target-arm/translate.c

   1 /*
   2  *  ARM translation
   3  *
   4  *  Copyright (c) 2003 Fabrice Bellard
   5  *  Copyright (c) 2005-2007 CodeSourcery
   6  *  Copyright (c) 2007 OpenedHand, Ltd.
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21 #include <stdarg.h>
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <string.h>
  25 #include <inttypes.h>
  26
  27 #include "cpu.h"
  28 #include "internals.h"
  29 #include "disas/disas.h"
  30 #include "tcg-op.h"
  31 #include "qemu/log.h"
  32 #include "qemu/bitops.h"
  33 #include "arm_ldst.h"
  34
  35 #include "exec/helper-proto.h"
  36 #include "exec/helper-gen.h"
  37
  38 #include "trace-tcg.h"
  39
  40
  41 #define ENABLE_ARCH_4T    arm_dc_feature(s, ARM_FEATURE_V4T)
  42 #define ENABLE_ARCH_5     arm_dc_feature(s, ARM_FEATURE_V5)
  43 /* currently all emulated v5 cores are also v5TE, so don't bother */
  44 #define ENABLE_ARCH_5TE   arm_dc_feature(s, ARM_FEATURE_V5)
  45 #define ENABLE_ARCH_5J    0
  46 #define ENABLE_ARCH_6     arm_dc_feature(s, ARM_FEATURE_V6)
  47 #define ENABLE_ARCH_6K    arm_dc_feature(s, ARM_FEATURE_V6K)
  48 #define ENABLE_ARCH_6T2   arm_dc_feature(s, ARM_FEATURE_THUMB2)
  49 #define ENABLE_ARCH_7     arm_dc_feature(s, ARM_FEATURE_V7)
  50 #define ENABLE_ARCH_8     arm_dc_feature(s, ARM_FEATURE_V8)
  51
  52 #define ARCH(x) do { if (!ENABLE_ARCH_##x) goto illegal_op; } while(0)
  53
  54 #include "translate.h"
  55 static uint32_t gen_opc_condexec_bits[OPC_BUF_SIZE];
  56
  57 #if defined(CONFIG_USER_ONLY)
  58 #define IS_USER(s) 1
  59 #else
  60 #define IS_USER(s) (s->user)
  61 #endif
  62
  63 TCGv_ptr cpu_env;
  64 /* We reuse the same 64-bit temporaries for efficiency.  */
  65 static TCGv_i64 cpu_V0, cpu_V1, cpu_M0;
  66 static TCGv_i32 cpu_R[16];
  67 static TCGv_i32 cpu_CF, cpu_NF, cpu_VF, cpu_ZF;
  68 static TCGv_i64 cpu_exclusive_addr;
  69 static TCGv_i64 cpu_exclusive_val;
  70 #ifdef CONFIG_USER_ONLY
  71 static TCGv_i64 cpu_exclusive_test;
  72 static TCGv_i32 cpu_exclusive_info;
  73 #endif
  74
  75 /* FIXME:  These should be removed.  */
  76 static TCGv_i32 cpu_F0s, cpu_F1s;
  77 static TCGv_i64 cpu_F0d, cpu_F1d;
  78
  79 #include "exec/gen-icount.h"
  80
  81 static const char *regnames[] =
  82     { "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
  83       "r8", "r9", "r10", "r11", "r12", "r13", "r14", "pc" };
  84
  85 /* initialize TCG globals.  */
  86 void arm_translate_init(void)
  87 {
  88     int i;
  89
  90     cpu_env = tcg_global_reg_new_ptr(TCG_AREG0, "env");
  91
  92     for (i = 0; i < 16; i++) {
  93         cpu_R[i] = tcg_global_mem_new_i32(TCG_AREG0,
  94                                           offsetof(CPUARMState, regs[i]),
  95                                           regnames[i]);
  96     }
  97     cpu_CF = tcg_global_mem_new_i32(TCG_AREG0, offsetof(CPUARMState, CF), "CF");
  98     cpu_NF = tcg_global_mem_new_i32(TCG_AREG0, offsetof(CPUARMState, NF), "NF");
  99     cpu_VF = tcg_global_mem_new_i32(TCG_AREG0, offsetof(CPUARMState, VF), "VF");
 100     cpu_ZF = tcg_global_mem_new_i32(TCG_AREG0, offsetof(CPUARMState, ZF), "ZF");
 101
 102     cpu_exclusive_addr = tcg_global_mem_new_i64(TCG_AREG0,
 103         offsetof(CPUARMState, exclusive_addr), "exclusive_addr");
 104     cpu_exclusive_val = tcg_global_mem_new_i64(TCG_AREG0,
 105         offsetof(CPUARMState, exclusive_val), "exclusive_val");
 106 #ifdef CONFIG_USER_ONLY
 107     cpu_exclusive_test = tcg_global_mem_new_i64(TCG_AREG0,
 108         offsetof(CPUARMState, exclusive_test), "exclusive_test");
 109     cpu_exclusive_info = tcg_global_mem_new_i32(TCG_AREG0,
 110         offsetof(CPUARMState, exclusive_info), "exclusive_info");
 111 #endif
 112
 113     a64_translate_init();
 114 }
 115
 116 static inline TCGv_i32 load_cpu_offset(int offset)
 117 {
 118     TCGv_i32 tmp = tcg_temp_new_i32();
 119     tcg_gen_ld_i32(tmp, cpu_env, offset);
 120     return tmp;
 121 }
 122
 123 #define load_cpu_field(name) load_cpu_offset(offsetof(CPUARMState, name))
 124
 125 static inline void store_cpu_offset(TCGv_i32 var, int offset)
 126 {
 127     tcg_gen_st_i32(var, cpu_env, offset);
 128     tcg_temp_free_i32(var);
 129 }
 130
 131 #define store_cpu_field(var, name) \
 132     store_cpu_offset(var, offsetof(CPUARMState, name))
 133
 134 /* Set a variable to the value of a CPU register.  */
 135 static void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
 136 {
 137     if (reg == 15) {
 138         uint32_t addr;
 139         /* normally, since we updated PC, we need only to add one insn */
 140         if (s->thumb)
 141             addr = (long)s->pc + 2;
 142         else
 143             addr = (long)s->pc + 4;
 144         tcg_gen_movi_i32(var, addr);
 145     } else {
 146         tcg_gen_mov_i32(var, cpu_R[reg]);
 147     }
 148 }
 149
 150 /* Create a new temporary and set it to the value of a CPU register.  */
 151 static inline TCGv_i32 load_reg(DisasContext *s, int reg)
 152 {
 153     TCGv_i32 tmp = tcg_temp_new_i32();
 154     load_reg_var(s, tmp, reg);
 155     return tmp;
 156 }
 157
 158 /* Set a CPU register.  The source must be a temporary and will be
 159    marked as dead.  */
 160 static void store_reg(DisasContext *s, int reg, TCGv_i32 var)
 161 {
 162     if (reg == 15) {
 163         tcg_gen_andi_i32(var, var, ~1);
 164         s->is_jmp = DISAS_JUMP;
 165     }
 166     tcg_gen_mov_i32(cpu_R[reg], var);
 167     tcg_temp_free_i32(var);
 168 }
 169
 170 /* Value extensions.  */
 171 #define gen_uxtb(var) tcg_gen_ext8u_i32(var, var)
 172 #define gen_uxth(var) tcg_gen_ext16u_i32(var, var)
 173 #define gen_sxtb(var) tcg_gen_ext8s_i32(var, var)
 174 #define gen_sxth(var) tcg_gen_ext16s_i32(var, var)
 175
 176 #define gen_sxtb16(var) gen_helper_sxtb16(var, var)
 177 #define gen_uxtb16(var) gen_helper_uxtb16(var, var)
 178
 179
 180 static inline void gen_set_cpsr(TCGv_i32 var, uint32_t mask)
 181 {
 182     TCGv_i32 tmp_mask = tcg_const_i32(mask);
 183     gen_helper_cpsr_write(cpu_env, var, tmp_mask);
 184     tcg_temp_free_i32(tmp_mask);
 185 }
 186 /* Set NZCV flags from the high 4 bits of var.  */
 187 #define gen_set_nzcv(var) gen_set_cpsr(var, CPSR_NZCV)
 188
 189 static void gen_exception_internal(int excp)
 190 {
 191     TCGv_i32 tcg_excp = tcg_const_i32(excp);
 192
 193     assert(excp_is_internal(excp));
 194     gen_helper_exception_internal(cpu_env, tcg_excp);
 195     tcg_temp_free_i32(tcg_excp);
 196 }
 197
 198 static void gen_exception(int excp, uint32_t syndrome)
 199 {
 200     TCGv_i32 tcg_excp = tcg_const_i32(excp);
 201     TCGv_i32 tcg_syn = tcg_const_i32(syndrome);
 202
 203     gen_helper_exception_with_syndrome(cpu_env, tcg_excp, tcg_syn);
 204     tcg_temp_free_i32(tcg_syn);
 205     tcg_temp_free_i32(tcg_excp);
 206 }
 207
 208 static void gen_ss_advance(DisasContext *s)
 209 {
 210     /* If the singlestep state is Active-not-pending, advance to
 211      * Active-pending.
 212      */
 213     if (s->ss_active) {
 214         s->pstate_ss = 0;
 215         gen_helper_clear_pstate_ss(cpu_env);
 216     }
 217 }
 218
 219 static void gen_step_complete_exception(DisasContext *s)
 220 {
 221     /* We just completed step of an insn. Move from Active-not-pending
 222      * to Active-pending, and then also take the swstep exception.
 223      * This corresponds to making the (IMPDEF) choice to prioritize
 224      * swstep exceptions over asynchronous exceptions taken to an exception
 225      * level where debug is disabled. This choice has the advantage that
 226      * we do not need to maintain internal state corresponding to the
 227      * ISV/EX syndrome bits between completion of the step and generation
 228      * of the exception, and our syndrome information is always correct.
 229      */
 230     gen_ss_advance(s);
 231     gen_exception(EXCP_UDEF, syn_swstep(s->ss_same_el, 1, s->is_ldex));
 232     s->is_jmp = DISAS_EXC;
 233 }
 234
 235 static void gen_smul_dual(TCGv_i32 a, TCGv_i32 b)
 236 {
 237     TCGv_i32 tmp1 = tcg_temp_new_i32();
 238     TCGv_i32 tmp2 = tcg_temp_new_i32();
 239     tcg_gen_ext16s_i32(tmp1, a);
 240     tcg_gen_ext16s_i32(tmp2, b);
 241     tcg_gen_mul_i32(tmp1, tmp1, tmp2);
 242     tcg_temp_free_i32(tmp2);
 243     tcg_gen_sari_i32(a, a, 16);
 244     tcg_gen_sari_i32(b, b, 16);
 245     tcg_gen_mul_i32(b, b, a);
 246     tcg_gen_mov_i32(a, tmp1);
 247     tcg_temp_free_i32(tmp1);
 248 }
 249
 250 /* Byteswap each halfword.  */
 251 static void gen_rev16(TCGv_i32 var)
 252 {
 253     TCGv_i32 tmp = tcg_temp_new_i32();
 254     tcg_gen_shri_i32(tmp, var, 8);
 255     tcg_gen_andi_i32(tmp, tmp, 0x00ff00ff);
 256     tcg_gen_shli_i32(var, var, 8);
 257     tcg_gen_andi_i32(var, var, 0xff00ff00);
 258     tcg_gen_or_i32(var, var, tmp);
 259     tcg_temp_free_i32(tmp);
 260 }
 261
 262 /* Byteswap low halfword and sign extend.  */
 263 static void gen_revsh(TCGv_i32 var)
 264 {
 265     tcg_gen_ext16u_i32(var, var);
 266     tcg_gen_bswap16_i32(var, var);
 267     tcg_gen_ext16s_i32(var, var);
 268 }
 269
 270 /* Unsigned bitfield extract.  */
 271 static void gen_ubfx(TCGv_i32 var, int shift, uint32_t mask)
 272 {
 273     if (shift)
 274         tcg_gen_shri_i32(var, var, shift);
 275     tcg_gen_andi_i32(var, var, mask);
 276 }
 277
 278 /* Signed bitfield extract.  */
 279 static void gen_sbfx(TCGv_i32 var, int shift, int width)
 280 {
 281     uint32_t signbit;
 282
 283     if (shift)
 284         tcg_gen_sari_i32(var, var, shift);
 285     if (shift + width < 32) {
 286         signbit = 1u << (width - 1);
 287         tcg_gen_andi_i32(var, var, (1u << width) - 1);
 288         tcg_gen_xori_i32(var, var, signbit);
 289         tcg_gen_subi_i32(var, var, signbit);
 290     }
 291 }
 292
 293 /* Return (b << 32) + a. Mark inputs as dead */
 294 static TCGv_i64 gen_addq_msw(TCGv_i64 a, TCGv_i32 b)
 295 {
 296     TCGv_i64 tmp64 = tcg_temp_new_i64();
 297
 298     tcg_gen_extu_i32_i64(tmp64, b);
 299     tcg_temp_free_i32(b);
 300     tcg_gen_shli_i64(tmp64, tmp64, 32);
 301     tcg_gen_add_i64(a, tmp64, a);
 302
 303     tcg_temp_free_i64(tmp64);
 304     return a;
 305 }
 306
 307 /* Return (b << 32) - a. Mark inputs as dead. */
 308 static TCGv_i64 gen_subq_msw(TCGv_i64 a, TCGv_i32 b)
 309 {
 310     TCGv_i64 tmp64 = tcg_temp_new_i64();
 311
 312     tcg_gen_extu_i32_i64(tmp64, b);
 313     tcg_temp_free_i32(b);
 314     tcg_gen_shli_i64(tmp64, tmp64, 32);
 315     tcg_gen_sub_i64(a, tmp64, a);
 316
 317     tcg_temp_free_i64(tmp64);
 318     return a;
 319 }
 320
 321 /* 32x32->64 multiply.  Marks inputs as dead.  */
 322 static TCGv_i64 gen_mulu_i64_i32(TCGv_i32 a, TCGv_i32 b)
 323 {
 324     TCGv_i32 lo = tcg_temp_new_i32();
 325     TCGv_i32 hi = tcg_temp_new_i32();
 326     TCGv_i64 ret;
 327
 328     tcg_gen_mulu2_i32(lo, hi, a, b);
 329     tcg_temp_free_i32(a);
 330     tcg_temp_free_i32(b);
 331
 332     ret = tcg_temp_new_i64();
 333     tcg_gen_concat_i32_i64(ret, lo, hi);
 334     tcg_temp_free_i32(lo);
 335     tcg_temp_free_i32(hi);
 336
 337     return ret;
 338 }
 339
 340 static TCGv_i64 gen_muls_i64_i32(TCGv_i32 a, TCGv_i32 b)
 341 {
 342     TCGv_i32 lo = tcg_temp_new_i32();
 343     TCGv_i32 hi = tcg_temp_new_i32();
 344     TCGv_i64 ret;
 345
 346     tcg_gen_muls2_i32(lo, hi, a, b);
 347     tcg_temp_free_i32(a);
 348     tcg_temp_free_i32(b);
 349
 350     ret = tcg_temp_new_i64();
 351     tcg_gen_concat_i32_i64(ret, lo, hi);
 352     tcg_temp_free_i32(lo);
 353     tcg_temp_free_i32(hi);
 354
 355     return ret;
 356 }
 357
 358 /* Swap low and high halfwords.  */
 359 static void gen_swap_half(TCGv_i32 var)
 360 {
 361     TCGv_i32 tmp = tcg_temp_new_i32();
 362     tcg_gen_shri_i32(tmp, var, 16);
 363     tcg_gen_shli_i32(var, var, 16);
 364     tcg_gen_or_i32(var, var, tmp);
 365     tcg_temp_free_i32(tmp);
 366 }
 367
 368 /* Dual 16-bit add.  Result placed in t0 and t1 is marked as dead.
 369     tmp = (t0 ^ t1) & 0x8000;
 370     t0 &= ~0x8000;
 371     t1 &= ~0x8000;
 372     t0 = (t0 + t1) ^ tmp;
 373  */
 374
 375 static void gen_add16(TCGv_i32 t0, TCGv_i32 t1)
 376 {
 377     TCGv_i32 tmp = tcg_temp_new_i32();
 378     tcg_gen_xor_i32(tmp, t0, t1);
 379     tcg_gen_andi_i32(tmp, tmp, 0x8000);
 380     tcg_gen_andi_i32(t0, t0, ~0x8000);
 381     tcg_gen_andi_i32(t1, t1, ~0x8000);
 382     tcg_gen_add_i32(t0, t0, t1);
 383     tcg_gen_xor_i32(t0, t0, tmp);
 384     tcg_temp_free_i32(tmp);
 385     tcg_temp_free_i32(t1);
 386 }
 387
 388 /* Set CF to the top bit of var.  */
 389 static void gen_set_CF_bit31(TCGv_i32 var)
 390 {
 391     tcg_gen_shri_i32(cpu_CF, var, 31);
 392 }
 393
 394 /* Set N and Z flags from var.  */
 395 static inline void gen_logic_CC(TCGv_i32 var)
 396 {
 397     tcg_gen_mov_i32(cpu_NF, var);
 398     tcg_gen_mov_i32(cpu_ZF, var);
 399 }
 400
 401 /* T0 += T1 + CF.  */
 402 static void gen_adc(TCGv_i32 t0, TCGv_i32 t1)
 403 {
 404     tcg_gen_add_i32(t0, t0, t1);
 405     tcg_gen_add_i32(t0, t0, cpu_CF);
 406 }
 407
 408 /* dest = T0 + T1 + CF. */
 409 static void gen_add_carry(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 410 {
 411     tcg_gen_add_i32(dest, t0, t1);
 412     tcg_gen_add_i32(dest, dest, cpu_CF);
 413 }
 414
 415 /* dest = T0 - T1 + CF - 1.  */
 416 static void gen_sub_carry(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 417 {
 418     tcg_gen_sub_i32(dest, t0, t1);
 419     tcg_gen_add_i32(dest, dest, cpu_CF);
 420     tcg_gen_subi_i32(dest, dest, 1);
 421 }
 422
 423 /* dest = T0 + T1. Compute C, N, V and Z flags */
 424 static void gen_add_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 425 {
 426     TCGv_i32 tmp = tcg_temp_new_i32();
 427     tcg_gen_movi_i32(tmp, 0);
 428     tcg_gen_add2_i32(cpu_NF, cpu_CF, t0, tmp, t1, tmp);
 429     tcg_gen_mov_i32(cpu_ZF, cpu_NF);
 430     tcg_gen_xor_i32(cpu_VF, cpu_NF, t0);
 431     tcg_gen_xor_i32(tmp, t0, t1);
 432     tcg_gen_andc_i32(cpu_VF, cpu_VF, tmp);
 433     tcg_temp_free_i32(tmp);
 434     tcg_gen_mov_i32(dest, cpu_NF);
 435 }
 436
 437 /* dest = T0 + T1 + CF.  Compute C, N, V and Z flags */
 438 static void gen_adc_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 439 {
 440     TCGv_i32 tmp = tcg_temp_new_i32();
 441     if (TCG_TARGET_HAS_add2_i32) {
 442         tcg_gen_movi_i32(tmp, 0);
 443         tcg_gen_add2_i32(cpu_NF, cpu_CF, t0, tmp, cpu_CF, tmp);
 444         tcg_gen_add2_i32(cpu_NF, cpu_CF, cpu_NF, cpu_CF, t1, tmp);
 445     } else {
 446         TCGv_i64 q0 = tcg_temp_new_i64();
 447         TCGv_i64 q1 = tcg_temp_new_i64();
 448         tcg_gen_extu_i32_i64(q0, t0);
 449         tcg_gen_extu_i32_i64(q1, t1);
 450         tcg_gen_add_i64(q0, q0, q1);
 451         tcg_gen_extu_i32_i64(q1, cpu_CF);
 452         tcg_gen_add_i64(q0, q0, q1);
 453         tcg_gen_extr_i64_i32(cpu_NF, cpu_CF, q0);
 454         tcg_temp_free_i64(q0);
 455         tcg_temp_free_i64(q1);
 456     }
 457     tcg_gen_mov_i32(cpu_ZF, cpu_NF);
 458     tcg_gen_xor_i32(cpu_VF, cpu_NF, t0);
 459     tcg_gen_xor_i32(tmp, t0, t1);
 460     tcg_gen_andc_i32(cpu_VF, cpu_VF, tmp);
 461     tcg_temp_free_i32(tmp);
 462     tcg_gen_mov_i32(dest, cpu_NF);
 463 }
 464
 465 /* dest = T0 - T1. Compute C, N, V and Z flags */
 466 static void gen_sub_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 467 {
 468     TCGv_i32 tmp;
 469     tcg_gen_sub_i32(cpu_NF, t0, t1);
 470     tcg_gen_mov_i32(cpu_ZF, cpu_NF);
 471     tcg_gen_setcond_i32(TCG_COND_GEU, cpu_CF, t0, t1);
 472     tcg_gen_xor_i32(cpu_VF, cpu_NF, t0);
 473     tmp = tcg_temp_new_i32();
 474     tcg_gen_xor_i32(tmp, t0, t1);
 475     tcg_gen_and_i32(cpu_VF, cpu_VF, tmp);
 476     tcg_temp_free_i32(tmp);
 477     tcg_gen_mov_i32(dest, cpu_NF);
 478 }
 479
 480 /* dest = T0 + ~T1 + CF.  Compute C, N, V and Z flags */
 481 static void gen_sbc_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 482 {
 483     TCGv_i32 tmp = tcg_temp_new_i32();
 484     tcg_gen_not_i32(tmp, t1);
 485     gen_adc_CC(dest, t0, tmp);
 486     tcg_temp_free_i32(tmp);
 487 }
 488
 489 #define GEN_SHIFT(name)                                               \
 490 static void gen_##name(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)       \
 491 {                                                                     \
 492     TCGv_i32 tmp1, tmp2, tmp3;                                        \
 493     tmp1 = tcg_temp_new_i32();                                        \
 494     tcg_gen_andi_i32(tmp1, t1, 0xff);                                 \
 495     tmp2 = tcg_const_i32(0);                                          \
 496     tmp3 = tcg_const_i32(0x1f);                                       \
 497     tcg_gen_movcond_i32(TCG_COND_GTU, tmp2, tmp1, tmp3, tmp2, t0);    \
 498     tcg_temp_free_i32(tmp3);                                          \
 499     tcg_gen_andi_i32(tmp1, tmp1, 0x1f);                               \
 500     tcg_gen_##name##_i32(dest, tmp2, tmp1);                           \
 501     tcg_temp_free_i32(tmp2);                                          \
 502     tcg_temp_free_i32(tmp1);                                          \
 503 }
 504 GEN_SHIFT(shl)
 505 GEN_SHIFT(shr)
 506 #undef GEN_SHIFT
 507
 508 static void gen_sar(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 509 {
 510     TCGv_i32 tmp1, tmp2;
 511     tmp1 = tcg_temp_new_i32();
 512     tcg_gen_andi_i32(tmp1, t1, 0xff);
 513     tmp2 = tcg_const_i32(0x1f);
 514     tcg_gen_movcond_i32(TCG_COND_GTU, tmp1, tmp1, tmp2, tmp2, tmp1);
 515     tcg_temp_free_i32(tmp2);
 516     tcg_gen_sar_i32(dest, t0, tmp1);
 517     tcg_temp_free_i32(tmp1);
 518 }
 519
 520 static void tcg_gen_abs_i32(TCGv_i32 dest, TCGv_i32 src)
 521 {
 522     TCGv_i32 c0 = tcg_const_i32(0);
 523     TCGv_i32 tmp = tcg_temp_new_i32();
 524     tcg_gen_neg_i32(tmp, src);
 525     tcg_gen_movcond_i32(TCG_COND_GT, dest, src, c0, src, tmp);
 526     tcg_temp_free_i32(c0);
 527     tcg_temp_free_i32(tmp);
 528 }
 529
 530 static void shifter_out_im(TCGv_i32 var, int shift)
 531 {
 532     if (shift == 0) {
 533         tcg_gen_andi_i32(cpu_CF, var, 1);
 534     } else {
 535         tcg_gen_shri_i32(cpu_CF, var, shift);
 536         if (shift != 31) {
 537             tcg_gen_andi_i32(cpu_CF, cpu_CF, 1);
 538         }
 539     }
 540 }
 541
 542 /* Shift by immediate.  Includes special handling for shift == 0.  */
 543 static inline void gen_arm_shift_im(TCGv_i32 var, int shiftop,
 544                                     int shift, int flags)
 545 {
 546     switch (shiftop) {
 547     case 0: /* LSL */
 548         if (shift != 0) {
 549             if (flags)
 550                 shifter_out_im(var, 32 - shift);
 551             tcg_gen_shli_i32(var, var, shift);
 552         }
 553         break;
 554     case 1: /* LSR */
 555         if (shift == 0) {
 556             if (flags) {
 557                 tcg_gen_shri_i32(cpu_CF, var, 31);
 558             }
 559             tcg_gen_movi_i32(var, 0);
 560         } else {
 561             if (flags)
 562                 shifter_out_im(var, shift - 1);
 563             tcg_gen_shri_i32(var, var, shift);
 564         }
 565         break;
 566     case 2: /* ASR */
 567         if (shift == 0)
 568             shift = 32;
 569         if (flags)
 570             shifter_out_im(var, shift - 1);
 571         if (shift == 32)
 572           shift = 31;
 573         tcg_gen_sari_i32(var, var, shift);
 574         break;
 575     case 3: /* ROR/RRX */
 576         if (shift != 0) {
 577             if (flags)
 578                 shifter_out_im(var, shift - 1);
 579             tcg_gen_rotri_i32(var, var, shift); break;
 580         } else {
 581             TCGv_i32 tmp = tcg_temp_new_i32();
 582             tcg_gen_shli_i32(tmp, cpu_CF, 31);
 583             if (flags)
 584                 shifter_out_im(var, 0);
 585             tcg_gen_shri_i32(var, var, 1);
 586             tcg_gen_or_i32(var, var, tmp);
 587             tcg_temp_free_i32(tmp);
 588         }
 589     }
 590 };
 591
 592 static inline void gen_arm_shift_reg(TCGv_i32 var, int shiftop,
 593                                      TCGv_i32 shift, int flags)
 594 {
 595     if (flags) {
 596         switch (shiftop) {
 597         case 0: gen_helper_shl_cc(var, cpu_env, var, shift); break;
 598         case 1: gen_helper_shr_cc(var, cpu_env, var, shift); break;
 599         case 2: gen_helper_sar_cc(var, cpu_env, var, shift); break;
 600         case 3: gen_helper_ror_cc(var, cpu_env, var, shift); break;
 601         }
 602     } else {
 603         switch (shiftop) {
 604         case 0:
 605             gen_shl(var, var, shift);
 606             break;
 607         case 1:
 608             gen_shr(var, var, shift);
 609             break;
 610         case 2:
 611             gen_sar(var, var, shift);
 612             break;
 613         case 3: tcg_gen_andi_i32(shift, shift, 0x1f);
 614                 tcg_gen_rotr_i32(var, var, shift); break;
 615         }
 616     }
 617     tcg_temp_free_i32(shift);
 618 }
 619
 620 #define PAS_OP(pfx) \
 621     switch (op2) {  \
 622     case 0: gen_pas_helper(glue(pfx,add16)); break; \
 623     case 1: gen_pas_helper(glue(pfx,addsubx)); break; \
 624     case 2: gen_pas_helper(glue(pfx,subaddx)); break; \
 625     case 3: gen_pas_helper(glue(pfx,sub16)); break; \
 626     case 4: gen_pas_helper(glue(pfx,add8)); break; \
 627     case 7: gen_pas_helper(glue(pfx,sub8)); break; \
 628     }
 629 static void gen_arm_parallel_addsub(int op1, int op2, TCGv_i32 a, TCGv_i32 b)
 630 {
 631     TCGv_ptr tmp;
 632
 633     switch (op1) {
 634 #define gen_pas_helper(name) glue(gen_helper_,name)(a, a, b, tmp)
 635     case 1:
 636         tmp = tcg_temp_new_ptr();
 637         tcg_gen_addi_ptr(tmp, cpu_env, offsetof(CPUARMState, GE));
 638         PAS_OP(s)
 639         tcg_temp_free_ptr(tmp);
 640         break;
 641     case 5:
 642         tmp = tcg_temp_new_ptr();
 643         tcg_gen_addi_ptr(tmp, cpu_env, offsetof(CPUARMState, GE));
 644         PAS_OP(u)
 645         tcg_temp_free_ptr(tmp);
 646         break;
 647 #undef gen_pas_helper
 648 #define gen_pas_helper(name) glue(gen_helper_,name)(a, a, b)
 649     case 2:
 650         PAS_OP(q);
 651         break;
 652     case 3:
 653         PAS_OP(sh);
 654         break;
 655     case 6:
 656         PAS_OP(uq);
 657         break;
 658     case 7:
 659         PAS_OP(uh);
 660         break;
 661 #undef gen_pas_helper
 662     }
 663 }
 664 #undef PAS_OP
 665
 666 /* For unknown reasons Arm and Thumb-2 use arbitrarily different encodings.  */
 667 #define PAS_OP(pfx) \
 668     switch (op1) {  \
 669     case 0: gen_pas_helper(glue(pfx,add8)); break; \
 670     case 1: gen_pas_helper(glue(pfx,add16)); break; \
 671     case 2: gen_pas_helper(glue(pfx,addsubx)); break; \
 672     case 4: gen_pas_helper(glue(pfx,sub8)); break; \
 673     case 5: gen_pas_helper(glue(pfx,sub16)); break; \
 674     case 6: gen_pas_helper(glue(pfx,subaddx)); break; \
 675     }
 676 static void gen_thumb2_parallel_addsub(int op1, int op2, TCGv_i32 a, TCGv_i32 b)
 677 {
 678     TCGv_ptr tmp;
 679
 680     switch (op2) {
 681 #define gen_pas_helper(name) glue(gen_helper_,name)(a, a, b, tmp)
 682     case 0:
 683         tmp = tcg_temp_new_ptr();
 684         tcg_gen_addi_ptr(tmp, cpu_env, offsetof(CPUARMState, GE));
 685         PAS_OP(s)
 686         tcg_temp_free_ptr(tmp);
 687         break;
 688     case 4:
 689         tmp = tcg_temp_new_ptr();
 690         tcg_gen_addi_ptr(tmp, cpu_env, offsetof(CPUARMState, GE));
 691         PAS_OP(u)
 692         tcg_temp_free_ptr(tmp);
 693         break;
 694 #undef gen_pas_helper
 695 #define gen_pas_helper(name) glue(gen_helper_,name)(a, a, b)
 696     case 1:
 697         PAS_OP(q);
 698         break;
 699     case 2:
 700         PAS_OP(sh);
 701         break;
 702     case 5:
 703         PAS_OP(uq);
 704         break;
 705     case 6:
 706         PAS_OP(uh);
 707         break;
 708 #undef gen_pas_helper
 709     }
 710 }
 711 #undef PAS_OP
 712
 713 /*
 714  * generate a conditional branch based on ARM condition code cc.
 715  * This is common between ARM and Aarch64 targets.
 716  */
 717 void arm_gen_test_cc(int cc, int label)
 718 {
 719     TCGv_i32 tmp;
 720     int inv;
 721
 722     switch (cc) {
 723     case 0: /* eq: Z */
 724         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_ZF, 0, label);
 725         break;
 726     case 1: /* ne: !Z */
 727         tcg_gen_brcondi_i32(TCG_COND_NE, cpu_ZF, 0, label);
 728         break;
 729     case 2: /* cs: C */
 730         tcg_gen_brcondi_i32(TCG_COND_NE, cpu_CF, 0, label);
 731         break;
 732     case 3: /* cc: !C */
 733         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_CF, 0, label);
 734         break;
 735     case 4: /* mi: N */
 736         tcg_gen_brcondi_i32(TCG_COND_LT, cpu_NF, 0, label);
 737         break;
 738     case 5: /* pl: !N */
 739         tcg_gen_brcondi_i32(TCG_COND_GE, cpu_NF, 0, label);
 740         break;
 741     case 6: /* vs: V */
 742         tcg_gen_brcondi_i32(TCG_COND_LT, cpu_VF, 0, label);
 743         break;
 744     case 7: /* vc: !V */
 745         tcg_gen_brcondi_i32(TCG_COND_GE, cpu_VF, 0, label);
 746         break;
 747     case 8: /* hi: C && !Z */
 748         inv = gen_new_label();
 749         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_CF, 0, inv);
 750         tcg_gen_brcondi_i32(TCG_COND_NE, cpu_ZF, 0, label);
 751         gen_set_label(inv);
 752         break;
 753     case 9: /* ls: !C || Z */
 754         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_CF, 0, label);
 755         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_ZF, 0, label);
 756         break;
 757     case 10: /* ge: N == V -> N ^ V == 0 */
 758         tmp = tcg_temp_new_i32();
 759         tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
 760         tcg_gen_brcondi_i32(TCG_COND_GE, tmp, 0, label);
 761         tcg_temp_free_i32(tmp);
 762         break;
 763     case 11: /* lt: N != V -> N ^ V != 0 */
 764         tmp = tcg_temp_new_i32();
 765         tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
 766         tcg_gen_brcondi_i32(TCG_COND_LT, tmp, 0, label);
 767         tcg_temp_free_i32(tmp);
 768         break;
 769     case 12: /* gt: !Z && N == V */
 770         inv = gen_new_label();
 771         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_ZF, 0, inv);
 772         tmp = tcg_temp_new_i32();
 773         tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
 774         tcg_gen_brcondi_i32(TCG_COND_GE, tmp, 0, label);
 775         tcg_temp_free_i32(tmp);
 776         gen_set_label(inv);
 777         break;
 778     case 13: /* le: Z || N != V */
 779         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_ZF, 0, label);
 780         tmp = tcg_temp_new_i32();
 781         tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
 782         tcg_gen_brcondi_i32(TCG_COND_LT, tmp, 0, label);
 783         tcg_temp_free_i32(tmp);
 784         break;
 785     default:
 786         fprintf(stderr, "Bad condition code 0x%x\n", cc);
 787         abort();
 788     }
 789 }
 790
 791 static const uint8_t table_logic_cc[16] = {
 792     1, /* and */
 793     1, /* xor */
 794     0, /* sub */
 795     0, /* rsb */
 796     0, /* add */
 797     0, /* adc */
 798     0, /* sbc */
 799     0, /* rsc */
 800     1, /* andl */
 801     1, /* xorl */
 802     0, /* cmp */
 803     0, /* cmn */
 804     1, /* orr */
 805     1, /* mov */
 806     1, /* bic */
 807     1, /* mvn */
 808 };
 809
 810 /* Set PC and Thumb state from an immediate address.  */
 811 static inline void gen_bx_im(DisasContext *s, uint32_t addr)
 812 {
 813     TCGv_i32 tmp;
 814
 815     s->is_jmp = DISAS_UPDATE;
 816     if (s->thumb != (addr & 1)) {
 817         tmp = tcg_temp_new_i32();
 818         tcg_gen_movi_i32(tmp, addr & 1);
 819         tcg_gen_st_i32(tmp, cpu_env, offsetof(CPUARMState, thumb));
 820         tcg_temp_free_i32(tmp);
 821     }
 822     tcg_gen_movi_i32(cpu_R[15], addr & ~1);
 823 }
 824
 825 /* Set PC and Thumb state from var.  var is marked as dead.  */
 826 static inline void gen_bx(DisasContext *s, TCGv_i32 var)
 827 {
 828     s->is_jmp = DISAS_UPDATE;
 829     tcg_gen_andi_i32(cpu_R[15], var, ~1);
 830     tcg_gen_andi_i32(var, var, 1);
 831     store_cpu_field(var, thumb);
 832 }
 833
 834 /* Variant of store_reg which uses branch&exchange logic when storing
 835    to r15 in ARM architecture v7 and above. The source must be a temporary
 836    and will be marked as dead. */
 837 static inline void store_reg_bx(DisasContext *s, int reg, TCGv_i32 var)
 838 {
 839     if (reg == 15 && ENABLE_ARCH_7) {
 840         gen_bx(s, var);
 841     } else {
 842         store_reg(s, reg, var);
 843     }
 844 }
 845
 846 /* Variant of store_reg which uses branch&exchange logic when storing
 847  * to r15 in ARM architecture v5T and above. This is used for storing
 848  * the results of a LDR/LDM/POP into r15, and corresponds to the cases
 849  * in the ARM ARM which use the LoadWritePC() pseudocode function. */
 850 static inline void store_reg_from_load(DisasContext *s, int reg, TCGv_i32 var)
 851 {
 852     if (reg == 15 && ENABLE_ARCH_5) {
 853         gen_bx(s, var);
 854     } else {
 855         store_reg(s, reg, var);
 856     }
 857 }
 858
 859 /* Abstractions of "generate code to do a guest load/store for
 860  * AArch32", where a vaddr is always 32 bits (and is zero
 861  * extended if we're a 64 bit core) and  data is also
 862  * 32 bits unless specifically doing a 64 bit access.
 863  * These functions work like tcg_gen_qemu_{ld,st}* except
 864  * that the address argument is TCGv_i32 rather than TCGv.
 865  */
 866 #if TARGET_LONG_BITS == 32
 867
 868 #define DO_GEN_LD(SUFF, OPC)                                             \
 869 static inline void gen_aa32_ld##SUFF(TCGv_i32 val, TCGv_i32 addr, int index) \
 870 {                                                                        \
 871     tcg_gen_qemu_ld_i32(val, addr, index, OPC);                          \
 872 }
 873
 874 #define DO_GEN_ST(SUFF, OPC)                                             \
 875 static inline void gen_aa32_st##SUFF(TCGv_i32 val, TCGv_i32 addr, int index) \
 876 {                                                                        \
 877     tcg_gen_qemu_st_i32(val, addr, index, OPC);                          \
 878 }
 879
 880 static inline void gen_aa32_ld64(TCGv_i64 val, TCGv_i32 addr, int index)
 881 {
 882     tcg_gen_qemu_ld_i64(val, addr, index, MO_TEQ);
 883 }
 884
 885 static inline void gen_aa32_st64(TCGv_i64 val, TCGv_i32 addr, int index)
 886 {
 887     tcg_gen_qemu_st_i64(val, addr, index, MO_TEQ);
 888 }
 889
 890 #else
 891
 892 #define DO_GEN_LD(SUFF, OPC)                                             \
 893 static inline void gen_aa32_ld##SUFF(TCGv_i32 val, TCGv_i32 addr, int index) \
 894 {                                                                        \
 895     TCGv addr64 = tcg_temp_new();                                        \
 896     tcg_gen_extu_i32_i64(addr64, addr);                                  \
 897     tcg_gen_qemu_ld_i32(val, addr64, index, OPC);                        \
 898     tcg_temp_free(addr64);                                               \
 899 }
 900
 901 #define DO_GEN_ST(SUFF, OPC)                                             \
 902 static inline void gen_aa32_st##SUFF(TCGv_i32 val, TCGv_i32 addr, int index) \
 903 {                                                                        \
 904     TCGv addr64 = tcg_temp_new();                                        \
 905     tcg_gen_extu_i32_i64(addr64, addr);                                  \
 906     tcg_gen_qemu_st_i32(val, addr64, index, OPC);                        \
 907     tcg_temp_free(addr64);                                               \
 908 }
 909
 910 static inline void gen_aa32_ld64(TCGv_i64 val, TCGv_i32 addr, int index)
 911 {
 912     TCGv addr64 = tcg_temp_new();
 913     tcg_gen_extu_i32_i64(addr64, addr);
 914     tcg_gen_qemu_ld_i64(val, addr64, index, MO_TEQ);
 915     tcg_temp_free(addr64);
 916 }
 917
 918 static inline void gen_aa32_st64(TCGv_i64 val, TCGv_i32 addr, int index)
 919 {
 920     TCGv addr64 = tcg_temp_new();
 921     tcg_gen_extu_i32_i64(addr64, addr);
 922     tcg_gen_qemu_st_i64(val, addr64, index, MO_TEQ);
 923     tcg_temp_free(addr64);
 924 }
 925
 926 #endif
 927
 928 DO_GEN_LD(8s, MO_SB)
 929 DO_GEN_LD(8u, MO_UB)
 930 DO_GEN_LD(16s, MO_TESW)
 931 DO_GEN_LD(16u, MO_TEUW)
 932 DO_GEN_LD(32u, MO_TEUL)
 933 DO_GEN_ST(8, MO_UB)
 934 DO_GEN_ST(16, MO_TEUW)
 935 DO_GEN_ST(32, MO_TEUL)
 936
 937 static inline void gen_set_pc_im(DisasContext *s, target_ulong val)
 938 {
 939     tcg_gen_movi_i32(cpu_R[15], val);
 940 }
 941
 942 static inline void gen_hvc(DisasContext *s, int imm16)
 943 {
 944     /* The pre HVC helper handles cases when HVC gets trapped
 945      * as an undefined insn by runtime configuration (ie before
 946      * the insn really executes).
 947      */
 948     gen_set_pc_im(s, s->pc - 4);
 949     gen_helper_pre_hvc(cpu_env);
 950     /* Otherwise we will treat this as a real exception which
 951      * happens after execution of the insn. (The distinction matters
 952      * for the PC value reported to the exception handler and also
 953      * for single stepping.)
 954      */
 955     s->svc_imm = imm16;
 956     gen_set_pc_im(s, s->pc);
 957     s->is_jmp = DISAS_HVC;
 958 }
 959
 960 static inline void gen_smc(DisasContext *s)
 961 {
 962     /* As with HVC, we may take an exception either before or after
 963      * the insn executes.
 964      */
 965     TCGv_i32 tmp;
 966
 967     gen_set_pc_im(s, s->pc - 4);
 968     tmp = tcg_const_i32(syn_aa32_smc());
 969     gen_helper_pre_smc(cpu_env, tmp);
 970     tcg_temp_free_i32(tmp);
 971     gen_set_pc_im(s, s->pc);
 972     s->is_jmp = DISAS_SMC;
 973 }
 974
 975 static inline void
 976 gen_set_condexec (DisasContext *s)
 977 {
 978     if (s->condexec_mask) {
 979         uint32_t val = (s->condexec_cond << 4) | (s->condexec_mask >> 1);
 980         TCGv_i32 tmp = tcg_temp_new_i32();
 981         tcg_gen_movi_i32(tmp, val);
 982         store_cpu_field(tmp, condexec_bits);
 983     }
 984 }
 985
 986 static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
 987 {
 988     gen_set_condexec(s);
 989     gen_set_pc_im(s, s->pc - offset);
 990     gen_exception_internal(excp);
 991     s->is_jmp = DISAS_JUMP;
 992 }
 993
 994 static void gen_exception_insn(DisasContext *s, int offset, int excp, int syn)
 995 {
 996     gen_set_condexec(s);
 997     gen_set_pc_im(s, s->pc - offset);
 998     gen_exception(excp, syn);
 999     s->is_jmp = DISAS_JUMP;
1000 }
1001
1002 /* Force a TB lookup after an instruction that changes the CPU state.  */
1003 static inline void gen_lookup_tb(DisasContext *s)
1004 {
1005     tcg_gen_movi_i32(cpu_R[15], s->pc & ~1);
1006     s->is_jmp = DISAS_UPDATE;
1007 }
1008
1009 static inline void gen_add_data_offset(DisasContext *s, unsigned int insn,
1010                                        TCGv_i32 var)
1011 {
1012     int val, rm, shift, shiftop;
1013     TCGv_i32 offset;
1014
1015     if (!(insn & (1 << 25))) {
1016         /* immediate */
1017         val = insn & 0xfff;
1018         if (!(insn & (1 << 23)))
1019             val = -val;
1020         if (val != 0)
1021             tcg_gen_addi_i32(var, var, val);
1022     } else {
1023         /* shift/register */
1024         rm = (insn) & 0xf;
1025         shift = (insn >> 7) & 0x1f;
1026         shiftop = (insn >> 5) & 3;
1027         offset = load_reg(s, rm);
1028         gen_arm_shift_im(offset, shiftop, shift, 0);
1029         if (!(insn & (1 << 23)))
1030             tcg_gen_sub_i32(var, var, offset);
1031         else
1032             tcg_gen_add_i32(var, var, offset);
1033         tcg_temp_free_i32(offset);
1034     }
1035 }
1036
1037 static inline void gen_add_datah_offset(DisasContext *s, unsigned int insn,
1038                                         int extra, TCGv_i32 var)
1039 {
1040     int val, rm;
1041     TCGv_i32 offset;
1042
1043     if (insn & (1 << 22)) {
1044         /* immediate */
1045         val = (insn & 0xf) | ((insn >> 4) & 0xf0);
1046         if (!(insn & (1 << 23)))
1047             val = -val;
1048         val += extra;
1049         if (val != 0)
1050             tcg_gen_addi_i32(var, var, val);
1051     } else {
1052         /* register */
1053         if (extra)
1054             tcg_gen_addi_i32(var, var, extra);
1055         rm = (insn) & 0xf;
1056         offset = load_reg(s, rm);
1057         if (!(insn & (1 << 23)))
1058             tcg_gen_sub_i32(var, var, offset);
1059         else
1060             tcg_gen_add_i32(var, var, offset);
1061         tcg_temp_free_i32(offset);
1062     }
1063 }
1064
1065 static TCGv_ptr get_fpstatus_ptr(int neon)
1066 {
1067     TCGv_ptr statusptr = tcg_temp_new_ptr();
1068     int offset;
1069     if (neon) {
1070         offset = offsetof(CPUARMState, vfp.standard_fp_status);
1071     } else {
1072         offset = offsetof(CPUARMState, vfp.fp_status);
1073     }
1074     tcg_gen_addi_ptr(statusptr, cpu_env, offset);
1075     return statusptr;
1076 }
1077
1078 #define VFP_OP2(name)                                                 \
1079 static inline void gen_vfp_##name(int dp)                             \
1080 {                                                                     \
1081     TCGv_ptr fpst = get_fpstatus_ptr(0);                              \
1082     if (dp) {                                                         \
1083         gen_helper_vfp_##name##d(cpu_F0d, cpu_F0d, cpu_F1d, fpst);    \
1084     } else {                                                          \
1085         gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, cpu_F1s, fpst);    \
1086     }                                                                 \
1087     tcg_temp_free_ptr(fpst);                                          \
1088 }
1089
1090 VFP_OP2(add)
1091 VFP_OP2(sub)
1092 VFP_OP2(mul)
1093 VFP_OP2(div)
1094
1095 #undef VFP_OP2
1096
1097 static inline void gen_vfp_F1_mul(int dp)
1098 {
1099     /* Like gen_vfp_mul() but put result in F1 */
1100     TCGv_ptr fpst = get_fpstatus_ptr(0);
1101     if (dp) {
1102         gen_helper_vfp_muld(cpu_F1d, cpu_F0d, cpu_F1d, fpst);
1103     } else {
1104         gen_helper_vfp_muls(cpu_F1s, cpu_F0s, cpu_F1s, fpst);
1105     }
1106     tcg_temp_free_ptr(fpst);
1107 }
1108
1109 static inline void gen_vfp_F1_neg(int dp)
1110 {
1111     /* Like gen_vfp_neg() but put result in F1 */
1112     if (dp) {
1113         gen_helper_vfp_negd(cpu_F1d, cpu_F0d);
1114     } else {
1115         gen_helper_vfp_negs(cpu_F1s, cpu_F0s);
1116     }
1117 }
1118
1119 static inline void gen_vfp_abs(int dp)
1120 {
1121     if (dp)
1122         gen_helper_vfp_absd(cpu_F0d, cpu_F0d);
1123     else
1124         gen_helper_vfp_abss(cpu_F0s, cpu_F0s);
1125 }
1126
1127 static inline void gen_vfp_neg(int dp)
1128 {
1129     if (dp)
1130         gen_helper_vfp_negd(cpu_F0d, cpu_F0d);
1131     else
1132         gen_helper_vfp_negs(cpu_F0s, cpu_F0s);
1133 }
1134
1135 static inline void gen_vfp_sqrt(int dp)
1136 {
1137     if (dp)
1138         gen_helper_vfp_sqrtd(cpu_F0d, cpu_F0d, cpu_env);
1139     else
1140         gen_helper_vfp_sqrts(cpu_F0s, cpu_F0s, cpu_env);
1141 }
1142
1143 static inline void gen_vfp_cmp(int dp)
1144 {
1145     if (dp)
1146         gen_helper_vfp_cmpd(cpu_F0d, cpu_F1d, cpu_env);
1147     else
1148         gen_helper_vfp_cmps(cpu_F0s, cpu_F1s, cpu_env);
1149 }
1150
1151 static inline void gen_vfp_cmpe(int dp)
1152 {
1153     if (dp)
1154         gen_helper_vfp_cmped(cpu_F0d, cpu_F1d, cpu_env);
1155     else
1156         gen_helper_vfp_cmpes(cpu_F0s, cpu_F1s, cpu_env);
1157 }
1158
1159 static inline void gen_vfp_F1_ld0(int dp)
1160 {
1161     if (dp)
1162         tcg_gen_movi_i64(cpu_F1d, 0);
1163     else
1164         tcg_gen_movi_i32(cpu_F1s, 0);
1165 }
1166
1167 #define VFP_GEN_ITOF(name) \
1168 static inline void gen_vfp_##name(int dp, int neon) \
1169 { \
1170     TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
1171     if (dp) { \
1172         gen_helper_vfp_##name##d(cpu_F0d, cpu_F0s, statusptr); \
1173     } else { \
1174         gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
1175     } \
1176     tcg_temp_free_ptr(statusptr); \
1177 }
1178
1179 VFP_GEN_ITOF(uito)
1180 VFP_GEN_ITOF(sito)
1181 #undef VFP_GEN_ITOF
1182
1183 #define VFP_GEN_FTOI(name) \
1184 static inline void gen_vfp_##name(int dp, int neon) \
1185 { \
1186     TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
1187     if (dp) { \
1188         gen_helper_vfp_##name##d(cpu_F0s, cpu_F0d, statusptr); \
1189     } else { \
1190         gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
1191     } \
1192     tcg_temp_free_ptr(statusptr); \
1193 }
1194
1195 VFP_GEN_FTOI(toui)
1196 VFP_GEN_FTOI(touiz)
1197 VFP_GEN_FTOI(tosi)
1198 VFP_GEN_FTOI(tosiz)
1199 #undef VFP_GEN_FTOI
1200
1201 #define VFP_GEN_FIX(name, round) \
1202 static inline void gen_vfp_##name(int dp, int shift, int neon) \
1203 { \
1204     TCGv_i32 tmp_shift = tcg_const_i32(shift); \
1205     TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
1206     if (dp) { \
1207         gen_helper_vfp_##name##d##round(cpu_F0d, cpu_F0d, tmp_shift, \
1208                                         statusptr); \
1209     } else { \
1210         gen_helper_vfp_##name##s##round(cpu_F0s, cpu_F0s, tmp_shift, \
1211                                         statusptr); \
1212     } \
1213     tcg_temp_free_i32(tmp_shift); \
1214     tcg_temp_free_ptr(statusptr); \
1215 }
1216 VFP_GEN_FIX(tosh, _round_to_zero)
1217 VFP_GEN_FIX(tosl, _round_to_zero)
1218 VFP_GEN_FIX(touh, _round_to_zero)
1219 VFP_GEN_FIX(toul, _round_to_zero)
1220 VFP_GEN_FIX(shto, )
1221 VFP_GEN_FIX(slto, )
1222 VFP_GEN_FIX(uhto, )
1223 VFP_GEN_FIX(ulto, )
1224 #undef VFP_GEN_FIX
1225
1226 static inline void gen_vfp_ld(DisasContext *s, int dp, TCGv_i32 addr)
1227 {
1228     if (dp) {
1229         gen_aa32_ld64(cpu_F0d, addr, get_mem_index(s));
1230     } else {
1231         gen_aa32_ld32u(cpu_F0s, addr, get_mem_index(s));
1232     }
1233 }
1234
1235 static inline void gen_vfp_st(DisasContext *s, int dp, TCGv_i32 addr)
1236 {
1237     if (dp) {
1238         gen_aa32_st64(cpu_F0d, addr, get_mem_index(s));
1239     } else {
1240         gen_aa32_st32(cpu_F0s, addr, get_mem_index(s));
1241     }
1242 }
1243
1244 static inline long
1245 vfp_reg_offset (int dp, int reg)
1246 {
1247     if (dp)
1248         return offsetof(CPUARMState, vfp.regs[reg]);
1249     else if (reg & 1) {
1250         return offsetof(CPUARMState, vfp.regs[reg >> 1])
1251           + offsetof(CPU_DoubleU, l.upper);
1252     } else {
1253         return offsetof(CPUARMState, vfp.regs[reg >> 1])
1254           + offsetof(CPU_DoubleU, l.lower);
1255     }
1256 }
1257
1258 /* Return the offset of a 32-bit piece of a NEON register.
1259    zero is the least significant end of the register.  */
1260 static inline long
1261 neon_reg_offset (int reg, int n)
1262 {
1263     int sreg;
1264     sreg = reg * 2 + n;
1265     return vfp_reg_offset(0, sreg);
1266 }
1267
1268 static TCGv_i32 neon_load_reg(int reg, int pass)
1269 {
1270     TCGv_i32 tmp = tcg_temp_new_i32();
1271     tcg_gen_ld_i32(tmp, cpu_env, neon_reg_offset(reg, pass));
1272     return tmp;
1273 }
1274
1275 static void neon_store_reg(int reg, int pass, TCGv_i32 var)
1276 {
1277     tcg_gen_st_i32(var, cpu_env, neon_reg_offset(reg, pass));
1278     tcg_temp_free_i32(var);
1279 }
1280
1281 static inline void neon_load_reg64(TCGv_i64 var, int reg)
1282 {
1283     tcg_gen_ld_i64(var, cpu_env, vfp_reg_offset(1, reg));
1284 }
1285
1286 static inline void neon_store_reg64(TCGv_i64 var, int reg)
1287 {
1288     tcg_gen_st_i64(var, cpu_env, vfp_reg_offset(1, reg));
1289 }
1290
1291 #define tcg_gen_ld_f32 tcg_gen_ld_i32
1292 #define tcg_gen_ld_f64 tcg_gen_ld_i64
1293 #define tcg_gen_st_f32 tcg_gen_st_i32
1294 #define tcg_gen_st_f64 tcg_gen_st_i64
1295
1296 static inline void gen_mov_F0_vreg(int dp, int reg)
1297 {
1298     if (dp)
1299         tcg_gen_ld_f64(cpu_F0d, cpu_env, vfp_reg_offset(dp, reg));
1300     else
1301         tcg_gen_ld_f32(cpu_F0s, cpu_env, vfp_reg_offset(dp, reg));
1302 }
1303
1304 static inline void gen_mov_F1_vreg(int dp, int reg)
1305 {
1306     if (dp)
1307         tcg_gen_ld_f64(cpu_F1d, cpu_env, vfp_reg_offset(dp, reg));
1308     else
1309         tcg_gen_ld_f32(cpu_F1s, cpu_env, vfp_reg_offset(dp, reg));
1310 }
1311
1312 static inline void gen_mov_vreg_F0(int dp, int reg)
1313 {
1314     if (dp)
1315         tcg_gen_st_f64(cpu_F0d, cpu_env, vfp_reg_offset(dp, reg));
1316     else
1317         tcg_gen_st_f32(cpu_F0s, cpu_env, vfp_reg_offset(dp, reg));
1318 }
1319
1320 #define ARM_CP_RW_BIT   (1 << 20)
1321
1322 static inline void iwmmxt_load_reg(TCGv_i64 var, int reg)
1323 {
1324     tcg_gen_ld_i64(var, cpu_env, offsetof(CPUARMState, iwmmxt.regs[reg]));
1325 }
1326
1327 static inline void iwmmxt_store_reg(TCGv_i64 var, int reg)
1328 {
1329     tcg_gen_st_i64(var, cpu_env, offsetof(CPUARMState, iwmmxt.regs[reg]));
1330 }
1331
1332 static inline TCGv_i32 iwmmxt_load_creg(int reg)
1333 {
1334     TCGv_i32 var = tcg_temp_new_i32();
1335     tcg_gen_ld_i32(var, cpu_env, offsetof(CPUARMState, iwmmxt.cregs[reg]));
1336     return var;
1337 }
1338
1339 static inline void iwmmxt_store_creg(int reg, TCGv_i32 var)
1340 {
1341     tcg_gen_st_i32(var, cpu_env, offsetof(CPUARMState, iwmmxt.cregs[reg]));
1342     tcg_temp_free_i32(var);
1343 }
1344
1345 static inline void gen_op_iwmmxt_movq_wRn_M0(int rn)
1346 {
1347     iwmmxt_store_reg(cpu_M0, rn);
1348 }
1349
1350 static inline void gen_op_iwmmxt_movq_M0_wRn(int rn)
1351 {
1352     iwmmxt_load_reg(cpu_M0, rn);
1353 }
1354
1355 static inline void gen_op_iwmmxt_orq_M0_wRn(int rn)
1356 {
1357     iwmmxt_load_reg(cpu_V1, rn);
1358     tcg_gen_or_i64(cpu_M0, cpu_M0, cpu_V1);
1359 }
1360
1361 static inline void gen_op_iwmmxt_andq_M0_wRn(int rn)
1362 {
1363     iwmmxt_load_reg(cpu_V1, rn);
1364     tcg_gen_and_i64(cpu_M0, cpu_M0, cpu_V1);
1365 }
1366
1367 static inline void gen_op_iwmmxt_xorq_M0_wRn(int rn)
1368 {
1369     iwmmxt_load_reg(cpu_V1, rn);
1370     tcg_gen_xor_i64(cpu_M0, cpu_M0, cpu_V1);
1371 }
1372
1373 #define IWMMXT_OP(name) \
1374 static inline void gen_op_iwmmxt_##name##_M0_wRn(int rn) \
1375 { \
1376     iwmmxt_load_reg(cpu_V1, rn); \
1377     gen_helper_iwmmxt_##name(cpu_M0, cpu_M0, cpu_V1); \
1378 }
1379
1380 #define IWMMXT_OP_ENV(name) \
1381 static inline void gen_op_iwmmxt_##name##_M0_wRn(int rn) \
1382 { \
1383     iwmmxt_load_reg(cpu_V1, rn); \
1384     gen_helper_iwmmxt_##name(cpu_M0, cpu_env, cpu_M0, cpu_V1); \
1385 }
1386
1387 #define IWMMXT_OP_ENV_SIZE(name) \
1388 IWMMXT_OP_ENV(name##b) \
1389 IWMMXT_OP_ENV(name##w) \
1390 IWMMXT_OP_ENV(name##l)
1391
1392 #define IWMMXT_OP_ENV1(name) \
1393 static inline void gen_op_iwmmxt_##name##_M0(void) \
1394 { \
1395     gen_helper_iwmmxt_##name(cpu_M0, cpu_env, cpu_M0); \
1396 }
1397
1398 IWMMXT_OP(maddsq)
1399 IWMMXT_OP(madduq)
1400 IWMMXT_OP(sadb)
1401 IWMMXT_OP(sadw)
1402 IWMMXT_OP(mulslw)
1403 IWMMXT_OP(mulshw)
1404 IWMMXT_OP(mululw)
1405 IWMMXT_OP(muluhw)
1406 IWMMXT_OP(macsw)
1407 IWMMXT_OP(macuw)
1408
1409 IWMMXT_OP_ENV_SIZE(unpackl)
1410 IWMMXT_OP_ENV_SIZE(unpackh)
1411
1412 IWMMXT_OP_ENV1(unpacklub)
1413 IWMMXT_OP_ENV1(unpackluw)
1414 IWMMXT_OP_ENV1(unpacklul)
1415 IWMMXT_OP_ENV1(unpackhub)
1416 IWMMXT_OP_ENV1(unpackhuw)
1417 IWMMXT_OP_ENV1(unpackhul)
1418 IWMMXT_OP_ENV1(unpacklsb)
1419 IWMMXT_OP_ENV1(unpacklsw)
1420 IWMMXT_OP_ENV1(unpacklsl)
1421 IWMMXT_OP_ENV1(unpackhsb)
1422 IWMMXT_OP_ENV1(unpackhsw)
1423 IWMMXT_OP_ENV1(unpackhsl)
1424
1425 IWMMXT_OP_ENV_SIZE(cmpeq)
1426 IWMMXT_OP_ENV_SIZE(cmpgtu)
1427 IWMMXT_OP_ENV_SIZE(cmpgts)
1428
1429 IWMMXT_OP_ENV_SIZE(mins)
1430 IWMMXT_OP_ENV_SIZE(minu)
1431 IWMMXT_OP_ENV_SIZE(maxs)
1432 IWMMXT_OP_ENV_SIZE(maxu)
1433
1434 IWMMXT_OP_ENV_SIZE(subn)
1435 IWMMXT_OP_ENV_SIZE(addn)
1436 IWMMXT_OP_ENV_SIZE(subu)
1437 IWMMXT_OP_ENV_SIZE(addu)
1438 IWMMXT_OP_ENV_SIZE(subs)
1439 IWMMXT_OP_ENV_SIZE(adds)
1440
1441 IWMMXT_OP_ENV(avgb0)
1442 IWMMXT_OP_ENV(avgb1)
1443 IWMMXT_OP_ENV(avgw0)
1444 IWMMXT_OP_ENV(avgw1)
1445
1446 IWMMXT_OP_ENV(packuw)
1447 IWMMXT_OP_ENV(packul)
1448 IWMMXT_OP_ENV(packuq)
1449 IWMMXT_OP_ENV(packsw)
1450 IWMMXT_OP_ENV(packsl)
1451 IWMMXT_OP_ENV(packsq)
1452
1453 static void gen_op_iwmmxt_set_mup(void)
1454 {
1455     TCGv_i32 tmp;
1456     tmp = load_cpu_field(iwmmxt.cregs[ARM_IWMMXT_wCon]);
1457     tcg_gen_ori_i32(tmp, tmp, 2);
1458     store_cpu_field(tmp, iwmmxt.cregs[ARM_IWMMXT_wCon]);
1459 }
1460
1461 static void gen_op_iwmmxt_set_cup(void)
1462 {
1463     TCGv_i32 tmp;
1464     tmp = load_cpu_field(iwmmxt.cregs[ARM_IWMMXT_wCon]);
1465     tcg_gen_ori_i32(tmp, tmp, 1);
1466     store_cpu_field(tmp, iwmmxt.cregs[ARM_IWMMXT_wCon]);
1467 }
1468
1469 static void gen_op_iwmmxt_setpsr_nz(void)
1470 {
1471     TCGv_i32 tmp = tcg_temp_new_i32();
1472     gen_helper_iwmmxt_setpsr_nz(tmp, cpu_M0);
1473     store_cpu_field(tmp, iwmmxt.cregs[ARM_IWMMXT_wCASF]);
1474 }
1475
1476 static inline void gen_op_iwmmxt_addl_M0_wRn(int rn)
1477 {
1478     iwmmxt_load_reg(cpu_V1, rn);
1479     tcg_gen_ext32u_i64(cpu_V1, cpu_V1);
1480     tcg_gen_add_i64(cpu_M0, cpu_M0, cpu_V1);
1481 }
1482
1483 static inline int gen_iwmmxt_address(DisasContext *s, uint32_t insn,
1484                                      TCGv_i32 dest)
1485 {
1486     int rd;
1487     uint32_t offset;
1488     TCGv_i32 tmp;
1489
1490     rd = (insn >> 16) & 0xf;
1491     tmp = load_reg(s, rd);
1492
1493     offset = (insn & 0xff) << ((insn >> 7) & 2);
1494     if (insn & (1 << 24)) {
1495         /* Pre indexed */
1496         if (insn & (1 << 23))
1497             tcg_gen_addi_i32(tmp, tmp, offset);
1498         else
1499             tcg_gen_addi_i32(tmp, tmp, -offset);
1500         tcg_gen_mov_i32(dest, tmp);
1501         if (insn & (1 << 21))
1502             store_reg(s, rd, tmp);
1503         else
1504             tcg_temp_free_i32(tmp);
1505     } else if (insn & (1 << 21)) {
1506         /* Post indexed */
1507         tcg_gen_mov_i32(dest, tmp);
1508         if (insn & (1 << 23))
1509             tcg_gen_addi_i32(tmp, tmp, offset);
1510         else
1511             tcg_gen_addi_i32(tmp, tmp, -offset);
1512         store_reg(s, rd, tmp);
1513     } else if (!(insn & (1 << 23)))
1514         return 1;
1515     return 0;
1516 }
1517
1518 static inline int gen_iwmmxt_shift(uint32_t insn, uint32_t mask, TCGv_i32 dest)
1519 {
1520     int rd = (insn >> 0) & 0xf;
1521     TCGv_i32 tmp;
1522
1523     if (insn & (1 << 8)) {
1524         if (rd < ARM_IWMMXT_wCGR0 || rd > ARM_IWMMXT_wCGR3) {
1525             return 1;
1526         } else {
1527             tmp = iwmmxt_load_creg(rd);
1528         }
1529     } else {
1530         tmp = tcg_temp_new_i32();
1531         iwmmxt_load_reg(cpu_V0, rd);
1532         tcg_gen_trunc_i64_i32(tmp, cpu_V0);
1533     }
1534     tcg_gen_andi_i32(tmp, tmp, mask);
1535     tcg_gen_mov_i32(dest, tmp);
1536     tcg_temp_free_i32(tmp);
1537     return 0;
1538 }
1539
1540 /* Disassemble an iwMMXt instruction.  Returns nonzero if an error occurred
1541    (ie. an undefined instruction).  */
1542 static int disas_iwmmxt_insn(DisasContext *s, uint32_t insn)
1543 {
1544     int rd, wrd;
1545     int rdhi, rdlo, rd0, rd1, i;
1546     TCGv_i32 addr;
1547     TCGv_i32 tmp, tmp2, tmp3;
1548
1549     if ((insn & 0x0e000e00) == 0x0c000000) {
1550         if ((insn & 0x0fe00ff0) == 0x0c400000) {
1551             wrd = insn & 0xf;
1552             rdlo = (insn >> 12) & 0xf;
1553             rdhi = (insn >> 16) & 0xf;
1554             if (insn & ARM_CP_RW_BIT) {                 /* TMRRC */
1555                 iwmmxt_load_reg(cpu_V0, wrd);
1556                 tcg_gen_trunc_i64_i32(cpu_R[rdlo], cpu_V0);
1557                 tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
1558                 tcg_gen_trunc_i64_i32(cpu_R[rdhi], cpu_V0);
1559             } else {                                    /* TMCRR */
1560                 tcg_gen_concat_i32_i64(cpu_V0, cpu_R[rdlo], cpu_R[rdhi]);
1561                 iwmmxt_store_reg(cpu_V0, wrd);
1562                 gen_op_iwmmxt_set_mup();
1563             }
1564             return 0;
1565         }
1566
1567         wrd = (insn >> 12) & 0xf;
1568         addr = tcg_temp_new_i32();
1569         if (gen_iwmmxt_address(s, insn, addr)) {
1570             tcg_temp_free_i32(addr);
1571             return 1;
1572         }
1573         if (insn & ARM_CP_RW_BIT) {
1574             if ((insn >> 28) == 0xf) {                  /* WLDRW wCx */
1575                 tmp = tcg_temp_new_i32();
1576                 gen_aa32_ld32u(tmp, addr, get_mem_index(s));
1577                 iwmmxt_store_creg(wrd, tmp);
1578             } else {
1579                 i = 1;
1580                 if (insn & (1 << 8)) {
1581                     if (insn & (1 << 22)) {             /* WLDRD */
1582                         gen_aa32_ld64(cpu_M0, addr, get_mem_index(s));
1583                         i = 0;
1584                     } else {                            /* WLDRW wRd */
1585                         tmp = tcg_temp_new_i32();
1586                         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
1587                     }
1588                 } else {
1589                     tmp = tcg_temp_new_i32();
1590                     if (insn & (1 << 22)) {             /* WLDRH */
1591                         gen_aa32_ld16u(tmp, addr, get_mem_index(s));
1592                     } else {                            /* WLDRB */
1593                         gen_aa32_ld8u(tmp, addr, get_mem_index(s));
1594                     }
1595                 }
1596                 if (i) {
1597                     tcg_gen_extu_i32_i64(cpu_M0, tmp);
1598                     tcg_temp_free_i32(tmp);
1599                 }
1600                 gen_op_iwmmxt_movq_wRn_M0(wrd);
1601             }
1602         } else {
1603             if ((insn >> 28) == 0xf) {                  /* WSTRW wCx */
1604                 tmp = iwmmxt_load_creg(wrd);
1605                 gen_aa32_st32(tmp, addr, get_mem_index(s));
1606             } else {
1607                 gen_op_iwmmxt_movq_M0_wRn(wrd);
1608                 tmp = tcg_temp_new_i32();
1609                 if (insn & (1 << 8)) {
1610                     if (insn & (1 << 22)) {             /* WSTRD */
1611                         gen_aa32_st64(cpu_M0, addr, get_mem_index(s));
1612                     } else {                            /* WSTRW wRd */
1613                         tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1614                         gen_aa32_st32(tmp, addr, get_mem_index(s));
1615                     }
1616                 } else {
1617                     if (insn & (1 << 22)) {             /* WSTRH */
1618                         tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1619                         gen_aa32_st16(tmp, addr, get_mem_index(s));
1620                     } else {                            /* WSTRB */
1621                         tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1622                         gen_aa32_st8(tmp, addr, get_mem_index(s));
1623                     }
1624                 }
1625             }
1626             tcg_temp_free_i32(tmp);
1627         }
1628         tcg_temp_free_i32(addr);
1629         return 0;
1630     }
1631
1632     if ((insn & 0x0f000000) != 0x0e000000)
1633         return 1;
1634
1635     switch (((insn >> 12) & 0xf00) | ((insn >> 4) & 0xff)) {
1636     case 0x000:                                         /* WOR */
1637         wrd = (insn >> 12) & 0xf;
1638         rd0 = (insn >> 0) & 0xf;
1639         rd1 = (insn >> 16) & 0xf;
1640         gen_op_iwmmxt_movq_M0_wRn(rd0);
1641         gen_op_iwmmxt_orq_M0_wRn(rd1);
1642         gen_op_iwmmxt_setpsr_nz();
1643         gen_op_iwmmxt_movq_wRn_M0(wrd);
1644         gen_op_iwmmxt_set_mup();
1645         gen_op_iwmmxt_set_cup();
1646         break;
1647     case 0x011:                                         /* TMCR */
1648         if (insn & 0xf)
1649             return 1;
1650         rd = (insn >> 12) & 0xf;
1651         wrd = (insn >> 16) & 0xf;
1652         switch (wrd) {
1653         case ARM_IWMMXT_wCID:
1654         case ARM_IWMMXT_wCASF:
1655             break;
1656         case ARM_IWMMXT_wCon:
1657             gen_op_iwmmxt_set_cup();
1658             /* Fall through.  */
1659         case ARM_IWMMXT_wCSSF:
1660             tmp = iwmmxt_load_creg(wrd);
1661             tmp2 = load_reg(s, rd);
1662             tcg_gen_andc_i32(tmp, tmp, tmp2);
1663             tcg_temp_free_i32(tmp2);
1664             iwmmxt_store_creg(wrd, tmp);
1665             break;
1666         case ARM_IWMMXT_wCGR0:
1667         case ARM_IWMMXT_wCGR1:
1668         case ARM_IWMMXT_wCGR2:
1669         case ARM_IWMMXT_wCGR3:
1670             gen_op_iwmmxt_set_cup();
1671             tmp = load_reg(s, rd);
1672             iwmmxt_store_creg(wrd, tmp);
1673             break;
1674         default:
1675             return 1;
1676         }
1677         break;
1678     case 0x100:                                         /* WXOR */
1679         wrd = (insn >> 12) & 0xf;
1680         rd0 = (insn >> 0) & 0xf;
1681         rd1 = (insn >> 16) & 0xf;
1682         gen_op_iwmmxt_movq_M0_wRn(rd0);
1683         gen_op_iwmmxt_xorq_M0_wRn(rd1);
1684         gen_op_iwmmxt_setpsr_nz();
1685         gen_op_iwmmxt_movq_wRn_M0(wrd);
1686         gen_op_iwmmxt_set_mup();
1687         gen_op_iwmmxt_set_cup();
1688         break;
1689     case 0x111:                                         /* TMRC */
1690         if (insn & 0xf)
1691             return 1;
1692         rd = (insn >> 12) & 0xf;
1693         wrd = (insn >> 16) & 0xf;
1694         tmp = iwmmxt_load_creg(wrd);
1695         store_reg(s, rd, tmp);
1696         break;
1697     case 0x300:                                         /* WANDN */
1698         wrd = (insn >> 12) & 0xf;
1699         rd0 = (insn >> 0) & 0xf;
1700         rd1 = (insn >> 16) & 0xf;
1701         gen_op_iwmmxt_movq_M0_wRn(rd0);
1702         tcg_gen_neg_i64(cpu_M0, cpu_M0);
1703         gen_op_iwmmxt_andq_M0_wRn(rd1);
1704         gen_op_iwmmxt_setpsr_nz();
1705         gen_op_iwmmxt_movq_wRn_M0(wrd);
1706         gen_op_iwmmxt_set_mup();
1707         gen_op_iwmmxt_set_cup();
1708         break;
1709     case 0x200:                                         /* WAND */
1710         wrd = (insn >> 12) & 0xf;
1711         rd0 = (insn >> 0) & 0xf;
1712         rd1 = (insn >> 16) & 0xf;
1713         gen_op_iwmmxt_movq_M0_wRn(rd0);
1714         gen_op_iwmmxt_andq_M0_wRn(rd1);
1715         gen_op_iwmmxt_setpsr_nz();
1716         gen_op_iwmmxt_movq_wRn_M0(wrd);
1717         gen_op_iwmmxt_set_mup();
1718         gen_op_iwmmxt_set_cup();
1719         break;
1720     case 0x810: case 0xa10:                             /* WMADD */
1721         wrd = (insn >> 12) & 0xf;
1722         rd0 = (insn >> 0) & 0xf;
1723         rd1 = (insn >> 16) & 0xf;
1724         gen_op_iwmmxt_movq_M0_wRn(rd0);
1725         if (insn & (1 << 21))
1726             gen_op_iwmmxt_maddsq_M0_wRn(rd1);
1727         else
1728             gen_op_iwmmxt_madduq_M0_wRn(rd1);
1729         gen_op_iwmmxt_movq_wRn_M0(wrd);
1730         gen_op_iwmmxt_set_mup();
1731         break;
1732     case 0x10e: case 0x50e: case 0x90e: case 0xd0e:     /* WUNPCKIL */
1733         wrd = (insn >> 12) & 0xf;
1734         rd0 = (insn >> 16) & 0xf;
1735         rd1 = (insn >> 0) & 0xf;
1736         gen_op_iwmmxt_movq_M0_wRn(rd0);
1737         switch ((insn >> 22) & 3) {
1738         case 0:
1739             gen_op_iwmmxt_unpacklb_M0_wRn(rd1);
1740             break;
1741         case 1:
1742             gen_op_iwmmxt_unpacklw_M0_wRn(rd1);
1743             break;
1744         case 2:
1745             gen_op_iwmmxt_unpackll_M0_wRn(rd1);
1746             break;
1747         case 3:
1748             return 1;
1749         }
1750         gen_op_iwmmxt_movq_wRn_M0(wrd);
1751         gen_op_iwmmxt_set_mup();
1752         gen_op_iwmmxt_set_cup();
1753         break;
1754     case 0x10c: case 0x50c: case 0x90c: case 0xd0c:     /* WUNPCKIH */
1755         wrd = (insn >> 12) & 0xf;
1756         rd0 = (insn >> 16) & 0xf;
1757         rd1 = (insn >> 0) & 0xf;
1758         gen_op_iwmmxt_movq_M0_wRn(rd0);
1759         switch ((insn >> 22) & 3) {
1760         case 0:
1761             gen_op_iwmmxt_unpackhb_M0_wRn(rd1);
1762             break;
1763         case 1:
1764             gen_op_iwmmxt_unpackhw_M0_wRn(rd1);
1765             break;
1766         case 2:
1767             gen_op_iwmmxt_unpackhl_M0_wRn(rd1);
1768             break;
1769         case 3:
1770             return 1;
1771         }
1772         gen_op_iwmmxt_movq_wRn_M0(wrd);
1773         gen_op_iwmmxt_set_mup();
1774         gen_op_iwmmxt_set_cup();
1775         break;
1776     case 0x012: case 0x112: case 0x412: case 0x512:     /* WSAD */
1777         wrd = (insn >> 12) & 0xf;
1778         rd0 = (insn >> 16) & 0xf;
1779         rd1 = (insn >> 0) & 0xf;
1780         gen_op_iwmmxt_movq_M0_wRn(rd0);
1781         if (insn & (1 << 22))
1782             gen_op_iwmmxt_sadw_M0_wRn(rd1);
1783         else
1784             gen_op_iwmmxt_sadb_M0_wRn(rd1);
1785         if (!(insn & (1 << 20)))
1786             gen_op_iwmmxt_addl_M0_wRn(wrd);
1787         gen_op_iwmmxt_movq_wRn_M0(wrd);
1788         gen_op_iwmmxt_set_mup();
1789         break;
1790     case 0x010: case 0x110: case 0x210: case 0x310:     /* WMUL */
1791         wrd = (insn >> 12) & 0xf;
1792         rd0 = (insn >> 16) & 0xf;
1793         rd1 = (insn >> 0) & 0xf;
1794         gen_op_iwmmxt_movq_M0_wRn(rd0);
1795         if (insn & (1 << 21)) {
1796             if (insn & (1 << 20))
1797                 gen_op_iwmmxt_mulshw_M0_wRn(rd1);
1798             else
1799                 gen_op_iwmmxt_mulslw_M0_wRn(rd1);
1800         } else {
1801             if (insn & (1 << 20))
1802                 gen_op_iwmmxt_muluhw_M0_wRn(rd1);
1803             else
1804                 gen_op_iwmmxt_mululw_M0_wRn(rd1);
1805         }
1806         gen_op_iwmmxt_movq_wRn_M0(wrd);
1807         gen_op_iwmmxt_set_mup();
1808         break;
1809     case 0x410: case 0x510: case 0x610: case 0x710:     /* WMAC */
1810         wrd = (insn >> 12) & 0xf;
1811         rd0 = (insn >> 16) & 0xf;
1812         rd1 = (insn >> 0) & 0xf;
1813         gen_op_iwmmxt_movq_M0_wRn(rd0);
1814         if (insn & (1 << 21))
1815             gen_op_iwmmxt_macsw_M0_wRn(rd1);
1816         else
1817             gen_op_iwmmxt_macuw_M0_wRn(rd1);
1818         if (!(insn & (1 << 20))) {
1819             iwmmxt_load_reg(cpu_V1, wrd);
1820             tcg_gen_add_i64(cpu_M0, cpu_M0, cpu_V1);
1821         }
1822         gen_op_iwmmxt_movq_wRn_M0(wrd);
1823         gen_op_iwmmxt_set_mup();
1824         break;
1825     case 0x006: case 0x406: case 0x806: case 0xc06:     /* WCMPEQ */
1826         wrd = (insn >> 12) & 0xf;
1827         rd0 = (insn >> 16) & 0xf;
1828         rd1 = (insn >> 0) & 0xf;
1829         gen_op_iwmmxt_movq_M0_wRn(rd0);
1830         switch ((insn >> 22) & 3) {
1831         case 0:
1832             gen_op_iwmmxt_cmpeqb_M0_wRn(rd1);
1833             break;
1834         case 1:
1835             gen_op_iwmmxt_cmpeqw_M0_wRn(rd1);
1836             break;
1837         case 2:
1838             gen_op_iwmmxt_cmpeql_M0_wRn(rd1);
1839             break;
1840         case 3:
1841             return 1;
1842         }
1843         gen_op_iwmmxt_movq_wRn_M0(wrd);
1844         gen_op_iwmmxt_set_mup();
1845         gen_op_iwmmxt_set_cup();
1846         break;
1847     case 0x800: case 0x900: case 0xc00: case 0xd00:     /* WAVG2 */
1848         wrd = (insn >> 12) & 0xf;
1849         rd0 = (insn >> 16) & 0xf;
1850         rd1 = (insn >> 0) & 0xf;
1851         gen_op_iwmmxt_movq_M0_wRn(rd0);
1852         if (insn & (1 << 22)) {
1853             if (insn & (1 << 20))
1854                 gen_op_iwmmxt_avgw1_M0_wRn(rd1);
1855             else
1856                 gen_op_iwmmxt_avgw0_M0_wRn(rd1);
1857         } else {
1858             if (insn & (1 << 20))
1859                 gen_op_iwmmxt_avgb1_M0_wRn(rd1);
1860             else
1861                 gen_op_iwmmxt_avgb0_M0_wRn(rd1);
1862         }
1863         gen_op_iwmmxt_movq_wRn_M0(wrd);
1864         gen_op_iwmmxt_set_mup();
1865         gen_op_iwmmxt_set_cup();
1866         break;
1867     case 0x802: case 0x902: case 0xa02: case 0xb02:     /* WALIGNR */
1868         wrd = (insn >> 12) & 0xf;
1869         rd0 = (insn >> 16) & 0xf;
1870         rd1 = (insn >> 0) & 0xf;
1871         gen_op_iwmmxt_movq_M0_wRn(rd0);
1872         tmp = iwmmxt_load_creg(ARM_IWMMXT_wCGR0 + ((insn >> 20) & 3));
1873         tcg_gen_andi_i32(tmp, tmp, 7);
1874         iwmmxt_load_reg(cpu_V1, rd1);
1875         gen_helper_iwmmxt_align(cpu_M0, cpu_M0, cpu_V1, tmp);
1876         tcg_temp_free_i32(tmp);
1877         gen_op_iwmmxt_movq_wRn_M0(wrd);
1878         gen_op_iwmmxt_set_mup();
1879         break;
1880     case 0x601: case 0x605: case 0x609: case 0x60d:     /* TINSR */
1881         if (((insn >> 6) & 3) == 3)
1882             return 1;
1883         rd = (insn >> 12) & 0xf;
1884         wrd = (insn >> 16) & 0xf;
1885         tmp = load_reg(s, rd);
1886         gen_op_iwmmxt_movq_M0_wRn(wrd);
1887         switch ((insn >> 6) & 3) {
1888         case 0:
1889             tmp2 = tcg_const_i32(0xff);
1890             tmp3 = tcg_const_i32((insn & 7) << 3);
1891             break;
1892         case 1:
1893             tmp2 = tcg_const_i32(0xffff);
1894             tmp3 = tcg_const_i32((insn & 3) << 4);
1895             break;
1896         case 2:
1897             tmp2 = tcg_const_i32(0xffffffff);
1898             tmp3 = tcg_const_i32((insn & 1) << 5);
1899             break;
1900         default:
1901             TCGV_UNUSED_I32(tmp2);
1902             TCGV_UNUSED_I32(tmp3);
1903         }
1904         gen_helper_iwmmxt_insr(cpu_M0, cpu_M0, tmp, tmp2, tmp3);
1905         tcg_temp_free_i32(tmp3);
1906         tcg_temp_free_i32(tmp2);
1907         tcg_temp_free_i32(tmp);
1908         gen_op_iwmmxt_movq_wRn_M0(wrd);
1909         gen_op_iwmmxt_set_mup();
1910         break;
1911     case 0x107: case 0x507: case 0x907: case 0xd07:     /* TEXTRM */
1912         rd = (insn >> 12) & 0xf;
1913         wrd = (insn >> 16) & 0xf;
1914         if (rd == 15 || ((insn >> 22) & 3) == 3)
1915             return 1;
1916         gen_op_iwmmxt_movq_M0_wRn(wrd);
1917         tmp = tcg_temp_new_i32();
1918         switch ((insn >> 22) & 3) {
1919         case 0:
1920             tcg_gen_shri_i64(cpu_M0, cpu_M0, (insn & 7) << 3);
1921             tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1922             if (insn & 8) {
1923                 tcg_gen_ext8s_i32(tmp, tmp);
1924             } else {
1925                 tcg_gen_andi_i32(tmp, tmp, 0xff);
1926             }
1927             break;
1928         case 1:
1929             tcg_gen_shri_i64(cpu_M0, cpu_M0, (insn & 3) << 4);
1930             tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1931             if (insn & 8) {
1932                 tcg_gen_ext16s_i32(tmp, tmp);
1933             } else {
1934                 tcg_gen_andi_i32(tmp, tmp, 0xffff);
1935             }
1936             break;
1937         case 2:
1938             tcg_gen_shri_i64(cpu_M0, cpu_M0, (insn & 1) << 5);
1939             tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1940             break;
1941         }
1942         store_reg(s, rd, tmp);
1943         break;
1944     case 0x117: case 0x517: case 0x917: case 0xd17:     /* TEXTRC */
1945         if ((insn & 0x000ff008) != 0x0003f000 || ((insn >> 22) & 3) == 3)
1946             return 1;
1947         tmp = iwmmxt_load_creg(ARM_IWMMXT_wCASF);
1948         switch ((insn >> 22) & 3) {
1949         case 0:
1950             tcg_gen_shri_i32(tmp, tmp, ((insn & 7) << 2) + 0);
1951             break;
1952         case 1:
1953             tcg_gen_shri_i32(tmp, tmp, ((insn & 3) << 3) + 4);
1954             break;
1955         case 2:
1956             tcg_gen_shri_i32(tmp, tmp, ((insn & 1) << 4) + 12);
1957             break;
1958         }
1959         tcg_gen_shli_i32(tmp, tmp, 28);
1960         gen_set_nzcv(tmp);
1961         tcg_temp_free_i32(tmp);
1962         break;
1963     case 0x401: case 0x405: case 0x409: case 0x40d:     /* TBCST */
1964         if (((insn >> 6) & 3) == 3)
1965             return 1;
1966         rd = (insn >> 12) & 0xf;
1967         wrd = (insn >> 16) & 0xf;
1968         tmp = load_reg(s, rd);
1969         switch ((insn >> 6) & 3) {
1970         case 0:
1971             gen_helper_iwmmxt_bcstb(cpu_M0, tmp);
1972             break;
1973         case 1:
1974             gen_helper_iwmmxt_bcstw(cpu_M0, tmp);
1975             break;
1976         case 2:
1977             gen_helper_iwmmxt_bcstl(cpu_M0, tmp);
1978             break;
1979         }
1980         tcg_temp_free_i32(tmp);
1981         gen_op_iwmmxt_movq_wRn_M0(wrd);
1982         gen_op_iwmmxt_set_mup();
1983         break;
1984     case 0x113: case 0x513: case 0x913: case 0xd13:     /* TANDC */
1985         if ((insn & 0x000ff00f) != 0x0003f000 || ((insn >> 22) & 3) == 3)
1986             return 1;
1987         tmp = iwmmxt_load_creg(ARM_IWMMXT_wCASF);
1988         tmp2 = tcg_temp_new_i32();
1989         tcg_gen_mov_i32(tmp2, tmp);
1990         switch ((insn >> 22) & 3) {
1991         case 0:
1992             for (i = 0; i < 7; i ++) {
1993                 tcg_gen_shli_i32(tmp2, tmp2, 4);
1994                 tcg_gen_and_i32(tmp, tmp, tmp2);
1995             }
1996             break;
1997         case 1:
1998             for (i = 0; i < 3; i ++) {
1999                 tcg_gen_shli_i32(tmp2, tmp2, 8);
2000                 tcg_gen_and_i32(tmp, tmp, tmp2);
2001             }
2002             break;
2003         case 2:
2004             tcg_gen_shli_i32(tmp2, tmp2, 16);
2005             tcg_gen_and_i32(tmp, tmp, tmp2);
2006             break;
2007         }
2008         gen_set_nzcv(tmp);
2009         tcg_temp_free_i32(tmp2);
2010         tcg_temp_free_i32(tmp);
2011         break;
2012     case 0x01c: case 0x41c: case 0x81c: case 0xc1c:     /* WACC */
2013         wrd = (insn >> 12) & 0xf;
2014         rd0 = (insn >> 16) & 0xf;
2015         gen_op_iwmmxt_movq_M0_wRn(rd0);
2016         switch ((insn >> 22) & 3) {
2017         case 0:
2018             gen_helper_iwmmxt_addcb(cpu_M0, cpu_M0);
2019             break;
2020         case 1:
2021             gen_helper_iwmmxt_addcw(cpu_M0, cpu_M0);
2022             break;
2023         case 2:
2024             gen_helper_iwmmxt_addcl(cpu_M0, cpu_M0);
2025             break;
2026         case 3:
2027             return 1;
2028         }
2029         gen_op_iwmmxt_movq_wRn_M0(wrd);
2030         gen_op_iwmmxt_set_mup();
2031         break;
2032     case 0x115: case 0x515: case 0x915: case 0xd15:     /* TORC */
2033         if ((insn & 0x000ff00f) != 0x0003f000 || ((insn >> 22) & 3) == 3)
2034             return 1;
2035         tmp = iwmmxt_load_creg(ARM_IWMMXT_wCASF);
2036         tmp2 = tcg_temp_new_i32();
2037         tcg_gen_mov_i32(tmp2, tmp);
2038         switch ((insn >> 22) & 3) {
2039         case 0:
2040             for (i = 0; i < 7; i ++) {
2041                 tcg_gen_shli_i32(tmp2, tmp2, 4);
2042                 tcg_gen_or_i32(tmp, tmp, tmp2);
2043             }
2044             break;
2045         case 1:
2046             for (i = 0; i < 3; i ++) {
2047                 tcg_gen_shli_i32(tmp2, tmp2, 8);
2048                 tcg_gen_or_i32(tmp, tmp, tmp2);
2049             }
2050             break;
2051         case 2:
2052             tcg_gen_shli_i32(tmp2, tmp2, 16);
2053             tcg_gen_or_i32(tmp, tmp, tmp2);
2054             break;
2055         }
2056         gen_set_nzcv(tmp);
2057         tcg_temp_free_i32(tmp2);
2058         tcg_temp_free_i32(tmp);
2059         break;
2060     case 0x103: case 0x503: case 0x903: case 0xd03:     /* TMOVMSK */
2061         rd = (insn >> 12) & 0xf;
2062         rd0 = (insn >> 16) & 0xf;
2063         if ((insn & 0xf) != 0 || ((insn >> 22) & 3) == 3)
2064             return 1;
2065         gen_op_iwmmxt_movq_M0_wRn(rd0);
2066         tmp = tcg_temp_new_i32();
2067         switch ((insn >> 22) & 3) {
2068         case 0:
2069             gen_helper_iwmmxt_msbb(tmp, cpu_M0);
2070             break;
2071         case 1:
2072             gen_helper_iwmmxt_msbw(tmp, cpu_M0);
2073             break;
2074         case 2:
2075             gen_helper_iwmmxt_msbl(tmp, cpu_M0);
2076             break;
2077         }
2078         store_reg(s, rd, tmp);
2079         break;
2080     case 0x106: case 0x306: case 0x506: case 0x706:     /* WCMPGT */
2081     case 0x906: case 0xb06: case 0xd06: case 0xf06:
2082         wrd = (insn >> 12) & 0xf;
2083         rd0 = (insn >> 16) & 0xf;
2084         rd1 = (insn >> 0) & 0xf;
2085         gen_op_iwmmxt_movq_M0_wRn(rd0);
2086         switch ((insn >> 22) & 3) {
2087         case 0:
2088             if (insn & (1 << 21))
2089                 gen_op_iwmmxt_cmpgtsb_M0_wRn(rd1);
2090             else
2091                 gen_op_iwmmxt_cmpgtub_M0_wRn(rd1);
2092             break;
2093         case 1:
2094             if (insn & (1 << 21))
2095                 gen_op_iwmmxt_cmpgtsw_M0_wRn(rd1);
2096             else
2097                 gen_op_iwmmxt_cmpgtuw_M0_wRn(rd1);
2098             break;
2099         case 2:
2100             if (insn & (1 << 21))
2101                 gen_op_iwmmxt_cmpgtsl_M0_wRn(rd1);
2102             else
2103                 gen_op_iwmmxt_cmpgtul_M0_wRn(rd1);
2104             break;
2105         case 3:
2106             return 1;
2107         }
2108         gen_op_iwmmxt_movq_wRn_M0(wrd);
2109         gen_op_iwmmxt_set_mup();
2110         gen_op_iwmmxt_set_cup();
2111         break;
2112     case 0x00e: case 0x20e: case 0x40e: case 0x60e:     /* WUNPCKEL */
2113     case 0x80e: case 0xa0e: case 0xc0e: case 0xe0e:
2114         wrd = (insn >> 12) & 0xf;
2115         rd0 = (insn >> 16) & 0xf;
2116         gen_op_iwmmxt_movq_M0_wRn(rd0);
2117         switch ((insn >> 22) & 3) {
2118         case 0:
2119             if (insn & (1 << 21))
2120                 gen_op_iwmmxt_unpacklsb_M0();
2121             else
2122                 gen_op_iwmmxt_unpacklub_M0();
2123             break;
2124         case 1:
2125             if (insn & (1 << 21))
2126                 gen_op_iwmmxt_unpacklsw_M0();
2127             else
2128                 gen_op_iwmmxt_unpackluw_M0();
2129             break;
2130         case 2:
2131             if (insn & (1 << 21))
2132                 gen_op_iwmmxt_unpacklsl_M0();
2133             else
2134                 gen_op_iwmmxt_unpacklul_M0();
2135             break;
2136         case 3:
2137             return 1;
2138         }
2139         gen_op_iwmmxt_movq_wRn_M0(wrd);
2140         gen_op_iwmmxt_set_mup();
2141         gen_op_iwmmxt_set_cup();
2142         break;
2143     case 0x00c: case 0x20c: case 0x40c: case 0x60c:     /* WUNPCKEH */
2144     case 0x80c: case 0xa0c: case 0xc0c: case 0xe0c:
2145         wrd = (insn >> 12) & 0xf;
2146         rd0 = (insn >> 16) & 0xf;
2147         gen_op_iwmmxt_movq_M0_wRn(rd0);
2148         switch ((insn >> 22) & 3) {
2149         case 0:
2150             if (insn & (1 << 21))
2151                 gen_op_iwmmxt_unpackhsb_M0();
2152             else
2153                 gen_op_iwmmxt_unpackhub_M0();
2154             break;
2155         case 1:
2156             if (insn & (1 << 21))
2157                 gen_op_iwmmxt_unpackhsw_M0();
2158             else
2159                 gen_op_iwmmxt_unpackhuw_M0();
2160             break;
2161         case 2:
2162             if (insn & (1 << 21))
2163                 gen_op_iwmmxt_unpackhsl_M0();
2164             else
2165                 gen_op_iwmmxt_unpackhul_M0();
2166             break;
2167         case 3:
2168             return 1;
2169         }
2170         gen_op_iwmmxt_movq_wRn_M0(wrd);
2171         gen_op_iwmmxt_set_mup();
2172         gen_op_iwmmxt_set_cup();
2173         break;
2174     case 0x204: case 0x604: case 0xa04: case 0xe04:     /* WSRL */
2175     case 0x214: case 0x614: case 0xa14: case 0xe14:
2176         if (((insn >> 22) & 3) == 0)
2177             return 1;
2178         wrd = (insn >> 12) & 0xf;
2179         rd0 = (insn >> 16) & 0xf;
2180         gen_op_iwmmxt_movq_M0_wRn(rd0);
2181         tmp = tcg_temp_new_i32();
2182         if (gen_iwmmxt_shift(insn, 0xff, tmp)) {
2183             tcg_temp_free_i32(tmp);
2184             return 1;
2185         }
2186         switch ((insn >> 22) & 3) {
2187         case 1:
2188             gen_helper_iwmmxt_srlw(cpu_M0, cpu_env, cpu_M0, tmp);
2189             break;
2190         case 2:
2191             gen_helper_iwmmxt_srll(cpu_M0, cpu_env, cpu_M0, tmp);
2192             break;
2193         case 3:
2194             gen_helper_iwmmxt_srlq(cpu_M0, cpu_env, cpu_M0, tmp);
2195             break;
2196         }
2197         tcg_temp_free_i32(tmp);
2198         gen_op_iwmmxt_movq_wRn_M0(wrd);
2199         gen_op_iwmmxt_set_mup();
2200         gen_op_iwmmxt_set_cup();
2201         break;
2202     case 0x004: case 0x404: case 0x804: case 0xc04:     /* WSRA */
2203     case 0x014: case 0x414: case 0x814: case 0xc14:
2204         if (((insn >> 22) & 3) == 0)
2205             return 1;
2206         wrd = (insn >> 12) & 0xf;
2207         rd0 = (insn >> 16) & 0xf;
2208         gen_op_iwmmxt_movq_M0_wRn(rd0);
2209         tmp = tcg_temp_new_i32();
2210         if (gen_iwmmxt_shift(insn, 0xff, tmp)) {
2211             tcg_temp_free_i32(tmp);
2212             return 1;
2213         }
2214         switch ((insn >> 22) & 3) {
2215         case 1:
2216             gen_helper_iwmmxt_sraw(cpu_M0, cpu_env, cpu_M0, tmp);
2217             break;
2218         case 2:
2219             gen_helper_iwmmxt_sral(cpu_M0, cpu_env, cpu_M0, tmp);
2220             break;
2221         case 3:
2222             gen_helper_iwmmxt_sraq(cpu_M0, cpu_env, cpu_M0, tmp);
2223             break;
2224         }
2225         tcg_temp_free_i32(tmp);
2226         gen_op_iwmmxt_movq_wRn_M0(wrd);
2227         gen_op_iwmmxt_set_mup();
2228         gen_op_iwmmxt_set_cup();
2229         break;
2230     case 0x104: case 0x504: case 0x904: case 0xd04:     /* WSLL */
2231     case 0x114: case 0x514: case 0x914: case 0xd14:
2232         if (((insn >> 22) & 3) == 0)
2233             return 1;
2234         wrd = (insn >> 12) & 0xf;
2235         rd0 = (insn >> 16) & 0xf;
2236         gen_op_iwmmxt_movq_M0_wRn(rd0);
2237         tmp = tcg_temp_new_i32();
2238         if (gen_iwmmxt_shift(insn, 0xff, tmp)) {
2239             tcg_temp_free_i32(tmp);
2240             return 1;
2241         }
2242         switch ((insn >> 22) & 3) {
2243         case 1:
2244             gen_helper_iwmmxt_sllw(cpu_M0, cpu_env, cpu_M0, tmp);
2245             break;
2246         case 2:
2247             gen_helper_iwmmxt_slll(cpu_M0, cpu_env, cpu_M0, tmp);
2248             break;
2249         case 3:
2250             gen_helper_iwmmxt_sllq(cpu_M0, cpu_env, cpu_M0, tmp);
2251             break;
2252         }
2253         tcg_temp_free_i32(tmp);
2254         gen_op_iwmmxt_movq_wRn_M0(wrd);
2255         gen_op_iwmmxt_set_mup();
2256         gen_op_iwmmxt_set_cup();
2257         break;
2258     case 0x304: case 0x704: case 0xb04: case 0xf04:     /* WROR */
2259     case 0x314: case 0x714: case 0xb14: case 0xf14:
2260         if (((insn >> 22) & 3) == 0)
2261             return 1;
2262         wrd = (insn >> 12) & 0xf;
2263         rd0 = (insn >> 16) & 0xf;
2264         gen_op_iwmmxt_movq_M0_wRn(rd0);
2265         tmp = tcg_temp_new_i32();
2266         switch ((insn >> 22) & 3) {
2267         case 1:
2268             if (gen_iwmmxt_shift(insn, 0xf, tmp)) {
2269                 tcg_temp_free_i32(tmp);
2270                 return 1;
2271             }
2272             gen_helper_iwmmxt_rorw(cpu_M0, cpu_env, cpu_M0, tmp);
2273             break;
2274         case 2:
2275             if (gen_iwmmxt_shift(insn, 0x1f, tmp)) {
2276                 tcg_temp_free_i32(tmp);
2277                 return 1;
2278             }
2279             gen_helper_iwmmxt_rorl(cpu_M0, cpu_env, cpu_M0, tmp);
2280             break;
2281         case 3:
2282             if (gen_iwmmxt_shift(insn, 0x3f, tmp)) {
2283                 tcg_temp_free_i32(tmp);
2284                 return 1;
2285             }
2286             gen_helper_iwmmxt_rorq(cpu_M0, cpu_env, cpu_M0, tmp);
2287             break;
2288         }
2289         tcg_temp_free_i32(tmp);
2290         gen_op_iwmmxt_movq_wRn_M0(wrd);
2291         gen_op_iwmmxt_set_mup();
2292         gen_op_iwmmxt_set_cup();
2293         break;
2294     case 0x116: case 0x316: case 0x516: case 0x716:     /* WMIN */
2295     case 0x916: case 0xb16: case 0xd16: case 0xf16:
2296         wrd = (insn >> 12) & 0xf;
2297         rd0 = (insn >> 16) & 0xf;
2298         rd1 = (insn >> 0) & 0xf;
2299         gen_op_iwmmxt_movq_M0_wRn(rd0);
2300         switch ((insn >> 22) & 3) {
2301         case 0:
2302             if (insn & (1 << 21))
2303                 gen_op_iwmmxt_minsb_M0_wRn(rd1);
2304             else
2305                 gen_op_iwmmxt_minub_M0_wRn(rd1);
2306             break;
2307         case 1:
2308             if (insn & (1 << 21))
2309                 gen_op_iwmmxt_minsw_M0_wRn(rd1);
2310             else
2311                 gen_op_iwmmxt_minuw_M0_wRn(rd1);
2312             break;
2313         case 2:
2314             if (insn & (1 << 21))
2315                 gen_op_iwmmxt_minsl_M0_wRn(rd1);
2316             else
2317                 gen_op_iwmmxt_minul_M0_wRn(rd1);
2318             break;
2319         case 3:
2320             return 1;
2321         }
2322         gen_op_iwmmxt_movq_wRn_M0(wrd);
2323         gen_op_iwmmxt_set_mup();
2324         break;
2325     case 0x016: case 0x216: case 0x416: case 0x616:     /* WMAX */
2326     case 0x816: case 0xa16: case 0xc16: case 0xe16:
2327         wrd = (insn >> 12) & 0xf;
2328         rd0 = (insn >> 16) & 0xf;
2329         rd1 = (insn >> 0) & 0xf;
2330         gen_op_iwmmxt_movq_M0_wRn(rd0);
2331         switch ((insn >> 22) & 3) {
2332         case 0:
2333             if (insn & (1 << 21))
2334                 gen_op_iwmmxt_maxsb_M0_wRn(rd1);
2335             else
2336                 gen_op_iwmmxt_maxub_M0_wRn(rd1);
2337             break;
2338         case 1:
2339             if (insn & (1 << 21))
2340                 gen_op_iwmmxt_maxsw_M0_wRn(rd1);
2341             else
2342                 gen_op_iwmmxt_maxuw_M0_wRn(rd1);
2343             break;
2344         case 2:
2345             if (insn & (1 << 21))
2346                 gen_op_iwmmxt_maxsl_M0_wRn(rd1);
2347             else
2348                 gen_op_iwmmxt_maxul_M0_wRn(rd1);
2349             break;
2350         case 3:
2351             return 1;
2352         }
2353         gen_op_iwmmxt_movq_wRn_M0(wrd);
2354         gen_op_iwmmxt_set_mup();
2355         break;
2356     case 0x002: case 0x102: case 0x202: case 0x302:     /* WALIGNI */
2357     case 0x402: case 0x502: case 0x602: case 0x702:
2358         wrd = (insn >> 12) & 0xf;
2359         rd0 = (insn >> 16) & 0xf;
2360         rd1 = (insn >> 0) & 0xf;
2361         gen_op_iwmmxt_movq_M0_wRn(rd0);
2362         tmp = tcg_const_i32((insn >> 20) & 3);
2363         iwmmxt_load_reg(cpu_V1, rd1);
2364         gen_helper_iwmmxt_align(cpu_M0, cpu_M0, cpu_V1, tmp);
2365         tcg_temp_free_i32(tmp);
2366         gen_op_iwmmxt_movq_wRn_M0(wrd);
2367         gen_op_iwmmxt_set_mup();
2368         break;
2369     case 0x01a: case 0x11a: case 0x21a: case 0x31a:     /* WSUB */
2370     case 0x41a: case 0x51a: case 0x61a: case 0x71a:
2371     case 0x81a: case 0x91a: case 0xa1a: case 0xb1a:
2372     case 0xc1a: case 0xd1a: case 0xe1a: case 0xf1a:
2373         wrd = (insn >> 12) & 0xf;
2374         rd0 = (insn >> 16) & 0xf;
2375         rd1 = (insn >> 0) & 0xf;
2376         gen_op_iwmmxt_movq_M0_wRn(rd0);
2377         switch ((insn >> 20) & 0xf) {
2378         case 0x0:
2379             gen_op_iwmmxt_subnb_M0_wRn(rd1);
2380             break;
2381         case 0x1:
2382             gen_op_iwmmxt_subub_M0_wRn(rd1);
2383             break;
2384         case 0x3:
2385             gen_op_iwmmxt_subsb_M0_wRn(rd1);
2386             break;
2387         case 0x4:
2388             gen_op_iwmmxt_subnw_M0_wRn(rd1);
2389             break;
2390         case 0x5:
2391             gen_op_iwmmxt_subuw_M0_wRn(rd1);
2392             break;
2393         case 0x7:
2394             gen_op_iwmmxt_subsw_M0_wRn(rd1);
2395             break;
2396         case 0x8:
2397             gen_op_iwmmxt_subnl_M0_wRn(rd1);
2398             break;
2399         case 0x9:
2400             gen_op_iwmmxt_subul_M0_wRn(rd1);
2401             break;
2402         case 0xb:
2403             gen_op_iwmmxt_subsl_M0_wRn(rd1);
2404             break;
2405         default:
2406             return 1;
2407         }
2408         gen_op_iwmmxt_movq_wRn_M0(wrd);
2409         gen_op_iwmmxt_set_mup();
2410         gen_op_iwmmxt_set_cup();
2411         break;
2412     case 0x01e: case 0x11e: case 0x21e: case 0x31e:     /* WSHUFH */
2413     case 0x41e: case 0x51e: case 0x61e: case 0x71e:
2414     case 0x81e: case 0x91e: case 0xa1e: case 0xb1e:
2415     case 0xc1e: case 0xd1e: case 0xe1e: case 0xf1e:
2416         wrd = (insn >> 12) & 0xf;
2417         rd0 = (insn >> 16) & 0xf;
2418         gen_op_iwmmxt_movq_M0_wRn(rd0);
2419         tmp = tcg_const_i32(((insn >> 16) & 0xf0) | (insn & 0x0f));
2420         gen_helper_iwmmxt_shufh(cpu_M0, cpu_env, cpu_M0, tmp);
2421         tcg_temp_free_i32(tmp);
2422         gen_op_iwmmxt_movq_wRn_M0(wrd);
2423         gen_op_iwmmxt_set_mup();
2424         gen_op_iwmmxt_set_cup();
2425         break;
2426     case 0x018: case 0x118: case 0x218: case 0x318:     /* WADD */
2427     case 0x418: case 0x518: case 0x618: case 0x718:
2428     case 0x818: case 0x918: case 0xa18: case 0xb18:
2429     case 0xc18: case 0xd18: case 0xe18: case 0xf18:
2430         wrd = (insn >> 12) & 0xf;
2431         rd0 = (insn >> 16) & 0xf;
2432         rd1 = (insn >> 0) & 0xf;
2433         gen_op_iwmmxt_movq_M0_wRn(rd0);
2434         switch ((insn >> 20) & 0xf) {
2435         case 0x0:
2436             gen_op_iwmmxt_addnb_M0_wRn(rd1);
2437             break;
2438         case 0x1:
2439             gen_op_iwmmxt_addub_M0_wRn(rd1);
2440             break;
2441         case 0x3:
2442             gen_op_iwmmxt_addsb_M0_wRn(rd1);
2443             break;
2444         case 0x4:
2445             gen_op_iwmmxt_addnw_M0_wRn(rd1);
2446             break;
2447         case 0x5:
2448             gen_op_iwmmxt_adduw_M0_wRn(rd1);
2449             break;
2450         case 0x7:
2451             gen_op_iwmmxt_addsw_M0_wRn(rd1);
2452             break;
2453         case 0x8:
2454             gen_op_iwmmxt_addnl_M0_wRn(rd1);
2455             break;
2456         case 0x9:
2457             gen_op_iwmmxt_addul_M0_wRn(rd1);
2458             break;
2459         case 0xb:
2460             gen_op_iwmmxt_addsl_M0_wRn(rd1);
2461             break;
2462         default:
2463             return 1;
2464         }
2465         gen_op_iwmmxt_movq_wRn_M0(wrd);
2466         gen_op_iwmmxt_set_mup();
2467         gen_op_iwmmxt_set_cup();
2468         break;
2469     case 0x008: case 0x108: case 0x208: case 0x308:     /* WPACK */
2470     case 0x408: case 0x508: case 0x608: case 0x708:
2471     case 0x808: case 0x908: case 0xa08: case 0xb08:
2472     case 0xc08: case 0xd08: case 0xe08: case 0xf08:
2473         if (!(insn & (1 << 20)) || ((insn >> 22) & 3) == 0)
2474             return 1;
2475         wrd = (insn >> 12) & 0xf;
2476         rd0 = (insn >> 16) & 0xf;
2477         rd1 = (insn >> 0) & 0xf;
2478         gen_op_iwmmxt_movq_M0_wRn(rd0);
2479         switch ((insn >> 22) & 3) {
2480         case 1:
2481             if (insn & (1 << 21))
2482                 gen_op_iwmmxt_packsw_M0_wRn(rd1);
2483             else
2484                 gen_op_iwmmxt_packuw_M0_wRn(rd1);
2485             break;
2486         case 2:
2487             if (insn & (1 << 21))
2488                 gen_op_iwmmxt_packsl_M0_wRn(rd1);
2489             else
2490                 gen_op_iwmmxt_packul_M0_wRn(rd1);
2491             break;
2492         case 3:
2493             if (insn & (1 << 21))
2494                 gen_op_iwmmxt_packsq_M0_wRn(rd1);
2495             else
2496                 gen_op_iwmmxt_packuq_M0_wRn(rd1);
2497             break;
2498         }
2499         gen_op_iwmmxt_movq_wRn_M0(wrd);
2500         gen_op_iwmmxt_set_mup();
2501         gen_op_iwmmxt_set_cup();
2502         break;
2503     case 0x201: case 0x203: case 0x205: case 0x207:
2504     case 0x209: case 0x20b: case 0x20d: case 0x20f:
2505     case 0x211: case 0x213: case 0x215: case 0x217:
2506     case 0x219: case 0x21b: case 0x21d: case 0x21f:
2507         wrd = (insn >> 5) & 0xf;
2508         rd0 = (insn >> 12) & 0xf;
2509         rd1 = (insn >> 0) & 0xf;
2510         if (rd0 == 0xf || rd1 == 0xf)
2511             return 1;
2512         gen_op_iwmmxt_movq_M0_wRn(wrd);
2513         tmp = load_reg(s, rd0);
2514         tmp2 = load_reg(s, rd1);
2515         switch ((insn >> 16) & 0xf) {
2516         case 0x0:                                       /* TMIA */
2517             gen_helper_iwmmxt_muladdsl(cpu_M0, cpu_M0, tmp, tmp2);
2518             break;
2519         case 0x8:                                       /* TMIAPH */
2520             gen_helper_iwmmxt_muladdsw(cpu_M0, cpu_M0, tmp, tmp2);
2521             break;
2522         case 0xc: case 0xd: case 0xe: case 0xf:         /* TMIAxy */
2523             if (insn & (1 << 16))
2524                 tcg_gen_shri_i32(tmp, tmp, 16);
2525             if (insn & (1 << 17))
2526                 tcg_gen_shri_i32(tmp2, tmp2, 16);
2527             gen_helper_iwmmxt_muladdswl(cpu_M0, cpu_M0, tmp, tmp2);
2528             break;
2529         default:
2530             tcg_temp_free_i32(tmp2);
2531             tcg_temp_free_i32(tmp);
2532             return 1;
2533         }
2534         tcg_temp_free_i32(tmp2);
2535         tcg_temp_free_i32(tmp);
2536         gen_op_iwmmxt_movq_wRn_M0(wrd);
2537         gen_op_iwmmxt_set_mup();
2538         break;
2539     default:
2540         return 1;
2541     }
2542
2543     return 0;
2544 }
2545
2546 /* Disassemble an XScale DSP instruction.  Returns nonzero if an error occurred
2547    (ie. an undefined instruction).  */
2548 static int disas_dsp_insn(DisasContext *s, uint32_t insn)
2549 {
2550     int acc, rd0, rd1, rdhi, rdlo;
2551     TCGv_i32 tmp, tmp2;
2552
2553     if ((insn & 0x0ff00f10) == 0x0e200010) {
2554         /* Multiply with Internal Accumulate Format */
2555         rd0 = (insn >> 12) & 0xf;
2556         rd1 = insn & 0xf;
2557         acc = (insn >> 5) & 7;
2558
2559         if (acc != 0)
2560             return 1;
2561
2562         tmp = load_reg(s, rd0);
2563         tmp2 = load_reg(s, rd1);
2564         switch ((insn >> 16) & 0xf) {
2565         case 0x0:                                       /* MIA */
2566             gen_helper_iwmmxt_muladdsl(cpu_M0, cpu_M0, tmp, tmp2);
2567             break;
2568         case 0x8:                                       /* MIAPH */
2569             gen_helper_iwmmxt_muladdsw(cpu_M0, cpu_M0, tmp, tmp2);
2570             break;
2571         case 0xc:                                       /* MIABB */
2572         case 0xd:                                       /* MIABT */
2573         case 0xe:                                       /* MIATB */
2574         case 0xf:                                       /* MIATT */
2575             if (insn & (1 << 16))
2576                 tcg_gen_shri_i32(tmp, tmp, 16);
2577             if (insn & (1 << 17))
2578                 tcg_gen_shri_i32(tmp2, tmp2, 16);
2579             gen_helper_iwmmxt_muladdswl(cpu_M0, cpu_M0, tmp, tmp2);
2580             break;
2581         default:
2582             return 1;
2583         }
2584         tcg_temp_free_i32(tmp2);
2585         tcg_temp_free_i32(tmp);
2586
2587         gen_op_iwmmxt_movq_wRn_M0(acc);
2588         return 0;
2589     }
2590
2591     if ((insn & 0x0fe00ff8) == 0x0c400000) {
2592         /* Internal Accumulator Access Format */
2593         rdhi = (insn >> 16) & 0xf;
2594         rdlo = (insn >> 12) & 0xf;
2595         acc = insn & 7;
2596
2597         if (acc != 0)
2598             return 1;
2599
2600         if (insn & ARM_CP_RW_BIT) {                     /* MRA */
2601             iwmmxt_load_reg(cpu_V0, acc);
2602             tcg_gen_trunc_i64_i32(cpu_R[rdlo], cpu_V0);
2603             tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
2604             tcg_gen_trunc_i64_i32(cpu_R[rdhi], cpu_V0);
2605             tcg_gen_andi_i32(cpu_R[rdhi], cpu_R[rdhi], (1 << (40 - 32)) - 1);
2606         } else {                                        /* MAR */
2607             tcg_gen_concat_i32_i64(cpu_V0, cpu_R[rdlo], cpu_R[rdhi]);
2608             iwmmxt_store_reg(cpu_V0, acc);
2609         }
2610         return 0;
2611     }
2612
2613     return 1;
2614 }
2615
2616 #define VFP_REG_SHR(x, n) (((n) > 0) ? (x) >> (n) : (x) << -(n))
2617 #define VFP_SREG(insn, bigbit, smallbit) \
2618   ((VFP_REG_SHR(insn, bigbit - 1) & 0x1e) | (((insn) >> (smallbit)) & 1))
2619 #define VFP_DREG(reg, insn, bigbit, smallbit) do { \
2620     if (arm_dc_feature(s, ARM_FEATURE_VFP3)) { \
2621         reg = (((insn) >> (bigbit)) & 0x0f) \
2622               | (((insn) >> ((smallbit) - 4)) & 0x10); \
2623     } else { \
2624         if (insn & (1 << (smallbit))) \
2625             return 1; \
2626         reg = ((insn) >> (bigbit)) & 0x0f; \
2627     }} while (0)
2628
2629 #define VFP_SREG_D(insn) VFP_SREG(insn, 12, 22)
2630 #define VFP_DREG_D(reg, insn) VFP_DREG(reg, insn, 12, 22)
2631 #define VFP_SREG_N(insn) VFP_SREG(insn, 16,  7)
2632 #define VFP_DREG_N(reg, insn) VFP_DREG(reg, insn, 16,  7)
2633 #define VFP_SREG_M(insn) VFP_SREG(insn,  0,  5)
2634 #define VFP_DREG_M(reg, insn) VFP_DREG(reg, insn,  0,  5)
2635
2636 /* Move between integer and VFP cores.  */
2637 static TCGv_i32 gen_vfp_mrs(void)
2638 {
2639     TCGv_i32 tmp = tcg_temp_new_i32();
2640     tcg_gen_mov_i32(tmp, cpu_F0s);
2641     return tmp;
2642 }
2643
2644 static void gen_vfp_msr(TCGv_i32 tmp)
2645 {
2646     tcg_gen_mov_i32(cpu_F0s, tmp);
2647     tcg_temp_free_i32(tmp);
2648 }
2649
2650 static void gen_neon_dup_u8(TCGv_i32 var, int shift)
2651 {
2652     TCGv_i32 tmp = tcg_temp_new_i32();
2653     if (shift)
2654         tcg_gen_shri_i32(var, var, shift);
2655     tcg_gen_ext8u_i32(var, var);
2656     tcg_gen_shli_i32(tmp, var, 8);
2657     tcg_gen_or_i32(var, var, tmp);
2658     tcg_gen_shli_i32(tmp, var, 16);
2659     tcg_gen_or_i32(var, var, tmp);
2660     tcg_temp_free_i32(tmp);
2661 }
2662
2663 static void gen_neon_dup_low16(TCGv_i32 var)
2664 {
2665     TCGv_i32 tmp = tcg_temp_new_i32();
2666     tcg_gen_ext16u_i32(var, var);
2667     tcg_gen_shli_i32(tmp, var, 16);
2668     tcg_gen_or_i32(var, var, tmp);
2669     tcg_temp_free_i32(tmp);
2670 }
2671
2672 static void gen_neon_dup_high16(TCGv_i32 var)
2673 {
2674     TCGv_i32 tmp = tcg_temp_new_i32();
2675     tcg_gen_andi_i32(var, var, 0xffff0000);
2676     tcg_gen_shri_i32(tmp, var, 16);
2677     tcg_gen_or_i32(var, var, tmp);
2678     tcg_temp_free_i32(tmp);
2679 }
2680
2681 static TCGv_i32 gen_load_and_replicate(DisasContext *s, TCGv_i32 addr, int size)
2682 {
2683     /* Load a single Neon element and replicate into a 32 bit TCG reg */
2684     TCGv_i32 tmp = tcg_temp_new_i32();
2685     switch (size) {
2686     case 0:
2687         gen_aa32_ld8u(tmp, addr, get_mem_index(s));
2688         gen_neon_dup_u8(tmp, 0);
2689         break;
2690     case 1:
2691         gen_aa32_ld16u(tmp, addr, get_mem_index(s));
2692         gen_neon_dup_low16(tmp);
2693         break;
2694     case 2:
2695         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
2696         break;
2697     default: /* Avoid compiler warnings.  */
2698         abort();
2699     }
2700     return tmp;
2701 }
2702
2703 static int handle_vsel(uint32_t insn, uint32_t rd, uint32_t rn, uint32_t rm,
2704                        uint32_t dp)
2705 {
2706     uint32_t cc = extract32(insn, 20, 2);
2707
2708     if (dp) {
2709         TCGv_i64 frn, frm, dest;
2710         TCGv_i64 tmp, zero, zf, nf, vf;
2711
2712         zero = tcg_const_i64(0);
2713
2714         frn = tcg_temp_new_i64();
2715         frm = tcg_temp_new_i64();
2716         dest = tcg_temp_new_i64();
2717
2718         zf = tcg_temp_new_i64();
2719         nf = tcg_temp_new_i64();
2720         vf = tcg_temp_new_i64();
2721
2722         tcg_gen_extu_i32_i64(zf, cpu_ZF);
2723         tcg_gen_ext_i32_i64(nf, cpu_NF);
2724         tcg_gen_ext_i32_i64(vf, cpu_VF);
2725
2726         tcg_gen_ld_f64(frn, cpu_env, vfp_reg_offset(dp, rn));
2727         tcg_gen_ld_f64(frm, cpu_env, vfp_reg_offset(dp, rm));
2728         switch (cc) {
2729         case 0: /* eq: Z */
2730             tcg_gen_movcond_i64(TCG_COND_EQ, dest, zf, zero,
2731                                 frn, frm);
2732             break;
2733         case 1: /* vs: V */
2734             tcg_gen_movcond_i64(TCG_COND_LT, dest, vf, zero,
2735                                 frn, frm);
2736             break;
2737         case 2: /* ge: N == V -> N ^ V == 0 */
2738             tmp = tcg_temp_new_i64();
2739             tcg_gen_xor_i64(tmp, vf, nf);
2740             tcg_gen_movcond_i64(TCG_COND_GE, dest, tmp, zero,
2741                                 frn, frm);
2742             tcg_temp_free_i64(tmp);
2743             break;
2744         case 3: /* gt: !Z && N == V */
2745             tcg_gen_movcond_i64(TCG_COND_NE, dest, zf, zero,
2746                                 frn, frm);
2747             tmp = tcg_temp_new_i64();
2748             tcg_gen_xor_i64(tmp, vf, nf);
2749             tcg_gen_movcond_i64(TCG_COND_GE, dest, tmp, zero,
2750                                 dest, frm);
2751             tcg_temp_free_i64(tmp);
2752             break;
2753         }
2754         tcg_gen_st_f64(dest, cpu_env, vfp_reg_offset(dp, rd));
2755         tcg_temp_free_i64(frn);
2756         tcg_temp_free_i64(frm);
2757         tcg_temp_free_i64(dest);
2758
2759         tcg_temp_free_i64(zf);
2760         tcg_temp_free_i64(nf);
2761         tcg_temp_free_i64(vf);
2762
2763         tcg_temp_free_i64(zero);
2764     } else {
2765         TCGv_i32 frn, frm, dest;
2766         TCGv_i32 tmp, zero;
2767
2768         zero = tcg_const_i32(0);
2769
2770         frn = tcg_temp_new_i32();
2771         frm = tcg_temp_new_i32();
2772         dest = tcg_temp_new_i32();
2773         tcg_gen_ld_f32(frn, cpu_env, vfp_reg_offset(dp, rn));
2774         tcg_gen_ld_f32(frm, cpu_env, vfp_reg_offset(dp, rm));
2775         switch (cc) {
2776         case 0: /* eq: Z */
2777             tcg_gen_movcond_i32(TCG_COND_EQ, dest, cpu_ZF, zero,
2778                                 frn, frm);
2779             break;
2780         case 1: /* vs: V */
2781             tcg_gen_movcond_i32(TCG_COND_LT, dest, cpu_VF, zero,
2782                                 frn, frm);
2783             break;
2784         case 2: /* ge: N == V -> N ^ V == 0 */
2785             tmp = tcg_temp_new_i32();
2786             tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
2787             tcg_gen_movcond_i32(TCG_COND_GE, dest, tmp, zero,
2788                                 frn, frm);
2789             tcg_temp_free_i32(tmp);
2790             break;
2791         case 3: /* gt: !Z && N == V */
2792             tcg_gen_movcond_i32(TCG_COND_NE, dest, cpu_ZF, zero,
2793                                 frn, frm);
2794             tmp = tcg_temp_new_i32();
2795             tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
2796             tcg_gen_movcond_i32(TCG_COND_GE, dest, tmp, zero,
2797                                 dest, frm);
2798             tcg_temp_free_i32(tmp);
2799             break;
2800         }
2801         tcg_gen_st_f32(dest, cpu_env, vfp_reg_offset(dp, rd));
2802         tcg_temp_free_i32(frn);
2803         tcg_temp_free_i32(frm);
2804         tcg_temp_free_i32(dest);
2805
2806         tcg_temp_free_i32(zero);
2807     }
2808
2809     return 0;
2810 }
2811
2812 static int handle_vminmaxnm(uint32_t insn, uint32_t rd, uint32_t rn,
2813                             uint32_t rm, uint32_t dp)
2814 {
2815     uint32_t vmin = extract32(insn, 6, 1);
2816     TCGv_ptr fpst = get_fpstatus_ptr(0);
2817
2818     if (dp) {
2819         TCGv_i64 frn, frm, dest;
2820
2821         frn = tcg_temp_new_i64();
2822         frm = tcg_temp_new_i64();
2823         dest = tcg_temp_new_i64();
2824
2825         tcg_gen_ld_f64(frn, cpu_env, vfp_reg_offset(dp, rn));
2826         tcg_gen_ld_f64(frm, cpu_env, vfp_reg_offset(dp, rm));
2827         if (vmin) {
2828             gen_helper_vfp_minnumd(dest, frn, frm, fpst);
2829         } else {
2830             gen_helper_vfp_maxnumd(dest, frn, frm, fpst);
2831         }
2832         tcg_gen_st_f64(dest, cpu_env, vfp_reg_offset(dp, rd));
2833         tcg_temp_free_i64(frn);
2834         tcg_temp_free_i64(frm);
2835         tcg_temp_free_i64(dest);
2836     } else {
2837         TCGv_i32 frn, frm, dest;
2838
2839         frn = tcg_temp_new_i32();
2840         frm = tcg_temp_new_i32();
2841         dest = tcg_temp_new_i32();
2842
2843         tcg_gen_ld_f32(frn, cpu_env, vfp_reg_offset(dp, rn));
2844         tcg_gen_ld_f32(frm, cpu_env, vfp_reg_offset(dp, rm));
2845         if (vmin) {
2846             gen_helper_vfp_minnums(dest, frn, frm, fpst);
2847         } else {
2848             gen_helper_vfp_maxnums(dest, frn, frm, fpst);
2849         }
2850         tcg_gen_st_f32(dest, cpu_env, vfp_reg_offset(dp, rd));
2851         tcg_temp_free_i32(frn);
2852         tcg_temp_free_i32(frm);
2853         tcg_temp_free_i32(dest);
2854     }
2855
2856     tcg_temp_free_ptr(fpst);
2857     return 0;
2858 }
2859
2860 static int handle_vrint(uint32_t insn, uint32_t rd, uint32_t rm, uint32_t dp,
2861                         int rounding)
2862 {
2863     TCGv_ptr fpst = get_fpstatus_ptr(0);
2864     TCGv_i32 tcg_rmode;
2865
2866     tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rounding));
2867     gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
2868
2869     if (dp) {
2870         TCGv_i64 tcg_op;
2871         TCGv_i64 tcg_res;
2872         tcg_op = tcg_temp_new_i64();
2873         tcg_res = tcg_temp_new_i64();
2874         tcg_gen_ld_f64(tcg_op, cpu_env, vfp_reg_offset(dp, rm));
2875         gen_helper_rintd(tcg_res, tcg_op, fpst);
2876         tcg_gen_st_f64(tcg_res, cpu_env, vfp_reg_offset(dp, rd));
2877         tcg_temp_free_i64(tcg_op);
2878         tcg_temp_free_i64(tcg_res);
2879     } else {
2880         TCGv_i32 tcg_op;
2881         TCGv_i32 tcg_res;
2882         tcg_op = tcg_temp_new_i32();
2883         tcg_res = tcg_temp_new_i32();
2884         tcg_gen_ld_f32(tcg_op, cpu_env, vfp_reg_offset(dp, rm));
2885         gen_helper_rints(tcg_res, tcg_op, fpst);
2886         tcg_gen_st_f32(tcg_res, cpu_env, vfp_reg_offset(dp, rd));
2887         tcg_temp_free_i32(tcg_op);
2888         tcg_temp_free_i32(tcg_res);
2889     }
2890
2891     gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
2892     tcg_temp_free_i32(tcg_rmode);
2893
2894     tcg_temp_free_ptr(fpst);
2895     return 0;
2896 }
2897
2898 static int handle_vcvt(uint32_t insn, uint32_t rd, uint32_t rm, uint32_t dp,
2899                        int rounding)
2900 {
2901     bool is_signed = extract32(insn, 7, 1);
2902     TCGv_ptr fpst = get_fpstatus_ptr(0);
2903     TCGv_i32 tcg_rmode, tcg_shift;
2904
2905     tcg_shift = tcg_const_i32(0);
2906
2907     tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rounding));
2908     gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
2909
2910     if (dp) {
2911         TCGv_i64 tcg_double, tcg_res;
2912         TCGv_i32 tcg_tmp;
2913         /* Rd is encoded as a single precision register even when the source
2914          * is double precision.
2915          */
2916         rd = ((rd << 1) & 0x1e) | ((rd >> 4) & 0x1);
2917         tcg_double = tcg_temp_new_i64();
2918         tcg_res = tcg_temp_new_i64();
2919         tcg_tmp = tcg_temp_new_i32();
2920         tcg_gen_ld_f64(tcg_double, cpu_env, vfp_reg_offset(1, rm));
2921         if (is_signed) {
2922             gen_helper_vfp_tosld(tcg_res, tcg_double, tcg_shift, fpst);
2923         } else {
2924             gen_helper_vfp_tould(tcg_res, tcg_double, tcg_shift, fpst);
2925         }
2926         tcg_gen_trunc_i64_i32(tcg_tmp, tcg_res);
2927         tcg_gen_st_f32(tcg_tmp, cpu_env, vfp_reg_offset(0, rd));
2928         tcg_temp_free_i32(tcg_tmp);
2929         tcg_temp_free_i64(tcg_res);
2930         tcg_temp_free_i64(tcg_double);
2931     } else {
2932         TCGv_i32 tcg_single, tcg_res;
2933         tcg_single = tcg_temp_new_i32();
2934         tcg_res = tcg_temp_new_i32();
2935         tcg_gen_ld_f32(tcg_single, cpu_env, vfp_reg_offset(0, rm));
2936         if (is_signed) {
2937             gen_helper_vfp_tosls(tcg_res, tcg_single, tcg_shift, fpst);
2938         } else {
2939             gen_helper_vfp_touls(tcg_res, tcg_single, tcg_shift, fpst);
2940         }
2941         tcg_gen_st_f32(tcg_res, cpu_env, vfp_reg_offset(0, rd));
2942         tcg_temp_free_i32(tcg_res);
2943         tcg_temp_free_i32(tcg_single);
2944     }
2945
2946     gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
2947     tcg_temp_free_i32(tcg_rmode);
2948
2949     tcg_temp_free_i32(tcg_shift);
2950
2951     tcg_temp_free_ptr(fpst);
2952
2953     return 0;
2954 }
2955
2956 /* Table for converting the most common AArch32 encoding of
2957  * rounding mode to arm_fprounding order (which matches the
2958  * common AArch64 order); see ARM ARM pseudocode FPDecodeRM().
2959  */
2960 static const uint8_t fp_decode_rm[] = {
2961     FPROUNDING_TIEAWAY,
2962     FPROUNDING_TIEEVEN,
2963     FPROUNDING_POSINF,
2964     FPROUNDING_NEGINF,
2965 };
2966
2967 static int disas_vfp_v8_insn(DisasContext *s, uint32_t insn)
2968 {
2969     uint32_t rd, rn, rm, dp = extract32(insn, 8, 1);
2970
2971     if (!arm_dc_feature(s, ARM_FEATURE_V8)) {
2972         return 1;
2973     }
2974
2975     if (dp) {
2976         VFP_DREG_D(rd, insn);
2977         VFP_DREG_N(rn, insn);
2978         VFP_DREG_M(rm, insn);
2979     } else {
2980         rd = VFP_SREG_D(insn);
2981         rn = VFP_SREG_N(insn);
2982         rm = VFP_SREG_M(insn);
2983     }
2984
2985     if ((insn & 0x0f800e50) == 0x0e000a00) {
2986         return handle_vsel(insn, rd, rn, rm, dp);
2987     } else if ((insn & 0x0fb00e10) == 0x0e800a00) {
2988         return handle_vminmaxnm(insn, rd, rn, rm, dp);
2989     } else if ((insn & 0x0fbc0ed0) == 0x0eb80a40) {
2990         /* VRINTA, VRINTN, VRINTP, VRINTM */
2991         int rounding = fp_decode_rm[extract32(insn, 16, 2)];
2992         return handle_vrint(insn, rd, rm, dp, rounding);
2993     } else if ((insn & 0x0fbc0e50) == 0x0ebc0a40) {
2994         /* VCVTA, VCVTN, VCVTP, VCVTM */
2995         int rounding = fp_decode_rm[extract32(insn, 16, 2)];
2996         return handle_vcvt(insn, rd, rm, dp, rounding);
2997     }
2998     return 1;
2999 }
3000
3001 /* Disassemble a VFP instruction.  Returns nonzero if an error occurred
3002    (ie. an undefined instruction).  */
3003 static int disas_vfp_insn(DisasContext *s, uint32_t insn)
3004 {
3005     uint32_t rd, rn, rm, op, i, n, offset, delta_d, delta_m, bank_mask;
3006     int dp, veclen;
3007     TCGv_i32 addr;
3008     TCGv_i32 tmp;
3009     TCGv_i32 tmp2;
3010
3011     if (!arm_dc_feature(s, ARM_FEATURE_VFP)) {
3012         return 1;
3013     }
3014
3015     /* FIXME: this access check should not take precedence over UNDEF
3016      * for invalid encodings; we will generate incorrect syndrome information
3017      * for attempts to execute invalid vfp/neon encodings with FP disabled.
3018      */
3019     if (!s->cpacr_fpen) {
3020         gen_exception_insn(s, 4, EXCP_UDEF,
3021                            syn_fp_access_trap(1, 0xe, s->thumb));
3022         return 0;
3023     }
3024
3025     if (!s->vfp_enabled) {
3026         /* VFP disabled.  Only allow fmxr/fmrx to/from some control regs.  */
3027         if ((insn & 0x0fe00fff) != 0x0ee00a10)
3028             return 1;
3029         rn = (insn >> 16) & 0xf;
3030         if (rn != ARM_VFP_FPSID && rn != ARM_VFP_FPEXC && rn != ARM_VFP_MVFR2
3031             && rn != ARM_VFP_MVFR1 && rn != ARM_VFP_MVFR0) {
3032             return 1;
3033         }
3034     }
3035
3036     if (extract32(insn, 28, 4) == 0xf) {
3037         /* Encodings with T=1 (Thumb) or unconditional (ARM):
3038          * only used in v8 and above.
3039          */
3040         return disas_vfp_v8_insn(s, insn);
3041     }
3042
3043     dp = ((insn & 0xf00) == 0xb00);
3044     switch ((insn >> 24) & 0xf) {
3045     case 0xe:
3046         if (insn & (1 << 4)) {
3047             /* single register transfer */
3048             rd = (insn >> 12) & 0xf;
3049             if (dp) {
3050                 int size;
3051                 int pass;
3052
3053                 VFP_DREG_N(rn, insn);
3054                 if (insn & 0xf)
3055                     return 1;
3056                 if (insn & 0x00c00060
3057                     && !arm_dc_feature(s, ARM_FEATURE_NEON)) {
3058                     return 1;
3059                 }
3060
3061                 pass = (insn >> 21) & 1;
3062                 if (insn & (1 << 22)) {
3063                     size = 0;
3064                     offset = ((insn >> 5) & 3) * 8;
3065                 } else if (insn & (1 << 5)) {
3066                     size = 1;
3067                     offset = (insn & (1 << 6)) ? 16 : 0;
3068                 } else {
3069                     size = 2;
3070                     offset = 0;
3071                 }
3072                 if (insn & ARM_CP_RW_BIT) {
3073                     /* vfp->arm */
3074                     tmp = neon_load_reg(rn, pass);
3075                     switch (size) {
3076                     case 0:
3077                         if (offset)
3078                             tcg_gen_shri_i32(tmp, tmp, offset);
3079                         if (insn & (1 << 23))
3080                             gen_uxtb(tmp);
3081                         else
3082                             gen_sxtb(tmp);
3083                         break;
3084                     case 1:
3085                         if (insn & (1 << 23)) {
3086                             if (offset) {
3087                                 tcg_gen_shri_i32(tmp, tmp, 16);
3088                             } else {
3089                                 gen_uxth(tmp);
3090                             }
3091                         } else {
3092                             if (offset) {
3093                                 tcg_gen_sari_i32(tmp, tmp, 16);
3094                             } else {
3095                                 gen_sxth(tmp);
3096                             }
3097                         }
3098                         break;
3099                     case 2:
3100                         break;
3101                     }
3102                     store_reg(s, rd, tmp);
3103                 } else {
3104                     /* arm->vfp */
3105                     tmp = load_reg(s, rd);
3106                     if (insn & (1 << 23)) {
3107                         /* VDUP */
3108                         if (size == 0) {
3109                             gen_neon_dup_u8(tmp, 0);
3110                         } else if (size == 1) {
3111                             gen_neon_dup_low16(tmp);
3112                         }
3113                         for (n = 0; n <= pass * 2; n++) {
3114                             tmp2 = tcg_temp_new_i32();
3115                             tcg_gen_mov_i32(tmp2, tmp);
3116                             neon_store_reg(rn, n, tmp2);
3117                         }
3118                         neon_store_reg(rn, n, tmp);
3119                     } else {
3120                         /* VMOV */
3121                         switch (size) {
3122                         case 0:
3123                             tmp2 = neon_load_reg(rn, pass);
3124                             tcg_gen_deposit_i32(tmp, tmp2, tmp, offset, 8);
3125                             tcg_temp_free_i32(tmp2);
3126                             break;
3127                         case 1:
3128                             tmp2 = neon_load_reg(rn, pass);
3129                             tcg_gen_deposit_i32(tmp, tmp2, tmp, offset, 16);
3130                             tcg_temp_free_i32(tmp2);
3131                             break;
3132                         case 2:
3133                             break;
3134                         }
3135                         neon_store_reg(rn, pass, tmp);
3136                     }
3137                 }
3138             } else { /* !dp */
3139                 if ((insn & 0x6f) != 0x00)
3140                     return 1;
3141                 rn = VFP_SREG_N(insn);
3142                 if (insn & ARM_CP_RW_BIT) {
3143                     /* vfp->arm */
3144                     if (insn & (1 << 21)) {
3145                         /* system register */
3146                         rn >>= 1;
3147
3148                         switch (rn) {
3149                         case ARM_VFP_FPSID:
3150                             /* VFP2 allows access to FSID from userspace.
3151                                VFP3 restricts all id registers to privileged
3152                                accesses.  */
3153                             if (IS_USER(s)
3154                                 && arm_dc_feature(s, ARM_FEATURE_VFP3)) {
3155                                 return 1;
3156                             }
3157                             tmp = load_cpu_field(vfp.xregs[rn]);
3158                             break;
3159                         case ARM_VFP_FPEXC:
3160                             if (IS_USER(s))
3161                                 return 1;
3162                             tmp = load_cpu_field(vfp.xregs[rn]);
3163                             break;
3164                         case ARM_VFP_FPINST:
3165                         case ARM_VFP_FPINST2:
3166                             /* Not present in VFP3.  */
3167                             if (IS_USER(s)
3168                                 || arm_dc_feature(s, ARM_FEATURE_VFP3)) {
3169                                 return 1;
3170                             }
3171                             tmp = load_cpu_field(vfp.xregs[rn]);
3172                             break;
3173                         case ARM_VFP_FPSCR:
3174                             if (rd == 15) {
3175                                 tmp = load_cpu_field(vfp.xregs[ARM_VFP_FPSCR]);
3176                                 tcg_gen_andi_i32(tmp, tmp, 0xf0000000);
3177                             } else {
3178                                 tmp = tcg_temp_new_i32();
3179                                 gen_helper_vfp_get_fpscr(tmp, cpu_env);
3180                             }
3181                             break;
3182                         case ARM_VFP_MVFR2:
3183                             if (!arm_dc_feature(s, ARM_FEATURE_V8)) {
3184                                 return 1;
3185                             }
3186                             /* fall through */
3187                         case ARM_VFP_MVFR0:
3188                         case ARM_VFP_MVFR1:
3189                             if (IS_USER(s)
3190                                 || !arm_dc_feature(s, ARM_FEATURE_MVFR)) {
3191                                 return 1;
3192                             }
3193                             tmp = load_cpu_field(vfp.xregs[rn]);
3194                             break;
3195                         default:
3196                             return 1;
3197                         }
3198                     } else {
3199                         gen_mov_F0_vreg(0, rn);
3200                         tmp = gen_vfp_mrs();
3201                     }
3202                     if (rd == 15) {
3203                         /* Set the 4 flag bits in the CPSR.  */
3204                         gen_set_nzcv(tmp);
3205                         tcg_temp_free_i32(tmp);
3206                     } else {
3207                         store_reg(s, rd, tmp);
3208                     }
3209                 } else {
3210                     /* arm->vfp */
3211                     if (insn & (1 << 21)) {
3212                         rn >>= 1;
3213                         /* system register */
3214                         switch (rn) {
3215                         case ARM_VFP_FPSID:
3216                         case ARM_VFP_MVFR0:
3217                         case ARM_VFP_MVFR1:
3218                             /* Writes are ignored.  */
3219                             break;
3220                         case ARM_VFP_FPSCR:
3221                             tmp = load_reg(s, rd);
3222                             gen_helper_vfp_set_fpscr(cpu_env, tmp);
3223                             tcg_temp_free_i32(tmp);
3224                             gen_lookup_tb(s);
3225                             break;
3226                         case ARM_VFP_FPEXC:
3227                             if (IS_USER(s))
3228                                 return 1;
3229                             /* TODO: VFP subarchitecture support.
3230                              * For now, keep the EN bit only */
3231                             tmp = load_reg(s, rd);
3232                             tcg_gen_andi_i32(tmp, tmp, 1 << 30);
3233                             store_cpu_field(tmp, vfp.xregs[rn]);
3234                             gen_lookup_tb(s);
3235                             break;
3236                         case ARM_VFP_FPINST:
3237                         case ARM_VFP_FPINST2:
3238                             if (IS_USER(s)) {
3239                                 return 1;
3240                             }
3241                             tmp = load_reg(s, rd);
3242                             store_cpu_field(tmp, vfp.xregs[rn]);
3243                             break;
3244                         default:
3245                             return 1;
3246                         }
3247                     } else {
3248                         tmp = load_reg(s, rd);
3249                         gen_vfp_msr(tmp);
3250                         gen_mov_vreg_F0(0, rn);
3251                     }
3252                 }
3253             }
3254         } else {
3255             /* data processing */
3256             /* The opcode is in bits 23, 21, 20 and 6.  */
3257             op = ((insn >> 20) & 8) | ((insn >> 19) & 6) | ((insn >> 6) & 1);
3258             if (dp) {
3259                 if (op == 15) {
3260                     /* rn is opcode */
3261                     rn = ((insn >> 15) & 0x1e) | ((insn >> 7) & 1);
3262                 } else {
3263                     /* rn is register number */
3264                     VFP_DREG_N(rn, insn);
3265                 }
3266
3267                 if (op == 15 && (rn == 15 || ((rn & 0x1c) == 0x18) ||
3268                                  ((rn & 0x1e) == 0x6))) {
3269                     /* Integer or single/half precision destination.  */
3270                     rd = VFP_SREG_D(insn);
3271                 } else {
3272                     VFP_DREG_D(rd, insn);
3273                 }
3274                 if (op == 15 &&
3275                     (((rn & 0x1c) == 0x10) || ((rn & 0x14) == 0x14) ||
3276                      ((rn & 0x1e) == 0x4))) {
3277                     /* VCVT from int or half precision is always from S reg
3278                      * regardless of dp bit. VCVT with immediate frac_bits
3279                      * has same format as SREG_M.
3280                      */
3281                     rm = VFP_SREG_M(insn);
3282                 } else {
3283                     VFP_DREG_M(rm, insn);
3284                 }
3285             } else {
3286                 rn = VFP_SREG_N(insn);
3287                 if (op == 15 && rn == 15) {
3288                     /* Double precision destination.  */
3289                     VFP_DREG_D(rd, insn);
3290                 } else {
3291                     rd = VFP_SREG_D(insn);
3292                 }
3293                 /* NB that we implicitly rely on the encoding for the frac_bits
3294                  * in VCVT of fixed to float being the same as that of an SREG_M
3295                  */
3296                 rm = VFP_SREG_M(insn);
3297             }
3298
3299             veclen = s->vec_len;
3300             if (op == 15 && rn > 3)
3301                 veclen = 0;
3302
3303             /* Shut up compiler warnings.  */
3304             delta_m = 0;
3305             delta_d = 0;
3306             bank_mask = 0;
3307
3308             if (veclen > 0) {
3309                 if (dp)
3310                     bank_mask = 0xc;
3311                 else
3312                     bank_mask = 0x18;
3313
3314                 /* Figure out what type of vector operation this is.  */
3315                 if ((rd & bank_mask) == 0) {
3316                     /* scalar */
3317                     veclen = 0;
3318                 } else {
3319                     if (dp)
3320                         delta_d = (s->vec_stride >> 1) + 1;
3321                     else
3322                         delta_d = s->vec_stride + 1;
3323
3324                     if ((rm & bank_mask) == 0) {
3325                         /* mixed scalar/vector */
3326                         delta_m = 0;
3327                     } else {
3328                         /* vector */
3329                         delta_m = delta_d;
3330                     }
3331                 }
3332             }
3333
3334             /* Load the initial operands.  */
3335             if (op == 15) {
3336                 switch (rn) {
3337                 case 16:
3338                 case 17:
3339                     /* Integer source */
3340                     gen_mov_F0_vreg(0, rm);
3341                     break;
3342                 case 8:
3343                 case 9:
3344                     /* Compare */
3345                     gen_mov_F0_vreg(dp, rd);
3346                     gen_mov_F1_vreg(dp, rm);
3347                     break;
3348                 case 10:
3349                 case 11:
3350                     /* Compare with zero */
3351                     gen_mov_F0_vreg(dp, rd);
3352                     gen_vfp_F1_ld0(dp);
3353                     break;
3354                 case 20:
3355                 case 21:
3356                 case 22:
3357                 case 23:
3358                 case 28:
3359                 case 29:
3360                 case 30:
3361                 case 31:
3362                     /* Source and destination the same.  */
3363                     gen_mov_F0_vreg(dp, rd);
3364                     break;
3365                 case 4:
3366                 case 5:
3367                 case 6:
3368                 case 7:
3369                     /* VCVTB, VCVTT: only present with the halfprec extension
3370                      * UNPREDICTABLE if bit 8 is set prior to ARMv8
3371                      * (we choose to UNDEF)
3372                      */
3373                     if ((dp && !arm_dc_feature(s, ARM_FEATURE_V8)) ||
3374                         !arm_dc_feature(s, ARM_FEATURE_VFP_FP16)) {
3375                         return 1;
3376                     }
3377                     if (!extract32(rn, 1, 1)) {
3378                         /* Half precision source.  */
3379                         gen_mov_F0_vreg(0, rm);
3380                         break;
3381                     }
3382                     /* Otherwise fall through */
3383                 default:
3384                     /* One source operand.  */
3385                     gen_mov_F0_vreg(dp, rm);
3386                     break;
3387                 }
3388             } else {
3389                 /* Two source operands.  */
3390                 gen_mov_F0_vreg(dp, rn);
3391                 gen_mov_F1_vreg(dp, rm);
3392             }
3393
3394             for (;;) {
3395                 /* Perform the calculation.  */
3396                 switch (op) {
3397                 case 0: /* VMLA: fd + (fn * fm) */
3398                     /* Note that order of inputs to the add matters for NaNs */
3399                     gen_vfp_F1_mul(dp);
3400                     gen_mov_F0_vreg(dp, rd);
3401                     gen_vfp_add(dp);
3402                     break;
3403                 case 1: /* VMLS: fd + -(fn * fm) */
3404                     gen_vfp_mul(dp);
3405                     gen_vfp_F1_neg(dp);
3406                     gen_mov_F0_vreg(dp, rd);
3407                     gen_vfp_add(dp);
3408                     break;
3409                 case 2: /* VNMLS: -fd + (fn * fm) */
3410                     /* Note that it isn't valid to replace (-A + B) with (B - A)
3411                      * or similar plausible looking simplifications
3412                      * because this will give wrong results for NaNs.
3413                      */
3414                     gen_vfp_F1_mul(dp);
3415                     gen_mov_F0_vreg(dp, rd);
3416                     gen_vfp_neg(dp);
3417                     gen_vfp_add(dp);
3418                     break;
3419                 case 3: /* VNMLA: -fd + -(fn * fm) */
3420                     gen_vfp_mul(dp);
3421                     gen_vfp_F1_neg(dp);
3422                     gen_mov_F0_vreg(dp, rd);
3423                     gen_vfp_neg(dp);
3424                     gen_vfp_add(dp);
3425                     break;
3426                 case 4: /* mul: fn * fm */
3427                     gen_vfp_mul(dp);
3428                     break;
3429                 case 5: /* nmul: -(fn * fm) */
3430                     gen_vfp_mul(dp);
3431                     gen_vfp_neg(dp);
3432                     break;
3433                 case 6: /* add: fn + fm */
3434                     gen_vfp_add(dp);
3435                     break;
3436                 case 7: /* sub: fn - fm */
3437                     gen_vfp_sub(dp);
3438                     break;
3439                 case 8: /* div: fn / fm */
3440                     gen_vfp_div(dp);
3441                     break;
3442                 case 10: /* VFNMA : fd = muladd(-fd,  fn, fm) */
3443                 case 11: /* VFNMS : fd = muladd(-fd, -fn, fm) */
3444                 case 12: /* VFMA  : fd = muladd( fd,  fn, fm) */
3445                 case 13: /* VFMS  : fd = muladd( fd, -fn, fm) */
3446                     /* These are fused multiply-add, and must be done as one
3447                      * floating point operation with no rounding between the
3448                      * multiplication and addition steps.
3449                      * NB that doing the negations here as separate steps is
3450                      * correct : an input NaN should come out with its sign bit
3451                      * flipped if it is a negated-input.
3452                      */
3453                     if (!arm_dc_feature(s, ARM_FEATURE_VFP4)) {
3454                         return 1;
3455                     }
3456                     if (dp) {
3457                         TCGv_ptr fpst;
3458                         TCGv_i64 frd;
3459                         if (op & 1) {
3460                             /* VFNMS, VFMS */
3461                             gen_helper_vfp_negd(cpu_F0d, cpu_F0d);
3462                         }
3463                         frd = tcg_temp_new_i64();
3464                         tcg_gen_ld_f64(frd, cpu_env, vfp_reg_offset(dp, rd));
3465                         if (op & 2) {
3466                             /* VFNMA, VFNMS */
3467                             gen_helper_vfp_negd(frd, frd);
3468                         }
3469                         fpst = get_fpstatus_ptr(0);
3470                         gen_helper_vfp_muladdd(cpu_F0d, cpu_F0d,
3471                                                cpu_F1d, frd, fpst);
3472                         tcg_temp_free_ptr(fpst);
3473                         tcg_temp_free_i64(frd);
3474                     } else {
3475                         TCGv_ptr fpst;
3476                         TCGv_i32 frd;
3477                         if (op & 1) {
3478                             /* VFNMS, VFMS */
3479                             gen_helper_vfp_negs(cpu_F0s, cpu_F0s);
3480                         }
3481                         frd = tcg_temp_new_i32();
3482                         tcg_gen_ld_f32(frd, cpu_env, vfp_reg_offset(dp, rd));
3483                         if (op & 2) {
3484                             gen_helper_vfp_negs(frd, frd);
3485                         }
3486                         fpst = get_fpstatus_ptr(0);
3487                         gen_helper_vfp_muladds(cpu_F0s, cpu_F0s,
3488                                                cpu_F1s, frd, fpst);
3489                         tcg_temp_free_ptr(fpst);
3490                         tcg_temp_free_i32(frd);
3491                     }
3492                     break;
3493                 case 14: /* fconst */
3494                     if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
3495                         return 1;
3496                     }
3497
3498                     n = (insn << 12) & 0x80000000;
3499                     i = ((insn >> 12) & 0x70) | (insn & 0xf);
3500                     if (dp) {
3501                         if (i & 0x40)
3502                             i |= 0x3f80;
3503                         else
3504                             i |= 0x4000;
3505                         n |= i << 16;
3506                         tcg_gen_movi_i64(cpu_F0d, ((uint64_t)n) << 32);
3507                     } else {
3508                         if (i & 0x40)
3509                             i |= 0x780;
3510                         else
3511                             i |= 0x800;
3512                         n |= i << 19;
3513                         tcg_gen_movi_i32(cpu_F0s, n);
3514                     }
3515                     break;
3516                 case 15: /* extension space */
3517                     switch (rn) {
3518                     case 0: /* cpy */
3519                         /* no-op */
3520                         break;
3521                     case 1: /* abs */
3522                         gen_vfp_abs(dp);
3523                         break;
3524                     case 2: /* neg */
3525                         gen_vfp_neg(dp);
3526                         break;
3527                     case 3: /* sqrt */
3528                         gen_vfp_sqrt(dp);
3529                         break;
3530                     case 4: /* vcvtb.f32.f16, vcvtb.f64.f16 */
3531                         tmp = gen_vfp_mrs();
3532                         tcg_gen_ext16u_i32(tmp, tmp);
3533                         if (dp) {
3534                             gen_helper_vfp_fcvt_f16_to_f64(cpu_F0d, tmp,
3535                                                            cpu_env);
3536                         } else {
3537                             gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp,
3538                                                            cpu_env);
3539                         }
3540                         tcg_temp_free_i32(tmp);
3541                         break;
3542                     case 5: /* vcvtt.f32.f16, vcvtt.f64.f16 */
3543                         tmp = gen_vfp_mrs();
3544                         tcg_gen_shri_i32(tmp, tmp, 16);
3545                         if (dp) {
3546                             gen_helper_vfp_fcvt_f16_to_f64(cpu_F0d, tmp,
3547                                                            cpu_env);
3548                         } else {
3549                             gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp,
3550                                                            cpu_env);
3551                         }
3552                         tcg_temp_free_i32(tmp);
3553                         break;
3554                     case 6: /* vcvtb.f16.f32, vcvtb.f16.f64 */
3555                         tmp = tcg_temp_new_i32();
3556                         if (dp) {
3557                             gen_helper_vfp_fcvt_f64_to_f16(tmp, cpu_F0d,
3558                                                            cpu_env);
3559                         } else {
3560                             gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s,
3561                                                            cpu_env);
3562                         }
3563                         gen_mov_F0_vreg(0, rd);
3564                         tmp2 = gen_vfp_mrs();
3565                         tcg_gen_andi_i32(tmp2, tmp2, 0xffff0000);
3566                         tcg_gen_or_i32(tmp, tmp, tmp2);
3567                         tcg_temp_free_i32(tmp2);
3568                         gen_vfp_msr(tmp);
3569                         break;
3570                     case 7: /* vcvtt.f16.f32, vcvtt.f16.f64 */
3571                         tmp = tcg_temp_new_i32();
3572                         if (dp) {
3573                             gen_helper_vfp_fcvt_f64_to_f16(tmp, cpu_F0d,
3574                                                            cpu_env);
3575                         } else {
3576                             gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s,
3577                                                            cpu_env);
3578                         }
3579                         tcg_gen_shli_i32(tmp, tmp, 16);
3580                         gen_mov_F0_vreg(0, rd);
3581                         tmp2 = gen_vfp_mrs();
3582                         tcg_gen_ext16u_i32(tmp2, tmp2);
3583                         tcg_gen_or_i32(tmp, tmp, tmp2);
3584                         tcg_temp_free_i32(tmp2);
3585                         gen_vfp_msr(tmp);
3586                         break;
3587                     case 8: /* cmp */
3588                         gen_vfp_cmp(dp);
3589                         break;
3590                     case 9: /* cmpe */
3591                         gen_vfp_cmpe(dp);
3592                         break;
3593                     case 10: /* cmpz */
3594                         gen_vfp_cmp(dp);
3595                         break;
3596                     case 11: /* cmpez */
3597                         gen_vfp_F1_ld0(dp);
3598                         gen_vfp_cmpe(dp);
3599                         break;
3600                     case 12: /* vrintr */
3601                     {
3602                         TCGv_ptr fpst = get_fpstatus_ptr(0);
3603                         if (dp) {
3604                             gen_helper_rintd(cpu_F0d, cpu_F0d, fpst);
3605                         } else {
3606                             gen_helper_rints(cpu_F0s, cpu_F0s, fpst);
3607                         }
3608                         tcg_temp_free_ptr(fpst);
3609                         break;
3610                     }
3611                     case 13: /* vrintz */
3612                     {
3613                         TCGv_ptr fpst = get_fpstatus_ptr(0);
3614                         TCGv_i32 tcg_rmode;
3615                         tcg_rmode = tcg_const_i32(float_round_to_zero);
3616                         gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
3617                         if (dp) {
3618                             gen_helper_rintd(cpu_F0d, cpu_F0d, fpst);
3619                         } else {
3620                             gen_helper_rints(cpu_F0s, cpu_F0s, fpst);
3621                         }
3622                         gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
3623                         tcg_temp_free_i32(tcg_rmode);
3624                         tcg_temp_free_ptr(fpst);
3625                         break;
3626                     }
3627                     case 14: /* vrintx */
3628                     {
3629                         TCGv_ptr fpst = get_fpstatus_ptr(0);
3630                         if (dp) {
3631                             gen_helper_rintd_exact(cpu_F0d, cpu_F0d, fpst);
3632                         } else {
3633                             gen_helper_rints_exact(cpu_F0s, cpu_F0s, fpst);
3634                         }
3635                         tcg_temp_free_ptr(fpst);
3636                         break;
3637                     }
3638                     case 15: /* single<->double conversion */
3639                         if (dp)
3640                             gen_helper_vfp_fcvtsd(cpu_F0s, cpu_F0d, cpu_env);
3641                         else
3642                             gen_helper_vfp_fcvtds(cpu_F0d, cpu_F0s, cpu_env);
3643                         break;
3644                     case 16: /* fuito */
3645                         gen_vfp_uito(dp, 0);
3646                         break;
3647                     case 17: /* fsito */
3648                         gen_vfp_sito(dp, 0);
3649                         break;
3650                     case 20: /* fshto */
3651                         if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
3652                             return 1;
3653                         }
3654                         gen_vfp_shto(dp, 16 - rm, 0);
3655                         break;
3656                     case 21: /* fslto */
3657                         if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
3658                             return 1;
3659                         }
3660                         gen_vfp_slto(dp, 32 - rm, 0);
3661                         break;
3662                     case 22: /* fuhto */
3663                         if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
3664                             return 1;
3665                         }
3666                         gen_vfp_uhto(dp, 16 - rm, 0);
3667                         break;
3668                     case 23: /* fulto */
3669                         if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
3670                             return 1;
3671                         }
3672                         gen_vfp_ulto(dp, 32 - rm, 0);
3673                         break;
3674                     case 24: /* ftoui */
3675                         gen_vfp_toui(dp, 0);
3676                         break;
3677                     case 25: /* ftouiz */
3678                         gen_vfp_touiz(dp, 0);
3679                         break;
3680                     case 26: /* ftosi */
3681                         gen_vfp_tosi(dp, 0);
3682                         break;
3683                     case 27: /* ftosiz */
3684                         gen_vfp_tosiz(dp, 0);
3685                         break;
3686                     case 28: /* ftosh */
3687                         if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
3688                             return 1;
3689                         }
3690                         gen_vfp_tosh(dp, 16 - rm, 0);
3691                         break;
3692                     case 29: /* ftosl */
3693                         if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
3694                             return 1;
3695                         }
3696                         gen_vfp_tosl(dp, 32 - rm, 0);
3697                         break;
3698                     case 30: /* ftouh */
3699                         if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
3700                             return 1;
3701                         }
3702                         gen_vfp_touh(dp, 16 - rm, 0);
3703                         break;
3704                     case 31: /* ftoul */
3705                         if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
3706                             return 1;
3707                         }
3708                         gen_vfp_toul(dp, 32 - rm, 0);
3709                         break;
3710                     default: /* undefined */
3711                         return 1;
3712                     }
3713                     break;
3714                 default: /* undefined */
3715                     return 1;
3716                 }
3717
3718                 /* Write back the result.  */
3719                 if (op == 15 && (rn >= 8 && rn <= 11)) {
3720                     /* Comparison, do nothing.  */
3721                 } else if (op == 15 && dp && ((rn & 0x1c) == 0x18 ||
3722                                               (rn & 0x1e) == 0x6)) {
3723                     /* VCVT double to int: always integer result.
3724                      * VCVT double to half precision is always a single
3725                      * precision result.
3726                      */
3727                     gen_mov_vreg_F0(0, rd);
3728                 } else if (op == 15 && rn == 15) {
3729                     /* conversion */
3730                     gen_mov_vreg_F0(!dp, rd);
3731                 } else {
3732                     gen_mov_vreg_F0(dp, rd);
3733                 }
3734
3735                 /* break out of the loop if we have finished  */
3736                 if (veclen == 0)
3737                     break;
3738
3739                 if (op == 15 && delta_m == 0) {
3740                     /* single source one-many */
3741                     while (veclen--) {
3742                         rd = ((rd + delta_d) & (bank_mask - 1))
3743                              | (rd & bank_mask);
3744                         gen_mov_vreg_F0(dp, rd);
3745                     }
3746                     break;
3747                 }
3748                 /* Setup the next operands.  */
3749                 veclen--;
3750                 rd = ((rd + delta_d) & (bank_mask - 1))
3751                      | (rd & bank_mask);
3752
3753                 if (op == 15) {
3754                     /* One source operand.  */
3755                     rm = ((rm + delta_m) & (bank_mask - 1))
3756                          | (rm & bank_mask);
3757                     gen_mov_F0_vreg(dp, rm);
3758                 } else {
3759                     /* Two source operands.  */
3760                     rn = ((rn + delta_d) & (bank_mask - 1))
3761                          | (rn & bank_mask);
3762                     gen_mov_F0_vreg(dp, rn);
3763                     if (delta_m) {
3764                         rm = ((rm + delta_m) & (bank_mask - 1))
3765                              | (rm & bank_mask);
3766                         gen_mov_F1_vreg(dp, rm);
3767                     }
3768                 }
3769             }
3770         }
3771         break;
3772     case 0xc:
3773     case 0xd:
3774         if ((insn & 0x03e00000) == 0x00400000) {
3775             /* two-register transfer */
3776             rn = (insn >> 16) & 0xf;
3777             rd = (insn >> 12) & 0xf;
3778             if (dp) {
3779                 VFP_DREG_M(rm, insn);
3780             } else {
3781                 rm = VFP_SREG_M(insn);
3782             }
3783
3784             if (insn & ARM_CP_RW_BIT) {
3785                 /* vfp->arm */
3786                 if (dp) {
3787                     gen_mov_F0_vreg(0, rm * 2);
3788                     tmp = gen_vfp_mrs();
3789                     store_reg(s, rd, tmp);
3790                     gen_mov_F0_vreg(0, rm * 2 + 1);
3791                     tmp = gen_vfp_mrs();
3792                     store_reg(s, rn, tmp);
3793                 } else {
3794                     gen_mov_F0_vreg(0, rm);
3795                     tmp = gen_vfp_mrs();
3796                     store_reg(s, rd, tmp);
3797                     gen_mov_F0_vreg(0, rm + 1);
3798                     tmp = gen_vfp_mrs();
3799                     store_reg(s, rn, tmp);
3800                 }
3801             } else {
3802                 /* arm->vfp */
3803                 if (dp) {
3804                     tmp = load_reg(s, rd);
3805                     gen_vfp_msr(tmp);
3806                     gen_mov_vreg_F0(0, rm * 2);
3807                     tmp = load_reg(s, rn);
3808                     gen_vfp_msr(tmp);
3809                     gen_mov_vreg_F0(0, rm * 2 + 1);
3810                 } else {
3811                     tmp = load_reg(s, rd);
3812                     gen_vfp_msr(tmp);
3813                     gen_mov_vreg_F0(0, rm);
3814                     tmp = load_reg(s, rn);
3815                     gen_vfp_msr(tmp);
3816                     gen_mov_vreg_F0(0, rm + 1);
3817                 }
3818             }
3819         } else {
3820             /* Load/store */
3821             rn = (insn >> 16) & 0xf;
3822             if (dp)
3823                 VFP_DREG_D(rd, insn);
3824             else
3825                 rd = VFP_SREG_D(insn);
3826             if ((insn & 0x01200000) == 0x01000000) {
3827                 /* Single load/store */
3828                 offset = (insn & 0xff) << 2;
3829                 if ((insn & (1 << 23)) == 0)
3830                     offset = -offset;
3831                 if (s->thumb && rn == 15) {
3832                     /* This is actually UNPREDICTABLE */
3833                     addr = tcg_temp_new_i32();
3834                     tcg_gen_movi_i32(addr, s->pc & ~2);
3835                 } else {
3836                     addr = load_reg(s, rn);
3837                 }
3838                 tcg_gen_addi_i32(addr, addr, offset);
3839                 if (insn & (1 << 20)) {
3840                     gen_vfp_ld(s, dp, addr);
3841                     gen_mov_vreg_F0(dp, rd);
3842                 } else {
3843                     gen_mov_F0_vreg(dp, rd);
3844                     gen_vfp_st(s, dp, addr);
3845                 }
3846                 tcg_temp_free_i32(addr);
3847             } else {
3848                 /* load/store multiple */
3849                 int w = insn & (1 << 21);
3850                 if (dp)
3851                     n = (insn >> 1) & 0x7f;
3852                 else
3853                     n = insn & 0xff;
3854
3855                 if (w && !(((insn >> 23) ^ (insn >> 24)) & 1)) {
3856                     /* P == U , W == 1  => UNDEF */
3857                     return 1;
3858                 }
3859                 if (n == 0 || (rd + n) > 32 || (dp && n > 16)) {
3860                     /* UNPREDICTABLE cases for bad immediates: we choose to
3861                      * UNDEF to avoid generating huge numbers of TCG ops
3862                      */
3863                     return 1;
3864                 }
3865                 if (rn == 15 && w) {
3866                     /* writeback to PC is UNPREDICTABLE, we choose to UNDEF */
3867                     return 1;
3868                 }
3869
3870                 if (s->thumb && rn == 15) {
3871                     /* This is actually UNPREDICTABLE */
3872                     addr = tcg_temp_new_i32();
3873                     tcg_gen_movi_i32(addr, s->pc & ~2);
3874                 } else {
3875                     addr = load_reg(s, rn);
3876                 }
3877                 if (insn & (1 << 24)) /* pre-decrement */
3878                     tcg_gen_addi_i32(addr, addr, -((insn & 0xff) << 2));
3879
3880                 if (dp)
3881                     offset = 8;
3882                 else
3883                     offset = 4;
3884                 for (i = 0; i < n; i++) {
3885                     if (insn & ARM_CP_RW_BIT) {
3886                         /* load */
3887                         gen_vfp_ld(s, dp, addr);
3888                         gen_mov_vreg_F0(dp, rd + i);
3889                     } else {
3890                         /* store */
3891                         gen_mov_F0_vreg(dp, rd + i);
3892                         gen_vfp_st(s, dp, addr);
3893                     }
3894                     tcg_gen_addi_i32(addr, addr, offset);
3895                 }
3896                 if (w) {
3897                     /* writeback */
3898                     if (insn & (1 << 24))
3899                         offset = -offset * n;
3900                     else if (dp && (insn & 1))
3901                         offset = 4;
3902                     else
3903                         offset = 0;
3904
3905                     if (offset != 0)
3906                         tcg_gen_addi_i32(addr, addr, offset);
3907                     store_reg(s, rn, addr);
3908                 } else {
3909                     tcg_temp_free_i32(addr);
3910                 }
3911             }
3912         }
3913         break;
3914     default:
3915         /* Should never happen.  */
3916         return 1;
3917     }
3918     return 0;
3919 }
3920
3921 static inline void gen_goto_tb(DisasContext *s, int n, target_ulong dest)
3922 {
3923     TranslationBlock *tb;
3924
3925     tb = s->tb;
3926     if ((tb->pc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK)) {
3927         tcg_gen_goto_tb(n);
3928         gen_set_pc_im(s, dest);
3929         tcg_gen_exit_tb((uintptr_t)tb + n);
3930     } else {
3931         gen_set_pc_im(s, dest);
3932         tcg_gen_exit_tb(0);
3933     }
3934 }
3935
3936 static inline void gen_jmp (DisasContext *s, uint32_t dest)
3937 {
3938     if (unlikely(s->singlestep_enabled || s->ss_active)) {
3939         /* An indirect jump so that we still trigger the debug exception.  */
3940         if (s->thumb)
3941             dest |= 1;
3942         gen_bx_im(s, dest);
3943     } else {
3944         gen_goto_tb(s, 0, dest);
3945         s->is_jmp = DISAS_TB_JUMP;
3946     }
3947 }
3948
3949 static inline void gen_mulxy(TCGv_i32 t0, TCGv_i32 t1, int x, int y)
3950 {
3951     if (x)
3952         tcg_gen_sari_i32(t0, t0, 16);
3953     else
3954         gen_sxth(t0);
3955     if (y)
3956         tcg_gen_sari_i32(t1, t1, 16);
3957     else
3958         gen_sxth(t1);
3959     tcg_gen_mul_i32(t0, t0, t1);
3960 }
3961
3962 /* Return the mask of PSR bits set by a MSR instruction.  */
3963 static uint32_t msr_mask(DisasContext *s, int flags, int spsr)
3964 {
3965     uint32_t mask;
3966
3967     mask = 0;
3968     if (flags & (1 << 0))
3969         mask |= 0xff;
3970     if (flags & (1 << 1))
3971         mask |= 0xff00;
3972     if (flags & (1 << 2))
3973         mask |= 0xff0000;
3974     if (flags & (1 << 3))
3975         mask |= 0xff000000;
3976
3977     /* Mask out undefined bits.  */
3978     mask &= ~CPSR_RESERVED;
3979     if (!arm_dc_feature(s, ARM_FEATURE_V4T)) {
3980         mask &= ~CPSR_T;
3981     }
3982     if (!arm_dc_feature(s, ARM_FEATURE_V5)) {
3983         mask &= ~CPSR_Q; /* V5TE in reality*/
3984     }
3985     if (!arm_dc_feature(s, ARM_FEATURE_V6)) {
3986         mask &= ~(CPSR_E | CPSR_GE);
3987     }
3988     if (!arm_dc_feature(s, ARM_FEATURE_THUMB2)) {
3989         mask &= ~CPSR_IT;
3990     }
3991     /* Mask out execution state and reserved bits.  */
3992     if (!spsr) {
3993         mask &= ~(CPSR_EXEC | CPSR_RESERVED);
3994     }
3995     /* Mask out privileged bits.  */
3996     if (IS_USER(s))
3997         mask &= CPSR_USER;
3998     return mask;
3999 }
4000
4001 /* Returns nonzero if access to the PSR is not permitted. Marks t0 as dead. */
4002 static int gen_set_psr(DisasContext *s, uint32_t mask, int spsr, TCGv_i32 t0)
4003 {
4004     TCGv_i32 tmp;
4005     if (spsr) {
4006         /* ??? This is also undefined in system mode.  */
4007         if (IS_USER(s))
4008             return 1;
4009
4010         tmp = load_cpu_field(spsr);
4011         tcg_gen_andi_i32(tmp, tmp, ~mask);
4012         tcg_gen_andi_i32(t0, t0, mask);
4013         tcg_gen_or_i32(tmp, tmp, t0);
4014         store_cpu_field(tmp, spsr);
4015     } else {
4016         gen_set_cpsr(t0, mask);
4017     }
4018     tcg_temp_free_i32(t0);
4019     gen_lookup_tb(s);
4020     return 0;
4021 }
4022
4023 /* Returns nonzero if access to the PSR is not permitted.  */
4024 static int gen_set_psr_im(DisasContext *s, uint32_t mask, int spsr, uint32_t val)
4025 {
4026     TCGv_i32 tmp;
4027     tmp = tcg_temp_new_i32();
4028     tcg_gen_movi_i32(tmp, val);
4029     return gen_set_psr(s, mask, spsr, tmp);
4030 }
4031
4032 /* Generate an old-style exception return. Marks pc as dead. */
4033 static void gen_exception_return(DisasContext *s, TCGv_i32 pc)
4034 {
4035     TCGv_i32 tmp;
4036     store_reg(s, 15, pc);
4037     tmp = load_cpu_field(spsr);
4038     gen_set_cpsr(tmp, CPSR_ERET_MASK);
4039     tcg_temp_free_i32(tmp);
4040     s->is_jmp = DISAS_UPDATE;
4041 }
4042
4043 /* Generate a v6 exception return.  Marks both values as dead.  */
4044 static void gen_rfe(DisasContext *s, TCGv_i32 pc, TCGv_i32 cpsr)
4045 {
4046     gen_set_cpsr(cpsr, CPSR_ERET_MASK);
4047     tcg_temp_free_i32(cpsr);
4048     store_reg(s, 15, pc);
4049     s->is_jmp = DISAS_UPDATE;
4050 }
4051
4052 static void gen_nop_hint(DisasContext *s, int val)
4053 {
4054     switch (val) {
4055     case 3: /* wfi */
4056         gen_set_pc_im(s, s->pc);
4057         s->is_jmp = DISAS_WFI;
4058         break;
4059     case 2: /* wfe */
4060         gen_set_pc_im(s, s->pc);
4061         s->is_jmp = DISAS_WFE;
4062         break;
4063     case 4: /* sev */
4064     case 5: /* sevl */
4065         /* TODO: Implement SEV, SEVL and WFE.  May help SMP performance.  */
4066     default: /* nop */
4067         break;
4068     }
4069 }
4070
4071 #define CPU_V001 cpu_V0, cpu_V0, cpu_V1
4072
4073 static inline void gen_neon_add(int size, TCGv_i32 t0, TCGv_i32 t1)
4074 {
4075     switch (size) {
4076     case 0: gen_helper_neon_add_u8(t0, t0, t1); break;
4077     case 1: gen_helper_neon_add_u16(t0, t0, t1); break;
4078     case 2: tcg_gen_add_i32(t0, t0, t1); break;
4079     default: abort();
4080     }
4081 }
4082
4083 static inline void gen_neon_rsb(int size, TCGv_i32 t0, TCGv_i32 t1)
4084 {
4085     switch (size) {
4086     case 0: gen_helper_neon_sub_u8(t0, t1, t0); break;
4087     case 1: gen_helper_neon_sub_u16(t0, t1, t0); break;
4088     case 2: tcg_gen_sub_i32(t0, t1, t0); break;
4089     default: return;
4090     }
4091 }
4092
4093 /* 32-bit pairwise ops end up the same as the elementwise versions.  */
4094 #define gen_helper_neon_pmax_s32  gen_helper_neon_max_s32
4095 #define gen_helper_neon_pmax_u32  gen_helper_neon_max_u32
4096 #define gen_helper_neon_pmin_s32  gen_helper_neon_min_s32
4097 #define gen_helper_neon_pmin_u32  gen_helper_neon_min_u32
4098
4099 #define GEN_NEON_INTEGER_OP_ENV(name) do { \
4100     switch ((size << 1) | u) { \
4101     case 0: \
4102         gen_helper_neon_##name##_s8(tmp, cpu_env, tmp, tmp2); \
4103         break; \
4104     case 1: \
4105         gen_helper_neon_##name##_u8(tmp, cpu_env, tmp, tmp2); \
4106         break; \
4107     case 2: \
4108         gen_helper_neon_##name##_s16(tmp, cpu_env, tmp, tmp2); \
4109         break; \
4110     case 3: \
4111         gen_helper_neon_##name##_u16(tmp, cpu_env, tmp, tmp2); \
4112         break; \
4113     case 4: \
4114         gen_helper_neon_##name##_s32(tmp, cpu_env, tmp, tmp2); \
4115         break; \
4116     case 5: \
4117         gen_helper_neon_##name##_u32(tmp, cpu_env, tmp, tmp2); \
4118         break; \
4119     default: return 1; \
4120     }} while (0)
4121
4122 #define GEN_NEON_INTEGER_OP(name) do { \
4123     switch ((size << 1) | u) { \
4124     case 0: \
4125         gen_helper_neon_##name##_s8(tmp, tmp, tmp2); \
4126         break; \
4127     case 1: \
4128         gen_helper_neon_##name##_u8(tmp, tmp, tmp2); \
4129         break; \
4130     case 2: \
4131         gen_helper_neon_##name##_s16(tmp, tmp, tmp2); \
4132         break; \
4133     case 3: \
4134         gen_helper_neon_##name##_u16(tmp, tmp, tmp2); \
4135         break; \
4136     case 4: \
4137         gen_helper_neon_##name##_s32(tmp, tmp, tmp2); \
4138         break; \
4139     case 5: \
4140         gen_helper_neon_##name##_u32(tmp, tmp, tmp2); \
4141         break; \
4142     default: return 1; \
4143     }} while (0)
4144
4145 static TCGv_i32 neon_load_scratch(int scratch)
4146 {
4147     TCGv_i32 tmp = tcg_temp_new_i32();
4148     tcg_gen_ld_i32(tmp, cpu_env, offsetof(CPUARMState, vfp.scratch[scratch]));
4149     return tmp;
4150 }
4151
4152 static void neon_store_scratch(int scratch, TCGv_i32 var)
4153 {
4154     tcg_gen_st_i32(var, cpu_env, offsetof(CPUARMState, vfp.scratch[scratch]));
4155     tcg_temp_free_i32(var);
4156 }
4157
4158 static inline TCGv_i32 neon_get_scalar(int size, int reg)
4159 {
4160     TCGv_i32 tmp;
4161     if (size == 1) {
4162         tmp = neon_load_reg(reg & 7, reg >> 4);
4163         if (reg & 8) {
4164             gen_neon_dup_high16(tmp);
4165         } else {
4166             gen_neon_dup_low16(tmp);
4167         }
4168     } else {
4169         tmp = neon_load_reg(reg & 15, reg >> 4);
4170     }
4171     return tmp;
4172 }
4173
4174 static int gen_neon_unzip(int rd, int rm, int size, int q)
4175 {
4176     TCGv_i32 tmp, tmp2;
4177     if (!q && size == 2) {
4178         return 1;
4179     }
4180     tmp = tcg_const_i32(rd);
4181     tmp2 = tcg_const_i32(rm);
4182     if (q) {
4183         switch (size) {
4184         case 0:
4185             gen_helper_neon_qunzip8(cpu_env, tmp, tmp2);
4186             break;
4187         case 1:
4188             gen_helper_neon_qunzip16(cpu_env, tmp, tmp2);
4189             break;
4190         case 2:
4191             gen_helper_neon_qunzip32(cpu_env, tmp, tmp2);
4192             break;
4193         default:
4194             abort();
4195         }
4196     } else {
4197         switch (size) {
4198         case 0:
4199             gen_helper_neon_unzip8(cpu_env, tmp, tmp2);
4200             break;
4201         case 1:
4202             gen_helper_neon_unzip16(cpu_env, tmp, tmp2);
4203             break;
4204         default:
4205             abort();
4206         }
4207     }
4208     tcg_temp_free_i32(tmp);
4209     tcg_temp_free_i32(tmp2);
4210     return 0;
4211 }
4212
4213 static int gen_neon_zip(int rd, int rm, int size, int q)
4214 {
4215     TCGv_i32 tmp, tmp2;
4216     if (!q && size == 2) {
4217         return 1;
4218     }
4219     tmp = tcg_const_i32(rd);
4220     tmp2 = tcg_const_i32(rm);
4221     if (q) {
4222         switch (size) {
4223         case 0:
4224             gen_helper_neon_qzip8(cpu_env, tmp, tmp2);
4225             break;
4226         case 1:
4227             gen_helper_neon_qzip16(cpu_env, tmp, tmp2);
4228             break;
4229         case 2:
4230             gen_helper_neon_qzip32(cpu_env, tmp, tmp2);
4231             break;
4232         default:
4233             abort();
4234         }
4235     } else {
4236         switch (size) {
4237         case 0:
4238             gen_helper_neon_zip8(cpu_env, tmp, tmp2);
4239             break;
4240         case 1:
4241             gen_helper_neon_zip16(cpu_env, tmp, tmp2);
4242             break;
4243         default:
4244             abort();
4245         }
4246     }
4247     tcg_temp_free_i32(tmp);
4248     tcg_temp_free_i32(tmp2);
4249     return 0;
4250 }
4251
4252 static void gen_neon_trn_u8(TCGv_i32 t0, TCGv_i32 t1)
4253 {
4254     TCGv_i32 rd, tmp;
4255
4256     rd = tcg_temp_new_i32();
4257     tmp = tcg_temp_new_i32();
4258
4259     tcg_gen_shli_i32(rd, t0, 8);
4260     tcg_gen_andi_i32(rd, rd, 0xff00ff00);
4261     tcg_gen_andi_i32(tmp, t1, 0x00ff00ff);
4262     tcg_gen_or_i32(rd, rd, tmp);
4263
4264     tcg_gen_shri_i32(t1, t1, 8);
4265     tcg_gen_andi_i32(t1, t1, 0x00ff00ff);
4266     tcg_gen_andi_i32(tmp, t0, 0xff00ff00);
4267     tcg_gen_or_i32(t1, t1, tmp);
4268     tcg_gen_mov_i32(t0, rd);
4269
4270     tcg_temp_free_i32(tmp);
4271     tcg_temp_free_i32(rd);
4272 }
4273
4274 static void gen_neon_trn_u16(TCGv_i32 t0, TCGv_i32 t1)
4275 {
4276     TCGv_i32 rd, tmp;
4277
4278     rd = tcg_temp_new_i32();
4279     tmp = tcg_temp_new_i32();
4280
4281     tcg_gen_shli_i32(rd, t0, 16);
4282     tcg_gen_andi_i32(tmp, t1, 0xffff);
4283     tcg_gen_or_i32(rd, rd, tmp);
4284     tcg_gen_shri_i32(t1, t1, 16);
4285     tcg_gen_andi_i32(tmp, t0, 0xffff0000);
4286     tcg_gen_or_i32(t1, t1, tmp);
4287     tcg_gen_mov_i32(t0, rd);
4288
4289     tcg_temp_free_i32(tmp);
4290     tcg_temp_free_i32(rd);
4291 }
4292
4293
4294 static struct {
4295     int nregs;
4296     int interleave;
4297     int spacing;
4298 } neon_ls_element_type[11] = {
4299     {4, 4, 1},
4300     {4, 4, 2},
4301     {4, 1, 1},
4302     {4, 2, 1},
4303     {3, 3, 1},
4304     {3, 3, 2},
4305     {3, 1, 1},
4306     {1, 1, 1},
4307     {2, 2, 1},
4308     {2, 2, 2},
4309     {2, 1, 1}
4310 };
4311
4312 /* Translate a NEON load/store element instruction.  Return nonzero if the
4313    instruction is invalid.  */
4314 static int disas_neon_ls_insn(DisasContext *s, uint32_t insn)
4315 {
4316     int rd, rn, rm;
4317     int op;
4318     int nregs;
4319     int interleave;
4320     int spacing;
4321     int stride;
4322     int size;
4323     int reg;
4324     int pass;
4325     int load;
4326     int shift;
4327     int n;
4328     TCGv_i32 addr;
4329     TCGv_i32 tmp;
4330     TCGv_i32 tmp2;
4331     TCGv_i64 tmp64;
4332
4333     /* FIXME: this access check should not take precedence over UNDEF
4334      * for invalid encodings; we will generate incorrect syndrome information
4335      * for attempts to execute invalid vfp/neon encodings with FP disabled.
4336      */
4337     if (!s->cpacr_fpen) {
4338         gen_exception_insn(s, 4, EXCP_UDEF,
4339                            syn_fp_access_trap(1, 0xe, s->thumb));
4340         return 0;
4341     }
4342
4343     if (!s->vfp_enabled)
4344       return 1;
4345     VFP_DREG_D(rd, insn);
4346     rn = (insn >> 16) & 0xf;
4347     rm = insn & 0xf;
4348     load = (insn & (1 << 21)) != 0;
4349     if ((insn & (1 << 23)) == 0) {
4350         /* Load store all elements.  */
4351         op = (insn >> 8) & 0xf;
4352         size = (insn >> 6) & 3;
4353         if (op > 10)
4354             return 1;
4355         /* Catch UNDEF cases for bad values of align field */
4356         switch (op & 0xc) {
4357         case 4:
4358             if (((insn >> 5) & 1) == 1) {
4359                 return 1;
4360             }
4361             break;
4362         case 8:
4363             if (((insn >> 4) & 3) == 3) {
4364                 return 1;
4365             }
4366             break;
4367         default:
4368             break;
4369         }
4370         nregs = neon_ls_element_type[op].nregs;
4371         interleave = neon_ls_element_type[op].interleave;
4372         spacing = neon_ls_element_type[op].spacing;
4373         if (size == 3 && (interleave | spacing) != 1)
4374             return 1;
4375         addr = tcg_temp_new_i32();
4376         load_reg_var(s, addr, rn);
4377         stride = (1 << size) * interleave;
4378         for (reg = 0; reg < nregs; reg++) {
4379             if (interleave > 2 || (interleave == 2 && nregs == 2)) {
4380                 load_reg_var(s, addr, rn);
4381                 tcg_gen_addi_i32(addr, addr, (1 << size) * reg);
4382             } else if (interleave == 2 && nregs == 4 && reg == 2) {
4383                 load_reg_var(s, addr, rn);
4384                 tcg_gen_addi_i32(addr, addr, 1 << size);
4385             }
4386             if (size == 3) {
4387                 tmp64 = tcg_temp_new_i64();
4388                 if (load) {
4389                     gen_aa32_ld64(tmp64, addr, get_mem_index(s));
4390                     neon_store_reg64(tmp64, rd);
4391                 } else {
4392                     neon_load_reg64(tmp64, rd);
4393                     gen_aa32_st64(tmp64, addr, get_mem_index(s));
4394                 }
4395                 tcg_temp_free_i64(tmp64);
4396                 tcg_gen_addi_i32(addr, addr, stride);
4397             } else {
4398                 for (pass = 0; pass < 2; pass++) {
4399                     if (size == 2) {
4400                         if (load) {
4401                             tmp = tcg_temp_new_i32();
4402                             gen_aa32_ld32u(tmp, addr, get_mem_index(s));
4403                             neon_store_reg(rd, pass, tmp);
4404                         } else {
4405                             tmp = neon_load_reg(rd, pass);
4406                             gen_aa32_st32(tmp, addr, get_mem_index(s));
4407                             tcg_temp_free_i32(tmp);
4408                         }
4409                         tcg_gen_addi_i32(addr, addr, stride);
4410                     } else if (size == 1) {
4411                         if (load) {
4412                             tmp = tcg_temp_new_i32();
4413                             gen_aa32_ld16u(tmp, addr, get_mem_index(s));
4414                             tcg_gen_addi_i32(addr, addr, stride);
4415                             tmp2 = tcg_temp_new_i32();
4416                             gen_aa32_ld16u(tmp2, addr, get_mem_index(s));
4417                             tcg_gen_addi_i32(addr, addr, stride);
4418                             tcg_gen_shli_i32(tmp2, tmp2, 16);
4419                             tcg_gen_or_i32(tmp, tmp, tmp2);
4420                             tcg_temp_free_i32(tmp2);
4421                             neon_store_reg(rd, pass, tmp);
4422                         } else {
4423                             tmp = neon_load_reg(rd, pass);
4424                             tmp2 = tcg_temp_new_i32();
4425                             tcg_gen_shri_i32(tmp2, tmp, 16);
4426                             gen_aa32_st16(tmp, addr, get_mem_index(s));
4427                             tcg_temp_free_i32(tmp);
4428                             tcg_gen_addi_i32(addr, addr, stride);
4429                             gen_aa32_st16(tmp2, addr, get_mem_index(s));
4430                             tcg_temp_free_i32(tmp2);
4431                             tcg_gen_addi_i32(addr, addr, stride);
4432                         }
4433                     } else /* size == 0 */ {
4434                         if (load) {
4435                             TCGV_UNUSED_I32(tmp2);
4436                             for (n = 0; n < 4; n++) {
4437                                 tmp = tcg_temp_new_i32();
4438                                 gen_aa32_ld8u(tmp, addr, get_mem_index(s));
4439                                 tcg_gen_addi_i32(addr, addr, stride);
4440                                 if (n == 0) {
4441                                     tmp2 = tmp;
4442                                 } else {
4443                                     tcg_gen_shli_i32(tmp, tmp, n * 8);
4444                                     tcg_gen_or_i32(tmp2, tmp2, tmp);
4445                                     tcg_temp_free_i32(tmp);
4446                                 }
4447                             }
4448                             neon_store_reg(rd, pass, tmp2);
4449                         } else {
4450                             tmp2 = neon_load_reg(rd, pass);
4451                             for (n = 0; n < 4; n++) {
4452                                 tmp = tcg_temp_new_i32();
4453                                 if (n == 0) {
4454                                     tcg_gen_mov_i32(tmp, tmp2);
4455                                 } else {
4456                                     tcg_gen_shri_i32(tmp, tmp2, n * 8);
4457                                 }
4458                                 gen_aa32_st8(tmp, addr, get_mem_index(s));
4459                                 tcg_temp_free_i32(tmp);
4460                                 tcg_gen_addi_i32(addr, addr, stride);
4461                             }
4462                             tcg_temp_free_i32(tmp2);
4463                         }
4464                     }
4465                 }
4466             }
4467             rd += spacing;
4468         }
4469         tcg_temp_free_i32(addr);
4470         stride = nregs * 8;
4471     } else {
4472         size = (insn >> 10) & 3;
4473         if (size == 3) {
4474             /* Load single element to all lanes.  */
4475             int a = (insn >> 4) & 1;
4476             if (!load) {
4477                 return 1;
4478             }
4479             size = (insn >> 6) & 3;
4480             nregs = ((insn >> 8) & 3) + 1;
4481
4482             if (size == 3) {
4483                 if (nregs != 4 || a == 0) {
4484                     return 1;
4485                 }
4486                 /* For VLD4 size==3 a == 1 means 32 bits at 16 byte alignment */
4487                 size = 2;
4488             }
4489             if (nregs == 1 && a == 1 && size == 0) {
4490                 return 1;
4491             }
4492             if (nregs == 3 && a == 1) {
4493                 return 1;
4494             }
4495             addr = tcg_temp_new_i32();
4496             load_reg_var(s, addr, rn);
4497             if (nregs == 1) {
4498                 /* VLD1 to all lanes: bit 5 indicates how many Dregs to write */
4499                 tmp = gen_load_and_replicate(s, addr, size);
4500                 tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd, 0));
4501                 tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd, 1));
4502                 if (insn & (1 << 5)) {
4503                     tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd + 1, 0));
4504                     tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd + 1, 1));
4505                 }
4506                 tcg_temp_free_i32(tmp);
4507             } else {
4508                 /* VLD2/3/4 to all lanes: bit 5 indicates register stride */
4509                 stride = (insn & (1 << 5)) ? 2 : 1;
4510                 for (reg = 0; reg < nregs; reg++) {
4511                     tmp = gen_load_and_replicate(s, addr, size);
4512                     tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd, 0));
4513                     tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd, 1));
4514                     tcg_temp_free_i32(tmp);
4515                     tcg_gen_addi_i32(addr, addr, 1 << size);
4516                     rd += stride;
4517                 }
4518             }
4519             tcg_temp_free_i32(addr);
4520             stride = (1 << size) * nregs;
4521         } else {
4522             /* Single element.  */
4523             int idx = (insn >> 4) & 0xf;
4524             pass = (insn >> 7) & 1;
4525             switch (size) {
4526             case 0:
4527                 shift = ((insn >> 5) & 3) * 8;
4528                 stride = 1;
4529                 break;
4530             case 1:
4531                 shift = ((insn >> 6) & 1) * 16;
4532                 stride = (insn & (1 << 5)) ? 2 : 1;
4533                 break;
4534             case 2:
4535                 shift = 0;
4536                 stride = (insn & (1 << 6)) ? 2 : 1;
4537                 break;
4538             default:
4539                 abort();
4540             }
4541             nregs = ((insn >> 8) & 3) + 1;
4542             /* Catch the UNDEF cases. This is unavoidably a bit messy. */
4543             switch (nregs) {
4544             case 1:
4545                 if (((idx & (1 << size)) != 0) ||
4546                     (size == 2 && ((idx & 3) == 1 || (idx & 3) == 2))) {
4547                     return 1;
4548                 }
4549                 break;
4550             case 3:
4551                 if ((idx & 1) != 0) {
4552                     return 1;
4553                 }
4554                 /* fall through */
4555             case 2:
4556                 if (size == 2 && (idx & 2) != 0) {
4557                     return 1;
4558                 }
4559                 break;
4560             case 4:
4561                 if ((size == 2) && ((idx & 3) == 3)) {
4562                     return 1;
4563                 }
4564                 break;
4565             default:
4566                 abort();
4567             }
4568             if ((rd + stride * (nregs - 1)) > 31) {
4569                 /* Attempts to write off the end of the register file
4570                  * are UNPREDICTABLE; we choose to UNDEF because otherwise
4571                  * the neon_load_reg() would write off the end of the array.
4572                  */
4573                 return 1;
4574             }
4575             addr = tcg_temp_new_i32();
4576             load_reg_var(s, addr, rn);
4577             for (reg = 0; reg < nregs; reg++) {
4578                 if (load) {
4579                     tmp = tcg_temp_new_i32();
4580                     switch (size) {
4581                     case 0:
4582                         gen_aa32_ld8u(tmp, addr, get_mem_index(s));
4583                         break;
4584                     case 1:
4585                         gen_aa32_ld16u(tmp, addr, get_mem_index(s));
4586                         break;
4587                     case 2:
4588                         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
4589                         break;
4590                     default: /* Avoid compiler warnings.  */
4591                         abort();
4592                     }
4593                     if (size != 2) {
4594                         tmp2 = neon_load_reg(rd, pass);
4595                         tcg_gen_deposit_i32(tmp, tmp2, tmp,
4596                                             shift, size ? 16 : 8);
4597                         tcg_temp_free_i32(tmp2);
4598                     }
4599                     neon_store_reg(rd, pass, tmp);
4600                 } else { /* Store */
4601                     tmp = neon_load_reg(rd, pass);
4602                     if (shift)
4603                         tcg_gen_shri_i32(tmp, tmp, shift);
4604                     switch (size) {
4605                     case 0:
4606                         gen_aa32_st8(tmp, addr, get_mem_index(s));
4607                         break;
4608                     case 1:
4609                         gen_aa32_st16(tmp, addr, get_mem_index(s));
4610                         break;
4611                     case 2:
4612                         gen_aa32_st32(tmp, addr, get_mem_index(s));
4613                         break;
4614                     }
4615                     tcg_temp_free_i32(tmp);
4616                 }
4617                 rd += stride;
4618                 tcg_gen_addi_i32(addr, addr, 1 << size);
4619             }
4620             tcg_temp_free_i32(addr);
4621             stride = nregs * (1 << size);
4622         }
4623     }
4624     if (rm != 15) {
4625         TCGv_i32 base;
4626
4627         base = load_reg(s, rn);
4628         if (rm == 13) {
4629             tcg_gen_addi_i32(base, base, stride);
4630         } else {
4631             TCGv_i32 index;
4632             index = load_reg(s, rm);
4633             tcg_gen_add_i32(base, base, index);
4634             tcg_temp_free_i32(index);
4635         }
4636         store_reg(s, rn, base);
4637     }
4638     return 0;
4639 }
4640
4641 /* Bitwise select.  dest = c ? t : f.  Clobbers T and F.  */
4642 static void gen_neon_bsl(TCGv_i32 dest, TCGv_i32 t, TCGv_i32 f, TCGv_i32 c)
4643 {
4644     tcg_gen_and_i32(t, t, c);
4645     tcg_gen_andc_i32(f, f, c);
4646     tcg_gen_or_i32(dest, t, f);
4647 }
4648
4649 static inline void gen_neon_narrow(int size, TCGv_i32 dest, TCGv_i64 src)
4650 {
4651     switch (size) {
4652     case 0: gen_helper_neon_narrow_u8(dest, src); break;
4653     case 1: gen_helper_neon_narrow_u16(dest, src); break;
4654     case 2: tcg_gen_trunc_i64_i32(dest, src); break;
4655     default: abort();
4656     }
4657 }
4658
4659 static inline void gen_neon_narrow_sats(int size, TCGv_i32 dest, TCGv_i64 src)
4660 {
4661     switch (size) {
4662     case 0: gen_helper_neon_narrow_sat_s8(dest, cpu_env, src); break;
4663     case 1: gen_helper_neon_narrow_sat_s16(dest, cpu_env, src); break;
4664     case 2: gen_helper_neon_narrow_sat_s32(dest, cpu_env, src); break;
4665     default: abort();
4666     }
4667 }
4668
4669 static inline void gen_neon_narrow_satu(int size, TCGv_i32 dest, TCGv_i64 src)
4670 {
4671     switch (size) {
4672     case 0: gen_helper_neon_narrow_sat_u8(dest, cpu_env, src); break;
4673     case 1: gen_helper_neon_narrow_sat_u16(dest, cpu_env, src); break;
4674     case 2: gen_helper_neon_narrow_sat_u32(dest, cpu_env, src); break;
4675     default: abort();
4676     }
4677 }
4678
4679 static inline void gen_neon_unarrow_sats(int size, TCGv_i32 dest, TCGv_i64 src)
4680 {
4681     switch (size) {
4682     case 0: gen_helper_neon_unarrow_sat8(dest, cpu_env, src); break;
4683     case 1: gen_helper_neon_unarrow_sat16(dest, cpu_env, src); break;
4684     case 2: gen_helper_neon_unarrow_sat32(dest, cpu_env, src); break;
4685     default: abort();
4686     }
4687 }
4688
4689 static inline void gen_neon_shift_narrow(int size, TCGv_i32 var, TCGv_i32 shift,
4690                                          int q, int u)
4691 {
4692     if (q) {
4693         if (u) {
4694             switch (size) {
4695             case 1: gen_helper_neon_rshl_u16(var, var, shift); break;
4696             case 2: gen_helper_neon_rshl_u32(var, var, shift); break;
4697             default: abort();
4698             }
4699         } else {
4700             switch (size) {
4701             case 1: gen_helper_neon_rshl_s16(var, var, shift); break;
4702             case 2: gen_helper_neon_rshl_s32(var, var, shift); break;
4703             default: abort();
4704             }
4705         }
4706     } else {
4707         if (u) {
4708             switch (size) {
4709             case 1: gen_helper_neon_shl_u16(var, var, shift); break;
4710             case 2: gen_helper_neon_shl_u32(var, var, shift); break;
4711             default: abort();
4712             }
4713         } else {
4714             switch (size) {
4715             case 1: gen_helper_neon_shl_s16(var, var, shift); break;
4716             case 2: gen_helper_neon_shl_s32(var, var, shift); break;
4717             default: abort();
4718             }
4719         }
4720     }
4721 }
4722
4723 static inline void gen_neon_widen(TCGv_i64 dest, TCGv_i32 src, int size, int u)
4724 {
4725     if (u) {
4726         switch (size) {
4727         case 0: gen_helper_neon_widen_u8(dest, src); break;
4728         case 1: gen_helper_neon_widen_u16(dest, src); break;
4729         case 2: tcg_gen_extu_i32_i64(dest, src); break;
4730         default: abort();
4731         }
4732     } else {
4733         switch (size) {
4734         case 0: gen_helper_neon_widen_s8(dest, src); break;
4735         case 1: gen_helper_neon_widen_s16(dest, src); break;
4736         case 2: tcg_gen_ext_i32_i64(dest, src); break;
4737         default: abort();
4738         }
4739     }
4740     tcg_temp_free_i32(src);
4741 }
4742
4743 static inline void gen_neon_addl(int size)
4744 {
4745     switch (size) {
4746     case 0: gen_helper_neon_addl_u16(CPU_V001); break;
4747     case 1: gen_helper_neon_addl_u32(CPU_V001); break;
4748     case 2: tcg_gen_add_i64(CPU_V001); break;
4749     default: abort();
4750     }
4751 }
4752
4753 static inline void gen_neon_subl(int size)
4754 {
4755     switch (size) {
4756     case 0: gen_helper_neon_subl_u16(CPU_V001); break;
4757     case 1: gen_helper_neon_subl_u32(CPU_V001); break;
4758     case 2: tcg_gen_sub_i64(CPU_V001); break;
4759     default: abort();
4760     }
4761 }
4762
4763 static inline void gen_neon_negl(TCGv_i64 var, int size)
4764 {
4765     switch (size) {
4766     case 0: gen_helper_neon_negl_u16(var, var); break;
4767     case 1: gen_helper_neon_negl_u32(var, var); break;
4768     case 2:
4769         tcg_gen_neg_i64(var, var);
4770         break;
4771     default: abort();
4772     }
4773 }
4774
4775 static inline void gen_neon_addl_saturate(TCGv_i64 op0, TCGv_i64 op1, int size)
4776 {
4777     switch (size) {
4778     case 1: gen_helper_neon_addl_saturate_s32(op0, cpu_env, op0, op1); break;
4779     case 2: gen_helper_neon_addl_saturate_s64(op0, cpu_env, op0, op1); break;
4780     default: abort();
4781     }
4782 }
4783
4784 static inline void gen_neon_mull(TCGv_i64 dest, TCGv_i32 a, TCGv_i32 b,
4785                                  int size, int u)
4786 {
4787     TCGv_i64 tmp;
4788
4789     switch ((size << 1) | u) {
4790     case 0: gen_helper_neon_mull_s8(dest, a, b); break;
4791     case 1: gen_helper_neon_mull_u8(dest, a, b); break;
4792     case 2: gen_helper_neon_mull_s16(dest, a, b); break;
4793     case 3: gen_helper_neon_mull_u16(dest, a, b); break;
4794     case 4:
4795         tmp = gen_muls_i64_i32(a, b);
4796         tcg_gen_mov_i64(dest, tmp);
4797         tcg_temp_free_i64(tmp);
4798         break;
4799     case 5:
4800         tmp = gen_mulu_i64_i32(a, b);
4801         tcg_gen_mov_i64(dest, tmp);
4802         tcg_temp_free_i64(tmp);
4803         break;
4804     default: abort();
4805     }
4806
4807     /* gen_helper_neon_mull_[su]{8|16} do not free their parameters.
4808        Don't forget to clean them now.  */
4809     if (size < 2) {
4810         tcg_temp_free_i32(a);
4811         tcg_temp_free_i32(b);
4812     }
4813 }
4814
4815 static void gen_neon_narrow_op(int op, int u, int size,
4816                                TCGv_i32 dest, TCGv_i64 src)
4817 {
4818     if (op) {
4819         if (u) {
4820             gen_neon_unarrow_sats(size, dest, src);
4821         } else {
4822             gen_neon_narrow(size, dest, src);
4823         }
4824     } else {
4825         if (u) {
4826             gen_neon_narrow_satu(size, dest, src);
4827         } else {
4828             gen_neon_narrow_sats(size, dest, src);
4829         }
4830     }
4831 }
4832
4833 /* Symbolic constants for op fields for Neon 3-register same-length.
4834  * The values correspond to bits [11:8,4]; see the ARM ARM DDI0406B
4835  * table A7-9.
4836  */
4837 #define NEON_3R_VHADD 0
4838 #define NEON_3R_VQADD 1
4839 #define NEON_3R_VRHADD 2
4840 #define NEON_3R_LOGIC 3 /* VAND,VBIC,VORR,VMOV,VORN,VEOR,VBIF,VBIT,VBSL */
4841 #define NEON_3R_VHSUB 4
4842 #define NEON_3R_VQSUB 5
4843 #define NEON_3R_VCGT 6
4844 #define NEON_3R_VCGE 7
4845 #define NEON_3R_VSHL 8
4846 #define NEON_3R_VQSHL 9
4847 #define NEON_3R_VRSHL 10
4848 #define NEON_3R_VQRSHL 11
4849 #define NEON_3R_VMAX 12
4850 #define NEON_3R_VMIN 13
4851 #define NEON_3R_VABD 14
4852 #define NEON_3R_VABA 15
4853 #define NEON_3R_VADD_VSUB 16
4854 #define NEON_3R_VTST_VCEQ 17
4855 #define NEON_3R_VML 18 /* VMLA, VMLAL, VMLS, VMLSL */
4856 #define NEON_3R_VMUL 19
4857 #define NEON_3R_VPMAX 20
4858 #define NEON_3R_VPMIN 21
4859 #define NEON_3R_VQDMULH_VQRDMULH 22
4860 #define NEON_3R_VPADD 23
4861 #define NEON_3R_SHA 24 /* SHA1C,SHA1P,SHA1M,SHA1SU0,SHA256H{2},SHA256SU1 */
4862 #define NEON_3R_VFM 25 /* VFMA, VFMS : float fused multiply-add */
4863 #define NEON_3R_FLOAT_ARITH 26 /* float VADD, VSUB, VPADD, VABD */
4864 #define NEON_3R_FLOAT_MULTIPLY 27 /* float VMLA, VMLS, VMUL */
4865 #define NEON_3R_FLOAT_CMP 28 /* float VCEQ, VCGE, VCGT */
4866 #define NEON_3R_FLOAT_ACMP 29 /* float VACGE, VACGT, VACLE, VACLT */
4867 #define NEON_3R_FLOAT_MINMAX 30 /* float VMIN, VMAX */
4868 #define NEON_3R_FLOAT_MISC 31 /* float VRECPS, VRSQRTS, VMAXNM/MINNM */
4869
4870 static const uint8_t neon_3r_sizes[] = {
4871     [NEON_3R_VHADD] = 0x7,
4872     [NEON_3R_VQADD] = 0xf,
4873     [NEON_3R_VRHADD] = 0x7,
4874     [NEON_3R_LOGIC] = 0xf, /* size field encodes op type */
4875     [NEON_3R_VHSUB] = 0x7,
4876     [NEON_3R_VQSUB] = 0xf,
4877     [NEON_3R_VCGT] = 0x7,
4878     [NEON_3R_VCGE] = 0x7,
4879     [NEON_3R_VSHL] = 0xf,
4880     [NEON_3R_VQSHL] = 0xf,
4881     [NEON_3R_VRSHL] = 0xf,
4882     [NEON_3R_VQRSHL] = 0xf,
4883     [NEON_3R_VMAX] = 0x7,
4884     [NEON_3R_VMIN] = 0x7,
4885     [NEON_3R_VABD] = 0x7,
4886     [NEON_3R_VABA] = 0x7,
4887     [NEON_3R_VADD_VSUB] = 0xf,
4888     [NEON_3R_VTST_VCEQ] = 0x7,
4889     [NEON_3R_VML] = 0x7,
4890     [NEON_3R_VMUL] = 0x7,
4891     [NEON_3R_VPMAX] = 0x7,
4892     [NEON_3R_VPMIN] = 0x7,
4893     [NEON_3R_VQDMULH_VQRDMULH] = 0x6,
4894     [NEON_3R_VPADD] = 0x7,
4895     [NEON_3R_SHA] = 0xf, /* size field encodes op type */
4896     [NEON_3R_VFM] = 0x5, /* size bit 1 encodes op */
4897     [NEON_3R_FLOAT_ARITH] = 0x5, /* size bit 1 encodes op */
4898     [NEON_3R_FLOAT_MULTIPLY] = 0x5, /* size bit 1 encodes op */
4899     [NEON_3R_FLOAT_CMP] = 0x5, /* size bit 1 encodes op */
4900     [NEON_3R_FLOAT_ACMP] = 0x5, /* size bit 1 encodes op */
4901     [NEON_3R_FLOAT_MINMAX] = 0x5, /* size bit 1 encodes op */
4902     [NEON_3R_FLOAT_MISC] = 0x5, /* size bit 1 encodes op */
4903 };
4904
4905 /* Symbolic constants for op fields for Neon 2-register miscellaneous.
4906  * The values correspond to bits [17:16,10:7]; see the ARM ARM DDI0406B
4907  * table A7-13.
4908  */
4909 #define NEON_2RM_VREV64 0
4910 #define NEON_2RM_VREV32 1
4911 #define NEON_2RM_VREV16 2
4912 #define NEON_2RM_VPADDL 4
4913 #define NEON_2RM_VPADDL_U 5
4914 #define NEON_2RM_AESE 6 /* Includes AESD */
4915 #define NEON_2RM_AESMC 7 /* Includes AESIMC */
4916 #define NEON_2RM_VCLS 8
4917 #define NEON_2RM_VCLZ 9
4918 #define NEON_2RM_VCNT 10
4919 #define NEON_2RM_VMVN 11
4920 #define NEON_2RM_VPADAL 12
4921 #define NEON_2RM_VPADAL_U 13
4922 #define NEON_2RM_VQABS 14
4923 #define NEON_2RM_VQNEG 15
4924 #define NEON_2RM_VCGT0 16
4925 #define NEON_2RM_VCGE0 17
4926 #define NEON_2RM_VCEQ0 18
4927 #define NEON_2RM_VCLE0 19
4928 #define NEON_2RM_VCLT0 20
4929 #define NEON_2RM_SHA1H 21
4930 #define NEON_2RM_VABS 22
4931 #define NEON_2RM_VNEG 23
4932 #define NEON_2RM_VCGT0_F 24
4933 #define NEON_2RM_VCGE0_F 25
4934 #define NEON_2RM_VCEQ0_F 26
4935 #define NEON_2RM_VCLE0_F 27
4936 #define NEON_2RM_VCLT0_F 28
4937 #define NEON_2RM_VABS_F 30
4938 #define NEON_2RM_VNEG_F 31
4939 #define NEON_2RM_VSWP 32
4940 #define NEON_2RM_VTRN 33
4941 #define NEON_2RM_VUZP 34
4942 #define NEON_2RM_VZIP 35
4943 #define NEON_2RM_VMOVN 36 /* Includes VQMOVN, VQMOVUN */
4944 #define NEON_2RM_VQMOVN 37 /* Includes VQMOVUN */
4945 #define NEON_2RM_VSHLL 38
4946 #define NEON_2RM_SHA1SU1 39 /* Includes SHA256SU0 */
4947 #define NEON_2RM_VRINTN 40
4948 #define NEON_2RM_VRINTX 41
4949 #define NEON_2RM_VRINTA 42
4950 #define NEON_2RM_VRINTZ 43
4951 #define NEON_2RM_VCVT_F16_F32 44
4952 #define NEON_2RM_VRINTM 45
4953 #define NEON_2RM_VCVT_F32_F16 46
4954 #define NEON_2RM_VRINTP 47
4955 #define NEON_2RM_VCVTAU 48
4956 #define NEON_2RM_VCVTAS 49
4957 #define NEON_2RM_VCVTNU 50
4958 #define NEON_2RM_VCVTNS 51
4959 #define NEON_2RM_VCVTPU 52
4960 #define NEON_2RM_VCVTPS 53
4961 #define NEON_2RM_VCVTMU 54
4962 #define NEON_2RM_VCVTMS 55
4963 #define NEON_2RM_VRECPE 56
4964 #define NEON_2RM_VRSQRTE 57
4965 #define NEON_2RM_VRECPE_F 58
4966 #define NEON_2RM_VRSQRTE_F 59
4967 #define NEON_2RM_VCVT_FS 60
4968 #define NEON_2RM_VCVT_FU 61
4969 #define NEON_2RM_VCVT_SF 62
4970 #define NEON_2RM_VCVT_UF 63
4971
4972 static int neon_2rm_is_float_op(int op)
4973 {
4974     /* Return true if this neon 2reg-misc op is float-to-float */
4975     return (op == NEON_2RM_VABS_F || op == NEON_2RM_VNEG_F ||
4976             (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
4977             op == NEON_2RM_VRINTM ||
4978             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
4979             op >= NEON_2RM_VRECPE_F);
4980 }
4981
4982 /* Each entry in this array has bit n set if the insn allows
4983  * size value n (otherwise it will UNDEF). Since unallocated
4984  * op values will have no bits set they always UNDEF.
4985  */
4986 static const uint8_t neon_2rm_sizes[] = {
4987     [NEON_2RM_VREV64] = 0x7,
4988     [NEON_2RM_VREV32] = 0x3,
4989     [NEON_2RM_VREV16] = 0x1,
4990     [NEON_2RM_VPADDL] = 0x7,
4991     [NEON_2RM_VPADDL_U] = 0x7,
4992     [NEON_2RM_AESE] = 0x1,
4993     [NEON_2RM_AESMC] = 0x1,
4994     [NEON_2RM_VCLS] = 0x7,
4995     [NEON_2RM_VCLZ] = 0x7,
4996     [NEON_2RM_VCNT] = 0x1,
4997     [NEON_2RM_VMVN] = 0x1,
4998     [NEON_2RM_VPADAL] = 0x7,
4999     [NEON_2RM_VPADAL_U] = 0x7,
5000     [NEON_2RM_VQABS] = 0x7,
5001     [NEON_2RM_VQNEG] = 0x7,
5002     [NEON_2RM_VCGT0] = 0x7,
5003     [NEON_2RM_VCGE0] = 0x7,
5004     [NEON_2RM_VCEQ0] = 0x7,
5005     [NEON_2RM_VCLE0] = 0x7,
5006     [NEON_2RM_VCLT0] = 0x7,
5007     [NEON_2RM_SHA1H] = 0x4,
5008     [NEON_2RM_VABS] = 0x7,
5009     [NEON_2RM_VNEG] = 0x7,
5010     [NEON_2RM_VCGT0_F] = 0x4,
5011     [NEON_2RM_VCGE0_F] = 0x4,
5012     [NEON_2RM_VCEQ0_F] = 0x4,
5013     [NEON_2RM_VCLE0_F] = 0x4,
5014     [NEON_2RM_VCLT0_F] = 0x4,
5015     [NEON_2RM_VABS_F] = 0x4,
5016     [NEON_2RM_VNEG_F] = 0x4,
5017     [NEON_2RM_VSWP] = 0x1,
5018     [NEON_2RM_VTRN] = 0x7,
5019     [NEON_2RM_VUZP] = 0x7,
5020     [NEON_2RM_VZIP] = 0x7,
5021     [NEON_2RM_VMOVN] = 0x7,
5022     [NEON_2RM_VQMOVN] = 0x7,
5023     [NEON_2RM_VSHLL] = 0x7,
5024     [NEON_2RM_SHA1SU1] = 0x4,
5025     [NEON_2RM_VRINTN] = 0x4,
5026     [NEON_2RM_VRINTX] = 0x4,
5027     [NEON_2RM_VRINTA] = 0x4,
5028     [NEON_2RM_VRINTZ] = 0x4,
5029     [NEON_2RM_VCVT_F16_F32] = 0x2,
5030     [NEON_2RM_VRINTM] = 0x4,
5031     [NEON_2RM_VCVT_F32_F16] = 0x2,
5032     [NEON_2RM_VRINTP] = 0x4,
5033     [NEON_2RM_VCVTAU] = 0x4,
5034     [NEON_2RM_VCVTAS] = 0x4,
5035     [NEON_2RM_VCVTNU] = 0x4,
5036     [NEON_2RM_VCVTNS] = 0x4,
5037     [NEON_2RM_VCVTPU] = 0x4,
5038     [NEON_2RM_VCVTPS] = 0x4,
5039     [NEON_2RM_VCVTMU] = 0x4,
5040     [NEON_2RM_VCVTMS] = 0x4,
5041     [NEON_2RM_VRECPE] = 0x4,
5042     [NEON_2RM_VRSQRTE] = 0x4,
5043     [NEON_2RM_VRECPE_F] = 0x4,
5044     [NEON_2RM_VRSQRTE_F] = 0x4,
5045     [NEON_2RM_VCVT_FS] = 0x4,
5046     [NEON_2RM_VCVT_FU] = 0x4,
5047     [NEON_2RM_VCVT_SF] = 0x4,
5048     [NEON_2RM_VCVT_UF] = 0x4,
5049 };
5050
5051 /* Translate a NEON data processing instruction.  Return nonzero if the
5052    instruction is invalid.
5053    We process data in a mixture of 32-bit and 64-bit chunks.
5054    Mostly we use 32-bit chunks so we can use normal scalar instructions.  */
5055
5056 static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
5057 {
5058     int op;
5059     int q;
5060     int rd, rn, rm;
5061     int size;
5062     int shift;
5063     int pass;
5064     int count;
5065     int pairwise;
5066     int u;
5067     uint32_t imm, mask;
5068     TCGv_i32 tmp, tmp2, tmp3, tmp4, tmp5;
5069     TCGv_i64 tmp64;
5070
5071     /* FIXME: this access check should not take precedence over UNDEF
5072      * for invalid encodings; we will generate incorrect syndrome information
5073      * for attempts to execute invalid vfp/neon encodings with FP disabled.
5074      */
5075     if (!s->cpacr_fpen) {
5076         gen_exception_insn(s, 4, EXCP_UDEF,
5077                            syn_fp_access_trap(1, 0xe, s->thumb));
5078         return 0;
5079     }
5080
5081     if (!s->vfp_enabled)
5082       return 1;
5083     q = (insn & (1 << 6)) != 0;
5084     u = (insn >> 24) & 1;
5085     VFP_DREG_D(rd, insn);
5086     VFP_DREG_N(rn, insn);
5087     VFP_DREG_M(rm, insn);
5088     size = (insn >> 20) & 3;
5089     if ((insn & (1 << 23)) == 0) {
5090         /* Three register same length.  */
5091         op = ((insn >> 7) & 0x1e) | ((insn >> 4) & 1);
5092         /* Catch invalid op and bad size combinations: UNDEF */
5093         if ((neon_3r_sizes[op] & (1 << size)) == 0) {
5094             return 1;
5095         }
5096         /* All insns of this form UNDEF for either this condition or the
5097          * superset of cases "Q==1"; we catch the latter later.
5098          */
5099         if (q && ((rd | rn | rm) & 1)) {
5100             return 1;
5101         }
5102         /*
5103          * The SHA-1/SHA-256 3-register instructions require special treatment
5104          * here, as their size field is overloaded as an op type selector, and
5105          * they all consume their input in a single pass.
5106          */
5107         if (op == NEON_3R_SHA) {
5108             if (!q) {
5109                 return 1;
5110             }
5111             if (!u) { /* SHA-1 */
5112                 if (!arm_dc_feature(s, ARM_FEATURE_V8_SHA1)) {
5113                     return 1;
5114                 }
5115                 tmp = tcg_const_i32(rd);
5116                 tmp2 = tcg_const_i32(rn);
5117                 tmp3 = tcg_const_i32(rm);
5118                 tmp4 = tcg_const_i32(size);
5119                 gen_helper_crypto_sha1_3reg(cpu_env, tmp, tmp2, tmp3, tmp4);
5120                 tcg_temp_free_i32(tmp4);
5121             } else { /* SHA-256 */
5122                 if (!arm_dc_feature(s, ARM_FEATURE_V8_SHA256) || size == 3) {
5123                     return 1;
5124                 }
5125                 tmp = tcg_const_i32(rd);
5126                 tmp2 = tcg_const_i32(rn);
5127                 tmp3 = tcg_const_i32(rm);
5128                 switch (size) {
5129                 case 0:
5130                     gen_helper_crypto_sha256h(cpu_env, tmp, tmp2, tmp3);
5131                     break;
5132                 case 1:
5133                     gen_helper_crypto_sha256h2(cpu_env, tmp, tmp2, tmp3);
5134                     break;
5135                 case 2:
5136                     gen_helper_crypto_sha256su1(cpu_env, tmp, tmp2, tmp3);
5137                     break;
5138                 }
5139             }
5140             tcg_temp_free_i32(tmp);
5141             tcg_temp_free_i32(tmp2);
5142             tcg_temp_free_i32(tmp3);
5143             return 0;
5144         }
5145         if (size == 3 && op != NEON_3R_LOGIC) {
5146             /* 64-bit element instructions. */
5147             for (pass = 0; pass < (q ? 2 : 1); pass++) {
5148                 neon_load_reg64(cpu_V0, rn + pass);
5149                 neon_load_reg64(cpu_V1, rm + pass);
5150                 switch (op) {
5151                 case NEON_3R_VQADD:
5152                     if (u) {
5153                         gen_helper_neon_qadd_u64(cpu_V0, cpu_env,
5154                                                  cpu_V0, cpu_V1);
5155                     } else {
5156                         gen_helper_neon_qadd_s64(cpu_V0, cpu_env,
5157                                                  cpu_V0, cpu_V1);
5158                     }
5159                     break;
5160                 case NEON_3R_VQSUB:
5161                     if (u) {
5162                         gen_helper_neon_qsub_u64(cpu_V0, cpu_env,
5163                                                  cpu_V0, cpu_V1);
5164                     } else {
5165                         gen_helper_neon_qsub_s64(cpu_V0, cpu_env,
5166                                                  cpu_V0, cpu_V1);
5167                     }
5168                     break;
5169                 case NEON_3R_VSHL:
5170                     if (u) {
5171                         gen_helper_neon_shl_u64(cpu_V0, cpu_V1, cpu_V0);
5172                     } else {
5173                         gen_helper_neon_shl_s64(cpu_V0, cpu_V1, cpu_V0);
5174                     }
5175                     break;
5176                 case NEON_3R_VQSHL:
5177                     if (u) {
5178                         gen_helper_neon_qshl_u64(cpu_V0, cpu_env,
5179                                                  cpu_V1, cpu_V0);
5180                     } else {
5181                         gen_helper_neon_qshl_s64(cpu_V0, cpu_env,
5182                                                  cpu_V1, cpu_V0);
5183                     }
5184                     break;
5185                 case NEON_3R_VRSHL:
5186                     if (u) {
5187                         gen_helper_neon_rshl_u64(cpu_V0, cpu_V1, cpu_V0);
5188                     } else {
5189                         gen_helper_neon_rshl_s64(cpu_V0, cpu_V1, cpu_V0);
5190                     }
5191                     break;
5192                 case NEON_3R_VQRSHL:
5193                     if (u) {
5194                         gen_helper_neon_qrshl_u64(cpu_V0, cpu_env,
5195                                                   cpu_V1, cpu_V0);
5196                     } else {
5197                         gen_helper_neon_qrshl_s64(cpu_V0, cpu_env,
5198                                                   cpu_V1, cpu_V0);
5199                     }
5200                     break;
5201                 case NEON_3R_VADD_VSUB:
5202                     if (u) {
5203                         tcg_gen_sub_i64(CPU_V001);
5204                     } else {
5205                         tcg_gen_add_i64(CPU_V001);
5206                     }
5207                     break;
5208                 default:
5209                     abort();
5210                 }
5211                 neon_store_reg64(cpu_V0, rd + pass);
5212             }
5213             return 0;
5214         }
5215         pairwise = 0;
5216         switch (op) {
5217         case NEON_3R_VSHL:
5218         case NEON_3R_VQSHL:
5219         case NEON_3R_VRSHL:
5220         case NEON_3R_VQRSHL:
5221             {
5222                 int rtmp;
5223                 /* Shift instruction operands are reversed.  */
5224                 rtmp = rn;
5225                 rn = rm;
5226                 rm = rtmp;
5227             }
5228             break;
5229         case NEON_3R_VPADD:
5230             if (u) {
5231                 return 1;
5232             }
5233             /* Fall through */
5234         case NEON_3R_VPMAX:
5235         case NEON_3R_VPMIN:
5236             pairwise = 1;
5237             break;
5238         case NEON_3R_FLOAT_ARITH:
5239             pairwise = (u && size < 2); /* if VPADD (float) */
5240             break;
5241         case NEON_3R_FLOAT_MINMAX:
5242             pairwise = u; /* if VPMIN/VPMAX (float) */
5243             break;
5244         case NEON_3R_FLOAT_CMP:
5245             if (!u && size) {
5246                 /* no encoding for U=0 C=1x */
5247                 return 1;
5248             }
5249             break;
5250         case NEON_3R_FLOAT_ACMP:
5251             if (!u) {
5252                 return 1;
5253             }
5254             break;
5255         case NEON_3R_FLOAT_MISC:
5256             /* VMAXNM/VMINNM in ARMv8 */
5257             if (u && !arm_dc_feature(s, ARM_FEATURE_V8)) {
5258                 return 1;
5259             }
5260             break;
5261         case NEON_3R_VMUL:
5262             if (u && (size != 0)) {
5263                 /* UNDEF on invalid size for polynomial subcase */
5264                 return 1;
5265             }
5266             break;
5267         case NEON_3R_VFM:
5268             if (!arm_dc_feature(s, ARM_FEATURE_VFP4) || u) {
5269                 return 1;
5270             }
5271             break;
5272         default:
5273             break;
5274         }
5275
5276         if (pairwise && q) {
5277             /* All the pairwise insns UNDEF if Q is set */
5278             return 1;
5279         }
5280
5281         for (pass = 0; pass < (q ? 4 : 2); pass++) {
5282
5283         if (pairwise) {
5284             /* Pairwise.  */
5285             if (pass < 1) {
5286                 tmp = neon_load_reg(rn, 0);
5287                 tmp2 = neon_load_reg(rn, 1);
5288             } else {
5289                 tmp = neon_load_reg(rm, 0);
5290                 tmp2 = neon_load_reg(rm, 1);
5291             }
5292         } else {
5293             /* Elementwise.  */
5294             tmp = neon_load_reg(rn, pass);
5295             tmp2 = neon_load_reg(rm, pass);
5296         }
5297         switch (op) {
5298         case NEON_3R_VHADD:
5299             GEN_NEON_INTEGER_OP(hadd);
5300             break;
5301         case NEON_3R_VQADD:
5302             GEN_NEON_INTEGER_OP_ENV(qadd);
5303             break;
5304         case NEON_3R_VRHADD:
5305             GEN_NEON_INTEGER_OP(rhadd);
5306             break;
5307         case NEON_3R_LOGIC: /* Logic ops.  */
5308             switch ((u << 2) | size) {
5309             case 0: /* VAND */
5310                 tcg_gen_and_i32(tmp, tmp, tmp2);
5311                 break;
5312             case 1: /* BIC */
5313                 tcg_gen_andc_i32(tmp, tmp, tmp2);
5314                 break;
5315             case 2: /* VORR */
5316                 tcg_gen_or_i32(tmp, tmp, tmp2);
5317                 break;
5318             case 3: /* VORN */
5319                 tcg_gen_orc_i32(tmp, tmp, tmp2);
5320                 break;
5321             case 4: /* VEOR */
5322                 tcg_gen_xor_i32(tmp, tmp, tmp2);
5323                 break;
5324             case 5: /* VBSL */
5325                 tmp3 = neon_load_reg(rd, pass);
5326                 gen_neon_bsl(tmp, tmp, tmp2, tmp3);
5327                 tcg_temp_free_i32(tmp3);
5328                 break;
5329             case 6: /* VBIT */
5330                 tmp3 = neon_load_reg(rd, pass);
5331                 gen_neon_bsl(tmp, tmp, tmp3, tmp2);
5332                 tcg_temp_free_i32(tmp3);
5333                 break;
5334             case 7: /* VBIF */
5335                 tmp3 = neon_load_reg(rd, pass);
5336                 gen_neon_bsl(tmp, tmp3, tmp, tmp2);
5337                 tcg_temp_free_i32(tmp3);
5338                 break;
5339             }
5340             break;
5341         case NEON_3R_VHSUB:
5342             GEN_NEON_INTEGER_OP(hsub);
5343             break;
5344         case NEON_3R_VQSUB:
5345             GEN_NEON_INTEGER_OP_ENV(qsub);
5346             break;
5347         case NEON_3R_VCGT:
5348             GEN_NEON_INTEGER_OP(cgt);
5349             break;
5350         case NEON_3R_VCGE:
5351             GEN_NEON_INTEGER_OP(cge);
5352             break;
5353         case NEON_3R_VSHL:
5354             GEN_NEON_INTEGER_OP(shl);
5355             break;
5356         case NEON_3R_VQSHL:
5357             GEN_NEON_INTEGER_OP_ENV(qshl);
5358             break;
5359         case NEON_3R_VRSHL:
5360             GEN_NEON_INTEGER_OP(rshl);
5361             break;
5362         case NEON_3R_VQRSHL:
5363             GEN_NEON_INTEGER_OP_ENV(qrshl);
5364             break;
5365         case NEON_3R_VMAX:
5366             GEN_NEON_INTEGER_OP(max);
5367             break;
5368         case NEON_3R_VMIN:
5369             GEN_NEON_INTEGER_OP(min);
5370             break;
5371         case NEON_3R_VABD:
5372             GEN_NEON_INTEGER_OP(abd);
5373             break;
5374         case NEON_3R_VABA:
5375             GEN_NEON_INTEGER_OP(abd);
5376             tcg_temp_free_i32(tmp2);
5377             tmp2 = neon_load_reg(rd, pass);
5378             gen_neon_add(size, tmp, tmp2);
5379             break;
5380         case NEON_3R_VADD_VSUB:
5381             if (!u) { /* VADD */
5382                 gen_neon_add(size, tmp, tmp2);
5383             } else { /* VSUB */
5384                 switch (size) {
5385                 case 0: gen_helper_neon_sub_u8(tmp, tmp, tmp2); break;
5386                 case 1: gen_helper_neon_sub_u16(tmp, tmp, tmp2); break;
5387                 case 2: tcg_gen_sub_i32(tmp, tmp, tmp2); break;
5388                 default: abort();
5389                 }
5390             }
5391             break;
5392         case NEON_3R_VTST_VCEQ:
5393             if (!u) { /* VTST */
5394                 switch (size) {
5395                 case 0: gen_helper_neon_tst_u8(tmp, tmp, tmp2); break;
5396                 case 1: gen_helper_neon_tst_u16(tmp, tmp, tmp2); break;
5397                 case 2: gen_helper_neon_tst_u32(tmp, tmp, tmp2); break;
5398                 default: abort();
5399                 }
5400             } else { /* VCEQ */
5401                 switch (size) {
5402                 case 0: gen_helper_neon_ceq_u8(tmp, tmp, tmp2); break;
5403                 case 1: gen_helper_neon_ceq_u16(tmp, tmp, tmp2); break;
5404                 case 2: gen_helper_neon_ceq_u32(tmp, tmp, tmp2); break;
5405                 default: abort();
5406                 }
5407             }
5408             break;
5409         case NEON_3R_VML: /* VMLA, VMLAL, VMLS,VMLSL */
5410             switch (size) {
5411             case 0: gen_helper_neon_mul_u8(tmp, tmp, tmp2); break;
5412             case 1: gen_helper_neon_mul_u16(tmp, tmp, tmp2); break;
5413             case 2: tcg_gen_mul_i32(tmp, tmp, tmp2); break;
5414             default: abort();
5415             }
5416             tcg_temp_free_i32(tmp2);
5417             tmp2 = neon_load_reg(rd, pass);
5418             if (u) { /* VMLS */
5419                 gen_neon_rsb(size, tmp, tmp2);
5420             } else { /* VMLA */
5421                 gen_neon_add(size, tmp, tmp2);
5422             }
5423             break;
5424         case NEON_3R_VMUL:
5425             if (u) { /* polynomial */
5426                 gen_helper_neon_mul_p8(tmp, tmp, tmp2);
5427             } else { /* Integer */
5428                 switch (size) {
5429                 case 0: gen_helper_neon_mul_u8(tmp, tmp, tmp2); break;
5430                 case 1: gen_helper_neon_mul_u16(tmp, tmp, tmp2); break;
5431                 case 2: tcg_gen_mul_i32(tmp, tmp, tmp2); break;
5432                 default: abort();
5433                 }
5434             }
5435             break;
5436         case NEON_3R_VPMAX:
5437             GEN_NEON_INTEGER_OP(pmax);
5438             break;
5439         case NEON_3R_VPMIN:
5440             GEN_NEON_INTEGER_OP(pmin);
5441             break;
5442         case NEON_3R_VQDMULH_VQRDMULH: /* Multiply high.  */
5443             if (!u) { /* VQDMULH */
5444                 switch (size) {
5445                 case 1:
5446                     gen_helper_neon_qdmulh_s16(tmp, cpu_env, tmp, tmp2);
5447                     break;
5448                 case 2:
5449                     gen_helper_neon_qdmulh_s32(tmp, cpu_env, tmp, tmp2);
5450                     break;
5451                 default: abort();
5452                 }
5453             } else { /* VQRDMULH */
5454                 switch (size) {
5455                 case 1:
5456                     gen_helper_neon_qrdmulh_s16(tmp, cpu_env, tmp, tmp2);
5457                     break;
5458                 case 2:
5459                     gen_helper_neon_qrdmulh_s32(tmp, cpu_env, tmp, tmp2);
5460                     break;
5461                 default: abort();
5462                 }
5463             }
5464             break;
5465         case NEON_3R_VPADD:
5466             switch (size) {
5467             case 0: gen_helper_neon_padd_u8(tmp, tmp, tmp2); break;
5468             case 1: gen_helper_neon_padd_u16(tmp, tmp, tmp2); break;
5469             case 2: tcg_gen_add_i32(tmp, tmp, tmp2); break;
5470             default: abort();
5471             }
5472             break;
5473         case NEON_3R_FLOAT_ARITH: /* Floating point arithmetic. */
5474         {
5475             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5476             switch ((u << 2) | size) {
5477             case 0: /* VADD */
5478             case 4: /* VPADD */
5479                 gen_helper_vfp_adds(tmp, tmp, tmp2, fpstatus);
5480                 break;
5481             case 2: /* VSUB */
5482                 gen_helper_vfp_subs(tmp, tmp, tmp2, fpstatus);
5483                 break;
5484             case 6: /* VABD */
5485                 gen_helper_neon_abd_f32(tmp, tmp, tmp2, fpstatus);
5486                 break;
5487             default:
5488                 abort();
5489             }
5490             tcg_temp_free_ptr(fpstatus);
5491             break;
5492         }
5493         case NEON_3R_FLOAT_MULTIPLY:
5494         {
5495             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5496             gen_helper_vfp_muls(tmp, tmp, tmp2, fpstatus);
5497             if (!u) {
5498                 tcg_temp_free_i32(tmp2);
5499                 tmp2 = neon_load_reg(rd, pass);
5500                 if (size == 0) {
5501                     gen_helper_vfp_adds(tmp, tmp, tmp2, fpstatus);
5502                 } else {
5503                     gen_helper_vfp_subs(tmp, tmp2, tmp, fpstatus);
5504                 }
5505             }
5506             tcg_temp_free_ptr(fpstatus);
5507             break;
5508         }
5509         case NEON_3R_FLOAT_CMP:
5510         {
5511             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5512             if (!u) {
5513                 gen_helper_neon_ceq_f32(tmp, tmp, tmp2, fpstatus);
5514             } else {
5515                 if (size == 0) {
5516                     gen_helper_neon_cge_f32(tmp, tmp, tmp2, fpstatus);
5517                 } else {
5518                     gen_helper_neon_cgt_f32(tmp, tmp, tmp2, fpstatus);
5519                 }
5520             }
5521             tcg_temp_free_ptr(fpstatus);
5522             break;
5523         }
5524         case NEON_3R_FLOAT_ACMP:
5525         {
5526             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5527             if (size == 0) {
5528                 gen_helper_neon_acge_f32(tmp, tmp, tmp2, fpstatus);
5529             } else {
5530                 gen_helper_neon_acgt_f32(tmp, tmp, tmp2, fpstatus);
5531             }
5532             tcg_temp_free_ptr(fpstatus);
5533             break;
5534         }
5535         case NEON_3R_FLOAT_MINMAX:
5536         {
5537             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5538             if (size == 0) {
5539                 gen_helper_vfp_maxs(tmp, tmp, tmp2, fpstatus);
5540             } else {
5541                 gen_helper_vfp_mins(tmp, tmp, tmp2, fpstatus);
5542             }
5543             tcg_temp_free_ptr(fpstatus);
5544             break;
5545         }
5546         case NEON_3R_FLOAT_MISC:
5547             if (u) {
5548                 /* VMAXNM/VMINNM */
5549                 TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5550                 if (size == 0) {
5551                     gen_helper_vfp_maxnums(tmp, tmp, tmp2, fpstatus);
5552                 } else {
5553                     gen_helper_vfp_minnums(tmp, tmp, tmp2, fpstatus);
5554                 }
5555                 tcg_temp_free_ptr(fpstatus);
5556             } else {
5557                 if (size == 0) {
5558                     gen_helper_recps_f32(tmp, tmp, tmp2, cpu_env);
5559                 } else {
5560                     gen_helper_rsqrts_f32(tmp, tmp, tmp2, cpu_env);
5561               }
5562             }
5563             break;
5564         case NEON_3R_VFM:
5565         {
5566             /* VFMA, VFMS: fused multiply-add */
5567             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5568             TCGv_i32 tmp3 = neon_load_reg(rd, pass);
5569             if (size) {
5570                 /* VFMS */
5571                 gen_helper_vfp_negs(tmp, tmp);
5572             }
5573             gen_helper_vfp_muladds(tmp, tmp, tmp2, tmp3, fpstatus);
5574             tcg_temp_free_i32(tmp3);
5575             tcg_temp_free_ptr(fpstatus);
5576             break;
5577         }
5578         default:
5579             abort();
5580         }
5581         tcg_temp_free_i32(tmp2);
5582
5583         /* Save the result.  For elementwise operations we can put it
5584            straight into the destination register.  For pairwise operations
5585            we have to be careful to avoid clobbering the source operands.  */
5586         if (pairwise && rd == rm) {
5587             neon_store_scratch(pass, tmp);
5588         } else {
5589             neon_store_reg(rd, pass, tmp);
5590         }
5591
5592         } /* for pass */
5593         if (pairwise && rd == rm) {
5594             for (pass = 0; pass < (q ? 4 : 2); pass++) {
5595                 tmp = neon_load_scratch(pass);
5596                 neon_store_reg(rd, pass, tmp);
5597             }
5598         }
5599         /* End of 3 register same size operations.  */
5600     } else if (insn & (1 << 4)) {
5601         if ((insn & 0x00380080) != 0) {
5602             /* Two registers and shift.  */
5603             op = (insn >> 8) & 0xf;
5604             if (insn & (1 << 7)) {
5605                 /* 64-bit shift. */
5606                 if (op > 7) {
5607                     return 1;
5608                 }
5609                 size = 3;
5610             } else {
5611                 size = 2;
5612                 while ((insn & (1 << (size + 19))) == 0)
5613                     size--;
5614             }
5615             shift = (insn >> 16) & ((1 << (3 + size)) - 1);
5616             /* To avoid excessive duplication of ops we implement shift
5617                by immediate using the variable shift operations.  */
5618             if (op < 8) {
5619                 /* Shift by immediate:
5620                    VSHR, VSRA, VRSHR, VRSRA, VSRI, VSHL, VQSHL, VQSHLU.  */
5621                 if (q && ((rd | rm) & 1)) {
5622                     return 1;
5623                 }
5624                 if (!u && (op == 4 || op == 6)) {
5625                     return 1;
5626                 }
5627                 /* Right shifts are encoded as N - shift, where N is the
5628                    element size in bits.  */
5629                 if (op <= 4)
5630                     shift = shift - (1 << (size + 3));
5631                 if (size == 3) {
5632                     count = q + 1;
5633                 } else {
5634                     count = q ? 4: 2;
5635                 }
5636                 switch (size) {
5637                 case 0:
5638                     imm = (uint8_t) shift;
5639                     imm |= imm << 8;
5640                     imm |= imm << 16;
5641                     break;
5642                 case 1:
5643                     imm = (uint16_t) shift;
5644                     imm |= imm << 16;
5645                     break;
5646                 case 2:
5647                 case 3:
5648                     imm = shift;
5649                     break;
5650                 default:
5651                     abort();
5652                 }
5653
5654                 for (pass = 0; pass < count; pass++) {
5655                     if (size == 3) {
5656                         neon_load_reg64(cpu_V0, rm + pass);
5657                         tcg_gen_movi_i64(cpu_V1, imm);
5658                         switch (op) {
5659                         case 0:  /* VSHR */
5660                         case 1:  /* VSRA */
5661                             if (u)
5662                                 gen_helper_neon_shl_u64(cpu_V0, cpu_V0, cpu_V1);
5663                             else
5664                                 gen_helper_neon_shl_s64(cpu_V0, cpu_V0, cpu_V1);
5665                             break;
5666                         case 2: /* VRSHR */
5667                         case 3: /* VRSRA */
5668                             if (u)
5669                                 gen_helper_neon_rshl_u64(cpu_V0, cpu_V0, cpu_V1);
5670                             else
5671                                 gen_helper_neon_rshl_s64(cpu_V0, cpu_V0, cpu_V1);
5672                             break;
5673                         case 4: /* VSRI */
5674                         case 5: /* VSHL, VSLI */
5675                             gen_helper_neon_shl_u64(cpu_V0, cpu_V0, cpu_V1);
5676                             break;
5677                         case 6: /* VQSHLU */
5678                             gen_helper_neon_qshlu_s64(cpu_V0, cpu_env,
5679                                                       cpu_V0, cpu_V1);
5680                             break;
5681                         case 7: /* VQSHL */
5682                             if (u) {
5683                                 gen_helper_neon_qshl_u64(cpu_V0, cpu_env,
5684                                                          cpu_V0, cpu_V1);
5685                             } else {
5686                                 gen_helper_neon_qshl_s64(cpu_V0, cpu_env,
5687                                                          cpu_V0, cpu_V1);
5688                             }
5689                             break;
5690                         }
5691                         if (op == 1 || op == 3) {
5692                             /* Accumulate.  */
5693                             neon_load_reg64(cpu_V1, rd + pass);
5694                             tcg_gen_add_i64(cpu_V0, cpu_V0, cpu_V1);
5695                         } else if (op == 4 || (op == 5 && u)) {
5696                             /* Insert */
5697                             neon_load_reg64(cpu_V1, rd + pass);
5698                             uint64_t mask;
5699                             if (shift < -63 || shift > 63) {
5700                                 mask = 0;
5701                             } else {
5702                                 if (op == 4) {
5703                                     mask = 0xffffffffffffffffull >> -shift;
5704                                 } else {
5705                                     mask = 0xffffffffffffffffull << shift;
5706                                 }
5707                             }
5708                             tcg_gen_andi_i64(cpu_V1, cpu_V1, ~mask);
5709                             tcg_gen_or_i64(cpu_V0, cpu_V0, cpu_V1);
5710                         }
5711                         neon_store_reg64(cpu_V0, rd + pass);
5712                     } else { /* size < 3 */
5713                         /* Operands in T0 and T1.  */
5714                         tmp = neon_load_reg(rm, pass);
5715                         tmp2 = tcg_temp_new_i32();
5716                         tcg_gen_movi_i32(tmp2, imm);
5717                         switch (op) {
5718                         case 0:  /* VSHR */
5719                         case 1:  /* VSRA */
5720                             GEN_NEON_INTEGER_OP(shl);
5721                             break;
5722                         case 2: /* VRSHR */
5723                         case 3: /* VRSRA */
5724                             GEN_NEON_INTEGER_OP(rshl);
5725                             break;
5726                         case 4: /* VSRI */
5727                         case 5: /* VSHL, VSLI */
5728                             switch (size) {
5729                             case 0: gen_helper_neon_shl_u8(tmp, tmp, tmp2); break;
5730                             case 1: gen_helper_neon_shl_u16(tmp, tmp, tmp2); break;
5731                             case 2: gen_helper_neon_shl_u32(tmp, tmp, tmp2); break;
5732                             default: abort();
5733                             }
5734                             break;
5735                         case 6: /* VQSHLU */
5736                             switch (size) {
5737                             case 0:
5738                                 gen_helper_neon_qshlu_s8(tmp, cpu_env,
5739                                                          tmp, tmp2);
5740                                 break;
5741                             case 1:
5742                                 gen_helper_neon_qshlu_s16(tmp, cpu_env,
5743                                                           tmp, tmp2);
5744                                 break;
5745                             case 2:
5746                                 gen_helper_neon_qshlu_s32(tmp, cpu_env,
5747                                                           tmp, tmp2);
5748                                 break;
5749                             default:
5750                                 abort();
5751                             }
5752                             break;
5753                         case 7: /* VQSHL */
5754                             GEN_NEON_INTEGER_OP_ENV(qshl);
5755                             break;
5756                         }
5757                         tcg_temp_free_i32(tmp2);
5758
5759                         if (op == 1 || op == 3) {
5760                             /* Accumulate.  */
5761                             tmp2 = neon_load_reg(rd, pass);
5762                             gen_neon_add(size, tmp, tmp2);
5763                             tcg_temp_free_i32(tmp2);
5764                         } else if (op == 4 || (op == 5 && u)) {
5765                             /* Insert */
5766                             switch (size) {
5767                             case 0:
5768                                 if (op == 4)
5769                                     mask = 0xff >> -shift;
5770                                 else
5771                                     mask = (uint8_t)(0xff << shift);
5772                                 mask |= mask << 8;
5773                                 mask |= mask << 16;
5774                                 break;
5775                             case 1:
5776                                 if (op == 4)
5777                                     mask = 0xffff >> -shift;
5778                                 else
5779                                     mask = (uint16_t)(0xffff << shift);
5780                                 mask |= mask << 16;
5781                                 break;
5782                             case 2:
5783                                 if (shift < -31 || shift > 31) {
5784                                     mask = 0;
5785                                 } else {
5786                                     if (op == 4)
5787                                         mask = 0xffffffffu >> -shift;
5788                                     else
5789                                         mask = 0xffffffffu << shift;
5790                                 }
5791                                 break;
5792                             default:
5793                                 abort();
5794                             }
5795                             tmp2 = neon_load_reg(rd, pass);
5796                             tcg_gen_andi_i32(tmp, tmp, mask);
5797                             tcg_gen_andi_i32(tmp2, tmp2, ~mask);
5798                             tcg_gen_or_i32(tmp, tmp, tmp2);
5799                             tcg_temp_free_i32(tmp2);
5800                         }
5801                         neon_store_reg(rd, pass, tmp);
5802                     }
5803                 } /* for pass */
5804             } else if (op < 10) {
5805                 /* Shift by immediate and narrow:
5806                    VSHRN, VRSHRN, VQSHRN, VQRSHRN.  */
5807                 int input_unsigned = (op == 8) ? !u : u;
5808                 if (rm & 1) {
5809                     return 1;
5810                 }
5811                 shift = shift - (1 << (size + 3));
5812                 size++;
5813                 if (size == 3) {
5814                     tmp64 = tcg_const_i64(shift);
5815                     neon_load_reg64(cpu_V0, rm);
5816                     neon_load_reg64(cpu_V1, rm + 1);
5817                     for (pass = 0; pass < 2; pass++) {
5818                         TCGv_i64 in;
5819                         if (pass == 0) {
5820                             in = cpu_V0;
5821                         } else {
5822                             in = cpu_V1;
5823                         }
5824                         if (q) {
5825                             if (input_unsigned) {
5826                                 gen_helper_neon_rshl_u64(cpu_V0, in, tmp64);
5827                             } else {
5828                                 gen_helper_neon_rshl_s64(cpu_V0, in, tmp64);
5829                             }
5830                         } else {
5831                             if (input_unsigned) {
5832                                 gen_helper_neon_shl_u64(cpu_V0, in, tmp64);
5833                             } else {
5834                                 gen_helper_neon_shl_s64(cpu_V0, in, tmp64);
5835                             }
5836                         }
5837                         tmp = tcg_temp_new_i32();
5838                         gen_neon_narrow_op(op == 8, u, size - 1, tmp, cpu_V0);
5839                         neon_store_reg(rd, pass, tmp);
5840                     } /* for pass */
5841                     tcg_temp_free_i64(tmp64);
5842                 } else {
5843                     if (size == 1) {
5844                         imm = (uint16_t)shift;
5845                         imm |= imm << 16;
5846                     } else {
5847                         /* size == 2 */
5848                         imm = (uint32_t)shift;
5849                     }
5850                     tmp2 = tcg_const_i32(imm);
5851                     tmp4 = neon_load_reg(rm + 1, 0);
5852                     tmp5 = neon_load_reg(rm + 1, 1);
5853                     for (pass = 0; pass < 2; pass++) {
5854                         if (pass == 0) {
5855                             tmp = neon_load_reg(rm, 0);
5856                         } else {
5857                             tmp = tmp4;
5858                         }
5859                         gen_neon_shift_narrow(size, tmp, tmp2, q,
5860                                               input_unsigned);
5861                         if (pass == 0) {
5862                             tmp3 = neon_load_reg(rm, 1);
5863                         } else {
5864                             tmp3 = tmp5;
5865                         }
5866                         gen_neon_shift_narrow(size, tmp3, tmp2, q,
5867                                               input_unsigned);
5868                         tcg_gen_concat_i32_i64(cpu_V0, tmp, tmp3);
5869                         tcg_temp_free_i32(tmp);
5870                         tcg_temp_free_i32(tmp3);
5871                         tmp = tcg_temp_new_i32();
5872                         gen_neon_narrow_op(op == 8, u, size - 1, tmp, cpu_V0);
5873                         neon_store_reg(rd, pass, tmp);
5874                     } /* for pass */
5875                     tcg_temp_free_i32(tmp2);
5876                 }
5877             } else if (op == 10) {
5878                 /* VSHLL, VMOVL */
5879                 if (q || (rd & 1)) {
5880                     return 1;
5881                 }
5882                 tmp = neon_load_reg(rm, 0);
5883                 tmp2 = neon_load_reg(rm, 1);
5884                 for (pass = 0; pass < 2; pass++) {
5885                     if (pass == 1)
5886                         tmp = tmp2;
5887
5888                     gen_neon_widen(cpu_V0, tmp, size, u);
5889
5890                     if (shift != 0) {
5891                         /* The shift is less than the width of the source
5892                            type, so we can just shift the whole register.  */
5893                         tcg_gen_shli_i64(cpu_V0, cpu_V0, shift);
5894                         /* Widen the result of shift: we need to clear
5895                          * the potential overflow bits resulting from
5896                          * left bits of the narrow input appearing as
5897                          * right bits of left the neighbour narrow
5898                          * input.  */
5899                         if (size < 2 || !u) {
5900                             uint64_t imm64;
5901                             if (size == 0) {
5902                                 imm = (0xffu >> (8 - shift));
5903                                 imm |= imm << 16;
5904                             } else if (size == 1) {
5905                                 imm = 0xffff >> (16 - shift);
5906                             } else {
5907                                 /* size == 2 */
5908                                 imm = 0xffffffff >> (32 - shift);
5909                             }
5910                             if (size < 2) {
5911                                 imm64 = imm | (((uint64_t)imm) << 32);
5912                             } else {
5913                                 imm64 = imm;
5914                             }
5915                             tcg_gen_andi_i64(cpu_V0, cpu_V0, ~imm64);
5916                         }
5917                     }
5918                     neon_store_reg64(cpu_V0, rd + pass);
5919                 }
5920             } else if (op >= 14) {
5921                 /* VCVT fixed-point.  */
5922                 if (!(insn & (1 << 21)) || (q && ((rd | rm) & 1))) {
5923                     return 1;
5924                 }
5925                 /* We have already masked out the must-be-1 top bit of imm6,
5926                  * hence this 32-shift where the ARM ARM has 64-imm6.
5927                  */
5928                 shift = 32 - shift;
5929                 for (pass = 0; pass < (q ? 4 : 2); pass++) {
5930                     tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, pass));
5931                     if (!(op & 1)) {
5932                         if (u)
5933                             gen_vfp_ulto(0, shift, 1);
5934                         else
5935                             gen_vfp_slto(0, shift, 1);
5936                     } else {
5937                         if (u)
5938                             gen_vfp_toul(0, shift, 1);
5939                         else
5940                             gen_vfp_tosl(0, shift, 1);
5941                     }
5942                     tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, pass));
5943                 }
5944             } else {
5945                 return 1;
5946             }
5947         } else { /* (insn & 0x00380080) == 0 */
5948             int invert;
5949             if (q && (rd & 1)) {
5950                 return 1;
5951             }
5952
5953             op = (insn >> 8) & 0xf;
5954             /* One register and immediate.  */
5955             imm = (u << 7) | ((insn >> 12) & 0x70) | (insn & 0xf);
5956             invert = (insn & (1 << 5)) != 0;
5957             /* Note that op = 2,3,4,5,6,7,10,11,12,13 imm=0 is UNPREDICTABLE.
5958              * We choose to not special-case this and will behave as if a
5959              * valid constant encoding of 0 had been given.
5960              */
5961             switch (op) {
5962             case 0: case 1:
5963                 /* no-op */
5964                 break;
5965             case 2: case 3:
5966                 imm <<= 8;
5967                 break;
5968             case 4: case 5:
5969                 imm <<= 16;
5970                 break;
5971             case 6: case 7:
5972                 imm <<= 24;
5973                 break;
5974             case 8: case 9:
5975                 imm |= imm << 16;
5976                 break;
5977             case 10: case 11:
5978                 imm = (imm << 8) | (imm << 24);
5979                 break;
5980             case 12:
5981                 imm = (imm << 8) | 0xff;
5982                 break;
5983             case 13:
5984                 imm = (imm << 16) | 0xffff;
5985                 break;
5986             case 14:
5987                 imm |= (imm << 8) | (imm << 16) | (imm << 24);
5988                 if (invert)
5989                     imm = ~imm;
5990                 break;
5991             case 15:
5992                 if (invert) {
5993                     return 1;
5994                 }
5995                 imm = ((imm & 0x80) << 24) | ((imm & 0x3f) << 19)
5996                       | ((imm & 0x40) ? (0x1f << 25) : (1 << 30));
5997                 break;
5998             }
5999             if (invert)
6000                 imm = ~imm;
6001
6002             for (pass = 0; pass < (q ? 4 : 2); pass++) {
6003                 if (op & 1 && op < 12) {
6004                     tmp = neon_load_reg(rd, pass);
6005                     if (invert) {
6006                         /* The immediate value has already been inverted, so
6007                            BIC becomes AND.  */
6008                         tcg_gen_andi_i32(tmp, tmp, imm);
6009                     } else {
6010                         tcg_gen_ori_i32(tmp, tmp, imm);
6011                     }
6012                 } else {
6013                     /* VMOV, VMVN.  */
6014                     tmp = tcg_temp_new_i32();
6015                     if (op == 14 && invert) {
6016                         int n;
6017                         uint32_t val;
6018                         val = 0;
6019                         for (n = 0; n < 4; n++) {
6020                             if (imm & (1 << (n + (pass & 1) * 4)))
6021                                 val |= 0xff << (n * 8);
6022                         }
6023                         tcg_gen_movi_i32(tmp, val);
6024                     } else {
6025                         tcg_gen_movi_i32(tmp, imm);
6026                     }
6027                 }
6028                 neon_store_reg(rd, pass, tmp);
6029             }
6030         }
6031     } else { /* (insn & 0x00800010 == 0x00800000) */
6032         if (size != 3) {
6033             op = (insn >> 8) & 0xf;
6034             if ((insn & (1 << 6)) == 0) {
6035                 /* Three registers of different lengths.  */
6036                 int src1_wide;
6037                 int src2_wide;
6038                 int prewiden;
6039                 /* undefreq: bit 0 : UNDEF if size == 0
6040                  *           bit 1 : UNDEF if size == 1
6041                  *           bit 2 : UNDEF if size == 2
6042                  *           bit 3 : UNDEF if U == 1
6043                  * Note that [2:0] set implies 'always UNDEF'
6044                  */
6045                 int undefreq;
6046                 /* prewiden, src1_wide, src2_wide, undefreq */
6047                 static const int neon_3reg_wide[16][4] = {
6048                     {1, 0, 0, 0}, /* VADDL */
6049                     {1, 1, 0, 0}, /* VADDW */
6050                     {1, 0, 0, 0}, /* VSUBL */
6051                     {1, 1, 0, 0}, /* VSUBW */
6052                     {0, 1, 1, 0}, /* VADDHN */
6053                     {0, 0, 0, 0}, /* VABAL */
6054                     {0, 1, 1, 0}, /* VSUBHN */
6055                     {0, 0, 0, 0}, /* VABDL */
6056                     {0, 0, 0, 0}, /* VMLAL */
6057                     {0, 0, 0, 9}, /* VQDMLAL */
6058                     {0, 0, 0, 0}, /* VMLSL */
6059                     {0, 0, 0, 9}, /* VQDMLSL */
6060                     {0, 0, 0, 0}, /* Integer VMULL */
6061                     {0, 0, 0, 1}, /* VQDMULL */
6062                     {0, 0, 0, 0xa}, /* Polynomial VMULL */
6063                     {0, 0, 0, 7}, /* Reserved: always UNDEF */
6064                 };
6065
6066                 prewiden = neon_3reg_wide[op][0];
6067                 src1_wide = neon_3reg_wide[op][1];
6068                 src2_wide = neon_3reg_wide[op][2];
6069                 undefreq = neon_3reg_wide[op][3];
6070
6071                 if ((undefreq & (1 << size)) ||
6072                     ((undefreq & 8) && u)) {
6073                     return 1;
6074                 }
6075                 if ((src1_wide && (rn & 1)) ||
6076                     (src2_wide && (rm & 1)) ||
6077                     (!src2_wide && (rd & 1))) {
6078                     return 1;
6079                 }
6080
6081                 /* Handle VMULL.P64 (Polynomial 64x64 to 128 bit multiply)
6082                  * outside the loop below as it only performs a single pass.
6083                  */
6084                 if (op == 14 && size == 2) {
6085                     TCGv_i64 tcg_rn, tcg_rm, tcg_rd;
6086
6087                     if (!arm_dc_feature(s, ARM_FEATURE_V8_PMULL)) {
6088                         return 1;
6089                     }
6090                     tcg_rn = tcg_temp_new_i64();
6091                     tcg_rm = tcg_temp_new_i64();
6092                     tcg_rd = tcg_temp_new_i64();
6093                     neon_load_reg64(tcg_rn, rn);
6094                     neon_load_reg64(tcg_rm, rm);
6095                     gen_helper_neon_pmull_64_lo(tcg_rd, tcg_rn, tcg_rm);
6096                     neon_store_reg64(tcg_rd, rd);
6097                     gen_helper_neon_pmull_64_hi(tcg_rd, tcg_rn, tcg_rm);
6098                     neon_store_reg64(tcg_rd, rd + 1);
6099                     tcg_temp_free_i64(tcg_rn);
6100                     tcg_temp_free_i64(tcg_rm);
6101                     tcg_temp_free_i64(tcg_rd);
6102                     return 0;
6103                 }
6104
6105                 /* Avoid overlapping operands.  Wide source operands are
6106                    always aligned so will never overlap with wide
6107                    destinations in problematic ways.  */
6108                 if (rd == rm && !src2_wide) {
6109                     tmp = neon_load_reg(rm, 1);
6110                     neon_store_scratch(2, tmp);
6111                 } else if (rd == rn && !src1_wide) {
6112                     tmp = neon_load_reg(rn, 1);
6113                     neon_store_scratch(2, tmp);
6114                 }
6115                 TCGV_UNUSED_I32(tmp3);
6116                 for (pass = 0; pass < 2; pass++) {
6117                     if (src1_wide) {
6118                         neon_load_reg64(cpu_V0, rn + pass);
6119                         TCGV_UNUSED_I32(tmp);
6120                     } else {
6121                         if (pass == 1 && rd == rn) {
6122                             tmp = neon_load_scratch(2);
6123                         } else {
6124                             tmp = neon_load_reg(rn, pass);
6125                         }
6126                         if (prewiden) {
6127                             gen_neon_widen(cpu_V0, tmp, size, u);
6128                         }
6129                     }
6130                     if (src2_wide) {
6131                         neon_load_reg64(cpu_V1, rm + pass);
6132                         TCGV_UNUSED_I32(tmp2);
6133                     } else {
6134                         if (pass == 1 && rd == rm) {
6135                             tmp2 = neon_load_scratch(2);
6136                         } else {
6137                             tmp2 = neon_load_reg(rm, pass);
6138                         }
6139                         if (prewiden) {
6140                             gen_neon_widen(cpu_V1, tmp2, size, u);
6141                         }
6142                     }
6143                     switch (op) {
6144                     case 0: case 1: case 4: /* VADDL, VADDW, VADDHN, VRADDHN */
6145                         gen_neon_addl(size);
6146                         break;
6147                     case 2: case 3: case 6: /* VSUBL, VSUBW, VSUBHN, VRSUBHN */
6148                         gen_neon_subl(size);
6149                         break;
6150                     case 5: case 7: /* VABAL, VABDL */
6151                         switch ((size << 1) | u) {
6152                         case 0:
6153                             gen_helper_neon_abdl_s16(cpu_V0, tmp, tmp2);
6154                             break;
6155                         case 1:
6156                             gen_helper_neon_abdl_u16(cpu_V0, tmp, tmp2);
6157                             break;
6158                         case 2:
6159                             gen_helper_neon_abdl_s32(cpu_V0, tmp, tmp2);
6160                             break;
6161                         case 3:
6162                             gen_helper_neon_abdl_u32(cpu_V0, tmp, tmp2);
6163                             break;
6164                         case 4:
6165                             gen_helper_neon_abdl_s64(cpu_V0, tmp, tmp2);
6166                             break;
6167                         case 5:
6168                             gen_helper_neon_abdl_u64(cpu_V0, tmp, tmp2);
6169                             break;
6170                         default: abort();
6171                         }
6172                         tcg_temp_free_i32(tmp2);
6173                         tcg_temp_free_i32(tmp);
6174                         break;
6175                     case 8: case 9: case 10: case 11: case 12: case 13:
6176                         /* VMLAL, VQDMLAL, VMLSL, VQDMLSL, VMULL, VQDMULL */
6177                         gen_neon_mull(cpu_V0, tmp, tmp2, size, u);
6178                         break;
6179                     case 14: /* Polynomial VMULL */
6180                         gen_helper_neon_mull_p8(cpu_V0, tmp, tmp2);
6181                         tcg_temp_free_i32(tmp2);
6182                         tcg_temp_free_i32(tmp);
6183                         break;
6184                     default: /* 15 is RESERVED: caught earlier  */
6185                         abort();
6186                     }
6187                     if (op == 13) {
6188                         /* VQDMULL */
6189                         gen_neon_addl_saturate(cpu_V0, cpu_V0, size);
6190                         neon_store_reg64(cpu_V0, rd + pass);
6191                     } else if (op == 5 || (op >= 8 && op <= 11)) {
6192                         /* Accumulate.  */
6193                         neon_load_reg64(cpu_V1, rd + pass);
6194                         switch (op) {
6195                         case 10: /* VMLSL */
6196                             gen_neon_negl(cpu_V0, size);
6197                             /* Fall through */
6198                         case 5: case 8: /* VABAL, VMLAL */
6199                             gen_neon_addl(size);
6200                             break;
6201                         case 9: case 11: /* VQDMLAL, VQDMLSL */
6202                             gen_neon_addl_saturate(cpu_V0, cpu_V0, size);
6203                             if (op == 11) {
6204                                 gen_neon_negl(cpu_V0, size);
6205                             }
6206                             gen_neon_addl_saturate(cpu_V0, cpu_V1, size);
6207                             break;
6208                         default:
6209                             abort();
6210                         }
6211                         neon_store_reg64(cpu_V0, rd + pass);
6212                     } else if (op == 4 || op == 6) {
6213                         /* Narrowing operation.  */
6214                         tmp = tcg_temp_new_i32();
6215                         if (!u) {
6216                             switch (size) {
6217                             case 0:
6218                                 gen_helper_neon_narrow_high_u8(tmp, cpu_V0);
6219                                 break;
6220                             case 1:
6221                                 gen_helper_neon_narrow_high_u16(tmp, cpu_V0);
6222                                 break;
6223                             case 2:
6224                                 tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
6225                                 tcg_gen_trunc_i64_i32(tmp, cpu_V0);
6226                                 break;
6227                             default: abort();
6228                             }
6229                         } else {
6230                             switch (size) {
6231                             case 0:
6232                                 gen_helper_neon_narrow_round_high_u8(tmp, cpu_V0);
6233                                 break;
6234                             case 1:
6235                                 gen_helper_neon_narrow_round_high_u16(tmp, cpu_V0);
6236                                 break;
6237                             case 2:
6238                                 tcg_gen_addi_i64(cpu_V0, cpu_V0, 1u << 31);
6239                                 tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
6240                                 tcg_gen_trunc_i64_i32(tmp, cpu_V0);
6241                                 break;
6242                             default: abort();
6243                             }
6244                         }
6245                         if (pass == 0) {
6246                             tmp3 = tmp;
6247                         } else {
6248                             neon_store_reg(rd, 0, tmp3);
6249                             neon_store_reg(rd, 1, tmp);
6250                         }
6251                     } else {
6252                         /* Write back the result.  */
6253                         neon_store_reg64(cpu_V0, rd + pass);
6254                     }
6255                 }
6256             } else {
6257                 /* Two registers and a scalar. NB that for ops of this form
6258                  * the ARM ARM labels bit 24 as Q, but it is in our variable
6259                  * 'u', not 'q'.
6260                  */
6261                 if (size == 0) {
6262                     return 1;
6263                 }
6264                 switch (op) {
6265                 case 1: /* Float VMLA scalar */
6266                 case 5: /* Floating point VMLS scalar */
6267                 case 9: /* Floating point VMUL scalar */
6268                     if (size == 1) {
6269                         return 1;
6270                     }
6271                     /* fall through */
6272                 case 0: /* Integer VMLA scalar */
6273                 case 4: /* Integer VMLS scalar */
6274                 case 8: /* Integer VMUL scalar */
6275                 case 12: /* VQDMULH scalar */
6276                 case 13: /* VQRDMULH scalar */
6277                     if (u && ((rd | rn) & 1)) {
6278                         return 1;
6279                     }
6280                     tmp = neon_get_scalar(size, rm);
6281                     neon_store_scratch(0, tmp);
6282                     for (pass = 0; pass < (u ? 4 : 2); pass++) {
6283                         tmp = neon_load_scratch(0);
6284                         tmp2 = neon_load_reg(rn, pass);
6285                         if (op == 12) {
6286                             if (size == 1) {
6287                                 gen_helper_neon_qdmulh_s16(tmp, cpu_env, tmp, tmp2);
6288                             } else {
6289                                 gen_helper_neon_qdmulh_s32(tmp, cpu_env, tmp, tmp2);
6290                             }
6291                         } else if (op == 13) {
6292                             if (size == 1) {
6293                                 gen_helper_neon_qrdmulh_s16(tmp, cpu_env, tmp, tmp2);
6294                             } else {
6295                                 gen_helper_neon_qrdmulh_s32(tmp, cpu_env, tmp, tmp2);
6296                             }
6297                         } else if (op & 1) {
6298                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6299                             gen_helper_vfp_muls(tmp, tmp, tmp2, fpstatus);
6300                             tcg_temp_free_ptr(fpstatus);
6301                         } else {
6302                             switch (size) {
6303                             case 0: gen_helper_neon_mul_u8(tmp, tmp, tmp2); break;
6304                             case 1: gen_helper_neon_mul_u16(tmp, tmp, tmp2); break;
6305                             case 2: tcg_gen_mul_i32(tmp, tmp, tmp2); break;
6306                             default: abort();
6307                             }
6308                         }
6309                         tcg_temp_free_i32(tmp2);
6310                         if (op < 8) {
6311                             /* Accumulate.  */
6312                             tmp2 = neon_load_reg(rd, pass);
6313                             switch (op) {
6314                             case 0:
6315                                 gen_neon_add(size, tmp, tmp2);
6316                                 break;
6317                             case 1:
6318                             {
6319                                 TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6320                                 gen_helper_vfp_adds(tmp, tmp, tmp2, fpstatus);
6321                                 tcg_temp_free_ptr(fpstatus);
6322                                 break;
6323                             }
6324                             case 4:
6325                                 gen_neon_rsb(size, tmp, tmp2);
6326                                 break;
6327                             case 5:
6328                             {
6329                                 TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6330                                 gen_helper_vfp_subs(tmp, tmp2, tmp, fpstatus);
6331                                 tcg_temp_free_ptr(fpstatus);
6332                                 break;
6333                             }
6334                             default:
6335                                 abort();
6336                             }
6337                             tcg_temp_free_i32(tmp2);
6338                         }
6339                         neon_store_reg(rd, pass, tmp);
6340                     }
6341                     break;
6342                 case 3: /* VQDMLAL scalar */
6343                 case 7: /* VQDMLSL scalar */
6344                 case 11: /* VQDMULL scalar */
6345                     if (u == 1) {
6346                         return 1;
6347                     }
6348                     /* fall through */
6349                 case 2: /* VMLAL sclar */
6350                 case 6: /* VMLSL scalar */
6351                 case 10: /* VMULL scalar */
6352                     if (rd & 1) {
6353                         return 1;
6354                     }
6355                     tmp2 = neon_get_scalar(size, rm);
6356                     /* We need a copy of tmp2 because gen_neon_mull
6357                      * deletes it during pass 0.  */
6358                     tmp4 = tcg_temp_new_i32();
6359                     tcg_gen_mov_i32(tmp4, tmp2);
6360                     tmp3 = neon_load_reg(rn, 1);
6361
6362                     for (pass = 0; pass < 2; pass++) {
6363                         if (pass == 0) {
6364                             tmp = neon_load_reg(rn, 0);
6365                         } else {
6366                             tmp = tmp3;
6367                             tmp2 = tmp4;
6368                         }
6369                         gen_neon_mull(cpu_V0, tmp, tmp2, size, u);
6370                         if (op != 11) {
6371                             neon_load_reg64(cpu_V1, rd + pass);
6372                         }
6373                         switch (op) {
6374                         case 6:
6375                             gen_neon_negl(cpu_V0, size);
6376                             /* Fall through */
6377                         case 2:
6378                             gen_neon_addl(size);
6379                             break;
6380                         case 3: case 7:
6381                             gen_neon_addl_saturate(cpu_V0, cpu_V0, size);
6382                             if (op == 7) {
6383                                 gen_neon_negl(cpu_V0, size);
6384                             }
6385                             gen_neon_addl_saturate(cpu_V0, cpu_V1, size);
6386                             break;
6387                         case 10:
6388                             /* no-op */
6389                             break;
6390                         case 11:
6391                             gen_neon_addl_saturate(cpu_V0, cpu_V0, size);
6392                             break;
6393                         default:
6394                             abort();
6395                         }
6396                         neon_store_reg64(cpu_V0, rd + pass);
6397                     }
6398
6399
6400                     break;
6401                 default: /* 14 and 15 are RESERVED */
6402                     return 1;
6403                 }
6404             }
6405         } else { /* size == 3 */
6406             if (!u) {
6407                 /* Extract.  */
6408                 imm = (insn >> 8) & 0xf;
6409
6410                 if (imm > 7 && !q)
6411                     return 1;
6412
6413                 if (q && ((rd | rn | rm) & 1)) {
6414                     return 1;
6415                 }
6416
6417                 if (imm == 0) {
6418                     neon_load_reg64(cpu_V0, rn);
6419                     if (q) {
6420                         neon_load_reg64(cpu_V1, rn + 1);
6421                     }
6422                 } else if (imm == 8) {
6423                     neon_load_reg64(cpu_V0, rn + 1);
6424                     if (q) {
6425                         neon_load_reg64(cpu_V1, rm);
6426                     }
6427                 } else if (q) {
6428                     tmp64 = tcg_temp_new_i64();
6429                     if (imm < 8) {
6430                         neon_load_reg64(cpu_V0, rn);
6431                         neon_load_reg64(tmp64, rn + 1);
6432                     } else {
6433                         neon_load_reg64(cpu_V0, rn + 1);
6434                         neon_load_reg64(tmp64, rm);
6435                     }
6436                     tcg_gen_shri_i64(cpu_V0, cpu_V0, (imm & 7) * 8);
6437                     tcg_gen_shli_i64(cpu_V1, tmp64, 64 - ((imm & 7) * 8));
6438                     tcg_gen_or_i64(cpu_V0, cpu_V0, cpu_V1);
6439                     if (imm < 8) {
6440                         neon_load_reg64(cpu_V1, rm);
6441                     } else {
6442                         neon_load_reg64(cpu_V1, rm + 1);
6443                         imm -= 8;
6444                     }
6445                     tcg_gen_shli_i64(cpu_V1, cpu_V1, 64 - (imm * 8));
6446                     tcg_gen_shri_i64(tmp64, tmp64, imm * 8);
6447                     tcg_gen_or_i64(cpu_V1, cpu_V1, tmp64);
6448                     tcg_temp_free_i64(tmp64);
6449                 } else {
6450                     /* BUGFIX */
6451                     neon_load_reg64(cpu_V0, rn);
6452                     tcg_gen_shri_i64(cpu_V0, cpu_V0, imm * 8);
6453                     neon_load_reg64(cpu_V1, rm);
6454                     tcg_gen_shli_i64(cpu_V1, cpu_V1, 64 - (imm * 8));
6455                     tcg_gen_or_i64(cpu_V0, cpu_V0, cpu_V1);
6456                 }
6457                 neon_store_reg64(cpu_V0, rd);
6458                 if (q) {
6459                     neon_store_reg64(cpu_V1, rd + 1);
6460                 }
6461             } else if ((insn & (1 << 11)) == 0) {
6462                 /* Two register misc.  */
6463                 op = ((insn >> 12) & 0x30) | ((insn >> 7) & 0xf);
6464                 size = (insn >> 18) & 3;
6465                 /* UNDEF for unknown op values and bad op-size combinations */
6466                 if ((neon_2rm_sizes[op] & (1 << size)) == 0) {
6467                     return 1;
6468                 }
6469                 if ((op != NEON_2RM_VMOVN && op != NEON_2RM_VQMOVN) &&
6470                     q && ((rm | rd) & 1)) {
6471                     return 1;
6472                 }
6473                 switch (op) {
6474                 case NEON_2RM_VREV64:
6475                     for (pass = 0; pass < (q ? 2 : 1); pass++) {
6476                         tmp = neon_load_reg(rm, pass * 2);
6477                         tmp2 = neon_load_reg(rm, pass * 2 + 1);
6478                         switch (size) {
6479                         case 0: tcg_gen_bswap32_i32(tmp, tmp); break;
6480                         case 1: gen_swap_half(tmp); break;
6481                         case 2: /* no-op */ break;
6482                         default: abort();
6483                         }
6484                         neon_store_reg(rd, pass * 2 + 1, tmp);
6485                         if (size == 2) {
6486                             neon_store_reg(rd, pass * 2, tmp2);
6487                         } else {
6488                             switch (size) {
6489                             case 0: tcg_gen_bswap32_i32(tmp2, tmp2); break;
6490                             case 1: gen_swap_half(tmp2); break;
6491                             default: abort();
6492                             }
6493                             neon_store_reg(rd, pass * 2, tmp2);
6494                         }
6495                     }
6496                     break;
6497                 case NEON_2RM_VPADDL: case NEON_2RM_VPADDL_U:
6498                 case NEON_2RM_VPADAL: case NEON_2RM_VPADAL_U:
6499                     for (pass = 0; pass < q + 1; pass++) {
6500                         tmp = neon_load_reg(rm, pass * 2);
6501                         gen_neon_widen(cpu_V0, tmp, size, op & 1);
6502                         tmp = neon_load_reg(rm, pass * 2 + 1);
6503                         gen_neon_widen(cpu_V1, tmp, size, op & 1);
6504                         switch (size) {
6505                         case 0: gen_helper_neon_paddl_u16(CPU_V001); break;
6506                         case 1: gen_helper_neon_paddl_u32(CPU_V001); break;
6507                         case 2: tcg_gen_add_i64(CPU_V001); break;
6508                         default: abort();
6509                         }
6510                         if (op >= NEON_2RM_VPADAL) {
6511                             /* Accumulate.  */
6512                             neon_load_reg64(cpu_V1, rd + pass);
6513                             gen_neon_addl(size);
6514                         }
6515                         neon_store_reg64(cpu_V0, rd + pass);
6516                     }
6517                     break;
6518                 case NEON_2RM_VTRN:
6519                     if (size == 2) {
6520                         int n;
6521                         for (n = 0; n < (q ? 4 : 2); n += 2) {
6522                             tmp = neon_load_reg(rm, n);
6523                             tmp2 = neon_load_reg(rd, n + 1);
6524                             neon_store_reg(rm, n, tmp2);
6525                             neon_store_reg(rd, n + 1, tmp);
6526                         }
6527                     } else {
6528                         goto elementwise;
6529                     }
6530                     break;
6531                 case NEON_2RM_VUZP:
6532                     if (gen_neon_unzip(rd, rm, size, q)) {
6533                         return 1;
6534                     }
6535                     break;
6536                 case NEON_2RM_VZIP:
6537                     if (gen_neon_zip(rd, rm, size, q)) {
6538                         return 1;
6539                     }
6540                     break;
6541                 case NEON_2RM_VMOVN: case NEON_2RM_VQMOVN:
6542                     /* also VQMOVUN; op field and mnemonics don't line up */
6543                     if (rm & 1) {
6544                         return 1;
6545                     }
6546                     TCGV_UNUSED_I32(tmp2);
6547                     for (pass = 0; pass < 2; pass++) {
6548                         neon_load_reg64(cpu_V0, rm + pass);
6549                         tmp = tcg_temp_new_i32();
6550                         gen_neon_narrow_op(op == NEON_2RM_VMOVN, q, size,
6551                                            tmp, cpu_V0);
6552                         if (pass == 0) {
6553                             tmp2 = tmp;
6554                         } else {
6555                             neon_store_reg(rd, 0, tmp2);
6556                             neon_store_reg(rd, 1, tmp);
6557                         }
6558                     }
6559                     break;
6560                 case NEON_2RM_VSHLL:
6561                     if (q || (rd & 1)) {
6562                         return 1;
6563                     }
6564                     tmp = neon_load_reg(rm, 0);
6565                     tmp2 = neon_load_reg(rm, 1);
6566                     for (pass = 0; pass < 2; pass++) {
6567                         if (pass == 1)
6568                             tmp = tmp2;
6569                         gen_neon_widen(cpu_V0, tmp, size, 1);
6570                         tcg_gen_shli_i64(cpu_V0, cpu_V0, 8 << size);
6571                         neon_store_reg64(cpu_V0, rd + pass);
6572                     }
6573                     break;
6574                 case NEON_2RM_VCVT_F16_F32:
6575                     if (!arm_dc_feature(s, ARM_FEATURE_VFP_FP16) ||
6576                         q || (rm & 1)) {
6577                         return 1;
6578                     }
6579                     tmp = tcg_temp_new_i32();
6580                     tmp2 = tcg_temp_new_i32();
6581                     tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 0));
6582                     gen_helper_neon_fcvt_f32_to_f16(tmp, cpu_F0s, cpu_env);
6583                     tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 1));
6584                     gen_helper_neon_fcvt_f32_to_f16(tmp2, cpu_F0s, cpu_env);
6585                     tcg_gen_shli_i32(tmp2, tmp2, 16);
6586                     tcg_gen_or_i32(tmp2, tmp2, tmp);
6587                     tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 2));
6588                     gen_helper_neon_fcvt_f32_to_f16(tmp, cpu_F0s, cpu_env);
6589                     tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 3));
6590                     neon_store_reg(rd, 0, tmp2);
6591                     tmp2 = tcg_temp_new_i32();
6592                     gen_helper_neon_fcvt_f32_to_f16(tmp2, cpu_F0s, cpu_env);
6593                     tcg_gen_shli_i32(tmp2, tmp2, 16);
6594                     tcg_gen_or_i32(tmp2, tmp2, tmp);
6595                     neon_store_reg(rd, 1, tmp2);
6596                     tcg_temp_free_i32(tmp);
6597                     break;
6598                 case NEON_2RM_VCVT_F32_F16:
6599                     if (!arm_dc_feature(s, ARM_FEATURE_VFP_FP16) ||
6600                         q || (rd & 1)) {
6601                         return 1;
6602                     }
6603                     tmp3 = tcg_temp_new_i32();
6604                     tmp = neon_load_reg(rm, 0);
6605                     tmp2 = neon_load_reg(rm, 1);
6606                     tcg_gen_ext16u_i32(tmp3, tmp);
6607                     gen_helper_neon_fcvt_f16_to_f32(cpu_F0s, tmp3, cpu_env);
6608                     tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 0));
6609                     tcg_gen_shri_i32(tmp3, tmp, 16);
6610                     gen_helper_neon_fcvt_f16_to_f32(cpu_F0s, tmp3, cpu_env);
6611                     tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 1));
6612                     tcg_temp_free_i32(tmp);
6613                     tcg_gen_ext16u_i32(tmp3, tmp2);
6614                     gen_helper_neon_fcvt_f16_to_f32(cpu_F0s, tmp3, cpu_env);
6615                     tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 2));
6616                     tcg_gen_shri_i32(tmp3, tmp2, 16);
6617                     gen_helper_neon_fcvt_f16_to_f32(cpu_F0s, tmp3, cpu_env);
6618                     tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 3));
6619                     tcg_temp_free_i32(tmp2);
6620                     tcg_temp_free_i32(tmp3);
6621                     break;
6622                 case NEON_2RM_AESE: case NEON_2RM_AESMC:
6623                     if (!arm_dc_feature(s, ARM_FEATURE_V8_AES)
6624                         || ((rm | rd) & 1)) {
6625                         return 1;
6626                     }
6627                     tmp = tcg_const_i32(rd);
6628                     tmp2 = tcg_const_i32(rm);
6629
6630                      /* Bit 6 is the lowest opcode bit; it distinguishes between
6631                       * encryption (AESE/AESMC) and decryption (AESD/AESIMC)
6632                       */
6633                     tmp3 = tcg_const_i32(extract32(insn, 6, 1));
6634
6635                     if (op == NEON_2RM_AESE) {
6636                         gen_helper_crypto_aese(cpu_env, tmp, tmp2, tmp3);
6637                     } else {
6638                         gen_helper_crypto_aesmc(cpu_env, tmp, tmp2, tmp3);
6639                     }
6640                     tcg_temp_free_i32(tmp);
6641                     tcg_temp_free_i32(tmp2);
6642                     tcg_temp_free_i32(tmp3);
6643                     break;
6644                 case NEON_2RM_SHA1H:
6645                     if (!arm_dc_feature(s, ARM_FEATURE_V8_SHA1)
6646                         || ((rm | rd) & 1)) {
6647                         return 1;
6648                     }
6649                     tmp = tcg_const_i32(rd);
6650                     tmp2 = tcg_const_i32(rm);
6651
6652                     gen_helper_crypto_sha1h(cpu_env, tmp, tmp2);
6653
6654                     tcg_temp_free_i32(tmp);
6655                     tcg_temp_free_i32(tmp2);
6656                     break;
6657                 case NEON_2RM_SHA1SU1:
6658                     if ((rm | rd) & 1) {
6659                             return 1;
6660                     }
6661                     /* bit 6 (q): set -> SHA256SU0, cleared -> SHA1SU1 */
6662                     if (q) {
6663                         if (!arm_dc_feature(s, ARM_FEATURE_V8_SHA256)) {
6664                             return 1;
6665                         }
6666                     } else if (!arm_dc_feature(s, ARM_FEATURE_V8_SHA1)) {
6667                         return 1;
6668                     }
6669                     tmp = tcg_const_i32(rd);
6670                     tmp2 = tcg_const_i32(rm);
6671                     if (q) {
6672                         gen_helper_crypto_sha256su0(cpu_env, tmp, tmp2);
6673                     } else {
6674                         gen_helper_crypto_sha1su1(cpu_env, tmp, tmp2);
6675                     }
6676                     tcg_temp_free_i32(tmp);
6677                     tcg_temp_free_i32(tmp2);
6678                     break;
6679                 default:
6680                 elementwise:
6681                     for (pass = 0; pass < (q ? 4 : 2); pass++) {
6682                         if (neon_2rm_is_float_op(op)) {
6683                             tcg_gen_ld_f32(cpu_F0s, cpu_env,
6684                                            neon_reg_offset(rm, pass));
6685                             TCGV_UNUSED_I32(tmp);
6686                         } else {
6687                             tmp = neon_load_reg(rm, pass);
6688                         }
6689                         switch (op) {
6690                         case NEON_2RM_VREV32:
6691                             switch (size) {
6692                             case 0: tcg_gen_bswap32_i32(tmp, tmp); break;
6693                             case 1: gen_swap_half(tmp); break;
6694                             default: abort();
6695                             }
6696                             break;
6697                         case NEON_2RM_VREV16:
6698                             gen_rev16(tmp);
6699                             break;
6700                         case NEON_2RM_VCLS:
6701                             switch (size) {
6702                             case 0: gen_helper_neon_cls_s8(tmp, tmp); break;
6703                             case 1: gen_helper_neon_cls_s16(tmp, tmp); break;
6704                             case 2: gen_helper_neon_cls_s32(tmp, tmp); break;
6705                             default: abort();
6706                             }
6707                             break;
6708                         case NEON_2RM_VCLZ:
6709                             switch (size) {
6710                             case 0: gen_helper_neon_clz_u8(tmp, tmp); break;
6711                             case 1: gen_helper_neon_clz_u16(tmp, tmp); break;
6712                             case 2: gen_helper_clz(tmp, tmp); break;
6713                             default: abort();
6714                             }
6715                             break;
6716                         case NEON_2RM_VCNT:
6717                             gen_helper_neon_cnt_u8(tmp, tmp);
6718                             break;
6719                         case NEON_2RM_VMVN:
6720                             tcg_gen_not_i32(tmp, tmp);
6721                             break;
6722                         case NEON_2RM_VQABS:
6723                             switch (size) {
6724                             case 0:
6725                                 gen_helper_neon_qabs_s8(tmp, cpu_env, tmp);
6726                                 break;
6727                             case 1:
6728                                 gen_helper_neon_qabs_s16(tmp, cpu_env, tmp);
6729                                 break;
6730                             case 2:
6731                                 gen_helper_neon_qabs_s32(tmp, cpu_env, tmp);
6732                                 break;
6733                             default: abort();
6734                             }
6735                             break;
6736                         case NEON_2RM_VQNEG:
6737                             switch (size) {
6738                             case 0:
6739                                 gen_helper_neon_qneg_s8(tmp, cpu_env, tmp);
6740                                 break;
6741                             case 1:
6742                                 gen_helper_neon_qneg_s16(tmp, cpu_env, tmp);
6743                                 break;
6744                             case 2:
6745                                 gen_helper_neon_qneg_s32(tmp, cpu_env, tmp);
6746                                 break;
6747                             default: abort();
6748                             }
6749                             break;
6750                         case NEON_2RM_VCGT0: case NEON_2RM_VCLE0:
6751                             tmp2 = tcg_const_i32(0);
6752                             switch(size) {
6753                             case 0: gen_helper_neon_cgt_s8(tmp, tmp, tmp2); break;
6754                             case 1: gen_helper_neon_cgt_s16(tmp, tmp, tmp2); break;
6755                             case 2: gen_helper_neon_cgt_s32(tmp, tmp, tmp2); break;
6756                             default: abort();
6757                             }
6758                             tcg_temp_free_i32(tmp2);
6759                             if (op == NEON_2RM_VCLE0) {
6760                                 tcg_gen_not_i32(tmp, tmp);
6761                             }
6762                             break;
6763                         case NEON_2RM_VCGE0: case NEON_2RM_VCLT0:
6764                             tmp2 = tcg_const_i32(0);
6765                             switch(size) {
6766                             case 0: gen_helper_neon_cge_s8(tmp, tmp, tmp2); break;
6767                             case 1: gen_helper_neon_cge_s16(tmp, tmp, tmp2); break;
6768                             case 2: gen_helper_neon_cge_s32(tmp, tmp, tmp2); break;
6769                             default: abort();
6770                             }
6771                             tcg_temp_free_i32(tmp2);
6772                             if (op == NEON_2RM_VCLT0) {
6773                                 tcg_gen_not_i32(tmp, tmp);
6774                             }
6775                             break;
6776                         case NEON_2RM_VCEQ0:
6777                             tmp2 = tcg_const_i32(0);
6778                             switch(size) {
6779                             case 0: gen_helper_neon_ceq_u8(tmp, tmp, tmp2); break;
6780                             case 1: gen_helper_neon_ceq_u16(tmp, tmp, tmp2); break;
6781                             case 2: gen_helper_neon_ceq_u32(tmp, tmp, tmp2); break;
6782                             default: abort();
6783                             }
6784                             tcg_temp_free_i32(tmp2);
6785                             break;
6786                         case NEON_2RM_VABS:
6787                             switch(size) {
6788                             case 0: gen_helper_neon_abs_s8(tmp, tmp); break;
6789                             case 1: gen_helper_neon_abs_s16(tmp, tmp); break;
6790                             case 2: tcg_gen_abs_i32(tmp, tmp); break;
6791                             default: abort();
6792                             }
6793                             break;
6794                         case NEON_2RM_VNEG:
6795                             tmp2 = tcg_const_i32(0);
6796                             gen_neon_rsb(size, tmp, tmp2);
6797                             tcg_temp_free_i32(tmp2);
6798                             break;
6799                         case NEON_2RM_VCGT0_F:
6800                         {
6801                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6802                             tmp2 = tcg_const_i32(0);
6803                             gen_helper_neon_cgt_f32(tmp, tmp, tmp2, fpstatus);
6804                             tcg_temp_free_i32(tmp2);
6805                             tcg_temp_free_ptr(fpstatus);
6806                             break;
6807                         }
6808                         case NEON_2RM_VCGE0_F:
6809                         {
6810                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6811                             tmp2 = tcg_const_i32(0);
6812                             gen_helper_neon_cge_f32(tmp, tmp, tmp2, fpstatus);
6813                             tcg_temp_free_i32(tmp2);
6814                             tcg_temp_free_ptr(fpstatus);
6815                             break;
6816                         }
6817                         case NEON_2RM_VCEQ0_F:
6818                         {
6819                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6820                             tmp2 = tcg_const_i32(0);
6821                             gen_helper_neon_ceq_f32(tmp, tmp, tmp2, fpstatus);
6822                             tcg_temp_free_i32(tmp2);
6823                             tcg_temp_free_ptr(fpstatus);
6824                             break;
6825                         }
6826                         case NEON_2RM_VCLE0_F:
6827                         {
6828                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6829                             tmp2 = tcg_const_i32(0);
6830                             gen_helper_neon_cge_f32(tmp, tmp2, tmp, fpstatus);
6831                             tcg_temp_free_i32(tmp2);
6832                             tcg_temp_free_ptr(fpstatus);
6833                             break;
6834                         }
6835                         case NEON_2RM_VCLT0_F:
6836                         {
6837                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6838                             tmp2 = tcg_const_i32(0);
6839                             gen_helper_neon_cgt_f32(tmp, tmp2, tmp, fpstatus);
6840                             tcg_temp_free_i32(tmp2);
6841                             tcg_temp_free_ptr(fpstatus);
6842                             break;
6843                         }
6844                         case NEON_2RM_VABS_F:
6845                             gen_vfp_abs(0);
6846                             break;
6847                         case NEON_2RM_VNEG_F:
6848                             gen_vfp_neg(0);
6849                             break;
6850                         case NEON_2RM_VSWP:
6851                             tmp2 = neon_load_reg(rd, pass);
6852                             neon_store_reg(rm, pass, tmp2);
6853                             break;
6854                         case NEON_2RM_VTRN:
6855                             tmp2 = neon_load_reg(rd, pass);
6856                             switch (size) {
6857                             case 0: gen_neon_trn_u8(tmp, tmp2); break;
6858                             case 1: gen_neon_trn_u16(tmp, tmp2); break;
6859                             default: abort();
6860                             }
6861                             neon_store_reg(rm, pass, tmp2);
6862                             break;
6863                         case NEON_2RM_VRINTN:
6864                         case NEON_2RM_VRINTA:
6865                         case NEON_2RM_VRINTM:
6866                         case NEON_2RM_VRINTP:
6867                         case NEON_2RM_VRINTZ:
6868                         {
6869                             TCGv_i32 tcg_rmode;
6870                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6871                             int rmode;
6872
6873                             if (op == NEON_2RM_VRINTZ) {
6874                                 rmode = FPROUNDING_ZERO;
6875                             } else {
6876                                 rmode = fp_decode_rm[((op & 0x6) >> 1) ^ 1];
6877                             }
6878
6879                             tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rmode));
6880                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
6881                                                       cpu_env);
6882                             gen_helper_rints(cpu_F0s, cpu_F0s, fpstatus);
6883                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
6884                                                       cpu_env);
6885                             tcg_temp_free_ptr(fpstatus);
6886                             tcg_temp_free_i32(tcg_rmode);
6887                             break;
6888                         }
6889                         case NEON_2RM_VRINTX:
6890                         {
6891                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6892                             gen_helper_rints_exact(cpu_F0s, cpu_F0s, fpstatus);
6893                             tcg_temp_free_ptr(fpstatus);
6894                             break;
6895                         }
6896                         case NEON_2RM_VCVTAU:
6897                         case NEON_2RM_VCVTAS:
6898                         case NEON_2RM_VCVTNU:
6899                         case NEON_2RM_VCVTNS:
6900                         case NEON_2RM_VCVTPU:
6901                         case NEON_2RM_VCVTPS:
6902                         case NEON_2RM_VCVTMU:
6903                         case NEON_2RM_VCVTMS:
6904                         {
6905                             bool is_signed = !extract32(insn, 7, 1);
6906                             TCGv_ptr fpst = get_fpstatus_ptr(1);
6907                             TCGv_i32 tcg_rmode, tcg_shift;
6908                             int rmode = fp_decode_rm[extract32(insn, 8, 2)];
6909
6910                             tcg_shift = tcg_const_i32(0);
6911                             tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rmode));
6912                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
6913                                                       cpu_env);
6914
6915                             if (is_signed) {
6916                                 gen_helper_vfp_tosls(cpu_F0s, cpu_F0s,
6917                                                      tcg_shift, fpst);
6918                             } else {
6919                                 gen_helper_vfp_touls(cpu_F0s, cpu_F0s,
6920                                                      tcg_shift, fpst);
6921                             }
6922
6923                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
6924                                                       cpu_env);
6925                             tcg_temp_free_i32(tcg_rmode);
6926                             tcg_temp_free_i32(tcg_shift);
6927                             tcg_temp_free_ptr(fpst);
6928                             break;
6929                         }
6930                         case NEON_2RM_VRECPE:
6931                         {
6932                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6933                             gen_helper_recpe_u32(tmp, tmp, fpstatus);
6934                             tcg_temp_free_ptr(fpstatus);
6935                             break;
6936                         }
6937                         case NEON_2RM_VRSQRTE:
6938                         {
6939                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6940                             gen_helper_rsqrte_u32(tmp, tmp, fpstatus);
6941                             tcg_temp_free_ptr(fpstatus);
6942                             break;
6943                         }
6944                         case NEON_2RM_VRECPE_F:
6945                         {
6946                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6947                             gen_helper_recpe_f32(cpu_F0s, cpu_F0s, fpstatus);
6948                             tcg_temp_free_ptr(fpstatus);
6949                             break;
6950                         }
6951                         case NEON_2RM_VRSQRTE_F:
6952                         {
6953                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6954                             gen_helper_rsqrte_f32(cpu_F0s, cpu_F0s, fpstatus);
6955                             tcg_temp_free_ptr(fpstatus);
6956                             break;
6957                         }
6958                         case NEON_2RM_VCVT_FS: /* VCVT.F32.S32 */
6959                             gen_vfp_sito(0, 1);
6960                             break;
6961                         case NEON_2RM_VCVT_FU: /* VCVT.F32.U32 */
6962                             gen_vfp_uito(0, 1);
6963                             break;
6964                         case NEON_2RM_VCVT_SF: /* VCVT.S32.F32 */
6965                             gen_vfp_tosiz(0, 1);
6966                             break;
6967                         case NEON_2RM_VCVT_UF: /* VCVT.U32.F32 */
6968                             gen_vfp_touiz(0, 1);
6969                             break;
6970                         default:
6971                             /* Reserved op values were caught by the
6972                              * neon_2rm_sizes[] check earlier.
6973                              */
6974                             abort();
6975                         }
6976                         if (neon_2rm_is_float_op(op)) {
6977                             tcg_gen_st_f32(cpu_F0s, cpu_env,
6978                                            neon_reg_offset(rd, pass));
6979                         } else {
6980                             neon_store_reg(rd, pass, tmp);
6981                         }
6982                     }
6983                     break;
6984                 }
6985             } else if ((insn & (1 << 10)) == 0) {
6986                 /* VTBL, VTBX.  */
6987                 int n = ((insn >> 8) & 3) + 1;
6988                 if ((rn + n) > 32) {
6989                     /* This is UNPREDICTABLE; we choose to UNDEF to avoid the
6990                      * helper function running off the end of the register file.
6991                      */
6992                     return 1;
6993                 }
6994                 n <<= 3;
6995                 if (insn & (1 << 6)) {
6996                     tmp = neon_load_reg(rd, 0);
6997                 } else {
6998                     tmp = tcg_temp_new_i32();
6999                     tcg_gen_movi_i32(tmp, 0);
7000                 }
7001                 tmp2 = neon_load_reg(rm, 0);
7002                 tmp4 = tcg_const_i32(rn);
7003                 tmp5 = tcg_const_i32(n);
7004                 gen_helper_neon_tbl(tmp2, cpu_env, tmp2, tmp, tmp4, tmp5);
7005                 tcg_temp_free_i32(tmp);
7006                 if (insn & (1 << 6)) {
7007                     tmp = neon_load_reg(rd, 1);
7008                 } else {
7009                     tmp = tcg_temp_new_i32();
7010                     tcg_gen_movi_i32(tmp, 0);
7011                 }
7012                 tmp3 = neon_load_reg(rm, 1);
7013                 gen_helper_neon_tbl(tmp3, cpu_env, tmp3, tmp, tmp4, tmp5);
7014                 tcg_temp_free_i32(tmp5);
7015                 tcg_temp_free_i32(tmp4);
7016                 neon_store_reg(rd, 0, tmp2);
7017                 neon_store_reg(rd, 1, tmp3);
7018                 tcg_temp_free_i32(tmp);
7019             } else if ((insn & 0x380) == 0) {
7020                 /* VDUP */
7021                 if ((insn & (7 << 16)) == 0 || (q && (rd & 1))) {
7022                     return 1;
7023                 }
7024                 if (insn & (1 << 19)) {
7025                     tmp = neon_load_reg(rm, 1);
7026                 } else {
7027                     tmp = neon_load_reg(rm, 0);
7028                 }
7029                 if (insn & (1 << 16)) {
7030                     gen_neon_dup_u8(tmp, ((insn >> 17) & 3) * 8);
7031                 } else if (insn & (1 << 17)) {
7032                     if ((insn >> 18) & 1)
7033                         gen_neon_dup_high16(tmp);
7034                     else
7035                         gen_neon_dup_low16(tmp);
7036                 }
7037                 for (pass = 0; pass < (q ? 4 : 2); pass++) {
7038                     tmp2 = tcg_temp_new_i32();
7039                     tcg_gen_mov_i32(tmp2, tmp);
7040                     neon_store_reg(rd, pass, tmp2);
7041                 }
7042                 tcg_temp_free_i32(tmp);
7043             } else {
7044                 return 1;
7045             }
7046         }
7047     }
7048     return 0;
7049 }
7050
7051 static int disas_coproc_insn(DisasContext *s, uint32_t insn)
7052 {
7053     int cpnum, is64, crn, crm, opc1, opc2, isread, rt, rt2;
7054     const ARMCPRegInfo *ri;
7055
7056     cpnum = (insn >> 8) & 0xf;
7057
7058     /* First check for coprocessor space used for XScale/iwMMXt insns */
7059     if (arm_dc_feature(s, ARM_FEATURE_XSCALE) && (cpnum < 2)) {
7060         if (extract32(s->c15_cpar, cpnum, 1) == 0) {
7061             return 1;
7062         }
7063         if (arm_dc_feature(s, ARM_FEATURE_IWMMXT)) {
7064             return disas_iwmmxt_insn(s, insn);
7065         } else if (arm_dc_feature(s, ARM_FEATURE_XSCALE)) {
7066             return disas_dsp_insn(s, insn);
7067         }
7068         return 1;
7069     }
7070
7071     /* Otherwise treat as a generic register access */
7072     is64 = (insn & (1 << 25)) == 0;
7073     if (!is64 && ((insn & (1 << 4)) == 0)) {
7074         /* cdp */
7075         return 1;
7076     }
7077
7078     crm = insn & 0xf;
7079     if (is64) {
7080         crn = 0;
7081         opc1 = (insn >> 4) & 0xf;
7082         opc2 = 0;
7083         rt2 = (insn >> 16) & 0xf;
7084     } else {
7085         crn = (insn >> 16) & 0xf;
7086         opc1 = (insn >> 21) & 7;
7087         opc2 = (insn >> 5) & 7;
7088         rt2 = 0;
7089     }
7090     isread = (insn >> 20) & 1;
7091     rt = (insn >> 12) & 0xf;
7092
7093     ri = get_arm_cp_reginfo(s->cp_regs,
7094             ENCODE_CP_REG(cpnum, is64, s->ns, crn, crm, opc1, opc2));
7095     if (ri) {
7096         /* Check access permissions */
7097         if (!cp_access_ok(s->current_el, ri, isread)) {
7098             return 1;
7099         }
7100
7101         if (ri->accessfn ||
7102             (arm_dc_feature(s, ARM_FEATURE_XSCALE) && cpnum < 14)) {
7103             /* Emit code to perform further access permissions checks at
7104              * runtime; this may result in an exception.
7105              * Note that on XScale all cp0..c13 registers do an access check
7106              * call in order to handle c15_cpar.
7107              */
7108             TCGv_ptr tmpptr;
7109             TCGv_i32 tcg_syn;
7110             uint32_t syndrome;
7111
7112             /* Note that since we are an implementation which takes an
7113              * exception on a trapped conditional instruction only if the
7114              * instruction passes its condition code check, we can take
7115              * advantage of the clause in the ARM ARM that allows us to set
7116              * the COND field in the instruction to 0xE in all cases.
7117              * We could fish the actual condition out of the insn (ARM)
7118              * or the condexec bits (Thumb) but it isn't necessary.
7119              */
7120             switch (cpnum) {
7121             case 14:
7122                 if (is64) {
7123                     syndrome = syn_cp14_rrt_trap(1, 0xe, opc1, crm, rt, rt2,
7124                                                  isread, s->thumb);
7125                 } else {
7126                     syndrome = syn_cp14_rt_trap(1, 0xe, opc1, opc2, crn, crm,
7127                                                 rt, isread, s->thumb);
7128                 }
7129                 break;
7130             case 15:
7131                 if (is64) {
7132                     syndrome = syn_cp15_rrt_trap(1, 0xe, opc1, crm, rt, rt2,
7133                                                  isread, s->thumb);
7134                 } else {
7135                     syndrome = syn_cp15_rt_trap(1, 0xe, opc1, opc2, crn, crm,
7136                                                 rt, isread, s->thumb);
7137                 }
7138                 break;
7139             default:
7140                 /* ARMv8 defines that only coprocessors 14 and 15 exist,
7141                  * so this can only happen if this is an ARMv7 or earlier CPU,
7142                  * in which case the syndrome information won't actually be
7143                  * guest visible.
7144                  */
7145                 assert(!arm_dc_feature(s, ARM_FEATURE_V8));
7146                 syndrome = syn_uncategorized();
7147                 break;
7148             }
7149
7150             gen_set_pc_im(s, s->pc);
7151             tmpptr = tcg_const_ptr(ri);
7152             tcg_syn = tcg_const_i32(syndrome);
7153             gen_helper_access_check_cp_reg(cpu_env, tmpptr, tcg_syn);
7154             tcg_temp_free_ptr(tmpptr);
7155             tcg_temp_free_i32(tcg_syn);
7156         }
7157
7158         /* Handle special cases first */
7159         switch (ri->type & ~(ARM_CP_FLAG_MASK & ~ARM_CP_SPECIAL)) {
7160         case ARM_CP_NOP:
7161             return 0;
7162         case ARM_CP_WFI:
7163             if (isread) {
7164                 return 1;
7165             }
7166             gen_set_pc_im(s, s->pc);
7167             s->is_jmp = DISAS_WFI;
7168             return 0;
7169         default:
7170             break;
7171         }
7172
7173         if ((s->tb->cflags & CF_USE_ICOUNT) && (ri->type & ARM_CP_IO)) {
7174             gen_io_start();
7175         }
7176
7177         if (isread) {
7178             /* Read */
7179             if (is64) {
7180                 TCGv_i64 tmp64;
7181                 TCGv_i32 tmp;
7182                 if (ri->type & ARM_CP_CONST) {
7183                     tmp64 = tcg_const_i64(ri->resetvalue);
7184                 } else if (ri->readfn) {
7185                     TCGv_ptr tmpptr;
7186                     tmp64 = tcg_temp_new_i64();
7187                     tmpptr = tcg_const_ptr(ri);
7188                     gen_helper_get_cp_reg64(tmp64, cpu_env, tmpptr);
7189                     tcg_temp_free_ptr(tmpptr);
7190                 } else {
7191                     tmp64 = tcg_temp_new_i64();
7192                     tcg_gen_ld_i64(tmp64, cpu_env, ri->fieldoffset);
7193                 }
7194                 tmp = tcg_temp_new_i32();
7195                 tcg_gen_trunc_i64_i32(tmp, tmp64);
7196                 store_reg(s, rt, tmp);
7197                 tcg_gen_shri_i64(tmp64, tmp64, 32);
7198                 tmp = tcg_temp_new_i32();
7199                 tcg_gen_trunc_i64_i32(tmp, tmp64);
7200                 tcg_temp_free_i64(tmp64);
7201                 store_reg(s, rt2, tmp);
7202             } else {
7203                 TCGv_i32 tmp;
7204                 if (ri->type & ARM_CP_CONST) {
7205                     tmp = tcg_const_i32(ri->resetvalue);
7206                 } else if (ri->readfn) {
7207                     TCGv_ptr tmpptr;
7208                     tmp = tcg_temp_new_i32();
7209                     tmpptr = tcg_const_ptr(ri);
7210                     gen_helper_get_cp_reg(tmp, cpu_env, tmpptr);
7211                     tcg_temp_free_ptr(tmpptr);
7212                 } else {
7213                     tmp = load_cpu_offset(ri->fieldoffset);
7214                 }
7215                 if (rt == 15) {
7216                     /* Destination register of r15 for 32 bit loads sets
7217                      * the condition codes from the high 4 bits of the value
7218                      */
7219                     gen_set_nzcv(tmp);
7220                     tcg_temp_free_i32(tmp);
7221                 } else {
7222                     store_reg(s, rt, tmp);
7223                 }
7224             }
7225         } else {
7226             /* Write */
7227             if (ri->type & ARM_CP_CONST) {
7228                 /* If not forbidden by access permissions, treat as WI */
7229                 return 0;
7230             }
7231
7232             if (is64) {
7233                 TCGv_i32 tmplo, tmphi;
7234                 TCGv_i64 tmp64 = tcg_temp_new_i64();
7235                 tmplo = load_reg(s, rt);
7236                 tmphi = load_reg(s, rt2);
7237                 tcg_gen_concat_i32_i64(tmp64, tmplo, tmphi);
7238                 tcg_temp_free_i32(tmplo);
7239                 tcg_temp_free_i32(tmphi);
7240                 if (ri->writefn) {
7241                     TCGv_ptr tmpptr = tcg_const_ptr(ri);
7242                     gen_helper_set_cp_reg64(cpu_env, tmpptr, tmp64);
7243                     tcg_temp_free_ptr(tmpptr);
7244                 } else {
7245                     tcg_gen_st_i64(tmp64, cpu_env, ri->fieldoffset);
7246                 }
7247                 tcg_temp_free_i64(tmp64);
7248             } else {
7249                 if (ri->writefn) {
7250                     TCGv_i32 tmp;
7251                     TCGv_ptr tmpptr;
7252                     tmp = load_reg(s, rt);
7253                     tmpptr = tcg_const_ptr(ri);
7254                     gen_helper_set_cp_reg(cpu_env, tmpptr, tmp);
7255                     tcg_temp_free_ptr(tmpptr);
7256                     tcg_temp_free_i32(tmp);
7257                 } else {
7258                     TCGv_i32 tmp = load_reg(s, rt);
7259                     store_cpu_offset(tmp, ri->fieldoffset);
7260                 }
7261             }
7262         }
7263
7264         if ((s->tb->cflags & CF_USE_ICOUNT) && (ri->type & ARM_CP_IO)) {
7265             /* I/O operations must end the TB here (whether read or write) */
7266             gen_io_end();
7267             gen_lookup_tb(s);
7268         } else if (!isread && !(ri->type & ARM_CP_SUPPRESS_TB_END)) {
7269             /* We default to ending the TB on a coprocessor register write,
7270              * but allow this to be suppressed by the register definition
7271              * (usually only necessary to work around guest bugs).
7272              */
7273             gen_lookup_tb(s);
7274         }
7275
7276         return 0;
7277     }
7278
7279     /* Unknown register; this might be a guest error or a QEMU
7280      * unimplemented feature.
7281      */
7282     if (is64) {
7283         qemu_log_mask(LOG_UNIMP, "%s access to unsupported AArch32 "
7284                       "64 bit system register cp:%d opc1: %d crm:%d "
7285                       "(%s)\n",
7286                       isread ? "read" : "write", cpnum, opc1, crm,
7287                       s->ns ? "non-secure" : "secure");
7288     } else {
7289         qemu_log_mask(LOG_UNIMP, "%s access to unsupported AArch32 "
7290                       "system register cp:%d opc1:%d crn:%d crm:%d opc2:%d "
7291                       "(%s)\n",
7292                       isread ? "read" : "write", cpnum, opc1, crn, crm, opc2,
7293                       s->ns ? "non-secure" : "secure");
7294     }
7295
7296     return 1;
7297 }
7298
7299
7300 /* Store a 64-bit value to a register pair.  Clobbers val.  */
7301 static void gen_storeq_reg(DisasContext *s, int rlow, int rhigh, TCGv_i64 val)
7302 {
7303     TCGv_i32 tmp;
7304     tmp = tcg_temp_new_i32();
7305     tcg_gen_trunc_i64_i32(tmp, val);
7306     store_reg(s, rlow, tmp);
7307     tmp = tcg_temp_new_i32();
7308     tcg_gen_shri_i64(val, val, 32);
7309     tcg_gen_trunc_i64_i32(tmp, val);
7310     store_reg(s, rhigh, tmp);
7311 }
7312
7313 /* load a 32-bit value from a register and perform a 64-bit accumulate.  */
7314 static void gen_addq_lo(DisasContext *s, TCGv_i64 val, int rlow)
7315 {
7316     TCGv_i64 tmp;
7317     TCGv_i32 tmp2;
7318
7319     /* Load value and extend to 64 bits.  */
7320     tmp = tcg_temp_new_i64();
7321     tmp2 = load_reg(s, rlow);
7322     tcg_gen_extu_i32_i64(tmp, tmp2);
7323     tcg_temp_free_i32(tmp2);
7324     tcg_gen_add_i64(val, val, tmp);
7325     tcg_temp_free_i64(tmp);
7326 }
7327
7328 /* load and add a 64-bit value from a register pair.  */
7329 static void gen_addq(DisasContext *s, TCGv_i64 val, int rlow, int rhigh)
7330 {
7331     TCGv_i64 tmp;
7332     TCGv_i32 tmpl;
7333     TCGv_i32 tmph;
7334
7335     /* Load 64-bit value rd:rn.  */
7336     tmpl = load_reg(s, rlow);
7337     tmph = load_reg(s, rhigh);
7338     tmp = tcg_temp_new_i64();
7339     tcg_gen_concat_i32_i64(tmp, tmpl, tmph);
7340     tcg_temp_free_i32(tmpl);
7341     tcg_temp_free_i32(tmph);
7342     tcg_gen_add_i64(val, val, tmp);
7343     tcg_temp_free_i64(tmp);
7344 }
7345
7346 /* Set N and Z flags from hi|lo.  */
7347 static void gen_logicq_cc(TCGv_i32 lo, TCGv_i32 hi)
7348 {
7349     tcg_gen_mov_i32(cpu_NF, hi);
7350     tcg_gen_or_i32(cpu_ZF, lo, hi);
7351 }
7352
7353 /* Load/Store exclusive instructions are implemented by remembering
7354    the value/address loaded, and seeing if these are the same
7355    when the store is performed. This should be sufficient to implement
7356    the architecturally mandated semantics, and avoids having to monitor
7357    regular stores.
7358
7359    In system emulation mode only one CPU will be running at once, so
7360    this sequence is effectively atomic.  In user emulation mode we
7361    throw an exception and handle the atomic operation elsewhere.  */
7362 static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
7363                                TCGv_i32 addr, int size)
7364 {
7365     TCGv_i32 tmp = tcg_temp_new_i32();
7366
7367     s->is_ldex = true;
7368
7369     switch (size) {
7370     case 0:
7371         gen_aa32_ld8u(tmp, addr, get_mem_index(s));
7372         break;
7373     case 1:
7374         gen_aa32_ld16u(tmp, addr, get_mem_index(s));
7375         break;
7376     case 2:
7377     case 3:
7378         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
7379         break;
7380     default:
7381         abort();
7382     }
7383
7384     if (size == 3) {
7385         TCGv_i32 tmp2 = tcg_temp_new_i32();
7386         TCGv_i32 tmp3 = tcg_temp_new_i32();
7387
7388         tcg_gen_addi_i32(tmp2, addr, 4);
7389         gen_aa32_ld32u(tmp3, tmp2, get_mem_index(s));
7390         tcg_temp_free_i32(tmp2);
7391         tcg_gen_concat_i32_i64(cpu_exclusive_val, tmp, tmp3);
7392         store_reg(s, rt2, tmp3);
7393     } else {
7394         tcg_gen_extu_i32_i64(cpu_exclusive_val, tmp);
7395     }
7396
7397     store_reg(s, rt, tmp);
7398     tcg_gen_extu_i32_i64(cpu_exclusive_addr, addr);
7399 }
7400
7401 static void gen_clrex(DisasContext *s)
7402 {
7403     tcg_gen_movi_i64(cpu_exclusive_addr, -1);
7404 }
7405
7406 #ifdef CONFIG_USER_ONLY
7407 static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
7408                                 TCGv_i32 addr, int size)
7409 {
7410     tcg_gen_extu_i32_i64(cpu_exclusive_test, addr);
7411     tcg_gen_movi_i32(cpu_exclusive_info,
7412                      size | (rd << 4) | (rt << 8) | (rt2 << 12));
7413     gen_exception_internal_insn(s, 4, EXCP_STREX);
7414 }
7415 #else
7416 static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
7417                                 TCGv_i32 addr, int size)
7418 {
7419     TCGv_i32 tmp;
7420     TCGv_i64 val64, extaddr;
7421     int done_label;
7422     int fail_label;
7423
7424     /* if (env->exclusive_addr == addr && env->exclusive_val == [addr]) {
7425          [addr] = {Rt};
7426          {Rd} = 0;
7427        } else {
7428          {Rd} = 1;
7429        } */
7430     fail_label = gen_new_label();
7431     done_label = gen_new_label();
7432     extaddr = tcg_temp_new_i64();
7433     tcg_gen_extu_i32_i64(extaddr, addr);
7434     tcg_gen_brcond_i64(TCG_COND_NE, extaddr, cpu_exclusive_addr, fail_label);
7435     tcg_temp_free_i64(extaddr);
7436
7437     tmp = tcg_temp_new_i32();
7438     switch (size) {
7439     case 0:
7440         gen_aa32_ld8u(tmp, addr, get_mem_index(s));
7441         break;
7442     case 1:
7443         gen_aa32_ld16u(tmp, addr, get_mem_index(s));
7444         break;
7445     case 2:
7446     case 3:
7447         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
7448         break;
7449     default:
7450         abort();
7451     }
7452
7453     val64 = tcg_temp_new_i64();
7454     if (size == 3) {
7455         TCGv_i32 tmp2 = tcg_temp_new_i32();
7456         TCGv_i32 tmp3 = tcg_temp_new_i32();
7457         tcg_gen_addi_i32(tmp2, addr, 4);
7458         gen_aa32_ld32u(tmp3, tmp2, get_mem_index(s));
7459         tcg_temp_free_i32(tmp2);
7460         tcg_gen_concat_i32_i64(val64, tmp, tmp3);
7461         tcg_temp_free_i32(tmp3);
7462     } else {
7463         tcg_gen_extu_i32_i64(val64, tmp);
7464     }
7465     tcg_temp_free_i32(tmp);
7466
7467     tcg_gen_brcond_i64(TCG_COND_NE, val64, cpu_exclusive_val, fail_label);
7468     tcg_temp_free_i64(val64);
7469
7470     tmp = load_reg(s, rt);
7471     switch (size) {
7472     case 0:
7473         gen_aa32_st8(tmp, addr, get_mem_index(s));
7474         break;
7475     case 1:
7476         gen_aa32_st16(tmp, addr, get_mem_index(s));
7477         break;
7478     case 2:
7479     case 3:
7480         gen_aa32_st32(tmp, addr, get_mem_index(s));
7481         break;
7482     default:
7483         abort();
7484     }
7485     tcg_temp_free_i32(tmp);
7486     if (size == 3) {
7487         tcg_gen_addi_i32(addr, addr, 4);
7488         tmp = load_reg(s, rt2);
7489         gen_aa32_st32(tmp, addr, get_mem_index(s));
7490         tcg_temp_free_i32(tmp);
7491     }
7492     tcg_gen_movi_i32(cpu_R[rd], 0);
7493     tcg_gen_br(done_label);
7494     gen_set_label(fail_label);
7495     tcg_gen_movi_i32(cpu_R[rd], 1);
7496     gen_set_label(done_label);
7497     tcg_gen_movi_i64(cpu_exclusive_addr, -1);
7498 }
7499 #endif
7500
7501 /* gen_srs:
7502  * @env: CPUARMState
7503  * @s: DisasContext
7504  * @mode: mode field from insn (which stack to store to)
7505  * @amode: addressing mode (DA/IA/DB/IB), encoded as per P,U bits in ARM insn
7506  * @writeback: true if writeback bit set
7507  *
7508  * Generate code for the SRS (Store Return State) insn.
7509  */
7510 static void gen_srs(DisasContext *s,
7511                     uint32_t mode, uint32_t amode, bool writeback)
7512 {
7513     int32_t offset;
7514     TCGv_i32 addr = tcg_temp_new_i32();
7515     TCGv_i32 tmp = tcg_const_i32(mode);
7516     gen_helper_get_r13_banked(addr, cpu_env, tmp);
7517     tcg_temp_free_i32(tmp);
7518     switch (amode) {
7519     case 0: /* DA */
7520         offset = -4;
7521         break;
7522     case 1: /* IA */
7523         offset = 0;
7524         break;
7525     case 2: /* DB */
7526         offset = -8;
7527         break;
7528     case 3: /* IB */
7529         offset = 4;
7530         break;
7531     default:
7532         abort();
7533     }
7534     tcg_gen_addi_i32(addr, addr, offset);
7535     tmp = load_reg(s, 14);
7536     gen_aa32_st32(tmp, addr, get_mem_index(s));
7537     tcg_temp_free_i32(tmp);
7538     tmp = load_cpu_field(spsr);
7539     tcg_gen_addi_i32(addr, addr, 4);
7540     gen_aa32_st32(tmp, addr, get_mem_index(s));
7541     tcg_temp_free_i32(tmp);
7542     if (writeback) {
7543         switch (amode) {
7544         case 0:
7545             offset = -8;
7546             break;
7547         case 1:
7548             offset = 4;
7549             break;
7550         case 2:
7551             offset = -4;
7552             break;
7553         case 3:
7554             offset = 0;
7555             break;
7556         default:
7557             abort();
7558         }
7559         tcg_gen_addi_i32(addr, addr, offset);
7560         tmp = tcg_const_i32(mode);
7561         gen_helper_set_r13_banked(cpu_env, tmp, addr);
7562         tcg_temp_free_i32(tmp);
7563     }
7564     tcg_temp_free_i32(addr);
7565 }
7566
7567 static void disas_arm_insn(DisasContext *s, unsigned int insn)
7568 {
7569     unsigned int cond, val, op1, i, shift, rm, rs, rn, rd, sh;
7570     TCGv_i32 tmp;
7571     TCGv_i32 tmp2;
7572     TCGv_i32 tmp3;
7573     TCGv_i32 addr;
7574     TCGv_i64 tmp64;
7575
7576     /* M variants do not implement ARM mode.  */
7577     if (arm_dc_feature(s, ARM_FEATURE_M)) {
7578         goto illegal_op;
7579     }
7580     cond = insn >> 28;
7581     if (cond == 0xf){
7582         /* In ARMv3 and v4 the NV condition is UNPREDICTABLE; we
7583          * choose to UNDEF. In ARMv5 and above the space is used
7584          * for miscellaneous unconditional instructions.
7585          */
7586         ARCH(5);
7587
7588         /* Unconditional instructions.  */
7589         if (((insn >> 25) & 7) == 1) {
7590             /* NEON Data processing.  */
7591             if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
7592                 goto illegal_op;
7593             }
7594
7595             if (disas_neon_data_insn(s, insn)) {
7596                 goto illegal_op;
7597             }
7598             return;
7599         }
7600         if ((insn & 0x0f100000) == 0x04000000) {
7601             /* NEON load/store.  */
7602             if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
7603                 goto illegal_op;
7604             }
7605
7606             if (disas_neon_ls_insn(s, insn)) {
7607                 goto illegal_op;
7608             }
7609             return;
7610         }
7611         if ((insn & 0x0f000e10) == 0x0e000a00) {
7612             /* VFP.  */
7613             if (disas_vfp_insn(s, insn)) {
7614                 goto illegal_op;
7615             }
7616             return;
7617         }
7618         if (((insn & 0x0f30f000) == 0x0510f000) ||
7619             ((insn & 0x0f30f010) == 0x0710f000)) {
7620             if ((insn & (1 << 22)) == 0) {
7621                 /* PLDW; v7MP */
7622                 if (!arm_dc_feature(s, ARM_FEATURE_V7MP)) {
7623                     goto illegal_op;
7624                 }
7625             }
7626             /* Otherwise PLD; v5TE+ */
7627             ARCH(5TE);
7628             return;
7629         }
7630         if (((insn & 0x0f70f000) == 0x0450f000) ||
7631             ((insn & 0x0f70f010) == 0x0650f000)) {
7632             ARCH(7);
7633             return; /* PLI; V7 */
7634         }
7635         if (((insn & 0x0f700000) == 0x04100000) ||
7636             ((insn & 0x0f700010) == 0x06100000)) {
7637             if (!arm_dc_feature(s, ARM_FEATURE_V7MP)) {
7638                 goto illegal_op;
7639             }
7640             return; /* v7MP: Unallocated memory hint: must NOP */
7641         }
7642
7643         if ((insn & 0x0ffffdff) == 0x01010000) {
7644             ARCH(6);
7645             /* setend */
7646             if (((insn >> 9) & 1) != s->bswap_code) {
7647                 /* Dynamic endianness switching not implemented. */
7648                 qemu_log_mask(LOG_UNIMP, "arm: unimplemented setend\n");
7649                 goto illegal_op;
7650             }
7651             return;
7652         } else if ((insn & 0x0fffff00) == 0x057ff000) {
7653             switch ((insn >> 4) & 0xf) {
7654             case 1: /* clrex */
7655                 ARCH(6K);
7656                 gen_clrex(s);
7657                 return;
7658             case 4: /* dsb */
7659             case 5: /* dmb */
7660             case 6: /* isb */
7661                 ARCH(7);
7662                 /* We don't emulate caches so these are a no-op.  */
7663                 return;
7664             default:
7665                 goto illegal_op;
7666             }
7667         } else if ((insn & 0x0e5fffe0) == 0x084d0500) {
7668             /* srs */
7669             if (IS_USER(s)) {
7670                 goto illegal_op;
7671             }
7672             ARCH(6);
7673             gen_srs(s, (insn & 0x1f), (insn >> 23) & 3, insn & (1 << 21));
7674             return;
7675         } else if ((insn & 0x0e50ffe0) == 0x08100a00) {
7676             /* rfe */
7677             int32_t offset;
7678             if (IS_USER(s))
7679                 goto illegal_op;
7680             ARCH(6);
7681             rn = (insn >> 16) & 0xf;
7682             addr = load_reg(s, rn);
7683             i = (insn >> 23) & 3;
7684             switch (i) {
7685             case 0: offset = -4; break; /* DA */
7686             case 1: offset = 0; break; /* IA */
7687             case 2: offset = -8; break; /* DB */
7688             case 3: offset = 4; break; /* IB */
7689             default: abort();
7690             }
7691             if (offset)
7692                 tcg_gen_addi_i32(addr, addr, offset);
7693             /* Load PC into tmp and CPSR into tmp2.  */
7694             tmp = tcg_temp_new_i32();
7695             gen_aa32_ld32u(tmp, addr, get_mem_index(s));
7696             tcg_gen_addi_i32(addr, addr, 4);
7697             tmp2 = tcg_temp_new_i32();
7698             gen_aa32_ld32u(tmp2, addr, get_mem_index(s));
7699             if (insn & (1 << 21)) {
7700                 /* Base writeback.  */
7701                 switch (i) {
7702                 case 0: offset = -8; break;
7703                 case 1: offset = 4; break;
7704                 case 2: offset = -4; break;
7705                 case 3: offset = 0; break;
7706                 default: abort();
7707                 }
7708                 if (offset)
7709                     tcg_gen_addi_i32(addr, addr, offset);
7710                 store_reg(s, rn, addr);
7711             } else {
7712                 tcg_temp_free_i32(addr);
7713             }
7714             gen_rfe(s, tmp, tmp2);
7715             return;
7716         } else if ((insn & 0x0e000000) == 0x0a000000) {
7717             /* branch link and change to thumb (blx <offset>) */
7718             int32_t offset;
7719
7720             val = (uint32_t)s->pc;
7721             tmp = tcg_temp_new_i32();
7722             tcg_gen_movi_i32(tmp, val);
7723             store_reg(s, 14, tmp);
7724             /* Sign-extend the 24-bit offset */
7725             offset = (((int32_t)insn) << 8) >> 8;
7726             /* offset * 4 + bit24 * 2 + (thumb bit) */
7727             val += (offset << 2) | ((insn >> 23) & 2) | 1;
7728             /* pipeline offset */
7729             val += 4;
7730             /* protected by ARCH(5); above, near the start of uncond block */
7731             gen_bx_im(s, val);
7732             return;
7733         } else if ((insn & 0x0e000f00) == 0x0c000100) {
7734             if (arm_dc_feature(s, ARM_FEATURE_IWMMXT)) {
7735                 /* iWMMXt register transfer.  */
7736                 if (extract32(s->c15_cpar, 1, 1)) {
7737                     if (!disas_iwmmxt_insn(s, insn)) {
7738                         return;
7739                     }
7740                 }
7741             }
7742         } else if ((insn & 0x0fe00000) == 0x0c400000) {
7743             /* Coprocessor double register transfer.  */
7744             ARCH(5TE);
7745         } else if ((insn & 0x0f000010) == 0x0e000010) {
7746             /* Additional coprocessor register transfer.  */
7747         } else if ((insn & 0x0ff10020) == 0x01000000) {
7748             uint32_t mask;
7749             uint32_t val;
7750             /* cps (privileged) */
7751             if (IS_USER(s))
7752                 return;
7753             mask = val = 0;
7754             if (insn & (1 << 19)) {
7755                 if (insn & (1 << 8))
7756                     mask |= CPSR_A;
7757                 if (insn & (1 << 7))
7758                     mask |= CPSR_I;
7759                 if (insn & (1 << 6))
7760                     mask |= CPSR_F;
7761                 if (insn & (1 << 18))
7762                     val |= mask;
7763             }
7764             if (insn & (1 << 17)) {
7765                 mask |= CPSR_M;
7766                 val |= (insn & 0x1f);
7767             }
7768             if (mask) {
7769                 gen_set_psr_im(s, mask, 0, val);
7770             }
7771             return;
7772         }
7773         goto illegal_op;
7774     }
7775     if (cond != 0xe) {
7776         /* if not always execute, we generate a conditional jump to
7777            next instruction */
7778         s->condlabel = gen_new_label();
7779         arm_gen_test_cc(cond ^ 1, s->condlabel);
7780         s->condjmp = 1;
7781     }
7782     if ((insn & 0x0f900000) == 0x03000000) {
7783         if ((insn & (1 << 21)) == 0) {
7784             ARCH(6T2);
7785             rd = (insn >> 12) & 0xf;
7786             val = ((insn >> 4) & 0xf000) | (insn & 0xfff);
7787             if ((insn & (1 << 22)) == 0) {
7788                 /* MOVW */
7789                 tmp = tcg_temp_new_i32();
7790                 tcg_gen_movi_i32(tmp, val);
7791             } else {
7792                 /* MOVT */
7793                 tmp = load_reg(s, rd);
7794                 tcg_gen_ext16u_i32(tmp, tmp);
7795                 tcg_gen_ori_i32(tmp, tmp, val << 16);
7796             }
7797             store_reg(s, rd, tmp);
7798         } else {
7799             if (((insn >> 12) & 0xf) != 0xf)
7800                 goto illegal_op;
7801             if (((insn >> 16) & 0xf) == 0) {
7802                 gen_nop_hint(s, insn & 0xff);
7803             } else {
7804                 /* CPSR = immediate */
7805                 val = insn & 0xff;
7806                 shift = ((insn >> 8) & 0xf) * 2;
7807                 if (shift)
7808                     val = (val >> shift) | (val << (32 - shift));
7809                 i = ((insn & (1 << 22)) != 0);
7810                 if (gen_set_psr_im(s, msr_mask(s, (insn >> 16) & 0xf, i),
7811                                    i, val)) {
7812                     goto illegal_op;
7813                 }
7814             }
7815         }
7816     } else if ((insn & 0x0f900000) == 0x01000000
7817                && (insn & 0x00000090) != 0x00000090) {
7818         /* miscellaneous instructions */
7819         op1 = (insn >> 21) & 3;
7820         sh = (insn >> 4) & 0xf;
7821         rm = insn & 0xf;
7822         switch (sh) {
7823         case 0x0: /* move program status register */
7824             if (op1 & 1) {
7825                 /* PSR = reg */
7826                 tmp = load_reg(s, rm);
7827                 i = ((op1 & 2) != 0);
7828                 if (gen_set_psr(s, msr_mask(s, (insn >> 16) & 0xf, i), i, tmp))
7829                     goto illegal_op;
7830             } else {
7831                 /* reg = PSR */
7832                 rd = (insn >> 12) & 0xf;
7833                 if (op1 & 2) {
7834                     if (IS_USER(s))
7835                         goto illegal_op;
7836                     tmp = load_cpu_field(spsr);
7837                 } else {
7838                     tmp = tcg_temp_new_i32();
7839                     gen_helper_cpsr_read(tmp, cpu_env);
7840                 }
7841                 store_reg(s, rd, tmp);
7842             }
7843             break;
7844         case 0x1:
7845             if (op1 == 1) {
7846                 /* branch/exchange thumb (bx).  */
7847                 ARCH(4T);
7848                 tmp = load_reg(s, rm);
7849                 gen_bx(s, tmp);
7850             } else if (op1 == 3) {
7851                 /* clz */
7852                 ARCH(5);
7853                 rd = (insn >> 12) & 0xf;
7854                 tmp = load_reg(s, rm);
7855                 gen_helper_clz(tmp, tmp);
7856                 store_reg(s, rd, tmp);
7857             } else {
7858                 goto illegal_op;
7859             }
7860             break;
7861         case 0x2:
7862             if (op1 == 1) {
7863                 ARCH(5J); /* bxj */
7864                 /* Trivial implementation equivalent to bx.  */
7865                 tmp = load_reg(s, rm);
7866                 gen_bx(s, tmp);
7867             } else {
7868                 goto illegal_op;
7869             }
7870             break;
7871         case 0x3:
7872             if (op1 != 1)
7873               goto illegal_op;
7874
7875             ARCH(5);
7876             /* branch link/exchange thumb (blx) */
7877             tmp = load_reg(s, rm);
7878             tmp2 = tcg_temp_new_i32();
7879             tcg_gen_movi_i32(tmp2, s->pc);
7880             store_reg(s, 14, tmp2);
7881             gen_bx(s, tmp);
7882             break;
7883         case 0x4:
7884         {
7885             /* crc32/crc32c */
7886             uint32_t c = extract32(insn, 8, 4);
7887
7888             /* Check this CPU supports ARMv8 CRC instructions.
7889              * op1 == 3 is UNPREDICTABLE but handle as UNDEFINED.
7890              * Bits 8, 10 and 11 should be zero.
7891              */
7892             if (!arm_dc_feature(s, ARM_FEATURE_CRC) || op1 == 0x3 ||
7893                 (c & 0xd) != 0) {
7894                 goto illegal_op;
7895             }
7896
7897             rn = extract32(insn, 16, 4);
7898             rd = extract32(insn, 12, 4);
7899
7900             tmp = load_reg(s, rn);
7901             tmp2 = load_reg(s, rm);
7902             if (op1 == 0) {
7903                 tcg_gen_andi_i32(tmp2, tmp2, 0xff);
7904             } else if (op1 == 1) {
7905                 tcg_gen_andi_i32(tmp2, tmp2, 0xffff);
7906             }
7907             tmp3 = tcg_const_i32(1 << op1);
7908             if (c & 0x2) {
7909                 gen_helper_crc32c(tmp, tmp, tmp2, tmp3);
7910             } else {
7911                 gen_helper_crc32(tmp, tmp, tmp2, tmp3);
7912             }
7913             tcg_temp_free_i32(tmp2);
7914             tcg_temp_free_i32(tmp3);
7915             store_reg(s, rd, tmp);
7916             break;
7917         }
7918         case 0x5: /* saturating add/subtract */
7919             ARCH(5TE);
7920             rd = (insn >> 12) & 0xf;
7921             rn = (insn >> 16) & 0xf;
7922             tmp = load_reg(s, rm);
7923             tmp2 = load_reg(s, rn);
7924             if (op1 & 2)
7925                 gen_helper_double_saturate(tmp2, cpu_env, tmp2);
7926             if (op1 & 1)
7927                 gen_helper_sub_saturate(tmp, cpu_env, tmp, tmp2);
7928             else
7929                 gen_helper_add_saturate(tmp, cpu_env, tmp, tmp2);
7930             tcg_temp_free_i32(tmp2);
7931             store_reg(s, rd, tmp);
7932             break;
7933         case 7:
7934         {
7935             int imm16 = extract32(insn, 0, 4) | (extract32(insn, 8, 12) << 4);
7936             switch (op1) {
7937             case 1:
7938                 /* bkpt */
7939                 ARCH(5);
7940                 gen_exception_insn(s, 4, EXCP_BKPT,
7941                                    syn_aa32_bkpt(imm16, false));
7942                 break;
7943             case 2:
7944                 /* Hypervisor call (v7) */
7945                 ARCH(7);
7946                 if (IS_USER(s)) {
7947                     goto illegal_op;
7948                 }
7949                 gen_hvc(s, imm16);
7950                 break;
7951             case 3:
7952                 /* Secure monitor call (v6+) */
7953                 ARCH(6K);
7954                 if (IS_USER(s)) {
7955                     goto illegal_op;
7956                 }
7957                 gen_smc(s);
7958                 break;
7959             default:
7960                 goto illegal_op;
7961             }
7962             break;
7963         }
7964         case 0x8: /* signed multiply */
7965         case 0xa:
7966         case 0xc:
7967         case 0xe:
7968             ARCH(5TE);
7969             rs = (insn >> 8) & 0xf;
7970             rn = (insn >> 12) & 0xf;
7971             rd = (insn >> 16) & 0xf;
7972             if (op1 == 1) {
7973                 /* (32 * 16) >> 16 */
7974                 tmp = load_reg(s, rm);
7975                 tmp2 = load_reg(s, rs);
7976                 if (sh & 4)
7977                     tcg_gen_sari_i32(tmp2, tmp2, 16);
7978                 else
7979                     gen_sxth(tmp2);
7980                 tmp64 = gen_muls_i64_i32(tmp, tmp2);
7981                 tcg_gen_shri_i64(tmp64, tmp64, 16);
7982                 tmp = tcg_temp_new_i32();
7983                 tcg_gen_trunc_i64_i32(tmp, tmp64);
7984                 tcg_temp_free_i64(tmp64);
7985                 if ((sh & 2) == 0) {
7986                     tmp2 = load_reg(s, rn);
7987                     gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
7988                     tcg_temp_free_i32(tmp2);
7989                 }
7990                 store_reg(s, rd, tmp);
7991             } else {
7992                 /* 16 * 16 */
7993                 tmp = load_reg(s, rm);
7994                 tmp2 = load_reg(s, rs);
7995                 gen_mulxy(tmp, tmp2, sh & 2, sh & 4);
7996                 tcg_temp_free_i32(tmp2);
7997                 if (op1 == 2) {
7998                     tmp64 = tcg_temp_new_i64();
7999                     tcg_gen_ext_i32_i64(tmp64, tmp);
8000                     tcg_temp_free_i32(tmp);
8001                     gen_addq(s, tmp64, rn, rd);
8002                     gen_storeq_reg(s, rn, rd, tmp64);
8003                     tcg_temp_free_i64(tmp64);
8004                 } else {
8005                     if (op1 == 0) {
8006                         tmp2 = load_reg(s, rn);
8007                         gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
8008                         tcg_temp_free_i32(tmp2);
8009                     }
8010                     store_reg(s, rd, tmp);
8011                 }
8012             }
8013             break;
8014         default:
8015             goto illegal_op;
8016         }
8017     } else if (((insn & 0x0e000000) == 0 &&
8018                 (insn & 0x00000090) != 0x90) ||
8019                ((insn & 0x0e000000) == (1 << 25))) {
8020         int set_cc, logic_cc, shiftop;
8021
8022         op1 = (insn >> 21) & 0xf;
8023         set_cc = (insn >> 20) & 1;
8024         logic_cc = table_logic_cc[op1] & set_cc;
8025
8026         /* data processing instruction */
8027         if (insn & (1 << 25)) {
8028             /* immediate operand */
8029             val = insn & 0xff;
8030             shift = ((insn >> 8) & 0xf) * 2;
8031             if (shift) {
8032                 val = (val >> shift) | (val << (32 - shift));
8033             }
8034             tmp2 = tcg_temp_new_i32();
8035             tcg_gen_movi_i32(tmp2, val);
8036             if (logic_cc && shift) {
8037                 gen_set_CF_bit31(tmp2);
8038             }
8039         } else {
8040             /* register */
8041             rm = (insn) & 0xf;
8042             tmp2 = load_reg(s, rm);
8043             shiftop = (insn >> 5) & 3;
8044             if (!(insn & (1 << 4))) {
8045                 shift = (insn >> 7) & 0x1f;
8046                 gen_arm_shift_im(tmp2, shiftop, shift, logic_cc);
8047             } else {
8048                 rs = (insn >> 8) & 0xf;
8049                 tmp = load_reg(s, rs);
8050                 gen_arm_shift_reg(tmp2, shiftop, tmp, logic_cc);
8051             }
8052         }
8053         if (op1 != 0x0f && op1 != 0x0d) {
8054             rn = (insn >> 16) & 0xf;
8055             tmp = load_reg(s, rn);
8056         } else {
8057             TCGV_UNUSED_I32(tmp);
8058         }
8059         rd = (insn >> 12) & 0xf;
8060         switch(op1) {
8061         case 0x00:
8062             tcg_gen_and_i32(tmp, tmp, tmp2);
8063             if (logic_cc) {
8064                 gen_logic_CC(tmp);
8065             }
8066             store_reg_bx(s, rd, tmp);
8067             break;
8068         case 0x01:
8069             tcg_gen_xor_i32(tmp, tmp, tmp2);
8070             if (logic_cc) {
8071                 gen_logic_CC(tmp);
8072             }
8073             store_reg_bx(s, rd, tmp);
8074             break;
8075         case 0x02:
8076             if (set_cc && rd == 15) {
8077                 /* SUBS r15, ... is used for exception return.  */
8078                 if (IS_USER(s)) {
8079                     goto illegal_op;
8080                 }
8081                 gen_sub_CC(tmp, tmp, tmp2);
8082                 gen_exception_return(s, tmp);
8083             } else {
8084                 if (set_cc) {
8085                     gen_sub_CC(tmp, tmp, tmp2);
8086                 } else {
8087                     tcg_gen_sub_i32(tmp, tmp, tmp2);
8088                 }
8089                 store_reg_bx(s, rd, tmp);
8090             }
8091             break;
8092         case 0x03:
8093             if (set_cc) {
8094                 gen_sub_CC(tmp, tmp2, tmp);
8095             } else {
8096                 tcg_gen_sub_i32(tmp, tmp2, tmp);
8097             }
8098             store_reg_bx(s, rd, tmp);
8099             break;
8100         case 0x04:
8101             if (set_cc) {
8102                 gen_add_CC(tmp, tmp, tmp2);
8103             } else {
8104                 tcg_gen_add_i32(tmp, tmp, tmp2);
8105             }
8106             store_reg_bx(s, rd, tmp);
8107             break;
8108         case 0x05:
8109             if (set_cc) {
8110                 gen_adc_CC(tmp, tmp, tmp2);
8111             } else {
8112                 gen_add_carry(tmp, tmp, tmp2);
8113             }
8114             store_reg_bx(s, rd, tmp);
8115             break;
8116         case 0x06:
8117             if (set_cc) {
8118                 gen_sbc_CC(tmp, tmp, tmp2);
8119             } else {
8120                 gen_sub_carry(tmp, tmp, tmp2);
8121             }
8122             store_reg_bx(s, rd, tmp);
8123             break;
8124         case 0x07:
8125             if (set_cc) {
8126                 gen_sbc_CC(tmp, tmp2, tmp);
8127             } else {
8128                 gen_sub_carry(tmp, tmp2, tmp);
8129             }
8130             store_reg_bx(s, rd, tmp);
8131             break;
8132         case 0x08:
8133             if (set_cc) {
8134                 tcg_gen_and_i32(tmp, tmp, tmp2);
8135                 gen_logic_CC(tmp);
8136             }
8137             tcg_temp_free_i32(tmp);
8138             break;
8139         case 0x09:
8140             if (set_cc) {
8141                 tcg_gen_xor_i32(tmp, tmp, tmp2);
8142                 gen_logic_CC(tmp);
8143             }
8144             tcg_temp_free_i32(tmp);
8145             break;
8146         case 0x0a:
8147             if (set_cc) {
8148                 gen_sub_CC(tmp, tmp, tmp2);
8149             }
8150             tcg_temp_free_i32(tmp);
8151             break;
8152         case 0x0b:
8153             if (set_cc) {
8154                 gen_add_CC(tmp, tmp, tmp2);
8155             }
8156             tcg_temp_free_i32(tmp);
8157             break;
8158         case 0x0c:
8159             tcg_gen_or_i32(tmp, tmp, tmp2);
8160             if (logic_cc) {
8161                 gen_logic_CC(tmp);
8162             }
8163             store_reg_bx(s, rd, tmp);
8164             break;
8165         case 0x0d:
8166             if (logic_cc && rd == 15) {
8167                 /* MOVS r15, ... is used for exception return.  */
8168                 if (IS_USER(s)) {
8169                     goto illegal_op;
8170                 }
8171                 gen_exception_return(s, tmp2);
8172             } else {
8173                 if (logic_cc) {
8174                     gen_logic_CC(tmp2);
8175                 }
8176                 store_reg_bx(s, rd, tmp2);
8177             }
8178             break;
8179         case 0x0e:
8180             tcg_gen_andc_i32(tmp, tmp, tmp2);
8181             if (logic_cc) {
8182                 gen_logic_CC(tmp);
8183             }
8184             store_reg_bx(s, rd, tmp);
8185             break;
8186         default:
8187         case 0x0f:
8188             tcg_gen_not_i32(tmp2, tmp2);
8189             if (logic_cc) {
8190                 gen_logic_CC(tmp2);
8191             }
8192             store_reg_bx(s, rd, tmp2);
8193             break;
8194         }
8195         if (op1 != 0x0f && op1 != 0x0d) {
8196             tcg_temp_free_i32(tmp2);
8197         }
8198     } else {
8199         /* other instructions */
8200         op1 = (insn >> 24) & 0xf;
8201         switch(op1) {
8202         case 0x0:
8203         case 0x1:
8204             /* multiplies, extra load/stores */
8205             sh = (insn >> 5) & 3;
8206             if (sh == 0) {
8207                 if (op1 == 0x0) {
8208                     rd = (insn >> 16) & 0xf;
8209                     rn = (insn >> 12) & 0xf;
8210                     rs = (insn >> 8) & 0xf;
8211                     rm = (insn) & 0xf;
8212                     op1 = (insn >> 20) & 0xf;
8213                     switch (op1) {
8214                     case 0: case 1: case 2: case 3: case 6:
8215                         /* 32 bit mul */
8216                         tmp = load_reg(s, rs);
8217                         tmp2 = load_reg(s, rm);
8218                         tcg_gen_mul_i32(tmp, tmp, tmp2);
8219                         tcg_temp_free_i32(tmp2);
8220                         if (insn & (1 << 22)) {
8221                             /* Subtract (mls) */
8222                             ARCH(6T2);
8223                             tmp2 = load_reg(s, rn);
8224                             tcg_gen_sub_i32(tmp, tmp2, tmp);
8225                             tcg_temp_free_i32(tmp2);
8226                         } else if (insn & (1 << 21)) {
8227                             /* Add */
8228                             tmp2 = load_reg(s, rn);
8229                             tcg_gen_add_i32(tmp, tmp, tmp2);
8230                             tcg_temp_free_i32(tmp2);
8231                         }
8232                         if (insn & (1 << 20))
8233                             gen_logic_CC(tmp);
8234                         store_reg(s, rd, tmp);
8235                         break;
8236                     case 4:
8237                         /* 64 bit mul double accumulate (UMAAL) */
8238                         ARCH(6);
8239                         tmp = load_reg(s, rs);
8240                         tmp2 = load_reg(s, rm);
8241                         tmp64 = gen_mulu_i64_i32(tmp, tmp2);
8242                         gen_addq_lo(s, tmp64, rn);
8243                         gen_addq_lo(s, tmp64, rd);
8244                         gen_storeq_reg(s, rn, rd, tmp64);
8245                         tcg_temp_free_i64(tmp64);
8246                         break;
8247                     case 8: case 9: case 10: case 11:
8248                     case 12: case 13: case 14: case 15:
8249                         /* 64 bit mul: UMULL, UMLAL, SMULL, SMLAL. */
8250                         tmp = load_reg(s, rs);
8251                         tmp2 = load_reg(s, rm);
8252                         if (insn & (1 << 22)) {
8253                             tcg_gen_muls2_i32(tmp, tmp2, tmp, tmp2);
8254                         } else {
8255                             tcg_gen_mulu2_i32(tmp, tmp2, tmp, tmp2);
8256                         }
8257                         if (insn & (1 << 21)) { /* mult accumulate */
8258                             TCGv_i32 al = load_reg(s, rn);
8259                             TCGv_i32 ah = load_reg(s, rd);
8260                             tcg_gen_add2_i32(tmp, tmp2, tmp, tmp2, al, ah);
8261                             tcg_temp_free_i32(al);
8262                             tcg_temp_free_i32(ah);
8263                         }
8264                         if (insn & (1 << 20)) {
8265                             gen_logicq_cc(tmp, tmp2);
8266                         }
8267                         store_reg(s, rn, tmp);
8268                         store_reg(s, rd, tmp2);
8269                         break;
8270                     default:
8271                         goto illegal_op;
8272                     }
8273                 } else {
8274                     rn = (insn >> 16) & 0xf;
8275                     rd = (insn >> 12) & 0xf;
8276                     if (insn & (1 << 23)) {
8277                         /* load/store exclusive */
8278                         int op2 = (insn >> 8) & 3;
8279                         op1 = (insn >> 21) & 0x3;
8280
8281                         switch (op2) {
8282                         case 0: /* lda/stl */
8283                             if (op1 == 1) {
8284                                 goto illegal_op;
8285                             }
8286                             ARCH(8);
8287                             break;
8288                         case 1: /* reserved */
8289                             goto illegal_op;
8290                         case 2: /* ldaex/stlex */
8291                             ARCH(8);
8292                             break;
8293                         case 3: /* ldrex/strex */
8294                             if (op1) {
8295                                 ARCH(6K);
8296                             } else {
8297                                 ARCH(6);
8298                             }
8299                             break;
8300                         }
8301
8302                         addr = tcg_temp_local_new_i32();
8303                         load_reg_var(s, addr, rn);
8304
8305                         /* Since the emulation does not have barriers,
8306                            the acquire/release semantics need no special
8307                            handling */
8308                         if (op2 == 0) {
8309                             if (insn & (1 << 20)) {
8310                                 tmp = tcg_temp_new_i32();
8311                                 switch (op1) {
8312                                 case 0: /* lda */
8313                                     gen_aa32_ld32u(tmp, addr, get_mem_index(s));
8314                                     break;
8315                                 case 2: /* ldab */
8316                                     gen_aa32_ld8u(tmp, addr, get_mem_index(s));
8317                                     break;
8318                                 case 3: /* ldah */
8319                                     gen_aa32_ld16u(tmp, addr, get_mem_index(s));
8320                                     break;
8321                                 default:
8322                                     abort();
8323                                 }
8324                                 store_reg(s, rd, tmp);
8325                             } else {
8326                                 rm = insn & 0xf;
8327                                 tmp = load_reg(s, rm);
8328                                 switch (op1) {
8329                                 case 0: /* stl */
8330                                     gen_aa32_st32(tmp, addr, get_mem_index(s));
8331                                     break;
8332                                 case 2: /* stlb */
8333                                     gen_aa32_st8(tmp, addr, get_mem_index(s));
8334                                     break;
8335                                 case 3: /* stlh */
8336                                     gen_aa32_st16(tmp, addr, get_mem_index(s));
8337                                     break;
8338                                 default:
8339                                     abort();
8340                                 }
8341                                 tcg_temp_free_i32(tmp);
8342                             }
8343                         } else if (insn & (1 << 20)) {
8344                             switch (op1) {
8345                             case 0: /* ldrex */
8346                                 gen_load_exclusive(s, rd, 15, addr, 2);
8347                                 break;
8348                             case 1: /* ldrexd */
8349                                 gen_load_exclusive(s, rd, rd + 1, addr, 3);
8350                                 break;
8351                             case 2: /* ldrexb */
8352                                 gen_load_exclusive(s, rd, 15, addr, 0);
8353                                 break;
8354                             case 3: /* ldrexh */
8355                                 gen_load_exclusive(s, rd, 15, addr, 1);
8356                                 break;
8357                             default:
8358                                 abort();
8359                             }
8360                         } else {
8361                             rm = insn & 0xf;
8362                             switch (op1) {
8363                             case 0:  /*  strex */
8364                                 gen_store_exclusive(s, rd, rm, 15, addr, 2);
8365                                 break;
8366                             case 1: /*  strexd */
8367                                 gen_store_exclusive(s, rd, rm, rm + 1, addr, 3);
8368                                 break;
8369                             case 2: /*  strexb */
8370                                 gen_store_exclusive(s, rd, rm, 15, addr, 0);
8371                                 break;
8372                             case 3: /* strexh */
8373                                 gen_store_exclusive(s, rd, rm, 15, addr, 1);
8374                                 break;
8375                             default:
8376                                 abort();
8377                             }
8378                         }
8379                         tcg_temp_free_i32(addr);
8380                     } else {
8381                         /* SWP instruction */
8382                         rm = (insn) & 0xf;
8383
8384                         /* ??? This is not really atomic.  However we know
8385                            we never have multiple CPUs running in parallel,
8386                            so it is good enough.  */
8387                         addr = load_reg(s, rn);
8388                         tmp = load_reg(s, rm);
8389                         tmp2 = tcg_temp_new_i32();
8390                         if (insn & (1 << 22)) {
8391                             gen_aa32_ld8u(tmp2, addr, get_mem_index(s));
8392                             gen_aa32_st8(tmp, addr, get_mem_index(s));
8393                         } else {
8394                             gen_aa32_ld32u(tmp2, addr, get_mem_index(s));
8395                             gen_aa32_st32(tmp, addr, get_mem_index(s));
8396                         }
8397                         tcg_temp_free_i32(tmp);
8398                         tcg_temp_free_i32(addr);
8399                         store_reg(s, rd, tmp2);
8400                     }
8401                 }
8402             } else {
8403                 int address_offset;
8404                 int load;
8405                 /* Misc load/store */
8406                 rn = (insn >> 16) & 0xf;
8407                 rd = (insn >> 12) & 0xf;
8408                 addr = load_reg(s, rn);
8409                 if (insn & (1 << 24))
8410                     gen_add_datah_offset(s, insn, 0, addr);
8411                 address_offset = 0;
8412                 if (insn & (1 << 20)) {
8413                     /* load */
8414                     tmp = tcg_temp_new_i32();
8415                     switch(sh) {
8416                     case 1:
8417                         gen_aa32_ld16u(tmp, addr, get_mem_index(s));
8418                         break;
8419                     case 2:
8420                         gen_aa32_ld8s(tmp, addr, get_mem_index(s));
8421                         break;
8422                     default:
8423                     case 3:
8424                         gen_aa32_ld16s(tmp, addr, get_mem_index(s));
8425                         break;
8426                     }
8427                     load = 1;
8428                 } else if (sh & 2) {
8429                     ARCH(5TE);
8430                     /* doubleword */
8431                     if (sh & 1) {
8432                         /* store */
8433                         tmp = load_reg(s, rd);
8434                         gen_aa32_st32(tmp, addr, get_mem_index(s));
8435                         tcg_temp_free_i32(tmp);
8436                         tcg_gen_addi_i32(addr, addr, 4);
8437                         tmp = load_reg(s, rd + 1);
8438                         gen_aa32_st32(tmp, addr, get_mem_index(s));
8439                         tcg_temp_free_i32(tmp);
8440                         load = 0;
8441                     } else {
8442                         /* load */
8443                         tmp = tcg_temp_new_i32();
8444                         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
8445                         store_reg(s, rd, tmp);
8446                         tcg_gen_addi_i32(addr, addr, 4);
8447                         tmp = tcg_temp_new_i32();
8448                         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
8449                         rd++;
8450                         load = 1;
8451                     }
8452                     address_offset = -4;
8453                 } else {
8454                     /* store */
8455                     tmp = load_reg(s, rd);
8456                     gen_aa32_st16(tmp, addr, get_mem_index(s));
8457                     tcg_temp_free_i32(tmp);
8458                     load = 0;
8459                 }
8460                 /* Perform base writeback before the loaded value to
8461                    ensure correct behavior with overlapping index registers.
8462                    ldrd with base writeback is is undefined if the
8463                    destination and index registers overlap.  */
8464                 if (!(insn & (1 << 24))) {
8465                     gen_add_datah_offset(s, insn, address_offset, addr);
8466                     store_reg(s, rn, addr);
8467                 } else if (insn & (1 << 21)) {
8468                     if (address_offset)
8469                         tcg_gen_addi_i32(addr, addr, address_offset);
8470                     store_reg(s, rn, addr);
8471                 } else {
8472                     tcg_temp_free_i32(addr);
8473                 }
8474                 if (load) {
8475                     /* Complete the load.  */
8476                     store_reg(s, rd, tmp);
8477                 }
8478             }
8479             break;
8480         case 0x4:
8481         case 0x5:
8482             goto do_ldst;
8483         case 0x6:
8484         case 0x7:
8485             if (insn & (1 << 4)) {
8486                 ARCH(6);
8487                 /* Armv6 Media instructions.  */
8488                 rm = insn & 0xf;
8489                 rn = (insn >> 16) & 0xf;
8490                 rd = (insn >> 12) & 0xf;
8491                 rs = (insn >> 8) & 0xf;
8492                 switch ((insn >> 23) & 3) {
8493                 case 0: /* Parallel add/subtract.  */
8494                     op1 = (insn >> 20) & 7;
8495                     tmp = load_reg(s, rn);
8496                     tmp2 = load_reg(s, rm);
8497                     sh = (insn >> 5) & 7;
8498                     if ((op1 & 3) == 0 || sh == 5 || sh == 6)
8499                         goto illegal_op;
8500                     gen_arm_parallel_addsub(op1, sh, tmp, tmp2);
8501                     tcg_temp_free_i32(tmp2);
8502                     store_reg(s, rd, tmp);
8503                     break;
8504                 case 1:
8505                     if ((insn & 0x00700020) == 0) {
8506                         /* Halfword pack.  */
8507                         tmp = load_reg(s, rn);
8508                         tmp2 = load_reg(s, rm);
8509                         shift = (insn >> 7) & 0x1f;
8510                         if (insn & (1 << 6)) {
8511                             /* pkhtb */
8512                             if (shift == 0)
8513                                 shift = 31;
8514                             tcg_gen_sari_i32(tmp2, tmp2, shift);
8515                             tcg_gen_andi_i32(tmp, tmp, 0xffff0000);
8516                             tcg_gen_ext16u_i32(tmp2, tmp2);
8517                         } else {
8518                             /* pkhbt */
8519                             if (shift)
8520                                 tcg_gen_shli_i32(tmp2, tmp2, shift);
8521                             tcg_gen_ext16u_i32(tmp, tmp);
8522                             tcg_gen_andi_i32(tmp2, tmp2, 0xffff0000);
8523                         }
8524                         tcg_gen_or_i32(tmp, tmp, tmp2);
8525                         tcg_temp_free_i32(tmp2);
8526                         store_reg(s, rd, tmp);
8527                     } else if ((insn & 0x00200020) == 0x00200000) {
8528                         /* [us]sat */
8529                         tmp = load_reg(s, rm);
8530                         shift = (insn >> 7) & 0x1f;
8531                         if (insn & (1 << 6)) {
8532                             if (shift == 0)
8533                                 shift = 31;
8534                             tcg_gen_sari_i32(tmp, tmp, shift);
8535                         } else {
8536                             tcg_gen_shli_i32(tmp, tmp, shift);
8537                         }
8538                         sh = (insn >> 16) & 0x1f;
8539                         tmp2 = tcg_const_i32(sh);
8540                         if (insn & (1 << 22))
8541                           gen_helper_usat(tmp, cpu_env, tmp, tmp2);
8542                         else
8543                           gen_helper_ssat(tmp, cpu_env, tmp, tmp2);
8544                         tcg_temp_free_i32(tmp2);
8545                         store_reg(s, rd, tmp);
8546                     } else if ((insn & 0x00300fe0) == 0x00200f20) {
8547                         /* [us]sat16 */
8548                         tmp = load_reg(s, rm);
8549                         sh = (insn >> 16) & 0x1f;
8550                         tmp2 = tcg_const_i32(sh);
8551                         if (insn & (1 << 22))
8552                           gen_helper_usat16(tmp, cpu_env, tmp, tmp2);
8553                         else
8554                           gen_helper_ssat16(tmp, cpu_env, tmp, tmp2);
8555                         tcg_temp_free_i32(tmp2);
8556                         store_reg(s, rd, tmp);
8557                     } else if ((insn & 0x00700fe0) == 0x00000fa0) {
8558                         /* Select bytes.  */
8559                         tmp = load_reg(s, rn);
8560                         tmp2 = load_reg(s, rm);
8561                         tmp3 = tcg_temp_new_i32();
8562                         tcg_gen_ld_i32(tmp3, cpu_env, offsetof(CPUARMState, GE));
8563                         gen_helper_sel_flags(tmp, tmp3, tmp, tmp2);
8564                         tcg_temp_free_i32(tmp3);
8565                         tcg_temp_free_i32(tmp2);
8566                         store_reg(s, rd, tmp);
8567                     } else if ((insn & 0x000003e0) == 0x00000060) {
8568                         tmp = load_reg(s, rm);
8569                         shift = (insn >> 10) & 3;
8570                         /* ??? In many cases it's not necessary to do a
8571                            rotate, a shift is sufficient.  */
8572                         if (shift != 0)
8573                             tcg_gen_rotri_i32(tmp, tmp, shift * 8);
8574                         op1 = (insn >> 20) & 7;
8575                         switch (op1) {
8576                         case 0: gen_sxtb16(tmp);  break;
8577                         case 2: gen_sxtb(tmp);    break;
8578                         case 3: gen_sxth(tmp);    break;
8579                         case 4: gen_uxtb16(tmp);  break;
8580                         case 6: gen_uxtb(tmp);    break;
8581                         case 7: gen_uxth(tmp);    break;
8582                         default: goto illegal_op;
8583                         }
8584                         if (rn != 15) {
8585                             tmp2 = load_reg(s, rn);
8586                             if ((op1 & 3) == 0) {
8587                                 gen_add16(tmp, tmp2);
8588                             } else {
8589                                 tcg_gen_add_i32(tmp, tmp, tmp2);
8590                                 tcg_temp_free_i32(tmp2);
8591                             }
8592                         }
8593                         store_reg(s, rd, tmp);
8594                     } else if ((insn & 0x003f0f60) == 0x003f0f20) {
8595                         /* rev */
8596                         tmp = load_reg(s, rm);
8597                         if (insn & (1 << 22)) {
8598                             if (insn & (1 << 7)) {
8599                                 gen_revsh(tmp);
8600                             } else {
8601                                 ARCH(6T2);
8602                                 gen_helper_rbit(tmp, tmp);
8603                             }
8604                         } else {
8605                             if (insn & (1 << 7))
8606                                 gen_rev16(tmp);
8607                             else
8608                                 tcg_gen_bswap32_i32(tmp, tmp);
8609                         }
8610                         store_reg(s, rd, tmp);
8611                     } else {
8612                         goto illegal_op;
8613                     }
8614                     break;
8615                 case 2: /* Multiplies (Type 3).  */
8616                     switch ((insn >> 20) & 0x7) {
8617                     case 5:
8618                         if (((insn >> 6) ^ (insn >> 7)) & 1) {
8619                             /* op2 not 00x or 11x : UNDEF */
8620                             goto illegal_op;
8621                         }
8622                         /* Signed multiply most significant [accumulate].
8623                            (SMMUL, SMMLA, SMMLS) */
8624                         tmp = load_reg(s, rm);
8625                         tmp2 = load_reg(s, rs);
8626                         tmp64 = gen_muls_i64_i32(tmp, tmp2);
8627
8628                         if (rd != 15) {
8629                             tmp = load_reg(s, rd);
8630                             if (insn & (1 << 6)) {
8631                                 tmp64 = gen_subq_msw(tmp64, tmp);
8632                             } else {
8633                                 tmp64 = gen_addq_msw(tmp64, tmp);
8634                             }
8635                         }
8636                         if (insn & (1 << 5)) {
8637                             tcg_gen_addi_i64(tmp64, tmp64, 0x80000000u);
8638                         }
8639                         tcg_gen_shri_i64(tmp64, tmp64, 32);
8640                         tmp = tcg_temp_new_i32();
8641                         tcg_gen_trunc_i64_i32(tmp, tmp64);
8642                         tcg_temp_free_i64(tmp64);
8643                         store_reg(s, rn, tmp);
8644                         break;
8645                     case 0:
8646                     case 4:
8647                         /* SMLAD, SMUAD, SMLSD, SMUSD, SMLALD, SMLSLD */
8648                         if (insn & (1 << 7)) {
8649                             goto illegal_op;
8650                         }
8651                         tmp = load_reg(s, rm);
8652                         tmp2 = load_reg(s, rs);
8653                         if (insn & (1 << 5))
8654                             gen_swap_half(tmp2);
8655                         gen_smul_dual(tmp, tmp2);
8656                         if (insn & (1 << 22)) {
8657                             /* smlald, smlsld */
8658                             TCGv_i64 tmp64_2;
8659
8660                             tmp64 = tcg_temp_new_i64();
8661                             tmp64_2 = tcg_temp_new_i64();
8662                             tcg_gen_ext_i32_i64(tmp64, tmp);
8663                             tcg_gen_ext_i32_i64(tmp64_2, tmp2);
8664                             tcg_temp_free_i32(tmp);
8665                             tcg_temp_free_i32(tmp2);
8666                             if (insn & (1 << 6)) {
8667                                 tcg_gen_sub_i64(tmp64, tmp64, tmp64_2);
8668                             } else {
8669                                 tcg_gen_add_i64(tmp64, tmp64, tmp64_2);
8670                             }
8671                             tcg_temp_free_i64(tmp64_2);
8672                             gen_addq(s, tmp64, rd, rn);
8673                             gen_storeq_reg(s, rd, rn, tmp64);
8674                             tcg_temp_free_i64(tmp64);
8675                         } else {
8676                             /* smuad, smusd, smlad, smlsd */
8677                             if (insn & (1 << 6)) {
8678                                 /* This subtraction cannot overflow. */
8679                                 tcg_gen_sub_i32(tmp, tmp, tmp2);
8680                             } else {
8681                                 /* This addition cannot overflow 32 bits;
8682                                  * however it may overflow considered as a
8683                                  * signed operation, in which case we must set
8684                                  * the Q flag.
8685                                  */
8686                                 gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
8687                             }
8688                             tcg_temp_free_i32(tmp2);
8689                             if (rd != 15)
8690                               {
8691                                 tmp2 = load_reg(s, rd);
8692                                 gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
8693                                 tcg_temp_free_i32(tmp2);
8694                               }
8695                             store_reg(s, rn, tmp);
8696                         }
8697                         break;
8698                     case 1:
8699                     case 3:
8700                         /* SDIV, UDIV */
8701                         if (!arm_dc_feature(s, ARM_FEATURE_ARM_DIV)) {
8702                             goto illegal_op;
8703                         }
8704                         if (((insn >> 5) & 7) || (rd != 15)) {
8705                             goto illegal_op;
8706                         }
8707                         tmp = load_reg(s, rm);
8708                         tmp2 = load_reg(s, rs);
8709                         if (insn & (1 << 21)) {
8710                             gen_helper_udiv(tmp, tmp, tmp2);
8711                         } else {
8712                             gen_helper_sdiv(tmp, tmp, tmp2);
8713                         }
8714                         tcg_temp_free_i32(tmp2);
8715                         store_reg(s, rn, tmp);
8716                         break;
8717                     default:
8718                         goto illegal_op;
8719                     }
8720                     break;
8721                 case 3:
8722                     op1 = ((insn >> 17) & 0x38) | ((insn >> 5) & 7);
8723                     switch (op1) {
8724                     case 0: /* Unsigned sum of absolute differences.  */
8725                         ARCH(6);
8726                         tmp = load_reg(s, rm);
8727                         tmp2 = load_reg(s, rs);
8728                         gen_helper_usad8(tmp, tmp, tmp2);
8729                         tcg_temp_free_i32(tmp2);
8730                         if (rd != 15) {
8731                             tmp2 = load_reg(s, rd);
8732                             tcg_gen_add_i32(tmp, tmp, tmp2);
8733                             tcg_temp_free_i32(tmp2);
8734                         }
8735                         store_reg(s, rn, tmp);
8736                         break;
8737                     case 0x20: case 0x24: case 0x28: case 0x2c:
8738                         /* Bitfield insert/clear.  */
8739                         ARCH(6T2);
8740                         shift = (insn >> 7) & 0x1f;
8741                         i = (insn >> 16) & 0x1f;
8742                         i = i + 1 - shift;
8743                         if (rm == 15) {
8744                             tmp = tcg_temp_new_i32();
8745                             tcg_gen_movi_i32(tmp, 0);
8746                         } else {
8747                             tmp = load_reg(s, rm);
8748                         }
8749                         if (i != 32) {
8750                             tmp2 = load_reg(s, rd);
8751                             tcg_gen_deposit_i32(tmp, tmp2, tmp, shift, i);
8752                             tcg_temp_free_i32(tmp2);
8753                         }
8754                         store_reg(s, rd, tmp);
8755                         break;
8756                     case 0x12: case 0x16: case 0x1a: case 0x1e: /* sbfx */
8757                     case 0x32: case 0x36: case 0x3a: case 0x3e: /* ubfx */
8758                         ARCH(6T2);
8759                         tmp = load_reg(s, rm);
8760                         shift = (insn >> 7) & 0x1f;
8761                         i = ((insn >> 16) & 0x1f) + 1;
8762                         if (shift + i > 32)
8763                             goto illegal_op;
8764                         if (i < 32) {
8765                             if (op1 & 0x20) {
8766                                 gen_ubfx(tmp, shift, (1u << i) - 1);
8767                             } else {
8768                                 gen_sbfx(tmp, shift, i);
8769                             }
8770                         }
8771                         store_reg(s, rd, tmp);
8772                         break;
8773                     default:
8774                         goto illegal_op;
8775                     }
8776                     break;
8777                 }
8778                 break;
8779             }
8780         do_ldst:
8781             /* Check for undefined extension instructions
8782              * per the ARM Bible IE:
8783              * xxxx 0111 1111 xxxx  xxxx xxxx 1111 xxxx
8784              */
8785             sh = (0xf << 20) | (0xf << 4);
8786             if (op1 == 0x7 && ((insn & sh) == sh))
8787             {
8788                 goto illegal_op;
8789             }
8790             /* load/store byte/word */
8791             rn = (insn >> 16) & 0xf;
8792             rd = (insn >> 12) & 0xf;
8793             tmp2 = load_reg(s, rn);
8794             if ((insn & 0x01200000) == 0x00200000) {
8795                 /* ldrt/strt */
8796                 i = MMU_USER_IDX;
8797             } else {
8798                 i = get_mem_index(s);
8799             }
8800             if (insn & (1 << 24))
8801                 gen_add_data_offset(s, insn, tmp2);
8802             if (insn & (1 << 20)) {
8803                 /* load */
8804                 tmp = tcg_temp_new_i32();
8805                 if (insn & (1 << 22)) {
8806                     gen_aa32_ld8u(tmp, tmp2, i);
8807                 } else {
8808                     gen_aa32_ld32u(tmp, tmp2, i);
8809                 }
8810             } else {
8811                 /* store */
8812                 tmp = load_reg(s, rd);
8813                 if (insn & (1 << 22)) {
8814                     gen_aa32_st8(tmp, tmp2, i);
8815                 } else {
8816                     gen_aa32_st32(tmp, tmp2, i);
8817                 }
8818                 tcg_temp_free_i32(tmp);
8819             }
8820             if (!(insn & (1 << 24))) {
8821                 gen_add_data_offset(s, insn, tmp2);
8822                 store_reg(s, rn, tmp2);
8823             } else if (insn & (1 << 21)) {
8824                 store_reg(s, rn, tmp2);
8825             } else {
8826                 tcg_temp_free_i32(tmp2);
8827             }
8828             if (insn & (1 << 20)) {
8829                 /* Complete the load.  */
8830                 store_reg_from_load(s, rd, tmp);
8831             }
8832             break;
8833         case 0x08:
8834         case 0x09:
8835             {
8836                 int j, n, user, loaded_base;
8837                 TCGv_i32 loaded_var;
8838                 /* load/store multiple words */
8839                 /* XXX: store correct base if write back */
8840                 user = 0;
8841                 if (insn & (1 << 22)) {
8842                     if (IS_USER(s))
8843                         goto illegal_op; /* only usable in supervisor mode */
8844
8845                     if ((insn & (1 << 15)) == 0)
8846                         user = 1;
8847                 }
8848                 rn = (insn >> 16) & 0xf;
8849                 addr = load_reg(s, rn);
8850
8851                 /* compute total size */
8852                 loaded_base = 0;
8853                 TCGV_UNUSED_I32(loaded_var);
8854                 n = 0;
8855                 for(i=0;i<16;i++) {
8856                     if (insn & (1 << i))
8857                         n++;
8858                 }
8859                 /* XXX: test invalid n == 0 case ? */
8860                 if (insn & (1 << 23)) {
8861                     if (insn & (1 << 24)) {
8862                         /* pre increment */
8863                         tcg_gen_addi_i32(addr, addr, 4);
8864                     } else {
8865                         /* post increment */
8866                     }
8867                 } else {
8868                     if (insn & (1 << 24)) {
8869                         /* pre decrement */
8870                         tcg_gen_addi_i32(addr, addr, -(n * 4));
8871                     } else {
8872                         /* post decrement */
8873                         if (n != 1)
8874                         tcg_gen_addi_i32(addr, addr, -((n - 1) * 4));
8875                     }
8876                 }
8877                 j = 0;
8878                 for(i=0;i<16;i++) {
8879                     if (insn & (1 << i)) {
8880                         if (insn & (1 << 20)) {
8881                             /* load */
8882                             tmp = tcg_temp_new_i32();
8883                             gen_aa32_ld32u(tmp, addr, get_mem_index(s));
8884                             if (user) {
8885                                 tmp2 = tcg_const_i32(i);
8886                                 gen_helper_set_user_reg(cpu_env, tmp2, tmp);
8887                                 tcg_temp_free_i32(tmp2);
8888                                 tcg_temp_free_i32(tmp);
8889                             } else if (i == rn) {
8890                                 loaded_var = tmp;
8891                                 loaded_base = 1;
8892                             } else {
8893                                 store_reg_from_load(s, i, tmp);
8894                             }
8895                         } else {
8896                             /* store */
8897                             if (i == 15) {
8898                                 /* special case: r15 = PC + 8 */
8899                                 val = (long)s->pc + 4;
8900                                 tmp = tcg_temp_new_i32();
8901                                 tcg_gen_movi_i32(tmp, val);
8902                             } else if (user) {
8903                                 tmp = tcg_temp_new_i32();
8904                                 tmp2 = tcg_const_i32(i);
8905                                 gen_helper_get_user_reg(tmp, cpu_env, tmp2);
8906                                 tcg_temp_free_i32(tmp2);
8907                             } else {
8908                                 tmp = load_reg(s, i);
8909                             }
8910                             gen_aa32_st32(tmp, addr, get_mem_index(s));
8911                             tcg_temp_free_i32(tmp);
8912                         }
8913                         j++;
8914                         /* no need to add after the last transfer */
8915                         if (j != n)
8916                             tcg_gen_addi_i32(addr, addr, 4);
8917                     }
8918                 }
8919                 if (insn & (1 << 21)) {
8920                     /* write back */
8921                     if (insn & (1 << 23)) {
8922                         if (insn & (1 << 24)) {
8923                             /* pre increment */
8924                         } else {
8925                             /* post increment */
8926                             tcg_gen_addi_i32(addr, addr, 4);
8927                         }
8928                     } else {
8929                         if (insn & (1 << 24)) {
8930                             /* pre decrement */
8931                             if (n != 1)
8932                                 tcg_gen_addi_i32(addr, addr, -((n - 1) * 4));
8933                         } else {
8934                             /* post decrement */
8935                             tcg_gen_addi_i32(addr, addr, -(n * 4));
8936                         }
8937                     }
8938                     store_reg(s, rn, addr);
8939                 } else {
8940                     tcg_temp_free_i32(addr);
8941                 }
8942                 if (loaded_base) {
8943                     store_reg(s, rn, loaded_var);
8944                 }
8945                 if ((insn & (1 << 22)) && !user) {
8946                     /* Restore CPSR from SPSR.  */
8947                     tmp = load_cpu_field(spsr);
8948                     gen_set_cpsr(tmp, CPSR_ERET_MASK);
8949                     tcg_temp_free_i32(tmp);
8950                     s->is_jmp = DISAS_UPDATE;
8951                 }
8952             }
8953             break;
8954         case 0xa:
8955         case 0xb:
8956             {
8957                 int32_t offset;
8958
8959                 /* branch (and link) */
8960                 val = (int32_t)s->pc;
8961                 if (insn & (1 << 24)) {
8962                     tmp = tcg_temp_new_i32();
8963                     tcg_gen_movi_i32(tmp, val);
8964                     store_reg(s, 14, tmp);
8965                 }
8966                 offset = sextract32(insn << 2, 0, 26);
8967                 val += offset + 4;
8968                 gen_jmp(s, val);
8969             }
8970             break;
8971         case 0xc:
8972         case 0xd:
8973         case 0xe:
8974             if (((insn >> 8) & 0xe) == 10) {
8975                 /* VFP.  */
8976                 if (disas_vfp_insn(s, insn)) {
8977                     goto illegal_op;
8978                 }
8979             } else if (disas_coproc_insn(s, insn)) {
8980                 /* Coprocessor.  */
8981                 goto illegal_op;
8982             }
8983             break;
8984         case 0xf:
8985             /* swi */
8986             gen_set_pc_im(s, s->pc);
8987             s->svc_imm = extract32(insn, 0, 24);
8988             s->is_jmp = DISAS_SWI;
8989             break;
8990         default:
8991         illegal_op:
8992             gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized());
8993             break;
8994         }
8995     }
8996 }
8997
8998 /* Return true if this is a Thumb-2 logical op.  */
8999 static int
9000 thumb2_logic_op(int op)
9001 {
9002     return (op < 8);
9003 }
9004
9005 /* Generate code for a Thumb-2 data processing operation.  If CONDS is nonzero
9006    then set condition code flags based on the result of the operation.
9007    If SHIFTER_OUT is nonzero then set the carry flag for logical operations
9008    to the high bit of T1.
9009    Returns zero if the opcode is valid.  */
9010
9011 static int
9012 gen_thumb2_data_op(DisasContext *s, int op, int conds, uint32_t shifter_out,
9013                    TCGv_i32 t0, TCGv_i32 t1)
9014 {
9015     int logic_cc;
9016
9017     logic_cc = 0;
9018     switch (op) {
9019     case 0: /* and */
9020         tcg_gen_and_i32(t0, t0, t1);
9021         logic_cc = conds;
9022         break;
9023     case 1: /* bic */
9024         tcg_gen_andc_i32(t0, t0, t1);
9025         logic_cc = conds;
9026         break;
9027     case 2: /* orr */
9028         tcg_gen_or_i32(t0, t0, t1);
9029         logic_cc = conds;
9030         break;
9031     case 3: /* orn */
9032         tcg_gen_orc_i32(t0, t0, t1);
9033         logic_cc = conds;
9034         break;
9035     case 4: /* eor */
9036         tcg_gen_xor_i32(t0, t0, t1);
9037         logic_cc = conds;
9038         break;
9039     case 8: /* add */
9040         if (conds)
9041             gen_add_CC(t0, t0, t1);
9042         else
9043             tcg_gen_add_i32(t0, t0, t1);
9044         break;
9045     case 10: /* adc */
9046         if (conds)
9047             gen_adc_CC(t0, t0, t1);
9048         else
9049             gen_adc(t0, t1);
9050         break;
9051     case 11: /* sbc */
9052         if (conds) {
9053             gen_sbc_CC(t0, t0, t1);
9054         } else {
9055             gen_sub_carry(t0, t0, t1);
9056         }
9057         break;
9058     case 13: /* sub */
9059         if (conds)
9060             gen_sub_CC(t0, t0, t1);
9061         else
9062             tcg_gen_sub_i32(t0, t0, t1);
9063         break;
9064     case 14: /* rsb */
9065         if (conds)
9066             gen_sub_CC(t0, t1, t0);
9067         else
9068             tcg_gen_sub_i32(t0, t1, t0);
9069         break;
9070     default: /* 5, 6, 7, 9, 12, 15. */
9071         return 1;
9072     }
9073     if (logic_cc) {
9074         gen_logic_CC(t0);
9075         if (shifter_out)
9076             gen_set_CF_bit31(t1);
9077     }
9078     return 0;
9079 }
9080
9081 /* Translate a 32-bit thumb instruction.  Returns nonzero if the instruction
9082    is not legal.  */
9083 static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw1)
9084 {
9085     uint32_t insn, imm, shift, offset;
9086     uint32_t rd, rn, rm, rs;
9087     TCGv_i32 tmp;
9088     TCGv_i32 tmp2;
9089     TCGv_i32 tmp3;
9090     TCGv_i32 addr;
9091     TCGv_i64 tmp64;
9092     int op;
9093     int shiftop;
9094     int conds;
9095     int logic_cc;
9096
9097     if (!(arm_dc_feature(s, ARM_FEATURE_THUMB2)
9098           || arm_dc_feature(s, ARM_FEATURE_M))) {
9099         /* Thumb-1 cores may need to treat bl and blx as a pair of
9100            16-bit instructions to get correct prefetch abort behavior.  */
9101         insn = insn_hw1;
9102         if ((insn & (1 << 12)) == 0) {
9103             ARCH(5);
9104             /* Second half of blx.  */
9105             offset = ((insn & 0x7ff) << 1);
9106             tmp = load_reg(s, 14);
9107             tcg_gen_addi_i32(tmp, tmp, offset);
9108             tcg_gen_andi_i32(tmp, tmp, 0xfffffffc);
9109
9110             tmp2 = tcg_temp_new_i32();
9111             tcg_gen_movi_i32(tmp2, s->pc | 1);
9112             store_reg(s, 14, tmp2);
9113             gen_bx(s, tmp);
9114             return 0;
9115         }
9116         if (insn & (1 << 11)) {
9117             /* Second half of bl.  */
9118             offset = ((insn & 0x7ff) << 1) | 1;
9119             tmp = load_reg(s, 14);
9120             tcg_gen_addi_i32(tmp, tmp, offset);
9121
9122             tmp2 = tcg_temp_new_i32();
9123             tcg_gen_movi_i32(tmp2, s->pc | 1);
9124             store_reg(s, 14, tmp2);
9125             gen_bx(s, tmp);
9126             return 0;
9127         }
9128         if ((s->pc & ~TARGET_PAGE_MASK) == 0) {
9129             /* Instruction spans a page boundary.  Implement it as two
9130                16-bit instructions in case the second half causes an
9131                prefetch abort.  */
9132             offset = ((int32_t)insn << 21) >> 9;
9133             tcg_gen_movi_i32(cpu_R[14], s->pc + 2 + offset);
9134             return 0;
9135         }
9136         /* Fall through to 32-bit decode.  */
9137     }
9138
9139     insn = arm_lduw_code(env, s->pc, s->bswap_code);
9140     s->pc += 2;
9141     insn |= (uint32_t)insn_hw1 << 16;
9142
9143     if ((insn & 0xf800e800) != 0xf000e800) {
9144         ARCH(6T2);
9145     }
9146
9147     rn = (insn >> 16) & 0xf;
9148     rs = (insn >> 12) & 0xf;
9149     rd = (insn >> 8) & 0xf;
9150     rm = insn & 0xf;
9151     switch ((insn >> 25) & 0xf) {
9152     case 0: case 1: case 2: case 3:
9153         /* 16-bit instructions.  Should never happen.  */
9154         abort();
9155     case 4:
9156         if (insn & (1 << 22)) {
9157             /* Other load/store, table branch.  */
9158             if (insn & 0x01200000) {
9159                 /* Load/store doubleword.  */
9160                 if (rn == 15) {
9161                     addr = tcg_temp_new_i32();
9162                     tcg_gen_movi_i32(addr, s->pc & ~3);
9163                 } else {
9164                     addr = load_reg(s, rn);
9165                 }
9166                 offset = (insn & 0xff) * 4;
9167                 if ((insn & (1 << 23)) == 0)
9168                     offset = -offset;
9169                 if (insn & (1 << 24)) {
9170                     tcg_gen_addi_i32(addr, addr, offset);
9171                     offset = 0;
9172                 }
9173                 if (insn & (1 << 20)) {
9174                     /* ldrd */
9175                     tmp = tcg_temp_new_i32();
9176                     gen_aa32_ld32u(tmp, addr, get_mem_index(s));
9177                     store_reg(s, rs, tmp);
9178                     tcg_gen_addi_i32(addr, addr, 4);
9179                     tmp = tcg_temp_new_i32();
9180                     gen_aa32_ld32u(tmp, addr, get_mem_index(s));
9181                     store_reg(s, rd, tmp);
9182                 } else {
9183                     /* strd */
9184                     tmp = load_reg(s, rs);
9185                     gen_aa32_st32(tmp, addr, get_mem_index(s));
9186                     tcg_temp_free_i32(tmp);
9187                     tcg_gen_addi_i32(addr, addr, 4);
9188                     tmp = load_reg(s, rd);
9189                     gen_aa32_st32(tmp, addr, get_mem_index(s));
9190                     tcg_temp_free_i32(tmp);
9191                 }
9192                 if (insn & (1 << 21)) {
9193                     /* Base writeback.  */
9194                     if (rn == 15)
9195                         goto illegal_op;
9196                     tcg_gen_addi_i32(addr, addr, offset - 4);
9197                     store_reg(s, rn, addr);
9198                 } else {
9199                     tcg_temp_free_i32(addr);
9200                 }
9201             } else if ((insn & (1 << 23)) == 0) {
9202                 /* Load/store exclusive word.  */
9203                 addr = tcg_temp_local_new_i32();
9204                 load_reg_var(s, addr, rn);
9205                 tcg_gen_addi_i32(addr, addr, (insn & 0xff) << 2);
9206                 if (insn & (1 << 20)) {
9207                     gen_load_exclusive(s, rs, 15, addr, 2);
9208                 } else {
9209                     gen_store_exclusive(s, rd, rs, 15, addr, 2);
9210                 }
9211                 tcg_temp_free_i32(addr);
9212             } else if ((insn & (7 << 5)) == 0) {
9213                 /* Table Branch.  */
9214                 if (rn == 15) {
9215                     addr = tcg_temp_new_i32();
9216                     tcg_gen_movi_i32(addr, s->pc);
9217                 } else {
9218                     addr = load_reg(s, rn);
9219                 }
9220                 tmp = load_reg(s, rm);
9221                 tcg_gen_add_i32(addr, addr, tmp);
9222                 if (insn & (1 << 4)) {
9223                     /* tbh */
9224                     tcg_gen_add_i32(addr, addr, tmp);
9225                     tcg_temp_free_i32(tmp);
9226                     tmp = tcg_temp_new_i32();
9227                     gen_aa32_ld16u(tmp, addr, get_mem_index(s));
9228                 } else { /* tbb */
9229                     tcg_temp_free_i32(tmp);
9230                     tmp = tcg_temp_new_i32();
9231                     gen_aa32_ld8u(tmp, addr, get_mem_index(s));
9232                 }
9233                 tcg_temp_free_i32(addr);
9234                 tcg_gen_shli_i32(tmp, tmp, 1);
9235                 tcg_gen_addi_i32(tmp, tmp, s->pc);
9236                 store_reg(s, 15, tmp);
9237             } else {
9238                 int op2 = (insn >> 6) & 0x3;
9239                 op = (insn >> 4) & 0x3;
9240                 switch (op2) {
9241                 case 0:
9242                     goto illegal_op;
9243                 case 1:
9244                     /* Load/store exclusive byte/halfword/doubleword */
9245                     if (op == 2) {
9246                         goto illegal_op;
9247                     }
9248                     ARCH(7);
9249                     break;
9250                 case 2:
9251                     /* Load-acquire/store-release */
9252                     if (op == 3) {
9253                         goto illegal_op;
9254                     }
9255                     /* Fall through */
9256                 case 3:
9257                     /* Load-acquire/store-release exclusive */
9258                     ARCH(8);
9259                     break;
9260                 }
9261                 addr = tcg_temp_local_new_i32();
9262                 load_reg_var(s, addr, rn);
9263                 if (!(op2 & 1)) {
9264                     if (insn & (1 << 20)) {
9265                         tmp = tcg_temp_new_i32();
9266                         switch (op) {
9267                         case 0: /* ldab */
9268                             gen_aa32_ld8u(tmp, addr, get_mem_index(s));
9269                             break;
9270                         case 1: /* ldah */
9271                             gen_aa32_ld16u(tmp, addr, get_mem_index(s));
9272                             break;
9273                         case 2: /* lda */
9274                             gen_aa32_ld32u(tmp, addr, get_mem_index(s));
9275                             break;
9276                         default:
9277                             abort();
9278                         }
9279                         store_reg(s, rs, tmp);
9280                     } else {
9281                         tmp = load_reg(s, rs);
9282                         switch (op) {
9283                         case 0: /* stlb */
9284                             gen_aa32_st8(tmp, addr, get_mem_index(s));
9285                             break;
9286                         case 1: /* stlh */
9287                             gen_aa32_st16(tmp, addr, get_mem_index(s));
9288                             break;
9289                         case 2: /* stl */
9290                             gen_aa32_st32(tmp, addr, get_mem_index(s));
9291                             break;
9292                         default:
9293                             abort();
9294                         }
9295                         tcg_temp_free_i32(tmp);
9296                     }
9297                 } else if (insn & (1 << 20)) {
9298                     gen_load_exclusive(s, rs, rd, addr, op);
9299                 } else {
9300                     gen_store_exclusive(s, rm, rs, rd, addr, op);
9301                 }
9302                 tcg_temp_free_i32(addr);
9303             }
9304         } else {
9305             /* Load/store multiple, RFE, SRS.  */
9306             if (((insn >> 23) & 1) == ((insn >> 24) & 1)) {
9307                 /* RFE, SRS: not available in user mode or on M profile */
9308                 if (IS_USER(s) || arm_dc_feature(s, ARM_FEATURE_M)) {
9309                     goto illegal_op;
9310                 }
9311                 if (insn & (1 << 20)) {
9312                     /* rfe */
9313                     addr = load_reg(s, rn);
9314                     if ((insn & (1 << 24)) == 0)
9315                         tcg_gen_addi_i32(addr, addr, -8);
9316                     /* Load PC into tmp and CPSR into tmp2.  */
9317                     tmp = tcg_temp_new_i32();
9318                     gen_aa32_ld32u(tmp, addr, get_mem_index(s));
9319                     tcg_gen_addi_i32(addr, addr, 4);
9320                     tmp2 = tcg_temp_new_i32();
9321                     gen_aa32_ld32u(tmp2, addr, get_mem_index(s));
9322                     if (insn & (1 << 21)) {
9323                         /* Base writeback.  */
9324                         if (insn & (1 << 24)) {
9325                             tcg_gen_addi_i32(addr, addr, 4);
9326                         } else {
9327                             tcg_gen_addi_i32(addr, addr, -4);
9328                         }
9329                         store_reg(s, rn, addr);
9330                     } else {
9331                         tcg_temp_free_i32(addr);
9332                     }
9333                     gen_rfe(s, tmp, tmp2);
9334                 } else {
9335                     /* srs */
9336                     gen_srs(s, (insn & 0x1f), (insn & (1 << 24)) ? 1 : 2,
9337                             insn & (1 << 21));
9338                 }
9339             } else {
9340                 int i, loaded_base = 0;
9341                 TCGv_i32 loaded_var;
9342                 /* Load/store multiple.  */
9343                 addr = load_reg(s, rn);
9344                 offset = 0;
9345                 for (i = 0; i < 16; i++) {
9346                     if (insn & (1 << i))
9347                         offset += 4;
9348                 }
9349                 if (insn & (1 << 24)) {
9350                     tcg_gen_addi_i32(addr, addr, -offset);
9351                 }
9352
9353                 TCGV_UNUSED_I32(loaded_var);
9354                 for (i = 0; i < 16; i++) {
9355                     if ((insn & (1 << i)) == 0)
9356                         continue;
9357                     if (insn & (1 << 20)) {
9358                         /* Load.  */
9359                         tmp = tcg_temp_new_i32();
9360                         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
9361                         if (i == 15) {
9362                             gen_bx(s, tmp);
9363                         } else if (i == rn) {
9364                             loaded_var = tmp;
9365                             loaded_base = 1;
9366                         } else {
9367                             store_reg(s, i, tmp);
9368                         }
9369                     } else {
9370                         /* Store.  */
9371                         tmp = load_reg(s, i);
9372                         gen_aa32_st32(tmp, addr, get_mem_index(s));
9373                         tcg_temp_free_i32(tmp);
9374                     }
9375                     tcg_gen_addi_i32(addr, addr, 4);
9376                 }
9377                 if (loaded_base) {
9378                     store_reg(s, rn, loaded_var);
9379                 }
9380                 if (insn & (1 << 21)) {
9381                     /* Base register writeback.  */
9382                     if (insn & (1 << 24)) {
9383                         tcg_gen_addi_i32(addr, addr, -offset);
9384                     }
9385                     /* Fault if writeback register is in register list.  */
9386                     if (insn & (1 << rn))
9387                         goto illegal_op;
9388                     store_reg(s, rn, addr);
9389                 } else {
9390                     tcg_temp_free_i32(addr);
9391                 }
9392             }
9393         }
9394         break;
9395     case 5:
9396
9397         op = (insn >> 21) & 0xf;
9398         if (op == 6) {
9399             /* Halfword pack.  */
9400             tmp = load_reg(s, rn);
9401             tmp2 = load_reg(s, rm);
9402             shift = ((insn >> 10) & 0x1c) | ((insn >> 6) & 0x3);
9403             if (insn & (1 << 5)) {
9404                 /* pkhtb */
9405                 if (shift == 0)
9406                     shift = 31;
9407                 tcg_gen_sari_i32(tmp2, tmp2, shift);
9408                 tcg_gen_andi_i32(tmp, tmp, 0xffff0000);
9409                 tcg_gen_ext16u_i32(tmp2, tmp2);
9410             } else {
9411                 /* pkhbt */
9412                 if (shift)
9413                     tcg_gen_shli_i32(tmp2, tmp2, shift);
9414                 tcg_gen_ext16u_i32(tmp, tmp);
9415                 tcg_gen_andi_i32(tmp2, tmp2, 0xffff0000);
9416             }
9417             tcg_gen_or_i32(tmp, tmp, tmp2);
9418             tcg_temp_free_i32(tmp2);
9419             store_reg(s, rd, tmp);
9420         } else {
9421             /* Data processing register constant shift.  */
9422             if (rn == 15) {
9423                 tmp = tcg_temp_new_i32();
9424                 tcg_gen_movi_i32(tmp, 0);
9425             } else {
9426                 tmp = load_reg(s, rn);
9427             }
9428             tmp2 = load_reg(s, rm);
9429
9430             shiftop = (insn >> 4) & 3;
9431             shift = ((insn >> 6) & 3) | ((insn >> 10) & 0x1c);
9432             conds = (insn & (1 << 20)) != 0;
9433             logic_cc = (conds && thumb2_logic_op(op));
9434             gen_arm_shift_im(tmp2, shiftop, shift, logic_cc);
9435             if (gen_thumb2_data_op(s, op, conds, 0, tmp, tmp2))
9436                 goto illegal_op;
9437             tcg_temp_free_i32(tmp2);
9438             if (rd != 15) {
9439                 store_reg(s, rd, tmp);
9440             } else {
9441                 tcg_temp_free_i32(tmp);
9442             }
9443         }
9444         break;
9445     case 13: /* Misc data processing.  */
9446         op = ((insn >> 22) & 6) | ((insn >> 7) & 1);
9447         if (op < 4 && (insn & 0xf000) != 0xf000)
9448             goto illegal_op;
9449         switch (op) {
9450         case 0: /* Register controlled shift.  */
9451             tmp = load_reg(s, rn);
9452             tmp2 = load_reg(s, rm);
9453             if ((insn & 0x70) != 0)
9454                 goto illegal_op;
9455             op = (insn >> 21) & 3;
9456             logic_cc = (insn & (1 << 20)) != 0;
9457             gen_arm_shift_reg(tmp, op, tmp2, logic_cc);
9458             if (logic_cc)
9459                 gen_logic_CC(tmp);
9460             store_reg_bx(s, rd, tmp);
9461             break;
9462         case 1: /* Sign/zero extend.  */
9463             tmp = load_reg(s, rm);
9464             shift = (insn >> 4) & 3;
9465             /* ??? In many cases it's not necessary to do a
9466                rotate, a shift is sufficient.  */
9467             if (shift != 0)
9468                 tcg_gen_rotri_i32(tmp, tmp, shift * 8);
9469             op = (insn >> 20) & 7;
9470             switch (op) {
9471             case 0: gen_sxth(tmp);   break;
9472             case 1: gen_uxth(tmp);   break;
9473             case 2: gen_sxtb16(tmp); break;
9474             case 3: gen_uxtb16(tmp); break;
9475             case 4: gen_sxtb(tmp);   break;
9476             case 5: gen_uxtb(tmp);   break;
9477             default: goto illegal_op;
9478             }
9479             if (rn != 15) {
9480                 tmp2 = load_reg(s, rn);
9481                 if ((op >> 1) == 1) {
9482                     gen_add16(tmp, tmp2);
9483                 } else {
9484                     tcg_gen_add_i32(tmp, tmp, tmp2);
9485                     tcg_temp_free_i32(tmp2);
9486                 }
9487             }
9488             store_reg(s, rd, tmp);
9489             break;
9490         case 2: /* SIMD add/subtract.  */
9491             op = (insn >> 20) & 7;
9492             shift = (insn >> 4) & 7;
9493             if ((op & 3) == 3 || (shift & 3) == 3)
9494                 goto illegal_op;
9495             tmp = load_reg(s, rn);
9496             tmp2 = load_reg(s, rm);
9497             gen_thumb2_parallel_addsub(op, shift, tmp, tmp2);
9498             tcg_temp_free_i32(tmp2);
9499             store_reg(s, rd, tmp);
9500             break;
9501         case 3: /* Other data processing.  */
9502             op = ((insn >> 17) & 0x38) | ((insn >> 4) & 7);
9503             if (op < 4) {
9504                 /* Saturating add/subtract.  */
9505                 tmp = load_reg(s, rn);
9506                 tmp2 = load_reg(s, rm);
9507                 if (op & 1)
9508                     gen_helper_double_saturate(tmp, cpu_env, tmp);
9509                 if (op & 2)
9510                     gen_helper_sub_saturate(tmp, cpu_env, tmp2, tmp);
9511                 else
9512                     gen_helper_add_saturate(tmp, cpu_env, tmp, tmp2);
9513                 tcg_temp_free_i32(tmp2);
9514             } else {
9515                 tmp = load_reg(s, rn);
9516                 switch (op) {
9517                 case 0x0a: /* rbit */
9518                     gen_helper_rbit(tmp, tmp);
9519                     break;
9520                 case 0x08: /* rev */
9521                     tcg_gen_bswap32_i32(tmp, tmp);
9522                     break;
9523                 case 0x09: /* rev16 */
9524                     gen_rev16(tmp);
9525                     break;
9526                 case 0x0b: /* revsh */
9527                     gen_revsh(tmp);
9528                     break;
9529                 case 0x10: /* sel */
9530                     tmp2 = load_reg(s, rm);
9531                     tmp3 = tcg_temp_new_i32();
9532                     tcg_gen_ld_i32(tmp3, cpu_env, offsetof(CPUARMState, GE));
9533                     gen_helper_sel_flags(tmp, tmp3, tmp, tmp2);
9534                     tcg_temp_free_i32(tmp3);
9535                     tcg_temp_free_i32(tmp2);
9536                     break;
9537                 case 0x18: /* clz */
9538                     gen_helper_clz(tmp, tmp);
9539                     break;
9540                 case 0x20:
9541                 case 0x21:
9542                 case 0x22:
9543                 case 0x28:
9544                 case 0x29:
9545                 case 0x2a:
9546                 {
9547                     /* crc32/crc32c */
9548                     uint32_t sz = op & 0x3;
9549                     uint32_t c = op & 0x8;
9550
9551                     if (!arm_dc_feature(s, ARM_FEATURE_CRC)) {
9552                         goto illegal_op;
9553                     }
9554
9555                     tmp2 = load_reg(s, rm);
9556                     if (sz == 0) {
9557                         tcg_gen_andi_i32(tmp2, tmp2, 0xff);
9558                     } else if (sz == 1) {
9559                         tcg_gen_andi_i32(tmp2, tmp2, 0xffff);
9560                     }
9561                     tmp3 = tcg_const_i32(1 << sz);
9562                     if (c) {
9563                         gen_helper_crc32c(tmp, tmp, tmp2, tmp3);
9564                     } else {
9565                         gen_helper_crc32(tmp, tmp, tmp2, tmp3);
9566                     }
9567                     tcg_temp_free_i32(tmp2);
9568                     tcg_temp_free_i32(tmp3);
9569                     break;
9570                 }
9571                 default:
9572                     goto illegal_op;
9573                 }
9574             }
9575             store_reg(s, rd, tmp);
9576             break;
9577         case 4: case 5: /* 32-bit multiply.  Sum of absolute differences.  */
9578             op = (insn >> 4) & 0xf;
9579             tmp = load_reg(s, rn);
9580             tmp2 = load_reg(s, rm);
9581             switch ((insn >> 20) & 7) {
9582             case 0: /* 32 x 32 -> 32 */
9583                 tcg_gen_mul_i32(tmp, tmp, tmp2);
9584                 tcg_temp_free_i32(tmp2);
9585                 if (rs != 15) {
9586                     tmp2 = load_reg(s, rs);
9587                     if (op)
9588                         tcg_gen_sub_i32(tmp, tmp2, tmp);
9589                     else
9590                         tcg_gen_add_i32(tmp, tmp, tmp2);
9591                     tcg_temp_free_i32(tmp2);
9592                 }
9593                 break;
9594             case 1: /* 16 x 16 -> 32 */
9595                 gen_mulxy(tmp, tmp2, op & 2, op & 1);
9596                 tcg_temp_free_i32(tmp2);
9597                 if (rs != 15) {
9598                     tmp2 = load_reg(s, rs);
9599                     gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
9600                     tcg_temp_free_i32(tmp2);
9601                 }
9602                 break;
9603             case 2: /* Dual multiply add.  */
9604             case 4: /* Dual multiply subtract.  */
9605                 if (op)
9606                     gen_swap_half(tmp2);
9607                 gen_smul_dual(tmp, tmp2);
9608                 if (insn & (1 << 22)) {
9609                     /* This subtraction cannot overflow. */
9610                     tcg_gen_sub_i32(tmp, tmp, tmp2);
9611                 } else {
9612                     /* This addition cannot overflow 32 bits;
9613                      * however it may overflow considered as a signed
9614                      * operation, in which case we must set the Q flag.
9615                      */
9616                     gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
9617                 }
9618                 tcg_temp_free_i32(tmp2);
9619                 if (rs != 15)
9620                   {
9621                     tmp2 = load_reg(s, rs);
9622                     gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
9623                     tcg_temp_free_i32(tmp2);
9624                   }
9625                 break;
9626             case 3: /* 32 * 16 -> 32msb */
9627                 if (op)
9628                     tcg_gen_sari_i32(tmp2, tmp2, 16);
9629                 else
9630                     gen_sxth(tmp2);
9631                 tmp64 = gen_muls_i64_i32(tmp, tmp2);
9632                 tcg_gen_shri_i64(tmp64, tmp64, 16);
9633                 tmp = tcg_temp_new_i32();
9634                 tcg_gen_trunc_i64_i32(tmp, tmp64);
9635                 tcg_temp_free_i64(tmp64);
9636                 if (rs != 15)
9637                   {
9638                     tmp2 = load_reg(s, rs);
9639                     gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
9640                     tcg_temp_free_i32(tmp2);
9641                   }
9642                 break;
9643             case 5: case 6: /* 32 * 32 -> 32msb (SMMUL, SMMLA, SMMLS) */
9644                 tmp64 = gen_muls_i64_i32(tmp, tmp2);
9645                 if (rs != 15) {
9646                     tmp = load_reg(s, rs);
9647                     if (insn & (1 << 20)) {
9648                         tmp64 = gen_addq_msw(tmp64, tmp);
9649                     } else {
9650                         tmp64 = gen_subq_msw(tmp64, tmp);
9651                     }
9652                 }
9653                 if (insn & (1 << 4)) {
9654                     tcg_gen_addi_i64(tmp64, tmp64, 0x80000000u);
9655                 }
9656                 tcg_gen_shri_i64(tmp64, tmp64, 32);
9657                 tmp = tcg_temp_new_i32();
9658                 tcg_gen_trunc_i64_i32(tmp, tmp64);
9659                 tcg_temp_free_i64(tmp64);
9660                 break;
9661             case 7: /* Unsigned sum of absolute differences.  */
9662                 gen_helper_usad8(tmp, tmp, tmp2);
9663                 tcg_temp_free_i32(tmp2);
9664                 if (rs != 15) {
9665                     tmp2 = load_reg(s, rs);
9666                     tcg_gen_add_i32(tmp, tmp, tmp2);
9667                     tcg_temp_free_i32(tmp2);
9668                 }
9669                 break;
9670             }
9671             store_reg(s, rd, tmp);
9672             break;
9673         case 6: case 7: /* 64-bit multiply, Divide.  */
9674             op = ((insn >> 4) & 0xf) | ((insn >> 16) & 0x70);
9675             tmp = load_reg(s, rn);
9676             tmp2 = load_reg(s, rm);
9677             if ((op & 0x50) == 0x10) {
9678                 /* sdiv, udiv */
9679                 if (!arm_dc_feature(s, ARM_FEATURE_THUMB_DIV)) {
9680                     goto illegal_op;
9681                 }
9682                 if (op & 0x20)
9683                     gen_helper_udiv(tmp, tmp, tmp2);
9684                 else
9685                     gen_helper_sdiv(tmp, tmp, tmp2);
9686                 tcg_temp_free_i32(tmp2);
9687                 store_reg(s, rd, tmp);
9688             } else if ((op & 0xe) == 0xc) {
9689                 /* Dual multiply accumulate long.  */
9690                 if (op & 1)
9691                     gen_swap_half(tmp2);
9692                 gen_smul_dual(tmp, tmp2);
9693                 if (op & 0x10) {
9694                     tcg_gen_sub_i32(tmp, tmp, tmp2);
9695                 } else {
9696                     tcg_gen_add_i32(tmp, tmp, tmp2);
9697                 }
9698                 tcg_temp_free_i32(tmp2);
9699                 /* BUGFIX */
9700                 tmp64 = tcg_temp_new_i64();
9701                 tcg_gen_ext_i32_i64(tmp64, tmp);
9702                 tcg_temp_free_i32(tmp);
9703                 gen_addq(s, tmp64, rs, rd);
9704                 gen_storeq_reg(s, rs, rd, tmp64);
9705                 tcg_temp_free_i64(tmp64);
9706             } else {
9707                 if (op & 0x20) {
9708                     /* Unsigned 64-bit multiply  */
9709                     tmp64 = gen_mulu_i64_i32(tmp, tmp2);
9710                 } else {
9711                     if (op & 8) {
9712                         /* smlalxy */
9713                         gen_mulxy(tmp, tmp2, op & 2, op & 1);
9714                         tcg_temp_free_i32(tmp2);
9715                         tmp64 = tcg_temp_new_i64();
9716                         tcg_gen_ext_i32_i64(tmp64, tmp);
9717                         tcg_temp_free_i32(tmp);
9718                     } else {
9719                         /* Signed 64-bit multiply  */
9720                         tmp64 = gen_muls_i64_i32(tmp, tmp2);
9721                     }
9722                 }
9723                 if (op & 4) {
9724                     /* umaal */
9725                     gen_addq_lo(s, tmp64, rs);
9726                     gen_addq_lo(s, tmp64, rd);
9727                 } else if (op & 0x40) {
9728                     /* 64-bit accumulate.  */
9729                     gen_addq(s, tmp64, rs, rd);
9730                 }
9731                 gen_storeq_reg(s, rs, rd, tmp64);
9732                 tcg_temp_free_i64(tmp64);
9733             }
9734             break;
9735         }
9736         break;
9737     case 6: case 7: case 14: case 15:
9738         /* Coprocessor.  */
9739         if (((insn >> 24) & 3) == 3) {
9740             /* Translate into the equivalent ARM encoding.  */
9741             insn = (insn & 0xe2ffffff) | ((insn & (1 << 28)) >> 4) | (1 << 28);
9742             if (disas_neon_data_insn(s, insn)) {
9743                 goto illegal_op;
9744             }
9745         } else if (((insn >> 8) & 0xe) == 10) {
9746             if (disas_vfp_insn(s, insn)) {
9747                 goto illegal_op;
9748             }
9749         } else {
9750             if (insn & (1 << 28))
9751                 goto illegal_op;
9752             if (disas_coproc_insn(s, insn)) {
9753                 goto illegal_op;
9754             }
9755         }
9756         break;
9757     case 8: case 9: case 10: case 11:
9758         if (insn & (1 << 15)) {
9759             /* Branches, misc control.  */
9760             if (insn & 0x5000) {
9761                 /* Unconditional branch.  */
9762                 /* signextend(hw1[10:0]) -> offset[:12].  */
9763                 offset = ((int32_t)insn << 5) >> 9 & ~(int32_t)0xfff;
9764                 /* hw1[10:0] -> offset[11:1].  */
9765                 offset |= (insn & 0x7ff) << 1;
9766                 /* (~hw2[13, 11] ^ offset[24]) -> offset[23,22]
9767                    offset[24:22] already have the same value because of the
9768                    sign extension above.  */
9769                 offset ^= ((~insn) & (1 << 13)) << 10;
9770                 offset ^= ((~insn) & (1 << 11)) << 11;
9771
9772                 if (insn & (1 << 14)) {
9773                     /* Branch and link.  */
9774                     tcg_gen_movi_i32(cpu_R[14], s->pc | 1);
9775                 }
9776
9777                 offset += s->pc;
9778                 if (insn & (1 << 12)) {
9779                     /* b/bl */
9780                     gen_jmp(s, offset);
9781                 } else {
9782                     /* blx */
9783                     offset &= ~(uint32_t)2;
9784                     /* thumb2 bx, no need to check */
9785                     gen_bx_im(s, offset);
9786                 }
9787             } else if (((insn >> 23) & 7) == 7) {
9788                 /* Misc control */
9789                 if (insn & (1 << 13))
9790                     goto illegal_op;
9791
9792                 if (insn & (1 << 26)) {
9793                     if (!(insn & (1 << 20))) {
9794                         /* Hypervisor call (v7) */
9795                         int imm16 = extract32(insn, 16, 4) << 12
9796                             | extract32(insn, 0, 12);
9797                         ARCH(7);
9798                         if (IS_USER(s)) {
9799                             goto illegal_op;
9800                         }
9801                         gen_hvc(s, imm16);
9802                     } else {
9803                         /* Secure monitor call (v6+) */
9804                         ARCH(6K);
9805                         if (IS_USER(s)) {
9806                             goto illegal_op;
9807                         }
9808                         gen_smc(s);
9809                     }
9810                 } else {
9811                     op = (insn >> 20) & 7;
9812                     switch (op) {
9813                     case 0: /* msr cpsr.  */
9814                         if (arm_dc_feature(s, ARM_FEATURE_M)) {
9815                             tmp = load_reg(s, rn);
9816                             addr = tcg_const_i32(insn & 0xff);
9817                             gen_helper_v7m_msr(cpu_env, addr, tmp);
9818                             tcg_temp_free_i32(addr);
9819                             tcg_temp_free_i32(tmp);
9820                             gen_lookup_tb(s);
9821                             break;
9822                         }
9823                         /* fall through */
9824                     case 1: /* msr spsr.  */
9825                         if (arm_dc_feature(s, ARM_FEATURE_M)) {
9826                             goto illegal_op;
9827                         }
9828                         tmp = load_reg(s, rn);
9829                         if (gen_set_psr(s,
9830                               msr_mask(s, (insn >> 8) & 0xf, op == 1),
9831                               op == 1, tmp))
9832                             goto illegal_op;
9833                         break;
9834                     case 2: /* cps, nop-hint.  */
9835                         if (((insn >> 8) & 7) == 0) {
9836                             gen_nop_hint(s, insn & 0xff);
9837                         }
9838                         /* Implemented as NOP in user mode.  */
9839                         if (IS_USER(s))
9840                             break;
9841                         offset = 0;
9842                         imm = 0;
9843                         if (insn & (1 << 10)) {
9844                             if (insn & (1 << 7))
9845                                 offset |= CPSR_A;
9846                             if (insn & (1 << 6))
9847                                 offset |= CPSR_I;
9848                             if (insn & (1 << 5))
9849                                 offset |= CPSR_F;
9850                             if (insn & (1 << 9))
9851                                 imm = CPSR_A | CPSR_I | CPSR_F;
9852                         }
9853                         if (insn & (1 << 8)) {
9854                             offset |= 0x1f;
9855                             imm |= (insn & 0x1f);
9856                         }
9857                         if (offset) {
9858                             gen_set_psr_im(s, offset, 0, imm);
9859                         }
9860                         break;
9861                     case 3: /* Special control operations.  */
9862                         ARCH(7);
9863                         op = (insn >> 4) & 0xf;
9864                         switch (op) {
9865                         case 2: /* clrex */
9866                             gen_clrex(s);
9867                             break;
9868                         case 4: /* dsb */
9869                         case 5: /* dmb */
9870                         case 6: /* isb */
9871                             /* These execute as NOPs.  */
9872                             break;
9873                         default:
9874                             goto illegal_op;
9875                         }
9876                         break;
9877                     case 4: /* bxj */
9878                         /* Trivial implementation equivalent to bx.  */
9879                         tmp = load_reg(s, rn);
9880                         gen_bx(s, tmp);
9881                         break;
9882                     case 5: /* Exception return.  */
9883                         if (IS_USER(s)) {
9884                             goto illegal_op;
9885                         }
9886                         if (rn != 14 || rd != 15) {
9887                             goto illegal_op;
9888                         }
9889                         tmp = load_reg(s, rn);
9890                         tcg_gen_subi_i32(tmp, tmp, insn & 0xff);
9891                         gen_exception_return(s, tmp);
9892                         break;
9893                     case 6: /* mrs cpsr.  */
9894                         tmp = tcg_temp_new_i32();
9895                         if (arm_dc_feature(s, ARM_FEATURE_M)) {
9896                             addr = tcg_const_i32(insn & 0xff);
9897                             gen_helper_v7m_mrs(tmp, cpu_env, addr);
9898                             tcg_temp_free_i32(addr);
9899                         } else {
9900                             gen_helper_cpsr_read(tmp, cpu_env);
9901                         }
9902                         store_reg(s, rd, tmp);
9903                         break;
9904                     case 7: /* mrs spsr.  */
9905                         /* Not accessible in user mode.  */
9906                         if (IS_USER(s) || arm_dc_feature(s, ARM_FEATURE_M)) {
9907                             goto illegal_op;
9908                         }
9909                         tmp = load_cpu_field(spsr);
9910                         store_reg(s, rd, tmp);
9911                         break;
9912                     }
9913                 }
9914             } else {
9915                 /* Conditional branch.  */
9916                 op = (insn >> 22) & 0xf;
9917                 /* Generate a conditional jump to next instruction.  */
9918                 s->condlabel = gen_new_label();
9919                 arm_gen_test_cc(op ^ 1, s->condlabel);
9920                 s->condjmp = 1;
9921
9922                 /* offset[11:1] = insn[10:0] */
9923                 offset = (insn & 0x7ff) << 1;
9924                 /* offset[17:12] = insn[21:16].  */
9925                 offset |= (insn & 0x003f0000) >> 4;
9926                 /* offset[31:20] = insn[26].  */
9927                 offset |= ((int32_t)((insn << 5) & 0x80000000)) >> 11;
9928                 /* offset[18] = insn[13].  */
9929                 offset |= (insn & (1 << 13)) << 5;
9930                 /* offset[19] = insn[11].  */
9931                 offset |= (insn & (1 << 11)) << 8;
9932
9933                 /* jump to the offset */
9934                 gen_jmp(s, s->pc + offset);
9935             }
9936         } else {
9937             /* Data processing immediate.  */
9938             if (insn & (1 << 25)) {
9939                 if (insn & (1 << 24)) {
9940                     if (insn & (1 << 20))
9941                         goto illegal_op;
9942                     /* Bitfield/Saturate.  */
9943                     op = (insn >> 21) & 7;
9944                     imm = insn & 0x1f;
9945                     shift = ((insn >> 6) & 3) | ((insn >> 10) & 0x1c);
9946                     if (rn == 15) {
9947                         tmp = tcg_temp_new_i32();
9948                         tcg_gen_movi_i32(tmp, 0);
9949                     } else {
9950                         tmp = load_reg(s, rn);
9951                     }
9952                     switch (op) {
9953                     case 2: /* Signed bitfield extract.  */
9954                         imm++;
9955                         if (shift + imm > 32)
9956                             goto illegal_op;
9957                         if (imm < 32)
9958                             gen_sbfx(tmp, shift, imm);
9959                         break;
9960                     case 6: /* Unsigned bitfield extract.  */
9961                         imm++;
9962                         if (shift + imm > 32)
9963                             goto illegal_op;
9964                         if (imm < 32)
9965                             gen_ubfx(tmp, shift, (1u << imm) - 1);
9966                         break;
9967                     case 3: /* Bitfield insert/clear.  */
9968                         if (imm < shift)
9969                             goto illegal_op;
9970                         imm = imm + 1 - shift;
9971                         if (imm != 32) {
9972                             tmp2 = load_reg(s, rd);
9973                             tcg_gen_deposit_i32(tmp, tmp2, tmp, shift, imm);
9974                             tcg_temp_free_i32(tmp2);
9975                         }
9976                         break;
9977                     case 7:
9978                         goto illegal_op;
9979                     default: /* Saturate.  */
9980                         if (shift) {
9981                             if (op & 1)
9982                                 tcg_gen_sari_i32(tmp, tmp, shift);
9983                             else
9984                                 tcg_gen_shli_i32(tmp, tmp, shift);
9985                         }
9986                         tmp2 = tcg_const_i32(imm);
9987                         if (op & 4) {
9988                             /* Unsigned.  */
9989                             if ((op & 1) && shift == 0)
9990                                 gen_helper_usat16(tmp, cpu_env, tmp, tmp2);
9991                             else
9992                                 gen_helper_usat(tmp, cpu_env, tmp, tmp2);
9993                         } else {
9994                             /* Signed.  */
9995                             if ((op & 1) && shift == 0)
9996                                 gen_helper_ssat16(tmp, cpu_env, tmp, tmp2);
9997                             else
9998                                 gen_helper_ssat(tmp, cpu_env, tmp, tmp2);
9999                         }
10000                         tcg_temp_free_i32(tmp2);
10001                         break;
10002                     }
10003                     store_reg(s, rd, tmp);
10004                 } else {
10005                     imm = ((insn & 0x04000000) >> 15)
10006                           | ((insn & 0x7000) >> 4) | (insn & 0xff);
10007                     if (insn & (1 << 22)) {
10008                         /* 16-bit immediate.  */
10009                         imm |= (insn >> 4) & 0xf000;
10010                         if (insn & (1 << 23)) {
10011                             /* movt */
10012                             tmp = load_reg(s, rd);
10013                             tcg_gen_ext16u_i32(tmp, tmp);
10014                             tcg_gen_ori_i32(tmp, tmp, imm << 16);
10015                         } else {
10016                             /* movw */
10017                             tmp = tcg_temp_new_i32();
10018                             tcg_gen_movi_i32(tmp, imm);
10019                         }
10020                     } else {
10021                         /* Add/sub 12-bit immediate.  */
10022                         if (rn == 15) {
10023                             offset = s->pc & ~(uint32_t)3;
10024                             if (insn & (1 << 23))
10025                                 offset -= imm;
10026                             else
10027                                 offset += imm;
10028                             tmp = tcg_temp_new_i32();
10029                             tcg_gen_movi_i32(tmp, offset);
10030                         } else {
10031                             tmp = load_reg(s, rn);
10032                             if (insn & (1 << 23))
10033                                 tcg_gen_subi_i32(tmp, tmp, imm);
10034                             else
10035                                 tcg_gen_addi_i32(tmp, tmp, imm);
10036                         }
10037                     }
10038                     store_reg(s, rd, tmp);
10039                 }
10040             } else {
10041                 int shifter_out = 0;
10042                 /* modified 12-bit immediate.  */
10043                 shift = ((insn & 0x04000000) >> 23) | ((insn & 0x7000) >> 12);
10044                 imm = (insn & 0xff);
10045                 switch (shift) {
10046                 case 0: /* XY */
10047                     /* Nothing to do.  */
10048                     break;
10049                 case 1: /* 00XY00XY */
10050                     imm |= imm << 16;
10051                     break;
10052                 case 2: /* XY00XY00 */
10053                     imm |= imm << 16;
10054                     imm <<= 8;
10055                     break;
10056                 case 3: /* XYXYXYXY */
10057                     imm |= imm << 16;
10058                     imm |= imm << 8;
10059                     break;
10060                 default: /* Rotated constant.  */
10061                     shift = (shift << 1) | (imm >> 7);
10062                     imm |= 0x80;
10063                     imm = imm << (32 - shift);
10064                     shifter_out = 1;
10065                     break;
10066                 }
10067                 tmp2 = tcg_temp_new_i32();
10068                 tcg_gen_movi_i32(tmp2, imm);
10069                 rn = (insn >> 16) & 0xf;
10070                 if (rn == 15) {
10071                     tmp = tcg_temp_new_i32();
10072                     tcg_gen_movi_i32(tmp, 0);
10073                 } else {
10074                     tmp = load_reg(s, rn);
10075                 }
10076                 op = (insn >> 21) & 0xf;
10077                 if (gen_thumb2_data_op(s, op, (insn & (1 << 20)) != 0,
10078                                        shifter_out, tmp, tmp2))
10079                     goto illegal_op;
10080                 tcg_temp_free_i32(tmp2);
10081                 rd = (insn >> 8) & 0xf;
10082                 if (rd != 15) {
10083                     store_reg(s, rd, tmp);
10084                 } else {
10085                     tcg_temp_free_i32(tmp);
10086                 }
10087             }
10088         }
10089         break;
10090     case 12: /* Load/store single data item.  */
10091         {
10092         int postinc = 0;
10093         int writeback = 0;
10094         int memidx;
10095         if ((insn & 0x01100000) == 0x01000000) {
10096             if (disas_neon_ls_insn(s, insn)) {
10097                 goto illegal_op;
10098             }
10099             break;
10100         }
10101         op = ((insn >> 21) & 3) | ((insn >> 22) & 4);
10102         if (rs == 15) {
10103             if (!(insn & (1 << 20))) {
10104                 goto illegal_op;
10105             }
10106             if (op != 2) {
10107                 /* Byte or halfword load space with dest == r15 : memory hints.
10108                  * Catch them early so we don't emit pointless addressing code.
10109                  * This space is a mix of:
10110                  *  PLD/PLDW/PLI,  which we implement as NOPs (note that unlike
10111                  *     the ARM encodings, PLDW space doesn't UNDEF for non-v7MP
10112                  *     cores)
10113                  *  unallocated hints, which must be treated as NOPs
10114                  *  UNPREDICTABLE space, which we NOP or UNDEF depending on
10115                  *     which is easiest for the decoding logic
10116                  *  Some space which must UNDEF
10117                  */
10118                 int op1 = (insn >> 23) & 3;
10119                 int op2 = (insn >> 6) & 0x3f;
10120                 if (op & 2) {
10121                     goto illegal_op;
10122                 }
10123                 if (rn == 15) {
10124                     /* UNPREDICTABLE, unallocated hint or
10125                      * PLD/PLDW/PLI (literal)
10126                      */
10127                     return 0;
10128                 }
10129                 if (op1 & 1) {
10130                     return 0; /* PLD/PLDW/PLI or unallocated hint */
10131                 }
10132                 if ((op2 == 0) || ((op2 & 0x3c) == 0x30)) {
10133                     return 0; /* PLD/PLDW/PLI or unallocated hint */
10134                 }
10135                 /* UNDEF space, or an UNPREDICTABLE */
10136                 return 1;
10137             }
10138         }
10139         memidx = get_mem_index(s);
10140         if (rn == 15) {
10141             addr = tcg_temp_new_i32();
10142             /* PC relative.  */
10143             /* s->pc has already been incremented by 4.  */
10144             imm = s->pc & 0xfffffffc;
10145             if (insn & (1 << 23))
10146                 imm += insn & 0xfff;
10147             else
10148                 imm -= insn & 0xfff;
10149             tcg_gen_movi_i32(addr, imm);
10150         } else {
10151             addr = load_reg(s, rn);
10152             if (insn & (1 << 23)) {
10153                 /* Positive offset.  */
10154                 imm = insn & 0xfff;
10155                 tcg_gen_addi_i32(addr, addr, imm);
10156             } else {
10157                 imm = insn & 0xff;
10158                 switch ((insn >> 8) & 0xf) {
10159                 case 0x0: /* Shifted Register.  */
10160                     shift = (insn >> 4) & 0xf;
10161                     if (shift > 3) {
10162                         tcg_temp_free_i32(addr);
10163                         goto illegal_op;
10164                     }
10165                     tmp = load_reg(s, rm);
10166                     if (shift)
10167                         tcg_gen_shli_i32(tmp, tmp, shift);
10168                     tcg_gen_add_i32(addr, addr, tmp);
10169                     tcg_temp_free_i32(tmp);
10170                     break;
10171                 case 0xc: /* Negative offset.  */
10172                     tcg_gen_addi_i32(addr, addr, -imm);
10173                     break;
10174                 case 0xe: /* User privilege.  */
10175                     tcg_gen_addi_i32(addr, addr, imm);
10176                     memidx = MMU_USER_IDX;
10177                     break;
10178                 case 0x9: /* Post-decrement.  */
10179                     imm = -imm;
10180                     /* Fall through.  */
10181                 case 0xb: /* Post-increment.  */
10182                     postinc = 1;
10183                     writeback = 1;
10184                     break;
10185                 case 0xd: /* Pre-decrement.  */
10186                     imm = -imm;
10187                     /* Fall through.  */
10188                 case 0xf: /* Pre-increment.  */
10189                     tcg_gen_addi_i32(addr, addr, imm);
10190                     writeback = 1;
10191                     break;
10192                 default:
10193                     tcg_temp_free_i32(addr);
10194                     goto illegal_op;
10195                 }
10196             }
10197         }
10198         if (insn & (1 << 20)) {
10199             /* Load.  */
10200             tmp = tcg_temp_new_i32();
10201             switch (op) {
10202             case 0:
10203                 gen_aa32_ld8u(tmp, addr, memidx);
10204                 break;
10205             case 4:
10206                 gen_aa32_ld8s(tmp, addr, memidx);
10207                 break;
10208             case 1:
10209                 gen_aa32_ld16u(tmp, addr, memidx);
10210                 break;
10211             case 5:
10212                 gen_aa32_ld16s(tmp, addr, memidx);
10213                 break;
10214             case 2:
10215                 gen_aa32_ld32u(tmp, addr, memidx);
10216                 break;
10217             default:
10218                 tcg_temp_free_i32(tmp);
10219                 tcg_temp_free_i32(addr);
10220                 goto illegal_op;
10221             }
10222             if (rs == 15) {
10223                 gen_bx(s, tmp);
10224             } else {
10225                 store_reg(s, rs, tmp);
10226             }
10227         } else {
10228             /* Store.  */
10229             tmp = load_reg(s, rs);
10230             switch (op) {
10231             case 0:
10232                 gen_aa32_st8(tmp, addr, memidx);
10233                 break;
10234             case 1:
10235                 gen_aa32_st16(tmp, addr, memidx);
10236                 break;
10237             case 2:
10238                 gen_aa32_st32(tmp, addr, memidx);
10239                 break;
10240             default:
10241                 tcg_temp_free_i32(tmp);
10242                 tcg_temp_free_i32(addr);
10243                 goto illegal_op;
10244             }
10245             tcg_temp_free_i32(tmp);
10246         }
10247         if (postinc)
10248             tcg_gen_addi_i32(addr, addr, imm);
10249         if (writeback) {
10250             store_reg(s, rn, addr);
10251         } else {
10252             tcg_temp_free_i32(addr);
10253         }
10254         }
10255         break;
10256     default:
10257         goto illegal_op;
10258     }
10259     return 0;
10260 illegal_op:
10261     return 1;
10262 }
10263
10264 static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
10265 {
10266     uint32_t val, insn, op, rm, rn, rd, shift, cond;
10267     int32_t offset;
10268     int i;
10269     TCGv_i32 tmp;
10270     TCGv_i32 tmp2;
10271     TCGv_i32 addr;
10272
10273     if (s->condexec_mask) {
10274         cond = s->condexec_cond;
10275         if (cond != 0x0e) {     /* Skip conditional when condition is AL. */
10276           s->condlabel = gen_new_label();
10277           arm_gen_test_cc(cond ^ 1, s->condlabel);
10278           s->condjmp = 1;
10279         }
10280     }
10281
10282     insn = arm_lduw_code(env, s->pc, s->bswap_code);
10283     s->pc += 2;
10284
10285     switch (insn >> 12) {
10286     case 0: case 1:
10287
10288         rd = insn & 7;
10289         op = (insn >> 11) & 3;
10290         if (op == 3) {
10291             /* add/subtract */
10292             rn = (insn >> 3) & 7;
10293             tmp = load_reg(s, rn);
10294             if (insn & (1 << 10)) {
10295                 /* immediate */
10296                 tmp2 = tcg_temp_new_i32();
10297                 tcg_gen_movi_i32(tmp2, (insn >> 6) & 7);
10298             } else {
10299                 /* reg */
10300                 rm = (insn >> 6) & 7;
10301                 tmp2 = load_reg(s, rm);
10302             }
10303             if (insn & (1 << 9)) {
10304                 if (s->condexec_mask)
10305                     tcg_gen_sub_i32(tmp, tmp, tmp2);
10306                 else
10307                     gen_sub_CC(tmp, tmp, tmp2);
10308             } else {
10309                 if (s->condexec_mask)
10310                     tcg_gen_add_i32(tmp, tmp, tmp2);
10311                 else
10312                     gen_add_CC(tmp, tmp, tmp2);
10313             }
10314             tcg_temp_free_i32(tmp2);
10315             store_reg(s, rd, tmp);
10316         } else {
10317             /* shift immediate */
10318             rm = (insn >> 3) & 7;
10319             shift = (insn >> 6) & 0x1f;
10320             tmp = load_reg(s, rm);
10321             gen_arm_shift_im(tmp, op, shift, s->condexec_mask == 0);
10322             if (!s->condexec_mask)
10323                 gen_logic_CC(tmp);
10324             store_reg(s, rd, tmp);
10325         }
10326         break;
10327     case 2: case 3:
10328         /* arithmetic large immediate */
10329         op = (insn >> 11) & 3;
10330         rd = (insn >> 8) & 0x7;
10331         if (op == 0) { /* mov */
10332             tmp = tcg_temp_new_i32();
10333             tcg_gen_movi_i32(tmp, insn & 0xff);
10334             if (!s->condexec_mask)
10335                 gen_logic_CC(tmp);
10336             store_reg(s, rd, tmp);
10337         } else {
10338             tmp = load_reg(s, rd);
10339             tmp2 = tcg_temp_new_i32();
10340             tcg_gen_movi_i32(tmp2, insn & 0xff);
10341             switch (op) {
10342             case 1: /* cmp */
10343                 gen_sub_CC(tmp, tmp, tmp2);
10344                 tcg_temp_free_i32(tmp);
10345                 tcg_temp_free_i32(tmp2);
10346                 break;
10347             case 2: /* add */
10348                 if (s->condexec_mask)
10349                     tcg_gen_add_i32(tmp, tmp, tmp2);
10350                 else
10351                     gen_add_CC(tmp, tmp, tmp2);
10352                 tcg_temp_free_i32(tmp2);
10353                 store_reg(s, rd, tmp);
10354                 break;
10355             case 3: /* sub */
10356                 if (s->condexec_mask)
10357                     tcg_gen_sub_i32(tmp, tmp, tmp2);
10358                 else
10359                     gen_sub_CC(tmp, tmp, tmp2);
10360                 tcg_temp_free_i32(tmp2);
10361                 store_reg(s, rd, tmp);
10362                 break;
10363             }
10364         }
10365         break;
10366     case 4:
10367         if (insn & (1 << 11)) {
10368             rd = (insn >> 8) & 7;
10369             /* load pc-relative.  Bit 1 of PC is ignored.  */
10370             val = s->pc + 2 + ((insn & 0xff) * 4);
10371             val &= ~(uint32_t)2;
10372             addr = tcg_temp_new_i32();
10373             tcg_gen_movi_i32(addr, val);
10374             tmp = tcg_temp_new_i32();
10375             gen_aa32_ld32u(tmp, addr, get_mem_index(s));
10376             tcg_temp_free_i32(addr);
10377             store_reg(s, rd, tmp);
10378             break;
10379         }
10380         if (insn & (1 << 10)) {
10381             /* data processing extended or blx */
10382             rd = (insn & 7) | ((insn >> 4) & 8);
10383             rm = (insn >> 3) & 0xf;
10384             op = (insn >> 8) & 3;
10385             switch (op) {
10386             case 0: /* add */
10387                 tmp = load_reg(s, rd);
10388                 tmp2 = load_reg(s, rm);
10389                 tcg_gen_add_i32(tmp, tmp, tmp2);
10390                 tcg_temp_free_i32(tmp2);
10391                 store_reg(s, rd, tmp);
10392                 break;
10393             case 1: /* cmp */
10394                 tmp = load_reg(s, rd);
10395                 tmp2 = load_reg(s, rm);
10396                 gen_sub_CC(tmp, tmp, tmp2);
10397                 tcg_temp_free_i32(tmp2);
10398                 tcg_temp_free_i32(tmp);
10399                 break;
10400             case 2: /* mov/cpy */
10401                 tmp = load_reg(s, rm);
10402                 store_reg(s, rd, tmp);
10403                 break;
10404             case 3:/* branch [and link] exchange thumb register */
10405                 tmp = load_reg(s, rm);
10406                 if (insn & (1 << 7)) {
10407                     ARCH(5);
10408                     val = (uint32_t)s->pc | 1;
10409                     tmp2 = tcg_temp_new_i32();
10410                     tcg_gen_movi_i32(tmp2, val);
10411                     store_reg(s, 14, tmp2);
10412                 }
10413                 /* already thumb, no need to check */
10414                 gen_bx(s, tmp);
10415                 break;
10416             }
10417             break;
10418         }
10419
10420         /* data processing register */
10421         rd = insn & 7;
10422         rm = (insn >> 3) & 7;
10423         op = (insn >> 6) & 0xf;
10424         if (op == 2 || op == 3 || op == 4 || op == 7) {
10425             /* the shift/rotate ops want the operands backwards */
10426             val = rm;
10427             rm = rd;
10428             rd = val;
10429             val = 1;
10430         } else {
10431             val = 0;
10432         }
10433
10434         if (op == 9) { /* neg */
10435             tmp = tcg_temp_new_i32();
10436             tcg_gen_movi_i32(tmp, 0);
10437         } else if (op != 0xf) { /* mvn doesn't read its first operand */
10438             tmp = load_reg(s, rd);
10439         } else {
10440             TCGV_UNUSED_I32(tmp);
10441         }
10442
10443         tmp2 = load_reg(s, rm);
10444         switch (op) {
10445         case 0x0: /* and */
10446             tcg_gen_and_i32(tmp, tmp, tmp2);
10447             if (!s->condexec_mask)
10448                 gen_logic_CC(tmp);
10449             break;
10450         case 0x1: /* eor */
10451             tcg_gen_xor_i32(tmp, tmp, tmp2);
10452             if (!s->condexec_mask)
10453                 gen_logic_CC(tmp);
10454             break;
10455         case 0x2: /* lsl */
10456             if (s->condexec_mask) {
10457                 gen_shl(tmp2, tmp2, tmp);
10458             } else {
10459                 gen_helper_shl_cc(tmp2, cpu_env, tmp2, tmp);
10460                 gen_logic_CC(tmp2);
10461             }
10462             break;
10463         case 0x3: /* lsr */
10464             if (s->condexec_mask) {
10465                 gen_shr(tmp2, tmp2, tmp);
10466             } else {
10467                 gen_helper_shr_cc(tmp2, cpu_env, tmp2, tmp);
10468                 gen_logic_CC(tmp2);
10469             }
10470             break;
10471         case 0x4: /* asr */
10472             if (s->condexec_mask) {
10473                 gen_sar(tmp2, tmp2, tmp);
10474             } else {
10475                 gen_helper_sar_cc(tmp2, cpu_env, tmp2, tmp);
10476                 gen_logic_CC(tmp2);
10477             }
10478             break;
10479         case 0x5: /* adc */
10480             if (s->condexec_mask) {
10481                 gen_adc(tmp, tmp2);
10482             } else {
10483                 gen_adc_CC(tmp, tmp, tmp2);
10484             }
10485             break;
10486         case 0x6: /* sbc */
10487             if (s->condexec_mask) {
10488                 gen_sub_carry(tmp, tmp, tmp2);
10489             } else {
10490                 gen_sbc_CC(tmp, tmp, tmp2);
10491             }
10492             break;
10493         case 0x7: /* ror */
10494             if (s->condexec_mask) {
10495                 tcg_gen_andi_i32(tmp, tmp, 0x1f);
10496                 tcg_gen_rotr_i32(tmp2, tmp2, tmp);
10497             } else {
10498                 gen_helper_ror_cc(tmp2, cpu_env, tmp2, tmp);
10499                 gen_logic_CC(tmp2);
10500             }
10501             break;
10502         case 0x8: /* tst */
10503             tcg_gen_and_i32(tmp, tmp, tmp2);
10504             gen_logic_CC(tmp);
10505             rd = 16;
10506             break;
10507         case 0x9: /* neg */
10508             if (s->condexec_mask)
10509                 tcg_gen_neg_i32(tmp, tmp2);
10510             else
10511                 gen_sub_CC(tmp, tmp, tmp2);
10512             break;
10513         case 0xa: /* cmp */
10514             gen_sub_CC(tmp, tmp, tmp2);
10515             rd = 16;
10516             break;
10517         case 0xb: /* cmn */
10518             gen_add_CC(tmp, tmp, tmp2);
10519             rd = 16;
10520             break;
10521         case 0xc: /* orr */
10522             tcg_gen_or_i32(tmp, tmp, tmp2);
10523             if (!s->condexec_mask)
10524                 gen_logic_CC(tmp);
10525             break;
10526         case 0xd: /* mul */
10527             tcg_gen_mul_i32(tmp, tmp, tmp2);
10528             if (!s->condexec_mask)
10529                 gen_logic_CC(tmp);
10530             break;
10531         case 0xe: /* bic */
10532             tcg_gen_andc_i32(tmp, tmp, tmp2);
10533             if (!s->condexec_mask)
10534                 gen_logic_CC(tmp);
10535             break;
10536         case 0xf: /* mvn */
10537             tcg_gen_not_i32(tmp2, tmp2);
10538             if (!s->condexec_mask)
10539                 gen_logic_CC(tmp2);
10540             val = 1;
10541             rm = rd;
10542             break;
10543         }
10544         if (rd != 16) {
10545             if (val) {
10546                 store_reg(s, rm, tmp2);
10547                 if (op != 0xf)
10548                     tcg_temp_free_i32(tmp);
10549             } else {
10550                 store_reg(s, rd, tmp);
10551                 tcg_temp_free_i32(tmp2);
10552             }
10553         } else {
10554             tcg_temp_free_i32(tmp);
10555             tcg_temp_free_i32(tmp2);
10556         }
10557         break;
10558
10559     case 5:
10560         /* load/store register offset.  */
10561         rd = insn & 7;
10562         rn = (insn >> 3) & 7;
10563         rm = (insn >> 6) & 7;
10564         op = (insn >> 9) & 7;
10565         addr = load_reg(s, rn);
10566         tmp = load_reg(s, rm);
10567         tcg_gen_add_i32(addr, addr, tmp);
10568         tcg_temp_free_i32(tmp);
10569
10570         if (op < 3) { /* store */
10571             tmp = load_reg(s, rd);
10572         } else {
10573             tmp = tcg_temp_new_i32();
10574         }
10575
10576         switch (op) {
10577         case 0: /* str */
10578             gen_aa32_st32(tmp, addr, get_mem_index(s));
10579             break;
10580         case 1: /* strh */
10581             gen_aa32_st16(tmp, addr, get_mem_index(s));
10582             break;
10583         case 2: /* strb */
10584             gen_aa32_st8(tmp, addr, get_mem_index(s));
10585             break;
10586         case 3: /* ldrsb */
10587             gen_aa32_ld8s(tmp, addr, get_mem_index(s));
10588             break;
10589         case 4: /* ldr */
10590             gen_aa32_ld32u(tmp, addr, get_mem_index(s));
10591             break;
10592         case 5: /* ldrh */
10593             gen_aa32_ld16u(tmp, addr, get_mem_index(s));
10594             break;
10595         case 6: /* ldrb */
10596             gen_aa32_ld8u(tmp, addr, get_mem_index(s));
10597             break;
10598         case 7: /* ldrsh */
10599             gen_aa32_ld16s(tmp, addr, get_mem_index(s));
10600             break;
10601         }
10602         if (op >= 3) { /* load */
10603             store_reg(s, rd, tmp);
10604         } else {
10605             tcg_temp_free_i32(tmp);
10606         }
10607         tcg_temp_free_i32(addr);
10608         break;
10609
10610     case 6:
10611         /* load/store word immediate offset */
10612         rd = insn & 7;
10613         rn = (insn >> 3) & 7;
10614         addr = load_reg(s, rn);
10615         val = (insn >> 4) & 0x7c;
10616         tcg_gen_addi_i32(addr, addr, val);
10617
10618         if (insn & (1 << 11)) {
10619             /* load */
10620             tmp = tcg_temp_new_i32();
10621             gen_aa32_ld32u(tmp, addr, get_mem_index(s));
10622             store_reg(s, rd, tmp);
10623         } else {
10624             /* store */
10625             tmp = load_reg(s, rd);
10626             gen_aa32_st32(tmp, addr, get_mem_index(s));
10627             tcg_temp_free_i32(tmp);
10628         }
10629         tcg_temp_free_i32(addr);
10630         break;
10631
10632     case 7:
10633         /* load/store byte immediate offset */
10634         rd = insn & 7;
10635         rn = (insn >> 3) & 7;
10636         addr = load_reg(s, rn);
10637         val = (insn >> 6) & 0x1f;
10638         tcg_gen_addi_i32(addr, addr, val);
10639
10640         if (insn & (1 << 11)) {
10641             /* load */
10642             tmp = tcg_temp_new_i32();
10643             gen_aa32_ld8u(tmp, addr, get_mem_index(s));
10644             store_reg(s, rd, tmp);
10645         } else {
10646             /* store */
10647             tmp = load_reg(s, rd);
10648             gen_aa32_st8(tmp, addr, get_mem_index(s));
10649             tcg_temp_free_i32(tmp);
10650         }
10651         tcg_temp_free_i32(addr);
10652         break;
10653
10654     case 8:
10655         /* load/store halfword immediate offset */
10656         rd = insn & 7;
10657         rn = (insn >> 3) & 7;
10658         addr = load_reg(s, rn);
10659         val = (insn >> 5) & 0x3e;
10660         tcg_gen_addi_i32(addr, addr, val);
10661
10662         if (insn & (1 << 11)) {
10663             /* load */
10664             tmp = tcg_temp_new_i32();
10665             gen_aa32_ld16u(tmp, addr, get_mem_index(s));
10666             store_reg(s, rd, tmp);
10667         } else {
10668             /* store */
10669             tmp = load_reg(s, rd);
10670             gen_aa32_st16(tmp, addr, get_mem_index(s));
10671             tcg_temp_free_i32(tmp);
10672         }
10673         tcg_temp_free_i32(addr);
10674         break;
10675
10676     case 9:
10677         /* load/store from stack */
10678         rd = (insn >> 8) & 7;
10679         addr = load_reg(s, 13);
10680         val = (insn & 0xff) * 4;
10681         tcg_gen_addi_i32(addr, addr, val);
10682
10683         if (insn & (1 << 11)) {
10684             /* load */
10685             tmp = tcg_temp_new_i32();
10686             gen_aa32_ld32u(tmp, addr, get_mem_index(s));
10687             store_reg(s, rd, tmp);
10688         } else {
10689             /* store */
10690             tmp = load_reg(s, rd);
10691             gen_aa32_st32(tmp, addr, get_mem_index(s));
10692             tcg_temp_free_i32(tmp);
10693         }
10694         tcg_temp_free_i32(addr);
10695         break;
10696
10697     case 10:
10698         /* add to high reg */
10699         rd = (insn >> 8) & 7;
10700         if (insn & (1 << 11)) {
10701             /* SP */
10702             tmp = load_reg(s, 13);
10703         } else {
10704             /* PC. bit 1 is ignored.  */
10705             tmp = tcg_temp_new_i32();
10706             tcg_gen_movi_i32(tmp, (s->pc + 2) & ~(uint32_t)2);
10707         }
10708         val = (insn & 0xff) * 4;
10709         tcg_gen_addi_i32(tmp, tmp, val);
10710         store_reg(s, rd, tmp);
10711         break;
10712
10713     case 11:
10714         /* misc */
10715         op = (insn >> 8) & 0xf;
10716         switch (op) {
10717         case 0:
10718             /* adjust stack pointer */
10719             tmp = load_reg(s, 13);
10720             val = (insn & 0x7f) * 4;
10721             if (insn & (1 << 7))
10722                 val = -(int32_t)val;
10723             tcg_gen_addi_i32(tmp, tmp, val);
10724             store_reg(s, 13, tmp);
10725             break;
10726
10727         case 2: /* sign/zero extend.  */
10728             ARCH(6);
10729             rd = insn & 7;
10730             rm = (insn >> 3) & 7;
10731             tmp = load_reg(s, rm);
10732             switch ((insn >> 6) & 3) {
10733             case 0: gen_sxth(tmp); break;
10734             case 1: gen_sxtb(tmp); break;
10735             case 2: gen_uxth(tmp); break;
10736             case 3: gen_uxtb(tmp); break;
10737             }
10738             store_reg(s, rd, tmp);
10739             break;
10740         case 4: case 5: case 0xc: case 0xd:
10741             /* push/pop */
10742             addr = load_reg(s, 13);
10743             if (insn & (1 << 8))
10744                 offset = 4;
10745             else
10746                 offset = 0;
10747             for (i = 0; i < 8; i++) {
10748                 if (insn & (1 << i))
10749                     offset += 4;
10750             }
10751             if ((insn & (1 << 11)) == 0) {
10752                 tcg_gen_addi_i32(addr, addr, -offset);
10753             }
10754             for (i = 0; i < 8; i++) {
10755                 if (insn & (1 << i)) {
10756                     if (insn & (1 << 11)) {
10757                         /* pop */
10758                         tmp = tcg_temp_new_i32();
10759                         gen_aa32_ld32u(tmp, addr, get_mem_index(s));
10760                         store_reg(s, i, tmp);
10761                     } else {
10762                         /* push */
10763                         tmp = load_reg(s, i);
10764                         gen_aa32_st32(tmp, addr, get_mem_index(s));
10765                         tcg_temp_free_i32(tmp);
10766                     }
10767                     /* advance to the next address.  */
10768                     tcg_gen_addi_i32(addr, addr, 4);
10769                 }
10770             }
10771             TCGV_UNUSED_I32(tmp);
10772             if (insn & (1 << 8)) {
10773                 if (insn & (1 << 11)) {
10774                     /* pop pc */
10775                     tmp = tcg_temp_new_i32();
10776                     gen_aa32_ld32u(tmp, addr, get_mem_index(s));
10777                     /* don't set the pc until the rest of the instruction
10778                        has completed */
10779                 } else {
10780                     /* push lr */
10781                     tmp = load_reg(s, 14);
10782                     gen_aa32_st32(tmp, addr, get_mem_index(s));
10783                     tcg_temp_free_i32(tmp);
10784                 }
10785                 tcg_gen_addi_i32(addr, addr, 4);
10786             }
10787             if ((insn & (1 << 11)) == 0) {
10788                 tcg_gen_addi_i32(addr, addr, -offset);
10789             }
10790             /* write back the new stack pointer */
10791             store_reg(s, 13, addr);
10792             /* set the new PC value */
10793             if ((insn & 0x0900) == 0x0900) {
10794                 store_reg_from_load(s, 15, tmp);
10795             }
10796             break;
10797
10798         case 1: case 3: case 9: case 11: /* czb */
10799             rm = insn & 7;
10800             tmp = load_reg(s, rm);
10801             s->condlabel = gen_new_label();
10802             s->condjmp = 1;
10803             if (insn & (1 << 11))
10804                 tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, s->condlabel);
10805             else
10806                 tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, s->condlabel);
10807             tcg_temp_free_i32(tmp);
10808             offset = ((insn & 0xf8) >> 2) | (insn & 0x200) >> 3;
10809             val = (uint32_t)s->pc + 2;
10810             val += offset;
10811             gen_jmp(s, val);
10812             break;
10813
10814         case 15: /* IT, nop-hint.  */
10815             if ((insn & 0xf) == 0) {
10816                 gen_nop_hint(s, (insn >> 4) & 0xf);
10817                 break;
10818             }
10819             /* If Then.  */
10820             s->condexec_cond = (insn >> 4) & 0xe;
10821             s->condexec_mask = insn & 0x1f;
10822             /* No actual code generated for this insn, just setup state.  */
10823             break;
10824
10825         case 0xe: /* bkpt */
10826         {
10827             int imm8 = extract32(insn, 0, 8);
10828             ARCH(5);
10829             gen_exception_insn(s, 2, EXCP_BKPT, syn_aa32_bkpt(imm8, true));
10830             break;
10831         }
10832
10833         case 0xa: /* rev */
10834             ARCH(6);
10835             rn = (insn >> 3) & 0x7;
10836             rd = insn & 0x7;
10837             tmp = load_reg(s, rn);
10838             switch ((insn >> 6) & 3) {
10839             case 0: tcg_gen_bswap32_i32(tmp, tmp); break;
10840             case 1: gen_rev16(tmp); break;
10841             case 3: gen_revsh(tmp); break;
10842             default: goto illegal_op;
10843             }
10844             store_reg(s, rd, tmp);
10845             break;
10846
10847         case 6:
10848             switch ((insn >> 5) & 7) {
10849             case 2:
10850                 /* setend */
10851                 ARCH(6);
10852                 if (((insn >> 3) & 1) != s->bswap_code) {
10853                     /* Dynamic endianness switching not implemented. */
10854                     qemu_log_mask(LOG_UNIMP, "arm: unimplemented setend\n");
10855                     goto illegal_op;
10856                 }
10857                 break;
10858             case 3:
10859                 /* cps */
10860                 ARCH(6);
10861                 if (IS_USER(s)) {
10862                     break;
10863                 }
10864                 if (arm_dc_feature(s, ARM_FEATURE_M)) {
10865                     tmp = tcg_const_i32((insn & (1 << 4)) != 0);
10866                     /* FAULTMASK */
10867                     if (insn & 1) {
10868                         addr = tcg_const_i32(19);
10869                         gen_helper_v7m_msr(cpu_env, addr, tmp);
10870                         tcg_temp_free_i32(addr);
10871                     }
10872                     /* PRIMASK */
10873                     if (insn & 2) {
10874                         addr = tcg_const_i32(16);
10875                         gen_helper_v7m_msr(cpu_env, addr, tmp);
10876                         tcg_temp_free_i32(addr);
10877                     }
10878                     tcg_temp_free_i32(tmp);
10879                     gen_lookup_tb(s);
10880                 } else {
10881                     if (insn & (1 << 4)) {
10882                         shift = CPSR_A | CPSR_I | CPSR_F;
10883                     } else {
10884                         shift = 0;
10885                     }
10886                     gen_set_psr_im(s, ((insn & 7) << 6), 0, shift);
10887                 }
10888                 break;
10889             default:
10890                 goto undef;
10891             }
10892             break;
10893
10894         default:
10895             goto undef;
10896         }
10897         break;
10898
10899     case 12:
10900     {
10901         /* load/store multiple */
10902         TCGv_i32 loaded_var;
10903         TCGV_UNUSED_I32(loaded_var);
10904         rn = (insn >> 8) & 0x7;
10905         addr = load_reg(s, rn);
10906         for (i = 0; i < 8; i++) {
10907             if (insn & (1 << i)) {
10908                 if (insn & (1 << 11)) {
10909                     /* load */
10910                     tmp = tcg_temp_new_i32();
10911                     gen_aa32_ld32u(tmp, addr, get_mem_index(s));
10912                     if (i == rn) {
10913                         loaded_var = tmp;
10914                     } else {
10915                         store_reg(s, i, tmp);
10916                     }
10917                 } else {
10918                     /* store */
10919                     tmp = load_reg(s, i);
10920                     gen_aa32_st32(tmp, addr, get_mem_index(s));
10921                     tcg_temp_free_i32(tmp);
10922                 }
10923                 /* advance to the next address */
10924                 tcg_gen_addi_i32(addr, addr, 4);
10925             }
10926         }
10927         if ((insn & (1 << rn)) == 0) {
10928             /* base reg not in list: base register writeback */
10929             store_reg(s, rn, addr);
10930         } else {
10931             /* base reg in list: if load, complete it now */
10932             if (insn & (1 << 11)) {
10933                 store_reg(s, rn, loaded_var);
10934             }
10935             tcg_temp_free_i32(addr);
10936         }
10937         break;
10938     }
10939     case 13:
10940         /* conditional branch or swi */
10941         cond = (insn >> 8) & 0xf;
10942         if (cond == 0xe)
10943             goto undef;
10944
10945         if (cond == 0xf) {
10946             /* swi */
10947             gen_set_pc_im(s, s->pc);
10948             s->svc_imm = extract32(insn, 0, 8);
10949             s->is_jmp = DISAS_SWI;
10950             break;
10951         }
10952         /* generate a conditional jump to next instruction */
10953         s->condlabel = gen_new_label();
10954         arm_gen_test_cc(cond ^ 1, s->condlabel);
10955         s->condjmp = 1;
10956
10957         /* jump to the offset */
10958         val = (uint32_t)s->pc + 2;
10959         offset = ((int32_t)insn << 24) >> 24;
10960         val += offset << 1;
10961         gen_jmp(s, val);
10962         break;
10963
10964     case 14:
10965         if (insn & (1 << 11)) {
10966             if (disas_thumb2_insn(env, s, insn))
10967               goto undef32;
10968             break;
10969         }
10970         /* unconditional branch */
10971         val = (uint32_t)s->pc;
10972         offset = ((int32_t)insn << 21) >> 21;
10973         val += (offset << 1) + 2;
10974         gen_jmp(s, val);
10975         break;
10976
10977     case 15:
10978         if (disas_thumb2_insn(env, s, insn))
10979             goto undef32;
10980         break;
10981     }
10982     return;
10983 undef32:
10984     gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized());
10985     return;
10986 illegal_op:
10987 undef:
10988     gen_exception_insn(s, 2, EXCP_UDEF, syn_uncategorized());
10989 }
10990
10991 /* generate intermediate code in gen_opc_buf and gen_opparam_buf for
10992    basic block 'tb'. If search_pc is TRUE, also generate PC
10993    information for each intermediate instruction. */
10994 static inline void gen_intermediate_code_internal(ARMCPU *cpu,
10995                                                   TranslationBlock *tb,
10996                                                   bool search_pc)
10997 {
10998     CPUState *cs = CPU(cpu);
10999     CPUARMState *env = &cpu->env;
11000     DisasContext dc1, *dc = &dc1;
11001     CPUBreakpoint *bp;
11002     uint16_t *gen_opc_end;
11003     int j, lj;
11004     target_ulong pc_start;
11005     target_ulong next_page_start;
11006     int num_insns;
11007     int max_insns;
11008
11009     /* generate intermediate code */
11010
11011     /* The A64 decoder has its own top level loop, because it doesn't need
11012      * the A32/T32 complexity to do with conditional execution/IT blocks/etc.
11013      */
11014     if (ARM_TBFLAG_AARCH64_STATE(tb->flags)) {
11015         gen_intermediate_code_internal_a64(cpu, tb, search_pc);
11016         return;
11017     }
11018
11019     pc_start = tb->pc;
11020
11021     dc->tb = tb;
11022
11023     gen_opc_end = tcg_ctx.gen_opc_buf + OPC_MAX_SIZE;
11024
11025     dc->is_jmp = DISAS_NEXT;
11026     dc->pc = pc_start;
11027     dc->singlestep_enabled = cs->singlestep_enabled;
11028     dc->condjmp = 0;
11029
11030     dc->aarch64 = 0;
11031     dc->thumb = ARM_TBFLAG_THUMB(tb->flags);
11032     dc->bswap_code = ARM_TBFLAG_BSWAP_CODE(tb->flags);
11033     dc->condexec_mask = (ARM_TBFLAG_CONDEXEC(tb->flags) & 0xf) << 1;
11034     dc->condexec_cond = ARM_TBFLAG_CONDEXEC(tb->flags) >> 4;
11035 #if !defined(CONFIG_USER_ONLY)
11036     dc->user = (ARM_TBFLAG_PRIV(tb->flags) == 0);
11037 #endif
11038     dc->ns = ARM_TBFLAG_NS(tb->flags);
11039     dc->cpacr_fpen = ARM_TBFLAG_CPACR_FPEN(tb->flags);
11040     dc->vfp_enabled = ARM_TBFLAG_VFPEN(tb->flags);
11041     dc->vec_len = ARM_TBFLAG_VECLEN(tb->flags);
11042     dc->vec_stride = ARM_TBFLAG_VECSTRIDE(tb->flags);
11043     dc->c15_cpar = ARM_TBFLAG_XSCALE_CPAR(tb->flags);
11044     dc->cp_regs = cpu->cp_regs;
11045     dc->current_el = arm_current_el(env);
11046     dc->features = env->features;
11047
11048     /* Single step state. The code-generation logic here is:
11049      *  SS_ACTIVE == 0:
11050      *   generate code with no special handling for single-stepping (except
11051      *   that anything that can make us go to SS_ACTIVE == 1 must end the TB;
11052      *   this happens anyway because those changes are all system register or
11053      *   PSTATE writes).
11054      *  SS_ACTIVE == 1, PSTATE.SS == 1: (active-not-pending)
11055      *   emit code for one insn
11056      *   emit code to clear PSTATE.SS
11057      *   emit code to generate software step exception for completed step
11058      *   end TB (as usual for having generated an exception)
11059      *  SS_ACTIVE == 1, PSTATE.SS == 0: (active-pending)
11060      *   emit code to generate a software step exception
11061      *   end the TB
11062      */
11063     dc->ss_active = ARM_TBFLAG_SS_ACTIVE(tb->flags);
11064     dc->pstate_ss = ARM_TBFLAG_PSTATE_SS(tb->flags);
11065     dc->is_ldex = false;
11066     dc->ss_same_el = false; /* Can't be true since EL_d must be AArch64 */
11067
11068     cpu_F0s = tcg_temp_new_i32();
11069     cpu_F1s = tcg_temp_new_i32();
11070     cpu_F0d = tcg_temp_new_i64();
11071     cpu_F1d = tcg_temp_new_i64();
11072     cpu_V0 = cpu_F0d;
11073     cpu_V1 = cpu_F1d;
11074     /* FIXME: cpu_M0 can probably be the same as cpu_V0.  */
11075     cpu_M0 = tcg_temp_new_i64();
11076     next_page_start = (pc_start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
11077     lj = -1;
11078     num_insns = 0;
11079     max_insns = tb->cflags & CF_COUNT_MASK;
11080     if (max_insns == 0)
11081         max_insns = CF_COUNT_MASK;
11082
11083     gen_tb_start(tb);
11084
11085     tcg_clear_temp_count();
11086
11087     /* A note on handling of the condexec (IT) bits:
11088      *
11089      * We want to avoid the overhead of having to write the updated condexec
11090      * bits back to the CPUARMState for every instruction in an IT block. So:
11091      * (1) if the condexec bits are not already zero then we write
11092      * zero back into the CPUARMState now. This avoids complications trying
11093      * to do it at the end of the block. (For example if we don't do this
11094      * it's hard to identify whether we can safely skip writing condexec
11095      * at the end of the TB, which we definitely want to do for the case
11096      * where a TB doesn't do anything with the IT state at all.)
11097      * (2) if we are going to leave the TB then we call gen_set_condexec()
11098      * which will write the correct value into CPUARMState if zero is wrong.
11099      * This is done both for leaving the TB at the end, and for leaving
11100      * it because of an exception we know will happen, which is done in
11101      * gen_exception_insn(). The latter is necessary because we need to
11102      * leave the TB with the PC/IT state just prior to execution of the
11103      * instruction which caused the exception.
11104      * (3) if we leave the TB unexpectedly (eg a data abort on a load)
11105      * then the CPUARMState will be wrong and we need to reset it.
11106      * This is handled in the same way as restoration of the
11107      * PC in these situations: we will be called again with search_pc=1
11108      * and generate a mapping of the condexec bits for each PC in
11109      * gen_opc_condexec_bits[]. restore_state_to_opc() then uses
11110      * this to restore the condexec bits.
11111      *
11112      * Note that there are no instructions which can read the condexec
11113      * bits, and none which can write non-static values to them, so
11114      * we don't need to care about whether CPUARMState is correct in the
11115      * middle of a TB.
11116      */
11117
11118     /* Reset the conditional execution bits immediately. This avoids
11119        complications trying to do it at the end of the block.  */
11120     if (dc->condexec_mask || dc->condexec_cond)
11121       {
11122         TCGv_i32 tmp = tcg_temp_new_i32();
11123         tcg_gen_movi_i32(tmp, 0);
11124         store_cpu_field(tmp, condexec_bits);
11125       }
11126     do {
11127 #ifdef CONFIG_USER_ONLY
11128         /* Intercept jump to the magic kernel page.  */
11129         if (dc->pc >= 0xffff0000) {
11130             /* We always get here via a jump, so know we are not in a
11131                conditional execution block.  */
11132             gen_exception_internal(EXCP_KERNEL_TRAP);
11133             dc->is_jmp = DISAS_UPDATE;
11134             break;
11135         }
11136 #else
11137         if (dc->pc >= 0xfffffff0 && arm_dc_feature(dc, ARM_FEATURE_M)) {
11138             /* We always get here via a jump, so know we are not in a
11139                conditional execution block.  */
11140             gen_exception_internal(EXCP_EXCEPTION_EXIT);
11141             dc->is_jmp = DISAS_UPDATE;
11142             break;
11143         }
11144 #endif
11145
11146         if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
11147             QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
11148                 if (bp->pc == dc->pc) {
11149                     gen_exception_internal_insn(dc, 0, EXCP_DEBUG);
11150                     /* Advance PC so that clearing the breakpoint will
11151                        invalidate this TB.  */
11152                     dc->pc += 2;
11153                     goto done_generating;
11154                 }
11155             }
11156         }
11157         if (search_pc) {
11158             j = tcg_ctx.gen_opc_ptr - tcg_ctx.gen_opc_buf;
11159             if (lj < j) {
11160                 lj++;
11161                 while (lj < j)
11162                     tcg_ctx.gen_opc_instr_start[lj++] = 0;
11163             }
11164             tcg_ctx.gen_opc_pc[lj] = dc->pc;
11165             gen_opc_condexec_bits[lj] = (dc->condexec_cond << 4) | (dc->condexec_mask >> 1);
11166             tcg_ctx.gen_opc_instr_start[lj] = 1;
11167             tcg_ctx.gen_opc_icount[lj] = num_insns;
11168         }
11169
11170         if (num_insns + 1 == max_insns && (tb->cflags & CF_LAST_IO))
11171             gen_io_start();
11172
11173         if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP | CPU_LOG_TB_OP_OPT))) {
11174             tcg_gen_debug_insn_start(dc->pc);
11175         }
11176
11177         if (dc->ss_active && !dc->pstate_ss) {
11178             /* Singlestep state is Active-pending.
11179              * If we're in this state at the start of a TB then either
11180              *  a) we just took an exception to an EL which is being debugged
11181              *     and this is the first insn in the exception handler
11182              *  b) debug exceptions were masked and we just unmasked them
11183              *     without changing EL (eg by clearing PSTATE.D)
11184              * In either case we're going to take a swstep exception in the
11185              * "did not step an insn" case, and so the syndrome ISV and EX
11186              * bits should be zero.
11187              */
11188             assert(num_insns == 0);
11189             gen_exception(EXCP_UDEF, syn_swstep(dc->ss_same_el, 0, 0));
11190             goto done_generating;
11191         }
11192
11193         if (dc->thumb) {
11194             disas_thumb_insn(env, dc);
11195             if (dc->condexec_mask) {
11196                 dc->condexec_cond = (dc->condexec_cond & 0xe)
11197                                    | ((dc->condexec_mask >> 4) & 1);
11198                 dc->condexec_mask = (dc->condexec_mask << 1) & 0x1f;
11199                 if (dc->condexec_mask == 0) {
11200                     dc->condexec_cond = 0;
11201                 }
11202             }
11203         } else {
11204             unsigned int insn = arm_ldl_code(env, dc->pc, dc->bswap_code);
11205             dc->pc += 4;
11206             disas_arm_insn(dc, insn);
11207         }
11208
11209         if (dc->condjmp && !dc->is_jmp) {
11210             gen_set_label(dc->condlabel);
11211             dc->condjmp = 0;
11212         }
11213
11214         if (tcg_check_temp_count()) {
11215             fprintf(stderr, "TCG temporary leak before "TARGET_FMT_lx"\n",
11216                     dc->pc);
11217         }
11218
11219         /* Translation stops when a conditional branch is encountered.
11220          * Otherwise the subsequent code could get translated several times.
11221          * Also stop translation when a page boundary is reached.  This
11222          * ensures prefetch aborts occur at the right place.  */
11223         num_insns ++;
11224     } while (!dc->is_jmp && tcg_ctx.gen_opc_ptr < gen_opc_end &&
11225              !cs->singlestep_enabled &&
11226              !singlestep &&
11227              !dc->ss_active &&
11228              dc->pc < next_page_start &&
11229              num_insns < max_insns);
11230
11231     if (tb->cflags & CF_LAST_IO) {
11232         if (dc->condjmp) {
11233             /* FIXME:  This can theoretically happen with self-modifying
11234                code.  */
11235             cpu_abort(cs, "IO on conditional branch instruction");
11236         }
11237         gen_io_end();
11238     }
11239
11240     /* At this stage dc->condjmp will only be set when the skipped
11241        instruction was a conditional branch or trap, and the PC has
11242        already been written.  */
11243     if (unlikely(cs->singlestep_enabled || dc->ss_active)) {
11244         /* Make sure the pc is updated, and raise a debug exception.  */
11245         if (dc->condjmp) {
11246             gen_set_condexec(dc);
11247             if (dc->is_jmp == DISAS_SWI) {
11248                 gen_ss_advance(dc);
11249                 gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
11250             } else if (dc->is_jmp == DISAS_HVC) {
11251                 gen_ss_advance(dc);
11252                 gen_exception(EXCP_HVC, syn_aa32_hvc(dc->svc_imm));
11253             } else if (dc->is_jmp == DISAS_SMC) {
11254                 gen_ss_advance(dc);
11255                 gen_exception(EXCP_SMC, syn_aa32_smc());
11256             } else if (dc->ss_active) {
11257                 gen_step_complete_exception(dc);
11258             } else {
11259                 gen_exception_internal(EXCP_DEBUG);
11260             }
11261             gen_set_label(dc->condlabel);
11262         }
11263         if (dc->condjmp || !dc->is_jmp) {
11264             gen_set_pc_im(dc, dc->pc);
11265             dc->condjmp = 0;
11266         }
11267         gen_set_condexec(dc);
11268         if (dc->is_jmp == DISAS_SWI && !dc->condjmp) {
11269             gen_ss_advance(dc);
11270             gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
11271         } else if (dc->is_jmp == DISAS_HVC && !dc->condjmp) {
11272             gen_ss_advance(dc);
11273             gen_exception(EXCP_HVC, syn_aa32_hvc(dc->svc_imm));
11274         } else if (dc->is_jmp == DISAS_SMC && !dc->condjmp) {
11275             gen_ss_advance(dc);
11276             gen_exception(EXCP_SMC, syn_aa32_smc());
11277         } else if (dc->ss_active) {
11278             gen_step_complete_exception(dc);
11279         } else {
11280             /* FIXME: Single stepping a WFI insn will not halt
11281                the CPU.  */
11282             gen_exception_internal(EXCP_DEBUG);
11283         }
11284     } else {
11285         /* While branches must always occur at the end of an IT block,
11286            there are a few other things that can cause us to terminate
11287            the TB in the middle of an IT block:
11288             - Exception generating instructions (bkpt, swi, undefined).
11289             - Page boundaries.
11290             - Hardware watchpoints.
11291            Hardware breakpoints have already been handled and skip this code.
11292          */
11293         gen_set_condexec(dc);
11294         switch(dc->is_jmp) {
11295         case DISAS_NEXT:
11296             gen_goto_tb(dc, 1, dc->pc);
11297             break;
11298         default:
11299         case DISAS_JUMP:
11300         case DISAS_UPDATE:
11301             /* indicate that the hash table must be used to find the next TB */
11302             tcg_gen_exit_tb(0);
11303             break;
11304         case DISAS_TB_JUMP:
11305             /* nothing more to generate */
11306             break;
11307         case DISAS_WFI:
11308             gen_helper_wfi(cpu_env);
11309             break;
11310         case DISAS_WFE:
11311             gen_helper_wfe(cpu_env);
11312             break;
11313         case DISAS_SWI:
11314             gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));
11315             break;
11316         case DISAS_HVC:
11317             gen_exception(EXCP_HVC, syn_aa32_hvc(dc->svc_imm));
11318             break;
11319         case DISAS_SMC:
11320             gen_exception(EXCP_SMC, syn_aa32_smc());
11321             break;
11322         }
11323         if (dc->condjmp) {
11324             gen_set_label(dc->condlabel);
11325             gen_set_condexec(dc);
11326             gen_goto_tb(dc, 1, dc->pc);
11327             dc->condjmp = 0;
11328         }
11329     }
11330
11331 done_generating:
11332     gen_tb_end(tb, num_insns);
11333     *tcg_ctx.gen_opc_ptr = INDEX_op_end;
11334
11335 #ifdef DEBUG_DISAS
11336     if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)) {
11337         qemu_log("----------------\n");
11338         qemu_log("IN: %s\n", lookup_symbol(pc_start));
11339         log_target_disas(env, pc_start, dc->pc - pc_start,
11340                          dc->thumb | (dc->bswap_code << 1));
11341         qemu_log("\n");
11342     }
11343 #endif
11344     if (search_pc) {
11345         j = tcg_ctx.gen_opc_ptr - tcg_ctx.gen_opc_buf;
11346         lj++;
11347         while (lj <= j)
11348             tcg_ctx.gen_opc_instr_start[lj++] = 0;
11349     } else {
11350         tb->size = dc->pc - pc_start;
11351         tb->icount = num_insns;
11352     }
11353 }
11354
11355 void gen_intermediate_code(CPUARMState *env, TranslationBlock *tb)
11356 {
11357     gen_intermediate_code_internal(arm_env_get_cpu(env), tb, false);
11358 }
11359
11360 void gen_intermediate_code_pc(CPUARMState *env, TranslationBlock *tb)
11361 {
11362     gen_intermediate_code_internal(arm_env_get_cpu(env), tb, true);
11363 }
11364
11365 static const char *cpu_mode_names[16] = {
11366   "usr", "fiq", "irq", "svc", "???", "???", "mon", "abt",
11367   "???", "???", "hyp", "und", "???", "???", "???", "sys"
11368 };
11369
11370 void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
11371                         int flags)
11372 {
11373     ARMCPU *cpu = ARM_CPU(cs);
11374     CPUARMState *env = &cpu->env;
11375     int i;
11376     uint32_t psr;
11377
11378     if (is_a64(env)) {
11379         aarch64_cpu_dump_state(cs, f, cpu_fprintf, flags);
11380         return;
11381     }
11382
11383     for(i=0;i<16;i++) {
11384         cpu_fprintf(f, "R%02d=%08x", i, env->regs[i]);
11385         if ((i % 4) == 3)
11386             cpu_fprintf(f, "\n");
11387         else
11388             cpu_fprintf(f, " ");
11389     }
11390     psr = cpsr_read(env);
11391     cpu_fprintf(f, "PSR=%08x %c%c%c%c %c %s%d\n",
11392                 psr,
11393                 psr & (1 << 31) ? 'N' : '-',
11394                 psr & (1 << 30) ? 'Z' : '-',
11395                 psr & (1 << 29) ? 'C' : '-',
11396                 psr & (1 << 28) ? 'V' : '-',
11397                 psr & CPSR_T ? 'T' : 'A',
11398                 cpu_mode_names[psr & 0xf], (psr & 0x10) ? 32 : 26);
11399
11400     if (flags & CPU_DUMP_FPU) {
11401         int numvfpregs = 0;
11402         if (arm_feature(env, ARM_FEATURE_VFP)) {
11403             numvfpregs += 16;
11404         }
11405         if (arm_feature(env, ARM_FEATURE_VFP3)) {
11406             numvfpregs += 16;
11407         }
11408         for (i = 0; i < numvfpregs; i++) {
11409             uint64_t v = float64_val(env->vfp.regs[i]);
11410             cpu_fprintf(f, "s%02d=%08x s%02d=%08x d%02d=%016" PRIx64 "\n",
11411                         i * 2, (uint32_t)v,
11412                         i * 2 + 1, (uint32_t)(v >> 32),
11413                         i, v);
11414         }
11415         cpu_fprintf(f, "FPSCR: %08x\n", (int)env->vfp.xregs[ARM_VFP_FPSCR]);
11416     }
11417 }
11418
11419 void restore_state_to_opc(CPUARMState *env, TranslationBlock *tb, int pc_pos)
11420 {
11421     if (is_a64(env)) {
11422         env->pc = tcg_ctx.gen_opc_pc[pc_pos];
11423         env->condexec_bits = 0;
11424     } else {
11425         env->regs[15] = tcg_ctx.gen_opc_pc[pc_pos];
11426         env->condexec_bits = gen_opc_condexec_bits[pc_pos];
11427     }
11428 }