) & 0xf;
6866     if (arm_feature(env, ARM_FEATURE_XSCALE)
6867             && ((env->cp15.c15_cpar ^ 0x3fff) & (1 << cpnum)))
6868         return 1;
6869
6870     /* First check for coprocessor space used for actual instructions */
6871     switch (cpnum) {
6872       case 0:
6873       case 1:
6874         if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
6875             return disas_iwmmxt_insn(env, s, insn);
6876         } else if (arm_feature(env, ARM_FEATURE_XSCALE)) {
6877             return disas_dsp_insn(env, s, insn);
6878         }
6879         return 1;
6880     default:
6881         break;
6882     }
6883
6884     /* Otherwise treat as a generic register access */
6885     is64 = (insn & (1 << 25)) == 0;
6886     if (!is64 && ((insn & (1 << 4)) == 0)) {
6887         /* cdp */
6888         return 1;
6889     }
6890
6891     crm = insn & 0xf;
6892     if (is64) {
6893         crn = 0;
6894         opc1 = (insn >> 4) & 0xf;
6895         opc2 = 0;
6896         rt2 = (insn >> 16) & 0xf;
6897     } else {
6898         crn = (insn >> 16) & 0xf;
6899         opc1 = (insn >> 21) & 7;
6900         opc2 = (insn >> 5) & 7;
6901         rt2 = 0;
6902     }
6903     isread = (insn >> 20) & 1;
6904     rt = (insn >> 12) & 0xf;
6905
6906     ri = get_arm_cp_reginfo(s->cp_regs,
6907                             ENCODE_CP_REG(cpnum, is64, crn, crm, opc1, opc2));
6908     if (ri) {
6909         /* Check access permissions */
6910         if (!cp_access_ok(s->current_pl, ri, isread)) {
6911             return 1;
6912         }
6913
6914         if (ri->accessfn) {
6915             /* Emit code to perform further access permissions checks at
6916              * runtime; this may result in an exception.
6917              */
6918             TCGv_ptr tmpptr;
6919             TCGv_i32 tcg_syn;
6920             uint32_t syndrome;
6921
6922             /* Note that since we are an implementation which takes an
6923              * exception on a trapped conditional instruction only if the
6924              * instruction passes its condition code check, we can take
6925              * advantage of the clause in the ARM ARM that allows us to set
6926              * the COND field in the instruction to 0xE in all cases.
6927              * We could fish the actual condition out of the insn (ARM)
6928              * or the condexec bits (Thumb) but it isn't necessary.
6929              */
6930             switch (cpnum) {
6931             case 14:
6932                 if (is64) {
6933                     syndrome = syn_cp14_rrt_trap(1, 0xe, opc1, crm, rt, rt2,
6934                                                  isread, s->thumb);
6935                 } else {
6936                     syndrome = syn_cp14_rt_trap(1, 0xe, opc1, opc2, crn, crm,
6937                                                 rt, isread, s->thumb);
6938                 }
6939                 break;
6940             case 15:
6941                 if (is64) {
6942                     syndrome = syn_cp15_rrt_trap(1, 0xe, opc1, crm, rt, rt2,
6943                                                  isread, s->thumb);
6944                 } else {
6945                     syndrome = syn_cp15_rt_trap(1, 0xe, opc1, opc2, crn, crm,
6946                                                 rt, isread, s->thumb);
6947                 }
6948                 break;
6949             default:
6950                 /* ARMv8 defines that only coprocessors 14 and 15 exist,
6951                  * so this can only happen if this is an ARMv7 or earlier CPU,
6952                  * in which case the syndrome information won't actually be
6953                  * guest visible.
6954                  */
6955                 assert(!arm_feature(env, ARM_FEATURE_V8));
6956                 syndrome = syn_uncategorized();
6957                 break;
6958             }
6959
6960             gen_set_pc_im(s, s->pc);
6961             tmpptr = tcg_const_ptr(ri);
6962             tcg_syn = tcg_const_i32(syndrome);
6963             gen_helper_access_check_cp_reg(cpu_env, tmpptr, tcg_syn);
6964             tcg_temp_free_ptr(tmpptr);
6965             tcg_temp_free_i32(tcg_syn);
6966         }
6967
6968         /* Handle special cases first */
6969         switch (ri->type & ~(ARM_CP_FLAG_MASK & ~ARM_CP_SPECIAL)) {
6970         case ARM_CP_NOP:
6971             return 0;
6972         case ARM_CP_WFI:
6973             if (isread) {
6974                 return 1;
6975             }
6976             gen_set_pc_im(s, s->pc);
6977             s->is_jmp = DISAS_WFI;
6978             return 0;
6979         default:
6980             break;
6981         }
6982
6983         if (use_icount && (ri->type & ARM_CP_IO)) {
6984             gen_io_start();
6985         }
6986
6987         if (isread) {
6988             /* Read */
6989             if (is64) {
6990                 TCGv_i64 tmp64;
6991                 TCGv_i32 tmp;
6992                 if (ri->type & ARM_CP_CONST) {
6993                     tmp64 = tcg_const_i64(ri->resetvalue);
6994                 } else if (ri->readfn) {
6995                     TCGv_ptr tmpptr;
6996                     tmp64 = tcg_temp_new_i64();
6997                     tmpptr = tcg_const_ptr(ri);
6998                     gen_helper_get_cp_reg64(tmp64, cpu_env, tmpptr);
6999                     tcg_temp_free_ptr(tmpptr);
7000                 } else {
7001                     tmp64 = tcg_temp_new_i64();
7002                     tcg_gen_ld_i64(tmp64, cpu_env, ri->fieldoffset);
7003                 }
7004                 tmp = tcg_temp_new_i32();
7005                 tcg_gen_trunc_i64_i32(tmp, tmp64);
7006                 store_reg(s, rt, tmp);
7007                 tcg_gen_shri_i64(tmp64, tmp64, 32);
7008                 tmp = tcg_temp_new_i32();
7009                 tcg_gen_trunc_i64_i32(tmp, tmp64);
7010                 tcg_temp_free_i64(tmp64);
7011                 store_reg(s, rt2, tmp);
7012             } else {
7013                 TCGv_i32 tmp;
7014                 if (ri->type & ARM_CP_CONST) {
7015                     tmp = tcg_const_i32(ri->resetvalue);
7016                 } else if (ri->readfn) {
7017                     TCGv_ptr tmpptr;
7018                     tmp = tcg_temp_new_i32();
7019                     tmpptr = tcg_const_ptr(ri);
7020                     gen_helper_get_cp_reg(tmp, cpu_env, tmpptr);
7021                     tcg_temp_free_ptr(tmpptr);
7022                 } else {
7023                     tmp = load_cpu_offset(ri->fieldoffset);
7024                 }
7025                 if (rt == 15) {
7026                     /* Destination register of r15 for 32 bit loads sets
7027                      * the condition codes from the high 4 bits of the value
7028                      */
7029                     gen_set_nzcv(tmp);
7030                     tcg_temp_free_i32(tmp);
7031                 } else {
7032                     store_reg(s, rt, tmp);
7033                 }
7034             }
7035         } else {
7036             /* Write */
7037             if (ri->type & ARM_CP_CONST) {
7038                 /* If not forbidden by access permissions, treat as WI */
7039                 return 0;
7040             }
7041
7042             if (is64) {
7043                 TCGv_i32 tmplo, tmphi;
7044                 TCGv_i64 tmp64 = tcg_temp_new_i64();
7045                 tmplo = load_reg(s, rt);
7046                 tmphi = load_reg(s, rt2);
7047                 tcg_gen_concat_i32_i64(tmp64, tmplo, tmphi);
7048                 tcg_temp_free_i32(tmplo);
7049                 tcg_temp_free_i32(tmphi);
7050                 if (ri->writefn) {
7051                     TCGv_ptr tmpptr = tcg_const_ptr(ri);
7052                     gen_helper_set_cp_reg64(cpu_env, tmpptr, tmp64);
7053                     tcg_temp_free_ptr(tmpptr);
7054                 } else {
7055                     tcg_gen_st_i64(tmp64, cpu_env, ri->fieldoffset);
7056                 }
7057                 tcg_temp_free_i64(tmp64);
7058             } else {
7059                 if (ri->writefn) {
7060                     TCGv_i32 tmp;
7061                     TCGv_ptr tmpptr;
7062                     tmp = load_reg(s, rt);
7063                     tmpptr = tcg_const_ptr(ri);
7064                     gen_helper_set_cp_reg(cpu_env, tmpptr, tmp);
7065                     tcg_temp_free_ptr(tmpptr);
7066                     tcg_temp_free_i32(tmp);
7067                 } else {
7068                     TCGv_i32 tmp = load_reg(s, rt);
7069                     store_cpu_offset(tmp, ri->fieldoffset);
7070                 }
7071             }
7072         }
7073
7074         if (use_icount && (ri->type & ARM_CP_IO)) {
7075             /* I/O operations must end the TB here (whether read or write) */
7076             gen_io_end();
7077             gen_lookup_tb(s);
7078         } else if (!isread && !(ri->type & ARM_CP_SUPPRESS_TB_END)) {
7079             /* We default to ending the TB on a coprocessor register write,
7080              * but allow this to be suppressed by the register definition
7081              * (usually only necessary to work around guest bugs).
7082              */
7083             gen_lookup_tb(s);
7084         }
7085
7086         return 0;
7087     }
7088
7089     /* Unknown register; this might be a guest error or a QEMU
7090      * unimplemented feature.
7091      */
7092     if (is64) {
7093         qemu_log_mask(LOG_UNIMP, "%s access to unsupported AArch32 "
7094                       "64 bit system register cp:%d opc1: %d crm:%d\n",
7095                       isread ? "read" : "write", cpnum, opc1, crm);
7096     } else {
7097         qemu_log_mask(LOG_UNIMP, "%s access to unsupported AArch32 "
7098                       "system register cp:%d opc1:%d crn:%d crm:%d opc2:%d\n",
7099                       isread ? "read" : "write", cpnum, opc1, crn, crm, opc2);
7100     }
7101
7102     return 1;
7103 }
7104
7105
7106 /* Store a 64-bit value to a register pair.  Clobbers val.  */
7107 static void gen_storeq_reg(DisasContext *s, int rlow, int rhigh, TCGv_i64 val)
7108 {
7109     TCGv_i32 tmp;
7110     tmp = tcg_temp_new_i32();
7111     tcg_gen_trunc_i64_i32(tmp, val);
7112     store_reg(s, rlow, tmp);
7113     tmp = tcg_temp_new_i32();
7114     tcg_gen_shri_i64(val, val, 32);
7115     tcg_gen_trunc_i64_i32(tmp, val);
7116     store_reg(s, rhigh, tmp);
7117 }
7118
7119 /* load a 32-bit value from a register and perform a 64-bit accumulate.  */
7120 static void gen_addq_lo(DisasContext *s, TCGv_i64 val, int rlow)
7121 {
7122     TCGv_i64 tmp;
7123     TCGv_i32 tmp2;
7124
7125     /* Load value and extend to 64 bits.  */
7126     tmp = tcg_temp_new_i64();
7127     tmp2 = load_reg(s, rlow);
7128     tcg_gen_extu_i32_i64(tmp, tmp2);
7129     tcg_temp_free_i32(tmp2);
7130     tcg_gen_add_i64(val, val, tmp);
7131     tcg_temp_free_i64(tmp);
7132 }
7133
7134 /* load and add a 64-bit value from a register pair.  */
7135 static void gen_addq(DisasContext *s, TCGv_i64 val, int rlow, int rhigh)
7136 {
7137     TCGv_i64 tmp;
7138     TCGv_i32 tmpl;
7139     TCGv_i32 tmph;
7140
7141     /* Load 64-bit value rd:rn.  */
7142     tmpl = load_reg(s, rlow);
7143     tmph = load_reg(s, rhigh);
7144     tmp = tcg_temp_new_i64();
7145     tcg_gen_concat_i32_i64(tmp, tmpl, tmph);
7146     tcg_temp_free_i32(tmpl);
7147     tcg_temp_free_i32(tmph);
7148     tcg_gen_add_i64(val, val, tmp);
7149     tcg_temp_free_i64(tmp);
7150 }
7151
7152 /* Set N and Z flags from hi|lo.  */
7153 static void gen_logicq_cc(TCGv_i32 lo, TCGv_i32 hi)
7154 {
7155     tcg_gen_mov_i32(cpu_NF, hi);
7156     tcg_gen_or_i32(cpu_ZF, lo, hi);
7157 }
7158
7159 /* Load/Store exclusive instructions are implemented by remembering
7160    the value/address loaded, and seeing if these are the same
7161    when the store is performed. This should be sufficient to implement
7162    the architecturally mandated semantics, and avoids having to monitor
7163    regular stores.
7164
7165    In system emulation mode only one CPU will be running at once, so
7166    this sequence is effectively atomic.  In user emulation mode we
7167    throw an exception and handle the atomic operation elsewhere.  */
7168 static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
7169                                TCGv_i32 addr, int size)
7170 {
7171     TCGv_i32 tmp = tcg_temp_new_i32();
7172
7173     switch (size) {
7174     case 0:
7175         gen_aa32_ld8u(tmp, addr, get_mem_index(s));
7176         break;
7177     case 1:
7178         gen_aa32_ld16u(tmp, addr, get_mem_index(s));
7179         break;
7180     case 2:
7181     case 3:
7182         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
7183         break;
7184     default:
7185         abort();
7186     }
7187
7188     if (size == 3) {
7189         TCGv_i32 tmp2 = tcg_temp_new_i32();
7190         TCGv_i32 tmp3 = tcg_temp_new_i32();
7191
7192         tcg_gen_addi_i32(tmp2, addr, 4);
7193         gen_aa32_ld32u(tmp3, tmp2, get_mem_index(s));
7194         tcg_temp_free_i32(tmp2);
7195         tcg_gen_concat_i32_i64(cpu_exclusive_val, tmp, tmp3);
7196         store_reg(s, rt2, tmp3);
7197     } else {
7198         tcg_gen_extu_i32_i64(cpu_exclusive_val, tmp);
7199     }
7200
7201     store_reg(s, rt, tmp);
7202     tcg_gen_extu_i32_i64(cpu_exclusive_addr, addr);
7203 }
7204
7205 static void gen_clrex(DisasContext *s)
7206 {
7207     tcg_gen_movi_i64(cpu_exclusive_addr, -1);
7208 }
7209
7210 #ifdef CONFIG_USER_ONLY
7211 static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
7212                                 TCGv_i32 addr, int size)
7213 {
7214     tcg_gen_extu_i32_i64(cpu_exclusive_test, addr);
7215     tcg_gen_movi_i32(cpu_exclusive_info,
7216                      size | (rd << 4) | (rt << 8) | (rt2 << 12));
7217     gen_exception_internal_insn(s, 4, EXCP_STREX);
7218 }
7219 #else
7220 static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
7221                                 TCGv_i32 addr, int size)
7222 {
7223     TCGv_i32 tmp;
7224     TCGv_i64 val64, extaddr;
7225     int done_label;
7226     int fail_label;
7227
7228     /* if (env->exclusive_addr == addr && env->exclusive_val == [addr]) {
7229          [addr] = {Rt};
7230          {Rd} = 0;
7231        } else {
7232          {Rd} = 1;
7233        } */
7234     fail_label = gen_new_label();
7235     done_label = gen_new_label();
7236     extaddr = tcg_temp_new_i64();
7237     tcg_gen_extu_i32_i64(extaddr, addr);
7238     tcg_gen_brcond_i64(TCG_COND_NE, extaddr, cpu_exclusive_addr, fail_label);
7239     tcg_temp_free_i64(extaddr);
7240
7241     tmp = tcg_temp_new_i32();
7242     switch (size) {
7243     case 0:
7244         gen_aa32_ld8u(tmp, addr, get_mem_index(s));
7245         break;
7246     case 1:
7247         gen_aa32_ld16u(tmp, addr, get_mem_index(s));
7248         break;
7249     case 2:
7250     case 3:
7251         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
7252         break;
7253     default:
7254         abort();
7255     }
7256
7257     val64 = tcg_temp_new_i64();
7258     if (size == 3) {
7259         TCGv_i32 tmp2 = tcg_temp_new_i32();
7260         TCGv_i32 tmp3 = tcg_temp_new_i32();
7261         tcg_gen_addi_i32(tmp2, addr, 4);
7262         gen_aa32_ld32u(tmp3, tmp2, get_mem_index(s));
7263         tcg_temp_free_i32(tmp2);
7264         tcg_gen_concat_i32_i64(val64, tmp, tmp3);
7265         tcg_temp_free_i32(tmp3);
7266     } else {
7267         tcg_gen_extu_i32_i64(val64, tmp);
7268     }
7269     tcg_temp_free_i32(tmp);
7270
7271     tcg_gen_brcond_i64(TCG_COND_NE, val64, cpu_exclusive_val, fail_label);
7272     tcg_temp_free_i64(val64);
7273
7274     tmp = load_reg(s, rt);
7275     switch (size) {
7276     case 0:
7277         gen_aa32_st8(tmp, addr, get_mem_index(s));
7278         break;
7279     case 1:
7280         gen_aa32_st16(tmp, addr, get_mem_index(s));
7281         break;
7282     case 2:
7283     case 3:
7284         gen_aa32_st32(tmp, addr, get_mem_index(s));
7285         break;
7286     default:
7287         abort();
7288     }
7289     tcg_temp_free_i32(tmp);
7290     if (size == 3) {
7291         tcg_gen_addi_i32(addr, addr, 4);
7292         tmp = load_reg(s, rt2);
7293         gen_aa32_st32(tmp, addr, get_mem_index(s));
7294         tcg_temp_free_i32(tmp);
7295     }
7296     tcg_gen_movi_i32(cpu_R[rd], 0);
7297     tcg_gen_br(done_label);
7298     gen_set_label(fail_label);
7299     tcg_gen_movi_i32(cpu_R[rd], 1);
7300     gen_set_label(done_label);
7301     tcg_gen_movi_i64(cpu_exclusive_addr, -1);
7302 }
7303 #endif
7304
7305 /* gen_srs:
7306  * @env: CPUARMState
7307  * @s: DisasContext
7308  * @mode: mode field from insn (which stack to store to)
7309  * @amode: addressing mode (DA/IA/DB/IB), encoded as per P,U bits in ARM insn
7310  * @writeback: true if writeback bit set
7311  *
7312  * Generate code for the SRS (Store Return State) insn.
7313  */
7314 static void gen_srs(DisasContext *s,
7315                     uint32_t mode, uint32_t amode, bool writeback)
7316 {
7317     int32_t offset;
7318     TCGv_i32 addr = tcg_temp_new_i32();
7319     TCGv_i32 tmp = tcg_const_i32(mode);
7320     gen_helper_get_r13_banked(addr, cpu_env, tmp);
7321     tcg_temp_free_i32(tmp);
7322     switch (amode) {
7323     case 0: /* DA */
7324         offset = -4;
7325         break;
7326     case 1: /* IA */
7327         offset = 0;
7328         break;
7329     case 2: /* DB */
7330         offset = -8;
7331         break;
7332     case 3: /* IB */
7333         offset = 4;
7334         break;
7335     default:
7336         abort();
7337     }
7338     tcg_gen_addi_i32(addr, addr, offset);
7339     tmp = load_reg(s, 14);
7340     gen_aa32_st32(tmp, addr, get_mem_index(s));
7341     tcg_temp_free_i32(tmp);
7342     tmp = load_cpu_field(spsr);
7343     tcg_gen_addi_i32(addr, addr, 4);
7344     gen_aa32_st32(tmp, addr, get_mem_index(s));
7345     tcg_temp_free_i32(tmp);
7346     if (writeback) {
7347         switch (amode) {
7348         case 0:
7349             offset = -8;
7350             break;
7351         case 1:
7352             offset = 4;
7353             break;
7354         case 2:
7355             offset = -4;
7356             break;
7357         case 3:
7358             offset = 0;
7359             break;
7360         default:
7361             abort();
7362         }
7363         tcg_gen_addi_i32(addr, addr, offset);
7364         tmp = tcg_const_i32(mode);
7365         gen_helper_set_r13_banked(cpu_env, tmp, addr);
7366         tcg_temp_free_i32(tmp);
7367     }
7368     tcg_temp_free_i32(addr);
7369 }
7370
7371 static void disas_arm_insn(CPUARMState * env, DisasContext *s)
7372 {
7373     unsigned int cond, insn, val, op1, i, shift, rm, rs, rn, rd, sh;
7374     TCGv_i32 tmp;
7375     TCGv_i32 tmp2;
7376     TCGv_i32 tmp3;
7377     TCGv_i32 addr;
7378     TCGv_i64 tmp64;
7379
7380     insn = arm_ldl_code(env, s->pc, s->bswap_code);
7381     s->pc += 4;
7382
7383     /* M variants do not implement ARM mode.  */
7384     if (IS_M(env))
7385         goto illegal_op;
7386     cond = insn >> 28;
7387     if (cond == 0xf){
7388         /* In ARMv3 and v4 the NV condition is UNPREDICTABLE; we
7389          * choose to UNDEF. In ARMv5 and above the space is used
7390          * for miscellaneous unconditional instructions.
7391          */
7392         ARCH(5);
7393
7394         /* Unconditional instructions.  */
7395         if (((insn >> 25) & 7) == 1) {
7396             /* NEON Data processing.  */
7397             if (!arm_feature(env, ARM_FEATURE_NEON))
7398                 goto illegal_op;
7399
7400             if (disas_neon_data_insn(env, s, insn))
7401                 goto illegal_op;
7402             return;
7403         }
7404         if ((insn & 0x0f100000) == 0x04000000) {
7405             /* NEON load/store.  */
7406             if (!arm_feature(env, ARM_FEATURE_NEON))
7407                 goto illegal_op;
7408
7409             if (disas_neon_ls_insn(env, s, insn))
7410                 goto illegal_op;
7411             return;
7412         }
7413         if ((insn & 0x0f000e10) == 0x0e000a00) {
7414             /* VFP.  */
7415             if (disas_vfp_insn(env, s, insn)) {
7416                 goto illegal_op;
7417             }
7418             return;
7419         }
7420         if (((insn & 0x0f30f000) == 0x0510f000) ||
7421             ((insn & 0x0f30f010) == 0x0710f000)) {
7422             if ((insn & (1 << 22)) == 0) {
7423                 /* PLDW; v7MP */
7424                 if (!arm_feature(env, ARM_FEATURE_V7MP)) {
7425                     goto illegal_op;
7426                 }
7427             }
7428             /* Otherwise PLD; v5TE+ */
7429             ARCH(5TE);
7430             return;
7431         }
7432         if (((insn & 0x0f70f000) == 0x0450f000) ||
7433             ((insn & 0x0f70f010) == 0x0650f000)) {
7434             ARCH(7);
7435             return; /* PLI; V7 */
7436         }
7437         if (((insn & 0x0f700000) == 0x04100000) ||
7438             ((insn & 0x0f700010) == 0x06100000)) {
7439             if (!arm_feature(env, ARM_FEATURE_V7MP)) {
7440                 goto illegal_op;
7441             }
7442             return; /* v7MP: Unallocated memory hint: must NOP */
7443         }
7444
7445         if ((insn & 0x0ffffdff) == 0x01010000) {
7446             ARCH(6);
7447             /* setend */
7448             if (((insn >> 9) & 1) != s->bswap_code) {
7449                 /* Dynamic endianness switching not implemented. */
7450                 qemu_log_mask(LOG_UNIMP, "arm: unimplemented setend\n");
7451                 goto illegal_op;
7452             }
7453             return;
7454         } else if ((insn & 0x0fffff00) == 0x057ff000) {
7455             switch ((insn >> 4) & 0xf) {
7456             case 1: /* clrex */
7457                 ARCH(6K);
7458                 gen_clrex(s);
7459                 return;
7460             case 4: /* dsb */
7461             case 5: /* dmb */
7462             case 6: /* isb */
7463                 ARCH(7);
7464                 /* We don't emulate caches so these are a no-op.  */
7465                 return;
7466             default:
7467                 goto illegal_op;
7468             }
7469         } else if ((insn & 0x0e5fffe0) == 0x084d0500) {
7470             /* srs */
7471             if (IS_USER(s)) {
7472                 goto illegal_op;
7473             }
7474             ARCH(6);
7475             gen_srs(s, (insn & 0x1f), (insn >> 23) & 3, insn & (1 << 21));
7476             return;
7477         } else if ((insn & 0x0e50ffe0) == 0x08100a00) {
7478             /* rfe */
7479             int32_t offset;
7480             if (IS_USER(s))
7481                 goto illegal_op;
7482             ARCH(6);
7483             rn = (insn >> 16) & 0xf;
7484             addr = load_reg(s, rn);
7485             i = (insn >> 23) & 3;
7486             switch (i) {
7487             case 0: offset = -4; break; /* DA */
7488             case 1: offset = 0; break; /* IA */
7489             case 2: offset = -8; break; /* DB */
7490             case 3: offset = 4; break; /* IB */
7491             default: abort();
7492             }
7493             if (offset)
7494                 tcg_gen_addi_i32(addr, addr, offset);
7495             /* Load PC into tmp and CPSR into tmp2.  */
7496             tmp = tcg_temp_new_i32();
7497             gen_aa32_ld32u(tmp, addr, get_mem_index(s));
7498             tcg_gen_addi_i32(addr, addr, 4);
7499             tmp2 = tcg_temp_new_i32();
7500             gen_aa32_ld32u(tmp2, addr, get_mem_index(s));
7501             if (insn & (1 << 21)) {
7502                 /* Base writeback.  */
7503                 switch (i) {
7504                 case 0: offset = -8; break;
7505                 case 1: offset = 4; break;
7506                 case 2: offset = -4; break;
7507                 case 3: offset = 0; break;
7508                 default: abort();
7509                 }
7510                 if (offset)
7511                     tcg_gen_addi_i32(addr, addr, offset);
7512                 store_reg(s, rn, addr);
7513             } else {
7514                 tcg_temp_free_i32(addr);
7515             }
7516             gen_rfe(s, tmp, tmp2);
7517             return;
7518         } else if ((insn & 0x0e000000) == 0x0a000000) {
7519             /* branch link and change to thumb (blx <offset>) */
7520             int32_t offset;
7521
7522             val = (uint32_t)s->pc;
7523             tmp = tcg_temp_new_i32();
7524             tcg_gen_movi_i32(tmp, val);
7525             store_reg(s, 14, tmp);
7526             /* Sign-extend the 24-bit offset */
7527             offset = (((int32_t)insn) << 8) >> 8;
7528             /* offset * 4 + bit24 * 2 + (thumb bit) */
7529             val += (offset << 2) | ((insn >> 23) & 2) | 1;
7530             /* pipeline offset */
7531             val += 4;
7532             /* protected by ARCH(5); above, near the start of uncond block */
7533             gen_bx_im(s, val);
7534             return;
7535         } else if ((insn & 0x0e000f00) == 0x0c000100) {
7536             if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
7537                 /* iWMMXt register transfer.  */
7538                 if (env->cp15.c15_cpar & (1 << 1))
7539                     if (!disas_iwmmxt_insn(env, s, insn))
7540                         return;
7541             }
7542         } else if ((insn & 0x0fe00000) == 0x0c400000) {
7543             /* Coprocessor double register transfer.  */
7544             ARCH(5TE);
7545         } else if ((insn & 0x0f000010) == 0x0e000010) {
7546             /* Additional coprocessor register transfer.  */
7547         } else if ((insn & 0x0ff10020) == 0x01000000) {
7548             uint32_t mask;
7549             uint32_t val;
7550             /* cps (privileged) */
7551             if (IS_USER(s))
7552                 return;
7553             mask = val = 0;
7554             if (insn & (1 << 19)) {
7555                 if (insn & (1 << 8))
7556                     mask |= CPSR_A;
7557                 if (insn & (1 << 7))
7558                     mask |= CPSR_I;
7559                 if (insn & (1 << 6))
7560                     mask |= CPSR_F;
7561                 if (insn & (1 << 18))
7562                     val |= mask;
7563             }
7564             if (insn & (1 << 17)) {
7565                 mask |= CPSR_M;
7566                 val |= (insn & 0x1f);
7567             }
7568             if (mask) {
7569                 gen_set_psr_im(s, mask, 0, val);
7570             }
7571             return;
7572         }
7573         goto illegal_op;
7574     }
7575     if (cond != 0xe) {
7576         /* if not always execute, we generate a conditional jump to
7577            next instruction */
7578         s->condlabel = gen_new_label();
7579         arm_gen_test_cc(cond ^ 1, s->condlabel);
7580         s->condjmp = 1;
7581     }
7582     if ((insn & 0x0f900000) == 0x03000000) {
7583         if ((insn & (1 << 21)) == 0) {
7584             ARCH(6T2);
7585             rd = (insn >> 12) & 0xf;
7586             val = ((insn >> 4) & 0xf000) | (insn & 0xfff);
7587             if ((insn & (1 << 22)) == 0) {
7588                 /* MOVW */
7589                 tmp = tcg_temp_new_i32();
7590                 tcg_gen_movi_i32(tmp, val);
7591             } else {
7592                 /* MOVT */
7593                 tmp = load_reg(s, rd);
7594                 tcg_gen_ext16u_i32(tmp, tmp);
7595                 tcg_gen_ori_i32(tmp, tmp, val << 16);
7596             }
7597             store_reg(s, rd, tmp);
7598         } else {
7599             if (((insn >> 12) & 0xf) != 0xf)
7600                 goto illegal_op;
7601             if (((insn >> 16) & 0xf) == 0) {
7602                 gen_nop_hint(s, insn & 0xff);
7603             } else {
7604                 /* CPSR = immediate */
7605                 val = insn & 0xff;
7606                 shift = ((insn >> 8) & 0xf) * 2;
7607                 if (shift)
7608                     val = (val >> shift) | (val << (32 - shift));
7609                 i = ((insn & (1 << 22)) != 0);
7610                 if (gen_set_psr_im(s, msr_mask(env, s, (insn >> 16) & 0xf, i), i, val))
7611                     goto illegal_op;
7612             }
7613         }
7614     } else if ((insn & 0x0f900000) == 0x01000000
7615                && (insn & 0x00000090) != 0x00000090) {
7616         /* miscellaneous instructions */
7617         op1 = (insn >> 21) & 3;
7618         sh = (insn >> 4) & 0xf;
7619         rm = insn & 0xf;
7620         switch (sh) {
7621         case 0x0: /* move program status register */
7622             if (op1 & 1) {
7623                 /* PSR = reg */
7624                 tmp = load_reg(s, rm);
7625                 i = ((op1 & 2) != 0);
7626                 if (gen_set_psr(s, msr_mask(env, s, (insn >> 16) & 0xf, i), i, tmp))
7627                     goto illegal_op;
7628             } else {
7629                 /* reg = PSR */
7630                 rd = (insn >> 12) & 0xf;
7631                 if (op1 & 2) {
7632                     if (IS_USER(s))
7633                         goto illegal_op;
7634                     tmp = load_cpu_field(spsr);
7635                 } else {
7636                     tmp = tcg_temp_new_i32();
7637                     gen_helper_cpsr_read(tmp, cpu_env);
7638                 }
7639                 store_reg(s, rd, tmp);
7640             }
7641             break;
7642         case 0x1:
7643             if (op1 == 1) {
7644                 /* branch/exchange thumb (bx).  */
7645                 ARCH(4T);
7646                 tmp = load_reg(s, rm);
7647                 gen_bx(s, tmp);
7648             } else if (op1 == 3) {
7649                 /* clz */
7650                 ARCH(5);
7651                 rd = (insn >> 12) & 0xf;
7652                 tmp = load_reg(s, rm);
7653                 gen_helper_clz(tmp, tmp);
7654                 store_reg(s, rd, tmp);
7655             } else {
7656                 goto illegal_op;
7657             }
7658             break;
7659         case 0x2:
7660             if (op1 == 1) {
7661                 ARCH(5J); /* bxj */
7662                 /* Trivial implementation equivalent to bx.  */
7663                 tmp = load_reg(s, rm);
7664                 gen_bx(s, tmp);
7665             } else {
7666                 goto illegal_op;
7667             }
7668             break;
7669         case 0x3:
7670             if (op1 != 1)
7671               goto illegal_op;
7672
7673             ARCH(5);
7674             /* branch link/exchange thumb (blx) */
7675             tmp = load_reg(s, rm);
7676             tmp2 = tcg_temp_new_i32();
7677             tcg_gen_movi_i32(tmp2, s->pc);
7678             store_reg(s, 14, tmp2);
7679             gen_bx(s, tmp);
7680             break;
7681         case 0x4:
7682         {
7683             /* crc32/crc32c */
7684             uint32_t c = extract32(insn, 8, 4);
7685
7686             /* Check this CPU supports ARMv8 CRC instructions.
7687              * op1 == 3 is UNPREDICTABLE but handle as UNDEFINED.
7688              * Bits 8, 10 and 11 should be zero.
7689              */
7690             if (!arm_feature(env, ARM_FEATURE_CRC) || op1 == 0x3 ||
7691                 (c & 0xd) != 0) {
7692                 goto illegal_op;
7693             }
7694
7695             rn = extract32(insn, 16, 4);
7696             rd = extract32(insn, 12, 4);
7697
7698             tmp = load_reg(s, rn);
7699             tmp2 = load_reg(s, rm);
7700             tmp3 = tcg_const_i32(1 << op1);
7701             if (c & 0x2) {
7702                 gen_helper_crc32c(tmp, tmp, tmp2, tmp3);
7703             } else {
7704                 gen_helper_crc32(tmp, tmp, tmp2, tmp3);
7705             }
7706             tcg_temp_free_i32(tmp2);
7707             tcg_temp_free_i32(tmp3);
7708             store_reg(s, rd, tmp);
7709             break;
7710         }
7711         case 0x5: /* saturating add/subtract */
7712             ARCH(5TE);
7713             rd = (insn >> 12) & 0xf;
7714             rn = (insn >> 16) & 0xf;
7715             tmp = load_reg(s, rm);
7716             tmp2 = load_reg(s, rn);
7717             if (op1 & 2)
7718                 gen_helper_double_saturate(tmp2, cpu_env, tmp2);
7719             if (op1 & 1)
7720                 gen_helper_sub_saturate(tmp, cpu_env, tmp, tmp2);
7721             else
7722                 gen_helper_add_saturate(tmp, cpu_env, tmp, tmp2);
7723             tcg_temp_free_i32(tmp2);
7724             store_reg(s, rd, tmp);
7725             break;
7726         case 7:
7727         {
7728             int imm16 = extract32(insn, 0, 4) | (extract32(insn, 8, 12) << 4);
7729             /* SMC instruction (op1 == 3)
7730                and undefined instructions (op1 == 0 || op1 == 2)
7731                will trap */
7732             if (op1 != 1) {
7733                 goto illegal_op;
7734             }
7735             /* bkpt */
7736             ARCH(5);
7737             gen_exception_insn(s, 4, EXCP_BKPT, syn_aa32_bkpt(imm16, false));
7738             break;
7739         }
7740         case 0x8: /* signed multiply */
7741         case 0xa:
7742         case 0xc:
7743         case 0xe:
7744             ARCH(5TE);
7745             rs = (insn >> 8) & 0xf;
7746             rn = (insn >> 12) & 0xf;
7747             rd = (insn >> 16) & 0xf;
7748             if (op1 == 1) {
7749                 /* (32 * 16) >> 16 */
7750                 tmp = load_reg(s, rm);
7751                 tmp2 = load_reg(s, rs);
7752                 if (sh & 4)
7753                     tcg_gen_sari_i32(tmp2, tmp2, 16);
7754                 else
7755                     gen_sxth(tmp2);
7756                 tmp64 = gen_muls_i64_i32(tmp, tmp2);
7757                 tcg_gen_shri_i64(tmp64, tmp64, 16);
7758                 tmp = tcg_temp_new_i32();
7759                 tcg_gen_trunc_i64_i32(tmp, tmp64);
7760                 tcg_temp_free_i64(tmp64);
7761                 if ((sh & 2) == 0) {
7762                     tmp2 = load_reg(s, rn);
7763                     gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
7764                     tcg_temp_free_i32(tmp2);
7765                 }
7766                 store_reg(s, rd, tmp);
7767             } else {
7768                 /* 16 * 16 */
7769                 tmp = load_reg(s, rm);
7770                 tmp2 = load_reg(s, rs);
7771                 gen_mulxy(tmp, tmp2, sh & 2, sh & 4);
7772                 tcg_temp_free_i32(tmp2);
7773                 if (op1 == 2) {
7774                     tmp64 = tcg_temp_new_i64();
7775                     tcg_gen_ext_i32_i64(tmp64, tmp);
7776                     tcg_temp_free_i32(tmp);
7777                     gen_addq(s, tmp64, rn, rd);
7778                     gen_storeq_reg(s, rn, rd, tmp64);
7779                     tcg_temp_free_i64(tmp64);
7780                 } else {
7781                     if (op1 == 0) {
7782                         tmp2 = load_reg(s, rn);
7783                         gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
7784                         tcg_temp_free_i32(tmp2);
7785                     }
7786                     store_reg(s, rd, tmp);
7787                 }
7788             }
7789             break;
7790         default:
7791             goto illegal_op;
7792         }
7793     } else if (((insn & 0x0e000000) == 0 &&
7794                 (insn & 0x00000090) != 0x90) ||
7795                ((insn & 0x0e000000) == (1 << 25))) {
7796         int set_cc, logic_cc, shiftop;
7797
7798         op1 = (insn >> 21) & 0xf;
7799         set_cc = (insn >> 20) & 1;
7800         logic_cc = table_logic_cc[op1] & set_cc;
7801
7802         /* data processing instruction */
7803         if (insn & (1 << 25)) {
7804             /* immediate operand */
7805             val = insn & 0xff;
7806             shift = ((insn >> 8) & 0xf) * 2;
7807             if (shift) {
7808                 val = (val >> shift) | (val << (32 - shift));
7809             }
7810             tmp2 = tcg_temp_new_i32();
7811             tcg_gen_movi_i32(tmp2, val);
7812             if (logic_cc && shift) {
7813                 gen_set_CF_bit31(tmp2);
7814             }
7815         } else {
7816             /* register */
7817             rm = (insn) & 0xf;
7818             tmp2 = load_reg(s, rm);
7819             shiftop = (insn >> 5) & 3;
7820             if (!(insn & (1 << 4))) {
7821                 shift = (insn >> 7) & 0x1f;
7822                 gen_arm_shift_im(tmp2, shiftop, shift, logic_cc);
7823             } else {
7824                 rs = (insn >> 8) & 0xf;
7825                 tmp = load_reg(s, rs);
7826                 gen_arm_shift_reg(tmp2, shiftop, tmp, logic_cc);
7827             }
7828         }
7829         if (op1 != 0x0f && op1 != 0x0d) {
7830             rn = (insn >> 16) & 0xf;
7831             tmp = load_reg(s, rn);
7832         } else {
7833             TCGV_UNUSED_I32(tmp);
7834         }
7835         rd = (insn >> 12) & 0xf;
7836         switch(op1) {
7837         case 0x00:
7838             tcg_gen_and_i32(tmp, tmp, tmp2);
7839             if (logic_cc) {
7840                 gen_logic_CC(tmp);
7841             }
7842             store_reg_bx(env, s, rd, tmp);
7843             break;
7844         case 0x01:
7845             tcg_gen_xor_i32(tmp, tmp, tmp2);
7846             if (logic_cc) {
7847                 gen_logic_CC(tmp);
7848             }
7849             store_reg_bx(env, s, rd, tmp);
7850             break;
7851         case 0x02:
7852             if (set_cc && rd == 15) {
7853                 /* SUBS r15, ... is used for exception return.  */
7854                 if (IS_USER(s)) {
7855                     goto illegal_op;
7856                 }
7857                 gen_sub_CC(tmp, tmp, tmp2);
7858                 gen_exception_return(s, tmp);
7859             } else {
7860                 if (set_cc) {
7861                     gen_sub_CC(tmp, tmp, tmp2);
7862                 } else {
7863                     tcg_gen_sub_i32(tmp, tmp, tmp2);
7864                 }
7865                 store_reg_bx(env, s, rd, tmp);
7866             }
7867             break;
7868         case 0x03:
7869             if (set_cc) {
7870                 gen_sub_CC(tmp, tmp2, tmp);
7871             } else {
7872                 tcg_gen_sub_i32(tmp, tmp2, tmp);
7873             }
7874             store_reg_bx(env, s, rd, tmp);
7875             break;
7876         case 0x04:
7877             if (set_cc) {
7878                 gen_add_CC(tmp, tmp, tmp2);
7879             } else {
7880                 tcg_gen_add_i32(tmp, tmp, tmp2);
7881             }
7882             store_reg_bx(env, s, rd, tmp);
7883             break;
7884         case 0x05:
7885             if (set_cc) {
7886                 gen_adc_CC(tmp, tmp, tmp2);
7887             } else {
7888                 gen_add_carry(tmp, tmp, tmp2);
7889             }
7890             store_reg_bx(env, s, rd, tmp);
7891             break;
7892         case 0x06:
7893             if (set_cc) {
7894                 gen_sbc_CC(tmp, tmp, tmp2);
7895             } else {
7896                 gen_sub_carry(tmp, tmp, tmp2);
7897             }
7898             store_reg_bx(env, s, rd, tmp);
7899             break;
7900         case 0x07:
7901             if (set_cc) {
7902                 gen_sbc_CC(tmp, tmp2, tmp);
7903             } else {
7904                 gen_sub_carry(tmp, tmp2, tmp);
7905             }
7906             store_reg_bx(env, s, rd, tmp);
7907             break;
7908         case 0x08:
7909             if (set_cc) {
7910                 tcg_gen_and_i32(tmp, tmp, tmp2);
7911                 gen_logic_CC(tmp);
7912             }
7913             tcg_temp_free_i32(tmp);
7914             break;
7915         case 0x09:
7916             if (set_cc) {
7917                 tcg_gen_xor_i32(tmp, tmp, tmp2);
7918                 gen_logic_CC(tmp);
7919             }
7920             tcg_temp_free_i32(tmp);
7921             break;
7922         case 0x0a:
7923             if (set_cc) {
7924                 gen_sub_CC(tmp, tmp, tmp2);
7925             }
7926             tcg_temp_free_i32(tmp);
7927             break;
7928         case 0x0b:
7929             if (set_cc) {
7930                 gen_add_CC(tmp, tmp, tmp2);
7931             }
7932             tcg_temp_free_i32(tmp);
7933             break;
7934         case 0x0c:
7935             tcg_gen_or_i32(tmp, tmp, tmp2);
7936             if (logic_cc) {
7937                 gen_logic_CC(tmp);
7938             }
7939             store_reg_bx(env, s, rd, tmp);
7940             break;
7941         case 0x0d:
7942             if (logic_cc && rd == 15) {
7943                 /* MOVS r15, ... is used for exception return.  */
7944                 if (IS_USER(s)) {
7945                     goto illegal_op;
7946                 }
7947                 gen_exception_return(s, tmp2);
7948             } else {
7949                 if (logic_cc) {
7950                     gen_logic_CC(tmp2);
7951                 }
7952                 store_reg_bx(env, s, rd, tmp2);
7953             }
7954             break;
7955         case 0x0e:
7956             tcg_gen_andc_i32(tmp, tmp, tmp2);
7957             if (logic_cc) {
7958                 gen_logic_CC(tmp);
7959             }
7960             store_reg_bx(env, s, rd, tmp);
7961             break;
7962         default:
7963         case 0x0f:
7964             tcg_gen_not_i32(tmp2, tmp2);
7965             if (logic_cc) {
7966                 gen_logic_CC(tmp2);
7967             }
7968             store_reg_bx(env, s, rd, tmp2);
7969             break;
7970         }
7971         if (op1 != 0x0f && op1 != 0x0d) {
7972             tcg_temp_free_i32(tmp2);
7973         }
7974     } else {
7975         /* other instructions */
7976         op1 = (insn >> 24) & 0xf;
7977         switch(op1) {
7978         case 0x0:
7979         case 0x1:
7980             /* multiplies, extra load/stores */
7981             sh = (insn >> 5) & 3;
7982             if (sh == 0) {
7983                 if (op1 == 0x0) {
7984                     rd = (insn >> 16) & 0xf;
7985                     rn = (insn >> 12) & 0xf;
7986                     rs = (insn >> 8) & 0xf;
7987                     rm = (insn) & 0xf;
7988                     op1 = (insn >> 20) & 0xf;
7989                     switch (op1) {
7990                     case 0: case 1: case 2: case 3: case 6:
7991                         /* 32 bit mul */
7992                         tmp = load_reg(s, rs);
7993                         tmp2 = load_reg(s, rm);
7994                         tcg_gen_mul_i32(tmp, tmp, tmp2);
7995                         tcg_temp_free_i32(tmp2);
7996                         if (insn & (1 << 22)) {
7997                             /* Subtract (mls) */
7998                             ARCH(6T2);
7999                             tmp2 = load_reg(s, rn);
8000                             tcg_gen_sub_i32(tmp, tmp2, tmp);
8001                             tcg_temp_free_i32(tmp2);
8002                         } else if (insn & (1 << 21)) {
8003                             /* Add */
8004                             tmp2 = load_reg(s, rn);
8005                             tcg_gen_add_i32(tmp, tmp, tmp2);
8006                             tcg_temp_free_i32(tmp2);
8007                         }
8008                         if (insn & (1 << 20))
8009                             gen_logic_CC(tmp);
8010                         store_reg(s, rd, tmp);
8011                         break;
8012                     case 4:
8013                         /* 64 bit mul double accumulate (UMAAL) */
8014                         ARCH(6);
8015                         tmp = load_reg(s, rs);
8016                         tmp2 = load_reg(s, rm);
8017                         tmp64 = gen_mulu_i64_i32(tmp, tmp2);
8018                         gen_addq_lo(s, tmp64, rn);
8019                         gen_addq_lo(s, tmp64, rd);
8020                         gen_storeq_reg(s, rn, rd, tmp64);
8021                         tcg_temp_free_i64(tmp64);
8022                         break;
8023                     case 8: case 9: case 10: case 11:
8024                     case 12: case 13: case 14: case 15:
8025                         /* 64 bit mul: UMULL, UMLAL, SMULL, SMLAL. */
8026                         tmp = load_reg(s, rs);
8027                         tmp2 = load_reg(s, rm);
8028                         if (insn & (1 << 22)) {
8029                             tcg_gen_muls2_i32(tmp, tmp2, tmp, tmp2);
8030                         } else {
8031                             tcg_gen_mulu2_i32(tmp, tmp2, tmp, tmp2);
8032                         }
8033                         if (insn & (1 << 21)) { /* mult accumulate */
8034                             TCGv_i32 al = load_reg(s, rn);
8035                             TCGv_i32 ah = load_reg(s, rd);
8036                             tcg_gen_add2_i32(tmp, tmp2, tmp, tmp2, al, ah);
8037                             tcg_temp_free_i32(al);
8038                             tcg_temp_free_i32(ah);
8039                         }
8040                         if (insn & (1 << 20)) {
8041                             gen_logicq_cc(tmp, tmp2);
8042                         }
8043                         store_reg(s, rn, tmp);
8044                         store_reg(s, rd, tmp2);
8045                         break;
8046                     default:
8047                         goto illegal_op;
8048                     }
8049                 } else {
8050                     rn = (insn >> 16) & 0xf;
8051                     rd = (insn >> 12) & 0xf;
8052                     if (insn & (1 << 23)) {
8053                         /* load/store exclusive */
8054                         int op2 = (insn >> 8) & 3;
8055                         op1 = (insn >> 21) & 0x3;
8056
8057                         switch (op2) {
8058                         case 0: /* lda/stl */
8059                             if (op1 == 1) {
8060                                 goto illegal_op;
8061                             }
8062                             ARCH(8);
8063                             break;
8064                         case 1: /* reserved */
8065                             goto illegal_op;
8066                         case 2: /* ldaex/stlex */
8067                             ARCH(8);
8068                             break;
8069                         case 3: /* ldrex/strex */
8070                             if (op1) {
8071                                 ARCH(6K);
8072                             } else {
8073                                 ARCH(6);
8074                             }
8075                             break;
8076                         }
8077
8078                         addr = tcg_temp_local_new_i32();
8079                         load_reg_var(s, addr, rn);
8080
8081                         /* Since the emulation does not have barriers,
8082                            the acquire/release semantics need no special
8083                            handling */
8084                         if (op2 == 0) {
8085                             if (insn & (1 << 20)) {
8086                                 tmp = tcg_temp_new_i32();
8087                                 switch (op1) {
8088                                 case 0: /* lda */
8089                                     gen_aa32_ld32u(tmp, addr, get_mem_index(s));
8090                                     break;
8091                                 case 2: /* ldab */
8092                                     gen_aa32_ld8u(tmp, addr, get_mem_index(s));
8093                                     break;
8094                                 case 3: /* ldah */
8095                                     gen_aa32_ld16u(tmp, addr, get_mem_index(s));
8096                                     break;
8097                                 default:
8098                                     abort();
8099                                 }
8100                                 store_reg(s, rd, tmp);
8101                             } else {
8102                                 rm = insn & 0xf;
8103                                 tmp = load_reg(s, rm);
8104                                 switch (op1) {
8105                                 case 0: /* stl */
8106                                     gen_aa32_st32(tmp, addr, get_mem_index(s));
8107                                     break;
8108                                 case 2: /* stlb */
8109                                     gen_aa32_st8(tmp, addr, get_mem_index(s));
8110                                     break;
8111                                 case 3: /* stlh */
8112                                     gen_aa32_st16(tmp, addr, get_mem_index(s));
8113                                     break;
8114                                 default:
8115                                     abort();
8116                                 }
8117                                 tcg_temp_free_i32(tmp);
8118                             }
8119                         } else if (insn & (1 << 20)) {
8120                             switch (op1) {
8121                             case 0: /* ldrex */
8122                                 gen_load_exclusive(s, rd, 15, addr, 2);
8123                                 break;
8124                             case 1: /* ldrexd */
8125                                 gen_load_exclusive(s, rd, rd + 1, addr, 3);
8126                                 break;
8127                             case 2: /* ldrexb */
8128                                 gen_load_exclusive(s, rd, 15, addr, 0);
8129                                 break;
8130                             case 3: /* ldrexh */
8131                                 gen_load_exclusive(s, rd, 15, addr, 1);
8132                                 break;
8133                             default:
8134                                 abort();
8135                             }
8136                         } else {
8137                             rm = insn & 0xf;
8138                             switch (op1) {
8139                             case 0:  /*  strex */
8140                                 gen_store_exclusive(s, rd, rm, 15, addr, 2);
8141                                 break;
8142                             case 1: /*  strexd */
8143                                 gen_store_exclusive(s, rd, rm, rm + 1, addr, 3);
8144                                 break;
8145                             case 2: /*  strexb */
8146                                 gen_store_exclusive(s, rd, rm, 15, addr, 0);
8147                                 break;
8148                             case 3: /* strexh */
8149                                 gen_store_exclusive(s, rd, rm, 15, addr, 1);
8150                                 break;
8151                             default:
8152                                 abort();
8153                             }
8154                         }
8155                         tcg_temp_free_i32(addr);
8156                     } else {
8157                         /* SWP instruction */
8158                         rm = (insn) & 0xf;
8159
8160                         /* ??? This is not really atomic.  However we know
8161                            we never have multiple CPUs running in parallel,
8162                            so it is good enough.  */
8163                         addr = load_reg(s, rn);
8164                         tmp = load_reg(s, rm);
8165                         tmp2 = tcg_temp_new_i32();
8166                         if (insn & (1 << 22)) {
8167                             gen_aa32_ld8u(tmp2, addr, get_mem_index(s));
8168                             gen_aa32_st8(tmp, addr, get_mem_index(s));
8169                         } else {
8170                             gen_aa32_ld32u(tmp2, addr, get_mem_index(s));
8171                             gen_aa32_st32(tmp, addr, get_mem_index(s));
8172                         }
8173                         tcg_temp_free_i32(tmp);
8174                         tcg_temp_free_i32(addr);
8175                         store_reg(s, rd, tmp2);
8176                     }
8177                 }
8178             } else {
8179                 int address_offset;
8180                 int load;
8181                 /* Misc load/store */
8182                 rn = (insn >> 16) & 0xf;
8183                 rd = (insn >> 12) & 0xf;
8184                 addr = load_reg(s, rn);
8185                 if (insn & (1 << 24))
8186                     gen_add_datah_offset(s, insn, 0, addr);
8187                 address_offset = 0;
8188                 if (insn & (1 << 20)) {
8189                     /* load */
8190                     tmp = tcg_temp_new_i32();
8191                     switch(sh) {
8192                     case 1:
8193                         gen_aa32_ld16u(tmp, addr, get_mem_index(s));
8194                         break;
8195                     case 2:
8196                         gen_aa32_ld8s(tmp, addr, get_mem_index(s));
8197                         break;
8198                     default:
8199                     case 3:
8200                         gen_aa32_ld16s(tmp, addr, get_mem_index(s));
8201                         break;
8202                     }
8203                     load = 1;
8204                 } else if (sh & 2) {
8205                     ARCH(5TE);
8206                     /* doubleword */
8207                     if (sh & 1) {
8208                         /* store */
8209                         tmp = load_reg(s, rd);
8210                         gen_aa32_st32(tmp, addr, get_mem_index(s));
8211                         tcg_temp_free_i32(tmp);
8212                         tcg_gen_addi_i32(addr, addr, 4);
8213                         tmp = load_reg(s, rd + 1);
8214                         gen_aa32_st32(tmp, addr, get_mem_index(s));
8215                         tcg_temp_free_i32(tmp);
8216                         load = 0;
8217                     } else {
8218                         /* load */
8219                         tmp = tcg_temp_new_i32();
8220                         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
8221                         store_reg(s, rd, tmp);
8222                         tcg_gen_addi_i32(addr, addr, 4);
8223                         tmp = tcg_temp_new_i32();
8224                         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
8225                         rd++;
8226                         load = 1;
8227                     }
8228                     address_offset = -4;
8229                 } else {
8230                     /* store */
8231                     tmp = load_reg(s, rd);
8232                     gen_aa32_st16(tmp, addr, get_mem_index(s));
8233                     tcg_temp_free_i32(tmp);
8234                     load = 0;
8235                 }
8236                 /* Perform base writeback before the loaded value to
8237                    ensure correct behavior with overlapping index registers.
8238                    ldrd with base writeback is is undefined if the
8239                    destination and index registers overlap.  */
8240                 if (!(insn & (1 << 24))) {
8241                     gen_add_datah_offset(s, insn, address_offset, addr);
8242                     store_reg(s, rn, addr);
8243                 } else if (insn & (1 << 21)) {
8244                     if (address_offset)
8245                         tcg_gen_addi_i32(addr, addr, address_offset);
8246                     store_reg(s, rn, addr);
8247                 } else {
8248                     tcg_temp_free_i32(addr);
8249                 }
8250                 if (load) {
8251                     /* Complete the load.  */
8252                     store_reg(s, rd, tmp);
8253                 }
8254             }
8255             break;
8256         case 0x4:
8257         case 0x5:
8258             goto do_ldst;
8259         case 0x6:
8260         case 0x7:
8261             if (insn & (1 << 4)) {
8262                 ARCH(6);
8263                 /* Armv6 Media instructions.  */
8264                 rm = insn & 0xf;
8265                 rn = (insn >> 16) & 0xf;
8266                 rd = (insn >> 12) & 0xf;
8267                 rs = (insn >> 8) & 0xf;
8268                 switch ((insn >> 23) & 3) {
8269                 case 0: /* Parallel add/subtract.  */
8270                     op1 = (insn >> 20) & 7;
8271                     tmp = load_reg(s, rn);
8272                     tmp2 = load_reg(s, rm);
8273                     sh = (insn >> 5) & 7;
8274                     if ((op1 & 3) == 0 || sh == 5 || sh == 6)
8275                         goto illegal_op;
8276                     gen_arm_parallel_addsub(op1, sh, tmp, tmp2);
8277                     tcg_temp_free_i32(tmp2);
8278                     store_reg(s, rd, tmp);
8279                     break;
8280                 case 1:
8281                     if ((insn & 0x00700020) == 0) {
8282                         /* Halfword pack.  */
8283                         tmp = load_reg(s, rn);
8284                         tmp2 = load_reg(s, rm);
8285                         shift = (insn >> 7) & 0x1f;
8286                         if (insn & (1 << 6)) {
8287                             /* pkhtb */
8288                             if (shift == 0)
8289                                 shift = 31;
8290                             tcg_gen_sari_i32(tmp2, tmp2, shift);
8291                             tcg_gen_andi_i32(tmp, tmp, 0xffff0000);
8292                             tcg_gen_ext16u_i32(tmp2, tmp2);
8293                         } else {
8294                             /* pkhbt */
8295                             if (shift)
8296                                 tcg_gen_shli_i32(tmp2, tmp2, shift);
8297                             tcg_gen_ext16u_i32(tmp, tmp);
8298                             tcg_gen_andi_i32(tmp2, tmp2, 0xffff0000);
8299                         }
8300                         tcg_gen_or_i32(tmp, tmp, tmp2);
8301                         tcg_temp_free_i32(tmp2);
8302                         store_reg(s, rd, tmp);
8303                     } else if ((insn & 0x00200020) == 0x00200000) {
8304                         /* [us]sat */
8305                         tmp = load_reg(s, rm);
8306                         shift = (insn >> 7) & 0x1f;
8307                         if (insn & (1 << 6)) {
8308                             if (shift == 0)
8309                                 shift = 31;
8310                             tcg_gen_sari_i32(tmp, tmp, shift);
8311                         } else {
8312                             tcg_gen_shli_i32(tmp, tmp, shift);
8313                         }
8314                         sh = (insn >> 16) & 0x1f;
8315                         tmp2 = tcg_const_i32(sh);
8316                         if (insn & (1 << 22))
8317                           gen_helper_usat(tmp, cpu_env, tmp, tmp2);
8318                         else
8319                           gen_helper_ssat(tmp, cpu_env, tmp, tmp2);
8320                         tcg_temp_free_i32(tmp2);
8321                         store_reg(s, rd, tmp);
8322                     } else if ((insn & 0x00300fe0) == 0x00200f20) {
8323                         /* [us]sat16 */
8324                         tmp = load_reg(s, rm);
8325                         sh = (insn >> 16) & 0x1f;
8326                         tmp2 = tcg_const_i32(sh);
8327                         if (insn & (1 << 22))
8328                           gen_helper_usat16(tmp, cpu_env, tmp, tmp2);
8329                         else
8330                           gen_helper_ssat16(tmp, cpu_env, tmp, tmp2);
8331                         tcg_temp_free_i32(tmp2);
8332                         store_reg(s, rd, tmp);
8333                     } else if ((insn & 0x00700fe0) == 0x00000fa0) {
8334                         /* Select bytes.  */
8335                         tmp = load_reg(s, rn);
8336                         tmp2 = load_reg(s, rm);
8337                         tmp3 = tcg_temp_new_i32();
8338                         tcg_gen_ld_i32(tmp3, cpu_env, offsetof(CPUARMState, GE));
8339                         gen_helper_sel_flags(tmp, tmp3, tmp, tmp2);
8340                         tcg_temp_free_i32(tmp3);
8341                         tcg_temp_free_i32(tmp2);
8342                         store_reg(s, rd, tmp);
8343                     } else if ((insn & 0x000003e0) == 0x00000060) {
8344                         tmp = load_reg(s, rm);
8345                         shift = (insn >> 10) & 3;
8346                         /* ??? In many cases it's not necessary to do a
8347                            rotate, a shift is sufficient.  */
8348                         if (shift != 0)
8349                             tcg_gen_rotri_i32(tmp, tmp, shift * 8);
8350                         op1 = (insn >> 20) & 7;
8351                         switch (op1) {
8352                         case 0: gen_sxtb16(tmp);  break;
8353                         case 2: gen_sxtb(tmp);    break;
8354                         case 3: gen_sxth(tmp);    break;
8355                         case 4: gen_uxtb16(tmp);  break;
8356                         case 6: gen_uxtb(tmp);    break;
8357                         case 7: gen_uxth(tmp);    break;
8358                         default: goto illegal_op;
8359                         }
8360                         if (rn != 15) {
8361                             tmp2 = load_reg(s, rn);
8362                             if ((op1 & 3) == 0) {
8363                                 gen_add16(tmp, tmp2);
8364                             } else {
8365                                 tcg_gen_add_i32(tmp, tmp, tmp2);
8366                                 tcg_temp_free_i32(tmp2);
8367                             }
8368                         }
8369                         store_reg(s, rd, tmp);
8370                     } else if ((insn & 0x003f0f60) == 0x003f0f20) {
8371                         /* rev */
8372                         tmp = load_reg(s, rm);
8373                         if (insn & (1 << 22)) {
8374                             if (insn & (1 << 7)) {
8375                                 gen_revsh(tmp);
8376                             } else {
8377                                 ARCH(6T2);
8378                                 gen_helper_rbit(tmp, tmp);
8379                             }
8380                         } else {
8381                             if (insn & (1 << 7))
8382                                 gen_rev16(tmp);
8383                             else
8384                                 tcg_gen_bswap32_i32(tmp, tmp);
8385                         }
8386                         store_reg(s, rd, tmp);
8387                     } else {
8388                         goto illegal_op;
8389                     }
8390                     break;
8391                 case 2: /* Multiplies (Type 3).  */
8392                     switch ((insn >> 20) & 0x7) {
8393                     case 5:
8394                         if (((insn >> 6) ^ (insn >> 7)) & 1) {
8395                             /* op2 not 00x or 11x : UNDEF */
8396                             goto illegal_op;
8397                         }
8398                         /* Signed multiply most significant [accumulate].
8399                            (SMMUL, SMMLA, SMMLS) */
8400                         tmp = load_reg(s, rm);
8401                         tmp2 = load_reg(s, rs);
8402                         tmp64 = gen_muls_i64_i32(tmp, tmp2);
8403
8404                         if (rd != 15) {
8405                             tmp = load_reg(s, rd);
8406                             if (insn & (1 << 6)) {
8407                                 tmp64 = gen_subq_msw(tmp64, tmp);
8408                             } else {
8409                                 tmp64 = gen_addq_msw(tmp64, tmp);
8410                             }
8411                         }
8412                         if (insn & (1 << 5)) {
8413                             tcg_gen_addi_i64(tmp64, tmp64, 0x80000000u);
8414                         }
8415                         tcg_gen_shri_i64(tmp64, tmp64, 32);
8416                         tmp = tcg_temp_new_i32();
8417                         tcg_gen_trunc_i64_i32(tmp, tmp64);
8418                         tcg_temp_free_i64(tmp64);
8419                         store_reg(s, rn, tmp);
8420                         break;
8421                     case 0:
8422                     case 4:
8423                         /* SMLAD, SMUAD, SMLSD, SMUSD, SMLALD, SMLSLD */
8424                         if (insn & (1 << 7)) {
8425                             goto illegal_op;
8426                         }
8427                         tmp = load_reg(s, rm);
8428                         tmp2 = load_reg(s, rs);
8429                         if (insn & (1 << 5))
8430                             gen_swap_half(tmp2);
8431                         gen_smul_dual(tmp, tmp2);
8432                         if (insn & (1 << 22)) {
8433                             /* smlald, smlsld */
8434                             TCGv_i64 tmp64_2;
8435
8436                             tmp64 = tcg_temp_new_i64();
8437                             tmp64_2 = tcg_temp_new_i64();
8438                             tcg_gen_ext_i32_i64(tmp64, tmp);
8439                             tcg_gen_ext_i32_i64(tmp64_2, tmp2);
8440                             tcg_temp_free_i32(tmp);
8441                             tcg_temp_free_i32(tmp2);
8442                             if (insn & (1 << 6)) {
8443                                 tcg_gen_sub_i64(tmp64, tmp64, tmp64_2);
8444                             } else {
8445                                 tcg_gen_add_i64(tmp64, tmp64, tmp64_2);
8446                             }
8447                             tcg_temp_free_i64(tmp64_2);
8448                             gen_addq(s, tmp64, rd, rn);
8449                             gen_storeq_reg(s, rd, rn, tmp64);
8450                             tcg_temp_free_i64(tmp64);
8451                         } else {
8452                             /* smuad, smusd, smlad, smlsd */
8453                             if (insn & (1 << 6)) {
8454                                 /* This subtraction cannot overflow. */
8455                                 tcg_gen_sub_i32(tmp, tmp, tmp2);
8456                             } else {
8457                                 /* This addition cannot overflow 32 bits;
8458                                  * however it may overflow considered as a
8459                                  * signed operation, in which case we must set
8460                                  * the Q flag.
8461                                  */
8462                                 gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
8463                             }
8464                             tcg_temp_free_i32(tmp2);
8465                             if (rd != 15)
8466                               {
8467                                 tmp2 = load_reg(s, rd);
8468                                 gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
8469                                 tcg_temp_free_i32(tmp2);
8470                               }
8471                             store_reg(s, rn, tmp);
8472                         }
8473                         break;
8474                     case 1:
8475                     case 3:
8476                         /* SDIV, UDIV */
8477                         if (!arm_feature(env, ARM_FEATURE_ARM_DIV)) {
8478                             goto illegal_op;
8479                         }
8480                         if (((insn >> 5) & 7) || (rd != 15)) {
8481                             goto illegal_op;
8482                         }
8483                         tmp = load_reg(s, rm);
8484                         tmp2 = load_reg(s, rs);
8485                         if (insn & (1 << 21)) {
8486                             gen_helper_udiv(tmp, tmp, tmp2);
8487                         } else {
8488                             gen_helper_sdiv(tmp, tmp, tmp2);
8489                         }
8490                         tcg_temp_free_i32(tmp2);
8491                         store_reg(s, rn, tmp);
8492                         break;
8493                     default:
8494                         goto illegal_op;
8495                     }
8496                     break;
8497                 case 3:
8498                     op1 = ((insn >> 17) & 0x38) | ((insn >> 5) & 7);
8499                     switch (op1) {
8500                     case 0: /* Unsigned sum of absolute differences.  */
8501                         ARCH(6);
8502                         tmp = load_reg(s, rm);
8503                         tmp2 = load_reg(s, rs);
8504                         gen_helper_usad8(tmp, tmp, tmp2);
8505                         tcg_temp_free_i32(tmp2);
8506                         if (rd != 15) {
8507                             tmp2 = load_reg(s, rd);
8508                             tcg_gen_add_i32(tmp, tmp, tmp2);
8509                             tcg_temp_free_i32(tmp2);
8510                         }
8511                         store_reg(s, rn, tmp);
8512                         break;
8513                     case 0x20: case 0x24: case 0x28: case 0x2c:
8514                         /* Bitfield insert/clear.  */
8515                         ARCH(6T2);
8516                         shift = (insn >> 7) & 0x1f;
8517                         i = (insn >> 16) & 0x1f;
8518                         i = i + 1 - shift;
8519                         if (rm == 15) {
8520                             tmp = tcg_temp_new_i32();
8521                             tcg_gen_movi_i32(tmp, 0);
8522                         } else {
8523                             tmp = load_reg(s, rm);
8524                         }
8525                         if (i != 32) {
8526                             tmp2 = load_reg(s, rd);
8527                             tcg_gen_deposit_i32(tmp, tmp2, tmp, shift, i);
8528                             tcg_temp_free_i32(tmp2);
8529                         }
8530                         store_reg(s, rd, tmp);
8531                         break;
8532                     case 0x12: case 0x16: case 0x1a: case 0x1e: /* sbfx */
8533                     case 0x32: case 0x36: case 0x3a: case 0x3e: /* ubfx */
8534                         ARCH(6T2);
8535                         tmp = load_reg(s, rm);
8536                         shift = (insn >> 7) & 0x1f;
8537                         i = ((insn >> 16) & 0x1f) + 1;
8538                         if (shift + i > 32)
8539                             goto illegal_op;
8540                         if (i < 32) {
8541                             if (op1 & 0x20) {
8542                                 gen_ubfx(tmp, shift, (1u << i) - 1);
8543                             } else {
8544                                 gen_sbfx(tmp, shift, i);
8545                             }
8546                         }
8547                         store_reg(s, rd, tmp);
8548                         break;
8549                     default:
8550                         goto illegal_op;
8551                     }
8552                     break;
8553                 }
8554                 break;
8555             }
8556         do_ldst:
8557             /* Check for undefined extension instructions
8558              * per the ARM Bible IE:
8559              * xxxx 0111 1111 xxxx  xxxx xxxx 1111 xxxx
8560              */
8561             sh = (0xf << 20) | (0xf << 4);
8562             if (op1 == 0x7 && ((insn & sh) == sh))
8563             {
8564                 goto illegal_op;
8565             }
8566             /* load/store byte/word */
8567             rn = (insn >> 16) & 0xf;
8568             rd = (insn >> 12) & 0xf;
8569             tmp2 = load_reg(s, rn);
8570             if ((insn & 0x01200000) == 0x00200000) {
8571                 /* ldrt/strt */
8572                 i = MMU_USER_IDX;
8573             } else {
8574                 i = get_mem_index(s);
8575             }
8576             if (insn & (1 << 24))
8577                 gen_add_data_offset(s, insn, tmp2);
8578             if (insn & (1 << 20)) {
8579                 /* load */
8580                 tmp = tcg_temp_new_i32();
8581                 if (insn & (1 << 22)) {
8582                     gen_aa32_ld8u(tmp, tmp2, i);
8583                 } else {
8584                     gen_aa32_ld32u(tmp, tmp2, i);
8585                 }
8586             } else {
8587                 /* store */
8588                 tmp = load_reg(s, rd);
8589                 if (insn & (1 << 22)) {
8590                     gen_aa32_st8(tmp, tmp2, i);
8591                 } else {
8592                     gen_aa32_st32(tmp, tmp2, i);
8593                 }
8594                 tcg_temp_free_i32(tmp);
8595             }
8596             if (!(insn & (1 << 24))) {
8597                 gen_add_data_offset(s, insn, tmp2);
8598                 store_reg(s, rn, tmp2);
8599             } else if (insn & (1 << 21)) {
8600                 store_reg(s, rn, tmp2);
8601             } else {
8602                 tcg_temp_free_i32(tmp2);
8603             }
8604             if (insn & (1 << 20)) {
8605                 /* Complete the load.  */
8606                 store_reg_from_load(env, s, rd, tmp);
8607             }
8608             break;
8609         case 0x08:
8610         case 0x09:
8611             {
8612                 int j, n, user, loaded_base;
8613                 TCGv_i32 loaded_var;
8614                 /* load/store multiple words */
8615                 /* XXX: store correct base if write back */
8616                 user = 0;
8617                 if (insn & (1 << 22)) {
8618                     if (IS_USER(s))
8619                         goto illegal_op; /* only usable in supervisor mode */
8620
8621                     if ((insn & (1 << 15)) == 0)
8622                         user = 1;
8623                 }
8624                 rn = (insn >> 16) & 0xf;
8625                 addr = load_reg(s, rn);
8626
8627                 /* compute total size */
8628                 loaded_base = 0;
8629                 TCGV_UNUSED_I32(loaded_var);
8630                 n = 0;
8631                 for(i=0;i<16;i++) {
8632                     if (insn & (1 << i))
8633                         n++;
8634                 }
8635                 /* XXX: test invalid n == 0 case ? */
8636                 if (insn & (1 << 23)) {
8637                     if (insn & (1 << 24)) {
8638                         /* pre increment */
8639                         tcg_gen_addi_i32(addr, addr, 4);
8640                     } else {
8641                         /* post increment */
8642                     }
8643                 } else {
8644                     if (insn & (1 << 24)) {
8645                         /* pre decrement */
8646                         tcg_gen_addi_i32(addr, addr, -(n * 4));
8647                     } else {
8648                         /* post decrement */
8649                         if (n != 1)
8650                         tcg_gen_addi_i32(addr, addr, -((n - 1) * 4));
8651                     }
8652                 }
8653                 j = 0;
8654                 for(i=0;i<16;i++) {
8655                     if (insn & (1 << i)) {
8656                         if (insn & (1 << 20)) {
8657                             /* load */
8658                             tmp = tcg_temp_new_i32();
8659                             gen_aa32_ld32u(tmp, addr, get_mem_index(s));
8660                             if (user) {
8661                                 tmp2 = tcg_const_i32(i);
8662                                 gen_helper_set_user_reg(cpu_env, tmp2, tmp);
8663                                 tcg_temp_free_i32(tmp2);
8664                                 tcg_temp_free_i32(tmp);
8665                             } else if (i == rn) {
8666                                 loaded_var = tmp;
8667                                 loaded_base = 1;
8668                             } else {
8669                                 store_reg_from_load(env, s, i, tmp);
8670                             }
8671                         } else {
8672                             /* store */
8673                             if (i == 15) {
8674                                 /* special case: r15 = PC + 8 */
8675                                 val = (long)s->pc + 4;
8676                                 tmp = tcg_temp_new_i32();
8677                                 tcg_gen_movi_i32(tmp, val);
8678                             } else if (user) {
8679                                 tmp = tcg_temp_new_i32();
8680                                 tmp2 = tcg_const_i32(i);
8681                                 gen_helper_get_user_reg(tmp, cpu_env, tmp2);
8682                                 tcg_temp_free_i32(tmp2);
8683                             } else {
8684                                 tmp = load_reg(s, i);
8685                             }
8686                             gen_aa32_st32(tmp, addr, get_mem_index(s));
8687                             tcg_temp_free_i32(tmp);
8688                         }
8689                         j++;
8690                         /* no need to add after the last transfer */
8691                         if (j != n)
8692                             tcg_gen_addi_i32(addr, addr, 4);
8693                     }
8694                 }
8695                 if (insn & (1 << 21)) {
8696                     /* write back */
8697                     if (insn & (1 << 23)) {
8698                         if (insn & (1 << 24)) {
8699                             /* pre increment */
8700                         } else {
8701                             /* post increment */
8702                             tcg_gen_addi_i32(addr, addr, 4);
8703                         }
8704                     } else {
8705                         if (insn & (1 << 24)) {
8706                             /* pre decrement */
8707                             if (n != 1)
8708                                 tcg_gen_addi_i32(addr, addr, -((n - 1) * 4));
8709                         } else {
8710                             /* post decrement */
8711                             tcg_gen_addi_i32(addr, addr, -(n * 4));
8712                         }
8713                     }
8714                     store_reg(s, rn, addr);
8715                 } else {
8716                     tcg_temp_free_i32(addr);
8717                 }
8718                 if (loaded_base) {
8719                     store_reg(s, rn, loaded_var);
8720                 }
8721                 if ((insn & (1 << 22)) && !user) {
8722                     /* Restore CPSR from SPSR.  */
8723                     tmp = load_cpu_field(spsr);
8724                     gen_set_cpsr(tmp, 0xffffffff);
8725                     tcg_temp_free_i32(tmp);
8726                     s->is_jmp = DISAS_UPDATE;
8727                 }
8728             }
8729             break;
8730         case 0xa:
8731         case 0xb:
8732             {
8733                 int32_t offset;
8734
8735                 /* branch (and link) */
8736                 val = (int32_t)s->pc;
8737                 if (insn & (1 << 24)) {
8738                     tmp = tcg_temp_new_i32();
8739                     tcg_gen_movi_i32(tmp, val);
8740                     store_reg(s, 14, tmp);
8741                 }
8742                 offset = sextract32(insn << 2, 0, 26);
8743                 val += offset + 4;
8744                 gen_jmp(s, val);
8745             }
8746             break;
8747         case 0xc:
8748         case 0xd:
8749         case 0xe:
8750             if (((insn >> 8) & 0xe) == 10) {
8751                 /* VFP.  */
8752                 if (disas_vfp_insn(env, s, insn)) {
8753                     goto illegal_op;
8754                 }
8755             } else if (disas_coproc_insn(env, s, insn)) {
8756                 /* Coprocessor.  */
8757                 goto illegal_op;
8758             }
8759             break;
8760         case 0xf:
8761             /* swi */
8762             gen_set_pc_im(s, s->pc);
8763             s->svc_imm = extract32(insn, 0, 24);
8764             s->is_jmp = DISAS_SWI;
8765             break;
8766         default:
8767         illegal_op:
8768             gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized());
8769             break;
8770         }
8771     }
8772 }
8773
8774 /* Return true if this is a Thumb-2 logical op.  */
8775 static int
8776 thumb2_logic_op(int op)
8777 {
8778     return (op < 8);
8779 }
8780
8781 /* Generate code for a Thumb-2 data processing operation.  If CONDS is nonzero
8782    then set condition code flags based on the result of the operation.
8783    If SHIFTER_OUT is nonzero then set the carry flag for logical operations
8784    to the high bit of T1.
8785    Returns zero if the opcode is valid.  */
8786
8787 static int
8788 gen_thumb2_data_op(DisasContext *s, int op, int conds, uint32_t shifter_out,
8789                    TCGv_i32 t0, TCGv_i32 t1)
8790 {
8791     int logic_cc;
8792
8793     logic_cc = 0;
8794     switch (op) {
8795     case 0: /* and */
8796         tcg_gen_and_i32(t0, t0, t1);
8797         logic_cc = conds;
8798         break;
8799     case 1: /* bic */
8800         tcg_gen_andc_i32(t0, t0, t1);
8801         logic_cc = conds;
8802         break;
8803     case 2: /* orr */
8804         tcg_gen_or_i32(t0, t0, t1);
8805         logic_cc = conds;
8806         break;
8807     case 3: /* orn */
8808         tcg_gen_orc_i32(t0, t0, t1);
8809         logic_cc = conds;
8810         break;
8811     case 4: /* eor */
8812         tcg_gen_xor_i32(t0, t0, t1);
8813         logic_cc = conds;
8814         break;
8815     case 8: /* add */
8816         if (conds)
8817             gen_add_CC(t0, t0, t1);
8818         else
8819             tcg_gen_add_i32(t0, t0, t1);
8820         break;
8821     case 10: /* adc */
8822         if (conds)
8823             gen_adc_CC(t0, t0, t1);
8824         else
8825             gen_adc(t0, t1);
8826         break;
8827     case 11: /* sbc */
8828         if (conds) {
8829             gen_sbc_CC(t0, t0, t1);
8830         } else {
8831             gen_sub_carry(t0, t0, t1);
8832         }
8833         break;
8834     case 13: /* sub */
8835         if (conds)
8836             gen_sub_CC(t0, t0, t1);
8837         else
8838             tcg_gen_sub_i32(t0, t0, t1);
8839         break;
8840     case 14: /* rsb */
8841         if (conds)
8842             gen_sub_CC(t0, t1, t0);
8843         else
8844             tcg_gen_sub_i32(t0, t1, t0);
8845         break;
8846     default: /* 5, 6, 7, 9, 12, 15. */
8847         return 1;
8848     }
8849     if (logic_cc) {
8850         gen_logic_CC(t0);
8851         if (shifter_out)
8852             gen_set_CF_bit31(t1);
8853     }
8854     return 0;
8855 }
8856
8857 /* Translate a 32-bit thumb instruction.  Returns nonzero if the instruction
8858    is not legal.  */
8859 static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw1)
8860 {
8861     uint32_t insn, imm, shift, offset;
8862     uint32_t rd, rn, rm, rs;
8863     TCGv_i32 tmp;
8864     TCGv_i32 tmp2;
8865     TCGv_i32 tmp3;
8866     TCGv_i32 addr;
8867     TCGv_i64 tmp64;
8868     int op;
8869     int shiftop;
8870     int conds;
8871     int logic_cc;
8872
8873     if (!(arm_feature(env, ARM_FEATURE_THUMB2)
8874           || arm_feature (env, ARM_FEATURE_M))) {
8875         /* Thumb-1 cores may need to treat bl and blx as a pair of
8876            16-bit instructions to get correct prefetch abort behavior.  */
8877         insn = insn_hw1;
8878         if ((insn & (1 << 12)) == 0) {
8879             ARCH(5);
8880             /* Second half of blx.  */
8881             offset = ((insn & 0x7ff) << 1);
8882             tmp = load_reg(s, 14);
8883             tcg_gen_addi_i32(tmp, tmp, offset);
8884             tcg_gen_andi_i32(tmp, tmp, 0xfffffffc);
8885
8886             tmp2 = tcg_temp_new_i32();
8887             tcg_gen_movi_i32(tmp2, s->pc | 1);
8888             store_reg(s, 14, tmp2);
8889             gen_bx(s, tmp);
8890             return 0;
8891         }
8892         if (insn & (1 << 11)) {
8893             /* Second half of bl.  */
8894             offset = ((insn & 0x7ff) << 1) | 1;
8895             tmp = load_reg(s, 14);
8896             tcg_gen_addi_i32(tmp, tmp, offset);
8897
8898             tmp2 = tcg_temp_new_i32();
8899             tcg_gen_movi_i32(tmp2, s->pc | 1);
8900             store_reg(s, 14, tmp2);
8901             gen_bx(s, tmp);
8902             return 0;
8903         }
8904         if ((s->pc & ~TARGET_PAGE_MASK) == 0) {
8905             /* Instruction spans a page boundary.  Implement it as two
8906                16-bit instructions in case the second half causes an
8907                prefetch abort.  */
8908             offset = ((int32_t)insn << 21) >> 9;
8909             tcg_gen_movi_i32(cpu_R[14], s->pc + 2 + offset);
8910             return 0;
8911         }
8912         /* Fall through to 32-bit decode.  */
8913     }
8914
8915     insn = arm_lduw_code(env, s->pc, s->bswap_code);
8916     s->pc += 2;
8917     insn |= (uint32_t)insn_hw1 << 16;
8918
8919     if ((insn & 0xf800e800) != 0xf000e800) {
8920         ARCH(6T2);
8921     }
8922
8923     rn = (insn >> 16) & 0xf;
8924     rs = (insn >> 12) & 0xf;
8925     rd = (insn >> 8) & 0xf;
8926     rm = insn & 0xf;
8927     switch ((insn >> 25) & 0xf) {
8928     case 0: case 1: case 2: case 3:
8929         /* 16-bit instructions.  Should never happen.  */
8930         abort();
8931     case 4:
8932         if (insn & (1 << 22)) {
8933             /* Other load/store, table branch.  */
8934             if (insn & 0x01200000) {
8935                 /* Load/store doubleword.  */
8936                 if (rn == 15) {
8937                     addr = tcg_temp_new_i32();
8938                     tcg_gen_movi_i32(addr, s->pc & ~3);
8939                 } else {
8940                     addr = load_reg(s, rn);
8941                 }
8942                 offset = (insn & 0xff) * 4;
8943                 if ((insn & (1 << 23)) == 0)
8944                     offset = -offset;
8945                 if (insn & (1 << 24)) {
8946                     tcg_gen_addi_i32(addr, addr, offset);
8947                     offset = 0;
8948                 }
8949                 if (insn & (1 << 20)) {
8950                     /* ldrd */
8951                     tmp = tcg_temp_new_i32();
8952                     gen_aa32_ld32u(tmp, addr, get_mem_index(s));
8953                     store_reg(s, rs, tmp);
8954                     tcg_gen_addi_i32(addr, addr, 4);
8955                     tmp = tcg_temp_new_i32();
8956                     gen_aa32_ld32u(tmp, addr, get_mem_index(s));
8957                     store_reg(s, rd, tmp);
8958                 } else {
8959                     /* strd */
8960                     tmp = load_reg(s, rs);
8961                     gen_aa32_st32(tmp, addr, get_mem_index(s));
8962                     tcg_temp_free_i32(tmp);
8963                     tcg_gen_addi_i32(addr, addr, 4);
8964                     tmp = load_reg(s, rd);
8965                     gen_aa32_st32(tmp, addr, get_mem_index(s));
8966                     tcg_temp_free_i32(tmp);
8967                 }
8968                 if (insn & (1 << 21)) {
8969                     /* Base writeback.  */
8970                     if (rn == 15)
8971                         goto illegal_op;
8972                     tcg_gen_addi_i32(addr, addr, offset - 4);
8973                     store_reg(s, rn, addr);
8974                 } else {
8975                     tcg_temp_free_i32(addr);
8976                 }
8977             } else if ((insn & (1 << 23)) == 0) {
8978                 /* Load/store exclusive word.  */
8979                 addr = tcg_temp_local_new_i32();
8980                 load_reg_var(s, addr, rn);
8981                 tcg_gen_addi_i32(addr, addr, (insn & 0xff) << 2);
8982                 if (insn & (1 << 20)) {
8983                     gen_load_exclusive(s, rs, 15, addr, 2);
8984                 } else {
8985                     gen_store_exclusive(s, rd, rs, 15, addr, 2);
8986                 }
8987                 tcg_temp_free_i32(addr);
8988             } else if ((insn & (7 << 5)) == 0) {
8989                 /* Table Branch.  */
8990                 if (rn == 15) {
8991                     addr = tcg_temp_new_i32();
8992                     tcg_gen_movi_i32(addr, s->pc);
8993                 } else {
8994                     addr = load_reg(s, rn);
8995                 }
8996                 tmp = load_reg(s, rm);
8997                 tcg_gen_add_i32(addr, addr, tmp);
8998                 if (insn & (1 << 4)) {
8999                     /* tbh */
9000                     tcg_gen_add_i32(addr, addr, tmp);
9001                     tcg_temp_free_i32(tmp);
9002                     tmp = tcg_temp_new_i32();
9003                     gen_aa32_ld16u(tmp, addr, get_mem_index(s));
9004                 } else { /* tbb */
9005                     tcg_temp_free_i32(tmp);
9006                     tmp = tcg_temp_new_i32();
9007                     gen_aa32_ld8u(tmp, addr, get_mem_index(s));
9008                 }
9009                 tcg_temp_free_i32(addr);
9010                 tcg_gen_shli_i32(tmp, tmp, 1);
9011                 tcg_gen_addi_i32(tmp, tmp, s->pc);
9012                 store_reg(s, 15, tmp);
9013             } else {
9014                 int op2 = (insn >> 6) & 0x3;
9015                 op = (insn >> 4) & 0x3;
9016                 switch (op2) {
9017                 case 0:
9018                     goto illegal_op;
9019                 case 1:
9020                     /* Load/store exclusive byte/halfword/doubleword */
9021                     if (op == 2) {
9022                         goto illegal_op;
9023                     }
9024                     ARCH(7);
9025                     break;
9026                 case 2:
9027                     /* Load-acquire/store-release */
9028                     if (op == 3) {
9029                         goto illegal_op;
9030                     }
9031                     /* Fall through */
9032                 case 3:
9033                     /* Load-acquire/store-release exclusive */
9034                     ARCH(8);
9035                     break;
9036                 }
9037                 addr = tcg_temp_local_new_i32();
9038                 load_reg_var(s, addr, rn);
9039                 if (!(op2 & 1)) {
9040                     if (insn & (1 << 20)) {
9041                         tmp = tcg_temp_new_i32();
9042                         switch (op) {
9043                         case 0: /* ldab */
9044                             gen_aa32_ld8u(tmp, addr, get_mem_index(s));
9045                             break;
9046                         case 1: /* ldah */
9047                             gen_aa32_ld16u(tmp, addr, get_mem_index(s));
9048                             break;
9049                         case 2: /* lda */
9050                             gen_aa32_ld32u(tmp, addr, get_mem_index(s));
9051                             break;
9052                         default:
9053                             abort();
9054                         }
9055                         store_reg(s, rs, tmp);
9056                     } else {
9057                         tmp = load_reg(s, rs);
9058                         switch (op) {
9059                         case 0: /* stlb */
9060                             gen_aa32_st8(tmp, addr, get_mem_index(s));
9061                             break;
9062                         case 1: /* stlh */
9063                             gen_aa32_st16(tmp, addr, get_mem_index(s));
9064                             break;
9065                         case 2: /* stl */
9066                             gen_aa32_st32(tmp, addr, get_mem_index(s));
9067                             break;
9068                         default:
9069                             abort();
9070                         }
9071                         tcg_temp_free_i32(tmp);
9072                     }
9073                 } else if (insn & (1 << 20)) {
9074                     gen_load_exclusive(s, rs, rd, addr, op);
9075                 } else {
9076                     gen_store_exclusive(s, rm, rs, rd, addr, op);
9077                 }
9078                 tcg_temp_free_i32(addr);
9079             }
9080         } else {
9081             /* Load/store multiple, RFE, SRS.  */
9082             if (((insn >> 23) & 1) == ((insn >> 24) & 1)) {
9083                 /* RFE, SRS: not available in user mode or on M profile */
9084                 if (IS_USER(s) || IS_M(env)) {
9085                     goto illegal_op;
9086                 }
9087                 if (insn & (1 << 20)) {
9088                     /* rfe */
9089                     addr = load_reg(s, rn);
9090                     if ((insn & (1 << 24)) == 0)
9091                         tcg_gen_addi_i32(addr, addr, -8);
9092                     /* Load PC into tmp and CPSR into tmp2.  */
9093                     tmp = tcg_temp_new_i32();
9094                     gen_aa32_ld32u(tmp, addr, get_mem_index(s));
9095                     tcg_gen_addi_i32(addr, addr, 4);
9096                     tmp2 = tcg_temp_new_i32();
9097                     gen_aa32_ld32u(tmp2, addr, get_mem_index(s));
9098                     if (insn & (1 << 21)) {
9099                         /* Base writeback.  */
9100                         if (insn & (1 << 24)) {
9101                             tcg_gen_addi_i32(addr, addr, 4);
9102                         } else {
9103                             tcg_gen_addi_i32(addr, addr, -4);
9104                         }
9105                         store_reg(s, rn, addr);
9106                     } else {
9107                         tcg_temp_free_i32(addr);
9108                     }
9109                     gen_rfe(s, tmp, tmp2);
9110                 } else {
9111                     /* srs */
9112                     gen_srs(s, (insn & 0x1f), (insn & (1 << 24)) ? 1 : 2,
9113                             insn & (1 << 21));
9114                 }
9115             } else {
9116                 int i, loaded_base = 0;
9117                 TCGv_i32 loaded_var;
9118                 /* Load/store multiple.  */
9119                 addr = load_reg(s, rn);
9120                 offset = 0;
9121                 for (i = 0; i < 16; i++) {
9122                     if (insn & (1 << i))
9123                         offset += 4;
9124                 }
9125                 if (insn & (1 << 24)) {
9126                     tcg_gen_addi_i32(addr, addr, -offset);
9127                 }
9128
9129                 TCGV_UNUSED_I32(loaded_var);
9130                 for (i = 0; i < 16; i++) {
9131                     if ((insn & (1 << i)) == 0)
9132                         continue;
9133                     if (insn & (1 << 20)) {
9134                         /* Load.  */
9135                         tmp = tcg_temp_new_i32();
9136                         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
9137                         if (i == 15) {
9138                             gen_bx(s, tmp);
9139                         } else if (i == rn) {
9140                             loaded_var = tmp;
9141                             loaded_base = 1;
9142                         } else {
9143                             store_reg(s, i, tmp);
9144                         }
9145                     } else {
9146                         /* Store.  */
9147                         tmp = load_reg(s, i);
9148                         gen_aa32_st32(tmp, addr, get_mem_index(s));
9149                         tcg_temp_free_i32(tmp);
9150                     }
9151                     tcg_gen_addi_i32(addr, addr, 4);
9152                 }
9153                 if (loaded_base) {
9154                     store_reg(s, rn, loaded_var);
9155                 }
9156                 if (insn & (1 << 21)) {
9157                     /* Base register writeback.  */
9158                     if (insn & (1 << 24)) {
9159                         tcg_gen_addi_i32(addr, addr, -offset);
9160                     }
9161                     /* Fault if writeback register is in register list.  */
9162                     if (insn & (1 << rn))
9163                         goto illegal_op;
9164                     store_reg(s, rn, addr);
9165                 } else {
9166                     tcg_temp_free_i32(addr);
9167                 }
9168             }
9169         }
9170         break;
9171     case 5:
9172
9173         op = (insn >> 21) & 0xf;
9174         if (op == 6) {
9175             /* Halfword pack.  */
9176             tmp = load_reg(s, rn);
9177             tmp2 = load_reg(s, rm);
9178             shift = ((insn >> 10) & 0x1c) | ((insn >> 6) & 0x3);
9179             if (insn & (1 << 5)) {
9180                 /* pkhtb */
9181                 if (shift == 0)
9182                     shift = 31;
9183                 tcg_gen_sari_i32(tmp2, tmp2, shift);
9184                 tcg_gen_andi_i32(tmp, tmp, 0xffff0000);
9185                 tcg_gen_ext16u_i32(tmp2, tmp2);
9186             } else {
9187                 /* pkhbt */
9188                 if (shift)
9189                     tcg_gen_shli_i32(tmp2, tmp2, shift);
9190                 tcg_gen_ext16u_i32(tmp, tmp);
9191                 tcg_gen_andi_i32(tmp2, tmp2, 0xffff0000);
9192             }
9193             tcg_gen_or_i32(tmp, tmp, tmp2);
9194             tcg_temp_free_i32(tmp2);
9195             store_reg(s, rd, tmp);
9196         } else {
9197             /* Data processing register constant shift.  */
9198             if (rn == 15) {
9199                 tmp = tcg_temp_new_i32();
9200                 tcg_gen_movi_i32(tmp, 0);
9201             } else {
9202                 tmp = load_reg(s, rn);
9203             }
9204             tmp2 = load_reg(s, rm);
9205
9206             shiftop = (insn >> 4) & 3;
9207             shift = ((insn >> 6) & 3) | ((insn >> 10) & 0x1c);
9208             conds = (insn & (1 << 20)) != 0;
9209             logic_cc = (conds && thumb2_logic_op(op));
9210             gen_arm_shift_im(tmp2, shiftop, shift, logic_cc);
9211             if (gen_thumb2_data_op(s, op, conds, 0, tmp, tmp2))
9212                 goto illegal_op;
9213             tcg_temp_free_i32(tmp2);
9214             if (rd != 15) {
9215                 store_reg(s, rd, tmp);
9216             } else {
9217                 tcg_temp_free_i32(tmp);
9218             }
9219         }
9220         break;
9221     case 13: /* Misc data processing.  */
9222         op = ((insn >> 22) & 6) | ((insn >> 7) & 1);
9223         if (op < 4 && (insn & 0xf000) != 0xf000)
9224             goto illegal_op;
9225         switch (op) {
9226         case 0: /* Register controlled shift.  */
9227             tmp = load_reg(s, rn);
9228             tmp2 = load_reg(s, rm);
9229             if ((insn & 0x70) != 0)
9230                 goto illegal_op;
9231             op = (insn >> 21) & 3;
9232             logic_cc = (insn & (1 << 20)) != 0;
9233             gen_arm_shift_reg(tmp, op, tmp2, logic_cc);
9234             if (logic_cc)
9235                 gen_logic_CC(tmp);
9236             store_reg_bx(env, s, rd, tmp);
9237             break;
9238         case 1: /* Sign/zero extend.  */
9239             tmp = load_reg(s, rm);
9240             shift = (insn >> 4) & 3;
9241             /* ??? In many cases it's not necessary to do a
9242                rotate, a shift is sufficient.  */
9243             if (shift != 0)
9244                 tcg_gen_rotri_i32(tmp, tmp, shift * 8);
9245             op = (insn >> 20) & 7;
9246             switch (op) {
9247             case 0: gen_sxth(tmp);   break;
9248             case 1: gen_uxth(tmp);   break;
9249             case 2: gen_sxtb16(tmp); break;
9250             case 3: gen_uxtb16(tmp); break;
9251             case 4: gen_sxtb(tmp);   break;
9252             case 5: gen_uxtb(tmp);   break;
9253             default: goto illegal_op;
9254             }
9255             if (rn != 15) {
9256                 tmp2 = load_reg(s, rn);
9257                 if ((op >> 1) == 1) {
9258                     gen_add16(tmp, tmp2);
9259                 } else {
9260                     tcg_gen_add_i32(tmp, tmp, tmp2);
9261                     tcg_temp_free_i32(tmp2);
9262                 }
9263             }
9264             store_reg(s, rd, tmp);
9265             break;
9266         case 2: /* SIMD add/subtract.  */
9267             op = (insn >> 20) & 7;
9268             shift = (insn >> 4) & 7;
9269             if ((op & 3) == 3 || (shift & 3) == 3)
9270                 goto illegal_op;
9271             tmp = load_reg(s, rn);
9272             tmp2 = load_reg(s, rm);
9273             gen_thumb2_parallel_addsub(op, shift, tmp, tmp2);
9274             tcg_temp_free_i32(tmp2);
9275             store_reg(s, rd, tmp);
9276             break;
9277         case 3: /* Other data processing.  */
9278             op = ((insn >> 17) & 0x38) | ((insn >> 4) & 7);
9279             if (op < 4) {
9280                 /* Saturating add/subtract.  */
9281                 tmp = load_reg(s, rn);
9282                 tmp2 = load_reg(s, rm);
9283                 if (op & 1)
9284                     gen_helper_double_saturate(tmp, cpu_env, tmp);
9285                 if (op & 2)
9286                     gen_helper_sub_saturate(tmp, cpu_env, tmp2, tmp);
9287                 else
9288                     gen_helper_add_saturate(tmp, cpu_env, tmp, tmp2);
9289                 tcg_temp_free_i32(tmp2);
9290             } else {
9291                 tmp = load_reg(s, rn);
9292                 switch (op) {
9293                 case 0x0a: /* rbit */
9294                     gen_helper_rbit(tmp, tmp);
9295                     break;
9296                 case 0x08: /* rev */
9297                     tcg_gen_bswap32_i32(tmp, tmp);
9298                     break;
9299                 case 0x09: /* rev16 */
9300                     gen_rev16(tmp);
9301                     break;
9302                 case 0x0b: /* revsh */
9303                     gen_revsh(tmp);
9304                     break;
9305                 case 0x10: /* sel */
9306                     tmp2 = load_reg(s, rm);
9307                     tmp3 = tcg_temp_new_i32();
9308                     tcg_gen_ld_i32(tmp3, cpu_env, offsetof(CPUARMState, GE));
9309                     gen_helper_sel_flags(tmp, tmp3, tmp, tmp2);
9310                     tcg_temp_free_i32(tmp3);
9311                     tcg_temp_free_i32(tmp2);
9312                     break;
9313                 case 0x18: /* clz */
9314                     gen_helper_clz(tmp, tmp);
9315                     break;
9316                 case 0x20:
9317                 case 0x21:
9318                 case 0x22:
9319                 case 0x28:
9320                 case 0x29:
9321                 case 0x2a:
9322                 {
9323                     /* crc32/crc32c */
9324                     uint32_t sz = op & 0x3;
9325                     uint32_t c = op & 0x8;
9326
9327                     if (!arm_feature(env, ARM_FEATURE_CRC)) {
9328                         goto illegal_op;
9329                     }
9330
9331                     tmp2 = load_reg(s, rm);
9332                     tmp3 = tcg_const_i32(1 << sz);
9333                     if (c) {
9334                         gen_helper_crc32c(tmp, tmp, tmp2, tmp3);
9335                     } else {
9336                         gen_helper_crc32(tmp, tmp, tmp2, tmp3);
9337                     }
9338                     tcg_temp_free_i32(tmp2);
9339                     tcg_temp_free_i32(tmp3);
9340                     break;
9341                 }
9342                 default:
9343                     goto illegal_op;
9344                 }
9345             }
9346             store_reg(s, rd, tmp);
9347             break;
9348         case 4: case 5: /* 32-bit multiply.  Sum of absolute differences.  */
9349             op = (insn >> 4) & 0xf;
9350             tmp = load_reg(s, rn);
9351             tmp2 = load_reg(s, rm);
9352             switch ((insn >> 20) & 7) {
9353             case 0: /* 32 x 32 -> 32 */
9354                 tcg_gen_mul_i32(tmp, tmp, tmp2);
9355                 tcg_temp_free_i32(tmp2);
9356                 if (rs != 15) {
9357                     tmp2 = load_reg(s, rs);
9358                     if (op)
9359                         tcg_gen_sub_i32(tmp, tmp2, tmp);
9360                     else
9361                         tcg_gen_add_i32(tmp, tmp, tmp2);
9362                     tcg_temp_free_i32(tmp2);
9363                 }
9364                 break;
9365             case 1: /* 16 x 16 -> 32 */
9366                 gen_mulxy(tmp, tmp2, op & 2, op & 1);
9367                 tcg_temp_free_i32(tmp2);
9368                 if (rs != 15) {
9369                     tmp2 = load_reg(s, rs);
9370                     gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
9371                     tcg_temp_free_i32(tmp2);
9372                 }
9373                 break;
9374             case 2: /* Dual multiply add.  */
9375             case 4: /* Dual multiply subtract.  */
9376                 if (op)
9377                     gen_swap_half(tmp2);
9378                 gen_smul_dual(tmp, tmp2);
9379                 if (insn & (1 << 22)) {
9380                     /* This subtraction cannot overflow. */
9381                     tcg_gen_sub_i32(tmp, tmp, tmp2);
9382                 } else {
9383                     /* This addition cannot overflow 32 bits;
9384                      * however it may overflow considered as a signed
9385                      * operation, in which case we must set the Q flag.
9386                      */
9387                     gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
9388                 }
9389                 tcg_temp_free_i32(tmp2);
9390                 if (rs != 15)
9391                   {
9392                     tmp2 = load_reg(s, rs);
9393                     gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
9394                     tcg_temp_free_i32(tmp2);
9395                   }
9396                 break;
9397             case 3: /* 32 * 16 -> 32msb */
9398                 if (op)
9399                     tcg_gen_sari_i32(tmp2, tmp2, 16);
9400                 else
9401                     gen_sxth(tmp2);
9402                 tmp64 = gen_muls_i64_i32(tmp, tmp2);
9403                 tcg_gen_shri_i64(tmp64, tmp64, 16);
9404                 tmp = tcg_temp_new_i32();
9405                 tcg_gen_trunc_i64_i32(tmp, tmp64);
9406                 tcg_temp_free_i64(tmp64);
9407                 if (rs != 15)
9408                   {
9409                     tmp2 = load_reg(s, rs);
9410                     gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
9411                     tcg_temp_free_i32(tmp2);
9412                   }
9413                 break;
9414             case 5: case 6: /* 32 * 32 -> 32msb (SMMUL, SMMLA, SMMLS) */
9415                 tmp64 = gen_muls_i64_i32(tmp, tmp2);
9416                 if (rs != 15) {
9417                     tmp = load_reg(s, rs);
9418                     if (insn & (1 << 20)) {
9419                         tmp64 = gen_addq_msw(tmp64, tmp);
9420                     } else {
9421                         tmp64 = gen_subq_msw(tmp64, tmp);
9422                     }
9423                 }
9424                 if (insn & (1 << 4)) {
9425                     tcg_gen_addi_i64(tmp64, tmp64, 0x80000000u);
9426                 }
9427                 tcg_gen_shri_i64(tmp64, tmp64, 32);
9428                 tmp = tcg_temp_new_i32();
9429                 tcg_gen_trunc_i64_i32(tmp, tmp64);
9430                 tcg_temp_free_i64(tmp64);
9431                 break;
9432             case 7: /* Unsigned sum of absolute differences.  */
9433                 gen_helper_usad8(tmp, tmp, tmp2);
9434                 tcg_temp_free_i32(tmp2);
9435                 if (rs != 15) {
9436                     tmp2 = load_reg(s, rs);
9437                     tcg_gen_add_i32(tmp, tmp, tmp2);
9438                     tcg_temp_free_i32(tmp2);
9439                 }
9440                 break;
9441             }
9442             store_reg(s, rd, tmp);
9443             break;
9444         case 6: case 7: /* 64-bit multiply, Divide.  */
9445             op = ((insn >> 4) & 0xf) | ((insn >> 16) & 0x70);
9446             tmp = load_reg(s, rn);
9447             tmp2 = load_reg(s, rm);
9448             if ((op & 0x50) == 0x10) {
9449                 /* sdiv, udiv */
9450                 if (!arm_feature(env, ARM_FEATURE_THUMB_DIV)) {
9451                     goto illegal_op;
9452                 }
9453                 if (op & 0x20)
9454                     gen_helper_udiv(tmp, tmp, tmp2);
9455                 else
9456                     gen_helper_sdiv(tmp, tmp, tmp2);
9457                 tcg_temp_free_i32(tmp2);
9458                 store_reg(s, rd, tmp);
9459             } else if ((op & 0xe) == 0xc) {
9460                 /* Dual multiply accumulate long.  */
9461                 if (op & 1)
9462                     gen_swap_half(tmp2);
9463                 gen_smul_dual(tmp, tmp2);
9464                 if (op & 0x10) {
9465                     tcg_gen_sub_i32(tmp, tmp, tmp2);
9466                 } else {
9467                     tcg_gen_add_i32(tmp, tmp, tmp2);
9468                 }
9469                 tcg_temp_free_i32(tmp2);
9470                 /* BUGFIX */
9471                 tmp64 = tcg_temp_new_i64();
9472                 tcg_gen_ext_i32_i64(tmp64, tmp);
9473                 tcg_temp_free_i32(tmp);
9474                 gen_addq(s, tmp64, rs, rd);
9475                 gen_storeq_reg(s, rs, rd, tmp64);
9476                 tcg_temp_free_i64(tmp64);
9477             } else {
9478                 if (op & 0x20) {
9479                     /* Unsigned 64-bit multiply  */
9480                     tmp64 = gen_mulu_i64_i32(tmp, tmp2);
9481                 } else {
9482                     if (op & 8) {
9483                         /* smlalxy */
9484                         gen_mulxy(tmp, tmp2, op & 2, op & 1);
9485                         tcg_temp_free_i32(tmp2);
9486                         tmp64 = tcg_temp_new_i64();
9487                         tcg_gen_ext_i32_i64(tmp64, tmp);
9488                         tcg_temp_free_i32(tmp);
9489                     } else {
9490                         /* Signed 64-bit multiply  */
9491                         tmp64 = gen_muls_i64_i32(tmp, tmp2);
9492                     }
9493                 }
9494                 if (op & 4) {
9495                     /* umaal */
9496                     gen_addq_lo(s, tmp64, rs);
9497                     gen_addq_lo(s, tmp64, rd);
9498                 } else if (op & 0x40) {
9499                     /* 64-bit accumulate.  */
9500                     gen_addq(s, tmp64, rs, rd);
9501                 }
9502                 gen_storeq_reg(s, rs, rd, tmp64);
9503                 tcg_temp_free_i64(tmp64);
9504             }
9505             break;
9506         }
9507         break;
9508     case 6: case 7: case 14: case 15:
9509         /* Coprocessor.  */
9510         if (((insn >> 24) & 3) == 3) {
9511             /* Translate into the equivalent ARM encoding.  */
9512             insn = (insn & 0xe2ffffff) | ((insn & (1 << 28)) >> 4) | (1 << 28);
9513             if (disas_neon_data_insn(env, s, insn))
9514                 goto illegal_op;
9515         } else if (((insn >> 8) & 0xe) == 10) {
9516             if (disas_vfp_insn(env, s, insn)) {
9517                 goto illegal_op;
9518             }
9519         } else {
9520             if (insn & (1 << 28))
9521                 goto illegal_op;
9522             if (disas_coproc_insn (env, s, insn))
9523                 goto illegal_op;
9524         }
9525         break;
9526     case 8: case 9: case 10: case 11:
9527         if (insn & (1 << 15)) {
9528             /* Branches, misc control.  */
9529             if (insn & 0x5000) {
9530                 /* Unconditional branch.  */
9531                 /* signextend(hw1[10:0]) -> offset[:12].  */
9532                 offset = ((int32_t)insn << 5) >> 9 & ~(int32_t)0xfff;
9533                 /* hw1[10:0] -> offset[11:1].  */
9534                 offset |= (insn & 0x7ff) << 1;
9535                 /* (~hw2[13, 11] ^ offset[24]) -> offset[23,22]
9536                    offset[24:22] already have the same value because of the
9537                    sign extension above.  */
9538                 offset ^= ((~insn) & (1 << 13)) << 10;
9539                 offset ^= ((~insn) & (1 << 11)) << 11;
9540
9541                 if (insn & (1 << 14)) {
9542                     /* Branch and link.  */
9543                     tcg_gen_movi_i32(cpu_R[14], s->pc | 1);
9544                 }
9545
9546                 offset += s->pc;
9547                 if (insn & (1 << 12)) {
9548                     /* b/bl */
9549                     gen_jmp(s, offset);
9550                 } else {
9551                     /* blx */
9552                     offset &= ~(uint32_t)2;
9553                     /* thumb2 bx, no need to check */
9554                     gen_bx_im(s, offset);
9555                 }
9556             } else if (((insn >> 23) & 7) == 7) {
9557                 /* Misc control */
9558                 if (insn & (1 << 13))
9559                     goto illegal_op;
9560
9561                 if (insn & (1 << 26)) {
9562                     /* Secure monitor call (v6Z) */
9563                     qemu_log_mask(LOG_UNIMP,
9564                                   "arm: unimplemented secure monitor call\n");
9565                     goto illegal_op; /* not implemented.  */
9566                 } else {
9567                     op = (insn >> 20) & 7;
9568                     switch (op) {
9569                     case 0: /* msr cpsr.  */
9570                         if (IS_M(env)) {
9571                             tmp = load_reg(s, rn);
9572                             addr = tcg_const_i32(insn & 0xff);
9573                             gen_helper_v7m_msr(cpu_env, addr, tmp);
9574                             tcg_temp_free_i32(addr);
9575                             tcg_temp_free_i32(tmp);
9576                             gen_lookup_tb(s);
9577                             break;
9578                         }
9579                         /* fall through */
9580                     case 1: /* msr spsr.  */
9581                         if (IS_M(env))
9582                             goto illegal_op;
9583                         tmp = load_reg(s, rn);
9584                         if (gen_set_psr(s,
9585                               msr_mask(env, s, (insn >> 8) & 0xf, op == 1),
9586                               op == 1, tmp))
9587                             goto illegal_op;
9588                         break;
9589                     case 2: /* cps, nop-hint.  */
9590                         if (((insn >> 8) & 7) == 0) {
9591                             gen_nop_hint(s, insn & 0xff);
9592                         }
9593                         /* Implemented as NOP in user mode.  */
9594                         if (IS_USER(s))
9595                             break;
9596                         offset = 0;
9597                         imm = 0;
9598                         if (insn & (1 << 10)) {
9599                             if (insn & (1 << 7))
9600                                 offset |= CPSR_A;
9601                             if (insn & (1 << 6))
9602                                 offset |= CPSR_I;
9603                             if (insn & (1 << 5))
9604                                 offset |= CPSR_F;
9605                             if (insn & (1 << 9))
9606                                 imm = CPSR_A | CPSR_I | CPSR_F;
9607                         }
9608                         if (insn & (1 << 8)) {
9609                             offset |= 0x1f;
9610                             imm |= (insn & 0x1f);
9611                         }
9612                         if (offset) {
9613                             gen_set_psr_im(s, offset, 0, imm);
9614                         }
9615                         break;
9616                     case 3: /* Special control operations.  */
9617                         ARCH(7);
9618                         op = (insn >> 4) & 0xf;
9619                         switch (op) {
9620                         case 2: /* clrex */
9621                             gen_clrex(s);
9622                             break;
9623                         case 4: /* dsb */
9624                         case 5: /* dmb */
9625                         case 6: /* isb */
9626                             /* These execute as NOPs.  */
9627                             break;
9628                         default:
9629                             goto illegal_op;
9630                         }
9631                         break;
9632                     case 4: /* bxj */
9633                         /* Trivial implementation equivalent to bx.  */
9634                         tmp = load_reg(s, rn);
9635                         gen_bx(s, tmp);
9636                         break;
9637                     case 5: /* Exception return.  */
9638                         if (IS_USER(s)) {
9639                             goto illegal_op;
9640                         }
9641                         if (rn != 14 || rd != 15) {
9642                             goto illegal_op;
9643                         }
9644                         tmp = load_reg(s, rn);
9645                         tcg_gen_subi_i32(tmp, tmp, insn & 0xff);
9646                         gen_exception_return(s, tmp);
9647                         break;
9648                     case 6: /* mrs cpsr.  */
9649                         tmp = tcg_temp_new_i32();
9650                         if (IS_M(env)) {
9651                             addr = tcg_const_i32(insn & 0xff);
9652                             gen_helper_v7m_mrs(tmp, cpu_env, addr);
9653                             tcg_temp_free_i32(addr);
9654                         } else {
9655                             gen_helper_cpsr_read(tmp, cpu_env);
9656                         }
9657                         store_reg(s, rd, tmp);
9658                         break;
9659                     case 7: /* mrs spsr.  */
9660                         /* Not accessible in user mode.  */
9661                         if (IS_USER(s) || IS_M(env))
9662                             goto illegal_op;
9663                         tmp = load_cpu_field(spsr);
9664                         store_reg(s, rd, tmp);
9665                         break;
9666                     }
9667                 }
9668             } else {
9669                 /* Conditional branch.  */
9670                 op = (insn >> 22) & 0xf;
9671                 /* Generate a conditional jump to next instruction.  */
9672                 s->condlabel = gen_new_label();
9673                 arm_gen_test_cc(op ^ 1, s->condlabel);
9674                 s->condjmp = 1;
9675
9676                 /* offset[11:1] = insn[10:0] */
9677                 offset = (insn & 0x7ff) << 1;
9678                 /* offset[17:12] = insn[21:16].  */
9679                 offset |= (insn & 0x003f0000) >> 4;
9680                 /* offset[31:20] = insn[26].  */
9681                 offset |= ((int32_t)((insn << 5) & 0x80000000)) >> 11;
9682                 /* offset[18] = insn[13].  */
9683                 offset |= (insn & (1 << 13)) << 5;
9684                 /* offset[19] = insn[11].  */
9685                 offset |= (insn & (1 << 11)) << 8;
9686
9687                 /* jump to the offset */
9688                 gen_jmp(s, s->pc + offset);
9689             }
9690         } else {
9691             /* Data processing immediate.  */
9692             if (insn & (1 << 25)) {
9693                 if (insn & (1 << 24)) {
9694                     if (insn & (1 << 20))
9695                         goto illegal_op;
9696                     /* Bitfield/Saturate.  */
9697                     op = (insn >> 21) & 7;
9698                     imm = insn & 0x1f;
9699                     shift = ((insn >> 6) & 3) | ((insn >> 10) & 0x1c);
9700                     if (rn == 15) {
9701                         tmp = tcg_temp_new_i32();
9702                         tcg_gen_movi_i32(tmp, 0);
9703                     } else {
9704                         tmp = load_reg(s, rn);
9705                     }
9706                     switch (op) {
9707                     case 2: /* Signed bitfield extract.  */
9708                         imm++;
9709                         if (shift + imm > 32)
9710                             goto illegal_op;
9711                         if (imm < 32)
9712                             gen_sbfx(tmp, shift, imm);
9713                         break;
9714                     case 6: /* Unsigned bitfield extract.  */
9715                         imm++;
9716                         if (shift + imm > 32)
9717                             goto illegal_op;
9718                         if (imm < 32)
9719                             gen_ubfx(tmp, shift, (1u << imm) - 1);
9720                         break;
9721                     case 3: /* Bitfield insert/clear.  */
9722                         if (imm < shift)
9723                             goto illegal_op;
9724                         imm = imm + 1 - shift;
9725                         if (imm != 32) {
9726                             tmp2 = load_reg(s, rd);
9727                             tcg_gen_deposit_i32(tmp, tmp2, tmp, shift, imm);
9728                             tcg_temp_free_i32(tmp2);
9729                         }
9730                         break;
9731                     case 7:
9732                         goto illegal_op;
9733                     default: /* Saturate.  */
9734                         if (shift) {
9735                             if (op & 1)
9736                                 tcg_gen_sari_i32(tmp, tmp, shift);
9737                             else
9738                                 tcg_gen_shli_i32(tmp, tmp, shift);
9739                         }
9740                         tmp2 = tcg_const_i32(imm);
9741                         if (op & 4) {
9742                             /* Unsigned.  */
9743                             if ((op & 1) && shift == 0)
9744                                 gen_helper_usat16(tmp, cpu_env, tmp, tmp2);
9745                             else
9746                                 gen_helper_usat(tmp, cpu_env, tmp, tmp2);
9747                         } else {
9748                             /* Signed.  */
9749                             if ((op & 1) && shift == 0)
9750                                 gen_helper_ssat16(tmp, cpu_env, tmp, tmp2);
9751                             else
9752                                 gen_helper_ssat(tmp, cpu_env, tmp, tmp2);
9753                         }
9754                         tcg_temp_free_i32(tmp2);
9755                         break;
9756                     }
9757                     store_reg(s, rd, tmp);
9758                 } else {
9759                     imm = ((insn & 0x04000000) >> 15)
9760                           | ((insn & 0x7000) >> 4) | (insn & 0xff);
9761                     if (insn & (1 << 22)) {
9762                         /* 16-bit immediate.  */
9763                         imm |= (insn >> 4) & 0xf000;
9764                         if (insn & (1 << 23)) {
9765                             /* movt */
9766                             tmp = load_reg(s, rd);
9767                             tcg_gen_ext16u_i32(tmp, tmp);
9768                             tcg_gen_ori_i32(tmp, tmp, imm << 16);
9769                         } else {
9770                             /* movw */
9771                             tmp = tcg_temp_new_i32();
9772                             tcg_gen_movi_i32(tmp, imm);
9773                         }
9774                     } else {
9775                         /* Add/sub 12-bit immediate.  */
9776                         if (rn == 15) {
9777                             offset = s->pc & ~(uint32_t)3;
9778                             if (insn & (1 << 23))
9779                                 offset -= imm;
9780                             else
9781                                 offset += imm;
9782                             tmp = tcg_temp_new_i32();
9783                             tcg_gen_movi_i32(tmp, offset);
9784                         } else {
9785                             tmp = load_reg(s, rn);
9786                             if (insn & (1 << 23))
9787                                 tcg_gen_subi_i32(tmp, tmp, imm);
9788                             else
9789                                 tcg_gen_addi_i32(tmp, tmp, imm);
9790                         }
9791                     }
9792                     store_reg(s, rd, tmp);
9793                 }
9794             } else {
9795                 int shifter_out = 0;
9796                 /* modified 12-bit immediate.  */
9797                 shift = ((insn & 0x04000000) >> 23) | ((insn & 0x7000) >> 12);
9798                 imm = (insn & 0xff);
9799                 switch (shift) {
9800                 case 0: /* XY */
9801                     /* Nothing to do.  */
9802                     break;
9803                 case 1: /* 00XY00XY */
9804                     imm |= imm << 16;
9805                     break;
9806                 case 2: /* XY00XY00 */
9807                     imm |= imm << 16;
9808                     imm <<= 8;
9809                     break;
9810                 case 3: /* XYXYXYXY */
9811                     imm |= imm << 16;
9812                     imm |= imm << 8;
9813                     break;
9814                 default: /* Rotated constant.  */
9815                     shift = (shift << 1) | (imm >> 7);
9816                     imm |= 0x80;
9817                     imm = imm << (32 - shift);
9818                     shifter_out = 1;
9819                     break;
9820                 }
9821                 tmp2 = tcg_temp_new_i32();
9822                 tcg_gen_movi_i32(tmp2, imm);
9823                 rn = (insn >> 16) & 0xf;
9824                 if (rn == 15) {
9825                     tmp = tcg_temp_new_i32();
9826                     tcg_gen_movi_i32(tmp, 0);
9827                 } else {
9828                     tmp = load_reg(s, rn);
9829                 }
9830                 op = (insn >> 21) & 0xf;
9831                 if (gen_thumb2_data_op(s, op, (insn & (1 << 20)) != 0,
9832                                        shifter_out, tmp, tmp2))
9833                     goto illegal_op;
9834                 tcg_temp_free_i32(tmp2);
9835                 rd = (insn >> 8) & 0xf;
9836                 if (rd != 15) {
9837                     store_reg(s, rd, tmp);
9838                 } else {
9839                     tcg_temp_free_i32(tmp);
9840                 }
9841             }
9842         }
9843         break;
9844     case 12: /* Load/store single data item.  */
9845         {
9846         int postinc = 0;
9847         int writeback = 0;
9848         int memidx;
9849         if ((insn & 0x01100000) == 0x01000000) {
9850             if (disas_neon_ls_insn(env, s, insn))
9851                 goto illegal_op;
9852             break;
9853         }
9854         op = ((insn >> 21) & 3) | ((insn >> 22) & 4);
9855         if (rs == 15) {
9856             if (!(insn & (1 << 20))) {
9857                 goto illegal_op;
9858             }
9859             if (op != 2) {
9860                 /* Byte or halfword load space with dest == r15 : memory hints.
9861                  * Catch them early so we don't emit pointless addressing code.
9862                  * This space is a mix of:
9863                  *  PLD/PLDW/PLI,  which we implement as NOPs (note that unlike
9864                  *     the ARM encodings, PLDW space doesn't UNDEF for non-v7MP
9865                  *     cores)
9866                  *  unallocated hints, which must be treated as NOPs
9867                  *  UNPREDICTABLE space, which we NOP or UNDEF depending on
9868                  *     which is easiest for the decoding logic
9869                  *  Some space which must UNDEF
9870                  */
9871                 int op1 = (insn >> 23) & 3;
9872                 int op2 = (insn >> 6) & 0x3f;
9873                 if (op & 2) {
9874                     goto illegal_op;
9875                 }
9876                 if (rn == 15) {
9877                     /* UNPREDICTABLE, unallocated hint or
9878                      * PLD/PLDW/PLI (literal)
9879                      */
9880                     return 0;
9881                 }
9882                 if (op1 & 1) {
9883                     return 0; /* PLD/PLDW/PLI or unallocated hint */
9884                 }
9885                 if ((op2 == 0) || ((op2 & 0x3c) == 0x30)) {
9886                     return 0; /* PLD/PLDW/PLI or unallocated hint */
9887                 }
9888                 /* UNDEF space, or an UNPREDICTABLE */
9889                 return 1;
9890             }
9891         }
9892         memidx = get_mem_index(s);
9893         if (rn == 15) {
9894             addr = tcg_temp_new_i32();
9895             /* PC relative.  */
9896             /* s->pc has already been incremented by 4.  */
9897             imm = s->pc & 0xfffffffc;
9898             if (insn & (1 << 23))
9899                 imm += insn & 0xfff;
9900             else
9901                 imm -= insn & 0xfff;
9902             tcg_gen_movi_i32(addr, imm);
9903         } else {
9904             addr = load_reg(s, rn);
9905             if (insn & (1 << 23)) {
9906                 /* Positive offset.  */
9907                 imm = insn & 0xfff;
9908                 tcg_gen_addi_i32(addr, addr, imm);
9909             } else {
9910                 imm = insn & 0xff;
9911                 switch ((insn >> 8) & 0xf) {
9912                 case 0x0: /* Shifted Register.  */
9913                     shift = (insn >> 4) & 0xf;
9914                     if (shift > 3) {
9915                         tcg_temp_free_i32(addr);
9916                         goto illegal_op;
9917                     }
9918                     tmp = load_reg(s, rm);
9919                     if (shift)
9920                         tcg_gen_shli_i32(tmp, tmp, shift);
9921                     tcg_gen_add_i32(addr, addr, tmp);
9922                     tcg_temp_free_i32(tmp);
9923                     break;
9924                 case 0xc: /* Negative offset.  */
9925                     tcg_gen_addi_i32(addr, addr, -imm);
9926                     break;
9927                 case 0xe: /* User privilege.  */
9928                     tcg_gen_addi_i32(addr, addr, imm);
9929                     memidx = MMU_USER_IDX;
9930                     break;
9931                 case 0x9: /* Post-decrement.  */
9932                     imm = -imm;
9933                     /* Fall through.  */
9934                 case 0xb: /* Post-increment.  */
9935                     postinc = 1;
9936                     writeback = 1;
9937                     break;
9938                 case 0xd: /* Pre-decrement.  */
9939                     imm = -imm;
9940                     /* Fall through.  */
9941                 case 0xf: /* Pre-increment.  */
9942                     tcg_gen_addi_i32(addr, addr, imm);
9943                     writeback = 1;
9944                     break;
9945                 default:
9946                     tcg_temp_free_i32(addr);
9947                     goto illegal_op;
9948                 }
9949             }
9950         }
9951         if (insn & (1 << 20)) {
9952             /* Load.  */
9953             tmp = tcg_temp_new_i32();
9954             switch (op) {
9955             case 0:
9956                 gen_aa32_ld8u(tmp, addr, memidx);
9957                 break;
9958             case 4:
9959                 gen_aa32_ld8s(tmp, addr, memidx);
9960                 break;
9961             case 1:
9962                 gen_aa32_ld16u(tmp, addr, memidx);
9963                 break;
9964             case 5:
9965                 gen_aa32_ld16s(tmp, addr, memidx);
9966                 break;
9967             case 2:
9968                 gen_aa32_ld32u(tmp, addr, memidx);
9969                 break;
9970             default:
9971                 tcg_temp_free_i32(tmp);
9972                 tcg_temp_free_i32(addr);
9973                 goto illegal_op;
9974             }
9975             if (rs == 15) {
9976                 gen_bx(s, tmp);
9977             } else {
9978                 store_reg(s, rs, tmp);
9979             }
9980         } else {
9981             /* Store.  */
9982             tmp = load_reg(s, rs);
9983             switch (op) {
9984             case 0:
9985                 gen_aa32_st8(tmp, addr, memidx);
9986                 break;
9987             case 1:
9988                 gen_aa32_st16(tmp, addr, memidx);
9989                 break;
9990             case 2:
9991                 gen_aa32_st32(tmp, addr, memidx);
9992                 break;
9993             default:
9994                 tcg_temp_free_i32(tmp);
9995                 tcg_temp_free_i32(addr);
9996                 goto illegal_op;
9997             }
9998             tcg_temp_free_i32(tmp);
9999         }
10000         if (postinc)
10001             tcg_gen_addi_i32(addr, addr, imm);
10002         if (writeback) {
10003             store_reg(s, rn, addr);
10004         } else {
10005             tcg_temp_free_i32(addr);
10006         }
10007         }
10008         break;
10009     default:
10010         goto illegal_op;
10011     }
10012     return 0;
10013 illegal_op:
10014     return 1;
10015 }
10016
10017 static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
10018 {
10019     uint32_t val, insn, op, rm, rn, rd, shift, cond;
10020     int32_t offset;
10021     int i;
10022     TCGv_i32 tmp;
10023     TCGv_i32 tmp2;
10024     TCGv_i32 addr;
10025
10026     if (s->condexec_mask) {
10027         cond = s->condexec_cond;
10028         if (cond != 0x0e) {     /* Skip conditional when condition is AL. */
10029           s->condlabel = gen_new_label();
10030           arm_gen_test_cc(cond ^ 1, s->condlabel);
10031           s->condjmp = 1;
10032         }
10033     }
10034
10035     insn = arm_lduw_code(env, s->pc, s->bswap_code);
10036     s->pc += 2;
10037
10038     switch (insn >> 12) {
10039     case 0: case 1:
10040
10041         rd = insn & 7;
10042         op = (insn >> 11) & 3;
10043         if (op == 3) {
10044             /* add/subtract */
10045             rn = (insn >> 3) & 7;
10046             tmp = load_reg(s, rn);
10047             if (insn & (1 << 10)) {
10048                 /* immediate */
10049                 tmp2 = tcg_temp_new_i32();
10050                 tcg_gen_movi_i32(tmp2, (insn >> 6) & 7);
10051             } else {
10052                 /* reg */
10053                 rm = (insn >> 6) & 7;
10054                 tmp2 = load_reg(s, rm);
10055             }
10056             if (insn & (1 << 9)) {
10057                 if (s->condexec_mask)
10058                     tcg_gen_sub_i32(tmp, tmp, tmp2);
10059                 else
10060                     gen_sub_CC(tmp, tmp, tmp2);
10061             } else {
10062                 if (s->condexec_mask)
10063                     tcg_gen_add_i32(tmp, tmp, tmp2);
10064                 else
10065                     gen_add_CC(tmp, tmp, tmp2);
10066             }
10067             tcg_temp_free_i32(tmp2);
10068             store_reg(s, rd, tmp);
10069         } else {
10070             /* shift immediate */
10071             rm = (insn >> 3) & 7;
10072             shift = (insn >> 6) & 0x1f;
10073             tmp = load_reg(s, rm);
10074             gen_arm_shift_im(tmp, op, shift, s->condexec_mask == 0);
10075             if (!s->condexec_mask)
10076                 gen_logic_CC(tmp);
10077             store_reg(s, rd, tmp);
10078         }
10079         break;
10080     case 2: case 3:
10081         /* arithmetic large immediate */
10082         op = (insn >> 11) & 3;
10083         rd = (insn >> 8) & 0x7;
10084         if (op == 0) { /* mov */
10085             tmp = tcg_temp_new_i32();
10086             tcg_gen_movi_i32(tmp, insn & 0xff);
10087             if (!s->condexec_mask)
10088                 gen_logic_CC(tmp);
10089             store_reg(s, rd, tmp);
10090         } else {
10091             tmp = load_reg(s, rd);
10092             tmp2 = tcg_temp_new_i32();
10093             tcg_gen_movi_i32(tmp2, insn & 0xff);
10094             switch (op) {
10095             case 1: /* cmp */
10096                 gen_sub_CC(tmp, tmp, tmp2);
10097                 tcg_temp_free_i32(tmp);
10098                 tcg_temp_free_i32(tmp2);
10099                 break;
10100             case 2: /* add */
10101                 if (s->condexec_mask)
10102                     tcg_gen_add_i32(tmp, tmp, tmp2);
10103                 else
10104                     gen_add_CC(tmp, tmp, tmp2);
10105                 tcg_temp_free_i32(tmp2);
10106                 store_reg(s, rd, tmp);
10107                 break;
10108             case 3: /* sub */
10109                 if (s->condexec_mask)
10110                     tcg_gen_sub_i32(tmp, tmp, tmp2);
10111                 else
10112                     gen_sub_CC(tmp, tmp, tmp2);
10113                 tcg_temp_free_i32(tmp2);
10114                 store_reg(s, rd, tmp);
10115                 break;
10116             }
10117         }
10118         break;
10119     case 4:
10120         if (insn & (1 << 11)) {
10121             rd = (insn >> 8) & 7;
10122             /* load pc-relative.  Bit 1 of PC is ignored.  */
10123             val = s->pc + 2 + ((insn & 0xff) * 4);
10124             val &= ~(uint32_t)2;
10125             addr = tcg_temp_new_i32();
10126             tcg_gen_movi_i32(addr, val);
10127             tmp = tcg_temp_new_i32();
10128             gen_aa32_ld32u(tmp, addr, get_mem_index(s));
10129             tcg_temp_free_i32(addr);
10130             store_reg(s, rd, tmp);
10131             break;
10132         }
10133         if (insn & (1 << 10)) {
10134             /* data processing extended or blx */
10135             rd = (insn & 7) | ((insn >> 4) & 8);
10136             rm = (insn >> 3) & 0xf;
10137             op = (insn >> 8) & 3;
10138             switch (op) {
10139             case 0: /* add */
10140                 tmp = load_reg(s, rd);
10141                 tmp2 = load_reg(s, rm);
10142                 tcg_gen_add_i32(tmp, tmp, tmp2);
10143                 tcg_temp_free_i32(tmp2);
10144                 store_reg(s, rd, tmp);
10145                 break;
10146             case 1: /* cmp */
10147                 tmp = load_reg(s, rd);
10148                 tmp2 = load_reg(s, rm);
10149                 gen_sub_CC(tmp, tmp, tmp2);
10150                 tcg_temp_free_i32(tmp2);
10151                 tcg_temp_free_i32(tmp);
10152                 break;
10153             case 2: /* mov/cpy */
10154                 tmp = load_reg(s, rm);
10155                 store_reg(s, rd, tmp);
10156                 break;
10157             case 3:/* branch [and link] exchange thumb register */
10158                 tmp = load_reg(s, rm);
10159                 if (insn & (1 << 7)) {
10160                     ARCH(5);
10161                     val = (uint32_t)s->pc | 1;
10162                     tmp2 = tcg_temp_new_i32();
10163                     tcg_gen_movi_i32(tmp2, val);
10164                     store_reg(s, 14, tmp2);
10165                 }
10166                 /* already thumb, no need to check */
10167                 gen_bx(s, tmp);
10168                 break;
10169             }
10170             break;
10171         }
10172
10173         /* data processing register */
10174         rd = insn & 7;
10175         rm = (insn >> 3) & 7;
10176         op = (insn >> 6) & 0xf;
10177         if (op == 2 || op == 3 || op == 4 || op == 7) {
10178             /* the shift/rotate ops want the operands backwards */
10179             val = rm;
10180             rm = rd;
10181             rd = val;
10182             val = 1;
10183         } else {
10184             val = 0;
10185         }
10186
10187         if (op == 9) { /* neg */
10188             tmp = tcg_temp_new_i32();
10189             tcg_gen_movi_i32(tmp, 0);
10190         } else if (op != 0xf) { /* mvn doesn't read its first operand */
10191             tmp = load_reg(s, rd);
10192         } else {
10193             TCGV_UNUSED_I32(tmp);
10194         }
10195
10196         tmp2 = load_reg(s, rm);
10197         switch (op) {
10198         case 0x0: /* and */
10199             tcg_gen_and_i32(tmp, tmp, tmp2);
10200             if (!s->condexec_mask)
10201                 gen_logic_CC(tmp);
10202             break;
10203         case 0x1: /* eor */
10204             tcg_gen_xor_i32(tmp, tmp, tmp2);
10205             if (!s->condexec_mask)
10206                 gen_logic_CC(tmp);
10207             break;
10208         case 0x2: /* lsl */
10209             if (s->condexec_mask) {
10210                 gen_shl(tmp2, tmp2, tmp);
10211             } else {
10212                 gen_helper_shl_cc(tmp2, cpu_env, tmp2, tmp);
10213                 gen_logic_CC(tmp2);
10214             }
10215             break;
10216         case 0x3: /* lsr */
10217             if (s->condexec_mask) {
10218                 gen_shr(tmp2, tmp2, tmp);
10219             } else {
10220                 gen_helper_shr_cc(tmp2, cpu_env, tmp2, tmp);
10221                 gen_logic_CC(tmp2);
10222             }
10223             break;
10224         case 0x4: /* asr */
10225             if (s->condexec_mask) {
10226                 gen_sar(tmp2, tmp2, tmp);
10227             } else {
10228                 gen_helper_sar_cc(tmp2, cpu_env, tmp2, tmp);
10229                 gen_logic_CC(tmp2);
10230             }
10231             break;
10232         case 0x5: /* adc */
10233             if (s->condexec_mask) {
10234                 gen_adc(tmp, tmp2);
10235             } else {
10236                 gen_adc_CC(tmp, tmp, tmp2);
10237             }
10238             break;
10239         case 0x6: /* sbc */
10240             if (s->condexec_mask) {
10241                 gen_sub_carry(tmp, tmp, tmp2);
10242             } else {
10243                 gen_sbc_CC(tmp, tmp, tmp2);
10244             }
10245             break;
10246         case 0x7: /* ror */
10247             if (s->condexec_mask) {
10248                 tcg_gen_andi_i32(tmp, tmp, 0x1f);
10249                 tcg_gen_rotr_i32(tmp2, tmp2, tmp);
10250             } else {
10251                 gen_helper_ror_cc(tmp2, cpu_env, tmp2, tmp);
10252                 gen_logic_CC(tmp2);
10253             }
10254             break;
10255         case 0x8: /* tst */
10256             tcg_gen_and_i32(tmp, tmp, tmp2);
10257             gen_logic_CC(tmp);
10258             rd = 16;
10259             break;
10260         case 0x9: /* neg */
10261             if (s->condexec_mask)
10262                 tcg_gen_neg_i32(tmp, tmp2);
10263             else
10264                 gen_sub_CC(tmp, tmp, tmp2);
10265             break;
10266         case 0xa: /* cmp */
10267             gen_sub_CC(tmp, tmp, tmp2);
10268             rd = 16;
10269             break;
10270         case 0xb: /* cmn */
10271             gen_add_CC(tmp, tmp, tmp2);
10272             rd = 16;
10273             break;
10274         case 0xc: /* orr */
10275             tcg_gen_or_i32(tmp, tmp, tmp2);
10276             if (!s->condexec_mask)
10277                 gen_logic_CC(tmp);
10278             break;
10279         case 0xd: /* mul */
10280             tcg_gen_mul_i32(tmp, tmp, tmp2);
10281             if (!s->condexec_mask)
10282                 gen_logic_CC(tmp);
10283             break;
10284         case 0xe: /* bic */
10285             tcg_gen_andc_i32(tmp, tmp, tmp2);
10286             if (!s->condexec_mask)
10287                 gen_logic_CC(tmp);
10288             break;
10289         case 0xf: /* mvn */
10290             tcg_gen_not_i32(tmp2, tmp2);
10291             if (!s->condexec_mask)
10292                 gen_logic_CC(tmp2);
10293             val = 1;
10294             rm = rd;
10295             break;
10296         }
10297         if (rd != 16) {
10298             if (val) {
10299                 store_reg(s, rm, tmp2);
10300                 if (op != 0xf)
10301                     tcg_temp_free_i32(tmp);
10302             } else {
10303                 store_reg(s, rd, tmp);
10304                 tcg_temp_free_i32(tmp2);
10305             }
10306         } else {
10307             tcg_temp_free_i32(tmp);
10308             tcg_temp_free_i32(tmp2);
10309         }
10310         break;
10311
10312     case 5:
10313         /* load/store register offset.  */
10314         rd = insn & 7;
10315         rn = (insn >> 3) & 7;
10316         rm = (insn >> 6) & 7;
10317         op = (insn >> 9) & 7;
10318         addr = load_reg(s, rn);
10319         tmp = load_reg(s, rm);
10320         tcg_gen_add_i32(addr, addr, tmp);
10321         tcg_temp_free_i32(tmp);
10322
10323         if (op < 3) { /* store */
10324             tmp = load_reg(s, rd);
10325         } else {
10326             tmp = tcg_temp_new_i32();
10327         }
10328
10329         switch (op) {
10330         case 0: /* str */
10331             gen_aa32_st32(tmp, addr, get_mem_index(s));
10332             break;
10333         case 1: /* strh */
10334             gen_aa32_st16(tmp, addr, get_mem_index(s));
10335             break;
10336         case 2: /* strb */
10337             gen_aa32_st8(tmp, addr, get_mem_index(s));
10338             break;
10339         case 3: /* ldrsb */
10340             gen_aa32_ld8s(tmp, addr, get_mem_index(s));
10341             break;
10342         case 4: /* ldr */
10343             gen_aa32_ld32u(tmp, addr, get_mem_index(s));
10344             break;
10345         case 5: /* ldrh */
10346             gen_aa32_ld16u(tmp, addr, get_mem_index(s));
10347             break;
10348         case 6: /* ldrb */
10349             gen_aa32_ld8u(tmp, addr, get_mem_index(s));
10350             break;
10351         case 7: /* ldrsh */
10352             gen_aa32_ld16s(tmp, addr, get_mem_index(s));
10353             break;
10354         }
10355         if (op >= 3) { /* load */
10356             store_reg(s, rd, tmp);
10357         } else {
10358             tcg_temp_free_i32(tmp);
10359         }
10360         tcg_temp_free_i32(addr);
10361         break;
10362
10363     case 6:
10364         /* load/store word immediate offset */
10365         rd = insn & 7;
10366         rn = (insn >> 3) & 7;
10367         addr = load_reg(s, rn);
10368         val = (insn >> 4) & 0x7c;
10369         tcg_gen_addi_i32(addr, addr, val);
10370
10371         if (insn & (1 << 11)) {
10372             /* load */
10373             tmp = tcg_temp_new_i32();
10374             gen_aa32_ld32u(tmp, addr, get_mem_index(s));
10375             store_reg(s, rd, tmp);
10376         } else {
10377             /* store */
10378             tmp = load_reg(s, rd);
10379             gen_aa32_st32(tmp, addr, get_mem_index(s));
10380             tcg_temp_free_i32(tmp);
10381         }
10382         tcg_temp_free_i32(addr);
10383         break;
10384
10385     case 7:
10386         /* load/store byte immediate offset */
10387         rd = insn & 7;
10388         rn = (insn >> 3) & 7;
10389         addr = load_reg(s, rn);
10390         val = (insn >> 6) & 0x1f;
10391         tcg_gen_addi_i32(addr, addr, val);
10392
10393         if (insn & (1 << 11)) {
10394             /* load */
10395             tmp = tcg_temp_new_i32();
10396             gen_aa32_ld8u(tmp, addr, get_mem_index(s));
10397             store_reg(s, rd, tmp);
10398         } else {
10399             /* store */
10400             tmp = load_reg(s, rd);
10401             gen_aa32_st8(tmp, addr, get_mem_index(s));
10402             tcg_temp_free_i32(tmp);
10403         }
10404         tcg_temp_free_i32(addr);
10405         break;
10406
10407     case 8:
10408         /* load/store halfword immediate offset */
10409         rd = insn & 7;
10410         rn = (insn >> 3) & 7;
10411         addr = load_reg(s, rn);
10412         val = (insn >> 5) & 0x3e;
10413         tcg_gen_addi_i32(addr, addr, val);
10414
10415         if (insn & (1 << 11)) {
10416             /* load */
10417             tmp = tcg_temp_new_i32();
10418             gen_aa32_ld16u(tmp, addr, get_mem_index(s));
10419             store_reg(s, rd, tmp);
10420         } else {
10421             /* store */
10422             tmp = load_reg(s, rd);
10423             gen_aa32_st16(tmp, addr, get_mem_index(s));
10424             tcg_temp_free_i32(tmp);
10425         }
10426         tcg_temp_free_i32(addr);
10427         break;
10428
10429     case 9:
10430         /* load/store from stack */
10431         rd = (insn >> 8) & 7;
10432         addr = load_reg(s, 13);
10433         val = (insn & 0xff) * 4;
10434         tcg_gen_addi_i32(addr, addr, val);
10435
10436         if (insn & (1 << 11)) {
10437             /* load */
10438             tmp = tcg_temp_new_i32();
10439             gen_aa32_ld32u(tmp, addr, get_mem_index(s));
10440             store_reg(s, rd, tmp);
10441         } else {
10442             /* store */
10443             tmp = load_reg(s, rd);
10444             gen_aa32_st32(tmp, addr, get_mem_index(s));
10445             tcg_temp_free_i32(tmp);
10446         }
10447         tcg_temp_free_i32(addr);
10448         break;
10449
10450     case 10:
10451         /* add to high reg */
10452         rd = (insn >> 8) & 7;
10453         if (insn & (1 << 11)) {
10454             /* SP */
10455             tmp = load_reg(s, 13);
10456         } else {
10457             /* PC. bit 1 is ignored.  */
10458             tmp = tcg_temp_new_i32();
10459             tcg_gen_movi_i32(tmp, (s->pc + 2) & ~(uint32_t)2);
10460         }
10461         val = (insn & 0xff) * 4;
10462         tcg_gen_addi_i32(tmp, tmp, val);
10463         store_reg(s, rd, tmp);
10464         break;
10465
10466     case 11:
10467         /* misc */
10468         op = (insn >> 8) & 0xf;
10469         switch (op) {
10470         case 0:
10471             /* adjust stack pointer */
10472             tmp = load_reg(s, 13);
10473             val = (insn & 0x7f) * 4;
10474             if (insn & (1 << 7))
10475                 val = -(int32_t)val;
10476             tcg_gen_addi_i32(tmp, tmp, val);
10477             store_reg(s, 13, tmp);
10478             break;
10479
10480         case 2: /* sign/zero extend.  */
10481             ARCH(6);
10482             rd = insn & 7;
10483             rm = (insn >> 3) & 7;
10484             tmp = load_reg(s, rm);
10485             switch ((insn >> 6) & 3) {
10486             case 0: gen_sxth(tmp); break;
10487             case 1: gen_sxtb(tmp); break;
10488             case 2: gen_uxth(tmp); break;
10489             case 3: gen_uxtb(tmp); break;
10490             }
10491             store_reg(s, rd, tmp);
10492             break;
10493         case 4: case 5: case 0xc: case 0xd:
10494             /* push/pop */
10495             addr = load_reg(s, 13);
10496             if (insn & (1 << 8))
10497                 offset = 4;
10498             else
10499                 offset = 0;
10500             for (i = 0; i < 8; i++) {
10501                 if (insn & (1 << i))
10502                     offset += 4;
10503             }
10504             if ((insn & (1 << 11)) == 0) {
10505                 tcg_gen_addi_i32(addr, addr, -offset);
10506             }
10507             for (i = 0; i < 8; i++) {
10508                 if (insn & (1 << i)) {
10509                     if (insn & (1 << 11)) {
10510                         /* pop */
10511                         tmp = tcg_temp_new_i32();
10512                         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
10513                         store_reg(s, i, tmp);
10514                     } else {
10515                         /* push */
10516                         tmp = load_reg(s, i);
10517                         gen_aa32_st32(tmp, addr, get_mem_index(s));
10518                         tcg_temp_free_i32(tmp);
10519                     }
10520                     /* advance to the next address.  */
10521                     tcg_gen_addi_i32(addr, addr, 4);
10522                 }
10523             }
10524             TCGV_UNUSED_I32(tmp);
10525             if (insn & (1 << 8)) {
10526                 if (insn & (1 << 11)) {
10527                     /* pop pc */
10528                     tmp = tcg_temp_new_i32();
10529                     gen_aa32_ld32u(tmp, addr, get_mem_index(s));
10530                     /* don't set the pc until the rest of the instruction
10531                        has completed */
10532                 } else {
10533                     /* push lr */
10534                     tmp = load_reg(s, 14);
10535                     gen_aa32_st32(tmp, addr, get_mem_index(s));
10536                     tcg_temp_free_i32(tmp);
10537                 }
10538                 tcg_gen_addi_i32(addr, addr, 4);
10539             }
10540             if ((insn & (1 << 11)) == 0) {
10541                 tcg_gen_addi_i32(addr, addr, -offset);
10542             }
10543             /* write back the new stack pointer */
10544             store_reg(s, 13, addr);
10545             /* set the new PC value */
10546             if ((insn & 0x0900) == 0x0900) {
10547                 store_reg_from_load(env, s, 15, tmp);
10548             }
10549             break;
10550
10551         case 1: case 3: case 9: case 11: /* czb */
10552             rm = insn & 7;
10553             tmp = load_reg(s, rm);
10554             s->condlabel = gen_new_label();
10555             s->condjmp = 1;
10556             if (insn & (1 << 11))
10557                 tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, s->condlabel);
10558             else
10559                 tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, s->condlabel);
10560             tcg_temp_free_i32(tmp);
10561             offset = ((insn & 0xf8) >> 2) | (insn & 0x200) >> 3;
10562             val = (uint32_t)s->pc + 2;
10563             val += offset;
10564             gen_jmp(s, val);
10565             break;
10566
10567         case 15: /* IT, nop-hint.  */
10568             if ((insn & 0xf) == 0) {
10569                 gen_nop_hint(s, (insn >> 4) & 0xf);
10570                 break;
10571             }
10572             /* If Then.  */
10573             s->condexec_cond = (insn >> 4) & 0xe;
10574             s->condexec_mask = insn & 0x1f;
10575             /* No actual code generated for this insn, just setup state.  */
10576             break;
10577
10578         case 0xe: /* bkpt */
10579         {
10580             int imm8 = extract32(insn, 0, 8);
10581             ARCH(5);
10582             gen_exception_insn(s, 2, EXCP_BKPT, syn_aa32_bkpt(imm8, true));
10583             break;
10584         }
10585
10586         case 0xa: /* rev */
10587             ARCH(6);
10588             rn = (insn >> 3) & 0x7;
10589             rd = insn & 0x7;
10590             tmp = load_reg(s, rn);
10591             switch ((insn >> 6) & 3) {
10592             case 0: tcg_gen_bswap32_i32(tmp, tmp); break;
10593             case 1: gen_rev16(tmp); break;
10594             case 3: gen_revsh(tmp); break;
10595             default: goto illegal_op;
10596             }
10597             store_reg(s, rd, tmp);
10598             break;
10599
10600         case 6:
10601             switch ((insn >> 5) & 7) {
10602             case 2:
10603                 /* setend */
10604                 ARCH(6);
10605                 if (((insn >> 3) & 1) != s->bswap_code) {
10606                     /* Dynamic endianness switching not implemented. */
10607                     qemu_log_mask(LOG_UNIMP, "arm: unimplemented setend\n");
10608                     goto illegal_op;
10609                 }
10610                 break;
10611             case 3:
10612                 /* cps */
10613                 ARCH(6);
10614                 if (IS_USER(s)) {
10615                     break;
10616                 }
10617                 if (IS_M(env)) {
10618                     tmp = tcg_const_i32((insn & (1 << 4)) != 0);
10619                     /* FAULTMASK */
10620                     if (insn & 1) {
10621                         addr = tcg_const_i32(19);
10622                         gen_helper_v7m_msr(cpu_env, addr, tmp);
10623                         tcg_temp_free_i32(addr);
10624                     }
10625                     /* PRIMASK */
10626                     if (insn & 2) {
10627                         addr = tcg_const_i32(16);
10628                         gen_helper_v7m_msr(cpu_env, addr, tmp);
10629                         tcg_temp_free_i32(addr);
10630                     }
10631                     tcg_temp_free_i32(tmp);
10632                     gen_lookup_tb(s);
10633                 } else {
10634                     if (insn & (1 << 4)) {
10635                         shift = CPSR_A | CPSR_I | CPSR_F;
10636                     } else {
10637                         shift = 0;
10638                     }
10639                     gen_set_psr_im(s, ((insn & 7) << 6), 0, shift);
10640                 }
10641                 break;
10642             default:
10643                 goto undef;
10644             }
10645             break;
10646
10647         default:
10648             goto undef;
10649         }
10650         break;
10651
10652     case 12:
10653     {
10654         /* load/store multiple */
10655         TCGv_i32 loaded_var;
10656         TCGV_UNUSED_I32(loaded_var);
10657         rn = (insn >> 8) & 0x7;
10658         addr = load_reg(s, rn);
10659         for (i = 0; i < 8; i++) {
10660             if (insn & (1 << i)) {
10661                 if (insn & (1 << 11)) {
10662                     /* load */
10663                     tmp = tcg_temp_new_i32();
10664                     gen_aa32_ld32u(tmp, addr, get_mem_index(s));
10665                     if (i == rn) {
10666                         loaded_var = tmp;
10667                     } else {
10668                         store_reg(s, i, tmp);
10669                     }
10670                 } else {
10671                     /* store */
10672                     tmp = load_reg(s, i);
10673                     gen_aa32_st32(tmp, addr, get_mem_index(s));
10674                     tcg_temp_free_i32(tmp);
10675                 }
10676                 /* advance to the next address */
10677                 tcg_gen_addi_i32(addr, addr, 4);
10678             }
10679         }
10680         if ((insn & (1 << rn)) == 0) {
10681             /* base reg not in list: base register writeback */
10682             store_reg(s, rn, addr);
10683         } else {
10684             /* base reg in list: if load, complete it now */
10685             if (insn & (1 << 11)) {
10686                 store_reg(s, rn, loaded_var);
10687             }
10688             tcg_temp_free_i32(addr);
10689         }
10690         break;
10691     }
10692     case 13:
10693         /* conditional branch or swi */
10694         cond = (insn >> 8) & 0xf;
10695         if (cond == 0xe)
10696             goto undef;
10697
10698         if (cond == 0xf) {
10699             /* swi */
10700             gen_set_pc_im(s, s->pc);
10701             s->svc_imm = extract32(insn, 0, 8);
10702             s->is_jmp = DISAS_SWI;
10703             break;
10704         }
10705         /* generate a conditional jump to next instruction */
10706         s->condlabel = gen_new_label();
10707         arm_gen_test_cc(cond ^ 1, s->condlabel);
10708         s->condjmp = 1;
10709
10710         /* jump to the offset */
10711         val = (uint32_t)s->pc + 2;
10712         offset = ((int32_t)insn << 24) >> 24;
10713         val += offset << 1;
10714         gen_jmp(s, val);
10715         break;
10716
10717     case 14:
10718         if (insn & (1 << 11)) {
10719             if (disas_thumb2_insn(env, s, insn))
10720               goto undef32;
10721             break;
10722         }
10723         /* unconditional branch */
10724         val = (uint32_t)s->pc;
10725         offset = ((int32_t)insn << 21) >> 21;
10726         val += (offset << 1) + 2;
10727         gen_jmp(s, val);
10728         break;
10729
10730     case 15:
10731         if (disas_thumb2_insn(env, s, insn))
10732             goto undef32;
10733         break;
10734     }
10735     return;
10736 undef32:
10737     gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized());
10738     return;
10739 illegal_op:
10740 undef:
10741     gen_exception_insn(s, 2, EXCP_UDEF, syn_uncategorized());
10742 }
10743
10744 /* generate intermediate code in gen_opc_buf and gen_opparam_buf for
10745    basic block 'tb'. If search_pc is TRUE, also generate PC
10746    information for each intermediate instruction. */
10747 static inline void gen_intermediate_code_internal(ARMCPU *cpu,
10748                                                   TranslationBlock *tb,
10749                                                   bool search_pc)
10750 {
10751     CPUState *cs = CPU(cpu);
10752     CPUARMState *env = &cpu->env;
10753     DisasContext dc1, *dc = &dc1;
10754     CPUBreakpoint *bp;
10755     uint16_t *gen_opc_end;
10756     int j, lj;
10757     target_ulong pc_start;
10758     target_ulong next_page_start;
10759     int num_insns;
10760     int max_insns;
10761
10762     /* generate intermediate code */
10763
10764     /* The A64 decoder has its own top level loop, because it doesn't need
10765      * the A32/T32 complexity to do with conditional execution/IT blocks/etc.
10766      */
10767     if (ARM_TBFLAG_AARCH64_STATE(tb->flags)) {
10768         gen_intermediate_code_internal_a64(cpu, tb, search_pc);
10769         return;
10770     }
10771
10772     pc_start = tb->pc;
10773
10774     dc->tb = tb;
10775
10776     gen_opc_end = tcg_ctx.gen_opc_buf + OPC_MAX_SIZE;
10777
10778     dc->is_jmp = DISAS_NEXT;
10779     dc->pc = pc_start;
10780     dc->singlestep_enabled = cs->singlestep_enabled;
10781     dc->condjmp = 0;
10782
10783     dc->aarch64 = 0;
10784     dc->thumb = ARM_TBFLAG_THUMB(tb->flags);
10785     dc->bswap_code = ARM_TBFLAG_BSWAP_CODE(tb->flags);
10786     dc->condexec_mask = (ARM_TBFLAG_CONDEXEC(tb->flags) & 0xf) << 1;
10787     dc->condexec_cond = ARM_TBFLAG_CONDEXEC(tb->flags) >> 4;
10788 #if !defined(CONFIG_USER_ONLY)
10789     dc->user = (ARM_TBFLAG_PRIV(tb->flags) == 0);
10790 #endif
10791     dc->cpacr_fpen = ARM_TBFLAG_CPACR_FPEN(tb->flags);
10792     dc->vfp_enabled = ARM_TBFLAG_VFPEN(tb->flags);
10793     dc->vec_len = ARM_TBFLAG_VECLEN(tb->flags);
10794     dc->vec_stride = ARM_TBFLAG_VECSTRIDE(tb->flags);
10795     dc->cp_regs = cpu->cp_regs;
10796     dc->current_pl = arm_current_pl(env);
10797     dc->features = env->features;
10798
10799     cpu_F0s = tcg_temp_new_i32();
10800     cpu_F1s = tcg_temp_new_i32();
10801     cpu_F0d = tcg_temp_new_i64();
10802     cpu_F1d = tcg_temp_new_i64();
10803     cpu_V0 = cpu_F0d;
10804     cpu_V1 = cpu_F1d;
10805     /* FIXME: cpu_M0 can probably be the same as cpu_V0.  */
10806     cpu_M0 = tcg_temp_new_i64();
10807     next_page_start = (pc_start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
10808     lj = -1;
10809     num_insns = 0;
10810     max_insns = tb->cflags & CF_COUNT_MASK;
10811     if (max_insns == 0)
10812         max_insns = CF_COUNT_MASK;
10813
10814     gen_tb_start();
10815
10816     tcg_clear_temp_count();
10817
10818     /* A note on handling of the condexec (IT) bits:
10819      *
10820      * We want to avoid the overhead of having to write the updated condexec
10821      * bits back to the CPUARMState for every instruction in an IT block. So:
10822      * (1) if the condexec bits are not already zero then we write
10823      * zero back into the CPUARMState now. This avoids complications trying
10824      * to do it at the end of the block. (For example if we don't do this
10825      * it's hard to identify whether we can safely skip writing condexec
10826      * at the end of the TB, which we definitely want to do for the case
10827      * where a TB doesn't do anything with the IT state at all.)
10828      * (2) if we are going to leave the TB then we call gen_set_condexec()
10829      * which will write the correct value into CPUARMState if zero is wrong.
10830      * This is done both for leaving the TB at the end, and for leaving
10831      * it because of an exception we know will happen, which is done in
10832      * gen_exception_insn(). The latter is necessary because we need to
10833      * leave the TB with the PC/IT state just prior to execution of the
10834      * instruction which caused the exception.
10835      * (3) if we leave the TB unexpectedly (eg a data abort on a load)
10836      * then the CPUARMState will be wrong and we need to reset it.
10837      * This is handled in the same way as restoration of the
10838      * PC in these situations: we will be called again with search_pc=1
10839      * and generate a mapping of the condexec bits for each PC in
10840      * gen_opc_condexec_bits[]. restore_state_to_opc() then uses
10841      * this to restore the condexec bits.
10842      *
10843      * Note that there are no instructions which can read the condexec
10844      * bits, and none which can write non-static values to them, so
10845      * we don't need to care about whether CPUARMState is correct in the
10846      * middle of a TB.
10847      */
10848
10849     /* Reset the conditional execution bits immediately. This avoids
10850        complications trying to do it at the end of the block.  */
10851     if (dc->condexec_mask || dc->condexec_cond)
10852       {
10853         TCGv_i32 tmp = tcg_temp_new_i32();
10854         tcg_gen_movi_i32(tmp, 0);
10855         store_cpu_field(tmp, condexec_bits);
10856       }
10857     do {
10858 #ifdef CONFIG_USER_ONLY
10859         /* Intercept jump to the magic kernel page.  */
10860         if (dc->pc >= 0xffff0000) {
10861             /* We always get here via a jump, so know we are not in a
10862                conditional execution block.  */
10863             gen_exception_internal(EXCP_KERNEL_TRAP);
10864             dc->is_jmp = DISAS_UPDATE;
10865             break;
10866         }
10867 #else
10868         if (dc->pc >= 0xfffffff0 && IS_M(env)) {
10869             /* We always get here via a jump, so know we are not in a
10870                conditional execution block.  */
10871             gen_exception_internal(EXCP_EXCEPTION_EXIT);
10872             dc->is_jmp = DISAS_UPDATE;
10873             break;
10874         }
10875 #endif
10876
10877         if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
10878             QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
10879                 if (bp->pc == dc->pc) {
10880                     gen_exception_internal_insn(dc, 0, EXCP_DEBUG);
10881                     /* Advance PC so that clearing the breakpoint will
10882                        invalidate this TB.  */
10883                     dc->pc += 2;
10884                     goto done_generating;
10885                 }
10886             }
10887         }
10888         if (search_pc) {
10889             j = tcg_ctx.gen_opc_ptr - tcg_ctx.gen_opc_buf;
10890             if (lj < j) {
10891                 lj++;
10892                 while (lj < j)
10893                     tcg_ctx.gen_opc_instr_start[lj++] = 0;
10894             }
10895             tcg_ctx.gen_opc_pc[lj] = dc->pc;
10896             gen_opc_condexec_bits[lj] = (dc->condexec_cond << 4) | (dc->condexec_mask >> 1);
10897             tcg_ctx.gen_opc_instr_start[lj] = 1;
10898             tcg_ctx.gen_opc_icount[lj] = num_insns;
10899         }
10900
10901         if (num_insns + 1 == max_insns && (tb->cflags & CF_LAST_IO))
10902             gen_io_start();
10903
10904         if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP | CPU_LOG_TB_OP_OPT))) {
10905             tcg_gen_debug_insn_start(dc->pc);
10906         }
10907
10908         if (dc->thumb) {
10909             disas_thumb_insn(env, dc);
10910             if (dc->condexec_mask) {
10911                 dc->condexec_cond = (dc->condexec_cond & 0xe)
10912                                    | ((dc->condexec_mask >> 4) & 1);
10913                 dc->condexec_mask = (dc->condexec_mask << 1) & 0x1f;
10914                 if (dc->condexec_mask == 0) {
10915                     dc->condexec_cond = 0;
10916                 }
10917             }
10918         } else {
10919             disas_arm_insn(env, dc);
10920         }
10921
10922         if (dc->condjmp && !dc->is_jmp) {
10923             gen_set_label(dc->condlabel);
10924             dc->condjmp = 0;
10925         }
10926
10927         if (tcg_check_temp_count()) {
10928             fprintf(stderr, "TCG temporary leak before "TARGET_FMT_lx"\n",
10929                     dc->pc);
10930         }
10931
10932         /* Translation stops when a conditional branch is encountered.
10933          * Otherwise the subsequent code could get translated several times.
10934          * Also stop translation when a page boundary is reached.  This
10935          * ensures prefetch aborts occur at the right place.  */
10936         num_insns ++;
10937     } while (!dc->is_jmp && tcg_ctx.gen_opc_ptr < gen_opc_end &&
10938              !cs->singlestep_enabled &&
10939              !singlestep &&
10940              dc->pc < next_page_start &&
10941              num_insns < max_insns);
10942
10943     if (tb->cflags & CF_LAST_IO) {
10944         if (dc->condjmp) {
10945             /* FIXME:  This can theoretically happen with self-modifying
10946                code.  */
10947             cpu_abort(cs, "IO on conditional branch instruction");
10948         }
10949         gen_io_end();
10950     }
10951
10952     /* At this stage dc->condjmp will only be set when the skipped
10953        instruction was a conditional branch or trap, and the PC has
10954        already been written.  */
10955     if (unlikely(cs->singlestep_enabled)) {
10956         /* Make sure the pc is updated, and raise a debug exception.  */
10957         if (dc->condjmp) {
10958             gen_set_condexec(dc);
10959             if (dc->is_jmp == DISAS_SWI) {
10960                 gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
10961             } else {
10962                 gen_exception_internal(EXCP_DEBUG);
10963             }
10964             gen_set_label(dc->condlabel);
10965         }
10966         if (dc->condjmp || !dc->is_jmp) {
10967             gen_set_pc_im(dc, dc->pc);
10968             dc->condjmp = 0;
10969         }
10970         gen_set_condexec(dc);
10971         if (dc->is_jmp == DISAS_SWI && !dc->condjmp) {
10972             gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
10973         } else {
10974             /* FIXME: Single stepping a WFI insn will not halt
10975                the CPU.  */
10976             gen_exception_internal(EXCP_DEBUG);
10977         }
10978     } else {
10979         /* While branches must always occur at the end of an IT block,
10980            there are a few other things that can cause us to terminate
10981            the TB in the middle of an IT block:
10982             - Exception generating instructions (bkpt, swi, undefined).
10983             - Page boundaries.
10984             - Hardware watchpoints.
10985            Hardware breakpoints have already been handled and skip this code.
10986          */
10987         gen_set_condexec(dc);
10988         switch(dc->is_jmp) {
10989         case DISAS_NEXT:
10990             gen_goto_tb(dc, 1, dc->pc);
10991             break;
10992         default:
10993         case DISAS_JUMP:
10994         case DISAS_UPDATE:
10995             /* indicate that the hash table must be used to find the next TB */
10996             tcg_gen_exit_tb(0);
10997             break;
10998         case DISAS_TB_JUMP:
10999             /* nothing more to generate */
11000             break;
11001         case DISAS_WFI:
11002             gen_helper_wfi(cpu_env);
11003             break;
11004         case DISAS_WFE:
11005             gen_helper_wfe(cpu_env);
11006             break;
11007         case DISAS_SWI:
11008             gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
11009             break;
11010         }
11011         if (dc->condjmp) {
11012             gen_set_label(dc->condlabel);
11013             gen_set_condexec(dc);
11014             gen_goto_tb(dc, 1, dc->pc);
11015             dc->condjmp = 0;
11016         }
11017     }
11018
11019 done_generating:
11020     gen_tb_end(tb, num_insns);
11021     *tcg_ctx.gen_opc_ptr = INDEX_op_end;
11022
11023 #ifdef DEBUG_DISAS
11024     if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)) {
11025         qemu_log("----------------\n");
11026         qemu_log("IN: %s\n", lookup_symbol(pc_start));
11027         log_target_disas(env, pc_start, dc->pc - pc_start,
11028                          dc->thumb | (dc->bswap_code << 1));
11029         qemu_log("\n");
11030     }
11031 #endif
11032     if (search_pc) {
11033         j = tcg_ctx.gen_opc_ptr - tcg_ctx.gen_opc_buf;
11034         lj++;
11035         while (lj <= j)
11036             tcg_ctx.gen_opc_instr_start[lj++] = 0;
11037     } else {
11038         tb->size = dc->pc - pc_start;
11039         tb->icount = num_insns;
11040     }
11041 }
11042
11043 void gen_intermediate_code(CPUARMState *env, TranslationBlock *tb)
11044 {
11045     gen_intermediate_code_internal(arm_env_get_cpu(env), tb, false);
11046 }
11047
11048 void gen_intermediate_code_pc(CPUARMState *env, TranslationBlock *tb)
11049 {
11050     gen_intermediate_code_internal(arm_env_get_cpu(env), tb, true);
11051 }
11052
11053 static const char *cpu_mode_names[16] = {
11054   "usr", "fiq", "irq", "svc", "???", "???", "mon", "abt",
11055   "???", "???", "hyp", "und", "???", "???", "???", "sys"
11056 };
11057
11058 void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
11059                         int flags)
11060 {
11061     ARMCPU *cpu = ARM_CPU(cs);
11062     CPUARMState *env = &cpu->env;
11063     int i;
11064     uint32_t psr;
11065
11066     if (is_a64(env)) {
11067         aarch64_cpu_dump_state(cs, f, cpu_fprintf, flags);
11068         return;
11069     }
11070
11071     for(i=0;i<16;i++) {
11072         cpu_fprintf(f, "R%02d=%08x", i, env->regs[i]);
11073         if ((i % 4) == 3)
11074             cpu_fprintf(f, "\n");
11075         else
11076             cpu_fprintf(f, " ");
11077     }
11078     psr = cpsr_read(env);
11079     cpu_fprintf(f, "PSR=%08x %c%c%c%c %c %s%d\n",
11080                 psr,
11081                 psr & (1 << 31) ? 'N' : '-',
11082                 psr & (1 << 30) ? 'Z' : '-',
11083                 psr & (1 << 29) ? 'C' : '-',
11084                 psr & (1 << 28) ? 'V' : '-',
11085                 psr & CPSR_T ? 'T' : 'A',
11086                 cpu_mode_names[psr & 0xf], (psr & 0x10) ? 32 : 26);
11087
11088     if (flags & CPU_DUMP_FPU) {
11089         int numvfpregs = 0;
11090         if (arm_feature(env, ARM_FEATURE_VFP)) {
11091             numvfpregs += 16;
11092         }
11093         if (arm_feature(env, ARM_FEATURE_VFP3)) {
11094             numvfpregs += 16;
11095         }
11096         for (i = 0; i < numvfpregs; i++) {
11097             uint64_t v = float64_val(env->vfp.regs[i]);
11098             cpu_fprintf(f, "s%02d=%08x s%02d=%08x d%02d=%016" PRIx64 "\n",
11099                         i * 2, (uint32_t)v,
11100                         i * 2 + 1, (uint32_t)(v >> 32),
11101                         i, v);
11102         }
11103         cpu_fprintf(f, "FPSCR: %08x\n", (int)env->vfp.xregs[ARM_VFP_FPSCR]);
11104     }
11105 }
11106
11107 void restore_state_to_opc(CPUARMState *env, TranslationBlock *tb, int pc_pos)
11108 {
11109     if (is_a64(env)) {
11110         env->pc = tcg_ctx.gen_opc_pc[pc_pos];
11111         env->condexec_bits = 0;
11112     } else {
11113         env->regs[15] = tcg_ctx.gen_opc_pc[pc_pos];
11114         env->condexec_bits = gen_opc_condexec_bits[pc_pos];
11115     }
11116 }