target-arm/translate.c

   1 /*
   2  *  ARM translation
   3  *
   4  *  Copyright (c) 2003 Fabrice Bellard
   5  *  Copyright (c) 2005-2007 CodeSourcery
   6  *  Copyright (c) 2007 OpenedHand, Ltd.
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21 #include <stdarg.h>
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <string.h>
  25 #include <inttypes.h>
  26
  27 #include "cpu.h"
  28 #include "disas/disas.h"
  29 #include "tcg-op.h"
  30 #include "qemu/log.h"
  31 #include "qemu/bitops.h"
  32
  33 #include "helper.h"
  34 #define GEN_HELPER 1
  35 #include "helper.h"
  36
  37 #define ENABLE_ARCH_4T    arm_feature(env, ARM_FEATURE_V4T)
  38 #define ENABLE_ARCH_5     arm_feature(env, ARM_FEATURE_V5)
  39 /* currently all emulated v5 cores are also v5TE, so don't bother */
  40 #define ENABLE_ARCH_5TE   arm_feature(env, ARM_FEATURE_V5)
  41 #define ENABLE_ARCH_5J    0
  42 #define ENABLE_ARCH_6     arm_feature(env, ARM_FEATURE_V6)
  43 #define ENABLE_ARCH_6K   arm_feature(env, ARM_FEATURE_V6K)
  44 #define ENABLE_ARCH_6T2   arm_feature(env, ARM_FEATURE_THUMB2)
  45 #define ENABLE_ARCH_7     arm_feature(env, ARM_FEATURE_V7)
  46 #define ENABLE_ARCH_8     arm_feature(env, ARM_FEATURE_V8)
  47
  48 #define ARCH(x) do { if (!ENABLE_ARCH_##x) goto illegal_op; } while(0)
  49
  50 #include "translate.h"
  51 static uint32_t gen_opc_condexec_bits[OPC_BUF_SIZE];
  52
  53 #if defined(CONFIG_USER_ONLY)
  54 #define IS_USER(s) 1
  55 #else
  56 #define IS_USER(s) (s->user)
  57 #endif
  58
  59 TCGv_ptr cpu_env;
  60 /* We reuse the same 64-bit temporaries for efficiency.  */
  61 static TCGv_i64 cpu_V0, cpu_V1, cpu_M0;
  62 static TCGv_i32 cpu_R[16];
  63 static TCGv_i32 cpu_CF, cpu_NF, cpu_VF, cpu_ZF;
  64 static TCGv_i64 cpu_exclusive_addr;
  65 static TCGv_i64 cpu_exclusive_val;
  66 #ifdef CONFIG_USER_ONLY
  67 static TCGv_i64 cpu_exclusive_test;
  68 static TCGv_i32 cpu_exclusive_info;
  69 #endif
  70
  71 /* FIXME:  These should be removed.  */
  72 static TCGv_i32 cpu_F0s, cpu_F1s;
  73 static TCGv_i64 cpu_F0d, cpu_F1d;
  74
  75 #include "exec/gen-icount.h"
  76
  77 static const char *regnames[] =
  78     { "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
  79       "r8", "r9", "r10", "r11", "r12", "r13", "r14", "pc" };
  80
  81 /* initialize TCG globals.  */
  82 void arm_translate_init(void)
  83 {
  84     int i;
  85
  86     cpu_env = tcg_global_reg_new_ptr(TCG_AREG0, "env");
  87
  88     for (i = 0; i < 16; i++) {
  89         cpu_R[i] = tcg_global_mem_new_i32(TCG_AREG0,
  90                                           offsetof(CPUARMState, regs[i]),
  91                                           regnames[i]);
  92     }
  93     cpu_CF = tcg_global_mem_new_i32(TCG_AREG0, offsetof(CPUARMState, CF), "CF");
  94     cpu_NF = tcg_global_mem_new_i32(TCG_AREG0, offsetof(CPUARMState, NF), "NF");
  95     cpu_VF = tcg_global_mem_new_i32(TCG_AREG0, offsetof(CPUARMState, VF), "VF");
  96     cpu_ZF = tcg_global_mem_new_i32(TCG_AREG0, offsetof(CPUARMState, ZF), "ZF");
  97
  98     cpu_exclusive_addr = tcg_global_mem_new_i64(TCG_AREG0,
  99         offsetof(CPUARMState, exclusive_addr), "exclusive_addr");
 100     cpu_exclusive_val = tcg_global_mem_new_i64(TCG_AREG0,
 101         offsetof(CPUARMState, exclusive_val), "exclusive_val");
 102 #ifdef CONFIG_USER_ONLY
 103     cpu_exclusive_test = tcg_global_mem_new_i64(TCG_AREG0,
 104         offsetof(CPUARMState, exclusive_test), "exclusive_test");
 105     cpu_exclusive_info = tcg_global_mem_new_i32(TCG_AREG0,
 106         offsetof(CPUARMState, exclusive_info), "exclusive_info");
 107 #endif
 108
 109     a64_translate_init();
 110 }
 111
 112 static inline TCGv_i32 load_cpu_offset(int offset)
 113 {
 114     TCGv_i32 tmp = tcg_temp_new_i32();
 115     tcg_gen_ld_i32(tmp, cpu_env, offset);
 116     return tmp;
 117 }
 118
 119 #define load_cpu_field(name) load_cpu_offset(offsetof(CPUARMState, name))
 120
 121 static inline void store_cpu_offset(TCGv_i32 var, int offset)
 122 {
 123     tcg_gen_st_i32(var, cpu_env, offset);
 124     tcg_temp_free_i32(var);
 125 }
 126
 127 #define store_cpu_field(var, name) \
 128     store_cpu_offset(var, offsetof(CPUARMState, name))
 129
 130 /* Set a variable to the value of a CPU register.  */
 131 static void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
 132 {
 133     if (reg == 15) {
 134         uint32_t addr;
 135         /* normally, since we updated PC, we need only to add one insn */
 136         if (s->thumb)
 137             addr = (long)s->pc + 2;
 138         else
 139             addr = (long)s->pc + 4;
 140         tcg_gen_movi_i32(var, addr);
 141     } else {
 142         tcg_gen_mov_i32(var, cpu_R[reg]);
 143     }
 144 }
 145
 146 /* Create a new temporary and set it to the value of a CPU register.  */
 147 static inline TCGv_i32 load_reg(DisasContext *s, int reg)
 148 {
 149     TCGv_i32 tmp = tcg_temp_new_i32();
 150     load_reg_var(s, tmp, reg);
 151     return tmp;
 152 }
 153
 154 /* Set a CPU register.  The source must be a temporary and will be
 155    marked as dead.  */
 156 static void store_reg(DisasContext *s, int reg, TCGv_i32 var)
 157 {
 158     if (reg == 15) {
 159         tcg_gen_andi_i32(var, var, ~1);
 160         s->is_jmp = DISAS_JUMP;
 161     }
 162     tcg_gen_mov_i32(cpu_R[reg], var);
 163     tcg_temp_free_i32(var);
 164 }
 165
 166 /* Value extensions.  */
 167 #define gen_uxtb(var) tcg_gen_ext8u_i32(var, var)
 168 #define gen_uxth(var) tcg_gen_ext16u_i32(var, var)
 169 #define gen_sxtb(var) tcg_gen_ext8s_i32(var, var)
 170 #define gen_sxth(var) tcg_gen_ext16s_i32(var, var)
 171
 172 #define gen_sxtb16(var) gen_helper_sxtb16(var, var)
 173 #define gen_uxtb16(var) gen_helper_uxtb16(var, var)
 174
 175
 176 static inline void gen_set_cpsr(TCGv_i32 var, uint32_t mask)
 177 {
 178     TCGv_i32 tmp_mask = tcg_const_i32(mask);
 179     gen_helper_cpsr_write(cpu_env, var, tmp_mask);
 180     tcg_temp_free_i32(tmp_mask);
 181 }
 182 /* Set NZCV flags from the high 4 bits of var.  */
 183 #define gen_set_nzcv(var) gen_set_cpsr(var, CPSR_NZCV)
 184
 185 static void gen_exception(int excp)
 186 {
 187     TCGv_i32 tmp = tcg_temp_new_i32();
 188     tcg_gen_movi_i32(tmp, excp);
 189     gen_helper_exception(cpu_env, tmp);
 190     tcg_temp_free_i32(tmp);
 191 }
 192
 193 static void gen_smul_dual(TCGv_i32 a, TCGv_i32 b)
 194 {
 195     TCGv_i32 tmp1 = tcg_temp_new_i32();
 196     TCGv_i32 tmp2 = tcg_temp_new_i32();
 197     tcg_gen_ext16s_i32(tmp1, a);
 198     tcg_gen_ext16s_i32(tmp2, b);
 199     tcg_gen_mul_i32(tmp1, tmp1, tmp2);
 200     tcg_temp_free_i32(tmp2);
 201     tcg_gen_sari_i32(a, a, 16);
 202     tcg_gen_sari_i32(b, b, 16);
 203     tcg_gen_mul_i32(b, b, a);
 204     tcg_gen_mov_i32(a, tmp1);
 205     tcg_temp_free_i32(tmp1);
 206 }
 207
 208 /* Byteswap each halfword.  */
 209 static void gen_rev16(TCGv_i32 var)
 210 {
 211     TCGv_i32 tmp = tcg_temp_new_i32();
 212     tcg_gen_shri_i32(tmp, var, 8);
 213     tcg_gen_andi_i32(tmp, tmp, 0x00ff00ff);
 214     tcg_gen_shli_i32(var, var, 8);
 215     tcg_gen_andi_i32(var, var, 0xff00ff00);
 216     tcg_gen_or_i32(var, var, tmp);
 217     tcg_temp_free_i32(tmp);
 218 }
 219
 220 /* Byteswap low halfword and sign extend.  */
 221 static void gen_revsh(TCGv_i32 var)
 222 {
 223     tcg_gen_ext16u_i32(var, var);
 224     tcg_gen_bswap16_i32(var, var);
 225     tcg_gen_ext16s_i32(var, var);
 226 }
 227
 228 /* Unsigned bitfield extract.  */
 229 static void gen_ubfx(TCGv_i32 var, int shift, uint32_t mask)
 230 {
 231     if (shift)
 232         tcg_gen_shri_i32(var, var, shift);
 233     tcg_gen_andi_i32(var, var, mask);
 234 }
 235
 236 /* Signed bitfield extract.  */
 237 static void gen_sbfx(TCGv_i32 var, int shift, int width)
 238 {
 239     uint32_t signbit;
 240
 241     if (shift)
 242         tcg_gen_sari_i32(var, var, shift);
 243     if (shift + width < 32) {
 244         signbit = 1u << (width - 1);
 245         tcg_gen_andi_i32(var, var, (1u << width) - 1);
 246         tcg_gen_xori_i32(var, var, signbit);
 247         tcg_gen_subi_i32(var, var, signbit);
 248     }
 249 }
 250
 251 /* Return (b << 32) + a. Mark inputs as dead */
 252 static TCGv_i64 gen_addq_msw(TCGv_i64 a, TCGv_i32 b)
 253 {
 254     TCGv_i64 tmp64 = tcg_temp_new_i64();
 255
 256     tcg_gen_extu_i32_i64(tmp64, b);
 257     tcg_temp_free_i32(b);
 258     tcg_gen_shli_i64(tmp64, tmp64, 32);
 259     tcg_gen_add_i64(a, tmp64, a);
 260
 261     tcg_temp_free_i64(tmp64);
 262     return a;
 263 }
 264
 265 /* Return (b << 32) - a. Mark inputs as dead. */
 266 static TCGv_i64 gen_subq_msw(TCGv_i64 a, TCGv_i32 b)
 267 {
 268     TCGv_i64 tmp64 = tcg_temp_new_i64();
 269
 270     tcg_gen_extu_i32_i64(tmp64, b);
 271     tcg_temp_free_i32(b);
 272     tcg_gen_shli_i64(tmp64, tmp64, 32);
 273     tcg_gen_sub_i64(a, tmp64, a);
 274
 275     tcg_temp_free_i64(tmp64);
 276     return a;
 277 }
 278
 279 /* 32x32->64 multiply.  Marks inputs as dead.  */
 280 static TCGv_i64 gen_mulu_i64_i32(TCGv_i32 a, TCGv_i32 b)
 281 {
 282     TCGv_i32 lo = tcg_temp_new_i32();
 283     TCGv_i32 hi = tcg_temp_new_i32();
 284     TCGv_i64 ret;
 285
 286     tcg_gen_mulu2_i32(lo, hi, a, b);
 287     tcg_temp_free_i32(a);
 288     tcg_temp_free_i32(b);
 289
 290     ret = tcg_temp_new_i64();
 291     tcg_gen_concat_i32_i64(ret, lo, hi);
 292     tcg_temp_free_i32(lo);
 293     tcg_temp_free_i32(hi);
 294
 295     return ret;
 296 }
 297
 298 static TCGv_i64 gen_muls_i64_i32(TCGv_i32 a, TCGv_i32 b)
 299 {
 300     TCGv_i32 lo = tcg_temp_new_i32();
 301     TCGv_i32 hi = tcg_temp_new_i32();
 302     TCGv_i64 ret;
 303
 304     tcg_gen_muls2_i32(lo, hi, a, b);
 305     tcg_temp_free_i32(a);
 306     tcg_temp_free_i32(b);
 307
 308     ret = tcg_temp_new_i64();
 309     tcg_gen_concat_i32_i64(ret, lo, hi);
 310     tcg_temp_free_i32(lo);
 311     tcg_temp_free_i32(hi);
 312
 313     return ret;
 314 }
 315
 316 /* Swap low and high halfwords.  */
 317 static void gen_swap_half(TCGv_i32 var)
 318 {
 319     TCGv_i32 tmp = tcg_temp_new_i32();
 320     tcg_gen_shri_i32(tmp, var, 16);
 321     tcg_gen_shli_i32(var, var, 16);
 322     tcg_gen_or_i32(var, var, tmp);
 323     tcg_temp_free_i32(tmp);
 324 }
 325
 326 /* Dual 16-bit add.  Result placed in t0 and t1 is marked as dead.
 327     tmp = (t0 ^ t1) & 0x8000;
 328     t0 &= ~0x8000;
 329     t1 &= ~0x8000;
 330     t0 = (t0 + t1) ^ tmp;
 331  */
 332
 333 static void gen_add16(TCGv_i32 t0, TCGv_i32 t1)
 334 {
 335     TCGv_i32 tmp = tcg_temp_new_i32();
 336     tcg_gen_xor_i32(tmp, t0, t1);
 337     tcg_gen_andi_i32(tmp, tmp, 0x8000);
 338     tcg_gen_andi_i32(t0, t0, ~0x8000);
 339     tcg_gen_andi_i32(t1, t1, ~0x8000);
 340     tcg_gen_add_i32(t0, t0, t1);
 341     tcg_gen_xor_i32(t0, t0, tmp);
 342     tcg_temp_free_i32(tmp);
 343     tcg_temp_free_i32(t1);
 344 }
 345
 346 /* Set CF to the top bit of var.  */
 347 static void gen_set_CF_bit31(TCGv_i32 var)
 348 {
 349     tcg_gen_shri_i32(cpu_CF, var, 31);
 350 }
 351
 352 /* Set N and Z flags from var.  */
 353 static inline void gen_logic_CC(TCGv_i32 var)
 354 {
 355     tcg_gen_mov_i32(cpu_NF, var);
 356     tcg_gen_mov_i32(cpu_ZF, var);
 357 }
 358
 359 /* T0 += T1 + CF.  */
 360 static void gen_adc(TCGv_i32 t0, TCGv_i32 t1)
 361 {
 362     tcg_gen_add_i32(t0, t0, t1);
 363     tcg_gen_add_i32(t0, t0, cpu_CF);
 364 }
 365
 366 /* dest = T0 + T1 + CF. */
 367 static void gen_add_carry(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 368 {
 369     tcg_gen_add_i32(dest, t0, t1);
 370     tcg_gen_add_i32(dest, dest, cpu_CF);
 371 }
 372
 373 /* dest = T0 - T1 + CF - 1.  */
 374 static void gen_sub_carry(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 375 {
 376     tcg_gen_sub_i32(dest, t0, t1);
 377     tcg_gen_add_i32(dest, dest, cpu_CF);
 378     tcg_gen_subi_i32(dest, dest, 1);
 379 }
 380
 381 /* dest = T0 + T1. Compute C, N, V and Z flags */
 382 static void gen_add_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 383 {
 384     TCGv_i32 tmp = tcg_temp_new_i32();
 385     tcg_gen_movi_i32(tmp, 0);
 386     tcg_gen_add2_i32(cpu_NF, cpu_CF, t0, tmp, t1, tmp);
 387     tcg_gen_mov_i32(cpu_ZF, cpu_NF);
 388     tcg_gen_xor_i32(cpu_VF, cpu_NF, t0);
 389     tcg_gen_xor_i32(tmp, t0, t1);
 390     tcg_gen_andc_i32(cpu_VF, cpu_VF, tmp);
 391     tcg_temp_free_i32(tmp);
 392     tcg_gen_mov_i32(dest, cpu_NF);
 393 }
 394
 395 /* dest = T0 + T1 + CF.  Compute C, N, V and Z flags */
 396 static void gen_adc_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 397 {
 398     TCGv_i32 tmp = tcg_temp_new_i32();
 399     if (TCG_TARGET_HAS_add2_i32) {
 400         tcg_gen_movi_i32(tmp, 0);
 401         tcg_gen_add2_i32(cpu_NF, cpu_CF, t0, tmp, cpu_CF, tmp);
 402         tcg_gen_add2_i32(cpu_NF, cpu_CF, cpu_NF, cpu_CF, t1, tmp);
 403     } else {
 404         TCGv_i64 q0 = tcg_temp_new_i64();
 405         TCGv_i64 q1 = tcg_temp_new_i64();
 406         tcg_gen_extu_i32_i64(q0, t0);
 407         tcg_gen_extu_i32_i64(q1, t1);
 408         tcg_gen_add_i64(q0, q0, q1);
 409         tcg_gen_extu_i32_i64(q1, cpu_CF);
 410         tcg_gen_add_i64(q0, q0, q1);
 411         tcg_gen_extr_i64_i32(cpu_NF, cpu_CF, q0);
 412         tcg_temp_free_i64(q0);
 413         tcg_temp_free_i64(q1);
 414     }
 415     tcg_gen_mov_i32(cpu_ZF, cpu_NF);
 416     tcg_gen_xor_i32(cpu_VF, cpu_NF, t0);
 417     tcg_gen_xor_i32(tmp, t0, t1);
 418     tcg_gen_andc_i32(cpu_VF, cpu_VF, tmp);
 419     tcg_temp_free_i32(tmp);
 420     tcg_gen_mov_i32(dest, cpu_NF);
 421 }
 422
 423 /* dest = T0 - T1. Compute C, N, V and Z flags */
 424 static void gen_sub_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 425 {
 426     TCGv_i32 tmp;
 427     tcg_gen_sub_i32(cpu_NF, t0, t1);
 428     tcg_gen_mov_i32(cpu_ZF, cpu_NF);
 429     tcg_gen_setcond_i32(TCG_COND_GEU, cpu_CF, t0, t1);
 430     tcg_gen_xor_i32(cpu_VF, cpu_NF, t0);
 431     tmp = tcg_temp_new_i32();
 432     tcg_gen_xor_i32(tmp, t0, t1);
 433     tcg_gen_and_i32(cpu_VF, cpu_VF, tmp);
 434     tcg_temp_free_i32(tmp);
 435     tcg_gen_mov_i32(dest, cpu_NF);
 436 }
 437
 438 /* dest = T0 + ~T1 + CF.  Compute C, N, V and Z flags */
 439 static void gen_sbc_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 440 {
 441     TCGv_i32 tmp = tcg_temp_new_i32();
 442     tcg_gen_not_i32(tmp, t1);
 443     gen_adc_CC(dest, t0, tmp);
 444     tcg_temp_free_i32(tmp);
 445 }
 446
 447 #define GEN_SHIFT(name)                                               \
 448 static void gen_##name(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)       \
 449 {                                                                     \
 450     TCGv_i32 tmp1, tmp2, tmp3;                                        \
 451     tmp1 = tcg_temp_new_i32();                                        \
 452     tcg_gen_andi_i32(tmp1, t1, 0xff);                                 \
 453     tmp2 = tcg_const_i32(0);                                          \
 454     tmp3 = tcg_const_i32(0x1f);                                       \
 455     tcg_gen_movcond_i32(TCG_COND_GTU, tmp2, tmp1, tmp3, tmp2, t0);    \
 456     tcg_temp_free_i32(tmp3);                                          \
 457     tcg_gen_andi_i32(tmp1, tmp1, 0x1f);                               \
 458     tcg_gen_##name##_i32(dest, tmp2, tmp1);                           \
 459     tcg_temp_free_i32(tmp2);                                          \
 460     tcg_temp_free_i32(tmp1);                                          \
 461 }
 462 GEN_SHIFT(shl)
 463 GEN_SHIFT(shr)
 464 #undef GEN_SHIFT
 465
 466 static void gen_sar(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 467 {
 468     TCGv_i32 tmp1, tmp2;
 469     tmp1 = tcg_temp_new_i32();
 470     tcg_gen_andi_i32(tmp1, t1, 0xff);
 471     tmp2 = tcg_const_i32(0x1f);
 472     tcg_gen_movcond_i32(TCG_COND_GTU, tmp1, tmp1, tmp2, tmp2, tmp1);
 473     tcg_temp_free_i32(tmp2);
 474     tcg_gen_sar_i32(dest, t0, tmp1);
 475     tcg_temp_free_i32(tmp1);
 476 }
 477
 478 static void tcg_gen_abs_i32(TCGv_i32 dest, TCGv_i32 src)
 479 {
 480     TCGv_i32 c0 = tcg_const_i32(0);
 481     TCGv_i32 tmp = tcg_temp_new_i32();
 482     tcg_gen_neg_i32(tmp, src);
 483     tcg_gen_movcond_i32(TCG_COND_GT, dest, src, c0, src, tmp);
 484     tcg_temp_free_i32(c0);
 485     tcg_temp_free_i32(tmp);
 486 }
 487
 488 static void shifter_out_im(TCGv_i32 var, int shift)
 489 {
 490     if (shift == 0) {
 491         tcg_gen_andi_i32(cpu_CF, var, 1);
 492     } else {
 493         tcg_gen_shri_i32(cpu_CF, var, shift);
 494         if (shift != 31) {
 495             tcg_gen_andi_i32(cpu_CF, cpu_CF, 1);
 496         }
 497     }
 498 }
 499
 500 /* Shift by immediate.  Includes special handling for shift == 0.  */
 501 static inline void gen_arm_shift_im(TCGv_i32 var, int shiftop,
 502                                     int shift, int flags)
 503 {
 504     switch (shiftop) {
 505     case 0: /* LSL */
 506         if (shift != 0) {
 507             if (flags)
 508                 shifter_out_im(var, 32 - shift);
 509             tcg_gen_shli_i32(var, var, shift);
 510         }
 511         break;
 512     case 1: /* LSR */
 513         if (shift == 0) {
 514             if (flags) {
 515                 tcg_gen_shri_i32(cpu_CF, var, 31);
 516             }
 517             tcg_gen_movi_i32(var, 0);
 518         } else {
 519             if (flags)
 520                 shifter_out_im(var, shift - 1);
 521             tcg_gen_shri_i32(var, var, shift);
 522         }
 523         break;
 524     case 2: /* ASR */
 525         if (shift == 0)
 526             shift = 32;
 527         if (flags)
 528             shifter_out_im(var, shift - 1);
 529         if (shift == 32)
 530           shift = 31;
 531         tcg_gen_sari_i32(var, var, shift);
 532         break;
 533     case 3: /* ROR/RRX */
 534         if (shift != 0) {
 535             if (flags)
 536                 shifter_out_im(var, shift - 1);
 537             tcg_gen_rotri_i32(var, var, shift); break;
 538         } else {
 539             TCGv_i32 tmp = tcg_temp_new_i32();
 540             tcg_gen_shli_i32(tmp, cpu_CF, 31);
 541             if (flags)
 542                 shifter_out_im(var, 0);
 543             tcg_gen_shri_i32(var, var, 1);
 544             tcg_gen_or_i32(var, var, tmp);
 545             tcg_temp_free_i32(tmp);
 546         }
 547     }
 548 };
 549
 550 static inline void gen_arm_shift_reg(TCGv_i32 var, int shiftop,
 551                                      TCGv_i32 shift, int flags)
 552 {
 553     if (flags) {
 554         switch (shiftop) {
 555         case 0: gen_helper_shl_cc(var, cpu_env, var, shift); break;
 556         case 1: gen_helper_shr_cc(var, cpu_env, var, shift); break;
 557         case 2: gen_helper_sar_cc(var, cpu_env, var, shift); break;
 558         case 3: gen_helper_ror_cc(var, cpu_env, var, shift); break;
 559         }
 560     } else {
 561         switch (shiftop) {
 562         case 0:
 563             gen_shl(var, var, shift);
 564             break;
 565         case 1:
 566             gen_shr(var, var, shift);
 567             break;
 568         case 2:
 569             gen_sar(var, var, shift);
 570             break;
 571         case 3: tcg_gen_andi_i32(shift, shift, 0x1f);
 572                 tcg_gen_rotr_i32(var, var, shift); break;
 573         }
 574     }
 575     tcg_temp_free_i32(shift);
 576 }
 577
 578 #define PAS_OP(pfx) \
 579     switch (op2) {  \
 580     case 0: gen_pas_helper(glue(pfx,add16)); break; \
 581     case 1: gen_pas_helper(glue(pfx,addsubx)); break; \
 582     case 2: gen_pas_helper(glue(pfx,subaddx)); break; \
 583     case 3: gen_pas_helper(glue(pfx,sub16)); break; \
 584     case 4: gen_pas_helper(glue(pfx,add8)); break; \
 585     case 7: gen_pas_helper(glue(pfx,sub8)); break; \
 586     }
 587 static void gen_arm_parallel_addsub(int op1, int op2, TCGv_i32 a, TCGv_i32 b)
 588 {
 589     TCGv_ptr tmp;
 590
 591     switch (op1) {
 592 #define gen_pas_helper(name) glue(gen_helper_,name)(a, a, b, tmp)
 593     case 1:
 594         tmp = tcg_temp_new_ptr();
 595         tcg_gen_addi_ptr(tmp, cpu_env, offsetof(CPUARMState, GE));
 596         PAS_OP(s)
 597         tcg_temp_free_ptr(tmp);
 598         break;
 599     case 5:
 600         tmp = tcg_temp_new_ptr();
 601         tcg_gen_addi_ptr(tmp, cpu_env, offsetof(CPUARMState, GE));
 602         PAS_OP(u)
 603         tcg_temp_free_ptr(tmp);
 604         break;
 605 #undef gen_pas_helper
 606 #define gen_pas_helper(name) glue(gen_helper_,name)(a, a, b)
 607     case 2:
 608         PAS_OP(q);
 609         break;
 610     case 3:
 611         PAS_OP(sh);
 612         break;
 613     case 6:
 614         PAS_OP(uq);
 615         break;
 616     case 7:
 617         PAS_OP(uh);
 618         break;
 619 #undef gen_pas_helper
 620     }
 621 }
 622 #undef PAS_OP
 623
 624 /* For unknown reasons Arm and Thumb-2 use arbitrarily different encodings.  */
 625 #define PAS_OP(pfx) \
 626     switch (op1) {  \
 627     case 0: gen_pas_helper(glue(pfx,add8)); break; \
 628     case 1: gen_pas_helper(glue(pfx,add16)); break; \
 629     case 2: gen_pas_helper(glue(pfx,addsubx)); break; \
 630     case 4: gen_pas_helper(glue(pfx,sub8)); break; \
 631     case 5: gen_pas_helper(glue(pfx,sub16)); break; \
 632     case 6: gen_pas_helper(glue(pfx,subaddx)); break; \
 633     }
 634 static void gen_thumb2_parallel_addsub(int op1, int op2, TCGv_i32 a, TCGv_i32 b)
 635 {
 636     TCGv_ptr tmp;
 637
 638     switch (op2) {
 639 #define gen_pas_helper(name) glue(gen_helper_,name)(a, a, b, tmp)
 640     case 0:
 641         tmp = tcg_temp_new_ptr();
 642         tcg_gen_addi_ptr(tmp, cpu_env, offsetof(CPUARMState, GE));
 643         PAS_OP(s)
 644         tcg_temp_free_ptr(tmp);
 645         break;
 646     case 4:
 647         tmp = tcg_temp_new_ptr();
 648         tcg_gen_addi_ptr(tmp, cpu_env, offsetof(CPUARMState, GE));
 649         PAS_OP(u)
 650         tcg_temp_free_ptr(tmp);
 651         break;
 652 #undef gen_pas_helper
 653 #define gen_pas_helper(name) glue(gen_helper_,name)(a, a, b)
 654     case 1:
 655         PAS_OP(q);
 656         break;
 657     case 2:
 658         PAS_OP(sh);
 659         break;
 660     case 5:
 661         PAS_OP(uq);
 662         break;
 663     case 6:
 664         PAS_OP(uh);
 665         break;
 666 #undef gen_pas_helper
 667     }
 668 }
 669 #undef PAS_OP
 670
 671 /*
 672  * generate a conditional branch based on ARM condition code cc.
 673  * This is common between ARM and Aarch64 targets.
 674  */
 675 void arm_gen_test_cc(int cc, int label)
 676 {
 677     TCGv_i32 tmp;
 678     int inv;
 679
 680     switch (cc) {
 681     case 0: /* eq: Z */
 682         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_ZF, 0, label);
 683         break;
 684     case 1: /* ne: !Z */
 685         tcg_gen_brcondi_i32(TCG_COND_NE, cpu_ZF, 0, label);
 686         break;
 687     case 2: /* cs: C */
 688         tcg_gen_brcondi_i32(TCG_COND_NE, cpu_CF, 0, label);
 689         break;
 690     case 3: /* cc: !C */
 691         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_CF, 0, label);
 692         break;
 693     case 4: /* mi: N */
 694         tcg_gen_brcondi_i32(TCG_COND_LT, cpu_NF, 0, label);
 695         break;
 696     case 5: /* pl: !N */
 697         tcg_gen_brcondi_i32(TCG_COND_GE, cpu_NF, 0, label);
 698         break;
 699     case 6: /* vs: V */
 700         tcg_gen_brcondi_i32(TCG_COND_LT, cpu_VF, 0, label);
 701         break;
 702     case 7: /* vc: !V */
 703         tcg_gen_brcondi_i32(TCG_COND_GE, cpu_VF, 0, label);
 704         break;
 705     case 8: /* hi: C && !Z */
 706         inv = gen_new_label();
 707         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_CF, 0, inv);
 708         tcg_gen_brcondi_i32(TCG_COND_NE, cpu_ZF, 0, label);
 709         gen_set_label(inv);
 710         break;
 711     case 9: /* ls: !C || Z */
 712         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_CF, 0, label);
 713         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_ZF, 0, label);
 714         break;
 715     case 10: /* ge: N == V -> N ^ V == 0 */
 716         tmp = tcg_temp_new_i32();
 717         tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
 718         tcg_gen_brcondi_i32(TCG_COND_GE, tmp, 0, label);
 719         tcg_temp_free_i32(tmp);
 720         break;
 721     case 11: /* lt: N != V -> N ^ V != 0 */
 722         tmp = tcg_temp_new_i32();
 723         tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
 724         tcg_gen_brcondi_i32(TCG_COND_LT, tmp, 0, label);
 725         tcg_temp_free_i32(tmp);
 726         break;
 727     case 12: /* gt: !Z && N == V */
 728         inv = gen_new_label();
 729         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_ZF, 0, inv);
 730         tmp = tcg_temp_new_i32();
 731         tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
 732         tcg_gen_brcondi_i32(TCG_COND_GE, tmp, 0, label);
 733         tcg_temp_free_i32(tmp);
 734         gen_set_label(inv);
 735         break;
 736     case 13: /* le: Z || N != V */
 737         tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_ZF, 0, label);
 738         tmp = tcg_temp_new_i32();
 739         tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
 740         tcg_gen_brcondi_i32(TCG_COND_LT, tmp, 0, label);
 741         tcg_temp_free_i32(tmp);
 742         break;
 743     default:
 744         fprintf(stderr, "Bad condition code 0x%x\n", cc);
 745         abort();
 746     }
 747 }
 748
 749 static const uint8_t table_logic_cc[16] = {
 750     1, /* and */
 751     1, /* xor */
 752     0, /* sub */
 753     0, /* rsb */
 754     0, /* add */
 755     0, /* adc */
 756     0, /* sbc */
 757     0, /* rsc */
 758     1, /* andl */
 759     1, /* xorl */
 760     0, /* cmp */
 761     0, /* cmn */
 762     1, /* orr */
 763     1, /* mov */
 764     1, /* bic */
 765     1, /* mvn */
 766 };
 767
 768 /* Set PC and Thumb state from an immediate address.  */
 769 static inline void gen_bx_im(DisasContext *s, uint32_t addr)
 770 {
 771     TCGv_i32 tmp;
 772
 773     s->is_jmp = DISAS_UPDATE;
 774     if (s->thumb != (addr & 1)) {
 775         tmp = tcg_temp_new_i32();
 776         tcg_gen_movi_i32(tmp, addr & 1);
 777         tcg_gen_st_i32(tmp, cpu_env, offsetof(CPUARMState, thumb));
 778         tcg_temp_free_i32(tmp);
 779     }
 780     tcg_gen_movi_i32(cpu_R[15], addr & ~1);
 781 }
 782
 783 /* Set PC and Thumb state from var.  var is marked as dead.  */
 784 static inline void gen_bx(DisasContext *s, TCGv_i32 var)
 785 {
 786     s->is_jmp = DISAS_UPDATE;
 787     tcg_gen_andi_i32(cpu_R[15], var, ~1);
 788     tcg_gen_andi_i32(var, var, 1);
 789     store_cpu_field(var, thumb);
 790 }
 791
 792 /* Variant of store_reg which uses branch&exchange logic when storing
 793    to r15 in ARM architecture v7 and above. The source must be a temporary
 794    and will be marked as dead. */
 795 static inline void store_reg_bx(CPUARMState *env, DisasContext *s,
 796                                 int reg, TCGv_i32 var)
 797 {
 798     if (reg == 15 && ENABLE_ARCH_7) {
 799         gen_bx(s, var);
 800     } else {
 801         store_reg(s, reg, var);
 802     }
 803 }
 804
 805 /* Variant of store_reg which uses branch&exchange logic when storing
 806  * to r15 in ARM architecture v5T and above. This is used for storing
 807  * the results of a LDR/LDM/POP into r15, and corresponds to the cases
 808  * in the ARM ARM which use the LoadWritePC() pseudocode function. */
 809 static inline void store_reg_from_load(CPUARMState *env, DisasContext *s,
 810                                        int reg, TCGv_i32 var)
 811 {
 812     if (reg == 15 && ENABLE_ARCH_5) {
 813         gen_bx(s, var);
 814     } else {
 815         store_reg(s, reg, var);
 816     }
 817 }
 818
 819 /* Abstractions of "generate code to do a guest load/store for
 820  * AArch32", where a vaddr is always 32 bits (and is zero
 821  * extended if we're a 64 bit core) and  data is also
 822  * 32 bits unless specifically doing a 64 bit access.
 823  * These functions work like tcg_gen_qemu_{ld,st}* except
 824  * that the address argument is TCGv_i32 rather than TCGv.
 825  */
 826 #if TARGET_LONG_BITS == 32
 827
 828 #define DO_GEN_LD(SUFF, OPC)                                             \
 829 static inline void gen_aa32_ld##SUFF(TCGv_i32 val, TCGv_i32 addr, int index) \
 830 {                                                                        \
 831     tcg_gen_qemu_ld_i32(val, addr, index, OPC);                          \
 832 }
 833
 834 #define DO_GEN_ST(SUFF, OPC)                                             \
 835 static inline void gen_aa32_st##SUFF(TCGv_i32 val, TCGv_i32 addr, int index) \
 836 {                                                                        \
 837     tcg_gen_qemu_st_i32(val, addr, index, OPC);                          \
 838 }
 839
 840 static inline void gen_aa32_ld64(TCGv_i64 val, TCGv_i32 addr, int index)
 841 {
 842     tcg_gen_qemu_ld_i64(val, addr, index, MO_TEQ);
 843 }
 844
 845 static inline void gen_aa32_st64(TCGv_i64 val, TCGv_i32 addr, int index)
 846 {
 847     tcg_gen_qemu_st_i64(val, addr, index, MO_TEQ);
 848 }
 849
 850 #else
 851
 852 #define DO_GEN_LD(SUFF, OPC)                                             \
 853 static inline void gen_aa32_ld##SUFF(TCGv_i32 val, TCGv_i32 addr, int index) \
 854 {                                                                        \
 855     TCGv addr64 = tcg_temp_new();                                        \
 856     tcg_gen_extu_i32_i64(addr64, addr);                                  \
 857     tcg_gen_qemu_ld_i32(val, addr64, index, OPC);                        \
 858     tcg_temp_free(addr64);                                               \
 859 }
 860
 861 #define DO_GEN_ST(SUFF, OPC)                                             \
 862 static inline void gen_aa32_st##SUFF(TCGv_i32 val, TCGv_i32 addr, int index) \
 863 {                                                                        \
 864     TCGv addr64 = tcg_temp_new();                                        \
 865     tcg_gen_extu_i32_i64(addr64, addr);                                  \
 866     tcg_gen_qemu_st_i32(val, addr64, index, OPC);                        \
 867     tcg_temp_free(addr64);                                               \
 868 }
 869
 870 static inline void gen_aa32_ld64(TCGv_i64 val, TCGv_i32 addr, int index)
 871 {
 872     TCGv addr64 = tcg_temp_new();
 873     tcg_gen_extu_i32_i64(addr64, addr);
 874     tcg_gen_qemu_ld_i64(val, addr64, index, MO_TEQ);
 875     tcg_temp_free(addr64);
 876 }
 877
 878 static inline void gen_aa32_st64(TCGv_i64 val, TCGv_i32 addr, int index)
 879 {
 880     TCGv addr64 = tcg_temp_new();
 881     tcg_gen_extu_i32_i64(addr64, addr);
 882     tcg_gen_qemu_st_i64(val, addr64, index, MO_TEQ);
 883     tcg_temp_free(addr64);
 884 }
 885
 886 #endif
 887
 888 DO_GEN_LD(8s, MO_SB)
 889 DO_GEN_LD(8u, MO_UB)
 890 DO_GEN_LD(16s, MO_TESW)
 891 DO_GEN_LD(16u, MO_TEUW)
 892 DO_GEN_LD(32u, MO_TEUL)
 893 DO_GEN_ST(8, MO_UB)
 894 DO_GEN_ST(16, MO_TEUW)
 895 DO_GEN_ST(32, MO_TEUL)
 896
 897 static inline void gen_set_pc_im(DisasContext *s, target_ulong val)
 898 {
 899     tcg_gen_movi_i32(cpu_R[15], val);
 900 }
 901
 902 /* Force a TB lookup after an instruction that changes the CPU state.  */
 903 static inline void gen_lookup_tb(DisasContext *s)
 904 {
 905     tcg_gen_movi_i32(cpu_R[15], s->pc & ~1);
 906     s->is_jmp = DISAS_UPDATE;
 907 }
 908
 909 static inline void gen_add_data_offset(DisasContext *s, unsigned int insn,
 910                                        TCGv_i32 var)
 911 {
 912     int val, rm, shift, shiftop;
 913     TCGv_i32 offset;
 914
 915     if (!(insn & (1 << 25))) {
 916         /* immediate */
 917         val = insn & 0xfff;
 918         if (!(insn & (1 << 23)))
 919             val = -val;
 920         if (val != 0)
 921             tcg_gen_addi_i32(var, var, val);
 922     } else {
 923         /* shift/register */
 924         rm = (insn) & 0xf;
 925         shift = (insn >> 7) & 0x1f;
 926         shiftop = (insn >> 5) & 3;
 927         offset = load_reg(s, rm);
 928         gen_arm_shift_im(offset, shiftop, shift, 0);
 929         if (!(insn & (1 << 23)))
 930             tcg_gen_sub_i32(var, var, offset);
 931         else
 932             tcg_gen_add_i32(var, var, offset);
 933         tcg_temp_free_i32(offset);
 934     }
 935 }
 936
 937 static inline void gen_add_datah_offset(DisasContext *s, unsigned int insn,
 938                                         int extra, TCGv_i32 var)
 939 {
 940     int val, rm;
 941     TCGv_i32 offset;
 942
 943     if (insn & (1 << 22)) {
 944         /* immediate */
 945         val = (insn & 0xf) | ((insn >> 4) & 0xf0);
 946         if (!(insn & (1 << 23)))
 947             val = -val;
 948         val += extra;
 949         if (val != 0)
 950             tcg_gen_addi_i32(var, var, val);
 951     } else {
 952         /* register */
 953         if (extra)
 954             tcg_gen_addi_i32(var, var, extra);
 955         rm = (insn) & 0xf;
 956         offset = load_reg(s, rm);
 957         if (!(insn & (1 << 23)))
 958             tcg_gen_sub_i32(var, var, offset);
 959         else
 960             tcg_gen_add_i32(var, var, offset);
 961         tcg_temp_free_i32(offset);
 962     }
 963 }
 964
 965 static TCGv_ptr get_fpstatus_ptr(int neon)
 966 {
 967     TCGv_ptr statusptr = tcg_temp_new_ptr();
 968     int offset;
 969     if (neon) {
 970         offset = offsetof(CPUARMState, vfp.standard_fp_status);
 971     } else {
 972         offset = offsetof(CPUARMState, vfp.fp_status);
 973     }
 974     tcg_gen_addi_ptr(statusptr, cpu_env, offset);
 975     return statusptr;
 976 }
 977
 978 #define VFP_OP2(name)                                                 \
 979 static inline void gen_vfp_##name(int dp)                             \
 980 {                                                                     \
 981     TCGv_ptr fpst = get_fpstatus_ptr(0);                              \
 982     if (dp) {                                                         \
 983         gen_helper_vfp_##name##d(cpu_F0d, cpu_F0d, cpu_F1d, fpst);    \
 984     } else {                                                          \
 985         gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, cpu_F1s, fpst);    \
 986     }                                                                 \
 987     tcg_temp_free_ptr(fpst);                                          \
 988 }
 989
 990 VFP_OP2(add)
 991 VFP_OP2(sub)
 992 VFP_OP2(mul)
 993 VFP_OP2(div)
 994
 995 #undef VFP_OP2
 996
 997 static inline void gen_vfp_F1_mul(int dp)
 998 {
 999     /* Like gen_vfp_mul() but put result in F1 */
1000     TCGv_ptr fpst = get_fpstatus_ptr(0);
1001     if (dp) {
1002         gen_helper_vfp_muld(cpu_F1d, cpu_F0d, cpu_F1d, fpst);
1003     } else {
1004         gen_helper_vfp_muls(cpu_F1s, cpu_F0s, cpu_F1s, fpst);
1005     }
1006     tcg_temp_free_ptr(fpst);
1007 }
1008
1009 static inline void gen_vfp_F1_neg(int dp)
1010 {
1011     /* Like gen_vfp_neg() but put result in F1 */
1012     if (dp) {
1013         gen_helper_vfp_negd(cpu_F1d, cpu_F0d);
1014     } else {
1015         gen_helper_vfp_negs(cpu_F1s, cpu_F0s);
1016     }
1017 }
1018
1019 static inline void gen_vfp_abs(int dp)
1020 {
1021     if (dp)
1022         gen_helper_vfp_absd(cpu_F0d, cpu_F0d);
1023     else
1024         gen_helper_vfp_abss(cpu_F0s, cpu_F0s);
1025 }
1026
1027 static inline void gen_vfp_neg(int dp)
1028 {
1029     if (dp)
1030         gen_helper_vfp_negd(cpu_F0d, cpu_F0d);
1031     else
1032         gen_helper_vfp_negs(cpu_F0s, cpu_F0s);
1033 }
1034
1035 static inline void gen_vfp_sqrt(int dp)
1036 {
1037     if (dp)
1038         gen_helper_vfp_sqrtd(cpu_F0d, cpu_F0d, cpu_env);
1039     else
1040         gen_helper_vfp_sqrts(cpu_F0s, cpu_F0s, cpu_env);
1041 }
1042
1043 static inline void gen_vfp_cmp(int dp)
1044 {
1045     if (dp)
1046         gen_helper_vfp_cmpd(cpu_F0d, cpu_F1d, cpu_env);
1047     else
1048         gen_helper_vfp_cmps(cpu_F0s, cpu_F1s, cpu_env);
1049 }
1050
1051 static inline void gen_vfp_cmpe(int dp)
1052 {
1053     if (dp)
1054         gen_helper_vfp_cmped(cpu_F0d, cpu_F1d, cpu_env);
1055     else
1056         gen_helper_vfp_cmpes(cpu_F0s, cpu_F1s, cpu_env);
1057 }
1058
1059 static inline void gen_vfp_F1_ld0(int dp)
1060 {
1061     if (dp)
1062         tcg_gen_movi_i64(cpu_F1d, 0);
1063     else
1064         tcg_gen_movi_i32(cpu_F1s, 0);
1065 }
1066
1067 #define VFP_GEN_ITOF(name) \
1068 static inline void gen_vfp_##name(int dp, int neon) \
1069 { \
1070     TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
1071     if (dp) { \
1072         gen_helper_vfp_##name##d(cpu_F0d, cpu_F0s, statusptr); \
1073     } else { \
1074         gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
1075     } \
1076     tcg_temp_free_ptr(statusptr); \
1077 }
1078
1079 VFP_GEN_ITOF(uito)
1080 VFP_GEN_ITOF(sito)
1081 #undef VFP_GEN_ITOF
1082
1083 #define VFP_GEN_FTOI(name) \
1084 static inline void gen_vfp_##name(int dp, int neon) \
1085 { \
1086     TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
1087     if (dp) { \
1088         gen_helper_vfp_##name##d(cpu_F0s, cpu_F0d, statusptr); \
1089     } else { \
1090         gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
1091     } \
1092     tcg_temp_free_ptr(statusptr); \
1093 }
1094
1095 VFP_GEN_FTOI(toui)
1096 VFP_GEN_FTOI(touiz)
1097 VFP_GEN_FTOI(tosi)
1098 VFP_GEN_FTOI(tosiz)
1099 #undef VFP_GEN_FTOI
1100
1101 #define VFP_GEN_FIX(name, round) \
1102 static inline void gen_vfp_##name(int dp, int shift, int neon) \
1103 { \
1104     TCGv_i32 tmp_shift = tcg_const_i32(shift); \
1105     TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
1106     if (dp) { \
1107         gen_helper_vfp_##name##d##round(cpu_F0d, cpu_F0d, tmp_shift, \
1108                                         statusptr); \
1109     } else { \
1110         gen_helper_vfp_##name##s##round(cpu_F0s, cpu_F0s, tmp_shift, \
1111                                         statusptr); \
1112     } \
1113     tcg_temp_free_i32(tmp_shift); \
1114     tcg_temp_free_ptr(statusptr); \
1115 }
1116 VFP_GEN_FIX(tosh, _round_to_zero)
1117 VFP_GEN_FIX(tosl, _round_to_zero)
1118 VFP_GEN_FIX(touh, _round_to_zero)
1119 VFP_GEN_FIX(toul, _round_to_zero)
1120 VFP_GEN_FIX(shto, )
1121 VFP_GEN_FIX(slto, )
1122 VFP_GEN_FIX(uhto, )
1123 VFP_GEN_FIX(ulto, )
1124 #undef VFP_GEN_FIX
1125
1126 static inline void gen_vfp_ld(DisasContext *s, int dp, TCGv_i32 addr)
1127 {
1128     if (dp) {
1129         gen_aa32_ld64(cpu_F0d, addr, IS_USER(s));
1130     } else {
1131         gen_aa32_ld32u(cpu_F0s, addr, IS_USER(s));
1132     }
1133 }
1134
1135 static inline void gen_vfp_st(DisasContext *s, int dp, TCGv_i32 addr)
1136 {
1137     if (dp) {
1138         gen_aa32_st64(cpu_F0d, addr, IS_USER(s));
1139     } else {
1140         gen_aa32_st32(cpu_F0s, addr, IS_USER(s));
1141     }
1142 }
1143
1144 static inline long
1145 vfp_reg_offset (int dp, int reg)
1146 {
1147     if (dp)
1148         return offsetof(CPUARMState, vfp.regs[reg]);
1149     else if (reg & 1) {
1150         return offsetof(CPUARMState, vfp.regs[reg >> 1])
1151           + offsetof(CPU_DoubleU, l.upper);
1152     } else {
1153         return offsetof(CPUARMState, vfp.regs[reg >> 1])
1154           + offsetof(CPU_DoubleU, l.lower);
1155     }
1156 }
1157
1158 /* Return the offset of a 32-bit piece of a NEON register.
1159    zero is the least significant end of the register.  */
1160 static inline long
1161 neon_reg_offset (int reg, int n)
1162 {
1163     int sreg;
1164     sreg = reg * 2 + n;
1165     return vfp_reg_offset(0, sreg);
1166 }
1167
1168 static TCGv_i32 neon_load_reg(int reg, int pass)
1169 {
1170     TCGv_i32 tmp = tcg_temp_new_i32();
1171     tcg_gen_ld_i32(tmp, cpu_env, neon_reg_offset(reg, pass));
1172     return tmp;
1173 }
1174
1175 static void neon_store_reg(int reg, int pass, TCGv_i32 var)
1176 {
1177     tcg_gen_st_i32(var, cpu_env, neon_reg_offset(reg, pass));
1178     tcg_temp_free_i32(var);
1179 }
1180
1181 static inline void neon_load_reg64(TCGv_i64 var, int reg)
1182 {
1183     tcg_gen_ld_i64(var, cpu_env, vfp_reg_offset(1, reg));
1184 }
1185
1186 static inline void neon_store_reg64(TCGv_i64 var, int reg)
1187 {
1188     tcg_gen_st_i64(var, cpu_env, vfp_reg_offset(1, reg));
1189 }
1190
1191 #define tcg_gen_ld_f32 tcg_gen_ld_i32
1192 #define tcg_gen_ld_f64 tcg_gen_ld_i64
1193 #define tcg_gen_st_f32 tcg_gen_st_i32
1194 #define tcg_gen_st_f64 tcg_gen_st_i64
1195
1196 static inline void gen_mov_F0_vreg(int dp, int reg)
1197 {
1198     if (dp)
1199         tcg_gen_ld_f64(cpu_F0d, cpu_env, vfp_reg_offset(dp, reg));
1200     else
1201         tcg_gen_ld_f32(cpu_F0s, cpu_env, vfp_reg_offset(dp, reg));
1202 }
1203
1204 static inline void gen_mov_F1_vreg(int dp, int reg)
1205 {
1206     if (dp)
1207         tcg_gen_ld_f64(cpu_F1d, cpu_env, vfp_reg_offset(dp, reg));
1208     else
1209         tcg_gen_ld_f32(cpu_F1s, cpu_env, vfp_reg_offset(dp, reg));
1210 }
1211
1212 static inline void gen_mov_vreg_F0(int dp, int reg)
1213 {
1214     if (dp)
1215         tcg_gen_st_f64(cpu_F0d, cpu_env, vfp_reg_offset(dp, reg));
1216     else
1217         tcg_gen_st_f32(cpu_F0s, cpu_env, vfp_reg_offset(dp, reg));
1218 }
1219
1220 #define ARM_CP_RW_BIT   (1 << 20)
1221
1222 static inline void iwmmxt_load_reg(TCGv_i64 var, int reg)
1223 {
1224     tcg_gen_ld_i64(var, cpu_env, offsetof(CPUARMState, iwmmxt.regs[reg]));
1225 }
1226
1227 static inline void iwmmxt_store_reg(TCGv_i64 var, int reg)
1228 {
1229     tcg_gen_st_i64(var, cpu_env, offsetof(CPUARMState, iwmmxt.regs[reg]));
1230 }
1231
1232 static inline TCGv_i32 iwmmxt_load_creg(int reg)
1233 {
1234     TCGv_i32 var = tcg_temp_new_i32();
1235     tcg_gen_ld_i32(var, cpu_env, offsetof(CPUARMState, iwmmxt.cregs[reg]));
1236     return var;
1237 }
1238
1239 static inline void iwmmxt_store_creg(int reg, TCGv_i32 var)
1240 {
1241     tcg_gen_st_i32(var, cpu_env, offsetof(CPUARMState, iwmmxt.cregs[reg]));
1242     tcg_temp_free_i32(var);
1243 }
1244
1245 static inline void gen_op_iwmmxt_movq_wRn_M0(int rn)
1246 {
1247     iwmmxt_store_reg(cpu_M0, rn);
1248 }
1249
1250 static inline void gen_op_iwmmxt_movq_M0_wRn(int rn)
1251 {
1252     iwmmxt_load_reg(cpu_M0, rn);
1253 }
1254
1255 static inline void gen_op_iwmmxt_orq_M0_wRn(int rn)
1256 {
1257     iwmmxt_load_reg(cpu_V1, rn);
1258     tcg_gen_or_i64(cpu_M0, cpu_M0, cpu_V1);
1259 }
1260
1261 static inline void gen_op_iwmmxt_andq_M0_wRn(int rn)
1262 {
1263     iwmmxt_load_reg(cpu_V1, rn);
1264     tcg_gen_and_i64(cpu_M0, cpu_M0, cpu_V1);
1265 }
1266
1267 static inline void gen_op_iwmmxt_xorq_M0_wRn(int rn)
1268 {
1269     iwmmxt_load_reg(cpu_V1, rn);
1270     tcg_gen_xor_i64(cpu_M0, cpu_M0, cpu_V1);
1271 }
1272
1273 #define IWMMXT_OP(name) \
1274 static inline void gen_op_iwmmxt_##name##_M0_wRn(int rn) \
1275 { \
1276     iwmmxt_load_reg(cpu_V1, rn); \
1277     gen_helper_iwmmxt_##name(cpu_M0, cpu_M0, cpu_V1); \
1278 }
1279
1280 #define IWMMXT_OP_ENV(name) \
1281 static inline void gen_op_iwmmxt_##name##_M0_wRn(int rn) \
1282 { \
1283     iwmmxt_load_reg(cpu_V1, rn); \
1284     gen_helper_iwmmxt_##name(cpu_M0, cpu_env, cpu_M0, cpu_V1); \
1285 }
1286
1287 #define IWMMXT_OP_ENV_SIZE(name) \
1288 IWMMXT_OP_ENV(name##b) \
1289 IWMMXT_OP_ENV(name##w) \
1290 IWMMXT_OP_ENV(name##l)
1291
1292 #define IWMMXT_OP_ENV1(name) \
1293 static inline void gen_op_iwmmxt_##name##_M0(void) \
1294 { \
1295     gen_helper_iwmmxt_##name(cpu_M0, cpu_env, cpu_M0); \
1296 }
1297
1298 IWMMXT_OP(maddsq)
1299 IWMMXT_OP(madduq)
1300 IWMMXT_OP(sadb)
1301 IWMMXT_OP(sadw)
1302 IWMMXT_OP(mulslw)
1303 IWMMXT_OP(mulshw)
1304 IWMMXT_OP(mululw)
1305 IWMMXT_OP(muluhw)
1306 IWMMXT_OP(macsw)
1307 IWMMXT_OP(macuw)
1308
1309 IWMMXT_OP_ENV_SIZE(unpackl)
1310 IWMMXT_OP_ENV_SIZE(unpackh)
1311
1312 IWMMXT_OP_ENV1(unpacklub)
1313 IWMMXT_OP_ENV1(unpackluw)
1314 IWMMXT_OP_ENV1(unpacklul)
1315 IWMMXT_OP_ENV1(unpackhub)
1316 IWMMXT_OP_ENV1(unpackhuw)
1317 IWMMXT_OP_ENV1(unpackhul)
1318 IWMMXT_OP_ENV1(unpacklsb)
1319 IWMMXT_OP_ENV1(unpacklsw)
1320 IWMMXT_OP_ENV1(unpacklsl)
1321 IWMMXT_OP_ENV1(unpackhsb)
1322 IWMMXT_OP_ENV1(unpackhsw)
1323 IWMMXT_OP_ENV1(unpackhsl)
1324
1325 IWMMXT_OP_ENV_SIZE(cmpeq)
1326 IWMMXT_OP_ENV_SIZE(cmpgtu)
1327 IWMMXT_OP_ENV_SIZE(cmpgts)
1328
1329 IWMMXT_OP_ENV_SIZE(mins)
1330 IWMMXT_OP_ENV_SIZE(minu)
1331 IWMMXT_OP_ENV_SIZE(maxs)
1332 IWMMXT_OP_ENV_SIZE(maxu)
1333
1334 IWMMXT_OP_ENV_SIZE(subn)
1335 IWMMXT_OP_ENV_SIZE(addn)
1336 IWMMXT_OP_ENV_SIZE(subu)
1337 IWMMXT_OP_ENV_SIZE(addu)
1338 IWMMXT_OP_ENV_SIZE(subs)
1339 IWMMXT_OP_ENV_SIZE(adds)
1340
1341 IWMMXT_OP_ENV(avgb0)
1342 IWMMXT_OP_ENV(avgb1)
1343 IWMMXT_OP_ENV(avgw0)
1344 IWMMXT_OP_ENV(avgw1)
1345
1346 IWMMXT_OP(msadb)
1347
1348 IWMMXT_OP_ENV(packuw)
1349 IWMMXT_OP_ENV(packul)
1350 IWMMXT_OP_ENV(packuq)
1351 IWMMXT_OP_ENV(packsw)
1352 IWMMXT_OP_ENV(packsl)
1353 IWMMXT_OP_ENV(packsq)
1354
1355 static void gen_op_iwmmxt_set_mup(void)
1356 {
1357     TCGv_i32 tmp;
1358     tmp = load_cpu_field(iwmmxt.cregs[ARM_IWMMXT_wCon]);
1359     tcg_gen_ori_i32(tmp, tmp, 2);
1360     store_cpu_field(tmp, iwmmxt.cregs[ARM_IWMMXT_wCon]);
1361 }
1362
1363 static void gen_op_iwmmxt_set_cup(void)
1364 {
1365     TCGv_i32 tmp;
1366     tmp = load_cpu_field(iwmmxt.cregs[ARM_IWMMXT_wCon]);
1367     tcg_gen_ori_i32(tmp, tmp, 1);
1368     store_cpu_field(tmp, iwmmxt.cregs[ARM_IWMMXT_wCon]);
1369 }
1370
1371 static void gen_op_iwmmxt_setpsr_nz(void)
1372 {
1373     TCGv_i32 tmp = tcg_temp_new_i32();
1374     gen_helper_iwmmxt_setpsr_nz(tmp, cpu_M0);
1375     store_cpu_field(tmp, iwmmxt.cregs[ARM_IWMMXT_wCASF]);
1376 }
1377
1378 static inline void gen_op_iwmmxt_addl_M0_wRn(int rn)
1379 {
1380     iwmmxt_load_reg(cpu_V1, rn);
1381     tcg_gen_ext32u_i64(cpu_V1, cpu_V1);
1382     tcg_gen_add_i64(cpu_M0, cpu_M0, cpu_V1);
1383 }
1384
1385 static inline int gen_iwmmxt_address(DisasContext *s, uint32_t insn,
1386                                      TCGv_i32 dest)
1387 {
1388     int rd;
1389     uint32_t offset;
1390     TCGv_i32 tmp;
1391
1392     rd = (insn >> 16) & 0xf;
1393     tmp = load_reg(s, rd);
1394
1395     offset = (insn & 0xff) << ((insn >> 7) & 2);
1396     if (insn & (1 << 24)) {
1397         /* Pre indexed */
1398         if (insn & (1 << 23))
1399             tcg_gen_addi_i32(tmp, tmp, offset);
1400         else
1401             tcg_gen_addi_i32(tmp, tmp, -offset);
1402         tcg_gen_mov_i32(dest, tmp);
1403         if (insn & (1 << 21))
1404             store_reg(s, rd, tmp);
1405         else
1406             tcg_temp_free_i32(tmp);
1407     } else if (insn & (1 << 21)) {
1408         /* Post indexed */
1409         tcg_gen_mov_i32(dest, tmp);
1410         if (insn & (1 << 23))
1411             tcg_gen_addi_i32(tmp, tmp, offset);
1412         else
1413             tcg_gen_addi_i32(tmp, tmp, -offset);
1414         store_reg(s, rd, tmp);
1415     } else if (!(insn & (1 << 23)))
1416         return 1;
1417     return 0;
1418 }
1419
1420 static inline int gen_iwmmxt_shift(uint32_t insn, uint32_t mask, TCGv_i32 dest)
1421 {
1422     int rd = (insn >> 0) & 0xf;
1423     TCGv_i32 tmp;
1424
1425     if (insn & (1 << 8)) {
1426         if (rd < ARM_IWMMXT_wCGR0 || rd > ARM_IWMMXT_wCGR3) {
1427             return 1;
1428         } else {
1429             tmp = iwmmxt_load_creg(rd);
1430         }
1431     } else {
1432         tmp = tcg_temp_new_i32();
1433         iwmmxt_load_reg(cpu_V0, rd);
1434         tcg_gen_trunc_i64_i32(tmp, cpu_V0);
1435     }
1436     tcg_gen_andi_i32(tmp, tmp, mask);
1437     tcg_gen_mov_i32(dest, tmp);
1438     tcg_temp_free_i32(tmp);
1439     return 0;
1440 }
1441
1442 /* Disassemble an iwMMXt instruction.  Returns nonzero if an error occurred
1443    (ie. an undefined instruction).  */
1444 static int disas_iwmmxt_insn(CPUARMState *env, DisasContext *s, uint32_t insn)
1445 {
1446     int rd, wrd;
1447     int rdhi, rdlo, rd0, rd1, i;
1448     TCGv_i32 addr;
1449     TCGv_i32 tmp, tmp2, tmp3;
1450
1451     if ((insn & 0x0e000e00) == 0x0c000000) {
1452         if ((insn & 0x0fe00ff0) == 0x0c400000) {
1453             wrd = insn & 0xf;
1454             rdlo = (insn >> 12) & 0xf;
1455             rdhi = (insn >> 16) & 0xf;
1456             if (insn & ARM_CP_RW_BIT) {                 /* TMRRC */
1457                 iwmmxt_load_reg(cpu_V0, wrd);
1458                 tcg_gen_trunc_i64_i32(cpu_R[rdlo], cpu_V0);
1459                 tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
1460                 tcg_gen_trunc_i64_i32(cpu_R[rdhi], cpu_V0);
1461             } else {                                    /* TMCRR */
1462                 tcg_gen_concat_i32_i64(cpu_V0, cpu_R[rdlo], cpu_R[rdhi]);
1463                 iwmmxt_store_reg(cpu_V0, wrd);
1464                 gen_op_iwmmxt_set_mup();
1465             }
1466             return 0;
1467         }
1468
1469         wrd = (insn >> 12) & 0xf;
1470         addr = tcg_temp_new_i32();
1471         if (gen_iwmmxt_address(s, insn, addr)) {
1472             tcg_temp_free_i32(addr);
1473             return 1;
1474         }
1475         if (insn & ARM_CP_RW_BIT) {
1476             if ((insn >> 28) == 0xf) {                  /* WLDRW wCx */
1477                 tmp = tcg_temp_new_i32();
1478                 gen_aa32_ld32u(tmp, addr, IS_USER(s));
1479                 iwmmxt_store_creg(wrd, tmp);
1480             } else {
1481                 i = 1;
1482                 if (insn & (1 << 8)) {
1483                     if (insn & (1 << 22)) {             /* WLDRD */
1484                         gen_aa32_ld64(cpu_M0, addr, IS_USER(s));
1485                         i = 0;
1486                     } else {                            /* WLDRW wRd */
1487                         tmp = tcg_temp_new_i32();
1488                         gen_aa32_ld32u(tmp, addr, IS_USER(s));
1489                     }
1490                 } else {
1491                     tmp = tcg_temp_new_i32();
1492                     if (insn & (1 << 22)) {             /* WLDRH */
1493                         gen_aa32_ld16u(tmp, addr, IS_USER(s));
1494                     } else {                            /* WLDRB */
1495                         gen_aa32_ld8u(tmp, addr, IS_USER(s));
1496                     }
1497                 }
1498                 if (i) {
1499                     tcg_gen_extu_i32_i64(cpu_M0, tmp);
1500                     tcg_temp_free_i32(tmp);
1501                 }
1502                 gen_op_iwmmxt_movq_wRn_M0(wrd);
1503             }
1504         } else {
1505             if ((insn >> 28) == 0xf) {                  /* WSTRW wCx */
1506                 tmp = iwmmxt_load_creg(wrd);
1507                 gen_aa32_st32(tmp, addr, IS_USER(s));
1508             } else {
1509                 gen_op_iwmmxt_movq_M0_wRn(wrd);
1510                 tmp = tcg_temp_new_i32();
1511                 if (insn & (1 << 8)) {
1512                     if (insn & (1 << 22)) {             /* WSTRD */
1513                         gen_aa32_st64(cpu_M0, addr, IS_USER(s));
1514                     } else {                            /* WSTRW wRd */
1515                         tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1516                         gen_aa32_st32(tmp, addr, IS_USER(s));
1517                     }
1518                 } else {
1519                     if (insn & (1 << 22)) {             /* WSTRH */
1520                         tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1521                         gen_aa32_st16(tmp, addr, IS_USER(s));
1522                     } else {                            /* WSTRB */
1523                         tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1524                         gen_aa32_st8(tmp, addr, IS_USER(s));
1525                     }
1526                 }
1527             }
1528             tcg_temp_free_i32(tmp);
1529         }
1530         tcg_temp_free_i32(addr);
1531         return 0;
1532     }
1533
1534     if ((insn & 0x0f000000) != 0x0e000000)
1535         return 1;
1536
1537     switch (((insn >> 12) & 0xf00) | ((insn >> 4) & 0xff)) {
1538     case 0x000:                                         /* WOR */
1539         wrd = (insn >> 12) & 0xf;
1540         rd0 = (insn >> 0) & 0xf;
1541         rd1 = (insn >> 16) & 0xf;
1542         gen_op_iwmmxt_movq_M0_wRn(rd0);
1543         gen_op_iwmmxt_orq_M0_wRn(rd1);
1544         gen_op_iwmmxt_setpsr_nz();
1545         gen_op_iwmmxt_movq_wRn_M0(wrd);
1546         gen_op_iwmmxt_set_mup();
1547         gen_op_iwmmxt_set_cup();
1548         break;
1549     case 0x011:                                         /* TMCR */
1550         if (insn & 0xf)
1551             return 1;
1552         rd = (insn >> 12) & 0xf;
1553         wrd = (insn >> 16) & 0xf;
1554         switch (wrd) {
1555         case ARM_IWMMXT_wCID:
1556         case ARM_IWMMXT_wCASF:
1557             break;
1558         case ARM_IWMMXT_wCon:
1559             gen_op_iwmmxt_set_cup();
1560             /* Fall through.  */
1561         case ARM_IWMMXT_wCSSF:
1562             tmp = iwmmxt_load_creg(wrd);
1563             tmp2 = load_reg(s, rd);
1564             tcg_gen_andc_i32(tmp, tmp, tmp2);
1565             tcg_temp_free_i32(tmp2);
1566             iwmmxt_store_creg(wrd, tmp);
1567             break;
1568         case ARM_IWMMXT_wCGR0:
1569         case ARM_IWMMXT_wCGR1:
1570         case ARM_IWMMXT_wCGR2:
1571         case ARM_IWMMXT_wCGR3:
1572             gen_op_iwmmxt_set_cup();
1573             tmp = load_reg(s, rd);
1574             iwmmxt_store_creg(wrd, tmp);
1575             break;
1576         default:
1577             return 1;
1578         }
1579         break;
1580     case 0x100:                                         /* WXOR */
1581         wrd = (insn >> 12) & 0xf;
1582         rd0 = (insn >> 0) & 0xf;
1583         rd1 = (insn >> 16) & 0xf;
1584         gen_op_iwmmxt_movq_M0_wRn(rd0);
1585         gen_op_iwmmxt_xorq_M0_wRn(rd1);
1586         gen_op_iwmmxt_setpsr_nz();
1587         gen_op_iwmmxt_movq_wRn_M0(wrd);
1588         gen_op_iwmmxt_set_mup();
1589         gen_op_iwmmxt_set_cup();
1590         break;
1591     case 0x111:                                         /* TMRC */
1592         if (insn & 0xf)
1593             return 1;
1594         rd = (insn >> 12) & 0xf;
1595         wrd = (insn >> 16) & 0xf;
1596         tmp = iwmmxt_load_creg(wrd);
1597         store_reg(s, rd, tmp);
1598         break;
1599     case 0x300:                                         /* WANDN */
1600         wrd = (insn >> 12) & 0xf;
1601         rd0 = (insn >> 0) & 0xf;
1602         rd1 = (insn >> 16) & 0xf;
1603         gen_op_iwmmxt_movq_M0_wRn(rd0);
1604         tcg_gen_neg_i64(cpu_M0, cpu_M0);
1605         gen_op_iwmmxt_andq_M0_wRn(rd1);
1606         gen_op_iwmmxt_setpsr_nz();
1607         gen_op_iwmmxt_movq_wRn_M0(wrd);
1608         gen_op_iwmmxt_set_mup();
1609         gen_op_iwmmxt_set_cup();
1610         break;
1611     case 0x200:                                         /* WAND */
1612         wrd = (insn >> 12) & 0xf;
1613         rd0 = (insn >> 0) & 0xf;
1614         rd1 = (insn >> 16) & 0xf;
1615         gen_op_iwmmxt_movq_M0_wRn(rd0);
1616         gen_op_iwmmxt_andq_M0_wRn(rd1);
1617         gen_op_iwmmxt_setpsr_nz();
1618         gen_op_iwmmxt_movq_wRn_M0(wrd);
1619         gen_op_iwmmxt_set_mup();
1620         gen_op_iwmmxt_set_cup();
1621         break;
1622     case 0x810: case 0xa10:                             /* WMADD */
1623         wrd = (insn >> 12) & 0xf;
1624         rd0 = (insn >> 0) & 0xf;
1625         rd1 = (insn >> 16) & 0xf;
1626         gen_op_iwmmxt_movq_M0_wRn(rd0);
1627         if (insn & (1 << 21))
1628             gen_op_iwmmxt_maddsq_M0_wRn(rd1);
1629         else
1630             gen_op_iwmmxt_madduq_M0_wRn(rd1);
1631         gen_op_iwmmxt_movq_wRn_M0(wrd);
1632         gen_op_iwmmxt_set_mup();
1633         break;
1634     case 0x10e: case 0x50e: case 0x90e: case 0xd0e:     /* WUNPCKIL */
1635         wrd = (insn >> 12) & 0xf;
1636         rd0 = (insn >> 16) & 0xf;
1637         rd1 = (insn >> 0) & 0xf;
1638         gen_op_iwmmxt_movq_M0_wRn(rd0);
1639         switch ((insn >> 22) & 3) {
1640         case 0:
1641             gen_op_iwmmxt_unpacklb_M0_wRn(rd1);
1642             break;
1643         case 1:
1644             gen_op_iwmmxt_unpacklw_M0_wRn(rd1);
1645             break;
1646         case 2:
1647             gen_op_iwmmxt_unpackll_M0_wRn(rd1);
1648             break;
1649         case 3:
1650             return 1;
1651         }
1652         gen_op_iwmmxt_movq_wRn_M0(wrd);
1653         gen_op_iwmmxt_set_mup();
1654         gen_op_iwmmxt_set_cup();
1655         break;
1656     case 0x10c: case 0x50c: case 0x90c: case 0xd0c:     /* WUNPCKIH */
1657         wrd = (insn >> 12) & 0xf;
1658         rd0 = (insn >> 16) & 0xf;
1659         rd1 = (insn >> 0) & 0xf;
1660         gen_op_iwmmxt_movq_M0_wRn(rd0);
1661         switch ((insn >> 22) & 3) {
1662         case 0:
1663             gen_op_iwmmxt_unpackhb_M0_wRn(rd1);
1664             break;
1665         case 1:
1666             gen_op_iwmmxt_unpackhw_M0_wRn(rd1);
1667             break;
1668         case 2:
1669             gen_op_iwmmxt_unpackhl_M0_wRn(rd1);
1670             break;
1671         case 3:
1672             return 1;
1673         }
1674         gen_op_iwmmxt_movq_wRn_M0(wrd);
1675         gen_op_iwmmxt_set_mup();
1676         gen_op_iwmmxt_set_cup();
1677         break;
1678     case 0x012: case 0x112: case 0x412: case 0x512:     /* WSAD */
1679         wrd = (insn >> 12) & 0xf;
1680         rd0 = (insn >> 16) & 0xf;
1681         rd1 = (insn >> 0) & 0xf;
1682         gen_op_iwmmxt_movq_M0_wRn(rd0);
1683         if (insn & (1 << 22))
1684             gen_op_iwmmxt_sadw_M0_wRn(rd1);
1685         else
1686             gen_op_iwmmxt_sadb_M0_wRn(rd1);
1687         if (!(insn & (1 << 20)))
1688             gen_op_iwmmxt_addl_M0_wRn(wrd);
1689         gen_op_iwmmxt_movq_wRn_M0(wrd);
1690         gen_op_iwmmxt_set_mup();
1691         break;
1692     case 0x010: case 0x110: case 0x210: case 0x310:     /* WMUL */
1693         wrd = (insn >> 12) & 0xf;
1694         rd0 = (insn >> 16) & 0xf;
1695         rd1 = (insn >> 0) & 0xf;
1696         gen_op_iwmmxt_movq_M0_wRn(rd0);
1697         if (insn & (1 << 21)) {
1698             if (insn & (1 << 20))
1699                 gen_op_iwmmxt_mulshw_M0_wRn(rd1);
1700             else
1701                 gen_op_iwmmxt_mulslw_M0_wRn(rd1);
1702         } else {
1703             if (insn & (1 << 20))
1704                 gen_op_iwmmxt_muluhw_M0_wRn(rd1);
1705             else
1706                 gen_op_iwmmxt_mululw_M0_wRn(rd1);
1707         }
1708         gen_op_iwmmxt_movq_wRn_M0(wrd);
1709         gen_op_iwmmxt_set_mup();
1710         break;
1711     case 0x410: case 0x510: case 0x610: case 0x710:     /* WMAC */
1712         wrd = (insn >> 12) & 0xf;
1713         rd0 = (insn >> 16) & 0xf;
1714         rd1 = (insn >> 0) & 0xf;
1715         gen_op_iwmmxt_movq_M0_wRn(rd0);
1716         if (insn & (1 << 21))
1717             gen_op_iwmmxt_macsw_M0_wRn(rd1);
1718         else
1719             gen_op_iwmmxt_macuw_M0_wRn(rd1);
1720         if (!(insn & (1 << 20))) {
1721             iwmmxt_load_reg(cpu_V1, wrd);
1722             tcg_gen_add_i64(cpu_M0, cpu_M0, cpu_V1);
1723         }
1724         gen_op_iwmmxt_movq_wRn_M0(wrd);
1725         gen_op_iwmmxt_set_mup();
1726         break;
1727     case 0x006: case 0x406: case 0x806: case 0xc06:     /* WCMPEQ */
1728         wrd = (insn >> 12) & 0xf;
1729         rd0 = (insn >> 16) & 0xf;
1730         rd1 = (insn >> 0) & 0xf;
1731         gen_op_iwmmxt_movq_M0_wRn(rd0);
1732         switch ((insn >> 22) & 3) {
1733         case 0:
1734             gen_op_iwmmxt_cmpeqb_M0_wRn(rd1);
1735             break;
1736         case 1:
1737             gen_op_iwmmxt_cmpeqw_M0_wRn(rd1);
1738             break;
1739         case 2:
1740             gen_op_iwmmxt_cmpeql_M0_wRn(rd1);
1741             break;
1742         case 3:
1743             return 1;
1744         }
1745         gen_op_iwmmxt_movq_wRn_M0(wrd);
1746         gen_op_iwmmxt_set_mup();
1747         gen_op_iwmmxt_set_cup();
1748         break;
1749     case 0x800: case 0x900: case 0xc00: case 0xd00:     /* WAVG2 */
1750         wrd = (insn >> 12) & 0xf;
1751         rd0 = (insn >> 16) & 0xf;
1752         rd1 = (insn >> 0) & 0xf;
1753         gen_op_iwmmxt_movq_M0_wRn(rd0);
1754         if (insn & (1 << 22)) {
1755             if (insn & (1 << 20))
1756                 gen_op_iwmmxt_avgw1_M0_wRn(rd1);
1757             else
1758                 gen_op_iwmmxt_avgw0_M0_wRn(rd1);
1759         } else {
1760             if (insn & (1 << 20))
1761                 gen_op_iwmmxt_avgb1_M0_wRn(rd1);
1762             else
1763                 gen_op_iwmmxt_avgb0_M0_wRn(rd1);
1764         }
1765         gen_op_iwmmxt_movq_wRn_M0(wrd);
1766         gen_op_iwmmxt_set_mup();
1767         gen_op_iwmmxt_set_cup();
1768         break;
1769     case 0x802: case 0x902: case 0xa02: case 0xb02:     /* WALIGNR */
1770         wrd = (insn >> 12) & 0xf;
1771         rd0 = (insn >> 16) & 0xf;
1772         rd1 = (insn >> 0) & 0xf;
1773         gen_op_iwmmxt_movq_M0_wRn(rd0);
1774         tmp = iwmmxt_load_creg(ARM_IWMMXT_wCGR0 + ((insn >> 20) & 3));
1775         tcg_gen_andi_i32(tmp, tmp, 7);
1776         iwmmxt_load_reg(cpu_V1, rd1);
1777         gen_helper_iwmmxt_align(cpu_M0, cpu_M0, cpu_V1, tmp);
1778         tcg_temp_free_i32(tmp);
1779         gen_op_iwmmxt_movq_wRn_M0(wrd);
1780         gen_op_iwmmxt_set_mup();
1781         break;
1782     case 0x601: case 0x605: case 0x609: case 0x60d:     /* TINSR */
1783         if (((insn >> 6) & 3) == 3)
1784             return 1;
1785         rd = (insn >> 12) & 0xf;
1786         wrd = (insn >> 16) & 0xf;
1787         tmp = load_reg(s, rd);
1788         gen_op_iwmmxt_movq_M0_wRn(wrd);
1789         switch ((insn >> 6) & 3) {
1790         case 0:
1791             tmp2 = tcg_const_i32(0xff);
1792             tmp3 = tcg_const_i32((insn & 7) << 3);
1793             break;
1794         case 1:
1795             tmp2 = tcg_const_i32(0xffff);
1796             tmp3 = tcg_const_i32((insn & 3) << 4);
1797             break;
1798         case 2:
1799             tmp2 = tcg_const_i32(0xffffffff);
1800             tmp3 = tcg_const_i32((insn & 1) << 5);
1801             break;
1802         default:
1803             TCGV_UNUSED_I32(tmp2);
1804             TCGV_UNUSED_I32(tmp3);
1805         }
1806         gen_helper_iwmmxt_insr(cpu_M0, cpu_M0, tmp, tmp2, tmp3);
1807         tcg_temp_free_i32(tmp3);
1808         tcg_temp_free_i32(tmp2);
1809         tcg_temp_free_i32(tmp);
1810         gen_op_iwmmxt_movq_wRn_M0(wrd);
1811         gen_op_iwmmxt_set_mup();
1812         break;
1813     case 0x107: case 0x507: case 0x907: case 0xd07:     /* TEXTRM */
1814         rd = (insn >> 12) & 0xf;
1815         wrd = (insn >> 16) & 0xf;
1816         if (rd == 15 || ((insn >> 22) & 3) == 3)
1817             return 1;
1818         gen_op_iwmmxt_movq_M0_wRn(wrd);
1819         tmp = tcg_temp_new_i32();
1820         switch ((insn >> 22) & 3) {
1821         case 0:
1822             tcg_gen_shri_i64(cpu_M0, cpu_M0, (insn & 7) << 3);
1823             tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1824             if (insn & 8) {
1825                 tcg_gen_ext8s_i32(tmp, tmp);
1826             } else {
1827                 tcg_gen_andi_i32(tmp, tmp, 0xff);
1828             }
1829             break;
1830         case 1:
1831             tcg_gen_shri_i64(cpu_M0, cpu_M0, (insn & 3) << 4);
1832             tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1833             if (insn & 8) {
1834                 tcg_gen_ext16s_i32(tmp, tmp);
1835             } else {
1836                 tcg_gen_andi_i32(tmp, tmp, 0xffff);
1837             }
1838             break;
1839         case 2:
1840             tcg_gen_shri_i64(cpu_M0, cpu_M0, (insn & 1) << 5);
1841             tcg_gen_trunc_i64_i32(tmp, cpu_M0);
1842             break;
1843         }
1844         store_reg(s, rd, tmp);
1845         break;
1846     case 0x117: case 0x517: case 0x917: case 0xd17:     /* TEXTRC */
1847         if ((insn & 0x000ff008) != 0x0003f000 || ((insn >> 22) & 3) == 3)
1848             return 1;
1849         tmp = iwmmxt_load_creg(ARM_IWMMXT_wCASF);
1850         switch ((insn >> 22) & 3) {
1851         case 0:
1852             tcg_gen_shri_i32(tmp, tmp, ((insn & 7) << 2) + 0);
1853             break;
1854         case 1:
1855             tcg_gen_shri_i32(tmp, tmp, ((insn & 3) << 3) + 4);
1856             break;
1857         case 2:
1858             tcg_gen_shri_i32(tmp, tmp, ((insn & 1) << 4) + 12);
1859             break;
1860         }
1861         tcg_gen_shli_i32(tmp, tmp, 28);
1862         gen_set_nzcv(tmp);
1863         tcg_temp_free_i32(tmp);
1864         break;
1865     case 0x401: case 0x405: case 0x409: case 0x40d:     /* TBCST */
1866         if (((insn >> 6) & 3) == 3)
1867             return 1;
1868         rd = (insn >> 12) & 0xf;
1869         wrd = (insn >> 16) & 0xf;
1870         tmp = load_reg(s, rd);
1871         switch ((insn >> 6) & 3) {
1872         case 0:
1873             gen_helper_iwmmxt_bcstb(cpu_M0, tmp);
1874             break;
1875         case 1:
1876             gen_helper_iwmmxt_bcstw(cpu_M0, tmp);
1877             break;
1878         case 2:
1879             gen_helper_iwmmxt_bcstl(cpu_M0, tmp);
1880             break;
1881         }
1882         tcg_temp_free_i32(tmp);
1883         gen_op_iwmmxt_movq_wRn_M0(wrd);
1884         gen_op_iwmmxt_set_mup();
1885         break;
1886     case 0x113: case 0x513: case 0x913: case 0xd13:     /* TANDC */
1887         if ((insn & 0x000ff00f) != 0x0003f000 || ((insn >> 22) & 3) == 3)
1888             return 1;
1889         tmp = iwmmxt_load_creg(ARM_IWMMXT_wCASF);
1890         tmp2 = tcg_temp_new_i32();
1891         tcg_gen_mov_i32(tmp2, tmp);
1892         switch ((insn >> 22) & 3) {
1893         case 0:
1894             for (i = 0; i < 7; i ++) {
1895                 tcg_gen_shli_i32(tmp2, tmp2, 4);
1896                 tcg_gen_and_i32(tmp, tmp, tmp2);
1897             }
1898             break;
1899         case 1:
1900             for (i = 0; i < 3; i ++) {
1901                 tcg_gen_shli_i32(tmp2, tmp2, 8);
1902                 tcg_gen_and_i32(tmp, tmp, tmp2);
1903             }
1904             break;
1905         case 2:
1906             tcg_gen_shli_i32(tmp2, tmp2, 16);
1907             tcg_gen_and_i32(tmp, tmp, tmp2);
1908             break;
1909         }
1910         gen_set_nzcv(tmp);
1911         tcg_temp_free_i32(tmp2);
1912         tcg_temp_free_i32(tmp);
1913         break;
1914     case 0x01c: case 0x41c: case 0x81c: case 0xc1c:     /* WACC */
1915         wrd = (insn >> 12) & 0xf;
1916         rd0 = (insn >> 16) & 0xf;
1917         gen_op_iwmmxt_movq_M0_wRn(rd0);
1918         switch ((insn >> 22) & 3) {
1919         case 0:
1920             gen_helper_iwmmxt_addcb(cpu_M0, cpu_M0);
1921             break;
1922         case 1:
1923             gen_helper_iwmmxt_addcw(cpu_M0, cpu_M0);
1924             break;
1925         case 2:
1926             gen_helper_iwmmxt_addcl(cpu_M0, cpu_M0);
1927             break;
1928         case 3:
1929             return 1;
1930         }
1931         gen_op_iwmmxt_movq_wRn_M0(wrd);
1932         gen_op_iwmmxt_set_mup();
1933         break;
1934     case 0x115: case 0x515: case 0x915: case 0xd15:     /* TORC */
1935         if ((insn & 0x000ff00f) != 0x0003f000 || ((insn >> 22) & 3) == 3)
1936             return 1;
1937         tmp = iwmmxt_load_creg(ARM_IWMMXT_wCASF);
1938         tmp2 = tcg_temp_new_i32();
1939         tcg_gen_mov_i32(tmp2, tmp);
1940         switch ((insn >> 22) & 3) {
1941         case 0:
1942             for (i = 0; i < 7; i ++) {
1943                 tcg_gen_shli_i32(tmp2, tmp2, 4);
1944                 tcg_gen_or_i32(tmp, tmp, tmp2);
1945             }
1946             break;
1947         case 1:
1948             for (i = 0; i < 3; i ++) {
1949                 tcg_gen_shli_i32(tmp2, tmp2, 8);
1950                 tcg_gen_or_i32(tmp, tmp, tmp2);
1951             }
1952             break;
1953         case 2:
1954             tcg_gen_shli_i32(tmp2, tmp2, 16);
1955             tcg_gen_or_i32(tmp, tmp, tmp2);
1956             break;
1957         }
1958         gen_set_nzcv(tmp);
1959         tcg_temp_free_i32(tmp2);
1960         tcg_temp_free_i32(tmp);
1961         break;
1962     case 0x103: case 0x503: case 0x903: case 0xd03:     /* TMOVMSK */
1963         rd = (insn >> 12) & 0xf;
1964         rd0 = (insn >> 16) & 0xf;
1965         if ((insn & 0xf) != 0 || ((insn >> 22) & 3) == 3)
1966             return 1;
1967         gen_op_iwmmxt_movq_M0_wRn(rd0);
1968         tmp = tcg_temp_new_i32();
1969         switch ((insn >> 22) & 3) {
1970         case 0:
1971             gen_helper_iwmmxt_msbb(tmp, cpu_M0);
1972             break;
1973         case 1:
1974             gen_helper_iwmmxt_msbw(tmp, cpu_M0);
1975             break;
1976         case 2:
1977             gen_helper_iwmmxt_msbl(tmp, cpu_M0);
1978             break;
1979         }
1980         store_reg(s, rd, tmp);
1981         break;
1982     case 0x106: case 0x306: case 0x506: case 0x706:     /* WCMPGT */
1983     case 0x906: case 0xb06: case 0xd06: case 0xf06:
1984         wrd = (insn >> 12) & 0xf;
1985         rd0 = (insn >> 16) & 0xf;
1986         rd1 = (insn >> 0) & 0xf;
1987         gen_op_iwmmxt_movq_M0_wRn(rd0);
1988         switch ((insn >> 22) & 3) {
1989         case 0:
1990             if (insn & (1 << 21))
1991                 gen_op_iwmmxt_cmpgtsb_M0_wRn(rd1);
1992             else
1993                 gen_op_iwmmxt_cmpgtub_M0_wRn(rd1);
1994             break;
1995         case 1:
1996             if (insn & (1 << 21))
1997                 gen_op_iwmmxt_cmpgtsw_M0_wRn(rd1);
1998             else
1999                 gen_op_iwmmxt_cmpgtuw_M0_wRn(rd1);
2000             break;
2001         case 2:
2002             if (insn & (1 << 21))
2003                 gen_op_iwmmxt_cmpgtsl_M0_wRn(rd1);
2004             else
2005                 gen_op_iwmmxt_cmpgtul_M0_wRn(rd1);
2006             break;
2007         case 3:
2008             return 1;
2009         }
2010         gen_op_iwmmxt_movq_wRn_M0(wrd);
2011         gen_op_iwmmxt_set_mup();
2012         gen_op_iwmmxt_set_cup();
2013         break;
2014     case 0x00e: case 0x20e: case 0x40e: case 0x60e:     /* WUNPCKEL */
2015     case 0x80e: case 0xa0e: case 0xc0e: case 0xe0e:
2016         wrd = (insn >> 12) & 0xf;
2017         rd0 = (insn >> 16) & 0xf;
2018         gen_op_iwmmxt_movq_M0_wRn(rd0);
2019         switch ((insn >> 22) & 3) {
2020         case 0:
2021             if (insn & (1 << 21))
2022                 gen_op_iwmmxt_unpacklsb_M0();
2023             else
2024                 gen_op_iwmmxt_unpacklub_M0();
2025             break;
2026         case 1:
2027             if (insn & (1 << 21))
2028                 gen_op_iwmmxt_unpacklsw_M0();
2029             else
2030                 gen_op_iwmmxt_unpackluw_M0();
2031             break;
2032         case 2:
2033             if (insn & (1 << 21))
2034                 gen_op_iwmmxt_unpacklsl_M0();
2035             else
2036                 gen_op_iwmmxt_unpacklul_M0();
2037             break;
2038         case 3:
2039             return 1;
2040         }
2041         gen_op_iwmmxt_movq_wRn_M0(wrd);
2042         gen_op_iwmmxt_set_mup();
2043         gen_op_iwmmxt_set_cup();
2044         break;
2045     case 0x00c: case 0x20c: case 0x40c: case 0x60c:     /* WUNPCKEH */
2046     case 0x80c: case 0xa0c: case 0xc0c: case 0xe0c:
2047         wrd = (insn >> 12) & 0xf;
2048         rd0 = (insn >> 16) & 0xf;
2049         gen_op_iwmmxt_movq_M0_wRn(rd0);
2050         switch ((insn >> 22) & 3) {
2051         case 0:
2052             if (insn & (1 << 21))
2053                 gen_op_iwmmxt_unpackhsb_M0();
2054             else
2055                 gen_op_iwmmxt_unpackhub_M0();
2056             break;
2057         case 1:
2058             if (insn & (1 << 21))
2059                 gen_op_iwmmxt_unpackhsw_M0();
2060             else
2061                 gen_op_iwmmxt_unpackhuw_M0();
2062             break;
2063         case 2:
2064             if (insn & (1 << 21))
2065                 gen_op_iwmmxt_unpackhsl_M0();
2066             else
2067                 gen_op_iwmmxt_unpackhul_M0();
2068             break;
2069         case 3:
2070             return 1;
2071         }
2072         gen_op_iwmmxt_movq_wRn_M0(wrd);
2073         gen_op_iwmmxt_set_mup();
2074         gen_op_iwmmxt_set_cup();
2075         break;
2076     case 0x204: case 0x604: case 0xa04: case 0xe04:     /* WSRL */
2077     case 0x214: case 0x614: case 0xa14: case 0xe14:
2078         if (((insn >> 22) & 3) == 0)
2079             return 1;
2080         wrd = (insn >> 12) & 0xf;
2081         rd0 = (insn >> 16) & 0xf;
2082         gen_op_iwmmxt_movq_M0_wRn(rd0);
2083         tmp = tcg_temp_new_i32();
2084         if (gen_iwmmxt_shift(insn, 0xff, tmp)) {
2085             tcg_temp_free_i32(tmp);
2086             return 1;
2087         }
2088         switch ((insn >> 22) & 3) {
2089         case 1:
2090             gen_helper_iwmmxt_srlw(cpu_M0, cpu_env, cpu_M0, tmp);
2091             break;
2092         case 2:
2093             gen_helper_iwmmxt_srll(cpu_M0, cpu_env, cpu_M0, tmp);
2094             break;
2095         case 3:
2096             gen_helper_iwmmxt_srlq(cpu_M0, cpu_env, cpu_M0, tmp);
2097             break;
2098         }
2099         tcg_temp_free_i32(tmp);
2100         gen_op_iwmmxt_movq_wRn_M0(wrd);
2101         gen_op_iwmmxt_set_mup();
2102         gen_op_iwmmxt_set_cup();
2103         break;
2104     case 0x004: case 0x404: case 0x804: case 0xc04:     /* WSRA */
2105     case 0x014: case 0x414: case 0x814: case 0xc14:
2106         if (((insn >> 22) & 3) == 0)
2107             return 1;
2108         wrd = (insn >> 12) & 0xf;
2109         rd0 = (insn >> 16) & 0xf;
2110         gen_op_iwmmxt_movq_M0_wRn(rd0);
2111         tmp = tcg_temp_new_i32();
2112         if (gen_iwmmxt_shift(insn, 0xff, tmp)) {
2113             tcg_temp_free_i32(tmp);
2114             return 1;
2115         }
2116         switch ((insn >> 22) & 3) {
2117         case 1:
2118             gen_helper_iwmmxt_sraw(cpu_M0, cpu_env, cpu_M0, tmp);
2119             break;
2120         case 2:
2121             gen_helper_iwmmxt_sral(cpu_M0, cpu_env, cpu_M0, tmp);
2122             break;
2123         case 3:
2124             gen_helper_iwmmxt_sraq(cpu_M0, cpu_env, cpu_M0, tmp);
2125             break;
2126         }
2127         tcg_temp_free_i32(tmp);
2128         gen_op_iwmmxt_movq_wRn_M0(wrd);
2129         gen_op_iwmmxt_set_mup();
2130         gen_op_iwmmxt_set_cup();
2131         break;
2132     case 0x104: case 0x504: case 0x904: case 0xd04:     /* WSLL */
2133     case 0x114: case 0x514: case 0x914: case 0xd14:
2134         if (((insn >> 22) & 3) == 0)
2135             return 1;
2136         wrd = (insn >> 12) & 0xf;
2137         rd0 = (insn >> 16) & 0xf;
2138         gen_op_iwmmxt_movq_M0_wRn(rd0);
2139         tmp = tcg_temp_new_i32();
2140         if (gen_iwmmxt_shift(insn, 0xff, tmp)) {
2141             tcg_temp_free_i32(tmp);
2142             return 1;
2143         }
2144         switch ((insn >> 22) & 3) {
2145         case 1:
2146             gen_helper_iwmmxt_sllw(cpu_M0, cpu_env, cpu_M0, tmp);
2147             break;
2148         case 2:
2149             gen_helper_iwmmxt_slll(cpu_M0, cpu_env, cpu_M0, tmp);
2150             break;
2151         case 3:
2152             gen_helper_iwmmxt_sllq(cpu_M0, cpu_env, cpu_M0, tmp);
2153             break;
2154         }
2155         tcg_temp_free_i32(tmp);
2156         gen_op_iwmmxt_movq_wRn_M0(wrd);
2157         gen_op_iwmmxt_set_mup();
2158         gen_op_iwmmxt_set_cup();
2159         break;
2160     case 0x304: case 0x704: case 0xb04: case 0xf04:     /* WROR */
2161     case 0x314: case 0x714: case 0xb14: case 0xf14:
2162         if (((insn >> 22) & 3) == 0)
2163             return 1;
2164         wrd = (insn >> 12) & 0xf;
2165         rd0 = (insn >> 16) & 0xf;
2166         gen_op_iwmmxt_movq_M0_wRn(rd0);
2167         tmp = tcg_temp_new_i32();
2168         switch ((insn >> 22) & 3) {
2169         case 1:
2170             if (gen_iwmmxt_shift(insn, 0xf, tmp)) {
2171                 tcg_temp_free_i32(tmp);
2172                 return 1;
2173             }
2174             gen_helper_iwmmxt_rorw(cpu_M0, cpu_env, cpu_M0, tmp);
2175             break;
2176         case 2:
2177             if (gen_iwmmxt_shift(insn, 0x1f, tmp)) {
2178                 tcg_temp_free_i32(tmp);
2179                 return 1;
2180             }
2181             gen_helper_iwmmxt_rorl(cpu_M0, cpu_env, cpu_M0, tmp);
2182             break;
2183         case 3:
2184             if (gen_iwmmxt_shift(insn, 0x3f, tmp)) {
2185                 tcg_temp_free_i32(tmp);
2186                 return 1;
2187             }
2188             gen_helper_iwmmxt_rorq(cpu_M0, cpu_env, cpu_M0, tmp);
2189             break;
2190         }
2191         tcg_temp_free_i32(tmp);
2192         gen_op_iwmmxt_movq_wRn_M0(wrd);
2193         gen_op_iwmmxt_set_mup();
2194         gen_op_iwmmxt_set_cup();
2195         break;
2196     case 0x116: case 0x316: case 0x516: case 0x716:     /* WMIN */
2197     case 0x916: case 0xb16: case 0xd16: case 0xf16:
2198         wrd = (insn >> 12) & 0xf;
2199         rd0 = (insn >> 16) & 0xf;
2200         rd1 = (insn >> 0) & 0xf;
2201         gen_op_iwmmxt_movq_M0_wRn(rd0);
2202         switch ((insn >> 22) & 3) {
2203         case 0:
2204             if (insn & (1 << 21))
2205                 gen_op_iwmmxt_minsb_M0_wRn(rd1);
2206             else
2207                 gen_op_iwmmxt_minub_M0_wRn(rd1);
2208             break;
2209         case 1:
2210             if (insn & (1 << 21))
2211                 gen_op_iwmmxt_minsw_M0_wRn(rd1);
2212             else
2213                 gen_op_iwmmxt_minuw_M0_wRn(rd1);
2214             break;
2215         case 2:
2216             if (insn & (1 << 21))
2217                 gen_op_iwmmxt_minsl_M0_wRn(rd1);
2218             else
2219                 gen_op_iwmmxt_minul_M0_wRn(rd1);
2220             break;
2221         case 3:
2222             return 1;
2223         }
2224         gen_op_iwmmxt_movq_wRn_M0(wrd);
2225         gen_op_iwmmxt_set_mup();
2226         break;
2227     case 0x016: case 0x216: case 0x416: case 0x616:     /* WMAX */
2228     case 0x816: case 0xa16: case 0xc16: case 0xe16:
2229         wrd = (insn >> 12) & 0xf;
2230         rd0 = (insn >> 16) & 0xf;
2231         rd1 = (insn >> 0) & 0xf;
2232         gen_op_iwmmxt_movq_M0_wRn(rd0);
2233         switch ((insn >> 22) & 3) {
2234         case 0:
2235             if (insn & (1 << 21))
2236                 gen_op_iwmmxt_maxsb_M0_wRn(rd1);
2237             else
2238                 gen_op_iwmmxt_maxub_M0_wRn(rd1);
2239             break;
2240         case 1:
2241             if (insn & (1 << 21))
2242                 gen_op_iwmmxt_maxsw_M0_wRn(rd1);
2243             else
2244                 gen_op_iwmmxt_maxuw_M0_wRn(rd1);
2245             break;
2246         case 2:
2247             if (insn & (1 << 21))
2248                 gen_op_iwmmxt_maxsl_M0_wRn(rd1);
2249             else
2250                 gen_op_iwmmxt_maxul_M0_wRn(rd1);
2251             break;
2252         case 3:
2253             return 1;
2254         }
2255         gen_op_iwmmxt_movq_wRn_M0(wrd);
2256         gen_op_iwmmxt_set_mup();
2257         break;
2258     case 0x002: case 0x102: case 0x202: case 0x302:     /* WALIGNI */
2259     case 0x402: case 0x502: case 0x602: case 0x702:
2260         wrd = (insn >> 12) & 0xf;
2261         rd0 = (insn >> 16) & 0xf;
2262         rd1 = (insn >> 0) & 0xf;
2263         gen_op_iwmmxt_movq_M0_wRn(rd0);
2264         tmp = tcg_const_i32((insn >> 20) & 3);
2265         iwmmxt_load_reg(cpu_V1, rd1);
2266         gen_helper_iwmmxt_align(cpu_M0, cpu_M0, cpu_V1, tmp);
2267         tcg_temp_free_i32(tmp);
2268         gen_op_iwmmxt_movq_wRn_M0(wrd);
2269         gen_op_iwmmxt_set_mup();
2270         break;
2271     case 0x01a: case 0x11a: case 0x21a: case 0x31a:     /* WSUB */
2272     case 0x41a: case 0x51a: case 0x61a: case 0x71a:
2273     case 0x81a: case 0x91a: case 0xa1a: case 0xb1a:
2274     case 0xc1a: case 0xd1a: case 0xe1a: case 0xf1a:
2275         wrd = (insn >> 12) & 0xf;
2276         rd0 = (insn >> 16) & 0xf;
2277         rd1 = (insn >> 0) & 0xf;
2278         gen_op_iwmmxt_movq_M0_wRn(rd0);
2279         switch ((insn >> 20) & 0xf) {
2280         case 0x0:
2281             gen_op_iwmmxt_subnb_M0_wRn(rd1);
2282             break;
2283         case 0x1:
2284             gen_op_iwmmxt_subub_M0_wRn(rd1);
2285             break;
2286         case 0x3:
2287             gen_op_iwmmxt_subsb_M0_wRn(rd1);
2288             break;
2289         case 0x4:
2290             gen_op_iwmmxt_subnw_M0_wRn(rd1);
2291             break;
2292         case 0x5:
2293             gen_op_iwmmxt_subuw_M0_wRn(rd1);
2294             break;
2295         case 0x7:
2296             gen_op_iwmmxt_subsw_M0_wRn(rd1);
2297             break;
2298         case 0x8:
2299             gen_op_iwmmxt_subnl_M0_wRn(rd1);
2300             break;
2301         case 0x9:
2302             gen_op_iwmmxt_subul_M0_wRn(rd1);
2303             break;
2304         case 0xb:
2305             gen_op_iwmmxt_subsl_M0_wRn(rd1);
2306             break;
2307         default:
2308             return 1;
2309         }
2310         gen_op_iwmmxt_movq_wRn_M0(wrd);
2311         gen_op_iwmmxt_set_mup();
2312         gen_op_iwmmxt_set_cup();
2313         break;
2314     case 0x01e: case 0x11e: case 0x21e: case 0x31e:     /* WSHUFH */
2315     case 0x41e: case 0x51e: case 0x61e: case 0x71e:
2316     case 0x81e: case 0x91e: case 0xa1e: case 0xb1e:
2317     case 0xc1e: case 0xd1e: case 0xe1e: case 0xf1e:
2318         wrd = (insn >> 12) & 0xf;
2319         rd0 = (insn >> 16) & 0xf;
2320         gen_op_iwmmxt_movq_M0_wRn(rd0);
2321         tmp = tcg_const_i32(((insn >> 16) & 0xf0) | (insn & 0x0f));
2322         gen_helper_iwmmxt_shufh(cpu_M0, cpu_env, cpu_M0, tmp);
2323         tcg_temp_free_i32(tmp);
2324         gen_op_iwmmxt_movq_wRn_M0(wrd);
2325         gen_op_iwmmxt_set_mup();
2326         gen_op_iwmmxt_set_cup();
2327         break;
2328     case 0x018: case 0x118: case 0x218: case 0x318:     /* WADD */
2329     case 0x418: case 0x518: case 0x618: case 0x718:
2330     case 0x818: case 0x918: case 0xa18: case 0xb18:
2331     case 0xc18: case 0xd18: case 0xe18: case 0xf18:
2332         wrd = (insn >> 12) & 0xf;
2333         rd0 = (insn >> 16) & 0xf;
2334         rd1 = (insn >> 0) & 0xf;
2335         gen_op_iwmmxt_movq_M0_wRn(rd0);
2336         switch ((insn >> 20) & 0xf) {
2337         case 0x0:
2338             gen_op_iwmmxt_addnb_M0_wRn(rd1);
2339             break;
2340         case 0x1:
2341             gen_op_iwmmxt_addub_M0_wRn(rd1);
2342             break;
2343         case 0x3:
2344             gen_op_iwmmxt_addsb_M0_wRn(rd1);
2345             break;
2346         case 0x4:
2347             gen_op_iwmmxt_addnw_M0_wRn(rd1);
2348             break;
2349         case 0x5:
2350             gen_op_iwmmxt_adduw_M0_wRn(rd1);
2351             break;
2352         case 0x7:
2353             gen_op_iwmmxt_addsw_M0_wRn(rd1);
2354             break;
2355         case 0x8:
2356             gen_op_iwmmxt_addnl_M0_wRn(rd1);
2357             break;
2358         case 0x9:
2359             gen_op_iwmmxt_addul_M0_wRn(rd1);
2360             break;
2361         case 0xb:
2362             gen_op_iwmmxt_addsl_M0_wRn(rd1);
2363             break;
2364         default:
2365             return 1;
2366         }
2367         gen_op_iwmmxt_movq_wRn_M0(wrd);
2368         gen_op_iwmmxt_set_mup();
2369         gen_op_iwmmxt_set_cup();
2370         break;
2371     case 0x008: case 0x108: case 0x208: case 0x308:     /* WPACK */
2372     case 0x408: case 0x508: case 0x608: case 0x708:
2373     case 0x808: case 0x908: case 0xa08: case 0xb08:
2374     case 0xc08: case 0xd08: case 0xe08: case 0xf08:
2375         if (!(insn & (1 << 20)) || ((insn >> 22) & 3) == 0)
2376             return 1;
2377         wrd = (insn >> 12) & 0xf;
2378         rd0 = (insn >> 16) & 0xf;
2379         rd1 = (insn >> 0) & 0xf;
2380         gen_op_iwmmxt_movq_M0_wRn(rd0);
2381         switch ((insn >> 22) & 3) {
2382         case 1:
2383             if (insn & (1 << 21))
2384                 gen_op_iwmmxt_packsw_M0_wRn(rd1);
2385             else
2386                 gen_op_iwmmxt_packuw_M0_wRn(rd1);
2387             break;
2388         case 2:
2389             if (insn & (1 << 21))
2390                 gen_op_iwmmxt_packsl_M0_wRn(rd1);
2391             else
2392                 gen_op_iwmmxt_packul_M0_wRn(rd1);
2393             break;
2394         case 3:
2395             if (insn & (1 << 21))
2396                 gen_op_iwmmxt_packsq_M0_wRn(rd1);
2397             else
2398                 gen_op_iwmmxt_packuq_M0_wRn(rd1);
2399             break;
2400         }
2401         gen_op_iwmmxt_movq_wRn_M0(wrd);
2402         gen_op_iwmmxt_set_mup();
2403         gen_op_iwmmxt_set_cup();
2404         break;
2405     case 0x201: case 0x203: case 0x205: case 0x207:
2406     case 0x209: case 0x20b: case 0x20d: case 0x20f:
2407     case 0x211: case 0x213: case 0x215: case 0x217:
2408     case 0x219: case 0x21b: case 0x21d: case 0x21f:
2409         wrd = (insn >> 5) & 0xf;
2410         rd0 = (insn >> 12) & 0xf;
2411         rd1 = (insn >> 0) & 0xf;
2412         if (rd0 == 0xf || rd1 == 0xf)
2413             return 1;
2414         gen_op_iwmmxt_movq_M0_wRn(wrd);
2415         tmp = load_reg(s, rd0);
2416         tmp2 = load_reg(s, rd1);
2417         switch ((insn >> 16) & 0xf) {
2418         case 0x0:                                       /* TMIA */
2419             gen_helper_iwmmxt_muladdsl(cpu_M0, cpu_M0, tmp, tmp2);
2420             break;
2421         case 0x8:                                       /* TMIAPH */
2422             gen_helper_iwmmxt_muladdsw(cpu_M0, cpu_M0, tmp, tmp2);
2423             break;
2424         case 0xc: case 0xd: case 0xe: case 0xf:         /* TMIAxy */
2425             if (insn & (1 << 16))
2426                 tcg_gen_shri_i32(tmp, tmp, 16);
2427             if (insn & (1 << 17))
2428                 tcg_gen_shri_i32(tmp2, tmp2, 16);
2429             gen_helper_iwmmxt_muladdswl(cpu_M0, cpu_M0, tmp, tmp2);
2430             break;
2431         default:
2432             tcg_temp_free_i32(tmp2);
2433             tcg_temp_free_i32(tmp);
2434             return 1;
2435         }
2436         tcg_temp_free_i32(tmp2);
2437         tcg_temp_free_i32(tmp);
2438         gen_op_iwmmxt_movq_wRn_M0(wrd);
2439         gen_op_iwmmxt_set_mup();
2440         break;
2441     default:
2442         return 1;
2443     }
2444
2445     return 0;
2446 }
2447
2448 /* Disassemble an XScale DSP instruction.  Returns nonzero if an error occurred
2449    (ie. an undefined instruction).  */
2450 static int disas_dsp_insn(CPUARMState *env, DisasContext *s, uint32_t insn)
2451 {
2452     int acc, rd0, rd1, rdhi, rdlo;
2453     TCGv_i32 tmp, tmp2;
2454
2455     if ((insn & 0x0ff00f10) == 0x0e200010) {
2456         /* Multiply with Internal Accumulate Format */
2457         rd0 = (insn >> 12) & 0xf;
2458         rd1 = insn & 0xf;
2459         acc = (insn >> 5) & 7;
2460
2461         if (acc != 0)
2462             return 1;
2463
2464         tmp = load_reg(s, rd0);
2465         tmp2 = load_reg(s, rd1);
2466         switch ((insn >> 16) & 0xf) {
2467         case 0x0:                                       /* MIA */
2468             gen_helper_iwmmxt_muladdsl(cpu_M0, cpu_M0, tmp, tmp2);
2469             break;
2470         case 0x8:                                       /* MIAPH */
2471             gen_helper_iwmmxt_muladdsw(cpu_M0, cpu_M0, tmp, tmp2);
2472             break;
2473         case 0xc:                                       /* MIABB */
2474         case 0xd:                                       /* MIABT */
2475         case 0xe:                                       /* MIATB */
2476         case 0xf:                                       /* MIATT */
2477             if (insn & (1 << 16))
2478                 tcg_gen_shri_i32(tmp, tmp, 16);
2479             if (insn & (1 << 17))
2480                 tcg_gen_shri_i32(tmp2, tmp2, 16);
2481             gen_helper_iwmmxt_muladdswl(cpu_M0, cpu_M0, tmp, tmp2);
2482             break;
2483         default:
2484             return 1;
2485         }
2486         tcg_temp_free_i32(tmp2);
2487         tcg_temp_free_i32(tmp);
2488
2489         gen_op_iwmmxt_movq_wRn_M0(acc);
2490         return 0;
2491     }
2492
2493     if ((insn & 0x0fe00ff8) == 0x0c400000) {
2494         /* Internal Accumulator Access Format */
2495         rdhi = (insn >> 16) & 0xf;
2496         rdlo = (insn >> 12) & 0xf;
2497         acc = insn & 7;
2498
2499         if (acc != 0)
2500             return 1;
2501
2502         if (insn & ARM_CP_RW_BIT) {                     /* MRA */
2503             iwmmxt_load_reg(cpu_V0, acc);
2504             tcg_gen_trunc_i64_i32(cpu_R[rdlo], cpu_V0);
2505             tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
2506             tcg_gen_trunc_i64_i32(cpu_R[rdhi], cpu_V0);
2507             tcg_gen_andi_i32(cpu_R[rdhi], cpu_R[rdhi], (1 << (40 - 32)) - 1);
2508         } else {                                        /* MAR */
2509             tcg_gen_concat_i32_i64(cpu_V0, cpu_R[rdlo], cpu_R[rdhi]);
2510             iwmmxt_store_reg(cpu_V0, acc);
2511         }
2512         return 0;
2513     }
2514
2515     return 1;
2516 }
2517
2518 #define VFP_REG_SHR(x, n) (((n) > 0) ? (x) >> (n) : (x) << -(n))
2519 #define VFP_SREG(insn, bigbit, smallbit) \
2520   ((VFP_REG_SHR(insn, bigbit - 1) & 0x1e) | (((insn) >> (smallbit)) & 1))
2521 #define VFP_DREG(reg, insn, bigbit, smallbit) do { \
2522     if (arm_feature(env, ARM_FEATURE_VFP3)) { \
2523         reg = (((insn) >> (bigbit)) & 0x0f) \
2524               | (((insn) >> ((smallbit) - 4)) & 0x10); \
2525     } else { \
2526         if (insn & (1 << (smallbit))) \
2527             return 1; \
2528         reg = ((insn) >> (bigbit)) & 0x0f; \
2529     }} while (0)
2530
2531 #define VFP_SREG_D(insn) VFP_SREG(insn, 12, 22)
2532 #define VFP_DREG_D(reg, insn) VFP_DREG(reg, insn, 12, 22)
2533 #define VFP_SREG_N(insn) VFP_SREG(insn, 16,  7)
2534 #define VFP_DREG_N(reg, insn) VFP_DREG(reg, insn, 16,  7)
2535 #define VFP_SREG_M(insn) VFP_SREG(insn,  0,  5)
2536 #define VFP_DREG_M(reg, insn) VFP_DREG(reg, insn,  0,  5)
2537
2538 /* Move between integer and VFP cores.  */
2539 static TCGv_i32 gen_vfp_mrs(void)
2540 {
2541     TCGv_i32 tmp = tcg_temp_new_i32();
2542     tcg_gen_mov_i32(tmp, cpu_F0s);
2543     return tmp;
2544 }
2545
2546 static void gen_vfp_msr(TCGv_i32 tmp)
2547 {
2548     tcg_gen_mov_i32(cpu_F0s, tmp);
2549     tcg_temp_free_i32(tmp);
2550 }
2551
2552 static void gen_neon_dup_u8(TCGv_i32 var, int shift)
2553 {
2554     TCGv_i32 tmp = tcg_temp_new_i32();
2555     if (shift)
2556         tcg_gen_shri_i32(var, var, shift);
2557     tcg_gen_ext8u_i32(var, var);
2558     tcg_gen_shli_i32(tmp, var, 8);
2559     tcg_gen_or_i32(var, var, tmp);
2560     tcg_gen_shli_i32(tmp, var, 16);
2561     tcg_gen_or_i32(var, var, tmp);
2562     tcg_temp_free_i32(tmp);
2563 }
2564
2565 static void gen_neon_dup_low16(TCGv_i32 var)
2566 {
2567     TCGv_i32 tmp = tcg_temp_new_i32();
2568     tcg_gen_ext16u_i32(var, var);
2569     tcg_gen_shli_i32(tmp, var, 16);
2570     tcg_gen_or_i32(var, var, tmp);
2571     tcg_temp_free_i32(tmp);
2572 }
2573
2574 static void gen_neon_dup_high16(TCGv_i32 var)
2575 {
2576     TCGv_i32 tmp = tcg_temp_new_i32();
2577     tcg_gen_andi_i32(var, var, 0xffff0000);
2578     tcg_gen_shri_i32(tmp, var, 16);
2579     tcg_gen_or_i32(var, var, tmp);
2580     tcg_temp_free_i32(tmp);
2581 }
2582
2583 static TCGv_i32 gen_load_and_replicate(DisasContext *s, TCGv_i32 addr, int size)
2584 {
2585     /* Load a single Neon element and replicate into a 32 bit TCG reg */
2586     TCGv_i32 tmp = tcg_temp_new_i32();
2587     switch (size) {
2588     case 0:
2589         gen_aa32_ld8u(tmp, addr, IS_USER(s));
2590         gen_neon_dup_u8(tmp, 0);
2591         break;
2592     case 1:
2593         gen_aa32_ld16u(tmp, addr, IS_USER(s));
2594         gen_neon_dup_low16(tmp);
2595         break;
2596     case 2:
2597         gen_aa32_ld32u(tmp, addr, IS_USER(s));
2598         break;
2599     default: /* Avoid compiler warnings.  */
2600         abort();
2601     }
2602     return tmp;
2603 }
2604
2605 static int handle_vsel(uint32_t insn, uint32_t rd, uint32_t rn, uint32_t rm,
2606                        uint32_t dp)
2607 {
2608     uint32_t cc = extract32(insn, 20, 2);
2609
2610     if (dp) {
2611         TCGv_i64 frn, frm, dest;
2612         TCGv_i64 tmp, zero, zf, nf, vf;
2613
2614         zero = tcg_const_i64(0);
2615
2616         frn = tcg_temp_new_i64();
2617         frm = tcg_temp_new_i64();
2618         dest = tcg_temp_new_i64();
2619
2620         zf = tcg_temp_new_i64();
2621         nf = tcg_temp_new_i64();
2622         vf = tcg_temp_new_i64();
2623
2624         tcg_gen_extu_i32_i64(zf, cpu_ZF);
2625         tcg_gen_ext_i32_i64(nf, cpu_NF);
2626         tcg_gen_ext_i32_i64(vf, cpu_VF);
2627
2628         tcg_gen_ld_f64(frn, cpu_env, vfp_reg_offset(dp, rn));
2629         tcg_gen_ld_f64(frm, cpu_env, vfp_reg_offset(dp, rm));
2630         switch (cc) {
2631         case 0: /* eq: Z */
2632             tcg_gen_movcond_i64(TCG_COND_EQ, dest, zf, zero,
2633                                 frn, frm);
2634             break;
2635         case 1: /* vs: V */
2636             tcg_gen_movcond_i64(TCG_COND_LT, dest, vf, zero,
2637                                 frn, frm);
2638             break;
2639         case 2: /* ge: N == V -> N ^ V == 0 */
2640             tmp = tcg_temp_new_i64();
2641             tcg_gen_xor_i64(tmp, vf, nf);
2642             tcg_gen_movcond_i64(TCG_COND_GE, dest, tmp, zero,
2643                                 frn, frm);
2644             tcg_temp_free_i64(tmp);
2645             break;
2646         case 3: /* gt: !Z && N == V */
2647             tcg_gen_movcond_i64(TCG_COND_NE, dest, zf, zero,
2648                                 frn, frm);
2649             tmp = tcg_temp_new_i64();
2650             tcg_gen_xor_i64(tmp, vf, nf);
2651             tcg_gen_movcond_i64(TCG_COND_GE, dest, tmp, zero,
2652                                 dest, frm);
2653             tcg_temp_free_i64(tmp);
2654             break;
2655         }
2656         tcg_gen_st_f64(dest, cpu_env, vfp_reg_offset(dp, rd));
2657         tcg_temp_free_i64(frn);
2658         tcg_temp_free_i64(frm);
2659         tcg_temp_free_i64(dest);
2660
2661         tcg_temp_free_i64(zf);
2662         tcg_temp_free_i64(nf);
2663         tcg_temp_free_i64(vf);
2664
2665         tcg_temp_free_i64(zero);
2666     } else {
2667         TCGv_i32 frn, frm, dest;
2668         TCGv_i32 tmp, zero;
2669
2670         zero = tcg_const_i32(0);
2671
2672         frn = tcg_temp_new_i32();
2673         frm = tcg_temp_new_i32();
2674         dest = tcg_temp_new_i32();
2675         tcg_gen_ld_f32(frn, cpu_env, vfp_reg_offset(dp, rn));
2676         tcg_gen_ld_f32(frm, cpu_env, vfp_reg_offset(dp, rm));
2677         switch (cc) {
2678         case 0: /* eq: Z */
2679             tcg_gen_movcond_i32(TCG_COND_EQ, dest, cpu_ZF, zero,
2680                                 frn, frm);
2681             break;
2682         case 1: /* vs: V */
2683             tcg_gen_movcond_i32(TCG_COND_LT, dest, cpu_VF, zero,
2684                                 frn, frm);
2685             break;
2686         case 2: /* ge: N == V -> N ^ V == 0 */
2687             tmp = tcg_temp_new_i32();
2688             tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
2689             tcg_gen_movcond_i32(TCG_COND_GE, dest, tmp, zero,
2690                                 frn, frm);
2691             tcg_temp_free_i32(tmp);
2692             break;
2693         case 3: /* gt: !Z && N == V */
2694             tcg_gen_movcond_i32(TCG_COND_NE, dest, cpu_ZF, zero,
2695                                 frn, frm);
2696             tmp = tcg_temp_new_i32();
2697             tcg_gen_xor_i32(tmp, cpu_VF, cpu_NF);
2698             tcg_gen_movcond_i32(TCG_COND_GE, dest, tmp, zero,
2699                                 dest, frm);
2700             tcg_temp_free_i32(tmp);
2701             break;
2702         }
2703         tcg_gen_st_f32(dest, cpu_env, vfp_reg_offset(dp, rd));
2704         tcg_temp_free_i32(frn);
2705         tcg_temp_free_i32(frm);
2706         tcg_temp_free_i32(dest);
2707
2708         tcg_temp_free_i32(zero);
2709     }
2710
2711     return 0;
2712 }
2713
2714 static int handle_vminmaxnm(uint32_t insn, uint32_t rd, uint32_t rn,
2715                             uint32_t rm, uint32_t dp)
2716 {
2717     uint32_t vmin = extract32(insn, 6, 1);
2718     TCGv_ptr fpst = get_fpstatus_ptr(0);
2719
2720     if (dp) {
2721         TCGv_i64 frn, frm, dest;
2722
2723         frn = tcg_temp_new_i64();
2724         frm = tcg_temp_new_i64();
2725         dest = tcg_temp_new_i64();
2726
2727         tcg_gen_ld_f64(frn, cpu_env, vfp_reg_offset(dp, rn));
2728         tcg_gen_ld_f64(frm, cpu_env, vfp_reg_offset(dp, rm));
2729         if (vmin) {
2730             gen_helper_vfp_minnumd(dest, frn, frm, fpst);
2731         } else {
2732             gen_helper_vfp_maxnumd(dest, frn, frm, fpst);
2733         }
2734         tcg_gen_st_f64(dest, cpu_env, vfp_reg_offset(dp, rd));
2735         tcg_temp_free_i64(frn);
2736         tcg_temp_free_i64(frm);
2737         tcg_temp_free_i64(dest);
2738     } else {
2739         TCGv_i32 frn, frm, dest;
2740
2741         frn = tcg_temp_new_i32();
2742         frm = tcg_temp_new_i32();
2743         dest = tcg_temp_new_i32();
2744
2745         tcg_gen_ld_f32(frn, cpu_env, vfp_reg_offset(dp, rn));
2746         tcg_gen_ld_f32(frm, cpu_env, vfp_reg_offset(dp, rm));
2747         if (vmin) {
2748             gen_helper_vfp_minnums(dest, frn, frm, fpst);
2749         } else {
2750             gen_helper_vfp_maxnums(dest, frn, frm, fpst);
2751         }
2752         tcg_gen_st_f32(dest, cpu_env, vfp_reg_offset(dp, rd));
2753         tcg_temp_free_i32(frn);
2754         tcg_temp_free_i32(frm);
2755         tcg_temp_free_i32(dest);
2756     }
2757
2758     tcg_temp_free_ptr(fpst);
2759     return 0;
2760 }
2761
2762 static int handle_vrint(uint32_t insn, uint32_t rd, uint32_t rm, uint32_t dp,
2763                         int rounding)
2764 {
2765     TCGv_ptr fpst = get_fpstatus_ptr(0);
2766     TCGv_i32 tcg_rmode;
2767
2768     tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rounding));
2769     gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
2770
2771     if (dp) {
2772         TCGv_i64 tcg_op;
2773         TCGv_i64 tcg_res;
2774         tcg_op = tcg_temp_new_i64();
2775         tcg_res = tcg_temp_new_i64();
2776         tcg_gen_ld_f64(tcg_op, cpu_env, vfp_reg_offset(dp, rm));
2777         gen_helper_rintd(tcg_res, tcg_op, fpst);
2778         tcg_gen_st_f64(tcg_res, cpu_env, vfp_reg_offset(dp, rd));
2779         tcg_temp_free_i64(tcg_op);
2780         tcg_temp_free_i64(tcg_res);
2781     } else {
2782         TCGv_i32 tcg_op;
2783         TCGv_i32 tcg_res;
2784         tcg_op = tcg_temp_new_i32();
2785         tcg_res = tcg_temp_new_i32();
2786         tcg_gen_ld_f32(tcg_op, cpu_env, vfp_reg_offset(dp, rm));
2787         gen_helper_rints(tcg_res, tcg_op, fpst);
2788         tcg_gen_st_f32(tcg_res, cpu_env, vfp_reg_offset(dp, rd));
2789         tcg_temp_free_i32(tcg_op);
2790         tcg_temp_free_i32(tcg_res);
2791     }
2792
2793     gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
2794     tcg_temp_free_i32(tcg_rmode);
2795
2796     tcg_temp_free_ptr(fpst);
2797     return 0;
2798 }
2799
2800 static int handle_vcvt(uint32_t insn, uint32_t rd, uint32_t rm, uint32_t dp,
2801                        int rounding)
2802 {
2803     bool is_signed = extract32(insn, 7, 1);
2804     TCGv_ptr fpst = get_fpstatus_ptr(0);
2805     TCGv_i32 tcg_rmode, tcg_shift;
2806
2807     tcg_shift = tcg_const_i32(0);
2808
2809     tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rounding));
2810     gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
2811
2812     if (dp) {
2813         TCGv_i64 tcg_double, tcg_res;
2814         TCGv_i32 tcg_tmp;
2815         /* Rd is encoded as a single precision register even when the source
2816          * is double precision.
2817          */
2818         rd = ((rd << 1) & 0x1e) | ((rd >> 4) & 0x1);
2819         tcg_double = tcg_temp_new_i64();
2820         tcg_res = tcg_temp_new_i64();
2821         tcg_tmp = tcg_temp_new_i32();
2822         tcg_gen_ld_f64(tcg_double, cpu_env, vfp_reg_offset(1, rm));
2823         if (is_signed) {
2824             gen_helper_vfp_tosld(tcg_res, tcg_double, tcg_shift, fpst);
2825         } else {
2826             gen_helper_vfp_tould(tcg_res, tcg_double, tcg_shift, fpst);
2827         }
2828         tcg_gen_trunc_i64_i32(tcg_tmp, tcg_res);
2829         tcg_gen_st_f32(tcg_tmp, cpu_env, vfp_reg_offset(0, rd));
2830         tcg_temp_free_i32(tcg_tmp);
2831         tcg_temp_free_i64(tcg_res);
2832         tcg_temp_free_i64(tcg_double);
2833     } else {
2834         TCGv_i32 tcg_single, tcg_res;
2835         tcg_single = tcg_temp_new_i32();
2836         tcg_res = tcg_temp_new_i32();
2837         tcg_gen_ld_f32(tcg_single, cpu_env, vfp_reg_offset(0, rm));
2838         if (is_signed) {
2839             gen_helper_vfp_tosls(tcg_res, tcg_single, tcg_shift, fpst);
2840         } else {
2841             gen_helper_vfp_touls(tcg_res, tcg_single, tcg_shift, fpst);
2842         }
2843         tcg_gen_st_f32(tcg_res, cpu_env, vfp_reg_offset(0, rd));
2844         tcg_temp_free_i32(tcg_res);
2845         tcg_temp_free_i32(tcg_single);
2846     }
2847
2848     gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
2849     tcg_temp_free_i32(tcg_rmode);
2850
2851     tcg_temp_free_i32(tcg_shift);
2852
2853     tcg_temp_free_ptr(fpst);
2854
2855     return 0;
2856 }
2857
2858 /* Table for converting the most common AArch32 encoding of
2859  * rounding mode to arm_fprounding order (which matches the
2860  * common AArch64 order); see ARM ARM pseudocode FPDecodeRM().
2861  */
2862 static const uint8_t fp_decode_rm[] = {
2863     FPROUNDING_TIEAWAY,
2864     FPROUNDING_TIEEVEN,
2865     FPROUNDING_POSINF,
2866     FPROUNDING_NEGINF,
2867 };
2868
2869 static int disas_vfp_v8_insn(CPUARMState *env, DisasContext *s, uint32_t insn)
2870 {
2871     uint32_t rd, rn, rm, dp = extract32(insn, 8, 1);
2872
2873     if (!arm_feature(env, ARM_FEATURE_V8)) {
2874         return 1;
2875     }
2876
2877     if (dp) {
2878         VFP_DREG_D(rd, insn);
2879         VFP_DREG_N(rn, insn);
2880         VFP_DREG_M(rm, insn);
2881     } else {
2882         rd = VFP_SREG_D(insn);
2883         rn = VFP_SREG_N(insn);
2884         rm = VFP_SREG_M(insn);
2885     }
2886
2887     if ((insn & 0x0f800e50) == 0x0e000a00) {
2888         return handle_vsel(insn, rd, rn, rm, dp);
2889     } else if ((insn & 0x0fb00e10) == 0x0e800a00) {
2890         return handle_vminmaxnm(insn, rd, rn, rm, dp);
2891     } else if ((insn & 0x0fbc0ed0) == 0x0eb80a40) {
2892         /* VRINTA, VRINTN, VRINTP, VRINTM */
2893         int rounding = fp_decode_rm[extract32(insn, 16, 2)];
2894         return handle_vrint(insn, rd, rm, dp, rounding);
2895     } else if ((insn & 0x0fbc0e50) == 0x0ebc0a40) {
2896         /* VCVTA, VCVTN, VCVTP, VCVTM */
2897         int rounding = fp_decode_rm[extract32(insn, 16, 2)];
2898         return handle_vcvt(insn, rd, rm, dp, rounding);
2899     }
2900     return 1;
2901 }
2902
2903 /* Disassemble a VFP instruction.  Returns nonzero if an error occurred
2904    (ie. an undefined instruction).  */
2905 static int disas_vfp_insn(CPUARMState * env, DisasContext *s, uint32_t insn)
2906 {
2907     uint32_t rd, rn, rm, op, i, n, offset, delta_d, delta_m, bank_mask;
2908     int dp, veclen;
2909     TCGv_i32 addr;
2910     TCGv_i32 tmp;
2911     TCGv_i32 tmp2;
2912
2913     if (!arm_feature(env, ARM_FEATURE_VFP))
2914         return 1;
2915
2916     if (!s->vfp_enabled) {
2917         /* VFP disabled.  Only allow fmxr/fmrx to/from some control regs.  */
2918         if ((insn & 0x0fe00fff) != 0x0ee00a10)
2919             return 1;
2920         rn = (insn >> 16) & 0xf;
2921         if (rn != ARM_VFP_FPSID && rn != ARM_VFP_FPEXC
2922             && rn != ARM_VFP_MVFR1 && rn != ARM_VFP_MVFR0)
2923             return 1;
2924     }
2925
2926     if (extract32(insn, 28, 4) == 0xf) {
2927         /* Encodings with T=1 (Thumb) or unconditional (ARM):
2928          * only used in v8 and above.
2929          */
2930         return disas_vfp_v8_insn(env, s, insn);
2931     }
2932
2933     dp = ((insn & 0xf00) == 0xb00);
2934     switch ((insn >> 24) & 0xf) {
2935     case 0xe:
2936         if (insn & (1 << 4)) {
2937             /* single register transfer */
2938             rd = (insn >> 12) & 0xf;
2939             if (dp) {
2940                 int size;
2941                 int pass;
2942
2943                 VFP_DREG_N(rn, insn);
2944                 if (insn & 0xf)
2945                     return 1;
2946                 if (insn & 0x00c00060
2947                     && !arm_feature(env, ARM_FEATURE_NEON))
2948                     return 1;
2949
2950                 pass = (insn >> 21) & 1;
2951                 if (insn & (1 << 22)) {
2952                     size = 0;
2953                     offset = ((insn >> 5) & 3) * 8;
2954                 } else if (insn & (1 << 5)) {
2955                     size = 1;
2956                     offset = (insn & (1 << 6)) ? 16 : 0;
2957                 } else {
2958                     size = 2;
2959                     offset = 0;
2960                 }
2961                 if (insn & ARM_CP_RW_BIT) {
2962                     /* vfp->arm */
2963                     tmp = neon_load_reg(rn, pass);
2964                     switch (size) {
2965                     case 0:
2966                         if (offset)
2967                             tcg_gen_shri_i32(tmp, tmp, offset);
2968                         if (insn & (1 << 23))
2969                             gen_uxtb(tmp);
2970                         else
2971                             gen_sxtb(tmp);
2972                         break;
2973                     case 1:
2974                         if (insn & (1 << 23)) {
2975                             if (offset) {
2976                                 tcg_gen_shri_i32(tmp, tmp, 16);
2977                             } else {
2978                                 gen_uxth(tmp);
2979                             }
2980                         } else {
2981                             if (offset) {
2982                                 tcg_gen_sari_i32(tmp, tmp, 16);
2983                             } else {
2984                                 gen_sxth(tmp);
2985                             }
2986                         }
2987                         break;
2988                     case 2:
2989                         break;
2990                     }
2991                     store_reg(s, rd, tmp);
2992                 } else {
2993                     /* arm->vfp */
2994                     tmp = load_reg(s, rd);
2995                     if (insn & (1 << 23)) {
2996                         /* VDUP */
2997                         if (size == 0) {
2998                             gen_neon_dup_u8(tmp, 0);
2999                         } else if (size == 1) {
3000                             gen_neon_dup_low16(tmp);
3001                         }
3002                         for (n = 0; n <= pass * 2; n++) {
3003                             tmp2 = tcg_temp_new_i32();
3004                             tcg_gen_mov_i32(tmp2, tmp);
3005                             neon_store_reg(rn, n, tmp2);
3006                         }
3007                         neon_store_reg(rn, n, tmp);
3008                     } else {
3009                         /* VMOV */
3010                         switch (size) {
3011                         case 0:
3012                             tmp2 = neon_load_reg(rn, pass);
3013                             tcg_gen_deposit_i32(tmp, tmp2, tmp, offset, 8);
3014                             tcg_temp_free_i32(tmp2);
3015                             break;
3016                         case 1:
3017                             tmp2 = neon_load_reg(rn, pass);
3018                             tcg_gen_deposit_i32(tmp, tmp2, tmp, offset, 16);
3019                             tcg_temp_free_i32(tmp2);
3020                             break;
3021                         case 2:
3022                             break;
3023                         }
3024                         neon_store_reg(rn, pass, tmp);
3025                     }
3026                 }
3027             } else { /* !dp */
3028                 if ((insn & 0x6f) != 0x00)
3029                     return 1;
3030                 rn = VFP_SREG_N(insn);
3031                 if (insn & ARM_CP_RW_BIT) {
3032                     /* vfp->arm */
3033                     if (insn & (1 << 21)) {
3034                         /* system register */
3035                         rn >>= 1;
3036
3037                         switch (rn) {
3038                         case ARM_VFP_FPSID:
3039                             /* VFP2 allows access to FSID from userspace.
3040                                VFP3 restricts all id registers to privileged
3041                                accesses.  */
3042                             if (IS_USER(s)
3043                                 && arm_feature(env, ARM_FEATURE_VFP3))
3044                                 return 1;
3045                             tmp = load_cpu_field(vfp.xregs[rn]);
3046                             break;
3047                         case ARM_VFP_FPEXC:
3048                             if (IS_USER(s))
3049                                 return 1;
3050                             tmp = load_cpu_field(vfp.xregs[rn]);
3051                             break;
3052                         case ARM_VFP_FPINST:
3053                         case ARM_VFP_FPINST2:
3054                             /* Not present in VFP3.  */
3055                             if (IS_USER(s)
3056                                 || arm_feature(env, ARM_FEATURE_VFP3))
3057                                 return 1;
3058                             tmp = load_cpu_field(vfp.xregs[rn]);
3059                             break;
3060                         case ARM_VFP_FPSCR:
3061                             if (rd == 15) {
3062                                 tmp = load_cpu_field(vfp.xregs[ARM_VFP_FPSCR]);
3063                                 tcg_gen_andi_i32(tmp, tmp, 0xf0000000);
3064                             } else {
3065                                 tmp = tcg_temp_new_i32();
3066                                 gen_helper_vfp_get_fpscr(tmp, cpu_env);
3067                             }
3068                             break;
3069                         case ARM_VFP_MVFR0:
3070                         case ARM_VFP_MVFR1:
3071                             if (IS_USER(s)
3072                                 || !arm_feature(env, ARM_FEATURE_MVFR))
3073                                 return 1;
3074                             tmp = load_cpu_field(vfp.xregs[rn]);
3075                             break;
3076                         default:
3077                             return 1;
3078                         }
3079                     } else {
3080                         gen_mov_F0_vreg(0, rn);
3081                         tmp = gen_vfp_mrs();
3082                     }
3083                     if (rd == 15) {
3084                         /* Set the 4 flag bits in the CPSR.  */
3085                         gen_set_nzcv(tmp);
3086                         tcg_temp_free_i32(tmp);
3087                     } else {
3088                         store_reg(s, rd, tmp);
3089                     }
3090                 } else {
3091                     /* arm->vfp */
3092                     if (insn & (1 << 21)) {
3093                         rn >>= 1;
3094                         /* system register */
3095                         switch (rn) {
3096                         case ARM_VFP_FPSID:
3097                         case ARM_VFP_MVFR0:
3098                         case ARM_VFP_MVFR1:
3099                             /* Writes are ignored.  */
3100                             break;
3101                         case ARM_VFP_FPSCR:
3102                             tmp = load_reg(s, rd);
3103                             gen_helper_vfp_set_fpscr(cpu_env, tmp);
3104                             tcg_temp_free_i32(tmp);
3105                             gen_lookup_tb(s);
3106                             break;
3107                         case ARM_VFP_FPEXC:
3108                             if (IS_USER(s))
3109                                 return 1;
3110                             /* TODO: VFP subarchitecture support.
3111                              * For now, keep the EN bit only */
3112                             tmp = load_reg(s, rd);
3113                             tcg_gen_andi_i32(tmp, tmp, 1 << 30);
3114                             store_cpu_field(tmp, vfp.xregs[rn]);
3115                             gen_lookup_tb(s);
3116                             break;
3117                         case ARM_VFP_FPINST:
3118                         case ARM_VFP_FPINST2:
3119                             tmp = load_reg(s, rd);
3120                             store_cpu_field(tmp, vfp.xregs[rn]);
3121                             break;
3122                         default:
3123                             return 1;
3124                         }
3125                     } else {
3126                         tmp = load_reg(s, rd);
3127                         gen_vfp_msr(tmp);
3128                         gen_mov_vreg_F0(0, rn);
3129                     }
3130                 }
3131             }
3132         } else {
3133             /* data processing */
3134             /* The opcode is in bits 23, 21, 20 and 6.  */
3135             op = ((insn >> 20) & 8) | ((insn >> 19) & 6) | ((insn >> 6) & 1);
3136             if (dp) {
3137                 if (op == 15) {
3138                     /* rn is opcode */
3139                     rn = ((insn >> 15) & 0x1e) | ((insn >> 7) & 1);
3140                 } else {
3141                     /* rn is register number */
3142                     VFP_DREG_N(rn, insn);
3143                 }
3144
3145                 if (op == 15 && (rn == 15 || ((rn & 0x1c) == 0x18) ||
3146                                  ((rn & 0x1e) == 0x6))) {
3147                     /* Integer or single/half precision destination.  */
3148                     rd = VFP_SREG_D(insn);
3149                 } else {
3150                     VFP_DREG_D(rd, insn);
3151                 }
3152                 if (op == 15 &&
3153                     (((rn & 0x1c) == 0x10) || ((rn & 0x14) == 0x14) ||
3154                      ((rn & 0x1e) == 0x4))) {
3155                     /* VCVT from int or half precision is always from S reg
3156                      * regardless of dp bit. VCVT with immediate frac_bits
3157                      * has same format as SREG_M.
3158                      */
3159                     rm = VFP_SREG_M(insn);
3160                 } else {
3161                     VFP_DREG_M(rm, insn);
3162                 }
3163             } else {
3164                 rn = VFP_SREG_N(insn);
3165                 if (op == 15 && rn == 15) {
3166                     /* Double precision destination.  */
3167                     VFP_DREG_D(rd, insn);
3168                 } else {
3169                     rd = VFP_SREG_D(insn);
3170                 }
3171                 /* NB that we implicitly rely on the encoding for the frac_bits
3172                  * in VCVT of fixed to float being the same as that of an SREG_M
3173                  */
3174                 rm = VFP_SREG_M(insn);
3175             }
3176
3177             veclen = s->vec_len;
3178             if (op == 15 && rn > 3)
3179                 veclen = 0;
3180
3181             /* Shut up compiler warnings.  */
3182             delta_m = 0;
3183             delta_d = 0;
3184             bank_mask = 0;
3185
3186             if (veclen > 0) {
3187                 if (dp)
3188                     bank_mask = 0xc;
3189                 else
3190                     bank_mask = 0x18;
3191
3192                 /* Figure out what type of vector operation this is.  */
3193                 if ((rd & bank_mask) == 0) {
3194                     /* scalar */
3195                     veclen = 0;
3196                 } else {
3197                     if (dp)
3198                         delta_d = (s->vec_stride >> 1) + 1;
3199                     else
3200                         delta_d = s->vec_stride + 1;
3201
3202                     if ((rm & bank_mask) == 0) {
3203                         /* mixed scalar/vector */
3204                         delta_m = 0;
3205                     } else {
3206                         /* vector */
3207                         delta_m = delta_d;
3208                     }
3209                 }
3210             }
3211
3212             /* Load the initial operands.  */
3213             if (op == 15) {
3214                 switch (rn) {
3215                 case 16:
3216                 case 17:
3217                     /* Integer source */
3218                     gen_mov_F0_vreg(0, rm);
3219                     break;
3220                 case 8:
3221                 case 9:
3222                     /* Compare */
3223                     gen_mov_F0_vreg(dp, rd);
3224                     gen_mov_F1_vreg(dp, rm);
3225                     break;
3226                 case 10:
3227                 case 11:
3228                     /* Compare with zero */
3229                     gen_mov_F0_vreg(dp, rd);
3230                     gen_vfp_F1_ld0(dp);
3231                     break;
3232                 case 20:
3233                 case 21:
3234                 case 22:
3235                 case 23:
3236                 case 28:
3237                 case 29:
3238                 case 30:
3239                 case 31:
3240                     /* Source and destination the same.  */
3241                     gen_mov_F0_vreg(dp, rd);
3242                     break;
3243                 case 4:
3244                 case 5:
3245                 case 6:
3246                 case 7:
3247                     /* VCVTB, VCVTT: only present with the halfprec extension
3248                      * UNPREDICTABLE if bit 8 is set prior to ARMv8
3249                      * (we choose to UNDEF)
3250                      */
3251                     if ((dp && !arm_feature(env, ARM_FEATURE_V8)) ||
3252                         !arm_feature(env, ARM_FEATURE_VFP_FP16)) {
3253                         return 1;
3254                     }
3255                     if (!extract32(rn, 1, 1)) {
3256                         /* Half precision source.  */
3257                         gen_mov_F0_vreg(0, rm);
3258                         break;
3259                     }
3260                     /* Otherwise fall through */
3261                 default:
3262                     /* One source operand.  */
3263                     gen_mov_F0_vreg(dp, rm);
3264                     break;
3265                 }
3266             } else {
3267                 /* Two source operands.  */
3268                 gen_mov_F0_vreg(dp, rn);
3269                 gen_mov_F1_vreg(dp, rm);
3270             }
3271
3272             for (;;) {
3273                 /* Perform the calculation.  */
3274                 switch (op) {
3275                 case 0: /* VMLA: fd + (fn * fm) */
3276                     /* Note that order of inputs to the add matters for NaNs */
3277                     gen_vfp_F1_mul(dp);
3278                     gen_mov_F0_vreg(dp, rd);
3279                     gen_vfp_add(dp);
3280                     break;
3281                 case 1: /* VMLS: fd + -(fn * fm) */
3282                     gen_vfp_mul(dp);
3283                     gen_vfp_F1_neg(dp);
3284                     gen_mov_F0_vreg(dp, rd);
3285                     gen_vfp_add(dp);
3286                     break;
3287                 case 2: /* VNMLS: -fd + (fn * fm) */
3288                     /* Note that it isn't valid to replace (-A + B) with (B - A)
3289                      * or similar plausible looking simplifications
3290                      * because this will give wrong results for NaNs.
3291                      */
3292                     gen_vfp_F1_mul(dp);
3293                     gen_mov_F0_vreg(dp, rd);
3294                     gen_vfp_neg(dp);
3295                     gen_vfp_add(dp);
3296                     break;
3297                 case 3: /* VNMLA: -fd + -(fn * fm) */
3298                     gen_vfp_mul(dp);
3299                     gen_vfp_F1_neg(dp);
3300                     gen_mov_F0_vreg(dp, rd);
3301                     gen_vfp_neg(dp);
3302                     gen_vfp_add(dp);
3303                     break;
3304                 case 4: /* mul: fn * fm */
3305                     gen_vfp_mul(dp);
3306                     break;
3307                 case 5: /* nmul: -(fn * fm) */
3308                     gen_vfp_mul(dp);
3309                     gen_vfp_neg(dp);
3310                     break;
3311                 case 6: /* add: fn + fm */
3312                     gen_vfp_add(dp);
3313                     break;
3314                 case 7: /* sub: fn - fm */
3315                     gen_vfp_sub(dp);
3316                     break;
3317                 case 8: /* div: fn / fm */
3318                     gen_vfp_div(dp);
3319                     break;
3320                 case 10: /* VFNMA : fd = muladd(-fd,  fn, fm) */
3321                 case 11: /* VFNMS : fd = muladd(-fd, -fn, fm) */
3322                 case 12: /* VFMA  : fd = muladd( fd,  fn, fm) */
3323                 case 13: /* VFMS  : fd = muladd( fd, -fn, fm) */
3324                     /* These are fused multiply-add, and must be done as one
3325                      * floating point operation with no rounding between the
3326                      * multiplication and addition steps.
3327                      * NB that doing the negations here as separate steps is
3328                      * correct : an input NaN should come out with its sign bit
3329                      * flipped if it is a negated-input.
3330                      */
3331                     if (!arm_feature(env, ARM_FEATURE_VFP4)) {
3332                         return 1;
3333                     }
3334                     if (dp) {
3335                         TCGv_ptr fpst;
3336                         TCGv_i64 frd;
3337                         if (op & 1) {
3338                             /* VFNMS, VFMS */
3339                             gen_helper_vfp_negd(cpu_F0d, cpu_F0d);
3340                         }
3341                         frd = tcg_temp_new_i64();
3342                         tcg_gen_ld_f64(frd, cpu_env, vfp_reg_offset(dp, rd));
3343                         if (op & 2) {
3344                             /* VFNMA, VFNMS */
3345                             gen_helper_vfp_negd(frd, frd);
3346                         }
3347                         fpst = get_fpstatus_ptr(0);
3348                         gen_helper_vfp_muladdd(cpu_F0d, cpu_F0d,
3349                                                cpu_F1d, frd, fpst);
3350                         tcg_temp_free_ptr(fpst);
3351                         tcg_temp_free_i64(frd);
3352                     } else {
3353                         TCGv_ptr fpst;
3354                         TCGv_i32 frd;
3355                         if (op & 1) {
3356                             /* VFNMS, VFMS */
3357                             gen_helper_vfp_negs(cpu_F0s, cpu_F0s);
3358                         }
3359                         frd = tcg_temp_new_i32();
3360                         tcg_gen_ld_f32(frd, cpu_env, vfp_reg_offset(dp, rd));
3361                         if (op & 2) {
3362                             gen_helper_vfp_negs(frd, frd);
3363                         }
3364                         fpst = get_fpstatus_ptr(0);
3365                         gen_helper_vfp_muladds(cpu_F0s, cpu_F0s,
3366                                                cpu_F1s, frd, fpst);
3367                         tcg_temp_free_ptr(fpst);
3368                         tcg_temp_free_i32(frd);
3369                     }
3370                     break;
3371                 case 14: /* fconst */
3372                     if (!arm_feature(env, ARM_FEATURE_VFP3))
3373                       return 1;
3374
3375                     n = (insn << 12) & 0x80000000;
3376                     i = ((insn >> 12) & 0x70) | (insn & 0xf);
3377                     if (dp) {
3378                         if (i & 0x40)
3379                             i |= 0x3f80;
3380                         else
3381                             i |= 0x4000;
3382                         n |= i << 16;
3383                         tcg_gen_movi_i64(cpu_F0d, ((uint64_t)n) << 32);
3384                     } else {
3385                         if (i & 0x40)
3386                             i |= 0x780;
3387                         else
3388                             i |= 0x800;
3389                         n |= i << 19;
3390                         tcg_gen_movi_i32(cpu_F0s, n);
3391                     }
3392                     break;
3393                 case 15: /* extension space */
3394                     switch (rn) {
3395                     case 0: /* cpy */
3396                         /* no-op */
3397                         break;
3398                     case 1: /* abs */
3399                         gen_vfp_abs(dp);
3400                         break;
3401                     case 2: /* neg */
3402                         gen_vfp_neg(dp);
3403                         break;
3404                     case 3: /* sqrt */
3405                         gen_vfp_sqrt(dp);
3406                         break;
3407                     case 4: /* vcvtb.f32.f16, vcvtb.f64.f16 */
3408                         tmp = gen_vfp_mrs();
3409                         tcg_gen_ext16u_i32(tmp, tmp);
3410                         if (dp) {
3411                             gen_helper_vfp_fcvt_f16_to_f64(cpu_F0d, tmp,
3412                                                            cpu_env);
3413                         } else {
3414                             gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp,
3415                                                            cpu_env);
3416                         }
3417                         tcg_temp_free_i32(tmp);
3418                         break;
3419                     case 5: /* vcvtt.f32.f16, vcvtt.f64.f16 */
3420                         tmp = gen_vfp_mrs();
3421                         tcg_gen_shri_i32(tmp, tmp, 16);
3422                         if (dp) {
3423                             gen_helper_vfp_fcvt_f16_to_f64(cpu_F0d, tmp,
3424                                                            cpu_env);
3425                         } else {
3426                             gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp,
3427                                                            cpu_env);
3428                         }
3429                         tcg_temp_free_i32(tmp);
3430                         break;
3431                     case 6: /* vcvtb.f16.f32, vcvtb.f16.f64 */
3432                         tmp = tcg_temp_new_i32();
3433                         if (dp) {
3434                             gen_helper_vfp_fcvt_f64_to_f16(tmp, cpu_F0d,
3435                                                            cpu_env);
3436                         } else {
3437                             gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s,
3438                                                            cpu_env);
3439                         }
3440                         gen_mov_F0_vreg(0, rd);
3441                         tmp2 = gen_vfp_mrs();
3442                         tcg_gen_andi_i32(tmp2, tmp2, 0xffff0000);
3443                         tcg_gen_or_i32(tmp, tmp, tmp2);
3444                         tcg_temp_free_i32(tmp2);
3445                         gen_vfp_msr(tmp);
3446                         break;
3447                     case 7: /* vcvtt.f16.f32, vcvtt.f16.f64 */
3448                         tmp = tcg_temp_new_i32();
3449                         if (dp) {
3450                             gen_helper_vfp_fcvt_f64_to_f16(tmp, cpu_F0d,
3451                                                            cpu_env);
3452                         } else {
3453                             gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s,
3454                                                            cpu_env);
3455                         }
3456                         tcg_gen_shli_i32(tmp, tmp, 16);
3457                         gen_mov_F0_vreg(0, rd);
3458                         tmp2 = gen_vfp_mrs();
3459                         tcg_gen_ext16u_i32(tmp2, tmp2);
3460                         tcg_gen_or_i32(tmp, tmp, tmp2);
3461                         tcg_temp_free_i32(tmp2);
3462                         gen_vfp_msr(tmp);
3463                         break;
3464                     case 8: /* cmp */
3465                         gen_vfp_cmp(dp);
3466                         break;
3467                     case 9: /* cmpe */
3468                         gen_vfp_cmpe(dp);
3469                         break;
3470                     case 10: /* cmpz */
3471                         gen_vfp_cmp(dp);
3472                         break;
3473                     case 11: /* cmpez */
3474                         gen_vfp_F1_ld0(dp);
3475                         gen_vfp_cmpe(dp);
3476                         break;
3477                     case 12: /* vrintr */
3478                     {
3479                         TCGv_ptr fpst = get_fpstatus_ptr(0);
3480                         if (dp) {
3481                             gen_helper_rintd(cpu_F0d, cpu_F0d, fpst);
3482                         } else {
3483                             gen_helper_rints(cpu_F0s, cpu_F0s, fpst);
3484                         }
3485                         tcg_temp_free_ptr(fpst);
3486                         break;
3487                     }
3488                     case 13: /* vrintz */
3489                     {
3490                         TCGv_ptr fpst = get_fpstatus_ptr(0);
3491                         TCGv_i32 tcg_rmode;
3492                         tcg_rmode = tcg_const_i32(float_round_to_zero);
3493                         gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
3494                         if (dp) {
3495                             gen_helper_rintd(cpu_F0d, cpu_F0d, fpst);
3496                         } else {
3497                             gen_helper_rints(cpu_F0s, cpu_F0s, fpst);
3498                         }
3499                         gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
3500                         tcg_temp_free_i32(tcg_rmode);
3501                         tcg_temp_free_ptr(fpst);
3502                         break;
3503                     }
3504                     case 14: /* vrintx */
3505                     {
3506                         TCGv_ptr fpst = get_fpstatus_ptr(0);
3507                         if (dp) {
3508                             gen_helper_rintd_exact(cpu_F0d, cpu_F0d, fpst);
3509                         } else {
3510                             gen_helper_rints_exact(cpu_F0s, cpu_F0s, fpst);
3511                         }
3512                         tcg_temp_free_ptr(fpst);
3513                         break;
3514                     }
3515                     case 15: /* single<->double conversion */
3516                         if (dp)
3517                             gen_helper_vfp_fcvtsd(cpu_F0s, cpu_F0d, cpu_env);
3518                         else
3519                             gen_helper_vfp_fcvtds(cpu_F0d, cpu_F0s, cpu_env);
3520                         break;
3521                     case 16: /* fuito */
3522                         gen_vfp_uito(dp, 0);
3523                         break;
3524                     case 17: /* fsito */
3525                         gen_vfp_sito(dp, 0);
3526                         break;
3527                     case 20: /* fshto */
3528                         if (!arm_feature(env, ARM_FEATURE_VFP3))
3529                           return 1;
3530                         gen_vfp_shto(dp, 16 - rm, 0);
3531                         break;
3532                     case 21: /* fslto */
3533                         if (!arm_feature(env, ARM_FEATURE_VFP3))
3534                           return 1;
3535                         gen_vfp_slto(dp, 32 - rm, 0);
3536                         break;
3537                     case 22: /* fuhto */
3538                         if (!arm_feature(env, ARM_FEATURE_VFP3))
3539                           return 1;
3540                         gen_vfp_uhto(dp, 16 - rm, 0);
3541                         break;
3542                     case 23: /* fulto */
3543                         if (!arm_feature(env, ARM_FEATURE_VFP3))
3544                           return 1;
3545                         gen_vfp_ulto(dp, 32 - rm, 0);
3546                         break;
3547                     case 24: /* ftoui */
3548                         gen_vfp_toui(dp, 0);
3549                         break;
3550                     case 25: /* ftouiz */
3551                         gen_vfp_touiz(dp, 0);
3552                         break;
3553                     case 26: /* ftosi */
3554                         gen_vfp_tosi(dp, 0);
3555                         break;
3556                     case 27: /* ftosiz */
3557                         gen_vfp_tosiz(dp, 0);
3558                         break;
3559                     case 28: /* ftosh */
3560                         if (!arm_feature(env, ARM_FEATURE_VFP3))
3561                           return 1;
3562                         gen_vfp_tosh(dp, 16 - rm, 0);
3563                         break;
3564                     case 29: /* ftosl */
3565                         if (!arm_feature(env, ARM_FEATURE_VFP3))
3566                           return 1;
3567                         gen_vfp_tosl(dp, 32 - rm, 0);
3568                         break;
3569                     case 30: /* ftouh */
3570                         if (!arm_feature(env, ARM_FEATURE_VFP3))
3571                           return 1;
3572                         gen_vfp_touh(dp, 16 - rm, 0);
3573                         break;
3574                     case 31: /* ftoul */
3575                         if (!arm_feature(env, ARM_FEATURE_VFP3))
3576                           return 1;
3577                         gen_vfp_toul(dp, 32 - rm, 0);
3578                         break;
3579                     default: /* undefined */
3580                         return 1;
3581                     }
3582                     break;
3583                 default: /* undefined */
3584                     return 1;
3585                 }
3586
3587                 /* Write back the result.  */
3588                 if (op == 15 && (rn >= 8 && rn <= 11)) {
3589                     /* Comparison, do nothing.  */
3590                 } else if (op == 15 && dp && ((rn & 0x1c) == 0x18 ||
3591                                               (rn & 0x1e) == 0x6)) {
3592                     /* VCVT double to int: always integer result.
3593                      * VCVT double to half precision is always a single
3594                      * precision result.
3595                      */
3596                     gen_mov_vreg_F0(0, rd);
3597                 } else if (op == 15 && rn == 15) {
3598                     /* conversion */
3599                     gen_mov_vreg_F0(!dp, rd);
3600                 } else {
3601                     gen_mov_vreg_F0(dp, rd);
3602                 }
3603
3604                 /* break out of the loop if we have finished  */
3605                 if (veclen == 0)
3606                     break;
3607
3608                 if (op == 15 && delta_m == 0) {
3609                     /* single source one-many */
3610                     while (veclen--) {
3611                         rd = ((rd + delta_d) & (bank_mask - 1))
3612                              | (rd & bank_mask);
3613                         gen_mov_vreg_F0(dp, rd);
3614                     }
3615                     break;
3616                 }
3617                 /* Setup the next operands.  */
3618                 veclen--;
3619                 rd = ((rd + delta_d) & (bank_mask - 1))
3620                      | (rd & bank_mask);
3621
3622                 if (op == 15) {
3623                     /* One source operand.  */
3624                     rm = ((rm + delta_m) & (bank_mask - 1))
3625                          | (rm & bank_mask);
3626                     gen_mov_F0_vreg(dp, rm);
3627                 } else {
3628                     /* Two source operands.  */
3629                     rn = ((rn + delta_d) & (bank_mask - 1))
3630                          | (rn & bank_mask);
3631                     gen_mov_F0_vreg(dp, rn);
3632                     if (delta_m) {
3633                         rm = ((rm + delta_m) & (bank_mask - 1))
3634                              | (rm & bank_mask);
3635                         gen_mov_F1_vreg(dp, rm);
3636                     }
3637                 }
3638             }
3639         }
3640         break;
3641     case 0xc:
3642     case 0xd:
3643         if ((insn & 0x03e00000) == 0x00400000) {
3644             /* two-register transfer */
3645             rn = (insn >> 16) & 0xf;
3646             rd = (insn >> 12) & 0xf;
3647             if (dp) {
3648                 VFP_DREG_M(rm, insn);
3649             } else {
3650                 rm = VFP_SREG_M(insn);
3651             }
3652
3653             if (insn & ARM_CP_RW_BIT) {
3654                 /* vfp->arm */
3655                 if (dp) {
3656                     gen_mov_F0_vreg(0, rm * 2);
3657                     tmp = gen_vfp_mrs();
3658                     store_reg(s, rd, tmp);
3659                     gen_mov_F0_vreg(0, rm * 2 + 1);
3660                     tmp = gen_vfp_mrs();
3661                     store_reg(s, rn, tmp);
3662                 } else {
3663                     gen_mov_F0_vreg(0, rm);
3664                     tmp = gen_vfp_mrs();
3665                     store_reg(s, rd, tmp);
3666                     gen_mov_F0_vreg(0, rm + 1);
3667                     tmp = gen_vfp_mrs();
3668                     store_reg(s, rn, tmp);
3669                 }
3670             } else {
3671                 /* arm->vfp */
3672                 if (dp) {
3673                     tmp = load_reg(s, rd);
3674                     gen_vfp_msr(tmp);
3675                     gen_mov_vreg_F0(0, rm * 2);
3676                     tmp = load_reg(s, rn);
3677                     gen_vfp_msr(tmp);
3678                     gen_mov_vreg_F0(0, rm * 2 + 1);
3679                 } else {
3680                     tmp = load_reg(s, rd);
3681                     gen_vfp_msr(tmp);
3682                     gen_mov_vreg_F0(0, rm);
3683                     tmp = load_reg(s, rn);
3684                     gen_vfp_msr(tmp);
3685                     gen_mov_vreg_F0(0, rm + 1);
3686                 }
3687             }
3688         } else {
3689             /* Load/store */
3690             rn = (insn >> 16) & 0xf;
3691             if (dp)
3692                 VFP_DREG_D(rd, insn);
3693             else
3694                 rd = VFP_SREG_D(insn);
3695             if ((insn & 0x01200000) == 0x01000000) {
3696                 /* Single load/store */
3697                 offset = (insn & 0xff) << 2;
3698                 if ((insn & (1 << 23)) == 0)
3699                     offset = -offset;
3700                 if (s->thumb && rn == 15) {
3701                     /* This is actually UNPREDICTABLE */
3702                     addr = tcg_temp_new_i32();
3703                     tcg_gen_movi_i32(addr, s->pc & ~2);
3704                 } else {
3705                     addr = load_reg(s, rn);
3706                 }
3707                 tcg_gen_addi_i32(addr, addr, offset);
3708                 if (insn & (1 << 20)) {
3709                     gen_vfp_ld(s, dp, addr);
3710                     gen_mov_vreg_F0(dp, rd);
3711                 } else {
3712                     gen_mov_F0_vreg(dp, rd);
3713                     gen_vfp_st(s, dp, addr);
3714                 }
3715                 tcg_temp_free_i32(addr);
3716             } else {
3717                 /* load/store multiple */
3718                 int w = insn & (1 << 21);
3719                 if (dp)
3720                     n = (insn >> 1) & 0x7f;
3721                 else
3722                     n = insn & 0xff;
3723
3724                 if (w && !(((insn >> 23) ^ (insn >> 24)) & 1)) {
3725                     /* P == U , W == 1  => UNDEF */
3726                     return 1;
3727                 }
3728                 if (n == 0 || (rd + n) > 32 || (dp && n > 16)) {
3729                     /* UNPREDICTABLE cases for bad immediates: we choose to
3730                      * UNDEF to avoid generating huge numbers of TCG ops
3731                      */
3732                     return 1;
3733                 }
3734                 if (rn == 15 && w) {
3735                     /* writeback to PC is UNPREDICTABLE, we choose to UNDEF */
3736                     return 1;
3737                 }
3738
3739                 if (s->thumb && rn == 15) {
3740                     /* This is actually UNPREDICTABLE */
3741                     addr = tcg_temp_new_i32();
3742                     tcg_gen_movi_i32(addr, s->pc & ~2);
3743                 } else {
3744                     addr = load_reg(s, rn);
3745                 }
3746                 if (insn & (1 << 24)) /* pre-decrement */
3747                     tcg_gen_addi_i32(addr, addr, -((insn & 0xff) << 2));
3748
3749                 if (dp)
3750                     offset = 8;
3751                 else
3752                     offset = 4;
3753                 for (i = 0; i < n; i++) {
3754                     if (insn & ARM_CP_RW_BIT) {
3755                         /* load */
3756                         gen_vfp_ld(s, dp, addr);
3757                         gen_mov_vreg_F0(dp, rd + i);
3758                     } else {
3759                         /* store */
3760                         gen_mov_F0_vreg(dp, rd + i);
3761                         gen_vfp_st(s, dp, addr);
3762                     }
3763                     tcg_gen_addi_i32(addr, addr, offset);
3764                 }
3765                 if (w) {
3766                     /* writeback */
3767                     if (insn & (1 << 24))
3768                         offset = -offset * n;
3769                     else if (dp && (insn & 1))
3770                         offset = 4;
3771                     else
3772                         offset = 0;
3773
3774                     if (offset != 0)
3775                         tcg_gen_addi_i32(addr, addr, offset);
3776                     store_reg(s, rn, addr);
3777                 } else {
3778                     tcg_temp_free_i32(addr);
3779                 }
3780             }
3781         }
3782         break;
3783     default:
3784         /* Should never happen.  */
3785         return 1;
3786     }
3787     return 0;
3788 }
3789
3790 static inline void gen_goto_tb(DisasContext *s, int n, target_ulong dest)
3791 {
3792     TranslationBlock *tb;
3793
3794     tb = s->tb;
3795     if ((tb->pc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK)) {
3796         tcg_gen_goto_tb(n);
3797         gen_set_pc_im(s, dest);
3798         tcg_gen_exit_tb((uintptr_t)tb + n);
3799     } else {
3800         gen_set_pc_im(s, dest);
3801         tcg_gen_exit_tb(0);
3802     }
3803 }
3804
3805 static inline void gen_jmp (DisasContext *s, uint32_t dest)
3806 {
3807     if (unlikely(s->singlestep_enabled)) {
3808         /* An indirect jump so that we still trigger the debug exception.  */
3809         if (s->thumb)
3810             dest |= 1;
3811         gen_bx_im(s, dest);
3812     } else {
3813         gen_goto_tb(s, 0, dest);
3814         s->is_jmp = DISAS_TB_JUMP;
3815     }
3816 }
3817
3818 static inline void gen_mulxy(TCGv_i32 t0, TCGv_i32 t1, int x, int y)
3819 {
3820     if (x)
3821         tcg_gen_sari_i32(t0, t0, 16);
3822     else
3823         gen_sxth(t0);
3824     if (y)
3825         tcg_gen_sari_i32(t1, t1, 16);
3826     else
3827         gen_sxth(t1);
3828     tcg_gen_mul_i32(t0, t0, t1);
3829 }
3830
3831 /* Return the mask of PSR bits set by a MSR instruction.  */
3832 static uint32_t msr_mask(CPUARMState *env, DisasContext *s, int flags, int spsr) {
3833     uint32_t mask;
3834
3835     mask = 0;
3836     if (flags & (1 << 0))
3837         mask |= 0xff;
3838     if (flags & (1 << 1))
3839         mask |= 0xff00;
3840     if (flags & (1 << 2))
3841         mask |= 0xff0000;
3842     if (flags & (1 << 3))
3843         mask |= 0xff000000;
3844
3845     /* Mask out undefined bits.  */
3846     mask &= ~CPSR_RESERVED;
3847     if (!arm_feature(env, ARM_FEATURE_V4T))
3848         mask &= ~CPSR_T;
3849     if (!arm_feature(env, ARM_FEATURE_V5))
3850         mask &= ~CPSR_Q; /* V5TE in reality*/
3851     if (!arm_feature(env, ARM_FEATURE_V6))
3852         mask &= ~(CPSR_E | CPSR_GE);
3853     if (!arm_feature(env, ARM_FEATURE_THUMB2))
3854         mask &= ~CPSR_IT;
3855     /* Mask out execution state bits.  */
3856     if (!spsr)
3857         mask &= ~CPSR_EXEC;
3858     /* Mask out privileged bits.  */
3859     if (IS_USER(s))
3860         mask &= CPSR_USER;
3861     return mask;
3862 }
3863
3864 /* Returns nonzero if access to the PSR is not permitted. Marks t0 as dead. */
3865 static int gen_set_psr(DisasContext *s, uint32_t mask, int spsr, TCGv_i32 t0)
3866 {
3867     TCGv_i32 tmp;
3868     if (spsr) {
3869         /* ??? This is also undefined in system mode.  */
3870         if (IS_USER(s))
3871             return 1;
3872
3873         tmp = load_cpu_field(spsr);
3874         tcg_gen_andi_i32(tmp, tmp, ~mask);
3875         tcg_gen_andi_i32(t0, t0, mask);
3876         tcg_gen_or_i32(tmp, tmp, t0);
3877         store_cpu_field(tmp, spsr);
3878     } else {
3879         gen_set_cpsr(t0, mask);
3880     }
3881     tcg_temp_free_i32(t0);
3882     gen_lookup_tb(s);
3883     return 0;
3884 }
3885
3886 /* Returns nonzero if access to the PSR is not permitted.  */
3887 static int gen_set_psr_im(DisasContext *s, uint32_t mask, int spsr, uint32_t val)
3888 {
3889     TCGv_i32 tmp;
3890     tmp = tcg_temp_new_i32();
3891     tcg_gen_movi_i32(tmp, val);
3892     return gen_set_psr(s, mask, spsr, tmp);
3893 }
3894
3895 /* Generate an old-style exception return. Marks pc as dead. */
3896 static void gen_exception_return(DisasContext *s, TCGv_i32 pc)
3897 {
3898     TCGv_i32 tmp;
3899     store_reg(s, 15, pc);
3900     tmp = load_cpu_field(spsr);
3901     gen_set_cpsr(tmp, 0xffffffff);
3902     tcg_temp_free_i32(tmp);
3903     s->is_jmp = DISAS_UPDATE;
3904 }
3905
3906 /* Generate a v6 exception return.  Marks both values as dead.  */
3907 static void gen_rfe(DisasContext *s, TCGv_i32 pc, TCGv_i32 cpsr)
3908 {
3909     gen_set_cpsr(cpsr, 0xffffffff);
3910     tcg_temp_free_i32(cpsr);
3911     store_reg(s, 15, pc);
3912     s->is_jmp = DISAS_UPDATE;
3913 }
3914
3915 static inline void
3916 gen_set_condexec (DisasContext *s)
3917 {
3918     if (s->condexec_mask) {
3919         uint32_t val = (s->condexec_cond << 4) | (s->condexec_mask >> 1);
3920         TCGv_i32 tmp = tcg_temp_new_i32();
3921         tcg_gen_movi_i32(tmp, val);
3922         store_cpu_field(tmp, condexec_bits);
3923     }
3924 }
3925
3926 static void gen_exception_insn(DisasContext *s, int offset, int excp)
3927 {
3928     gen_set_condexec(s);
3929     gen_set_pc_im(s, s->pc - offset);
3930     gen_exception(excp);
3931     s->is_jmp = DISAS_JUMP;
3932 }
3933
3934 static void gen_nop_hint(DisasContext *s, int val)
3935 {
3936     switch (val) {
3937     case 3: /* wfi */
3938         gen_set_pc_im(s, s->pc);
3939         s->is_jmp = DISAS_WFI;
3940         break;
3941     case 2: /* wfe */
3942         gen_set_pc_im(s, s->pc);
3943         s->is_jmp = DISAS_WFE;
3944         break;
3945     case 4: /* sev */
3946     case 5: /* sevl */
3947         /* TODO: Implement SEV, SEVL and WFE.  May help SMP performance.  */
3948     default: /* nop */
3949         break;
3950     }
3951 }
3952
3953 #define CPU_V001 cpu_V0, cpu_V0, cpu_V1
3954
3955 static inline void gen_neon_add(int size, TCGv_i32 t0, TCGv_i32 t1)
3956 {
3957     switch (size) {
3958     case 0: gen_helper_neon_add_u8(t0, t0, t1); break;
3959     case 1: gen_helper_neon_add_u16(t0, t0, t1); break;
3960     case 2: tcg_gen_add_i32(t0, t0, t1); break;
3961     default: abort();
3962     }
3963 }
3964
3965 static inline void gen_neon_rsb(int size, TCGv_i32 t0, TCGv_i32 t1)
3966 {
3967     switch (size) {
3968     case 0: gen_helper_neon_sub_u8(t0, t1, t0); break;
3969     case 1: gen_helper_neon_sub_u16(t0, t1, t0); break;
3970     case 2: tcg_gen_sub_i32(t0, t1, t0); break;
3971     default: return;
3972     }
3973 }
3974
3975 /* 32-bit pairwise ops end up the same as the elementwise versions.  */
3976 #define gen_helper_neon_pmax_s32  gen_helper_neon_max_s32
3977 #define gen_helper_neon_pmax_u32  gen_helper_neon_max_u32
3978 #define gen_helper_neon_pmin_s32  gen_helper_neon_min_s32
3979 #define gen_helper_neon_pmin_u32  gen_helper_neon_min_u32
3980
3981 #define GEN_NEON_INTEGER_OP_ENV(name) do { \
3982     switch ((size << 1) | u) { \
3983     case 0: \
3984         gen_helper_neon_##name##_s8(tmp, cpu_env, tmp, tmp2); \
3985         break; \
3986     case 1: \
3987         gen_helper_neon_##name##_u8(tmp, cpu_env, tmp, tmp2); \
3988         break; \
3989     case 2: \
3990         gen_helper_neon_##name##_s16(tmp, cpu_env, tmp, tmp2); \
3991         break; \
3992     case 3: \
3993         gen_helper_neon_##name##_u16(tmp, cpu_env, tmp, tmp2); \
3994         break; \
3995     case 4: \
3996         gen_helper_neon_##name##_s32(tmp, cpu_env, tmp, tmp2); \
3997         break; \
3998     case 5: \
3999         gen_helper_neon_##name##_u32(tmp, cpu_env, tmp, tmp2); \
4000         break; \
4001     default: return 1; \
4002     }} while (0)
4003
4004 #define GEN_NEON_INTEGER_OP(name) do { \
4005     switch ((size << 1) | u) { \
4006     case 0: \
4007         gen_helper_neon_##name##_s8(tmp, tmp, tmp2); \
4008         break; \
4009     case 1: \
4010         gen_helper_neon_##name##_u8(tmp, tmp, tmp2); \
4011         break; \
4012     case 2: \
4013         gen_helper_neon_##name##_s16(tmp, tmp, tmp2); \
4014         break; \
4015     case 3: \
4016         gen_helper_neon_##name##_u16(tmp, tmp, tmp2); \
4017         break; \
4018     case 4: \
4019         gen_helper_neon_##name##_s32(tmp, tmp, tmp2); \
4020         break; \
4021     case 5: \
4022         gen_helper_neon_##name##_u32(tmp, tmp, tmp2); \
4023         break; \
4024     default: return 1; \
4025     }} while (0)
4026
4027 static TCGv_i32 neon_load_scratch(int scratch)
4028 {
4029     TCGv_i32 tmp = tcg_temp_new_i32();
4030     tcg_gen_ld_i32(tmp, cpu_env, offsetof(CPUARMState, vfp.scratch[scratch]));
4031     return tmp;
4032 }
4033
4034 static void neon_store_scratch(int scratch, TCGv_i32 var)
4035 {
4036     tcg_gen_st_i32(var, cpu_env, offsetof(CPUARMState, vfp.scratch[scratch]));
4037     tcg_temp_free_i32(var);
4038 }
4039
4040 static inline TCGv_i32 neon_get_scalar(int size, int reg)
4041 {
4042     TCGv_i32 tmp;
4043     if (size == 1) {
4044         tmp = neon_load_reg(reg & 7, reg >> 4);
4045         if (reg & 8) {
4046             gen_neon_dup_high16(tmp);
4047         } else {
4048             gen_neon_dup_low16(tmp);
4049         }
4050     } else {
4051         tmp = neon_load_reg(reg & 15, reg >> 4);
4052     }
4053     return tmp;
4054 }
4055
4056 static int gen_neon_unzip(int rd, int rm, int size, int q)
4057 {
4058     TCGv_i32 tmp, tmp2;
4059     if (!q && size == 2) {
4060         return 1;
4061     }
4062     tmp = tcg_const_i32(rd);
4063     tmp2 = tcg_const_i32(rm);
4064     if (q) {
4065         switch (size) {
4066         case 0:
4067             gen_helper_neon_qunzip8(cpu_env, tmp, tmp2);
4068             break;
4069         case 1:
4070             gen_helper_neon_qunzip16(cpu_env, tmp, tmp2);
4071             break;
4072         case 2:
4073             gen_helper_neon_qunzip32(cpu_env, tmp, tmp2);
4074             break;
4075         default:
4076             abort();
4077         }
4078     } else {
4079         switch (size) {
4080         case 0:
4081             gen_helper_neon_unzip8(cpu_env, tmp, tmp2);
4082             break;
4083         case 1:
4084             gen_helper_neon_unzip16(cpu_env, tmp, tmp2);
4085             break;
4086         default:
4087             abort();
4088         }
4089     }
4090     tcg_temp_free_i32(tmp);
4091     tcg_temp_free_i32(tmp2);
4092     return 0;
4093 }
4094
4095 static int gen_neon_zip(int rd, int rm, int size, int q)
4096 {
4097     TCGv_i32 tmp, tmp2;
4098     if (!q && size == 2) {
4099         return 1;
4100     }
4101     tmp = tcg_const_i32(rd);
4102     tmp2 = tcg_const_i32(rm);
4103     if (q) {
4104         switch (size) {
4105         case 0:
4106             gen_helper_neon_qzip8(cpu_env, tmp, tmp2);
4107             break;
4108         case 1:
4109             gen_helper_neon_qzip16(cpu_env, tmp, tmp2);
4110             break;
4111         case 2:
4112             gen_helper_neon_qzip32(cpu_env, tmp, tmp2);
4113             break;
4114         default:
4115             abort();
4116         }
4117     } else {
4118         switch (size) {
4119         case 0:
4120             gen_helper_neon_zip8(cpu_env, tmp, tmp2);
4121             break;
4122         case 1:
4123             gen_helper_neon_zip16(cpu_env, tmp, tmp2);
4124             break;
4125         default:
4126             abort();
4127         }
4128     }
4129     tcg_temp_free_i32(tmp);
4130     tcg_temp_free_i32(tmp2);
4131     return 0;
4132 }
4133
4134 static void gen_neon_trn_u8(TCGv_i32 t0, TCGv_i32 t1)
4135 {
4136     TCGv_i32 rd, tmp;
4137
4138     rd = tcg_temp_new_i32();
4139     tmp = tcg_temp_new_i32();
4140
4141     tcg_gen_shli_i32(rd, t0, 8);
4142     tcg_gen_andi_i32(rd, rd, 0xff00ff00);
4143     tcg_gen_andi_i32(tmp, t1, 0x00ff00ff);
4144     tcg_gen_or_i32(rd, rd, tmp);
4145
4146     tcg_gen_shri_i32(t1, t1, 8);
4147     tcg_gen_andi_i32(t1, t1, 0x00ff00ff);
4148     tcg_gen_andi_i32(tmp, t0, 0xff00ff00);
4149     tcg_gen_or_i32(t1, t1, tmp);
4150     tcg_gen_mov_i32(t0, rd);
4151
4152     tcg_temp_free_i32(tmp);
4153     tcg_temp_free_i32(rd);
4154 }
4155
4156 static void gen_neon_trn_u16(TCGv_i32 t0, TCGv_i32 t1)
4157 {
4158     TCGv_i32 rd, tmp;
4159
4160     rd = tcg_temp_new_i32();
4161     tmp = tcg_temp_new_i32();
4162
4163     tcg_gen_shli_i32(rd, t0, 16);
4164     tcg_gen_andi_i32(tmp, t1, 0xffff);
4165     tcg_gen_or_i32(rd, rd, tmp);
4166     tcg_gen_shri_i32(t1, t1, 16);
4167     tcg_gen_andi_i32(tmp, t0, 0xffff0000);
4168     tcg_gen_or_i32(t1, t1, tmp);
4169     tcg_gen_mov_i32(t0, rd);
4170
4171     tcg_temp_free_i32(tmp);
4172     tcg_temp_free_i32(rd);
4173 }
4174
4175
4176 static struct {
4177     int nregs;
4178     int interleave;
4179     int spacing;
4180 } neon_ls_element_type[11] = {
4181     {4, 4, 1},
4182     {4, 4, 2},
4183     {4, 1, 1},
4184     {4, 2, 1},
4185     {3, 3, 1},
4186     {3, 3, 2},
4187     {3, 1, 1},
4188     {1, 1, 1},
4189     {2, 2, 1},
4190     {2, 2, 2},
4191     {2, 1, 1}
4192 };
4193
4194 /* Translate a NEON load/store element instruction.  Return nonzero if the
4195    instruction is invalid.  */
4196 static int disas_neon_ls_insn(CPUARMState * env, DisasContext *s, uint32_t insn)
4197 {
4198     int rd, rn, rm;
4199     int op;
4200     int nregs;
4201     int interleave;
4202     int spacing;
4203     int stride;
4204     int size;
4205     int reg;
4206     int pass;
4207     int load;
4208     int shift;
4209     int n;
4210     TCGv_i32 addr;
4211     TCGv_i32 tmp;
4212     TCGv_i32 tmp2;
4213     TCGv_i64 tmp64;
4214
4215     if (!s->vfp_enabled)
4216       return 1;
4217     VFP_DREG_D(rd, insn);
4218     rn = (insn >> 16) & 0xf;
4219     rm = insn & 0xf;
4220     load = (insn & (1 << 21)) != 0;
4221     if ((insn & (1 << 23)) == 0) {
4222         /* Load store all elements.  */
4223         op = (insn >> 8) & 0xf;
4224         size = (insn >> 6) & 3;
4225         if (op > 10)
4226             return 1;
4227         /* Catch UNDEF cases for bad values of align field */
4228         switch (op & 0xc) {
4229         case 4:
4230             if (((insn >> 5) & 1) == 1) {
4231                 return 1;
4232             }
4233             break;
4234         case 8:
4235             if (((insn >> 4) & 3) == 3) {
4236                 return 1;
4237             }
4238             break;
4239         default:
4240             break;
4241         }
4242         nregs = neon_ls_element_type[op].nregs;
4243         interleave = neon_ls_element_type[op].interleave;
4244         spacing = neon_ls_element_type[op].spacing;
4245         if (size == 3 && (interleave | spacing) != 1)
4246             return 1;
4247         addr = tcg_temp_new_i32();
4248         load_reg_var(s, addr, rn);
4249         stride = (1 << size) * interleave;
4250         for (reg = 0; reg < nregs; reg++) {
4251             if (interleave > 2 || (interleave == 2 && nregs == 2)) {
4252                 load_reg_var(s, addr, rn);
4253                 tcg_gen_addi_i32(addr, addr, (1 << size) * reg);
4254             } else if (interleave == 2 && nregs == 4 && reg == 2) {
4255                 load_reg_var(s, addr, rn);
4256                 tcg_gen_addi_i32(addr, addr, 1 << size);
4257             }
4258             if (size == 3) {
4259                 tmp64 = tcg_temp_new_i64();
4260                 if (load) {
4261                     gen_aa32_ld64(tmp64, addr, IS_USER(s));
4262                     neon_store_reg64(tmp64, rd);
4263                 } else {
4264                     neon_load_reg64(tmp64, rd);
4265                     gen_aa32_st64(tmp64, addr, IS_USER(s));
4266                 }
4267                 tcg_temp_free_i64(tmp64);
4268                 tcg_gen_addi_i32(addr, addr, stride);
4269             } else {
4270                 for (pass = 0; pass < 2; pass++) {
4271                     if (size == 2) {
4272                         if (load) {
4273                             tmp = tcg_temp_new_i32();
4274                             gen_aa32_ld32u(tmp, addr, IS_USER(s));
4275                             neon_store_reg(rd, pass, tmp);
4276                         } else {
4277                             tmp = neon_load_reg(rd, pass);
4278                             gen_aa32_st32(tmp, addr, IS_USER(s));
4279                             tcg_temp_free_i32(tmp);
4280                         }
4281                         tcg_gen_addi_i32(addr, addr, stride);
4282                     } else if (size == 1) {
4283                         if (load) {
4284                             tmp = tcg_temp_new_i32();
4285                             gen_aa32_ld16u(tmp, addr, IS_USER(s));
4286                             tcg_gen_addi_i32(addr, addr, stride);
4287                             tmp2 = tcg_temp_new_i32();
4288                             gen_aa32_ld16u(tmp2, addr, IS_USER(s));
4289                             tcg_gen_addi_i32(addr, addr, stride);
4290                             tcg_gen_shli_i32(tmp2, tmp2, 16);
4291                             tcg_gen_or_i32(tmp, tmp, tmp2);
4292                             tcg_temp_free_i32(tmp2);
4293                             neon_store_reg(rd, pass, tmp);
4294                         } else {
4295                             tmp = neon_load_reg(rd, pass);
4296                             tmp2 = tcg_temp_new_i32();
4297                             tcg_gen_shri_i32(tmp2, tmp, 16);
4298                             gen_aa32_st16(tmp, addr, IS_USER(s));
4299                             tcg_temp_free_i32(tmp);
4300                             tcg_gen_addi_i32(addr, addr, stride);
4301                             gen_aa32_st16(tmp2, addr, IS_USER(s));
4302                             tcg_temp_free_i32(tmp2);
4303                             tcg_gen_addi_i32(addr, addr, stride);
4304                         }
4305                     } else /* size == 0 */ {
4306                         if (load) {
4307                             TCGV_UNUSED_I32(tmp2);
4308                             for (n = 0; n < 4; n++) {
4309                                 tmp = tcg_temp_new_i32();
4310                                 gen_aa32_ld8u(tmp, addr, IS_USER(s));
4311                                 tcg_gen_addi_i32(addr, addr, stride);
4312                                 if (n == 0) {
4313                                     tmp2 = tmp;
4314                                 } else {
4315                                     tcg_gen_shli_i32(tmp, tmp, n * 8);
4316                                     tcg_gen_or_i32(tmp2, tmp2, tmp);
4317                                     tcg_temp_free_i32(tmp);
4318                                 }
4319                             }
4320                             neon_store_reg(rd, pass, tmp2);
4321                         } else {
4322                             tmp2 = neon_load_reg(rd, pass);
4323                             for (n = 0; n < 4; n++) {
4324                                 tmp = tcg_temp_new_i32();
4325                                 if (n == 0) {
4326                                     tcg_gen_mov_i32(tmp, tmp2);
4327                                 } else {
4328                                     tcg_gen_shri_i32(tmp, tmp2, n * 8);
4329                                 }
4330                                 gen_aa32_st8(tmp, addr, IS_USER(s));
4331                                 tcg_temp_free_i32(tmp);
4332                                 tcg_gen_addi_i32(addr, addr, stride);
4333                             }
4334                             tcg_temp_free_i32(tmp2);
4335                         }
4336                     }
4337                 }
4338             }
4339             rd += spacing;
4340         }
4341         tcg_temp_free_i32(addr);
4342         stride = nregs * 8;
4343     } else {
4344         size = (insn >> 10) & 3;
4345         if (size == 3) {
4346             /* Load single element to all lanes.  */
4347             int a = (insn >> 4) & 1;
4348             if (!load) {
4349                 return 1;
4350             }
4351             size = (insn >> 6) & 3;
4352             nregs = ((insn >> 8) & 3) + 1;
4353
4354             if (size == 3) {
4355                 if (nregs != 4 || a == 0) {
4356                     return 1;
4357                 }
4358                 /* For VLD4 size==3 a == 1 means 32 bits at 16 byte alignment */
4359                 size = 2;
4360             }
4361             if (nregs == 1 && a == 1 && size == 0) {
4362                 return 1;
4363             }
4364             if (nregs == 3 && a == 1) {
4365                 return 1;
4366             }
4367             addr = tcg_temp_new_i32();
4368             load_reg_var(s, addr, rn);
4369             if (nregs == 1) {
4370                 /* VLD1 to all lanes: bit 5 indicates how many Dregs to write */
4371                 tmp = gen_load_and_replicate(s, addr, size);
4372                 tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd, 0));
4373                 tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd, 1));
4374                 if (insn & (1 << 5)) {
4375                     tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd + 1, 0));
4376                     tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd + 1, 1));
4377                 }
4378                 tcg_temp_free_i32(tmp);
4379             } else {
4380                 /* VLD2/3/4 to all lanes: bit 5 indicates register stride */
4381                 stride = (insn & (1 << 5)) ? 2 : 1;
4382                 for (reg = 0; reg < nregs; reg++) {
4383                     tmp = gen_load_and_replicate(s, addr, size);
4384                     tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd, 0));
4385                     tcg_gen_st_i32(tmp, cpu_env, neon_reg_offset(rd, 1));
4386                     tcg_temp_free_i32(tmp);
4387                     tcg_gen_addi_i32(addr, addr, 1 << size);
4388                     rd += stride;
4389                 }
4390             }
4391             tcg_temp_free_i32(addr);
4392             stride = (1 << size) * nregs;
4393         } else {
4394             /* Single element.  */
4395             int idx = (insn >> 4) & 0xf;
4396             pass = (insn >> 7) & 1;
4397             switch (size) {
4398             case 0:
4399                 shift = ((insn >> 5) & 3) * 8;
4400                 stride = 1;
4401                 break;
4402             case 1:
4403                 shift = ((insn >> 6) & 1) * 16;
4404                 stride = (insn & (1 << 5)) ? 2 : 1;
4405                 break;
4406             case 2:
4407                 shift = 0;
4408                 stride = (insn & (1 << 6)) ? 2 : 1;
4409                 break;
4410             default:
4411                 abort();
4412             }
4413             nregs = ((insn >> 8) & 3) + 1;
4414             /* Catch the UNDEF cases. This is unavoidably a bit messy. */
4415             switch (nregs) {
4416             case 1:
4417                 if (((idx & (1 << size)) != 0) ||
4418                     (size == 2 && ((idx & 3) == 1 || (idx & 3) == 2))) {
4419                     return 1;
4420                 }
4421                 break;
4422             case 3:
4423                 if ((idx & 1) != 0) {
4424                     return 1;
4425                 }
4426                 /* fall through */
4427             case 2:
4428                 if (size == 2 && (idx & 2) != 0) {
4429                     return 1;
4430                 }
4431                 break;
4432             case 4:
4433                 if ((size == 2) && ((idx & 3) == 3)) {
4434                     return 1;
4435                 }
4436                 break;
4437             default:
4438                 abort();
4439             }
4440             if ((rd + stride * (nregs - 1)) > 31) {
4441                 /* Attempts to write off the end of the register file
4442                  * are UNPREDICTABLE; we choose to UNDEF because otherwise
4443                  * the neon_load_reg() would write off the end of the array.
4444                  */
4445                 return 1;
4446             }
4447             addr = tcg_temp_new_i32();
4448             load_reg_var(s, addr, rn);
4449             for (reg = 0; reg < nregs; reg++) {
4450                 if (load) {
4451                     tmp = tcg_temp_new_i32();
4452                     switch (size) {
4453                     case 0:
4454                         gen_aa32_ld8u(tmp, addr, IS_USER(s));
4455                         break;
4456                     case 1:
4457                         gen_aa32_ld16u(tmp, addr, IS_USER(s));
4458                         break;
4459                     case 2:
4460                         gen_aa32_ld32u(tmp, addr, IS_USER(s));
4461                         break;
4462                     default: /* Avoid compiler warnings.  */
4463                         abort();
4464                     }
4465                     if (size != 2) {
4466                         tmp2 = neon_load_reg(rd, pass);
4467                         tcg_gen_deposit_i32(tmp, tmp2, tmp,
4468                                             shift, size ? 16 : 8);
4469                         tcg_temp_free_i32(tmp2);
4470                     }
4471                     neon_store_reg(rd, pass, tmp);
4472                 } else { /* Store */
4473                     tmp = neon_load_reg(rd, pass);
4474                     if (shift)
4475                         tcg_gen_shri_i32(tmp, tmp, shift);
4476                     switch (size) {
4477                     case 0:
4478                         gen_aa32_st8(tmp, addr, IS_USER(s));
4479                         break;
4480                     case 1:
4481                         gen_aa32_st16(tmp, addr, IS_USER(s));
4482                         break;
4483                     case 2:
4484                         gen_aa32_st32(tmp, addr, IS_USER(s));
4485                         break;
4486                     }
4487                     tcg_temp_free_i32(tmp);
4488                 }
4489                 rd += stride;
4490                 tcg_gen_addi_i32(addr, addr, 1 << size);
4491             }
4492             tcg_temp_free_i32(addr);
4493             stride = nregs * (1 << size);
4494         }
4495     }
4496     if (rm != 15) {
4497         TCGv_i32 base;
4498
4499         base = load_reg(s, rn);
4500         if (rm == 13) {
4501             tcg_gen_addi_i32(base, base, stride);
4502         } else {
4503             TCGv_i32 index;
4504             index = load_reg(s, rm);
4505             tcg_gen_add_i32(base, base, index);
4506             tcg_temp_free_i32(index);
4507         }
4508         store_reg(s, rn, base);
4509     }
4510     return 0;
4511 }
4512
4513 /* Bitwise select.  dest = c ? t : f.  Clobbers T and F.  */
4514 static void gen_neon_bsl(TCGv_i32 dest, TCGv_i32 t, TCGv_i32 f, TCGv_i32 c)
4515 {
4516     tcg_gen_and_i32(t, t, c);
4517     tcg_gen_andc_i32(f, f, c);
4518     tcg_gen_or_i32(dest, t, f);
4519 }
4520
4521 static inline void gen_neon_narrow(int size, TCGv_i32 dest, TCGv_i64 src)
4522 {
4523     switch (size) {
4524     case 0: gen_helper_neon_narrow_u8(dest, src); break;
4525     case 1: gen_helper_neon_narrow_u16(dest, src); break;
4526     case 2: tcg_gen_trunc_i64_i32(dest, src); break;
4527     default: abort();
4528     }
4529 }
4530
4531 static inline void gen_neon_narrow_sats(int size, TCGv_i32 dest, TCGv_i64 src)
4532 {
4533     switch (size) {
4534     case 0: gen_helper_neon_narrow_sat_s8(dest, cpu_env, src); break;
4535     case 1: gen_helper_neon_narrow_sat_s16(dest, cpu_env, src); break;
4536     case 2: gen_helper_neon_narrow_sat_s32(dest, cpu_env, src); break;
4537     default: abort();
4538     }
4539 }
4540
4541 static inline void gen_neon_narrow_satu(int size, TCGv_i32 dest, TCGv_i64 src)
4542 {
4543     switch (size) {
4544     case 0: gen_helper_neon_narrow_sat_u8(dest, cpu_env, src); break;
4545     case 1: gen_helper_neon_narrow_sat_u16(dest, cpu_env, src); break;
4546     case 2: gen_helper_neon_narrow_sat_u32(dest, cpu_env, src); break;
4547     default: abort();
4548     }
4549 }
4550
4551 static inline void gen_neon_unarrow_sats(int size, TCGv_i32 dest, TCGv_i64 src)
4552 {
4553     switch (size) {
4554     case 0: gen_helper_neon_unarrow_sat8(dest, cpu_env, src); break;
4555     case 1: gen_helper_neon_unarrow_sat16(dest, cpu_env, src); break;
4556     case 2: gen_helper_neon_unarrow_sat32(dest, cpu_env, src); break;
4557     default: abort();
4558     }
4559 }
4560
4561 static inline void gen_neon_shift_narrow(int size, TCGv_i32 var, TCGv_i32 shift,
4562                                          int q, int u)
4563 {
4564     if (q) {
4565         if (u) {
4566             switch (size) {
4567             case 1: gen_helper_neon_rshl_u16(var, var, shift); break;
4568             case 2: gen_helper_neon_rshl_u32(var, var, shift); break;
4569             default: abort();
4570             }
4571         } else {
4572             switch (size) {
4573             case 1: gen_helper_neon_rshl_s16(var, var, shift); break;
4574             case 2: gen_helper_neon_rshl_s32(var, var, shift); break;
4575             default: abort();
4576             }
4577         }
4578     } else {
4579         if (u) {
4580             switch (size) {
4581             case 1: gen_helper_neon_shl_u16(var, var, shift); break;
4582             case 2: gen_helper_neon_shl_u32(var, var, shift); break;
4583             default: abort();
4584             }
4585         } else {
4586             switch (size) {
4587             case 1: gen_helper_neon_shl_s16(var, var, shift); break;
4588             case 2: gen_helper_neon_shl_s32(var, var, shift); break;
4589             default: abort();
4590             }
4591         }
4592     }
4593 }
4594
4595 static inline void gen_neon_widen(TCGv_i64 dest, TCGv_i32 src, int size, int u)
4596 {
4597     if (u) {
4598         switch (size) {
4599         case 0: gen_helper_neon_widen_u8(dest, src); break;
4600         case 1: gen_helper_neon_widen_u16(dest, src); break;
4601         case 2: tcg_gen_extu_i32_i64(dest, src); break;
4602         default: abort();
4603         }
4604     } else {
4605         switch (size) {
4606         case 0: gen_helper_neon_widen_s8(dest, src); break;
4607         case 1: gen_helper_neon_widen_s16(dest, src); break;
4608         case 2: tcg_gen_ext_i32_i64(dest, src); break;
4609         default: abort();
4610         }
4611     }
4612     tcg_temp_free_i32(src);
4613 }
4614
4615 static inline void gen_neon_addl(int size)
4616 {
4617     switch (size) {
4618     case 0: gen_helper_neon_addl_u16(CPU_V001); break;
4619     case 1: gen_helper_neon_addl_u32(CPU_V001); break;
4620     case 2: tcg_gen_add_i64(CPU_V001); break;
4621     default: abort();
4622     }
4623 }
4624
4625 static inline void gen_neon_subl(int size)
4626 {
4627     switch (size) {
4628     case 0: gen_helper_neon_subl_u16(CPU_V001); break;
4629     case 1: gen_helper_neon_subl_u32(CPU_V001); break;
4630     case 2: tcg_gen_sub_i64(CPU_V001); break;
4631     default: abort();
4632     }
4633 }
4634
4635 static inline void gen_neon_negl(TCGv_i64 var, int size)
4636 {
4637     switch (size) {
4638     case 0: gen_helper_neon_negl_u16(var, var); break;
4639     case 1: gen_helper_neon_negl_u32(var, var); break;
4640     case 2:
4641         tcg_gen_neg_i64(var, var);
4642         break;
4643     default: abort();
4644     }
4645 }
4646
4647 static inline void gen_neon_addl_saturate(TCGv_i64 op0, TCGv_i64 op1, int size)
4648 {
4649     switch (size) {
4650     case 1: gen_helper_neon_addl_saturate_s32(op0, cpu_env, op0, op1); break;
4651     case 2: gen_helper_neon_addl_saturate_s64(op0, cpu_env, op0, op1); break;
4652     default: abort();
4653     }
4654 }
4655
4656 static inline void gen_neon_mull(TCGv_i64 dest, TCGv_i32 a, TCGv_i32 b,
4657                                  int size, int u)
4658 {
4659     TCGv_i64 tmp;
4660
4661     switch ((size << 1) | u) {
4662     case 0: gen_helper_neon_mull_s8(dest, a, b); break;
4663     case 1: gen_helper_neon_mull_u8(dest, a, b); break;
4664     case 2: gen_helper_neon_mull_s16(dest, a, b); break;
4665     case 3: gen_helper_neon_mull_u16(dest, a, b); break;
4666     case 4:
4667         tmp = gen_muls_i64_i32(a, b);
4668         tcg_gen_mov_i64(dest, tmp);
4669         tcg_temp_free_i64(tmp);
4670         break;
4671     case 5:
4672         tmp = gen_mulu_i64_i32(a, b);
4673         tcg_gen_mov_i64(dest, tmp);
4674         tcg_temp_free_i64(tmp);
4675         break;
4676     default: abort();
4677     }
4678
4679     /* gen_helper_neon_mull_[su]{8|16} do not free their parameters.
4680        Don't forget to clean them now.  */
4681     if (size < 2) {
4682         tcg_temp_free_i32(a);
4683         tcg_temp_free_i32(b);
4684     }
4685 }
4686
4687 static void gen_neon_narrow_op(int op, int u, int size,
4688                                TCGv_i32 dest, TCGv_i64 src)
4689 {
4690     if (op) {
4691         if (u) {
4692             gen_neon_unarrow_sats(size, dest, src);
4693         } else {
4694             gen_neon_narrow(size, dest, src);
4695         }
4696     } else {
4697         if (u) {
4698             gen_neon_narrow_satu(size, dest, src);
4699         } else {
4700             gen_neon_narrow_sats(size, dest, src);
4701         }
4702     }
4703 }
4704
4705 /* Symbolic constants for op fields for Neon 3-register same-length.
4706  * The values correspond to bits [11:8,4]; see the ARM ARM DDI0406B
4707  * table A7-9.
4708  */
4709 #define NEON_3R_VHADD 0
4710 #define NEON_3R_VQADD 1
4711 #define NEON_3R_VRHADD 2
4712 #define NEON_3R_LOGIC 3 /* VAND,VBIC,VORR,VMOV,VORN,VEOR,VBIF,VBIT,VBSL */
4713 #define NEON_3R_VHSUB 4
4714 #define NEON_3R_VQSUB 5
4715 #define NEON_3R_VCGT 6
4716 #define NEON_3R_VCGE 7
4717 #define NEON_3R_VSHL 8
4718 #define NEON_3R_VQSHL 9
4719 #define NEON_3R_VRSHL 10
4720 #define NEON_3R_VQRSHL 11
4721 #define NEON_3R_VMAX 12
4722 #define NEON_3R_VMIN 13
4723 #define NEON_3R_VABD 14
4724 #define NEON_3R_VABA 15
4725 #define NEON_3R_VADD_VSUB 16
4726 #define NEON_3R_VTST_VCEQ 17
4727 #define NEON_3R_VML 18 /* VMLA, VMLAL, VMLS, VMLSL */
4728 #define NEON_3R_VMUL 19
4729 #define NEON_3R_VPMAX 20
4730 #define NEON_3R_VPMIN 21
4731 #define NEON_3R_VQDMULH_VQRDMULH 22
4732 #define NEON_3R_VPADD 23
4733 #define NEON_3R_VFM 25 /* VFMA, VFMS : float fused multiply-add */
4734 #define NEON_3R_FLOAT_ARITH 26 /* float VADD, VSUB, VPADD, VABD */
4735 #define NEON_3R_FLOAT_MULTIPLY 27 /* float VMLA, VMLS, VMUL */
4736 #define NEON_3R_FLOAT_CMP 28 /* float VCEQ, VCGE, VCGT */
4737 #define NEON_3R_FLOAT_ACMP 29 /* float VACGE, VACGT, VACLE, VACLT */
4738 #define NEON_3R_FLOAT_MINMAX 30 /* float VMIN, VMAX */
4739 #define NEON_3R_FLOAT_MISC 31 /* float VRECPS, VRSQRTS, VMAXNM/MINNM */
4740
4741 static const uint8_t neon_3r_sizes[] = {
4742     [NEON_3R_VHADD] = 0x7,
4743     [NEON_3R_VQADD] = 0xf,
4744     [NEON_3R_VRHADD] = 0x7,
4745     [NEON_3R_LOGIC] = 0xf, /* size field encodes op type */
4746     [NEON_3R_VHSUB] = 0x7,
4747     [NEON_3R_VQSUB] = 0xf,
4748     [NEON_3R_VCGT] = 0x7,
4749     [NEON_3R_VCGE] = 0x7,
4750     [NEON_3R_VSHL] = 0xf,
4751     [NEON_3R_VQSHL] = 0xf,
4752     [NEON_3R_VRSHL] = 0xf,
4753     [NEON_3R_VQRSHL] = 0xf,
4754     [NEON_3R_VMAX] = 0x7,
4755     [NEON_3R_VMIN] = 0x7,
4756     [NEON_3R_VABD] = 0x7,
4757     [NEON_3R_VABA] = 0x7,
4758     [NEON_3R_VADD_VSUB] = 0xf,
4759     [NEON_3R_VTST_VCEQ] = 0x7,
4760     [NEON_3R_VML] = 0x7,
4761     [NEON_3R_VMUL] = 0x7,
4762     [NEON_3R_VPMAX] = 0x7,
4763     [NEON_3R_VPMIN] = 0x7,
4764     [NEON_3R_VQDMULH_VQRDMULH] = 0x6,
4765     [NEON_3R_VPADD] = 0x7,
4766     [NEON_3R_VFM] = 0x5, /* size bit 1 encodes op */
4767     [NEON_3R_FLOAT_ARITH] = 0x5, /* size bit 1 encodes op */
4768     [NEON_3R_FLOAT_MULTIPLY] = 0x5, /* size bit 1 encodes op */
4769     [NEON_3R_FLOAT_CMP] = 0x5, /* size bit 1 encodes op */
4770     [NEON_3R_FLOAT_ACMP] = 0x5, /* size bit 1 encodes op */
4771     [NEON_3R_FLOAT_MINMAX] = 0x5, /* size bit 1 encodes op */
4772     [NEON_3R_FLOAT_MISC] = 0x5, /* size bit 1 encodes op */
4773 };
4774
4775 /* Symbolic constants for op fields for Neon 2-register miscellaneous.
4776  * The values correspond to bits [17:16,10:7]; see the ARM ARM DDI0406B
4777  * table A7-13.
4778  */
4779 #define NEON_2RM_VREV64 0
4780 #define NEON_2RM_VREV32 1
4781 #define NEON_2RM_VREV16 2
4782 #define NEON_2RM_VPADDL 4
4783 #define NEON_2RM_VPADDL_U 5
4784 #define NEON_2RM_AESE 6 /* Includes AESD */
4785 #define NEON_2RM_AESMC 7 /* Includes AESIMC */
4786 #define NEON_2RM_VCLS 8
4787 #define NEON_2RM_VCLZ 9
4788 #define NEON_2RM_VCNT 10
4789 #define NEON_2RM_VMVN 11
4790 #define NEON_2RM_VPADAL 12
4791 #define NEON_2RM_VPADAL_U 13
4792 #define NEON_2RM_VQABS 14
4793 #define NEON_2RM_VQNEG 15
4794 #define NEON_2RM_VCGT0 16
4795 #define NEON_2RM_VCGE0 17
4796 #define NEON_2RM_VCEQ0 18
4797 #define NEON_2RM_VCLE0 19
4798 #define NEON_2RM_VCLT0 20
4799 #define NEON_2RM_VABS 22
4800 #define NEON_2RM_VNEG 23
4801 #define NEON_2RM_VCGT0_F 24
4802 #define NEON_2RM_VCGE0_F 25
4803 #define NEON_2RM_VCEQ0_F 26
4804 #define NEON_2RM_VCLE0_F 27
4805 #define NEON_2RM_VCLT0_F 28
4806 #define NEON_2RM_VABS_F 30
4807 #define NEON_2RM_VNEG_F 31
4808 #define NEON_2RM_VSWP 32
4809 #define NEON_2RM_VTRN 33
4810 #define NEON_2RM_VUZP 34
4811 #define NEON_2RM_VZIP 35
4812 #define NEON_2RM_VMOVN 36 /* Includes VQMOVN, VQMOVUN */
4813 #define NEON_2RM_VQMOVN 37 /* Includes VQMOVUN */
4814 #define NEON_2RM_VSHLL 38
4815 #define NEON_2RM_VRINTN 40
4816 #define NEON_2RM_VRINTX 41
4817 #define NEON_2RM_VRINTA 42
4818 #define NEON_2RM_VRINTZ 43
4819 #define NEON_2RM_VCVT_F16_F32 44
4820 #define NEON_2RM_VRINTM 45
4821 #define NEON_2RM_VCVT_F32_F16 46
4822 #define NEON_2RM_VRINTP 47
4823 #define NEON_2RM_VCVTAU 48
4824 #define NEON_2RM_VCVTAS 49
4825 #define NEON_2RM_VCVTNU 50
4826 #define NEON_2RM_VCVTNS 51
4827 #define NEON_2RM_VCVTPU 52
4828 #define NEON_2RM_VCVTPS 53
4829 #define NEON_2RM_VCVTMU 54
4830 #define NEON_2RM_VCVTMS 55
4831 #define NEON_2RM_VRECPE 56
4832 #define NEON_2RM_VRSQRTE 57
4833 #define NEON_2RM_VRECPE_F 58
4834 #define NEON_2RM_VRSQRTE_F 59
4835 #define NEON_2RM_VCVT_FS 60
4836 #define NEON_2RM_VCVT_FU 61
4837 #define NEON_2RM_VCVT_SF 62
4838 #define NEON_2RM_VCVT_UF 63
4839
4840 static int neon_2rm_is_float_op(int op)
4841 {
4842     /* Return true if this neon 2reg-misc op is float-to-float */
4843     return (op == NEON_2RM_VABS_F || op == NEON_2RM_VNEG_F ||
4844             (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
4845             op == NEON_2RM_VRINTM ||
4846             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
4847             op >= NEON_2RM_VRECPE_F);
4848 }
4849
4850 /* Each entry in this array has bit n set if the insn allows
4851  * size value n (otherwise it will UNDEF). Since unallocated
4852  * op values will have no bits set they always UNDEF.
4853  */
4854 static const uint8_t neon_2rm_sizes[] = {
4855     [NEON_2RM_VREV64] = 0x7,
4856     [NEON_2RM_VREV32] = 0x3,
4857     [NEON_2RM_VREV16] = 0x1,
4858     [NEON_2RM_VPADDL] = 0x7,
4859     [NEON_2RM_VPADDL_U] = 0x7,
4860     [NEON_2RM_AESE] = 0x1,
4861     [NEON_2RM_AESMC] = 0x1,
4862     [NEON_2RM_VCLS] = 0x7,
4863     [NEON_2RM_VCLZ] = 0x7,
4864     [NEON_2RM_VCNT] = 0x1,
4865     [NEON_2RM_VMVN] = 0x1,
4866     [NEON_2RM_VPADAL] = 0x7,
4867     [NEON_2RM_VPADAL_U] = 0x7,
4868     [NEON_2RM_VQABS] = 0x7,
4869     [NEON_2RM_VQNEG] = 0x7,
4870     [NEON_2RM_VCGT0] = 0x7,
4871     [NEON_2RM_VCGE0] = 0x7,
4872     [NEON_2RM_VCEQ0] = 0x7,
4873     [NEON_2RM_VCLE0] = 0x7,
4874     [NEON_2RM_VCLT0] = 0x7,
4875     [NEON_2RM_VABS] = 0x7,
4876     [NEON_2RM_VNEG] = 0x7,
4877     [NEON_2RM_VCGT0_F] = 0x4,
4878     [NEON_2RM_VCGE0_F] = 0x4,
4879     [NEON_2RM_VCEQ0_F] = 0x4,
4880     [NEON_2RM_VCLE0_F] = 0x4,
4881     [NEON_2RM_VCLT0_F] = 0x4,
4882     [NEON_2RM_VABS_F] = 0x4,
4883     [NEON_2RM_VNEG_F] = 0x4,
4884     [NEON_2RM_VSWP] = 0x1,
4885     [NEON_2RM_VTRN] = 0x7,
4886     [NEON_2RM_VUZP] = 0x7,
4887     [NEON_2RM_VZIP] = 0x7,
4888     [NEON_2RM_VMOVN] = 0x7,
4889     [NEON_2RM_VQMOVN] = 0x7,
4890     [NEON_2RM_VSHLL] = 0x7,
4891     [NEON_2RM_VRINTN] = 0x4,
4892     [NEON_2RM_VRINTX] = 0x4,
4893     [NEON_2RM_VRINTA] = 0x4,
4894     [NEON_2RM_VRINTZ] = 0x4,
4895     [NEON_2RM_VCVT_F16_F32] = 0x2,
4896     [NEON_2RM_VRINTM] = 0x4,
4897     [NEON_2RM_VCVT_F32_F16] = 0x2,
4898     [NEON_2RM_VRINTP] = 0x4,
4899     [NEON_2RM_VCVTAU] = 0x4,
4900     [NEON_2RM_VCVTAS] = 0x4,
4901     [NEON_2RM_VCVTNU] = 0x4,
4902     [NEON_2RM_VCVTNS] = 0x4,
4903     [NEON_2RM_VCVTPU] = 0x4,
4904     [NEON_2RM_VCVTPS] = 0x4,
4905     [NEON_2RM_VCVTMU] = 0x4,
4906     [NEON_2RM_VCVTMS] = 0x4,
4907     [NEON_2RM_VRECPE] = 0x4,
4908     [NEON_2RM_VRSQRTE] = 0x4,
4909     [NEON_2RM_VRECPE_F] = 0x4,
4910     [NEON_2RM_VRSQRTE_F] = 0x4,
4911     [NEON_2RM_VCVT_FS] = 0x4,
4912     [NEON_2RM_VCVT_FU] = 0x4,
4913     [NEON_2RM_VCVT_SF] = 0x4,
4914     [NEON_2RM_VCVT_UF] = 0x4,
4915 };
4916
4917 /* Translate a NEON data processing instruction.  Return nonzero if the
4918    instruction is invalid.
4919    We process data in a mixture of 32-bit and 64-bit chunks.
4920    Mostly we use 32-bit chunks so we can use normal scalar instructions.  */
4921
4922 static int disas_neon_data_insn(CPUARMState * env, DisasContext *s, uint32_t insn)
4923 {
4924     int op;
4925     int q;
4926     int rd, rn, rm;
4927     int size;
4928     int shift;
4929     int pass;
4930     int count;
4931     int pairwise;
4932     int u;
4933     uint32_t imm, mask;
4934     TCGv_i32 tmp, tmp2, tmp3, tmp4, tmp5;
4935     TCGv_i64 tmp64;
4936
4937     if (!s->vfp_enabled)
4938       return 1;
4939     q = (insn & (1 << 6)) != 0;
4940     u = (insn >> 24) & 1;
4941     VFP_DREG_D(rd, insn);
4942     VFP_DREG_N(rn, insn);
4943     VFP_DREG_M(rm, insn);
4944     size = (insn >> 20) & 3;
4945     if ((insn & (1 << 23)) == 0) {
4946         /* Three register same length.  */
4947         op = ((insn >> 7) & 0x1e) | ((insn >> 4) & 1);
4948         /* Catch invalid op and bad size combinations: UNDEF */
4949         if ((neon_3r_sizes[op] & (1 << size)) == 0) {
4950             return 1;
4951         }
4952         /* All insns of this form UNDEF for either this condition or the
4953          * superset of cases "Q==1"; we catch the latter later.
4954          */
4955         if (q && ((rd | rn | rm) & 1)) {
4956             return 1;
4957         }
4958         if (size == 3 && op != NEON_3R_LOGIC) {
4959             /* 64-bit element instructions. */
4960             for (pass = 0; pass < (q ? 2 : 1); pass++) {
4961                 neon_load_reg64(cpu_V0, rn + pass);
4962                 neon_load_reg64(cpu_V1, rm + pass);
4963                 switch (op) {
4964                 case NEON_3R_VQADD:
4965                     if (u) {
4966                         gen_helper_neon_qadd_u64(cpu_V0, cpu_env,
4967                                                  cpu_V0, cpu_V1);
4968                     } else {
4969                         gen_helper_neon_qadd_s64(cpu_V0, cpu_env,
4970                                                  cpu_V0, cpu_V1);
4971                     }
4972                     break;
4973                 case NEON_3R_VQSUB:
4974                     if (u) {
4975                         gen_helper_neon_qsub_u64(cpu_V0, cpu_env,
4976                                                  cpu_V0, cpu_V1);
4977                     } else {
4978                         gen_helper_neon_qsub_s64(cpu_V0, cpu_env,
4979                                                  cpu_V0, cpu_V1);
4980                     }
4981                     break;
4982                 case NEON_3R_VSHL:
4983                     if (u) {
4984                         gen_helper_neon_shl_u64(cpu_V0, cpu_V1, cpu_V0);
4985                     } else {
4986                         gen_helper_neon_shl_s64(cpu_V0, cpu_V1, cpu_V0);
4987                     }
4988                     break;
4989                 case NEON_3R_VQSHL:
4990                     if (u) {
4991                         gen_helper_neon_qshl_u64(cpu_V0, cpu_env,
4992                                                  cpu_V1, cpu_V0);
4993                     } else {
4994                         gen_helper_neon_qshl_s64(cpu_V0, cpu_env,
4995                                                  cpu_V1, cpu_V0);
4996                     }
4997                     break;
4998                 case NEON_3R_VRSHL:
4999                     if (u) {
5000                         gen_helper_neon_rshl_u64(cpu_V0, cpu_V1, cpu_V0);
5001                     } else {
5002                         gen_helper_neon_rshl_s64(cpu_V0, cpu_V1, cpu_V0);
5003                     }
5004                     break;
5005                 case NEON_3R_VQRSHL:
5006                     if (u) {
5007                         gen_helper_neon_qrshl_u64(cpu_V0, cpu_env,
5008                                                   cpu_V1, cpu_V0);
5009                     } else {
5010                         gen_helper_neon_qrshl_s64(cpu_V0, cpu_env,
5011                                                   cpu_V1, cpu_V0);
5012                     }
5013                     break;
5014                 case NEON_3R_VADD_VSUB:
5015                     if (u) {
5016                         tcg_gen_sub_i64(CPU_V001);
5017                     } else {
5018                         tcg_gen_add_i64(CPU_V001);
5019                     }
5020                     break;
5021                 default:
5022                     abort();
5023                 }
5024                 neon_store_reg64(cpu_V0, rd + pass);
5025             }
5026             return 0;
5027         }
5028         pairwise = 0;
5029         switch (op) {
5030         case NEON_3R_VSHL:
5031         case NEON_3R_VQSHL:
5032         case NEON_3R_VRSHL:
5033         case NEON_3R_VQRSHL:
5034             {
5035                 int rtmp;
5036                 /* Shift instruction operands are reversed.  */
5037                 rtmp = rn;
5038                 rn = rm;
5039                 rm = rtmp;
5040             }
5041             break;
5042         case NEON_3R_VPADD:
5043             if (u) {
5044                 return 1;
5045             }
5046             /* Fall through */
5047         case NEON_3R_VPMAX:
5048         case NEON_3R_VPMIN:
5049             pairwise = 1;
5050             break;
5051         case NEON_3R_FLOAT_ARITH:
5052             pairwise = (u && size < 2); /* if VPADD (float) */
5053             break;
5054         case NEON_3R_FLOAT_MINMAX:
5055             pairwise = u; /* if VPMIN/VPMAX (float) */
5056             break;
5057         case NEON_3R_FLOAT_CMP:
5058             if (!u && size) {
5059                 /* no encoding for U=0 C=1x */
5060                 return 1;
5061             }
5062             break;
5063         case NEON_3R_FLOAT_ACMP:
5064             if (!u) {
5065                 return 1;
5066             }
5067             break;
5068         case NEON_3R_FLOAT_MISC:
5069             /* VMAXNM/VMINNM in ARMv8 */
5070             if (u && !arm_feature(env, ARM_FEATURE_V8)) {
5071                 return 1;
5072             }
5073             break;
5074         case NEON_3R_VMUL:
5075             if (u && (size != 0)) {
5076                 /* UNDEF on invalid size for polynomial subcase */
5077                 return 1;
5078             }
5079             break;
5080         case NEON_3R_VFM:
5081             if (!arm_feature(env, ARM_FEATURE_VFP4) || u) {
5082                 return 1;
5083             }
5084             break;
5085         default:
5086             break;
5087         }
5088
5089         if (pairwise && q) {
5090             /* All the pairwise insns UNDEF if Q is set */
5091             return 1;
5092         }
5093
5094         for (pass = 0; pass < (q ? 4 : 2); pass++) {
5095
5096         if (pairwise) {
5097             /* Pairwise.  */
5098             if (pass < 1) {
5099                 tmp = neon_load_reg(rn, 0);
5100                 tmp2 = neon_load_reg(rn, 1);
5101             } else {
5102                 tmp = neon_load_reg(rm, 0);
5103                 tmp2 = neon_load_reg(rm, 1);
5104             }
5105         } else {
5106             /* Elementwise.  */
5107             tmp = neon_load_reg(rn, pass);
5108             tmp2 = neon_load_reg(rm, pass);
5109         }
5110         switch (op) {
5111         case NEON_3R_VHADD:
5112             GEN_NEON_INTEGER_OP(hadd);
5113             break;
5114         case NEON_3R_VQADD:
5115             GEN_NEON_INTEGER_OP_ENV(qadd);
5116             break;
5117         case NEON_3R_VRHADD:
5118             GEN_NEON_INTEGER_OP(rhadd);
5119             break;
5120         case NEON_3R_LOGIC: /* Logic ops.  */
5121             switch ((u << 2) | size) {
5122             case 0: /* VAND */
5123                 tcg_gen_and_i32(tmp, tmp, tmp2);
5124                 break;
5125             case 1: /* BIC */
5126                 tcg_gen_andc_i32(tmp, tmp, tmp2);
5127                 break;
5128             case 2: /* VORR */
5129                 tcg_gen_or_i32(tmp, tmp, tmp2);
5130                 break;
5131             case 3: /* VORN */
5132                 tcg_gen_orc_i32(tmp, tmp, tmp2);
5133                 break;
5134             case 4: /* VEOR */
5135                 tcg_gen_xor_i32(tmp, tmp, tmp2);
5136                 break;
5137             case 5: /* VBSL */
5138                 tmp3 = neon_load_reg(rd, pass);
5139                 gen_neon_bsl(tmp, tmp, tmp2, tmp3);
5140                 tcg_temp_free_i32(tmp3);
5141                 break;
5142             case 6: /* VBIT */
5143                 tmp3 = neon_load_reg(rd, pass);
5144                 gen_neon_bsl(tmp, tmp, tmp3, tmp2);
5145                 tcg_temp_free_i32(tmp3);
5146                 break;
5147             case 7: /* VBIF */
5148                 tmp3 = neon_load_reg(rd, pass);
5149                 gen_neon_bsl(tmp, tmp3, tmp, tmp2);
5150                 tcg_temp_free_i32(tmp3);
5151                 break;
5152             }
5153             break;
5154         case NEON_3R_VHSUB:
5155             GEN_NEON_INTEGER_OP(hsub);
5156             break;
5157         case NEON_3R_VQSUB:
5158             GEN_NEON_INTEGER_OP_ENV(qsub);
5159             break;
5160         case NEON_3R_VCGT:
5161             GEN_NEON_INTEGER_OP(cgt);
5162             break;
5163         case NEON_3R_VCGE:
5164             GEN_NEON_INTEGER_OP(cge);
5165             break;
5166         case NEON_3R_VSHL:
5167             GEN_NEON_INTEGER_OP(shl);
5168             break;
5169         case NEON_3R_VQSHL:
5170             GEN_NEON_INTEGER_OP_ENV(qshl);
5171             break;
5172         case NEON_3R_VRSHL:
5173             GEN_NEON_INTEGER_OP(rshl);
5174             break;
5175         case NEON_3R_VQRSHL:
5176             GEN_NEON_INTEGER_OP_ENV(qrshl);
5177             break;
5178         case NEON_3R_VMAX:
5179             GEN_NEON_INTEGER_OP(max);
5180             break;
5181         case NEON_3R_VMIN:
5182             GEN_NEON_INTEGER_OP(min);
5183             break;
5184         case NEON_3R_VABD:
5185             GEN_NEON_INTEGER_OP(abd);
5186             break;
5187         case NEON_3R_VABA:
5188             GEN_NEON_INTEGER_OP(abd);
5189             tcg_temp_free_i32(tmp2);
5190             tmp2 = neon_load_reg(rd, pass);
5191             gen_neon_add(size, tmp, tmp2);
5192             break;
5193         case NEON_3R_VADD_VSUB:
5194             if (!u) { /* VADD */
5195                 gen_neon_add(size, tmp, tmp2);
5196             } else { /* VSUB */
5197                 switch (size) {
5198                 case 0: gen_helper_neon_sub_u8(tmp, tmp, tmp2); break;
5199                 case 1: gen_helper_neon_sub_u16(tmp, tmp, tmp2); break;
5200                 case 2: tcg_gen_sub_i32(tmp, tmp, tmp2); break;
5201                 default: abort();
5202                 }
5203             }
5204             break;
5205         case NEON_3R_VTST_VCEQ:
5206             if (!u) { /* VTST */
5207                 switch (size) {
5208                 case 0: gen_helper_neon_tst_u8(tmp, tmp, tmp2); break;
5209                 case 1: gen_helper_neon_tst_u16(tmp, tmp, tmp2); break;
5210                 case 2: gen_helper_neon_tst_u32(tmp, tmp, tmp2); break;
5211                 default: abort();
5212                 }
5213             } else { /* VCEQ */
5214                 switch (size) {
5215                 case 0: gen_helper_neon_ceq_u8(tmp, tmp, tmp2); break;
5216                 case 1: gen_helper_neon_ceq_u16(tmp, tmp, tmp2); break;
5217                 case 2: gen_helper_neon_ceq_u32(tmp, tmp, tmp2); break;
5218                 default: abort();
5219                 }
5220             }
5221             break;
5222         case NEON_3R_VML: /* VMLA, VMLAL, VMLS,VMLSL */
5223             switch (size) {
5224             case 0: gen_helper_neon_mul_u8(tmp, tmp, tmp2); break;
5225             case 1: gen_helper_neon_mul_u16(tmp, tmp, tmp2); break;
5226             case 2: tcg_gen_mul_i32(tmp, tmp, tmp2); break;
5227             default: abort();
5228             }
5229             tcg_temp_free_i32(tmp2);
5230             tmp2 = neon_load_reg(rd, pass);
5231             if (u) { /* VMLS */
5232                 gen_neon_rsb(size, tmp, tmp2);
5233             } else { /* VMLA */
5234                 gen_neon_add(size, tmp, tmp2);
5235             }
5236             break;
5237         case NEON_3R_VMUL:
5238             if (u) { /* polynomial */
5239                 gen_helper_neon_mul_p8(tmp, tmp, tmp2);
5240             } else { /* Integer */
5241                 switch (size) {
5242                 case 0: gen_helper_neon_mul_u8(tmp, tmp, tmp2); break;
5243                 case 1: gen_helper_neon_mul_u16(tmp, tmp, tmp2); break;
5244                 case 2: tcg_gen_mul_i32(tmp, tmp, tmp2); break;
5245                 default: abort();
5246                 }
5247             }
5248             break;
5249         case NEON_3R_VPMAX:
5250             GEN_NEON_INTEGER_OP(pmax);
5251             break;
5252         case NEON_3R_VPMIN:
5253             GEN_NEON_INTEGER_OP(pmin);
5254             break;
5255         case NEON_3R_VQDMULH_VQRDMULH: /* Multiply high.  */
5256             if (!u) { /* VQDMULH */
5257                 switch (size) {
5258                 case 1:
5259                     gen_helper_neon_qdmulh_s16(tmp, cpu_env, tmp, tmp2);
5260                     break;
5261                 case 2:
5262                     gen_helper_neon_qdmulh_s32(tmp, cpu_env, tmp, tmp2);
5263                     break;
5264                 default: abort();
5265                 }
5266             } else { /* VQRDMULH */
5267                 switch (size) {
5268                 case 1:
5269                     gen_helper_neon_qrdmulh_s16(tmp, cpu_env, tmp, tmp2);
5270                     break;
5271                 case 2:
5272                     gen_helper_neon_qrdmulh_s32(tmp, cpu_env, tmp, tmp2);
5273                     break;
5274                 default: abort();
5275                 }
5276             }
5277             break;
5278         case NEON_3R_VPADD:
5279             switch (size) {
5280             case 0: gen_helper_neon_padd_u8(tmp, tmp, tmp2); break;
5281             case 1: gen_helper_neon_padd_u16(tmp, tmp, tmp2); break;
5282             case 2: tcg_gen_add_i32(tmp, tmp, tmp2); break;
5283             default: abort();
5284             }
5285             break;
5286         case NEON_3R_FLOAT_ARITH: /* Floating point arithmetic. */
5287         {
5288             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5289             switch ((u << 2) | size) {
5290             case 0: /* VADD */
5291             case 4: /* VPADD */
5292                 gen_helper_vfp_adds(tmp, tmp, tmp2, fpstatus);
5293                 break;
5294             case 2: /* VSUB */
5295                 gen_helper_vfp_subs(tmp, tmp, tmp2, fpstatus);
5296                 break;
5297             case 6: /* VABD */
5298                 gen_helper_neon_abd_f32(tmp, tmp, tmp2, fpstatus);
5299                 break;
5300             default:
5301                 abort();
5302             }
5303             tcg_temp_free_ptr(fpstatus);
5304             break;
5305         }
5306         case NEON_3R_FLOAT_MULTIPLY:
5307         {
5308             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5309             gen_helper_vfp_muls(tmp, tmp, tmp2, fpstatus);
5310             if (!u) {
5311                 tcg_temp_free_i32(tmp2);
5312                 tmp2 = neon_load_reg(rd, pass);
5313                 if (size == 0) {
5314                     gen_helper_vfp_adds(tmp, tmp, tmp2, fpstatus);
5315                 } else {
5316                     gen_helper_vfp_subs(tmp, tmp2, tmp, fpstatus);
5317                 }
5318             }
5319             tcg_temp_free_ptr(fpstatus);
5320             break;
5321         }
5322         case NEON_3R_FLOAT_CMP:
5323         {
5324             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5325             if (!u) {
5326                 gen_helper_neon_ceq_f32(tmp, tmp, tmp2, fpstatus);
5327             } else {
5328                 if (size == 0) {
5329                     gen_helper_neon_cge_f32(tmp, tmp, tmp2, fpstatus);
5330                 } else {
5331                     gen_helper_neon_cgt_f32(tmp, tmp, tmp2, fpstatus);
5332                 }
5333             }
5334             tcg_temp_free_ptr(fpstatus);
5335             break;
5336         }
5337         case NEON_3R_FLOAT_ACMP:
5338         {
5339             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5340             if (size == 0) {
5341                 gen_helper_neon_acge_f32(tmp, tmp, tmp2, fpstatus);
5342             } else {
5343                 gen_helper_neon_acgt_f32(tmp, tmp, tmp2, fpstatus);
5344             }
5345             tcg_temp_free_ptr(fpstatus);
5346             break;
5347         }
5348         case NEON_3R_FLOAT_MINMAX:
5349         {
5350             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5351             if (size == 0) {
5352                 gen_helper_vfp_maxs(tmp, tmp, tmp2, fpstatus);
5353             } else {
5354                 gen_helper_vfp_mins(tmp, tmp, tmp2, fpstatus);
5355             }
5356             tcg_temp_free_ptr(fpstatus);
5357             break;
5358         }
5359         case NEON_3R_FLOAT_MISC:
5360             if (u) {
5361                 /* VMAXNM/VMINNM */
5362                 TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5363                 if (size == 0) {
5364                     gen_helper_vfp_maxnums(tmp, tmp, tmp2, fpstatus);
5365                 } else {
5366                     gen_helper_vfp_minnums(tmp, tmp, tmp2, fpstatus);
5367                 }
5368                 tcg_temp_free_ptr(fpstatus);
5369             } else {
5370                 if (size == 0) {
5371                     gen_helper_recps_f32(tmp, tmp, tmp2, cpu_env);
5372                 } else {
5373                     gen_helper_rsqrts_f32(tmp, tmp, tmp2, cpu_env);
5374               }
5375             }
5376             break;
5377         case NEON_3R_VFM:
5378         {
5379             /* VFMA, VFMS: fused multiply-add */
5380             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
5381             TCGv_i32 tmp3 = neon_load_reg(rd, pass);
5382             if (size) {
5383                 /* VFMS */
5384                 gen_helper_vfp_negs(tmp, tmp);
5385             }
5386             gen_helper_vfp_muladds(tmp, tmp, tmp2, tmp3, fpstatus);
5387             tcg_temp_free_i32(tmp3);
5388             tcg_temp_free_ptr(fpstatus);
5389             break;
5390         }
5391         default:
5392             abort();
5393         }
5394         tcg_temp_free_i32(tmp2);
5395
5396         /* Save the result.  For elementwise operations we can put it
5397            straight into the destination register.  For pairwise operations
5398            we have to be careful to avoid clobbering the source operands.  */
5399         if (pairwise && rd == rm) {
5400             neon_store_scratch(pass, tmp);
5401         } else {
5402             neon_store_reg(rd, pass, tmp);
5403         }
5404
5405         } /* for pass */
5406         if (pairwise && rd == rm) {
5407             for (pass = 0; pass < (q ? 4 : 2); pass++) {
5408                 tmp = neon_load_scratch(pass);
5409                 neon_store_reg(rd, pass, tmp);
5410             }
5411         }
5412         /* End of 3 register same size operations.  */
5413     } else if (insn & (1 << 4)) {
5414         if ((insn & 0x00380080) != 0) {
5415             /* Two registers and shift.  */
5416             op = (insn >> 8) & 0xf;
5417             if (insn & (1 << 7)) {
5418                 /* 64-bit shift. */
5419                 if (op > 7) {
5420                     return 1;
5421                 }
5422                 size = 3;
5423             } else {
5424                 size = 2;
5425                 while ((insn & (1 << (size + 19))) == 0)
5426                     size--;
5427             }
5428             shift = (insn >> 16) & ((1 << (3 + size)) - 1);
5429             /* To avoid excessive duplication of ops we implement shift
5430                by immediate using the variable shift operations.  */
5431             if (op < 8) {
5432                 /* Shift by immediate:
5433                    VSHR, VSRA, VRSHR, VRSRA, VSRI, VSHL, VQSHL, VQSHLU.  */
5434                 if (q && ((rd | rm) & 1)) {
5435                     return 1;
5436                 }
5437                 if (!u && (op == 4 || op == 6)) {
5438                     return 1;
5439                 }
5440                 /* Right shifts are encoded as N - shift, where N is the
5441                    element size in bits.  */
5442                 if (op <= 4)
5443                     shift = shift - (1 << (size + 3));
5444                 if (size == 3) {
5445                     count = q + 1;
5446                 } else {
5447                     count = q ? 4: 2;
5448                 }
5449                 switch (size) {
5450                 case 0:
5451                     imm = (uint8_t) shift;
5452                     imm |= imm << 8;
5453                     imm |= imm << 16;
5454                     break;
5455                 case 1:
5456                     imm = (uint16_t) shift;
5457                     imm |= imm << 16;
5458                     break;
5459                 case 2:
5460                 case 3:
5461                     imm = shift;
5462                     break;
5463                 default:
5464                     abort();
5465                 }
5466
5467                 for (pass = 0; pass < count; pass++) {
5468                     if (size == 3) {
5469                         neon_load_reg64(cpu_V0, rm + pass);
5470                         tcg_gen_movi_i64(cpu_V1, imm);
5471                         switch (op) {
5472                         case 0:  /* VSHR */
5473                         case 1:  /* VSRA */
5474                             if (u)
5475                                 gen_helper_neon_shl_u64(cpu_V0, cpu_V0, cpu_V1);
5476                             else
5477                                 gen_helper_neon_shl_s64(cpu_V0, cpu_V0, cpu_V1);
5478                             break;
5479                         case 2: /* VRSHR */
5480                         case 3: /* VRSRA */
5481                             if (u)
5482                                 gen_helper_neon_rshl_u64(cpu_V0, cpu_V0, cpu_V1);
5483                             else
5484                                 gen_helper_neon_rshl_s64(cpu_V0, cpu_V0, cpu_V1);
5485                             break;
5486                         case 4: /* VSRI */
5487                         case 5: /* VSHL, VSLI */
5488                             gen_helper_neon_shl_u64(cpu_V0, cpu_V0, cpu_V1);
5489                             break;
5490                         case 6: /* VQSHLU */
5491                             gen_helper_neon_qshlu_s64(cpu_V0, cpu_env,
5492                                                       cpu_V0, cpu_V1);
5493                             break;
5494                         case 7: /* VQSHL */
5495                             if (u) {
5496                                 gen_helper_neon_qshl_u64(cpu_V0, cpu_env,
5497                                                          cpu_V0, cpu_V1);
5498                             } else {
5499                                 gen_helper_neon_qshl_s64(cpu_V0, cpu_env,
5500                                                          cpu_V0, cpu_V1);
5501                             }
5502                             break;
5503                         }
5504                         if (op == 1 || op == 3) {
5505                             /* Accumulate.  */
5506                             neon_load_reg64(cpu_V1, rd + pass);
5507                             tcg_gen_add_i64(cpu_V0, cpu_V0, cpu_V1);
5508                         } else if (op == 4 || (op == 5 && u)) {
5509                             /* Insert */
5510                             neon_load_reg64(cpu_V1, rd + pass);
5511                             uint64_t mask;
5512                             if (shift < -63 || shift > 63) {
5513                                 mask = 0;
5514                             } else {
5515                                 if (op == 4) {
5516                                     mask = 0xffffffffffffffffull >> -shift;
5517                                 } else {
5518                                     mask = 0xffffffffffffffffull << shift;
5519                                 }
5520                             }
5521                             tcg_gen_andi_i64(cpu_V1, cpu_V1, ~mask);
5522                             tcg_gen_or_i64(cpu_V0, cpu_V0, cpu_V1);
5523                         }
5524                         neon_store_reg64(cpu_V0, rd + pass);
5525                     } else { /* size < 3 */
5526                         /* Operands in T0 and T1.  */
5527                         tmp = neon_load_reg(rm, pass);
5528                         tmp2 = tcg_temp_new_i32();
5529                         tcg_gen_movi_i32(tmp2, imm);
5530                         switch (op) {
5531                         case 0:  /* VSHR */
5532                         case 1:  /* VSRA */
5533                             GEN_NEON_INTEGER_OP(shl);
5534                             break;
5535                         case 2: /* VRSHR */
5536                         case 3: /* VRSRA */
5537                             GEN_NEON_INTEGER_OP(rshl);
5538                             break;
5539                         case 4: /* VSRI */
5540                         case 5: /* VSHL, VSLI */
5541                             switch (size) {
5542                             case 0: gen_helper_neon_shl_u8(tmp, tmp, tmp2); break;
5543                             case 1: gen_helper_neon_shl_u16(tmp, tmp, tmp2); break;
5544                             case 2: gen_helper_neon_shl_u32(tmp, tmp, tmp2); break;
5545                             default: abort();
5546                             }
5547                             break;
5548                         case 6: /* VQSHLU */
5549                             switch (size) {
5550                             case 0:
5551                                 gen_helper_neon_qshlu_s8(tmp, cpu_env,
5552                                                          tmp, tmp2);
5553                                 break;
5554                             case 1:
5555                                 gen_helper_neon_qshlu_s16(tmp, cpu_env,
5556                                                           tmp, tmp2);
5557                                 break;
5558                             case 2:
5559                                 gen_helper_neon_qshlu_s32(tmp, cpu_env,
5560                                                           tmp, tmp2);
5561                                 break;
5562                             default:
5563                                 abort();
5564                             }
5565                             break;
5566                         case 7: /* VQSHL */
5567                             GEN_NEON_INTEGER_OP_ENV(qshl);
5568                             break;
5569                         }
5570                         tcg_temp_free_i32(tmp2);
5571
5572                         if (op == 1 || op == 3) {
5573                             /* Accumulate.  */
5574                             tmp2 = neon_load_reg(rd, pass);
5575                             gen_neon_add(size, tmp, tmp2);
5576                             tcg_temp_free_i32(tmp2);
5577                         } else if (op == 4 || (op == 5 && u)) {
5578                             /* Insert */
5579                             switch (size) {
5580                             case 0:
5581                                 if (op == 4)
5582                                     mask = 0xff >> -shift;
5583                                 else
5584                                     mask = (uint8_t)(0xff << shift);
5585                                 mask |= mask << 8;
5586                                 mask |= mask << 16;
5587                                 break;
5588                             case 1:
5589                                 if (op == 4)
5590                                     mask = 0xffff >> -shift;
5591                                 else
5592                                     mask = (uint16_t)(0xffff << shift);
5593                                 mask |= mask << 16;
5594                                 break;
5595                             case 2:
5596                                 if (shift < -31 || shift > 31) {
5597                                     mask = 0;
5598                                 } else {
5599                                     if (op == 4)
5600                                         mask = 0xffffffffu >> -shift;
5601                                     else
5602                                         mask = 0xffffffffu << shift;
5603                                 }
5604                                 break;
5605                             default:
5606                                 abort();
5607                             }
5608                             tmp2 = neon_load_reg(rd, pass);
5609                             tcg_gen_andi_i32(tmp, tmp, mask);
5610                             tcg_gen_andi_i32(tmp2, tmp2, ~mask);
5611                             tcg_gen_or_i32(tmp, tmp, tmp2);
5612                             tcg_temp_free_i32(tmp2);
5613                         }
5614                         neon_store_reg(rd, pass, tmp);
5615                     }
5616                 } /* for pass */
5617             } else if (op < 10) {
5618                 /* Shift by immediate and narrow:
5619                    VSHRN, VRSHRN, VQSHRN, VQRSHRN.  */
5620                 int input_unsigned = (op == 8) ? !u : u;
5621                 if (rm & 1) {
5622                     return 1;
5623                 }
5624                 shift = shift - (1 << (size + 3));
5625                 size++;
5626                 if (size == 3) {
5627                     tmp64 = tcg_const_i64(shift);
5628                     neon_load_reg64(cpu_V0, rm);
5629                     neon_load_reg64(cpu_V1, rm + 1);
5630                     for (pass = 0; pass < 2; pass++) {
5631                         TCGv_i64 in;
5632                         if (pass == 0) {
5633                             in = cpu_V0;
5634                         } else {
5635                             in = cpu_V1;
5636                         }
5637                         if (q) {
5638                             if (input_unsigned) {
5639                                 gen_helper_neon_rshl_u64(cpu_V0, in, tmp64);
5640                             } else {
5641                                 gen_helper_neon_rshl_s64(cpu_V0, in, tmp64);
5642                             }
5643                         } else {
5644                             if (input_unsigned) {
5645                                 gen_helper_neon_shl_u64(cpu_V0, in, tmp64);
5646                             } else {
5647                                 gen_helper_neon_shl_s64(cpu_V0, in, tmp64);
5648                             }
5649                         }
5650                         tmp = tcg_temp_new_i32();
5651                         gen_neon_narrow_op(op == 8, u, size - 1, tmp, cpu_V0);
5652                         neon_store_reg(rd, pass, tmp);
5653                     } /* for pass */
5654                     tcg_temp_free_i64(tmp64);
5655                 } else {
5656                     if (size == 1) {
5657                         imm = (uint16_t)shift;
5658                         imm |= imm << 16;
5659                     } else {
5660                         /* size == 2 */
5661                         imm = (uint32_t)shift;
5662                     }
5663                     tmp2 = tcg_const_i32(imm);
5664                     tmp4 = neon_load_reg(rm + 1, 0);
5665                     tmp5 = neon_load_reg(rm + 1, 1);
5666                     for (pass = 0; pass < 2; pass++) {
5667                         if (pass == 0) {
5668                             tmp = neon_load_reg(rm, 0);
5669                         } else {
5670                             tmp = tmp4;
5671                         }
5672                         gen_neon_shift_narrow(size, tmp, tmp2, q,
5673                                               input_unsigned);
5674                         if (pass == 0) {
5675                             tmp3 = neon_load_reg(rm, 1);
5676                         } else {
5677                             tmp3 = tmp5;
5678                         }
5679                         gen_neon_shift_narrow(size, tmp3, tmp2, q,
5680                                               input_unsigned);
5681                         tcg_gen_concat_i32_i64(cpu_V0, tmp, tmp3);
5682                         tcg_temp_free_i32(tmp);
5683                         tcg_temp_free_i32(tmp3);
5684                         tmp = tcg_temp_new_i32();
5685                         gen_neon_narrow_op(op == 8, u, size - 1, tmp, cpu_V0);
5686                         neon_store_reg(rd, pass, tmp);
5687                     } /* for pass */
5688                     tcg_temp_free_i32(tmp2);
5689                 }
5690             } else if (op == 10) {
5691                 /* VSHLL, VMOVL */
5692                 if (q || (rd & 1)) {
5693                     return 1;
5694                 }
5695                 tmp = neon_load_reg(rm, 0);
5696                 tmp2 = neon_load_reg(rm, 1);
5697                 for (pass = 0; pass < 2; pass++) {
5698                     if (pass == 1)
5699                         tmp = tmp2;
5700
5701                     gen_neon_widen(cpu_V0, tmp, size, u);
5702
5703                     if (shift != 0) {
5704                         /* The shift is less than the width of the source
5705                            type, so we can just shift the whole register.  */
5706                         tcg_gen_shli_i64(cpu_V0, cpu_V0, shift);
5707                         /* Widen the result of shift: we need to clear
5708                          * the potential overflow bits resulting from
5709                          * left bits of the narrow input appearing as
5710                          * right bits of left the neighbour narrow
5711                          * input.  */
5712                         if (size < 2 || !u) {
5713                             uint64_t imm64;
5714                             if (size == 0) {
5715                                 imm = (0xffu >> (8 - shift));
5716                                 imm |= imm << 16;
5717                             } else if (size == 1) {
5718                                 imm = 0xffff >> (16 - shift);
5719                             } else {
5720                                 /* size == 2 */
5721                                 imm = 0xffffffff >> (32 - shift);
5722                             }
5723                             if (size < 2) {
5724                                 imm64 = imm | (((uint64_t)imm) << 32);
5725                             } else {
5726                                 imm64 = imm;
5727                             }
5728                             tcg_gen_andi_i64(cpu_V0, cpu_V0, ~imm64);
5729                         }
5730                     }
5731                     neon_store_reg64(cpu_V0, rd + pass);
5732                 }
5733             } else if (op >= 14) {
5734                 /* VCVT fixed-point.  */
5735                 if (!(insn & (1 << 21)) || (q && ((rd | rm) & 1))) {
5736                     return 1;
5737                 }
5738                 /* We have already masked out the must-be-1 top bit of imm6,
5739                  * hence this 32-shift where the ARM ARM has 64-imm6.
5740                  */
5741                 shift = 32 - shift;
5742                 for (pass = 0; pass < (q ? 4 : 2); pass++) {
5743                     tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, pass));
5744                     if (!(op & 1)) {
5745                         if (u)
5746                             gen_vfp_ulto(0, shift, 1);
5747                         else
5748                             gen_vfp_slto(0, shift, 1);
5749                     } else {
5750                         if (u)
5751                             gen_vfp_toul(0, shift, 1);
5752                         else
5753                             gen_vfp_tosl(0, shift, 1);
5754                     }
5755                     tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, pass));
5756                 }
5757             } else {
5758                 return 1;
5759             }
5760         } else { /* (insn & 0x00380080) == 0 */
5761             int invert;
5762             if (q && (rd & 1)) {
5763                 return 1;
5764             }
5765
5766             op = (insn >> 8) & 0xf;
5767             /* One register and immediate.  */
5768             imm = (u << 7) | ((insn >> 12) & 0x70) | (insn & 0xf);
5769             invert = (insn & (1 << 5)) != 0;
5770             /* Note that op = 2,3,4,5,6,7,10,11,12,13 imm=0 is UNPREDICTABLE.
5771              * We choose to not special-case this and will behave as if a
5772              * valid constant encoding of 0 had been given.
5773              */
5774             switch (op) {
5775             case 0: case 1:
5776                 /* no-op */
5777                 break;
5778             case 2: case 3:
5779                 imm <<= 8;
5780                 break;
5781             case 4: case 5:
5782                 imm <<= 16;
5783                 break;
5784             case 6: case 7:
5785                 imm <<= 24;
5786                 break;
5787             case 8: case 9:
5788                 imm |= imm << 16;
5789                 break;
5790             case 10: case 11:
5791                 imm = (imm << 8) | (imm << 24);
5792                 break;
5793             case 12:
5794                 imm = (imm << 8) | 0xff;
5795                 break;
5796             case 13:
5797                 imm = (imm << 16) | 0xffff;
5798                 break;
5799             case 14:
5800                 imm |= (imm << 8) | (imm << 16) | (imm << 24);
5801                 if (invert)
5802                     imm = ~imm;
5803                 break;
5804             case 15:
5805                 if (invert) {
5806                     return 1;
5807                 }
5808                 imm = ((imm & 0x80) << 24) | ((imm & 0x3f) << 19)
5809                       | ((imm & 0x40) ? (0x1f << 25) : (1 << 30));
5810                 break;
5811             }
5812             if (invert)
5813                 imm = ~imm;
5814
5815             for (pass = 0; pass < (q ? 4 : 2); pass++) {
5816                 if (op & 1 && op < 12) {
5817                     tmp = neon_load_reg(rd, pass);
5818                     if (invert) {
5819                         /* The immediate value has already been inverted, so
5820                            BIC becomes AND.  */
5821                         tcg_gen_andi_i32(tmp, tmp, imm);
5822                     } else {
5823                         tcg_gen_ori_i32(tmp, tmp, imm);
5824                     }
5825                 } else {
5826                     /* VMOV, VMVN.  */
5827                     tmp = tcg_temp_new_i32();
5828                     if (op == 14 && invert) {
5829                         int n;
5830                         uint32_t val;
5831                         val = 0;
5832                         for (n = 0; n < 4; n++) {
5833                             if (imm & (1 << (n + (pass & 1) * 4)))
5834                                 val |= 0xff << (n * 8);
5835                         }
5836                         tcg_gen_movi_i32(tmp, val);
5837                     } else {
5838                         tcg_gen_movi_i32(tmp, imm);
5839                     }
5840                 }
5841                 neon_store_reg(rd, pass, tmp);
5842             }
5843         }
5844     } else { /* (insn & 0x00800010 == 0x00800000) */
5845         if (size != 3) {
5846             op = (insn >> 8) & 0xf;
5847             if ((insn & (1 << 6)) == 0) {
5848                 /* Three registers of different lengths.  */
5849                 int src1_wide;
5850                 int src2_wide;
5851                 int prewiden;
5852                 /* undefreq: bit 0 : UNDEF if size != 0
5853                  *           bit 1 : UNDEF if size == 0
5854                  *           bit 2 : UNDEF if U == 1
5855                  * Note that [1:0] set implies 'always UNDEF'
5856                  */
5857                 int undefreq;
5858                 /* prewiden, src1_wide, src2_wide, undefreq */
5859                 static const int neon_3reg_wide[16][4] = {
5860                     {1, 0, 0, 0}, /* VADDL */
5861                     {1, 1, 0, 0}, /* VADDW */
5862                     {1, 0, 0, 0}, /* VSUBL */
5863                     {1, 1, 0, 0}, /* VSUBW */
5864                     {0, 1, 1, 0}, /* VADDHN */
5865                     {0, 0, 0, 0}, /* VABAL */
5866                     {0, 1, 1, 0}, /* VSUBHN */
5867                     {0, 0, 0, 0}, /* VABDL */
5868                     {0, 0, 0, 0}, /* VMLAL */
5869                     {0, 0, 0, 6}, /* VQDMLAL */
5870                     {0, 0, 0, 0}, /* VMLSL */
5871                     {0, 0, 0, 6}, /* VQDMLSL */
5872                     {0, 0, 0, 0}, /* Integer VMULL */
5873                     {0, 0, 0, 2}, /* VQDMULL */
5874                     {0, 0, 0, 5}, /* Polynomial VMULL */
5875                     {0, 0, 0, 3}, /* Reserved: always UNDEF */
5876                 };
5877
5878                 prewiden = neon_3reg_wide[op][0];
5879                 src1_wide = neon_3reg_wide[op][1];
5880                 src2_wide = neon_3reg_wide[op][2];
5881                 undefreq = neon_3reg_wide[op][3];
5882
5883                 if (((undefreq & 1) && (size != 0)) ||
5884                     ((undefreq & 2) && (size == 0)) ||
5885                     ((undefreq & 4) && u)) {
5886                     return 1;
5887                 }
5888                 if ((src1_wide && (rn & 1)) ||
5889                     (src2_wide && (rm & 1)) ||
5890                     (!src2_wide && (rd & 1))) {
5891                     return 1;
5892                 }
5893
5894                 /* Avoid overlapping operands.  Wide source operands are
5895                    always aligned so will never overlap with wide
5896                    destinations in problematic ways.  */
5897                 if (rd == rm && !src2_wide) {
5898                     tmp = neon_load_reg(rm, 1);
5899                     neon_store_scratch(2, tmp);
5900                 } else if (rd == rn && !src1_wide) {
5901                     tmp = neon_load_reg(rn, 1);
5902                     neon_store_scratch(2, tmp);
5903                 }
5904                 TCGV_UNUSED_I32(tmp3);
5905                 for (pass = 0; pass < 2; pass++) {
5906                     if (src1_wide) {
5907                         neon_load_reg64(cpu_V0, rn + pass);
5908                         TCGV_UNUSED_I32(tmp);
5909                     } else {
5910                         if (pass == 1 && rd == rn) {
5911                             tmp = neon_load_scratch(2);
5912                         } else {
5913                             tmp = neon_load_reg(rn, pass);
5914                         }
5915                         if (prewiden) {
5916                             gen_neon_widen(cpu_V0, tmp, size, u);
5917                         }
5918                     }
5919                     if (src2_wide) {
5920                         neon_load_reg64(cpu_V1, rm + pass);
5921                         TCGV_UNUSED_I32(tmp2);
5922                     } else {
5923                         if (pass == 1 && rd == rm) {
5924                             tmp2 = neon_load_scratch(2);
5925                         } else {
5926                             tmp2 = neon_load_reg(rm, pass);
5927                         }
5928                         if (prewiden) {
5929                             gen_neon_widen(cpu_V1, tmp2, size, u);
5930                         }
5931                     }
5932                     switch (op) {
5933                     case 0: case 1: case 4: /* VADDL, VADDW, VADDHN, VRADDHN */
5934                         gen_neon_addl(size);
5935                         break;
5936                     case 2: case 3: case 6: /* VSUBL, VSUBW, VSUBHN, VRSUBHN */
5937                         gen_neon_subl(size);
5938                         break;
5939                     case 5: case 7: /* VABAL, VABDL */
5940                         switch ((size << 1) | u) {
5941                         case 0:
5942                             gen_helper_neon_abdl_s16(cpu_V0, tmp, tmp2);
5943                             break;
5944                         case 1:
5945                             gen_helper_neon_abdl_u16(cpu_V0, tmp, tmp2);
5946                             break;
5947                         case 2:
5948                             gen_helper_neon_abdl_s32(cpu_V0, tmp, tmp2);
5949                             break;
5950                         case 3:
5951                             gen_helper_neon_abdl_u32(cpu_V0, tmp, tmp2);
5952                             break;
5953                         case 4:
5954                             gen_helper_neon_abdl_s64(cpu_V0, tmp, tmp2);
5955                             break;
5956                         case 5:
5957                             gen_helper_neon_abdl_u64(cpu_V0, tmp, tmp2);
5958                             break;
5959                         default: abort();
5960                         }
5961                         tcg_temp_free_i32(tmp2);
5962                         tcg_temp_free_i32(tmp);
5963                         break;
5964                     case 8: case 9: case 10: case 11: case 12: case 13:
5965                         /* VMLAL, VQDMLAL, VMLSL, VQDMLSL, VMULL, VQDMULL */
5966                         gen_neon_mull(cpu_V0, tmp, tmp2, size, u);
5967                         break;
5968                     case 14: /* Polynomial VMULL */
5969                         gen_helper_neon_mull_p8(cpu_V0, tmp, tmp2);
5970                         tcg_temp_free_i32(tmp2);
5971                         tcg_temp_free_i32(tmp);
5972                         break;
5973                     default: /* 15 is RESERVED: caught earlier  */
5974                         abort();
5975                     }
5976                     if (op == 13) {
5977                         /* VQDMULL */
5978                         gen_neon_addl_saturate(cpu_V0, cpu_V0, size);
5979                         neon_store_reg64(cpu_V0, rd + pass);
5980                     } else if (op == 5 || (op >= 8 && op <= 11)) {
5981                         /* Accumulate.  */
5982                         neon_load_reg64(cpu_V1, rd + pass);
5983                         switch (op) {
5984                         case 10: /* VMLSL */
5985                             gen_neon_negl(cpu_V0, size);
5986                             /* Fall through */
5987                         case 5: case 8: /* VABAL, VMLAL */
5988                             gen_neon_addl(size);
5989                             break;
5990                         case 9: case 11: /* VQDMLAL, VQDMLSL */
5991                             gen_neon_addl_saturate(cpu_V0, cpu_V0, size);
5992                             if (op == 11) {
5993                                 gen_neon_negl(cpu_V0, size);
5994                             }
5995                             gen_neon_addl_saturate(cpu_V0, cpu_V1, size);
5996                             break;
5997                         default:
5998                             abort();
5999                         }
6000                         neon_store_reg64(cpu_V0, rd + pass);
6001                     } else if (op == 4 || op == 6) {
6002                         /* Narrowing operation.  */
6003                         tmp = tcg_temp_new_i32();
6004                         if (!u) {
6005                             switch (size) {
6006                             case 0:
6007                                 gen_helper_neon_narrow_high_u8(tmp, cpu_V0);
6008                                 break;
6009                             case 1:
6010                                 gen_helper_neon_narrow_high_u16(tmp, cpu_V0);
6011                                 break;
6012                             case 2:
6013                                 tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
6014                                 tcg_gen_trunc_i64_i32(tmp, cpu_V0);
6015                                 break;
6016                             default: abort();
6017                             }
6018                         } else {
6019                             switch (size) {
6020                             case 0:
6021                                 gen_helper_neon_narrow_round_high_u8(tmp, cpu_V0);
6022                                 break;
6023                             case 1:
6024                                 gen_helper_neon_narrow_round_high_u16(tmp, cpu_V0);
6025                                 break;
6026                             case 2:
6027                                 tcg_gen_addi_i64(cpu_V0, cpu_V0, 1u << 31);
6028                                 tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
6029                                 tcg_gen_trunc_i64_i32(tmp, cpu_V0);
6030                                 break;
6031                             default: abort();
6032                             }
6033                         }
6034                         if (pass == 0) {
6035                             tmp3 = tmp;
6036                         } else {
6037                             neon_store_reg(rd, 0, tmp3);
6038                             neon_store_reg(rd, 1, tmp);
6039                         }
6040                     } else {
6041                         /* Write back the result.  */
6042                         neon_store_reg64(cpu_V0, rd + pass);
6043                     }
6044                 }
6045             } else {
6046                 /* Two registers and a scalar. NB that for ops of this form
6047                  * the ARM ARM labels bit 24 as Q, but it is in our variable
6048                  * 'u', not 'q'.
6049                  */
6050                 if (size == 0) {
6051                     return 1;
6052                 }
6053                 switch (op) {
6054                 case 1: /* Float VMLA scalar */
6055                 case 5: /* Floating point VMLS scalar */
6056                 case 9: /* Floating point VMUL scalar */
6057                     if (size == 1) {
6058                         return 1;
6059                     }
6060                     /* fall through */
6061                 case 0: /* Integer VMLA scalar */
6062                 case 4: /* Integer VMLS scalar */
6063                 case 8: /* Integer VMUL scalar */
6064                 case 12: /* VQDMULH scalar */
6065                 case 13: /* VQRDMULH scalar */
6066                     if (u && ((rd | rn) & 1)) {
6067                         return 1;
6068                     }
6069                     tmp = neon_get_scalar(size, rm);
6070                     neon_store_scratch(0, tmp);
6071                     for (pass = 0; pass < (u ? 4 : 2); pass++) {
6072                         tmp = neon_load_scratch(0);
6073                         tmp2 = neon_load_reg(rn, pass);
6074                         if (op == 12) {
6075                             if (size == 1) {
6076                                 gen_helper_neon_qdmulh_s16(tmp, cpu_env, tmp, tmp2);
6077                             } else {
6078                                 gen_helper_neon_qdmulh_s32(tmp, cpu_env, tmp, tmp2);
6079                             }
6080                         } else if (op == 13) {
6081                             if (size == 1) {
6082                                 gen_helper_neon_qrdmulh_s16(tmp, cpu_env, tmp, tmp2);
6083                             } else {
6084                                 gen_helper_neon_qrdmulh_s32(tmp, cpu_env, tmp, tmp2);
6085                             }
6086                         } else if (op & 1) {
6087                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6088                             gen_helper_vfp_muls(tmp, tmp, tmp2, fpstatus);
6089                             tcg_temp_free_ptr(fpstatus);
6090                         } else {
6091                             switch (size) {
6092                             case 0: gen_helper_neon_mul_u8(tmp, tmp, tmp2); break;
6093                             case 1: gen_helper_neon_mul_u16(tmp, tmp, tmp2); break;
6094                             case 2: tcg_gen_mul_i32(tmp, tmp, tmp2); break;
6095                             default: abort();
6096                             }
6097                         }
6098                         tcg_temp_free_i32(tmp2);
6099                         if (op < 8) {
6100                             /* Accumulate.  */
6101                             tmp2 = neon_load_reg(rd, pass);
6102                             switch (op) {
6103                             case 0:
6104                                 gen_neon_add(size, tmp, tmp2);
6105                                 break;
6106                             case 1:
6107                             {
6108                                 TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6109                                 gen_helper_vfp_adds(tmp, tmp, tmp2, fpstatus);
6110                                 tcg_temp_free_ptr(fpstatus);
6111                                 break;
6112                             }
6113                             case 4:
6114                                 gen_neon_rsb(size, tmp, tmp2);
6115                                 break;
6116                             case 5:
6117                             {
6118                                 TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6119                                 gen_helper_vfp_subs(tmp, tmp2, tmp, fpstatus);
6120                                 tcg_temp_free_ptr(fpstatus);
6121                                 break;
6122                             }
6123                             default:
6124                                 abort();
6125                             }
6126                             tcg_temp_free_i32(tmp2);
6127                         }
6128                         neon_store_reg(rd, pass, tmp);
6129                     }
6130                     break;
6131                 case 3: /* VQDMLAL scalar */
6132                 case 7: /* VQDMLSL scalar */
6133                 case 11: /* VQDMULL scalar */
6134                     if (u == 1) {
6135                         return 1;
6136                     }
6137                     /* fall through */
6138                 case 2: /* VMLAL sclar */
6139                 case 6: /* VMLSL scalar */
6140                 case 10: /* VMULL scalar */
6141                     if (rd & 1) {
6142                         return 1;
6143                     }
6144                     tmp2 = neon_get_scalar(size, rm);
6145                     /* We need a copy of tmp2 because gen_neon_mull
6146                      * deletes it during pass 0.  */
6147                     tmp4 = tcg_temp_new_i32();
6148                     tcg_gen_mov_i32(tmp4, tmp2);
6149                     tmp3 = neon_load_reg(rn, 1);
6150
6151                     for (pass = 0; pass < 2; pass++) {
6152                         if (pass == 0) {
6153                             tmp = neon_load_reg(rn, 0);
6154                         } else {
6155                             tmp = tmp3;
6156                             tmp2 = tmp4;
6157                         }
6158                         gen_neon_mull(cpu_V0, tmp, tmp2, size, u);
6159                         if (op != 11) {
6160                             neon_load_reg64(cpu_V1, rd + pass);
6161                         }
6162                         switch (op) {
6163                         case 6:
6164                             gen_neon_negl(cpu_V0, size);
6165                             /* Fall through */
6166                         case 2:
6167                             gen_neon_addl(size);
6168                             break;
6169                         case 3: case 7:
6170                             gen_neon_addl_saturate(cpu_V0, cpu_V0, size);
6171                             if (op == 7) {
6172                                 gen_neon_negl(cpu_V0, size);
6173                             }
6174                             gen_neon_addl_saturate(cpu_V0, cpu_V1, size);
6175                             break;
6176                         case 10:
6177                             /* no-op */
6178                             break;
6179                         case 11:
6180                             gen_neon_addl_saturate(cpu_V0, cpu_V0, size);
6181                             break;
6182                         default:
6183                             abort();
6184                         }
6185                         neon_store_reg64(cpu_V0, rd + pass);
6186                     }
6187
6188
6189                     break;
6190                 default: /* 14 and 15 are RESERVED */
6191                     return 1;
6192                 }
6193             }
6194         } else { /* size == 3 */
6195             if (!u) {
6196                 /* Extract.  */
6197                 imm = (insn >> 8) & 0xf;
6198
6199                 if (imm > 7 && !q)
6200                     return 1;
6201
6202                 if (q && ((rd | rn | rm) & 1)) {
6203                     return 1;
6204                 }
6205
6206                 if (imm == 0) {
6207                     neon_load_reg64(cpu_V0, rn);
6208                     if (q) {
6209                         neon_load_reg64(cpu_V1, rn + 1);
6210                     }
6211                 } else if (imm == 8) {
6212                     neon_load_reg64(cpu_V0, rn + 1);
6213                     if (q) {
6214                         neon_load_reg64(cpu_V1, rm);
6215                     }
6216                 } else if (q) {
6217                     tmp64 = tcg_temp_new_i64();
6218                     if (imm < 8) {
6219                         neon_load_reg64(cpu_V0, rn);
6220                         neon_load_reg64(tmp64, rn + 1);
6221                     } else {
6222                         neon_load_reg64(cpu_V0, rn + 1);
6223                         neon_load_reg64(tmp64, rm);
6224                     }
6225                     tcg_gen_shri_i64(cpu_V0, cpu_V0, (imm & 7) * 8);
6226                     tcg_gen_shli_i64(cpu_V1, tmp64, 64 - ((imm & 7) * 8));
6227                     tcg_gen_or_i64(cpu_V0, cpu_V0, cpu_V1);
6228                     if (imm < 8) {
6229                         neon_load_reg64(cpu_V1, rm);
6230                     } else {
6231                         neon_load_reg64(cpu_V1, rm + 1);
6232                         imm -= 8;
6233                     }
6234                     tcg_gen_shli_i64(cpu_V1, cpu_V1, 64 - (imm * 8));
6235                     tcg_gen_shri_i64(tmp64, tmp64, imm * 8);
6236                     tcg_gen_or_i64(cpu_V1, cpu_V1, tmp64);
6237                     tcg_temp_free_i64(tmp64);
6238                 } else {
6239                     /* BUGFIX */
6240                     neon_load_reg64(cpu_V0, rn);
6241                     tcg_gen_shri_i64(cpu_V0, cpu_V0, imm * 8);
6242                     neon_load_reg64(cpu_V1, rm);
6243                     tcg_gen_shli_i64(cpu_V1, cpu_V1, 64 - (imm * 8));
6244                     tcg_gen_or_i64(cpu_V0, cpu_V0, cpu_V1);
6245                 }
6246                 neon_store_reg64(cpu_V0, rd);
6247                 if (q) {
6248                     neon_store_reg64(cpu_V1, rd + 1);
6249                 }
6250             } else if ((insn & (1 << 11)) == 0) {
6251                 /* Two register misc.  */
6252                 op = ((insn >> 12) & 0x30) | ((insn >> 7) & 0xf);
6253                 size = (insn >> 18) & 3;
6254                 /* UNDEF for unknown op values and bad op-size combinations */
6255                 if ((neon_2rm_sizes[op] & (1 << size)) == 0) {
6256                     return 1;
6257                 }
6258                 if ((op != NEON_2RM_VMOVN && op != NEON_2RM_VQMOVN) &&
6259                     q && ((rm | rd) & 1)) {
6260                     return 1;
6261                 }
6262                 switch (op) {
6263                 case NEON_2RM_VREV64:
6264                     for (pass = 0; pass < (q ? 2 : 1); pass++) {
6265                         tmp = neon_load_reg(rm, pass * 2);
6266                         tmp2 = neon_load_reg(rm, pass * 2 + 1);
6267                         switch (size) {
6268                         case 0: tcg_gen_bswap32_i32(tmp, tmp); break;
6269                         case 1: gen_swap_half(tmp); break;
6270                         case 2: /* no-op */ break;
6271                         default: abort();
6272                         }
6273                         neon_store_reg(rd, pass * 2 + 1, tmp);
6274                         if (size == 2) {
6275                             neon_store_reg(rd, pass * 2, tmp2);
6276                         } else {
6277                             switch (size) {
6278                             case 0: tcg_gen_bswap32_i32(tmp2, tmp2); break;
6279                             case 1: gen_swap_half(tmp2); break;
6280                             default: abort();
6281                             }
6282                             neon_store_reg(rd, pass * 2, tmp2);
6283                         }
6284                     }
6285                     break;
6286                 case NEON_2RM_VPADDL: case NEON_2RM_VPADDL_U:
6287                 case NEON_2RM_VPADAL: case NEON_2RM_VPADAL_U:
6288                     for (pass = 0; pass < q + 1; pass++) {
6289                         tmp = neon_load_reg(rm, pass * 2);
6290                         gen_neon_widen(cpu_V0, tmp, size, op & 1);
6291                         tmp = neon_load_reg(rm, pass * 2 + 1);
6292                         gen_neon_widen(cpu_V1, tmp, size, op & 1);
6293                         switch (size) {
6294                         case 0: gen_helper_neon_paddl_u16(CPU_V001); break;
6295                         case 1: gen_helper_neon_paddl_u32(CPU_V001); break;
6296                         case 2: tcg_gen_add_i64(CPU_V001); break;
6297                         default: abort();
6298                         }
6299                         if (op >= NEON_2RM_VPADAL) {
6300                             /* Accumulate.  */
6301                             neon_load_reg64(cpu_V1, rd + pass);
6302                             gen_neon_addl(size);
6303                         }
6304                         neon_store_reg64(cpu_V0, rd + pass);
6305                     }
6306                     break;
6307                 case NEON_2RM_VTRN:
6308                     if (size == 2) {
6309                         int n;
6310                         for (n = 0; n < (q ? 4 : 2); n += 2) {
6311                             tmp = neon_load_reg(rm, n);
6312                             tmp2 = neon_load_reg(rd, n + 1);
6313                             neon_store_reg(rm, n, tmp2);
6314                             neon_store_reg(rd, n + 1, tmp);
6315                         }
6316                     } else {
6317                         goto elementwise;
6318                     }
6319                     break;
6320                 case NEON_2RM_VUZP:
6321                     if (gen_neon_unzip(rd, rm, size, q)) {
6322                         return 1;
6323                     }
6324                     break;
6325                 case NEON_2RM_VZIP:
6326                     if (gen_neon_zip(rd, rm, size, q)) {
6327                         return 1;
6328                     }
6329                     break;
6330                 case NEON_2RM_VMOVN: case NEON_2RM_VQMOVN:
6331                     /* also VQMOVUN; op field and mnemonics don't line up */
6332                     if (rm & 1) {
6333                         return 1;
6334                     }
6335                     TCGV_UNUSED_I32(tmp2);
6336                     for (pass = 0; pass < 2; pass++) {
6337                         neon_load_reg64(cpu_V0, rm + pass);
6338                         tmp = tcg_temp_new_i32();
6339                         gen_neon_narrow_op(op == NEON_2RM_VMOVN, q, size,
6340                                            tmp, cpu_V0);
6341                         if (pass == 0) {
6342                             tmp2 = tmp;
6343                         } else {
6344                             neon_store_reg(rd, 0, tmp2);
6345                             neon_store_reg(rd, 1, tmp);
6346                         }
6347                     }
6348                     break;
6349                 case NEON_2RM_VSHLL:
6350                     if (q || (rd & 1)) {
6351                         return 1;
6352                     }
6353                     tmp = neon_load_reg(rm, 0);
6354                     tmp2 = neon_load_reg(rm, 1);
6355                     for (pass = 0; pass < 2; pass++) {
6356                         if (pass == 1)
6357                             tmp = tmp2;
6358                         gen_neon_widen(cpu_V0, tmp, size, 1);
6359                         tcg_gen_shli_i64(cpu_V0, cpu_V0, 8 << size);
6360                         neon_store_reg64(cpu_V0, rd + pass);
6361                     }
6362                     break;
6363                 case NEON_2RM_VCVT_F16_F32:
6364                     if (!arm_feature(env, ARM_FEATURE_VFP_FP16) ||
6365                         q || (rm & 1)) {
6366                         return 1;
6367                     }
6368                     tmp = tcg_temp_new_i32();
6369                     tmp2 = tcg_temp_new_i32();
6370                     tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 0));
6371                     gen_helper_neon_fcvt_f32_to_f16(tmp, cpu_F0s, cpu_env);
6372                     tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 1));
6373                     gen_helper_neon_fcvt_f32_to_f16(tmp2, cpu_F0s, cpu_env);
6374                     tcg_gen_shli_i32(tmp2, tmp2, 16);
6375                     tcg_gen_or_i32(tmp2, tmp2, tmp);
6376                     tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 2));
6377                     gen_helper_neon_fcvt_f32_to_f16(tmp, cpu_F0s, cpu_env);
6378                     tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 3));
6379                     neon_store_reg(rd, 0, tmp2);
6380                     tmp2 = tcg_temp_new_i32();
6381                     gen_helper_neon_fcvt_f32_to_f16(tmp2, cpu_F0s, cpu_env);
6382                     tcg_gen_shli_i32(tmp2, tmp2, 16);
6383                     tcg_gen_or_i32(tmp2, tmp2, tmp);
6384                     neon_store_reg(rd, 1, tmp2);
6385                     tcg_temp_free_i32(tmp);
6386                     break;
6387                 case NEON_2RM_VCVT_F32_F16:
6388                     if (!arm_feature(env, ARM_FEATURE_VFP_FP16) ||
6389                         q || (rd & 1)) {
6390                         return 1;
6391                     }
6392                     tmp3 = tcg_temp_new_i32();
6393                     tmp = neon_load_reg(rm, 0);
6394                     tmp2 = neon_load_reg(rm, 1);
6395                     tcg_gen_ext16u_i32(tmp3, tmp);
6396                     gen_helper_neon_fcvt_f16_to_f32(cpu_F0s, tmp3, cpu_env);
6397                     tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 0));
6398                     tcg_gen_shri_i32(tmp3, tmp, 16);
6399                     gen_helper_neon_fcvt_f16_to_f32(cpu_F0s, tmp3, cpu_env);
6400                     tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 1));
6401                     tcg_temp_free_i32(tmp);
6402                     tcg_gen_ext16u_i32(tmp3, tmp2);
6403                     gen_helper_neon_fcvt_f16_to_f32(cpu_F0s, tmp3, cpu_env);
6404                     tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 2));
6405                     tcg_gen_shri_i32(tmp3, tmp2, 16);
6406                     gen_helper_neon_fcvt_f16_to_f32(cpu_F0s, tmp3, cpu_env);
6407                     tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 3));
6408                     tcg_temp_free_i32(tmp2);
6409                     tcg_temp_free_i32(tmp3);
6410                     break;
6411                 case NEON_2RM_AESE: case NEON_2RM_AESMC:
6412                     if (!arm_feature(env, ARM_FEATURE_V8_AES)
6413                         || ((rm | rd) & 1)) {
6414                         return 1;
6415                     }
6416                     tmp = tcg_const_i32(rd);
6417                     tmp2 = tcg_const_i32(rm);
6418
6419                      /* Bit 6 is the lowest opcode bit; it distinguishes between
6420                       * encryption (AESE/AESMC) and decryption (AESD/AESIMC)
6421                       */
6422                     tmp3 = tcg_const_i32(extract32(insn, 6, 1));
6423
6424                     if (op == NEON_2RM_AESE) {
6425                         gen_helper_crypto_aese(cpu_env, tmp, tmp2, tmp3);
6426                     } else {
6427                         gen_helper_crypto_aesmc(cpu_env, tmp, tmp2, tmp3);
6428                     }
6429                     tcg_temp_free_i32(tmp);
6430                     tcg_temp_free_i32(tmp2);
6431                     tcg_temp_free_i32(tmp3);
6432                     break;
6433                 default:
6434                 elementwise:
6435                     for (pass = 0; pass < (q ? 4 : 2); pass++) {
6436                         if (neon_2rm_is_float_op(op)) {
6437                             tcg_gen_ld_f32(cpu_F0s, cpu_env,
6438                                            neon_reg_offset(rm, pass));
6439                             TCGV_UNUSED_I32(tmp);
6440                         } else {
6441                             tmp = neon_load_reg(rm, pass);
6442                         }
6443                         switch (op) {
6444                         case NEON_2RM_VREV32:
6445                             switch (size) {
6446                             case 0: tcg_gen_bswap32_i32(tmp, tmp); break;
6447                             case 1: gen_swap_half(tmp); break;
6448                             default: abort();
6449                             }
6450                             break;
6451                         case NEON_2RM_VREV16:
6452                             gen_rev16(tmp);
6453                             break;
6454                         case NEON_2RM_VCLS:
6455                             switch (size) {
6456                             case 0: gen_helper_neon_cls_s8(tmp, tmp); break;
6457                             case 1: gen_helper_neon_cls_s16(tmp, tmp); break;
6458                             case 2: gen_helper_neon_cls_s32(tmp, tmp); break;
6459                             default: abort();
6460                             }
6461                             break;
6462                         case NEON_2RM_VCLZ:
6463                             switch (size) {
6464                             case 0: gen_helper_neon_clz_u8(tmp, tmp); break;
6465                             case 1: gen_helper_neon_clz_u16(tmp, tmp); break;
6466                             case 2: gen_helper_clz(tmp, tmp); break;
6467                             default: abort();
6468                             }
6469                             break;
6470                         case NEON_2RM_VCNT:
6471                             gen_helper_neon_cnt_u8(tmp, tmp);
6472                             break;
6473                         case NEON_2RM_VMVN:
6474                             tcg_gen_not_i32(tmp, tmp);
6475                             break;
6476                         case NEON_2RM_VQABS:
6477                             switch (size) {
6478                             case 0:
6479                                 gen_helper_neon_qabs_s8(tmp, cpu_env, tmp);
6480                                 break;
6481                             case 1:
6482                                 gen_helper_neon_qabs_s16(tmp, cpu_env, tmp);
6483                                 break;
6484                             case 2:
6485                                 gen_helper_neon_qabs_s32(tmp, cpu_env, tmp);
6486                                 break;
6487                             default: abort();
6488                             }
6489                             break;
6490                         case NEON_2RM_VQNEG:
6491                             switch (size) {
6492                             case 0:
6493                                 gen_helper_neon_qneg_s8(tmp, cpu_env, tmp);
6494                                 break;
6495                             case 1:
6496                                 gen_helper_neon_qneg_s16(tmp, cpu_env, tmp);
6497                                 break;
6498                             case 2:
6499                                 gen_helper_neon_qneg_s32(tmp, cpu_env, tmp);
6500                                 break;
6501                             default: abort();
6502                             }
6503                             break;
6504                         case NEON_2RM_VCGT0: case NEON_2RM_VCLE0:
6505                             tmp2 = tcg_const_i32(0);
6506                             switch(size) {
6507                             case 0: gen_helper_neon_cgt_s8(tmp, tmp, tmp2); break;
6508                             case 1: gen_helper_neon_cgt_s16(tmp, tmp, tmp2); break;
6509                             case 2: gen_helper_neon_cgt_s32(tmp, tmp, tmp2); break;
6510                             default: abort();
6511                             }
6512                             tcg_temp_free_i32(tmp2);
6513                             if (op == NEON_2RM_VCLE0) {
6514                                 tcg_gen_not_i32(tmp, tmp);
6515                             }
6516                             break;
6517                         case NEON_2RM_VCGE0: case NEON_2RM_VCLT0:
6518                             tmp2 = tcg_const_i32(0);
6519                             switch(size) {
6520                             case 0: gen_helper_neon_cge_s8(tmp, tmp, tmp2); break;
6521                             case 1: gen_helper_neon_cge_s16(tmp, tmp, tmp2); break;
6522                             case 2: gen_helper_neon_cge_s32(tmp, tmp, tmp2); break;
6523                             default: abort();
6524                             }
6525                             tcg_temp_free_i32(tmp2);
6526                             if (op == NEON_2RM_VCLT0) {
6527                                 tcg_gen_not_i32(tmp, tmp);
6528                             }
6529                             break;
6530                         case NEON_2RM_VCEQ0:
6531                             tmp2 = tcg_const_i32(0);
6532                             switch(size) {
6533                             case 0: gen_helper_neon_ceq_u8(tmp, tmp, tmp2); break;
6534                             case 1: gen_helper_neon_ceq_u16(tmp, tmp, tmp2); break;
6535                             case 2: gen_helper_neon_ceq_u32(tmp, tmp, tmp2); break;
6536                             default: abort();
6537                             }
6538                             tcg_temp_free_i32(tmp2);
6539                             break;
6540                         case NEON_2RM_VABS:
6541                             switch(size) {
6542                             case 0: gen_helper_neon_abs_s8(tmp, tmp); break;
6543                             case 1: gen_helper_neon_abs_s16(tmp, tmp); break;
6544                             case 2: tcg_gen_abs_i32(tmp, tmp); break;
6545                             default: abort();
6546                             }
6547                             break;
6548                         case NEON_2RM_VNEG:
6549                             tmp2 = tcg_const_i32(0);
6550                             gen_neon_rsb(size, tmp, tmp2);
6551                             tcg_temp_free_i32(tmp2);
6552                             break;
6553                         case NEON_2RM_VCGT0_F:
6554                         {
6555                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6556                             tmp2 = tcg_const_i32(0);
6557                             gen_helper_neon_cgt_f32(tmp, tmp, tmp2, fpstatus);
6558                             tcg_temp_free_i32(tmp2);
6559                             tcg_temp_free_ptr(fpstatus);
6560                             break;
6561                         }
6562                         case NEON_2RM_VCGE0_F:
6563                         {
6564                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6565                             tmp2 = tcg_const_i32(0);
6566                             gen_helper_neon_cge_f32(tmp, tmp, tmp2, fpstatus);
6567                             tcg_temp_free_i32(tmp2);
6568                             tcg_temp_free_ptr(fpstatus);
6569                             break;
6570                         }
6571                         case NEON_2RM_VCEQ0_F:
6572                         {
6573                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6574                             tmp2 = tcg_const_i32(0);
6575                             gen_helper_neon_ceq_f32(tmp, tmp, tmp2, fpstatus);
6576                             tcg_temp_free_i32(tmp2);
6577                             tcg_temp_free_ptr(fpstatus);
6578                             break;
6579                         }
6580                         case NEON_2RM_VCLE0_F:
6581                         {
6582                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6583                             tmp2 = tcg_const_i32(0);
6584                             gen_helper_neon_cge_f32(tmp, tmp2, tmp, fpstatus);
6585                             tcg_temp_free_i32(tmp2);
6586                             tcg_temp_free_ptr(fpstatus);
6587                             break;
6588                         }
6589                         case NEON_2RM_VCLT0_F:
6590                         {
6591                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6592                             tmp2 = tcg_const_i32(0);
6593                             gen_helper_neon_cgt_f32(tmp, tmp2, tmp, fpstatus);
6594                             tcg_temp_free_i32(tmp2);
6595                             tcg_temp_free_ptr(fpstatus);
6596                             break;
6597                         }
6598                         case NEON_2RM_VABS_F:
6599                             gen_vfp_abs(0);
6600                             break;
6601                         case NEON_2RM_VNEG_F:
6602                             gen_vfp_neg(0);
6603                             break;
6604                         case NEON_2RM_VSWP:
6605                             tmp2 = neon_load_reg(rd, pass);
6606                             neon_store_reg(rm, pass, tmp2);
6607                             break;
6608                         case NEON_2RM_VTRN:
6609                             tmp2 = neon_load_reg(rd, pass);
6610                             switch (size) {
6611                             case 0: gen_neon_trn_u8(tmp, tmp2); break;
6612                             case 1: gen_neon_trn_u16(tmp, tmp2); break;
6613                             default: abort();
6614                             }
6615                             neon_store_reg(rm, pass, tmp2);
6616                             break;
6617                         case NEON_2RM_VRINTN:
6618                         case NEON_2RM_VRINTA:
6619                         case NEON_2RM_VRINTM:
6620                         case NEON_2RM_VRINTP:
6621                         case NEON_2RM_VRINTZ:
6622                         {
6623                             TCGv_i32 tcg_rmode;
6624                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6625                             int rmode;
6626
6627                             if (op == NEON_2RM_VRINTZ) {
6628                                 rmode = FPROUNDING_ZERO;
6629                             } else {
6630                                 rmode = fp_decode_rm[((op & 0x6) >> 1) ^ 1];
6631                             }
6632
6633                             tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rmode));
6634                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
6635                                                       cpu_env);
6636                             gen_helper_rints(cpu_F0s, cpu_F0s, fpstatus);
6637                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
6638                                                       cpu_env);
6639                             tcg_temp_free_ptr(fpstatus);
6640                             tcg_temp_free_i32(tcg_rmode);
6641                             break;
6642                         }
6643                         case NEON_2RM_VRINTX:
6644                         {
6645                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
6646                             gen_helper_rints_exact(cpu_F0s, cpu_F0s, fpstatus);
6647                             tcg_temp_free_ptr(fpstatus);
6648                             break;
6649                         }
6650                         case NEON_2RM_VCVTAU:
6651                         case NEON_2RM_VCVTAS:
6652                         case NEON_2RM_VCVTNU:
6653                         case NEON_2RM_VCVTNS:
6654                         case NEON_2RM_VCVTPU:
6655                         case NEON_2RM_VCVTPS:
6656                         case NEON_2RM_VCVTMU:
6657                         case NEON_2RM_VCVTMS:
6658                         {
6659                             bool is_signed = !extract32(insn, 7, 1);
6660                             TCGv_ptr fpst = get_fpstatus_ptr(1);
6661                             TCGv_i32 tcg_rmode, tcg_shift;
6662                             int rmode = fp_decode_rm[extract32(insn, 8, 2)];
6663
6664                             tcg_shift = tcg_const_i32(0);
6665                             tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rmode));
6666                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
6667                                                       cpu_env);
6668
6669                             if (is_signed) {
6670                                 gen_helper_vfp_tosls(cpu_F0s, cpu_F0s,
6671                                                      tcg_shift, fpst);
6672                             } else {
6673                                 gen_helper_vfp_touls(cpu_F0s, cpu_F0s,
6674                                                      tcg_shift, fpst);
6675                             }
6676
6677                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
6678                                                       cpu_env);
6679                             tcg_temp_free_i32(tcg_rmode);
6680                             tcg_temp_free_i32(tcg_shift);
6681                             tcg_temp_free_ptr(fpst);
6682                             break;
6683                         }
6684                         case NEON_2RM_VRECPE:
6685                             gen_helper_recpe_u32(tmp, tmp, cpu_env);
6686                             break;
6687                         case NEON_2RM_VRSQRTE:
6688                             gen_helper_rsqrte_u32(tmp, tmp, cpu_env);
6689                             break;
6690                         case NEON_2RM_VRECPE_F:
6691                             gen_helper_recpe_f32(cpu_F0s, cpu_F0s, cpu_env);
6692                             break;
6693                         case NEON_2RM_VRSQRTE_F:
6694                             gen_helper_rsqrte_f32(cpu_F0s, cpu_F0s, cpu_env);
6695                             break;
6696                         case NEON_2RM_VCVT_FS: /* VCVT.F32.S32 */
6697                             gen_vfp_sito(0, 1);
6698                             break;
6699                         case NEON_2RM_VCVT_FU: /* VCVT.F32.U32 */
6700                             gen_vfp_uito(0, 1);
6701                             break;
6702                         case NEON_2RM_VCVT_SF: /* VCVT.S32.F32 */
6703                             gen_vfp_tosiz(0, 1);
6704                             break;
6705                         case NEON_2RM_VCVT_UF: /* VCVT.U32.F32 */
6706                             gen_vfp_touiz(0, 1);
6707                             break;
6708                         default:
6709                             /* Reserved op values were caught by the
6710                              * neon_2rm_sizes[] check earlier.
6711                              */
6712                             abort();
6713                         }
6714                         if (neon_2rm_is_float_op(op)) {
6715                             tcg_gen_st_f32(cpu_F0s, cpu_env,
6716                                            neon_reg_offset(rd, pass));
6717                         } else {
6718                             neon_store_reg(rd, pass, tmp);
6719                         }
6720                     }
6721                     break;
6722                 }
6723             } else if ((insn & (1 << 10)) == 0) {
6724                 /* VTBL, VTBX.  */
6725                 int n = ((insn >> 8) & 3) + 1;
6726                 if ((rn + n) > 32) {
6727                     /* This is UNPREDICTABLE; we choose to UNDEF to avoid the
6728                      * helper function running off the end of the register file.
6729                      */
6730                     return 1;
6731                 }
6732                 n <<= 3;
6733                 if (insn & (1 << 6)) {
6734                     tmp = neon_load_reg(rd, 0);
6735                 } else {
6736                     tmp = tcg_temp_new_i32();
6737                     tcg_gen_movi_i32(tmp, 0);
6738                 }
6739                 tmp2 = neon_load_reg(rm, 0);
6740                 tmp4 = tcg_const_i32(rn);
6741                 tmp5 = tcg_const_i32(n);
6742                 gen_helper_neon_tbl(tmp2, cpu_env, tmp2, tmp, tmp4, tmp5);
6743                 tcg_temp_free_i32(tmp);
6744                 if (insn & (1 << 6)) {
6745                     tmp = neon_load_reg(rd, 1);
6746                 } else {
6747                     tmp = tcg_temp_new_i32();
6748                     tcg_gen_movi_i32(tmp, 0);
6749                 }
6750                 tmp3 = neon_load_reg(rm, 1);
6751                 gen_helper_neon_tbl(tmp3, cpu_env, tmp3, tmp, tmp4, tmp5);
6752                 tcg_temp_free_i32(tmp5);
6753                 tcg_temp_free_i32(tmp4);
6754                 neon_store_reg(rd, 0, tmp2);
6755                 neon_store_reg(rd, 1, tmp3);
6756                 tcg_temp_free_i32(tmp);
6757             } else if ((insn & 0x380) == 0) {
6758                 /* VDUP */
6759                 if ((insn & (7 << 16)) == 0 || (q && (rd & 1))) {
6760                     return 1;
6761                 }
6762                 if (insn & (1 << 19)) {
6763                     tmp = neon_load_reg(rm, 1);
6764                 } else {
6765                     tmp = neon_load_reg(rm, 0);
6766                 }
6767                 if (insn & (1 << 16)) {
6768                     gen_neon_dup_u8(tmp, ((insn >> 17) & 3) * 8);
6769                 } else if (insn & (1 << 17)) {
6770                     if ((insn >> 18) & 1)
6771                         gen_neon_dup_high16(tmp);
6772                     else
6773                         gen_neon_dup_low16(tmp);
6774                 }
6775                 for (pass = 0; pass < (q ? 4 : 2); pass++) {
6776                     tmp2 = tcg_temp_new_i32();
6777                     tcg_gen_mov_i32(tmp2, tmp);
6778                     neon_store_reg(rd, pass, tmp2);
6779                 }
6780                 tcg_temp_free_i32(tmp);
6781             } else {
6782                 return 1;
6783             }
6784         }
6785     }
6786     return 0;
6787 }
6788
6789 static int disas_coproc_insn(CPUARMState * env, DisasContext *s, uint32_t insn)
6790 {
6791     int cpnum, is64, crn, crm, opc1, opc2, isread, rt, rt2;
6792     const ARMCPRegInfo *ri;
6793
6794     cpnum = (insn >> 8) & 0xf;
6795     if (arm_feature(env, ARM_FEATURE_XSCALE)
6796             && ((env->cp15.c15_cpar ^ 0x3fff) & (1 << cpnum)))
6797         return 1;
6798
6799     /* First check for coprocessor space used for actual instructions */
6800     switch (cpnum) {
6801       case 0:
6802       case 1:
6803         if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
6804             return disas_iwmmxt_insn(env, s, insn);
6805         } else if (arm_feature(env, ARM_FEATURE_XSCALE)) {
6806             return disas_dsp_insn(env, s, insn);
6807         }
6808         return 1;
6809     default:
6810         break;
6811     }
6812
6813     /* Otherwise treat as a generic register access */
6814     is64 = (insn & (1 << 25)) == 0;
6815     if (!is64 && ((insn & (1 << 4)) == 0)) {
6816         /* cdp */
6817         return 1;
6818     }
6819
6820     crm = insn & 0xf;
6821     if (is64) {
6822         crn = 0;
6823         opc1 = (insn >> 4) & 0xf;
6824         opc2 = 0;
6825         rt2 = (insn >> 16) & 0xf;
6826     } else {
6827         crn = (insn >> 16) & 0xf;
6828         opc1 = (insn >> 21) & 7;
6829         opc2 = (insn >> 5) & 7;
6830         rt2 = 0;
6831     }
6832     isread = (insn >> 20) & 1;
6833     rt = (insn >> 12) & 0xf;
6834
6835     ri = get_arm_cp_reginfo(s->cp_regs,
6836                             ENCODE_CP_REG(cpnum, is64, crn, crm, opc1, opc2));
6837     if (ri) {
6838         /* Check access permissions */
6839         if (!cp_access_ok(s->current_pl, ri, isread)) {
6840             return 1;
6841         }
6842
6843         if (ri->accessfn) {
6844             /* Emit code to perform further access permissions checks at
6845              * runtime; this may result in an exception.
6846              */
6847             TCGv_ptr tmpptr;
6848             gen_set_pc_im(s, s->pc);
6849             tmpptr = tcg_const_ptr(ri);
6850             gen_helper_access_check_cp_reg(cpu_env, tmpptr);
6851             tcg_temp_free_ptr(tmpptr);
6852         }
6853
6854         /* Handle special cases first */
6855         switch (ri->type & ~(ARM_CP_FLAG_MASK & ~ARM_CP_SPECIAL)) {
6856         case ARM_CP_NOP:
6857             return 0;
6858         case ARM_CP_WFI:
6859             if (isread) {
6860                 return 1;
6861             }
6862             gen_set_pc_im(s, s->pc);
6863             s->is_jmp = DISAS_WFI;
6864             return 0;
6865         default:
6866             break;
6867         }
6868
6869         if (use_icount && (ri->type & ARM_CP_IO)) {
6870             gen_io_start();
6871         }
6872
6873         if (isread) {
6874             /* Read */
6875             if (is64) {
6876                 TCGv_i64 tmp64;
6877                 TCGv_i32 tmp;
6878                 if (ri->type & ARM_CP_CONST) {
6879                     tmp64 = tcg_const_i64(ri->resetvalue);
6880                 } else if (ri->readfn) {
6881                     TCGv_ptr tmpptr;
6882                     tmp64 = tcg_temp_new_i64();
6883                     tmpptr = tcg_const_ptr(ri);
6884                     gen_helper_get_cp_reg64(tmp64, cpu_env, tmpptr);
6885                     tcg_temp_free_ptr(tmpptr);
6886                 } else {
6887                     tmp64 = tcg_temp_new_i64();
6888                     tcg_gen_ld_i64(tmp64, cpu_env, ri->fieldoffset);
6889                 }
6890                 tmp = tcg_temp_new_i32();
6891                 tcg_gen_trunc_i64_i32(tmp, tmp64);
6892                 store_reg(s, rt, tmp);
6893                 tcg_gen_shri_i64(tmp64, tmp64, 32);
6894                 tmp = tcg_temp_new_i32();
6895                 tcg_gen_trunc_i64_i32(tmp, tmp64);
6896                 tcg_temp_free_i64(tmp64);
6897                 store_reg(s, rt2, tmp);
6898             } else {
6899                 TCGv_i32 tmp;
6900                 if (ri->type & ARM_CP_CONST) {
6901                     tmp = tcg_const_i32(ri->resetvalue);
6902                 } else if (ri->readfn) {
6903                     TCGv_ptr tmpptr;
6904                     tmp = tcg_temp_new_i32();
6905                     tmpptr = tcg_const_ptr(ri);
6906                     gen_helper_get_cp_reg(tmp, cpu_env, tmpptr);
6907                     tcg_temp_free_ptr(tmpptr);
6908                 } else {
6909                     tmp = load_cpu_offset(ri->fieldoffset);
6910                 }
6911                 if (rt == 15) {
6912                     /* Destination register of r15 for 32 bit loads sets
6913                      * the condition codes from the high 4 bits of the value
6914                      */
6915                     gen_set_nzcv(tmp);
6916                     tcg_temp_free_i32(tmp);
6917                 } else {
6918                     store_reg(s, rt, tmp);
6919                 }
6920             }
6921         } else {
6922             /* Write */
6923             if (ri->type & ARM_CP_CONST) {
6924                 /* If not forbidden by access permissions, treat as WI */
6925                 return 0;
6926             }
6927
6928             if (is64) {
6929                 TCGv_i32 tmplo, tmphi;
6930                 TCGv_i64 tmp64 = tcg_temp_new_i64();
6931                 tmplo = load_reg(s, rt);
6932                 tmphi = load_reg(s, rt2);
6933                 tcg_gen_concat_i32_i64(tmp64, tmplo, tmphi);
6934                 tcg_temp_free_i32(tmplo);
6935                 tcg_temp_free_i32(tmphi);
6936                 if (ri->writefn) {
6937                     TCGv_ptr tmpptr = tcg_const_ptr(ri);
6938                     gen_helper_set_cp_reg64(cpu_env, tmpptr, tmp64);
6939                     tcg_temp_free_ptr(tmpptr);
6940                 } else {
6941                     tcg_gen_st_i64(tmp64, cpu_env, ri->fieldoffset);
6942                 }
6943                 tcg_temp_free_i64(tmp64);
6944             } else {
6945                 if (ri->writefn) {
6946                     TCGv_i32 tmp;
6947                     TCGv_ptr tmpptr;
6948                     tmp = load_reg(s, rt);
6949                     tmpptr = tcg_const_ptr(ri);
6950                     gen_helper_set_cp_reg(cpu_env, tmpptr, tmp);
6951                     tcg_temp_free_ptr(tmpptr);
6952                     tcg_temp_free_i32(tmp);
6953                 } else {
6954                     TCGv_i32 tmp = load_reg(s, rt);
6955                     store_cpu_offset(tmp, ri->fieldoffset);
6956                 }
6957             }
6958         }
6959
6960         if (use_icount && (ri->type & ARM_CP_IO)) {
6961             /* I/O operations must end the TB here (whether read or write) */
6962             gen_io_end();
6963             gen_lookup_tb(s);
6964         } else if (!isread && !(ri->type & ARM_CP_SUPPRESS_TB_END)) {
6965             /* We default to ending the TB on a coprocessor register write,
6966              * but allow this to be suppressed by the register definition
6967              * (usually only necessary to work around guest bugs).
6968              */
6969             gen_lookup_tb(s);
6970         }
6971
6972         return 0;
6973     }
6974
6975     /* Unknown register; this might be a guest error or a QEMU
6976      * unimplemented feature.
6977      */
6978     if (is64) {
6979         qemu_log_mask(LOG_UNIMP, "%s access to unsupported AArch32 "
6980                       "64 bit system register cp:%d opc1: %d crm:%d\n",
6981                       isread ? "read" : "write", cpnum, opc1, crm);
6982     } else {
6983         qemu_log_mask(LOG_UNIMP, "%s access to unsupported AArch32 "
6984                       "system register cp:%d opc1:%d crn:%d crm:%d opc2:%d\n",
6985                       isread ? "read" : "write", cpnum, opc1, crn, crm, opc2);
6986     }
6987
6988     return 1;
6989 }
6990
6991
6992 /* Store a 64-bit value to a register pair.  Clobbers val.  */
6993 static void gen_storeq_reg(DisasContext *s, int rlow, int rhigh, TCGv_i64 val)
6994 {
6995     TCGv_i32 tmp;
6996     tmp = tcg_temp_new_i32();
6997     tcg_gen_trunc_i64_i32(tmp, val);
6998     store_reg(s, rlow, tmp);
6999     tmp = tcg_temp_new_i32();
7000     tcg_gen_shri_i64(val, val, 32);
7001     tcg_gen_trunc_i64_i32(tmp, val);
7002     store_reg(s, rhigh, tmp);
7003 }
7004
7005 /* load a 32-bit value from a register and perform a 64-bit accumulate.  */
7006 static void gen_addq_lo(DisasContext *s, TCGv_i64 val, int rlow)
7007 {
7008     TCGv_i64 tmp;
7009     TCGv_i32 tmp2;
7010
7011     /* Load value and extend to 64 bits.  */
7012     tmp = tcg_temp_new_i64();
7013     tmp2 = load_reg(s, rlow);
7014     tcg_gen_extu_i32_i64(tmp, tmp2);
7015     tcg_temp_free_i32(tmp2);
7016     tcg_gen_add_i64(val, val, tmp);
7017     tcg_temp_free_i64(tmp);
7018 }
7019
7020 /* load and add a 64-bit value from a register pair.  */
7021 static void gen_addq(DisasContext *s, TCGv_i64 val, int rlow, int rhigh)
7022 {
7023     TCGv_i64 tmp;
7024     TCGv_i32 tmpl;
7025     TCGv_i32 tmph;
7026
7027     /* Load 64-bit value rd:rn.  */
7028     tmpl = load_reg(s, rlow);
7029     tmph = load_reg(s, rhigh);
7030     tmp = tcg_temp_new_i64();
7031     tcg_gen_concat_i32_i64(tmp, tmpl, tmph);
7032     tcg_temp_free_i32(tmpl);
7033     tcg_temp_free_i32(tmph);
7034     tcg_gen_add_i64(val, val, tmp);
7035     tcg_temp_free_i64(tmp);
7036 }
7037
7038 /* Set N and Z flags from hi|lo.  */
7039 static void gen_logicq_cc(TCGv_i32 lo, TCGv_i32 hi)
7040 {
7041     tcg_gen_mov_i32(cpu_NF, hi);
7042     tcg_gen_or_i32(cpu_ZF, lo, hi);
7043 }
7044
7045 /* Load/Store exclusive instructions are implemented by remembering
7046    the value/address loaded, and seeing if these are the same
7047    when the store is performed. This should be sufficient to implement
7048    the architecturally mandated semantics, and avoids having to monitor
7049    regular stores.
7050
7051    In system emulation mode only one CPU will be running at once, so
7052    this sequence is effectively atomic.  In user emulation mode we
7053    throw an exception and handle the atomic operation elsewhere.  */
7054 static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
7055                                TCGv_i32 addr, int size)
7056 {
7057     TCGv_i32 tmp = tcg_temp_new_i32();
7058
7059     switch (size) {
7060     case 0:
7061         gen_aa32_ld8u(tmp, addr, IS_USER(s));
7062         break;
7063     case 1:
7064         gen_aa32_ld16u(tmp, addr, IS_USER(s));
7065         break;
7066     case 2:
7067     case 3:
7068         gen_aa32_ld32u(tmp, addr, IS_USER(s));
7069         break;
7070     default:
7071         abort();
7072     }
7073
7074     if (size == 3) {
7075         TCGv_i32 tmp2 = tcg_temp_new_i32();
7076         TCGv_i32 tmp3 = tcg_temp_new_i32();
7077
7078         tcg_gen_addi_i32(tmp2, addr, 4);
7079         gen_aa32_ld32u(tmp3, tmp2, IS_USER(s));
7080         tcg_temp_free_i32(tmp2);
7081         tcg_gen_concat_i32_i64(cpu_exclusive_val, tmp, tmp3);
7082         store_reg(s, rt2, tmp3);
7083     } else {
7084         tcg_gen_extu_i32_i64(cpu_exclusive_val, tmp);
7085     }
7086
7087     store_reg(s, rt, tmp);
7088     tcg_gen_extu_i32_i64(cpu_exclusive_addr, addr);
7089 }
7090
7091 static void gen_clrex(DisasContext *s)
7092 {
7093     tcg_gen_movi_i64(cpu_exclusive_addr, -1);
7094 }
7095
7096 #ifdef CONFIG_USER_ONLY
7097 static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
7098                                 TCGv_i32 addr, int size)
7099 {
7100     tcg_gen_extu_i32_i64(cpu_exclusive_test, addr);
7101     tcg_gen_movi_i32(cpu_exclusive_info,
7102                      size | (rd << 4) | (rt << 8) | (rt2 << 12));
7103     gen_exception_insn(s, 4, EXCP_STREX);
7104 }
7105 #else
7106 static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
7107                                 TCGv_i32 addr, int size)
7108 {
7109     TCGv_i32 tmp;
7110     TCGv_i64 val64, extaddr;
7111     int done_label;
7112     int fail_label;
7113
7114     /* if (env->exclusive_addr == addr && env->exclusive_val == [addr]) {
7115          [addr] = {Rt};
7116          {Rd} = 0;
7117        } else {
7118          {Rd} = 1;
7119        } */
7120     fail_label = gen_new_label();
7121     done_label = gen_new_label();
7122     extaddr = tcg_temp_new_i64();
7123     tcg_gen_extu_i32_i64(extaddr, addr);
7124     tcg_gen_brcond_i64(TCG_COND_NE, extaddr, cpu_exclusive_addr, fail_label);
7125     tcg_temp_free_i64(extaddr);
7126
7127     tmp = tcg_temp_new_i32();
7128     switch (size) {
7129     case 0:
7130         gen_aa32_ld8u(tmp, addr, IS_USER(s));
7131         break;
7132     case 1:
7133         gen_aa32_ld16u(tmp, addr, IS_USER(s));
7134         break;
7135     case 2:
7136     case 3:
7137         gen_aa32_ld32u(tmp, addr, IS_USER(s));
7138         break;
7139     default:
7140         abort();
7141     }
7142
7143     val64 = tcg_temp_new_i64();
7144     if (size == 3) {
7145         TCGv_i32 tmp2 = tcg_temp_new_i32();
7146         TCGv_i32 tmp3 = tcg_temp_new_i32();
7147         tcg_gen_addi_i32(tmp2, addr, 4);
7148         gen_aa32_ld32u(tmp3, tmp2, IS_USER(s));
7149         tcg_temp_free_i32(tmp2);
7150         tcg_gen_concat_i32_i64(val64, tmp, tmp3);
7151         tcg_temp_free_i32(tmp3);
7152     } else {
7153         tcg_gen_extu_i32_i64(val64, tmp);
7154     }
7155     tcg_temp_free_i32(tmp);
7156
7157     tcg_gen_brcond_i64(TCG_COND_NE, val64, cpu_exclusive_val, fail_label);
7158     tcg_temp_free_i64(val64);
7159
7160     tmp = load_reg(s, rt);
7161     switch (size) {
7162     case 0:
7163         gen_aa32_st8(tmp, addr, IS_USER(s));
7164         break;
7165     case 1:
7166         gen_aa32_st16(tmp, addr, IS_USER(s));
7167         break;
7168     case 2:
7169     case 3:
7170         gen_aa32_st32(tmp, addr, IS_USER(s));
7171         break;
7172     default:
7173         abort();
7174     }
7175     tcg_temp_free_i32(tmp);
7176     if (size == 3) {
7177         tcg_gen_addi_i32(addr, addr, 4);
7178         tmp = load_reg(s, rt2);
7179         gen_aa32_st32(tmp, addr, IS_USER(s));
7180         tcg_temp_free_i32(tmp);
7181     }
7182     tcg_gen_movi_i32(cpu_R[rd], 0);
7183     tcg_gen_br(done_label);
7184     gen_set_label(fail_label);
7185     tcg_gen_movi_i32(cpu_R[rd], 1);
7186     gen_set_label(done_label);
7187     tcg_gen_movi_i64(cpu_exclusive_addr, -1);
7188 }
7189 #endif
7190
7191 /* gen_srs:
7192  * @env: CPUARMState
7193  * @s: DisasContext
7194  * @mode: mode field from insn (which stack to store to)
7195  * @amode: addressing mode (DA/IA/DB/IB), encoded as per P,U bits in ARM insn
7196  * @writeback: true if writeback bit set
7197  *
7198  * Generate code for the SRS (Store Return State) insn.
7199  */
7200 static void gen_srs(DisasContext *s,
7201                     uint32_t mode, uint32_t amode, bool writeback)
7202 {
7203     int32_t offset;
7204     TCGv_i32 addr = tcg_temp_new_i32();
7205     TCGv_i32 tmp = tcg_const_i32(mode);
7206     gen_helper_get_r13_banked(addr, cpu_env, tmp);
7207     tcg_temp_free_i32(tmp);
7208     switch (amode) {
7209     case 0: /* DA */
7210         offset = -4;
7211         break;
7212     case 1: /* IA */
7213         offset = 0;
7214         break;
7215     case 2: /* DB */
7216         offset = -8;
7217         break;
7218     case 3: /* IB */
7219         offset = 4;
7220         break;
7221     default:
7222         abort();
7223     }
7224     tcg_gen_addi_i32(addr, addr, offset);
7225     tmp = load_reg(s, 14);
7226     gen_aa32_st32(tmp, addr, 0);
7227     tcg_temp_free_i32(tmp);
7228     tmp = load_cpu_field(spsr);
7229     tcg_gen_addi_i32(addr, addr, 4);
7230     gen_aa32_st32(tmp, addr, 0);
7231     tcg_temp_free_i32(tmp);
7232     if (writeback) {
7233         switch (amode) {
7234         case 0:
7235             offset = -8;
7236             break;
7237         case 1:
7238             offset = 4;
7239             break;
7240         case 2:
7241             offset = -4;
7242             break;
7243         case 3:
7244             offset = 0;
7245             break;
7246         default:
7247             abort();
7248         }
7249         tcg_gen_addi_i32(addr, addr, offset);
7250         tmp = tcg_const_i32(mode);
7251         gen_helper_set_r13_banked(cpu_env, tmp, addr);
7252         tcg_temp_free_i32(tmp);
7253     }
7254     tcg_temp_free_i32(addr);
7255 }
7256
7257 static void disas_arm_insn(CPUARMState * env, DisasContext *s)
7258 {
7259     unsigned int cond, insn, val, op1, i, shift, rm, rs, rn, rd, sh;
7260     TCGv_i32 tmp;
7261     TCGv_i32 tmp2;
7262     TCGv_i32 tmp3;
7263     TCGv_i32 addr;
7264     TCGv_i64 tmp64;
7265
7266     insn = arm_ldl_code(env, s->pc, s->bswap_code);
7267     s->pc += 4;
7268
7269     /* M variants do not implement ARM mode.  */
7270     if (IS_M(env))
7271         goto illegal_op;
7272     cond = insn >> 28;
7273     if (cond == 0xf){
7274         /* In ARMv3 and v4 the NV condition is UNPREDICTABLE; we
7275          * choose to UNDEF. In ARMv5 and above the space is used
7276          * for miscellaneous unconditional instructions.
7277          */
7278         ARCH(5);
7279
7280         /* Unconditional instructions.  */
7281         if (((insn >> 25) & 7) == 1) {
7282             /* NEON Data processing.  */
7283             if (!arm_feature(env, ARM_FEATURE_NEON))
7284                 goto illegal_op;
7285
7286             if (disas_neon_data_insn(env, s, insn))
7287                 goto illegal_op;
7288             return;
7289         }
7290         if ((insn & 0x0f100000) == 0x04000000) {
7291             /* NEON load/store.  */
7292             if (!arm_feature(env, ARM_FEATURE_NEON))
7293                 goto illegal_op;
7294
7295             if (disas_neon_ls_insn(env, s, insn))
7296                 goto illegal_op;
7297             return;
7298         }
7299         if ((insn & 0x0f000e10) == 0x0e000a00) {
7300             /* VFP.  */
7301             if (disas_vfp_insn(env, s, insn)) {
7302                 goto illegal_op;
7303             }
7304             return;
7305         }
7306         if (((insn & 0x0f30f000) == 0x0510f000) ||
7307             ((insn & 0x0f30f010) == 0x0710f000)) {
7308             if ((insn & (1 << 22)) == 0) {
7309                 /* PLDW; v7MP */
7310                 if (!arm_feature(env, ARM_FEATURE_V7MP)) {
7311                     goto illegal_op;
7312                 }
7313             }
7314             /* Otherwise PLD; v5TE+ */
7315             ARCH(5TE);
7316             return;
7317         }
7318         if (((insn & 0x0f70f000) == 0x0450f000) ||
7319             ((insn & 0x0f70f010) == 0x0650f000)) {
7320             ARCH(7);
7321             return; /* PLI; V7 */
7322         }
7323         if (((insn & 0x0f700000) == 0x04100000) ||
7324             ((insn & 0x0f700010) == 0x06100000)) {
7325             if (!arm_feature(env, ARM_FEATURE_V7MP)) {
7326                 goto illegal_op;
7327             }
7328             return; /* v7MP: Unallocated memory hint: must NOP */
7329         }
7330
7331         if ((insn & 0x0ffffdff) == 0x01010000) {
7332             ARCH(6);
7333             /* setend */
7334             if (((insn >> 9) & 1) != s->bswap_code) {
7335                 /* Dynamic endianness switching not implemented. */
7336                 qemu_log_mask(LOG_UNIMP, "arm: unimplemented setend\n");
7337                 goto illegal_op;
7338             }
7339             return;
7340         } else if ((insn & 0x0fffff00) == 0x057ff000) {
7341             switch ((insn >> 4) & 0xf) {
7342             case 1: /* clrex */
7343                 ARCH(6K);
7344                 gen_clrex(s);
7345                 return;
7346             case 4: /* dsb */
7347             case 5: /* dmb */
7348             case 6: /* isb */
7349                 ARCH(7);
7350                 /* We don't emulate caches so these are a no-op.  */
7351                 return;
7352             default:
7353                 goto illegal_op;
7354             }
7355         } else if ((insn & 0x0e5fffe0) == 0x084d0500) {
7356             /* srs */
7357             if (IS_USER(s)) {
7358                 goto illegal_op;
7359             }
7360             ARCH(6);
7361             gen_srs(s, (insn & 0x1f), (insn >> 23) & 3, insn & (1 << 21));
7362             return;
7363         } else if ((insn & 0x0e50ffe0) == 0x08100a00) {
7364             /* rfe */
7365             int32_t offset;
7366             if (IS_USER(s))
7367                 goto illegal_op;
7368             ARCH(6);
7369             rn = (insn >> 16) & 0xf;
7370             addr = load_reg(s, rn);
7371             i = (insn >> 23) & 3;
7372             switch (i) {
7373             case 0: offset = -4; break; /* DA */
7374             case 1: offset = 0; break; /* IA */
7375             case 2: offset = -8; break; /* DB */
7376             case 3: offset = 4; break; /* IB */
7377             default: abort();
7378             }
7379             if (offset)
7380                 tcg_gen_addi_i32(addr, addr, offset);
7381             /* Load PC into tmp and CPSR into tmp2.  */
7382             tmp = tcg_temp_new_i32();
7383             gen_aa32_ld32u(tmp, addr, 0);
7384             tcg_gen_addi_i32(addr, addr, 4);
7385             tmp2 = tcg_temp_new_i32();
7386             gen_aa32_ld32u(tmp2, addr, 0);
7387             if (insn & (1 << 21)) {
7388                 /* Base writeback.  */
7389                 switch (i) {
7390                 case 0: offset = -8; break;
7391                 case 1: offset = 4; break;
7392                 case 2: offset = -4; break;
7393                 case 3: offset = 0; break;
7394                 default: abort();
7395                 }
7396                 if (offset)
7397                     tcg_gen_addi_i32(addr, addr, offset);
7398                 store_reg(s, rn, addr);
7399             } else {
7400                 tcg_temp_free_i32(addr);
7401             }
7402             gen_rfe(s, tmp, tmp2);
7403             return;
7404         } else if ((insn & 0x0e000000) == 0x0a000000) {
7405             /* branch link and change to thumb (blx <offset>) */
7406             int32_t offset;
7407
7408             val = (uint32_t)s->pc;
7409             tmp = tcg_temp_new_i32();
7410             tcg_gen_movi_i32(tmp, val);
7411             store_reg(s, 14, tmp);
7412             /* Sign-extend the 24-bit offset */
7413             offset = (((int32_t)insn) << 8) >> 8;
7414             /* offset * 4 + bit24 * 2 + (thumb bit) */
7415             val += (offset << 2) | ((insn >> 23) & 2) | 1;
7416             /* pipeline offset */
7417             val += 4;
7418             /* protected by ARCH(5); above, near the start of uncond block */
7419             gen_bx_im(s, val);
7420             return;
7421         } else if ((insn & 0x0e000f00) == 0x0c000100) {
7422             if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
7423                 /* iWMMXt register transfer.  */
7424                 if (env->cp15.c15_cpar & (1 << 1))
7425                     if (!disas_iwmmxt_insn(env, s, insn))
7426                         return;
7427             }
7428         } else if ((insn & 0x0fe00000) == 0x0c400000) {
7429             /* Coprocessor double register transfer.  */
7430             ARCH(5TE);
7431         } else if ((insn & 0x0f000010) == 0x0e000010) {
7432             /* Additional coprocessor register transfer.  */
7433         } else if ((insn & 0x0ff10020) == 0x01000000) {
7434             uint32_t mask;
7435             uint32_t val;
7436             /* cps (privileged) */
7437             if (IS_USER(s))
7438                 return;
7439             mask = val = 0;
7440             if (insn & (1 << 19)) {
7441                 if (insn & (1 << 8))
7442                     mask |= CPSR_A;
7443                 if (insn & (1 << 7))
7444                     mask |= CPSR_I;
7445                 if (insn & (1 << 6))
7446                     mask |= CPSR_F;
7447                 if (insn & (1 << 18))
7448                     val |= mask;
7449             }
7450             if (insn & (1 << 17)) {
7451                 mask |= CPSR_M;
7452                 val |= (insn & 0x1f);
7453             }
7454             if (mask) {
7455                 gen_set_psr_im(s, mask, 0, val);
7456             }
7457             return;
7458         }
7459         goto illegal_op;
7460     }
7461     if (cond != 0xe) {
7462         /* if not always execute, we generate a conditional jump to
7463            next instruction */
7464         s->condlabel = gen_new_label();
7465         arm_gen_test_cc(cond ^ 1, s->condlabel);
7466         s->condjmp = 1;
7467     }
7468     if ((insn & 0x0f900000) == 0x03000000) {
7469         if ((insn & (1 << 21)) == 0) {
7470             ARCH(6T2);
7471             rd = (insn >> 12) & 0xf;
7472             val = ((insn >> 4) & 0xf000) | (insn & 0xfff);
7473             if ((insn & (1 << 22)) == 0) {
7474                 /* MOVW */
7475                 tmp = tcg_temp_new_i32();
7476                 tcg_gen_movi_i32(tmp, val);
7477             } else {
7478                 /* MOVT */
7479                 tmp = load_reg(s, rd);
7480                 tcg_gen_ext16u_i32(tmp, tmp);
7481                 tcg_gen_ori_i32(tmp, tmp, val << 16);
7482             }
7483             store_reg(s, rd, tmp);
7484         } else {
7485             if (((insn >> 12) & 0xf) != 0xf)
7486                 goto illegal_op;
7487             if (((insn >> 16) & 0xf) == 0) {
7488                 gen_nop_hint(s, insn & 0xff);
7489             } else {
7490                 /* CPSR = immediate */
7491                 val = insn & 0xff;
7492                 shift = ((insn >> 8) & 0xf) * 2;
7493                 if (shift)
7494                     val = (val >> shift) | (val << (32 - shift));
7495                 i = ((insn & (1 << 22)) != 0);
7496                 if (gen_set_psr_im(s, msr_mask(env, s, (insn >> 16) & 0xf, i), i, val))
7497                     goto illegal_op;
7498             }
7499         }
7500     } else if ((insn & 0x0f900000) == 0x01000000
7501                && (insn & 0x00000090) != 0x00000090) {
7502         /* miscellaneous instructions */
7503         op1 = (insn >> 21) & 3;
7504         sh = (insn >> 4) & 0xf;
7505         rm = insn & 0xf;
7506         switch (sh) {
7507         case 0x0: /* move program status register */
7508             if (op1 & 1) {
7509                 /* PSR = reg */
7510                 tmp = load_reg(s, rm);
7511                 i = ((op1 & 2) != 0);
7512                 if (gen_set_psr(s, msr_mask(env, s, (insn >> 16) & 0xf, i), i, tmp))
7513                     goto illegal_op;
7514             } else {
7515                 /* reg = PSR */
7516                 rd = (insn >> 12) & 0xf;
7517                 if (op1 & 2) {
7518                     if (IS_USER(s))
7519                         goto illegal_op;
7520                     tmp = load_cpu_field(spsr);
7521                 } else {
7522                     tmp = tcg_temp_new_i32();
7523                     gen_helper_cpsr_read(tmp, cpu_env);
7524                 }
7525                 store_reg(s, rd, tmp);
7526             }
7527             break;
7528         case 0x1:
7529             if (op1 == 1) {
7530                 /* branch/exchange thumb (bx).  */
7531                 ARCH(4T);
7532                 tmp = load_reg(s, rm);
7533                 gen_bx(s, tmp);
7534             } else if (op1 == 3) {
7535                 /* clz */
7536                 ARCH(5);
7537                 rd = (insn >> 12) & 0xf;
7538                 tmp = load_reg(s, rm);
7539                 gen_helper_clz(tmp, tmp);
7540                 store_reg(s, rd, tmp);
7541             } else {
7542                 goto illegal_op;
7543             }
7544             break;
7545         case 0x2:
7546             if (op1 == 1) {
7547                 ARCH(5J); /* bxj */
7548                 /* Trivial implementation equivalent to bx.  */
7549                 tmp = load_reg(s, rm);
7550                 gen_bx(s, tmp);
7551             } else {
7552                 goto illegal_op;
7553             }
7554             break;
7555         case 0x3:
7556             if (op1 != 1)
7557               goto illegal_op;
7558
7559             ARCH(5);
7560             /* branch link/exchange thumb (blx) */
7561             tmp = load_reg(s, rm);
7562             tmp2 = tcg_temp_new_i32();
7563             tcg_gen_movi_i32(tmp2, s->pc);
7564             store_reg(s, 14, tmp2);
7565             gen_bx(s, tmp);
7566             break;
7567         case 0x4:
7568         {
7569             /* crc32/crc32c */
7570             uint32_t c = extract32(insn, 8, 4);
7571
7572             /* Check this CPU supports ARMv8 CRC instructions.
7573              * op1 == 3 is UNPREDICTABLE but handle as UNDEFINED.
7574              * Bits 8, 10 and 11 should be zero.
7575              */
7576             if (!arm_feature(env, ARM_FEATURE_CRC) || op1 == 0x3 ||
7577                 (c & 0xd) != 0) {
7578                 goto illegal_op;
7579             }
7580
7581             rn = extract32(insn, 16, 4);
7582             rd = extract32(insn, 12, 4);
7583
7584             tmp = load_reg(s, rn);
7585             tmp2 = load_reg(s, rm);
7586             tmp3 = tcg_const_i32(1 << op1);
7587             if (c & 0x2) {
7588                 gen_helper_crc32c(tmp, tmp, tmp2, tmp3);
7589             } else {
7590                 gen_helper_crc32(tmp, tmp, tmp2, tmp3);
7591             }
7592             tcg_temp_free_i32(tmp2);
7593             tcg_temp_free_i32(tmp3);
7594             store_reg(s, rd, tmp);
7595             break;
7596         }
7597         case 0x5: /* saturating add/subtract */
7598             ARCH(5TE);
7599             rd = (insn >> 12) & 0xf;
7600             rn = (insn >> 16) & 0xf;
7601             tmp = load_reg(s, rm);
7602             tmp2 = load_reg(s, rn);
7603             if (op1 & 2)
7604                 gen_helper_double_saturate(tmp2, cpu_env, tmp2);
7605             if (op1 & 1)
7606                 gen_helper_sub_saturate(tmp, cpu_env, tmp, tmp2);
7607             else
7608                 gen_helper_add_saturate(tmp, cpu_env, tmp, tmp2);
7609             tcg_temp_free_i32(tmp2);
7610             store_reg(s, rd, tmp);
7611             break;
7612         case 7:
7613             /* SMC instruction (op1 == 3)
7614                and undefined instructions (op1 == 0 || op1 == 2)
7615                will trap */
7616             if (op1 != 1) {
7617                 goto illegal_op;
7618             }
7619             /* bkpt */
7620             ARCH(5);
7621             gen_exception_insn(s, 4, EXCP_BKPT);
7622             break;
7623         case 0x8: /* signed multiply */
7624         case 0xa:
7625         case 0xc:
7626         case 0xe:
7627             ARCH(5TE);
7628             rs = (insn >> 8) & 0xf;
7629             rn = (insn >> 12) & 0xf;
7630             rd = (insn >> 16) & 0xf;
7631             if (op1 == 1) {
7632                 /* (32 * 16) >> 16 */
7633                 tmp = load_reg(s, rm);
7634                 tmp2 = load_reg(s, rs);
7635                 if (sh & 4)
7636                     tcg_gen_sari_i32(tmp2, tmp2, 16);
7637                 else
7638                     gen_sxth(tmp2);
7639                 tmp64 = gen_muls_i64_i32(tmp, tmp2);
7640                 tcg_gen_shri_i64(tmp64, tmp64, 16);
7641                 tmp = tcg_temp_new_i32();
7642                 tcg_gen_trunc_i64_i32(tmp, tmp64);
7643                 tcg_temp_free_i64(tmp64);
7644                 if ((sh & 2) == 0) {
7645                     tmp2 = load_reg(s, rn);
7646                     gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
7647                     tcg_temp_free_i32(tmp2);
7648                 }
7649                 store_reg(s, rd, tmp);
7650             } else {
7651                 /* 16 * 16 */
7652                 tmp = load_reg(s, rm);
7653                 tmp2 = load_reg(s, rs);
7654                 gen_mulxy(tmp, tmp2, sh & 2, sh & 4);
7655                 tcg_temp_free_i32(tmp2);
7656                 if (op1 == 2) {
7657                     tmp64 = tcg_temp_new_i64();
7658                     tcg_gen_ext_i32_i64(tmp64, tmp);
7659                     tcg_temp_free_i32(tmp);
7660                     gen_addq(s, tmp64, rn, rd);
7661                     gen_storeq_reg(s, rn, rd, tmp64);
7662                     tcg_temp_free_i64(tmp64);
7663                 } else {
7664                     if (op1 == 0) {
7665                         tmp2 = load_reg(s, rn);
7666                         gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
7667                         tcg_temp_free_i32(tmp2);
7668                     }
7669                     store_reg(s, rd, tmp);
7670                 }
7671             }
7672             break;
7673         default:
7674             goto illegal_op;
7675         }
7676     } else if (((insn & 0x0e000000) == 0 &&
7677                 (insn & 0x00000090) != 0x90) ||
7678                ((insn & 0x0e000000) == (1 << 25))) {
7679         int set_cc, logic_cc, shiftop;
7680
7681         op1 = (insn >> 21) & 0xf;
7682         set_cc = (insn >> 20) & 1;
7683         logic_cc = table_logic_cc[op1] & set_cc;
7684
7685         /* data processing instruction */
7686         if (insn & (1 << 25)) {
7687             /* immediate operand */
7688             val = insn & 0xff;
7689             shift = ((insn >> 8) & 0xf) * 2;
7690             if (shift) {
7691                 val = (val >> shift) | (val << (32 - shift));
7692             }
7693             tmp2 = tcg_temp_new_i32();
7694             tcg_gen_movi_i32(tmp2, val);
7695             if (logic_cc && shift) {
7696                 gen_set_CF_bit31(tmp2);
7697             }
7698         } else {
7699             /* register */
7700             rm = (insn) & 0xf;
7701             tmp2 = load_reg(s, rm);
7702             shiftop = (insn >> 5) & 3;
7703             if (!(insn & (1 << 4))) {
7704                 shift = (insn >> 7) & 0x1f;
7705                 gen_arm_shift_im(tmp2, shiftop, shift, logic_cc);
7706             } else {
7707                 rs = (insn >> 8) & 0xf;
7708                 tmp = load_reg(s, rs);
7709                 gen_arm_shift_reg(tmp2, shiftop, tmp, logic_cc);
7710             }
7711         }
7712         if (op1 != 0x0f && op1 != 0x0d) {
7713             rn = (insn >> 16) & 0xf;
7714             tmp = load_reg(s, rn);
7715         } else {
7716             TCGV_UNUSED_I32(tmp);
7717         }
7718         rd = (insn >> 12) & 0xf;
7719         switch(op1) {
7720         case 0x00:
7721             tcg_gen_and_i32(tmp, tmp, tmp2);
7722             if (logic_cc) {
7723                 gen_logic_CC(tmp);
7724             }
7725             store_reg_bx(env, s, rd, tmp);
7726             break;
7727         case 0x01:
7728             tcg_gen_xor_i32(tmp, tmp, tmp2);
7729             if (logic_cc) {
7730                 gen_logic_CC(tmp);
7731             }
7732             store_reg_bx(env, s, rd, tmp);
7733             break;
7734         case 0x02:
7735             if (set_cc && rd == 15) {
7736                 /* SUBS r15, ... is used for exception return.  */
7737                 if (IS_USER(s)) {
7738                     goto illegal_op;
7739                 }
7740                 gen_sub_CC(tmp, tmp, tmp2);
7741                 gen_exception_return(s, tmp);
7742             } else {
7743                 if (set_cc) {
7744                     gen_sub_CC(tmp, tmp, tmp2);
7745                 } else {
7746                     tcg_gen_sub_i32(tmp, tmp, tmp2);
7747                 }
7748                 store_reg_bx(env, s, rd, tmp);
7749             }
7750             break;
7751         case 0x03:
7752             if (set_cc) {
7753                 gen_sub_CC(tmp, tmp2, tmp);
7754             } else {
7755                 tcg_gen_sub_i32(tmp, tmp2, tmp);
7756             }
7757             store_reg_bx(env, s, rd, tmp);
7758             break;
7759         case 0x04:
7760             if (set_cc) {
7761                 gen_add_CC(tmp, tmp, tmp2);
7762             } else {
7763                 tcg_gen_add_i32(tmp, tmp, tmp2);
7764             }
7765             store_reg_bx(env, s, rd, tmp);
7766             break;
7767         case 0x05:
7768             if (set_cc) {
7769                 gen_adc_CC(tmp, tmp, tmp2);
7770             } else {
7771                 gen_add_carry(tmp, tmp, tmp2);
7772             }
7773             store_reg_bx(env, s, rd, tmp);
7774             break;
7775         case 0x06:
7776             if (set_cc) {
7777                 gen_sbc_CC(tmp, tmp, tmp2);
7778             } else {
7779                 gen_sub_carry(tmp, tmp, tmp2);
7780             }
7781             store_reg_bx(env, s, rd, tmp);
7782             break;
7783         case 0x07:
7784             if (set_cc) {
7785                 gen_sbc_CC(tmp, tmp2, tmp);
7786             } else {
7787                 gen_sub_carry(tmp, tmp2, tmp);
7788             }
7789             store_reg_bx(env, s, rd, tmp);
7790             break;
7791         case 0x08:
7792             if (set_cc) {
7793                 tcg_gen_and_i32(tmp, tmp, tmp2);
7794                 gen_logic_CC(tmp);
7795             }
7796             tcg_temp_free_i32(tmp);
7797             break;
7798         case 0x09:
7799             if (set_cc) {
7800                 tcg_gen_xor_i32(tmp, tmp, tmp2);
7801                 gen_logic_CC(tmp);
7802             }
7803             tcg_temp_free_i32(tmp);
7804             break;
7805         case 0x0a:
7806             if (set_cc) {
7807                 gen_sub_CC(tmp, tmp, tmp2);
7808             }
7809             tcg_temp_free_i32(tmp);
7810             break;
7811         case 0x0b:
7812             if (set_cc) {
7813                 gen_add_CC(tmp, tmp, tmp2);
7814             }
7815             tcg_temp_free_i32(tmp);
7816             break;
7817         case 0x0c:
7818             tcg_gen_or_i32(tmp, tmp, tmp2);
7819             if (logic_cc) {
7820                 gen_logic_CC(tmp);
7821             }
7822             store_reg_bx(env, s, rd, tmp);
7823             break;
7824         case 0x0d:
7825             if (logic_cc && rd == 15) {
7826                 /* MOVS r15, ... is used for exception return.  */
7827                 if (IS_USER(s)) {
7828                     goto illegal_op;
7829                 }
7830                 gen_exception_return(s, tmp2);
7831             } else {
7832                 if (logic_cc) {
7833                     gen_logic_CC(tmp2);
7834                 }
7835                 store_reg_bx(env, s, rd, tmp2);
7836             }
7837             break;
7838         case 0x0e:
7839             tcg_gen_andc_i32(tmp, tmp, tmp2);
7840             if (logic_cc) {
7841                 gen_logic_CC(tmp);
7842             }
7843             store_reg_bx(env, s, rd, tmp);
7844             break;
7845         default:
7846         case 0x0f:
7847             tcg_gen_not_i32(tmp2, tmp2);
7848             if (logic_cc) {
7849                 gen_logic_CC(tmp2);
7850             }
7851             store_reg_bx(env, s, rd, tmp2);
7852             break;
7853         }
7854         if (op1 != 0x0f && op1 != 0x0d) {
7855             tcg_temp_free_i32(tmp2);
7856         }
7857     } else {
7858         /* other instructions */
7859         op1 = (insn >> 24) & 0xf;
7860         switch(op1) {
7861         case 0x0:
7862         case 0x1:
7863             /* multiplies, extra load/stores */
7864             sh = (insn >> 5) & 3;
7865             if (sh == 0) {
7866                 if (op1 == 0x0) {
7867                     rd = (insn >> 16) & 0xf;
7868                     rn = (insn >> 12) & 0xf;
7869                     rs = (insn >> 8) & 0xf;
7870                     rm = (insn) & 0xf;
7871                     op1 = (insn >> 20) & 0xf;
7872                     switch (op1) {
7873                     case 0: case 1: case 2: case 3: case 6:
7874                         /* 32 bit mul */
7875                         tmp = load_reg(s, rs);
7876                         tmp2 = load_reg(s, rm);
7877                         tcg_gen_mul_i32(tmp, tmp, tmp2);
7878                         tcg_temp_free_i32(tmp2);
7879                         if (insn & (1 << 22)) {
7880                             /* Subtract (mls) */
7881                             ARCH(6T2);
7882                             tmp2 = load_reg(s, rn);
7883                             tcg_gen_sub_i32(tmp, tmp2, tmp);
7884                             tcg_temp_free_i32(tmp2);
7885                         } else if (insn & (1 << 21)) {
7886                             /* Add */
7887                             tmp2 = load_reg(s, rn);
7888                             tcg_gen_add_i32(tmp, tmp, tmp2);
7889                             tcg_temp_free_i32(tmp2);
7890                         }
7891                         if (insn & (1 << 20))
7892                             gen_logic_CC(tmp);
7893                         store_reg(s, rd, tmp);
7894                         break;
7895                     case 4:
7896                         /* 64 bit mul double accumulate (UMAAL) */
7897                         ARCH(6);
7898                         tmp = load_reg(s, rs);
7899                         tmp2 = load_reg(s, rm);
7900                         tmp64 = gen_mulu_i64_i32(tmp, tmp2);
7901                         gen_addq_lo(s, tmp64, rn);
7902                         gen_addq_lo(s, tmp64, rd);
7903                         gen_storeq_reg(s, rn, rd, tmp64);
7904                         tcg_temp_free_i64(tmp64);
7905                         break;
7906                     case 8: case 9: case 10: case 11:
7907                     case 12: case 13: case 14: case 15:
7908                         /* 64 bit mul: UMULL, UMLAL, SMULL, SMLAL. */
7909                         tmp = load_reg(s, rs);
7910                         tmp2 = load_reg(s, rm);
7911                         if (insn & (1 << 22)) {
7912                             tcg_gen_muls2_i32(tmp, tmp2, tmp, tmp2);
7913                         } else {
7914                             tcg_gen_mulu2_i32(tmp, tmp2, tmp, tmp2);
7915                         }
7916                         if (insn & (1 << 21)) { /* mult accumulate */
7917                             TCGv_i32 al = load_reg(s, rn);
7918                             TCGv_i32 ah = load_reg(s, rd);
7919                             tcg_gen_add2_i32(tmp, tmp2, tmp, tmp2, al, ah);
7920                             tcg_temp_free_i32(al);
7921                             tcg_temp_free_i32(ah);
7922                         }
7923                         if (insn & (1 << 20)) {
7924                             gen_logicq_cc(tmp, tmp2);
7925                         }
7926                         store_reg(s, rn, tmp);
7927                         store_reg(s, rd, tmp2);
7928                         break;
7929                     default:
7930                         goto illegal_op;
7931                     }
7932                 } else {
7933                     rn = (insn >> 16) & 0xf;
7934                     rd = (insn >> 12) & 0xf;
7935                     if (insn & (1 << 23)) {
7936                         /* load/store exclusive */
7937                         int op2 = (insn >> 8) & 3;
7938                         op1 = (insn >> 21) & 0x3;
7939
7940                         switch (op2) {
7941                         case 0: /* lda/stl */
7942                             if (op1 == 1) {
7943                                 goto illegal_op;
7944                             }
7945                             ARCH(8);
7946                             break;
7947                         case 1: /* reserved */
7948                             goto illegal_op;
7949                         case 2: /* ldaex/stlex */
7950                             ARCH(8);
7951                             break;
7952                         case 3: /* ldrex/strex */
7953                             if (op1) {
7954                                 ARCH(6K);
7955                             } else {
7956                                 ARCH(6);
7957                             }
7958                             break;
7959                         }
7960
7961                         addr = tcg_temp_local_new_i32();
7962                         load_reg_var(s, addr, rn);
7963
7964                         /* Since the emulation does not have barriers,
7965                            the acquire/release semantics need no special
7966                            handling */
7967                         if (op2 == 0) {
7968                             if (insn & (1 << 20)) {
7969                                 tmp = tcg_temp_new_i32();
7970                                 switch (op1) {
7971                                 case 0: /* lda */
7972                                     gen_aa32_ld32u(tmp, addr, IS_USER(s));
7973                                     break;
7974                                 case 2: /* ldab */
7975                                     gen_aa32_ld8u(tmp, addr, IS_USER(s));
7976                                     break;
7977                                 case 3: /* ldah */
7978                                     gen_aa32_ld16u(tmp, addr, IS_USER(s));
7979                                     break;
7980                                 default:
7981                                     abort();
7982                                 }
7983                                 store_reg(s, rd, tmp);
7984                             } else {
7985                                 rm = insn & 0xf;
7986                                 tmp = load_reg(s, rm);
7987                                 switch (op1) {
7988                                 case 0: /* stl */
7989                                     gen_aa32_st32(tmp, addr, IS_USER(s));
7990                                     break;
7991                                 case 2: /* stlb */
7992                                     gen_aa32_st8(tmp, addr, IS_USER(s));
7993                                     break;
7994                                 case 3: /* stlh */
7995                                     gen_aa32_st16(tmp, addr, IS_USER(s));
7996                                     break;
7997                                 default:
7998                                     abort();
7999                                 }
8000                                 tcg_temp_free_i32(tmp);
8001                             }
8002                         } else if (insn & (1 << 20)) {
8003                             switch (op1) {
8004                             case 0: /* ldrex */
8005                                 gen_load_exclusive(s, rd, 15, addr, 2);
8006                                 break;
8007                             case 1: /* ldrexd */
8008                                 gen_load_exclusive(s, rd, rd + 1, addr, 3);
8009                                 break;
8010                             case 2: /* ldrexb */
8011                                 gen_load_exclusive(s, rd, 15, addr, 0);
8012                                 break;
8013                             case 3: /* ldrexh */
8014                                 gen_load_exclusive(s, rd, 15, addr, 1);
8015                                 break;
8016                             default:
8017                                 abort();
8018                             }
8019                         } else {
8020                             rm = insn & 0xf;
8021                             switch (op1) {
8022                             case 0:  /*  strex */
8023                                 gen_store_exclusive(s, rd, rm, 15, addr, 2);
8024                                 break;
8025                             case 1: /*  strexd */
8026                                 gen_store_exclusive(s, rd, rm, rm + 1, addr, 3);
8027                                 break;
8028                             case 2: /*  strexb */
8029                                 gen_store_exclusive(s, rd, rm, 15, addr, 0);
8030                                 break;
8031                             case 3: /* strexh */
8032                                 gen_store_exclusive(s, rd, rm, 15, addr, 1);
8033                                 break;
8034                             default:
8035                                 abort();
8036                             }
8037                         }
8038                         tcg_temp_free_i32(addr);
8039                     } else {
8040                         /* SWP instruction */
8041                         rm = (insn) & 0xf;
8042
8043                         /* ??? This is not really atomic.  However we know
8044                            we never have multiple CPUs running in parallel,
8045                            so it is good enough.  */
8046                         addr = load_reg(s, rn);
8047                         tmp = load_reg(s, rm);
8048                         tmp2 = tcg_temp_new_i32();
8049                         if (insn & (1 << 22)) {
8050                             gen_aa32_ld8u(tmp2, addr, IS_USER(s));
8051                             gen_aa32_st8(tmp, addr, IS_USER(s));
8052                         } else {
8053                             gen_aa32_ld32u(tmp2, addr, IS_USER(s));
8054                             gen_aa32_st32(tmp, addr, IS_USER(s));
8055                         }
8056                         tcg_temp_free_i32(tmp);
8057                         tcg_temp_free_i32(addr);
8058                         store_reg(s, rd, tmp2);
8059                     }
8060                 }
8061             } else {
8062                 int address_offset;
8063                 int load;
8064                 /* Misc load/store */
8065                 rn = (insn >> 16) & 0xf;
8066                 rd = (insn >> 12) & 0xf;
8067                 addr = load_reg(s, rn);
8068                 if (insn & (1 << 24))
8069                     gen_add_datah_offset(s, insn, 0, addr);
8070                 address_offset = 0;
8071                 if (insn & (1 << 20)) {
8072                     /* load */
8073                     tmp = tcg_temp_new_i32();
8074                     switch(sh) {
8075                     case 1:
8076                         gen_aa32_ld16u(tmp, addr, IS_USER(s));
8077                         break;
8078                     case 2:
8079                         gen_aa32_ld8s(tmp, addr, IS_USER(s));
8080                         break;
8081                     default:
8082                     case 3:
8083                         gen_aa32_ld16s(tmp, addr, IS_USER(s));
8084                         break;
8085                     }
8086                     load = 1;
8087                 } else if (sh & 2) {
8088                     ARCH(5TE);
8089                     /* doubleword */
8090                     if (sh & 1) {
8091                         /* store */
8092                         tmp = load_reg(s, rd);
8093                         gen_aa32_st32(tmp, addr, IS_USER(s));
8094                         tcg_temp_free_i32(tmp);
8095                         tcg_gen_addi_i32(addr, addr, 4);
8096                         tmp = load_reg(s, rd + 1);
8097                         gen_aa32_st32(tmp, addr, IS_USER(s));
8098                         tcg_temp_free_i32(tmp);
8099                         load = 0;
8100                     } else {
8101                         /* load */
8102                         tmp = tcg_temp_new_i32();
8103                         gen_aa32_ld32u(tmp, addr, IS_USER(s));
8104                         store_reg(s, rd, tmp);
8105                         tcg_gen_addi_i32(addr, addr, 4);
8106                         tmp = tcg_temp_new_i32();
8107                         gen_aa32_ld32u(tmp, addr, IS_USER(s));
8108                         rd++;
8109                         load = 1;
8110                     }
8111                     address_offset = -4;
8112                 } else {
8113                     /* store */
8114                     tmp = load_reg(s, rd);
8115                     gen_aa32_st16(tmp, addr, IS_USER(s));
8116                     tcg_temp_free_i32(tmp);
8117                     load = 0;
8118                 }
8119                 /* Perform base writeback before the loaded value to
8120                    ensure correct behavior with overlapping index registers.
8121                    ldrd with base writeback is is undefined if the
8122                    destination and index registers overlap.  */
8123                 if (!(insn & (1 << 24))) {
8124                     gen_add_datah_offset(s, insn, address_offset, addr);
8125                     store_reg(s, rn, addr);
8126                 } else if (insn & (1 << 21)) {
8127                     if (address_offset)
8128                         tcg_gen_addi_i32(addr, addr, address_offset);
8129                     store_reg(s, rn, addr);
8130                 } else {
8131                     tcg_temp_free_i32(addr);
8132                 }
8133                 if (load) {
8134                     /* Complete the load.  */
8135                     store_reg(s, rd, tmp);
8136                 }
8137             }
8138             break;
8139         case 0x4:
8140         case 0x5:
8141             goto do_ldst;
8142         case 0x6:
8143         case 0x7:
8144             if (insn & (1 << 4)) {
8145                 ARCH(6);
8146                 /* Armv6 Media instructions.  */
8147                 rm = insn & 0xf;
8148                 rn = (insn >> 16) & 0xf;
8149                 rd = (insn >> 12) & 0xf;
8150                 rs = (insn >> 8) & 0xf;
8151                 switch ((insn >> 23) & 3) {
8152                 case 0: /* Parallel add/subtract.  */
8153                     op1 = (insn >> 20) & 7;
8154                     tmp = load_reg(s, rn);
8155                     tmp2 = load_reg(s, rm);
8156                     sh = (insn >> 5) & 7;
8157                     if ((op1 & 3) == 0 || sh == 5 || sh == 6)
8158                         goto illegal_op;
8159                     gen_arm_parallel_addsub(op1, sh, tmp, tmp2);
8160                     tcg_temp_free_i32(tmp2);
8161                     store_reg(s, rd, tmp);
8162                     break;
8163                 case 1:
8164                     if ((insn & 0x00700020) == 0) {
8165                         /* Halfword pack.  */
8166                         tmp = load_reg(s, rn);
8167                         tmp2 = load_reg(s, rm);
8168                         shift = (insn >> 7) & 0x1f;
8169                         if (insn & (1 << 6)) {
8170                             /* pkhtb */
8171                             if (shift == 0)
8172                                 shift = 31;
8173                             tcg_gen_sari_i32(tmp2, tmp2, shift);
8174                             tcg_gen_andi_i32(tmp, tmp, 0xffff0000);
8175                             tcg_gen_ext16u_i32(tmp2, tmp2);
8176                         } else {
8177                             /* pkhbt */
8178                             if (shift)
8179                                 tcg_gen_shli_i32(tmp2, tmp2, shift);
8180                             tcg_gen_ext16u_i32(tmp, tmp);
8181                             tcg_gen_andi_i32(tmp2, tmp2, 0xffff0000);
8182                         }
8183                         tcg_gen_or_i32(tmp, tmp, tmp2);
8184                         tcg_temp_free_i32(tmp2);
8185                         store_reg(s, rd, tmp);
8186                     } else if ((insn & 0x00200020) == 0x00200000) {
8187                         /* [us]sat */
8188                         tmp = load_reg(s, rm);
8189                         shift = (insn >> 7) & 0x1f;
8190                         if (insn & (1 << 6)) {
8191                             if (shift == 0)
8192                                 shift = 31;
8193                             tcg_gen_sari_i32(tmp, tmp, shift);
8194                         } else {
8195                             tcg_gen_shli_i32(tmp, tmp, shift);
8196                         }
8197                         sh = (insn >> 16) & 0x1f;
8198                         tmp2 = tcg_const_i32(sh);
8199                         if (insn & (1 << 22))
8200                           gen_helper_usat(tmp, cpu_env, tmp, tmp2);
8201                         else
8202                           gen_helper_ssat(tmp, cpu_env, tmp, tmp2);
8203                         tcg_temp_free_i32(tmp2);
8204                         store_reg(s, rd, tmp);
8205                     } else if ((insn & 0x00300fe0) == 0x00200f20) {
8206                         /* [us]sat16 */
8207                         tmp = load_reg(s, rm);
8208                         sh = (insn >> 16) & 0x1f;
8209                         tmp2 = tcg_const_i32(sh);
8210                         if (insn & (1 << 22))
8211                           gen_helper_usat16(tmp, cpu_env, tmp, tmp2);
8212                         else
8213                           gen_helper_ssat16(tmp, cpu_env, tmp, tmp2);
8214                         tcg_temp_free_i32(tmp2);
8215                         store_reg(s, rd, tmp);
8216                     } else if ((insn & 0x00700fe0) == 0x00000fa0) {
8217                         /* Select bytes.  */
8218                         tmp = load_reg(s, rn);
8219                         tmp2 = load_reg(s, rm);
8220                         tmp3 = tcg_temp_new_i32();
8221                         tcg_gen_ld_i32(tmp3, cpu_env, offsetof(CPUARMState, GE));
8222                         gen_helper_sel_flags(tmp, tmp3, tmp, tmp2);
8223                         tcg_temp_free_i32(tmp3);
8224                         tcg_temp_free_i32(tmp2);
8225                         store_reg(s, rd, tmp);
8226                     } else if ((insn & 0x000003e0) == 0x00000060) {
8227                         tmp = load_reg(s, rm);
8228                         shift = (insn >> 10) & 3;
8229                         /* ??? In many cases it's not necessary to do a
8230                            rotate, a shift is sufficient.  */
8231                         if (shift != 0)
8232                             tcg_gen_rotri_i32(tmp, tmp, shift * 8);
8233                         op1 = (insn >> 20) & 7;
8234                         switch (op1) {
8235                         case 0: gen_sxtb16(tmp);  break;
8236                         case 2: gen_sxtb(tmp);    break;
8237                         case 3: gen_sxth(tmp);    break;
8238                         case 4: gen_uxtb16(tmp);  break;
8239                         case 6: gen_uxtb(tmp);    break;
8240                         case 7: gen_uxth(tmp);    break;
8241                         default: goto illegal_op;
8242                         }
8243                         if (rn != 15) {
8244                             tmp2 = load_reg(s, rn);
8245                             if ((op1 & 3) == 0) {
8246                                 gen_add16(tmp, tmp2);
8247                             } else {
8248                                 tcg_gen_add_i32(tmp, tmp, tmp2);
8249                                 tcg_temp_free_i32(tmp2);
8250                             }
8251                         }
8252                         store_reg(s, rd, tmp);
8253                     } else if ((insn & 0x003f0f60) == 0x003f0f20) {
8254                         /* rev */
8255                         tmp = load_reg(s, rm);
8256                         if (insn & (1 << 22)) {
8257                             if (insn & (1 << 7)) {
8258                                 gen_revsh(tmp);
8259                             } else {
8260                                 ARCH(6T2);
8261                                 gen_helper_rbit(tmp, tmp);
8262                             }
8263                         } else {
8264                             if (insn & (1 << 7))
8265                                 gen_rev16(tmp);
8266                             else
8267                                 tcg_gen_bswap32_i32(tmp, tmp);
8268                         }
8269                         store_reg(s, rd, tmp);
8270                     } else {
8271                         goto illegal_op;
8272                     }
8273                     break;
8274                 case 2: /* Multiplies (Type 3).  */
8275                     switch ((insn >> 20) & 0x7) {
8276                     case 5:
8277                         if (((insn >> 6) ^ (insn >> 7)) & 1) {
8278                             /* op2 not 00x or 11x : UNDEF */
8279                             goto illegal_op;
8280                         }
8281                         /* Signed multiply most significant [accumulate].
8282                            (SMMUL, SMMLA, SMMLS) */
8283                         tmp = load_reg(s, rm);
8284                         tmp2 = load_reg(s, rs);
8285                         tmp64 = gen_muls_i64_i32(tmp, tmp2);
8286
8287                         if (rd != 15) {
8288                             tmp = load_reg(s, rd);
8289                             if (insn & (1 << 6)) {
8290                                 tmp64 = gen_subq_msw(tmp64, tmp);
8291                             } else {
8292                                 tmp64 = gen_addq_msw(tmp64, tmp);
8293                             }
8294                         }
8295                         if (insn & (1 << 5)) {
8296                             tcg_gen_addi_i64(tmp64, tmp64, 0x80000000u);
8297                         }
8298                         tcg_gen_shri_i64(tmp64, tmp64, 32);
8299                         tmp = tcg_temp_new_i32();
8300                         tcg_gen_trunc_i64_i32(tmp, tmp64);
8301                         tcg_temp_free_i64(tmp64);
8302                         store_reg(s, rn, tmp);
8303                         break;
8304                     case 0:
8305                     case 4:
8306                         /* SMLAD, SMUAD, SMLSD, SMUSD, SMLALD, SMLSLD */
8307                         if (insn & (1 << 7)) {
8308                             goto illegal_op;
8309                         }
8310                         tmp = load_reg(s, rm);
8311                         tmp2 = load_reg(s, rs);
8312                         if (insn & (1 << 5))
8313                             gen_swap_half(tmp2);
8314                         gen_smul_dual(tmp, tmp2);
8315                         if (insn & (1 << 6)) {
8316                             /* This subtraction cannot overflow. */
8317                             tcg_gen_sub_i32(tmp, tmp, tmp2);
8318                         } else {
8319                             /* This addition cannot overflow 32 bits;
8320                              * however it may overflow considered as a signed
8321                              * operation, in which case we must set the Q flag.
8322                              */
8323                             gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
8324                         }
8325                         tcg_temp_free_i32(tmp2);
8326                         if (insn & (1 << 22)) {
8327                             /* smlald, smlsld */
8328                             tmp64 = tcg_temp_new_i64();
8329                             tcg_gen_ext_i32_i64(tmp64, tmp);
8330                             tcg_temp_free_i32(tmp);
8331                             gen_addq(s, tmp64, rd, rn);
8332                             gen_storeq_reg(s, rd, rn, tmp64);
8333                             tcg_temp_free_i64(tmp64);
8334                         } else {
8335                             /* smuad, smusd, smlad, smlsd */
8336                             if (rd != 15)
8337                               {
8338                                 tmp2 = load_reg(s, rd);
8339                                 gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
8340                                 tcg_temp_free_i32(tmp2);
8341                               }
8342                             store_reg(s, rn, tmp);
8343                         }
8344                         break;
8345                     case 1:
8346                     case 3:
8347                         /* SDIV, UDIV */
8348                         if (!arm_feature(env, ARM_FEATURE_ARM_DIV)) {
8349                             goto illegal_op;
8350                         }
8351                         if (((insn >> 5) & 7) || (rd != 15)) {
8352                             goto illegal_op;
8353                         }
8354                         tmp = load_reg(s, rm);
8355                         tmp2 = load_reg(s, rs);
8356                         if (insn & (1 << 21)) {
8357                             gen_helper_udiv(tmp, tmp, tmp2);
8358                         } else {
8359                             gen_helper_sdiv(tmp, tmp, tmp2);
8360                         }
8361                         tcg_temp_free_i32(tmp2);
8362                         store_reg(s, rn, tmp);
8363                         break;
8364                     default:
8365                         goto illegal_op;
8366                     }
8367                     break;
8368                 case 3:
8369                     op1 = ((insn >> 17) & 0x38) | ((insn >> 5) & 7);
8370                     switch (op1) {
8371                     case 0: /* Unsigned sum of absolute differences.  */
8372                         ARCH(6);
8373                         tmp = load_reg(s, rm);
8374                         tmp2 = load_reg(s, rs);
8375                         gen_helper_usad8(tmp, tmp, tmp2);
8376                         tcg_temp_free_i32(tmp2);
8377                         if (rd != 15) {
8378                             tmp2 = load_reg(s, rd);
8379                             tcg_gen_add_i32(tmp, tmp, tmp2);
8380                             tcg_temp_free_i32(tmp2);
8381                         }
8382                         store_reg(s, rn, tmp);
8383                         break;
8384                     case 0x20: case 0x24: case 0x28: case 0x2c:
8385                         /* Bitfield insert/clear.  */
8386                         ARCH(6T2);
8387                         shift = (insn >> 7) & 0x1f;
8388                         i = (insn >> 16) & 0x1f;
8389                         i = i + 1 - shift;
8390                         if (rm == 15) {
8391                             tmp = tcg_temp_new_i32();
8392                             tcg_gen_movi_i32(tmp, 0);
8393                         } else {
8394                             tmp = load_reg(s, rm);
8395                         }
8396                         if (i != 32) {
8397                             tmp2 = load_reg(s, rd);
8398                             tcg_gen_deposit_i32(tmp, tmp2, tmp, shift, i);
8399                             tcg_temp_free_i32(tmp2);
8400                         }
8401                         store_reg(s, rd, tmp);
8402                         break;
8403                     case 0x12: case 0x16: case 0x1a: case 0x1e: /* sbfx */
8404                     case 0x32: case 0x36: case 0x3a: case 0x3e: /* ubfx */
8405                         ARCH(6T2);
8406                         tmp = load_reg(s, rm);
8407                         shift = (insn >> 7) & 0x1f;
8408                         i = ((insn >> 16) & 0x1f) + 1;
8409                         if (shift + i > 32)
8410                             goto illegal_op;
8411                         if (i < 32) {
8412                             if (op1 & 0x20) {
8413                                 gen_ubfx(tmp, shift, (1u << i) - 1);
8414                             } else {
8415                                 gen_sbfx(tmp, shift, i);
8416                             }
8417                         }
8418                         store_reg(s, rd, tmp);
8419                         break;
8420                     default:
8421                         goto illegal_op;
8422                     }
8423                     break;
8424                 }
8425                 break;
8426             }
8427         do_ldst:
8428             /* Check for undefined extension instructions
8429              * per the ARM Bible IE:
8430              * xxxx 0111 1111 xxxx  xxxx xxxx 1111 xxxx
8431              */
8432             sh = (0xf << 20) | (0xf << 4);
8433             if (op1 == 0x7 && ((insn & sh) == sh))
8434             {
8435                 goto illegal_op;
8436             }
8437             /* load/store byte/word */
8438             rn = (insn >> 16) & 0xf;
8439             rd = (insn >> 12) & 0xf;
8440             tmp2 = load_reg(s, rn);
8441             i = (IS_USER(s) || (insn & 0x01200000) == 0x00200000);
8442             if (insn & (1 << 24))
8443                 gen_add_data_offset(s, insn, tmp2);
8444             if (insn & (1 << 20)) {
8445                 /* load */
8446                 tmp = tcg_temp_new_i32();
8447                 if (insn & (1 << 22)) {
8448                     gen_aa32_ld8u(tmp, tmp2, i);
8449                 } else {
8450                     gen_aa32_ld32u(tmp, tmp2, i);
8451                 }
8452             } else {
8453                 /* store */
8454                 tmp = load_reg(s, rd);
8455                 if (insn & (1 << 22)) {
8456                     gen_aa32_st8(tmp, tmp2, i);
8457                 } else {
8458                     gen_aa32_st32(tmp, tmp2, i);
8459                 }
8460                 tcg_temp_free_i32(tmp);
8461             }
8462             if (!(insn & (1 << 24))) {
8463                 gen_add_data_offset(s, insn, tmp2);
8464                 store_reg(s, rn, tmp2);
8465             } else if (insn & (1 << 21)) {
8466                 store_reg(s, rn, tmp2);
8467             } else {
8468                 tcg_temp_free_i32(tmp2);
8469             }
8470             if (insn & (1 << 20)) {
8471                 /* Complete the load.  */
8472                 store_reg_from_load(env, s, rd, tmp);
8473             }
8474             break;
8475         case 0x08:
8476         case 0x09:
8477             {
8478                 int j, n, user, loaded_base;
8479                 TCGv_i32 loaded_var;
8480                 /* load/store multiple words */
8481                 /* XXX: store correct base if write back */
8482                 user = 0;
8483                 if (insn & (1 << 22)) {
8484                     if (IS_USER(s))
8485                         goto illegal_op; /* only usable in supervisor mode */
8486
8487                     if ((insn & (1 << 15)) == 0)
8488                         user = 1;
8489                 }
8490                 rn = (insn >> 16) & 0xf;
8491                 addr = load_reg(s, rn);
8492
8493                 /* compute total size */
8494                 loaded_base = 0;
8495                 TCGV_UNUSED_I32(loaded_var);
8496                 n = 0;
8497                 for(i=0;i<16;i++) {
8498                     if (insn & (1 << i))
8499                         n++;
8500                 }
8501                 /* XXX: test invalid n == 0 case ? */
8502                 if (insn & (1 << 23)) {
8503                     if (insn & (1 << 24)) {
8504                         /* pre increment */
8505                         tcg_gen_addi_i32(addr, addr, 4);
8506                     } else {
8507                         /* post increment */
8508                     }
8509                 } else {
8510                     if (insn & (1 << 24)) {
8511                         /* pre decrement */
8512                         tcg_gen_addi_i32(addr, addr, -(n * 4));
8513                     } else {
8514                         /* post decrement */
8515                         if (n != 1)
8516                         tcg_gen_addi_i32(addr, addr, -((n - 1) * 4));
8517                     }
8518                 }
8519                 j = 0;
8520                 for(i=0;i<16;i++) {
8521                     if (insn & (1 << i)) {
8522                         if (insn & (1 << 20)) {
8523                             /* load */
8524                             tmp = tcg_temp_new_i32();
8525                             gen_aa32_ld32u(tmp, addr, IS_USER(s));
8526                             if (user) {
8527                                 tmp2 = tcg_const_i32(i);
8528                                 gen_helper_set_user_reg(cpu_env, tmp2, tmp);
8529                                 tcg_temp_free_i32(tmp2);
8530                                 tcg_temp_free_i32(tmp);
8531                             } else if (i == rn) {
8532                                 loaded_var = tmp;
8533                                 loaded_base = 1;
8534                             } else {
8535                                 store_reg_from_load(env, s, i, tmp);
8536                             }
8537                         } else {
8538                             /* store */
8539                             if (i == 15) {
8540                                 /* special case: r15 = PC + 8 */
8541                                 val = (long)s->pc + 4;
8542                                 tmp = tcg_temp_new_i32();
8543                                 tcg_gen_movi_i32(tmp, val);
8544                             } else if (user) {
8545                                 tmp = tcg_temp_new_i32();
8546                                 tmp2 = tcg_const_i32(i);
8547                                 gen_helper_get_user_reg(tmp, cpu_env, tmp2);
8548                                 tcg_temp_free_i32(tmp2);
8549                             } else {
8550                                 tmp = load_reg(s, i);
8551                             }
8552                             gen_aa32_st32(tmp, addr, IS_USER(s));
8553                             tcg_temp_free_i32(tmp);
8554                         }
8555                         j++;
8556                         /* no need to add after the last transfer */
8557                         if (j != n)
8558                             tcg_gen_addi_i32(addr, addr, 4);
8559                     }
8560                 }
8561                 if (insn & (1 << 21)) {
8562                     /* write back */
8563                     if (insn & (1 << 23)) {
8564                         if (insn & (1 << 24)) {
8565                             /* pre increment */
8566                         } else {
8567                             /* post increment */
8568                             tcg_gen_addi_i32(addr, addr, 4);
8569                         }
8570                     } else {
8571                         if (insn & (1 << 24)) {
8572                             /* pre decrement */
8573                             if (n != 1)
8574                                 tcg_gen_addi_i32(addr, addr, -((n - 1) * 4));
8575                         } else {
8576                             /* post decrement */
8577                             tcg_gen_addi_i32(addr, addr, -(n * 4));
8578                         }
8579                     }
8580                     store_reg(s, rn, addr);
8581                 } else {
8582                     tcg_temp_free_i32(addr);
8583                 }
8584                 if (loaded_base) {
8585                     store_reg(s, rn, loaded_var);
8586                 }
8587                 if ((insn & (1 << 22)) && !user) {
8588                     /* Restore CPSR from SPSR.  */
8589                     tmp = load_cpu_field(spsr);
8590                     gen_set_cpsr(tmp, 0xffffffff);
8591                     tcg_temp_free_i32(tmp);
8592                     s->is_jmp = DISAS_UPDATE;
8593                 }
8594             }
8595             break;
8596         case 0xa:
8597         case 0xb:
8598             {
8599                 int32_t offset;
8600
8601                 /* branch (and link) */
8602                 val = (int32_t)s->pc;
8603                 if (insn & (1 << 24)) {
8604                     tmp = tcg_temp_new_i32();
8605                     tcg_gen_movi_i32(tmp, val);
8606                     store_reg(s, 14, tmp);
8607                 }
8608                 offset = sextract32(insn << 2, 0, 26);
8609                 val += offset + 4;
8610                 gen_jmp(s, val);
8611             }
8612             break;
8613         case 0xc:
8614         case 0xd:
8615         case 0xe:
8616             if (((insn >> 8) & 0xe) == 10) {
8617                 /* VFP.  */
8618                 if (disas_vfp_insn(env, s, insn)) {
8619                     goto illegal_op;
8620                 }
8621             } else if (disas_coproc_insn(env, s, insn)) {
8622                 /* Coprocessor.  */
8623                 goto illegal_op;
8624             }
8625             break;
8626         case 0xf:
8627             /* swi */
8628             gen_set_pc_im(s, s->pc);
8629             s->is_jmp = DISAS_SWI;
8630             break;
8631         default:
8632         illegal_op:
8633             gen_exception_insn(s, 4, EXCP_UDEF);
8634             break;
8635         }
8636     }
8637 }
8638
8639 /* Return true if this is a Thumb-2 logical op.  */
8640 static int
8641 thumb2_logic_op(int op)
8642 {
8643     return (op < 8);
8644 }
8645
8646 /* Generate code for a Thumb-2 data processing operation.  If CONDS is nonzero
8647    then set condition code flags based on the result of the operation.
8648    If SHIFTER_OUT is nonzero then set the carry flag for logical operations
8649    to the high bit of T1.
8650    Returns zero if the opcode is valid.  */
8651
8652 static int
8653 gen_thumb2_data_op(DisasContext *s, int op, int conds, uint32_t shifter_out,
8654                    TCGv_i32 t0, TCGv_i32 t1)
8655 {
8656     int logic_cc;
8657
8658     logic_cc = 0;
8659     switch (op) {
8660     case 0: /* and */
8661         tcg_gen_and_i32(t0, t0, t1);
8662         logic_cc = conds;
8663         break;
8664     case 1: /* bic */
8665         tcg_gen_andc_i32(t0, t0, t1);
8666         logic_cc = conds;
8667         break;
8668     case 2: /* orr */
8669         tcg_gen_or_i32(t0, t0, t1);
8670         logic_cc = conds;
8671         break;
8672     case 3: /* orn */
8673         tcg_gen_orc_i32(t0, t0, t1);
8674         logic_cc = conds;
8675         break;
8676     case 4: /* eor */
8677         tcg_gen_xor_i32(t0, t0, t1);
8678         logic_cc = conds;
8679         break;
8680     case 8: /* add */
8681         if (conds)
8682             gen_add_CC(t0, t0, t1);
8683         else
8684             tcg_gen_add_i32(t0, t0, t1);
8685         break;
8686     case 10: /* adc */
8687         if (conds)
8688             gen_adc_CC(t0, t0, t1);
8689         else
8690             gen_adc(t0, t1);
8691         break;
8692     case 11: /* sbc */
8693         if (conds) {
8694             gen_sbc_CC(t0, t0, t1);
8695         } else {
8696             gen_sub_carry(t0, t0, t1);
8697         }
8698         break;
8699     case 13: /* sub */
8700         if (conds)
8701             gen_sub_CC(t0, t0, t1);
8702         else
8703             tcg_gen_sub_i32(t0, t0, t1);
8704         break;
8705     case 14: /* rsb */
8706         if (conds)
8707             gen_sub_CC(t0, t1, t0);
8708         else
8709             tcg_gen_sub_i32(t0, t1, t0);
8710         break;
8711     default: /* 5, 6, 7, 9, 12, 15. */
8712         return 1;
8713     }
8714     if (logic_cc) {
8715         gen_logic_CC(t0);
8716         if (shifter_out)
8717             gen_set_CF_bit31(t1);
8718     }
8719     return 0;
8720 }
8721
8722 /* Translate a 32-bit thumb instruction.  Returns nonzero if the instruction
8723    is not legal.  */
8724 static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw1)
8725 {
8726     uint32_t insn, imm, shift, offset;
8727     uint32_t rd, rn, rm, rs;
8728     TCGv_i32 tmp;
8729     TCGv_i32 tmp2;
8730     TCGv_i32 tmp3;
8731     TCGv_i32 addr;
8732     TCGv_i64 tmp64;
8733     int op;
8734     int shiftop;
8735     int conds;
8736     int logic_cc;
8737
8738     if (!(arm_feature(env, ARM_FEATURE_THUMB2)
8739           || arm_feature (env, ARM_FEATURE_M))) {
8740         /* Thumb-1 cores may need to treat bl and blx as a pair of
8741            16-bit instructions to get correct prefetch abort behavior.  */
8742         insn = insn_hw1;
8743         if ((insn & (1 << 12)) == 0) {
8744             ARCH(5);
8745             /* Second half of blx.  */
8746             offset = ((insn & 0x7ff) << 1);
8747             tmp = load_reg(s, 14);
8748             tcg_gen_addi_i32(tmp, tmp, offset);
8749             tcg_gen_andi_i32(tmp, tmp, 0xfffffffc);
8750
8751             tmp2 = tcg_temp_new_i32();
8752             tcg_gen_movi_i32(tmp2, s->pc | 1);
8753             store_reg(s, 14, tmp2);
8754             gen_bx(s, tmp);
8755             return 0;
8756         }
8757         if (insn & (1 << 11)) {
8758             /* Second half of bl.  */
8759             offset = ((insn & 0x7ff) << 1) | 1;
8760             tmp = load_reg(s, 14);
8761             tcg_gen_addi_i32(tmp, tmp, offset);
8762
8763             tmp2 = tcg_temp_new_i32();
8764             tcg_gen_movi_i32(tmp2, s->pc | 1);
8765             store_reg(s, 14, tmp2);
8766             gen_bx(s, tmp);
8767             return 0;
8768         }
8769         if ((s->pc & ~TARGET_PAGE_MASK) == 0) {
8770             /* Instruction spans a page boundary.  Implement it as two
8771                16-bit instructions in case the second half causes an
8772                prefetch abort.  */
8773             offset = ((int32_t)insn << 21) >> 9;
8774             tcg_gen_movi_i32(cpu_R[14], s->pc + 2 + offset);
8775             return 0;
8776         }
8777         /* Fall through to 32-bit decode.  */
8778     }
8779
8780     insn = arm_lduw_code(env, s->pc, s->bswap_code);
8781     s->pc += 2;
8782     insn |= (uint32_t)insn_hw1 << 16;
8783
8784     if ((insn & 0xf800e800) != 0xf000e800) {
8785         ARCH(6T2);
8786     }
8787
8788     rn = (insn >> 16) & 0xf;
8789     rs = (insn >> 12) & 0xf;
8790     rd = (insn >> 8) & 0xf;
8791     rm = insn & 0xf;
8792     switch ((insn >> 25) & 0xf) {
8793     case 0: case 1: case 2: case 3:
8794         /* 16-bit instructions.  Should never happen.  */
8795         abort();
8796     case 4:
8797         if (insn & (1 << 22)) {
8798             /* Other load/store, table branch.  */
8799             if (insn & 0x01200000) {
8800                 /* Load/store doubleword.  */
8801                 if (rn == 15) {
8802                     addr = tcg_temp_new_i32();
8803                     tcg_gen_movi_i32(addr, s->pc & ~3);
8804                 } else {
8805                     addr = load_reg(s, rn);
8806                 }
8807                 offset = (insn & 0xff) * 4;
8808                 if ((insn & (1 << 23)) == 0)
8809                     offset = -offset;
8810                 if (insn & (1 << 24)) {
8811                     tcg_gen_addi_i32(addr, addr, offset);
8812                     offset = 0;
8813                 }
8814                 if (insn & (1 << 20)) {
8815                     /* ldrd */
8816                     tmp = tcg_temp_new_i32();
8817                     gen_aa32_ld32u(tmp, addr, IS_USER(s));
8818                     store_reg(s, rs, tmp);
8819                     tcg_gen_addi_i32(addr, addr, 4);
8820                     tmp = tcg_temp_new_i32();
8821                     gen_aa32_ld32u(tmp, addr, IS_USER(s));
8822                     store_reg(s, rd, tmp);
8823                 } else {
8824                     /* strd */
8825                     tmp = load_reg(s, rs);
8826                     gen_aa32_st32(tmp, addr, IS_USER(s));
8827                     tcg_temp_free_i32(tmp);
8828                     tcg_gen_addi_i32(addr, addr, 4);
8829                     tmp = load_reg(s, rd);
8830                     gen_aa32_st32(tmp, addr, IS_USER(s));
8831                     tcg_temp_free_i32(tmp);
8832                 }
8833                 if (insn & (1 << 21)) {
8834                     /* Base writeback.  */
8835                     if (rn == 15)
8836                         goto illegal_op;
8837                     tcg_gen_addi_i32(addr, addr, offset - 4);
8838                     store_reg(s, rn, addr);
8839                 } else {
8840                     tcg_temp_free_i32(addr);
8841                 }
8842             } else if ((insn & (1 << 23)) == 0) {
8843                 /* Load/store exclusive word.  */
8844                 addr = tcg_temp_local_new_i32();
8845                 load_reg_var(s, addr, rn);
8846                 tcg_gen_addi_i32(addr, addr, (insn & 0xff) << 2);
8847                 if (insn & (1 << 20)) {
8848                     gen_load_exclusive(s, rs, 15, addr, 2);
8849                 } else {
8850                     gen_store_exclusive(s, rd, rs, 15, addr, 2);
8851                 }
8852                 tcg_temp_free_i32(addr);
8853             } else if ((insn & (7 << 5)) == 0) {
8854                 /* Table Branch.  */
8855                 if (rn == 15) {
8856                     addr = tcg_temp_new_i32();
8857                     tcg_gen_movi_i32(addr, s->pc);
8858                 } else {
8859                     addr = load_reg(s, rn);
8860                 }
8861                 tmp = load_reg(s, rm);
8862                 tcg_gen_add_i32(addr, addr, tmp);
8863                 if (insn & (1 << 4)) {
8864                     /* tbh */
8865                     tcg_gen_add_i32(addr, addr, tmp);
8866                     tcg_temp_free_i32(tmp);
8867                     tmp = tcg_temp_new_i32();
8868                     gen_aa32_ld16u(tmp, addr, IS_USER(s));
8869                 } else { /* tbb */
8870                     tcg_temp_free_i32(tmp);
8871                     tmp = tcg_temp_new_i32();
8872                     gen_aa32_ld8u(tmp, addr, IS_USER(s));
8873                 }
8874                 tcg_temp_free_i32(addr);
8875                 tcg_gen_shli_i32(tmp, tmp, 1);
8876                 tcg_gen_addi_i32(tmp, tmp, s->pc);
8877                 store_reg(s, 15, tmp);
8878             } else {
8879                 int op2 = (insn >> 6) & 0x3;
8880                 op = (insn >> 4) & 0x3;
8881                 switch (op2) {
8882                 case 0:
8883                     goto illegal_op;
8884                 case 1:
8885                     /* Load/store exclusive byte/halfword/doubleword */
8886                     if (op == 2) {
8887                         goto illegal_op;
8888                     }
8889                     ARCH(7);
8890                     break;
8891                 case 2:
8892                     /* Load-acquire/store-release */
8893                     if (op == 3) {
8894                         goto illegal_op;
8895                     }
8896                     /* Fall through */
8897                 case 3:
8898                     /* Load-acquire/store-release exclusive */
8899                     ARCH(8);
8900                     break;
8901                 }
8902                 addr = tcg_temp_local_new_i32();
8903                 load_reg_var(s, addr, rn);
8904                 if (!(op2 & 1)) {
8905                     if (insn & (1 << 20)) {
8906                         tmp = tcg_temp_new_i32();
8907                         switch (op) {
8908                         case 0: /* ldab */
8909                             gen_aa32_ld8u(tmp, addr, IS_USER(s));
8910                             break;
8911                         case 1: /* ldah */
8912                             gen_aa32_ld16u(tmp, addr, IS_USER(s));
8913                             break;
8914                         case 2: /* lda */
8915                             gen_aa32_ld32u(tmp, addr, IS_USER(s));
8916                             break;
8917                         default:
8918                             abort();
8919                         }
8920                         store_reg(s, rs, tmp);
8921                     } else {
8922                         tmp = load_reg(s, rs);
8923                         switch (op) {
8924                         case 0: /* stlb */
8925                             gen_aa32_st8(tmp, addr, IS_USER(s));
8926                             break;
8927                         case 1: /* stlh */
8928                             gen_aa32_st16(tmp, addr, IS_USER(s));
8929                             break;
8930                         case 2: /* stl */
8931                             gen_aa32_st32(tmp, addr, IS_USER(s));
8932                             break;
8933                         default:
8934                             abort();
8935                         }
8936                         tcg_temp_free_i32(tmp);
8937                     }
8938                 } else if (insn & (1 << 20)) {
8939                     gen_load_exclusive(s, rs, rd, addr, op);
8940                 } else {
8941                     gen_store_exclusive(s, rm, rs, rd, addr, op);
8942                 }
8943                 tcg_temp_free_i32(addr);
8944             }
8945         } else {
8946             /* Load/store multiple, RFE, SRS.  */
8947             if (((insn >> 23) & 1) == ((insn >> 24) & 1)) {
8948                 /* RFE, SRS: not available in user mode or on M profile */
8949                 if (IS_USER(s) || IS_M(env)) {
8950                     goto illegal_op;
8951                 }
8952                 if (insn & (1 << 20)) {
8953                     /* rfe */
8954                     addr = load_reg(s, rn);
8955                     if ((insn & (1 << 24)) == 0)
8956                         tcg_gen_addi_i32(addr, addr, -8);
8957                     /* Load PC into tmp and CPSR into tmp2.  */
8958                     tmp = tcg_temp_new_i32();
8959                     gen_aa32_ld32u(tmp, addr, 0);
8960                     tcg_gen_addi_i32(addr, addr, 4);
8961                     tmp2 = tcg_temp_new_i32();
8962                     gen_aa32_ld32u(tmp2, addr, 0);
8963                     if (insn & (1 << 21)) {
8964                         /* Base writeback.  */
8965                         if (insn & (1 << 24)) {
8966                             tcg_gen_addi_i32(addr, addr, 4);
8967                         } else {
8968                             tcg_gen_addi_i32(addr, addr, -4);
8969                         }
8970                         store_reg(s, rn, addr);
8971                     } else {
8972                         tcg_temp_free_i32(addr);
8973                     }
8974                     gen_rfe(s, tmp, tmp2);
8975                 } else {
8976                     /* srs */
8977                     gen_srs(s, (insn & 0x1f), (insn & (1 << 24)) ? 1 : 2,
8978                             insn & (1 << 21));
8979                 }
8980             } else {
8981                 int i, loaded_base = 0;
8982                 TCGv_i32 loaded_var;
8983                 /* Load/store multiple.  */
8984                 addr = load_reg(s, rn);
8985                 offset = 0;
8986                 for (i = 0; i < 16; i++) {
8987                     if (insn & (1 << i))
8988                         offset += 4;
8989                 }
8990                 if (insn & (1 << 24)) {
8991                     tcg_gen_addi_i32(addr, addr, -offset);
8992                 }
8993
8994                 TCGV_UNUSED_I32(loaded_var);
8995                 for (i = 0; i < 16; i++) {
8996                     if ((insn & (1 << i)) == 0)
8997                         continue;
8998                     if (insn & (1 << 20)) {
8999                         /* Load.  */
9000                         tmp = tcg_temp_new_i32();
9001                         gen_aa32_ld32u(tmp, addr, IS_USER(s));
9002                         if (i == 15) {
9003                             gen_bx(s, tmp);
9004                         } else if (i == rn) {
9005                             loaded_var = tmp;
9006                             loaded_base = 1;
9007                         } else {
9008                             store_reg(s, i, tmp);
9009                         }
9010                     } else {
9011                         /* Store.  */
9012                         tmp = load_reg(s, i);
9013                         gen_aa32_st32(tmp, addr, IS_USER(s));
9014                         tcg_temp_free_i32(tmp);
9015                     }
9016                     tcg_gen_addi_i32(addr, addr, 4);
9017                 }
9018                 if (loaded_base) {
9019                     store_reg(s, rn, loaded_var);
9020                 }
9021                 if (insn & (1 << 21)) {
9022                     /* Base register writeback.  */
9023                     if (insn & (1 << 24)) {
9024                         tcg_gen_addi_i32(addr, addr, -offset);
9025                     }
9026                     /* Fault if writeback register is in register list.  */
9027                     if (insn & (1 << rn))
9028                         goto illegal_op;
9029                     store_reg(s, rn, addr);
9030                 } else {
9031                     tcg_temp_free_i32(addr);
9032                 }
9033             }
9034         }
9035         break;
9036     case 5:
9037
9038         op = (insn >> 21) & 0xf;
9039         if (op == 6) {
9040             /* Halfword pack.  */
9041             tmp = load_reg(s, rn);
9042             tmp2 = load_reg(s, rm);
9043             shift = ((insn >> 10) & 0x1c) | ((insn >> 6) & 0x3);
9044             if (insn & (1 << 5)) {
9045                 /* pkhtb */
9046                 if (shift == 0)
9047                     shift = 31;
9048                 tcg_gen_sari_i32(tmp2, tmp2, shift);
9049                 tcg_gen_andi_i32(tmp, tmp, 0xffff0000);
9050                 tcg_gen_ext16u_i32(tmp2, tmp2);
9051             } else {
9052                 /* pkhbt */
9053                 if (shift)
9054                     tcg_gen_shli_i32(tmp2, tmp2, shift);
9055                 tcg_gen_ext16u_i32(tmp, tmp);
9056                 tcg_gen_andi_i32(tmp2, tmp2, 0xffff0000);
9057             }
9058             tcg_gen_or_i32(tmp, tmp, tmp2);
9059             tcg_temp_free_i32(tmp2);
9060             store_reg(s, rd, tmp);
9061         } else {
9062             /* Data processing register constant shift.  */
9063             if (rn == 15) {
9064                 tmp = tcg_temp_new_i32();
9065                 tcg_gen_movi_i32(tmp, 0);
9066             } else {
9067                 tmp = load_reg(s, rn);
9068             }
9069             tmp2 = load_reg(s, rm);
9070
9071             shiftop = (insn >> 4) & 3;
9072             shift = ((insn >> 6) & 3) | ((insn >> 10) & 0x1c);
9073             conds = (insn & (1 << 20)) != 0;
9074             logic_cc = (conds && thumb2_logic_op(op));
9075             gen_arm_shift_im(tmp2, shiftop, shift, logic_cc);
9076             if (gen_thumb2_data_op(s, op, conds, 0, tmp, tmp2))
9077                 goto illegal_op;
9078             tcg_temp_free_i32(tmp2);
9079             if (rd != 15) {
9080                 store_reg(s, rd, tmp);
9081             } else {
9082                 tcg_temp_free_i32(tmp);
9083             }
9084         }
9085         break;
9086     case 13: /* Misc data processing.  */
9087         op = ((insn >> 22) & 6) | ((insn >> 7) & 1);
9088         if (op < 4 && (insn & 0xf000) != 0xf000)
9089             goto illegal_op;
9090         switch (op) {
9091         case 0: /* Register controlled shift.  */
9092             tmp = load_reg(s, rn);
9093             tmp2 = load_reg(s, rm);
9094             if ((insn & 0x70) != 0)
9095                 goto illegal_op;
9096             op = (insn >> 21) & 3;
9097             logic_cc = (insn & (1 << 20)) != 0;
9098             gen_arm_shift_reg(tmp, op, tmp2, logic_cc);
9099             if (logic_cc)
9100                 gen_logic_CC(tmp);
9101             store_reg_bx(env, s, rd, tmp);
9102             break;
9103         case 1: /* Sign/zero extend.  */
9104             tmp = load_reg(s, rm);
9105             shift = (insn >> 4) & 3;
9106             /* ??? In many cases it's not necessary to do a
9107                rotate, a shift is sufficient.  */
9108             if (shift != 0)
9109                 tcg_gen_rotri_i32(tmp, tmp, shift * 8);
9110             op = (insn >> 20) & 7;
9111             switch (op) {
9112             case 0: gen_sxth(tmp);   break;
9113             case 1: gen_uxth(tmp);   break;
9114             case 2: gen_sxtb16(tmp); break;
9115             case 3: gen_uxtb16(tmp); break;
9116             case 4: gen_sxtb(tmp);   break;
9117             case 5: gen_uxtb(tmp);   break;
9118             default: goto illegal_op;
9119             }
9120             if (rn != 15) {
9121                 tmp2 = load_reg(s, rn);
9122                 if ((op >> 1) == 1) {
9123                     gen_add16(tmp, tmp2);
9124                 } else {
9125                     tcg_gen_add_i32(tmp, tmp, tmp2);
9126                     tcg_temp_free_i32(tmp2);
9127                 }
9128             }
9129             store_reg(s, rd, tmp);
9130             break;
9131         case 2: /* SIMD add/subtract.  */
9132             op = (insn >> 20) & 7;
9133             shift = (insn >> 4) & 7;
9134             if ((op & 3) == 3 || (shift & 3) == 3)
9135                 goto illegal_op;
9136             tmp = load_reg(s, rn);
9137             tmp2 = load_reg(s, rm);
9138             gen_thumb2_parallel_addsub(op, shift, tmp, tmp2);
9139             tcg_temp_free_i32(tmp2);
9140             store_reg(s, rd, tmp);
9141             break;
9142         case 3: /* Other data processing.  */
9143             op = ((insn >> 17) & 0x38) | ((insn >> 4) & 7);
9144             if (op < 4) {
9145                 /* Saturating add/subtract.  */
9146                 tmp = load_reg(s, rn);
9147                 tmp2 = load_reg(s, rm);
9148                 if (op & 1)
9149                     gen_helper_double_saturate(tmp, cpu_env, tmp);
9150                 if (op & 2)
9151                     gen_helper_sub_saturate(tmp, cpu_env, tmp2, tmp);
9152                 else
9153                     gen_helper_add_saturate(tmp, cpu_env, tmp, tmp2);
9154                 tcg_temp_free_i32(tmp2);
9155             } else {
9156                 tmp = load_reg(s, rn);
9157                 switch (op) {
9158                 case 0x0a: /* rbit */
9159                     gen_helper_rbit(tmp, tmp);
9160                     break;
9161                 case 0x08: /* rev */
9162                     tcg_gen_bswap32_i32(tmp, tmp);
9163                     break;
9164                 case 0x09: /* rev16 */
9165                     gen_rev16(tmp);
9166                     break;
9167                 case 0x0b: /* revsh */
9168                     gen_revsh(tmp);
9169                     break;
9170                 case 0x10: /* sel */
9171                     tmp2 = load_reg(s, rm);
9172                     tmp3 = tcg_temp_new_i32();
9173                     tcg_gen_ld_i32(tmp3, cpu_env, offsetof(CPUARMState, GE));
9174                     gen_helper_sel_flags(tmp, tmp3, tmp, tmp2);
9175                     tcg_temp_free_i32(tmp3);
9176                     tcg_temp_free_i32(tmp2);
9177                     break;
9178                 case 0x18: /* clz */
9179                     gen_helper_clz(tmp, tmp);
9180                     break;
9181                 case 0x20:
9182                 case 0x21:
9183                 case 0x22:
9184                 case 0x28:
9185                 case 0x29:
9186                 case 0x2a:
9187                 {
9188                     /* crc32/crc32c */
9189                     uint32_t sz = op & 0x3;
9190                     uint32_t c = op & 0x8;
9191
9192                     if (!arm_feature(env, ARM_FEATURE_CRC)) {
9193                         goto illegal_op;
9194                     }
9195
9196                     tmp2 = load_reg(s, rm);
9197                     tmp3 = tcg_const_i32(1 << sz);
9198                     if (c) {
9199                         gen_helper_crc32c(tmp, tmp, tmp2, tmp3);
9200                     } else {
9201                         gen_helper_crc32(tmp, tmp, tmp2, tmp3);
9202                     }
9203                     tcg_temp_free_i32(tmp2);
9204                     tcg_temp_free_i32(tmp3);
9205                     break;
9206                 }
9207                 default:
9208                     goto illegal_op;
9209                 }
9210             }
9211             store_reg(s, rd, tmp);
9212             break;
9213         case 4: case 5: /* 32-bit multiply.  Sum of absolute differences.  */
9214             op = (insn >> 4) & 0xf;
9215             tmp = load_reg(s, rn);
9216             tmp2 = load_reg(s, rm);
9217             switch ((insn >> 20) & 7) {
9218             case 0: /* 32 x 32 -> 32 */
9219                 tcg_gen_mul_i32(tmp, tmp, tmp2);
9220                 tcg_temp_free_i32(tmp2);
9221                 if (rs != 15) {
9222                     tmp2 = load_reg(s, rs);
9223                     if (op)
9224                         tcg_gen_sub_i32(tmp, tmp2, tmp);
9225                     else
9226                         tcg_gen_add_i32(tmp, tmp, tmp2);
9227                     tcg_temp_free_i32(tmp2);
9228                 }
9229                 break;
9230             case 1: /* 16 x 16 -> 32 */
9231                 gen_mulxy(tmp, tmp2, op & 2, op & 1);
9232                 tcg_temp_free_i32(tmp2);
9233                 if (rs != 15) {
9234                     tmp2 = load_reg(s, rs);
9235                     gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
9236                     tcg_temp_free_i32(tmp2);
9237                 }
9238                 break;
9239             case 2: /* Dual multiply add.  */
9240             case 4: /* Dual multiply subtract.  */
9241                 if (op)
9242                     gen_swap_half(tmp2);
9243                 gen_smul_dual(tmp, tmp2);
9244                 if (insn & (1 << 22)) {
9245                     /* This subtraction cannot overflow. */
9246                     tcg_gen_sub_i32(tmp, tmp, tmp2);
9247                 } else {
9248                     /* This addition cannot overflow 32 bits;
9249                      * however it may overflow considered as a signed
9250                      * operation, in which case we must set the Q flag.
9251                      */
9252                     gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
9253                 }
9254                 tcg_temp_free_i32(tmp2);
9255                 if (rs != 15)
9256                   {
9257                     tmp2 = load_reg(s, rs);
9258                     gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
9259                     tcg_temp_free_i32(tmp2);
9260                   }
9261                 break;
9262             case 3: /* 32 * 16 -> 32msb */
9263                 if (op)
9264                     tcg_gen_sari_i32(tmp2, tmp2, 16);
9265                 else
9266                     gen_sxth(tmp2);
9267                 tmp64 = gen_muls_i64_i32(tmp, tmp2);
9268                 tcg_gen_shri_i64(tmp64, tmp64, 16);
9269                 tmp = tcg_temp_new_i32();
9270                 tcg_gen_trunc_i64_i32(tmp, tmp64);
9271                 tcg_temp_free_i64(tmp64);
9272                 if (rs != 15)
9273                   {
9274                     tmp2 = load_reg(s, rs);
9275                     gen_helper_add_setq(tmp, cpu_env, tmp, tmp2);
9276                     tcg_temp_free_i32(tmp2);
9277                   }
9278                 break;
9279             case 5: case 6: /* 32 * 32 -> 32msb (SMMUL, SMMLA, SMMLS) */
9280                 tmp64 = gen_muls_i64_i32(tmp, tmp2);
9281                 if (rs != 15) {
9282                     tmp = load_reg(s, rs);
9283                     if (insn & (1 << 20)) {
9284                         tmp64 = gen_addq_msw(tmp64, tmp);
9285                     } else {
9286                         tmp64 = gen_subq_msw(tmp64, tmp);
9287                     }
9288                 }
9289                 if (insn & (1 << 4)) {
9290                     tcg_gen_addi_i64(tmp64, tmp64, 0x80000000u);
9291                 }
9292                 tcg_gen_shri_i64(tmp64, tmp64, 32);
9293                 tmp = tcg_temp_new_i32();
9294                 tcg_gen_trunc_i64_i32(tmp, tmp64);
9295                 tcg_temp_free_i64(tmp64);
9296                 break;
9297             case 7: /* Unsigned sum of absolute differences.  */
9298                 gen_helper_usad8(tmp, tmp, tmp2);
9299                 tcg_temp_free_i32(tmp2);
9300                 if (rs != 15) {
9301                     tmp2 = load_reg(s, rs);
9302                     tcg_gen_add_i32(tmp, tmp, tmp2);
9303                     tcg_temp_free_i32(tmp2);
9304                 }
9305                 break;
9306             }
9307             store_reg(s, rd, tmp);
9308             break;
9309         case 6: case 7: /* 64-bit multiply, Divide.  */
9310             op = ((insn >> 4) & 0xf) | ((insn >> 16) & 0x70);
9311             tmp = load_reg(s, rn);
9312             tmp2 = load_reg(s, rm);
9313             if ((op & 0x50) == 0x10) {
9314                 /* sdiv, udiv */
9315                 if (!arm_feature(env, ARM_FEATURE_THUMB_DIV)) {
9316                     goto illegal_op;
9317                 }
9318                 if (op & 0x20)
9319                     gen_helper_udiv(tmp, tmp, tmp2);
9320                 else
9321                     gen_helper_sdiv(tmp, tmp, tmp2);
9322                 tcg_temp_free_i32(tmp2);
9323                 store_reg(s, rd, tmp);
9324             } else if ((op & 0xe) == 0xc) {
9325                 /* Dual multiply accumulate long.  */
9326                 if (op & 1)
9327                     gen_swap_half(tmp2);
9328                 gen_smul_dual(tmp, tmp2);
9329                 if (op & 0x10) {
9330                     tcg_gen_sub_i32(tmp, tmp, tmp2);
9331                 } else {
9332                     tcg_gen_add_i32(tmp, tmp, tmp2);
9333                 }
9334                 tcg_temp_free_i32(tmp2);
9335                 /* BUGFIX */
9336                 tmp64 = tcg_temp_new_i64();
9337                 tcg_gen_ext_i32_i64(tmp64, tmp);
9338                 tcg_temp_free_i32(tmp);
9339                 gen_addq(s, tmp64, rs, rd);
9340                 gen_storeq_reg(s, rs, rd, tmp64);
9341                 tcg_temp_free_i64(tmp64);
9342             } else {
9343                 if (op & 0x20) {
9344                     /* Unsigned 64-bit multiply  */
9345                     tmp64 = gen_mulu_i64_i32(tmp, tmp2);
9346                 } else {
9347                     if (op & 8) {
9348                         /* smlalxy */
9349                         gen_mulxy(tmp, tmp2, op & 2, op & 1);
9350                         tcg_temp_free_i32(tmp2);
9351                         tmp64 = tcg_temp_new_i64();
9352                         tcg_gen_ext_i32_i64(tmp64, tmp);
9353                         tcg_temp_free_i32(tmp);
9354                     } else {
9355                         /* Signed 64-bit multiply  */
9356                         tmp64 = gen_muls_i64_i32(tmp, tmp2);
9357                     }
9358                 }
9359                 if (op & 4) {
9360                     /* umaal */
9361                     gen_addq_lo(s, tmp64, rs);
9362                     gen_addq_lo(s, tmp64, rd);
9363                 } else if (op & 0x40) {
9364                     /* 64-bit accumulate.  */
9365                     gen_addq(s, tmp64, rs, rd);
9366                 }
9367                 gen_storeq_reg(s, rs, rd, tmp64);
9368                 tcg_temp_free_i64(tmp64);
9369             }
9370             break;
9371         }
9372         break;
9373     case 6: case 7: case 14: case 15:
9374         /* Coprocessor.  */
9375         if (((insn >> 24) & 3) == 3) {
9376             /* Translate into the equivalent ARM encoding.  */
9377             insn = (insn & 0xe2ffffff) | ((insn & (1 << 28)) >> 4) | (1 << 28);
9378             if (disas_neon_data_insn(env, s, insn))
9379                 goto illegal_op;
9380         } else if (((insn >> 8) & 0xe) == 10) {
9381             if (disas_vfp_insn(env, s, insn)) {
9382                 goto illegal_op;
9383             }
9384         } else {
9385             if (insn & (1 << 28))
9386                 goto illegal_op;
9387             if (disas_coproc_insn (env, s, insn))
9388                 goto illegal_op;
9389         }
9390         break;
9391     case 8: case 9: case 10: case 11:
9392         if (insn & (1 << 15)) {
9393             /* Branches, misc control.  */
9394             if (insn & 0x5000) {
9395                 /* Unconditional branch.  */
9396                 /* signextend(hw1[10:0]) -> offset[:12].  */
9397                 offset = ((int32_t)insn << 5) >> 9 & ~(int32_t)0xfff;
9398                 /* hw1[10:0] -> offset[11:1].  */
9399                 offset |= (insn & 0x7ff) << 1;
9400                 /* (~hw2[13, 11] ^ offset[24]) -> offset[23,22]
9401                    offset[24:22] already have the same value because of the
9402                    sign extension above.  */
9403                 offset ^= ((~insn) & (1 << 13)) << 10;
9404                 offset ^= ((~insn) & (1 << 11)) << 11;
9405
9406                 if (insn & (1 << 14)) {
9407                     /* Branch and link.  */
9408                     tcg_gen_movi_i32(cpu_R[14], s->pc | 1);
9409                 }
9410
9411                 offset += s->pc;
9412                 if (insn & (1 << 12)) {
9413                     /* b/bl */
9414                     gen_jmp(s, offset);
9415                 } else {
9416                     /* blx */
9417                     offset &= ~(uint32_t)2;
9418                     /* thumb2 bx, no need to check */
9419                     gen_bx_im(s, offset);
9420                 }
9421             } else if (((insn >> 23) & 7) == 7) {
9422                 /* Misc control */
9423                 if (insn & (1 << 13))
9424                     goto illegal_op;
9425
9426                 if (insn & (1 << 26)) {
9427                     /* Secure monitor call (v6Z) */
9428                     qemu_log_mask(LOG_UNIMP,
9429                                   "arm: unimplemented secure monitor call\n");
9430                     goto illegal_op; /* not implemented.  */
9431                 } else {
9432                     op = (insn >> 20) & 7;
9433                     switch (op) {
9434                     case 0: /* msr cpsr.  */
9435                         if (IS_M(env)) {
9436                             tmp = load_reg(s, rn);
9437                             addr = tcg_const_i32(insn & 0xff);
9438                             gen_helper_v7m_msr(cpu_env, addr, tmp);
9439                             tcg_temp_free_i32(addr);
9440                             tcg_temp_free_i32(tmp);
9441                             gen_lookup_tb(s);
9442                             break;
9443                         }
9444                         /* fall through */
9445                     case 1: /* msr spsr.  */
9446                         if (IS_M(env))
9447                             goto illegal_op;
9448                         tmp = load_reg(s, rn);
9449                         if (gen_set_psr(s,
9450                               msr_mask(env, s, (insn >> 8) & 0xf, op == 1),
9451                               op == 1, tmp))
9452                             goto illegal_op;
9453                         break;
9454                     case 2: /* cps, nop-hint.  */
9455                         if (((insn >> 8) & 7) == 0) {
9456                             gen_nop_hint(s, insn & 0xff);
9457                         }
9458                         /* Implemented as NOP in user mode.  */
9459                         if (IS_USER(s))
9460                             break;
9461                         offset = 0;
9462                         imm = 0;
9463                         if (insn & (1 << 10)) {
9464                             if (insn & (1 << 7))
9465                                 offset |= CPSR_A;
9466                             if (insn & (1 << 6))
9467                                 offset |= CPSR_I;
9468                             if (insn & (1 << 5))
9469                                 offset |= CPSR_F;
9470                             if (insn & (1 << 9))
9471                                 imm = CPSR_A | CPSR_I | CPSR_F;
9472                         }
9473                         if (insn & (1 << 8)) {
9474                             offset |= 0x1f;
9475                             imm |= (insn & 0x1f);
9476                         }
9477                         if (offset) {
9478                             gen_set_psr_im(s, offset, 0, imm);
9479                         }
9480                         break;
9481                     case 3: /* Special control operations.  */
9482                         ARCH(7);
9483                         op = (insn >> 4) & 0xf;
9484                         switch (op) {
9485                         case 2: /* clrex */
9486                             gen_clrex(s);
9487                             break;
9488                         case 4: /* dsb */
9489                         case 5: /* dmb */
9490                         case 6: /* isb */
9491                             /* These execute as NOPs.  */
9492                             break;
9493                         default:
9494                             goto illegal_op;
9495                         }
9496                         break;
9497                     case 4: /* bxj */
9498                         /* Trivial implementation equivalent to bx.  */
9499                         tmp = load_reg(s, rn);
9500                         gen_bx(s, tmp);
9501                         break;
9502                     case 5: /* Exception return.  */
9503                         if (IS_USER(s)) {
9504                             goto illegal_op;
9505                         }
9506                         if (rn != 14 || rd != 15) {
9507                             goto illegal_op;
9508                         }
9509                         tmp = load_reg(s, rn);
9510                         tcg_gen_subi_i32(tmp, tmp, insn & 0xff);
9511                         gen_exception_return(s, tmp);
9512                         break;
9513                     case 6: /* mrs cpsr.  */
9514                         tmp = tcg_temp_new_i32();
9515                         if (IS_M(env)) {
9516                             addr = tcg_const_i32(insn & 0xff);
9517                             gen_helper_v7m_mrs(tmp, cpu_env, addr);
9518                             tcg_temp_free_i32(addr);
9519                         } else {
9520                             gen_helper_cpsr_read(tmp, cpu_env);
9521                         }
9522                         store_reg(s, rd, tmp);
9523                         break;
9524                     case 7: /* mrs spsr.  */
9525                         /* Not accessible in user mode.  */
9526                         if (IS_USER(s) || IS_M(env))
9527                             goto illegal_op;
9528                         tmp = load_cpu_field(spsr);
9529                         store_reg(s, rd, tmp);
9530                         break;
9531                     }
9532                 }
9533             } else {
9534                 /* Conditional branch.  */
9535                 op = (insn >> 22) & 0xf;
9536                 /* Generate a conditional jump to next instruction.  */
9537                 s->condlabel = gen_new_label();
9538                 arm_gen_test_cc(op ^ 1, s->condlabel);
9539                 s->condjmp = 1;
9540
9541                 /* offset[11:1] = insn[10:0] */
9542                 offset = (insn & 0x7ff) << 1;
9543                 /* offset[17:12] = insn[21:16].  */
9544                 offset |= (insn & 0x003f0000) >> 4;
9545                 /* offset[31:20] = insn[26].  */
9546                 offset |= ((int32_t)((insn << 5) & 0x80000000)) >> 11;
9547                 /* offset[18] = insn[13].  */
9548                 offset |= (insn & (1 << 13)) << 5;
9549                 /* offset[19] = insn[11].  */
9550                 offset |= (insn & (1 << 11)) << 8;
9551
9552                 /* jump to the offset */
9553                 gen_jmp(s, s->pc + offset);
9554             }
9555         } else {
9556             /* Data processing immediate.  */
9557             if (insn & (1 << 25)) {
9558                 if (insn & (1 << 24)) {
9559                     if (insn & (1 << 20))
9560                         goto illegal_op;
9561                     /* Bitfield/Saturate.  */
9562                     op = (insn >> 21) & 7;
9563                     imm = insn & 0x1f;
9564                     shift = ((insn >> 6) & 3) | ((insn >> 10) & 0x1c);
9565                     if (rn == 15) {
9566                         tmp = tcg_temp_new_i32();
9567                         tcg_gen_movi_i32(tmp, 0);
9568                     } else {
9569                         tmp = load_reg(s, rn);
9570                     }
9571                     switch (op) {
9572                     case 2: /* Signed bitfield extract.  */
9573                         imm++;
9574                         if (shift + imm > 32)
9575                             goto illegal_op;
9576                         if (imm < 32)
9577                             gen_sbfx(tmp, shift, imm);
9578                         break;
9579                     case 6: /* Unsigned bitfield extract.  */
9580                         imm++;
9581                         if (shift + imm > 32)
9582                             goto illegal_op;
9583                         if (imm < 32)
9584                             gen_ubfx(tmp, shift, (1u << imm) - 1);
9585                         break;
9586                     case 3: /* Bitfield insert/clear.  */
9587                         if (imm < shift)
9588                             goto illegal_op;
9589                         imm = imm + 1 - shift;
9590                         if (imm != 32) {
9591                             tmp2 = load_reg(s, rd);
9592                             tcg_gen_deposit_i32(tmp, tmp2, tmp, shift, imm);
9593                             tcg_temp_free_i32(tmp2);
9594                         }
9595                         break;
9596                     case 7:
9597                         goto illegal_op;
9598                     default: /* Saturate.  */
9599                         if (shift) {
9600                             if (op & 1)
9601                                 tcg_gen_sari_i32(tmp, tmp, shift);
9602                             else
9603                                 tcg_gen_shli_i32(tmp, tmp, shift);
9604                         }
9605                         tmp2 = tcg_const_i32(imm);
9606                         if (op & 4) {
9607                             /* Unsigned.  */
9608                             if ((op & 1) && shift == 0)
9609                                 gen_helper_usat16(tmp, cpu_env, tmp, tmp2);
9610                             else
9611                                 gen_helper_usat(tmp, cpu_env, tmp, tmp2);
9612                         } else {
9613                             /* Signed.  */
9614                             if ((op & 1) && shift == 0)
9615                                 gen_helper_ssat16(tmp, cpu_env, tmp, tmp2);
9616                             else
9617                                 gen_helper_ssat(tmp, cpu_env, tmp, tmp2);
9618                         }
9619                         tcg_temp_free_i32(tmp2);
9620                         break;
9621                     }
9622                     store_reg(s, rd, tmp);
9623                 } else {
9624                     imm = ((insn & 0x04000000) >> 15)
9625                           | ((insn & 0x7000) >> 4) | (insn & 0xff);
9626                     if (insn & (1 << 22)) {
9627                         /* 16-bit immediate.  */
9628                         imm |= (insn >> 4) & 0xf000;
9629                         if (insn & (1 << 23)) {
9630                             /* movt */
9631                             tmp = load_reg(s, rd);
9632                             tcg_gen_ext16u_i32(tmp, tmp);
9633                             tcg_gen_ori_i32(tmp, tmp, imm << 16);
9634                         } else {
9635                             /* movw */
9636                             tmp = tcg_temp_new_i32();
9637                             tcg_gen_movi_i32(tmp, imm);
9638                         }
9639                     } else {
9640                         /* Add/sub 12-bit immediate.  */
9641                         if (rn == 15) {
9642                             offset = s->pc & ~(uint32_t)3;
9643                             if (insn & (1 << 23))
9644                                 offset -= imm;
9645                             else
9646                                 offset += imm;
9647                             tmp = tcg_temp_new_i32();
9648                             tcg_gen_movi_i32(tmp, offset);
9649                         } else {
9650                             tmp = load_reg(s, rn);
9651                             if (insn & (1 << 23))
9652                                 tcg_gen_subi_i32(tmp, tmp, imm);
9653                             else
9654                                 tcg_gen_addi_i32(tmp, tmp, imm);
9655                         }
9656                     }
9657                     store_reg(s, rd, tmp);
9658                 }
9659             } else {
9660                 int shifter_out = 0;
9661                 /* modified 12-bit immediate.  */
9662                 shift = ((insn & 0x04000000) >> 23) | ((insn & 0x7000) >> 12);
9663                 imm = (insn & 0xff);
9664                 switch (shift) {
9665                 case 0: /* XY */
9666                     /* Nothing to do.  */
9667                     break;
9668                 case 1: /* 00XY00XY */
9669                     imm |= imm << 16;
9670                     break;
9671                 case 2: /* XY00XY00 */
9672                     imm |= imm << 16;
9673                     imm <<= 8;
9674                     break;
9675                 case 3: /* XYXYXYXY */
9676                     imm |= imm << 16;
9677                     imm |= imm << 8;
9678                     break;
9679                 default: /* Rotated constant.  */
9680                     shift = (shift << 1) | (imm >> 7);
9681                     imm |= 0x80;
9682                     imm = imm << (32 - shift);
9683                     shifter_out = 1;
9684                     break;
9685                 }
9686                 tmp2 = tcg_temp_new_i32();
9687                 tcg_gen_movi_i32(tmp2, imm);
9688                 rn = (insn >> 16) & 0xf;
9689                 if (rn == 15) {
9690                     tmp = tcg_temp_new_i32();
9691                     tcg_gen_movi_i32(tmp, 0);
9692                 } else {
9693                     tmp = load_reg(s, rn);
9694                 }
9695                 op = (insn >> 21) & 0xf;
9696                 if (gen_thumb2_data_op(s, op, (insn & (1 << 20)) != 0,
9697                                        shifter_out, tmp, tmp2))
9698                     goto illegal_op;
9699                 tcg_temp_free_i32(tmp2);
9700                 rd = (insn >> 8) & 0xf;
9701                 if (rd != 15) {
9702                     store_reg(s, rd, tmp);
9703                 } else {
9704                     tcg_temp_free_i32(tmp);
9705                 }
9706             }
9707         }
9708         break;
9709     case 12: /* Load/store single data item.  */
9710         {
9711         int postinc = 0;
9712         int writeback = 0;
9713         int user;
9714         if ((insn & 0x01100000) == 0x01000000) {
9715             if (disas_neon_ls_insn(env, s, insn))
9716                 goto illegal_op;
9717             break;
9718         }
9719         op = ((insn >> 21) & 3) | ((insn >> 22) & 4);
9720         if (rs == 15) {
9721             if (!(insn & (1 << 20))) {
9722                 goto illegal_op;
9723             }
9724             if (op != 2) {
9725                 /* Byte or halfword load space with dest == r15 : memory hints.
9726                  * Catch them early so we don't emit pointless addressing code.
9727                  * This space is a mix of:
9728                  *  PLD/PLDW/PLI,  which we implement as NOPs (note that unlike
9729                  *     the ARM encodings, PLDW space doesn't UNDEF for non-v7MP
9730                  *     cores)
9731                  *  unallocated hints, which must be treated as NOPs
9732                  *  UNPREDICTABLE space, which we NOP or UNDEF depending on
9733                  *     which is easiest for the decoding logic
9734                  *  Some space which must UNDEF
9735                  */
9736                 int op1 = (insn >> 23) & 3;
9737                 int op2 = (insn >> 6) & 0x3f;
9738                 if (op & 2) {
9739                     goto illegal_op;
9740                 }
9741                 if (rn == 15) {
9742                     /* UNPREDICTABLE, unallocated hint or
9743                      * PLD/PLDW/PLI (literal)
9744                      */
9745                     return 0;
9746                 }
9747                 if (op1 & 1) {
9748                     return 0; /* PLD/PLDW/PLI or unallocated hint */
9749                 }
9750                 if ((op2 == 0) || ((op2 & 0x3c) == 0x30)) {
9751                     return 0; /* PLD/PLDW/PLI or unallocated hint */
9752                 }
9753                 /* UNDEF space, or an UNPREDICTABLE */
9754                 return 1;
9755             }
9756         }
9757         user = IS_USER(s);
9758         if (rn == 15) {
9759             addr = tcg_temp_new_i32();
9760             /* PC relative.  */
9761             /* s->pc has already been incremented by 4.  */
9762             imm = s->pc & 0xfffffffc;
9763             if (insn & (1 << 23))
9764                 imm += insn & 0xfff;
9765             else
9766                 imm -= insn & 0xfff;
9767             tcg_gen_movi_i32(addr, imm);
9768         } else {
9769             addr = load_reg(s, rn);
9770             if (insn & (1 << 23)) {
9771                 /* Positive offset.  */
9772                 imm = insn & 0xfff;
9773                 tcg_gen_addi_i32(addr, addr, imm);
9774             } else {
9775                 imm = insn & 0xff;
9776                 switch ((insn >> 8) & 0xf) {
9777                 case 0x0: /* Shifted Register.  */
9778                     shift = (insn >> 4) & 0xf;
9779                     if (shift > 3) {
9780                         tcg_temp_free_i32(addr);
9781                         goto illegal_op;
9782                     }
9783                     tmp = load_reg(s, rm);
9784                     if (shift)
9785                         tcg_gen_shli_i32(tmp, tmp, shift);
9786                     tcg_gen_add_i32(addr, addr, tmp);
9787                     tcg_temp_free_i32(tmp);
9788                     break;
9789                 case 0xc: /* Negative offset.  */
9790                     tcg_gen_addi_i32(addr, addr, -imm);
9791                     break;
9792                 case 0xe: /* User privilege.  */
9793                     tcg_gen_addi_i32(addr, addr, imm);
9794                     user = 1;
9795                     break;
9796                 case 0x9: /* Post-decrement.  */
9797                     imm = -imm;
9798                     /* Fall through.  */
9799                 case 0xb: /* Post-increment.  */
9800                     postinc = 1;
9801                     writeback = 1;
9802                     break;
9803                 case 0xd: /* Pre-decrement.  */
9804                     imm = -imm;
9805                     /* Fall through.  */
9806                 case 0xf: /* Pre-increment.  */
9807                     tcg_gen_addi_i32(addr, addr, imm);
9808                     writeback = 1;
9809                     break;
9810                 default:
9811                     tcg_temp_free_i32(addr);
9812                     goto illegal_op;
9813                 }
9814             }
9815         }
9816         if (insn & (1 << 20)) {
9817             /* Load.  */
9818             tmp = tcg_temp_new_i32();
9819             switch (op) {
9820             case 0:
9821                 gen_aa32_ld8u(tmp, addr, user);
9822                 break;
9823             case 4:
9824                 gen_aa32_ld8s(tmp, addr, user);
9825                 break;
9826             case 1:
9827                 gen_aa32_ld16u(tmp, addr, user);
9828                 break;
9829             case 5:
9830                 gen_aa32_ld16s(tmp, addr, user);
9831                 break;
9832             case 2:
9833                 gen_aa32_ld32u(tmp, addr, user);
9834                 break;
9835             default:
9836                 tcg_temp_free_i32(tmp);
9837                 tcg_temp_free_i32(addr);
9838                 goto illegal_op;
9839             }
9840             if (rs == 15) {
9841                 gen_bx(s, tmp);
9842             } else {
9843                 store_reg(s, rs, tmp);
9844             }
9845         } else {
9846             /* Store.  */
9847             tmp = load_reg(s, rs);
9848             switch (op) {
9849             case 0:
9850                 gen_aa32_st8(tmp, addr, user);
9851                 break;
9852             case 1:
9853                 gen_aa32_st16(tmp, addr, user);
9854                 break;
9855             case 2:
9856                 gen_aa32_st32(tmp, addr, user);
9857                 break;
9858             default:
9859                 tcg_temp_free_i32(tmp);
9860                 tcg_temp_free_i32(addr);
9861                 goto illegal_op;
9862             }
9863             tcg_temp_free_i32(tmp);
9864         }
9865         if (postinc)
9866             tcg_gen_addi_i32(addr, addr, imm);
9867         if (writeback) {
9868             store_reg(s, rn, addr);
9869         } else {
9870             tcg_temp_free_i32(addr);
9871         }
9872         }
9873         break;
9874     default:
9875         goto illegal_op;
9876     }
9877     return 0;
9878 illegal_op:
9879     return 1;
9880 }
9881
9882 static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
9883 {
9884     uint32_t val, insn, op, rm, rn, rd, shift, cond;
9885     int32_t offset;
9886     int i;
9887     TCGv_i32 tmp;
9888     TCGv_i32 tmp2;
9889     TCGv_i32 addr;
9890
9891     if (s->condexec_mask) {
9892         cond = s->condexec_cond;
9893         if (cond != 0x0e) {     /* Skip conditional when condition is AL. */
9894           s->condlabel = gen_new_label();
9895           arm_gen_test_cc(cond ^ 1, s->condlabel);
9896           s->condjmp = 1;
9897         }
9898     }
9899
9900     insn = arm_lduw_code(env, s->pc, s->bswap_code);
9901     s->pc += 2;
9902
9903     switch (insn >> 12) {
9904     case 0: case 1:
9905
9906         rd = insn & 7;
9907         op = (insn >> 11) & 3;
9908         if (op == 3) {
9909             /* add/subtract */
9910             rn = (insn >> 3) & 7;
9911             tmp = load_reg(s, rn);
9912             if (insn & (1 << 10)) {
9913                 /* immediate */
9914                 tmp2 = tcg_temp_new_i32();
9915                 tcg_gen_movi_i32(tmp2, (insn >> 6) & 7);
9916             } else {
9917                 /* reg */
9918                 rm = (insn >> 6) & 7;
9919                 tmp2 = load_reg(s, rm);
9920             }
9921             if (insn & (1 << 9)) {
9922                 if (s->condexec_mask)
9923                     tcg_gen_sub_i32(tmp, tmp, tmp2);
9924                 else
9925                     gen_sub_CC(tmp, tmp, tmp2);
9926             } else {
9927                 if (s->condexec_mask)
9928                     tcg_gen_add_i32(tmp, tmp, tmp2);
9929                 else
9930                     gen_add_CC(tmp, tmp, tmp2);
9931             }
9932             tcg_temp_free_i32(tmp2);
9933             store_reg(s, rd, tmp);
9934         } else {
9935             /* shift immediate */
9936             rm = (insn >> 3) & 7;
9937             shift = (insn >> 6) & 0x1f;
9938             tmp = load_reg(s, rm);
9939             gen_arm_shift_im(tmp, op, shift, s->condexec_mask == 0);
9940             if (!s->condexec_mask)
9941                 gen_logic_CC(tmp);
9942             store_reg(s, rd, tmp);
9943         }
9944         break;
9945     case 2: case 3:
9946         /* arithmetic large immediate */
9947         op = (insn >> 11) & 3;
9948         rd = (insn >> 8) & 0x7;
9949         if (op == 0) { /* mov */
9950             tmp = tcg_temp_new_i32();
9951             tcg_gen_movi_i32(tmp, insn & 0xff);
9952             if (!s->condexec_mask)
9953                 gen_logic_CC(tmp);
9954             store_reg(s, rd, tmp);
9955         } else {
9956             tmp = load_reg(s, rd);
9957             tmp2 = tcg_temp_new_i32();
9958             tcg_gen_movi_i32(tmp2, insn & 0xff);
9959             switch (op) {
9960             case 1: /* cmp */
9961                 gen_sub_CC(tmp, tmp, tmp2);
9962                 tcg_temp_free_i32(tmp);
9963                 tcg_temp_free_i32(tmp2);
9964                 break;
9965             case 2: /* add */
9966                 if (s->condexec_mask)
9967                     tcg_gen_add_i32(tmp, tmp, tmp2);
9968                 else
9969                     gen_add_CC(tmp, tmp, tmp2);
9970                 tcg_temp_free_i32(tmp2);
9971                 store_reg(s, rd, tmp);
9972                 break;
9973             case 3: /* sub */
9974                 if (s->condexec_mask)
9975                     tcg_gen_sub_i32(tmp, tmp, tmp2);
9976                 else
9977                     gen_sub_CC(tmp, tmp, tmp2);
9978                 tcg_temp_free_i32(tmp2);
9979                 store_reg(s, rd, tmp);
9980                 break;
9981             }
9982         }
9983         break;
9984     case 4:
9985         if (insn & (1 << 11)) {
9986             rd = (insn >> 8) & 7;
9987             /* load pc-relative.  Bit 1 of PC is ignored.  */
9988             val = s->pc + 2 + ((insn & 0xff) * 4);
9989             val &= ~(uint32_t)2;
9990             addr = tcg_temp_new_i32();
9991             tcg_gen_movi_i32(addr, val);
9992             tmp = tcg_temp_new_i32();
9993             gen_aa32_ld32u(tmp, addr, IS_USER(s));
9994             tcg_temp_free_i32(addr);
9995             store_reg(s, rd, tmp);
9996             break;
9997         }
9998         if (insn & (1 << 10)) {
9999             /* data processing extended or blx */
10000             rd = (insn & 7) | ((insn >> 4) & 8);
10001             rm = (insn >> 3) & 0xf;
10002             op = (insn >> 8) & 3;
10003             switch (op) {
10004             case 0: /* add */
10005                 tmp = load_reg(s, rd);
10006                 tmp2 = load_reg(s, rm);
10007                 tcg_gen_add_i32(tmp, tmp, tmp2);
10008                 tcg_temp_free_i32(tmp2);
10009                 store_reg(s, rd, tmp);
10010                 break;
10011             case 1: /* cmp */
10012                 tmp = load_reg(s, rd);
10013                 tmp2 = load_reg(s, rm);
10014                 gen_sub_CC(tmp, tmp, tmp2);
10015                 tcg_temp_free_i32(tmp2);
10016                 tcg_temp_free_i32(tmp);
10017                 break;
10018             case 2: /* mov/cpy */
10019                 tmp = load_reg(s, rm);
10020                 store_reg(s, rd, tmp);
10021                 break;
10022             case 3:/* branch [and link] exchange thumb register */
10023                 tmp = load_reg(s, rm);
10024                 if (insn & (1 << 7)) {
10025                     ARCH(5);
10026                     val = (uint32_t)s->pc | 1;
10027                     tmp2 = tcg_temp_new_i32();
10028                     tcg_gen_movi_i32(tmp2, val);
10029                     store_reg(s, 14, tmp2);
10030                 }
10031                 /* already thumb, no need to check */
10032                 gen_bx(s, tmp);
10033                 break;
10034             }
10035             break;
10036         }
10037
10038         /* data processing register */
10039         rd = insn & 7;
10040         rm = (insn >> 3) & 7;
10041         op = (insn >> 6) & 0xf;
10042         if (op == 2 || op == 3 || op == 4 || op == 7) {
10043             /* the shift/rotate ops want the operands backwards */
10044             val = rm;
10045             rm = rd;
10046             rd = val;
10047             val = 1;
10048         } else {
10049             val = 0;
10050         }
10051
10052         if (op == 9) { /* neg */
10053             tmp = tcg_temp_new_i32();
10054             tcg_gen_movi_i32(tmp, 0);
10055         } else if (op != 0xf) { /* mvn doesn't read its first operand */
10056             tmp = load_reg(s, rd);
10057         } else {
10058             TCGV_UNUSED_I32(tmp);
10059         }
10060
10061         tmp2 = load_reg(s, rm);
10062         switch (op) {
10063         case 0x0: /* and */
10064             tcg_gen_and_i32(tmp, tmp, tmp2);
10065             if (!s->condexec_mask)
10066                 gen_logic_CC(tmp);
10067             break;
10068         case 0x1: /* eor */
10069             tcg_gen_xor_i32(tmp, tmp, tmp2);
10070             if (!s->condexec_mask)
10071                 gen_logic_CC(tmp);
10072             break;
10073         case 0x2: /* lsl */
10074             if (s->condexec_mask) {
10075                 gen_shl(tmp2, tmp2, tmp);
10076             } else {
10077                 gen_helper_shl_cc(tmp2, cpu_env, tmp2, tmp);
10078                 gen_logic_CC(tmp2);
10079             }
10080             break;
10081         case 0x3: /* lsr */
10082             if (s->condexec_mask) {
10083                 gen_shr(tmp2, tmp2, tmp);
10084             } else {
10085                 gen_helper_shr_cc(tmp2, cpu_env, tmp2, tmp);
10086                 gen_logic_CC(tmp2);
10087             }
10088             break;
10089         case 0x4: /* asr */
10090             if (s->condexec_mask) {
10091                 gen_sar(tmp2, tmp2, tmp);
10092             } else {
10093                 gen_helper_sar_cc(tmp2, cpu_env, tmp2, tmp);
10094                 gen_logic_CC(tmp2);
10095             }
10096             break;
10097         case 0x5: /* adc */
10098             if (s->condexec_mask) {
10099                 gen_adc(tmp, tmp2);
10100             } else {
10101                 gen_adc_CC(tmp, tmp, tmp2);
10102             }
10103             break;
10104         case 0x6: /* sbc */
10105             if (s->condexec_mask) {
10106                 gen_sub_carry(tmp, tmp, tmp2);
10107             } else {
10108                 gen_sbc_CC(tmp, tmp, tmp2);
10109             }
10110             break;
10111         case 0x7: /* ror */
10112             if (s->condexec_mask) {
10113                 tcg_gen_andi_i32(tmp, tmp, 0x1f);
10114                 tcg_gen_rotr_i32(tmp2, tmp2, tmp);
10115             } else {
10116                 gen_helper_ror_cc(tmp2, cpu_env, tmp2, tmp);
10117                 gen_logic_CC(tmp2);
10118             }
10119             break;
10120         case 0x8: /* tst */
10121             tcg_gen_and_i32(tmp, tmp, tmp2);
10122             gen_logic_CC(tmp);
10123             rd = 16;
10124             break;
10125         case 0x9: /* neg */
10126             if (s->condexec_mask)
10127                 tcg_gen_neg_i32(tmp, tmp2);
10128             else
10129                 gen_sub_CC(tmp, tmp, tmp2);
10130             break;
10131         case 0xa: /* cmp */
10132             gen_sub_CC(tmp, tmp, tmp2);
10133             rd = 16;
10134             break;
10135         case 0xb: /* cmn */
10136             gen_add_CC(tmp, tmp, tmp2);
10137             rd = 16;
10138             break;
10139         case 0xc: /* orr */
10140             tcg_gen_or_i32(tmp, tmp, tmp2);
10141             if (!s->condexec_mask)
10142                 gen_logic_CC(tmp);
10143             break;
10144         case 0xd: /* mul */
10145             tcg_gen_mul_i32(tmp, tmp, tmp2);
10146             if (!s->condexec_mask)
10147                 gen_logic_CC(tmp);
10148             break;
10149         case 0xe: /* bic */
10150             tcg_gen_andc_i32(tmp, tmp, tmp2);
10151             if (!s->condexec_mask)
10152                 gen_logic_CC(tmp);
10153             break;
10154         case 0xf: /* mvn */
10155             tcg_gen_not_i32(tmp2, tmp2);
10156             if (!s->condexec_mask)
10157                 gen_logic_CC(tmp2);
10158             val = 1;
10159             rm = rd;
10160             break;
10161         }
10162         if (rd != 16) {
10163             if (val) {
10164                 store_reg(s, rm, tmp2);
10165                 if (op != 0xf)
10166                     tcg_temp_free_i32(tmp);
10167             } else {
10168                 store_reg(s, rd, tmp);
10169                 tcg_temp_free_i32(tmp2);
10170             }
10171         } else {
10172             tcg_temp_free_i32(tmp);
10173             tcg_temp_free_i32(tmp2);
10174         }
10175         break;
10176
10177     case 5:
10178         /* load/store register offset.  */
10179         rd = insn & 7;
10180         rn = (insn >> 3) & 7;
10181         rm = (insn >> 6) & 7;
10182         op = (insn >> 9) & 7;
10183         addr = load_reg(s, rn);
10184         tmp = load_reg(s, rm);
10185         tcg_gen_add_i32(addr, addr, tmp);
10186         tcg_temp_free_i32(tmp);
10187
10188         if (op < 3) { /* store */
10189             tmp = load_reg(s, rd);
10190         } else {
10191             tmp = tcg_temp_new_i32();
10192         }
10193
10194         switch (op) {
10195         case 0: /* str */
10196             gen_aa32_st32(tmp, addr, IS_USER(s));
10197             break;
10198         case 1: /* strh */
10199             gen_aa32_st16(tmp, addr, IS_USER(s));
10200             break;
10201         case 2: /* strb */
10202             gen_aa32_st8(tmp, addr, IS_USER(s));
10203             break;
10204         case 3: /* ldrsb */
10205             gen_aa32_ld8s(tmp, addr, IS_USER(s));
10206             break;
10207         case 4: /* ldr */
10208             gen_aa32_ld32u(tmp, addr, IS_USER(s));
10209             break;
10210         case 5: /* ldrh */
10211             gen_aa32_ld16u(tmp, addr, IS_USER(s));
10212             break;
10213         case 6: /* ldrb */
10214             gen_aa32_ld8u(tmp, addr, IS_USER(s));
10215             break;
10216         case 7: /* ldrsh */
10217             gen_aa32_ld16s(tmp, addr, IS_USER(s));
10218             break;
10219         }
10220         if (op >= 3) { /* load */
10221             store_reg(s, rd, tmp);
10222         } else {
10223             tcg_temp_free_i32(tmp);
10224         }
10225         tcg_temp_free_i32(addr);
10226         break;
10227
10228     case 6:
10229         /* load/store word immediate offset */
10230         rd = insn & 7;
10231         rn = (insn >> 3) & 7;
10232         addr = load_reg(s, rn);
10233         val = (insn >> 4) & 0x7c;
10234         tcg_gen_addi_i32(addr, addr, val);
10235
10236         if (insn & (1 << 11)) {
10237             /* load */
10238             tmp = tcg_temp_new_i32();
10239             gen_aa32_ld32u(tmp, addr, IS_USER(s));
10240             store_reg(s, rd, tmp);
10241         } else {
10242             /* store */
10243             tmp = load_reg(s, rd);
10244             gen_aa32_st32(tmp, addr, IS_USER(s));
10245             tcg_temp_free_i32(tmp);
10246         }
10247         tcg_temp_free_i32(addr);
10248         break;
10249
10250     case 7:
10251         /* load/store byte immediate offset */
10252         rd = insn & 7;
10253         rn = (insn >> 3) & 7;
10254         addr = load_reg(s, rn);
10255         val = (insn >> 6) & 0x1f;
10256         tcg_gen_addi_i32(addr, addr, val);
10257
10258         if (insn & (1 << 11)) {
10259             /* load */
10260             tmp = tcg_temp_new_i32();
10261             gen_aa32_ld8u(tmp, addr, IS_USER(s));
10262             store_reg(s, rd, tmp);
10263         } else {
10264             /* store */
10265             tmp = load_reg(s, rd);
10266             gen_aa32_st8(tmp, addr, IS_USER(s));
10267             tcg_temp_free_i32(tmp);
10268         }
10269         tcg_temp_free_i32(addr);
10270         break;
10271
10272     case 8:
10273         /* load/store halfword immediate offset */
10274         rd = insn & 7;
10275         rn = (insn >> 3) & 7;
10276         addr = load_reg(s, rn);
10277         val = (insn >> 5) & 0x3e;
10278         tcg_gen_addi_i32(addr, addr, val);
10279
10280         if (insn & (1 << 11)) {
10281             /* load */
10282             tmp = tcg_temp_new_i32();
10283             gen_aa32_ld16u(tmp, addr, IS_USER(s));
10284             store_reg(s, rd, tmp);
10285         } else {
10286             /* store */
10287             tmp = load_reg(s, rd);
10288             gen_aa32_st16(tmp, addr, IS_USER(s));
10289             tcg_temp_free_i32(tmp);
10290         }
10291         tcg_temp_free_i32(addr);
10292         break;
10293
10294     case 9:
10295         /* load/store from stack */
10296         rd = (insn >> 8) & 7;
10297         addr = load_reg(s, 13);
10298         val = (insn & 0xff) * 4;
10299         tcg_gen_addi_i32(addr, addr, val);
10300
10301         if (insn & (1 << 11)) {
10302             /* load */
10303             tmp = tcg_temp_new_i32();
10304             gen_aa32_ld32u(tmp, addr, IS_USER(s));
10305             store_reg(s, rd, tmp);
10306         } else {
10307             /* store */
10308             tmp = load_reg(s, rd);
10309             gen_aa32_st32(tmp, addr, IS_USER(s));
10310             tcg_temp_free_i32(tmp);
10311         }
10312         tcg_temp_free_i32(addr);
10313         break;
10314
10315     case 10:
10316         /* add to high reg */
10317         rd = (insn >> 8) & 7;
10318         if (insn & (1 << 11)) {
10319             /* SP */
10320             tmp = load_reg(s, 13);
10321         } else {
10322             /* PC. bit 1 is ignored.  */
10323             tmp = tcg_temp_new_i32();
10324             tcg_gen_movi_i32(tmp, (s->pc + 2) & ~(uint32_t)2);
10325         }
10326         val = (insn & 0xff) * 4;
10327         tcg_gen_addi_i32(tmp, tmp, val);
10328         store_reg(s, rd, tmp);
10329         break;
10330
10331     case 11:
10332         /* misc */
10333         op = (insn >> 8) & 0xf;
10334         switch (op) {
10335         case 0:
10336             /* adjust stack pointer */
10337             tmp = load_reg(s, 13);
10338             val = (insn & 0x7f) * 4;
10339             if (insn & (1 << 7))
10340                 val = -(int32_t)val;
10341             tcg_gen_addi_i32(tmp, tmp, val);
10342             store_reg(s, 13, tmp);
10343             break;
10344
10345         case 2: /* sign/zero extend.  */
10346             ARCH(6);
10347             rd = insn & 7;
10348             rm = (insn >> 3) & 7;
10349             tmp = load_reg(s, rm);
10350             switch ((insn >> 6) & 3) {
10351             case 0: gen_sxth(tmp); break;
10352             case 1: gen_sxtb(tmp); break;
10353             case 2: gen_uxth(tmp); break;
10354             case 3: gen_uxtb(tmp); break;
10355             }
10356             store_reg(s, rd, tmp);
10357             break;
10358         case 4: case 5: case 0xc: case 0xd:
10359             /* push/pop */
10360             addr = load_reg(s, 13);
10361             if (insn & (1 << 8))
10362                 offset = 4;
10363             else
10364                 offset = 0;
10365             for (i = 0; i < 8; i++) {
10366                 if (insn & (1 << i))
10367                     offset += 4;
10368             }
10369             if ((insn & (1 << 11)) == 0) {
10370                 tcg_gen_addi_i32(addr, addr, -offset);
10371             }
10372             for (i = 0; i < 8; i++) {
10373                 if (insn & (1 << i)) {
10374                     if (insn & (1 << 11)) {
10375                         /* pop */
10376                         tmp = tcg_temp_new_i32();
10377                         gen_aa32_ld32u(tmp, addr, IS_USER(s));
10378                         store_reg(s, i, tmp);
10379                     } else {
10380                         /* push */
10381                         tmp = load_reg(s, i);
10382                         gen_aa32_st32(tmp, addr, IS_USER(s));
10383                         tcg_temp_free_i32(tmp);
10384                     }
10385                     /* advance to the next address.  */
10386                     tcg_gen_addi_i32(addr, addr, 4);
10387                 }
10388             }
10389             TCGV_UNUSED_I32(tmp);
10390             if (insn & (1 << 8)) {
10391                 if (insn & (1 << 11)) {
10392                     /* pop pc */
10393                     tmp = tcg_temp_new_i32();
10394                     gen_aa32_ld32u(tmp, addr, IS_USER(s));
10395                     /* don't set the pc until the rest of the instruction
10396                        has completed */
10397                 } else {
10398                     /* push lr */
10399                     tmp = load_reg(s, 14);
10400                     gen_aa32_st32(tmp, addr, IS_USER(s));
10401                     tcg_temp_free_i32(tmp);
10402                 }
10403                 tcg_gen_addi_i32(addr, addr, 4);
10404             }
10405             if ((insn & (1 << 11)) == 0) {
10406                 tcg_gen_addi_i32(addr, addr, -offset);
10407             }
10408             /* write back the new stack pointer */
10409             store_reg(s, 13, addr);
10410             /* set the new PC value */
10411             if ((insn & 0x0900) == 0x0900) {
10412                 store_reg_from_load(env, s, 15, tmp);
10413             }
10414             break;
10415
10416         case 1: case 3: case 9: case 11: /* czb */
10417             rm = insn & 7;
10418             tmp = load_reg(s, rm);
10419             s->condlabel = gen_new_label();
10420             s->condjmp = 1;
10421             if (insn & (1 << 11))
10422                 tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, s->condlabel);
10423             else
10424                 tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, s->condlabel);
10425             tcg_temp_free_i32(tmp);
10426             offset = ((insn & 0xf8) >> 2) | (insn & 0x200) >> 3;
10427             val = (uint32_t)s->pc + 2;
10428             val += offset;
10429             gen_jmp(s, val);
10430             break;
10431
10432         case 15: /* IT, nop-hint.  */
10433             if ((insn & 0xf) == 0) {
10434                 gen_nop_hint(s, (insn >> 4) & 0xf);
10435                 break;
10436             }
10437             /* If Then.  */
10438             s->condexec_cond = (insn >> 4) & 0xe;
10439             s->condexec_mask = insn & 0x1f;
10440             /* No actual code generated for this insn, just setup state.  */
10441             break;
10442
10443         case 0xe: /* bkpt */
10444             ARCH(5);
10445             gen_exception_insn(s, 2, EXCP_BKPT);
10446             break;
10447
10448         case 0xa: /* rev */
10449             ARCH(6);
10450             rn = (insn >> 3) & 0x7;
10451             rd = insn & 0x7;
10452             tmp = load_reg(s, rn);
10453             switch ((insn >> 6) & 3) {
10454             case 0: tcg_gen_bswap32_i32(tmp, tmp); break;
10455             case 1: gen_rev16(tmp); break;
10456             case 3: gen_revsh(tmp); break;
10457             default: goto illegal_op;
10458             }
10459             store_reg(s, rd, tmp);
10460             break;
10461
10462         case 6:
10463             switch ((insn >> 5) & 7) {
10464             case 2:
10465                 /* setend */
10466                 ARCH(6);
10467                 if (((insn >> 3) & 1) != s->bswap_code) {
10468                     /* Dynamic endianness switching not implemented. */
10469                     qemu_log_mask(LOG_UNIMP, "arm: unimplemented setend\n");
10470                     goto illegal_op;
10471                 }
10472                 break;
10473             case 3:
10474                 /* cps */
10475                 ARCH(6);
10476                 if (IS_USER(s)) {
10477                     break;
10478                 }
10479                 if (IS_M(env)) {
10480                     tmp = tcg_const_i32((insn & (1 << 4)) != 0);
10481                     /* FAULTMASK */
10482                     if (insn & 1) {
10483                         addr = tcg_const_i32(19);
10484                         gen_helper_v7m_msr(cpu_env, addr, tmp);
10485                         tcg_temp_free_i32(addr);
10486                     }
10487                     /* PRIMASK */
10488                     if (insn & 2) {
10489                         addr = tcg_const_i32(16);
10490                         gen_helper_v7m_msr(cpu_env, addr, tmp);
10491                         tcg_temp_free_i32(addr);
10492                     }
10493                     tcg_temp_free_i32(tmp);
10494                     gen_lookup_tb(s);
10495                 } else {
10496                     if (insn & (1 << 4)) {
10497                         shift = CPSR_A | CPSR_I | CPSR_F;
10498                     } else {
10499                         shift = 0;
10500                     }
10501                     gen_set_psr_im(s, ((insn & 7) << 6), 0, shift);
10502                 }
10503                 break;
10504             default:
10505                 goto undef;
10506             }
10507             break;
10508
10509         default:
10510             goto undef;
10511         }
10512         break;
10513
10514     case 12:
10515     {
10516         /* load/store multiple */
10517         TCGv_i32 loaded_var;
10518         TCGV_UNUSED_I32(loaded_var);
10519         rn = (insn >> 8) & 0x7;
10520         addr = load_reg(s, rn);
10521         for (i = 0; i < 8; i++) {
10522             if (insn & (1 << i)) {
10523                 if (insn & (1 << 11)) {
10524                     /* load */
10525                     tmp = tcg_temp_new_i32();
10526                     gen_aa32_ld32u(tmp, addr, IS_USER(s));
10527                     if (i == rn) {
10528                         loaded_var = tmp;
10529                     } else {
10530                         store_reg(s, i, tmp);
10531                     }
10532                 } else {
10533                     /* store */
10534                     tmp = load_reg(s, i);
10535                     gen_aa32_st32(tmp, addr, IS_USER(s));
10536                     tcg_temp_free_i32(tmp);
10537                 }
10538                 /* advance to the next address */
10539                 tcg_gen_addi_i32(addr, addr, 4);
10540             }
10541         }
10542         if ((insn & (1 << rn)) == 0) {
10543             /* base reg not in list: base register writeback */
10544             store_reg(s, rn, addr);
10545         } else {
10546             /* base reg in list: if load, complete it now */
10547             if (insn & (1 << 11)) {
10548                 store_reg(s, rn, loaded_var);
10549             }
10550             tcg_temp_free_i32(addr);
10551         }
10552         break;
10553     }
10554     case 13:
10555         /* conditional branch or swi */
10556         cond = (insn >> 8) & 0xf;
10557         if (cond == 0xe)
10558             goto undef;
10559
10560         if (cond == 0xf) {
10561             /* swi */
10562             gen_set_pc_im(s, s->pc);
10563             s->is_jmp = DISAS_SWI;
10564             break;
10565         }
10566         /* generate a conditional jump to next instruction */
10567         s->condlabel = gen_new_label();
10568         arm_gen_test_cc(cond ^ 1, s->condlabel);
10569         s->condjmp = 1;
10570
10571         /* jump to the offset */
10572         val = (uint32_t)s->pc + 2;
10573         offset = ((int32_t)insn << 24) >> 24;
10574         val += offset << 1;
10575         gen_jmp(s, val);
10576         break;
10577
10578     case 14:
10579         if (insn & (1 << 11)) {
10580             if (disas_thumb2_insn(env, s, insn))
10581               goto undef32;
10582             break;
10583         }
10584         /* unconditional branch */
10585         val = (uint32_t)s->pc;
10586         offset = ((int32_t)insn << 21) >> 21;
10587         val += (offset << 1) + 2;
10588         gen_jmp(s, val);
10589         break;
10590
10591     case 15:
10592         if (disas_thumb2_insn(env, s, insn))
10593             goto undef32;
10594         break;
10595     }
10596     return;
10597 undef32:
10598     gen_exception_insn(s, 4, EXCP_UDEF);
10599     return;
10600 illegal_op:
10601 undef:
10602     gen_exception_insn(s, 2, EXCP_UDEF);
10603 }
10604
10605 /* generate intermediate code in gen_opc_buf and gen_opparam_buf for
10606    basic block 'tb'. If search_pc is TRUE, also generate PC
10607    information for each intermediate instruction. */
10608 static inline void gen_intermediate_code_internal(ARMCPU *cpu,
10609                                                   TranslationBlock *tb,
10610                                                   bool search_pc)
10611 {
10612     CPUState *cs = CPU(cpu);
10613     CPUARMState *env = &cpu->env;
10614     DisasContext dc1, *dc = &dc1;
10615     CPUBreakpoint *bp;
10616     uint16_t *gen_opc_end;
10617     int j, lj;
10618     target_ulong pc_start;
10619     target_ulong next_page_start;
10620     int num_insns;
10621     int max_insns;
10622
10623     /* generate intermediate code */
10624
10625     /* The A64 decoder has its own top level loop, because it doesn't need
10626      * the A32/T32 complexity to do with conditional execution/IT blocks/etc.
10627      */
10628     if (ARM_TBFLAG_AARCH64_STATE(tb->flags)) {
10629         gen_intermediate_code_internal_a64(cpu, tb, search_pc);
10630         return;
10631     }
10632
10633     pc_start = tb->pc;
10634
10635     dc->tb = tb;
10636
10637     gen_opc_end = tcg_ctx.gen_opc_buf + OPC_MAX_SIZE;
10638
10639     dc->is_jmp = DISAS_NEXT;
10640     dc->pc = pc_start;
10641     dc->singlestep_enabled = cs->singlestep_enabled;
10642     dc->condjmp = 0;
10643
10644     dc->aarch64 = 0;
10645     dc->thumb = ARM_TBFLAG_THUMB(tb->flags);
10646     dc->bswap_code = ARM_TBFLAG_BSWAP_CODE(tb->flags);
10647     dc->condexec_mask = (ARM_TBFLAG_CONDEXEC(tb->flags) & 0xf) << 1;
10648     dc->condexec_cond = ARM_TBFLAG_CONDEXEC(tb->flags) >> 4;
10649 #if !defined(CONFIG_USER_ONLY)
10650     dc->user = (ARM_TBFLAG_PRIV(tb->flags) == 0);
10651 #endif
10652     dc->vfp_enabled = ARM_TBFLAG_VFPEN(tb->flags);
10653     dc->vec_len = ARM_TBFLAG_VECLEN(tb->flags);
10654     dc->vec_stride = ARM_TBFLAG_VECSTRIDE(tb->flags);
10655     dc->cp_regs = cpu->cp_regs;
10656     dc->current_pl = arm_current_pl(env);
10657
10658     cpu_F0s = tcg_temp_new_i32();
10659     cpu_F1s = tcg_temp_new_i32();
10660     cpu_F0d = tcg_temp_new_i64();
10661     cpu_F1d = tcg_temp_new_i64();
10662     cpu_V0 = cpu_F0d;
10663     cpu_V1 = cpu_F1d;
10664     /* FIXME: cpu_M0 can probably be the same as cpu_V0.  */
10665     cpu_M0 = tcg_temp_new_i64();
10666     next_page_start = (pc_start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
10667     lj = -1;
10668     num_insns = 0;
10669     max_insns = tb->cflags & CF_COUNT_MASK;
10670     if (max_insns == 0)
10671         max_insns = CF_COUNT_MASK;
10672
10673     gen_tb_start();
10674
10675     tcg_clear_temp_count();
10676
10677     /* A note on handling of the condexec (IT) bits:
10678      *
10679      * We want to avoid the overhead of having to write the updated condexec
10680      * bits back to the CPUARMState for every instruction in an IT block. So:
10681      * (1) if the condexec bits are not already zero then we write
10682      * zero back into the CPUARMState now. This avoids complications trying
10683      * to do it at the end of the block. (For example if we don't do this
10684      * it's hard to identify whether we can safely skip writing condexec
10685      * at the end of the TB, which we definitely want to do for the case
10686      * where a TB doesn't do anything with the IT state at all.)
10687      * (2) if we are going to leave the TB then we call gen_set_condexec()
10688      * which will write the correct value into CPUARMState if zero is wrong.
10689      * This is done both for leaving the TB at the end, and for leaving
10690      * it because of an exception we know will happen, which is done in
10691      * gen_exception_insn(). The latter is necessary because we need to
10692      * leave the TB with the PC/IT state just prior to execution of the
10693      * instruction which caused the exception.
10694      * (3) if we leave the TB unexpectedly (eg a data abort on a load)
10695      * then the CPUARMState will be wrong and we need to reset it.
10696      * This is handled in the same way as restoration of the
10697      * PC in these situations: we will be called again with search_pc=1
10698      * and generate a mapping of the condexec bits for each PC in
10699      * gen_opc_condexec_bits[]. restore_state_to_opc() then uses
10700      * this to restore the condexec bits.
10701      *
10702      * Note that there are no instructions which can read the condexec
10703      * bits, and none which can write non-static values to them, so
10704      * we don't need to care about whether CPUARMState is correct in the
10705      * middle of a TB.
10706      */
10707
10708     /* Reset the conditional execution bits immediately. This avoids
10709        complications trying to do it at the end of the block.  */
10710     if (dc->condexec_mask || dc->condexec_cond)
10711       {
10712         TCGv_i32 tmp = tcg_temp_new_i32();
10713         tcg_gen_movi_i32(tmp, 0);
10714         store_cpu_field(tmp, condexec_bits);
10715       }
10716     do {
10717 #ifdef CONFIG_USER_ONLY
10718         /* Intercept jump to the magic kernel page.  */
10719         if (dc->pc >= 0xffff0000) {
10720             /* We always get here via a jump, so know we are not in a
10721                conditional execution block.  */
10722             gen_exception(EXCP_KERNEL_TRAP);
10723             dc->is_jmp = DISAS_UPDATE;
10724             break;
10725         }
10726 #else
10727         if (dc->pc >= 0xfffffff0 && IS_M(env)) {
10728             /* We always get here via a jump, so know we are not in a
10729                conditional execution block.  */
10730             gen_exception(EXCP_EXCEPTION_EXIT);
10731             dc->is_jmp = DISAS_UPDATE;
10732             break;
10733         }
10734 #endif
10735
10736         if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
10737             QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
10738                 if (bp->pc == dc->pc) {
10739                     gen_exception_insn(dc, 0, EXCP_DEBUG);
10740                     /* Advance PC so that clearing the breakpoint will
10741                        invalidate this TB.  */
10742                     dc->pc += 2;
10743                     goto done_generating;
10744                 }
10745             }
10746         }
10747         if (search_pc) {
10748             j = tcg_ctx.gen_opc_ptr - tcg_ctx.gen_opc_buf;
10749             if (lj < j) {
10750                 lj++;
10751                 while (lj < j)
10752                     tcg_ctx.gen_opc_instr_start[lj++] = 0;
10753             }
10754             tcg_ctx.gen_opc_pc[lj] = dc->pc;
10755             gen_opc_condexec_bits[lj] = (dc->condexec_cond << 4) | (dc->condexec_mask >> 1);
10756             tcg_ctx.gen_opc_instr_start[lj] = 1;
10757             tcg_ctx.gen_opc_icount[lj] = num_insns;
10758         }
10759
10760         if (num_insns + 1 == max_insns && (tb->cflags & CF_LAST_IO))
10761             gen_io_start();
10762
10763         if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP | CPU_LOG_TB_OP_OPT))) {
10764             tcg_gen_debug_insn_start(dc->pc);
10765         }
10766
10767         if (dc->thumb) {
10768             disas_thumb_insn(env, dc);
10769             if (dc->condexec_mask) {
10770                 dc->condexec_cond = (dc->condexec_cond & 0xe)
10771                                    | ((dc->condexec_mask >> 4) & 1);
10772                 dc->condexec_mask = (dc->condexec_mask << 1) & 0x1f;
10773                 if (dc->condexec_mask == 0) {
10774                     dc->condexec_cond = 0;
10775                 }
10776             }
10777         } else {
10778             disas_arm_insn(env, dc);
10779         }
10780
10781         if (dc->condjmp && !dc->is_jmp) {
10782             gen_set_label(dc->condlabel);
10783             dc->condjmp = 0;
10784         }
10785
10786         if (tcg_check_temp_count()) {
10787             fprintf(stderr, "TCG temporary leak before "TARGET_FMT_lx"\n",
10788                     dc->pc);
10789         }
10790
10791         /* Translation stops when a conditional branch is encountered.
10792          * Otherwise the subsequent code could get translated several times.
10793          * Also stop translation when a page boundary is reached.  This
10794          * ensures prefetch aborts occur at the right place.  */
10795         num_insns ++;
10796     } while (!dc->is_jmp && tcg_ctx.gen_opc_ptr < gen_opc_end &&
10797              !cs->singlestep_enabled &&
10798              !singlestep &&
10799              dc->pc < next_page_start &&
10800              num_insns < max_insns);
10801
10802     if (tb->cflags & CF_LAST_IO) {
10803         if (dc->condjmp) {
10804             /* FIXME:  This can theoretically happen with self-modifying
10805                code.  */
10806             cpu_abort(env, "IO on conditional branch instruction");
10807         }
10808         gen_io_end();
10809     }
10810
10811     /* At this stage dc->condjmp will only be set when the skipped
10812        instruction was a conditional branch or trap, and the PC has
10813        already been written.  */
10814     if (unlikely(cs->singlestep_enabled)) {
10815         /* Make sure the pc is updated, and raise a debug exception.  */
10816         if (dc->condjmp) {
10817             gen_set_condexec(dc);
10818             if (dc->is_jmp == DISAS_SWI) {
10819                 gen_exception(EXCP_SWI);
10820             } else {
10821                 gen_exception(EXCP_DEBUG);
10822             }
10823             gen_set_label(dc->condlabel);
10824         }
10825         if (dc->condjmp || !dc->is_jmp) {
10826             gen_set_pc_im(dc, dc->pc);
10827             dc->condjmp = 0;
10828         }
10829         gen_set_condexec(dc);
10830         if (dc->is_jmp == DISAS_SWI && !dc->condjmp) {
10831             gen_exception(EXCP_SWI);
10832         } else {
10833             /* FIXME: Single stepping a WFI insn will not halt
10834                the CPU.  */
10835             gen_exception(EXCP_DEBUG);
10836         }
10837     } else {
10838         /* While branches must always occur at the end of an IT block,
10839            there are a few other things that can cause us to terminate
10840            the TB in the middle of an IT block:
10841             - Exception generating instructions (bkpt, swi, undefined).
10842             - Page boundaries.
10843             - Hardware watchpoints.
10844            Hardware breakpoints have already been handled and skip this code.
10845          */
10846         gen_set_condexec(dc);
10847         switch(dc->is_jmp) {
10848         case DISAS_NEXT:
10849             gen_goto_tb(dc, 1, dc->pc);
10850             break;
10851         default:
10852         case DISAS_JUMP:
10853         case DISAS_UPDATE:
10854             /* indicate that the hash table must be used to find the next TB */
10855             tcg_gen_exit_tb(0);
10856             break;
10857         case DISAS_TB_JUMP:
10858             /* nothing more to generate */
10859             break;
10860         case DISAS_WFI:
10861             gen_helper_wfi(cpu_env);
10862             break;
10863         case DISAS_WFE:
10864             gen_helper_wfe(cpu_env);
10865             break;
10866         case DISAS_SWI:
10867             gen_exception(EXCP_SWI);
10868             break;
10869         }
10870         if (dc->condjmp) {
10871             gen_set_label(dc->condlabel);
10872             gen_set_condexec(dc);
10873             gen_goto_tb(dc, 1, dc->pc);
10874             dc->condjmp = 0;
10875         }
10876     }
10877
10878 done_generating:
10879     gen_tb_end(tb, num_insns);
10880     *tcg_ctx.gen_opc_ptr = INDEX_op_end;
10881
10882 #ifdef DEBUG_DISAS
10883     if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)) {
10884         qemu_log("----------------\n");
10885         qemu_log("IN: %s\n", lookup_symbol(pc_start));
10886         log_target_disas(env, pc_start, dc->pc - pc_start,
10887                          dc->thumb | (dc->bswap_code << 1));
10888         qemu_log("\n");
10889     }
10890 #endif
10891     if (search_pc) {
10892         j = tcg_ctx.gen_opc_ptr - tcg_ctx.gen_opc_buf;
10893         lj++;
10894         while (lj <= j)
10895             tcg_ctx.gen_opc_instr_start[lj++] = 0;
10896     } else {
10897         tb->size = dc->pc - pc_start;
10898         tb->icount = num_insns;
10899     }
10900 }
10901
10902 void gen_intermediate_code(CPUARMState *env, TranslationBlock *tb)
10903 {
10904     gen_intermediate_code_internal(arm_env_get_cpu(env), tb, false);
10905 }
10906
10907 void gen_intermediate_code_pc(CPUARMState *env, TranslationBlock *tb)
10908 {
10909     gen_intermediate_code_internal(arm_env_get_cpu(env), tb, true);
10910 }
10911
10912 static const char *cpu_mode_names[16] = {
10913   "usr", "fiq", "irq", "svc", "???", "???", "???", "abt",
10914   "???", "???", "???", "und", "???", "???", "???", "sys"
10915 };
10916
10917 void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
10918                         int flags)
10919 {
10920     ARMCPU *cpu = ARM_CPU(cs);
10921     CPUARMState *env = &cpu->env;
10922     int i;
10923     uint32_t psr;
10924
10925     for(i=0;i<16;i++) {
10926         cpu_fprintf(f, "R%02d=%08x", i, env->regs[i]);
10927         if ((i % 4) == 3)
10928             cpu_fprintf(f, "\n");
10929         else
10930             cpu_fprintf(f, " ");
10931     }
10932     psr = cpsr_read(env);
10933     cpu_fprintf(f, "PSR=%08x %c%c%c%c %c %s%d\n",
10934                 psr,
10935                 psr & (1 << 31) ? 'N' : '-',
10936                 psr & (1 << 30) ? 'Z' : '-',
10937                 psr & (1 << 29) ? 'C' : '-',
10938                 psr & (1 << 28) ? 'V' : '-',
10939                 psr & CPSR_T ? 'T' : 'A',
10940                 cpu_mode_names[psr & 0xf], (psr & 0x10) ? 32 : 26);
10941
10942     if (flags & CPU_DUMP_FPU) {
10943         int numvfpregs = 0;
10944         if (arm_feature(env, ARM_FEATURE_VFP)) {
10945             numvfpregs += 16;
10946         }
10947         if (arm_feature(env, ARM_FEATURE_VFP3)) {
10948             numvfpregs += 16;
10949         }
10950         for (i = 0; i < numvfpregs; i++) {
10951             uint64_t v = float64_val(env->vfp.regs[i]);
10952             cpu_fprintf(f, "s%02d=%08x s%02d=%08x d%02d=%016" PRIx64 "\n",
10953                         i * 2, (uint32_t)v,
10954                         i * 2 + 1, (uint32_t)(v >> 32),
10955                         i, v);
10956         }
10957         cpu_fprintf(f, "FPSCR: %08x\n", (int)env->vfp.xregs[ARM_VFP_FPSCR]);
10958     }
10959 }
10960
10961 void restore_state_to_opc(CPUARMState *env, TranslationBlock *tb, int pc_pos)
10962 {
10963     if (is_a64(env)) {
10964         env->pc = tcg_ctx.gen_opc_pc[pc_pos];
10965         env->condexec_bits = 0;
10966     } else {
10967         env->regs[15] = tcg_ctx.gen_opc_pc[pc_pos];
10968         env->condexec_bits = gen_opc_condexec_bits[pc_pos];
10969     }
10970 }